diff --git a/[refs] b/[refs]
index bb2b2c22209b..df1a57ba3854 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5d8c397f304e1363f8ff9749b08172eb59e6534a
+refs/heads/master: 68d9102f76de7a923fb81c8b6de4764f8f50ed17
diff --git a/trunk/Documentation/feature-removal-schedule.txt b/trunk/Documentation/feature-removal-schedule.txt
index 0665cb12bd66..8b1430b46655 100644
--- a/trunk/Documentation/feature-removal-schedule.txt
+++ b/trunk/Documentation/feature-removal-schedule.txt
@@ -135,15 +135,3 @@ Why:	With the 16-bit PCMCIA subsystem now behaving (almost) like a
 	pcmciautils package available at
 	http://kernel.org/pub/linux/utils/kernel/pcmcia/
 Who:	Dominik Brodowski <linux@brodo.de>
-
----------------------------
-
-What:	ip_queue and ip6_queue (old ipv4-only and ipv6-only netfilter queue)
-When:	December 2005
-Why:	This interface has been obsoleted by the new layer3-independent
-	"nfnetlink_queue".  The Kernel interface is compatible, so the old
-	ip[6]tables "QUEUE" targets still work and will transparently handle
-	all packets into nfnetlink queue number 0.  Userspace users will have
-	to link against API-compatible library on top of libnfnetlink_queue 
-	instead of the current 'libipq'.
-Who:	Harald Welte <laforge@netfilter.org>
diff --git a/trunk/Documentation/networking/README.ipw2100 b/trunk/Documentation/networking/README.ipw2100
deleted file mode 100644
index 2046948b020d..000000000000
--- a/trunk/Documentation/networking/README.ipw2100
+++ /dev/null
@@ -1,246 +0,0 @@
-
-===========================
-Intel(R) PRO/Wireless 2100 Network Connection Driver for Linux
-README.ipw2100
-
-March 14, 2005
-
-===========================
-Index
----------------------------
-0. Introduction
-1. Release 1.1.0 Current Features
-2. Command Line Parameters
-3. Sysfs Helper Files
-4. Radio Kill Switch
-5. Dynamic Firmware
-6. Power Management
-7. Support
-8. License
-
-
-===========================
-0. Introduction
------------- -----   -----       ----       ---       --         -     
-
-This document provides a brief overview of the features supported by the 
-IPW2100 driver project.  The main project website, where the latest 
-development version of the driver can be found, is:
-
-	http://ipw2100.sourceforge.net
-
-There you can find the not only the latest releases, but also information about
-potential fixes and patches, as well as links to the development mailing list
-for the driver project.
-
-
-===========================
-1. Release 1.1.0 Current Supported Features
----------------------------     
-- Managed (BSS) and Ad-Hoc (IBSS)
-- WEP (shared key and open)
-- Wireless Tools support 
-- 802.1x (tested with XSupplicant 1.0.1)
-
-Enabled (but not supported) features:
-- Monitor/RFMon mode
-- WPA/WPA2
-
-The distinction between officially supported and enabled is a reflection
-on the amount of validation and interoperability testing that has been
-performed on a given feature.
-
-
-===========================
-2. Command Line Parameters
----------------------------     
-
-If the driver is built as a module, the following optional parameters are used
-by entering them on the command line with the modprobe command using this
-syntax:
-
-	modprobe ipw2100 [<option>=<VAL1><,VAL2>...]
-
-For example, to disable the radio on driver loading, enter:
-
-	modprobe ipw2100 disable=1
-
-The ipw2100 driver supports the following module parameters:
-
-Name		Value		Example:
-debug		0x0-0xffffffff	debug=1024
-mode		0,1,2		mode=1   /* AdHoc */
-channel		int		channel=3 /* Only valid in AdHoc or Monitor */
-associate	boolean		associate=0 /* Do NOT auto associate */
-disable		boolean		disable=1 /* Do not power the HW */
-
-
-===========================
-3. Sysfs Helper Files
----------------------------     
-
-There are several ways to control the behavior of the driver.  Many of the 
-general capabilities are exposed through the Wireless Tools (iwconfig).  There
-are a few capabilities that are exposed through entries in the Linux Sysfs.
-
-
------ Driver Level ------
-For the driver level files, look in /sys/bus/pci/drivers/ipw2100/
-
-  debug_level  
-	
-	This controls the same global as the 'debug' module parameter.  For 
-        information on the various debugging levels available, run the 'dvals'
-	script found in the driver source directory.
-
-	NOTE:  'debug_level' is only enabled if CONFIG_IPW2100_DEBUG is turn
-	       on.
-
------ Device Level ------
-For the device level files look in
-	
-	/sys/bus/pci/drivers/ipw2100/{PCI-ID}/
-
-For example:
-	/sys/bus/pci/drivers/ipw2100/0000:02:01.0
-
-For the device level files, see /sys/bus/pci/drivers/ipw2100:
-
-  rf_kill
-	read - 
-	0 = RF kill not enabled (radio on)
-	1 = SW based RF kill active (radio off)
-	2 = HW based RF kill active (radio off)
-	3 = Both HW and SW RF kill active (radio off)
-	write -
-	0 = If SW based RF kill active, turn the radio back on
-	1 = If radio is on, activate SW based RF kill
-
-	NOTE: If you enable the SW based RF kill and then toggle the HW
-  	based RF kill from ON -> OFF -> ON, the radio will NOT come back on
-
-
-===========================
-4. Radio Kill Switch
----------------------------
-Most laptops provide the ability for the user to physically disable the radio.
-Some vendors have implemented this as a physical switch that requires no
-software to turn the radio off and on.  On other laptops, however, the switch
-is controlled through a button being pressed and a software driver then making
-calls to turn the radio off and on.  This is referred to as a "software based
-RF kill switch"
-
-See the Sysfs helper file 'rf_kill' for determining the state of the RF switch
-on your system.
-
-
-===========================
-5. Dynamic Firmware
----------------------------     
-As the firmware is licensed under a restricted use license, it can not be 
-included within the kernel sources.  To enable the IPW2100 you will need a 
-firmware image to load into the wireless NIC's processors.
-
-You can obtain these images from <http://ipw2100.sf.net/firmware.php>.
-
-See INSTALL for instructions on installing the firmware.
-
-
-===========================
-6. Power Management
----------------------------     
-The IPW2100 supports the configuration of the Power Save Protocol 
-through a private wireless extension interface.  The IPW2100 supports 
-the following different modes:
-
-	off	No power management.  Radio is always on.
-	on	Automatic power management
-	1-5	Different levels of power management.  The higher the 
-		number the greater the power savings, but with an impact to 
-		packet latencies. 
-
-Power management works by powering down the radio after a certain 
-interval of time has passed where no packets are passed through the 
-radio.  Once powered down, the radio remains in that state for a given 
-period of time.  For higher power savings, the interval between last 
-packet processed to sleep is shorter and the sleep period is longer.
-
-When the radio is asleep, the access point sending data to the station 
-must buffer packets at the AP until the station wakes up and requests 
-any buffered packets.  If you have an AP that does not correctly support 
-the PSP protocol you may experience packet loss or very poor performance 
-while power management is enabled.  If this is the case, you will need 
-to try and find a firmware update for your AP, or disable power 
-management (via `iwconfig eth1 power off`)
-
-To configure the power level on the IPW2100 you use a combination of 
-iwconfig and iwpriv.  iwconfig is used to turn power management on, off, 
-and set it to auto.
-
-	iwconfig eth1 power off    Disables radio power down
-	iwconfig eth1 power on     Enables radio power management to 
-				   last set level (defaults to AUTO)
-	iwpriv eth1 set_power 0    Sets power level to AUTO and enables 
-				   power management if not previously 
-				   enabled.
-	iwpriv eth1 set_power 1-5  Set the power level as specified, 
-				   enabling power management if not 
-				   previously enabled.
-
-You can view the current power level setting via:
-	
-	iwpriv eth1 get_power
-
-It will return the current period or timeout that is configured as a string
-in the form of xxxx/yyyy (z) where xxxx is the timeout interval (amount of
-time after packet processing), yyyy is the period to sleep (amount of time to 
-wait before powering the radio and querying the access point for buffered
-packets), and z is the 'power level'.  If power management is turned off the
-xxxx/yyyy will be replaced with 'off' -- the level reported will be the active
-level if `iwconfig eth1 power on` is invoked.
-
-
-===========================
-7. Support
----------------------------     
-
-For general development information and support,
-go to:
-	
-    http://ipw2100.sf.net/
-
-The ipw2100 1.1.0 driver and firmware can be downloaded from:  
-
-    http://support.intel.com
-
-For installation support on the ipw2100 1.1.0 driver on Linux kernels 
-2.6.8 or greater, email support is available from:  
-
-    http://supportmail.intel.com
-
-===========================
-8. License
----------------------------     
-
-  Copyright(c) 2003 - 2005 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify it 
-  under the terms of the GNU General Public License (version 2) as 
-  published by the Free Software Foundation.
-  
-  This program is distributed in the hope that it will be useful, but WITHOUT 
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for 
-  more details.
-  
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59 
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-  
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-  
-  License Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
diff --git a/trunk/Documentation/networking/README.ipw2200 b/trunk/Documentation/networking/README.ipw2200
deleted file mode 100644
index 6916080c5f03..000000000000
--- a/trunk/Documentation/networking/README.ipw2200
+++ /dev/null
@@ -1,300 +0,0 @@
-
-Intel(R) PRO/Wireless 2915ABG Driver for Linux in support of:
-
-Intel(R) PRO/Wireless 2200BG Network Connection 
-Intel(R) PRO/Wireless 2915ABG Network Connection 
-
-Note: The Intel(R) PRO/Wireless 2915ABG Driver for Linux and Intel(R) 
-PRO/Wireless 2200BG Driver for Linux is a unified driver that works on 
-both hardware adapters listed above. In this document the Intel(R) 
-PRO/Wireless 2915ABG Driver for Linux will be used to reference the 
-unified driver.
-
-Copyright (C) 2004-2005, Intel Corporation
-
-README.ipw2200
-
-Version: 1.0.0
-Date   : January 31, 2005
-
-
-Index
------------------------------------------------
-1.   Introduction
-1.1. Overview of features
-1.2. Module parameters
-1.3. Wireless Extension Private Methods
-1.4. Sysfs Helper Files
-2.   About the Version Numbers
-3.   Support
-4.   License
-
-
-1.   Introduction
------------------------------------------------
-The following sections attempt to provide a brief introduction to using 
-the Intel(R) PRO/Wireless 2915ABG Driver for Linux.
-
-This document is not meant to be a comprehensive manual on 
-understanding or using wireless technologies, but should be sufficient 
-to get you moving without wires on Linux.
-
-For information on building and installing the driver, see the INSTALL
-file.
-
-
-1.1. Overview of Features
------------------------------------------------
-The current release (1.0.0) supports the following features:
-
-+ BSS mode (Infrastructure, Managed)
-+ IBSS mode (Ad-Hoc)
-+ WEP (OPEN and SHARED KEY mode)
-+ 802.1x EAP via wpa_supplicant and xsupplicant
-+ Wireless Extension support 
-+ Full B and G rate support (2200 and 2915)
-+ Full A rate support (2915 only)
-+ Transmit power control
-+ S state support (ACPI suspend/resume)
-+ long/short preamble support
-
-
-
-1.2. Command Line Parameters
------------------------------------------------
-
-Like many modules used in the Linux kernel, the Intel(R) PRO/Wireless 
-2915ABG Driver for Linux allows certain configuration options to be 
-provided as module parameters.  The most common way to specify a module 
-parameter is via the command line.  
-
-The general form is:
-
-% modprobe ipw2200 parameter=value
-
-Where the supported parameter are:
-
-  associate
-	Set to 0 to disable the auto scan-and-associate functionality of the
-	driver.  If disabled, the driver will not attempt to scan 
-	for and associate to a network until it has been configured with 
-	one or more properties for the target network, for example configuring 
-	the network SSID.  Default is 1 (auto-associate)
-	
-	Example: % modprobe ipw2200 associate=0
-
-  auto_create
-	Set to 0 to disable the auto creation of an Ad-Hoc network 
-	matching the channel and network name parameters provided.  
-	Default is 1.
-
-  channel
-	channel number for association.  The normal method for setting
-        the channel would be to use the standard wireless tools
-        (i.e. `iwconfig eth1 channel 10`), but it is useful sometimes
-	to set this while debugging.  Channel 0 means 'ANY'
-
-  debug
-	If using a debug build, this is used to control the amount of debug
-	info is logged.  See the 'dval' and 'load' script for more info on
-	how to use this (the dval and load scripts are provided as part 
-	of the ipw2200 development snapshot releases available from the 
-	SourceForge project at http://ipw2200.sf.net)
-
-  mode
-	Can be used to set the default mode of the adapter.  
-	0 = Managed, 1 = Ad-Hoc
-
-
-1.3. Wireless Extension Private Methods
------------------------------------------------
-
-As an interface designed to handle generic hardware, there are certain 
-capabilities not exposed through the normal Wireless Tool interface.  As 
-such, a provision is provided for a driver to declare custom, or 
-private, methods.  The Intel(R) PRO/Wireless 2915ABG Driver for Linux 
-defines several of these to configure various settings.
-
-The general form of using the private wireless methods is:
-
-	% iwpriv $IFNAME method parameters
-
-Where $IFNAME is the interface name the device is registered with 
-(typically eth1, customized via one of the various network interface
-name managers, such as ifrename)
-
-The supported private methods are:
-
-  get_mode
-	Can be used to report out which IEEE mode the driver is 
-	configured to support.  Example:
-	
-	% iwpriv eth1 get_mode
-	eth1	get_mode:802.11bg (6)
-
-  set_mode
-	Can be used to configure which IEEE mode the driver will 
-	support.  
-
-	Usage:
-	% iwpriv eth1 set_mode {mode}
-	Where {mode} is a number in the range 1-7:
-	1	802.11a (2915 only)
-	2	802.11b
-	3	802.11ab (2915 only)
-	4	802.11g 
-	5	802.11ag (2915 only)
-	6	802.11bg
-	7	802.11abg (2915 only)
-
-  get_preamble
-	Can be used to report configuration of preamble length.
-
-  set_preamble
-	Can be used to set the configuration of preamble length:
-
-	Usage:
-	% iwpriv eth1 set_preamble {mode}
-	Where {mode} is one of:
-	1	Long preamble only
-	0	Auto (long or short based on connection)
-	
-
-1.4. Sysfs Helper Files:
------------------------------------------------
-
-The Linux kernel provides a pseudo file system that can be used to 
-access various components of the operating system.  The Intel(R) 
-PRO/Wireless 2915ABG Driver for Linux exposes several configuration 
-parameters through this mechanism.
-
-An entry in the sysfs can support reading and/or writing.  You can 
-typically query the contents of a sysfs entry through the use of cat, 
-and can set the contents via echo.  For example:
-
-% cat /sys/bus/pci/drivers/ipw2200/debug_level
-
-Will report the current debug level of the driver's logging subsystem 
-(only available if CONFIG_IPW_DEBUG was configured when the driver was 
-built).
-
-You can set the debug level via:
-
-% echo $VALUE > /sys/bus/pci/drivers/ipw2200/debug_level
-
-Where $VALUE would be a number in the case of this sysfs entry.  The 
-input to sysfs files does not have to be a number.  For example, the 
-firmware loader used by hotplug utilizes sysfs entries for transferring 
-the firmware image from user space into the driver.
-
-The Intel(R) PRO/Wireless 2915ABG Driver for Linux exposes sysfs entries 
-at two levels -- driver level, which apply to all instances of the 
-driver (in the event that there are more than one device installed) and 
-device level, which applies only to the single specific instance.
-
-
-1.4.1 Driver Level Sysfs Helper Files
------------------------------------------------
-
-For the driver level files, look in /sys/bus/pci/drivers/ipw2200/
-
-  debug_level  
-	
-	This controls the same global as the 'debug' module parameter
-
-
-1.4.2 Device Level Sysfs Helper Files
------------------------------------------------
-
-For the device level files, look in
-	
-	/sys/bus/pci/drivers/ipw2200/{PCI-ID}/
-
-For example:
-	/sys/bus/pci/drivers/ipw2200/0000:02:01.0
-
-For the device level files, see /sys/bus/pci/[drivers/ipw2200:
-
-  rf_kill
-	read - 
-	0 = RF kill not enabled (radio on)
-	1 = SW based RF kill active (radio off)
-	2 = HW based RF kill active (radio off)
-	3 = Both HW and SW RF kill active (radio off)
-	write -
-	0 = If SW based RF kill active, turn the radio back on
-	1 = If radio is on, activate SW based RF kill
-
-	NOTE: If you enable the SW based RF kill and then toggle the HW
-  	based RF kill from ON -> OFF -> ON, the radio will NOT come back on
-	
-  ucode 
-	read-only access to the ucode version number
-
-
-2.   About the Version Numbers
------------------------------------------------
-
-Due to the nature of open source development projects, there are 
-frequently changes being incorporated that have not gone through 
-a complete validation process.  These changes are incorporated into 
-development snapshot releases.
-
-Releases are numbered with a three level scheme: 
-
-	major.minor.development
-
-Any version where the 'development' portion is 0 (for example
-1.0.0, 1.1.0, etc.) indicates a stable version that will be made 
-available for kernel inclusion.
-
-Any version where the 'development' portion is not a 0 (for
-example 1.0.1, 1.1.5, etc.) indicates a development version that is
-being made available for testing and cutting edge users.  The stability 
-and functionality of the development releases are not know.  We make
-efforts to try and keep all snapshots reasonably stable, but due to the
-frequency of their release, and the desire to get those releases 
-available as quickly as possible, unknown anomalies should be expected.
-
-The major version number will be incremented when significant changes
-are made to the driver.  Currently, there are no major changes planned.
-
-
-3.  Support
------------------------------------------------
-
-For installation support of the 1.0.0 version, you can contact 
-http://supportmail.intel.com, or you can use the open source project 
-support.
-
-For general information and support, go to:
-	
-    http://ipw2200.sf.net/
-
-
-4.  License
------------------------------------------------
-
-  Copyright(c) 2003 - 2005 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify it 
-  under the terms of the GNU General Public License version 2 as 
-  published by the Free Software Foundation.
-  
-  This program is distributed in the hope that it will be useful, but WITHOUT 
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for 
-  more details.
-  
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59 
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-  
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-  
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-
diff --git a/trunk/Documentation/networking/cxgb.txt b/trunk/Documentation/networking/cxgb.txt
deleted file mode 100644
index 76324638626b..000000000000
--- a/trunk/Documentation/networking/cxgb.txt
+++ /dev/null
@@ -1,352 +0,0 @@
-                 Chelsio N210 10Gb Ethernet Network Controller
-
-                         Driver Release Notes for Linux
-
-                                 Version 2.1.1
-
-                                 June 20, 2005
-
-CONTENTS
-========
- INTRODUCTION
- FEATURES
- PERFORMANCE
- DRIVER MESSAGES
- KNOWN ISSUES
- SUPPORT
-
-
-INTRODUCTION
-============
-
- This document describes the Linux driver for Chelsio 10Gb Ethernet Network
- Controller. This driver supports the Chelsio N210 NIC and is backward
- compatible with the Chelsio N110 model 10Gb NICs.
-
-
-FEATURES
-========
-
- Adaptive Interrupts (adaptive-rx)
- ---------------------------------
-
-  This feature provides an adaptive algorithm that adjusts the interrupt
-  coalescing parameters, allowing the driver to dynamically adapt the latency
-  settings to achieve the highest performance during various types of network
-  load.
-
-  The interface used to control this feature is ethtool. Please see the
-  ethtool manpage for additional usage information.
-
-  By default, adaptive-rx is disabled.
-  To enable adaptive-rx:
-
-      ethtool -C <interface> adaptive-rx on
-
-  To disable adaptive-rx, use ethtool:
-
-      ethtool -C <interface> adaptive-rx off
-
-  After disabling adaptive-rx, the timer latency value will be set to 50us.
-  You may set the timer latency after disabling adaptive-rx:
-
-      ethtool -C <interface> rx-usecs <microseconds>
-
-  An example to set the timer latency value to 100us on eth0:
-
-      ethtool -C eth0 rx-usecs 100
-
-  You may also provide a timer latency value while disabling adpative-rx:
-
-      ethtool -C <interface> adaptive-rx off rx-usecs <microseconds>
-
-  If adaptive-rx is disabled and a timer latency value is specified, the timer
-  will be set to the specified value until changed by the user or until
-  adaptive-rx is enabled.
-
-  To view the status of the adaptive-rx and timer latency values:
-
-      ethtool -c <interface>
-
-
- TCP Segmentation Offloading (TSO) Support
- -----------------------------------------
-
-  This feature, also known as "large send", enables a system's protocol stack
-  to offload portions of outbound TCP processing to a network interface card
-  thereby reducing system CPU utilization and enhancing performance.
-
-  The interface used to control this feature is ethtool version 1.8 or higher.
-  Please see the ethtool manpage for additional usage information.
-
-  By default, TSO is enabled.
-  To disable TSO:
-
-      ethtool -K <interface> tso off
-
-  To enable TSO:
-
-      ethtool -K <interface> tso on
-
-  To view the status of TSO:
-
-      ethtool -k <interface>
-
-
-PERFORMANCE
-===========
-
- The following information is provided as an example of how to change system
- parameters for "performance tuning" an what value to use. You may or may not
- want to change these system parameters, depending on your server/workstation
- application. Doing so is not warranted in any way by Chelsio Communications,
- and is done at "YOUR OWN RISK". Chelsio will not be held responsible for loss
- of data or damage to equipment.
-
- Your distribution may have a different way of doing things, or you may prefer
- a different method. These commands are shown only to provide an example of
- what to do and are by no means definitive.
-
- Making any of the following system changes will only last until you reboot
- your system. You may want to write a script that runs at boot-up which
- includes the optimal settings for your system.
-
-  Setting PCI Latency Timer:
-      setpci -d 1425:* 0x0c.l=0x0000F800
-
-  Disabling TCP timestamp:
-      sysctl -w net.ipv4.tcp_timestamps=0
-
-  Disabling SACK:
-      sysctl -w net.ipv4.tcp_sack=0
-
-  Setting large number of incoming connection requests:
-      sysctl -w net.ipv4.tcp_max_syn_backlog=3000
-
-  Setting maximum receive socket buffer size:
-      sysctl -w net.core.rmem_max=1024000
-
-  Setting maximum send socket buffer size:
-      sysctl -w net.core.wmem_max=1024000
-
-  Set smp_affinity (on a multiprocessor system) to a single CPU:
-      echo 1 > /proc/irq/<interrupt_number>/smp_affinity
-
-  Setting default receive socket buffer size:
-      sysctl -w net.core.rmem_default=524287
-
-  Setting default send socket buffer size:
-      sysctl -w net.core.wmem_default=524287
-
-  Setting maximum option memory buffers:
-      sysctl -w net.core.optmem_max=524287
-
-  Setting maximum backlog (# of unprocessed packets before kernel drops):
-      sysctl -w net.core.netdev_max_backlog=300000
-
-  Setting TCP read buffers (min/default/max):
-      sysctl -w net.ipv4.tcp_rmem="10000000 10000000 10000000"
-
-  Setting TCP write buffers (min/pressure/max):
-      sysctl -w net.ipv4.tcp_wmem="10000000 10000000 10000000"
-
-  Setting TCP buffer space (min/pressure/max):
-      sysctl -w net.ipv4.tcp_mem="10000000 10000000 10000000"
-
-  TCP window size for single connections:
-   The receive buffer (RX_WINDOW) size must be at least as large as the
-   Bandwidth-Delay Product of the communication link between the sender and
-   receiver. Due to the variations of RTT, you may want to increase the buffer
-   size up to 2 times the Bandwidth-Delay Product. Reference page 289 of
-   "TCP/IP Illustrated, Volume 1, The Protocols" by W. Richard Stevens.
-   At 10Gb speeds, use the following formula:
-       RX_WINDOW >= 1.25MBytes * RTT(in milliseconds)
-       Example for RTT with 100us: RX_WINDOW = (1,250,000 * 0.1) = 125,000
-   RX_WINDOW sizes of 256KB - 512KB should be sufficient.
-   Setting the min, max, and default receive buffer (RX_WINDOW) size:
-       sysctl -w net.ipv4.tcp_rmem="<min> <default> <max>"
-
-  TCP window size for multiple connections:
-   The receive buffer (RX_WINDOW) size may be calculated the same as single
-   connections, but should be divided by the number of connections. The
-   smaller window prevents congestion and facilitates better pacing,
-   especially if/when MAC level flow control does not work well or when it is
-   not supported on the machine. Experimentation may be necessary to attain
-   the correct value. This method is provided as a starting point fot the
-   correct receive buffer size.
-   Setting the min, max, and default receive buffer (RX_WINDOW) size is
-   performed in the same manner as single connection.
-
-
-DRIVER MESSAGES
-===============
-
- The following messages are the most common messages logged by syslog. These
- may be found in /var/log/messages.
-
-  Driver up:
-     Chelsio Network Driver - version 2.1.1
-
-  NIC detected:
-     eth#: Chelsio N210 1x10GBaseX NIC (rev #), PCIX 133MHz/64-bit
-
-  Link up:
-     eth#: link is up at 10 Gbps, full duplex
-
-  Link down:
-     eth#: link is down
-
-
-KNOWN ISSUES
-============
-
- These issues have been identified during testing. The following information
- is provided as a workaround to the problem. In some cases, this problem is
- inherent to Linux or to a particular Linux Distribution and/or hardware
- platform.
-
-  1. Large number of TCP retransmits on a multiprocessor (SMP) system.
-
-      On a system with multiple CPUs, the interrupt (IRQ) for the network
-      controller may be bound to more than one CPU. This will cause TCP
-      retransmits if the packet data were to be split across different CPUs
-      and re-assembled in a different order than expected.
-
-      To eliminate the TCP retransmits, set smp_affinity on the particular
-      interrupt to a single CPU. You can locate the interrupt (IRQ) used on
-      the N110/N210 by using ifconfig:
-          ifconfig <dev_name> | grep Interrupt
-      Set the smp_affinity to a single CPU:
-          echo 1 > /proc/irq/<interrupt_number>/smp_affinity
-
-      It is highly suggested that you do not run the irqbalance daemon on your
-      system, as this will change any smp_affinity setting you have applied.
-      The irqbalance daemon runs on a 10 second interval and binds interrupts
-      to the least loaded CPU determined by the daemon. To disable this daemon:
-          chkconfig --level 2345 irqbalance off
-
-      By default, some Linux distributions enable the kernel feature,
-      irqbalance, which performs the same function as the daemon. To disable
-      this feature, add the following line to your bootloader:
-          noirqbalance
-
-          Example using the Grub bootloader:
-              title Red Hat Enterprise Linux AS (2.4.21-27.ELsmp)
-              root (hd0,0)
-              kernel /vmlinuz-2.4.21-27.ELsmp ro root=/dev/hda3 noirqbalance
-              initrd /initrd-2.4.21-27.ELsmp.img
-
-  2. After running insmod, the driver is loaded and the incorrect network
-     interface is brought up without running ifup.
-
-      When using 2.4.x kernels, including RHEL kernels, the Linux kernel
-      invokes a script named "hotplug". This script is primarily used to
-      automatically bring up USB devices when they are plugged in, however,
-      the script also attempts to automatically bring up a network interface
-      after loading the kernel module. The hotplug script does this by scanning
-      the ifcfg-eth# config files in /etc/sysconfig/network-scripts, looking
-      for HWADDR=<mac_address>.
-
-      If the hotplug script does not find the HWADDRR within any of the
-      ifcfg-eth# files, it will bring up the device with the next available
-      interface name. If this interface is already configured for a different
-      network card, your new interface will have incorrect IP address and
-      network settings.
-
-      To solve this issue, you can add the HWADDR=<mac_address> key to the
-      interface config file of your network controller.
-
-      To disable this "hotplug" feature, you may add the driver (module name)
-      to the "blacklist" file located in /etc/hotplug. It has been noted that
-      this does not work for network devices because the net.agent script
-      does not use the blacklist file. Simply remove, or rename, the net.agent
-      script located in /etc/hotplug to disable this feature.
-
-  3. Transport Protocol (TP) hangs when running heavy multi-connection traffic
-     on an AMD Opteron system with HyperTransport PCI-X Tunnel chipset.
-
-      If your AMD Opteron system uses the AMD-8131 HyperTransport PCI-X Tunnel
-      chipset, you may experience the "133-Mhz Mode Split Completion Data
-      Corruption" bug identified by AMD while using a 133Mhz PCI-X card on the
-      bus PCI-X bus.
-
-      AMD states, "Under highly specific conditions, the AMD-8131 PCI-X Tunnel
-      can provide stale data via split completion cycles to a PCI-X card that
-      is operating at 133 Mhz", causing data corruption.
-
-      AMD's provides three workarounds for this problem, however, Chelsio
-      recommends the first option for best performance with this bug:
-
-        For 133Mhz secondary bus operation, limit the transaction length and
-        the number of outstanding transactions, via BIOS configuration
-        programming of the PCI-X card, to the following:
-
-           Data Length (bytes): 1k
-           Total allowed outstanding transactions: 2
-
-      Please refer to AMD 8131-HT/PCI-X Errata 26310 Rev 3.08 August 2004,
-      section 56, "133-MHz Mode Split Completion Data Corruption" for more
-      details with this bug and workarounds suggested by AMD.
-
-      It may be possible to work outside AMD's recommended PCI-X settings, try
-      increasing the Data Length to 2k bytes for increased performance. If you
-      have issues with these settings, please revert to the "safe" settings
-      and duplicate the problem before submitting a bug or asking for support.
-
-      NOTE: The default setting on most systems is 8 outstanding transactions
-            and 2k bytes data length.
-
-  4. On multiprocessor systems, it has been noted that an application which
-     is handling 10Gb networking can switch between CPUs causing degraded
-     and/or unstable performance.
-
-      If running on an SMP system and taking performance measurements, it
-      is suggested you either run the latest netperf-2.4.0+ or use a binding
-      tool such as Tim Hockin's procstate utilities (runon)
-      <http://www.hockin.org/~thockin/procstate/>.
-
-      Binding netserver and netperf (or other applications) to particular
-      CPUs will have a significant difference in performance measurements.
-      You may need to experiment which CPU to bind the application to in
-      order to achieve the best performance for your system.
-
-      If you are developing an application designed for 10Gb networking,
-      please keep in mind you may want to look at kernel functions
-      sched_setaffinity & sched_getaffinity to bind your application.
-
-      If you are just running user-space applications such as ftp, telnet,
-      etc., you may want to try the runon tool provided by Tim Hockin's
-      procstate utility. You could also try binding the interface to a
-      particular CPU: runon 0 ifup eth0
-
-
-SUPPORT
-=======
-
- If you have problems with the software or hardware, please contact our
- customer support team via email at support@chelsio.com or check our website
- at http://www.chelsio.com
-
-===============================================================================
-
- Chelsio Communications
- 370 San Aleso Ave.
- Suite 100
- Sunnyvale, CA 94085
- http://www.chelsio.com
-
-This program is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License, version 2, as
-published by the Free Software Foundation.
-
-You should have received a copy of the GNU General Public License along
-with this program; if not, write to the Free Software Foundation, Inc.,
-59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-
-THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
-WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-
- Copyright (c) 2003-2005 Chelsio Communications. All rights reserved.
-
-===============================================================================
diff --git a/trunk/Documentation/sound/alsa/ALSA-Configuration.txt b/trunk/Documentation/sound/alsa/ALSA-Configuration.txt
index 5c49ba07e709..a18ecb92b356 100644
--- a/trunk/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/trunk/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -132,7 +132,6 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     mpu_irq	- IRQ # for MPU-401 UART (PnP setup)
     dma1	- first DMA # for AD1816A chip (PnP setup)
     dma2	- second DMA # for AD1816A chip (PnP setup)
-    clockfreq   - Clock frequency for AD1816A chip (default = 0, 33000Hz)
     
     Module supports up to 8 cards, autoprobe and PnP.
     
diff --git a/trunk/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl b/trunk/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
index 0475478c2484..db0b7d2dc477 100644
--- a/trunk/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
+++ b/trunk/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
@@ -3422,17 +3422,10 @@ struct _snd_pcm_runtime {
 
       <para>
         The <structfield>iface</structfield> field specifies the type of
-      the control, <constant>SNDRV_CTL_ELEM_IFACE_XXX</constant>, which
-      is usually <constant>MIXER</constant>.
-      Use <constant>CARD</constant> for global controls that are not
-      logically part of the mixer.
-      If the control is closely associated with some specific device on
-      the sound card, use <constant>HWDEP</constant>,
-      <constant>PCM</constant>, <constant>RAWMIDI</constant>,
-      <constant>TIMER</constant>, or <constant>SEQUENCER</constant>, and
-      specify the device number with the
-      <structfield>device</structfield> and
-      <structfield>subdevice</structfield> fields.
+      the control,
+      <constant>SNDRV_CTL_ELEM_IFACE_XXX</constant>. There are
+      <constant>MIXER</constant>, <constant>PCM</constant>,
+      <constant>CARD</constant>, etc.
       </para>
 
       <para>
diff --git a/trunk/MAINTAINERS b/trunk/MAINTAINERS
index 671e32905d28..564a03e61a0c 100644
--- a/trunk/MAINTAINERS
+++ b/trunk/MAINTAINERS
@@ -991,13 +991,6 @@ M:	mike.miller@hp.com
 L:	iss_storagedev@hp.com
 S:	Supported
  
-HOST AP DRIVER
-P:	Jouni Malinen
-M:	jkmaline@cc.hut.fi
-L:	hostap@shmoo.com
-W:	http://hostap.epitest.fi/
-S:	Maintained
-
 HP100:	Driver for HP 10/100 Mbit/s Voice Grade Network Adapter Series
 P:	Jaroslav Kysela
 M:	perex@suse.cz
@@ -2099,12 +2092,6 @@ M:	support@simtec.co.uk
 W:	http://www.simtec.co.uk/products/EB2410ITX/
 S:	Supported
 
-SIS 190 ETHERNET DRIVER
-P:	Francois Romieu
-M:	romieu@fr.zoreil.com
-L:	netdev@vger.kernel.org
-S:	Maintained
-
 SIS 5513 IDE CONTROLLER DRIVER
 P:	Lionel Bouton
 M:	Lionel.Bouton@inet6.fr
diff --git a/trunk/arch/arm/kernel/calls.S b/trunk/arch/arm/kernel/calls.S
index 2b6b4c786e65..db07ce42b3b2 100644
--- a/trunk/arch/arm/kernel/calls.S
+++ b/trunk/arch/arm/kernel/calls.S
@@ -284,7 +284,7 @@ __syscall_start:
 		.long	sys_fstatfs64
 		.long	sys_tgkill
 		.long	sys_utimes
-/* 270 */	.long	sys_fadvise64_64
+/* 270 */	.long	sys_arm_fadvise64_64_wrapper
 		.long	sys_pciconfig_iobase
 		.long	sys_pciconfig_read
 		.long	sys_pciconfig_write
diff --git a/trunk/arch/arm/kernel/entry-common.S b/trunk/arch/arm/kernel/entry-common.S
index 3f8d0e3aefab..6281d488ac97 100644
--- a/trunk/arch/arm/kernel/entry-common.S
+++ b/trunk/arch/arm/kernel/entry-common.S
@@ -265,6 +265,10 @@ sys_futex_wrapper:
 		str	r5, [sp, #4]		@ push sixth arg
 		b	sys_futex
 
+sys_arm_fadvise64_64_wrapper:
+		str	r5, [sp, #4]		@ push r5 to stack
+		b	sys_arm_fadvise64_64
+
 /*
  * Note: off_4k (r5) is always units of 4K.  If we can't do the requested
  * offset, we return EINVAL.
diff --git a/trunk/arch/arm/kernel/sys_arm.c b/trunk/arch/arm/kernel/sys_arm.c
index f897ce2ccf0d..42629ff84f5a 100644
--- a/trunk/arch/arm/kernel/sys_arm.c
+++ b/trunk/arch/arm/kernel/sys_arm.c
@@ -311,3 +311,13 @@ long execve(const char *filename, char **argv, char **envp)
 	return ret;
 }
 EXPORT_SYMBOL(execve);
+
+/*
+ * Since loff_t is a 64 bit type we avoid a lot of ABI hastle
+ * with a different argument ordering.
+ */
+asmlinkage long sys_arm_fadvise64_64(int fd, int advice,
+				     loff_t offset, loff_t len)
+{
+	return sys_fadvise64_64(fd, offset, len, advice);
+}
diff --git a/trunk/arch/i386/pci/common.c b/trunk/arch/i386/pci/common.c
index c96bea14b98f..ade5bc57c34c 100644
--- a/trunk/arch/i386/pci/common.c
+++ b/trunk/arch/i386/pci/common.c
@@ -165,6 +165,7 @@ static int __init pcibios_init(void)
 	if ((pci_probe & PCI_BIOS_SORT) && !(pci_probe & PCI_NO_SORT))
 		pcibios_sort();
 #endif
+	pci_assign_unassigned_resources();
 	return 0;
 }
 
diff --git a/trunk/arch/i386/pci/i386.c b/trunk/arch/i386/pci/i386.c
index 3cc480998a47..93a364c82150 100644
--- a/trunk/arch/i386/pci/i386.c
+++ b/trunk/arch/i386/pci/i386.c
@@ -170,26 +170,43 @@ static void __init pcibios_allocate_resources(int pass)
 static int __init pcibios_assign_resources(void)
 {
 	struct pci_dev *dev = NULL;
-	struct resource *r, *pr;
+	int idx;
+	struct resource *r;
 
-	if (!(pci_probe & PCI_ASSIGN_ROMS)) {
-		/* Try to use BIOS settings for ROMs, otherwise let
-		   pci_assign_unassigned_resources() allocate the new
-		   addresses. */
-		for_each_pci_dev(dev) {
-			r = &dev->resource[PCI_ROM_RESOURCE];
-			if (!r->flags || !r->start)
+	for_each_pci_dev(dev) {
+		int class = dev->class >> 8;
+
+		/* Don't touch classless devices and host bridges */
+		if (!class || class == PCI_CLASS_BRIDGE_HOST)
+			continue;
+
+		for(idx=0; idx<6; idx++) {
+			r = &dev->resource[idx];
+
+			/*
+			 *  Don't touch IDE controllers and I/O ports of video cards!
+			 */
+			if ((class == PCI_CLASS_STORAGE_IDE && idx < 4) ||
+			    (class == PCI_CLASS_DISPLAY_VGA && (r->flags & IORESOURCE_IO)))
 				continue;
-			pr = pci_find_parent_resource(dev, r);
-			if (!pr || request_resource(pr, r) < 0) {
-				r->end -= r->start;
-				r->start = 0;
-			}
-		}
-	}
 
-	pci_assign_unassigned_resources();
+			/*
+			 *  We shall assign a new address to this resource, either because
+			 *  the BIOS forgot to do so or because we have decided the old
+			 *  address was unusable for some reason.
+			 */
+			if (!r->start && r->end)
+				pci_assign_resource(dev, idx);
+		}
 
+		if (pci_probe & PCI_ASSIGN_ROMS) {
+			r = &dev->resource[PCI_ROM_RESOURCE];
+			r->end -= r->start;
+			r->start = 0;
+			if (r->end)
+				pci_assign_resource(dev, PCI_ROM_RESOURCE);
+		}
+	}
 	return 0;
 }
 
diff --git a/trunk/arch/ia64/Kconfig b/trunk/arch/ia64/Kconfig
index 3deced637f07..80988136f26d 100644
--- a/trunk/arch/ia64/Kconfig
+++ b/trunk/arch/ia64/Kconfig
@@ -383,12 +383,6 @@ source "drivers/acpi/Kconfig"
 
 endif
 
-if PM
-
-source "arch/ia64/kernel/cpufreq/Kconfig"
-
-endif
-
 endmenu
 
 if !IA64_HP_SIM
diff --git a/trunk/arch/ia64/hp/sim/boot/fw-emu.c b/trunk/arch/ia64/hp/sim/boot/fw-emu.c
index 30fdfb1d0a53..5c46928e3dc6 100644
--- a/trunk/arch/ia64/hp/sim/boot/fw-emu.c
+++ b/trunk/arch/ia64/hp/sim/boot/fw-emu.c
@@ -237,6 +237,17 @@ sal_emulator (long index, unsigned long in1, unsigned long in2,
 	return ((struct sal_ret_values) {status, r9, r10, r11});
 }
 
+
+/*
+ * This is here to work around a bug in egcs-1.1.1b that causes the
+ * compiler to crash (seems like a bug in the new alias analysis code.
+ */
+void *
+id (long addr)
+{
+	return (void *) addr;
+}
+
 struct ia64_boot_param *
 sys_fw_init (const char *args, int arglen)
 {
diff --git a/trunk/arch/ia64/ia32/ia32_signal.c b/trunk/arch/ia64/ia32/ia32_signal.c
index aa891c9bc9b6..ebb89be2aa2d 100644
--- a/trunk/arch/ia64/ia32/ia32_signal.c
+++ b/trunk/arch/ia64/ia32/ia32_signal.c
@@ -29,6 +29,7 @@
 #include <asm/uaccess.h>
 #include <asm/rse.h>
 #include <asm/sigcontext.h>
+#include <asm/segment.h>
 
 #include "ia32priv.h"
 
diff --git a/trunk/arch/ia64/kernel/Makefile b/trunk/arch/ia64/kernel/Makefile
index b242594be55b..e1fb68ddec26 100644
--- a/trunk/arch/ia64/kernel/Makefile
+++ b/trunk/arch/ia64/kernel/Makefile
@@ -20,7 +20,6 @@ obj-$(CONFIG_SMP)		+= smp.o smpboot.o domain.o
 obj-$(CONFIG_NUMA)		+= numa.o
 obj-$(CONFIG_PERFMON)		+= perfmon_default_smpl.o
 obj-$(CONFIG_IA64_CYCLONE)	+= cyclone.o
-obj-$(CONFIG_CPU_FREQ)		+= cpufreq/
 obj-$(CONFIG_IA64_MCA_RECOVERY)	+= mca_recovery.o
 obj-$(CONFIG_KPROBES)		+= kprobes.o jprobes.o
 obj-$(CONFIG_IA64_UNCACHED_ALLOCATOR)	+= uncached.o
diff --git a/trunk/arch/ia64/kernel/cpufreq/Kconfig b/trunk/arch/ia64/kernel/cpufreq/Kconfig
deleted file mode 100644
index 2d9d5279b981..000000000000
--- a/trunk/arch/ia64/kernel/cpufreq/Kconfig
+++ /dev/null
@@ -1,29 +0,0 @@
-
-#
-# CPU Frequency scaling
-#
-
-menu "CPU Frequency scaling"
-
-source "drivers/cpufreq/Kconfig"
-
-if CPU_FREQ
-
-comment "CPUFreq processor drivers"
-
-config IA64_ACPI_CPUFREQ
-	tristate "ACPI Processor P-States driver"
-	select CPU_FREQ_TABLE
-	depends on ACPI_PROCESSOR
-	help
-	This driver adds a CPUFreq driver which utilizes the ACPI
-	Processor Performance States.
-
-	For details, take a look at <file:Documentation/cpu-freq/>.
-
-	If in doubt, say N.
-
-endif   # CPU_FREQ
-
-endmenu
-
diff --git a/trunk/arch/ia64/kernel/cpufreq/Makefile b/trunk/arch/ia64/kernel/cpufreq/Makefile
deleted file mode 100644
index f748d34c02f0..000000000000
--- a/trunk/arch/ia64/kernel/cpufreq/Makefile
+++ /dev/null
@@ -1 +0,0 @@
-obj-$(CONFIG_IA64_ACPI_CPUFREQ)		+= acpi-cpufreq.o
diff --git a/trunk/arch/ia64/kernel/cpufreq/acpi-cpufreq.c b/trunk/arch/ia64/kernel/cpufreq/acpi-cpufreq.c
deleted file mode 100644
index da4d5cf80a48..000000000000
--- a/trunk/arch/ia64/kernel/cpufreq/acpi-cpufreq.c
+++ /dev/null
@@ -1,499 +0,0 @@
-/*
- * arch/ia64/kernel/cpufreq/acpi-cpufreq.c
- * This file provides the ACPI based P-state support. This
- * module works with generic cpufreq infrastructure. Most of
- * the code is based on i386 version
- * (arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c)
- *
- * Copyright (C) 2005 Intel Corp
- *      Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
- */
-
-#include <linux/config.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/cpufreq.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <asm/io.h>
-#include <asm/uaccess.h>
-#include <asm/pal.h>
-
-#include <linux/acpi.h>
-#include <acpi/processor.h>
-
-#define dprintk(msg...) cpufreq_debug_printk(CPUFREQ_DEBUG_DRIVER, "acpi-cpufreq", msg)
-
-MODULE_AUTHOR("Venkatesh Pallipadi");
-MODULE_DESCRIPTION("ACPI Processor P-States Driver");
-MODULE_LICENSE("GPL");
-
-
-struct cpufreq_acpi_io {
-	struct acpi_processor_performance	acpi_data;
-	struct cpufreq_frequency_table		*freq_table;
-	unsigned int				resume;
-};
-
-static struct cpufreq_acpi_io	*acpi_io_data[NR_CPUS];
-
-static struct cpufreq_driver acpi_cpufreq_driver;
-
-
-static int
-processor_set_pstate (
-	u32	value)
-{
-	s64 retval;
-
-	dprintk("processor_set_pstate\n");
-
-	retval = ia64_pal_set_pstate((u64)value);
-
-	if (retval) {
-		dprintk("Failed to set freq to 0x%x, with error 0x%x\n",
-		        value, retval);
-		return -ENODEV;
-	}
-	return (int)retval;
-}
-
-
-static int
-processor_get_pstate (
-	u32	*value)
-{
-	u64	pstate_index = 0;
-	s64 	retval;
-
-	dprintk("processor_get_pstate\n");
-
-	retval = ia64_pal_get_pstate(&pstate_index);
-	*value = (u32) pstate_index;
-
-	if (retval)
-		dprintk("Failed to get current freq with "
-		        "error 0x%x, idx 0x%x\n", retval, *value);
-
-	return (int)retval;
-}
-
-
-/* To be used only after data->acpi_data is initialized */
-static unsigned
-extract_clock (
-	struct cpufreq_acpi_io *data,
-	unsigned value,
-	unsigned int cpu)
-{
-	unsigned long i;
-
-	dprintk("extract_clock\n");
-
-	for (i = 0; i < data->acpi_data.state_count; i++) {
-		if (value >= data->acpi_data.states[i].control)
-			return data->acpi_data.states[i].core_frequency;
-	}
-	return data->acpi_data.states[i-1].core_frequency;
-}
-
-
-static unsigned int
-processor_get_freq (
-	struct cpufreq_acpi_io	*data,
-	unsigned int		cpu)
-{
-	int			ret = 0;
-	u32			value = 0;
-	cpumask_t		saved_mask;
-	unsigned long 		clock_freq;
-
-	dprintk("processor_get_freq\n");
-
-	saved_mask = current->cpus_allowed;
-	set_cpus_allowed(current, cpumask_of_cpu(cpu));
-	if (smp_processor_id() != cpu) {
-		ret = -EAGAIN;
-		goto migrate_end;
-	}
-
-	/*
-	 * processor_get_pstate gets the average frequency since the
-	 * last get. So, do two PAL_get_freq()...
-	 */
-	ret = processor_get_pstate(&value);
-	ret = processor_get_pstate(&value);
-
-	if (ret) {
-		set_cpus_allowed(current, saved_mask);
-		printk(KERN_WARNING "get performance failed with error %d\n",
-		       ret);
-		ret = -EAGAIN;
-		goto migrate_end;
-	}
-	clock_freq = extract_clock(data, value, cpu);
-	ret = (clock_freq*1000);
-
-migrate_end:
-	set_cpus_allowed(current, saved_mask);
-	return ret;
-}
-
-
-static int
-processor_set_freq (
-	struct cpufreq_acpi_io	*data,
-	unsigned int		cpu,
-	int			state)
-{
-	int			ret = 0;
-	u32			value = 0;
-	struct cpufreq_freqs    cpufreq_freqs;
-	cpumask_t		saved_mask;
-	int			retval;
-
-	dprintk("processor_set_freq\n");
-
-	saved_mask = current->cpus_allowed;
-	set_cpus_allowed(current, cpumask_of_cpu(cpu));
-	if (smp_processor_id() != cpu) {
-		retval = -EAGAIN;
-		goto migrate_end;
-	}
-
-	if (state == data->acpi_data.state) {
-		if (unlikely(data->resume)) {
-			dprintk("Called after resume, resetting to P%d\n", state);
-			data->resume = 0;
-		} else {
-			dprintk("Already at target state (P%d)\n", state);
-			retval = 0;
-			goto migrate_end;
-		}
-	}
-
-	dprintk("Transitioning from P%d to P%d\n",
-		data->acpi_data.state, state);
-
-	/* cpufreq frequency struct */
-	cpufreq_freqs.cpu = cpu;
-	cpufreq_freqs.old = data->freq_table[data->acpi_data.state].frequency;
-	cpufreq_freqs.new = data->freq_table[state].frequency;
-
-	/* notify cpufreq */
-	cpufreq_notify_transition(&cpufreq_freqs, CPUFREQ_PRECHANGE);
-
-	/*
-	 * First we write the target state's 'control' value to the
-	 * control_register.
-	 */
-
-	value = (u32) data->acpi_data.states[state].control;
-
-	dprintk("Transitioning to state: 0x%08x\n", value);
-
-	ret = processor_set_pstate(value);
-	if (ret) {
-		unsigned int tmp = cpufreq_freqs.new;
-		cpufreq_notify_transition(&cpufreq_freqs, CPUFREQ_POSTCHANGE);
-		cpufreq_freqs.new = cpufreq_freqs.old;
-		cpufreq_freqs.old = tmp;
-		cpufreq_notify_transition(&cpufreq_freqs, CPUFREQ_PRECHANGE);
-		cpufreq_notify_transition(&cpufreq_freqs, CPUFREQ_POSTCHANGE);
-		printk(KERN_WARNING "Transition failed with error %d\n", ret);
-		retval = -ENODEV;
-		goto migrate_end;
-	}
-
-	cpufreq_notify_transition(&cpufreq_freqs, CPUFREQ_POSTCHANGE);
-
-	data->acpi_data.state = state;
-
-	retval = 0;
-
-migrate_end:
-	set_cpus_allowed(current, saved_mask);
-	return (retval);
-}
-
-
-static unsigned int
-acpi_cpufreq_get (
-	unsigned int		cpu)
-{
-	struct cpufreq_acpi_io *data = acpi_io_data[cpu];
-
-	dprintk("acpi_cpufreq_get\n");
-
-	return processor_get_freq(data, cpu);
-}
-
-
-static int
-acpi_cpufreq_target (
-	struct cpufreq_policy   *policy,
-	unsigned int target_freq,
-	unsigned int relation)
-{
-	struct cpufreq_acpi_io *data = acpi_io_data[policy->cpu];
-	unsigned int next_state = 0;
-	unsigned int result = 0;
-
-	dprintk("acpi_cpufreq_setpolicy\n");
-
-	result = cpufreq_frequency_table_target(policy,
-			data->freq_table, target_freq, relation, &next_state);
-	if (result)
-		return (result);
-
-	result = processor_set_freq(data, policy->cpu, next_state);
-
-	return (result);
-}
-
-
-static int
-acpi_cpufreq_verify (
-	struct cpufreq_policy   *policy)
-{
-	unsigned int result = 0;
-	struct cpufreq_acpi_io *data = acpi_io_data[policy->cpu];
-
-	dprintk("acpi_cpufreq_verify\n");
-
-	result = cpufreq_frequency_table_verify(policy,
-			data->freq_table);
-
-	return (result);
-}
-
-
-/*
- * processor_init_pdc - let BIOS know about the SMP capabilities
- * of this driver
- * @perf: processor-specific acpi_io_data struct
- * @cpu: CPU being initialized
- *
- * To avoid issues with legacy OSes, some BIOSes require to be informed of
- * the SMP capabilities of OS P-state driver. Here we set the bits in _PDC
- * accordingly. Actual call to _PDC is done in driver/acpi/processor.c
- */
-static void
-processor_init_pdc (
-		struct acpi_processor_performance *perf,
-		unsigned int cpu,
-		struct acpi_object_list *obj_list
-		)
-{
-	union acpi_object *obj;
-	u32 *buf;
-
-	dprintk("processor_init_pdc\n");
-
-	perf->pdc = NULL;
-	/* Initialize pdc. It will be used later. */
-	if (!obj_list)
-		return;
-
-	if (!(obj_list->count && obj_list->pointer))
-		return;
-
-	obj = obj_list->pointer;
-	if ((obj->buffer.length == 12) && obj->buffer.pointer) {
-		buf = (u32 *)obj->buffer.pointer;
-       		buf[0] = ACPI_PDC_REVISION_ID;
-       		buf[1] = 1;
-       		buf[2] = ACPI_PDC_EST_CAPABILITY_SMP;
-		perf->pdc = obj_list;
-	}
-	return;
-}
-
-
-static int
-acpi_cpufreq_cpu_init (
-	struct cpufreq_policy   *policy)
-{
-	unsigned int		i;
-	unsigned int		cpu = policy->cpu;
-	struct cpufreq_acpi_io	*data;
-	unsigned int		result = 0;
-
-	union acpi_object		arg0 = {ACPI_TYPE_BUFFER};
-	u32				arg0_buf[3];
-	struct acpi_object_list 	arg_list = {1, &arg0};
-
-	dprintk("acpi_cpufreq_cpu_init\n");
-	/* setup arg_list for _PDC settings */
-        arg0.buffer.length = 12;
-        arg0.buffer.pointer = (u8 *) arg0_buf;
-
-	data = kmalloc(sizeof(struct cpufreq_acpi_io), GFP_KERNEL);
-	if (!data)
-		return (-ENOMEM);
-
-	memset(data, 0, sizeof(struct cpufreq_acpi_io));
-
-	acpi_io_data[cpu] = data;
-
-	processor_init_pdc(&data->acpi_data, cpu, &arg_list);
-	result = acpi_processor_register_performance(&data->acpi_data, cpu);
-	data->acpi_data.pdc = NULL;
-
-	if (result)
-		goto err_free;
-
-	/* capability check */
-	if (data->acpi_data.state_count <= 1) {
-		dprintk("No P-States\n");
-		result = -ENODEV;
-		goto err_unreg;
-	}
-
-	if ((data->acpi_data.control_register.space_id !=
-					ACPI_ADR_SPACE_FIXED_HARDWARE) ||
-	    (data->acpi_data.status_register.space_id !=
-					ACPI_ADR_SPACE_FIXED_HARDWARE)) {
-		dprintk("Unsupported address space [%d, %d]\n",
-			(u32) (data->acpi_data.control_register.space_id),
-			(u32) (data->acpi_data.status_register.space_id));
-		result = -ENODEV;
-		goto err_unreg;
-	}
-
-	/* alloc freq_table */
-	data->freq_table = kmalloc(sizeof(struct cpufreq_frequency_table) *
-	                           (data->acpi_data.state_count + 1),
-	                           GFP_KERNEL);
-	if (!data->freq_table) {
-		result = -ENOMEM;
-		goto err_unreg;
-	}
-
-	/* detect transition latency */
-	policy->cpuinfo.transition_latency = 0;
-	for (i=0; i<data->acpi_data.state_count; i++) {
-		if ((data->acpi_data.states[i].transition_latency * 1000) >
-		    policy->cpuinfo.transition_latency) {
-			policy->cpuinfo.transition_latency =
-			    data->acpi_data.states[i].transition_latency * 1000;
-		}
-	}
-	policy->governor = CPUFREQ_DEFAULT_GOVERNOR;
-
-	policy->cur = processor_get_freq(data, policy->cpu);
-
-	/* table init */
-	for (i = 0; i <= data->acpi_data.state_count; i++)
-	{
-		data->freq_table[i].index = i;
-		if (i < data->acpi_data.state_count) {
-			data->freq_table[i].frequency =
-			      data->acpi_data.states[i].core_frequency * 1000;
-		} else {
-			data->freq_table[i].frequency = CPUFREQ_TABLE_END;
-		}
-	}
-
-	result = cpufreq_frequency_table_cpuinfo(policy, data->freq_table);
-	if (result) {
-		goto err_freqfree;
-	}
-
-	/* notify BIOS that we exist */
-	acpi_processor_notify_smm(THIS_MODULE);
-
-	printk(KERN_INFO "acpi-cpufreq: CPU%u - ACPI performance management "
-	       "activated.\n", cpu);
-
-	for (i = 0; i < data->acpi_data.state_count; i++)
-		dprintk("     %cP%d: %d MHz, %d mW, %d uS, %d uS, 0x%x 0x%x\n",
-			(i == data->acpi_data.state?'*':' '), i,
-			(u32) data->acpi_data.states[i].core_frequency,
-			(u32) data->acpi_data.states[i].power,
-			(u32) data->acpi_data.states[i].transition_latency,
-			(u32) data->acpi_data.states[i].bus_master_latency,
-			(u32) data->acpi_data.states[i].status,
-			(u32) data->acpi_data.states[i].control);
-
-	cpufreq_frequency_table_get_attr(data->freq_table, policy->cpu);
-
-	/* the first call to ->target() should result in us actually
-	 * writing something to the appropriate registers. */
-	data->resume = 1;
-
-	return (result);
-
- err_freqfree:
-	kfree(data->freq_table);
- err_unreg:
-	acpi_processor_unregister_performance(&data->acpi_data, cpu);
- err_free:
-	kfree(data);
-	acpi_io_data[cpu] = NULL;
-
-	return (result);
-}
-
-
-static int
-acpi_cpufreq_cpu_exit (
-	struct cpufreq_policy   *policy)
-{
-	struct cpufreq_acpi_io *data = acpi_io_data[policy->cpu];
-
-	dprintk("acpi_cpufreq_cpu_exit\n");
-
-	if (data) {
-		cpufreq_frequency_table_put_attr(policy->cpu);
-		acpi_io_data[policy->cpu] = NULL;
-		acpi_processor_unregister_performance(&data->acpi_data,
-		                                      policy->cpu);
-		kfree(data);
-	}
-
-	return (0);
-}
-
-
-static struct freq_attr* acpi_cpufreq_attr[] = {
-	&cpufreq_freq_attr_scaling_available_freqs,
-	NULL,
-};
-
-
-static struct cpufreq_driver acpi_cpufreq_driver = {
-	.verify 	= acpi_cpufreq_verify,
-	.target 	= acpi_cpufreq_target,
-	.get 		= acpi_cpufreq_get,
-	.init		= acpi_cpufreq_cpu_init,
-	.exit		= acpi_cpufreq_cpu_exit,
-	.name		= "acpi-cpufreq",
-	.owner		= THIS_MODULE,
-	.attr           = acpi_cpufreq_attr,
-};
-
-
-static int __init
-acpi_cpufreq_init (void)
-{
-	dprintk("acpi_cpufreq_init\n");
-
- 	return cpufreq_register_driver(&acpi_cpufreq_driver);
-}
-
-
-static void __exit
-acpi_cpufreq_exit (void)
-{
-	dprintk("acpi_cpufreq_exit\n");
-
-	cpufreq_unregister_driver(&acpi_cpufreq_driver);
-	return;
-}
-
-
-late_initcall(acpi_cpufreq_init);
-module_exit(acpi_cpufreq_exit);
-
diff --git a/trunk/arch/ia64/kernel/sys_ia64.c b/trunk/arch/ia64/kernel/sys_ia64.c
index f2dbcd1db0d4..770fab37928e 100644
--- a/trunk/arch/ia64/kernel/sys_ia64.c
+++ b/trunk/arch/ia64/kernel/sys_ia64.c
@@ -35,7 +35,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
 		return -ENOMEM;
 
 #ifdef CONFIG_HUGETLB_PAGE
-	if (REGION_NUMBER(addr) == RGN_HPAGE)
+	if (REGION_NUMBER(addr) == REGION_HPAGE)
 		addr = 0;
 #endif
 	if (!addr)
diff --git a/trunk/arch/ia64/kernel/uncached.c b/trunk/arch/ia64/kernel/uncached.c
index 4e9d06c48a8b..490dfc9ab47f 100644
--- a/trunk/arch/ia64/kernel/uncached.c
+++ b/trunk/arch/ia64/kernel/uncached.c
@@ -184,7 +184,7 @@ uncached_free_page(unsigned long maddr)
 {
 	int node;
 
-	node = paddr_to_nid(maddr - __IA64_UNCACHED_OFFSET);
+	node = nasid_to_cnodeid(NASID_GET(maddr));
 
 	dprintk(KERN_DEBUG "uncached_free_page(%lx) on node %i\n", maddr, node);
 
@@ -217,7 +217,7 @@ uncached_build_memmap(unsigned long start, unsigned long end, void *arg)
 
 	memset((char *)vstart, 0, length);
 
-	node = paddr_to_nid(start);
+	node = nasid_to_cnodeid(NASID_GET(start));
 
 	for (; vstart < vend ; vstart += PAGE_SIZE) {
 		dprintk(KERN_INFO "sticking %lx into the pool!\n", vstart);
diff --git a/trunk/arch/ia64/lib/Makefile b/trunk/arch/ia64/lib/Makefile
index 799407e7726f..1902c3c2ef92 100644
--- a/trunk/arch/ia64/lib/Makefile
+++ b/trunk/arch/ia64/lib/Makefile
@@ -6,7 +6,7 @@ obj-y := io.o
 
 lib-y := __divsi3.o __udivsi3.o __modsi3.o __umodsi3.o			\
 	__divdi3.o __udivdi3.o __moddi3.o __umoddi3.o			\
-	bitop.o checksum.o clear_page.o csum_partial_copy.o		\
+	bitop.o checksum.o clear_page.o csum_partial_copy.o copy_page.o	\
 	clear_user.o strncpy_from_user.o strlen_user.o strnlen_user.o	\
 	flush.o ip_fast_csum.o do_csum.o				\
 	memset.o strlen.o swiotlb.o
diff --git a/trunk/arch/ia64/lib/swiotlb.c b/trunk/arch/ia64/lib/swiotlb.c
index dbc0b3e449c5..ab7b3ad99a7f 100644
--- a/trunk/arch/ia64/lib/swiotlb.c
+++ b/trunk/arch/ia64/lib/swiotlb.c
@@ -93,7 +93,8 @@ static int __init
 setup_io_tlb_npages(char *str)
 {
 	if (isdigit(*str)) {
-		io_tlb_nslabs = simple_strtoul(str, &str, 0);
+		io_tlb_nslabs = simple_strtoul(str, &str, 0) <<
+			(PAGE_SHIFT - IO_TLB_SHIFT);
 		/* avoid tail segment of size < IO_TLB_SEGSIZE */
 		io_tlb_nslabs = ALIGN(io_tlb_nslabs, IO_TLB_SEGSIZE);
 	}
@@ -116,7 +117,7 @@ swiotlb_init_with_default_size (size_t default_size)
 	unsigned long i;
 
 	if (!io_tlb_nslabs) {
-		io_tlb_nslabs = (default_size >> IO_TLB_SHIFT);
+		io_tlb_nslabs = (default_size >> PAGE_SHIFT);
 		io_tlb_nslabs = ALIGN(io_tlb_nslabs, IO_TLB_SEGSIZE);
 	}
 
diff --git a/trunk/arch/ia64/mm/hugetlbpage.c b/trunk/arch/ia64/mm/hugetlbpage.c
index 2d13889d0a99..e0a776a3044c 100644
--- a/trunk/arch/ia64/mm/hugetlbpage.c
+++ b/trunk/arch/ia64/mm/hugetlbpage.c
@@ -76,7 +76,7 @@ int is_aligned_hugepage_range(unsigned long addr, unsigned long len)
 		return -EINVAL;
 	if (addr & ~HPAGE_MASK)
 		return -EINVAL;
-	if (REGION_NUMBER(addr) != RGN_HPAGE)
+	if (REGION_NUMBER(addr) != REGION_HPAGE)
 		return -EINVAL;
 
 	return 0;
@@ -87,7 +87,7 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long addr, int writ
 	struct page *page;
 	pte_t *ptep;
 
-	if (REGION_NUMBER(addr) != RGN_HPAGE)
+	if (REGION_NUMBER(addr) != REGION_HPAGE)
 		return ERR_PTR(-EINVAL);
 
 	ptep = huge_pte_offset(mm, addr);
@@ -142,8 +142,8 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
 		return -ENOMEM;
 	if (len & ~HPAGE_MASK)
 		return -EINVAL;
-	/* This code assumes that RGN_HPAGE != 0. */
-	if ((REGION_NUMBER(addr) != RGN_HPAGE) || (addr & (HPAGE_SIZE - 1)))
+	/* This code assumes that REGION_HPAGE != 0. */
+	if ((REGION_NUMBER(addr) != REGION_HPAGE) || (addr & (HPAGE_SIZE - 1)))
 		addr = HPAGE_REGION_BASE;
 	else
 		addr = ALIGN(addr, HPAGE_SIZE);
diff --git a/trunk/arch/ia64/pci/pci.c b/trunk/arch/ia64/pci/pci.c
index 9977c122e9fa..f9472c50ab42 100644
--- a/trunk/arch/ia64/pci/pci.c
+++ b/trunk/arch/ia64/pci/pci.c
@@ -24,6 +24,7 @@
 
 #include <asm/machvec.h>
 #include <asm/page.h>
+#include <asm/segment.h>
 #include <asm/system.h>
 #include <asm/io.h>
 #include <asm/sal.h>
diff --git a/trunk/arch/ia64/sn/include/tio.h b/trunk/arch/ia64/sn/include/tio.h
index 6b2e7b75eb19..0139124dd54a 100644
--- a/trunk/arch/ia64/sn/include/tio.h
+++ b/trunk/arch/ia64/sn/include/tio.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2000-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2000-2004 Silicon Graphics, Inc. All rights reserved.
  */
 
 #ifndef _ASM_IA64_SN_TIO_H
@@ -26,10 +26,6 @@
 #define TIO_ITTE_VALID_MASK	0x1
 #define TIO_ITTE_VALID_SHIFT	16
 
-#define TIO_ITTE_WIDGET(itte) \
-	(((itte) >> TIO_ITTE_WIDGET_SHIFT) & TIO_ITTE_WIDGET_MASK)
-#define TIO_ITTE_VALID(itte) \
-	(((itte) >> TIO_ITTE_VALID_SHIFT) & TIO_ITTE_VALID_MASK)
 
 #define TIO_ITTE_PUT(nasid, bigwin, widget, addr, valid) \
         REMOTE_HUB_S((nasid), TIO_ITTE(bigwin), \
diff --git a/trunk/arch/ia64/sn/include/xtalk/hubdev.h b/trunk/arch/ia64/sn/include/xtalk/hubdev.h
index 71c2b271b4c6..580a1c0403a7 100644
--- a/trunk/arch/ia64/sn/include/xtalk/hubdev.h
+++ b/trunk/arch/ia64/sn/include/xtalk/hubdev.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1992 - 1997, 2000-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 1992 - 1997, 2000-2004 Silicon Graphics, Inc. All rights reserved.
  */
 #ifndef _ASM_IA64_SN_XTALK_HUBDEV_H
 #define _ASM_IA64_SN_XTALK_HUBDEV_H
@@ -16,9 +16,6 @@
 #define IIO_ITTE_WIDGET_MASK    ((1<<IIO_ITTE_WIDGET_BITS)-1)
 #define IIO_ITTE_WIDGET_SHIFT   8
 
-#define IIO_ITTE_WIDGET(itte)	\
-	(((itte) >> IIO_ITTE_WIDGET_SHIFT) & IIO_ITTE_WIDGET_MASK)
-
 /*
  * Use the top big window as a surrogate for the first small window
  */
@@ -37,8 +34,7 @@ struct sn_flush_device_list {
 	unsigned long sfdl_force_int_addr;
 	unsigned long sfdl_flush_value;
 	volatile unsigned long *sfdl_flush_addr;
-	uint32_t sfdl_persistent_busnum;
-	uint32_t sfdl_persistent_segment;
+	uint64_t sfdl_persistent_busnum;
 	struct pcibus_info *sfdl_pcibus_info;
 	spinlock_t sfdl_flush_lock;
 };
@@ -62,8 +58,7 @@ struct hubdev_info {
 
 	void				*hdi_nodepda;
 	void				*hdi_node_vertex;
-	uint32_t			max_segment_number;
-	uint32_t			max_pcibus_number;
+	void				*hdi_xtalk_vertex;
 };
 
 extern void hubdev_init_node(nodepda_t *, cnodeid_t);
diff --git a/trunk/arch/ia64/sn/kernel/bte.c b/trunk/arch/ia64/sn/kernel/bte.c
index 45854c637e9c..647deae9bfcd 100644
--- a/trunk/arch/ia64/sn/kernel/bte.c
+++ b/trunk/arch/ia64/sn/kernel/bte.c
@@ -29,30 +29,16 @@
 
 /* two interfaces on two btes */
 #define MAX_INTERFACES_TO_TRY		4
-#define MAX_NODES_TO_TRY		2
 
 static struct bteinfo_s *bte_if_on_node(nasid_t nasid, int interface)
 {
 	nodepda_t *tmp_nodepda;
 
-	if (nasid_to_cnodeid(nasid) == -1)
-		return (struct bteinfo_s *)NULL;;
-
 	tmp_nodepda = NODEPDA(nasid_to_cnodeid(nasid));
 	return &tmp_nodepda->bte_if[interface];
 
 }
 
-static inline void bte_start_transfer(struct bteinfo_s *bte, u64 len, u64 mode)
-{
-	if (is_shub2()) {
-		BTE_CTRL_STORE(bte, (IBLS_BUSY | ((len) | (mode) << 24)));
-	} else {
-		BTE_LNSTAT_STORE(bte, len);
-		BTE_CTRL_STORE(bte, mode);
-	}
-}
-
 /************************************************************************
  * Block Transfer Engine copy related functions.
  *
@@ -81,15 +67,13 @@ bte_result_t bte_copy(u64 src, u64 dest, u64 len, u64 mode, void *notification)
 {
 	u64 transfer_size;
 	u64 transfer_stat;
-	u64 notif_phys_addr;
 	struct bteinfo_s *bte;
 	bte_result_t bte_status;
 	unsigned long irq_flags;
 	unsigned long itc_end = 0;
-	int nasid_to_try[MAX_NODES_TO_TRY];
-	int my_nasid = get_nasid();
-	int bte_if_index, nasid_index;
-	int bte_first, btes_per_node = BTES_PER_NODE;
+	struct bteinfo_s *btes_to_try[MAX_INTERFACES_TO_TRY];
+	int bte_if_index;
+	int bte_pri, bte_sec;
 
 	BTE_PRINTK(("bte_copy(0x%lx, 0x%lx, 0x%lx, 0x%lx, 0x%p)\n",
 		    src, dest, len, mode, notification));
@@ -102,26 +86,36 @@ bte_result_t bte_copy(u64 src, u64 dest, u64 len, u64 mode, void *notification)
 		 (src & L1_CACHE_MASK) || (dest & L1_CACHE_MASK));
 	BUG_ON(!(len < ((BTE_LEN_MASK + 1) << L1_CACHE_SHIFT)));
 
-	/*
-	 * Start with interface corresponding to cpu number
-	 */
-	bte_first = raw_smp_processor_id() % btes_per_node;
+	/* CPU 0 (per node) tries bte0 first, CPU 1 try bte1 first */
+	if (cpuid_to_subnode(smp_processor_id()) == 0) {
+		bte_pri = 0;
+		bte_sec = 1;
+	} else {
+		bte_pri = 1;
+		bte_sec = 0;
+	}
 
 	if (mode & BTE_USE_DEST) {
 		/* try remote then local */
-		nasid_to_try[0] = NASID_GET(dest);
+		btes_to_try[0] = bte_if_on_node(NASID_GET(dest), bte_pri);
+		btes_to_try[1] = bte_if_on_node(NASID_GET(dest), bte_sec);
 		if (mode & BTE_USE_ANY) {
-			nasid_to_try[1] = my_nasid;
+			btes_to_try[2] = bte_if_on_node(get_nasid(), bte_pri);
+			btes_to_try[3] = bte_if_on_node(get_nasid(), bte_sec);
 		} else {
-			nasid_to_try[1] = (int)NULL;
+			btes_to_try[2] = NULL;
+			btes_to_try[3] = NULL;
 		}
 	} else {
 		/* try local then remote */
-		nasid_to_try[0] = my_nasid;
+		btes_to_try[0] = bte_if_on_node(get_nasid(), bte_pri);
+		btes_to_try[1] = bte_if_on_node(get_nasid(), bte_sec);
 		if (mode & BTE_USE_ANY) {
-			nasid_to_try[1] = NASID_GET(dest);
+			btes_to_try[2] = bte_if_on_node(NASID_GET(dest), bte_pri);
+			btes_to_try[3] = bte_if_on_node(NASID_GET(dest), bte_sec);
 		} else {
-			nasid_to_try[1] = (int)NULL;
+			btes_to_try[2] = NULL;
+			btes_to_try[3] = NULL;
 		}
 	}
 
@@ -129,12 +123,11 @@ bte_result_t bte_copy(u64 src, u64 dest, u64 len, u64 mode, void *notification)
 	do {
 		local_irq_save(irq_flags);
 
-		bte_if_index = bte_first;
-		nasid_index = 0;
+		bte_if_index = 0;
 
 		/* Attempt to lock one of the BTE interfaces. */
-		while (nasid_index < MAX_NODES_TO_TRY) {
-			bte = bte_if_on_node(nasid_to_try[nasid_index],bte_if_index);
+		while (bte_if_index < MAX_INTERFACES_TO_TRY) {
+			bte = btes_to_try[bte_if_index++];
 
 			if (bte == NULL) {
 				continue;
@@ -150,15 +143,6 @@ bte_result_t bte_copy(u64 src, u64 dest, u64 len, u64 mode, void *notification)
 					break;
 				}
 			}
-
-			bte_if_index = (bte_if_index + 1) % btes_per_node; /* Next interface */
-			if (bte_if_index == bte_first) {
-				/*
-				 * We've tried all interfaces on this node
-				 */
-				nasid_index++;
-			}
-
 			bte = NULL;
 		}
 
@@ -185,13 +169,7 @@ bte_result_t bte_copy(u64 src, u64 dest, u64 len, u64 mode, void *notification)
 
 	/* Initialize the notification to a known value. */
 	*bte->most_rcnt_na = BTE_WORD_BUSY;
-	notif_phys_addr = TO_PHYS(ia64_tpa((unsigned long)bte->most_rcnt_na));
 
-	if (is_shub2()) {
-		src = SH2_TIO_PHYS_TO_DMA(src);
-		dest = SH2_TIO_PHYS_TO_DMA(dest);
-		notif_phys_addr = SH2_TIO_PHYS_TO_DMA(notif_phys_addr);
-	}
 	/* Set the source and destination registers */
 	BTE_PRINTKV(("IBSA = 0x%lx)\n", (TO_PHYS(src))));
 	BTE_SRC_STORE(bte, TO_PHYS(src));
@@ -199,12 +177,14 @@ bte_result_t bte_copy(u64 src, u64 dest, u64 len, u64 mode, void *notification)
 	BTE_DEST_STORE(bte, TO_PHYS(dest));
 
 	/* Set the notification register */
-	BTE_PRINTKV(("IBNA = 0x%lx)\n", notif_phys_addr));
-	BTE_NOTIF_STORE(bte, notif_phys_addr);
+	BTE_PRINTKV(("IBNA = 0x%lx)\n",
+		     TO_PHYS(ia64_tpa((unsigned long)bte->most_rcnt_na))));
+	BTE_NOTIF_STORE(bte,
+			TO_PHYS(ia64_tpa((unsigned long)bte->most_rcnt_na)));
 
 	/* Initiate the transfer */
 	BTE_PRINTK(("IBCT = 0x%lx)\n", BTE_VALID_MODE(mode)));
-	bte_start_transfer(bte, transfer_size, BTE_VALID_MODE(mode));
+	BTE_START_TRANSFER(bte, transfer_size, BTE_VALID_MODE(mode));
 
 	itc_end = ia64_get_itc() + (40000000 * local_cpu_data->cyc_per_usec);
 
@@ -215,7 +195,6 @@ bte_result_t bte_copy(u64 src, u64 dest, u64 len, u64 mode, void *notification)
 	}
 
 	while ((transfer_stat = *bte->most_rcnt_na) == BTE_WORD_BUSY) {
-		cpu_relax();
 		if (ia64_get_itc() > itc_end) {
 			BTE_PRINTK(("BTE timeout nasid 0x%x bte%d IBLS = 0x%lx na 0x%lx\n",
 				NASID_GET(bte->bte_base_addr), bte->bte_num,
diff --git a/trunk/arch/ia64/sn/kernel/huberror.c b/trunk/arch/ia64/sn/kernel/huberror.c
index 5c5eb01c50f0..5c39b43ba3c0 100644
--- a/trunk/arch/ia64/sn/kernel/huberror.c
+++ b/trunk/arch/ia64/sn/kernel/huberror.c
@@ -76,7 +76,7 @@ void hubiio_crb_free(struct hubdev_info *hubdev_info, int crbnum)
 	 */
 	REMOTE_HUB_S(hubdev_info->hdi_nasid, IIO_ICDR, (IIO_ICDR_PND | crbnum));
 	while (REMOTE_HUB_L(hubdev_info->hdi_nasid, IIO_ICDR) & IIO_ICDR_PND)
-		cpu_relax();
+		udelay(1);
 
 }
 
diff --git a/trunk/arch/ia64/sn/kernel/io_init.c b/trunk/arch/ia64/sn/kernel/io_init.c
index 4564ed0b5ff3..414cdf2e3c96 100644
--- a/trunk/arch/ia64/sn/kernel/io_init.c
+++ b/trunk/arch/ia64/sn/kernel/io_init.c
@@ -18,7 +18,6 @@
 #include <asm/sn/simulator.h>
 #include <asm/sn/sn_sal.h>
 #include <asm/sn/tioca_provider.h>
-#include <asm/sn/tioce_provider.h>
 #include "xtalk/hubdev.h"
 #include "xtalk/xwidgetdev.h"
 
@@ -45,9 +44,6 @@ int sn_ioif_inited = 0;		/* SN I/O infrastructure initialized? */
 
 struct sn_pcibus_provider *sn_pci_provider[PCIIO_ASIC_MAX_TYPES];	/* indexed by asic type */
 
-static int max_segment_number = 0; /* Default highest segment number */
-static int max_pcibus_number = 255; /* Default highest pci bus number */
-
 /*
  * Hooks and struct for unsupported pci providers
  */
@@ -161,28 +157,13 @@ static void sn_fixup_ionodes(void)
 	uint64_t nasid;
 	int i, widget;
 
-	/*
-	 * Get SGI Specific HUB chipset information.
-	 * Inform Prom that this kernel can support domain bus numbering.
-	 */
 	for (i = 0; i < numionodes; i++) {
 		hubdev = (struct hubdev_info *)(NODEPDA(i)->pdinfo);
 		nasid = cnodeid_to_nasid(i);
-		hubdev->max_segment_number = 0xffffffff;
-		hubdev->max_pcibus_number = 0xff;
 		status = sal_get_hubdev_info(nasid, (uint64_t) __pa(hubdev));
 		if (status)
 			continue;
 
-		/* Save the largest Domain and pcibus numbers found. */
-		if (hubdev->max_segment_number) {
-			/*
-			 * Dealing with a Prom that supports segments.
-			 */
-			max_segment_number = hubdev->max_segment_number;
-			max_pcibus_number = hubdev->max_pcibus_number;
-		}
-
 		/* Attach the error interrupt handlers */
 		if (nasid & 1)
 			ice_error_init(hubdev);
@@ -249,7 +230,7 @@ void sn_pci_unfixup_slot(struct pci_dev *dev)
 void sn_pci_fixup_slot(struct pci_dev *dev)
 {
 	int idx;
-	int segment = pci_domain_nr(dev->bus);
+	int segment = 0;
 	int status = 0;
 	struct pcibus_bussoft *bs;
  	struct pci_bus *host_pci_bus;
@@ -302,9 +283,9 @@ void sn_pci_fixup_slot(struct pci_dev *dev)
  	 * PCI host_pci_dev struct and set up host bus linkages
  	 */
 
- 	bus_no = (SN_PCIDEV_INFO(dev)->pdi_slot_host_handle >> 32) & 0xff;
+ 	bus_no = SN_PCIDEV_INFO(dev)->pdi_slot_host_handle >> 32;
  	devfn = SN_PCIDEV_INFO(dev)->pdi_slot_host_handle & 0xffffffff;
- 	host_pci_bus = pci_find_bus(segment, bus_no);
+ 	host_pci_bus = pci_find_bus(pci_domain_nr(dev->bus), bus_no);
  	host_pci_dev = pci_get_slot(host_pci_bus, devfn);
 
 	SN_PCIDEV_INFO(dev)->host_pci_dev = host_pci_dev;
@@ -352,7 +333,6 @@ void sn_pci_controller_fixup(int segment, int busnum, struct pci_bus *bus)
 	prom_bussoft_ptr = __va(prom_bussoft_ptr);
 
  	controller = kcalloc(1,sizeof(struct pci_controller), GFP_KERNEL);
-	controller->segment = segment;
  	if (!controller)
  		BUG();
 
@@ -410,7 +390,7 @@ void sn_pci_controller_fixup(int segment, int busnum, struct pci_bus *bus)
 	if (controller->node >= num_online_nodes()) {
 		struct pcibus_bussoft *b = SN_PCIBUS_BUSSOFT(bus);
 
-		printk(KERN_WARNING "Device ASIC=%u XID=%u PBUSNUM=%u"
+		printk(KERN_WARNING "Device ASIC=%u XID=%u PBUSNUM=%lu"
 				    "L_IO=%lx L_MEM=%lx BASE=%lx\n",
 			b->bs_asic_type, b->bs_xid, b->bs_persist_busnum,
 			b->bs_legacy_io, b->bs_legacy_mem, b->bs_base);
@@ -465,7 +445,6 @@ void sn_bus_free_sysdata(void)
 static int __init sn_pci_init(void)
 {
 	int i = 0;
-	int j = 0;
 	struct pci_dev *pci_dev = NULL;
 	extern void sn_init_cpei_timer(void);
 #ifdef CONFIG_PROC_FS
@@ -485,7 +464,6 @@ static int __init sn_pci_init(void)
 
 	pcibr_init_provider();
 	tioca_init_provider();
-	tioce_init_provider();
 
 	/*
 	 * This is needed to avoid bounce limit checks in the blk layer
@@ -501,9 +479,8 @@ static int __init sn_pci_init(void)
 #endif
 
 	/* busses are not known yet ... */
-	for (i = 0; i <= max_segment_number; i++)
-		for (j = 0; j <= max_pcibus_number; j++)
-			sn_pci_controller_fixup(i, j, NULL);
+	for (i = 0; i < PCI_BUSES_TO_SCAN; i++)
+		sn_pci_controller_fixup(0, i, NULL);
 
 	/*
 	 * Generic Linux PCI Layer has created the pci_bus and pci_dev 
diff --git a/trunk/arch/ia64/sn/kernel/irq.c b/trunk/arch/ia64/sn/kernel/irq.c
index 9fc74631ba8a..84d276a14ecb 100644
--- a/trunk/arch/ia64/sn/kernel/irq.c
+++ b/trunk/arch/ia64/sn/kernel/irq.c
@@ -5,7 +5,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 2000-2005 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2000-2004 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 #include <linux/irq.h>
@@ -76,14 +76,16 @@ static void sn_enable_irq(unsigned int irq)
 
 static void sn_ack_irq(unsigned int irq)
 {
-	u64 event_occurred, mask = 0;
+	uint64_t event_occurred, mask = 0;
+	int nasid;
 
 	irq = irq & 0xff;
+	nasid = get_nasid();
 	event_occurred =
-	    HUB_L((u64*)LOCAL_MMR_ADDR(SH_EVENT_OCCURRED));
+	    HUB_L((uint64_t *) GLOBAL_MMR_ADDR(nasid, SH_EVENT_OCCURRED));
 	mask = event_occurred & SH_ALL_INT_MASK;
-	HUB_S((u64*)LOCAL_MMR_ADDR(SH_EVENT_OCCURRED_ALIAS),
-	      mask);
+	HUB_S((uint64_t *) GLOBAL_MMR_ADDR(nasid, SH_EVENT_OCCURRED_ALIAS),
+		 mask);
 	__set_bit(irq, (volatile void *)pda->sn_in_service_ivecs);
 
 	move_irq(irq);
@@ -91,12 +93,15 @@ static void sn_ack_irq(unsigned int irq)
 
 static void sn_end_irq(unsigned int irq)
 {
+	int nasid;
 	int ivec;
-	u64 event_occurred;
+	uint64_t event_occurred;
 
 	ivec = irq & 0xff;
 	if (ivec == SGI_UART_VECTOR) {
-		event_occurred = HUB_L((u64*)LOCAL_MMR_ADDR (SH_EVENT_OCCURRED));
+		nasid = get_nasid();
+		event_occurred = HUB_L((uint64_t *) GLOBAL_MMR_ADDR
+				       (nasid, SH_EVENT_OCCURRED));
 		/* If the UART bit is set here, we may have received an
 		 * interrupt from the UART that the driver missed.  To
 		 * make sure, we IPI ourselves to force us to look again.
@@ -127,7 +132,6 @@ static void sn_set_affinity_irq(unsigned int irq, cpumask_t mask)
 		int local_widget, status;
 		nasid_t local_nasid;
 		struct sn_irq_info *new_irq_info;
-		struct sn_pcibus_provider *pci_provider;
 
 		new_irq_info = kmalloc(sizeof(struct sn_irq_info), GFP_ATOMIC);
 		if (new_irq_info == NULL)
@@ -167,9 +171,8 @@ static void sn_set_affinity_irq(unsigned int irq, cpumask_t mask)
 		new_irq_info->irq_cpuid = cpuid;
 		register_intr_pda(new_irq_info);
 
-		pci_provider = sn_pci_provider[new_irq_info->irq_bridge_type];
-		if (pci_provider && pci_provider->target_interrupt)
-			(pci_provider->target_interrupt)(new_irq_info);
+		if (IS_PCI_BRIDGE_ASIC(new_irq_info->irq_bridge_type))
+			pcibr_change_devices_irq(new_irq_info);
 
 		spin_lock(&sn_irq_info_lock);
 		list_replace_rcu(&sn_irq_info->list, &new_irq_info->list);
@@ -314,16 +317,6 @@ void sn_irq_unfixup(struct pci_dev *pci_dev)
 	pci_dev_put(pci_dev);
 }
 
-static inline void
-sn_call_force_intr_provider(struct sn_irq_info *sn_irq_info)
-{
-	struct sn_pcibus_provider *pci_provider;
-
-	pci_provider = sn_pci_provider[sn_irq_info->irq_bridge_type];
-	if (pci_provider && pci_provider->force_interrupt)
-		(*pci_provider->force_interrupt)(sn_irq_info);
-}
-
 static void force_interrupt(int irq)
 {
 	struct sn_irq_info *sn_irq_info;
@@ -332,9 +325,11 @@ static void force_interrupt(int irq)
 		return;
 
 	rcu_read_lock();
-	list_for_each_entry_rcu(sn_irq_info, sn_irq_lh[irq], list)
-		sn_call_force_intr_provider(sn_irq_info);
-
+	list_for_each_entry_rcu(sn_irq_info, sn_irq_lh[irq], list) {
+		if (IS_PCI_BRIDGE_ASIC(sn_irq_info->irq_bridge_type) &&
+		    (sn_irq_info->irq_bridge != NULL))
+			pcibr_force_interrupt(sn_irq_info);
+	}
 	rcu_read_unlock();
 }
 
@@ -356,14 +351,6 @@ static void sn_check_intr(int irq, struct sn_irq_info *sn_irq_info)
 	struct pcidev_info *pcidev_info;
 	struct pcibus_info *pcibus_info;
 
-	/*
-	 * Bridge types attached to TIO (anything but PIC) do not need this WAR
-	 * since they do not target Shub II interrupt registers.  If that
-	 * ever changes, this check needs to accomodate.
-	 */
-	if (sn_irq_info->irq_bridge_type != PCIIO_ASIC_TYPE_PIC)
-		return;
-
 	pcidev_info = (struct pcidev_info *)sn_irq_info->irq_pciioinfo;
 	if (!pcidev_info)
 		return;
@@ -390,12 +377,16 @@ static void sn_check_intr(int irq, struct sn_irq_info *sn_irq_info)
 		break;
 	}
 	if (!test_bit(irr_bit, &irr_reg)) {
-		if (!test_bit(irq, pda->sn_in_service_ivecs)) {
-			regval &= 0xff;
-			if (sn_irq_info->irq_int_bit & regval &
-			    sn_irq_info->irq_last_intr) {
-				regval &= ~(sn_irq_info->irq_int_bit & regval);
-				sn_call_force_intr_provider(sn_irq_info);
+		if (!test_bit(irq, pda->sn_soft_irr)) {
+			if (!test_bit(irq, pda->sn_in_service_ivecs)) {
+				regval &= 0xff;
+				if (sn_irq_info->irq_int_bit & regval &
+				    sn_irq_info->irq_last_intr) {
+					regval &=
+					    ~(sn_irq_info->
+					      irq_int_bit & regval);
+					pcibr_force_interrupt(sn_irq_info);
+				}
 			}
 		}
 	}
@@ -413,7 +404,13 @@ void sn_lb_int_war_check(void)
 	rcu_read_lock();
 	for (i = pda->sn_first_irq; i <= pda->sn_last_irq; i++) {
 		list_for_each_entry_rcu(sn_irq_info, sn_irq_lh[i], list) {
-			sn_check_intr(i, sn_irq_info);
+			/*
+			 * Only call for PCI bridges that are fully
+			 * initialized.
+			 */
+			if (IS_PCI_BRIDGE_ASIC(sn_irq_info->irq_bridge_type) &&
+			    (sn_irq_info->irq_bridge != NULL))
+				sn_check_intr(i, sn_irq_info);
 		}
 	}
 	rcu_read_unlock();
diff --git a/trunk/arch/ia64/sn/kernel/setup.c b/trunk/arch/ia64/sn/kernel/setup.c
index a594aca959e6..7c7fe441d623 100644
--- a/trunk/arch/ia64/sn/kernel/setup.c
+++ b/trunk/arch/ia64/sn/kernel/setup.c
@@ -80,6 +80,8 @@ EXPORT_PER_CPU_SYMBOL(__sn_cnodeid_to_nasid);
 DEFINE_PER_CPU(struct nodepda_s *, __sn_nodepda);
 EXPORT_PER_CPU_SYMBOL(__sn_nodepda);
 
+partid_t sn_partid = -1;
+EXPORT_SYMBOL(sn_partid);
 char sn_system_serial_number_string[128];
 EXPORT_SYMBOL(sn_system_serial_number_string);
 u64 sn_partition_serial_number;
@@ -401,7 +403,6 @@ static void __init sn_init_pdas(char **cmdline_p)
 		memset(nodepdaindr[cnode], 0, sizeof(nodepda_t));
 		memset(nodepdaindr[cnode]->phys_cpuid, -1,
 		    sizeof(nodepdaindr[cnode]->phys_cpuid));
-		spin_lock_init(&nodepdaindr[cnode]->ptc_lock);
 	}
 
 	/*
@@ -531,8 +532,8 @@ void __init sn_cpu_init(void)
 	 */
 	{
 		u64 pio1[] = {SH1_PIO_WRITE_STATUS_0, 0, SH1_PIO_WRITE_STATUS_1, 0};
-		u64 pio2[] = {SH2_PIO_WRITE_STATUS_0, SH2_PIO_WRITE_STATUS_2,
-			SH2_PIO_WRITE_STATUS_1, SH2_PIO_WRITE_STATUS_3};
+		u64 pio2[] = {SH2_PIO_WRITE_STATUS_0, SH2_PIO_WRITE_STATUS_1,
+			SH2_PIO_WRITE_STATUS_2, SH2_PIO_WRITE_STATUS_3};
 		u64 *pio;
 		pio = is_shub1() ? pio1 : pio2;
 		pda->pio_write_status_addr = (volatile unsigned long *) LOCAL_MMR_ADDR(pio[slice]);
diff --git a/trunk/arch/ia64/sn/kernel/sn2/ptc_deadlock.S b/trunk/arch/ia64/sn/kernel/sn2/ptc_deadlock.S
index 3fa95065a446..96cb71d15682 100644
--- a/trunk/arch/ia64/sn/kernel/sn2/ptc_deadlock.S
+++ b/trunk/arch/ia64/sn/kernel/sn2/ptc_deadlock.S
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2000-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2000-2004 Silicon Graphics, Inc. All rights reserved.
  */
 
 #include <asm/types.h>
@@ -11,7 +11,7 @@
 
 #define DEADLOCKBIT	SH_PIO_WRITE_STATUS_WRITE_DEADLOCK_SHFT
 #define WRITECOUNTMASK	SH_PIO_WRITE_STATUS_PENDING_WRITE_COUNT_MASK
-#define ALIAS_OFFSET	8
+#define ALIAS_OFFSET	(SH1_PIO_WRITE_STATUS_0_ALIAS-SH1_PIO_WRITE_STATUS_0)
 
 
 	.global	sn2_ptc_deadlock_recovery_core
@@ -36,15 +36,13 @@ sn2_ptc_deadlock_recovery_core:
 	extr.u	piowcphy=piowc,0,61;;	// Convert piowc to uncached physical address
 	dep	piowcphy=-1,piowcphy,63,1
 	movl	mask=WRITECOUNTMASK
-	mov	r8=r0
 
 1:
 	add	scr2=ALIAS_OFFSET,piowc	// Address of WRITE_STATUS alias register 
-	;;
-	ld8.acq	scr1=[scr2];;
+	mov	scr1=7;;		// Clear DEADLOCK, WRITE_ERROR, MULTI_WRITE_ERROR
+	st8.rel	[scr2]=scr1;;
 
 5:	ld8.acq	scr1=[piowc];;		// Wait for PIOs to complete.
-	hint	@pause
 	and	scr2=scr1,mask;;	// mask of writecount bits
 	cmp.ne	p6,p0=zeroval,scr2
 (p6)	br.cond.sptk 5b
@@ -59,7 +57,6 @@ sn2_ptc_deadlock_recovery_core:
 	st8.rel [ptc0]=data0		// Write PTC0 & wait for completion.
 
 5:	ld8.acq	scr1=[piowcphy];;	// Wait for PIOs to complete.
-	hint	@pause
 	and	scr2=scr1,mask;;	// mask of writecount bits
 	cmp.ne	p6,p0=zeroval,scr2
 (p6)	br.cond.sptk 5b;;
@@ -70,7 +67,6 @@ sn2_ptc_deadlock_recovery_core:
 (p7)	st8.rel [ptc1]=data1;;		// Now write PTC1.
 
 5:	ld8.acq	scr1=[piowcphy];;	// Wait for PIOs to complete.
-	hint	@pause
 	and	scr2=scr1,mask;;	// mask of writecount bits
 	cmp.ne	p6,p0=zeroval,scr2
 (p6)	br.cond.sptk 5b
@@ -81,7 +77,6 @@ sn2_ptc_deadlock_recovery_core:
 	srlz.i;;
 	////////////// END   PHYSICAL MODE ////////////////////
 
-(p8)	add	r8=1,r8
 (p8)	br.cond.spnt 1b;;		// Repeat if DEADLOCK occurred.
 
 	br.ret.sptk	rp
diff --git a/trunk/arch/ia64/sn/kernel/sn2/sn2_smp.c b/trunk/arch/ia64/sn/kernel/sn2/sn2_smp.c
index 0a4ee50c302f..7af05a7ac743 100644
--- a/trunk/arch/ia64/sn/kernel/sn2/sn2_smp.c
+++ b/trunk/arch/ia64/sn/kernel/sn2/sn2_smp.c
@@ -5,7 +5,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2000-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2000-2004 Silicon Graphics, Inc. All rights reserved.
  */
 
 #include <linux/init.h>
@@ -20,8 +20,6 @@
 #include <linux/module.h>
 #include <linux/bitops.h>
 #include <linux/nodemask.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
 
 #include <asm/processor.h>
 #include <asm/irq.h>
@@ -41,120 +39,12 @@
 #include <asm/sn/nodepda.h>
 #include <asm/sn/rw_mmr.h>
 
-DEFINE_PER_CPU(struct ptc_stats, ptcstats);
-DECLARE_PER_CPU(struct ptc_stats, ptcstats);
-
-static  __cacheline_aligned DEFINE_SPINLOCK(sn2_global_ptc_lock);
-
-void sn2_ptc_deadlock_recovery(short *, short, int, volatile unsigned long *, unsigned long data0,
+void sn2_ptc_deadlock_recovery(volatile unsigned long *, unsigned long data0, 
 	volatile unsigned long *, unsigned long data1);
 
-#ifdef DEBUG_PTC
-/*
- * ptctest:
- *
- * 	xyz - 3 digit hex number:
- * 		x - Force PTC purges to use shub:
- * 			0 - no force
- * 			1 - force
- * 		y - interupt enable
- * 			0 - disable interrupts
- * 			1 - leave interuupts enabled
- * 		z - type of lock:
- * 			0 - global lock
- * 			1 - node local lock
- * 			2 - no lock
- *
- *   	Note: on shub1, only ptctest == 0 is supported. Don't try other values!
- */
-
-static unsigned int sn2_ptctest = 0;
-
-static int __init ptc_test(char *str)
-{
-	get_option(&str, &sn2_ptctest);
-	return 1;
-}
-__setup("ptctest=", ptc_test);
-
-static inline int ptc_lock(unsigned long *flagp)
-{
-	unsigned long opt = sn2_ptctest & 255;
-
-	switch (opt) {
-	case 0x00:
-		spin_lock_irqsave(&sn2_global_ptc_lock, *flagp);
-		break;
-	case 0x01:
-		spin_lock_irqsave(&sn_nodepda->ptc_lock, *flagp);
-		break;
-	case 0x02:
-		local_irq_save(*flagp);
-		break;
-	case 0x10:
-		spin_lock(&sn2_global_ptc_lock);
-		break;
-	case 0x11:
-		spin_lock(&sn_nodepda->ptc_lock);
-		break;
-	case 0x12:
-		break;
-	default:
-		BUG();
-	}
-	return opt;
-}
-
-static inline void ptc_unlock(unsigned long flags, int opt)
-{
-	switch (opt) {
-	case 0x00:
-		spin_unlock_irqrestore(&sn2_global_ptc_lock, flags);
-		break;
-	case 0x01:
-		spin_unlock_irqrestore(&sn_nodepda->ptc_lock, flags);
-		break;
-	case 0x02:
-		local_irq_restore(flags);
-		break;
-	case 0x10:
-		spin_unlock(&sn2_global_ptc_lock);
-		break;
-	case 0x11:
-		spin_unlock(&sn_nodepda->ptc_lock);
-		break;
-	case 0x12:
-		break;
-	default:
-		BUG();
-	}
-}
-#else
+static  __cacheline_aligned DEFINE_SPINLOCK(sn2_global_ptc_lock);
 
-#define sn2_ptctest	0
-
-static inline int ptc_lock(unsigned long *flagp)
-{
-	spin_lock_irqsave(&sn2_global_ptc_lock, *flagp);
-	return 0;
-}
-
-static inline void ptc_unlock(unsigned long flags, int opt)
-{
-	spin_unlock_irqrestore(&sn2_global_ptc_lock, flags);
-}
-#endif
-
-struct ptc_stats {
-	unsigned long ptc_l;
-	unsigned long change_rid;
-	unsigned long shub_ptc_flushes;
-	unsigned long nodes_flushed;
-	unsigned long deadlocks;
-	unsigned long lock_itc_clocks;
-	unsigned long shub_itc_clocks;
-	unsigned long shub_itc_clocks_max;
-};
+static unsigned long sn2_ptc_deadlock_count;
 
 static inline unsigned long wait_piowc(void)
 {
@@ -199,9 +89,9 @@ void
 sn2_global_tlb_purge(unsigned long start, unsigned long end,
 		     unsigned long nbits)
 {
-	int i, opt, shub1, cnode, mynasid, cpu, lcpu = 0, nasid, flushed = 0;
+	int i, shub1, cnode, mynasid, cpu, lcpu = 0, nasid, flushed = 0;
 	volatile unsigned long *ptc0, *ptc1;
-	unsigned long itc, itc2, flags, data0 = 0, data1 = 0;
+	unsigned long flags = 0, data0 = 0, data1 = 0;
 	struct mm_struct *mm = current->active_mm;
 	short nasids[MAX_NUMNODES], nix;
 	nodemask_t nodes_flushed;
@@ -224,19 +114,16 @@ sn2_global_tlb_purge(unsigned long start, unsigned long end,
 			start += (1UL << nbits);
 		} while (start < end);
 		ia64_srlz_i();
-		__get_cpu_var(ptcstats).ptc_l++;
 		preempt_enable();
 		return;
 	}
 
 	if (atomic_read(&mm->mm_users) == 1) {
 		flush_tlb_mm(mm);
-		__get_cpu_var(ptcstats).change_rid++;
 		preempt_enable();
 		return;
 	}
 
-	itc = ia64_get_itc();
 	nix = 0;
 	for_each_node_mask(cnode, nodes_flushed)
 		nasids[nix++] = cnodeid_to_nasid(cnode);
@@ -261,12 +148,7 @@ sn2_global_tlb_purge(unsigned long start, unsigned long end,
 
 	mynasid = get_nasid();
 
-	itc = ia64_get_itc();
-	opt = ptc_lock(&flags);
-	itc2 = ia64_get_itc();
-	__get_cpu_var(ptcstats).lock_itc_clocks += itc2 - itc;
-	__get_cpu_var(ptcstats).shub_ptc_flushes++;
-	__get_cpu_var(ptcstats).nodes_flushed += nix;
+	spin_lock_irqsave(&sn2_global_ptc_lock, flags);
 
 	do {
 		if (shub1)
@@ -275,7 +157,7 @@ sn2_global_tlb_purge(unsigned long start, unsigned long end,
 			data0 = (data0 & ~SH2_PTC_ADDR_MASK) | (start & SH2_PTC_ADDR_MASK);
 		for (i = 0; i < nix; i++) {
 			nasid = nasids[i];
-			if ((!(sn2_ptctest & 3)) && unlikely(nasid == mynasid)) {
+			if (unlikely(nasid == mynasid)) {
 				ia64_ptcga(start, nbits << 2);
 				ia64_srlz_i();
 			} else {
@@ -287,22 +169,18 @@ sn2_global_tlb_purge(unsigned long start, unsigned long end,
 				flushed = 1;
 			}
 		}
+
 		if (flushed
 		    && (wait_piowc() &
-				(SH_PIO_WRITE_STATUS_WRITE_DEADLOCK_MASK))) {
-			sn2_ptc_deadlock_recovery(nasids, nix, mynasid, ptc0, data0, ptc1, data1);
+			SH_PIO_WRITE_STATUS_WRITE_DEADLOCK_MASK)) {
+			sn2_ptc_deadlock_recovery(ptc0, data0, ptc1, data1);
 		}
 
 		start += (1UL << nbits);
 
 	} while (start < end);
 
-	itc2 = ia64_get_itc() - itc2;
-	__get_cpu_var(ptcstats).shub_itc_clocks += itc2;
-	if (itc2 > __get_cpu_var(ptcstats).shub_itc_clocks_max)
-		__get_cpu_var(ptcstats).shub_itc_clocks_max = itc2;
-
-	ptc_unlock(flags, opt);
+	spin_unlock_irqrestore(&sn2_global_ptc_lock, flags);
 
 	preempt_enable();
 }
@@ -314,29 +192,31 @@ sn2_global_tlb_purge(unsigned long start, unsigned long end,
  * TLB flush transaction.  The recovery sequence is somewhat tricky & is
  * coded in assembly language.
  */
-void sn2_ptc_deadlock_recovery(short *nasids, short nix, int mynasid, volatile unsigned long *ptc0, unsigned long data0,
+void sn2_ptc_deadlock_recovery(volatile unsigned long *ptc0, unsigned long data0,
 	volatile unsigned long *ptc1, unsigned long data1)
 {
 	extern void sn2_ptc_deadlock_recovery_core(volatile unsigned long *, unsigned long,
 	        volatile unsigned long *, unsigned long, volatile unsigned long *, unsigned long);
-	short nasid, i;
-	unsigned long *piows, zeroval;
+	int cnode, mycnode, nasid;
+	volatile unsigned long *piows;
+	volatile unsigned long zeroval;
 
-	__get_cpu_var(ptcstats).deadlocks++;
+	sn2_ptc_deadlock_count++;
 
-	piows = (unsigned long *) pda->pio_write_status_addr;
+	piows = pda->pio_write_status_addr;
 	zeroval = pda->pio_write_status_val;
 
-	for (i=0; i < nix; i++) {
-		nasid = nasids[i];
-		if (!(sn2_ptctest & 3) && nasid == mynasid)
+	mycnode = numa_node_id();
+
+	for_each_online_node(cnode) {
+		if (is_headless_node(cnode) || cnode == mycnode)
 			continue;
+		nasid = cnodeid_to_nasid(cnode);
 		ptc0 = CHANGE_NASID(nasid, ptc0);
 		if (ptc1)
 			ptc1 = CHANGE_NASID(nasid, ptc1);
 		sn2_ptc_deadlock_recovery_core(ptc0, data0, ptc1, data1, piows, zeroval);
 	}
-
 }
 
 /**
@@ -413,93 +293,3 @@ void sn2_send_IPI(int cpuid, int vector, int delivery_mode, int redirect)
 
 	sn_send_IPI_phys(nasid, physid, vector, delivery_mode);
 }
-
-#ifdef CONFIG_PROC_FS
-
-#define PTC_BASENAME	"sgi_sn/ptc_statistics"
-
-static void *sn2_ptc_seq_start(struct seq_file *file, loff_t * offset)
-{
-	if (*offset < NR_CPUS)
-		return offset;
-	return NULL;
-}
-
-static void *sn2_ptc_seq_next(struct seq_file *file, void *data, loff_t * offset)
-{
-	(*offset)++;
-	if (*offset < NR_CPUS)
-		return offset;
-	return NULL;
-}
-
-static void sn2_ptc_seq_stop(struct seq_file *file, void *data)
-{
-}
-
-static int sn2_ptc_seq_show(struct seq_file *file, void *data)
-{
-	struct ptc_stats *stat;
-	int cpu;
-
-	cpu = *(loff_t *) data;
-
-	if (!cpu) {
-		seq_printf(file, "# ptc_l change_rid shub_ptc_flushes shub_nodes_flushed deadlocks lock_nsec shub_nsec shub_nsec_max\n");
-		seq_printf(file, "# ptctest %d\n", sn2_ptctest);
-	}
-
-	if (cpu < NR_CPUS && cpu_online(cpu)) {
-		stat = &per_cpu(ptcstats, cpu);
-		seq_printf(file, "cpu %d %ld %ld %ld %ld %ld %ld %ld %ld\n", cpu, stat->ptc_l,
-				stat->change_rid, stat->shub_ptc_flushes, stat->nodes_flushed,
-				stat->deadlocks,
-				1000 * stat->lock_itc_clocks / per_cpu(cpu_info, cpu).cyc_per_usec,
-				1000 * stat->shub_itc_clocks / per_cpu(cpu_info, cpu).cyc_per_usec,
-				1000 * stat->shub_itc_clocks_max / per_cpu(cpu_info, cpu).cyc_per_usec);
-	}
-
-	return 0;
-}
-
-static struct seq_operations sn2_ptc_seq_ops = {
-	.start = sn2_ptc_seq_start,
-	.next = sn2_ptc_seq_next,
-	.stop = sn2_ptc_seq_stop,
-	.show = sn2_ptc_seq_show
-};
-
-int sn2_ptc_proc_open(struct inode *inode, struct file *file)
-{
-	return seq_open(file, &sn2_ptc_seq_ops);
-}
-
-static struct file_operations proc_sn2_ptc_operations = {
-	.open = sn2_ptc_proc_open,
-	.read = seq_read,
-	.llseek = seq_lseek,
-	.release = seq_release,
-};
-
-static struct proc_dir_entry *proc_sn2_ptc;
-
-static int __init sn2_ptc_init(void)
-{
-	if (!(proc_sn2_ptc = create_proc_entry(PTC_BASENAME, 0444, NULL))) {
-		printk(KERN_ERR "unable to create %s proc entry", PTC_BASENAME);
-		return -EINVAL;
-	}
-	proc_sn2_ptc->proc_fops = &proc_sn2_ptc_operations;
-	spin_lock_init(&sn2_global_ptc_lock);
-	return 0;
-}
-
-static void __exit sn2_ptc_exit(void)
-{
-	remove_proc_entry(PTC_BASENAME, NULL);
-}
-
-module_init(sn2_ptc_init);
-module_exit(sn2_ptc_exit);
-#endif /* CONFIG_PROC_FS */
-
diff --git a/trunk/arch/ia64/sn/kernel/sn2/sn_hwperf.c b/trunk/arch/ia64/sn/kernel/sn2/sn_hwperf.c
index 0513aacac8c1..833e700fdac9 100644
--- a/trunk/arch/ia64/sn/kernel/sn2/sn_hwperf.c
+++ b/trunk/arch/ia64/sn/kernel/sn2/sn_hwperf.c
@@ -36,6 +36,7 @@
 #include <asm/topology.h>
 #include <asm/smp.h>
 #include <asm/semaphore.h>
+#include <asm/segment.h>
 #include <asm/uaccess.h>
 #include <asm/sal.h>
 #include <asm/sn/io.h>
@@ -58,7 +59,7 @@ static int sn_hwperf_enum_objects(int *nobj, struct sn_hwperf_object_info **ret)
 	struct sn_hwperf_object_info *objbuf = NULL;
 
 	if ((e = sn_hwperf_init()) < 0) {
-		printk(KERN_ERR "sn_hwperf_init failed: err %d\n", e);
+		printk("sn_hwperf_init failed: err %d\n", e);
 		goto out;
 	}
 
@@ -110,7 +111,7 @@ static int sn_hwperf_geoid_to_cnode(char *location)
 	if (sn_hwperf_location_to_bpos(location, &rack, &bay, &slot, &slab))
 		return -1;
 
-	for_each_node(cnode) {
+	for (cnode = 0; cnode < numionodes; cnode++) {
 		geoid = cnodeid_get_geoid(cnode);
 		module_id = geo_module(geoid);
 		this_rack = MODULE_GET_RACK(module_id);
@@ -123,13 +124,11 @@ static int sn_hwperf_geoid_to_cnode(char *location)
 		}
 	}
 
-	return node_possible(cnode) ? cnode : -1;
+	return cnode < numionodes ? cnode : -1;
 }
 
 static int sn_hwperf_obj_to_cnode(struct sn_hwperf_object_info * obj)
 {
-	if (!SN_HWPERF_IS_NODE(obj) && !SN_HWPERF_IS_IONODE(obj))
-		BUG();
 	if (!obj->sn_hwp_this_part)
 		return -1;
 	return sn_hwperf_geoid_to_cnode(obj->location);
@@ -175,199 +174,31 @@ static const char *sn_hwperf_get_slabname(struct sn_hwperf_object_info *obj,
 	return slabname;
 }
 
-static void print_pci_topology(struct seq_file *s)
-{
-	char *p;
-	size_t sz;
-	int e;
-
-	for (sz = PAGE_SIZE; sz < 16 * PAGE_SIZE; sz += PAGE_SIZE) {
-		if (!(p = (char *)kmalloc(sz, GFP_KERNEL)))
-			break;
-		e = ia64_sn_ioif_get_pci_topology(__pa(p), sz);
-		if (e == SALRET_OK)
-			seq_puts(s, p);
-		kfree(p);
-		if (e == SALRET_OK || e == SALRET_NOT_IMPLEMENTED)
-			break;
-	}
-}
-
-static inline int sn_hwperf_has_cpus(cnodeid_t node)
-{
-	return node_online(node) && nr_cpus_node(node);
-}
-
-static inline int sn_hwperf_has_mem(cnodeid_t node)
-{
-	return node_online(node) && NODE_DATA(node)->node_present_pages;
-}
-
-static struct sn_hwperf_object_info *
-sn_hwperf_findobj_id(struct sn_hwperf_object_info *objbuf,
-	int nobj, int id)
+static void print_pci_topology(struct seq_file *s,
+	struct sn_hwperf_object_info *obj, int *ordinal,
+	u64 rack, u64 bay, u64 slot, u64 slab)
 {
-	int i;
-	struct sn_hwperf_object_info *p = objbuf;
-
-	for (i=0; i < nobj; i++, p++) {
-		if (p->id == id)
-			return p;
-	}
-
-	return NULL;
-
-}
-
-static int sn_hwperf_get_nearest_node_objdata(struct sn_hwperf_object_info *objbuf,
-	int nobj, cnodeid_t node, cnodeid_t *near_mem_node, cnodeid_t *near_cpu_node)
-{
-	int e;
-	struct sn_hwperf_object_info *nodeobj = NULL;
-	struct sn_hwperf_object_info *op;
-	struct sn_hwperf_object_info *dest;
-	struct sn_hwperf_object_info *router;
-	struct sn_hwperf_port_info ptdata[16];
-	int sz, i, j;
-	cnodeid_t c;
-	int found_mem = 0;
-	int found_cpu = 0;
-
-	if (!node_possible(node))
-		return -EINVAL;
-
-	if (sn_hwperf_has_cpus(node)) {
-		if (near_cpu_node)
-			*near_cpu_node = node;
-		found_cpu++;
-	}
-
-	if (sn_hwperf_has_mem(node)) {
-		if (near_mem_node)
-			*near_mem_node = node;
-		found_mem++;
-	}
-
-	if (found_cpu && found_mem)
-		return 0; /* trivially successful */
-
-	/* find the argument node object */
-	for (i=0, op=objbuf; i < nobj; i++, op++) {
-		if (!SN_HWPERF_IS_NODE(op) && !SN_HWPERF_IS_IONODE(op))
-			continue;
-		if (node == sn_hwperf_obj_to_cnode(op)) {
-			nodeobj = op;
-			break;
-		}
-	}
-	if (!nodeobj) {
-		e = -ENOENT;
-		goto err;
-	}
-
-	/* get it's interconnect topology */
-	sz = op->ports * sizeof(struct sn_hwperf_port_info);
-	if (sz > sizeof(ptdata))
-		BUG();
-	e = ia64_sn_hwperf_op(sn_hwperf_master_nasid,
-			      SN_HWPERF_ENUM_PORTS, nodeobj->id, sz,
-			      (u64)&ptdata, 0, 0, NULL);
-	if (e != SN_HWPERF_OP_OK) {
-		e = -EINVAL;
-		goto err;
-	}
-
-	/* find nearest node with cpus and nearest memory */
-	for (router=NULL, j=0; j < op->ports; j++) {
-		dest = sn_hwperf_findobj_id(objbuf, nobj, ptdata[j].conn_id);
-		if (!dest || SN_HWPERF_FOREIGN(dest) ||
-		    !SN_HWPERF_IS_NODE(dest) || SN_HWPERF_IS_IONODE(dest)) {
-			continue;
-		}
-		c = sn_hwperf_obj_to_cnode(dest);
-		if (!found_cpu && sn_hwperf_has_cpus(c)) {
-			if (near_cpu_node)
-				*near_cpu_node = c;
-			found_cpu++;
-		}
-		if (!found_mem && sn_hwperf_has_mem(c)) {
-			if (near_mem_node)
-				*near_mem_node = c;
-			found_mem++;
-		}
-		if (SN_HWPERF_IS_ROUTER(dest))
-			router = dest;
-	}
-
-	if (router && (!found_cpu || !found_mem)) {
-		/* search for a node connected to the same router */
-		sz = router->ports * sizeof(struct sn_hwperf_port_info);
-		if (sz > sizeof(ptdata))
-			BUG();
-		e = ia64_sn_hwperf_op(sn_hwperf_master_nasid,
-				      SN_HWPERF_ENUM_PORTS, router->id, sz,
-				      (u64)&ptdata, 0, 0, NULL);
-		if (e != SN_HWPERF_OP_OK) {
-			e = -EINVAL;
-			goto err;
-		}
-		for (j=0; j < router->ports; j++) {
-			dest = sn_hwperf_findobj_id(objbuf, nobj,
-				ptdata[j].conn_id);
-			if (!dest || dest->id == node ||
-			    SN_HWPERF_FOREIGN(dest) ||
-			    !SN_HWPERF_IS_NODE(dest) ||
-			    SN_HWPERF_IS_IONODE(dest)) {
-				continue;
-			}
-			c = sn_hwperf_obj_to_cnode(dest);
-			if (!found_cpu && sn_hwperf_has_cpus(c)) {
-				if (near_cpu_node)
-					*near_cpu_node = c;
-				found_cpu++;
-			}
-			if (!found_mem && sn_hwperf_has_mem(c)) {
-				if (near_mem_node)
-					*near_mem_node = c;
-				found_mem++;
-			}
-			if (found_cpu && found_mem)
-				break;
-		}
-	}
-
-	if (!found_cpu || !found_mem) {
-		/* resort to _any_ node with CPUs and memory */
-		for (i=0, op=objbuf; i < nobj; i++, op++) {
-			if (SN_HWPERF_FOREIGN(op) ||
-			    SN_HWPERF_IS_IONODE(op) ||
-			    !SN_HWPERF_IS_NODE(op)) {
-				continue;
-			}
-			c = sn_hwperf_obj_to_cnode(op);
-			if (!found_cpu && sn_hwperf_has_cpus(c)) {
-				if (near_cpu_node)
-					*near_cpu_node = c;
-				found_cpu++;
-			}
-			if (!found_mem && sn_hwperf_has_mem(c)) {
-				if (near_mem_node)
-					*near_mem_node = c;
-				found_mem++;
-			}
-			if (found_cpu && found_mem)
+	char *p1;
+	char *p2;
+	char *pg;
+
+	if (!(pg = (char *)get_zeroed_page(GFP_KERNEL)))
+		return; /* ignore */
+	if (ia64_sn_ioif_get_pci_topology(rack, bay, slot, slab,
+		__pa(pg), PAGE_SIZE) == SN_HWPERF_OP_OK) {
+		for (p1=pg; *p1 && p1 < pg + PAGE_SIZE;) {
+			if (!(p2 = strchr(p1, '\n')))
 				break;
+			*p2 = '\0';
+			seq_printf(s, "pcibus %d %s-%s\n",
+				*ordinal, obj->location, p1);
+			(*ordinal)++;
+			p1 = p2 + 1;
 		}
 	}
-
-	if (!found_cpu || !found_mem)
-		e = -ENODATA;
-
-err:
-	return e;
+	free_page((unsigned long)pg);
 }
 
-
 static int sn_topology_show(struct seq_file *s, void *d)
 {
 	int sz;
@@ -384,6 +215,7 @@ static int sn_topology_show(struct seq_file *s, void *d)
 	struct sn_hwperf_object_info *p;
 	struct sn_hwperf_object_info *obj = d;	/* this object */
 	struct sn_hwperf_object_info *objs = s->private; /* all objects */
+	int rack, bay, slot, slab;
 	u8 shubtype;
 	u8 system_size;
 	u8 sharing_size;
@@ -393,6 +225,7 @@ static int sn_topology_show(struct seq_file *s, void *d)
 	u8 region_size;
 	u16 nasid_mask;
 	int nasid_msb;
+	int pci_bus_ordinal = 0;
 
 	if (obj == objs) {
 		seq_printf(s, "# sn_topology version 2\n");
@@ -420,8 +253,6 @@ static int sn_topology_show(struct seq_file *s, void *d)
 			shubtype ? "shub2" : "shub1", 
 			(u64)nasid_mask << nasid_shift, nasid_msb, nasid_shift,
 			system_size, sharing_size, coher, region_size);
-
-		print_pci_topology(s);
 	}
 
 	if (SN_HWPERF_FOREIGN(obj)) {
@@ -441,24 +272,11 @@ static int sn_topology_show(struct seq_file *s, void *d)
 	if (!SN_HWPERF_IS_NODE(obj) && !SN_HWPERF_IS_IONODE(obj))
 		seq_putc(s, '\n');
 	else {
-		cnodeid_t near_mem = -1;
-		cnodeid_t near_cpu = -1;
-
 		seq_printf(s, ", nasid 0x%x", cnodeid_to_nasid(ordinal));
-
-		if (sn_hwperf_get_nearest_node_objdata(objs, sn_hwperf_obj_cnt,
-			ordinal, &near_mem, &near_cpu) == 0) {
-			seq_printf(s, ", near_mem_nodeid %d, near_cpu_nodeid %d",
-				near_mem, near_cpu);
-		}
-
-		if (!SN_HWPERF_IS_IONODE(obj)) {
-			for_each_online_node(i) {
-				seq_printf(s, i ? ":%d" : ", dist %d",
-					node_distance(ordinal, i));
-			}
+		for (i=0; i < numionodes; i++) {
+			seq_printf(s, i ? ":%d" : ", dist %d",
+				node_distance(ordinal, i));
 		}
-
 		seq_putc(s, '\n');
 
 		/*
@@ -482,6 +300,17 @@ static int sn_topology_show(struct seq_file *s, void *d)
 				seq_putc(s, '\n');
 			}
 		}
+
+		/*
+		 * PCI busses attached to this node, if any
+		 */
+		if (sn_hwperf_location_to_bpos(obj->location,
+			&rack, &bay, &slot, &slab)) {
+			/* export pci bus info */
+			print_pci_topology(s, obj, &pci_bus_ordinal,
+				rack, bay, slot, slab);
+
+		}
 	}
 
 	if (obj->ports) {
@@ -743,8 +572,6 @@ sn_hwperf_ioctl(struct inode *in, struct file *fp, u32 op, u64 arg)
 		if ((r = sn_hwperf_enum_objects(&nobj, &objs)) == 0) {
 			memset(p, 0, a.sz);
 			for (i = 0; i < nobj; i++) {
-				if (!SN_HWPERF_IS_NODE(objs + i))
-					continue;
 				node = sn_hwperf_obj_to_cnode(objs + i);
 				for_each_online_cpu(j) {
 					if (node != cpu_to_node(j))
@@ -771,7 +598,7 @@ sn_hwperf_ioctl(struct inode *in, struct file *fp, u32 op, u64 arg)
 
 	case SN_HWPERF_GET_NODE_NASID:
 		if (a.sz != sizeof(u64) ||
-		   (node = a.arg) < 0 || !node_possible(node)) {
+		   (node = a.arg) < 0 || node >= numionodes) {
 			r = -EINVAL;
 			goto error;
 		}
@@ -800,14 +627,6 @@ sn_hwperf_ioctl(struct inode *in, struct file *fp, u32 op, u64 arg)
 				vfree(objs);
 				goto error;
 			}
-
-			if (!SN_HWPERF_IS_NODE(objs + i) &&
-			    !SN_HWPERF_IS_IONODE(objs + i)) {
-			    	r = -ENOENT;
-				vfree(objs);
-				goto error;
-			}
-
 			*(u64 *)p = (u64)sn_hwperf_obj_to_cnode(objs + i);
 			vfree(objs);
 		}
@@ -873,7 +692,6 @@ static int sn_hwperf_init(void)
 
 	/* single threaded, once-only initialization */
 	down(&sn_hwperf_init_mutex);
-
 	if (sn_hwperf_salheap) {
 		up(&sn_hwperf_init_mutex);
 		return e;
@@ -924,6 +742,19 @@ static int sn_hwperf_init(void)
 		sn_hwperf_salheap = NULL;
 		sn_hwperf_obj_cnt = 0;
 	}
+
+	if (!e) {
+		/*
+		 * Register a dynamic misc device for ioctl. Platforms
+		 * supporting hotplug will create /dev/sn_hwperf, else
+		 * user can to look up the minor number in /proc/misc.
+		 */
+		if ((e = misc_register(&sn_hwperf_dev)) != 0) {
+			printk(KERN_ERR "sn_hwperf_init: misc register "
+			       "for \"sn_hwperf\" failed, err %d\n", e);
+		}
+	}
+
 	up(&sn_hwperf_init_mutex);
 	return e;
 }
@@ -951,41 +782,3 @@ int sn_topology_release(struct inode *inode, struct file *file)
 	vfree(seq->private);
 	return seq_release(inode, file);
 }
-
-int sn_hwperf_get_nearest_node(cnodeid_t node,
-	cnodeid_t *near_mem_node, cnodeid_t *near_cpu_node)
-{
-	int e;
-	int nobj;
-	struct sn_hwperf_object_info *objbuf;
-
-	if ((e = sn_hwperf_enum_objects(&nobj, &objbuf)) == 0) {
-		e = sn_hwperf_get_nearest_node_objdata(objbuf, nobj,
-			node, near_mem_node, near_cpu_node);
-		vfree(objbuf);
-	}
-
-	return e;
-}
-
-static int __devinit sn_hwperf_misc_register_init(void)
-{
-	int e;
-
-	sn_hwperf_init();
-
-	/*
-	 * Register a dynamic misc device for hwperf ioctls. Platforms
-	 * supporting hotplug will create /dev/sn_hwperf, else user
-	 * can to look up the minor number in /proc/misc.
-	 */
-	if ((e = misc_register(&sn_hwperf_dev)) != 0) {
-		printk(KERN_ERR "sn_hwperf_misc_register_init: failed to "
-		"register misc device for \"%s\"\n", sn_hwperf_dev.name);
-	}
-
-	return e;
-}
-
-device_initcall(sn_hwperf_misc_register_init); /* after misc_init() */
-EXPORT_SYMBOL(sn_hwperf_get_nearest_node);
diff --git a/trunk/arch/ia64/sn/kernel/sn2/sn_proc_fs.c b/trunk/arch/ia64/sn/kernel/sn2/sn_proc_fs.c
index 51bf82720d99..6a80fca807b9 100644
--- a/trunk/arch/ia64/sn/kernel/sn2/sn_proc_fs.c
+++ b/trunk/arch/ia64/sn/kernel/sn2/sn_proc_fs.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2000-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2000-2004 Silicon Graphics, Inc. All rights reserved.
  */
 #include <linux/config.h>
 #include <asm/uaccess.h>
@@ -15,7 +15,7 @@
 
 static int partition_id_show(struct seq_file *s, void *p)
 {
-	seq_printf(s, "%d\n", sn_partition_id);
+	seq_printf(s, "%d\n", sn_local_partid());
 	return 0;
 }
 
diff --git a/trunk/arch/ia64/sn/kernel/sn2/timer_interrupt.c b/trunk/arch/ia64/sn/kernel/sn2/timer_interrupt.c
index adf5db2e2afe..cde7375390b0 100644
--- a/trunk/arch/ia64/sn/kernel/sn2/timer_interrupt.c
+++ b/trunk/arch/ia64/sn/kernel/sn2/timer_interrupt.c
@@ -1,7 +1,7 @@
 /*
  *
  *
- * Copyright (c) 2005 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2003 Silicon Graphics, Inc.  All Rights Reserved.
  * 
  * This program is free software; you can redistribute it and/or modify it 
  * under the terms of version 2 of the GNU General Public License 
@@ -50,16 +50,14 @@ void sn_timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 			     LED_CPU_HEARTBEAT, LED_CPU_HEARTBEAT);
 	}
 
-	if (is_shub1()) {
-		if (enable_shub_wars_1_1()) {
-			/* Bugfix code for SHUB 1.1 */
-			if (pda->pio_shub_war_cam_addr)
-				*pda->pio_shub_war_cam_addr = 0x8000000000000010UL;
-		}
-		if (pda->sn_lb_int_war_ticks == 0)
-			sn_lb_int_war_check();
-		pda->sn_lb_int_war_ticks++;
-		if (pda->sn_lb_int_war_ticks >= SN_LB_INT_WAR_INTERVAL)
-			pda->sn_lb_int_war_ticks = 0;
+	if (enable_shub_wars_1_1()) {
+		/* Bugfix code for SHUB 1.1 */
+		if (pda->pio_shub_war_cam_addr)
+			*pda->pio_shub_war_cam_addr = 0x8000000000000010UL;
 	}
+	if (pda->sn_lb_int_war_ticks == 0)
+		sn_lb_int_war_check();
+	pda->sn_lb_int_war_ticks++;
+	if (pda->sn_lb_int_war_ticks >= SN_LB_INT_WAR_INTERVAL)
+		pda->sn_lb_int_war_ticks = 0;
 }
diff --git a/trunk/arch/ia64/sn/pci/Makefile b/trunk/arch/ia64/sn/pci/Makefile
index 321576b1b425..2f915bce25f9 100644
--- a/trunk/arch/ia64/sn/pci/Makefile
+++ b/trunk/arch/ia64/sn/pci/Makefile
@@ -7,4 +7,4 @@
 #
 # Makefile for the sn pci general routines.
 
-obj-y := pci_dma.o tioca_provider.o tioce_provider.o pcibr/
+obj-y := pci_dma.o tioca_provider.o pcibr/ 
diff --git a/trunk/arch/ia64/sn/pci/pcibr/pcibr_dma.c b/trunk/arch/ia64/sn/pci/pcibr/pcibr_dma.c
index 34093476e965..b058dc2a0b9d 100644
--- a/trunk/arch/ia64/sn/pci/pcibr/pcibr_dma.c
+++ b/trunk/arch/ia64/sn/pci/pcibr/pcibr_dma.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2001-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2001-2004 Silicon Graphics, Inc. All rights reserved.
  */
 
 #include <linux/types.h>
@@ -215,8 +215,8 @@ void sn_dma_flush(uint64_t addr)
 	int is_tio;
 	int wid_num;
 	int i, j;
+	int bwin;
 	uint64_t flags;
-	uint64_t itte;
 	struct hubdev_info *hubinfo;
 	volatile struct sn_flush_device_list *p;
 	struct sn_flush_nasid_entry *flush_nasid_list;
@@ -233,36 +233,31 @@ void sn_dma_flush(uint64_t addr)
 	if (!hubinfo) {
 		BUG();
 	}
+	is_tio = (nasid & 1);
+	if (is_tio) {
+		wid_num = TIO_SWIN_WIDGETNUM(addr);
+		bwin = TIO_BWIN_WINDOWNUM(addr);
+	} else {
+		wid_num = SWIN_WIDGETNUM(addr);
+		bwin = BWIN_WINDOWNUM(addr);
+	}
 
 	flush_nasid_list = &hubinfo->hdi_flush_nasid_list;
 	if (flush_nasid_list->widget_p == NULL)
 		return;
+	if (bwin > 0) {
+		uint64_t itte = flush_nasid_list->iio_itte[bwin];
 
-	is_tio = (nasid & 1);
-	if (is_tio) {
-		int itte_index;
-
-		if (TIO_HWIN(addr))
-			itte_index = 0;
-		else if (TIO_BWIN_WINDOWNUM(addr))
-			itte_index = TIO_BWIN_WINDOWNUM(addr);
-		else
-			itte_index = -1;
-
-		if (itte_index >= 0) {
-			itte = flush_nasid_list->iio_itte[itte_index];
-			if (! TIO_ITTE_VALID(itte))
-				return;
-			wid_num = TIO_ITTE_WIDGET(itte);
-		} else
-			wid_num = TIO_SWIN_WIDGETNUM(addr);
-	} else {
-		if (BWIN_WINDOWNUM(addr)) {
-			itte = flush_nasid_list->iio_itte[BWIN_WINDOWNUM(addr)];
-			wid_num = IIO_ITTE_WIDGET(itte);
-		} else
-			wid_num = SWIN_WIDGETNUM(addr);
+		if (is_tio) {
+			wid_num = (itte >> TIO_ITTE_WIDGET_SHIFT) &
+			    TIO_ITTE_WIDGET_MASK;
+		} else {
+			wid_num = (itte >> IIO_ITTE_WIDGET_SHIFT) &
+			    IIO_ITTE_WIDGET_MASK;
+		}
 	}
+	if (flush_nasid_list->widget_p == NULL)
+		return;
 	if (flush_nasid_list->widget_p[wid_num] == NULL)
 		return;
 	p = &flush_nasid_list->widget_p[wid_num][0];
@@ -288,16 +283,10 @@ void sn_dma_flush(uint64_t addr)
 	/*
 	 * For TIOCP use the Device(x) Write Request Buffer Flush Bridge
 	 * register since it ensures the data has entered the coherence
-	 * domain, unlike PIC.
+	 * domain, unlike PIC
 	 */
 	if (is_tio) {
-		/*
-	 	 * Note:  devices behind TIOCE should never be matched in the
-		 * above code, and so the following code is PIC/CP centric.
-		 * If CE ever needs the sn_dma_flush mechanism, we will have
-		 * to account for that here and in tioce_bus_fixup().
-	 	 */
-		uint32_t tio_id = HUB_L(TIO_IOSPACE_ADDR(nasid, TIO_NODE_ID));
+		uint32_t tio_id = REMOTE_HUB_L(nasid, TIO_NODE_ID);
 		uint32_t revnum = XWIDGET_PART_REV_NUM(tio_id);
 
 		/* TIOCP BRINGUP WAR (PV907516): Don't write buffer flush reg */
@@ -317,8 +306,7 @@ void sn_dma_flush(uint64_t addr)
 		*(volatile uint32_t *)(p->sfdl_force_int_addr) = 1;
 
 		/* wait for the interrupt to come back. */
-		while (*(p->sfdl_flush_addr) != 0x10f)
-			cpu_relax();
+		while (*(p->sfdl_flush_addr) != 0x10f) ;
 
 		/* okay, everything is synched up. */
 		spin_unlock_irqrestore((spinlock_t *)&p->sfdl_flush_lock, flags);
diff --git a/trunk/arch/ia64/sn/pci/pcibr/pcibr_provider.c b/trunk/arch/ia64/sn/pci/pcibr/pcibr_provider.c
index 7b03b8084ffc..b95e928636a1 100644
--- a/trunk/arch/ia64/sn/pci/pcibr/pcibr_provider.c
+++ b/trunk/arch/ia64/sn/pci/pcibr/pcibr_provider.c
@@ -15,7 +15,6 @@
 #include <asm/sn/pcibus_provider_defs.h>
 #include <asm/sn/pcidev.h>
 #include <asm/sn/sn_sal.h>
-#include <asm/sn/sn2/sn_hwperf.h>
 #include "xtalk/xwidgetdev.h"
 #include "xtalk/hubdev.h"
 
@@ -61,7 +60,7 @@ static int sal_pcibr_error_interrupt(struct pcibus_info *soft)
 	ret_stuff.status = 0;
 	ret_stuff.v0 = 0;
 
-	segment = soft->pbi_buscommon.bs_persist_segment;
+	segment = 0;
 	busnum = soft->pbi_buscommon.bs_persist_busnum;
 	SAL_CALL_NOLOCK(ret_stuff,
 			(u64) SN_SAL_IOIF_ERROR_INTERRUPT,
@@ -89,7 +88,6 @@ void *
 pcibr_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *controller)
 {
 	int nasid, cnode, j;
-	cnodeid_t near_cnode;
 	struct hubdev_info *hubdev_info;
 	struct pcibus_info *soft;
 	struct sn_flush_device_list *sn_flush_device_list;
@@ -117,7 +115,7 @@ pcibr_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
 	/*
 	 * register the bridge's error interrupt handler
 	 */
-	if (request_irq(SGI_PCIASIC_ERROR, (void *)pcibr_error_intr_handler,
+	if (request_irq(SGI_PCIBR_ERROR, (void *)pcibr_error_intr_handler,
 			SA_SHIRQ, "PCIBR error", (void *)(soft))) {
 		printk(KERN_WARNING
 		       "pcibr cannot allocate interrupt for error handler\n");
@@ -144,12 +142,9 @@ pcibr_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
 			     j++, sn_flush_device_list++) {
 				if (sn_flush_device_list->sfdl_slot == -1)
 					continue;
-				if ((sn_flush_device_list->
-				     sfdl_persistent_segment ==
-				     soft->pbi_buscommon.bs_persist_segment) &&
-				     (sn_flush_device_list->
-				     sfdl_persistent_busnum ==
-				     soft->pbi_buscommon.bs_persist_busnum))
+				if (sn_flush_device_list->
+				    sfdl_persistent_busnum ==
+				    soft->pbi_buscommon.bs_persist_busnum)
 					sn_flush_device_list->sfdl_pcibus_info =
 					    soft;
 			}
@@ -163,18 +158,12 @@ pcibr_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
 	memset(soft->pbi_int_ate_resource.ate, 0,
  	       (soft->pbi_int_ate_size * sizeof(uint64_t)));
 
-	if (prom_bussoft->bs_asic_type == PCIIO_ASIC_TYPE_TIOCP) {
-		/* TIO PCI Bridge: find nearest node with CPUs */
-		int e = sn_hwperf_get_nearest_node(cnode, NULL, &near_cnode);
-
-		if (e < 0) {
-			near_cnode = (cnodeid_t)-1; /* use any node */
-			printk(KERN_WARNING "pcibr_bus_fixup: failed to find "
-				"near node with CPUs to TIO node %d, err=%d\n",
-				cnode, e);
-		}
-		controller->node = near_cnode;
-	}
+	if (prom_bussoft->bs_asic_type == PCIIO_ASIC_TYPE_TIOCP)
+		/*
+		 * TIO PCI Bridge with no closest node information.
+		 * FIXME: Find another way to determine the closest node
+		 */
+		controller->node = -1;
 	else
 		controller->node = cnode;
 	return soft;
@@ -186,9 +175,6 @@ void pcibr_force_interrupt(struct sn_irq_info *sn_irq_info)
 	struct pcibus_info *pcibus_info;
 	int bit = sn_irq_info->irq_int_bit;
 
-	if (! sn_irq_info->irq_bridge)
-		return;
-
 	pcidev_info = (struct pcidev_info *)sn_irq_info->irq_pciioinfo;
 	if (pcidev_info) {
 		pcibus_info =
@@ -198,7 +184,7 @@ void pcibr_force_interrupt(struct sn_irq_info *sn_irq_info)
 	}
 }
 
-void pcibr_target_interrupt(struct sn_irq_info *sn_irq_info)
+void pcibr_change_devices_irq(struct sn_irq_info *sn_irq_info)
 {
 	struct pcidev_info *pcidev_info;
 	struct pcibus_info *pcibus_info;
@@ -233,8 +219,6 @@ struct sn_pcibus_provider pcibr_provider = {
 	.dma_map_consistent = pcibr_dma_map_consistent,
 	.dma_unmap = pcibr_dma_unmap,
 	.bus_fixup = pcibr_bus_fixup,
-	.force_interrupt = pcibr_force_interrupt,
-	.target_interrupt = pcibr_target_interrupt
 };
 
 int
diff --git a/trunk/arch/ia64/sn/pci/tioca_provider.c b/trunk/arch/ia64/sn/pci/tioca_provider.c
index ea09c12f0258..5d76a7581465 100644
--- a/trunk/arch/ia64/sn/pci/tioca_provider.c
+++ b/trunk/arch/ia64/sn/pci/tioca_provider.c
@@ -559,7 +559,7 @@ tioca_error_intr_handler(int irq, void *arg, struct pt_regs *pt)
 	ret_stuff.status = 0;
 	ret_stuff.v0 = 0;
 
-	segment = soft->ca_common.bs_persist_segment;
+	segment = 0;
 	busnum = soft->ca_common.bs_persist_busnum;
 
 	SAL_CALL_NOLOCK(ret_stuff,
@@ -622,8 +622,7 @@ tioca_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
 	    nasid_to_cnodeid(tioca_common->ca_closest_nasid);
 	tioca_common->ca_kernel_private = (uint64_t) tioca_kern;
 
-	bus = pci_find_bus(tioca_common->ca_common.bs_persist_segment,
-		tioca_common->ca_common.bs_persist_busnum);
+	bus = pci_find_bus(0, tioca_common->ca_common.bs_persist_busnum);
 	BUG_ON(!bus);
 	tioca_kern->ca_devices = &bus->devices;
 
@@ -657,8 +656,6 @@ static struct sn_pcibus_provider tioca_pci_interfaces = {
 	.dma_map_consistent = tioca_dma_map,
 	.dma_unmap = tioca_dma_unmap,
 	.bus_fixup = tioca_bus_fixup,
-	.force_interrupt = NULL,
-	.target_interrupt = NULL
 };
 
 /**
diff --git a/trunk/arch/ia64/sn/pci/tioce_provider.c b/trunk/arch/ia64/sn/pci/tioce_provider.c
deleted file mode 100644
index 8e75db2b825d..000000000000
--- a/trunk/arch/ia64/sn/pci/tioce_provider.c
+++ /dev/null
@@ -1,771 +0,0 @@
-/*
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2003-2005 Silicon Graphics, Inc.  All Rights Reserved.
- */
-
-#include <linux/types.h>
-#include <linux/interrupt.h>
-#include <linux/pci.h>
-#include <asm/sn/sn_sal.h>
-#include <asm/sn/addrs.h>
-#include <asm/sn/pcidev.h>
-#include <asm/sn/pcibus_provider_defs.h>
-#include <asm/sn/tioce_provider.h>
-
-/**
- * Bus address ranges for the 5 flavors of TIOCE DMA
- */
-
-#define TIOCE_D64_MIN	0x8000000000000000UL
-#define TIOCE_D64_MAX	0xffffffffffffffffUL
-#define TIOCE_D64_ADDR(a)	((a) >= TIOCE_D64_MIN)
-
-#define TIOCE_D32_MIN	0x0000000080000000UL
-#define TIOCE_D32_MAX	0x00000000ffffffffUL
-#define TIOCE_D32_ADDR(a)	((a) >= TIOCE_D32_MIN && (a) <= TIOCE_D32_MAX)
-
-#define TIOCE_M32_MIN	0x0000000000000000UL
-#define TIOCE_M32_MAX	0x000000007fffffffUL
-#define TIOCE_M32_ADDR(a)	((a) >= TIOCE_M32_MIN && (a) <= TIOCE_M32_MAX)
-
-#define TIOCE_M40_MIN	0x0000004000000000UL
-#define TIOCE_M40_MAX	0x0000007fffffffffUL
-#define TIOCE_M40_ADDR(a)	((a) >= TIOCE_M40_MIN && (a) <= TIOCE_M40_MAX)
-
-#define TIOCE_M40S_MIN	0x0000008000000000UL
-#define TIOCE_M40S_MAX	0x000000ffffffffffUL
-#define TIOCE_M40S_ADDR(a)	((a) >= TIOCE_M40S_MIN && (a) <= TIOCE_M40S_MAX)
-
-/*
- * ATE manipulation macros.
- */
-
-#define ATE_PAGESHIFT(ps)	(__ffs(ps))
-#define ATE_PAGEMASK(ps)	((ps)-1)
-
-#define ATE_PAGE(x, ps) ((x) >> ATE_PAGESHIFT(ps))
-#define ATE_NPAGES(start, len, pagesize) \
-	(ATE_PAGE((start)+(len)-1, pagesize) - ATE_PAGE(start, pagesize) + 1)
-
-#define ATE_VALID(ate)	((ate) & (1UL << 63))
-#define ATE_MAKE(addr, ps) (((addr) & ~ATE_PAGEMASK(ps)) | (1UL << 63))
-
-/*
- * Flavors of ate-based mapping supported by tioce_alloc_map()
- */
-
-#define TIOCE_ATE_M32	1
-#define TIOCE_ATE_M40	2
-#define TIOCE_ATE_M40S	3
-
-#define KB(x)	((x) << 10)
-#define MB(x)	((x) << 20)
-#define GB(x)	((x) << 30)
-
-/**
- * tioce_dma_d64 - create a DMA mapping using 64-bit direct mode
- * @ct_addr: system coretalk address
- *
- * Map @ct_addr into 64-bit CE bus space.  No device context is necessary
- * and no CE mapping are consumed.
- *
- * Bits 53:0 come from the coretalk address.  The remaining bits are set as
- * follows:
- *
- * 63    - must be 1 to indicate d64 mode to CE hardware
- * 62    - barrier bit ... controlled with tioce_dma_barrier()
- * 61    - 0 since this is not an MSI transaction
- * 60:54 - reserved, MBZ
- */
-static uint64_t
-tioce_dma_d64(unsigned long ct_addr)
-{
-	uint64_t bus_addr;
-
-	bus_addr = ct_addr | (1UL << 63);
-
-	return bus_addr;
-}
-
-/**
- * pcidev_to_tioce - return misc ce related pointers given a pci_dev
- * @pci_dev: pci device context
- * @base: ptr to store struct tioce_mmr * for the CE holding this device
- * @kernel: ptr to store struct tioce_kernel * for the CE holding this device
- * @port: ptr to store the CE port number that this device is on
- *
- * Return pointers to various CE-related structures for the CE upstream of
- * @pci_dev.
- */
-static inline void
-pcidev_to_tioce(struct pci_dev *pdev, struct tioce **base,
-		struct tioce_kernel **kernel, int *port)
-{
-	struct pcidev_info *pcidev_info;
-	struct tioce_common *ce_common;
-	struct tioce_kernel *ce_kernel;
-
-	pcidev_info = SN_PCIDEV_INFO(pdev);
-	ce_common = (struct tioce_common *)pcidev_info->pdi_pcibus_info;
-	ce_kernel = (struct tioce_kernel *)ce_common->ce_kernel_private;
-
-	if (base)
-		*base = (struct tioce *)ce_common->ce_pcibus.bs_base;
-	if (kernel)
-		*kernel = ce_kernel;
-
-	/*
-	 * we use port as a zero-based value internally, even though the
-	 * documentation is 1-based.
-	 */
-	if (port)
-		*port =
-		    (pdev->bus->number < ce_kernel->ce_port1_secondary) ? 0 : 1;
-}
-
-/**
- * tioce_alloc_map - Given a coretalk address, map it to pcie bus address
- * space using one of the various ATE-based address modes.
- * @ce_kern: tioce context
- * @type: map mode to use
- * @port: 0-based port that the requesting device is downstream of
- * @ct_addr: the coretalk address to map
- * @len: number of bytes to map
- *
- * Given the addressing type, set up various paramaters that define the
- * ATE pool to use.  Search for a contiguous block of entries to cover the
- * length, and if enough resources exist, fill in the ATE's and construct a
- * tioce_dmamap struct to track the mapping.
- */
-static uint64_t
-tioce_alloc_map(struct tioce_kernel *ce_kern, int type, int port,
-		uint64_t ct_addr, int len)
-{
-	int i;
-	int j;
-	int first;
-	int last;
-	int entries;
-	int nates;
-	int pagesize;
-	uint64_t *ate_shadow;
-	uint64_t *ate_reg;
-	uint64_t addr;
-	struct tioce *ce_mmr;
-	uint64_t bus_base;
-	struct tioce_dmamap *map;
-
-	ce_mmr = (struct tioce *)ce_kern->ce_common->ce_pcibus.bs_base;
-
-	switch (type) {
-	case TIOCE_ATE_M32:
-		/*
-		 * The first 64 entries of the ate3240 pool are dedicated to
-		 * super-page (TIOCE_ATE_M40S) mode.
-		 */
-		first = 64;
-		entries = TIOCE_NUM_M3240_ATES - 64;
-		ate_shadow = ce_kern->ce_ate3240_shadow;
-		ate_reg = ce_mmr->ce_ure_ate3240;
-		pagesize = ce_kern->ce_ate3240_pagesize;
-		bus_base = TIOCE_M32_MIN;
-		break;
-	case TIOCE_ATE_M40:
-		first = 0;
-		entries = TIOCE_NUM_M40_ATES;
-		ate_shadow = ce_kern->ce_ate40_shadow;
-		ate_reg = ce_mmr->ce_ure_ate40;
-		pagesize = MB(64);
-		bus_base = TIOCE_M40_MIN;
-		break;
-	case TIOCE_ATE_M40S:
-		/*
-		 * ate3240 entries 0-31 are dedicated to port1 super-page
-		 * mappings.  ate3240 entries 32-63 are dedicated to port2.
-		 */
-		first = port * 32;
-		entries = 32;
-		ate_shadow = ce_kern->ce_ate3240_shadow;
-		ate_reg = ce_mmr->ce_ure_ate3240;
-		pagesize = GB(16);
-		bus_base = TIOCE_M40S_MIN;
-		break;
-	default:
-		return 0;
-	}
-
-	nates = ATE_NPAGES(ct_addr, len, pagesize);
-	if (nates > entries)
-		return 0;
-
-	last = first + entries - nates;
-	for (i = first; i <= last; i++) {
-		if (ATE_VALID(ate_shadow[i]))
-			continue;
-
-		for (j = i; j < i + nates; j++)
-			if (ATE_VALID(ate_shadow[j]))
-				break;
-
-		if (j >= i + nates)
-			break;
-	}
-
-	if (i > last)
-		return 0;
-
-	map = kcalloc(1, sizeof(struct tioce_dmamap), GFP_ATOMIC);
-	if (!map)
-		return 0;
-
-	addr = ct_addr;
-	for (j = 0; j < nates; j++) {
-		uint64_t ate;
-
-		ate = ATE_MAKE(addr, pagesize);
-		ate_shadow[i + j] = ate;
-		ate_reg[i + j] = ate;
-		addr += pagesize;
-	}
-
-	map->refcnt = 1;
-	map->nbytes = nates * pagesize;
-	map->ct_start = ct_addr & ~ATE_PAGEMASK(pagesize);
-	map->pci_start = bus_base + (i * pagesize);
-	map->ate_hw = &ate_reg[i];
-	map->ate_shadow = &ate_shadow[i];
-	map->ate_count = nates;
-
-	list_add(&map->ce_dmamap_list, &ce_kern->ce_dmamap_list);
-
-	return (map->pci_start + (ct_addr - map->ct_start));
-}
-
-/**
- * tioce_dma_d32 - create a DMA mapping using 32-bit direct mode
- * @pdev: linux pci_dev representing the function
- * @paddr: system physical address
- *
- * Map @paddr into 32-bit bus space of the CE associated with @pcidev_info.
- */
-static uint64_t
-tioce_dma_d32(struct pci_dev *pdev, uint64_t ct_addr)
-{
-	int dma_ok;
-	int port;
-	struct tioce *ce_mmr;
-	struct tioce_kernel *ce_kern;
-	uint64_t ct_upper;
-	uint64_t ct_lower;
-	dma_addr_t bus_addr;
-
-	ct_upper = ct_addr & ~0x3fffffffUL;
-	ct_lower = ct_addr & 0x3fffffffUL;
-
-	pcidev_to_tioce(pdev, &ce_mmr, &ce_kern, &port);
-
-	if (ce_kern->ce_port[port].dirmap_refcnt == 0) {
-		volatile uint64_t tmp;
-
-		ce_kern->ce_port[port].dirmap_shadow = ct_upper;
-		ce_mmr->ce_ure_dir_map[port] = ct_upper;
-		tmp = ce_mmr->ce_ure_dir_map[port];
-		dma_ok = 1;
-	} else
-		dma_ok = (ce_kern->ce_port[port].dirmap_shadow == ct_upper);
-
-	if (dma_ok) {
-		ce_kern->ce_port[port].dirmap_refcnt++;
-		bus_addr = TIOCE_D32_MIN + ct_lower;
-	} else
-		bus_addr = 0;
-
-	return bus_addr;
-}
-
-/**
- * tioce_dma_barrier - swizzle a TIOCE bus address to include or exclude
- * the barrier bit.
- * @bus_addr:  bus address to swizzle
- *
- * Given a TIOCE bus address, set the appropriate bit to indicate barrier
- * attributes.
- */
-static uint64_t
-tioce_dma_barrier(uint64_t bus_addr, int on)
-{
-	uint64_t barrier_bit;
-
-	/* barrier not supported in M40/M40S mode */
-	if (TIOCE_M40_ADDR(bus_addr) || TIOCE_M40S_ADDR(bus_addr))
-		return bus_addr;
-
-	if (TIOCE_D64_ADDR(bus_addr))
-		barrier_bit = (1UL << 62);
-	else			/* must be m32 or d32 */
-		barrier_bit = (1UL << 30);
-
-	return (on) ? (bus_addr | barrier_bit) : (bus_addr & ~barrier_bit);
-}
-
-/**
- * tioce_dma_unmap - release CE mapping resources
- * @pdev: linux pci_dev representing the function
- * @bus_addr: bus address returned by an earlier tioce_dma_map
- * @dir: mapping direction (unused)
- *
- * Locate mapping resources associated with @bus_addr and release them.
- * For mappings created using the direct modes there are no resources
- * to release.
- */
-void
-tioce_dma_unmap(struct pci_dev *pdev, dma_addr_t bus_addr, int dir)
-{
-	int i;
-	int port;
-	struct tioce_kernel *ce_kern;
-	struct tioce *ce_mmr;
-	unsigned long flags;
-
-	bus_addr = tioce_dma_barrier(bus_addr, 0);
-	pcidev_to_tioce(pdev, &ce_mmr, &ce_kern, &port);
-
-	/* nothing to do for D64 */
-
-	if (TIOCE_D64_ADDR(bus_addr))
-		return;
-
-	spin_lock_irqsave(&ce_kern->ce_lock, flags);
-
-	if (TIOCE_D32_ADDR(bus_addr)) {
-		if (--ce_kern->ce_port[port].dirmap_refcnt == 0) {
-			ce_kern->ce_port[port].dirmap_shadow = 0;
-			ce_mmr->ce_ure_dir_map[port] = 0;
-		}
-	} else {
-		struct tioce_dmamap *map;
-
-		list_for_each_entry(map, &ce_kern->ce_dmamap_list,
-				    ce_dmamap_list) {
-			uint64_t last;
-
-			last = map->pci_start + map->nbytes - 1;
-			if (bus_addr >= map->pci_start && bus_addr <= last)
-				break;
-		}
-
-		if (&map->ce_dmamap_list == &ce_kern->ce_dmamap_list) {
-			printk(KERN_WARNING
-			       "%s:  %s - no map found for bus_addr 0x%lx\n",
-			       __FUNCTION__, pci_name(pdev), bus_addr);
-		} else if (--map->refcnt == 0) {
-			for (i = 0; i < map->ate_count; i++) {
-				map->ate_shadow[i] = 0;
-				map->ate_hw[i] = 0;
-			}
-
-			list_del(&map->ce_dmamap_list);
-			kfree(map);
-		}
-	}
-
-	spin_unlock_irqrestore(&ce_kern->ce_lock, flags);
-}
-
-/**
- * tioce_do_dma_map - map pages for PCI DMA
- * @pdev: linux pci_dev representing the function
- * @paddr: host physical address to map
- * @byte_count: bytes to map
- *
- * This is the main wrapper for mapping host physical pages to CE PCI space.
- * The mapping mode used is based on the device's dma_mask.
- */
-static uint64_t
-tioce_do_dma_map(struct pci_dev *pdev, uint64_t paddr, size_t byte_count,
-		 int barrier)
-{
-	unsigned long flags;
-	uint64_t ct_addr;
-	uint64_t mapaddr = 0;
-	struct tioce_kernel *ce_kern;
-	struct tioce_dmamap *map;
-	int port;
-	uint64_t dma_mask;
-
-	dma_mask = (barrier) ? pdev->dev.coherent_dma_mask : pdev->dma_mask;
-
-	/* cards must be able to address at least 31 bits */
-	if (dma_mask < 0x7fffffffUL)
-		return 0;
-
-	ct_addr = PHYS_TO_TIODMA(paddr);
-
-	/*
-	 * If the device can generate 64 bit addresses, create a D64 map.
-	 * Since this should never fail, bypass the rest of the checks.
-	 */
-	if (dma_mask == ~0UL) {
-		mapaddr = tioce_dma_d64(ct_addr);
-		goto dma_map_done;
-	}
-
-	pcidev_to_tioce(pdev, NULL, &ce_kern, &port);
-
-	spin_lock_irqsave(&ce_kern->ce_lock, flags);
-
-	/*
-	 * D64 didn't work ... See if we have an existing map that covers
-	 * this address range.  Must account for devices dma_mask here since
-	 * an existing map might have been done in a mode using more pci
-	 * address bits than this device can support.
-	 */
-	list_for_each_entry(map, &ce_kern->ce_dmamap_list, ce_dmamap_list) {
-		uint64_t last;
-
-		last = map->ct_start + map->nbytes - 1;
-		if (ct_addr >= map->ct_start &&
-		    ct_addr + byte_count - 1 <= last &&
-		    map->pci_start <= dma_mask) {
-			map->refcnt++;
-			mapaddr = map->pci_start + (ct_addr - map->ct_start);
-			break;
-		}
-	}
-
-	/*
-	 * If we don't have a map yet, and the card can generate 40
-	 * bit addresses, try the M40/M40S modes.  Note these modes do not
-	 * support a barrier bit, so if we need a consistent map these
-	 * won't work.
-	 */
-	if (!mapaddr && !barrier && dma_mask >= 0xffffffffffUL) {
-		/*
-		 * We have two options for 40-bit mappings:  16GB "super" ATE's
-		 * and 64MB "regular" ATE's.  We'll try both if needed for a
-		 * given mapping but which one we try first depends on the
-		 * size.  For requests >64MB, prefer to use a super page with
-		 * regular as the fallback. Otherwise, try in the reverse order.
-		 */
-
-		if (byte_count > MB(64)) {
-			mapaddr = tioce_alloc_map(ce_kern, TIOCE_ATE_M40S,
-						  port, ct_addr, byte_count);
-			if (!mapaddr)
-				mapaddr =
-				    tioce_alloc_map(ce_kern, TIOCE_ATE_M40, -1,
-						    ct_addr, byte_count);
-		} else {
-			mapaddr = tioce_alloc_map(ce_kern, TIOCE_ATE_M40, -1,
-						  ct_addr, byte_count);
-			if (!mapaddr)
-				mapaddr =
-				    tioce_alloc_map(ce_kern, TIOCE_ATE_M40S,
-						    port, ct_addr, byte_count);
-		}
-	}
-
-	/*
-	 * 32-bit direct is the next mode to try
-	 */
-	if (!mapaddr && dma_mask >= 0xffffffffUL)
-		mapaddr = tioce_dma_d32(pdev, ct_addr);
-
-	/*
-	 * Last resort, try 32-bit ATE-based map.
-	 */
-	if (!mapaddr)
-		mapaddr =
-		    tioce_alloc_map(ce_kern, TIOCE_ATE_M32, -1, ct_addr,
-				    byte_count);
-
-	spin_unlock_irqrestore(&ce_kern->ce_lock, flags);
-
-dma_map_done:
-	if (mapaddr & barrier)
-		mapaddr = tioce_dma_barrier(mapaddr, 1);
-
-	return mapaddr;
-}
-
-/**
- * tioce_dma - standard pci dma map interface
- * @pdev: pci device requesting the map
- * @paddr: system physical address to map into pci space
- * @byte_count: # bytes to map
- *
- * Simply call tioce_do_dma_map() to create a map with the barrier bit clear
- * in the address.
- */
-static uint64_t
-tioce_dma(struct pci_dev *pdev, uint64_t paddr, size_t byte_count)
-{
-	return tioce_do_dma_map(pdev, paddr, byte_count, 0);
-}
-
-/**
- * tioce_dma_consistent - consistent pci dma map interface
- * @pdev: pci device requesting the map
- * @paddr: system physical address to map into pci space
- * @byte_count: # bytes to map
- *
- * Simply call tioce_do_dma_map() to create a map with the barrier bit set
- * in the address.
- */ static uint64_t
-tioce_dma_consistent(struct pci_dev *pdev, uint64_t paddr, size_t byte_count)
-{
-	return tioce_do_dma_map(pdev, paddr, byte_count, 1);
-}
-
-/**
- * tioce_error_intr_handler - SGI TIO CE error interrupt handler
- * @irq: unused
- * @arg: pointer to tioce_common struct for the given CE
- * @pt: unused
- *
- * Handle a CE error interrupt.  Simply a wrapper around a SAL call which
- * defers processing to the SGI prom.
- */ static irqreturn_t
-tioce_error_intr_handler(int irq, void *arg, struct pt_regs *pt)
-{
-	struct tioce_common *soft = arg;
-	struct ia64_sal_retval ret_stuff;
-	ret_stuff.status = 0;
-	ret_stuff.v0 = 0;
-
-	SAL_CALL_NOLOCK(ret_stuff, (u64) SN_SAL_IOIF_ERROR_INTERRUPT,
-			soft->ce_pcibus.bs_persist_segment,
-			soft->ce_pcibus.bs_persist_busnum, 0, 0, 0, 0, 0);
-
-	return IRQ_HANDLED;
-}
-
-/**
- * tioce_kern_init - init kernel structures related to a given TIOCE
- * @tioce_common: ptr to a cached tioce_common struct that originated in prom
- */ static struct tioce_kernel *
-tioce_kern_init(struct tioce_common *tioce_common)
-{
-	int i;
-	uint32_t tmp;
-	struct tioce *tioce_mmr;
-	struct tioce_kernel *tioce_kern;
-
-	tioce_kern = kcalloc(1, sizeof(struct tioce_kernel), GFP_KERNEL);
-	if (!tioce_kern) {
-		return NULL;
-	}
-
-	tioce_kern->ce_common = tioce_common;
-	spin_lock_init(&tioce_kern->ce_lock);
-	INIT_LIST_HEAD(&tioce_kern->ce_dmamap_list);
-	tioce_common->ce_kernel_private = (uint64_t) tioce_kern;
-
-	/*
-	 * Determine the secondary bus number of the port2 logical PPB.
-	 * This is used to decide whether a given pci device resides on
-	 * port1 or port2.  Note:  We don't have enough plumbing set up
-	 * here to use pci_read_config_xxx() so use the raw_pci_ops vector.
-	 */
-
-	raw_pci_ops->read(tioce_common->ce_pcibus.bs_persist_segment,
-			  tioce_common->ce_pcibus.bs_persist_busnum,
-			  PCI_DEVFN(2, 0), PCI_SECONDARY_BUS, 1, &tmp);
-	tioce_kern->ce_port1_secondary = (uint8_t) tmp;
-
-	/*
-	 * Set PMU pagesize to the largest size available, and zero out
-	 * the ate's.
-	 */
-
-	tioce_mmr = (struct tioce *)tioce_common->ce_pcibus.bs_base;
-	tioce_mmr->ce_ure_page_map &= ~CE_URE_PAGESIZE_MASK;
-	tioce_mmr->ce_ure_page_map |= CE_URE_256K_PAGESIZE;
-	tioce_kern->ce_ate3240_pagesize = KB(256);
-
-	for (i = 0; i < TIOCE_NUM_M40_ATES; i++) {
-		tioce_kern->ce_ate40_shadow[i] = 0;
-		tioce_mmr->ce_ure_ate40[i] = 0;
-	}
-
-	for (i = 0; i < TIOCE_NUM_M3240_ATES; i++) {
-		tioce_kern->ce_ate3240_shadow[i] = 0;
-		tioce_mmr->ce_ure_ate3240[i] = 0;
-	}
-
-	return tioce_kern;
-}
-
-/**
- * tioce_force_interrupt - implement altix force_interrupt() backend for CE
- * @sn_irq_info: sn asic irq that we need an interrupt generated for
- *
- * Given an sn_irq_info struct, set the proper bit in ce_adm_force_int to
- * force a secondary interrupt to be generated.  This is to work around an
- * asic issue where there is a small window of opportunity for a legacy device
- * interrupt to be lost.
- */
-static void
-tioce_force_interrupt(struct sn_irq_info *sn_irq_info)
-{
-	struct pcidev_info *pcidev_info;
-	struct tioce_common *ce_common;
-	struct tioce *ce_mmr;
-	uint64_t force_int_val;
-
-	if (!sn_irq_info->irq_bridge)
-		return;
-
-	if (sn_irq_info->irq_bridge_type != PCIIO_ASIC_TYPE_TIOCE)
-		return;
-
-	pcidev_info = (struct pcidev_info *)sn_irq_info->irq_pciioinfo;
-	if (!pcidev_info)
-		return;
-
-	ce_common = (struct tioce_common *)pcidev_info->pdi_pcibus_info;
-	ce_mmr = (struct tioce *)ce_common->ce_pcibus.bs_base;
-
-	/*
-	 * irq_int_bit is originally set up by prom, and holds the interrupt
-	 * bit shift (not mask) as defined by the bit definitions in the
-	 * ce_adm_int mmr.  These shifts are not the same for the
-	 * ce_adm_force_int register, so do an explicit mapping here to make
-	 * things clearer.
-	 */
-
-	switch (sn_irq_info->irq_int_bit) {
-	case CE_ADM_INT_PCIE_PORT1_DEV_A_SHFT:
-		force_int_val = 1UL << CE_ADM_FORCE_INT_PCIE_PORT1_DEV_A_SHFT;
-		break;
-	case CE_ADM_INT_PCIE_PORT1_DEV_B_SHFT:
-		force_int_val = 1UL << CE_ADM_FORCE_INT_PCIE_PORT1_DEV_B_SHFT;
-		break;
-	case CE_ADM_INT_PCIE_PORT1_DEV_C_SHFT:
-		force_int_val = 1UL << CE_ADM_FORCE_INT_PCIE_PORT1_DEV_C_SHFT;
-		break;
-	case CE_ADM_INT_PCIE_PORT1_DEV_D_SHFT:
-		force_int_val = 1UL << CE_ADM_FORCE_INT_PCIE_PORT1_DEV_D_SHFT;
-		break;
-	case CE_ADM_INT_PCIE_PORT2_DEV_A_SHFT:
-		force_int_val = 1UL << CE_ADM_FORCE_INT_PCIE_PORT2_DEV_A_SHFT;
-		break;
-	case CE_ADM_INT_PCIE_PORT2_DEV_B_SHFT:
-		force_int_val = 1UL << CE_ADM_FORCE_INT_PCIE_PORT2_DEV_B_SHFT;
-		break;
-	case CE_ADM_INT_PCIE_PORT2_DEV_C_SHFT:
-		force_int_val = 1UL << CE_ADM_FORCE_INT_PCIE_PORT2_DEV_C_SHFT;
-		break;
-	case CE_ADM_INT_PCIE_PORT2_DEV_D_SHFT:
-		force_int_val = 1UL << CE_ADM_FORCE_INT_PCIE_PORT2_DEV_D_SHFT;
-		break;
-	default:
-		return;
-	}
-	ce_mmr->ce_adm_force_int = force_int_val;
-}
-
-/**
- * tioce_target_interrupt - implement set_irq_affinity for tioce resident
- * functions.  Note:  only applies to line interrupts, not MSI's.
- *
- * @sn_irq_info: SN IRQ context
- *
- * Given an sn_irq_info, set the associated CE device's interrupt destination
- * register.  Since the interrupt destination registers are on a per-ce-slot
- * basis, this will retarget line interrupts for all functions downstream of
- * the slot.
- */
-static void
-tioce_target_interrupt(struct sn_irq_info *sn_irq_info)
-{
-	struct pcidev_info *pcidev_info;
-	struct tioce_common *ce_common;
-	struct tioce *ce_mmr;
-	int bit;
-
-	pcidev_info = (struct pcidev_info *)sn_irq_info->irq_pciioinfo;
-	if (!pcidev_info)
-		return;
-
-	ce_common = (struct tioce_common *)pcidev_info->pdi_pcibus_info;
-	ce_mmr = (struct tioce *)ce_common->ce_pcibus.bs_base;
-
-	bit = sn_irq_info->irq_int_bit;
-
-	ce_mmr->ce_adm_int_mask |= (1UL << bit);
-	ce_mmr->ce_adm_int_dest[bit] =
-		((uint64_t)sn_irq_info->irq_irq << INTR_VECTOR_SHFT) |
-			   sn_irq_info->irq_xtalkaddr;
-	ce_mmr->ce_adm_int_mask &= ~(1UL << bit);
-
-	tioce_force_interrupt(sn_irq_info);
-}
-
-/**
- * tioce_bus_fixup - perform final PCI fixup for a TIO CE bus
- * @prom_bussoft: Common prom/kernel struct representing the bus
- *
- * Replicates the tioce_common pointed to by @prom_bussoft in kernel
- * space.  Allocates and initializes a kernel-only area for a given CE,
- * and sets up an irq for handling CE error interrupts.
- *
- * On successful setup, returns the kernel version of tioce_common back to
- * the caller.
- */
-static void *
-tioce_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *controller)
-{
-	struct tioce_common *tioce_common;
-
-	/*
-	 * Allocate kernel bus soft and copy from prom.
-	 */
-
-	tioce_common = kcalloc(1, sizeof(struct tioce_common), GFP_KERNEL);
-	if (!tioce_common)
-		return NULL;
-
-	memcpy(tioce_common, prom_bussoft, sizeof(struct tioce_common));
-	tioce_common->ce_pcibus.bs_base |= __IA64_UNCACHED_OFFSET;
-
-	if (tioce_kern_init(tioce_common) == NULL) {
-		kfree(tioce_common);
-		return NULL;
-	}
-
-	if (request_irq(SGI_PCIASIC_ERROR,
-			tioce_error_intr_handler,
-			SA_SHIRQ, "TIOCE error", (void *)tioce_common))
-		printk(KERN_WARNING
-		       "%s:  Unable to get irq %d.  "
-		       "Error interrupts won't be routed for "
-		       "TIOCE bus %04x:%02x\n",
-		       __FUNCTION__, SGI_PCIASIC_ERROR,
-		       tioce_common->ce_pcibus.bs_persist_segment,
-		       tioce_common->ce_pcibus.bs_persist_busnum);
-
-	return tioce_common;
-}
-
-static struct sn_pcibus_provider tioce_pci_interfaces = {
-	.dma_map = tioce_dma,
-	.dma_map_consistent = tioce_dma_consistent,
-	.dma_unmap = tioce_dma_unmap,
-	.bus_fixup = tioce_bus_fixup,
-	.force_interrupt = tioce_force_interrupt,
-	.target_interrupt = tioce_target_interrupt
-};
-
-/**
- * tioce_init_provider - init SN PCI provider ops for TIO CE
- */
-int
-tioce_init_provider(void)
-{
-	sn_pci_provider[PCIIO_ASIC_TYPE_TIOCE] = &tioce_pci_interfaces;
-	return 0;
-}
diff --git a/trunk/arch/ppc/Makefile b/trunk/arch/ppc/Makefile
index d1b6e6dcb504..f9b0d778dd82 100644
--- a/trunk/arch/ppc/Makefile
+++ b/trunk/arch/ppc/Makefile
@@ -21,13 +21,11 @@ CC		:= $(CC) -m32
 endif
 
 LDFLAGS_vmlinux	:= -Ttext $(KERNELLOAD) -Bstatic
-CPPFLAGS	+= -Iarch/$(ARCH) -Iinclude3
+CPPFLAGS	+= -Iarch/$(ARCH)
 AFLAGS		+= -Iarch/$(ARCH)
 CFLAGS		+= -Iarch/$(ARCH) -msoft-float -pipe \
 		-ffixed-r2 -mmultiple
 CPP		= $(CC) -E $(CFLAGS)
-# Temporary hack until we have migrated to asm-powerpc
-LINUXINCLUDE    += -Iinclude3
 
 CHECKFLAGS	+= -D__powerpc__
 
@@ -103,7 +101,6 @@ endef
 
 archclean:
 	$(Q)$(MAKE) $(clean)=arch/ppc/boot
-	$(Q)rm -rf include3
 
 prepare: include/asm-$(ARCH)/offsets.h checkbin
 
@@ -113,12 +110,6 @@ arch/$(ARCH)/kernel/asm-offsets.s: include/asm include/linux/version.h \
 include/asm-$(ARCH)/offsets.h: arch/$(ARCH)/kernel/asm-offsets.s
 	$(call filechk,gen-asm-offsets)
 
-# Temporary hack until we have migrated to asm-powerpc
-include/asm: include3/asm
-include3/asm:
-	$(Q)if [ ! -d include3 ]; then mkdir -p include3; fi
-	$(Q)ln -fsn $(srctree)/include/asm-powerpc include3/asm
-
 # Use the file '.tmp_gas_check' for binutils tests, as gas won't output
 # to stdout and these checks are run even on install targets.
 TOUT	:= .tmp_gas_check
diff --git a/trunk/arch/ppc/boot/utils/addRamDisk.c b/trunk/arch/ppc/boot/utils/addRamDisk.c
new file mode 100644
index 000000000000..93400dfcce7f
--- /dev/null
+++ b/trunk/arch/ppc/boot/utils/addRamDisk.c
@@ -0,0 +1,203 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <netinet/in.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <string.h>
+
+#define ElfHeaderSize  (64 * 1024)
+#define ElfPages  (ElfHeaderSize / 4096)
+#define KERNELBASE (0xc0000000)
+
+void get4k(FILE *file, char *buf )
+{
+    unsigned j;
+    unsigned num = fread(buf, 1, 4096, file);
+    for (  j=num; j<4096; ++j )
+	buf[j] = 0;
+}
+
+void put4k(FILE *file, char *buf )
+{
+    fwrite(buf, 1, 4096, file);
+}
+
+void death(const char *msg, FILE *fdesc, const char *fname)
+{
+    printf(msg);
+    fclose(fdesc);
+    unlink(fname);
+    exit(1);
+}
+
+int main(int argc, char **argv)
+{
+    char inbuf[4096];
+    FILE *ramDisk = NULL;
+    FILE *inputVmlinux = NULL;
+    FILE *outputVmlinux = NULL;
+    unsigned i = 0;
+    u_int32_t ramFileLen = 0;
+    u_int32_t ramLen = 0;
+    u_int32_t roundR = 0;
+    u_int32_t kernelLen = 0;
+    u_int32_t actualKernelLen = 0;
+    u_int32_t round = 0;
+    u_int32_t roundedKernelLen = 0;
+    u_int32_t ramStartOffs = 0;
+    u_int32_t ramPages = 0;
+    u_int32_t roundedKernelPages = 0;
+    u_int32_t hvReleaseData = 0;
+    u_int32_t eyeCatcher = 0xc8a5d9c4;
+    u_int32_t naca = 0;
+    u_int32_t xRamDisk = 0;
+    u_int32_t xRamDiskSize = 0;
+    if ( argc < 2 ) {
+	printf("Name of RAM disk file missing.\n");
+	exit(1);
+    }
+
+    if ( argc < 3 ) {
+	printf("Name of vmlinux file missing.\n");
+	exit(1);
+    }
+
+    if ( argc < 4 ) {
+	printf("Name of vmlinux output file missing.\n");
+	exit(1);
+    }
+
+    ramDisk = fopen(argv[1], "r");
+    if ( ! ramDisk ) {
+	printf("RAM disk file \"%s\" failed to open.\n", argv[1]);
+	exit(1);
+    }
+    inputVmlinux = fopen(argv[2], "r");
+    if ( ! inputVmlinux ) {
+	printf("vmlinux file \"%s\" failed to open.\n", argv[2]);
+	exit(1);
+    }
+    outputVmlinux = fopen(argv[3], "w+");
+    if ( ! outputVmlinux ) {
+	printf("output vmlinux file \"%s\" failed to open.\n", argv[3]);
+	exit(1);
+    }
+    fseek(ramDisk, 0, SEEK_END);
+    ramFileLen = ftell(ramDisk);
+    fseek(ramDisk, 0, SEEK_SET);
+    printf("%s file size = %d\n", argv[1], ramFileLen);
+
+    ramLen = ramFileLen;
+
+    roundR = 4096 - (ramLen % 4096);
+    if ( roundR ) {
+	printf("Rounding RAM disk file up to a multiple of 4096, adding %d\n", roundR);
+	ramLen += roundR;
+    }
+
+    printf("Rounded RAM disk size is %d\n", ramLen);
+    fseek(inputVmlinux, 0, SEEK_END);
+    kernelLen = ftell(inputVmlinux);
+    fseek(inputVmlinux, 0, SEEK_SET);
+    printf("kernel file size = %d\n", kernelLen);
+    if ( kernelLen == 0 ) {
+	printf("You must have a linux kernel specified as argv[2]\n");
+	exit(1);
+    }
+
+    actualKernelLen = kernelLen - ElfHeaderSize;
+
+    printf("actual kernel length (minus ELF header) = %d\n", actualKernelLen);
+
+    round = actualKernelLen % 4096;
+    roundedKernelLen = actualKernelLen;
+    if ( round )
+	roundedKernelLen += (4096 - round);
+
+    printf("actual kernel length rounded up to a 4k multiple = %d\n", roundedKernelLen);
+
+    ramStartOffs = roundedKernelLen;
+    ramPages = ramLen / 4096;
+
+    printf("RAM disk pages to copy = %d\n", ramPages);
+
+    // Copy 64K ELF header
+      for (i=0; i<(ElfPages); ++i) {
+	  get4k( inputVmlinux, inbuf );
+	  put4k( outputVmlinux, inbuf );
+      }
+
+    roundedKernelPages = roundedKernelLen / 4096;
+
+    fseek(inputVmlinux, ElfHeaderSize, SEEK_SET);
+
+    for ( i=0; i<roundedKernelPages; ++i ) {
+	get4k( inputVmlinux, inbuf );
+	put4k( outputVmlinux, inbuf );
+    }
+
+    for ( i=0; i<ramPages; ++i ) {
+	get4k( ramDisk, inbuf );
+	put4k( outputVmlinux, inbuf );
+    }
+
+    /* Close the input files */
+    fclose(ramDisk);
+    fclose(inputVmlinux);
+    /* And flush the written output file */
+    fflush(outputVmlinux);
+
+    /* fseek to the hvReleaseData pointer */
+    fseek(outputVmlinux, ElfHeaderSize + 0x24, SEEK_SET);
+    if (fread(&hvReleaseData, 4, 1, outputVmlinux) != 1) {
+        death("Could not read hvReleaseData pointer\n", outputVmlinux, argv[3]);
+    }
+    hvReleaseData = ntohl(hvReleaseData); /* Convert to native int */
+    printf("hvReleaseData is at %08x\n", hvReleaseData);
+
+    /* fseek to the hvReleaseData */
+    fseek(outputVmlinux, ElfHeaderSize + hvReleaseData, SEEK_SET);
+    if (fread(inbuf, 0x40, 1, outputVmlinux) != 1) {
+        death("Could not read hvReleaseData\n", outputVmlinux, argv[3]);
+    }
+    /* Check hvReleaseData sanity */
+    if (memcmp(inbuf, &eyeCatcher, 4) != 0) {
+        death("hvReleaseData is invalid\n", outputVmlinux, argv[3]);
+    }
+    /* Get the naca pointer */
+    naca = ntohl(*((u_int32_t *) &inbuf[0x0c])) - KERNELBASE;
+    printf("naca is at %08x\n", naca);
+
+    /* fseek to the naca */
+    fseek(outputVmlinux, ElfHeaderSize + naca, SEEK_SET);
+    if (fread(inbuf, 0x18, 1, outputVmlinux) != 1) {
+        death("Could not read naca\n", outputVmlinux, argv[3]);
+    }
+    xRamDisk = ntohl(*((u_int32_t *) &inbuf[0x0c]));
+    xRamDiskSize = ntohl(*((u_int32_t *) &inbuf[0x14]));
+    /* Make sure a RAM disk isn't already present */
+    if ((xRamDisk != 0) || (xRamDiskSize != 0)) {
+        death("RAM disk is already attached to this kernel\n", outputVmlinux, argv[3]);
+    }
+    /* Fill in the values */
+    *((u_int32_t *) &inbuf[0x0c]) = htonl(ramStartOffs);
+    *((u_int32_t *) &inbuf[0x14]) = htonl(ramPages);
+
+    /* Write out the new naca */
+    fflush(outputVmlinux);
+    fseek(outputVmlinux, ElfHeaderSize + naca, SEEK_SET);
+    if (fwrite(inbuf, 0x18, 1, outputVmlinux) != 1) {
+        death("Could not write naca\n", outputVmlinux, argv[3]);
+    }
+    printf("RAM Disk of 0x%x pages size is attached to the kernel at offset 0x%08x\n",
+            ramPages, ramStartOffs);
+
+    /* Done */
+    fclose(outputVmlinux);
+    /* Set permission to executable */
+    chmod(argv[3], S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH);
+
+    return 0;
+}
+
diff --git a/trunk/arch/ppc/kernel/cpu_setup_6xx.S b/trunk/arch/ppc/kernel/cpu_setup_6xx.S
index 3fb1fb619d2c..468721d9ebd2 100644
--- a/trunk/arch/ppc/kernel/cpu_setup_6xx.S
+++ b/trunk/arch/ppc/kernel/cpu_setup_6xx.S
@@ -249,11 +249,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_NO_DPM)
 	sync
 	isync
 
-	/* Enable L2 HW prefetch, if L2 is enabled
+	/* Enable L2 HW prefetch
 	 */
-	mfspr	r3,SPRN_L2CR
-	andis.	r3,r3,L2CR_L2E@h
-	beqlr
 	mfspr	r3,SPRN_MSSCR0
 	ori	r3,r3,3
 	sync
diff --git a/trunk/arch/ppc/kernel/l2cr.S b/trunk/arch/ppc/kernel/l2cr.S
index 861115249b35..c39441048266 100644
--- a/trunk/arch/ppc/kernel/l2cr.S
+++ b/trunk/arch/ppc/kernel/l2cr.S
@@ -156,26 +156,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 	       The bit moved on the 7450.....
 	  ****/
 
-BEGIN_FTR_SECTION
-	/* Disable L2 prefetch on some 745x and try to ensure
-	 * L2 prefetch engines are idle. As explained by errata
-	 * text, we can't be sure they are, we just hope very hard
-	 * that well be enough (sic !). At least I noticed Apple
-	 * doesn't even bother doing the dcbf's here...
-	 */
-	mfspr	r4,SPRN_MSSCR0
-	rlwinm	r4,r4,0,0,29
-	sync
-	mtspr	SPRN_MSSCR0,r4
-	sync
-	isync
-	lis	r4,KERNELBASE@h
-	dcbf	0,r4
-	dcbf	0,r4
-	dcbf	0,r4
-	dcbf	0,r4
-END_FTR_SECTION_IFSET(CPU_FTR_SPEC7450)
-
 	/* TODO: use HW flush assist when available */
 
 	lis	r4,0x0002
@@ -250,16 +230,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_SPEC7450)
 	oris	r3,r3,0x8000
 	mtspr	SPRN_L2CR,r3
 	sync
-	
-	/* Enable L2 HW prefetch on 744x/745x */
-BEGIN_FTR_SECTION
-	mfspr	r3,SPRN_MSSCR0
-	ori	r3,r3,3
-	sync
-	mtspr	SPRN_MSSCR0,r3
-	sync
-	isync
-END_FTR_SECTION_IFSET(CPU_FTR_SPEC7450)
+
 4:
 
 	/* Restore HID0[DPM] to whatever it was before */
diff --git a/trunk/arch/ppc/syslib/m8xx_setup.c b/trunk/arch/ppc/syslib/m8xx_setup.c
index 4c888da89b3c..a3702cfe8f7c 100644
--- a/trunk/arch/ppc/syslib/m8xx_setup.c
+++ b/trunk/arch/ppc/syslib/m8xx_setup.c
@@ -57,7 +57,7 @@ unsigned char __res[sizeof(bd_t)];
 extern void m8xx_ide_init(void);
 
 extern unsigned long find_available_memory(void);
-extern void m8xx_cpm_reset(void);
+extern void m8xx_cpm_reset();
 extern void m8xx_wdt_handler_install(bd_t *bp);
 extern void rpxfb_alloc_pages(void);
 extern void cpm_interrupt_init(void);
@@ -266,8 +266,8 @@ m8xx_show_percpuinfo(struct seq_file *m, int i)
 
 	bp = (bd_t *)__res;
 
-	seq_printf(m, "clock\t\t: %uMHz\n"
-		   "bus clock\t: %uMHz\n",
+	seq_printf(m, "clock\t\t: %ldMHz\n"
+		   "bus clock\t: %ldMHz\n",
 		   bp->bi_intfreq / 1000000,
 		   bp->bi_busfreq / 1000000);
 
diff --git a/trunk/arch/ppc64/Kconfig b/trunk/arch/ppc64/Kconfig
index 13b262f10216..2ce87836c671 100644
--- a/trunk/arch/ppc64/Kconfig
+++ b/trunk/arch/ppc64/Kconfig
@@ -302,6 +302,12 @@ config GENERIC_HARDIRQS
 	bool
 	default y
 
+config MSCHUNKS
+	bool
+	depends on PPC_ISERIES
+	default y
+
+
 config PPC_RTAS
 	bool
 	depends on PPC_PSERIES || PPC_BPA
@@ -344,46 +350,13 @@ config SECCOMP
 
 	  If unsure, say Y. Only embedded should say N here.
 
-source "fs/Kconfig.binfmt"
-
-config HOTPLUG_CPU
-	bool "Support for hot-pluggable CPUs"
-	depends on SMP && EXPERIMENTAL && (PPC_PSERIES || PPC_PMAC)
-	select HOTPLUG
-	---help---
-	  Say Y here to be able to turn CPUs off and on.
-
-	  Say N if you are unsure.
-
-config PROC_DEVICETREE
-	bool "Support for Open Firmware device tree in /proc"
-	depends on !PPC_ISERIES
-	help
-	  This option adds a device-tree directory under /proc which contains
-	  an image of the device tree that the kernel copies from Open
-	  Firmware. If unsure, say Y here.
-
-config CMDLINE_BOOL
-	bool "Default bootloader kernel arguments"
-	depends on !PPC_ISERIES
-
-config CMDLINE
-	string "Initial kernel command string"
-	depends on CMDLINE_BOOL
-	default "console=ttyS0,9600 console=tty0 root=/dev/sda2"
-	help
-	  On some platforms, there is currently no way for the boot loader to
-	  pass arguments to the kernel. For these platforms, you can supply
-	  some command-line options at build time by entering them here.  In
-	  most cases you will need to specify the root device here.
-
 endmenu
 
 config ISA_DMA_API
 	bool
 	default y
 
-menu "Bus Options"
+menu "General setup"
 
 config ISA
 	bool
@@ -416,12 +389,45 @@ config PCI_DOMAINS
 	bool
 	default PCI
 
+source "fs/Kconfig.binfmt"
+
 source "drivers/pci/Kconfig"
 
+config HOTPLUG_CPU
+	bool "Support for hot-pluggable CPUs"
+	depends on SMP && EXPERIMENTAL && (PPC_PSERIES || PPC_PMAC)
+	select HOTPLUG
+	---help---
+	  Say Y here to be able to turn CPUs off and on.
+
+	  Say N if you are unsure.
+
 source "drivers/pcmcia/Kconfig"
 
 source "drivers/pci/hotplug/Kconfig"
 
+config PROC_DEVICETREE
+	bool "Support for Open Firmware device tree in /proc"
+	depends on !PPC_ISERIES
+	help
+	  This option adds a device-tree directory under /proc which contains
+	  an image of the device tree that the kernel copies from Open
+	  Firmware. If unsure, say Y here.
+
+config CMDLINE_BOOL
+	bool "Default bootloader kernel arguments"
+	depends on !PPC_ISERIES
+
+config CMDLINE
+	string "Initial kernel command string"
+	depends on CMDLINE_BOOL
+	default "console=ttyS0,9600 console=tty0 root=/dev/sda2"
+	help
+	  On some platforms, there is currently no way for the boot loader to
+	  pass arguments to the kernel. For these platforms, you can supply
+	  some command-line options at build time by entering them here.  In
+	  most cases you will need to specify the root device here.
+
 endmenu
 
 source "net/Kconfig"
diff --git a/trunk/arch/ppc64/Makefile b/trunk/arch/ppc64/Makefile
index 6350cce82efb..731b84758331 100644
--- a/trunk/arch/ppc64/Makefile
+++ b/trunk/arch/ppc64/Makefile
@@ -55,8 +55,6 @@ LDFLAGS		:= -m elf64ppc
 LDFLAGS_vmlinux	:= -Bstatic -e $(KERNELLOAD) -Ttext $(KERNELLOAD)
 CFLAGS		+= -msoft-float -pipe -mminimal-toc -mtraceback=none \
 		   -mcall-aixdesc
-# Temporary hack until we have migrated to asm-powerpc
-CPPFLAGS	+= -Iinclude3
 
 GCC_VERSION     := $(call cc-version)
 GCC_BROKEN_VEC	:= $(shell if [ $(GCC_VERSION) -lt 0400 ] ; then echo "y"; fi ;)
@@ -114,7 +112,6 @@ all: $(KBUILD_IMAGE)
 
 archclean:
 	$(Q)$(MAKE) $(clean)=$(boot)
-	$(Q)rm -rf include3
 
 prepare: include/asm-ppc64/offsets.h
 
@@ -124,12 +121,6 @@ arch/ppc64/kernel/asm-offsets.s: include/asm include/linux/version.h \
 include/asm-ppc64/offsets.h: arch/ppc64/kernel/asm-offsets.s
 	$(call filechk,gen-asm-offsets)
 
-# Temporary hack until we have migrated to asm-powerpc
-include/asm: include3/asm
-include3/asm:
-	$(Q)if [ ! -d include3 ]; then mkdir -p include3; fi;
-	$(Q)ln -fsn $(srctree)/include/asm-powerpc include3/asm
-
 define archhelp
   echo  '* zImage       - Compressed kernel image (arch/$(ARCH)/boot/zImage)'
   echo  '  zImage.initrd- Compressed kernel image with initrd attached,'
diff --git a/trunk/arch/ppc64/boot/Makefile b/trunk/arch/ppc64/boot/Makefile
index 2c5f5e73d00c..683b2d43c15f 100644
--- a/trunk/arch/ppc64/boot/Makefile
+++ b/trunk/arch/ppc64/boot/Makefile
@@ -22,8 +22,8 @@
 
 
 HOSTCC		:= gcc
-BOOTCFLAGS	:= $(HOSTCFLAGS) -fno-builtin -nostdinc -isystem $(shell $(CROSS32CC) -print-file-name=include)
-BOOTAFLAGS	:= -D__ASSEMBLY__ $(BOOTCFLAGS) -traditional -nostdinc
+BOOTCFLAGS	:= $(HOSTCFLAGS) $(LINUXINCLUDE) -fno-builtin 
+BOOTAFLAGS	:= -D__ASSEMBLY__ $(BOOTCFLAGS) -traditional
 BOOTLFLAGS	:= -Ttext 0x00400000 -e _start -T $(srctree)/$(src)/zImage.lds
 OBJCOPYFLAGS    := contents,alloc,load,readonly,data
 
diff --git a/trunk/arch/ppc64/boot/addnote.c b/trunk/arch/ppc64/boot/addnote.c
index 8041a9845ab7..719663a694bb 100644
--- a/trunk/arch/ppc64/boot/addnote.c
+++ b/trunk/arch/ppc64/boot/addnote.c
@@ -157,7 +157,7 @@ main(int ac, char **av)
 	PUT_32BE(ns, strlen(arch) + 1);
 	PUT_32BE(ns + 4, N_DESCR * 4);
 	PUT_32BE(ns + 8, 0x1275);
-	strcpy((char *) &buf[ns + 12], arch);
+	strcpy(&buf[ns + 12], arch);
 	ns += 12 + strlen(arch) + 1;
 	for (i = 0; i < N_DESCR; ++i, ns += 4)
 		PUT_32BE(ns, descr[i]);
@@ -172,7 +172,7 @@ main(int ac, char **av)
 	PUT_32BE(ns, strlen(rpaname) + 1);
 	PUT_32BE(ns + 4, sizeof(rpanote));
 	PUT_32BE(ns + 8, 0x12759999);
-	strcpy((char *) &buf[ns + 12], rpaname);
+	strcpy(&buf[ns + 12], rpaname);
 	ns += 12 + ROUNDUP(strlen(rpaname) + 1);
 	for (i = 0; i < N_RPA_DESCR; ++i, ns += 4)
 		PUT_32BE(ns, rpanote[i]);
diff --git a/trunk/arch/ppc64/boot/crt0.S b/trunk/arch/ppc64/boot/crt0.S
index 3861e7f9cf19..04d3e74cd72f 100644
--- a/trunk/arch/ppc64/boot/crt0.S
+++ b/trunk/arch/ppc64/boot/crt0.S
@@ -9,7 +9,7 @@
  * NOTE: this code runs in 32 bit mode and is packaged as ELF32.
  */
 
-#include "ppc_asm.h"
+#include <asm/ppc_asm.h>
 
 	.text
 	.globl	_start
diff --git a/trunk/arch/ppc64/boot/div64.S b/trunk/arch/ppc64/boot/div64.S
index 722f360a32a9..38f7e466d7d6 100644
--- a/trunk/arch/ppc64/boot/div64.S
+++ b/trunk/arch/ppc64/boot/div64.S
@@ -13,7 +13,7 @@
  * as published by the Free Software Foundation; either version
  * 2 of the License, or (at your option) any later version.
  */
-#include "ppc_asm.h"
+#include <asm/ppc_asm.h>
 
 	.globl __div64_32
 __div64_32:
diff --git a/trunk/arch/ppc64/boot/elf.h b/trunk/arch/ppc64/boot/elf.h
deleted file mode 100644
index d4828fcf1cb9..000000000000
--- a/trunk/arch/ppc64/boot/elf.h
+++ /dev/null
@@ -1,149 +0,0 @@
-#ifndef _PPC_BOOT_ELF_H_
-#define _PPC_BOOT_ELF_H_
-
-/* 32-bit ELF base types. */
-typedef unsigned int Elf32_Addr;
-typedef unsigned short Elf32_Half;
-typedef unsigned int Elf32_Off;
-typedef signed int Elf32_Sword;
-typedef unsigned int Elf32_Word;
-
-/* 64-bit ELF base types. */
-typedef unsigned long long Elf64_Addr;
-typedef unsigned short Elf64_Half;
-typedef signed short Elf64_SHalf;
-typedef unsigned long long Elf64_Off;
-typedef signed int Elf64_Sword;
-typedef unsigned int Elf64_Word;
-typedef unsigned long long Elf64_Xword;
-typedef signed long long Elf64_Sxword;
-
-/* These constants are for the segment types stored in the image headers */
-#define PT_NULL    0
-#define PT_LOAD    1
-#define PT_DYNAMIC 2
-#define PT_INTERP  3
-#define PT_NOTE    4
-#define PT_SHLIB   5
-#define PT_PHDR    6
-#define PT_TLS     7		/* Thread local storage segment */
-#define PT_LOOS    0x60000000	/* OS-specific */
-#define PT_HIOS    0x6fffffff	/* OS-specific */
-#define PT_LOPROC  0x70000000
-#define PT_HIPROC  0x7fffffff
-#define PT_GNU_EH_FRAME		0x6474e550
-
-#define PT_GNU_STACK	(PT_LOOS + 0x474e551)
-
-/* These constants define the different elf file types */
-#define ET_NONE   0
-#define ET_REL    1
-#define ET_EXEC   2
-#define ET_DYN    3
-#define ET_CORE   4
-#define ET_LOPROC 0xff00
-#define ET_HIPROC 0xffff
-
-/* These constants define the various ELF target machines */
-#define EM_NONE  0
-#define EM_PPC	       20	/* PowerPC */
-#define EM_PPC64       21	/* PowerPC64 */
-
-#define EI_NIDENT	16
-
-typedef struct elf32_hdr {
-	unsigned char e_ident[EI_NIDENT];
-	Elf32_Half e_type;
-	Elf32_Half e_machine;
-	Elf32_Word e_version;
-	Elf32_Addr e_entry;	/* Entry point */
-	Elf32_Off e_phoff;
-	Elf32_Off e_shoff;
-	Elf32_Word e_flags;
-	Elf32_Half e_ehsize;
-	Elf32_Half e_phentsize;
-	Elf32_Half e_phnum;
-	Elf32_Half e_shentsize;
-	Elf32_Half e_shnum;
-	Elf32_Half e_shstrndx;
-} Elf32_Ehdr;
-
-typedef struct elf64_hdr {
-	unsigned char e_ident[16];	/* ELF "magic number" */
-	Elf64_Half e_type;
-	Elf64_Half e_machine;
-	Elf64_Word e_version;
-	Elf64_Addr e_entry;	/* Entry point virtual address */
-	Elf64_Off e_phoff;	/* Program header table file offset */
-	Elf64_Off e_shoff;	/* Section header table file offset */
-	Elf64_Word e_flags;
-	Elf64_Half e_ehsize;
-	Elf64_Half e_phentsize;
-	Elf64_Half e_phnum;
-	Elf64_Half e_shentsize;
-	Elf64_Half e_shnum;
-	Elf64_Half e_shstrndx;
-} Elf64_Ehdr;
-
-/* These constants define the permissions on sections in the program
-   header, p_flags. */
-#define PF_R		0x4
-#define PF_W		0x2
-#define PF_X		0x1
-
-typedef struct elf32_phdr {
-	Elf32_Word p_type;
-	Elf32_Off p_offset;
-	Elf32_Addr p_vaddr;
-	Elf32_Addr p_paddr;
-	Elf32_Word p_filesz;
-	Elf32_Word p_memsz;
-	Elf32_Word p_flags;
-	Elf32_Word p_align;
-} Elf32_Phdr;
-
-typedef struct elf64_phdr {
-	Elf64_Word p_type;
-	Elf64_Word p_flags;
-	Elf64_Off p_offset;	/* Segment file offset */
-	Elf64_Addr p_vaddr;	/* Segment virtual address */
-	Elf64_Addr p_paddr;	/* Segment physical address */
-	Elf64_Xword p_filesz;	/* Segment size in file */
-	Elf64_Xword p_memsz;	/* Segment size in memory */
-	Elf64_Xword p_align;	/* Segment alignment, file & memory */
-} Elf64_Phdr;
-
-#define	EI_MAG0		0	/* e_ident[] indexes */
-#define	EI_MAG1		1
-#define	EI_MAG2		2
-#define	EI_MAG3		3
-#define	EI_CLASS	4
-#define	EI_DATA		5
-#define	EI_VERSION	6
-#define	EI_OSABI	7
-#define	EI_PAD		8
-
-#define	ELFMAG0		0x7f	/* EI_MAG */
-#define	ELFMAG1		'E'
-#define	ELFMAG2		'L'
-#define	ELFMAG3		'F'
-#define	ELFMAG		"\177ELF"
-#define	SELFMAG		4
-
-#define	ELFCLASSNONE	0	/* EI_CLASS */
-#define	ELFCLASS32	1
-#define	ELFCLASS64	2
-#define	ELFCLASSNUM	3
-
-#define ELFDATANONE	0	/* e_ident[EI_DATA] */
-#define ELFDATA2LSB	1
-#define ELFDATA2MSB	2
-
-#define EV_NONE		0	/* e_version, EI_VERSION */
-#define EV_CURRENT	1
-#define EV_NUM		2
-
-#define ELFOSABI_NONE	0
-#define ELFOSABI_LINUX	3
-
-#endif				/* _PPC_BOOT_ELF_H_ */
diff --git a/trunk/arch/ppc64/boot/main.c b/trunk/arch/ppc64/boot/main.c
index 99e68cfbe688..199d9804f61c 100644
--- a/trunk/arch/ppc64/boot/main.c
+++ b/trunk/arch/ppc64/boot/main.c
@@ -8,28 +8,36 @@
  * as published by the Free Software Foundation; either version
  * 2 of the License, or (at your option) any later version.
  */
-#include <stdarg.h>
-#include <stddef.h>
-#include "elf.h"
-#include "page.h"
-#include "string.h"
-#include "stdio.h"
-#include "prom.h"
+#include "ppc32-types.h"
 #include "zlib.h"
-
-static void gunzip(void *, int, unsigned char *, int *);
-extern void flush_cache(void *, unsigned long);
-
+#include <linux/elf.h>
+#include <linux/string.h>
+#include <asm/processor.h>
+#include <asm/page.h>
+
+extern void *finddevice(const char *);
+extern int getprop(void *, const char *, void *, int);
+extern void printf(const char *fmt, ...);
+extern int sprintf(char *buf, const char *fmt, ...);
+void gunzip(void *, int, unsigned char *, int *);
+void *claim(unsigned int, unsigned int, unsigned int);
+void flush_cache(void *, unsigned long);
+void pause(void);
+extern void exit(void);
+
+unsigned long strlen(const char *s);
+void *memmove(void *dest, const void *src, unsigned long n);
+void *memcpy(void *dest, const void *src, unsigned long n);
 
 /* Value picked to match that used by yaboot */
 #define PROG_START	0x01400000
 #define RAM_END		(256<<20) // Fixme: use OF */
 
-static char *avail_ram;
-static char *begin_avail, *end_avail;
-static char *avail_high;
-static unsigned int heap_use;
-static unsigned int heap_max;
+char *avail_ram;
+char *begin_avail, *end_avail;
+char *avail_high;
+unsigned int heap_use;
+unsigned int heap_max;
 
 extern char _start[];
 extern char _vmlinux_start[];
@@ -44,9 +52,9 @@ struct addr_range {
 	unsigned long size;
 	unsigned long memsize;
 };
-static struct addr_range vmlinux = {0, 0, 0};
-static struct addr_range vmlinuz = {0, 0, 0};
-static struct addr_range initrd  = {0, 0, 0};
+struct addr_range vmlinux = {0, 0, 0};
+struct addr_range vmlinuz = {0, 0, 0};
+struct addr_range initrd  = {0, 0, 0};
 
 static char scratch[128<<10];	/* 128kB of scratch space for gunzip */
 
@@ -56,6 +64,13 @@ typedef void (*kernel_entry_t)( unsigned long,
 				void *);
 
 
+int (*prom)(void *);
+
+void *chosen_handle;
+void *stdin;
+void *stdout;
+void *stderr;
+
 #undef DEBUG
 
 static unsigned long claim_base = PROG_START;
@@ -262,7 +277,7 @@ void zfree(void *x, void *addr, unsigned nb)
 
 #define DEFLATED	8
 
-static void gunzip(void *dst, int dstlen, unsigned char *src, int *lenp)
+void gunzip(void *dst, int dstlen, unsigned char *src, int *lenp)
 {
 	z_stream s;
 	int r, i, flags;
diff --git a/trunk/arch/ppc64/boot/page.h b/trunk/arch/ppc64/boot/page.h
deleted file mode 100644
index 14eca30fef64..000000000000
--- a/trunk/arch/ppc64/boot/page.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#ifndef _PPC_BOOT_PAGE_H
-#define _PPC_BOOT_PAGE_H
-/*
- * Copyright (C) 2001 PPC64 Team, IBM Corp
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#ifdef __ASSEMBLY__
-#define ASM_CONST(x) x
-#else
-#define __ASM_CONST(x) x##UL
-#define ASM_CONST(x) __ASM_CONST(x)
-#endif
-
-/* PAGE_SHIFT determines the page size */
-#define PAGE_SHIFT	12
-#define PAGE_SIZE	(ASM_CONST(1) << PAGE_SHIFT)
-#define PAGE_MASK	(~(PAGE_SIZE-1))
-
-/* align addr on a size boundary - adjust address up/down if needed */
-#define _ALIGN_UP(addr,size)	(((addr)+((size)-1))&(~((size)-1)))
-#define _ALIGN_DOWN(addr,size)	((addr)&(~((size)-1)))
-
-/* align addr on a size boundary - adjust address up if needed */
-#define _ALIGN(addr,size)     _ALIGN_UP(addr,size)
-
-/* to align the pointer to the (next) page boundary */
-#define PAGE_ALIGN(addr)	_ALIGN(addr, PAGE_SIZE)
-
-#endif				/* _PPC_BOOT_PAGE_H */
diff --git a/trunk/arch/ppc64/boot/ppc32-types.h b/trunk/arch/ppc64/boot/ppc32-types.h
new file mode 100644
index 000000000000..f7b8884f8f70
--- /dev/null
+++ b/trunk/arch/ppc64/boot/ppc32-types.h
@@ -0,0 +1,36 @@
+#ifndef _PPC64_TYPES_H
+#define _PPC64_TYPES_H
+
+typedef __signed__ char __s8;
+typedef unsigned char __u8;
+
+typedef __signed__ short __s16;
+typedef unsigned short __u16;
+
+typedef __signed__ int __s32;
+typedef unsigned int __u32;
+
+typedef __signed__ long long __s64;
+typedef unsigned long long __u64;
+
+typedef signed char s8;
+typedef unsigned char u8;
+
+typedef signed short s16;
+typedef unsigned short u16;
+
+typedef signed int s32;
+typedef unsigned int u32;
+
+typedef signed long long s64;
+typedef unsigned long long u64;
+
+typedef struct {
+	__u32 u[4];
+} __attribute((aligned(16))) __vector128;
+
+#define BITS_PER_LONG 32
+
+typedef __vector128 vector128;
+
+#endif /* _PPC64_TYPES_H */
diff --git a/trunk/arch/ppc64/boot/ppc_asm.h b/trunk/arch/ppc64/boot/ppc_asm.h
deleted file mode 100644
index 1c2c2817f9b7..000000000000
--- a/trunk/arch/ppc64/boot/ppc_asm.h
+++ /dev/null
@@ -1,62 +0,0 @@
-#ifndef _PPC64_PPC_ASM_H
-#define _PPC64_PPC_ASM_H
-/*
- *
- * Definitions used by various bits of low-level assembly code on PowerPC.
- *
- * Copyright (C) 1995-1999 Gary Thomas, Paul Mackerras, Cort Dougan.
- *
- *  This program is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU General Public License
- *  as published by the Free Software Foundation; either version
- *  2 of the License, or (at your option) any later version.
- */
-
-/* Condition Register Bit Fields */
-
-#define	cr0	0
-#define	cr1	1
-#define	cr2	2
-#define	cr3	3
-#define	cr4	4
-#define	cr5	5
-#define	cr6	6
-#define	cr7	7
-
-
-/* General Purpose Registers (GPRs) */
-
-#define	r0	0
-#define	r1	1
-#define	r2	2
-#define	r3	3
-#define	r4	4
-#define	r5	5
-#define	r6	6
-#define	r7	7
-#define	r8	8
-#define	r9	9
-#define	r10	10
-#define	r11	11
-#define	r12	12
-#define	r13	13
-#define	r14	14
-#define	r15	15
-#define	r16	16
-#define	r17	17
-#define	r18	18
-#define	r19	19
-#define	r20	20
-#define	r21	21
-#define	r22	22
-#define	r23	23
-#define	r24	24
-#define	r25	25
-#define	r26	26
-#define	r27	27
-#define	r28	28
-#define	r29	29
-#define	r30	30
-#define	r31	31
-
-#endif /* _PPC64_PPC_ASM_H */
diff --git a/trunk/arch/ppc64/boot/prom.c b/trunk/arch/ppc64/boot/prom.c
index 4bea2f4dcb06..5e48b80ff5a0 100644
--- a/trunk/arch/ppc64/boot/prom.c
+++ b/trunk/arch/ppc64/boot/prom.c
@@ -7,19 +7,43 @@
  * 2 of the License, or (at your option) any later version.
  */
 #include <stdarg.h>
-#include <stddef.h>
-#include "string.h"
-#include "stdio.h"
-#include "prom.h"
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/ctype.h>
+
+extern __u32 __div64_32(unsigned long long *dividend, __u32 divisor);
+
+/* The unnecessary pointer compare is there
+ * to check for type safety (n must be 64bit)
+ */
+# define do_div(n,base) ({				\
+	__u32 __base = (base);			\
+	__u32 __rem;					\
+	(void)(((typeof((n)) *)0) == ((unsigned long long *)0));	\
+	if (((n) >> 32) == 0) {			\
+		__rem = (__u32)(n) % __base;		\
+		(n) = (__u32)(n) / __base;		\
+	} else 						\
+		__rem = __div64_32(&(n), __base);	\
+	__rem;						\
+ })
 
 int (*prom)(void *);
 
 void *chosen_handle;
-
 void *stdin;
 void *stdout;
 void *stderr;
 
+void exit(void);
+void *finddevice(const char *name);
+int getprop(void *phandle, const char *name, void *buf, int buflen);
+void chrpboot(int a1, int a2, void *prom);	/* in main.c */
+
+int printf(char *fmt, ...);
+
+/* there is no convenient header to get this from...  -- paulus */
+extern unsigned long strlen(const char *);
 
 int
 write(void *handle, void *ptr, int nb)
@@ -186,6 +210,107 @@ fputs(char *str, void *f)
 	return write(f, str, n) == n? 0: -1;
 }
 
+int
+readchar(void)
+{
+	char ch;
+
+	for (;;) {
+		switch (read(stdin, &ch, 1)) {
+		case 1:
+			return ch;
+		case -1:
+			printf("read(stdin) returned -1\r\n");
+			return -1;
+		}
+	}
+}
+
+static char line[256];
+static char *lineptr;
+static int lineleft;
+
+int
+getchar(void)
+{
+	int c;
+
+	if (lineleft == 0) {
+		lineptr = line;
+		for (;;) {
+			c = readchar();
+			if (c == -1 || c == 4)
+				break;
+			if (c == '\r' || c == '\n') {
+				*lineptr++ = '\n';
+				putchar('\n');
+				break;
+			}
+			switch (c) {
+			case 0177:
+			case '\b':
+				if (lineptr > line) {
+					putchar('\b');
+					putchar(' ');
+					putchar('\b');
+					--lineptr;
+				}
+				break;
+			case 'U' & 0x1F:
+				while (lineptr > line) {
+					putchar('\b');
+					putchar(' ');
+					putchar('\b');
+					--lineptr;
+				}
+				break;
+			default:
+				if (lineptr >= &line[sizeof(line) - 1])
+					putchar('\a');
+				else {
+					putchar(c);
+					*lineptr++ = c;
+				}
+			}
+		}
+		lineleft = lineptr - line;
+		lineptr = line;
+	}
+	if (lineleft == 0)
+		return -1;
+	--lineleft;
+	return *lineptr++;
+}
+
+
+
+/* String functions lifted from lib/vsprintf.c and lib/ctype.c */
+unsigned char _ctype[] = {
+_C,_C,_C,_C,_C,_C,_C,_C,			/* 0-7 */
+_C,_C|_S,_C|_S,_C|_S,_C|_S,_C|_S,_C,_C,		/* 8-15 */
+_C,_C,_C,_C,_C,_C,_C,_C,			/* 16-23 */
+_C,_C,_C,_C,_C,_C,_C,_C,			/* 24-31 */
+_S|_SP,_P,_P,_P,_P,_P,_P,_P,			/* 32-39 */
+_P,_P,_P,_P,_P,_P,_P,_P,			/* 40-47 */
+_D,_D,_D,_D,_D,_D,_D,_D,			/* 48-55 */
+_D,_D,_P,_P,_P,_P,_P,_P,			/* 56-63 */
+_P,_U|_X,_U|_X,_U|_X,_U|_X,_U|_X,_U|_X,_U,	/* 64-71 */
+_U,_U,_U,_U,_U,_U,_U,_U,			/* 72-79 */
+_U,_U,_U,_U,_U,_U,_U,_U,			/* 80-87 */
+_U,_U,_U,_P,_P,_P,_P,_P,			/* 88-95 */
+_P,_L|_X,_L|_X,_L|_X,_L|_X,_L|_X,_L|_X,_L,	/* 96-103 */
+_L,_L,_L,_L,_L,_L,_L,_L,			/* 104-111 */
+_L,_L,_L,_L,_L,_L,_L,_L,			/* 112-119 */
+_L,_L,_L,_P,_P,_P,_P,_C,			/* 120-127 */
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,		/* 128-143 */
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,		/* 144-159 */
+_S|_SP,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,   /* 160-175 */
+_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,       /* 176-191 */
+_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,       /* 192-207 */
+_U,_U,_U,_U,_U,_U,_U,_P,_U,_U,_U,_U,_U,_U,_U,_L,       /* 208-223 */
+_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,       /* 224-239 */
+_L,_L,_L,_L,_L,_L,_L,_P,_L,_L,_L,_L,_L,_L,_L,_L};      /* 240-255 */
+
 size_t strnlen(const char * s, size_t count)
 {
 	const char *sc;
@@ -195,30 +320,44 @@ size_t strnlen(const char * s, size_t count)
 	return sc - s;
 }
 
-extern unsigned int __div64_32(unsigned long long *dividend,
-			       unsigned int divisor);
+unsigned long simple_strtoul(const char *cp,char **endp,unsigned int base)
+{
+	unsigned long result = 0,value;
 
-/* The unnecessary pointer compare is there
- * to check for type safety (n must be 64bit)
- */
-# define do_div(n,base) ({						\
-	unsigned int __base = (base);					\
-	unsigned int __rem;						\
-	(void)(((typeof((n)) *)0) == ((unsigned long long *)0));	\
-	if (((n) >> 32) == 0) {						\
-		__rem = (unsigned int)(n) % __base;			\
-		(n) = (unsigned int)(n) / __base;			\
-	} else								\
-		__rem = __div64_32(&(n), __base);			\
-	__rem;								\
- })
+	if (!base) {
+		base = 10;
+		if (*cp == '0') {
+			base = 8;
+			cp++;
+			if ((*cp == 'x') && isxdigit(cp[1])) {
+				cp++;
+				base = 16;
+			}
+		}
+	}
+	while (isxdigit(*cp) &&
+	       (value = isdigit(*cp) ? *cp-'0' : toupper(*cp)-'A'+10) < base) {
+		result = result*base + value;
+		cp++;
+	}
+	if (endp)
+		*endp = (char *)cp;
+	return result;
+}
+
+long simple_strtol(const char *cp,char **endp,unsigned int base)
+{
+	if(*cp=='-')
+		return -simple_strtoul(cp+1,endp,base);
+	return simple_strtoul(cp,endp,base);
+}
 
 static int skip_atoi(const char **s)
 {
-	int i, c;
+	int i=0;
 
-	for (i = 0; '0' <= (c = **s) && c <= '9'; ++*s)
-		i = i*10 + c - '0';
+	while (isdigit(**s))
+		i = i*10 + *((*s)++) - '0';
 	return i;
 }
 
@@ -297,6 +436,9 @@ static char * number(char * str, unsigned long long num, int base, int size, int
 	return str;
 }
 
+/* Forward decl. needed for IP address printing stuff... */
+int sprintf(char * buf, const char *fmt, ...);
+
 int vsprintf(char *buf, const char *fmt, va_list args)
 {
 	int len;
@@ -335,7 +477,7 @@ int vsprintf(char *buf, const char *fmt, va_list args)
 		
 		/* get field width */
 		field_width = -1;
-		if ('0' <= *fmt && *fmt <= '9')
+		if (isdigit(*fmt))
 			field_width = skip_atoi(&fmt);
 		else if (*fmt == '*') {
 			++fmt;
@@ -351,7 +493,7 @@ int vsprintf(char *buf, const char *fmt, va_list args)
 		precision = -1;
 		if (*fmt == '.') {
 			++fmt;	
-			if ('0' <= *fmt && *fmt <= '9')
+			if (isdigit(*fmt))
 				precision = skip_atoi(&fmt);
 			else if (*fmt == '*') {
 				++fmt;
@@ -486,7 +628,7 @@ int sprintf(char * buf, const char *fmt, ...)
 static char sprint_buf[1024];
 
 int
-printf(const char *fmt, ...)
+printf(char *fmt, ...)
 {
 	va_list args;
 	int n;
diff --git a/trunk/arch/ppc64/boot/prom.h b/trunk/arch/ppc64/boot/prom.h
deleted file mode 100644
index 96ab5aec740c..000000000000
--- a/trunk/arch/ppc64/boot/prom.h
+++ /dev/null
@@ -1,18 +0,0 @@
-#ifndef _PPC_BOOT_PROM_H_
-#define _PPC_BOOT_PROM_H_
-
-extern int (*prom) (void *);
-extern void *chosen_handle;
-
-extern void *stdin;
-extern void *stdout;
-extern void *stderr;
-
-extern int write(void *handle, void *ptr, int nb);
-extern int read(void *handle, void *ptr, int nb);
-extern void exit(void);
-extern void pause(void);
-extern void *finddevice(const char *);
-extern void *claim(unsigned long virt, unsigned long size, unsigned long align);
-extern int getprop(void *phandle, const char *name, void *buf, int buflen);
-#endif				/* _PPC_BOOT_PROM_H_ */
diff --git a/trunk/arch/ppc64/boot/stdio.h b/trunk/arch/ppc64/boot/stdio.h
deleted file mode 100644
index 24bd3a8dee94..000000000000
--- a/trunk/arch/ppc64/boot/stdio.h
+++ /dev/null
@@ -1,16 +0,0 @@
-#ifndef _PPC_BOOT_STDIO_H_
-#define _PPC_BOOT_STDIO_H_
-
-extern int printf(const char *fmt, ...);
-
-extern int sprintf(char *buf, const char *fmt, ...);
-
-extern int vsprintf(char *buf, const char *fmt, va_list args);
-
-extern int putc(int c, void *f);
-extern int putchar(int c);
-extern int getchar(void);
-
-extern int fputs(char *str, void *f);
-
-#endif				/* _PPC_BOOT_STDIO_H_ */
diff --git a/trunk/arch/ppc64/boot/string.S b/trunk/arch/ppc64/boot/string.S
index 7ade87ae7718..ba5f2d21c9ea 100644
--- a/trunk/arch/ppc64/boot/string.S
+++ b/trunk/arch/ppc64/boot/string.S
@@ -9,7 +9,7 @@
  * NOTE: this code runs in 32 bit mode and is packaged as ELF32.
  */
 
-#include "ppc_asm.h"
+#include <asm/ppc_asm.h>
 
 	.text
 	.globl	strcpy
diff --git a/trunk/arch/ppc64/boot/string.h b/trunk/arch/ppc64/boot/string.h
deleted file mode 100644
index 9289258bcbd6..000000000000
--- a/trunk/arch/ppc64/boot/string.h
+++ /dev/null
@@ -1,16 +0,0 @@
-#ifndef _PPC_BOOT_STRING_H_
-#define _PPC_BOOT_STRING_H_
-
-extern char *strcpy(char *dest, const char *src);
-extern char *strncpy(char *dest, const char *src, size_t n);
-extern char *strcat(char *dest, const char *src);
-extern int strcmp(const char *s1, const char *s2);
-extern size_t strlen(const char *s);
-extern size_t strnlen(const char *s, size_t count);
-
-extern void *memset(void *s, int c, size_t n);
-extern void *memmove(void *dest, const void *src, unsigned long n);
-extern void *memcpy(void *dest, const void *src, unsigned long n);
-extern int memcmp(const void *s1, const void *s2, size_t n);
-
-#endif	/* _PPC_BOOT_STRING_H_ */
diff --git a/trunk/arch/ppc64/boot/zlib.c b/trunk/arch/ppc64/boot/zlib.c
index 0d910cd2079d..78837e884b8b 100644
--- a/trunk/arch/ppc64/boot/zlib.c
+++ b/trunk/arch/ppc64/boot/zlib.c
@@ -107,7 +107,7 @@ extern void *memcpy(void *, const void *, unsigned long);
 
 /* Diagnostic functions */
 #ifdef DEBUG_ZLIB
-#  include "stdio.h"
+#  include <stdio.h>
 #  ifndef verbose
 #    define verbose 0
 #  endif
diff --git a/trunk/arch/ppc64/configs/g5_defconfig b/trunk/arch/ppc64/configs/g5_defconfig
index fc83d9330282..ab567741e80e 100644
--- a/trunk/arch/ppc64/configs/g5_defconfig
+++ b/trunk/arch/ppc64/configs/g5_defconfig
@@ -103,10 +103,10 @@ CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_PREEMPT_BKL is not set
-# CONFIG_HZ_100 is not set
-CONFIG_HZ_250=y
+CONFIG_HZ_100=y
+# CONFIG_HZ_250 is not set
 # CONFIG_HZ_1000 is not set
-CONFIG_HZ=250
+CONFIG_HZ=100
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_SECCOMP=y
 CONFIG_ISA_DMA_API=y
diff --git a/trunk/arch/ppc64/configs/iSeries_defconfig b/trunk/arch/ppc64/configs/iSeries_defconfig
index 013d4e0e4003..394ba18b58c7 100644
--- a/trunk/arch/ppc64/configs/iSeries_defconfig
+++ b/trunk/arch/ppc64/configs/iSeries_defconfig
@@ -94,11 +94,12 @@ CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_PREEMPT_BKL is not set
-# CONFIG_HZ_100 is not set
-CONFIG_HZ_250=y
+CONFIG_HZ_100=y
+# CONFIG_HZ_250 is not set
 # CONFIG_HZ_1000 is not set
-CONFIG_HZ=250
+CONFIG_HZ=100
 CONFIG_GENERIC_HARDIRQS=y
+CONFIG_MSCHUNKS=y
 CONFIG_LPARCFG=y
 CONFIG_SECCOMP=y
 CONFIG_ISA_DMA_API=y
diff --git a/trunk/arch/ppc64/configs/maple_defconfig b/trunk/arch/ppc64/configs/maple_defconfig
index dd42892cd873..2033fe663dbe 100644
--- a/trunk/arch/ppc64/configs/maple_defconfig
+++ b/trunk/arch/ppc64/configs/maple_defconfig
@@ -103,10 +103,10 @@ CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_PREEMPT_BKL is not set
-# CONFIG_HZ_100 is not set
-CONFIG_HZ_250=y
+CONFIG_HZ_100=y
+# CONFIG_HZ_250 is not set
 # CONFIG_HZ_1000 is not set
-CONFIG_HZ=250
+CONFIG_HZ=100
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_SECCOMP=y
 CONFIG_ISA_DMA_API=y
diff --git a/trunk/arch/ppc64/configs/pSeries_defconfig b/trunk/arch/ppc64/configs/pSeries_defconfig
index 29f7b80b0efc..297fd5229487 100644
--- a/trunk/arch/ppc64/configs/pSeries_defconfig
+++ b/trunk/arch/ppc64/configs/pSeries_defconfig
@@ -112,10 +112,10 @@ CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_PREEMPT_BKL is not set
-# CONFIG_HZ_100 is not set
-CONFIG_HZ_250=y
+CONFIG_HZ_100=y
+# CONFIG_HZ_250 is not set
 # CONFIG_HZ_1000 is not set
-CONFIG_HZ=250
+CONFIG_HZ=100
 CONFIG_EEH=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_PPC_RTAS=y
diff --git a/trunk/arch/ppc64/defconfig b/trunk/arch/ppc64/defconfig
index 7cb4750bb7a9..c361e7727b7a 100644
--- a/trunk/arch/ppc64/defconfig
+++ b/trunk/arch/ppc64/defconfig
@@ -114,10 +114,10 @@ CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_PREEMPT_BKL is not set
-# CONFIG_HZ_100 is not set
-CONFIG_HZ_250=y
+CONFIG_HZ_100=y
+# CONFIG_HZ_250 is not set
 # CONFIG_HZ_1000 is not set
-CONFIG_HZ=250
+CONFIG_HZ=100
 CONFIG_EEH=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_PPC_RTAS=y
diff --git a/trunk/arch/ppc64/kernel/LparData.c b/trunk/arch/ppc64/kernel/LparData.c
index 0a9c23ca2f0c..1c11031c838e 100644
--- a/trunk/arch/ppc64/kernel/LparData.c
+++ b/trunk/arch/ppc64/kernel/LparData.c
@@ -51,17 +51,6 @@ struct HvReleaseData hvReleaseData = {
 		0xf4, 0x4b, 0xf6, 0xf4 },
 };
 
-/*
- * The NACA.  The first dword of the naca is required by the iSeries
- * hypervisor to point to itVpdAreas.  The hypervisor finds the NACA
- * through the pointer in hvReleaseData.
- */
-struct naca_struct naca = {
-	.xItVpdAreas = &itVpdAreas,
-	.xRamDisk = 0,
-	.xRamDiskSize = 0,
-};
-
 extern void system_reset_iSeries(void);
 extern void machine_check_iSeries(void);
 extern void data_access_iSeries(void);
@@ -225,3 +214,29 @@ struct ItVpdAreas itVpdAreas = {
 		0,0
 	}
 };
+
+struct msChunks msChunks;
+EXPORT_SYMBOL(msChunks);
+
+/* Depending on whether this is called from iSeries or pSeries setup
+ * code, the location of the msChunks struct may or may not have
+ * to be reloc'd, so we force the caller to do that for us by passing
+ * in a pointer to the structure.
+ */
+unsigned long
+msChunks_alloc(unsigned long mem, unsigned long num_chunks, unsigned long chunk_size)
+{
+	unsigned long offset = reloc_offset();
+	struct msChunks *_msChunks = PTRRELOC(&msChunks);
+
+	_msChunks->num_chunks  = num_chunks;
+	_msChunks->chunk_size  = chunk_size;
+	_msChunks->chunk_shift = __ilog2(chunk_size);
+	_msChunks->chunk_mask  = (1UL<<_msChunks->chunk_shift)-1;
+
+	mem = _ALIGN(mem, sizeof(msChunks_entry));
+	_msChunks->abs = (msChunks_entry *)(mem + offset);
+	mem += num_chunks * sizeof(msChunks_entry);
+
+	return mem;
+}
diff --git a/trunk/arch/ppc64/kernel/Makefile b/trunk/arch/ppc64/kernel/Makefile
index f4b3bfcc109d..2ecccb6b4f8c 100644
--- a/trunk/arch/ppc64/kernel/Makefile
+++ b/trunk/arch/ppc64/kernel/Makefile
@@ -11,7 +11,7 @@ obj-y               :=	setup.o entry.o traps.o irq.o idle.o dma.o \
 			udbg.o binfmt_elf32.o sys_ppc32.o ioctl32.o \
 			ptrace32.o signal32.o rtc.o init_task.o \
 			lmb.o cputable.o cpu_setup_power4.o idle_power4.o \
-			iommu.o sysfs.o vdso.o pmc.o firmware.o
+			iommu.o sysfs.o vdso.o pmc.o
 obj-y += vdso32/ vdso64/
 
 obj-$(CONFIG_PPC_OF) +=	of_device.o
@@ -50,10 +50,7 @@ obj-$(CONFIG_LPARCFG)		+= lparcfg.o
 obj-$(CONFIG_HVC_CONSOLE)	+= hvconsole.o
 obj-$(CONFIG_BOOTX_TEXT)	+= btext.o
 obj-$(CONFIG_HVCS)		+= hvcserver.o
-
-vio-obj-$(CONFIG_PPC_PSERIES)	+= pSeries_vio.o
-vio-obj-$(CONFIG_PPC_ISERIES)	+= iSeries_vio.o
-obj-$(CONFIG_IBMVIO)		+= vio.o $(vio-obj-y)
+obj-$(CONFIG_IBMVIO)		+= vio.o
 obj-$(CONFIG_XICS)		+= xics.o
 obj-$(CONFIG_MPIC)		+= mpic.o
 
diff --git a/trunk/arch/ppc64/kernel/asm-offsets.c b/trunk/arch/ppc64/kernel/asm-offsets.c
index 17e35d0fed09..abb9e5b5da03 100644
--- a/trunk/arch/ppc64/kernel/asm-offsets.c
+++ b/trunk/arch/ppc64/kernel/asm-offsets.c
@@ -94,8 +94,7 @@ int main(void)
 	DEFINE(PACASLBCACHEPTR, offsetof(struct paca_struct, slb_cache_ptr));
 	DEFINE(PACACONTEXTID, offsetof(struct paca_struct, context.id));
 #ifdef CONFIG_HUGETLB_PAGE
-	DEFINE(PACALOWHTLBAREAS, offsetof(struct paca_struct, context.low_htlb_areas));
-	DEFINE(PACAHIGHHTLBAREAS, offsetof(struct paca_struct, context.high_htlb_areas));
+	DEFINE(PACAHTLBSEGS, offsetof(struct paca_struct, context.htlb_segs));
 #endif /* CONFIG_HUGETLB_PAGE */
 	DEFINE(PACADEFAULTDECR, offsetof(struct paca_struct, default_decr));
         DEFINE(PACA_EXGEN, offsetof(struct paca_struct, exgen));
diff --git a/trunk/arch/ppc64/kernel/cputable.c b/trunk/arch/ppc64/kernel/cputable.c
index 4847f2ac8c9f..77cec42f9525 100644
--- a/trunk/arch/ppc64/kernel/cputable.c
+++ b/trunk/arch/ppc64/kernel/cputable.c
@@ -5,7 +5,7 @@
  *
  *  Modifications for ppc64:
  *      Copyright (C) 2003 Dave Engebretsen <engebret@us.ibm.com>
- *
+ * 
  *  This program is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU General Public License
  *  as published by the Free Software Foundation; either version
@@ -60,6 +60,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power3,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* Power3+ */
 		.pvr_mask		= 0xffff0000,
@@ -72,6 +73,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power3,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* Northstar */
 		.pvr_mask		= 0xffff0000,
@@ -84,6 +86,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power3,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* Pulsar */
 		.pvr_mask		= 0xffff0000,
@@ -96,6 +99,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power3,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* I-star */
 		.pvr_mask		= 0xffff0000,
@@ -108,6 +112,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power3,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* S-star */
 		.pvr_mask		= 0xffff0000,
@@ -120,6 +125,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power3,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* Power4 */
 		.pvr_mask		= 0xffff0000,
@@ -132,6 +138,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power4,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* Power4+ */
 		.pvr_mask		= 0xffff0000,
@@ -144,6 +151,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power4,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* PPC970 */
 		.pvr_mask		= 0xffff0000,
@@ -158,6 +166,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_ppc970,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* PPC970FX */
 		.pvr_mask		= 0xffff0000,
@@ -172,6 +181,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_ppc970,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* PPC970MP */
 		.pvr_mask		= 0xffff0000,
@@ -186,6 +196,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_ppc970,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* Power5 */
 		.pvr_mask		= 0xffff0000,
@@ -200,6 +211,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power4,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* Power5 */
 		.pvr_mask		= 0xffff0000,
@@ -214,6 +226,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power4,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* BE DD1.x */
 		.pvr_mask		= 0xffff0000,
@@ -228,6 +241,7 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_be,
+		.firmware_features	= COMMON_PPC64_FW,
 	},
 	{	/* default match */
 		.pvr_mask		= 0x00000000,
@@ -240,5 +254,29 @@ struct cpu_spec	cpu_specs[] = {
 		.icache_bsize		= 128,
 		.dcache_bsize		= 128,
 		.cpu_setup		= __setup_cpu_power4,
+		.firmware_features	= COMMON_PPC64_FW,
 	}
 };
+
+firmware_feature_t firmware_features_table[FIRMWARE_MAX_FEATURES] = {
+	{FW_FEATURE_PFT,		"hcall-pft"},
+	{FW_FEATURE_TCE,		"hcall-tce"},
+	{FW_FEATURE_SPRG0,		"hcall-sprg0"},
+	{FW_FEATURE_DABR,		"hcall-dabr"},
+	{FW_FEATURE_COPY,		"hcall-copy"},
+	{FW_FEATURE_ASR,		"hcall-asr"},
+	{FW_FEATURE_DEBUG,		"hcall-debug"},
+	{FW_FEATURE_PERF,		"hcall-perf"},
+	{FW_FEATURE_DUMP,		"hcall-dump"},
+	{FW_FEATURE_INTERRUPT,		"hcall-interrupt"},
+	{FW_FEATURE_MIGRATE,		"hcall-migrate"},
+	{FW_FEATURE_PERFMON,		"hcall-perfmon"},
+	{FW_FEATURE_CRQ,		"hcall-crq"},
+	{FW_FEATURE_VIO,		"hcall-vio"},
+	{FW_FEATURE_RDMA,		"hcall-rdma"},
+	{FW_FEATURE_LLAN,		"hcall-lLAN"},
+	{FW_FEATURE_BULK,		"hcall-bulk"},
+	{FW_FEATURE_XDABR,		"hcall-xdabr"},
+	{FW_FEATURE_MULTITCE,		"hcall-multi-tce"},
+	{FW_FEATURE_SPLPAR,		"hcall-splpar"},
+};
diff --git a/trunk/arch/ppc64/kernel/firmware.c b/trunk/arch/ppc64/kernel/firmware.c
deleted file mode 100644
index d8432c0fb27d..000000000000
--- a/trunk/arch/ppc64/kernel/firmware.c
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- *  arch/ppc64/kernel/firmware.c
- *
- *  Extracted from cputable.c
- *
- *  Copyright (C) 2001 Ben. Herrenschmidt (benh@kernel.crashing.org)
- *
- *  Modifications for ppc64:
- *      Copyright (C) 2003 Dave Engebretsen <engebret@us.ibm.com>
- *  Copyright (C) 2005 Stephen Rothwell, IBM Corporation
- *
- *  This program is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU General Public License
- *  as published by the Free Software Foundation; either version
- *  2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-
-#include <asm/firmware.h>
-
-unsigned long ppc64_firmware_features;
-
-#ifdef CONFIG_PPC_PSERIES
-firmware_feature_t firmware_features_table[FIRMWARE_MAX_FEATURES] = {
-	{FW_FEATURE_PFT,		"hcall-pft"},
-	{FW_FEATURE_TCE,		"hcall-tce"},
-	{FW_FEATURE_SPRG0,		"hcall-sprg0"},
-	{FW_FEATURE_DABR,		"hcall-dabr"},
-	{FW_FEATURE_COPY,		"hcall-copy"},
-	{FW_FEATURE_ASR,		"hcall-asr"},
-	{FW_FEATURE_DEBUG,		"hcall-debug"},
-	{FW_FEATURE_PERF,		"hcall-perf"},
-	{FW_FEATURE_DUMP,		"hcall-dump"},
-	{FW_FEATURE_INTERRUPT,		"hcall-interrupt"},
-	{FW_FEATURE_MIGRATE,		"hcall-migrate"},
-	{FW_FEATURE_PERFMON,		"hcall-perfmon"},
-	{FW_FEATURE_CRQ,		"hcall-crq"},
-	{FW_FEATURE_VIO,		"hcall-vio"},
-	{FW_FEATURE_RDMA,		"hcall-rdma"},
-	{FW_FEATURE_LLAN,		"hcall-lLAN"},
-	{FW_FEATURE_BULK,		"hcall-bulk"},
-	{FW_FEATURE_XDABR,		"hcall-xdabr"},
-	{FW_FEATURE_MULTITCE,		"hcall-multi-tce"},
-	{FW_FEATURE_SPLPAR,		"hcall-splpar"},
-};
-#endif
diff --git a/trunk/arch/ppc64/kernel/head.S b/trunk/arch/ppc64/kernel/head.S
index 036959775623..accaa052d31f 100644
--- a/trunk/arch/ppc64/kernel/head.S
+++ b/trunk/arch/ppc64/kernel/head.S
@@ -23,11 +23,14 @@
  *  2 of the License, or (at your option) any later version.
  */
 
+#define SECONDARY_PROCESSORS
+
 #include <linux/config.h>
 #include <linux/threads.h>
 #include <asm/processor.h>
 #include <asm/page.h>
 #include <asm/mmu.h>
+#include <asm/naca.h>
 #include <asm/systemcfg.h>
 #include <asm/ppc_asm.h>
 #include <asm/offsets.h>
@@ -41,14 +44,19 @@
 #define DO_SOFT_DISABLE
 #endif
 
+/*
+ * hcall interface to pSeries LPAR
+ */
+#define H_SET_ASR	0x30
+
 /*
  * We layout physical memory as follows:
  * 0x0000 - 0x00ff : Secondary processor spin code
  * 0x0100 - 0x2fff : pSeries Interrupt prologs
- * 0x3000 - 0x5fff : interrupt support, iSeries and common interrupt prologs
- * 0x6000 - 0x6fff : Initial (CPU0) segment table
- * 0x7000 - 0x7fff : FWNMI data area
- * 0x8000 -        : Early init and support code
+ * 0x3000 - 0x3fff : Interrupt support
+ * 0x4000 - 0x4fff : NACA
+ * 0x6000	   : iSeries and common interrupt prologs
+ * 0x9000 - 0x9fff : Initial segment table
  */
 
 /*
@@ -86,7 +94,6 @@ END_FTR_SECTION(0, 1)
 
 	/* Catch branch to 0 in real mode */
 	trap
-
 #ifdef CONFIG_PPC_ISERIES
 	/*
 	 * At offset 0x20, there is a pointer to iSeries LPAR data.
@@ -96,12 +103,12 @@ END_FTR_SECTION(0, 1)
 	.llong hvReleaseData-KERNELBASE
 
 	/*
-	 * At offset 0x28 and 0x30 are offsets to the mschunks_map
+	 * At offset 0x28 and 0x30 are offsets to the msChunks
 	 * array (used by the iSeries LPAR debugger to do translation
 	 * between physical addresses and absolute addresses) and
 	 * to the pidhash table (also used by the debugger)
 	 */
-	.llong mschunks_map-KERNELBASE
+	.llong msChunks-KERNELBASE
 	.llong 0	/* pidhash-KERNELBASE SFRXXX */
 
 	/* Offset 0x38 - Pointer to start of embedded System.map */
@@ -113,7 +120,7 @@ embedded_sysmap_start:
 embedded_sysmap_end:
 	.llong	0
 
-#endif /* CONFIG_PPC_ISERIES */
+#else /* CONFIG_PPC_ISERIES */
 
 	/* Secondary processors spin on this value until it goes to 1. */
 	.globl  __secondary_hold_spinloop
@@ -148,7 +155,7 @@ _GLOBAL(__secondary_hold)
 	std	r24,__secondary_hold_acknowledge@l(0)
 	sync
 
-	/* All secondary cpus wait here until told to start. */
+	/* All secondary cpu's wait here until told to start. */
 100:	ld	r4,__secondary_hold_spinloop@l(0)
 	cmpdi	0,r4,1
 	bne	100b
@@ -163,6 +170,7 @@ _GLOBAL(__secondary_hold)
 	BUG_OPCODE
 #endif
 #endif
+#endif
 
 /* This value is used to mark exception frames on the stack. */
 	.section ".toc","aw"
@@ -494,37 +502,33 @@ system_call_pSeries:
 	STD_EXCEPTION_PSERIES(0x1300, instruction_breakpoint)
 	STD_EXCEPTION_PSERIES(0x1700, altivec_assist)
 
-	. = 0x3000
-
-/*** pSeries interrupt support ***/
-
 	/* moved from 0xf00 */
-	STD_EXCEPTION_PSERIES(., performance_monitor)
+	STD_EXCEPTION_PSERIES(0x3000, performance_monitor)
 
-	.align	7
+	. = 0x3100
 _GLOBAL(do_stab_bolted_pSeries)
 	mtcrf	0x80,r12
 	mfspr	r12,SPRG2
 	EXCEPTION_PROLOG_PSERIES(PACA_EXSLB, .do_stab_bolted)
 
-/*
- * Vectors for the FWNMI option.  Share common code.
- */
-      .globl system_reset_fwnmi
-system_reset_fwnmi:
-      HMT_MEDIUM
-      mtspr   SPRG1,r13               /* save r13 */
-      RUNLATCH_ON(r13)
-      EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, system_reset_common)
+	
+	/* Space for the naca.  Architected to be located at real address
+	 * NACA_PHYS_ADDR.  Various tools rely on this location being fixed.
+	 * The first dword of the naca is required by iSeries LPAR to
+	 * point to itVpdAreas.  On pSeries native, this value is not used.
+	 */
+	. = NACA_PHYS_ADDR
+	.globl __end_interrupts
+__end_interrupts:
+#ifdef CONFIG_PPC_ISERIES
+	.globl naca
+naca:
+	.llong	itVpdAreas
+	.llong	0		/* xRamDisk */
+	.llong	0		/* xRamDiskSize */
 
-      .globl machine_check_fwnmi
-machine_check_fwnmi:
-      HMT_MEDIUM
-      mtspr   SPRG1,r13               /* save r13 */
-      RUNLATCH_ON(r13)
-      EXCEPTION_PROLOG_PSERIES(PACA_EXMC, machine_check_common)
+	. = 0x6100
 
-#ifdef CONFIG_PPC_ISERIES
 /***  ISeries-LPAR interrupt handlers ***/
 
 	STD_EXCEPTION_ISERIES(0x200, machine_check, PACA_EXMC)
@@ -622,7 +626,9 @@ system_reset_iSeries:
 
 	cmpwi	0,r23,0
 	beq	iSeries_secondary_smp_loop	/* Loop until told to go */
+#ifdef SECONDARY_PROCESSORS
 	bne	.__secondary_start		/* Loop until told to go */
+#endif
 iSeries_secondary_smp_loop:
 	/* Let the Hypervisor know we are alive */
 	/* 8002 is a call to HvCallCfg::getLps, a harmless Hypervisor function */
@@ -665,8 +671,51 @@ hardware_interrupt_iSeries_masked:
 	ld	r13,PACA_EXGEN+EX_R13(r13)
 	rfid
 	b	.	/* prevent speculative execution */
+#endif
+
+/*
+ * Data area reserved for FWNMI option.
+ */
+	.= 0x7000
+	.globl fwnmi_data_area
+fwnmi_data_area:
+
+#ifdef CONFIG_PPC_ISERIES
+	. = LPARMAP_PHYS
+#include "lparmap.s"
 #endif /* CONFIG_PPC_ISERIES */
 
+/*
+ * Vectors for the FWNMI option.  Share common code.
+ */
+	. = 0x8000
+	.globl system_reset_fwnmi
+system_reset_fwnmi:
+	HMT_MEDIUM
+	mtspr	SPRG1,r13		/* save r13 */
+	RUNLATCH_ON(r13)
+	EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, system_reset_common)
+	.globl machine_check_fwnmi
+machine_check_fwnmi:
+	HMT_MEDIUM
+	mtspr	SPRG1,r13		/* save r13 */
+	RUNLATCH_ON(r13)
+	EXCEPTION_PROLOG_PSERIES(PACA_EXMC, machine_check_common)
+
+	/*
+	 * Space for the initial segment table
+	 * For LPAR, the hypervisor must fill in at least one entry
+	 * before we get control (with relocate on)
+	 */
+	. = STAB0_PHYS_ADDR
+	.globl __start_stab
+__start_stab:
+
+	. = (STAB0_PHYS_ADDR + PAGE_SIZE)
+	.globl __end_stab
+__end_stab:
+
+
 /*** Common interrupt handlers ***/
 
 	STD_EXCEPTION_COMMON(0x100, system_reset, .system_reset_exception)
@@ -703,8 +752,8 @@ machine_check_common:
  * R9 contains the saved CR, r13 points to the paca,
  * r10 contains the (bad) kernel stack pointer,
  * r11 and r12 contain the saved SRR0 and SRR1.
- * We switch to using an emergency stack, save the registers there,
- * and call kernel_bad_stack(), which panics.
+ * We switch to using the paca guard page as an emergency stack,
+ * save the registers there, and call kernel_bad_stack(), which panics.
  */
 bad_stack:
 	ld	r1,PACAEMERGSP(r13)
@@ -857,62 +906,6 @@ fp_unavailable_common:
 	bl	.kernel_fp_unavailable_exception
 	BUG_OPCODE
 
-/*
- * load_up_fpu(unused, unused, tsk)
- * Disable FP for the task which had the FPU previously,
- * and save its floating-point registers in its thread_struct.
- * Enables the FPU for use in the kernel on return.
- * On SMP we know the fpu is free, since we give it up every
- * switch (ie, no lazy save of the FP registers).
- * On entry: r13 == 'current' && last_task_used_math != 'current'
- */
-_STATIC(load_up_fpu)
-	mfmsr	r5			/* grab the current MSR */
-	ori	r5,r5,MSR_FP
-	mtmsrd	r5			/* enable use of fpu now */
-	isync
-/*
- * For SMP, we don't do lazy FPU switching because it just gets too
- * horrendously complex, especially when a task switches from one CPU
- * to another.  Instead we call giveup_fpu in switch_to.
- *
- */
-#ifndef CONFIG_SMP
-	ld	r3,last_task_used_math@got(r2)
-	ld	r4,0(r3)
-	cmpdi	0,r4,0
-	beq	1f
-	/* Save FP state to last_task_used_math's THREAD struct */
-	addi	r4,r4,THREAD
-	SAVE_32FPRS(0, r4)
-	mffs	fr0
-	stfd	fr0,THREAD_FPSCR(r4)
-	/* Disable FP for last_task_used_math */
-	ld	r5,PT_REGS(r4)
-	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-	li	r6,MSR_FP|MSR_FE0|MSR_FE1
-	andc	r4,r4,r6
-	std	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-1:
-#endif /* CONFIG_SMP */
-	/* enable use of FP after return */
-	ld	r4,PACACURRENT(r13)
-	addi	r5,r4,THREAD		/* Get THREAD */
-	ld	r4,THREAD_FPEXC_MODE(r5)
-	ori	r12,r12,MSR_FP
-	or	r12,r12,r4
-	std	r12,_MSR(r1)
-	lfd	fr0,THREAD_FPSCR(r5)
-	mtfsf	0xff,fr0
-	REST_32FPRS(0, r5)
-#ifndef CONFIG_SMP
-	/* Update last_task_used_math to 'current' */
-	subi	r4,r5,THREAD		/* Back to 'current' */
-	std	r4,0(r3)
-#endif /* CONFIG_SMP */
-	/* restore registers and return */
-	b	fast_exception_return
-
 	.align	7
 	.globl altivec_unavailable_common
 altivec_unavailable_common:
@@ -928,80 +921,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 	bl	.altivec_unavailable_exception
 	b	.ret_from_except
 
-#ifdef CONFIG_ALTIVEC
-/*
- * load_up_altivec(unused, unused, tsk)
- * Disable VMX for the task which had it previously,
- * and save its vector registers in its thread_struct.
- * Enables the VMX for use in the kernel on return.
- * On SMP we know the VMX is free, since we give it up every
- * switch (ie, no lazy save of the vector registers).
- * On entry: r13 == 'current' && last_task_used_altivec != 'current'
- */
-_STATIC(load_up_altivec)
-	mfmsr	r5			/* grab the current MSR */
-	oris	r5,r5,MSR_VEC@h
-	mtmsrd	r5			/* enable use of VMX now */
-	isync
-
-/*
- * For SMP, we don't do lazy VMX switching because it just gets too
- * horrendously complex, especially when a task switches from one CPU
- * to another.  Instead we call giveup_altvec in switch_to.
- * VRSAVE isn't dealt with here, that is done in the normal context
- * switch code. Note that we could rely on vrsave value to eventually
- * avoid saving all of the VREGs here...
- */
-#ifndef CONFIG_SMP
-	ld	r3,last_task_used_altivec@got(r2)
-	ld	r4,0(r3)
-	cmpdi	0,r4,0
-	beq	1f
-	/* Save VMX state to last_task_used_altivec's THREAD struct */
-	addi	r4,r4,THREAD
-	SAVE_32VRS(0,r5,r4)
-	mfvscr	vr0
-	li	r10,THREAD_VSCR
-	stvx	vr0,r10,r4
-	/* Disable VMX for last_task_used_altivec */
-	ld	r5,PT_REGS(r4)
-	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-	lis	r6,MSR_VEC@h
-	andc	r4,r4,r6
-	std	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-1:
-#endif /* CONFIG_SMP */
-	/* Hack: if we get an altivec unavailable trap with VRSAVE
-	 * set to all zeros, we assume this is a broken application
-	 * that fails to set it properly, and thus we switch it to
-	 * all 1's
-	 */
-	mfspr	r4,SPRN_VRSAVE
-	cmpdi	0,r4,0
-	bne+	1f
-	li	r4,-1
-	mtspr	SPRN_VRSAVE,r4
-1:
-	/* enable use of VMX after return */
-	ld	r4,PACACURRENT(r13)
-	addi	r5,r4,THREAD		/* Get THREAD */
-	oris	r12,r12,MSR_VEC@h
-	std	r12,_MSR(r1)
-	li	r4,1
-	li	r10,THREAD_VSCR
-	stw	r4,THREAD_USED_VR(r5)
-	lvx	vr0,r10,r5
-	mtvscr	vr0
-	REST_32VRS(0,r4,r5)
-#ifndef CONFIG_SMP
-	/* Update last_task_used_math to 'current' */
-	subi	r4,r5,THREAD		/* Back to 'current' */
-	std	r4,0(r3)
-#endif /* CONFIG_SMP */
-	/* restore registers and return */
-	b	fast_exception_return
-#endif /* CONFIG_ALTIVEC */
-
 /*
  * Hash table stuff
  */
@@ -1248,42 +1167,6 @@ unrecov_slb:
 	bl	.unrecoverable_exception
 	b	1b
 
-/*
- * Space for CPU0's segment table.
- *
- * On iSeries, the hypervisor must fill in at least one entry before
- * we get control (with relocate on).  The address is give to the hv
- * as a page number (see xLparMap in LparData.c), so this must be at a
- * fixed address (the linker can't compute (u64)&initial_stab >>
- * PAGE_SHIFT).
- */
-	. = STAB0_PHYS_ADDR	/* 0x6000 */
-	.globl initial_stab
-initial_stab:
-	.space	4096
-
-/*
- * Data area reserved for FWNMI option.
- * This address (0x7000) is fixed by the RPA.
- */
-	.= 0x7000
-	.globl fwnmi_data_area
-fwnmi_data_area:
-
-	/* iSeries does not use the FWNMI stuff, so it is safe to put
-	 * this here, even if we later allow kernels that will boot on
-	 * both pSeries and iSeries */
-#ifdef CONFIG_PPC_ISERIES
-        . = LPARMAP_PHYS
-#include "lparmap.s"
-/*
- * This ".text" is here for old compilers that generate a trailing
- * .note section when compiling .c files to .s
- */
-	.text
-#endif /* CONFIG_PPC_ISERIES */
-
-        . = 0x8000
 
 /*
  * On pSeries, secondary processors spin in the following code.
@@ -1317,7 +1200,7 @@ _GLOBAL(pSeries_secondary_smp_init)
 	b	.kexec_wait		/* next kernel might do better	 */
 
 2:	mtspr	SPRG3,r13		/* Save vaddr of paca in SPRG3	 */
-	/* From now on, r24 is expected to be logical cpuid */
+	/* From now on, r24 is expected to be logica cpuid */
 	mr	r24,r5
 3:	HMT_LOW
 	lbz	r23,PACAPROCSTART(r13)	/* Test if this processor should */
@@ -1330,7 +1213,9 @@ _GLOBAL(pSeries_secondary_smp_init)
 
 	cmpwi	0,r23,0
 #ifdef CONFIG_SMP
+#ifdef SECONDARY_PROCESSORS
 	bne	.__secondary_start
+#endif
 #endif
 	b 	3b			/* Loop until told to go	 */
 
@@ -1545,6 +1430,228 @@ _GLOBAL(copy_and_flush)
 .align 8
 copy_to_here:
 
+/*
+ * load_up_fpu(unused, unused, tsk)
+ * Disable FP for the task which had the FPU previously,
+ * and save its floating-point registers in its thread_struct.
+ * Enables the FPU for use in the kernel on return.
+ * On SMP we know the fpu is free, since we give it up every
+ * switch (ie, no lazy save of the FP registers).
+ * On entry: r13 == 'current' && last_task_used_math != 'current'
+ */
+_STATIC(load_up_fpu)
+	mfmsr	r5			/* grab the current MSR */
+	ori	r5,r5,MSR_FP
+	mtmsrd	r5			/* enable use of fpu now */
+	isync
+/*
+ * For SMP, we don't do lazy FPU switching because it just gets too
+ * horrendously complex, especially when a task switches from one CPU
+ * to another.  Instead we call giveup_fpu in switch_to.
+ *
+ */
+#ifndef CONFIG_SMP
+	ld	r3,last_task_used_math@got(r2)
+	ld	r4,0(r3)
+	cmpdi	0,r4,0
+	beq	1f
+	/* Save FP state to last_task_used_math's THREAD struct */
+	addi	r4,r4,THREAD
+	SAVE_32FPRS(0, r4)
+	mffs	fr0
+	stfd	fr0,THREAD_FPSCR(r4)
+	/* Disable FP for last_task_used_math */
+	ld	r5,PT_REGS(r4)
+	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+	li	r6,MSR_FP|MSR_FE0|MSR_FE1
+	andc	r4,r4,r6
+	std	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+1:
+#endif /* CONFIG_SMP */
+	/* enable use of FP after return */
+	ld	r4,PACACURRENT(r13)
+	addi	r5,r4,THREAD		/* Get THREAD */
+	ld	r4,THREAD_FPEXC_MODE(r5)
+	ori	r12,r12,MSR_FP
+	or	r12,r12,r4
+	std	r12,_MSR(r1)
+	lfd	fr0,THREAD_FPSCR(r5)
+	mtfsf	0xff,fr0
+	REST_32FPRS(0, r5)
+#ifndef CONFIG_SMP
+	/* Update last_task_used_math to 'current' */
+	subi	r4,r5,THREAD		/* Back to 'current' */
+	std	r4,0(r3)
+#endif /* CONFIG_SMP */
+	/* restore registers and return */
+	b	fast_exception_return
+
+/*
+ * disable_kernel_fp()
+ * Disable the FPU.
+ */
+_GLOBAL(disable_kernel_fp)
+	mfmsr	r3
+	rldicl	r0,r3,(63-MSR_FP_LG),1
+	rldicl	r3,r0,(MSR_FP_LG+1),0
+	mtmsrd	r3			/* disable use of fpu now */
+	isync
+	blr
+
+/*
+ * giveup_fpu(tsk)
+ * Disable FP for the task given as the argument,
+ * and save the floating-point registers in its thread_struct.
+ * Enables the FPU for use in the kernel on return.
+ */
+_GLOBAL(giveup_fpu)
+	mfmsr	r5
+	ori	r5,r5,MSR_FP
+	mtmsrd	r5			/* enable use of fpu now */
+	isync
+	cmpdi	0,r3,0
+	beqlr-				/* if no previous owner, done */
+	addi	r3,r3,THREAD		/* want THREAD of task */
+	ld	r5,PT_REGS(r3)
+	cmpdi	0,r5,0
+	SAVE_32FPRS(0, r3)
+	mffs	fr0
+	stfd	fr0,THREAD_FPSCR(r3)
+	beq	1f
+	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+	li	r3,MSR_FP|MSR_FE0|MSR_FE1
+	andc	r4,r4,r3		/* disable FP for previous task */
+	std	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+1:
+#ifndef CONFIG_SMP
+	li	r5,0
+	ld	r4,last_task_used_math@got(r2)
+	std	r5,0(r4)
+#endif /* CONFIG_SMP */
+	blr
+
+
+#ifdef CONFIG_ALTIVEC
+		
+/*
+ * load_up_altivec(unused, unused, tsk)
+ * Disable VMX for the task which had it previously,
+ * and save its vector registers in its thread_struct.
+ * Enables the VMX for use in the kernel on return.
+ * On SMP we know the VMX is free, since we give it up every
+ * switch (ie, no lazy save of the vector registers).
+ * On entry: r13 == 'current' && last_task_used_altivec != 'current'
+ */
+_STATIC(load_up_altivec)
+	mfmsr	r5			/* grab the current MSR */
+	oris	r5,r5,MSR_VEC@h
+	mtmsrd	r5			/* enable use of VMX now */
+	isync
+	
+/*
+ * For SMP, we don't do lazy VMX switching because it just gets too
+ * horrendously complex, especially when a task switches from one CPU
+ * to another.  Instead we call giveup_altvec in switch_to.
+ * VRSAVE isn't dealt with here, that is done in the normal context
+ * switch code. Note that we could rely on vrsave value to eventually
+ * avoid saving all of the VREGs here...
+ */
+#ifndef CONFIG_SMP
+	ld	r3,last_task_used_altivec@got(r2)
+	ld	r4,0(r3)
+	cmpdi	0,r4,0
+	beq	1f
+	/* Save VMX state to last_task_used_altivec's THREAD struct */
+	addi	r4,r4,THREAD
+	SAVE_32VRS(0,r5,r4)
+	mfvscr	vr0
+	li	r10,THREAD_VSCR
+	stvx	vr0,r10,r4
+	/* Disable VMX for last_task_used_altivec */
+	ld	r5,PT_REGS(r4)
+	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+	lis	r6,MSR_VEC@h
+	andc	r4,r4,r6
+	std	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+1:
+#endif /* CONFIG_SMP */
+	/* Hack: if we get an altivec unavailable trap with VRSAVE
+	 * set to all zeros, we assume this is a broken application
+	 * that fails to set it properly, and thus we switch it to
+	 * all 1's
+	 */
+	mfspr	r4,SPRN_VRSAVE
+	cmpdi	0,r4,0
+	bne+	1f
+	li	r4,-1
+	mtspr	SPRN_VRSAVE,r4
+1:
+	/* enable use of VMX after return */
+	ld	r4,PACACURRENT(r13)
+	addi	r5,r4,THREAD		/* Get THREAD */
+	oris	r12,r12,MSR_VEC@h
+	std	r12,_MSR(r1)
+	li	r4,1
+	li	r10,THREAD_VSCR
+	stw	r4,THREAD_USED_VR(r5)
+	lvx	vr0,r10,r5
+	mtvscr	vr0
+	REST_32VRS(0,r4,r5)
+#ifndef CONFIG_SMP
+	/* Update last_task_used_math to 'current' */
+	subi	r4,r5,THREAD		/* Back to 'current' */
+	std	r4,0(r3)
+#endif /* CONFIG_SMP */
+	/* restore registers and return */
+	b	fast_exception_return
+
+/*
+ * disable_kernel_altivec()
+ * Disable the VMX.
+ */
+_GLOBAL(disable_kernel_altivec)
+	mfmsr	r3
+	rldicl	r0,r3,(63-MSR_VEC_LG),1
+	rldicl	r3,r0,(MSR_VEC_LG+1),0
+	mtmsrd	r3			/* disable use of VMX now */
+	isync
+	blr
+
+/*
+ * giveup_altivec(tsk)
+ * Disable VMX for the task given as the argument,
+ * and save the vector registers in its thread_struct.
+ * Enables the VMX for use in the kernel on return.
+ */
+_GLOBAL(giveup_altivec)
+	mfmsr	r5
+	oris	r5,r5,MSR_VEC@h
+	mtmsrd	r5			/* enable use of VMX now */
+	isync
+	cmpdi	0,r3,0
+	beqlr-				/* if no previous owner, done */
+	addi	r3,r3,THREAD		/* want THREAD of task */
+	ld	r5,PT_REGS(r3)
+	cmpdi	0,r5,0
+	SAVE_32VRS(0,r4,r3)
+	mfvscr	vr0
+	li	r4,THREAD_VSCR
+	stvx	vr0,r4,r3
+	beq	1f
+	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+	lis	r3,MSR_VEC@h
+	andc	r4,r4,r3		/* disable FP for previous task */
+	std	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+1:
+#ifndef CONFIG_SMP
+	li	r5,0
+	ld	r4,last_task_used_altivec@got(r2)
+	std	r5,0(r4)
+#endif /* CONFIG_SMP */
+	blr
+
+#endif /* CONFIG_ALTIVEC */
+
 #ifdef CONFIG_SMP
 #ifdef CONFIG_PPC_PMAC
 /*
@@ -1895,6 +2002,9 @@ _STATIC(start_here_common)
 
 	bl .start_kernel
 
+_GLOBAL(__setup_cpu_power3)
+	blr
+
 _GLOBAL(hmt_init)
 #ifdef CONFIG_HMT
 	LOADADDR(r5, hmt_thread_data)
@@ -1985,19 +2095,20 @@ _GLOBAL(smp_release_cpus)
 
 /*
  * We put a few things here that have to be page-aligned.
- * This stuff goes at the beginning of the bss, which is page-aligned.
+ * This stuff goes at the beginning of the data segment,
+ * which is page-aligned.
  */
-	.section ".bss"
-
+	.data
 	.align	12
-
+	.globl	sdata
+sdata:
 	.globl	empty_zero_page
 empty_zero_page:
-	.space	PAGE_SIZE
+	.space	4096
 
 	.globl	swapper_pg_dir
 swapper_pg_dir:
-	.space	PAGE_SIZE
+	.space	4096
 
 /*
  * This space gets a copy of optional info passed to us by the bootstrap
diff --git a/trunk/arch/ppc64/kernel/iSeries_htab.c b/trunk/arch/ppc64/kernel/iSeries_htab.c
index 2192055a90a0..b0250ae4a72a 100644
--- a/trunk/arch/ppc64/kernel/iSeries_htab.c
+++ b/trunk/arch/ppc64/kernel/iSeries_htab.c
@@ -41,7 +41,6 @@ static long iSeries_hpte_insert(unsigned long hpte_group, unsigned long va,
 				unsigned long prpn, unsigned long vflags,
 				unsigned long rflags)
 {
-	unsigned long arpn;
 	long slot;
 	hpte_t lhpte;
 	int secondary = 0;
@@ -71,10 +70,8 @@ static long iSeries_hpte_insert(unsigned long hpte_group, unsigned long va,
 		slot &= 0x7fffffffffffffff;
 	}
 
-	arpn = phys_to_abs(prpn << PAGE_SHIFT) >> PAGE_SHIFT;
-
 	lhpte.v = (va >> 23) << HPTE_V_AVPN_SHIFT | vflags | HPTE_V_VALID;
-	lhpte.r = (arpn << HPTE_R_RPN_SHIFT) | rflags;
+	lhpte.r = (physRpn_to_absRpn(prpn) << HPTE_R_RPN_SHIFT) | rflags;
 
 	/* Now fill in the actual HPTE */
 	HvCallHpt_addValidate(slot, secondary, &lhpte);
diff --git a/trunk/arch/ppc64/kernel/iSeries_setup.c b/trunk/arch/ppc64/kernel/iSeries_setup.c
index 3ffefbbc6623..a649edbb23b6 100644
--- a/trunk/arch/ppc64/kernel/iSeries_setup.c
+++ b/trunk/arch/ppc64/kernel/iSeries_setup.c
@@ -39,7 +39,6 @@
 #include <asm/cputable.h>
 #include <asm/sections.h>
 #include <asm/iommu.h>
-#include <asm/firmware.h>
 
 #include <asm/time.h>
 #include "iSeries_setup.h"
@@ -315,8 +314,6 @@ static void __init iSeries_init_early(void)
 
 	DBG(" -> iSeries_init_early()\n");
 
-	ppc64_firmware_features = FW_FEATURE_ISERIES;
-
 	ppcdbg_initialize();
 
 #if defined(CONFIG_BLK_DEV_INITRD)
@@ -415,22 +412,6 @@ static void __init iSeries_init_early(void)
 	DBG(" <- iSeries_init_early()\n");
 }
 
-struct mschunks_map mschunks_map = {
-	/* XXX We don't use these, but Piranha might need them. */
-	.chunk_size  = MSCHUNKS_CHUNK_SIZE,
-	.chunk_shift = MSCHUNKS_CHUNK_SHIFT,
-	.chunk_mask  = MSCHUNKS_OFFSET_MASK,
-};
-EXPORT_SYMBOL(mschunks_map);
-
-void mschunks_alloc(unsigned long num_chunks)
-{
-	klimit = _ALIGN(klimit, sizeof(u32));
-	mschunks_map.mapping = (u32 *)klimit;
-	klimit += num_chunks * sizeof(u32);
-	mschunks_map.num_chunks = num_chunks;
-}
-
 /*
  * The iSeries may have very large memories ( > 128 GB ) and a partition
  * may get memory in "chunks" that may be anywhere in the 2**52 real
@@ -468,7 +449,7 @@ static void __init build_iSeries_Memory_Map(void)
 
 	/* Chunk size on iSeries is 256K bytes */
 	totalChunks = (u32)HvLpConfig_getMsChunks();
-	mschunks_alloc(totalChunks);
+	klimit = msChunks_alloc(klimit, totalChunks, 1UL << 18);
 
 	/*
 	 * Get absolute address of our load area
@@ -505,7 +486,7 @@ static void __init build_iSeries_Memory_Map(void)
 	printk("Load area size %dK\n", loadAreaSize * 256);
 
 	for (nextPhysChunk = 0; nextPhysChunk < loadAreaSize; ++nextPhysChunk)
-		mschunks_map.mapping[nextPhysChunk] =
+		msChunks.abs[nextPhysChunk] =
 			loadAreaFirstChunk + nextPhysChunk;
 
 	/*
@@ -514,7 +495,7 @@ static void __init build_iSeries_Memory_Map(void)
 	 */
 	hptFirstChunk = (u32)addr_to_chunk(HvCallHpt_getHptAddress());
 	hptSizePages = (u32)HvCallHpt_getHptPages();
-	hptSizeChunks = hptSizePages >> (MSCHUNKS_CHUNK_SHIFT - PAGE_SHIFT);
+	hptSizeChunks = hptSizePages >> (msChunks.chunk_shift - PAGE_SHIFT);
 	hptLastChunk = hptFirstChunk + hptSizeChunks - 1;
 
 	printk("HPT absolute addr = %016lx, size = %dK\n",
@@ -571,8 +552,7 @@ static void __init build_iSeries_Memory_Map(void)
 				     (absChunk > hptLastChunk)) &&
 				    ((absChunk < loadAreaFirstChunk) ||
 				     (absChunk > loadAreaLastChunk))) {
-					mschunks_map.mapping[nextPhysChunk] =
-						absChunk;
+					msChunks.abs[nextPhysChunk] = absChunk;
 					++nextPhysChunk;
 				}
 			}
@@ -964,8 +944,6 @@ void __init iSeries_early_setup(void)
 	ppc_md.calibrate_decr = iSeries_calibrate_decr;
 	ppc_md.progress = iSeries_progress;
 
-	/* XXX Implement enable_pmcs for iSeries */
-
 	if (get_paca()->lppaca.shared_proc) {
 		ppc_md.idle_loop = iseries_shared_idle;
 		printk(KERN_INFO "Using shared processor idle loop\n");
diff --git a/trunk/arch/ppc64/kernel/iSeries_vio.c b/trunk/arch/ppc64/kernel/iSeries_vio.c
deleted file mode 100644
index 6b754b0c8344..000000000000
--- a/trunk/arch/ppc64/kernel/iSeries_vio.c
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * IBM PowerPC iSeries Virtual I/O Infrastructure Support.
- *
- *    Copyright (c) 2005 Stephen Rothwell, IBM Corp.
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-#include <linux/types.h>
-#include <linux/device.h>
-#include <linux/init.h>
-
-#include <asm/vio.h>
-#include <asm/iommu.h>
-#include <asm/abs_addr.h>
-#include <asm/page.h>
-#include <asm/iSeries/vio.h>
-#include <asm/iSeries/HvTypes.h>
-#include <asm/iSeries/HvLpConfig.h>
-#include <asm/iSeries/HvCallXm.h>
-
-struct device *iSeries_vio_dev = &vio_bus_device.dev;
-EXPORT_SYMBOL(iSeries_vio_dev);
-
-static struct iommu_table veth_iommu_table;
-static struct iommu_table vio_iommu_table;
-
-static void __init iommu_vio_init(void)
-{
-	struct iommu_table *t;
-	struct iommu_table_cb cb;
-	unsigned long cbp;
-	unsigned long itc_entries;
-
-	cb.itc_busno = 255;    /* Bus 255 is the virtual bus */
-	cb.itc_virtbus = 0xff; /* Ask for virtual bus */
-
-	cbp = virt_to_abs(&cb);
-	HvCallXm_getTceTableParms(cbp);
-
-	itc_entries = cb.itc_size * PAGE_SIZE / sizeof(union tce_entry);
-	veth_iommu_table.it_size        = itc_entries / 2;
-	veth_iommu_table.it_busno       = cb.itc_busno;
-	veth_iommu_table.it_offset      = cb.itc_offset;
-	veth_iommu_table.it_index       = cb.itc_index;
-	veth_iommu_table.it_type        = TCE_VB;
-	veth_iommu_table.it_blocksize	= 1;
-
-	t = iommu_init_table(&veth_iommu_table);
-
-	if (!t)
-		printk("Virtual Bus VETH TCE table failed.\n");
-
-	vio_iommu_table.it_size         = itc_entries - veth_iommu_table.it_size;
-	vio_iommu_table.it_busno        = cb.itc_busno;
-	vio_iommu_table.it_offset       = cb.itc_offset +
-					  veth_iommu_table.it_size;
-	vio_iommu_table.it_index        = cb.itc_index;
-	vio_iommu_table.it_type         = TCE_VB;
-	vio_iommu_table.it_blocksize	= 1;
-
-	t = iommu_init_table(&vio_iommu_table);
-
-	if (!t)
-		printk("Virtual Bus VIO TCE table failed.\n");
-}
-
-/**
- * vio_register_device_iseries: - Register a new iSeries vio device.
- * @voidev:	The device to register.
- */
-static struct vio_dev *__init vio_register_device_iseries(char *type,
-		uint32_t unit_num)
-{
-	struct vio_dev *viodev;
-
-	/* allocate a vio_dev for this device */
-	viodev = kmalloc(sizeof(struct vio_dev), GFP_KERNEL);
-	if (!viodev)
-		return NULL;
-	memset(viodev, 0, sizeof(struct vio_dev));
-
-	snprintf(viodev->dev.bus_id, BUS_ID_SIZE, "%s%d", type, unit_num);
-
-	viodev->name = viodev->dev.bus_id;
-	viodev->type = type;
-	viodev->unit_address = unit_num;
-	viodev->iommu_table = &vio_iommu_table;
-	if (vio_register_device(viodev) == NULL) {
-		kfree(viodev);
-		return NULL;
-	}
-	return viodev;
-}
-
-void __init probe_bus_iseries(void)
-{
-	HvLpIndexMap vlan_map;
-	struct vio_dev *viodev;
-	int i;
-
-	/* there is only one of each of these */
-	vio_register_device_iseries("viocons", 0);
-	vio_register_device_iseries("vscsi", 0);
-
-	vlan_map = HvLpConfig_getVirtualLanIndexMap();
-	for (i = 0; i < HVMAXARCHITECTEDVIRTUALLANS; i++) {
-		if ((vlan_map & (0x8000 >> i)) == 0)
-			continue;
-		viodev = vio_register_device_iseries("vlan", i);
-		/* veth is special and has it own iommu_table */
-		viodev->iommu_table = &veth_iommu_table;
-	}
-	for (i = 0; i < HVMAXARCHITECTEDVIRTUALDISKS; i++)
-		vio_register_device_iseries("viodasd", i);
-	for (i = 0; i < HVMAXARCHITECTEDVIRTUALCDROMS; i++)
-		vio_register_device_iseries("viocd", i);
-	for (i = 0; i < HVMAXARCHITECTEDVIRTUALTAPES; i++)
-		vio_register_device_iseries("viotape", i);
-}
-
-/**
- * vio_match_device_iseries: - Tell if a iSeries VIO device matches a
- *	vio_device_id
- */
-static int vio_match_device_iseries(const struct vio_device_id *id,
-		const struct vio_dev *dev)
-{
-	return strncmp(dev->type, id->type, strlen(id->type)) == 0;
-}
-
-static struct vio_bus_ops vio_bus_ops_iseries = {
-	.match = vio_match_device_iseries,
-};
-
-/**
- * vio_bus_init_iseries: - Initialize the iSeries virtual IO bus
- */
-static int __init vio_bus_init_iseries(void)
-{
-	int err;
-
-	err = vio_bus_init(&vio_bus_ops_iseries);
-	if (err == 0) {
-		iommu_vio_init();
-		vio_bus_device.iommu_table = &vio_iommu_table;
-		iSeries_vio_dev = &vio_bus_device.dev;
-		probe_bus_iseries();
-	}
-	return err;
-}
-
-__initcall(vio_bus_init_iseries);
diff --git a/trunk/arch/ppc64/kernel/lmb.c b/trunk/arch/ppc64/kernel/lmb.c
index 5adaca2ddc9d..d6c6bd03d2a4 100644
--- a/trunk/arch/ppc64/kernel/lmb.c
+++ b/trunk/arch/ppc64/kernel/lmb.c
@@ -28,28 +28,33 @@ void lmb_dump_all(void)
 {
 #ifdef DEBUG
 	unsigned long i;
+	struct lmb *_lmb  = &lmb;
 
 	udbg_printf("lmb_dump_all:\n");
 	udbg_printf("    memory.cnt		  = 0x%lx\n",
-		    lmb.memory.cnt);
+		    _lmb->memory.cnt);
 	udbg_printf("    memory.size		  = 0x%lx\n",
-		    lmb.memory.size);
-	for (i=0; i < lmb.memory.cnt ;i++) {
+		    _lmb->memory.size);
+	for (i=0; i < _lmb->memory.cnt ;i++) {
 		udbg_printf("    memory.region[0x%x].base       = 0x%lx\n",
-			    i, lmb.memory.region[i].base);
+			    i, _lmb->memory.region[i].base);
+		udbg_printf("		      .physbase = 0x%lx\n",
+			    _lmb->memory.region[i].physbase);
 		udbg_printf("		      .size     = 0x%lx\n",
-			    lmb.memory.region[i].size);
+			    _lmb->memory.region[i].size);
 	}
 
 	udbg_printf("\n    reserved.cnt	  = 0x%lx\n",
-		    lmb.reserved.cnt);
+		    _lmb->reserved.cnt);
 	udbg_printf("    reserved.size	  = 0x%lx\n",
-		    lmb.reserved.size);
-	for (i=0; i < lmb.reserved.cnt ;i++) {
+		    _lmb->reserved.size);
+	for (i=0; i < _lmb->reserved.cnt ;i++) {
 		udbg_printf("    reserved.region[0x%x].base       = 0x%lx\n",
-			    i, lmb.reserved.region[i].base);
+			    i, _lmb->reserved.region[i].base);
+		udbg_printf("		      .physbase = 0x%lx\n",
+			    _lmb->reserved.region[i].physbase);
 		udbg_printf("		      .size     = 0x%lx\n",
-			    lmb.reserved.region[i].size);
+			    _lmb->reserved.region[i].size);
 	}
 #endif /* DEBUG */
 }
@@ -93,6 +98,7 @@ lmb_coalesce_regions(struct lmb_region *rgn, unsigned long r1, unsigned long r2)
 	rgn->region[r1].size += rgn->region[r2].size;
 	for (i=r2; i < rgn->cnt-1; i++) {
 		rgn->region[i].base = rgn->region[i+1].base;
+		rgn->region[i].physbase = rgn->region[i+1].physbase;
 		rgn->region[i].size = rgn->region[i+1].size;
 	}
 	rgn->cnt--;
@@ -102,29 +108,49 @@ lmb_coalesce_regions(struct lmb_region *rgn, unsigned long r1, unsigned long r2)
 void __init
 lmb_init(void)
 {
+	struct lmb *_lmb = &lmb;
+
 	/* Create a dummy zero size LMB which will get coalesced away later.
 	 * This simplifies the lmb_add() code below...
 	 */
-	lmb.memory.region[0].base = 0;
-	lmb.memory.region[0].size = 0;
-	lmb.memory.cnt = 1;
+	_lmb->memory.region[0].base = 0;
+	_lmb->memory.region[0].size = 0;
+	_lmb->memory.cnt = 1;
 
 	/* Ditto. */
-	lmb.reserved.region[0].base = 0;
-	lmb.reserved.region[0].size = 0;
-	lmb.reserved.cnt = 1;
+	_lmb->reserved.region[0].base = 0;
+	_lmb->reserved.region[0].size = 0;
+	_lmb->reserved.cnt = 1;
 }
 
 /* This routine called with relocation disabled. */
 void __init
 lmb_analyze(void)
 {
-	int i;
-
-	lmb.memory.size = 0;
+	unsigned long i;
+	unsigned long mem_size = 0;
+	unsigned long size_mask = 0;
+	struct lmb *_lmb = &lmb;
+#ifdef CONFIG_MSCHUNKS
+	unsigned long physbase = 0;
+#endif
+
+	for (i=0; i < _lmb->memory.cnt; i++) {
+		unsigned long lmb_size;
+
+		lmb_size = _lmb->memory.region[i].size;
+
+#ifdef CONFIG_MSCHUNKS
+		_lmb->memory.region[i].physbase = physbase;
+		physbase += lmb_size;
+#else
+		_lmb->memory.region[i].physbase = _lmb->memory.region[i].base;
+#endif
+		mem_size += lmb_size;
+		size_mask |= lmb_size;
+	}
 
-	for (i = 0; i < lmb.memory.cnt; i++)
-		lmb.memory.size += lmb.memory.region[i].size;
+	_lmb->memory.size = mem_size;
 }
 
 /* This routine called with relocation disabled. */
@@ -142,6 +168,7 @@ lmb_add_region(struct lmb_region *rgn, unsigned long base, unsigned long size)
 		adjacent = lmb_addrs_adjacent(base,size,rgnbase,rgnsize);
 		if ( adjacent > 0 ) {
 			rgn->region[i].base -= size;
+			rgn->region[i].physbase -= size;
 			rgn->region[i].size += size;
 			coalesced++;
 			break;
@@ -168,9 +195,11 @@ lmb_add_region(struct lmb_region *rgn, unsigned long base, unsigned long size)
 	for (i=rgn->cnt-1; i >= 0; i--) {
 		if (base < rgn->region[i].base) {
 			rgn->region[i+1].base = rgn->region[i].base;
+			rgn->region[i+1].physbase = rgn->region[i].physbase;
 			rgn->region[i+1].size = rgn->region[i].size;
 		}  else {
 			rgn->region[i+1].base = base;
+			rgn->region[i+1].physbase = lmb_abs_to_phys(base);
 			rgn->region[i+1].size = size;
 			break;
 		}
@@ -184,11 +213,12 @@ lmb_add_region(struct lmb_region *rgn, unsigned long base, unsigned long size)
 long __init
 lmb_add(unsigned long base, unsigned long size)
 {
-	struct lmb_region *_rgn = &(lmb.memory);
+	struct lmb *_lmb = &lmb;
+	struct lmb_region *_rgn = &(_lmb->memory);
 
 	/* On pSeries LPAR systems, the first LMB is our RMO region. */
 	if ( base == 0 )
-		lmb.rmo_size = size;
+		_lmb->rmo_size = size;
 
 	return lmb_add_region(_rgn, base, size);
 
@@ -197,7 +227,8 @@ lmb_add(unsigned long base, unsigned long size)
 long __init
 lmb_reserve(unsigned long base, unsigned long size)
 {
-	struct lmb_region *_rgn = &(lmb.reserved);
+	struct lmb *_lmb = &lmb;
+	struct lmb_region *_rgn = &(_lmb->reserved);
 
 	return lmb_add_region(_rgn, base, size);
 }
@@ -229,10 +260,13 @@ lmb_alloc_base(unsigned long size, unsigned long align, unsigned long max_addr)
 {
 	long i, j;
 	unsigned long base = 0;
+	struct lmb *_lmb = &lmb;
+	struct lmb_region *_mem = &(_lmb->memory);
+	struct lmb_region *_rsv = &(_lmb->reserved);
 
-	for (i=lmb.memory.cnt-1; i >= 0; i--) {
-		unsigned long lmbbase = lmb.memory.region[i].base;
-		unsigned long lmbsize = lmb.memory.region[i].size;
+	for (i=_mem->cnt-1; i >= 0; i--) {
+		unsigned long lmbbase = _mem->region[i].base;
+		unsigned long lmbsize = _mem->region[i].size;
 
 		if ( max_addr == LMB_ALLOC_ANYWHERE )
 			base = _ALIGN_DOWN(lmbbase+lmbsize-size, align);
@@ -242,8 +276,8 @@ lmb_alloc_base(unsigned long size, unsigned long align, unsigned long max_addr)
 			continue;
 
 		while ( (lmbbase <= base) &&
-			((j = lmb_overlaps_region(&lmb.reserved,base,size)) >= 0) ) {
-			base = _ALIGN_DOWN(lmb.reserved.region[j].base-size, align);
+			((j = lmb_overlaps_region(_rsv,base,size)) >= 0) ) {
+			base = _ALIGN_DOWN(_rsv->region[j].base-size, align);
 		}
 
 		if ( (base != 0) && (lmbbase <= base) )
@@ -253,24 +287,62 @@ lmb_alloc_base(unsigned long size, unsigned long align, unsigned long max_addr)
 	if ( i < 0 )
 		return 0;
 
-	lmb_add_region(&lmb.reserved, base, size);
+	lmb_add_region(_rsv, base, size);
 
 	return base;
 }
 
-/* You must call lmb_analyze() before this. */
 unsigned long __init
 lmb_phys_mem_size(void)
 {
-	return lmb.memory.size;
+	struct lmb *_lmb = &lmb;
+#ifdef CONFIG_MSCHUNKS
+	return _lmb->memory.size;
+#else
+	struct lmb_region *_mem = &(_lmb->memory);
+	unsigned long total = 0;
+	int i;
+
+	/* add all physical memory to the bootmem map */
+	for (i=0; i < _mem->cnt; i++)
+		total += _mem->region[i].size;
+	return total;
+#endif /* CONFIG_MSCHUNKS */
 }
 
 unsigned long __init
 lmb_end_of_DRAM(void)
 {
-	int idx = lmb.memory.cnt - 1;
+	struct lmb *_lmb = &lmb;
+	struct lmb_region *_mem = &(_lmb->memory);
+	int idx = _mem->cnt - 1;
+
+#ifdef CONFIG_MSCHUNKS
+	return (_mem->region[idx].physbase + _mem->region[idx].size);
+#else
+	return (_mem->region[idx].base + _mem->region[idx].size);
+#endif /* CONFIG_MSCHUNKS */
+
+	return 0;
+}
+
+unsigned long __init
+lmb_abs_to_phys(unsigned long aa)
+{
+	unsigned long i, pa = aa;
+	struct lmb *_lmb = &lmb;
+	struct lmb_region *_mem = &(_lmb->memory);
+
+	for (i=0; i < _mem->cnt; i++) {
+		unsigned long lmbbase = _mem->region[i].base;
+		unsigned long lmbsize = _mem->region[i].size;
+		if ( lmb_addrs_overlap(aa,1,lmbbase,lmbsize) ) {
+			pa = _mem->region[i].physbase + (aa - lmbbase);
+			break;
+		}
+	}
 
-	return (lmb.memory.region[idx].base + lmb.memory.region[idx].size);
+	return pa;
 }
 
 /*
@@ -281,19 +353,20 @@ void __init lmb_enforce_memory_limit(void)
 {
 	extern unsigned long memory_limit;
 	unsigned long i, limit;
+	struct lmb_region *mem = &(lmb.memory);
 
 	if (! memory_limit)
 		return;
 
 	limit = memory_limit;
-	for (i = 0; i < lmb.memory.cnt; i++) {
-		if (limit > lmb.memory.region[i].size) {
-			limit -= lmb.memory.region[i].size;
+	for (i = 0; i < mem->cnt; i++) {
+		if (limit > mem->region[i].size) {
+			limit -= mem->region[i].size;
 			continue;
 		}
 
-		lmb.memory.region[i].size = limit;
-		lmb.memory.cnt = i + 1;
+		mem->region[i].size = limit;
+		mem->cnt = i + 1;
 		break;
 	}
 }
diff --git a/trunk/arch/ppc64/kernel/lparcfg.c b/trunk/arch/ppc64/kernel/lparcfg.c
index edad361a8db0..02e96627fa66 100644
--- a/trunk/arch/ppc64/kernel/lparcfg.c
+++ b/trunk/arch/ppc64/kernel/lparcfg.c
@@ -29,7 +29,7 @@
 #include <asm/iSeries/HvLpConfig.h>
 #include <asm/lppaca.h>
 #include <asm/hvcall.h>
-#include <asm/firmware.h>
+#include <asm/cputable.h>
 #include <asm/rtas.h>
 #include <asm/system.h>
 #include <asm/time.h>
@@ -273,7 +273,6 @@ static void parse_system_parameter_string(struct seq_file *m)
 		if (!workbuffer) {
 			printk(KERN_ERR "%s %s kmalloc failure at line %d \n",
 			       __FILE__, __FUNCTION__, __LINE__);
-			kfree(local_buffer);			
 			return;
 		}
 #ifdef LPARCFG_DEBUG
@@ -378,7 +377,7 @@ static int lparcfg_data(struct seq_file *m, void *v)
 
 	partition_active_processors = lparcfg_count_active_processors();
 
-	if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
+	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR) {
 		unsigned long h_entitled, h_unallocated;
 		unsigned long h_aggregation, h_resource;
 		unsigned long pool_idle_time, pool_procs;
@@ -572,7 +571,7 @@ int __init lparcfg_init(void)
 	mode_t mode = S_IRUSR;
 
 	/* Allow writing if we have FW_FEATURE_SPLPAR */
-	if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
+	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR) {
 		lparcfg_fops.write = lparcfg_write;
 		mode |= S_IWUSR;
 	}
diff --git a/trunk/arch/ppc64/kernel/misc.S b/trunk/arch/ppc64/kernel/misc.S
index 474df0a862bf..a05b50b738e9 100644
--- a/trunk/arch/ppc64/kernel/misc.S
+++ b/trunk/arch/ppc64/kernel/misc.S
@@ -680,104 +680,6 @@ _GLOBAL(kernel_thread)
 	ld	r30,-16(r1)
 	blr
 
-/*
- * disable_kernel_fp()
- * Disable the FPU.
- */
-_GLOBAL(disable_kernel_fp)
-	mfmsr	r3
-	rldicl	r0,r3,(63-MSR_FP_LG),1
-	rldicl	r3,r0,(MSR_FP_LG+1),0
-	mtmsrd	r3			/* disable use of fpu now */
-	isync
-	blr
-
-/*
- * giveup_fpu(tsk)
- * Disable FP for the task given as the argument,
- * and save the floating-point registers in its thread_struct.
- * Enables the FPU for use in the kernel on return.
- */
-_GLOBAL(giveup_fpu)
-	mfmsr	r5
-	ori	r5,r5,MSR_FP
-	mtmsrd	r5			/* enable use of fpu now */
-	isync
-	cmpdi	0,r3,0
-	beqlr-				/* if no previous owner, done */
-	addi	r3,r3,THREAD		/* want THREAD of task */
-	ld	r5,PT_REGS(r3)
-	cmpdi	0,r5,0
-	SAVE_32FPRS(0, r3)
-	mffs	fr0
-	stfd	fr0,THREAD_FPSCR(r3)
-	beq	1f
-	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-	li	r3,MSR_FP|MSR_FE0|MSR_FE1
-	andc	r4,r4,r3		/* disable FP for previous task */
-	std	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-1:
-#ifndef CONFIG_SMP
-	li	r5,0
-	ld	r4,last_task_used_math@got(r2)
-	std	r5,0(r4)
-#endif /* CONFIG_SMP */
-	blr
-
-#ifdef CONFIG_ALTIVEC
-
-#if 0 /* this has no callers for now */
-/*
- * disable_kernel_altivec()
- * Disable the VMX.
- */
-_GLOBAL(disable_kernel_altivec)
-	mfmsr	r3
-	rldicl	r0,r3,(63-MSR_VEC_LG),1
-	rldicl	r3,r0,(MSR_VEC_LG+1),0
-	mtmsrd	r3			/* disable use of VMX now */
-	isync
-	blr
-#endif /* 0 */
-
-/*
- * giveup_altivec(tsk)
- * Disable VMX for the task given as the argument,
- * and save the vector registers in its thread_struct.
- * Enables the VMX for use in the kernel on return.
- */
-_GLOBAL(giveup_altivec)
-	mfmsr	r5
-	oris	r5,r5,MSR_VEC@h
-	mtmsrd	r5			/* enable use of VMX now */
-	isync
-	cmpdi	0,r3,0
-	beqlr-				/* if no previous owner, done */
-	addi	r3,r3,THREAD		/* want THREAD of task */
-	ld	r5,PT_REGS(r3)
-	cmpdi	0,r5,0
-	SAVE_32VRS(0,r4,r3)
-	mfvscr	vr0
-	li	r4,THREAD_VSCR
-	stvx	vr0,r4,r3
-	beq	1f
-	ld	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-	lis	r3,MSR_VEC@h
-	andc	r4,r4,r3		/* disable FP for previous task */
-	std	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-1:
-#ifndef CONFIG_SMP
-	li	r5,0
-	ld	r4,last_task_used_altivec@got(r2)
-	std	r5,0(r4)
-#endif /* CONFIG_SMP */
-	blr
-
-#endif /* CONFIG_ALTIVEC */
-
-_GLOBAL(__setup_cpu_power3)
-	blr
-
 /* kexec_wait(phys_cpu)
  *
  * wait for the flag to change, indicating this kernel is going away but
diff --git a/trunk/arch/ppc64/kernel/of_device.c b/trunk/arch/ppc64/kernel/of_device.c
index da580812ddfe..b80e81984ba8 100644
--- a/trunk/arch/ppc64/kernel/of_device.c
+++ b/trunk/arch/ppc64/kernel/of_device.c
@@ -236,6 +236,7 @@ void of_device_unregister(struct of_device *ofdev)
 struct of_device* of_platform_device_create(struct device_node *np, const char *bus_id)
 {
 	struct of_device *dev;
+	u32 *reg;
 
 	dev = kmalloc(sizeof(*dev), GFP_KERNEL);
 	if (!dev)
@@ -249,6 +250,7 @@ struct of_device* of_platform_device_create(struct device_node *np, const char *
 	dev->dev.bus = &of_platform_bus_type;
 	dev->dev.release = of_release_dev;
 
+	reg = (u32 *)get_property(np, "reg", NULL);
 	strlcpy(dev->dev.bus_id, bus_id, BUS_ID_SIZE);
 
 	if (of_device_register(dev) != 0) {
diff --git a/trunk/arch/ppc64/kernel/pSeries_iommu.c b/trunk/arch/ppc64/kernel/pSeries_iommu.c
index 9d5e1e7fc389..69130522a87e 100644
--- a/trunk/arch/ppc64/kernel/pSeries_iommu.c
+++ b/trunk/arch/ppc64/kernel/pSeries_iommu.c
@@ -45,7 +45,6 @@
 #include <asm/plpar_wrappers.h>
 #include <asm/pSeries_reconfig.h>
 #include <asm/systemcfg.h>
-#include <asm/firmware.h>
 #include "pci.h"
 
 #define DBG(fmt...)
@@ -547,7 +546,7 @@ void iommu_init_early_pSeries(void)
 	}
 
 	if (systemcfg->platform & PLATFORM_LPAR) {
-		if (firmware_has_feature(FW_FEATURE_MULTITCE)) {
+		if (cur_cpu_spec->firmware_features & FW_FEATURE_MULTITCE) {
 			ppc_md.tce_build = tce_buildmulti_pSeriesLP;
 			ppc_md.tce_free	 = tce_freemulti_pSeriesLP;
 		} else {
diff --git a/trunk/arch/ppc64/kernel/pSeries_lpar.c b/trunk/arch/ppc64/kernel/pSeries_lpar.c
index 0a3ddc9227c5..74dd144dcce8 100644
--- a/trunk/arch/ppc64/kernel/pSeries_lpar.c
+++ b/trunk/arch/ppc64/kernel/pSeries_lpar.c
@@ -52,6 +52,7 @@ EXPORT_SYMBOL(plpar_hcall_4out);
 EXPORT_SYMBOL(plpar_hcall_norets);
 EXPORT_SYMBOL(plpar_hcall_8arg_2ret);
 
+extern void fw_feature_init(void);
 extern void pSeries_find_serial_port(void);
 
 
@@ -278,6 +279,7 @@ long pSeries_lpar_hpte_insert(unsigned long hpte_group,
 			      unsigned long va, unsigned long prpn,
 			      unsigned long vflags, unsigned long rflags)
 {
+	unsigned long arpn = physRpn_to_absRpn(prpn);
 	unsigned long lpar_rc;
 	unsigned long flags;
 	unsigned long slot;
@@ -288,7 +290,7 @@ long pSeries_lpar_hpte_insert(unsigned long hpte_group,
 	if (vflags & HPTE_V_LARGE)
 		hpte_v &= ~(1UL << HPTE_V_AVPN_SHIFT);
 
-	hpte_r = (prpn << HPTE_R_RPN_SHIFT) | rflags;
+	hpte_r = (arpn << HPTE_R_RPN_SHIFT) | rflags;
 
 	/* Now fill in the actual HPTE */
 	/* Set CEC cookie to 0         */
diff --git a/trunk/arch/ppc64/kernel/pSeries_setup.c b/trunk/arch/ppc64/kernel/pSeries_setup.c
index f0f0630cf07c..5bec956e44a0 100644
--- a/trunk/arch/ppc64/kernel/pSeries_setup.c
+++ b/trunk/arch/ppc64/kernel/pSeries_setup.c
@@ -60,8 +60,7 @@
 #include <asm/nvram.h>
 #include <asm/plpar_wrappers.h>
 #include <asm/xics.h>
-#include <asm/firmware.h>
-#include <asm/pmc.h>
+#include <asm/cputable.h>
 
 #include "i8259.h"
 #include "mpic.h"
@@ -188,21 +187,6 @@ static void __init pSeries_setup_mpic(void)
 				  " MPIC     ");
 }
 
-static void pseries_lpar_enable_pmcs(void)
-{
-	unsigned long set, reset;
-
-	power4_enable_pmcs();
-
-	set = 1UL << 63;
-	reset = 0;
-	plpar_hcall_norets(H_PERFMON, set, reset);
-
-	/* instruct hypervisor to maintain PMCs */
-	if (firmware_has_feature(FW_FEATURE_SPLPAR))
-		get_paca()->lppaca.pmcregs_in_use = 1;
-}
-
 static void __init pSeries_setup_arch(void)
 {
 	/* Fixup ppc_md depending on the type of interrupt controller */
@@ -247,9 +231,11 @@ static void __init pSeries_setup_arch(void)
 
 	pSeries_nvram_init();
 
-	/* Choose an idle loop */
-	if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
+	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR)
 		vpa_init(boot_cpuid);
+
+	/* Choose an idle loop */
+	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR) {
 		if (get_paca()->lppaca.shared_proc) {
 			printk(KERN_INFO "Using shared processor idle loop\n");
 			ppc_md.idle_loop = pseries_shared_idle;
@@ -261,11 +247,6 @@ static void __init pSeries_setup_arch(void)
 		printk(KERN_INFO "Using default idle loop\n");
 		ppc_md.idle_loop = default_idle;
 	}
-
-	if (systemcfg->platform & PLATFORM_LPAR)
-		ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;
-	else
-		ppc_md.enable_pmcs = power4_enable_pmcs;
 }
 
 static int __init pSeries_init_panel(void)
@@ -279,11 +260,11 @@ static int __init pSeries_init_panel(void)
 arch_initcall(pSeries_init_panel);
 
 
-/* Build up the ppc64_firmware_features bitmask field
+/* Build up the firmware_features bitmask field
  * using contents of device-tree/ibm,hypertas-functions.
  * Ultimately this functionality may be moved into prom.c prom_init().
  */
-static void __init fw_feature_init(void)
+void __init fw_feature_init(void)
 {
 	struct device_node * dn;
 	char * hypertas;
@@ -291,7 +272,7 @@ static void __init fw_feature_init(void)
 
 	DBG(" -> fw_feature_init()\n");
 
-	ppc64_firmware_features = 0;
+	cur_cpu_spec->firmware_features = 0;
 	dn = of_find_node_by_path("/rtas");
 	if (dn == NULL) {
 		printk(KERN_ERR "WARNING ! Cannot find RTAS in device-tree !\n");
@@ -307,7 +288,7 @@ static void __init fw_feature_init(void)
 				if ((firmware_features_table[i].name) &&
 				    (strcmp(firmware_features_table[i].name,hypertas))==0) {
 					/* we have a match */
-					ppc64_firmware_features |= 
+					cur_cpu_spec->firmware_features |= 
 						(firmware_features_table[i].val);
 					break;
 				} 
@@ -321,7 +302,7 @@ static void __init fw_feature_init(void)
 	of_node_put(dn);
  no_rtas:
 	printk(KERN_INFO "firmware_features = 0x%lx\n", 
-	       ppc64_firmware_features);
+	       cur_cpu_spec->firmware_features);
 
 	DBG(" <- fw_feature_init()\n");
 }
diff --git a/trunk/arch/ppc64/kernel/pSeries_smp.c b/trunk/arch/ppc64/kernel/pSeries_smp.c
index 79c7f3223665..62c55a123560 100644
--- a/trunk/arch/ppc64/kernel/pSeries_smp.c
+++ b/trunk/arch/ppc64/kernel/pSeries_smp.c
@@ -41,7 +41,6 @@
 #include <asm/machdep.h>
 #include <asm/xics.h>
 #include <asm/cputable.h>
-#include <asm/firmware.h>
 #include <asm/system.h>
 #include <asm/rtas.h>
 #include <asm/plpar_wrappers.h>
@@ -327,7 +326,7 @@ static void __devinit smp_xics_setup_cpu(int cpu)
 	if (cpu != boot_cpuid)
 		xics_setup_cpu();
 
-	if (firmware_has_feature(FW_FEATURE_SPLPAR))
+	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR)
 		vpa_init(cpu);
 
 	cpu_clear(cpu, of_spin_map);
diff --git a/trunk/arch/ppc64/kernel/pSeries_vio.c b/trunk/arch/ppc64/kernel/pSeries_vio.c
deleted file mode 100644
index e0ae06f58f86..000000000000
--- a/trunk/arch/ppc64/kernel/pSeries_vio.c
+++ /dev/null
@@ -1,273 +0,0 @@
-/*
- * IBM PowerPC pSeries Virtual I/O Infrastructure Support.
- *
- *    Copyright (c) 2003-2005 IBM Corp.
- *     Dave Engebretsen engebret@us.ibm.com
- *     Santiago Leon santil@us.ibm.com
- *     Hollis Blanchard <hollisb@us.ibm.com>
- *     Stephen Rothwell
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/mm.h>
-#include <linux/kobject.h>
-#include <asm/iommu.h>
-#include <asm/dma.h>
-#include <asm/prom.h>
-#include <asm/vio.h>
-#include <asm/hvcall.h>
-
-extern struct subsystem devices_subsys; /* needed for vio_find_name() */
-
-static void probe_bus_pseries(void)
-{
-	struct device_node *node_vroot, *of_node;
-
-	node_vroot = find_devices("vdevice");
-	if ((node_vroot == NULL) || (node_vroot->child == NULL))
-		/* this machine doesn't do virtual IO, and that's ok */
-		return;
-
-	/*
-	 * Create struct vio_devices for each virtual device in the device tree.
-	 * Drivers will associate with them later.
-	 */
-	for (of_node = node_vroot->child; of_node != NULL;
-			of_node = of_node->sibling) {
-		printk(KERN_DEBUG "%s: processing %p\n", __FUNCTION__, of_node);
-		vio_register_device_node(of_node);
-	}
-}
-
-/**
- * vio_match_device_pseries: - Tell if a pSeries VIO device matches a
- *	vio_device_id
- */
-static int vio_match_device_pseries(const struct vio_device_id *id,
-		const struct vio_dev *dev)
-{
-	return (strncmp(dev->type, id->type, strlen(id->type)) == 0) &&
-			device_is_compatible(dev->dev.platform_data, id->compat);
-}
-
-static void vio_release_device_pseries(struct device *dev)
-{
-	/* XXX free TCE table */
-	of_node_put(dev->platform_data);
-}
-
-static ssize_t viodev_show_devspec(struct device *dev,
-		struct device_attribute *attr, char *buf)
-{
-	struct device_node *of_node = dev->platform_data;
-
-	return sprintf(buf, "%s\n", of_node->full_name);
-}
-DEVICE_ATTR(devspec, S_IRUSR | S_IRGRP | S_IROTH, viodev_show_devspec, NULL);
-
-static void vio_unregister_device_pseries(struct vio_dev *viodev)
-{
-	device_remove_file(&viodev->dev, &dev_attr_devspec);
-}
-
-static struct vio_bus_ops vio_bus_ops_pseries = {
-	.match = vio_match_device_pseries,
-	.unregister_device = vio_unregister_device_pseries,
-	.release_device = vio_release_device_pseries,
-};
-
-/**
- * vio_bus_init_pseries: - Initialize the pSeries virtual IO bus
- */
-static int __init vio_bus_init_pseries(void)
-{
-	int err;
-
-	err = vio_bus_init(&vio_bus_ops_pseries);
-	if (err == 0)
-		probe_bus_pseries();
-	return err;
-}
-
-__initcall(vio_bus_init_pseries);
-
-/**
- * vio_build_iommu_table: - gets the dma information from OF and
- *	builds the TCE tree.
- * @dev: the virtual device.
- *
- * Returns a pointer to the built tce tree, or NULL if it can't
- * find property.
-*/
-static struct iommu_table *vio_build_iommu_table(struct vio_dev *dev)
-{
-	unsigned int *dma_window;
-	struct iommu_table *newTceTable;
-	unsigned long offset;
-	int dma_window_property_size;
-
-	dma_window = (unsigned int *) get_property(dev->dev.platform_data, "ibm,my-dma-window", &dma_window_property_size);
-	if(!dma_window) {
-		return NULL;
-	}
-
-	newTceTable = (struct iommu_table *) kmalloc(sizeof(struct iommu_table), GFP_KERNEL);
-
-	/*  There should be some code to extract the phys-encoded offset
-		using prom_n_addr_cells(). However, according to a comment
-		on earlier versions, it's always zero, so we don't bother */
-	offset = dma_window[1] >>  PAGE_SHIFT;
-
-	/* TCE table size - measured in tce entries */
-	newTceTable->it_size		= dma_window[4] >> PAGE_SHIFT;
-	/* offset for VIO should always be 0 */
-	newTceTable->it_offset		= offset;
-	newTceTable->it_busno		= 0;
-	newTceTable->it_index		= (unsigned long)dma_window[0];
-	newTceTable->it_type		= TCE_VB;
-
-	return iommu_init_table(newTceTable);
-}
-
-/**
- * vio_register_device_node: - Register a new vio device.
- * @of_node:	The OF node for this device.
- *
- * Creates and initializes a vio_dev structure from the data in
- * of_node (dev.platform_data) and adds it to the list of virtual devices.
- * Returns a pointer to the created vio_dev or NULL if node has
- * NULL device_type or compatible fields.
- */
-struct vio_dev * __devinit vio_register_device_node(struct device_node *of_node)
-{
-	struct vio_dev *viodev;
-	unsigned int *unit_address;
-	unsigned int *irq_p;
-
-	/* we need the 'device_type' property, in order to match with drivers */
-	if ((NULL == of_node->type)) {
-		printk(KERN_WARNING
-			"%s: node %s missing 'device_type'\n", __FUNCTION__,
-			of_node->name ? of_node->name : "<unknown>");
-		return NULL;
-	}
-
-	unit_address = (unsigned int *)get_property(of_node, "reg", NULL);
-	if (!unit_address) {
-		printk(KERN_WARNING "%s: node %s missing 'reg'\n", __FUNCTION__,
-			of_node->name ? of_node->name : "<unknown>");
-		return NULL;
-	}
-
-	/* allocate a vio_dev for this node */
-	viodev = kmalloc(sizeof(struct vio_dev), GFP_KERNEL);
-	if (!viodev) {
-		return NULL;
-	}
-	memset(viodev, 0, sizeof(struct vio_dev));
-
-	viodev->dev.platform_data = of_node_get(of_node);
-
-	viodev->irq = NO_IRQ;
-	irq_p = (unsigned int *)get_property(of_node, "interrupts", NULL);
-	if (irq_p) {
-		int virq = virt_irq_create_mapping(*irq_p);
-		if (virq == NO_IRQ) {
-			printk(KERN_ERR "Unable to allocate interrupt "
-			       "number for %s\n", of_node->full_name);
-		} else
-			viodev->irq = irq_offset_up(virq);
-	}
-
-	snprintf(viodev->dev.bus_id, BUS_ID_SIZE, "%x", *unit_address);
-	viodev->name = of_node->name;
-	viodev->type = of_node->type;
-	viodev->unit_address = *unit_address;
-	viodev->iommu_table = vio_build_iommu_table(viodev);
-
-	/* register with generic device framework */
-	if (vio_register_device(viodev) == NULL) {
-		/* XXX free TCE table */
-		kfree(viodev);
-		return NULL;
-	}
-	device_create_file(&viodev->dev, &dev_attr_devspec);
-
-	return viodev;
-}
-EXPORT_SYMBOL(vio_register_device_node);
-
-/**
- * vio_get_attribute: - get attribute for virtual device
- * @vdev:	The vio device to get property.
- * @which:	The property/attribute to be extracted.
- * @length:	Pointer to length of returned data size (unused if NULL).
- *
- * Calls prom.c's get_property() to return the value of the
- * attribute specified by the preprocessor constant @which
-*/
-const void * vio_get_attribute(struct vio_dev *vdev, void* which, int* length)
-{
-	return get_property(vdev->dev.platform_data, (char*)which, length);
-}
-EXPORT_SYMBOL(vio_get_attribute);
-
-/* vio_find_name() - internal because only vio.c knows how we formatted the
- * kobject name
- * XXX once vio_bus_type.devices is actually used as a kset in
- * drivers/base/bus.c, this function should be removed in favor of
- * "device_find(kobj_name, &vio_bus_type)"
- */
-static struct vio_dev *vio_find_name(const char *kobj_name)
-{
-	struct kobject *found;
-
-	found = kset_find_obj(&devices_subsys.kset, kobj_name);
-	if (!found)
-		return NULL;
-
-	return to_vio_dev(container_of(found, struct device, kobj));
-}
-
-/**
- * vio_find_node - find an already-registered vio_dev
- * @vnode: device_node of the virtual device we're looking for
- */
-struct vio_dev *vio_find_node(struct device_node *vnode)
-{
-	uint32_t *unit_address;
-	char kobj_name[BUS_ID_SIZE];
-
-	/* construct the kobject name from the device node */
-	unit_address = (uint32_t *)get_property(vnode, "reg", NULL);
-	if (!unit_address)
-		return NULL;
-	snprintf(kobj_name, BUS_ID_SIZE, "%x", *unit_address);
-
-	return vio_find_name(kobj_name);
-}
-EXPORT_SYMBOL(vio_find_node);
-
-int vio_enable_interrupts(struct vio_dev *dev)
-{
-	int rc = h_vio_signal(dev->unit_address, VIO_IRQ_ENABLE);
-	if (rc != H_Success)
-		printk(KERN_ERR "vio: Error 0x%x enabling interrupts\n", rc);
-	return rc;
-}
-EXPORT_SYMBOL(vio_enable_interrupts);
-
-int vio_disable_interrupts(struct vio_dev *dev)
-{
-	int rc = h_vio_signal(dev->unit_address, VIO_IRQ_DISABLE);
-	if (rc != H_Success)
-		printk(KERN_ERR "vio: Error 0x%x disabling interrupts\n", rc);
-	return rc;
-}
-EXPORT_SYMBOL(vio_disable_interrupts);
diff --git a/trunk/arch/ppc64/kernel/pacaData.c b/trunk/arch/ppc64/kernel/pacaData.c
index 6182a2cd90a5..6316188737b6 100644
--- a/trunk/arch/ppc64/kernel/pacaData.c
+++ b/trunk/arch/ppc64/kernel/pacaData.c
@@ -78,7 +78,7 @@ extern unsigned long __toc_start;
 
 #define BOOTCPU_PACA_INIT(number)					    \
 {									    \
-	PACA_INIT_COMMON(number, 1, 0, (u64)&initial_stab)		    \
+	PACA_INIT_COMMON(number, 1, 0, STAB0_VIRT_ADDR)			    \
 	PACA_INIT_ISERIES(number)					    \
 }
 
@@ -90,7 +90,7 @@ extern unsigned long __toc_start;
 
 #define BOOTCPU_PACA_INIT(number)					    \
 {									    \
-	PACA_INIT_COMMON(number, 1, STAB0_PHYS_ADDR, (u64)&initial_stab)    \
+	PACA_INIT_COMMON(number, 1, STAB0_PHYS_ADDR, STAB0_VIRT_ADDR)	    \
 }
 #endif
 
diff --git a/trunk/arch/ppc64/kernel/pmac_setup.c b/trunk/arch/ppc64/kernel/pmac_setup.c
index 8ff86a766cdf..e40877fa67cd 100644
--- a/trunk/arch/ppc64/kernel/pmac_setup.c
+++ b/trunk/arch/ppc64/kernel/pmac_setup.c
@@ -71,7 +71,6 @@
 #include <asm/of_device.h>
 #include <asm/lmb.h>
 #include <asm/smu.h>
-#include <asm/pmc.h>
 
 #include "pmac.h"
 #include "mpic.h"
@@ -512,5 +511,4 @@ struct machdep_calls __initdata pmac_md = {
 	.progress		= pmac_progress,
 	.check_legacy_ioport	= pmac_check_legacy_ioport,
 	.idle_loop		= native_idle,
-	.enable_pmcs		= power4_enable_pmcs,
 };
diff --git a/trunk/arch/ppc64/kernel/pmc.c b/trunk/arch/ppc64/kernel/pmc.c
index cdfec7438d01..67be773f9c00 100644
--- a/trunk/arch/ppc64/kernel/pmc.c
+++ b/trunk/arch/ppc64/kernel/pmc.c
@@ -65,24 +65,3 @@ void release_pmc_hardware(void)
 	spin_unlock(&pmc_owner_lock);
 }
 EXPORT_SYMBOL_GPL(release_pmc_hardware);
-
-void power4_enable_pmcs(void)
-{
-	unsigned long hid0;
-
-	hid0 = mfspr(HID0);
-	hid0 |= 1UL << (63 - 20);
-
-	/* POWER4 requires the following sequence */
-	asm volatile(
-		"sync\n"
-		"mtspr     %1, %0\n"
-		"mfspr     %0, %1\n"
-		"mfspr     %0, %1\n"
-		"mfspr     %0, %1\n"
-		"mfspr     %0, %1\n"
-		"mfspr     %0, %1\n"
-		"mfspr     %0, %1\n"
-		"isync" : "=&r" (hid0) : "i" (HID0), "0" (hid0):
-		"memory");
-}
diff --git a/trunk/arch/ppc64/kernel/process.c b/trunk/arch/ppc64/kernel/process.c
index 7a7e027653ad..f7cae05e40fb 100644
--- a/trunk/arch/ppc64/kernel/process.c
+++ b/trunk/arch/ppc64/kernel/process.c
@@ -50,7 +50,6 @@
 #include <asm/machdep.h>
 #include <asm/iSeries/HvCallHpt.h>
 #include <asm/cputable.h>
-#include <asm/firmware.h>
 #include <asm/sections.h>
 #include <asm/tlbflush.h>
 #include <asm/time.h>
@@ -203,10 +202,11 @@ struct task_struct *__switch_to(struct task_struct *prev,
 	new_thread = &new->thread;
 	old_thread = &current->thread;
 
-	/* Collect purr utilization data per process and per processor
-	 * wise purr is nothing but processor time base
-	 */
-	if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
+/* Collect purr utilization data per process and per processor wise */
+/* purr is nothing but processor time base                          */
+
+#if defined(CONFIG_PPC_PSERIES)
+	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR) {
 		struct cpu_usage *cu = &__get_cpu_var(cpu_usage_array);
 		long unsigned start_tb, current_tb;
 		start_tb = old_thread->start_tb;
@@ -214,6 +214,8 @@ struct task_struct *__switch_to(struct task_struct *prev,
 		old_thread->accum_tb += (current_tb - start_tb);
 		new_thread->start_tb = current_tb;
 	}
+#endif
+
 
 	local_irq_save(flags);
 	last = _switch(old_thread, new_thread);
diff --git a/trunk/arch/ppc64/kernel/prom.c b/trunk/arch/ppc64/kernel/prom.c
index b21848826791..5aca01ddd81f 100644
--- a/trunk/arch/ppc64/kernel/prom.c
+++ b/trunk/arch/ppc64/kernel/prom.c
@@ -625,8 +625,8 @@ void __init finish_device_tree(void)
 
 static inline char *find_flat_dt_string(u32 offset)
 {
-	return ((char *)initial_boot_params) +
-		initial_boot_params->off_dt_strings + offset;
+	return ((char *)initial_boot_params) + initial_boot_params->off_dt_strings
+		+ offset;
 }
 
 /**
@@ -635,33 +635,26 @@ static inline char *find_flat_dt_string(u32 offset)
  * unflatten the tree
  */
 static int __init scan_flat_dt(int (*it)(unsigned long node,
-					 const char *uname, int depth,
-					 void *data),
+					 const char *full_path, void *data),
 			       void *data)
 {
 	unsigned long p = ((unsigned long)initial_boot_params) +
 		initial_boot_params->off_dt_struct;
 	int rc = 0;
-	int depth = -1;
 
 	do {
 		u32 tag = *((u32 *)p);
 		char *pathp;
 		
 		p += 4;
-		if (tag == OF_DT_END_NODE) {
-			depth --;
-			continue;
-		}
-		if (tag == OF_DT_NOP)
+		if (tag == OF_DT_END_NODE)
 			continue;
 		if (tag == OF_DT_END)
 			break;
 		if (tag == OF_DT_PROP) {
 			u32 sz = *((u32 *)p);
 			p += 8;
-			if (initial_boot_params->version < 0x10)
-				p = _ALIGN(p, sz >= 8 ? 8 : 4);
+			p = _ALIGN(p, sz >= 8 ? 8 : 4);
 			p += sz;
 			p = _ALIGN(p, 4);
 			continue;
@@ -671,18 +664,9 @@ static int __init scan_flat_dt(int (*it)(unsigned long node,
 			       " device tree !\n", tag);
 			return -EINVAL;
 		}
-		depth++;
 		pathp = (char *)p;
 		p = _ALIGN(p + strlen(pathp) + 1, 4);
-		if ((*pathp) == '/') {
-			char *lp, *np;
-			for (lp = NULL, np = pathp; *np; np++)
-				if ((*np) == '/')
-					lp = np+1;
-			if (lp != NULL)
-				pathp = lp;
-		}
-		rc = it(p, pathp, depth, data);
+		rc = it(p, pathp, data);
 		if (rc != 0)
 			break;		
 	} while(1);
@@ -705,21 +689,17 @@ static void* __init get_flat_dt_prop(unsigned long node, const char *name,
 		const char *nstr;
 
 		p += 4;
-		if (tag == OF_DT_NOP)
-			continue;
 		if (tag != OF_DT_PROP)
 			return NULL;
 
 		sz = *((u32 *)p);
 		noff = *((u32 *)(p + 4));
 		p += 8;
-		if (initial_boot_params->version < 0x10)
-			p = _ALIGN(p, sz >= 8 ? 8 : 4);
+		p = _ALIGN(p, sz >= 8 ? 8 : 4);
 
 		nstr = find_flat_dt_string(noff);
 		if (nstr == NULL) {
-			printk(KERN_WARNING "Can't find property index"
-			       " name !\n");
+			printk(KERN_WARNING "Can't find property index name !\n");
 			return NULL;
 		}
 		if (strcmp(name, nstr) == 0) {
@@ -733,7 +713,7 @@ static void* __init get_flat_dt_prop(unsigned long node, const char *name,
 }
 
 static void *__init unflatten_dt_alloc(unsigned long *mem, unsigned long size,
-				       unsigned long align)
+					       unsigned long align)
 {
 	void *res;
 
@@ -747,16 +727,13 @@ static void *__init unflatten_dt_alloc(unsigned long *mem, unsigned long size,
 static unsigned long __init unflatten_dt_node(unsigned long mem,
 					      unsigned long *p,
 					      struct device_node *dad,
-					      struct device_node ***allnextpp,
-					      unsigned long fpsize)
+					      struct device_node ***allnextpp)
 {
 	struct device_node *np;
 	struct property *pp, **prev_pp = NULL;
 	char *pathp;
 	u32 tag;
-	unsigned int l, allocl;
-	int has_name = 0;
-	int new_format = 0;
+	unsigned int l;
 
 	tag = *((u32 *)(*p));
 	if (tag != OF_DT_BEGIN_NODE) {
@@ -765,62 +742,21 @@ static unsigned long __init unflatten_dt_node(unsigned long mem,
 	}
 	*p += 4;
 	pathp = (char *)*p;
-	l = allocl = strlen(pathp) + 1;
+	l = strlen(pathp) + 1;
 	*p = _ALIGN(*p + l, 4);
 
-	/* version 0x10 has a more compact unit name here instead of the full
-	 * path. we accumulate the full path size using "fpsize", we'll rebuild
-	 * it later. We detect this because the first character of the name is
-	 * not '/'.
-	 */
-	if ((*pathp) != '/') {
-		new_format = 1;
-		if (fpsize == 0) {
-			/* root node: special case. fpsize accounts for path
-			 * plus terminating zero. root node only has '/', so
-			 * fpsize should be 2, but we want to avoid the first
-			 * level nodes to have two '/' so we use fpsize 1 here
-			 */
-			fpsize = 1;
-			allocl = 2;
-		} else {
-			/* account for '/' and path size minus terminal 0
-			 * already in 'l'
-			 */
-			fpsize += l;
-			allocl = fpsize;
-		}
-	}
-
-
-	np = unflatten_dt_alloc(&mem, sizeof(struct device_node) + allocl,
+	np = unflatten_dt_alloc(&mem, sizeof(struct device_node) + l,
 				__alignof__(struct device_node));
 	if (allnextpp) {
 		memset(np, 0, sizeof(*np));
 		np->full_name = ((char*)np) + sizeof(struct device_node);
-		if (new_format) {
-			char *p = np->full_name;
-			/* rebuild full path for new format */
-			if (dad && dad->parent) {
-				strcpy(p, dad->full_name);
-#ifdef DEBUG
-				if ((strlen(p) + l + 1) != allocl) {
-					DBG("%s: p: %d, l: %d, a: %d\n",
-					    pathp, strlen(p), l, allocl);
-				}
-#endif
-				p += strlen(p);
-			}
-			*(p++) = '/';
-			memcpy(p, pathp, l);
-		} else
-			memcpy(np->full_name, pathp, l);
+		memcpy(np->full_name, pathp, l);
 		prev_pp = &np->properties;
 		**allnextpp = np;
 		*allnextpp = &np->allnext;
 		if (dad != NULL) {
 			np->parent = dad;
-			/* we temporarily use the next field as `last_child'*/
+			/* we temporarily use the `next' field as `last_child'. */
 			if (dad->next == 0)
 				dad->child = np;
 			else
@@ -834,26 +770,18 @@ static unsigned long __init unflatten_dt_node(unsigned long mem,
 		char *pname;
 
 		tag = *((u32 *)(*p));
-		if (tag == OF_DT_NOP) {
-			*p += 4;
-			continue;
-		}
 		if (tag != OF_DT_PROP)
 			break;
 		*p += 4;
 		sz = *((u32 *)(*p));
 		noff = *((u32 *)((*p) + 4));
-		*p += 8;
-		if (initial_boot_params->version < 0x10)
-			*p = _ALIGN(*p, sz >= 8 ? 8 : 4);
+		*p = _ALIGN((*p) + 8, sz >= 8 ? 8 : 4);
 
 		pname = find_flat_dt_string(noff);
 		if (pname == NULL) {
 			printk("Can't find property name in list !\n");
 			break;
 		}
-		if (strcmp(pname, "name") == 0)
-			has_name = 1;
 		l = strlen(pname) + 1;
 		pp = unflatten_dt_alloc(&mem, sizeof(struct property),
 					__alignof__(struct property));
@@ -873,36 +801,6 @@ static unsigned long __init unflatten_dt_node(unsigned long mem,
 		}
 		*p = _ALIGN((*p) + sz, 4);
 	}
-	/* with version 0x10 we may not have the name property, recreate
-	 * it here from the unit name if absent
-	 */
-	if (!has_name) {
-		char *p = pathp, *ps = pathp, *pa = NULL;
-		int sz;
-
-		while (*p) {
-			if ((*p) == '@')
-				pa = p;
-			if ((*p) == '/')
-				ps = p + 1;
-			p++;
-		}
-		if (pa < ps)
-			pa = p;
-		sz = (pa - ps) + 1;
-		pp = unflatten_dt_alloc(&mem, sizeof(struct property) + sz,
-					__alignof__(struct property));
-		if (allnextpp) {
-			pp->name = "name";
-			pp->length = sz;
-			pp->value = (unsigned char *)(pp + 1);
-			*prev_pp = pp;
-			prev_pp = &pp->next;
-			memcpy(pp->value, ps, sz - 1);
-			((char *)pp->value)[sz - 1] = 0;
-			DBG("fixed up name for %s -> %s\n", pathp, pp->value);
-		}
-	}
 	if (allnextpp) {
 		*prev_pp = NULL;
 		np->name = get_property(np, "name", NULL);
@@ -914,11 +812,11 @@ static unsigned long __init unflatten_dt_node(unsigned long mem,
 			np->type = "<NULL>";
 	}
 	while (tag == OF_DT_BEGIN_NODE) {
-		mem = unflatten_dt_node(mem, p, np, allnextpp, fpsize);
+		mem = unflatten_dt_node(mem, p, np, allnextpp);
 		tag = *((u32 *)(*p));
 	}
 	if (tag != OF_DT_END_NODE) {
-		printk("Weird tag at end of node: %x\n", tag);
+		printk("Weird tag at start of node: %x\n", tag);
 		return mem;
 	}
 	*p += 4;
@@ -944,32 +842,21 @@ void __init unflatten_device_tree(void)
 	/* First pass, scan for size */
 	start = ((unsigned long)initial_boot_params) +
 		initial_boot_params->off_dt_struct;
-	size = unflatten_dt_node(0, &start, NULL, NULL, 0);
-	size = (size | 3) + 1;
+	size = unflatten_dt_node(0, &start, NULL, NULL);
 
 	DBG("  size is %lx, allocating...\n", size);
 
 	/* Allocate memory for the expanded device tree */
-	mem = lmb_alloc(size + 4, __alignof__(struct device_node));
-	if (!mem) {
-		DBG("Couldn't allocate memory with lmb_alloc()!\n");
-		panic("Couldn't allocate memory with lmb_alloc()!\n");
-	}
-	mem = (unsigned long)abs_to_virt(mem);
-
-	((u32 *)mem)[size / 4] = 0xdeadbeef;
-
+	mem = (unsigned long)abs_to_virt(lmb_alloc(size,
+						   __alignof__(struct device_node)));
 	DBG("  unflattening...\n", mem);
 
 	/* Second pass, do actual unflattening */
 	start = ((unsigned long)initial_boot_params) +
 		initial_boot_params->off_dt_struct;
-	unflatten_dt_node(mem, &start, NULL, &allnextp, 0);
+	unflatten_dt_node(mem, &start, NULL, &allnextp);
 	if (*((u32 *)start) != OF_DT_END)
-		printk(KERN_WARNING "Weird tag at end of tree: %08x\n", *((u32 *)start));
-	if (((u32 *)mem)[size / 4] != 0xdeadbeef)
-		printk(KERN_WARNING "End of tree marker overwritten: %08x\n",
-		       ((u32 *)mem)[size / 4] );
+		printk(KERN_WARNING "Weird tag at end of tree: %x\n", *((u32 *)start));
 	*allnextp = NULL;
 
 	/* Get pointer to OF "/chosen" node for use everywhere */
@@ -993,7 +880,7 @@ void __init unflatten_device_tree(void)
 
 
 static int __init early_init_dt_scan_cpus(unsigned long node,
-					  const char *uname, int depth, void *data)
+					  const char *full_path, void *data)
 {
 	char *type = get_flat_dt_prop(node, "device_type", NULL);
 	u32 *prop;
@@ -1060,15 +947,13 @@ static int __init early_init_dt_scan_cpus(unsigned long node,
 }
 
 static int __init early_init_dt_scan_chosen(unsigned long node,
-					    const char *uname, int depth, void *data)
+					    const char *full_path, void *data)
 {
 	u32 *prop;
 	u64 *prop64;
 	extern unsigned long memory_limit, tce_alloc_start, tce_alloc_end;
 
-	DBG("search \"chosen\", depth: %d, uname: %s\n", depth, uname);
-
-	if (depth != 1 || strcmp(uname, "chosen") != 0)
+	if (strcmp(full_path, "/chosen") != 0)
 		return 0;
 
 	/* get platform type */
@@ -1118,20 +1003,18 @@ static int __init early_init_dt_scan_chosen(unsigned long node,
 }
 
 static int __init early_init_dt_scan_root(unsigned long node,
-					  const char *uname, int depth, void *data)
+					  const char *full_path, void *data)
 {
 	u32 *prop;
 
-	if (depth != 0)
+	if (strcmp(full_path, "/") != 0)
 		return 0;
 
 	prop = (u32 *)get_flat_dt_prop(node, "#size-cells", NULL);
 	dt_root_size_cells = (prop == NULL) ? 1 : *prop;
-	DBG("dt_root_size_cells = %x\n", dt_root_size_cells);
-
+		
 	prop = (u32 *)get_flat_dt_prop(node, "#address-cells", NULL);
 	dt_root_addr_cells = (prop == NULL) ? 2 : *prop;
-	DBG("dt_root_addr_cells = %x\n", dt_root_addr_cells);
 	
 	/* break now */
 	return 1;
@@ -1159,7 +1042,7 @@ static unsigned long __init dt_mem_next_cell(int s, cell_t **cellp)
 
 
 static int __init early_init_dt_scan_memory(unsigned long node,
-					    const char *uname, int depth, void *data)
+					    const char *full_path, void *data)
 {
 	char *type = get_flat_dt_prop(node, "device_type", NULL);
 	cell_t *reg, *endp;
@@ -1175,9 +1058,7 @@ static int __init early_init_dt_scan_memory(unsigned long node,
 
 	endp = reg + (l / sizeof(cell_t));
 
-	DBG("memory scan node %s ..., reg size %ld, data: %x %x %x %x, ...\n",
-	    uname, l, reg[0], reg[1], reg[2], reg[3]);
-
+	DBG("memory scan node %s ...\n", full_path);
 	while ((endp - reg) >= (dt_root_addr_cells + dt_root_size_cells)) {
 		unsigned long base, size;
 
@@ -1588,11 +1469,10 @@ struct device_node *of_find_node_by_path(const char *path)
 	struct device_node *np = allnodes;
 
 	read_lock(&devtree_lock);
-	for (; np != 0; np = np->allnext) {
+	for (; np != 0; np = np->allnext)
 		if (np->full_name != 0 && strcasecmp(np->full_name, path) == 0
 		    && of_node_get(np))
 			break;
-	}
 	read_unlock(&devtree_lock);
 	return np;
 }
diff --git a/trunk/arch/ppc64/kernel/prom_init.c b/trunk/arch/ppc64/kernel/prom_init.c
index 122283a1d39a..dbbe6c79d8da 100644
--- a/trunk/arch/ppc64/kernel/prom_init.c
+++ b/trunk/arch/ppc64/kernel/prom_init.c
@@ -892,10 +892,7 @@ static void __init prom_init_mem(void)
 	if ( RELOC(of_platform) == PLATFORM_PSERIES_LPAR )
 		RELOC(alloc_top) = RELOC(rmo_top);
 	else
-		/* Some RS64 machines have buggy firmware where claims up at 1GB
-		 * fails. Cap at 768MB as a workaround. Still plenty of room.
-		 */
-		RELOC(alloc_top) = RELOC(rmo_top) = min(0x30000000ul, RELOC(ram_top));
+		RELOC(alloc_top) = RELOC(rmo_top) = min(0x40000000ul, RELOC(ram_top));
 
 	prom_printf("memory layout at init:\n");
 	prom_printf("  memory_limit : %x (16 MB aligned)\n", RELOC(prom_memory_limit));
@@ -1537,8 +1534,7 @@ static unsigned long __init dt_find_string(char *str)
  */
 #define MAX_PROPERTY_NAME 64
 
-static void __init scan_dt_build_strings(phandle node,
-					 unsigned long *mem_start,
+static void __init scan_dt_build_strings(phandle node, unsigned long *mem_start,
 					 unsigned long *mem_end)
 {
 	unsigned long offset = reloc_offset();
@@ -1551,21 +1547,16 @@ static void __init scan_dt_build_strings(phandle node,
 	/* get and store all property names */
 	prev_name = RELOC("");
 	for (;;) {
+		int rc;
+
 		/* 64 is max len of name including nul. */
 		namep = make_room(mem_start, mem_end, MAX_PROPERTY_NAME, 1);
-		if (call_prom("nextprop", 3, 1, node, prev_name, namep) != 1) {
+		rc = call_prom("nextprop", 3, 1, node, prev_name, namep);
+		if (rc != 1) {
 			/* No more nodes: unwind alloc */
 			*mem_start = (unsigned long)namep;
 			break;
 		}
-
- 		/* skip "name" */
- 		if (strcmp(namep, RELOC("name")) == 0) {
- 			*mem_start = (unsigned long)namep;
- 			prev_name = RELOC("name");
- 			continue;
- 		}
-		/* get/create string entry */
 		soff = dt_find_string(namep);
 		if (soff != 0) {
 			*mem_start = (unsigned long)namep;
@@ -1580,7 +1571,7 @@ static void __init scan_dt_build_strings(phandle node,
 
 	/* do all our children */
 	child = call_prom("child", 1, 1, node);
-	while (child != 0) {
+	while (child != (phandle)0) {
 		scan_dt_build_strings(child, mem_start, mem_end);
 		child = call_prom("peer", 1, 1, child);
 	}
@@ -1589,13 +1580,16 @@ static void __init scan_dt_build_strings(phandle node,
 static void __init scan_dt_build_struct(phandle node, unsigned long *mem_start,
 					unsigned long *mem_end)
 {
+	int l, align;
 	phandle child;
-	char *namep, *prev_name, *sstart, *p, *ep, *lp, *path;
+	char *namep, *prev_name, *sstart, *p, *ep;
 	unsigned long soff;
 	unsigned char *valp;
 	unsigned long offset = reloc_offset();
-	static char pname[MAX_PROPERTY_NAME];
-	int l;
+	char pname[MAX_PROPERTY_NAME];
+	char *path;
+
+	path = RELOC(prom_scratch);
 
 	dt_push_token(OF_DT_BEGIN_NODE, mem_start, mem_end);
 
@@ -1605,33 +1599,23 @@ static void __init scan_dt_build_struct(phandle node, unsigned long *mem_start,
 		      namep, *mem_end - *mem_start);
 	if (l >= 0) {
 		/* Didn't fit?  Get more room. */
-		if ((l+1) > (*mem_end - *mem_start)) {
+		if (l+1 > *mem_end - *mem_start) {
 			namep = make_room(mem_start, mem_end, l+1, 1);
 			call_prom("package-to-path", 3, 1, node, namep, l);
 		}
 		namep[l] = '\0';
-
 		/* Fixup an Apple bug where they have bogus \0 chars in the
 		 * middle of the path in some properties
 		 */
 		for (p = namep, ep = namep + l; p < ep; p++)
 			if (*p == '\0') {
 				memmove(p, p+1, ep - p);
-				ep--; l--; p--;
+				ep--; l--;
 			}
-
-		/* now try to extract the unit name in that mess */
-		for (p = namep, lp = NULL; *p; p++)
-			if (*p == '/')
-				lp = p + 1;
-		if (lp != NULL)
-			memmove(namep, lp, strlen(lp) + 1);
-		*mem_start = _ALIGN(((unsigned long) namep) +
-				    strlen(namep) + 1, 4);
+		*mem_start = _ALIGN(((unsigned long) namep) + strlen(namep) + 1, 4);
 	}
 
 	/* get it again for debugging */
-	path = RELOC(prom_scratch);
 	memset(path, 0, PROM_SCRATCH_SIZE);
 	call_prom("package-to-path", 3, 1, node, path, PROM_SCRATCH_SIZE-1);
 
@@ -1639,27 +1623,23 @@ static void __init scan_dt_build_struct(phandle node, unsigned long *mem_start,
 	prev_name = RELOC("");
 	sstart = (char *)RELOC(dt_string_start);
 	for (;;) {
-		if (call_prom("nextprop", 3, 1, node, prev_name,
-			      RELOC(pname)) != 1)
-			break;
+		int rc;
 
- 		/* skip "name" */
- 		if (strcmp(RELOC(pname), RELOC("name")) == 0) {
- 			prev_name = RELOC("name");
- 			continue;
- 		}
+		rc = call_prom("nextprop", 3, 1, node, prev_name, pname);
+		if (rc != 1)
+			break;
 
 		/* find string offset */
-		soff = dt_find_string(RELOC(pname));
+		soff = dt_find_string(pname);
 		if (soff == 0) {
-			prom_printf("WARNING: Can't find string index for"
-				    " <%s>, node %s\n", RELOC(pname), path);
+			prom_printf("WARNING: Can't find string index for <%s>, node %s\n",
+				    pname, path);
 			break;
 		}
 		prev_name = sstart + soff;
 
 		/* get length */
-		l = call_prom("getproplen", 2, 1, node, RELOC(pname));
+		l = call_prom("getproplen", 2, 1, node, pname);
 
 		/* sanity checks */
 		if (l == PROM_ERROR)
@@ -1668,7 +1648,7 @@ static void __init scan_dt_build_struct(phandle node, unsigned long *mem_start,
 			prom_printf("WARNING: ignoring large property ");
 			/* It seems OF doesn't null-terminate the path :-( */
 			prom_printf("[%s] ", path);
-			prom_printf("%s length 0x%x\n", RELOC(pname), l);
+			prom_printf("%s length 0x%x\n", pname, l);
 			continue;
 		}
 
@@ -1678,16 +1658,17 @@ static void __init scan_dt_build_struct(phandle node, unsigned long *mem_start,
 		dt_push_token(soff, mem_start, mem_end);
 
 		/* push property content */
-		valp = make_room(mem_start, mem_end, l, 4);
-		call_prom("getprop", 4, 1, node, RELOC(pname), valp, l);
+		align = (l >= 8) ? 8 : 4;
+		valp = make_room(mem_start, mem_end, l, align);
+		call_prom("getprop", 4, 1, node, pname, valp, l);
 		*mem_start = _ALIGN(*mem_start, 4);
 	}
 
 	/* Add a "linux,phandle" property. */
 	soff = dt_find_string(RELOC("linux,phandle"));
 	if (soff == 0)
-		prom_printf("WARNING: Can't find string index for"
-			    " <linux-phandle> node %s\n", path);
+		prom_printf("WARNING: Can't find string index for <linux-phandle>"
+			    " node %s\n", path);
 	else {
 		dt_push_token(OF_DT_PROP, mem_start, mem_end);
 		dt_push_token(4, mem_start, mem_end);
@@ -1698,7 +1679,7 @@ static void __init scan_dt_build_struct(phandle node, unsigned long *mem_start,
 
 	/* do all our children */
 	child = call_prom("child", 1, 1, node);
-	while (child != 0) {
+	while (child != (phandle)0) {
 		scan_dt_build_struct(child, mem_start, mem_end);
 		child = call_prom("peer", 1, 1, child);
 	}
@@ -1737,8 +1718,7 @@ static void __init flatten_device_tree(void)
 
 	/* Build header and make room for mem rsv map */ 
 	mem_start = _ALIGN(mem_start, 4);
-	hdr = make_room(&mem_start, &mem_end,
-			sizeof(struct boot_param_header), 4);
+	hdr = make_room(&mem_start, &mem_end, sizeof(struct boot_param_header), 4);
 	RELOC(dt_header_start) = (unsigned long)hdr;
 	rsvmap = make_room(&mem_start, &mem_end, sizeof(mem_reserve_map), 8);
 
@@ -1751,11 +1731,11 @@ static void __init flatten_device_tree(void)
 	namep = make_room(&mem_start, &mem_end, 16, 1);
 	strcpy(namep, RELOC("linux,phandle"));
 	mem_start = (unsigned long)namep + strlen(namep) + 1;
+	RELOC(dt_string_end) = mem_start;
 
 	/* Build string array */
 	prom_printf("Building dt strings...\n"); 
 	scan_dt_build_strings(root, &mem_start, &mem_end);
-	RELOC(dt_string_end) = mem_start;
 
 	/* Build structure */
 	mem_start = PAGE_ALIGN(mem_start);
@@ -1770,11 +1750,9 @@ static void __init flatten_device_tree(void)
 	hdr->totalsize = RELOC(dt_struct_end) - RELOC(dt_header_start);
 	hdr->off_dt_struct = RELOC(dt_struct_start) - RELOC(dt_header_start);
 	hdr->off_dt_strings = RELOC(dt_string_start) - RELOC(dt_header_start);
-	hdr->dt_strings_size = RELOC(dt_string_end) - RELOC(dt_string_start);
 	hdr->off_mem_rsvmap = ((unsigned long)rsvmap) - RELOC(dt_header_start);
 	hdr->version = OF_DT_VERSION;
-	/* Version 16 is not backward compatible */
-	hdr->last_comp_version = 0x10;
+	hdr->last_comp_version = 1;
 
 	/* Reserve the whole thing and copy the reserve map in, we
 	 * also bump mem_reserve_cnt to cause further reservations to
@@ -1830,9 +1808,6 @@ static void __init fixup_device_tree(void)
 	/* does it need fixup ? */
 	if (prom_getproplen(i2c, "interrupts") > 0)
 		return;
-
-	prom_printf("fixing up bogus interrupts for u3 i2c...\n");
-
 	/* interrupt on this revision of u3 is number 0 and level */
 	interrupts[0] = 0;
 	interrupts[1] = 1;
diff --git a/trunk/arch/ppc64/kernel/rtas_pci.c b/trunk/arch/ppc64/kernel/rtas_pci.c
index 1dccadaddd1d..1048817befb8 100644
--- a/trunk/arch/ppc64/kernel/rtas_pci.c
+++ b/trunk/arch/ppc64/kernel/rtas_pci.c
@@ -58,21 +58,6 @@ static int config_access_valid(struct device_node *dn, int where)
 	return 0;
 }
 
-static int of_device_available(struct device_node * dn)
-{
-        char * status;
-
-        status = get_property(dn, "status", NULL);
-
-        if (!status)
-                return 1;
-
-        if (!strcmp(status, "okay"))
-                return 1;
-
-        return 0;
-}
-
 static int rtas_read_config(struct device_node *dn, int where, int size, u32 *val)
 {
 	int returnval = -1;
@@ -118,7 +103,7 @@ static int rtas_pci_read_config(struct pci_bus *bus,
 
 	/* Search only direct children of the bus */
 	for (dn = busdn->child; dn; dn = dn->sibling)
-		if (dn->devfn == devfn && of_device_available(dn))
+		if (dn->devfn == devfn)
 			return rtas_read_config(dn, where, size, val);
 	return PCIBIOS_DEVICE_NOT_FOUND;
 }
@@ -161,7 +146,7 @@ static int rtas_pci_write_config(struct pci_bus *bus,
 
 	/* Search only direct children of the bus */
 	for (dn = busdn->child; dn; dn = dn->sibling)
-		if (dn->devfn == devfn && of_device_available(dn))
+		if (dn->devfn == devfn)
 			return rtas_write_config(dn, where, size, val);
 	return PCIBIOS_DEVICE_NOT_FOUND;
 }
diff --git a/trunk/arch/ppc64/kernel/setup.c b/trunk/arch/ppc64/kernel/setup.c
index ee3b20de2e7a..e9c24d2dbd91 100644
--- a/trunk/arch/ppc64/kernel/setup.c
+++ b/trunk/arch/ppc64/kernel/setup.c
@@ -536,19 +536,15 @@ static void __init check_for_initrd(void)
 
 	DBG(" -> check_for_initrd()\n");
 
-	if (of_chosen) {
-		prop = (u64 *)get_property(of_chosen,
-				"linux,initrd-start", NULL);
+	prop = (u64 *)get_property(of_chosen, "linux,initrd-start", NULL);
+	if (prop != NULL) {
+		initrd_start = (unsigned long)__va(*prop);
+		prop = (u64 *)get_property(of_chosen, "linux,initrd-end", NULL);
 		if (prop != NULL) {
-			initrd_start = (unsigned long)__va(*prop);
-			prop = (u64 *)get_property(of_chosen,
-					"linux,initrd-end", NULL);
-			if (prop != NULL) {
-				initrd_end = (unsigned long)__va(*prop);
-				initrd_below_start_ok = 1;
-			} else
-				initrd_start = 0;
-		}
+			initrd_end = (unsigned long)__va(*prop);
+			initrd_below_start_ok = 1;
+		} else
+			initrd_start = 0;
 	}
 
 	/* If we were passed an initrd, set the ROOT_DEV properly if the values
@@ -631,7 +627,7 @@ void __init setup_system(void)
 	 * Initialize xmon
 	 */
 #ifdef CONFIG_XMON_DEFAULT
-	xmon_init(1);
+	xmon_init();
 #endif
 	/*
 	 * Register early console
@@ -1347,13 +1343,11 @@ static int __init early_xmon(char *p)
 	/* ensure xmon is enabled */
 	if (p) {
 		if (strncmp(p, "on", 2) == 0)
-			xmon_init(1);
-		if (strncmp(p, "off", 3) == 0)
-			xmon_init(0);
+			xmon_init();
 		if (strncmp(p, "early", 5) != 0)
 			return 0;
 	}
-	xmon_init(1);
+	xmon_init();
 	debugger(NULL);
 
 	return 0;
diff --git a/trunk/arch/ppc64/kernel/sysfs.c b/trunk/arch/ppc64/kernel/sysfs.c
index f311ee7c0070..02b8ac4e0168 100644
--- a/trunk/arch/ppc64/kernel/sysfs.c
+++ b/trunk/arch/ppc64/kernel/sysfs.c
@@ -13,7 +13,6 @@
 #include <asm/current.h>
 #include <asm/processor.h>
 #include <asm/cputable.h>
-#include <asm/firmware.h>
 #include <asm/hvcall.h>
 #include <asm/prom.h>
 #include <asm/systemcfg.h>
@@ -101,8 +100,6 @@ static int __init setup_smt_snooze_delay(char *str)
 }
 __setup("smt-snooze-delay=", setup_smt_snooze_delay);
 
-#endif /* CONFIG_PPC_MULTIPLATFORM */
-
 /*
  * Enabling PMCs will slow partition context switch times so we only do
  * it the first time we write to the PMCs.
@@ -112,15 +109,65 @@ static DEFINE_PER_CPU(char, pmcs_enabled);
 
 void ppc64_enable_pmcs(void)
 {
+	unsigned long hid0;
+#ifdef CONFIG_PPC_PSERIES
+	unsigned long set, reset;
+#endif /* CONFIG_PPC_PSERIES */
+
 	/* Only need to enable them once */
 	if (__get_cpu_var(pmcs_enabled))
 		return;
 
 	__get_cpu_var(pmcs_enabled) = 1;
 
-	if (ppc_md.enable_pmcs)
-		ppc_md.enable_pmcs();
+	switch (systemcfg->platform) {
+	case PLATFORM_PSERIES:
+	case PLATFORM_POWERMAC:
+		hid0 = mfspr(HID0);
+		hid0 |= 1UL << (63 - 20);
+
+		/* POWER4 requires the following sequence */
+		asm volatile(
+			     "sync\n"
+			     "mtspr	%1, %0\n"
+			     "mfspr	%0, %1\n"
+			     "mfspr	%0, %1\n"
+			     "mfspr	%0, %1\n"
+			     "mfspr	%0, %1\n"
+			     "mfspr	%0, %1\n"
+			     "mfspr	%0, %1\n"
+			     "isync" : "=&r" (hid0) : "i" (HID0), "0" (hid0):
+			     "memory");
+		break;
+
+#ifdef CONFIG_PPC_PSERIES
+	case PLATFORM_PSERIES_LPAR:
+		set = 1UL << 63;
+		reset = 0;
+		plpar_hcall_norets(H_PERFMON, set, reset);
+		break;
+#endif /* CONFIG_PPC_PSERIES */
+
+	default:
+		break;
+	}
+
+#ifdef CONFIG_PPC_PSERIES
+	/* instruct hypervisor to maintain PMCs */
+	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR)
+		get_paca()->lppaca.pmcregs_in_use = 1;
+#endif /* CONFIG_PPC_PSERIES */
 }
+
+#else
+
+/* PMC stuff */
+void ppc64_enable_pmcs(void)
+{
+	/* XXX Implement for iseries */
+}
+#endif /* CONFIG_PPC_MULTIPLATFORM */
+
 EXPORT_SYMBOL(ppc64_enable_pmcs);
 
 /* XXX convert to rusty's on_one_cpu */
diff --git a/trunk/arch/ppc64/kernel/time.c b/trunk/arch/ppc64/kernel/time.c
index 1696e1b05bb9..909462e1adea 100644
--- a/trunk/arch/ppc64/kernel/time.c
+++ b/trunk/arch/ppc64/kernel/time.c
@@ -67,7 +67,6 @@
 #include <asm/prom.h>
 #include <asm/sections.h>
 #include <asm/systemcfg.h>
-#include <asm/firmware.h>
 
 u64 jiffies_64 __cacheline_aligned_in_smp = INITIAL_JIFFIES;
 
@@ -371,11 +370,13 @@ int timer_interrupt(struct pt_regs * regs)
 		process_hvlpevents(regs);
 #endif
 
-	/* collect purr register values often, for accurate calculations */
-	if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
+/* collect purr register values often, for accurate calculations */
+#if defined(CONFIG_PPC_PSERIES)
+	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR) {
 		struct cpu_usage *cu = &__get_cpu_var(cpu_usage_array);
 		cu->current_tb = mfspr(SPRN_PURR);
 	}
+#endif
 
 	irq_exit();
 
diff --git a/trunk/arch/ppc64/kernel/vio.c b/trunk/arch/ppc64/kernel/vio.c
index c90e1dd875ce..0c0ba71ac0e8 100644
--- a/trunk/arch/ppc64/kernel/vio.c
+++ b/trunk/arch/ppc64/kernel/vio.c
@@ -1,11 +1,10 @@
 /*
  * IBM PowerPC Virtual I/O Infrastructure Support.
  *
- *    Copyright (c) 2003-2005 IBM Corp.
+ *    Copyright (c) 2003 IBM Corp.
  *     Dave Engebretsen engebret@us.ibm.com
  *     Santiago Leon santil@us.ibm.com
  *     Hollis Blanchard <hollisb@us.ibm.com>
- *     Stephen Rothwell
  *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
@@ -15,30 +14,61 @@
 
 #include <linux/init.h>
 #include <linux/console.h>
+#include <linux/version.h>
 #include <linux/module.h>
+#include <linux/kobject.h>
 #include <linux/mm.h>
 #include <linux/dma-mapping.h>
+#include <asm/rtas.h>
 #include <asm/iommu.h>
 #include <asm/dma.h>
+#include <asm/ppcdebug.h>
 #include <asm/vio.h>
+#include <asm/hvcall.h>
+#include <asm/iSeries/vio.h>
+#include <asm/iSeries/HvTypes.h>
+#include <asm/iSeries/HvCallXm.h>
+#include <asm/iSeries/HvLpConfig.h>
+
+#define DBGENTER() pr_debug("%s entered\n", __FUNCTION__)
+
+extern struct subsystem devices_subsys; /* needed for vio_find_name() */
 
 static const struct vio_device_id *vio_match_device(
 		const struct vio_device_id *, const struct vio_dev *);
 
-struct vio_dev vio_bus_device  = { /* fake "parent" device */
+#ifdef CONFIG_PPC_PSERIES
+static struct iommu_table *vio_build_iommu_table(struct vio_dev *);
+static int vio_num_address_cells;
+#endif
+#ifdef CONFIG_PPC_ISERIES
+static struct iommu_table veth_iommu_table;
+static struct iommu_table vio_iommu_table;
+#endif
+static struct vio_dev vio_bus_device  = { /* fake "parent" device */
 	.name = vio_bus_device.dev.bus_id,
 	.type = "",
+#ifdef CONFIG_PPC_ISERIES
+	.iommu_table = &vio_iommu_table,
+#endif
 	.dev.bus_id = "vio",
 	.dev.bus = &vio_bus_type,
 };
 
-static struct vio_bus_ops vio_bus_ops;
+#ifdef CONFIG_PPC_ISERIES
+static struct vio_dev *__init vio_register_device_iseries(char *type,
+		uint32_t unit_num);
 
-/*
- * Convert from struct device to struct vio_dev and pass to driver.
+struct device *iSeries_vio_dev = &vio_bus_device.dev;
+EXPORT_SYMBOL(iSeries_vio_dev);
+
+#define device_is_compatible(a, b)	1
+
+#endif
+
+/* convert from struct device to struct vio_dev and pass to driver.
  * dev->driver has already been set by generic code because vio_bus_match
- * succeeded.
- */
+ * succeeded. */
 static int vio_bus_probe(struct device *dev)
 {
 	struct vio_dev *viodev = to_vio_dev(dev);
@@ -46,12 +76,15 @@ static int vio_bus_probe(struct device *dev)
 	const struct vio_device_id *id;
 	int error = -ENODEV;
 
+	DBGENTER();
+
 	if (!viodrv->probe)
 		return error;
 
 	id = vio_match_device(viodrv->id_table, viodev);
-	if (id)
+	if (id) {
 		error = viodrv->probe(viodev, id);
+	}
 
 	return error;
 }
@@ -62,8 +95,11 @@ static int vio_bus_remove(struct device *dev)
 	struct vio_dev *viodev = to_vio_dev(dev);
 	struct vio_driver *viodrv = to_vio_driver(dev->driver);
 
-	if (viodrv->remove)
+	DBGENTER();
+
+	if (viodrv->remove) {
 		return viodrv->remove(viodev);
+	}
 
 	/* driver can't remove */
 	return 1;
@@ -99,72 +135,193 @@ void vio_unregister_driver(struct vio_driver *viodrv)
 EXPORT_SYMBOL(vio_unregister_driver);
 
 /**
- * vio_match_device: - Tell if a VIO device has a matching
- *			VIO device id structure.
- * @ids:	array of VIO device id structures to search in
- * @dev:	the VIO device structure to match against
+ * vio_match_device: - Tell if a VIO device has a matching VIO device id structure.
+ * @ids: 	array of VIO device id structures to search in
+ * @dev: 	the VIO device structure to match against
  *
  * Used by a driver to check whether a VIO device present in the
  * system is in its list of supported devices. Returns the matching
  * vio_device_id structure or NULL if there is no match.
  */
-static const struct vio_device_id *vio_match_device(
-		const struct vio_device_id *ids, const struct vio_dev *dev)
+static const struct vio_device_id * vio_match_device(const struct vio_device_id *ids,
+	const struct vio_dev *dev)
 {
-	while (ids->type[0] != '\0') {
-		if (vio_bus_ops.match(ids, dev))
+	DBGENTER();
+
+	while (ids->type) {
+		if ((strncmp(dev->type, ids->type, strlen(ids->type)) == 0) &&
+			device_is_compatible(dev->dev.platform_data, ids->compat))
 			return ids;
 		ids++;
 	}
 	return NULL;
 }
 
+#ifdef CONFIG_PPC_ISERIES
+void __init iommu_vio_init(void)
+{
+	struct iommu_table *t;
+	struct iommu_table_cb cb;
+	unsigned long cbp;
+	unsigned long itc_entries;
+
+	cb.itc_busno = 255;    /* Bus 255 is the virtual bus */
+	cb.itc_virtbus = 0xff; /* Ask for virtual bus */
+
+	cbp = virt_to_abs(&cb);
+	HvCallXm_getTceTableParms(cbp);
+
+	itc_entries = cb.itc_size * PAGE_SIZE / sizeof(union tce_entry);
+	veth_iommu_table.it_size        = itc_entries / 2;
+	veth_iommu_table.it_busno       = cb.itc_busno;
+	veth_iommu_table.it_offset      = cb.itc_offset;
+	veth_iommu_table.it_index       = cb.itc_index;
+	veth_iommu_table.it_type        = TCE_VB;
+	veth_iommu_table.it_blocksize	= 1;
+
+	t = iommu_init_table(&veth_iommu_table);
+
+	if (!t)
+		printk("Virtual Bus VETH TCE table failed.\n");
+
+	vio_iommu_table.it_size         = itc_entries - veth_iommu_table.it_size;
+	vio_iommu_table.it_busno        = cb.itc_busno;
+	vio_iommu_table.it_offset       = cb.itc_offset +
+					  veth_iommu_table.it_size;
+	vio_iommu_table.it_index        = cb.itc_index;
+	vio_iommu_table.it_type         = TCE_VB;
+	vio_iommu_table.it_blocksize	= 1;
+
+	t = iommu_init_table(&vio_iommu_table);
+
+	if (!t)
+		printk("Virtual Bus VIO TCE table failed.\n");
+}
+#endif
+
+#ifdef CONFIG_PPC_PSERIES
+static void probe_bus_pseries(void)
+{
+	struct device_node *node_vroot, *of_node;
+
+	node_vroot = find_devices("vdevice");
+	if ((node_vroot == NULL) || (node_vroot->child == NULL))
+		/* this machine doesn't do virtual IO, and that's ok */
+		return;
+
+	vio_num_address_cells = prom_n_addr_cells(node_vroot->child);
+
+	/*
+	 * Create struct vio_devices for each virtual device in the device tree.
+	 * Drivers will associate with them later.
+	 */
+	for (of_node = node_vroot->child; of_node != NULL;
+			of_node = of_node->sibling) {
+		printk(KERN_DEBUG "%s: processing %p\n", __FUNCTION__, of_node);
+		vio_register_device_node(of_node);
+	}
+}
+#endif
+
+#ifdef CONFIG_PPC_ISERIES
+static void probe_bus_iseries(void)
+{
+	HvLpIndexMap vlan_map = HvLpConfig_getVirtualLanIndexMap();
+	struct vio_dev *viodev;
+	int i;
+
+	/* there is only one of each of these */
+	vio_register_device_iseries("viocons", 0);
+	vio_register_device_iseries("vscsi", 0);
+
+	vlan_map = HvLpConfig_getVirtualLanIndexMap();
+	for (i = 0; i < HVMAXARCHITECTEDVIRTUALLANS; i++) {
+		if ((vlan_map & (0x8000 >> i)) == 0)
+			continue;
+		viodev = vio_register_device_iseries("vlan", i);
+		/* veth is special and has it own iommu_table */
+		viodev->iommu_table = &veth_iommu_table;
+	}
+	for (i = 0; i < HVMAXARCHITECTEDVIRTUALDISKS; i++)
+		vio_register_device_iseries("viodasd", i);
+	for (i = 0; i < HVMAXARCHITECTEDVIRTUALCDROMS; i++)
+		vio_register_device_iseries("viocd", i);
+	for (i = 0; i < HVMAXARCHITECTEDVIRTUALTAPES; i++)
+		vio_register_device_iseries("viotape", i);
+}
+#endif
+
 /**
  * vio_bus_init: - Initialize the virtual IO bus
  */
-int __init vio_bus_init(struct vio_bus_ops *ops)
+static int __init vio_bus_init(void)
 {
 	int err;
 
-	vio_bus_ops = *ops;
-
 	err = bus_register(&vio_bus_type);
 	if (err) {
 		printk(KERN_ERR "failed to register VIO bus\n");
 		return err;
 	}
 
-	/*
-	 * The fake parent of all vio devices, just to give us
-	 * a nice directory
-	 */
+	/* the fake parent of all vio devices, just to give us a nice directory */
 	err = device_register(&vio_bus_device.dev);
 	if (err) {
-		printk(KERN_WARNING "%s: device_register returned %i\n",
-				__FUNCTION__, err);
+		printk(KERN_WARNING "%s: device_register returned %i\n", __FUNCTION__,
+			err);
 		return err;
 	}
 
+#ifdef CONFIG_PPC_PSERIES
+	probe_bus_pseries();
+#endif
+#ifdef CONFIG_PPC_ISERIES
+	probe_bus_iseries();
+#endif
+
 	return 0;
 }
 
+__initcall(vio_bus_init);
+
 /* vio_dev refcount hit 0 */
 static void __devinit vio_dev_release(struct device *dev)
 {
-	if (vio_bus_ops.release_device)
-		vio_bus_ops.release_device(dev);
+	DBGENTER();
+
+#ifdef CONFIG_PPC_PSERIES
+	/* XXX free TCE table */
+	of_node_put(dev->platform_data);
+#endif
 	kfree(to_vio_dev(dev));
 }
 
-static ssize_t viodev_show_name(struct device *dev,
-		struct device_attribute *attr, char *buf)
+#ifdef CONFIG_PPC_PSERIES
+static ssize_t viodev_show_devspec(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct device_node *of_node = dev->platform_data;
+
+	return sprintf(buf, "%s\n", of_node->full_name);
+}
+DEVICE_ATTR(devspec, S_IRUSR | S_IRGRP | S_IROTH, viodev_show_devspec, NULL);
+#endif
+
+static ssize_t viodev_show_name(struct device *dev, struct device_attribute *attr, char *buf)
 {
 	return sprintf(buf, "%s\n", to_vio_dev(dev)->name);
 }
 DEVICE_ATTR(name, S_IRUSR | S_IRGRP | S_IROTH, viodev_show_name, NULL);
 
-struct vio_dev * __devinit vio_register_device(struct vio_dev *viodev)
+static struct vio_dev * __devinit vio_register_device_common(
+		struct vio_dev *viodev, char *name, char *type,
+		uint32_t unit_address, struct iommu_table *iommu_table)
 {
+	DBGENTER();
+
+	viodev->name = name;
+	viodev->type = type;
+	viodev->unit_address = unit_address;
+	viodev->iommu_table = iommu_table;
 	/* init generic 'struct device' fields: */
 	viodev->dev.parent = &vio_bus_device.dev;
 	viodev->dev.bus = &vio_bus_type;
@@ -181,15 +338,222 @@ struct vio_dev * __devinit vio_register_device(struct vio_dev *viodev)
 	return viodev;
 }
 
+#ifdef CONFIG_PPC_PSERIES
+/**
+ * vio_register_device_node: - Register a new vio device.
+ * @of_node:	The OF node for this device.
+ *
+ * Creates and initializes a vio_dev structure from the data in
+ * of_node (dev.platform_data) and adds it to the list of virtual devices.
+ * Returns a pointer to the created vio_dev or NULL if node has
+ * NULL device_type or compatible fields.
+ */
+struct vio_dev * __devinit vio_register_device_node(struct device_node *of_node)
+{
+	struct vio_dev *viodev;
+	unsigned int *unit_address;
+	unsigned int *irq_p;
+
+	DBGENTER();
+
+	/* we need the 'device_type' property, in order to match with drivers */
+	if ((NULL == of_node->type)) {
+		printk(KERN_WARNING
+			"%s: node %s missing 'device_type'\n", __FUNCTION__,
+			of_node->name ? of_node->name : "<unknown>");
+		return NULL;
+	}
+
+	unit_address = (unsigned int *)get_property(of_node, "reg", NULL);
+	if (!unit_address) {
+		printk(KERN_WARNING "%s: node %s missing 'reg'\n", __FUNCTION__,
+			of_node->name ? of_node->name : "<unknown>");
+		return NULL;
+	}
+
+	/* allocate a vio_dev for this node */
+	viodev = kmalloc(sizeof(struct vio_dev), GFP_KERNEL);
+	if (!viodev) {
+		return NULL;
+	}
+	memset(viodev, 0, sizeof(struct vio_dev));
+
+	viodev->dev.platform_data = of_node_get(of_node);
+
+	viodev->irq = NO_IRQ;
+	irq_p = (unsigned int *)get_property(of_node, "interrupts", NULL);
+	if (irq_p) {
+		int virq = virt_irq_create_mapping(*irq_p);
+		if (virq == NO_IRQ) {
+			printk(KERN_ERR "Unable to allocate interrupt "
+			       "number for %s\n", of_node->full_name);
+		} else
+			viodev->irq = irq_offset_up(virq);
+	}
+
+	snprintf(viodev->dev.bus_id, BUS_ID_SIZE, "%x", *unit_address);
+
+	/* register with generic device framework */
+	if (vio_register_device_common(viodev, of_node->name, of_node->type,
+				*unit_address, vio_build_iommu_table(viodev))
+			== NULL) {
+		/* XXX free TCE table */
+		kfree(viodev);
+		return NULL;
+	}
+	device_create_file(&viodev->dev, &dev_attr_devspec);
+
+	return viodev;
+}
+EXPORT_SYMBOL(vio_register_device_node);
+#endif
+
+#ifdef CONFIG_PPC_ISERIES
+/**
+ * vio_register_device: - Register a new vio device.
+ * @voidev:	The device to register.
+ */
+static struct vio_dev *__init vio_register_device_iseries(char *type,
+		uint32_t unit_num)
+{
+	struct vio_dev *viodev;
+
+	DBGENTER();
+
+	/* allocate a vio_dev for this node */
+	viodev = kmalloc(sizeof(struct vio_dev), GFP_KERNEL);
+	if (!viodev)
+		return NULL;
+	memset(viodev, 0, sizeof(struct vio_dev));
+
+	snprintf(viodev->dev.bus_id, BUS_ID_SIZE, "%s%d", type, unit_num);
+
+	return vio_register_device_common(viodev, viodev->dev.bus_id, type,
+			unit_num, &vio_iommu_table);
+}
+#endif
+
 void __devinit vio_unregister_device(struct vio_dev *viodev)
 {
-	if (vio_bus_ops.unregister_device)
-		vio_bus_ops.unregister_device(viodev);
+	DBGENTER();
+#ifdef CONFIG_PPC_PSERIES
+	device_remove_file(&viodev->dev, &dev_attr_devspec);
+#endif
 	device_remove_file(&viodev->dev, &dev_attr_name);
 	device_unregister(&viodev->dev);
 }
 EXPORT_SYMBOL(vio_unregister_device);
 
+#ifdef CONFIG_PPC_PSERIES
+/**
+ * vio_get_attribute: - get attribute for virtual device
+ * @vdev:	The vio device to get property.
+ * @which:	The property/attribute to be extracted.
+ * @length:	Pointer to length of returned data size (unused if NULL).
+ *
+ * Calls prom.c's get_property() to return the value of the
+ * attribute specified by the preprocessor constant @which
+*/
+const void * vio_get_attribute(struct vio_dev *vdev, void* which, int* length)
+{
+	return get_property(vdev->dev.platform_data, (char*)which, length);
+}
+EXPORT_SYMBOL(vio_get_attribute);
+
+/* vio_find_name() - internal because only vio.c knows how we formatted the
+ * kobject name
+ * XXX once vio_bus_type.devices is actually used as a kset in
+ * drivers/base/bus.c, this function should be removed in favor of
+ * "device_find(kobj_name, &vio_bus_type)"
+ */
+static struct vio_dev *vio_find_name(const char *kobj_name)
+{
+	struct kobject *found;
+
+	found = kset_find_obj(&devices_subsys.kset, kobj_name);
+	if (!found)
+		return NULL;
+
+	return to_vio_dev(container_of(found, struct device, kobj));
+}
+
+/**
+ * vio_find_node - find an already-registered vio_dev
+ * @vnode: device_node of the virtual device we're looking for
+ */
+struct vio_dev *vio_find_node(struct device_node *vnode)
+{
+	uint32_t *unit_address;
+	char kobj_name[BUS_ID_SIZE];
+
+	/* construct the kobject name from the device node */
+	unit_address = (uint32_t *)get_property(vnode, "reg", NULL);
+	if (!unit_address)
+		return NULL;
+	snprintf(kobj_name, BUS_ID_SIZE, "%x", *unit_address);
+
+	return vio_find_name(kobj_name);
+}
+EXPORT_SYMBOL(vio_find_node);
+
+/**
+ * vio_build_iommu_table: - gets the dma information from OF and builds the TCE tree.
+ * @dev: the virtual device.
+ *
+ * Returns a pointer to the built tce tree, or NULL if it can't
+ * find property.
+*/
+static struct iommu_table * vio_build_iommu_table(struct vio_dev *dev)
+{
+	unsigned int *dma_window;
+	struct iommu_table *newTceTable;
+	unsigned long offset;
+	int dma_window_property_size;
+
+	dma_window = (unsigned int *) get_property(dev->dev.platform_data, "ibm,my-dma-window", &dma_window_property_size);
+	if(!dma_window) {
+		return NULL;
+	}
+
+	newTceTable = (struct iommu_table *) kmalloc(sizeof(struct iommu_table), GFP_KERNEL);
+
+	/*  There should be some code to extract the phys-encoded offset
+		using prom_n_addr_cells(). However, according to a comment
+		on earlier versions, it's always zero, so we don't bother */
+	offset = dma_window[1] >>  PAGE_SHIFT;
+
+	/* TCE table size - measured in tce entries */
+	newTceTable->it_size		= dma_window[4] >> PAGE_SHIFT;
+	/* offset for VIO should always be 0 */
+	newTceTable->it_offset		= offset;
+	newTceTable->it_busno		= 0;
+	newTceTable->it_index		= (unsigned long)dma_window[0];
+	newTceTable->it_type		= TCE_VB;
+
+	return iommu_init_table(newTceTable);
+}
+
+int vio_enable_interrupts(struct vio_dev *dev)
+{
+	int rc = h_vio_signal(dev->unit_address, VIO_IRQ_ENABLE);
+	if (rc != H_Success) {
+		printk(KERN_ERR "vio: Error 0x%x enabling interrupts\n", rc);
+	}
+	return rc;
+}
+EXPORT_SYMBOL(vio_enable_interrupts);
+
+int vio_disable_interrupts(struct vio_dev *dev)
+{
+	int rc = h_vio_signal(dev->unit_address, VIO_IRQ_DISABLE);
+	if (rc != H_Success) {
+		printk(KERN_ERR "vio: Error 0x%x disabling interrupts\n", rc);
+	}
+	return rc;
+}
+EXPORT_SYMBOL(vio_disable_interrupts);
+#endif
+
 static dma_addr_t vio_map_single(struct device *dev, void *vaddr,
 			  size_t size, enum dma_data_direction direction)
 {
@@ -251,8 +615,18 @@ static int vio_bus_match(struct device *dev, struct device_driver *drv)
 	const struct vio_dev *vio_dev = to_vio_dev(dev);
 	struct vio_driver *vio_drv = to_vio_driver(drv);
 	const struct vio_device_id *ids = vio_drv->id_table;
+	const struct vio_device_id *found_id;
+
+	DBGENTER();
 
-	return (ids != NULL) && (vio_match_device(ids, vio_dev) != NULL);
+	if (!ids)
+		return 0;
+
+	found_id = vio_match_device(ids, vio_dev);
+	if (found_id)
+		return 1;
+
+	return 0;
 }
 
 struct bus_type vio_bus_type = {
diff --git a/trunk/arch/ppc64/mm/hash_low.S b/trunk/arch/ppc64/mm/hash_low.S
index 35eb49e1b890..fbff24827ae7 100644
--- a/trunk/arch/ppc64/mm/hash_low.S
+++ b/trunk/arch/ppc64/mm/hash_low.S
@@ -128,11 +128,13 @@ _GLOBAL(__hash_page)
 	/* We eventually do the icache sync here (maybe inline that
 	 * code rather than call a C function...) 
 	 */
+BEGIN_FTR_SECTION
 BEGIN_FTR_SECTION
 	mr	r4,r30
 	mr	r5,r7
 	bl	.hash_page_do_lazy_icache
-END_FTR_SECTION(CPU_FTR_NOEXECUTE|CPU_FTR_COHERENT_ICACHE, CPU_FTR_NOEXECUTE)
+END_FTR_SECTION_IFSET(CPU_FTR_NOEXECUTE)
+END_FTR_SECTION_IFCLR(CPU_FTR_COHERENT_ICACHE)
 
 	/* At this point, r3 contains new PP bits, save them in
 	 * place of "access" in the param area (sic)
diff --git a/trunk/arch/ppc64/mm/hash_native.c b/trunk/arch/ppc64/mm/hash_native.c
index 7626bb59954d..a6abd3a979bf 100644
--- a/trunk/arch/ppc64/mm/hash_native.c
+++ b/trunk/arch/ppc64/mm/hash_native.c
@@ -51,6 +51,7 @@ long native_hpte_insert(unsigned long hpte_group, unsigned long va,
 			unsigned long prpn, unsigned long vflags,
 			unsigned long rflags)
 {
+	unsigned long arpn = physRpn_to_absRpn(prpn);
 	hpte_t *hptep = htab_address + hpte_group;
 	unsigned long hpte_v, hpte_r;
 	int i;
@@ -73,7 +74,7 @@ long native_hpte_insert(unsigned long hpte_group, unsigned long va,
 	hpte_v = (va >> 23) << HPTE_V_AVPN_SHIFT | vflags | HPTE_V_VALID;
 	if (vflags & HPTE_V_LARGE)
 		va &= ~(1UL << HPTE_V_AVPN_SHIFT);
-	hpte_r = (prpn << HPTE_R_RPN_SHIFT) | rflags;
+	hpte_r = (arpn << HPTE_R_RPN_SHIFT) | rflags;
 
 	hptep->r = hpte_r;
 	/* Guarantee the second dword is visible before the valid bit */
diff --git a/trunk/arch/ppc64/mm/hash_utils.c b/trunk/arch/ppc64/mm/hash_utils.c
index 09475c8edf7c..623b5d130c31 100644
--- a/trunk/arch/ppc64/mm/hash_utils.c
+++ b/trunk/arch/ppc64/mm/hash_utils.c
@@ -210,7 +210,7 @@ void __init htab_initialize(void)
 
 	/* create bolted the linear mapping in the hash table */
 	for (i=0; i < lmb.memory.cnt; i++) {
-		base = lmb.memory.region[i].base + KERNELBASE;
+		base = lmb.memory.region[i].physbase + KERNELBASE;
 		size = lmb.memory.region[i].size;
 
 		DBG("creating mapping for region: %lx : %lx\n", base, size);
@@ -302,7 +302,7 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
 	int local = 0;
 	cpumask_t tmp;
 
-	if ((ea & ~REGION_MASK) >= PGTABLE_RANGE)
+	if ((ea & ~REGION_MASK) > EADDR_MASK)
 		return 1;
 
  	switch (REGION_ID(ea)) {
diff --git a/trunk/arch/ppc64/mm/hugetlbpage.c b/trunk/arch/ppc64/mm/hugetlbpage.c
index e7833c80eb68..f9524602818d 100644
--- a/trunk/arch/ppc64/mm/hugetlbpage.c
+++ b/trunk/arch/ppc64/mm/hugetlbpage.c
@@ -27,94 +27,124 @@
 
 #include <linux/sysctl.h>
 
-#define NUM_LOW_AREAS	(0x100000000UL >> SID_SHIFT)
-#define NUM_HIGH_AREAS	(PGTABLE_RANGE >> HTLB_AREA_SHIFT)
+#define	HUGEPGDIR_SHIFT		(HPAGE_SHIFT + PAGE_SHIFT - 3)
+#define HUGEPGDIR_SIZE		(1UL << HUGEPGDIR_SHIFT)
+#define HUGEPGDIR_MASK		(~(HUGEPGDIR_SIZE-1))
 
-/* Modelled after find_linux_pte() */
-pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
+#define HUGEPTE_INDEX_SIZE	9
+#define HUGEPGD_INDEX_SIZE	10
+
+#define PTRS_PER_HUGEPTE	(1 << HUGEPTE_INDEX_SIZE)
+#define PTRS_PER_HUGEPGD	(1 << HUGEPGD_INDEX_SIZE)
+
+static inline int hugepgd_index(unsigned long addr)
 {
-	pgd_t *pg;
-	pud_t *pu;
-	pmd_t *pm;
-	pte_t *pt;
+	return (addr & ~REGION_MASK) >> HUGEPGDIR_SHIFT;
+}
 
-	BUG_ON(! in_hugepage_area(mm->context, addr));
+static pud_t *hugepgd_offset(struct mm_struct *mm, unsigned long addr)
+{
+	int index;
 
-	addr &= HPAGE_MASK;
-
-	pg = pgd_offset(mm, addr);
-	if (!pgd_none(*pg)) {
-		pu = pud_offset(pg, addr);
-		if (!pud_none(*pu)) {
-			pm = pmd_offset(pu, addr);
-			pt = (pte_t *)pm;
-			BUG_ON(!pmd_none(*pm)
-			       && !(pte_present(*pt) && pte_huge(*pt)));
-			return pt;
-		}
-	}
+	if (! mm->context.huge_pgdir)
+		return NULL;
 
-	return NULL;
+
+	index = hugepgd_index(addr);
+	BUG_ON(index >= PTRS_PER_HUGEPGD);
+	return (pud_t *)(mm->context.huge_pgdir + index);
 }
 
-pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr)
+static inline pte_t *hugepte_offset(pud_t *dir, unsigned long addr)
 {
-	pgd_t *pg;
-	pud_t *pu;
-	pmd_t *pm;
-	pte_t *pt;
+	int index;
+
+	if (pud_none(*dir))
+		return NULL;
 
+	index = (addr >> HPAGE_SHIFT) % PTRS_PER_HUGEPTE;
+	return (pte_t *)pud_page(*dir) + index;
+}
+
+static pud_t *hugepgd_alloc(struct mm_struct *mm, unsigned long addr)
+{
 	BUG_ON(! in_hugepage_area(mm->context, addr));
 
-	addr &= HPAGE_MASK;
+	if (! mm->context.huge_pgdir) {
+		pgd_t *new;
+		spin_unlock(&mm->page_table_lock);
+		/* Don't use pgd_alloc(), because we want __GFP_REPEAT */
+		new = kmem_cache_alloc(zero_cache, GFP_KERNEL | __GFP_REPEAT);
+		BUG_ON(memcmp(new, empty_zero_page, PAGE_SIZE));
+		spin_lock(&mm->page_table_lock);
 
-	pg = pgd_offset(mm, addr);
-	pu = pud_alloc(mm, pg, addr);
+		/*
+		 * Because we dropped the lock, we should re-check the
+		 * entry, as somebody else could have populated it..
+		 */
+		if (mm->context.huge_pgdir)
+			pgd_free(new);
+		else
+			mm->context.huge_pgdir = new;
+	}
+	return hugepgd_offset(mm, addr);
+}
 
-	if (pu) {
-		pm = pmd_alloc(mm, pu, addr);
-		if (pm) {
-			pt = (pte_t *)pm;
-			BUG_ON(!pmd_none(*pm)
-			       && !(pte_present(*pt) && pte_huge(*pt)));
-			return pt;
+static pte_t *hugepte_alloc(struct mm_struct *mm, pud_t *dir, unsigned long addr)
+{
+	if (! pud_present(*dir)) {
+		pte_t *new;
+
+		spin_unlock(&mm->page_table_lock);
+		new = kmem_cache_alloc(zero_cache, GFP_KERNEL | __GFP_REPEAT);
+		BUG_ON(memcmp(new, empty_zero_page, PAGE_SIZE));
+		spin_lock(&mm->page_table_lock);
+		/*
+		 * Because we dropped the lock, we should re-check the
+		 * entry, as somebody else could have populated it..
+		 */
+		if (pud_present(*dir)) {
+			if (new)
+				kmem_cache_free(zero_cache, new);
+		} else {
+			struct page *ptepage;
+
+			if (! new)
+				return NULL;
+			ptepage = virt_to_page(new);
+			ptepage->mapping = (void *) mm;
+			ptepage->index = addr & HUGEPGDIR_MASK;
+			pud_populate(mm, dir, new);
 		}
 	}
 
-	return NULL;
+	return hugepte_offset(dir, addr);
 }
 
-#define HUGEPTE_BATCH_SIZE	(HPAGE_SIZE / PMD_SIZE)
-
-void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
-		     pte_t *ptep, pte_t pte)
+pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
 {
-	int i;
+	pud_t *pud;
 
-	if (pte_present(*ptep)) {
-		pte_clear(mm, addr, ptep);
-		flush_tlb_pending();
-	}
+	BUG_ON(! in_hugepage_area(mm->context, addr));
 
-	for (i = 0; i < HUGEPTE_BATCH_SIZE; i++) {
-		*ptep = __pte(pte_val(pte) & ~_PAGE_HPTEFLAGS);
-		ptep++;
-	}
+	pud = hugepgd_offset(mm, addr);
+	if (! pud)
+		return NULL;
+
+	return hugepte_offset(pud, addr);
 }
 
-pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
-			      pte_t *ptep)
+pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr)
 {
-	unsigned long old = pte_update(ptep, ~0UL);
-	int i;
+	pud_t *pud;
 
-	if (old & _PAGE_HASHPTE)
-		hpte_update(mm, addr, old, 0);
+	BUG_ON(! in_hugepage_area(mm->context, addr));
 
-	for (i = 1; i < HUGEPTE_BATCH_SIZE; i++)
-		ptep[i] = __pte(0);
+	pud = hugepgd_alloc(mm, addr);
+	if (! pud)
+		return NULL;
 
-	return __pte(old);
+	return hugepte_alloc(mm, pud, addr);
 }
 
 /*
@@ -132,17 +162,15 @@ int is_aligned_hugepage_range(unsigned long addr, unsigned long len)
 	return 0;
 }
 
-static void flush_low_segments(void *parm)
+static void flush_segments(void *parm)
 {
-	u16 areas = (unsigned long) parm;
+	u16 segs = (unsigned long) parm;
 	unsigned long i;
 
 	asm volatile("isync" : : : "memory");
 
-	BUILD_BUG_ON((sizeof(areas)*8) != NUM_LOW_AREAS);
-
-	for (i = 0; i < NUM_LOW_AREAS; i++) {
-		if (! (areas & (1U << i)))
+	for (i = 0; i < 16; i++) {
+		if (! (segs & (1U << i)))
 			continue;
 		asm volatile("slbie %0" : : "r" (i << SID_SHIFT));
 	}
@@ -150,33 +178,13 @@ static void flush_low_segments(void *parm)
 	asm volatile("isync" : : : "memory");
 }
 
-static void flush_high_segments(void *parm)
+static int prepare_low_seg_for_htlb(struct mm_struct *mm, unsigned long seg)
 {
-	u16 areas = (unsigned long) parm;
-	unsigned long i, j;
-
-	asm volatile("isync" : : : "memory");
-
-	BUILD_BUG_ON((sizeof(areas)*8) != NUM_HIGH_AREAS);
-
-	for (i = 0; i < NUM_HIGH_AREAS; i++) {
-		if (! (areas & (1U << i)))
-			continue;
-		for (j = 0; j < (1UL << (HTLB_AREA_SHIFT-SID_SHIFT)); j++)
-			asm volatile("slbie %0"
-				     :: "r" ((i << HTLB_AREA_SHIFT) + (j << SID_SHIFT)));
-	}
-
-	asm volatile("isync" : : : "memory");
-}
-
-static int prepare_low_area_for_htlb(struct mm_struct *mm, unsigned long area)
-{
-	unsigned long start = area << SID_SHIFT;
-	unsigned long end = (area+1) << SID_SHIFT;
+	unsigned long start = seg << SID_SHIFT;
+	unsigned long end = (seg+1) << SID_SHIFT;
 	struct vm_area_struct *vma;
 
-	BUG_ON(area >= NUM_LOW_AREAS);
+	BUG_ON(seg >= 16);
 
 	/* Check no VMAs are in the region */
 	vma = find_vma(mm, start);
@@ -186,39 +194,20 @@ static int prepare_low_area_for_htlb(struct mm_struct *mm, unsigned long area)
 	return 0;
 }
 
-static int prepare_high_area_for_htlb(struct mm_struct *mm, unsigned long area)
-{
-	unsigned long start = area << HTLB_AREA_SHIFT;
-	unsigned long end = (area+1) << HTLB_AREA_SHIFT;
-	struct vm_area_struct *vma;
-
-	BUG_ON(area >= NUM_HIGH_AREAS);
-
-	/* Check no VMAs are in the region */
-	vma = find_vma(mm, start);
-	if (vma && (vma->vm_start < end))
-		return -EBUSY;
-
-	return 0;
-}
-
-static int open_low_hpage_areas(struct mm_struct *mm, u16 newareas)
+static int open_low_hpage_segs(struct mm_struct *mm, u16 newsegs)
 {
 	unsigned long i;
 
-	BUILD_BUG_ON((sizeof(newareas)*8) != NUM_LOW_AREAS);
-	BUILD_BUG_ON((sizeof(mm->context.low_htlb_areas)*8) != NUM_LOW_AREAS);
-
-	newareas &= ~(mm->context.low_htlb_areas);
-	if (! newareas)
+	newsegs &= ~(mm->context.htlb_segs);
+	if (! newsegs)
 		return 0; /* The segments we want are already open */
 
-	for (i = 0; i < NUM_LOW_AREAS; i++)
-		if ((1 << i) & newareas)
-			if (prepare_low_area_for_htlb(mm, i) != 0)
+	for (i = 0; i < 16; i++)
+		if ((1 << i) & newsegs)
+			if (prepare_low_seg_for_htlb(mm, i) != 0)
 				return -EBUSY;
 
-	mm->context.low_htlb_areas |= newareas;
+	mm->context.htlb_segs |= newsegs;
 
 	/* update the paca copy of the context struct */
 	get_paca()->context = mm->context;
@@ -226,63 +215,29 @@ static int open_low_hpage_areas(struct mm_struct *mm, u16 newareas)
 	/* the context change must make it to memory before the flush,
 	 * so that further SLB misses do the right thing. */
 	mb();
-	on_each_cpu(flush_low_segments, (void *)(unsigned long)newareas, 0, 1);
-
-	return 0;
-}
-
-static int open_high_hpage_areas(struct mm_struct *mm, u16 newareas)
-{
-	unsigned long i;
-
-	BUILD_BUG_ON((sizeof(newareas)*8) != NUM_HIGH_AREAS);
-	BUILD_BUG_ON((sizeof(mm->context.high_htlb_areas)*8)
-		     != NUM_HIGH_AREAS);
-
-	newareas &= ~(mm->context.high_htlb_areas);
-	if (! newareas)
-		return 0; /* The areas we want are already open */
-
-	for (i = 0; i < NUM_HIGH_AREAS; i++)
-		if ((1 << i) & newareas)
-			if (prepare_high_area_for_htlb(mm, i) != 0)
-				return -EBUSY;
-
-	mm->context.high_htlb_areas |= newareas;
-
-	/* update the paca copy of the context struct */
-	get_paca()->context = mm->context;
-
-	/* the context change must make it to memory before the flush,
-	 * so that further SLB misses do the right thing. */
-	mb();
-	on_each_cpu(flush_high_segments, (void *)(unsigned long)newareas, 0, 1);
+	on_each_cpu(flush_segments, (void *)(unsigned long)newsegs, 0, 1);
 
 	return 0;
 }
 
 int prepare_hugepage_range(unsigned long addr, unsigned long len)
 {
-	int err;
-
-	if ( (addr+len) < addr )
-		return -EINVAL;
-
-	if ((addr + len) < 0x100000000UL)
-		err = open_low_hpage_areas(current->mm,
+	if (within_hugepage_high_range(addr, len))
+		return 0;
+	else if ((addr < 0x100000000UL) && ((addr+len) < 0x100000000UL)) {
+		int err;
+		/* Yes, we need both tests, in case addr+len overflows
+		 * 64-bit arithmetic */
+		err = open_low_hpage_segs(current->mm,
 					  LOW_ESID_MASK(addr, len));
-	else
-		err = open_high_hpage_areas(current->mm,
-					    HTLB_AREA_MASK(addr, len));
-	if (err) {
-		printk(KERN_DEBUG "prepare_hugepage_range(%lx, %lx)"
-		       " failed (lowmask: 0x%04hx, highmask: 0x%04hx)\n",
-		       addr, len,
-		       LOW_ESID_MASK(addr, len), HTLB_AREA_MASK(addr, len));
+		if (err)
+			printk(KERN_DEBUG "prepare_hugepage_range(%lx, %lx)"
+			       " failed (segs: 0x%04hx)\n", addr, len,
+			       LOW_ESID_MASK(addr, len));
 		return err;
 	}
 
-	return 0;
+	return -EINVAL;
 }
 
 struct page *
@@ -354,8 +309,8 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
 			vma = find_vma(mm, addr);
 			continue;
 		}
-		if (touches_hugepage_high_range(mm, addr, len)) {
-			addr = ALIGN(addr+1, 1UL<<HTLB_AREA_SHIFT);
+		if (touches_hugepage_high_range(addr, len)) {
+			addr = TASK_HPAGE_END;
 			vma = find_vma(mm, addr);
 			continue;
 		}
@@ -434,9 +389,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 		if (touches_hugepage_low_range(mm, addr, len)) {
 			addr = (addr & ((~0) << SID_SHIFT)) - len;
 			goto hugepage_recheck;
-		} else if (touches_hugepage_high_range(mm, addr, len)) {
-			addr = (addr & ((~0UL) << HTLB_AREA_SHIFT)) - len;
-			goto hugepage_recheck;
+		} else if (touches_hugepage_high_range(addr, len)) {
+			addr = TASK_HPAGE_BASE - len;
 		}
 
 		/*
@@ -527,28 +481,23 @@ static unsigned long htlb_get_low_area(unsigned long len, u16 segmask)
 	return -ENOMEM;
 }
 
-static unsigned long htlb_get_high_area(unsigned long len, u16 areamask)
+static unsigned long htlb_get_high_area(unsigned long len)
 {
-	unsigned long addr = 0x100000000UL;
+	unsigned long addr = TASK_HPAGE_BASE;
 	struct vm_area_struct *vma;
 
 	vma = find_vma(current->mm, addr);
-	while (addr + len <= TASK_SIZE_USER64) {
+	for (vma = find_vma(current->mm, addr);
+	     addr + len <= TASK_HPAGE_END;
+	     vma = vma->vm_next) {
 		BUG_ON(vma && (addr >= vma->vm_end)); /* invariant */
-
-		if (! __within_hugepage_high_range(addr, len, areamask)) {
-			addr = ALIGN(addr+1, 1UL<<HTLB_AREA_SHIFT);
-			vma = find_vma(current->mm, addr);
-			continue;
-		}
+		BUG_ON(! within_hugepage_high_range(addr, len));
 
 		if (!vma || (addr + len) <= vma->vm_start)
 			return addr;
 		addr = ALIGN(vma->vm_end, HPAGE_SIZE);
-		/* Depending on segmask this might not be a confirmed
-		 * hugepage region, so the ALIGN could have skipped
-		 * some VMAs */
-		vma = find_vma(current->mm, addr);
+		/* Because we're in a hugepage region, this alignment
+		 * should not skip us over any VMAs */
 	}
 
 	return -ENOMEM;
@@ -558,9 +507,6 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
 					unsigned long len, unsigned long pgoff,
 					unsigned long flags)
 {
-	int lastshift;
-	u16 areamask, curareas;
-
 	if (len & ~HPAGE_MASK)
 		return -EINVAL;
 
@@ -568,49 +514,67 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
 		return -EINVAL;
 
 	if (test_thread_flag(TIF_32BIT)) {
-		curareas = current->mm->context.low_htlb_areas;
+		int lastshift = 0;
+		u16 segmask, cursegs = current->mm->context.htlb_segs;
 
 		/* First see if we can do the mapping in the existing
-		 * low areas */
-		addr = htlb_get_low_area(len, curareas);
+		 * low hpage segments */
+		addr = htlb_get_low_area(len, cursegs);
 		if (addr != -ENOMEM)
 			return addr;
 
-		lastshift = 0;
-		for (areamask = LOW_ESID_MASK(0x100000000UL-len, len);
-		     ! lastshift; areamask >>=1) {
-			if (areamask & 1)
+		for (segmask = LOW_ESID_MASK(0x100000000UL-len, len);
+		     ! lastshift; segmask >>=1) {
+			if (segmask & 1)
 				lastshift = 1;
 
-			addr = htlb_get_low_area(len, curareas | areamask);
+			addr = htlb_get_low_area(len, cursegs | segmask);
 			if ((addr != -ENOMEM)
-			    && open_low_hpage_areas(current->mm, areamask) == 0)
+			    && open_low_hpage_segs(current->mm, segmask) == 0)
 				return addr;
 		}
+		printk(KERN_DEBUG "hugetlb_get_unmapped_area() unable to open"
+		       " enough segments\n");
+		return -ENOMEM;
 	} else {
-		curareas = current->mm->context.high_htlb_areas;
+		return htlb_get_high_area(len);
+	}
+}
 
-		/* First see if we can do the mapping in the existing
-		 * high areas */
-		addr = htlb_get_high_area(len, curareas);
-		if (addr != -ENOMEM)
-			return addr;
+void hugetlb_mm_free_pgd(struct mm_struct *mm)
+{
+	int i;
+	pgd_t *pgdir;
 
-		lastshift = 0;
-		for (areamask = HTLB_AREA_MASK(TASK_SIZE_USER64-len, len);
-		     ! lastshift; areamask >>=1) {
-			if (areamask & 1)
-				lastshift = 1;
+	spin_lock(&mm->page_table_lock);
 
-			addr = htlb_get_high_area(len, curareas | areamask);
-			if ((addr != -ENOMEM)
-			    && open_high_hpage_areas(current->mm, areamask) == 0)
-				return addr;
+	pgdir = mm->context.huge_pgdir;
+	if (! pgdir)
+		goto out;
+
+	mm->context.huge_pgdir = NULL;
+
+	/* cleanup any hugepte pages leftover */
+	for (i = 0; i < PTRS_PER_HUGEPGD; i++) {
+		pud_t *pud = (pud_t *)(pgdir + i);
+
+		if (! pud_none(*pud)) {
+			pte_t *pte = (pte_t *)pud_page(*pud);
+			struct page *ptepage = virt_to_page(pte);
+
+			ptepage->mapping = NULL;
+
+			BUG_ON(memcmp(pte, empty_zero_page, PAGE_SIZE));
+			kmem_cache_free(zero_cache, pte);
 		}
+		pud_clear(pud);
 	}
-	printk(KERN_DEBUG "hugetlb_get_unmapped_area() unable to open"
-	       " enough areas\n");
-	return -ENOMEM;
+
+	BUG_ON(memcmp(pgdir, empty_zero_page, PAGE_SIZE));
+	kmem_cache_free(zero_cache, pgdir);
+
+ out:
+	spin_unlock(&mm->page_table_lock);
 }
 
 int hash_huge_page(struct mm_struct *mm, unsigned long access,
diff --git a/trunk/arch/ppc64/mm/imalloc.c b/trunk/arch/ppc64/mm/imalloc.c
index c65b87b92756..b6e75b891ac0 100644
--- a/trunk/arch/ppc64/mm/imalloc.c
+++ b/trunk/arch/ppc64/mm/imalloc.c
@@ -31,7 +31,7 @@ static int get_free_im_addr(unsigned long size, unsigned long *im_addr)
 			break;
 		if ((unsigned long)tmp->addr >= ioremap_bot)
 			addr = tmp->size + (unsigned long) tmp->addr;
-		if (addr >= IMALLOC_END-size)
+		if (addr > IMALLOC_END-size) 
 			return 1;
 	}
 	*im_addr = addr;
diff --git a/trunk/arch/ppc64/mm/init.c b/trunk/arch/ppc64/mm/init.c
index c02dc9809ca5..e58a24d42879 100644
--- a/trunk/arch/ppc64/mm/init.c
+++ b/trunk/arch/ppc64/mm/init.c
@@ -42,6 +42,7 @@
 
 #include <asm/pgalloc.h>
 #include <asm/page.h>
+#include <asm/abs_addr.h>
 #include <asm/prom.h>
 #include <asm/lmb.h>
 #include <asm/rtas.h>
@@ -65,14 +66,6 @@
 #include <asm/vdso.h>
 #include <asm/imalloc.h>
 
-#if PGTABLE_RANGE > USER_VSID_RANGE
-#warning Limited user VSID range means pagetable space is wasted
-#endif
-
-#if (TASK_SIZE_USER64 < PGTABLE_RANGE) && (TASK_SIZE_USER64 < USER_VSID_RANGE)
-#warning TASK_SIZE is smaller than it needs to be.
-#endif
-
 int mem_init_done;
 unsigned long ioremap_bot = IMALLOC_BASE;
 static unsigned long phbs_io_bot = PHBS_IO_BASE;
@@ -166,6 +159,7 @@ static int map_io_page(unsigned long ea, unsigned long pa, int flags)
 		ptep = pte_alloc_kernel(&init_mm, pmdp, ea);
 		if (!ptep)
 			return -ENOMEM;
+		pa = abs_to_phys(pa);
 		set_pte_at(&init_mm, ea, ptep, pfn_pte(pa >> PAGE_SHIFT,
 							  __pgprot(flags)));
 		spin_unlock(&init_mm.page_table_lock);
@@ -232,7 +226,7 @@ void __iomem * __ioremap(unsigned long addr, unsigned long size,
 	 * Before that, we map using addresses going
 	 * up from ioremap_bot.  imalloc will use
 	 * the addresses from ioremap_bot through
-	 * IMALLOC_END
+	 * IMALLOC_END (0xE000001fffffffff)
 	 * 
 	 */
 	pa = addr & PAGE_MASK;
@@ -423,6 +417,12 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
 	int index;
 	int err;
 
+#ifdef CONFIG_HUGETLB_PAGE
+	/* We leave htlb_segs as it was, but for a fork, we need to
+	 * clear the huge_pgdir. */
+	mm->context.huge_pgdir = NULL;
+#endif
+
 again:
 	if (!idr_pre_get(&mmu_context_idr, GFP_KERNEL))
 		return -ENOMEM;
@@ -453,6 +453,8 @@ void destroy_context(struct mm_struct *mm)
 	spin_unlock(&mmu_context_lock);
 
 	mm->context.id = NO_CONTEXT;
+
+	hugetlb_mm_free_pgd(mm);
 }
 
 /*
@@ -482,9 +484,9 @@ void __init mm_init_ppc64(void)
 	for (i = 1; i < lmb.memory.cnt; i++) {
 		unsigned long base, prevbase, prevsize;
 
-		prevbase = lmb.memory.region[i-1].base;
+		prevbase = lmb.memory.region[i-1].physbase;
 		prevsize = lmb.memory.region[i-1].size;
-		base = lmb.memory.region[i].base;
+		base = lmb.memory.region[i].physbase;
 		if (base > (prevbase + prevsize)) {
 			io_hole_start = prevbase + prevsize;
 			io_hole_size = base  - (prevbase + prevsize);
@@ -511,8 +513,11 @@ int page_is_ram(unsigned long pfn)
 	for (i=0; i < lmb.memory.cnt; i++) {
 		unsigned long base;
 
+#ifdef CONFIG_MSCHUNKS
+		base = lmb.memory.region[i].physbase;
+#else
 		base = lmb.memory.region[i].base;
-
+#endif
 		if ((paddr >= base) &&
 			(paddr < (base + lmb.memory.region[i].size))) {
 			return 1;
@@ -542,7 +547,7 @@ void __init do_init_bootmem(void)
 	 */
 	bootmap_pages = bootmem_bootmap_pages(total_pages);
 
-	start = lmb_alloc(bootmap_pages<<PAGE_SHIFT, PAGE_SIZE);
+	start = abs_to_phys(lmb_alloc(bootmap_pages<<PAGE_SHIFT, PAGE_SIZE));
 	BUG_ON(!start);
 
 	boot_mapsize = init_bootmem(start >> PAGE_SHIFT, total_pages);
@@ -553,25 +558,25 @@ void __init do_init_bootmem(void)
 	 * present.
 	 */
 	for (i=0; i < lmb.memory.cnt; i++) {
-		unsigned long base, size;
+		unsigned long physbase, size;
 		unsigned long start_pfn, end_pfn;
 
-		base = lmb.memory.region[i].base;
+		physbase = lmb.memory.region[i].physbase;
 		size = lmb.memory.region[i].size;
 
-		start_pfn = base >> PAGE_SHIFT;
+		start_pfn = physbase >> PAGE_SHIFT;
 		end_pfn = start_pfn + (size >> PAGE_SHIFT);
 		memory_present(0, start_pfn, end_pfn);
 
-		free_bootmem(base, size);
+		free_bootmem(physbase, size);
 	}
 
 	/* reserve the sections we're already using */
 	for (i=0; i < lmb.reserved.cnt; i++) {
-		unsigned long base = lmb.reserved.region[i].base;
+		unsigned long physbase = lmb.reserved.region[i].physbase;
 		unsigned long size = lmb.reserved.region[i].size;
 
-		reserve_bootmem(base, size);
+		reserve_bootmem(physbase, size);
 	}
 }
 
@@ -610,10 +615,10 @@ static int __init setup_kcore(void)
 	int i;
 
 	for (i=0; i < lmb.memory.cnt; i++) {
-		unsigned long base, size;
+		unsigned long physbase, size;
 		struct kcore_list *kcore_mem;
 
-		base = lmb.memory.region[i].base;
+		physbase = lmb.memory.region[i].physbase;
 		size = lmb.memory.region[i].size;
 
 		/* GFP_ATOMIC to avoid might_sleep warnings during boot */
@@ -621,7 +626,7 @@ static int __init setup_kcore(void)
 		if (!kcore_mem)
 			panic("mem_init: kmalloc failed\n");
 
-		kclist_add(kcore_mem, __va(base), size);
+		kclist_add(kcore_mem, __va(physbase), size);
 	}
 
 	kclist_add(&kcore_vmem, (void *)VMALLOC_START, VMALLOC_END-VMALLOC_START);
@@ -681,6 +686,9 @@ void __init mem_init(void)
 
 	mem_init_done = 1;
 
+#ifdef CONFIG_PPC_ISERIES
+	iommu_vio_init();
+#endif
 	/* Initialize the vDSO */
 	vdso_init();
 }
@@ -825,43 +833,23 @@ void __iomem * reserve_phb_iospace(unsigned long size)
 	return virt_addr;
 }
 
-static void zero_ctor(void *addr, kmem_cache_t *cache, unsigned long flags)
+kmem_cache_t *zero_cache;
+
+static void zero_ctor(void *pte, kmem_cache_t *cache, unsigned long flags)
 {
-	memset(addr, 0, kmem_cache_size(cache));
+	memset(pte, 0, PAGE_SIZE);
 }
 
-static const int pgtable_cache_size[2] = {
-	PTE_TABLE_SIZE, PMD_TABLE_SIZE
-};
-static const char *pgtable_cache_name[ARRAY_SIZE(pgtable_cache_size)] = {
-	"pgd_pte_cache", "pud_pmd_cache",
-};
-
-kmem_cache_t *pgtable_cache[ARRAY_SIZE(pgtable_cache_size)];
-
 void pgtable_cache_init(void)
 {
-	int i;
-
-	BUILD_BUG_ON(PTE_TABLE_SIZE != pgtable_cache_size[PTE_CACHE_NUM]);
-	BUILD_BUG_ON(PMD_TABLE_SIZE != pgtable_cache_size[PMD_CACHE_NUM]);
-	BUILD_BUG_ON(PUD_TABLE_SIZE != pgtable_cache_size[PUD_CACHE_NUM]);
-	BUILD_BUG_ON(PGD_TABLE_SIZE != pgtable_cache_size[PGD_CACHE_NUM]);
-
-	for (i = 0; i < ARRAY_SIZE(pgtable_cache_size); i++) {
-		int size = pgtable_cache_size[i];
-		const char *name = pgtable_cache_name[i];
-
-		pgtable_cache[i] = kmem_cache_create(name,
-						     size, size,
-						     SLAB_HWCACHE_ALIGN
-						     | SLAB_MUST_HWCACHE_ALIGN,
-						     zero_ctor,
-						     NULL);
-		if (! pgtable_cache[i])
-			panic("pgtable_cache_init(): could not create %s!\n",
-			      name);
-	}
+	zero_cache = kmem_cache_create("zero",
+				PAGE_SIZE,
+				0,
+				SLAB_HWCACHE_ALIGN | SLAB_MUST_HWCACHE_ALIGN,
+				zero_ctor,
+				NULL);
+	if (!zero_cache)
+		panic("pgtable_cache_init(): could not create zero_cache!\n");
 }
 
 pgprot_t phys_mem_access_prot(struct file *file, unsigned long addr,
diff --git a/trunk/arch/ppc64/mm/numa.c b/trunk/arch/ppc64/mm/numa.c
index c3116f0d788c..0b191f2de016 100644
--- a/trunk/arch/ppc64/mm/numa.c
+++ b/trunk/arch/ppc64/mm/numa.c
@@ -671,7 +671,7 @@ void __init do_init_bootmem(void)
 		 * Mark reserved regions on this node
 		 */
 		for (i = 0; i < lmb.reserved.cnt; i++) {
-			unsigned long physbase = lmb.reserved.region[i].base;
+			unsigned long physbase = lmb.reserved.region[i].physbase;
 			unsigned long size = lmb.reserved.region[i].size;
 
 			if (pa_to_nid(physbase) != nid &&
diff --git a/trunk/arch/ppc64/mm/slb_low.S b/trunk/arch/ppc64/mm/slb_low.S
index 698d6b9ed6d1..8379d678f70f 100644
--- a/trunk/arch/ppc64/mm/slb_low.S
+++ b/trunk/arch/ppc64/mm/slb_low.S
@@ -89,29 +89,32 @@ END_FTR_SECTION_IFSET(CPU_FTR_16M_PAGE)
 	b	9f
 
 0:	/* user address: proto-VSID = context<<15 | ESID */
-	srdi.	r9,r3,USER_ESID_BITS
-	bne-	8f			/* invalid ea bits set */
-
-#ifdef CONFIG_HUGETLB_PAGE
-BEGIN_FTR_SECTION
-	lhz	r9,PACAHIGHHTLBAREAS(r13)
-	srdi	r11,r3,(HTLB_AREA_SHIFT-SID_SHIFT)
-	srd	r9,r9,r11
-	lhz	r11,PACALOWHTLBAREAS(r13)
-	srd	r11,r11,r3
-	or	r9,r9,r11
-END_FTR_SECTION_IFSET(CPU_FTR_16M_PAGE)
-#endif /* CONFIG_HUGETLB_PAGE */
-
 	li	r11,SLB_VSID_USER
 
+	srdi.	r9,r3,13
+	bne-	8f			/* invalid ea bits set */
+
 #ifdef CONFIG_HUGETLB_PAGE
 BEGIN_FTR_SECTION
-	rldimi	r11,r9,8,55		/* shift masked bit into SLB_VSID_L */
+	/* check against the hugepage ranges */
+	cmpldi	r3,(TASK_HPAGE_END>>SID_SHIFT)
+	bge	6f			/* >= TASK_HPAGE_END */
+	cmpldi	r3,(TASK_HPAGE_BASE>>SID_SHIFT)
+	bge	5f			/* TASK_HPAGE_BASE..TASK_HPAGE_END */
+	cmpldi	r3,16
+	bge	6f			/* 4GB..TASK_HPAGE_BASE */
+
+	lhz	r9,PACAHTLBSEGS(r13)
+	srd	r9,r9,r3
+	andi.	r9,r9,1
+	beq	6f
+
+5:	/* this is a hugepage user address */
+	li	r11,(SLB_VSID_USER|SLB_VSID_L)
 END_FTR_SECTION_IFSET(CPU_FTR_16M_PAGE)
 #endif /* CONFIG_HUGETLB_PAGE */
 
-	ld	r9,PACACONTEXTID(r13)
+6:	ld	r9,PACACONTEXTID(r13)
 	rldimi	r3,r9,USER_ESID_BITS,0
 
 9:	/* r3 = protovsid, r11 = flags, r10 = esid_data, cr7 = <>KERNELBASE */
diff --git a/trunk/arch/ppc64/mm/tlb.c b/trunk/arch/ppc64/mm/tlb.c
index d8a6593a13f0..26f0172c4527 100644
--- a/trunk/arch/ppc64/mm/tlb.c
+++ b/trunk/arch/ppc64/mm/tlb.c
@@ -41,58 +41,7 @@ DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
 DEFINE_PER_CPU(struct pte_freelist_batch *, pte_freelist_cur);
 unsigned long pte_freelist_forced_free;
 
-struct pte_freelist_batch
-{
-	struct rcu_head	rcu;
-	unsigned int	index;
-	pgtable_free_t	tables[0];
-};
-
-DEFINE_PER_CPU(struct pte_freelist_batch *, pte_freelist_cur);
-unsigned long pte_freelist_forced_free;
-
-#define PTE_FREELIST_SIZE \
-	((PAGE_SIZE - sizeof(struct pte_freelist_batch)) \
-	  / sizeof(pgtable_free_t))
-
-#ifdef CONFIG_SMP
-static void pte_free_smp_sync(void *arg)
-{
-	/* Do nothing, just ensure we sync with all CPUs */
-}
-#endif
-
-/* This is only called when we are critically out of memory
- * (and fail to get a page in pte_free_tlb).
- */
-static void pgtable_free_now(pgtable_free_t pgf)
-{
-	pte_freelist_forced_free++;
-
-	smp_call_function(pte_free_smp_sync, NULL, 0, 1);
-
-	pgtable_free(pgf);
-}
-
-static void pte_free_rcu_callback(struct rcu_head *head)
-{
-	struct pte_freelist_batch *batch =
-		container_of(head, struct pte_freelist_batch, rcu);
-	unsigned int i;
-
-	for (i = 0; i < batch->index; i++)
-		pgtable_free(batch->tables[i]);
-
-	free_page((unsigned long)batch);
-}
-
-static void pte_free_submit(struct pte_freelist_batch *batch)
-{
-	INIT_RCU_HEAD(&batch->rcu);
-	call_rcu(&batch->rcu, pte_free_rcu_callback);
-}
-
-void pgtable_free_tlb(struct mmu_gather *tlb, pgtable_free_t pgf)
+void __pte_free_tlb(struct mmu_gather *tlb, struct page *ptepage)
 {
 	/* This is safe as we are holding page_table_lock */
         cpumask_t local_cpumask = cpumask_of_cpu(smp_processor_id());
@@ -100,19 +49,19 @@ void pgtable_free_tlb(struct mmu_gather *tlb, pgtable_free_t pgf)
 
 	if (atomic_read(&tlb->mm->mm_users) < 2 ||
 	    cpus_equal(tlb->mm->cpu_vm_mask, local_cpumask)) {
-		pgtable_free(pgf);
+		pte_free(ptepage);
 		return;
 	}
 
 	if (*batchp == NULL) {
 		*batchp = (struct pte_freelist_batch *)__get_free_page(GFP_ATOMIC);
 		if (*batchp == NULL) {
-			pgtable_free_now(pgf);
+			pte_free_now(ptepage);
 			return;
 		}
 		(*batchp)->index = 0;
 	}
-	(*batchp)->tables[(*batchp)->index++] = pgf;
+	(*batchp)->pages[(*batchp)->index++] = ptepage;
 	if ((*batchp)->index == PTE_FREELIST_SIZE) {
 		pte_free_submit(*batchp);
 		*batchp = NULL;
@@ -183,6 +132,42 @@ void __flush_tlb_pending(struct ppc64_tlb_batch *batch)
 	put_cpu();
 }
 
+#ifdef CONFIG_SMP
+static void pte_free_smp_sync(void *arg)
+{
+	/* Do nothing, just ensure we sync with all CPUs */
+}
+#endif
+
+/* This is only called when we are critically out of memory
+ * (and fail to get a page in pte_free_tlb).
+ */
+void pte_free_now(struct page *ptepage)
+{
+	pte_freelist_forced_free++;
+
+	smp_call_function(pte_free_smp_sync, NULL, 0, 1);
+
+	pte_free(ptepage);
+}
+
+static void pte_free_rcu_callback(struct rcu_head *head)
+{
+	struct pte_freelist_batch *batch =
+		container_of(head, struct pte_freelist_batch, rcu);
+	unsigned int i;
+
+	for (i = 0; i < batch->index; i++)
+		pte_free(batch->pages[i]);
+	free_page((unsigned long)batch);
+}
+
+void pte_free_submit(struct pte_freelist_batch *batch)
+{
+	INIT_RCU_HEAD(&batch->rcu);
+	call_rcu(&batch->rcu, pte_free_rcu_callback);
+}
+
 void pte_free_finish(void)
 {
 	/* This is safe as we are holding page_table_lock */
diff --git a/trunk/arch/ppc64/oprofile/common.c b/trunk/arch/ppc64/oprofile/common.c
index 4acd1a424933..b28bfda23d94 100644
--- a/trunk/arch/ppc64/oprofile/common.c
+++ b/trunk/arch/ppc64/oprofile/common.c
@@ -153,7 +153,6 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
 
 		case PV_970:
 		case PV_970FX:
-		case PV_970MP:
 			model = &op_model_power4;
 			model->num_counters = 8;
 			ops->cpu_type = "ppc64/970";
diff --git a/trunk/arch/ppc64/xmon/start.c b/trunk/arch/ppc64/xmon/start.c
index f86b584acd76..a9265bcc79b2 100644
--- a/trunk/arch/ppc64/xmon/start.c
+++ b/trunk/arch/ppc64/xmon/start.c
@@ -27,7 +27,7 @@ static void sysrq_handle_xmon(int key, struct pt_regs *pt_regs,
 			      struct tty_struct *tty) 
 {
 	/* ensure xmon is enabled */
-	xmon_init(1);
+	xmon_init();
 	debugger(pt_regs);
 }
 
diff --git a/trunk/arch/ppc64/xmon/xmon.c b/trunk/arch/ppc64/xmon/xmon.c
index 45908b10acd3..05539439e6bc 100644
--- a/trunk/arch/ppc64/xmon/xmon.c
+++ b/trunk/arch/ppc64/xmon/xmon.c
@@ -2496,25 +2496,15 @@ static void dump_stab(void)
 	}
 }
 
-void xmon_init(int enable)
-{
-	if (enable) {
-		__debugger = xmon;
-		__debugger_ipi = xmon_ipi;
-		__debugger_bpt = xmon_bpt;
-		__debugger_sstep = xmon_sstep;
-		__debugger_iabr_match = xmon_iabr_match;
-		__debugger_dabr_match = xmon_dabr_match;
-		__debugger_fault_handler = xmon_fault_handler;
-	} else {
-		__debugger = NULL;
-		__debugger_ipi = NULL;
-		__debugger_bpt = NULL;
-		__debugger_sstep = NULL;
-		__debugger_iabr_match = NULL;
-		__debugger_dabr_match = NULL;
-		__debugger_fault_handler = NULL;
-	}
+void xmon_init(void)
+{
+	__debugger = xmon;
+	__debugger_ipi = xmon_ipi;
+	__debugger_bpt = xmon_bpt;
+	__debugger_sstep = xmon_sstep;
+	__debugger_iabr_match = xmon_iabr_match;
+	__debugger_dabr_match = xmon_dabr_match;
+	__debugger_fault_handler = xmon_fault_handler;
 }
 
 void dump_segments(void)
diff --git a/trunk/arch/sparc/kernel/setup.c b/trunk/arch/sparc/kernel/setup.c
index 53c192a4982f..55352ed85e8a 100644
--- a/trunk/arch/sparc/kernel/setup.c
+++ b/trunk/arch/sparc/kernel/setup.c
@@ -32,6 +32,7 @@
 #include <linux/spinlock.h>
 #include <linux/root_dev.h>
 
+#include <asm/segment.h>
 #include <asm/system.h>
 #include <asm/io.h>
 #include <asm/processor.h>
diff --git a/trunk/arch/sparc/kernel/tick14.c b/trunk/arch/sparc/kernel/tick14.c
index 591547af4c65..fd8005a3e6bd 100644
--- a/trunk/arch/sparc/kernel/tick14.c
+++ b/trunk/arch/sparc/kernel/tick14.c
@@ -19,6 +19,7 @@
 #include <linux/interrupt.h>
 
 #include <asm/oplib.h>
+#include <asm/segment.h>
 #include <asm/timer.h>
 #include <asm/mostek.h>
 #include <asm/system.h>
diff --git a/trunk/arch/sparc/kernel/time.c b/trunk/arch/sparc/kernel/time.c
index 3b759aefc170..6486cbf2efe9 100644
--- a/trunk/arch/sparc/kernel/time.c
+++ b/trunk/arch/sparc/kernel/time.c
@@ -32,6 +32,7 @@
 #include <linux/profile.h>
 
 #include <asm/oplib.h>
+#include <asm/segment.h>
 #include <asm/timer.h>
 #include <asm/mostek.h>
 #include <asm/system.h>
diff --git a/trunk/arch/sparc/mm/fault.c b/trunk/arch/sparc/mm/fault.c
index 2bbd53f3cafb..37f4107bae66 100644
--- a/trunk/arch/sparc/mm/fault.c
+++ b/trunk/arch/sparc/mm/fault.c
@@ -23,6 +23,7 @@
 #include <linux/module.h>
 
 #include <asm/system.h>
+#include <asm/segment.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/memreg.h>
diff --git a/trunk/arch/sparc/mm/init.c b/trunk/arch/sparc/mm/init.c
index c03babaa0498..ec2e05028a10 100644
--- a/trunk/arch/sparc/mm/init.c
+++ b/trunk/arch/sparc/mm/init.c
@@ -25,6 +25,7 @@
 #include <linux/bootmem.h>
 
 #include <asm/system.h>
+#include <asm/segment.h>
 #include <asm/vac-ops.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
diff --git a/trunk/arch/sparc64/kernel/entry.S b/trunk/arch/sparc64/kernel/entry.S
index cecdc0a7521f..88332f00094a 100644
--- a/trunk/arch/sparc64/kernel/entry.S
+++ b/trunk/arch/sparc64/kernel/entry.S
@@ -21,7 +21,6 @@
 #include <asm/visasm.h>
 #include <asm/estate.h>
 #include <asm/auxio.h>
-#include <asm/sfafsr.h>
 
 #define curptr      g6
 
@@ -691,159 +690,14 @@ netbsd_syscall:
 	retl
 	 nop
 
-	/* We need to carefully read the error status, ACK
-	 * the errors, prevent recursive traps, and pass the
-	 * information on to C code for logging.
-	 *
-	 * We pass the AFAR in as-is, and we encode the status
-	 * information as described in asm-sparc64/sfafsr.h
-	 */
-	.globl		__spitfire_access_error
-__spitfire_access_error:
-	/* Disable ESTATE error reporting so that we do not
-	 * take recursive traps and RED state the processor.
-	 */
-	stxa		%g0, [%g0] ASI_ESTATE_ERROR_EN
-	membar		#Sync
-
-	mov		UDBE_UE, %g1
-	ldxa		[%g0] ASI_AFSR, %g4	! Get AFSR
-
-	/* __spitfire_cee_trap branches here with AFSR in %g4 and
-	 * UDBE_CE in %g1.  It only clears ESTATE_ERR_CE in the
-	 * ESTATE Error Enable register.
-	 */
-__spitfire_cee_trap_continue:
-	ldxa		[%g0] ASI_AFAR, %g5	! Get AFAR
-
-	rdpr		%tt, %g3
-	and		%g3, 0x1ff, %g3		! Paranoia
-	sllx		%g3, SFSTAT_TRAP_TYPE_SHIFT, %g3
-	or		%g4, %g3, %g4
-	rdpr		%tl, %g3
-	cmp		%g3, 1
-	mov		1, %g3
-	bleu		%xcc, 1f
-	 sllx		%g3, SFSTAT_TL_GT_ONE_SHIFT, %g3
-
-	or		%g4, %g3, %g4
-
-	/* Read in the UDB error register state, clearing the
-	 * sticky error bits as-needed.  We only clear them if
-	 * the UE bit is set.  Likewise, __spitfire_cee_trap
-	 * below will only do so if the CE bit is set.
-	 *
-	 * NOTE: UltraSparc-I/II have high and low UDB error
-	 *       registers, corresponding to the two UDB units
-	 *       present on those chips.  UltraSparc-IIi only
-	 *       has a single UDB, called "SDB" in the manual.
-	 *       For IIi the upper UDB register always reads
-	 *       as zero so for our purposes things will just
-	 *       work with the checks below.
+	/* These next few routines must be sure to clear the
+	 * SFSR FaultValid bit so that the fast tlb data protection
+	 * handler does not flush the wrong context and lock up the
+	 * box.
 	 */
-1:	ldxa		[%g0] ASI_UDBH_ERROR_R, %g3
-	and		%g3, 0x3ff, %g7		! Paranoia
-	sllx		%g7, SFSTAT_UDBH_SHIFT, %g7
-	or		%g4, %g7, %g4
-	andcc		%g3, %g1, %g3		! UDBE_UE or UDBE_CE
-	be,pn		%xcc, 1f
-	 nop
-	stxa		%g3, [%g0] ASI_UDB_ERROR_W
-	membar		#Sync
-
-1:	mov		0x18, %g3
-	ldxa		[%g3] ASI_UDBL_ERROR_R, %g3
-	and		%g3, 0x3ff, %g7		! Paranoia
-	sllx		%g7, SFSTAT_UDBL_SHIFT, %g7
-	or		%g4, %g7, %g4
-	andcc		%g3, %g1, %g3		! UDBE_UE or UDBE_CE
-	be,pn		%xcc, 1f
-	 nop
-	mov		0x18, %g7
-	stxa		%g3, [%g7] ASI_UDB_ERROR_W
-	membar		#Sync
-
-1:	/* Ok, now that we've latched the error state,
-	 * clear the sticky bits in the AFSR.
-	 */
-	stxa		%g4, [%g0] ASI_AFSR
-	membar		#Sync
-
-	rdpr		%tl, %g2
-	cmp		%g2, 1
-	rdpr		%pil, %g2
-	bleu,pt		%xcc, 1f
-	 wrpr		%g0, 15, %pil
-
-	ba,pt		%xcc, etraptl1
-	 rd		%pc, %g7
-
-	ba,pt		%xcc, 2f
-	 nop
-
-1:	ba,pt		%xcc, etrap_irq
-	 rd		%pc, %g7
-
-2:	mov		%l4, %o1
-	mov		%l5, %o2
-	call		spitfire_access_error
-	 add		%sp, PTREGS_OFF, %o0
-	ba,pt		%xcc, rtrap
-	 clr		%l6
-
-	/* This is the trap handler entry point for ECC correctable
-	 * errors.  They are corrected, but we listen for the trap
-	 * so that the event can be logged.
-	 *
-	 * Disrupting errors are either:
-	 * 1) single-bit ECC errors during UDB reads to system
-	 *    memory
-	 * 2) data parity errors during write-back events
-	 *
-	 * As far as I can make out from the manual, the CEE trap
-	 * is only for correctable errors during memory read
-	 * accesses by the front-end of the processor.
-	 *
-	 * The code below is only for trap level 1 CEE events,
-	 * as it is the only situation where we can safely record
-	 * and log.  For trap level >1 we just clear the CE bit
-	 * in the AFSR and return.
-	 *
-	 * This is just like __spiftire_access_error above, but it
-	 * specifically handles correctable errors.  If an
-	 * uncorrectable error is indicated in the AFSR we
-	 * will branch directly above to __spitfire_access_error
-	 * to handle it instead.  Uncorrectable therefore takes
-	 * priority over correctable, and the error logging
-	 * C code will notice this case by inspecting the
-	 * trap type.
-	 */
-	.globl		__spitfire_cee_trap
-__spitfire_cee_trap:
-	ldxa		[%g0] ASI_AFSR, %g4	! Get AFSR
-	mov		1, %g3
-	sllx		%g3, SFAFSR_UE_SHIFT, %g3
-	andcc		%g4, %g3, %g0		! Check for UE
-	bne,pn		%xcc, __spitfire_access_error
-	 nop
-
-	/* Ok, in this case we only have a correctable error.
-	 * Indicate we only wish to capture that state in register
-	 * %g1, and we only disable CE error reporting unlike UE
-	 * handling which disables all errors.
-	 */
-	ldxa		[%g0] ASI_ESTATE_ERROR_EN, %g3
-	andn		%g3, ESTATE_ERR_CE, %g3
-	stxa		%g3, [%g0] ASI_ESTATE_ERROR_EN
-	membar		#Sync
-
-	/* Preserve AFSR in %g4, indicate UDB state to capture in %g1 */
-	ba,pt		%xcc, __spitfire_cee_trap_continue
-	 mov		UDBE_CE, %g1
-
-	.globl		__spitfire_data_access_exception
-	.globl		__spitfire_data_access_exception_tl1
-__spitfire_data_access_exception_tl1:
+	.globl		__do_data_access_exception
+	.globl		__do_data_access_exception_tl1
+__do_data_access_exception_tl1:
 	rdpr		%pstate, %g4
 	wrpr		%g4, PSTATE_MG|PSTATE_AG, %pstate
 	mov		TLB_SFSR, %g3
@@ -852,25 +706,9 @@ __spitfire_data_access_exception_tl1:
 	ldxa		[%g5] ASI_DMMU, %g5	! Get SFAR
 	stxa		%g0, [%g3] ASI_DMMU	! Clear SFSR.FaultValid bit
 	membar		#Sync
-	rdpr		%tt, %g3
-	cmp		%g3, 0x80		! first win spill/fill trap
-	blu,pn		%xcc, 1f
-	 cmp		%g3, 0xff		! last win spill/fill trap
-	bgu,pn		%xcc, 1f
-	 nop
 	ba,pt		%xcc, winfix_dax
 	 rdpr		%tpc, %g3
-1:	sethi		%hi(109f), %g7
-	ba,pt		%xcc, etraptl1
-109:	 or		%g7, %lo(109b), %g7
-	mov		%l4, %o1
-	mov		%l5, %o2
-	call		spitfire_data_access_exception_tl1
-	 add		%sp, PTREGS_OFF, %o0
-	ba,pt		%xcc, rtrap
-	 clr		%l6
-
-__spitfire_data_access_exception:
+__do_data_access_exception:
 	rdpr		%pstate, %g4
 	wrpr		%g4, PSTATE_MG|PSTATE_AG, %pstate
 	mov		TLB_SFSR, %g3
@@ -884,19 +722,20 @@ __spitfire_data_access_exception:
 109:	 or		%g7, %lo(109b), %g7
 	mov		%l4, %o1
 	mov		%l5, %o2
-	call		spitfire_data_access_exception
+	call		data_access_exception
 	 add		%sp, PTREGS_OFF, %o0
 	ba,pt		%xcc, rtrap
 	 clr		%l6
 
-	.globl		__spitfire_insn_access_exception
-	.globl		__spitfire_insn_access_exception_tl1
-__spitfire_insn_access_exception_tl1:
+	.globl		__do_instruction_access_exception
+	.globl		__do_instruction_access_exception_tl1
+__do_instruction_access_exception_tl1:
 	rdpr		%pstate, %g4
 	wrpr		%g4, PSTATE_MG|PSTATE_AG, %pstate
 	mov		TLB_SFSR, %g3
-	ldxa		[%g3] ASI_IMMU, %g4	! Get SFSR
-	rdpr		%tpc, %g5		! IMMU has no SFAR, use TPC
+	mov		DMMU_SFAR, %g5
+	ldxa		[%g3] ASI_DMMU, %g4	! Get SFSR
+	ldxa		[%g5] ASI_DMMU, %g5	! Get SFAR
 	stxa		%g0, [%g3] ASI_IMMU	! Clear FaultValid bit
 	membar		#Sync
 	sethi		%hi(109f), %g7
@@ -904,17 +743,18 @@ __spitfire_insn_access_exception_tl1:
 109:	 or		%g7, %lo(109b), %g7
 	mov		%l4, %o1
 	mov		%l5, %o2
-	call		spitfire_insn_access_exception_tl1
+	call		instruction_access_exception_tl1
 	 add		%sp, PTREGS_OFF, %o0
 	ba,pt		%xcc, rtrap
 	 clr		%l6
 
-__spitfire_insn_access_exception:
+__do_instruction_access_exception:
 	rdpr		%pstate, %g4
 	wrpr		%g4, PSTATE_MG|PSTATE_AG, %pstate
 	mov		TLB_SFSR, %g3
-	ldxa		[%g3] ASI_IMMU, %g4	! Get SFSR
-	rdpr		%tpc, %g5		! IMMU has no SFAR, use TPC
+	mov		DMMU_SFAR, %g5
+	ldxa		[%g3] ASI_DMMU, %g4	! Get SFSR
+	ldxa		[%g5] ASI_DMMU, %g5	! Get SFAR
 	stxa		%g0, [%g3] ASI_IMMU	! Clear FaultValid bit
 	membar		#Sync
 	sethi		%hi(109f), %g7
@@ -922,11 +762,102 @@ __spitfire_insn_access_exception:
 109:	 or		%g7, %lo(109b), %g7
 	mov		%l4, %o1
 	mov		%l5, %o2
-	call		spitfire_insn_access_exception
+	call		instruction_access_exception
 	 add		%sp, PTREGS_OFF, %o0
 	ba,pt		%xcc, rtrap
 	 clr		%l6
 
+	/* This is the trap handler entry point for ECC correctable
+	 * errors.  They are corrected, but we listen for the trap
+	 * so that the event can be logged.
+	 *
+	 * Disrupting errors are either:
+	 * 1) single-bit ECC errors during UDB reads to system
+	 *    memory
+	 * 2) data parity errors during write-back events
+	 *
+	 * As far as I can make out from the manual, the CEE trap
+	 * is only for correctable errors during memory read
+	 * accesses by the front-end of the processor.
+	 *
+	 * The code below is only for trap level 1 CEE events,
+	 * as it is the only situation where we can safely record
+	 * and log.  For trap level >1 we just clear the CE bit
+	 * in the AFSR and return.
+	 */
+
+	/* Our trap handling infrastructure allows us to preserve
+	 * two 64-bit values during etrap for arguments to
+	 * subsequent C code.  Therefore we encode the information
+	 * as follows:
+	 *
+	 * value 1) Full 64-bits of AFAR
+	 * value 2) Low 33-bits of AFSR, then bits 33-->42
+	 *          are UDBL error status and bits 43-->52
+	 *          are UDBH error status
+	 */
+	.align	64
+	.globl	cee_trap
+cee_trap:
+	ldxa	[%g0] ASI_AFSR, %g1		! Read AFSR
+	ldxa	[%g0] ASI_AFAR, %g2		! Read AFAR
+	sllx	%g1, 31, %g1			! Clear reserved bits
+	srlx	%g1, 31, %g1			! in AFSR
+
+	/* NOTE: UltraSparc-I/II have high and low UDB error
+	 *       registers, corresponding to the two UDB units
+	 *       present on those chips.  UltraSparc-IIi only
+	 *       has a single UDB, called "SDB" in the manual.
+	 *       For IIi the upper UDB register always reads
+	 *       as zero so for our purposes things will just
+	 *       work with the checks below.
+	 */
+	ldxa	[%g0] ASI_UDBL_ERROR_R, %g3	! Read UDB-Low error status
+	andcc	%g3, (1 << 8), %g4		! Check CE bit
+	sllx	%g3, (64 - 10), %g3		! Clear reserved bits
+	srlx	%g3, (64 - 10), %g3		! in UDB-Low error status
+
+	sllx	%g3, (33 + 0), %g3		! Shift up to encoding area
+	or	%g1, %g3, %g1			! Or it in
+	be,pn	%xcc, 1f			! Branch if CE bit was clear
+	 nop
+	stxa	%g4, [%g0] ASI_UDB_ERROR_W	! Clear CE sticky bit in UDBL
+	membar	#Sync				! Synchronize ASI stores
+1:	mov	0x18, %g5			! Addr of UDB-High error status
+	ldxa	[%g5] ASI_UDBH_ERROR_R, %g3	! Read it
+
+	andcc	%g3, (1 << 8), %g4		! Check CE bit
+	sllx	%g3, (64 - 10), %g3		! Clear reserved bits
+	srlx	%g3, (64 - 10), %g3		! in UDB-High error status
+	sllx	%g3, (33 + 10), %g3		! Shift up to encoding area
+	or	%g1, %g3, %g1			! Or it in
+	be,pn	%xcc, 1f			! Branch if CE bit was clear
+	 nop
+	nop
+
+	stxa	%g4, [%g5] ASI_UDB_ERROR_W	! Clear CE sticky bit in UDBH
+	membar	#Sync				! Synchronize ASI stores
+1:	mov	1, %g5				! AFSR CE bit is
+	sllx	%g5, 20, %g5			! bit 20
+	stxa	%g5, [%g0] ASI_AFSR		! Clear CE sticky bit in AFSR
+	membar	#Sync				! Synchronize ASI stores
+	sllx	%g2, (64 - 41), %g2		! Clear reserved bits
+	srlx	%g2, (64 - 41), %g2		! in latched AFAR
+
+	andn	%g2, 0x0f, %g2			! Finish resv bit clearing
+	mov	%g1, %g4			! Move AFSR+UDB* into save reg
+	mov	%g2, %g5			! Move AFAR into save reg
+	rdpr	%pil, %g2
+	wrpr	%g0, 15, %pil
+	ba,pt	%xcc, etrap_irq
+	 rd	%pc, %g7
+	mov	%l4, %o0
+
+	mov	%l5, %o1
+	call	cee_log
+	 add	%sp, PTREGS_OFF, %o2
+	ba,a,pt	%xcc, rtrap_irq
+
 	/* Capture I/D/E-cache state into per-cpu error scoreboard.
 	 *
 	 * %g1:		(TL>=0) ? 1 : 0
diff --git a/trunk/arch/sparc64/kernel/pci_iommu.c b/trunk/arch/sparc64/kernel/pci_iommu.c
index 425c60cfea19..2803bc7c2c79 100644
--- a/trunk/arch/sparc64/kernel/pci_iommu.c
+++ b/trunk/arch/sparc64/kernel/pci_iommu.c
@@ -466,7 +466,7 @@ static void pci_strbuf_flush(struct pci_strbuf *strbuf, struct pci_iommu *iommu,
 		if (!limit)
 			break;
 		udelay(1);
-		rmb();
+		membar("#LoadLoad");
 	}
 	if (!limit)
 		printk(KERN_WARNING "pci_strbuf_flush: flushflag timeout "
diff --git a/trunk/arch/sparc64/kernel/process.c b/trunk/arch/sparc64/kernel/process.c
index 66255434128a..07424b075938 100644
--- a/trunk/arch/sparc64/kernel/process.c
+++ b/trunk/arch/sparc64/kernel/process.c
@@ -103,7 +103,7 @@ void cpu_idle(void)
 		 * other cpus see our increasing idleness for the buddy
 		 * redistribution algorithm.  -DaveM
 		 */
-		membar_storeload_storestore();
+		membar("#StoreStore | #StoreLoad");
 	}
 }
 
diff --git a/trunk/arch/sparc64/kernel/sbus.c b/trunk/arch/sparc64/kernel/sbus.c
index e09ddf927655..89f5e019f24c 100644
--- a/trunk/arch/sparc64/kernel/sbus.c
+++ b/trunk/arch/sparc64/kernel/sbus.c
@@ -147,7 +147,7 @@ static void sbus_strbuf_flush(struct sbus_iommu *iommu, u32 base, unsigned long
 		if (!limit)
 			break;
 		udelay(1);
-		rmb();
+		membar("#LoadLoad");
 	}
 	if (!limit)
 		printk(KERN_WARNING "sbus_strbuf_flush: flushflag timeout "
diff --git a/trunk/arch/sparc64/kernel/setup.c b/trunk/arch/sparc64/kernel/setup.c
index fbdfed3798d8..b7e6a91952b2 100644
--- a/trunk/arch/sparc64/kernel/setup.c
+++ b/trunk/arch/sparc64/kernel/setup.c
@@ -33,6 +33,7 @@
 #include <linux/cpu.h>
 #include <linux/initrd.h>
 
+#include <asm/segment.h>
 #include <asm/system.h>
 #include <asm/io.h>
 #include <asm/processor.h>
diff --git a/trunk/arch/sparc64/kernel/signal32.c b/trunk/arch/sparc64/kernel/signal32.c
index aecccd0df1d1..b1ed23091fbb 100644
--- a/trunk/arch/sparc64/kernel/signal32.c
+++ b/trunk/arch/sparc64/kernel/signal32.c
@@ -877,12 +877,11 @@ static void new_setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
 			unsigned long page = (unsigned long)
 				page_address(pte_page(*ptep));
 
-			wmb();
-			__asm__ __volatile__("flush	%0 + %1"
-					     : /* no outputs */
-					     : "r" (page),
-					       "r" (address & (PAGE_SIZE - 1))
-					     : "memory");
+			__asm__ __volatile__(
+			"	membar	#StoreStore\n"
+			"	flush	%0 + %1"
+			: : "r" (page), "r" (address & (PAGE_SIZE - 1))
+			: "memory");
 		}
 		pte_unmap(ptep);
 		preempt_enable();
@@ -1293,12 +1292,11 @@ static void setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
 			unsigned long page = (unsigned long)
 				page_address(pte_page(*ptep));
 
-			wmb();
-			__asm__ __volatile__("flush	%0 + %1"
-					     : /* no outputs */
-					     : "r" (page),
-					       "r" (address & (PAGE_SIZE - 1))
-					     : "memory");
+			__asm__ __volatile__(
+			"	membar	#StoreStore\n"
+			"	flush	%0 + %1"
+			: : "r" (page), "r" (address & (PAGE_SIZE - 1))
+			: "memory");
 		}
 		pte_unmap(ptep);
 		preempt_enable();
diff --git a/trunk/arch/sparc64/kernel/smp.c b/trunk/arch/sparc64/kernel/smp.c
index b4fc6a5462b2..b9b42491e118 100644
--- a/trunk/arch/sparc64/kernel/smp.c
+++ b/trunk/arch/sparc64/kernel/smp.c
@@ -144,7 +144,7 @@ void __init smp_callin(void)
 	current->active_mm = &init_mm;
 
 	while (!cpu_isset(cpuid, smp_commenced_mask))
-		rmb();
+		membar("#LoadLoad");
 
 	cpu_set(cpuid, cpu_online_map);
 }
@@ -184,11 +184,11 @@ static inline long get_delta (long *rt, long *master)
 	for (i = 0; i < NUM_ITERS; i++) {
 		t0 = tick_ops->get_tick();
 		go[MASTER] = 1;
-		membar_storeload();
+		membar("#StoreLoad");
 		while (!(tm = go[SLAVE]))
-			rmb();
+			membar("#LoadLoad");
 		go[SLAVE] = 0;
-		wmb();
+		membar("#StoreStore");
 		t1 = tick_ops->get_tick();
 
 		if (t1 - t0 < best_t1 - best_t0)
@@ -221,7 +221,7 @@ void smp_synchronize_tick_client(void)
 	go[MASTER] = 1;
 
 	while (go[MASTER])
-		rmb();
+		membar("#LoadLoad");
 
 	local_irq_save(flags);
 	{
@@ -273,21 +273,21 @@ static void smp_synchronize_one_tick(int cpu)
 
 	/* wait for client to be ready */
 	while (!go[MASTER])
-		rmb();
+		membar("#LoadLoad");
 
 	/* now let the client proceed into his loop */
 	go[MASTER] = 0;
-	membar_storeload();
+	membar("#StoreLoad");
 
 	spin_lock_irqsave(&itc_sync_lock, flags);
 	{
 		for (i = 0; i < NUM_ROUNDS*NUM_ITERS; i++) {
 			while (!go[MASTER])
-				rmb();
+				membar("#LoadLoad");
 			go[MASTER] = 0;
-			wmb();
+			membar("#StoreStore");
 			go[SLAVE] = tick_ops->get_tick();
-			membar_storeload();
+			membar("#StoreLoad");
 		}
 	}
 	spin_unlock_irqrestore(&itc_sync_lock, flags);
@@ -927,11 +927,11 @@ void smp_capture(void)
 		       smp_processor_id());
 #endif
 		penguins_are_doing_time = 1;
-		membar_storestore_loadstore();
+		membar("#StoreStore | #LoadStore");
 		atomic_inc(&smp_capture_registry);
 		smp_cross_call(&xcall_capture, 0, 0, 0);
 		while (atomic_read(&smp_capture_registry) != ncpus)
-			rmb();
+			membar("#LoadLoad");
 #ifdef CAPTURE_DEBUG
 		printk("done\n");
 #endif
@@ -947,7 +947,7 @@ void smp_release(void)
 		       smp_processor_id());
 #endif
 		penguins_are_doing_time = 0;
-		membar_storeload_storestore();
+		membar("#StoreStore | #StoreLoad");
 		atomic_dec(&smp_capture_registry);
 	}
 }
@@ -970,9 +970,9 @@ void smp_penguin_jailcell(int irq, struct pt_regs *regs)
 	save_alternate_globals(global_save);
 	prom_world(1);
 	atomic_inc(&smp_capture_registry);
-	membar_storeload_storestore();
+	membar("#StoreLoad | #StoreStore");
 	while (penguins_are_doing_time)
-		rmb();
+		membar("#LoadLoad");
 	restore_alternate_globals(global_save);
 	atomic_dec(&smp_capture_registry);
 	prom_world(0);
diff --git a/trunk/arch/sparc64/kernel/sparc64_ksyms.c b/trunk/arch/sparc64/kernel/sparc64_ksyms.c
index a3ea697f1adb..9202d925a9ce 100644
--- a/trunk/arch/sparc64/kernel/sparc64_ksyms.c
+++ b/trunk/arch/sparc64/kernel/sparc64_ksyms.c
@@ -99,6 +99,17 @@ extern int __ashrdi3(int, int);
 extern void dump_thread(struct pt_regs *, struct user *);
 extern int dump_fpu (struct pt_regs * regs, elf_fpregset_t * fpregs);
 
+#if defined(CONFIG_SMP) && defined(CONFIG_DEBUG_SPINLOCK)
+extern void _do_spin_lock (spinlock_t *lock, char *str);
+extern void _do_spin_unlock (spinlock_t *lock);
+extern int _spin_trylock (spinlock_t *lock);
+extern void _do_read_lock(rwlock_t *rw, char *str);
+extern void _do_read_unlock(rwlock_t *rw, char *str);
+extern void _do_write_lock(rwlock_t *rw, char *str);
+extern void _do_write_unlock(rwlock_t *rw);
+extern int _do_write_trylock(rwlock_t *rw, char *str);
+#endif
+
 extern unsigned long phys_base;
 extern unsigned long pfn_base;
 
@@ -141,6 +152,18 @@ EXPORT_SYMBOL(_mcount);
 EXPORT_SYMBOL(cpu_online_map);
 EXPORT_SYMBOL(phys_cpu_present_map);
 
+/* Spinlock debugging library, optional. */
+#ifdef CONFIG_DEBUG_SPINLOCK
+EXPORT_SYMBOL(_do_spin_lock);
+EXPORT_SYMBOL(_do_spin_unlock);
+EXPORT_SYMBOL(_spin_trylock);
+EXPORT_SYMBOL(_do_read_lock);
+EXPORT_SYMBOL(_do_read_unlock);
+EXPORT_SYMBOL(_do_write_lock);
+EXPORT_SYMBOL(_do_write_unlock);
+EXPORT_SYMBOL(_do_write_trylock);
+#endif
+
 EXPORT_SYMBOL(smp_call_function);
 #endif /* CONFIG_SMP */
 
@@ -406,12 +429,3 @@ EXPORT_SYMBOL(xor_vis_4);
 EXPORT_SYMBOL(xor_vis_5);
 
 EXPORT_SYMBOL(prom_palette);
-
-/* memory barriers */
-EXPORT_SYMBOL(mb);
-EXPORT_SYMBOL(rmb);
-EXPORT_SYMBOL(wmb);
-EXPORT_SYMBOL(membar_storeload);
-EXPORT_SYMBOL(membar_storeload_storestore);
-EXPORT_SYMBOL(membar_storeload_loadload);
-EXPORT_SYMBOL(membar_storestore_loadstore);
diff --git a/trunk/arch/sparc64/kernel/traps.c b/trunk/arch/sparc64/kernel/traps.c
index b280b2ef674f..0c9e54b2f0c8 100644
--- a/trunk/arch/sparc64/kernel/traps.c
+++ b/trunk/arch/sparc64/kernel/traps.c
@@ -33,7 +33,6 @@
 #include <asm/dcu.h>
 #include <asm/estate.h>
 #include <asm/chafsr.h>
-#include <asm/sfafsr.h>
 #include <asm/psrcompat.h>
 #include <asm/processor.h>
 #include <asm/timer.h>
@@ -144,7 +143,8 @@ void do_BUG(const char *file, int line)
 }
 #endif
 
-void spitfire_insn_access_exception(struct pt_regs *regs, unsigned long sfsr, unsigned long sfar)
+void instruction_access_exception(struct pt_regs *regs,
+				  unsigned long sfsr, unsigned long sfar)
 {
 	siginfo_t info;
 
@@ -153,8 +153,8 @@ void spitfire_insn_access_exception(struct pt_regs *regs, unsigned long sfsr, un
 		return;
 
 	if (regs->tstate & TSTATE_PRIV) {
-		printk("spitfire_insn_access_exception: SFSR[%016lx] "
-		       "SFAR[%016lx], going.\n", sfsr, sfar);
+		printk("instruction_access_exception: SFSR[%016lx] SFAR[%016lx], going.\n",
+		       sfsr, sfar);
 		die_if_kernel("Iax", regs);
 	}
 	if (test_thread_flag(TIF_32BIT)) {
@@ -169,17 +169,19 @@ void spitfire_insn_access_exception(struct pt_regs *regs, unsigned long sfsr, un
 	force_sig_info(SIGSEGV, &info, current);
 }
 
-void spitfire_insn_access_exception_tl1(struct pt_regs *regs, unsigned long sfsr, unsigned long sfar)
+void instruction_access_exception_tl1(struct pt_regs *regs,
+				      unsigned long sfsr, unsigned long sfar)
 {
 	if (notify_die(DIE_TRAP_TL1, "instruction access exception tl1", regs,
 		       0, 0x8, SIGTRAP) == NOTIFY_STOP)
 		return;
 
 	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-	spitfire_insn_access_exception(regs, sfsr, sfar);
+	instruction_access_exception(regs, sfsr, sfar);
 }
 
-void spitfire_data_access_exception(struct pt_regs *regs, unsigned long sfsr, unsigned long sfar)
+void data_access_exception(struct pt_regs *regs,
+			   unsigned long sfsr, unsigned long sfar)
 {
 	siginfo_t info;
 
@@ -205,8 +207,8 @@ void spitfire_data_access_exception(struct pt_regs *regs, unsigned long sfsr, un
 			return;
 		}
 		/* Shit... */
-		printk("spitfire_data_access_exception: SFSR[%016lx] "
-		       "SFAR[%016lx], going.\n", sfsr, sfar);
+		printk("data_access_exception: SFSR[%016lx] SFAR[%016lx], going.\n",
+		       sfsr, sfar);
 		die_if_kernel("Dax", regs);
 	}
 
@@ -218,16 +220,6 @@ void spitfire_data_access_exception(struct pt_regs *regs, unsigned long sfsr, un
 	force_sig_info(SIGSEGV, &info, current);
 }
 
-void spitfire_data_access_exception_tl1(struct pt_regs *regs, unsigned long sfsr, unsigned long sfar)
-{
-	if (notify_die(DIE_TRAP_TL1, "data access exception tl1", regs,
-		       0, 0x30, SIGTRAP) == NOTIFY_STOP)
-		return;
-
-	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-	spitfire_data_access_exception(regs, sfsr, sfar);
-}
-
 #ifdef CONFIG_PCI
 /* This is really pathetic... */
 extern volatile int pci_poke_in_progress;
@@ -261,13 +253,54 @@ static void spitfire_clean_and_reenable_l1_caches(void)
 			     : "memory");
 }
 
-static void spitfire_enable_estate_errors(void)
+void do_iae(struct pt_regs *regs)
 {
-	__asm__ __volatile__("stxa	%0, [%%g0] %1\n\t"
-			     "membar	#Sync"
-			     : /* no outputs */
-			     : "r" (ESTATE_ERR_ALL),
-			       "i" (ASI_ESTATE_ERROR_EN));
+	siginfo_t info;
+
+	spitfire_clean_and_reenable_l1_caches();
+
+	if (notify_die(DIE_TRAP, "instruction access exception", regs,
+		       0, 0x8, SIGTRAP) == NOTIFY_STOP)
+		return;
+
+	info.si_signo = SIGBUS;
+	info.si_errno = 0;
+	info.si_code = BUS_OBJERR;
+	info.si_addr = (void *)0;
+	info.si_trapno = 0;
+	force_sig_info(SIGBUS, &info, current);
+}
+
+void do_dae(struct pt_regs *regs)
+{
+	siginfo_t info;
+
+#ifdef CONFIG_PCI
+	if (pci_poke_in_progress && pci_poke_cpu == smp_processor_id()) {
+		spitfire_clean_and_reenable_l1_caches();
+
+		pci_poke_faulted = 1;
+
+		/* Why the fuck did they have to change this? */
+		if (tlb_type == cheetah || tlb_type == cheetah_plus)
+			regs->tpc += 4;
+
+		regs->tnpc = regs->tpc + 4;
+		return;
+	}
+#endif
+	spitfire_clean_and_reenable_l1_caches();
+
+	if (notify_die(DIE_TRAP, "data access exception", regs,
+		       0, 0x30, SIGTRAP) == NOTIFY_STOP)
+		return;
+
+	info.si_signo = SIGBUS;
+	info.si_errno = 0;
+	info.si_code = BUS_OBJERR;
+	info.si_addr = (void *)0;
+	info.si_trapno = 0;
+	force_sig_info(SIGBUS, &info, current);
 }
 
 static char ecc_syndrome_table[] = {
@@ -305,15 +338,65 @@ static char ecc_syndrome_table[] = {
 	0x0b, 0x48, 0x48, 0x4b, 0x48, 0x4b, 0x4b, 0x4a
 };
 
+/* cee_trap in entry.S encodes AFSR/UDBH/UDBL error status
+ * in the following format.  The AFAR is left as is, with
+ * reserved bits cleared, and is a raw 40-bit physical
+ * address.
+ */
+#define CE_STATUS_UDBH_UE		(1UL << (43 + 9))
+#define CE_STATUS_UDBH_CE		(1UL << (43 + 8))
+#define CE_STATUS_UDBH_ESYNDR		(0xffUL << 43)
+#define CE_STATUS_UDBH_SHIFT		43
+#define CE_STATUS_UDBL_UE		(1UL << (33 + 9))
+#define CE_STATUS_UDBL_CE		(1UL << (33 + 8))
+#define CE_STATUS_UDBL_ESYNDR		(0xffUL << 33)
+#define CE_STATUS_UDBL_SHIFT		33
+#define CE_STATUS_AFSR_MASK		(0x1ffffffffUL)
+#define CE_STATUS_AFSR_ME		(1UL << 32)
+#define CE_STATUS_AFSR_PRIV		(1UL << 31)
+#define CE_STATUS_AFSR_ISAP		(1UL << 30)
+#define CE_STATUS_AFSR_ETP		(1UL << 29)
+#define CE_STATUS_AFSR_IVUE		(1UL << 28)
+#define CE_STATUS_AFSR_TO		(1UL << 27)
+#define CE_STATUS_AFSR_BERR		(1UL << 26)
+#define CE_STATUS_AFSR_LDP		(1UL << 25)
+#define CE_STATUS_AFSR_CP		(1UL << 24)
+#define CE_STATUS_AFSR_WP		(1UL << 23)
+#define CE_STATUS_AFSR_EDP		(1UL << 22)
+#define CE_STATUS_AFSR_UE		(1UL << 21)
+#define CE_STATUS_AFSR_CE		(1UL << 20)
+#define CE_STATUS_AFSR_ETS		(0xfUL << 16)
+#define CE_STATUS_AFSR_ETS_SHIFT	16
+#define CE_STATUS_AFSR_PSYND		(0xffffUL << 0)
+#define CE_STATUS_AFSR_PSYND_SHIFT	0
+
+/* Layout of Ecache TAG Parity Syndrome of AFSR */
+#define AFSR_ETSYNDROME_7_0		0x1UL /* E$-tag bus bits  <7:0> */
+#define AFSR_ETSYNDROME_15_8		0x2UL /* E$-tag bus bits <15:8> */
+#define AFSR_ETSYNDROME_21_16		0x4UL /* E$-tag bus bits <21:16> */
+#define AFSR_ETSYNDROME_24_22		0x8UL /* E$-tag bus bits <24:22> */
+
 static char *syndrome_unknown = "<Unknown>";
 
-static void spitfire_log_udb_syndrome(unsigned long afar, unsigned long udbh, unsigned long udbl, unsigned long bit)
+asmlinkage void cee_log(unsigned long ce_status,
+			unsigned long afar,
+			struct pt_regs *regs)
 {
-	unsigned short scode;
-	char memmod_str[64], *p;
+	char memmod_str[64];
+	char *p;
+	unsigned short scode, udb_reg;
 
-	if (udbl & bit) {
-		scode = ecc_syndrome_table[udbl & 0xff];
+	printk(KERN_WARNING "CPU[%d]: Correctable ECC Error "
+	       "AFSR[%lx] AFAR[%016lx] UDBL[%lx] UDBH[%lx]\n",
+	       smp_processor_id(),
+	       (ce_status & CE_STATUS_AFSR_MASK),
+	       afar,
+	       ((ce_status >> CE_STATUS_UDBL_SHIFT) & 0x3ffUL),
+	       ((ce_status >> CE_STATUS_UDBH_SHIFT) & 0x3ffUL));
+
+	udb_reg = ((ce_status >> CE_STATUS_UDBL_SHIFT) & 0x3ffUL);
+	if (udb_reg & (1 << 8)) {
+		scode = ecc_syndrome_table[udb_reg & 0xff];
 		if (prom_getunumber(scode, afar,
 				    memmod_str, sizeof(memmod_str)) == -1)
 			p = syndrome_unknown;
@@ -324,8 +407,9 @@ static void spitfire_log_udb_syndrome(unsigned long afar, unsigned long udbh, un
 		       smp_processor_id(), scode, p);
 	}
 
-	if (udbh & bit) {
-		scode = ecc_syndrome_table[udbh & 0xff];
+	udb_reg = ((ce_status >> CE_STATUS_UDBH_SHIFT) & 0x3ffUL);
+	if (udb_reg & (1 << 8)) {
+		scode = ecc_syndrome_table[udb_reg & 0xff];
 		if (prom_getunumber(scode, afar,
 				    memmod_str, sizeof(memmod_str)) == -1)
 			p = syndrome_unknown;
@@ -335,127 +419,6 @@ static void spitfire_log_udb_syndrome(unsigned long afar, unsigned long udbh, un
 		       "Memory Module \"%s\"\n",
 		       smp_processor_id(), scode, p);
 	}
-
-}
-
-static void spitfire_cee_log(unsigned long afsr, unsigned long afar, unsigned long udbh, unsigned long udbl, int tl1, struct pt_regs *regs)
-{
-
-	printk(KERN_WARNING "CPU[%d]: Correctable ECC Error "
-	       "AFSR[%lx] AFAR[%016lx] UDBL[%lx] UDBH[%lx] TL>1[%d]\n",
-	       smp_processor_id(), afsr, afar, udbl, udbh, tl1);
-
-	spitfire_log_udb_syndrome(afar, udbh, udbl, UDBE_CE);
-
-	/* We always log it, even if someone is listening for this
-	 * trap.
-	 */
-	notify_die(DIE_TRAP, "Correctable ECC Error", regs,
-		   0, TRAP_TYPE_CEE, SIGTRAP);
-
-	/* The Correctable ECC Error trap does not disable I/D caches.  So
-	 * we only have to restore the ESTATE Error Enable register.
-	 */
-	spitfire_enable_estate_errors();
-}
-
-static void spitfire_ue_log(unsigned long afsr, unsigned long afar, unsigned long udbh, unsigned long udbl, unsigned long tt, int tl1, struct pt_regs *regs)
-{
-	siginfo_t info;
-
-	printk(KERN_WARNING "CPU[%d]: Uncorrectable Error AFSR[%lx] "
-	       "AFAR[%lx] UDBL[%lx] UDBH[%ld] TT[%lx] TL>1[%d]\n",
-	       smp_processor_id(), afsr, afar, udbl, udbh, tt, tl1);
-
-	/* XXX add more human friendly logging of the error status
-	 * XXX as is implemented for cheetah
-	 */
-
-	spitfire_log_udb_syndrome(afar, udbh, udbl, UDBE_UE);
-
-	/* We always log it, even if someone is listening for this
-	 * trap.
-	 */
-	notify_die(DIE_TRAP, "Uncorrectable Error", regs,
-		   0, tt, SIGTRAP);
-
-	if (regs->tstate & TSTATE_PRIV) {
-		if (tl1)
-			dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-		die_if_kernel("UE", regs);
-	}
-
-	/* XXX need more intelligent processing here, such as is implemented
-	 * XXX for cheetah errors, in fact if the E-cache still holds the
-	 * XXX line with bad parity this will loop
-	 */
-
-	spitfire_clean_and_reenable_l1_caches();
-	spitfire_enable_estate_errors();
-
-	if (test_thread_flag(TIF_32BIT)) {
-		regs->tpc &= 0xffffffff;
-		regs->tnpc &= 0xffffffff;
-	}
-	info.si_signo = SIGBUS;
-	info.si_errno = 0;
-	info.si_code = BUS_OBJERR;
-	info.si_addr = (void *)0;
-	info.si_trapno = 0;
-	force_sig_info(SIGBUS, &info, current);
-}
-
-void spitfire_access_error(struct pt_regs *regs, unsigned long status_encoded, unsigned long afar)
-{
-	unsigned long afsr, tt, udbh, udbl;
-	int tl1;
-
-	afsr = (status_encoded & SFSTAT_AFSR_MASK) >> SFSTAT_AFSR_SHIFT;
-	tt = (status_encoded & SFSTAT_TRAP_TYPE) >> SFSTAT_TRAP_TYPE_SHIFT;
-	tl1 = (status_encoded & SFSTAT_TL_GT_ONE) ? 1 : 0;
-	udbl = (status_encoded & SFSTAT_UDBL_MASK) >> SFSTAT_UDBL_SHIFT;
-	udbh = (status_encoded & SFSTAT_UDBH_MASK) >> SFSTAT_UDBH_SHIFT;
-
-#ifdef CONFIG_PCI
-	if (tt == TRAP_TYPE_DAE &&
-	    pci_poke_in_progress && pci_poke_cpu == smp_processor_id()) {
-		spitfire_clean_and_reenable_l1_caches();
-		spitfire_enable_estate_errors();
-
-		pci_poke_faulted = 1;
-		regs->tnpc = regs->tpc + 4;
-		return;
-	}
-#endif
-
-	if (afsr & SFAFSR_UE)
-		spitfire_ue_log(afsr, afar, udbh, udbl, tt, tl1, regs);
-
-	if (tt == TRAP_TYPE_CEE) {
-		/* Handle the case where we took a CEE trap, but ACK'd
-		 * only the UE state in the UDB error registers.
-		 */
-		if (afsr & SFAFSR_UE) {
-			if (udbh & UDBE_CE) {
-				__asm__ __volatile__(
-					"stxa	%0, [%1] %2\n\t"
-					"membar	#Sync"
-					: /* no outputs */
-					: "r" (udbh & UDBE_CE),
-					  "r" (0x0), "i" (ASI_UDB_ERROR_W));
-			}
-			if (udbl & UDBE_CE) {
-				__asm__ __volatile__(
-					"stxa	%0, [%1] %2\n\t"
-					"membar	#Sync"
-					: /* no outputs */
-					: "r" (udbl & UDBE_CE),
-					  "r" (0x18), "i" (ASI_UDB_ERROR_W));
-			}
-		}
-
-		spitfire_cee_log(afsr, afar, udbh, udbl, tl1, regs);
-	}
 }
 
 int cheetah_pcache_forced_on;
diff --git a/trunk/arch/sparc64/kernel/ttable.S b/trunk/arch/sparc64/kernel/ttable.S
index 8365bc1f81f3..491bb3681f9d 100644
--- a/trunk/arch/sparc64/kernel/ttable.S
+++ b/trunk/arch/sparc64/kernel/ttable.S
@@ -18,10 +18,9 @@ sparc64_ttable_tl0:
 tl0_resv000:	BOOT_KERNEL BTRAP(0x1) BTRAP(0x2) BTRAP(0x3)
 tl0_resv004:	BTRAP(0x4)  BTRAP(0x5) BTRAP(0x6) BTRAP(0x7)
 tl0_iax:	membar #Sync
-		TRAP_NOSAVE_7INSNS(__spitfire_insn_access_exception)
+		TRAP_NOSAVE_7INSNS(__do_instruction_access_exception)
 tl0_resv009:	BTRAP(0x9)
-tl0_iae:	membar #Sync
-		TRAP_NOSAVE_7INSNS(__spitfire_access_error)
+tl0_iae:	TRAP(do_iae)
 tl0_resv00b:	BTRAP(0xb) BTRAP(0xc) BTRAP(0xd) BTRAP(0xe) BTRAP(0xf)
 tl0_ill:	membar #Sync
 		TRAP_7INSNS(do_illegal_instruction)
@@ -37,10 +36,9 @@ tl0_cwin:	CLEAN_WINDOW
 tl0_div0:	TRAP(do_div0)
 tl0_resv029:	BTRAP(0x29) BTRAP(0x2a) BTRAP(0x2b) BTRAP(0x2c) BTRAP(0x2d) BTRAP(0x2e)
 tl0_resv02f:	BTRAP(0x2f)
-tl0_dax:	TRAP_NOSAVE(__spitfire_data_access_exception)
+tl0_dax:	TRAP_NOSAVE(__do_data_access_exception)
 tl0_resv031:	BTRAP(0x31)
-tl0_dae:	membar #Sync
-		TRAP_NOSAVE_7INSNS(__spitfire_access_error)
+tl0_dae:	TRAP(do_dae)
 tl0_resv033:	BTRAP(0x33)
 tl0_mna:	TRAP_NOSAVE(do_mna)
 tl0_lddfmna:	TRAP_NOSAVE(do_lddfmna)
@@ -75,8 +73,7 @@ tl0_resv05c:	BTRAP(0x5c) BTRAP(0x5d) BTRAP(0x5e) BTRAP(0x5f)
 tl0_ivec:	TRAP_IVEC
 tl0_paw:	TRAP(do_paw)
 tl0_vaw:	TRAP(do_vaw)
-tl0_cee:	membar #Sync
-		TRAP_NOSAVE_7INSNS(__spitfire_cee_trap)
+tl0_cee:	TRAP_NOSAVE(cee_trap)
 tl0_iamiss:
 #include	"itlb_base.S"
 tl0_damiss:
@@ -178,10 +175,9 @@ tl0_resv1f0:	BTRAPS(0x1f0) BTRAPS(0x1f8)
 sparc64_ttable_tl1:
 tl1_resv000:	BOOT_KERNEL    BTRAPTL1(0x1) BTRAPTL1(0x2) BTRAPTL1(0x3)
 tl1_resv004:	BTRAPTL1(0x4)  BTRAPTL1(0x5) BTRAPTL1(0x6) BTRAPTL1(0x7)
-tl1_iax:	TRAP_NOSAVE(__spitfire_insn_access_exception_tl1)
+tl1_iax:	TRAP_NOSAVE(__do_instruction_access_exception_tl1)
 tl1_resv009:	BTRAPTL1(0x9)
-tl1_iae:	membar #Sync
-		TRAP_NOSAVE_7INSNS(__spitfire_access_error)
+tl1_iae:	TRAPTL1(do_iae_tl1)
 tl1_resv00b:	BTRAPTL1(0xb) BTRAPTL1(0xc) BTRAPTL1(0xd) BTRAPTL1(0xe) BTRAPTL1(0xf)
 tl1_ill:	TRAPTL1(do_ill_tl1)
 tl1_privop:	BTRAPTL1(0x11)
@@ -197,10 +193,9 @@ tl1_cwin:	CLEAN_WINDOW
 tl1_div0:	TRAPTL1(do_div0_tl1)
 tl1_resv029:	BTRAPTL1(0x29) BTRAPTL1(0x2a) BTRAPTL1(0x2b) BTRAPTL1(0x2c)
 tl1_resv02d:	BTRAPTL1(0x2d) BTRAPTL1(0x2e) BTRAPTL1(0x2f)
-tl1_dax:	TRAP_NOSAVE(__spitfire_data_access_exception_tl1)
+tl1_dax:	TRAP_NOSAVE(__do_data_access_exception_tl1)
 tl1_resv031:	BTRAPTL1(0x31)
-tl1_dae:	membar #Sync
-		TRAP_NOSAVE_7INSNS(__spitfire_access_error)
+tl1_dae:	TRAPTL1(do_dae_tl1)
 tl1_resv033:	BTRAPTL1(0x33)
 tl1_mna:	TRAP_NOSAVE(do_mna)
 tl1_lddfmna:	TRAPTL1(do_lddfmna_tl1)
@@ -224,8 +219,8 @@ tl1_paw:	TRAPTL1(do_paw_tl1)
 tl1_vaw:	TRAPTL1(do_vaw_tl1)
 
 		/* The grotty trick to save %g1 into current->thread.cee_stuff
-		 * is because when we take this trap we could be interrupting
-		 * trap code already using the trap alternate global registers.
+		 * is because when we take this trap we could be interrupting trap
+		 * code already using the trap alternate global registers.
 		 *
 		 * We cross our fingers and pray that this store/load does
 		 * not cause yet another CEE trap.
diff --git a/trunk/arch/sparc64/kernel/unaligned.c b/trunk/arch/sparc64/kernel/unaligned.c
index da9739f0d437..11c3e88732e4 100644
--- a/trunk/arch/sparc64/kernel/unaligned.c
+++ b/trunk/arch/sparc64/kernel/unaligned.c
@@ -349,9 +349,9 @@ int handle_popc(u32 insn, struct pt_regs *regs)
 
 extern void do_fpother(struct pt_regs *regs);
 extern void do_privact(struct pt_regs *regs);
-extern void spitfire_data_access_exception(struct pt_regs *regs,
-					   unsigned long sfsr,
-					   unsigned long sfar);
+extern void data_access_exception(struct pt_regs *regs,
+				  unsigned long sfsr,
+				  unsigned long sfar);
 
 int handle_ldf_stq(u32 insn, struct pt_regs *regs)
 {
@@ -394,14 +394,14 @@ int handle_ldf_stq(u32 insn, struct pt_regs *regs)
 				break;
 			}
 		default:
-			spitfire_data_access_exception(regs, 0, addr);
+			data_access_exception(regs, 0, addr);
 			return 1;
 		}
 		if (put_user (first >> 32, (u32 __user *)addr) ||
 		    __put_user ((u32)first, (u32 __user *)(addr + 4)) ||
 		    __put_user (second >> 32, (u32 __user *)(addr + 8)) ||
 		    __put_user ((u32)second, (u32 __user *)(addr + 12))) {
-		    	spitfire_data_access_exception(regs, 0, addr);
+		    	data_access_exception(regs, 0, addr);
 		    	return 1;
 		}
 	} else {
@@ -414,7 +414,7 @@ int handle_ldf_stq(u32 insn, struct pt_regs *regs)
 			do_privact(regs);
 			return 1;
 		} else if (asi > ASI_SNFL) {
-			spitfire_data_access_exception(regs, 0, addr);
+			data_access_exception(regs, 0, addr);
 			return 1;
 		}
 		switch (insn & 0x180000) {
@@ -431,7 +431,7 @@ int handle_ldf_stq(u32 insn, struct pt_regs *regs)
 				err |= __get_user (data[i], (u32 __user *)(addr + 4*i));
 		}
 		if (err && !(asi & 0x2 /* NF */)) {
-			spitfire_data_access_exception(regs, 0, addr);
+			data_access_exception(regs, 0, addr);
 			return 1;
 		}
 		if (asi & 0x8) /* Little */ {
@@ -534,7 +534,7 @@ void handle_lddfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr
 		*(u64 *)(f->regs + freg) = value;
 		current_thread_info()->fpsaved[0] |= flag;
 	} else {
-daex:		spitfire_data_access_exception(regs, sfsr, sfar);
+daex:		data_access_exception(regs, sfsr, sfar);
 		return;
 	}
 	advance(regs);
@@ -578,7 +578,7 @@ void handle_stdfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr
 		    __put_user ((u32)value, (u32 __user *)(sfar + 4)))
 			goto daex;
 	} else {
-daex:		spitfire_data_access_exception(regs, sfsr, sfar);
+daex:		data_access_exception(regs, sfsr, sfar);
 		return;
 	}
 	advance(regs);
diff --git a/trunk/arch/sparc64/kernel/winfixup.S b/trunk/arch/sparc64/kernel/winfixup.S
index 99c809a1e5ac..dfbc7e0dcf70 100644
--- a/trunk/arch/sparc64/kernel/winfixup.S
+++ b/trunk/arch/sparc64/kernel/winfixup.S
@@ -318,7 +318,7 @@ fill_fixup_dax:
 	 nop
 	rdpr		%pstate, %l1			! Prepare to change globals.
 	mov		%g4, %o1			! Setup args for
-	mov		%g5, %o2			! final call to spitfire_data_access_exception.
+	mov		%g5, %o2			! final call to data_access_exception.
 	andn		%l1, PSTATE_MM, %l1		! We want to be in RMO
 
 	mov		%g6, %o7			! Stash away current.
@@ -330,7 +330,7 @@ fill_fixup_dax:
 	mov		TSB_REG, %g1
 	ldxa		[%g1] ASI_IMMU, %g5
 #endif
-	call		spitfire_data_access_exception
+	call		data_access_exception
 	 add		%sp, PTREGS_OFF, %o0
 
 	b,pt		%xcc, rtrap
@@ -391,7 +391,7 @@ window_dax_from_user_common:
 109:	 or		%g7, %lo(109b), %g7
 	mov		%l4, %o1
 	mov		%l5, %o2
-	call		spitfire_data_access_exception
+	call		data_access_exception
 	 add		%sp, PTREGS_OFF, %o0
 	ba,pt		%xcc, rtrap
 	 clr		%l6
diff --git a/trunk/arch/sparc64/lib/Makefile b/trunk/arch/sparc64/lib/Makefile
index 6201f1040982..40dbeec7e5d6 100644
--- a/trunk/arch/sparc64/lib/Makefile
+++ b/trunk/arch/sparc64/lib/Makefile
@@ -12,7 +12,7 @@ lib-y := PeeCeeI.o copy_page.o clear_page.o strlen.o strncmp.o \
 	 U1memcpy.o U1copy_from_user.o U1copy_to_user.o \
 	 U3memcpy.o U3copy_from_user.o U3copy_to_user.o U3patch.o \
 	 copy_in_user.o user_fixup.o memmove.o \
-	 mcount.o ipcsum.o rwsem.o xor.o find_bit.o delay.o mb.o
+	 mcount.o ipcsum.o rwsem.o xor.o find_bit.o delay.o
 
 lib-$(CONFIG_DEBUG_SPINLOCK) += debuglocks.o
 lib-$(CONFIG_HAVE_DEC_LOCK) += dec_and_lock.o
diff --git a/trunk/arch/sparc64/lib/debuglocks.c b/trunk/arch/sparc64/lib/debuglocks.c
index f5f0b5586f01..f03344cf784e 100644
--- a/trunk/arch/sparc64/lib/debuglocks.c
+++ b/trunk/arch/sparc64/lib/debuglocks.c
@@ -12,6 +12,8 @@
 
 #ifdef CONFIG_SMP
 
+#define GET_CALLER(PC) __asm__ __volatile__("mov %%i7, %0" : "=r" (PC))
+
 static inline void show (char *str, spinlock_t *lock, unsigned long caller)
 {
 	int cpu = smp_processor_id();
@@ -49,19 +51,20 @@ static inline void show_write (char *str, rwlock_t *lock, unsigned long caller)
 #undef INIT_STUCK
 #define INIT_STUCK 100000000
 
-void _do_spin_lock(spinlock_t *lock, char *str, unsigned long caller)
+void _do_spin_lock(spinlock_t *lock, char *str)
 {
-	unsigned long val;
+	unsigned long caller, val;
 	int stuck = INIT_STUCK;
 	int cpu = get_cpu();
 	int shown = 0;
 
+	GET_CALLER(caller);
 again:
 	__asm__ __volatile__("ldstub [%1], %0"
 			     : "=r" (val)
 			     : "r" (&(lock->lock))
 			     : "memory");
-	membar_storeload_storestore();
+	membar("#StoreLoad | #StoreStore");
 	if (val) {
 		while (lock->lock) {
 			if (!--stuck) {
@@ -69,7 +72,7 @@ void _do_spin_lock(spinlock_t *lock, char *str, unsigned long caller)
 					show(str, lock, caller);
 				stuck = INIT_STUCK;
 			}
-			rmb();
+			membar("#LoadLoad");
 		}
 		goto again;
 	}
@@ -81,16 +84,17 @@ void _do_spin_lock(spinlock_t *lock, char *str, unsigned long caller)
 	put_cpu();
 }
 
-int _do_spin_trylock(spinlock_t *lock, unsigned long caller)
+int _do_spin_trylock(spinlock_t *lock)
 {
-	unsigned long val;
+	unsigned long val, caller;
 	int cpu = get_cpu();
 
+	GET_CALLER(caller);
 	__asm__ __volatile__("ldstub [%1], %0"
 			     : "=r" (val)
 			     : "r" (&(lock->lock))
 			     : "memory");
-	membar_storeload_storestore();
+	membar("#StoreLoad | #StoreStore");
 	if (!val) {
 		lock->owner_pc = ((unsigned int)caller);
 		lock->owner_cpu = cpu;
@@ -107,20 +111,21 @@ void _do_spin_unlock(spinlock_t *lock)
 {
 	lock->owner_pc = 0;
 	lock->owner_cpu = NO_PROC_ID;
-	membar_storestore_loadstore();
+	membar("#StoreStore | #LoadStore");
 	lock->lock = 0;
 	current->thread.smp_lock_count--;
 }
 
 /* Keep INIT_STUCK the same... */
 
-void _do_read_lock(rwlock_t *rw, char *str, unsigned long caller)
+void _do_read_lock (rwlock_t *rw, char *str)
 {
-	unsigned long val;
+	unsigned long caller, val;
 	int stuck = INIT_STUCK;
 	int cpu = get_cpu();
 	int shown = 0;
 
+	GET_CALLER(caller);
 wlock_again:
 	/* Wait for any writer to go away.  */
 	while (((long)(rw->lock)) < 0) {
@@ -129,7 +134,7 @@ void _do_read_lock(rwlock_t *rw, char *str, unsigned long caller)
 				show_read(str, rw, caller);
 			stuck = INIT_STUCK;
 		}
-		rmb();
+		membar("#LoadLoad");
 	}
 	/* Try once to increment the counter.  */
 	__asm__ __volatile__(
@@ -142,7 +147,7 @@ void _do_read_lock(rwlock_t *rw, char *str, unsigned long caller)
 "2:"	: "=r" (val)
 	: "0" (&(rw->lock))
 	: "g1", "g7", "memory");
-	membar_storeload_storestore();
+	membar("#StoreLoad | #StoreStore");
 	if (val)
 		goto wlock_again;
 	rw->reader_pc[cpu] = ((unsigned int)caller);
@@ -152,13 +157,15 @@ void _do_read_lock(rwlock_t *rw, char *str, unsigned long caller)
 	put_cpu();
 }
 
-void _do_read_unlock(rwlock_t *rw, char *str, unsigned long caller)
+void _do_read_unlock (rwlock_t *rw, char *str)
 {
-	unsigned long val;
+	unsigned long caller, val;
 	int stuck = INIT_STUCK;
 	int cpu = get_cpu();
 	int shown = 0;
 
+	GET_CALLER(caller);
+
 	/* Drop our identity _first_. */
 	rw->reader_pc[cpu] = 0;
 	current->thread.smp_lock_count--;
@@ -186,13 +193,14 @@ void _do_read_unlock(rwlock_t *rw, char *str, unsigned long caller)
 	put_cpu();
 }
 
-void _do_write_lock(rwlock_t *rw, char *str, unsigned long caller)
+void _do_write_lock (rwlock_t *rw, char *str)
 {
-	unsigned long val;
+	unsigned long caller, val;
 	int stuck = INIT_STUCK;
 	int cpu = get_cpu();
 	int shown = 0;
 
+	GET_CALLER(caller);
 wlock_again:
 	/* Spin while there is another writer. */
 	while (((long)rw->lock) < 0) {
@@ -201,7 +209,7 @@ void _do_write_lock(rwlock_t *rw, char *str, unsigned long caller)
 				show_write(str, rw, caller);
 			stuck = INIT_STUCK;
 		}
-		rmb();
+		membar("#LoadLoad");
 	}
 
 	/* Try to acuire the write bit.  */
@@ -256,7 +264,7 @@ void _do_write_lock(rwlock_t *rw, char *str, unsigned long caller)
 					show_write(str, rw, caller);
 				stuck = INIT_STUCK;
 			}
-			rmb();
+			membar("#LoadLoad");
 		}
 		goto wlock_again;
 	}
@@ -270,12 +278,14 @@ void _do_write_lock(rwlock_t *rw, char *str, unsigned long caller)
 	put_cpu();
 }
 
-void _do_write_unlock(rwlock_t *rw, unsigned long caller)
+void _do_write_unlock(rwlock_t *rw)
 {
-	unsigned long val;
+	unsigned long caller, val;
 	int stuck = INIT_STUCK;
 	int shown = 0;
 
+	GET_CALLER(caller);
+
 	/* Drop our identity _first_ */
 	rw->writer_pc = 0;
 	rw->writer_cpu = NO_PROC_ID;
@@ -303,11 +313,13 @@ void _do_write_unlock(rwlock_t *rw, unsigned long caller)
 	}
 }
 
-int _do_write_trylock(rwlock_t *rw, char *str, unsigned long caller)
+int _do_write_trylock (rwlock_t *rw, char *str)
 {
-	unsigned long val;
+	unsigned long caller, val;
 	int cpu = get_cpu();
 
+	GET_CALLER(caller);
+
 	/* Try to acuire the write bit.  */
 	__asm__ __volatile__(
 "	mov	1, %%g3\n"
diff --git a/trunk/arch/sparc64/lib/mb.S b/trunk/arch/sparc64/lib/mb.S
deleted file mode 100644
index 4004f748619f..000000000000
--- a/trunk/arch/sparc64/lib/mb.S
+++ /dev/null
@@ -1,73 +0,0 @@
-/* mb.S: Out of line memory barriers.
- *
- * Copyright (C) 2005 David S. Miller (davem@davemloft.net)
- */
-
-	/* These are here in an effort to more fully work around
-	 * Spitfire Errata #51.  Essentially, if a memory barrier
-	 * occurs soon after a mispredicted branch, the chip can stop
-	 * executing instructions until a trap occurs.  Therefore, if
-	 * interrupts are disabled, the chip can hang forever.
-	 *
-	 * It used to be believed that the memory barrier had to be
-	 * right in the delay slot, but a case has been traced
-	 * recently wherein the memory barrier was one instruction
-	 * after the branch delay slot and the chip still hung.  The
-	 * offending sequence was the following in sym_wakeup_done()
-	 * of the sym53c8xx_2 driver:
-	 *
-	 *	call	sym_ccb_from_dsa, 0
-	 *	 movge	%icc, 0, %l0
-	 *	brz,pn	%o0, .LL1303
-	 *	 mov	%o0, %l2
-	 *	membar	#LoadLoad
-	 *
-	 * The branch has to be mispredicted for the bug to occur.
-	 * Therefore, we put the memory barrier explicitly into a
-	 * "branch always, predicted taken" delay slot to avoid the
-	 * problem case.
-	 */
-
-	.text
-
-99:	retl
-	 nop
-
-	.globl	mb
-mb:	ba,pt	%xcc, 99b
-	 membar	#LoadLoad | #LoadStore | #StoreStore | #StoreLoad
-	.size	mb, .-mb
-
-	.globl	rmb
-rmb:	ba,pt	%xcc, 99b
-	 membar	#LoadLoad
-	.size	rmb, .-rmb
-
-	.globl	wmb
-wmb:	ba,pt	%xcc, 99b
-	 membar	#StoreStore
-	.size	wmb, .-wmb
-
-	.globl	membar_storeload
-membar_storeload:
-	ba,pt	%xcc, 99b
-	 membar	#StoreLoad
-	.size	membar_storeload, .-membar_storeload
-
-	.globl	membar_storeload_storestore
-membar_storeload_storestore:
-	ba,pt	%xcc, 99b
-	 membar	#StoreLoad | #StoreStore
-	.size	membar_storeload_storestore, .-membar_storeload_storestore
-
-	.globl	membar_storeload_loadload
-membar_storeload_loadload:
-	ba,pt	%xcc, 99b
-	 membar	#StoreLoad | #LoadLoad
-	.size	membar_storeload_loadload, .-membar_storeload_loadload
-
-	.globl	membar_storestore_loadstore
-membar_storestore_loadstore:
-	ba,pt	%xcc, 99b
-	 membar	#StoreStore | #LoadStore
-	.size	membar_storestore_loadstore, .-membar_storestore_loadstore
diff --git a/trunk/arch/sparc64/solaris/misc.c b/trunk/arch/sparc64/solaris/misc.c
index 302efbcba70e..15b4cfe07557 100644
--- a/trunk/arch/sparc64/solaris/misc.c
+++ b/trunk/arch/sparc64/solaris/misc.c
@@ -737,8 +737,7 @@ MODULE_LICENSE("GPL");
 extern u32 tl0_solaris[8];
 #define update_ttable(x) 										\
 	tl0_solaris[3] = (((long)(x) - (long)tl0_solaris - 3) >> 2) | 0x40000000;			\
-	wmb();		\
-	__asm__ __volatile__ ("flush %0" : : "r" (&tl0_solaris[3]))
+	__asm__ __volatile__ ("membar #StoreStore; flush %0" : : "r" (&tl0_solaris[3]))
 #else
 #endif	
 
@@ -762,8 +761,7 @@ int init_module(void)
 	entry64_personality_patch |=
 		(offsetof(struct task_struct, personality) +
 		 (sizeof(unsigned long) - 1));
-	wmb();
-	__asm__ __volatile__("flush %0"
+	__asm__ __volatile__("membar #StoreStore; flush %0"
 			     : : "r" (&entry64_personality_patch));
 	return 0;
 }
diff --git a/trunk/drivers/atm/ambassador.c b/trunk/drivers/atm/ambassador.c
index d74a7c5e75dd..73c6b85299c1 100644
--- a/trunk/drivers/atm/ambassador.c
+++ b/trunk/drivers/atm/ambassador.c
@@ -513,7 +513,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
 	  
 	  // VC layer stats
 	  atomic_inc(&atm_vcc->stats->rx);
-	  __net_timestamp(skb);
+	  do_gettimeofday(&skb->stamp);
 	  // end of our responsability
 	  atm_vcc->push (atm_vcc, skb);
 	  return;
diff --git a/trunk/drivers/atm/atmtcp.c b/trunk/drivers/atm/atmtcp.c
index 57f1810fdccd..f2f01cb82cb4 100644
--- a/trunk/drivers/atm/atmtcp.c
+++ b/trunk/drivers/atm/atmtcp.c
@@ -325,7 +325,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
 		result = -ENOBUFS;
 		goto done;
 	}
-	__net_timestamp(new_skb);
+	do_gettimeofday(&new_skb->stamp);
 	memcpy(skb_put(new_skb,skb->len),skb->data,skb->len);
 	out_vcc->push(out_vcc,new_skb);
 	atomic_inc(&vcc->stats->tx);
diff --git a/trunk/drivers/atm/eni.c b/trunk/drivers/atm/eni.c
index c13c4d736ef5..10da36934769 100644
--- a/trunk/drivers/atm/eni.c
+++ b/trunk/drivers/atm/eni.c
@@ -537,7 +537,7 @@ static int rx_aal0(struct atm_vcc *vcc)
 		return 0;
 	}
 	skb_put(skb,length);
-	skb_set_timestamp(skb, &eni_vcc->timestamp);
+	skb->stamp = eni_vcc->timestamp;
 	DPRINTK("got len %ld\n",length);
 	if (do_rx_dma(vcc,skb,1,length >> 2,length >> 2)) return 1;
 	eni_vcc->rxing++;
diff --git a/trunk/drivers/atm/firestream.c b/trunk/drivers/atm/firestream.c
index 58219744f5db..b078fa548ebf 100644
--- a/trunk/drivers/atm/firestream.c
+++ b/trunk/drivers/atm/firestream.c
@@ -815,7 +815,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
 				skb_put (skb, qe->p1 & 0xffff); 
 				ATM_SKB(skb)->vcc = atm_vcc;
 				atomic_inc(&atm_vcc->stats->rx);
-				__net_timestamp(skb);
+				do_gettimeofday(&skb->stamp);
 				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
 				atm_vcc->push (atm_vcc, skb);
 				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-d: %p\n", pe);
diff --git a/trunk/drivers/atm/fore200e.c b/trunk/drivers/atm/fore200e.c
index 2bf723a7b6e6..5f702199543a 100644
--- a/trunk/drivers/atm/fore200e.c
+++ b/trunk/drivers/atm/fore200e.c
@@ -1176,7 +1176,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
 	return -ENOMEM;
     } 
 
-    __net_timestamp(skb);
+    do_gettimeofday(&skb->stamp);
     
 #ifdef FORE200E_52BYTE_AAL0_SDU
     if (cell_header) {
diff --git a/trunk/drivers/atm/he.c b/trunk/drivers/atm/he.c
index fde9334059af..28250c9b32d6 100644
--- a/trunk/drivers/atm/he.c
+++ b/trunk/drivers/atm/he.c
@@ -1886,7 +1886,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
 		if (rx_skb_reserve > 0)
 			skb_reserve(skb, rx_skb_reserve);
 
-		__net_timestamp(skb);
+		do_gettimeofday(&skb->stamp);
 
 		for (iov = he_vcc->iov_head;
 				iov < he_vcc->iov_tail; ++iov) {
diff --git a/trunk/drivers/atm/horizon.c b/trunk/drivers/atm/horizon.c
index 0cded0468003..924a2c8988bd 100644
--- a/trunk/drivers/atm/horizon.c
+++ b/trunk/drivers/atm/horizon.c
@@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
 	  struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
 	  // VC layer stats
 	  atomic_inc(&vcc->stats->rx);
-	  __net_timestamp(skb);
+	  do_gettimeofday(&skb->stamp);
 	  // end of our responsability
 	  vcc->push (vcc, skb);
 	}
diff --git a/trunk/drivers/atm/idt77252.c b/trunk/drivers/atm/idt77252.c
index b4a76cade646..30b7e990ed0b 100644
--- a/trunk/drivers/atm/idt77252.c
+++ b/trunk/drivers/atm/idt77252.c
@@ -1101,7 +1101,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
 			       cell, ATM_CELL_PAYLOAD);
 
 			ATM_SKB(sb)->vcc = vcc;
-			__net_timestamp(sb);
+			do_gettimeofday(&sb->stamp);
 			vcc->push(vcc, sb);
 			atomic_inc(&vcc->stats->rx);
 
@@ -1179,7 +1179,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
 
 			skb_trim(skb, len);
 			ATM_SKB(skb)->vcc = vcc;
-			__net_timestamp(skb);
+			do_gettimeofday(&skb->stamp);
 
 			vcc->push(vcc, skb);
 			atomic_inc(&vcc->stats->rx);
@@ -1201,7 +1201,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
 
 		skb_trim(skb, len);
 		ATM_SKB(skb)->vcc = vcc;
-		__net_timestamp(skb);
+		do_gettimeofday(&skb->stamp);
 
 		vcc->push(vcc, skb);
 		atomic_inc(&vcc->stats->rx);
@@ -1340,7 +1340,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
 		       ATM_CELL_PAYLOAD);
 
 		ATM_SKB(sb)->vcc = vcc;
-		__net_timestamp(sb);
+		do_gettimeofday(&sb->stamp);
 		vcc->push(vcc, sb);
 		atomic_inc(&vcc->stats->rx);
 
diff --git a/trunk/drivers/atm/lanai.c b/trunk/drivers/atm/lanai.c
index 51ec14787293..ffe3afa723b8 100644
--- a/trunk/drivers/atm/lanai.c
+++ b/trunk/drivers/atm/lanai.c
@@ -1427,7 +1427,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
 	skb_put(skb, size);
 	vcc_rx_memcpy(skb->data, lvcc, size);
 	ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
-	__net_timestamp(skb);
+	do_gettimeofday(&skb->stamp);
 	lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
 	atomic_inc(&lvcc->rx.atmvcc->stats->rx);
     out:
diff --git a/trunk/drivers/atm/nicstar.c b/trunk/drivers/atm/nicstar.c
index c57e20dcb0f8..b2a7b754fd14 100644
--- a/trunk/drivers/atm/nicstar.c
+++ b/trunk/drivers/atm/nicstar.c
@@ -214,7 +214,8 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev);
 static void __devinit ns_init_card_error(ns_dev *card, int error);
 static scq_info *get_scq(int size, u32 scd);
 static void free_scq(scq_info *scq, struct atm_vcc *vcc);
-static void push_rxbufs(ns_dev *, struct sk_buff *);
+static void push_rxbufs(ns_dev *card, u32 type, u32 handle1, u32 addr1,
+                       u32 handle2, u32 addr2);
 static irqreturn_t ns_irq_handler(int irq, void *dev_id, struct pt_regs *regs);
 static int ns_open(struct atm_vcc *vcc);
 static void ns_close(struct atm_vcc *vcc);
@@ -765,7 +766,6 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
          ns_init_card_error(card, error);
 	 return error;
       }
-      NS_SKB_CB(hb)->buf_type = BUF_NONE;
       skb_queue_tail(&card->hbpool.queue, hb);
       card->hbpool.count++;
    }
@@ -786,10 +786,9 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
          ns_init_card_error(card, error);
 	 return error;
       }
-      NS_SKB_CB(lb)->buf_type = BUF_LG;
       skb_queue_tail(&card->lbpool.queue, lb);
       skb_reserve(lb, NS_SMBUFSIZE);
-      push_rxbufs(card, lb);
+      push_rxbufs(card, BUF_LG, (u32) lb, (u32) virt_to_bus(lb->data), 0, 0);
       /* Due to the implementation of push_rxbufs() this is 1, not 0 */
       if (j == 1)
       {
@@ -823,10 +822,9 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
          ns_init_card_error(card, error);
 	 return error;
       }
-      NS_SKB_CB(sb)->buf_type = BUF_SM;
       skb_queue_tail(&card->sbpool.queue, sb);
       skb_reserve(sb, NS_AAL0_HEADER);
-      push_rxbufs(card, sb);
+      push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data), 0, 0);
    }
    /* Test for strange behaviour which leads to crashes */
    if ((bcount = ns_stat_sfbqc_get(readl(card->membase + STAT))) < card->sbnr.min)
@@ -854,7 +852,6 @@ static int __devinit ns_init_card(int i, struct pci_dev *pcidev)
          ns_init_card_error(card, error);
 	 return error;
       }
-      NS_SKB_CB(iovb)->buf_type = BUF_NONE;
       skb_queue_tail(&card->iovpool.queue, iovb);
       card->iovpool.count++;
    }
@@ -1081,18 +1078,12 @@ static void free_scq(scq_info *scq, struct atm_vcc *vcc)
 
 /* The handles passed must be pointers to the sk_buff containing the small
    or large buffer(s) cast to u32. */
-static void push_rxbufs(ns_dev *card, struct sk_buff *skb)
+static void push_rxbufs(ns_dev *card, u32 type, u32 handle1, u32 addr1,
+                       u32 handle2, u32 addr2)
 {
-   struct ns_skb_cb *cb = NS_SKB_CB(skb);
-   u32 handle1, addr1;
-   u32 handle2, addr2;
    u32 stat;
    unsigned long flags;
    
-   /* *BARF* */
-   handle2 = addr2 = 0;
-   handle1 = (u32)skb;
-   addr1 = (u32)virt_to_bus(skb->data);
 
 #ifdef GENERAL_DEBUG
    if (!addr1)
@@ -1102,7 +1093,7 @@ static void push_rxbufs(ns_dev *card, struct sk_buff *skb)
    stat = readl(card->membase + STAT);
    card->sbfqc = ns_stat_sfbqc_get(stat);
    card->lbfqc = ns_stat_lfbqc_get(stat);
-   if (cb->buf_type == BUF_SM)
+   if (type == BUF_SM)
    {
       if (!addr2)
       {
@@ -1120,7 +1111,7 @@ static void push_rxbufs(ns_dev *card, struct sk_buff *skb)
 	 }
       }      
    }
-   else /* buf_type == BUF_LG */
+   else /* type == BUF_LG */
    {
       if (!addr2)
       {
@@ -1141,26 +1132,26 @@ static void push_rxbufs(ns_dev *card, struct sk_buff *skb)
 
    if (addr2)
    {
-      if (cb->buf_type == BUF_SM)
+      if (type == BUF_SM)
       {
          if (card->sbfqc >= card->sbnr.max)
          {
-            skb_unlink((struct sk_buff *) handle1, &card->sbpool.queue);
+            skb_unlink((struct sk_buff *) handle1);
             dev_kfree_skb_any((struct sk_buff *) handle1);
-            skb_unlink((struct sk_buff *) handle2, &card->sbpool.queue);
+            skb_unlink((struct sk_buff *) handle2);
             dev_kfree_skb_any((struct sk_buff *) handle2);
             return;
          }
 	 else
             card->sbfqc += 2;
       }
-      else /* (buf_type == BUF_LG) */
+      else /* (type == BUF_LG) */
       {
          if (card->lbfqc >= card->lbnr.max)
          {
-            skb_unlink((struct sk_buff *) handle1, &card->lbpool.queue);
+            skb_unlink((struct sk_buff *) handle1);
             dev_kfree_skb_any((struct sk_buff *) handle1);
-            skb_unlink((struct sk_buff *) handle2, &card->lbpool.queue);
+            skb_unlink((struct sk_buff *) handle2);
             dev_kfree_skb_any((struct sk_buff *) handle2);
             return;
          }
@@ -1175,12 +1166,12 @@ static void push_rxbufs(ns_dev *card, struct sk_buff *skb)
       writel(handle2, card->membase + DR2);
       writel(addr1, card->membase + DR1);
       writel(handle1, card->membase + DR0);
-      writel(NS_CMD_WRITE_FREEBUFQ | cb->buf_type, card->membase + CMD);
+      writel(NS_CMD_WRITE_FREEBUFQ | (u32) type, card->membase + CMD);
  
       spin_unlock_irqrestore(&card->res_lock, flags);
 
       XPRINTK("nicstar%d: Pushing %s buffers at 0x%x and 0x%x.\n", card->index,
-              (cb->buf_type == BUF_SM ? "small" : "large"), addr1, addr2);
+              (type == BUF_SM ? "small" : "large"), addr1, addr2);
    }
 
    if (!card->efbie && card->sbfqc >= card->sbnr.min &&
@@ -1331,10 +1322,9 @@ static irqreturn_t ns_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
             card->efbie = 0;
             break;
          }
-         NS_SKB_CB(sb)->buf_type = BUF_SM;
          skb_queue_tail(&card->sbpool.queue, sb);
          skb_reserve(sb, NS_AAL0_HEADER);
-         push_rxbufs(card, sb);
+         push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data), 0, 0);
       }
       card->sbfqc = i;
       process_rsq(card);
@@ -1358,10 +1348,9 @@ static irqreturn_t ns_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
             card->efbie = 0;
             break;
          }
-         NS_SKB_CB(lb)->buf_type = BUF_LG;
          skb_queue_tail(&card->lbpool.queue, lb);
          skb_reserve(lb, NS_SMBUFSIZE);
-         push_rxbufs(card, lb);
+         push_rxbufs(card, BUF_LG, (u32) lb, (u32) virt_to_bus(lb->data), 0, 0);
       }
       card->lbfqc = i;
       process_rsq(card);
@@ -2213,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
          memcpy(sb->tail, cell, ATM_CELL_PAYLOAD);
          skb_put(sb, ATM_CELL_PAYLOAD);
          ATM_SKB(sb)->vcc = vcc;
-	 __net_timestamp(sb);
+         do_gettimeofday(&sb->stamp);
          vcc->push(vcc, sb);
          atomic_inc(&vcc->stats->rx);
          cell += ATM_CELL_PAYLOAD;
@@ -2238,7 +2227,6 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             recycle_rx_buf(card, skb);
             return;
 	 }
-         NS_SKB_CB(iovb)->buf_type = BUF_NONE;
       }
       else
          if (--card->iovpool.count < card->iovnr.min)
@@ -2246,7 +2234,6 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
 	    struct sk_buff *new_iovb;
 	    if ((new_iovb = alloc_skb(NS_IOVBUFSIZE, GFP_ATOMIC)) != NULL)
 	    {
-               NS_SKB_CB(iovb)->buf_type = BUF_NONE;
                skb_queue_tail(&card->iovpool.queue, new_iovb);
                card->iovpool.count++;
 	    }
@@ -2277,7 +2264,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
 
    if (NS_SKB(iovb)->iovcnt == 1)
    {
-      if (NS_SKB_CB(skb)->buf_type != BUF_SM)
+      if (skb->list != &card->sbpool.queue)
       {
          printk("nicstar%d: Expected a small buffer, and this is not one.\n",
 	        card->index);
@@ -2291,7 +2278,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
    }
    else /* NS_SKB(iovb)->iovcnt >= 2 */
    {
-      if (NS_SKB_CB(skb)->buf_type != BUF_LG)
+      if (skb->list != &card->lbpool.queue)
       {
          printk("nicstar%d: Expected a large buffer, and this is not one.\n",
 	        card->index);
@@ -2335,7 +2322,8 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
          /* skb points to a small buffer */
          if (!atm_charge(vcc, skb->truesize))
          {
-            push_rxbufs(card, skb);
+            push_rxbufs(card, BUF_SM, (u32) skb, (u32) virt_to_bus(skb->data),
+                        0, 0);
             atomic_inc(&vcc->stats->rx_drop);
          }
          else
@@ -2346,7 +2334,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             skb->destructor = ns_sb_destructor;
 #endif /* NS_USE_DESTRUCTORS */
             ATM_SKB(skb)->vcc = vcc;
-	    __net_timestamp(skb);
+            do_gettimeofday(&skb->stamp);
             vcc->push(vcc, skb);
             atomic_inc(&vcc->stats->rx);
          }
@@ -2362,7 +2350,8 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
 	 {
             if (!atm_charge(vcc, sb->truesize))
             {
-               push_rxbufs(card, sb);
+               push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data),
+                           0, 0);
                atomic_inc(&vcc->stats->rx_drop);
             }
             else
@@ -2373,19 +2362,21 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
                sb->destructor = ns_sb_destructor;
 #endif /* NS_USE_DESTRUCTORS */
                ATM_SKB(sb)->vcc = vcc;
-	       __net_timestamp(sb);
+               do_gettimeofday(&sb->stamp);
                vcc->push(vcc, sb);
                atomic_inc(&vcc->stats->rx);
             }
 
-            push_rxbufs(card, skb);
+            push_rxbufs(card, BUF_LG, (u32) skb,
+	                   (u32) virt_to_bus(skb->data), 0, 0);
 
 	 }
 	 else			/* len > NS_SMBUFSIZE, the usual case */
 	 {
             if (!atm_charge(vcc, skb->truesize))
             {
-               push_rxbufs(card, skb);
+               push_rxbufs(card, BUF_LG, (u32) skb,
+                           (u32) virt_to_bus(skb->data), 0, 0);
                atomic_inc(&vcc->stats->rx_drop);
             }
             else
@@ -2398,12 +2389,13 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
                memcpy(skb->data, sb->data, NS_SMBUFSIZE);
                skb_put(skb, len - NS_SMBUFSIZE);
                ATM_SKB(skb)->vcc = vcc;
-	       __net_timestamp(skb);
+               do_gettimeofday(&skb->stamp);
                vcc->push(vcc, skb);
                atomic_inc(&vcc->stats->rx);
             }
 
-            push_rxbufs(card, sb);
+            push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data),
+                        0, 0);
 
          }
 	 
@@ -2438,7 +2430,6 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
                   card->hbpool.count++;
                }
             }
-            NS_SKB_CB(hb)->buf_type = BUF_NONE;
 	 }
 	 else
          if (--card->hbpool.count < card->hbnr.min)
@@ -2446,7 +2437,6 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             struct sk_buff *new_hb;
             if ((new_hb = dev_alloc_skb(NS_HBUFSIZE)) != NULL)
             {
-               NS_SKB_CB(new_hb)->buf_type = BUF_NONE;
                skb_queue_tail(&card->hbpool.queue, new_hb);
                card->hbpool.count++;
             }
@@ -2454,7 +2444,6 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
 	    {
                if ((new_hb = dev_alloc_skb(NS_HBUFSIZE)) != NULL)
                {
-                  NS_SKB_CB(new_hb)->buf_type = BUF_NONE;
                   skb_queue_tail(&card->hbpool.queue, new_hb);
                   card->hbpool.count++;
                }
@@ -2484,7 +2473,8 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             remaining = len - iov->iov_len;
             iov++;
             /* Free the small buffer */
-            push_rxbufs(card, sb);
+            push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data),
+                        0, 0);
 
             /* Copy all large buffers to the huge buffer and free them */
             for (j = 1; j < NS_SKB(iovb)->iovcnt; j++)
@@ -2495,7 +2485,8 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
                skb_put(hb, tocopy);
                iov++;
                remaining -= tocopy;
-               push_rxbufs(card, lb);
+               push_rxbufs(card, BUF_LG, (u32) lb,
+                           (u32) virt_to_bus(lb->data), 0, 0);
             }
 #ifdef EXTRA_DEBUG
             if (remaining != 0 || hb->len != len)
@@ -2505,7 +2496,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
 #ifdef NS_USE_DESTRUCTORS
             hb->destructor = ns_hb_destructor;
 #endif /* NS_USE_DESTRUCTORS */
-	    __net_timestamp(hb);
+            do_gettimeofday(&hb->stamp);
             vcc->push(vcc, hb);
             atomic_inc(&vcc->stats->rx);
          }
@@ -2536,10 +2527,9 @@ static void ns_sb_destructor(struct sk_buff *sb)
       sb = __dev_alloc_skb(NS_SMSKBSIZE, GFP_KERNEL);
       if (sb == NULL)
          break;
-      NS_SKB_CB(sb)->buf_type = BUF_SM;
       skb_queue_tail(&card->sbpool.queue, sb);
       skb_reserve(sb, NS_AAL0_HEADER);
-      push_rxbufs(card, sb);
+      push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data), 0, 0);
    } while (card->sbfqc < card->sbnr.min);
 }
 
@@ -2560,10 +2550,9 @@ static void ns_lb_destructor(struct sk_buff *lb)
       lb = __dev_alloc_skb(NS_LGSKBSIZE, GFP_KERNEL);
       if (lb == NULL)
          break;
-      NS_SKB_CB(lb)->buf_type = BUF_LG;
       skb_queue_tail(&card->lbpool.queue, lb);
       skb_reserve(lb, NS_SMBUFSIZE);
-      push_rxbufs(card, lb);
+      push_rxbufs(card, BUF_LG, (u32) lb, (u32) virt_to_bus(lb->data), 0, 0);
    } while (card->lbfqc < card->lbnr.min);
 }
 
@@ -2580,7 +2569,6 @@ static void ns_hb_destructor(struct sk_buff *hb)
       hb = __dev_alloc_skb(NS_HBUFSIZE, GFP_KERNEL);
       if (hb == NULL)
          break;
-      NS_SKB_CB(hb)->buf_type = BUF_NONE;
       skb_queue_tail(&card->hbpool.queue, hb);
       card->hbpool.count++;
    }
@@ -2589,25 +2577,45 @@ static void ns_hb_destructor(struct sk_buff *hb)
 #endif /* NS_USE_DESTRUCTORS */
 
 
+
 static void recycle_rx_buf(ns_dev *card, struct sk_buff *skb)
 {
-	struct ns_skb_cb *cb = NS_SKB_CB(skb);
-
-	if (unlikely(cb->buf_type == BUF_NONE)) {
-		printk("nicstar%d: What kind of rx buffer is this?\n", card->index);
-		dev_kfree_skb_any(skb);
-	} else
-		push_rxbufs(card, skb);
+   if (skb->list == &card->sbpool.queue)
+      push_rxbufs(card, BUF_SM, (u32) skb, (u32) virt_to_bus(skb->data), 0, 0);
+   else if (skb->list == &card->lbpool.queue)
+      push_rxbufs(card, BUF_LG, (u32) skb, (u32) virt_to_bus(skb->data), 0, 0);
+   else
+   {
+      printk("nicstar%d: What kind of rx buffer is this?\n", card->index);
+      dev_kfree_skb_any(skb);
+   }
 }
 
 
+
 static void recycle_iovec_rx_bufs(ns_dev *card, struct iovec *iov, int count)
 {
-	while (count-- > 0)
-		recycle_rx_buf(card, (struct sk_buff *) (iov++)->iov_base);
+   struct sk_buff *skb;
+
+   for (; count > 0; count--)
+   {
+      skb = (struct sk_buff *) (iov++)->iov_base;
+      if (skb->list == &card->sbpool.queue)
+         push_rxbufs(card, BUF_SM, (u32) skb, (u32) virt_to_bus(skb->data),
+	             0, 0);
+      else if (skb->list == &card->lbpool.queue)
+         push_rxbufs(card, BUF_LG, (u32) skb, (u32) virt_to_bus(skb->data),
+	             0, 0);
+      else
+      {
+         printk("nicstar%d: What kind of rx buffer is this?\n", card->index);
+         dev_kfree_skb_any(skb);
+      }
+   }
 }
 
 
+
 static void recycle_iov_buf(ns_dev *card, struct sk_buff *iovb)
 {
    if (card->iovpool.count < card->iovnr.max)
@@ -2623,7 +2631,7 @@ static void recycle_iov_buf(ns_dev *card, struct sk_buff *iovb)
 
 static void dequeue_sm_buf(ns_dev *card, struct sk_buff *sb)
 {
-   skb_unlink(sb, &card->sbpool.queue);
+   skb_unlink(sb);
 #ifdef NS_USE_DESTRUCTORS
    if (card->sbfqc < card->sbnr.min)
 #else
@@ -2632,10 +2640,10 @@ static void dequeue_sm_buf(ns_dev *card, struct sk_buff *sb)
       struct sk_buff *new_sb;
       if ((new_sb = dev_alloc_skb(NS_SMSKBSIZE)) != NULL)
       {
-         NS_SKB_CB(new_sb)->buf_type = BUF_SM;
          skb_queue_tail(&card->sbpool.queue, new_sb);
          skb_reserve(new_sb, NS_AAL0_HEADER);
-         push_rxbufs(card, new_sb);
+         push_rxbufs(card, BUF_SM, (u32) new_sb,
+                     (u32) virt_to_bus(new_sb->data), 0, 0);
       }
    }
    if (card->sbfqc < card->sbnr.init)
@@ -2644,10 +2652,10 @@ static void dequeue_sm_buf(ns_dev *card, struct sk_buff *sb)
       struct sk_buff *new_sb;
       if ((new_sb = dev_alloc_skb(NS_SMSKBSIZE)) != NULL)
       {
-         NS_SKB_CB(new_sb)->buf_type = BUF_SM;
          skb_queue_tail(&card->sbpool.queue, new_sb);
          skb_reserve(new_sb, NS_AAL0_HEADER);
-         push_rxbufs(card, new_sb);
+         push_rxbufs(card, BUF_SM, (u32) new_sb,
+                     (u32) virt_to_bus(new_sb->data), 0, 0);
       }
    }
 }
@@ -2656,7 +2664,7 @@ static void dequeue_sm_buf(ns_dev *card, struct sk_buff *sb)
 
 static void dequeue_lg_buf(ns_dev *card, struct sk_buff *lb)
 {
-   skb_unlink(lb, &card->lbpool.queue);
+   skb_unlink(lb);
 #ifdef NS_USE_DESTRUCTORS
    if (card->lbfqc < card->lbnr.min)
 #else
@@ -2665,10 +2673,10 @@ static void dequeue_lg_buf(ns_dev *card, struct sk_buff *lb)
       struct sk_buff *new_lb;
       if ((new_lb = dev_alloc_skb(NS_LGSKBSIZE)) != NULL)
       {
-         NS_SKB_CB(new_lb)->buf_type = BUF_LG;
          skb_queue_tail(&card->lbpool.queue, new_lb);
          skb_reserve(new_lb, NS_SMBUFSIZE);
-         push_rxbufs(card, new_lb);
+         push_rxbufs(card, BUF_LG, (u32) new_lb,
+                     (u32) virt_to_bus(new_lb->data), 0, 0);
       }
    }
    if (card->lbfqc < card->lbnr.init)
@@ -2677,10 +2685,10 @@ static void dequeue_lg_buf(ns_dev *card, struct sk_buff *lb)
       struct sk_buff *new_lb;
       if ((new_lb = dev_alloc_skb(NS_LGSKBSIZE)) != NULL)
       {
-         NS_SKB_CB(new_lb)->buf_type = BUF_LG;
          skb_queue_tail(&card->lbpool.queue, new_lb);
          skb_reserve(new_lb, NS_SMBUFSIZE);
-         push_rxbufs(card, new_lb);
+         push_rxbufs(card, BUF_LG, (u32) new_lb,
+                     (u32) virt_to_bus(new_lb->data), 0, 0);
       }
    }
 }
@@ -2872,10 +2880,9 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   sb = __dev_alloc_skb(NS_SMSKBSIZE, GFP_KERNEL);
                   if (sb == NULL)
                      return -ENOMEM;
-                  NS_SKB_CB(sb)->buf_type = BUF_SM;
                   skb_queue_tail(&card->sbpool.queue, sb);
                   skb_reserve(sb, NS_AAL0_HEADER);
-                  push_rxbufs(card, sb);
+                  push_rxbufs(card, BUF_SM, (u32) sb, (u32) virt_to_bus(sb->data), 0, 0);
 	       }
 	       break;
 
@@ -2887,10 +2894,9 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   lb = __dev_alloc_skb(NS_LGSKBSIZE, GFP_KERNEL);
                   if (lb == NULL)
                      return -ENOMEM;
-                  NS_SKB_CB(lb)->buf_type = BUF_LG;
                   skb_queue_tail(&card->lbpool.queue, lb);
                   skb_reserve(lb, NS_SMBUFSIZE);
-                  push_rxbufs(card, lb);
+                  push_rxbufs(card, BUF_LG, (u32) lb, (u32) virt_to_bus(lb->data), 0, 0);
 	       }
 	       break;
 
@@ -2917,7 +2923,6 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   hb = __dev_alloc_skb(NS_HBUFSIZE, GFP_KERNEL);
                   if (hb == NULL)
                      return -ENOMEM;
-                  NS_SKB_CB(hb)->buf_type = BUF_NONE;
                   ns_grab_int_lock(card, flags);
                   skb_queue_tail(&card->hbpool.queue, hb);
                   card->hbpool.count++;
@@ -2948,7 +2953,6 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   iovb = alloc_skb(NS_IOVBUFSIZE, GFP_KERNEL);
                   if (iovb == NULL)
                      return -ENOMEM;
-                  NS_SKB_CB(iovb)->buf_type = BUF_NONE;
                   ns_grab_int_lock(card, flags);
                   skb_queue_tail(&card->iovpool.queue, iovb);
                   card->iovpool.count++;
@@ -2975,12 +2979,17 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
 }
 
 
+
 static void which_list(ns_dev *card, struct sk_buff *skb)
 {
-	printk("skb buf_type: 0x%08x\n", NS_SKB_CB(skb)->buf_type);
+   printk("It's a %s buffer.\n", skb->list == &card->sbpool.queue ?
+          "small" : skb->list == &card->lbpool.queue ? "large" :
+	  skb->list == &card->hbpool.queue ? "huge" :
+	  skb->list == &card->iovpool.queue ? "iovec" : "unknown");
 }
 
 
+
 static void ns_poll(unsigned long arg)
 {
    int i;
diff --git a/trunk/drivers/atm/nicstar.h b/trunk/drivers/atm/nicstar.h
index 5997bcb45b59..ea83c46c8ba5 100644
--- a/trunk/drivers/atm/nicstar.h
+++ b/trunk/drivers/atm/nicstar.h
@@ -103,14 +103,8 @@
 
 #define NS_IOREMAP_SIZE 4096
 
-/*
- * BUF_XX distinguish the Rx buffers depending on their (small/large) size.
- * BUG_SM and BUG_LG are both used by the driver and the device.
- * BUF_NONE is only used by the driver.
- */
-#define BUF_SM		0x00000000	/* These two are used for push_rxbufs() */
-#define BUF_LG		0x00000001	/* CMD, Write_FreeBufQ, LBUF bit */
-#define BUF_NONE 	0xffffffff	/* Software only: */
+#define BUF_SM 0x00000000	/* These two are used for push_rxbufs() */
+#define BUF_LG 0x00000001       /* CMD, Write_FreeBufQ, LBUF bit */
 
 #define NS_HBUFSIZE 65568	/* Size of max. AAL5 PDU */
 #define NS_MAX_IOVECS (2 + (65568 - NS_SMBUFSIZE) / \
@@ -690,12 +684,6 @@ enum ns_regs
 /* Device driver structures ***************************************************/
 
 
-struct ns_skb_cb {
-	u32 buf_type;			/* BUF_SM/BUF_LG/BUF_NONE */
-};
-
-#define NS_SKB_CB(skb)	((struct ns_skb_cb *)((skb)->cb))
-
 typedef struct tsq_info
 {
    void *org;
diff --git a/trunk/drivers/atm/zatm.c b/trunk/drivers/atm/zatm.c
index c4b75ecf9460..a2b236a966e0 100644
--- a/trunk/drivers/atm/zatm.c
+++ b/trunk/drivers/atm/zatm.c
@@ -400,7 +400,7 @@ unsigned long *x;
 EVENT("error code 0x%x/0x%x\n",(here[3] & uPD98401_AAL5_ES) >>
   uPD98401_AAL5_ES_SHIFT,error);
 		skb = ((struct rx_buffer_head *) bus_to_virt(here[2]))->skb;
-		__net_timestamp(skb);
+		do_gettimeofday(&skb->stamp);
 #if 0
 printk("[-3..0] 0x%08lx 0x%08lx 0x%08lx 0x%08lx\n",((unsigned *) skb->data)[-3],
   ((unsigned *) skb->data)[-2],((unsigned *) skb->data)[-1],
@@ -417,12 +417,10 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
 		chan = (here[3] & uPD98401_AAL5_CHAN) >>
 		    uPD98401_AAL5_CHAN_SHIFT;
 		if (chan < zatm_dev->chans && zatm_dev->rx_map[chan]) {
-			int pos = ZATM_VCC(vcc)->pool;
-
 			vcc = zatm_dev->rx_map[chan];
-			if (skb == zatm_dev->last_free[pos])
-				zatm_dev->last_free[pos] = NULL;
-			skb_unlink(skb, zatm_dev->pool + pos);
+			if (skb == zatm_dev->last_free[ZATM_VCC(vcc)->pool])
+				zatm_dev->last_free[ZATM_VCC(vcc)->pool] = NULL;
+			skb_unlink(skb);
 		}
 		else {
 			printk(KERN_ERR DEV_LABEL "(itf %d): RX indication "
diff --git a/trunk/drivers/block/aoe/aoenet.c b/trunk/drivers/block/aoe/aoenet.c
index 4be976940f69..9e6f51c528b0 100644
--- a/trunk/drivers/block/aoe/aoenet.c
+++ b/trunk/drivers/block/aoe/aoenet.c
@@ -120,7 +120,7 @@ aoenet_xmit(struct sk_buff *sl)
  * (1) len doesn't include the header by default.  I want this. 
  */
 static int
-aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt, struct net_device *orig_dev)
+aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt)
 {
 	struct aoe_hdr *h;
 	u32 n;
diff --git a/trunk/drivers/block/viodasd.c b/trunk/drivers/block/viodasd.c
index e46ecd23b3ac..46e56a25d2c8 100644
--- a/trunk/drivers/block/viodasd.c
+++ b/trunk/drivers/block/viodasd.c
@@ -776,7 +776,7 @@ static int viodasd_remove(struct vio_dev *vdev)
  */
 static struct vio_device_id viodasd_device_table[] __devinitdata = {
 	{ "viodasd", "" },
-	{ "", "" }
+	{ 0, }
 };
 
 MODULE_DEVICE_TABLE(vio, viodasd_device_table);
diff --git a/trunk/drivers/bluetooth/bfusb.c b/trunk/drivers/bluetooth/bfusb.c
index 1e9db0156ea7..c42d7e6ac1c5 100644
--- a/trunk/drivers/bluetooth/bfusb.c
+++ b/trunk/drivers/bluetooth/bfusb.c
@@ -158,7 +158,7 @@ static int bfusb_send_bulk(struct bfusb *bfusb, struct sk_buff *skb)
 	if (err) {
 		BT_ERR("%s bulk tx submit failed urb %p err %d", 
 					bfusb->hdev->name, urb, err);
-		skb_unlink(skb, &bfusb->pending_q);
+		skb_unlink(skb);
 		usb_free_urb(urb);
 	} else
 		atomic_inc(&bfusb->pending_tx);
@@ -212,7 +212,7 @@ static void bfusb_tx_complete(struct urb *urb, struct pt_regs *regs)
 
 	read_lock(&bfusb->lock);
 
-	skb_unlink(skb, &bfusb->pending_q);
+	skb_unlink(skb);
 	skb_queue_tail(&bfusb->completed_q, skb);
 
 	bfusb_tx_wakeup(bfusb);
@@ -253,7 +253,7 @@ static int bfusb_rx_submit(struct bfusb *bfusb, struct urb *urb)
 	if (err) {
 		BT_ERR("%s bulk rx submit failed urb %p err %d",
 					bfusb->hdev->name, urb, err);
-		skb_unlink(skb, &bfusb->pending_q);
+		skb_unlink(skb);
 		kfree_skb(skb);
 		usb_free_urb(urb);
 	}
@@ -330,7 +330,7 @@ static inline int bfusb_recv_block(struct bfusb *bfusb, int hdr, unsigned char *
 		}
 
 		skb->dev = (void *) bfusb->hdev;
-		bt_cb(skb)->pkt_type = pkt_type;
+		skb->pkt_type = pkt_type;
 
 		bfusb->reassembly = skb;
 	} else {
@@ -398,7 +398,7 @@ static void bfusb_rx_complete(struct urb *urb, struct pt_regs *regs)
 		buf   += len;
 	}
 
-	skb_unlink(skb, &bfusb->pending_q);
+	skb_unlink(skb);
 	kfree_skb(skb);
 
 	bfusb_rx_submit(bfusb, urb);
@@ -485,7 +485,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
 	unsigned char buf[3];
 	int sent = 0, size, count;
 
-	BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, bt_cb(skb)->pkt_type, skb->len);
+	BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, skb->pkt_type, skb->len);
 
 	if (!hdev) {
 		BT_ERR("Frame for unknown HCI device (hdev=NULL)");
@@ -497,7 +497,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
 
 	bfusb = (struct bfusb *) hdev->driver_data;
 
-	switch (bt_cb(skb)->pkt_type) {
+	switch (skb->pkt_type) {
 	case HCI_COMMAND_PKT:
 		hdev->stat.cmd_tx++;
 		break;
@@ -510,7 +510,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
 	};
 
 	/* Prepend skb with frame type */
-	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
+	memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
 
 	count = skb->len;
 
diff --git a/trunk/drivers/bluetooth/bluecard_cs.c b/trunk/drivers/bluetooth/bluecard_cs.c
index 26fe9c0e1d20..bd2ec7e284cc 100644
--- a/trunk/drivers/bluetooth/bluecard_cs.c
+++ b/trunk/drivers/bluetooth/bluecard_cs.c
@@ -270,7 +270,7 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
 		if (!(skb = skb_dequeue(&(info->txq))))
 			break;
 
-		if (bt_cb(skb)->pkt_type & 0x80) {
+		if (skb->pkt_type & 0x80) {
 			/* Disable RTS */
 			info->ctrl_reg |= REG_CONTROL_RTS;
 			outb(info->ctrl_reg, iobase + REG_CONTROL);
@@ -288,13 +288,13 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
 		/* Mark the buffer as dirty */
 		clear_bit(ready_bit, &(info->tx_state));
 
-		if (bt_cb(skb)->pkt_type & 0x80) {
+		if (skb->pkt_type & 0x80) {
 			DECLARE_WAIT_QUEUE_HEAD(wq);
 			DEFINE_WAIT(wait);
 
 			unsigned char baud_reg;
 
-			switch (bt_cb(skb)->pkt_type) {
+			switch (skb->pkt_type) {
 			case PKT_BAUD_RATE_460800:
 				baud_reg = REG_CONTROL_BAUD_RATE_460800;
 				break;
@@ -410,9 +410,9 @@ static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
 		if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
 			info->rx_skb->dev = (void *) info->hdev;
-			bt_cb(info->rx_skb)->pkt_type = buf[i];
+			info->rx_skb->pkt_type = buf[i];
 
-			switch (bt_cb(info->rx_skb)->pkt_type) {
+			switch (info->rx_skb->pkt_type) {
 
 			case 0x00:
 				/* init packet */
@@ -444,7 +444,7 @@ static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
 
 			default:
 				/* unknown packet */
-				BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
+				BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
 				info->hdev->stat.err_rx++;
 
 				kfree_skb(info->rx_skb);
@@ -586,21 +586,21 @@ static int bluecard_hci_set_baud_rate(struct hci_dev *hdev, int baud)
 	switch (baud) {
 	case 460800:
 		cmd[4] = 0x00;
-		bt_cb(skb)->pkt_type = PKT_BAUD_RATE_460800;
+		skb->pkt_type = PKT_BAUD_RATE_460800;
 		break;
 	case 230400:
 		cmd[4] = 0x01;
-		bt_cb(skb)->pkt_type = PKT_BAUD_RATE_230400;
+		skb->pkt_type = PKT_BAUD_RATE_230400;
 		break;
 	case 115200:
 		cmd[4] = 0x02;
-		bt_cb(skb)->pkt_type = PKT_BAUD_RATE_115200;
+		skb->pkt_type = PKT_BAUD_RATE_115200;
 		break;
 	case 57600:
 		/* Fall through... */
 	default:
 		cmd[4] = 0x03;
-		bt_cb(skb)->pkt_type = PKT_BAUD_RATE_57600;
+		skb->pkt_type = PKT_BAUD_RATE_57600;
 		break;
 	}
 
@@ -680,7 +680,7 @@ static int bluecard_hci_send_frame(struct sk_buff *skb)
 
 	info = (bluecard_info_t *)(hdev->driver_data);
 
-	switch (bt_cb(skb)->pkt_type) {
+	switch (skb->pkt_type) {
 	case HCI_COMMAND_PKT:
 		hdev->stat.cmd_tx++;
 		break;
@@ -693,7 +693,7 @@ static int bluecard_hci_send_frame(struct sk_buff *skb)
 	};
 
 	/* Prepend skb with frame type */
-	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
+	memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
 	skb_queue_tail(&(info->txq), skb);
 
 	bluecard_write_wakeup(info);
diff --git a/trunk/drivers/bluetooth/bpa10x.c b/trunk/drivers/bluetooth/bpa10x.c
index a1bf8f066c88..f696da6f417b 100644
--- a/trunk/drivers/bluetooth/bpa10x.c
+++ b/trunk/drivers/bluetooth/bpa10x.c
@@ -105,7 +105,7 @@ static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int c
 			if (skb) {
 				memcpy(skb_put(skb, len), buf, len);
 				skb->dev = (void *) data->hdev;
-				bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
+				skb->pkt_type = HCI_ACLDATA_PKT;
 				hci_recv_frame(skb);
 			}
 			break;
@@ -117,7 +117,7 @@ static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int c
 			if (skb) {
 				memcpy(skb_put(skb, len), buf, len);
 				skb->dev = (void *) data->hdev;
-				bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
+				skb->pkt_type = HCI_SCODATA_PKT;
 				hci_recv_frame(skb);
 			}
 			break;
@@ -129,7 +129,7 @@ static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int c
 			if (skb) {
 				memcpy(skb_put(skb, len), buf, len);
 				skb->dev = (void *) data->hdev;
-				bt_cb(skb)->pkt_type = HCI_VENDOR_PKT;
+				skb->pkt_type = HCI_VENDOR_PKT;
 				hci_recv_frame(skb);
 			}
 			break;
@@ -190,7 +190,7 @@ static int bpa10x_recv_event(struct bpa10x_data *data, unsigned char *buf, int s
 		}
 
 		skb->dev = (void *) data->hdev;
-		bt_cb(skb)->pkt_type = pkt_type;
+		skb->pkt_type = pkt_type;
 
 		memcpy(skb_put(skb, size), buf, size);
 
@@ -307,8 +307,7 @@ static void bpa10x_complete(struct urb *urb, struct pt_regs *regs)
 	read_unlock(&data->lock);
 }
 
-static inline struct urb *bpa10x_alloc_urb(struct usb_device *udev, unsigned int pipe,
-					size_t size, unsigned int __nocast flags, void *data)
+static inline struct urb *bpa10x_alloc_urb(struct usb_device *udev, unsigned int pipe, size_t size, int flags, void *data)
 {
 	struct urb *urb;
 	struct usb_ctrlrequest *cr;
@@ -488,7 +487,7 @@ static int bpa10x_send_frame(struct sk_buff *skb)
 	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 	struct bpa10x_data *data;
 
-	BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, bt_cb(skb)->pkt_type, skb->len);
+	BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, skb->pkt_type, skb->len);
 
 	if (!hdev) {
 		BT_ERR("Frame for unknown HCI device");
@@ -501,9 +500,9 @@ static int bpa10x_send_frame(struct sk_buff *skb)
 	data = hdev->driver_data;
 
 	/* Prepend skb with frame type */
-	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
+	memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
 
-	switch (bt_cb(skb)->pkt_type) {
+	switch (skb->pkt_type) {
 	case HCI_COMMAND_PKT:
 		hdev->stat.cmd_tx++;
 		skb_queue_tail(&data->cmd_queue, skb);
diff --git a/trunk/drivers/bluetooth/bt3c_cs.c b/trunk/drivers/bluetooth/bt3c_cs.c
index 2e0338d80f32..adf1750ea58d 100644
--- a/trunk/drivers/bluetooth/bt3c_cs.c
+++ b/trunk/drivers/bluetooth/bt3c_cs.c
@@ -259,11 +259,11 @@ static void bt3c_receive(bt3c_info_t *info)
 		if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
 			info->rx_skb->dev = (void *) info->hdev;
-			bt_cb(info->rx_skb)->pkt_type = inb(iobase + DATA_L);
+			info->rx_skb->pkt_type = inb(iobase + DATA_L);
 			inb(iobase + DATA_H);
-			//printk("bt3c: PACKET_TYPE=%02x\n", bt_cb(info->rx_skb)->pkt_type);
+			//printk("bt3c: PACKET_TYPE=%02x\n", info->rx_skb->pkt_type);
 
-			switch (bt_cb(info->rx_skb)->pkt_type) {
+			switch (info->rx_skb->pkt_type) {
 
 			case HCI_EVENT_PKT:
 				info->rx_state = RECV_WAIT_EVENT_HEADER;
@@ -282,7 +282,7 @@ static void bt3c_receive(bt3c_info_t *info)
 
 			default:
 				/* Unknown packet */
-				BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
+				BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
 				info->hdev->stat.err_rx++;
 				clear_bit(HCI_RUNNING, &(info->hdev->flags));
 
@@ -439,7 +439,7 @@ static int bt3c_hci_send_frame(struct sk_buff *skb)
 
 	info = (bt3c_info_t *) (hdev->driver_data);
 
-	switch (bt_cb(skb)->pkt_type) {
+	switch (skb->pkt_type) {
 	case HCI_COMMAND_PKT:
 		hdev->stat.cmd_tx++;
 		break;
@@ -452,7 +452,7 @@ static int bt3c_hci_send_frame(struct sk_buff *skb)
 	};
 
 	/* Prepend skb with frame type */
-	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
+	memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
 	skb_queue_tail(&(info->txq), skb);
 
 	spin_lock_irqsave(&(info->lock), flags);
diff --git a/trunk/drivers/bluetooth/btuart_cs.c b/trunk/drivers/bluetooth/btuart_cs.c
index 89486ea7a021..e4c59fdc0e12 100644
--- a/trunk/drivers/bluetooth/btuart_cs.c
+++ b/trunk/drivers/bluetooth/btuart_cs.c
@@ -211,9 +211,9 @@ static void btuart_receive(btuart_info_t *info)
 		if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
 			info->rx_skb->dev = (void *) info->hdev;
-			bt_cb(info->rx_skb)->pkt_type = inb(iobase + UART_RX);
+			info->rx_skb->pkt_type = inb(iobase + UART_RX);
 
-			switch (bt_cb(info->rx_skb)->pkt_type) {
+			switch (info->rx_skb->pkt_type) {
 
 			case HCI_EVENT_PKT:
 				info->rx_state = RECV_WAIT_EVENT_HEADER;
@@ -232,7 +232,7 @@ static void btuart_receive(btuart_info_t *info)
 
 			default:
 				/* Unknown packet */
-				BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
+				BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
 				info->hdev->stat.err_rx++;
 				clear_bit(HCI_RUNNING, &(info->hdev->flags));
 
@@ -447,7 +447,7 @@ static int btuart_hci_send_frame(struct sk_buff *skb)
 
 	info = (btuart_info_t *)(hdev->driver_data);
 
-	switch (bt_cb(skb)->pkt_type) {
+	switch (skb->pkt_type) {
 	case HCI_COMMAND_PKT:
 		hdev->stat.cmd_tx++;
 		break;
@@ -460,7 +460,7 @@ static int btuart_hci_send_frame(struct sk_buff *skb)
 	};
 
 	/* Prepend skb with frame type */
-	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
+	memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
 	skb_queue_tail(&(info->txq), skb);
 
 	btuart_write_wakeup(info);
diff --git a/trunk/drivers/bluetooth/dtl1_cs.c b/trunk/drivers/bluetooth/dtl1_cs.c
index 84c1f8839422..e39868c3da48 100644
--- a/trunk/drivers/bluetooth/dtl1_cs.c
+++ b/trunk/drivers/bluetooth/dtl1_cs.c
@@ -251,7 +251,7 @@ static void dtl1_receive(dtl1_info_t *info)
 				info->rx_count = nsh->len + (nsh->len & 0x0001);
 				break;
 			case RECV_WAIT_DATA:
-				bt_cb(info->rx_skb)->pkt_type = nsh->type;
+				info->rx_skb->pkt_type = nsh->type;
 
 				/* remove PAD byte if it exists */
 				if (nsh->len & 0x0001) {
@@ -262,7 +262,7 @@ static void dtl1_receive(dtl1_info_t *info)
 				/* remove NSH */
 				skb_pull(info->rx_skb, NSHL);
 
-				switch (bt_cb(info->rx_skb)->pkt_type) {
+				switch (info->rx_skb->pkt_type) {
 				case 0x80:
 					/* control data for the Nokia Card */
 					dtl1_control(info, info->rx_skb);
@@ -272,12 +272,12 @@ static void dtl1_receive(dtl1_info_t *info)
 				case 0x84:
 					/* send frame to the HCI layer */
 					info->rx_skb->dev = (void *) info->hdev;
-					bt_cb(info->rx_skb)->pkt_type &= 0x0f;
+					info->rx_skb->pkt_type &= 0x0f;
 					hci_recv_frame(info->rx_skb);
 					break;
 				default:
 					/* unknown packet */
-					BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
+					BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
 					kfree_skb(info->rx_skb);
 					break;
 				}
@@ -410,7 +410,7 @@ static int dtl1_hci_send_frame(struct sk_buff *skb)
 
 	info = (dtl1_info_t *)(hdev->driver_data);
 
-	switch (bt_cb(skb)->pkt_type) {
+	switch (skb->pkt_type) {
 	case HCI_COMMAND_PKT:
 		hdev->stat.cmd_tx++;
 		nsh.type = 0x81;
diff --git a/trunk/drivers/bluetooth/hci_bcsp.c b/trunk/drivers/bluetooth/hci_bcsp.c
index 0ee324e1265d..858fddb046de 100644
--- a/trunk/drivers/bluetooth/hci_bcsp.c
+++ b/trunk/drivers/bluetooth/hci_bcsp.c
@@ -149,7 +149,7 @@ static int bcsp_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 		return 0;
 	}
 
-	switch (bt_cb(skb)->pkt_type) {
+	switch (skb->pkt_type) {
 	case HCI_ACLDATA_PKT:
 	case HCI_COMMAND_PKT:
 		skb_queue_tail(&bcsp->rel, skb);
@@ -227,7 +227,7 @@ static struct sk_buff *bcsp_prepare_pkt(struct bcsp_struct *bcsp, u8 *data,
 	if (!nskb)
 		return NULL;
 
-	bt_cb(nskb)->pkt_type = pkt_type;
+	nskb->pkt_type = pkt_type;
 
 	bcsp_slip_msgdelim(nskb);
 
@@ -286,7 +286,7 @@ static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
 	   since they have priority */
 
 	if ((skb = skb_dequeue(&bcsp->unrel)) != NULL) {
-		struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
+		struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, skb->pkt_type);
 		if (nskb) {
 			kfree_skb(skb);
 			return nskb;
@@ -303,7 +303,7 @@ static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
 	spin_lock_irqsave(&bcsp->unack.lock, flags);
 
 	if (bcsp->unack.qlen < BCSP_TXWINSIZE && (skb = skb_dequeue(&bcsp->rel)) != NULL) {
-		struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
+		struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, skb->pkt_type);
 		if (nskb) {
 			__skb_queue_tail(&bcsp->unack, skb);
 			mod_timer(&bcsp->tbcsp, jiffies + HZ / 4);
@@ -401,7 +401,7 @@ static void bcsp_handle_le_pkt(struct hci_uart *hu)
 		if (!nskb)
 			return;
 		memcpy(skb_put(nskb, 4), conf_rsp_pkt, 4);
-		bt_cb(nskb)->pkt_type = BCSP_LE_PKT;
+		nskb->pkt_type = BCSP_LE_PKT;
 
 		skb_queue_head(&bcsp->unrel, nskb);
 		hci_uart_tx_wakeup(hu);
@@ -483,14 +483,14 @@ static inline void bcsp_complete_rx_pkt(struct hci_uart *hu)
 	bcsp_pkt_cull(bcsp);
 	if ((bcsp->rx_skb->data[1] & 0x0f) == 6 &&
 			bcsp->rx_skb->data[0] & 0x80) {
-		bt_cb(bcsp->rx_skb)->pkt_type = HCI_ACLDATA_PKT;
+		bcsp->rx_skb->pkt_type = HCI_ACLDATA_PKT;
 		pass_up = 1;
 	} else if ((bcsp->rx_skb->data[1] & 0x0f) == 5 &&
 			bcsp->rx_skb->data[0] & 0x80) {
-		bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
+		bcsp->rx_skb->pkt_type = HCI_EVENT_PKT;
 		pass_up = 1;
 	} else if ((bcsp->rx_skb->data[1] & 0x0f) == 7) {
-		bt_cb(bcsp->rx_skb)->pkt_type = HCI_SCODATA_PKT;
+		bcsp->rx_skb->pkt_type = HCI_SCODATA_PKT;
 		pass_up = 1;
 	} else if ((bcsp->rx_skb->data[1] & 0x0f) == 1 &&
 			!(bcsp->rx_skb->data[0] & 0x80)) {
@@ -512,7 +512,7 @@ static inline void bcsp_complete_rx_pkt(struct hci_uart *hu)
 				hdr.evt = 0xff;
 				hdr.plen = bcsp->rx_skb->len;
 				memcpy(skb_push(bcsp->rx_skb, HCI_EVENT_HDR_SIZE), &hdr, HCI_EVENT_HDR_SIZE);
-				bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
+				bcsp->rx_skb->pkt_type = HCI_EVENT_PKT;
 
 				hci_recv_frame(bcsp->rx_skb);
 			} else {
diff --git a/trunk/drivers/bluetooth/hci_h4.c b/trunk/drivers/bluetooth/hci_h4.c
index cf8a22d58d96..533323b60e63 100644
--- a/trunk/drivers/bluetooth/hci_h4.c
+++ b/trunk/drivers/bluetooth/hci_h4.c
@@ -112,7 +112,7 @@ static int h4_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 	BT_DBG("hu %p skb %p", hu, skb);
 
 	/* Prepend skb with frame type */
-	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
+	memcpy(skb_push(skb, 1), &skb->pkt_type, 1);
 	skb_queue_tail(&h4->txq, skb);
 	return 0;
 }
@@ -239,7 +239,7 @@ static int h4_recv(struct hci_uart *hu, void *data, int count)
 			return 0;
 		}
 		h4->rx_skb->dev = (void *) hu->hdev;
-		bt_cb(h4->rx_skb)->pkt_type = type;
+		h4->rx_skb->pkt_type = type;
 	}
 	return count;
 }
diff --git a/trunk/drivers/bluetooth/hci_ldisc.c b/trunk/drivers/bluetooth/hci_ldisc.c
index aed80cc22890..90be2eae52e0 100644
--- a/trunk/drivers/bluetooth/hci_ldisc.c
+++ b/trunk/drivers/bluetooth/hci_ldisc.c
@@ -153,7 +153,7 @@ int hci_uart_tx_wakeup(struct hci_uart *hu)
 			break;
 		}
 	
-		hci_uart_tx_complete(hu, bt_cb(skb)->pkt_type);
+		hci_uart_tx_complete(hu, skb->pkt_type);
 		kfree_skb(skb);
 	} 
 	
@@ -229,7 +229,7 @@ static int hci_uart_send_frame(struct sk_buff *skb)
 	hu = (struct hci_uart *) hdev->driver_data;
 	tty = hu->tty;
 
-	BT_DBG("%s: type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
+	BT_DBG("%s: type %d len %d", hdev->name, skb->pkt_type, skb->len);
 
 	hu->proto->enqueue(hu, skb);
 
diff --git a/trunk/drivers/bluetooth/hci_usb.c b/trunk/drivers/bluetooth/hci_usb.c
index 67d96b5cbb96..657719b8254f 100644
--- a/trunk/drivers/bluetooth/hci_usb.c
+++ b/trunk/drivers/bluetooth/hci_usb.c
@@ -127,7 +127,7 @@ static struct usb_device_id blacklist_ids[] = {
 	{ }	/* Terminating entry */
 };
 
-static struct _urb *_urb_alloc(int isoc, unsigned int __nocast gfp)
+static struct _urb *_urb_alloc(int isoc, int gfp)
 {
 	struct _urb *_urb = kmalloc(sizeof(struct _urb) +
 				sizeof(struct usb_iso_packet_descriptor) * isoc, gfp);
@@ -443,7 +443,7 @@ static int __tx_submit(struct hci_usb *husb, struct _urb *_urb)
 
 static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
 {
-	struct _urb *_urb = __get_completed(husb, bt_cb(skb)->pkt_type);
+	struct _urb *_urb = __get_completed(husb, skb->pkt_type);
 	struct usb_ctrlrequest *dr;
 	struct urb *urb;
 
@@ -451,7 +451,7 @@ static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
 		_urb = _urb_alloc(0, GFP_ATOMIC);
 		if (!_urb)
 			return -ENOMEM;
-		_urb->type = bt_cb(skb)->pkt_type;
+		_urb->type = skb->pkt_type;
 
 		dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
 		if (!dr) {
@@ -479,7 +479,7 @@ static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
 
 static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
 {
-	struct _urb *_urb = __get_completed(husb, bt_cb(skb)->pkt_type);
+	struct _urb *_urb = __get_completed(husb, skb->pkt_type);
 	struct urb *urb;
 	int pipe;
 
@@ -487,7 +487,7 @@ static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
 		_urb = _urb_alloc(0, GFP_ATOMIC);
 		if (!_urb)
 			return -ENOMEM;
-		_urb->type = bt_cb(skb)->pkt_type;
+		_urb->type = skb->pkt_type;
 	}
 
 	urb  = &_urb->urb;
@@ -505,14 +505,14 @@ static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
 #ifdef CONFIG_BT_HCIUSB_SCO
 static inline int hci_usb_send_isoc(struct hci_usb *husb, struct sk_buff *skb)
 {
-	struct _urb *_urb = __get_completed(husb, bt_cb(skb)->pkt_type);
+	struct _urb *_urb = __get_completed(husb, skb->pkt_type);
 	struct urb *urb;
 
 	if (!_urb) {
 		_urb = _urb_alloc(HCI_MAX_ISOC_FRAMES, GFP_ATOMIC);
 		if (!_urb)
 			return -ENOMEM;
-		_urb->type = bt_cb(skb)->pkt_type;
+		_urb->type = skb->pkt_type;
 	}
 
 	BT_DBG("%s skb %p len %d", husb->hdev->name, skb, skb->len);
@@ -601,11 +601,11 @@ static int hci_usb_send_frame(struct sk_buff *skb)
 	if (!test_bit(HCI_RUNNING, &hdev->flags))
 		return -EBUSY;
 
-	BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
+	BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
 
 	husb = (struct hci_usb *) hdev->driver_data;
 
-	switch (bt_cb(skb)->pkt_type) {
+	switch (skb->pkt_type) {
 	case HCI_COMMAND_PKT:
 		hdev->stat.cmd_tx++;
 		break;
@@ -627,7 +627,7 @@ static int hci_usb_send_frame(struct sk_buff *skb)
 
 	read_lock(&husb->completion_lock);
 
-	skb_queue_tail(__transmit_q(husb, bt_cb(skb)->pkt_type), skb);
+	skb_queue_tail(__transmit_q(husb, skb->pkt_type), skb);
 	hci_usb_tx_wakeup(husb);
 
 	read_unlock(&husb->completion_lock);
@@ -682,7 +682,7 @@ static inline int __recv_frame(struct hci_usb *husb, int type, void *data, int c
 				return -ENOMEM;
 			}
 			skb->dev = (void *) husb->hdev;
-			bt_cb(skb)->pkt_type = type;
+			skb->pkt_type = type;
 	
 			__reassembly(husb, type) = skb;
 
@@ -702,7 +702,6 @@ static inline int __recv_frame(struct hci_usb *husb, int type, void *data, int c
 		if (!scb->expect) {
 			/* Complete frame */
 			__reassembly(husb, type) = NULL;
-			bt_cb(skb)->pkt_type = type;
 			hci_recv_frame(skb);
 		}
 
diff --git a/trunk/drivers/bluetooth/hci_vhci.c b/trunk/drivers/bluetooth/hci_vhci.c
index 52cbd45c308f..f9b956fb2b8b 100644
--- a/trunk/drivers/bluetooth/hci_vhci.c
+++ b/trunk/drivers/bluetooth/hci_vhci.c
@@ -1,220 +1,229 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
 /*
+ * Bluetooth HCI virtual device driver.
  *
- *  Bluetooth virtual HCI driver
- *
- *  Copyright (C) 2000-2001 Qualcomm Incorporated
- *  Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com>
- *  Copyright (C) 2004-2005 Marcel Holtmann <marcel@holtmann.org>
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
+ * $Id: hci_vhci.c,v 1.3 2002/04/17 17:37:20 maxk Exp $ 
  */
+#define VERSION "1.1"
 
 #include <linux/config.h>
 #include <linux/module.h>
 
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/types.h>
 #include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/init.h>
+#include <linux/random.h>
 
 #include <linux/skbuff.h>
 #include <linux/miscdevice.h>
 
+#include <asm/system.h>
+#include <asm/uaccess.h>
+
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
+#include "hci_vhci.h"
 
-#ifndef CONFIG_BT_HCIVHCI_DEBUG
-#undef  BT_DBG
-#define BT_DBG(D...)
-#endif
-
-#define VERSION "1.2"
-
-static int minor = MISC_DYNAMIC_MINOR;
-
-struct vhci_data {
-	struct hci_dev *hdev;
-
-	unsigned long flags;
-
-	wait_queue_head_t read_wait;
-	struct sk_buff_head readq;
-
-	struct fasync_struct *fasync;
-};
+/* HCI device part */
 
-#define VHCI_FASYNC	0x0010
-
-static struct miscdevice vhci_miscdev;
-
-static int vhci_open_dev(struct hci_dev *hdev)
+static int hci_vhci_open(struct hci_dev *hdev)
 {
 	set_bit(HCI_RUNNING, &hdev->flags);
-
 	return 0;
 }
 
-static int vhci_close_dev(struct hci_dev *hdev)
+static int hci_vhci_flush(struct hci_dev *hdev)
 {
-	struct vhci_data *vhci = hdev->driver_data;
+	struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) hdev->driver_data;
+	skb_queue_purge(&hci_vhci->readq);
+	return 0;
+}
 
+static int hci_vhci_close(struct hci_dev *hdev)
+{
 	if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
 		return 0;
 
-	skb_queue_purge(&vhci->readq);
-
+	hci_vhci_flush(hdev);
 	return 0;
 }
 
-static int vhci_flush(struct hci_dev *hdev)
+static void hci_vhci_destruct(struct hci_dev *hdev)
 {
-	struct vhci_data *vhci = hdev->driver_data;
+	struct hci_vhci_struct *vhci;
 
-	skb_queue_purge(&vhci->readq);
+	if (!hdev) return;
 
-	return 0;
+	vhci = (struct hci_vhci_struct *) hdev->driver_data;
+	kfree(vhci);
 }
 
-static int vhci_send_frame(struct sk_buff *skb)
+static int hci_vhci_send_frame(struct sk_buff *skb)
 {
 	struct hci_dev* hdev = (struct hci_dev *) skb->dev;
-	struct vhci_data *vhci;
+	struct hci_vhci_struct *hci_vhci;
 
 	if (!hdev) {
-		BT_ERR("Frame for unknown HCI device (hdev=NULL)");
+		BT_ERR("Frame for uknown device (hdev=NULL)");
 		return -ENODEV;
 	}
 
 	if (!test_bit(HCI_RUNNING, &hdev->flags))
 		return -EBUSY;
 
-	vhci = hdev->driver_data;
-
-	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
-	skb_queue_tail(&vhci->readq, skb);
+	hci_vhci = (struct hci_vhci_struct *) hdev->driver_data;
 
-	if (vhci->flags & VHCI_FASYNC)
-		kill_fasync(&vhci->fasync, SIGIO, POLL_IN);
+	memcpy(skb_push(skb, 1), &skb->pkt_type, 1);
+	skb_queue_tail(&hci_vhci->readq, skb);
 
-	wake_up_interruptible(&vhci->read_wait);
+	if (hci_vhci->flags & VHCI_FASYNC)
+		kill_fasync(&hci_vhci->fasync, SIGIO, POLL_IN);
+	wake_up_interruptible(&hci_vhci->read_wait);
 
 	return 0;
 }
 
-static void vhci_destruct(struct hci_dev *hdev)
-{
-	kfree(hdev->driver_data);
+/* Character device part */
+
+/* Poll */
+static unsigned int hci_vhci_chr_poll(struct file *file, poll_table * wait)
+{  
+	struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
+
+	poll_wait(file, &hci_vhci->read_wait, wait);
+ 
+	if (!skb_queue_empty(&hci_vhci->readq))
+		return POLLIN | POLLRDNORM;
+
+	return POLLOUT | POLLWRNORM;
 }
 
-static inline ssize_t vhci_get_user(struct vhci_data *vhci,
-					const char __user *buf, size_t count)
+/* Get packet from user space buffer(already verified) */
+static inline ssize_t hci_vhci_get_user(struct hci_vhci_struct *hci_vhci, const char __user *buf, size_t count)
 {
 	struct sk_buff *skb;
 
 	if (count > HCI_MAX_FRAME_SIZE)
 		return -EINVAL;
 
-	skb = bt_skb_alloc(count, GFP_KERNEL);
-	if (!skb)
+	if (!(skb = bt_skb_alloc(count, GFP_KERNEL)))
 		return -ENOMEM;
-
+	
 	if (copy_from_user(skb_put(skb, count), buf, count)) {
 		kfree_skb(skb);
 		return -EFAULT;
 	}
 
-	skb->dev = (void *) vhci->hdev;
-	bt_cb(skb)->pkt_type = *((__u8 *) skb->data);
+	skb->dev = (void *) hci_vhci->hdev;
+	skb->pkt_type = *((__u8 *) skb->data);
 	skb_pull(skb, 1);
 
 	hci_recv_frame(skb);
 
 	return count;
+} 
+
+/* Write */
+static ssize_t hci_vhci_chr_write(struct file * file, const char __user * buf, 
+			     size_t count, loff_t *pos)
+{
+	struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
+
+	if (!access_ok(VERIFY_READ, buf, count))
+		return -EFAULT;
+
+	return hci_vhci_get_user(hci_vhci, buf, count);
 }
 
-static inline ssize_t vhci_put_user(struct vhci_data *vhci,
-			struct sk_buff *skb, char __user *buf, int count)
+/* Put packet to user space buffer(already verified) */
+static inline ssize_t hci_vhci_put_user(struct hci_vhci_struct *hci_vhci,
+				       struct sk_buff *skb, char __user *buf,
+				       int count)
 {
+	int len = count, total = 0;
 	char __user *ptr = buf;
-	int len, total = 0;
-
-	len = min_t(unsigned int, skb->len, count);
 
+	len = min_t(unsigned int, skb->len, len);
 	if (copy_to_user(ptr, skb->data, len))
 		return -EFAULT;
-
 	total += len;
 
-	vhci->hdev->stat.byte_tx += len;
+	hci_vhci->hdev->stat.byte_tx += len;
+	switch (skb->pkt_type) {
+		case HCI_COMMAND_PKT:
+			hci_vhci->hdev->stat.cmd_tx++;
+			break;
 
-	switch (bt_cb(skb)->pkt_type) {
-	case HCI_COMMAND_PKT:
-		vhci->hdev->stat.cmd_tx++;
-		break;
-
-	case HCI_ACLDATA_PKT:
-		vhci->hdev->stat.acl_tx++;
-		break;
+		case HCI_ACLDATA_PKT:
+			hci_vhci->hdev->stat.acl_tx++;
+			break;
 
-	case HCI_SCODATA_PKT:
-		vhci->hdev->stat.cmd_tx++;
-		break;
+		case HCI_SCODATA_PKT:
+			hci_vhci->hdev->stat.cmd_tx++;
+			break;
 	};
 
 	return total;
 }
 
-static loff_t vhci_llseek(struct file * file, loff_t offset, int origin)
-{
-	return -ESPIPE;
-}
-
-static ssize_t vhci_read(struct file * file, char __user * buf, size_t count, loff_t *pos)
+/* Read */
+static ssize_t hci_vhci_chr_read(struct file * file, char __user * buf, size_t count, loff_t *pos)
 {
+	struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
 	DECLARE_WAITQUEUE(wait, current);
-	struct vhci_data *vhci = file->private_data;
 	struct sk_buff *skb;
 	ssize_t ret = 0;
 
-	add_wait_queue(&vhci->read_wait, &wait);
+	add_wait_queue(&hci_vhci->read_wait, &wait);
 	while (count) {
 		set_current_state(TASK_INTERRUPTIBLE);
 
-		skb = skb_dequeue(&vhci->readq);
-		if (!skb) {
+		/* Read frames from device queue */
+		if (!(skb = skb_dequeue(&hci_vhci->readq))) {
 			if (file->f_flags & O_NONBLOCK) {
 				ret = -EAGAIN;
 				break;
 			}
-
 			if (signal_pending(current)) {
 				ret = -ERESTARTSYS;
 				break;
 			}
 
+			/* Nothing to read, let's sleep */
 			schedule();
 			continue;
 		}
 
 		if (access_ok(VERIFY_WRITE, buf, count))
-			ret = vhci_put_user(vhci, skb, buf, count);
+			ret = hci_vhci_put_user(hci_vhci, skb, buf, count);
 		else
 			ret = -EFAULT;
 
@@ -222,90 +231,84 @@ static ssize_t vhci_read(struct file * file, char __user * buf, size_t count, lo
 		break;
 	}
 	set_current_state(TASK_RUNNING);
-	remove_wait_queue(&vhci->read_wait, &wait);
+	remove_wait_queue(&hci_vhci->read_wait, &wait);
 
 	return ret;
 }
 
-static ssize_t vhci_write(struct file *file,
-			const char __user *buf, size_t count, loff_t *pos)
+static loff_t hci_vhci_chr_lseek(struct file * file, loff_t offset, int origin)
 {
-	struct vhci_data *vhci = file->private_data;
-
-	if (!access_ok(VERIFY_READ, buf, count))
-		return -EFAULT;
-
-	return vhci_get_user(vhci, buf, count);
+	return -ESPIPE;
 }
 
-static unsigned int vhci_poll(struct file *file, poll_table *wait)
+static int hci_vhci_chr_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
 {
-	struct vhci_data *vhci = file->private_data;
-
-	poll_wait(file, &vhci->read_wait, wait);
-
-	if (!skb_queue_empty(&vhci->readq))
-		return POLLIN | POLLRDNORM;
-
-	return POLLOUT | POLLWRNORM;
+	return -EINVAL;
 }
 
-static int vhci_ioctl(struct inode *inode, struct file *file,
-					unsigned int cmd, unsigned long arg)
+static int hci_vhci_chr_fasync(int fd, struct file *file, int on)
 {
-	return -EINVAL;
+	struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
+	int ret;
+
+	if ((ret = fasync_helper(fd, file, on, &hci_vhci->fasync)) < 0)
+		return ret; 
+ 
+	if (on)
+		hci_vhci->flags |= VHCI_FASYNC;
+	else 
+		hci_vhci->flags &= ~VHCI_FASYNC;
+
+	return 0;
 }
 
-static int vhci_open(struct inode *inode, struct file *file)
+static int hci_vhci_chr_open(struct inode *inode, struct file * file)
 {
-	struct vhci_data *vhci;
+	struct hci_vhci_struct *hci_vhci = NULL; 
 	struct hci_dev *hdev;
 
-	vhci = kmalloc(sizeof(struct vhci_data), GFP_KERNEL);
-	if (!vhci)
+	if (!(hci_vhci = kmalloc(sizeof(struct hci_vhci_struct), GFP_KERNEL)))
 		return -ENOMEM;
 
-	memset(vhci, 0, sizeof(struct vhci_data));
+	memset(hci_vhci, 0, sizeof(struct hci_vhci_struct));
 
-	skb_queue_head_init(&vhci->readq);
-	init_waitqueue_head(&vhci->read_wait);
+	skb_queue_head_init(&hci_vhci->readq);
+	init_waitqueue_head(&hci_vhci->read_wait);
 
+	/* Initialize and register HCI device */
 	hdev = hci_alloc_dev();
 	if (!hdev) {
-		kfree(vhci);
+		kfree(hci_vhci);
 		return -ENOMEM;
 	}
 
-	vhci->hdev = hdev;
+	hci_vhci->hdev = hdev;
 
 	hdev->type = HCI_VHCI;
-	hdev->driver_data = vhci;
-	SET_HCIDEV_DEV(hdev, vhci_miscdev.dev);
+	hdev->driver_data = hci_vhci;
 
-	hdev->open     = vhci_open_dev;
-	hdev->close    = vhci_close_dev;
-	hdev->flush    = vhci_flush;
-	hdev->send     = vhci_send_frame;
-	hdev->destruct = vhci_destruct;
+	hdev->open  = hci_vhci_open;
+	hdev->close = hci_vhci_close;
+	hdev->flush = hci_vhci_flush;
+	hdev->send  = hci_vhci_send_frame;
+	hdev->destruct = hci_vhci_destruct;
 
 	hdev->owner = THIS_MODULE;
-
+	
 	if (hci_register_dev(hdev) < 0) {
-		BT_ERR("Can't register HCI device");
-		kfree(vhci);
+		kfree(hci_vhci);
 		hci_free_dev(hdev);
 		return -EBUSY;
 	}
 
-	file->private_data = vhci;
-
-	return nonseekable_open(inode, file);
+	file->private_data = hci_vhci;
+	return nonseekable_open(inode, file);   
 }
 
-static int vhci_release(struct inode *inode, struct file *file)
+static int hci_vhci_chr_close(struct inode *inode, struct file *file)
 {
-	struct vhci_data *vhci = file->private_data;
-	struct hci_dev *hdev = vhci->hdev;
+	struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
+	struct hci_dev *hdev = hci_vhci->hdev;
 
 	if (hci_unregister_dev(hdev) < 0) {
 		BT_ERR("Can't unregister HCI device %s", hdev->name);
@@ -314,71 +317,48 @@ static int vhci_release(struct inode *inode, struct file *file)
 	hci_free_dev(hdev);
 
 	file->private_data = NULL;
-
 	return 0;
 }
 
-static int vhci_fasync(int fd, struct file *file, int on)
-{
-	struct vhci_data *vhci = file->private_data;
-	int err;
-
-	err = fasync_helper(fd, file, on, &vhci->fasync);
-	if (err < 0)
-		return err;
-
-	if (on)
-		vhci->flags |= VHCI_FASYNC;
-	else
-		vhci->flags &= ~VHCI_FASYNC;
-
-	return 0;
-}
-
-static struct file_operations vhci_fops = {
-	.owner		= THIS_MODULE,
-	.llseek		= vhci_llseek,
-	.read		= vhci_read,
-	.write		= vhci_write,
-	.poll		= vhci_poll,
-	.ioctl		= vhci_ioctl,
-	.open		= vhci_open,
-	.release	= vhci_release,
-	.fasync		= vhci_fasync,
+static struct file_operations hci_vhci_fops = {
+	.owner	= THIS_MODULE,	
+	.llseek	= hci_vhci_chr_lseek,
+	.read	= hci_vhci_chr_read,
+	.write	= hci_vhci_chr_write,
+	.poll	= hci_vhci_chr_poll,
+	.ioctl	= hci_vhci_chr_ioctl,
+	.open	= hci_vhci_chr_open,
+	.release	= hci_vhci_chr_close,
+	.fasync	= hci_vhci_chr_fasync		
 };
 
-static struct miscdevice vhci_miscdev= {
-	.name		= "vhci",
-	.fops		= &vhci_fops,
+static struct miscdevice hci_vhci_miscdev=
+{
+        VHCI_MINOR,
+        "hci_vhci",
+        &hci_vhci_fops
 };
 
-static int __init vhci_init(void)
+static int __init hci_vhci_init(void)
 {
-	BT_INFO("Virtual HCI driver ver %s", VERSION);
+	BT_INFO("VHCI driver ver %s", VERSION);
 
-	vhci_miscdev.minor = minor;
-
-	if (misc_register(&vhci_miscdev) < 0) {
-		BT_ERR("Can't register misc device with minor %d", minor);
+	if (misc_register(&hci_vhci_miscdev)) {
+		BT_ERR("Can't register misc device %d\n", VHCI_MINOR);
 		return -EIO;
 	}
 
 	return 0;
 }
 
-static void __exit vhci_exit(void)
+static void hci_vhci_cleanup(void)
 {
-	if (misc_deregister(&vhci_miscdev) < 0)
-		BT_ERR("Can't unregister misc device with minor %d", minor);
+	misc_deregister(&hci_vhci_miscdev);
 }
 
-module_init(vhci_init);
-module_exit(vhci_exit);
-
-module_param(minor, int, 0444);
-MODULE_PARM_DESC(minor, "Miscellaneous minor device number");
+module_init(hci_vhci_init);
+module_exit(hci_vhci_cleanup);
 
-MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
-MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
-MODULE_VERSION(VERSION);
-MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>");
+MODULE_DESCRIPTION("Bluetooth VHCI driver ver " VERSION);
+MODULE_LICENSE("GPL"); 
diff --git a/trunk/drivers/bluetooth/hci_vhci.h b/trunk/drivers/bluetooth/hci_vhci.h
new file mode 100644
index 000000000000..53b11f9ef76d
--- /dev/null
+++ b/trunk/drivers/bluetooth/hci_vhci.h
@@ -0,0 +1,50 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/*
+ * $Id: hci_vhci.h,v 1.1.1.1 2002/03/08 21:03:15 maxk Exp $
+ */
+
+#ifndef __HCI_VHCI_H
+#define __HCI_VHCI_H
+
+#ifdef __KERNEL__
+
+struct hci_vhci_struct {
+	struct hci_dev       *hdev;
+	__u32                flags;
+	wait_queue_head_t    read_wait;
+	struct sk_buff_head  readq;
+	struct fasync_struct *fasync;
+};
+
+/* VHCI device flags */
+#define VHCI_FASYNC		0x0010
+
+#endif /* __KERNEL__ */
+
+#define VHCI_DEV	"/dev/vhci"
+#define VHCI_MINOR	250
+
+#endif /* __HCI_VHCI_H */
diff --git a/trunk/drivers/cdrom/viocd.c b/trunk/drivers/cdrom/viocd.c
index 0829db58462f..38dd9ffbe8bc 100644
--- a/trunk/drivers/cdrom/viocd.c
+++ b/trunk/drivers/cdrom/viocd.c
@@ -734,7 +734,7 @@ static int viocd_remove(struct vio_dev *vdev)
  */
 static struct vio_device_id viocd_device_table[] __devinitdata = {
 	{ "viocd", "" },
-	{ "", "" }
+	{ 0, }
 };
 
 MODULE_DEVICE_TABLE(vio, viocd_device_table);
diff --git a/trunk/drivers/char/drm/Kconfig b/trunk/drivers/char/drm/Kconfig
index 56ace9d5e2ae..123417e43040 100644
--- a/trunk/drivers/char/drm/Kconfig
+++ b/trunk/drivers/char/drm/Kconfig
@@ -23,6 +23,13 @@ config DRM_TDFX
 	  Choose this option if you have a 3dfx Banshee or Voodoo3 (or later),
 	  graphics card.  If M is selected, the module will be called tdfx.
 
+config DRM_GAMMA
+	tristate "3dlabs GMX 2000"
+	depends on DRM && BROKEN
+	help
+	  This is the old gamma driver, please tell me if it might actually
+	  work.
+
 config DRM_R128
 	tristate "ATI Rage 128"
 	depends on DRM && PCI
@@ -75,7 +82,7 @@ endchoice
 
 config DRM_MGA
 	tristate "Matrox g200/g400"
-	depends on DRM
+	depends on DRM && AGP
 	help
 	  Choose this option if you have a Matrox G200, G400 or G450 graphics
 	  card.  If M is selected, the module will be called mga.  AGP
@@ -96,10 +103,3 @@ config DRM_VIA
 	  Choose this option if you have a Via unichrome or compatible video
 	  chipset. If M is selected the module will be called via.
 
-config DRM_SAVAGE
-	tristate "Savage video cards"
-	depends on DRM
-	help
-	  Choose this option if you have a Savage3D/4/SuperSavage/Pro/Twister
-	  chipset. If M is selected the module will be called savage.
-
diff --git a/trunk/drivers/char/drm/Makefile b/trunk/drivers/char/drm/Makefile
index e41060c76226..ddd941045b1f 100644
--- a/trunk/drivers/char/drm/Makefile
+++ b/trunk/drivers/char/drm/Makefile
@@ -8,16 +8,16 @@ drm-objs    :=	drm_auth.o drm_bufs.o drm_context.o drm_dma.o drm_drawable.o \
 		drm_agpsupport.o drm_scatter.o ati_pcigart.o drm_pci.o \
 		drm_sysfs.o
 
+gamma-objs  := gamma_drv.o gamma_dma.o
 tdfx-objs   := tdfx_drv.o
 r128-objs   := r128_drv.o r128_cce.o r128_state.o r128_irq.o
 mga-objs    := mga_drv.o mga_dma.o mga_state.o mga_warp.o mga_irq.o
 i810-objs   := i810_drv.o i810_dma.o
 i830-objs   := i830_drv.o i830_dma.o i830_irq.o
 i915-objs   := i915_drv.o i915_dma.o i915_irq.o i915_mem.o
-radeon-objs := radeon_drv.o radeon_cp.o radeon_state.o radeon_mem.o radeon_irq.o r300_cmdbuf.o
+radeon-objs := radeon_drv.o radeon_cp.o radeon_state.o radeon_mem.o radeon_irq.o
 ffb-objs    := ffb_drv.o ffb_context.o
 sis-objs    := sis_drv.o sis_ds.o sis_mm.o
-savage-objs := savage_drv.o savage_bci.o savage_state.o
 via-objs    := via_irq.o via_drv.o via_ds.o via_map.o via_mm.o via_dma.o via_verifier.o via_video.o
 
 ifeq ($(CONFIG_COMPAT),y)
@@ -29,6 +29,7 @@ i915-objs   += i915_ioc32.o
 endif
 
 obj-$(CONFIG_DRM)	+= drm.o
+obj-$(CONFIG_DRM_GAMMA) += gamma.o
 obj-$(CONFIG_DRM_TDFX)	+= tdfx.o
 obj-$(CONFIG_DRM_R128)	+= r128.o
 obj-$(CONFIG_DRM_RADEON)+= radeon.o
@@ -38,7 +39,5 @@ obj-$(CONFIG_DRM_I830)	+= i830.o
 obj-$(CONFIG_DRM_I915)  += i915.o
 obj-$(CONFIG_DRM_FFB)   += ffb.o
 obj-$(CONFIG_DRM_SIS)   += sis.o
-obj-$(CONFIG_DRM_SAVAGE)+= savage.o
 obj-$(CONFIG_DRM_VIA)	+=via.o
 
-
diff --git a/trunk/drivers/char/drm/drm.h b/trunk/drivers/char/drm/drm.h
index fc6598a81acd..e8371dd87fbc 100644
--- a/trunk/drivers/char/drm/drm.h
+++ b/trunk/drivers/char/drm/drm.h
@@ -98,7 +98,7 @@
 #define _DRM_LOCKING_CONTEXT(lock) ((lock) & ~(_DRM_LOCK_HELD|_DRM_LOCK_CONT))
 
 
-typedef unsigned int  drm_handle_t;
+typedef unsigned long drm_handle_t;
 typedef unsigned int  drm_context_t;
 typedef unsigned int  drm_drawable_t;
 typedef unsigned int  drm_magic_t;
@@ -209,8 +209,7 @@ typedef enum drm_map_type {
 	_DRM_REGISTERS	    = 1,  /**< no caching, no core dump */
 	_DRM_SHM	    = 2,  /**< shared, cached */
 	_DRM_AGP            = 3,  /**< AGP/GART */
-	_DRM_SCATTER_GATHER = 4,  /**< Scatter/gather memory for PCI DMA */
-	_DRM_CONSISTENT     = 5,  /**< Consistent memory for PCI DMA */
+	_DRM_SCATTER_GATHER = 4	  /**< Scatter/gather memory for PCI DMA */
 } drm_map_type_t;
 
 
@@ -369,8 +368,7 @@ typedef struct drm_buf_desc {
 	enum {
 		_DRM_PAGE_ALIGN = 0x01, /**< Align on page boundaries for DMA */
 		_DRM_AGP_BUFFER = 0x02, /**< Buffer is in AGP space */
-		_DRM_SG_BUFFER  = 0x04, /**< Scatter/gather memory buffer */
-		_DRM_FB_BUFFER  = 0x08  /**< Buffer is in frame buffer */
+		_DRM_SG_BUFFER  = 0x04  /**< Scatter/gather memory buffer */
 	}	      flags;
 	unsigned long agp_start; /**< 
 				  * Start address of where the AGP buffers are
diff --git a/trunk/drivers/char/drm/drmP.h b/trunk/drivers/char/drm/drmP.h
index 6f98701dfe15..5df09cc8c6db 100644
--- a/trunk/drivers/char/drm/drmP.h
+++ b/trunk/drivers/char/drm/drmP.h
@@ -53,6 +53,7 @@
 #include <linux/init.h>
 #include <linux/file.h>
 #include <linux/pci.h>
+#include <linux/version.h>
 #include <linux/jiffies.h>
 #include <linux/smp_lock.h>	/* For (un)lock_kernel */
 #include <linux/mm.h>
@@ -95,7 +96,6 @@
 #define DRIVER_IRQ_SHARED  0x80
 #define DRIVER_IRQ_VBL     0x100
 #define DRIVER_DMA_QUEUE   0x200
-#define DRIVER_FB_DMA      0x400
 
 /***********************************************************************/
 /** \name Begin the DRM... */
@@ -160,7 +160,36 @@
 #define pte_unmap(pte)
 #endif
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,4,19)
+static inline struct page * vmalloc_to_page(void * vmalloc_addr)
+{
+	unsigned long addr = (unsigned long) vmalloc_addr;
+	struct page *page = NULL;
+	pgd_t *pgd = pgd_offset_k(addr);
+	pmd_t *pmd;
+	pte_t *ptep, pte;
+  
+	if (!pgd_none(*pgd)) {
+		pmd = pmd_offset(pgd, addr);
+		if (!pmd_none(*pmd)) {
+			preempt_disable();
+			ptep = pte_offset_map(pmd, addr);
+			pte = *ptep;
+			if (pte_present(pte))
+				page = pte_page(pte);
+			pte_unmap(ptep);
+			preempt_enable();
+		}
+	}
+	return page;
+}
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
+#define DRM_RPR_ARG(vma)
+#else
 #define DRM_RPR_ARG(vma) vma,
+#endif
 
 #define VM_OFFSET(vma) ((vma)->vm_pgoff << PAGE_SHIFT)
 
@@ -445,8 +474,7 @@ typedef struct drm_device_dma {
 	unsigned long	  byte_count;
 	enum {
 		_DRM_DMA_USE_AGP = 0x01,
-		_DRM_DMA_USE_SG  = 0x02,
-		_DRM_DMA_USE_FB  = 0x04
+		_DRM_DMA_USE_SG  = 0x02
 	} flags;
 
 } drm_device_dma_t;
@@ -497,19 +525,12 @@ typedef struct drm_sigdata {
 	drm_hw_lock_t *lock;
 } drm_sigdata_t;
 
-typedef struct drm_dma_handle {
-	dma_addr_t busaddr;
-	void *vaddr;
-	size_t size;
-} drm_dma_handle_t;
-
 /**
  * Mappings list
  */
 typedef struct drm_map_list {
 	struct list_head	head;	/**< list head */
 	drm_map_t		*map;	/**< mapping */
-	unsigned int user_token;
 } drm_map_list_t;
 
 typedef drm_map_t drm_local_map_t;
@@ -557,22 +578,7 @@ struct drm_driver {
  	int (*kernel_context_switch)(struct drm_device *dev, int old, int new);
 	void (*kernel_context_switch_unlock)(struct drm_device *dev, drm_lock_t *lock);
 	int (*vblank_wait)(struct drm_device *dev, unsigned int *sequence);
-	
-	/**
-	 * Called by \c drm_device_is_agp.  Typically used to determine if a
-	 * card is really attached to AGP or not.
-	 *
-	 * \param dev  DRM device handle
-	 *
-	 * \returns
-	 * One of three values is returned depending on whether or not the
-	 * card is absolutely \b not AGP (return of 0), absolutely \b is AGP
-	 * (return of 1), or may or may not be AGP (return of 2).
-	 */
-	int (*device_is_agp) (struct drm_device * dev);
-
 	/* these have to be filled in */
-  
  	int (*postinit)(struct drm_device *, unsigned long flags);
 	irqreturn_t (*irq_handler)( DRM_IRQ_ARGS );
  	void (*irq_preinstall)(struct drm_device *dev);
@@ -716,7 +722,11 @@ typedef struct drm_device {
 	int               pci_slot;	/**< PCI slot number */
 	int               pci_func;	/**< PCI function number */
 #ifdef __alpha__
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,4,3)
+	struct pci_controler *hose;
+#else
 	struct pci_controller *hose;
+#endif
 #endif
 	drm_sg_mem_t      *sg;  /**< Scatter gather memory */
 	unsigned long     *ctx_bitmap;	/**< context bitmap */
@@ -726,7 +736,6 @@ typedef struct drm_device {
 
 	struct            drm_driver *driver;
 	drm_local_map_t   *agp_buffer_map;
-	unsigned int agp_buffer_token;
 	drm_head_t primary;		/**< primary screen head */
 } drm_device_t;
 
@@ -797,7 +806,7 @@ extern void	     *drm_ioremap_nocache(unsigned long offset, unsigned long size,
 					   drm_device_t *dev);
 extern void	     drm_ioremapfree(void *pt, unsigned long size, drm_device_t *dev);
 
-extern DRM_AGP_MEM   *drm_alloc_agp(drm_device_t *dev, int pages, u32 type);
+extern DRM_AGP_MEM   *drm_alloc_agp(struct agp_bridge_data *bridge, int pages, u32 type);
 extern int           drm_free_agp(DRM_AGP_MEM *handle, int pages);
 extern int           drm_bind_agp(DRM_AGP_MEM *handle, unsigned int start);
 extern int           drm_unbind_agp(DRM_AGP_MEM *handle);
@@ -872,19 +881,11 @@ extern int	     drm_lock_free(drm_device_t *dev,
 				    unsigned int context);
 
 				/* Buffer management support (drm_bufs.h) */
-extern int drm_addbufs_agp(drm_device_t *dev, drm_buf_desc_t *request);
-extern int drm_addbufs_pci(drm_device_t *dev, drm_buf_desc_t *request);
-extern int drm_addmap(drm_device_t *dev, unsigned int offset,
-		      unsigned int size, drm_map_type_t type,
-		      drm_map_flags_t flags, drm_local_map_t **map_ptr);
-extern int drm_addmap_ioctl(struct inode *inode, struct file *filp,
-			    unsigned int cmd, unsigned long arg);
-extern int drm_rmmap(drm_device_t *dev, drm_local_map_t *map);
-extern int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map);
-extern int drm_rmmap_ioctl(struct inode *inode, struct file *filp,
-			   unsigned int cmd, unsigned long arg);
-
 extern int	     drm_order( unsigned long size );
+extern int	     drm_addmap( struct inode *inode, struct file *filp,
+				  unsigned int cmd, unsigned long arg );
+extern int	     drm_rmmap( struct inode *inode, struct file *filp,
+				 unsigned int cmd, unsigned long arg );
 extern int	     drm_addbufs( struct inode *inode, struct file *filp,
 				   unsigned int cmd, unsigned long arg );
 extern int	     drm_infobufs( struct inode *inode, struct file *filp,
@@ -895,10 +896,6 @@ extern int	     drm_freebufs( struct inode *inode, struct file *filp,
 				    unsigned int cmd, unsigned long arg );
 extern int	     drm_mapbufs( struct inode *inode, struct file *filp,
 				   unsigned int cmd, unsigned long arg );
-extern unsigned long drm_get_resource_start(drm_device_t *dev,
-					    unsigned int resource);
-extern unsigned long drm_get_resource_len(drm_device_t *dev,
-					  unsigned int resource);
 
 				/* DMA support (drm_dma.h) */
 extern int	     drm_dma_setup(drm_device_t *dev);
@@ -922,18 +919,15 @@ extern void          drm_vbl_send_signals( drm_device_t *dev );
 
 				/* AGP/GART support (drm_agpsupport.h) */
 extern drm_agp_head_t *drm_agp_init(drm_device_t *dev);
-extern int drm_agp_acquire(drm_device_t * dev);
-extern int drm_agp_acquire_ioctl(struct inode *inode, struct file *filp,
-			   unsigned int cmd, unsigned long arg);
-extern int drm_agp_release(drm_device_t *dev);
-extern int drm_agp_release_ioctl(struct inode *inode, struct file *filp,
-			   unsigned int cmd, unsigned long arg);
-extern int drm_agp_enable(drm_device_t *dev, drm_agp_mode_t mode);
-extern int drm_agp_enable_ioctl(struct inode *inode, struct file *filp,
-			  unsigned int cmd, unsigned long arg);
-extern int drm_agp_info(drm_device_t * dev, drm_agp_info_t *info);
-extern int drm_agp_info_ioctl(struct inode *inode, struct file *filp,
-			unsigned int cmd, unsigned long arg);
+extern int            drm_agp_acquire(struct inode *inode, struct file *filp,
+				       unsigned int cmd, unsigned long arg);
+extern void           drm_agp_do_release(drm_device_t *dev);
+extern int            drm_agp_release(struct inode *inode, struct file *filp,
+				       unsigned int cmd, unsigned long arg);
+extern int            drm_agp_enable(struct inode *inode, struct file *filp,
+				      unsigned int cmd, unsigned long arg);
+extern int            drm_agp_info(struct inode *inode, struct file *filp,
+				    unsigned int cmd, unsigned long arg);
 extern int            drm_agp_alloc(struct inode *inode, struct file *filp,
 				     unsigned int cmd, unsigned long arg);
 extern int            drm_agp_free(struct inode *inode, struct file *filp,
@@ -982,10 +976,12 @@ extern int            drm_ati_pcigart_cleanup(drm_device_t *dev,
 					       unsigned long addr,
 					       dma_addr_t bus_addr);
 
-extern drm_dma_handle_t *drm_pci_alloc(drm_device_t *dev, size_t size,
-				       size_t align, dma_addr_t maxaddr);
-extern void __drm_pci_free(drm_device_t *dev, drm_dma_handle_t *dmah);
-extern void drm_pci_free(drm_device_t *dev, drm_dma_handle_t *dmah);
+extern void *drm_pci_alloc(drm_device_t * dev, size_t size,
+			   size_t align, dma_addr_t maxaddr,
+			   dma_addr_t * busaddr);
+
+extern void drm_pci_free(drm_device_t * dev, size_t size,
+			 void *vaddr, dma_addr_t busaddr);
 
 			       /* sysfs support (drm_sysfs.c) */
 struct drm_sysfs_class;
@@ -1016,26 +1012,17 @@ static __inline__ void drm_core_ioremapfree(struct drm_map *map, struct drm_devi
 		drm_ioremapfree( map->handle, map->size, dev );
 }
 
-static __inline__ struct drm_map *drm_core_findmap(struct drm_device *dev, unsigned int token)
+static __inline__ struct drm_map *drm_core_findmap(struct drm_device *dev, unsigned long offset)
 {
-	drm_map_list_t *_entry;
-	list_for_each_entry(_entry, &dev->maplist->head, head)
-		if (_entry->user_token == token)
+	struct list_head *_list;
+	list_for_each( _list, &dev->maplist->head ) {
+		drm_map_list_t *_entry = list_entry( _list, drm_map_list_t, head );
+		if ( _entry->map &&
+		     _entry->map->offset == offset ) {
 			return _entry->map;
-	return NULL;
-}
-
-static __inline__ int drm_device_is_agp(drm_device_t *dev)
-{
-	if ( dev->driver->device_is_agp != NULL ) {
-		int err = (*dev->driver->device_is_agp)( dev );
-	
-		if (err != 2) {
-			return err;
 		}
 	}
-
-	return pci_find_capability(dev->pdev, PCI_CAP_ID_AGP);
+	return NULL;
 }
 
 static __inline__ void drm_core_dropmap(struct drm_map *map)
diff --git a/trunk/drivers/char/drm/drm_agpsupport.c b/trunk/drivers/char/drm/drm_agpsupport.c
index 8c215adcb4b2..8d94c0b5fa44 100644
--- a/trunk/drivers/char/drm/drm_agpsupport.c
+++ b/trunk/drivers/char/drm/drm_agpsupport.c
@@ -37,7 +37,7 @@
 #if __OS_HAS_AGP
 
 /**
- * Get AGP information.
+ * AGP information ioctl.
  *
  * \param inode device inode.
  * \param filp file pointer.
@@ -48,56 +48,51 @@
  * Verifies the AGP device has been initialized and acquired and fills in the
  * drm_agp_info structure with the information in drm_agp_head::agp_info.
  */
-int drm_agp_info(drm_device_t *dev, drm_agp_info_t *info)
+int drm_agp_info(struct inode *inode, struct file *filp,
+		  unsigned int cmd, unsigned long arg)
 {
+	drm_file_t	 *priv	 = filp->private_data;
+	drm_device_t	 *dev	 = priv->head->dev;
 	DRM_AGP_KERN     *kern;
+	drm_agp_info_t   info;
 
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
 
 	kern                   = &dev->agp->agp_info;
-	info->agp_version_major = kern->version.major;
-	info->agp_version_minor = kern->version.minor;
-	info->mode              = kern->mode;
-	info->aperture_base     = kern->aper_base;
-	info->aperture_size     = kern->aper_size * 1024 * 1024;
-	info->memory_allowed    = kern->max_memory << PAGE_SHIFT;
-	info->memory_used       = kern->current_memory << PAGE_SHIFT;
-	info->id_vendor         = kern->device->vendor;
-	info->id_device         = kern->device->device;
-
-	return 0;
-}
-EXPORT_SYMBOL(drm_agp_info);
-
-int drm_agp_info_ioctl(struct inode *inode, struct file *filp,
-		 unsigned int cmd, unsigned long arg)
-{
-	drm_file_t *priv = filp->private_data;
-	drm_device_t *dev = priv->head->dev;
-	drm_agp_info_t info;
-	int err;
-
-	err = drm_agp_info(dev, &info);
-	if (err)
-		return err;
-	
-	if (copy_to_user((drm_agp_info_t __user *) arg, &info, sizeof(info)))
+	info.agp_version_major = kern->version.major;
+	info.agp_version_minor = kern->version.minor;
+	info.mode              = kern->mode;
+	info.aperture_base     = kern->aper_base;
+	info.aperture_size     = kern->aper_size * 1024 * 1024;
+	info.memory_allowed    = kern->max_memory << PAGE_SHIFT;
+	info.memory_used       = kern->current_memory << PAGE_SHIFT;
+	info.id_vendor         = kern->device->vendor;
+	info.id_device         = kern->device->device;
+
+	if (copy_to_user((drm_agp_info_t __user *)arg, &info, sizeof(info)))
 		return -EFAULT;
 	return 0;
 }
 
 /**
- * Acquire the AGP device.
+ * Acquire the AGP device (ioctl).
  *
- * \param dev DRM device that is to acquire AGP
+ * \param inode device inode.
+ * \param filp file pointer.
+ * \param cmd command.
+ * \param arg user argument.
  * \return zero on success or a negative number on failure. 
  *
  * Verifies the AGP device hasn't been acquired before and calls
- * \c agp_backend_acquire.
+ * agp_acquire().
  */
-int drm_agp_acquire(drm_device_t *dev)
+int drm_agp_acquire(struct inode *inode, struct file *filp,
+		     unsigned int cmd, unsigned long arg)
 {
+	drm_file_t	 *priv	 = filp->private_data;
+	drm_device_t	 *dev	 = priv->head->dev;
+
 	if (!dev->agp)
 		return -ENODEV;
 	if (dev->agp->acquired)
@@ -107,10 +102,9 @@ int drm_agp_acquire(drm_device_t *dev)
 	dev->agp->acquired = 1;
 	return 0;
 }
-EXPORT_SYMBOL(drm_agp_acquire);
 
 /**
- * Acquire the AGP device (ioctl).
+ * Release the AGP device (ioctl).
  *
  * \param inode device inode.
  * \param filp file pointer.
@@ -118,80 +112,63 @@ EXPORT_SYMBOL(drm_agp_acquire);
  * \param arg user argument.
  * \return zero on success or a negative number on failure.
  *
- * Verifies the AGP device hasn't been acquired before and calls
- * \c agp_backend_acquire.
+ * Verifies the AGP device has been acquired and calls agp_backend_release().
  */
-int drm_agp_acquire_ioctl(struct inode *inode, struct file *filp,
-			  unsigned int cmd, unsigned long arg)
+int drm_agp_release(struct inode *inode, struct file *filp,
+		     unsigned int cmd, unsigned long arg)
 {
-	drm_file_t *priv = filp->private_data;
-	
-	return drm_agp_acquire( (drm_device_t *) priv->head->dev );
-}
+	drm_file_t	 *priv	 = filp->private_data;
+	drm_device_t	 *dev	 = priv->head->dev;
 
-/**
- * Release the AGP device.
- *
- * \param dev DRM device that is to release AGP
- * \return zero on success or a negative number on failure.
- *
- * Verifies the AGP device has been acquired and calls \c agp_backend_release.
- */
-int drm_agp_release(drm_device_t *dev)
-{
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
 	agp_backend_release(dev->agp->bridge);
 	dev->agp->acquired = 0;
 	return 0;
+
 }
-EXPORT_SYMBOL(drm_agp_release);
 
-int drm_agp_release_ioctl(struct inode *inode, struct file *filp,
-			  unsigned int cmd, unsigned long arg)
+/**
+ * Release the AGP device.
+ *
+ * Calls agp_backend_release().
+ */
+void drm_agp_do_release(drm_device_t *dev)
 {
-	drm_file_t *priv = filp->private_data;
-	drm_device_t *dev = priv->head->dev;
-	
-	return drm_agp_release(dev);
+  agp_backend_release(dev->agp->bridge);
 }
 
 /**
  * Enable the AGP bus.
  * 
- * \param dev DRM device that has previously acquired AGP.
- * \param mode Requested AGP mode.
+ * \param inode device inode.
+ * \param filp file pointer.
+ * \param cmd command.
+ * \param arg pointer to a drm_agp_mode structure.
  * \return zero on success or a negative number on failure.
  *
  * Verifies the AGP device has been acquired but not enabled, and calls
- * \c agp_enable.
+ * agp_enable().
  */
-int drm_agp_enable(drm_device_t *dev, drm_agp_mode_t mode)
+int drm_agp_enable(struct inode *inode, struct file *filp,
+		    unsigned int cmd, unsigned long arg)
 {
+	drm_file_t	 *priv	 = filp->private_data;
+	drm_device_t	 *dev	 = priv->head->dev;
+	drm_agp_mode_t   mode;
+
 	if (!dev->agp || !dev->agp->acquired)
 		return -EINVAL;
 
+	if (copy_from_user(&mode, (drm_agp_mode_t __user *)arg, sizeof(mode)))
+		return -EFAULT;
+
 	dev->agp->mode    = mode.mode;
 	agp_enable(dev->agp->bridge, mode.mode);
 	dev->agp->base    = dev->agp->agp_info.aper_base;
 	dev->agp->enabled = 1;
 	return 0;
 }
-EXPORT_SYMBOL(drm_agp_enable);
-
-int drm_agp_enable_ioctl(struct inode *inode, struct file *filp,
-		   unsigned int cmd, unsigned long arg)
-{
-	drm_file_t *priv = filp->private_data;
-	drm_device_t *dev = priv->head->dev;
-	drm_agp_mode_t mode;
-
-
-	if (copy_from_user(&mode, (drm_agp_mode_t __user *) arg, sizeof(mode)))
-		return -EFAULT;
-
-	return drm_agp_enable(dev, mode);
-}
 
 /**
  * Allocate AGP memory.
@@ -229,7 +206,7 @@ int drm_agp_alloc(struct inode *inode, struct file *filp,
 	pages = (request.size + PAGE_SIZE - 1) / PAGE_SIZE;
 	type = (u32) request.type;
 
-	if (!(memory = drm_alloc_agp(dev, pages, type))) {
+	if (!(memory = drm_alloc_agp(dev->agp->bridge, pages, type))) {
 		drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
 		return -ENOMEM;
 	}
@@ -426,8 +403,13 @@ drm_agp_head_t *drm_agp_init(drm_device_t *dev)
 		return NULL;
 	}
 	head->memory = NULL;
+#if LINUX_VERSION_CODE <= 0x020408
+	head->cant_use_aperture = 0;
+	head->page_mask = ~(0xfff);
+#else
 	head->cant_use_aperture = head->agp_info.cant_use_aperture;
 	head->page_mask = head->agp_info.page_mask;
+#endif
 
 	return head;
 }
@@ -454,7 +436,6 @@ int drm_agp_bind_memory(DRM_AGP_MEM *handle, off_t start)
 		return -EINVAL;
 	return agp_bind_memory(handle, start);
 }
-EXPORT_SYMBOL(drm_agp_bind_memory);
 
 /** Calls agp_unbind_memory() */
 int drm_agp_unbind_memory(DRM_AGP_MEM *handle)
diff --git a/trunk/drivers/char/drm/drm_bufs.c b/trunk/drivers/char/drm/drm_bufs.c
index e0743ebbe4bd..4c6191d231b8 100644
--- a/trunk/drivers/char/drm/drm_bufs.c
+++ b/trunk/drivers/char/drm/drm_bufs.c
@@ -36,69 +36,37 @@
 #include <linux/vmalloc.h>
 #include "drmP.h"
 
-unsigned long drm_get_resource_start(drm_device_t *dev, unsigned int resource)
-{
-	return pci_resource_start(dev->pdev, resource);
-}
-EXPORT_SYMBOL(drm_get_resource_start);
-
-unsigned long drm_get_resource_len(drm_device_t *dev, unsigned int resource)
+/**
+ * Compute size order.  Returns the exponent of the smaller power of two which
+ * is greater or equal to given number.
+ * 
+ * \param size size.
+ * \return order.
+ *
+ * \todo Can be made faster.
+ */
+int drm_order( unsigned long size )
 {
-	return pci_resource_len(dev->pdev, resource);
-}
-EXPORT_SYMBOL(drm_get_resource_len);
+	int order;
+	unsigned long tmp;
 
-static drm_local_map_t *drm_find_matching_map(drm_device_t *dev,
-					      drm_local_map_t *map)
-{
-	struct list_head *list;
+	for (order = 0, tmp = size >> 1; tmp; tmp >>= 1, order++)
+		;
 
-	list_for_each(list, &dev->maplist->head) {
-		drm_map_list_t *entry = list_entry(list, drm_map_list_t, head);
-		if (entry->map && map->type == entry->map->type &&
-		    entry->map->offset == map->offset) {
-			return entry->map;
-		}
-	}
+	if (size & (size - 1))
+		++order;
 
-	return NULL;
+	return order;
 }
+EXPORT_SYMBOL(drm_order);
 
+#ifdef CONFIG_COMPAT
 /*
- * Used to allocate 32-bit handles for mappings.
+ * Used to allocate 32-bit handles for _DRM_SHM regions
+ * The 0x10000000 value is chosen to be out of the way of
+ * FB/register and GART physical addresses.
  */
-#define START_RANGE 0x10000000
-#define END_RANGE 0x40000000
-
-#ifdef _LP64
-static __inline__ unsigned int HandleID(unsigned long lhandle, drm_device_t *dev) 
-{
-	static unsigned int map32_handle = START_RANGE;
-	unsigned int hash;
-
-	if (lhandle & 0xffffffff00000000) {
-		hash = map32_handle;
-		map32_handle += PAGE_SIZE;
-		if (map32_handle > END_RANGE)
-			map32_handle = START_RANGE;
-	} else 
-		hash = lhandle;
-
-	while (1) {
-		drm_map_list_t *_entry;
-		list_for_each_entry(_entry, &dev->maplist->head,head) {
-			if (_entry->user_token == hash)
-				break;
-		}
-		if (&_entry->head == &dev->maplist->head)
-			return hash;
-
-		hash += PAGE_SIZE;
-		map32_handle += PAGE_SIZE;
-	}
-}
-#else
-# define HandleID(x,dev) (unsigned int)(x)
+static unsigned int map32_handle = 0x10000000;
 #endif
 
 /**
@@ -114,23 +82,25 @@ static __inline__ unsigned int HandleID(unsigned long lhandle, drm_device_t *dev
  * type.  Adds the map to the map list drm_device::maplist. Adds MTRR's where
  * applicable and if supported by the kernel.
  */
-int drm_addmap(drm_device_t * dev, unsigned int offset,
-	       unsigned int size, drm_map_type_t type,
-	       drm_map_flags_t flags, drm_local_map_t ** map_ptr)
+int drm_addmap( struct inode *inode, struct file *filp,
+		 unsigned int cmd, unsigned long arg )
 {
+	drm_file_t *priv = filp->private_data;
+	drm_device_t *dev = priv->head->dev;
 	drm_map_t *map;
+	drm_map_t __user *argp = (void __user *)arg;
 	drm_map_list_t *list;
-	drm_dma_handle_t *dmah;
-	drm_local_map_t *found_map;
+
+	if ( !(filp->f_mode & 3) ) return -EACCES; /* Require read/write */
 
 	map = drm_alloc( sizeof(*map), DRM_MEM_MAPS );
 	if ( !map )
 		return -ENOMEM;
 
-	map->offset = offset;
-	map->size = size;
-	map->flags = flags;
-	map->type = type;
+	if ( copy_from_user( map, argp, sizeof(*map) ) ) {
+		drm_free( map, sizeof(*map), DRM_MEM_MAPS );
+		return -EFAULT;
+	}
 
 	/* Only allow shared memory to be removable since we only keep enough
 	 * book keeping information about shared memory to allow for removal
@@ -152,7 +122,7 @@ int drm_addmap(drm_device_t * dev, unsigned int offset,
 	switch ( map->type ) {
 	case _DRM_REGISTERS:
 	case _DRM_FRAME_BUFFER:
-#if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__) && !defined(__powerpc64__) && !defined(__x86_64__)
+#if !defined(__sparc__) && !defined(__alpha__) && !defined(__ia64__)
 		if ( map->offset + map->size < map->offset ||
 		     map->offset < virt_to_phys(high_memory) ) {
 			drm_free( map, sizeof(*map), DRM_MEM_MAPS );
@@ -162,24 +132,6 @@ int drm_addmap(drm_device_t * dev, unsigned int offset,
 #ifdef __alpha__
 		map->offset += dev->hose->mem_space->start;
 #endif
-		/* Some drivers preinitialize some maps, without the X Server
-		 * needing to be aware of it.  Therefore, we just return success
-		 * when the server tries to create a duplicate map.
-		 */
-		found_map = drm_find_matching_map(dev, map);
-		if (found_map != NULL) {
-			if (found_map->size != map->size) {
-				DRM_DEBUG("Matching maps of type %d with "
-				   "mismatched sizes, (%ld vs %ld)\n",
-				    map->type, map->size, found_map->size);
-				found_map->size = map->size;
-			}
-
-			drm_free(map, sizeof(*map), DRM_MEM_MAPS);
-			*map_ptr = found_map;
-			return 0;
-		}
-
 		if (drm_core_has_MTRR(dev)) {
 			if ( map->type == _DRM_FRAME_BUFFER ||
 			     (map->flags & _DRM_WRITE_COMBINING) ) {
@@ -226,22 +178,9 @@ int drm_addmap(drm_device_t * dev, unsigned int offset,
 			drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 			return -EINVAL;
 		}
-		map->offset += (unsigned long)dev->sg->virtual;
-		break;
-	case _DRM_CONSISTENT: 
-		/* dma_addr_t is 64bit on i386 with CONFIG_HIGHMEM64G,
-		 * As we're limiting the address to 2^32-1 (or less),
-		 * casting it down to 32 bits is no problem, but we
-		 * need to point to a 64bit variable first. */
-		dmah = drm_pci_alloc(dev, map->size, map->size, 0xffffffffUL);
-		if (!dmah) {
-			drm_free(map, sizeof(*map), DRM_MEM_MAPS);
-			return -ENOMEM;
-		}
-		map->handle = dmah->vaddr;
-		map->offset = (unsigned long)dmah->busaddr;
-		kfree(dmah);
+		map->offset += dev->sg->handle;
 		break;
+
 	default:
 		drm_free( map, sizeof(*map), DRM_MEM_MAPS );
 		return -EINVAL;
@@ -257,56 +196,17 @@ int drm_addmap(drm_device_t * dev, unsigned int offset,
 
 	down(&dev->struct_sem);
 	list_add(&list->head, &dev->maplist->head);
-	/* Assign a 32-bit handle */
+#ifdef CONFIG_COMPAT
+	/* Assign a 32-bit handle for _DRM_SHM mappings */
 	/* We do it here so that dev->struct_sem protects the increment */
-	list->user_token = HandleID(map->type==_DRM_SHM
-				    ? (unsigned long)map->handle
-				    : map->offset, dev);
+	if (map->type == _DRM_SHM)
+		map->offset = map32_handle += PAGE_SIZE;
+#endif
  	up(&dev->struct_sem);
 
-	*map_ptr = map;
-	return 0;
-}
-EXPORT_SYMBOL(drm_addmap);
-
-int drm_addmap_ioctl(struct inode *inode, struct file *filp,
-		     unsigned int cmd, unsigned long arg)
-{
-	drm_file_t *priv = filp->private_data;
-	drm_device_t *dev = priv->head->dev;
-	drm_map_t map;
-	drm_map_t *map_ptr;
-	drm_map_t __user *argp = (void __user *)arg;
-	int err;
-	unsigned long handle = 0;
-
-	if (!(filp->f_mode & 3))
-		return -EACCES;	/* Require read/write */
-
-	if (copy_from_user(& map, argp, sizeof(map))) {
-		return -EFAULT;
-	}
-
-	err = drm_addmap(dev, map.offset, map.size, map.type, map.flags,
-			 &map_ptr);
-
-	if (err) {
-		return err;
-	}
-
-	{
-		drm_map_list_t *_entry;
-		list_for_each_entry(_entry, &dev->maplist->head, head) {
-			if (_entry->map == map_ptr)
-				handle = _entry->user_token;
-		}
-		if (!handle)
-			return -EFAULT;
-	}
-
-	if (copy_to_user(argp, map_ptr, sizeof(*map_ptr)))
+	if ( copy_to_user( argp, map, sizeof(*map) ) )
 		return -EFAULT;
-	if (put_user(handle, &argp->handle))
+	if (copy_to_user(&argp->handle, &map->offset, sizeof(map->offset)))
 		return -EFAULT;
 	return 0;
 }
@@ -326,138 +226,81 @@ int drm_addmap_ioctl(struct inode *inode, struct file *filp,
  * its being used, and free any associate resource (such as MTRR's) if it's not
  * being on use.
  *
- * \sa drm_addmap
+ * \sa addmap().
  */
-int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
+int drm_rmmap(struct inode *inode, struct file *filp,
+	       unsigned int cmd, unsigned long arg)
 {
+	drm_file_t	*priv	= filp->private_data;
+	drm_device_t	*dev	= priv->head->dev;
 	struct list_head *list;
 	drm_map_list_t *r_list = NULL;
-	drm_dma_handle_t dmah;
-
-	/* Find the list entry for the map and remove it */
-	list_for_each(list, &dev->maplist->head) {
-		r_list = list_entry(list, drm_map_list_t, head);
-
-		if (r_list->map == map) {
-			list_del(list);
-			drm_free(list, sizeof(*list), DRM_MEM_MAPS);
-			break;
-		}
-	}
-
-	/* List has wrapped around to the head pointer, or it's empty and we
-	 * didn't find anything.
-	 */
-	if (list == (&dev->maplist->head)) {
-		return -EINVAL;
-	}
-
-	switch (map->type) {
-	case _DRM_REGISTERS:
-		drm_ioremapfree(map->handle, map->size, dev);
-		/* FALLTHROUGH */
-	case _DRM_FRAME_BUFFER:
-		if (drm_core_has_MTRR(dev) && map->mtrr >= 0) {
-			int retcode;
-			retcode = mtrr_del(map->mtrr, map->offset,
-					   map->size);
-			DRM_DEBUG ("mtrr_del=%d\n", retcode);
-		}
-		break;
-	case _DRM_SHM:
-		vfree(map->handle);
-		break;
-	case _DRM_AGP:
-	case _DRM_SCATTER_GATHER:
-		break;
-	case _DRM_CONSISTENT:
-		dmah.vaddr = map->handle;
-		dmah.busaddr = map->offset;
-		dmah.size = map->size;
-		__drm_pci_free(dev, &dmah);
-		break;
-	}
-	drm_free(map, sizeof(*map), DRM_MEM_MAPS);
-
-	return 0;
-}
-EXPORT_SYMBOL(drm_rmmap_locked);
-
-int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
-{
-	int ret;
-
-	down(&dev->struct_sem);
-	ret = drm_rmmap_locked(dev, map);
-	up(&dev->struct_sem);
-
-	return ret;
-}
-EXPORT_SYMBOL(drm_rmmap);
-
-/* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
- * the last close of the device, and this is necessary for cleanup when things
- * exit uncleanly.  Therefore, having userland manually remove mappings seems
- * like a pointless exercise since they're going away anyway.
- *
- * One use case might be after addmap is allowed for normal users for SHM and
- * gets used by drivers that the server doesn't need to care about.  This seems
- * unlikely.
- */
-int drm_rmmap_ioctl(struct inode *inode, struct file *filp,
-		    unsigned int cmd, unsigned long arg)
-{
-	drm_file_t *priv = filp->private_data;
-	drm_device_t *dev = priv->head->dev;
+	drm_vma_entry_t *pt, *prev;
+	drm_map_t *map;
 	drm_map_t request;
-	drm_local_map_t *map = NULL;
-	struct list_head *list;
-	int ret;
+	int found_maps = 0;
 
-	if (copy_from_user(&request, (drm_map_t __user *)arg, sizeof(request))) {
+	if (copy_from_user(&request, (drm_map_t __user *)arg,
+			   sizeof(request))) {
 		return -EFAULT;
 	}
 
 	down(&dev->struct_sem);
+	list = &dev->maplist->head;
 	list_for_each(list, &dev->maplist->head) {
-		drm_map_list_t *r_list = list_entry(list, drm_map_list_t, head);
+		r_list = list_entry(list, drm_map_list_t, head);
 
-		if (r_list->map &&
-		    r_list->user_token == (unsigned long) request.handle &&
-		    r_list->map->flags & _DRM_REMOVABLE) {
-			map = r_list->map;
-			break;
-		}
+		if(r_list->map &&
+		   r_list->map->offset == (unsigned long) request.handle &&
+		   r_list->map->flags & _DRM_REMOVABLE) break;
 	}
 
 	/* List has wrapped around to the head pointer, or its empty we didn't
 	 * find anything.
 	 */
-	if (list == (&dev->maplist->head)) {
+	if(list == (&dev->maplist->head)) {
 		up(&dev->struct_sem);
 		return -EINVAL;
 	}
+	map = r_list->map;
+	list_del(list);
+	drm_free(list, sizeof(*list), DRM_MEM_MAPS);
 
-	if (!map)
-		return -EINVAL;
-
-	/* Register and framebuffer maps are permanent */
-	if ((map->type == _DRM_REGISTERS) || (map->type == _DRM_FRAME_BUFFER)) {
-		up(&dev->struct_sem);
-		return 0;
+	for (pt = dev->vmalist, prev = NULL; pt; prev = pt, pt = pt->next) {
+		if (pt->vma->vm_private_data == map) found_maps++;
 	}
 
-	ret = drm_rmmap_locked(dev, map);
-
+	if(!found_maps) {
+		switch (map->type) {
+		case _DRM_REGISTERS:
+		case _DRM_FRAME_BUFFER:
+		  if (drm_core_has_MTRR(dev)) {
+				if (map->mtrr >= 0) {
+					int retcode;
+					retcode = mtrr_del(map->mtrr,
+							   map->offset,
+							   map->size);
+					DRM_DEBUG("mtrr_del = %d\n", retcode);
+				}
+			}
+			drm_ioremapfree(map->handle, map->size, dev);
+			break;
+		case _DRM_SHM:
+			vfree(map->handle);
+			break;
+		case _DRM_AGP:
+		case _DRM_SCATTER_GATHER:
+			break;
+		}
+		drm_free(map, sizeof(*map), DRM_MEM_MAPS);
+	}
 	up(&dev->struct_sem);
-
-	return ret;
+	return 0;
 }
 
 /**
  * Cleanup after an error on one of the addbufs() functions.
  *
- * \param dev DRM device.
  * \param entry buffer entry where the error occurred.
  *
  * Frees any pages and buffers associated with the given entry.
@@ -501,19 +344,25 @@ static void drm_cleanup_buf_error(drm_device_t *dev, drm_buf_entry_t *entry)
 
 #if __OS_HAS_AGP
 /**
- * Add AGP buffers for DMA transfers.
+ * Add AGP buffers for DMA transfers (ioctl).
  *
- * \param dev drm_device_t to which the buffers are to be added.
- * \param request pointer to a drm_buf_desc_t describing the request.
+ * \param inode device inode.
+ * \param filp file pointer.
+ * \param cmd command.
+ * \param arg pointer to a drm_buf_desc_t request.
  * \return zero on success or a negative number on failure.
  * 
  * After some sanity checks creates a drm_buf structure for each buffer and
  * reallocates the buffer list of the same size order to accommodate the new
  * buffers.
  */
-int drm_addbufs_agp(drm_device_t *dev, drm_buf_desc_t *request)
+static int drm_addbufs_agp( struct inode *inode, struct file *filp,
+			    unsigned int cmd, unsigned long arg )
 {
+	drm_file_t *priv = filp->private_data;
+	drm_device_t *dev = priv->head->dev;
 	drm_device_dma_t *dma = dev->dma;
+	drm_buf_desc_t request;
 	drm_buf_entry_t *entry;
 	drm_buf_t *buf;
 	unsigned long offset;
@@ -527,20 +376,25 @@ int drm_addbufs_agp(drm_device_t *dev, drm_buf_desc_t *request)
 	int byte_count;
 	int i;
 	drm_buf_t **temp_buflist;
+	drm_buf_desc_t __user *argp = (void __user *)arg;
 
 	if ( !dma ) return -EINVAL;
 
-	count = request->count;
-	order = drm_order(request->size);
+	if ( copy_from_user( &request, argp,
+			     sizeof(request) ) )
+		return -EFAULT;
+
+	count = request.count;
+	order = drm_order( request.size );
 	size = 1 << order;
 
-	alignment  = (request->flags & _DRM_PAGE_ALIGN)
+	alignment  = (request.flags & _DRM_PAGE_ALIGN)
 		? PAGE_ALIGN(size) : size;
 	page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 	total = PAGE_SIZE << page_order;
 
 	byte_count = 0;
-	agp_offset = dev->agp->base + request->agp_start;
+	agp_offset = dev->agp->base + request.agp_start;
 
 	DRM_DEBUG( "count:      %d\n",  count );
 	DRM_DEBUG( "order:      %d\n",  order );
@@ -654,20 +508,26 @@ int drm_addbufs_agp(drm_device_t *dev, drm_buf_desc_t *request)
 
 	up( &dev->struct_sem );
 
-	request->count = entry->buf_count;
-	request->size = size;
+	request.count = entry->buf_count;
+	request.size = size;
+
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
+		return -EFAULT;
 
 	dma->flags = _DRM_DMA_USE_AGP;
 
 	atomic_dec( &dev->buf_alloc );
 	return 0;
 }
-EXPORT_SYMBOL(drm_addbufs_agp);
 #endif /* __OS_HAS_AGP */
 
-int drm_addbufs_pci(drm_device_t *dev, drm_buf_desc_t *request)
+static int drm_addbufs_pci( struct inode *inode, struct file *filp,
+			    unsigned int cmd, unsigned long arg )
 {
+   	drm_file_t *priv = filp->private_data;
+	drm_device_t *dev = priv->head->dev;
 	drm_device_dma_t *dma = dev->dma;
+	drm_buf_desc_t request;
 	int count;
 	int order;
 	int size;
@@ -683,22 +543,26 @@ int drm_addbufs_pci(drm_device_t *dev, drm_buf_desc_t *request)
 	int page_count;
 	unsigned long *temp_pagelist;
 	drm_buf_t **temp_buflist;
+	drm_buf_desc_t __user *argp = (void __user *)arg;
 
 	if (!drm_core_check_feature(dev, DRIVER_PCI_DMA)) return -EINVAL;
 	if ( !dma ) return -EINVAL;
 
-	count = request->count;
-	order = drm_order(request->size);
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
+		return -EFAULT;
+
+	count = request.count;
+	order = drm_order( request.size );
 	size = 1 << order;
 
 	DRM_DEBUG( "count=%d, size=%d (%d), order=%d, queue_count=%d\n",
-		   request->count, request->size, size,
+		   request.count, request.size, size,
 		   order, dev->queue_count );
 
 	if ( order < DRM_MIN_ORDER || order > DRM_MAX_ORDER ) return -EINVAL;
 	if ( dev->queue_count ) return -EBUSY; /* Not while in use */
 
-	alignment = (request->flags & _DRM_PAGE_ALIGN)
+	alignment = (request.flags & _DRM_PAGE_ALIGN)
 		? PAGE_ALIGN(size) : size;
 	page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 	total = PAGE_SIZE << page_order;
@@ -876,18 +740,25 @@ int drm_addbufs_pci(drm_device_t *dev, drm_buf_desc_t *request)
 
 	up( &dev->struct_sem );
 
-	request->count = entry->buf_count;
-	request->size = size;
+	request.count = entry->buf_count;
+	request.size = size;
+
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
+		return -EFAULT;
 
 	atomic_dec( &dev->buf_alloc );
 	return 0;
 
 }
-EXPORT_SYMBOL(drm_addbufs_pci);
 
-static int drm_addbufs_sg(drm_device_t *dev, drm_buf_desc_t *request)
+static int drm_addbufs_sg( struct inode *inode, struct file *filp,
+			   unsigned int cmd, unsigned long arg )
 {
+	drm_file_t *priv = filp->private_data;
+	drm_device_t *dev = priv->head->dev;
 	drm_device_dma_t *dma = dev->dma;
+	drm_buf_desc_t __user *argp = (void __user *)arg;
+	drm_buf_desc_t request;
 	drm_buf_entry_t *entry;
 	drm_buf_t *buf;
 	unsigned long offset;
@@ -906,17 +777,20 @@ static int drm_addbufs_sg(drm_device_t *dev, drm_buf_desc_t *request)
 	
 	if ( !dma ) return -EINVAL;
 
-	count = request->count;
-	order = drm_order(request->size);
+	if ( copy_from_user( &request, argp, sizeof(request) ) )
+		return -EFAULT;
+
+	count = request.count;
+	order = drm_order( request.size );
 	size = 1 << order;
 
-	alignment  = (request->flags & _DRM_PAGE_ALIGN)
+	alignment  = (request.flags & _DRM_PAGE_ALIGN)
 			? PAGE_ALIGN(size) : size;
 	page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
 	total = PAGE_SIZE << page_order;
 
 	byte_count = 0;
-	agp_offset = request->agp_start;
+	agp_offset = request.agp_start;
 
 	DRM_DEBUG( "count:      %d\n",  count );
 	DRM_DEBUG( "order:      %d\n",  order );
@@ -974,8 +848,7 @@ static int drm_addbufs_sg(drm_device_t *dev, drm_buf_desc_t *request)
 
 		buf->offset  = (dma->byte_count + offset);
 		buf->bus_address = agp_offset + offset;
-		buf->address = (void *)(agp_offset + offset 
-					+ (unsigned long)dev->sg->virtual);
+		buf->address = (void *)(agp_offset + offset + dev->sg->handle);
 		buf->next    = NULL;
 		buf->waiting = 0;
 		buf->pending = 0;
@@ -1032,8 +905,11 @@ static int drm_addbufs_sg(drm_device_t *dev, drm_buf_desc_t *request)
 
 	up( &dev->struct_sem );
 
-	request->count = entry->buf_count;
-	request->size = size;
+	request.count = entry->buf_count;
+	request.size = size;
+
+	if ( copy_to_user( argp, &request, sizeof(request) ) )
+		return -EFAULT;
 
 	dma->flags = _DRM_DMA_USE_SG;
 
@@ -1041,161 +917,6 @@ static int drm_addbufs_sg(drm_device_t *dev, drm_buf_desc_t *request)
 	return 0;
 }
 
-int drm_addbufs_fb(drm_device_t *dev, drm_buf_desc_t *request)
-{
-	drm_device_dma_t *dma = dev->dma;
-	drm_buf_entry_t *entry;
-	drm_buf_t *buf;
-	unsigned long offset;
-	unsigned long agp_offset;
-	int count;
-	int order;
-	int size;
-	int alignment;
-	int page_order;
-	int total;
-	int byte_count;
-	int i;
-	drm_buf_t **temp_buflist;
-
-	if (!drm_core_check_feature(dev, DRIVER_FB_DMA))
-		return -EINVAL;
-    
-	if (!dma)
-		return -EINVAL;
-
-	count = request->count;
-	order = drm_order(request->size);
-	size = 1 << order;
-
-	alignment = (request->flags & _DRM_PAGE_ALIGN)
-	    ? PAGE_ALIGN(size) : size;
-	page_order = order - PAGE_SHIFT > 0 ? order - PAGE_SHIFT : 0;
-	total = PAGE_SIZE << page_order;
-
-	byte_count = 0;
-	agp_offset = request->agp_start;
-
-	DRM_DEBUG("count:      %d\n", count);
-	DRM_DEBUG("order:      %d\n", order);
-	DRM_DEBUG("size:       %d\n", size);
-	DRM_DEBUG("agp_offset: %lu\n", agp_offset);
-	DRM_DEBUG("alignment:  %d\n", alignment);
-	DRM_DEBUG("page_order: %d\n", page_order);
-	DRM_DEBUG("total:      %d\n", total);
-
-	if (order < DRM_MIN_ORDER || order > DRM_MAX_ORDER)
-		return -EINVAL;
-	if (dev->queue_count)
-		return -EBUSY;	/* Not while in use */
-
-	spin_lock(&dev->count_lock);
-	if (dev->buf_use) {
-		spin_unlock(&dev->count_lock);
-		return -EBUSY;
-	}
-	atomic_inc(&dev->buf_alloc);
-	spin_unlock(&dev->count_lock);
-
-	down(&dev->struct_sem);
-	entry = &dma->bufs[order];
-	if (entry->buf_count) {
-		up(&dev->struct_sem);
-		atomic_dec(&dev->buf_alloc);
-		return -ENOMEM;	/* May only call once for each order */
-	}
-
-	if (count < 0 || count > 4096) {
-		up(&dev->struct_sem);
-		atomic_dec(&dev->buf_alloc);
-		return -EINVAL;
-	}
-
-	entry->buflist = drm_alloc(count * sizeof(*entry->buflist),
-				   DRM_MEM_BUFS);
-	if (!entry->buflist) {
-		up(&dev->struct_sem);
-		atomic_dec(&dev->buf_alloc);
-		return -ENOMEM;
-	}
-	memset(entry->buflist, 0, count * sizeof(*entry->buflist));
-
-	entry->buf_size = size;
-	entry->page_order = page_order;
-
-	offset = 0;
-
-	while (entry->buf_count < count) {
-		buf = &entry->buflist[entry->buf_count];
-		buf->idx = dma->buf_count + entry->buf_count;
-		buf->total = alignment;
-		buf->order = order;
-		buf->used = 0;
-
-		buf->offset = (dma->byte_count + offset);
-		buf->bus_address = agp_offset + offset;
-		buf->address = (void *)(agp_offset + offset);
-		buf->next = NULL;
-		buf->waiting = 0;
-		buf->pending = 0;
-		init_waitqueue_head(&buf->dma_wait);
-		buf->filp = NULL;
-
-		buf->dev_priv_size = dev->driver->dev_priv_size;
-		buf->dev_private = drm_alloc(buf->dev_priv_size, DRM_MEM_BUFS);
-		if (!buf->dev_private) {
-			/* Set count correctly so we free the proper amount. */
-			entry->buf_count = count;
-			drm_cleanup_buf_error(dev, entry);
-			up(&dev->struct_sem);
-			atomic_dec(&dev->buf_alloc);
-			return -ENOMEM;
-		}
-		memset(buf->dev_private, 0, buf->dev_priv_size);
-
-		DRM_DEBUG("buffer %d @ %p\n", entry->buf_count, buf->address);
-
-		offset += alignment;
-		entry->buf_count++;
-		byte_count += PAGE_SIZE << page_order;
-	}
-
-	DRM_DEBUG("byte_count: %d\n", byte_count);
-
-	temp_buflist = drm_realloc(dma->buflist,
-				   dma->buf_count * sizeof(*dma->buflist),
-				   (dma->buf_count + entry->buf_count)
-				   * sizeof(*dma->buflist), DRM_MEM_BUFS);
-	if (!temp_buflist) {
-		/* Free the entry because it isn't valid */
-		drm_cleanup_buf_error(dev, entry);
-		up(&dev->struct_sem);
-		atomic_dec(&dev->buf_alloc);
-		return -ENOMEM;
-	}
-	dma->buflist = temp_buflist;
-
-	for (i = 0; i < entry->buf_count; i++) {
-		dma->buflist[i + dma->buf_count] = &entry->buflist[i];
-	}
-
-	dma->buf_count += entry->buf_count;
-	dma->byte_count += byte_count;
-
-	DRM_DEBUG("dma->buf_count : %d\n", dma->buf_count);
-	DRM_DEBUG("entry->buf_count : %d\n", entry->buf_count);
-
-	up(&dev->struct_sem);
-
-	request->count = entry->buf_count;
-	request->size = size;
-
-	dma->flags = _DRM_DMA_USE_FB;
-
-	atomic_dec(&dev->buf_alloc);
-	return 0;
-}
-
 /**
  * Add buffers for DMA transfers (ioctl).
  *
@@ -1216,7 +937,6 @@ int drm_addbufs( struct inode *inode, struct file *filp,
 	drm_buf_desc_t request;
 	drm_file_t *priv = filp->private_data;
 	drm_device_t *dev = priv->head->dev;
-	int ret;
 	
 	if (!drm_core_check_feature(dev, DRIVER_HAVE_DMA))
 		return -EINVAL;
@@ -1227,23 +947,13 @@ int drm_addbufs( struct inode *inode, struct file *filp,
 
 #if __OS_HAS_AGP
 	if ( request.flags & _DRM_AGP_BUFFER )
-		ret=drm_addbufs_agp(dev, &request);
+		return drm_addbufs_agp( inode, filp, cmd, arg );
 	else
 #endif
 	if ( request.flags & _DRM_SG_BUFFER )
-		ret=drm_addbufs_sg(dev, &request);
-	else if ( request.flags & _DRM_FB_BUFFER)
-		ret=drm_addbufs_fb(dev, &request);
+		return drm_addbufs_sg( inode, filp, cmd, arg );
 	else
-		ret=drm_addbufs_pci(dev, &request);
-
-	if (ret==0) {
-		if (copy_to_user((void __user *)arg, &request,
-				 sizeof(request))) {
-			ret = -EFAULT;
-		}
-	}
-	return ret;
+		return drm_addbufs_pci( inode, filp, cmd, arg );
 }
 
 
@@ -1486,31 +1196,43 @@ int drm_mapbufs( struct inode *inode, struct file *filp,
 		return -EFAULT;
 
 	if ( request.count >= dma->buf_count ) {
-		if ((drm_core_has_AGP(dev) && (dma->flags & _DRM_DMA_USE_AGP))
-		    || (drm_core_check_feature(dev, DRIVER_SG) 
-			&& (dma->flags & _DRM_DMA_USE_SG))
-		    || (drm_core_check_feature(dev, DRIVER_FB_DMA)
-			&& (dma->flags & _DRM_DMA_USE_FB))) {
+		if ((drm_core_has_AGP(dev) && (dma->flags & _DRM_DMA_USE_AGP)) ||
+		    (drm_core_check_feature(dev, DRIVER_SG) && (dma->flags & _DRM_DMA_USE_SG)) ) {
 			drm_map_t *map = dev->agp_buffer_map;
-			unsigned long token = dev->agp_buffer_token;
 
 			if ( !map ) {
 				retcode = -EINVAL;
 				goto done;
 			}
 
+#if LINUX_VERSION_CODE <= 0x020402
+			down( &current->mm->mmap_sem );
+#else
 			down_write( &current->mm->mmap_sem );
+#endif
 			virtual = do_mmap( filp, 0, map->size,
 					   PROT_READ | PROT_WRITE,
 					   MAP_SHARED,
-					   token );
+					   (unsigned long)map->offset );
+#if LINUX_VERSION_CODE <= 0x020402
+			up( &current->mm->mmap_sem );
+#else
 			up_write( &current->mm->mmap_sem );
+#endif
 		} else {
+#if LINUX_VERSION_CODE <= 0x020402
+			down( &current->mm->mmap_sem );
+#else
 			down_write( &current->mm->mmap_sem );
+#endif
 			virtual = do_mmap( filp, 0, dma->byte_count,
 					   PROT_READ | PROT_WRITE,
 					   MAP_SHARED, 0 );
+#if LINUX_VERSION_CODE <= 0x020402
+			up( &current->mm->mmap_sem );
+#else
 			up_write( &current->mm->mmap_sem );
+#endif
 		}
 		if ( virtual > -1024UL ) {
 			/* Real error */
@@ -1557,26 +1279,3 @@ int drm_mapbufs( struct inode *inode, struct file *filp,
 	return retcode;
 }
 
-/**
- * Compute size order.  Returns the exponent of the smaller power of two which
- * is greater or equal to given number.
- * 
- * \param size size.
- * \return order.
- *
- * \todo Can be made faster.
- */
-int drm_order( unsigned long size )
-{
-	int order;
-	unsigned long tmp;
-
-	for (order = 0, tmp = size >> 1; tmp; tmp >>= 1, order++)
-		;
-
-	if (size & (size - 1))
-		++order;
-
-	return order;
-}
-EXPORT_SYMBOL(drm_order);
diff --git a/trunk/drivers/char/drm/drm_context.c b/trunk/drivers/char/drm/drm_context.c
index f515567e5b6f..a7cfabd1ca2e 100644
--- a/trunk/drivers/char/drm/drm_context.c
+++ b/trunk/drivers/char/drm/drm_context.c
@@ -212,7 +212,6 @@ int drm_getsareactx(struct inode *inode, struct file *filp,
 	drm_ctx_priv_map_t __user *argp = (void __user *)arg;
 	drm_ctx_priv_map_t request;
 	drm_map_t *map;
-	drm_map_list_t *_entry;
 
 	if (copy_from_user(&request, argp, sizeof(request)))
 		return -EFAULT;
@@ -226,17 +225,7 @@ int drm_getsareactx(struct inode *inode, struct file *filp,
 	map = dev->context_sareas[request.ctx_id];
 	up(&dev->struct_sem);
 
-	request.handle = 0;
-	list_for_each_entry(_entry, &dev->maplist->head,head) {
-		if (_entry->map == map) {
-			request.handle = (void *)(unsigned long)_entry->user_token;
-			break;
-		}
-	}
-	if (request.handle == 0)
-		return -EINVAL;
-
-
+	request.handle = (void *) map->offset;
 	if (copy_to_user(argp, &request, sizeof(request)))
 		return -EFAULT;
 	return 0;
@@ -273,7 +262,7 @@ int drm_setsareactx(struct inode *inode, struct file *filp,
 	list_for_each(list, &dev->maplist->head) {
 		r_list = list_entry(list, drm_map_list_t, head);
 		if (r_list->map
-		    && r_list->user_token == (unsigned long) request.handle)
+		    && r_list->map->offset == (unsigned long) request.handle)
 			goto found;
 	}
 bad:
@@ -380,7 +369,7 @@ int drm_resctx( struct inode *inode, struct file *filp,
 		for ( i = 0 ; i < DRM_RESERVED_CONTEXTS ; i++ ) {
 			ctx.handle = i;
 			if ( copy_to_user( &res.contexts[i],
-					   &ctx, sizeof(ctx) ) )
+					   &i, sizeof(i) ) )
 				return -EFAULT;
 		}
 	}
diff --git a/trunk/drivers/char/drm/drm_drv.c b/trunk/drivers/char/drm/drm_drv.c
index 6ba48f346fcf..3333c250c4d9 100644
--- a/trunk/drivers/char/drm/drm_drv.c
+++ b/trunk/drivers/char/drm/drm_drv.c
@@ -70,8 +70,8 @@ static drm_ioctl_desc_t		  drm_ioctls[] = {
 	[DRM_IOCTL_NR(DRM_IOCTL_UNBLOCK)]       = { drm_noop,        1, 1 },
 	[DRM_IOCTL_NR(DRM_IOCTL_AUTH_MAGIC)]    = { drm_authmagic,   1, 1 },
 
-	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP)]       = { drm_addmap_ioctl,1, 1 },
-	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP)]        = { drm_rmmap_ioctl, 1, 0 },
+	[DRM_IOCTL_NR(DRM_IOCTL_ADD_MAP)]       = { drm_addmap,      1, 1 },
+	[DRM_IOCTL_NR(DRM_IOCTL_RM_MAP)]        = { drm_rmmap,       1, 0 },
 
 	[DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX)] = { drm_setsareactx, 1, 1 },
 	[DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX)] = { drm_getsareactx, 1, 0 },
@@ -102,10 +102,10 @@ static drm_ioctl_desc_t		  drm_ioctls[] = {
 	[DRM_IOCTL_NR(DRM_IOCTL_CONTROL)]       = { drm_control,     1, 1 },
 
 #if __OS_HAS_AGP
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ACQUIRE)]   = { drm_agp_acquire_ioctl, 1, 1 },
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_RELEASE)]   = { drm_agp_release_ioctl, 1, 1 },
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE)]    = { drm_agp_enable_ioctl, 1, 1 },
-	[DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO)]      = { drm_agp_info_ioctl, 1, 0 },
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ACQUIRE)]   = { drm_agp_acquire, 1, 1 },
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_RELEASE)]   = { drm_agp_release, 1, 1 },
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ENABLE)]    = { drm_agp_enable,  1, 1 },
+	[DRM_IOCTL_NR(DRM_IOCTL_AGP_INFO)]      = { drm_agp_info,    1, 0 },
 	[DRM_IOCTL_NR(DRM_IOCTL_AGP_ALLOC)]     = { drm_agp_alloc,   1, 1 },
 	[DRM_IOCTL_NR(DRM_IOCTL_AGP_FREE)]      = { drm_agp_free,    1, 1 },
 	[DRM_IOCTL_NR(DRM_IOCTL_AGP_BIND)]      = { drm_agp_bind,    1, 1 },
@@ -127,12 +127,14 @@ static drm_ioctl_desc_t		  drm_ioctls[] = {
  *
  * Frees every resource in \p dev.
  *
- * \sa drm_device
+ * \sa drm_device and setup().
  */
 int drm_takedown( drm_device_t *dev )
 {
 	drm_magic_entry_t *pt, *next;
+	drm_map_t *map;
 	drm_map_list_t *r_list;
+	struct list_head *list, *list_next;
 	drm_vma_entry_t *vma, *vma_next;
 	int i;
 
@@ -140,7 +142,6 @@ int drm_takedown( drm_device_t *dev )
 
 	if (dev->driver->pretakedown)
 	  dev->driver->pretakedown(dev);
-	DRM_DEBUG("driver pretakedown completed\n");
 
 	if (dev->unique) {
 		drm_free(dev->unique, strlen(dev->unique) + 1, DRM_MEM_DRIVER);
@@ -177,16 +178,11 @@ int drm_takedown( drm_device_t *dev )
 		}
 		dev->agp->memory = NULL;
 
-		if (dev->agp->acquired)
-		  drm_agp_release(dev);
+		if ( dev->agp->acquired ) drm_agp_do_release(dev);
 
 		dev->agp->acquired = 0;
 		dev->agp->enabled  = 0;
 	}
-	if (drm_core_check_feature(dev, DRIVER_SG) && dev->sg) {
-		drm_sg_cleanup(dev->sg);
-		dev->sg = NULL;
-	}
 
 				/* Clear vma list (only built for debugging) */
 	if ( dev->vmalist ) {
@@ -198,11 +194,48 @@ int drm_takedown( drm_device_t *dev )
 	}
 
 	if( dev->maplist ) {
-		while (!list_empty(&dev->maplist->head)) {
-			struct list_head *list = dev->maplist->head.next;
-			r_list = list_entry(list, drm_map_list_t, head);
-			drm_rmmap_locked(dev, r_list->map);
-		}
+		list_for_each_safe( list, list_next, &dev->maplist->head ) {
+			r_list = (drm_map_list_t *)list;
+
+			if ( ( map = r_list->map ) ) {
+				switch ( map->type ) {
+				case _DRM_REGISTERS:
+				case _DRM_FRAME_BUFFER:
+					if (drm_core_has_MTRR(dev)) {
+						if ( map->mtrr >= 0 ) {
+							int retcode;
+							retcode = mtrr_del( map->mtrr,
+									    map->offset,
+									    map->size );
+							DRM_DEBUG( "mtrr_del=%d\n", retcode );
+						}
+					}
+					drm_ioremapfree( map->handle, map->size, dev );
+					break;
+				case _DRM_SHM:
+					vfree(map->handle);
+					break;
+
+				case _DRM_AGP:
+					/* Do nothing here, because this is all
+					 * handled in the AGP/GART driver.
+					 */
+					break;
+				case _DRM_SCATTER_GATHER:
+					/* Handle it */
+					if (drm_core_check_feature(dev, DRIVER_SG) && dev->sg) {
+						drm_sg_cleanup(dev->sg);
+						dev->sg = NULL;
+					}
+					break;
+				}
+				drm_free(map, sizeof(*map), DRM_MEM_MAPS);
+			}
+			list_del( list );
+			drm_free(r_list, sizeof(*r_list), DRM_MEM_MAPS);
+ 		}
+		drm_free(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
+		dev->maplist = NULL;
  	}
 
 	if (drm_core_check_feature(dev, DRIVER_DMA_QUEUE) && dev->queuelist ) {
@@ -231,7 +264,6 @@ int drm_takedown( drm_device_t *dev )
 	}
 	up( &dev->struct_sem );
 
-	DRM_DEBUG("takedown completed\n");
 	return 0;
 }
 
@@ -280,7 +312,7 @@ EXPORT_SYMBOL(drm_init);
  *
  * Cleans up all DRM device, calling takedown().
  * 
- * \sa drm_init
+ * \sa drm_init().
  */
 static void drm_cleanup( drm_device_t *dev )
 {
@@ -293,11 +325,6 @@ static void drm_cleanup( drm_device_t *dev )
 
 	drm_takedown( dev );	
 
-	if (dev->maplist) {
-		drm_free(dev->maplist, sizeof(*dev->maplist), DRM_MEM_MAPS);
-		dev->maplist = NULL;
-	}
-
 	drm_ctxbitmap_cleanup( dev );
 	
 	if (drm_core_has_MTRR(dev) && drm_core_has_AGP(dev) &&
diff --git a/trunk/drivers/char/drm/drm_fops.c b/trunk/drivers/char/drm/drm_fops.c
index a1f4e9cd64ed..10e64fde8d78 100644
--- a/trunk/drivers/char/drm/drm_fops.c
+++ b/trunk/drivers/char/drm/drm_fops.c
@@ -71,6 +71,12 @@ static int drm_setup( drm_device_t *dev )
 		dev->magiclist[i].tail = NULL;
 	}
 
+	dev->maplist = drm_alloc(sizeof(*dev->maplist),
+				  DRM_MEM_MAPS);
+	if(dev->maplist == NULL) return -ENOMEM;
+	memset(dev->maplist, 0, sizeof(*dev->maplist));
+	INIT_LIST_HEAD(&dev->maplist->head);
+
 	dev->ctxlist = drm_alloc(sizeof(*dev->ctxlist),
 				  DRM_MEM_CTXLIST);
 	if(dev->ctxlist == NULL) return -ENOMEM;
diff --git a/trunk/drivers/char/drm/drm_ioctl.c b/trunk/drivers/char/drm/drm_ioctl.c
index d2ed3ba5aca9..39afda0ccabe 100644
--- a/trunk/drivers/char/drm/drm_ioctl.c
+++ b/trunk/drivers/char/drm/drm_ioctl.c
@@ -208,7 +208,7 @@ int drm_getmap( struct inode *inode, struct file *filp,
 	map.size   = r_list->map->size;
 	map.type   = r_list->map->type;
 	map.flags  = r_list->map->flags;
-	map.handle = (void *)(unsigned long) r_list->user_token;
+	map.handle = r_list->map->handle;
 	map.mtrr   = r_list->map->mtrr;
 	up(&dev->struct_sem);
 
diff --git a/trunk/drivers/char/drm/drm_memory.c b/trunk/drivers/char/drm/drm_memory.c
index ff483fb418aa..ace3d42f4407 100644
--- a/trunk/drivers/char/drm/drm_memory.c
+++ b/trunk/drivers/char/drm/drm_memory.c
@@ -142,31 +142,27 @@ void drm_free_pages(unsigned long address, int order, int area)
 
 #if __OS_HAS_AGP
 /** Wrapper around agp_allocate_memory() */
-DRM_AGP_MEM *drm_alloc_agp(drm_device_t *dev, int pages, u32 type)
+DRM_AGP_MEM *drm_alloc_agp(struct agp_bridge_data *bridge, int pages, u32 type)
 {
-	return drm_agp_allocate_memory(dev->agp->bridge, pages, type);
+	return drm_agp_allocate_memory(bridge, pages, type);
 }
-EXPORT_SYMBOL(drm_alloc_agp);
 
 /** Wrapper around agp_free_memory() */
 int drm_free_agp(DRM_AGP_MEM *handle, int pages)
 {
 	return drm_agp_free_memory(handle) ? 0 : -EINVAL;
 }
-EXPORT_SYMBOL(drm_free_agp);
 
 /** Wrapper around agp_bind_memory() */
 int drm_bind_agp(DRM_AGP_MEM *handle, unsigned int start)
 {
 	return drm_agp_bind_memory(handle, start);
 }
-EXPORT_SYMBOL(drm_bind_agp);
 
 /** Wrapper around agp_unbind_memory() */
 int drm_unbind_agp(DRM_AGP_MEM *handle)
 {
 	return drm_agp_unbind_memory(handle);
 }
-EXPORT_SYMBOL(drm_unbind_agp);
 #endif /* agp */
 #endif /* debug_memory */
diff --git a/trunk/drivers/char/drm/drm_pci.c b/trunk/drivers/char/drm/drm_pci.c
index 09ed712c1a7f..192e8762571c 100644
--- a/trunk/drivers/char/drm/drm_pci.c
+++ b/trunk/drivers/char/drm/drm_pci.c
@@ -46,11 +46,11 @@
 /**
  * \brief Allocate a PCI consistent memory block, for DMA.
  */
-drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
-				dma_addr_t maxaddr)
+void *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
+		    dma_addr_t maxaddr, dma_addr_t * busaddr)
 {
-	drm_dma_handle_t *dmah;
-#ifdef DRM_DEBUG_MEMORY
+	void *address;
+#if DRM_DEBUG_MEMORY
 	int area = DRM_MEM_DMA;
 
 	spin_lock(&drm_mem_lock);
@@ -74,19 +74,13 @@ drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
 		return NULL;
 	}
 
-	dmah = kmalloc(sizeof(drm_dma_handle_t), GFP_KERNEL);
-	if (!dmah)
-		return NULL;
-	
-	dmah->size = size;
-	dmah->vaddr = pci_alloc_consistent(dev->pdev, size, &dmah->busaddr);
+	address = pci_alloc_consistent(dev->pdev, size, busaddr);
 
-#ifdef DRM_DEBUG_MEMORY
-	if (dmah->vaddr == NULL) {
+#if DRM_DEBUG_MEMORY
+	if (address == NULL) {
 		spin_lock(&drm_mem_lock);
 		++drm_mem_stats[area].fail_count;
 		spin_unlock(&drm_mem_lock);
-		kfree(dmah);
 		return NULL;
 	}
 
@@ -96,42 +90,37 @@ drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
 	drm_ram_used += size;
 	spin_unlock(&drm_mem_lock);
 #else
-	if (dmah->vaddr == NULL) {
-		kfree(dmah);
+	if (address == NULL)
 		return NULL;
-	}
 #endif
 
-	memset(dmah->vaddr, 0, size);
+	memset(address, 0, size);
 
-	return dmah;
+	return address;
 }
 EXPORT_SYMBOL(drm_pci_alloc);
 
 /**
- * \brief Free a PCI consistent memory block with freeing its descriptor.
- *
- * This function is for internal use in the Linux-specific DRM core code.
+ * \brief Free a PCI consistent memory block.
  */
 void
-__drm_pci_free(drm_device_t * dev, drm_dma_handle_t *dmah)
+drm_pci_free(drm_device_t * dev, size_t size, void *vaddr, dma_addr_t busaddr)
 {
-#ifdef DRM_DEBUG_MEMORY
+#if DRM_DEBUG_MEMORY
 	int area = DRM_MEM_DMA;
 	int alloc_count;
 	int free_count;
 #endif
 
-	if (!dmah->vaddr) {
-#ifdef DRM_DEBUG_MEMORY
+	if (!vaddr) {
+#if DRM_DEBUG_MEMORY
 		DRM_MEM_ERROR(area, "Attempt to free address 0\n");
 #endif
 	} else {
-		pci_free_consistent(dev->pdev, dmah->size, dmah->vaddr,
-				    dmah->busaddr);
+		pci_free_consistent(dev->pdev, size, vaddr, busaddr);
 	}
 
-#ifdef DRM_DEBUG_MEMORY
+#if DRM_DEBUG_MEMORY
 	spin_lock(&drm_mem_lock);
 	free_count = ++drm_mem_stats[area].free_count;
 	alloc_count = drm_mem_stats[area].succeed_count;
@@ -146,16 +135,6 @@ __drm_pci_free(drm_device_t * dev, drm_dma_handle_t *dmah)
 #endif
 
 }
-
-/**
- * \brief Free a PCI consistent memory block
- */
-void
-drm_pci_free(drm_device_t *dev, drm_dma_handle_t *dmah)
-{
-	__drm_pci_free(dev, dmah);
-	kfree(dmah);
-}
 EXPORT_SYMBOL(drm_pci_free);
 
 /*@}*/
diff --git a/trunk/drivers/char/drm/drm_pciids.h b/trunk/drivers/char/drm/drm_pciids.h
index 58b1747cd440..70ca4fa55c9d 100644
--- a/trunk/drivers/char/drm/drm_pciids.h
+++ b/trunk/drivers/char/drm/drm_pciids.h
@@ -25,8 +25,6 @@
 	{0x1002, 0x4965, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
 	{0x1002, 0x4966, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
 	{0x1002, 0x4967, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
-	{0x1002, 0x4A49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420}, \
-	{0x1002, 0x4A4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420}, \
 	{0x1002, 0x4C57, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV200|CHIP_IS_MOBILITY}, \
 	{0x1002, 0x4C58, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV200|CHIP_IS_MOBILITY}, \
 	{0x1002, 0x4C59, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100|CHIP_IS_MOBILITY}, \
@@ -35,17 +33,7 @@
 	{0x1002, 0x4C65, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
 	{0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
 	{0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
-	{0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
-	{0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
-	{0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
-	{0x1002, 0x4E47, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
-	{0x1002, 0x4E48, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
-	{0x1002, 0x4E49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
-	{0x1002, 0x4E4A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
-	{0x1002, 0x4E4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
 	{0x1002, 0x4E50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
-	{0x1002, 0x4E51, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
-	{0x1002, 0x4E54, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
 	{0x1002, 0x5144, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
 	{0x1002, 0x5145, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
 	{0x1002, 0x5146, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
@@ -68,7 +56,6 @@
 	{0x1002, 0x516A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
 	{0x1002, 0x516B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
 	{0x1002, 0x516C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-	{0x1002, 0x5460, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
 	{0x1002, 0x5834, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP}, \
 	{0x1002, 0x5835, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP|CHIP_IS_MOBILITY}, \
 	{0x1002, 0x5836, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP}, \
@@ -129,10 +116,9 @@
 	{0, 0, 0}
 
 #define mga_PCI_IDS \
-	{0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
-	{0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
-	{0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
-	{0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
+	{0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
 	{0, 0, 0}
 
 #define mach64_PCI_IDS \
@@ -176,10 +162,9 @@
 
 #define viadrv_PCI_IDS \
 	{0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-	{0x1106, 0x3118, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
 	{0x1106, 0x3122, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
 	{0x1106, 0x7205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-	{0x1106, 0x3108, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x1106, 0x7204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
 	{0, 0, 0}
 
 #define i810_PCI_IDS \
@@ -196,30 +181,33 @@
 	{0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
 	{0, 0, 0}
 
+#define gamma_PCI_IDS \
+	{0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0, 0, 0}
+
 #define savage_PCI_IDS \
-	{0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
-	{0x5333, 0x8a21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
-	{0x5333, 0x8a22, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE4}, \
-	{0x5333, 0x8a23, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE4}, \
-	{0x5333, 0x8c10, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE_MX}, \
-	{0x5333, 0x8c11, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE_MX}, \
-	{0x5333, 0x8c12, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE_MX}, \
-	{0x5333, 0x8c13, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE_MX}, \
-	{0x5333, 0x8c22, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
-	{0x5333, 0x8c24, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
-	{0x5333, 0x8c26, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
-	{0x5333, 0x8c2a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
-	{0x5333, 0x8c2b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
-	{0x5333, 0x8c2c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
-	{0x5333, 0x8c2d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
-	{0x5333, 0x8c2e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
-	{0x5333, 0x8c2f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SUPERSAVAGE}, \
-	{0x5333, 0x8a25, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGE}, \
-	{0x5333, 0x8a26, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGE}, \
-	{0x5333, 0x8d01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
-	{0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
-	{0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
-	{0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
+	{0x5333, 0x8a22, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8a23, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c10, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c11, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c12, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c13, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c22, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c24, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c26, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c2a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c2b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c2c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c2d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c2e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8c2f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8a25, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8a26, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8d01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
 	{0, 0, 0}
 
 #define ffb_PCI_IDS \
@@ -235,3 +223,10 @@
 	{0x8086, 0x2772, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
 	{0, 0, 0}
 
+#define viadrv_PCI_IDS \
+	{0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x1106, 0x3122, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x1106, 0x7205, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0x1106, 0x7204, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+	{0, 0, 0}
+
diff --git a/trunk/drivers/char/drm/drm_proc.c b/trunk/drivers/char/drm/drm_proc.c
index 32d2bb99462c..4774087d2e9e 100644
--- a/trunk/drivers/char/drm/drm_proc.c
+++ b/trunk/drivers/char/drm/drm_proc.c
@@ -210,8 +210,8 @@ static int drm__vm_info(char *buf, char **start, off_t offset, int request,
 
 				/* Hardcoded from _DRM_FRAME_BUFFER,
                                    _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
-                                   _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
-	const char   *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
+                                   _DRM_SCATTER_GATHER. */
+	const char   *types[] = { "FB", "REG", "SHM", "AGP", "SG" };
 	const char   *type;
 	int	     i;
 
@@ -229,19 +229,16 @@ static int drm__vm_info(char *buf, char **start, off_t offset, int request,
 	if (dev->maplist != NULL) list_for_each(list, &dev->maplist->head) {
 		r_list = list_entry(list, drm_map_list_t, head);
 		map = r_list->map;
-		if(!map)
-			continue;
-		if (map->type < 0 || map->type > 5)
-			type = "??";
-		else	
-			type = types[map->type];
-		DRM_PROC_PRINT("%4d 0x%08lx 0x%08lx %4.4s  0x%02x 0x%08x ",
+		if(!map) continue;
+		if (map->type < 0 || map->type > 4) type = "??";
+		else				    type = types[map->type];
+		DRM_PROC_PRINT("%4d 0x%08lx 0x%08lx %4.4s  0x%02x 0x%08lx ",
 			       i,
 			       map->offset,
 			       map->size,
 			       type,
 			       map->flags,
-			       r_list->user_token);
+			       (unsigned long)map->handle);
 		if (map->mtrr < 0) {
 			DRM_PROC_PRINT("none\n");
 		} else {
diff --git a/trunk/drivers/char/drm/drm_scatter.c b/trunk/drivers/char/drm/drm_scatter.c
index ed267d49bc6a..54fddb6ea2d1 100644
--- a/trunk/drivers/char/drm/drm_scatter.c
+++ b/trunk/drivers/char/drm/drm_scatter.c
@@ -61,12 +61,6 @@ void drm_sg_cleanup( drm_sg_mem_t *entry )
 		   DRM_MEM_SGLISTS );
 }
 
-#ifdef _LP64
-# define ScatterHandle(x) (unsigned int)((x >> 32) + (x & ((1L << 32) - 1)))
-#else
-# define ScatterHandle(x) (unsigned int)(x)
-#endif
-
 int drm_sg_alloc( struct inode *inode, struct file *filp,
 		   unsigned int cmd, unsigned long arg )
 {
@@ -139,13 +133,12 @@ int drm_sg_alloc( struct inode *inode, struct file *filp,
 	 */
 	memset( entry->virtual, 0, pages << PAGE_SHIFT );
 
-	entry->handle = ScatterHandle((unsigned long)entry->virtual);
+	entry->handle = (unsigned long)entry->virtual;
 
 	DRM_DEBUG( "sg alloc handle  = %08lx\n", entry->handle );
 	DRM_DEBUG( "sg alloc virtual = %p\n", entry->virtual );
 
-	for (i = (unsigned long)entry->virtual, j = 0; j < pages; 
-		i += PAGE_SIZE, j++) {
+	for ( i = entry->handle, j = 0 ; j < pages ; i += PAGE_SIZE, j++ ) {
 		entry->pagelist[j] = vmalloc_to_page((void *)i);
 		if (!entry->pagelist[j])
 			goto failed;
diff --git a/trunk/drivers/char/drm/drm_stub.c b/trunk/drivers/char/drm/drm_stub.c
index 95a976c96eb8..48829a1a086a 100644
--- a/trunk/drivers/char/drm/drm_stub.c
+++ b/trunk/drivers/char/drm/drm_stub.c
@@ -75,11 +75,6 @@ static int drm_fill_in_dev(drm_device_t *dev, struct pci_dev *pdev, const struct
 	dev->pci_func = PCI_FUNC(pdev->devfn);
 	dev->irq = pdev->irq;
 
-	dev->maplist = drm_calloc(1, sizeof(*dev->maplist), DRM_MEM_MAPS);
-	if (dev->maplist == NULL)
-		return -ENOMEM;
-	INIT_LIST_HEAD(&dev->maplist->head);
-
 	/* the DRM has 6 basic counters */
 	dev->counters = 6;
 	dev->types[0]  = _DRM_STAT_LOCK;
@@ -96,8 +91,7 @@ static int drm_fill_in_dev(drm_device_t *dev, struct pci_dev *pdev, const struct
 			goto error_out_unreg;
 
 	if (drm_core_has_AGP(dev)) {
-		if (drm_device_is_agp(dev))
-			dev->agp = drm_agp_init(dev);
+		dev->agp = drm_agp_init(dev);
 		if (drm_core_check_feature(dev, DRIVER_REQUIRE_AGP) && (dev->agp == NULL)) {
 			DRM_ERROR( "Cannot initialize the agpgart module.\n" );
 			retcode = -EINVAL;
diff --git a/trunk/drivers/char/drm/drm_vm.c b/trunk/drivers/char/drm/drm_vm.c
index ced4215e2275..621220f3f372 100644
--- a/trunk/drivers/char/drm/drm_vm.c
+++ b/trunk/drivers/char/drm/drm_vm.c
@@ -73,13 +73,12 @@ static __inline__ struct page *drm_do_vm_nopage(struct vm_area_struct *vma,
 		r_list = list_entry(list, drm_map_list_t, head);
 		map = r_list->map;
 		if (!map) continue;
-		if (r_list->user_token == VM_OFFSET(vma))
-			break;
+		if (map->offset == VM_OFFSET(vma)) break;
 	}
 
 	if (map && map->type == _DRM_AGP) {
 		unsigned long offset = address - vma->vm_start;
-		unsigned long baddr = map->offset + offset;
+		unsigned long baddr = VM_OFFSET(vma) + offset;
 		struct drm_agp_mem *agpmem;
 		struct page *page;
 
@@ -211,8 +210,6 @@ static void drm_vm_shm_close(struct vm_area_struct *vma)
 		}
 
 		if(!found_maps) {
-			drm_dma_handle_t dmah;
-
 			switch (map->type) {
 			case _DRM_REGISTERS:
 			case _DRM_FRAME_BUFFER:
@@ -231,12 +228,6 @@ static void drm_vm_shm_close(struct vm_area_struct *vma)
 			case _DRM_AGP:
 			case _DRM_SCATTER_GATHER:
 				break;
-			case _DRM_CONSISTENT:
-				dmah.vaddr = map->handle;
-				dmah.busaddr = map->offset;
-				dmah.size = map->size;
-				__drm_pci_free(dev, &dmah);
-				break;
 			}
 			drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 		}
@@ -305,7 +296,7 @@ static __inline__ struct page *drm_do_vm_sg_nopage(struct vm_area_struct *vma,
 
 
 	offset = address - vma->vm_start;
-	map_offset = map->offset - (unsigned long)dev->sg->virtual;
+	map_offset = map->offset - dev->sg->handle;
 	page_offset = (offset >> PAGE_SHIFT) + (map_offset >> PAGE_SHIFT);
 	page = entry->pagelist[page_offset];
 	get_page(page);
@@ -314,6 +305,8 @@ static __inline__ struct page *drm_do_vm_sg_nopage(struct vm_area_struct *vma,
 }
 
 
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,0)
+
 static struct page *drm_vm_nopage(struct vm_area_struct *vma,
 				   unsigned long address,
 				   int *type) {
@@ -342,6 +335,35 @@ static struct page *drm_vm_sg_nopage(struct vm_area_struct *vma,
 	return drm_do_vm_sg_nopage(vma, address);
 }
 
+#else	/* LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,0) */
+
+static struct page *drm_vm_nopage(struct vm_area_struct *vma,
+				   unsigned long address,
+				   int unused) {
+	return drm_do_vm_nopage(vma, address);
+}
+
+static struct page *drm_vm_shm_nopage(struct vm_area_struct *vma,
+				       unsigned long address,
+				       int unused) {
+	return drm_do_vm_shm_nopage(vma, address);
+}
+
+static struct page *drm_vm_dma_nopage(struct vm_area_struct *vma,
+				       unsigned long address,
+				       int unused) {
+	return drm_do_vm_dma_nopage(vma, address);
+}
+
+static struct page *drm_vm_sg_nopage(struct vm_area_struct *vma,
+				      unsigned long address,
+				      int unused) {
+	return drm_do_vm_sg_nopage(vma, address);
+}
+
+#endif
+
+
 /** AGP virtual memory operations */
 static struct vm_operations_struct   drm_vm_ops = {
 	.nopage = drm_vm_nopage,
@@ -465,7 +487,11 @@ static int drm_mmap_dma(struct file *filp, struct vm_area_struct *vma)
 
 	vma->vm_ops   = &drm_vm_dma_ops;
 
+#if LINUX_VERSION_CODE <= 0x02040e /* KERNEL_VERSION(2,4,14) */
+	vma->vm_flags |= VM_LOCKED | VM_SHM; /* Don't swap */
+#else
 	vma->vm_flags |= VM_RESERVED; /* Don't swap */
+#endif
 
 	vma->vm_file  =	 filp;	/* Needed for drm_vm_open() */
 	drm_vm_open(vma);
@@ -534,12 +560,13 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
 				   for performance, even if the list was a
 				   bit longer. */
 	list_for_each(list, &dev->maplist->head) {
+		unsigned long off;
 
 		r_list = list_entry(list, drm_map_list_t, head);
 		map = r_list->map;
 		if (!map) continue;
-		if (r_list->user_token == VM_OFFSET(vma))
-			break;
+		off = dev->driver->get_map_ofs(map);
+		if (off == VM_OFFSET(vma)) break;
 	}
 
 	if (!map || ((map->flags&_DRM_RESTRICTED) && !capable(CAP_SYS_ADMIN)))
@@ -578,17 +605,17 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
                 /* fall through to _DRM_FRAME_BUFFER... */        
 	case _DRM_FRAME_BUFFER:
 	case _DRM_REGISTERS:
+		if (VM_OFFSET(vma) >= __pa(high_memory)) {
 #if defined(__i386__) || defined(__x86_64__)
-		if (boot_cpu_data.x86 > 3 && map->type != _DRM_AGP) {
-			pgprot_val(vma->vm_page_prot) |= _PAGE_PCD;
-			pgprot_val(vma->vm_page_prot) &= ~_PAGE_PWT;
-		}
+			if (boot_cpu_data.x86 > 3 && map->type != _DRM_AGP) {
+				pgprot_val(vma->vm_page_prot) |= _PAGE_PCD;
+				pgprot_val(vma->vm_page_prot) &= ~_PAGE_PWT;
+			}
 #elif defined(__powerpc__)
-		pgprot_val(vma->vm_page_prot) |= _PAGE_NO_CACHE;
-		if (map->type == _DRM_REGISTERS)
-			pgprot_val(vma->vm_page_prot) |= _PAGE_GUARDED;
+			pgprot_val(vma->vm_page_prot) |= _PAGE_NO_CACHE | _PAGE_GUARDED;
 #endif
-		vma->vm_flags |= VM_IO;	/* not in core dump */
+			vma->vm_flags |= VM_IO;	/* not in core dump */
+		}
 #if defined(__ia64__)
 		if (efi_range_is_wc(vma->vm_start, vma->vm_end -
 				    vma->vm_start))
@@ -601,12 +628,12 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
 		offset = dev->driver->get_reg_ofs(dev);
 #ifdef __sparc__
 		if (io_remap_pfn_range(DRM_RPR_ARG(vma) vma->vm_start,
-					(map->offset + offset) >> PAGE_SHIFT,
+					(VM_OFFSET(vma) + offset) >> PAGE_SHIFT,
 					vma->vm_end - vma->vm_start,
 					vma->vm_page_prot))
 #else
 		if (io_remap_pfn_range(vma, vma->vm_start,
-				     (map->offset + offset) >> PAGE_SHIFT,
+				     (VM_OFFSET(vma) + offset) >> PAGE_SHIFT,
 				     vma->vm_end - vma->vm_start,
 				     vma->vm_page_prot))
 #endif
@@ -614,28 +641,37 @@ int drm_mmap(struct file *filp, struct vm_area_struct *vma)
 		DRM_DEBUG("   Type = %d; start = 0x%lx, end = 0x%lx,"
 			  " offset = 0x%lx\n",
 			  map->type,
-			  vma->vm_start, vma->vm_end, map->offset + offset);
+			  vma->vm_start, vma->vm_end, VM_OFFSET(vma) + offset);
 		vma->vm_ops = &drm_vm_ops;
 		break;
 	case _DRM_SHM:
-	case _DRM_CONSISTENT:
-		/* Consistent memory is really like shared memory. It's only
-		 * allocate in a different way */
 		vma->vm_ops = &drm_vm_shm_ops;
 		vma->vm_private_data = (void *)map;
 				/* Don't let this area swap.  Change when
 				   DRM_KERNEL advisory is supported. */
+#if LINUX_VERSION_CODE <= 0x02040e /* KERNEL_VERSION(2,4,14) */
+		vma->vm_flags |= VM_LOCKED;
+#else
 		vma->vm_flags |= VM_RESERVED;
+#endif
 		break;
 	case _DRM_SCATTER_GATHER:
 		vma->vm_ops = &drm_vm_sg_ops;
 		vma->vm_private_data = (void *)map;
+#if LINUX_VERSION_CODE <= 0x02040e /* KERNEL_VERSION(2,4,14) */
+		vma->vm_flags |= VM_LOCKED;
+#else
 		vma->vm_flags |= VM_RESERVED;
+#endif
                 break;
 	default:
 		return -EINVAL;	/* This should never happen. */
 	}
+#if LINUX_VERSION_CODE <= 0x02040e /* KERNEL_VERSION(2,4,14) */
+	vma->vm_flags |= VM_LOCKED | VM_SHM; /* Don't swap */
+#else
 	vma->vm_flags |= VM_RESERVED; /* Don't swap */
+#endif
 
 	vma->vm_file  =	 filp;	/* Needed for drm_vm_open() */
 	drm_vm_open(vma);
diff --git a/trunk/drivers/char/drm/ffb_drv.c b/trunk/drivers/char/drm/ffb_drv.c
index 1bd0d55ee0f0..ec614fff8f04 100644
--- a/trunk/drivers/char/drm/ffb_drv.c
+++ b/trunk/drivers/char/drm/ffb_drv.c
@@ -152,11 +152,14 @@ static drm_map_t *ffb_find_map(struct file *filp, unsigned long off)
 		return NULL;
 
 	list_for_each(list, &dev->maplist->head) {
+		unsigned long uoff;
+
 		r_list = (drm_map_list_t *)list;
 		map = r_list->map;
 		if (!map)
 			continue;
-		if (r_list->user_token == off)
+		uoff = (map->offset & 0xffffffff);
+		if (uoff == off)
 			return map;
 	}
 
diff --git a/trunk/drivers/char/drm/gamma_context.h b/trunk/drivers/char/drm/gamma_context.h
new file mode 100644
index 000000000000..d11b507f87ee
--- /dev/null
+++ b/trunk/drivers/char/drm/gamma_context.h
@@ -0,0 +1,492 @@
+/* drm_context.h -- IOCTLs for generic contexts -*- linux-c -*-
+ * Created: Fri Nov 24 18:31:37 2000 by gareth@valinux.com
+ *
+ * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas.
+ * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Rickard E. (Rik) Faith <faith@valinux.com>
+ *    Gareth Hughes <gareth@valinux.com>
+ * ChangeLog:
+ *  2001-11-16	Torsten Duwe <duwe@caldera.de>
+ *		added context constructor/destructor hooks,
+ *		needed by SiS driver's memory management.
+ */
+
+/* ================================================================
+ * Old-style context support -- only used by gamma.  
+ */
+
+
+/* The drm_read and drm_write_string code (especially that which manages
+   the circular buffer), is based on Alessandro Rubini's LINUX DEVICE
+   DRIVERS (Cambridge: O'Reilly, 1998), pages 111-113. */
+
+ssize_t gamma_fops_read(struct file *filp, char __user *buf, size_t count, loff_t *off)
+{
+	drm_file_t    *priv   = filp->private_data;
+	drm_device_t  *dev    = priv->dev;
+	int	      left;
+	int	      avail;
+	int	      send;
+	int	      cur;
+
+	DRM_DEBUG("%p, %p\n", dev->buf_rp, dev->buf_wp);
+
+	while (dev->buf_rp == dev->buf_wp) {
+		DRM_DEBUG("  sleeping\n");
+		if (filp->f_flags & O_NONBLOCK) {
+			return -EAGAIN;
+		}
+		interruptible_sleep_on(&dev->buf_readers);
+		if (signal_pending(current)) {
+			DRM_DEBUG("  interrupted\n");
+			return -ERESTARTSYS;
+		}
+		DRM_DEBUG("  awake\n");
+	}
+
+	left  = (dev->buf_rp + DRM_BSZ - dev->buf_wp) % DRM_BSZ;
+	avail = DRM_BSZ - left;
+	send  = DRM_MIN(avail, count);
+
+	while (send) {
+		if (dev->buf_wp > dev->buf_rp) {
+			cur = DRM_MIN(send, dev->buf_wp - dev->buf_rp);
+		} else {
+			cur = DRM_MIN(send, dev->buf_end - dev->buf_rp);
+		}
+		if (copy_to_user(buf, dev->buf_rp, cur))
+			return -EFAULT;
+		dev->buf_rp += cur;
+		if (dev->buf_rp == dev->buf_end) dev->buf_rp = dev->buf;
+		send -= cur;
+	}
+
+	wake_up_interruptible(&dev->buf_writers);
+	return DRM_MIN(avail, count);
+}
+
+
+/* In an incredibly convoluted setup, the kernel module actually calls
+ * back into the X server to perform context switches on behalf of the
+ * 3d clients.
+ */
+int DRM(write_string)(drm_device_t *dev, const char *s)
+{
+	int left   = (dev->buf_rp + DRM_BSZ - dev->buf_wp) % DRM_BSZ;
+	int send   = strlen(s);
+	int count;
+
+	DRM_DEBUG("%d left, %d to send (%p, %p)\n",
+		  left, send, dev->buf_rp, dev->buf_wp);
+
+	if (left == 1 || dev->buf_wp != dev->buf_rp) {
+		DRM_ERROR("Buffer not empty (%d left, wp = %p, rp = %p)\n",
+			  left,
+			  dev->buf_wp,
+			  dev->buf_rp);
+	}
+
+	while (send) {
+		if (dev->buf_wp >= dev->buf_rp) {
+			count = DRM_MIN(send, dev->buf_end - dev->buf_wp);
+			if (count == left) --count; /* Leave a hole */
+		} else {
+			count = DRM_MIN(send, dev->buf_rp - dev->buf_wp - 1);
+		}
+		strncpy(dev->buf_wp, s, count);
+		dev->buf_wp += count;
+		if (dev->buf_wp == dev->buf_end) dev->buf_wp = dev->buf;
+		send -= count;
+	}
+
+	if (dev->buf_async) kill_fasync(&dev->buf_async, SIGIO, POLL_IN);
+
+	DRM_DEBUG("waking\n");
+	wake_up_interruptible(&dev->buf_readers);
+	return 0;
+}
+
+unsigned int gamma_fops_poll(struct file *filp, struct poll_table_struct *wait)
+{
+	drm_file_t   *priv = filp->private_data;
+	drm_device_t *dev  = priv->dev;
+
+	poll_wait(filp, &dev->buf_readers, wait);
+	if (dev->buf_wp != dev->buf_rp) return POLLIN | POLLRDNORM;
+	return 0;
+}
+
+int DRM(context_switch)(drm_device_t *dev, int old, int new)
+{
+	char	    buf[64];
+	drm_queue_t *q;
+
+	if (test_and_set_bit(0, &dev->context_flag)) {
+		DRM_ERROR("Reentering -- FIXME\n");
+		return -EBUSY;
+	}
+
+	DRM_DEBUG("Context switch from %d to %d\n", old, new);
+
+	if (new >= dev->queue_count) {
+		clear_bit(0, &dev->context_flag);
+		return -EINVAL;
+	}
+
+	if (new == dev->last_context) {
+		clear_bit(0, &dev->context_flag);
+		return 0;
+	}
+
+	q = dev->queuelist[new];
+	atomic_inc(&q->use_count);
+	if (atomic_read(&q->use_count) == 1) {
+		atomic_dec(&q->use_count);
+		clear_bit(0, &dev->context_flag);
+		return -EINVAL;
+	}
+
+	/* This causes the X server to wake up & do a bunch of hardware
+	 * interaction to actually effect the context switch.
+	 */
+	sprintf(buf, "C %d %d\n", old, new);
+	DRM(write_string)(dev, buf);
+
+	atomic_dec(&q->use_count);
+
+	return 0;
+}
+
+int DRM(context_switch_complete)(drm_device_t *dev, int new)
+{
+	drm_device_dma_t *dma = dev->dma;
+
+	dev->last_context = new;  /* PRE/POST: This is the _only_ writer. */
+	dev->last_switch  = jiffies;
+
+	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+		DRM_ERROR("Lock isn't held after context switch\n");
+	}
+
+	if (!dma || !(dma->next_buffer && dma->next_buffer->while_locked)) {
+		if (DRM(lock_free)(dev, &dev->lock.hw_lock->lock,
+				  DRM_KERNEL_CONTEXT)) {
+			DRM_ERROR("Cannot free lock\n");
+		}
+	}
+
+	clear_bit(0, &dev->context_flag);
+	wake_up_interruptible(&dev->context_wait);
+
+	return 0;
+}
+
+static int DRM(init_queue)(drm_device_t *dev, drm_queue_t *q, drm_ctx_t *ctx)
+{
+	DRM_DEBUG("\n");
+
+	if (atomic_read(&q->use_count) != 1
+	    || atomic_read(&q->finalization)
+	    || atomic_read(&q->block_count)) {
+		DRM_ERROR("New queue is already in use: u%d f%d b%d\n",
+			  atomic_read(&q->use_count),
+			  atomic_read(&q->finalization),
+			  atomic_read(&q->block_count));
+	}
+
+	atomic_set(&q->finalization,  0);
+	atomic_set(&q->block_count,   0);
+	atomic_set(&q->block_read,    0);
+	atomic_set(&q->block_write,   0);
+	atomic_set(&q->total_queued,  0);
+	atomic_set(&q->total_flushed, 0);
+	atomic_set(&q->total_locks,   0);
+
+	init_waitqueue_head(&q->write_queue);
+	init_waitqueue_head(&q->read_queue);
+	init_waitqueue_head(&q->flush_queue);
+
+	q->flags = ctx->flags;
+
+	DRM(waitlist_create)(&q->waitlist, dev->dma->buf_count);
+
+	return 0;
+}
+
+
+/* drm_alloc_queue:
+PRE: 1) dev->queuelist[0..dev->queue_count] is allocated and will not
+	disappear (so all deallocation must be done after IOCTLs are off)
+     2) dev->queue_count < dev->queue_slots
+     3) dev->queuelist[i].use_count == 0 and
+	dev->queuelist[i].finalization == 0 if i not in use
+POST: 1) dev->queuelist[i].use_count == 1
+      2) dev->queue_count < dev->queue_slots */
+
+static int DRM(alloc_queue)(drm_device_t *dev)
+{
+	int	    i;
+	drm_queue_t *queue;
+	int	    oldslots;
+	int	    newslots;
+				/* Check for a free queue */
+	for (i = 0; i < dev->queue_count; i++) {
+		atomic_inc(&dev->queuelist[i]->use_count);
+		if (atomic_read(&dev->queuelist[i]->use_count) == 1
+		    && !atomic_read(&dev->queuelist[i]->finalization)) {
+			DRM_DEBUG("%d (free)\n", i);
+			return i;
+		}
+		atomic_dec(&dev->queuelist[i]->use_count);
+	}
+				/* Allocate a new queue */
+	down(&dev->struct_sem);
+
+	queue = DRM(alloc)(sizeof(*queue), DRM_MEM_QUEUES);
+	memset(queue, 0, sizeof(*queue));
+	atomic_set(&queue->use_count, 1);
+
+	++dev->queue_count;
+	if (dev->queue_count >= dev->queue_slots) {
+		oldslots = dev->queue_slots * sizeof(*dev->queuelist);
+		if (!dev->queue_slots) dev->queue_slots = 1;
+		dev->queue_slots *= 2;
+		newslots = dev->queue_slots * sizeof(*dev->queuelist);
+
+		dev->queuelist = DRM(realloc)(dev->queuelist,
+					      oldslots,
+					      newslots,
+					      DRM_MEM_QUEUES);
+		if (!dev->queuelist) {
+			up(&dev->struct_sem);
+			DRM_DEBUG("out of memory\n");
+			return -ENOMEM;
+		}
+	}
+	dev->queuelist[dev->queue_count-1] = queue;
+
+	up(&dev->struct_sem);
+	DRM_DEBUG("%d (new)\n", dev->queue_count - 1);
+	return dev->queue_count - 1;
+}
+
+int DRM(resctx)(struct inode *inode, struct file *filp,
+		unsigned int cmd, unsigned long arg)
+{
+	drm_ctx_res_t __user *argp = (void __user *)arg;
+	drm_ctx_res_t	res;
+	drm_ctx_t	ctx;
+	int		i;
+
+	DRM_DEBUG("%d\n", DRM_RESERVED_CONTEXTS);
+	if (copy_from_user(&res, argp, sizeof(res)))
+		return -EFAULT;
+	if (res.count >= DRM_RESERVED_CONTEXTS) {
+		memset(&ctx, 0, sizeof(ctx));
+		for (i = 0; i < DRM_RESERVED_CONTEXTS; i++) {
+			ctx.handle = i;
+			if (copy_to_user(&res.contexts[i],
+					 &i,
+					 sizeof(i)))
+				return -EFAULT;
+		}
+	}
+	res.count = DRM_RESERVED_CONTEXTS;
+	if (copy_to_user(argp, &res, sizeof(res)))
+		return -EFAULT;
+	return 0;
+}
+
+int DRM(addctx)(struct inode *inode, struct file *filp,
+		unsigned int cmd, unsigned long arg)
+{
+	drm_file_t	*priv	= filp->private_data;
+	drm_device_t	*dev	= priv->dev;
+	drm_ctx_t	ctx;
+	drm_ctx_t	__user *argp = (void __user *)arg;
+
+	if (copy_from_user(&ctx, argp, sizeof(ctx)))
+		return -EFAULT;
+	if ((ctx.handle = DRM(alloc_queue)(dev)) == DRM_KERNEL_CONTEXT) {
+				/* Init kernel's context and get a new one. */
+		DRM(init_queue)(dev, dev->queuelist[ctx.handle], &ctx);
+		ctx.handle = DRM(alloc_queue)(dev);
+	}
+	DRM(init_queue)(dev, dev->queuelist[ctx.handle], &ctx);
+	DRM_DEBUG("%d\n", ctx.handle);
+	if (copy_to_user(argp, &ctx, sizeof(ctx)))
+		return -EFAULT;
+	return 0;
+}
+
+int DRM(modctx)(struct inode *inode, struct file *filp,
+		unsigned int cmd, unsigned long arg)
+{
+	drm_file_t	*priv	= filp->private_data;
+	drm_device_t	*dev	= priv->dev;
+	drm_ctx_t	ctx;
+	drm_queue_t	*q;
+
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
+		return -EFAULT;
+
+	DRM_DEBUG("%d\n", ctx.handle);
+
+	if (ctx.handle < 0 || ctx.handle >= dev->queue_count) return -EINVAL;
+	q = dev->queuelist[ctx.handle];
+
+	atomic_inc(&q->use_count);
+	if (atomic_read(&q->use_count) == 1) {
+				/* No longer in use */
+		atomic_dec(&q->use_count);
+		return -EINVAL;
+	}
+
+	if (DRM_BUFCOUNT(&q->waitlist)) {
+		atomic_dec(&q->use_count);
+		return -EBUSY;
+	}
+
+	q->flags = ctx.flags;
+
+	atomic_dec(&q->use_count);
+	return 0;
+}
+
+int DRM(getctx)(struct inode *inode, struct file *filp,
+		unsigned int cmd, unsigned long arg)
+{
+	drm_file_t	*priv	= filp->private_data;
+	drm_device_t	*dev	= priv->dev;
+	drm_ctx_t	__user *argp = (void __user *)arg;
+	drm_ctx_t	ctx;
+	drm_queue_t	*q;
+
+	if (copy_from_user(&ctx, argp, sizeof(ctx)))
+		return -EFAULT;
+
+	DRM_DEBUG("%d\n", ctx.handle);
+
+	if (ctx.handle >= dev->queue_count) return -EINVAL;
+	q = dev->queuelist[ctx.handle];
+
+	atomic_inc(&q->use_count);
+	if (atomic_read(&q->use_count) == 1) {
+				/* No longer in use */
+		atomic_dec(&q->use_count);
+		return -EINVAL;
+	}
+
+	ctx.flags = q->flags;
+	atomic_dec(&q->use_count);
+
+	if (copy_to_user(argp, &ctx, sizeof(ctx)))
+		return -EFAULT;
+
+	return 0;
+}
+
+int DRM(switchctx)(struct inode *inode, struct file *filp,
+		   unsigned int cmd, unsigned long arg)
+{
+	drm_file_t	*priv	= filp->private_data;
+	drm_device_t	*dev	= priv->dev;
+	drm_ctx_t	ctx;
+
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
+		return -EFAULT;
+	DRM_DEBUG("%d\n", ctx.handle);
+	return DRM(context_switch)(dev, dev->last_context, ctx.handle);
+}
+
+int DRM(newctx)(struct inode *inode, struct file *filp,
+		unsigned int cmd, unsigned long arg)
+{
+	drm_file_t	*priv	= filp->private_data;
+	drm_device_t	*dev	= priv->dev;
+	drm_ctx_t	ctx;
+
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
+		return -EFAULT;
+	DRM_DEBUG("%d\n", ctx.handle);
+	DRM(context_switch_complete)(dev, ctx.handle);
+
+	return 0;
+}
+
+int DRM(rmctx)(struct inode *inode, struct file *filp,
+	       unsigned int cmd, unsigned long arg)
+{
+	drm_file_t	*priv	= filp->private_data;
+	drm_device_t	*dev	= priv->dev;
+	drm_ctx_t	ctx;
+	drm_queue_t	*q;
+	drm_buf_t	*buf;
+
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
+		return -EFAULT;
+	DRM_DEBUG("%d\n", ctx.handle);
+
+	if (ctx.handle >= dev->queue_count) return -EINVAL;
+	q = dev->queuelist[ctx.handle];
+
+	atomic_inc(&q->use_count);
+	if (atomic_read(&q->use_count) == 1) {
+				/* No longer in use */
+		atomic_dec(&q->use_count);
+		return -EINVAL;
+	}
+
+	atomic_inc(&q->finalization); /* Mark queue in finalization state */
+	atomic_sub(2, &q->use_count); /* Mark queue as unused (pending
+					 finalization) */
+
+	while (test_and_set_bit(0, &dev->interrupt_flag)) {
+		schedule();
+		if (signal_pending(current)) {
+			clear_bit(0, &dev->interrupt_flag);
+			return -EINTR;
+		}
+	}
+				/* Remove queued buffers */
+	while ((buf = DRM(waitlist_get)(&q->waitlist))) {
+		DRM(free_buffer)(dev, buf);
+	}
+	clear_bit(0, &dev->interrupt_flag);
+
+				/* Wakeup blocked processes */
+	wake_up_interruptible(&q->read_queue);
+	wake_up_interruptible(&q->write_queue);
+	wake_up_interruptible(&q->flush_queue);
+
+				/* Finalization over.  Queue is made
+				   available when both use_count and
+				   finalization become 0, which won't
+				   happen until all the waiting processes
+				   stop waiting. */
+	atomic_dec(&q->finalization);
+	return 0;
+}
+
diff --git a/trunk/drivers/char/drm/gamma_dma.c b/trunk/drivers/char/drm/gamma_dma.c
new file mode 100644
index 000000000000..e486fb8d31e9
--- /dev/null
+++ b/trunk/drivers/char/drm/gamma_dma.c
@@ -0,0 +1,946 @@
+/* gamma_dma.c -- DMA support for GMX 2000 -*- linux-c -*-
+ * Created: Fri Mar 19 14:30:16 1999 by faith@precisioninsight.com
+ *
+ * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
+ * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Rickard E. (Rik) Faith <faith@valinux.com>
+ *
+ */
+
+#include "gamma.h"
+#include "drmP.h"
+#include "drm.h"
+#include "gamma_drm.h"
+#include "gamma_drv.h"
+
+#include <linux/interrupt.h>	/* For task queue support */
+#include <linux/delay.h>
+
+static inline void gamma_dma_dispatch(drm_device_t *dev, unsigned long address,
+				      unsigned long length)
+{
+	drm_gamma_private_t *dev_priv =
+				(drm_gamma_private_t *)dev->dev_private;
+	mb();
+	while ( GAMMA_READ(GAMMA_INFIFOSPACE) < 2)
+		cpu_relax();
+
+	GAMMA_WRITE(GAMMA_DMAADDRESS, address);
+
+	while (GAMMA_READ(GAMMA_GCOMMANDSTATUS) != 4)
+		cpu_relax();
+
+	GAMMA_WRITE(GAMMA_DMACOUNT, length / 4);
+}
+
+void gamma_dma_quiescent_single(drm_device_t *dev)
+{
+	drm_gamma_private_t *dev_priv =
+				(drm_gamma_private_t *)dev->dev_private;
+	while (GAMMA_READ(GAMMA_DMACOUNT))
+		cpu_relax();
+
+	while (GAMMA_READ(GAMMA_INFIFOSPACE) < 2)
+		cpu_relax();
+
+	GAMMA_WRITE(GAMMA_FILTERMODE, 1 << 10);
+	GAMMA_WRITE(GAMMA_SYNC, 0);
+
+	do {
+		while (!GAMMA_READ(GAMMA_OUTFIFOWORDS))
+			cpu_relax();
+	} while (GAMMA_READ(GAMMA_OUTPUTFIFO) != GAMMA_SYNC_TAG);
+}
+
+void gamma_dma_quiescent_dual(drm_device_t *dev)
+{
+	drm_gamma_private_t *dev_priv =
+				(drm_gamma_private_t *)dev->dev_private;
+	while (GAMMA_READ(GAMMA_DMACOUNT))
+		cpu_relax();
+
+	while (GAMMA_READ(GAMMA_INFIFOSPACE) < 3)
+		cpu_relax();
+
+	GAMMA_WRITE(GAMMA_BROADCASTMASK, 3);
+	GAMMA_WRITE(GAMMA_FILTERMODE, 1 << 10);
+	GAMMA_WRITE(GAMMA_SYNC, 0);
+
+	/* Read from first MX */
+	do {
+		while (!GAMMA_READ(GAMMA_OUTFIFOWORDS))
+			cpu_relax();
+	} while (GAMMA_READ(GAMMA_OUTPUTFIFO) != GAMMA_SYNC_TAG);
+
+	/* Read from second MX */
+	do {
+		while (!GAMMA_READ(GAMMA_OUTFIFOWORDS + 0x10000))
+			cpu_relax();
+	} while (GAMMA_READ(GAMMA_OUTPUTFIFO + 0x10000) != GAMMA_SYNC_TAG);
+}
+
+void gamma_dma_ready(drm_device_t *dev)
+{
+	drm_gamma_private_t *dev_priv =
+				(drm_gamma_private_t *)dev->dev_private;
+	while (GAMMA_READ(GAMMA_DMACOUNT))
+		cpu_relax();
+}
+
+static inline int gamma_dma_is_ready(drm_device_t *dev)
+{
+	drm_gamma_private_t *dev_priv =
+				(drm_gamma_private_t *)dev->dev_private;
+	return (!GAMMA_READ(GAMMA_DMACOUNT));
+}
+
+irqreturn_t gamma_driver_irq_handler( DRM_IRQ_ARGS )
+{
+	drm_device_t	 *dev = (drm_device_t *)arg;
+	drm_device_dma_t *dma = dev->dma;
+	drm_gamma_private_t *dev_priv =
+				(drm_gamma_private_t *)dev->dev_private;
+
+	/* FIXME: should check whether we're actually interested in the interrupt? */
+	atomic_inc(&dev->counts[6]); /* _DRM_STAT_IRQ */
+
+	while (GAMMA_READ(GAMMA_INFIFOSPACE) < 3)
+		cpu_relax();
+
+	GAMMA_WRITE(GAMMA_GDELAYTIMER, 0xc350/2); /* 0x05S */
+	GAMMA_WRITE(GAMMA_GCOMMANDINTFLAGS, 8);
+	GAMMA_WRITE(GAMMA_GINTFLAGS, 0x2001);
+	if (gamma_dma_is_ready(dev)) {
+				/* Free previous buffer */
+		if (test_and_set_bit(0, &dev->dma_flag))
+			return IRQ_HANDLED;
+		if (dma->this_buffer) {
+			gamma_free_buffer(dev, dma->this_buffer);
+			dma->this_buffer = NULL;
+		}
+		clear_bit(0, &dev->dma_flag);
+
+		/* Dispatch new buffer */
+		schedule_work(&dev->work);
+	}
+	return IRQ_HANDLED;
+}
+
+/* Only called by gamma_dma_schedule. */
+static int gamma_do_dma(drm_device_t *dev, int locked)
+{
+	unsigned long	 address;
+	unsigned long	 length;
+	drm_buf_t	 *buf;
+	int		 retcode = 0;
+	drm_device_dma_t *dma = dev->dma;
+
+	if (test_and_set_bit(0, &dev->dma_flag)) return -EBUSY;
+
+
+	if (!dma->next_buffer) {
+		DRM_ERROR("No next_buffer\n");
+		clear_bit(0, &dev->dma_flag);
+		return -EINVAL;
+	}
+
+	buf	= dma->next_buffer;
+	/* WE NOW ARE ON LOGICAL PAGES!! - using page table setup in dma_init */
+	/* So we pass the buffer index value into the physical page offset */
+	address = buf->idx << 12;
+	length	= buf->used;
+
+	DRM_DEBUG("context %d, buffer %d (%ld bytes)\n",
+		  buf->context, buf->idx, length);
+
+	if (buf->list == DRM_LIST_RECLAIM) {
+		gamma_clear_next_buffer(dev);
+		gamma_free_buffer(dev, buf);
+		clear_bit(0, &dev->dma_flag);
+		return -EINVAL;
+	}
+
+	if (!length) {
+		DRM_ERROR("0 length buffer\n");
+		gamma_clear_next_buffer(dev);
+		gamma_free_buffer(dev, buf);
+		clear_bit(0, &dev->dma_flag);
+		return 0;
+	}
+
+	if (!gamma_dma_is_ready(dev)) {
+		clear_bit(0, &dev->dma_flag);
+		return -EBUSY;
+	}
+
+	if (buf->while_locked) {
+		if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+			DRM_ERROR("Dispatching buffer %d from pid %d"
+				  " \"while locked\", but no lock held\n",
+				  buf->idx, current->pid);
+		}
+	} else {
+		if (!locked && !gamma_lock_take(&dev->lock.hw_lock->lock,
+					      DRM_KERNEL_CONTEXT)) {
+			clear_bit(0, &dev->dma_flag);
+			return -EBUSY;
+		}
+	}
+
+	if (dev->last_context != buf->context
+	    && !(dev->queuelist[buf->context]->flags
+		 & _DRM_CONTEXT_PRESERVED)) {
+				/* PRE: dev->last_context != buf->context */
+		if (DRM(context_switch)(dev, dev->last_context,
+					buf->context)) {
+			DRM(clear_next_buffer)(dev);
+			DRM(free_buffer)(dev, buf);
+		}
+		retcode = -EBUSY;
+		goto cleanup;
+
+				/* POST: we will wait for the context
+				   switch and will dispatch on a later call
+				   when dev->last_context == buf->context.
+				   NOTE WE HOLD THE LOCK THROUGHOUT THIS
+				   TIME! */
+	}
+
+	gamma_clear_next_buffer(dev);
+	buf->pending	 = 1;
+	buf->waiting	 = 0;
+	buf->list	 = DRM_LIST_PEND;
+
+	/* WE NOW ARE ON LOGICAL PAGES!!! - overriding address */
+	address = buf->idx << 12;
+
+	gamma_dma_dispatch(dev, address, length);
+	gamma_free_buffer(dev, dma->this_buffer);
+	dma->this_buffer = buf;
+
+	atomic_inc(&dev->counts[7]); /* _DRM_STAT_DMA */
+	atomic_add(length, &dev->counts[8]); /* _DRM_STAT_PRIMARY */
+
+	if (!buf->while_locked && !dev->context_flag && !locked) {
+		if (gamma_lock_free(dev, &dev->lock.hw_lock->lock,
+				  DRM_KERNEL_CONTEXT)) {
+			DRM_ERROR("\n");
+		}
+	}
+cleanup:
+
+	clear_bit(0, &dev->dma_flag);
+
+
+	return retcode;
+}
+
+static void gamma_dma_timer_bh(unsigned long dev)
+{
+	gamma_dma_schedule((drm_device_t *)dev, 0);
+}
+
+void gamma_irq_immediate_bh(void *dev)
+{
+	gamma_dma_schedule(dev, 0);
+}
+
+int gamma_dma_schedule(drm_device_t *dev, int locked)
+{
+	int		 next;
+	drm_queue_t	 *q;
+	drm_buf_t	 *buf;
+	int		 retcode   = 0;
+	int		 processed = 0;
+	int		 missed;
+	int		 expire	   = 20;
+	drm_device_dma_t *dma	   = dev->dma;
+
+	if (test_and_set_bit(0, &dev->interrupt_flag)) {
+				/* Not reentrant */
+		atomic_inc(&dev->counts[10]); /* _DRM_STAT_MISSED */
+		return -EBUSY;
+	}
+	missed = atomic_read(&dev->counts[10]);
+
+
+again:
+	if (dev->context_flag) {
+		clear_bit(0, &dev->interrupt_flag);
+		return -EBUSY;
+	}
+	if (dma->next_buffer) {
+				/* Unsent buffer that was previously
+				   selected, but that couldn't be sent
+				   because the lock could not be obtained
+				   or the DMA engine wasn't ready.  Try
+				   again. */
+		if (!(retcode = gamma_do_dma(dev, locked))) ++processed;
+	} else {
+		do {
+			next = gamma_select_queue(dev, gamma_dma_timer_bh);
+			if (next >= 0) {
+				q   = dev->queuelist[next];
+				buf = gamma_waitlist_get(&q->waitlist);
+				dma->next_buffer = buf;
+				dma->next_queue	 = q;
+				if (buf && buf->list == DRM_LIST_RECLAIM) {
+					gamma_clear_next_buffer(dev);
+					gamma_free_buffer(dev, buf);
+				}
+			}
+		} while (next >= 0 && !dma->next_buffer);
+		if (dma->next_buffer) {
+			if (!(retcode = gamma_do_dma(dev, locked))) {
+				++processed;
+			}
+		}
+	}
+
+	if (--expire) {
+		if (missed != atomic_read(&dev->counts[10])) {
+			if (gamma_dma_is_ready(dev)) goto again;
+		}
+		if (processed && gamma_dma_is_ready(dev)) {
+			processed = 0;
+			goto again;
+		}
+	}
+
+	clear_bit(0, &dev->interrupt_flag);
+
+	return retcode;
+}
+
+static int gamma_dma_priority(struct file *filp, 
+			      drm_device_t *dev, drm_dma_t *d)
+{
+	unsigned long	  address;
+	unsigned long	  length;
+	int		  must_free = 0;
+	int		  retcode   = 0;
+	int		  i;
+	int		  idx;
+	drm_buf_t	  *buf;
+	drm_buf_t	  *last_buf = NULL;
+	drm_device_dma_t  *dma	    = dev->dma;
+	int		  *send_indices = NULL;
+	int		  *send_sizes = NULL;
+
+	DECLARE_WAITQUEUE(entry, current);
+
+				/* Turn off interrupt handling */
+	while (test_and_set_bit(0, &dev->interrupt_flag)) {
+		schedule();
+		if (signal_pending(current)) return -EINTR;
+	}
+	if (!(d->flags & _DRM_DMA_WHILE_LOCKED)) {
+		while (!gamma_lock_take(&dev->lock.hw_lock->lock,
+				      DRM_KERNEL_CONTEXT)) {
+			schedule();
+			if (signal_pending(current)) {
+				clear_bit(0, &dev->interrupt_flag);
+				return -EINTR;
+			}
+		}
+		++must_free;
+	}
+
+	send_indices = DRM(alloc)(d->send_count * sizeof(*send_indices),
+				  DRM_MEM_DRIVER);
+	if (send_indices == NULL)
+		return -ENOMEM;
+	if (copy_from_user(send_indices, d->send_indices, 
+			   d->send_count * sizeof(*send_indices))) {
+		retcode = -EFAULT;
+                goto cleanup;
+	}
+	
+	send_sizes = DRM(alloc)(d->send_count * sizeof(*send_sizes),
+				DRM_MEM_DRIVER);
+	if (send_sizes == NULL)
+		return -ENOMEM;
+	if (copy_from_user(send_sizes, d->send_sizes, 
+			   d->send_count * sizeof(*send_sizes))) {
+		retcode = -EFAULT;
+                goto cleanup;
+	}
+
+	for (i = 0; i < d->send_count; i++) {
+		idx = send_indices[i];
+		if (idx < 0 || idx >= dma->buf_count) {
+			DRM_ERROR("Index %d (of %d max)\n",
+				  send_indices[i], dma->buf_count - 1);
+			continue;
+		}
+		buf = dma->buflist[ idx ];
+		if (buf->filp != filp) {
+			DRM_ERROR("Process %d using buffer not owned\n",
+				  current->pid);
+			retcode = -EINVAL;
+			goto cleanup;
+		}
+		if (buf->list != DRM_LIST_NONE) {
+			DRM_ERROR("Process %d using buffer on list %d\n",
+				  current->pid, buf->list);
+			retcode = -EINVAL;
+			goto cleanup;
+		}
+				/* This isn't a race condition on
+				   buf->list, since our concern is the
+				   buffer reclaim during the time the
+				   process closes the /dev/drm? handle, so
+				   it can't also be doing DMA. */
+		buf->list	  = DRM_LIST_PRIO;
+		buf->used	  = send_sizes[i];
+		buf->context	  = d->context;
+		buf->while_locked = d->flags & _DRM_DMA_WHILE_LOCKED;
+		address		  = (unsigned long)buf->address;
+		length		  = buf->used;
+		if (!length) {
+			DRM_ERROR("0 length buffer\n");
+		}
+		if (buf->pending) {
+			DRM_ERROR("Sending pending buffer:"
+				  " buffer %d, offset %d\n",
+				  send_indices[i], i);
+			retcode = -EINVAL;
+			goto cleanup;
+		}
+		if (buf->waiting) {
+			DRM_ERROR("Sending waiting buffer:"
+				  " buffer %d, offset %d\n",
+				  send_indices[i], i);
+			retcode = -EINVAL;
+			goto cleanup;
+		}
+		buf->pending = 1;
+
+		if (dev->last_context != buf->context
+		    && !(dev->queuelist[buf->context]->flags
+			 & _DRM_CONTEXT_PRESERVED)) {
+			add_wait_queue(&dev->context_wait, &entry);
+			current->state = TASK_INTERRUPTIBLE;
+				/* PRE: dev->last_context != buf->context */
+			DRM(context_switch)(dev, dev->last_context,
+					    buf->context);
+				/* POST: we will wait for the context
+				   switch and will dispatch on a later call
+				   when dev->last_context == buf->context.
+				   NOTE WE HOLD THE LOCK THROUGHOUT THIS
+				   TIME! */
+			schedule();
+			current->state = TASK_RUNNING;
+			remove_wait_queue(&dev->context_wait, &entry);
+			if (signal_pending(current)) {
+				retcode = -EINTR;
+				goto cleanup;
+			}
+			if (dev->last_context != buf->context) {
+				DRM_ERROR("Context mismatch: %d %d\n",
+					  dev->last_context,
+					  buf->context);
+			}
+		}
+
+		gamma_dma_dispatch(dev, address, length);
+		atomic_inc(&dev->counts[9]); /* _DRM_STAT_SPECIAL */
+		atomic_add(length, &dev->counts[8]); /* _DRM_STAT_PRIMARY */
+
+		if (last_buf) {
+			gamma_free_buffer(dev, last_buf);
+		}
+		last_buf = buf;
+	}
+
+
+cleanup:
+	if (last_buf) {
+		gamma_dma_ready(dev);
+		gamma_free_buffer(dev, last_buf);
+	}
+	if (send_indices)
+		DRM(free)(send_indices, d->send_count * sizeof(*send_indices), 
+			  DRM_MEM_DRIVER);
+	if (send_sizes)
+		DRM(free)(send_sizes, d->send_count * sizeof(*send_sizes), 
+			  DRM_MEM_DRIVER);
+
+	if (must_free && !dev->context_flag) {
+		if (gamma_lock_free(dev, &dev->lock.hw_lock->lock,
+				  DRM_KERNEL_CONTEXT)) {
+			DRM_ERROR("\n");
+		}
+	}
+	clear_bit(0, &dev->interrupt_flag);
+	return retcode;
+}
+
+static int gamma_dma_send_buffers(struct file *filp,
+				  drm_device_t *dev, drm_dma_t *d)
+{
+	DECLARE_WAITQUEUE(entry, current);
+	drm_buf_t	  *last_buf = NULL;
+	int		  retcode   = 0;
+	drm_device_dma_t  *dma	    = dev->dma;
+	int               send_index;
+
+	if (get_user(send_index, &d->send_indices[d->send_count-1]))
+		return -EFAULT;
+
+	if (d->flags & _DRM_DMA_BLOCK) {
+		last_buf = dma->buflist[send_index];
+		add_wait_queue(&last_buf->dma_wait, &entry);
+	}
+
+	if ((retcode = gamma_dma_enqueue(filp, d))) {
+		if (d->flags & _DRM_DMA_BLOCK)
+			remove_wait_queue(&last_buf->dma_wait, &entry);
+		return retcode;
+	}
+
+	gamma_dma_schedule(dev, 0);
+
+	if (d->flags & _DRM_DMA_BLOCK) {
+		DRM_DEBUG("%d waiting\n", current->pid);
+		for (;;) {
+			current->state = TASK_INTERRUPTIBLE;
+			if (!last_buf->waiting && !last_buf->pending)
+				break; /* finished */
+			schedule();
+			if (signal_pending(current)) {
+				retcode = -EINTR; /* Can't restart */
+				break;
+			}
+		}
+		current->state = TASK_RUNNING;
+		DRM_DEBUG("%d running\n", current->pid);
+		remove_wait_queue(&last_buf->dma_wait, &entry);
+		if (!retcode
+		    || (last_buf->list==DRM_LIST_PEND && !last_buf->pending)) {
+			if (!waitqueue_active(&last_buf->dma_wait)) {
+				gamma_free_buffer(dev, last_buf);
+			}
+		}
+		if (retcode) {
+			DRM_ERROR("ctx%d w%d p%d c%ld i%d l%d pid:%d\n",
+				  d->context,
+				  last_buf->waiting,
+				  last_buf->pending,
+				  (long)DRM_WAITCOUNT(dev, d->context),
+				  last_buf->idx,
+				  last_buf->list,
+				  current->pid);
+		}
+	}
+	return retcode;
+}
+
+int gamma_dma(struct inode *inode, struct file *filp, unsigned int cmd,
+	      unsigned long arg)
+{
+	drm_file_t	  *priv	    = filp->private_data;
+	drm_device_t	  *dev	    = priv->dev;
+	drm_device_dma_t  *dma	    = dev->dma;
+	int		  retcode   = 0;
+	drm_dma_t	  __user *argp = (void __user *)arg;
+	drm_dma_t	  d;
+
+	if (copy_from_user(&d, argp, sizeof(d)))
+		return -EFAULT;
+
+	if (d.send_count < 0 || d.send_count > dma->buf_count) {
+		DRM_ERROR("Process %d trying to send %d buffers (of %d max)\n",
+			  current->pid, d.send_count, dma->buf_count);
+		return -EINVAL;
+	}
+
+	if (d.request_count < 0 || d.request_count > dma->buf_count) {
+		DRM_ERROR("Process %d trying to get %d buffers (of %d max)\n",
+			  current->pid, d.request_count, dma->buf_count);
+		return -EINVAL;
+	}
+
+	if (d.send_count) {
+		if (d.flags & _DRM_DMA_PRIORITY)
+			retcode = gamma_dma_priority(filp, dev, &d);
+		else
+			retcode = gamma_dma_send_buffers(filp, dev, &d);
+	}
+
+	d.granted_count = 0;
+
+	if (!retcode && d.request_count) {
+		retcode = gamma_dma_get_buffers(filp, &d);
+	}
+
+	DRM_DEBUG("%d returning, granted = %d\n",
+		  current->pid, d.granted_count);
+	if (copy_to_user(argp, &d, sizeof(d)))
+		return -EFAULT;
+
+	return retcode;
+}
+
+/* =============================================================
+ * DMA initialization, cleanup
+ */
+
+static int gamma_do_init_dma( drm_device_t *dev, drm_gamma_init_t *init )
+{
+	drm_gamma_private_t *dev_priv;
+	drm_device_dma_t    *dma = dev->dma;
+	drm_buf_t	    *buf;
+	int i;
+	struct list_head    *list;
+	unsigned long	    *pgt;
+
+	DRM_DEBUG( "%s\n", __FUNCTION__ );
+
+	dev_priv = DRM(alloc)( sizeof(drm_gamma_private_t),
+							DRM_MEM_DRIVER );
+	if ( !dev_priv )
+		return -ENOMEM;
+
+	dev->dev_private = (void *)dev_priv;
+
+	memset( dev_priv, 0, sizeof(drm_gamma_private_t) );
+
+	dev_priv->num_rast = init->num_rast;
+
+	list_for_each(list, &dev->maplist->head) {
+		drm_map_list_t *r_list = list_entry(list, drm_map_list_t, head);
+		if( r_list->map &&
+		    r_list->map->type == _DRM_SHM &&
+		    r_list->map->flags & _DRM_CONTAINS_LOCK ) {
+			dev_priv->sarea = r_list->map;
+ 			break;
+ 		}
+ 	}
+	
+	dev_priv->mmio0 = drm_core_findmap(dev, init->mmio0);
+	dev_priv->mmio1 = drm_core_findmap(dev, init->mmio1);
+	dev_priv->mmio2 = drm_core_findmap(dev, init->mmio2);
+	dev_priv->mmio3 = drm_core_findmap(dev, init->mmio3);
+	
+	dev_priv->sarea_priv = (drm_gamma_sarea_t *)
+		((u8 *)dev_priv->sarea->handle +
+		 init->sarea_priv_offset);
+
+	if (init->pcimode) {
+		buf = dma->buflist[GLINT_DRI_BUF_COUNT];
+		pgt = buf->address;
+
+ 		for (i = 0; i < GLINT_DRI_BUF_COUNT; i++) {
+			buf = dma->buflist[i];
+			*pgt = virt_to_phys((void*)buf->address) | 0x07;
+			pgt++;
+		}
+
+		buf = dma->buflist[GLINT_DRI_BUF_COUNT];
+	} else {
+		dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
+		drm_core_ioremap( dev->agp_buffer_map, dev);
+
+		buf = dma->buflist[GLINT_DRI_BUF_COUNT];
+		pgt = buf->address;
+
+ 		for (i = 0; i < GLINT_DRI_BUF_COUNT; i++) {
+			buf = dma->buflist[i];
+			*pgt = (unsigned long)buf->address + 0x07;
+			pgt++;
+		}
+
+		buf = dma->buflist[GLINT_DRI_BUF_COUNT];
+
+		while (GAMMA_READ(GAMMA_INFIFOSPACE) < 1);
+		GAMMA_WRITE( GAMMA_GDMACONTROL, 0xe);
+	}
+	while (GAMMA_READ(GAMMA_INFIFOSPACE) < 2);
+	GAMMA_WRITE( GAMMA_PAGETABLEADDR, virt_to_phys((void*)buf->address) );
+	GAMMA_WRITE( GAMMA_PAGETABLELENGTH, 2 );
+
+	return 0;
+}
+
+int gamma_do_cleanup_dma( drm_device_t *dev )
+{
+	DRM_DEBUG( "%s\n", __FUNCTION__ );
+
+	/* Make sure interrupts are disabled here because the uninstall ioctl
+	 * may not have been called from userspace and after dev_private
+	 * is freed, it's too late.
+	 */
+	if (drm_core_check_feature(dev, DRIVER_HAVE_IRQ))
+		if ( dev->irq_enabled ) 
+			DRM(irq_uninstall)(dev);
+
+	if ( dev->dev_private ) {
+
+		if ( dev->agp_buffer_map != NULL )
+			drm_core_ioremapfree( dev->agp_buffer_map, dev );
+
+		DRM(free)( dev->dev_private, sizeof(drm_gamma_private_t),
+			   DRM_MEM_DRIVER );
+		dev->dev_private = NULL;
+	}
+
+	return 0;
+}
+
+int gamma_dma_init( struct inode *inode, struct file *filp,
+		  unsigned int cmd, unsigned long arg )
+{
+	drm_file_t *priv = filp->private_data;
+	drm_device_t *dev = priv->dev;
+	drm_gamma_init_t init;
+
+	LOCK_TEST_WITH_RETURN( dev, filp );
+
+	if ( copy_from_user( &init, (drm_gamma_init_t __user *)arg, sizeof(init) ) )
+		return -EFAULT;
+
+	switch ( init.func ) {
+	case GAMMA_INIT_DMA:
+		return gamma_do_init_dma( dev, &init );
+	case GAMMA_CLEANUP_DMA:
+		return gamma_do_cleanup_dma( dev );
+	}
+
+	return -EINVAL;
+}
+
+static int gamma_do_copy_dma( drm_device_t *dev, drm_gamma_copy_t *copy )
+{
+	drm_device_dma_t    *dma = dev->dma;
+	unsigned int        *screenbuf;
+
+	DRM_DEBUG( "%s\n", __FUNCTION__ );
+
+	/* We've DRM_RESTRICTED this DMA buffer */
+
+	screenbuf = dma->buflist[ GLINT_DRI_BUF_COUNT + 1 ]->address;
+
+#if 0
+	*buffer++ = 0x180;	/* Tag (FilterMode) */
+	*buffer++ = 0x200;	/* Allow FBColor through */
+	*buffer++ = 0x53B;	/* Tag */
+	*buffer++ = copy->Pitch;
+	*buffer++ = 0x53A;	/* Tag */
+	*buffer++ = copy->SrcAddress;
+	*buffer++ = 0x539;	/* Tag */
+	*buffer++ = copy->WidthHeight; /* Initiates transfer */
+	*buffer++ = 0x53C;	/* Tag - DMAOutputAddress */
+	*buffer++ = virt_to_phys((void*)screenbuf);
+	*buffer++ = 0x53D;	/* Tag - DMAOutputCount */
+	*buffer++ = copy->Count; /* Reads HostOutFifo BLOCKS until ..*/
+
+	/* Data now sitting in dma->buflist[ GLINT_DRI_BUF_COUNT + 1 ] */
+	/* Now put it back to the screen */
+
+	*buffer++ = 0x180;	/* Tag (FilterMode) */
+	*buffer++ = 0x400;	/* Allow Sync through */
+	*buffer++ = 0x538;	/* Tag - DMARectangleReadTarget */
+	*buffer++ = 0x155;	/* FBSourceData | count */
+	*buffer++ = 0x537;	/* Tag */
+	*buffer++ = copy->Pitch;
+	*buffer++ = 0x536;	/* Tag */
+	*buffer++ = copy->DstAddress;
+	*buffer++ = 0x535;	/* Tag */
+	*buffer++ = copy->WidthHeight; /* Initiates transfer */
+	*buffer++ = 0x530;	/* Tag - DMAAddr */
+	*buffer++ = virt_to_phys((void*)screenbuf);
+	*buffer++ = 0x531;
+	*buffer++ = copy->Count; /* initiates DMA transfer of color data */
+#endif
+
+	/* need to dispatch it now */
+
+	return 0;
+}
+
+int gamma_dma_copy( struct inode *inode, struct file *filp,
+		  unsigned int cmd, unsigned long arg )
+{
+	drm_file_t *priv = filp->private_data;
+	drm_device_t *dev = priv->dev;
+	drm_gamma_copy_t copy;
+
+	if ( copy_from_user( &copy, (drm_gamma_copy_t __user *)arg, sizeof(copy) ) )
+		return -EFAULT;
+
+	return gamma_do_copy_dma( dev, &copy );
+}
+
+/* =============================================================
+ * Per Context SAREA Support
+ */
+
+int gamma_getsareactx(struct inode *inode, struct file *filp,
+		     unsigned int cmd, unsigned long arg)
+{
+	drm_file_t	*priv	= filp->private_data;
+	drm_device_t	*dev	= priv->dev;
+	drm_ctx_priv_map_t __user *argp = (void __user *)arg;
+	drm_ctx_priv_map_t request;
+	drm_map_t *map;
+
+	if (copy_from_user(&request, argp, sizeof(request)))
+		return -EFAULT;
+
+	down(&dev->struct_sem);
+	if ((int)request.ctx_id >= dev->max_context) {
+		up(&dev->struct_sem);
+		return -EINVAL;
+	}
+
+	map = dev->context_sareas[request.ctx_id];
+	up(&dev->struct_sem);
+
+	request.handle = map->handle;
+	if (copy_to_user(argp, &request, sizeof(request)))
+		return -EFAULT;
+	return 0;
+}
+
+int gamma_setsareactx(struct inode *inode, struct file *filp,
+		     unsigned int cmd, unsigned long arg)
+{
+	drm_file_t	*priv	= filp->private_data;
+	drm_device_t	*dev	= priv->dev;
+	drm_ctx_priv_map_t request;
+	drm_map_t *map = NULL;
+	drm_map_list_t *r_list;
+	struct list_head *list;
+
+	if (copy_from_user(&request,
+			   (drm_ctx_priv_map_t __user *)arg,
+			   sizeof(request)))
+		return -EFAULT;
+
+	down(&dev->struct_sem);
+	r_list = NULL;
+	list_for_each(list, &dev->maplist->head) {
+		r_list = list_entry(list, drm_map_list_t, head);
+		if(r_list->map &&
+		   r_list->map->handle == request.handle) break;
+	}
+	if (list == &(dev->maplist->head)) {
+		up(&dev->struct_sem);
+		return -EINVAL;
+	}
+	map = r_list->map;
+	up(&dev->struct_sem);
+
+	if (!map) return -EINVAL;
+
+	down(&dev->struct_sem);
+	if ((int)request.ctx_id >= dev->max_context) {
+		up(&dev->struct_sem);
+		return -EINVAL;
+	}
+	dev->context_sareas[request.ctx_id] = map;
+	up(&dev->struct_sem);
+	return 0;
+}
+
+void gamma_driver_irq_preinstall( drm_device_t *dev ) {
+	drm_gamma_private_t *dev_priv =
+				(drm_gamma_private_t *)dev->dev_private;
+
+	while(GAMMA_READ(GAMMA_INFIFOSPACE) < 2)
+		cpu_relax();
+
+	GAMMA_WRITE( GAMMA_GCOMMANDMODE,	0x00000004 );
+	GAMMA_WRITE( GAMMA_GDMACONTROL,		0x00000000 );
+}
+
+void gamma_driver_irq_postinstall( drm_device_t *dev ) {
+	drm_gamma_private_t *dev_priv =
+				(drm_gamma_private_t *)dev->dev_private;
+
+	while(GAMMA_READ(GAMMA_INFIFOSPACE) < 3)
+		cpu_relax();
+
+	GAMMA_WRITE( GAMMA_GINTENABLE,		0x00002001 );
+	GAMMA_WRITE( GAMMA_COMMANDINTENABLE,	0x00000008 );
+	GAMMA_WRITE( GAMMA_GDELAYTIMER,		0x00039090 );
+}
+
+void gamma_driver_irq_uninstall( drm_device_t *dev ) {
+	drm_gamma_private_t *dev_priv =
+				(drm_gamma_private_t *)dev->dev_private;
+	if (!dev_priv)
+		return;
+
+	while(GAMMA_READ(GAMMA_INFIFOSPACE) < 3)
+		cpu_relax();
+
+	GAMMA_WRITE( GAMMA_GDELAYTIMER,		0x00000000 );
+	GAMMA_WRITE( GAMMA_COMMANDINTENABLE,	0x00000000 );
+	GAMMA_WRITE( GAMMA_GINTENABLE,		0x00000000 );
+}
+
+extern drm_ioctl_desc_t DRM(ioctls)[];
+
+static int gamma_driver_preinit(drm_device_t *dev)
+{
+	/* reset the finish ioctl */
+	DRM(ioctls)[DRM_IOCTL_NR(DRM_IOCTL_FINISH)].func = DRM(finish);
+	return 0;
+}
+
+static void gamma_driver_pretakedown(drm_device_t *dev)
+{
+	gamma_do_cleanup_dma(dev);
+}
+
+static void gamma_driver_dma_ready(drm_device_t *dev)
+{
+	gamma_dma_ready(dev);
+}
+
+static int gamma_driver_dma_quiescent(drm_device_t *dev)
+{
+	drm_gamma_private_t *dev_priv =	(
+		drm_gamma_private_t *)dev->dev_private;
+	if (dev_priv->num_rast == 2)
+		gamma_dma_quiescent_dual(dev);
+	else gamma_dma_quiescent_single(dev);
+	return 0;
+}
+
+void gamma_driver_register_fns(drm_device_t *dev)
+{
+	dev->driver_features = DRIVER_USE_AGP | DRIVER_USE_MTRR | DRIVER_PCI_DMA | DRIVER_HAVE_DMA | DRIVER_HAVE_IRQ;
+	DRM(fops).read = gamma_fops_read;
+	DRM(fops).poll = gamma_fops_poll;
+	dev->driver.preinit = gamma_driver_preinit;
+	dev->driver.pretakedown = gamma_driver_pretakedown;
+	dev->driver.dma_ready = gamma_driver_dma_ready;
+	dev->driver.dma_quiescent = gamma_driver_dma_quiescent;
+	dev->driver.dma_flush_block_and_flush = gamma_flush_block_and_flush;
+	dev->driver.dma_flush_unblock = gamma_flush_unblock;
+}
diff --git a/trunk/drivers/char/drm/gamma_drm.h b/trunk/drivers/char/drm/gamma_drm.h
new file mode 100644
index 000000000000..20819ded0e15
--- /dev/null
+++ b/trunk/drivers/char/drm/gamma_drm.h
@@ -0,0 +1,90 @@
+#ifndef _GAMMA_DRM_H_
+#define _GAMMA_DRM_H_
+
+typedef struct _drm_gamma_tex_region {
+	unsigned char next, prev; /* indices to form a circular LRU  */
+	unsigned char in_use;	/* owned by a client, or free? */
+	int age;		/* tracked by clients to update local LRU's */
+} drm_gamma_tex_region_t;
+
+typedef struct {
+	unsigned int	GDeltaMode;
+	unsigned int	GDepthMode;
+	unsigned int	GGeometryMode;
+	unsigned int	GTransformMode;
+} drm_gamma_context_regs_t;
+
+typedef struct _drm_gamma_sarea {
+   	drm_gamma_context_regs_t context_state;
+
+	unsigned int dirty;
+
+
+	/* Maintain an LRU of contiguous regions of texture space.  If
+	 * you think you own a region of texture memory, and it has an
+	 * age different to the one you set, then you are mistaken and
+	 * it has been stolen by another client.  If global texAge
+	 * hasn't changed, there is no need to walk the list.
+	 *
+	 * These regions can be used as a proxy for the fine-grained
+	 * texture information of other clients - by maintaining them
+	 * in the same lru which is used to age their own textures,
+	 * clients have an approximate lru for the whole of global
+	 * texture space, and can make informed decisions as to which
+	 * areas to kick out.  There is no need to choose whether to
+	 * kick out your own texture or someone else's - simply eject
+	 * them all in LRU order.  
+	 */
+   
+#define GAMMA_NR_TEX_REGIONS 64
+	drm_gamma_tex_region_t texList[GAMMA_NR_TEX_REGIONS+1]; 
+				/* Last elt is sentinal */
+        int texAge;		/* last time texture was uploaded */
+        int last_enqueue;	/* last time a buffer was enqueued */
+	int last_dispatch;	/* age of the most recently dispatched buffer */
+	int last_quiescent;     /*  */
+	int ctxOwner;		/* last context to upload state */
+
+	int vertex_prim;
+} drm_gamma_sarea_t;
+
+/* WARNING: If you change any of these defines, make sure to change the
+ * defines in the Xserver file (xf86drmGamma.h)
+ */
+
+/* Gamma specific ioctls
+ * The device specific ioctl range is 0x40 to 0x79.
+ */
+#define DRM_IOCTL_GAMMA_INIT		DRM_IOW( 0x40, drm_gamma_init_t)
+#define DRM_IOCTL_GAMMA_COPY		DRM_IOW( 0x41, drm_gamma_copy_t)
+
+typedef struct drm_gamma_copy {
+	unsigned int	DMAOutputAddress;
+	unsigned int	DMAOutputCount;
+	unsigned int	DMAReadGLINTSource;
+	unsigned int	DMARectangleWriteAddress;
+	unsigned int	DMARectangleWriteLinePitch;
+	unsigned int	DMARectangleWrite;
+	unsigned int	DMARectangleReadAddress;
+	unsigned int	DMARectangleReadLinePitch;
+	unsigned int	DMARectangleRead;
+	unsigned int	DMARectangleReadTarget;
+} drm_gamma_copy_t;
+
+typedef struct drm_gamma_init {
+   	enum {
+	   	GAMMA_INIT_DMA    = 0x01,
+	       	GAMMA_CLEANUP_DMA = 0x02
+	} func;
+
+   	int sarea_priv_offset;
+	int pcimode;
+	unsigned int mmio0;
+	unsigned int mmio1;
+	unsigned int mmio2;
+	unsigned int mmio3;
+	unsigned int buffers_offset;
+	int num_rast;
+} drm_gamma_init_t;
+
+#endif /* _GAMMA_DRM_H_ */
diff --git a/trunk/drivers/char/drm/gamma_drv.c b/trunk/drivers/char/drm/gamma_drv.c
new file mode 100644
index 000000000000..e7e64b62792a
--- /dev/null
+++ b/trunk/drivers/char/drm/gamma_drv.c
@@ -0,0 +1,59 @@
+/* gamma.c -- 3dlabs GMX 2000 driver -*- linux-c -*-
+ * Created: Mon Jan  4 08:58:31 1999 by faith@precisioninsight.com
+ *
+ * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
+ * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Rickard E. (Rik) Faith <faith@valinux.com>
+ *    Gareth Hughes <gareth@valinux.com>
+ */
+
+#include <linux/config.h>
+#include "gamma.h"
+#include "drmP.h"
+#include "drm.h"
+#include "gamma_drm.h"
+#include "gamma_drv.h"
+
+#include "drm_auth.h"
+#include "drm_agpsupport.h"
+#include "drm_bufs.h"
+#include "gamma_context.h"	/* NOTE! */
+#include "drm_dma.h"
+#include "gamma_old_dma.h"	/* NOTE */
+#include "drm_drawable.h"
+#include "drm_drv.h"
+
+#include "drm_fops.h"
+#include "drm_init.h"
+#include "drm_ioctl.h"
+#include "drm_irq.h"
+#include "gamma_lists.h"        /* NOTE */
+#include "drm_lock.h"
+#include "gamma_lock.h"		/* NOTE */
+#include "drm_memory.h"
+#include "drm_proc.h"
+#include "drm_vm.h"
+#include "drm_stub.h"
+#include "drm_scatter.h"
diff --git a/trunk/drivers/char/drm/gamma_drv.h b/trunk/drivers/char/drm/gamma_drv.h
new file mode 100644
index 000000000000..146fcc6253cd
--- /dev/null
+++ b/trunk/drivers/char/drm/gamma_drv.h
@@ -0,0 +1,147 @@
+/* gamma_drv.h -- Private header for 3dlabs GMX 2000 driver -*- linux-c -*-
+ * Created: Mon Jan  4 10:05:05 1999 by faith@precisioninsight.com
+ *
+ * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
+ * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+ * All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Rickard E. (Rik) Faith <faith@valinux.com>
+ *
+ */
+
+#ifndef _GAMMA_DRV_H_
+#define _GAMMA_DRV_H_
+
+typedef struct drm_gamma_private {
+	drm_gamma_sarea_t *sarea_priv;
+	drm_map_t *sarea;
+	drm_map_t *mmio0;
+	drm_map_t *mmio1;
+	drm_map_t *mmio2;
+	drm_map_t *mmio3;
+	int num_rast;
+} drm_gamma_private_t;
+
+				/* gamma_dma.c */
+extern int gamma_dma_init( struct inode *inode, struct file *filp,
+			 unsigned int cmd, unsigned long arg );
+extern int gamma_dma_copy( struct inode *inode, struct file *filp,
+			 unsigned int cmd, unsigned long arg );
+
+extern int gamma_do_cleanup_dma( drm_device_t *dev );
+extern void gamma_dma_ready(drm_device_t *dev);
+extern void gamma_dma_quiescent_single(drm_device_t *dev);
+extern void gamma_dma_quiescent_dual(drm_device_t *dev);
+
+				/* gamma_dma.c */
+extern int  gamma_dma_schedule(drm_device_t *dev, int locked);
+extern int  gamma_dma(struct inode *inode, struct file *filp,
+		      unsigned int cmd, unsigned long arg);
+extern int  gamma_find_devices(void);
+extern int  gamma_found(void);
+
+/* Gamma-specific code pulled from drm_fops.h:
+ */
+extern int	     DRM(finish)(struct inode *inode, struct file *filp,
+				 unsigned int cmd, unsigned long arg);
+extern int	     DRM(flush_unblock)(drm_device_t *dev, int context,
+					drm_lock_flags_t flags);
+extern int	     DRM(flush_block_and_flush)(drm_device_t *dev, int context,
+						drm_lock_flags_t flags);
+
+/* Gamma-specific code pulled from drm_dma.h:
+ */
+extern void	     DRM(clear_next_buffer)(drm_device_t *dev);
+extern int	     DRM(select_queue)(drm_device_t *dev,
+				       void (*wrapper)(unsigned long));
+extern int	     DRM(dma_enqueue)(struct file *filp, drm_dma_t *dma);
+extern int	     DRM(dma_get_buffers)(struct file *filp, drm_dma_t *dma);
+
+
+/* Gamma-specific code pulled from drm_lists.h (now renamed gamma_lists.h):
+ */
+extern int	     DRM(waitlist_create)(drm_waitlist_t *bl, int count);
+extern int	     DRM(waitlist_destroy)(drm_waitlist_t *bl);
+extern int	     DRM(waitlist_put)(drm_waitlist_t *bl, drm_buf_t *buf);
+extern drm_buf_t     *DRM(waitlist_get)(drm_waitlist_t *bl);
+extern int	     DRM(freelist_create)(drm_freelist_t *bl, int count);
+extern int	     DRM(freelist_destroy)(drm_freelist_t *bl);
+extern int	     DRM(freelist_put)(drm_device_t *dev, drm_freelist_t *bl,
+				       drm_buf_t *buf);
+extern drm_buf_t     *DRM(freelist_get)(drm_freelist_t *bl, int block);
+
+/* externs for gamma changes to the ops */
+extern struct file_operations DRM(fops);
+extern unsigned int gamma_fops_poll(struct file *filp, struct poll_table_struct *wait);
+extern ssize_t gamma_fops_read(struct file *filp, char __user *buf, size_t count, loff_t *off);
+
+
+#define GLINT_DRI_BUF_COUNT 256
+
+#define GAMMA_OFF(reg)						   \
+	((reg < 0x1000)						   \
+	 ? reg							   \
+	 : ((reg < 0x10000)					   \
+	    ? (reg - 0x1000)					   \
+	    : ((reg < 0x11000)					   \
+	       ? (reg - 0x10000)				   \
+	       : (reg - 0x11000))))
+
+#define GAMMA_BASE(reg)	 ((unsigned long)				     \
+			  ((reg < 0x1000)    ? dev_priv->mmio0->handle :     \
+			   ((reg < 0x10000)  ? dev_priv->mmio1->handle :     \
+			    ((reg < 0x11000) ? dev_priv->mmio2->handle :     \
+					       dev_priv->mmio3->handle))))
+#define GAMMA_ADDR(reg)	 (GAMMA_BASE(reg) + GAMMA_OFF(reg))
+#define GAMMA_DEREF(reg) *(__volatile__ int *)GAMMA_ADDR(reg)
+#define GAMMA_READ(reg)	 GAMMA_DEREF(reg)
+#define GAMMA_WRITE(reg,val) do { GAMMA_DEREF(reg) = val; } while (0)
+
+#define GAMMA_BROADCASTMASK    0x9378
+#define GAMMA_COMMANDINTENABLE 0x0c48
+#define GAMMA_DMAADDRESS       0x0028
+#define GAMMA_DMACOUNT	       0x0030
+#define GAMMA_FILTERMODE       0x8c00
+#define GAMMA_GCOMMANDINTFLAGS 0x0c50
+#define GAMMA_GCOMMANDMODE     0x0c40
+#define		GAMMA_QUEUED_DMA_MODE		1<<1
+#define GAMMA_GCOMMANDSTATUS   0x0c60
+#define GAMMA_GDELAYTIMER      0x0c38
+#define GAMMA_GDMACONTROL      0x0060
+#define 	GAMMA_USE_AGP			1<<1
+#define GAMMA_GINTENABLE       0x0808
+#define GAMMA_GINTFLAGS	       0x0810
+#define GAMMA_INFIFOSPACE      0x0018
+#define GAMMA_OUTFIFOWORDS     0x0020
+#define GAMMA_OUTPUTFIFO       0x2000
+#define GAMMA_SYNC	       0x8c40
+#define GAMMA_SYNC_TAG	       0x0188
+#define GAMMA_PAGETABLEADDR    0x0C00
+#define GAMMA_PAGETABLELENGTH  0x0C08
+
+#define GAMMA_PASSTHROUGH	0x1FE
+#define GAMMA_DMAADDRTAG	0x530
+#define GAMMA_DMACOUNTTAG	0x531
+#define GAMMA_COMMANDINTTAG	0x532
+
+#endif
diff --git a/trunk/drivers/char/drm/gamma_lists.h b/trunk/drivers/char/drm/gamma_lists.h
new file mode 100644
index 000000000000..2d93f412b96b
--- /dev/null
+++ b/trunk/drivers/char/drm/gamma_lists.h
@@ -0,0 +1,215 @@
+/* drm_lists.h -- Buffer list handling routines -*- linux-c -*-
+ * Created: Mon Apr 19 20:54:22 1999 by faith@valinux.com
+ *
+ * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
+ * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Rickard E. (Rik) Faith <faith@valinux.com>
+ *    Gareth Hughes <gareth@valinux.com>
+ */
+
+#include "drmP.h"
+
+
+int DRM(waitlist_create)(drm_waitlist_t *bl, int count)
+{
+	if (bl->count) return -EINVAL;
+
+	bl->bufs       = DRM(alloc)((bl->count + 2) * sizeof(*bl->bufs),
+				    DRM_MEM_BUFLISTS);
+
+	if(!bl->bufs) return -ENOMEM;
+	memset(bl->bufs, 0, sizeof(*bl->bufs));
+	bl->count      = count;
+	bl->rp	       = bl->bufs;
+	bl->wp	       = bl->bufs;
+	bl->end	       = &bl->bufs[bl->count+1];
+	spin_lock_init(&bl->write_lock);
+	spin_lock_init(&bl->read_lock);
+	return 0;
+}
+
+int DRM(waitlist_destroy)(drm_waitlist_t *bl)
+{
+	if (bl->rp != bl->wp) return -EINVAL;
+	if (bl->bufs) DRM(free)(bl->bufs,
+				(bl->count + 2) * sizeof(*bl->bufs),
+				DRM_MEM_BUFLISTS);
+	bl->count = 0;
+	bl->bufs  = NULL;
+	bl->rp	  = NULL;
+	bl->wp	  = NULL;
+	bl->end	  = NULL;
+	return 0;
+}
+
+int DRM(waitlist_put)(drm_waitlist_t *bl, drm_buf_t *buf)
+{
+	int	      left;
+	unsigned long flags;
+
+	left = DRM_LEFTCOUNT(bl);
+	if (!left) {
+		DRM_ERROR("Overflow while adding buffer %d from filp %p\n",
+			  buf->idx, buf->filp);
+		return -EINVAL;
+	}
+	buf->list	 = DRM_LIST_WAIT;
+
+	spin_lock_irqsave(&bl->write_lock, flags);
+	*bl->wp = buf;
+	if (++bl->wp >= bl->end) bl->wp = bl->bufs;
+	spin_unlock_irqrestore(&bl->write_lock, flags);
+
+	return 0;
+}
+
+drm_buf_t *DRM(waitlist_get)(drm_waitlist_t *bl)
+{
+	drm_buf_t     *buf;
+	unsigned long flags;
+
+	spin_lock_irqsave(&bl->read_lock, flags);
+	buf = *bl->rp;
+	if (bl->rp == bl->wp) {
+		spin_unlock_irqrestore(&bl->read_lock, flags);
+		return NULL;
+	}
+	if (++bl->rp >= bl->end) bl->rp = bl->bufs;
+	spin_unlock_irqrestore(&bl->read_lock, flags);
+
+	return buf;
+}
+
+int DRM(freelist_create)(drm_freelist_t *bl, int count)
+{
+	atomic_set(&bl->count, 0);
+	bl->next      = NULL;
+	init_waitqueue_head(&bl->waiting);
+	bl->low_mark  = 0;
+	bl->high_mark = 0;
+	atomic_set(&bl->wfh,   0);
+	spin_lock_init(&bl->lock);
+	++bl->initialized;
+	return 0;
+}
+
+int DRM(freelist_destroy)(drm_freelist_t *bl)
+{
+	atomic_set(&bl->count, 0);
+	bl->next = NULL;
+	return 0;
+}
+
+int DRM(freelist_put)(drm_device_t *dev, drm_freelist_t *bl, drm_buf_t *buf)
+{
+	drm_device_dma_t *dma  = dev->dma;
+
+	if (!dma) {
+		DRM_ERROR("No DMA support\n");
+		return 1;
+	}
+
+	if (buf->waiting || buf->pending || buf->list == DRM_LIST_FREE) {
+		DRM_ERROR("Freed buffer %d: w%d, p%d, l%d\n",
+			  buf->idx, buf->waiting, buf->pending, buf->list);
+	}
+	if (!bl) return 1;
+	buf->list	= DRM_LIST_FREE;
+
+	spin_lock(&bl->lock);
+	buf->next	= bl->next;
+	bl->next	= buf;
+	spin_unlock(&bl->lock);
+
+	atomic_inc(&bl->count);
+	if (atomic_read(&bl->count) > dma->buf_count) {
+		DRM_ERROR("%d of %d buffers free after addition of %d\n",
+			  atomic_read(&bl->count), dma->buf_count, buf->idx);
+		return 1;
+	}
+				/* Check for high water mark */
+	if (atomic_read(&bl->wfh) && atomic_read(&bl->count)>=bl->high_mark) {
+		atomic_set(&bl->wfh, 0);
+		wake_up_interruptible(&bl->waiting);
+	}
+	return 0;
+}
+
+static drm_buf_t *DRM(freelist_try)(drm_freelist_t *bl)
+{
+	drm_buf_t	  *buf;
+
+	if (!bl) return NULL;
+
+				/* Get buffer */
+	spin_lock(&bl->lock);
+	if (!bl->next) {
+		spin_unlock(&bl->lock);
+		return NULL;
+	}
+	buf	  = bl->next;
+	bl->next  = bl->next->next;
+	spin_unlock(&bl->lock);
+
+	atomic_dec(&bl->count);
+	buf->next = NULL;
+	buf->list = DRM_LIST_NONE;
+	if (buf->waiting || buf->pending) {
+		DRM_ERROR("Free buffer %d: w%d, p%d, l%d\n",
+			  buf->idx, buf->waiting, buf->pending, buf->list);
+	}
+
+	return buf;
+}
+
+drm_buf_t *DRM(freelist_get)(drm_freelist_t *bl, int block)
+{
+	drm_buf_t	  *buf	= NULL;
+	DECLARE_WAITQUEUE(entry, current);
+
+	if (!bl || !bl->initialized) return NULL;
+
+				/* Check for low water mark */
+	if (atomic_read(&bl->count) <= bl->low_mark) /* Became low */
+		atomic_set(&bl->wfh, 1);
+	if (atomic_read(&bl->wfh)) {
+		if (block) {
+			add_wait_queue(&bl->waiting, &entry);
+			for (;;) {
+				current->state = TASK_INTERRUPTIBLE;
+				if (!atomic_read(&bl->wfh)
+				    && (buf = DRM(freelist_try)(bl))) break;
+				schedule();
+				if (signal_pending(current)) break;
+			}
+			current->state = TASK_RUNNING;
+			remove_wait_queue(&bl->waiting, &entry);
+		}
+		return buf;
+	}
+
+	return DRM(freelist_try)(bl);
+}
+
diff --git a/trunk/drivers/char/drm/gamma_lock.h b/trunk/drivers/char/drm/gamma_lock.h
new file mode 100644
index 000000000000..ddec67e4ed16
--- /dev/null
+++ b/trunk/drivers/char/drm/gamma_lock.h
@@ -0,0 +1,140 @@
+/* lock.c -- IOCTLs for locking -*- linux-c -*-
+ * Created: Tue Feb  2 08:37:54 1999 by faith@valinux.com
+ *
+ * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas.
+ * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Rickard E. (Rik) Faith <faith@valinux.com>
+ *    Gareth Hughes <gareth@valinux.com>
+ */
+
+
+/* Gamma-specific code extracted from drm_lock.h:
+ */
+static int DRM(flush_queue)(drm_device_t *dev, int context)
+{
+	DECLARE_WAITQUEUE(entry, current);
+	int		  ret	= 0;
+	drm_queue_t	  *q	= dev->queuelist[context];
+
+	DRM_DEBUG("\n");
+
+	atomic_inc(&q->use_count);
+	if (atomic_read(&q->use_count) > 1) {
+		atomic_inc(&q->block_write);
+		add_wait_queue(&q->flush_queue, &entry);
+		atomic_inc(&q->block_count);
+		for (;;) {
+			current->state = TASK_INTERRUPTIBLE;
+			if (!DRM_BUFCOUNT(&q->waitlist)) break;
+			schedule();
+			if (signal_pending(current)) {
+				ret = -EINTR; /* Can't restart */
+				break;
+			}
+		}
+		atomic_dec(&q->block_count);
+		current->state = TASK_RUNNING;
+		remove_wait_queue(&q->flush_queue, &entry);
+	}
+	atomic_dec(&q->use_count);
+
+				/* NOTE: block_write is still incremented!
+				   Use drm_flush_unlock_queue to decrement. */
+	return ret;
+}
+
+static int DRM(flush_unblock_queue)(drm_device_t *dev, int context)
+{
+	drm_queue_t	  *q	= dev->queuelist[context];
+
+	DRM_DEBUG("\n");
+
+	atomic_inc(&q->use_count);
+	if (atomic_read(&q->use_count) > 1) {
+		if (atomic_read(&q->block_write)) {
+			atomic_dec(&q->block_write);
+			wake_up_interruptible(&q->write_queue);
+		}
+	}
+	atomic_dec(&q->use_count);
+	return 0;
+}
+
+int DRM(flush_block_and_flush)(drm_device_t *dev, int context,
+			       drm_lock_flags_t flags)
+{
+	int ret = 0;
+	int i;
+
+	DRM_DEBUG("\n");
+
+	if (flags & _DRM_LOCK_FLUSH) {
+		ret = DRM(flush_queue)(dev, DRM_KERNEL_CONTEXT);
+		if (!ret) ret = DRM(flush_queue)(dev, context);
+	}
+	if (flags & _DRM_LOCK_FLUSH_ALL) {
+		for (i = 0; !ret && i < dev->queue_count; i++) {
+			ret = DRM(flush_queue)(dev, i);
+		}
+	}
+	return ret;
+}
+
+int DRM(flush_unblock)(drm_device_t *dev, int context, drm_lock_flags_t flags)
+{
+	int ret = 0;
+	int i;
+
+	DRM_DEBUG("\n");
+
+	if (flags & _DRM_LOCK_FLUSH) {
+		ret = DRM(flush_unblock_queue)(dev, DRM_KERNEL_CONTEXT);
+		if (!ret) ret = DRM(flush_unblock_queue)(dev, context);
+	}
+	if (flags & _DRM_LOCK_FLUSH_ALL) {
+		for (i = 0; !ret && i < dev->queue_count; i++) {
+			ret = DRM(flush_unblock_queue)(dev, i);
+		}
+	}
+
+	return ret;
+}
+
+int DRM(finish)(struct inode *inode, struct file *filp, unsigned int cmd,
+		unsigned long arg)
+{
+	drm_file_t	  *priv	  = filp->private_data;
+	drm_device_t	  *dev	  = priv->dev;
+	int		  ret	  = 0;
+	drm_lock_t	  lock;
+
+	DRM_DEBUG("\n");
+
+	if (copy_from_user(&lock, (drm_lock_t __user *)arg, sizeof(lock)))
+		return -EFAULT;
+	ret = DRM(flush_block_and_flush)(dev, lock.context, lock.flags);
+	DRM(flush_unblock)(dev, lock.context, lock.flags);
+	return ret;
+}
diff --git a/trunk/drivers/char/drm/gamma_old_dma.h b/trunk/drivers/char/drm/gamma_old_dma.h
new file mode 100644
index 000000000000..abdd454aab9f
--- /dev/null
+++ b/trunk/drivers/char/drm/gamma_old_dma.h
@@ -0,0 +1,313 @@
+/* drm_dma.c -- DMA IOCTL and function support -*- linux-c -*-
+ * Created: Fri Mar 19 14:30:16 1999 by faith@valinux.com
+ *
+ * Copyright 1999, 2000 Precision Insight, Inc., Cedar Park, Texas.
+ * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Rickard E. (Rik) Faith <faith@valinux.com>
+ *    Gareth Hughes <gareth@valinux.com>
+ */
+
+
+/* Gamma-specific code pulled from drm_dma.h:
+ */
+
+void DRM(clear_next_buffer)(drm_device_t *dev)
+{
+	drm_device_dma_t *dma = dev->dma;
+
+	dma->next_buffer = NULL;
+	if (dma->next_queue && !DRM_BUFCOUNT(&dma->next_queue->waitlist)) {
+		wake_up_interruptible(&dma->next_queue->flush_queue);
+	}
+	dma->next_queue	 = NULL;
+}
+
+int DRM(select_queue)(drm_device_t *dev, void (*wrapper)(unsigned long))
+{
+	int	   i;
+	int	   candidate = -1;
+	int	   j	     = jiffies;
+
+	if (!dev) {
+		DRM_ERROR("No device\n");
+		return -1;
+	}
+	if (!dev->queuelist || !dev->queuelist[DRM_KERNEL_CONTEXT]) {
+				/* This only happens between the time the
+				   interrupt is initialized and the time
+				   the queues are initialized. */
+		return -1;
+	}
+
+				/* Doing "while locked" DMA? */
+	if (DRM_WAITCOUNT(dev, DRM_KERNEL_CONTEXT)) {
+		return DRM_KERNEL_CONTEXT;
+	}
+
+				/* If there are buffers on the last_context
+				   queue, and we have not been executing
+				   this context very long, continue to
+				   execute this context. */
+	if (dev->last_switch <= j
+	    && dev->last_switch + DRM_TIME_SLICE > j
+	    && DRM_WAITCOUNT(dev, dev->last_context)) {
+		return dev->last_context;
+	}
+
+				/* Otherwise, find a candidate */
+	for (i = dev->last_checked + 1; i < dev->queue_count; i++) {
+		if (DRM_WAITCOUNT(dev, i)) {
+			candidate = dev->last_checked = i;
+			break;
+		}
+	}
+
+	if (candidate < 0) {
+		for (i = 0; i < dev->queue_count; i++) {
+			if (DRM_WAITCOUNT(dev, i)) {
+				candidate = dev->last_checked = i;
+				break;
+			}
+		}
+	}
+
+	if (wrapper
+	    && candidate >= 0
+	    && candidate != dev->last_context
+	    && dev->last_switch <= j
+	    && dev->last_switch + DRM_TIME_SLICE > j) {
+		if (dev->timer.expires != dev->last_switch + DRM_TIME_SLICE) {
+			del_timer(&dev->timer);
+			dev->timer.function = wrapper;
+			dev->timer.data	    = (unsigned long)dev;
+			dev->timer.expires  = dev->last_switch+DRM_TIME_SLICE;
+			add_timer(&dev->timer);
+		}
+		return -1;
+	}
+
+	return candidate;
+}
+
+
+int DRM(dma_enqueue)(struct file *filp, drm_dma_t *d)
+{
+	drm_file_t    *priv   = filp->private_data;
+	drm_device_t  *dev    = priv->dev;
+	int		  i;
+	drm_queue_t	  *q;
+	drm_buf_t	  *buf;
+	int		  idx;
+	int		  while_locked = 0;
+	drm_device_dma_t  *dma = dev->dma;
+	int		  *ind;
+	int		  err;
+	DECLARE_WAITQUEUE(entry, current);
+
+	DRM_DEBUG("%d\n", d->send_count);
+
+	if (d->flags & _DRM_DMA_WHILE_LOCKED) {
+		int context = dev->lock.hw_lock->lock;
+
+		if (!_DRM_LOCK_IS_HELD(context)) {
+			DRM_ERROR("No lock held during \"while locked\""
+				  " request\n");
+			return -EINVAL;
+		}
+		if (d->context != _DRM_LOCKING_CONTEXT(context)
+		    && _DRM_LOCKING_CONTEXT(context) != DRM_KERNEL_CONTEXT) {
+			DRM_ERROR("Lock held by %d while %d makes"
+				  " \"while locked\" request\n",
+				  _DRM_LOCKING_CONTEXT(context),
+				  d->context);
+			return -EINVAL;
+		}
+		q = dev->queuelist[DRM_KERNEL_CONTEXT];
+		while_locked = 1;
+	} else {
+		q = dev->queuelist[d->context];
+	}
+
+
+	atomic_inc(&q->use_count);
+	if (atomic_read(&q->block_write)) {
+		add_wait_queue(&q->write_queue, &entry);
+		atomic_inc(&q->block_count);
+		for (;;) {
+			current->state = TASK_INTERRUPTIBLE;
+			if (!atomic_read(&q->block_write)) break;
+			schedule();
+			if (signal_pending(current)) {
+				atomic_dec(&q->use_count);
+				remove_wait_queue(&q->write_queue, &entry);
+				return -EINTR;
+			}
+		}
+		atomic_dec(&q->block_count);
+		current->state = TASK_RUNNING;
+		remove_wait_queue(&q->write_queue, &entry);
+	}
+
+	ind = DRM(alloc)(d->send_count * sizeof(int), DRM_MEM_DRIVER);
+	if (!ind)
+		return -ENOMEM;
+
+	if (copy_from_user(ind, d->send_indices, d->send_count * sizeof(int))) {
+		err = -EFAULT;
+                goto out;
+	}
+
+	err = -EINVAL;
+	for (i = 0; i < d->send_count; i++) {
+		idx = ind[i];
+		if (idx < 0 || idx >= dma->buf_count) {
+			DRM_ERROR("Index %d (of %d max)\n",
+				  ind[i], dma->buf_count - 1);
+			goto out;
+		}
+		buf = dma->buflist[ idx ];
+		if (buf->filp != filp) {
+			DRM_ERROR("Process %d using buffer not owned\n",
+				  current->pid);
+			goto out;
+		}
+		if (buf->list != DRM_LIST_NONE) {
+			DRM_ERROR("Process %d using buffer %d on list %d\n",
+				  current->pid, buf->idx, buf->list);
+			goto out;
+		}
+		buf->used	  = ind[i];
+		buf->while_locked = while_locked;
+		buf->context	  = d->context;
+		if (!buf->used) {
+			DRM_ERROR("Queueing 0 length buffer\n");
+		}
+		if (buf->pending) {
+			DRM_ERROR("Queueing pending buffer:"
+				  " buffer %d, offset %d\n",
+				  ind[i], i);
+			goto out;
+		}
+		if (buf->waiting) {
+			DRM_ERROR("Queueing waiting buffer:"
+				  " buffer %d, offset %d\n",
+				  ind[i], i);
+			goto out;
+		}
+		buf->waiting = 1;
+		if (atomic_read(&q->use_count) == 1
+		    || atomic_read(&q->finalization)) {
+			DRM(free_buffer)(dev, buf);
+		} else {
+			DRM(waitlist_put)(&q->waitlist, buf);
+			atomic_inc(&q->total_queued);
+		}
+	}
+	atomic_dec(&q->use_count);
+
+	return 0;
+
+out:
+	DRM(free)(ind, d->send_count * sizeof(int), DRM_MEM_DRIVER);
+	atomic_dec(&q->use_count);
+	return err;
+}
+
+static int DRM(dma_get_buffers_of_order)(struct file *filp, drm_dma_t *d,
+					 int order)
+{
+	drm_file_t    *priv   = filp->private_data;
+	drm_device_t  *dev    = priv->dev;
+	int		  i;
+	drm_buf_t	  *buf;
+	drm_device_dma_t  *dma = dev->dma;
+
+	for (i = d->granted_count; i < d->request_count; i++) {
+		buf = DRM(freelist_get)(&dma->bufs[order].freelist,
+					d->flags & _DRM_DMA_WAIT);
+		if (!buf) break;
+		if (buf->pending || buf->waiting) {
+			DRM_ERROR("Free buffer %d in use: filp %p (w%d, p%d)\n",
+				  buf->idx,
+				  buf->filp,
+				  buf->waiting,
+				  buf->pending);
+		}
+		buf->filp     = filp;
+		if (copy_to_user(&d->request_indices[i],
+				 &buf->idx,
+				 sizeof(buf->idx)))
+			return -EFAULT;
+
+		if (copy_to_user(&d->request_sizes[i],
+				 &buf->total,
+				 sizeof(buf->total)))
+			return -EFAULT;
+
+		++d->granted_count;
+	}
+	return 0;
+}
+
+
+int DRM(dma_get_buffers)(struct file *filp, drm_dma_t *dma)
+{
+	int		  order;
+	int		  retcode = 0;
+	int		  tmp_order;
+
+	order = DRM(order)(dma->request_size);
+
+	dma->granted_count = 0;
+	retcode		   = DRM(dma_get_buffers_of_order)(filp, dma, order);
+
+	if (dma->granted_count < dma->request_count
+	    && (dma->flags & _DRM_DMA_SMALLER_OK)) {
+		for (tmp_order = order - 1;
+		     !retcode
+			     && dma->granted_count < dma->request_count
+			     && tmp_order >= DRM_MIN_ORDER;
+		     --tmp_order) {
+
+			retcode = DRM(dma_get_buffers_of_order)(filp, dma,
+								tmp_order);
+		}
+	}
+
+	if (dma->granted_count < dma->request_count
+	    && (dma->flags & _DRM_DMA_LARGER_OK)) {
+		for (tmp_order = order + 1;
+		     !retcode
+			     && dma->granted_count < dma->request_count
+			     && tmp_order <= DRM_MAX_ORDER;
+		     ++tmp_order) {
+
+			retcode = DRM(dma_get_buffers_of_order)(filp, dma,
+								tmp_order);
+		}
+	}
+	return 0;
+}
+
diff --git a/trunk/drivers/char/drm/i810_dma.c b/trunk/drivers/char/drm/i810_dma.c
index 2f1659b96fd1..18e0b7622893 100644
--- a/trunk/drivers/char/drm/i810_dma.c
+++ b/trunk/drivers/char/drm/i810_dma.c
@@ -45,6 +45,11 @@
 #define I810_BUF_UNMAPPED 0
 #define I810_BUF_MAPPED   1
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,4,2)
+#define down_write down
+#define up_write up
+#endif
+
 static drm_buf_t *i810_freelist_get(drm_device_t *dev)
 {
    	drm_device_dma_t *dma = dev->dma;
@@ -346,7 +351,6 @@ static int i810_dma_initialize(drm_device_t *dev,
 	   	DRM_ERROR("can not find mmio map!\n");
 	   	return -EINVAL;
 	}
-	dev->agp_buffer_token = init->buffers_offset;
 	dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
 	if (!dev->agp_buffer_map) {
 		dev->dev_private = (void *)dev_priv;
@@ -1379,19 +1383,3 @@ drm_ioctl_desc_t i810_ioctls[] = {
 };
 
 int i810_max_ioctl = DRM_ARRAY_SIZE(i810_ioctls);
-
-/**
- * Determine if the device really is AGP or not.
- *
- * All Intel graphics chipsets are treated as AGP, even if they are really
- * PCI-e.
- *
- * \param dev   The device to be tested.
- *
- * \returns
- * A value of 1 is always retured to indictate every i810 is AGP.
- */
-int i810_driver_device_is_agp(drm_device_t * dev)
-{
-	return 1;
-}
diff --git a/trunk/drivers/char/drm/i810_drv.c b/trunk/drivers/char/drm/i810_drv.c
index 00609329d578..ff51b3259af9 100644
--- a/trunk/drivers/char/drm/i810_drv.c
+++ b/trunk/drivers/char/drm/i810_drv.c
@@ -84,7 +84,6 @@ static struct drm_driver driver = {
 	.dev_priv_size = sizeof(drm_i810_buf_priv_t),
 	.pretakedown = i810_driver_pretakedown,
 	.prerelease = i810_driver_prerelease,
-	.device_is_agp = i810_driver_device_is_agp,
 	.release = i810_driver_release,
 	.dma_quiescent = i810_driver_dma_quiescent,
 	.reclaim_buffers = i810_reclaim_buffers,
diff --git a/trunk/drivers/char/drm/i810_drv.h b/trunk/drivers/char/drm/i810_drv.h
index 62ee4f58c59a..1b40538d1725 100644
--- a/trunk/drivers/char/drm/i810_drv.h
+++ b/trunk/drivers/char/drm/i810_drv.h
@@ -120,7 +120,6 @@ extern int i810_driver_dma_quiescent(drm_device_t *dev);
 extern void i810_driver_release(drm_device_t *dev, struct file *filp);
 extern void i810_driver_pretakedown(drm_device_t *dev);
 extern void i810_driver_prerelease(drm_device_t *dev, DRMFILE filp);
-extern int i810_driver_device_is_agp(drm_device_t * dev);
 
 #define I810_BASE(reg)		((unsigned long) \
 				dev_priv->mmio_map->handle)
diff --git a/trunk/drivers/char/drm/i830_dma.c b/trunk/drivers/char/drm/i830_dma.c
index 6f89d5796ef3..dc7733035864 100644
--- a/trunk/drivers/char/drm/i830_dma.c
+++ b/trunk/drivers/char/drm/i830_dma.c
@@ -47,6 +47,11 @@
 #define I830_BUF_UNMAPPED 0
 #define I830_BUF_MAPPED   1
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,4,2)
+#define down_write down
+#define up_write up
+#endif
+
 static drm_buf_t *i830_freelist_get(drm_device_t *dev)
 {
    	drm_device_dma_t *dma = dev->dma;
@@ -353,7 +358,6 @@ static int i830_dma_initialize(drm_device_t *dev,
 		DRM_ERROR("can not find mmio map!\n");
 		return -EINVAL;
 	}
-	dev->agp_buffer_token = init->buffers_offset;
 	dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
 	if(!dev->agp_buffer_map) {
 		dev->dev_private = (void *)dev_priv;
@@ -1582,19 +1586,3 @@ drm_ioctl_desc_t i830_ioctls[] = {
 };
 
 int i830_max_ioctl = DRM_ARRAY_SIZE(i830_ioctls);
-
-/**
- * Determine if the device really is AGP or not.
- *
- * All Intel graphics chipsets are treated as AGP, even if they are really
- * PCI-e.
- *
- * \param dev   The device to be tested.
- *
- * \returns
- * A value of 1 is always retured to indictate every i8xx is AGP.
- */
-int i830_driver_device_is_agp(drm_device_t * dev)
-{
-	return 1;
-}
diff --git a/trunk/drivers/char/drm/i830_drv.c b/trunk/drivers/char/drm/i830_drv.c
index 0da9cd19919e..bc36be76b8b2 100644
--- a/trunk/drivers/char/drm/i830_drv.c
+++ b/trunk/drivers/char/drm/i830_drv.c
@@ -88,7 +88,6 @@ static struct drm_driver driver = {
 	.dev_priv_size = sizeof(drm_i830_buf_priv_t),
 	.pretakedown = i830_driver_pretakedown,
 	.prerelease = i830_driver_prerelease,
-	.device_is_agp = i830_driver_device_is_agp,
 	.release = i830_driver_release,
 	.dma_quiescent = i830_driver_dma_quiescent,
 	.reclaim_buffers = i830_reclaim_buffers,
diff --git a/trunk/drivers/char/drm/i830_drv.h b/trunk/drivers/char/drm/i830_drv.h
index 63f96a8b6a4a..df7746131dea 100644
--- a/trunk/drivers/char/drm/i830_drv.h
+++ b/trunk/drivers/char/drm/i830_drv.h
@@ -137,7 +137,6 @@ extern void i830_driver_pretakedown(drm_device_t *dev);
 extern void i830_driver_release(drm_device_t *dev, struct file *filp);
 extern int i830_driver_dma_quiescent(drm_device_t *dev);
 extern void i830_driver_prerelease(drm_device_t *dev, DRMFILE filp);
-extern int i830_driver_device_is_agp(drm_device_t * dev);
 
 #define I830_BASE(reg)		((unsigned long) \
 				dev_priv->mmio_map->handle)
diff --git a/trunk/drivers/char/drm/i915_dma.c b/trunk/drivers/char/drm/i915_dma.c
index 34f552f90c4a..acf9e52a9507 100644
--- a/trunk/drivers/char/drm/i915_dma.c
+++ b/trunk/drivers/char/drm/i915_dma.c
@@ -95,8 +95,9 @@ static int i915_dma_cleanup(drm_device_t * dev)
 			drm_core_ioremapfree( &dev_priv->ring.map, dev);
 		}
 
-		if (dev_priv->status_page_dmah) {
-			drm_pci_free(dev, dev_priv->status_page_dmah);
+		if (dev_priv->hw_status_page) {
+			drm_pci_free(dev, PAGE_SIZE, dev_priv->hw_status_page,
+				     dev_priv->dma_status_page);
 			/* Need to rewrite hardware status page */
 			I915_WRITE(0x02080, 0x1ffff000);
 		}
@@ -173,18 +174,16 @@ static int i915_initialize(drm_device_t * dev,
 	dev_priv->allow_batchbuffer = 1;
 
 	/* Program Hardware Status Page */
-	dev_priv->status_page_dmah = drm_pci_alloc(dev, PAGE_SIZE, PAGE_SIZE,
-						   0xffffffff);
+	dev_priv->hw_status_page = drm_pci_alloc(dev, PAGE_SIZE, PAGE_SIZE,
+						 0xffffffff, 
+						 &dev_priv->dma_status_page);
 
-	if (!dev_priv->status_page_dmah) {
+	if (!dev_priv->hw_status_page) {
 		dev->dev_private = (void *)dev_priv;
 		i915_dma_cleanup(dev);
 		DRM_ERROR("Can not allocate hardware status page\n");
 		return DRM_ERR(ENOMEM);
 	}
-	dev_priv->hw_status_page = dev_priv->status_page_dmah->vaddr;
-	dev_priv->dma_status_page = dev_priv->status_page_dmah->busaddr;
-
 	memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
 	DRM_DEBUG("hw status page @ %p\n", dev_priv->hw_status_page);
 
@@ -732,19 +731,3 @@ drm_ioctl_desc_t i915_ioctls[] = {
 };
 
 int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
-
-/**
- * Determine if the device really is AGP or not.
- *
- * All Intel graphics chipsets are treated as AGP, even if they are really
- * PCI-e.
- *
- * \param dev   The device to be tested.
- *
- * \returns
- * A value of 1 is always retured to indictate every i9x5 is AGP.
- */
-int i915_driver_device_is_agp(drm_device_t * dev)
-{
-	return 1;
-}
diff --git a/trunk/drivers/char/drm/i915_drv.c b/trunk/drivers/char/drm/i915_drv.c
index 106b9ec02213..1f59d3fc79bc 100644
--- a/trunk/drivers/char/drm/i915_drv.c
+++ b/trunk/drivers/char/drm/i915_drv.c
@@ -79,7 +79,6 @@ static struct drm_driver driver = {
 				DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED,
 	.pretakedown = i915_driver_pretakedown,
 	.prerelease = i915_driver_prerelease,
-	.device_is_agp = i915_driver_device_is_agp,
 	.irq_preinstall = i915_driver_irq_preinstall,
 	.irq_postinstall = i915_driver_irq_postinstall,
 	.irq_uninstall = i915_driver_irq_uninstall,
diff --git a/trunk/drivers/char/drm/i915_drv.h b/trunk/drivers/char/drm/i915_drv.h
index 70ed4e68eac8..9c37d2367dd5 100644
--- a/trunk/drivers/char/drm/i915_drv.h
+++ b/trunk/drivers/char/drm/i915_drv.h
@@ -79,10 +79,9 @@ typedef struct drm_i915_private {
 	drm_i915_sarea_t *sarea_priv;
 	drm_i915_ring_buffer_t ring;
 
-	drm_dma_handle_t *status_page_dmah;
 	void *hw_status_page;
-	dma_addr_t dma_status_page;
 	unsigned long counter;
+	dma_addr_t dma_status_page;
 
 	int back_offset;
 	int front_offset;
@@ -103,7 +102,6 @@ typedef struct drm_i915_private {
 extern void i915_kernel_lost_context(drm_device_t * dev);
 extern void i915_driver_pretakedown(drm_device_t *dev);
 extern void i915_driver_prerelease(drm_device_t *dev, DRMFILE filp);
-extern int i915_driver_device_is_agp(drm_device_t *dev);
 
 /* i915_irq.c */
 extern int i915_irq_emit(DRM_IOCTL_ARGS);
diff --git a/trunk/drivers/char/drm/mga_dma.c b/trunk/drivers/char/drm/mga_dma.c
index 567b425b784f..832eaf8a5068 100644
--- a/trunk/drivers/char/drm/mga_dma.c
+++ b/trunk/drivers/char/drm/mga_dma.c
@@ -23,21 +23,18 @@
  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  * DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * \file mga_dma.c
- * DMA support for MGA G200 / G400.
- * 
- * \author Rickard E. (Rik) Faith <faith@valinux.com>
- * \author Jeff Hartmann <jhartmann@valinux.com>
- * \author Keith Whitwell <keith@tungstengraphics.com>
- * \author Gareth Hughes <gareth@valinux.com>
+ *
+ * Authors:
+ *    Rickard E. (Rik) Faith <faith@valinux.com>
+ *    Jeff Hartmann <jhartmann@valinux.com>
+ *    Keith Whitwell <keith@tungstengraphics.com>
+ *
+ * Rewritten by:
+ *    Gareth Hughes <gareth@valinux.com>
  */
 
 #include "drmP.h"
 #include "drm.h"
-#include "drm_sarea.h"
 #include "mga_drm.h"
 #include "mga_drv.h"
 
@@ -151,7 +148,7 @@ void mga_do_dma_flush( drm_mga_private_t *dev_priv )
 	DRM_DEBUG( "  space = 0x%06x\n", primary->space );
 
 	mga_flush_write_combine();
-	MGA_WRITE(MGA_PRIMEND, tail | dev_priv->dma_access);
+	MGA_WRITE( MGA_PRIMEND, tail | MGA_PAGPXFER );
 
 	DRM_DEBUG( "done.\n" );
 }
@@ -193,7 +190,7 @@ void mga_do_dma_wrap_start( drm_mga_private_t *dev_priv )
 	DRM_DEBUG( "  space = 0x%06x\n", primary->space );
 
 	mga_flush_write_combine();
-	MGA_WRITE(MGA_PRIMEND, tail | dev_priv->dma_access);
+	MGA_WRITE( MGA_PRIMEND, tail | MGA_PAGPXFER );
 
 	set_bit( 0, &primary->wrapped );
 	DRM_DEBUG( "done.\n" );
@@ -399,383 +396,23 @@ int mga_freelist_put( drm_device_t *dev, drm_buf_t *buf )
  * DMA initialization, cleanup
  */
 
-
-int mga_driver_preinit(drm_device_t *dev, unsigned long flags)
-{
-	drm_mga_private_t * dev_priv;
-
-	dev_priv = drm_alloc(sizeof(drm_mga_private_t), DRM_MEM_DRIVER);
-	if (!dev_priv)
-		return DRM_ERR(ENOMEM);
-
-	dev->dev_private = (void *)dev_priv;
-	memset(dev_priv, 0, sizeof(drm_mga_private_t));
-
-	dev_priv->usec_timeout = MGA_DEFAULT_USEC_TIMEOUT;
-	dev_priv->chipset = flags;
-
-	return 0;
-}
-
-/**
- * Bootstrap the driver for AGP DMA.
- * 
- * \todo
- * Investigate whether there is any benifit to storing the WARP microcode in
- * AGP memory.  If not, the microcode may as well always be put in PCI
- * memory.
- *
- * \todo
- * This routine needs to set dma_bs->agp_mode to the mode actually configured
- * in the hardware.  Looking just at the Linux AGP driver code, I don't see
- * an easy way to determine this.
- *
- * \sa mga_do_dma_bootstrap, mga_do_pci_dma_bootstrap
- */
-static int mga_do_agp_dma_bootstrap(drm_device_t * dev,
-				    drm_mga_dma_bootstrap_t * dma_bs)
-{
-	drm_mga_private_t * const dev_priv = (drm_mga_private_t *) dev->dev_private;
-	const unsigned int warp_size = mga_warp_microcode_size(dev_priv);
-	int err;
-	unsigned  offset;
-	const unsigned secondary_size = dma_bs->secondary_bin_count
-		* dma_bs->secondary_bin_size;
-	const unsigned agp_size = (dma_bs->agp_size << 20);
-	drm_buf_desc_t req;
-	drm_agp_mode_t mode;
-	drm_agp_info_t info;
-
-	
-	/* Acquire AGP. */
-	err = drm_agp_acquire(dev);
-	if (err) {
-		DRM_ERROR("Unable to acquire AGP\n");
-		return err;
-	}
-
-	err = drm_agp_info(dev, &info);
-	if (err) {
-		DRM_ERROR("Unable to get AGP info\n");
-		return err;
-	}
-
-	mode.mode = (info.mode & ~0x07) | dma_bs->agp_mode;
-	err = drm_agp_enable(dev, mode);
-	if (err) {
-		DRM_ERROR("Unable to enable AGP (mode = 0x%lx)\n", mode.mode);
-		return err;
-	}
-
-
-	/* In addition to the usual AGP mode configuration, the G200 AGP cards
-	 * need to have the AGP mode "manually" set.
-	 */
-
-	if (dev_priv->chipset == MGA_CARD_TYPE_G200) {
-		if (mode.mode & 0x02) {
-			MGA_WRITE(MGA_AGP_PLL, MGA_AGP2XPLL_ENABLE);
-		}
-		else {
-			MGA_WRITE(MGA_AGP_PLL, MGA_AGP2XPLL_DISABLE);
-		}
-	}
-
-
-	/* Allocate and bind AGP memory. */
-	dev_priv->agp_pages = agp_size / PAGE_SIZE;
-	dev_priv->agp_mem = drm_alloc_agp( dev, dev_priv->agp_pages, 0 );
-	if (dev_priv->agp_mem == NULL) {
-		dev_priv->agp_pages = 0;
-		DRM_ERROR("Unable to allocate %uMB AGP memory\n",
-			  dma_bs->agp_size);
-		return DRM_ERR(ENOMEM);
-	}
-		
-	err = drm_bind_agp( dev_priv->agp_mem, 0 );
-	if (err) {
-		DRM_ERROR("Unable to bind AGP memory\n");
-		return err;
-	}
-
-	offset = 0;
-	err = drm_addmap( dev, offset, warp_size,
-			  _DRM_AGP, _DRM_READ_ONLY, & dev_priv->warp );
-	if (err) {
-		DRM_ERROR("Unable to map WARP microcode\n");
-		return err;
-	}
-
-	offset += warp_size;
-	err = drm_addmap( dev, offset, dma_bs->primary_size,
-			  _DRM_AGP, _DRM_READ_ONLY, & dev_priv->primary );
-	if (err) {
-		DRM_ERROR("Unable to map primary DMA region\n");
-		return err;
-	}
-
-	offset += dma_bs->primary_size;
-	err = drm_addmap( dev, offset, secondary_size,
-			  _DRM_AGP, 0, & dev->agp_buffer_map );
-	if (err) {
-		DRM_ERROR("Unable to map secondary DMA region\n");
-		return err;
-	}
-
-	(void) memset( &req, 0, sizeof(req) );
-	req.count = dma_bs->secondary_bin_count;
-	req.size = dma_bs->secondary_bin_size;
-	req.flags = _DRM_AGP_BUFFER;
-	req.agp_start = offset;
-
-	err = drm_addbufs_agp( dev, & req );
-	if (err) {
-		DRM_ERROR("Unable to add secondary DMA buffers\n");
-		return err;
-	}
-
-	offset += secondary_size;
-	err = drm_addmap( dev, offset, agp_size - offset,
-			  _DRM_AGP, 0, & dev_priv->agp_textures );
-	if (err) {
-		DRM_ERROR("Unable to map AGP texture region\n");
-		return err;
-	}
-
-	drm_core_ioremap(dev_priv->warp, dev);
-	drm_core_ioremap(dev_priv->primary, dev);
-	drm_core_ioremap(dev->agp_buffer_map, dev);
-
-	if (!dev_priv->warp->handle ||
-	    !dev_priv->primary->handle || !dev->agp_buffer_map->handle) {
-		DRM_ERROR("failed to ioremap agp regions! (%p, %p, %p)\n",
-			  dev_priv->warp->handle, dev_priv->primary->handle,
-			  dev->agp_buffer_map->handle);
-		return DRM_ERR(ENOMEM);
-	}
-
-	dev_priv->dma_access = MGA_PAGPXFER;
-	dev_priv->wagp_enable = MGA_WAGP_ENABLE;
-
-	DRM_INFO("Initialized card for AGP DMA.\n");
-	return 0;
-}
-
-/**
- * Bootstrap the driver for PCI DMA.
- * 
- * \todo
- * The algorithm for decreasing the size of the primary DMA buffer could be
- * better.  The size should be rounded up to the nearest page size, then
- * decrease the request size by a single page each pass through the loop.
- *
- * \todo
- * Determine whether the maximum address passed to drm_pci_alloc is correct.
- * The same goes for drm_addbufs_pci.
- * 
- * \sa mga_do_dma_bootstrap, mga_do_agp_dma_bootstrap
- */
-static int mga_do_pci_dma_bootstrap(drm_device_t * dev,
-				    drm_mga_dma_bootstrap_t * dma_bs)
-{
-	drm_mga_private_t * const dev_priv = (drm_mga_private_t *) dev->dev_private;
-	const unsigned int warp_size = mga_warp_microcode_size(dev_priv);
-	unsigned int primary_size;
-	unsigned int bin_count;
-	int err;
-	drm_buf_desc_t req;
-
-	
-	if (dev->dma == NULL) {
-		DRM_ERROR("dev->dma is NULL\n");
-		return DRM_ERR(EFAULT);
-	}
-
-	/* The proper alignment is 0x100 for this mapping */
-	err = drm_addmap(dev, 0, warp_size, _DRM_CONSISTENT,
-			 _DRM_READ_ONLY, &dev_priv->warp);
-	if (err != 0) {
-		DRM_ERROR("Unable to create mapping for WARP microcode\n");
-		return err;
-	}
-
-	/* Other than the bottom two bits being used to encode other
-	 * information, there don't appear to be any restrictions on the
-	 * alignment of the primary or secondary DMA buffers.
-	 */
-
-	for ( primary_size = dma_bs->primary_size
-	      ; primary_size != 0
-	      ; primary_size >>= 1 ) {
-		/* The proper alignment for this mapping is 0x04 */
-		err = drm_addmap(dev, 0, primary_size, _DRM_CONSISTENT,
-				 _DRM_READ_ONLY, &dev_priv->primary);
-		if (!err)
-			break;
-	}
-
-	if (err != 0) {
-		DRM_ERROR("Unable to allocate primary DMA region\n");
-		return DRM_ERR(ENOMEM);
-	}
-
-	if (dev_priv->primary->size != dma_bs->primary_size) {
-		DRM_INFO("Primary DMA buffer size reduced from %u to %u.\n",
-			 dma_bs->primary_size, 
-			 (unsigned) dev_priv->primary->size);
-		dma_bs->primary_size = dev_priv->primary->size;
-	}
-
-	for ( bin_count = dma_bs->secondary_bin_count
-	      ; bin_count > 0 
-	      ; bin_count-- ) {
-		(void) memset( &req, 0, sizeof(req) );
-		req.count = bin_count;
-		req.size = dma_bs->secondary_bin_size;
-
-		err = drm_addbufs_pci( dev, & req );
-		if (!err) {
-			break;
-		}
-	}
-	
-	if (bin_count == 0) {
-		DRM_ERROR("Unable to add secondary DMA buffers\n");
-		return err;
-	}
-
-	if (bin_count != dma_bs->secondary_bin_count) {
-		DRM_INFO("Secondary PCI DMA buffer bin count reduced from %u "
-			 "to %u.\n", dma_bs->secondary_bin_count, bin_count);
-
-		dma_bs->secondary_bin_count = bin_count;
-	}
-
-	dev_priv->dma_access = 0;
-	dev_priv->wagp_enable = 0;
-
-	dma_bs->agp_mode = 0;
-
-	DRM_INFO("Initialized card for PCI DMA.\n");
-	return 0;
-}
-
-
-static int mga_do_dma_bootstrap(drm_device_t * dev,
-				drm_mga_dma_bootstrap_t * dma_bs)
-{
-	const int is_agp = (dma_bs->agp_mode != 0) && drm_device_is_agp(dev);
-	int err;
-	drm_mga_private_t * const dev_priv =
-		(drm_mga_private_t *) dev->dev_private;
-
-
-	dev_priv->used_new_dma_init = 1;
-
-	/* The first steps are the same for both PCI and AGP based DMA.  Map
-	 * the cards MMIO registers and map a status page.
-	 */
-	err = drm_addmap( dev, dev_priv->mmio_base, dev_priv->mmio_size,
-			  _DRM_REGISTERS, _DRM_READ_ONLY, & dev_priv->mmio );
-	if (err) {
-		DRM_ERROR("Unable to map MMIO region\n");
-		return err;
-	}
-
-
-	err = drm_addmap( dev, 0, SAREA_MAX, _DRM_SHM,
-			  _DRM_READ_ONLY | _DRM_LOCKED | _DRM_KERNEL,
-			  & dev_priv->status );
-	if (err) {
-		DRM_ERROR("Unable to map status region\n");
-		return err;
-	}
-
-
-	/* The DMA initialization procedure is slightly different for PCI and
-	 * AGP cards.  AGP cards just allocate a large block of AGP memory and
-	 * carve off portions of it for internal uses.  The remaining memory
-	 * is returned to user-mode to be used for AGP textures.
-	 */
-
-	if (is_agp) {
-		err = mga_do_agp_dma_bootstrap(dev, dma_bs);
-	}
-	
-	/* If we attempted to initialize the card for AGP DMA but failed,
-	 * clean-up any mess that may have been created.
-	 */
-
-	if (err) {
-		mga_do_cleanup_dma(dev);
-	}
-
-
-	/* Not only do we want to try and initialized PCI cards for PCI DMA,
-	 * but we also try to initialized AGP cards that could not be
-	 * initialized for AGP DMA.  This covers the case where we have an AGP
-	 * card in a system with an unsupported AGP chipset.  In that case the
-	 * card will be detected as AGP, but we won't be able to allocate any
-	 * AGP memory, etc.
-	 */
-
-	if (!is_agp || err) {
-		err = mga_do_pci_dma_bootstrap(dev, dma_bs);
-	}
-
-
-	return err;
-}
-
-int mga_dma_bootstrap(DRM_IOCTL_ARGS)
-{
-	DRM_DEVICE;
-	drm_mga_dma_bootstrap_t bootstrap;
-	int err;
-
-
-	DRM_COPY_FROM_USER_IOCTL(bootstrap,
-				 (drm_mga_dma_bootstrap_t __user *) data,
-				 sizeof(bootstrap));
-
-	err = mga_do_dma_bootstrap(dev, & bootstrap);
-	if (! err) {
-		static const int modes[] = { 0, 1, 2, 2, 4, 4, 4, 4 };
-		const drm_mga_private_t * const dev_priv = 
-			(drm_mga_private_t *) dev->dev_private;
-
-		if (dev_priv->agp_textures != NULL) {
-			bootstrap.texture_handle = dev_priv->agp_textures->offset;
-			bootstrap.texture_size = dev_priv->agp_textures->size;
-		}
-		else {
-			bootstrap.texture_handle = 0;
-			bootstrap.texture_size = 0;
-		}
-
-		bootstrap.agp_mode = modes[ bootstrap.agp_mode & 0x07 ];
-		if (DRM_COPY_TO_USER( (void __user *) data, & bootstrap,
-				     sizeof(bootstrap))) {
-			err = DRM_ERR(EFAULT);
-		}
-	}
-	else {
-		mga_do_cleanup_dma(dev);
-	}
-
-	return err;
-}
-
 static int mga_do_init_dma( drm_device_t *dev, drm_mga_init_t *init )
 {
 	drm_mga_private_t *dev_priv;
 	int ret;
 	DRM_DEBUG( "\n" );
 
+	dev_priv = drm_alloc( sizeof(drm_mga_private_t), DRM_MEM_DRIVER );
+	if ( !dev_priv )
+		return DRM_ERR(ENOMEM);
+
+	memset( dev_priv, 0, sizeof(drm_mga_private_t) );
 
-	dev_priv = dev->dev_private;
+	dev_priv->chipset = init->chipset;
 
-	if (init->sgram) {
+	dev_priv->usec_timeout = MGA_DEFAULT_USEC_TIMEOUT;
+
+	if ( init->sgram ) {
 		dev_priv->clear_cmd = MGA_DWGCTL_CLEAR | MGA_ATYPE_BLK;
 	} else {
 		dev_priv->clear_cmd = MGA_DWGCTL_CLEAR | MGA_ATYPE_RSTR;
@@ -799,66 +436,88 @@ static int mga_do_init_dma( drm_device_t *dev, drm_mga_init_t *init )
 
 	DRM_GETSAREA();
 
-	if (!dev_priv->sarea) {
-		DRM_ERROR("failed to find sarea!\n");
+	if(!dev_priv->sarea) {
+		DRM_ERROR( "failed to find sarea!\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
 		return DRM_ERR(EINVAL);
 	}
 
-	if (! dev_priv->used_new_dma_init) {
-		dev_priv->status = drm_core_findmap(dev, init->status_offset);
-		if (!dev_priv->status) {
-			DRM_ERROR("failed to find status page!\n");
-			return DRM_ERR(EINVAL);
-		}
-		dev_priv->mmio = drm_core_findmap(dev, init->mmio_offset);
-		if (!dev_priv->mmio) {
-			DRM_ERROR("failed to find mmio region!\n");
-			return DRM_ERR(EINVAL);
-		}
-		dev_priv->warp = drm_core_findmap(dev, init->warp_offset);
-		if (!dev_priv->warp) {
-			DRM_ERROR("failed to find warp microcode region!\n");
-			return DRM_ERR(EINVAL);
-		}
-		dev_priv->primary = drm_core_findmap(dev, init->primary_offset);
-		if (!dev_priv->primary) {
-			DRM_ERROR("failed to find primary dma region!\n");
-			return DRM_ERR(EINVAL);
-		}
-		dev->agp_buffer_token = init->buffers_offset;
-		dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
-		if (!dev->agp_buffer_map) {
-			DRM_ERROR("failed to find dma buffer region!\n");
-			return DRM_ERR(EINVAL);
-		}
-
-		drm_core_ioremap(dev_priv->warp, dev);
-		drm_core_ioremap(dev_priv->primary, dev);
-		drm_core_ioremap(dev->agp_buffer_map, dev);
+	dev_priv->mmio = drm_core_findmap(dev, init->mmio_offset);
+	if(!dev_priv->mmio) {
+		DRM_ERROR( "failed to find mmio region!\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
+		return DRM_ERR(EINVAL);
+	}
+	dev_priv->status = drm_core_findmap(dev, init->status_offset);
+	if(!dev_priv->status) {
+		DRM_ERROR( "failed to find status page!\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
+		return DRM_ERR(EINVAL);
+	}
+	dev_priv->warp = drm_core_findmap(dev, init->warp_offset);
+	if(!dev_priv->warp) {
+		DRM_ERROR( "failed to find warp microcode region!\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
+		return DRM_ERR(EINVAL);
+	}
+	dev_priv->primary = drm_core_findmap(dev, init->primary_offset);
+	if(!dev_priv->primary) {
+		DRM_ERROR( "failed to find primary dma region!\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
+		return DRM_ERR(EINVAL);
+	}
+	dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
+	if(!dev->agp_buffer_map) {
+		DRM_ERROR( "failed to find dma buffer region!\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
+		return DRM_ERR(EINVAL);
 	}
 
 	dev_priv->sarea_priv =
 		(drm_mga_sarea_t *)((u8 *)dev_priv->sarea->handle +
 				    init->sarea_priv_offset);
 
-	if (!dev_priv->warp->handle ||
-	    !dev_priv->primary->handle ||
-	    ((dev_priv->dma_access != 0) &&
-	     ((dev->agp_buffer_map == NULL) ||
-	      (dev->agp_buffer_map->handle == NULL)))) {
-		DRM_ERROR("failed to ioremap agp regions!\n");
+	drm_core_ioremap( dev_priv->warp, dev );
+	drm_core_ioremap( dev_priv->primary, dev );
+	drm_core_ioremap( dev->agp_buffer_map, dev );
+
+	if(!dev_priv->warp->handle ||
+	   !dev_priv->primary->handle ||
+	   !dev->agp_buffer_map->handle ) {
+		DRM_ERROR( "failed to ioremap agp regions!\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
 		return DRM_ERR(ENOMEM);
 	}
 
-	ret = mga_warp_install_microcode(dev_priv);
-	if (ret < 0) {
-		DRM_ERROR("failed to install WARP ucode!\n");
+	ret = mga_warp_install_microcode( dev_priv );
+	if ( ret < 0 ) {
+		DRM_ERROR( "failed to install WARP ucode!\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
 		return ret;
 	}
 
-	ret = mga_warp_init(dev_priv);
-	if (ret < 0) {
-		DRM_ERROR("failed to init WARP engine!\n");
+	ret = mga_warp_init( dev_priv );
+	if ( ret < 0 ) {
+		DRM_ERROR( "failed to init WARP engine!\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
 		return ret;
 	}
 
@@ -898,18 +557,22 @@ static int mga_do_init_dma( drm_device_t *dev, drm_mga_init_t *init )
 	dev_priv->sarea_priv->last_frame.head = 0;
 	dev_priv->sarea_priv->last_frame.wrap = 0;
 
-	if (mga_freelist_init(dev, dev_priv) < 0) {
-		DRM_ERROR("could not initialize freelist\n");
+	if ( mga_freelist_init( dev, dev_priv ) < 0 ) {
+		DRM_ERROR( "could not initialize freelist\n" );
+		/* Assign dev_private so we can do cleanup. */
+		dev->dev_private = (void *)dev_priv;
+		mga_do_cleanup_dma( dev );
 		return DRM_ERR(ENOMEM);
 	}
 
+	/* Make dev_private visable to others. */
+	dev->dev_private = (void *)dev_priv;
 	return 0;
 }
 
 static int mga_do_cleanup_dma( drm_device_t *dev )
 {
-	int err = 0;
-	DRM_DEBUG("\n");
+	DRM_DEBUG( "\n" );
 
 	/* Make sure interrupts are disabled here because the uninstall ioctl
 	 * may not have been called from userspace and after dev_private
@@ -920,49 +583,20 @@ static int mga_do_cleanup_dma( drm_device_t *dev )
 	if ( dev->dev_private ) {
 		drm_mga_private_t *dev_priv = dev->dev_private;
 
-		if ((dev_priv->warp != NULL) 
-		    && (dev_priv->mmio->type != _DRM_CONSISTENT))
-			drm_core_ioremapfree(dev_priv->warp, dev);
-
-		if ((dev_priv->primary != NULL) 
-		    && (dev_priv->primary->type != _DRM_CONSISTENT))
-			drm_core_ioremapfree(dev_priv->primary, dev);
+		if ( dev_priv->warp != NULL )
+			drm_core_ioremapfree( dev_priv->warp, dev );
+		if ( dev_priv->primary != NULL )
+			drm_core_ioremapfree( dev_priv->primary, dev );
+		if ( dev->agp_buffer_map != NULL )
+			drm_core_ioremapfree( dev->agp_buffer_map, dev );
 
-		if (dev->agp_buffer_map != NULL)
-			drm_core_ioremapfree(dev->agp_buffer_map, dev);
-
-		if (dev_priv->used_new_dma_init) {
-			if (dev_priv->agp_mem != NULL) {
-				dev_priv->agp_textures = NULL;
-				drm_unbind_agp(dev_priv->agp_mem);
-
-				drm_free_agp(dev_priv->agp_mem, dev_priv->agp_pages);
-				dev_priv->agp_pages = 0;
-				dev_priv->agp_mem = NULL;
-			}
-
-			if ((dev->agp != NULL) && dev->agp->acquired) {
-				err = drm_agp_release(dev);
-			}
-
-			dev_priv->used_new_dma_init = 0;
+		if ( dev_priv->head != NULL ) {
+			mga_freelist_cleanup( dev );
 		}
 
-		dev_priv->warp = NULL;
-		dev_priv->primary = NULL;
-		dev_priv->mmio = NULL;
-		dev_priv->status = NULL;
-		dev_priv->sarea = NULL;
-		dev_priv->sarea_priv = NULL;
-		dev->agp_buffer_map = NULL;
-
-		memset(&dev_priv->prim, 0, sizeof(dev_priv->prim));
-		dev_priv->warp_pipe = 0;
-		memset(dev_priv->warp_pipe_phys, 0, sizeof(dev_priv->warp_pipe_phys));
-
-		if (dev_priv->head != NULL) {
-			mga_freelist_cleanup(dev);
-		}
+		drm_free( dev->dev_private, sizeof(drm_mga_private_t),
+			   DRM_MEM_DRIVER );
+		dev->dev_private = NULL;
 	}
 
 	return 0;
@@ -972,20 +606,14 @@ int mga_dma_init( DRM_IOCTL_ARGS )
 {
 	DRM_DEVICE;
 	drm_mga_init_t init;
-	int err;
 
 	LOCK_TEST_WITH_RETURN( dev, filp );
 
-	DRM_COPY_FROM_USER_IOCTL(init, (drm_mga_init_t __user *) data,
-				 sizeof(init));
+	DRM_COPY_FROM_USER_IOCTL( init, (drm_mga_init_t __user *)data, sizeof(init) );
 
 	switch ( init.func ) {
 	case MGA_INIT_DMA:
-		err = mga_do_init_dma(dev, &init);
-		if (err) {
-			(void) mga_do_cleanup_dma(dev);
-		}
-		return err;
+		return mga_do_init_dma( dev, &init );
 	case MGA_CLEANUP_DMA:
 		return mga_do_cleanup_dma( dev );
 	}
@@ -1114,21 +742,7 @@ int mga_dma_buffers( DRM_IOCTL_ARGS )
 	return ret;
 }
 
-/**
- * Called just before the module is unloaded.
- */
-int mga_driver_postcleanup(drm_device_t * dev)
-{
-	drm_free(dev->dev_private, sizeof(drm_mga_private_t), DRM_MEM_DRIVER);
-	dev->dev_private = NULL;
-
-	return 0;
-}
-
-/**
- * Called when the last opener of the device is closed.
- */
-void mga_driver_pretakedown(drm_device_t * dev)
+void mga_driver_pretakedown(drm_device_t *dev)
 {
 	mga_do_cleanup_dma( dev );
 }
diff --git a/trunk/drivers/char/drm/mga_drm.h b/trunk/drivers/char/drm/mga_drm.h
index d20aab3bd57b..521d4451d012 100644
--- a/trunk/drivers/char/drm/mga_drm.h
+++ b/trunk/drivers/char/drm/mga_drm.h
@@ -73,8 +73,7 @@
 
 #define MGA_CARD_TYPE_G200	1
 #define MGA_CARD_TYPE_G400	2
-#define MGA_CARD_TYPE_G450	3       /* not currently used */
-#define MGA_CARD_TYPE_G550	4
+
 
 #define MGA_FRONT		0x1
 #define MGA_BACK		0x2
@@ -226,6 +225,10 @@ typedef struct _drm_mga_sarea {
 } drm_mga_sarea_t;
 
 
+/* WARNING: If you change any of these defines, make sure to change the
+ * defines in the Xserver file (xf86drmMga.h)
+ */
+
 /* MGA specific ioctls
  * The device specific ioctl range is 0x40 to 0x79.
  */
@@ -240,14 +243,6 @@ typedef struct _drm_mga_sarea {
 #define DRM_MGA_BLIT     0x08
 #define DRM_MGA_GETPARAM 0x09
 
-/* 3.2:
- * ioctls for operating on fences.
- */
-#define DRM_MGA_SET_FENCE      0x0a
-#define DRM_MGA_WAIT_FENCE     0x0b
-#define DRM_MGA_DMA_BOOTSTRAP  0x0c
-
-
 #define DRM_IOCTL_MGA_INIT     DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_INIT, drm_mga_init_t)
 #define DRM_IOCTL_MGA_FLUSH    DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_FLUSH, drm_lock_t)
 #define DRM_IOCTL_MGA_RESET    DRM_IO(  DRM_COMMAND_BASE + DRM_MGA_RESET)
@@ -258,9 +253,6 @@ typedef struct _drm_mga_sarea {
 #define DRM_IOCTL_MGA_ILOAD    DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_ILOAD, drm_mga_iload_t)
 #define DRM_IOCTL_MGA_BLIT     DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_BLIT, drm_mga_blit_t)
 #define DRM_IOCTL_MGA_GETPARAM DRM_IOWR(DRM_COMMAND_BASE + DRM_MGA_GETPARAM, drm_mga_getparam_t)
-#define DRM_IOCTL_MGA_SET_FENCE     DRM_IOW( DRM_COMMAND_BASE + DRM_MGA_SET_FENCE, uint32_t)
-#define DRM_IOCTL_MGA_WAIT_FENCE    DRM_IOWR(DRM_COMMAND_BASE + DRM_MGA_WAIT_FENCE, uint32_t)
-#define DRM_IOCTL_MGA_DMA_BOOTSTRAP DRM_IOWR(DRM_COMMAND_BASE + DRM_MGA_DMA_BOOTSTRAP, drm_mga_dma_bootstrap_t)
 
 typedef struct _drm_mga_warp_index {
    	int installed;
@@ -299,72 +291,12 @@ typedef struct drm_mga_init {
 	unsigned long buffers_offset;
 } drm_mga_init_t;
 
-typedef struct drm_mga_dma_bootstrap {
-	/**
-	 * \name AGP texture region
-	 * 
-	 * On return from the DRM_MGA_DMA_BOOTSTRAP ioctl, these fields will
-	 * be filled in with the actual AGP texture settings.
-	 * 
-	 * \warning
-	 * If these fields are non-zero, but dma_mga_dma_bootstrap::agp_mode
-	 * is zero, it means that PCI memory (most likely through the use of
-	 * an IOMMU) is being used for "AGP" textures.
-	 */
-	/*@{*/
-	unsigned long texture_handle; /**< Handle used to map AGP textures. */
-	uint32_t     texture_size;    /**< Size of the AGP texture region. */
-	/*@}*/
-
-
-	/**
-	 * Requested size of the primary DMA region.
-	 * 
-	 * On return from the DRM_MGA_DMA_BOOTSTRAP ioctl, this field will be
-	 * filled in with the actual AGP mode.  If AGP was not available
-	 */
-	uint32_t primary_size;
-
-
-	/**
-	 * Requested number of secondary DMA buffers.
-	 * 
-	 * On return from the DRM_MGA_DMA_BOOTSTRAP ioctl, this field will be
-	 * filled in with the actual number of secondary DMA buffers
-	 * allocated.  Particularly when PCI DMA is used, this may be
-	 * (subtantially) less than the number requested.
-	 */
-	uint32_t secondary_bin_count;
-	
-	
-	/**
-	 * Requested size of each secondary DMA buffer.
-	 * 
-	 * While the kernel \b is free to reduce
-	 * dma_mga_dma_bootstrap::secondary_bin_count, it is \b not allowed
-	 * to reduce dma_mga_dma_bootstrap::secondary_bin_size.
-	 */
-	uint32_t secondary_bin_size;
-
-
-	/**
-	 * Bit-wise mask of AGPSTAT2_* values.  Currently only \c AGPSTAT2_1X,
-	 * \c AGPSTAT2_2X, and \c AGPSTAT2_4X are supported.  If this value is
-	 * zero, it means that PCI DMA should be used, even if AGP is
-	 * possible.
-	 * 
-	 * On return from the DRM_MGA_DMA_BOOTSTRAP ioctl, this field will be
-	 * filled in with the actual AGP mode.  If AGP was not available
-	 * (i.e., PCI DMA was used), this value will be zero.
-	 */
-	uint32_t agp_mode;
-
-
-	/**
-	 * Desired AGP GART size, measured in megabytes.
-	 */
-	uint8_t agp_size;
-} drm_mga_dma_bootstrap_t;
+typedef struct drm_mga_fullscreen {
+	enum {
+		MGA_INIT_FULLSCREEN    = 0x01,
+		MGA_CLEANUP_FULLSCREEN = 0x02
+	} func;
+} drm_mga_fullscreen_t;
 
 typedef struct drm_mga_clear {
 	unsigned int flags;
@@ -409,14 +341,6 @@ typedef struct _drm_mga_blit {
  */
 #define MGA_PARAM_IRQ_NR            1
 
-/* 3.2: Query the actual card type.  The DDX only distinguishes between
- * G200 chips and non-G200 chips, which it calls G400.  It turns out that
- * there are some very sublte differences between the G4x0 chips and the G550
- * chips.  Using this parameter query, a client-side driver can detect the
- * difference between a G4x0 and a G550.
- */
-#define MGA_PARAM_CARD_TYPE         2
-
 typedef struct drm_mga_getparam {
 	int param;
 	void __user *value;
diff --git a/trunk/drivers/char/drm/mga_drv.c b/trunk/drivers/char/drm/mga_drv.c
index daabbba3b297..844cca9cb29d 100644
--- a/trunk/drivers/char/drm/mga_drv.c
+++ b/trunk/drivers/char/drm/mga_drv.c
@@ -38,15 +38,8 @@
   
 #include "drm_pciids.h"
 
-static int mga_driver_device_is_agp(drm_device_t * dev);
 static int postinit( struct drm_device *dev, unsigned long flags )
 {
-	drm_mga_private_t * const dev_priv =
-		(drm_mga_private_t *) dev->dev_private;
-
-	dev_priv->mmio_base = pci_resource_start(dev->pdev, 1);
-	dev_priv->mmio_size = pci_resource_len(dev->pdev, 1);
-
 	dev->counters += 3;
 	dev->types[6] = _DRM_STAT_IRQ;
 	dev->types[7] = _DRM_STAT_PRIMARY;
@@ -86,11 +79,8 @@ extern int mga_max_ioctl;
 
 static struct drm_driver driver = {
 	.driver_features = DRIVER_USE_AGP | DRIVER_REQUIRE_AGP | DRIVER_USE_MTRR | DRIVER_HAVE_DMA | DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED | DRIVER_IRQ_VBL,
-	.preinit = mga_driver_preinit,
-	.postcleanup = mga_driver_postcleanup,
 	.pretakedown = mga_driver_pretakedown,
 	.dma_quiescent = mga_driver_dma_quiescent,
-	.device_is_agp = mga_driver_device_is_agp,
 	.vblank_wait = mga_driver_vblank_wait,
 	.irq_preinstall = mga_driver_irq_preinstall,
 	.irq_postinstall = mga_driver_irq_postinstall,
@@ -138,38 +128,3 @@ module_exit(mga_exit);
 MODULE_AUTHOR( DRIVER_AUTHOR );
 MODULE_DESCRIPTION( DRIVER_DESC );
 MODULE_LICENSE("GPL and additional rights");
-
-/**
- * Determine if the device really is AGP or not.
- *
- * In addition to the usual tests performed by \c drm_device_is_agp, this
- * function detects PCI G450 cards that appear to the system exactly like
- * AGP G450 cards.
- *
- * \param dev   The device to be tested.
- *
- * \returns
- * If the device is a PCI G450, zero is returned.  Otherwise 2 is returned.
- */
-int mga_driver_device_is_agp(drm_device_t * dev)
-{
-	const struct pci_dev * const pdev = dev->pdev;
-
-
-	/* There are PCI versions of the G450.  These cards have the
-	 * same PCI ID as the AGP G450, but have an additional PCI-to-PCI
-	 * bridge chip.  We detect these cards, which are not currently
-	 * supported by this driver, by looking at the device ID of the
-	 * bus the "card" is on.  If vendor is 0x3388 (Hint Corp) and the
-	 * device is 0x0021 (HB6 Universal PCI-PCI bridge), we reject the
-	 * device.
-	 */
-	
-	if ( (pdev->device == 0x0525)
-	     && (pdev->bus->self->vendor == 0x3388)
-	     && (pdev->bus->self->device == 0x0021) ) {
-		return 0;
-	}
-
-	return 2;
-}
diff --git a/trunk/drivers/char/drm/mga_drv.h b/trunk/drivers/char/drm/mga_drv.h
index b22fdbd4f830..9412e2816eb7 100644
--- a/trunk/drivers/char/drm/mga_drv.h
+++ b/trunk/drivers/char/drm/mga_drv.h
@@ -38,10 +38,10 @@
 
 #define DRIVER_NAME		"mga"
 #define DRIVER_DESC		"Matrox G200/G400"
-#define DRIVER_DATE		"20050607"
+#define DRIVER_DATE		"20021029"
 
 #define DRIVER_MAJOR		3
-#define DRIVER_MINOR		2
+#define DRIVER_MINOR		1
 #define DRIVER_PATCHLEVEL	0
 
 typedef struct drm_mga_primary_buffer {
@@ -87,43 +87,9 @@ typedef struct drm_mga_private {
 	int chipset;
 	int usec_timeout;
 
-	/**
-	 * If set, the new DMA initialization sequence was used.  This is
-	 * primarilly used to select how the driver should uninitialized its
-	 * internal DMA structures.
-	 */
-	int used_new_dma_init;
-
-	/**
-	 * If AGP memory is used for DMA buffers, this will be the value
-	 * \c MGA_PAGPXFER.  Otherwise, it will be zero (for a PCI transfer).
-	 */
-	u32 dma_access;
-
-	/**
-	 * If AGP memory is used for DMA buffers, this will be the value
-	 * \c MGA_WAGP_ENABLE.  Otherwise, it will be zero (for a PCI
-	 * transfer).
-	 */
-	u32 wagp_enable;
-
-	/**
-	 * \name MMIO region parameters.
-	 * 
-	 * \sa drm_mga_private_t::mmio
-	 */
-	/*@{*/
-	u32 mmio_base;             /**< Bus address of base of MMIO. */
-	u32 mmio_size;             /**< Size of the MMIO region. */
-	/*@}*/
-
 	u32 clear_cmd;
 	u32 maccess;
 
-	wait_queue_head_t fence_queue;
-	atomic_t last_fence_retired;
-	u32 next_fence_to_post;
-
 	unsigned int fb_cpp;
 	unsigned int front_offset;
 	unsigned int front_pitch;
@@ -142,43 +108,35 @@ typedef struct drm_mga_private {
 	drm_local_map_t *status;
 	drm_local_map_t *warp;
 	drm_local_map_t *primary;
+	drm_local_map_t *buffers;
 	drm_local_map_t *agp_textures;
-	
-	DRM_AGP_MEM *agp_mem;
-	unsigned int agp_pages;
 } drm_mga_private_t;
 
 				/* mga_dma.c */
-extern int mga_driver_preinit(drm_device_t * dev, unsigned long flags);
-extern int mga_dma_bootstrap(DRM_IOCTL_ARGS);
-extern int mga_dma_init(DRM_IOCTL_ARGS);
-extern int mga_dma_flush(DRM_IOCTL_ARGS);
-extern int mga_dma_reset(DRM_IOCTL_ARGS);
-extern int mga_dma_buffers(DRM_IOCTL_ARGS);
-extern int mga_driver_postcleanup(drm_device_t * dev);
-extern void mga_driver_pretakedown(drm_device_t * dev);
-extern int mga_driver_dma_quiescent(drm_device_t * dev);
-
-extern int mga_do_wait_for_idle(drm_mga_private_t * dev_priv);
-
-extern void mga_do_dma_flush(drm_mga_private_t * dev_priv);
-extern void mga_do_dma_wrap_start(drm_mga_private_t * dev_priv);
-extern void mga_do_dma_wrap_end(drm_mga_private_t * dev_priv);
+extern int mga_dma_init( DRM_IOCTL_ARGS );
+extern int mga_dma_flush( DRM_IOCTL_ARGS );
+extern int mga_dma_reset( DRM_IOCTL_ARGS );
+extern int mga_dma_buffers( DRM_IOCTL_ARGS );
+extern void mga_driver_pretakedown(drm_device_t *dev);
+extern int mga_driver_dma_quiescent(drm_device_t *dev);
+
+extern int mga_do_wait_for_idle( drm_mga_private_t *dev_priv );
+
+extern void mga_do_dma_flush( drm_mga_private_t *dev_priv );
+extern void mga_do_dma_wrap_start( drm_mga_private_t *dev_priv );
+extern void mga_do_dma_wrap_end( drm_mga_private_t *dev_priv );
 
 extern int mga_freelist_put( drm_device_t *dev, drm_buf_t *buf );
 
 				/* mga_warp.c */
-extern unsigned int mga_warp_microcode_size(const drm_mga_private_t * dev_priv);
-extern int mga_warp_install_microcode(drm_mga_private_t * dev_priv);
-extern int mga_warp_init(drm_mga_private_t * dev_priv);
-
-				/* mga_irq.c */
-extern int mga_driver_fence_wait(drm_device_t * dev, unsigned int *sequence);
-extern int mga_driver_vblank_wait(drm_device_t * dev, unsigned int *sequence);
-extern irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS);
-extern void mga_driver_irq_preinstall(drm_device_t * dev);
-extern void mga_driver_irq_postinstall(drm_device_t * dev);
-extern void mga_driver_irq_uninstall(drm_device_t * dev);
+extern int mga_warp_install_microcode( drm_mga_private_t *dev_priv );
+extern int mga_warp_init( drm_mga_private_t *dev_priv );
+
+extern int mga_driver_vblank_wait(drm_device_t *dev, unsigned int *sequence);
+extern irqreturn_t mga_driver_irq_handler( DRM_IRQ_ARGS );
+extern void mga_driver_irq_preinstall( drm_device_t *dev );
+extern void mga_driver_irq_postinstall( drm_device_t *dev );
+extern void mga_driver_irq_uninstall( drm_device_t *dev );
 extern long mga_compat_ioctl(struct file *filp, unsigned int cmd,
 			     unsigned long arg);
 
@@ -569,12 +527,6 @@ do {									\
  */
 #define MGA_EXEC 			0x0100
 
-/* AGP PLL encoding (for G200 only).
- */
-#define MGA_AGP_PLL 			0x1e4c
-#	define MGA_AGP2XPLL_DISABLE		(0 << 0)
-#	define MGA_AGP2XPLL_ENABLE		(1 << 0)
-
 /* Warp registers
  */
 #define MGA_WR0				0x2d00
diff --git a/trunk/drivers/char/drm/mga_ioc32.c b/trunk/drivers/char/drm/mga_ioc32.c
index 77d738e75a4d..bc745cfa2095 100644
--- a/trunk/drivers/char/drm/mga_ioc32.c
+++ b/trunk/drivers/char/drm/mga_ioc32.c
@@ -129,76 +129,9 @@ static int compat_mga_getparam(struct file *file, unsigned int cmd,
 			 DRM_IOCTL_MGA_GETPARAM, (unsigned long)getparam);
 }
 
-typedef struct drm_mga_drm_bootstrap32 {
-	u32 texture_handle;
-	u32 texture_size;
-	u32 primary_size;
-	u32 secondary_bin_count;
-	u32 secondary_bin_size;
-	u32 agp_mode;
-	u8 agp_size;
-} drm_mga_dma_bootstrap32_t;
-
-static int compat_mga_dma_bootstrap(struct file *file, unsigned int cmd,
-				    unsigned long arg)
-{
-	drm_mga_dma_bootstrap32_t dma_bootstrap32;
-	drm_mga_dma_bootstrap_t __user *dma_bootstrap;
-	int err;
-
-	if (copy_from_user(&dma_bootstrap32, (void __user *)arg,
-			   sizeof(dma_bootstrap32)))
-		return -EFAULT;
-
-	dma_bootstrap = compat_alloc_user_space(sizeof(*dma_bootstrap));
-	if (!access_ok(VERIFY_WRITE, dma_bootstrap, sizeof(*dma_bootstrap))
-	    || __put_user(dma_bootstrap32.texture_handle,
-			  &dma_bootstrap->texture_handle)
-	    || __put_user(dma_bootstrap32.texture_size,
-			  &dma_bootstrap->texture_size)
-	    || __put_user(dma_bootstrap32.primary_size,
-			  &dma_bootstrap->primary_size)
-	    || __put_user(dma_bootstrap32.secondary_bin_count,
-			  &dma_bootstrap->secondary_bin_count)
-	    || __put_user(dma_bootstrap32.secondary_bin_size,
-			  &dma_bootstrap->secondary_bin_size)
-	    || __put_user(dma_bootstrap32.agp_mode, &dma_bootstrap->agp_mode)
-	    || __put_user(dma_bootstrap32.agp_size, &dma_bootstrap->agp_size))
-		return -EFAULT;
-
-	err = drm_ioctl(file->f_dentry->d_inode, file,
-			DRM_IOCTL_MGA_DMA_BOOTSTRAP,
-			(unsigned long)dma_bootstrap);
-	if (err)
-		return err;
-
-	if (__get_user(dma_bootstrap32.texture_handle,
-		       &dma_bootstrap->texture_handle)
-	    || __get_user(dma_bootstrap32.texture_size,
-			  &dma_bootstrap->texture_size)
-	    || __get_user(dma_bootstrap32.primary_size,
-			  &dma_bootstrap->primary_size)
-	    || __get_user(dma_bootstrap32.secondary_bin_count,
-			  &dma_bootstrap->secondary_bin_count)
-	    || __get_user(dma_bootstrap32.secondary_bin_size,
-			  &dma_bootstrap->secondary_bin_size)
-	    || __get_user(dma_bootstrap32.agp_mode,
-			  &dma_bootstrap->agp_mode)
-	    || __get_user(dma_bootstrap32.agp_size,
-			  &dma_bootstrap->agp_size))
-		return -EFAULT;
-
-	if (copy_to_user((void __user *)arg, &dma_bootstrap32,
-	    		 sizeof(dma_bootstrap32)))
-		return -EFAULT;
-
-	return 0;
-}
-
 drm_ioctl_compat_t *mga_compat_ioctls[] = {
 	[DRM_MGA_INIT] = compat_mga_init,
 	[DRM_MGA_GETPARAM] = compat_mga_getparam,
-	[DRM_MGA_DMA_BOOTSTRAP] = compat_mga_dma_bootstrap,
 };
 
 /**
diff --git a/trunk/drivers/char/drm/mga_irq.c b/trunk/drivers/char/drm/mga_irq.c
index 52eaa4e788f9..bc0b6b5d43a6 100644
--- a/trunk/drivers/char/drm/mga_irq.c
+++ b/trunk/drivers/char/drm/mga_irq.c
@@ -41,40 +41,15 @@ irqreturn_t mga_driver_irq_handler( DRM_IRQ_ARGS )
 	drm_mga_private_t *dev_priv = 
 	   (drm_mga_private_t *)dev->dev_private;
 	int status;
-	int handled = 0;
-
-	status = MGA_READ(MGA_STATUS);
 
+	status = MGA_READ( MGA_STATUS );
+	
 	/* VBLANK interrupt */
 	if ( status & MGA_VLINEPEN ) {
 		MGA_WRITE( MGA_ICLEAR, MGA_VLINEICLR );
 		atomic_inc(&dev->vbl_received);
 		DRM_WAKEUP(&dev->vbl_queue);
-		drm_vbl_send_signals(dev);
-		handled = 1;
-	}
-
-	/* SOFTRAP interrupt */
-	if (status & MGA_SOFTRAPEN) {
-		const u32 prim_start = MGA_READ(MGA_PRIMADDRESS);
-		const u32 prim_end   = MGA_READ(MGA_PRIMEND);
-
-
-		MGA_WRITE(MGA_ICLEAR, MGA_SOFTRAPICLR);
-
-		/* In addition to clearing the interrupt-pending bit, we
-		 * have to write to MGA_PRIMEND to re-start the DMA operation.
-		 */
-		if ( (prim_start & ~0x03) != (prim_end & ~0x03) ) {
-			MGA_WRITE(MGA_PRIMEND, prim_end);
-		}
-
-		atomic_inc(&dev_priv->last_fence_retired);
-		DRM_WAKEUP(&dev_priv->fence_queue);
-		handled = 1;
-	}
-
-	if ( handled ) {
+		drm_vbl_send_signals( dev );
 		return IRQ_HANDLED;
 	}
 	return IRQ_NONE;
@@ -98,28 +73,9 @@ int mga_driver_vblank_wait(drm_device_t *dev, unsigned int *sequence)
 	return ret;
 }
 
-int mga_driver_fence_wait(drm_device_t * dev, unsigned int *sequence)
-{
-	drm_mga_private_t *dev_priv = (drm_mga_private_t *) dev->dev_private;
-	unsigned int cur_fence;
-	int ret = 0;
-
-	/* Assume that the user has missed the current sequence number
-	 * by about a day rather than she wants to wait for years
-	 * using fences.
-	 */
-	DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
-		    (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
-		      - *sequence) <= (1 << 23)));
-
-	*sequence = cur_fence;
-
-	return ret;
-}
-
-void mga_driver_irq_preinstall(drm_device_t * dev)
-{
-	drm_mga_private_t *dev_priv = (drm_mga_private_t *) dev->dev_private;
+void mga_driver_irq_preinstall( drm_device_t *dev ) {
+  	drm_mga_private_t *dev_priv = 
+	   (drm_mga_private_t *)dev->dev_private;
 
 	/* Disable *all* interrupts */
       	MGA_WRITE( MGA_IEN, 0 );
@@ -127,14 +83,12 @@ void mga_driver_irq_preinstall(drm_device_t * dev)
    	MGA_WRITE( MGA_ICLEAR, ~0 );
 }
 
-void mga_driver_irq_postinstall(drm_device_t * dev)
-{
-	drm_mga_private_t *dev_priv = (drm_mga_private_t *) dev->dev_private;
-
-	DRM_INIT_WAITQUEUE( &dev_priv->fence_queue );
+void mga_driver_irq_postinstall( drm_device_t *dev ) {
+  	drm_mga_private_t *dev_priv = 
+	   (drm_mga_private_t *)dev->dev_private;
 
-	/* Turn on vertical blank interrupt and soft trap interrupt. */
-	MGA_WRITE(MGA_IEN, MGA_VLINEIEN | MGA_SOFTRAPEN);
+	/* Turn on VBL interrupt */
+   	MGA_WRITE( MGA_IEN, MGA_VLINEIEN );
 }
 
 void mga_driver_irq_uninstall( drm_device_t *dev ) {
@@ -144,7 +98,5 @@ void mga_driver_irq_uninstall( drm_device_t *dev ) {
 		return;
 
 	/* Disable *all* interrupts */
-	MGA_WRITE(MGA_IEN, 0);
-	
-	dev->irq_enabled = 0;
+	MGA_WRITE( MGA_IEN, 0 );
 }
diff --git a/trunk/drivers/char/drm/mga_state.c b/trunk/drivers/char/drm/mga_state.c
index 05bbb4719376..3c7a8f5ba501 100644
--- a/trunk/drivers/char/drm/mga_state.c
+++ b/trunk/drivers/char/drm/mga_state.c
@@ -53,16 +53,16 @@ static void mga_emit_clip_rect( drm_mga_private_t *dev_priv,
 
 	/* Force reset of DWGCTL on G400 (eliminates clip disable bit).
 	 */
-	if (dev_priv->chipset == MGA_CARD_TYPE_G400) {
-		DMA_BLOCK(MGA_DWGCTL, ctx->dwgctl,
-			  MGA_LEN + MGA_EXEC, 0x80000000,
-			  MGA_DWGCTL, ctx->dwgctl,
-			  MGA_LEN + MGA_EXEC, 0x80000000);
+	if ( dev_priv->chipset == MGA_CARD_TYPE_G400 ) {
+		DMA_BLOCK( MGA_DWGCTL,		ctx->dwgctl,
+			   MGA_LEN + MGA_EXEC,	0x80000000,
+			   MGA_DWGCTL,		ctx->dwgctl,
+			   MGA_LEN + MGA_EXEC,	0x80000000 );
 	}
-	DMA_BLOCK(MGA_DMAPAD, 0x00000000,
-		  MGA_CXBNDRY, ((box->x2 - 1) << 16) | box->x1,
-		  MGA_YTOP, box->y1 * pitch,
-		  MGA_YBOT, (box->y2 - 1) * pitch);
+	DMA_BLOCK( MGA_DMAPAD,	0x00000000,
+		   MGA_CXBNDRY,	(box->x2 << 16) | box->x1,
+		   MGA_YTOP,	box->y1 * pitch,
+		   MGA_YBOT,	box->y2 * pitch );
 
 	ADVANCE_DMA();
 }
@@ -260,11 +260,12 @@ static __inline__ void mga_g200_emit_pipe( drm_mga_private_t *dev_priv )
 
 	/* Padding required to to hardware bug.
 	 */
-	DMA_BLOCK(MGA_DMAPAD, 0xffffffff,
-		  MGA_DMAPAD, 0xffffffff,
-		  MGA_DMAPAD, 0xffffffff,
-		  MGA_WIADDR, (dev_priv->warp_pipe_phys[pipe] |
-			       MGA_WMODE_START | dev_priv->wagp_enable));
+	DMA_BLOCK( MGA_DMAPAD,	0xffffffff,
+		   MGA_DMAPAD,	0xffffffff,
+		   MGA_DMAPAD,	0xffffffff,
+		   MGA_WIADDR,	(dev_priv->warp_pipe_phys[pipe] |
+				 MGA_WMODE_START |
+				 MGA_WAGP_ENABLE) );
 
 	ADVANCE_DMA();
 }
@@ -341,11 +342,12 @@ static __inline__ void mga_g400_emit_pipe( drm_mga_private_t *dev_priv )
 		   MGA_WR60,	MGA_G400_WR_MAGIC );	/* tex1 height       */
 
 	/* Padding required to to hardware bug */
-	DMA_BLOCK(MGA_DMAPAD, 0xffffffff,
-		  MGA_DMAPAD, 0xffffffff,
-		  MGA_DMAPAD, 0xffffffff,
-		  MGA_WIADDR2, (dev_priv->warp_pipe_phys[pipe] |
-				MGA_WMODE_START | dev_priv->wagp_enable));
+	DMA_BLOCK( MGA_DMAPAD,	0xffffffff,
+		   MGA_DMAPAD,	0xffffffff,
+		   MGA_DMAPAD,	0xffffffff,
+		   MGA_WIADDR2,	(dev_priv->warp_pipe_phys[pipe] |
+				 MGA_WMODE_START |
+				 MGA_WAGP_ENABLE) );
 
 	ADVANCE_DMA();
 }
@@ -457,9 +459,9 @@ static int mga_verify_state( drm_mga_private_t *dev_priv )
 	if ( dirty & MGA_UPLOAD_TEX0 )
 		ret |= mga_verify_tex( dev_priv, 0 );
 
-	if (dev_priv->chipset >= MGA_CARD_TYPE_G400) {
-		if (dirty & MGA_UPLOAD_TEX1)
-			ret |= mga_verify_tex(dev_priv, 1);
+	if ( dev_priv->chipset == MGA_CARD_TYPE_G400 ) {
+		if ( dirty & MGA_UPLOAD_TEX1 )
+			ret |= mga_verify_tex( dev_priv, 1 );
 
 		if ( dirty & MGA_UPLOAD_PIPE )
 			ret |= ( sarea_priv->warp_pipe > MGA_MAX_G400_PIPES );
@@ -684,12 +686,12 @@ static void mga_dma_dispatch_vertex( drm_device_t *dev, drm_buf_t *buf )
 
 			BEGIN_DMA( 1 );
 
-			DMA_BLOCK(MGA_DMAPAD, 0x00000000,
-				  MGA_DMAPAD, 0x00000000,
-				  MGA_SECADDRESS, (address |
-						   MGA_DMA_VERTEX),
-				  MGA_SECEND, ((address + length) |
-					       dev_priv->dma_access));
+			DMA_BLOCK( MGA_DMAPAD,		0x00000000,
+				   MGA_DMAPAD,		0x00000000,
+				   MGA_SECADDRESS,	(address |
+							 MGA_DMA_VERTEX),
+				   MGA_SECEND,		((address + length) |
+							 MGA_PAGPXFER) );
 
 			ADVANCE_DMA();
 		} while ( ++i < sarea_priv->nbox );
@@ -731,11 +733,11 @@ static void mga_dma_dispatch_indices( drm_device_t *dev, drm_buf_t *buf,
 
 			BEGIN_DMA( 1 );
 
-			DMA_BLOCK(MGA_DMAPAD, 0x00000000,
-				  MGA_DMAPAD, 0x00000000,
-				  MGA_SETUPADDRESS, address + start,
-				  MGA_SETUPEND, ((address + end) |
-						 dev_priv->dma_access));
+			DMA_BLOCK( MGA_DMAPAD,		0x00000000,
+				   MGA_DMAPAD,		0x00000000,
+				   MGA_SETUPADDRESS,	address + start,
+				   MGA_SETUPEND,	((address + end) |
+							 MGA_PAGPXFER) );
 
 			ADVANCE_DMA();
 		} while ( ++i < sarea_priv->nbox );
@@ -762,7 +764,7 @@ static void mga_dma_dispatch_iload( drm_device_t *dev, drm_buf_t *buf,
 	drm_mga_private_t *dev_priv = dev->dev_private;
 	drm_mga_buf_priv_t *buf_priv = buf->dev_private;
 	drm_mga_context_regs_t *ctx = &dev_priv->sarea_priv->context_state;
-	u32 srcorg = buf->bus_address | dev_priv->dma_access | MGA_SRCMAP_SYSMEM;
+	u32 srcorg = buf->bus_address | MGA_SRCACC_AGP | MGA_SRCMAP_SYSMEM;
 	u32 y2;
 	DMA_LOCALS;
 	DRM_DEBUG( "buf=%d used=%d\n", buf->idx, buf->used );
@@ -1093,9 +1095,6 @@ static int mga_getparam( DRM_IOCTL_ARGS )
 	case MGA_PARAM_IRQ_NR:
 		value = dev->irq;
 		break;
-	case MGA_PARAM_CARD_TYPE:
-		value = dev_priv->chipset;
-		break;
 	default:
 		return DRM_ERR(EINVAL);
 	}
@@ -1108,82 +1107,17 @@ static int mga_getparam( DRM_IOCTL_ARGS )
 	return 0;
 }
 
-static int mga_set_fence(DRM_IOCTL_ARGS)
-{
-	DRM_DEVICE;
-	drm_mga_private_t *dev_priv = dev->dev_private;
-	u32 temp;
-	DMA_LOCALS;
-
-	if (!dev_priv) {
-		DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-		return DRM_ERR(EINVAL);
-	}
-
-	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
-
-	/* I would normal do this assignment in the declaration of temp,
-	 * but dev_priv may be NULL.
-	 */
-
-	temp = dev_priv->next_fence_to_post;
-	dev_priv->next_fence_to_post++;
-
-	BEGIN_DMA(1);
-	DMA_BLOCK(MGA_DMAPAD, 0x00000000,
-		  MGA_DMAPAD, 0x00000000,
-		  MGA_DMAPAD, 0x00000000,
-		  MGA_SOFTRAP, 0x00000000);
-	ADVANCE_DMA();
-
-	if (DRM_COPY_TO_USER( (u32 __user *) data, & temp, sizeof(u32))) {
-		DRM_ERROR("copy_to_user\n");
-		return DRM_ERR(EFAULT);
-	}
-
-	return 0;
-}
-
-static int mga_wait_fence(DRM_IOCTL_ARGS)
-{
-	DRM_DEVICE;
-	drm_mga_private_t *dev_priv = dev->dev_private;
-	u32 fence;
-
-	if (!dev_priv) {
-		DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-		return DRM_ERR(EINVAL);
-	}
-
-	DRM_COPY_FROM_USER_IOCTL(fence, (u32 __user *) data, sizeof(u32));
-
-	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
-
-	mga_driver_fence_wait(dev, & fence);
-
-	if (DRM_COPY_TO_USER( (u32 __user *) data, & fence, sizeof(u32))) {
-		DRM_ERROR("copy_to_user\n");
-		return DRM_ERR(EFAULT);
-	}
-
-	return 0;
-}
-
 drm_ioctl_desc_t mga_ioctls[] = {
-	[DRM_IOCTL_NR(DRM_MGA_INIT)] = {mga_dma_init, 1, 1},
-	[DRM_IOCTL_NR(DRM_MGA_FLUSH)] = {mga_dma_flush, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_RESET)] = {mga_dma_reset, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_SWAP)] = {mga_dma_swap, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_CLEAR)] = {mga_dma_clear, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_VERTEX)] = {mga_dma_vertex, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_INDICES)] = {mga_dma_indices, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_ILOAD)] = {mga_dma_iload, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_BLIT)] = {mga_dma_blit, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_GETPARAM)] = {mga_getparam, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_SET_FENCE)] = {mga_set_fence, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_WAIT_FENCE)] = {mga_wait_fence, 1, 0},
-	[DRM_IOCTL_NR(DRM_MGA_DMA_BOOTSTRAP)] = {mga_dma_bootstrap, 1, 1},
-
+	[DRM_IOCTL_NR(DRM_MGA_INIT)]    = { mga_dma_init,    1, 1 },
+	[DRM_IOCTL_NR(DRM_MGA_FLUSH)]   = { mga_dma_flush,   1, 0 },
+	[DRM_IOCTL_NR(DRM_MGA_RESET)]   = { mga_dma_reset,   1, 0 },
+	[DRM_IOCTL_NR(DRM_MGA_SWAP)]    = { mga_dma_swap,    1, 0 },
+	[DRM_IOCTL_NR(DRM_MGA_CLEAR)]   = { mga_dma_clear,   1, 0 },
+	[DRM_IOCTL_NR(DRM_MGA_VERTEX)]  = { mga_dma_vertex,  1, 0 },
+	[DRM_IOCTL_NR(DRM_MGA_INDICES)] = { mga_dma_indices, 1, 0 },
+	[DRM_IOCTL_NR(DRM_MGA_ILOAD)]   = { mga_dma_iload,   1, 0 },
+	[DRM_IOCTL_NR(DRM_MGA_BLIT)]    = { mga_dma_blit,    1, 0 },
+	[DRM_IOCTL_NR(DRM_MGA_GETPARAM)]= { mga_getparam,    1, 0 },
 };
 
 int mga_max_ioctl = DRM_ARRAY_SIZE(mga_ioctls);
diff --git a/trunk/drivers/char/drm/mga_warp.c b/trunk/drivers/char/drm/mga_warp.c
index 55ccc8a0ac29..0a3a0cc700dc 100644
--- a/trunk/drivers/char/drm/mga_warp.c
+++ b/trunk/drivers/char/drm/mga_warp.c
@@ -48,52 +48,65 @@ do {									\
 	vcbase += WARP_UCODE_SIZE( which );				\
 } while (0)
 
-static const unsigned int mga_warp_g400_microcode_size =
-	       (WARP_UCODE_SIZE(warp_g400_tgz) +
-		WARP_UCODE_SIZE(warp_g400_tgza) +
-		WARP_UCODE_SIZE(warp_g400_tgzaf) +
-		WARP_UCODE_SIZE(warp_g400_tgzf) +
-		WARP_UCODE_SIZE(warp_g400_tgzs) +
-		WARP_UCODE_SIZE(warp_g400_tgzsa) +
-		WARP_UCODE_SIZE(warp_g400_tgzsaf) +
-		WARP_UCODE_SIZE(warp_g400_tgzsf) +
-		WARP_UCODE_SIZE(warp_g400_t2gz) +
-		WARP_UCODE_SIZE(warp_g400_t2gza) +
-		WARP_UCODE_SIZE(warp_g400_t2gzaf) +
-		WARP_UCODE_SIZE(warp_g400_t2gzf) +
-		WARP_UCODE_SIZE(warp_g400_t2gzs) +
-		WARP_UCODE_SIZE(warp_g400_t2gzsa) +
-		WARP_UCODE_SIZE(warp_g400_t2gzsaf) +
-		WARP_UCODE_SIZE(warp_g400_t2gzsf));
-
-static const unsigned int mga_warp_g200_microcode_size =
-	       (WARP_UCODE_SIZE(warp_g200_tgz) +
-		WARP_UCODE_SIZE(warp_g200_tgza) +
-		WARP_UCODE_SIZE(warp_g200_tgzaf) +
-		WARP_UCODE_SIZE(warp_g200_tgzf) +
-		WARP_UCODE_SIZE(warp_g200_tgzs) +
-		WARP_UCODE_SIZE(warp_g200_tgzsa) +
-		WARP_UCODE_SIZE(warp_g200_tgzsaf) +
-		WARP_UCODE_SIZE(warp_g200_tgzsf));
-
-
-unsigned int mga_warp_microcode_size(const drm_mga_private_t * dev_priv)
+
+static unsigned int mga_warp_g400_microcode_size( drm_mga_private_t *dev_priv )
 {
-	switch (dev_priv->chipset) {
-	case MGA_CARD_TYPE_G400:
-	case MGA_CARD_TYPE_G550:
-		return PAGE_ALIGN(mga_warp_g400_microcode_size);
-	case MGA_CARD_TYPE_G200:
-		return PAGE_ALIGN(mga_warp_g200_microcode_size);
-	default:
-		return 0;
-	}
+	unsigned int size;
+
+	size = ( WARP_UCODE_SIZE( warp_g400_tgz ) +
+		 WARP_UCODE_SIZE( warp_g400_tgza ) +
+		 WARP_UCODE_SIZE( warp_g400_tgzaf ) +
+		 WARP_UCODE_SIZE( warp_g400_tgzf ) +
+		 WARP_UCODE_SIZE( warp_g400_tgzs ) +
+		 WARP_UCODE_SIZE( warp_g400_tgzsa ) +
+		 WARP_UCODE_SIZE( warp_g400_tgzsaf ) +
+		 WARP_UCODE_SIZE( warp_g400_tgzsf ) +
+		 WARP_UCODE_SIZE( warp_g400_t2gz ) +
+		 WARP_UCODE_SIZE( warp_g400_t2gza ) +
+		 WARP_UCODE_SIZE( warp_g400_t2gzaf ) +
+		 WARP_UCODE_SIZE( warp_g400_t2gzf ) +
+		 WARP_UCODE_SIZE( warp_g400_t2gzs ) +
+		 WARP_UCODE_SIZE( warp_g400_t2gzsa ) +
+		 WARP_UCODE_SIZE( warp_g400_t2gzsaf ) +
+		 WARP_UCODE_SIZE( warp_g400_t2gzsf ) );
+
+	size = PAGE_ALIGN( size );
+
+	DRM_DEBUG( "G400 ucode size = %d bytes\n", size );
+	return size;
+}
+
+static unsigned int mga_warp_g200_microcode_size( drm_mga_private_t *dev_priv )
+{
+	unsigned int size;
+
+	size = ( WARP_UCODE_SIZE( warp_g200_tgz ) +
+		 WARP_UCODE_SIZE( warp_g200_tgza ) +
+		 WARP_UCODE_SIZE( warp_g200_tgzaf ) +
+		 WARP_UCODE_SIZE( warp_g200_tgzf ) +
+		 WARP_UCODE_SIZE( warp_g200_tgzs ) +
+		 WARP_UCODE_SIZE( warp_g200_tgzsa ) +
+		 WARP_UCODE_SIZE( warp_g200_tgzsaf ) +
+		 WARP_UCODE_SIZE( warp_g200_tgzsf ) );
+
+	size = PAGE_ALIGN( size );
+
+	DRM_DEBUG( "G200 ucode size = %d bytes\n", size );
+	return size;
 }
 
 static int mga_warp_install_g400_microcode( drm_mga_private_t *dev_priv )
 {
 	unsigned char *vcbase = dev_priv->warp->handle;
 	unsigned long pcbase = dev_priv->warp->offset;
+	unsigned int size;
+
+	size = mga_warp_g400_microcode_size( dev_priv );
+	if ( size > dev_priv->warp->size ) {
+		DRM_ERROR( "microcode too large! (%u > %lu)\n",
+			   size, dev_priv->warp->size );
+		return DRM_ERR(ENOMEM);
+	}
 
 	memset( dev_priv->warp_pipe_phys, 0,
 		sizeof(dev_priv->warp_pipe_phys) );
@@ -123,36 +136,35 @@ static int mga_warp_install_g200_microcode( drm_mga_private_t *dev_priv )
 {
 	unsigned char *vcbase = dev_priv->warp->handle;
 	unsigned long pcbase = dev_priv->warp->offset;
+	unsigned int size;
+
+	size = mga_warp_g200_microcode_size( dev_priv );
+	if ( size > dev_priv->warp->size ) {
+		DRM_ERROR( "microcode too large! (%u > %lu)\n",
+			   size, dev_priv->warp->size );
+		return DRM_ERR(ENOMEM);
+	}
 
-	memset(dev_priv->warp_pipe_phys, 0, sizeof(dev_priv->warp_pipe_phys));
+	memset( dev_priv->warp_pipe_phys, 0,
+		sizeof(dev_priv->warp_pipe_phys) );
 
-	WARP_UCODE_INSTALL(warp_g200_tgz, MGA_WARP_TGZ);
-	WARP_UCODE_INSTALL(warp_g200_tgzf, MGA_WARP_TGZF);
-	WARP_UCODE_INSTALL(warp_g200_tgza, MGA_WARP_TGZA);
-	WARP_UCODE_INSTALL(warp_g200_tgzaf, MGA_WARP_TGZAF);
-	WARP_UCODE_INSTALL(warp_g200_tgzs, MGA_WARP_TGZS);
-	WARP_UCODE_INSTALL(warp_g200_tgzsf, MGA_WARP_TGZSF);
-	WARP_UCODE_INSTALL(warp_g200_tgzsa, MGA_WARP_TGZSA);
-	WARP_UCODE_INSTALL(warp_g200_tgzsaf, MGA_WARP_TGZSAF);
+	WARP_UCODE_INSTALL( warp_g200_tgz,	MGA_WARP_TGZ );
+	WARP_UCODE_INSTALL( warp_g200_tgzf,	MGA_WARP_TGZF );
+	WARP_UCODE_INSTALL( warp_g200_tgza,	MGA_WARP_TGZA );
+	WARP_UCODE_INSTALL( warp_g200_tgzaf,	MGA_WARP_TGZAF );
+	WARP_UCODE_INSTALL( warp_g200_tgzs,	MGA_WARP_TGZS );
+	WARP_UCODE_INSTALL( warp_g200_tgzsf,	MGA_WARP_TGZSF );
+	WARP_UCODE_INSTALL( warp_g200_tgzsa,	MGA_WARP_TGZSA );
+	WARP_UCODE_INSTALL( warp_g200_tgzsaf,	MGA_WARP_TGZSAF );
 
 	return 0;
 }
 
 int mga_warp_install_microcode(	drm_mga_private_t *dev_priv )
 {
-	const unsigned int size = mga_warp_microcode_size(dev_priv);
-
-	DRM_DEBUG("MGA ucode size = %d bytes\n", size);
-	if (size > dev_priv->warp->size) {
-		DRM_ERROR("microcode too large! (%u > %lu)\n",
-			  size, dev_priv->warp->size);
-		return DRM_ERR(ENOMEM);
-	}
-
-	switch (dev_priv->chipset) {
+	switch ( dev_priv->chipset ) {
 	case MGA_CARD_TYPE_G400:
-	case MGA_CARD_TYPE_G550:
-		return mga_warp_install_g400_microcode(dev_priv);
+		return mga_warp_install_g400_microcode( dev_priv );
 	case MGA_CARD_TYPE_G200:
 		return mga_warp_install_g200_microcode( dev_priv );
 	default:
@@ -170,11 +182,10 @@ int mga_warp_init( drm_mga_private_t *dev_priv )
 	 */
 	switch ( dev_priv->chipset ) {
 	case MGA_CARD_TYPE_G400:
-	case MGA_CARD_TYPE_G550:
-		MGA_WRITE(MGA_WIADDR2, MGA_WMODE_SUSPEND);
-		MGA_WRITE(MGA_WGETMSB, 0x00000E00);
-		MGA_WRITE(MGA_WVRTXSZ, 0x00001807);
-		MGA_WRITE(MGA_WACCEPTSEQ, 0x18000000);
+		MGA_WRITE( MGA_WIADDR2, MGA_WMODE_SUSPEND );
+		MGA_WRITE( MGA_WGETMSB, 0x00000E00 );
+		MGA_WRITE( MGA_WVRTXSZ, 0x00001807 );
+		MGA_WRITE( MGA_WACCEPTSEQ, 0x18000000 );
 		break;
 	case MGA_CARD_TYPE_G200:
 		MGA_WRITE( MGA_WIADDR, MGA_WMODE_SUSPEND );
diff --git a/trunk/drivers/char/drm/r128_cce.c b/trunk/drivers/char/drm/r128_cce.c
index 895152206b31..08ed8d01d9d9 100644
--- a/trunk/drivers/char/drm/r128_cce.c
+++ b/trunk/drivers/char/drm/r128_cce.c
@@ -326,8 +326,7 @@ static void r128_cce_init_ring_buffer( drm_device_t *dev,
 		ring_start = dev_priv->cce_ring->offset - dev->agp->base;
 	else
 #endif
-		ring_start = dev_priv->cce_ring->offset - 
-				(unsigned long)dev->sg->virtual;
+		ring_start = dev_priv->cce_ring->offset - dev->sg->handle;
 
 	R128_WRITE( R128_PM4_BUFFER_OFFSET, ring_start | R128_AGP_OFFSET );
 
@@ -488,7 +487,6 @@ static int r128_do_init_cce( drm_device_t *dev, drm_r128_init_t *init )
 		r128_do_cleanup_cce( dev );
 		return DRM_ERR(EINVAL);
 	}
-	dev->agp_buffer_token = init->buffers_offset;
 	dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
 	if(!dev->agp_buffer_map) {
 		DRM_ERROR("could not find dma buffer region!\n");
@@ -539,7 +537,7 @@ static int r128_do_init_cce( drm_device_t *dev, drm_r128_init_t *init )
 		dev_priv->cce_buffers_offset = dev->agp->base;
 	else
 #endif
-		dev_priv->cce_buffers_offset = (unsigned long)dev->sg->virtual;
+		dev_priv->cce_buffers_offset = dev->sg->handle;
 
 	dev_priv->ring.start = (u32 *)dev_priv->cce_ring->handle;
 	dev_priv->ring.end = ((u32 *)dev_priv->cce_ring->handle
diff --git a/trunk/drivers/char/drm/r128_drm.h b/trunk/drivers/char/drm/r128_drm.h
index b616cd3ed2cd..0cba17d1e0ff 100644
--- a/trunk/drivers/char/drm/r128_drm.h
+++ b/trunk/drivers/char/drm/r128_drm.h
@@ -215,7 +215,7 @@ typedef struct drm_r128_sarea {
 #define DRM_IOCTL_R128_INDIRECT   DRM_IOWR(DRM_COMMAND_BASE + DRM_R128_INDIRECT, drm_r128_indirect_t)
 #define DRM_IOCTL_R128_FULLSCREEN DRM_IOW( DRM_COMMAND_BASE + DRM_R128_FULLSCREEN, drm_r128_fullscreen_t)
 #define DRM_IOCTL_R128_CLEAR2     DRM_IOW( DRM_COMMAND_BASE + DRM_R128_CLEAR2, drm_r128_clear2_t)
-#define DRM_IOCTL_R128_GETPARAM   DRM_IOWR( DRM_COMMAND_BASE + DRM_R128_GETPARAM, drm_r128_getparam_t)
+#define DRM_IOCTL_R128_GETPARAM   DRM_IOW( DRM_COMMAND_BASE + DRM_R128_GETPARAM, drm_r128_getparam_t)
 #define DRM_IOCTL_R128_FLIP       DRM_IO(  DRM_COMMAND_BASE + DRM_R128_FLIP)
 
 typedef struct drm_r128_init {
diff --git a/trunk/drivers/char/drm/r300_cmdbuf.c b/trunk/drivers/char/drm/r300_cmdbuf.c
deleted file mode 100644
index 623f1f460cb5..000000000000
--- a/trunk/drivers/char/drm/r300_cmdbuf.c
+++ /dev/null
@@ -1,801 +0,0 @@
-/* r300_cmdbuf.c -- Command buffer emission for R300 -*- linux-c -*-
- *
- * Copyright (C) The Weather Channel, Inc.  2002.
- * Copyright (C) 2004 Nicolai Haehnle.
- * All Rights Reserved.
- *
- * The Weather Channel (TM) funded Tungsten Graphics to develop the
- * initial release of the Radeon 8500 driver under the XFree86 license.
- * This notice must be preserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
- *
- * Authors:
- *    Nicolai Haehnle <prefect_@gmx.net>
- */
-
-#include "drmP.h"
-#include "drm.h"
-#include "radeon_drm.h"
-#include "radeon_drv.h"
-#include "r300_reg.h"
-
-
-#define R300_SIMULTANEOUS_CLIPRECTS		4
-
-/* Values for R300_RE_CLIPRECT_CNTL depending on the number of cliprects
- */
-static const int r300_cliprect_cntl[4] = {
-	0xAAAA,
-	0xEEEE,
-	0xFEFE,
-	0xFFFE
-};
-
-
-/**
- * Emit up to R300_SIMULTANEOUS_CLIPRECTS cliprects from the given command
- * buffer, starting with index n.
- */
-static int r300_emit_cliprects(drm_radeon_private_t* dev_priv,
-			       drm_radeon_cmd_buffer_t* cmdbuf,
-			       int n)
-{
-	drm_clip_rect_t box;
-	int nr;
-	int i;
-	RING_LOCALS;
-
-	nr = cmdbuf->nbox - n;
-	if (nr > R300_SIMULTANEOUS_CLIPRECTS)
-		nr = R300_SIMULTANEOUS_CLIPRECTS;
-
-	DRM_DEBUG("%i cliprects\n", nr);
-
-	if (nr) {
-		BEGIN_RING(6 + nr*2);
-		OUT_RING( CP_PACKET0( R300_RE_CLIPRECT_TL_0, nr*2 - 1 ) );
-
-		for(i = 0; i < nr; ++i) {
-			if (DRM_COPY_FROM_USER_UNCHECKED(&box, &cmdbuf->boxes[n+i], sizeof(box))) {
-				DRM_ERROR("copy cliprect faulted\n");
-				return DRM_ERR(EFAULT);
-			}
-
-			box.x1 = (box.x1 + R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
-			box.y1 = (box.y1 + R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
-			box.x2 = (box.x2 + R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
-			box.y2 = (box.y2 + R300_CLIPRECT_OFFSET) & R300_CLIPRECT_MASK;
-
-			OUT_RING((box.x1 << R300_CLIPRECT_X_SHIFT) |
-					(box.y1 << R300_CLIPRECT_Y_SHIFT));
-			OUT_RING((box.x2 << R300_CLIPRECT_X_SHIFT) |
-					(box.y2 << R300_CLIPRECT_Y_SHIFT));
-		}
-
-		OUT_RING_REG( R300_RE_CLIPRECT_CNTL, r300_cliprect_cntl[nr-1] );
-
-		/* TODO/SECURITY: Force scissors to a safe value, otherwise the
-		* client might be able to trample over memory.
-		* The impact should be very limited, but I'd rather be safe than
-		* sorry.
-		*/
-		OUT_RING( CP_PACKET0( R300_RE_SCISSORS_TL, 1 ) );
-		OUT_RING( 0 );
-		OUT_RING( R300_SCISSORS_X_MASK | R300_SCISSORS_Y_MASK );
-		ADVANCE_RING();
-		} else {
-		/* Why we allow zero cliprect rendering:
-		 * There are some commands in a command buffer that must be submitted
-		 * even when there are no cliprects, e.g. DMA buffer discard
-		 * or state setting (though state setting could be avoided by
-		 * simulating a loss of context).
-		 *
-		 * Now since the cmdbuf interface is so chaotic right now (and is
-		 * bound to remain that way for a bit until things settle down),
-		 * it is basically impossible to filter out the commands that are
-		 * necessary and those that aren't.
-		 *
-		 * So I choose the safe way and don't do any filtering at all;
-		 * instead, I simply set up the engine so that all rendering
-		 * can't produce any fragments.
-		 */
-		BEGIN_RING(2);
-		OUT_RING_REG( R300_RE_CLIPRECT_CNTL, 0 );
-		ADVANCE_RING();
-		}
-
-	return 0;
-}
-
-u8  r300_reg_flags[0x10000>>2];
-
-
-void r300_init_reg_flags(void)
-{
-	int i;
-	memset(r300_reg_flags, 0, 0x10000>>2);
-	#define ADD_RANGE_MARK(reg, count,mark) \
-		for(i=((reg)>>2);i<((reg)>>2)+(count);i++)\
-			r300_reg_flags[i]|=(mark);
-	
-	#define MARK_SAFE		1
-	#define MARK_CHECK_OFFSET	2
-	
-	#define ADD_RANGE(reg, count)	ADD_RANGE_MARK(reg, count, MARK_SAFE)
-
-	/* these match cmducs() command in r300_driver/r300/r300_cmdbuf.c */
-	ADD_RANGE(R300_SE_VPORT_XSCALE, 6);
-	ADD_RANGE(0x2080, 1);
-	ADD_RANGE(R300_SE_VTE_CNTL, 2);
-	ADD_RANGE(0x2134, 2);
-	ADD_RANGE(0x2140, 1);
-	ADD_RANGE(R300_VAP_INPUT_CNTL_0, 2);
-	ADD_RANGE(0x21DC, 1);
-	ADD_RANGE(0x221C, 1);
-	ADD_RANGE(0x2220, 4);
-	ADD_RANGE(0x2288, 1);
-	ADD_RANGE(R300_VAP_OUTPUT_VTX_FMT_0, 2);
-	ADD_RANGE(R300_VAP_PVS_CNTL_1, 3);
-	ADD_RANGE(R300_GB_ENABLE, 1);
-	ADD_RANGE(R300_GB_MSPOS0, 5);
-	ADD_RANGE(R300_TX_ENABLE, 1);
-	ADD_RANGE(0x4200, 4);
-	ADD_RANGE(0x4214, 1);
-	ADD_RANGE(R300_RE_POINTSIZE, 1);
-	ADD_RANGE(0x4230, 3);
-	ADD_RANGE(R300_RE_LINE_CNT, 1);
-	ADD_RANGE(0x4238, 1);
-	ADD_RANGE(0x4260, 3);
-	ADD_RANGE(0x4274, 4);
-	ADD_RANGE(0x4288, 5);
-	ADD_RANGE(0x42A0, 1);
-	ADD_RANGE(R300_RE_ZBIAS_T_FACTOR, 4);
-	ADD_RANGE(0x42B4, 1);
-	ADD_RANGE(R300_RE_CULL_CNTL, 1);
-	ADD_RANGE(0x42C0, 2);
-	ADD_RANGE(R300_RS_CNTL_0, 2);
-	ADD_RANGE(R300_RS_INTERP_0, 8);
-	ADD_RANGE(R300_RS_ROUTE_0, 8);
-	ADD_RANGE(0x43A4, 2);
-	ADD_RANGE(0x43E8, 1);
-	ADD_RANGE(R300_PFS_CNTL_0, 3);
-	ADD_RANGE(R300_PFS_NODE_0, 4);
-	ADD_RANGE(R300_PFS_TEXI_0, 64);
-	ADD_RANGE(0x46A4, 5);
-	ADD_RANGE(R300_PFS_INSTR0_0, 64);
-	ADD_RANGE(R300_PFS_INSTR1_0, 64);
-	ADD_RANGE(R300_PFS_INSTR2_0, 64);
-	ADD_RANGE(R300_PFS_INSTR3_0, 64);
-	ADD_RANGE(0x4BC0, 1);
-	ADD_RANGE(0x4BC8, 3);
-	ADD_RANGE(R300_PP_ALPHA_TEST, 2);
-	ADD_RANGE(0x4BD8, 1);
-	ADD_RANGE(R300_PFS_PARAM_0_X, 64);
-	ADD_RANGE(0x4E00, 1);
-	ADD_RANGE(R300_RB3D_CBLEND, 2);
-	ADD_RANGE(R300_RB3D_COLORMASK, 1);
-	ADD_RANGE(0x4E10, 3);
-	ADD_RANGE_MARK(R300_RB3D_COLOROFFSET0, 1, MARK_CHECK_OFFSET); /* check offset */
-	ADD_RANGE(R300_RB3D_COLORPITCH0, 1);
-	ADD_RANGE(0x4E50, 9);
-	ADD_RANGE(0x4E88, 1);
-	ADD_RANGE(0x4EA0, 2);
-	ADD_RANGE(R300_RB3D_ZSTENCIL_CNTL_0, 3);
-	ADD_RANGE(0x4F10, 4);
-	ADD_RANGE_MARK(R300_RB3D_DEPTHOFFSET, 1, MARK_CHECK_OFFSET); /* check offset */
-	ADD_RANGE(R300_RB3D_DEPTHPITCH, 1); 
-	ADD_RANGE(0x4F28, 1);
-	ADD_RANGE(0x4F30, 2);
-	ADD_RANGE(0x4F44, 1);
-	ADD_RANGE(0x4F54, 1);
-
-	ADD_RANGE(R300_TX_FILTER_0, 16);
-	ADD_RANGE(R300_TX_UNK1_0, 16);
-	ADD_RANGE(R300_TX_SIZE_0, 16);
-	ADD_RANGE(R300_TX_FORMAT_0, 16);
-		/* Texture offset is dangerous and needs more checking */
-	ADD_RANGE_MARK(R300_TX_OFFSET_0, 16, MARK_CHECK_OFFSET);
-	ADD_RANGE(R300_TX_UNK4_0, 16);
-	ADD_RANGE(R300_TX_BORDER_COLOR_0, 16);
-
-	/* Sporadic registers used as primitives are emitted */
-	ADD_RANGE(0x4f18, 1);
-	ADD_RANGE(R300_RB3D_DSTCACHE_CTLSTAT, 1);
-	ADD_RANGE(R300_VAP_INPUT_ROUTE_0_0, 8);
-	ADD_RANGE(R300_VAP_INPUT_ROUTE_1_0, 8);
-
-}
-
-static __inline__ int r300_check_range(unsigned  reg, int count)
-{
-	int i;
-	if(reg & ~0xffff)return -1;
-	for(i=(reg>>2);i<(reg>>2)+count;i++)
-		if(r300_reg_flags[i]!=MARK_SAFE)return 1;
-	return 0;
-}
-
-  /* we expect offsets passed to the framebuffer to be either within video memory or
-      within AGP space */
-static __inline__ int r300_check_offset(drm_radeon_private_t* dev_priv, u32 offset)
-{
-	/* we realy want to check against end of video aperture
-		but this value is not being kept. 
-		This code is correct for now (does the same thing as the
-		code that sets MC_FB_LOCATION) in radeon_cp.c */
-	if((offset>=dev_priv->fb_location) && 
-		(offset<dev_priv->gart_vm_start))return 0;
-	if((offset>=dev_priv->gart_vm_start) &&
-		 (offset<dev_priv->gart_vm_start+dev_priv->gart_size))return 0;
-	return 1;
-}
-
-static __inline__ int r300_emit_carefully_checked_packet0(drm_radeon_private_t* dev_priv,
-						drm_radeon_cmd_buffer_t* cmdbuf,
-						drm_r300_cmd_header_t header)
-{
-	int reg;
-	int sz;
-	int i;
-	int values[64];
-	RING_LOCALS;
-
-	sz = header.packet0.count;
-	reg = (header.packet0.reghi << 8) | header.packet0.reglo;
-	
-	if((sz>64)||(sz<0)){
-		DRM_ERROR("Cannot emit more than 64 values at a time (reg=%04x sz=%d)\n", reg, sz);
-		return DRM_ERR(EINVAL);
-		}
-	for(i=0;i<sz;i++){
-		values[i]=((int __user*)cmdbuf->buf)[i];
-		switch(r300_reg_flags[(reg>>2)+i]){
-		case MARK_SAFE:
-			break;
-		case MARK_CHECK_OFFSET:
-			if(r300_check_offset(dev_priv, (u32)values[i])){
-				DRM_ERROR("Offset failed range check (reg=%04x sz=%d)\n", reg, sz);
-				return DRM_ERR(EINVAL);
-				}
-			break;
-		default:
-			DRM_ERROR("Register %04x failed check as flag=%02x\n", reg+i*4, r300_reg_flags[(reg>>2)+i]);
-			return DRM_ERR(EINVAL);
-			}
-		}
-		
-	BEGIN_RING(1+sz);
-	OUT_RING( CP_PACKET0( reg, sz-1 ) );
-	OUT_RING_TABLE( values, sz );
-	ADVANCE_RING();
-
-	cmdbuf->buf += sz*4;
-	cmdbuf->bufsz -= sz*4;
-
-	return 0;
-}
-
-/**
- * Emits a packet0 setting arbitrary registers.
- * Called by r300_do_cp_cmdbuf.
- *
- * Note that checks are performed on contents and addresses of the registers
- */
-static __inline__ int r300_emit_packet0(drm_radeon_private_t* dev_priv,
-						drm_radeon_cmd_buffer_t* cmdbuf,
-						drm_r300_cmd_header_t header)
-{
-	int reg;
-	int sz;
-	RING_LOCALS;
-
-	sz = header.packet0.count;
-	reg = (header.packet0.reghi << 8) | header.packet0.reglo;
-
-	if (!sz)
-		return 0;
-
-	if (sz*4 > cmdbuf->bufsz)
-		return DRM_ERR(EINVAL);
-		
-	if (reg+sz*4 >= 0x10000){
-		DRM_ERROR("No such registers in hardware reg=%04x sz=%d\n", reg, sz);
-		return DRM_ERR(EINVAL);
-		}
-
-	if(r300_check_range(reg, sz)){
-		/* go and check everything */
-		return r300_emit_carefully_checked_packet0(dev_priv, cmdbuf, header);
-		}
-	/* the rest of the data is safe to emit, whatever the values the user passed */
-
-	BEGIN_RING(1+sz);
-	OUT_RING( CP_PACKET0( reg, sz-1 ) );
-	OUT_RING_TABLE( (int __user*)cmdbuf->buf, sz );
-	ADVANCE_RING();
-
-	cmdbuf->buf += sz*4;
-	cmdbuf->bufsz -= sz*4;
-
-	return 0;
-}
-
-
-/**
- * Uploads user-supplied vertex program instructions or parameters onto
- * the graphics card.
- * Called by r300_do_cp_cmdbuf.
- */
-static __inline__ int r300_emit_vpu(drm_radeon_private_t* dev_priv,
-				    drm_radeon_cmd_buffer_t* cmdbuf,
-				    drm_r300_cmd_header_t header)
-{
-	int sz;
-	int addr;
-	RING_LOCALS;
-
-	sz = header.vpu.count;
-	addr = (header.vpu.adrhi << 8) | header.vpu.adrlo;
-
-	if (!sz)
-		return 0;
-	if (sz*16 > cmdbuf->bufsz)
-		return DRM_ERR(EINVAL);
-
-	BEGIN_RING(5+sz*4);
-	/* Wait for VAP to come to senses.. */
-	/* there is no need to emit it multiple times, (only once before VAP is programmed,
-	   but this optimization is for later */
-	OUT_RING_REG( R300_VAP_PVS_WAITIDLE, 0 );
-	OUT_RING_REG( R300_VAP_PVS_UPLOAD_ADDRESS, addr );
-	OUT_RING( CP_PACKET0_TABLE( R300_VAP_PVS_UPLOAD_DATA, sz*4 - 1 ) );
-	OUT_RING_TABLE( (int __user*)cmdbuf->buf, sz*4 );
-
-	ADVANCE_RING();
-
-	cmdbuf->buf += sz*16;
-	cmdbuf->bufsz -= sz*16;
-
-	return 0;
-}
-
-
-/**
- * Emit a clear packet from userspace.
- * Called by r300_emit_packet3.
- */
-static __inline__ int r300_emit_clear(drm_radeon_private_t* dev_priv,
-				      drm_radeon_cmd_buffer_t* cmdbuf)
-{
-	RING_LOCALS;
-
-	if (8*4 > cmdbuf->bufsz)
-		return DRM_ERR(EINVAL);
-
-	BEGIN_RING(10);
-	OUT_RING( CP_PACKET3( R200_3D_DRAW_IMMD_2, 8 ) );
-	OUT_RING( R300_PRIM_TYPE_POINT|R300_PRIM_WALK_RING|
-	          (1<<R300_PRIM_NUM_VERTICES_SHIFT) );
-	OUT_RING_TABLE( (int __user*)cmdbuf->buf, 8 );
-	ADVANCE_RING();
-
-	cmdbuf->buf += 8*4;
-	cmdbuf->bufsz -= 8*4;
-
-	return 0;
-}
-
-static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t* dev_priv,
-				      drm_radeon_cmd_buffer_t* cmdbuf,
-				      u32 header)
-{
-	int count, i,k;
-	#define MAX_ARRAY_PACKET  64
-	u32 payload[MAX_ARRAY_PACKET];
-	u32 narrays;
-	RING_LOCALS;
-
-	count=(header>>16) & 0x3fff;
-	
-	if((count+1)>MAX_ARRAY_PACKET){
-		DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n", count);
-		return DRM_ERR(EINVAL);
-		}
-	memset(payload, 0, MAX_ARRAY_PACKET*4);
-	memcpy(payload, cmdbuf->buf+4, (count+1)*4);	
-	
-	/* carefully check packet contents */
-	
-	narrays=payload[0];
-	k=0;
-	i=1;
-	while((k<narrays) && (i<(count+1))){
-		i++; /* skip attribute field */
-		if(r300_check_offset(dev_priv, payload[i])){
-			DRM_ERROR("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n", k, i);
-			return DRM_ERR(EINVAL);
-			}
-		k++;
-		i++;
-		if(k==narrays)break;
-		/* have one more to process, they come in pairs */
-		if(r300_check_offset(dev_priv, payload[i])){
-			DRM_ERROR("Offset failed range check (k=%d i=%d) while processing 3D_LOAD_VBPNTR packet.\n", k, i);
-			return DRM_ERR(EINVAL);
-			}
-		k++;
-		i++;			
-		}
-	/* do the counts match what we expect ? */
-	if((k!=narrays) || (i!=(count+1))){
-		DRM_ERROR("Malformed 3D_LOAD_VBPNTR packet (k=%d i=%d narrays=%d count+1=%d).\n", k, i, narrays, count+1);
-		return DRM_ERR(EINVAL);
-		}
-
-	/* all clear, output packet */
-
-	BEGIN_RING(count+2);
-	OUT_RING(header);
-	OUT_RING_TABLE(payload, count+1);
-	ADVANCE_RING();
-
-	cmdbuf->buf += (count+2)*4;
-	cmdbuf->bufsz -= (count+2)*4;
-
-	return 0;
-}
-
-static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t* dev_priv,
-				      drm_radeon_cmd_buffer_t* cmdbuf)
-{
-	u32 header;
-	int count;
-	RING_LOCALS;
-
-	if (4 > cmdbuf->bufsz)
-		return DRM_ERR(EINVAL);
-
-        /* Fixme !! This simply emits a packet without much checking.
-	   We need to be smarter. */
-
-	/* obtain first word - actual packet3 header */
-	header = *(u32 __user*)cmdbuf->buf;
-
-	/* Is it packet 3 ? */
-	if( (header>>30)!=0x3 ) {
-		DRM_ERROR("Not a packet3 header (0x%08x)\n", header);
-		return DRM_ERR(EINVAL);
-		}
-
-	count=(header>>16) & 0x3fff;
-
-	/* Check again now that we know how much data to expect */
-	if ((count+2)*4 > cmdbuf->bufsz){
-		DRM_ERROR("Expected packet3 of length %d but have only %d bytes left\n",
-			(count+2)*4, cmdbuf->bufsz);
-		return DRM_ERR(EINVAL);
-		}
-
-	/* Is it a packet type we know about ? */
-	switch(header & 0xff00){
-	case RADEON_3D_LOAD_VBPNTR: /* load vertex array pointers */
-		return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);
-
-	case RADEON_CP_3D_DRAW_IMMD_2: /* triggers drawing using in-packet vertex data */
-	case RADEON_CP_3D_DRAW_VBUF_2: /* triggers drawing of vertex buffers setup elsewhere */
-	case RADEON_CP_3D_DRAW_INDX_2: /* triggers drawing using indices to vertex buffer */
-	case RADEON_CP_INDX_BUFFER: /* DRAW_INDX_2 without INDX_BUFFER seems to lock up the gpu */
-	case RADEON_WAIT_FOR_IDLE:
-	case RADEON_CP_NOP:
-		/* these packets are safe */
-		break;
-	default:
-		DRM_ERROR("Unknown packet3 header (0x%08x)\n", header);
-		return DRM_ERR(EINVAL);
-		}
-
-
-	BEGIN_RING(count+2);
-	OUT_RING(header);
-	OUT_RING_TABLE( (int __user*)(cmdbuf->buf+4), count+1);
-	ADVANCE_RING();
-
-	cmdbuf->buf += (count+2)*4;
-	cmdbuf->bufsz -= (count+2)*4;
-
-	return 0;
-}
-
-
-/**
- * Emit a rendering packet3 from userspace.
- * Called by r300_do_cp_cmdbuf.
- */
-static __inline__ int r300_emit_packet3(drm_radeon_private_t* dev_priv,
-					drm_radeon_cmd_buffer_t* cmdbuf,
-					drm_r300_cmd_header_t header)
-{
-	int n;
-	int ret;
-	char __user* orig_buf = cmdbuf->buf;
-	int orig_bufsz = cmdbuf->bufsz;
-
-	/* This is a do-while-loop so that we run the interior at least once,
-	 * even if cmdbuf->nbox is 0. Compare r300_emit_cliprects for rationale.
-	 */
-	n = 0;
-	do {
-		if (cmdbuf->nbox > R300_SIMULTANEOUS_CLIPRECTS) {
-			ret = r300_emit_cliprects(dev_priv, cmdbuf, n);
-			if (ret)
-				return ret;
-
-			cmdbuf->buf = orig_buf;
-			cmdbuf->bufsz = orig_bufsz;
-			}
-
-		switch(header.packet3.packet) {
-		case R300_CMD_PACKET3_CLEAR:
-			DRM_DEBUG("R300_CMD_PACKET3_CLEAR\n");
-			ret = r300_emit_clear(dev_priv, cmdbuf);
-			if (ret) {
-				DRM_ERROR("r300_emit_clear failed\n");
-				return ret;
-				}
-			break;
-
-		case R300_CMD_PACKET3_RAW:
-			DRM_DEBUG("R300_CMD_PACKET3_RAW\n");
-			ret = r300_emit_raw_packet3(dev_priv, cmdbuf);
-			if (ret) {
-				DRM_ERROR("r300_emit_raw_packet3 failed\n");
-				return ret;
-				}
-			break;
-
-		default:
-			DRM_ERROR("bad packet3 type %i at %p\n",
-				header.packet3.packet,
-				cmdbuf->buf - sizeof(header));
-			return DRM_ERR(EINVAL);
-			}
-
-		n += R300_SIMULTANEOUS_CLIPRECTS;
-	} while(n < cmdbuf->nbox);
-
-	return 0;
-}
-
-/* Some of the R300 chips seem to be extremely touchy about the two registers
- * that are configured in r300_pacify.
- * Among the worst offenders seems to be the R300 ND (0x4E44): When userspace
- * sends a command buffer that contains only state setting commands and a
- * vertex program/parameter upload sequence, this will eventually lead to a
- * lockup, unless the sequence is bracketed by calls to r300_pacify.
- * So we should take great care to *always* call r300_pacify before
- * *anything* 3D related, and again afterwards. This is what the
- * call bracket in r300_do_cp_cmdbuf is for.
- */
-
-/**
- * Emit the sequence to pacify R300.
- */
-static __inline__ void r300_pacify(drm_radeon_private_t* dev_priv)
-{
-	RING_LOCALS;
-
-	BEGIN_RING(6);
-	OUT_RING( CP_PACKET0( R300_RB3D_DSTCACHE_CTLSTAT, 0 ) );
-	OUT_RING( 0xa );
-	OUT_RING( CP_PACKET0( 0x4f18, 0 ) );
-	OUT_RING( 0x3 );
-	OUT_RING( CP_PACKET3( RADEON_CP_NOP, 0 ) );
-	OUT_RING( 0x0 );
-	ADVANCE_RING();
-}
-
-
-/**
- * Called by r300_do_cp_cmdbuf to update the internal buffer age and state.
- * The actual age emit is done by r300_do_cp_cmdbuf, which is why you must
- * be careful about how this function is called.
- */
-static void r300_discard_buffer(drm_device_t * dev, drm_buf_t * buf)
-{
-	drm_radeon_private_t *dev_priv = dev->dev_private;
-	drm_radeon_buf_priv_t *buf_priv = buf->dev_private;
-
-	buf_priv->age = ++dev_priv->sarea_priv->last_dispatch;
-	buf->pending = 1;
-	buf->used = 0;
-}
-
-
-/**
- * Parses and validates a user-supplied command buffer and emits appropriate
- * commands on the DMA ring buffer.
- * Called by the ioctl handler function radeon_cp_cmdbuf.
- */
-int r300_do_cp_cmdbuf(drm_device_t* dev,
-			  DRMFILE filp,
-		      drm_file_t* filp_priv,
-		      drm_radeon_cmd_buffer_t* cmdbuf)
-{
-	drm_radeon_private_t *dev_priv = dev->dev_private;
-        drm_device_dma_t *dma = dev->dma;
-        drm_buf_t *buf = NULL;
-	int emit_dispatch_age = 0;
-	int ret = 0;
-
-	DRM_DEBUG("\n");
-
-	/* See the comment above r300_emit_begin3d for why this call must be here,
-	 * and what the cleanup gotos are for. */
-	r300_pacify(dev_priv);
-
-	if (cmdbuf->nbox <= R300_SIMULTANEOUS_CLIPRECTS) {
-		ret = r300_emit_cliprects(dev_priv, cmdbuf, 0);
-		if (ret)
-			goto cleanup;
-		}
-
-	while(cmdbuf->bufsz >= sizeof(drm_r300_cmd_header_t)) {
-		int idx;
-		drm_r300_cmd_header_t header;
-
-		header.u = *(unsigned int *)cmdbuf->buf;
-
-		cmdbuf->buf += sizeof(header);
-		cmdbuf->bufsz -= sizeof(header);
-
-		switch(header.header.cmd_type) {
-		case R300_CMD_PACKET0: 
-			DRM_DEBUG("R300_CMD_PACKET0\n");
-			ret = r300_emit_packet0(dev_priv, cmdbuf, header);
-			if (ret) {
-				DRM_ERROR("r300_emit_packet0 failed\n");
-				goto cleanup;
-				}
-			break;
-
-		case R300_CMD_VPU:
-			DRM_DEBUG("R300_CMD_VPU\n");
-			ret = r300_emit_vpu(dev_priv, cmdbuf, header);
-			if (ret) {
-				DRM_ERROR("r300_emit_vpu failed\n");
-				goto cleanup;
-				}
-			break;
-
-		case R300_CMD_PACKET3:
-			DRM_DEBUG("R300_CMD_PACKET3\n");
-			ret = r300_emit_packet3(dev_priv, cmdbuf, header);
-			if (ret) {
-				DRM_ERROR("r300_emit_packet3 failed\n");
-				goto cleanup;
-				}
-			break;
-
-		case R300_CMD_END3D:
-			DRM_DEBUG("R300_CMD_END3D\n");
-			/* TODO: 
-				Ideally userspace driver should not need to issue this call, 
-				i.e. the drm driver should issue it automatically and prevent
-				lockups.
-				
-				In practice, we do not understand why this call is needed and what
-				it does (except for some vague guesses that it has to do with cache
-				coherence) and so the user space driver does it. 
-				
-				Once we are sure which uses prevent lockups the code could be moved
-				into the kernel and the userspace driver will not
-				need to use this command.
-
-				Note that issuing this command does not hurt anything
-				except, possibly, performance */
-			r300_pacify(dev_priv);
-			break;
-
-		case R300_CMD_CP_DELAY:
-			/* simple enough, we can do it here */
-			DRM_DEBUG("R300_CMD_CP_DELAY\n");
-			{
-				int i;
-				RING_LOCALS;
-
-				BEGIN_RING(header.delay.count);
-				for(i=0;i<header.delay.count;i++)
-					OUT_RING(RADEON_CP_PACKET2);
-				ADVANCE_RING();
-			}
-			break;
-
-		case R300_CMD_DMA_DISCARD:
-			DRM_DEBUG("RADEON_CMD_DMA_DISCARD\n");
-            		idx = header.dma.buf_idx;
-            		if (idx < 0 || idx >= dma->buf_count) {
-                		DRM_ERROR("buffer index %d (of %d max)\n",
-                      			idx, dma->buf_count - 1);
-				ret = DRM_ERR(EINVAL);
-                		goto cleanup;
-            			}
-
-	                buf = dma->buflist[idx];
-            		if (buf->filp != filp || buf->pending) {
-                		DRM_ERROR("bad buffer %p %p %d\n",
-                      		buf->filp, filp, buf->pending);
-                		ret = DRM_ERR(EINVAL);
-				goto cleanup;
-            			}
-
-			emit_dispatch_age = 1;
-			r300_discard_buffer(dev, buf);
-            		break;
-
-		case R300_CMD_WAIT:
-			/* simple enough, we can do it here */
-			DRM_DEBUG("R300_CMD_WAIT\n");
-			if(header.wait.flags==0)break; /* nothing to do */
-
-			{
-				RING_LOCALS;
-
-				BEGIN_RING(2);
-				OUT_RING( CP_PACKET0( RADEON_WAIT_UNTIL, 0 ) );
-				OUT_RING( (header.wait.flags & 0xf)<<14 );
-				ADVANCE_RING();
-			}
-			break;
-
-		default:
-			DRM_ERROR("bad cmd_type %i at %p\n",
-			          header.header.cmd_type,
-				  cmdbuf->buf - sizeof(header));
-			ret = DRM_ERR(EINVAL);
-			goto cleanup;
-			}
-	}
-
-	DRM_DEBUG("END\n");
-
-cleanup:
-	r300_pacify(dev_priv);
-
-	/* We emit the vertex buffer age here, outside the pacifier "brackets"
-	 * for two reasons:
-	 *  (1) This may coalesce multiple age emissions into a single one and
-	 *  (2) more importantly, some chips lock up hard when scratch registers
-	 *      are written inside the pacifier bracket.
-	 */
-	if (emit_dispatch_age) {
-		RING_LOCALS;
-
-		/* Emit the vertex buffer age */
-		BEGIN_RING(2);
-		RADEON_DISPATCH_AGE(dev_priv->sarea_priv->last_dispatch);
-		ADVANCE_RING();
-		}
-
-	COMMIT_RING();
-
-	return ret;
-}
-
diff --git a/trunk/drivers/char/drm/r300_reg.h b/trunk/drivers/char/drm/r300_reg.h
deleted file mode 100644
index c3e7ca3dbe3d..000000000000
--- a/trunk/drivers/char/drm/r300_reg.h
+++ /dev/null
@@ -1,1412 +0,0 @@
-/**************************************************************************
-
-Copyright (C) 2004-2005 Nicolai Haehnle et al.
-
-Permission is hereby granted, free of charge, to any person obtaining a
-copy of this software and associated documentation files (the "Software"),
-to deal in the Software without restriction, including without limitation
-on the rights to use, copy, modify, merge, publish, distribute, sub
-license, and/or sell copies of the Software, and to permit persons to whom
-the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice (including the next
-paragraph) shall be included in all copies or substantial portions of the
-Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
-THE AUTHOR(S) AND/OR THEIR SUPPLIERS BE LIABLE FOR ANY CLAIM,
-DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-**************************************************************************/
-
-#ifndef _R300_REG_H
-#define _R300_REG_H
-
-#define R300_MC_INIT_MISC_LAT_TIMER	0x180
-#	define R300_MC_MISC__MC_CPR_INIT_LAT_SHIFT	0
-#	define R300_MC_MISC__MC_VF_INIT_LAT_SHIFT	4
-#	define R300_MC_MISC__MC_DISP0R_INIT_LAT_SHIFT	8
-#	define R300_MC_MISC__MC_DISP1R_INIT_LAT_SHIFT	12
-#	define R300_MC_MISC__MC_FIXED_INIT_LAT_SHIFT	16
-#	define R300_MC_MISC__MC_E2R_INIT_LAT_SHIFT	20
-#	define R300_MC_MISC__MC_SAME_PAGE_PRIO_SHIFT	24
-#	define R300_MC_MISC__MC_GLOBW_INIT_LAT_SHIFT	28
-
-
-#define R300_MC_INIT_GFX_LAT_TIMER	0x154
-#	define R300_MC_MISC__MC_G3D0R_INIT_LAT_SHIFT	0
-#	define R300_MC_MISC__MC_G3D1R_INIT_LAT_SHIFT	4
-#	define R300_MC_MISC__MC_G3D2R_INIT_LAT_SHIFT	8
-#	define R300_MC_MISC__MC_G3D3R_INIT_LAT_SHIFT	12
-#	define R300_MC_MISC__MC_TX0R_INIT_LAT_SHIFT	16
-#	define R300_MC_MISC__MC_TX1R_INIT_LAT_SHIFT	20
-#	define R300_MC_MISC__MC_GLOBR_INIT_LAT_SHIFT	24
-#	define R300_MC_MISC__MC_GLOBW_FULL_LAT_SHIFT	28
-
-/*
-This file contains registers and constants for the R300. They have been
-found mostly by examining command buffers captured using glxtest, as well
-as by extrapolating some known registers and constants from the R200.
-
-I am fairly certain that they are correct unless stated otherwise in comments.
-*/
-
-#define R300_SE_VPORT_XSCALE                0x1D98
-#define R300_SE_VPORT_XOFFSET               0x1D9C
-#define R300_SE_VPORT_YSCALE                0x1DA0
-#define R300_SE_VPORT_YOFFSET               0x1DA4
-#define R300_SE_VPORT_ZSCALE                0x1DA8
-#define R300_SE_VPORT_ZOFFSET               0x1DAC
-
-
-/* This register is written directly and also starts data section in many 3d CP_PACKET3's */
-#define R300_VAP_VF_CNTL	0x2084
-
-#	define	R300_VAP_VF_CNTL__PRIM_TYPE__SHIFT                       0
-#	define  R300_VAP_VF_CNTL__PRIM_NONE				 (0<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_POINTS				 (1<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_LINES				 (2<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_LINE_STRIP			 (3<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_TRIANGLES			 (4<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_TRIANGLE_FAN			 (5<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_TRIANGLE_STRIP			 (6<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_LINE_LOOP			 (12<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_QUADS			 	 (13<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_QUAD_STRIP			 (14<<0)
-#	define  R300_VAP_VF_CNTL__PRIM_POLYGON			 	 (15<<0)
-
-#	define	R300_VAP_VF_CNTL__PRIM_WALK__SHIFT                       4
-	/* State based - direct writes to registers trigger vertex generation */
-#	define	R300_VAP_VF_CNTL__PRIM_WALK_STATE_BASED                      (0<<4)
-#	define	R300_VAP_VF_CNTL__PRIM_WALK_INDICES                          (1<<4)
-#	define	R300_VAP_VF_CNTL__PRIM_WALK_VERTEX_LIST                      (2<<4)
-#	define	R300_VAP_VF_CNTL__PRIM_WALK_VERTEX_EMBEDDED                  (3<<4)
-
-		/* I don't think I saw these three used.. */
-#	define	R300_VAP_VF_CNTL__COLOR_ORDER__SHIFT                     6
-#	define	R300_VAP_VF_CNTL__TCL_OUTPUT_CTL_ENA__SHIFT              9
-#	define	R300_VAP_VF_CNTL__PROG_STREAM_ENA__SHIFT                 10
-
-		/* index size - when not set the indices are assumed to be 16 bit */
-#	define	R300_VAP_VF_CNTL__INDEX_SIZE_32bit                      (1<<11)
-                /* number of vertices */
-#	define	R300_VAP_VF_CNTL__NUM_VERTICES__SHIFT                    16
-
-/* BEGIN: Wild guesses */
-#define R300_VAP_OUTPUT_VTX_FMT_0           0x2090
-#       define R300_VAP_OUTPUT_VTX_FMT_0__POS_PRESENT     (1<<0)
-#       define R300_VAP_OUTPUT_VTX_FMT_0__COLOR_PRESENT   (1<<1)
-#       define R300_VAP_OUTPUT_VTX_FMT_0__COLOR_1_PRESENT (1<<2) /* GUESS */
-#       define R300_VAP_OUTPUT_VTX_FMT_0__COLOR_2_PRESENT (1<<3) /* GUESS */
-#       define R300_VAP_OUTPUT_VTX_FMT_0__COLOR_3_PRESENT (1<<4) /* GUESS */
-#       define R300_VAP_OUTPUT_VTX_FMT_0__PT_SIZE_PRESENT (1<<16) /* GUESS */
-
-#define R300_VAP_OUTPUT_VTX_FMT_1           0x2094
-#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_0_COMP_CNT_SHIFT 0
-#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_1_COMP_CNT_SHIFT 3
-#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_2_COMP_CNT_SHIFT 6
-#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_3_COMP_CNT_SHIFT 9
-#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_4_COMP_CNT_SHIFT 12
-#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_5_COMP_CNT_SHIFT 15
-#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_6_COMP_CNT_SHIFT 18
-#       define R300_VAP_OUTPUT_VTX_FMT_1__TEX_7_COMP_CNT_SHIFT 21
-/* END */
-
-#define R300_SE_VTE_CNTL                  0x20b0
-#	define     R300_VPORT_X_SCALE_ENA                0x00000001
-#	define     R300_VPORT_X_OFFSET_ENA               0x00000002
-#	define     R300_VPORT_Y_SCALE_ENA                0x00000004
-#	define     R300_VPORT_Y_OFFSET_ENA               0x00000008
-#	define     R300_VPORT_Z_SCALE_ENA                0x00000010
-#	define     R300_VPORT_Z_OFFSET_ENA               0x00000020
-#	define     R300_VTX_XY_FMT                       0x00000100
-#	define     R300_VTX_Z_FMT                        0x00000200
-#	define     R300_VTX_W0_FMT                       0x00000400
-#	define     R300_VTX_W0_NORMALIZE                 0x00000800
-#	define     R300_VTX_ST_DENORMALIZED              0x00001000
-
-/* BEGIN: Vertex data assembly - lots of uncertainties */
-/* gap */
-/* Where do we get our vertex data?
-//
-// Vertex data either comes either from immediate mode registers or from
-// vertex arrays.
-// There appears to be no mixed mode (though we can force the pitch of
-// vertex arrays to 0, effectively reusing the same element over and over
-// again).
-//
-// Immediate mode is controlled by the INPUT_CNTL registers. I am not sure
-// if these registers influence vertex array processing.
-//
-// Vertex arrays are controlled via the 3D_LOAD_VBPNTR packet3.
-//
-// In both cases, vertex attributes are then passed through INPUT_ROUTE.
-
-// Beginning with INPUT_ROUTE_0_0 is a list of WORDs that route vertex data
-// into the vertex processor's input registers.
-// The first word routes the first input, the second word the second, etc.
-// The corresponding input is routed into the register with the given index.
-// The list is ended by a word with INPUT_ROUTE_END set.
-//
-// Always set COMPONENTS_4 in immediate mode. */
-
-#define R300_VAP_INPUT_ROUTE_0_0            0x2150
-#       define R300_INPUT_ROUTE_COMPONENTS_1     (0 << 0)
-#       define R300_INPUT_ROUTE_COMPONENTS_2     (1 << 0)
-#       define R300_INPUT_ROUTE_COMPONENTS_3     (2 << 0)
-#       define R300_INPUT_ROUTE_COMPONENTS_4     (3 << 0)
-#       define R300_INPUT_ROUTE_COMPONENTS_RGBA  (4 << 0) /* GUESS */
-#       define R300_VAP_INPUT_ROUTE_IDX_SHIFT    8
-#       define R300_VAP_INPUT_ROUTE_IDX_MASK     (31 << 8) /* GUESS */
-#       define R300_VAP_INPUT_ROUTE_END          (1 << 13)
-#       define R300_INPUT_ROUTE_IMMEDIATE_MODE   (0 << 14) /* GUESS */
-#       define R300_INPUT_ROUTE_FLOAT            (1 << 14) /* GUESS */
-#       define R300_INPUT_ROUTE_UNSIGNED_BYTE    (2 << 14) /* GUESS */
-#       define R300_INPUT_ROUTE_FLOAT_COLOR      (3 << 14) /* GUESS */
-#define R300_VAP_INPUT_ROUTE_0_1            0x2154
-#define R300_VAP_INPUT_ROUTE_0_2            0x2158
-#define R300_VAP_INPUT_ROUTE_0_3            0x215C
-#define R300_VAP_INPUT_ROUTE_0_4            0x2160
-#define R300_VAP_INPUT_ROUTE_0_5            0x2164
-#define R300_VAP_INPUT_ROUTE_0_6            0x2168
-#define R300_VAP_INPUT_ROUTE_0_7            0x216C
-
-/* gap */
-/* Notes:
-//  - always set up to produce at least two attributes:
-//    if vertex program uses only position, fglrx will set normal, too
-//  - INPUT_CNTL_0_COLOR and INPUT_CNTL_COLOR bits are always equal */
-#define R300_VAP_INPUT_CNTL_0               0x2180
-#       define R300_INPUT_CNTL_0_COLOR           0x00000001
-#define R300_VAP_INPUT_CNTL_1               0x2184
-#       define R300_INPUT_CNTL_POS               0x00000001
-#       define R300_INPUT_CNTL_NORMAL            0x00000002
-#       define R300_INPUT_CNTL_COLOR             0x00000004
-#       define R300_INPUT_CNTL_TC0               0x00000400
-#       define R300_INPUT_CNTL_TC1               0x00000800
-#       define R300_INPUT_CNTL_TC2               0x00001000 /* GUESS */
-#       define R300_INPUT_CNTL_TC3               0x00002000 /* GUESS */
-#       define R300_INPUT_CNTL_TC4               0x00004000 /* GUESS */
-#       define R300_INPUT_CNTL_TC5               0x00008000 /* GUESS */
-#       define R300_INPUT_CNTL_TC6               0x00010000 /* GUESS */
-#       define R300_INPUT_CNTL_TC7               0x00020000 /* GUESS */
-
-/* gap */
-/* Words parallel to INPUT_ROUTE_0; All words that are active in INPUT_ROUTE_0
-// are set to a swizzling bit pattern, other words are 0.
-//
-// In immediate mode, the pattern is always set to xyzw. In vertex array
-// mode, the swizzling pattern is e.g. used to set zw components in texture
-// coordinates with only tweo components. */
-#define R300_VAP_INPUT_ROUTE_1_0            0x21E0
-#       define R300_INPUT_ROUTE_SELECT_X    0
-#       define R300_INPUT_ROUTE_SELECT_Y    1
-#       define R300_INPUT_ROUTE_SELECT_Z    2
-#       define R300_INPUT_ROUTE_SELECT_W    3
-#       define R300_INPUT_ROUTE_SELECT_ZERO 4
-#       define R300_INPUT_ROUTE_SELECT_ONE  5
-#       define R300_INPUT_ROUTE_SELECT_MASK 7
-#       define R300_INPUT_ROUTE_X_SHIFT          0
-#       define R300_INPUT_ROUTE_Y_SHIFT          3
-#       define R300_INPUT_ROUTE_Z_SHIFT          6
-#       define R300_INPUT_ROUTE_W_SHIFT          9
-#       define R300_INPUT_ROUTE_ENABLE           (15 << 12)
-#define R300_VAP_INPUT_ROUTE_1_1            0x21E4
-#define R300_VAP_INPUT_ROUTE_1_2            0x21E8
-#define R300_VAP_INPUT_ROUTE_1_3            0x21EC
-#define R300_VAP_INPUT_ROUTE_1_4            0x21F0
-#define R300_VAP_INPUT_ROUTE_1_5            0x21F4
-#define R300_VAP_INPUT_ROUTE_1_6            0x21F8
-#define R300_VAP_INPUT_ROUTE_1_7            0x21FC
-
-/* END */
-
-/* gap */
-/* BEGIN: Upload vertex program and data
-// The programmable vertex shader unit has a memory bank of unknown size
-// that can be written to in 16 byte units by writing the address into
-// UPLOAD_ADDRESS, followed by data in UPLOAD_DATA (multiples of 4 DWORDs).
-//
-// Pointers into the memory bank are always in multiples of 16 bytes.
-//
-// The memory bank is divided into areas with fixed meaning.
-//
-// Starting at address UPLOAD_PROGRAM: Vertex program instructions.
-// Native limits reported by drivers from ATI suggest size 256 (i.e. 4KB),
-// whereas the difference between known addresses suggests size 512.
-//
-// Starting at address UPLOAD_PARAMETERS: Vertex program parameters.
-// Native reported limits and the VPI layout suggest size 256, whereas
-// difference between known addresses suggests size 512.
-//
-// At address UPLOAD_POINTSIZE is a vector (0, 0, ps, 0), where ps is the
-// floating point pointsize. The exact purpose of this state is uncertain,
-// as there is also the R300_RE_POINTSIZE register.
-//
-// Multiple vertex programs and parameter sets can be loaded at once,
-// which could explain the size discrepancy. */
-#define R300_VAP_PVS_UPLOAD_ADDRESS         0x2200
-#       define R300_PVS_UPLOAD_PROGRAM           0x00000000
-#       define R300_PVS_UPLOAD_PARAMETERS        0x00000200
-#       define R300_PVS_UPLOAD_POINTSIZE         0x00000406
-/* gap */
-#define R300_VAP_PVS_UPLOAD_DATA            0x2208
-/* END */
-
-/* gap */
-/* I do not know the purpose of this register. However, I do know that
-// it is set to 221C_CLEAR for clear operations and to 221C_NORMAL
-// for normal rendering. */
-#define R300_VAP_UNKNOWN_221C               0x221C
-#       define R300_221C_NORMAL                  0x00000000
-#       define R300_221C_CLEAR                   0x0001C000
-
-/* gap */
-/* Sometimes, END_OF_PKT and 0x2284=0 are the only commands sent between
-// rendering commands and overwriting vertex program parameters.
-// Therefore, I suspect writing zero to 0x2284 synchronizes the engine and
-// avoids bugs caused by still running shaders reading bad data from memory. */
-#define R300_VAP_PVS_WAITIDLE               0x2284 /* GUESS */
-
-/* Absolutely no clue what this register is about. */
-#define R300_VAP_UNKNOWN_2288               0x2288
-#       define R300_2288_R300                    0x00750000 /* -- nh */
-#       define R300_2288_RV350                   0x0000FFFF /* -- Vladimir */
-
-/* gap */
-/* Addresses are relative to the vertex program instruction area of the
-// memory bank. PROGRAM_END points to the last instruction of the active
-// program
-//
-// The meaning of the two UNKNOWN fields is obviously not known. However,
-// experiments so far have shown that both *must* point to an instruction
-// inside the vertex program, otherwise the GPU locks up.
-// fglrx usually sets CNTL_3_UNKNOWN to the end of the program and
-// CNTL_1_UNKNOWN points to instruction where last write to position takes place. 
-// Most likely this is used to ignore rest of the program in cases where group of verts arent visible.
-// For some reason this "section" is sometimes accepted other instruction that have
-// no relationship with position calculations. 
-*/
-#define R300_VAP_PVS_CNTL_1                 0x22D0
-#       define R300_PVS_CNTL_1_PROGRAM_START_SHIFT   0
-#       define R300_PVS_CNTL_1_POS_END_SHIFT         10
-#       define R300_PVS_CNTL_1_PROGRAM_END_SHIFT     20
-/* Addresses are relative the the vertex program parameters area. */
-#define R300_VAP_PVS_CNTL_2                 0x22D4
-#       define R300_PVS_CNTL_2_PARAM_OFFSET_SHIFT 0
-#       define R300_PVS_CNTL_2_PARAM_COUNT_SHIFT  16
-#define R300_VAP_PVS_CNTL_3	           0x22D8
-#       define R300_PVS_CNTL_3_PROGRAM_UNKNOWN_SHIFT 10
-#       define R300_PVS_CNTL_3_PROGRAM_UNKNOWN2_SHIFT 0
-
-/* The entire range from 0x2300 to 0x2AC inclusive seems to be used for
-// immediate vertices */
-#define R300_VAP_VTX_COLOR_R                0x2464
-#define R300_VAP_VTX_COLOR_G                0x2468
-#define R300_VAP_VTX_COLOR_B                0x246C
-#define R300_VAP_VTX_POS_0_X_1              0x2490 /* used for glVertex2*() */
-#define R300_VAP_VTX_POS_0_Y_1              0x2494
-#define R300_VAP_VTX_COLOR_PKD              0x249C /* RGBA */
-#define R300_VAP_VTX_POS_0_X_2              0x24A0 /* used for glVertex3*() */
-#define R300_VAP_VTX_POS_0_Y_2              0x24A4
-#define R300_VAP_VTX_POS_0_Z_2              0x24A8
-#define R300_VAP_VTX_END_OF_PKT             0x24AC /* write 0 to indicate end of packet? */
-
-/* gap */
-
-/* These are values from r300_reg/r300_reg.h - they are known to be correct
-   and are here so we can use one register file instead of several
-   - Vladimir */
-#define R300_GB_VAP_RASTER_VTX_FMT_0	0x4000
-#	define R300_GB_VAP_RASTER_VTX_FMT_0__POS_PRESENT	(1<<0)
-#	define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_0_PRESENT	(1<<1)
-#	define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_1_PRESENT	(1<<2)
-#	define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_2_PRESENT	(1<<3)
-#	define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_3_PRESENT	(1<<4)
-#	define R300_GB_VAP_RASTER_VTX_FMT_0__COLOR_SPACE	(0xf<<5)
-#	define R300_GB_VAP_RASTER_VTX_FMT_0__PT_SIZE_PRESENT	(0x1<<16)
-
-#define R300_GB_VAP_RASTER_VTX_FMT_1	0x4004
-	/* each of the following is 3 bits wide, specifies number
-	   of components */
-#	define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_0_COMP_CNT_SHIFT	0
-#	define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_1_COMP_CNT_SHIFT	3
-#	define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_2_COMP_CNT_SHIFT	6
-#	define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_3_COMP_CNT_SHIFT	9
-#	define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_4_COMP_CNT_SHIFT	12
-#	define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_5_COMP_CNT_SHIFT	15
-#	define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_6_COMP_CNT_SHIFT	18
-#	define R300_GB_VAP_RASTER_VTX_FMT_1__TEX_7_COMP_CNT_SHIFT	21
-
-/* UNK30 seems to enables point to quad transformation on textures
-   (or something closely related to that).
-   This bit is rather fatal at the time being due to lackings at pixel shader side */
-#define R300_GB_ENABLE	0x4008
-#	define R300_GB_POINT_STUFF_ENABLE	(1<<0)
-#	define R300_GB_LINE_STUFF_ENABLE	(1<<1)
-#	define R300_GB_TRIANGLE_STUFF_ENABLE	(1<<2)
-#	define R300_GB_STENCIL_AUTO_ENABLE	(1<<4)
-#	define R300_GB_UNK30			(1<<30)
-	/* each of the following is 2 bits wide */
-#define R300_GB_TEX_REPLICATE	0
-#define R300_GB_TEX_ST		1
-#define R300_GB_TEX_STR		2
-#	define R300_GB_TEX0_SOURCE_SHIFT	16
-#	define R300_GB_TEX1_SOURCE_SHIFT	18
-#	define R300_GB_TEX2_SOURCE_SHIFT	20
-#	define R300_GB_TEX3_SOURCE_SHIFT	22
-#	define R300_GB_TEX4_SOURCE_SHIFT	24
-#	define R300_GB_TEX5_SOURCE_SHIFT	26
-#	define R300_GB_TEX6_SOURCE_SHIFT	28
-#	define R300_GB_TEX7_SOURCE_SHIFT	30
-
-/* MSPOS - positions for multisample antialiasing (?) */
-#define R300_GB_MSPOS0	0x4010
-	/* shifts - each of the fields is 4 bits */
-#	define R300_GB_MSPOS0__MS_X0_SHIFT	0
-#	define R300_GB_MSPOS0__MS_Y0_SHIFT	4
-#	define R300_GB_MSPOS0__MS_X1_SHIFT	8
-#	define R300_GB_MSPOS0__MS_Y1_SHIFT	12
-#	define R300_GB_MSPOS0__MS_X2_SHIFT	16
-#	define R300_GB_MSPOS0__MS_Y2_SHIFT	20
-#	define R300_GB_MSPOS0__MSBD0_Y		24
-#	define R300_GB_MSPOS0__MSBD0_X		28
-
-#define R300_GB_MSPOS1	0x4014
-#	define R300_GB_MSPOS1__MS_X3_SHIFT	0
-#	define R300_GB_MSPOS1__MS_Y3_SHIFT	4
-#	define R300_GB_MSPOS1__MS_X4_SHIFT	8
-#	define R300_GB_MSPOS1__MS_Y4_SHIFT	12
-#	define R300_GB_MSPOS1__MS_X5_SHIFT	16
-#	define R300_GB_MSPOS1__MS_Y5_SHIFT	20
-#	define R300_GB_MSPOS1__MSBD1		24
-
-
-#define R300_GB_TILE_CONFIG	0x4018
-#	define R300_GB_TILE_ENABLE	(1<<0)
-#	define R300_GB_TILE_PIPE_COUNT_RV300	0
-#	define R300_GB_TILE_PIPE_COUNT_R300	(3<<1)
-#	define R300_GB_TILE_PIPE_COUNT_R420	(7<<1)
-#	define R300_GB_TILE_SIZE_8		0
-#	define R300_GB_TILE_SIZE_16		(1<<4)
-#	define R300_GB_TILE_SIZE_32		(2<<4)
-#	define R300_GB_SUPER_SIZE_1		(0<<6)
-#	define R300_GB_SUPER_SIZE_2		(1<<6)
-#	define R300_GB_SUPER_SIZE_4		(2<<6)
-#	define R300_GB_SUPER_SIZE_8		(3<<6)
-#	define R300_GB_SUPER_SIZE_16		(4<<6)
-#	define R300_GB_SUPER_SIZE_32		(5<<6)
-#	define R300_GB_SUPER_SIZE_64		(6<<6)
-#	define R300_GB_SUPER_SIZE_128		(7<<6)
-#	define R300_GB_SUPER_X_SHIFT		9	/* 3 bits wide */
-#	define R300_GB_SUPER_Y_SHIFT		12	/* 3 bits wide */
-#	define R300_GB_SUPER_TILE_A		0
-#	define R300_GB_SUPER_TILE_B		(1<<15)
-#	define R300_GB_SUBPIXEL_1_12		0
-#	define R300_GB_SUBPIXEL_1_16		(1<<16)
-
-#define R300_GB_FIFO_SIZE	0x4024
-	/* each of the following is 2 bits wide */
-#define R300_GB_FIFO_SIZE_32	0
-#define R300_GB_FIFO_SIZE_64	1
-#define R300_GB_FIFO_SIZE_128	2
-#define R300_GB_FIFO_SIZE_256	3
-#	define R300_SC_IFIFO_SIZE_SHIFT	0
-#	define R300_SC_TZFIFO_SIZE_SHIFT	2
-#	define R300_SC_BFIFO_SIZE_SHIFT	4
-
-#	define R300_US_OFIFO_SIZE_SHIFT	12
-#	define R300_US_WFIFO_SIZE_SHIFT	14
-	/* the following use the same constants as above, but meaning is
-	   is times 2 (i.e. instead of 32 words it means 64 */
-#	define R300_RS_TFIFO_SIZE_SHIFT	6
-#	define R300_RS_CFIFO_SIZE_SHIFT	8
-#	define R300_US_RAM_SIZE_SHIFT		10
-	/* watermarks, 3 bits wide */
-#	define R300_RS_HIGHWATER_COL_SHIFT	16
-#	define R300_RS_HIGHWATER_TEX_SHIFT	19
-#	define R300_OFIFO_HIGHWATER_SHIFT	22	/* two bits only */
-#	define R300_CUBE_FIFO_HIGHWATER_COL_SHIFT	24
-
-#define R300_GB_SELECT	0x401C
-#	define R300_GB_FOG_SELECT_C0A		0
-#	define R300_GB_FOG_SELECT_C1A		1
-#	define R300_GB_FOG_SELECT_C2A		2
-#	define R300_GB_FOG_SELECT_C3A		3
-#	define R300_GB_FOG_SELECT_1_1_W	4
-#	define R300_GB_FOG_SELECT_Z		5
-#	define R300_GB_DEPTH_SELECT_Z		0
-#	define R300_GB_DEPTH_SELECT_1_1_W	(1<<3)
-#	define R300_GB_W_SELECT_1_W		0
-#	define R300_GB_W_SELECT_1		(1<<4)
-
-#define R300_GB_AA_CONFIG		0x4020
-#	define R300_AA_ENABLE			0x01
-#	define R300_AA_SUBSAMPLES_2		0
-#	define R300_AA_SUBSAMPLES_3		(1<<1)
-#	define R300_AA_SUBSAMPLES_4		(2<<1)
-#	define R300_AA_SUBSAMPLES_6		(3<<1)
-
-/* END */
-
-/* gap */
-/* The upper enable bits are guessed, based on fglrx reported limits. */
-#define R300_TX_ENABLE                      0x4104
-#       define R300_TX_ENABLE_0                  (1 << 0)
-#       define R300_TX_ENABLE_1                  (1 << 1)
-#       define R300_TX_ENABLE_2                  (1 << 2)
-#       define R300_TX_ENABLE_3                  (1 << 3)
-#       define R300_TX_ENABLE_4                  (1 << 4)
-#       define R300_TX_ENABLE_5                  (1 << 5)
-#       define R300_TX_ENABLE_6                  (1 << 6)
-#       define R300_TX_ENABLE_7                  (1 << 7)
-#       define R300_TX_ENABLE_8                  (1 << 8)
-#       define R300_TX_ENABLE_9                  (1 << 9)
-#       define R300_TX_ENABLE_10                 (1 << 10)
-#       define R300_TX_ENABLE_11                 (1 << 11)
-#       define R300_TX_ENABLE_12                 (1 << 12)
-#       define R300_TX_ENABLE_13                 (1 << 13)
-#       define R300_TX_ENABLE_14                 (1 << 14)
-#       define R300_TX_ENABLE_15                 (1 << 15)
-
-/* The pointsize is given in multiples of 6. The pointsize can be
-// enormous: Clear() renders a single point that fills the entire
-// framebuffer. */
-#define R300_RE_POINTSIZE                   0x421C
-#       define R300_POINTSIZE_Y_SHIFT            0
-#       define R300_POINTSIZE_Y_MASK             (0xFFFF << 0) /* GUESS */
-#       define R300_POINTSIZE_X_SHIFT            16
-#       define R300_POINTSIZE_X_MASK             (0xFFFF << 16) /* GUESS */
-#       define R300_POINTSIZE_MAX             (R300_POINTSIZE_Y_MASK / 6)
-
-/* The line width is given in multiples of 6.
-   In default mode lines are classified as vertical lines.
-   HO: horizontal
-   VE: vertical or horizontal
-   HO & VE: no classification
-*/
-#define R300_RE_LINE_CNT                      0x4234
-#       define R300_LINESIZE_SHIFT            0
-#       define R300_LINESIZE_MASK             (0xFFFF << 0) /* GUESS */
-#       define R300_LINESIZE_MAX             (R300_LINESIZE_MASK / 6)
-#       define R300_LINE_CNT_HO               (1 << 16)
-#       define R300_LINE_CNT_VE               (1 << 17)
-
-/* Some sort of scale or clamp value for texcoordless textures. */
-#define R300_RE_UNK4238                       0x4238
-
-#define R300_RE_SHADE_MODEL                   0x4278
-#	define R300_RE_SHADE_MODEL_SMOOTH     0x3aaaa
-#	define R300_RE_SHADE_MODEL_FLAT       0x39595
-
-/* Dangerous */
-#define R300_RE_POLYGON_MODE                  0x4288
-#	define R300_PM_ENABLED                (1 << 0)
-#	define R300_PM_FRONT_POINT            (0 << 0)
-#	define R300_PM_BACK_POINT             (0 << 0)
-#	define R300_PM_FRONT_LINE             (1 << 4)
-#	define R300_PM_FRONT_FILL             (1 << 5)
-#	define R300_PM_BACK_LINE              (1 << 7)
-#	define R300_PM_BACK_FILL              (1 << 8)
-
-/* Not sure why there are duplicate of factor and constant values. 
-   My best guess so far is that there are seperate zbiases for test and write. 
-   Ordering might be wrong.
-   Some of the tests indicate that fgl has a fallback implementation of zbias
-   via pixel shaders. */
-#define R300_RE_ZBIAS_T_FACTOR                0x42A4
-#define R300_RE_ZBIAS_T_CONSTANT              0x42A8
-#define R300_RE_ZBIAS_W_FACTOR                0x42AC
-#define R300_RE_ZBIAS_W_CONSTANT              0x42B0
-
-/* This register needs to be set to (1<<1) for RV350 to correctly
-   perform depth test (see --vb-triangles in r300_demo)
-   Don't know about other chips. - Vladimir
-   This is set to 3 when GL_POLYGON_OFFSET_FILL is on.
-   My guess is that there are two bits for each zbias primitive (FILL, LINE, POINT).
-   One to enable depth test and one for depth write.
-   Yet this doesnt explain why depth writes work ...
-    */
-#define R300_RE_OCCLUSION_CNTL		    0x42B4
-#	define R300_OCCLUSION_ON		(1<<1)
-
-#define R300_RE_CULL_CNTL                   0x42B8
-#       define R300_CULL_FRONT                   (1 << 0)
-#       define R300_CULL_BACK                    (1 << 1)
-#       define R300_FRONT_FACE_CCW               (0 << 2)
-#       define R300_FRONT_FACE_CW                (1 << 2)
-
-
-/* BEGIN: Rasterization / Interpolators - many guesses
-// 0_UNKNOWN_18 has always been set except for clear operations.
-// TC_CNT is the number of incoming texture coordinate sets (i.e. it depends
-// on the vertex program, *not* the fragment program) */
-#define R300_RS_CNTL_0                      0x4300
-#       define R300_RS_CNTL_TC_CNT_SHIFT         2
-#       define R300_RS_CNTL_TC_CNT_MASK          (7 << 2)
-#		define R300_RS_CNTL_CI_CNT_SHIFT         7 /* number of color interpolators used */
-#       define R300_RS_CNTL_0_UNKNOWN_18         (1 << 18)
-/* Guess: RS_CNTL_1 holds the index of the highest used RS_ROUTE_n register. */
-#define R300_RS_CNTL_1                      0x4304
-
-/* gap */
-/* Only used for texture coordinates.
-// Use the source field to route texture coordinate input from the vertex program
-// to the desired interpolator. Note that the source field is relative to the
-// outputs the vertex program *actually* writes. If a vertex program only writes
-// texcoord[1], this will be source index 0.
-// Set INTERP_USED on all interpolators that produce data used by the
-// fragment program. INTERP_USED looks like a swizzling mask, but
-// I haven't seen it used that way.
-//
-// Note: The _UNKNOWN constants are always set in their respective register.
-// I don't know if this is necessary. */
-#define R300_RS_INTERP_0                    0x4310
-#define R300_RS_INTERP_1                    0x4314
-#       define R300_RS_INTERP_1_UNKNOWN          0x40
-#define R300_RS_INTERP_2                    0x4318
-#       define R300_RS_INTERP_2_UNKNOWN          0x80
-#define R300_RS_INTERP_3                    0x431C
-#       define R300_RS_INTERP_3_UNKNOWN          0xC0
-#define R300_RS_INTERP_4                    0x4320
-#define R300_RS_INTERP_5                    0x4324
-#define R300_RS_INTERP_6                    0x4328
-#define R300_RS_INTERP_7                    0x432C
-#       define R300_RS_INTERP_SRC_SHIFT          2
-#       define R300_RS_INTERP_SRC_MASK           (7 << 2)
-#       define R300_RS_INTERP_USED               0x00D10000
-
-/* These DWORDs control how vertex data is routed into fragment program
-// registers, after interpolators. */
-#define R300_RS_ROUTE_0                     0x4330
-#define R300_RS_ROUTE_1                     0x4334
-#define R300_RS_ROUTE_2                     0x4338
-#define R300_RS_ROUTE_3                     0x433C /* GUESS */
-#define R300_RS_ROUTE_4                     0x4340 /* GUESS */
-#define R300_RS_ROUTE_5                     0x4344 /* GUESS */
-#define R300_RS_ROUTE_6                     0x4348 /* GUESS */
-#define R300_RS_ROUTE_7                     0x434C /* GUESS */
-#       define R300_RS_ROUTE_SOURCE_INTERP_0     0
-#       define R300_RS_ROUTE_SOURCE_INTERP_1     1
-#       define R300_RS_ROUTE_SOURCE_INTERP_2     2
-#       define R300_RS_ROUTE_SOURCE_INTERP_3     3
-#       define R300_RS_ROUTE_SOURCE_INTERP_4     4
-#       define R300_RS_ROUTE_SOURCE_INTERP_5     5 /* GUESS */
-#       define R300_RS_ROUTE_SOURCE_INTERP_6     6 /* GUESS */
-#       define R300_RS_ROUTE_SOURCE_INTERP_7     7 /* GUESS */
-#       define R300_RS_ROUTE_ENABLE              (1 << 3) /* GUESS */
-#       define R300_RS_ROUTE_DEST_SHIFT          6
-#       define R300_RS_ROUTE_DEST_MASK           (31 << 6) /* GUESS */
-
-/* Special handling for color: When the fragment program uses color,
-// the ROUTE_0_COLOR bit is set and ROUTE_0_COLOR_DEST contains the
-// color register index. */
-#       define R300_RS_ROUTE_0_COLOR             (1 << 14)
-#       define R300_RS_ROUTE_0_COLOR_DEST_SHIFT  17
-#       define R300_RS_ROUTE_0_COLOR_DEST_MASK   (31 << 17) /* GUESS */
-/* As above, but for secondary color */
-#		define R300_RS_ROUTE_1_COLOR1            (1 << 14)
-#		define R300_RS_ROUTE_1_COLOR1_DEST_SHIFT 17
-#		define R300_RS_ROUTE_1_COLOR1_DEST_MASK  (31 << 17)
-#		define R300_RS_ROUTE_1_UNKNOWN11         (1 << 11)
-/* END */
-
-/* BEGIN: Scissors and cliprects
-// There are four clipping rectangles. Their corner coordinates are inclusive.
-// Every pixel is assigned a number from 0 and 15 by setting bits 0-3 depending
-// on whether the pixel is inside cliprects 0-3, respectively. For example,
-// if a pixel is inside cliprects 0 and 1, but outside 2 and 3, it is assigned
-// the number 3 (binary 0011).
-// Iff the bit corresponding to the pixel's number in RE_CLIPRECT_CNTL is set,
-// the pixel is rasterized.
-//
-// In addition to this, there is a scissors rectangle. Only pixels inside the
-// scissors rectangle are drawn. (coordinates are inclusive)
-//
-// For some reason, the top-left corner of the framebuffer is at (1440, 1440)
-// for the purpose of clipping and scissors. */
-#define R300_RE_CLIPRECT_TL_0               0x43B0
-#define R300_RE_CLIPRECT_BR_0               0x43B4
-#define R300_RE_CLIPRECT_TL_1               0x43B8
-#define R300_RE_CLIPRECT_BR_1               0x43BC
-#define R300_RE_CLIPRECT_TL_2               0x43C0
-#define R300_RE_CLIPRECT_BR_2               0x43C4
-#define R300_RE_CLIPRECT_TL_3               0x43C8
-#define R300_RE_CLIPRECT_BR_3               0x43CC
-#       define R300_CLIPRECT_OFFSET              1440
-#       define R300_CLIPRECT_MASK                0x1FFF
-#       define R300_CLIPRECT_X_SHIFT             0
-#       define R300_CLIPRECT_X_MASK              (0x1FFF << 0)
-#       define R300_CLIPRECT_Y_SHIFT             13
-#       define R300_CLIPRECT_Y_MASK              (0x1FFF << 13)
-#define R300_RE_CLIPRECT_CNTL               0x43D0
-#       define R300_CLIP_OUT                     (1 << 0)
-#       define R300_CLIP_0                       (1 << 1)
-#       define R300_CLIP_1                       (1 << 2)
-#       define R300_CLIP_10                      (1 << 3)
-#       define R300_CLIP_2                       (1 << 4)
-#       define R300_CLIP_20                      (1 << 5)
-#       define R300_CLIP_21                      (1 << 6)
-#       define R300_CLIP_210                     (1 << 7)
-#       define R300_CLIP_3                       (1 << 8)
-#       define R300_CLIP_30                      (1 << 9)
-#       define R300_CLIP_31                      (1 << 10)
-#       define R300_CLIP_310                     (1 << 11)
-#       define R300_CLIP_32                      (1 << 12)
-#       define R300_CLIP_320                     (1 << 13)
-#       define R300_CLIP_321                     (1 << 14)
-#       define R300_CLIP_3210                    (1 << 15)
-
-/* gap */
-#define R300_RE_SCISSORS_TL                 0x43E0
-#define R300_RE_SCISSORS_BR                 0x43E4
-#       define R300_SCISSORS_OFFSET              1440
-#       define R300_SCISSORS_X_SHIFT             0
-#       define R300_SCISSORS_X_MASK              (0x1FFF << 0)
-#       define R300_SCISSORS_Y_SHIFT             13
-#       define R300_SCISSORS_Y_MASK              (0x1FFF << 13)
-/* END */
-
-/* BEGIN: Texture specification
-// The texture specification dwords are grouped by meaning and not by texture unit.
-// This means that e.g. the offset for texture image unit N is found in register
-// TX_OFFSET_0 + (4*N) */
-#define R300_TX_FILTER_0                    0x4400
-#       define R300_TX_REPEAT                    0
-#       define R300_TX_MIRRORED                  1
-#       define R300_TX_CLAMP                     4
-#       define R300_TX_CLAMP_TO_EDGE             2
-#       define R300_TX_CLAMP_TO_BORDER           6
-#       define R300_TX_WRAP_S_SHIFT              0
-#       define R300_TX_WRAP_S_MASK               (7 << 0)
-#       define R300_TX_WRAP_T_SHIFT              3
-#       define R300_TX_WRAP_T_MASK               (7 << 3)
-#       define R300_TX_WRAP_Q_SHIFT              6
-#       define R300_TX_WRAP_Q_MASK               (7 << 6)
-#       define R300_TX_MAG_FILTER_NEAREST        (1 << 9)
-#       define R300_TX_MAG_FILTER_LINEAR         (2 << 9)
-#       define R300_TX_MAG_FILTER_MASK           (3 << 9)
-#       define R300_TX_MIN_FILTER_NEAREST        (1 << 11)
-#       define R300_TX_MIN_FILTER_LINEAR         (2 << 11)
-#	define R300_TX_MIN_FILTER_NEAREST_MIP_NEAREST       (5  <<  11)
-#	define R300_TX_MIN_FILTER_NEAREST_MIP_LINEAR        (9  <<  11)
-#	define R300_TX_MIN_FILTER_LINEAR_MIP_NEAREST        (6  <<  11)
-#	define R300_TX_MIN_FILTER_LINEAR_MIP_LINEAR         (10 <<  11)
-
-/* NOTE: NEAREST doesnt seem to exist.
-   Im not seting MAG_FILTER_MASK and (3 << 11) on for all
-   anisotropy modes because that would void selected mag filter */
-#	define R300_TX_MIN_FILTER_ANISO_NEAREST             ((0 << 13) /*|R300_TX_MAG_FILTER_MASK|(3<<11)*/)
-#	define R300_TX_MIN_FILTER_ANISO_LINEAR              ((0 << 13) /*|R300_TX_MAG_FILTER_MASK|(3<<11)*/)
-#	define R300_TX_MIN_FILTER_ANISO_NEAREST_MIP_NEAREST ((1 << 13) /*|R300_TX_MAG_FILTER_MASK|(3<<11)*/)
-#	define R300_TX_MIN_FILTER_ANISO_NEAREST_MIP_LINEAR  ((2 << 13) /*|R300_TX_MAG_FILTER_MASK|(3<<11)*/)
-#       define R300_TX_MIN_FILTER_MASK           ( (15 << 11) | (3 << 13) )
-#	define R300_TX_MAX_ANISO_1_TO_1  (0 << 21)
-#	define R300_TX_MAX_ANISO_2_TO_1  (2 << 21)
-#	define R300_TX_MAX_ANISO_4_TO_1  (4 << 21)
-#	define R300_TX_MAX_ANISO_8_TO_1  (6 << 21)
-#	define R300_TX_MAX_ANISO_16_TO_1 (8 << 21)
-#	define R300_TX_MAX_ANISO_MASK    (14 << 21)
-
-#define R300_TX_UNK1_0                      0x4440
-#	define R300_LOD_BIAS_MASK	    0x1fff
-
-#define R300_TX_SIZE_0                      0x4480
-#       define R300_TX_WIDTHMASK_SHIFT           0
-#       define R300_TX_WIDTHMASK_MASK            (2047 << 0)
-#       define R300_TX_HEIGHTMASK_SHIFT          11
-#       define R300_TX_HEIGHTMASK_MASK           (2047 << 11)
-#       define R300_TX_UNK23                     (1 << 23)
-#       define R300_TX_SIZE_SHIFT                26 /* largest of width, height */
-#       define R300_TX_SIZE_MASK                 (15 << 26)
-#define R300_TX_FORMAT_0                    0x44C0
-	/* The interpretation of the format word by Wladimir van der Laan */
-	/* The X, Y, Z and W refer to the layout of the components.
-	   They are given meanings as R, G, B and Alpha by the swizzle
-	   specification */
-#	define R300_TX_FORMAT_X8		    0x0
-#	define R300_TX_FORMAT_X16		    0x1
-#	define R300_TX_FORMAT_Y4X4		    0x2
-#	define R300_TX_FORMAT_Y8X8		    0x3
-#	define R300_TX_FORMAT_Y16X16		    0x4
-#	define R300_TX_FORMAT_Z3Y3X2		    0x5
-#	define R300_TX_FORMAT_Z5Y6X5		    0x6
-#	define R300_TX_FORMAT_Z6Y5X5		    0x7
-#	define R300_TX_FORMAT_Z11Y11X10		    0x8
-#	define R300_TX_FORMAT_Z10Y11X11		    0x9
-#	define R300_TX_FORMAT_W4Z4Y4X4		    0xA
-#	define R300_TX_FORMAT_W1Z5Y5X5		    0xB
-#	define R300_TX_FORMAT_W8Z8Y8X8		    0xC
-#	define R300_TX_FORMAT_W2Z10Y10X10	    0xD
-#	define R300_TX_FORMAT_W16Z16Y16X16	    0xE
-#	define R300_TX_FORMAT_DXT1	    	    0xF
-#	define R300_TX_FORMAT_DXT3	    	    0x10
-#	define R300_TX_FORMAT_DXT5	    	    0x11
-#	define R300_TX_FORMAT_D3DMFT_CxV8U8	    0x12     /* no swizzle */
-#	define R300_TX_FORMAT_A8R8G8B8	    	    0x13     /* no swizzle */
-#	define R300_TX_FORMAT_B8G8_B8G8	    	    0x14     /* no swizzle */
-#	define R300_TX_FORMAT_G8R8_G8B8	    	    0x15     /* no swizzle */
-						  /* 0x16 - some 16 bit green format.. ?? */
-#	define R300_TX_FORMAT_UNK25		   (1 << 25) /* no swizzle */
-
-	/* gap */
-	/* Floating point formats */
-	/* Note - hardware supports both 16 and 32 bit floating point */
-#	define R300_TX_FORMAT_FL_I16	    	    0x18
-#	define R300_TX_FORMAT_FL_I16A16	    	    0x19
-#	define R300_TX_FORMAT_FL_R16G16B16A16	    0x1A
-#	define R300_TX_FORMAT_FL_I32	    	    0x1B
-#	define R300_TX_FORMAT_FL_I32A32	    	    0x1C
-#	define R300_TX_FORMAT_FL_R32G32B32A32	    0x1D
-	/* alpha modes, convenience mostly */
-	/* if you have alpha, pick constant appropriate to the
-	   number of channels (1 for I8, 2 for I8A8, 4 for R8G8B8A8, etc */
-# 	define R300_TX_FORMAT_ALPHA_1CH		    0x000
-# 	define R300_TX_FORMAT_ALPHA_2CH		    0x200
-# 	define R300_TX_FORMAT_ALPHA_4CH		    0x600
-# 	define R300_TX_FORMAT_ALPHA_NONE	    0xA00
-	/* Swizzling */
-	/* constants */
-#	define R300_TX_FORMAT_X		0
-#	define R300_TX_FORMAT_Y		1
-#	define R300_TX_FORMAT_Z		2
-#	define R300_TX_FORMAT_W		3
-#	define R300_TX_FORMAT_ZERO	4
-#	define R300_TX_FORMAT_ONE	5
-#	define R300_TX_FORMAT_CUT_Z	6		/* 2.0*Z, everything above 1.0 is set to 0.0 */
-#	define R300_TX_FORMAT_CUT_W	7		/* 2.0*W, everything above 1.0 is set to 0.0 */
-
-#	define R300_TX_FORMAT_B_SHIFT	18
-#	define R300_TX_FORMAT_G_SHIFT	15
-#	define R300_TX_FORMAT_R_SHIFT	12
-#	define R300_TX_FORMAT_A_SHIFT	9
-	/* Convenience macro to take care of layout and swizzling */
-#	define R300_EASY_TX_FORMAT(B, G, R, A, FMT)	(\
-	  ((R300_TX_FORMAT_##B)<<R300_TX_FORMAT_B_SHIFT) \
-	| ((R300_TX_FORMAT_##G)<<R300_TX_FORMAT_G_SHIFT) \
-	| ((R300_TX_FORMAT_##R)<<R300_TX_FORMAT_R_SHIFT) \
-	| ((R300_TX_FORMAT_##A)<<R300_TX_FORMAT_A_SHIFT) \
-	| (R300_TX_FORMAT_##FMT) \
-	  )
-	/* These can be ORed with result of R300_EASY_TX_FORMAT() */
-	/* We don't really know what they do. Take values from a constant color ? */
-#	define R300_TX_FORMAT_CONST_X		(1<<5)
-#	define R300_TX_FORMAT_CONST_Y		(2<<5)
-#	define R300_TX_FORMAT_CONST_Z		(4<<5)
-#	define R300_TX_FORMAT_CONST_W		(8<<5)
-
-#	define R300_TX_FORMAT_YUV_MODE		0x00800000
-
-#define R300_TX_OFFSET_0                    0x4540
-/* BEGIN: Guess from R200 */
-#       define R300_TXO_ENDIAN_NO_SWAP           (0 << 0)
-#       define R300_TXO_ENDIAN_BYTE_SWAP         (1 << 0)
-#       define R300_TXO_ENDIAN_WORD_SWAP         (2 << 0)
-#       define R300_TXO_ENDIAN_HALFDW_SWAP       (3 << 0)
-#       define R300_TXO_OFFSET_MASK              0xffffffe0
-#       define R300_TXO_OFFSET_SHIFT             5
-/* END */
-#define R300_TX_UNK4_0                      0x4580
-#define R300_TX_BORDER_COLOR_0              0x45C0 //ff00ff00 == { 0, 1.0, 0, 1.0 }
-
-/* END */
-
-/* BEGIN: Fragment program instruction set
-// Fragment programs are written directly into register space.
-// There are separate instruction streams for texture instructions and ALU
-// instructions.
-// In order to synchronize these streams, the program is divided into up
-// to 4 nodes. Each node begins with a number of TEX operations, followed
-// by a number of ALU operations.
-// The first node can have zero TEX ops, all subsequent nodes must have at least
-// one TEX ops.
-// All nodes must have at least one ALU op.
-//
-// The index of the last node is stored in PFS_CNTL_0: A value of 0 means
-// 1 node, a value of 3 means 4 nodes.
-// The total amount of instructions is defined in PFS_CNTL_2. The offsets are
-// offsets into the respective instruction streams, while *_END points to the
-// last instruction relative to this offset. */
-#define R300_PFS_CNTL_0                     0x4600
-#       define R300_PFS_CNTL_LAST_NODES_SHIFT    0
-#       define R300_PFS_CNTL_LAST_NODES_MASK     (3 << 0)
-#       define R300_PFS_CNTL_FIRST_NODE_HAS_TEX  (1 << 3)
-#define R300_PFS_CNTL_1                     0x4604
-/* There is an unshifted value here which has so far always been equal to the
-// index of the highest used temporary register. */
-#define R300_PFS_CNTL_2                     0x4608
-#       define R300_PFS_CNTL_ALU_OFFSET_SHIFT    0
-#       define R300_PFS_CNTL_ALU_OFFSET_MASK     (63 << 0)
-#       define R300_PFS_CNTL_ALU_END_SHIFT       6
-#       define R300_PFS_CNTL_ALU_END_MASK        (63 << 0)
-#       define R300_PFS_CNTL_TEX_OFFSET_SHIFT    12
-#       define R300_PFS_CNTL_TEX_OFFSET_MASK     (31 << 12) /* GUESS */
-#       define R300_PFS_CNTL_TEX_END_SHIFT       18
-#       define R300_PFS_CNTL_TEX_END_MASK        (31 << 18) /* GUESS */
-
-/* gap */
-/* Nodes are stored backwards. The last active node is always stored in
-// PFS_NODE_3.
-// Example: In a 2-node program, NODE_0 and NODE_1 are set to 0. The
-// first node is stored in NODE_2, the second node is stored in NODE_3.
-//
-// Offsets are relative to the master offset from PFS_CNTL_2.
-// LAST_NODE is set for the last node, and only for the last node. */
-#define R300_PFS_NODE_0                     0x4610
-#define R300_PFS_NODE_1                     0x4614
-#define R300_PFS_NODE_2                     0x4618
-#define R300_PFS_NODE_3                     0x461C
-#       define R300_PFS_NODE_ALU_OFFSET_SHIFT    0
-#       define R300_PFS_NODE_ALU_OFFSET_MASK     (63 << 0)
-#       define R300_PFS_NODE_ALU_END_SHIFT       6
-#       define R300_PFS_NODE_ALU_END_MASK        (63 << 6)
-#       define R300_PFS_NODE_TEX_OFFSET_SHIFT    12
-#       define R300_PFS_NODE_TEX_OFFSET_MASK     (31 << 12)
-#       define R300_PFS_NODE_TEX_END_SHIFT       17
-#       define R300_PFS_NODE_TEX_END_MASK        (31 << 17)
-#       define R300_PFS_NODE_LAST_NODE           (1 << 22)
-
-/* TEX
-// As far as I can tell, texture instructions cannot write into output
-// registers directly. A subsequent ALU instruction is always necessary,
-// even if it's just MAD o0, r0, 1, 0 */
-#define R300_PFS_TEXI_0                     0x4620
-#       define R300_FPITX_SRC_SHIFT              0
-#       define R300_FPITX_SRC_MASK               (31 << 0)
-#       define R300_FPITX_SRC_CONST              (1 << 5) /* GUESS */
-#       define R300_FPITX_DST_SHIFT              6
-#       define R300_FPITX_DST_MASK               (31 << 6)
-#       define R300_FPITX_IMAGE_SHIFT            11
-#       define R300_FPITX_IMAGE_MASK             (15 << 11) /* GUESS based on layout and native limits */
-/* Unsure if these are opcodes, or some kind of bitfield, but this is how
- * they were set when I checked
- */
-#		define R300_FPITX_OPCODE_SHIFT			15
-#			define R300_FPITX_OP_TEX			1
-#			define R300_FPITX_OP_TXP			3
-#			define R300_FPITX_OP_TXB			4
-
-/* ALU
-// The ALU instructions register blocks are enumerated according to the order
-// in which fglrx. I assume there is space for 64 instructions, since
-// each block has space for a maximum of 64 DWORDs, and this matches reported
-// native limits.
-//
-// The basic functional block seems to be one MAD for each color and alpha,
-// and an adder that adds all components after the MUL.
-//  - ADD, MUL, MAD etc.: use MAD with appropriate neutral operands
-//  - DP4: Use OUTC_DP4, OUTA_DP4
-//  - DP3: Use OUTC_DP3, OUTA_DP4, appropriate alpha operands
-//  - DPH: Use OUTC_DP4, OUTA_DP4, appropriate alpha operands
-//  - CMP: If ARG2 < 0, return ARG1, else return ARG0
-//  - FLR: use FRC+MAD
-//  - XPD: use MAD+MAD
-//  - SGE, SLT: use MAD+CMP
-//  - RSQ: use ABS modifier for argument
-//  - Use OUTC_REPL_ALPHA to write results of an alpha-only operation (e.g. RCP)
-//    into color register
-//  - apparently, there's no quick DST operation
-//  - fglrx set FPI2_UNKNOWN_31 on a "MAD fragment.color, tmp0, tmp1, tmp2"
-//  - fglrx set FPI2_UNKNOWN_31 on a "MAX r2, r1, c0"
-//  - fglrx once set FPI0_UNKNOWN_31 on a "FRC r1, r1"
-//
-// Operand selection
-// First stage selects three sources from the available registers and
-// constant parameters. This is defined in INSTR1 (color) and INSTR3 (alpha).
-// fglrx sorts the three source fields: Registers before constants,
-// lower indices before higher indices; I do not know whether this is necessary.
-// fglrx fills unused sources with "read constant 0"
-// According to specs, you cannot select more than two different constants.
-//
-// Second stage selects the operands from the sources. This is defined in
-// INSTR0 (color) and INSTR2 (alpha). You can also select the special constants
-// zero and one.
-// Swizzling and negation happens in this stage, as well.
-//
-// Important: Color and alpha seem to be mostly separate, i.e. their sources
-// selection appears to be fully independent (the register storage is probably
-// physically split into a color and an alpha section).
-// However (because of the apparent physical split), there is some interaction
-// WRT swizzling. If, for example, you want to load an R component into an
-// Alpha operand, this R component is taken from a *color* source, not from
-// an alpha source. The corresponding register doesn't even have to appear in
-// the alpha sources list. (I hope this alll makes sense to you)
-//
-// Destination selection
-// The destination register index is in FPI1 (color) and FPI3 (alpha) together
-// with enable bits.
-// There are separate enable bits for writing into temporary registers
-// (DSTC_REG_* /DSTA_REG) and and program output registers (DSTC_OUTPUT_* /DSTA_OUTPUT).
-// You can write to both at once, or not write at all (the same index
-// must be used for both).
-//
-// Note: There is a special form for LRP
-//  - Argument order is the same as in ARB_fragment_program.
-//  - Operation is MAD
-//  - ARG1 is set to ARGC_SRC1C_LRP/ARGC_SRC1A_LRP
-//  - Set FPI0/FPI2_SPECIAL_LRP
-// Arbitrary LRP (including support for swizzling) requires vanilla MAD+MAD */
-#define R300_PFS_INSTR1_0                   0x46C0
-#       define R300_FPI1_SRC0C_SHIFT             0
-#       define R300_FPI1_SRC0C_MASK              (31 << 0)
-#       define R300_FPI1_SRC0C_CONST             (1 << 5)
-#       define R300_FPI1_SRC1C_SHIFT             6
-#       define R300_FPI1_SRC1C_MASK              (31 << 6)
-#       define R300_FPI1_SRC1C_CONST             (1 << 11)
-#       define R300_FPI1_SRC2C_SHIFT             12
-#       define R300_FPI1_SRC2C_MASK              (31 << 12)
-#       define R300_FPI1_SRC2C_CONST             (1 << 17)
-#       define R300_FPI1_DSTC_SHIFT              18
-#       define R300_FPI1_DSTC_MASK               (31 << 18)
-#       define R300_FPI1_DSTC_REG_X              (1 << 23)
-#       define R300_FPI1_DSTC_REG_Y              (1 << 24)
-#       define R300_FPI1_DSTC_REG_Z              (1 << 25)
-#       define R300_FPI1_DSTC_OUTPUT_X           (1 << 26)
-#       define R300_FPI1_DSTC_OUTPUT_Y           (1 << 27)
-#       define R300_FPI1_DSTC_OUTPUT_Z           (1 << 28)
-
-#define R300_PFS_INSTR3_0                   0x47C0
-#       define R300_FPI3_SRC0A_SHIFT             0
-#       define R300_FPI3_SRC0A_MASK              (31 << 0)
-#       define R300_FPI3_SRC0A_CONST             (1 << 5)
-#       define R300_FPI3_SRC1A_SHIFT             6
-#       define R300_FPI3_SRC1A_MASK              (31 << 6)
-#       define R300_FPI3_SRC1A_CONST             (1 << 11)
-#       define R300_FPI3_SRC2A_SHIFT             12
-#       define R300_FPI3_SRC2A_MASK              (31 << 12)
-#       define R300_FPI3_SRC2A_CONST             (1 << 17)
-#       define R300_FPI3_DSTA_SHIFT              18
-#       define R300_FPI3_DSTA_MASK               (31 << 18)
-#       define R300_FPI3_DSTA_REG                (1 << 23)
-#       define R300_FPI3_DSTA_OUTPUT             (1 << 24)
-
-#define R300_PFS_INSTR0_0                   0x48C0
-#       define R300_FPI0_ARGC_SRC0C_XYZ          0
-#       define R300_FPI0_ARGC_SRC0C_XXX          1
-#       define R300_FPI0_ARGC_SRC0C_YYY          2
-#       define R300_FPI0_ARGC_SRC0C_ZZZ          3
-#       define R300_FPI0_ARGC_SRC1C_XYZ          4
-#       define R300_FPI0_ARGC_SRC1C_XXX          5
-#       define R300_FPI0_ARGC_SRC1C_YYY          6
-#       define R300_FPI0_ARGC_SRC1C_ZZZ          7
-#       define R300_FPI0_ARGC_SRC2C_XYZ          8
-#       define R300_FPI0_ARGC_SRC2C_XXX          9
-#       define R300_FPI0_ARGC_SRC2C_YYY          10
-#       define R300_FPI0_ARGC_SRC2C_ZZZ          11
-#       define R300_FPI0_ARGC_SRC0A              12
-#       define R300_FPI0_ARGC_SRC1A              13
-#       define R300_FPI0_ARGC_SRC2A              14
-#       define R300_FPI0_ARGC_SRC1C_LRP          15
-#       define R300_FPI0_ARGC_ZERO               20
-#       define R300_FPI0_ARGC_ONE                21
-#       define R300_FPI0_ARGC_HALF               22 /* GUESS */
-#       define R300_FPI0_ARGC_SRC0C_YZX          23
-#       define R300_FPI0_ARGC_SRC1C_YZX          24
-#       define R300_FPI0_ARGC_SRC2C_YZX          25
-#       define R300_FPI0_ARGC_SRC0C_ZXY          26
-#       define R300_FPI0_ARGC_SRC1C_ZXY          27
-#       define R300_FPI0_ARGC_SRC2C_ZXY          28
-#       define R300_FPI0_ARGC_SRC0CA_WZY         29
-#       define R300_FPI0_ARGC_SRC1CA_WZY         30
-#       define R300_FPI0_ARGC_SRC2CA_WZY         31
-
-#       define R300_FPI0_ARG0C_SHIFT             0
-#       define R300_FPI0_ARG0C_MASK              (31 << 0)
-#       define R300_FPI0_ARG0C_NEG               (1 << 5)
-#       define R300_FPI0_ARG0C_ABS               (1 << 6)
-#       define R300_FPI0_ARG1C_SHIFT             7
-#       define R300_FPI0_ARG1C_MASK              (31 << 7)
-#       define R300_FPI0_ARG1C_NEG               (1 << 12)
-#       define R300_FPI0_ARG1C_ABS               (1 << 13)
-#       define R300_FPI0_ARG2C_SHIFT             14
-#       define R300_FPI0_ARG2C_MASK              (31 << 14)
-#       define R300_FPI0_ARG2C_NEG               (1 << 19)
-#       define R300_FPI0_ARG2C_ABS               (1 << 20)
-#       define R300_FPI0_SPECIAL_LRP             (1 << 21)
-#       define R300_FPI0_OUTC_MAD                (0 << 23)
-#       define R300_FPI0_OUTC_DP3                (1 << 23)
-#       define R300_FPI0_OUTC_DP4                (2 << 23)
-#       define R300_FPI0_OUTC_MIN                (4 << 23)
-#       define R300_FPI0_OUTC_MAX                (5 << 23)
-#       define R300_FPI0_OUTC_CMP                (8 << 23)
-#       define R300_FPI0_OUTC_FRC                (9 << 23)
-#       define R300_FPI0_OUTC_REPL_ALPHA         (10 << 23)
-#       define R300_FPI0_OUTC_SAT                (1 << 30)
-#       define R300_FPI0_UNKNOWN_31              (1 << 31)
-
-#define R300_PFS_INSTR2_0                   0x49C0
-#       define R300_FPI2_ARGA_SRC0C_X            0
-#       define R300_FPI2_ARGA_SRC0C_Y            1
-#       define R300_FPI2_ARGA_SRC0C_Z            2
-#       define R300_FPI2_ARGA_SRC1C_X            3
-#       define R300_FPI2_ARGA_SRC1C_Y            4
-#       define R300_FPI2_ARGA_SRC1C_Z            5
-#       define R300_FPI2_ARGA_SRC2C_X            6
-#       define R300_FPI2_ARGA_SRC2C_Y            7
-#       define R300_FPI2_ARGA_SRC2C_Z            8
-#       define R300_FPI2_ARGA_SRC0A              9
-#       define R300_FPI2_ARGA_SRC1A              10
-#       define R300_FPI2_ARGA_SRC2A              11
-#       define R300_FPI2_ARGA_SRC1A_LRP          15
-#       define R300_FPI2_ARGA_ZERO               16
-#       define R300_FPI2_ARGA_ONE                17
-#       define R300_FPI2_ARGA_HALF               18 /* GUESS */
-
-#       define R300_FPI2_ARG0A_SHIFT             0
-#       define R300_FPI2_ARG0A_MASK              (31 << 0)
-#       define R300_FPI2_ARG0A_NEG               (1 << 5)
-#		define R300_FPI2_ARG0A_ABS				 (1 << 6) /* GUESS */
-#       define R300_FPI2_ARG1A_SHIFT             7
-#       define R300_FPI2_ARG1A_MASK              (31 << 7)
-#       define R300_FPI2_ARG1A_NEG               (1 << 12)
-#		define R300_FPI2_ARG1A_ABS				 (1 << 13) /* GUESS */
-#       define R300_FPI2_ARG2A_SHIFT             14
-#       define R300_FPI2_ARG2A_MASK              (31 << 14)
-#       define R300_FPI2_ARG2A_NEG               (1 << 19)
-#		define R300_FPI2_ARG2A_ABS				 (1 << 20) /* GUESS */
-#       define R300_FPI2_SPECIAL_LRP             (1 << 21)
-#       define R300_FPI2_OUTA_MAD                (0 << 23)
-#       define R300_FPI2_OUTA_DP4                (1 << 23)
-#       define R300_FPI2_OUTA_MIN                (2 << 23)
-#       define R300_FPI2_OUTA_MAX                (3 << 23)
-#       define R300_FPI2_OUTA_CMP                (6 << 23)
-#       define R300_FPI2_OUTA_FRC                (7 << 23)
-#       define R300_FPI2_OUTA_EX2                (8 << 23)
-#       define R300_FPI2_OUTA_LG2                (9 << 23)
-#       define R300_FPI2_OUTA_RCP                (10 << 23)
-#       define R300_FPI2_OUTA_RSQ                (11 << 23)
-#       define R300_FPI2_OUTA_SAT                (1 << 30)
-#       define R300_FPI2_UNKNOWN_31              (1 << 31)
-/* END */
-
-/* gap */
-#define R300_PP_ALPHA_TEST                  0x4BD4
-#       define R300_REF_ALPHA_MASK               0x000000ff
-#       define R300_ALPHA_TEST_FAIL              (0 << 8)
-#       define R300_ALPHA_TEST_LESS              (1 << 8)
-#       define R300_ALPHA_TEST_LEQUAL            (3 << 8)
-#       define R300_ALPHA_TEST_EQUAL             (2 << 8)
-#       define R300_ALPHA_TEST_GEQUAL            (6 << 8)
-#       define R300_ALPHA_TEST_GREATER           (4 << 8)
-#       define R300_ALPHA_TEST_NEQUAL            (5 << 8)
-#       define R300_ALPHA_TEST_PASS              (7 << 8)
-#       define R300_ALPHA_TEST_OP_MASK           (7 << 8)
-#       define R300_ALPHA_TEST_ENABLE            (1 << 11)
-
-/* gap */
-/* Fragment program parameters in 7.16 floating point */
-#define R300_PFS_PARAM_0_X                  0x4C00
-#define R300_PFS_PARAM_0_Y                  0x4C04
-#define R300_PFS_PARAM_0_Z                  0x4C08
-#define R300_PFS_PARAM_0_W                  0x4C0C
-/* GUESS: PARAM_31 is last, based on native limits reported by fglrx */
-#define R300_PFS_PARAM_31_X                 0x4DF0
-#define R300_PFS_PARAM_31_Y                 0x4DF4
-#define R300_PFS_PARAM_31_Z                 0x4DF8
-#define R300_PFS_PARAM_31_W                 0x4DFC
-
-/* Notes:
-// - AFAIK fglrx always sets BLEND_UNKNOWN when blending is used in the application
-// - AFAIK fglrx always sets BLEND_NO_SEPARATE when CBLEND and ABLEND are set to the same
-//   function (both registers are always set up completely in any case)
-// - Most blend flags are simply copied from R200 and not tested yet */
-#define R300_RB3D_CBLEND                    0x4E04
-#define R300_RB3D_ABLEND                    0x4E08
- /* the following only appear in CBLEND */
-#       define R300_BLEND_ENABLE                     (1 << 0)
-#       define R300_BLEND_UNKNOWN                    (3 << 1)
-#       define R300_BLEND_NO_SEPARATE                (1 << 3)
- /* the following are shared between CBLEND and ABLEND */
-#       define R300_FCN_MASK                         (3  << 12)
-#       define R300_COMB_FCN_ADD_CLAMP               (0  << 12)
-#       define R300_COMB_FCN_ADD_NOCLAMP             (1  << 12)
-#       define R300_COMB_FCN_SUB_CLAMP               (2  << 12)
-#       define R300_COMB_FCN_SUB_NOCLAMP             (3  << 12)
-#       define R300_SRC_BLEND_GL_ZERO                (32 << 16)
-#       define R300_SRC_BLEND_GL_ONE                 (33 << 16)
-#       define R300_SRC_BLEND_GL_SRC_COLOR           (34 << 16)
-#       define R300_SRC_BLEND_GL_ONE_MINUS_SRC_COLOR (35 << 16)
-#       define R300_SRC_BLEND_GL_DST_COLOR           (36 << 16)
-#       define R300_SRC_BLEND_GL_ONE_MINUS_DST_COLOR (37 << 16)
-#       define R300_SRC_BLEND_GL_SRC_ALPHA           (38 << 16)
-#       define R300_SRC_BLEND_GL_ONE_MINUS_SRC_ALPHA (39 << 16)
-#       define R300_SRC_BLEND_GL_DST_ALPHA           (40 << 16)
-#       define R300_SRC_BLEND_GL_ONE_MINUS_DST_ALPHA (41 << 16)
-#       define R300_SRC_BLEND_GL_SRC_ALPHA_SATURATE  (42 << 16)
-#       define R300_SRC_BLEND_MASK                   (63 << 16)
-#       define R300_DST_BLEND_GL_ZERO                (32 << 24)
-#       define R300_DST_BLEND_GL_ONE                 (33 << 24)
-#       define R300_DST_BLEND_GL_SRC_COLOR           (34 << 24)
-#       define R300_DST_BLEND_GL_ONE_MINUS_SRC_COLOR (35 << 24)
-#       define R300_DST_BLEND_GL_DST_COLOR           (36 << 24)
-#       define R300_DST_BLEND_GL_ONE_MINUS_DST_COLOR (37 << 24)
-#       define R300_DST_BLEND_GL_SRC_ALPHA           (38 << 24)
-#       define R300_DST_BLEND_GL_ONE_MINUS_SRC_ALPHA (39 << 24)
-#       define R300_DST_BLEND_GL_DST_ALPHA           (40 << 24)
-#       define R300_DST_BLEND_GL_ONE_MINUS_DST_ALPHA (41 << 24)
-#       define R300_DST_BLEND_MASK                   (63 << 24)
-#define R300_RB3D_COLORMASK                 0x4E0C
-#       define R300_COLORMASK0_B                 (1<<0)
-#       define R300_COLORMASK0_G                 (1<<1)
-#       define R300_COLORMASK0_R                 (1<<2)
-#       define R300_COLORMASK0_A                 (1<<3)
-
-/* gap */
-#define R300_RB3D_COLOROFFSET0              0x4E28
-#       define R300_COLOROFFSET_MASK             0xFFFFFFF0 /* GUESS */
-#define R300_RB3D_COLOROFFSET1              0x4E2C /* GUESS */
-#define R300_RB3D_COLOROFFSET2              0x4E30 /* GUESS */
-#define R300_RB3D_COLOROFFSET3              0x4E34 /* GUESS */
-/* gap */
-/* Bit 16: Larger tiles
-// Bit 17: 4x2 tiles
-// Bit 18: Extremely weird tile like, but some pixels duplicated? */
-#define R300_RB3D_COLORPITCH0               0x4E38
-#       define R300_COLORPITCH_MASK              0x00001FF8 /* GUESS */
-#       define R300_COLOR_TILE_ENABLE            (1 << 16) /* GUESS */
-#       define R300_COLOR_MICROTILE_ENABLE       (1 << 17) /* GUESS */
-#       define R300_COLOR_ENDIAN_NO_SWAP         (0 << 18) /* GUESS */
-#       define R300_COLOR_ENDIAN_WORD_SWAP       (1 << 18) /* GUESS */
-#       define R300_COLOR_ENDIAN_DWORD_SWAP      (2 << 18) /* GUESS */
-#       define R300_COLOR_FORMAT_RGB565          (2 << 22)
-#       define R300_COLOR_FORMAT_ARGB8888        (3 << 22)
-#define R300_RB3D_COLORPITCH1               0x4E3C /* GUESS */
-#define R300_RB3D_COLORPITCH2               0x4E40 /* GUESS */
-#define R300_RB3D_COLORPITCH3               0x4E44 /* GUESS */
-
-/* gap */
-/* Guess by Vladimir.
-// Set to 0A before 3D operations, set to 02 afterwards. */
-#define R300_RB3D_DSTCACHE_CTLSTAT          0x4E4C
-#       define R300_RB3D_DSTCACHE_02             0x00000002
-#       define R300_RB3D_DSTCACHE_0A             0x0000000A
-
-/* gap */
-/* There seems to be no "write only" setting, so use Z-test = ALWAYS for this. */
-/* Bit (1<<8) is the "test" bit. so plain write is 6  - vd */
-#define R300_RB3D_ZSTENCIL_CNTL_0                   0x4F00
-#       define R300_RB3D_Z_DISABLED_1            0x00000010 /* GUESS */
-#       define R300_RB3D_Z_DISABLED_2            0x00000014 /* GUESS */
-#       define R300_RB3D_Z_TEST                  0x00000012
-#       define R300_RB3D_Z_TEST_AND_WRITE        0x00000016
-#       define R300_RB3D_Z_WRITE_ONLY        	 0x00000006
-
-#       define R300_RB3D_Z_TEST                  0x00000012
-#       define R300_RB3D_Z_TEST_AND_WRITE        0x00000016
-#       define R300_RB3D_Z_WRITE_ONLY        	 0x00000006
-#	define R300_RB3D_STENCIL_ENABLE		 0x00000001
-
-#define R300_RB3D_ZSTENCIL_CNTL_1                   0x4F04
-		/* functions */
-#	define R300_ZS_NEVER			0
-#	define R300_ZS_LESS			1
-#	define R300_ZS_LEQUAL			2
-#	define R300_ZS_EQUAL			3
-#	define R300_ZS_GEQUAL			4
-#	define R300_ZS_GREATER			5
-#	define R300_ZS_NOTEQUAL			6
-#	define R300_ZS_ALWAYS			7
-#       define R300_ZS_MASK                     7
-		/* operations */
-#	define R300_ZS_KEEP			0
-#	define R300_ZS_ZERO			1
-#	define R300_ZS_REPLACE			2
-#	define R300_ZS_INCR			3
-#	define R300_ZS_DECR			4
-#	define R300_ZS_INVERT			5
-#	define R300_ZS_INCR_WRAP		6
-#	define R300_ZS_DECR_WRAP		7
-
-       /* front and back refer to operations done for front
-          and back faces, i.e. separate stencil function support */
-#	define R300_RB3D_ZS1_DEPTH_FUNC_SHIFT		0
-#	define R300_RB3D_ZS1_FRONT_FUNC_SHIFT		3
-#	define R300_RB3D_ZS1_FRONT_FAIL_OP_SHIFT	6
-#	define R300_RB3D_ZS1_FRONT_ZPASS_OP_SHIFT	9
-#	define R300_RB3D_ZS1_FRONT_ZFAIL_OP_SHIFT      12
-#	define R300_RB3D_ZS1_BACK_FUNC_SHIFT           15
-#	define R300_RB3D_ZS1_BACK_FAIL_OP_SHIFT        18
-#	define R300_RB3D_ZS1_BACK_ZPASS_OP_SHIFT       21
-#	define R300_RB3D_ZS1_BACK_ZFAIL_OP_SHIFT       24
-
-
-
-#define R300_RB3D_ZSTENCIL_CNTL_2                   0x4F08
-#	define R300_RB3D_ZS2_STENCIL_REF_SHIFT		0
-#	define R300_RB3D_ZS2_STENCIL_MASK		0xFF
-#	define R300_RB3D_ZS2_STENCIL_MASK_SHIFT	        8
-#	define R300_RB3D_ZS2_STENCIL_WRITE_MASK_SHIFT	16
-
-/* gap */
-
-#define R300_RB3D_ZSTENCIL_FORMAT                   0x4F10
-#	define R300_DEPTH_FORMAT_16BIT_INT_Z     (0 << 0)
-#	define R300_DEPTH_FORMAT_24BIT_INT_Z     (2 << 0)
-
-/* gap */
-#define R300_RB3D_DEPTHOFFSET               0x4F20
-#define R300_RB3D_DEPTHPITCH                0x4F24
-#       define R300_DEPTHPITCH_MASK              0x00001FF8 /* GUESS */
-#       define R300_DEPTH_TILE_ENABLE            (1 << 16) /* GUESS */
-#       define R300_DEPTH_MICROTILE_ENABLE       (1 << 17) /* GUESS */
-#       define R300_DEPTH_ENDIAN_NO_SWAP         (0 << 18) /* GUESS */
-#       define R300_DEPTH_ENDIAN_WORD_SWAP       (1 << 18) /* GUESS */
-#       define R300_DEPTH_ENDIAN_DWORD_SWAP      (2 << 18) /* GUESS */
-
-/* BEGIN: Vertex program instruction set
-// Every instruction is four dwords long:
-//  DWORD 0: output and opcode
-//  DWORD 1: first argument
-//  DWORD 2: second argument
-//  DWORD 3: third argument
-//
-// Notes:
-//  - ABS r, a is implemented as MAX r, a, -a
-//  - MOV is implemented as ADD to zero
-//  - XPD is implemented as MUL + MAD
-//  - FLR is implemented as FRC + ADD
-//  - apparently, fglrx tries to schedule instructions so that there is at least
-//    one instruction between the write to a temporary and the first read
-//    from said temporary; however, violations of this scheduling are allowed
-//  - register indices seem to be unrelated with OpenGL aliasing to conventional state
-//  - only one attribute and one parameter can be loaded at a time; however, the
-//    same attribute/parameter can be used for more than one argument
-//  - the second software argument for POW is the third hardware argument (no idea why)
-//  - MAD with only temporaries as input seems to use VPI_OUT_SELECT_MAD_2
-//
-// There is some magic surrounding LIT:
-//  The single argument is replicated across all three inputs, but swizzled:
-//   First argument: xyzy
-//   Second argument: xyzx
-//   Third argument: xyzw
-//  Whenever the result is used later in the fragment program, fglrx forces x and w
-//  to be 1.0 in the input selection; I don't know whether this is strictly necessary */
-#define R300_VPI_OUT_OP_DOT                     (1 << 0)
-#define R300_VPI_OUT_OP_MUL                     (2 << 0)
-#define R300_VPI_OUT_OP_ADD                     (3 << 0)
-#define R300_VPI_OUT_OP_MAD                     (4 << 0)
-#define R300_VPI_OUT_OP_DST                     (5 << 0)
-#define R300_VPI_OUT_OP_FRC                     (6 << 0)
-#define R300_VPI_OUT_OP_MAX                     (7 << 0)
-#define R300_VPI_OUT_OP_MIN                     (8 << 0)
-#define R300_VPI_OUT_OP_SGE                     (9 << 0)
-#define R300_VPI_OUT_OP_SLT                     (10 << 0)
-#define R300_VPI_OUT_OP_UNK12                   (12 << 0) /* Used in GL_POINT_DISTANCE_ATTENUATION_ARB, vector(scalar, vector) */
-#define R300_VPI_OUT_OP_EXP                     (65 << 0)
-#define R300_VPI_OUT_OP_LOG                     (66 << 0)
-#define R300_VPI_OUT_OP_UNK67                   (67 << 0) /* Used in fog computations, scalar(scalar) */
-#define R300_VPI_OUT_OP_LIT                     (68 << 0)
-#define R300_VPI_OUT_OP_POW                     (69 << 0)
-#define R300_VPI_OUT_OP_RCP                     (70 << 0)
-#define R300_VPI_OUT_OP_RSQ                     (72 << 0)
-#define R300_VPI_OUT_OP_UNK73                   (73 << 0) /* Used in GL_POINT_DISTANCE_ATTENUATION_ARB, scalar(scalar) */
-#define R300_VPI_OUT_OP_EX2                     (75 << 0)
-#define R300_VPI_OUT_OP_LG2                     (76 << 0)
-#define R300_VPI_OUT_OP_MAD_2                   (128 << 0)
-#define R300_VPI_OUT_OP_UNK129                  (129 << 0) /* all temps, vector(scalar, vector, vector) */
-
-#define R300_VPI_OUT_REG_CLASS_TEMPORARY        (0 << 8)
-#define R300_VPI_OUT_REG_CLASS_RESULT           (2 << 8)
-#define R300_VPI_OUT_REG_CLASS_MASK             (31 << 8)
-
-#define R300_VPI_OUT_REG_INDEX_SHIFT            13
-#define R300_VPI_OUT_REG_INDEX_MASK             (31 << 13) /* GUESS based on fglrx native limits */
-
-#define R300_VPI_OUT_WRITE_X                    (1 << 20)
-#define R300_VPI_OUT_WRITE_Y                    (1 << 21)
-#define R300_VPI_OUT_WRITE_Z                    (1 << 22)
-#define R300_VPI_OUT_WRITE_W                    (1 << 23)
-
-#define R300_VPI_IN_REG_CLASS_TEMPORARY         (0 << 0)
-#define R300_VPI_IN_REG_CLASS_ATTRIBUTE         (1 << 0)
-#define R300_VPI_IN_REG_CLASS_PARAMETER         (2 << 0)
-#define R300_VPI_IN_REG_CLASS_NONE              (9 << 0)
-#define R300_VPI_IN_REG_CLASS_MASK              (31 << 0) /* GUESS */
-
-#define R300_VPI_IN_REG_INDEX_SHIFT             5
-#define R300_VPI_IN_REG_INDEX_MASK              (255 << 5) /* GUESS based on fglrx native limits */
-
-/* The R300 can select components from the input register arbitrarily.
-// Use the following constants, shifted by the component shift you
-// want to select */
-#define R300_VPI_IN_SELECT_X    0
-#define R300_VPI_IN_SELECT_Y    1
-#define R300_VPI_IN_SELECT_Z    2
-#define R300_VPI_IN_SELECT_W    3
-#define R300_VPI_IN_SELECT_ZERO 4
-#define R300_VPI_IN_SELECT_ONE  5
-#define R300_VPI_IN_SELECT_MASK 7
-
-#define R300_VPI_IN_X_SHIFT                     13
-#define R300_VPI_IN_Y_SHIFT                     16
-#define R300_VPI_IN_Z_SHIFT                     19
-#define R300_VPI_IN_W_SHIFT                     22
-
-#define R300_VPI_IN_NEG_X                       (1 << 25)
-#define R300_VPI_IN_NEG_Y                       (1 << 26)
-#define R300_VPI_IN_NEG_Z                       (1 << 27)
-#define R300_VPI_IN_NEG_W                       (1 << 28)
-/* END */
-
-//BEGIN: Packet 3 commands
-
-// A primitive emission dword.
-#define R300_PRIM_TYPE_NONE                     (0 << 0)
-#define R300_PRIM_TYPE_POINT                    (1 << 0)
-#define R300_PRIM_TYPE_LINE                     (2 << 0)
-#define R300_PRIM_TYPE_LINE_STRIP               (3 << 0)
-#define R300_PRIM_TYPE_TRI_LIST                 (4 << 0)
-#define R300_PRIM_TYPE_TRI_FAN                  (5 << 0)
-#define R300_PRIM_TYPE_TRI_STRIP                (6 << 0)
-#define R300_PRIM_TYPE_TRI_TYPE2                (7 << 0)
-#define R300_PRIM_TYPE_RECT_LIST                (8 << 0)
-#define R300_PRIM_TYPE_3VRT_POINT_LIST          (9 << 0)
-#define R300_PRIM_TYPE_3VRT_LINE_LIST           (10 << 0)
-#define R300_PRIM_TYPE_POINT_SPRITES            (11 << 0) // GUESS (based on r200)
-#define R300_PRIM_TYPE_LINE_LOOP                (12 << 0)
-#define R300_PRIM_TYPE_QUADS                    (13 << 0)
-#define R300_PRIM_TYPE_QUAD_STRIP               (14 << 0)
-#define R300_PRIM_TYPE_POLYGON                  (15 << 0)
-#define R300_PRIM_TYPE_MASK                     0xF
-#define R300_PRIM_WALK_IND                      (1 << 4)
-#define R300_PRIM_WALK_LIST                     (2 << 4)
-#define R300_PRIM_WALK_RING                     (3 << 4)
-#define R300_PRIM_WALK_MASK                     (3 << 4)
-#define R300_PRIM_COLOR_ORDER_BGRA              (0 << 6) // GUESS (based on r200)
-#define R300_PRIM_COLOR_ORDER_RGBA              (1 << 6) // GUESS
-#define R300_PRIM_NUM_VERTICES_SHIFT            16
-
-// Draw a primitive from vertex data in arrays loaded via 3D_LOAD_VBPNTR.
-// Two parameter dwords:
-// 0. The first parameter appears to be always 0
-// 1. The second parameter is a standard primitive emission dword.
-#define R300_PACKET3_3D_DRAW_VBUF           0x00002800
-
-// Specify the full set of vertex arrays as (address, stride).
-// The first parameter is the number of vertex arrays specified.
-// The rest of the command is a variable length list of blocks, where
-// each block is three dwords long and specifies two arrays.
-// The first dword of a block is split into two words, the lower significant
-// word refers to the first array, the more significant word to the second
-// array in the block.
-// The low byte of each word contains the size of an array entry in dwords,
-// the high byte contains the stride of the array.
-// The second dword of a block contains the pointer to the first array,
-// the third dword of a block contains the pointer to the second array.
-// Note that if the total number of arrays is odd, the third dword of
-// the last block is omitted.
-#define R300_PACKET3_3D_LOAD_VBPNTR         0x00002F00
-
-#define R300_PACKET3_INDX_BUFFER            0x00003300
-#    define R300_EB_UNK1_SHIFT                      24
-#    define R300_EB_UNK1                    (0x80<<24)
-#    define R300_EB_UNK2                        0x0810
-#define R300_PACKET3_3D_DRAW_INDX_2         0x00003600
-
-//END
-
-#endif /* _R300_REG_H */
diff --git a/trunk/drivers/char/drm/radeon_cp.c b/trunk/drivers/char/drm/radeon_cp.c
index 6d9080a3ca7e..20bcf872b348 100644
--- a/trunk/drivers/char/drm/radeon_cp.c
+++ b/trunk/drivers/char/drm/radeon_cp.c
@@ -32,7 +32,6 @@
 #include "drm.h"
 #include "radeon_drm.h"
 #include "radeon_drv.h"
-#include "r300_reg.h"
 
 #define RADEON_FIFO_DEBUG	0
 
@@ -1152,8 +1151,6 @@ static void radeon_cp_init_ring_buffer( drm_device_t *dev,
 
 #if __OS_HAS_AGP
 	if ( !dev_priv->is_pci ) {
-		/* set RADEON_AGP_BASE here instead of relying on X from user space */
-		RADEON_WRITE(RADEON_AGP_BASE, (unsigned int)dev->agp->base);
 		RADEON_WRITE( RADEON_CP_RB_RPTR_ADDR,
 			      dev_priv->ring_rptr->offset
 			      - dev->agp->base
@@ -1410,7 +1407,6 @@ static int radeon_do_init_cp( drm_device_t *dev, drm_radeon_init_t *init )
 		radeon_do_cleanup_cp(dev);
 		return DRM_ERR(EINVAL);
 	}
-	dev->agp_buffer_token = init->buffers_offset;
 	dev->agp_buffer_map = drm_core_findmap(dev, init->buffers_offset);
 	if(!dev->agp_buffer_map) {
 		DRM_ERROR("could not find dma buffer region!\n");
@@ -1629,9 +1625,6 @@ int radeon_cp_init( DRM_IOCTL_ARGS )
 
 	DRM_COPY_FROM_USER_IOCTL( init, (drm_radeon_init_t __user *)data, sizeof(init) );
 
-	if(init.func == RADEON_INIT_R300_CP)
-		r300_init_reg_flags();
-
 	switch ( init.func ) {
 	case RADEON_INIT_CP:
 	case RADEON_INIT_R200_CP:
@@ -2046,43 +2039,15 @@ int radeon_driver_preinit(struct drm_device *dev, unsigned long flags)
 	case CHIP_RV200:
 	case CHIP_R200:
 	case CHIP_R300:
-	case CHIP_R420:
 		dev_priv->flags |= CHIP_HAS_HIERZ;
 		break;
 	default:
 	/* all other chips have no hierarchical z buffer */
 		break;
 	}
-
-	if (drm_device_is_agp(dev))
-		dev_priv->flags |= CHIP_IS_AGP;
-	
-	DRM_DEBUG("%s card detected\n",
-		  ((dev_priv->flags & CHIP_IS_AGP) ? "AGP" : "PCI"));
 	return ret;
 }
 
-int radeon_presetup(struct drm_device *dev)
-{
-	int ret;
-	drm_local_map_t *map;
-	drm_radeon_private_t *dev_priv = dev->dev_private;
-
-	ret = drm_addmap(dev, drm_get_resource_start(dev, 2),
-			 drm_get_resource_len(dev, 2), _DRM_REGISTERS,
-			 _DRM_READ_ONLY, &dev_priv->mmio);
-	if (ret != 0)
-		return ret;
-
-	ret = drm_addmap(dev, drm_get_resource_start(dev, 0),
-			 drm_get_resource_len(dev, 0), _DRM_FRAME_BUFFER,
-			 _DRM_WRITE_COMBINING, &map);
-	if (ret != 0)
-		return ret;
-
-	return 0;
-}
-
 int radeon_driver_postcleanup(struct drm_device *dev)
 {
 	drm_radeon_private_t *dev_priv = dev->dev_private;
diff --git a/trunk/drivers/char/drm/radeon_drm.h b/trunk/drivers/char/drm/radeon_drm.h
index 3792798270a4..c1e62d047989 100644
--- a/trunk/drivers/char/drm/radeon_drm.h
+++ b/trunk/drivers/char/drm/radeon_drm.h
@@ -195,52 +195,6 @@ typedef union {
 #define RADEON_WAIT_2D  0x1
 #define RADEON_WAIT_3D  0x2
 
-/* Allowed parameters for R300_CMD_PACKET3
- */
-#define R300_CMD_PACKET3_CLEAR		0
-#define R300_CMD_PACKET3_RAW		1
-
-/* Commands understood by cmd_buffer ioctl for R300.
- * The interface has not been stabilized, so some of these may be removed
- * and eventually reordered before stabilization.
- */
-#define R300_CMD_PACKET0		1 
-#define R300_CMD_VPU			2 /* emit vertex program upload */
-#define R300_CMD_PACKET3		3 /* emit a packet3 */
-#define R300_CMD_END3D			4 /* emit sequence ending 3d rendering */
-#define R300_CMD_CP_DELAY		5
-#define R300_CMD_DMA_DISCARD		6
-#define R300_CMD_WAIT			7
-#	define R300_WAIT_2D  		0x1
-#	define R300_WAIT_3D  		0x2
-#	define R300_WAIT_2D_CLEAN  	0x3
-#	define R300_WAIT_3D_CLEAN  	0x4
-
-typedef union {
-	unsigned int u;
-	struct {
-		unsigned char cmd_type, pad0, pad1, pad2;
-	} header;
-	struct {
-		unsigned char cmd_type, count, reglo, reghi;
-	} packet0;
-	struct {
-		unsigned char cmd_type, count, adrlo, adrhi;
-	} vpu;
-	struct {
-		unsigned char cmd_type, packet, pad0, pad1;
-	} packet3;
-	struct {
-		unsigned char cmd_type, packet;
-		unsigned short count; /* amount of packet2 to emit */
-	} delay;
-	struct {
-		unsigned char cmd_type, buf_idx, pad0, pad1;
-	} dma;
-	struct {
-		unsigned char cmd_type, flags, pad0, pad1;	
-	} wait;
-} drm_r300_cmd_header_t;
 
 #define RADEON_FRONT			0x1
 #define RADEON_BACK			0x2
diff --git a/trunk/drivers/char/drm/radeon_drv.c b/trunk/drivers/char/drm/radeon_drv.c
index e0682f64b400..18e4e5b0952f 100644
--- a/trunk/drivers/char/drm/radeon_drv.c
+++ b/trunk/drivers/char/drm/radeon_drv.c
@@ -76,7 +76,6 @@ static struct drm_driver driver = {
 	.driver_features = DRIVER_USE_AGP | DRIVER_USE_MTRR | DRIVER_PCI_DMA | DRIVER_SG | DRIVER_HAVE_IRQ | DRIVER_HAVE_DMA | DRIVER_IRQ_SHARED | DRIVER_IRQ_VBL,
 	.dev_priv_size = sizeof(drm_radeon_buf_priv_t),
 	.preinit = radeon_driver_preinit,
-	.presetup = radeon_presetup,
 	.postcleanup = radeon_driver_postcleanup,
 	.prerelease = radeon_driver_prerelease,
 	.pretakedown = radeon_driver_pretakedown,
diff --git a/trunk/drivers/char/drm/radeon_drv.h b/trunk/drivers/char/drm/radeon_drv.h
index f12a963ede18..771aa80a5e8c 100644
--- a/trunk/drivers/char/drm/radeon_drv.h
+++ b/trunk/drivers/char/drm/radeon_drv.h
@@ -82,10 +82,9 @@
  *     - Add support for r100 cube maps
  * 1.16- Add R200_EMIT_PP_TRI_PERF_CNTL packet to support brilinear
  *       texture filtering on r200
- * 1.17- Add initial support for R300 (3D).
  */
 #define DRIVER_MAJOR		1
-#define DRIVER_MINOR		17
+#define DRIVER_MINOR		16
 #define DRIVER_PATCHLEVEL	0
 
 #define GET_RING_HEAD(dev_priv)		DRM_READ32(  (dev_priv)->ring_rptr, 0 )
@@ -107,9 +106,7 @@ enum radeon_family {
 	CHIP_RV280,
 	CHIP_R300,
 	CHIP_RS300,
-	CHIP_R350,
 	CHIP_RV350,
-	CHIP_R420,
 	CHIP_LAST,
 };
 
@@ -293,7 +290,6 @@ extern int radeon_wait_ring( drm_radeon_private_t *dev_priv, int n );
 extern int radeon_do_cp_idle( drm_radeon_private_t *dev_priv );
 
 extern int radeon_driver_preinit(struct drm_device *dev, unsigned long flags);
-extern int radeon_presetup(struct drm_device *dev);
 extern int radeon_driver_postcleanup(struct drm_device *dev);
 
 extern int radeon_mem_alloc( DRM_IOCTL_ARGS );
@@ -324,14 +320,6 @@ extern int radeon_postcleanup( struct drm_device *dev );
 extern long radeon_compat_ioctl(struct file *filp, unsigned int cmd,
 				unsigned long arg);
 
-
-/* r300_cmdbuf.c */
-extern void r300_init_reg_flags(void);
-
-extern int r300_do_cp_cmdbuf(drm_device_t* dev, DRMFILE filp,
-			     drm_file_t* filp_priv,
-			     drm_radeon_cmd_buffer_t* cmdbuf);
-
 /* Flags for stats.boxes
  */
 #define RADEON_BOX_DMA_IDLE      0x1
@@ -369,11 +357,6 @@ extern int r300_do_cp_cmdbuf(drm_device_t* dev, DRMFILE filp,
 #define RADEON_CRTC2_OFFSET		0x0324
 #define RADEON_CRTC2_OFFSET_CNTL	0x0328
 
-#define RADEON_MPP_TB_CONFIG		0x01c0
-#define RADEON_MEM_CNTL			0x0140
-#define RADEON_MEM_SDRAM_MODE_REG	0x0158
-#define RADEON_AGP_BASE			0x0170
-
 #define RADEON_RB3D_COLOROFFSET		0x1c40
 #define RADEON_RB3D_COLORPITCH		0x1c48
 
@@ -668,27 +651,16 @@ extern int r300_do_cp_cmdbuf(drm_device_t* dev, DRMFILE filp,
 #define RADEON_CP_PACKET1		0x40000000
 #define RADEON_CP_PACKET2		0x80000000
 #define RADEON_CP_PACKET3		0xC0000000
-#       define RADEON_CP_NOP                    0x00001000
-#       define RADEON_CP_NEXT_CHAR              0x00001900
-#       define RADEON_CP_PLY_NEXTSCAN           0x00001D00
-#       define RADEON_CP_SET_SCISSORS           0x00001E00
-             /* GEN_INDX_PRIM is unsupported starting with R300 */
 #	define RADEON_3D_RNDR_GEN_INDX_PRIM	0x00002300
 #	define RADEON_WAIT_FOR_IDLE		0x00002600
 #	define RADEON_3D_DRAW_VBUF		0x00002800
 #	define RADEON_3D_DRAW_IMMD		0x00002900
 #	define RADEON_3D_DRAW_INDX		0x00002A00
-#       define RADEON_CP_LOAD_PALETTE           0x00002C00
 #	define RADEON_3D_LOAD_VBPNTR		0x00002F00
 #	define RADEON_MPEG_IDCT_MACROBLOCK	0x00003000
 #	define RADEON_MPEG_IDCT_MACROBLOCK_REV	0x00003100
 #	define RADEON_3D_CLEAR_ZMASK		0x00003200
-#	define RADEON_CP_INDX_BUFFER		0x00003300
-#       define RADEON_CP_3D_DRAW_VBUF_2         0x00003400
-#       define RADEON_CP_3D_DRAW_IMMD_2         0x00003500
-#       define RADEON_CP_3D_DRAW_INDX_2         0x00003600
 #	define RADEON_3D_CLEAR_HIZ		0x00003700
-#       define RADEON_CP_3D_CLEAR_CMASK         0x00003802
 #	define RADEON_CNTL_HOSTDATA_BLT		0x00009400
 #	define RADEON_CNTL_PAINT_MULTI		0x00009A00
 #	define RADEON_CNTL_BITBLT_MULTI		0x00009B00
diff --git a/trunk/drivers/char/drm/radeon_state.c b/trunk/drivers/char/drm/radeon_state.c
index 64a3e3a406ef..1f79e249146c 100644
--- a/trunk/drivers/char/drm/radeon_state.c
+++ b/trunk/drivers/char/drm/radeon_state.c
@@ -1493,7 +1493,7 @@ static void radeon_cp_dispatch_indices( drm_device_t *dev,
 
 }
 
-#define RADEON_MAX_TEXTURE_SIZE RADEON_BUFFER_SIZE
+#define RADEON_MAX_TEXTURE_SIZE (RADEON_BUFFER_SIZE - 8 * sizeof(u32))
 
 static int radeon_cp_dispatch_texture( DRMFILE filp,
 				       drm_device_t *dev,
@@ -1506,11 +1506,10 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 	u32 format;
 	u32 *buffer;
 	const u8 __user *data;
-	int size, dwords, tex_width, blit_width, spitch;
+	int size, dwords, tex_width, blit_width;
 	u32 height;
 	int i;
 	u32 texpitch, microtile;
-	u32 offset;
 	RING_LOCALS;
 
 	DRM_GET_PRIV_WITH_RETURN( filp_priv, filp );
@@ -1531,6 +1530,17 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 	RADEON_WAIT_UNTIL_IDLE();
 	ADVANCE_RING();
 
+#ifdef __BIG_ENDIAN
+	/* The Mesa texture functions provide the data in little endian as the
+	 * chip wants it, but we need to compensate for the fact that the CP
+	 * ring gets byte-swapped
+	 */
+	BEGIN_RING( 2 );
+	OUT_RING_REG( RADEON_RBBM_GUICNTL, RADEON_HOST_DATA_SWAP_32BIT );
+	ADVANCE_RING();
+#endif
+
+
 	/* The compiler won't optimize away a division by a variable,
 	 * even if the only legal values are powers of two.  Thus, we'll
 	 * use a shift instead.
@@ -1562,10 +1572,6 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 		DRM_ERROR( "invalid texture format %d\n", tex->format );
 		return DRM_ERR(EINVAL);
 	}
-	spitch = blit_width >> 6;
-	if (spitch == 0 && image->height > 1)
-		return DRM_ERR(EINVAL);
-
 	texpitch = tex->pitch;
 	if ((texpitch << 22) & RADEON_DST_TILE_MICRO) {
 		microtile = 1;
@@ -1618,6 +1624,25 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 		 */
 		buffer = (u32*)((char*)dev->agp_buffer_map->handle + buf->offset);
 		dwords = size / 4;
+		buffer[0] = CP_PACKET3( RADEON_CNTL_HOSTDATA_BLT, dwords + 6 );
+		buffer[1] = (RADEON_GMC_DST_PITCH_OFFSET_CNTL |
+			     RADEON_GMC_BRUSH_NONE |
+			     (format << 8) |
+			     RADEON_GMC_SRC_DATATYPE_COLOR |
+			     RADEON_ROP3_S |
+			     RADEON_DP_SRC_SOURCE_HOST_DATA |
+			     RADEON_GMC_CLR_CMP_CNTL_DIS |
+			     RADEON_GMC_WR_MSK_DIS);
+		
+		buffer[2] = (texpitch << 22) | (tex->offset >> 10);
+		buffer[3] = 0xffffffff;
+		buffer[4] = 0xffffffff;
+		buffer[5] = (image->y << 16) | image->x;
+		buffer[6] = (height << 16) | image->width;
+		buffer[7] = dwords;
+		buffer += 8;
+
+		
 
 		if (microtile) {
 			/* texture micro tiling in use, minimum texture width is thus 16 bytes.
@@ -1725,28 +1750,9 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
 		}
 
 		buf->filp = filp;
-		buf->used = size;
-		offset = dev_priv->gart_buffers_offset + buf->offset;
-		BEGIN_RING(9);
-		OUT_RING(CP_PACKET3(RADEON_CNTL_BITBLT_MULTI, 5));
-		OUT_RING(RADEON_GMC_SRC_PITCH_OFFSET_CNTL |
-			 RADEON_GMC_DST_PITCH_OFFSET_CNTL |
-			 RADEON_GMC_BRUSH_NONE |
-			 (format << 8) |
-			 RADEON_GMC_SRC_DATATYPE_COLOR |
-			 RADEON_ROP3_S |
-			 RADEON_DP_SRC_SOURCE_MEMORY |
-			 RADEON_GMC_CLR_CMP_CNTL_DIS |
-			 RADEON_GMC_WR_MSK_DIS );
-		OUT_RING((spitch << 22) | (offset >> 10));
-		OUT_RING((texpitch << 22) | (tex->offset >> 10));
-		OUT_RING(0);
-		OUT_RING((image->x << 16) | image->y);
-		OUT_RING((image->width << 16) | height);
-		RADEON_WAIT_UNTIL_2D_IDLE();
-		ADVANCE_RING();
-
-		radeon_cp_discard_buffer(dev, buf);
+		buf->used = (dwords + 8) * sizeof(u32);
+		radeon_cp_dispatch_indirect( dev, buf, 0, buf->used );
+		radeon_cp_discard_buffer( dev, buf );
 
 		/* Update the input parameters for next time */
 		image->y += height;
@@ -2791,17 +2797,6 @@ static int radeon_cp_cmdbuf( DRM_IOCTL_ARGS )
 
 	orig_nbox = cmdbuf.nbox;
 
-	if(dev_priv->microcode_version == UCODE_R300) {
-		int temp;
-		temp=r300_do_cp_cmdbuf(dev, filp, filp_priv, &cmdbuf);
-	
-		if (orig_bufsz != 0)
-			drm_free(kbuf, orig_bufsz, DRM_MEM_DRIVER);
-	
-		return temp;
-	}
-
-	/* microcode_version != r300 */
 	while ( cmdbuf.bufsz >= sizeof(header) ) {
 
 		header.i = *(int *)cmdbuf.buf;
diff --git a/trunk/drivers/char/drm/savage_bci.c b/trunk/drivers/char/drm/savage_bci.c
deleted file mode 100644
index 2fd40bac7c97..000000000000
--- a/trunk/drivers/char/drm/savage_bci.c
+++ /dev/null
@@ -1,1096 +0,0 @@
-/* savage_bci.c -- BCI support for Savage
- *
- * Copyright 2004  Felix Kuehling
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sub license,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the
- * next paragraph) shall be included in all copies or substantial portions
- * of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
- * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
- * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-#include "drmP.h"
-#include "savage_drm.h"
-#include "savage_drv.h"
-
-/* Need a long timeout for shadow status updates can take a while
- * and so can waiting for events when the queue is full. */
-#define SAVAGE_DEFAULT_USEC_TIMEOUT	1000000 /* 1s */
-#define SAVAGE_EVENT_USEC_TIMEOUT	5000000 /* 5s */
-#define SAVAGE_FREELIST_DEBUG		0
-
-static int
-savage_bci_wait_fifo_shadow(drm_savage_private_t *dev_priv, unsigned int n)
-{
-	uint32_t mask = dev_priv->status_used_mask;
-	uint32_t threshold = dev_priv->bci_threshold_hi;
-	uint32_t status;
-	int i;
-
-#if SAVAGE_BCI_DEBUG
-	if (n > dev_priv->cob_size + SAVAGE_BCI_FIFO_SIZE - threshold)
-		DRM_ERROR("Trying to emit %d words "
-			  "(more than guaranteed space in COB)\n", n);
-#endif
-
-	for (i = 0; i < SAVAGE_DEFAULT_USEC_TIMEOUT; i++) {
-		DRM_MEMORYBARRIER();
-		status = dev_priv->status_ptr[0];
-		if ((status & mask) < threshold)
-			return 0;
-		DRM_UDELAY(1);
-	}
-
-#if SAVAGE_BCI_DEBUG
-	DRM_ERROR("failed!\n");
-	DRM_INFO("   status=0x%08x, threshold=0x%08x\n", status, threshold);
-#endif
-	return DRM_ERR(EBUSY);
-}
-
-static int
-savage_bci_wait_fifo_s3d(drm_savage_private_t *dev_priv, unsigned int n)
-{
-	uint32_t maxUsed = dev_priv->cob_size + SAVAGE_BCI_FIFO_SIZE - n;
-	uint32_t status;
-	int i;
-
-	for (i = 0; i < SAVAGE_DEFAULT_USEC_TIMEOUT; i++) {
-		status = SAVAGE_READ(SAVAGE_STATUS_WORD0);
-		if ((status & SAVAGE_FIFO_USED_MASK_S3D) <= maxUsed)
-			return 0;
-		DRM_UDELAY(1);
-	}
-
-#if SAVAGE_BCI_DEBUG
-	DRM_ERROR("failed!\n");
-	DRM_INFO("   status=0x%08x\n", status);
-#endif
-	return DRM_ERR(EBUSY);
-}
-
-static int
-savage_bci_wait_fifo_s4(drm_savage_private_t *dev_priv, unsigned int n)
-{
-	uint32_t maxUsed = dev_priv->cob_size + SAVAGE_BCI_FIFO_SIZE - n;
-	uint32_t status;
-	int i;
-
-	for (i = 0; i < SAVAGE_DEFAULT_USEC_TIMEOUT; i++) {
-		status = SAVAGE_READ(SAVAGE_ALT_STATUS_WORD0);
-		if ((status & SAVAGE_FIFO_USED_MASK_S4) <= maxUsed)
-			return 0;
-		DRM_UDELAY(1);
-	}
-
-#if SAVAGE_BCI_DEBUG
-	DRM_ERROR("failed!\n");
-	DRM_INFO("   status=0x%08x\n", status);
-#endif
-	return DRM_ERR(EBUSY);
-}
-
-/*
- * Waiting for events.
- *
- * The BIOSresets the event tag to 0 on mode changes. Therefore we
- * never emit 0 to the event tag. If we find a 0 event tag we know the
- * BIOS stomped on it and return success assuming that the BIOS waited
- * for engine idle.
- *
- * Note: if the Xserver uses the event tag it has to follow the same
- * rule. Otherwise there may be glitches every 2^16 events.
- */
-static int
-savage_bci_wait_event_shadow(drm_savage_private_t *dev_priv, uint16_t e)
-{
-	uint32_t status;
-	int i;
-
-	for (i = 0; i < SAVAGE_EVENT_USEC_TIMEOUT; i++) {
-		DRM_MEMORYBARRIER();
-		status = dev_priv->status_ptr[1];
-		if ((((status & 0xffff) - e) & 0xffff) <= 0x7fff ||
-		    (status & 0xffff) == 0)
-			return 0;
-		DRM_UDELAY(1);
-	}
-
-#if SAVAGE_BCI_DEBUG
-	DRM_ERROR("failed!\n");
-	DRM_INFO("   status=0x%08x, e=0x%04x\n", status, e);
-#endif
-
-	return DRM_ERR(EBUSY);
-}
-
-static int
-savage_bci_wait_event_reg(drm_savage_private_t *dev_priv, uint16_t e)
-{
-	uint32_t status;
-	int i;
-
-	for (i = 0; i < SAVAGE_EVENT_USEC_TIMEOUT; i++) {
-		status = SAVAGE_READ(SAVAGE_STATUS_WORD1);
-		if ((((status & 0xffff) - e) & 0xffff) <= 0x7fff ||
-		    (status & 0xffff) == 0)
-			return 0;
-		DRM_UDELAY(1);
-	}
-
-#if SAVAGE_BCI_DEBUG
-	DRM_ERROR("failed!\n");
-	DRM_INFO("   status=0x%08x, e=0x%04x\n", status, e);
-#endif
-
-	return DRM_ERR(EBUSY);
-}
-
-uint16_t savage_bci_emit_event(drm_savage_private_t *dev_priv,
-			       unsigned int flags)
-{
-	uint16_t count;
-	BCI_LOCALS;
-
-	if (dev_priv->status_ptr) {
-		/* coordinate with Xserver */
-		count = dev_priv->status_ptr[1023];
-		if (count < dev_priv->event_counter)
-			dev_priv->event_wrap++;
-	} else {
-		count = dev_priv->event_counter;
-	}
-	count = (count + 1) & 0xffff;
-	if (count == 0) {
-		count++; /* See the comment above savage_wait_event_*. */
-		dev_priv->event_wrap++;
-	}
-	dev_priv->event_counter = count;
-	if (dev_priv->status_ptr)
-		dev_priv->status_ptr[1023] = (uint32_t)count;
-
-	if ((flags & (SAVAGE_WAIT_2D | SAVAGE_WAIT_3D))) {
-		unsigned int wait_cmd = BCI_CMD_WAIT;
-		if ((flags & SAVAGE_WAIT_2D))
-			wait_cmd |= BCI_CMD_WAIT_2D;
-		if ((flags & SAVAGE_WAIT_3D))
-			wait_cmd |= BCI_CMD_WAIT_3D;
-		BEGIN_BCI(2);
-		BCI_WRITE(wait_cmd);
-	} else {
-		BEGIN_BCI(1);
-	}
-	BCI_WRITE(BCI_CMD_UPDATE_EVENT_TAG | (uint32_t)count);
-
-	return count;
-}
-
-/*
- * Freelist management
- */
-static int savage_freelist_init(drm_device_t *dev)
-{
-	drm_savage_private_t *dev_priv = dev->dev_private;
-	drm_device_dma_t *dma = dev->dma;
-	drm_buf_t *buf;
-	drm_savage_buf_priv_t *entry;
-	int i;
-	DRM_DEBUG("count=%d\n", dma->buf_count);
-
-	dev_priv->head.next = &dev_priv->tail;
-	dev_priv->head.prev = NULL;
-	dev_priv->head.buf = NULL;
-
-	dev_priv->tail.next = NULL;
-	dev_priv->tail.prev = &dev_priv->head;
-	dev_priv->tail.buf = NULL;
-
-	for (i = 0; i < dma->buf_count; i++) {
-		buf = dma->buflist[i];
-		entry = buf->dev_private;
-
-		SET_AGE(&entry->age, 0, 0);
-		entry->buf = buf;
-
-		entry->next = dev_priv->head.next;
-		entry->prev = &dev_priv->head;
-		dev_priv->head.next->prev = entry;
-		dev_priv->head.next = entry;
-	}
-
-	return 0;
-}
-
-static drm_buf_t *savage_freelist_get(drm_device_t *dev)
-{
-	drm_savage_private_t *dev_priv = dev->dev_private;
-	drm_savage_buf_priv_t *tail = dev_priv->tail.prev;
-	uint16_t event;
-	unsigned int wrap;
-	DRM_DEBUG("\n");
-
-	UPDATE_EVENT_COUNTER();
-	if (dev_priv->status_ptr)
-		event = dev_priv->status_ptr[1] & 0xffff;
-	else
-		event = SAVAGE_READ(SAVAGE_STATUS_WORD1) & 0xffff;
-	wrap = dev_priv->event_wrap;
-	if (event > dev_priv->event_counter)
-		wrap--; /* hardware hasn't passed the last wrap yet */
-
-	DRM_DEBUG("   tail=0x%04x %d\n", tail->age.event, tail->age.wrap);
-	DRM_DEBUG("   head=0x%04x %d\n", event, wrap);
-
-	if (tail->buf && (TEST_AGE(&tail->age, event, wrap) || event == 0)) {
-		drm_savage_buf_priv_t *next = tail->next;
-		drm_savage_buf_priv_t *prev = tail->prev;
-		prev->next = next;
-		next->prev = prev;
-		tail->next = tail->prev = NULL;
-		return tail->buf;
-	}
-
-	DRM_DEBUG("returning NULL, tail->buf=%p!\n", tail->buf);
-	return NULL;
-}
-
-void savage_freelist_put(drm_device_t *dev, drm_buf_t *buf)
-{
-	drm_savage_private_t *dev_priv = dev->dev_private;
-	drm_savage_buf_priv_t *entry = buf->dev_private, *prev, *next;
-
-	DRM_DEBUG("age=0x%04x wrap=%d\n", entry->age.event, entry->age.wrap);
-
-	if (entry->next != NULL || entry->prev != NULL) {
-		DRM_ERROR("entry already on freelist.\n");
-		return;
-	}
-
-	prev = &dev_priv->head;
-	next = prev->next;
-	prev->next = entry;
-	next->prev = entry;
-	entry->prev = prev;
-	entry->next = next;
-}
-
-/*
- * Command DMA
- */
-static int savage_dma_init(drm_savage_private_t *dev_priv)
-{
-	unsigned int i;
-
-	dev_priv->nr_dma_pages = dev_priv->cmd_dma->size /
-		(SAVAGE_DMA_PAGE_SIZE*4);
-	dev_priv->dma_pages = drm_alloc(sizeof(drm_savage_dma_page_t) *
-					dev_priv->nr_dma_pages,
-					DRM_MEM_DRIVER);
-	if (dev_priv->dma_pages == NULL)
-		return DRM_ERR(ENOMEM);
-
-	for (i = 0; i < dev_priv->nr_dma_pages; ++i) {
-		SET_AGE(&dev_priv->dma_pages[i].age, 0, 0);
-		dev_priv->dma_pages[i].used = 0;
-		dev_priv->dma_pages[i].flushed = 0;
-	}
-	SET_AGE(&dev_priv->last_dma_age, 0, 0);
-
-	dev_priv->first_dma_page = 0;
-	dev_priv->current_dma_page = 0;
-
-	return 0;
-}
-
-void savage_dma_reset(drm_savage_private_t *dev_priv)
-{
-	uint16_t event;
-	unsigned int wrap, i;
-	event = savage_bci_emit_event(dev_priv, 0);
-	wrap = dev_priv->event_wrap;
-	for (i = 0; i < dev_priv->nr_dma_pages; ++i) {
-		SET_AGE(&dev_priv->dma_pages[i].age, event, wrap);
-		dev_priv->dma_pages[i].used = 0;
-		dev_priv->dma_pages[i].flushed = 0;
-	}
-	SET_AGE(&dev_priv->last_dma_age, event, wrap);
-	dev_priv->first_dma_page = dev_priv->current_dma_page = 0;
-}
-
-void savage_dma_wait(drm_savage_private_t *dev_priv, unsigned int page)
-{
-	uint16_t event;
-	unsigned int wrap;
-
-	/* Faked DMA buffer pages don't age. */
-	if (dev_priv->cmd_dma == &dev_priv->fake_dma)
-		return;
-
-	UPDATE_EVENT_COUNTER();
-	if (dev_priv->status_ptr)
-		event = dev_priv->status_ptr[1] & 0xffff;
-	else
-		event = SAVAGE_READ(SAVAGE_STATUS_WORD1) & 0xffff;
-	wrap = dev_priv->event_wrap;
-	if (event > dev_priv->event_counter)
-		wrap--; /* hardware hasn't passed the last wrap yet */
-
-	if (dev_priv->dma_pages[page].age.wrap > wrap ||
-	    (dev_priv->dma_pages[page].age.wrap == wrap &&
-	     dev_priv->dma_pages[page].age.event > event)) {
-		if (dev_priv->wait_evnt(dev_priv,
-					dev_priv->dma_pages[page].age.event)
-		    < 0)
-			DRM_ERROR("wait_evnt failed!\n");
-	}
-}
-
-uint32_t *savage_dma_alloc(drm_savage_private_t *dev_priv, unsigned int n)
-{
-	unsigned int cur = dev_priv->current_dma_page;
-	unsigned int rest = SAVAGE_DMA_PAGE_SIZE -
-		dev_priv->dma_pages[cur].used;
-	unsigned int nr_pages = (n - rest + SAVAGE_DMA_PAGE_SIZE-1) /
-		SAVAGE_DMA_PAGE_SIZE;
-	uint32_t *dma_ptr;
-	unsigned int i;
-
-	DRM_DEBUG("cur=%u, cur->used=%u, n=%u, rest=%u, nr_pages=%u\n",
-		  cur, dev_priv->dma_pages[cur].used, n, rest, nr_pages);
-
-	if (cur + nr_pages < dev_priv->nr_dma_pages) {
-		dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle +
-			cur*SAVAGE_DMA_PAGE_SIZE +
-			dev_priv->dma_pages[cur].used;
-		if (n < rest)
-			rest = n;
-		dev_priv->dma_pages[cur].used += rest;
-		n -= rest;
-		cur++;
-	} else {
-		dev_priv->dma_flush(dev_priv);
-		nr_pages = (n + SAVAGE_DMA_PAGE_SIZE-1) / SAVAGE_DMA_PAGE_SIZE;
-		for (i = cur; i < dev_priv->nr_dma_pages; ++i) {
-			dev_priv->dma_pages[i].age = dev_priv->last_dma_age;
-			dev_priv->dma_pages[i].used = 0;
-			dev_priv->dma_pages[i].flushed = 0;
-		}
-		dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle;
-		dev_priv->first_dma_page = cur = 0;
-	}
-	for (i = cur; nr_pages > 0; ++i, --nr_pages) {
-#if SAVAGE_DMA_DEBUG
-		if (dev_priv->dma_pages[i].used) {
-			DRM_ERROR("unflushed page %u: used=%u\n",
-				  i, dev_priv->dma_pages[i].used);
-		}
-#endif
-		if (n > SAVAGE_DMA_PAGE_SIZE)
-			dev_priv->dma_pages[i].used = SAVAGE_DMA_PAGE_SIZE;
-		else
-			dev_priv->dma_pages[i].used = n;
-		n -= SAVAGE_DMA_PAGE_SIZE;
-	}
-	dev_priv->current_dma_page = --i;
-
-	DRM_DEBUG("cur=%u, cur->used=%u, n=%u\n",
-		  i, dev_priv->dma_pages[i].used, n);
-
-	savage_dma_wait(dev_priv, dev_priv->current_dma_page);
-
-	return dma_ptr;
-}
-
-static void savage_dma_flush(drm_savage_private_t *dev_priv)
-{
-	unsigned int first = dev_priv->first_dma_page;
-	unsigned int cur = dev_priv->current_dma_page;
-	uint16_t event;
-	unsigned int wrap, pad, align, len, i;
-	unsigned long phys_addr;
-	BCI_LOCALS;
-
-	if (first == cur &&
-	    dev_priv->dma_pages[cur].used == dev_priv->dma_pages[cur].flushed)
-		return;
-
-	/* pad length to multiples of 2 entries
-	 * align start of next DMA block to multiles of 8 entries */
-	pad = -dev_priv->dma_pages[cur].used & 1;
-	align = -(dev_priv->dma_pages[cur].used + pad) & 7;
-
-	DRM_DEBUG("first=%u, cur=%u, first->flushed=%u, cur->used=%u, "
-		  "pad=%u, align=%u\n",
-		  first, cur, dev_priv->dma_pages[first].flushed,
-		  dev_priv->dma_pages[cur].used, pad, align);
-
-	/* pad with noops */
-	if (pad) {
-		uint32_t *dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle +
-			cur * SAVAGE_DMA_PAGE_SIZE +
-			dev_priv->dma_pages[cur].used;
-		dev_priv->dma_pages[cur].used += pad;
-		while(pad != 0) {
-			*dma_ptr++ = BCI_CMD_WAIT;
-			pad--;
-		}
-	}
-
-	DRM_MEMORYBARRIER();
-
-	/* do flush ... */
-	phys_addr = dev_priv->cmd_dma->offset +
-		(first * SAVAGE_DMA_PAGE_SIZE +
-		 dev_priv->dma_pages[first].flushed) * 4;
-	len = (cur - first) * SAVAGE_DMA_PAGE_SIZE +
-		dev_priv->dma_pages[cur].used -
-		dev_priv->dma_pages[first].flushed;
-
-	DRM_DEBUG("phys_addr=%lx, len=%u\n",
-		  phys_addr | dev_priv->dma_type, len);
-
-	BEGIN_BCI(3);
-	BCI_SET_REGISTERS(SAVAGE_DMABUFADDR, 1);
-	BCI_WRITE(phys_addr | dev_priv->dma_type);
-	BCI_DMA(len);
-
-	/* fix alignment of the start of the next block */
-	dev_priv->dma_pages[cur].used += align;
-
-	/* age DMA pages */
-	event = savage_bci_emit_event(dev_priv, 0);
-	wrap = dev_priv->event_wrap;
-	for (i = first; i < cur; ++i) {
-		SET_AGE(&dev_priv->dma_pages[i].age, event, wrap);
-		dev_priv->dma_pages[i].used = 0;
-		dev_priv->dma_pages[i].flushed = 0;
-	}
-	/* age the current page only when it's full */
-	if (dev_priv->dma_pages[cur].used == SAVAGE_DMA_PAGE_SIZE) {
-		SET_AGE(&dev_priv->dma_pages[cur].age, event, wrap);
-		dev_priv->dma_pages[cur].used = 0;
-		dev_priv->dma_pages[cur].flushed = 0;
-		/* advance to next page */
-		cur++;
-		if (cur == dev_priv->nr_dma_pages)
-			cur = 0;
-		dev_priv->first_dma_page = dev_priv->current_dma_page = cur;
-	} else {
-		dev_priv->first_dma_page = cur;
-		dev_priv->dma_pages[cur].flushed = dev_priv->dma_pages[i].used;
-	}
-	SET_AGE(&dev_priv->last_dma_age, event, wrap);
-
-	DRM_DEBUG("first=cur=%u, cur->used=%u, cur->flushed=%u\n", cur,
-		  dev_priv->dma_pages[cur].used,
-		  dev_priv->dma_pages[cur].flushed);
-}
-
-static void savage_fake_dma_flush(drm_savage_private_t *dev_priv)
-{
-	unsigned int i, j;
-	BCI_LOCALS;
-
-	if (dev_priv->first_dma_page == dev_priv->current_dma_page &&
-	    dev_priv->dma_pages[dev_priv->current_dma_page].used == 0)
-		return;
-
-	DRM_DEBUG("first=%u, cur=%u, cur->used=%u\n",
-		  dev_priv->first_dma_page, dev_priv->current_dma_page,
-		  dev_priv->dma_pages[dev_priv->current_dma_page].used);
-
-	for (i = dev_priv->first_dma_page;
-	     i <= dev_priv->current_dma_page && dev_priv->dma_pages[i].used;
-	     ++i) {
-		uint32_t *dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle +
-			i * SAVAGE_DMA_PAGE_SIZE;
-#if SAVAGE_DMA_DEBUG
-		/* Sanity check: all pages except the last one must be full. */
-		if (i < dev_priv->current_dma_page &&
-		    dev_priv->dma_pages[i].used != SAVAGE_DMA_PAGE_SIZE) {
-			DRM_ERROR("partial DMA page %u: used=%u",
-				  i, dev_priv->dma_pages[i].used);
-		}
-#endif
-		BEGIN_BCI(dev_priv->dma_pages[i].used);
-		for (j = 0; j < dev_priv->dma_pages[i].used; ++j) {
-			BCI_WRITE(dma_ptr[j]);
-		}
-		dev_priv->dma_pages[i].used = 0;
-	}
-
-	/* reset to first page */
-	dev_priv->first_dma_page = dev_priv->current_dma_page = 0;
-}
-
-/*
- * Initalize mappings. On Savage4 and SavageIX the alignment
- * and size of the aperture is not suitable for automatic MTRR setup
- * in drm_addmap. Therefore we do it manually before the maps are
- * initialized. We also need to take care of deleting the MTRRs in
- * postcleanup.
- */
-int savage_preinit(drm_device_t *dev, unsigned long chipset)
-{
-	drm_savage_private_t *dev_priv;
-	unsigned long mmio_base, fb_base, fb_size, aperture_base;
-	/* fb_rsrc and aper_rsrc aren't really used currently, but still exist
-	 * in case we decide we need information on the BAR for BSD in the
-	 * future.
-	 */
-	unsigned int fb_rsrc, aper_rsrc;
-	int ret = 0;
-
-	dev_priv = drm_alloc(sizeof(drm_savage_private_t), DRM_MEM_DRIVER);
-	if (dev_priv == NULL)
-		return DRM_ERR(ENOMEM);
-
-	memset(dev_priv, 0, sizeof(drm_savage_private_t));
-	dev->dev_private = (void *)dev_priv;
-	dev_priv->chipset = (enum savage_family)chipset;
-
-	dev_priv->mtrr[0].handle = -1;
-	dev_priv->mtrr[1].handle = -1;
-	dev_priv->mtrr[2].handle = -1;
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-		fb_rsrc = 0;
-		fb_base = drm_get_resource_start(dev, 0);
-		fb_size = SAVAGE_FB_SIZE_S3;
-		mmio_base = fb_base + SAVAGE_FB_SIZE_S3;
-		aper_rsrc = 0;
-		aperture_base = fb_base + SAVAGE_APERTURE_OFFSET;
-		/* this should always be true */
-		if (drm_get_resource_len(dev, 0) == 0x08000000) {
-			/* Don't make MMIO write-cobining! We need 3
-			 * MTRRs. */
-			dev_priv->mtrr[0].base = fb_base;
-			dev_priv->mtrr[0].size = 0x01000000;
-			dev_priv->mtrr[0].handle = mtrr_add(
-				dev_priv->mtrr[0].base, dev_priv->mtrr[0].size,
-				MTRR_TYPE_WRCOMB, 1);
-			dev_priv->mtrr[1].base = fb_base+0x02000000;
-			dev_priv->mtrr[1].size = 0x02000000;
-			dev_priv->mtrr[1].handle = mtrr_add(
-				dev_priv->mtrr[1].base, dev_priv->mtrr[1].size,
-				MTRR_TYPE_WRCOMB, 1);
-			dev_priv->mtrr[2].base = fb_base+0x04000000;
-			dev_priv->mtrr[2].size = 0x04000000;
-			dev_priv->mtrr[2].handle = mtrr_add(
-				dev_priv->mtrr[2].base, dev_priv->mtrr[2].size,
-				MTRR_TYPE_WRCOMB, 1);
-		} else {
-			DRM_ERROR("strange pci_resource_len %08lx\n",
-				  drm_get_resource_len(dev, 0));
-		}
-	} else if (chipset != S3_SUPERSAVAGE && chipset != S3_SAVAGE2000) {
-		mmio_base = drm_get_resource_start(dev, 0);
-		fb_rsrc = 1;
-		fb_base = drm_get_resource_start(dev, 1);
-		fb_size = SAVAGE_FB_SIZE_S4;
-		aper_rsrc = 1;
-		aperture_base = fb_base + SAVAGE_APERTURE_OFFSET;
-		/* this should always be true */
-		if (drm_get_resource_len(dev, 1) == 0x08000000) {
-			/* Can use one MTRR to cover both fb and
-			 * aperture. */
-			dev_priv->mtrr[0].base = fb_base;
-			dev_priv->mtrr[0].size = 0x08000000;
-			dev_priv->mtrr[0].handle = mtrr_add(
-				dev_priv->mtrr[0].base, dev_priv->mtrr[0].size,
-				MTRR_TYPE_WRCOMB, 1);
-		} else {
-			DRM_ERROR("strange pci_resource_len %08lx\n",
-				  drm_get_resource_len(dev, 1));
-		}
-	} else {
-		mmio_base = drm_get_resource_start(dev, 0);
-		fb_rsrc = 1;
-		fb_base = drm_get_resource_start(dev, 1);
-		fb_size = drm_get_resource_len(dev, 1);
-		aper_rsrc = 2;
-		aperture_base = drm_get_resource_start(dev, 2);
-		/* Automatic MTRR setup will do the right thing. */
-	}
-
-	ret = drm_addmap(dev, mmio_base, SAVAGE_MMIO_SIZE, _DRM_REGISTERS,
-			 _DRM_READ_ONLY, &dev_priv->mmio);
-	if (ret)
-		return ret;
-
-	ret = drm_addmap(dev, fb_base, fb_size, _DRM_FRAME_BUFFER,
-			 _DRM_WRITE_COMBINING, &dev_priv->fb);
-	if (ret)
-		return ret;
-
-	ret = drm_addmap(dev, aperture_base, SAVAGE_APERTURE_SIZE,
-			 _DRM_FRAME_BUFFER, _DRM_WRITE_COMBINING,
-			 &dev_priv->aperture);
-	if (ret)
-		return ret;
-
-	return ret;
-}
-
-/*
- * Delete MTRRs and free device-private data.
- */
-int savage_postcleanup(drm_device_t *dev)
-{
-	drm_savage_private_t *dev_priv = dev->dev_private;
-	int i;
-
-	for (i = 0; i < 3; ++i)
-		if (dev_priv->mtrr[i].handle >= 0)
-			mtrr_del(dev_priv->mtrr[i].handle,
-				 dev_priv->mtrr[i].base,
-				 dev_priv->mtrr[i].size);
-
-	drm_free(dev_priv, sizeof(drm_savage_private_t), DRM_MEM_DRIVER);
-
-	return 0;
-}
-
-static int savage_do_init_bci(drm_device_t *dev, drm_savage_init_t *init)
-{
-	drm_savage_private_t *dev_priv = dev->dev_private;
-
-	if (init->fb_bpp != 16 && init->fb_bpp != 32) {
-		DRM_ERROR("invalid frame buffer bpp %d!\n", init->fb_bpp);
-		return DRM_ERR(EINVAL);
-	}
-	if (init->depth_bpp != 16 && init->depth_bpp != 32) {
-		DRM_ERROR("invalid depth buffer bpp %d!\n", init->fb_bpp);
-		return DRM_ERR(EINVAL);
-	}
-	if (init->dma_type != SAVAGE_DMA_AGP &&
-	    init->dma_type != SAVAGE_DMA_PCI) {
-		DRM_ERROR("invalid dma memory type %d!\n", init->dma_type);
-		return DRM_ERR(EINVAL);
-	}
-
-	dev_priv->cob_size = init->cob_size;
-	dev_priv->bci_threshold_lo = init->bci_threshold_lo;
-	dev_priv->bci_threshold_hi = init->bci_threshold_hi;
-	dev_priv->dma_type = init->dma_type;
-
-	dev_priv->fb_bpp = init->fb_bpp;
-	dev_priv->front_offset = init->front_offset;
-	dev_priv->front_pitch = init->front_pitch;
-	dev_priv->back_offset = init->back_offset;
-	dev_priv->back_pitch = init->back_pitch;
-	dev_priv->depth_bpp = init->depth_bpp;
-	dev_priv->depth_offset = init->depth_offset;
-	dev_priv->depth_pitch = init->depth_pitch;
-
-	dev_priv->texture_offset = init->texture_offset;
-	dev_priv->texture_size = init->texture_size;
-
-	DRM_GETSAREA();
-	if (!dev_priv->sarea) {
-		DRM_ERROR("could not find sarea!\n");
-		savage_do_cleanup_bci(dev);
-		return DRM_ERR(EINVAL);
-	}
-	if (init->status_offset != 0) {
-		dev_priv->status = drm_core_findmap(dev, init->status_offset);
-		if (!dev_priv->status) {
-			DRM_ERROR("could not find shadow status region!\n");
-			savage_do_cleanup_bci(dev);
-			return DRM_ERR(EINVAL);
-		}
-	} else {
-		dev_priv->status = NULL;
-	}
-	if (dev_priv->dma_type == SAVAGE_DMA_AGP && init->buffers_offset) {
-		dev->agp_buffer_map = drm_core_findmap(dev,
-						       init->buffers_offset);
-		if (!dev->agp_buffer_map) {
-			DRM_ERROR("could not find DMA buffer region!\n");
-			savage_do_cleanup_bci(dev);
-			return DRM_ERR(EINVAL);
-		}
-		drm_core_ioremap(dev->agp_buffer_map, dev);
-		if (!dev->agp_buffer_map) {
-			DRM_ERROR("failed to ioremap DMA buffer region!\n");
-			savage_do_cleanup_bci(dev);
-			return DRM_ERR(ENOMEM);
-		}
-	}
-	if (init->agp_textures_offset) {
-		dev_priv->agp_textures =
-			drm_core_findmap(dev, init->agp_textures_offset);
-		if (!dev_priv->agp_textures) {
-			DRM_ERROR("could not find agp texture region!\n");
-			savage_do_cleanup_bci(dev);
-			return DRM_ERR(EINVAL);
-		}
-	} else {
-		dev_priv->agp_textures = NULL;
-	}
-
-	if (init->cmd_dma_offset) {
-		if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-			DRM_ERROR("command DMA not supported on "
-				  "Savage3D/MX/IX.\n");
-			savage_do_cleanup_bci(dev);
-			return DRM_ERR(EINVAL);
-		}
-		if (dev->dma && dev->dma->buflist) {
-			DRM_ERROR("command and vertex DMA not supported "
-				  "at the same time.\n");
-			savage_do_cleanup_bci(dev);
-			return DRM_ERR(EINVAL);
-		}
-		dev_priv->cmd_dma = drm_core_findmap(dev, init->cmd_dma_offset);
-		if (!dev_priv->cmd_dma) {
-			DRM_ERROR("could not find command DMA region!\n");
-			savage_do_cleanup_bci(dev);
-			return DRM_ERR(EINVAL);
-		}
-		if (dev_priv->dma_type == SAVAGE_DMA_AGP) {
-			if (dev_priv->cmd_dma->type != _DRM_AGP) {
-				DRM_ERROR("AGP command DMA region is not a "
-					  "_DRM_AGP map!\n");
-				savage_do_cleanup_bci(dev);
-				return DRM_ERR(EINVAL);
-			}
-			drm_core_ioremap(dev_priv->cmd_dma, dev);
-			if (!dev_priv->cmd_dma->handle) {
-				DRM_ERROR("failed to ioremap command "
-					  "DMA region!\n");
-				savage_do_cleanup_bci(dev);
-				return DRM_ERR(ENOMEM);
-			}
-		} else if (dev_priv->cmd_dma->type != _DRM_CONSISTENT) {
-			DRM_ERROR("PCI command DMA region is not a "
-				  "_DRM_CONSISTENT map!\n");
-			savage_do_cleanup_bci(dev);
-			return DRM_ERR(EINVAL);
-		}
-	} else {
-		dev_priv->cmd_dma = NULL;
-	}
-
-	dev_priv->dma_flush = savage_dma_flush;
-	if (!dev_priv->cmd_dma) {
-		DRM_DEBUG("falling back to faked command DMA.\n");
-		dev_priv->fake_dma.offset = 0;
-		dev_priv->fake_dma.size = SAVAGE_FAKE_DMA_SIZE;
-		dev_priv->fake_dma.type = _DRM_SHM;
-		dev_priv->fake_dma.handle = drm_alloc(SAVAGE_FAKE_DMA_SIZE,
-						      DRM_MEM_DRIVER);
-		if (!dev_priv->fake_dma.handle) {
-			DRM_ERROR("could not allocate faked DMA buffer!\n");
-			savage_do_cleanup_bci(dev);
-			return DRM_ERR(ENOMEM);
-		}
-		dev_priv->cmd_dma = &dev_priv->fake_dma;
-		dev_priv->dma_flush = savage_fake_dma_flush;
-	}
-
-	dev_priv->sarea_priv =
-		(drm_savage_sarea_t *)((uint8_t *)dev_priv->sarea->handle +
-				       init->sarea_priv_offset);
-
-	/* setup bitmap descriptors */
-	{
-		unsigned int color_tile_format;
-		unsigned int depth_tile_format;
-		unsigned int front_stride, back_stride, depth_stride;
-		if (dev_priv->chipset <= S3_SAVAGE4) {
-			color_tile_format = dev_priv->fb_bpp == 16 ?
-				SAVAGE_BD_TILE_16BPP : SAVAGE_BD_TILE_32BPP;
-			depth_tile_format = dev_priv->depth_bpp == 16 ?
-				SAVAGE_BD_TILE_16BPP : SAVAGE_BD_TILE_32BPP;
-		} else {
-			color_tile_format = SAVAGE_BD_TILE_DEST;
-			depth_tile_format = SAVAGE_BD_TILE_DEST;
-		}
-		front_stride = dev_priv->front_pitch / (dev_priv->fb_bpp/8);
-		back_stride  = dev_priv-> back_pitch / (dev_priv->fb_bpp/8);
-		depth_stride = dev_priv->depth_pitch / (dev_priv->depth_bpp/8);
-
-		dev_priv->front_bd = front_stride | SAVAGE_BD_BW_DISABLE |
-			(dev_priv->fb_bpp << SAVAGE_BD_BPP_SHIFT) |
-			(color_tile_format << SAVAGE_BD_TILE_SHIFT);
-
-		dev_priv-> back_bd =  back_stride | SAVAGE_BD_BW_DISABLE |
-			(dev_priv->fb_bpp << SAVAGE_BD_BPP_SHIFT) |
-			(color_tile_format << SAVAGE_BD_TILE_SHIFT);
-
-		dev_priv->depth_bd = depth_stride | SAVAGE_BD_BW_DISABLE |
-			(dev_priv->depth_bpp << SAVAGE_BD_BPP_SHIFT) |
-			(depth_tile_format << SAVAGE_BD_TILE_SHIFT);
-	}
-
-	/* setup status and bci ptr */
-	dev_priv->event_counter = 0;
-	dev_priv->event_wrap = 0;
-	dev_priv->bci_ptr = (volatile uint32_t *)
-	    ((uint8_t *)dev_priv->mmio->handle + SAVAGE_BCI_OFFSET);
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-		dev_priv->status_used_mask = SAVAGE_FIFO_USED_MASK_S3D;
-	} else {
-		dev_priv->status_used_mask = SAVAGE_FIFO_USED_MASK_S4;
-	}
-	if (dev_priv->status != NULL) {
-		dev_priv->status_ptr =
-			(volatile uint32_t *)dev_priv->status->handle;
-		dev_priv->wait_fifo = savage_bci_wait_fifo_shadow;
-		dev_priv->wait_evnt = savage_bci_wait_event_shadow;
-		dev_priv->status_ptr[1023] = dev_priv->event_counter;
-	} else {
-		dev_priv->status_ptr = NULL;
-		if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-			dev_priv->wait_fifo = savage_bci_wait_fifo_s3d;
-		} else {
-			dev_priv->wait_fifo = savage_bci_wait_fifo_s4;
-		}
-		dev_priv->wait_evnt = savage_bci_wait_event_reg;
-	}
-
-	/* cliprect functions */
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset))
-		dev_priv->emit_clip_rect = savage_emit_clip_rect_s3d;
-	else
-		dev_priv->emit_clip_rect = savage_emit_clip_rect_s4;
-
-	if (savage_freelist_init(dev) < 0) {
-		DRM_ERROR("could not initialize freelist\n");
-		savage_do_cleanup_bci(dev);
-		return DRM_ERR(ENOMEM);
-	}
-
-	if (savage_dma_init(dev_priv) <  0) {
-		DRM_ERROR("could not initialize command DMA\n");
-		savage_do_cleanup_bci(dev);
-		return DRM_ERR(ENOMEM);
-	}
-
-	return 0;
-}
-
-int savage_do_cleanup_bci(drm_device_t *dev)
-{
-	drm_savage_private_t *dev_priv = dev->dev_private;
-
-	if (dev_priv->cmd_dma == &dev_priv->fake_dma) {
-		if (dev_priv->fake_dma.handle)
-			drm_free(dev_priv->fake_dma.handle,
-				 SAVAGE_FAKE_DMA_SIZE, DRM_MEM_DRIVER);
-	} else if (dev_priv->cmd_dma && dev_priv->cmd_dma->handle &&
-		   dev_priv->cmd_dma->type == _DRM_AGP &&
-		   dev_priv->dma_type == SAVAGE_DMA_AGP)
-		drm_core_ioremapfree(dev_priv->cmd_dma, dev);
-
-	if (dev_priv->dma_type == SAVAGE_DMA_AGP &&
-	    dev->agp_buffer_map && dev->agp_buffer_map->handle) {
-		drm_core_ioremapfree(dev->agp_buffer_map, dev);
-		/* make sure the next instance (which may be running
-		 * in PCI mode) doesn't try to use an old
-		 * agp_buffer_map. */
-		dev->agp_buffer_map = NULL;
-	}
-
-	if (dev_priv->dma_pages)
-		drm_free(dev_priv->dma_pages,
-			 sizeof(drm_savage_dma_page_t)*dev_priv->nr_dma_pages,
-			 DRM_MEM_DRIVER);
-
-	return 0;
-}
-
-static int savage_bci_init(DRM_IOCTL_ARGS)
-{
-	DRM_DEVICE;
-	drm_savage_init_t init;
-
-	LOCK_TEST_WITH_RETURN(dev, filp);
-
-	DRM_COPY_FROM_USER_IOCTL(init, (drm_savage_init_t __user *)data,
-				 sizeof(init));
-
-	switch (init.func) {
-	case SAVAGE_INIT_BCI:
-		return savage_do_init_bci(dev, &init);
-	case SAVAGE_CLEANUP_BCI:
-		return savage_do_cleanup_bci(dev);
-	}
-
-	return DRM_ERR(EINVAL);
-}
-
-static int savage_bci_event_emit(DRM_IOCTL_ARGS)
-{
-	DRM_DEVICE;
-	drm_savage_private_t *dev_priv = dev->dev_private;
-	drm_savage_event_emit_t event;
-
-	DRM_DEBUG("\n");
-
-	LOCK_TEST_WITH_RETURN(dev, filp);
-
-	DRM_COPY_FROM_USER_IOCTL(event, (drm_savage_event_emit_t __user *)data,
-				 sizeof(event));
-
-	event.count = savage_bci_emit_event(dev_priv, event.flags);
-	event.count |= dev_priv->event_wrap << 16;
-	DRM_COPY_TO_USER_IOCTL(&((drm_savage_event_emit_t __user *)data)->count,
-			       event.count, sizeof(event.count));
-	return 0;
-}
-
-static int savage_bci_event_wait(DRM_IOCTL_ARGS)
-{
-	DRM_DEVICE;
-	drm_savage_private_t *dev_priv = dev->dev_private;
-	drm_savage_event_wait_t event;
-	unsigned int event_e, hw_e;
-	unsigned int event_w, hw_w;
-
-	DRM_DEBUG("\n");
-
-	DRM_COPY_FROM_USER_IOCTL(event, (drm_savage_event_wait_t __user *)data,
-				 sizeof(event));
-
-	UPDATE_EVENT_COUNTER();
-	if (dev_priv->status_ptr)
-		hw_e = dev_priv->status_ptr[1] & 0xffff;
-	else
-		hw_e = SAVAGE_READ(SAVAGE_STATUS_WORD1) & 0xffff;
-	hw_w = dev_priv->event_wrap;
-	if (hw_e > dev_priv->event_counter)
-		hw_w--; /* hardware hasn't passed the last wrap yet */
-
-	event_e = event.count & 0xffff;
-	event_w = event.count >> 16;
-
-	/* Don't need to wait if
-	 * - event counter wrapped since the event was emitted or
-	 * - the hardware has advanced up to or over the event to wait for.
-	 */
-	if (event_w < hw_w || (event_w == hw_w && event_e <= hw_e) )
-		return 0;
-	else
-		return dev_priv->wait_evnt(dev_priv, event_e);
-}
-
-/*
- * DMA buffer management
- */
-
-static int savage_bci_get_buffers(DRMFILE filp, drm_device_t *dev, drm_dma_t *d)
-{
-	drm_buf_t *buf;
-	int i;
-
-	for (i = d->granted_count; i < d->request_count; i++) {
-		buf = savage_freelist_get(dev);
-		if (!buf)
-			return DRM_ERR(EAGAIN);
-
-		buf->filp = filp;
-
-		if (DRM_COPY_TO_USER(&d->request_indices[i],
-				     &buf->idx, sizeof(buf->idx)))
-			return DRM_ERR(EFAULT);
-		if (DRM_COPY_TO_USER(&d->request_sizes[i],
-				     &buf->total, sizeof(buf->total)))
-			return DRM_ERR(EFAULT);
-
-		d->granted_count++;
-	}
-	return 0;
-}
-
-int savage_bci_buffers(DRM_IOCTL_ARGS)
-{
-	DRM_DEVICE;
-	drm_device_dma_t *dma = dev->dma;
-	drm_dma_t d;
-	int ret = 0;
-
-	LOCK_TEST_WITH_RETURN(dev, filp);
-
-	DRM_COPY_FROM_USER_IOCTL(d, (drm_dma_t __user *)data, sizeof(d));
-
-	/* Please don't send us buffers.
-	 */
-	if (d.send_count != 0) {
-		DRM_ERROR("Process %d trying to send %d buffers via drmDMA\n",
-			  DRM_CURRENTPID, d.send_count);
-		return DRM_ERR(EINVAL);
-	}
-
-	/* We'll send you buffers.
-	 */
-	if (d.request_count < 0 || d.request_count > dma->buf_count) {
-		DRM_ERROR("Process %d trying to get %d buffers (of %d max)\n",
-			  DRM_CURRENTPID, d.request_count, dma->buf_count);
-		return DRM_ERR(EINVAL);
-	}
-
-	d.granted_count = 0;
-
-	if (d.request_count) {
-		ret = savage_bci_get_buffers(filp, dev, &d);
-	}
-
-	DRM_COPY_TO_USER_IOCTL((drm_dma_t __user *)data, d, sizeof(d));
-
-	return ret;
-}
-
-void savage_reclaim_buffers(drm_device_t *dev, DRMFILE filp) {
-	drm_device_dma_t *dma = dev->dma;
-	drm_savage_private_t *dev_priv = dev->dev_private;
-	int i;
-
-	if (!dma)
-		return;
-	if (!dev_priv)
-		return;
-	if (!dma->buflist)
-		return;
-
-	/*i830_flush_queue(dev);*/
-
-	for (i = 0; i < dma->buf_count; i++) {
-		drm_buf_t *buf = dma->buflist[i];
-		drm_savage_buf_priv_t *buf_priv = buf->dev_private;
-
-		if (buf->filp == filp && buf_priv &&
-		    buf_priv->next == NULL && buf_priv->prev == NULL) {
-			uint16_t event;
-			DRM_DEBUG("reclaimed from client\n");
-			event = savage_bci_emit_event(dev_priv, SAVAGE_WAIT_3D);
-			SET_AGE(&buf_priv->age, event, dev_priv->event_wrap);
-			savage_freelist_put(dev, buf);
-		}
-	}
-
-	drm_core_reclaim_buffers(dev, filp);
-}
-
-
-drm_ioctl_desc_t savage_ioctls[] = {
-	[DRM_IOCTL_NR(DRM_SAVAGE_BCI_INIT)] = {savage_bci_init, 1, 1},
-	[DRM_IOCTL_NR(DRM_SAVAGE_BCI_CMDBUF)] = {savage_bci_cmdbuf, 1, 0},
-	[DRM_IOCTL_NR(DRM_SAVAGE_BCI_EVENT_EMIT)] = {savage_bci_event_emit, 1, 0},
-	[DRM_IOCTL_NR(DRM_SAVAGE_BCI_EVENT_WAIT)] = {savage_bci_event_wait, 1, 0},
-};
-
-int savage_max_ioctl = DRM_ARRAY_SIZE(savage_ioctls);
diff --git a/trunk/drivers/char/drm/savage_drm.h b/trunk/drivers/char/drm/savage_drm.h
deleted file mode 100644
index 6526c9aa7589..000000000000
--- a/trunk/drivers/char/drm/savage_drm.h
+++ /dev/null
@@ -1,209 +0,0 @@
-/* savage_drm.h -- Public header for the savage driver
- *
- * Copyright 2004  Felix Kuehling
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sub license,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the
- * next paragraph) shall be included in all copies or substantial portions
- * of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
- * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
- * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-
-#ifndef __SAVAGE_DRM_H__
-#define __SAVAGE_DRM_H__
-
-#ifndef __SAVAGE_SAREA_DEFINES__
-#define __SAVAGE_SAREA_DEFINES__
-
-/* 2 heaps (1 for card, 1 for agp), each divided into upto 128
- * regions, subject to a minimum region size of (1<<16) == 64k.
- *
- * Clients may subdivide regions internally, but when sharing between
- * clients, the region size is the minimum granularity.
- */
-
-#define SAVAGE_CARD_HEAP		0
-#define SAVAGE_AGP_HEAP			1
-#define SAVAGE_NR_TEX_HEAPS		2
-#define SAVAGE_NR_TEX_REGIONS		16
-#define SAVAGE_LOG_MIN_TEX_REGION_SIZE	16
-
-#endif /* __SAVAGE_SAREA_DEFINES__ */
-
-typedef struct _drm_savage_sarea {
-	/* LRU lists for texture memory in agp space and on the card.
-	 */
-	drm_tex_region_t texList[SAVAGE_NR_TEX_HEAPS][SAVAGE_NR_TEX_REGIONS+1];
-	unsigned int texAge[SAVAGE_NR_TEX_HEAPS];
-
-	/* Mechanism to validate card state.
-	 */
-	int ctxOwner;
-} drm_savage_sarea_t, *drm_savage_sarea_ptr;
-
-/* Savage-specific ioctls
- */
-#define DRM_SAVAGE_BCI_INIT		0x00
-#define DRM_SAVAGE_BCI_CMDBUF           0x01
-#define DRM_SAVAGE_BCI_EVENT_EMIT	0x02
-#define DRM_SAVAGE_BCI_EVENT_WAIT	0x03
-
-#define DRM_IOCTL_SAVAGE_INIT		DRM_IOW( DRM_COMMAND_BASE + DRM_SAVAGE_BCI_INIT, drm_savage_init_t)
-#define DRM_IOCTL_SAVAGE_CMDBUF		DRM_IOW( DRM_COMMAND_BASE + DRM_SAVAGE_BCI_CMDBUF, drm_savage_cmdbuf_t)
-#define DRM_IOCTL_SAVAGE_EVENT_EMIT	DRM_IOWR(DRM_COMMAND_BASE + DRM_SAVAGE_BCI_EVENT_EMIT, drm_savage_event_emit_t)
-#define DRM_IOCTL_SAVAGE_EVENT_WAIT	DRM_IOW( DRM_COMMAND_BASE + DRM_SAVAGE_BCI_EVENT_WAIT, drm_savage_event_wait_t)
-
-#define SAVAGE_DMA_PCI	1
-#define SAVAGE_DMA_AGP	3
-typedef struct drm_savage_init {
-	enum {
-		SAVAGE_INIT_BCI = 1,
-		SAVAGE_CLEANUP_BCI = 2
-	} func;
-	unsigned int sarea_priv_offset;
-
-	/* some parameters */
-	unsigned int cob_size;
-	unsigned int bci_threshold_lo, bci_threshold_hi;
-	unsigned int dma_type;
-
-	/* frame buffer layout */
-	unsigned int fb_bpp;
-	unsigned int front_offset, front_pitch;
-	unsigned int back_offset, back_pitch;
-	unsigned int depth_bpp;
-	unsigned int depth_offset, depth_pitch;
-
-	/* local textures */
-	unsigned int texture_offset;
-	unsigned int texture_size;
-
-	/* physical locations of non-permanent maps */
-	unsigned long status_offset;
-	unsigned long buffers_offset;
-	unsigned long agp_textures_offset;
-	unsigned long cmd_dma_offset;
-} drm_savage_init_t;
-
-typedef union drm_savage_cmd_header drm_savage_cmd_header_t;
-typedef struct drm_savage_cmdbuf {
-				/* command buffer in client's address space */
-	drm_savage_cmd_header_t __user *cmd_addr;
-	unsigned int size;	/* size of the command buffer in 64bit units */
-
-	unsigned int dma_idx;	/* DMA buffer index to use */
-	int discard;		/* discard DMA buffer when done */
-				/* vertex buffer in client's address space */
-	unsigned int __user *vb_addr;
-	unsigned int vb_size;	/* size of client vertex buffer in bytes */
-	unsigned int vb_stride;	/* stride of vertices in 32bit words */
-				/* boxes in client's address space */
-	drm_clip_rect_t __user *box_addr;
-	unsigned int nbox;	/* number of clipping boxes */
-} drm_savage_cmdbuf_t;
-
-#define SAVAGE_WAIT_2D  0x1 /* wait for 2D idle before updating event tag */
-#define SAVAGE_WAIT_3D  0x2 /* wait for 3D idle before updating event tag */
-#define SAVAGE_WAIT_IRQ 0x4 /* emit or wait for IRQ, not implemented yet */
-typedef struct drm_savage_event {
-	unsigned int count;
-	unsigned int flags;
-} drm_savage_event_emit_t, drm_savage_event_wait_t;
-
-/* Commands for the cmdbuf ioctl
- */
-#define SAVAGE_CMD_STATE	0  /* a range of state registers */
-#define SAVAGE_CMD_DMA_PRIM	1  /* vertices from DMA buffer */
-#define SAVAGE_CMD_VB_PRIM	2  /* vertices from client vertex buffer */
-#define SAVAGE_CMD_DMA_IDX	3  /* indexed vertices from DMA buffer */
-#define SAVAGE_CMD_VB_IDX	4  /* indexed vertices client vertex buffer */
-#define SAVAGE_CMD_CLEAR	5  /* clear buffers */
-#define SAVAGE_CMD_SWAP		6  /* swap buffers */
-
-/* Primitive types
-*/
-#define SAVAGE_PRIM_TRILIST	0  /* triangle list */
-#define SAVAGE_PRIM_TRISTRIP	1  /* triangle strip */
-#define SAVAGE_PRIM_TRIFAN	2  /* triangle fan */
-#define SAVAGE_PRIM_TRILIST_201	3  /* reorder verts for correct flat
-				    * shading on s3d */
-
-/* Skip flags (vertex format)
- */
-#define SAVAGE_SKIP_Z		0x01
-#define SAVAGE_SKIP_W		0x02
-#define SAVAGE_SKIP_C0		0x04
-#define SAVAGE_SKIP_C1		0x08
-#define SAVAGE_SKIP_S0		0x10
-#define SAVAGE_SKIP_T0		0x20
-#define SAVAGE_SKIP_ST0		0x30
-#define SAVAGE_SKIP_S1		0x40
-#define SAVAGE_SKIP_T1		0x80
-#define SAVAGE_SKIP_ST1		0xc0
-#define SAVAGE_SKIP_ALL_S3D	0x3f
-#define SAVAGE_SKIP_ALL_S4	0xff
-
-/* Buffer names for clear command
- */
-#define SAVAGE_FRONT		0x1
-#define SAVAGE_BACK		0x2
-#define SAVAGE_DEPTH		0x4
-
-/* 64-bit command header
- */
-union drm_savage_cmd_header {
-	struct {
-		unsigned char cmd;	/* command */
-		unsigned char pad0;
-		unsigned short pad1;
-		unsigned short pad2;
-		unsigned short pad3;
-	} cmd; /* generic */
-	struct {
-		unsigned char cmd;
-		unsigned char global;	/* need idle engine? */
-		unsigned short count;	/* number of consecutive registers */
-		unsigned short start;	/* first register */
-		unsigned short pad3;
-	} state; /* SAVAGE_CMD_STATE */
-	struct {
-		unsigned char cmd;
-		unsigned char prim;	/* primitive type */
-		unsigned short skip;	/* vertex format (skip flags) */
-		unsigned short count;	/* number of vertices */
-		unsigned short start;	/* first vertex in DMA/vertex buffer */
-	} prim; /* SAVAGE_CMD_DMA_PRIM, SAVAGE_CMD_VB_PRIM */
-	struct {
-		unsigned char cmd;
-		unsigned char prim;
-		unsigned short skip;
-		unsigned short count;	/* number of indices that follow */
-		unsigned short pad3;
-	} idx; /* SAVAGE_CMD_DMA_IDX, SAVAGE_CMD_VB_IDX */
-	struct {
-		unsigned char cmd;
-		unsigned char pad0;
-		unsigned short pad1;
-		unsigned int flags;
-	} clear0; /* SAVAGE_CMD_CLEAR */
-	struct {
-		unsigned int mask;
-		unsigned int value;
-	} clear1; /* SAVAGE_CMD_CLEAR data */
-};
-
-#endif
diff --git a/trunk/drivers/char/drm/savage_drv.c b/trunk/drivers/char/drm/savage_drv.c
deleted file mode 100644
index ac8d270427ca..000000000000
--- a/trunk/drivers/char/drm/savage_drv.c
+++ /dev/null
@@ -1,112 +0,0 @@
-/* savage_drv.c -- Savage driver for Linux
- *
- * Copyright 2004  Felix Kuehling
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sub license,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the
- * next paragraph) shall be included in all copies or substantial portions
- * of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
- * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
- * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-
-#include <linux/config.h>
-#include "drmP.h"
-#include "savage_drm.h"
-#include "savage_drv.h"
-
-#include "drm_pciids.h"
-
-static int postinit( struct drm_device *dev, unsigned long flags )
-{
-	DRM_INFO( "Initialized %s %d.%d.%d %s on minor %d: %s\n",
-		DRIVER_NAME,
-		DRIVER_MAJOR,
-		DRIVER_MINOR,
-		DRIVER_PATCHLEVEL,
-		DRIVER_DATE,
-		dev->primary.minor,
-		pci_pretty_name(dev->pdev)
-		);
-	return 0;
-}
-
-static int version( drm_version_t *version )
-{
-	int len;
-
-	version->version_major = DRIVER_MAJOR;
-	version->version_minor = DRIVER_MINOR;
-	version->version_patchlevel = DRIVER_PATCHLEVEL;
-	DRM_COPY( version->name, DRIVER_NAME );
-	DRM_COPY( version->date, DRIVER_DATE );
-	DRM_COPY( version->desc, DRIVER_DESC );
-	return 0;
-}
-
-static struct pci_device_id pciidlist[] = {
-	savage_PCI_IDS
-};
-
-extern drm_ioctl_desc_t savage_ioctls[];
-extern int savage_max_ioctl;
-
-static struct drm_driver driver = {
-	.driver_features =
-	    DRIVER_USE_AGP | DRIVER_USE_MTRR |
-	    DRIVER_HAVE_DMA | DRIVER_PCI_DMA,
-	.dev_priv_size = sizeof(drm_savage_buf_priv_t),
-	.preinit = savage_preinit,
-	.postinit = postinit,
-	.postcleanup = savage_postcleanup,
-	.reclaim_buffers = savage_reclaim_buffers,
-	.get_map_ofs = drm_core_get_map_ofs,
-	.get_reg_ofs = drm_core_get_reg_ofs,
-	.version = version,
-	.ioctls = savage_ioctls,
-	.dma_ioctl = savage_bci_buffers,
-	.fops = {
-		.owner   = THIS_MODULE,
-		.open	 = drm_open,
-		.release = drm_release,
-		.ioctl	 = drm_ioctl,
-		.mmap	 = drm_mmap,
-		.poll = drm_poll,
-		.fasync  = drm_fasync,
-	},
-	.pci_driver = {
-		.name          = DRIVER_NAME,
-		.id_table      = pciidlist,
-	}
-};
-
-static int __init savage_init(void)
-{
-	driver.num_ioctls = savage_max_ioctl;
-	return drm_init(&driver);
-}
-
-static void __exit savage_exit(void)
-{
-	drm_exit(&driver);
-}
-
-module_init(savage_init);
-module_exit(savage_exit);
-
-MODULE_AUTHOR( DRIVER_AUTHOR );
-MODULE_DESCRIPTION( DRIVER_DESC );
-MODULE_LICENSE("GPL and additional rights");
diff --git a/trunk/drivers/char/drm/savage_drv.h b/trunk/drivers/char/drm/savage_drv.h
deleted file mode 100644
index a45434944658..000000000000
--- a/trunk/drivers/char/drm/savage_drv.h
+++ /dev/null
@@ -1,579 +0,0 @@
-/* savage_drv.h -- Private header for the savage driver
- *
- * Copyright 2004  Felix Kuehling
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sub license,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the
- * next paragraph) shall be included in all copies or substantial portions
- * of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
- * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
- * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-
-#ifndef __SAVAGE_DRV_H__
-#define __SAVAGE_DRV_H__
-
-#define DRIVER_AUTHOR	"Felix Kuehling"
-
-#define DRIVER_NAME	"savage"
-#define DRIVER_DESC	"Savage3D/MX/IX, Savage4, SuperSavage, Twister, ProSavage[DDR]"
-#define DRIVER_DATE	"20050313"
-
-#define DRIVER_MAJOR		2
-#define DRIVER_MINOR		4
-#define DRIVER_PATCHLEVEL	1
-/* Interface history:
- *
- * 1.x   The DRM driver from the VIA/S3 code drop, basically a dummy
- * 2.0   The first real DRM
- * 2.1   Scissors registers managed by the DRM, 3D operations clipped by
- *       cliprects of the cmdbuf ioctl
- * 2.2   Implemented SAVAGE_CMD_DMA_IDX and SAVAGE_CMD_VB_IDX
- * 2.3   Event counters used by BCI_EVENT_EMIT/WAIT ioctls are now 32 bits
- *       wide and thus very long lived (unlikely to ever wrap). The size
- *       in the struct was 32 bits before, but only 16 bits were used
- * 2.4   Implemented command DMA. Now drm_savage_init_t.cmd_dma_offset is
- *       actually used
- */
-
-typedef struct drm_savage_age {
-	uint16_t event;
-	unsigned int wrap;
-} drm_savage_age_t;
-
-typedef struct drm_savage_buf_priv {
-	struct drm_savage_buf_priv *next;
-	struct drm_savage_buf_priv *prev;
-	drm_savage_age_t age;
-	drm_buf_t *buf;
-} drm_savage_buf_priv_t;
-
-typedef struct drm_savage_dma_page {
-	drm_savage_age_t age;
-	unsigned int used, flushed;
-} drm_savage_dma_page_t;
-#define SAVAGE_DMA_PAGE_SIZE 1024 /* in dwords */
-/* Fake DMA buffer size in bytes. 4 pages. Allows a maximum command
- * size of 16kbytes or 4k entries. Minimum requirement would be
- * 10kbytes for 255 40-byte vertices in one drawing command. */
-#define SAVAGE_FAKE_DMA_SIZE (SAVAGE_DMA_PAGE_SIZE*4*4)
-
-/* interesting bits of hardware state that are saved in dev_priv */
-typedef union {
-	struct drm_savage_common_state {
-		uint32_t vbaddr;
-	} common;
-	struct {
-		unsigned char pad[sizeof(struct drm_savage_common_state)];
-		uint32_t texctrl, texaddr;
-		uint32_t scstart, new_scstart;
-		uint32_t scend, new_scend;
-	} s3d;
-	struct {
-		unsigned char pad[sizeof(struct drm_savage_common_state)];
-		uint32_t texdescr, texaddr0, texaddr1;
-		uint32_t drawctrl0, new_drawctrl0;
-		uint32_t drawctrl1, new_drawctrl1;
-	} s4;
-} drm_savage_state_t;
-
-/* these chip tags should match the ones in the 2D driver in savage_regs.h. */
-enum savage_family {
-	S3_UNKNOWN = 0,
-	S3_SAVAGE3D,
-	S3_SAVAGE_MX,
-	S3_SAVAGE4,
-	S3_PROSAVAGE,
-	S3_TWISTER,
-	S3_PROSAVAGEDDR,
-	S3_SUPERSAVAGE,
-	S3_SAVAGE2000,
-	S3_LAST
-};
-
-#define S3_SAVAGE3D_SERIES(chip)  ((chip>=S3_SAVAGE3D) && (chip<=S3_SAVAGE_MX))
-
-#define S3_SAVAGE4_SERIES(chip)  ((chip==S3_SAVAGE4)            \
-                                  || (chip==S3_PROSAVAGE)       \
-                                  || (chip==S3_TWISTER)         \
-                                  || (chip==S3_PROSAVAGEDDR))
-
-#define	S3_SAVAGE_MOBILE_SERIES(chip)	((chip==S3_SAVAGE_MX) || (chip==S3_SUPERSAVAGE))
-
-#define S3_SAVAGE_SERIES(chip)    ((chip>=S3_SAVAGE3D) && (chip<=S3_SAVAGE2000))
-
-#define S3_MOBILE_TWISTER_SERIES(chip)   ((chip==S3_TWISTER)    \
-                                          ||(chip==S3_PROSAVAGEDDR))
-
-/* flags */
-#define SAVAGE_IS_AGP 1
-
-typedef struct drm_savage_private {
-	drm_savage_sarea_t *sarea_priv;
-
-	drm_savage_buf_priv_t head, tail;
-
-	/* who am I? */
-	enum savage_family chipset;
-
-	unsigned int cob_size;
-	unsigned int bci_threshold_lo, bci_threshold_hi;
-	unsigned int dma_type;
-
-	/* frame buffer layout */
-	unsigned int fb_bpp;
-	unsigned int front_offset, front_pitch;
-	unsigned int back_offset, back_pitch;
-	unsigned int depth_bpp;
-	unsigned int depth_offset, depth_pitch;
-
-	/* bitmap descriptors for swap and clear */
-	unsigned int front_bd, back_bd, depth_bd;
-
-	/* local textures */
-	unsigned int texture_offset;
-	unsigned int texture_size;
-
-	/* memory regions in physical memory */
-	drm_local_map_t *sarea;
-	drm_local_map_t *mmio;
-	drm_local_map_t *fb;
-	drm_local_map_t *aperture;
-	drm_local_map_t *status;
-	drm_local_map_t *agp_textures;
-	drm_local_map_t *cmd_dma;
-	drm_local_map_t fake_dma;
-
-	struct {
-		int handle;
-		unsigned long base, size;
-	} mtrr[3];
-
-	/* BCI and status-related stuff */
-	volatile uint32_t *status_ptr, *bci_ptr;
-	uint32_t status_used_mask;
-	uint16_t event_counter;
-	unsigned int event_wrap;
-
-	/* Savage4 command DMA */
-	drm_savage_dma_page_t *dma_pages;
-	unsigned int nr_dma_pages, first_dma_page, current_dma_page;
-	drm_savage_age_t last_dma_age;
-
-	/* saved hw state for global/local check on S3D */
-	uint32_t hw_draw_ctrl, hw_zbuf_ctrl;
-	/* and for scissors (global, so don't emit if not changed) */
-	uint32_t hw_scissors_start, hw_scissors_end;
-
-	drm_savage_state_t state;
-
-	/* after emitting a wait cmd Savage3D needs 63 nops before next DMA */
-	unsigned int waiting;
-
-	/* config/hardware-dependent function pointers */
-	int (*wait_fifo)(struct drm_savage_private *dev_priv, unsigned int n);
-	int (*wait_evnt)(struct drm_savage_private *dev_priv, uint16_t e);
-	/* Err, there is a macro wait_event in include/linux/wait.h.
-	 * Avoid unwanted macro expansion. */
-	void (*emit_clip_rect)(struct drm_savage_private *dev_priv,
-			       drm_clip_rect_t *pbox);
-	void (*dma_flush)(struct drm_savage_private *dev_priv);
-} drm_savage_private_t;
-
-/* ioctls */
-extern int savage_bci_cmdbuf(DRM_IOCTL_ARGS);
-extern int savage_bci_buffers(DRM_IOCTL_ARGS);
-
-/* BCI functions */
-extern uint16_t savage_bci_emit_event(drm_savage_private_t *dev_priv,
-				      unsigned int flags);
-extern void savage_freelist_put(drm_device_t *dev, drm_buf_t *buf);
-extern void savage_dma_reset(drm_savage_private_t *dev_priv);
-extern void savage_dma_wait(drm_savage_private_t *dev_priv, unsigned int page);
-extern uint32_t *savage_dma_alloc(drm_savage_private_t *dev_priv,
-				  unsigned int n);
-extern int savage_preinit(drm_device_t *dev, unsigned long chipset);
-extern int savage_postcleanup(drm_device_t *dev);
-extern int savage_do_cleanup_bci(drm_device_t *dev);
-extern void savage_reclaim_buffers(drm_device_t *dev, DRMFILE filp);
-
-/* state functions */
-extern void savage_emit_clip_rect_s3d(drm_savage_private_t *dev_priv,
-				      drm_clip_rect_t *pbox);
-extern void savage_emit_clip_rect_s4(drm_savage_private_t *dev_priv,
-				     drm_clip_rect_t *pbox);
-
-#define SAVAGE_FB_SIZE_S3	0x01000000	/*  16MB */
-#define SAVAGE_FB_SIZE_S4	0x02000000	/*  32MB */
-#define SAVAGE_MMIO_SIZE        0x00080000	/* 512kB */
-#define SAVAGE_APERTURE_OFFSET  0x02000000	/*  32MB */
-#define SAVAGE_APERTURE_SIZE    0x05000000	/* 5 tiled surfaces, 16MB each */
-
-#define SAVAGE_BCI_OFFSET       0x00010000      /* offset of the BCI region
-						 * inside the MMIO region */
-#define SAVAGE_BCI_FIFO_SIZE	32		/* number of entries in on-chip
-						 * BCI FIFO */
-
-/*
- * MMIO registers
- */
-#define SAVAGE_STATUS_WORD0		0x48C00
-#define SAVAGE_STATUS_WORD1		0x48C04
-#define SAVAGE_ALT_STATUS_WORD0 	0x48C60
-
-#define SAVAGE_FIFO_USED_MASK_S3D	0x0001ffff
-#define SAVAGE_FIFO_USED_MASK_S4	0x001fffff
-
-/* Copied from savage_bci.h in the 2D driver with some renaming. */
-
-/* Bitmap descriptors */
-#define SAVAGE_BD_STRIDE_SHIFT 0
-#define SAVAGE_BD_BPP_SHIFT   16
-#define SAVAGE_BD_TILE_SHIFT  24
-#define SAVAGE_BD_BW_DISABLE  (1<<28)
-/* common: */
-#define	SAVAGE_BD_TILE_LINEAR		0
-/* savage4, MX, IX, 3D */
-#define	SAVAGE_BD_TILE_16BPP		2
-#define	SAVAGE_BD_TILE_32BPP		3
-/* twister, prosavage, DDR, supersavage, 2000 */
-#define	SAVAGE_BD_TILE_DEST		1
-#define	SAVAGE_BD_TILE_TEXTURE		2
-/* GBD - BCI enable */
-/* savage4, MX, IX, 3D */
-#define SAVAGE_GBD_BCI_ENABLE                    8
-/* twister, prosavage, DDR, supersavage, 2000 */
-#define SAVAGE_GBD_BCI_ENABLE_TWISTER            0
-
-#define SAVAGE_GBD_BIG_ENDIAN                    4
-#define SAVAGE_GBD_LITTLE_ENDIAN                 0
-#define SAVAGE_GBD_64                            1
-
-/*  Global Bitmap Descriptor */
-#define SAVAGE_BCI_GLB_BD_LOW             0x8168
-#define SAVAGE_BCI_GLB_BD_HIGH            0x816C
-
-/*
- * BCI registers
- */
-/* Savage4/Twister/ProSavage 3D registers */
-#define SAVAGE_DRAWLOCALCTRL_S4		0x1e
-#define SAVAGE_TEXPALADDR_S4		0x1f
-#define SAVAGE_TEXCTRL0_S4		0x20
-#define SAVAGE_TEXCTRL1_S4		0x21
-#define SAVAGE_TEXADDR0_S4		0x22
-#define SAVAGE_TEXADDR1_S4		0x23
-#define SAVAGE_TEXBLEND0_S4		0x24
-#define SAVAGE_TEXBLEND1_S4		0x25
-#define SAVAGE_TEXXPRCLR_S4		0x26 /* never used */
-#define SAVAGE_TEXDESCR_S4		0x27
-#define SAVAGE_FOGTABLE_S4		0x28
-#define SAVAGE_FOGCTRL_S4		0x30
-#define SAVAGE_STENCILCTRL_S4		0x31
-#define SAVAGE_ZBUFCTRL_S4		0x32
-#define SAVAGE_ZBUFOFF_S4		0x33
-#define SAVAGE_DESTCTRL_S4		0x34
-#define SAVAGE_DRAWCTRL0_S4		0x35
-#define SAVAGE_DRAWCTRL1_S4		0x36
-#define SAVAGE_ZWATERMARK_S4		0x37
-#define SAVAGE_DESTTEXRWWATERMARK_S4	0x38
-#define SAVAGE_TEXBLENDCOLOR_S4		0x39
-/* Savage3D/MX/IX 3D registers */
-#define SAVAGE_TEXPALADDR_S3D		0x18
-#define SAVAGE_TEXXPRCLR_S3D		0x19 /* never used */
-#define SAVAGE_TEXADDR_S3D		0x1A
-#define SAVAGE_TEXDESCR_S3D		0x1B
-#define SAVAGE_TEXCTRL_S3D		0x1C
-#define SAVAGE_FOGTABLE_S3D		0x20
-#define SAVAGE_FOGCTRL_S3D		0x30
-#define SAVAGE_DRAWCTRL_S3D		0x31
-#define SAVAGE_ZBUFCTRL_S3D		0x32
-#define SAVAGE_ZBUFOFF_S3D		0x33
-#define SAVAGE_DESTCTRL_S3D		0x34
-#define SAVAGE_SCSTART_S3D		0x35
-#define SAVAGE_SCEND_S3D		0x36
-#define SAVAGE_ZWATERMARK_S3D		0x37 
-#define SAVAGE_DESTTEXRWWATERMARK_S3D	0x38
-/* common stuff */
-#define SAVAGE_VERTBUFADDR		0x3e
-#define SAVAGE_BITPLANEWTMASK		0xd7
-#define SAVAGE_DMABUFADDR		0x51
-
-/* texture enable bits (needed for tex addr checking) */
-#define SAVAGE_TEXCTRL_TEXEN_MASK	0x00010000 /* S3D */
-#define SAVAGE_TEXDESCR_TEX0EN_MASK	0x02000000 /* S4 */
-#define SAVAGE_TEXDESCR_TEX1EN_MASK	0x04000000 /* S4 */
-
-/* Global fields in Savage4/Twister/ProSavage 3D registers:
- *
- * All texture registers and DrawLocalCtrl are local. All other
- * registers are global. */
-
-/* Global fields in Savage3D/MX/IX 3D registers:
- *
- * All texture registers are local. DrawCtrl and ZBufCtrl are
- * partially local. All other registers are global.
- *
- * DrawCtrl global fields: cullMode, alphaTestCmpFunc, alphaTestEn, alphaRefVal
- * ZBufCtrl global fields: zCmpFunc, zBufEn
- */
-#define SAVAGE_DRAWCTRL_S3D_GLOBAL	0x03f3c00c
-#define SAVAGE_ZBUFCTRL_S3D_GLOBAL	0x00000027
-
-/* Masks for scissor bits (drawCtrl[01] on s4, scissorStart/End on s3d)
- */
-#define SAVAGE_SCISSOR_MASK_S4		0x00fff7ff
-#define SAVAGE_SCISSOR_MASK_S3D		0x07ff07ff
-
-/*
- * BCI commands
- */
-#define BCI_CMD_NOP                  0x40000000
-#define BCI_CMD_RECT                 0x48000000
-#define BCI_CMD_RECT_XP              0x01000000
-#define BCI_CMD_RECT_YP              0x02000000
-#define BCI_CMD_SCANLINE             0x50000000
-#define BCI_CMD_LINE                 0x5C000000
-#define BCI_CMD_LINE_LAST_PIXEL      0x58000000
-#define BCI_CMD_BYTE_TEXT            0x63000000
-#define BCI_CMD_NT_BYTE_TEXT         0x67000000
-#define BCI_CMD_BIT_TEXT             0x6C000000
-#define BCI_CMD_GET_ROP(cmd)         (((cmd) >> 16) & 0xFF)
-#define BCI_CMD_SET_ROP(cmd, rop)    ((cmd) |= ((rop & 0xFF) << 16))
-#define BCI_CMD_SEND_COLOR           0x00008000
-
-#define BCI_CMD_CLIP_NONE            0x00000000
-#define BCI_CMD_CLIP_CURRENT         0x00002000
-#define BCI_CMD_CLIP_LR              0x00004000
-#define BCI_CMD_CLIP_NEW             0x00006000
-
-#define BCI_CMD_DEST_GBD             0x00000000
-#define BCI_CMD_DEST_PBD             0x00000800
-#define BCI_CMD_DEST_PBD_NEW         0x00000C00
-#define BCI_CMD_DEST_SBD             0x00001000
-#define BCI_CMD_DEST_SBD_NEW         0x00001400
-
-#define BCI_CMD_SRC_TRANSPARENT      0x00000200
-#define BCI_CMD_SRC_SOLID            0x00000000
-#define BCI_CMD_SRC_GBD              0x00000020
-#define BCI_CMD_SRC_COLOR            0x00000040
-#define BCI_CMD_SRC_MONO             0x00000060
-#define BCI_CMD_SRC_PBD_COLOR        0x00000080
-#define BCI_CMD_SRC_PBD_MONO         0x000000A0
-#define BCI_CMD_SRC_PBD_COLOR_NEW    0x000000C0
-#define BCI_CMD_SRC_PBD_MONO_NEW     0x000000E0
-#define BCI_CMD_SRC_SBD_COLOR        0x00000100
-#define BCI_CMD_SRC_SBD_MONO         0x00000120
-#define BCI_CMD_SRC_SBD_COLOR_NEW    0x00000140
-#define BCI_CMD_SRC_SBD_MONO_NEW     0x00000160
-
-#define BCI_CMD_PAT_TRANSPARENT      0x00000010
-#define BCI_CMD_PAT_NONE             0x00000000
-#define BCI_CMD_PAT_COLOR            0x00000002
-#define BCI_CMD_PAT_MONO             0x00000003
-#define BCI_CMD_PAT_PBD_COLOR        0x00000004
-#define BCI_CMD_PAT_PBD_MONO         0x00000005
-#define BCI_CMD_PAT_PBD_COLOR_NEW    0x00000006
-#define BCI_CMD_PAT_PBD_MONO_NEW     0x00000007
-#define BCI_CMD_PAT_SBD_COLOR        0x00000008
-#define BCI_CMD_PAT_SBD_MONO         0x00000009
-#define BCI_CMD_PAT_SBD_COLOR_NEW    0x0000000A
-#define BCI_CMD_PAT_SBD_MONO_NEW     0x0000000B
-
-#define BCI_BD_BW_DISABLE            0x10000000
-#define BCI_BD_TILE_MASK             0x03000000
-#define BCI_BD_TILE_NONE             0x00000000
-#define BCI_BD_TILE_16               0x02000000
-#define BCI_BD_TILE_32               0x03000000
-#define BCI_BD_GET_BPP(bd)           (((bd) >> 16) & 0xFF)
-#define BCI_BD_SET_BPP(bd, bpp)      ((bd) |= (((bpp) & 0xFF) << 16))
-#define BCI_BD_GET_STRIDE(bd)        ((bd) & 0xFFFF)
-#define BCI_BD_SET_STRIDE(bd, st)    ((bd) |= ((st) & 0xFFFF))
-
-#define BCI_CMD_SET_REGISTER            0x96000000
-
-#define BCI_CMD_WAIT                    0xC0000000
-#define BCI_CMD_WAIT_3D                 0x00010000
-#define BCI_CMD_WAIT_2D                 0x00020000
-
-#define BCI_CMD_UPDATE_EVENT_TAG        0x98000000
-
-#define BCI_CMD_DRAW_PRIM               0x80000000
-#define BCI_CMD_DRAW_INDEXED_PRIM       0x88000000
-#define BCI_CMD_DRAW_CONT               0x01000000
-#define BCI_CMD_DRAW_TRILIST            0x00000000
-#define BCI_CMD_DRAW_TRISTRIP           0x02000000
-#define BCI_CMD_DRAW_TRIFAN             0x04000000
-#define BCI_CMD_DRAW_SKIPFLAGS          0x000000ff
-#define BCI_CMD_DRAW_NO_Z		0x00000001
-#define BCI_CMD_DRAW_NO_W		0x00000002
-#define BCI_CMD_DRAW_NO_CD		0x00000004
-#define BCI_CMD_DRAW_NO_CS		0x00000008
-#define BCI_CMD_DRAW_NO_U0		0x00000010
-#define BCI_CMD_DRAW_NO_V0		0x00000020
-#define BCI_CMD_DRAW_NO_UV0		0x00000030
-#define BCI_CMD_DRAW_NO_U1		0x00000040
-#define BCI_CMD_DRAW_NO_V1		0x00000080
-#define BCI_CMD_DRAW_NO_UV1		0x000000c0
-
-#define BCI_CMD_DMA			0xa8000000
-
-#define BCI_W_H(w, h)                ((((h) << 16) | (w)) & 0x0FFF0FFF)
-#define BCI_X_Y(x, y)                ((((y) << 16) | (x)) & 0x0FFF0FFF)
-#define BCI_X_W(x, y)                ((((w) << 16) | (x)) & 0x0FFF0FFF)
-#define BCI_CLIP_LR(l, r)            ((((r) << 16) | (l)) & 0x0FFF0FFF)
-#define BCI_CLIP_TL(t, l)            ((((t) << 16) | (l)) & 0x0FFF0FFF)
-#define BCI_CLIP_BR(b, r)            ((((b) << 16) | (r)) & 0x0FFF0FFF)
-
-#define BCI_LINE_X_Y(x, y)           (((y) << 16) | ((x) & 0xFFFF))
-#define BCI_LINE_STEPS(diag, axi)    (((axi) << 16) | ((diag) & 0xFFFF))
-#define BCI_LINE_MISC(maj, ym, xp, yp, err) \
-	(((maj) & 0x1FFF) | \
-	((ym) ? 1<<13 : 0) | \
-	((xp) ? 1<<14 : 0) | \
-	((yp) ? 1<<15 : 0) | \
-	((err) << 16))
-
-/*
- * common commands
- */
-#define BCI_SET_REGISTERS( first, n )			\
-	BCI_WRITE(BCI_CMD_SET_REGISTER |		\
-		  ((uint32_t)(n) & 0xff) << 16 |	\
-		  ((uint32_t)(first) & 0xffff))
-#define DMA_SET_REGISTERS( first, n )			\
-	DMA_WRITE(BCI_CMD_SET_REGISTER |		\
-		  ((uint32_t)(n) & 0xff) << 16 |	\
-		  ((uint32_t)(first) & 0xffff))
-
-#define BCI_DRAW_PRIMITIVE(n, type, skip)         \
-        BCI_WRITE(BCI_CMD_DRAW_PRIM | (type) | (skip) | \
-		  ((n) << 16))
-#define DMA_DRAW_PRIMITIVE(n, type, skip)         \
-        DMA_WRITE(BCI_CMD_DRAW_PRIM | (type) | (skip) | \
-		  ((n) << 16))
-
-#define BCI_DRAW_INDICES_S3D(n, type, i0)         \
-        BCI_WRITE(BCI_CMD_DRAW_INDEXED_PRIM | (type) |  \
-		  ((n) << 16) | (i0))
-
-#define BCI_DRAW_INDICES_S4(n, type, skip)        \
-        BCI_WRITE(BCI_CMD_DRAW_INDEXED_PRIM | (type) |  \
-                  (skip) | ((n) << 16))
-
-#define BCI_DMA(n)	\
-	BCI_WRITE(BCI_CMD_DMA | (((n) >> 1) - 1))
-
-/*
- * access to MMIO
- */
-#define SAVAGE_READ(reg)	DRM_READ32(  dev_priv->mmio, (reg) )
-#define SAVAGE_WRITE(reg)	DRM_WRITE32( dev_priv->mmio, (reg) )
-
-/*
- * access to the burst command interface (BCI)
- */
-#define SAVAGE_BCI_DEBUG 1
-
-#define BCI_LOCALS    volatile uint32_t *bci_ptr;
-
-#define BEGIN_BCI( n ) do {			\
-	dev_priv->wait_fifo(dev_priv, (n));	\
-	bci_ptr = dev_priv->bci_ptr;		\
-} while(0)
-
-#define BCI_WRITE( val ) *bci_ptr++ = (uint32_t)(val)
-
-#define BCI_COPY_FROM_USER(src,n) do {				\
-    unsigned int i;						\
-    for (i = 0; i < n; ++i) {					\
-	uint32_t val;						\
-	DRM_GET_USER_UNCHECKED(val, &((uint32_t*)(src))[i]);	\
-	BCI_WRITE(val);						\
-    }								\
-} while(0)
-
-/*
- * command DMA support
- */
-#define SAVAGE_DMA_DEBUG 1
-
-#define DMA_LOCALS   uint32_t *dma_ptr;
-
-#define BEGIN_DMA( n ) do {						\
-	unsigned int cur = dev_priv->current_dma_page;			\
-	unsigned int rest = SAVAGE_DMA_PAGE_SIZE -			\
-		dev_priv->dma_pages[cur].used;				\
-	if ((n) > rest) {						\
-		dma_ptr = savage_dma_alloc(dev_priv, (n));		\
-	} else { /* fast path for small allocations */			\
-		dma_ptr = (uint32_t *)dev_priv->cmd_dma->handle +	\
-			cur * SAVAGE_DMA_PAGE_SIZE +			\
-			dev_priv->dma_pages[cur].used;			\
-		if (dev_priv->dma_pages[cur].used == 0)			\
-			savage_dma_wait(dev_priv, cur);			\
-		dev_priv->dma_pages[cur].used += (n);			\
-	}								\
-} while(0)
-
-#define DMA_WRITE( val ) *dma_ptr++ = (uint32_t)(val)
-
-#define DMA_COPY_FROM_USER(src,n) do {				\
-	DRM_COPY_FROM_USER_UNCHECKED(dma_ptr, (src), (n)*4);	\
-	dma_ptr += n;						\
-} while(0)
-
-#if SAVAGE_DMA_DEBUG
-#define DMA_COMMIT() do {						\
-	unsigned int cur = dev_priv->current_dma_page;			\
-	uint32_t *expected = (uint32_t *)dev_priv->cmd_dma->handle +	\
-			cur * SAVAGE_DMA_PAGE_SIZE +			\
-			dev_priv->dma_pages[cur].used;			\
-	if (dma_ptr != expected) {					\
-		DRM_ERROR("DMA allocation and use don't match: "	\
-			  "%p != %p\n", expected, dma_ptr);		\
-		savage_dma_reset(dev_priv);				\
-	}								\
-} while(0)
-#else
-#define DMA_COMMIT() do {/* nothing */} while(0)
-#endif
-
-#define DMA_FLUSH() dev_priv->dma_flush(dev_priv)
-
-/* Buffer aging via event tag
- */
-
-#define UPDATE_EVENT_COUNTER( ) do {			\
-	if (dev_priv->status_ptr) {			\
-		uint16_t count;				\
-		/* coordinate with Xserver */		\
-		count = dev_priv->status_ptr[1023];	\
-		if (count < dev_priv->event_counter)	\
-			dev_priv->event_wrap++;		\
-		dev_priv->event_counter = count;	\
-	}						\
-} while(0)
-
-#define SET_AGE( age, e, w ) do {	\
-	(age)->event = e;		\
-	(age)->wrap = w;		\
-} while(0)
-
-#define TEST_AGE( age, e, w )				\
-	( (age)->wrap < (w) || ( (age)->wrap == (w) && (age)->event <= (e) ) )
-
-#endif /* __SAVAGE_DRV_H__ */
diff --git a/trunk/drivers/char/drm/savage_state.c b/trunk/drivers/char/drm/savage_state.c
deleted file mode 100644
index 475695a00083..000000000000
--- a/trunk/drivers/char/drm/savage_state.c
+++ /dev/null
@@ -1,1146 +0,0 @@
-/* savage_state.c -- State and drawing support for Savage
- *
- * Copyright 2004  Felix Kuehling
- * All Rights Reserved.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sub license,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the
- * next paragraph) shall be included in all copies or substantial portions
- * of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NON-INFRINGEMENT. IN NO EVENT SHALL FELIX KUEHLING BE LIABLE FOR
- * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
- * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
- * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-#include "drmP.h"
-#include "savage_drm.h"
-#include "savage_drv.h"
-
-void savage_emit_clip_rect_s3d(drm_savage_private_t *dev_priv,
-			       drm_clip_rect_t *pbox)
-{
-	uint32_t scstart = dev_priv->state.s3d.new_scstart;
-	uint32_t scend   = dev_priv->state.s3d.new_scend;
-	scstart = (scstart & ~SAVAGE_SCISSOR_MASK_S3D) |
-		((uint32_t)pbox->x1 & 0x000007ff) | 
-		(((uint32_t)pbox->y1 << 16) & 0x07ff0000);
-	scend   = (scend   & ~SAVAGE_SCISSOR_MASK_S3D) |
-		(((uint32_t)pbox->x2-1) & 0x000007ff) |
-		((((uint32_t)pbox->y2-1) << 16) & 0x07ff0000);
-	if (scstart != dev_priv->state.s3d.scstart ||
-	    scend   != dev_priv->state.s3d.scend) {
-		DMA_LOCALS;
-		BEGIN_DMA(4);
-		DMA_WRITE(BCI_CMD_WAIT|BCI_CMD_WAIT_3D);
-		DMA_SET_REGISTERS(SAVAGE_SCSTART_S3D, 2);
-		DMA_WRITE(scstart);
-		DMA_WRITE(scend);
-		dev_priv->state.s3d.scstart = scstart;
-		dev_priv->state.s3d.scend   = scend;
-		dev_priv->waiting = 1;
-		DMA_COMMIT();
-	}
-}
-
-void savage_emit_clip_rect_s4(drm_savage_private_t *dev_priv,
-			      drm_clip_rect_t *pbox)
-{
-	uint32_t drawctrl0 = dev_priv->state.s4.new_drawctrl0;
-	uint32_t drawctrl1 = dev_priv->state.s4.new_drawctrl1;
-	drawctrl0 = (drawctrl0 & ~SAVAGE_SCISSOR_MASK_S4) |
-		((uint32_t)pbox->x1 & 0x000007ff) |
-		(((uint32_t)pbox->y1 << 12) & 0x00fff000);
-	drawctrl1 = (drawctrl1 & ~SAVAGE_SCISSOR_MASK_S4) |
-		(((uint32_t)pbox->x2-1) & 0x000007ff) |
-		((((uint32_t)pbox->y2-1) << 12) & 0x00fff000);
-	if (drawctrl0 != dev_priv->state.s4.drawctrl0 ||
-	    drawctrl1 != dev_priv->state.s4.drawctrl1) {
-		DMA_LOCALS;
-		BEGIN_DMA(4);
-		DMA_WRITE(BCI_CMD_WAIT|BCI_CMD_WAIT_3D);
-		DMA_SET_REGISTERS(SAVAGE_DRAWCTRL0_S4, 2);
-		DMA_WRITE(drawctrl0);
-		DMA_WRITE(drawctrl1);
-		dev_priv->state.s4.drawctrl0 = drawctrl0;
-		dev_priv->state.s4.drawctrl1 = drawctrl1;
-		dev_priv->waiting = 1;
-		DMA_COMMIT();
-	}
-}
-
-static int savage_verify_texaddr(drm_savage_private_t *dev_priv, int unit,
-				 uint32_t addr)
-{
-	if ((addr & 6) != 2) { /* reserved bits */
-		DRM_ERROR("bad texAddr%d %08x (reserved bits)\n", unit, addr);
-		return DRM_ERR(EINVAL);
-	}
-	if (!(addr & 1)) { /* local */
-		addr &= ~7;
-		if (addr <  dev_priv->texture_offset ||
-		    addr >= dev_priv->texture_offset+dev_priv->texture_size) {
-			DRM_ERROR("bad texAddr%d %08x (local addr out of range)\n",
-				  unit, addr);
-			return DRM_ERR(EINVAL);
-		}
-	} else { /* AGP */
-		if (!dev_priv->agp_textures) {
-			DRM_ERROR("bad texAddr%d %08x (AGP not available)\n",
-				  unit, addr);
-			return DRM_ERR(EINVAL);
-		}
-		addr &= ~7;
-		if (addr < dev_priv->agp_textures->offset ||
-		    addr >= (dev_priv->agp_textures->offset +
-			     dev_priv->agp_textures->size)) {
-			DRM_ERROR("bad texAddr%d %08x (AGP addr out of range)\n",
-				  unit, addr);
-			return DRM_ERR(EINVAL);
-		}
-	}
-	return 0;
-}
-
-#define SAVE_STATE(reg,where)			\
-	if(start <= reg && start+count > reg)	\
-		DRM_GET_USER_UNCHECKED(dev_priv->state.where, &regs[reg-start])
-#define SAVE_STATE_MASK(reg,where,mask) do {			\
-	if(start <= reg && start+count > reg) {			\
-		uint32_t tmp;					\
-		DRM_GET_USER_UNCHECKED(tmp, &regs[reg-start]);	\
-		dev_priv->state.where = (tmp & (mask)) |	\
-			(dev_priv->state.where & ~(mask));	\
-	}							\
-} while (0)
-static int savage_verify_state_s3d(drm_savage_private_t *dev_priv,
-				   unsigned int start, unsigned int count,
-				   const uint32_t __user *regs)
-{
-	if (start < SAVAGE_TEXPALADDR_S3D ||
-	    start+count-1 > SAVAGE_DESTTEXRWWATERMARK_S3D) {
-		DRM_ERROR("invalid register range (0x%04x-0x%04x)\n",
-			  start, start+count-1);
-		return DRM_ERR(EINVAL);
-	}
-
-	SAVE_STATE_MASK(SAVAGE_SCSTART_S3D, s3d.new_scstart,
-			~SAVAGE_SCISSOR_MASK_S3D);
-	SAVE_STATE_MASK(SAVAGE_SCEND_S3D, s3d.new_scend,
-			~SAVAGE_SCISSOR_MASK_S3D);
-
-	/* if any texture regs were changed ... */
-	if (start <= SAVAGE_TEXCTRL_S3D &&
-	    start+count > SAVAGE_TEXPALADDR_S3D) {
-		/* ... check texture state */
-		SAVE_STATE(SAVAGE_TEXCTRL_S3D, s3d.texctrl);
-		SAVE_STATE(SAVAGE_TEXADDR_S3D, s3d.texaddr);
-		if (dev_priv->state.s3d.texctrl & SAVAGE_TEXCTRL_TEXEN_MASK)
-			return savage_verify_texaddr(
-				dev_priv, 0, dev_priv->state.s3d.texaddr);
-	}
-
-	return 0;
-}
-
-static int savage_verify_state_s4(drm_savage_private_t *dev_priv,
-				  unsigned int start, unsigned int count,
-				  const uint32_t __user *regs)
-{
-	int ret = 0;
-
-	if (start < SAVAGE_DRAWLOCALCTRL_S4 ||
-	    start+count-1 > SAVAGE_TEXBLENDCOLOR_S4) {
-		DRM_ERROR("invalid register range (0x%04x-0x%04x)\n",
-			  start, start+count-1);
-		return DRM_ERR(EINVAL);
-	}
-
-	SAVE_STATE_MASK(SAVAGE_DRAWCTRL0_S4, s4.new_drawctrl0,
-			~SAVAGE_SCISSOR_MASK_S4);
-	SAVE_STATE_MASK(SAVAGE_DRAWCTRL1_S4, s4.new_drawctrl1,
-			~SAVAGE_SCISSOR_MASK_S4);
-
-	/* if any texture regs were changed ... */
-	if (start <= SAVAGE_TEXDESCR_S4 &&
-	    start+count > SAVAGE_TEXPALADDR_S4) {
-		/* ... check texture state */
-		SAVE_STATE(SAVAGE_TEXDESCR_S4, s4.texdescr);
-		SAVE_STATE(SAVAGE_TEXADDR0_S4, s4.texaddr0);
-		SAVE_STATE(SAVAGE_TEXADDR1_S4, s4.texaddr1);
-		if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX0EN_MASK)
-			ret |= savage_verify_texaddr(
-				dev_priv, 0, dev_priv->state.s4.texaddr0);
-		if (dev_priv->state.s4.texdescr & SAVAGE_TEXDESCR_TEX1EN_MASK)
-			ret |= savage_verify_texaddr(
-				dev_priv, 1, dev_priv->state.s4.texaddr1);
-	}
-
-	return ret;
-}
-#undef SAVE_STATE
-#undef SAVE_STATE_MASK
-
-static int savage_dispatch_state(drm_savage_private_t *dev_priv,
-				 const drm_savage_cmd_header_t *cmd_header,
-				 const uint32_t __user *regs)
-{
-	unsigned int count = cmd_header->state.count;
-	unsigned int start = cmd_header->state.start;
-	unsigned int count2 = 0;
-	unsigned int bci_size;
-	int ret;
-	DMA_LOCALS;
-
-	if (!count)
-		return 0;
-
-	if (DRM_VERIFYAREA_READ(regs, count*4))
-		return DRM_ERR(EFAULT);
-
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-		ret = savage_verify_state_s3d(dev_priv, start, count, regs);
-		if (ret != 0)
-			return ret;
-		/* scissor regs are emitted in savage_dispatch_draw */
-		if (start < SAVAGE_SCSTART_S3D) {
-			if (start+count > SAVAGE_SCEND_S3D+1)
-				count2 = count - (SAVAGE_SCEND_S3D+1 - start);
-			if (start+count > SAVAGE_SCSTART_S3D)
-				count = SAVAGE_SCSTART_S3D - start;
-		} else if (start <= SAVAGE_SCEND_S3D) {
-			if (start+count > SAVAGE_SCEND_S3D+1) {
-				count -= SAVAGE_SCEND_S3D+1 - start;
-				start = SAVAGE_SCEND_S3D+1;
-			} else
-				return 0;
-		}
-	} else {
-		ret = savage_verify_state_s4(dev_priv, start, count, regs);
-		if (ret != 0)
-			return ret;
-		/* scissor regs are emitted in savage_dispatch_draw */
-		if (start < SAVAGE_DRAWCTRL0_S4) {
-			if (start+count > SAVAGE_DRAWCTRL1_S4+1)
-				count2 = count - (SAVAGE_DRAWCTRL1_S4+1 - start);
-			if (start+count > SAVAGE_DRAWCTRL0_S4)
-				count = SAVAGE_DRAWCTRL0_S4 - start;
-		} else if (start <= SAVAGE_DRAWCTRL1_S4) {
-			if (start+count > SAVAGE_DRAWCTRL1_S4+1) {
-				count -= SAVAGE_DRAWCTRL1_S4+1 - start;
-				start = SAVAGE_DRAWCTRL1_S4+1;
-			} else
-				return 0;
-		}
-	}
-
-	bci_size = count + (count+254)/255 + count2 + (count2+254)/255;
-
-	if (cmd_header->state.global) {
-		BEGIN_DMA(bci_size+1);
-		DMA_WRITE(BCI_CMD_WAIT | BCI_CMD_WAIT_3D);
-		dev_priv->waiting = 1;
-	} else {
-		BEGIN_DMA(bci_size);
-	}
-
-	do {
-		while (count > 0) {
-			unsigned int n = count < 255 ? count : 255;
-			DMA_SET_REGISTERS(start, n);
-			DMA_COPY_FROM_USER(regs, n);
-			count -= n;
-			start += n;
-			regs += n;
-		}
-		start += 2;
-		regs += 2;
-		count = count2;
-		count2 = 0;
-	} while (count);
-
-	DMA_COMMIT();
-
-	return 0;
-}
-
-static int savage_dispatch_dma_prim(drm_savage_private_t *dev_priv,
-				    const drm_savage_cmd_header_t *cmd_header,
-				    const drm_buf_t *dmabuf)
-{
-	unsigned char reorder = 0;
-	unsigned int prim = cmd_header->prim.prim;
-	unsigned int skip = cmd_header->prim.skip;
-	unsigned int n = cmd_header->prim.count;
-	unsigned int start = cmd_header->prim.start;
-	unsigned int i;
-	BCI_LOCALS;
-
-	if (!dmabuf) {
-	    DRM_ERROR("called without dma buffers!\n");
-	    return DRM_ERR(EINVAL);
-	}
-
-	if (!n)
-		return 0;
-
-	switch (prim) {
-	case SAVAGE_PRIM_TRILIST_201:
-		reorder = 1;
-		prim = SAVAGE_PRIM_TRILIST;
-	case SAVAGE_PRIM_TRILIST:
-		if (n % 3 != 0) {
-			DRM_ERROR("wrong number of vertices %u in TRILIST\n",
-				  n);
-			return DRM_ERR(EINVAL);
-		}
-		break;
-	case SAVAGE_PRIM_TRISTRIP:
-	case SAVAGE_PRIM_TRIFAN:
-		if (n < 3) {
-			DRM_ERROR("wrong number of vertices %u in TRIFAN/STRIP\n",
-				  n);
-			return DRM_ERR(EINVAL);
-		}
-		break;
-	default:
-		DRM_ERROR("invalid primitive type %u\n", prim);
-		return DRM_ERR(EINVAL);
-	}
-
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-		if (skip != 0) {
-			DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
-				  skip);
-			return DRM_ERR(EINVAL);
-		}
-	} else {
-		unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) -
-			(skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) -
-			(skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
-		if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) {
-			DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
-				  skip);
-			return DRM_ERR(EINVAL);
-		}
-		if (reorder) {
-			DRM_ERROR("TRILIST_201 used on Savage4 hardware\n");
-			return DRM_ERR(EINVAL);
-		}
-	}
-
-	if (start + n > dmabuf->total/32) {
-		DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n",
-			  start, start + n - 1, dmabuf->total/32);
-		return DRM_ERR(EINVAL);
-	}
-
-	/* Vertex DMA doesn't work with command DMA at the same time,
-	 * so we use BCI_... to submit commands here. Flush buffered
-	 * faked DMA first. */
-	DMA_FLUSH();
-
-	if (dmabuf->bus_address != dev_priv->state.common.vbaddr) {
-		BEGIN_BCI(2);
-		BCI_SET_REGISTERS(SAVAGE_VERTBUFADDR, 1);
-		BCI_WRITE(dmabuf->bus_address | dev_priv->dma_type);
-		dev_priv->state.common.vbaddr = dmabuf->bus_address;
-	}
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset) && dev_priv->waiting) {
-		/* Workaround for what looks like a hardware bug. If a
-		 * WAIT_3D_IDLE was emitted some time before the
-		 * indexed drawing command then the engine will lock
-		 * up. There are two known workarounds:
-		 * WAIT_IDLE_EMPTY or emit at least 63 NOPs. */
-		BEGIN_BCI(63);
-		for (i = 0; i < 63; ++i)
-			BCI_WRITE(BCI_CMD_WAIT);
-		dev_priv->waiting = 0;
-	}
-
-	prim <<= 25;
-	while (n != 0) {
-		/* Can emit up to 255 indices (85 triangles) at once. */
-		unsigned int count = n > 255 ? 255 : n;
-		if (reorder) {
-			/* Need to reorder indices for correct flat
-			 * shading while preserving the clock sense
-			 * for correct culling. Only on Savage3D. */
-			int reorder[3] = {-1, -1, -1};
-			reorder[start%3] = 2;
-
-			BEGIN_BCI((count+1+1)/2);
-			BCI_DRAW_INDICES_S3D(count, prim, start+2);
-
-			for (i = start+1; i+1 < start+count; i += 2)
-				BCI_WRITE((i + reorder[i % 3]) |
-					  ((i+1 + reorder[(i+1) % 3]) << 16));
-			if (i < start+count)
-				BCI_WRITE(i + reorder[i%3]);
-		} else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-			BEGIN_BCI((count+1+1)/2);
-			BCI_DRAW_INDICES_S3D(count, prim, start);
-
-			for (i = start+1; i+1 < start+count; i += 2)
-				BCI_WRITE(i | ((i+1) << 16));
-			if (i < start+count)
-				BCI_WRITE(i);
-		} else {
-			BEGIN_BCI((count+2+1)/2);
-			BCI_DRAW_INDICES_S4(count, prim, skip);
-
-			for (i = start; i+1 < start+count; i += 2)
-				BCI_WRITE(i | ((i+1) << 16));
-			if (i < start+count)
-				BCI_WRITE(i);
-		}
-
-		start += count;
-		n -= count;
-
-		prim |= BCI_CMD_DRAW_CONT;
-	}
-
-	return 0;
-}
-
-static int savage_dispatch_vb_prim(drm_savage_private_t *dev_priv,
-				   const drm_savage_cmd_header_t *cmd_header,
-				   const uint32_t __user *vtxbuf,
-				   unsigned int vb_size,
-				   unsigned int vb_stride)
-{
-	unsigned char reorder = 0;
-	unsigned int prim = cmd_header->prim.prim;
-	unsigned int skip = cmd_header->prim.skip;
-	unsigned int n = cmd_header->prim.count;
-	unsigned int start = cmd_header->prim.start;
-	unsigned int vtx_size;
-	unsigned int i;
-	DMA_LOCALS;
-
-	if (!n)
-		return 0;
-
-	switch (prim) {
-	case SAVAGE_PRIM_TRILIST_201:
-		reorder = 1;
-		prim = SAVAGE_PRIM_TRILIST;
-	case SAVAGE_PRIM_TRILIST:
-		if (n % 3 != 0) {
-			DRM_ERROR("wrong number of vertices %u in TRILIST\n",
-				  n);
-			return DRM_ERR(EINVAL);
-		}
-		break;
-	case SAVAGE_PRIM_TRISTRIP:
-	case SAVAGE_PRIM_TRIFAN:
-		if (n < 3) {
-			DRM_ERROR("wrong number of vertices %u in TRIFAN/STRIP\n",
-				  n);
-			return DRM_ERR(EINVAL);
-		}
-		break;
-	default:
-		DRM_ERROR("invalid primitive type %u\n", prim);
-		return DRM_ERR(EINVAL);
-	}
-
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-		if (skip > SAVAGE_SKIP_ALL_S3D) {
-			DRM_ERROR("invalid skip flags 0x%04x\n", skip);
-			return DRM_ERR(EINVAL);
-		}
-		vtx_size = 8; /* full vertex */
-	} else {
-		if (skip > SAVAGE_SKIP_ALL_S4) {
-			DRM_ERROR("invalid skip flags 0x%04x\n", skip);
-			return DRM_ERR(EINVAL);
-		}
-		vtx_size = 10; /* full vertex */
-	}
-
-	vtx_size -= (skip & 1) + (skip >> 1 & 1) +
-		(skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) +
-		(skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1);
-
-	if (vtx_size > vb_stride) {
-		DRM_ERROR("vertex size greater than vb stride (%u > %u)\n",
-			  vtx_size, vb_stride);
-		return DRM_ERR(EINVAL);
-	}
-
-	if (start + n > vb_size / (vb_stride*4)) {
-		DRM_ERROR("vertex indices (%u-%u) out of range (0-%u)\n",
-			  start, start + n - 1, vb_size / (vb_stride*4));
-		return DRM_ERR(EINVAL);
-	}
-
-	prim <<= 25;
-	while (n != 0) {
-		/* Can emit up to 255 vertices (85 triangles) at once. */
-		unsigned int count = n > 255 ? 255 : n;
-		if (reorder) {
-			/* Need to reorder vertices for correct flat
-			 * shading while preserving the clock sense
-			 * for correct culling. Only on Savage3D. */
-			int reorder[3] = {-1, -1, -1};
-			reorder[start%3] = 2;
-
-			BEGIN_DMA(count*vtx_size+1);
-			DMA_DRAW_PRIMITIVE(count, prim, skip);
-
-			for (i = start; i < start+count; ++i) {
-				unsigned int j = i + reorder[i % 3];
-				DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j],
-						   vtx_size);
-			}
-
-			DMA_COMMIT();
-		} else {
-			BEGIN_DMA(count*vtx_size+1);
-			DMA_DRAW_PRIMITIVE(count, prim, skip);
-
-			if (vb_stride == vtx_size) {
-				DMA_COPY_FROM_USER(&vtxbuf[vb_stride*start],
-						   vtx_size*count);
-			} else {
-				for (i = start; i < start+count; ++i) {
-					DMA_COPY_FROM_USER(
-						&vtxbuf[vb_stride*i],
-						vtx_size);
-				}
-			}
-
-			DMA_COMMIT();
-		}
-
-		start += count;
-		n -= count;
-
-		prim |= BCI_CMD_DRAW_CONT;
-	}
-
-	return 0;
-}
-
-static int savage_dispatch_dma_idx(drm_savage_private_t *dev_priv,
-				   const drm_savage_cmd_header_t *cmd_header,
-				   const uint16_t __user *usr_idx,
-				   const drm_buf_t *dmabuf)
-{
-	unsigned char reorder = 0;
-	unsigned int prim = cmd_header->idx.prim;
-	unsigned int skip = cmd_header->idx.skip;
-	unsigned int n = cmd_header->idx.count;
-	unsigned int i;
-	BCI_LOCALS;
-
-	if (!dmabuf) {
-	    DRM_ERROR("called without dma buffers!\n");
-	    return DRM_ERR(EINVAL);
-	}
-
-	if (!n)
-		return 0;
-
-	switch (prim) {
-	case SAVAGE_PRIM_TRILIST_201:
-		reorder = 1;
-		prim = SAVAGE_PRIM_TRILIST;
-	case SAVAGE_PRIM_TRILIST:
-		if (n % 3 != 0) {
-			DRM_ERROR("wrong number of indices %u in TRILIST\n",
-				  n);
-			return DRM_ERR(EINVAL);
-		}
-		break;
-	case SAVAGE_PRIM_TRISTRIP:
-	case SAVAGE_PRIM_TRIFAN:
-		if (n < 3) {
-			DRM_ERROR("wrong number of indices %u in TRIFAN/STRIP\n",
-				  n);
-			return DRM_ERR(EINVAL);
-		}
-		break;
-	default:
-		DRM_ERROR("invalid primitive type %u\n", prim);
-		return DRM_ERR(EINVAL);
-	}
-
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-		if (skip != 0) {
-			DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
-				  skip);
-			return DRM_ERR(EINVAL);
-		}
-	} else {
-		unsigned int size = 10 - (skip & 1) - (skip >> 1 & 1) -
-			(skip >> 2 & 1) - (skip >> 3 & 1) - (skip >> 4 & 1) -
-			(skip >> 5 & 1) - (skip >> 6 & 1) - (skip >> 7 & 1);
-		if (skip > SAVAGE_SKIP_ALL_S4 || size != 8) {
-			DRM_ERROR("invalid skip flags 0x%04x for DMA\n",
-				  skip);
-			return DRM_ERR(EINVAL);
-		}
-		if (reorder) {
-			DRM_ERROR("TRILIST_201 used on Savage4 hardware\n");
-			return DRM_ERR(EINVAL);
-		}
-	}
-
-	/* Vertex DMA doesn't work with command DMA at the same time,
-	 * so we use BCI_... to submit commands here. Flush buffered
-	 * faked DMA first. */
-	DMA_FLUSH();
-
-	if (dmabuf->bus_address != dev_priv->state.common.vbaddr) {
-		BEGIN_BCI(2);
-		BCI_SET_REGISTERS(SAVAGE_VERTBUFADDR, 1);
-		BCI_WRITE(dmabuf->bus_address | dev_priv->dma_type);
-		dev_priv->state.common.vbaddr = dmabuf->bus_address;
-	}
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset) && dev_priv->waiting) {
-		/* Workaround for what looks like a hardware bug. If a
-		 * WAIT_3D_IDLE was emitted some time before the
-		 * indexed drawing command then the engine will lock
-		 * up. There are two known workarounds:
-		 * WAIT_IDLE_EMPTY or emit at least 63 NOPs. */
-		BEGIN_BCI(63);
-		for (i = 0; i < 63; ++i)
-			BCI_WRITE(BCI_CMD_WAIT);
-		dev_priv->waiting = 0;
-	}
-
-	prim <<= 25;
-	while (n != 0) {
-		/* Can emit up to 255 indices (85 triangles) at once. */
-		unsigned int count = n > 255 ? 255 : n;
-		/* Is it ok to allocate 510 bytes on the stack in an ioctl? */
-		uint16_t idx[255];
-
-		/* Copy and check indices */
-		DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count*2);
-		for (i = 0; i < count; ++i) {
-			if (idx[i] > dmabuf->total/32) {
-				DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
-					  i, idx[i], dmabuf->total/32);
-				return DRM_ERR(EINVAL);
-			}
-		}
-
-		if (reorder) {
-			/* Need to reorder indices for correct flat
-			 * shading while preserving the clock sense
-			 * for correct culling. Only on Savage3D. */
-			int reorder[3] = {2, -1, -1};
-
-			BEGIN_BCI((count+1+1)/2);
-			BCI_DRAW_INDICES_S3D(count, prim, idx[2]);
-
-			for (i = 1; i+1 < count; i += 2)
-				BCI_WRITE(idx[i + reorder[i % 3]] |
-					  (idx[i+1 + reorder[(i+1) % 3]] << 16));
-			if (i < count)
-				BCI_WRITE(idx[i + reorder[i%3]]);
-		} else if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-			BEGIN_BCI((count+1+1)/2);
-			BCI_DRAW_INDICES_S3D(count, prim, idx[0]);
-
-			for (i = 1; i+1 < count; i += 2)
-				BCI_WRITE(idx[i] | (idx[i+1] << 16));
-			if (i < count)
-				BCI_WRITE(idx[i]);
-		} else {
-			BEGIN_BCI((count+2+1)/2);
-			BCI_DRAW_INDICES_S4(count, prim, skip);
-
-			for (i = 0; i+1 < count; i += 2)
-				BCI_WRITE(idx[i] | (idx[i+1] << 16));
-			if (i < count)
-				BCI_WRITE(idx[i]);
-		}
-
-		usr_idx += count;
-		n -= count;
-
-		prim |= BCI_CMD_DRAW_CONT;
-	}
-
-	return 0;
-}
-
-static int savage_dispatch_vb_idx(drm_savage_private_t *dev_priv,
-				  const drm_savage_cmd_header_t *cmd_header,
-				  const uint16_t __user *usr_idx,
-				  const uint32_t __user *vtxbuf,
-				  unsigned int vb_size,
-				  unsigned int vb_stride)
-{
-	unsigned char reorder = 0;
-	unsigned int prim = cmd_header->idx.prim;
-	unsigned int skip = cmd_header->idx.skip;
-	unsigned int n = cmd_header->idx.count;
-	unsigned int vtx_size;
-	unsigned int i;
-	DMA_LOCALS;
-
-	if (!n)
-		return 0;
-
-	switch (prim) {
-	case SAVAGE_PRIM_TRILIST_201:
-		reorder = 1;
-		prim = SAVAGE_PRIM_TRILIST;
-	case SAVAGE_PRIM_TRILIST:
-		if (n % 3 != 0) {
-			DRM_ERROR("wrong number of indices %u in TRILIST\n",
-				  n);
-			return DRM_ERR(EINVAL);
-		}
-		break;
-	case SAVAGE_PRIM_TRISTRIP:
-	case SAVAGE_PRIM_TRIFAN:
-		if (n < 3) {
-			DRM_ERROR("wrong number of indices %u in TRIFAN/STRIP\n",
-				  n);
-			return DRM_ERR(EINVAL);
-		}
-		break;
-	default:
-		DRM_ERROR("invalid primitive type %u\n", prim);
-		return DRM_ERR(EINVAL);
-	}
-
-	if (S3_SAVAGE3D_SERIES(dev_priv->chipset)) {
-		if (skip > SAVAGE_SKIP_ALL_S3D) {
-			DRM_ERROR("invalid skip flags 0x%04x\n", skip);
-			return DRM_ERR(EINVAL);
-		}
-		vtx_size = 8; /* full vertex */
-	} else {
-		if (skip > SAVAGE_SKIP_ALL_S4) {
-			DRM_ERROR("invalid skip flags 0x%04x\n", skip);
-			return DRM_ERR(EINVAL);
-		}
-		vtx_size = 10; /* full vertex */
-	}
-
-	vtx_size -= (skip & 1) + (skip >> 1 & 1) +
-		(skip >> 2 & 1) + (skip >> 3 & 1) + (skip >> 4 & 1) +
-		(skip >> 5 & 1) + (skip >> 6 & 1) + (skip >> 7 & 1);
-
-	if (vtx_size > vb_stride) {
-		DRM_ERROR("vertex size greater than vb stride (%u > %u)\n",
-			  vtx_size, vb_stride);
-		return DRM_ERR(EINVAL);
-	}
-
-	prim <<= 25;
-	while (n != 0) {
-		/* Can emit up to 255 vertices (85 triangles) at once. */
-		unsigned int count = n > 255 ? 255 : n;
-		/* Is it ok to allocate 510 bytes on the stack in an ioctl? */
-		uint16_t idx[255];
-
-		/* Copy and check indices */
-		DRM_COPY_FROM_USER_UNCHECKED(idx, usr_idx, count*2);
-		for (i = 0; i < count; ++i) {
-			if (idx[i] > vb_size / (vb_stride*4)) {
-				DRM_ERROR("idx[%u]=%u out of range (0-%u)\n",
-					  i, idx[i],  vb_size / (vb_stride*4));
-				return DRM_ERR(EINVAL);
-			}
-		}
-
-		if (reorder) {
-			/* Need to reorder vertices for correct flat
-			 * shading while preserving the clock sense
-			 * for correct culling. Only on Savage3D. */
-			int reorder[3] = {2, -1, -1};
-
-			BEGIN_DMA(count*vtx_size+1);
-			DMA_DRAW_PRIMITIVE(count, prim, skip);
-
-			for (i = 0; i < count; ++i) {
-				unsigned int j = idx[i + reorder[i % 3]];
-				DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j],
-						   vtx_size);
-			}
-
-			DMA_COMMIT();
-		} else {
-			BEGIN_DMA(count*vtx_size+1);
-			DMA_DRAW_PRIMITIVE(count, prim, skip);
-
-			for (i = 0; i < count; ++i) {
-				unsigned int j = idx[i];
-				DMA_COPY_FROM_USER(&vtxbuf[vb_stride*j],
-						   vtx_size);
-			}
-
-			DMA_COMMIT();
-		}
-
-		usr_idx += count;
-		n -= count;
-
-		prim |= BCI_CMD_DRAW_CONT;
-	}
-
-	return 0;
-}
-
-static int savage_dispatch_clear(drm_savage_private_t *dev_priv,
-				 const drm_savage_cmd_header_t *cmd_header,
-				 const drm_savage_cmd_header_t __user *data,
-				 unsigned int nbox,
-				 const drm_clip_rect_t __user *usr_boxes)
-{
-	unsigned int flags = cmd_header->clear0.flags, mask, value;
-	unsigned int clear_cmd;
-	unsigned int i, nbufs;
-	DMA_LOCALS;
-
-	if (nbox == 0)
-		return 0;
-
-	DRM_GET_USER_UNCHECKED(mask, &((const drm_savage_cmd_header_t*)data)
-			       ->clear1.mask);
-	DRM_GET_USER_UNCHECKED(value, &((const drm_savage_cmd_header_t*)data)
-			       ->clear1.value);
-
-	clear_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP |
-		BCI_CMD_SEND_COLOR | BCI_CMD_DEST_PBD_NEW;
-	BCI_CMD_SET_ROP(clear_cmd,0xCC);
-
-	nbufs = ((flags & SAVAGE_FRONT) ? 1 : 0) +
-		((flags & SAVAGE_BACK) ? 1 : 0) +
-		((flags & SAVAGE_DEPTH) ? 1 : 0);
-	if (nbufs == 0)
-		return 0;
-
-	if (mask != 0xffffffff) {
-		/* set mask */
-		BEGIN_DMA(2);
-		DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
-		DMA_WRITE(mask);
-		DMA_COMMIT();
-	}
-	for (i = 0; i < nbox; ++i) {
-		drm_clip_rect_t box;
-		unsigned int x, y, w, h;
-		unsigned int buf;
-		DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
-		x = box.x1, y = box.y1;
-		w = box.x2 - box.x1;
-		h = box.y2 - box.y1;
-		BEGIN_DMA(nbufs*6);
-		for (buf = SAVAGE_FRONT; buf <= SAVAGE_DEPTH; buf <<= 1) {
-			if (!(flags & buf))
-				continue;
-			DMA_WRITE(clear_cmd);
-			switch(buf) {
-			case SAVAGE_FRONT:
-				DMA_WRITE(dev_priv->front_offset);
-				DMA_WRITE(dev_priv->front_bd);
-				break;
-			case SAVAGE_BACK:
-				DMA_WRITE(dev_priv->back_offset);
-				DMA_WRITE(dev_priv->back_bd);
-				break;
-			case SAVAGE_DEPTH:
-				DMA_WRITE(dev_priv->depth_offset);
-				DMA_WRITE(dev_priv->depth_bd);
-				break;
-			}
-			DMA_WRITE(value);
-			DMA_WRITE(BCI_X_Y(x, y));
-			DMA_WRITE(BCI_W_H(w, h));
-		}
-		DMA_COMMIT();
-	}
-	if (mask != 0xffffffff) {
-		/* reset mask */
-		BEGIN_DMA(2);
-		DMA_SET_REGISTERS(SAVAGE_BITPLANEWTMASK, 1);
-		DMA_WRITE(0xffffffff);
-		DMA_COMMIT();
-	}
-
-	return 0;
-}
-
-static int savage_dispatch_swap(drm_savage_private_t *dev_priv,
-				unsigned int nbox,
-				const drm_clip_rect_t __user *usr_boxes)
-{
-	unsigned int swap_cmd;
-	unsigned int i;
-	DMA_LOCALS;
-
-	if (nbox == 0)
-		return 0;
-
-	swap_cmd = BCI_CMD_RECT | BCI_CMD_RECT_XP | BCI_CMD_RECT_YP |
-		BCI_CMD_SRC_PBD_COLOR_NEW | BCI_CMD_DEST_GBD;
-	BCI_CMD_SET_ROP(swap_cmd,0xCC);
-
-	for (i = 0; i < nbox; ++i) {
-		drm_clip_rect_t box;
-		DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
-
-		BEGIN_DMA(6);
-		DMA_WRITE(swap_cmd);
-		DMA_WRITE(dev_priv->back_offset);
-		DMA_WRITE(dev_priv->back_bd);
-		DMA_WRITE(BCI_X_Y(box.x1, box.y1));
-		DMA_WRITE(BCI_X_Y(box.x1, box.y1));
-		DMA_WRITE(BCI_W_H(box.x2-box.x1, box.y2-box.y1));
-		DMA_COMMIT();
-	}
-
-	return 0;
-}
-
-static int savage_dispatch_draw(drm_savage_private_t *dev_priv,
-				const drm_savage_cmd_header_t __user *start,
-				const drm_savage_cmd_header_t __user *end,
-				const drm_buf_t *dmabuf,
-				const unsigned int __user *usr_vtxbuf,
-				unsigned int vb_size, unsigned int vb_stride,
-				unsigned int nbox,
-				const drm_clip_rect_t __user *usr_boxes)
-{
-	unsigned int i, j;
-	int ret;
-
-	for (i = 0; i < nbox; ++i) {
-		drm_clip_rect_t box;
-		const drm_savage_cmd_header_t __user *usr_cmdbuf;
-		DRM_COPY_FROM_USER_UNCHECKED(&box, &usr_boxes[i], sizeof(box));
-		dev_priv->emit_clip_rect(dev_priv, &box);
-
-		usr_cmdbuf = start;
-		while (usr_cmdbuf < end) {
-			drm_savage_cmd_header_t cmd_header;
-			DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf,
-						     sizeof(cmd_header));
-			usr_cmdbuf++;
-			switch (cmd_header.cmd.cmd) {
-			case SAVAGE_CMD_DMA_PRIM:
-				ret = savage_dispatch_dma_prim(
-					dev_priv, &cmd_header, dmabuf);
-				break;
-			case SAVAGE_CMD_VB_PRIM:
-				ret = savage_dispatch_vb_prim(
-					dev_priv, &cmd_header,
-					(const uint32_t __user *)usr_vtxbuf,
-					vb_size, vb_stride);
-				break;
-			case SAVAGE_CMD_DMA_IDX:
-				j = (cmd_header.idx.count + 3) / 4;
-				/* j was check in savage_bci_cmdbuf */
-				ret = savage_dispatch_dma_idx(
-					dev_priv, &cmd_header,
-					(const uint16_t __user *)usr_cmdbuf,
-					dmabuf);
-				usr_cmdbuf += j;
-				break;
-			case SAVAGE_CMD_VB_IDX:
-				j = (cmd_header.idx.count + 3) / 4;
-				/* j was check in savage_bci_cmdbuf */
-				ret = savage_dispatch_vb_idx(
-					dev_priv, &cmd_header,
-					(const uint16_t __user *)usr_cmdbuf,
-					(const uint32_t __user *)usr_vtxbuf,
-					vb_size, vb_stride);
-				usr_cmdbuf += j;
-				break;
-			default:
-				/* What's the best return code? EFAULT? */
-				DRM_ERROR("IMPLEMENTATION ERROR: "
-					  "non-drawing-command %d\n",
-					  cmd_header.cmd.cmd);
-				return DRM_ERR(EINVAL);
-			}
-
-			if (ret != 0)
-				return ret;
-		}
-	}
-
-	return 0;
-}
-
-int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
-{
-	DRM_DEVICE;
-	drm_savage_private_t *dev_priv = dev->dev_private;
-	drm_device_dma_t *dma = dev->dma;
-	drm_buf_t *dmabuf;
-	drm_savage_cmdbuf_t cmdbuf;
-	drm_savage_cmd_header_t __user *usr_cmdbuf;
-	drm_savage_cmd_header_t __user *first_draw_cmd;
-	unsigned int __user *usr_vtxbuf;
-	drm_clip_rect_t __user *usr_boxes;
-	unsigned int i, j;
-	int ret = 0;
-
-	DRM_DEBUG("\n");
-	
-	LOCK_TEST_WITH_RETURN(dev, filp);
-
-	DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_savage_cmdbuf_t __user *)data,
-				 sizeof(cmdbuf));
-
-	if (dma && dma->buflist) {
-		if (cmdbuf.dma_idx > dma->buf_count) {
-			DRM_ERROR("vertex buffer index %u out of range (0-%u)\n",
-				  cmdbuf.dma_idx, dma->buf_count-1);
-			return DRM_ERR(EINVAL);
-		}
-		dmabuf = dma->buflist[cmdbuf.dma_idx];
-	} else {
-		dmabuf = NULL;
-	}
-
-	usr_cmdbuf = (drm_savage_cmd_header_t __user *)cmdbuf.cmd_addr;
-	usr_vtxbuf = (unsigned int __user *)cmdbuf.vb_addr;
-	usr_boxes = (drm_clip_rect_t __user *)cmdbuf.box_addr;
-	if ((cmdbuf.size && DRM_VERIFYAREA_READ(usr_cmdbuf, cmdbuf.size*8)) ||
-	    (cmdbuf.vb_size && DRM_VERIFYAREA_READ(
-		    usr_vtxbuf, cmdbuf.vb_size)) ||
-	    (cmdbuf.nbox && DRM_VERIFYAREA_READ(
-		    usr_boxes, cmdbuf.nbox*sizeof(drm_clip_rect_t))))
-		return DRM_ERR(EFAULT);
-
-	/* Make sure writes to DMA buffers are finished before sending
-	 * DMA commands to the graphics hardware. */
-	DRM_MEMORYBARRIER();
-
-	/* Coming from user space. Don't know if the Xserver has
-	 * emitted wait commands. Assuming the worst. */
-	dev_priv->waiting = 1;
-
-	i = 0;
-	first_draw_cmd = NULL;
-	while (i < cmdbuf.size) {
-		drm_savage_cmd_header_t cmd_header;
-		DRM_COPY_FROM_USER_UNCHECKED(&cmd_header, usr_cmdbuf,
-					     sizeof(cmd_header));
-		usr_cmdbuf++;
-		i++;
-
-		/* Group drawing commands with same state to minimize
-		 * iterations over clip rects. */
-		j = 0;
-		switch (cmd_header.cmd.cmd) {
-		case SAVAGE_CMD_DMA_IDX:
-		case SAVAGE_CMD_VB_IDX:
-			j = (cmd_header.idx.count + 3) / 4;
-			if (i + j > cmdbuf.size) {
-				DRM_ERROR("indexed drawing command extends "
-					  "beyond end of command buffer\n");
-				DMA_FLUSH();
-				return DRM_ERR(EINVAL);
-			}
-			/* fall through */
-		case SAVAGE_CMD_DMA_PRIM:
-		case SAVAGE_CMD_VB_PRIM:
-			if (!first_draw_cmd)
-				first_draw_cmd = usr_cmdbuf-1;
-			usr_cmdbuf += j;
-			i += j;
-			break;
-		default:
-			if (first_draw_cmd) {
-				ret = savage_dispatch_draw (
-					dev_priv, first_draw_cmd, usr_cmdbuf-1,
-					dmabuf, usr_vtxbuf, cmdbuf.vb_size,
-					cmdbuf.vb_stride,
-					cmdbuf.nbox, usr_boxes);
-				if (ret != 0)
-					return ret;
-				first_draw_cmd = NULL;
-			}
-		}
-		if (first_draw_cmd)
-			continue;
-
-		switch (cmd_header.cmd.cmd) {
-		case SAVAGE_CMD_STATE:
-			j = (cmd_header.state.count + 1) / 2;
-			if (i + j > cmdbuf.size) {
-				DRM_ERROR("command SAVAGE_CMD_STATE extends "
-					  "beyond end of command buffer\n");
-				DMA_FLUSH();
-				return DRM_ERR(EINVAL);
-			}
-			ret = savage_dispatch_state(
-				dev_priv, &cmd_header,
-				(uint32_t __user *)usr_cmdbuf);
-			usr_cmdbuf += j;
-			i += j;
-			break;
-		case SAVAGE_CMD_CLEAR:
-			if (i + 1 > cmdbuf.size) {
-				DRM_ERROR("command SAVAGE_CMD_CLEAR extends "
-					  "beyond end of command buffer\n");
-				DMA_FLUSH();
-				return DRM_ERR(EINVAL);
-			}
-			ret = savage_dispatch_clear(dev_priv, &cmd_header,
-						    usr_cmdbuf,
-						    cmdbuf.nbox, usr_boxes);
-			usr_cmdbuf++;
-			i++;
-			break;
-		case SAVAGE_CMD_SWAP:
-			ret = savage_dispatch_swap(dev_priv,
-						   cmdbuf.nbox, usr_boxes);
-			break;
-		default:
-			DRM_ERROR("invalid command 0x%x\n", cmd_header.cmd.cmd);
-			DMA_FLUSH();
-			return DRM_ERR(EINVAL);
-		}
-
-		if (ret != 0) {
-			DMA_FLUSH();
-			return ret;
-		}
-	}
-
-	if (first_draw_cmd) {
-		ret = savage_dispatch_draw (
-			dev_priv, first_draw_cmd, usr_cmdbuf, dmabuf,
-			usr_vtxbuf, cmdbuf.vb_size, cmdbuf.vb_stride,
-			cmdbuf.nbox, usr_boxes);
-		if (ret != 0) {
-			DMA_FLUSH();
-			return ret;
-		}
-	}
-
-	DMA_FLUSH();
-
-	if (dmabuf && cmdbuf.discard) {
-		drm_savage_buf_priv_t *buf_priv = dmabuf->dev_private;
-		uint16_t event;
-		event = savage_bci_emit_event(dev_priv, SAVAGE_WAIT_3D);
-		SET_AGE(&buf_priv->age, event, dev_priv->event_wrap);
-		savage_freelist_put(dev, dmabuf);
-	}
-
-	return 0;
-}
diff --git a/trunk/drivers/char/hvc_vio.c b/trunk/drivers/char/hvc_vio.c
index 78d681dc35a8..60bb9152b832 100644
--- a/trunk/drivers/char/hvc_vio.c
+++ b/trunk/drivers/char/hvc_vio.c
@@ -39,7 +39,7 @@ char hvc_driver_name[] = "hvc_console";
 
 static struct vio_device_id hvc_driver_table[] __devinitdata = {
 	{"serial", "hvterm1"},
-	{ "", "" }
+	{ NULL, }
 };
 MODULE_DEVICE_TABLE(vio, hvc_driver_table);
 
diff --git a/trunk/drivers/char/hvcs.c b/trunk/drivers/char/hvcs.c
index f47f009f9259..3236d2404905 100644
--- a/trunk/drivers/char/hvcs.c
+++ b/trunk/drivers/char/hvcs.c
@@ -527,7 +527,7 @@ static int khvcsd(void *unused)
 
 static struct vio_device_id hvcs_driver_table[] __devinitdata= {
 	{"serial-server", "hvterm2"},
-	{ "", "" }
+	{ NULL, }
 };
 MODULE_DEVICE_TABLE(vio, hvcs_driver_table);
 
diff --git a/trunk/drivers/char/random.c b/trunk/drivers/char/random.c
index 7999da25fe40..6b11d6b2129f 100644
--- a/trunk/drivers/char/random.c
+++ b/trunk/drivers/char/random.c
@@ -1589,40 +1589,6 @@ u32 secure_tcpv6_port_ephemeral(const __u32 *saddr, const __u32 *daddr, __u16 dp
 EXPORT_SYMBOL(secure_tcpv6_port_ephemeral);
 #endif
 
-#if defined(CONFIG_IP_DCCP) || defined(CONFIG_IP_DCCP_MODULE)
-/* Similar to secure_tcp_sequence_number but generate a 48 bit value
- * bit's 32-47 increase every key exchange
- *       0-31  hash(source, dest)
- */
-u64 secure_dccp_sequence_number(__u32 saddr, __u32 daddr,
-				__u16 sport, __u16 dport)
-{
-	struct timeval tv;
-	u64 seq;
-	__u32 hash[4];
-	struct keydata *keyptr = get_keyptr();
-
-	hash[0] = saddr;
-	hash[1] = daddr;
-	hash[2] = (sport << 16) + dport;
-	hash[3] = keyptr->secret[11];
-
-	seq = half_md4_transform(hash, keyptr->secret);
-	seq |= ((u64)keyptr->count) << (32 - HASH_BITS);
-
-	do_gettimeofday(&tv);
-	seq += tv.tv_usec + tv.tv_sec * 1000000;
-	seq &= (1ull << 48) - 1;
-#if 0
-	printk("dccp init_seq(%lx, %lx, %d, %d) = %d\n",
-	       saddr, daddr, sport, dport, seq);
-#endif
-	return seq;
-}
-
-EXPORT_SYMBOL(secure_dccp_sequence_number);
-#endif
-
 #endif /* CONFIG_INET */
 
 
diff --git a/trunk/drivers/char/snsc_event.c b/trunk/drivers/char/snsc_event.c
index baaa365285fa..d692af57213a 100644
--- a/trunk/drivers/char/snsc_event.c
+++ b/trunk/drivers/char/snsc_event.c
@@ -19,7 +19,6 @@
 #include <linux/sched.h>
 #include <linux/byteorder/generic.h>
 #include <asm/sn/sn_sal.h>
-#include <asm/unaligned.h>
 #include "snsc.h"
 
 static struct subch_data_s *event_sd;
@@ -63,16 +62,13 @@ static int
 scdrv_parse_event(char *event, int *src, int *code, int *esp_code, char *desc)
 {
 	char *desc_end;
-	__be32 from_buf;
 
 	/* record event source address */
-	from_buf = get_unaligned((__be32 *)event);
-	*src = be32_to_cpup(&from_buf);
+	*src = be32_to_cpup((__be32 *)event);
 	event += 4; 			/* move on to event code */
 
 	/* record the system controller's event code */
-	from_buf = get_unaligned((__be32 *)event);
-	*code = be32_to_cpup(&from_buf);
+	*code = be32_to_cpup((__be32 *)event);
 	event += 4;			/* move on to event arguments */
 
 	/* how many arguments are in the packet? */
@@ -86,8 +82,7 @@ scdrv_parse_event(char *event, int *src, int *code, int *esp_code, char *desc)
 		/* not an integer argument, so give up */
 		return -1;
 	}
-	from_buf = get_unaligned((__be32 *)event);
-	*esp_code = be32_to_cpup(&from_buf);
+	*esp_code = be32_to_cpup((__be32 *)event);
 	event += 4;
 
 	/* parse out the event description */
diff --git a/trunk/drivers/char/viotape.c b/trunk/drivers/char/viotape.c
index 0aff45fac2e6..4764b4f9555d 100644
--- a/trunk/drivers/char/viotape.c
+++ b/trunk/drivers/char/viotape.c
@@ -991,7 +991,7 @@ static int viotape_remove(struct vio_dev *vdev)
  */
 static struct vio_device_id viotape_device_table[] __devinitdata = {
 	{ "viotape", "" },
-	{ "", "" }
+	{ 0, }
 };
 
 MODULE_DEVICE_TABLE(vio, viotape_device_table);
diff --git a/trunk/drivers/ieee1394/ieee1394_core.c b/trunk/drivers/ieee1394/ieee1394_core.c
index d633770fac8e..b248d89de8b4 100644
--- a/trunk/drivers/ieee1394/ieee1394_core.c
+++ b/trunk/drivers/ieee1394/ieee1394_core.c
@@ -681,7 +681,7 @@ static void handle_packet_response(struct hpsb_host *host, int tcode,
                 return;
         }
 
-	__skb_unlink(skb, &host->pending_packet_queue);
+	__skb_unlink(skb, skb->list);
 
 	if (packet->state == hpsb_queued) {
 		packet->sendtime = jiffies;
@@ -989,7 +989,7 @@ void abort_timedouts(unsigned long __opaque)
 		packet = (struct hpsb_packet *)skb->data;
 
 		if (time_before(packet->sendtime + expire, jiffies)) {
-			__skb_unlink(skb, &host->pending_packet_queue);
+			__skb_unlink(skb, skb->list);
 			packet->state = hpsb_complete;
 			packet->ack_code = ACKX_TIMEOUT;
 			queue_packet_complete(packet);
diff --git a/trunk/drivers/isdn/act2000/capi.c b/trunk/drivers/isdn/act2000/capi.c
index 6ae6eb322111..afa46681f983 100644
--- a/trunk/drivers/isdn/act2000/capi.c
+++ b/trunk/drivers/isdn/act2000/capi.c
@@ -606,7 +606,7 @@ handle_ack(act2000_card *card, act2000_chan *chan, __u8 blocknr) {
                 if ((((m->msg.data_b3_req.fakencci >> 8) & 0xff) == chan->ncci) &&
 		    (m->msg.data_b3_req.blocknr == blocknr)) {
 			/* found corresponding DATA_B3_REQ */
-                        skb_unlink(tmp, &card->ackq);
+                        skb_unlink(tmp);
 			chan->queued -= m->msg.data_b3_req.datalen;
 			if (m->msg.data_b3_req.flags)
 				ret = m->msg.data_b3_req.datalen;
diff --git a/trunk/drivers/isdn/i4l/isdn_net.c b/trunk/drivers/isdn/i4l/isdn_net.c
index 96c115e13389..f30e8e63ae0d 100644
--- a/trunk/drivers/isdn/i4l/isdn_net.c
+++ b/trunk/drivers/isdn/i4l/isdn_net.c
@@ -1786,6 +1786,7 @@ isdn_net_receive(struct net_device *ndev, struct sk_buff *skb)
 		lp->stats.rx_bytes += skb->len;
 	}
 	skb->dev = ndev;
+	skb->input_dev = ndev;
 	skb->pkt_type = PACKET_HOST;
 	skb->mac.raw = skb->data;
 #ifdef ISDN_DEBUG_NET_DUMP
diff --git a/trunk/drivers/isdn/i4l/isdn_ppp.c b/trunk/drivers/isdn/i4l/isdn_ppp.c
index d97a9be5469c..260a323a96d3 100644
--- a/trunk/drivers/isdn/i4l/isdn_ppp.c
+++ b/trunk/drivers/isdn/i4l/isdn_ppp.c
@@ -1177,6 +1177,7 @@ isdn_ppp_push_higher(isdn_net_dev * net_dev, isdn_net_local * lp, struct sk_buff
 		mlp->huptimer = 0;
 #endif /* CONFIG_IPPP_FILTER */
 	skb->dev = dev;
+	skb->input_dev = dev;
 	skb->mac.raw = skb->data;
 	netif_rx(skb);
 	/* net_dev->local->stats.rx_packets++; done in isdn_net.c */
diff --git a/trunk/drivers/media/dvb/ttpci/Kconfig b/trunk/drivers/media/dvb/ttpci/Kconfig
index d8bf65877897..bf3c011d2cfb 100644
--- a/trunk/drivers/media/dvb/ttpci/Kconfig
+++ b/trunk/drivers/media/dvb/ttpci/Kconfig
@@ -102,9 +102,6 @@ config DVB_BUDGET_AV
 	select VIDEO_DEV
 	select VIDEO_SAA7146_VV
 	select DVB_STV0299
-	select DVB_TDA1004X
-	select DVB_TDA10021
-	select FW_LOADER
 	help
 	  Support for simple SAA7146 based DVB cards
 	  (so called Budget- or Nova-PCI cards) without onboard
diff --git a/trunk/drivers/net/Kconfig b/trunk/drivers/net/Kconfig
index e0239a10d325..79e8aa6f2b9e 100644
--- a/trunk/drivers/net/Kconfig
+++ b/trunk/drivers/net/Kconfig
@@ -1923,17 +1923,6 @@ config R8169_VLAN
 	  
 	  If in doubt, say Y.
 
-config SIS190
-	tristate "SiS190 gigabit ethernet support"
-	depends on PCI
-	select CRC32
-	select MII
-	---help---
-	  Say Y here if you have a SiS 190 PCI Gigabit Ethernet adapter.
-
-	  To compile this driver as a module, choose M here: the module
-	  will be called sis190.  This is recommended.
-
 config SKGE
 	tristate "New SysKonnect GigaEthernet support (EXPERIMENTAL)"
 	depends on PCI && EXPERIMENTAL
@@ -2104,25 +2093,6 @@ endmenu
 menu "Ethernet (10000 Mbit)"
 	depends on !UML
 
-config CHELSIO_T1
-        tristate "Chelsio 10Gb Ethernet support"
-        depends on PCI
-        help
-          This driver supports Chelsio N110 and N210 models 10Gb Ethernet
-          cards. More information about adapter features and performance
-          tuning is in <file:Documentation/networking/cxgb.txt>.
-
-          For general information about Chelsio and our products, visit
-          our website at <http://www.chelsio.com>.
-
-          For customer support, please visit our customer support page at
-          <http://www.chelsio.com/support.htm>.
-
-          Please send feedback to <linux-bugs@chelsio.com>.
-
-          To compile this driver as a module, choose M here: the module
-          will be called cxgb.
-
 config IXGB
 	tristate "Intel(R) PRO/10GbE support"
 	depends on PCI
diff --git a/trunk/drivers/net/Makefile b/trunk/drivers/net/Makefile
index 5baafcd55610..a369ae284a9a 100644
--- a/trunk/drivers/net/Makefile
+++ b/trunk/drivers/net/Makefile
@@ -9,7 +9,6 @@ endif
 obj-$(CONFIG_E1000) += e1000/
 obj-$(CONFIG_IBM_EMAC) += ibm_emac/
 obj-$(CONFIG_IXGB) += ixgb/
-obj-$(CONFIG_CHELSIO_T1) += chelsio/
 obj-$(CONFIG_BONDING) += bonding/
 obj-$(CONFIG_GIANFAR) += gianfar_driver.o
 
@@ -43,7 +42,6 @@ obj-$(CONFIG_EEPRO100) += eepro100.o
 obj-$(CONFIG_E100) += e100.o
 obj-$(CONFIG_TLAN) += tlan.o
 obj-$(CONFIG_EPIC100) += epic100.o
-obj-$(CONFIG_SIS190) += sis190.o
 obj-$(CONFIG_SIS900) += sis900.o
 obj-$(CONFIG_YELLOWFIN) += yellowfin.o
 obj-$(CONFIG_ACENIC) += acenic.o
diff --git a/trunk/drivers/net/bnx2.c b/trunk/drivers/net/bnx2.c
index 7babf6af4e28..8acc655ec1e8 100644
--- a/trunk/drivers/net/bnx2.c
+++ b/trunk/drivers/net/bnx2.c
@@ -14,8 +14,8 @@
 
 #define DRV_MODULE_NAME		"bnx2"
 #define PFX DRV_MODULE_NAME	": "
-#define DRV_MODULE_VERSION	"1.2.20"
-#define DRV_MODULE_RELDATE	"August 22, 2005"
+#define DRV_MODULE_VERSION	"1.2.19"
+#define DRV_MODULE_RELDATE	"May 23, 2005"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -52,6 +52,7 @@ static struct {
 	{ "HP NC370i Multifunction Gigabit Server Adapter" },
 	{ "Broadcom NetXtreme II BCM5706 1000Base-SX" },
 	{ "HP NC370F Multifunction Gigabit Server Adapter" },
+	{ 0 },
 	};
 
 static struct pci_device_id bnx2_pci_tbl[] = {
@@ -107,15 +108,6 @@ static struct flash_spec flash_table[] =
 
 MODULE_DEVICE_TABLE(pci, bnx2_pci_tbl);
 
-static inline u32 bnx2_tx_avail(struct bnx2 *bp)
-{
-	u32 diff = TX_RING_IDX(bp->tx_prod) - TX_RING_IDX(bp->tx_cons);
-
-	if (diff > MAX_TX_DESC_CNT)
-		diff = (diff & MAX_TX_DESC_CNT) - 1;
-	return (bp->tx_ring_size - diff);
-}
-
 static u32
 bnx2_reg_rd_ind(struct bnx2 *bp, u32 offset)
 {
@@ -815,19 +807,7 @@ bnx2_setup_serdes_phy(struct bnx2 *bp)
 		bnx2_write_phy(bp, MII_ADVERTISE, new_adv);
 		bnx2_write_phy(bp, MII_BMCR, bmcr | BMCR_ANRESTART |
 			BMCR_ANENABLE);
-		if (CHIP_NUM(bp) == CHIP_NUM_5706) {
-			/* Speed up link-up time when the link partner
-			 * does not autonegotiate which is very common
-			 * in blade servers. Some blade servers use
-			 * IPMI for kerboard input and it's important
-			 * to minimize link disruptions. Autoneg. involves
-			 * exchanging base pages plus 3 next pages and
-			 * normally completes in about 120 msec.
-			 */
-			bp->current_interval = SERDES_AN_TIMEOUT;
-			bp->serdes_an_pending = 1;
-			mod_timer(&bp->timer, jiffies + bp->current_interval);
-		}
+		bp->serdes_an_pending = SERDES_AN_TIMEOUT / bp->timer_interval;
 	}
 
 	return 0;
@@ -1347,17 +1327,22 @@ bnx2_tx_int(struct bnx2 *bp)
 		}
 	}
 
-	bp->tx_cons = sw_cons;
+	atomic_add(tx_free_bd, &bp->tx_avail_bd);
 
 	if (unlikely(netif_queue_stopped(bp->dev))) {
-		spin_lock(&bp->tx_lock);
+		unsigned long flags;
+
+		spin_lock_irqsave(&bp->tx_lock, flags);
 		if ((netif_queue_stopped(bp->dev)) &&
-		    (bnx2_tx_avail(bp) > MAX_SKB_FRAGS)) {
+			(atomic_read(&bp->tx_avail_bd) > MAX_SKB_FRAGS)) {
 
 			netif_wake_queue(bp->dev);
 		}
-		spin_unlock(&bp->tx_lock);
+		spin_unlock_irqrestore(&bp->tx_lock, flags);
 	}
+
+	bp->tx_cons = sw_cons;
+
 }
 
 static inline void
@@ -1538,12 +1523,15 @@ bnx2_msi(int irq, void *dev_instance, struct pt_regs *regs)
 		BNX2_PCICFG_INT_ACK_CMD_MASK_INT);
 
 	/* Return here if interrupt is disabled. */
-	if (unlikely(atomic_read(&bp->intr_sem) != 0))
-		return IRQ_HANDLED;
+	if (unlikely(atomic_read(&bp->intr_sem) != 0)) {
+		return IRQ_RETVAL(1);
+	}
 
-	netif_rx_schedule(dev);
+	if (netif_rx_schedule_prep(dev)) {
+		__netif_rx_schedule(dev);
+	}
 
-	return IRQ_HANDLED;
+	return IRQ_RETVAL(1);
 }
 
 static irqreturn_t
@@ -1561,19 +1549,22 @@ bnx2_interrupt(int irq, void *dev_instance, struct pt_regs *regs)
 	if ((bp->status_blk->status_idx == bp->last_status_idx) ||
 	    (REG_RD(bp, BNX2_PCICFG_MISC_STATUS) &
 	     BNX2_PCICFG_MISC_STATUS_INTA_VALUE))
-		return IRQ_NONE;
+		return IRQ_RETVAL(0);
 
 	REG_WR(bp, BNX2_PCICFG_INT_ACK_CMD,
 		BNX2_PCICFG_INT_ACK_CMD_USE_INT_HC_PARAM |
 		BNX2_PCICFG_INT_ACK_CMD_MASK_INT);
 
 	/* Return here if interrupt is shared and is disabled. */
-	if (unlikely(atomic_read(&bp->intr_sem) != 0))
-		return IRQ_HANDLED;
+	if (unlikely(atomic_read(&bp->intr_sem) != 0)) {
+		return IRQ_RETVAL(1);
+	}
 
-	netif_rx_schedule(dev);
+	if (netif_rx_schedule_prep(dev)) {
+		__netif_rx_schedule(dev);
+	}
 
-	return IRQ_HANDLED;
+	return IRQ_RETVAL(1);
 }
 
 static int
@@ -1590,9 +1581,11 @@ bnx2_poll(struct net_device *dev, int *budget)
 		(bp->status_blk->status_attn_bits_ack &
 		STATUS_ATTN_BITS_LINK_STATE)) {
 
-		spin_lock(&bp->phy_lock);
+		unsigned long flags;
+
+		spin_lock_irqsave(&bp->phy_lock, flags);
 		bnx2_phy_int(bp);
-		spin_unlock(&bp->phy_lock);
+		spin_unlock_irqrestore(&bp->phy_lock, flags);
 	}
 
 	if (bp->status_blk->status_tx_quick_consumer_index0 != bp->tx_cons) {
@@ -1635,8 +1628,9 @@ bnx2_set_rx_mode(struct net_device *dev)
 	struct bnx2 *bp = dev->priv;
 	u32 rx_mode, sort_mode;
 	int i;
+	unsigned long flags;
 
-	spin_lock_bh(&bp->phy_lock);
+	spin_lock_irqsave(&bp->phy_lock, flags);
 
 	rx_mode = bp->rx_mode & ~(BNX2_EMAC_RX_MODE_PROMISCUOUS |
 				  BNX2_EMAC_RX_MODE_KEEP_VLAN_TAG);
@@ -1697,7 +1691,7 @@ bnx2_set_rx_mode(struct net_device *dev)
 	REG_WR(bp, BNX2_RPM_SORT_USER0, sort_mode);
 	REG_WR(bp, BNX2_RPM_SORT_USER0, sort_mode | BNX2_RPM_SORT_USER0_ENA);
 
-	spin_unlock_bh(&bp->phy_lock);
+	spin_unlock_irqrestore(&bp->phy_lock, flags);
 }
 
 static void
@@ -2966,6 +2960,7 @@ bnx2_init_tx_ring(struct bnx2 *bp)
 	bp->tx_prod = 0;
 	bp->tx_cons = 0;
 	bp->tx_prod_bseq = 0;
+	atomic_set(&bp->tx_avail_bd, bp->tx_ring_size);
 	
 	val = BNX2_L2CTX_TYPE_TYPE_L2;
 	val |= BNX2_L2CTX_TYPE_SIZE_L2;
@@ -3512,11 +3507,11 @@ bnx2_test_registers(struct bnx2 *bp)
 		rw_mask = reg_tbl[i].rw_mask;
 		ro_mask = reg_tbl[i].ro_mask;
 
-		save_val = readl(bp->regview + offset);
+		save_val = readl((u8 *) bp->regview + offset);
 
-		writel(0, bp->regview + offset);
+		writel(0, (u8 *) bp->regview + offset);
 
-		val = readl(bp->regview + offset);
+		val = readl((u8 *) bp->regview + offset);
 		if ((val & rw_mask) != 0) {
 			goto reg_test_err;
 		}
@@ -3525,9 +3520,9 @@ bnx2_test_registers(struct bnx2 *bp)
 			goto reg_test_err;
 		}
 
-		writel(0xffffffff, bp->regview + offset);
+		writel(0xffffffff, (u8 *) bp->regview + offset);
 
-		val = readl(bp->regview + offset);
+		val = readl((u8 *) bp->regview + offset);
 		if ((val & rw_mask) != rw_mask) {
 			goto reg_test_err;
 		}
@@ -3536,11 +3531,11 @@ bnx2_test_registers(struct bnx2 *bp)
 			goto reg_test_err;
 		}
 
-		writel(save_val, bp->regview + offset);
+		writel(save_val, (u8 *) bp->regview + offset);
 		continue;
 
 reg_test_err:
-		writel(save_val, bp->regview + offset);
+		writel(save_val, (u8 *) bp->regview + offset);
 		ret = -ENODEV;
 		break;
 	}
@@ -3757,10 +3752,10 @@ bnx2_test_link(struct bnx2 *bp)
 {
 	u32 bmsr;
 
-	spin_lock_bh(&bp->phy_lock);
+	spin_lock_irq(&bp->phy_lock);
 	bnx2_read_phy(bp, MII_BMSR, &bmsr);
 	bnx2_read_phy(bp, MII_BMSR, &bmsr);
-	spin_unlock_bh(&bp->phy_lock);
+	spin_unlock_irq(&bp->phy_lock);
 		
 	if (bmsr & BMSR_LSTATUS) {
 		return 0;
@@ -3806,9 +3801,6 @@ bnx2_timer(unsigned long data)
 	struct bnx2 *bp = (struct bnx2 *) data;
 	u32 msg;
 
-	if (!netif_running(bp->dev))
-		return;
-
 	if (atomic_read(&bp->intr_sem) != 0)
 		goto bnx2_restart_timer;
 
@@ -3817,16 +3809,15 @@ bnx2_timer(unsigned long data)
 
 	if ((bp->phy_flags & PHY_SERDES_FLAG) &&
 	    (CHIP_NUM(bp) == CHIP_NUM_5706)) {
+		unsigned long flags;
 
-		spin_lock(&bp->phy_lock);
+		spin_lock_irqsave(&bp->phy_lock, flags);
 		if (bp->serdes_an_pending) {
 			bp->serdes_an_pending--;
 		}
 		else if ((bp->link_up == 0) && (bp->autoneg & AUTONEG_SPEED)) {
 			u32 bmcr;
 
-			bp->current_interval = bp->timer_interval;
-
 			bnx2_read_phy(bp, MII_BMCR, &bmcr);
 
 			if (bmcr & BMCR_ANENABLE) {
@@ -3869,14 +3860,14 @@ bnx2_timer(unsigned long data)
 
 			}
 		}
-		else
-			bp->current_interval = bp->timer_interval;
 
-		spin_unlock(&bp->phy_lock);
+		spin_unlock_irqrestore(&bp->phy_lock, flags);
 	}
 
 bnx2_restart_timer:
-	mod_timer(&bp->timer, jiffies + bp->current_interval);
+	bp->timer.expires = RUN_AT(bp->timer_interval);
+
+	add_timer(&bp->timer);
 }
 
 /* Called with rtnl_lock */
@@ -3929,7 +3920,12 @@ bnx2_open(struct net_device *dev)
 		return rc;
 	}
 	
-	mod_timer(&bp->timer, jiffies + bp->current_interval);
+	init_timer(&bp->timer);
+
+	bp->timer.expires = RUN_AT(bp->timer_interval);
+	bp->timer.data = (unsigned long) bp;
+	bp->timer.function = bnx2_timer;
+	add_timer(&bp->timer);
 
 	atomic_set(&bp->intr_sem, 0);
 
@@ -3980,17 +3976,12 @@ bnx2_reset_task(void *data)
 {
 	struct bnx2 *bp = data;
 
-	if (!netif_running(bp->dev))
-		return;
-
-	bp->in_reset_task = 1;
 	bnx2_netif_stop(bp);
 
 	bnx2_init_nic(bp);
 
 	atomic_set(&bp->intr_sem, 1);
 	bnx2_netif_start(bp);
-	bp->in_reset_task = 0;
 }
 
 static void
@@ -4050,7 +4041,9 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	u16 prod, ring_prod;
 	int i;
 
-	if (unlikely(bnx2_tx_avail(bp) < (skb_shinfo(skb)->nr_frags + 1))) {
+	if (unlikely(atomic_read(&bp->tx_avail_bd) <
+		(skb_shinfo(skb)->nr_frags + 1))) {
+
 		netif_stop_queue(dev);
 		printk(KERN_ERR PFX "%s: BUG! Tx ring full when queue awake!\n",
 			dev->name);
@@ -4147,6 +4140,8 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	prod = NEXT_TX_BD(prod);
 	bp->tx_prod_bseq += skb->len;
 
+	atomic_sub(last_frag + 1, &bp->tx_avail_bd);
+
 	REG_WR16(bp, MB_TX_CID_ADDR + BNX2_L2CTX_TX_HOST_BIDX, prod);
 	REG_WR(bp, MB_TX_CID_ADDR + BNX2_L2CTX_TX_HOST_BSEQ, bp->tx_prod_bseq);
 
@@ -4155,13 +4150,17 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	bp->tx_prod = prod;
 	dev->trans_start = jiffies;
 
-	if (unlikely(bnx2_tx_avail(bp) <= MAX_SKB_FRAGS)) {
-		spin_lock(&bp->tx_lock);
-		netif_stop_queue(dev);
-		
-		if (bnx2_tx_avail(bp) > MAX_SKB_FRAGS)
-			netif_wake_queue(dev);
-		spin_unlock(&bp->tx_lock);
+	if (unlikely(atomic_read(&bp->tx_avail_bd) <= MAX_SKB_FRAGS)) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&bp->tx_lock, flags);
+		if (atomic_read(&bp->tx_avail_bd) <= MAX_SKB_FRAGS) {
+			netif_stop_queue(dev);
+
+			if (atomic_read(&bp->tx_avail_bd) > MAX_SKB_FRAGS)
+				netif_wake_queue(dev);
+		}
+		spin_unlock_irqrestore(&bp->tx_lock, flags);
 	}
 
 	return NETDEV_TX_OK;
@@ -4174,13 +4173,7 @@ bnx2_close(struct net_device *dev)
 	struct bnx2 *bp = dev->priv;
 	u32 reset_code;
 
-	/* Calling flush_scheduled_work() may deadlock because
-	 * linkwatch_event() may be on the workqueue and it will try to get
-	 * the rtnl_lock which we are holding.
-	 */
-	while (bp->in_reset_task)
-		msleep(1);
-
+	flush_scheduled_work();
 	bnx2_netif_stop(bp);
 	del_timer_sync(&bp->timer);
 	if (bp->wol)
@@ -4397,11 +4390,11 @@ bnx2_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 	bp->req_line_speed = req_line_speed;
 	bp->req_duplex = req_duplex;
 
-	spin_lock_bh(&bp->phy_lock);
+	spin_lock_irq(&bp->phy_lock);
 
 	bnx2_setup_phy(bp);
 
-	spin_unlock_bh(&bp->phy_lock);
+	spin_unlock_irq(&bp->phy_lock);
 
 	return 0;
 }
@@ -4471,20 +4464,19 @@ bnx2_nway_reset(struct net_device *dev)
 		return -EINVAL;
 	}
 
-	spin_lock_bh(&bp->phy_lock);
+	spin_lock_irq(&bp->phy_lock);
 
 	/* Force a link down visible on the other side */
 	if (bp->phy_flags & PHY_SERDES_FLAG) {
 		bnx2_write_phy(bp, MII_BMCR, BMCR_LOOPBACK);
-		spin_unlock_bh(&bp->phy_lock);
+		spin_unlock_irq(&bp->phy_lock);
 
 		msleep(20);
 
-		spin_lock_bh(&bp->phy_lock);
+		spin_lock_irq(&bp->phy_lock);
 		if (CHIP_NUM(bp) == CHIP_NUM_5706) {
-			bp->current_interval = SERDES_AN_TIMEOUT;
-			bp->serdes_an_pending = 1;
-			mod_timer(&bp->timer, jiffies + bp->current_interval);
+			bp->serdes_an_pending = SERDES_AN_TIMEOUT /
+				bp->timer_interval;
 		}
 	}
 
@@ -4492,7 +4484,7 @@ bnx2_nway_reset(struct net_device *dev)
 	bmcr &= ~BMCR_LOOPBACK;
 	bnx2_write_phy(bp, MII_BMCR, bmcr | BMCR_ANRESTART | BMCR_ANENABLE);
 
-	spin_unlock_bh(&bp->phy_lock);
+	spin_unlock_irq(&bp->phy_lock);
 
 	return 0;
 }
@@ -4678,11 +4670,11 @@ bnx2_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
 		bp->autoneg &= ~AUTONEG_FLOW_CTRL;
 	}
 
-	spin_lock_bh(&bp->phy_lock);
+	spin_lock_irq(&bp->phy_lock);
 
 	bnx2_setup_phy(bp);
 
-	spin_unlock_bh(&bp->phy_lock);
+	spin_unlock_irq(&bp->phy_lock);
 
 	return 0;
 }
@@ -4706,7 +4698,7 @@ bnx2_set_rx_csum(struct net_device *dev, u32 data)
 
 #define BNX2_NUM_STATS 45
 
-static struct {
+struct {
 	char string[ETH_GSTRING_LEN];
 } bnx2_stats_str_arr[BNX2_NUM_STATS] = {
 	{ "rx_bytes" },
@@ -4758,7 +4750,7 @@ static struct {
 
 #define STATS_OFFSET32(offset_name) (offsetof(struct statistics_block, offset_name) / 4)
 
-static unsigned long bnx2_stats_offset_arr[BNX2_NUM_STATS] = {
+unsigned long bnx2_stats_offset_arr[BNX2_NUM_STATS] = {
     STATS_OFFSET32(stat_IfHCInOctets_hi),
     STATS_OFFSET32(stat_IfHCInBadOctets_hi),
     STATS_OFFSET32(stat_IfHCOutOctets_hi),
@@ -4809,7 +4801,7 @@ static unsigned long bnx2_stats_offset_arr[BNX2_NUM_STATS] = {
 /* stat_IfHCInBadOctets and stat_Dot3StatsCarrierSenseErrors are
  * skipped because of errata.
  */               
-static u8 bnx2_5706_stats_len_arr[BNX2_NUM_STATS] = {
+u8 bnx2_5706_stats_len_arr[BNX2_NUM_STATS] = {
 	8,0,8,8,8,8,8,8,8,8,
 	4,0,4,4,4,4,4,4,4,4,
 	4,4,4,4,4,4,4,4,4,4,
@@ -4819,7 +4811,7 @@ static u8 bnx2_5706_stats_len_arr[BNX2_NUM_STATS] = {
 
 #define BNX2_NUM_TESTS 6
 
-static struct {
+struct {
 	char string[ETH_GSTRING_LEN];
 } bnx2_tests_str_arr[BNX2_NUM_TESTS] = {
 	{ "register_test (offline)" },
@@ -4918,7 +4910,7 @@ bnx2_get_ethtool_stats(struct net_device *dev,
 	struct bnx2 *bp = dev->priv;
 	int i;
 	u32 *hw_stats = (u32 *) bp->stats_blk;
-	u8 *stats_len_arr = NULL;
+	u8 *stats_len_arr = 0;
 
 	if (hw_stats == NULL) {
 		memset(buf, 0, sizeof(u64) * BNX2_NUM_STATS);
@@ -5020,7 +5012,7 @@ static struct ethtool_ops bnx2_ethtool_ops = {
 static int
 bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
-	struct mii_ioctl_data *data = if_mii(ifr);
+	struct mii_ioctl_data *data = (struct mii_ioctl_data *)&ifr->ifr_data;
 	struct bnx2 *bp = dev->priv;
 	int err;
 
@@ -5032,9 +5024,9 @@ bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 	case SIOCGMIIREG: {
 		u32 mii_regval;
 
-		spin_lock_bh(&bp->phy_lock);
+		spin_lock_irq(&bp->phy_lock);
 		err = bnx2_read_phy(bp, data->reg_num & 0x1f, &mii_regval);
-		spin_unlock_bh(&bp->phy_lock);
+		spin_unlock_irq(&bp->phy_lock);
 
 		data->val_out = mii_regval;
 
@@ -5045,9 +5037,9 @@ bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 		if (!capable(CAP_NET_ADMIN))
 			return -EPERM;
 
-		spin_lock_bh(&bp->phy_lock);
+		spin_lock_irq(&bp->phy_lock);
 		err = bnx2_write_phy(bp, data->reg_num & 0x1f, data->val_in);
-		spin_unlock_bh(&bp->phy_lock);
+		spin_unlock_irq(&bp->phy_lock);
 
 		return err;
 
@@ -5065,9 +5057,6 @@ bnx2_change_mac_addr(struct net_device *dev, void *p)
 	struct sockaddr *addr = p;
 	struct bnx2 *bp = dev->priv;
 
-	if (!is_valid_ether_addr(addr->sa_data))
-		return -EINVAL;
-
 	memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
 	if (netif_running(dev))
 		bnx2_set_mac_addr(bp);
@@ -5316,7 +5305,6 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 	bp->stats_ticks = 1000000 & 0xffff00;
 
 	bp->timer_interval =  HZ;
-	bp->current_interval =  HZ;
 
 	/* Disable WOL support if we are running on a SERDES chip. */
 	if (CHIP_BOND_ID(bp) & CHIP_BOND_ID_SERDES_BIT) {
@@ -5340,15 +5328,6 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 	bp->req_line_speed = 0;
 	if (bp->phy_flags & PHY_SERDES_FLAG) {
 		bp->advertising = ETHTOOL_ALL_FIBRE_SPEED | ADVERTISED_Autoneg;
-
-		reg = REG_RD_IND(bp, HOST_VIEW_SHMEM_BASE +
-				 BNX2_PORT_HW_CFG_CONFIG);
-		reg &= BNX2_PORT_HW_CFG_CFG_DFLT_LINK_MASK;
-		if (reg == BNX2_PORT_HW_CFG_CFG_DFLT_LINK_1G) {
-			bp->autoneg = 0;
-			bp->req_line_speed = bp->line_speed = SPEED_1000;
-			bp->req_duplex = DUPLEX_FULL;
-		}
 	}
 	else {
 		bp->advertising = ETHTOOL_ALL_COPPER_SPEED | ADVERTISED_Autoneg;
@@ -5356,17 +5335,11 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 
 	bp->req_flow_ctrl = FLOW_CTRL_RX | FLOW_CTRL_TX;
 
-	init_timer(&bp->timer);
-	bp->timer.expires = RUN_AT(bp->timer_interval);
-	bp->timer.data = (unsigned long) bp;
-	bp->timer.function = bnx2_timer;
-
 	return 0;
 
 err_out_unmap:
 	if (bp->regview) {
 		iounmap(bp->regview);
-		bp->regview = NULL;
 	}
 
 err_out_release:
@@ -5481,8 +5454,6 @@ bnx2_remove_one(struct pci_dev *pdev)
 	struct net_device *dev = pci_get_drvdata(pdev);
 	struct bnx2 *bp = dev->priv;
 
-	flush_scheduled_work();
-
 	unregister_netdev(dev);
 
 	if (bp->regview)
@@ -5534,12 +5505,12 @@ bnx2_resume(struct pci_dev *pdev)
 }
 
 static struct pci_driver bnx2_pci_driver = {
-	.name		= DRV_MODULE_NAME,
-	.id_table	= bnx2_pci_tbl,
-	.probe		= bnx2_init_one,
-	.remove		= __devexit_p(bnx2_remove_one),
-	.suspend	= bnx2_suspend,
-	.resume		= bnx2_resume,
+	name:		DRV_MODULE_NAME,
+	id_table:	bnx2_pci_tbl,
+	probe:		bnx2_init_one,
+	remove:		__devexit_p(bnx2_remove_one),
+	suspend:	bnx2_suspend,
+	resume:		bnx2_resume,
 };
 
 static int __init bnx2_init(void)
diff --git a/trunk/drivers/net/bnx2.h b/trunk/drivers/net/bnx2.h
index 9ad3f5740cd8..8214a2853d0d 100644
--- a/trunk/drivers/net/bnx2.h
+++ b/trunk/drivers/net/bnx2.h
@@ -3841,12 +3841,12 @@ struct bnx2 {
 	struct status_block	*status_blk;
 	u32 			last_status_idx;
 
+	atomic_t		tx_avail_bd;
 	struct tx_bd		*tx_desc_ring;
 	struct sw_bd		*tx_buf_ring;
 	u32			tx_prod_bseq;
 	u16			tx_prod;
 	u16			tx_cons;
-	int			tx_ring_size;
 
 #ifdef BCM_VLAN 
 	struct			vlan_group *vlgrp;
@@ -3872,10 +3872,8 @@ struct bnx2 {
 	char			*name;
 
 	int			timer_interval;
-	int			current_interval;
 	struct			timer_list timer;
 	struct work_struct	reset_task;
-	int			in_reset_task;
 
 	/* Used to synchronize phy accesses. */
 	spinlock_t		phy_lock;
@@ -3929,6 +3927,7 @@ struct bnx2 {
 	u16			fw_wr_seq;
 	u16			fw_drv_pulse_wr_seq;
 
+	int			tx_ring_size;
 	dma_addr_t		tx_desc_mapping;
 
 
@@ -3986,7 +3985,7 @@ struct bnx2 {
 #define PHY_LOOPBACK		2
 
 	u8			serdes_an_pending;
-#define SERDES_AN_TIMEOUT	(HZ / 3)
+#define SERDES_AN_TIMEOUT	(2 * HZ)
 
 	u8			mac_addr[8];
 
@@ -4172,9 +4171,6 @@ struct fw_info {
 
 #define BNX2_PORT_HW_CFG_MAC_LOWER		0x00000054
 #define BNX2_PORT_HW_CFG_CONFIG			0x00000058
-#define BNX2_PORT_HW_CFG_CFG_DFLT_LINK_MASK	 0x001f0000
-#define BNX2_PORT_HW_CFG_CFG_DFLT_LINK_AN	 0x00000000
-#define BNX2_PORT_HW_CFG_CFG_DFLT_LINK_1G	 0x00030000
 
 #define BNX2_PORT_HW_CFG_IMD_MAC_A_UPPER	0x00000068
 #define BNX2_PORT_HW_CFG_IMD_MAC_A_LOWER	0x0000006c
diff --git a/trunk/drivers/net/bonding/bond_3ad.c b/trunk/drivers/net/bonding/bond_3ad.c
index d2f34d5a8083..a2e8dda5afac 100644
--- a/trunk/drivers/net/bonding/bond_3ad.c
+++ b/trunk/drivers/net/bonding/bond_3ad.c
@@ -2419,19 +2419,22 @@ int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
 	return 0;
 }
 
-int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type* ptype, struct net_device *orig_dev)
+int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type* ptype)
 {
 	struct bonding *bond = dev->priv;
 	struct slave *slave = NULL;
 	int ret = NET_RX_DROP;
 
-	if (!(dev->flags & IFF_MASTER))
+	if (!(dev->flags & IFF_MASTER)) {
 		goto out;
+	}
 
 	read_lock(&bond->lock);
-	slave = bond_get_slave_by_dev((struct bonding *)dev->priv, orig_dev);
-	if (!slave)
+	slave = bond_get_slave_by_dev((struct bonding *)dev->priv,
+				      skb->real_dev);
+	if (slave == NULL) {
 		goto out_unlock;
+	}
 
 	bond_3ad_rx_indication((struct lacpdu *) skb->data, slave, skb->len);
 
diff --git a/trunk/drivers/net/bonding/bond_3ad.h b/trunk/drivers/net/bonding/bond_3ad.h
index 673a30af5660..f46823894187 100644
--- a/trunk/drivers/net/bonding/bond_3ad.h
+++ b/trunk/drivers/net/bonding/bond_3ad.h
@@ -295,6 +295,6 @@ void bond_3ad_adapter_duplex_changed(struct slave *slave);
 void bond_3ad_handle_link_change(struct slave *slave, char link);
 int  bond_3ad_get_active_agg_info(struct bonding *bond, struct ad_info *ad_info);
 int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev);
-int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type* ptype, struct net_device *orig_dev);
+int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type* ptype);
 #endif //__BOND_3AD_H__
 
diff --git a/trunk/drivers/net/bonding/bond_alb.c b/trunk/drivers/net/bonding/bond_alb.c
index f8fce3961197..19e829b567d0 100644
--- a/trunk/drivers/net/bonding/bond_alb.c
+++ b/trunk/drivers/net/bonding/bond_alb.c
@@ -354,14 +354,15 @@ static void rlb_update_entry_from_arp(struct bonding *bond, struct arp_pkt *arp)
 	_unlock_rx_hashtbl(bond);
 }
 
-static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct packet_type *ptype, struct net_device *orig_dev)
+static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct packet_type *ptype)
 {
 	struct bonding *bond = bond_dev->priv;
 	struct arp_pkt *arp = (struct arp_pkt *)skb->data;
 	int res = NET_RX_DROP;
 
-	if (!(bond_dev->flags & IFF_MASTER))
+	if (!(bond_dev->flags & IFF_MASTER)) {
 		goto out;
+	}
 
 	if (!arp) {
 		dprintk("Packet has no ARP data\n");
diff --git a/trunk/drivers/net/chelsio/Makefile b/trunk/drivers/net/chelsio/Makefile
deleted file mode 100644
index 91e927827c43..000000000000
--- a/trunk/drivers/net/chelsio/Makefile
+++ /dev/null
@@ -1,11 +0,0 @@
-#
-# Chelsio 10Gb NIC driver for Linux.
-#
-
-obj-$(CONFIG_CHELSIO_T1) += cxgb.o
-
-EXTRA_CFLAGS += -I$(TOPDIR)/drivers/net/chelsio $(DEBUG_FLAGS)
-
-
-cxgb-objs := cxgb2.o espi.o pm3393.o sge.o subr.o mv88x201x.o
-
diff --git a/trunk/drivers/net/chelsio/common.h b/trunk/drivers/net/chelsio/common.h
deleted file mode 100644
index f09348802b46..000000000000
--- a/trunk/drivers/net/chelsio/common.h
+++ /dev/null
@@ -1,314 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: common.h                                                            *
- * $Revision: 1.21 $                                                         *
- * $Date: 2005/06/22 00:43:25 $                                              *
- * Description:                                                              *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#ifndef _CXGB_COMMON_H_
-#define _CXGB_COMMON_H_
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/types.h>
-#include <linux/delay.h>
-#include <linux/pci.h>
-#include <linux/ethtool.h>
-#include <linux/mii.h>
-#include <linux/crc32.h>
-#include <linux/init.h>
-#include <asm/io.h>
-#include <linux/pci_ids.h>
-
-#define DRV_DESCRIPTION "Chelsio 10Gb Ethernet Driver"
-#define DRV_NAME "cxgb"
-#define DRV_VERSION "2.1.1"
-#define PFX      DRV_NAME ": "
-
-#define CH_ERR(fmt, ...)   printk(KERN_ERR PFX fmt, ## __VA_ARGS__)
-#define CH_WARN(fmt, ...)  printk(KERN_WARNING PFX fmt, ## __VA_ARGS__)
-#define CH_ALERT(fmt, ...) printk(KERN_ALERT PFX fmt, ## __VA_ARGS__)
-
-#define CH_DEVICE(devid, ssid, idx) \
-	{ PCI_VENDOR_ID_CHELSIO, devid, PCI_ANY_ID, ssid, 0, 0, idx }
-
-#define SUPPORTED_PAUSE       (1 << 13)
-#define SUPPORTED_LOOPBACK    (1 << 15)
-
-#define ADVERTISED_PAUSE      (1 << 13)
-#define ADVERTISED_ASYM_PAUSE (1 << 14)
-
-typedef struct adapter adapter_t;
-
-void t1_elmer0_ext_intr(adapter_t *adapter);
-void t1_link_changed(adapter_t *adapter, int port_id, int link_status,
-			int speed, int duplex, int fc);
-
-struct t1_rx_mode {
-	struct net_device *dev;
-	u32 idx;
-	struct dev_mc_list *list;
-};
-
-#define t1_rx_mode_promisc(rm)	(rm->dev->flags & IFF_PROMISC)
-#define t1_rx_mode_allmulti(rm)	(rm->dev->flags & IFF_ALLMULTI)
-#define t1_rx_mode_mc_cnt(rm)	(rm->dev->mc_count)
-
-static inline u8 *t1_get_next_mcaddr(struct t1_rx_mode *rm)
-{
-	u8 *addr = 0;
-
-	if (rm->idx++ < rm->dev->mc_count) {
-		addr = rm->list->dmi_addr;
-		rm->list = rm->list->next;
-	}
-	return addr;
-}
-
-#define	MAX_NPORTS 4
-
-#define SPEED_INVALID 0xffff
-#define DUPLEX_INVALID 0xff
-
-enum {
-	CHBT_BOARD_N110,
-	CHBT_BOARD_N210
-};
-
-enum {
-	CHBT_TERM_T1,
-	CHBT_TERM_T2
-};
-
-enum {
-	CHBT_MAC_PM3393,
-};
-
-enum {
-	CHBT_PHY_88X2010,
-};
-
-enum {
-	PAUSE_RX      = 1 << 0,
-	PAUSE_TX      = 1 << 1,
-	PAUSE_AUTONEG = 1 << 2
-};
-
-/* Revisions of T1 chip */
-enum {
-	TERM_T1A   = 0,
-	TERM_T1B   = 1,
-	TERM_T2    = 3
-};
-
-struct sge_params {
-	unsigned int cmdQ_size[2];
-	unsigned int freelQ_size[2];
-	unsigned int large_buf_capacity;
-	unsigned int rx_coalesce_usecs;
-	unsigned int last_rx_coalesce_raw;
-	unsigned int default_rx_coalesce_usecs;
-	unsigned int sample_interval_usecs;
-	unsigned int coalesce_enable;
-	unsigned int polling;
-};
-
-struct chelsio_pci_params {
-	unsigned short speed;
-	unsigned char  width;
-	unsigned char  is_pcix;
-};
-
-struct adapter_params {
-	struct sge_params sge;
-	struct chelsio_pci_params pci;
-
-	const struct board_info *brd_info;
-
-	unsigned int   nports;          /* # of ethernet ports */
-	unsigned int   stats_update_period;
-	unsigned short chip_revision;
-	unsigned char  chip_version;
-};
-
-struct link_config {
-	unsigned int   supported;        /* link capabilities */
-	unsigned int   advertising;      /* advertised capabilities */
-	unsigned short requested_speed;  /* speed user has requested */
-	unsigned short speed;            /* actual link speed */
-	unsigned char  requested_duplex; /* duplex user has requested */
-	unsigned char  duplex;           /* actual link duplex */
-	unsigned char  requested_fc;     /* flow control user has requested */
-	unsigned char  fc;               /* actual link flow control */
-	unsigned char  autoneg;          /* autonegotiating? */
-};
-
-struct cmac;
-struct cphy;
-
-struct port_info {
-	struct net_device *dev;
-	struct cmac *mac;
-	struct cphy *phy;
-	struct link_config link_config;
-	struct net_device_stats netstats;
-};
-
-struct sge;
-struct peespi;
-
-struct adapter {
-	u8 *regs;
-	struct pci_dev *pdev;
-	unsigned long registered_device_map;
-	unsigned long open_device_map;
-	unsigned long flags;
-
-	const char *name;
-	int msg_enable;
-	u32 mmio_len;
-
-	struct work_struct ext_intr_handler_task;
-	struct adapter_params params;
-
-	struct vlan_group *vlan_grp;
-
-	/* Terminator modules. */
-	struct sge    *sge;
-	struct peespi *espi;
-
-	struct port_info port[MAX_NPORTS];
-	struct work_struct stats_update_task;
-	struct timer_list stats_update_timer;
-
-	struct semaphore mib_mutex;
-	spinlock_t tpi_lock;
-	spinlock_t work_lock;
-	/* guards async operations */
-	spinlock_t async_lock ____cacheline_aligned;
-	u32 slow_intr_mask;
-};
-
-enum {                                           /* adapter flags */
-	FULL_INIT_DONE        = 1 << 0,
-	TSO_CAPABLE           = 1 << 2,
-	TCP_CSUM_CAPABLE      = 1 << 3,
-	UDP_CSUM_CAPABLE      = 1 << 4,
-	VLAN_ACCEL_CAPABLE    = 1 << 5,
-	RX_CSUM_ENABLED       = 1 << 6,
-};
-
-struct mdio_ops;
-struct gmac;
-struct gphy;
-
-struct board_info {
-	unsigned char           board;
-	unsigned char           port_number;
-	unsigned long           caps;
-	unsigned char           chip_term;
-	unsigned char           chip_mac;
-	unsigned char           chip_phy;
-	unsigned int            clock_core;
-	unsigned int            clock_mc3;
-	unsigned int            clock_mc4;
-	unsigned int            espi_nports;
-	unsigned int            clock_cspi;
-	unsigned int            clock_elmer0;
-	unsigned char           mdio_mdien;
-	unsigned char           mdio_mdiinv;
-	unsigned char           mdio_mdc;
-	unsigned char           mdio_phybaseaddr;
-	struct gmac            *gmac;
-	struct gphy            *gphy;
-	struct mdio_ops	       *mdio_ops;
-	const char             *desc;
-};
-
-extern struct pci_device_id t1_pci_tbl[];
-
-static inline int adapter_matches_type(const adapter_t *adapter,
-				       int version, int revision)
-{
-	return adapter->params.chip_version == version &&
-	       adapter->params.chip_revision == revision;
-}
-
-#define t1_is_T1B(adap) adapter_matches_type(adap, CHBT_TERM_T1, TERM_T1B)
-#define is_T2(adap)     adapter_matches_type(adap, CHBT_TERM_T2, TERM_T2)
-
-/* Returns true if an adapter supports VLAN acceleration and TSO */
-static inline int vlan_tso_capable(const adapter_t *adapter)
-{
-	return !t1_is_T1B(adapter);
-}
-
-#define for_each_port(adapter, iter) \
-	for (iter = 0; iter < (adapter)->params.nports; ++iter)
-
-#define board_info(adapter) ((adapter)->params.brd_info)
-#define is_10G(adapter) (board_info(adapter)->caps & SUPPORTED_10000baseT_Full)
-
-static inline unsigned int core_ticks_per_usec(const adapter_t *adap)
-{
-	return board_info(adap)->clock_core / 1000000;
-}
-
-extern int t1_tpi_write(adapter_t *adapter, u32 addr, u32 value);
-extern int t1_tpi_read(adapter_t *adapter, u32 addr, u32 *value);
-
-extern void t1_interrupts_enable(adapter_t *adapter);
-extern void t1_interrupts_disable(adapter_t *adapter);
-extern void t1_interrupts_clear(adapter_t *adapter);
-extern int elmer0_ext_intr_handler(adapter_t *adapter);
-extern int t1_slow_intr_handler(adapter_t *adapter);
-
-extern int t1_link_start(struct cphy *phy, struct cmac *mac, struct link_config *lc);
-extern const struct board_info *t1_get_board_info(unsigned int board_id);
-extern const struct board_info *t1_get_board_info_from_ids(unsigned int devid,
-						    unsigned short ssid);
-extern int t1_seeprom_read(adapter_t *adapter, u32 addr, u32 *data);
-extern int t1_get_board_rev(adapter_t *adapter, const struct board_info *bi,
-		     struct adapter_params *p);
-extern int t1_init_hw_modules(adapter_t *adapter);
-extern int t1_init_sw_modules(adapter_t *adapter, const struct board_info *bi);
-extern void t1_free_sw_modules(adapter_t *adapter);
-extern void t1_fatal_err(adapter_t *adapter);
-
-extern void t1_tp_set_udp_checksum_offload(adapter_t *adapter, int enable);
-extern void t1_tp_set_tcp_checksum_offload(adapter_t *adapter, int enable);
-extern void t1_tp_set_ip_checksum_offload(adapter_t *adapter, int enable);
-
-#endif /* _CXGB_COMMON_H_ */
diff --git a/trunk/drivers/net/chelsio/cphy.h b/trunk/drivers/net/chelsio/cphy.h
deleted file mode 100644
index 3412342f7345..000000000000
--- a/trunk/drivers/net/chelsio/cphy.h
+++ /dev/null
@@ -1,148 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: cphy.h                                                              *
- * $Revision: 1.7 $                                                          *
- * $Date: 2005/06/21 18:29:47 $                                              *
- * Description:                                                              *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#ifndef _CXGB_CPHY_H_
-#define _CXGB_CPHY_H_
-
-#include "common.h"
-
-struct mdio_ops {
-	void (*init)(adapter_t *adapter, const struct board_info *bi);
-	int  (*read)(adapter_t *adapter, int phy_addr, int mmd_addr,
-		     int reg_addr, unsigned int *val);
-	int  (*write)(adapter_t *adapter, int phy_addr, int mmd_addr,
-		      int reg_addr, unsigned int val);
-};
-
-/* PHY interrupt types */
-enum {
-	cphy_cause_link_change = 0x1,
-	cphy_cause_error = 0x2
-};
-
-struct cphy;
-
-/* PHY operations */
-struct cphy_ops {
-	void (*destroy)(struct cphy *);
-	int (*reset)(struct cphy *, int wait);
-
-	int (*interrupt_enable)(struct cphy *);
-	int (*interrupt_disable)(struct cphy *);
-	int (*interrupt_clear)(struct cphy *);
-	int (*interrupt_handler)(struct cphy *);
-
-	int (*autoneg_enable)(struct cphy *);
-	int (*autoneg_disable)(struct cphy *);
-	int (*autoneg_restart)(struct cphy *);
-
-	int (*advertise)(struct cphy *phy, unsigned int advertise_map);
-	int (*set_loopback)(struct cphy *, int on);
-	int (*set_speed_duplex)(struct cphy *phy, int speed, int duplex);
-	int (*get_link_status)(struct cphy *phy, int *link_ok, int *speed,
-			       int *duplex, int *fc);
-};
-
-/* A PHY instance */
-struct cphy {
-	int addr;                            /* PHY address */
-	adapter_t *adapter;                  /* associated adapter */
-	struct cphy_ops *ops;                /* PHY operations */
-	int (*mdio_read)(adapter_t *adapter, int phy_addr, int mmd_addr,
-			 int reg_addr, unsigned int *val);
-	int (*mdio_write)(adapter_t *adapter, int phy_addr, int mmd_addr,
-			  int reg_addr, unsigned int val);
-	struct cphy_instance *instance;
-};
-
-/* Convenience MDIO read/write wrappers */
-static inline int mdio_read(struct cphy *cphy, int mmd, int reg,
-			    unsigned int *valp)
-{
-	return cphy->mdio_read(cphy->adapter, cphy->addr, mmd, reg, valp);
-}
-
-static inline int mdio_write(struct cphy *cphy, int mmd, int reg,
-			     unsigned int val)
-{
-	return cphy->mdio_write(cphy->adapter, cphy->addr, mmd, reg, val);
-}
-
-static inline int simple_mdio_read(struct cphy *cphy, int reg,
-				   unsigned int *valp)
-{
-	return mdio_read(cphy, 0, reg, valp);
-}
-
-static inline int simple_mdio_write(struct cphy *cphy, int reg,
-				    unsigned int val)
-{
-	return mdio_write(cphy, 0, reg, val);
-}
-
-/* Convenience initializer */
-static inline void cphy_init(struct cphy *phy, adapter_t *adapter,
-			     int phy_addr, struct cphy_ops *phy_ops,
-			     struct mdio_ops *mdio_ops)
-{
-	phy->adapter = adapter;
-	phy->addr    = phy_addr;
-	phy->ops     = phy_ops;
-	if (mdio_ops) {
-		phy->mdio_read  = mdio_ops->read;
-		phy->mdio_write = mdio_ops->write;
-	}
-}
-
-/* Operations of the PHY-instance factory */
-struct gphy {
-	/* Construct a PHY instance with the given PHY address */
-	struct cphy *(*create)(adapter_t *adapter, int phy_addr,
-			       struct mdio_ops *mdio_ops);
-
-	/*
-	 * Reset the PHY chip.  This resets the whole PHY chip, not individual
-	 * ports.
-	 */
-	int (*reset)(adapter_t *adapter);
-};
-
-extern struct gphy t1_mv88x201x_ops;
-extern struct gphy t1_dummy_phy_ops;
-
-#endif /* _CXGB_CPHY_H_ */
diff --git a/trunk/drivers/net/chelsio/cpl5_cmd.h b/trunk/drivers/net/chelsio/cpl5_cmd.h
deleted file mode 100644
index 27925e487bcf..000000000000
--- a/trunk/drivers/net/chelsio/cpl5_cmd.h
+++ /dev/null
@@ -1,145 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: cpl5_cmd.h                                                          *
- * $Revision: 1.6 $                                                          *
- * $Date: 2005/06/21 18:29:47 $                                              *
- * Description:                                                              *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#ifndef _CXGB_CPL5_CMD_H_
-#define _CXGB_CPL5_CMD_H_
-
-#include <asm/byteorder.h>
-
-#if !defined(__LITTLE_ENDIAN_BITFIELD) && !defined(__BIG_ENDIAN_BITFIELD)
-#error "Adjust your <asm/byteorder.h> defines"
-#endif
-
-enum CPL_opcode {
-	CPL_RX_PKT            = 0xAD,
-	CPL_TX_PKT            = 0xB2,
-	CPL_TX_PKT_LSO        = 0xB6,
-};
-
-enum {                /* TX_PKT_LSO ethernet types */
-	CPL_ETH_II,
-	CPL_ETH_II_VLAN,
-	CPL_ETH_802_3,
-	CPL_ETH_802_3_VLAN
-};
-
-struct cpl_rx_data {
-	u32 rsvd0;
-	u32 len;
-	u32 seq;
-	u16 urg;
-	u8  rsvd1;
-	u8  status;
-};
-
-/*
- * We want this header's alignment to be no more stringent than 2-byte aligned.
- * All fields are u8 or u16 except for the length.  However that field is not
- * used so we break it into 2 16-bit parts to easily meet our alignment needs.
- */
-struct cpl_tx_pkt {
-	u8 opcode;
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	u8 iff:4;
-	u8 ip_csum_dis:1;
-	u8 l4_csum_dis:1;
-	u8 vlan_valid:1;
-	u8 rsvd:1;
-#else
-	u8 rsvd:1;
-	u8 vlan_valid:1;
-	u8 l4_csum_dis:1;
-	u8 ip_csum_dis:1;
-	u8 iff:4;
-#endif
-	u16 vlan;
-	u16 len_hi;
-	u16 len_lo;
-};
-
-struct cpl_tx_pkt_lso {
-	u8 opcode;
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	u8 iff:4;
-	u8 ip_csum_dis:1;
-	u8 l4_csum_dis:1;
-	u8 vlan_valid:1;
-	u8 rsvd:1;
-#else
-	u8 rsvd:1;
-	u8 vlan_valid:1;
-	u8 l4_csum_dis:1;
-	u8 ip_csum_dis:1;
-	u8 iff:4;
-#endif
-	u16 vlan;
-	u32 len;
-
-	u32 rsvd2;
-	u8 rsvd3;
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	u8 tcp_hdr_words:4;
-	u8 ip_hdr_words:4;
-#else
-	u8 ip_hdr_words:4;
-	u8 tcp_hdr_words:4;
-#endif
-	u16 eth_type_mss;
-};
-
-struct cpl_rx_pkt {
-	u8 opcode;
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	u8 iff:4;
-	u8 csum_valid:1;
-	u8 bad_pkt:1;
-	u8 vlan_valid:1;
-	u8 rsvd:1;
-#else
-	u8 rsvd:1;
-	u8 vlan_valid:1;
-	u8 bad_pkt:1;
-	u8 csum_valid:1;
-	u8 iff:4;
-#endif
-	u16 csum;
-	u16 vlan;
-	u16 len;
-};
-
-#endif /* _CXGB_CPL5_CMD_H_ */
diff --git a/trunk/drivers/net/chelsio/cxgb2.c b/trunk/drivers/net/chelsio/cxgb2.c
deleted file mode 100644
index 28ae478b386d..000000000000
--- a/trunk/drivers/net/chelsio/cxgb2.c
+++ /dev/null
@@ -1,1256 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: cxgb2.c                                                             *
- * $Revision: 1.25 $                                                         *
- * $Date: 2005/06/22 00:43:25 $                                              *
- * Description:                                                              *
- *  Chelsio 10Gb Ethernet Driver.                                            *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#include "common.h"
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/pci.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/if_vlan.h>
-#include <linux/mii.h>
-#include <linux/sockios.h>
-#include <linux/proc_fs.h>
-#include <linux/dma-mapping.h>
-#include <asm/uaccess.h>
-
-#include "cpl5_cmd.h"
-#include "regs.h"
-#include "gmac.h"
-#include "cphy.h"
-#include "sge.h"
-#include "espi.h"
-
-#ifdef work_struct
-#include <linux/tqueue.h>
-#define INIT_WORK INIT_TQUEUE
-#define schedule_work schedule_task
-#define flush_scheduled_work flush_scheduled_tasks
-
-static inline void schedule_mac_stats_update(struct adapter *ap, int secs)
-{
-	mod_timer(&ap->stats_update_timer, jiffies + secs * HZ);
-}
-
-static inline void cancel_mac_stats_update(struct adapter *ap)
-{
-	del_timer_sync(&ap->stats_update_timer);
-	flush_scheduled_tasks();
-}
-
-/*
- * Stats update timer for 2.4.  It schedules a task to do the actual update as
- * we need to access MAC statistics in process context.
- */
-static void mac_stats_timer(unsigned long data)
-{
-	struct adapter *ap = (struct adapter *)data;
-
-	schedule_task(&ap->stats_update_task);
-}
-#else
-#include <linux/workqueue.h>
-
-static inline void schedule_mac_stats_update(struct adapter *ap, int secs)
-{
-	schedule_delayed_work(&ap->stats_update_task, secs * HZ);
-}
-
-static inline void cancel_mac_stats_update(struct adapter *ap)
-{
-	cancel_delayed_work(&ap->stats_update_task);
-}
-#endif
-
-#define MAX_CMDQ_ENTRIES 16384
-#define MAX_CMDQ1_ENTRIES 1024
-#define MAX_RX_BUFFERS 16384
-#define MAX_RX_JUMBO_BUFFERS 16384
-#define MAX_TX_BUFFERS_HIGH	16384U
-#define MAX_TX_BUFFERS_LOW	1536U
-#define MIN_FL_ENTRIES 32
-
-#define PORT_MASK ((1 << MAX_NPORTS) - 1)
-
-#define DFLT_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_PROBE | NETIF_MSG_LINK | \
-			 NETIF_MSG_TIMER | NETIF_MSG_IFDOWN | NETIF_MSG_IFUP |\
-			 NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
-
-/*
- * The EEPROM is actually bigger but only the first few bytes are used so we
- * only report those.
- */
-#define EEPROM_SIZE 32
-
-MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_AUTHOR("Chelsio Communications");
-MODULE_LICENSE("GPL");
-
-static int dflt_msg_enable = DFLT_MSG_ENABLE;
-
-MODULE_PARM(dflt_msg_enable, "i");
-MODULE_PARM_DESC(dflt_msg_enable, "Chelsio T1 message enable bitmap");
-
-
-static const char pci_speed[][4] = {
-	"33", "66", "100", "133"
-};
-
-/*
- * Setup MAC to receive the types of packets we want.
- */
-static void t1_set_rxmode(struct net_device *dev)
-{
-	struct adapter *adapter = dev->priv;
-	struct cmac *mac = adapter->port[dev->if_port].mac;
-	struct t1_rx_mode rm;
-
-	rm.dev = dev;
-	rm.idx = 0;
-	rm.list = dev->mc_list;
-	mac->ops->set_rx_mode(mac, &rm);
-}
-
-static void link_report(struct port_info *p)
-{
-	if (!netif_carrier_ok(p->dev))
-        	printk(KERN_INFO "%s: link down\n", p->dev->name);
-	else {
-		const char *s = "10Mbps";
-
-		switch (p->link_config.speed) {
-			case SPEED_10000: s = "10Gbps"; break;
-			case SPEED_1000:  s = "1000Mbps"; break;
-			case SPEED_100:   s = "100Mbps"; break;
-		}
-
-        printk(KERN_INFO "%s: link up, %s, %s-duplex\n",
-		       p->dev->name, s,
-		       p->link_config.duplex == DUPLEX_FULL ? "full" : "half");
-	}
-}
-
-void t1_link_changed(struct adapter *adapter, int port_id, int link_stat,
-			int speed, int duplex, int pause)
-{
-	struct port_info *p = &adapter->port[port_id];
-
-	if (link_stat != netif_carrier_ok(p->dev)) {
-		if (link_stat)
-			netif_carrier_on(p->dev);
-		else
-			netif_carrier_off(p->dev);
-		link_report(p);
-
-	}
-}
-
-static void link_start(struct port_info *p)
-{
-	struct cmac *mac = p->mac;
-
-	mac->ops->reset(mac);
-	if (mac->ops->macaddress_set)
-		mac->ops->macaddress_set(mac, p->dev->dev_addr);
-	t1_set_rxmode(p->dev);
-	t1_link_start(p->phy, mac, &p->link_config);
-	mac->ops->enable(mac, MAC_DIRECTION_RX | MAC_DIRECTION_TX);
-}
-
-static void enable_hw_csum(struct adapter *adapter)
-{
-	if (adapter->flags & TSO_CAPABLE)
-		t1_tp_set_ip_checksum_offload(adapter, 1); /* for TSO only */
-	t1_tp_set_tcp_checksum_offload(adapter, 1);
-}
-
-/*
- * Things to do upon first use of a card.
- * This must run with the rtnl lock held.
- */
-static int cxgb_up(struct adapter *adapter)
-{
-	int err = 0;
-
-	if (!(adapter->flags & FULL_INIT_DONE)) {
-		err = t1_init_hw_modules(adapter);
-		if (err)
-			goto out_err;
-
-		enable_hw_csum(adapter);
-		adapter->flags |= FULL_INIT_DONE;
-	}
-
-	t1_interrupts_clear(adapter);
-	if ((err = request_irq(adapter->pdev->irq,
-			       t1_select_intr_handler(adapter), SA_SHIRQ,
-			       adapter->name, adapter))) {
-		goto out_err;
-	}
-	t1_sge_start(adapter->sge);
-	t1_interrupts_enable(adapter);
- out_err:
-	return err;
-}
-
-/*
- * Release resources when all the ports have been stopped.
- */
-static void cxgb_down(struct adapter *adapter)
-{
-	t1_sge_stop(adapter->sge);
-	t1_interrupts_disable(adapter);
-	free_irq(adapter->pdev->irq, adapter);
-}
-
-static int cxgb_open(struct net_device *dev)
-{
-	int err;
-	struct adapter *adapter = dev->priv;
-	int other_ports = adapter->open_device_map & PORT_MASK;
-
-	if (!adapter->open_device_map && (err = cxgb_up(adapter)) < 0)
-		return err;
-
-	__set_bit(dev->if_port, &adapter->open_device_map);
-	link_start(&adapter->port[dev->if_port]);
-	netif_start_queue(dev);
-	if (!other_ports && adapter->params.stats_update_period)
-		schedule_mac_stats_update(adapter,
-					  adapter->params.stats_update_period);
-	return 0;
-}
-
-static int cxgb_close(struct net_device *dev)
-{
-	struct adapter *adapter = dev->priv;
-	struct port_info *p = &adapter->port[dev->if_port];
-	struct cmac *mac = p->mac;
-
-	netif_stop_queue(dev);
-	mac->ops->disable(mac, MAC_DIRECTION_TX | MAC_DIRECTION_RX);
-	netif_carrier_off(dev);
-
-	clear_bit(dev->if_port, &adapter->open_device_map);
-	if (adapter->params.stats_update_period &&
-	    !(adapter->open_device_map & PORT_MASK)) {
-		/* Stop statistics accumulation. */
-		smp_mb__after_clear_bit();
-		spin_lock(&adapter->work_lock);   /* sync with update task */
-		spin_unlock(&adapter->work_lock);
-		cancel_mac_stats_update(adapter);
-	}
-
-	if (!adapter->open_device_map)
-		cxgb_down(adapter);
-	return 0;
-}
-
-static struct net_device_stats *t1_get_stats(struct net_device *dev)
-{
-	struct adapter *adapter = dev->priv;
-	struct port_info *p = &adapter->port[dev->if_port];
-	struct net_device_stats *ns = &p->netstats;
-	const struct cmac_statistics *pstats;
-
-	/* Do a full update of the MAC stats */
-	pstats = p->mac->ops->statistics_update(p->mac,
-						      MAC_STATS_UPDATE_FULL);
-
-	ns->tx_packets = pstats->TxUnicastFramesOK +
-		pstats->TxMulticastFramesOK + pstats->TxBroadcastFramesOK;
-
-	ns->rx_packets = pstats->RxUnicastFramesOK +
-		pstats->RxMulticastFramesOK + pstats->RxBroadcastFramesOK;
-
-	ns->tx_bytes = pstats->TxOctetsOK;
-	ns->rx_bytes = pstats->RxOctetsOK;
-
-	ns->tx_errors = pstats->TxLateCollisions + pstats->TxLengthErrors +
-		pstats->TxUnderrun + pstats->TxFramesAbortedDueToXSCollisions;
-	ns->rx_errors = pstats->RxDataErrors + pstats->RxJabberErrors +
-		pstats->RxFCSErrors + pstats->RxAlignErrors +
-		pstats->RxSequenceErrors + pstats->RxFrameTooLongErrors +
-		pstats->RxSymbolErrors + pstats->RxRuntErrors;
-
-	ns->multicast  = pstats->RxMulticastFramesOK;
-	ns->collisions = pstats->TxTotalCollisions;
-
-	/* detailed rx_errors */
-	ns->rx_length_errors = pstats->RxFrameTooLongErrors +
-		pstats->RxJabberErrors;
-	ns->rx_over_errors   = 0;
-	ns->rx_crc_errors    = pstats->RxFCSErrors;
-	ns->rx_frame_errors  = pstats->RxAlignErrors;
-	ns->rx_fifo_errors   = 0;
-	ns->rx_missed_errors = 0;
-
-	/* detailed tx_errors */
-	ns->tx_aborted_errors   = pstats->TxFramesAbortedDueToXSCollisions;
-	ns->tx_carrier_errors   = 0;
-	ns->tx_fifo_errors      = pstats->TxUnderrun;
-	ns->tx_heartbeat_errors = 0;
-	ns->tx_window_errors    = pstats->TxLateCollisions;
-	return ns;
-}
-
-static u32 get_msglevel(struct net_device *dev)
-{
-	struct adapter *adapter = dev->priv;
-
-	return adapter->msg_enable;
-}
-
-static void set_msglevel(struct net_device *dev, u32 val)
-{
-	struct adapter *adapter = dev->priv;
-
-	adapter->msg_enable = val;
-}
-
-static char stats_strings[][ETH_GSTRING_LEN] = {
-        "TxOctetsOK",
-        "TxOctetsBad",
-        "TxUnicastFramesOK",
-        "TxMulticastFramesOK",
-        "TxBroadcastFramesOK",
-        "TxPauseFrames",
-        "TxFramesWithDeferredXmissions",
-        "TxLateCollisions",
-        "TxTotalCollisions",
-        "TxFramesAbortedDueToXSCollisions",
-        "TxUnderrun",
-        "TxLengthErrors",
-        "TxInternalMACXmitError",
-        "TxFramesWithExcessiveDeferral",
-        "TxFCSErrors",
-
-        "RxOctetsOK",
-        "RxOctetsBad",
-        "RxUnicastFramesOK",
-        "RxMulticastFramesOK",
-        "RxBroadcastFramesOK",
-        "RxPauseFrames",
-        "RxFCSErrors",
-        "RxAlignErrors",
-        "RxSymbolErrors",
-        "RxDataErrors",
-        "RxSequenceErrors",
-        "RxRuntErrors",
-        "RxJabberErrors",
-        "RxInternalMACRcvError",
-        "RxInRangeLengthErrors",
-        "RxOutOfRangeLengthField",
-        "RxFrameTooLongErrors",
-
-	"TSO",
-	"VLANextractions",
-	"VLANinsertions",
-	"RxCsumGood",
-	"TxCsumOffload",
-	"RxDrops"
-
-	"respQ_empty",
-	"respQ_overflow",
-	"freelistQ_empty",
-	"pkt_too_big",
-	"pkt_mismatch",
-	"cmdQ_full0",
-	"cmdQ_full1",
-	"tx_ipfrags",
-	"tx_reg_pkts",
-	"tx_lso_pkts",
-	"tx_do_cksum",
-	
-	"espi_DIP2ParityErr",
-	"espi_DIP4Err",
-	"espi_RxDrops",
-	"espi_TxDrops",
-	"espi_RxOvfl",
-	"espi_ParityErr"
-};
- 
-#define T2_REGMAP_SIZE (3 * 1024)
-
-static int get_regs_len(struct net_device *dev)
-{
-	return T2_REGMAP_SIZE;
-}
-
-static void get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
-{
-	struct adapter *adapter = dev->priv;
-
-	strcpy(info->driver, DRV_NAME);
-	strcpy(info->version, DRV_VERSION);
-	strcpy(info->fw_version, "N/A");
-	strcpy(info->bus_info, pci_name(adapter->pdev));
-}
-
-static int get_stats_count(struct net_device *dev)
-{
-	return ARRAY_SIZE(stats_strings);
-}
-
-static void get_strings(struct net_device *dev, u32 stringset, u8 *data)
-{
-	if (stringset == ETH_SS_STATS)
-		memcpy(data, stats_strings, sizeof(stats_strings));
-}
-
-static void get_stats(struct net_device *dev, struct ethtool_stats *stats,
-		      u64 *data)
-{
-	struct adapter *adapter = dev->priv;
-	struct cmac *mac = adapter->port[dev->if_port].mac;
-	const struct cmac_statistics *s;
-	const struct sge_port_stats *ss;
-	const struct sge_intr_counts *t;
-
-	s = mac->ops->statistics_update(mac, MAC_STATS_UPDATE_FULL);
-	ss = t1_sge_get_port_stats(adapter->sge, dev->if_port);
-	t = t1_sge_get_intr_counts(adapter->sge);
-
-        *data++ = s->TxOctetsOK;
-        *data++ = s->TxOctetsBad;
-        *data++ = s->TxUnicastFramesOK;
-        *data++ = s->TxMulticastFramesOK;
-        *data++ = s->TxBroadcastFramesOK;
-        *data++ = s->TxPauseFrames;
-        *data++ = s->TxFramesWithDeferredXmissions;
-        *data++ = s->TxLateCollisions;
-        *data++ = s->TxTotalCollisions;
-        *data++ = s->TxFramesAbortedDueToXSCollisions;
-        *data++ = s->TxUnderrun;
-        *data++ = s->TxLengthErrors;
-        *data++ = s->TxInternalMACXmitError;
-        *data++ = s->TxFramesWithExcessiveDeferral;
-        *data++ = s->TxFCSErrors;
-
-        *data++ = s->RxOctetsOK;
-        *data++ = s->RxOctetsBad;
-        *data++ = s->RxUnicastFramesOK;
-        *data++ = s->RxMulticastFramesOK;
-        *data++ = s->RxBroadcastFramesOK;
-        *data++ = s->RxPauseFrames;
-        *data++ = s->RxFCSErrors;
-        *data++ = s->RxAlignErrors;
-        *data++ = s->RxSymbolErrors;
-        *data++ = s->RxDataErrors;
-        *data++ = s->RxSequenceErrors;
-        *data++ = s->RxRuntErrors;
-        *data++ = s->RxJabberErrors;
-        *data++ = s->RxInternalMACRcvError;
-        *data++ = s->RxInRangeLengthErrors;
-        *data++ = s->RxOutOfRangeLengthField;
-        *data++ = s->RxFrameTooLongErrors;
-
-	*data++ = ss->tso;
-	*data++ = ss->vlan_xtract;
-	*data++ = ss->vlan_insert;
-	*data++ = ss->rx_cso_good;
-	*data++ = ss->tx_cso;
-	*data++ = ss->rx_drops;
-
-	*data++ = (u64)t->respQ_empty;
-	*data++ = (u64)t->respQ_overflow;
-	*data++ = (u64)t->freelistQ_empty;
-	*data++ = (u64)t->pkt_too_big;
-	*data++ = (u64)t->pkt_mismatch;
-	*data++ = (u64)t->cmdQ_full[0];
-	*data++ = (u64)t->cmdQ_full[1];
-	*data++ = (u64)t->tx_ipfrags;
-	*data++ = (u64)t->tx_reg_pkts;
-	*data++ = (u64)t->tx_lso_pkts;
-	*data++ = (u64)t->tx_do_cksum;
-}
-
-static inline void reg_block_dump(struct adapter *ap, void *buf,
-				  unsigned int start, unsigned int end)
-{
-	u32 *p = buf + start;
-
-	for ( ; start <= end; start += sizeof(u32))
-		*p++ = readl(ap->regs + start);
-}
-
-static void get_regs(struct net_device *dev, struct ethtool_regs *regs,
-		     void *buf)
-{
-	struct adapter *ap = dev->priv;
-
-	/*
-	 * Version scheme: bits 0..9: chip version, bits 10..15: chip revision
-	 */
-	regs->version = 2;
-
-	memset(buf, 0, T2_REGMAP_SIZE);
-	reg_block_dump(ap, buf, 0, A_SG_RESPACCUTIMER);
-}
-
-static int get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
-{
-	struct adapter *adapter = dev->priv;
-	struct port_info *p = &adapter->port[dev->if_port];
-
-	cmd->supported = p->link_config.supported;
-	cmd->advertising = p->link_config.advertising;
-
-	if (netif_carrier_ok(dev)) {
-		cmd->speed = p->link_config.speed;
-		cmd->duplex = p->link_config.duplex;
-	} else {
-		cmd->speed = -1;
-		cmd->duplex = -1;
-	}
-
-        cmd->port = (cmd->supported & SUPPORTED_TP) ? PORT_TP : PORT_FIBRE;
-        cmd->phy_address = p->phy->addr;
-        cmd->transceiver = XCVR_EXTERNAL;
-        cmd->autoneg = p->link_config.autoneg;
-        cmd->maxtxpkt = 0;
-        cmd->maxrxpkt = 0;
-	return 0;
-}
-
-static int speed_duplex_to_caps(int speed, int duplex)
-{
-	int cap = 0;
-
-	switch (speed) {
-	case SPEED_10:
-		if (duplex == DUPLEX_FULL)
-			cap = SUPPORTED_10baseT_Full;
-		else
-			cap = SUPPORTED_10baseT_Half;
-		break;
-	case SPEED_100:
-		if (duplex == DUPLEX_FULL)
-			cap = SUPPORTED_100baseT_Full;
-		else
-			cap = SUPPORTED_100baseT_Half;
-		break;
-	case SPEED_1000:
-		if (duplex == DUPLEX_FULL)
-			cap = SUPPORTED_1000baseT_Full;
-		else
-			cap = SUPPORTED_1000baseT_Half;
-		break;
-	case SPEED_10000:
-		if (duplex == DUPLEX_FULL)
-			cap = SUPPORTED_10000baseT_Full;
-	}
-	return cap;
-}
-
-#define ADVERTISED_MASK (ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full | \
-		      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full | \
-		      ADVERTISED_1000baseT_Half | ADVERTISED_1000baseT_Full | \
-		      ADVERTISED_10000baseT_Full)
-
-static int set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
-{
-	struct adapter *adapter = dev->priv;
-	struct port_info *p = &adapter->port[dev->if_port];
-	struct link_config *lc = &p->link_config;
-
-	if (!(lc->supported & SUPPORTED_Autoneg))
-		return -EOPNOTSUPP;             /* can't change speed/duplex */
-
-	if (cmd->autoneg == AUTONEG_DISABLE) {
-		int cap = speed_duplex_to_caps(cmd->speed, cmd->duplex);
-
-		if (!(lc->supported & cap) || cmd->speed == SPEED_1000)
-			return -EINVAL;
-		lc->requested_speed = cmd->speed;
-		lc->requested_duplex = cmd->duplex;
-		lc->advertising = 0;
-	} else {
-		cmd->advertising &= ADVERTISED_MASK;
-		if (cmd->advertising & (cmd->advertising - 1))
-			cmd->advertising = lc->supported;
-		cmd->advertising &= lc->supported;
-		if (!cmd->advertising)
-			return -EINVAL;
-		lc->requested_speed = SPEED_INVALID;
-		lc->requested_duplex = DUPLEX_INVALID;
-		lc->advertising = cmd->advertising | ADVERTISED_Autoneg;
-	}
-	lc->autoneg = cmd->autoneg;
-	if (netif_running(dev))
-		t1_link_start(p->phy, p->mac, lc);
-	return 0;
-}
-
-static void get_pauseparam(struct net_device *dev,
-			   struct ethtool_pauseparam *epause)
-{
-	struct adapter *adapter = dev->priv;
-	struct port_info *p = &adapter->port[dev->if_port];
-
-	epause->autoneg = (p->link_config.requested_fc & PAUSE_AUTONEG) != 0;
-	epause->rx_pause = (p->link_config.fc & PAUSE_RX) != 0;
-	epause->tx_pause = (p->link_config.fc & PAUSE_TX) != 0;
-}
-
-static int set_pauseparam(struct net_device *dev,
-			  struct ethtool_pauseparam *epause)
-{
-	struct adapter *adapter = dev->priv;
-	struct port_info *p = &adapter->port[dev->if_port];
-	struct link_config *lc = &p->link_config;
-
-	if (epause->autoneg == AUTONEG_DISABLE)
-		lc->requested_fc = 0;
-	else if (lc->supported & SUPPORTED_Autoneg)
-		lc->requested_fc = PAUSE_AUTONEG;
-	else
-		return -EINVAL;
-
-	if (epause->rx_pause)
-		lc->requested_fc |= PAUSE_RX;
-	if (epause->tx_pause)
-		lc->requested_fc |= PAUSE_TX;
-	if (lc->autoneg == AUTONEG_ENABLE) {
-		if (netif_running(dev))
-			t1_link_start(p->phy, p->mac, lc);
-	} else {
-		lc->fc = lc->requested_fc & (PAUSE_RX | PAUSE_TX);
-		if (netif_running(dev))
-			p->mac->ops->set_speed_duplex_fc(p->mac, -1, -1,
-							 lc->fc);
-	}
-	return 0;
-}
-
-static u32 get_rx_csum(struct net_device *dev)
-{
-	struct adapter *adapter = dev->priv;
-
-	return (adapter->flags & RX_CSUM_ENABLED) != 0;
-}
-
-static int set_rx_csum(struct net_device *dev, u32 data)
-{
-	struct adapter *adapter = dev->priv;
-
-	if (data)
-		adapter->flags |= RX_CSUM_ENABLED;
-	else
-		adapter->flags &= ~RX_CSUM_ENABLED;
-	return 0;
-}
-
-static int set_tso(struct net_device *dev, u32 value)
-{
-	struct adapter *adapter = dev->priv;
-
-	if (!(adapter->flags & TSO_CAPABLE))
-		return value ? -EOPNOTSUPP : 0;
-	return ethtool_op_set_tso(dev, value);
-}
-
-static void get_sge_param(struct net_device *dev, struct ethtool_ringparam *e)
-{
-	struct adapter *adapter = dev->priv;
-	int jumbo_fl = t1_is_T1B(adapter) ? 1 : 0;
-
-	e->rx_max_pending = MAX_RX_BUFFERS;
-	e->rx_mini_max_pending = 0;
-	e->rx_jumbo_max_pending = MAX_RX_JUMBO_BUFFERS;
-	e->tx_max_pending = MAX_CMDQ_ENTRIES;
-
-	e->rx_pending = adapter->params.sge.freelQ_size[!jumbo_fl];
-	e->rx_mini_pending = 0;
-	e->rx_jumbo_pending = adapter->params.sge.freelQ_size[jumbo_fl];
-	e->tx_pending = adapter->params.sge.cmdQ_size[0];
-}
-
-static int set_sge_param(struct net_device *dev, struct ethtool_ringparam *e)
-{
-	struct adapter *adapter = dev->priv;
-	int jumbo_fl = t1_is_T1B(adapter) ? 1 : 0;
-
-	if (e->rx_pending > MAX_RX_BUFFERS || e->rx_mini_pending ||
-	    e->rx_jumbo_pending > MAX_RX_JUMBO_BUFFERS ||
-	    e->tx_pending > MAX_CMDQ_ENTRIES ||
-	    e->rx_pending < MIN_FL_ENTRIES ||
-	    e->rx_jumbo_pending < MIN_FL_ENTRIES ||
-	    e->tx_pending < (adapter->params.nports + 1) * (MAX_SKB_FRAGS + 1))
-		return -EINVAL;
-
-	if (adapter->flags & FULL_INIT_DONE)
-        return -EBUSY;
-
-	adapter->params.sge.freelQ_size[!jumbo_fl] = e->rx_pending;
-	adapter->params.sge.freelQ_size[jumbo_fl] = e->rx_jumbo_pending;
-	adapter->params.sge.cmdQ_size[0] = e->tx_pending;
-	adapter->params.sge.cmdQ_size[1] = e->tx_pending > MAX_CMDQ1_ENTRIES ?
-		MAX_CMDQ1_ENTRIES : e->tx_pending;
-	return 0;
-}
-
-static int set_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
-{
-	struct adapter *adapter = dev->priv;
-
-	/*
-	 * If RX coalescing is requested we use NAPI, otherwise interrupts.
-	 * This choice can be made only when all ports and the TOE are off.
-	 */
-	if (adapter->open_device_map == 0)
-		adapter->params.sge.polling = c->use_adaptive_rx_coalesce;
-
-	if (adapter->params.sge.polling) {
-		adapter->params.sge.rx_coalesce_usecs = 0;
-	} else {
-		adapter->params.sge.rx_coalesce_usecs = c->rx_coalesce_usecs;
-	}
- 	adapter->params.sge.coalesce_enable = c->use_adaptive_rx_coalesce;
-	adapter->params.sge.sample_interval_usecs = c->rate_sample_interval;
-	t1_sge_set_coalesce_params(adapter->sge, &adapter->params.sge);
-	return 0;
-}
-
-static int get_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
-{
-	struct adapter *adapter = dev->priv;
-
-	c->rx_coalesce_usecs = adapter->params.sge.rx_coalesce_usecs;
-	c->rate_sample_interval = adapter->params.sge.sample_interval_usecs;
-	c->use_adaptive_rx_coalesce = adapter->params.sge.coalesce_enable;
-	return 0;
-}
-
-static int get_eeprom_len(struct net_device *dev)
-{
-    return EEPROM_SIZE;
-}
-
-#define EEPROM_MAGIC(ap) \
-	(PCI_VENDOR_ID_CHELSIO | ((ap)->params.chip_version << 16))
-
-static int get_eeprom(struct net_device *dev, struct ethtool_eeprom *e,
-		      u8 *data)
-{
-	int i;
-	u8 buf[EEPROM_SIZE] __attribute__((aligned(4)));
-	struct adapter *adapter = dev->priv;
-
-	e->magic = EEPROM_MAGIC(adapter);
-	for (i = e->offset & ~3; i < e->offset + e->len; i += sizeof(u32))
-		t1_seeprom_read(adapter, i, (u32 *)&buf[i]);
-	memcpy(data, buf + e->offset, e->len);
-	return 0;
-}
-
-static struct ethtool_ops t1_ethtool_ops = {
-	.get_settings      = get_settings,
-	.set_settings      = set_settings,
-	.get_drvinfo       = get_drvinfo,
-	.get_msglevel      = get_msglevel,
-	.set_msglevel      = set_msglevel,
-	.get_ringparam     = get_sge_param,
-	.set_ringparam     = set_sge_param,
-	.get_coalesce      = get_coalesce,
-	.set_coalesce      = set_coalesce,
-	.get_eeprom_len    = get_eeprom_len,
-	.get_eeprom        = get_eeprom,
-	.get_pauseparam    = get_pauseparam,
-	.set_pauseparam    = set_pauseparam,
-	.get_rx_csum       = get_rx_csum,
-	.set_rx_csum       = set_rx_csum,
-	.get_tx_csum       = ethtool_op_get_tx_csum,
-	.set_tx_csum       = ethtool_op_set_tx_csum,
-	.get_sg            = ethtool_op_get_sg,
-	.set_sg            = ethtool_op_set_sg,
-	.get_link          = ethtool_op_get_link,
-	.get_strings       = get_strings,
-	.get_stats_count   = get_stats_count,
-	.get_ethtool_stats = get_stats,
-	.get_regs_len      = get_regs_len,
-	.get_regs          = get_regs,
-	.get_tso           = ethtool_op_get_tso,
-	.set_tso           = set_tso,
-};
-
-static void cxgb_proc_cleanup(struct adapter *adapter,
-					struct proc_dir_entry *dir)
-{
-	const char *name;
-	name = adapter->name;
-	remove_proc_entry(name, dir);
-}
-//#define chtoe_setup_toedev(adapter) NULL
-#define update_mtu_tab(adapter)
-#define write_smt_entry(adapter, idx)
-
-static int t1_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
-{
-        struct adapter *adapter = dev->priv;
-        struct mii_ioctl_data *data = (struct mii_ioctl_data *)&req->ifr_data;
-
-	switch (cmd) {
-        case SIOCGMIIPHY:
-                data->phy_id = adapter->port[dev->if_port].phy->addr;
-                /* FALLTHRU */
-        case SIOCGMIIREG: {
-		struct cphy *phy = adapter->port[dev->if_port].phy;
-		u32 val;
-
-		if (!phy->mdio_read)
-            return -EOPNOTSUPP;
-		phy->mdio_read(adapter, data->phy_id, 0, data->reg_num & 0x1f,
-			       &val);
-                data->val_out = val;
-                break;
-	}
-        case SIOCSMIIREG: {
-		struct cphy *phy = adapter->port[dev->if_port].phy;
-
-                if (!capable(CAP_NET_ADMIN))
-                    return -EPERM;
-		if (!phy->mdio_write)
-            return -EOPNOTSUPP;
-		phy->mdio_write(adapter, data->phy_id, 0, data->reg_num & 0x1f,
-			        data->val_in);
-                break;
-	}
-
-	default:
-		return -EOPNOTSUPP;
-	}
-	return 0;
-}
-
-static int t1_change_mtu(struct net_device *dev, int new_mtu)
-{
-	int ret;
-	struct adapter *adapter = dev->priv;
-	struct cmac *mac = adapter->port[dev->if_port].mac;
-
-	if (!mac->ops->set_mtu)
-        return -EOPNOTSUPP;
-	if (new_mtu < 68)
-        return -EINVAL;
-	if ((ret = mac->ops->set_mtu(mac, new_mtu)))
-		return ret;
-	dev->mtu = new_mtu;
-	return 0;
-}
-
-static int t1_set_mac_addr(struct net_device *dev, void *p)
-{
-	struct adapter *adapter = dev->priv;
-	struct cmac *mac = adapter->port[dev->if_port].mac;
-	struct sockaddr *addr = p;
-
-	if (!mac->ops->macaddress_set)
-		return -EOPNOTSUPP;
-
-	memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-	mac->ops->macaddress_set(mac, dev->dev_addr);
-	return 0;
-}
-
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-static void vlan_rx_register(struct net_device *dev,
-				   struct vlan_group *grp)
-{
-	struct adapter *adapter = dev->priv;
-
-	spin_lock_irq(&adapter->async_lock);
-	adapter->vlan_grp = grp;
-	t1_set_vlan_accel(adapter, grp != NULL);
-	spin_unlock_irq(&adapter->async_lock);
-}
-
-static void vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-	struct adapter *adapter = dev->priv;
-
-	spin_lock_irq(&adapter->async_lock);
-	if (adapter->vlan_grp)
-		adapter->vlan_grp->vlan_devices[vid] = NULL;
-	spin_unlock_irq(&adapter->async_lock);
-}
-#endif
-
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void t1_netpoll(struct net_device *dev)
-{
-	unsigned long flags;
-	struct adapter *adapter = dev->priv;
-
-	local_irq_save(flags);
-        t1_select_intr_handler(adapter)(adapter->pdev->irq, adapter, NULL);
-	local_irq_restore(flags);
-}
-#endif
-
-/*
- * Periodic accumulation of MAC statistics.  This is used only if the MAC
- * does not have any other way to prevent stats counter overflow.
- */
-static void mac_stats_task(void *data)
-{
-	int i;
-	struct adapter *adapter = data;
-
-	for_each_port(adapter, i) {
-		struct port_info *p = &adapter->port[i];
-
-		if (netif_running(p->dev))
-			p->mac->ops->statistics_update(p->mac,
-						       MAC_STATS_UPDATE_FAST);
-	}
-
-	/* Schedule the next statistics update if any port is active. */
-	spin_lock(&adapter->work_lock);
-	if (adapter->open_device_map & PORT_MASK)
-		schedule_mac_stats_update(adapter,
-					  adapter->params.stats_update_period);
-	spin_unlock(&adapter->work_lock);
-}
-
-/*
- * Processes elmer0 external interrupts in process context.
- */
-static void ext_intr_task(void *data)
-{
-	struct adapter *adapter = data;
-
-	elmer0_ext_intr_handler(adapter);
-
-	/* Now reenable external interrupts */
-	spin_lock_irq(&adapter->async_lock);
-	adapter->slow_intr_mask |= F_PL_INTR_EXT;
-	writel(F_PL_INTR_EXT, adapter->regs + A_PL_CAUSE);
-	writel(adapter->slow_intr_mask | F_PL_INTR_SGE_DATA,
-                   adapter->regs + A_PL_ENABLE);
-	spin_unlock_irq(&adapter->async_lock);
-}
-
-/*
- * Interrupt-context handler for elmer0 external interrupts.
- */
-void t1_elmer0_ext_intr(struct adapter *adapter)
-{
-	/*
-	 * Schedule a task to handle external interrupts as we require
-	 * a process context.  We disable EXT interrupts in the interim
-	 * and let the task reenable them when it's done.
-	 */
-	adapter->slow_intr_mask &= ~F_PL_INTR_EXT;
-	writel(adapter->slow_intr_mask | F_PL_INTR_SGE_DATA,
-                   adapter->regs + A_PL_ENABLE);
-	schedule_work(&adapter->ext_intr_handler_task);
-}
-
-void t1_fatal_err(struct adapter *adapter)
-{
-	if (adapter->flags & FULL_INIT_DONE) {
-		t1_sge_stop(adapter->sge);
-		t1_interrupts_disable(adapter);
-	}
-	CH_ALERT("%s: encountered fatal error, operation suspended\n",
-		 adapter->name);
-}
-
-static int __devinit init_one(struct pci_dev *pdev,
-			      const struct pci_device_id *ent)
-{
-	static int version_printed;
-
-	int i, err, pci_using_dac = 0;
-	unsigned long mmio_start, mmio_len;
-	const struct board_info *bi;
-	struct adapter *adapter = NULL;
-	struct port_info *pi;
-
-	if (!version_printed) {
-		printk(KERN_INFO "%s - version %s\n", DRV_DESCRIPTION,
-		       DRV_VERSION);
-		++version_printed;
-	}
-
-	err = pci_enable_device(pdev);
-	if (err)
-        return err;
-
-	if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
-		CH_ERR("%s: cannot find PCI device memory base address\n",
-		       pci_name(pdev));
-		err = -ENODEV;
-		goto out_disable_pdev;
-	}
-
-	if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK)) {
-		pci_using_dac = 1;
-
-		if (pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK)) {
-			CH_ERR("%s: unable to obtain 64-bit DMA for"
-			       "consistent allocations\n", pci_name(pdev));
-			err = -ENODEV;
-			goto out_disable_pdev;
-		}
-
-	} else if ((err = pci_set_dma_mask(pdev, DMA_32BIT_MASK)) != 0) {
-		CH_ERR("%s: no usable DMA configuration\n", pci_name(pdev));
-		goto out_disable_pdev;
-	}
-
-	err = pci_request_regions(pdev, DRV_NAME);
-	if (err) {
-		CH_ERR("%s: cannot obtain PCI resources\n", pci_name(pdev));
-		goto out_disable_pdev;
-	}
-
-	pci_set_master(pdev);
-
-    mmio_start = pci_resource_start(pdev, 0);
-	mmio_len = pci_resource_len(pdev, 0);
-	bi = t1_get_board_info(ent->driver_data);
-
-	for (i = 0; i < bi->port_number; ++i) {
-		struct net_device *netdev;
-
-		netdev = alloc_etherdev(adapter ? 0 : sizeof(*adapter));
-		if (!netdev) {
-			err = -ENOMEM;
-			goto out_free_dev;
-		}
-
-		SET_MODULE_OWNER(netdev);
-		SET_NETDEV_DEV(netdev, &pdev->dev);
-
-		if (!adapter) {
-			adapter = netdev->priv;
-			adapter->pdev = pdev;
-			adapter->port[0].dev = netdev;  /* so we don't leak it */
-
-			adapter->regs = ioremap(mmio_start, mmio_len);
-			if (!adapter->regs) {
-				CH_ERR("%s: cannot map device registers\n",
-				       pci_name(pdev));
-				err = -ENOMEM;
-				goto out_free_dev;
-			}
-
-			if (t1_get_board_rev(adapter, bi, &adapter->params)) {
-				err = -ENODEV;	  /* Can't handle this chip rev */
-				goto out_free_dev;
-			}
-
-			adapter->name = pci_name(pdev);
-			adapter->msg_enable = dflt_msg_enable;
-			adapter->mmio_len = mmio_len;
-
-			init_MUTEX(&adapter->mib_mutex);
-			spin_lock_init(&adapter->tpi_lock);
-			spin_lock_init(&adapter->work_lock);
-			spin_lock_init(&adapter->async_lock);
-
-			INIT_WORK(&adapter->ext_intr_handler_task,
-				  ext_intr_task, adapter);
-			INIT_WORK(&adapter->stats_update_task, mac_stats_task,
-				  adapter);
-#ifdef work_struct
-			init_timer(&adapter->stats_update_timer);
-			adapter->stats_update_timer.function = mac_stats_timer;
-			adapter->stats_update_timer.data =
-				(unsigned long)adapter;
-#endif
-
-			pci_set_drvdata(pdev, netdev);
-		}
-
-		pi = &adapter->port[i];
-		pi->dev = netdev;
-		netif_carrier_off(netdev);
-		netdev->irq = pdev->irq;
-		netdev->if_port = i;
-		netdev->mem_start = mmio_start;
-		netdev->mem_end = mmio_start + mmio_len - 1;
-		netdev->priv = adapter;
-		netdev->features |= NETIF_F_SG | NETIF_F_IP_CSUM;
-		netdev->features |= NETIF_F_LLTX;
-
-		adapter->flags |= RX_CSUM_ENABLED | TCP_CSUM_CAPABLE;
-		if (pci_using_dac)
-			netdev->features |= NETIF_F_HIGHDMA;
-		if (vlan_tso_capable(adapter)) {
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-			adapter->flags |= VLAN_ACCEL_CAPABLE;
-			netdev->features |=
-				NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-			netdev->vlan_rx_register = vlan_rx_register;
-			netdev->vlan_rx_kill_vid = vlan_rx_kill_vid;
-#endif
-			adapter->flags |= TSO_CAPABLE;
-			netdev->features |= NETIF_F_TSO;
-		}
-
-		netdev->open = cxgb_open;
-		netdev->stop = cxgb_close;
-		netdev->hard_start_xmit = t1_start_xmit;
-		netdev->hard_header_len += (adapter->flags & TSO_CAPABLE) ?
-			sizeof(struct cpl_tx_pkt_lso) :
-			sizeof(struct cpl_tx_pkt);
-		netdev->get_stats = t1_get_stats;
-		netdev->set_multicast_list = t1_set_rxmode;
-		netdev->do_ioctl = t1_ioctl;
-		netdev->change_mtu = t1_change_mtu;
-		netdev->set_mac_address = t1_set_mac_addr;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-		netdev->poll_controller = t1_netpoll;
-#endif
-		netdev->weight = 64;
-
-        SET_ETHTOOL_OPS(netdev, &t1_ethtool_ops);
-	}
-
-	if (t1_init_sw_modules(adapter, bi) < 0) {
-		err = -ENODEV;
-		goto out_free_dev;
-	}
-
-	/*
-	 * The card is now ready to go.  If any errors occur during device
-	 * registration we do not fail the whole card but rather proceed only
-	 * with the ports we manage to register successfully.  However we must
-	 * register at least one net device.
-	 */
-	for (i = 0; i < bi->port_number; ++i) {
-		err = register_netdev(adapter->port[i].dev);
-		if (err)
-			CH_WARN("%s: cannot register net device %s, skipping\n",
-				pci_name(pdev), adapter->port[i].dev->name);
-		else {
-			/*
-			 * Change the name we use for messages to the name of
-			 * the first successfully registered interface.
-			 */
-			if (!adapter->registered_device_map)
-				adapter->name = adapter->port[i].dev->name;
-
-                __set_bit(i, &adapter->registered_device_map);
-		}
-	}
-	if (!adapter->registered_device_map) {
-		CH_ERR("%s: could not register any net devices\n",
-		       pci_name(pdev));
-		goto out_release_adapter_res;
-	}
-
-	printk(KERN_INFO "%s: %s (rev %d), %s %dMHz/%d-bit\n", adapter->name,
-	       bi->desc, adapter->params.chip_revision,
-	       adapter->params.pci.is_pcix ? "PCIX" : "PCI",
-	       adapter->params.pci.speed, adapter->params.pci.width);
-	return 0;
-
- out_release_adapter_res:
-	t1_free_sw_modules(adapter);
- out_free_dev:
-	if (adapter) {
-		if (adapter->regs) iounmap(adapter->regs);
-		for (i = bi->port_number - 1; i >= 0; --i)
-			if (adapter->port[i].dev) {
-				cxgb_proc_cleanup(adapter, proc_root_driver);
-				kfree(adapter->port[i].dev);
-			}
-	}
-	pci_release_regions(pdev);
- out_disable_pdev:
-	pci_disable_device(pdev);
-	pci_set_drvdata(pdev, NULL);
-	return err;
-}
-
-static inline void t1_sw_reset(struct pci_dev *pdev)
-{
-	pci_write_config_dword(pdev, A_PCICFG_PM_CSR, 3);
-	pci_write_config_dword(pdev, A_PCICFG_PM_CSR, 0);
-}
-
-static void __devexit remove_one(struct pci_dev *pdev)
-{
-	struct net_device *dev = pci_get_drvdata(pdev);
-
-	if (dev) {
-		int i;
-		struct adapter *adapter = dev->priv;
-
-		for_each_port(adapter, i)
-			if (test_bit(i, &adapter->registered_device_map))
-				unregister_netdev(adapter->port[i].dev);
-
-		t1_free_sw_modules(adapter);
-		iounmap(adapter->regs);
-		while (--i >= 0)
-			if (adapter->port[i].dev) {
-				cxgb_proc_cleanup(adapter, proc_root_driver);
-				kfree(adapter->port[i].dev);
-			}
-		pci_release_regions(pdev);
-		pci_disable_device(pdev);
-		pci_set_drvdata(pdev, NULL);
-		t1_sw_reset(pdev);
-	}
-}
-
-static struct pci_driver driver = {
-	.name     = DRV_NAME,
-	.id_table = t1_pci_tbl,
-	.probe    = init_one,
-	.remove   = __devexit_p(remove_one),
-};
-
-static int __init t1_init_module(void)
-{
-	return pci_module_init(&driver);
-}
-
-static void __exit t1_cleanup_module(void)
-{
-	pci_unregister_driver(&driver);
-}
-
-module_init(t1_init_module);
-module_exit(t1_cleanup_module);
diff --git a/trunk/drivers/net/chelsio/elmer0.h b/trunk/drivers/net/chelsio/elmer0.h
deleted file mode 100644
index 5590cb2dac19..000000000000
--- a/trunk/drivers/net/chelsio/elmer0.h
+++ /dev/null
@@ -1,151 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: elmer0.h                                                            *
- * $Revision: 1.6 $                                                          *
- * $Date: 2005/06/21 22:49:43 $                                              *
- * Description:                                                              *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#ifndef _CXGB_ELMER0_H_
-#define _CXGB_ELMER0_H_
-
-/* ELMER0 registers */
-#define A_ELMER0_VERSION 0x100000
-#define A_ELMER0_PHY_CFG 0x100004
-#define A_ELMER0_INT_ENABLE 0x100008
-#define A_ELMER0_INT_CAUSE 0x10000c
-#define A_ELMER0_GPI_CFG 0x100010
-#define A_ELMER0_GPI_STAT 0x100014
-#define A_ELMER0_GPO 0x100018
-#define A_ELMER0_PORT0_MI1_CFG 0x400000
-
-#define S_MI1_MDI_ENABLE    0
-#define V_MI1_MDI_ENABLE(x) ((x) << S_MI1_MDI_ENABLE)
-#define F_MI1_MDI_ENABLE    V_MI1_MDI_ENABLE(1U)
-
-#define S_MI1_MDI_INVERT    1
-#define V_MI1_MDI_INVERT(x) ((x) << S_MI1_MDI_INVERT)
-#define F_MI1_MDI_INVERT    V_MI1_MDI_INVERT(1U)
-
-#define S_MI1_PREAMBLE_ENABLE    2
-#define V_MI1_PREAMBLE_ENABLE(x) ((x) << S_MI1_PREAMBLE_ENABLE)
-#define F_MI1_PREAMBLE_ENABLE    V_MI1_PREAMBLE_ENABLE(1U)
-
-#define S_MI1_SOF    3
-#define M_MI1_SOF    0x3
-#define V_MI1_SOF(x) ((x) << S_MI1_SOF)
-#define G_MI1_SOF(x) (((x) >> S_MI1_SOF) & M_MI1_SOF)
-
-#define S_MI1_CLK_DIV    5
-#define M_MI1_CLK_DIV    0xff
-#define V_MI1_CLK_DIV(x) ((x) << S_MI1_CLK_DIV)
-#define G_MI1_CLK_DIV(x) (((x) >> S_MI1_CLK_DIV) & M_MI1_CLK_DIV)
-
-#define A_ELMER0_PORT0_MI1_ADDR 0x400004
-
-#define S_MI1_REG_ADDR    0
-#define M_MI1_REG_ADDR    0x1f
-#define V_MI1_REG_ADDR(x) ((x) << S_MI1_REG_ADDR)
-#define G_MI1_REG_ADDR(x) (((x) >> S_MI1_REG_ADDR) & M_MI1_REG_ADDR)
-
-#define S_MI1_PHY_ADDR    5
-#define M_MI1_PHY_ADDR    0x1f
-#define V_MI1_PHY_ADDR(x) ((x) << S_MI1_PHY_ADDR)
-#define G_MI1_PHY_ADDR(x) (((x) >> S_MI1_PHY_ADDR) & M_MI1_PHY_ADDR)
-
-#define A_ELMER0_PORT0_MI1_DATA 0x400008
-
-#define S_MI1_DATA    0
-#define M_MI1_DATA    0xffff
-#define V_MI1_DATA(x) ((x) << S_MI1_DATA)
-#define G_MI1_DATA(x) (((x) >> S_MI1_DATA) & M_MI1_DATA)
-
-#define A_ELMER0_PORT0_MI1_OP 0x40000c
-
-#define S_MI1_OP    0
-#define M_MI1_OP    0x3
-#define V_MI1_OP(x) ((x) << S_MI1_OP)
-#define G_MI1_OP(x) (((x) >> S_MI1_OP) & M_MI1_OP)
-
-#define S_MI1_ADDR_AUTOINC    2
-#define V_MI1_ADDR_AUTOINC(x) ((x) << S_MI1_ADDR_AUTOINC)
-#define F_MI1_ADDR_AUTOINC    V_MI1_ADDR_AUTOINC(1U)
-
-#define S_MI1_OP_BUSY    31
-#define V_MI1_OP_BUSY(x) ((x) << S_MI1_OP_BUSY)
-#define F_MI1_OP_BUSY    V_MI1_OP_BUSY(1U)
-
-#define A_ELMER0_PORT1_MI1_CFG 0x500000
-#define A_ELMER0_PORT1_MI1_ADDR 0x500004
-#define A_ELMER0_PORT1_MI1_DATA 0x500008
-#define A_ELMER0_PORT1_MI1_OP 0x50000c
-#define A_ELMER0_PORT2_MI1_CFG 0x600000
-#define A_ELMER0_PORT2_MI1_ADDR 0x600004
-#define A_ELMER0_PORT2_MI1_DATA 0x600008
-#define A_ELMER0_PORT2_MI1_OP 0x60000c
-#define A_ELMER0_PORT3_MI1_CFG 0x700000
-#define A_ELMER0_PORT3_MI1_ADDR 0x700004
-#define A_ELMER0_PORT3_MI1_DATA 0x700008
-#define A_ELMER0_PORT3_MI1_OP 0x70000c
-
-/* Simple bit definition for GPI and GP0 registers. */
-#define     ELMER0_GP_BIT0              0x0001
-#define     ELMER0_GP_BIT1              0x0002
-#define     ELMER0_GP_BIT2              0x0004
-#define     ELMER0_GP_BIT3              0x0008
-#define     ELMER0_GP_BIT4              0x0010
-#define     ELMER0_GP_BIT5              0x0020
-#define     ELMER0_GP_BIT6              0x0040
-#define     ELMER0_GP_BIT7              0x0080
-#define     ELMER0_GP_BIT8              0x0100
-#define     ELMER0_GP_BIT9              0x0200
-#define     ELMER0_GP_BIT10             0x0400
-#define     ELMER0_GP_BIT11             0x0800
-#define     ELMER0_GP_BIT12             0x1000
-#define     ELMER0_GP_BIT13             0x2000
-#define     ELMER0_GP_BIT14             0x4000
-#define     ELMER0_GP_BIT15             0x8000
-#define     ELMER0_GP_BIT16             0x10000
-#define     ELMER0_GP_BIT17             0x20000
-#define     ELMER0_GP_BIT18             0x40000
-#define     ELMER0_GP_BIT19             0x80000
-
-#define MI1_OP_DIRECT_WRITE 1
-#define MI1_OP_DIRECT_READ  2
-
-#define MI1_OP_INDIRECT_ADDRESS  0
-#define MI1_OP_INDIRECT_WRITE    1
-#define MI1_OP_INDIRECT_READ_INC 2
-#define MI1_OP_INDIRECT_READ     3
-
-#endif /* _CXGB_ELMER0_H_ */
diff --git a/trunk/drivers/net/chelsio/espi.c b/trunk/drivers/net/chelsio/espi.c
deleted file mode 100644
index 230642571c92..000000000000
--- a/trunk/drivers/net/chelsio/espi.c
+++ /dev/null
@@ -1,346 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: espi.c                                                              *
- * $Revision: 1.14 $                                                         *
- * $Date: 2005/05/14 00:59:32 $                                              *
- * Description:                                                              *
- *  Ethernet SPI functionality.                                              *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#include "common.h"
-#include "regs.h"
-#include "espi.h"
-
-struct peespi {
-	adapter_t *adapter;
-	struct espi_intr_counts intr_cnt;
-	u32 misc_ctrl;
-	spinlock_t lock;
-};
-
-#define ESPI_INTR_MASK (F_DIP4ERR | F_RXDROP | F_TXDROP | F_RXOVERFLOW | \
-			F_RAMPARITYERR | F_DIP2PARITYERR)
-#define MON_MASK  (V_MONITORED_PORT_NUM(3) | F_MONITORED_DIRECTION \
-		   | F_MONITORED_INTERFACE)
-
-#define TRICN_CNFG 14
-#define TRICN_CMD_READ  0x11
-#define TRICN_CMD_WRITE 0x21
-#define TRICN_CMD_ATTEMPTS 10
-
-static int tricn_write(adapter_t *adapter, int bundle_addr, int module_addr,
-		       int ch_addr, int reg_offset, u32 wr_data)
-{
-	int busy, attempts = TRICN_CMD_ATTEMPTS;
-
-	writel(V_WRITE_DATA(wr_data) |
-	       V_REGISTER_OFFSET(reg_offset) |
-	       V_CHANNEL_ADDR(ch_addr) | V_MODULE_ADDR(module_addr) |
-	       V_BUNDLE_ADDR(bundle_addr) |
-	       V_SPI4_COMMAND(TRICN_CMD_WRITE),
-	       adapter->regs + A_ESPI_CMD_ADDR);
-	writel(0, adapter->regs + A_ESPI_GOSTAT);
-
-	do {
-		busy = readl(adapter->regs + A_ESPI_GOSTAT) & F_ESPI_CMD_BUSY;
-	} while (busy && --attempts);
-
-	if (busy)
-		CH_ERR("%s: TRICN write timed out\n", adapter->name);
-
-	return busy;
-}
-
-/* 1. Deassert rx_reset_core. */
-/* 2. Program TRICN_CNFG registers. */
-/* 3. Deassert rx_reset_link */
-static int tricn_init(adapter_t *adapter)
-{
-	int     i               = 0;
-	int     sme             = 1;
-	int     stat            = 0;
-	int     timeout         = 0;
-	int     is_ready        = 0;
-	int     dynamic_deskew  = 0;
-
-	if (dynamic_deskew)
-		sme = 0;
-
-
-	/* 1 */
-	timeout=1000;
-	do {
-		stat = readl(adapter->regs + A_ESPI_RX_RESET);
-		is_ready = (stat & 0x4);
-		timeout--;
-		udelay(5);
-	} while (!is_ready || (timeout==0));
-	writel(0x2, adapter->regs + A_ESPI_RX_RESET);
-	if (timeout==0)
-	{
-		CH_ERR("ESPI : ERROR : Timeout tricn_init() \n");
-		t1_fatal_err(adapter);
-	}
-
-	/* 2 */
-	if (sme) {
-		tricn_write(adapter, 0, 0, 0, TRICN_CNFG, 0x81);
-		tricn_write(adapter, 0, 1, 0, TRICN_CNFG, 0x81);
-		tricn_write(adapter, 0, 2, 0, TRICN_CNFG, 0x81);
-	}
-	for (i=1; i<= 8; i++) tricn_write(adapter, 0, 0, i, TRICN_CNFG, 0xf1);
-	for (i=1; i<= 2; i++) tricn_write(adapter, 0, 1, i, TRICN_CNFG, 0xf1);
-	for (i=1; i<= 3; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xe1);
-	for (i=4; i<= 4; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xf1);
-	for (i=5; i<= 5; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xe1);
-	for (i=6; i<= 6; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xf1);
-	for (i=7; i<= 7; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0x80);
-	for (i=8; i<= 8; i++) tricn_write(adapter, 0, 2, i, TRICN_CNFG, 0xf1);
-
-	/* 3 */
-	writel(0x3, adapter->regs + A_ESPI_RX_RESET);
-
-	return 0;
-}
-
-void t1_espi_intr_enable(struct peespi *espi)
-{
-	u32 enable, pl_intr = readl(espi->adapter->regs + A_PL_ENABLE);
-
-	/*
-	 * Cannot enable ESPI interrupts on T1B because HW asserts the
-	 * interrupt incorrectly, namely the driver gets ESPI interrupts
-	 * but no data is actually dropped (can verify this reading the ESPI
-	 * drop registers).  Also, once the ESPI interrupt is asserted it
-	 * cannot be cleared (HW bug).
-	 */
-	enable = t1_is_T1B(espi->adapter) ? 0 : ESPI_INTR_MASK;
-	writel(enable, espi->adapter->regs + A_ESPI_INTR_ENABLE);
-	writel(pl_intr | F_PL_INTR_ESPI, espi->adapter->regs + A_PL_ENABLE);
-}
-
-void t1_espi_intr_clear(struct peespi *espi)
-{
-	writel(0xffffffff, espi->adapter->regs + A_ESPI_INTR_STATUS);
-	writel(F_PL_INTR_ESPI, espi->adapter->regs + A_PL_CAUSE);
-}
-
-void t1_espi_intr_disable(struct peespi *espi)
-{
-	u32 pl_intr = readl(espi->adapter->regs + A_PL_ENABLE);
-
-	writel(0, espi->adapter->regs + A_ESPI_INTR_ENABLE);
-	writel(pl_intr & ~F_PL_INTR_ESPI, espi->adapter->regs + A_PL_ENABLE);
-}
-
-int t1_espi_intr_handler(struct peespi *espi)
-{
-	u32 cnt;
-	u32 status = readl(espi->adapter->regs + A_ESPI_INTR_STATUS);
-
-	if (status & F_DIP4ERR)
-		espi->intr_cnt.DIP4_err++;
-	if (status & F_RXDROP)
-		espi->intr_cnt.rx_drops++;
-	if (status & F_TXDROP)
-		espi->intr_cnt.tx_drops++;
-	if (status & F_RXOVERFLOW)
-		espi->intr_cnt.rx_ovflw++;
-	if (status & F_RAMPARITYERR)
-		espi->intr_cnt.parity_err++;
-	if (status & F_DIP2PARITYERR) {
-		espi->intr_cnt.DIP2_parity_err++;
-
-		/*
-		 * Must read the error count to clear the interrupt
-		 * that it causes.
-		 */
-		cnt = readl(espi->adapter->regs + A_ESPI_DIP2_ERR_COUNT);
-	}
-
-	/*
-	 * For T1B we need to write 1 to clear ESPI interrupts.  For T2+ we
-	 * write the status as is.
-	 */
-	if (status && t1_is_T1B(espi->adapter))
-		status = 1;
-	writel(status, espi->adapter->regs + A_ESPI_INTR_STATUS);
-	return 0;
-}
-
-const struct espi_intr_counts *t1_espi_get_intr_counts(struct peespi *espi)
-{
-    return &espi->intr_cnt;
-}
-
-static void espi_setup_for_pm3393(adapter_t *adapter)
-{
-	u32 wmark = t1_is_T1B(adapter) ? 0x4000 : 0x3200;
-
-	writel(0x1f4, adapter->regs + A_ESPI_SCH_TOKEN0);
-	writel(0x1f4, adapter->regs + A_ESPI_SCH_TOKEN1);
-	writel(0x1f4, adapter->regs + A_ESPI_SCH_TOKEN2);
-	writel(0x1f4, adapter->regs + A_ESPI_SCH_TOKEN3);
-	writel(0x100, adapter->regs + A_ESPI_RX_FIFO_ALMOST_EMPTY_WATERMARK);
-	writel(wmark, adapter->regs + A_ESPI_RX_FIFO_ALMOST_FULL_WATERMARK);
-	writel(3, adapter->regs + A_ESPI_CALENDAR_LENGTH);
-	writel(0x08000008, adapter->regs + A_ESPI_TRAIN);
-	writel(V_RX_NPORTS(1) | V_TX_NPORTS(1), adapter->regs + A_PORT_CONFIG);
-}
-
-/* T2 Init part --  */
-/* 1. Set T_ESPI_MISCCTRL_ADDR */
-/* 2. Init ESPI registers. */
-/* 3. Init TriCN Hard Macro */
-int t1_espi_init(struct peespi *espi, int mac_type, int nports)
-{
-	u32 cnt;
-
-	u32 status_enable_extra = 0;
-	adapter_t *adapter = espi->adapter;
-	u32 status, burstval = 0x800100;
-
-	/* Disable ESPI training.  MACs that can handle it enable it below. */
-	writel(0, adapter->regs + A_ESPI_TRAIN);
-
-	if (is_T2(adapter)) {
-		writel(V_OUT_OF_SYNC_COUNT(4) |
-		       V_DIP2_PARITY_ERR_THRES(3) |
-		       V_DIP4_THRES(1), adapter->regs + A_ESPI_MISC_CONTROL);
-		if (nports == 4) {
-			/* T204: maxburst1 = 0x40, maxburst2 = 0x20 */
-			burstval = 0x200040;
-		}
-	}
-	writel(burstval, adapter->regs + A_ESPI_MAXBURST1_MAXBURST2);
-
-	switch (mac_type) {
-	case CHBT_MAC_PM3393:
-		espi_setup_for_pm3393(adapter);
-		break;
-	default:
-		return -1;
-	}
-
-	/*
-	 * Make sure any pending interrupts from the SPI are
-	 * Cleared before enabling the interrupt.
-	 */
-	writel(ESPI_INTR_MASK, espi->adapter->regs + A_ESPI_INTR_ENABLE);
-	status = readl(espi->adapter->regs + A_ESPI_INTR_STATUS);
-	if (status & F_DIP2PARITYERR) {
-		cnt = readl(espi->adapter->regs + A_ESPI_DIP2_ERR_COUNT);
-	}
-
-	/*
-	 * For T1B we need to write 1 to clear ESPI interrupts.  For T2+ we
-	 * write the status as is.
-	 */
-	if (status && t1_is_T1B(espi->adapter))
-		status = 1;
-	writel(status, espi->adapter->regs + A_ESPI_INTR_STATUS);
-
-	writel(status_enable_extra | F_RXSTATUSENABLE,
-	       adapter->regs + A_ESPI_FIFO_STATUS_ENABLE);
-
-	if (is_T2(adapter)) {
-		tricn_init(adapter);
-		/*
-		 * Always position the control at the 1st port egress IN
-		 * (sop,eop) counter to reduce PIOs for T/N210 workaround.
-		 */
-		espi->misc_ctrl = (readl(adapter->regs + A_ESPI_MISC_CONTROL)
-				   & ~MON_MASK) | (F_MONITORED_DIRECTION
-				   | F_MONITORED_INTERFACE);
-		writel(espi->misc_ctrl, adapter->regs + A_ESPI_MISC_CONTROL);
-		spin_lock_init(&espi->lock);
-	}
-
-	return 0;
-}
-
-void t1_espi_destroy(struct peespi *espi)
-{
-	kfree(espi);
-}
-
-struct peespi *t1_espi_create(adapter_t *adapter)
-{
-	struct peespi *espi = kmalloc(sizeof(*espi), GFP_KERNEL);
-
-	memset(espi, 0, sizeof(*espi));
-
-	if (espi)
-		espi->adapter = adapter;
-	return espi;
-}
-
-void t1_espi_set_misc_ctrl(adapter_t *adapter, u32 val)
-{
-	struct peespi *espi = adapter->espi;
-
-	if (!is_T2(adapter))
-		return;
-	spin_lock(&espi->lock);
-	espi->misc_ctrl = (val & ~MON_MASK) |
-			  (espi->misc_ctrl & MON_MASK);
-	writel(espi->misc_ctrl, adapter->regs + A_ESPI_MISC_CONTROL);
-	spin_unlock(&espi->lock);
-}
-
-u32 t1_espi_get_mon(adapter_t *adapter, u32 addr, u8 wait)
-{
-	u32 sel;
-
-	struct peespi *espi = adapter->espi;
-
-	if (!is_T2(adapter))
-		return 0;
-	sel = V_MONITORED_PORT_NUM((addr & 0x3c) >> 2);
-	if (!wait) {
-		if (!spin_trylock(&espi->lock))
-			return 0;
-	}
-	else
-		spin_lock(&espi->lock);
-	if ((sel != (espi->misc_ctrl & MON_MASK))) {
-		writel(((espi->misc_ctrl & ~MON_MASK) | sel),
-		       adapter->regs + A_ESPI_MISC_CONTROL);
-		sel = readl(adapter->regs + A_ESPI_SCH_TOKEN3);
-		writel(espi->misc_ctrl, adapter->regs + A_ESPI_MISC_CONTROL);
-	}
-	else
-		sel = readl(adapter->regs + A_ESPI_SCH_TOKEN3);
-	spin_unlock(&espi->lock);
-	return sel;
-}
diff --git a/trunk/drivers/net/chelsio/espi.h b/trunk/drivers/net/chelsio/espi.h
deleted file mode 100644
index c90e37f8457c..000000000000
--- a/trunk/drivers/net/chelsio/espi.h
+++ /dev/null
@@ -1,68 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: espi.h                                                              *
- * $Revision: 1.7 $                                                          *
- * $Date: 2005/06/21 18:29:47 $                                              *
- * Description:                                                              *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#ifndef _CXGB_ESPI_H_
-#define _CXGB_ESPI_H_
-
-#include "common.h"
-
-struct espi_intr_counts {
-	unsigned int DIP4_err;
-	unsigned int rx_drops;
-	unsigned int tx_drops;
-	unsigned int rx_ovflw;
-	unsigned int parity_err;
-	unsigned int DIP2_parity_err;
-};
-
-struct peespi;
-
-struct peespi *t1_espi_create(adapter_t *adapter);
-void t1_espi_destroy(struct peespi *espi);
-int t1_espi_init(struct peespi *espi, int mac_type, int nports);
-
-void t1_espi_intr_enable(struct peespi *);
-void t1_espi_intr_clear(struct peespi *);
-void t1_espi_intr_disable(struct peespi *);
-int t1_espi_intr_handler(struct peespi *);
-const struct espi_intr_counts *t1_espi_get_intr_counts(struct peespi *espi);
-
-void t1_espi_set_misc_ctrl(adapter_t *adapter, u32 val);
-u32 t1_espi_get_mon(adapter_t *adapter, u32 addr, u8 wait);
-
-#endif /* _CXGB_ESPI_H_ */
diff --git a/trunk/drivers/net/chelsio/gmac.h b/trunk/drivers/net/chelsio/gmac.h
deleted file mode 100644
index 746b0eeea964..000000000000
--- a/trunk/drivers/net/chelsio/gmac.h
+++ /dev/null
@@ -1,134 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: gmac.h                                                              *
- * $Revision: 1.6 $                                                          *
- * $Date: 2005/06/21 18:29:47 $                                              *
- * Description:                                                              *
- *  Generic MAC functionality.                                               *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#ifndef _CXGB_GMAC_H_
-#define _CXGB_GMAC_H_
-
-#include "common.h"
-
-enum { MAC_STATS_UPDATE_FAST, MAC_STATS_UPDATE_FULL };
-enum { MAC_DIRECTION_RX = 1, MAC_DIRECTION_TX = 2 };
-
-struct cmac_statistics {
-	/* Transmit */
-	u64 TxOctetsOK;
-	u64 TxOctetsBad;
-	u64 TxUnicastFramesOK;
-	u64 TxMulticastFramesOK;
-	u64 TxBroadcastFramesOK;
-	u64 TxPauseFrames;
-	u64 TxFramesWithDeferredXmissions;
-	u64 TxLateCollisions;
-	u64 TxTotalCollisions;
-	u64 TxFramesAbortedDueToXSCollisions;
-	u64 TxUnderrun;
-	u64 TxLengthErrors;
-	u64 TxInternalMACXmitError;
-	u64 TxFramesWithExcessiveDeferral;
-	u64 TxFCSErrors;
-
-	/* Receive */
-	u64 RxOctetsOK;
-	u64 RxOctetsBad;
-	u64 RxUnicastFramesOK;
-	u64 RxMulticastFramesOK;
-	u64 RxBroadcastFramesOK;
-	u64 RxPauseFrames;
-	u64 RxFCSErrors;
-	u64 RxAlignErrors;
-	u64 RxSymbolErrors;
-	u64 RxDataErrors;
-	u64 RxSequenceErrors;
-	u64 RxRuntErrors;
-	u64 RxJabberErrors;
-	u64 RxInternalMACRcvError;
-	u64 RxInRangeLengthErrors;
-	u64 RxOutOfRangeLengthField;
-	u64 RxFrameTooLongErrors;
-};
-
-struct cmac_ops {
-	void (*destroy)(struct cmac *);
-	int (*reset)(struct cmac *);
-	int (*interrupt_enable)(struct cmac *);
-	int (*interrupt_disable)(struct cmac *);
-	int (*interrupt_clear)(struct cmac *);
-	int (*interrupt_handler)(struct cmac *);
-
-	int (*enable)(struct cmac *, int);
-	int (*disable)(struct cmac *, int);
-
-	int (*loopback_enable)(struct cmac *);
-	int (*loopback_disable)(struct cmac *);
-
-	int (*set_mtu)(struct cmac *, int mtu);
-	int (*set_rx_mode)(struct cmac *, struct t1_rx_mode *rm);
-
-	int (*set_speed_duplex_fc)(struct cmac *, int speed, int duplex, int fc);
-	int (*get_speed_duplex_fc)(struct cmac *, int *speed, int *duplex,
-				   int *fc);
-
-	const struct cmac_statistics *(*statistics_update)(struct cmac *, int);
-
-	int (*macaddress_get)(struct cmac *, u8 mac_addr[6]);
-	int (*macaddress_set)(struct cmac *, u8 mac_addr[6]);
-};
-
-typedef struct _cmac_instance cmac_instance;
-
-struct cmac {
-	struct cmac_statistics stats;
-	adapter_t *adapter;
-	struct cmac_ops *ops;
-	cmac_instance *instance;
-};
-
-struct gmac {
-	unsigned int stats_update_period;
-	struct cmac *(*create)(adapter_t *adapter, int index);
-	int (*reset)(adapter_t *);
-};
-
-extern struct gmac t1_pm3393_ops;
-extern struct gmac t1_chelsio_mac_ops;
-extern struct gmac t1_vsc7321_ops;
-extern struct gmac t1_ixf1010_ops;
-extern struct gmac t1_dummy_mac_ops;
-
-#endif /* _CXGB_GMAC_H_ */
diff --git a/trunk/drivers/net/chelsio/mv88x201x.c b/trunk/drivers/net/chelsio/mv88x201x.c
deleted file mode 100644
index db5034282782..000000000000
--- a/trunk/drivers/net/chelsio/mv88x201x.c
+++ /dev/null
@@ -1,252 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: mv88x201x.c                                                         *
- * $Revision: 1.12 $                                                         *
- * $Date: 2005/04/15 19:27:14 $                                              *
- * Description:                                                              *
- *  Marvell PHY (mv88x201x) functionality.                                   *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#include "cphy.h"
-#include "elmer0.h"
-
-/*
- * The 88x2010 Rev C. requires some link status registers * to be read
- * twice in order to get the right values. Future * revisions will fix
- * this problem and then this macro * can disappear.
- */
-#define MV88x2010_LINK_STATUS_BUGS    1
-
-static int led_init(struct cphy *cphy)
-{
-	/* Setup the LED registers so we can turn on/off.
-	 * Writing these bits maps control to another
-	 * register. mmd(0x1) addr(0x7)
-	 */
-	mdio_write(cphy, 0x3, 0x8304, 0xdddd);
-	return 0;
-}
-
-static int led_link(struct cphy *cphy, u32 do_enable)
-{
-	u32 led = 0;
-#define LINK_ENABLE_BIT 0x1
-
-	mdio_read(cphy, 0x1, 0x7, &led);
-
-	if (do_enable & LINK_ENABLE_BIT) {
-		led |= LINK_ENABLE_BIT;
-		mdio_write(cphy, 0x1, 0x7, led);
-	} else {
-		led &= ~LINK_ENABLE_BIT;
-		mdio_write(cphy, 0x1, 0x7, led);
-	}
-	return 0;
-}
-
-/* Port Reset */
-static int mv88x201x_reset(struct cphy *cphy, int wait)
-{
-	/* This can be done through registers.  It is not required since
-	 * a full chip reset is used.
-	 */
-	return 0;
-}
-
-static int mv88x201x_interrupt_enable(struct cphy *cphy)
-{
-	u32 elmer;
-
-	/* Enable PHY LASI interrupts. */
-	mdio_write(cphy, 0x1, 0x9002, 0x1);
-
-	/* Enable Marvell interrupts through Elmer0. */
-	t1_tpi_read(cphy->adapter, A_ELMER0_INT_ENABLE, &elmer);
-	elmer |= ELMER0_GP_BIT6;
-	t1_tpi_write(cphy->adapter, A_ELMER0_INT_ENABLE, elmer);
-	return 0;
-}
-
-static int mv88x201x_interrupt_disable(struct cphy *cphy)
-{
-	u32 elmer;
-
-	/* Disable PHY LASI interrupts. */
-	mdio_write(cphy, 0x1, 0x9002, 0x0);
-
-	/* Disable Marvell interrupts through Elmer0. */
-	t1_tpi_read(cphy->adapter, A_ELMER0_INT_ENABLE, &elmer);
-	elmer &= ~ELMER0_GP_BIT6;
-	t1_tpi_write(cphy->adapter, A_ELMER0_INT_ENABLE, elmer);
-	return 0;
-}
-
-static int mv88x201x_interrupt_clear(struct cphy *cphy)
-{
-	u32 elmer;
-	u32 val;
-
-#ifdef MV88x2010_LINK_STATUS_BUGS
-	/* Required to read twice before clear takes affect. */
-	mdio_read(cphy, 0x1, 0x9003, &val);
-	mdio_read(cphy, 0x1, 0x9004, &val);
-	mdio_read(cphy, 0x1, 0x9005, &val);
-
-	/* Read this register after the others above it else
-	 * the register doesn't clear correctly.
-	 */
-	mdio_read(cphy, 0x1, 0x1, &val);
-#endif
-
-	/* Clear link status. */
-	mdio_read(cphy, 0x1, 0x1, &val);
-	/* Clear PHY LASI interrupts. */
-	mdio_read(cphy, 0x1, 0x9005, &val);
-
-#ifdef MV88x2010_LINK_STATUS_BUGS
-	/* Do it again. */
-	mdio_read(cphy, 0x1, 0x9003, &val);
-	mdio_read(cphy, 0x1, 0x9004, &val);
-#endif
-
-	/* Clear Marvell interrupts through Elmer0. */
-	t1_tpi_read(cphy->adapter, A_ELMER0_INT_CAUSE, &elmer);
-	elmer |= ELMER0_GP_BIT6;
-	t1_tpi_write(cphy->adapter, A_ELMER0_INT_CAUSE, elmer);
-	return 0;
-}
-
-static int mv88x201x_interrupt_handler(struct cphy *cphy)
-{
-	/* Clear interrupts */
-	mv88x201x_interrupt_clear(cphy);
-
-	/* We have only enabled link change interrupts and so
-	 * cphy_cause must be a link change interrupt.
-	 */
-	return cphy_cause_link_change;
-}
-
-static int mv88x201x_set_loopback(struct cphy *cphy, int on)
-{
-	return 0;
-}
-
-static int mv88x201x_get_link_status(struct cphy *cphy, int *link_ok,
-				     int *speed, int *duplex, int *fc)
-{
-	u32 val = 0;
-#define LINK_STATUS_BIT 0x4
-
-	if (link_ok) {
-		/* Read link status. */
-		mdio_read(cphy, 0x1, 0x1, &val);
-		val &= LINK_STATUS_BIT;
-		*link_ok = (val == LINK_STATUS_BIT);
-		/* Turn on/off Link LED */
-		led_link(cphy, *link_ok);
-	}
-	if (speed)
-		*speed = SPEED_10000;
-	if (duplex)
-		*duplex = DUPLEX_FULL;
-	if (fc)
-		*fc = PAUSE_RX | PAUSE_TX;
-	return 0;
-}
-
-static void mv88x201x_destroy(struct cphy *cphy)
-{
-	kfree(cphy);
-}
-
-static struct cphy_ops mv88x201x_ops = {
-	.destroy           = mv88x201x_destroy,
-	.reset             = mv88x201x_reset,
-	.interrupt_enable  = mv88x201x_interrupt_enable,
-	.interrupt_disable = mv88x201x_interrupt_disable,
-	.interrupt_clear   = mv88x201x_interrupt_clear,
-	.interrupt_handler = mv88x201x_interrupt_handler,
-	.get_link_status   = mv88x201x_get_link_status,
-	.set_loopback      = mv88x201x_set_loopback,
-};
-
-static struct cphy *mv88x201x_phy_create(adapter_t *adapter, int phy_addr,
-					 struct mdio_ops *mdio_ops)
-{
-	u32 val;
-	struct cphy *cphy = kmalloc(sizeof(*cphy), GFP_KERNEL);
-
-	if (!cphy)
-		return NULL;
-	memset(cphy, 0, sizeof(*cphy));
-	cphy_init(cphy, adapter, phy_addr, &mv88x201x_ops, mdio_ops);
-
-	/* Commands the PHY to enable XFP's clock. */
-	mdio_read(cphy, 0x3, 0x8300, &val);
-	mdio_write(cphy, 0x3, 0x8300, val | 1);
-
-	/* Clear link status. Required because of a bug in the PHY.  */
-	mdio_read(cphy, 0x1, 0x8, &val);
-	mdio_read(cphy, 0x3, 0x8, &val);
-
-	/* Allows for Link,Ack LED turn on/off */
-	led_init(cphy);
-	return cphy;
-}
-
-/* Chip Reset */
-static int mv88x201x_phy_reset(adapter_t *adapter)
-{
-	u32 val;
-
-	t1_tpi_read(adapter, A_ELMER0_GPO, &val);
-	val &= ~4;
-	t1_tpi_write(adapter, A_ELMER0_GPO, val);
-	msleep(100);
-
-	t1_tpi_write(adapter, A_ELMER0_GPO, val | 4);
-	msleep(1000);
-
-	/* Now lets enable the Laser. Delay 100us */
-	t1_tpi_read(adapter, A_ELMER0_GPO, &val);
-	val |= 0x8000;
-	t1_tpi_write(adapter, A_ELMER0_GPO, val);
-	udelay(100);
-	return 0;
-}
-
-struct gphy t1_mv88x201x_ops = {
-	mv88x201x_phy_create,
-	mv88x201x_phy_reset
-};
diff --git a/trunk/drivers/net/chelsio/pm3393.c b/trunk/drivers/net/chelsio/pm3393.c
deleted file mode 100644
index 04a1404fc65e..000000000000
--- a/trunk/drivers/net/chelsio/pm3393.c
+++ /dev/null
@@ -1,826 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: pm3393.c                                                            *
- * $Revision: 1.16 $                                                         *
- * $Date: 2005/05/14 00:59:32 $                                              *
- * Description:                                                              *
- *  PMC/SIERRA (pm3393) MAC-PHY functionality.                               *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#include "common.h"
-#include "regs.h"
-#include "gmac.h"
-#include "elmer0.h"
-#include "suni1x10gexp_regs.h"
-
-/* 802.3ae 10Gb/s MDIO Manageable Device(MMD)
- */
-enum {
-    MMD_RESERVED,
-    MMD_PMAPMD,
-    MMD_WIS,
-    MMD_PCS,
-    MMD_PHY_XGXS,	/* XGMII Extender Sublayer */
-    MMD_DTE_XGXS,
-};
-
-enum {
-    PHY_XGXS_CTRL_1,
-    PHY_XGXS_STATUS_1
-};
-
-#define OFFSET(REG_ADDR)    (REG_ADDR << 2)
-
-/* Max frame size PM3393 can handle. Includes Ethernet header and CRC. */
-#define MAX_FRAME_SIZE  9600
-
-#define IPG 12
-#define TXXG_CONF1_VAL ((IPG << SUNI1x10GEXP_BITOFF_TXXG_IPGT) | \
-	SUNI1x10GEXP_BITMSK_TXXG_32BIT_ALIGN | SUNI1x10GEXP_BITMSK_TXXG_CRCEN | \
-	SUNI1x10GEXP_BITMSK_TXXG_PADEN)
-#define RXXG_CONF1_VAL (SUNI1x10GEXP_BITMSK_RXXG_PUREP | 0x14 | \
-	SUNI1x10GEXP_BITMSK_RXXG_FLCHK | SUNI1x10GEXP_BITMSK_RXXG_CRC_STRIP)
-
-/* Update statistics every 15 minutes */
-#define STATS_TICK_SECS (15 * 60)
-
-enum {                     /* RMON registers */
-	RxOctetsReceivedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_1_LOW,
-	RxUnicastFramesReceivedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_4_LOW,
-	RxMulticastFramesReceivedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_5_LOW,
-	RxBroadcastFramesReceivedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_6_LOW,
-	RxPAUSEMACCtrlFramesReceived = SUNI1x10GEXP_REG_MSTAT_COUNTER_8_LOW,
-	RxFrameCheckSequenceErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_10_LOW,
-	RxFramesLostDueToInternalMACErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_11_LOW,
-	RxSymbolErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_12_LOW,
-	RxInRangeLengthErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_13_LOW,
-	RxFramesTooLongErrors = SUNI1x10GEXP_REG_MSTAT_COUNTER_15_LOW,
-	RxJabbers = SUNI1x10GEXP_REG_MSTAT_COUNTER_16_LOW,
-	RxFragments = SUNI1x10GEXP_REG_MSTAT_COUNTER_17_LOW,
-	RxUndersizedFrames =  SUNI1x10GEXP_REG_MSTAT_COUNTER_18_LOW,
-
-	TxOctetsTransmittedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_33_LOW,
-	TxFramesLostDueToInternalMACTransmissionError = SUNI1x10GEXP_REG_MSTAT_COUNTER_35_LOW,
-	TxTransmitSystemError = SUNI1x10GEXP_REG_MSTAT_COUNTER_36_LOW,
-	TxUnicastFramesTransmittedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_38_LOW,
-	TxMulticastFramesTransmittedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_40_LOW,
-	TxBroadcastFramesTransmittedOK = SUNI1x10GEXP_REG_MSTAT_COUNTER_42_LOW,
-	TxPAUSEMACCtrlFramesTransmitted = SUNI1x10GEXP_REG_MSTAT_COUNTER_43_LOW
-};
-
-struct _cmac_instance {
-	u8 enabled;
-	u8 fc;
-	u8 mac_addr[6];
-};
-
-static int pmread(struct cmac *cmac, u32 reg, u32 * data32)
-{
-	t1_tpi_read(cmac->adapter, OFFSET(reg), data32);
-	return 0;
-}
-
-static int pmwrite(struct cmac *cmac, u32 reg, u32 data32)
-{
-	t1_tpi_write(cmac->adapter, OFFSET(reg), data32);
-	return 0;
-}
-
-/* Port reset. */
-static int pm3393_reset(struct cmac *cmac)
-{
-	return 0;
-}
-
-/*
- * Enable interrupts for the PM3393
-
-	1. Enable PM3393 BLOCK interrupts.
-	2. Enable PM3393 Master Interrupt bit(INTE)
-	3. Enable ELMER's PM3393 bit.
-	4. Enable Terminator external interrupt.
-*/
-static int pm3393_interrupt_enable(struct cmac *cmac)
-{
-	u32 pl_intr;
-
-	/* PM3393 - Enabling all hardware block interrupts.
-	 */
-	pmwrite(cmac, SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_ENABLE, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_XRF_INTERRUPT_ENABLE, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_ENABLE, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXOAM_INTERRUPT_ENABLE, 0xffff);
-
-	/* Don't interrupt on statistics overflow, we are polling */
-	pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_0, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_1, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_2, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_3, 0);
-
-	pmwrite(cmac, SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_ENABLE, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_PL4ODP_INTERRUPT_MASK, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_XTEF_INTERRUPT_ENABLE, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_TXOAM_INTERRUPT_ENABLE, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_CONFIG_3, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_MASK, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_CONFIG_3, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_PL4IDU_INTERRUPT_MASK, 0xffff);
-	pmwrite(cmac, SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_ENABLE, 0xffff);
-
-	/* PM3393 - Global interrupt enable
-	 */
-	/* TBD XXX Disable for now until we figure out why error interrupts keep asserting. */
-	pmwrite(cmac, SUNI1x10GEXP_REG_GLOBAL_INTERRUPT_ENABLE,
-		0 /*SUNI1x10GEXP_BITMSK_TOP_INTE */ );
-
-	/* TERMINATOR - PL_INTERUPTS_EXT */
-	pl_intr = readl(cmac->adapter->regs + A_PL_ENABLE);
-	pl_intr |= F_PL_INTR_EXT;
-	writel(pl_intr, cmac->adapter->regs + A_PL_ENABLE);
-	return 0;
-}
-
-static int pm3393_interrupt_disable(struct cmac *cmac)
-{
-	u32 elmer;
-
-	/* PM3393 - Enabling HW interrupt blocks. */
-	pmwrite(cmac, SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_ENABLE, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_XRF_INTERRUPT_ENABLE, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_ENABLE, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXOAM_INTERRUPT_ENABLE, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_0, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_1, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_2, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_3, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_ENABLE, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_PL4ODP_INTERRUPT_MASK, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_XTEF_INTERRUPT_ENABLE, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_TXOAM_INTERRUPT_ENABLE, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_CONFIG_3, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_MASK, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_CONFIG_3, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_PL4IDU_INTERRUPT_MASK, 0);
-	pmwrite(cmac, SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_ENABLE, 0);
-
-	/* PM3393 - Global interrupt enable */
-	pmwrite(cmac, SUNI1x10GEXP_REG_GLOBAL_INTERRUPT_ENABLE, 0);
-
-	/* ELMER - External chip interrupts. */
-	t1_tpi_read(cmac->adapter, A_ELMER0_INT_ENABLE, &elmer);
-	elmer &= ~ELMER0_GP_BIT1;
-	t1_tpi_write(cmac->adapter, A_ELMER0_INT_ENABLE, elmer);
-
-	/* TERMINATOR - PL_INTERUPTS_EXT */
-	/* DO NOT DISABLE TERMINATOR's EXTERNAL INTERRUPTS. ANOTHER CHIP
-	 * COULD WANT THEM ENABLED. We disable PM3393 at the ELMER level.
-	 */
-
-	return 0;
-}
-
-static int pm3393_interrupt_clear(struct cmac *cmac)
-{
-	u32 elmer;
-	u32 pl_intr;
-	u32 val32;
-
-	/* PM3393 - Clearing HW interrupt blocks. Note, this assumes
-	 *          bit WCIMODE=0 for a clear-on-read.
-	 */
-	pmread(cmac, SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_STATUS, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_XRF_INTERRUPT_STATUS, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_STATUS, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_RXOAM_INTERRUPT_STATUS, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_PL4ODP_INTERRUPT, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_XTEF_INTERRUPT_STATUS, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_INTERRUPT, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_TXOAM_INTERRUPT_STATUS, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_RXXG_INTERRUPT, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_TXXG_INTERRUPT, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_PL4IDU_INTERRUPT, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_INDICATION,
-	       &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_STATUS, &val32);
-	pmread(cmac, SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_CHANGE, &val32);
-
-	/* PM3393 - Global interrupt status
-	 */
-	pmread(cmac, SUNI1x10GEXP_REG_MASTER_INTERRUPT_STATUS, &val32);
-
-	/* ELMER - External chip interrupts.
-	 */
-	t1_tpi_read(cmac->adapter, A_ELMER0_INT_CAUSE, &elmer);
-	elmer |= ELMER0_GP_BIT1;
-	t1_tpi_write(cmac->adapter, A_ELMER0_INT_CAUSE, elmer);
-
-	/* TERMINATOR - PL_INTERUPTS_EXT
-	 */
-	pl_intr = readl(cmac->adapter->regs + A_PL_CAUSE);
-	pl_intr |= F_PL_INTR_EXT;
-	writel(pl_intr, cmac->adapter->regs + A_PL_CAUSE);
-
-	return 0;
-}
-
-/* Interrupt handler */
-static int pm3393_interrupt_handler(struct cmac *cmac)
-{
-	u32 master_intr_status;
-/*
-	1. Read master interrupt register.
-	2. Read BLOCK's interrupt status registers.
-	3. Handle BLOCK interrupts.
-*/
-	/* Read the master interrupt status register. */
-	pmread(cmac, SUNI1x10GEXP_REG_MASTER_INTERRUPT_STATUS,
-	       &master_intr_status);
-
-	/* TBD XXX Lets just clear everything for now */
-	pm3393_interrupt_clear(cmac);
-
-	return 0;
-}
-
-static int pm3393_enable(struct cmac *cmac, int which)
-{
-	if (which & MAC_DIRECTION_RX)
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_CONFIG_1,
-			(RXXG_CONF1_VAL | SUNI1x10GEXP_BITMSK_RXXG_RXEN));
-
-	if (which & MAC_DIRECTION_TX) {
-		u32 val = TXXG_CONF1_VAL | SUNI1x10GEXP_BITMSK_TXXG_TXEN0;
-
-		if (cmac->instance->fc & PAUSE_RX)
-			val |= SUNI1x10GEXP_BITMSK_TXXG_FCRX;
-		if (cmac->instance->fc & PAUSE_TX)
-			val |= SUNI1x10GEXP_BITMSK_TXXG_FCTX;
-		pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_CONFIG_1, val);
-	}
-
-	cmac->instance->enabled |= which;
-	return 0;
-}
-
-static int pm3393_enable_port(struct cmac *cmac, int which)
-{
-	/* Clear port statistics */
-	pmwrite(cmac, SUNI1x10GEXP_REG_MSTAT_CONTROL,
-		SUNI1x10GEXP_BITMSK_MSTAT_CLEAR);
-	udelay(2);
-	memset(&cmac->stats, 0, sizeof(struct cmac_statistics));
-
-	pm3393_enable(cmac, which);
-
-	/*
-	 * XXX This should be done by the PHY and preferrably not at all.
-	 * The PHY doesn't give us link status indication on its own so have
-	 * the link management code query it instead.
-	 */
-	{
-		extern void link_changed(adapter_t *adapter, int port_id);
-
-		link_changed(cmac->adapter, 0);
-	}
-	return 0;
-}
-
-static int pm3393_disable(struct cmac *cmac, int which)
-{
-	if (which & MAC_DIRECTION_RX)
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_CONFIG_1, RXXG_CONF1_VAL);
-	if (which & MAC_DIRECTION_TX)
-		pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_CONFIG_1, TXXG_CONF1_VAL);
-
-	/*
-	 * The disable is graceful. Give the PM3393 time.  Can't wait very
-	 * long here, we may be holding locks.
-	 */
-	udelay(20);
-
-	cmac->instance->enabled &= ~which;
-	return 0;
-}
-
-static int pm3393_loopback_enable(struct cmac *cmac)
-{
-	return 0;
-}
-
-static int pm3393_loopback_disable(struct cmac *cmac)
-{
-	return 0;
-}
-
-static int pm3393_set_mtu(struct cmac *cmac, int mtu)
-{
-	int enabled = cmac->instance->enabled;
-
-	/* MAX_FRAME_SIZE includes header + FCS, mtu doesn't */
-	mtu += 14 + 4;
-	if (mtu > MAX_FRAME_SIZE)
-		return -EINVAL;
-
-	/* Disable Rx/Tx MAC before configuring it. */
-	if (enabled)
-		pm3393_disable(cmac, MAC_DIRECTION_RX | MAC_DIRECTION_TX);
-
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MAX_FRAME_LENGTH, mtu);
-	pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_MAX_FRAME_SIZE, mtu);
-
-	if (enabled)
-		pm3393_enable(cmac, enabled);
-	return 0;
-}
-
-static u32 calc_crc(u8 *b, int len)
-{
-	int i;
-	u32 crc = (u32)~0;
-
-	/* calculate crc one bit at a time */
-	while (len--) {
-		crc ^= *b++;
-		for (i = 0; i < 8; i++) {
-			if (crc & 0x1)
-				crc = (crc >> 1) ^ 0xedb88320;
-			else
-				crc = (crc >> 1);
-		}
-	}
-
-	/* reverse bits */
-	crc = ((crc >> 4) & 0x0f0f0f0f) | ((crc << 4) & 0xf0f0f0f0);
-	crc = ((crc >> 2) & 0x33333333) | ((crc << 2) & 0xcccccccc);
-	crc = ((crc >> 1) & 0x55555555) | ((crc << 1) & 0xaaaaaaaa);
-	/* swap bytes */
-	crc = (crc >> 16) | (crc << 16);
-	crc = (crc >> 8 & 0x00ff00ff) | (crc << 8 & 0xff00ff00);
-
-	return crc;
-}
-
-static int pm3393_set_rx_mode(struct cmac *cmac, struct t1_rx_mode *rm)
-{
-	int enabled = cmac->instance->enabled & MAC_DIRECTION_RX;
-	u32 rx_mode;
-
-	/* Disable MAC RX before reconfiguring it */
-	if (enabled)
-		pm3393_disable(cmac, MAC_DIRECTION_RX);
-
-	pmread(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_2, &rx_mode);
-	rx_mode &= ~(SUNI1x10GEXP_BITMSK_RXXG_PMODE |
-		     SUNI1x10GEXP_BITMSK_RXXG_MHASH_EN);
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_2,
-		(u16)rx_mode);
-
-	if (t1_rx_mode_promisc(rm)) {
-		/* Promiscuous mode. */
-		rx_mode |= SUNI1x10GEXP_BITMSK_RXXG_PMODE;
-	}
-	if (t1_rx_mode_allmulti(rm)) {
-		/* Accept all multicast. */
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_LOW, 0xffff);
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDLOW, 0xffff);
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDHIGH, 0xffff);
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_HIGH, 0xffff);
-		rx_mode |= SUNI1x10GEXP_BITMSK_RXXG_MHASH_EN;
-	} else if (t1_rx_mode_mc_cnt(rm)) {
-		/* Accept one or more multicast(s). */
-		u8 *addr;
-		int bit;
-		u16 mc_filter[4] = { 0, };
-
-		while ((addr = t1_get_next_mcaddr(rm))) {
-			bit = (calc_crc(addr, ETH_ALEN) >> 23) & 0x3f;	/* bit[23:28] */
-			mc_filter[bit >> 4] |= 1 << (bit & 0xf);
-		}
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_LOW, mc_filter[0]);
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDLOW, mc_filter[1]);
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDHIGH, mc_filter[2]);
-		pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_HIGH, mc_filter[3]);
-		rx_mode |= SUNI1x10GEXP_BITMSK_RXXG_MHASH_EN;
-	}
-
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_2, (u16)rx_mode);
-
-	if (enabled)
-		pm3393_enable(cmac, MAC_DIRECTION_RX);
-
-	return 0;
-}
-
-static int pm3393_get_speed_duplex_fc(struct cmac *cmac, int *speed,
-				      int *duplex, int *fc)
-{
-	if (speed)
-		*speed = SPEED_10000;
-	if (duplex)
-		*duplex = DUPLEX_FULL;
-	if (fc)
-		*fc = cmac->instance->fc;
-	return 0;
-}
-
-static int pm3393_set_speed_duplex_fc(struct cmac *cmac, int speed, int duplex,
-				      int fc)
-{
-	if (speed >= 0 && speed != SPEED_10000)
-		return -1;
-	if (duplex >= 0 && duplex != DUPLEX_FULL)
-		return -1;
-	if (fc & ~(PAUSE_TX | PAUSE_RX))
-		return -1;
-
-	if (fc != cmac->instance->fc) {
-		cmac->instance->fc = (u8) fc;
-		if (cmac->instance->enabled & MAC_DIRECTION_TX)
-			pm3393_enable(cmac, MAC_DIRECTION_TX);
-	}
-	return 0;
-}
-
-#define RMON_UPDATE(mac, name, stat_name) \
-	{ \
-		t1_tpi_read((mac)->adapter, OFFSET(name), &val0);	\
-		t1_tpi_read((mac)->adapter, OFFSET(((name)+1)), &val1); \
-		t1_tpi_read((mac)->adapter, OFFSET(((name)+2)), &val2); \
-		(mac)->stats.stat_name = ((u64)val0 & 0xffff) | \
-						(((u64)val1 & 0xffff) << 16) | \
-						(((u64)val2 & 0xff) << 32) | \
-						((mac)->stats.stat_name & \
-							(~(u64)0 << 40)); \
-		if (ro &	\
-			((name -  SUNI1x10GEXP_REG_MSTAT_COUNTER_0_LOW) >> 2)) \
-			(mac)->stats.stat_name += ((u64)1 << 40); \
-	}
-
-static const struct cmac_statistics *pm3393_update_statistics(struct cmac *mac,
-							      int flag)
-{
-	u64	ro;
-	u32	val0, val1, val2, val3;
-
-	/* Snap the counters */
-	pmwrite(mac, SUNI1x10GEXP_REG_MSTAT_CONTROL,
-		SUNI1x10GEXP_BITMSK_MSTAT_SNAP);
-
-	/* Counter rollover, clear on read */
-	pmread(mac, SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_0, &val0);
-	pmread(mac, SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_1, &val1);
-	pmread(mac, SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_2, &val2);
-	pmread(mac, SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_3, &val3);
-	ro = ((u64)val0 & 0xffff) | (((u64)val1 & 0xffff) << 16) |
-		(((u64)val2 & 0xffff) << 32) | (((u64)val3 & 0xffff) << 48);
-
-	/* Rx stats */
-	RMON_UPDATE(mac, RxOctetsReceivedOK, RxOctetsOK);
-	RMON_UPDATE(mac, RxUnicastFramesReceivedOK, RxUnicastFramesOK);
-	RMON_UPDATE(mac, RxMulticastFramesReceivedOK, RxMulticastFramesOK);
-	RMON_UPDATE(mac, RxBroadcastFramesReceivedOK, RxBroadcastFramesOK);
-	RMON_UPDATE(mac, RxPAUSEMACCtrlFramesReceived, RxPauseFrames);
-	RMON_UPDATE(mac, RxFrameCheckSequenceErrors, RxFCSErrors);
-	RMON_UPDATE(mac, RxFramesLostDueToInternalMACErrors,
-				RxInternalMACRcvError);
-	RMON_UPDATE(mac, RxSymbolErrors, RxSymbolErrors);
-	RMON_UPDATE(mac, RxInRangeLengthErrors, RxInRangeLengthErrors);
-	RMON_UPDATE(mac, RxFramesTooLongErrors , RxFrameTooLongErrors);
-	RMON_UPDATE(mac, RxJabbers, RxJabberErrors);
-	RMON_UPDATE(mac, RxFragments, RxRuntErrors);
-	RMON_UPDATE(mac, RxUndersizedFrames, RxRuntErrors);
-
-	/* Tx stats */
-	RMON_UPDATE(mac, TxOctetsTransmittedOK, TxOctetsOK);
-	RMON_UPDATE(mac, TxFramesLostDueToInternalMACTransmissionError,
-				TxInternalMACXmitError);
-	RMON_UPDATE(mac, TxTransmitSystemError, TxFCSErrors);
-	RMON_UPDATE(mac, TxUnicastFramesTransmittedOK, TxUnicastFramesOK);
-	RMON_UPDATE(mac, TxMulticastFramesTransmittedOK, TxMulticastFramesOK);
-	RMON_UPDATE(mac, TxBroadcastFramesTransmittedOK, TxBroadcastFramesOK);
-	RMON_UPDATE(mac, TxPAUSEMACCtrlFramesTransmitted, TxPauseFrames);
-
-	return &mac->stats;
-}
-
-static int pm3393_macaddress_get(struct cmac *cmac, u8 mac_addr[6])
-{
-	memcpy(mac_addr, cmac->instance->mac_addr, 6);
-	return 0;
-}
-
-static int pm3393_macaddress_set(struct cmac *cmac, u8 ma[6])
-{
-	u32 val, lo, mid, hi, enabled = cmac->instance->enabled;
-
-	/*
-	 * MAC addr: 00:07:43:00:13:09
-	 *
-	 * ma[5] = 0x09
-	 * ma[4] = 0x13
-	 * ma[3] = 0x00
-	 * ma[2] = 0x43
-	 * ma[1] = 0x07
-	 * ma[0] = 0x00
-	 *
-	 * The PM3393 requires byte swapping and reverse order entry
-	 * when programming MAC addresses:
-	 *
-	 * low_bits[15:0]    = ma[1]:ma[0]
-	 * mid_bits[31:16]   = ma[3]:ma[2]
-	 * high_bits[47:32]  = ma[5]:ma[4]
-	 */
-
-	/* Store local copy */
-	memcpy(cmac->instance->mac_addr, ma, 6);
-
-	lo = ((u32) ma[1] << 8) | (u32) ma[0];
-	mid = ((u32) ma[3] << 8) | (u32) ma[2];
-	hi = ((u32) ma[5] << 8) | (u32) ma[4];
-
-	/* Disable Rx/Tx MAC before configuring it. */
-	if (enabled)
-		pm3393_disable(cmac, MAC_DIRECTION_RX | MAC_DIRECTION_TX);
-
-	/* Set RXXG Station Address */
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_SA_15_0, lo);
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_SA_31_16, mid);
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_SA_47_32, hi);
-
-	/* Set TXXG Station Address */
-	pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_SA_15_0, lo);
-	pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_SA_31_16, mid);
-	pmwrite(cmac, SUNI1x10GEXP_REG_TXXG_SA_47_32, hi);
-
-	/* Setup Exact Match Filter 1 with our MAC address
-	 *
-	 * Must disable exact match filter before configuring it.
-	 */
-	pmread(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_0, &val);
-	val &= 0xff0f;
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_0, val);
-
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_LOW, lo);
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_MID, mid);
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_HIGH, hi);
-
-	val |= 0x0090;
-	pmwrite(cmac, SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_0, val);
-
-	if (enabled)
-		pm3393_enable(cmac, enabled);
-	return 0;
-}
-
-static void pm3393_destroy(struct cmac *cmac)
-{
-	kfree(cmac);
-}
-
-static struct cmac_ops pm3393_ops = {
-	.destroy                 = pm3393_destroy,
-	.reset                   = pm3393_reset,
-	.interrupt_enable        = pm3393_interrupt_enable,
-	.interrupt_disable       = pm3393_interrupt_disable,
-	.interrupt_clear         = pm3393_interrupt_clear,
-	.interrupt_handler       = pm3393_interrupt_handler,
-	.enable                  = pm3393_enable_port,
-	.disable                 = pm3393_disable,
-	.loopback_enable         = pm3393_loopback_enable,
-	.loopback_disable        = pm3393_loopback_disable,
-	.set_mtu                 = pm3393_set_mtu,
-	.set_rx_mode             = pm3393_set_rx_mode,
-	.get_speed_duplex_fc     = pm3393_get_speed_duplex_fc,
-	.set_speed_duplex_fc     = pm3393_set_speed_duplex_fc,
-	.statistics_update       = pm3393_update_statistics,
-	.macaddress_get          = pm3393_macaddress_get,
-	.macaddress_set          = pm3393_macaddress_set
-};
-
-static struct cmac *pm3393_mac_create(adapter_t *adapter, int index)
-{
-	struct cmac *cmac;
-
-	cmac = kmalloc(sizeof(*cmac) + sizeof(cmac_instance), GFP_KERNEL);
-	if (!cmac)
-		return NULL;
-	memset(cmac, 0, sizeof(*cmac));
-
-	cmac->ops = &pm3393_ops;
-	cmac->instance = (cmac_instance *) (cmac + 1);
-	cmac->adapter = adapter;
-	cmac->instance->fc = PAUSE_TX | PAUSE_RX;
-
-	t1_tpi_write(adapter, OFFSET(0x0001), 0x00008000);
-	t1_tpi_write(adapter, OFFSET(0x0001), 0x00000000);
-	t1_tpi_write(adapter, OFFSET(0x2308), 0x00009800);
-	t1_tpi_write(adapter, OFFSET(0x2305), 0x00001001);   /* PL4IO Enable */
-	t1_tpi_write(adapter, OFFSET(0x2320), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x2321), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x2322), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x2323), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x2324), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x2325), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x2326), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x2327), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x2328), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x2329), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x232a), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x232b), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x232c), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x232d), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x232e), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x232f), 0x00008800);
-	t1_tpi_write(adapter, OFFSET(0x230d), 0x00009c00);
-	t1_tpi_write(adapter, OFFSET(0x2304), 0x00000202);	/* PL4IO Calendar Repetitions */
-
-	t1_tpi_write(adapter, OFFSET(0x3200), 0x00008080);	/* EFLX Enable */
-	t1_tpi_write(adapter, OFFSET(0x3210), 0x00000000);	/* EFLX Channel Deprovision */
-	t1_tpi_write(adapter, OFFSET(0x3203), 0x00000000);	/* EFLX Low Limit */
-	t1_tpi_write(adapter, OFFSET(0x3204), 0x00000040);	/* EFLX High Limit */
-	t1_tpi_write(adapter, OFFSET(0x3205), 0x000002cc);	/* EFLX Almost Full */
-	t1_tpi_write(adapter, OFFSET(0x3206), 0x00000199);	/* EFLX Almost Empty */
-	t1_tpi_write(adapter, OFFSET(0x3207), 0x00000240);	/* EFLX Cut Through Threshold */
-	t1_tpi_write(adapter, OFFSET(0x3202), 0x00000000);	/* EFLX Indirect Register Update */
-	t1_tpi_write(adapter, OFFSET(0x3210), 0x00000001);	/* EFLX Channel Provision */
-	t1_tpi_write(adapter, OFFSET(0x3208), 0x0000ffff);	/* EFLX Undocumented */
-	t1_tpi_write(adapter, OFFSET(0x320a), 0x0000ffff);	/* EFLX Undocumented */
-	t1_tpi_write(adapter, OFFSET(0x320c), 0x0000ffff);	/* EFLX enable overflow interrupt The other bit are undocumented */
-	t1_tpi_write(adapter, OFFSET(0x320e), 0x0000ffff);	/* EFLX Undocumented */
-
-	t1_tpi_write(adapter, OFFSET(0x2200), 0x0000c000);	/* IFLX Configuration - enable */
-	t1_tpi_write(adapter, OFFSET(0x2201), 0x00000000);	/* IFLX Channel Deprovision */
-	t1_tpi_write(adapter, OFFSET(0x220e), 0x00000000);	/* IFLX Low Limit */
-	t1_tpi_write(adapter, OFFSET(0x220f), 0x00000100);	/* IFLX High Limit */
-	t1_tpi_write(adapter, OFFSET(0x2210), 0x00000c00);	/* IFLX Almost Full Limit */
-	t1_tpi_write(adapter, OFFSET(0x2211), 0x00000599);	/* IFLX Almost Empty Limit */
-	t1_tpi_write(adapter, OFFSET(0x220d), 0x00000000);	/* IFLX Indirect Register Update */
-	t1_tpi_write(adapter, OFFSET(0x2201), 0x00000001);	/* IFLX Channel Provision */
-	t1_tpi_write(adapter, OFFSET(0x2203), 0x0000ffff);	/* IFLX Undocumented */
-	t1_tpi_write(adapter, OFFSET(0x2205), 0x0000ffff);	/* IFLX Undocumented */
-	t1_tpi_write(adapter, OFFSET(0x2209), 0x0000ffff);	/* IFLX Enable overflow interrupt.  The other bit are undocumented */
-
-	t1_tpi_write(adapter, OFFSET(0x2241), 0xfffffffe);	/* PL4MOS Undocumented */
-	t1_tpi_write(adapter, OFFSET(0x2242), 0x0000ffff);	/* PL4MOS Undocumented */
-	t1_tpi_write(adapter, OFFSET(0x2243), 0x00000008);	/* PL4MOS Starving Burst Size */
-	t1_tpi_write(adapter, OFFSET(0x2244), 0x00000008);	/* PL4MOS Hungry Burst Size */
-	t1_tpi_write(adapter, OFFSET(0x2245), 0x00000008);	/* PL4MOS Transfer Size */
-	t1_tpi_write(adapter, OFFSET(0x2240), 0x00000005);	/* PL4MOS Disable */
-
-	t1_tpi_write(adapter, OFFSET(0x2280), 0x00002103);	/* PL4ODP Training Repeat and SOP rule */
-	t1_tpi_write(adapter, OFFSET(0x2284), 0x00000000);	/* PL4ODP MAX_T setting */
-
-	t1_tpi_write(adapter, OFFSET(0x3280), 0x00000087);	/* PL4IDU Enable data forward, port state machine. Set ALLOW_NON_ZERO_OLB */
-	t1_tpi_write(adapter, OFFSET(0x3282), 0x0000001f);	/* PL4IDU Enable Dip4 check error interrupts */
-
-	t1_tpi_write(adapter, OFFSET(0x3040), 0x0c32);	/* # TXXG Config */
-	/* For T1 use timer based Mac flow control. */
-	t1_tpi_write(adapter, OFFSET(0x304d), 0x8000);
-	t1_tpi_write(adapter, OFFSET(0x2040), 0x059c);	/* # RXXG Config */
-	t1_tpi_write(adapter, OFFSET(0x2049), 0x0001);	/* # RXXG Cut Through */
-	t1_tpi_write(adapter, OFFSET(0x2070), 0x0000);	/* # Disable promiscuous mode */
-
-	/* Setup Exact Match Filter 0 to allow broadcast packets.
-	 */
-	t1_tpi_write(adapter, OFFSET(0x206e), 0x0000);	/* # Disable Match Enable bit */
-	t1_tpi_write(adapter, OFFSET(0x204a), 0xffff);	/* # low addr */
-	t1_tpi_write(adapter, OFFSET(0x204b), 0xffff);	/* # mid addr */
-	t1_tpi_write(adapter, OFFSET(0x204c), 0xffff);	/* # high addr */
-	t1_tpi_write(adapter, OFFSET(0x206e), 0x0009);	/* # Enable Match Enable bit */
-
-	t1_tpi_write(adapter, OFFSET(0x0003), 0x0000);	/* # NO SOP/ PAD_EN setup */
-	t1_tpi_write(adapter, OFFSET(0x0100), 0x0ff0);	/* # RXEQB disabled */
-	t1_tpi_write(adapter, OFFSET(0x0101), 0x0f0f);	/* # No Preemphasis */
-
-	return cmac;
-}
-
-static int pm3393_mac_reset(adapter_t * adapter)
-{
-	u32 val;
-	u32 x;
-	u32 is_pl4_reset_finished;
-	u32 is_pl4_outof_lock;
-	u32 is_xaui_mabc_pll_locked;
-	u32 successful_reset;
-	int i;
-
-	/* The following steps are required to properly reset
-	 * the PM3393. This information is provided in the
-	 * PM3393 datasheet (Issue 2: November 2002)
-	 * section 13.1 -- Device Reset.
-	 *
-	 * The PM3393 has three types of components that are
-	 * individually reset:
-	 *
-	 * DRESETB      - Digital circuitry
-	 * PL4_ARESETB  - PL4 analog circuitry
-	 * XAUI_ARESETB - XAUI bus analog circuitry
-	 *
-	 * Steps to reset PM3393 using RSTB pin:
-	 *
-	 * 1. Assert RSTB pin low ( write 0 )
-	 * 2. Wait at least 1ms to initiate a complete initialization of device.
-	 * 3. Wait until all external clocks and REFSEL are stable.
-	 * 4. Wait minimum of 1ms. (after external clocks and REFEL are stable)
-	 * 5. De-assert RSTB ( write 1 )
-	 * 6. Wait until internal timers to expires after ~14ms.
-	 *    - Allows analog clock synthesizer(PL4CSU) to stabilize to
-	 *      selected reference frequency before allowing the digital
-	 *      portion of the device to operate.
-	 * 7. Wait at least 200us for XAUI interface to stabilize.
-	 * 8. Verify the PM3393 came out of reset successfully.
-	 *    Set successful reset flag if everything worked else try again
-	 *    a few more times.
-	 */
-
-	successful_reset = 0;
-	for (i = 0; i < 3 && !successful_reset; i++) {
-		/* 1 */
-		t1_tpi_read(adapter, A_ELMER0_GPO, &val);
-		val &= ~1;
-		t1_tpi_write(adapter, A_ELMER0_GPO, val);
-
-		/* 2 */
-		msleep(1);
-
-		/* 3 */
-		msleep(1);
-
-		/* 4 */
-		msleep(2 /*1 extra ms for safety */ );
-
-		/* 5 */
-		val |= 1;
-		t1_tpi_write(adapter, A_ELMER0_GPO, val);
-
-		/* 6 */
-		msleep(15 /*1 extra ms for safety */ );
-
-		/* 7 */
-		msleep(1);
-
-		/* 8 */
-
-		/* Has PL4 analog block come out of reset correctly? */
-		t1_tpi_read(adapter, OFFSET(SUNI1x10GEXP_REG_DEVICE_STATUS), &val);
-		is_pl4_reset_finished = (val & SUNI1x10GEXP_BITMSK_TOP_EXPIRED);
-
-		/* TBD XXX SUNI1x10GEXP_BITMSK_TOP_PL4_IS_DOOL gets locked later in the init sequence
-		 *         figure out why? */
-
-		/* Have all PL4 block clocks locked? */
-		x = (SUNI1x10GEXP_BITMSK_TOP_PL4_ID_DOOL
-		     /*| SUNI1x10GEXP_BITMSK_TOP_PL4_IS_DOOL */  |
-		     SUNI1x10GEXP_BITMSK_TOP_PL4_ID_ROOL |
-		     SUNI1x10GEXP_BITMSK_TOP_PL4_IS_ROOL |
-		     SUNI1x10GEXP_BITMSK_TOP_PL4_OUT_ROOL);
-		is_pl4_outof_lock = (val & x);
-
-		/* ??? If this fails, might be able to software reset the XAUI part
-		 *     and try to recover... thus saving us from doing another HW reset */
-		/* Has the XAUI MABC PLL circuitry stablized? */
-		is_xaui_mabc_pll_locked =
-		    (val & SUNI1x10GEXP_BITMSK_TOP_SXRA_EXPIRED);
-
-		successful_reset = (is_pl4_reset_finished && !is_pl4_outof_lock
-				    && is_xaui_mabc_pll_locked);
-	}
-	return successful_reset ? 0 : 1;
-}
-
-struct gmac t1_pm3393_ops = {
-	STATS_TICK_SECS,
-	pm3393_mac_create,
-	pm3393_mac_reset
-};
diff --git a/trunk/drivers/net/chelsio/regs.h b/trunk/drivers/net/chelsio/regs.h
deleted file mode 100644
index b90e11f40d1f..000000000000
--- a/trunk/drivers/net/chelsio/regs.h
+++ /dev/null
@@ -1,468 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: regs.h                                                              *
- * $Revision: 1.8 $                                                          *
- * $Date: 2005/06/21 18:29:48 $                                              *
- * Description:                                                              *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#ifndef _CXGB_REGS_H_
-#define _CXGB_REGS_H_
-
-/* SGE registers */
-#define A_SG_CONTROL 0x0
-
-#define S_CMDQ0_ENABLE    0
-#define V_CMDQ0_ENABLE(x) ((x) << S_CMDQ0_ENABLE)
-#define F_CMDQ0_ENABLE    V_CMDQ0_ENABLE(1U)
-
-#define S_CMDQ1_ENABLE    1
-#define V_CMDQ1_ENABLE(x) ((x) << S_CMDQ1_ENABLE)
-#define F_CMDQ1_ENABLE    V_CMDQ1_ENABLE(1U)
-
-#define S_FL0_ENABLE    2
-#define V_FL0_ENABLE(x) ((x) << S_FL0_ENABLE)
-#define F_FL0_ENABLE    V_FL0_ENABLE(1U)
-
-#define S_FL1_ENABLE    3
-#define V_FL1_ENABLE(x) ((x) << S_FL1_ENABLE)
-#define F_FL1_ENABLE    V_FL1_ENABLE(1U)
-
-#define S_CPL_ENABLE    4
-#define V_CPL_ENABLE(x) ((x) << S_CPL_ENABLE)
-#define F_CPL_ENABLE    V_CPL_ENABLE(1U)
-
-#define S_RESPONSE_QUEUE_ENABLE    5
-#define V_RESPONSE_QUEUE_ENABLE(x) ((x) << S_RESPONSE_QUEUE_ENABLE)
-#define F_RESPONSE_QUEUE_ENABLE    V_RESPONSE_QUEUE_ENABLE(1U)
-
-#define S_CMDQ_PRIORITY    6
-#define M_CMDQ_PRIORITY    0x3
-#define V_CMDQ_PRIORITY(x) ((x) << S_CMDQ_PRIORITY)
-#define G_CMDQ_PRIORITY(x) (((x) >> S_CMDQ_PRIORITY) & M_CMDQ_PRIORITY)
-
-#define S_DISABLE_CMDQ1_GTS    9
-#define V_DISABLE_CMDQ1_GTS(x) ((x) << S_DISABLE_CMDQ1_GTS)
-#define F_DISABLE_CMDQ1_GTS    V_DISABLE_CMDQ1_GTS(1U)
-
-#define S_DISABLE_FL0_GTS    10
-#define V_DISABLE_FL0_GTS(x) ((x) << S_DISABLE_FL0_GTS)
-#define F_DISABLE_FL0_GTS    V_DISABLE_FL0_GTS(1U)
-
-#define S_DISABLE_FL1_GTS    11
-#define V_DISABLE_FL1_GTS(x) ((x) << S_DISABLE_FL1_GTS)
-#define F_DISABLE_FL1_GTS    V_DISABLE_FL1_GTS(1U)
-
-#define S_ENABLE_BIG_ENDIAN    12
-#define V_ENABLE_BIG_ENDIAN(x) ((x) << S_ENABLE_BIG_ENDIAN)
-#define F_ENABLE_BIG_ENDIAN    V_ENABLE_BIG_ENDIAN(1U)
-
-#define S_ISCSI_COALESCE    14
-#define V_ISCSI_COALESCE(x) ((x) << S_ISCSI_COALESCE)
-#define F_ISCSI_COALESCE    V_ISCSI_COALESCE(1U)
-
-#define S_RX_PKT_OFFSET    15
-#define V_RX_PKT_OFFSET(x) ((x) << S_RX_PKT_OFFSET)
-
-#define S_VLAN_XTRACT    18
-#define V_VLAN_XTRACT(x) ((x) << S_VLAN_XTRACT)
-#define F_VLAN_XTRACT    V_VLAN_XTRACT(1U)
-
-#define A_SG_DOORBELL 0x4
-#define A_SG_CMD0BASELWR 0x8
-#define A_SG_CMD0BASEUPR 0xc
-#define A_SG_CMD1BASELWR 0x10
-#define A_SG_CMD1BASEUPR 0x14
-#define A_SG_FL0BASELWR 0x18
-#define A_SG_FL0BASEUPR 0x1c
-#define A_SG_FL1BASELWR 0x20
-#define A_SG_FL1BASEUPR 0x24
-#define A_SG_CMD0SIZE 0x28
-#define A_SG_FL0SIZE 0x2c
-#define A_SG_RSPSIZE 0x30
-#define A_SG_RSPBASELWR 0x34
-#define A_SG_RSPBASEUPR 0x38
-#define A_SG_FLTHRESHOLD 0x3c
-#define A_SG_RSPQUEUECREDIT 0x40
-#define A_SG_SLEEPING 0x48
-#define A_SG_INTRTIMER 0x4c
-#define A_SG_CMD1SIZE 0xb0
-#define A_SG_FL1SIZE 0xb4
-#define A_SG_INT_ENABLE 0xb8
-
-#define S_RESPQ_EXHAUSTED    0
-#define V_RESPQ_EXHAUSTED(x) ((x) << S_RESPQ_EXHAUSTED)
-#define F_RESPQ_EXHAUSTED    V_RESPQ_EXHAUSTED(1U)
-
-#define S_RESPQ_OVERFLOW    1
-#define V_RESPQ_OVERFLOW(x) ((x) << S_RESPQ_OVERFLOW)
-#define F_RESPQ_OVERFLOW    V_RESPQ_OVERFLOW(1U)
-
-#define S_FL_EXHAUSTED    2
-#define V_FL_EXHAUSTED(x) ((x) << S_FL_EXHAUSTED)
-#define F_FL_EXHAUSTED    V_FL_EXHAUSTED(1U)
-
-#define S_PACKET_TOO_BIG    3
-#define V_PACKET_TOO_BIG(x) ((x) << S_PACKET_TOO_BIG)
-#define F_PACKET_TOO_BIG    V_PACKET_TOO_BIG(1U)
-
-#define S_PACKET_MISMATCH    4
-#define V_PACKET_MISMATCH(x) ((x) << S_PACKET_MISMATCH)
-#define F_PACKET_MISMATCH    V_PACKET_MISMATCH(1U)
-
-#define A_SG_INT_CAUSE 0xbc
-#define A_SG_RESPACCUTIMER 0xc0
-
-/* MC3 registers */
-
-#define S_READY    1
-#define V_READY(x) ((x) << S_READY)
-#define F_READY    V_READY(1U)
-
-/* MC4 registers */
-
-#define A_MC4_CFG 0x180
-#define S_MC4_SLOW    25
-#define V_MC4_SLOW(x) ((x) << S_MC4_SLOW)
-#define F_MC4_SLOW    V_MC4_SLOW(1U)
-
-/* TPI registers */
-
-#define A_TPI_ADDR 0x280
-#define A_TPI_WR_DATA 0x284
-#define A_TPI_RD_DATA 0x288
-#define A_TPI_CSR 0x28c
-
-#define S_TPIWR    0
-#define V_TPIWR(x) ((x) << S_TPIWR)
-#define F_TPIWR    V_TPIWR(1U)
-
-#define S_TPIRDY    1
-#define V_TPIRDY(x) ((x) << S_TPIRDY)
-#define F_TPIRDY    V_TPIRDY(1U)
-
-#define A_TPI_PAR 0x29c
-
-#define S_TPIPAR    0
-#define M_TPIPAR    0x7f
-#define V_TPIPAR(x) ((x) << S_TPIPAR)
-#define G_TPIPAR(x) (((x) >> S_TPIPAR) & M_TPIPAR)
-
-/* TP registers */
-
-#define A_TP_IN_CONFIG 0x300
-
-#define S_TP_IN_CSPI_CPL    3
-#define V_TP_IN_CSPI_CPL(x) ((x) << S_TP_IN_CSPI_CPL)
-#define F_TP_IN_CSPI_CPL    V_TP_IN_CSPI_CPL(1U)
-
-#define S_TP_IN_CSPI_CHECK_IP_CSUM    5
-#define V_TP_IN_CSPI_CHECK_IP_CSUM(x) ((x) << S_TP_IN_CSPI_CHECK_IP_CSUM)
-#define F_TP_IN_CSPI_CHECK_IP_CSUM    V_TP_IN_CSPI_CHECK_IP_CSUM(1U)
-
-#define S_TP_IN_CSPI_CHECK_TCP_CSUM    6
-#define V_TP_IN_CSPI_CHECK_TCP_CSUM(x) ((x) << S_TP_IN_CSPI_CHECK_TCP_CSUM)
-#define F_TP_IN_CSPI_CHECK_TCP_CSUM    V_TP_IN_CSPI_CHECK_TCP_CSUM(1U)
-
-#define S_TP_IN_ESPI_ETHERNET    8
-#define V_TP_IN_ESPI_ETHERNET(x) ((x) << S_TP_IN_ESPI_ETHERNET)
-#define F_TP_IN_ESPI_ETHERNET    V_TP_IN_ESPI_ETHERNET(1U)
-
-#define S_TP_IN_ESPI_CHECK_IP_CSUM    12
-#define V_TP_IN_ESPI_CHECK_IP_CSUM(x) ((x) << S_TP_IN_ESPI_CHECK_IP_CSUM)
-#define F_TP_IN_ESPI_CHECK_IP_CSUM    V_TP_IN_ESPI_CHECK_IP_CSUM(1U)
-
-#define S_TP_IN_ESPI_CHECK_TCP_CSUM    13
-#define V_TP_IN_ESPI_CHECK_TCP_CSUM(x) ((x) << S_TP_IN_ESPI_CHECK_TCP_CSUM)
-#define F_TP_IN_ESPI_CHECK_TCP_CSUM    V_TP_IN_ESPI_CHECK_TCP_CSUM(1U)
-
-#define S_OFFLOAD_DISABLE    14
-#define V_OFFLOAD_DISABLE(x) ((x) << S_OFFLOAD_DISABLE)
-#define F_OFFLOAD_DISABLE    V_OFFLOAD_DISABLE(1U)
-
-#define A_TP_OUT_CONFIG 0x304
-
-#define S_TP_OUT_CSPI_CPL    2
-#define V_TP_OUT_CSPI_CPL(x) ((x) << S_TP_OUT_CSPI_CPL)
-#define F_TP_OUT_CSPI_CPL    V_TP_OUT_CSPI_CPL(1U)
-
-#define S_TP_OUT_ESPI_ETHERNET    6
-#define V_TP_OUT_ESPI_ETHERNET(x) ((x) << S_TP_OUT_ESPI_ETHERNET)
-#define F_TP_OUT_ESPI_ETHERNET    V_TP_OUT_ESPI_ETHERNET(1U)
-
-#define S_TP_OUT_ESPI_GENERATE_IP_CSUM    10
-#define V_TP_OUT_ESPI_GENERATE_IP_CSUM(x) ((x) << S_TP_OUT_ESPI_GENERATE_IP_CSUM)
-#define F_TP_OUT_ESPI_GENERATE_IP_CSUM    V_TP_OUT_ESPI_GENERATE_IP_CSUM(1U)
-
-#define S_TP_OUT_ESPI_GENERATE_TCP_CSUM    11
-#define V_TP_OUT_ESPI_GENERATE_TCP_CSUM(x) ((x) << S_TP_OUT_ESPI_GENERATE_TCP_CSUM)
-#define F_TP_OUT_ESPI_GENERATE_TCP_CSUM    V_TP_OUT_ESPI_GENERATE_TCP_CSUM(1U)
-
-#define A_TP_GLOBAL_CONFIG 0x308
-
-#define S_IP_TTL    0
-#define M_IP_TTL    0xff
-#define V_IP_TTL(x) ((x) << S_IP_TTL)
-
-#define S_TCP_CSUM    11
-#define V_TCP_CSUM(x) ((x) << S_TCP_CSUM)
-#define F_TCP_CSUM    V_TCP_CSUM(1U)
-
-#define S_UDP_CSUM    12
-#define V_UDP_CSUM(x) ((x) << S_UDP_CSUM)
-#define F_UDP_CSUM    V_UDP_CSUM(1U)
-
-#define S_IP_CSUM    13
-#define V_IP_CSUM(x) ((x) << S_IP_CSUM)
-#define F_IP_CSUM    V_IP_CSUM(1U)
-
-#define S_PATH_MTU    15
-#define V_PATH_MTU(x) ((x) << S_PATH_MTU)
-#define F_PATH_MTU    V_PATH_MTU(1U)
-
-#define S_5TUPLE_LOOKUP    17
-#define V_5TUPLE_LOOKUP(x) ((x) << S_5TUPLE_LOOKUP)
-
-#define S_SYN_COOKIE_PARAMETER    26
-#define V_SYN_COOKIE_PARAMETER(x) ((x) << S_SYN_COOKIE_PARAMETER)
-
-#define A_TP_PC_CONFIG 0x348
-#define S_DIS_TX_FILL_WIN_PUSH    12
-#define V_DIS_TX_FILL_WIN_PUSH(x) ((x) << S_DIS_TX_FILL_WIN_PUSH)
-#define F_DIS_TX_FILL_WIN_PUSH    V_DIS_TX_FILL_WIN_PUSH(1U)
-
-#define S_TP_PC_REV    30
-#define M_TP_PC_REV    0x3
-#define G_TP_PC_REV(x) (((x) >> S_TP_PC_REV) & M_TP_PC_REV)
-#define A_TP_RESET 0x44c
-#define S_TP_RESET    0
-#define V_TP_RESET(x) ((x) << S_TP_RESET)
-#define F_TP_RESET    V_TP_RESET(1U)
-
-#define A_TP_INT_ENABLE 0x470
-#define A_TP_INT_CAUSE 0x474
-#define A_TP_TX_DROP_CONFIG 0x4b8
-
-#define S_ENABLE_TX_DROP    31
-#define V_ENABLE_TX_DROP(x) ((x) << S_ENABLE_TX_DROP)
-#define F_ENABLE_TX_DROP    V_ENABLE_TX_DROP(1U)
-
-#define S_ENABLE_TX_ERROR    30
-#define V_ENABLE_TX_ERROR(x) ((x) << S_ENABLE_TX_ERROR)
-#define F_ENABLE_TX_ERROR    V_ENABLE_TX_ERROR(1U)
-
-#define S_DROP_TICKS_CNT    4
-#define V_DROP_TICKS_CNT(x) ((x) << S_DROP_TICKS_CNT)
-
-#define S_NUM_PKTS_DROPPED    0
-#define V_NUM_PKTS_DROPPED(x) ((x) << S_NUM_PKTS_DROPPED)
-
-/* CSPI registers */
-
-#define S_DIP4ERR    0
-#define V_DIP4ERR(x) ((x) << S_DIP4ERR)
-#define F_DIP4ERR    V_DIP4ERR(1U)
-
-#define S_RXDROP    1
-#define V_RXDROP(x) ((x) << S_RXDROP)
-#define F_RXDROP    V_RXDROP(1U)
-
-#define S_TXDROP    2
-#define V_TXDROP(x) ((x) << S_TXDROP)
-#define F_TXDROP    V_TXDROP(1U)
-
-#define S_RXOVERFLOW    3
-#define V_RXOVERFLOW(x) ((x) << S_RXOVERFLOW)
-#define F_RXOVERFLOW    V_RXOVERFLOW(1U)
-
-#define S_RAMPARITYERR    4
-#define V_RAMPARITYERR(x) ((x) << S_RAMPARITYERR)
-#define F_RAMPARITYERR    V_RAMPARITYERR(1U)
-
-/* ESPI registers */
-
-#define A_ESPI_SCH_TOKEN0 0x880
-#define A_ESPI_SCH_TOKEN1 0x884
-#define A_ESPI_SCH_TOKEN2 0x888
-#define A_ESPI_SCH_TOKEN3 0x88c
-#define A_ESPI_RX_FIFO_ALMOST_EMPTY_WATERMARK 0x890
-#define A_ESPI_RX_FIFO_ALMOST_FULL_WATERMARK 0x894
-#define A_ESPI_CALENDAR_LENGTH 0x898
-#define A_PORT_CONFIG 0x89c
-
-#define S_RX_NPORTS    0
-#define V_RX_NPORTS(x) ((x) << S_RX_NPORTS)
-
-#define S_TX_NPORTS    8
-#define V_TX_NPORTS(x) ((x) << S_TX_NPORTS)
-
-#define A_ESPI_FIFO_STATUS_ENABLE 0x8a0
-
-#define S_RXSTATUSENABLE    0
-#define V_RXSTATUSENABLE(x) ((x) << S_RXSTATUSENABLE)
-#define F_RXSTATUSENABLE    V_RXSTATUSENABLE(1U)
-
-#define S_INTEL1010MODE    4
-#define V_INTEL1010MODE(x) ((x) << S_INTEL1010MODE)
-#define F_INTEL1010MODE    V_INTEL1010MODE(1U)
-
-#define A_ESPI_MAXBURST1_MAXBURST2 0x8a8
-#define A_ESPI_TRAIN 0x8ac
-#define A_ESPI_INTR_STATUS 0x8c8
-
-#define S_DIP2PARITYERR    5
-#define V_DIP2PARITYERR(x) ((x) << S_DIP2PARITYERR)
-#define F_DIP2PARITYERR    V_DIP2PARITYERR(1U)
-
-#define A_ESPI_INTR_ENABLE 0x8cc
-#define A_RX_DROP_THRESHOLD 0x8d0
-#define A_ESPI_RX_RESET 0x8ec
-#define A_ESPI_MISC_CONTROL 0x8f0
-
-#define S_OUT_OF_SYNC_COUNT    0
-#define V_OUT_OF_SYNC_COUNT(x) ((x) << S_OUT_OF_SYNC_COUNT)
-
-#define S_DIP2_PARITY_ERR_THRES    5
-#define V_DIP2_PARITY_ERR_THRES(x) ((x) << S_DIP2_PARITY_ERR_THRES)
-
-#define S_DIP4_THRES    9
-#define V_DIP4_THRES(x) ((x) << S_DIP4_THRES)
-
-#define S_MONITORED_PORT_NUM    25
-#define V_MONITORED_PORT_NUM(x) ((x) << S_MONITORED_PORT_NUM)
-
-#define S_MONITORED_DIRECTION    27
-#define V_MONITORED_DIRECTION(x) ((x) << S_MONITORED_DIRECTION)
-#define F_MONITORED_DIRECTION    V_MONITORED_DIRECTION(1U)
-
-#define S_MONITORED_INTERFACE    28
-#define V_MONITORED_INTERFACE(x) ((x) << S_MONITORED_INTERFACE)
-#define F_MONITORED_INTERFACE    V_MONITORED_INTERFACE(1U)
-
-#define A_ESPI_DIP2_ERR_COUNT 0x8f4
-#define A_ESPI_CMD_ADDR 0x8f8
-
-#define S_WRITE_DATA    0
-#define V_WRITE_DATA(x) ((x) << S_WRITE_DATA)
-
-#define S_REGISTER_OFFSET    8
-#define V_REGISTER_OFFSET(x) ((x) << S_REGISTER_OFFSET)
-
-#define S_CHANNEL_ADDR    12
-#define V_CHANNEL_ADDR(x) ((x) << S_CHANNEL_ADDR)
-
-#define S_MODULE_ADDR    16
-#define V_MODULE_ADDR(x) ((x) << S_MODULE_ADDR)
-
-#define S_BUNDLE_ADDR    20
-#define V_BUNDLE_ADDR(x) ((x) << S_BUNDLE_ADDR)
-
-#define S_SPI4_COMMAND    24
-#define V_SPI4_COMMAND(x) ((x) << S_SPI4_COMMAND)
-
-#define A_ESPI_GOSTAT 0x8fc
-#define S_ESPI_CMD_BUSY    8
-#define V_ESPI_CMD_BUSY(x) ((x) << S_ESPI_CMD_BUSY)
-#define F_ESPI_CMD_BUSY    V_ESPI_CMD_BUSY(1U)
-
-/* PL registers */
-
-#define A_PL_ENABLE 0xa00
-
-#define S_PL_INTR_SGE_ERR    0
-#define V_PL_INTR_SGE_ERR(x) ((x) << S_PL_INTR_SGE_ERR)
-#define F_PL_INTR_SGE_ERR    V_PL_INTR_SGE_ERR(1U)
-
-#define S_PL_INTR_SGE_DATA    1
-#define V_PL_INTR_SGE_DATA(x) ((x) << S_PL_INTR_SGE_DATA)
-#define F_PL_INTR_SGE_DATA    V_PL_INTR_SGE_DATA(1U)
-
-#define S_PL_INTR_TP    6
-#define V_PL_INTR_TP(x) ((x) << S_PL_INTR_TP)
-#define F_PL_INTR_TP    V_PL_INTR_TP(1U)
-
-#define S_PL_INTR_ESPI    8
-#define V_PL_INTR_ESPI(x) ((x) << S_PL_INTR_ESPI)
-#define F_PL_INTR_ESPI    V_PL_INTR_ESPI(1U)
-
-#define S_PL_INTR_PCIX    10
-#define V_PL_INTR_PCIX(x) ((x) << S_PL_INTR_PCIX)
-#define F_PL_INTR_PCIX    V_PL_INTR_PCIX(1U)
-
-#define S_PL_INTR_EXT    11
-#define V_PL_INTR_EXT(x) ((x) << S_PL_INTR_EXT)
-#define F_PL_INTR_EXT    V_PL_INTR_EXT(1U)
-
-#define A_PL_CAUSE 0xa04
-
-/* MC5 registers */
-
-#define A_MC5_CONFIG 0xc04
-
-#define S_TCAM_RESET    1
-#define V_TCAM_RESET(x) ((x) << S_TCAM_RESET)
-#define F_TCAM_RESET    V_TCAM_RESET(1U)
-
-#define S_M_BUS_ENABLE    5
-#define V_M_BUS_ENABLE(x) ((x) << S_M_BUS_ENABLE)
-#define F_M_BUS_ENABLE    V_M_BUS_ENABLE(1U)
-
-/* PCICFG registers */
-
-#define A_PCICFG_PM_CSR 0x44
-#define A_PCICFG_VPD_ADDR 0x4a
-
-#define S_VPD_OP_FLAG    15
-#define V_VPD_OP_FLAG(x) ((x) << S_VPD_OP_FLAG)
-#define F_VPD_OP_FLAG    V_VPD_OP_FLAG(1U)
-
-#define A_PCICFG_VPD_DATA 0x4c
-
-#define A_PCICFG_INTR_ENABLE 0xf4
-#define A_PCICFG_INTR_CAUSE 0xf8
-
-#define A_PCICFG_MODE 0xfc
-
-#define S_PCI_MODE_64BIT    0
-#define V_PCI_MODE_64BIT(x) ((x) << S_PCI_MODE_64BIT)
-#define F_PCI_MODE_64BIT    V_PCI_MODE_64BIT(1U)
-
-#define S_PCI_MODE_PCIX    5
-#define V_PCI_MODE_PCIX(x) ((x) << S_PCI_MODE_PCIX)
-#define F_PCI_MODE_PCIX    V_PCI_MODE_PCIX(1U)
-
-#define S_PCI_MODE_CLK    6
-#define M_PCI_MODE_CLK    0x3
-#define G_PCI_MODE_CLK(x) (((x) >> S_PCI_MODE_CLK) & M_PCI_MODE_CLK)
-
-#endif /* _CXGB_REGS_H_ */
diff --git a/trunk/drivers/net/chelsio/sge.c b/trunk/drivers/net/chelsio/sge.c
deleted file mode 100644
index 53b41d99b00b..000000000000
--- a/trunk/drivers/net/chelsio/sge.c
+++ /dev/null
@@ -1,1684 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: sge.c                                                               *
- * $Revision: 1.26 $                                                         *
- * $Date: 2005/06/21 18:29:48 $                                              *
- * Description:                                                              *
- *  DMA engine.                                                              *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#include "common.h"
-
-#include <linux/config.h>
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/pci.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/if_vlan.h>
-#include <linux/skbuff.h>
-#include <linux/init.h>
-#include <linux/mm.h>
-#include <linux/ip.h>
-#include <linux/in.h>
-#include <linux/if_arp.h>
-
-#include "cpl5_cmd.h"
-#include "sge.h"
-#include "regs.h"
-#include "espi.h"
-
-
-#ifdef NETIF_F_TSO
-#include <linux/tcp.h>
-#endif
-
-#define SGE_CMDQ_N		2
-#define SGE_FREELQ_N		2
-#define SGE_CMDQ0_E_N		1024
-#define SGE_CMDQ1_E_N		128
-#define SGE_FREEL_SIZE		4096
-#define SGE_JUMBO_FREEL_SIZE	512
-#define SGE_FREEL_REFILL_THRESH	16
-#define SGE_RESPQ_E_N		1024
-#define SGE_INTRTIMER_NRES	1000
-#define SGE_RX_COPY_THRES	256
-#define SGE_RX_SM_BUF_SIZE	1536
-
-# define SGE_RX_DROP_THRES 2
-
-#define SGE_RESPQ_REPLENISH_THRES (SGE_RESPQ_E_N / 4)
-
-/*
- * Period of the TX buffer reclaim timer.  This timer does not need to run
- * frequently as TX buffers are usually reclaimed by new TX packets.
- */
-#define TX_RECLAIM_PERIOD (HZ / 4)
-
-#ifndef NET_IP_ALIGN
-# define NET_IP_ALIGN 2
-#endif
-
-#define M_CMD_LEN       0x7fffffff
-#define V_CMD_LEN(v)    (v)
-#define G_CMD_LEN(v)    ((v) & M_CMD_LEN)
-#define V_CMD_GEN1(v)   ((v) << 31)
-#define V_CMD_GEN2(v)   (v)
-#define F_CMD_DATAVALID (1 << 1)
-#define F_CMD_SOP       (1 << 2)
-#define V_CMD_EOP(v)    ((v) << 3)
-
-/*
- * Command queue, receive buffer list, and response queue descriptors.
- */
-#if defined(__BIG_ENDIAN_BITFIELD)
-struct cmdQ_e {
-	u32 addr_lo;
-	u32 len_gen;
-	u32 flags;
-	u32 addr_hi;
-};
-
-struct freelQ_e {
-	u32 addr_lo;
-	u32 len_gen;
-	u32 gen2;
-	u32 addr_hi;
-};
-
-struct respQ_e {
-	u32 Qsleeping		: 4;
-	u32 Cmdq1CreditReturn	: 5;
-	u32 Cmdq1DmaComplete	: 5;
-	u32 Cmdq0CreditReturn	: 5;
-	u32 Cmdq0DmaComplete	: 5;
-	u32 FreelistQid		: 2;
-	u32 CreditValid		: 1;
-	u32 DataValid		: 1;
-	u32 Offload		: 1;
-	u32 Eop			: 1;
-	u32 Sop			: 1;
-	u32 GenerationBit	: 1;
-	u32 BufferLength;
-};
-#elif defined(__LITTLE_ENDIAN_BITFIELD)
-struct cmdQ_e {
-	u32 len_gen;
-	u32 addr_lo;
-	u32 addr_hi;
-	u32 flags;
-};
-
-struct freelQ_e {
-	u32 len_gen;
-	u32 addr_lo;
-	u32 addr_hi;
-	u32 gen2;
-};
-
-struct respQ_e {
-	u32 BufferLength;
-	u32 GenerationBit	: 1;
-	u32 Sop			: 1;
-	u32 Eop			: 1;
-	u32 Offload		: 1;
-	u32 DataValid		: 1;
-	u32 CreditValid		: 1;
-	u32 FreelistQid		: 2;
-	u32 Cmdq0DmaComplete	: 5;
-	u32 Cmdq0CreditReturn	: 5;
-	u32 Cmdq1DmaComplete	: 5;
-	u32 Cmdq1CreditReturn	: 5;
-	u32 Qsleeping		: 4;
-} ;
-#endif
-
-/*
- * SW Context Command and Freelist Queue Descriptors
- */
-struct cmdQ_ce {
-	struct sk_buff *skb;
-	DECLARE_PCI_UNMAP_ADDR(dma_addr);
-	DECLARE_PCI_UNMAP_LEN(dma_len);
-};
-
-struct freelQ_ce {
-	struct sk_buff *skb;
-	DECLARE_PCI_UNMAP_ADDR(dma_addr);
-	DECLARE_PCI_UNMAP_LEN(dma_len);
-};
-
-/*
- * SW command, freelist and response rings
- */
-struct cmdQ {
-	unsigned long   status;         /* HW DMA fetch status */
-	unsigned int    in_use;         /* # of in-use command descriptors */
-	unsigned int	size;	        /* # of descriptors */
-	unsigned int	processed;      /* total # of descs HW has processed */
-	unsigned int	cleaned;        /* total # of descs SW has reclaimed */
-	unsigned int	stop_thres;     /* SW TX queue suspend threshold */
-	u16		pidx;           /* producer index (SW) */
-	u16		cidx;           /* consumer index (HW) */
-	u8		genbit;         /* current generation (=valid) bit */
-	u8		sop;            /* is next entry start of packet? */
-	struct cmdQ_e  *entries;        /* HW command descriptor Q */
-	struct cmdQ_ce *centries;       /* SW command context descriptor Q */
-	spinlock_t	lock;           /* Lock to protect cmdQ enqueuing */
-	dma_addr_t	dma_addr;       /* DMA addr HW command descriptor Q */
-};
-
-struct freelQ {
-	unsigned int	credits;        /* # of available RX buffers */
-	unsigned int	size;	        /* free list capacity */
-	u16		pidx;           /* producer index (SW) */
-	u16		cidx;           /* consumer index (HW) */
-	u16		rx_buffer_size; /* Buffer size on this free list */
-	u16		dma_offset;     /* DMA offset to align IP headers */
-	u16		recycleq_idx;   /* skb recycle q to use */
-	u8		genbit;	        /* current generation (=valid) bit */
-	struct freelQ_e	*entries;       /* HW freelist descriptor Q */
-	struct freelQ_ce *centries;     /* SW freelist context descriptor Q */
-	dma_addr_t	dma_addr;       /* DMA addr HW freelist descriptor Q */
-};
-
-struct respQ {
-	unsigned int	credits;        /* credits to be returned to SGE */
-	unsigned int	size;	        /* # of response Q descriptors */
-	u16		cidx;	        /* consumer index (SW) */
-	u8		genbit;	        /* current generation(=valid) bit */
-	struct respQ_e *entries;        /* HW response descriptor Q */
-	dma_addr_t	dma_addr;       /* DMA addr HW response descriptor Q */
-};
-
-/* Bit flags for cmdQ.status */
-enum {
-	CMDQ_STAT_RUNNING = 1,          /* fetch engine is running */
-	CMDQ_STAT_LAST_PKT_DB = 2       /* last packet rung the doorbell */
-};
-
-/*
- * Main SGE data structure
- *
- * Interrupts are handled by a single CPU and it is likely that on a MP system
- * the application is migrated to another CPU. In that scenario, we try to
- * seperate the RX(in irq context) and TX state in order to decrease memory
- * contention.
- */
-struct sge {
-	struct adapter *adapter; 	/* adapter backpointer */
-	struct net_device *netdev;      /* netdevice backpointer */
-	struct freelQ 	freelQ[SGE_FREELQ_N]; /* buffer free lists */
-	struct respQ 	respQ;		/* response Q */
-	unsigned long   stopped_tx_queues; /* bitmap of suspended Tx queues */
-	unsigned int	rx_pkt_pad;     /* RX padding for L2 packets */
-	unsigned int	jumbo_fl;       /* jumbo freelist Q index */
-	unsigned int	intrtimer_nres;	/* no-resource interrupt timer */
-	unsigned int	fixed_intrtimer;/* non-adaptive interrupt timer */
-	struct timer_list tx_reclaim_timer; /* reclaims TX buffers */
-	struct timer_list espibug_timer;
-	unsigned int	espibug_timeout;
-	struct sk_buff	*espibug_skb;
-	u32		sge_control;	/* shadow value of sge control reg */
-	struct sge_intr_counts stats;
-	struct sge_port_stats port_stats[MAX_NPORTS];
-	struct cmdQ cmdQ[SGE_CMDQ_N] ____cacheline_aligned_in_smp;
-};
-
-/*
- * PIO to indicate that memory mapped Q contains valid descriptor(s).
- */
-static inline void doorbell_pio(struct adapter *adapter, u32 val)
-{
-	wmb();
-	writel(val, adapter->regs + A_SG_DOORBELL);
-}
-
-/*
- * Frees all RX buffers on the freelist Q. The caller must make sure that
- * the SGE is turned off before calling this function.
- */
-static void free_freelQ_buffers(struct pci_dev *pdev, struct freelQ *q)
-{
-	unsigned int cidx = q->cidx;
-
-	while (q->credits--) {
-		struct freelQ_ce *ce = &q->centries[cidx];
-
-		pci_unmap_single(pdev, pci_unmap_addr(ce, dma_addr),
-				 pci_unmap_len(ce, dma_len),
-				 PCI_DMA_FROMDEVICE);
-		dev_kfree_skb(ce->skb);
-		ce->skb = NULL;
-		if (++cidx == q->size)
-			cidx = 0;
-	}
-}
-
-/*
- * Free RX free list and response queue resources.
- */
-static void free_rx_resources(struct sge *sge)
-{
-	struct pci_dev *pdev = sge->adapter->pdev;
-	unsigned int size, i;
-
-	if (sge->respQ.entries) {
-		size = sizeof(struct respQ_e) * sge->respQ.size;
-		pci_free_consistent(pdev, size, sge->respQ.entries,
-				    sge->respQ.dma_addr);
-	}
-
-	for (i = 0; i < SGE_FREELQ_N; i++) {
-		struct freelQ *q = &sge->freelQ[i];
-
-		if (q->centries) {
-			free_freelQ_buffers(pdev, q);
-			kfree(q->centries);
-		}
-		if (q->entries) {
-			size = sizeof(struct freelQ_e) * q->size;
-			pci_free_consistent(pdev, size, q->entries,
-					    q->dma_addr);
-		}
-	}
-}
-
-/*
- * Allocates basic RX resources, consisting of memory mapped freelist Qs and a
- * response queue.
- */
-static int alloc_rx_resources(struct sge *sge, struct sge_params *p)
-{
-	struct pci_dev *pdev = sge->adapter->pdev;
-	unsigned int size, i;
-
-	for (i = 0; i < SGE_FREELQ_N; i++) {
-		struct freelQ *q = &sge->freelQ[i];
-
-		q->genbit = 1;
-		q->size = p->freelQ_size[i];
-		q->dma_offset = sge->rx_pkt_pad ? 0 : NET_IP_ALIGN;
-		size = sizeof(struct freelQ_e) * q->size;
-		q->entries = (struct freelQ_e *)
-			      pci_alloc_consistent(pdev, size, &q->dma_addr);
-		if (!q->entries)
-			goto err_no_mem;
-		memset(q->entries, 0, size);
-		size = sizeof(struct freelQ_ce) * q->size;
-		q->centries = kmalloc(size, GFP_KERNEL);
-		if (!q->centries)
-			goto err_no_mem;
-		memset(q->centries, 0, size);
-	}
-
-	/*
-	 * Calculate the buffer sizes for the two free lists.  FL0 accommodates
-	 * regular sized Ethernet frames, FL1 is sized not to exceed 16K,
-	 * including all the sk_buff overhead.
-	 *
-	 * Note: For T2 FL0 and FL1 are reversed.
-	 */
-	sge->freelQ[!sge->jumbo_fl].rx_buffer_size = SGE_RX_SM_BUF_SIZE +
-		sizeof(struct cpl_rx_data) +
-		sge->freelQ[!sge->jumbo_fl].dma_offset;
-	sge->freelQ[sge->jumbo_fl].rx_buffer_size = (16 * 1024) -
-		SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-
-	/*
-	 * Setup which skb recycle Q should be used when recycling buffers from
-	 * each free list.
-	 */
-	sge->freelQ[!sge->jumbo_fl].recycleq_idx = 0;
-	sge->freelQ[sge->jumbo_fl].recycleq_idx = 1;
-
-	sge->respQ.genbit = 1;
-	sge->respQ.size = SGE_RESPQ_E_N;
-	sge->respQ.credits = 0;
-	size = sizeof(struct respQ_e) * sge->respQ.size;
-	sge->respQ.entries = (struct respQ_e *)
-		pci_alloc_consistent(pdev, size, &sge->respQ.dma_addr);
-	if (!sge->respQ.entries)
-		goto err_no_mem;
-	memset(sge->respQ.entries, 0, size);
-	return 0;
-
-err_no_mem:
-	free_rx_resources(sge);
-	return -ENOMEM;
-}
-
-/*
- * Reclaims n TX descriptors and frees the buffers associated with them.
- */
-static void free_cmdQ_buffers(struct sge *sge, struct cmdQ *q, unsigned int n)
-{
-	struct cmdQ_ce *ce;
-	struct pci_dev *pdev = sge->adapter->pdev;
-	unsigned int cidx = q->cidx;
-
-	q->in_use -= n;
-	ce = &q->centries[cidx];
-	while (n--) {
-		if (q->sop)
-			pci_unmap_single(pdev, pci_unmap_addr(ce, dma_addr),
-			 		 pci_unmap_len(ce, dma_len),
-					 PCI_DMA_TODEVICE);
-		else
-			pci_unmap_page(pdev, pci_unmap_addr(ce, dma_addr),
-			 	       pci_unmap_len(ce, dma_len),
-				       PCI_DMA_TODEVICE);
-		q->sop = 0;
-		if (ce->skb) {
-			dev_kfree_skb(ce->skb);
-			q->sop = 1;
-		}
-		ce++;
-		if (++cidx == q->size) {
-			cidx = 0;
-			ce = q->centries;
-		}
-	}
-	q->cidx = cidx;
-}
-
-/*
- * Free TX resources.
- *
- * Assumes that SGE is stopped and all interrupts are disabled.
- */
-static void free_tx_resources(struct sge *sge)
-{
-	struct pci_dev *pdev = sge->adapter->pdev;
-	unsigned int size, i;
-
-	for (i = 0; i < SGE_CMDQ_N; i++) {
-		struct cmdQ *q = &sge->cmdQ[i];
-
-		if (q->centries) {
-			if (q->in_use)
-				free_cmdQ_buffers(sge, q, q->in_use);
-			kfree(q->centries);
-		}
-		if (q->entries) {
-			size = sizeof(struct cmdQ_e) * q->size;
-			pci_free_consistent(pdev, size, q->entries,
-					    q->dma_addr);
-		}
-	}
-}
-
-/*
- * Allocates basic TX resources, consisting of memory mapped command Qs.
- */
-static int alloc_tx_resources(struct sge *sge, struct sge_params *p)
-{
-	struct pci_dev *pdev = sge->adapter->pdev;
-	unsigned int size, i;
-
-	for (i = 0; i < SGE_CMDQ_N; i++) {
-		struct cmdQ *q = &sge->cmdQ[i];
-
-		q->genbit = 1;
-		q->sop = 1;
-		q->size = p->cmdQ_size[i];
-		q->in_use = 0;
-		q->status = 0;
-		q->processed = q->cleaned = 0;
-		q->stop_thres = 0;
-		spin_lock_init(&q->lock);
-		size = sizeof(struct cmdQ_e) * q->size;
-		q->entries = (struct cmdQ_e *)
-			      pci_alloc_consistent(pdev, size, &q->dma_addr);
-		if (!q->entries)
-			goto err_no_mem;
-		memset(q->entries, 0, size);
-		size = sizeof(struct cmdQ_ce) * q->size;
-		q->centries = kmalloc(size, GFP_KERNEL);
-		if (!q->centries)
-			goto err_no_mem;
-		memset(q->centries, 0, size);
-	}
-
-	/*
-	 * CommandQ 0 handles Ethernet and TOE packets, while queue 1 is TOE
-	 * only.  For queue 0 set the stop threshold so we can handle one more
-	 * packet from each port, plus reserve an additional 24 entries for
-	 * Ethernet packets only.  Queue 1 never suspends nor do we reserve
-	 * space for Ethernet packets.
-	 */
-	sge->cmdQ[0].stop_thres = sge->adapter->params.nports *
-		(MAX_SKB_FRAGS + 1);
-	return 0;
-
-err_no_mem:
-	free_tx_resources(sge);
-	return -ENOMEM;
-}
-
-static inline void setup_ring_params(struct adapter *adapter, u64 addr,
-				     u32 size, int base_reg_lo,
-				     int base_reg_hi, int size_reg)
-{
-	writel((u32)addr, adapter->regs + base_reg_lo);
-	writel(addr >> 32, adapter->regs + base_reg_hi);
-	writel(size, adapter->regs + size_reg);
-}
-
-/*
- * Enable/disable VLAN acceleration.
- */
-void t1_set_vlan_accel(struct adapter *adapter, int on_off)
-{
-	struct sge *sge = adapter->sge;
-
-	sge->sge_control &= ~F_VLAN_XTRACT;
-	if (on_off)
-		sge->sge_control |= F_VLAN_XTRACT;
-	if (adapter->open_device_map) {
-		writel(sge->sge_control, adapter->regs + A_SG_CONTROL);
-		readl(adapter->regs + A_SG_CONTROL); /* flush */
-	}
-}
-
-/*
- * Programs the various SGE registers. However, the engine is not yet enabled,
- * but sge->sge_control is setup and ready to go.
- */
-static void configure_sge(struct sge *sge, struct sge_params *p)
-{
-	struct adapter *ap = sge->adapter;
-	
-	writel(0, ap->regs + A_SG_CONTROL);
-	setup_ring_params(ap, sge->cmdQ[0].dma_addr, sge->cmdQ[0].size,
-			  A_SG_CMD0BASELWR, A_SG_CMD0BASEUPR, A_SG_CMD0SIZE);
-	setup_ring_params(ap, sge->cmdQ[1].dma_addr, sge->cmdQ[1].size,
-			  A_SG_CMD1BASELWR, A_SG_CMD1BASEUPR, A_SG_CMD1SIZE);
-	setup_ring_params(ap, sge->freelQ[0].dma_addr,
-			  sge->freelQ[0].size, A_SG_FL0BASELWR,
-			  A_SG_FL0BASEUPR, A_SG_FL0SIZE);
-	setup_ring_params(ap, sge->freelQ[1].dma_addr,
-			  sge->freelQ[1].size, A_SG_FL1BASELWR,
-			  A_SG_FL1BASEUPR, A_SG_FL1SIZE);
-
-	/* The threshold comparison uses <. */
-	writel(SGE_RX_SM_BUF_SIZE + 1, ap->regs + A_SG_FLTHRESHOLD);
-
-	setup_ring_params(ap, sge->respQ.dma_addr, sge->respQ.size,
-			  A_SG_RSPBASELWR, A_SG_RSPBASEUPR, A_SG_RSPSIZE);
-	writel((u32)sge->respQ.size - 1, ap->regs + A_SG_RSPQUEUECREDIT);
-
-	sge->sge_control = F_CMDQ0_ENABLE | F_CMDQ1_ENABLE | F_FL0_ENABLE |
-		F_FL1_ENABLE | F_CPL_ENABLE | F_RESPONSE_QUEUE_ENABLE |
-		V_CMDQ_PRIORITY(2) | F_DISABLE_CMDQ1_GTS | F_ISCSI_COALESCE |
-		F_DISABLE_FL0_GTS | F_DISABLE_FL1_GTS |
-		V_RX_PKT_OFFSET(sge->rx_pkt_pad);
-
-#if defined(__BIG_ENDIAN_BITFIELD)
-	sge->sge_control |= F_ENABLE_BIG_ENDIAN;
-#endif
-
-	/* Initialize no-resource timer */
-	sge->intrtimer_nres = SGE_INTRTIMER_NRES * core_ticks_per_usec(ap);
-
-	t1_sge_set_coalesce_params(sge, p);
-}
-
-/*
- * Return the payload capacity of the jumbo free-list buffers.
- */
-static inline unsigned int jumbo_payload_capacity(const struct sge *sge)
-{
-	return sge->freelQ[sge->jumbo_fl].rx_buffer_size -
-		sge->freelQ[sge->jumbo_fl].dma_offset -
-		sizeof(struct cpl_rx_data);
-}
-
-/*
- * Frees all SGE related resources and the sge structure itself
- */
-void t1_sge_destroy(struct sge *sge)
-{
-	if (sge->espibug_skb)
-		kfree_skb(sge->espibug_skb);
-
-	free_tx_resources(sge);
-	free_rx_resources(sge);
-	kfree(sge);
-}
-
-/*
- * Allocates new RX buffers on the freelist Q (and tracks them on the freelist
- * context Q) until the Q is full or alloc_skb fails.
- *
- * It is possible that the generation bits already match, indicating that the
- * buffer is already valid and nothing needs to be done. This happens when we
- * copied a received buffer into a new sk_buff during the interrupt processing.
- *
- * If the SGE doesn't automatically align packets properly (!sge->rx_pkt_pad),
- * we specify a RX_OFFSET in order to make sure that the IP header is 4B
- * aligned.
- */
-static void refill_free_list(struct sge *sge, struct freelQ *q)
-{
-	struct pci_dev *pdev = sge->adapter->pdev;
-	struct freelQ_ce *ce = &q->centries[q->pidx];
-	struct freelQ_e *e = &q->entries[q->pidx];
-	unsigned int dma_len = q->rx_buffer_size - q->dma_offset;
-
-
-	while (q->credits < q->size) {
-		struct sk_buff *skb;
-		dma_addr_t mapping;
-
-		skb = alloc_skb(q->rx_buffer_size, GFP_ATOMIC);
-		if (!skb)
-			break;
-
-		skb_reserve(skb, q->dma_offset);
-		mapping = pci_map_single(pdev, skb->data, dma_len,
-					 PCI_DMA_FROMDEVICE);
-		ce->skb = skb;
-		pci_unmap_addr_set(ce, dma_addr, mapping);
-		pci_unmap_len_set(ce, dma_len, dma_len);
-		e->addr_lo = (u32)mapping;
-		e->addr_hi = (u64)mapping >> 32;
-		e->len_gen = V_CMD_LEN(dma_len) | V_CMD_GEN1(q->genbit);
-		wmb();
-		e->gen2 = V_CMD_GEN2(q->genbit);
-
-		e++;
-		ce++;
-		if (++q->pidx == q->size) {
-			q->pidx = 0;
-			q->genbit ^= 1;
-			ce = q->centries;
-			e = q->entries;
-		}
-		q->credits++;
-	}
-
-}
-
-/*
- * Calls refill_free_list for both free lists. If we cannot fill at least 1/4
- * of both rings, we go into 'few interrupt mode' in order to give the system
- * time to free up resources.
- */
-static void freelQs_empty(struct sge *sge)
-{
-	struct adapter *adapter = sge->adapter;
-	u32 irq_reg = readl(adapter->regs + A_SG_INT_ENABLE);
-	u32 irqholdoff_reg;
-
-	refill_free_list(sge, &sge->freelQ[0]);
-	refill_free_list(sge, &sge->freelQ[1]);
-
-	if (sge->freelQ[0].credits > (sge->freelQ[0].size >> 2) &&
-	    sge->freelQ[1].credits > (sge->freelQ[1].size >> 2)) {
-		irq_reg |= F_FL_EXHAUSTED;
-		irqholdoff_reg = sge->fixed_intrtimer;
-	} else {
-		/* Clear the F_FL_EXHAUSTED interrupts for now */
-		irq_reg &= ~F_FL_EXHAUSTED;
-		irqholdoff_reg = sge->intrtimer_nres;
-	}
-	writel(irqholdoff_reg, adapter->regs + A_SG_INTRTIMER);
-	writel(irq_reg, adapter->regs + A_SG_INT_ENABLE);
-
-	/* We reenable the Qs to force a freelist GTS interrupt later */
-	doorbell_pio(adapter, F_FL0_ENABLE | F_FL1_ENABLE);
-}
-
-#define SGE_PL_INTR_MASK (F_PL_INTR_SGE_ERR | F_PL_INTR_SGE_DATA)
-#define SGE_INT_FATAL (F_RESPQ_OVERFLOW | F_PACKET_TOO_BIG | F_PACKET_MISMATCH)
-#define SGE_INT_ENABLE (F_RESPQ_EXHAUSTED | F_RESPQ_OVERFLOW | \
-			F_FL_EXHAUSTED | F_PACKET_TOO_BIG | F_PACKET_MISMATCH)
-
-/*
- * Disable SGE Interrupts
- */
-void t1_sge_intr_disable(struct sge *sge)
-{
-	u32 val = readl(sge->adapter->regs + A_PL_ENABLE);
-
-	writel(val & ~SGE_PL_INTR_MASK, sge->adapter->regs + A_PL_ENABLE);
-	writel(0, sge->adapter->regs + A_SG_INT_ENABLE);
-}
-
-/*
- * Enable SGE interrupts.
- */
-void t1_sge_intr_enable(struct sge *sge)
-{
-	u32 en = SGE_INT_ENABLE;
-	u32 val = readl(sge->adapter->regs + A_PL_ENABLE);
-
-	if (sge->adapter->flags & TSO_CAPABLE)
-		en &= ~F_PACKET_TOO_BIG;
-	writel(en, sge->adapter->regs + A_SG_INT_ENABLE);
-	writel(val | SGE_PL_INTR_MASK, sge->adapter->regs + A_PL_ENABLE);
-}
-
-/*
- * Clear SGE interrupts.
- */
-void t1_sge_intr_clear(struct sge *sge)
-{
-	writel(SGE_PL_INTR_MASK, sge->adapter->regs + A_PL_CAUSE);
-	writel(0xffffffff, sge->adapter->regs + A_SG_INT_CAUSE);
-}
-
-/*
- * SGE 'Error' interrupt handler
- */
-int t1_sge_intr_error_handler(struct sge *sge)
-{
-	struct adapter *adapter = sge->adapter;
-	u32 cause = readl(adapter->regs + A_SG_INT_CAUSE);
-
-	if (adapter->flags & TSO_CAPABLE)
-		cause &= ~F_PACKET_TOO_BIG;
-	if (cause & F_RESPQ_EXHAUSTED)
-		sge->stats.respQ_empty++;
-	if (cause & F_RESPQ_OVERFLOW) {
-		sge->stats.respQ_overflow++;
-		CH_ALERT("%s: SGE response queue overflow\n",
-			 adapter->name);
-	}
-	if (cause & F_FL_EXHAUSTED) {
-		sge->stats.freelistQ_empty++;
-		freelQs_empty(sge);
-	}
-	if (cause & F_PACKET_TOO_BIG) {
-		sge->stats.pkt_too_big++;
-		CH_ALERT("%s: SGE max packet size exceeded\n",
-			 adapter->name);
-	}
-	if (cause & F_PACKET_MISMATCH) {
-		sge->stats.pkt_mismatch++;
-		CH_ALERT("%s: SGE packet mismatch\n", adapter->name);
-	}
-	if (cause & SGE_INT_FATAL)
-		t1_fatal_err(adapter);
-
-	writel(cause, adapter->regs + A_SG_INT_CAUSE);
-	return 0;
-}
-
-const struct sge_intr_counts *t1_sge_get_intr_counts(struct sge *sge)
-{
-	return &sge->stats;
-}
-
-const struct sge_port_stats *t1_sge_get_port_stats(struct sge *sge, int port)
-{
-	return &sge->port_stats[port];
-}
-
-/**
- *	recycle_fl_buf - recycle a free list buffer
- *	@fl: the free list
- *	@idx: index of buffer to recycle
- *
- *	Recycles the specified buffer on the given free list by adding it at
- *	the next available slot on the list.
- */
-static void recycle_fl_buf(struct freelQ *fl, int idx)
-{
-	struct freelQ_e *from = &fl->entries[idx];
-	struct freelQ_e *to = &fl->entries[fl->pidx];
-
-	fl->centries[fl->pidx] = fl->centries[idx];
-	to->addr_lo = from->addr_lo;
-	to->addr_hi = from->addr_hi;
-	to->len_gen = G_CMD_LEN(from->len_gen) | V_CMD_GEN1(fl->genbit);
-	wmb();
-	to->gen2 = V_CMD_GEN2(fl->genbit);
-	fl->credits++;
-
-	if (++fl->pidx == fl->size) {
-		fl->pidx = 0;
-		fl->genbit ^= 1;
-	}
-}
-
-/**
- *	get_packet - return the next ingress packet buffer
- *	@pdev: the PCI device that received the packet
- *	@fl: the SGE free list holding the packet
- *	@len: the actual packet length, excluding any SGE padding
- *	@dma_pad: padding at beginning of buffer left by SGE DMA
- *	@skb_pad: padding to be used if the packet is copied
- *	@copy_thres: length threshold under which a packet should be copied
- *	@drop_thres: # of remaining buffers before we start dropping packets
- *
- *	Get the next packet from a free list and complete setup of the
- *	sk_buff.  If the packet is small we make a copy and recycle the
- *	original buffer, otherwise we use the original buffer itself.  If a
- *	positive drop threshold is supplied packets are dropped and their
- *	buffers recycled if (a) the number of remaining buffers is under the
- *	threshold and the packet is too big to copy, or (b) the packet should
- *	be copied but there is no memory for the copy.
- */
-static inline struct sk_buff *get_packet(struct pci_dev *pdev,
-					 struct freelQ *fl, unsigned int len,
-					 int dma_pad, int skb_pad,
-					 unsigned int copy_thres,
-					 unsigned int drop_thres)
-{
-	struct sk_buff *skb;
-	struct freelQ_ce *ce = &fl->centries[fl->cidx];
-
-	if (len < copy_thres) {
-		skb = alloc_skb(len + skb_pad, GFP_ATOMIC);
-		if (likely(skb != NULL)) {
-			skb_reserve(skb, skb_pad);
-			skb_put(skb, len);
-			pci_dma_sync_single_for_cpu(pdev,
-					    pci_unmap_addr(ce, dma_addr),
- 					    pci_unmap_len(ce, dma_len),
-					    PCI_DMA_FROMDEVICE);
-			memcpy(skb->data, ce->skb->data + dma_pad, len);
-			pci_dma_sync_single_for_device(pdev,
-					    pci_unmap_addr(ce, dma_addr),
- 					    pci_unmap_len(ce, dma_len),
-					    PCI_DMA_FROMDEVICE);
-		} else if (!drop_thres)
-			goto use_orig_buf;
-
-		recycle_fl_buf(fl, fl->cidx);
-		return skb;
-	}
-
-	if (fl->credits < drop_thres) {
-		recycle_fl_buf(fl, fl->cidx);
-		return NULL;
-	}
-
-use_orig_buf:
-	pci_unmap_single(pdev, pci_unmap_addr(ce, dma_addr),
-			 pci_unmap_len(ce, dma_len), PCI_DMA_FROMDEVICE);
-	skb = ce->skb;
-	skb_reserve(skb, dma_pad);
-	skb_put(skb, len);
-	return skb;
-}
-
-/**
- *	unexpected_offload - handle an unexpected offload packet
- *	@adapter: the adapter
- *	@fl: the free list that received the packet
- *
- *	Called when we receive an unexpected offload packet (e.g., the TOE
- *	function is disabled or the card is a NIC).  Prints a message and
- *	recycles the buffer.
- */
-static void unexpected_offload(struct adapter *adapter, struct freelQ *fl)
-{
-	struct freelQ_ce *ce = &fl->centries[fl->cidx];
-	struct sk_buff *skb = ce->skb;
-
-	pci_dma_sync_single_for_cpu(adapter->pdev, pci_unmap_addr(ce, dma_addr),
-			    pci_unmap_len(ce, dma_len), PCI_DMA_FROMDEVICE);
-	CH_ERR("%s: unexpected offload packet, cmd %u\n",
-	       adapter->name, *skb->data);
-	recycle_fl_buf(fl, fl->cidx);
-}
-
-/*
- * Write the command descriptors to transmit the given skb starting at
- * descriptor pidx with the given generation.
- */
-static inline void write_tx_descs(struct adapter *adapter, struct sk_buff *skb,
-				  unsigned int pidx, unsigned int gen,
-				  struct cmdQ *q)
-{
-	dma_addr_t mapping;
-	struct cmdQ_e *e, *e1;
-	struct cmdQ_ce *ce;
-	unsigned int i, flags, nfrags = skb_shinfo(skb)->nr_frags;
-
-	mapping = pci_map_single(adapter->pdev, skb->data,
-				 skb->len - skb->data_len, PCI_DMA_TODEVICE);
-	ce = &q->centries[pidx];
-	ce->skb = NULL;
-	pci_unmap_addr_set(ce, dma_addr, mapping);
-	pci_unmap_len_set(ce, dma_len, skb->len - skb->data_len);
-
-	flags = F_CMD_DATAVALID | F_CMD_SOP | V_CMD_EOP(nfrags == 0) |
-		V_CMD_GEN2(gen);
-	e = &q->entries[pidx];
-	e->addr_lo = (u32)mapping;
-	e->addr_hi = (u64)mapping >> 32;
-	e->len_gen = V_CMD_LEN(skb->len - skb->data_len) | V_CMD_GEN1(gen);
-	for (e1 = e, i = 0; nfrags--; i++) {
-		skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-
-		ce++;
-		e1++;
-		if (++pidx == q->size) {
-			pidx = 0;
-			gen ^= 1;
-			ce = q->centries;
-			e1 = q->entries;
-		}
-
-		mapping = pci_map_page(adapter->pdev, frag->page,
-				       frag->page_offset, frag->size,
-				       PCI_DMA_TODEVICE);
-		ce->skb = NULL;
-		pci_unmap_addr_set(ce, dma_addr, mapping);
-		pci_unmap_len_set(ce, dma_len, frag->size);
-
-		e1->addr_lo = (u32)mapping;
-		e1->addr_hi = (u64)mapping >> 32;
-		e1->len_gen = V_CMD_LEN(frag->size) | V_CMD_GEN1(gen);
-		e1->flags = F_CMD_DATAVALID | V_CMD_EOP(nfrags == 0) |
-			    V_CMD_GEN2(gen);
-	}
-
-	ce->skb = skb;
-	wmb();
-	e->flags = flags;
-}
-
-/*
- * Clean up completed Tx buffers.
- */
-static inline void reclaim_completed_tx(struct sge *sge, struct cmdQ *q)
-{
-	unsigned int reclaim = q->processed - q->cleaned;
-
-	if (reclaim) {
-		free_cmdQ_buffers(sge, q, reclaim);
-		q->cleaned += reclaim;
-	}
-}
-
-#ifndef SET_ETHTOOL_OPS
-# define __netif_rx_complete(dev) netif_rx_complete(dev)
-#endif
-
-/*
- * We cannot use the standard netif_rx_schedule_prep() because we have multiple
- * ports plus the TOE all multiplexing onto a single response queue, therefore
- * accepting new responses cannot depend on the state of any particular port.
- * So define our own equivalent that omits the netif_running() test.
- */
-static inline int napi_schedule_prep(struct net_device *dev)
-{
-	return !test_and_set_bit(__LINK_STATE_RX_SCHED, &dev->state);
-}
-
-
-/**
- *	sge_rx - process an ingress ethernet packet
- *	@sge: the sge structure
- *	@fl: the free list that contains the packet buffer
- *	@len: the packet length
- *
- *	Process an ingress ethernet pakcet and deliver it to the stack.
- */
-static int sge_rx(struct sge *sge, struct freelQ *fl, unsigned int len)
-{
-	struct sk_buff *skb;
-	struct cpl_rx_pkt *p;
-	struct adapter *adapter = sge->adapter;
-
-	sge->stats.ethernet_pkts++;
-	skb = get_packet(adapter->pdev, fl, len - sge->rx_pkt_pad,
-			 sge->rx_pkt_pad, 2, SGE_RX_COPY_THRES,
-			 SGE_RX_DROP_THRES);
-	if (!skb) {
-		sge->port_stats[0].rx_drops++; /* charge only port 0 for now */
-		return 0;
-	}
-
-	p = (struct cpl_rx_pkt *)skb->data;
-	skb_pull(skb, sizeof(*p));
-	skb->dev = adapter->port[p->iff].dev;
-	skb->dev->last_rx = jiffies;
-	skb->protocol = eth_type_trans(skb, skb->dev);
-	if ((adapter->flags & RX_CSUM_ENABLED) && p->csum == 0xffff &&
-	    skb->protocol == htons(ETH_P_IP) &&
-	    (skb->data[9] == IPPROTO_TCP || skb->data[9] == IPPROTO_UDP)) {
-		sge->port_stats[p->iff].rx_cso_good++;
-		skb->ip_summed = CHECKSUM_UNNECESSARY;
-	} else
-		skb->ip_summed = CHECKSUM_NONE;
-
-	if (unlikely(adapter->vlan_grp && p->vlan_valid)) {
-		sge->port_stats[p->iff].vlan_xtract++;
-		if (adapter->params.sge.polling)
-			vlan_hwaccel_receive_skb(skb, adapter->vlan_grp,
-						 ntohs(p->vlan));
-		else
-			vlan_hwaccel_rx(skb, adapter->vlan_grp,
-					ntohs(p->vlan));
-	} else if (adapter->params.sge.polling)
-		netif_receive_skb(skb);
-	else
-		netif_rx(skb);
-	return 0;
-}
-
-/*
- * Returns true if a command queue has enough available descriptors that
- * we can resume Tx operation after temporarily disabling its packet queue.
- */
-static inline int enough_free_Tx_descs(const struct cmdQ *q)
-{
-	unsigned int r = q->processed - q->cleaned;
-
-	return q->in_use - r < (q->size >> 1);
-}
-
-/*
- * Called when sufficient space has become available in the SGE command queues
- * after the Tx packet schedulers have been suspended to restart the Tx path.
- */
-static void restart_tx_queues(struct sge *sge)
-{
-	struct adapter *adap = sge->adapter;
-
-	if (enough_free_Tx_descs(&sge->cmdQ[0])) {
-		int i;
-
-		for_each_port(adap, i) {
-			struct net_device *nd = adap->port[i].dev;
-
-			if (test_and_clear_bit(nd->if_port,
-					       &sge->stopped_tx_queues) &&
-			    netif_running(nd)) {
-				sge->stats.cmdQ_restarted[3]++;
-				netif_wake_queue(nd);
-			}
-		}
-	}
-}
-
-/*
- * update_tx_info is called from the interrupt handler/NAPI to return cmdQ0 
- * information.
- */
-static unsigned int update_tx_info(struct adapter *adapter, 
-					  unsigned int flags, 
-					  unsigned int pr0)
-{
-	struct sge *sge = adapter->sge;
-	struct cmdQ *cmdq = &sge->cmdQ[0];
-
-	cmdq->processed += pr0;
-
-	if (flags & F_CMDQ0_ENABLE) {
-		clear_bit(CMDQ_STAT_RUNNING, &cmdq->status);
-	
-		if (cmdq->cleaned + cmdq->in_use != cmdq->processed &&
-		    !test_and_set_bit(CMDQ_STAT_LAST_PKT_DB, &cmdq->status)) {
-			set_bit(CMDQ_STAT_RUNNING, &cmdq->status);
-			writel(F_CMDQ0_ENABLE, adapter->regs + A_SG_DOORBELL);
-		}
-	 	flags &= ~F_CMDQ0_ENABLE;
-	}
-	
-	if (unlikely(sge->stopped_tx_queues != 0))
-		restart_tx_queues(sge);
-
-	return flags;
-}
-
-/*
- * Process SGE responses, up to the supplied budget.  Returns the number of
- * responses processed.  A negative budget is effectively unlimited.
- */
-static int process_responses(struct adapter *adapter, int budget)
-{
-	struct sge *sge = adapter->sge;
-	struct respQ *q = &sge->respQ;
-	struct respQ_e *e = &q->entries[q->cidx];
-	int budget_left = budget;
-	unsigned int flags = 0;
-	unsigned int cmdq_processed[SGE_CMDQ_N] = {0, 0};
-	
-
-	while (likely(budget_left && e->GenerationBit == q->genbit)) {
-		flags |= e->Qsleeping;
-		
-		cmdq_processed[0] += e->Cmdq0CreditReturn;
-		cmdq_processed[1] += e->Cmdq1CreditReturn;
-		
-		/* We batch updates to the TX side to avoid cacheline
-		 * ping-pong of TX state information on MP where the sender
-		 * might run on a different CPU than this function...
-		 */
-		if (unlikely(flags & F_CMDQ0_ENABLE || cmdq_processed[0] > 64)) {
-			flags = update_tx_info(adapter, flags, cmdq_processed[0]);
-			cmdq_processed[0] = 0;
-		}
-		if (unlikely(cmdq_processed[1] > 16)) {
-			sge->cmdQ[1].processed += cmdq_processed[1];
-			cmdq_processed[1] = 0;
-		}
-		if (likely(e->DataValid)) {
-			struct freelQ *fl = &sge->freelQ[e->FreelistQid];
-
-			if (unlikely(!e->Sop || !e->Eop))
-				BUG();
-			if (unlikely(e->Offload))
-				unexpected_offload(adapter, fl);
-			else
-				sge_rx(sge, fl, e->BufferLength);
-
-			/*
-			 * Note: this depends on each packet consuming a
-			 * single free-list buffer; cf. the BUG above.
-			 */
-			if (++fl->cidx == fl->size)
-				fl->cidx = 0;
-			if (unlikely(--fl->credits <
-				     fl->size - SGE_FREEL_REFILL_THRESH))
-				refill_free_list(sge, fl);
-		} else
-			sge->stats.pure_rsps++;
-
-		e++;
-		if (unlikely(++q->cidx == q->size)) {
-			q->cidx = 0;
-			q->genbit ^= 1;
-			e = q->entries;
-		}
-		prefetch(e);
-
-		if (++q->credits > SGE_RESPQ_REPLENISH_THRES) {
-			writel(q->credits, adapter->regs + A_SG_RSPQUEUECREDIT);
-			q->credits = 0;
-		}
-		--budget_left;
-	}
-
-	flags = update_tx_info(adapter, flags, cmdq_processed[0]); 
-	sge->cmdQ[1].processed += cmdq_processed[1];
-
-	budget -= budget_left;
-	return budget;
-}
-
-/*
- * A simpler version of process_responses() that handles only pure (i.e.,
- * non data-carrying) responses.  Such respones are too light-weight to justify
- * calling a softirq when using NAPI, so we handle them specially in hard
- * interrupt context.  The function is called with a pointer to a response,
- * which the caller must ensure is a valid pure response.  Returns 1 if it
- * encounters a valid data-carrying response, 0 otherwise.
- */
-static int process_pure_responses(struct adapter *adapter, struct respQ_e *e)
-{
-	struct sge *sge = adapter->sge;
-	struct respQ *q = &sge->respQ;
-	unsigned int flags = 0;
-	unsigned int cmdq_processed[SGE_CMDQ_N] = {0, 0};
-
-	do {
-		flags |= e->Qsleeping;
-
-		cmdq_processed[0] += e->Cmdq0CreditReturn;
-		cmdq_processed[1] += e->Cmdq1CreditReturn;
-		
-		e++;
-		if (unlikely(++q->cidx == q->size)) {
-			q->cidx = 0;
-			q->genbit ^= 1;
-			e = q->entries;
-		}
-		prefetch(e);
-
-		if (++q->credits > SGE_RESPQ_REPLENISH_THRES) {
-			writel(q->credits, adapter->regs + A_SG_RSPQUEUECREDIT);
-			q->credits = 0;
-		}
-		sge->stats.pure_rsps++;
-	} while (e->GenerationBit == q->genbit && !e->DataValid);
-
-	flags = update_tx_info(adapter, flags, cmdq_processed[0]); 
-	sge->cmdQ[1].processed += cmdq_processed[1];
-
-	return e->GenerationBit == q->genbit;
-}
-
-/*
- * Handler for new data events when using NAPI.  This does not need any locking
- * or protection from interrupts as data interrupts are off at this point and
- * other adapter interrupts do not interfere.
- */
-static int t1_poll(struct net_device *dev, int *budget)
-{
-	struct adapter *adapter = dev->priv;
-	int effective_budget = min(*budget, dev->quota);
-
-	int work_done = process_responses(adapter, effective_budget);
-	*budget -= work_done;
-	dev->quota -= work_done;
-
-	if (work_done >= effective_budget)
-		return 1;
-
-	__netif_rx_complete(dev);
-
-	/*
-	 * Because we don't atomically flush the following write it is
-	 * possible that in very rare cases it can reach the device in a way
-	 * that races with a new response being written plus an error interrupt
-	 * causing the NAPI interrupt handler below to return unhandled status
-	 * to the OS.  To protect against this would require flushing the write
-	 * and doing both the write and the flush with interrupts off.  Way too
-	 * expensive and unjustifiable given the rarity of the race.
-	 */
-	writel(adapter->sge->respQ.cidx, adapter->regs + A_SG_SLEEPING);
-	return 0;
-}
-
-/*
- * Returns true if the device is already scheduled for polling.
- */
-static inline int napi_is_scheduled(struct net_device *dev)
-{
-	return test_bit(__LINK_STATE_RX_SCHED, &dev->state);
-}
-
-/*
- * NAPI version of the main interrupt handler.
- */
-static irqreturn_t t1_interrupt_napi(int irq, void *data, struct pt_regs *regs)
-{
-	int handled;
-	struct adapter *adapter = data;
-	struct sge *sge = adapter->sge;
-	struct respQ *q = &adapter->sge->respQ;
-
-	/*
-	 * Clear the SGE_DATA interrupt first thing.  Normally the NAPI
-	 * handler has control of the response queue and the interrupt handler
-	 * can look at the queue reliably only once it knows NAPI is off.
-	 * We can't wait that long to clear the SGE_DATA interrupt because we
-	 * could race with t1_poll rearming the SGE interrupt, so we need to
-	 * clear the interrupt speculatively and really early on.
-	 */
-	writel(F_PL_INTR_SGE_DATA, adapter->regs + A_PL_CAUSE);
-
-	spin_lock(&adapter->async_lock);
-	if (!napi_is_scheduled(sge->netdev)) {
-		struct respQ_e *e = &q->entries[q->cidx];
-
-		if (e->GenerationBit == q->genbit) {
-			if (e->DataValid ||
-			    process_pure_responses(adapter, e)) {
-				if (likely(napi_schedule_prep(sge->netdev)))
-					__netif_rx_schedule(sge->netdev);
-				else
-					printk(KERN_CRIT
-					       "NAPI schedule failure!\n");
-			} else
-			writel(q->cidx, adapter->regs + A_SG_SLEEPING);
-			handled = 1;
-			goto unlock;
-		} else
-		writel(q->cidx, adapter->regs + A_SG_SLEEPING);
-	}  else
-	if (readl(adapter->regs + A_PL_CAUSE) & F_PL_INTR_SGE_DATA)
-		printk(KERN_ERR "data interrupt while NAPI running\n");
-	
-	handled = t1_slow_intr_handler(adapter);
-	if (!handled)
-		sge->stats.unhandled_irqs++;
- unlock:
-	spin_unlock(&adapter->async_lock);
-	return IRQ_RETVAL(handled != 0);
-}
-
-/*
- * Main interrupt handler, optimized assuming that we took a 'DATA'
- * interrupt.
- *
- * 1. Clear the interrupt
- * 2. Loop while we find valid descriptors and process them; accumulate
- *      information that can be processed after the loop
- * 3. Tell the SGE at which index we stopped processing descriptors
- * 4. Bookkeeping; free TX buffers, ring doorbell if there are any
- *      outstanding TX buffers waiting, replenish RX buffers, potentially
- *      reenable upper layers if they were turned off due to lack of TX
- *      resources which are available again.
- * 5. If we took an interrupt, but no valid respQ descriptors was found we
- *      let the slow_intr_handler run and do error handling.
- */
-static irqreturn_t t1_interrupt(int irq, void *cookie, struct pt_regs *regs)
-{
-	int work_done;
-	struct respQ_e *e;
-	struct adapter *adapter = cookie;
-	struct respQ *Q = &adapter->sge->respQ;
-
-	spin_lock(&adapter->async_lock);
-	e = &Q->entries[Q->cidx];
-	prefetch(e);
-
-	writel(F_PL_INTR_SGE_DATA, adapter->regs + A_PL_CAUSE);
-
-	if (likely(e->GenerationBit == Q->genbit))
-		work_done = process_responses(adapter, -1);
-	else
-		work_done = t1_slow_intr_handler(adapter);
-
-	/*
-	 * The unconditional clearing of the PL_CAUSE above may have raced
-	 * with DMA completion and the corresponding generation of a response
-	 * to cause us to miss the resulting data interrupt.  The next write
-	 * is also unconditional to recover the missed interrupt and render
-	 * this race harmless.
-	 */
-	writel(Q->cidx, adapter->regs + A_SG_SLEEPING);
-
-	if (!work_done)
-		adapter->sge->stats.unhandled_irqs++;
-	spin_unlock(&adapter->async_lock);
-	return IRQ_RETVAL(work_done != 0);
-}
-
-intr_handler_t t1_select_intr_handler(adapter_t *adapter)
-{
-	return adapter->params.sge.polling ? t1_interrupt_napi : t1_interrupt;
-}
-
-/*
- * Enqueues the sk_buff onto the cmdQ[qid] and has hardware fetch it.
- *
- * The code figures out how many entries the sk_buff will require in the
- * cmdQ and updates the cmdQ data structure with the state once the enqueue
- * has complete. Then, it doesn't access the global structure anymore, but
- * uses the corresponding fields on the stack. In conjuction with a spinlock
- * around that code, we can make the function reentrant without holding the
- * lock when we actually enqueue (which might be expensive, especially on
- * architectures with IO MMUs).
- *
- * This runs with softirqs disabled.
- */
-unsigned int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter,
-		       unsigned int qid, struct net_device *dev)
-{
-	struct sge *sge = adapter->sge;
-	struct cmdQ *q = &sge->cmdQ[qid];
-	unsigned int credits, pidx, genbit, count;
-
-	spin_lock(&q->lock);
-	reclaim_completed_tx(sge, q);
-
-	pidx = q->pidx;
-	credits = q->size - q->in_use;
-	count = 1 + skb_shinfo(skb)->nr_frags;
-
-	{	/* Ethernet packet */
-	 	if (unlikely(credits < count)) {
-			netif_stop_queue(dev);
-			set_bit(dev->if_port, &sge->stopped_tx_queues);
-			sge->stats.cmdQ_full[3]++;
-			spin_unlock(&q->lock);
-			CH_ERR("%s: Tx ring full while queue awake!\n",
-			       adapter->name);
-			return 1;
-		}
-		if (unlikely(credits - count < q->stop_thres)) {
-			sge->stats.cmdQ_full[3]++;
-			netif_stop_queue(dev);
-			set_bit(dev->if_port, &sge->stopped_tx_queues);
-		}
-	}
-	q->in_use += count;
-	genbit = q->genbit;
-	q->pidx += count;
-	if (q->pidx >= q->size) {
-		q->pidx -= q->size;
-		q->genbit ^= 1;
-	}
-	spin_unlock(&q->lock);
-
-	write_tx_descs(adapter, skb, pidx, genbit, q);
-
-	/*
-	 * We always ring the doorbell for cmdQ1.  For cmdQ0, we only ring
-	 * the doorbell if the Q is asleep. There is a natural race, where
-	 * the hardware is going to sleep just after we checked, however,
-	 * then the interrupt handler will detect the outstanding TX packet
-	 * and ring the doorbell for us.
-	 */
-	if (qid)
-		doorbell_pio(adapter, F_CMDQ1_ENABLE);
-	else {
-		clear_bit(CMDQ_STAT_LAST_PKT_DB, &q->status);
-		if (test_and_set_bit(CMDQ_STAT_RUNNING, &q->status) == 0) {
-			set_bit(CMDQ_STAT_LAST_PKT_DB, &q->status);
-			writel(F_CMDQ0_ENABLE, adapter->regs + A_SG_DOORBELL);
-		}
-	}
-	return 0;
-}
-
-#define MK_ETH_TYPE_MSS(type, mss) (((mss) & 0x3FFF) | ((type) << 14))
-
-/*
- *	eth_hdr_len - return the length of an Ethernet header
- *	@data: pointer to the start of the Ethernet header
- *
- *	Returns the length of an Ethernet header, including optional VLAN tag.
- */
-static inline int eth_hdr_len(const void *data)
-{
-	const struct ethhdr *e = data;
-
-	return e->h_proto == htons(ETH_P_8021Q) ? VLAN_ETH_HLEN : ETH_HLEN;
-}
-
-/*
- * Adds the CPL header to the sk_buff and passes it to t1_sge_tx.
- */
-int t1_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	struct adapter *adapter = dev->priv;
-	struct sge_port_stats *st = &adapter->sge->port_stats[dev->if_port];
-	struct sge *sge = adapter->sge;
-	struct cpl_tx_pkt *cpl;
-
-#ifdef NETIF_F_TSO
-	if (skb_shinfo(skb)->tso_size) {
-		int eth_type;
-		struct cpl_tx_pkt_lso *hdr;
-
-		st->tso++;
-
-		eth_type = skb->nh.raw - skb->data == ETH_HLEN ?
-			CPL_ETH_II : CPL_ETH_II_VLAN;
-
-		hdr = (struct cpl_tx_pkt_lso *)skb_push(skb, sizeof(*hdr));
-		hdr->opcode = CPL_TX_PKT_LSO;
-		hdr->ip_csum_dis = hdr->l4_csum_dis = 0;
-		hdr->ip_hdr_words = skb->nh.iph->ihl;
-		hdr->tcp_hdr_words = skb->h.th->doff;
-		hdr->eth_type_mss = htons(MK_ETH_TYPE_MSS(eth_type,
-						skb_shinfo(skb)->tso_size));
-		hdr->len = htonl(skb->len - sizeof(*hdr));
-		cpl = (struct cpl_tx_pkt *)hdr;
-		sge->stats.tx_lso_pkts++;
-	} else
-#endif
-	{
-		/*
-	 	 * Packets shorter than ETH_HLEN can break the MAC, drop them
-		 * early.  Also, we may get oversized packets because some
-		 * parts of the kernel don't handle our unusual hard_header_len
-		 * right, drop those too.
-		 */
-		if (unlikely(skb->len < ETH_HLEN ||
-			     skb->len > dev->mtu + eth_hdr_len(skb->data))) {
-			dev_kfree_skb_any(skb);
-			return NET_XMIT_SUCCESS;
-		}
-
-		/*
-		 * We are using a non-standard hard_header_len and some kernel
-		 * components, such as pktgen, do not handle it right.
-		 * Complain when this happens but try to fix things up.
-		 */
-		if (unlikely(skb_headroom(skb) <
-			     dev->hard_header_len - ETH_HLEN)) {
-			struct sk_buff *orig_skb = skb;
-
-			if (net_ratelimit())
-				printk(KERN_ERR "%s: inadequate headroom in "
-				       "Tx packet\n", dev->name);
-			skb = skb_realloc_headroom(skb, sizeof(*cpl));
-			dev_kfree_skb_any(orig_skb);
-			if (!skb)
-				return -ENOMEM;
-		}
-
-		if (!(adapter->flags & UDP_CSUM_CAPABLE) &&
-		    skb->ip_summed == CHECKSUM_HW &&
-		    skb->nh.iph->protocol == IPPROTO_UDP)
-			if (unlikely(skb_checksum_help(skb, 0))) {
-				dev_kfree_skb_any(skb);
-				return -ENOMEM;
-			}
-
-		/* Hmmm, assuming to catch the gratious arp... and we'll use
-		 * it to flush out stuck espi packets...
-		  */
-		if (unlikely(!adapter->sge->espibug_skb)) {
-			if (skb->protocol == htons(ETH_P_ARP) &&
-			    skb->nh.arph->ar_op == htons(ARPOP_REQUEST)) {
-				adapter->sge->espibug_skb = skb;
-				/* We want to re-use this skb later. We
-				 * simply bump the reference count and it
-				 * will not be freed...
-				 */
-				skb = skb_get(skb);
-			}
-		}
-
-		cpl = (struct cpl_tx_pkt *)__skb_push(skb, sizeof(*cpl));
-		cpl->opcode = CPL_TX_PKT;
-		cpl->ip_csum_dis = 1;    /* SW calculates IP csum */
-		cpl->l4_csum_dis = skb->ip_summed == CHECKSUM_HW ? 0 : 1;
-		/* the length field isn't used so don't bother setting it */
-
-		st->tx_cso += (skb->ip_summed == CHECKSUM_HW);
-		sge->stats.tx_do_cksum += (skb->ip_summed == CHECKSUM_HW);
-		sge->stats.tx_reg_pkts++;
-	}
-	cpl->iff = dev->if_port;
-
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-	if (adapter->vlan_grp && vlan_tx_tag_present(skb)) {
-		cpl->vlan_valid = 1;
-		cpl->vlan = htons(vlan_tx_tag_get(skb));
-		st->vlan_insert++;
-	} else
-#endif
-		cpl->vlan_valid = 0;
-
-	dev->trans_start = jiffies;
-	return t1_sge_tx(skb, adapter, 0, dev);
-}
-
-/*
- * Callback for the Tx buffer reclaim timer.  Runs with softirqs disabled.
- */
-static void sge_tx_reclaim_cb(unsigned long data)
-{
-	int i;
-	struct sge *sge = (struct sge *)data;
-
-	for (i = 0; i < SGE_CMDQ_N; ++i) {
-		struct cmdQ *q = &sge->cmdQ[i];
-
-		if (!spin_trylock(&q->lock))
-			continue;
-
-		reclaim_completed_tx(sge, q);
-		if (i == 0 && q->in_use)   /* flush pending credits */
-			writel(F_CMDQ0_ENABLE,
-				sge->adapter->regs + A_SG_DOORBELL);
-
-		spin_unlock(&q->lock);
-	}
-	mod_timer(&sge->tx_reclaim_timer, jiffies + TX_RECLAIM_PERIOD);
-}
-
-/*
- * Propagate changes of the SGE coalescing parameters to the HW.
- */
-int t1_sge_set_coalesce_params(struct sge *sge, struct sge_params *p)
-{
-	sge->netdev->poll = t1_poll;
-	sge->fixed_intrtimer = p->rx_coalesce_usecs *
-		core_ticks_per_usec(sge->adapter);
-	writel(sge->fixed_intrtimer, sge->adapter->regs + A_SG_INTRTIMER);
-	return 0;
-}
-
-/*
- * Allocates both RX and TX resources and configures the SGE. However,
- * the hardware is not enabled yet.
- */
-int t1_sge_configure(struct sge *sge, struct sge_params *p)
-{
-	if (alloc_rx_resources(sge, p))
-		return -ENOMEM;
-	if (alloc_tx_resources(sge, p)) {
-		free_rx_resources(sge);
-		return -ENOMEM;
-	}
-	configure_sge(sge, p);
-
-	/*
-	 * Now that we have sized the free lists calculate the payload
-	 * capacity of the large buffers.  Other parts of the driver use
-	 * this to set the max offload coalescing size so that RX packets
-	 * do not overflow our large buffers.
-	 */
-	p->large_buf_capacity = jumbo_payload_capacity(sge);
-	return 0;
-}
-
-/*
- * Disables the DMA engine.
- */
-void t1_sge_stop(struct sge *sge)
-{
-	writel(0, sge->adapter->regs + A_SG_CONTROL);
-	(void) readl(sge->adapter->regs + A_SG_CONTROL); /* flush */
-	if (is_T2(sge->adapter))
-		del_timer_sync(&sge->espibug_timer);
-	del_timer_sync(&sge->tx_reclaim_timer);
-}
-
-/*
- * Enables the DMA engine.
- */
-void t1_sge_start(struct sge *sge)
-{
-	refill_free_list(sge, &sge->freelQ[0]);
-	refill_free_list(sge, &sge->freelQ[1]);
-
-	writel(sge->sge_control, sge->adapter->regs + A_SG_CONTROL);
-	doorbell_pio(sge->adapter, F_FL0_ENABLE | F_FL1_ENABLE);
-	(void) readl(sge->adapter->regs + A_SG_CONTROL); /* flush */
-
-	mod_timer(&sge->tx_reclaim_timer, jiffies + TX_RECLAIM_PERIOD);
-
-	if (is_T2(sge->adapter)) 
-		mod_timer(&sge->espibug_timer, jiffies + sge->espibug_timeout);
-}
-
-/*
- * Callback for the T2 ESPI 'stuck packet feature' workaorund
- */
-static void espibug_workaround(void *data)
-{
-	struct adapter *adapter = (struct adapter *)data;
-	struct sge *sge = adapter->sge;
-
-	if (netif_running(adapter->port[0].dev)) {
-		struct sk_buff *skb = sge->espibug_skb;
-
-		u32 seop = t1_espi_get_mon(adapter, 0x930, 0);
-
-		if ((seop & 0xfff0fff) == 0xfff && skb) {
-			if (!skb->cb[0]) {
-				u8 ch_mac_addr[ETH_ALEN] =
-				    {0x0, 0x7, 0x43, 0x0, 0x0, 0x0};
-				memcpy(skb->data + sizeof(struct cpl_tx_pkt),
-				    ch_mac_addr, ETH_ALEN);
-				memcpy(skb->data + skb->len - 10, ch_mac_addr,
-				    ETH_ALEN);
-				skb->cb[0] = 0xff;
-			}
-
-			/* bump the reference count to avoid freeing of the
-			 * skb once the DMA has completed.
-			 */
-			skb = skb_get(skb);
-			t1_sge_tx(skb, adapter, 0, adapter->port[0].dev);
-		}
-	}
-	mod_timer(&sge->espibug_timer, jiffies + sge->espibug_timeout);
-}
-
-/*
- * Creates a t1_sge structure and returns suggested resource parameters.
- */
-struct sge * __devinit t1_sge_create(struct adapter *adapter,
-				     struct sge_params *p)
-{
-	struct sge *sge = kmalloc(sizeof(*sge), GFP_KERNEL);
-
-	if (!sge)
-		return NULL;
-	memset(sge, 0, sizeof(*sge));
-
-	sge->adapter = adapter;
-	sge->netdev = adapter->port[0].dev;
-	sge->rx_pkt_pad = t1_is_T1B(adapter) ? 0 : 2;
-	sge->jumbo_fl = t1_is_T1B(adapter) ? 1 : 0;
-
-	init_timer(&sge->tx_reclaim_timer);
-	sge->tx_reclaim_timer.data = (unsigned long)sge;
-	sge->tx_reclaim_timer.function = sge_tx_reclaim_cb;
-
-	if (is_T2(sge->adapter)) {
-		init_timer(&sge->espibug_timer);
-		sge->espibug_timer.function = (void *)&espibug_workaround;
-		sge->espibug_timer.data = (unsigned long)sge->adapter;
-		sge->espibug_timeout = 1;
-	}
-	 
-
-	p->cmdQ_size[0] = SGE_CMDQ0_E_N;
-	p->cmdQ_size[1] = SGE_CMDQ1_E_N;
-	p->freelQ_size[!sge->jumbo_fl] = SGE_FREEL_SIZE;
-	p->freelQ_size[sge->jumbo_fl] = SGE_JUMBO_FREEL_SIZE;
-	p->rx_coalesce_usecs =  50;
-	p->coalesce_enable = 0;
-	p->sample_interval_usecs = 0;
-	p->polling = 0;
-
-	return sge;
-}
diff --git a/trunk/drivers/net/chelsio/sge.h b/trunk/drivers/net/chelsio/sge.h
deleted file mode 100644
index 434b25586851..000000000000
--- a/trunk/drivers/net/chelsio/sge.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: sge.h                                                               *
- * $Revision: 1.11 $                                                          *
- * $Date: 2005/06/21 22:10:55 $                                              *
- * Description:                                                              *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#ifndef _CXGB_SGE_H_
-#define _CXGB_SGE_H_
-
-#include <linux/types.h>
-#include <linux/interrupt.h>
-#include <asm/byteorder.h>
-
-#ifndef IRQ_RETVAL
-#define IRQ_RETVAL(x)
-typedef void irqreturn_t;
-#endif
-
-typedef irqreturn_t (*intr_handler_t)(int, void *, struct pt_regs *);
-
-struct sge_intr_counts {
-	unsigned int respQ_empty;      /* # times respQ empty */
-	unsigned int respQ_overflow;   /* # respQ overflow (fatal) */
-	unsigned int freelistQ_empty;  /* # times freelist empty */
-	unsigned int pkt_too_big;      /* packet too large (fatal) */
-	unsigned int pkt_mismatch;
-	unsigned int cmdQ_full[3];     /* not HW IRQ, host cmdQ[] full */
-	unsigned int cmdQ_restarted[3];/* # of times cmdQ X was restarted */
-	unsigned int ethernet_pkts;    /* # of Ethernet packets received */
-	unsigned int offload_pkts;     /* # of offload packets received */
-	unsigned int offload_bundles;  /* # of offload pkt bundles delivered */
-	unsigned int pure_rsps;        /* # of non-payload responses */
-	unsigned int unhandled_irqs;   /* # of unhandled interrupts */
-	unsigned int tx_ipfrags;
-	unsigned int tx_reg_pkts;
-	unsigned int tx_lso_pkts;
-	unsigned int tx_do_cksum;
-};
-
-struct sge_port_stats {
-	unsigned long rx_cso_good;     /* # of successful RX csum offloads */
-	unsigned long tx_cso;          /* # of TX checksum offloads */
-	unsigned long vlan_xtract;     /* # of VLAN tag extractions */
-	unsigned long vlan_insert;     /* # of VLAN tag extractions */
-	unsigned long tso;             /* # of TSO requests */
-	unsigned long rx_drops;        /* # of packets dropped due to no mem */
-};
-
-struct sk_buff;
-struct net_device;
-struct adapter;
-struct sge_params;
-struct sge;
-
-struct sge *t1_sge_create(struct adapter *, struct sge_params *);
-int t1_sge_configure(struct sge *, struct sge_params *);
-int t1_sge_set_coalesce_params(struct sge *, struct sge_params *);
-void t1_sge_destroy(struct sge *);
-intr_handler_t t1_select_intr_handler(adapter_t *adapter);
-unsigned int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter,
-		       unsigned int qid, struct net_device *netdev);
-int t1_start_xmit(struct sk_buff *skb, struct net_device *dev);
-void t1_set_vlan_accel(struct adapter *adapter, int on_off);
-void t1_sge_start(struct sge *);
-void t1_sge_stop(struct sge *);
-int t1_sge_intr_error_handler(struct sge *);
-void t1_sge_intr_enable(struct sge *);
-void t1_sge_intr_disable(struct sge *);
-void t1_sge_intr_clear(struct sge *);
-const struct sge_intr_counts *t1_sge_get_intr_counts(struct sge *sge);
-const struct sge_port_stats *t1_sge_get_port_stats(struct sge *sge, int port);
-
-#endif /* _CXGB_SGE_H_ */
diff --git a/trunk/drivers/net/chelsio/subr.c b/trunk/drivers/net/chelsio/subr.c
deleted file mode 100644
index 1ebb5d149aef..000000000000
--- a/trunk/drivers/net/chelsio/subr.c
+++ /dev/null
@@ -1,812 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: subr.c                                                              *
- * $Revision: 1.27 $                                                         *
- * $Date: 2005/06/22 01:08:36 $                                              *
- * Description:                                                              *
- *  Various subroutines (intr,pio,etc.) used by Chelsio 10G Ethernet driver. *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Copyright (c) 2003 - 2005 Chelsio Communications, Inc.                    *
- * All rights reserved.                                                      *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: Dimitrios Michailidis   <dm@chelsio.com>                         *
- *          Tina Yang               <tainay@chelsio.com>                     *
- *          Felix Marti             <felix@chelsio.com>                      *
- *          Scott Bardone           <sbardone@chelsio.com>                   *
- *          Kurt Ottaway            <kottaway@chelsio.com>                   *
- *          Frank DiMambro          <frank@chelsio.com>                      *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#include "common.h"
-#include "elmer0.h"
-#include "regs.h"
-#include "gmac.h"
-#include "cphy.h"
-#include "sge.h"
-#include "espi.h"
-
-/**
- *	t1_wait_op_done - wait until an operation is completed
- *	@adapter: the adapter performing the operation
- *	@reg: the register to check for completion
- *	@mask: a single-bit field within @reg that indicates completion
- *	@polarity: the value of the field when the operation is completed
- *	@attempts: number of check iterations
- *      @delay: delay in usecs between iterations
- *
- *	Wait until an operation is completed by checking a bit in a register
- *	up to @attempts times.  Returns %0 if the operation completes and %1
- *	otherwise.
- */
-static int t1_wait_op_done(adapter_t *adapter, int reg, u32 mask, int polarity,
-		    int attempts, int delay)
-{
-	while (1) {
-		u32 val = readl(adapter->regs + reg) & mask;
-
-		if (!!val == polarity)
-			return 0;
-		if (--attempts == 0)
-			return 1;
-		if (delay)
-			udelay(delay);
-	}
-}
-
-#define TPI_ATTEMPTS 50
-
-/*
- * Write a register over the TPI interface (unlocked and locked versions).
- */
-static int __t1_tpi_write(adapter_t *adapter, u32 addr, u32 value)
-{
-	int tpi_busy;
-
-	writel(addr, adapter->regs + A_TPI_ADDR);
-	writel(value, adapter->regs + A_TPI_WR_DATA);
-	writel(F_TPIWR, adapter->regs + A_TPI_CSR);
-
-	tpi_busy = t1_wait_op_done(adapter, A_TPI_CSR, F_TPIRDY, 1,
-				   TPI_ATTEMPTS, 3);
-	if (tpi_busy)
-		CH_ALERT("%s: TPI write to 0x%x failed\n",
-			 adapter->name, addr);
-	return tpi_busy;
-}
-
-int t1_tpi_write(adapter_t *adapter, u32 addr, u32 value)
-{
-	int ret;
-
-	spin_lock(&(adapter)->tpi_lock);
-	ret = __t1_tpi_write(adapter, addr, value);
-	spin_unlock(&(adapter)->tpi_lock);
-	return ret;
-}
-
-/*
- * Read a register over the TPI interface (unlocked and locked versions).
- */
-static int __t1_tpi_read(adapter_t *adapter, u32 addr, u32 *valp)
-{
-	int tpi_busy;
-
-	writel(addr, adapter->regs + A_TPI_ADDR);
-	writel(0, adapter->regs + A_TPI_CSR);
-
-	tpi_busy = t1_wait_op_done(adapter, A_TPI_CSR, F_TPIRDY, 1,
-				   TPI_ATTEMPTS, 3);
-	if (tpi_busy)
-		CH_ALERT("%s: TPI read from 0x%x failed\n",
-			 adapter->name, addr);
-	else
-		*valp = readl(adapter->regs + A_TPI_RD_DATA);
-	return tpi_busy;
-}
-
-int t1_tpi_read(adapter_t *adapter, u32 addr, u32 *valp)
-{
-	int ret;
-
-	spin_lock(&(adapter)->tpi_lock);
-	ret = __t1_tpi_read(adapter, addr, valp);
-	spin_unlock(&(adapter)->tpi_lock);
-	return ret;
-}
-
-/*
- * Called when a port's link settings change to propagate the new values to the
- * associated PHY and MAC.  After performing the common tasks it invokes an
- * OS-specific handler.
- */
-/* static */ void link_changed(adapter_t *adapter, int port_id)
-{
-	int link_ok, speed, duplex, fc;
-	struct cphy *phy = adapter->port[port_id].phy;
-	struct link_config *lc = &adapter->port[port_id].link_config;
-
-	phy->ops->get_link_status(phy, &link_ok, &speed, &duplex, &fc);
-
-	lc->speed = speed < 0 ? SPEED_INVALID : speed;
-	lc->duplex = duplex < 0 ? DUPLEX_INVALID : duplex;
-	if (!(lc->requested_fc & PAUSE_AUTONEG))
-		fc = lc->requested_fc & (PAUSE_RX | PAUSE_TX);
-
-	if (link_ok && speed >= 0 && lc->autoneg == AUTONEG_ENABLE) {
-		/* Set MAC speed, duplex, and flow control to match PHY. */
-		struct cmac *mac = adapter->port[port_id].mac;
-
-		mac->ops->set_speed_duplex_fc(mac, speed, duplex, fc);
-		lc->fc = (unsigned char)fc;
-	}
-	t1_link_changed(adapter, port_id, link_ok, speed, duplex, fc);
-}
-
-static int t1_pci_intr_handler(adapter_t *adapter)
-{
-	u32 pcix_cause;
-
-    	pci_read_config_dword(adapter->pdev, A_PCICFG_INTR_CAUSE, &pcix_cause);
-
-	if (pcix_cause) {
-		pci_write_config_dword(adapter->pdev, A_PCICFG_INTR_CAUSE,
-					 pcix_cause);
-		t1_fatal_err(adapter);    /* PCI errors are fatal */
-	}
-	return 0;
-}
-
-
-/*
- * Wait until Elmer's MI1 interface is ready for new operations.
- */
-static int mi1_wait_until_ready(adapter_t *adapter, int mi1_reg)
-{
-	int attempts = 100, busy;
-
-	do {
-		u32 val;
-
-		__t1_tpi_read(adapter, mi1_reg, &val);
-		busy = val & F_MI1_OP_BUSY;
-		if (busy)
-			udelay(10);
-	} while (busy && --attempts);
-	if (busy)
-		CH_ALERT("%s: MDIO operation timed out\n",
-			 adapter->name);
-	return busy;
-}
-
-/*
- * MI1 MDIO initialization.
- */
-static void mi1_mdio_init(adapter_t *adapter, const struct board_info *bi)
-{
-	u32 clkdiv = bi->clock_elmer0 / (2 * bi->mdio_mdc) - 1;
-	u32 val = F_MI1_PREAMBLE_ENABLE | V_MI1_MDI_INVERT(bi->mdio_mdiinv) |
-		V_MI1_MDI_ENABLE(bi->mdio_mdien) | V_MI1_CLK_DIV(clkdiv);
-
-	if (!(bi->caps & SUPPORTED_10000baseT_Full))
-		val |= V_MI1_SOF(1);
-	t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_CFG, val);
-}
-
-static int mi1_mdio_ext_read(adapter_t *adapter, int phy_addr, int mmd_addr,
-			     int reg_addr, unsigned int *valp)
-{
-	u32 addr = V_MI1_REG_ADDR(mmd_addr) | V_MI1_PHY_ADDR(phy_addr);
-
-	spin_lock(&(adapter)->tpi_lock);
-
-	/* Write the address we want. */
-	__t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_ADDR, addr);
-	__t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_DATA, reg_addr);
-	__t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_OP,
-		       MI1_OP_INDIRECT_ADDRESS);
-	mi1_wait_until_ready(adapter, A_ELMER0_PORT0_MI1_OP);
-
-	/* Write the operation we want. */
-	__t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_OP, MI1_OP_INDIRECT_READ);
-	mi1_wait_until_ready(adapter, A_ELMER0_PORT0_MI1_OP);
-
-	/* Read the data. */
-	__t1_tpi_read(adapter, A_ELMER0_PORT0_MI1_DATA, valp);
-	spin_unlock(&(adapter)->tpi_lock);
-	return 0;
-}
-
-static int mi1_mdio_ext_write(adapter_t *adapter, int phy_addr, int mmd_addr,
-			      int reg_addr, unsigned int val)
-{
-	u32 addr = V_MI1_REG_ADDR(mmd_addr) | V_MI1_PHY_ADDR(phy_addr);
-
-	spin_lock(&(adapter)->tpi_lock);
-
-	/* Write the address we want. */
-	__t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_ADDR, addr);
-	__t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_DATA, reg_addr);
-	__t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_OP,
-		       MI1_OP_INDIRECT_ADDRESS);
-	mi1_wait_until_ready(adapter, A_ELMER0_PORT0_MI1_OP);
-
-	/* Write the data. */
-	__t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_DATA, val);
-	__t1_tpi_write(adapter, A_ELMER0_PORT0_MI1_OP, MI1_OP_INDIRECT_WRITE);
-	mi1_wait_until_ready(adapter, A_ELMER0_PORT0_MI1_OP);
-	spin_unlock(&(adapter)->tpi_lock);
-	return 0;
-}
-
-static struct mdio_ops mi1_mdio_ext_ops = {
-	mi1_mdio_init,
-	mi1_mdio_ext_read,
-	mi1_mdio_ext_write
-};
-
-enum {
-	CH_BRD_N110_1F,
-	CH_BRD_N210_1F,
-};
-
-static struct board_info t1_board[] = {
-
-{ CHBT_BOARD_N110, 1/*ports#*/,
-  SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE /*caps*/, CHBT_TERM_T1,
-  CHBT_MAC_PM3393, CHBT_PHY_88X2010,
-  125000000/*clk-core*/, 0/*clk-mc3*/, 0/*clk-mc4*/,
-  1/*espi-ports*/, 0/*clk-cspi*/, 44/*clk-elmer0*/, 0/*mdien*/,
-  0/*mdiinv*/, 1/*mdc*/, 0/*phybaseaddr*/, &t1_pm3393_ops,
-  &t1_mv88x201x_ops, &mi1_mdio_ext_ops,
-  "Chelsio N110 1x10GBaseX NIC" },
-
-{ CHBT_BOARD_N210, 1/*ports#*/,
-  SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE /*caps*/, CHBT_TERM_T2,
-  CHBT_MAC_PM3393, CHBT_PHY_88X2010,
-  125000000/*clk-core*/, 0/*clk-mc3*/, 0/*clk-mc4*/,
-  1/*espi-ports*/, 0/*clk-cspi*/, 44/*clk-elmer0*/, 0/*mdien*/,
-  0/*mdiinv*/, 1/*mdc*/, 0/*phybaseaddr*/, &t1_pm3393_ops,
-  &t1_mv88x201x_ops, &mi1_mdio_ext_ops,
-  "Chelsio N210 1x10GBaseX NIC" },
-
-};
-
-struct pci_device_id t1_pci_tbl[] = {
-	CH_DEVICE(7, 0, CH_BRD_N110_1F),
-	CH_DEVICE(10, 1, CH_BRD_N210_1F),
-	{ 0, }
-};
-
-MODULE_DEVICE_TABLE(pci, t1_pci_tbl);
-
-/*
- * Return the board_info structure with a given index.  Out-of-range indices
- * return NULL.
- */
-const struct board_info *t1_get_board_info(unsigned int board_id)
-{
-	return board_id < ARRAY_SIZE(t1_board) ? &t1_board[board_id] : NULL;
-}
-
-struct chelsio_vpd_t {
-	u32 format_version;
-	u8 serial_number[16];
-	u8 mac_base_address[6];
-	u8 pad[2];           /* make multiple-of-4 size requirement explicit */
-};
-
-#define EEPROMSIZE        (8 * 1024)
-#define EEPROM_MAX_POLL   4
-
-/*
- * Read SEEPROM. A zero is written to the flag register when the addres is
- * written to the Control register. The hardware device will set the flag to a
- * one when 4B have been transferred to the Data register.
- */
-int t1_seeprom_read(adapter_t *adapter, u32 addr, u32 *data)
-{
-	int i = EEPROM_MAX_POLL;
-	u16 val;
-
-	if (addr >= EEPROMSIZE || (addr & 3))
-		return -EINVAL;
-
-	pci_write_config_word(adapter->pdev, A_PCICFG_VPD_ADDR, (u16)addr);
-	do {
-		udelay(50);
-		pci_read_config_word(adapter->pdev, A_PCICFG_VPD_ADDR, &val);
-	} while (!(val & F_VPD_OP_FLAG) && --i);
-
-	if (!(val & F_VPD_OP_FLAG)) {
-		CH_ERR("%s: reading EEPROM address 0x%x failed\n",
-		       adapter->name, addr);
-		return -EIO;
-	}
-	pci_read_config_dword(adapter->pdev, A_PCICFG_VPD_DATA, data);
-	*data = le32_to_cpu(*data);
-	return 0;
-}
-
-static int t1_eeprom_vpd_get(adapter_t *adapter, struct chelsio_vpd_t *vpd)
-{
-	int addr, ret = 0;
-
-	for (addr = 0; !ret && addr < sizeof(*vpd); addr += sizeof(u32))
-		ret = t1_seeprom_read(adapter, addr,
-				      (u32 *)((u8 *)vpd + addr));
-
-	return ret;
-}
-
-/*
- * Read a port's MAC address from the VPD ROM.
- */
-static int vpd_macaddress_get(adapter_t *adapter, int index, u8 mac_addr[])
-{
-	struct chelsio_vpd_t vpd;
-
-	if (t1_eeprom_vpd_get(adapter, &vpd))
-		return 1;
-	memcpy(mac_addr, vpd.mac_base_address, 5);
-	mac_addr[5] = vpd.mac_base_address[5] + index;
-	return 0;
-}
-
-/*
- * Set up the MAC/PHY according to the requested link settings.
- *
- * If the PHY can auto-negotiate first decide what to advertise, then
- * enable/disable auto-negotiation as desired and reset.
- *
- * If the PHY does not auto-negotiate we just reset it.
- *
- * If auto-negotiation is off set the MAC to the proper speed/duplex/FC,
- * otherwise do it later based on the outcome of auto-negotiation.
- */
-int t1_link_start(struct cphy *phy, struct cmac *mac, struct link_config *lc)
-{
-	unsigned int fc = lc->requested_fc & (PAUSE_RX | PAUSE_TX);
-
-	if (lc->supported & SUPPORTED_Autoneg) {
-		lc->advertising &= ~(ADVERTISED_ASYM_PAUSE | ADVERTISED_PAUSE);
-		if (fc) {
-			lc->advertising |= ADVERTISED_ASYM_PAUSE;
-			if (fc == (PAUSE_RX | PAUSE_TX))
-				lc->advertising |= ADVERTISED_PAUSE;
-		}
-		phy->ops->advertise(phy, lc->advertising);
-
-		if (lc->autoneg == AUTONEG_DISABLE) {
-			lc->speed = lc->requested_speed;
-			lc->duplex = lc->requested_duplex;
-			lc->fc = (unsigned char)fc;
-			mac->ops->set_speed_duplex_fc(mac, lc->speed,
-						      lc->duplex, fc);
-			/* Also disables autoneg */
-			phy->ops->set_speed_duplex(phy, lc->speed, lc->duplex);
-			phy->ops->reset(phy, 0);
-		} else
-			phy->ops->autoneg_enable(phy); /* also resets PHY */
-	} else {
-		mac->ops->set_speed_duplex_fc(mac, -1, -1, fc);
-		lc->fc = (unsigned char)fc;
-		phy->ops->reset(phy, 0);
-	}
-	return 0;
-}
-
-/*
- * External interrupt handler for boards using elmer0.
- */
-int elmer0_ext_intr_handler(adapter_t *adapter)
-{
-    	struct cphy *phy;
-	int phy_cause;
-    	u32 cause;
-
-	t1_tpi_read(adapter, A_ELMER0_INT_CAUSE, &cause);
-
-	switch (board_info(adapter)->board) {
-	case CHBT_BOARD_N210:
-	case CHBT_BOARD_N110:
-		if (cause & ELMER0_GP_BIT6) { /* Marvell 88x2010 interrupt */
-			phy = adapter->port[0].phy;
-			phy_cause = phy->ops->interrupt_handler(phy);
-			if (phy_cause & cphy_cause_link_change)
-				link_changed(adapter, 0);
-		}
-		break;
-	}
-	t1_tpi_write(adapter, A_ELMER0_INT_CAUSE, cause);
-	return 0;
-}
-
-/* Enables all interrupts. */
-void t1_interrupts_enable(adapter_t *adapter)
-{
-	unsigned int i;
-	u32 pl_intr;
-
-	adapter->slow_intr_mask = F_PL_INTR_SGE_ERR;
-
-	t1_sge_intr_enable(adapter->sge);
-	if (adapter->espi) {
-		adapter->slow_intr_mask |= F_PL_INTR_ESPI;
-		t1_espi_intr_enable(adapter->espi);
-	}
-
-	/* Enable MAC/PHY interrupts for each port. */
-	for_each_port(adapter, i) {
-		adapter->port[i].mac->ops->interrupt_enable(adapter->port[i].mac);
-		adapter->port[i].phy->ops->interrupt_enable(adapter->port[i].phy);
-	}
-
-	/* Enable PCIX & external chip interrupts on ASIC boards. */
-	pl_intr = readl(adapter->regs + A_PL_ENABLE);
-
-	/* PCI-X interrupts */
-	pci_write_config_dword(adapter->pdev, A_PCICFG_INTR_ENABLE,
-			       0xffffffff);
-
-	adapter->slow_intr_mask |= F_PL_INTR_EXT | F_PL_INTR_PCIX;
-	pl_intr |= F_PL_INTR_EXT | F_PL_INTR_PCIX;
-	writel(pl_intr, adapter->regs + A_PL_ENABLE);
-}
-
-/* Disables all interrupts. */
-void t1_interrupts_disable(adapter_t* adapter)
-{
-	unsigned int i;
-
-	t1_sge_intr_disable(adapter->sge);
-	if (adapter->espi)
-		t1_espi_intr_disable(adapter->espi);
-
-	/* Disable MAC/PHY interrupts for each port. */
-	for_each_port(adapter, i) {
-		adapter->port[i].mac->ops->interrupt_disable(adapter->port[i].mac);
-		adapter->port[i].phy->ops->interrupt_disable(adapter->port[i].phy);
-	}
-
-	/* Disable PCIX & external chip interrupts. */
-	writel(0, adapter->regs + A_PL_ENABLE);
-
-	/* PCI-X interrupts */
-	pci_write_config_dword(adapter->pdev, A_PCICFG_INTR_ENABLE, 0);
-
-	adapter->slow_intr_mask = 0;
-}
-
-/* Clears all interrupts */
-void t1_interrupts_clear(adapter_t* adapter)
-{
-	unsigned int i;
-	u32 pl_intr;
-
-
-	t1_sge_intr_clear(adapter->sge);
-	if (adapter->espi)
-		t1_espi_intr_clear(adapter->espi);
-
-	/* Clear MAC/PHY interrupts for each port. */
-	for_each_port(adapter, i) {
-		adapter->port[i].mac->ops->interrupt_clear(adapter->port[i].mac);
-		adapter->port[i].phy->ops->interrupt_clear(adapter->port[i].phy);
-	}
-
-	/* Enable interrupts for external devices. */
-    	pl_intr = readl(adapter->regs + A_PL_CAUSE);
-
-	writel(pl_intr | F_PL_INTR_EXT | F_PL_INTR_PCIX,
-	       adapter->regs + A_PL_CAUSE);
-
-	/* PCI-X interrupts */
-	pci_write_config_dword(adapter->pdev, A_PCICFG_INTR_CAUSE, 0xffffffff);
-}
-
-/*
- * Slow path interrupt handler for ASICs.
- */
-int t1_slow_intr_handler(adapter_t *adapter)
-{
-	u32 cause = readl(adapter->regs + A_PL_CAUSE);
-
-	cause &= adapter->slow_intr_mask;
-	if (!cause)
-		return 0;
-	if (cause & F_PL_INTR_SGE_ERR)
-		t1_sge_intr_error_handler(adapter->sge);
-	if (cause & F_PL_INTR_ESPI)
-		t1_espi_intr_handler(adapter->espi);
-	if (cause & F_PL_INTR_PCIX)
-		t1_pci_intr_handler(adapter);
-	if (cause & F_PL_INTR_EXT)
-		t1_elmer0_ext_intr(adapter);
-
-	/* Clear the interrupts just processed. */
-	writel(cause, adapter->regs + A_PL_CAUSE);
-	(void)readl(adapter->regs + A_PL_CAUSE); /* flush writes */
-	return 1;
-}
-
-/* Pause deadlock avoidance parameters */
-#define DROP_MSEC 16
-#define DROP_PKTS_CNT  1
-
-static void set_csum_offload(adapter_t *adapter, u32 csum_bit, int enable)
-{
-	u32 val = readl(adapter->regs + A_TP_GLOBAL_CONFIG);
-
-	if (enable)
-		val |= csum_bit;
-	else
-		val &= ~csum_bit;
-	writel(val, adapter->regs + A_TP_GLOBAL_CONFIG);
-}
-
-void t1_tp_set_ip_checksum_offload(adapter_t *adapter, int enable)
-{
-	set_csum_offload(adapter, F_IP_CSUM, enable);
-}
-
-void t1_tp_set_udp_checksum_offload(adapter_t *adapter, int enable)
-{
-	set_csum_offload(adapter, F_UDP_CSUM, enable);
-}
-
-void t1_tp_set_tcp_checksum_offload(adapter_t *adapter, int enable)
-{
-	set_csum_offload(adapter, F_TCP_CSUM, enable);
-}
-
-static void t1_tp_reset(adapter_t *adapter, unsigned int tp_clk)
-{
-	u32 val;
-
-	val = F_TP_IN_CSPI_CPL | F_TP_IN_CSPI_CHECK_IP_CSUM |
-	      F_TP_IN_CSPI_CHECK_TCP_CSUM | F_TP_IN_ESPI_ETHERNET;
-	val |= F_TP_IN_ESPI_CHECK_IP_CSUM |
-	       F_TP_IN_ESPI_CHECK_TCP_CSUM;
-	writel(val, adapter->regs + A_TP_IN_CONFIG);
-	writel(F_TP_OUT_CSPI_CPL |
-	       F_TP_OUT_ESPI_ETHERNET |
-	       F_TP_OUT_ESPI_GENERATE_IP_CSUM |
-	       F_TP_OUT_ESPI_GENERATE_TCP_CSUM,
-	       adapter->regs + A_TP_OUT_CONFIG);
-
-	val = readl(adapter->regs + A_TP_GLOBAL_CONFIG);
-	val &= ~(F_IP_CSUM | F_UDP_CSUM | F_TCP_CSUM);
-	writel(val, adapter->regs + A_TP_GLOBAL_CONFIG);
-
-	/*
-	 * Enable pause frame deadlock prevention.
-	 */
-	if (is_T2(adapter)) {
-		u32 drop_ticks = DROP_MSEC * (tp_clk / 1000);
-
-		writel(F_ENABLE_TX_DROP | F_ENABLE_TX_ERROR |
-		       V_DROP_TICKS_CNT(drop_ticks) |
-		       V_NUM_PKTS_DROPPED(DROP_PKTS_CNT),
-		       adapter->regs + A_TP_TX_DROP_CONFIG);
-	}
-
-	writel(F_TP_RESET, adapter->regs + A_TP_RESET);
-}
-
-int __devinit t1_get_board_rev(adapter_t *adapter, const struct board_info *bi,
-			       struct adapter_params *p)
-{
-	p->chip_version = bi->chip_term;
-	if (p->chip_version == CHBT_TERM_T1 ||
-	    p->chip_version == CHBT_TERM_T2) {
-		u32 val = readl(adapter->regs + A_TP_PC_CONFIG);
-
-		val = G_TP_PC_REV(val);
-		if (val == 2)
-			p->chip_revision = TERM_T1B;
-		else if (val == 3)
-			p->chip_revision = TERM_T2;
-		else
-			return -1;
-	} else
-		return -1;
-	return 0;
-}
-
-/*
- * Enable board components other than the Chelsio chip, such as external MAC
- * and PHY.
- */
-static int board_init(adapter_t *adapter, const struct board_info *bi)
-{
-	switch (bi->board) {
-	case CHBT_BOARD_N110:
-	case CHBT_BOARD_N210:
-		writel(V_TPIPAR(0xf), adapter->regs + A_TPI_PAR);
-    		t1_tpi_write(adapter, A_ELMER0_GPO, 0x800);
-		break;
-	}
-	return 0;
-}
-
-/*
- * Initialize and configure the Terminator HW modules.  Note that external
- * MAC and PHYs are initialized separately.
- */
-int t1_init_hw_modules(adapter_t *adapter)
-{
-	int err = -EIO;
-	const struct board_info *bi = board_info(adapter);
-
-	if (!bi->clock_mc4) {
-		u32 val = readl(adapter->regs + A_MC4_CFG);
-
-		writel(val | F_READY | F_MC4_SLOW, adapter->regs + A_MC4_CFG);
-		writel(F_M_BUS_ENABLE | F_TCAM_RESET,
-		       adapter->regs + A_MC5_CONFIG);
-	}
-
-	if (adapter->espi && t1_espi_init(adapter->espi, bi->chip_mac,
-					  bi->espi_nports))
-		goto out_err;
-
-	t1_tp_reset(adapter, bi->clock_core);
-
-	err = t1_sge_configure(adapter->sge, &adapter->params.sge);
-	if (err)
-		goto out_err;
-
-	err = 0;
- out_err:
-	return err;
-}
-
-/*
- * Determine a card's PCI mode.
- */
-static void __devinit get_pci_mode(adapter_t *adapter, struct chelsio_pci_params *p)
-{
-	static unsigned short speed_map[] = { 33, 66, 100, 133 };
-	u32 pci_mode;
-
-	pci_read_config_dword(adapter->pdev, A_PCICFG_MODE, &pci_mode);
-	p->speed = speed_map[G_PCI_MODE_CLK(pci_mode)];
-	p->width = (pci_mode & F_PCI_MODE_64BIT) ? 64 : 32;
-	p->is_pcix = (pci_mode & F_PCI_MODE_PCIX) != 0;
-}
-
-/*
- * Release the structures holding the SW per-Terminator-HW-module state.
- */
-void t1_free_sw_modules(adapter_t *adapter)
-{
-	unsigned int i;
-
-	for_each_port(adapter, i) {
-		struct cmac *mac = adapter->port[i].mac;
-		struct cphy *phy = adapter->port[i].phy;
-
-		if (mac)
-			mac->ops->destroy(mac);
-		if (phy)
-			phy->ops->destroy(phy);
-	}
-
-	if (adapter->sge)
-		t1_sge_destroy(adapter->sge);
-	if (adapter->espi)
-		t1_espi_destroy(adapter->espi);
-}
-
-static void __devinit init_link_config(struct link_config *lc,
-				       const struct board_info *bi)
-{
-	lc->supported = bi->caps;
-	lc->requested_speed = lc->speed = SPEED_INVALID;
-	lc->requested_duplex = lc->duplex = DUPLEX_INVALID;
-	lc->requested_fc = lc->fc = PAUSE_RX | PAUSE_TX;
-	if (lc->supported & SUPPORTED_Autoneg) {
-		lc->advertising = lc->supported;
-		lc->autoneg = AUTONEG_ENABLE;
-		lc->requested_fc |= PAUSE_AUTONEG;
-	} else {
-		lc->advertising = 0;
-		lc->autoneg = AUTONEG_DISABLE;
-	}
-}
-
-
-/*
- * Allocate and initialize the data structures that hold the SW state of
- * the Terminator HW modules.
- */
-int __devinit t1_init_sw_modules(adapter_t *adapter,
-				 const struct board_info *bi)
-{
-	unsigned int i;
-
-	adapter->params.brd_info = bi;
-	adapter->params.nports = bi->port_number;
-	adapter->params.stats_update_period = bi->gmac->stats_update_period;
-
-	adapter->sge = t1_sge_create(adapter, &adapter->params.sge);
-	if (!adapter->sge) {
-		CH_ERR("%s: SGE initialization failed\n",
-		       adapter->name);
-		goto error;
-	}
-
-	if (bi->espi_nports && !(adapter->espi = t1_espi_create(adapter))) {
-		CH_ERR("%s: ESPI initialization failed\n",
-		       adapter->name);
-		goto error;
-	}
-
-	board_init(adapter, bi);
-	bi->mdio_ops->init(adapter, bi);
-	if (bi->gphy->reset)
-		bi->gphy->reset(adapter);
-	if (bi->gmac->reset)
-		bi->gmac->reset(adapter);
-
-	for_each_port(adapter, i) {
-		u8 hw_addr[6];
-		struct cmac *mac;
-		int phy_addr = bi->mdio_phybaseaddr + i;
-
-		adapter->port[i].phy = bi->gphy->create(adapter, phy_addr,
-							bi->mdio_ops);
-		if (!adapter->port[i].phy) {
-			CH_ERR("%s: PHY %d initialization failed\n",
-			       adapter->name, i);
-			goto error;
-		}
-
-		adapter->port[i].mac = mac = bi->gmac->create(adapter, i);
-		if (!mac) {
-			CH_ERR("%s: MAC %d initialization failed\n",
-			       adapter->name, i);
-			goto error;
-		}
-
-		/*
-		 * Get the port's MAC addresses either from the EEPROM if one
-		 * exists or the one hardcoded in the MAC.
-		 */
-		if (vpd_macaddress_get(adapter, i, hw_addr)) {
-			CH_ERR("%s: could not read MAC address from VPD ROM\n",
-			       adapter->port[i].dev->name);
-			goto error;
-		}
-		memcpy(adapter->port[i].dev->dev_addr, hw_addr, ETH_ALEN);
-		init_link_config(&adapter->port[i].link_config, bi);
-	}
-
-	get_pci_mode(adapter, &adapter->params.pci);
-	t1_interrupts_clear(adapter);
-	return 0;
-
- error:
-	t1_free_sw_modules(adapter);
-	return -1;
-}
diff --git a/trunk/drivers/net/chelsio/suni1x10gexp_regs.h b/trunk/drivers/net/chelsio/suni1x10gexp_regs.h
deleted file mode 100644
index 81816c2b708a..000000000000
--- a/trunk/drivers/net/chelsio/suni1x10gexp_regs.h
+++ /dev/null
@@ -1,213 +0,0 @@
-/*****************************************************************************
- *                                                                           *
- * File: suni1x10gexp_regs.h                                                 *
- * $Revision: 1.9 $                                                          *
- * $Date: 2005/06/22 00:17:04 $                                              *
- * Description:                                                              *
- *  PMC/SIERRA (pm3393) MAC-PHY functionality.                               *
- *  part of the Chelsio 10Gb Ethernet Driver.                                *
- *                                                                           *
- * This program is free software; you can redistribute it and/or modify      *
- * it under the terms of the GNU General Public License, version 2, as       *
- * published by the Free Software Foundation.                                *
- *                                                                           *
- * You should have received a copy of the GNU General Public License along   *
- * with this program; if not, write to the Free Software Foundation, Inc.,   *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.                 *
- *                                                                           *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED    *
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF      *
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.                     *
- *                                                                           *
- * http://www.chelsio.com                                                    *
- *                                                                           *
- * Maintainers: maintainers@chelsio.com                                      *
- *                                                                           *
- * Authors: PMC/SIERRA                                                       *
- *                                                                           *
- * History:                                                                  *
- *                                                                           *
- ****************************************************************************/
-
-#ifndef _CXGB_SUNI1x10GEXP_REGS_H_
-#define _CXGB_SUNI1x10GEXP_REGS_H_
-
-/******************************************************************************/
-/** S/UNI-1x10GE-XP REGISTER ADDRESS MAP                                     **/
-/******************************************************************************/
-/* Refer to the Register Bit Masks bellow for the naming of each register and */
-/* to the S/UNI-1x10GE-XP Data Sheet for the signification of each bit        */
-/******************************************************************************/
-
-#define SUNI1x10GEXP_REG_DEVICE_STATUS                                   0x0004
-#define SUNI1x10GEXP_REG_MASTER_INTERRUPT_STATUS                         0x000D
-#define SUNI1x10GEXP_REG_GLOBAL_INTERRUPT_ENABLE                         0x000E
-#define SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_ENABLE                    0x0102
-#define SUNI1x10GEXP_REG_SERDES_3125_INTERRUPT_STATUS                    0x0104
-#define SUNI1x10GEXP_REG_RXXG_CONFIG_1                                   0x2040
-#define SUNI1x10GEXP_REG_RXXG_CONFIG_3                                   0x2042
-#define SUNI1x10GEXP_REG_RXXG_INTERRUPT                                  0x2043
-#define SUNI1x10GEXP_REG_RXXG_MAX_FRAME_LENGTH                           0x2045
-#define SUNI1x10GEXP_REG_RXXG_SA_15_0                                    0x2046
-#define SUNI1x10GEXP_REG_RXXG_SA_31_16                                   0x2047
-#define SUNI1x10GEXP_REG_RXXG_SA_47_32                                   0x2048
-#define SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_LOW                     0x204D
-#define SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_MID                     0x204E
-#define SUNI1x10GEXP_REG_RXXG_EXACT_MATCH_ADDR_1_HIGH                    0x204F
-#define SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_LOW                         0x206A
-#define SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDLOW                      0x206B
-#define SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_MIDHIGH                     0x206C
-#define SUNI1x10GEXP_REG_RXXG_MULTICAST_HASH_HIGH                        0x206D
-#define SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_0                   0x206E
-#define SUNI1x10GEXP_REG_RXXG_ADDRESS_FILTER_CONTROL_2                   0x2070
-#define SUNI1x10GEXP_REG_XRF_INTERRUPT_ENABLE                            0x2088
-#define SUNI1x10GEXP_REG_XRF_INTERRUPT_STATUS                            0x2089
-#define SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_ENABLE                       0x208B
-#define SUNI1x10GEXP_REG_XRF_DIAG_INTERRUPT_STATUS                       0x208C
-#define SUNI1x10GEXP_REG_RXOAM_INTERRUPT_ENABLE                          0x20C7
-#define SUNI1x10GEXP_REG_RXOAM_INTERRUPT_STATUS                          0x20C8
-#define SUNI1x10GEXP_REG_MSTAT_CONTROL                                   0x2100
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_0                        0x2101
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_1                        0x2102
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_2                        0x2103
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_ROLLOVER_3                        0x2104
-#define SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_0                          0x2105
-#define SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_1                          0x2106
-#define SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_2                          0x2107
-#define SUNI1x10GEXP_REG_MSTAT_INTERRUPT_MASK_3                          0x2108
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_0_LOW                             0x2110
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_1_LOW                             0x2114
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_4_LOW                             0x2120
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_5_LOW                             0x2124
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_6_LOW                             0x2128
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_8_LOW                             0x2130
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_10_LOW                            0x2138
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_11_LOW                            0x213C
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_12_LOW                            0x2140
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_13_LOW                            0x2144
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_15_LOW                            0x214C
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_16_LOW                            0x2150
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_17_LOW                            0x2154
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_18_LOW                            0x2158
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_33_LOW                            0x2194
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_35_LOW                            0x219C
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_36_LOW                            0x21A0
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_38_LOW                            0x21A8
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_40_LOW                            0x21B0
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_42_LOW                            0x21B8
-#define SUNI1x10GEXP_REG_MSTAT_COUNTER_43_LOW                            0x21BC
-#define SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_ENABLE                       0x2209
-#define SUNI1x10GEXP_REG_IFLX_FIFO_OVERFLOW_INTERRUPT                    0x220A
-#define SUNI1x10GEXP_REG_PL4ODP_INTERRUPT_MASK                           0x2282
-#define SUNI1x10GEXP_REG_PL4ODP_INTERRUPT                                0x2283
-#define SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_STATUS                        0x2300
-#define SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_CHANGE                        0x2301
-#define SUNI1x10GEXP_REG_PL4IO_LOCK_DETECT_MASK                          0x2302
-#define SUNI1x10GEXP_REG_TXXG_CONFIG_1                                   0x3040
-#define SUNI1x10GEXP_REG_TXXG_CONFIG_3                                   0x3042
-#define SUNI1x10GEXP_REG_TXXG_INTERRUPT                                  0x3043
-#define SUNI1x10GEXP_REG_TXXG_MAX_FRAME_SIZE                             0x3045
-#define SUNI1x10GEXP_REG_TXXG_SA_15_0                                    0x3047
-#define SUNI1x10GEXP_REG_TXXG_SA_31_16                                   0x3048
-#define SUNI1x10GEXP_REG_TXXG_SA_47_32                                   0x3049
-#define SUNI1x10GEXP_REG_XTEF_INTERRUPT_STATUS                           0x3084
-#define SUNI1x10GEXP_REG_XTEF_INTERRUPT_ENABLE                           0x3085
-#define SUNI1x10GEXP_REG_TXOAM_INTERRUPT_ENABLE                          0x30C6
-#define SUNI1x10GEXP_REG_TXOAM_INTERRUPT_STATUS                          0x30C7
-#define SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_ENABLE                 0x320C
-#define SUNI1x10GEXP_REG_EFLX_FIFO_OVERFLOW_ERROR_INDICATION             0x320D
-#define SUNI1x10GEXP_REG_PL4IDU_INTERRUPT_MASK                           0x3282
-#define SUNI1x10GEXP_REG_PL4IDU_INTERRUPT                                0x3283
-
-/******************************************************************************/
-/*                 -- End register offset definitions --                      */
-/******************************************************************************/
-
-/******************************************************************************/
-/** SUNI-1x10GE-XP REGISTER BIT MASKS                                        **/
-/******************************************************************************/
-
-/*----------------------------------------------------------------------------
- * Register 0x0004: S/UNI-1x10GE-XP Device Status
- *    Bit 9 TOP_SXRA_EXPIRED
- *    Bit 8 TOP_MDIO_BUSY
- *    Bit 7 TOP_DTRB
- *    Bit 6 TOP_EXPIRED
- *    Bit 5 TOP_PAUSED
- *    Bit 4 TOP_PL4_ID_DOOL
- *    Bit 3 TOP_PL4_IS_DOOL
- *    Bit 2 TOP_PL4_ID_ROOL
- *    Bit 1 TOP_PL4_IS_ROOL
- *    Bit 0 TOP_PL4_OUT_ROOL
- *----------------------------------------------------------------------------*/
-#define SUNI1x10GEXP_BITMSK_TOP_SXRA_EXPIRED  0x0200
-#define SUNI1x10GEXP_BITMSK_TOP_EXPIRED       0x0040
-#define SUNI1x10GEXP_BITMSK_TOP_PL4_ID_DOOL   0x0010
-#define SUNI1x10GEXP_BITMSK_TOP_PL4_IS_DOOL   0x0008
-#define SUNI1x10GEXP_BITMSK_TOP_PL4_ID_ROOL   0x0004
-#define SUNI1x10GEXP_BITMSK_TOP_PL4_IS_ROOL   0x0002
-#define SUNI1x10GEXP_BITMSK_TOP_PL4_OUT_ROOL  0x0001
-
-/*----------------------------------------------------------------------------
- * Register 0x000E:PM3393 Global interrupt enable
- *    Bit 15 TOP_INTE
- *----------------------------------------------------------------------------*/
-#define SUNI1x10GEXP_BITMSK_TOP_INTE  0x8000
-
-/*----------------------------------------------------------------------------
- * Register 0x2040: RXXG Configuration 1
- *    Bit 15  RXXG_RXEN
- *    Bit 14  RXXG_ROCF
- *    Bit 13  RXXG_PAD_STRIP
- *    Bit 10  RXXG_PUREP
- *    Bit 9   RXXG_LONGP
- *    Bit 8   RXXG_PARF
- *    Bit 7   RXXG_FLCHK
- *    Bit 5   RXXG_PASS_CTRL
- *    Bit 3   RXXG_CRC_STRIP
- *    Bit 2-0 RXXG_MIFG
- *----------------------------------------------------------------------------*/
-#define SUNI1x10GEXP_BITMSK_RXXG_RXEN       0x8000
-#define SUNI1x10GEXP_BITMSK_RXXG_PUREP      0x0400
-#define SUNI1x10GEXP_BITMSK_RXXG_FLCHK      0x0080
-#define SUNI1x10GEXP_BITMSK_RXXG_CRC_STRIP  0x0008
-
-/*----------------------------------------------------------------------------
- * Register 0x2070: RXXG Address Filter Control 2
- *    Bit 1 RXXG_PMODE
- *    Bit 0 RXXG_MHASH_EN
- *----------------------------------------------------------------------------*/
-#define SUNI1x10GEXP_BITMSK_RXXG_PMODE     0x0002
-#define SUNI1x10GEXP_BITMSK_RXXG_MHASH_EN  0x0001
-
-/*----------------------------------------------------------------------------
- * Register 0x2100: MSTAT Control
- *    Bit 2 MSTAT_WRITE
- *    Bit 1 MSTAT_CLEAR
- *    Bit 0 MSTAT_SNAP
- *----------------------------------------------------------------------------*/
-#define SUNI1x10GEXP_BITMSK_MSTAT_CLEAR  0x0002
-#define SUNI1x10GEXP_BITMSK_MSTAT_SNAP   0x0001
-
-/*----------------------------------------------------------------------------
- * Register 0x3040: TXXG Configuration Register 1
- *    Bit 15   TXXG_TXEN0
- *    Bit 13   TXXG_HOSTPAUSE
- *    Bit 12-7 TXXG_IPGT
- *    Bit 5    TXXG_32BIT_ALIGN
- *    Bit 4    TXXG_CRCEN
- *    Bit 3    TXXG_FCTX
- *    Bit 2    TXXG_FCRX
- *    Bit 1    TXXG_PADEN
- *    Bit 0    TXXG_SPRE
- *----------------------------------------------------------------------------*/
-#define SUNI1x10GEXP_BITMSK_TXXG_TXEN0        0x8000
-#define SUNI1x10GEXP_BITOFF_TXXG_IPGT         7
-#define SUNI1x10GEXP_BITMSK_TXXG_32BIT_ALIGN  0x0020
-#define SUNI1x10GEXP_BITMSK_TXXG_CRCEN        0x0010
-#define SUNI1x10GEXP_BITMSK_TXXG_FCTX         0x0008
-#define SUNI1x10GEXP_BITMSK_TXXG_FCRX         0x0004
-#define SUNI1x10GEXP_BITMSK_TXXG_PADEN        0x0002
-
-#endif /* _CXGB_SUNI1x10GEXP_REGS_H_ */
-
diff --git a/trunk/drivers/net/e100.c b/trunk/drivers/net/e100.c
index 25cc20e415da..d0fa2448761d 100644
--- a/trunk/drivers/net/e100.c
+++ b/trunk/drivers/net/e100.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   
-  Copyright(c) 1999 - 2005 Intel Corporation. All rights reserved.
+  Copyright(c) 1999 - 2004 Intel Corporation. All rights reserved.
   
   This program is free software; you can redistribute it and/or modify it 
   under the terms of the GNU General Public License as published by the Free 
@@ -156,7 +156,7 @@
 
 #define DRV_NAME		"e100"
 #define DRV_EXT		"-NAPI"
-#define DRV_VERSION		"3.4.14-k2"DRV_EXT
+#define DRV_VERSION		"3.4.8-k2"DRV_EXT
 #define DRV_DESCRIPTION		"Intel(R) PRO/100 Network Driver"
 #define DRV_COPYRIGHT		"Copyright(c) 1999-2005 Intel Corporation"
 #define PFX			DRV_NAME ": "
@@ -785,7 +785,6 @@ static int e100_eeprom_save(struct nic *nic, u16 start, u16 count)
 }
 
 #define E100_WAIT_SCB_TIMEOUT 20000 /* we might have to wait 100ms!!! */
-#define E100_WAIT_SCB_FAST 20       /* delay like the old code */
 static inline int e100_exec_cmd(struct nic *nic, u8 cmd, dma_addr_t dma_addr)
 {
 	unsigned long flags;
@@ -799,7 +798,7 @@ static inline int e100_exec_cmd(struct nic *nic, u8 cmd, dma_addr_t dma_addr)
 		if(likely(!readb(&nic->csr->scb.cmd_lo)))
 			break;
 		cpu_relax();
-		if(unlikely(i > E100_WAIT_SCB_FAST))
+		if(unlikely(i > (E100_WAIT_SCB_TIMEOUT >> 1)))
 			udelay(5);
 	}
 	if(unlikely(i == E100_WAIT_SCB_TIMEOUT)) {
@@ -903,8 +902,8 @@ static void mdio_write(struct net_device *netdev, int addr, int reg, int data)
 
 static void e100_get_defaults(struct nic *nic)
 {
-	struct param_range rfds = { .min = 16, .max = 256, .count = 256 };
-	struct param_range cbs  = { .min = 64, .max = 256, .count = 128 };
+	struct param_range rfds = { .min = 16, .max = 256, .count = 64 };
+	struct param_range cbs  = { .min = 64, .max = 256, .count = 64 };
 
 	pci_read_config_byte(nic->pdev, PCI_REVISION_ID, &nic->rev_id);
 	/* MAC type is encoded as rev ID; exception: ICH is treated as 82559 */
@@ -1007,213 +1006,25 @@ static void e100_configure(struct nic *nic, struct cb *cb, struct sk_buff *skb)
 		c[16], c[17], c[18], c[19], c[20], c[21], c[22], c[23]);
 }
 
-/********************************************************/
-/*  Micro code for 8086:1229 Rev 8                      */
-/********************************************************/
-
-/*  Parameter values for the D101M B-step  */
-#define D101M_CPUSAVER_TIMER_DWORD		78
-#define D101M_CPUSAVER_BUNDLE_DWORD		65
-#define D101M_CPUSAVER_MIN_SIZE_DWORD		126
-
-#define D101M_B_RCVBUNDLE_UCODE \
-{\
-0x00550215, 0xFFFF0437, 0xFFFFFFFF, 0x06A70789, 0xFFFFFFFF, 0x0558FFFF, \
-0x000C0001, 0x00101312, 0x000C0008, 0x00380216, \
-0x0010009C, 0x00204056, 0x002380CC, 0x00380056, \
-0x0010009C, 0x00244C0B, 0x00000800, 0x00124818, \
-0x00380438, 0x00000000, 0x00140000, 0x00380555, \
-0x00308000, 0x00100662, 0x00100561, 0x000E0408, \
-0x00134861, 0x000C0002, 0x00103093, 0x00308000, \
-0x00100624, 0x00100561, 0x000E0408, 0x00100861, \
-0x000C007E, 0x00222C21, 0x000C0002, 0x00103093, \
-0x00380C7A, 0x00080000, 0x00103090, 0x00380C7A, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x0010009C, 0x00244C2D, 0x00010004, 0x00041000, \
-0x003A0437, 0x00044010, 0x0038078A, 0x00000000, \
-0x00100099, 0x00206C7A, 0x0010009C, 0x00244C48, \
-0x00130824, 0x000C0001, 0x00101213, 0x00260C75, \
-0x00041000, 0x00010004, 0x00130826, 0x000C0006, \
-0x002206A8, 0x0013C926, 0x00101313, 0x003806A8, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00080600, 0x00101B10, 0x00050004, 0x00100826, \
-0x00101210, 0x00380C34, 0x00000000, 0x00000000, \
-0x0021155B, 0x00100099, 0x00206559, 0x0010009C, \
-0x00244559, 0x00130836, 0x000C0000, 0x00220C62, \
-0x000C0001, 0x00101B13, 0x00229C0E, 0x00210C0E, \
-0x00226C0E, 0x00216C0E, 0x0022FC0E, 0x00215C0E, \
-0x00214C0E, 0x00380555, 0x00010004, 0x00041000, \
-0x00278C67, 0x00040800, 0x00018100, 0x003A0437, \
-0x00130826, 0x000C0001, 0x00220559, 0x00101313, \
-0x00380559, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00130831, 0x0010090B, 0x00124813, \
-0x000CFF80, 0x002606AB, 0x00041000, 0x00010004, \
-0x003806A8, 0x00000000, 0x00000000, 0x00000000, \
-}
-
-/********************************************************/
-/*  Micro code for 8086:1229 Rev 9                      */
-/********************************************************/
-
-/*  Parameter values for the D101S  */
-#define D101S_CPUSAVER_TIMER_DWORD		78
-#define D101S_CPUSAVER_BUNDLE_DWORD		67
-#define D101S_CPUSAVER_MIN_SIZE_DWORD		128
-
-#define D101S_RCVBUNDLE_UCODE \
-{\
-0x00550242, 0xFFFF047E, 0xFFFFFFFF, 0x06FF0818, 0xFFFFFFFF, 0x05A6FFFF, \
-0x000C0001, 0x00101312, 0x000C0008, 0x00380243, \
-0x0010009C, 0x00204056, 0x002380D0, 0x00380056, \
-0x0010009C, 0x00244F8B, 0x00000800, 0x00124818, \
-0x0038047F, 0x00000000, 0x00140000, 0x003805A3, \
-0x00308000, 0x00100610, 0x00100561, 0x000E0408, \
-0x00134861, 0x000C0002, 0x00103093, 0x00308000, \
-0x00100624, 0x00100561, 0x000E0408, 0x00100861, \
-0x000C007E, 0x00222FA1, 0x000C0002, 0x00103093, \
-0x00380F90, 0x00080000, 0x00103090, 0x00380F90, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x0010009C, 0x00244FAD, 0x00010004, 0x00041000, \
-0x003A047E, 0x00044010, 0x00380819, 0x00000000, \
-0x00100099, 0x00206FFD, 0x0010009A, 0x0020AFFD, \
-0x0010009C, 0x00244FC8, 0x00130824, 0x000C0001, \
-0x00101213, 0x00260FF7, 0x00041000, 0x00010004, \
-0x00130826, 0x000C0006, 0x00220700, 0x0013C926, \
-0x00101313, 0x00380700, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00080600, 0x00101B10, 0x00050004, 0x00100826, \
-0x00101210, 0x00380FB6, 0x00000000, 0x00000000, \
-0x002115A9, 0x00100099, 0x002065A7, 0x0010009A, \
-0x0020A5A7, 0x0010009C, 0x002445A7, 0x00130836, \
-0x000C0000, 0x00220FE4, 0x000C0001, 0x00101B13, \
-0x00229F8E, 0x00210F8E, 0x00226F8E, 0x00216F8E, \
-0x0022FF8E, 0x00215F8E, 0x00214F8E, 0x003805A3, \
-0x00010004, 0x00041000, 0x00278FE9, 0x00040800, \
-0x00018100, 0x003A047E, 0x00130826, 0x000C0001, \
-0x002205A7, 0x00101313, 0x003805A7, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00130831, \
-0x0010090B, 0x00124813, 0x000CFF80, 0x00260703, \
-0x00041000, 0x00010004, 0x00380700  \
-}
-
-/********************************************************/
-/*  Micro code for the 8086:1229 Rev F/10               */
-/********************************************************/
-
-/*  Parameter values for the D102 E-step  */
-#define D102_E_CPUSAVER_TIMER_DWORD		42
-#define D102_E_CPUSAVER_BUNDLE_DWORD		54
-#define D102_E_CPUSAVER_MIN_SIZE_DWORD		46
-
-#define     D102_E_RCVBUNDLE_UCODE \
-{\
-0x007D028F, 0x0E4204F9, 0x14ED0C85, 0x14FA14E9, 0x0EF70E36, 0x1FFF1FFF, \
-0x00E014B9, 0x00000000, 0x00000000, 0x00000000, \
-0x00E014BD, 0x00000000, 0x00000000, 0x00000000, \
-0x00E014D5, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00E014C1, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00E014C8, 0x00000000, 0x00000000, 0x00000000, \
-0x00200600, 0x00E014EE, 0x00000000, 0x00000000, \
-0x0030FF80, 0x00940E46, 0x00038200, 0x00102000, \
-0x00E00E43, 0x00000000, 0x00000000, 0x00000000, \
-0x00300006, 0x00E014FB, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00906E41, 0x00800E3C, 0x00E00E39, 0x00000000, \
-0x00906EFD, 0x00900EFD, 0x00E00EF8, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-0x00000000, 0x00000000, 0x00000000, 0x00000000, \
-}
-
 static void e100_load_ucode(struct nic *nic, struct cb *cb, struct sk_buff *skb)
 {
-/* *INDENT-OFF* */
-	static struct {
-		u32 ucode[UCODE_SIZE + 1];
-		u8 mac;
-		u8 timer_dword;
-		u8 bundle_dword;
-		u8 min_size_dword;
-	} ucode_opts[] = {
-		{ D101M_B_RCVBUNDLE_UCODE,
-		  mac_82559_D101M,
-		  D101M_CPUSAVER_TIMER_DWORD,
-		  D101M_CPUSAVER_BUNDLE_DWORD,
-		  D101M_CPUSAVER_MIN_SIZE_DWORD },
-		{ D101S_RCVBUNDLE_UCODE,
-		  mac_82559_D101S,
-		  D101S_CPUSAVER_TIMER_DWORD,
-		  D101S_CPUSAVER_BUNDLE_DWORD,
-		  D101S_CPUSAVER_MIN_SIZE_DWORD },
-		{ D102_E_RCVBUNDLE_UCODE,
-		  mac_82551_F,
-		  D102_E_CPUSAVER_TIMER_DWORD,
-		  D102_E_CPUSAVER_BUNDLE_DWORD,
-		  D102_E_CPUSAVER_MIN_SIZE_DWORD },
-		{ D102_E_RCVBUNDLE_UCODE,
-		  mac_82551_10,
-		  D102_E_CPUSAVER_TIMER_DWORD,
-		  D102_E_CPUSAVER_BUNDLE_DWORD,
-		  D102_E_CPUSAVER_MIN_SIZE_DWORD },
-		{ {0}, 0, 0, 0, 0}
-	}, *opts;
-/* *INDENT-ON* */
-
-#define BUNDLESMALL 1
-#define BUNDLEMAX 50
-#define INTDELAY 15000
-
-	opts = ucode_opts;
-
-	/* do not load u-code for ICH devices */
-	if (nic->flags & ich)
-		return;
-
-	/* Search for ucode match against h/w rev_id */
-	while (opts->mac) {
-		if (nic->mac == opts->mac) {
-			int i;
-			u32 *ucode = opts->ucode;
-
-			/* Insert user-tunable settings */
-			ucode[opts->timer_dword] &= 0xFFFF0000;
-			ucode[opts->timer_dword] |=
-				(u16) INTDELAY;
-			ucode[opts->bundle_dword] &= 0xFFFF0000;
-			ucode[opts->bundle_dword] |= (u16) BUNDLEMAX;
-			ucode[opts->min_size_dword] &= 0xFFFF0000;
-			ucode[opts->min_size_dword] |=
-				(BUNDLESMALL) ?  0xFFFF : 0xFF80;
-
-			for(i = 0; i < UCODE_SIZE; i++)
-				cb->u.ucode[i] = cpu_to_le32(ucode[i]);
-			cb->command = cpu_to_le16(cb_ucode);
-			return;
-		}
-		opts++;
-	}
+	int i;
+	static const u32 ucode[UCODE_SIZE] = {
+		/* NFS packets are misinterpreted as TCO packets and
+		 * incorrectly routed to the BMC over SMBus.  This
+		 * microcode patch checks the fragmented IP bit in the
+		 * NFS/UDP header to distinguish between NFS and TCO. */
+		0x0EF70E36, 0x1FFF1FFF, 0x1FFF1FFF, 0x1FFF1FFF, 0x1FFF1FFF,
+		0x1FFF1FFF, 0x00906E41, 0x00800E3C, 0x00E00E39, 0x00000000,
+		0x00906EFD, 0x00900EFD,	0x00E00EF8,
+	};
 
-	cb->command = cpu_to_le16(cb_nop);
+	if(nic->mac == mac_82551_F || nic->mac == mac_82551_10) {
+		for(i = 0; i < UCODE_SIZE; i++)
+			cb->u.ucode[i] = cpu_to_le32(ucode[i]);
+		cb->command = cpu_to_le16(cb_ucode);
+	} else
+		cb->command = cpu_to_le16(cb_nop);
 }
 
 static void e100_setup_iaaddr(struct nic *nic, struct cb *cb,
@@ -1496,15 +1307,14 @@ static inline void e100_xmit_prepare(struct nic *nic, struct cb *cb,
 {
 	cb->command = nic->tx_command;
 	/* interrupt every 16 packets regardless of delay */
-	if((nic->cbs_avail & ~15) == nic->cbs_avail)
-		cb->command |= cpu_to_le16(cb_i);
+	if((nic->cbs_avail & ~15) == nic->cbs_avail) cb->command |= cb_i;
 	cb->u.tcb.tbd_array = cb->dma_addr + offsetof(struct cb, u.tcb.tbd);
 	cb->u.tcb.tcb_byte_count = 0;
 	cb->u.tcb.threshold = nic->tx_threshold;
 	cb->u.tcb.tbd_count = 1;
 	cb->u.tcb.tbd.buf_addr = cpu_to_le32(pci_map_single(nic->pdev,
 		skb->data, skb->len, PCI_DMA_TODEVICE));
-	/* check for mapping failure? */
+	// check for mapping failure?
 	cb->u.tcb.tbd.size = cpu_to_le16(skb->len);
 }
 
@@ -1729,7 +1539,7 @@ static inline int e100_rx_indicate(struct nic *nic, struct rx *rx,
 		/* Don't indicate if hardware indicates errors */
 		nic->net_stats.rx_dropped++;
 		dev_kfree_skb_any(skb);
-	} else if(actual_size > ETH_DATA_LEN + VLAN_ETH_HLEN) {
+	} else if(actual_size > nic->netdev->mtu + VLAN_ETH_HLEN) {
 		/* Don't indicate oversized frames */
 		nic->rx_over_length_errors++;
 		nic->net_stats.rx_dropped++;
@@ -1896,7 +1706,6 @@ static int e100_poll(struct net_device *netdev, int *budget)
 static void e100_netpoll(struct net_device *netdev)
 {
 	struct nic *nic = netdev_priv(netdev);
-
 	e100_disable_irq(nic);
 	e100_intr(nic->pdev->irq, netdev, NULL);
 	e100_tx_clean(nic);
@@ -2299,8 +2108,6 @@ static void e100_diag_test(struct net_device *netdev,
 	}
 	for(i = 0; i < E100_TEST_LEN; i++)
 		test->flags |= data[i] ? ETH_TEST_FL_FAILED : 0;
-
-	msleep_interruptible(4 * 1000);
 }
 
 static int e100_phys_id(struct net_device *netdev, u32 data)
diff --git a/trunk/drivers/net/hamradio/bpqether.c b/trunk/drivers/net/hamradio/bpqether.c
index 2946e037a9b1..ba9f0580e1f9 100644
--- a/trunk/drivers/net/hamradio/bpqether.c
+++ b/trunk/drivers/net/hamradio/bpqether.c
@@ -98,7 +98,7 @@ static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
 
 static char bpq_eth_addr[6];
 
-static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
+static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *);
 static int bpq_device_event(struct notifier_block *, unsigned long, void *);
 static const char *bpq_print_ethaddr(const unsigned char *);
 
@@ -165,7 +165,7 @@ static inline int dev_is_ethdev(struct net_device *dev)
 /*
  *	Receive an AX.25 frame via an ethernet interface.
  */
-static int bpq_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptype, struct net_device *orig_dev)
+static int bpq_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptype)
 {
 	int len;
 	char * ptr;
diff --git a/trunk/drivers/net/ibmveth.c b/trunk/drivers/net/ibmveth.c
index 32d5fabd4b10..c39b0609742a 100644
--- a/trunk/drivers/net/ibmveth.c
+++ b/trunk/drivers/net/ibmveth.c
@@ -1144,7 +1144,7 @@ static void ibmveth_proc_unregister_driver(void)
 
 static struct vio_device_id ibmveth_device_table[] __devinitdata= {
 	{ "network", "IBM,l-lan"},
-	{ "", "" }
+	{ 0,}
 };
 
 MODULE_DEVICE_TABLE(vio, ibmveth_device_table);
diff --git a/trunk/drivers/net/iseries_veth.c b/trunk/drivers/net/iseries_veth.c
index dc5d089bf184..55af32e9bf08 100644
--- a/trunk/drivers/net/iseries_veth.c
+++ b/trunk/drivers/net/iseries_veth.c
@@ -79,55 +79,12 @@
 #include <asm/iommu.h>
 #include <asm/vio.h>
 
-#undef DEBUG
+#include "iseries_veth.h"
 
 MODULE_AUTHOR("Kyle Lucke <klucke@us.ibm.com>");
 MODULE_DESCRIPTION("iSeries Virtual ethernet driver");
 MODULE_LICENSE("GPL");
 
-#define VETH_EVENT_CAP	(0)
-#define VETH_EVENT_FRAMES	(1)
-#define VETH_EVENT_MONITOR	(2)
-#define VETH_EVENT_FRAMES_ACK	(3)
-
-#define VETH_MAX_ACKS_PER_MSG	(20)
-#define VETH_MAX_FRAMES_PER_MSG	(6)
-
-struct veth_frames_data {
-	u32 addr[VETH_MAX_FRAMES_PER_MSG];
-	u16 len[VETH_MAX_FRAMES_PER_MSG];
-	u32 eofmask;
-};
-#define VETH_EOF_SHIFT		(32-VETH_MAX_FRAMES_PER_MSG)
-
-struct veth_frames_ack_data {
-	u16 token[VETH_MAX_ACKS_PER_MSG];
-};
-
-struct veth_cap_data {
-	u8 caps_version;
-	u8 rsvd1;
-	u16 num_buffers;
-	u16 ack_threshold;
-	u16 rsvd2;
-	u32 ack_timeout;
-	u32 rsvd3;
-	u64 rsvd4[3];
-};
-
-struct veth_lpevent {
-	struct HvLpEvent base_event;
-	union {
-		struct veth_cap_data caps_data;
-		struct veth_frames_data frames_data;
-		struct veth_frames_ack_data frames_ack_data;
-	} u;
-
-};
-
-#define DRV_NAME	"iseries_veth"
-#define DRV_VERSION	"2.0"
-
 #define VETH_NUMBUFFERS		(120)
 #define VETH_ACKTIMEOUT 	(1000000) /* microseconds */
 #define VETH_MAX_MCAST		(12)
@@ -156,9 +113,9 @@ struct veth_lpevent {
 
 struct veth_msg {
 	struct veth_msg *next;
-	struct veth_frames_data data;
+	struct VethFramesData data;
 	int token;
-	int in_use;
+	unsigned long in_use;
 	struct sk_buff *skb;
 	struct device *dev;
 };
@@ -168,28 +125,23 @@ struct veth_lpar_connection {
 	struct work_struct statemachine_wq;
 	struct veth_msg *msgs;
 	int num_events;
-	struct veth_cap_data local_caps;
+	struct VethCapData local_caps;
 
-	struct kobject kobject;
 	struct timer_list ack_timer;
 
-	struct timer_list reset_timer;
-	unsigned int reset_timeout;
-	unsigned long last_contact;
-	int outstanding_tx;
-
 	spinlock_t lock;
 	unsigned long state;
 	HvLpInstanceId src_inst;
 	HvLpInstanceId dst_inst;
-	struct veth_lpevent cap_event, cap_ack_event;
+	struct VethLpEvent cap_event, cap_ack_event;
 	u16 pending_acks[VETH_MAX_ACKS_PER_MSG];
 	u32 num_pending_acks;
 
 	int num_ack_events;
-	struct veth_cap_data remote_caps;
+	struct VethCapData remote_caps;
 	u32 ack_timeout;
 
+	spinlock_t msg_stack_lock;
 	struct veth_msg *msg_stack_head;
 };
 
@@ -199,17 +151,15 @@ struct veth_port {
 	u64 mac_addr;
 	HvLpIndexMap lpar_map;
 
-	/* queue_lock protects the stopped_map and dev's queue. */
-	spinlock_t queue_lock;
-	HvLpIndexMap stopped_map;
+	spinlock_t pending_gate;
+	struct sk_buff *pending_skb;
+	HvLpIndexMap pending_lpmask;
 
-	/* mcast_gate protects promiscuous, num_mcast & mcast_addr. */
 	rwlock_t mcast_gate;
 	int promiscuous;
+	int all_mcast;
 	int num_mcast;
 	u64 mcast_addr[VETH_MAX_MCAST];
-
-	struct kobject kobject;
 };
 
 static HvLpIndex this_lp;
@@ -218,56 +168,44 @@ static struct net_device *veth_dev[HVMAXARCHITECTEDVIRTUALLANS]; /* = 0 */
 
 static int veth_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static void veth_recycle_msg(struct veth_lpar_connection *, struct veth_msg *);
-static void veth_wake_queues(struct veth_lpar_connection *cnx);
-static void veth_stop_queues(struct veth_lpar_connection *cnx);
-static void veth_receive(struct veth_lpar_connection *, struct veth_lpevent *);
-static void veth_release_connection(struct kobject *kobject);
-static void veth_timed_ack(unsigned long ptr);
-static void veth_timed_reset(unsigned long ptr);
+static void veth_flush_pending(struct veth_lpar_connection *cnx);
+static void veth_receive(struct veth_lpar_connection *, struct VethLpEvent *);
+static void veth_timed_ack(unsigned long connectionPtr);
 
 /*
  * Utility functions
  */
 
-#define veth_info(fmt, args...) \
-	printk(KERN_INFO DRV_NAME ": " fmt, ## args)
+#define veth_printk(prio, fmt, args...) \
+	printk(prio "%s: " fmt, __FILE__, ## args)
 
 #define veth_error(fmt, args...) \
-	printk(KERN_ERR DRV_NAME ": Error: " fmt, ## args)
-
-#ifdef DEBUG
-#define veth_debug(fmt, args...) \
-	printk(KERN_DEBUG DRV_NAME ": " fmt, ## args)
-#else
-#define veth_debug(fmt, args...) do {} while (0)
-#endif
+	printk(KERN_ERR "(%s:%3.3d) ERROR: " fmt, __FILE__, __LINE__ , ## args)
 
-/* You must hold the connection's lock when you call this function. */
 static inline void veth_stack_push(struct veth_lpar_connection *cnx,
 				   struct veth_msg *msg)
 {
+	unsigned long flags;
+
+	spin_lock_irqsave(&cnx->msg_stack_lock, flags);
 	msg->next = cnx->msg_stack_head;
 	cnx->msg_stack_head = msg;
+	spin_unlock_irqrestore(&cnx->msg_stack_lock, flags);
 }
 
-/* You must hold the connection's lock when you call this function. */
 static inline struct veth_msg *veth_stack_pop(struct veth_lpar_connection *cnx)
 {
+	unsigned long flags;
 	struct veth_msg *msg;
 
+	spin_lock_irqsave(&cnx->msg_stack_lock, flags);
 	msg = cnx->msg_stack_head;
 	if (msg)
 		cnx->msg_stack_head = cnx->msg_stack_head->next;
-
+	spin_unlock_irqrestore(&cnx->msg_stack_lock, flags);
 	return msg;
 }
 
-/* You must hold the connection's lock when you call this function. */
-static inline int veth_stack_is_empty(struct veth_lpar_connection *cnx)
-{
-	return cnx->msg_stack_head == NULL;
-}
-
 static inline HvLpEvent_Rc
 veth_signalevent(struct veth_lpar_connection *cnx, u16 subtype,
 		 HvLpEvent_AckInd ackind, HvLpEvent_AckType acktype,
@@ -311,144 +249,13 @@ static int veth_allocate_events(HvLpIndex rlp, int number)
 	struct veth_allocation vc = { COMPLETION_INITIALIZER(vc.c), 0 };
 
 	mf_allocate_lp_events(rlp, HvLpEvent_Type_VirtualLan,
-			    sizeof(struct veth_lpevent), number,
+			    sizeof(struct VethLpEvent), number,
 			    &veth_complete_allocation, &vc);
 	wait_for_completion(&vc.c);
 
 	return vc.num;
 }
 
-/*
- * sysfs support
- */
-
-struct veth_cnx_attribute {
-	struct attribute attr;
-	ssize_t (*show)(struct veth_lpar_connection *, char *buf);
-	ssize_t (*store)(struct veth_lpar_connection *, const char *buf);
-};
-
-static ssize_t veth_cnx_attribute_show(struct kobject *kobj,
-		struct attribute *attr, char *buf)
-{
-	struct veth_cnx_attribute *cnx_attr;
-	struct veth_lpar_connection *cnx;
-
-	cnx_attr = container_of(attr, struct veth_cnx_attribute, attr);
-	cnx = container_of(kobj, struct veth_lpar_connection, kobject);
-
-	if (!cnx_attr->show)
-		return -EIO;
-
-	return cnx_attr->show(cnx, buf);
-}
-
-#define CUSTOM_CNX_ATTR(_name, _format, _expression)			\
-static ssize_t _name##_show(struct veth_lpar_connection *cnx, char *buf)\
-{									\
-	return sprintf(buf, _format, _expression);			\
-}									\
-struct veth_cnx_attribute veth_cnx_attr_##_name = __ATTR_RO(_name)
-
-#define SIMPLE_CNX_ATTR(_name)	\
-	CUSTOM_CNX_ATTR(_name, "%lu\n", (unsigned long)cnx->_name)
-
-SIMPLE_CNX_ATTR(outstanding_tx);
-SIMPLE_CNX_ATTR(remote_lp);
-SIMPLE_CNX_ATTR(num_events);
-SIMPLE_CNX_ATTR(src_inst);
-SIMPLE_CNX_ATTR(dst_inst);
-SIMPLE_CNX_ATTR(num_pending_acks);
-SIMPLE_CNX_ATTR(num_ack_events);
-CUSTOM_CNX_ATTR(ack_timeout, "%d\n", jiffies_to_msecs(cnx->ack_timeout));
-CUSTOM_CNX_ATTR(reset_timeout, "%d\n", jiffies_to_msecs(cnx->reset_timeout));
-CUSTOM_CNX_ATTR(state, "0x%.4lX\n", cnx->state);
-CUSTOM_CNX_ATTR(last_contact, "%d\n", cnx->last_contact ?
-		jiffies_to_msecs(jiffies - cnx->last_contact) : 0);
-
-#define GET_CNX_ATTR(_name)	(&veth_cnx_attr_##_name.attr)
-
-static struct attribute *veth_cnx_default_attrs[] = {
-	GET_CNX_ATTR(outstanding_tx),
-	GET_CNX_ATTR(remote_lp),
-	GET_CNX_ATTR(num_events),
-	GET_CNX_ATTR(reset_timeout),
-	GET_CNX_ATTR(last_contact),
-	GET_CNX_ATTR(state),
-	GET_CNX_ATTR(src_inst),
-	GET_CNX_ATTR(dst_inst),
-	GET_CNX_ATTR(num_pending_acks),
-	GET_CNX_ATTR(num_ack_events),
-	GET_CNX_ATTR(ack_timeout),
-	NULL
-};
-
-static struct sysfs_ops veth_cnx_sysfs_ops = {
-		.show = veth_cnx_attribute_show
-};
-
-static struct kobj_type veth_lpar_connection_ktype = {
-	.release	= veth_release_connection,
-	.sysfs_ops	= &veth_cnx_sysfs_ops,
-	.default_attrs	= veth_cnx_default_attrs
-};
-
-struct veth_port_attribute {
-	struct attribute attr;
-	ssize_t (*show)(struct veth_port *, char *buf);
-	ssize_t (*store)(struct veth_port *, const char *buf);
-};
-
-static ssize_t veth_port_attribute_show(struct kobject *kobj,
-		struct attribute *attr, char *buf)
-{
-	struct veth_port_attribute *port_attr;
-	struct veth_port *port;
-
-	port_attr = container_of(attr, struct veth_port_attribute, attr);
-	port = container_of(kobj, struct veth_port, kobject);
-
-	if (!port_attr->show)
-		return -EIO;
-
-	return port_attr->show(port, buf);
-}
-
-#define CUSTOM_PORT_ATTR(_name, _format, _expression)			\
-static ssize_t _name##_show(struct veth_port *port, char *buf)		\
-{									\
-	return sprintf(buf, _format, _expression);			\
-}									\
-struct veth_port_attribute veth_port_attr_##_name = __ATTR_RO(_name)
-
-#define SIMPLE_PORT_ATTR(_name)	\
-	CUSTOM_PORT_ATTR(_name, "%lu\n", (unsigned long)port->_name)
-
-SIMPLE_PORT_ATTR(promiscuous);
-SIMPLE_PORT_ATTR(num_mcast);
-CUSTOM_PORT_ATTR(lpar_map, "0x%X\n", port->lpar_map);
-CUSTOM_PORT_ATTR(stopped_map, "0x%X\n", port->stopped_map);
-CUSTOM_PORT_ATTR(mac_addr, "0x%lX\n", port->mac_addr);
-
-#define GET_PORT_ATTR(_name)	(&veth_port_attr_##_name.attr)
-static struct attribute *veth_port_default_attrs[] = {
-	GET_PORT_ATTR(mac_addr),
-	GET_PORT_ATTR(lpar_map),
-	GET_PORT_ATTR(stopped_map),
-	GET_PORT_ATTR(promiscuous),
-	GET_PORT_ATTR(num_mcast),
-	NULL
-};
-
-static struct sysfs_ops veth_port_sysfs_ops = {
-	.show = veth_port_attribute_show
-};
-
-static struct kobj_type veth_port_ktype = {
-	.sysfs_ops	= &veth_port_sysfs_ops,
-	.default_attrs	= veth_port_default_attrs
-};
-
 /*
  * LPAR connection code
  */
@@ -459,7 +266,7 @@ static inline void veth_kick_statemachine(struct veth_lpar_connection *cnx)
 }
 
 static void veth_take_cap(struct veth_lpar_connection *cnx,
-			  struct veth_lpevent *event)
+			  struct VethLpEvent *event)
 {
 	unsigned long flags;
 
@@ -471,7 +278,7 @@ static void veth_take_cap(struct veth_lpar_connection *cnx,
 						  HvLpEvent_Type_VirtualLan);
 
 	if (cnx->state & VETH_STATE_GOTCAPS) {
-		veth_error("Received a second capabilities from LPAR %d.\n",
+		veth_error("Received a second capabilities from lpar %d\n",
 			   cnx->remote_lp);
 		event->base_event.xRc = HvLpEvent_Rc_BufferNotAvailable;
 		HvCallEvent_ackLpEvent((struct HvLpEvent *) event);
@@ -484,13 +291,13 @@ static void veth_take_cap(struct veth_lpar_connection *cnx,
 }
 
 static void veth_take_cap_ack(struct veth_lpar_connection *cnx,
-			      struct veth_lpevent *event)
+			      struct VethLpEvent *event)
 {
 	unsigned long flags;
 
 	spin_lock_irqsave(&cnx->lock, flags);
 	if (cnx->state & VETH_STATE_GOTCAPACK) {
-		veth_error("Received a second capabilities ack from LPAR %d.\n",
+		veth_error("Received a second capabilities ack from lpar %d\n",
 			   cnx->remote_lp);
 	} else {
 		memcpy(&cnx->cap_ack_event, event,
@@ -502,24 +309,19 @@ static void veth_take_cap_ack(struct veth_lpar_connection *cnx,
 }
 
 static void veth_take_monitor_ack(struct veth_lpar_connection *cnx,
-				  struct veth_lpevent *event)
+				  struct VethLpEvent *event)
 {
 	unsigned long flags;
 
 	spin_lock_irqsave(&cnx->lock, flags);
-	veth_debug("cnx %d: lost connection.\n", cnx->remote_lp);
-
-	/* Avoid kicking the statemachine once we're shutdown.
-	 * It's unnecessary and it could break veth_stop_connection(). */
-
-	if (! (cnx->state & VETH_STATE_SHUTDOWN)) {
-		cnx->state |= VETH_STATE_RESET;
-		veth_kick_statemachine(cnx);
-	}
+	veth_printk(KERN_DEBUG, "Monitor ack returned for lpar %d\n",
+		    cnx->remote_lp);
+	cnx->state |= VETH_STATE_RESET;
+	veth_kick_statemachine(cnx);
 	spin_unlock_irqrestore(&cnx->lock, flags);
 }
 
-static void veth_handle_ack(struct veth_lpevent *event)
+static void veth_handle_ack(struct VethLpEvent *event)
 {
 	HvLpIndex rlp = event->base_event.xTargetLp;
 	struct veth_lpar_connection *cnx = veth_cnx[rlp];
@@ -527,67 +329,58 @@ static void veth_handle_ack(struct veth_lpevent *event)
 	BUG_ON(! cnx);
 
 	switch (event->base_event.xSubtype) {
-	case VETH_EVENT_CAP:
+	case VethEventTypeCap:
 		veth_take_cap_ack(cnx, event);
 		break;
-	case VETH_EVENT_MONITOR:
+	case VethEventTypeMonitor:
 		veth_take_monitor_ack(cnx, event);
 		break;
 	default:
-		veth_error("Unknown ack type %d from LPAR %d.\n",
-				event->base_event.xSubtype, rlp);
+		veth_error("Unknown ack type %d from lpar %d\n",
+			   event->base_event.xSubtype, rlp);
 	};
 }
 
-static void veth_handle_int(struct veth_lpevent *event)
+static void veth_handle_int(struct VethLpEvent *event)
 {
 	HvLpIndex rlp = event->base_event.xSourceLp;
 	struct veth_lpar_connection *cnx = veth_cnx[rlp];
 	unsigned long flags;
-	int i, acked = 0;
+	int i;
 
 	BUG_ON(! cnx);
 
 	switch (event->base_event.xSubtype) {
-	case VETH_EVENT_CAP:
+	case VethEventTypeCap:
 		veth_take_cap(cnx, event);
 		break;
-	case VETH_EVENT_MONITOR:
+	case VethEventTypeMonitor:
 		/* do nothing... this'll hang out here til we're dead,
 		 * and the hypervisor will return it for us. */
 		break;
-	case VETH_EVENT_FRAMES_ACK:
+	case VethEventTypeFramesAck:
 		spin_lock_irqsave(&cnx->lock, flags);
-
 		for (i = 0; i < VETH_MAX_ACKS_PER_MSG; ++i) {
 			u16 msgnum = event->u.frames_ack_data.token[i];
 
-			if (msgnum < VETH_NUMBUFFERS) {
+			if (msgnum < VETH_NUMBUFFERS)
 				veth_recycle_msg(cnx, cnx->msgs + msgnum);
-				cnx->outstanding_tx--;
-				acked++;
-			}
-		}
-
-		if (acked > 0) {
-			cnx->last_contact = jiffies;
-			veth_wake_queues(cnx);
 		}
-
 		spin_unlock_irqrestore(&cnx->lock, flags);
+		veth_flush_pending(cnx);
 		break;
-	case VETH_EVENT_FRAMES:
+	case VethEventTypeFrames:
 		veth_receive(cnx, event);
 		break;
 	default:
-		veth_error("Unknown interrupt type %d from LPAR %d.\n",
-				event->base_event.xSubtype, rlp);
+		veth_error("Unknown interrupt type %d from lpar %d\n",
+			   event->base_event.xSubtype, rlp);
 	};
 }
 
 static void veth_handle_event(struct HvLpEvent *event, struct pt_regs *regs)
 {
-	struct veth_lpevent *veth_event = (struct veth_lpevent *)event;
+	struct VethLpEvent *veth_event = (struct VethLpEvent *)event;
 
 	if (event->xFlags.xFunction == HvLpEvent_Function_Ack)
 		veth_handle_ack(veth_event);
@@ -597,7 +390,7 @@ static void veth_handle_event(struct HvLpEvent *event, struct pt_regs *regs)
 
 static int veth_process_caps(struct veth_lpar_connection *cnx)
 {
-	struct veth_cap_data *remote_caps = &cnx->remote_caps;
+	struct VethCapData *remote_caps = &cnx->remote_caps;
 	int num_acks_needed;
 
 	/* Convert timer to jiffies */
@@ -607,8 +400,8 @@ static int veth_process_caps(struct veth_lpar_connection *cnx)
 	     || (remote_caps->ack_threshold > VETH_MAX_ACKS_PER_MSG)
 	     || (remote_caps->ack_threshold == 0)
 	     || (cnx->ack_timeout == 0) ) {
-		veth_error("Received incompatible capabilities from LPAR %d.\n",
-				cnx->remote_lp);
+		veth_error("Received incompatible capabilities from lpar %d\n",
+			   cnx->remote_lp);
 		return HvLpEvent_Rc_InvalidSubtypeData;
 	}
 
@@ -625,8 +418,8 @@ static int veth_process_caps(struct veth_lpar_connection *cnx)
 			cnx->num_ack_events += num;
 
 		if (cnx->num_ack_events < num_acks_needed) {
-			veth_error("Couldn't allocate enough ack events "
-					"for LPAR %d.\n", cnx->remote_lp);
+			veth_error("Couldn't allocate enough ack events for lpar %d\n",
+				   cnx->remote_lp);
 
 			return HvLpEvent_Rc_BufferNotAvailable;
 		}
@@ -647,15 +440,15 @@ static void veth_statemachine(void *p)
 
  restart:
 	if (cnx->state & VETH_STATE_RESET) {
+		int i;
+
+		del_timer(&cnx->ack_timer);
+
 		if (cnx->state & VETH_STATE_OPEN)
 			HvCallEvent_closeLpEventPath(cnx->remote_lp,
 						     HvLpEvent_Type_VirtualLan);
 
-		/*
-		 * Reset ack data. This prevents the ack_timer actually
-		 * doing anything, even if it runs one more time when
-		 * we drop the lock below.
-		 */
+		/* reset ack data */
 		memset(&cnx->pending_acks, 0xff, sizeof (cnx->pending_acks));
 		cnx->num_pending_acks = 0;
 
@@ -665,32 +458,14 @@ static void veth_statemachine(void *p)
 				| VETH_STATE_SENTCAPACK | VETH_STATE_READY);
 
 		/* Clean up any leftover messages */
-		if (cnx->msgs) {
-			int i;
+		if (cnx->msgs)
 			for (i = 0; i < VETH_NUMBUFFERS; ++i)
 				veth_recycle_msg(cnx, cnx->msgs + i);
-		}
-
-		cnx->outstanding_tx = 0;
-		veth_wake_queues(cnx);
-
-		/* Drop the lock so we can do stuff that might sleep or
-		 * take other locks. */
 		spin_unlock_irq(&cnx->lock);
-
-		del_timer_sync(&cnx->ack_timer);
-		del_timer_sync(&cnx->reset_timer);
-
+		veth_flush_pending(cnx);
 		spin_lock_irq(&cnx->lock);
-
 		if (cnx->state & VETH_STATE_RESET)
 			goto restart;
-
-		/* Hack, wait for the other end to reset itself. */
-		if (! (cnx->state & VETH_STATE_SHUTDOWN)) {
-			schedule_delayed_work(&cnx->statemachine_wq, 5 * HZ);
-			goto out;
-		}
 	}
 
 	if (cnx->state & VETH_STATE_SHUTDOWN)
@@ -713,7 +488,7 @@ static void veth_statemachine(void *p)
 
 	if ( (cnx->state & VETH_STATE_OPEN)
 	     && !(cnx->state & VETH_STATE_SENTMON) ) {
-		rc = veth_signalevent(cnx, VETH_EVENT_MONITOR,
+		rc = veth_signalevent(cnx, VethEventTypeMonitor,
 				      HvLpEvent_AckInd_DoAck,
 				      HvLpEvent_AckType_DeferredAck,
 				      0, 0, 0, 0, 0, 0);
@@ -723,8 +498,9 @@ static void veth_statemachine(void *p)
 		} else {
 			if ( (rc != HvLpEvent_Rc_PartitionDead)
 			     && (rc != HvLpEvent_Rc_PathClosed) )
-				veth_error("Error sending monitor to LPAR %d, "
-						"rc = %d\n", rlp, rc);
+				veth_error("Error sending monitor to "
+					   "lpar %d, rc=%x\n",
+					   rlp, (int) rc);
 
 			/* Oh well, hope we get a cap from the other
 			 * end and do better when that kicks us */
@@ -736,7 +512,7 @@ static void veth_statemachine(void *p)
 	     && !(cnx->state & VETH_STATE_SENTCAPS)) {
 		u64 *rawcap = (u64 *)&cnx->local_caps;
 
-		rc = veth_signalevent(cnx, VETH_EVENT_CAP,
+		rc = veth_signalevent(cnx, VethEventTypeCap,
 				      HvLpEvent_AckInd_DoAck,
 				      HvLpEvent_AckType_ImmediateAck,
 				      0, rawcap[0], rawcap[1], rawcap[2],
@@ -747,9 +523,9 @@ static void veth_statemachine(void *p)
 		} else {
 			if ( (rc != HvLpEvent_Rc_PartitionDead)
 			     && (rc != HvLpEvent_Rc_PathClosed) )
-				veth_error("Error sending caps to LPAR %d, "
-						"rc = %d\n", rlp, rc);
-
+				veth_error("Error sending caps to "
+					   "lpar %d, rc=%x\n",
+					   rlp, (int) rc);
 			/* Oh well, hope we get a cap from the other
 			 * end and do better when that kicks us */
 			goto out;
@@ -758,7 +534,7 @@ static void veth_statemachine(void *p)
 
 	if ((cnx->state & VETH_STATE_GOTCAPS)
 	    && !(cnx->state & VETH_STATE_SENTCAPACK)) {
-		struct veth_cap_data *remote_caps = &cnx->remote_caps;
+		struct VethCapData *remote_caps = &cnx->remote_caps;
 
 		memcpy(remote_caps, &cnx->cap_event.u.caps_data,
 		       sizeof(*remote_caps));
@@ -789,8 +565,10 @@ static void veth_statemachine(void *p)
 			add_timer(&cnx->ack_timer);
 			cnx->state |= VETH_STATE_READY;
 		} else {
-			veth_error("Caps rejected by LPAR %d, rc = %d\n",
-					rlp, cnx->cap_ack_event.base_event.xRc);
+			veth_printk(KERN_ERR, "Caps rejected (rc=%d) by "
+				    "lpar %d\n",
+				    cnx->cap_ack_event.base_event.xRc,
+				    rlp);
 			goto cant_cope;
 		}
 	}
@@ -803,8 +581,8 @@ static void veth_statemachine(void *p)
 	/* FIXME: we get here if something happens we really can't
 	 * cope with.  The link will never work once we get here, and
 	 * all we can do is not lock the rest of the system up */
-	veth_error("Unrecoverable error on connection to LPAR %d, shutting down"
-			" (state = 0x%04lx)\n", rlp, cnx->state);
+	veth_error("Badness on connection to lpar %d (state=%04lx) "
+		   " - shutting down\n", rlp, cnx->state);
 	cnx->state |= VETH_STATE_SHUTDOWN;
 	spin_unlock_irq(&cnx->lock);
 }
@@ -813,7 +591,7 @@ static int veth_init_connection(u8 rlp)
 {
 	struct veth_lpar_connection *cnx;
 	struct veth_msg *msgs;
-	int i, rc;
+	int i;
 
 	if ( (rlp == this_lp)
 	     || ! HvLpConfig_doLpsCommunicateOnVirtualLan(this_lp, rlp) )
@@ -827,36 +605,22 @@ static int veth_init_connection(u8 rlp)
 	cnx->remote_lp = rlp;
 	spin_lock_init(&cnx->lock);
 	INIT_WORK(&cnx->statemachine_wq, veth_statemachine, cnx);
-
 	init_timer(&cnx->ack_timer);
 	cnx->ack_timer.function = veth_timed_ack;
 	cnx->ack_timer.data = (unsigned long) cnx;
-
-	init_timer(&cnx->reset_timer);
-	cnx->reset_timer.function = veth_timed_reset;
-	cnx->reset_timer.data = (unsigned long) cnx;
-	cnx->reset_timeout = 5 * HZ * (VETH_ACKTIMEOUT / 1000000);
-
 	memset(&cnx->pending_acks, 0xff, sizeof (cnx->pending_acks));
 
 	veth_cnx[rlp] = cnx;
 
-	/* This gets us 1 reference, which is held on behalf of the driver
-	 * infrastructure. It's released at module unload. */
-	kobject_init(&cnx->kobject);
-	cnx->kobject.ktype = &veth_lpar_connection_ktype;
-	rc = kobject_set_name(&cnx->kobject, "cnx%.2d", rlp);
-	if (rc != 0)
-		return rc;
-
 	msgs = kmalloc(VETH_NUMBUFFERS * sizeof(struct veth_msg), GFP_KERNEL);
 	if (! msgs) {
-		veth_error("Can't allocate buffers for LPAR %d.\n", rlp);
+		veth_error("Can't allocate buffers for lpar %d\n", rlp);
 		return -ENOMEM;
 	}
 
 	cnx->msgs = msgs;
 	memset(msgs, 0, VETH_NUMBUFFERS * sizeof(struct veth_msg));
+	spin_lock_init(&cnx->msg_stack_lock);
 
 	for (i = 0; i < VETH_NUMBUFFERS; i++) {
 		msgs[i].token = i;
@@ -866,7 +630,8 @@ static int veth_init_connection(u8 rlp)
 	cnx->num_events = veth_allocate_events(rlp, 2 + VETH_NUMBUFFERS);
 
 	if (cnx->num_events < (2 + VETH_NUMBUFFERS)) {
-		veth_error("Can't allocate enough events for LPAR %d.\n", rlp);
+		veth_error("Can't allocate events for lpar %d, only got %d\n",
+			   rlp, cnx->num_events);
 		return -ENOMEM;
 	}
 
@@ -877,9 +642,11 @@ static int veth_init_connection(u8 rlp)
 	return 0;
 }
 
-static void veth_stop_connection(struct veth_lpar_connection *cnx)
+static void veth_stop_connection(u8 rlp)
 {
-	if (!cnx)
+	struct veth_lpar_connection *cnx = veth_cnx[rlp];
+
+	if (! cnx)
 		return;
 
 	spin_lock_irq(&cnx->lock);
@@ -887,23 +654,12 @@ static void veth_stop_connection(struct veth_lpar_connection *cnx)
 	veth_kick_statemachine(cnx);
 	spin_unlock_irq(&cnx->lock);
 
-	/* There's a slim chance the reset code has just queued the
-	 * statemachine to run in five seconds. If so we need to cancel
-	 * that and requeue the work to run now. */
-	if (cancel_delayed_work(&cnx->statemachine_wq)) {
-		spin_lock_irq(&cnx->lock);
-		veth_kick_statemachine(cnx);
-		spin_unlock_irq(&cnx->lock);
-	}
-
-	/* Wait for the state machine to run. */
 	flush_scheduled_work();
-}
 
-static void veth_destroy_connection(struct veth_lpar_connection *cnx)
-{
-	if (!cnx)
-		return;
+	/* FIXME: not sure if this is necessary - will already have
+	 * been deleted by the state machine, just want to make sure
+	 * its not running any more */
+	del_timer_sync(&cnx->ack_timer);
 
 	if (cnx->num_events > 0)
 		mf_deallocate_lp_events(cnx->remote_lp,
@@ -915,18 +671,18 @@ static void veth_destroy_connection(struct veth_lpar_connection *cnx)
 				      HvLpEvent_Type_VirtualLan,
 				      cnx->num_ack_events,
 				      NULL, NULL);
-
-	kfree(cnx->msgs);
-	veth_cnx[cnx->remote_lp] = NULL;
-	kfree(cnx);
 }
 
-static void veth_release_connection(struct kobject *kobj)
+static void veth_destroy_connection(u8 rlp)
 {
-	struct veth_lpar_connection *cnx;
-	cnx = container_of(kobj, struct veth_lpar_connection, kobject);
-	veth_stop_connection(cnx);
-	veth_destroy_connection(cnx);
+	struct veth_lpar_connection *cnx = veth_cnx[rlp];
+
+	if (! cnx)
+		return;
+
+	kfree(cnx->msgs);
+	kfree(cnx);
+	veth_cnx[rlp] = NULL;
 }
 
 /*
@@ -970,15 +726,17 @@ static void veth_set_multicast_list(struct net_device *dev)
 
 	write_lock_irqsave(&port->mcast_gate, flags);
 
-	if ((dev->flags & IFF_PROMISC) || (dev->flags & IFF_ALLMULTI) ||
-			(dev->mc_count > VETH_MAX_MCAST)) {
+	if (dev->flags & IFF_PROMISC) {	/* set promiscuous mode */
+		printk(KERN_INFO "%s: Promiscuous mode enabled.\n",
+		       dev->name);
 		port->promiscuous = 1;
+	} else if ( (dev->flags & IFF_ALLMULTI)
+		    || (dev->mc_count > VETH_MAX_MCAST) ) {
+		port->all_mcast = 1;
 	} else {
 		struct dev_mc_list *dmi = dev->mc_list;
 		int i;
 
-		port->promiscuous = 0;
-
 		/* Update table */
 		port->num_mcast = 0;
 
@@ -1000,10 +758,9 @@ static void veth_set_multicast_list(struct net_device *dev)
 
 static void veth_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
 {
-	strncpy(info->driver, DRV_NAME, sizeof(info->driver) - 1);
+	strncpy(info->driver, "veth", sizeof(info->driver) - 1);
 	info->driver[sizeof(info->driver) - 1] = '\0';
-	strncpy(info->version, DRV_VERSION, sizeof(info->version) - 1);
-	info->version[sizeof(info->version) - 1] = '\0';
+	strncpy(info->version, "1.0", sizeof(info->version) - 1);
 }
 
 static int veth_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
@@ -1034,6 +791,49 @@ static struct ethtool_ops ops = {
 	.get_link = veth_get_link,
 };
 
+static void veth_tx_timeout(struct net_device *dev)
+{
+	struct veth_port *port = (struct veth_port *)dev->priv;
+	struct net_device_stats *stats = &port->stats;
+	unsigned long flags;
+	int i;
+
+	stats->tx_errors++;
+
+	spin_lock_irqsave(&port->pending_gate, flags);
+
+	if (!port->pending_lpmask) {
+		spin_unlock_irqrestore(&port->pending_gate, flags);
+		return;
+	}
+
+	printk(KERN_WARNING "%s: Tx timeout!  Resetting lp connections: %08x\n",
+	       dev->name, port->pending_lpmask);
+
+	for (i = 0; i < HVMAXARCHITECTEDLPS; i++) {
+		struct veth_lpar_connection *cnx = veth_cnx[i];
+
+		if (! (port->pending_lpmask & (1<<i)))
+			continue;
+
+		/* If we're pending on it, we must be connected to it,
+		 * so we should certainly have a structure for it. */
+		BUG_ON(! cnx);
+
+		/* Theoretically we could be kicking a connection
+		 * which doesn't deserve it, but in practice if we've
+		 * had a Tx timeout, the pending_lpmask will have
+		 * exactly one bit set - the connection causing the
+		 * problem. */
+		spin_lock(&cnx->lock);
+		cnx->state |= VETH_STATE_RESET;
+		veth_kick_statemachine(cnx);
+		spin_unlock(&cnx->lock);
+	}
+
+	spin_unlock_irqrestore(&port->pending_gate, flags);
+}
+
 static struct net_device * __init veth_probe_one(int vlan, struct device *vdev)
 {
 	struct net_device *dev;
@@ -1048,9 +848,8 @@ static struct net_device * __init veth_probe_one(int vlan, struct device *vdev)
 
 	port = (struct veth_port *) dev->priv;
 
-	spin_lock_init(&port->queue_lock);
+	spin_lock_init(&port->pending_gate);
 	rwlock_init(&port->mcast_gate);
-	port->stopped_map = 0;
 
 	for (i = 0; i < HVMAXARCHITECTEDLPS; i++) {
 		HvLpVirtualLanIndexMap map;
@@ -1083,24 +882,22 @@ static struct net_device * __init veth_probe_one(int vlan, struct device *vdev)
 	dev->set_multicast_list = veth_set_multicast_list;
 	SET_ETHTOOL_OPS(dev, &ops);
 
+	dev->watchdog_timeo = 2 * (VETH_ACKTIMEOUT * HZ / 1000000);
+	dev->tx_timeout = veth_tx_timeout;
+
 	SET_NETDEV_DEV(dev, vdev);
 
 	rc = register_netdev(dev);
 	if (rc != 0) {
-		veth_error("Failed registering net device for vlan%d.\n", vlan);
+		veth_printk(KERN_ERR,
+			    "Failed to register ethernet device for vlan %d\n",
+			    vlan);
 		free_netdev(dev);
 		return NULL;
 	}
 
-	kobject_init(&port->kobject);
-	port->kobject.parent = &dev->class_dev.kobj;
-	port->kobject.ktype  = &veth_port_ktype;
-	kobject_set_name(&port->kobject, "veth_port");
-	if (0 != kobject_add(&port->kobject))
-		veth_error("Failed adding port for %s to sysfs.\n", dev->name);
-
-	veth_info("%s attached to iSeries vlan %d (LPAR map = 0x%.4X)\n",
-			dev->name, vlan, port->lpar_map);
+	veth_printk(KERN_DEBUG, "%s attached to iSeries vlan %d (lpar_map=0x%04x)\n",
+		    dev->name, vlan, port->lpar_map);
 
 	return dev;
 }
@@ -1115,95 +912,98 @@ static int veth_transmit_to_one(struct sk_buff *skb, HvLpIndex rlp,
 	struct veth_lpar_connection *cnx = veth_cnx[rlp];
 	struct veth_port *port = (struct veth_port *) dev->priv;
 	HvLpEvent_Rc rc;
+	u32 dma_address, dma_length;
 	struct veth_msg *msg = NULL;
+	int err = 0;
 	unsigned long flags;
 
-	if (! cnx)
+	if (! cnx) {
+		port->stats.tx_errors++;
+		dev_kfree_skb(skb);
 		return 0;
+	}
 
 	spin_lock_irqsave(&cnx->lock, flags);
 
 	if (! (cnx->state & VETH_STATE_READY))
-		goto no_error;
+		goto drop;
 
-	if ((skb->len - ETH_HLEN) > VETH_MAX_MTU)
+	if ((skb->len - 14) > VETH_MAX_MTU)
 		goto drop;
 
 	msg = veth_stack_pop(cnx);
-	if (! msg)
-		goto drop;
 
-	msg->in_use = 1;
-	msg->skb = skb_get(skb);
+	if (! msg) {
+		err = 1;
+		goto drop;
+	}
 
-	msg->data.addr[0] = dma_map_single(port->dev, skb->data,
-				skb->len, DMA_TO_DEVICE);
+	dma_length = skb->len;
+	dma_address = dma_map_single(port->dev, skb->data,
+				     dma_length, DMA_TO_DEVICE);
 
-	if (dma_mapping_error(msg->data.addr[0]))
+	if (dma_mapping_error(dma_address))
 		goto recycle_and_drop;
 
+	/* Is it really necessary to check the length and address
+	 * fields of the first entry here? */
+	msg->skb = skb;
 	msg->dev = port->dev;
-	msg->data.len[0] = skb->len;
+	msg->data.addr[0] = dma_address;
+	msg->data.len[0] = dma_length;
 	msg->data.eofmask = 1 << VETH_EOF_SHIFT;
-
-	rc = veth_signaldata(cnx, VETH_EVENT_FRAMES, msg->token, &msg->data);
+	set_bit(0, &(msg->in_use));
+	rc = veth_signaldata(cnx, VethEventTypeFrames, msg->token, &msg->data);
 
 	if (rc != HvLpEvent_Rc_Good)
 		goto recycle_and_drop;
 
-	/* If the timer's not already running, start it now. */
-	if (0 == cnx->outstanding_tx)
-		mod_timer(&cnx->reset_timer, jiffies + cnx->reset_timeout);
-
-	cnx->last_contact = jiffies;
-	cnx->outstanding_tx++;
-
-	if (veth_stack_is_empty(cnx))
-		veth_stop_queues(cnx);
-
- no_error:
 	spin_unlock_irqrestore(&cnx->lock, flags);
 	return 0;
 
  recycle_and_drop:
+	msg->skb = NULL;
+	/* need to set in use to make veth_recycle_msg in case this
+	 * was a mapping failure */
+	set_bit(0, &msg->in_use);
 	veth_recycle_msg(cnx, msg);
  drop:
+	port->stats.tx_errors++;
+	dev_kfree_skb(skb);
 	spin_unlock_irqrestore(&cnx->lock, flags);
-	return 1;
+	return err;
 }
 
-static void veth_transmit_to_many(struct sk_buff *skb,
+static HvLpIndexMap veth_transmit_to_many(struct sk_buff *skb,
 					  HvLpIndexMap lpmask,
 					  struct net_device *dev)
 {
 	struct veth_port *port = (struct veth_port *) dev->priv;
-	int i, success, error;
-
-	success = error = 0;
+	int i;
+	int rc;
 
 	for (i = 0; i < HVMAXARCHITECTEDLPS; i++) {
 		if ((lpmask & (1 << i)) == 0)
 			continue;
 
-		if (veth_transmit_to_one(skb, i, dev))
-			error = 1;
-		else
-			success = 1;
+		rc = veth_transmit_to_one(skb_get(skb), i, dev);
+		if (! rc)
+			lpmask &= ~(1<<i);
 	}
 
-	if (error)
-		port->stats.tx_errors++;
-
-	if (success) {
+	if (! lpmask) {
 		port->stats.tx_packets++;
 		port->stats.tx_bytes += skb->len;
 	}
+
+	return lpmask;
 }
 
 static int veth_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	unsigned char *frame = skb->data;
 	struct veth_port *port = (struct veth_port *) dev->priv;
+	unsigned long flags;
 	HvLpIndexMap lpmask;
 
 	if (! (frame[0] & 0x01)) {
@@ -1220,27 +1020,44 @@ static int veth_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		lpmask = port->lpar_map;
 	}
 
-	veth_transmit_to_many(skb, lpmask, dev);
+	spin_lock_irqsave(&port->pending_gate, flags);
 
-	dev_kfree_skb(skb);
+	lpmask = veth_transmit_to_many(skb, lpmask, dev);
+
+	dev->trans_start = jiffies;
+
+	if (! lpmask) {
+		dev_kfree_skb(skb);
+	} else {
+		if (port->pending_skb) {
+			veth_error("%s: Tx while skb was pending!\n",
+				   dev->name);
+			dev_kfree_skb(skb);
+			spin_unlock_irqrestore(&port->pending_gate, flags);
+			return 1;
+		}
+
+		port->pending_skb = skb;
+		port->pending_lpmask = lpmask;
+		netif_stop_queue(dev);
+	}
+
+	spin_unlock_irqrestore(&port->pending_gate, flags);
 
 	return 0;
 }
 
-/* You must hold the connection's lock when you call this function. */
 static void veth_recycle_msg(struct veth_lpar_connection *cnx,
 			     struct veth_msg *msg)
 {
 	u32 dma_address, dma_length;
 
-	if (msg->in_use) {
-		msg->in_use = 0;
+	if (test_and_clear_bit(0, &msg->in_use)) {
 		dma_address = msg->data.addr[0];
 		dma_length = msg->data.len[0];
 
-		if (!dma_mapping_error(dma_address))
-			dma_unmap_single(msg->dev, dma_address, dma_length,
-					DMA_TO_DEVICE);
+		dma_unmap_single(msg->dev, dma_address, dma_length,
+				 DMA_TO_DEVICE);
 
 		if (msg->skb) {
 			dev_kfree_skb_any(msg->skb);
@@ -1249,16 +1066,15 @@ static void veth_recycle_msg(struct veth_lpar_connection *cnx,
 
 		memset(&msg->data, 0, sizeof(msg->data));
 		veth_stack_push(cnx, msg);
-	} else if (cnx->state & VETH_STATE_OPEN) {
-		veth_error("Non-pending frame (# %d) acked by LPAR %d.\n",
-				cnx->remote_lp, msg->token);
-	}
+	} else
+		if (cnx->state & VETH_STATE_OPEN)
+			veth_error("Bogus frames ack from lpar %d (#%d)\n",
+				   cnx->remote_lp, msg->token);
 }
 
-static void veth_wake_queues(struct veth_lpar_connection *cnx)
+static void veth_flush_pending(struct veth_lpar_connection *cnx)
 {
 	int i;
-
 	for (i = 0; i < HVMAXARCHITECTEDVIRTUALLANS; i++) {
 		struct net_device *dev = veth_dev[i];
 		struct veth_port *port;
@@ -1272,77 +1088,20 @@ static void veth_wake_queues(struct veth_lpar_connection *cnx)
 		if (! (port->lpar_map & (1<<cnx->remote_lp)))
 			continue;
 
-		spin_lock_irqsave(&port->queue_lock, flags);
-
-		port->stopped_map &= ~(1 << cnx->remote_lp);
-
-		if (0 == port->stopped_map && netif_queue_stopped(dev)) {
-			veth_debug("cnx %d: woke queue for %s.\n",
-					cnx->remote_lp, dev->name);
-			netif_wake_queue(dev);
-		}
-		spin_unlock_irqrestore(&port->queue_lock, flags);
-	}
-}
-
-static void veth_stop_queues(struct veth_lpar_connection *cnx)
-{
-	int i;
-
-	for (i = 0; i < HVMAXARCHITECTEDVIRTUALLANS; i++) {
-		struct net_device *dev = veth_dev[i];
-		struct veth_port *port;
-
-		if (! dev)
-			continue;
-
-		port = (struct veth_port *)dev->priv;
-
-		/* If this cnx is not on the vlan for this port, continue */
-		if (! (port->lpar_map & (1 << cnx->remote_lp)))
-			continue;
-
-		spin_lock(&port->queue_lock);
-
-		netif_stop_queue(dev);
-		port->stopped_map |= (1 << cnx->remote_lp);
-
-		veth_debug("cnx %d: stopped queue for %s, map = 0x%x.\n",
-				cnx->remote_lp, dev->name, port->stopped_map);
-
-		spin_unlock(&port->queue_lock);
-	}
-}
-
-static void veth_timed_reset(unsigned long ptr)
-{
-	struct veth_lpar_connection *cnx = (struct veth_lpar_connection *)ptr;
-	unsigned long trigger_time, flags;
-
-	/* FIXME is it possible this fires after veth_stop_connection()?
-	 * That would reschedule the statemachine for 5 seconds and probably
-	 * execute it after the module's been unloaded. Hmm. */
-
-	spin_lock_irqsave(&cnx->lock, flags);
-
-	if (cnx->outstanding_tx > 0) {
-		trigger_time = cnx->last_contact + cnx->reset_timeout;
-
-		if (trigger_time < jiffies) {
-			cnx->state |= VETH_STATE_RESET;
-			veth_kick_statemachine(cnx);
-			veth_error("%d packets not acked by LPAR %d within %d "
-					"seconds, resetting.\n",
-					cnx->outstanding_tx, cnx->remote_lp,
-					cnx->reset_timeout / HZ);
-		} else {
-			/* Reschedule the timer */
-			trigger_time = jiffies + cnx->reset_timeout;
-			mod_timer(&cnx->reset_timer, trigger_time);
+		spin_lock_irqsave(&port->pending_gate, flags);
+		if (port->pending_skb) {
+			port->pending_lpmask =
+				veth_transmit_to_many(port->pending_skb,
+						      port->pending_lpmask,
+						      dev);
+			if (! port->pending_lpmask) {
+				dev_kfree_skb_any(port->pending_skb);
+				port->pending_skb = NULL;
+				netif_wake_queue(dev);
+			}
 		}
+		spin_unlock_irqrestore(&port->pending_gate, flags);
 	}
-
-	spin_unlock_irqrestore(&cnx->lock, flags);
 }
 
 /*
@@ -1358,9 +1117,12 @@ static inline int veth_frame_wanted(struct veth_port *port, u64 mac_addr)
 	if ( (mac_addr == port->mac_addr) || (mac_addr == 0xffffffffffff0000) )
 		return 1;
 
+	if (! (((char *) &mac_addr)[0] & 0x01))
+		return 0;
+
 	read_lock_irqsave(&port->mcast_gate, flags);
 
-	if (port->promiscuous) {
+	if (port->promiscuous || port->all_mcast) {
 		wanted = 1;
 		goto out;
 	}
@@ -1413,21 +1175,21 @@ static void veth_flush_acks(struct veth_lpar_connection *cnx)
 {
 	HvLpEvent_Rc rc;
 
-	rc = veth_signaldata(cnx, VETH_EVENT_FRAMES_ACK,
+	rc = veth_signaldata(cnx, VethEventTypeFramesAck,
 			     0, &cnx->pending_acks);
 
 	if (rc != HvLpEvent_Rc_Good)
-		veth_error("Failed acking frames from LPAR %d, rc = %d\n",
-				cnx->remote_lp, (int)rc);
+		veth_error("Error 0x%x acking frames from lpar %d!\n",
+			   (unsigned)rc, cnx->remote_lp);
 
 	cnx->num_pending_acks = 0;
 	memset(&cnx->pending_acks, 0xff, sizeof(cnx->pending_acks));
 }
 
 static void veth_receive(struct veth_lpar_connection *cnx,
-			 struct veth_lpevent *event)
+			 struct VethLpEvent *event)
 {
-	struct veth_frames_data *senddata = &event->u.frames_data;
+	struct VethFramesData *senddata = &event->u.frames_data;
 	int startchunk = 0;
 	int nchunks;
 	unsigned long flags;
@@ -1454,10 +1216,9 @@ static void veth_receive(struct veth_lpar_connection *cnx,
 		/* make sure that we have at least 1 EOF entry in the
 		 * remaining entries */
 		if (! (senddata->eofmask >> (startchunk + VETH_EOF_SHIFT))) {
-			veth_error("Missing EOF fragment in event "
-					"eofmask = 0x%x startchunk = %d\n",
-					(unsigned)senddata->eofmask,
-					startchunk);
+			veth_error("missing EOF frag in event "
+				   "eofmask=0x%x startchunk=%d\n",
+				   (unsigned) senddata->eofmask, startchunk);
 			break;
 		}
 
@@ -1476,9 +1237,8 @@ static void veth_receive(struct veth_lpar_connection *cnx,
 		/* nchunks == # of chunks in this frame */
 
 		if ((length - ETH_HLEN) > VETH_MAX_MTU) {
-			veth_error("Received oversize frame from LPAR %d "
-					"(length = %d)\n",
-					cnx->remote_lp, length);
+			veth_error("Received oversize frame from lpar %d "
+				   "(length=%d)\n", cnx->remote_lp, length);
 			continue;
 		}
 
@@ -1571,33 +1331,15 @@ static void veth_timed_ack(unsigned long ptr)
 
 static int veth_remove(struct vio_dev *vdev)
 {
-	struct veth_lpar_connection *cnx;
+	int i = vdev->unit_address;
 	struct net_device *dev;
-	struct veth_port *port;
-	int i;
-
-	dev = veth_dev[vdev->unit_address];
-
-	if (! dev)
-		return 0;
-
-	port = netdev_priv(dev);
-
-	for (i = 0; i < HVMAXARCHITECTEDLPS; i++) {
-		cnx = veth_cnx[i];
 
-		if (cnx && (port->lpar_map & (1 << i))) {
-			/* Drop our reference to connections on our VLAN */
-			kobject_put(&cnx->kobject);
-		}
+	dev = veth_dev[i];
+	if (dev != NULL) {
+		veth_dev[i] = NULL;
+		unregister_netdev(dev);
+		free_netdev(dev);
 	}
-
-	veth_dev[vdev->unit_address] = NULL;
-	kobject_del(&port->kobject);
-	kobject_put(&port->kobject);
-	unregister_netdev(dev);
-	free_netdev(dev);
-
 	return 0;
 }
 
@@ -1605,7 +1347,6 @@ static int veth_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 {
 	int i = vdev->unit_address;
 	struct net_device *dev;
-	struct veth_port *port;
 
 	dev = veth_probe_one(i, &vdev->dev);
 	if (dev == NULL) {
@@ -1614,23 +1355,11 @@ static int veth_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 	}
 	veth_dev[i] = dev;
 
-	port = (struct veth_port*)netdev_priv(dev);
-
-	/* Start the state machine on each connection on this vlan. If we're
-	 * the first dev to do so this will commence link negotiation */
-	for (i = 0; i < HVMAXARCHITECTEDLPS; i++) {
-		struct veth_lpar_connection *cnx;
-
-		if (! (port->lpar_map & (1 << i)))
-			continue;
-
-		cnx = veth_cnx[i];
-		if (!cnx)
-			continue;
-
-		kobject_get(&cnx->kobject);
-		veth_kick_statemachine(cnx);
-	}
+	/* Start the state machine on each connection, to commence
+	 * link negotiation */
+	for (i = 0; i < HVMAXARCHITECTEDLPS; i++)
+		if (veth_cnx[i])
+			veth_kick_statemachine(veth_cnx[i]);
 
 	return 0;
 }
@@ -1641,12 +1370,12 @@ static int veth_probe(struct vio_dev *vdev, const struct vio_device_id *id)
  */
 static struct vio_device_id veth_device_table[] __devinitdata = {
 	{ "vlan", "" },
-	{ "", "" }
+	{ NULL, NULL }
 };
 MODULE_DEVICE_TABLE(vio, veth_device_table);
 
 static struct vio_driver veth_driver = {
-	.name = DRV_NAME,
+	.name = "iseries_veth",
 	.id_table = veth_device_table,
 	.probe = veth_probe,
 	.remove = veth_remove
@@ -1659,29 +1388,29 @@ static struct vio_driver veth_driver = {
 void __exit veth_module_cleanup(void)
 {
 	int i;
-	struct veth_lpar_connection *cnx;
 
-	/* Disconnect our "irq" to stop events coming from the Hypervisor. */
+	/* Stop the queues first to stop any new packets being sent. */
+	for (i = 0; i < HVMAXARCHITECTEDVIRTUALLANS; i++)
+		if (veth_dev[i])
+			netif_stop_queue(veth_dev[i]);
+
+	/* Stop the connections before we unregister the driver. This
+	 * ensures there's no skbs lying around holding the device open. */
+	for (i = 0; i < HVMAXARCHITECTEDLPS; ++i)
+		veth_stop_connection(i);
+
 	HvLpEvent_unregisterHandler(HvLpEvent_Type_VirtualLan);
 
-	/* Make sure any work queued from Hypervisor callbacks is finished. */
+	/* Hypervisor callbacks may have scheduled more work while we
+	 * were stoping connections. Now that we've disconnected from
+	 * the hypervisor make sure everything's finished. */
 	flush_scheduled_work();
 
-	for (i = 0; i < HVMAXARCHITECTEDLPS; ++i) {
-		cnx = veth_cnx[i];
-
-		if (!cnx)
-			continue;
+	vio_unregister_driver(&veth_driver);
 
-		/* Remove the connection from sysfs */
-		kobject_del(&cnx->kobject);
-		/* Drop the driver's reference to the connection */
-		kobject_put(&cnx->kobject);
-	}
+	for (i = 0; i < HVMAXARCHITECTEDLPS; ++i)
+		veth_destroy_connection(i);
 
-	/* Unregister the driver, which will close all the netdevs and stop
-	 * the connections when they're no longer referenced. */
-	vio_unregister_driver(&veth_driver);
 }
 module_exit(veth_module_cleanup);
 
@@ -1694,37 +1423,15 @@ int __init veth_module_init(void)
 
 	for (i = 0; i < HVMAXARCHITECTEDLPS; ++i) {
 		rc = veth_init_connection(i);
-		if (rc != 0)
-			goto error;
+		if (rc != 0) {
+			veth_module_cleanup();
+			return rc;
+		}
 	}
 
 	HvLpEvent_registerHandler(HvLpEvent_Type_VirtualLan,
 				  &veth_handle_event);
 
-	rc = vio_register_driver(&veth_driver);
-	if (rc != 0)
-		goto error;
-
-	for (i = 0; i < HVMAXARCHITECTEDLPS; ++i) {
-		struct kobject *kobj;
-
-		if (!veth_cnx[i])
-			continue;
-
-		kobj = &veth_cnx[i]->kobject;
-		kobj->parent = &veth_driver.driver.kobj;
-		/* If the add failes, complain but otherwise continue */
-		if (0 != kobject_add(kobj))
-			veth_error("cnx %d: Failed adding to sysfs.\n", i);
-	}
-
-	return 0;
-
-error:
-	for (i = 0; i < HVMAXARCHITECTEDLPS; ++i) {
-		veth_destroy_connection(veth_cnx[i]);
-	}
-
-	return rc;
+	return vio_register_driver(&veth_driver);
 }
 module_init(veth_module_init);
diff --git a/trunk/drivers/net/iseries_veth.h b/trunk/drivers/net/iseries_veth.h
new file mode 100644
index 000000000000..d9370f79b83e
--- /dev/null
+++ b/trunk/drivers/net/iseries_veth.h
@@ -0,0 +1,46 @@
+/* File veth.h created by Kyle A. Lucke on Mon Aug  7 2000. */
+
+#ifndef _ISERIES_VETH_H
+#define _ISERIES_VETH_H
+
+#define VethEventTypeCap	(0)
+#define VethEventTypeFrames	(1)
+#define VethEventTypeMonitor	(2)
+#define VethEventTypeFramesAck	(3)
+
+#define VETH_MAX_ACKS_PER_MSG	(20)
+#define VETH_MAX_FRAMES_PER_MSG	(6)
+
+struct VethFramesData {
+	u32 addr[VETH_MAX_FRAMES_PER_MSG];
+	u16 len[VETH_MAX_FRAMES_PER_MSG];
+	u32 eofmask;
+};
+#define VETH_EOF_SHIFT		(32-VETH_MAX_FRAMES_PER_MSG)
+
+struct VethFramesAckData {
+	u16 token[VETH_MAX_ACKS_PER_MSG];
+};
+
+struct VethCapData {
+	u8 caps_version;
+	u8 rsvd1;
+	u16 num_buffers;
+	u16 ack_threshold;
+	u16 rsvd2;
+	u32 ack_timeout;
+	u32 rsvd3;
+	u64 rsvd4[3];
+};
+
+struct VethLpEvent {
+	struct HvLpEvent base_event;
+	union {
+		struct VethCapData caps_data;
+		struct VethFramesData frames_data;
+		struct VethFramesAckData frames_ack_data;
+	} u;
+
+};
+
+#endif	/* _ISERIES_VETH_H */
diff --git a/trunk/drivers/net/ppp_generic.c b/trunk/drivers/net/ppp_generic.c
index bb71638a7c44..a32668e88e09 100644
--- a/trunk/drivers/net/ppp_generic.c
+++ b/trunk/drivers/net/ppp_generic.c
@@ -1657,6 +1657,7 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
 			skb->dev = ppp->dev;
 			skb->protocol = htons(npindex_to_ethertype[npi]);
 			skb->mac.raw = skb->data;
+			skb->input_dev = ppp->dev;
 			netif_rx(skb);
 			ppp->dev->last_rx = jiffies;
 		}
diff --git a/trunk/drivers/net/pppoe.c b/trunk/drivers/net/pppoe.c
index 82f236cc3b9b..ce1a9bf7b9a7 100644
--- a/trunk/drivers/net/pppoe.c
+++ b/trunk/drivers/net/pppoe.c
@@ -377,8 +377,7 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
  ***********************************************************************/
 static int pppoe_rcv(struct sk_buff *skb,
 		     struct net_device *dev,
-		     struct packet_type *pt,
-		     struct net_device *orig_dev)
+		     struct packet_type *pt)
 
 {
 	struct pppoe_hdr *ph;
@@ -427,8 +426,7 @@ static int pppoe_rcv(struct sk_buff *skb,
  ***********************************************************************/
 static int pppoe_disc_rcv(struct sk_buff *skb,
 			  struct net_device *dev,
-			  struct packet_type *pt,
-			  struct net_device *orig_dev)
+			  struct packet_type *pt)
 
 {
 	struct pppoe_hdr *ph;
diff --git a/trunk/drivers/net/rrunner.c b/trunk/drivers/net/rrunner.c
index ec1a18d189a1..12a86f96d973 100644
--- a/trunk/drivers/net/rrunner.c
+++ b/trunk/drivers/net/rrunner.c
@@ -1429,7 +1429,6 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct rr_private *rrpriv = netdev_priv(dev);
 	struct rr_regs __iomem *regs = rrpriv->regs;
-	struct hippi_cb *hcb = (struct hippi_cb *) skb->cb;
 	struct ring_ctrl *txctrl;
 	unsigned long flags;
 	u32 index, len = skb->len;
@@ -1461,7 +1460,7 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	ifield = (u32 *)skb_push(skb, 8);
 
 	ifield[0] = 0;
-	ifield[1] = hcb->ifield;
+	ifield[1] = skb->private.ifield;
 
 	/*
 	 * We don't need the lock before we are actually going to start
diff --git a/trunk/drivers/net/s2io.h b/trunk/drivers/net/s2io.h
index bc64d967f080..5d9270730ca2 100644
--- a/trunk/drivers/net/s2io.h
+++ b/trunk/drivers/net/s2io.h
@@ -762,8 +762,8 @@ static inline u64 readq(void __iomem *addr)
 {
 	u64 ret = 0;
 	ret = readl(addr + 4);
-	ret <<= 32;
-	ret |= readl(addr);
+	(u64) ret <<= 32;
+	(u64) ret |= readl(addr);
 
 	return ret;
 }
diff --git a/trunk/drivers/net/shaper.c b/trunk/drivers/net/shaper.c
index 221354eea21f..3ad0b6751f6f 100644
--- a/trunk/drivers/net/shaper.c
+++ b/trunk/drivers/net/shaper.c
@@ -156,6 +156,52 @@ static int shaper_start_xmit(struct sk_buff *skb, struct net_device *dev)
  	 
  	SHAPERCB(skb)->shapelen= shaper_clocks(shaper,skb);
  	
+#ifdef SHAPER_COMPLEX /* and broken.. */
+
+ 	while(ptr && ptr!=(struct sk_buff *)&shaper->sendq)
+ 	{
+ 		if(ptr->pri<skb->pri 
+ 			&& jiffies - SHAPERCB(ptr)->shapeclock < SHAPER_MAXSLIP)
+ 		{
+ 			struct sk_buff *tmp=ptr->prev;
+
+ 			/*
+ 			 *	It goes before us therefore we slip the length
+ 			 *	of the new frame.
+ 			 */
+
+ 			SHAPERCB(ptr)->shapeclock+=SHAPERCB(skb)->shapelen;
+ 			SHAPERCB(ptr)->shapelatency+=SHAPERCB(skb)->shapelen;
+
+ 			/*
+ 			 *	The packet may have slipped so far back it
+ 			 *	fell off.
+ 			 */
+ 			if(SHAPERCB(ptr)->shapelatency > SHAPER_LATENCY)
+ 			{
+ 				skb_unlink(ptr);
+ 				dev_kfree_skb(ptr);
+ 			}
+ 			ptr=tmp;
+ 		}
+ 		else
+ 			break;
+ 	}
+ 	if(ptr==NULL || ptr==(struct sk_buff *)&shaper->sendq)
+ 		skb_queue_head(&shaper->sendq,skb);
+ 	else
+ 	{
+ 		struct sk_buff *tmp;
+ 		/*
+ 		 *	Set the packet clock out time according to the
+ 		 *	frames ahead. Im sure a bit of thought could drop
+ 		 *	this loop.
+ 		 */
+ 		for(tmp=skb_peek(&shaper->sendq); tmp!=NULL && tmp!=ptr; tmp=tmp->next)
+ 			SHAPERCB(skb)->shapeclock+=tmp->shapelen;
+ 		skb_append(ptr,skb);
+ 	}
+#else
 	{
 		struct sk_buff *tmp;
 		/*
@@ -174,7 +220,7 @@ static int shaper_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		} else
 			skb_queue_tail(&shaper->sendq, skb);
 	}
-
+#endif 	
 	if(sh_debug)
  		printk("Frame queued.\n");
  	if(skb_queue_len(&shaper->sendq)>SHAPER_QLEN)
@@ -256,7 +302,7 @@ static void shaper_kick(struct shaper *shaper)
 			 *	Pull the frame and get interrupts back on.
 			 */
 			 
-			skb_unlink(skb, &shaper->sendq);
+			skb_unlink(skb);
 			if (shaper->recovery < 
 			    SHAPERCB(skb)->shapeclock + SHAPERCB(skb)->shapelen)
 				shaper->recovery = SHAPERCB(skb)->shapeclock + SHAPERCB(skb)->shapelen;
diff --git a/trunk/drivers/net/sis190.c b/trunk/drivers/net/sis190.c
deleted file mode 100644
index bf3440aa6c24..000000000000
--- a/trunk/drivers/net/sis190.c
+++ /dev/null
@@ -1,1843 +0,0 @@
-/*
-   sis190.c: Silicon Integrated Systems SiS190 ethernet driver
-
-   Copyright (c) 2003 K.M. Liu <kmliu@sis.com>
-   Copyright (c) 2003, 2004 Jeff Garzik <jgarzik@pobox.com>
-   Copyright (c) 2003, 2004, 2005 Francois Romieu <romieu@fr.zoreil.com>
-
-   Based on r8169.c, tg3.c, 8139cp.c, skge.c, epic100.c and SiS 190/191
-   genuine driver.
-
-   This software may be used and distributed according to the terms of
-   the GNU General Public License (GPL), incorporated herein by reference.
-   Drivers based on or derived from this code fall under the GPL and must
-   retain the authorship, copyright and license notice.  This file is not
-   a complete program and may only be used when the entire operating
-   system is licensed under the GPL.
-
-   See the file COPYING in this distribution for more information.
-
- */
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/netdevice.h>
-#include <linux/rtnetlink.h>
-#include <linux/etherdevice.h>
-#include <linux/ethtool.h>
-#include <linux/pci.h>
-#include <linux/mii.h>
-#include <linux/delay.h>
-#include <linux/crc32.h>
-#include <linux/dma-mapping.h>
-#include <asm/irq.h>
-
-#define net_drv(p, arg...)	if (netif_msg_drv(p)) \
-					printk(arg)
-#define net_probe(p, arg...)	if (netif_msg_probe(p)) \
-					printk(arg)
-#define net_link(p, arg...)	if (netif_msg_link(p)) \
-					printk(arg)
-#define net_intr(p, arg...)	if (netif_msg_intr(p)) \
-					printk(arg)
-#define net_tx_err(p, arg...)	if (netif_msg_tx_err(p)) \
-					printk(arg)
-
-#define PHY_MAX_ADDR		32
-#define PHY_ID_ANY		0x1f
-#define MII_REG_ANY		0x1f
-
-#ifdef CONFIG_SIS190_NAPI
-#define NAPI_SUFFIX	"-NAPI"
-#else
-#define NAPI_SUFFIX	""
-#endif
-
-#define DRV_VERSION		"1.2" NAPI_SUFFIX
-#define DRV_NAME		"sis190"
-#define SIS190_DRIVER_NAME	DRV_NAME " Gigabit Ethernet driver " DRV_VERSION
-#define PFX DRV_NAME ": "
-
-#ifdef CONFIG_SIS190_NAPI
-#define sis190_rx_skb			netif_receive_skb
-#define sis190_rx_quota(count, quota)	min(count, quota)
-#else
-#define sis190_rx_skb			netif_rx
-#define sis190_rx_quota(count, quota)	count
-#endif
-
-#define MAC_ADDR_LEN		6
-
-#define NUM_TX_DESC		64	/* [8..1024] */
-#define NUM_RX_DESC		64	/* [8..8192] */
-#define TX_RING_BYTES		(NUM_TX_DESC * sizeof(struct TxDesc))
-#define RX_RING_BYTES		(NUM_RX_DESC * sizeof(struct RxDesc))
-#define RX_BUF_SIZE		1536
-#define RX_BUF_MASK		0xfff8
-
-#define SIS190_REGS_SIZE	0x80
-#define SIS190_TX_TIMEOUT	(6*HZ)
-#define SIS190_PHY_TIMEOUT	(10*HZ)
-#define SIS190_MSG_DEFAULT	(NETIF_MSG_DRV | NETIF_MSG_PROBE | \
-				 NETIF_MSG_LINK | NETIF_MSG_IFUP | \
-				 NETIF_MSG_IFDOWN)
-
-/* Enhanced PHY access register bit definitions */
-#define EhnMIIread		0x0000
-#define EhnMIIwrite		0x0020
-#define EhnMIIdataShift		16
-#define EhnMIIpmdShift		6	/* 7016 only */
-#define EhnMIIregShift		11
-#define EhnMIIreq		0x0010
-#define EhnMIInotDone		0x0010
-
-/* Write/read MMIO register */
-#define SIS_W8(reg, val)	writeb ((val), ioaddr + (reg))
-#define SIS_W16(reg, val)	writew ((val), ioaddr + (reg))
-#define SIS_W32(reg, val)	writel ((val), ioaddr + (reg))
-#define SIS_R8(reg)		readb (ioaddr + (reg))
-#define SIS_R16(reg)		readw (ioaddr + (reg))
-#define SIS_R32(reg)		readl (ioaddr + (reg))
-
-#define SIS_PCI_COMMIT()	SIS_R32(IntrControl)
-
-enum sis190_registers {
-	TxControl		= 0x00,
-	TxDescStartAddr		= 0x04,
-	rsv0			= 0x08,	// reserved
-	TxSts			= 0x0c,	// unused (Control/Status)
-	RxControl		= 0x10,
-	RxDescStartAddr		= 0x14,
-	rsv1			= 0x18,	// reserved
-	RxSts			= 0x1c,	// unused
-	IntrStatus		= 0x20,
-	IntrMask		= 0x24,
-	IntrControl		= 0x28,
-	IntrTimer		= 0x2c,	// unused (Interupt Timer)
-	PMControl		= 0x30,	// unused (Power Mgmt Control/Status)
-	rsv2			= 0x34,	// reserved
-	ROMControl		= 0x38,
-	ROMInterface		= 0x3c,
-	StationControl		= 0x40,
-	GMIIControl		= 0x44,
-	GIoCR			= 0x48, // unused (GMAC IO Compensation)
-	GIoCtrl			= 0x4c, // unused (GMAC IO Control)
-	TxMacControl		= 0x50,
-	TxLimit			= 0x54, // unused (Tx MAC Timer/TryLimit)
-	RGDelay			= 0x58, // unused (RGMII Tx Internal Delay)
-	rsv3			= 0x5c, // reserved
-	RxMacControl		= 0x60,
-	RxMacAddr		= 0x62,
-	RxHashTable		= 0x68,
-	// Undocumented		= 0x6c,
-	RxWolCtrl		= 0x70,
-	RxWolData		= 0x74, // unused (Rx WOL Data Access)
-	RxMPSControl		= 0x78,	// unused (Rx MPS Control)
-	rsv4			= 0x7c, // reserved
-};
-
-enum sis190_register_content {
-	/* IntrStatus */
-	SoftInt			= 0x40000000,	// unused
-	Timeup			= 0x20000000,	// unused
-	PauseFrame		= 0x00080000,	// unused
-	MagicPacket		= 0x00040000,	// unused
-	WakeupFrame		= 0x00020000,	// unused
-	LinkChange		= 0x00010000,
-	RxQEmpty		= 0x00000080,
-	RxQInt			= 0x00000040,
-	TxQ1Empty		= 0x00000020,	// unused
-	TxQ1Int			= 0x00000010,
-	TxQ0Empty		= 0x00000008,	// unused
-	TxQ0Int			= 0x00000004,
-	RxHalt			= 0x00000002,
-	TxHalt			= 0x00000001,
-
-	/* {Rx/Tx}CmdBits */
-	CmdReset		= 0x10,
-	CmdRxEnb		= 0x08,		// unused
-	CmdTxEnb		= 0x01,
-	RxBufEmpty		= 0x01,		// unused
-
-	/* Cfg9346Bits */
-	Cfg9346_Lock		= 0x00,		// unused
-	Cfg9346_Unlock		= 0xc0,		// unused
-
-	/* RxMacControl */
-	AcceptErr		= 0x20,		// unused
-	AcceptRunt		= 0x10,		// unused
-	AcceptBroadcast		= 0x0800,
-	AcceptMulticast		= 0x0400,
-	AcceptMyPhys		= 0x0200,
-	AcceptAllPhys		= 0x0100,
-
-	/* RxConfigBits */
-	RxCfgFIFOShift		= 13,
-	RxCfgDMAShift		= 8,		// 0x1a in RxControl ?
-
-	/* TxConfigBits */
-	TxInterFrameGapShift	= 24,
-	TxDMAShift		= 8, /* DMA burst value (0-7) is shift this many bits */
-
-	/* StationControl */
-	_1000bpsF		= 0x1c00,
-	_1000bpsH		= 0x0c00,
-	_100bpsF		= 0x1800,
-	_100bpsH		= 0x0800,
-	_10bpsF			= 0x1400,
-	_10bpsH			= 0x0400,
-
-	LinkStatus		= 0x02,		// unused
-	FullDup			= 0x01,		// unused
-
-	/* TBICSRBit */
-	TBILinkOK		= 0x02000000,	// unused
-};
-
-struct TxDesc {
-	__le32 PSize;
-	__le32 status;
-	__le32 addr;
-	__le32 size;
-};
-
-struct RxDesc {
-	__le32 PSize;
-	__le32 status;
-	__le32 addr;
-	__le32 size;
-};
-
-enum _DescStatusBit {
-	/* _Desc.status */
-	OWNbit		= 0x80000000, // RXOWN/TXOWN
-	INTbit		= 0x40000000, // RXINT/TXINT
-	CRCbit		= 0x00020000, // CRCOFF/CRCEN
-	PADbit		= 0x00010000, // PREADD/PADEN
-	/* _Desc.size */
-	RingEnd		= 0x80000000,
-	/* TxDesc.status */
-	LSEN		= 0x08000000, // TSO ? -- FR
-	IPCS		= 0x04000000,
-	TCPCS		= 0x02000000,
-	UDPCS		= 0x01000000,
-	BSTEN		= 0x00800000,
-	EXTEN		= 0x00400000,
-	DEFEN		= 0x00200000,
-	BKFEN		= 0x00100000,
-	CRSEN		= 0x00080000,
-	COLEN		= 0x00040000,
-	THOL3		= 0x30000000,
-	THOL2		= 0x20000000,
-	THOL1		= 0x10000000,
-	THOL0		= 0x00000000,
-	/* RxDesc.status */
-	IPON		= 0x20000000,
-	TCPON		= 0x10000000,
-	UDPON		= 0x08000000,
-	Wakup		= 0x00400000,
-	Magic		= 0x00200000,
-	Pause		= 0x00100000,
-	DEFbit		= 0x00200000,
-	BCAST		= 0x000c0000,
-	MCAST		= 0x00080000,
-	UCAST		= 0x00040000,
-	/* RxDesc.PSize */
-	TAGON		= 0x80000000,
-	RxDescCountMask	= 0x7f000000, // multi-desc pkt when > 1 ? -- FR
-	ABORT		= 0x00800000,
-	SHORT		= 0x00400000,
-	LIMIT		= 0x00200000,
-	MIIER		= 0x00100000,
-	OVRUN		= 0x00080000,
-	NIBON		= 0x00040000,
-	COLON		= 0x00020000,
-	CRCOK		= 0x00010000,
-	RxSizeMask	= 0x0000ffff
-	/*
-	 * The asic could apparently do vlan, TSO, jumbo (sis191 only) and
-	 * provide two (unused with Linux) Tx queues. No publically
-	 * available documentation alas.
-	 */
-};
-
-enum sis190_eeprom_access_register_bits {
-	EECS	= 0x00000001,	// unused
-	EECLK	= 0x00000002,	// unused
-	EEDO	= 0x00000008,	// unused
-	EEDI	= 0x00000004,	// unused
-	EEREQ	= 0x00000080,
-	EEROP	= 0x00000200,
-	EEWOP	= 0x00000100	// unused
-};
-
-/* EEPROM Addresses */
-enum sis190_eeprom_address {
-	EEPROMSignature	= 0x00,
-	EEPROMCLK	= 0x01,	// unused
-	EEPROMInfo	= 0x02,
-	EEPROMMACAddr	= 0x03
-};
-
-struct sis190_private {
-	void __iomem *mmio_addr;
-	struct pci_dev *pci_dev;
-	struct net_device_stats stats;
-	spinlock_t lock;
-	u32 rx_buf_sz;
-	u32 cur_rx;
-	u32 cur_tx;
-	u32 dirty_rx;
-	u32 dirty_tx;
-	dma_addr_t rx_dma;
-	dma_addr_t tx_dma;
-	struct RxDesc *RxDescRing;
-	struct TxDesc *TxDescRing;
-	struct sk_buff *Rx_skbuff[NUM_RX_DESC];
-	struct sk_buff *Tx_skbuff[NUM_TX_DESC];
-	struct work_struct phy_task;
-	struct timer_list timer;
-	u32 msg_enable;
-	struct mii_if_info mii_if;
-	struct list_head first_phy;
-};
-
-struct sis190_phy {
-	struct list_head list;
-	int phy_id;
-	u16 id[2];
-	u16 status;
-	u8  type;
-};
-
-enum sis190_phy_type {
-	UNKNOWN	= 0x00,
-	HOME	= 0x01,
-	LAN	= 0x02,
-	MIX	= 0x03
-};
-
-static struct mii_chip_info {
-        const char *name;
-        u16 id[2];
-        unsigned int type;
-} mii_chip_table[] = {
-	{ "Broadcom PHY BCM5461", { 0x0020, 0x60c0 }, LAN },
-	{ "Agere PHY ET1101B",    { 0x0282, 0xf010 }, LAN },
-	{ "Marvell PHY 88E1111",  { 0x0141, 0x0cc0 }, LAN },
-	{ "Realtek PHY RTL8201",  { 0x0000, 0x8200 }, LAN },
-	{ NULL, }
-};
-
-const static struct {
-	const char *name;
-	u8 version;		/* depend on docs */
-	u32 RxConfigMask;	/* clear the bits supported by this chip */
-} sis_chip_info[] = {
-	{ DRV_NAME, 0x00, 0xff7e1880, },
-};
-
-static struct pci_device_id sis190_pci_tbl[] __devinitdata = {
-	{ PCI_DEVICE(PCI_VENDOR_ID_SI, 0x0190), 0, 0, 0 },
-	{ 0, },
-};
-
-MODULE_DEVICE_TABLE(pci, sis190_pci_tbl);
-
-static int rx_copybreak = 200;
-
-static struct {
-	u32 msg_enable;
-} debug = { -1 };
-
-MODULE_DESCRIPTION("SiS sis190 Gigabit Ethernet driver");
-module_param(rx_copybreak, int, 0);
-MODULE_PARM_DESC(rx_copybreak, "Copy breakpoint for copy-only-tiny-frames");
-module_param_named(debug, debug.msg_enable, int, 0);
-MODULE_PARM_DESC(debug, "Debug verbosity level (0=none, ..., 16=all)");
-MODULE_AUTHOR("K.M. Liu <kmliu@sis.com>, Ueimor <romieu@fr.zoreil.com>");
-MODULE_VERSION(DRV_VERSION);
-MODULE_LICENSE("GPL");
-
-static const u32 sis190_intr_mask =
-	RxQEmpty | RxQInt | TxQ1Int | TxQ0Int | RxHalt | TxHalt;
-
-/*
- * Maximum number of multicast addresses to filter (vs. Rx-all-multicast).
- * The chips use a 64 element hash table based on the Ethernet CRC.
- */
-static int multicast_filter_limit = 32;
-
-static void __mdio_cmd(void __iomem *ioaddr, u32 ctl)
-{
-	unsigned int i;
-
-	SIS_W32(GMIIControl, ctl);
-
-	msleep(1);
-
-	for (i = 0; i < 100; i++) {
-		if (!(SIS_R32(GMIIControl) & EhnMIInotDone))
-			break;
-		msleep(1);
-	}
-
-	if (i > 999)
-		printk(KERN_ERR PFX "PHY command failed !\n");
-}
-
-static void mdio_write(void __iomem *ioaddr, int phy_id, int reg, int val)
-{
-	__mdio_cmd(ioaddr, EhnMIIreq | EhnMIIwrite |
-		(((u32) reg) << EhnMIIregShift) | (phy_id << EhnMIIpmdShift) |
-		(((u32) val) << EhnMIIdataShift));
-}
-
-static int mdio_read(void __iomem *ioaddr, int phy_id, int reg)
-{
-	__mdio_cmd(ioaddr, EhnMIIreq | EhnMIIread |
-		(((u32) reg) << EhnMIIregShift) | (phy_id << EhnMIIpmdShift));
-
-	return (u16) (SIS_R32(GMIIControl) >> EhnMIIdataShift);
-}
-
-static void __mdio_write(struct net_device *dev, int phy_id, int reg, int val)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	mdio_write(tp->mmio_addr, phy_id, reg, val);
-}
-
-static int __mdio_read(struct net_device *dev, int phy_id, int reg)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	return mdio_read(tp->mmio_addr, phy_id, reg);
-}
-
-static u16 mdio_read_latched(void __iomem *ioaddr, int phy_id, int reg)
-{
-	mdio_read(ioaddr, phy_id, reg);
-	return mdio_read(ioaddr, phy_id, reg);
-}
-
-static u16 __devinit sis190_read_eeprom(void __iomem *ioaddr, u32 reg)
-{
-	u16 data = 0xffff;
-	unsigned int i;
-
-	if (!(SIS_R32(ROMControl) & 0x0002))
-		return 0;
-
-	SIS_W32(ROMInterface, EEREQ | EEROP | (reg << 10));
-
-	for (i = 0; i < 200; i++) {
-		if (!(SIS_R32(ROMInterface) & EEREQ)) {
-			data = (SIS_R32(ROMInterface) & 0xffff0000) >> 16;
-			break;
-		}
-		msleep(1);
-	}
-
-	return data;
-}
-
-static void sis190_irq_mask_and_ack(void __iomem *ioaddr)
-{
-	SIS_W32(IntrMask, 0x00);
-	SIS_W32(IntrStatus, 0xffffffff);
-	SIS_PCI_COMMIT();
-}
-
-static void sis190_asic_down(void __iomem *ioaddr)
-{
-	/* Stop the chip's Tx and Rx DMA processes. */
-
-	SIS_W32(TxControl, 0x1a00);
-	SIS_W32(RxControl, 0x1a00);
-
-	sis190_irq_mask_and_ack(ioaddr);
-}
-
-static void sis190_mark_as_last_descriptor(struct RxDesc *desc)
-{
-	desc->size |= cpu_to_le32(RingEnd);
-}
-
-static inline void sis190_give_to_asic(struct RxDesc *desc, u32 rx_buf_sz)
-{
-	u32 eor = le32_to_cpu(desc->size) & RingEnd;
-
-	desc->PSize = 0x0;
-	desc->size = cpu_to_le32((rx_buf_sz & RX_BUF_MASK) | eor);
-	wmb();
-	desc->status = cpu_to_le32(OWNbit | INTbit);
-}
-
-static inline void sis190_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
-				      u32 rx_buf_sz)
-{
-	desc->addr = cpu_to_le32(mapping);
-	sis190_give_to_asic(desc, rx_buf_sz);
-}
-
-static inline void sis190_make_unusable_by_asic(struct RxDesc *desc)
-{
-	desc->PSize = 0x0;
-	desc->addr = 0xdeadbeef;
-	desc->size &= cpu_to_le32(RingEnd);
-	wmb();
-	desc->status = 0x0;
-}
-
-static int sis190_alloc_rx_skb(struct pci_dev *pdev, struct sk_buff **sk_buff,
-			       struct RxDesc *desc, u32 rx_buf_sz)
-{
-	struct sk_buff *skb;
-	dma_addr_t mapping;
-	int ret = 0;
-
-	skb = dev_alloc_skb(rx_buf_sz);
-	if (!skb)
-		goto err_out;
-
-	*sk_buff = skb;
-
-	mapping = pci_map_single(pdev, skb->data, rx_buf_sz,
-				 PCI_DMA_FROMDEVICE);
-
-	sis190_map_to_asic(desc, mapping, rx_buf_sz);
-out:
-	return ret;
-
-err_out:
-	ret = -ENOMEM;
-	sis190_make_unusable_by_asic(desc);
-	goto out;
-}
-
-static u32 sis190_rx_fill(struct sis190_private *tp, struct net_device *dev,
-			  u32 start, u32 end)
-{
-	u32 cur;
-
-	for (cur = start; cur < end; cur++) {
-		int ret, i = cur % NUM_RX_DESC;
-
-		if (tp->Rx_skbuff[i])
-			continue;
-
-		ret = sis190_alloc_rx_skb(tp->pci_dev, tp->Rx_skbuff + i,
-					  tp->RxDescRing + i, tp->rx_buf_sz);
-		if (ret < 0)
-			break;
-	}
-	return cur - start;
-}
-
-static inline int sis190_try_rx_copy(struct sk_buff **sk_buff, int pkt_size,
-				     struct RxDesc *desc, int rx_buf_sz)
-{
-	int ret = -1;
-
-	if (pkt_size < rx_copybreak) {
-		struct sk_buff *skb;
-
-		skb = dev_alloc_skb(pkt_size + NET_IP_ALIGN);
-		if (skb) {
-			skb_reserve(skb, NET_IP_ALIGN);
-			eth_copy_and_sum(skb, sk_buff[0]->data, pkt_size, 0);
-			*sk_buff = skb;
-			sis190_give_to_asic(desc, rx_buf_sz);
-			ret = 0;
-		}
-	}
-	return ret;
-}
-
-static inline int sis190_rx_pkt_err(u32 status, struct net_device_stats *stats)
-{
-#define ErrMask	(OVRUN | SHORT | LIMIT | MIIER | NIBON | COLON | ABORT)
-
-	if ((status & CRCOK) && !(status & ErrMask))
-		return 0;
-
-	if (!(status & CRCOK))
-		stats->rx_crc_errors++;
-	else if (status & OVRUN)
-		stats->rx_over_errors++;
-	else if (status & (SHORT | LIMIT))
-		stats->rx_length_errors++;
-	else if (status & (MIIER | NIBON | COLON))
-		stats->rx_frame_errors++;
-
-	stats->rx_errors++;
-	return -1;
-}
-
-static int sis190_rx_interrupt(struct net_device *dev,
-			       struct sis190_private *tp, void __iomem *ioaddr)
-{
-	struct net_device_stats *stats = &tp->stats;
-	u32 rx_left, cur_rx = tp->cur_rx;
-	u32 delta, count;
-
-	rx_left = NUM_RX_DESC + tp->dirty_rx - cur_rx;
-	rx_left = sis190_rx_quota(rx_left, (u32) dev->quota);
-
-	for (; rx_left > 0; rx_left--, cur_rx++) {
-		unsigned int entry = cur_rx % NUM_RX_DESC;
-		struct RxDesc *desc = tp->RxDescRing + entry;
-		u32 status;
-
-		if (desc->status & OWNbit)
-			break;
-
-		status = le32_to_cpu(desc->PSize);
-
-		// net_intr(tp, KERN_INFO "%s: Rx PSize = %08x.\n", dev->name,
-		//	 status);
-
-		if (sis190_rx_pkt_err(status, stats) < 0)
-			sis190_give_to_asic(desc, tp->rx_buf_sz);
-		else {
-			struct sk_buff *skb = tp->Rx_skbuff[entry];
-			int pkt_size = (status & RxSizeMask) - 4;
-			void (*pci_action)(struct pci_dev *, dma_addr_t,
-				size_t, int) = pci_dma_sync_single_for_device;
-
-			if (unlikely(pkt_size > tp->rx_buf_sz)) {
-				net_intr(tp, KERN_INFO
-					 "%s: (frag) status = %08x.\n",
-					 dev->name, status);
-				stats->rx_dropped++;
-				stats->rx_length_errors++;
-				sis190_give_to_asic(desc, tp->rx_buf_sz);
-				continue;
-			}
-
-			pci_dma_sync_single_for_cpu(tp->pci_dev,
-				le32_to_cpu(desc->addr), tp->rx_buf_sz,
-				PCI_DMA_FROMDEVICE);
-
-			if (sis190_try_rx_copy(&skb, pkt_size, desc,
-					       tp->rx_buf_sz)) {
-				pci_action = pci_unmap_single;
-				tp->Rx_skbuff[entry] = NULL;
-				sis190_make_unusable_by_asic(desc);
-			}
-
-			pci_action(tp->pci_dev, le32_to_cpu(desc->addr),
-				   tp->rx_buf_sz, PCI_DMA_FROMDEVICE);
-
-			skb->dev = dev;
-			skb_put(skb, pkt_size);
-			skb->protocol = eth_type_trans(skb, dev);
-
-			sis190_rx_skb(skb);
-
-			dev->last_rx = jiffies;
-			stats->rx_packets++;
-			stats->rx_bytes += pkt_size;
-			if ((status & BCAST) == MCAST)
-				stats->multicast++;
-		}
-	}
-	count = cur_rx - tp->cur_rx;
-	tp->cur_rx = cur_rx;
-
-	delta = sis190_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx);
-	if (!delta && count && netif_msg_intr(tp))
-		printk(KERN_INFO "%s: no Rx buffer allocated.\n", dev->name);
-	tp->dirty_rx += delta;
-
-	if (((tp->dirty_rx + NUM_RX_DESC) == tp->cur_rx) && netif_msg_intr(tp))
-		printk(KERN_EMERG "%s: Rx buffers exhausted.\n", dev->name);
-
-	return count;
-}
-
-static void sis190_unmap_tx_skb(struct pci_dev *pdev, struct sk_buff *skb,
-				struct TxDesc *desc)
-{
-	unsigned int len;
-
-	len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
-
-	pci_unmap_single(pdev, le32_to_cpu(desc->addr), len, PCI_DMA_TODEVICE);
-
-	memset(desc, 0x00, sizeof(*desc));
-}
-
-static void sis190_tx_interrupt(struct net_device *dev,
-				struct sis190_private *tp, void __iomem *ioaddr)
-{
-	u32 pending, dirty_tx = tp->dirty_tx;
-	/*
-	 * It would not be needed if queueing was allowed to be enabled
-	 * again too early (hint: think preempt and unclocked smp systems).
-	 */
-	unsigned int queue_stopped;
-
-	smp_rmb();
-	pending = tp->cur_tx - dirty_tx;
-	queue_stopped = (pending == NUM_TX_DESC);
-
-	for (; pending; pending--, dirty_tx++) {
-		unsigned int entry = dirty_tx % NUM_TX_DESC;
-		struct TxDesc *txd = tp->TxDescRing + entry;
-		struct sk_buff *skb;
-
-		if (le32_to_cpu(txd->status) & OWNbit)
-			break;
-
-		skb = tp->Tx_skbuff[entry];
-
-		tp->stats.tx_packets++;
-		tp->stats.tx_bytes += skb->len;
-
-		sis190_unmap_tx_skb(tp->pci_dev, skb, txd);
-		tp->Tx_skbuff[entry] = NULL;
-		dev_kfree_skb_irq(skb);
-	}
-
-	if (tp->dirty_tx != dirty_tx) {
-		tp->dirty_tx = dirty_tx;
-		smp_wmb();
-		if (queue_stopped)
-			netif_wake_queue(dev);
-	}
-}
-
-/*
- * The interrupt handler does all of the Rx thread work and cleans up after
- * the Tx thread.
- */
-static irqreturn_t sis190_interrupt(int irq, void *__dev, struct pt_regs *regs)
-{
-	struct net_device *dev = __dev;
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-	unsigned int handled = 0;
-	u32 status;
-
-	status = SIS_R32(IntrStatus);
-
-	if ((status == 0xffffffff) || !status)
-		goto out;
-
-	handled = 1;
-
-	if (unlikely(!netif_running(dev))) {
-		sis190_asic_down(ioaddr);
-		goto out;
-	}
-
-	SIS_W32(IntrStatus, status);
-
-	// net_intr(tp, KERN_INFO "%s: status = %08x.\n", dev->name, status);
-
-	if (status & LinkChange) {
-		net_intr(tp, KERN_INFO "%s: link change.\n", dev->name);
-		schedule_work(&tp->phy_task);
-	}
-
-	if (status & RxQInt)
-		sis190_rx_interrupt(dev, tp, ioaddr);
-
-	if (status & TxQ0Int)
-		sis190_tx_interrupt(dev, tp, ioaddr);
-out:
-	return IRQ_RETVAL(handled);
-}
-
-#ifdef CONFIG_NET_POLL_CONTROLLER
-static void sis190_netpoll(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	struct pci_dev *pdev = tp->pci_dev;
-
-	disable_irq(pdev->irq);
-	sis190_interrupt(pdev->irq, dev, NULL);
-	enable_irq(pdev->irq);
-}
-#endif
-
-static void sis190_free_rx_skb(struct sis190_private *tp,
-			       struct sk_buff **sk_buff, struct RxDesc *desc)
-{
-	struct pci_dev *pdev = tp->pci_dev;
-
-	pci_unmap_single(pdev, le32_to_cpu(desc->addr), tp->rx_buf_sz,
-			 PCI_DMA_FROMDEVICE);
-	dev_kfree_skb(*sk_buff);
-	*sk_buff = NULL;
-	sis190_make_unusable_by_asic(desc);
-}
-
-static void sis190_rx_clear(struct sis190_private *tp)
-{
-	unsigned int i;
-
-	for (i = 0; i < NUM_RX_DESC; i++) {
-		if (!tp->Rx_skbuff[i])
-			continue;
-		sis190_free_rx_skb(tp, tp->Rx_skbuff + i, tp->RxDescRing + i);
-	}
-}
-
-static void sis190_init_ring_indexes(struct sis190_private *tp)
-{
-	tp->dirty_tx = tp->dirty_rx = tp->cur_tx = tp->cur_rx = 0;
-}
-
-static int sis190_init_ring(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	sis190_init_ring_indexes(tp);
-
-	memset(tp->Tx_skbuff, 0x0, NUM_TX_DESC * sizeof(struct sk_buff *));
-	memset(tp->Rx_skbuff, 0x0, NUM_RX_DESC * sizeof(struct sk_buff *));
-
-	if (sis190_rx_fill(tp, dev, 0, NUM_RX_DESC) != NUM_RX_DESC)
-		goto err_rx_clear;
-
-	sis190_mark_as_last_descriptor(tp->RxDescRing + NUM_RX_DESC - 1);
-
-	return 0;
-
-err_rx_clear:
-	sis190_rx_clear(tp);
-	return -ENOMEM;
-}
-
-static void sis190_set_rx_mode(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-	unsigned long flags;
-	u32 mc_filter[2];	/* Multicast hash filter */
-	u16 rx_mode;
-
-	if (dev->flags & IFF_PROMISC) {
-		/* Unconditionally log net taps. */
-		net_drv(tp, KERN_NOTICE "%s: Promiscuous mode enabled.\n",
-			dev->name);
-		rx_mode =
-			AcceptBroadcast | AcceptMulticast | AcceptMyPhys |
-			AcceptAllPhys;
-		mc_filter[1] = mc_filter[0] = 0xffffffff;
-	} else if ((dev->mc_count > multicast_filter_limit) ||
-		   (dev->flags & IFF_ALLMULTI)) {
-		/* Too many to filter perfectly -- accept all multicasts. */
-		rx_mode = AcceptBroadcast | AcceptMulticast | AcceptMyPhys;
-		mc_filter[1] = mc_filter[0] = 0xffffffff;
-	} else {
-		struct dev_mc_list *mclist;
-		unsigned int i;
-
-		rx_mode = AcceptBroadcast | AcceptMyPhys;
-		mc_filter[1] = mc_filter[0] = 0;
-		for (i = 0, mclist = dev->mc_list; mclist && i < dev->mc_count;
-		     i++, mclist = mclist->next) {
-			int bit_nr =
-				ether_crc(ETH_ALEN, mclist->dmi_addr) >> 26;
-			mc_filter[bit_nr >> 5] |= 1 << (bit_nr & 31);
-			rx_mode |= AcceptMulticast;
-		}
-	}
-
-	spin_lock_irqsave(&tp->lock, flags);
-
-	SIS_W16(RxMacControl, rx_mode | 0x2);
-	SIS_W32(RxHashTable, mc_filter[0]);
-	SIS_W32(RxHashTable + 4, mc_filter[1]);
-
-	spin_unlock_irqrestore(&tp->lock, flags);
-}
-
-static void sis190_soft_reset(void __iomem *ioaddr)
-{
-	SIS_W32(IntrControl, 0x8000);
-	SIS_PCI_COMMIT();
-	msleep(1);
-	SIS_W32(IntrControl, 0x0);
-	sis190_asic_down(ioaddr);
-	msleep(1);
-}
-
-static void sis190_hw_start(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-
-	sis190_soft_reset(ioaddr);
-
-	SIS_W32(TxDescStartAddr, tp->tx_dma);
-	SIS_W32(RxDescStartAddr, tp->rx_dma);
-
-	SIS_W32(IntrStatus, 0xffffffff);
-	SIS_W32(IntrMask, 0x0);
-	/*
-	 * Default is 100Mbps.
-	 * A bit strange: 100Mbps is 0x1801 elsewhere -- FR 2005/06/09
-	 */
-	SIS_W16(StationControl, 0x1901);
-	SIS_W32(GMIIControl, 0x0);
-	SIS_W32(TxMacControl, 0x60);
-	SIS_W16(RxMacControl, 0x02);
-	SIS_W32(RxHashTable, 0x0);
-	SIS_W32(0x6c, 0x0);
-	SIS_W32(RxWolCtrl, 0x0);
-	SIS_W32(RxWolData, 0x0);
-
-	SIS_PCI_COMMIT();
-
-	sis190_set_rx_mode(dev);
-
-	/* Enable all known interrupts by setting the interrupt mask. */
-	SIS_W32(IntrMask, sis190_intr_mask);
-
-	SIS_W32(TxControl, 0x1a00 | CmdTxEnb);
-	SIS_W32(RxControl, 0x1a1d);
-
-	netif_start_queue(dev);
-}
-
-static void sis190_phy_task(void * data)
-{
-	struct net_device *dev = data;
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-	int phy_id = tp->mii_if.phy_id;
-	u16 val;
-
-	rtnl_lock();
-
-	val = mdio_read(ioaddr, phy_id, MII_BMCR);
-	if (val & BMCR_RESET) {
-		// FIXME: needlessly high ?  -- FR 02/07/2005
-		mod_timer(&tp->timer, jiffies + HZ/10);
-	} else if (!(mdio_read_latched(ioaddr, phy_id, MII_BMSR) &
-		     BMSR_ANEGCOMPLETE)) {
-		net_link(tp, KERN_WARNING "%s: PHY reset until link up.\n",
-			 dev->name);
-		mdio_write(ioaddr, phy_id, MII_BMCR, val | BMCR_RESET);
-		mod_timer(&tp->timer, jiffies + SIS190_PHY_TIMEOUT);
-	} else {
-		/* Rejoice ! */
-		struct {
-			int val;
-			const char *msg;
-			u16 ctl;
-		} reg31[] = {
-			{ LPA_1000XFULL | LPA_SLCT,
-				"1000 Mbps Full Duplex",
-				0x01 | _1000bpsF },
-			{ LPA_1000XHALF | LPA_SLCT,
-				"1000 Mbps Half Duplex",
-				0x01 | _1000bpsH },
-			{ LPA_100FULL,
-				"100 Mbps Full Duplex",
-				0x01 | _100bpsF },
-			{ LPA_100HALF,
-				"100 Mbps Half Duplex",
-				0x01 | _100bpsH },
-			{ LPA_10FULL,
-				"10 Mbps Full Duplex",
-				0x01 | _10bpsF },
-			{ LPA_10HALF,
-				"10 Mbps Half Duplex",
-				0x01 | _10bpsH },
-			{ 0, "unknown", 0x0000 }
-		}, *p;
-		u16 adv;
-
-		val = mdio_read(ioaddr, phy_id, 0x1f);
-		net_link(tp, KERN_INFO "%s: mii ext = %04x.\n", dev->name, val);
-
-		val = mdio_read(ioaddr, phy_id, MII_LPA);
-		adv = mdio_read(ioaddr, phy_id, MII_ADVERTISE);
-		net_link(tp, KERN_INFO "%s: mii lpa = %04x adv = %04x.\n",
-			 dev->name, val, adv);
-
-		val &= adv;
-
-		for (p = reg31; p->ctl; p++) {
-			if ((val & p->val) == p->val)
-				break;
-		}
-		if (p->ctl)
-			SIS_W16(StationControl, p->ctl);
-		net_link(tp, KERN_INFO "%s: link on %s mode.\n", dev->name,
-			 p->msg);
-		netif_carrier_on(dev);
-	}
-
-	rtnl_unlock();
-}
-
-static void sis190_phy_timer(unsigned long __opaque)
-{
-	struct net_device *dev = (struct net_device *)__opaque;
-	struct sis190_private *tp = netdev_priv(dev);
-
-	if (likely(netif_running(dev)))
-		schedule_work(&tp->phy_task);
-}
-
-static inline void sis190_delete_timer(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	del_timer_sync(&tp->timer);
-}
-
-static inline void sis190_request_timer(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	struct timer_list *timer = &tp->timer;
-
-	init_timer(timer);
-	timer->expires = jiffies + SIS190_PHY_TIMEOUT;
-	timer->data = (unsigned long)dev;
-	timer->function = sis190_phy_timer;
-	add_timer(timer);
-}
-
-static void sis190_set_rxbufsize(struct sis190_private *tp,
-				 struct net_device *dev)
-{
-	unsigned int mtu = dev->mtu;
-
-	tp->rx_buf_sz = (mtu > RX_BUF_SIZE) ? mtu + ETH_HLEN + 8 : RX_BUF_SIZE;
-	/* RxDesc->size has a licence to kill the lower bits */
-	if (tp->rx_buf_sz & 0x07) {
-		tp->rx_buf_sz += 8;
-		tp->rx_buf_sz &= RX_BUF_MASK;
-	}
-}
-
-static int sis190_open(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	struct pci_dev *pdev = tp->pci_dev;
-	int rc = -ENOMEM;
-
-	sis190_set_rxbufsize(tp, dev);
-
-	/*
-	 * Rx and Tx descriptors need 256 bytes alignment.
-	 * pci_alloc_consistent() guarantees a stronger alignment.
-	 */
-	tp->TxDescRing = pci_alloc_consistent(pdev, TX_RING_BYTES, &tp->tx_dma);
-	if (!tp->TxDescRing)
-		goto out;
-
-	tp->RxDescRing = pci_alloc_consistent(pdev, RX_RING_BYTES, &tp->rx_dma);
-	if (!tp->RxDescRing)
-		goto err_free_tx_0;
-
-	rc = sis190_init_ring(dev);
-	if (rc < 0)
-		goto err_free_rx_1;
-
-	INIT_WORK(&tp->phy_task, sis190_phy_task, dev);
-
-	sis190_request_timer(dev);
-
-	rc = request_irq(dev->irq, sis190_interrupt, SA_SHIRQ, dev->name, dev);
-	if (rc < 0)
-		goto err_release_timer_2;
-
-	sis190_hw_start(dev);
-out:
-	return rc;
-
-err_release_timer_2:
-	sis190_delete_timer(dev);
-	sis190_rx_clear(tp);
-err_free_rx_1:
-	pci_free_consistent(tp->pci_dev, RX_RING_BYTES, tp->RxDescRing,
-		tp->rx_dma);
-err_free_tx_0:
-	pci_free_consistent(tp->pci_dev, TX_RING_BYTES, tp->TxDescRing,
-		tp->tx_dma);
-	goto out;
-}
-
-static void sis190_tx_clear(struct sis190_private *tp)
-{
-	unsigned int i;
-
-	for (i = 0; i < NUM_TX_DESC; i++) {
-		struct sk_buff *skb = tp->Tx_skbuff[i];
-
-		if (!skb)
-			continue;
-
-		sis190_unmap_tx_skb(tp->pci_dev, skb, tp->TxDescRing + i);
-		tp->Tx_skbuff[i] = NULL;
-		dev_kfree_skb(skb);
-
-		tp->stats.tx_dropped++;
-	}
-	tp->cur_tx = tp->dirty_tx = 0;
-}
-
-static void sis190_down(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-	unsigned int poll_locked = 0;
-
-	sis190_delete_timer(dev);
-
-	netif_stop_queue(dev);
-
-	flush_scheduled_work();
-
-	do {
-		spin_lock_irq(&tp->lock);
-
-		sis190_asic_down(ioaddr);
-
-		spin_unlock_irq(&tp->lock);
-
-		synchronize_irq(dev->irq);
-
-		if (!poll_locked) {
-			netif_poll_disable(dev);
-			poll_locked++;
-		}
-
-		synchronize_sched();
-
-	} while (SIS_R32(IntrMask));
-
-	sis190_tx_clear(tp);
-	sis190_rx_clear(tp);
-}
-
-static int sis190_close(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	struct pci_dev *pdev = tp->pci_dev;
-
-	sis190_down(dev);
-
-	free_irq(dev->irq, dev);
-
-	netif_poll_enable(dev);
-
-	pci_free_consistent(pdev, TX_RING_BYTES, tp->TxDescRing, tp->tx_dma);
-	pci_free_consistent(pdev, RX_RING_BYTES, tp->RxDescRing, tp->rx_dma);
-
-	tp->TxDescRing = NULL;
-	tp->RxDescRing = NULL;
-
-	return 0;
-}
-
-static int sis190_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-	u32 len, entry, dirty_tx;
-	struct TxDesc *desc;
-	dma_addr_t mapping;
-
-	if (unlikely(skb->len < ETH_ZLEN)) {
-		skb = skb_padto(skb, ETH_ZLEN);
-		if (!skb) {
-			tp->stats.tx_dropped++;
-			goto out;
-		}
-		len = ETH_ZLEN;
-	} else {
-		len = skb->len;
-	}
-
-	entry = tp->cur_tx % NUM_TX_DESC;
-	desc = tp->TxDescRing + entry;
-
-	if (unlikely(le32_to_cpu(desc->status) & OWNbit)) {
-		netif_stop_queue(dev);
-		net_tx_err(tp, KERN_ERR PFX
-			   "%s: BUG! Tx Ring full when queue awake!\n",
-			   dev->name);
-		return NETDEV_TX_BUSY;
-	}
-
-	mapping = pci_map_single(tp->pci_dev, skb->data, len, PCI_DMA_TODEVICE);
-
-	tp->Tx_skbuff[entry] = skb;
-
-	desc->PSize = cpu_to_le32(len);
-	desc->addr = cpu_to_le32(mapping);
-
-	desc->size = cpu_to_le32(len);
-	if (entry == (NUM_TX_DESC - 1))
-		desc->size |= cpu_to_le32(RingEnd);
-
-	wmb();
-
-	desc->status = cpu_to_le32(OWNbit | INTbit | DEFbit | CRCbit | PADbit);
-
-	tp->cur_tx++;
-
-	smp_wmb();
-
-	SIS_W32(TxControl, 0x1a00 | CmdReset | CmdTxEnb);
-
-	dev->trans_start = jiffies;
-
-	dirty_tx = tp->dirty_tx;
-	if ((tp->cur_tx - NUM_TX_DESC) == dirty_tx) {
-		netif_stop_queue(dev);
-		smp_rmb();
-		if (dirty_tx != tp->dirty_tx)
-			netif_wake_queue(dev);
-	}
-out:
-	return NETDEV_TX_OK;
-}
-
-static struct net_device_stats *sis190_get_stats(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	return &tp->stats;
-}
-
-static void sis190_free_phy(struct list_head *first_phy)
-{
-	struct sis190_phy *cur, *next;
-
-	list_for_each_entry_safe(cur, next, first_phy, list) {
-		kfree(cur);
-	}
-}
-
-/**
- *	sis190_default_phy - Select default PHY for sis190 mac.
- *	@dev: the net device to probe for
- *
- *	Select first detected PHY with link as default.
- *	If no one is link on, select PHY whose types is HOME as default.
- *	If HOME doesn't exist, select LAN.
- */
-static u16 sis190_default_phy(struct net_device *dev)
-{
-	struct sis190_phy *phy, *phy_home, *phy_default, *phy_lan;
-	struct sis190_private *tp = netdev_priv(dev);
-	struct mii_if_info *mii_if = &tp->mii_if;
-	void __iomem *ioaddr = tp->mmio_addr;
-	u16 status;
-
-	phy_home = phy_default = phy_lan = NULL;
-
-	list_for_each_entry(phy, &tp->first_phy, list) {
-		status = mdio_read_latched(ioaddr, phy->phy_id, MII_BMSR);
-
-		// Link ON & Not select default PHY & not ghost PHY.
-		if ((status & BMSR_LSTATUS) &&
-		    !phy_default &&
-		    (phy->type != UNKNOWN)) {
-			phy_default = phy;
-		} else {
-			status = mdio_read(ioaddr, phy->phy_id, MII_BMCR);
-			mdio_write(ioaddr, phy->phy_id, MII_BMCR,
-				   status | BMCR_ANENABLE | BMCR_ISOLATE);
-			if (phy->type == HOME)
-				phy_home = phy;
-			else if (phy->type == LAN)
-				phy_lan = phy;
-		}
-	}
-
-	if (!phy_default) {
-		if (phy_home)
-			phy_default = phy_home;
-		else if (phy_lan)
-			phy_default = phy_lan;
-		else
-			phy_default = list_entry(&tp->first_phy,
-						 struct sis190_phy, list);
-	}
-
-	if (mii_if->phy_id != phy_default->phy_id) {
-		mii_if->phy_id = phy_default->phy_id;
-		net_probe(tp, KERN_INFO
-		       "%s: Using transceiver at address %d as default.\n",
-		       pci_name(tp->pci_dev), mii_if->phy_id);
-	}
-
-	status = mdio_read(ioaddr, mii_if->phy_id, MII_BMCR);
-	status &= (~BMCR_ISOLATE);
-
-	mdio_write(ioaddr, mii_if->phy_id, MII_BMCR, status);
-	status = mdio_read_latched(ioaddr, mii_if->phy_id, MII_BMSR);
-
-	return status;
-}
-
-static void sis190_init_phy(struct net_device *dev, struct sis190_private *tp,
-			    struct sis190_phy *phy, unsigned int phy_id,
-			    u16 mii_status)
-{
-	void __iomem *ioaddr = tp->mmio_addr;
-	struct mii_chip_info *p;
-
-	INIT_LIST_HEAD(&phy->list);
-	phy->status = mii_status;
-	phy->phy_id = phy_id;
-
-	phy->id[0] = mdio_read(ioaddr, phy_id, MII_PHYSID1);
-	phy->id[1] = mdio_read(ioaddr, phy_id, MII_PHYSID2);
-
-	for (p = mii_chip_table; p->type; p++) {
-		if ((p->id[0] == phy->id[0]) &&
-		    (p->id[1] == (phy->id[1] & 0xfff0))) {
-			break;
-		}
-	}
-
-	if (p->id[1]) {
-		phy->type = (p->type == MIX) ?
-			((mii_status & (BMSR_100FULL | BMSR_100HALF)) ?
-				LAN : HOME) : p->type;
-	} else
-		phy->type = UNKNOWN;
-
-	net_probe(tp, KERN_INFO "%s: %s transceiver at address %d.\n",
-		  pci_name(tp->pci_dev),
-		  (phy->type == UNKNOWN) ? "Unknown PHY" : p->name, phy_id);
-}
-
-/**
- *	sis190_mii_probe - Probe MII PHY for sis190
- *	@dev: the net device to probe for
- *
- *	Search for total of 32 possible mii phy addresses.
- *	Identify and set current phy if found one,
- *	return error if it failed to found.
- */
-static int __devinit sis190_mii_probe(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	struct mii_if_info *mii_if = &tp->mii_if;
-	void __iomem *ioaddr = tp->mmio_addr;
-	int phy_id;
-	int rc = 0;
-
-	INIT_LIST_HEAD(&tp->first_phy);
-
-	for (phy_id = 0; phy_id < PHY_MAX_ADDR; phy_id++) {
-		struct sis190_phy *phy;
-		u16 status;
-
-		status = mdio_read_latched(ioaddr, phy_id, MII_BMSR);
-
-		// Try next mii if the current one is not accessible.
-		if (status == 0xffff || status == 0x0000)
-			continue;
-
-		phy = kmalloc(sizeof(*phy), GFP_KERNEL);
-		if (!phy) {
-			sis190_free_phy(&tp->first_phy);
-			rc = -ENOMEM;
-			goto out;
-		}
-
-		sis190_init_phy(dev, tp, phy, phy_id, status);
-
-		list_add(&tp->first_phy, &phy->list);
-	}
-
-	if (list_empty(&tp->first_phy)) {
-		net_probe(tp, KERN_INFO "%s: No MII transceivers found!\n",
-			  pci_name(tp->pci_dev));
-		rc = -EIO;
-		goto out;
-	}
-
-	/* Select default PHY for mac */
-	sis190_default_phy(dev);
-
-	mii_if->dev = dev;
-	mii_if->mdio_read = __mdio_read;
-	mii_if->mdio_write = __mdio_write;
-	mii_if->phy_id_mask = PHY_ID_ANY;
-	mii_if->reg_num_mask = MII_REG_ANY;
-out:
-	return rc;
-}
-
-static void __devexit sis190_mii_remove(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	sis190_free_phy(&tp->first_phy);
-}
-
-static void sis190_release_board(struct pci_dev *pdev)
-{
-	struct net_device *dev = pci_get_drvdata(pdev);
-	struct sis190_private *tp = netdev_priv(dev);
-
-	iounmap(tp->mmio_addr);
-	pci_release_regions(pdev);
-	pci_disable_device(pdev);
-	free_netdev(dev);
-}
-
-static struct net_device * __devinit sis190_init_board(struct pci_dev *pdev)
-{
-	struct sis190_private *tp;
-	struct net_device *dev;
-	void __iomem *ioaddr;
-	int rc;
-
-	dev = alloc_etherdev(sizeof(*tp));
-	if (!dev) {
-		net_drv(&debug, KERN_ERR PFX "unable to alloc new ethernet\n");
-		rc = -ENOMEM;
-		goto err_out_0;
-	}
-
-	SET_MODULE_OWNER(dev);
-	SET_NETDEV_DEV(dev, &pdev->dev);
-
-	tp = netdev_priv(dev);
-	tp->msg_enable = netif_msg_init(debug.msg_enable, SIS190_MSG_DEFAULT);
-
-	rc = pci_enable_device(pdev);
-	if (rc < 0) {
-		net_probe(tp, KERN_ERR "%s: enable failure\n", pci_name(pdev));
-		goto err_free_dev_1;
-	}
-
-	rc = -ENODEV;
-
-	if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
-		net_probe(tp, KERN_ERR "%s: region #0 is no MMIO resource.\n",
-			  pci_name(pdev));
-		goto err_pci_disable_2;
-	}
-	if (pci_resource_len(pdev, 0) < SIS190_REGS_SIZE) {
-		net_probe(tp, KERN_ERR "%s: invalid PCI region size(s).\n",
-			  pci_name(pdev));
-		goto err_pci_disable_2;
-	}
-
-	rc = pci_request_regions(pdev, DRV_NAME);
-	if (rc < 0) {
-		net_probe(tp, KERN_ERR PFX "%s: could not request regions.\n",
-			  pci_name(pdev));
-		goto err_pci_disable_2;
-	}
-
-	rc = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
-	if (rc < 0) {
-		net_probe(tp, KERN_ERR "%s: DMA configuration failed.\n",
-			  pci_name(pdev));
-		goto err_free_res_3;
-	}
-
-	pci_set_master(pdev);
-
-	ioaddr = ioremap(pci_resource_start(pdev, 0), SIS190_REGS_SIZE);
-	if (!ioaddr) {
-		net_probe(tp, KERN_ERR "%s: cannot remap MMIO, aborting\n",
-			  pci_name(pdev));
-		rc = -EIO;
-		goto err_free_res_3;
-	}
-
-	tp->pci_dev = pdev;
-	tp->mmio_addr = ioaddr;
-
-	sis190_irq_mask_and_ack(ioaddr);
-
-	sis190_soft_reset(ioaddr);
-out:
-	return dev;
-
-err_free_res_3:
-	pci_release_regions(pdev);
-err_pci_disable_2:
-	pci_disable_device(pdev);
-err_free_dev_1:
-	free_netdev(dev);
-err_out_0:
-	dev = ERR_PTR(rc);
-	goto out;
-}
-
-static void sis190_tx_timeout(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-	u8 tmp8;
-
-	/* Disable Tx, if not already */
-	tmp8 = SIS_R8(TxControl);
-	if (tmp8 & CmdTxEnb)
-		SIS_W8(TxControl, tmp8 & ~CmdTxEnb);
-
-
-	net_tx_err(tp, KERN_INFO "%s: Transmit timeout, status %08x %08x.\n",
-		   dev->name, SIS_R32(TxControl), SIS_R32(TxSts));
-
-	/* Disable interrupts by clearing the interrupt mask. */
-	SIS_W32(IntrMask, 0x0000);
-
-	/* Stop a shared interrupt from scavenging while we are. */
-	spin_lock_irq(&tp->lock);
-	sis190_tx_clear(tp);
-	spin_unlock_irq(&tp->lock);
-
-	/* ...and finally, reset everything. */
-	sis190_hw_start(dev);
-
-	netif_wake_queue(dev);
-}
-
-static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
-						     struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-	u16 sig;
-	int i;
-
-	net_probe(tp, KERN_INFO "%s: Read MAC address from EEPROM\n",
-		  pci_name(pdev));
-
-	/* Check to see if there is a sane EEPROM */
-	sig = (u16) sis190_read_eeprom(ioaddr, EEPROMSignature);
-
-	if ((sig == 0xffff) || (sig == 0x0000)) {
-		net_probe(tp, KERN_INFO "%s: Error EEPROM read %x.\n",
-			  pci_name(pdev), sig);
-		return -EIO;
-	}
-
-	/* Get MAC address from EEPROM */
-	for (i = 0; i < MAC_ADDR_LEN / 2; i++) {
-		__le16 w = sis190_read_eeprom(ioaddr, EEPROMMACAddr + i);
-
-		((u16 *)dev->dev_addr)[0] = le16_to_cpu(w);
-	}
-
-	return 0;
-}
-
-/**
- *	sis190_get_mac_addr_from_apc - Get MAC address for SiS965 model
- *	@pdev: PCI device
- *	@dev:  network device to get address for
- *
- *	SiS965 model, use APC CMOS RAM to store MAC address.
- *	APC CMOS RAM is accessed through ISA bridge.
- *	MAC address is read into @net_dev->dev_addr.
- */
-static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
-						  struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	struct pci_dev *isa_bridge;
-	u8 reg, tmp8;
-	int i;
-
-	net_probe(tp, KERN_INFO "%s: Read MAC address from APC.\n",
-		  pci_name(pdev));
-
-	isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0965, NULL);
-	if (!isa_bridge) {
-		net_probe(tp, KERN_INFO "%s: Can not find ISA bridge.\n",
-			  pci_name(pdev));
-		return -EIO;
-	}
-
-	/* Enable port 78h & 79h to access APC Registers. */
-	pci_read_config_byte(isa_bridge, 0x48, &tmp8);
-	reg = (tmp8 & ~0x02);
-	pci_write_config_byte(isa_bridge, 0x48, reg);
-	udelay(50);
-	pci_read_config_byte(isa_bridge, 0x48, &reg);
-
-        for (i = 0; i < MAC_ADDR_LEN; i++) {
-                outb(0x9 + i, 0x78);
-                dev->dev_addr[i] = inb(0x79);
-        }
-
-	outb(0x12, 0x78);
-	reg = inb(0x79);
-
-	/* Restore the value to ISA Bridge */
-	pci_write_config_byte(isa_bridge, 0x48, tmp8);
-	pci_dev_put(isa_bridge);
-
-	return 0;
-}
-
-/**
- *      sis190_init_rxfilter - Initialize the Rx filter
- *      @dev: network device to initialize
- *
- *      Set receive filter address to our MAC address
- *      and enable packet filtering.
- */
-static inline void sis190_init_rxfilter(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-	u16 ctl;
-	int i;
-
-	ctl = SIS_R16(RxMacControl);
-	/*
-	 * Disable packet filtering before setting filter.
-	 * Note: SiS's driver writes 32 bits but RxMacControl is 16 bits
-	 * only and followed by RxMacAddr (6 bytes). Strange. -- FR
-	 */
-	SIS_W16(RxMacControl, ctl & ~0x0f00);
-
-	for (i = 0; i < MAC_ADDR_LEN; i++)
-		SIS_W8(RxMacAddr + i, dev->dev_addr[i]);
-
-	SIS_W16(RxMacControl, ctl);
-	SIS_PCI_COMMIT();
-}
-
-static int sis190_get_mac_addr(struct pci_dev *pdev, struct net_device *dev)
-{
-	u8 from;
-
-	pci_read_config_byte(pdev, 0x73, &from);
-
-	return (from & 0x00000001) ?
-		sis190_get_mac_addr_from_apc(pdev, dev) :
-		sis190_get_mac_addr_from_eeprom(pdev, dev);
-}
-
-static void sis190_set_speed_auto(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	void __iomem *ioaddr = tp->mmio_addr;
-	int phy_id = tp->mii_if.phy_id;
-	int val;
-
-	net_link(tp, KERN_INFO "%s: Enabling Auto-negotiation.\n", dev->name);
-
-	val = mdio_read(ioaddr, phy_id, MII_ADVERTISE);
-
-	// Enable 10/100 Full/Half Mode, leave MII_ADVERTISE bit4:0
-	// unchanged.
-	mdio_write(ioaddr, phy_id, MII_ADVERTISE, (val & ADVERTISE_SLCT) |
-		   ADVERTISE_100FULL | ADVERTISE_10FULL |
-		   ADVERTISE_100HALF | ADVERTISE_10HALF);
-
-	// Enable 1000 Full Mode.
-	mdio_write(ioaddr, phy_id, MII_CTRL1000, ADVERTISE_1000FULL);
-
-	// Enable auto-negotiation and restart auto-negotiation.
-	mdio_write(ioaddr, phy_id, MII_BMCR,
-		   BMCR_ANENABLE | BMCR_ANRESTART | BMCR_RESET);
-}
-
-static int sis190_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	return mii_ethtool_gset(&tp->mii_if, cmd);
-}
-
-static int sis190_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	return mii_ethtool_sset(&tp->mii_if, cmd);
-}
-
-static void sis190_get_drvinfo(struct net_device *dev,
-			       struct ethtool_drvinfo *info)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	strcpy(info->driver, DRV_NAME);
-	strcpy(info->version, DRV_VERSION);
-	strcpy(info->bus_info, pci_name(tp->pci_dev));
-}
-
-static int sis190_get_regs_len(struct net_device *dev)
-{
-	return SIS190_REGS_SIZE;
-}
-
-static void sis190_get_regs(struct net_device *dev, struct ethtool_regs *regs,
-			    void *p)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-	unsigned long flags;
-
-	if (regs->len > SIS190_REGS_SIZE)
-		regs->len = SIS190_REGS_SIZE;
-
-	spin_lock_irqsave(&tp->lock, flags);
-	memcpy_fromio(p, tp->mmio_addr, regs->len);
-	spin_unlock_irqrestore(&tp->lock, flags);
-}
-
-static int sis190_nway_reset(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	return mii_nway_restart(&tp->mii_if);
-}
-
-static u32 sis190_get_msglevel(struct net_device *dev)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	return tp->msg_enable;
-}
-
-static void sis190_set_msglevel(struct net_device *dev, u32 value)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	tp->msg_enable = value;
-}
-
-static struct ethtool_ops sis190_ethtool_ops = {
-	.get_settings	= sis190_get_settings,
-	.set_settings	= sis190_set_settings,
-	.get_drvinfo	= sis190_get_drvinfo,
-	.get_regs_len	= sis190_get_regs_len,
-	.get_regs	= sis190_get_regs,
-	.get_link	= ethtool_op_get_link,
-	.get_msglevel	= sis190_get_msglevel,
-	.set_msglevel	= sis190_set_msglevel,
-	.nway_reset	= sis190_nway_reset,
-};
-
-static int sis190_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
-{
-	struct sis190_private *tp = netdev_priv(dev);
-
-	return !netif_running(dev) ? -EINVAL :
-		generic_mii_ioctl(&tp->mii_if, if_mii(ifr), cmd, NULL);
-}
-
-static int __devinit sis190_init_one(struct pci_dev *pdev,
-				     const struct pci_device_id *ent)
-{
-	static int printed_version = 0;
-	struct sis190_private *tp;
-	struct net_device *dev;
-	void __iomem *ioaddr;
-	int rc;
-
-	if (!printed_version) {
-		net_drv(&debug, KERN_INFO SIS190_DRIVER_NAME " loaded.\n");
-		printed_version = 1;
-	}
-
-	dev = sis190_init_board(pdev);
-	if (IS_ERR(dev)) {
-		rc = PTR_ERR(dev);
-		goto out;
-	}
-
-	tp = netdev_priv(dev);
-	ioaddr = tp->mmio_addr;
-
-	rc = sis190_get_mac_addr(pdev, dev);
-	if (rc < 0)
-		goto err_release_board;
-
-	sis190_init_rxfilter(dev);
-
-	INIT_WORK(&tp->phy_task, sis190_phy_task, dev);
-
-	dev->open = sis190_open;
-	dev->stop = sis190_close;
-	dev->do_ioctl = sis190_ioctl;
-	dev->get_stats = sis190_get_stats;
-	dev->tx_timeout = sis190_tx_timeout;
-	dev->watchdog_timeo = SIS190_TX_TIMEOUT;
-	dev->hard_start_xmit = sis190_start_xmit;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-	dev->poll_controller = sis190_netpoll;
-#endif
-	dev->set_multicast_list = sis190_set_rx_mode;
-	SET_ETHTOOL_OPS(dev, &sis190_ethtool_ops);
-	dev->irq = pdev->irq;
-	dev->base_addr = (unsigned long) 0xdead;
-
-	spin_lock_init(&tp->lock);
-
-	rc = sis190_mii_probe(dev);
-	if (rc < 0)
-		goto err_release_board;
-
-	rc = register_netdev(dev);
-	if (rc < 0)
-		goto err_remove_mii;
-
-	pci_set_drvdata(pdev, dev);
-
-	net_probe(tp, KERN_INFO "%s: %s at %p (IRQ: %d), "
-	       "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
-	       pci_name(pdev), sis_chip_info[ent->driver_data].name,
-	       ioaddr, dev->irq,
-	       dev->dev_addr[0], dev->dev_addr[1],
-	       dev->dev_addr[2], dev->dev_addr[3],
-	       dev->dev_addr[4], dev->dev_addr[5]);
-
-	netif_carrier_off(dev);
-
-	sis190_set_speed_auto(dev);
-out:
-	return rc;
-
-err_remove_mii:
-	sis190_mii_remove(dev);
-err_release_board:
-	sis190_release_board(pdev);
-	goto out;
-}
-
-static void __devexit sis190_remove_one(struct pci_dev *pdev)
-{
-	struct net_device *dev = pci_get_drvdata(pdev);
-
-	sis190_mii_remove(dev);
-	unregister_netdev(dev);
-	sis190_release_board(pdev);
-	pci_set_drvdata(pdev, NULL);
-}
-
-static struct pci_driver sis190_pci_driver = {
-	.name		= DRV_NAME,
-	.id_table	= sis190_pci_tbl,
-	.probe		= sis190_init_one,
-	.remove		= __devexit_p(sis190_remove_one),
-};
-
-static int __init sis190_init_module(void)
-{
-	return pci_module_init(&sis190_pci_driver);
-}
-
-static void __exit sis190_cleanup_module(void)
-{
-	pci_unregister_driver(&sis190_pci_driver);
-}
-
-module_init(sis190_init_module);
-module_exit(sis190_cleanup_module);
diff --git a/trunk/drivers/net/tg3.c b/trunk/drivers/net/tg3.c
index af8263a1580e..6d4ab1e333b5 100644
--- a/trunk/drivers/net/tg3.c
+++ b/trunk/drivers/net/tg3.c
@@ -340,92 +340,41 @@ static struct {
 
 static void tg3_write_indirect_reg32(struct tg3 *tp, u32 off, u32 val)
 {
-	unsigned long flags;
-
-	spin_lock_irqsave(&tp->indirect_lock, flags);
-	pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off);
-	pci_write_config_dword(tp->pdev, TG3PCI_REG_DATA, val);
-	spin_unlock_irqrestore(&tp->indirect_lock, flags);
-}
-
-static void tg3_write_flush_reg32(struct tg3 *tp, u32 off, u32 val)
-{
-	writel(val, tp->regs + off);
-	readl(tp->regs + off);
-}
-
-static u32 tg3_read_indirect_reg32(struct tg3 *tp, u32 off)
-{
-	unsigned long flags;
-	u32 val;
-
-	spin_lock_irqsave(&tp->indirect_lock, flags);
-	pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off);
-	pci_read_config_dword(tp->pdev, TG3PCI_REG_DATA, &val);
-	spin_unlock_irqrestore(&tp->indirect_lock, flags);
-	return val;
-}
-
-static void tg3_write_indirect_mbox(struct tg3 *tp, u32 off, u32 val)
-{
-	unsigned long flags;
-
-	if (off == (MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW)) {
-		pci_write_config_dword(tp->pdev, TG3PCI_RCV_RET_RING_CON_IDX +
-				       TG3_64BIT_REG_LOW, val);
-		return;
-	}
-	if (off == (MAILBOX_RCV_STD_PROD_IDX + TG3_64BIT_REG_LOW)) {
-		pci_write_config_dword(tp->pdev, TG3PCI_STD_RING_PROD_IDX +
-				       TG3_64BIT_REG_LOW, val);
-		return;
-	}
-
-	spin_lock_irqsave(&tp->indirect_lock, flags);
-	pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off + 0x5600);
-	pci_write_config_dword(tp->pdev, TG3PCI_REG_DATA, val);
-	spin_unlock_irqrestore(&tp->indirect_lock, flags);
-
-	/* In indirect mode when disabling interrupts, we also need
-	 * to clear the interrupt bit in the GRC local ctrl register.
-	 */
-	if ((off == (MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW)) &&
-	    (val == 0x1)) {
-		pci_write_config_dword(tp->pdev, TG3PCI_MISC_LOCAL_CTRL,
-				       tp->grc_local_ctrl|GRC_LCLCTRL_CLEARINT);
+	if ((tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) != 0) {
+		spin_lock_bh(&tp->indirect_lock);
+		pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off);
+		pci_write_config_dword(tp->pdev, TG3PCI_REG_DATA, val);
+		spin_unlock_bh(&tp->indirect_lock);
+	} else {
+		writel(val, tp->regs + off);
+		if ((tp->tg3_flags & TG3_FLAG_5701_REG_WRITE_BUG) != 0)
+			readl(tp->regs + off);
 	}
 }
 
-static u32 tg3_read_indirect_mbox(struct tg3 *tp, u32 off)
-{
-	unsigned long flags;
-	u32 val;
-
-	spin_lock_irqsave(&tp->indirect_lock, flags);
-	pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off + 0x5600);
-	pci_read_config_dword(tp->pdev, TG3PCI_REG_DATA, &val);
-	spin_unlock_irqrestore(&tp->indirect_lock, flags);
-	return val;
-}
-
 static void _tw32_flush(struct tg3 *tp, u32 off, u32 val)
 {
-	tp->write32(tp, off, val);
-	if (!(tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) &&
-	    !(tp->tg3_flags & TG3_FLAG_5701_REG_WRITE_BUG) &&
-	    !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
-		tp->read32(tp, off);	/* flush */
+	if ((tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG) != 0) {
+		spin_lock_bh(&tp->indirect_lock);
+		pci_write_config_dword(tp->pdev, TG3PCI_REG_BASE_ADDR, off);
+		pci_write_config_dword(tp->pdev, TG3PCI_REG_DATA, val);
+		spin_unlock_bh(&tp->indirect_lock);
+	} else {
+		void __iomem *dest = tp->regs + off;
+		writel(val, dest);
+		readl(dest);    /* always flush PCI write */
+	}
 }
 
-static inline void tw32_mailbox_flush(struct tg3 *tp, u32 off, u32 val)
+static inline void _tw32_rx_mbox(struct tg3 *tp, u32 off, u32 val)
 {
-	tp->write32_mbox(tp, off, val);
-	if (!(tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER) &&
-	    !(tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND))
-		tp->read32_mbox(tp, off);
+	void __iomem *mbox = tp->regs + off;
+	writel(val, mbox);
+	if (tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER)
+		readl(mbox);
 }
 
-static void tg3_write32_tx_mbox(struct tg3 *tp, u32 off, u32 val)
+static inline void _tw32_tx_mbox(struct tg3 *tp, u32 off, u32 val)
 {
 	void __iomem *mbox = tp->regs + off;
 	writel(val, mbox);
@@ -435,57 +384,46 @@ static void tg3_write32_tx_mbox(struct tg3 *tp, u32 off, u32 val)
 		readl(mbox);
 }
 
-static void tg3_write32(struct tg3 *tp, u32 off, u32 val)
-{
-	writel(val, tp->regs + off);
-}
-
-static u32 tg3_read32(struct tg3 *tp, u32 off)
-{
-	return (readl(tp->regs + off)); 
-}
-
-#define tw32_mailbox(reg, val)	tp->write32_mbox(tp, reg, val)
-#define tw32_mailbox_f(reg, val)	tw32_mailbox_flush(tp, (reg), (val))
-#define tw32_rx_mbox(reg, val)	tp->write32_rx_mbox(tp, reg, val)
-#define tw32_tx_mbox(reg, val)	tp->write32_tx_mbox(tp, reg, val)
-#define tr32_mailbox(reg)	tp->read32_mbox(tp, reg)
+#define tw32_mailbox(reg, val)  writel(((val) & 0xffffffff), tp->regs + (reg))
+#define tw32_rx_mbox(reg, val)  _tw32_rx_mbox(tp, reg, val)
+#define tw32_tx_mbox(reg, val)  _tw32_tx_mbox(tp, reg, val)
 
-#define tw32(reg,val)		tp->write32(tp, reg, val)
+#define tw32(reg,val)		tg3_write_indirect_reg32(tp,(reg),(val))
 #define tw32_f(reg,val)		_tw32_flush(tp,(reg),(val))
-#define tr32(reg)		tp->read32(tp, reg)
+#define tw16(reg,val)		writew(((val) & 0xffff), tp->regs + (reg))
+#define tw8(reg,val)		writeb(((val) & 0xff), tp->regs + (reg))
+#define tr32(reg)		readl(tp->regs + (reg))
+#define tr16(reg)		readw(tp->regs + (reg))
+#define tr8(reg)		readb(tp->regs + (reg))
 
 static void tg3_write_mem(struct tg3 *tp, u32 off, u32 val)
 {
-	unsigned long flags;
-
-	spin_lock_irqsave(&tp->indirect_lock, flags);
+	spin_lock_bh(&tp->indirect_lock);
 	pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, off);
 	pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_DATA, val);
 
 	/* Always leave this as zero. */
 	pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, 0);
-	spin_unlock_irqrestore(&tp->indirect_lock, flags);
+	spin_unlock_bh(&tp->indirect_lock);
 }
 
 static void tg3_read_mem(struct tg3 *tp, u32 off, u32 *val)
 {
-	unsigned long flags;
-
-	spin_lock_irqsave(&tp->indirect_lock, flags);
+	spin_lock_bh(&tp->indirect_lock);
 	pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, off);
 	pci_read_config_dword(tp->pdev, TG3PCI_MEM_WIN_DATA, val);
 
 	/* Always leave this as zero. */
 	pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, 0);
-	spin_unlock_irqrestore(&tp->indirect_lock, flags);
+	spin_unlock_bh(&tp->indirect_lock);
 }
 
 static void tg3_disable_ints(struct tg3 *tp)
 {
 	tw32(TG3PCI_MISC_HOST_CTRL,
 	     (tp->misc_host_ctrl | MISC_HOST_CTRL_MASK_PCI_INT));
-	tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000001);
+	tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000001);
+	tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
 }
 
 static inline void tg3_cond_int(struct tg3 *tp)
@@ -501,8 +439,9 @@ static void tg3_enable_ints(struct tg3 *tp)
 
 	tw32(TG3PCI_MISC_HOST_CTRL,
 	     (tp->misc_host_ctrl & ~MISC_HOST_CTRL_MASK_PCI_INT));
-	tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-		       (tp->last_tag << 24));
+	tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+		     (tp->last_tag << 24));
+	tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
 	tg3_cond_int(tp);
 }
 
@@ -533,6 +472,8 @@ static inline unsigned int tg3_has_work(struct tg3 *tp)
  */
 static void tg3_restart_ints(struct tg3 *tp)
 {
+	tw32(TG3PCI_MISC_HOST_CTRL,
+		(tp->misc_host_ctrl & ~MISC_HOST_CTRL_MASK_PCI_INT));
 	tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
 		     tp->last_tag << 24);
 	mmiowb();
@@ -3337,8 +3278,9 @@ static irqreturn_t tg3_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 			/* No work, shared interrupt perhaps?  re-enable
 			 * interrupts, and flush that PCI write
 			 */
-			tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+			tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
 			     	0x00000000);
+			tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
 		}
 	} else {	/* shared interrupt */
 		handled = 0;
@@ -3381,8 +3323,9 @@ static irqreturn_t tg3_interrupt_tagged(int irq, void *dev_id, struct pt_regs *r
 			/* no work, shared interrupt perhaps?  re-enable
 			 * interrupts, and flush that PCI write
 			 */
-			tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-				       tp->last_tag << 24);
+			tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+				     tp->last_tag << 24);
+			tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
 		}
 	} else {	/* shared interrupt */
 		handled = 0;
@@ -4273,7 +4216,7 @@ static void tg3_stop_fw(struct tg3 *);
 static int tg3_chip_reset(struct tg3 *tp)
 {
 	u32 val;
-	void (*write_op)(struct tg3 *, u32, u32);
+	u32 flags_save;
 	int i;
 
 	if (!(tp->tg3_flags2 & TG3_FLG2_SUN_570X))
@@ -4285,9 +4228,8 @@ static int tg3_chip_reset(struct tg3 *tp)
 	 * fun things.  So, temporarily disable the 5701
 	 * hardware workaround, while we do the reset.
 	 */
-	write_op = tp->write32;
-	if (write_op == tg3_write_flush_reg32)
-		tp->write32 = tg3_write32;
+	flags_save = tp->tg3_flags;
+	tp->tg3_flags &= ~TG3_FLAG_5701_REG_WRITE_BUG;
 
 	/* do the reset */
 	val = GRC_MISC_CFG_CORECLK_RESET;
@@ -4306,8 +4248,8 @@ static int tg3_chip_reset(struct tg3 *tp)
 		val |= GRC_MISC_CFG_KEEP_GPHY_POWER;
 	tw32(GRC_MISC_CFG, val);
 
-	/* restore 5701 hardware bug workaround write method */
-	tp->write32 = write_op;
+	/* restore 5701 hardware bug workaround flag */
+	tp->tg3_flags = flags_save;
 
 	/* Unfortunately, we have to delay before the PCI read back.
 	 * Some 575X chips even will not respond to a PCI cfg access
@@ -4693,6 +4635,7 @@ static int tg3_load_firmware_cpu(struct tg3 *tp, u32 cpu_base, u32 cpu_scratch_b
 				 int cpu_scratch_size, struct fw_info *info)
 {
 	int err, i;
+	u32 orig_tg3_flags = tp->tg3_flags;
 	void (*write_op)(struct tg3 *, u32, u32);
 
 	if (cpu_base == TX_CPU_BASE &&
@@ -4708,6 +4651,11 @@ static int tg3_load_firmware_cpu(struct tg3 *tp, u32 cpu_base, u32 cpu_scratch_b
 	else
 		write_op = tg3_write_indirect_reg32;
 
+	/* Force use of PCI config space for indirect register
+	 * write calls.
+	 */
+	tp->tg3_flags |= TG3_FLAG_PCIX_TARGET_HWBUG;
+
 	/* It is possible that bootcode is still loading at this point.
 	 * Get the nvram lock first before halting the cpu.
 	 */
@@ -4743,6 +4691,7 @@ static int tg3_load_firmware_cpu(struct tg3 *tp, u32 cpu_base, u32 cpu_scratch_b
 	err = 0;
 
 out:
+	tp->tg3_flags = orig_tg3_flags;
 	return err;
 }
 
@@ -5859,7 +5808,8 @@ static int tg3_reset_hw(struct tg3 *tp)
 	tw32_f(GRC_LOCAL_CTRL, tp->grc_local_ctrl);
 	udelay(100);
 
-	tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0);
+	tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0);
+	tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
 	tp->last_tag = 0;
 
 	if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS)) {
@@ -6248,8 +6198,7 @@ static int tg3_test_interrupt(struct tg3 *tp)
 	       HOSTCC_MODE_NOW);
 
 	for (i = 0; i < 5; i++) {
-		int_mbox = tr32_mailbox(MAILBOX_INTERRUPT_0 +
-					TG3_64BIT_REG_LOW);
+		int_mbox = tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
 		if (int_mbox != 0)
 			break;
 		msleep(10);
@@ -6649,10 +6598,10 @@ static int tg3_open(struct net_device *dev)
 
 	/* Mailboxes */
 	printk("DEBUG: SNDHOST_PROD[%08x%08x] SNDNIC_PROD[%08x%08x]\n",
-	       tr32_mailbox(MAILBOX_SNDHOST_PROD_IDX_0 + 0x0),
-	       tr32_mailbox(MAILBOX_SNDHOST_PROD_IDX_0 + 0x4),
-	       tr32_mailbox(MAILBOX_SNDNIC_PROD_IDX_0 + 0x0),
-	       tr32_mailbox(MAILBOX_SNDNIC_PROD_IDX_0 + 0x4));
+	       tr32(MAILBOX_SNDHOST_PROD_IDX_0 + 0x0),
+	       tr32(MAILBOX_SNDHOST_PROD_IDX_0 + 0x4),
+	       tr32(MAILBOX_SNDNIC_PROD_IDX_0 + 0x0),
+	       tr32(MAILBOX_SNDNIC_PROD_IDX_0 + 0x4));
 
 	/* NIC side send descriptors. */
 	for (i = 0; i < 6; i++) {
@@ -7952,7 +7901,7 @@ static int tg3_test_loopback(struct tg3 *tp)
 	num_pkts++;
 
 	tw32_tx_mbox(MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW, send_idx);
-	tr32_mailbox(MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW);
+	tr32(MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW);
 
 	udelay(10);
 
@@ -9204,6 +9153,14 @@ static int __devinit tg3_is_sun_570X(struct tg3 *tp)
 static int __devinit tg3_get_invariants(struct tg3 *tp)
 {
 	static struct pci_device_id write_reorder_chipsets[] = {
+		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL,
+		             PCI_DEVICE_ID_INTEL_82801AA_8) },
+		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL,
+		             PCI_DEVICE_ID_INTEL_82801AB_8) },
+		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL,
+		             PCI_DEVICE_ID_INTEL_82801BA_11) },
+		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL,
+		             PCI_DEVICE_ID_INTEL_82801BA_6) },
 		{ PCI_DEVICE(PCI_VENDOR_ID_AMD,
 		             PCI_DEVICE_ID_AMD_FE_GATE_700C) },
 		{ },
@@ -9220,7 +9177,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 		tp->tg3_flags2 |= TG3_FLG2_SUN_570X;
 #endif
 
-	/* If we have an AMD 762 chipset, write
+	/* If we have an AMD 762 or Intel ICH/ICH0/ICH2 chipset, write
 	 * reordering to the mailbox registers done by the host
 	 * controller can cause major troubles.  We read back from
 	 * every mailbox register write to force the writes to be
@@ -9258,69 +9215,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 	if (tp->pci_chip_rev_id == CHIPREV_ID_5752_A0_HW)
 		tp->pci_chip_rev_id = CHIPREV_ID_5752_A0;
 
-	/* If we have 5702/03 A1 or A2 on certain ICH chipsets,
-	 * we need to disable memory and use config. cycles
-	 * only to access all registers. The 5702/03 chips
-	 * can mistakenly decode the special cycles from the
-	 * ICH chipsets as memory write cycles, causing corruption
-	 * of register and memory space. Only certain ICH bridges
-	 * will drive special cycles with non-zero data during the
-	 * address phase which can fall within the 5703's address
-	 * range. This is not an ICH bug as the PCI spec allows
-	 * non-zero address during special cycles. However, only
-	 * these ICH bridges are known to drive non-zero addresses
-	 * during special cycles.
-	 *
-	 * Since special cycles do not cross PCI bridges, we only
-	 * enable this workaround if the 5703 is on the secondary
-	 * bus of these ICH bridges.
-	 */
-	if ((tp->pci_chip_rev_id == CHIPREV_ID_5703_A1) ||
-	    (tp->pci_chip_rev_id == CHIPREV_ID_5703_A2)) {
-		static struct tg3_dev_id {
-			u32	vendor;
-			u32	device;
-			u32	rev;
-		} ich_chipsets[] = {
-			{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_8,
-			  PCI_ANY_ID },
-			{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AB_8,
-			  PCI_ANY_ID },
-			{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801BA_11,
-			  0xa },
-			{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801BA_6,
-			  PCI_ANY_ID },
-			{ },
-		};
-		struct tg3_dev_id *pci_id = &ich_chipsets[0];
-		struct pci_dev *bridge = NULL;
-
-		while (pci_id->vendor != 0) {
-			bridge = pci_get_device(pci_id->vendor, pci_id->device,
-						bridge);
-			if (!bridge) {
-				pci_id++;
-				continue;
-			}
-			if (pci_id->rev != PCI_ANY_ID) {
-				u8 rev;
-
-				pci_read_config_byte(bridge, PCI_REVISION_ID,
-						     &rev);
-				if (rev > pci_id->rev)
-					continue;
-			}
-			if (bridge->subordinate &&
-			    (bridge->subordinate->number ==
-			     tp->pdev->bus->number)) {
-
-				tp->tg3_flags2 |= TG3_FLG2_ICH_WORKAROUND;
-				pci_dev_put(bridge);
-				break;
-			}
-		}
-	}
-
 	/* Find msi capability. */
 	if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5780)
 		tp->msi_cap = pci_find_capability(tp->pdev, PCI_CAP_ID_MSI);
@@ -9408,12 +9302,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 		}
 	}
 
-	/* 5700 BX chips need to have their TX producer index mailboxes
-	 * written twice to workaround a bug.
-	 */
-	if (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5700_BX)
-		tp->tg3_flags |= TG3_FLAG_TXD_MBOX_HWBUG;
-
 	/* Back to back register writes can cause problems on this chip,
 	 * the workaround is to read back all reg writes except those to
 	 * mailbox regs.  See tg3_write_indirect_reg32().
@@ -9437,43 +9325,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 		pci_write_config_dword(tp->pdev, TG3PCI_PCISTATE, pci_state_reg);
 	}
 
-	/* Default fast path register access methods */
-	tp->read32 = tg3_read32;
-	tp->write32 = tg3_write32;
-	tp->read32_mbox = tg3_read32;
-	tp->write32_mbox = tg3_write32;
-	tp->write32_tx_mbox = tg3_write32;
-	tp->write32_rx_mbox = tg3_write32;
-
-	/* Various workaround register access methods */
-	if (tp->tg3_flags & TG3_FLAG_PCIX_TARGET_HWBUG)
-		tp->write32 = tg3_write_indirect_reg32;
-	else if (tp->tg3_flags & TG3_FLAG_5701_REG_WRITE_BUG)
-		tp->write32 = tg3_write_flush_reg32;
-
-	if ((tp->tg3_flags & TG3_FLAG_TXD_MBOX_HWBUG) ||
-	    (tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER)) {
-		tp->write32_tx_mbox = tg3_write32_tx_mbox;
-		if (tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER)
-			tp->write32_rx_mbox = tg3_write_flush_reg32;
-	}
-
-	if (tp->tg3_flags2 & TG3_FLG2_ICH_WORKAROUND) {
-		tp->read32 = tg3_read_indirect_reg32;
-		tp->write32 = tg3_write_indirect_reg32;
-		tp->read32_mbox = tg3_read_indirect_mbox;
-		tp->write32_mbox = tg3_write_indirect_mbox;
-		tp->write32_tx_mbox = tg3_write_indirect_mbox;
-		tp->write32_rx_mbox = tg3_write_indirect_mbox;
-
-		iounmap(tp->regs);
-		tp->regs = 0;
-
-		pci_read_config_word(tp->pdev, PCI_COMMAND, &pci_cmd);
-		pci_cmd &= ~PCI_COMMAND_MEMORY;
-		pci_write_config_word(tp->pdev, PCI_COMMAND, pci_cmd);
-	}
-
 	/* Get eeprom hw config before calling tg3_set_power_state().
 	 * In particular, the TG3_FLAG_EEPROM_WRITE_PROT flag must be
 	 * determined before calling tg3_set_power_state() so that
@@ -9688,6 +9539,14 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 	else
 		tp->tg3_flags &= ~TG3_FLAG_POLL_SERDES;
 
+	/* 5700 BX chips need to have their TX producer index mailboxes
+	 * written twice to workaround a bug.
+	 */
+	if (GET_CHIP_REV(tp->pci_chip_rev_id) == CHIPREV_5700_BX)
+		tp->tg3_flags |= TG3_FLAG_TXD_MBOX_HWBUG;
+	else
+		tp->tg3_flags &= ~TG3_FLAG_TXD_MBOX_HWBUG;
+
 	/* It seems all chips can get confused if TX buffers
 	 * straddle the 4GB address boundary in some cases.
 	 */
@@ -10610,10 +10469,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 	return 0;
 
 err_out_iounmap:
-	if (tp->regs) {
-		iounmap(tp->regs);
-		tp->regs = 0;
-	}
+	iounmap(tp->regs);
 
 err_out_free_dev:
 	free_netdev(dev);
@@ -10635,10 +10491,7 @@ static void __devexit tg3_remove_one(struct pci_dev *pdev)
 		struct tg3 *tp = netdev_priv(dev);
 
 		unregister_netdev(dev);
-		if (tp->regs) {
-			iounmap(tp->regs);
-			tp->regs = 0;
-		}
+		iounmap(tp->regs);
 		free_netdev(dev);
 		pci_release_regions(pdev);
 		pci_disable_device(pdev);
diff --git a/trunk/drivers/net/tg3.h b/trunk/drivers/net/tg3.h
index c184b773e585..5c4433c147fa 100644
--- a/trunk/drivers/net/tg3.h
+++ b/trunk/drivers/net/tg3.h
@@ -2049,11 +2049,6 @@ struct tg3 {
 	spinlock_t			lock;
 	spinlock_t			indirect_lock;
 
-	u32				(*read32) (struct tg3 *, u32);
-	void				(*write32) (struct tg3 *, u32, u32);
-	u32				(*read32_mbox) (struct tg3 *, u32);
-	void				(*write32_mbox) (struct tg3 *, u32,
-							 u32);
 	void __iomem			*regs;
 	struct net_device		*dev;
 	struct pci_dev			*pdev;
@@ -2065,8 +2060,6 @@ struct tg3 {
 	u32				msg_enable;
 
 	/* begin "tx thread" cacheline section */
-	void				(*write32_tx_mbox) (struct tg3 *, u32,
-							    u32);
 	u32				tx_prod;
 	u32				tx_cons;
 	u32				tx_pending;
@@ -2078,8 +2071,6 @@ struct tg3 {
 	dma_addr_t			tx_desc_mapping;
 
 	/* begin "rx thread" cacheline section */
-	void				(*write32_rx_mbox) (struct tg3 *, u32,
-							    u32);
 	u32				rx_rcb_ptr;
 	u32				rx_std_ptr;
 	u32				rx_jumbo_ptr;
@@ -2174,7 +2165,6 @@ struct tg3 {
 #define TG3_FLG2_ANY_SERDES		(TG3_FLG2_PHY_SERDES |	\
 					TG3_FLG2_MII_SERDES)
 #define TG3_FLG2_PARALLEL_DETECT	0x01000000
-#define TG3_FLG2_ICH_WORKAROUND		0x02000000
 
 	u32				split_mode_max_reqs;
 #define SPLIT_MODE_5704_MAX_REQ		3
diff --git a/trunk/drivers/net/tulip/Kconfig b/trunk/drivers/net/tulip/Kconfig
index 8c9634a98c11..e2cdaf876201 100644
--- a/trunk/drivers/net/tulip/Kconfig
+++ b/trunk/drivers/net/tulip/Kconfig
@@ -135,18 +135,6 @@ config DM9102
 	  <file:Documentation/networking/net-modules.txt>.  The module will
 	  be called dmfe.
 
-config ULI526X
-	tristate "ULi M526x controller support"
-	depends on NET_TULIP && PCI
-	select CRC32
-	---help---
-	  This driver is for ULi M5261/M5263 10/100M Ethernet Controller
-	  (<http://www.uli.com.tw/>).
-
-	  To compile this driver as a module, choose M here and read
-	  <file:Documentation/networking/net-modules.txt>.  The module will
-	  be called uli526x.
-	  
 config PCMCIA_XIRCOM
 	tristate "Xircom CardBus support (new driver)"
 	depends on NET_TULIP && CARDBUS
diff --git a/trunk/drivers/net/tulip/Makefile b/trunk/drivers/net/tulip/Makefile
index 451090d6fcca..8bb9b4683979 100644
--- a/trunk/drivers/net/tulip/Makefile
+++ b/trunk/drivers/net/tulip/Makefile
@@ -9,7 +9,6 @@ obj-$(CONFIG_WINBOND_840)	+= winbond-840.o
 obj-$(CONFIG_DE2104X)		+= de2104x.o
 obj-$(CONFIG_TULIP)		+= tulip.o
 obj-$(CONFIG_DE4X5)		+= de4x5.o
-obj-$(CONFIG_ULI526X)		+= uli526x.o
 
 # Declare multi-part drivers.
 
diff --git a/trunk/drivers/net/tulip/de2104x.c b/trunk/drivers/net/tulip/de2104x.c
index a22d00198e4d..fc353e348f9a 100644
--- a/trunk/drivers/net/tulip/de2104x.c
+++ b/trunk/drivers/net/tulip/de2104x.c
@@ -1934,7 +1934,7 @@ static int __init de_init_one (struct pci_dev *pdev,
 	struct de_private *de;
 	int rc;
 	void __iomem *regs;
-	unsigned long pciaddr;
+	long pciaddr;
 	static int board_idx = -1;
 
 	board_idx++;
diff --git a/trunk/drivers/net/tulip/media.c b/trunk/drivers/net/tulip/media.c
index f53396fe79c9..e26c31f944bf 100644
--- a/trunk/drivers/net/tulip/media.c
+++ b/trunk/drivers/net/tulip/media.c
@@ -81,6 +81,25 @@ int tulip_mdio_read(struct net_device *dev, int phy_id, int location)
 		return retval & 0xffff;
 	}
 
+	if(tp->chip_id == ULI526X && tp->revision >= 0x40) {
+		int value;
+		int i = 1000;
+		
+		value = ioread32(ioaddr + CSR9);
+		iowrite32(value & 0xFFEFFFFF, ioaddr + CSR9);
+		
+		value = (phy_id << 21) | (location << 16) | 0x08000000;
+		iowrite32(value, ioaddr + CSR10);
+		
+		while(--i > 0) {
+			mdio_delay();
+			if(ioread32(ioaddr + CSR10) & 0x10000000)
+				break;
+		}
+		retval = ioread32(ioaddr + CSR10);
+		spin_unlock_irqrestore(&tp->mii_lock, flags);
+		return retval & 0xFFFF;
+	}
 	/* Establish sync by sending at least 32 logic ones. */
 	for (i = 32; i >= 0; i--) {
 		iowrite32(MDIO_ENB | MDIO_DATA_WRITE1, mdio_addr);
@@ -140,6 +159,23 @@ void tulip_mdio_write(struct net_device *dev, int phy_id, int location, int val)
 		spin_unlock_irqrestore(&tp->mii_lock, flags);
 		return;
 	}
+	if (tp->chip_id == ULI526X && tp->revision >= 0x40) {
+		int value;
+		int i = 1000;
+		
+		value = ioread32(ioaddr + CSR9);
+		iowrite32(value & 0xFFEFFFFF, ioaddr + CSR9);
+		
+		value = (phy_id << 21) | (location << 16) | 0x04000000 | (val & 0xFFFF);
+		iowrite32(value, ioaddr + CSR10);
+		
+		while(--i > 0) {
+			if (ioread32(ioaddr + CSR10) & 0x10000000)
+				break;
+		}
+		spin_unlock_irqrestore(&tp->mii_lock, flags);
+		return;
+	}
 		
 	/* Establish sync by sending 32 logic ones. */
 	for (i = 32; i >= 0; i--) {
diff --git a/trunk/drivers/net/tulip/timer.c b/trunk/drivers/net/tulip/timer.c
index e058a9fbfe88..691568283553 100644
--- a/trunk/drivers/net/tulip/timer.c
+++ b/trunk/drivers/net/tulip/timer.c
@@ -39,6 +39,7 @@ void tulip_timer(unsigned long data)
 	case MX98713:
 	case COMPEX9881:
 	case DM910X:
+	case ULI526X:
 	default: {
 		struct medialeaf *mleaf;
 		unsigned char *p;
diff --git a/trunk/drivers/net/tulip/tulip.h b/trunk/drivers/net/tulip/tulip.h
index 05d2d96f7be2..20346d847d9e 100644
--- a/trunk/drivers/net/tulip/tulip.h
+++ b/trunk/drivers/net/tulip/tulip.h
@@ -88,6 +88,7 @@ enum chips {
 	I21145,
 	DM910X,
 	CONEXANT,
+	ULI526X
 };
 
 
@@ -481,8 +482,11 @@ static inline void tulip_stop_rxtx(struct tulip_private *tp)
 
 static inline void tulip_restart_rxtx(struct tulip_private *tp)
 {
-	tulip_stop_rxtx(tp);
-	udelay(5);
+	if(!(tp->chip_id == ULI526X && 
+		(tp->revision == 0x40 || tp->revision == 0x50))) {
+		tulip_stop_rxtx(tp);
+		udelay(5);
+	}
 	tulip_start_rxtx(tp);
 }
 
diff --git a/trunk/drivers/net/tulip/tulip_core.c b/trunk/drivers/net/tulip/tulip_core.c
index 6266a9a7e6e3..d45d8f56e5b4 100644
--- a/trunk/drivers/net/tulip/tulip_core.c
+++ b/trunk/drivers/net/tulip/tulip_core.c
@@ -199,6 +199,9 @@ struct tulip_chip_table tulip_tbl[] = {
   { "Conexant LANfinity", 256, 0x0001ebef,
 	HAS_MII | HAS_ACPI, tulip_timer },
 
+   /* ULi526X */
+   { "ULi M5261/M5263", 128, 0x0001ebef,
+        HAS_MII | HAS_MEDIA_TABLE | CSR12_IN_SROM | HAS_ACPI, tulip_timer },
 };
 
 
@@ -236,9 +239,10 @@ static struct pci_device_id tulip_pci_tbl[] = {
 	{ 0x1737, 0xAB09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
 	{ 0x1737, 0xAB08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
 	{ 0x17B3, 0xAB08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
+ 	{ 0x10b9, 0x5261, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ULI526X },	/* ALi 1563 integrated ethernet */
+ 	{ 0x10b9, 0x5263, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ULI526X },	/* ALi 1563 integrated ethernet */
 	{ 0x10b7, 0x9300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* 3Com 3CSOHO100B-TX */
 	{ 0x14ea, 0xab08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Planex FNW-3602-TX */
-	{ 0x1414, 0x0002, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
 	{ } /* terminate list */
 };
 MODULE_DEVICE_TABLE(pci, tulip_pci_tbl);
@@ -518,7 +522,7 @@ static void tulip_tx_timeout(struct net_device *dev)
 				   dev->name);
 	} else if (tp->chip_id == DC21140 || tp->chip_id == DC21142
 			   || tp->chip_id == MX98713 || tp->chip_id == COMPEX9881
-			   || tp->chip_id == DM910X) {
+			   || tp->chip_id == DM910X || tp->chip_id == ULI526X) {
 		printk(KERN_WARNING "%s: 21140 transmit timed out, status %8.8x, "
 			   "SIA %8.8x %8.8x %8.8x %8.8x, resetting...\n",
 			   dev->name, ioread32(ioaddr + CSR5), ioread32(ioaddr + CSR12),
@@ -1099,16 +1103,18 @@ static void set_rx_mode(struct net_device *dev)
 			entry = tp->cur_tx++ % TX_RING_SIZE;
 
 			if (entry != 0) {
-				/* Avoid a chip errata by prefixing a dummy entry. */
-				tp->tx_buffers[entry].skb = NULL;
-				tp->tx_buffers[entry].mapping = 0;
-				tp->tx_ring[entry].length =
-					(entry == TX_RING_SIZE-1) ? cpu_to_le32(DESC_RING_WRAP) : 0;
-				tp->tx_ring[entry].buffer1 = 0;
-				/* Must set DescOwned later to avoid race with chip */
-				dummy = entry;
-				entry = tp->cur_tx++ % TX_RING_SIZE;
-
+				/* Avoid a chip errata by prefixing a dummy entry. Don't do
+				   this on the ULI526X as it triggers a different problem */
+				if (!(tp->chip_id == ULI526X && (tp->revision == 0x40 || tp->revision == 0x50))) {
+					tp->tx_buffers[entry].skb = NULL;
+					tp->tx_buffers[entry].mapping = 0;
+					tp->tx_ring[entry].length =
+						(entry == TX_RING_SIZE-1) ? cpu_to_le32(DESC_RING_WRAP) : 0;
+					tp->tx_ring[entry].buffer1 = 0;
+					/* Must set DescOwned later to avoid race with chip */
+					dummy = entry;
+					entry = tp->cur_tx++ % TX_RING_SIZE;
+				}
 			}
 
 			tp->tx_buffers[entry].skb = NULL;
@@ -1229,6 +1235,10 @@ static int tulip_uli_dm_quirk(struct pci_dev *pdev)
 {
 	if (pdev->vendor == 0x1282 && pdev->device == 0x9102)
 		return 1;
+	if (pdev->vendor == 0x10b9 && pdev->device == 0x5261)
+		return 1;
+	if (pdev->vendor == 0x10b9 && pdev->device == 0x5263)
+		return 1;
 	return 0;
 }
 
@@ -1670,6 +1680,7 @@ static int __devinit tulip_init_one (struct pci_dev *pdev,
 	switch (chip_idx) {
 	case DC21140:
 	case DM910X:
+	case ULI526X:
 	default:
 		if (tp->mtable)
 			iowrite32(tp->mtable->csr12dir | 0x100, ioaddr + CSR12);
diff --git a/trunk/drivers/net/tulip/uli526x.c b/trunk/drivers/net/tulip/uli526x.c
deleted file mode 100644
index 5ae22b7bc5ca..000000000000
--- a/trunk/drivers/net/tulip/uli526x.c
+++ /dev/null
@@ -1,1749 +0,0 @@
-/*
-    This program is free software; you can redistribute it and/or
-    modify it under the terms of the GNU General Public License
-    as published by the Free Software Foundation; either version 2
-    of the License, or (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    
-*/
-
-#define DRV_NAME	"uli526x"
-#define DRV_VERSION	"0.9.3"
-#define DRV_RELDATE	"2005-7-29"
-
-#include <linux/module.h>
-
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/timer.h>
-#include <linux/ptrace.h>
-#include <linux/errno.h>
-#include <linux/ioport.h>
-#include <linux/slab.h>
-#include <linux/interrupt.h>
-#include <linux/pci.h>
-#include <linux/init.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/ethtool.h>
-#include <linux/skbuff.h>
-#include <linux/delay.h>
-#include <linux/spinlock.h>
-
-#include <asm/processor.h>
-#include <asm/bitops.h>
-#include <asm/io.h>
-#include <asm/dma.h>
-#include <asm/uaccess.h>
-
-
-/* Board/System/Debug information/definition ---------------- */
-#define PCI_ULI5261_ID  0x526110B9	/* ULi M5261 ID*/
-#define PCI_ULI5263_ID  0x526310B9	/* ULi M5263 ID*/
-
-#define ULI526X_IO_SIZE 0x100
-#define TX_DESC_CNT     0x20            /* Allocated Tx descriptors */
-#define RX_DESC_CNT     0x30            /* Allocated Rx descriptors */
-#define TX_FREE_DESC_CNT (TX_DESC_CNT - 2)	/* Max TX packet count */
-#define TX_WAKE_DESC_CNT (TX_DESC_CNT - 3)	/* TX wakeup count */
-#define DESC_ALL_CNT    (TX_DESC_CNT + RX_DESC_CNT)
-#define TX_BUF_ALLOC    0x600
-#define RX_ALLOC_SIZE   0x620
-#define ULI526X_RESET    1
-#define CR0_DEFAULT     0
-#define CR6_DEFAULT     0x22200000
-#define CR7_DEFAULT     0x180c1
-#define CR15_DEFAULT    0x06            /* TxJabber RxWatchdog */
-#define TDES0_ERR_MASK  0x4302          /* TXJT, LC, EC, FUE */
-#define MAX_PACKET_SIZE 1514
-#define ULI5261_MAX_MULTICAST 14
-#define RX_COPY_SIZE	100
-#define MAX_CHECK_PACKET 0x8000
-
-#define ULI526X_10MHF      0
-#define ULI526X_100MHF     1
-#define ULI526X_10MFD      4
-#define ULI526X_100MFD     5
-#define ULI526X_AUTO       8
-
-#define ULI526X_TXTH_72	0x400000	/* TX TH 72 byte */
-#define ULI526X_TXTH_96	0x404000	/* TX TH 96 byte */
-#define ULI526X_TXTH_128	0x0000		/* TX TH 128 byte */
-#define ULI526X_TXTH_256	0x4000		/* TX TH 256 byte */
-#define ULI526X_TXTH_512	0x8000		/* TX TH 512 byte */
-#define ULI526X_TXTH_1K	0xC000		/* TX TH 1K  byte */
-
-#define ULI526X_TIMER_WUT  (jiffies + HZ * 1)/* timer wakeup time : 1 second */
-#define ULI526X_TX_TIMEOUT ((16*HZ)/2)	/* tx packet time-out time 8 s" */
-#define ULI526X_TX_KICK 	(4*HZ/2)	/* tx packet Kick-out time 2 s" */
-
-#define ULI526X_DBUG(dbug_now, msg, value) if (uli526x_debug || (dbug_now)) printk(KERN_ERR DRV_NAME ": %s %lx\n", (msg), (long) (value))
-
-#define SHOW_MEDIA_TYPE(mode) printk(KERN_ERR DRV_NAME ": Change Speed to %sMhz %s duplex\n",mode & 1 ?"100":"10", mode & 4 ? "full":"half");
-
-
-/* CR9 definition: SROM/MII */
-#define CR9_SROM_READ   0x4800
-#define CR9_SRCS        0x1
-#define CR9_SRCLK       0x2
-#define CR9_CRDOUT      0x8
-#define SROM_DATA_0     0x0
-#define SROM_DATA_1     0x4
-#define PHY_DATA_1      0x20000
-#define PHY_DATA_0      0x00000
-#define MDCLKH          0x10000
-
-#define PHY_POWER_DOWN	0x800
-
-#define SROM_V41_CODE   0x14
-
-#define SROM_CLK_WRITE(data, ioaddr)					\
-		outl(data|CR9_SROM_READ|CR9_SRCS,ioaddr);		\
-		udelay(5);						\
-		outl(data|CR9_SROM_READ|CR9_SRCS|CR9_SRCLK,ioaddr);	\
-		udelay(5);						\
-		outl(data|CR9_SROM_READ|CR9_SRCS,ioaddr);		\
-		udelay(5);
-
-/* Structure/enum declaration ------------------------------- */
-struct tx_desc {
-        u32 tdes0, tdes1, tdes2, tdes3; /* Data for the card */
-        char *tx_buf_ptr;               /* Data for us */
-        struct tx_desc *next_tx_desc;
-} __attribute__(( aligned(32) ));
-
-struct rx_desc {
-	u32 rdes0, rdes1, rdes2, rdes3; /* Data for the card */
-	struct sk_buff *rx_skb_ptr;	/* Data for us */
-	struct rx_desc *next_rx_desc;
-} __attribute__(( aligned(32) ));
-
-struct uli526x_board_info {
-	u32 chip_id;			/* Chip vendor/Device ID */
-	struct net_device *next_dev;	/* next device */
-	struct pci_dev *pdev;		/* PCI device */
-	spinlock_t lock;
-
-	long ioaddr;			/* I/O base address */
-	u32 cr0_data;
-	u32 cr5_data;
-	u32 cr6_data;
-	u32 cr7_data;
-	u32 cr15_data;
-
-	/* pointer for memory physical address */
-	dma_addr_t buf_pool_dma_ptr;	/* Tx buffer pool memory */
-	dma_addr_t buf_pool_dma_start;	/* Tx buffer pool align dword */
-	dma_addr_t desc_pool_dma_ptr;	/* descriptor pool memory */
-	dma_addr_t first_tx_desc_dma;
-	dma_addr_t first_rx_desc_dma;
-
-	/* descriptor pointer */
-	unsigned char *buf_pool_ptr;	/* Tx buffer pool memory */
-	unsigned char *buf_pool_start;	/* Tx buffer pool align dword */
-	unsigned char *desc_pool_ptr;	/* descriptor pool memory */
-	struct tx_desc *first_tx_desc;
-	struct tx_desc *tx_insert_ptr;
-	struct tx_desc *tx_remove_ptr;
-	struct rx_desc *first_rx_desc;
-	struct rx_desc *rx_insert_ptr;
-	struct rx_desc *rx_ready_ptr;	/* packet come pointer */
-	unsigned long tx_packet_cnt;	/* transmitted packet count */
-	unsigned long rx_avail_cnt;	/* available rx descriptor count */
-	unsigned long interval_rx_cnt;	/* rx packet count a callback time */
-
-	u16 dbug_cnt;
-	u16 NIC_capability;		/* NIC media capability */
-	u16 PHY_reg4;			/* Saved Phyxcer register 4 value */
-
-	u8 media_mode;			/* user specify media mode */
-	u8 op_mode;			/* real work media mode */
-	u8 phy_addr;
-	u8 link_failed;			/* Ever link failed */
-	u8 wait_reset;			/* Hardware failed, need to reset */
-	struct timer_list timer;
-
-	/* System defined statistic counter */
-	struct net_device_stats stats;
-
-	/* Driver defined statistic counter */
-	unsigned long tx_fifo_underrun;
-	unsigned long tx_loss_carrier;
-	unsigned long tx_no_carrier;
-	unsigned long tx_late_collision;
-	unsigned long tx_excessive_collision;
-	unsigned long tx_jabber_timeout;
-	unsigned long reset_count;
-	unsigned long reset_cr8;
-	unsigned long reset_fatal;
-	unsigned long reset_TXtimeout;
-
-	/* NIC SROM data */
-	unsigned char srom[128];
-	u8 init;	
-};
-
-enum uli526x_offsets {
-	DCR0 = 0x00, DCR1 = 0x08, DCR2 = 0x10, DCR3 = 0x18, DCR4 = 0x20,
-	DCR5 = 0x28, DCR6 = 0x30, DCR7 = 0x38, DCR8 = 0x40, DCR9 = 0x48,
-	DCR10 = 0x50, DCR11 = 0x58, DCR12 = 0x60, DCR13 = 0x68, DCR14 = 0x70,
-	DCR15 = 0x78
-};
-
-enum uli526x_CR6_bits {
-	CR6_RXSC = 0x2, CR6_PBF = 0x8, CR6_PM = 0x40, CR6_PAM = 0x80,
-	CR6_FDM = 0x200, CR6_TXSC = 0x2000, CR6_STI = 0x100000,
-	CR6_SFT = 0x200000, CR6_RXA = 0x40000000, CR6_NO_PURGE = 0x20000000
-};
-
-/* Global variable declaration ----------------------------- */
-static int __devinitdata printed_version;
-static char version[] __devinitdata =
-	KERN_INFO DRV_NAME ": ULi M5261/M5263 net driver, version "
-	DRV_VERSION " (" DRV_RELDATE ")\n";
-
-static int uli526x_debug;
-static unsigned char uli526x_media_mode = ULI526X_AUTO;
-static u32 uli526x_cr6_user_set;
-
-/* For module input parameter */
-static int debug;
-static u32 cr6set;
-static unsigned char mode = 8;
-
-/* function declaration ------------------------------------- */
-static int uli526x_open(struct net_device *);
-static int uli526x_start_xmit(struct sk_buff *, struct net_device *);
-static int uli526x_stop(struct net_device *);
-static struct net_device_stats * uli526x_get_stats(struct net_device *);
-static void uli526x_set_filter_mode(struct net_device *);
-static struct ethtool_ops netdev_ethtool_ops;
-static u16 read_srom_word(long, int);
-static irqreturn_t uli526x_interrupt(int, void *, struct pt_regs *);
-static void uli526x_descriptor_init(struct uli526x_board_info *, unsigned long);
-static void allocate_rx_buffer(struct uli526x_board_info *);
-static void update_cr6(u32, unsigned long);
-static void send_filter_frame(struct net_device *, int);
-static u16 phy_read(unsigned long, u8, u8, u32);
-static u16 phy_readby_cr10(unsigned long, u8, u8);
-static void phy_write(unsigned long, u8, u8, u16, u32);
-static void phy_writeby_cr10(unsigned long, u8, u8, u16);
-static void phy_write_1bit(unsigned long, u32, u32);
-static u16 phy_read_1bit(unsigned long, u32);
-static u8 uli526x_sense_speed(struct uli526x_board_info *);
-static void uli526x_process_mode(struct uli526x_board_info *);
-static void uli526x_timer(unsigned long);
-static void uli526x_rx_packet(struct net_device *, struct uli526x_board_info *);
-static void uli526x_free_tx_pkt(struct net_device *, struct uli526x_board_info *);
-static void uli526x_reuse_skb(struct uli526x_board_info *, struct sk_buff *);
-static void uli526x_dynamic_reset(struct net_device *);
-static void uli526x_free_rxbuffer(struct uli526x_board_info *);
-static void uli526x_init(struct net_device *);
-static void uli526x_set_phyxcer(struct uli526x_board_info *);
-
-/* ULI526X network board routine ---------------------------- */
-
-/*
- *	Search ULI526X board, allocate space and register it
- */
-
-static int __devinit uli526x_init_one (struct pci_dev *pdev,
-				    const struct pci_device_id *ent)
-{
-	struct uli526x_board_info *db;	/* board information structure */
-	struct net_device *dev;
-	int i, err;
-	
-	ULI526X_DBUG(0, "uli526x_init_one()", 0);
-
-	if (!printed_version++)
-		printk(version);
-
-	/* Init network device */
-	dev = alloc_etherdev(sizeof(*db));
-	if (dev == NULL)
-		return -ENOMEM;
-	SET_MODULE_OWNER(dev);
-	SET_NETDEV_DEV(dev, &pdev->dev);
-
-	if (pci_set_dma_mask(pdev, DMA_32BIT_MASK)) {
-		printk(KERN_WARNING DRV_NAME ": 32-bit PCI DMA not available.\n");
-		err = -ENODEV;
-		goto err_out_free;
-	}
-
-	/* Enable Master/IO access, Disable memory access */
-	err = pci_enable_device(pdev);
-	if (err)
-		goto err_out_free;
-
-	if (!pci_resource_start(pdev, 0)) {
-		printk(KERN_ERR DRV_NAME ": I/O base is zero\n");
-		err = -ENODEV;
-		goto err_out_disable;
-	}
-
-	if (pci_resource_len(pdev, 0) < (ULI526X_IO_SIZE) ) {
-		printk(KERN_ERR DRV_NAME ": Allocated I/O size too small\n");
-		err = -ENODEV;
-		goto err_out_disable;
-	}
-
-	if (pci_request_regions(pdev, DRV_NAME)) {
-		printk(KERN_ERR DRV_NAME ": Failed to request PCI regions\n");
-		err = -ENODEV;
-		goto err_out_disable;
-	}
-
-	/* Init system & device */
-	db = netdev_priv(dev);
-
-	/* Allocate Tx/Rx descriptor memory */
-	db->desc_pool_ptr = pci_alloc_consistent(pdev, sizeof(struct tx_desc) * DESC_ALL_CNT + 0x20, &db->desc_pool_dma_ptr);
-	if(db->desc_pool_ptr == NULL)
-	{
-		err = -ENOMEM;
-		goto err_out_nomem;
-	}
-	db->buf_pool_ptr = pci_alloc_consistent(pdev, TX_BUF_ALLOC * TX_DESC_CNT + 4, &db->buf_pool_dma_ptr);
-	if(db->buf_pool_ptr == NULL)
-	{
-		err = -ENOMEM;
-		goto err_out_nomem;
-	}
-	
-	db->first_tx_desc = (struct tx_desc *) db->desc_pool_ptr;
-	db->first_tx_desc_dma = db->desc_pool_dma_ptr;
-	db->buf_pool_start = db->buf_pool_ptr;
-	db->buf_pool_dma_start = db->buf_pool_dma_ptr;
-
-	db->chip_id = ent->driver_data;
-	db->ioaddr = pci_resource_start(pdev, 0);
-	
-	db->pdev = pdev;
-	db->init = 1;
-	
-	dev->base_addr = db->ioaddr;
-	dev->irq = pdev->irq;
-	pci_set_drvdata(pdev, dev);
-	
-	/* Register some necessary functions */
-	dev->open = &uli526x_open;
-	dev->hard_start_xmit = &uli526x_start_xmit;
-	dev->stop = &uli526x_stop;
-	dev->get_stats = &uli526x_get_stats;
-	dev->set_multicast_list = &uli526x_set_filter_mode;
-	dev->ethtool_ops = &netdev_ethtool_ops;
-	spin_lock_init(&db->lock);
-
-		
-	/* read 64 word srom data */
-	for (i = 0; i < 64; i++)
-		((u16 *) db->srom)[i] = cpu_to_le16(read_srom_word(db->ioaddr, i));
-
-	/* Set Node address */
-	if(((u16 *) db->srom)[0] == 0xffff || ((u16 *) db->srom)[0] == 0)		/* SROM absent, so read MAC address from ID Table */
-	{
-		outl(0x10000, db->ioaddr + DCR0);	//Diagnosis mode
-		outl(0x1c0, db->ioaddr + DCR13);	//Reset dianostic pointer port
-		outl(0, db->ioaddr + DCR14);		//Clear reset port
-		outl(0x10, db->ioaddr + DCR14);		//Reset ID Table pointer
-		outl(0, db->ioaddr + DCR14);		//Clear reset port
-		outl(0, db->ioaddr + DCR13);		//Clear CR13
-		outl(0x1b0, db->ioaddr + DCR13);	//Select ID Table access port
-		//Read MAC address from CR14
-		for (i = 0; i < 6; i++)
-			dev->dev_addr[i] = inl(db->ioaddr + DCR14);
-		//Read end
-		outl(0, db->ioaddr + DCR13);	//Clear CR13
-		outl(0, db->ioaddr + DCR0);		//Clear CR0
-		udelay(10);
-	}
-	else		/*Exist SROM*/
-	{
-		for (i = 0; i < 6; i++)
-			dev->dev_addr[i] = db->srom[20 + i];
-	}
-	err = register_netdev (dev);
-	if (err)
-		goto err_out_res;
-
-	printk(KERN_INFO "%s: ULi M%04lx at pci%s,",dev->name,ent->driver_data >> 16,pci_name(pdev));
-	
-	for (i = 0; i < 6; i++)
-		printk("%c%02x", i ? ':' : ' ', dev->dev_addr[i]);
-	printk(", irq %d.\n", dev->irq);
-
-	pci_set_master(pdev);
-
-	return 0;
-
-err_out_res:
-	pci_release_regions(pdev);
-err_out_nomem:
-	if(db->desc_pool_ptr)
-		pci_free_consistent(pdev, sizeof(struct tx_desc) * DESC_ALL_CNT + 0x20,
-			db->desc_pool_ptr, db->desc_pool_dma_ptr);
-			
-	if(db->buf_pool_ptr != NULL)
-		pci_free_consistent(pdev, TX_BUF_ALLOC * TX_DESC_CNT + 4,
-			db->buf_pool_ptr, db->buf_pool_dma_ptr);
-err_out_disable:
-	pci_disable_device(pdev);
-err_out_free:
-	pci_set_drvdata(pdev, NULL);
-	free_netdev(dev);
-
-	return err;
-}
-
-
-static void __devexit uli526x_remove_one (struct pci_dev *pdev)
-{
-	struct net_device *dev = pci_get_drvdata(pdev);
-	struct uli526x_board_info *db = netdev_priv(dev);
-
-	ULI526X_DBUG(0, "uli526x_remove_one()", 0);
-
-	pci_free_consistent(db->pdev, sizeof(struct tx_desc) *
-				DESC_ALL_CNT + 0x20, db->desc_pool_ptr,
- 				db->desc_pool_dma_ptr);
-	pci_free_consistent(db->pdev, TX_BUF_ALLOC * TX_DESC_CNT + 4,
-				db->buf_pool_ptr, db->buf_pool_dma_ptr);
-	unregister_netdev(dev);
-	pci_release_regions(pdev);
-	free_netdev(dev);	/* free board information */
-	pci_set_drvdata(pdev, NULL);
-	pci_disable_device(pdev);
-	ULI526X_DBUG(0, "uli526x_remove_one() exit", 0);
-}
-
-
-/*
- *	Open the interface.
- *	The interface is opened whenever "ifconfig" activates it.
- */
-
-static int uli526x_open(struct net_device *dev)
-{
-	int ret;
-	struct uli526x_board_info *db = netdev_priv(dev);
-	
-	ULI526X_DBUG(0, "uli526x_open", 0);
-
-	ret = request_irq(dev->irq, &uli526x_interrupt, SA_SHIRQ, dev->name, dev);
-	if (ret)
-		return ret;
-
-	/* system variable init */
-	db->cr6_data = CR6_DEFAULT | uli526x_cr6_user_set;
-	db->tx_packet_cnt = 0;
-	db->rx_avail_cnt = 0;
-	db->link_failed = 1;
-	netif_carrier_off(dev);
-	db->wait_reset = 0;
-
-	db->NIC_capability = 0xf;	/* All capability*/
-	db->PHY_reg4 = 0x1e0;
-
-	/* CR6 operation mode decision */
-	db->cr6_data |= ULI526X_TXTH_256;
-	db->cr0_data = CR0_DEFAULT;
-	
-	/* Initialize ULI526X board */
-	uli526x_init(dev);
-
-	/* Active System Interface */
-	netif_wake_queue(dev);
-
-	/* set and active a timer process */
-	init_timer(&db->timer);
-	db->timer.expires = ULI526X_TIMER_WUT + HZ * 2;
-	db->timer.data = (unsigned long)dev;
-	db->timer.function = &uli526x_timer;
-	add_timer(&db->timer);
-
-	return 0;
-}
-
-
-/*	Initialize ULI526X board
- *	Reset ULI526X board
- *	Initialize TX/Rx descriptor chain structure
- *	Send the set-up frame
- *	Enable Tx/Rx machine
- */
-
-static void uli526x_init(struct net_device *dev)
-{
-	struct uli526x_board_info *db = netdev_priv(dev);
-	unsigned long ioaddr = db->ioaddr;
-	u8	phy_tmp;
-	u16	phy_value;
-	u16 phy_reg_reset;
-
-	ULI526X_DBUG(0, "uli526x_init()", 0);
-
-	/* Reset M526x MAC controller */
-	outl(ULI526X_RESET, ioaddr + DCR0);	/* RESET MAC */
-	udelay(100);
-	outl(db->cr0_data, ioaddr + DCR0);
-	udelay(5);
-
-	/* Phy addr : In some boards,M5261/M5263 phy address != 1 */
-	db->phy_addr = 1;
-	for(phy_tmp=0;phy_tmp<32;phy_tmp++)
-	{
-		phy_value=phy_read(db->ioaddr,phy_tmp,3,db->chip_id);//peer add
-		if(phy_value != 0xffff&&phy_value!=0)
-		{
-			db->phy_addr = phy_tmp;
-			break;
-		}
-	}
-	if(phy_tmp == 32)
-		printk(KERN_WARNING "Can not find the phy address!!!");
-	/* Parser SROM and media mode */
-	db->media_mode = uli526x_media_mode;
-
-	/* Phyxcer capability setting */
-	phy_reg_reset = phy_read(db->ioaddr, db->phy_addr, 0, db->chip_id);
-	phy_reg_reset = (phy_reg_reset | 0x8000);
-	phy_write(db->ioaddr, db->phy_addr, 0, phy_reg_reset, db->chip_id);
-	udelay(500);
-
-	/* Process Phyxcer Media Mode */
-	uli526x_set_phyxcer(db);
-
-	/* Media Mode Process */
-	if ( !(db->media_mode & ULI526X_AUTO) )
-		db->op_mode = db->media_mode; 	/* Force Mode */
-
-	/* Initialize Transmit/Receive decriptor and CR3/4 */
-	uli526x_descriptor_init(db, ioaddr);
-
-	/* Init CR6 to program M526X operation */
-	update_cr6(db->cr6_data, ioaddr);
-
-	/* Send setup frame */
-	send_filter_frame(dev, dev->mc_count);	/* M5261/M5263 */
-
-	/* Init CR7, interrupt active bit */
-	db->cr7_data = CR7_DEFAULT;
-	outl(db->cr7_data, ioaddr + DCR7);
-
-	/* Init CR15, Tx jabber and Rx watchdog timer */
-	outl(db->cr15_data, ioaddr + DCR15);
-
-	/* Enable ULI526X Tx/Rx function */
-	db->cr6_data |= CR6_RXSC | CR6_TXSC;
-	update_cr6(db->cr6_data, ioaddr);
-}
-
-
-/*
- *	Hardware start transmission.
- *	Send a packet to media from the upper layer.
- */
-
-static int uli526x_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	struct uli526x_board_info *db = netdev_priv(dev);
-	struct tx_desc *txptr;
-	unsigned long flags;
-
-	ULI526X_DBUG(0, "uli526x_start_xmit", 0);
-
-	/* Resource flag check */
-	netif_stop_queue(dev);
-
-	/* Too large packet check */
-	if (skb->len > MAX_PACKET_SIZE) {
-		printk(KERN_ERR DRV_NAME ": big packet = %d\n", (u16)skb->len);
-		dev_kfree_skb(skb);
-		return 0;
-	}
-
-	spin_lock_irqsave(&db->lock, flags);
-
-	/* No Tx resource check, it never happen nromally */
-	if (db->tx_packet_cnt >= TX_FREE_DESC_CNT) {
-		spin_unlock_irqrestore(&db->lock, flags);
-		printk(KERN_ERR DRV_NAME ": No Tx resource %ld\n", db->tx_packet_cnt);
-		return 1;
-	}
-
-	/* Disable NIC interrupt */
-	outl(0, dev->base_addr + DCR7);
-
-	/* transmit this packet */
-	txptr = db->tx_insert_ptr;
-	memcpy(txptr->tx_buf_ptr, skb->data, skb->len);
-	txptr->tdes1 = cpu_to_le32(0xe1000000 | skb->len);
-
-	/* Point to next transmit free descriptor */
-	db->tx_insert_ptr = txptr->next_tx_desc;
-
-	/* Transmit Packet Process */
-	if ( (db->tx_packet_cnt < TX_DESC_CNT) ) {
-		txptr->tdes0 = cpu_to_le32(0x80000000);	/* Set owner bit */
-		db->tx_packet_cnt++;			/* Ready to send */
-		outl(0x1, dev->base_addr + DCR1);	/* Issue Tx polling */
-		dev->trans_start = jiffies;		/* saved time stamp */
-	}
-
-	/* Tx resource check */
-	if ( db->tx_packet_cnt < TX_FREE_DESC_CNT )
-		netif_wake_queue(dev);
-
-	/* Restore CR7 to enable interrupt */
-	spin_unlock_irqrestore(&db->lock, flags);
-	outl(db->cr7_data, dev->base_addr + DCR7);
-	
-	/* free this SKB */
-	dev_kfree_skb(skb);
-
-	return 0;
-}
-
-
-/*
- *	Stop the interface.
- *	The interface is stopped when it is brought.
- */
-
-static int uli526x_stop(struct net_device *dev)
-{
-	struct uli526x_board_info *db = netdev_priv(dev);
-	unsigned long ioaddr = dev->base_addr;
-
-	ULI526X_DBUG(0, "uli526x_stop", 0);
-
-	/* disable system */
-	netif_stop_queue(dev);
-
-	/* deleted timer */
-	del_timer_sync(&db->timer);
-
-	/* Reset & stop ULI526X board */
-	outl(ULI526X_RESET, ioaddr + DCR0);
-	udelay(5);
-	phy_write(db->ioaddr, db->phy_addr, 0, 0x8000, db->chip_id);
-
-	/* free interrupt */
-	free_irq(dev->irq, dev);
-
-	/* free allocated rx buffer */
-	uli526x_free_rxbuffer(db);
-
-#if 0
-	/* show statistic counter */
-	printk(DRV_NAME ": FU:%lx EC:%lx LC:%lx NC:%lx LOC:%lx TXJT:%lx RESET:%lx RCR8:%lx FAL:%lx TT:%lx\n",
-		db->tx_fifo_underrun, db->tx_excessive_collision,
-		db->tx_late_collision, db->tx_no_carrier, db->tx_loss_carrier,
-		db->tx_jabber_timeout, db->reset_count, db->reset_cr8,
-		db->reset_fatal, db->reset_TXtimeout);
-#endif
-
-	return 0;
-}
-
-
-/*
- *	M5261/M5263 insterrupt handler
- *	receive the packet to upper layer, free the transmitted packet
- */
-
-static irqreturn_t uli526x_interrupt(int irq, void *dev_id, struct pt_regs *regs)
-{
-	struct net_device *dev = dev_id;
-	struct uli526x_board_info *db = netdev_priv(dev);
-	unsigned long ioaddr = dev->base_addr;
-	unsigned long flags;
-
-	if (!dev) {
-		ULI526X_DBUG(1, "uli526x_interrupt() without DEVICE arg", 0);
-		return IRQ_NONE;
-	}
-
-	spin_lock_irqsave(&db->lock, flags);
-	outl(0, ioaddr + DCR7);
-
-	/* Got ULI526X status */
-	db->cr5_data = inl(ioaddr + DCR5);
-	outl(db->cr5_data, ioaddr + DCR5);
-	if ( !(db->cr5_data & 0x180c1) ) {
-		spin_unlock_irqrestore(&db->lock, flags);
-		outl(db->cr7_data, ioaddr + DCR7);
-		return IRQ_HANDLED;
-	}
-
-	/* Check system status */
-	if (db->cr5_data & 0x2000) {
-		/* system bus error happen */
-		ULI526X_DBUG(1, "System bus error happen. CR5=", db->cr5_data);
-		db->reset_fatal++;
-		db->wait_reset = 1;	/* Need to RESET */
-		spin_unlock_irqrestore(&db->lock, flags);
-		return IRQ_HANDLED;
-	}
-
-	 /* Received the coming packet */
-	if ( (db->cr5_data & 0x40) && db->rx_avail_cnt )
-		uli526x_rx_packet(dev, db);
-
-	/* reallocate rx descriptor buffer */
-	if (db->rx_avail_cnt<RX_DESC_CNT)
-		allocate_rx_buffer(db);
-
-	/* Free the transmitted descriptor */
-	if ( db->cr5_data & 0x01)
-		uli526x_free_tx_pkt(dev, db);
-
-	/* Restore CR7 to enable interrupt mask */
-	outl(db->cr7_data, ioaddr + DCR7);
-
-	spin_unlock_irqrestore(&db->lock, flags);
-	return IRQ_HANDLED;
-}
-
-
-/*
- *	Free TX resource after TX complete
- */
-
-static void uli526x_free_tx_pkt(struct net_device *dev, struct uli526x_board_info * db)
-{
-	struct tx_desc *txptr;
-	u32 tdes0;
-
-	txptr = db->tx_remove_ptr;
-	while(db->tx_packet_cnt) {
-		tdes0 = le32_to_cpu(txptr->tdes0);
-		/* printk(DRV_NAME ": tdes0=%x\n", tdes0); */
-		if (tdes0 & 0x80000000)
-			break;
-
-		/* A packet sent completed */
-		db->tx_packet_cnt--;
-		db->stats.tx_packets++;
-
-		/* Transmit statistic counter */
-		if ( tdes0 != 0x7fffffff ) {
-			/* printk(DRV_NAME ": tdes0=%x\n", tdes0); */
-			db->stats.collisions += (tdes0 >> 3) & 0xf;
-			db->stats.tx_bytes += le32_to_cpu(txptr->tdes1) & 0x7ff;
-			if (tdes0 & TDES0_ERR_MASK) {
-				db->stats.tx_errors++;
-				if (tdes0 & 0x0002) {	/* UnderRun */
-					db->tx_fifo_underrun++;
-					if ( !(db->cr6_data & CR6_SFT) ) {
-						db->cr6_data = db->cr6_data | CR6_SFT;
-						update_cr6(db->cr6_data, db->ioaddr);
-					}
-				}
-				if (tdes0 & 0x0100)
-					db->tx_excessive_collision++;
-				if (tdes0 & 0x0200)
-					db->tx_late_collision++;
-				if (tdes0 & 0x0400)
-					db->tx_no_carrier++;
-				if (tdes0 & 0x0800)
-					db->tx_loss_carrier++;
-				if (tdes0 & 0x4000)
-					db->tx_jabber_timeout++;
-			}
-		}
-
-    		txptr = txptr->next_tx_desc;
-	}/* End of while */
-
-	/* Update TX remove pointer to next */
-	db->tx_remove_ptr = txptr;
-
-	/* Resource available check */
-	if ( db->tx_packet_cnt < TX_WAKE_DESC_CNT )
-		netif_wake_queue(dev);	/* Active upper layer, send again */
-}
-
-
-/*
- *	Receive the come packet and pass to upper layer
- */
-
-static void uli526x_rx_packet(struct net_device *dev, struct uli526x_board_info * db)
-{
-	struct rx_desc *rxptr;
-	struct sk_buff *skb;
-	int rxlen;
-	u32 rdes0;
-	
-	rxptr = db->rx_ready_ptr;
-
-	while(db->rx_avail_cnt) {
-		rdes0 = le32_to_cpu(rxptr->rdes0);
-		if (rdes0 & 0x80000000)	/* packet owner check */
-		{
-			break;
-		}
-
-		db->rx_avail_cnt--;
-		db->interval_rx_cnt++;
-
-		pci_unmap_single(db->pdev, le32_to_cpu(rxptr->rdes2), RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE);
-		if ( (rdes0 & 0x300) != 0x300) {
-			/* A packet without First/Last flag */
-			/* reuse this SKB */
-			ULI526X_DBUG(0, "Reuse SK buffer, rdes0", rdes0);
-			uli526x_reuse_skb(db, rxptr->rx_skb_ptr);
-		} else {
-			/* A packet with First/Last flag */
-			rxlen = ( (rdes0 >> 16) & 0x3fff) - 4;
-
-			/* error summary bit check */
-			if (rdes0 & 0x8000) {
-				/* This is a error packet */
-				//printk(DRV_NAME ": rdes0: %lx\n", rdes0);
-				db->stats.rx_errors++;
-				if (rdes0 & 1)
-					db->stats.rx_fifo_errors++;
-				if (rdes0 & 2)
-					db->stats.rx_crc_errors++;
-				if (rdes0 & 0x80)
-					db->stats.rx_length_errors++;
-			}
-
-			if ( !(rdes0 & 0x8000) ||
-				((db->cr6_data & CR6_PM) && (rxlen>6)) ) {
-				skb = rxptr->rx_skb_ptr;
-		
-				/* Good packet, send to upper layer */
-				/* Shorst packet used new SKB */
-				if ( (rxlen < RX_COPY_SIZE) &&
-					( (skb = dev_alloc_skb(rxlen + 2) )
-					!= NULL) ) {
-					/* size less than COPY_SIZE, allocate a rxlen SKB */
-					skb->dev = dev;
-					skb_reserve(skb, 2); /* 16byte align */
-					memcpy(skb_put(skb, rxlen), rxptr->rx_skb_ptr->tail, rxlen);
-					uli526x_reuse_skb(db, rxptr->rx_skb_ptr);
-				} else {
-					skb->dev = dev;
-					skb_put(skb, rxlen);
-				}
-				skb->protocol = eth_type_trans(skb, dev);
-				netif_rx(skb);
-				dev->last_rx = jiffies;
-				db->stats.rx_packets++;
-				db->stats.rx_bytes += rxlen;
-				
-			} else {
-				/* Reuse SKB buffer when the packet is error */
-				ULI526X_DBUG(0, "Reuse SK buffer, rdes0", rdes0);
-				uli526x_reuse_skb(db, rxptr->rx_skb_ptr);
-			}
-		}
-
-		rxptr = rxptr->next_rx_desc;
-	}
-
-	db->rx_ready_ptr = rxptr;
-}
-
-
-/*
- *	Get statistics from driver.
- */
-
-static struct net_device_stats * uli526x_get_stats(struct net_device *dev)
-{
-	struct uli526x_board_info *db = netdev_priv(dev);
-
-	ULI526X_DBUG(0, "uli526x_get_stats", 0);
-	return &db->stats;
-}
-
-
-/*
- * Set ULI526X multicast address
- */
-
-static void uli526x_set_filter_mode(struct net_device * dev)
-{
-	struct uli526x_board_info *db = dev->priv;
-	unsigned long flags;
-
-	ULI526X_DBUG(0, "uli526x_set_filter_mode()", 0);
-	spin_lock_irqsave(&db->lock, flags);
-
-	if (dev->flags & IFF_PROMISC) {
-		ULI526X_DBUG(0, "Enable PROM Mode", 0);
-		db->cr6_data |= CR6_PM | CR6_PBF;
-		update_cr6(db->cr6_data, db->ioaddr);
-		spin_unlock_irqrestore(&db->lock, flags);
-		return;
-	}
-
-	if (dev->flags & IFF_ALLMULTI || dev->mc_count > ULI5261_MAX_MULTICAST) {
-		ULI526X_DBUG(0, "Pass all multicast address", dev->mc_count);
-		db->cr6_data &= ~(CR6_PM | CR6_PBF);
-		db->cr6_data |= CR6_PAM;
-		spin_unlock_irqrestore(&db->lock, flags);
-		return;
-	}
-
-	ULI526X_DBUG(0, "Set multicast address", dev->mc_count);
-	send_filter_frame(dev, dev->mc_count); 	/* M5261/M5263 */
-	spin_unlock_irqrestore(&db->lock, flags);
-}
-
-static void
-ULi_ethtool_gset(struct uli526x_board_info *db, struct ethtool_cmd *ecmd)
-{
-	ecmd->supported = (SUPPORTED_10baseT_Half |
-	                   SUPPORTED_10baseT_Full |
-	                   SUPPORTED_100baseT_Half |
-	                   SUPPORTED_100baseT_Full |
-	                   SUPPORTED_Autoneg |
-	                   SUPPORTED_MII);
-		
-	ecmd->advertising = (ADVERTISED_10baseT_Half |
-	                   ADVERTISED_10baseT_Full |
-	                   ADVERTISED_100baseT_Half |
-	                   ADVERTISED_100baseT_Full |
-	                   ADVERTISED_Autoneg |
-	                   ADVERTISED_MII);
-
-
-	ecmd->port = PORT_MII;
-	ecmd->phy_address = db->phy_addr;
-
-	ecmd->transceiver = XCVR_EXTERNAL;
-		
-	ecmd->speed = 10;
-	ecmd->duplex = DUPLEX_HALF;
-	
-	if(db->op_mode==ULI526X_100MHF || db->op_mode==ULI526X_100MFD)
-	{
-		ecmd->speed = 100;               
-	}
-	if(db->op_mode==ULI526X_10MFD || db->op_mode==ULI526X_100MFD)
-	{
-		ecmd->duplex = DUPLEX_FULL;
-	}
-	if(db->link_failed)
-	{
-		ecmd->speed = -1;
-		ecmd->duplex = -1;	
-	}
-	
-	if (db->media_mode & ULI526X_AUTO)
-	{	
-		ecmd->autoneg = AUTONEG_ENABLE;
-	}
-}
-
-static void netdev_get_drvinfo(struct net_device *dev,
-			       struct ethtool_drvinfo *info)
-{
-	struct uli526x_board_info *np = netdev_priv(dev);
-
-	strcpy(info->driver, DRV_NAME);
-	strcpy(info->version, DRV_VERSION);
-	if (np->pdev)
-		strcpy(info->bus_info, pci_name(np->pdev));
-	else
-		sprintf(info->bus_info, "EISA 0x%lx %d",
-			dev->base_addr, dev->irq);
-}
-
-static int netdev_get_settings(struct net_device *dev, struct ethtool_cmd *cmd) {
-	struct uli526x_board_info *np = netdev_priv(dev);
-	
-	ULi_ethtool_gset(np, cmd);
-	
-	return 0;
-}
-
-static u32 netdev_get_link(struct net_device *dev) {
-	struct uli526x_board_info *np = netdev_priv(dev);
-		
-	if(np->link_failed)
-		return 0;
-	else
-		return 1;
-}
-
-static void uli526x_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
-{
-	wol->supported = WAKE_PHY | WAKE_MAGIC;
-	wol->wolopts = 0;
-}
-
-static struct ethtool_ops netdev_ethtool_ops = {
-	.get_drvinfo		= netdev_get_drvinfo,
-	.get_settings		= netdev_get_settings,
-	.get_link		= netdev_get_link,
-	.get_wol		= uli526x_get_wol,
-};
-
-/*
- *	A periodic timer routine
- *	Dynamic media sense, allocate Rx buffer...
- */
-
-static void uli526x_timer(unsigned long data)
-{
-	u32 tmp_cr8;
-	unsigned char tmp_cr12=0;
-	struct net_device *dev = (struct net_device *) data;
-	struct uli526x_board_info *db = netdev_priv(dev);
- 	unsigned long flags;
-	u8 TmpSpeed=10;
-	
-	//ULI526X_DBUG(0, "uli526x_timer()", 0);
-	spin_lock_irqsave(&db->lock, flags);
-
-	
-	/* Dynamic reset ULI526X : system error or transmit time-out */
-	tmp_cr8 = inl(db->ioaddr + DCR8);
-	if ( (db->interval_rx_cnt==0) && (tmp_cr8) ) {
-		db->reset_cr8++;
-		db->wait_reset = 1;
-	}
-	db->interval_rx_cnt = 0;
-
-	/* TX polling kick monitor */
-	if ( db->tx_packet_cnt &&
-	     time_after(jiffies, dev->trans_start + ULI526X_TX_KICK) ) {
-		outl(0x1, dev->base_addr + DCR1);   // Tx polling again 
-
-		// TX Timeout 
-		if ( time_after(jiffies, dev->trans_start + ULI526X_TX_TIMEOUT) ) {
-			db->reset_TXtimeout++;
-			db->wait_reset = 1;
-			printk( "%s: Tx timeout - resetting\n",
-			       dev->name);
-		}
-	}
-
-	if (db->wait_reset) {
-		ULI526X_DBUG(0, "Dynamic Reset device", db->tx_packet_cnt);
-		db->reset_count++;
-		uli526x_dynamic_reset(dev);
-		db->timer.expires = ULI526X_TIMER_WUT;
-		add_timer(&db->timer);
-		spin_unlock_irqrestore(&db->lock, flags);
-		return;
-	}
-
-	/* Link status check, Dynamic media type change */
-	if((phy_read(db->ioaddr, db->phy_addr, 5, db->chip_id) & 0x01e0)!=0)
-		tmp_cr12 = 3;
-
-	if ( !(tmp_cr12 & 0x3) && !db->link_failed ) {
-		/* Link Failed */
-		ULI526X_DBUG(0, "Link Failed", tmp_cr12);
-		netif_carrier_off(dev);
-		printk(KERN_INFO "uli526x: %s NIC Link is Down\n",dev->name);
-		db->link_failed = 1;
-
-		/* For Force 10/100M Half/Full mode: Enable Auto-Nego mode */
-		/* AUTO don't need */
-		if ( !(db->media_mode & 0x8) )
-			phy_write(db->ioaddr, db->phy_addr, 0, 0x1000, db->chip_id);
-
-		/* AUTO mode, if INT phyxcer link failed, select EXT device */
-		if (db->media_mode & ULI526X_AUTO) {
-			db->cr6_data&=~0x00000200;	/* bit9=0, HD mode */
-			update_cr6(db->cr6_data, db->ioaddr);
-		}
-	} else
-		if ((tmp_cr12 & 0x3) && db->link_failed) {
-			ULI526X_DBUG(0, "Link link OK", tmp_cr12);
-			db->link_failed = 0;
-
-			/* Auto Sense Speed */
-			if ( (db->media_mode & ULI526X_AUTO) &&
-				uli526x_sense_speed(db) )
-				db->link_failed = 1;
-			uli526x_process_mode(db);
-			
-			if(db->link_failed==0)
-			{
-				if(db->op_mode==ULI526X_100MHF || db->op_mode==ULI526X_100MFD)
-				{
-					TmpSpeed = 100;
-				}
-				if(db->op_mode==ULI526X_10MFD || db->op_mode==ULI526X_100MFD)
-				{
-					printk(KERN_INFO "uli526x: %s NIC Link is Up %d Mbps Full duplex\n",dev->name,TmpSpeed);
-				}
-				else
-				{
-					printk(KERN_INFO "uli526x: %s NIC Link is Up %d Mbps Half duplex\n",dev->name,TmpSpeed);
-				}
-				netif_carrier_on(dev);
-			}
-			/* SHOW_MEDIA_TYPE(db->op_mode); */
-		}
-		else if(!(tmp_cr12 & 0x3) && db->link_failed)
-		{
-			if(db->init==1)
-			{
-				printk(KERN_INFO "uli526x: %s NIC Link is Down\n",dev->name);
-				netif_carrier_off(dev);
-			}
-		}
-		db->init=0;
-
-	/* Timer active again */
-	db->timer.expires = ULI526X_TIMER_WUT;
-	add_timer(&db->timer);
-	spin_unlock_irqrestore(&db->lock, flags);
-}
-
-
-/*
- *	Dynamic reset the ULI526X board
- *	Stop ULI526X board
- *	Free Tx/Rx allocated memory
- *	Reset ULI526X board
- *	Re-initialize ULI526X board
- */
-
-static void uli526x_dynamic_reset(struct net_device *dev)
-{
-	struct uli526x_board_info *db = netdev_priv(dev);
-
-	ULI526X_DBUG(0, "uli526x_dynamic_reset()", 0);
-
-	/* Sopt MAC controller */
-	db->cr6_data &= ~(CR6_RXSC | CR6_TXSC);	/* Disable Tx/Rx */
-	update_cr6(db->cr6_data, dev->base_addr);
-	outl(0, dev->base_addr + DCR7);		/* Disable Interrupt */
-	outl(inl(dev->base_addr + DCR5), dev->base_addr + DCR5);
-
-	/* Disable upper layer interface */
-	netif_stop_queue(dev);
-
-	/* Free Rx Allocate buffer */
-	uli526x_free_rxbuffer(db);
-
-	/* system variable init */
-	db->tx_packet_cnt = 0;
-	db->rx_avail_cnt = 0;
-	db->link_failed = 1;
-	db->init=1;
-	db->wait_reset = 0;
-
-	/* Re-initialize ULI526X board */
-	uli526x_init(dev);
-
-	/* Restart upper layer interface */
-	netif_wake_queue(dev);
-}
-
-
-/*
- *	free all allocated rx buffer
- */
-
-static void uli526x_free_rxbuffer(struct uli526x_board_info * db)
-{
-	ULI526X_DBUG(0, "uli526x_free_rxbuffer()", 0);
-
-	/* free allocated rx buffer */
-	while (db->rx_avail_cnt) {
-		dev_kfree_skb(db->rx_ready_ptr->rx_skb_ptr);
-		db->rx_ready_ptr = db->rx_ready_ptr->next_rx_desc;
-		db->rx_avail_cnt--;
-	}
-}
-
-
-/*
- *	Reuse the SK buffer
- */
-
-static void uli526x_reuse_skb(struct uli526x_board_info *db, struct sk_buff * skb)
-{
-	struct rx_desc *rxptr = db->rx_insert_ptr;
-
-	if (!(rxptr->rdes0 & cpu_to_le32(0x80000000))) {
-		rxptr->rx_skb_ptr = skb;
-		rxptr->rdes2 = cpu_to_le32( pci_map_single(db->pdev, skb->tail, RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE) );
-		wmb();
-		rxptr->rdes0 = cpu_to_le32(0x80000000);
-		db->rx_avail_cnt++;
-		db->rx_insert_ptr = rxptr->next_rx_desc;
-	} else
-		ULI526X_DBUG(0, "SK Buffer reuse method error", db->rx_avail_cnt);
-}
-
-
-/*
- *	Initialize transmit/Receive descriptor
- *	Using Chain structure, and allocate Tx/Rx buffer
- */
-
-static void uli526x_descriptor_init(struct uli526x_board_info *db, unsigned long ioaddr)
-{
-	struct tx_desc *tmp_tx;
-	struct rx_desc *tmp_rx;
-	unsigned char *tmp_buf;
-	dma_addr_t tmp_tx_dma, tmp_rx_dma;
-	dma_addr_t tmp_buf_dma;
-	int i;
-
-	ULI526X_DBUG(0, "uli526x_descriptor_init()", 0);
-
-	/* tx descriptor start pointer */
-	db->tx_insert_ptr = db->first_tx_desc;
-	db->tx_remove_ptr = db->first_tx_desc;
-	outl(db->first_tx_desc_dma, ioaddr + DCR4);     /* TX DESC address */
-
-	/* rx descriptor start pointer */
-	db->first_rx_desc = (void *)db->first_tx_desc + sizeof(struct tx_desc) * TX_DESC_CNT;
-	db->first_rx_desc_dma =  db->first_tx_desc_dma + sizeof(struct tx_desc) * TX_DESC_CNT;
-	db->rx_insert_ptr = db->first_rx_desc;
-	db->rx_ready_ptr = db->first_rx_desc;
-	outl(db->first_rx_desc_dma, ioaddr + DCR3);	/* RX DESC address */
-
-	/* Init Transmit chain */
-	tmp_buf = db->buf_pool_start;
-	tmp_buf_dma = db->buf_pool_dma_start;
-	tmp_tx_dma = db->first_tx_desc_dma;
-	for (tmp_tx = db->first_tx_desc, i = 0; i < TX_DESC_CNT; i++, tmp_tx++) {
-		tmp_tx->tx_buf_ptr = tmp_buf;
-		tmp_tx->tdes0 = cpu_to_le32(0);
-		tmp_tx->tdes1 = cpu_to_le32(0x81000000);	/* IC, chain */
-		tmp_tx->tdes2 = cpu_to_le32(tmp_buf_dma);
-		tmp_tx_dma += sizeof(struct tx_desc);
-		tmp_tx->tdes3 = cpu_to_le32(tmp_tx_dma);
-		tmp_tx->next_tx_desc = tmp_tx + 1;
-		tmp_buf = tmp_buf + TX_BUF_ALLOC;
-		tmp_buf_dma = tmp_buf_dma + TX_BUF_ALLOC;
-	}
-	(--tmp_tx)->tdes3 = cpu_to_le32(db->first_tx_desc_dma);
-	tmp_tx->next_tx_desc = db->first_tx_desc;
-
-	 /* Init Receive descriptor chain */
-	tmp_rx_dma=db->first_rx_desc_dma;
-	for (tmp_rx = db->first_rx_desc, i = 0; i < RX_DESC_CNT; i++, tmp_rx++) {
-		tmp_rx->rdes0 = cpu_to_le32(0);
-		tmp_rx->rdes1 = cpu_to_le32(0x01000600);
-		tmp_rx_dma += sizeof(struct rx_desc);
-		tmp_rx->rdes3 = cpu_to_le32(tmp_rx_dma);
-		tmp_rx->next_rx_desc = tmp_rx + 1;
-	}
-	(--tmp_rx)->rdes3 = cpu_to_le32(db->first_rx_desc_dma);
-	tmp_rx->next_rx_desc = db->first_rx_desc;
-
-	/* pre-allocate Rx buffer */
-	allocate_rx_buffer(db);
-}
-
-
-/*
- *	Update CR6 value
- *	Firstly stop ULI526X, then written value and start
- */
-
-static void update_cr6(u32 cr6_data, unsigned long ioaddr)
-{
-
-	outl(cr6_data, ioaddr + DCR6);
-	udelay(5);
-}
-
-
-/*
- *	Send a setup frame for M5261/M5263
- *	This setup frame initialize ULI526X address filter mode
- */
-
-static void send_filter_frame(struct net_device *dev, int mc_cnt)
-{
-	struct uli526x_board_info *db = netdev_priv(dev);
-	struct dev_mc_list *mcptr;
-	struct tx_desc *txptr;
-	u16 * addrptr;
-	u32 * suptr;
-	int i;
-
-	ULI526X_DBUG(0, "send_filter_frame()", 0);
-
-	txptr = db->tx_insert_ptr;
-	suptr = (u32 *) txptr->tx_buf_ptr;
-
-	/* Node address */
-	addrptr = (u16 *) dev->dev_addr;
-	*suptr++ = addrptr[0];
-	*suptr++ = addrptr[1];
-	*suptr++ = addrptr[2];
-
-	/* broadcast address */
-	*suptr++ = 0xffff;
-	*suptr++ = 0xffff;
-	*suptr++ = 0xffff;
-
-	/* fit the multicast address */
-	for (mcptr = dev->mc_list, i = 0; i < mc_cnt; i++, mcptr = mcptr->next) {
-		addrptr = (u16 *) mcptr->dmi_addr;
-		*suptr++ = addrptr[0];
-		*suptr++ = addrptr[1];
-		*suptr++ = addrptr[2];
-	}
-
-	for (; i<14; i++) {
-		*suptr++ = 0xffff;
-		*suptr++ = 0xffff;
-		*suptr++ = 0xffff;
-	}
-
-	/* prepare the setup frame */
-	db->tx_insert_ptr = txptr->next_tx_desc;
-	txptr->tdes1 = cpu_to_le32(0x890000c0);
-
-	/* Resource Check and Send the setup packet */
-	if (db->tx_packet_cnt < TX_DESC_CNT) {
-		/* Resource Empty */
-		db->tx_packet_cnt++;
-		txptr->tdes0 = cpu_to_le32(0x80000000);
-		update_cr6(db->cr6_data | 0x2000, dev->base_addr);
-		outl(0x1, dev->base_addr + DCR1);	/* Issue Tx polling */
-		update_cr6(db->cr6_data, dev->base_addr);
-		dev->trans_start = jiffies;
-	} else
-		printk(KERN_ERR DRV_NAME ": No Tx resource - Send_filter_frame!\n");
-}
-
-
-/*
- *	Allocate rx buffer,
- *	As possible as allocate maxiumn Rx buffer
- */
-
-static void allocate_rx_buffer(struct uli526x_board_info *db)
-{
-	struct rx_desc *rxptr;
-	struct sk_buff *skb;
-
-	rxptr = db->rx_insert_ptr;
-
-	while(db->rx_avail_cnt < RX_DESC_CNT) {
-		if ( ( skb = dev_alloc_skb(RX_ALLOC_SIZE) ) == NULL )
-			break;
-		rxptr->rx_skb_ptr = skb; /* FIXME (?) */
-		rxptr->rdes2 = cpu_to_le32( pci_map_single(db->pdev, skb->tail, RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE) );
-		wmb();
-		rxptr->rdes0 = cpu_to_le32(0x80000000);
-		rxptr = rxptr->next_rx_desc;
-		db->rx_avail_cnt++;
-	}
-
-	db->rx_insert_ptr = rxptr;
-}
-
-
-/*
- *	Read one word data from the serial ROM
- */
-
-static u16 read_srom_word(long ioaddr, int offset)
-{
-	int i;
-	u16 srom_data = 0;
-	long cr9_ioaddr = ioaddr + DCR9;
-
-	outl(CR9_SROM_READ, cr9_ioaddr);
-	outl(CR9_SROM_READ | CR9_SRCS, cr9_ioaddr);
-
-	/* Send the Read Command 110b */
-	SROM_CLK_WRITE(SROM_DATA_1, cr9_ioaddr);
-	SROM_CLK_WRITE(SROM_DATA_1, cr9_ioaddr);
-	SROM_CLK_WRITE(SROM_DATA_0, cr9_ioaddr);
-
-	/* Send the offset */
-	for (i = 5; i >= 0; i--) {
-		srom_data = (offset & (1 << i)) ? SROM_DATA_1 : SROM_DATA_0;
-		SROM_CLK_WRITE(srom_data, cr9_ioaddr);
-	}
-
-	outl(CR9_SROM_READ | CR9_SRCS, cr9_ioaddr);
-
-	for (i = 16; i > 0; i--) {
-		outl(CR9_SROM_READ | CR9_SRCS | CR9_SRCLK, cr9_ioaddr);
-		udelay(5);
-		srom_data = (srom_data << 1) | ((inl(cr9_ioaddr) & CR9_CRDOUT) ? 1 : 0);
-		outl(CR9_SROM_READ | CR9_SRCS, cr9_ioaddr);
-		udelay(5);
-	}
-
-	outl(CR9_SROM_READ, cr9_ioaddr);
-	return srom_data;
-}
-
-
-/*
- *	Auto sense the media mode
- */
-
-static u8 uli526x_sense_speed(struct uli526x_board_info * db)
-{
-	u8 ErrFlag = 0;
-	u16 phy_mode;
-
-	phy_mode = phy_read(db->ioaddr, db->phy_addr, 1, db->chip_id);
-	phy_mode = phy_read(db->ioaddr, db->phy_addr, 1, db->chip_id);
-
-	if ( (phy_mode & 0x24) == 0x24 ) {
-		
-		phy_mode = ((phy_read(db->ioaddr, db->phy_addr, 5, db->chip_id) & 0x01e0)<<7);
-		if(phy_mode&0x8000)
-			phy_mode = 0x8000;
-		else if(phy_mode&0x4000)
-			phy_mode = 0x4000;
-		else if(phy_mode&0x2000)
-			phy_mode = 0x2000;
-		else
-			phy_mode = 0x1000;
-		
-		/* printk(DRV_NAME ": Phy_mode %x ",phy_mode); */
-		switch (phy_mode) {
-		case 0x1000: db->op_mode = ULI526X_10MHF; break;
-		case 0x2000: db->op_mode = ULI526X_10MFD; break;
-		case 0x4000: db->op_mode = ULI526X_100MHF; break;
-		case 0x8000: db->op_mode = ULI526X_100MFD; break;
-		default: db->op_mode = ULI526X_10MHF; ErrFlag = 1; break;
-		}
-	} else {
-		db->op_mode = ULI526X_10MHF;
-		ULI526X_DBUG(0, "Link Failed :", phy_mode);
-		ErrFlag = 1;
-	}
-
-	return ErrFlag;
-}
-
-
-/*
- *	Set 10/100 phyxcer capability
- *	AUTO mode : phyxcer register4 is NIC capability
- *	Force mode: phyxcer register4 is the force media
- */
-
-static void uli526x_set_phyxcer(struct uli526x_board_info *db)
-{
-	u16 phy_reg;
-	
-	/* Phyxcer capability setting */
-	phy_reg = phy_read(db->ioaddr, db->phy_addr, 4, db->chip_id) & ~0x01e0;
-
-	if (db->media_mode & ULI526X_AUTO) {
-		/* AUTO Mode */
-		phy_reg |= db->PHY_reg4;
-	} else {
-		/* Force Mode */
-		switch(db->media_mode) {
-		case ULI526X_10MHF: phy_reg |= 0x20; break;
-		case ULI526X_10MFD: phy_reg |= 0x40; break;
-		case ULI526X_100MHF: phy_reg |= 0x80; break;
-		case ULI526X_100MFD: phy_reg |= 0x100; break;
-		}
-		
-	}
-
-  	/* Write new capability to Phyxcer Reg4 */
-	if ( !(phy_reg & 0x01e0)) {
-		phy_reg|=db->PHY_reg4;
-		db->media_mode|=ULI526X_AUTO;
-	}
-	phy_write(db->ioaddr, db->phy_addr, 4, phy_reg, db->chip_id);
-
- 	/* Restart Auto-Negotiation */
-	phy_write(db->ioaddr, db->phy_addr, 0, 0x1200, db->chip_id);
-	udelay(50);
-}
-
-
-/*
- *	Process op-mode
- 	AUTO mode : PHY controller in Auto-negotiation Mode
- *	Force mode: PHY controller in force mode with HUB
- *			N-way force capability with SWITCH
- */
-
-static void uli526x_process_mode(struct uli526x_board_info *db)
-{
-	u16 phy_reg;
-
-	/* Full Duplex Mode Check */
-	if (db->op_mode & 0x4)
-		db->cr6_data |= CR6_FDM;	/* Set Full Duplex Bit */
-	else
-		db->cr6_data &= ~CR6_FDM;	/* Clear Full Duplex Bit */
-
-	update_cr6(db->cr6_data, db->ioaddr);
-
-	/* 10/100M phyxcer force mode need */
-	if ( !(db->media_mode & 0x8)) {
-		/* Forece Mode */
-		phy_reg = phy_read(db->ioaddr, db->phy_addr, 6, db->chip_id);
-		if ( !(phy_reg & 0x1) ) {
-			/* parter without N-Way capability */
-			phy_reg = 0x0;
-			switch(db->op_mode) {
-			case ULI526X_10MHF: phy_reg = 0x0; break;
-			case ULI526X_10MFD: phy_reg = 0x100; break;
-			case ULI526X_100MHF: phy_reg = 0x2000; break;
-			case ULI526X_100MFD: phy_reg = 0x2100; break;
-			}
-			phy_write(db->ioaddr, db->phy_addr, 0, phy_reg, db->chip_id);
-       			phy_write(db->ioaddr, db->phy_addr, 0, phy_reg, db->chip_id);
-		}
-	}
-}
-
-
-/*
- *	Write a word to Phy register
- */
-
-static void phy_write(unsigned long iobase, u8 phy_addr, u8 offset, u16 phy_data, u32 chip_id)
-{
-	u16 i;
-	unsigned long ioaddr;
-
-	if(chip_id == PCI_ULI5263_ID)
-	{
-		phy_writeby_cr10(iobase, phy_addr, offset, phy_data);
-		return;
-	}
-	/* M5261/M5263 Chip */
-	ioaddr = iobase + DCR9;
-
-	/* Send 33 synchronization clock to Phy controller */
-	for (i = 0; i < 35; i++)
-		phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
-
-	/* Send start command(01) to Phy */
-	phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
-	phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
-
-	/* Send write command(01) to Phy */
-	phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
-	phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
-
-	/* Send Phy address */
-	for (i = 0x10; i > 0; i = i >> 1)
-		phy_write_1bit(ioaddr, phy_addr & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
-
-	/* Send register address */
-	for (i = 0x10; i > 0; i = i >> 1)
-		phy_write_1bit(ioaddr, offset & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
-
-	/* written trasnition */
-	phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
-	phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
-
-	/* Write a word data to PHY controller */
-	for ( i = 0x8000; i > 0; i >>= 1)
-		phy_write_1bit(ioaddr, phy_data & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
-	
-}
-
-
-/*
- *	Read a word data from phy register
- */
-
-static u16 phy_read(unsigned long iobase, u8 phy_addr, u8 offset, u32 chip_id)
-{
-	int i;
-	u16 phy_data;
-	unsigned long ioaddr;
-
-	if(chip_id == PCI_ULI5263_ID)
-		return phy_readby_cr10(iobase, phy_addr, offset);
-	/* M5261/M5263 Chip */
-	ioaddr = iobase + DCR9;
-	
-	/* Send 33 synchronization clock to Phy controller */
-	for (i = 0; i < 35; i++)
-		phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
-
-	/* Send start command(01) to Phy */
-	phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
-	phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
-
-	/* Send read command(10) to Phy */
-	phy_write_1bit(ioaddr, PHY_DATA_1, chip_id);
-	phy_write_1bit(ioaddr, PHY_DATA_0, chip_id);
-
-	/* Send Phy address */
-	for (i = 0x10; i > 0; i = i >> 1)
-		phy_write_1bit(ioaddr, phy_addr & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
-
-	/* Send register address */
-	for (i = 0x10; i > 0; i = i >> 1)
-		phy_write_1bit(ioaddr, offset & i ? PHY_DATA_1 : PHY_DATA_0, chip_id);
-
-	/* Skip transition state */
-	phy_read_1bit(ioaddr, chip_id);
-
-	/* read 16bit data */
-	for (phy_data = 0, i = 0; i < 16; i++) {
-		phy_data <<= 1;
-		phy_data |= phy_read_1bit(ioaddr, chip_id);
-	}
-
-	return phy_data;
-}
-
-static u16 phy_readby_cr10(unsigned long iobase, u8 phy_addr, u8 offset)
-{
-	unsigned long ioaddr,cr10_value;
-	
-	ioaddr = iobase + DCR10;
-	cr10_value = phy_addr;
-	cr10_value = (cr10_value<<5) + offset;
-	cr10_value = (cr10_value<<16) + 0x08000000;
-	outl(cr10_value,ioaddr);
-	udelay(1);
-	while(1)
-	{
-		cr10_value = inl(ioaddr);
-		if(cr10_value&0x10000000)
-			break;
-	}
-	return (cr10_value&0x0ffff);
-}
-
-static void phy_writeby_cr10(unsigned long iobase, u8 phy_addr, u8 offset, u16 phy_data)
-{
-	unsigned long ioaddr,cr10_value;
-	
-	ioaddr = iobase + DCR10;
-	cr10_value = phy_addr;
-	cr10_value = (cr10_value<<5) + offset;
-	cr10_value = (cr10_value<<16) + 0x04000000 + phy_data;
-	outl(cr10_value,ioaddr);
-	udelay(1);
-}
-/*
- *	Write one bit data to Phy Controller
- */
-
-static void phy_write_1bit(unsigned long ioaddr, u32 phy_data, u32 chip_id)
-{
-	outl(phy_data , ioaddr);			/* MII Clock Low */
-	udelay(1);
-	outl(phy_data  | MDCLKH, ioaddr);	/* MII Clock High */
-	udelay(1);
-	outl(phy_data , ioaddr);			/* MII Clock Low */
-	udelay(1);
-}
-
-
-/*
- *	Read one bit phy data from PHY controller
- */
-
-static u16 phy_read_1bit(unsigned long ioaddr, u32 chip_id)
-{
-	u16 phy_data;
-	
-	outl(0x50000 , ioaddr);
-	udelay(1);
-	phy_data = ( inl(ioaddr) >> 19 ) & 0x1;
-	outl(0x40000 , ioaddr);
-	udelay(1);
-
-	return phy_data;
-}
-
-
-static struct pci_device_id uli526x_pci_tbl[] = {
-	{ 0x10B9, 0x5261, PCI_ANY_ID, PCI_ANY_ID, 0, 0, PCI_ULI5261_ID },
-	{ 0x10B9, 0x5263, PCI_ANY_ID, PCI_ANY_ID, 0, 0, PCI_ULI5263_ID },
-	{ 0, }
-};
-MODULE_DEVICE_TABLE(pci, uli526x_pci_tbl);
-
-
-static struct pci_driver uli526x_driver = {
-	.name		= "uli526x",
-	.id_table	= uli526x_pci_tbl,
-	.probe		= uli526x_init_one,
-	.remove		= __devexit_p(uli526x_remove_one),
-};
-
-MODULE_AUTHOR("Peer Chen, peer.chen@uli.com.tw");
-MODULE_DESCRIPTION("ULi M5261/M5263 fast ethernet driver");
-MODULE_LICENSE("GPL");
-
-MODULE_PARM(debug, "i");
-MODULE_PARM(mode, "i");
-MODULE_PARM(cr6set, "i");
-MODULE_PARM_DESC(debug, "ULi M5261/M5263 enable debugging (0-1)");
-MODULE_PARM_DESC(mode, "ULi M5261/M5263: Bit 0: 10/100Mbps, bit 2: duplex, bit 8: HomePNA");
-
-/*	Description:
- *	when user used insmod to add module, system invoked init_module()
- *	to register the services.
- */
-
-static int __init uli526x_init_module(void)
-{
-	int rc;
-
-	printk(version);
-	printed_version = 1;
-
-	ULI526X_DBUG(0, "init_module() ", debug);
-
-	if (debug)
-		uli526x_debug = debug;	/* set debug flag */
-	if (cr6set)
-		uli526x_cr6_user_set = cr6set;
-
- 	switch(mode) {
-   	case ULI526X_10MHF:
-	case ULI526X_100MHF:
-	case ULI526X_10MFD:
-	case ULI526X_100MFD:
-		uli526x_media_mode = mode;
-		break;
-	default:uli526x_media_mode = ULI526X_AUTO;
-		break;
-	}
-
-	rc = pci_module_init(&uli526x_driver);
-	if (rc < 0)
-		return rc;
-
-	return 0;
-}
-
-
-/*
- *	Description:
- *	when user used rmmod to delete module, system invoked clean_module()
- *	to un-register all registered services.
- */
-
-static void __exit uli526x_cleanup_module(void)
-{
-	ULI526X_DBUG(0, "uli526x_clean_module() ", debug);
-	pci_unregister_driver(&uli526x_driver);
-}
-
-module_init(uli526x_init_module);
-module_exit(uli526x_cleanup_module);
diff --git a/trunk/drivers/net/wan/hdlc_generic.c b/trunk/drivers/net/wan/hdlc_generic.c
index cdd4c09c2d90..a63f6a2cc4f7 100644
--- a/trunk/drivers/net/wan/hdlc_generic.c
+++ b/trunk/drivers/net/wan/hdlc_generic.c
@@ -61,7 +61,7 @@ static struct net_device_stats *hdlc_get_stats(struct net_device *dev)
 
 
 static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev,
-		    struct packet_type *p, struct net_device *orig_dev)
+		    struct packet_type *p)
 {
 	hdlc_device *hdlc = dev_to_hdlc(dev);
 	if (hdlc->proto.netif_rx)
diff --git a/trunk/drivers/net/wan/lapbether.c b/trunk/drivers/net/wan/lapbether.c
index 6c302e9dbca2..7f2e3653c5e5 100644
--- a/trunk/drivers/net/wan/lapbether.c
+++ b/trunk/drivers/net/wan/lapbether.c
@@ -86,7 +86,7 @@ static __inline__ int dev_is_ethdev(struct net_device *dev)
 /*
  *	Receive a LAPB frame via an ethernet interface.
  */
-static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptype, struct net_device *orig_dev)
+static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *ptype)
 {
 	int len, err;
 	struct lapbethdev *lapbeth;
diff --git a/trunk/drivers/net/wan/sdla_fr.c b/trunk/drivers/net/wan/sdla_fr.c
index 0497dbdb8631..c5f5e62aab8b 100644
--- a/trunk/drivers/net/wan/sdla_fr.c
+++ b/trunk/drivers/net/wan/sdla_fr.c
@@ -445,7 +445,7 @@ void 	s508_s514_unlock(sdla_t *card, unsigned long *smp_flags);
 void 	s508_s514_lock(sdla_t *card, unsigned long *smp_flags);
 
 unsigned short calc_checksum (char *, int);
-static int setup_fr_header(struct sk_buff *skb,
+static int setup_fr_header(struct sk_buff** skb,
 			   struct net_device* dev, char op_mode);
 
 
@@ -1372,7 +1372,7 @@ static int if_send(struct sk_buff* skb, struct net_device* dev)
 	/* Move the if_header() code to here. By inserting frame
 	 * relay header in if_header() we would break the
 	 * tcpdump and other packet sniffers */
-	chan->fr_header_len = setup_fr_header(skb,dev,chan->common.usedby);
+	chan->fr_header_len = setup_fr_header(&skb,dev,chan->common.usedby);
 	if (chan->fr_header_len < 0 ){
 		++chan->ifstats.tx_dropped;
 		++card->wandev.stats.tx_dropped;
@@ -1597,6 +1597,8 @@ static int setup_for_delayed_transmit(struct net_device* dev,
 		return 1;
 	}
 
+	skb_unlink(skb);
+	
         chan->transmit_length = len;
 	chan->delay_skb = skb;
         
@@ -4869,15 +4871,18 @@ static void unconfig_fr (sdla_t *card)
 	}
 }
 
-static int setup_fr_header(struct sk_buff *skb, struct net_device* dev,
+static int setup_fr_header(struct sk_buff **skb_orig, struct net_device* dev,
 			   char op_mode)
 {
+	struct sk_buff *skb = *skb_orig;
 	fr_channel_t *chan=dev->priv;
 
-	if (op_mode == WANPIPE) {
+	if (op_mode == WANPIPE){
+
 		chan->fr_header[0]=Q922_UI;
 		
 		switch (htons(skb->protocol)){
+			
 		case ETH_P_IP:
 			chan->fr_header[1]=NLPID_IP;
 			break;
@@ -4889,14 +4894,16 @@ static int setup_fr_header(struct sk_buff *skb, struct net_device* dev,
 	}
 
 	/* If we are in bridging mode, we must apply
-	 * an Ethernet header
-	 */
-	if (op_mode == BRIDGE || op_mode == BRIDGE_NODE) {
+	 * an Ethernet header */
+	if (op_mode == BRIDGE || op_mode == BRIDGE_NODE){
+
+
 		/* Encapsulate the packet as a bridged Ethernet frame. */
 #ifdef DEBUG
 		printk(KERN_INFO "%s: encapsulating skb for frame relay\n", 
 			dev->name);
 #endif
+		
 		chan->fr_header[0] = 0x03;
 		chan->fr_header[1] = 0x00;
 		chan->fr_header[2] = 0x80;
@@ -4909,6 +4916,7 @@ static int setup_fr_header(struct sk_buff *skb, struct net_device* dev,
 		/* Yuck. */
 		skb->protocol = ETH_P_802_3;
 		return 8;
+
 	}
 		
 	return 0;
diff --git a/trunk/drivers/net/wan/syncppp.c b/trunk/drivers/net/wan/syncppp.c
index f58c794a963a..84b65c60c799 100644
--- a/trunk/drivers/net/wan/syncppp.c
+++ b/trunk/drivers/net/wan/syncppp.c
@@ -1447,7 +1447,7 @@ static void sppp_print_bytes (u_char *p, u16 len)
  *	after interrupt servicing to process frames queued via netif_rx.
  */
 
-static int sppp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *p, struct net_device *orig_dev)
+static int sppp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *p)
 {
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		return NET_RX_DROP;
diff --git a/trunk/drivers/net/wireless/Kconfig b/trunk/drivers/net/wireless/Kconfig
index dd7dbf7b14d4..ec3f75a030d2 100644
--- a/trunk/drivers/net/wireless/Kconfig
+++ b/trunk/drivers/net/wireless/Kconfig
@@ -137,110 +137,6 @@ config PCMCIA_RAYCS
 comment "Wireless 802.11b ISA/PCI cards support"
 	depends on NET_RADIO && (ISA || PCI || PPC_PMAC || PCMCIA)
 
-config IPW2100
-	tristate "Intel PRO/Wireless 2100 Network Connection"
-	depends on NET_RADIO && PCI && IEEE80211
-	select FW_LOADER
-	---help---
-          A driver for the Intel PRO/Wireless 2100 Network 
-	  Connection 802.11b wireless network adapter.
-
-          See <file:Documentation/networking/README.ipw2100> for information on
-          the capabilities currently enabled in this driver and for tips
-          for debugging issues and problems.
-
-	  In order to use this driver, you will need a firmware image for it.
-          You can obtain the firmware from
-	  <http://ipw2100.sf.net/>.  Once you have the firmware image, you 
-	  will need to place it in /etc/firmware.
-
-          You will also very likely need the Wireless Tools in order to
-          configure your card:
-
-          <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
- 
-          If you want to compile the driver as a module ( = code which can be
-          inserted in and remvoed from the running kernel whenever you want),
-          say M here and read <file:Documentation/modules.txt>.  The module
-          will be called ipw2100.ko.
-	
-config IPW2100_MONITOR
-        bool "Enable promiscuous mode"
-        depends on IPW2100
-        ---help---
-	  Enables promiscuous/monitor mode support for the ipw2100 driver.
-	  With this feature compiled into the driver, you can switch to 
-	  promiscuous mode via the Wireless Tool's Monitor mode.  While in this
-	  mode, no packets can be sent.
-
-config IPW_DEBUG
-	bool "Enable full debugging output in IPW2100 module."
-	depends on IPW2100
-	---help---
-	  This option will enable debug tracing output for the IPW2100.  
-
-	  This will result in the kernel module being ~60k larger.  You can 
-	  control which debug output is sent to the kernel log by setting the 
-	  value in 
-
-	  /sys/bus/pci/drivers/ipw2100/debug_level
-
-	  This entry will only exist if this option is enabled.
-
-	  If you are not trying to debug or develop the IPW2100 driver, you 
-	  most likely want to say N here.
-
-config IPW2200
-	tristate "Intel PRO/Wireless 2200BG and 2915ABG Network Connection"
-	depends on IEEE80211 && PCI
-	select FW_LOADER
-	---help---
-          A driver for the Intel PRO/Wireless 2200BG and 2915ABG Network
-	  Connection adapters. 
-
-          See <file:Documentation/networking/README.ipw2200> for 
-	  information on the capabilities currently enabled in this 
-	  driver and for tips for debugging issues and problems.
-
-	  In order to use this driver, you will need a firmware image for it.
-          You can obtain the firmware from
-	  <http://ipw2200.sf.net/>.  See the above referenced README.ipw2200 
-	  for information on where to install the firmare images.
-
-          You will also very likely need the Wireless Tools in order to
-          configure your card:
-
-          <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
- 
-          If you want to compile the driver as a module ( = code which can be
-          inserted in and remvoed from the running kernel whenever you want),
-          say M here and read <file:Documentation/modules.txt>.  The module
-          will be called ipw2200.ko.
-
-config IPW_DEBUG
-	bool "Enable full debugging output in IPW2200 module."
-	depends on IPW2200
-	---help---
-	  This option will enable debug tracing output for the IPW2200.  
-
-	  This will result in the kernel module being ~100k larger.  You can 
-	  control which debug output is sent to the kernel log by setting the 
-	  value in 
-
-	  /sys/bus/pci/drivers/ipw2200/debug_level
-
-	  This entry will only exist if this option is enabled.
-
-	  To set a value, simply echo an 8-byte hex value to the same file:
-
-	  % echo 0x00000FFO > /sys/bus/pci/drivers/ipw2200/debug_level
-
-	  You can find the list of debug mask values in 
-	  drivers/net/wireless/ipw2200.h
-
-	  If you are not trying to debug or develop the IPW2200 driver, you 
-	  most likely want to say N here.
-
 config AIRO
 	tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
 	depends on NET_RADIO && ISA && (PCI || BROKEN)
@@ -459,8 +355,6 @@ config PRISM54
 	  say M here and read <file:Documentation/modules.txt>.  The module
 	  will be called prism54.ko.
 
-source "drivers/net/wireless/hostap/Kconfig"
-
 # yes, this works even when no drivers are selected
 config NET_WIRELESS
 	bool
diff --git a/trunk/drivers/net/wireless/Makefile b/trunk/drivers/net/wireless/Makefile
index 0953cc0cdee6..2b87841322cc 100644
--- a/trunk/drivers/net/wireless/Makefile
+++ b/trunk/drivers/net/wireless/Makefile
@@ -2,10 +2,6 @@
 # Makefile for the Linux Wireless network device drivers.
 #
 
-obj-$(CONFIG_IPW2100) += ipw2100.o
-
-obj-$(CONFIG_IPW2200) += ipw2200.o
-
 obj-$(CONFIG_STRIP) += strip.o
 obj-$(CONFIG_ARLAN) += arlan.o 
 
@@ -32,8 +28,6 @@ obj-$(CONFIG_PCMCIA_ATMEL)      += atmel_cs.o
 
 obj-$(CONFIG_PRISM54)		+= prism54/
 
-obj-$(CONFIG_HOSTAP)		+= hostap/
-
 # 16-bit wireless PCMCIA client drivers
 obj-$(CONFIG_PCMCIA_RAYCS)	+= ray_cs.o
 obj-$(CONFIG_PCMCIA_WL3501)	+= wl3501_cs.o
diff --git a/trunk/drivers/net/wireless/airo.c b/trunk/drivers/net/wireless/airo.c
index 6db1fb6461de..df20adcd0730 100644
--- a/trunk/drivers/net/wireless/airo.c
+++ b/trunk/drivers/net/wireless/airo.c
@@ -1040,7 +1040,7 @@ typedef struct {
 	u16 status;
 } WifiCtlHdr;
 
-static WifiCtlHdr wifictlhdr8023 = {
+WifiCtlHdr wifictlhdr8023 = {
 	.ctlhdr = {
 		.ctl	= HOST_DONT_RLSE,
 	}
@@ -1111,13 +1111,13 @@ static int airo_thread(void *data);
 static void timer_func( struct net_device *dev );
 static int airo_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 #ifdef WIRELESS_EXT
-static struct iw_statistics *airo_get_wireless_stats (struct net_device *dev);
+struct iw_statistics *airo_get_wireless_stats (struct net_device *dev);
 static void airo_read_wireless_stats (struct airo_info *local);
 #endif /* WIRELESS_EXT */
 #ifdef CISCO_EXT
 static int readrids(struct net_device *dev, aironet_ioctl *comp);
 static int writerids(struct net_device *dev, aironet_ioctl *comp);
-static int flashcard(struct net_device *dev, aironet_ioctl *comp);
+int flashcard(struct net_device *dev, aironet_ioctl *comp);
 #endif /* CISCO_EXT */
 #ifdef MICSUPPORT
 static void micinit(struct airo_info *ai);
@@ -1226,12 +1226,6 @@ static int setup_proc_entry( struct net_device *dev,
 static int takedown_proc_entry( struct net_device *dev,
 				struct airo_info *apriv );
 
-static int cmdreset(struct airo_info *ai);
-static int setflashmode (struct airo_info *ai);
-static int flashgchar(struct airo_info *ai,int matchbyte,int dwelltime);
-static int flashputbuf(struct airo_info *ai);
-static int flashrestart(struct airo_info *ai,struct net_device *dev);
-
 #ifdef MICSUPPORT
 /***********************************************************************
  *                              MIC ROUTINES                           *
@@ -1240,11 +1234,10 @@ static int flashrestart(struct airo_info *ai,struct net_device *dev);
 
 static int RxSeqValid (struct airo_info *ai,miccntx *context,int mcast,u32 micSeq);
 static void MoveWindow(miccntx *context, u32 micSeq);
-static void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen, struct crypto_tfm *);
-static void emmh32_init(emmh32_context *context);
-static void emmh32_update(emmh32_context *context, u8 *pOctets, int len);
-static void emmh32_final(emmh32_context *context, u8 digest[4]);
-static int flashpchar(struct airo_info *ai,int byte,int dwelltime);
+void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen, struct crypto_tfm *);
+void emmh32_init(emmh32_context *context);
+void emmh32_update(emmh32_context *context, u8 *pOctets, int len);
+void emmh32_final(emmh32_context *context, u8 digest[4]);
 
 /* micinit - Initialize mic seed */
 
@@ -1322,7 +1315,7 @@ static int micsetup(struct airo_info *ai) {
 	return SUCCESS;
 }
 
-static char micsnap[] = {0xAA,0xAA,0x03,0x00,0x40,0x96,0x00,0x02};
+char micsnap[]= {0xAA,0xAA,0x03,0x00,0x40,0x96,0x00,0x02};
 
 /*===========================================================================
  * Description: Mic a packet
@@ -1577,7 +1570,7 @@ static void MoveWindow(miccntx *context, u32 micSeq)
 static unsigned char aes_counter[16];
 
 /* expand the key to fill the MMH coefficient array */
-static void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen, struct crypto_tfm *tfm)
+void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen, struct crypto_tfm *tfm)
 {
   /* take the keying material, expand if necessary, truncate at 16-bytes */
   /* run through AES counter mode to generate context->coeff[] */
@@ -1609,7 +1602,7 @@ static void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen, struct
 }
 
 /* prepare for calculation of a new mic */
-static void emmh32_init(emmh32_context *context)
+void emmh32_init(emmh32_context *context)
 {
 	/* prepare for new mic calculation */
 	context->accum = 0;
@@ -1617,7 +1610,7 @@ static void emmh32_init(emmh32_context *context)
 }
 
 /* add some bytes to the mic calculation */
-static void emmh32_update(emmh32_context *context, u8 *pOctets, int len)
+void emmh32_update(emmh32_context *context, u8 *pOctets, int len)
 {
 	int	coeff_position, byte_position;
   
@@ -1659,7 +1652,7 @@ static void emmh32_update(emmh32_context *context, u8 *pOctets, int len)
 static u32 mask32[4] = { 0x00000000L, 0xFF000000L, 0xFFFF0000L, 0xFFFFFF00L };
 
 /* calculate the mic */
-static void emmh32_final(emmh32_context *context, u8 digest[4])
+void emmh32_final(emmh32_context *context, u8 digest[4])
 {
 	int	coeff_position, byte_position;
 	u32	val;
@@ -2262,7 +2255,7 @@ static void airo_read_stats(struct airo_info *ai) {
 	ai->stats.rx_fifo_errors = vals[0];
 }
 
-static struct net_device_stats *airo_get_stats(struct net_device *dev)
+struct net_device_stats *airo_get_stats(struct net_device *dev)
 {
 	struct airo_info *local =  dev->priv;
 
@@ -2421,7 +2414,7 @@ EXPORT_SYMBOL(stop_airo_card);
 
 static int add_airo_dev( struct net_device *dev );
 
-static int wll_header_parse(struct sk_buff *skb, unsigned char *haddr)
+int wll_header_parse(struct sk_buff *skb, unsigned char *haddr)
 {
 	memcpy(haddr, skb->mac.raw + 10, ETH_ALEN);
 	return ETH_ALEN;
@@ -2688,7 +2681,7 @@ static struct net_device *init_wifidev(struct airo_info *ai,
 	return dev;
 }
 
-static int reset_card( struct net_device *dev , int lock) {
+int reset_card( struct net_device *dev , int lock) {
 	struct airo_info *ai = dev->priv;
 
 	if (lock && down_interruptible(&ai->sem))
@@ -2703,9 +2696,9 @@ static int reset_card( struct net_device *dev , int lock) {
 	return 0;
 }
 
-static struct net_device *_init_airo_card( unsigned short irq, int port,
-					   int is_pcmcia, struct pci_dev *pci,
-					   struct device *dmdev )
+struct net_device *_init_airo_card( unsigned short irq, int port,
+				    int is_pcmcia, struct pci_dev *pci,
+				    struct device *dmdev )
 {
 	struct net_device *dev;
 	struct airo_info *ai;
@@ -7242,7 +7235,7 @@ static void airo_read_wireless_stats(struct airo_info *local)
 	local->wstats.miss.beacon = vals[34];
 }
 
-static struct iw_statistics *airo_get_wireless_stats(struct net_device *dev)
+struct iw_statistics *airo_get_wireless_stats(struct net_device *dev)
 {
 	struct airo_info *local =  dev->priv;
 
@@ -7457,8 +7450,14 @@ static int writerids(struct net_device *dev, aironet_ioctl *comp) {
  * Flash command switch table
  */
 
-static int flashcard(struct net_device *dev, aironet_ioctl *comp) {
+int flashcard(struct net_device *dev, aironet_ioctl *comp) {
 	int z;
+	int cmdreset(struct airo_info *);
+	int setflashmode(struct airo_info *);
+	int flashgchar(struct airo_info *,int,int);
+	int flashpchar(struct airo_info *,int,int);
+	int flashputbuf(struct airo_info *);
+	int flashrestart(struct airo_info *,struct net_device *);
 
 	/* Only super-user can modify flash */
 	if (!capable(CAP_NET_ADMIN))
@@ -7516,7 +7515,7 @@ static int flashcard(struct net_device *dev, aironet_ioctl *comp) {
  * card.
  */
 
-static int cmdreset(struct airo_info *ai) {
+int cmdreset(struct airo_info *ai) {
 	disable_MAC(ai, 1);
 
 	if(!waitbusy (ai)){
@@ -7540,7 +7539,7 @@ static int cmdreset(struct airo_info *ai) {
  * mode
  */
 
-static int setflashmode (struct airo_info *ai) {
+int setflashmode (struct airo_info *ai) {
 	set_bit (FLAG_FLASHING, &ai->flags);
 
 	OUT4500(ai, SWS0, FLASH_COMMAND);
@@ -7567,7 +7566,7 @@ static int setflashmode (struct airo_info *ai) {
  * x 50us for  echo .
  */
 
-static int flashpchar(struct airo_info *ai,int byte,int dwelltime) {
+int flashpchar(struct airo_info *ai,int byte,int dwelltime) {
 	int echo;
 	int waittime;
 
@@ -7607,7 +7606,7 @@ static int flashpchar(struct airo_info *ai,int byte,int dwelltime) {
  * Get a character from the card matching matchbyte
  * Step 3)
  */
-static int flashgchar(struct airo_info *ai,int matchbyte,int dwelltime){
+int flashgchar(struct airo_info *ai,int matchbyte,int dwelltime){
 	int           rchar;
 	unsigned char rbyte=0;
 
@@ -7638,7 +7637,7 @@ static int flashgchar(struct airo_info *ai,int matchbyte,int dwelltime){
  * send to the card
  */
 
-static int flashputbuf(struct airo_info *ai){
+int flashputbuf(struct airo_info *ai){
 	int            nwords;
 
 	/* Write stuff */
@@ -7660,7 +7659,7 @@ static int flashputbuf(struct airo_info *ai){
 /*
  *
  */
-static int flashrestart(struct airo_info *ai,struct net_device *dev){
+int flashrestart(struct airo_info *ai,struct net_device *dev){
 	int    i,status;
 
 	ssleep(1);			/* Added 12/7/00 */
diff --git a/trunk/drivers/net/wireless/atmel.c b/trunk/drivers/net/wireless/atmel.c
index f48a6e729224..18a7d38d2a13 100644
--- a/trunk/drivers/net/wireless/atmel.c
+++ b/trunk/drivers/net/wireless/atmel.c
@@ -68,7 +68,7 @@
 #include <linux/device.h>
 #include <linux/moduleparam.h>
 #include <linux/firmware.h>
-#include <net/ieee80211.h>
+#include "ieee802_11.h"
 #include "atmel.h"
 
 #define DRIVER_MAJOR 0
@@ -618,12 +618,12 @@ static int atmel_lock_mac(struct atmel_private *priv);
 static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data);
 static void atmel_command_irq(struct atmel_private *priv);
 static int atmel_validate_channel(struct atmel_private *priv, int channel);
-static void atmel_management_frame(struct atmel_private *priv, struct ieee80211_hdr *header, 
+static void atmel_management_frame(struct atmel_private *priv, struct ieee802_11_hdr *header, 
 				   u16 frame_len, u8 rssi);
 static void atmel_management_timer(u_long a);
 static void atmel_send_command(struct atmel_private *priv, int command, void *cmd, int cmd_size);
 static int atmel_send_command_wait(struct atmel_private *priv, int command, void *cmd, int cmd_size);
-static void atmel_transmit_management_frame(struct atmel_private *priv, struct ieee80211_hdr *header,
+static void atmel_transmit_management_frame(struct atmel_private *priv, struct ieee802_11_hdr *header,
 					    u8 *body, int body_len);
 
 static u8 atmel_get_mib8(struct atmel_private *priv, u8 type, u8 index);
@@ -827,7 +827,7 @@ static void tx_update_descriptor(struct atmel_private *priv, int is_bcast, u16 l
 static int start_tx (struct sk_buff *skb, struct net_device *dev)
 {
 	struct atmel_private *priv = netdev_priv(dev);
-	struct ieee80211_hdr header;
+	struct ieee802_11_hdr header;
 	unsigned long flags;
 	u16 buff, frame_ctl, len = (ETH_ZLEN < skb->len) ? skb->len : ETH_ZLEN;
 	u8 SNAP_RFC1024[6] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
@@ -863,17 +863,17 @@ static int start_tx (struct sk_buff *skb, struct net_device *dev)
 		return 1;
 	}
 	
-	frame_ctl = IEEE80211_FTYPE_DATA;
+	frame_ctl = IEEE802_11_FTYPE_DATA;
 	header.duration_id = 0;
 	header.seq_ctl = 0;
 	if (priv->wep_is_on)
-		frame_ctl |= IEEE80211_FCTL_PROTECTED;
+		frame_ctl |= IEEE802_11_FCTL_WEP;
 	if (priv->operating_mode == IW_MODE_ADHOC) {
 		memcpy(&header.addr1, skb->data, 6);
 		memcpy(&header.addr2, dev->dev_addr, 6);
 		memcpy(&header.addr3, priv->BSSID, 6);
 	} else {
-		frame_ctl |= IEEE80211_FCTL_TODS;
+		frame_ctl |= IEEE802_11_FCTL_TODS;
 		memcpy(&header.addr1, priv->CurrentBSSID, 6);
 		memcpy(&header.addr2, dev->dev_addr, 6);
 		memcpy(&header.addr3, skb->data, 6);
@@ -902,7 +902,7 @@ static int start_tx (struct sk_buff *skb, struct net_device *dev)
 }
 
 static void atmel_transmit_management_frame(struct atmel_private *priv, 
-					    struct ieee80211_hdr *header,
+					    struct ieee802_11_hdr *header,
 					    u8 *body, int body_len)
 {
 	u16 buff;
@@ -917,7 +917,7 @@ static void atmel_transmit_management_frame(struct atmel_private *priv,
 	tx_update_descriptor(priv, header->addr1[0] & 0x01, len, buff, TX_PACKET_TYPE_MGMT);
 }
 	
-static void fast_rx_path(struct atmel_private *priv, struct ieee80211_hdr *header, 
+static void fast_rx_path(struct atmel_private *priv, struct ieee802_11_hdr *header, 
 			 u16 msdu_size, u16 rx_packet_loc, u32 crc)
 {
 	/* fast path: unfragmented packet copy directly into skbuf */
@@ -955,7 +955,7 @@ static void fast_rx_path(struct atmel_private *priv, struct ieee80211_hdr *heade
 	}
 	
 	memcpy(skbp, header->addr1, 6); /* destination address */
-	if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS) 
+	if (le16_to_cpu(header->frame_ctl) & IEEE802_11_FCTL_FROMDS) 
 		memcpy(&skbp[6], header->addr3, 6);
 	else
 		memcpy(&skbp[6], header->addr2, 6); /* source address */
@@ -990,14 +990,14 @@ static int probe_crc(struct atmel_private *priv, u16 packet_loc, u16 msdu_size)
 	return (crc ^ 0xffffffff) == netcrc;
 }
 
-static void frag_rx_path(struct atmel_private *priv, struct ieee80211_hdr *header, 
+static void frag_rx_path(struct atmel_private *priv, struct ieee802_11_hdr *header, 
 			 u16 msdu_size, u16 rx_packet_loc, u32 crc, u16 seq_no, u8 frag_no, int more_frags)
 {
 	u8 mac4[6]; 
 	u8 source[6];
 	struct sk_buff *skb;
 
-	if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS) 
+	if (le16_to_cpu(header->frame_ctl) & IEEE802_11_FCTL_FROMDS) 
 		memcpy(source, header->addr3, 6);
 	else
 		memcpy(source, header->addr2, 6); 
@@ -1082,7 +1082,7 @@ static void frag_rx_path(struct atmel_private *priv, struct ieee80211_hdr *heade
 static void rx_done_irq(struct atmel_private *priv)
 {
 	int i;
-	struct ieee80211_hdr header;
+	struct ieee802_11_hdr header;
 	
 	for (i = 0; 
 	     atmel_rmem8(priv, atmel_rx(priv, RX_DESC_FLAGS_OFFSET, priv->rx_desc_head)) == RX_DESC_FLAG_VALID &&
@@ -1117,7 +1117,7 @@ static void rx_done_irq(struct atmel_private *priv)
 		/* probe for CRC use here if needed  once five packets have arrived with
 		   the same crc status, we assume we know what's happening and stop probing */
 		if (priv->probe_crc) {
-			if (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED)) {
+			if (!priv->wep_is_on || !(frame_ctl & IEEE802_11_FCTL_WEP)) {
 				priv->do_rx_crc = probe_crc(priv, rx_packet_loc, msdu_size);
 			} else {
 				priv->do_rx_crc = probe_crc(priv, rx_packet_loc + 24, msdu_size - 24);
@@ -1132,16 +1132,16 @@ static void rx_done_irq(struct atmel_private *priv)
 		}
 		    
 		/* don't CRC header when WEP in use */
-		if (priv->do_rx_crc && (!priv->wep_is_on || !(frame_ctl & IEEE80211_FCTL_PROTECTED))) {
+		if (priv->do_rx_crc && (!priv->wep_is_on || !(frame_ctl & IEEE802_11_FCTL_WEP))) {
 			crc = crc32_le(0xffffffff, (unsigned char *)&header, 24);
 		}
 		msdu_size -= 24; /* header */
 
-		if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) { 
+		if ((frame_ctl & IEEE802_11_FCTL_FTYPE) == IEEE802_11_FTYPE_DATA) { 
 			
-			int more_fragments = frame_ctl & IEEE80211_FCTL_MOREFRAGS;
-			u8 packet_fragment_no = seq_control & IEEE80211_SCTL_FRAG;
-			u16 packet_sequence_no = (seq_control & IEEE80211_SCTL_SEQ) >> 4;
+			int more_fragments = frame_ctl & IEEE802_11_FCTL_MOREFRAGS;
+			u8 packet_fragment_no = seq_control & IEEE802_11_SCTL_FRAG;
+			u16 packet_sequence_no = (seq_control & IEEE802_11_SCTL_SEQ) >> 4;
 			
 			if (!more_fragments && packet_fragment_no == 0 ) {
 				fast_rx_path(priv, &header, msdu_size, rx_packet_loc, crc);
@@ -1151,7 +1151,7 @@ static void rx_done_irq(struct atmel_private *priv)
 			}
 		}
 		
-		if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
+		if ((frame_ctl & IEEE802_11_FCTL_FTYPE) == IEEE802_11_FTYPE_MGMT) {
 			/* copy rest of packet into buffer */
 			atmel_copy_to_host(priv->dev, (unsigned char *)&priv->rx_buf, rx_packet_loc + 24, msdu_size);
 			
@@ -2663,10 +2663,10 @@ static void handle_beacon_probe(struct atmel_private *priv, u16 capability, u8 c
  
 static void send_authentication_request(struct atmel_private *priv, u8 *challenge, int challenge_len)
 {
-	struct ieee80211_hdr header;
+	struct ieee802_11_hdr header;
 	struct auth_body auth;
 	
-	header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH); 
+	header.frame_ctl = cpu_to_le16(IEEE802_11_FTYPE_MGMT | IEEE802_11_STYPE_AUTH); 
 	header.duration_id	= cpu_to_le16(0x8000);	
 	header.seq_ctl = 0;
 	memcpy(header.addr1, priv->CurrentBSSID, 6);
@@ -2677,7 +2677,7 @@ static void send_authentication_request(struct atmel_private *priv, u8 *challeng
 		auth.alg = cpu_to_le16(C80211_MGMT_AAN_SHAREDKEY); 
 		/* no WEP for authentication frames with TrSeqNo 1 */
 		if (priv->CurrentAuthentTransactionSeqNum != 1)
-			header.frame_ctl |=  cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+			header.frame_ctl |=  cpu_to_le16(IEEE802_11_FCTL_WEP); 
 	} else {
 		auth.alg = cpu_to_le16(C80211_MGMT_AAN_OPENSYSTEM);
 	}
@@ -2701,7 +2701,7 @@ static void send_association_request(struct atmel_private *priv, int is_reassoc)
 {
 	u8 *ssid_el_p;
 	int bodysize;
-	struct ieee80211_hdr header;
+	struct ieee802_11_hdr header;
 	struct ass_req_format {
 		u16 capability;
 		u16 listen_interval; 
@@ -2714,8 +2714,8 @@ static void send_association_request(struct atmel_private *priv, int is_reassoc)
 		u8 rates[4];
 	} body;
 		
-	header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT | 
-		(is_reassoc ? IEEE80211_STYPE_REASSOC_REQ : IEEE80211_STYPE_ASSOC_REQ));
+	header.frame_ctl = cpu_to_le16(IEEE802_11_FTYPE_MGMT | 
+		(is_reassoc ? IEEE802_11_STYPE_REASSOC_REQ : IEEE802_11_STYPE_ASSOC_REQ));
 	header.duration_id = cpu_to_le16(0x8000);
 	header.seq_ctl = 0;
 
@@ -2751,9 +2751,9 @@ static void send_association_request(struct atmel_private *priv, int is_reassoc)
 	atmel_transmit_management_frame(priv, &header, (void *)&body, bodysize);
 }
 
-static int is_frame_from_current_bss(struct atmel_private *priv, struct ieee80211_hdr *header)
+static int is_frame_from_current_bss(struct atmel_private *priv, struct ieee802_11_hdr *header)
 {
-	if (le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_FROMDS)
+	if (le16_to_cpu(header->frame_ctl) & IEEE802_11_FCTL_FROMDS)
 		return memcmp(header->addr3, priv->CurrentBSSID, 6) == 0;
 	else
 		return memcmp(header->addr2, priv->CurrentBSSID, 6) == 0;
@@ -2801,7 +2801,7 @@ static int retrieve_bss(struct atmel_private *priv)
 }
 
 
-static void store_bss_info(struct atmel_private *priv, struct ieee80211_hdr *header,
+static void store_bss_info(struct atmel_private *priv, struct ieee802_11_hdr *header,
 			   u16 capability, u16 beacon_period, u8 channel, u8 rssi, 
 			   u8 ssid_len, u8 *ssid, int is_beacon)
 {
@@ -3085,12 +3085,12 @@ static void atmel_smooth_qual(struct atmel_private *priv)
 }
 
 /* deals with incoming managment frames. */
-static void atmel_management_frame(struct atmel_private *priv, struct ieee80211_hdr *header, 
+static void atmel_management_frame(struct atmel_private *priv, struct ieee802_11_hdr *header, 
 		      u16 frame_len, u8 rssi)
 {
 	u16 subtype;
 	
-	switch (subtype = le16_to_cpu(header->frame_ctl) & IEEE80211_FCTL_STYPE) {
+	switch (subtype = le16_to_cpu(header->frame_ctl) & IEEE802_11_FCTL_STYPE) {
 	case C80211_SUBTYPE_MGMT_BEACON :
 	case C80211_SUBTYPE_MGMT_ProbeResponse:
 		
diff --git a/trunk/drivers/net/wireless/hostap/Kconfig b/trunk/drivers/net/wireless/hostap/Kconfig
deleted file mode 100644
index 1445f3f2600f..000000000000
--- a/trunk/drivers/net/wireless/hostap/Kconfig
+++ /dev/null
@@ -1,71 +0,0 @@
-config HOSTAP
-	tristate "IEEE 802.11 for Host AP (Prism2/2.5/3 and WEP/TKIP/CCMP)"
-	depends on NET_RADIO
-	---help---
-	Shared driver code for IEEE 802.11b wireless cards based on
-	Intersil Prism2/2.5/3 chipset. This driver supports so called
-	Host AP mode that allows the card to act as an IEEE 802.11
-	access point.
-
-	See <http://hostap.epitest.fi/> for more information about the
-	Host AP driver configuration and tools. This site includes
-	information and tools (hostapd and wpa_supplicant) for WPA/WPA2
-	support.
-
-	This option includes the base Host AP driver code that is shared by
-	different hardware models. You will also need to enable support for
-	PLX/PCI/CS version of the driver to actually use the driver.
-
-	The driver can be compiled as a module and it will be called
-	"hostap.ko".
-
-config HOSTAP_FIRMWARE
-	bool "Support downloading firmware images with Host AP driver"
-	depends on HOSTAP
-	---help---
-	Configure Host AP driver to include support for firmware image
-	download. Current version supports only downloading to volatile, i.e.,
-	RAM memory. Flash upgrade is not yet supported.
-
-	Firmware image downloading needs user space tool, prism2_srec. It is
-	available from http://hostap.epitest.fi/.
-
-config HOSTAP_PLX
-	tristate "Host AP driver for Prism2/2.5/3 in PLX9052 PCI adaptors"
-	depends on PCI && HOSTAP
-	---help---
-	Host AP driver's version for Prism2/2.5/3 PC Cards in PLX9052 based
-	PCI adaptors.
-
-	"Host AP support for Prism2/2.5/3 IEEE 802.11b" is required for this
-	driver and its help text includes more information about the Host AP
-	driver.
-
-	The driver can be compiled as a module and will be named
-	"hostap_plx.ko".
-
-config HOSTAP_PCI
-	tristate "Host AP driver for Prism2.5 PCI adaptors"
-	depends on PCI && HOSTAP
-	---help---
-	Host AP driver's version for Prism2.5 PCI adaptors.
-
-	"Host AP support for Prism2/2.5/3 IEEE 802.11b" is required for this
-	driver and its help text includes more information about the Host AP
-	driver.
-
-	The driver can be compiled as a module and will be named
-	"hostap_pci.ko".
-
-config HOSTAP_CS
-	tristate "Host AP driver for Prism2/2.5/3 PC Cards"
-	depends on PCMCIA!=n && HOSTAP
-	---help---
-	Host AP driver's version for Prism2/2.5/3 PC Cards.
-
-	"Host AP support for Prism2/2.5/3 IEEE 802.11b" is required for this
-	driver and its help text includes more information about the Host AP
-	driver.
-
-	The driver can be compiled as a module and will be named
-	"hostap_cs.ko".
diff --git a/trunk/drivers/net/wireless/hostap/Makefile b/trunk/drivers/net/wireless/hostap/Makefile
deleted file mode 100644
index fc62235bfc24..000000000000
--- a/trunk/drivers/net/wireless/hostap/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-obj-$(CONFIG_HOSTAP) += hostap.o
-
-obj-$(CONFIG_HOSTAP_CS) += hostap_cs.o
-obj-$(CONFIG_HOSTAP_PLX) += hostap_plx.o
-obj-$(CONFIG_HOSTAP_PCI) += hostap_pci.o
diff --git a/trunk/drivers/net/wireless/hostap/hostap.c b/trunk/drivers/net/wireless/hostap/hostap.c
deleted file mode 100644
index e7f5821b4942..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap.c
+++ /dev/null
@@ -1,1198 +0,0 @@
-/*
- * Host AP (software wireless LAN access point) driver for
- * Intersil Prism2/2.5/3 - hostap.o module, common routines
- *
- * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
- * <jkmaline@cc.hut.fi>
- * Copyright (c) 2002-2005, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-
-#include <linux/config.h>
-#include <linux/version.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/proc_fs.h>
-#include <linux/if_arp.h>
-#include <linux/delay.h>
-#include <linux/random.h>
-#include <linux/workqueue.h>
-#include <linux/kmod.h>
-#include <linux/rtnetlink.h>
-#include <linux/wireless.h>
-#include <net/iw_handler.h>
-#include <net/ieee80211.h>
-#include <net/ieee80211_crypt.h>
-#include <asm/uaccess.h>
-
-#include "hostap_wlan.h"
-#include "hostap_80211.h"
-#include "hostap_ap.h"
-#include "hostap.h"
-
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Host AP common routines");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(PRISM2_VERSION);
-
-#define TX_TIMEOUT (2 * HZ)
-
-#define PRISM2_MAX_FRAME_SIZE 2304
-#define PRISM2_MIN_MTU 256
-/* FIX: */
-#define PRISM2_MAX_MTU (PRISM2_MAX_FRAME_SIZE - (6 /* LLC */ + 8 /* WEP */))
-
-
-/* hostap.c */
-static int prism2_wds_add(local_info_t *local, u8 *remote_addr,
-			  int rtnl_locked);
-static int prism2_wds_del(local_info_t *local, u8 *remote_addr,
-			  int rtnl_locked, int do_not_remove);
-
-/* hostap_ap.c */
-static int prism2_ap_get_sta_qual(local_info_t *local, struct sockaddr addr[],
-				  struct iw_quality qual[], int buf_size,
-				  int aplist);
-static int prism2_ap_translate_scan(struct net_device *dev, char *buffer);
-static int prism2_hostapd(struct ap_data *ap,
-			  struct prism2_hostapd_param *param);
-static void * ap_crypt_get_ptrs(struct ap_data *ap, u8 *addr, int permanent,
-				struct ieee80211_crypt_data ***crypt);
-static void ap_control_kickall(struct ap_data *ap);
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-static int ap_control_add_mac(struct mac_restrictions *mac_restrictions,
-			      u8 *mac);
-static int ap_control_del_mac(struct mac_restrictions *mac_restrictions,
-			      u8 *mac);
-static void ap_control_flush_macs(struct mac_restrictions *mac_restrictions);
-static int ap_control_kick_mac(struct ap_data *ap, struct net_device *dev,
-			       u8 *mac);
-#endif /* !PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-static const long freq_list[] = { 2412, 2417, 2422, 2427, 2432, 2437, 2442,
-				  2447, 2452, 2457, 2462, 2467, 2472, 2484 };
-#define FREQ_COUNT (sizeof(freq_list) / sizeof(freq_list[0]))
-
-
-/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
-/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
-static unsigned char rfc1042_header[] =
-{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
-/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
-static unsigned char bridge_tunnel_header[] =
-{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
-/* No encapsulation header if EtherType < 0x600 (=length) */
-
-
-/* FIX: these could be compiled separately and linked together to hostap.o */
-#include "hostap_ap.c"
-#include "hostap_info.c"
-#include "hostap_ioctl.c"
-#include "hostap_proc.c"
-#include "hostap_80211_rx.c"
-#include "hostap_80211_tx.c"
-
-
-struct net_device * hostap_add_interface(struct local_info *local,
-					 int type, int rtnl_locked,
-					 const char *prefix,
-					 const char *name)
-{
-	struct net_device *dev, *mdev;
-	struct hostap_interface *iface;
-	int ret;
-
-	dev = alloc_etherdev(sizeof(struct hostap_interface));
-	if (dev == NULL)
-		return NULL;
-
-	iface = netdev_priv(dev);
-	iface->dev = dev;
-	iface->local = local;
-	iface->type = type;
-	list_add(&iface->list, &local->hostap_interfaces);
-
-	mdev = local->dev;
-	memcpy(dev->dev_addr, mdev->dev_addr, ETH_ALEN);
-	dev->base_addr = mdev->base_addr;
-	dev->irq = mdev->irq;
-	dev->mem_start = mdev->mem_start;
-	dev->mem_end = mdev->mem_end;
-
-	hostap_setup_dev(dev, local, 0);
-	dev->destructor = free_netdev;
-
-	sprintf(dev->name, "%s%s", prefix, name);
-	if (!rtnl_locked)
-		rtnl_lock();
-
-	ret = 0;
-	if (strchr(dev->name, '%'))
-		ret = dev_alloc_name(dev, dev->name);
-
-	SET_NETDEV_DEV(dev, mdev->class_dev.dev);
-	if (ret >= 0)
-		ret = register_netdevice(dev);
-
-	if (!rtnl_locked)
-		rtnl_unlock();
-
-	if (ret < 0) {
-		printk(KERN_WARNING "%s: failed to add new netdevice!\n",
-		       dev->name);
-		free_netdev(dev);
-		return NULL;
-	}
-
-	printk(KERN_DEBUG "%s: registered netdevice %s\n",
-	       mdev->name, dev->name);
-
-	return dev;
-}
-
-
-void hostap_remove_interface(struct net_device *dev, int rtnl_locked,
-			     int remove_from_list)
-{
-	struct hostap_interface *iface;
-
-	if (!dev)
-		return;
-
-	iface = netdev_priv(dev);
-
-	if (remove_from_list) {
-		list_del(&iface->list);
-	}
-
-	if (dev == iface->local->ddev)
-		iface->local->ddev = NULL;
-	else if (dev == iface->local->apdev)
-		iface->local->apdev = NULL;
-	else if (dev == iface->local->stadev)
-		iface->local->stadev = NULL;
-
-	if (rtnl_locked)
-		unregister_netdevice(dev);
-	else
-		unregister_netdev(dev);
-
-	/* dev->destructor = free_netdev() will free the device data, including
-	 * private data, when removing the device */
-}
-
-
-static inline int prism2_wds_special_addr(u8 *addr)
-{
-	if (addr[0] || addr[1] || addr[2] || addr[3] || addr[4] || addr[5])
-		return 0;
-
-	return 1;
-}
-
-
-static int prism2_wds_add(local_info_t *local, u8 *remote_addr,
-			  int rtnl_locked)
-{
-	struct net_device *dev;
-	struct list_head *ptr;
-	struct hostap_interface *iface, *empty, *match;
-
-	empty = match = NULL;
-	read_lock_bh(&local->iface_lock);
-	list_for_each(ptr, &local->hostap_interfaces) {
-		iface = list_entry(ptr, struct hostap_interface, list);
-		if (iface->type != HOSTAP_INTERFACE_WDS)
-			continue;
-
-		if (prism2_wds_special_addr(iface->u.wds.remote_addr))
-			empty = iface;
-		else if (memcmp(iface->u.wds.remote_addr, remote_addr,
-				ETH_ALEN) == 0) {
-			match = iface;
-			break;
-		}
-	}
-	if (!match && empty && !prism2_wds_special_addr(remote_addr)) {
-		/* take pre-allocated entry into use */
-		memcpy(empty->u.wds.remote_addr, remote_addr, ETH_ALEN);
-		read_unlock_bh(&local->iface_lock);
-		printk(KERN_DEBUG "%s: using pre-allocated WDS netdevice %s\n",
-		       local->dev->name, empty->dev->name);
-		return 0;
-	}
-	read_unlock_bh(&local->iface_lock);
-
-	if (!prism2_wds_special_addr(remote_addr)) {
-		if (match)
-			return -EEXIST;
-		hostap_add_sta(local->ap, remote_addr);
-	}
-
-	if (local->wds_connections >= local->wds_max_connections)
-		return -ENOBUFS;
-
-	/* verify that there is room for wds# postfix in the interface name */
-	if (strlen(local->dev->name) > IFNAMSIZ - 5) {
-		printk(KERN_DEBUG "'%s' too long base device name\n",
-		       local->dev->name);
-		return -EINVAL;
-	}
-
-	dev = hostap_add_interface(local, HOSTAP_INTERFACE_WDS, rtnl_locked,
-				   local->ddev->name, "wds%d");
-	if (dev == NULL)
-		return -ENOMEM;
-
-	iface = netdev_priv(dev);
-	memcpy(iface->u.wds.remote_addr, remote_addr, ETH_ALEN);
-
-	local->wds_connections++;
-
-	return 0;
-}
-
-
-static int prism2_wds_del(local_info_t *local, u8 *remote_addr,
-			  int rtnl_locked, int do_not_remove)
-{
-	unsigned long flags;
-	struct list_head *ptr;
-	struct hostap_interface *iface, *selected = NULL;
-
-	write_lock_irqsave(&local->iface_lock, flags);
-	list_for_each(ptr, &local->hostap_interfaces) {
-		iface = list_entry(ptr, struct hostap_interface, list);
-		if (iface->type != HOSTAP_INTERFACE_WDS)
-			continue;
-
-		if (memcmp(iface->u.wds.remote_addr, remote_addr,
-			   ETH_ALEN) == 0) {
-			selected = iface;
-			break;
-		}
-	}
-	if (selected && !do_not_remove)
-		list_del(&selected->list);
-	write_unlock_irqrestore(&local->iface_lock, flags);
-
-	if (selected) {
-		if (do_not_remove)
-			memset(selected->u.wds.remote_addr, 0, ETH_ALEN);
-		else {
-			hostap_remove_interface(selected->dev, rtnl_locked, 0);
-			local->wds_connections--;
-		}
-	}
-
-	return selected ? 0 : -ENODEV;
-}
-
-
-u16 hostap_tx_callback_register(local_info_t *local,
-				void (*func)(struct sk_buff *, int ok, void *),
-				void *data)
-{
-	unsigned long flags;
-	struct hostap_tx_callback_info *entry;
-
-	entry = (struct hostap_tx_callback_info *) kmalloc(sizeof(*entry),
-							   GFP_ATOMIC);
-	if (entry == NULL)
-		return 0;
-
-	entry->func = func;
-	entry->data = data;
-
-	spin_lock_irqsave(&local->lock, flags);
-	entry->idx = local->tx_callback ? local->tx_callback->idx + 1 : 1;
-	entry->next = local->tx_callback;
-	local->tx_callback = entry;
-	spin_unlock_irqrestore(&local->lock, flags);
-
-	return entry->idx;
-}
-
-
-int hostap_tx_callback_unregister(local_info_t *local, u16 idx)
-{
-	unsigned long flags;
-	struct hostap_tx_callback_info *cb, *prev = NULL;
-
-	spin_lock_irqsave(&local->lock, flags);
-	cb = local->tx_callback;
-	while (cb != NULL && cb->idx != idx) {
-		prev = cb;
-		cb = cb->next;
-	}
-	if (cb) {
-		if (prev == NULL)
-			local->tx_callback = cb->next;
-		else
-			prev->next = cb->next;
-		kfree(cb);
-	}
-	spin_unlock_irqrestore(&local->lock, flags);
-
-	return cb ? 0 : -1;
-}
-
-
-/* val is in host byte order */
-int hostap_set_word(struct net_device *dev, int rid, u16 val)
-{
-	struct hostap_interface *iface;
-	u16 tmp = cpu_to_le16(val);
-	iface = netdev_priv(dev);
-	return iface->local->func->set_rid(dev, rid, &tmp, 2);
-}
-
-
-int hostap_set_string(struct net_device *dev, int rid, const char *val)
-{
-	struct hostap_interface *iface;
-	char buf[MAX_SSID_LEN + 2];
-	int len;
-
-	iface = netdev_priv(dev);
-	len = strlen(val);
-	if (len > MAX_SSID_LEN)
-		return -1;
-	memset(buf, 0, sizeof(buf));
-	buf[0] = len; /* little endian 16 bit word */
-	memcpy(buf + 2, val, len);
-
-	return iface->local->func->set_rid(dev, rid, &buf, MAX_SSID_LEN + 2);
-}
-
-
-u16 hostap_get_porttype(local_info_t *local)
-{
-	if (local->iw_mode == IW_MODE_ADHOC && local->pseudo_adhoc)
-		return HFA384X_PORTTYPE_PSEUDO_IBSS;
-	if (local->iw_mode == IW_MODE_ADHOC)
-		return HFA384X_PORTTYPE_IBSS;
-	if (local->iw_mode == IW_MODE_INFRA)
-		return HFA384X_PORTTYPE_BSS;
-	if (local->iw_mode == IW_MODE_REPEAT)
-		return HFA384X_PORTTYPE_WDS;
-	if (local->iw_mode == IW_MODE_MONITOR)
-		return HFA384X_PORTTYPE_PSEUDO_IBSS;
-	return HFA384X_PORTTYPE_HOSTAP;
-}
-
-
-int hostap_set_encryption(local_info_t *local)
-{
-	u16 val, old_val;
-	int i, keylen, len, idx;
-	char keybuf[WEP_KEY_LEN + 1];
-	enum { NONE, WEP, OTHER } encrypt_type;
-
-	idx = local->tx_keyidx;
-	if (local->crypt[idx] == NULL || local->crypt[idx]->ops == NULL)
-		encrypt_type = NONE;
-	else if (strcmp(local->crypt[idx]->ops->name, "WEP") == 0)
-		encrypt_type = WEP;
-	else
-		encrypt_type = OTHER;
-
-	if (local->func->get_rid(local->dev, HFA384X_RID_CNFWEPFLAGS, &val, 2,
-				 1) < 0) {
-		printk(KERN_DEBUG "Could not read current WEP flags.\n");
-		goto fail;
-	}
-	le16_to_cpus(&val);
-	old_val = val;
-
-	if (encrypt_type != NONE || local->privacy_invoked)
-		val |= HFA384X_WEPFLAGS_PRIVACYINVOKED;
-	else
-		val &= ~HFA384X_WEPFLAGS_PRIVACYINVOKED;
-
-	if (local->open_wep || encrypt_type == NONE ||
-	    ((local->ieee_802_1x || local->wpa) && local->host_decrypt))
-		val &= ~HFA384X_WEPFLAGS_EXCLUDEUNENCRYPTED;
-	else
-		val |= HFA384X_WEPFLAGS_EXCLUDEUNENCRYPTED;
-
-	if ((encrypt_type != NONE || local->privacy_invoked) &&
-	    (encrypt_type == OTHER || local->host_encrypt))
-		val |= HFA384X_WEPFLAGS_HOSTENCRYPT;
-	else
-		val &= ~HFA384X_WEPFLAGS_HOSTENCRYPT;
-	if ((encrypt_type != NONE || local->privacy_invoked) &&
-	    (encrypt_type == OTHER || local->host_decrypt))
-		val |= HFA384X_WEPFLAGS_HOSTDECRYPT;
-	else
-		val &= ~HFA384X_WEPFLAGS_HOSTDECRYPT;
-
-	if (val != old_val &&
-	    hostap_set_word(local->dev, HFA384X_RID_CNFWEPFLAGS, val)) {
-		printk(KERN_DEBUG "Could not write new WEP flags (0x%x)\n",
-		       val);
-		goto fail;
-	}
-
-	if (encrypt_type != WEP)
-		return 0;
-
-	/* 104-bit support seems to require that all the keys are set to the
-	 * same keylen */
-	keylen = 6; /* first 5 octets */
-	len = local->crypt[idx]->ops->get_key(keybuf, sizeof(keybuf),
-					      NULL, local->crypt[idx]->priv);
-	if (idx >= 0 && idx < WEP_KEYS && len > 5)
-		keylen = WEP_KEY_LEN + 1; /* first 13 octets */
-
-	for (i = 0; i < WEP_KEYS; i++) {
-		memset(keybuf, 0, sizeof(keybuf));
-		if (local->crypt[i]) {
-			(void) local->crypt[i]->ops->get_key(
-				keybuf, sizeof(keybuf),
-				NULL, local->crypt[i]->priv);
-		}
-		if (local->func->set_rid(local->dev,
-					 HFA384X_RID_CNFDEFAULTKEY0 + i,
-					 keybuf, keylen)) {
-			printk(KERN_DEBUG "Could not set key %d (len=%d)\n",
-			       i, keylen);
-			goto fail;
-		}
-	}
-	if (hostap_set_word(local->dev, HFA384X_RID_CNFWEPDEFAULTKEYID, idx)) {
-		printk(KERN_DEBUG "Could not set default keyid %d\n", idx);
-		goto fail;
-	}
-
-	return 0;
-
- fail:
-	printk(KERN_DEBUG "%s: encryption setup failed\n", local->dev->name);
-	return -1;
-}
-
-
-int hostap_set_antsel(local_info_t *local)
-{
-	u16 val;
-	int ret = 0;
-
-	if (local->antsel_tx != HOSTAP_ANTSEL_DO_NOT_TOUCH &&
-	    local->func->cmd(local->dev, HFA384X_CMDCODE_READMIF,
-			     HFA386X_CR_TX_CONFIGURE,
-			     NULL, &val) == 0) {
-		val &= ~(BIT(2) | BIT(1));
-		switch (local->antsel_tx) {
-		case HOSTAP_ANTSEL_DIVERSITY:
-			val |= BIT(1);
-			break;
-		case HOSTAP_ANTSEL_LOW:
-			break;
-		case HOSTAP_ANTSEL_HIGH:
-			val |= BIT(2);
-			break;
-		}
-
-		if (local->func->cmd(local->dev, HFA384X_CMDCODE_WRITEMIF,
-				     HFA386X_CR_TX_CONFIGURE, &val, NULL)) {
-			printk(KERN_INFO "%s: setting TX AntSel failed\n",
-			       local->dev->name);
-			ret = -1;
-		}
-	}
-
-	if (local->antsel_rx != HOSTAP_ANTSEL_DO_NOT_TOUCH &&
-	    local->func->cmd(local->dev, HFA384X_CMDCODE_READMIF,
-			     HFA386X_CR_RX_CONFIGURE,
-			     NULL, &val) == 0) {
-		val &= ~(BIT(1) | BIT(0));
-		switch (local->antsel_rx) {
-		case HOSTAP_ANTSEL_DIVERSITY:
-			break;
-		case HOSTAP_ANTSEL_LOW:
-			val |= BIT(0);
-			break;
-		case HOSTAP_ANTSEL_HIGH:
-			val |= BIT(0) | BIT(1);
-			break;
-		}
-
-		if (local->func->cmd(local->dev, HFA384X_CMDCODE_WRITEMIF,
-				     HFA386X_CR_RX_CONFIGURE, &val, NULL)) {
-			printk(KERN_INFO "%s: setting RX AntSel failed\n",
-			       local->dev->name);
-			ret = -1;
-		}
-	}
-
-	return ret;
-}
-
-
-int hostap_set_roaming(local_info_t *local)
-{
-	u16 val;
-
-	switch (local->host_roaming) {
-	case 1:
-		val = HFA384X_ROAMING_HOST;
-		break;
-	case 2:
-		val = HFA384X_ROAMING_DISABLED;
-		break;
-	case 0:
-	default:
-		val = HFA384X_ROAMING_FIRMWARE;
-		break;
-	}
-
-	return hostap_set_word(local->dev, HFA384X_RID_CNFROAMINGMODE, val);
-}
-
-
-int hostap_set_auth_algs(local_info_t *local)
-{
-	int val = local->auth_algs;
-	/* At least STA f/w v0.6.2 seems to have issues with cnfAuthentication
-	 * set to include both Open and Shared Key flags. It tries to use
-	 * Shared Key authentication in that case even if WEP keys are not
-	 * configured.. STA f/w v0.7.6 is able to handle such configuration,
-	 * but it is unknown when this was fixed between 0.6.2 .. 0.7.6. */
-	if (local->sta_fw_ver < PRISM2_FW_VER(0,7,0) &&
-	    val != PRISM2_AUTH_OPEN && val != PRISM2_AUTH_SHARED_KEY)
-		val = PRISM2_AUTH_OPEN;
-
-	if (hostap_set_word(local->dev, HFA384X_RID_CNFAUTHENTICATION, val)) {
-		printk(KERN_INFO "%s: cnfAuthentication setting to 0x%x "
-		       "failed\n", local->dev->name, local->auth_algs);
-		return -EINVAL;
-	}
-
-	return 0;
-}
-
-
-void hostap_dump_rx_header(const char *name, const struct hfa384x_rx_frame *rx)
-{
-	u16 status, fc;
-
-	status = __le16_to_cpu(rx->status);
-
-	printk(KERN_DEBUG "%s: RX status=0x%04x (port=%d, type=%d, "
-	       "fcserr=%d) silence=%d signal=%d rate=%d rxflow=%d; "
-	       "jiffies=%ld\n",
-	       name, status, (status >> 8) & 0x07, status >> 13, status & 1,
-	       rx->silence, rx->signal, rx->rate, rx->rxflow, jiffies);
-
-	fc = __le16_to_cpu(rx->frame_control);
-	printk(KERN_DEBUG "   FC=0x%04x (type=%d:%d) dur=0x%04x seq=0x%04x "
-	       "data_len=%d%s%s\n",
-	       fc, WLAN_FC_GET_TYPE(fc) >> 2, WLAN_FC_GET_STYPE(fc) >> 4,
-	       __le16_to_cpu(rx->duration_id), __le16_to_cpu(rx->seq_ctrl),
-	       __le16_to_cpu(rx->data_len),
-	       fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "",
-	       fc & IEEE80211_FCTL_FROMDS ? " [FromDS]" : "");
-
-	printk(KERN_DEBUG "   A1=" MACSTR " A2=" MACSTR " A3=" MACSTR " A4="
-	       MACSTR "\n",
-	       MAC2STR(rx->addr1), MAC2STR(rx->addr2), MAC2STR(rx->addr3),
-	       MAC2STR(rx->addr4));
-
-	printk(KERN_DEBUG "   dst=" MACSTR " src=" MACSTR " len=%d\n",
-	       MAC2STR(rx->dst_addr), MAC2STR(rx->src_addr),
-	       __be16_to_cpu(rx->len));
-}
-
-
-void hostap_dump_tx_header(const char *name, const struct hfa384x_tx_frame *tx)
-{
-	u16 fc;
-
-	printk(KERN_DEBUG "%s: TX status=0x%04x retry_count=%d tx_rate=%d "
-	       "tx_control=0x%04x; jiffies=%ld\n",
-	       name, __le16_to_cpu(tx->status), tx->retry_count, tx->tx_rate,
-	       __le16_to_cpu(tx->tx_control), jiffies);
-
-	fc = __le16_to_cpu(tx->frame_control);
-	printk(KERN_DEBUG "   FC=0x%04x (type=%d:%d) dur=0x%04x seq=0x%04x "
-	       "data_len=%d%s%s\n",
-	       fc, WLAN_FC_GET_TYPE(fc) >> 2, WLAN_FC_GET_STYPE(fc) >> 4,
-	       __le16_to_cpu(tx->duration_id), __le16_to_cpu(tx->seq_ctrl),
-	       __le16_to_cpu(tx->data_len),
-	       fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "",
-	       fc & IEEE80211_FCTL_FROMDS ? " [FromDS]" : "");
-
-	printk(KERN_DEBUG "   A1=" MACSTR " A2=" MACSTR " A3=" MACSTR " A4="
-	       MACSTR "\n",
-	       MAC2STR(tx->addr1), MAC2STR(tx->addr2), MAC2STR(tx->addr3),
-	       MAC2STR(tx->addr4));
-
-	printk(KERN_DEBUG "   dst=" MACSTR " src=" MACSTR " len=%d\n",
-	       MAC2STR(tx->dst_addr), MAC2STR(tx->src_addr),
-	       __be16_to_cpu(tx->len));
-}
-
-
-int hostap_80211_header_parse(struct sk_buff *skb, unsigned char *haddr)
-{
-	memcpy(haddr, skb->mac.raw + 10, ETH_ALEN); /* addr2 */
-	return ETH_ALEN;
-}
-
-
-int hostap_80211_prism_header_parse(struct sk_buff *skb, unsigned char *haddr)
-{
-	if (*(u32 *)skb->mac.raw == LWNG_CAP_DID_BASE) {
-		memcpy(haddr, skb->mac.raw +
-		       sizeof(struct linux_wlan_ng_prism_hdr) + 10,
-		       ETH_ALEN); /* addr2 */
-	} else { /* (*(u32 *)skb->mac.raw == htonl(LWNG_CAPHDR_VERSION)) */
-		memcpy(haddr, skb->mac.raw +
-		       sizeof(struct linux_wlan_ng_cap_hdr) + 10,
-		       ETH_ALEN); /* addr2 */
-	}
-	return ETH_ALEN;
-}
-
-
-int hostap_80211_get_hdrlen(u16 fc)
-{
-	int hdrlen = 24;
-
-	switch (WLAN_FC_GET_TYPE(fc)) {
-	case IEEE80211_FTYPE_DATA:
-		if ((fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS))
-			hdrlen = 30; /* Addr4 */
-		break;
-	case IEEE80211_FTYPE_CTL:
-		switch (WLAN_FC_GET_STYPE(fc)) {
-		case IEEE80211_STYPE_CTS:
-		case IEEE80211_STYPE_ACK:
-			hdrlen = 10;
-			break;
-		default:
-			hdrlen = 16;
-			break;
-		}
-		break;
-	}
-
-	return hdrlen;
-}
-
-
-struct net_device_stats *hostap_get_stats(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	iface = netdev_priv(dev);
-	return &iface->stats;
-}
-
-
-static int prism2_close(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	PDEBUG(DEBUG_FLOW, "%s: prism2_close\n", dev->name);
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (dev == local->ddev) {
-		prism2_sta_deauth(local, WLAN_REASON_DEAUTH_LEAVING);
-	}
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	if (!local->hostapd && dev == local->dev &&
-	    (!local->func->card_present || local->func->card_present(local)) &&
-	    local->hw_ready && local->ap && local->iw_mode == IW_MODE_MASTER)
-		hostap_deauth_all_stas(dev, local->ap, 1);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-	if (local->func->dev_close && local->func->dev_close(local))
-		return 0;
-
-	if (dev == local->dev) {
-		local->func->hw_shutdown(dev, HOSTAP_HW_ENABLE_CMDCOMPL);
-	}
-
-	if (netif_running(dev)) {
-		netif_stop_queue(dev);
-		netif_device_detach(dev);
-	}
-
-	flush_scheduled_work();
-
-	module_put(local->hw_module);
-
-	local->num_dev_open--;
-
-	if (dev != local->dev && local->dev->flags & IFF_UP &&
-	    local->master_dev_auto_open && local->num_dev_open == 1) {
-		/* Close master radio interface automatically if it was also
-		 * opened automatically and we are now closing the last
-		 * remaining non-master device. */
-		dev_close(local->dev);
-	}
-
-	return 0;
-}
-
-
-static int prism2_open(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	PDEBUG(DEBUG_FLOW, "%s: prism2_open\n", dev->name);
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->no_pri) {
-		printk(KERN_DEBUG "%s: could not set interface UP - no PRI "
-		       "f/w\n", dev->name);
-		return 1;
-	}
-
-	if ((local->func->card_present && !local->func->card_present(local)) ||
-	    local->hw_downloading)
-		return -ENODEV;
-
-	if (local->func->dev_open && local->func->dev_open(local))
-		return 1;
-
-	if (!try_module_get(local->hw_module))
-		return -ENODEV;
-	local->num_dev_open++;
-
-	if (!local->dev_enabled && local->func->hw_enable(dev, 1)) {
-		printk(KERN_WARNING "%s: could not enable MAC port\n",
-		       dev->name);
-		prism2_close(dev);
-		return 1;
-	}
-	if (!local->dev_enabled)
-		prism2_callback(local, PRISM2_CALLBACK_ENABLE);
-	local->dev_enabled = 1;
-
-	if (dev != local->dev && !(local->dev->flags & IFF_UP)) {
-		/* Master radio interface is needed for all operation, so open
-		 * it automatically when any virtual net_device is opened. */
-		local->master_dev_auto_open = 1;
-		dev_open(local->dev);
-	}
-
-	netif_device_attach(dev);
-	netif_start_queue(dev);
-
-	return 0;
-}
-
-
-static int prism2_set_mac_address(struct net_device *dev, void *p)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct list_head *ptr;
-	struct sockaddr *addr = p;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->set_rid(dev, HFA384X_RID_CNFOWNMACADDR, addr->sa_data,
-				 ETH_ALEN) < 0 || local->func->reset_port(dev))
-		return -EINVAL;
-
-	read_lock_bh(&local->iface_lock);
-	list_for_each(ptr, &local->hostap_interfaces) {
-		iface = list_entry(ptr, struct hostap_interface, list);
-		memcpy(iface->dev->dev_addr, addr->sa_data, ETH_ALEN);
-	}
-	memcpy(local->dev->dev_addr, addr->sa_data, ETH_ALEN);
-	read_unlock_bh(&local->iface_lock);
-
-	return 0;
-}
-
-
-/* TODO: to be further implemented as soon as Prism2 fully supports
- *       GroupAddresses and correct documentation is available */
-void hostap_set_multicast_list_queue(void *data)
-{
-	struct net_device *dev = (struct net_device *) data;
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	if (hostap_set_word(dev, HFA384X_RID_PROMISCUOUSMODE,
-			    local->is_promisc)) {
-		printk(KERN_INFO "%s: %sabling promiscuous mode failed\n",
-		       dev->name, local->is_promisc ? "en" : "dis");
-	}
-}
-
-
-static void hostap_set_multicast_list(struct net_device *dev)
-{
-#if 0
-	/* FIX: promiscuous mode seems to be causing a lot of problems with
-	 * some station firmware versions (FCSErr frames, invalid MACPort, etc.
-	 * corrupted incoming frames). This code is now commented out while the
-	 * problems are investigated. */
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	if ((dev->flags & IFF_ALLMULTI) || (dev->flags & IFF_PROMISC)) {
-		local->is_promisc = 1;
-	} else {
-		local->is_promisc = 0;
-	}
-
-	schedule_work(&local->set_multicast_list_queue);
-#endif
-}
-
-
-static int prism2_change_mtu(struct net_device *dev, int new_mtu)
-{
-	if (new_mtu < PRISM2_MIN_MTU || new_mtu > PRISM2_MAX_MTU)
-		return -EINVAL;
-
-	dev->mtu = new_mtu;
-	return 0;
-}
-
-
-static void prism2_tx_timeout(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct hfa384x_regs regs;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	printk(KERN_WARNING "%s Tx timed out! Resetting card\n", dev->name);
-	netif_stop_queue(local->dev);
-
-	local->func->read_regs(dev, &regs);
-	printk(KERN_DEBUG "%s: CMD=%04x EVSTAT=%04x "
-	       "OFFSET0=%04x OFFSET1=%04x SWSUPPORT0=%04x\n",
-	       dev->name, regs.cmd, regs.evstat, regs.offset0, regs.offset1,
-	       regs.swsupport0);
-
-	local->func->schedule_reset(local);
-}
-
-
-void hostap_setup_dev(struct net_device *dev, local_info_t *local,
-		      int main_dev)
-{
-	struct hostap_interface *iface;
-
-	iface = netdev_priv(dev);
-	ether_setup(dev);
-
-	/* kernel callbacks */
-	dev->get_stats = hostap_get_stats;
-	if (iface) {
-		/* Currently, we point to the proper spy_data only on
-		 * the main_dev. This could be fixed. Jean II */
-		iface->wireless_data.spy_data = &iface->spy_data;
-		dev->wireless_data = &iface->wireless_data;
-	}
-	dev->wireless_handlers =
-		(struct iw_handler_def *) &hostap_iw_handler_def;
-	dev->do_ioctl = hostap_ioctl;
-	dev->open = prism2_open;
-	dev->stop = prism2_close;
-	dev->hard_start_xmit = hostap_data_start_xmit;
-	dev->set_mac_address = prism2_set_mac_address;
-	dev->set_multicast_list = hostap_set_multicast_list;
-	dev->change_mtu = prism2_change_mtu;
-	dev->tx_timeout = prism2_tx_timeout;
-	dev->watchdog_timeo = TX_TIMEOUT;
-
-	dev->mtu = local->mtu;
-	if (!main_dev) {
-		/* use main radio device queue */
-		dev->tx_queue_len = 0;
-	}
-
-	SET_ETHTOOL_OPS(dev, &prism2_ethtool_ops);
-
-	netif_stop_queue(dev);
-}
-
-
-static int hostap_enable_hostapd(local_info_t *local, int rtnl_locked)
-{
-	struct net_device *dev = local->dev;
-
-	if (local->apdev)
-		return -EEXIST;
-
-	printk(KERN_DEBUG "%s: enabling hostapd mode\n", dev->name);
-
-	local->apdev = hostap_add_interface(local, HOSTAP_INTERFACE_AP,
-					    rtnl_locked, local->ddev->name,
-					    "ap");
-	if (local->apdev == NULL)
-		return -ENOMEM;
-
-	local->apdev->hard_start_xmit = hostap_mgmt_start_xmit;
-	local->apdev->type = ARPHRD_IEEE80211;
-	local->apdev->hard_header_parse = hostap_80211_header_parse;
-
-	return 0;
-}
-
-
-static int hostap_disable_hostapd(local_info_t *local, int rtnl_locked)
-{
-	struct net_device *dev = local->dev;
-
-	printk(KERN_DEBUG "%s: disabling hostapd mode\n", dev->name);
-
-	hostap_remove_interface(local->apdev, rtnl_locked, 1);
-	local->apdev = NULL;
-
-	return 0;
-}
-
-
-static int hostap_enable_hostapd_sta(local_info_t *local, int rtnl_locked)
-{
-	struct net_device *dev = local->dev;
-
-	if (local->stadev)
-		return -EEXIST;
-
-	printk(KERN_DEBUG "%s: enabling hostapd STA mode\n", dev->name);
-
-	local->stadev = hostap_add_interface(local, HOSTAP_INTERFACE_STA,
-					     rtnl_locked, local->ddev->name,
-					     "sta");
-	if (local->stadev == NULL)
-		return -ENOMEM;
-
-	return 0;
-}
-
-
-static int hostap_disable_hostapd_sta(local_info_t *local, int rtnl_locked)
-{
-	struct net_device *dev = local->dev;
-
-	printk(KERN_DEBUG "%s: disabling hostapd mode\n", dev->name);
-
-	hostap_remove_interface(local->stadev, rtnl_locked, 1);
-	local->stadev = NULL;
-
-	return 0;
-}
-
-
-int hostap_set_hostapd(local_info_t *local, int val, int rtnl_locked)
-{
-	int ret;
-
-	if (val < 0 || val > 1)
-		return -EINVAL;
-
-	if (local->hostapd == val)
-		return 0;
-
-	if (val) {
-		ret = hostap_enable_hostapd(local, rtnl_locked);
-		if (ret == 0)
-			local->hostapd = 1;
-	} else {
-		local->hostapd = 0;
-		ret = hostap_disable_hostapd(local, rtnl_locked);
-		if (ret != 0)
-			local->hostapd = 1;
-	}
-
-	return ret;
-}
-
-
-int hostap_set_hostapd_sta(local_info_t *local, int val, int rtnl_locked)
-{
-	int ret;
-
-	if (val < 0 || val > 1)
-		return -EINVAL;
-
-	if (local->hostapd_sta == val)
-		return 0;
-
-	if (val) {
-		ret = hostap_enable_hostapd_sta(local, rtnl_locked);
-		if (ret == 0)
-			local->hostapd_sta = 1;
-	} else {
-		local->hostapd_sta = 0;
-		ret = hostap_disable_hostapd_sta(local, rtnl_locked);
-		if (ret != 0)
-			local->hostapd_sta = 1;
-	}
-
-
-	return ret;
-}
-
-
-int prism2_update_comms_qual(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int ret = 0;
-	struct hfa384x_comms_quality sq;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	if (!local->sta_fw_ver)
-		ret = -1;
-	else if (local->sta_fw_ver >= PRISM2_FW_VER(1,3,1)) {
-		if (local->func->get_rid(local->dev,
-					 HFA384X_RID_DBMCOMMSQUALITY,
-					 &sq, sizeof(sq), 1) >= 0) {
-			local->comms_qual = (s16) le16_to_cpu(sq.comm_qual);
-			local->avg_signal = (s16) le16_to_cpu(sq.signal_level);
-			local->avg_noise = (s16) le16_to_cpu(sq.noise_level);
-			local->last_comms_qual_update = jiffies;
-		} else
-			ret = -1;
-	} else {
-		if (local->func->get_rid(local->dev, HFA384X_RID_COMMSQUALITY,
-					 &sq, sizeof(sq), 1) >= 0) {
-			local->comms_qual = le16_to_cpu(sq.comm_qual);
-			local->avg_signal = HFA384X_LEVEL_TO_dBm(
-				le16_to_cpu(sq.signal_level));
-			local->avg_noise = HFA384X_LEVEL_TO_dBm(
-				le16_to_cpu(sq.noise_level));
-			local->last_comms_qual_update = jiffies;
-		} else
-			ret = -1;
-	}
-
-	return ret;
-}
-
-
-int prism2_sta_send_mgmt(local_info_t *local, u8 *dst, u16 stype,
-			 u8 *body, size_t bodylen)
-{
-	struct sk_buff *skb;
-	struct hostap_ieee80211_mgmt *mgmt;
-	struct hostap_skb_tx_data *meta;
-	struct net_device *dev = local->dev;
-
-	skb = dev_alloc_skb(IEEE80211_MGMT_HDR_LEN + bodylen);
-	if (skb == NULL)
-		return -ENOMEM;
-
-	mgmt = (struct hostap_ieee80211_mgmt *)
-		skb_put(skb, IEEE80211_MGMT_HDR_LEN);
-	memset(mgmt, 0, IEEE80211_MGMT_HDR_LEN);
-	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
-	memcpy(mgmt->da, dst, ETH_ALEN);
-	memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
-	memcpy(mgmt->bssid, dst, ETH_ALEN);
-	if (body)
-		memcpy(skb_put(skb, bodylen), body, bodylen);
-
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-	memset(meta, 0, sizeof(*meta));
-	meta->magic = HOSTAP_SKB_TX_DATA_MAGIC;
-	meta->iface = netdev_priv(dev);
-
-	skb->dev = dev;
-	skb->mac.raw = skb->nh.raw = skb->data;
-	dev_queue_xmit(skb);
-
-	return 0;
-}
-
-
-int prism2_sta_deauth(local_info_t *local, u16 reason)
-{
-	union iwreq_data wrqu;
-	int ret;
-
-	if (local->iw_mode != IW_MODE_INFRA ||
-	    memcmp(local->bssid, "\x00\x00\x00\x00\x00\x00", ETH_ALEN) == 0 ||
-	    memcmp(local->bssid, "\x44\x44\x44\x44\x44\x44", ETH_ALEN) == 0)
-		return 0;
-
-	reason = cpu_to_le16(reason);
-	ret = prism2_sta_send_mgmt(local, local->bssid, IEEE80211_STYPE_DEAUTH,
-				   (u8 *) &reason, 2);
-	memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
-	wireless_send_event(local->dev, SIOCGIWAP, &wrqu, NULL);
-	return ret;
-}
-
-
-struct proc_dir_entry *hostap_proc;
-
-static int __init hostap_init(void)
-{
-	if (proc_net != NULL) {
-		hostap_proc = proc_mkdir("hostap", proc_net);
-		if (!hostap_proc)
-			printk(KERN_WARNING "Failed to mkdir "
-			       "/proc/net/hostap\n");
-	} else
-		hostap_proc = NULL;
-
-	return 0;
-}
-
-
-static void __exit hostap_exit(void)
-{
-	if (hostap_proc != NULL) {
-		hostap_proc = NULL;
-		remove_proc_entry("hostap", proc_net);
-	}
-}
-
-
-EXPORT_SYMBOL(hostap_set_word);
-EXPORT_SYMBOL(hostap_set_string);
-EXPORT_SYMBOL(hostap_get_porttype);
-EXPORT_SYMBOL(hostap_set_encryption);
-EXPORT_SYMBOL(hostap_set_antsel);
-EXPORT_SYMBOL(hostap_set_roaming);
-EXPORT_SYMBOL(hostap_set_auth_algs);
-EXPORT_SYMBOL(hostap_dump_rx_header);
-EXPORT_SYMBOL(hostap_dump_tx_header);
-EXPORT_SYMBOL(hostap_80211_header_parse);
-EXPORT_SYMBOL(hostap_80211_prism_header_parse);
-EXPORT_SYMBOL(hostap_80211_get_hdrlen);
-EXPORT_SYMBOL(hostap_get_stats);
-EXPORT_SYMBOL(hostap_setup_dev);
-EXPORT_SYMBOL(hostap_proc);
-EXPORT_SYMBOL(hostap_set_multicast_list_queue);
-EXPORT_SYMBOL(hostap_set_hostapd);
-EXPORT_SYMBOL(hostap_set_hostapd_sta);
-EXPORT_SYMBOL(hostap_add_interface);
-EXPORT_SYMBOL(hostap_remove_interface);
-EXPORT_SYMBOL(prism2_update_comms_qual);
-
-module_init(hostap_init);
-module_exit(hostap_exit);
diff --git a/trunk/drivers/net/wireless/hostap/hostap.h b/trunk/drivers/net/wireless/hostap/hostap.h
deleted file mode 100644
index 5fac89b8ce3a..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap.h
+++ /dev/null
@@ -1,57 +0,0 @@
-#ifndef HOSTAP_H
-#define HOSTAP_H
-
-/* hostap.c */
-
-extern struct proc_dir_entry *hostap_proc;
-
-u16 hostap_tx_callback_register(local_info_t *local,
-				void (*func)(struct sk_buff *, int ok, void *),
-				void *data);
-int hostap_tx_callback_unregister(local_info_t *local, u16 idx);
-int hostap_set_word(struct net_device *dev, int rid, u16 val);
-int hostap_set_string(struct net_device *dev, int rid, const char *val);
-u16 hostap_get_porttype(local_info_t *local);
-int hostap_set_encryption(local_info_t *local);
-int hostap_set_antsel(local_info_t *local);
-int hostap_set_roaming(local_info_t *local);
-int hostap_set_auth_algs(local_info_t *local);
-void hostap_dump_rx_header(const char *name,
-			   const struct hfa384x_rx_frame *rx);
-void hostap_dump_tx_header(const char *name,
-			   const struct hfa384x_tx_frame *tx);
-int hostap_80211_header_parse(struct sk_buff *skb, unsigned char *haddr);
-int hostap_80211_prism_header_parse(struct sk_buff *skb, unsigned char *haddr);
-int hostap_80211_get_hdrlen(u16 fc);
-struct net_device_stats *hostap_get_stats(struct net_device *dev);
-void hostap_setup_dev(struct net_device *dev, local_info_t *local,
-		      int main_dev);
-void hostap_set_multicast_list_queue(void *data);
-int hostap_set_hostapd(local_info_t *local, int val, int rtnl_locked);
-int hostap_set_hostapd_sta(local_info_t *local, int val, int rtnl_locked);
-void hostap_cleanup(local_info_t *local);
-void hostap_cleanup_handler(void *data);
-struct net_device * hostap_add_interface(struct local_info *local,
-					 int type, int rtnl_locked,
-					 const char *prefix, const char *name);
-void hostap_remove_interface(struct net_device *dev, int rtnl_locked,
-			     int remove_from_list);
-int prism2_update_comms_qual(struct net_device *dev);
-int prism2_sta_send_mgmt(local_info_t *local, u8 *dst, u16 stype,
-			 u8 *body, size_t bodylen);
-int prism2_sta_deauth(local_info_t *local, u16 reason);
-
-
-/* hostap_proc.c */
-
-void hostap_init_proc(local_info_t *local);
-void hostap_remove_proc(local_info_t *local);
-
-
-/* hostap_info.c */
-
-void hostap_info_init(local_info_t *local);
-void hostap_info_process(local_info_t *local, struct sk_buff *skb);
-
-
-#endif /* HOSTAP_H */
diff --git a/trunk/drivers/net/wireless/hostap/hostap_80211.h b/trunk/drivers/net/wireless/hostap/hostap_80211.h
deleted file mode 100644
index bf506f50d722..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_80211.h
+++ /dev/null
@@ -1,96 +0,0 @@
-#ifndef HOSTAP_80211_H
-#define HOSTAP_80211_H
-
-struct hostap_ieee80211_mgmt {
-	u16 frame_control;
-	u16 duration;
-	u8 da[6];
-	u8 sa[6];
-	u8 bssid[6];
-	u16 seq_ctrl;
-	union {
-		struct {
-			u16 auth_alg;
-			u16 auth_transaction;
-			u16 status_code;
-			/* possibly followed by Challenge text */
-			u8 variable[0];
-		} __attribute__ ((packed)) auth;
-		struct {
-			u16 reason_code;
-		} __attribute__ ((packed)) deauth;
-		struct {
-			u16 capab_info;
-			u16 listen_interval;
-			/* followed by SSID and Supported rates */
-			u8 variable[0];
-		} __attribute__ ((packed)) assoc_req;
-		struct {
-			u16 capab_info;
-			u16 status_code;
-			u16 aid;
-			/* followed by Supported rates */
-			u8 variable[0];
-		} __attribute__ ((packed)) assoc_resp, reassoc_resp;
-		struct {
-			u16 capab_info;
-			u16 listen_interval;
-			u8 current_ap[6];
-			/* followed by SSID and Supported rates */
-			u8 variable[0];
-		} __attribute__ ((packed)) reassoc_req;
-		struct {
-			u16 reason_code;
-		} __attribute__ ((packed)) disassoc;
-		struct {
-		} __attribute__ ((packed)) probe_req;
-		struct {
-			u8 timestamp[8];
-			u16 beacon_int;
-			u16 capab_info;
-			/* followed by some of SSID, Supported rates,
-			 * FH Params, DS Params, CF Params, IBSS Params, TIM */
-			u8 variable[0];
-		} __attribute__ ((packed)) beacon, probe_resp;
-	} u;
-} __attribute__ ((packed));
-
-
-#define IEEE80211_MGMT_HDR_LEN 24
-#define IEEE80211_DATA_HDR3_LEN 24
-#define IEEE80211_DATA_HDR4_LEN 30
-
-
-struct hostap_80211_rx_status {
-	u32 mac_time;
-	u8 signal;
-	u8 noise;
-	u16 rate; /* in 100 kbps */
-};
-
-
-void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
-		     struct hostap_80211_rx_status *rx_stats);
-
-
-/* prism2_rx_80211 'type' argument */
-enum {
-	PRISM2_RX_MONITOR, PRISM2_RX_MGMT, PRISM2_RX_NON_ASSOC,
-	PRISM2_RX_NULLFUNC_ACK
-};
-
-int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb,
-		    struct hostap_80211_rx_status *rx_stats, int type);
-void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
-		     struct hostap_80211_rx_status *rx_stats);
-void hostap_dump_rx_80211(const char *name, struct sk_buff *skb,
-			  struct hostap_80211_rx_status *rx_stats);
-
-void hostap_dump_tx_80211(const char *name, struct sk_buff *skb);
-int hostap_data_start_xmit(struct sk_buff *skb, struct net_device *dev);
-int hostap_mgmt_start_xmit(struct sk_buff *skb, struct net_device *dev);
-struct sk_buff * hostap_tx_encrypt(struct sk_buff *skb,
-				   struct ieee80211_crypt_data *crypt);
-int hostap_master_start_xmit(struct sk_buff *skb, struct net_device *dev);
-
-#endif /* HOSTAP_80211_H */
diff --git a/trunk/drivers/net/wireless/hostap/hostap_80211_rx.c b/trunk/drivers/net/wireless/hostap/hostap_80211_rx.c
deleted file mode 100644
index b0501243b175..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ /dev/null
@@ -1,1091 +0,0 @@
-#include <linux/etherdevice.h>
-
-#include "hostap_80211.h"
-#include "hostap.h"
-
-void hostap_dump_rx_80211(const char *name, struct sk_buff *skb,
-			  struct hostap_80211_rx_status *rx_stats)
-{
-	struct ieee80211_hdr *hdr;
-	u16 fc;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-
-	printk(KERN_DEBUG "%s: RX signal=%d noise=%d rate=%d len=%d "
-	       "jiffies=%ld\n",
-	       name, rx_stats->signal, rx_stats->noise, rx_stats->rate,
-	       skb->len, jiffies);
-
-	if (skb->len < 2)
-		return;
-
-	fc = le16_to_cpu(hdr->frame_ctl);
-	printk(KERN_DEBUG "   FC=0x%04x (type=%d:%d)%s%s",
-	       fc, WLAN_FC_GET_TYPE(fc) >> 2, WLAN_FC_GET_STYPE(fc) >> 4,
-	       fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "",
-	       fc & IEEE80211_FCTL_FROMDS ? " [FromDS]" : "");
-
-	if (skb->len < IEEE80211_DATA_HDR3_LEN) {
-		printk("\n");
-		return;
-	}
-
-	printk(" dur=0x%04x seq=0x%04x\n", le16_to_cpu(hdr->duration_id),
-	       le16_to_cpu(hdr->seq_ctl));
-
-	printk(KERN_DEBUG "   A1=" MACSTR " A2=" MACSTR " A3=" MACSTR,
-	       MAC2STR(hdr->addr1), MAC2STR(hdr->addr2), MAC2STR(hdr->addr3));
-	if (skb->len >= 30)
-		printk(" A4=" MACSTR, MAC2STR(hdr->addr4));
-	printk("\n");
-}
-
-
-/* Send RX frame to netif with 802.11 (and possible prism) header.
- * Called from hardware or software IRQ context. */
-int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb,
-		    struct hostap_80211_rx_status *rx_stats, int type)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int hdrlen, phdrlen, head_need, tail_need;
-	u16 fc;
-	int prism_header, ret;
-	struct ieee80211_hdr *hdr;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	dev->last_rx = jiffies;
-
-	if (dev->type == ARPHRD_IEEE80211_PRISM) {
-		if (local->monitor_type == PRISM2_MONITOR_PRISM) {
-			prism_header = 1;
-			phdrlen = sizeof(struct linux_wlan_ng_prism_hdr);
-		} else { /* local->monitor_type == PRISM2_MONITOR_CAPHDR */
-			prism_header = 2;
-			phdrlen = sizeof(struct linux_wlan_ng_cap_hdr);
-		}
-	} else {
-		prism_header = 0;
-		phdrlen = 0;
-	}
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	fc = le16_to_cpu(hdr->frame_ctl);
-
-	if (type == PRISM2_RX_MGMT && (fc & IEEE80211_FCTL_VERS)) {
-		printk(KERN_DEBUG "%s: dropped management frame with header "
-		       "version %d\n", dev->name, fc & IEEE80211_FCTL_VERS);
-		dev_kfree_skb_any(skb);
-		return 0;
-	}
-
-	hdrlen = hostap_80211_get_hdrlen(fc);
-
-	/* check if there is enough room for extra data; if not, expand skb
-	 * buffer to be large enough for the changes */
-	head_need = phdrlen;
-	tail_need = 0;
-#ifdef PRISM2_ADD_BOGUS_CRC
-	tail_need += 4;
-#endif /* PRISM2_ADD_BOGUS_CRC */
-
-	head_need -= skb_headroom(skb);
-	tail_need -= skb_tailroom(skb);
-
-	if (head_need > 0 || tail_need > 0) {
-		if (pskb_expand_head(skb, head_need > 0 ? head_need : 0,
-				     tail_need > 0 ? tail_need : 0,
-				     GFP_ATOMIC)) {
-			printk(KERN_DEBUG "%s: prism2_rx_80211 failed to "
-			       "reallocate skb buffer\n", dev->name);
-			dev_kfree_skb_any(skb);
-			return 0;
-		}
-	}
-
-	/* We now have an skb with enough head and tail room, so just insert
-	 * the extra data */
-
-#ifdef PRISM2_ADD_BOGUS_CRC
-	memset(skb_put(skb, 4), 0xff, 4); /* Prism2 strips CRC */
-#endif /* PRISM2_ADD_BOGUS_CRC */
-
-	if (prism_header == 1) {
-		struct linux_wlan_ng_prism_hdr *hdr;
-		hdr = (struct linux_wlan_ng_prism_hdr *)
-			skb_push(skb, phdrlen);
-		memset(hdr, 0, phdrlen);
-		hdr->msgcode = LWNG_CAP_DID_BASE;
-		hdr->msglen = sizeof(*hdr);
-		memcpy(hdr->devname, dev->name, sizeof(hdr->devname));
-#define LWNG_SETVAL(f,i,s,l,d) \
-hdr->f.did = LWNG_CAP_DID_BASE | (i << 12); \
-hdr->f.status = s; hdr->f.len = l; hdr->f.data = d
-		LWNG_SETVAL(hosttime, 1, 0, 4, jiffies);
-		LWNG_SETVAL(mactime, 2, 0, 4, rx_stats->mac_time);
-		LWNG_SETVAL(channel, 3, 1 /* no value */, 4, 0);
-		LWNG_SETVAL(rssi, 4, 1 /* no value */, 4, 0);
-		LWNG_SETVAL(sq, 5, 1 /* no value */, 4, 0);
-		LWNG_SETVAL(signal, 6, 0, 4, rx_stats->signal);
-		LWNG_SETVAL(noise, 7, 0, 4, rx_stats->noise);
-		LWNG_SETVAL(rate, 8, 0, 4, rx_stats->rate / 5);
-		LWNG_SETVAL(istx, 9, 0, 4, 0);
-		LWNG_SETVAL(frmlen, 10, 0, 4, skb->len - phdrlen);
-#undef LWNG_SETVAL
-	} else if (prism_header == 2) {
-		struct linux_wlan_ng_cap_hdr *hdr;
-		hdr = (struct linux_wlan_ng_cap_hdr *)
-			skb_push(skb, phdrlen);
-		memset(hdr, 0, phdrlen);
-		hdr->version    = htonl(LWNG_CAPHDR_VERSION);
-		hdr->length     = htonl(phdrlen);
-		hdr->mactime    = __cpu_to_be64(rx_stats->mac_time);
-		hdr->hosttime   = __cpu_to_be64(jiffies);
-		hdr->phytype    = htonl(4); /* dss_dot11_b */
-		hdr->channel    = htonl(local->channel);
-		hdr->datarate   = htonl(rx_stats->rate);
-		hdr->antenna    = htonl(0); /* unknown */
-		hdr->priority   = htonl(0); /* unknown */
-		hdr->ssi_type   = htonl(3); /* raw */
-		hdr->ssi_signal = htonl(rx_stats->signal);
-		hdr->ssi_noise  = htonl(rx_stats->noise);
-		hdr->preamble   = htonl(0); /* unknown */
-		hdr->encoding   = htonl(1); /* cck */
-	}
-
-	ret = skb->len - phdrlen;
-	skb->dev = dev;
-	skb->mac.raw = skb->data;
-	skb_pull(skb, hdrlen);
-	if (prism_header)
-		skb_pull(skb, phdrlen);
-	skb->pkt_type = PACKET_OTHERHOST;
-	skb->protocol = __constant_htons(ETH_P_802_2);
-	memset(skb->cb, 0, sizeof(skb->cb));
-	netif_rx(skb);
-
-	return ret;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void monitor_rx(struct net_device *dev, struct sk_buff *skb,
-		       struct hostap_80211_rx_status *rx_stats)
-{
-	struct net_device_stats *stats;
-	int len;
-
-	len = prism2_rx_80211(dev, skb, rx_stats, PRISM2_RX_MONITOR);
-	stats = hostap_get_stats(dev);
-	stats->rx_packets++;
-	stats->rx_bytes += len;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static struct prism2_frag_entry *
-prism2_frag_cache_find(local_info_t *local, unsigned int seq,
-		       unsigned int frag, u8 *src, u8 *dst)
-{
-	struct prism2_frag_entry *entry;
-	int i;
-
-	for (i = 0; i < PRISM2_FRAG_CACHE_LEN; i++) {
-		entry = &local->frag_cache[i];
-		if (entry->skb != NULL &&
-		    time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
-			printk(KERN_DEBUG "%s: expiring fragment cache entry "
-			       "seq=%u last_frag=%u\n",
-			       local->dev->name, entry->seq, entry->last_frag);
-			dev_kfree_skb(entry->skb);
-			entry->skb = NULL;
-		}
-
-		if (entry->skb != NULL && entry->seq == seq &&
-		    (entry->last_frag + 1 == frag || frag == -1) &&
-		    memcmp(entry->src_addr, src, ETH_ALEN) == 0 &&
-		    memcmp(entry->dst_addr, dst, ETH_ALEN) == 0)
-			return entry;
-	}
-
-	return NULL;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static struct sk_buff *
-prism2_frag_cache_get(local_info_t *local, struct ieee80211_hdr *hdr)
-{
-	struct sk_buff *skb = NULL;
-	u16 sc;
-	unsigned int frag, seq;
-	struct prism2_frag_entry *entry;
-
-	sc = le16_to_cpu(hdr->seq_ctl);
-	frag = WLAN_GET_SEQ_FRAG(sc);
-	seq = WLAN_GET_SEQ_SEQ(sc) >> 4;
-
-	if (frag == 0) {
-		/* Reserve enough space to fit maximum frame length */
-		skb = dev_alloc_skb(local->dev->mtu +
-				    sizeof(struct ieee80211_hdr) +
-				    8 /* LLC */ +
-				    2 /* alignment */ +
-				    8 /* WEP */ + ETH_ALEN /* WDS */);
-		if (skb == NULL)
-			return NULL;
-
-		entry = &local->frag_cache[local->frag_next_idx];
-		local->frag_next_idx++;
-		if (local->frag_next_idx >= PRISM2_FRAG_CACHE_LEN)
-			local->frag_next_idx = 0;
-
-		if (entry->skb != NULL)
-			dev_kfree_skb(entry->skb);
-
-		entry->first_frag_time = jiffies;
-		entry->seq = seq;
-		entry->last_frag = frag;
-		entry->skb = skb;
-		memcpy(entry->src_addr, hdr->addr2, ETH_ALEN);
-		memcpy(entry->dst_addr, hdr->addr1, ETH_ALEN);
-	} else {
-		/* received a fragment of a frame for which the head fragment
-		 * should have already been received */
-		entry = prism2_frag_cache_find(local, seq, frag, hdr->addr2,
-					       hdr->addr1);
-		if (entry != NULL) {
-			entry->last_frag = frag;
-			skb = entry->skb;
-		}
-	}
-
-	return skb;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static int prism2_frag_cache_invalidate(local_info_t *local,
-					struct ieee80211_hdr *hdr)
-{
-	u16 sc;
-	unsigned int seq;
-	struct prism2_frag_entry *entry;
-
-	sc = le16_to_cpu(hdr->seq_ctl);
-	seq = WLAN_GET_SEQ_SEQ(sc) >> 4;
-
-	entry = prism2_frag_cache_find(local, seq, -1, hdr->addr2, hdr->addr1);
-
-	if (entry == NULL) {
-		printk(KERN_DEBUG "%s: could not invalidate fragment cache "
-		       "entry (seq=%u)\n",
-		       local->dev->name, seq);
-		return -1;
-	}
-
-	entry->skb = NULL;
-	return 0;
-}
-
-
-static struct hostap_bss_info *__hostap_get_bss(local_info_t *local, u8 *bssid,
-						u8 *ssid, size_t ssid_len)
-{
-	struct list_head *ptr;
-	struct hostap_bss_info *bss;
-
-	list_for_each(ptr, &local->bss_list) {
-		bss = list_entry(ptr, struct hostap_bss_info, list);
-		if (memcmp(bss->bssid, bssid, ETH_ALEN) == 0 &&
-		    (ssid == NULL ||
-		     (ssid_len == bss->ssid_len &&
-		      memcmp(ssid, bss->ssid, ssid_len) == 0))) {
-			list_move(&bss->list, &local->bss_list);
-			return bss;
-		}
-	}
-
-	return NULL;
-}
-
-
-static struct hostap_bss_info *__hostap_add_bss(local_info_t *local, u8 *bssid,
-						u8 *ssid, size_t ssid_len)
-{
-	struct hostap_bss_info *bss;
-
-	if (local->num_bss_info >= HOSTAP_MAX_BSS_COUNT) {
-		bss = list_entry(local->bss_list.prev,
-				 struct hostap_bss_info, list);
-		list_del(&bss->list);
-		local->num_bss_info--;
-	} else {
-		bss = (struct hostap_bss_info *)
-			kmalloc(sizeof(*bss), GFP_ATOMIC);
-		if (bss == NULL)
-			return NULL;
-	}
-
-	memset(bss, 0, sizeof(*bss));
-	memcpy(bss->bssid, bssid, ETH_ALEN);
-	memcpy(bss->ssid, ssid, ssid_len);
-	bss->ssid_len = ssid_len;
-	local->num_bss_info++;
-	list_add(&bss->list, &local->bss_list);
-	return bss;
-}
-
-
-static void __hostap_expire_bss(local_info_t *local)
-{
-	struct hostap_bss_info *bss;
-
-	while (local->num_bss_info > 0) {
-		bss = list_entry(local->bss_list.prev,
-				 struct hostap_bss_info, list);
-		if (!time_after(jiffies, bss->last_update + 60 * HZ))
-			break;
-
-		list_del(&bss->list);
-		local->num_bss_info--;
-		kfree(bss);
-	}
-}
-
-
-/* Both IEEE 802.11 Beacon and Probe Response frames have similar structure, so
- * the same routine can be used to parse both of them. */
-static void hostap_rx_sta_beacon(local_info_t *local, struct sk_buff *skb,
-				 int stype)
-{
-	struct hostap_ieee80211_mgmt *mgmt;
-	int left, chan = 0;
-	u8 *pos;
-	u8 *ssid = NULL, *wpa = NULL, *rsn = NULL;
-	size_t ssid_len = 0, wpa_len = 0, rsn_len = 0;
-	struct hostap_bss_info *bss;
-
-	if (skb->len < IEEE80211_MGMT_HDR_LEN + sizeof(mgmt->u.beacon))
-		return;
-
-	mgmt = (struct hostap_ieee80211_mgmt *) skb->data;
-	pos = mgmt->u.beacon.variable;
-	left = skb->len - (pos - skb->data);
-
-	while (left >= 2) {
-		if (2 + pos[1] > left)
-			return; /* parse failed */
-		switch (*pos) {
-		case WLAN_EID_SSID:
-			ssid = pos + 2;
-			ssid_len = pos[1];
-			break;
-		case WLAN_EID_GENERIC:
-			if (pos[1] >= 4 &&
-			    pos[2] == 0x00 && pos[3] == 0x50 &&
-			    pos[4] == 0xf2 && pos[5] == 1) {
-				wpa = pos;
-				wpa_len = pos[1] + 2;
-			}
-			break;
-		case WLAN_EID_RSN:
-			rsn = pos;
-			rsn_len = pos[1] + 2;
-			break;
-		case WLAN_EID_DS_PARAMS:
-			if (pos[1] >= 1)
-				chan = pos[2];
-			break;
-		}
-		left -= 2 + pos[1];
-		pos += 2 + pos[1];
-	}
-
-	if (wpa_len > MAX_WPA_IE_LEN)
-		wpa_len = MAX_WPA_IE_LEN;
-	if (rsn_len > MAX_WPA_IE_LEN)
-		rsn_len = MAX_WPA_IE_LEN;
-	if (ssid_len > sizeof(bss->ssid))
-		ssid_len = sizeof(bss->ssid);
-
-	spin_lock(&local->lock);
-	bss = __hostap_get_bss(local, mgmt->bssid, ssid, ssid_len);
-	if (bss == NULL)
-		bss = __hostap_add_bss(local, mgmt->bssid, ssid, ssid_len);
-	if (bss) {
-		bss->last_update = jiffies;
-		bss->count++;
-		bss->capab_info = le16_to_cpu(mgmt->u.beacon.capab_info);
-		if (wpa) {
-			memcpy(bss->wpa_ie, wpa, wpa_len);
-			bss->wpa_ie_len = wpa_len;
-		} else
-			bss->wpa_ie_len = 0;
-		if (rsn) {
-			memcpy(bss->rsn_ie, rsn, rsn_len);
-			bss->rsn_ie_len = rsn_len;
-		} else
-			bss->rsn_ie_len = 0;
-		bss->chan = chan;
-	}
-	__hostap_expire_bss(local);
-	spin_unlock(&local->lock);
-}
-
-
-static inline int
-hostap_rx_frame_mgmt(local_info_t *local, struct sk_buff *skb,
-		     struct hostap_80211_rx_status *rx_stats, u16 type,
-		     u16 stype)
-{
-	if (local->iw_mode == IW_MODE_MASTER) {
-		hostap_update_sta_ps(local, (struct ieee80211_hdr *)
-				     skb->data);
-	}
-
-	if (local->hostapd && type == IEEE80211_FTYPE_MGMT) {
-		if (stype == IEEE80211_STYPE_BEACON &&
-		    local->iw_mode == IW_MODE_MASTER) {
-			struct sk_buff *skb2;
-			/* Process beacon frames also in kernel driver to
-			 * update STA(AP) table statistics */
-			skb2 = skb_clone(skb, GFP_ATOMIC);
-			if (skb2)
-				hostap_rx(skb2->dev, skb2, rx_stats);
-		}
-
-		/* send management frames to the user space daemon for
-		 * processing */
-		local->apdevstats.rx_packets++;
-		local->apdevstats.rx_bytes += skb->len;
-		if (local->apdev == NULL)
-			return -1;
-		prism2_rx_80211(local->apdev, skb, rx_stats, PRISM2_RX_MGMT);
-		return 0;
-	}
-
-	if (local->iw_mode == IW_MODE_MASTER) {
-		if (type != IEEE80211_FTYPE_MGMT &&
-		    type != IEEE80211_FTYPE_CTL) {
-			printk(KERN_DEBUG "%s: unknown management frame "
-			       "(type=0x%02x, stype=0x%02x) dropped\n",
-			       skb->dev->name, type >> 2, stype >> 4);
-			return -1;
-		}
-
-		hostap_rx(skb->dev, skb, rx_stats);
-		return 0;
-	} else if (type == IEEE80211_FTYPE_MGMT &&
-		   (stype == IEEE80211_STYPE_BEACON ||
-		    stype == IEEE80211_STYPE_PROBE_RESP)) {
-		hostap_rx_sta_beacon(local, skb, stype);
-		return -1;
-	} else if (type == IEEE80211_FTYPE_MGMT &&
-		   (stype == IEEE80211_STYPE_ASSOC_RESP ||
-		    stype == IEEE80211_STYPE_REASSOC_RESP)) {
-		/* Ignore (Re)AssocResp silently since these are not currently
-		 * needed but are still received when WPA/RSN mode is enabled.
-		 */
-		return -1;
-	} else {
-		printk(KERN_DEBUG "%s: hostap_rx_frame_mgmt: dropped unhandled"
-		       " management frame in non-Host AP mode (type=%d:%d)\n",
-		       skb->dev->name, type >> 2, stype >> 4);
-		return -1;
-	}
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static inline struct net_device *prism2_rx_get_wds(local_info_t *local,
-						   u8 *addr)
-{
-	struct hostap_interface *iface = NULL;
-	struct list_head *ptr;
-
-	read_lock_bh(&local->iface_lock);
-	list_for_each(ptr, &local->hostap_interfaces) {
-		iface = list_entry(ptr, struct hostap_interface, list);
-		if (iface->type == HOSTAP_INTERFACE_WDS &&
-		    memcmp(iface->u.wds.remote_addr, addr, ETH_ALEN) == 0)
-			break;
-		iface = NULL;
-	}
-	read_unlock_bh(&local->iface_lock);
-
-	return iface ? iface->dev : NULL;
-}
-
-
-static inline int
-hostap_rx_frame_wds(local_info_t *local, struct ieee80211_hdr *hdr,
-		    u16 fc, struct net_device **wds)
-{
-	/* FIX: is this really supposed to accept WDS frames only in Master
-	 * mode? What about Repeater or Managed with WDS frames? */
-	if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) !=
-	    (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS) &&
-	    (local->iw_mode != IW_MODE_MASTER || !(fc & IEEE80211_FCTL_TODS)))
-		return 0; /* not a WDS frame */
-
-	/* Possible WDS frame: either IEEE 802.11 compliant (if FromDS)
-	 * or own non-standard frame with 4th address after payload */
-	if (memcmp(hdr->addr1, local->dev->dev_addr, ETH_ALEN) != 0 &&
-	    (hdr->addr1[0] != 0xff || hdr->addr1[1] != 0xff ||
-	     hdr->addr1[2] != 0xff || hdr->addr1[3] != 0xff ||
-	     hdr->addr1[4] != 0xff || hdr->addr1[5] != 0xff)) {
-		/* RA (or BSSID) is not ours - drop */
-		PDEBUG(DEBUG_EXTRA, "%s: received WDS frame with "
-		       "not own or broadcast %s=" MACSTR "\n",
-		       local->dev->name,
-		       fc & IEEE80211_FCTL_FROMDS ? "RA" : "BSSID",
-		       MAC2STR(hdr->addr1));
-		return -1;
-	}
-
-	/* check if the frame came from a registered WDS connection */
-	*wds = prism2_rx_get_wds(local, hdr->addr2);
-	if (*wds == NULL && fc & IEEE80211_FCTL_FROMDS &&
-	    (local->iw_mode != IW_MODE_INFRA ||
-	     !(local->wds_type & HOSTAP_WDS_AP_CLIENT) ||
-	     memcmp(hdr->addr2, local->bssid, ETH_ALEN) != 0)) {
-		/* require that WDS link has been registered with TA or the
-		 * frame is from current AP when using 'AP client mode' */
-		PDEBUG(DEBUG_EXTRA, "%s: received WDS[4 addr] frame "
-		       "from unknown TA=" MACSTR "\n",
-		       local->dev->name, MAC2STR(hdr->addr2));
-		if (local->ap && local->ap->autom_ap_wds)
-			hostap_wds_link_oper(local, hdr->addr2, WDS_ADD);
-		return -1;
-	}
-
-	if (*wds && !(fc & IEEE80211_FCTL_FROMDS) && local->ap &&
-	    hostap_is_sta_assoc(local->ap, hdr->addr2)) {
-		/* STA is actually associated with us even though it has a
-		 * registered WDS link. Assume it is in 'AP client' mode.
-		 * Since this is a 3-addr frame, assume it is not (bogus) WDS
-		 * frame and process it like any normal ToDS frame from
-		 * associated STA. */
-		*wds = NULL;
-	}
-
-	return 0;
-}
-
-
-static int hostap_is_eapol_frame(local_info_t *local, struct sk_buff *skb)
-{
-	struct net_device *dev = local->dev;
-	u16 fc, ethertype;
-	struct ieee80211_hdr *hdr;
-	u8 *pos;
-
-	if (skb->len < 24)
-		return 0;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	fc = le16_to_cpu(hdr->frame_ctl);
-
-	/* check that the frame is unicast frame to us */
-	if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-	    IEEE80211_FCTL_TODS &&
-	    memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 &&
-	    memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
-		/* ToDS frame with own addr BSSID and DA */
-	} else if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-		   IEEE80211_FCTL_FROMDS &&
-		   memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
-		/* FromDS frame with own addr as DA */
-	} else
-		return 0;
-
-	if (skb->len < 24 + 8)
-		return 0;
-
-	/* check for port access entity Ethernet type */
-	pos = skb->data + 24;
-	ethertype = (pos[6] << 8) | pos[7];
-	if (ethertype == ETH_P_PAE)
-		return 1;
-
-	return 0;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static inline int
-hostap_rx_frame_decrypt(local_info_t *local, struct sk_buff *skb,
-			struct ieee80211_crypt_data *crypt)
-{
-	struct ieee80211_hdr *hdr;
-	int res, hdrlen;
-
-	if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
-		return 0;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
-
-	if (local->tkip_countermeasures &&
-	    strcmp(crypt->ops->name, "TKIP") == 0) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
-			       "received packet from " MACSTR "\n",
-			       local->dev->name, MAC2STR(hdr->addr2));
-		}
-		return -1;
-	}
-
-	atomic_inc(&crypt->refcnt);
-	res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
-	atomic_dec(&crypt->refcnt);
-	if (res < 0) {
-		printk(KERN_DEBUG "%s: decryption failed (SA=" MACSTR
-		       ") res=%d\n",
-		       local->dev->name, MAC2STR(hdr->addr2), res);
-		local->comm_tallies.rx_discards_wep_undecryptable++;
-		return -1;
-	}
-
-	return res;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static inline int
-hostap_rx_frame_decrypt_msdu(local_info_t *local, struct sk_buff *skb,
-			     int keyidx, struct ieee80211_crypt_data *crypt)
-{
-	struct ieee80211_hdr *hdr;
-	int res, hdrlen;
-
-	if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
-		return 0;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
-
-	atomic_inc(&crypt->refcnt);
-	res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv);
-	atomic_dec(&crypt->refcnt);
-	if (res < 0) {
-		printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed"
-		       " (SA=" MACSTR " keyidx=%d)\n",
-		       local->dev->name, MAC2STR(hdr->addr2), keyidx);
-		return -1;
-	}
-
-	return 0;
-}
-
-
-/* All received frames are sent to this function. @skb contains the frame in
- * IEEE 802.11 format, i.e., in the format it was sent over air.
- * This function is called only as a tasklet (software IRQ). */
-void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
-		     struct hostap_80211_rx_status *rx_stats)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct ieee80211_hdr *hdr;
-	size_t hdrlen;
-	u16 fc, type, stype, sc;
-	struct net_device *wds = NULL;
-	struct net_device_stats *stats;
-	unsigned int frag;
-	u8 *payload;
-	struct sk_buff *skb2 = NULL;
-	u16 ethertype;
-	int frame_authorized = 0;
-	int from_assoc_ap = 0;
-	u8 dst[ETH_ALEN];
-	u8 src[ETH_ALEN];
-	struct ieee80211_crypt_data *crypt = NULL;
-	void *sta = NULL;
-	int keyidx = 0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	iface->stats.rx_packets++;
-	iface->stats.rx_bytes += skb->len;
-
-	/* dev is the master radio device; change this to be the default
-	 * virtual interface (this may be changed to WDS device below) */
-	dev = local->ddev;
-	iface = netdev_priv(dev);
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	stats = hostap_get_stats(dev);
-
-	if (skb->len < 10)
-		goto rx_dropped;
-
-	fc = le16_to_cpu(hdr->frame_ctl);
-	type = WLAN_FC_GET_TYPE(fc);
-	stype = WLAN_FC_GET_STYPE(fc);
-	sc = le16_to_cpu(hdr->seq_ctl);
-	frag = WLAN_GET_SEQ_FRAG(sc);
-	hdrlen = hostap_80211_get_hdrlen(fc);
-
-	/* Put this code here so that we avoid duplicating it in all
-	 * Rx paths. - Jean II */
-#ifdef IW_WIRELESS_SPY		/* defined in iw_handler.h */
-	/* If spy monitoring on */
-	if (iface->spy_data.spy_number > 0) {
-		struct iw_quality wstats;
-		wstats.level = rx_stats->signal;
-		wstats.noise = rx_stats->noise;
-		wstats.updated = 6;	/* No qual value */
-		/* Update spy records */
-		wireless_spy_update(dev, hdr->addr2, &wstats);
-	}
-#endif /* IW_WIRELESS_SPY */
-	hostap_update_rx_stats(local->ap, hdr, rx_stats);
-
-	if (local->iw_mode == IW_MODE_MONITOR) {
-		monitor_rx(dev, skb, rx_stats);
-		return;
-	}
-
-	if (local->host_decrypt) {
-		int idx = 0;
-		if (skb->len >= hdrlen + 3)
-			idx = skb->data[hdrlen + 3] >> 6;
-		crypt = local->crypt[idx];
-		sta = NULL;
-
-		/* Use station specific key to override default keys if the
-		 * receiver address is a unicast address ("individual RA"). If
-		 * bcrx_sta_key parameter is set, station specific key is used
-		 * even with broad/multicast targets (this is against IEEE
-		 * 802.11, but makes it easier to use different keys with
-		 * stations that do not support WEP key mapping). */
-
-		if (!(hdr->addr1[0] & 0x01) || local->bcrx_sta_key)
-			(void) hostap_handle_sta_crypto(local, hdr, &crypt,
-							&sta);
-
-		/* allow NULL decrypt to indicate an station specific override
-		 * for default encryption */
-		if (crypt && (crypt->ops == NULL ||
-			      crypt->ops->decrypt_mpdu == NULL))
-			crypt = NULL;
-
-		if (!crypt && (fc & IEEE80211_FCTL_PROTECTED)) {
-#if 0
-			/* This seems to be triggered by some (multicast?)
-			 * frames from other than current BSS, so just drop the
-			 * frames silently instead of filling system log with
-			 * these reports. */
-			printk(KERN_DEBUG "%s: WEP decryption failed (not set)"
-			       " (SA=" MACSTR ")\n",
-			       local->dev->name, MAC2STR(hdr->addr2));
-#endif
-			local->comm_tallies.rx_discards_wep_undecryptable++;
-			goto rx_dropped;
-		}
-	}
-
-	if (type != IEEE80211_FTYPE_DATA) {
-		if (type == IEEE80211_FTYPE_MGMT &&
-		    stype == IEEE80211_STYPE_AUTH &&
-		    fc & IEEE80211_FCTL_PROTECTED && local->host_decrypt &&
-		    (keyidx = hostap_rx_frame_decrypt(local, skb, crypt)) < 0)
-		{
-			printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth "
-			       "from " MACSTR "\n", dev->name,
-			       MAC2STR(hdr->addr2));
-			/* TODO: could inform hostapd about this so that it
-			 * could send auth failure report */
-			goto rx_dropped;
-		}
-
-		if (hostap_rx_frame_mgmt(local, skb, rx_stats, type, stype))
-			goto rx_dropped;
-		else
-			goto rx_exit;
-	}
-
-	/* Data frame - extract src/dst addresses */
-	if (skb->len < IEEE80211_DATA_HDR3_LEN)
-		goto rx_dropped;
-
-	switch (fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
-	case IEEE80211_FCTL_FROMDS:
-		memcpy(dst, hdr->addr1, ETH_ALEN);
-		memcpy(src, hdr->addr3, ETH_ALEN);
-		break;
-	case IEEE80211_FCTL_TODS:
-		memcpy(dst, hdr->addr3, ETH_ALEN);
-		memcpy(src, hdr->addr2, ETH_ALEN);
-		break;
-	case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
-		if (skb->len < IEEE80211_DATA_HDR4_LEN)
-			goto rx_dropped;
-		memcpy(dst, hdr->addr3, ETH_ALEN);
-		memcpy(src, hdr->addr4, ETH_ALEN);
-		break;
-	case 0:
-		memcpy(dst, hdr->addr1, ETH_ALEN);
-		memcpy(src, hdr->addr2, ETH_ALEN);
-		break;
-	}
-
-	if (hostap_rx_frame_wds(local, hdr, fc, &wds))
-		goto rx_dropped;
-	if (wds) {
-		skb->dev = dev = wds;
-		stats = hostap_get_stats(dev);
-	}
-
-	if (local->iw_mode == IW_MODE_MASTER && !wds &&
-	    (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-	    IEEE80211_FCTL_FROMDS &&
-	    local->stadev &&
-	    memcmp(hdr->addr2, local->assoc_ap_addr, ETH_ALEN) == 0) {
-		/* Frame from BSSID of the AP for which we are a client */
-		skb->dev = dev = local->stadev;
-		stats = hostap_get_stats(dev);
-		from_assoc_ap = 1;
-	}
-
-	dev->last_rx = jiffies;
-
-	if ((local->iw_mode == IW_MODE_MASTER ||
-	     local->iw_mode == IW_MODE_REPEAT) &&
-	    !from_assoc_ap) {
-		switch (hostap_handle_sta_rx(local, dev, skb, rx_stats,
-					     wds != NULL)) {
-		case AP_RX_CONTINUE_NOT_AUTHORIZED:
-			frame_authorized = 0;
-			break;
-		case AP_RX_CONTINUE:
-			frame_authorized = 1;
-			break;
-		case AP_RX_DROP:
-			goto rx_dropped;
-		case AP_RX_EXIT:
-			goto rx_exit;
-		}
-	}
-
-	/* Nullfunc frames may have PS-bit set, so they must be passed to
-	 * hostap_handle_sta_rx() before being dropped here. */
-	if (stype != IEEE80211_STYPE_DATA &&
-	    stype != IEEE80211_STYPE_DATA_CFACK &&
-	    stype != IEEE80211_STYPE_DATA_CFPOLL &&
-	    stype != IEEE80211_STYPE_DATA_CFACKPOLL) {
-		if (stype != IEEE80211_STYPE_NULLFUNC)
-			printk(KERN_DEBUG "%s: RX: dropped data frame "
-			       "with no data (type=0x%02x, subtype=0x%02x)\n",
-			       dev->name, type >> 2, stype >> 4);
-		goto rx_dropped;
-	}
-
-	/* skb: hdr + (possibly fragmented, possibly encrypted) payload */
-
-	if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) &&
-	    (keyidx = hostap_rx_frame_decrypt(local, skb, crypt)) < 0)
-		goto rx_dropped;
-	hdr = (struct ieee80211_hdr *) skb->data;
-
-	/* skb: hdr + (possibly fragmented) plaintext payload */
-
-	if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) &&
-	    (frag != 0 || (fc & IEEE80211_FCTL_MOREFRAGS))) {
-		int flen;
-		struct sk_buff *frag_skb =
-			prism2_frag_cache_get(local, hdr);
-		if (!frag_skb) {
-			printk(KERN_DEBUG "%s: Rx cannot get skb from "
-			       "fragment cache (morefrag=%d seq=%u frag=%u)\n",
-			       dev->name, (fc & IEEE80211_FCTL_MOREFRAGS) != 0,
-			       WLAN_GET_SEQ_SEQ(sc) >> 4, frag);
-			goto rx_dropped;
-		}
-
-		flen = skb->len;
-		if (frag != 0)
-			flen -= hdrlen;
-
-		if (frag_skb->tail + flen > frag_skb->end) {
-			printk(KERN_WARNING "%s: host decrypted and "
-			       "reassembled frame did not fit skb\n",
-			       dev->name);
-			prism2_frag_cache_invalidate(local, hdr);
-			goto rx_dropped;
-		}
-
-		if (frag == 0) {
-			/* copy first fragment (including full headers) into
-			 * beginning of the fragment cache skb */
-			memcpy(skb_put(frag_skb, flen), skb->data, flen);
-		} else {
-			/* append frame payload to the end of the fragment
-			 * cache skb */
-			memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
-			       flen);
-		}
-		dev_kfree_skb(skb);
-		skb = NULL;
-
-		if (fc & IEEE80211_FCTL_MOREFRAGS) {
-			/* more fragments expected - leave the skb in fragment
-			 * cache for now; it will be delivered to upper layers
-			 * after all fragments have been received */
-			goto rx_exit;
-		}
-
-		/* this was the last fragment and the frame will be
-		 * delivered, so remove skb from fragment cache */
-		skb = frag_skb;
-		hdr = (struct ieee80211_hdr *) skb->data;
-		prism2_frag_cache_invalidate(local, hdr);
-	}
-
-	/* skb: hdr + (possible reassembled) full MSDU payload; possibly still
-	 * encrypted/authenticated */
-
-	if (local->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) &&
-	    hostap_rx_frame_decrypt_msdu(local, skb, keyidx, crypt))
-		goto rx_dropped;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !local->open_wep) {
-		if (local->ieee_802_1x &&
-		    hostap_is_eapol_frame(local, skb)) {
-			/* pass unencrypted EAPOL frames even if encryption is
-			 * configured */
-			PDEBUG(DEBUG_EXTRA2, "%s: RX: IEEE 802.1X - passing "
-			       "unencrypted EAPOL frame\n", local->dev->name);
-		} else {
-			printk(KERN_DEBUG "%s: encryption configured, but RX "
-			       "frame not encrypted (SA=" MACSTR ")\n",
-			       local->dev->name, MAC2STR(hdr->addr2));
-			goto rx_dropped;
-		}
-	}
-
-	if (local->drop_unencrypted && !(fc & IEEE80211_FCTL_PROTECTED) &&
-	    !hostap_is_eapol_frame(local, skb)) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "%s: dropped unencrypted RX data "
-			       "frame from " MACSTR " (drop_unencrypted=1)\n",
-			       dev->name, MAC2STR(hdr->addr2));
-		}
-		goto rx_dropped;
-	}
-
-	/* skb: hdr + (possible reassembled) full plaintext payload */
-
-	payload = skb->data + hdrlen;
-	ethertype = (payload[6] << 8) | payload[7];
-
-	/* If IEEE 802.1X is used, check whether the port is authorized to send
-	 * the received frame. */
-	if (local->ieee_802_1x && local->iw_mode == IW_MODE_MASTER) {
-		if (ethertype == ETH_P_PAE) {
-			PDEBUG(DEBUG_EXTRA2, "%s: RX: IEEE 802.1X frame\n",
-			       dev->name);
-			if (local->hostapd && local->apdev) {
-				/* Send IEEE 802.1X frames to the user
-				 * space daemon for processing */
-				prism2_rx_80211(local->apdev, skb, rx_stats,
-						PRISM2_RX_MGMT);
-				local->apdevstats.rx_packets++;
-				local->apdevstats.rx_bytes += skb->len;
-				goto rx_exit;
-			}
-		} else if (!frame_authorized) {
-			printk(KERN_DEBUG "%s: dropped frame from "
-			       "unauthorized port (IEEE 802.1X): "
-			       "ethertype=0x%04x\n",
-			       dev->name, ethertype);
-			goto rx_dropped;
-		}
-	}
-
-	/* convert hdr + possible LLC headers into Ethernet header */
-	if (skb->len - hdrlen >= 8 &&
-	    ((memcmp(payload, rfc1042_header, 6) == 0 &&
-	      ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-	     memcmp(payload, bridge_tunnel_header, 6) == 0)) {
-		/* remove RFC1042 or Bridge-Tunnel encapsulation and
-		 * replace EtherType */
-		skb_pull(skb, hdrlen + 6);
-		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
-		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
-	} else {
-		u16 len;
-		/* Leave Ethernet header part of hdr and full payload */
-		skb_pull(skb, hdrlen);
-		len = htons(skb->len);
-		memcpy(skb_push(skb, 2), &len, 2);
-		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
-		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
-	}
-
-	if (wds && ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-		    IEEE80211_FCTL_TODS) &&
-	    skb->len >= ETH_HLEN + ETH_ALEN) {
-		/* Non-standard frame: get addr4 from its bogus location after
-		 * the payload */
-		memcpy(skb->data + ETH_ALEN,
-		       skb->data + skb->len - ETH_ALEN, ETH_ALEN);
-		skb_trim(skb, skb->len - ETH_ALEN);
-	}
-
-	stats->rx_packets++;
-	stats->rx_bytes += skb->len;
-
-	if (local->iw_mode == IW_MODE_MASTER && !wds &&
-	    local->ap->bridge_packets) {
-		if (dst[0] & 0x01) {
-			/* copy multicast frame both to the higher layers and
-			 * to the wireless media */
-			local->ap->bridged_multicast++;
-			skb2 = skb_clone(skb, GFP_ATOMIC);
-			if (skb2 == NULL)
-				printk(KERN_DEBUG "%s: skb_clone failed for "
-				       "multicast frame\n", dev->name);
-		} else if (hostap_is_sta_authorized(local->ap, dst)) {
-			/* send frame directly to the associated STA using
-			 * wireless media and not passing to higher layers */
-			local->ap->bridged_unicast++;
-			skb2 = skb;
-			skb = NULL;
-		}
-	}
-
-	if (skb2 != NULL) {
-		/* send to wireless media */
-		skb2->protocol = __constant_htons(ETH_P_802_3);
-		skb2->mac.raw = skb2->nh.raw = skb2->data;
-		/* skb2->nh.raw = skb2->data + ETH_HLEN; */
-		skb2->dev = dev;
-		dev_queue_xmit(skb2);
-	}
-
-	if (skb) {
-		skb->protocol = eth_type_trans(skb, dev);
-		memset(skb->cb, 0, sizeof(skb->cb));
-		skb->dev = dev;
-		netif_rx(skb);
-	}
-
- rx_exit:
-	if (sta)
-		hostap_handle_sta_release(sta);
-	return;
-
- rx_dropped:
-	dev_kfree_skb(skb);
-
-	stats->rx_dropped++;
-	goto rx_exit;
-}
-
-
-EXPORT_SYMBOL(hostap_80211_rx);
diff --git a/trunk/drivers/net/wireless/hostap/hostap_80211_tx.c b/trunk/drivers/net/wireless/hostap/hostap_80211_tx.c
deleted file mode 100644
index 6358015f6526..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_80211_tx.c
+++ /dev/null
@@ -1,524 +0,0 @@
-void hostap_dump_tx_80211(const char *name, struct sk_buff *skb)
-{
-	struct ieee80211_hdr *hdr;
-	u16 fc;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-
-	printk(KERN_DEBUG "%s: TX len=%d jiffies=%ld\n",
-	       name, skb->len, jiffies);
-
-	if (skb->len < 2)
-		return;
-
-	fc = le16_to_cpu(hdr->frame_ctl);
-	printk(KERN_DEBUG "   FC=0x%04x (type=%d:%d)%s%s",
-	       fc, WLAN_FC_GET_TYPE(fc) >> 2, WLAN_FC_GET_STYPE(fc) >> 4,
-	       fc & IEEE80211_FCTL_TODS ? " [ToDS]" : "",
-	       fc & IEEE80211_FCTL_FROMDS ? " [FromDS]" : "");
-
-	if (skb->len < IEEE80211_DATA_HDR3_LEN) {
-		printk("\n");
-		return;
-	}
-
-	printk(" dur=0x%04x seq=0x%04x\n", le16_to_cpu(hdr->duration_id),
-	       le16_to_cpu(hdr->seq_ctl));
-
-	printk(KERN_DEBUG "   A1=" MACSTR " A2=" MACSTR " A3=" MACSTR,
-	       MAC2STR(hdr->addr1), MAC2STR(hdr->addr2), MAC2STR(hdr->addr3));
-	if (skb->len >= 30)
-		printk(" A4=" MACSTR, MAC2STR(hdr->addr4));
-	printk("\n");
-}
-
-
-/* hard_start_xmit function for data interfaces (wlan#, wlan#wds#, wlan#sta)
- * Convert Ethernet header into a suitable IEEE 802.11 header depending on
- * device configuration. */
-int hostap_data_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int need_headroom, need_tailroom = 0;
-	struct ieee80211_hdr hdr;
-	u16 fc, ethertype = 0;
-	enum {
-		WDS_NO = 0, WDS_OWN_FRAME, WDS_COMPLIANT_FRAME
-	} use_wds = WDS_NO;
-	u8 *encaps_data;
-	int hdr_len, encaps_len, skip_header_bytes;
-	int to_assoc_ap = 0;
-	struct hostap_skb_tx_data *meta;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (skb->len < ETH_HLEN) {
-		printk(KERN_DEBUG "%s: hostap_data_start_xmit: short skb "
-		       "(len=%d)\n", dev->name, skb->len);
-		kfree_skb(skb);
-		return 0;
-	}
-
-	if (local->ddev != dev) {
-		use_wds = (local->iw_mode == IW_MODE_MASTER &&
-			   !(local->wds_type & HOSTAP_WDS_STANDARD_FRAME)) ?
-			WDS_OWN_FRAME : WDS_COMPLIANT_FRAME;
-		if (dev == local->stadev) {
-			to_assoc_ap = 1;
-			use_wds = WDS_NO;
-		} else if (dev == local->apdev) {
-			printk(KERN_DEBUG "%s: prism2_tx: trying to use "
-			       "AP device with Ethernet net dev\n", dev->name);
-			kfree_skb(skb);
-			return 0;
-		}
-	} else {
-		if (local->iw_mode == IW_MODE_REPEAT) {
-			printk(KERN_DEBUG "%s: prism2_tx: trying to use "
-			       "non-WDS link in Repeater mode\n", dev->name);
-			kfree_skb(skb);
-			return 0;
-		} else if (local->iw_mode == IW_MODE_INFRA &&
-			   (local->wds_type & HOSTAP_WDS_AP_CLIENT) &&
-			   memcmp(skb->data + ETH_ALEN, dev->dev_addr,
-				  ETH_ALEN) != 0) {
-			/* AP client mode: send frames with foreign src addr
-			 * using 4-addr WDS frames */
-			use_wds = WDS_COMPLIANT_FRAME;
-		}
-	}
-
-	/* Incoming skb->data: dst_addr[6], src_addr[6], proto[2], payload
-	 * ==>
-	 * Prism2 TX frame with 802.11 header:
-	 * txdesc (address order depending on used mode; includes dst_addr and
-	 * src_addr), possible encapsulation (RFC1042/Bridge-Tunnel;
-	 * proto[2], payload {, possible addr4[6]} */
-
-	ethertype = (skb->data[12] << 8) | skb->data[13];
-
-	memset(&hdr, 0, sizeof(hdr));
-
-	/* Length of data after IEEE 802.11 header */
-	encaps_data = NULL;
-	encaps_len = 0;
-	skip_header_bytes = ETH_HLEN;
-	if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
-		encaps_data = bridge_tunnel_header;
-		encaps_len = sizeof(bridge_tunnel_header);
-		skip_header_bytes -= 2;
-	} else if (ethertype >= 0x600) {
-		encaps_data = rfc1042_header;
-		encaps_len = sizeof(rfc1042_header);
-		skip_header_bytes -= 2;
-	}
-
-	fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA;
-	hdr_len = IEEE80211_DATA_HDR3_LEN;
-
-	if (use_wds != WDS_NO) {
-		/* Note! Prism2 station firmware has problems with sending real
-		 * 802.11 frames with four addresses; until these problems can
-		 * be fixed or worked around, 4-addr frames needed for WDS are
-		 * using incompatible format: FromDS flag is not set and the
-		 * fourth address is added after the frame payload; it is
-		 * assumed, that the receiving station knows how to handle this
-		 * frame format */
-
-		if (use_wds == WDS_COMPLIANT_FRAME) {
-			fc |= IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS;
-			/* From&To DS: Addr1 = RA, Addr2 = TA, Addr3 = DA,
-			 * Addr4 = SA */
-			memcpy(&hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
-			hdr_len += ETH_ALEN;
-		} else {
-			/* bogus 4-addr format to workaround Prism2 station
-			 * f/w bug */
-			fc |= IEEE80211_FCTL_TODS;
-			/* From DS: Addr1 = DA (used as RA),
-			 * Addr2 = BSSID (used as TA), Addr3 = SA (used as DA),
-			 */
-
-			/* SA from skb->data + ETH_ALEN will be added after
-			 * frame payload; use hdr.addr4 as a temporary buffer
-			 */
-			memcpy(&hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
-			need_tailroom += ETH_ALEN;
-		}
-
-		/* send broadcast and multicast frames to broadcast RA, if
-		 * configured; otherwise, use unicast RA of the WDS link */
-		if ((local->wds_type & HOSTAP_WDS_BROADCAST_RA) &&
-		    skb->data[0] & 0x01)
-			memset(&hdr.addr1, 0xff, ETH_ALEN);
-		else if (iface->type == HOSTAP_INTERFACE_WDS)
-			memcpy(&hdr.addr1, iface->u.wds.remote_addr,
-			       ETH_ALEN);
-		else
-			memcpy(&hdr.addr1, local->bssid, ETH_ALEN);
-		memcpy(&hdr.addr2, dev->dev_addr, ETH_ALEN);
-		memcpy(&hdr.addr3, skb->data, ETH_ALEN);
-	} else if (local->iw_mode == IW_MODE_MASTER && !to_assoc_ap) {
-		fc |= IEEE80211_FCTL_FROMDS;
-		/* From DS: Addr1 = DA, Addr2 = BSSID, Addr3 = SA */
-		memcpy(&hdr.addr1, skb->data, ETH_ALEN);
-		memcpy(&hdr.addr2, dev->dev_addr, ETH_ALEN);
-		memcpy(&hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
-	} else if (local->iw_mode == IW_MODE_INFRA || to_assoc_ap) {
-		fc |= IEEE80211_FCTL_TODS;
-		/* To DS: Addr1 = BSSID, Addr2 = SA, Addr3 = DA */
-		memcpy(&hdr.addr1, to_assoc_ap ?
-		       local->assoc_ap_addr : local->bssid, ETH_ALEN);
-		memcpy(&hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-		memcpy(&hdr.addr3, skb->data, ETH_ALEN);
-	} else if (local->iw_mode == IW_MODE_ADHOC) {
-		/* not From/To DS: Addr1 = DA, Addr2 = SA, Addr3 = BSSID */
-		memcpy(&hdr.addr1, skb->data, ETH_ALEN);
-		memcpy(&hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-		memcpy(&hdr.addr3, local->bssid, ETH_ALEN);
-	}
-
-	hdr.frame_ctl = cpu_to_le16(fc);
-
-	skb_pull(skb, skip_header_bytes);
-	need_headroom = local->func->need_tx_headroom + hdr_len + encaps_len;
-	if (skb_tailroom(skb) < need_tailroom) {
-		skb = skb_unshare(skb, GFP_ATOMIC);
-		if (skb == NULL) {
-			iface->stats.tx_dropped++;
-			return 0;
-		}
-		if (pskb_expand_head(skb, need_headroom, need_tailroom,
-				     GFP_ATOMIC)) {
-			kfree_skb(skb);
-			iface->stats.tx_dropped++;
-			return 0;
-		}
-	} else if (skb_headroom(skb) < need_headroom) {
-		struct sk_buff *tmp = skb;
-		skb = skb_realloc_headroom(skb, need_headroom);
-		kfree_skb(tmp);
-		if (skb == NULL) {
-			iface->stats.tx_dropped++;
-			return 0;
-		}
-	} else {
-		skb = skb_unshare(skb, GFP_ATOMIC);
-		if (skb == NULL) {
-			iface->stats.tx_dropped++;
-			return 0;
-		}
-	}
-
-	if (encaps_data)
-		memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
-	memcpy(skb_push(skb, hdr_len), &hdr, hdr_len);
-	if (use_wds == WDS_OWN_FRAME) {
-		memcpy(skb_put(skb, ETH_ALEN), &hdr.addr4, ETH_ALEN);
-	}
-
-	iface->stats.tx_packets++;
-	iface->stats.tx_bytes += skb->len;
-
-	skb->mac.raw = skb->data;
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-	memset(meta, 0, sizeof(*meta));
-	meta->magic = HOSTAP_SKB_TX_DATA_MAGIC;
-	if (use_wds)
-		meta->flags |= HOSTAP_TX_FLAGS_WDS;
-	meta->ethertype = ethertype;
-	meta->iface = iface;
-
-	/* Send IEEE 802.11 encapsulated frame using the master radio device */
-	skb->dev = local->dev;
-	dev_queue_xmit(skb);
-	return 0;
-}
-
-
-/* hard_start_xmit function for hostapd wlan#ap interfaces */
-int hostap_mgmt_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct hostap_skb_tx_data *meta;
-	struct ieee80211_hdr *hdr;
-	u16 fc;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (skb->len < 10) {
-		printk(KERN_DEBUG "%s: hostap_mgmt_start_xmit: short skb "
-		       "(len=%d)\n", dev->name, skb->len);
-		kfree_skb(skb);
-		return 0;
-	}
-
-	iface->stats.tx_packets++;
-	iface->stats.tx_bytes += skb->len;
-
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-	memset(meta, 0, sizeof(*meta));
-	meta->magic = HOSTAP_SKB_TX_DATA_MAGIC;
-	meta->iface = iface;
-
-	if (skb->len >= IEEE80211_DATA_HDR3_LEN + sizeof(rfc1042_header) + 2) {
-		hdr = (struct ieee80211_hdr *) skb->data;
-		fc = le16_to_cpu(hdr->frame_ctl);
-		if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA &&
-		    WLAN_FC_GET_STYPE(fc) == IEEE80211_STYPE_DATA) {
-			u8 *pos = &skb->data[IEEE80211_DATA_HDR3_LEN +
-					     sizeof(rfc1042_header)];
-			meta->ethertype = (pos[0] << 8) | pos[1];
-		}
-	}
-
-	/* Send IEEE 802.11 encapsulated frame using the master radio device */
-	skb->dev = local->dev;
-	dev_queue_xmit(skb);
-	return 0;
-}
-
-
-/* Called only from software IRQ */
-struct sk_buff * hostap_tx_encrypt(struct sk_buff *skb,
-				   struct ieee80211_crypt_data *crypt)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct ieee80211_hdr *hdr;
-	u16 fc;
-	int hdr_len, res;
-
-	iface = netdev_priv(skb->dev);
-	local = iface->local;
-
-	if (skb->len < IEEE80211_DATA_HDR3_LEN) {
-		kfree_skb(skb);
-		return NULL;
-	}
-
-	if (local->tkip_countermeasures &&
-	    crypt && crypt->ops && strcmp(crypt->ops->name, "TKIP") == 0) {
-		hdr = (struct ieee80211_hdr *) skb->data;
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
-			       "TX packet to " MACSTR "\n",
-			       local->dev->name, MAC2STR(hdr->addr1));
-		}
-		kfree_skb(skb);
-		return NULL;
-	}
-
-	skb = skb_unshare(skb, GFP_ATOMIC);
-	if (skb == NULL)
-		return NULL;
-
-	if ((skb_headroom(skb) < crypt->ops->extra_prefix_len ||
-	     skb_tailroom(skb) < crypt->ops->extra_postfix_len) &&
-	    pskb_expand_head(skb, crypt->ops->extra_prefix_len,
-			     crypt->ops->extra_postfix_len, GFP_ATOMIC)) {
-		kfree_skb(skb);
-		return NULL;
-	}
-
-	hdr = (struct ieee80211_hdr *) skb->data;
- 	fc = le16_to_cpu(hdr->frame_ctl);
-	hdr_len = hostap_80211_get_hdrlen(fc);
-
-	/* Host-based IEEE 802.11 fragmentation for TX is not yet supported, so
-	 * call both MSDU and MPDU encryption functions from here. */
-	atomic_inc(&crypt->refcnt);
-	res = 0;
-	if (crypt->ops->encrypt_msdu)
-		res = crypt->ops->encrypt_msdu(skb, hdr_len, crypt->priv);
-	if (res == 0 && crypt->ops->encrypt_mpdu)
-		res = crypt->ops->encrypt_mpdu(skb, hdr_len, crypt->priv);
-	atomic_dec(&crypt->refcnt);
-	if (res < 0) {
-		kfree_skb(skb);
-		return NULL;
-	}
-
-	return skb;
-}
-
-
-/* hard_start_xmit function for master radio interface wifi#.
- * AP processing (TX rate control, power save buffering, etc.).
- * Use hardware TX function to send the frame. */
-int hostap_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int ret = 1;
-	u16 fc;
-	struct hostap_tx_data tx;
-	ap_tx_ret tx_ret;
-	struct hostap_skb_tx_data *meta;
-	int no_encrypt = 0;
-	struct ieee80211_hdr *hdr;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	tx.skb = skb;
-	tx.sta_ptr = NULL;
-
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-	if (meta->magic != HOSTAP_SKB_TX_DATA_MAGIC) {
-		printk(KERN_DEBUG "%s: invalid skb->cb magic (0x%08x, "
-		       "expected 0x%08x)\n",
-		       dev->name, meta->magic, HOSTAP_SKB_TX_DATA_MAGIC);
-		ret = 0;
-		iface->stats.tx_dropped++;
-		goto fail;
-	}
-
-	if (local->host_encrypt) {
-		/* Set crypt to default algorithm and key; will be replaced in
-		 * AP code if STA has own alg/key */
-		tx.crypt = local->crypt[local->tx_keyidx];
-		tx.host_encrypt = 1;
-	} else {
-		tx.crypt = NULL;
-		tx.host_encrypt = 0;
-	}
-
-	if (skb->len < 24) {
-		printk(KERN_DEBUG "%s: hostap_master_start_xmit: short skb "
-		       "(len=%d)\n", dev->name, skb->len);
-		ret = 0;
-		iface->stats.tx_dropped++;
-		goto fail;
-	}
-
-	/* FIX (?):
-	 * Wi-Fi 802.11b test plan suggests that AP should ignore power save
-	 * bit in authentication and (re)association frames and assume tha
-	 * STA remains awake for the response. */
-	tx_ret = hostap_handle_sta_tx(local, &tx);
-	skb = tx.skb;
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-	hdr = (struct ieee80211_hdr *) skb->data;
- 	fc = le16_to_cpu(hdr->frame_ctl);
-	switch (tx_ret) {
-	case AP_TX_CONTINUE:
-		break;
-	case AP_TX_CONTINUE_NOT_AUTHORIZED:
-		if (local->ieee_802_1x &&
-		    WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA &&
-		    meta->ethertype != ETH_P_PAE &&
-		    !(meta->flags & HOSTAP_TX_FLAGS_WDS)) {
-			printk(KERN_DEBUG "%s: dropped frame to unauthorized "
-			       "port (IEEE 802.1X): ethertype=0x%04x\n",
-			       dev->name, meta->ethertype);
-			hostap_dump_tx_80211(dev->name, skb);
-
-			ret = 0; /* drop packet */
-			iface->stats.tx_dropped++;
-			goto fail;
-		}
-		break;
-	case AP_TX_DROP:
-		ret = 0; /* drop packet */
-		iface->stats.tx_dropped++;
-		goto fail;
-	case AP_TX_RETRY:
-		goto fail;
-	case AP_TX_BUFFERED:
-		/* do not free skb here, it will be freed when the
-		 * buffered frame is sent/timed out */
-		ret = 0;
-		goto tx_exit;
-	}
-
-	/* Request TX callback if protocol version is 2 in 802.11 header;
-	 * this version 2 is a special case used between hostapd and kernel
-	 * driver */
-	if (((fc & IEEE80211_FCTL_VERS) == BIT(1)) &&
-	    local->ap && local->ap->tx_callback_idx && meta->tx_cb_idx == 0) {
-		meta->tx_cb_idx = local->ap->tx_callback_idx;
-
-		/* remove special version from the frame header */
-		fc &= ~IEEE80211_FCTL_VERS;
-		hdr->frame_ctl = cpu_to_le16(fc);
-	}
-
-	if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_DATA) {
-		no_encrypt = 1;
-		tx.crypt = NULL;
-	}
-
-	if (local->ieee_802_1x && meta->ethertype == ETH_P_PAE && tx.crypt &&
-	    !(fc & IEEE80211_FCTL_VERS)) {
-		no_encrypt = 1;
-		PDEBUG(DEBUG_EXTRA2, "%s: TX: IEEE 802.1X - passing "
-		       "unencrypted EAPOL frame\n", dev->name);
-		tx.crypt = NULL; /* no encryption for IEEE 802.1X frames */
-	}
-
-	if (tx.crypt && (!tx.crypt->ops || !tx.crypt->ops->encrypt_mpdu))
-		tx.crypt = NULL;
-	else if ((tx.crypt || local->crypt[local->tx_keyidx]) && !no_encrypt) {
-		/* Add ISWEP flag both for firmware and host based encryption
-		 */
-		fc |= IEEE80211_FCTL_PROTECTED;
-		hdr->frame_ctl = cpu_to_le16(fc);
-	} else if (local->drop_unencrypted &&
-		   WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA &&
-		   meta->ethertype != ETH_P_PAE) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "%s: dropped unencrypted TX data "
-			       "frame (drop_unencrypted=1)\n", dev->name);
-		}
-		iface->stats.tx_dropped++;
-		ret = 0;
-		goto fail;
-	}
-
-	if (tx.crypt) {
-		skb = hostap_tx_encrypt(skb, tx.crypt);
-		if (skb == NULL) {
-			printk(KERN_DEBUG "%s: TX - encryption failed\n",
-			       dev->name);
-			ret = 0;
-			goto fail;
-		}
-		meta = (struct hostap_skb_tx_data *) skb->cb;
-		if (meta->magic != HOSTAP_SKB_TX_DATA_MAGIC) {
-			printk(KERN_DEBUG "%s: invalid skb->cb magic (0x%08x, "
-			       "expected 0x%08x) after hostap_tx_encrypt\n",
-			       dev->name, meta->magic,
-			       HOSTAP_SKB_TX_DATA_MAGIC);
-			ret = 0;
-			iface->stats.tx_dropped++;
-			goto fail;
-		}
-	}
-
-	if (local->func->tx == NULL || local->func->tx(skb, dev)) {
-		ret = 0;
-		iface->stats.tx_dropped++;
-	} else {
-		ret = 0;
-		iface->stats.tx_packets++;
-		iface->stats.tx_bytes += skb->len;
-	}
-
- fail:
-	if (!ret && skb)
-		dev_kfree_skb(skb);
- tx_exit:
-	if (tx.sta_ptr)
-		hostap_handle_sta_release(tx.sta_ptr);
-	return ret;
-}
-
-
-EXPORT_SYMBOL(hostap_dump_tx_80211);
-EXPORT_SYMBOL(hostap_tx_encrypt);
-EXPORT_SYMBOL(hostap_master_start_xmit);
diff --git a/trunk/drivers/net/wireless/hostap/hostap_ap.c b/trunk/drivers/net/wireless/hostap/hostap_ap.c
deleted file mode 100644
index 930cef8367f2..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_ap.c
+++ /dev/null
@@ -1,3288 +0,0 @@
-/*
- * Intersil Prism2 driver with Host AP (software access point) support
- * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
- * <jkmaline@cc.hut.fi>
- * Copyright (c) 2002-2005, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This file is to be included into hostap.c when S/W AP functionality is
- * compiled.
- *
- * AP:  FIX:
- * - if unicast Class 2 (assoc,reassoc,disassoc) frame received from
- *   unauthenticated STA, send deauth. frame (8802.11: 5.5)
- * - if unicast Class 3 (data with to/from DS,deauth,pspoll) frame received
- *   from authenticated, but unassoc STA, send disassoc frame (8802.11: 5.5)
- * - if unicast Class 3 received from unauthenticated STA, send deauth. frame
- *   (8802.11: 5.5)
- */
-
-static int other_ap_policy[MAX_PARM_DEVICES] = { AP_OTHER_AP_SKIP_ALL,
-						 DEF_INTS };
-module_param_array(other_ap_policy, int, NULL, 0444);
-MODULE_PARM_DESC(other_ap_policy, "Other AP beacon monitoring policy (0-3)");
-
-static int ap_max_inactivity[MAX_PARM_DEVICES] = { AP_MAX_INACTIVITY_SEC,
-						   DEF_INTS };
-module_param_array(ap_max_inactivity, int, NULL, 0444);
-MODULE_PARM_DESC(ap_max_inactivity, "AP timeout (in seconds) for station "
-		 "inactivity");
-
-static int ap_bridge_packets[MAX_PARM_DEVICES] = { 1, DEF_INTS };
-module_param_array(ap_bridge_packets, int, NULL, 0444);
-MODULE_PARM_DESC(ap_bridge_packets, "Bridge packets directly between "
-		 "stations");
-
-static int autom_ap_wds[MAX_PARM_DEVICES] = { 0, DEF_INTS };
-module_param_array(autom_ap_wds, int, NULL, 0444);
-MODULE_PARM_DESC(autom_ap_wds, "Add WDS connections to other APs "
-		 "automatically");
-
-
-static struct sta_info* ap_get_sta(struct ap_data *ap, u8 *sta);
-static void hostap_event_expired_sta(struct net_device *dev,
-				     struct sta_info *sta);
-static void handle_add_proc_queue(void *data);
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-static void handle_wds_oper_queue(void *data);
-static void prism2_send_mgmt(struct net_device *dev,
-			     u16 type_subtype, char *body,
-			     int body_len, u8 *addr, u16 tx_cb_idx);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-#ifndef PRISM2_NO_PROCFS_DEBUG
-static int ap_debug_proc_read(char *page, char **start, off_t off,
-			      int count, int *eof, void *data)
-{
-	char *p = page;
-	struct ap_data *ap = (struct ap_data *) data;
-
-	if (off != 0) {
-		*eof = 1;
-		return 0;
-	}
-
-	p += sprintf(p, "BridgedUnicastFrames=%u\n", ap->bridged_unicast);
-	p += sprintf(p, "BridgedMulticastFrames=%u\n", ap->bridged_multicast);
-	p += sprintf(p, "max_inactivity=%u\n", ap->max_inactivity / HZ);
-	p += sprintf(p, "bridge_packets=%u\n", ap->bridge_packets);
-	p += sprintf(p, "nullfunc_ack=%u\n", ap->nullfunc_ack);
-	p += sprintf(p, "autom_ap_wds=%u\n", ap->autom_ap_wds);
-	p += sprintf(p, "auth_algs=%u\n", ap->local->auth_algs);
-	p += sprintf(p, "tx_drop_nonassoc=%u\n", ap->tx_drop_nonassoc);
-
-	return (p - page);
-}
-#endif /* PRISM2_NO_PROCFS_DEBUG */
-
-
-static void ap_sta_hash_add(struct ap_data *ap, struct sta_info *sta)
-{
-	sta->hnext = ap->sta_hash[STA_HASH(sta->addr)];
-	ap->sta_hash[STA_HASH(sta->addr)] = sta;
-}
-
-static void ap_sta_hash_del(struct ap_data *ap, struct sta_info *sta)
-{
-	struct sta_info *s;
-
-	s = ap->sta_hash[STA_HASH(sta->addr)];
-	if (s == NULL) return;
-	if (memcmp(s->addr, sta->addr, ETH_ALEN) == 0) {
-		ap->sta_hash[STA_HASH(sta->addr)] = s->hnext;
-		return;
-	}
-
-	while (s->hnext != NULL && memcmp(s->hnext->addr, sta->addr, ETH_ALEN)
-	       != 0)
-		s = s->hnext;
-	if (s->hnext != NULL)
-		s->hnext = s->hnext->hnext;
-	else
-		printk("AP: could not remove STA " MACSTR " from hash table\n",
-		       MAC2STR(sta->addr));
-}
-
-static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
-{
-	if (sta->ap && sta->local)
-		hostap_event_expired_sta(sta->local->dev, sta);
-
-	if (ap->proc != NULL) {
-		char name[20];
-		sprintf(name, MACSTR, MAC2STR(sta->addr));
-		remove_proc_entry(name, ap->proc);
-	}
-
-	if (sta->crypt) {
-		sta->crypt->ops->deinit(sta->crypt->priv);
-		kfree(sta->crypt);
-		sta->crypt = NULL;
-	}
-
-	skb_queue_purge(&sta->tx_buf);
-
-	ap->num_sta--;
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	if (sta->aid > 0)
-		ap->sta_aid[sta->aid - 1] = NULL;
-
-	if (!sta->ap && sta->u.sta.challenge)
-		kfree(sta->u.sta.challenge);
-	del_timer(&sta->timer);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-	kfree(sta);
-}
-
-
-static void hostap_set_tim(local_info_t *local, int aid, int set)
-{
-	if (local->func->set_tim)
-		local->func->set_tim(local->dev, aid, set);
-}
-
-
-static void hostap_event_new_sta(struct net_device *dev, struct sta_info *sta)
-{
-	union iwreq_data wrqu;
-	memset(&wrqu, 0, sizeof(wrqu));
-	memcpy(wrqu.addr.sa_data, sta->addr, ETH_ALEN);
-	wrqu.addr.sa_family = ARPHRD_ETHER;
-	wireless_send_event(dev, IWEVREGISTERED, &wrqu, NULL);
-}
-
-
-static void hostap_event_expired_sta(struct net_device *dev,
-				     struct sta_info *sta)
-{
-	union iwreq_data wrqu;
-	memset(&wrqu, 0, sizeof(wrqu));
-	memcpy(wrqu.addr.sa_data, sta->addr, ETH_ALEN);
-	wrqu.addr.sa_family = ARPHRD_ETHER;
-	wireless_send_event(dev, IWEVEXPIRED, &wrqu, NULL);
-}
-
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-
-static void ap_handle_timer(unsigned long data)
-{
-	struct sta_info *sta = (struct sta_info *) data;
-	local_info_t *local;
-	struct ap_data *ap;
-	unsigned long next_time = 0;
-	int was_assoc;
-
-	if (sta == NULL || sta->local == NULL || sta->local->ap == NULL) {
-		PDEBUG(DEBUG_AP, "ap_handle_timer() called with NULL data\n");
-		return;
-	}
-
-	local = sta->local;
-	ap = local->ap;
-	was_assoc = sta->flags & WLAN_STA_ASSOC;
-
-	if (atomic_read(&sta->users) != 0)
-		next_time = jiffies + HZ;
-	else if ((sta->flags & WLAN_STA_PERM) && !(sta->flags & WLAN_STA_AUTH))
-		next_time = jiffies + ap->max_inactivity;
-
-	if (time_before(jiffies, sta->last_rx + ap->max_inactivity)) {
-		/* station activity detected; reset timeout state */
-		sta->timeout_next = STA_NULLFUNC;
-		next_time = sta->last_rx + ap->max_inactivity;
-	} else if (sta->timeout_next == STA_DISASSOC &&
-		   !(sta->flags & WLAN_STA_PENDING_POLL)) {
-		/* STA ACKed data nullfunc frame poll */
-		sta->timeout_next = STA_NULLFUNC;
-		next_time = jiffies + ap->max_inactivity;
-	}
-
-	if (next_time) {
-		sta->timer.expires = next_time;
-		add_timer(&sta->timer);
-		return;
-	}
-
-	if (sta->ap)
-		sta->timeout_next = STA_DEAUTH;
-
-	if (sta->timeout_next == STA_DEAUTH && !(sta->flags & WLAN_STA_PERM)) {
-		spin_lock(&ap->sta_table_lock);
-		ap_sta_hash_del(ap, sta);
-		list_del(&sta->list);
-		spin_unlock(&ap->sta_table_lock);
-		sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
-	} else if (sta->timeout_next == STA_DISASSOC)
-		sta->flags &= ~WLAN_STA_ASSOC;
-
-	if (was_assoc && !(sta->flags & WLAN_STA_ASSOC) && !sta->ap)
-		hostap_event_expired_sta(local->dev, sta);
-
-	if (sta->timeout_next == STA_DEAUTH && sta->aid > 0 &&
-	    !skb_queue_empty(&sta->tx_buf)) {
-		hostap_set_tim(local, sta->aid, 0);
-		sta->flags &= ~WLAN_STA_TIM;
-	}
-
-	if (sta->ap) {
-		if (ap->autom_ap_wds) {
-			PDEBUG(DEBUG_AP, "%s: removing automatic WDS "
-			       "connection to AP " MACSTR "\n",
-			       local->dev->name, MAC2STR(sta->addr));
-			hostap_wds_link_oper(local, sta->addr, WDS_DEL);
-		}
-	} else if (sta->timeout_next == STA_NULLFUNC) {
-		/* send data frame to poll STA and check whether this frame
-		 * is ACKed */
-		/* FIX: IEEE80211_STYPE_NULLFUNC would be more appropriate, but
-		 * it is apparently not retried so TX Exc events are not
-		 * received for it */
-		sta->flags |= WLAN_STA_PENDING_POLL;
-		prism2_send_mgmt(local->dev, IEEE80211_FTYPE_DATA |
-				 IEEE80211_STYPE_DATA, NULL, 0,
-				 sta->addr, ap->tx_callback_poll);
-	} else {
-		int deauth = sta->timeout_next == STA_DEAUTH;
-		u16 resp;
-		PDEBUG(DEBUG_AP, "%s: sending %s info to STA " MACSTR
-		       "(last=%lu, jiffies=%lu)\n",
-		       local->dev->name,
-		       deauth ? "deauthentication" : "disassociation",
-		       MAC2STR(sta->addr), sta->last_rx, jiffies);
-
-		resp = cpu_to_le16(deauth ? WLAN_REASON_PREV_AUTH_NOT_VALID :
-				   WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
-		prism2_send_mgmt(local->dev, IEEE80211_FTYPE_MGMT |
-				 (deauth ? IEEE80211_STYPE_DEAUTH :
-				  IEEE80211_STYPE_DISASSOC),
-				 (char *) &resp, 2, sta->addr, 0);
-	}
-
-	if (sta->timeout_next == STA_DEAUTH) {
-		if (sta->flags & WLAN_STA_PERM) {
-			PDEBUG(DEBUG_AP, "%s: STA " MACSTR " would have been "
-			       "removed, but it has 'perm' flag\n",
-			       local->dev->name, MAC2STR(sta->addr));
-		} else
-			ap_free_sta(ap, sta);
-		return;
-	}
-
-	if (sta->timeout_next == STA_NULLFUNC) {
-		sta->timeout_next = STA_DISASSOC;
-		sta->timer.expires = jiffies + AP_DISASSOC_DELAY;
-	} else {
-		sta->timeout_next = STA_DEAUTH;
-		sta->timer.expires = jiffies + AP_DEAUTH_DELAY;
-	}
-
-	add_timer(&sta->timer);
-}
-
-
-void hostap_deauth_all_stas(struct net_device *dev, struct ap_data *ap,
-			    int resend)
-{
-	u8 addr[ETH_ALEN];
-	u16 resp;
-	int i;
-
-	PDEBUG(DEBUG_AP, "%s: Deauthenticate all stations\n", dev->name);
-	memset(addr, 0xff, ETH_ALEN);
-
-	resp = __constant_cpu_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID);
-
-	/* deauth message sent; try to resend it few times; the message is
-	 * broadcast, so it may be delayed until next DTIM; there is not much
-	 * else we can do at this point since the driver is going to be shut
-	 * down */
-	for (i = 0; i < 5; i++) {
-		prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT |
-				 IEEE80211_STYPE_DEAUTH,
-				 (char *) &resp, 2, addr, 0);
-
-		if (!resend || ap->num_sta <= 0)
-			return;
-
-		mdelay(50);
-	}
-}
-
-
-static int ap_control_proc_read(char *page, char **start, off_t off,
-				int count, int *eof, void *data)
-{
-	char *p = page;
-	struct ap_data *ap = (struct ap_data *) data;
-	char *policy_txt;
-	struct list_head *ptr;
-	struct mac_entry *entry;
-
-	if (off != 0) {
-		*eof = 1;
-		return 0;
-	}
-
-	switch (ap->mac_restrictions.policy) {
-	case MAC_POLICY_OPEN:
-		policy_txt = "open";
-		break;
-	case MAC_POLICY_ALLOW:
-		policy_txt = "allow";
-		break;
-	case MAC_POLICY_DENY:
-		policy_txt = "deny";
-		break;
-	default:
-		policy_txt = "unknown";
-		break;
-	};
-	p += sprintf(p, "MAC policy: %s\n", policy_txt);
-	p += sprintf(p, "MAC entries: %u\n", ap->mac_restrictions.entries);
-	p += sprintf(p, "MAC list:\n");
-	spin_lock_bh(&ap->mac_restrictions.lock);
-	for (ptr = ap->mac_restrictions.mac_list.next;
-	     ptr != &ap->mac_restrictions.mac_list; ptr = ptr->next) {
-		if (p - page > PAGE_SIZE - 80) {
-			p += sprintf(p, "All entries did not fit one page.\n");
-			break;
-		}
-
-		entry = list_entry(ptr, struct mac_entry, list);
-		p += sprintf(p, MACSTR "\n", MAC2STR(entry->addr));
-	}
-	spin_unlock_bh(&ap->mac_restrictions.lock);
-
-	return (p - page);
-}
-
-
-static int ap_control_add_mac(struct mac_restrictions *mac_restrictions,
-			      u8 *mac)
-{
-	struct mac_entry *entry;
-
-	entry = kmalloc(sizeof(struct mac_entry), GFP_KERNEL);
-	if (entry == NULL)
-		return -1;
-
-	memcpy(entry->addr, mac, ETH_ALEN);
-
-	spin_lock_bh(&mac_restrictions->lock);
-	list_add_tail(&entry->list, &mac_restrictions->mac_list);
-	mac_restrictions->entries++;
-	spin_unlock_bh(&mac_restrictions->lock);
-
-	return 0;
-}
-
-
-static int ap_control_del_mac(struct mac_restrictions *mac_restrictions,
-			      u8 *mac)
-{
-	struct list_head *ptr;
-	struct mac_entry *entry;
-
-	spin_lock_bh(&mac_restrictions->lock);
-	for (ptr = mac_restrictions->mac_list.next;
-	     ptr != &mac_restrictions->mac_list; ptr = ptr->next) {
-		entry = list_entry(ptr, struct mac_entry, list);
-
-		if (memcmp(entry->addr, mac, ETH_ALEN) == 0) {
-			list_del(ptr);
-			kfree(entry);
-			mac_restrictions->entries--;
-			spin_unlock_bh(&mac_restrictions->lock);
-			return 0;
-		}
-	}
-	spin_unlock_bh(&mac_restrictions->lock);
-	return -1;
-}
-
-
-static int ap_control_mac_deny(struct mac_restrictions *mac_restrictions,
-			       u8 *mac)
-{
-	struct list_head *ptr;
-	struct mac_entry *entry;
-	int found = 0;
-
-	if (mac_restrictions->policy == MAC_POLICY_OPEN)
-		return 0;
-
-	spin_lock_bh(&mac_restrictions->lock);
-	for (ptr = mac_restrictions->mac_list.next;
-	     ptr != &mac_restrictions->mac_list; ptr = ptr->next) {
-		entry = list_entry(ptr, struct mac_entry, list);
-
-		if (memcmp(entry->addr, mac, ETH_ALEN) == 0) {
-			found = 1;
-			break;
-		}
-	}
-	spin_unlock_bh(&mac_restrictions->lock);
-
-	if (mac_restrictions->policy == MAC_POLICY_ALLOW)
-		return !found;
-	else
-		return found;
-}
-
-
-static void ap_control_flush_macs(struct mac_restrictions *mac_restrictions)
-{
-	struct list_head *ptr, *n;
-	struct mac_entry *entry;
-
-	if (mac_restrictions->entries == 0)
-		return;
-
-	spin_lock_bh(&mac_restrictions->lock);
-	for (ptr = mac_restrictions->mac_list.next, n = ptr->next;
-	     ptr != &mac_restrictions->mac_list;
-	     ptr = n, n = ptr->next) {
-		entry = list_entry(ptr, struct mac_entry, list);
-		list_del(ptr);
-		kfree(entry);
-	}
-	mac_restrictions->entries = 0;
-	spin_unlock_bh(&mac_restrictions->lock);
-}
-
-
-static int ap_control_kick_mac(struct ap_data *ap, struct net_device *dev,
-			       u8 *mac)
-{
-	struct sta_info *sta;
-	u16 resp;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, mac);
-	if (sta) {
-		ap_sta_hash_del(ap, sta);
-		list_del(&sta->list);
-	}
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	if (!sta)
-		return -EINVAL;
-
-	resp = cpu_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID);
-	prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_DEAUTH,
-			 (char *) &resp, 2, sta->addr, 0);
-
-	if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap)
-		hostap_event_expired_sta(dev, sta);
-
-	ap_free_sta(ap, sta);
-
-	return 0;
-}
-
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-static void ap_control_kickall(struct ap_data *ap)
-{
-	struct list_head *ptr, *n;
-	struct sta_info *sta;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	for (ptr = ap->sta_list.next, n = ptr->next; ptr != &ap->sta_list;
-	     ptr = n, n = ptr->next) {
-		sta = list_entry(ptr, struct sta_info, list);
-		ap_sta_hash_del(ap, sta);
-		list_del(&sta->list);
-		if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
-			hostap_event_expired_sta(sta->local->dev, sta);
-		ap_free_sta(ap, sta);
-	}
-	spin_unlock_bh(&ap->sta_table_lock);
-}
-
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-
-#define PROC_LIMIT (PAGE_SIZE - 80)
-
-static int prism2_ap_proc_read(char *page, char **start, off_t off,
-			       int count, int *eof, void *data)
-{
-	char *p = page;
-	struct ap_data *ap = (struct ap_data *) data;
-	struct list_head *ptr;
-	int i;
-
-	if (off > PROC_LIMIT) {
-		*eof = 1;
-		return 0;
-	}
-
-	p += sprintf(p, "# BSSID CHAN SIGNAL NOISE RATE SSID FLAGS\n");
-	spin_lock_bh(&ap->sta_table_lock);
-	for (ptr = ap->sta_list.next; ptr != &ap->sta_list; ptr = ptr->next) {
-		struct sta_info *sta = (struct sta_info *) ptr;
-
-		if (!sta->ap)
-			continue;
-
-		p += sprintf(p, MACSTR " %d %d %d %d '", MAC2STR(sta->addr),
-			     sta->u.ap.channel, sta->last_rx_signal,
-			     sta->last_rx_silence, sta->last_rx_rate);
-		for (i = 0; i < sta->u.ap.ssid_len; i++)
-			p += sprintf(p, ((sta->u.ap.ssid[i] >= 32 &&
-					  sta->u.ap.ssid[i] < 127) ?
-					 "%c" : "<%02x>"),
-				     sta->u.ap.ssid[i]);
-		p += sprintf(p, "'");
-		if (sta->capability & WLAN_CAPABILITY_ESS)
-			p += sprintf(p, " [ESS]");
-		if (sta->capability & WLAN_CAPABILITY_IBSS)
-			p += sprintf(p, " [IBSS]");
-		if (sta->capability & WLAN_CAPABILITY_PRIVACY)
-			p += sprintf(p, " [WEP]");
-		p += sprintf(p, "\n");
-
-		if ((p - page) > PROC_LIMIT) {
-			printk(KERN_DEBUG "hostap: ap proc did not fit\n");
-			break;
-		}
-	}
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	if ((p - page) <= off) {
-		*eof = 1;
-		return 0;
-	}
-
-	*start = page + off;
-
-	return (p - page - off);
-}
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-void hostap_check_sta_fw_version(struct ap_data *ap, int sta_fw_ver)
-{
-	if (!ap)
-		return;
-
-	if (sta_fw_ver == PRISM2_FW_VER(0,8,0)) {
-		PDEBUG(DEBUG_AP, "Using data::nullfunc ACK workaround - "
-		       "firmware upgrade recommended\n");
-		ap->nullfunc_ack = 1;
-	} else
-		ap->nullfunc_ack = 0;
-
-	if (sta_fw_ver == PRISM2_FW_VER(1,4,2)) {
-		printk(KERN_WARNING "%s: Warning: secondary station firmware "
-		       "version 1.4.2 does not seem to work in Host AP mode\n",
-		       ap->local->dev->name);
-	}
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void hostap_ap_tx_cb(struct sk_buff *skb, int ok, void *data)
-{
-	struct ap_data *ap = data;
-	u16 fc;
-	struct ieee80211_hdr *hdr;
-
-	if (!ap->local->hostapd || !ap->local->apdev) {
-		dev_kfree_skb(skb);
-		return;
-	}
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	fc = le16_to_cpu(hdr->frame_ctl);
-
-	/* Pass the TX callback frame to the hostapd; use 802.11 header version
-	 * 1 to indicate failure (no ACK) and 2 success (frame ACKed) */
-
-	fc &= ~IEEE80211_FCTL_VERS;
-	fc |= ok ? BIT(1) : BIT(0);
-	hdr->frame_ctl = cpu_to_le16(fc);
-
-	skb->dev = ap->local->apdev;
-	skb_pull(skb, hostap_80211_get_hdrlen(fc));
-	skb->pkt_type = PACKET_OTHERHOST;
-	skb->protocol = __constant_htons(ETH_P_802_2);
-	memset(skb->cb, 0, sizeof(skb->cb));
-	netif_rx(skb);
-}
-
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-/* Called only as a tasklet (software IRQ) */
-static void hostap_ap_tx_cb_auth(struct sk_buff *skb, int ok, void *data)
-{
-	struct ap_data *ap = data;
-	struct net_device *dev = ap->local->dev;
-	struct ieee80211_hdr *hdr;
-	u16 fc, *pos, auth_alg, auth_transaction, status;
-	struct sta_info *sta = NULL;
-	char *txt = NULL;
-
-	if (ap->local->hostapd) {
-		dev_kfree_skb(skb);
-		return;
-	}
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	fc = le16_to_cpu(hdr->frame_ctl);
-	if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_MGMT ||
-	    WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_AUTH ||
-	    skb->len < IEEE80211_MGMT_HDR_LEN + 6) {
-		printk(KERN_DEBUG "%s: hostap_ap_tx_cb_auth received invalid "
-		       "frame\n", dev->name);
-		dev_kfree_skb(skb);
-		return;
-	}
-
-	pos = (u16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
-	auth_alg = le16_to_cpu(*pos++);
-	auth_transaction = le16_to_cpu(*pos++);
-	status = le16_to_cpu(*pos++);
-
-	if (!ok) {
-		txt = "frame was not ACKed";
-		goto done;
-	}
-
-	spin_lock(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, hdr->addr1);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock(&ap->sta_table_lock);
-
-	if (!sta) {
-		txt = "STA not found";
-		goto done;
-	}
-
-	if (status == WLAN_STATUS_SUCCESS &&
-	    ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
-	     (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
-		txt = "STA authenticated";
-		sta->flags |= WLAN_STA_AUTH;
-		sta->last_auth = jiffies;
-	} else if (status != WLAN_STATUS_SUCCESS)
-		txt = "authentication failed";
-
- done:
-	if (sta)
-		atomic_dec(&sta->users);
-	if (txt) {
-		PDEBUG(DEBUG_AP, "%s: " MACSTR " auth_cb - alg=%d trans#=%d "
-		       "status=%d - %s\n",
-		       dev->name, MAC2STR(hdr->addr1), auth_alg,
-		       auth_transaction, status, txt);
-	}
-	dev_kfree_skb(skb);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
-{
-	struct ap_data *ap = data;
-	struct net_device *dev = ap->local->dev;
-	struct ieee80211_hdr *hdr;
-	u16 fc, *pos, status;
-	struct sta_info *sta = NULL;
-	char *txt = NULL;
-
-	if (ap->local->hostapd) {
-		dev_kfree_skb(skb);
-		return;
-	}
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	fc = le16_to_cpu(hdr->frame_ctl);
-	if (WLAN_FC_GET_TYPE(fc) != IEEE80211_FTYPE_MGMT ||
-	    (WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_ASSOC_RESP &&
-	     WLAN_FC_GET_STYPE(fc) != IEEE80211_STYPE_REASSOC_RESP) ||
-	    skb->len < IEEE80211_MGMT_HDR_LEN + 4) {
-		printk(KERN_DEBUG "%s: hostap_ap_tx_cb_assoc received invalid "
-		       "frame\n", dev->name);
-		dev_kfree_skb(skb);
-		return;
-	}
-
-	if (!ok) {
-		txt = "frame was not ACKed";
-		goto done;
-	}
-
-	spin_lock(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, hdr->addr1);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock(&ap->sta_table_lock);
-
-	if (!sta) {
-		txt = "STA not found";
-		goto done;
-	}
-
-	pos = (u16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
-	pos++;
-	status = le16_to_cpu(*pos++);
-	if (status == WLAN_STATUS_SUCCESS) {
-		if (!(sta->flags & WLAN_STA_ASSOC))
-			hostap_event_new_sta(dev, sta);
-		txt = "STA associated";
-		sta->flags |= WLAN_STA_ASSOC;
-		sta->last_assoc = jiffies;
-	} else
-		txt = "association failed";
-
- done:
-	if (sta)
-		atomic_dec(&sta->users);
-	if (txt) {
-		PDEBUG(DEBUG_AP, "%s: " MACSTR " assoc_cb - %s\n",
-		       dev->name, MAC2STR(hdr->addr1), txt);
-	}
-	dev_kfree_skb(skb);
-}
-
-/* Called only as a tasklet (software IRQ); TX callback for poll frames used
- * in verifying whether the STA is still present. */
-static void hostap_ap_tx_cb_poll(struct sk_buff *skb, int ok, void *data)
-{
-	struct ap_data *ap = data;
-	struct ieee80211_hdr *hdr;
-	struct sta_info *sta;
-
-	if (skb->len < 24)
-		goto fail;
-	hdr = (struct ieee80211_hdr *) skb->data;
-	if (ok) {
-		spin_lock(&ap->sta_table_lock);
-		sta = ap_get_sta(ap, hdr->addr1);
-		if (sta)
-			sta->flags &= ~WLAN_STA_PENDING_POLL;
-		spin_unlock(&ap->sta_table_lock);
-	} else {
-		PDEBUG(DEBUG_AP, "%s: STA " MACSTR " did not ACK activity "
-		       "poll frame\n", ap->local->dev->name,
-		       MAC2STR(hdr->addr1));
-	}
-
- fail:
-	dev_kfree_skb(skb);
-}
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-void hostap_init_data(local_info_t *local)
-{
-	struct ap_data *ap = local->ap;
-
-	if (ap == NULL) {
-		printk(KERN_WARNING "hostap_init_data: ap == NULL\n");
-		return;
-	}
-	memset(ap, 0, sizeof(struct ap_data));
-	ap->local = local;
-
-	ap->ap_policy = GET_INT_PARM(other_ap_policy, local->card_idx);
-	ap->bridge_packets = GET_INT_PARM(ap_bridge_packets, local->card_idx);
-	ap->max_inactivity =
-		GET_INT_PARM(ap_max_inactivity, local->card_idx) * HZ;
-	ap->autom_ap_wds = GET_INT_PARM(autom_ap_wds, local->card_idx);
-
-	spin_lock_init(&ap->sta_table_lock);
-	INIT_LIST_HEAD(&ap->sta_list);
-
-	/* Initialize task queue structure for AP management */
-	INIT_WORK(&local->ap->add_sta_proc_queue, handle_add_proc_queue, ap);
-
-	ap->tx_callback_idx =
-		hostap_tx_callback_register(local, hostap_ap_tx_cb, ap);
-	if (ap->tx_callback_idx == 0)
-		printk(KERN_WARNING "%s: failed to register TX callback for "
-		       "AP\n", local->dev->name);
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	INIT_WORK(&local->ap->wds_oper_queue, handle_wds_oper_queue, local);
-
-	ap->tx_callback_auth =
-		hostap_tx_callback_register(local, hostap_ap_tx_cb_auth, ap);
-	ap->tx_callback_assoc =
-		hostap_tx_callback_register(local, hostap_ap_tx_cb_assoc, ap);
-	ap->tx_callback_poll =
-		hostap_tx_callback_register(local, hostap_ap_tx_cb_poll, ap);
-	if (ap->tx_callback_auth == 0 || ap->tx_callback_assoc == 0 ||
-		ap->tx_callback_poll == 0)
-		printk(KERN_WARNING "%s: failed to register TX callback for "
-		       "AP\n", local->dev->name);
-
-	spin_lock_init(&ap->mac_restrictions.lock);
-	INIT_LIST_HEAD(&ap->mac_restrictions.mac_list);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-	ap->initialized = 1;
-}
-
-
-void hostap_init_ap_proc(local_info_t *local)
-{
-	struct ap_data *ap = local->ap;
-
-	ap->proc = local->proc;
-	if (ap->proc == NULL)
-		return;
-
-#ifndef PRISM2_NO_PROCFS_DEBUG
-	create_proc_read_entry("ap_debug", 0, ap->proc,
-			       ap_debug_proc_read, ap);
-#endif /* PRISM2_NO_PROCFS_DEBUG */
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	create_proc_read_entry("ap_control", 0, ap->proc,
-			       ap_control_proc_read, ap);
-	create_proc_read_entry("ap", 0, ap->proc,
-			       prism2_ap_proc_read, ap);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-}
-
-
-void hostap_free_data(struct ap_data *ap)
-{
-	struct list_head *n, *ptr;
-
-	if (ap == NULL || !ap->initialized) {
-		printk(KERN_DEBUG "hostap_free_data: ap has not yet been "
-		       "initialized - skip resource freeing\n");
-		return;
-	}
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	if (ap->crypt)
-		ap->crypt->deinit(ap->crypt_priv);
-	ap->crypt = ap->crypt_priv = NULL;
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-	list_for_each_safe(ptr, n, &ap->sta_list) {
-		struct sta_info *sta = list_entry(ptr, struct sta_info, list);
-		ap_sta_hash_del(ap, sta);
-		list_del(&sta->list);
-		if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
-			hostap_event_expired_sta(sta->local->dev, sta);
-		ap_free_sta(ap, sta);
-	}
-
-#ifndef PRISM2_NO_PROCFS_DEBUG
-	if (ap->proc != NULL) {
-		remove_proc_entry("ap_debug", ap->proc);
-	}
-#endif /* PRISM2_NO_PROCFS_DEBUG */
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	if (ap->proc != NULL) {
-	  remove_proc_entry("ap", ap->proc);
-		remove_proc_entry("ap_control", ap->proc);
-	}
-	ap_control_flush_macs(&ap->mac_restrictions);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-	ap->initialized = 0;
-}
-
-
-/* caller should have mutex for AP STA list handling */
-static struct sta_info* ap_get_sta(struct ap_data *ap, u8 *sta)
-{
-	struct sta_info *s;
-
-	s = ap->sta_hash[STA_HASH(sta)];
-	while (s != NULL && memcmp(s->addr, sta, ETH_ALEN) != 0)
-		s = s->hnext;
-	return s;
-}
-
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-
-/* Called from timer handler and from scheduled AP queue handlers */
-static void prism2_send_mgmt(struct net_device *dev,
-			     u16 type_subtype, char *body,
-			     int body_len, u8 *addr, u16 tx_cb_idx)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct ieee80211_hdr *hdr;
-	u16 fc;
-	struct sk_buff *skb;
-	struct hostap_skb_tx_data *meta;
-	int hdrlen;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	dev = local->dev; /* always use master radio device */
-	iface = netdev_priv(dev);
-
-	if (!(dev->flags & IFF_UP)) {
-		PDEBUG(DEBUG_AP, "%s: prism2_send_mgmt - device is not UP - "
-		       "cannot send frame\n", dev->name);
-		return;
-	}
-
-	skb = dev_alloc_skb(sizeof(*hdr) + body_len);
-	if (skb == NULL) {
-		PDEBUG(DEBUG_AP, "%s: prism2_send_mgmt failed to allocate "
-		       "skb\n", dev->name);
-		return;
-	}
-
-	fc = type_subtype;
-	hdrlen = hostap_80211_get_hdrlen(fc);
-	hdr = (struct ieee80211_hdr *) skb_put(skb, hdrlen);
-	if (body)
-		memcpy(skb_put(skb, body_len), body, body_len);
-
-	memset(hdr, 0, hdrlen);
-
-	/* FIX: ctrl::ack sending used special HFA384X_TX_CTRL_802_11
-	 * tx_control instead of using local->tx_control */
-
-
-	memcpy(hdr->addr1, addr, ETH_ALEN); /* DA / RA */
-	if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) {
-		fc |= IEEE80211_FCTL_FROMDS;
-		memcpy(hdr->addr2, dev->dev_addr, ETH_ALEN); /* BSSID */
-		memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* SA */
-	} else if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_CTL) {
-		/* control:ACK does not have addr2 or addr3 */
-		memset(hdr->addr2, 0, ETH_ALEN);
-		memset(hdr->addr3, 0, ETH_ALEN);
-	} else {
-		memcpy(hdr->addr2, dev->dev_addr, ETH_ALEN); /* SA */
-		memcpy(hdr->addr3, dev->dev_addr, ETH_ALEN); /* BSSID */
-	}
-
-	hdr->frame_ctl = cpu_to_le16(fc);
-
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-	memset(meta, 0, sizeof(*meta));
-	meta->magic = HOSTAP_SKB_TX_DATA_MAGIC;
-	meta->iface = iface;
-	meta->tx_cb_idx = tx_cb_idx;
-
-	skb->dev = dev;
-	skb->mac.raw = skb->nh.raw = skb->data;
-	dev_queue_xmit(skb);
-}
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-static int prism2_sta_proc_read(char *page, char **start, off_t off,
-				int count, int *eof, void *data)
-{
-	char *p = page;
-	struct sta_info *sta = (struct sta_info *) data;
-	int i;
-
-	/* FIX: possible race condition.. the STA data could have just expired,
-	 * but proc entry was still here so that the read could have started;
-	 * some locking should be done here.. */
-
-	if (off != 0) {
-		*eof = 1;
-		return 0;
-	}
-
-	p += sprintf(p, "%s=" MACSTR "\nusers=%d\naid=%d\n"
-		     "flags=0x%04x%s%s%s%s%s%s%s\n"
-		     "capability=0x%02x\nlisten_interval=%d\nsupported_rates=",
-		     sta->ap ? "AP" : "STA",
-		     MAC2STR(sta->addr), atomic_read(&sta->users), sta->aid,
-		     sta->flags,
-		     sta->flags & WLAN_STA_AUTH ? " AUTH" : "",
-		     sta->flags & WLAN_STA_ASSOC ? " ASSOC" : "",
-		     sta->flags & WLAN_STA_PS ? " PS" : "",
-		     sta->flags & WLAN_STA_TIM ? " TIM" : "",
-		     sta->flags & WLAN_STA_PERM ? " PERM" : "",
-		     sta->flags & WLAN_STA_AUTHORIZED ? " AUTHORIZED" : "",
-		     sta->flags & WLAN_STA_PENDING_POLL ? " POLL" : "",
-		     sta->capability, sta->listen_interval);
-	/* supported_rates: 500 kbit/s units with msb ignored */
-	for (i = 0; i < sizeof(sta->supported_rates); i++)
-		if (sta->supported_rates[i] != 0)
-			p += sprintf(p, "%d%sMbps ",
-				     (sta->supported_rates[i] & 0x7f) / 2,
-				     sta->supported_rates[i] & 1 ? ".5" : "");
-	p += sprintf(p, "\njiffies=%lu\nlast_auth=%lu\nlast_assoc=%lu\n"
-		     "last_rx=%lu\nlast_tx=%lu\nrx_packets=%lu\n"
-		     "tx_packets=%lu\n"
-		     "rx_bytes=%lu\ntx_bytes=%lu\nbuffer_count=%d\n"
-		     "last_rx: silence=%d dBm signal=%d dBm rate=%d%s Mbps\n"
-		     "tx_rate=%d\ntx[1M]=%d\ntx[2M]=%d\ntx[5.5M]=%d\n"
-		     "tx[11M]=%d\n"
-		     "rx[1M]=%d\nrx[2M]=%d\nrx[5.5M]=%d\nrx[11M]=%d\n",
-		     jiffies, sta->last_auth, sta->last_assoc, sta->last_rx,
-		     sta->last_tx,
-		     sta->rx_packets, sta->tx_packets, sta->rx_bytes,
-		     sta->tx_bytes, skb_queue_len(&sta->tx_buf),
-		     sta->last_rx_silence,
-		     sta->last_rx_signal, sta->last_rx_rate / 10,
-		     sta->last_rx_rate % 10 ? ".5" : "",
-		     sta->tx_rate, sta->tx_count[0], sta->tx_count[1],
-		     sta->tx_count[2], sta->tx_count[3],  sta->rx_count[0],
-		     sta->rx_count[1], sta->rx_count[2], sta->rx_count[3]);
-	if (sta->crypt && sta->crypt->ops && sta->crypt->ops->print_stats)
-		p = sta->crypt->ops->print_stats(p, sta->crypt->priv);
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	if (sta->ap) {
-		if (sta->u.ap.channel >= 0)
-			p += sprintf(p, "channel=%d\n", sta->u.ap.channel);
-		p += sprintf(p, "ssid=");
-		for (i = 0; i < sta->u.ap.ssid_len; i++)
-			p += sprintf(p, ((sta->u.ap.ssid[i] >= 32 &&
-					  sta->u.ap.ssid[i] < 127) ?
-					 "%c" : "<%02x>"),
-				     sta->u.ap.ssid[i]);
-		p += sprintf(p, "\n");
-	}
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-	return (p - page);
-}
-
-
-static void handle_add_proc_queue(void *data)
-{
-	struct ap_data *ap = (struct ap_data *) data;
-	struct sta_info *sta;
-	char name[20];
-	struct add_sta_proc_data *entry, *prev;
-
-	entry = ap->add_sta_proc_entries;
-	ap->add_sta_proc_entries = NULL;
-
-	while (entry) {
-		spin_lock_bh(&ap->sta_table_lock);
-		sta = ap_get_sta(ap, entry->addr);
-		if (sta)
-			atomic_inc(&sta->users);
-		spin_unlock_bh(&ap->sta_table_lock);
-
-		if (sta) {
-			sprintf(name, MACSTR, MAC2STR(sta->addr));
-			sta->proc = create_proc_read_entry(
-				name, 0, ap->proc,
-				prism2_sta_proc_read, sta);
-
-			atomic_dec(&sta->users);
-		}
-
-		prev = entry;
-		entry = entry->next;
-		kfree(prev);
-	}
-}
-
-
-static struct sta_info * ap_add_sta(struct ap_data *ap, u8 *addr)
-{
-	struct sta_info *sta;
-
-	sta = (struct sta_info *)
-		kmalloc(sizeof(struct sta_info), GFP_ATOMIC);
-	if (sta == NULL) {
-		PDEBUG(DEBUG_AP, "AP: kmalloc failed\n");
-		return NULL;
-	}
-
-	/* initialize STA info data */
-	memset(sta, 0, sizeof(struct sta_info));
-	sta->local = ap->local;
-	skb_queue_head_init(&sta->tx_buf);
-	memcpy(sta->addr, addr, ETH_ALEN);
-
-	atomic_inc(&sta->users);
-	spin_lock_bh(&ap->sta_table_lock);
-	list_add(&sta->list, &ap->sta_list);
-	ap->num_sta++;
-	ap_sta_hash_add(ap, sta);
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	if (ap->proc) {
-		struct add_sta_proc_data *entry;
-		/* schedule a non-interrupt context process to add a procfs
-		 * entry for the STA since procfs code use GFP_KERNEL */
-		entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
-		if (entry) {
-			memcpy(entry->addr, sta->addr, ETH_ALEN);
-			entry->next = ap->add_sta_proc_entries;
-			ap->add_sta_proc_entries = entry;
-			schedule_work(&ap->add_sta_proc_queue);
-		} else
-			printk(KERN_DEBUG "Failed to add STA proc data\n");
-	}
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	init_timer(&sta->timer);
-	sta->timer.expires = jiffies + ap->max_inactivity;
-	sta->timer.data = (unsigned long) sta;
-	sta->timer.function = ap_handle_timer;
-	if (!ap->local->hostapd)
-		add_timer(&sta->timer);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-	return sta;
-}
-
-
-static int ap_tx_rate_ok(int rateidx, struct sta_info *sta,
-			 local_info_t *local)
-{
-	if (rateidx > sta->tx_max_rate ||
-	    !(sta->tx_supp_rates & (1 << rateidx)))
-		return 0;
-
-	if (local->tx_rate_control != 0 &&
-	    !(local->tx_rate_control & (1 << rateidx)))
-		return 0;
-
-	return 1;
-}
-
-
-static void prism2_check_tx_rates(struct sta_info *sta)
-{
-	int i;
-
-	sta->tx_supp_rates = 0;
-	for (i = 0; i < sizeof(sta->supported_rates); i++) {
-		if ((sta->supported_rates[i] & 0x7f) == 2)
-			sta->tx_supp_rates |= WLAN_RATE_1M;
-		if ((sta->supported_rates[i] & 0x7f) == 4)
-			sta->tx_supp_rates |= WLAN_RATE_2M;
-		if ((sta->supported_rates[i] & 0x7f) == 11)
-			sta->tx_supp_rates |= WLAN_RATE_5M5;
-		if ((sta->supported_rates[i] & 0x7f) == 22)
-			sta->tx_supp_rates |= WLAN_RATE_11M;
-	}
-	sta->tx_max_rate = sta->tx_rate = sta->tx_rate_idx = 0;
-	if (sta->tx_supp_rates & WLAN_RATE_1M) {
-		sta->tx_max_rate = 0;
-		if (ap_tx_rate_ok(0, sta, sta->local)) {
-			sta->tx_rate = 10;
-			sta->tx_rate_idx = 0;
-		}
-	}
-	if (sta->tx_supp_rates & WLAN_RATE_2M) {
-		sta->tx_max_rate = 1;
-		if (ap_tx_rate_ok(1, sta, sta->local)) {
-			sta->tx_rate = 20;
-			sta->tx_rate_idx = 1;
-		}
-	}
-	if (sta->tx_supp_rates & WLAN_RATE_5M5) {
-		sta->tx_max_rate = 2;
-		if (ap_tx_rate_ok(2, sta, sta->local)) {
-			sta->tx_rate = 55;
-			sta->tx_rate_idx = 2;
-		}
-	}
-	if (sta->tx_supp_rates & WLAN_RATE_11M) {
-		sta->tx_max_rate = 3;
-		if (ap_tx_rate_ok(3, sta, sta->local)) {
-			sta->tx_rate = 110;
-			sta->tx_rate_idx = 3;
-		}
-	}
-}
-
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-
-static void ap_crypt_init(struct ap_data *ap)
-{
-	ap->crypt = ieee80211_get_crypto_ops("WEP");
-
-	if (ap->crypt) {
-		if (ap->crypt->init) {
-			ap->crypt_priv = ap->crypt->init(0);
-			if (ap->crypt_priv == NULL)
-				ap->crypt = NULL;
-			else {
-				u8 key[WEP_KEY_LEN];
-				get_random_bytes(key, WEP_KEY_LEN);
-				ap->crypt->set_key(key, WEP_KEY_LEN, NULL,
-						   ap->crypt_priv);
-			}
-		}
-	}
-
-	if (ap->crypt == NULL) {
-		printk(KERN_WARNING "AP could not initialize WEP: load module "
-		       "ieee80211_crypt_wep.ko\n");
-	}
-}
-
-
-/* Generate challenge data for shared key authentication. IEEE 802.11 specifies
- * that WEP algorithm is used for generating challange. This should be unique,
- * but otherwise there is not really need for randomness etc. Initialize WEP
- * with pseudo random key and then use increasing IV to get unique challenge
- * streams.
- *
- * Called only as a scheduled task for pending AP frames.
- */
-static char * ap_auth_make_challenge(struct ap_data *ap)
-{
-	char *tmpbuf;
-	struct sk_buff *skb;
-
-	if (ap->crypt == NULL) {
-		ap_crypt_init(ap);
-		if (ap->crypt == NULL)
-			return NULL;
-	}
-
-	tmpbuf = (char *) kmalloc(WLAN_AUTH_CHALLENGE_LEN, GFP_ATOMIC);
-	if (tmpbuf == NULL) {
-		PDEBUG(DEBUG_AP, "AP: kmalloc failed for challenge\n");
-		return NULL;
-	}
-
-	skb = dev_alloc_skb(WLAN_AUTH_CHALLENGE_LEN +
-			    ap->crypt->extra_prefix_len +
-			    ap->crypt->extra_postfix_len);
-	if (skb == NULL) {
-		kfree(tmpbuf);
-		return NULL;
-	}
-
-	skb_reserve(skb, ap->crypt->extra_prefix_len);
-	memset(skb_put(skb, WLAN_AUTH_CHALLENGE_LEN), 0,
-	       WLAN_AUTH_CHALLENGE_LEN);
-	if (ap->crypt->encrypt_mpdu(skb, 0, ap->crypt_priv)) {
-		dev_kfree_skb(skb);
-		kfree(tmpbuf);
-		return NULL;
-	}
-
-	memcpy(tmpbuf, skb->data + ap->crypt->extra_prefix_len,
-	       WLAN_AUTH_CHALLENGE_LEN);
-	dev_kfree_skb(skb);
-
-	return tmpbuf;
-}
-
-
-/* Called only as a scheduled task for pending AP frames. */
-static void handle_authen(local_info_t *local, struct sk_buff *skb,
-			  struct hostap_80211_rx_status *rx_stats)
-{
-	struct net_device *dev = local->dev;
-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-	size_t hdrlen;
-	struct ap_data *ap = local->ap;
-	char body[8 + WLAN_AUTH_CHALLENGE_LEN], *challenge = NULL;
-	int len, olen;
-	u16 auth_alg, auth_transaction, status_code, *pos;
-	u16 resp = WLAN_STATUS_SUCCESS, fc;
-	struct sta_info *sta = NULL;
-	struct ieee80211_crypt_data *crypt;
-	char *txt = "";
-
-	len = skb->len - IEEE80211_MGMT_HDR_LEN;
-
-	fc = le16_to_cpu(hdr->frame_ctl);
-	hdrlen = hostap_80211_get_hdrlen(fc);
-
-	if (len < 6) {
-		PDEBUG(DEBUG_AP, "%s: handle_authen - too short payload "
-		       "(len=%d) from " MACSTR "\n", dev->name, len,
-		       MAC2STR(hdr->addr2));
-		return;
-	}
-
-	spin_lock_bh(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock_bh(&local->ap->sta_table_lock);
-
-	if (sta && sta->crypt)
-		crypt = sta->crypt;
-	else {
-		int idx = 0;
-		if (skb->len >= hdrlen + 3)
-			idx = skb->data[hdrlen + 3] >> 6;
-		crypt = local->crypt[idx];
-	}
-
-	pos = (u16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
-	auth_alg = __le16_to_cpu(*pos);
-	pos++;
-	auth_transaction = __le16_to_cpu(*pos);
-	pos++;
-	status_code = __le16_to_cpu(*pos);
-	pos++;
-
-	if (memcmp(dev->dev_addr, hdr->addr2, ETH_ALEN) == 0 ||
-	    ap_control_mac_deny(&ap->mac_restrictions, hdr->addr2)) {
-		txt = "authentication denied";
-		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
-		goto fail;
-	}
-
-	if (((local->auth_algs & PRISM2_AUTH_OPEN) &&
-	     auth_alg == WLAN_AUTH_OPEN) ||
-	    ((local->auth_algs & PRISM2_AUTH_SHARED_KEY) &&
-	     crypt && auth_alg == WLAN_AUTH_SHARED_KEY)) {
-	} else {
-		txt = "unsupported algorithm";
-		resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
-		goto fail;
-	}
-
-	if (len >= 8) {
-		u8 *u = (u8 *) pos;
-		if (*u == WLAN_EID_CHALLENGE) {
-			if (*(u + 1) != WLAN_AUTH_CHALLENGE_LEN) {
-				txt = "invalid challenge len";
-				resp = WLAN_STATUS_CHALLENGE_FAIL;
-				goto fail;
-			}
-			if (len - 8 < WLAN_AUTH_CHALLENGE_LEN) {
-				txt = "challenge underflow";
-				resp = WLAN_STATUS_CHALLENGE_FAIL;
-				goto fail;
-			}
-			challenge = (char *) (u + 2);
-		}
-	}
-
-	if (sta && sta->ap) {
-		if (time_after(jiffies, sta->u.ap.last_beacon +
-			       (10 * sta->listen_interval * HZ) / 1024)) {
-			PDEBUG(DEBUG_AP, "%s: no beacons received for a while,"
-			       " assuming AP " MACSTR " is now STA\n",
-			       dev->name, MAC2STR(sta->addr));
-			sta->ap = 0;
-			sta->flags = 0;
-			sta->u.sta.challenge = NULL;
-		} else {
-			txt = "AP trying to authenticate?";
-			resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
-			goto fail;
-		}
-	}
-
-	if ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 1) ||
-	    (auth_alg == WLAN_AUTH_SHARED_KEY &&
-	     (auth_transaction == 1 ||
-	      (auth_transaction == 3 && sta != NULL &&
-	       sta->u.sta.challenge != NULL)))) {
-	} else {
-		txt = "unknown authentication transaction number";
-		resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
-		goto fail;
-	}
-
-	if (sta == NULL) {
-		txt = "new STA";
-
-		if (local->ap->num_sta >= MAX_STA_COUNT) {
-			/* FIX: might try to remove some old STAs first? */
-			txt = "no more room for new STAs";
-			resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
-			goto fail;
-		}
-
-		sta = ap_add_sta(local->ap, hdr->addr2);
-		if (sta == NULL) {
-			txt = "ap_add_sta failed";
-			resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
-			goto fail;
-		}
-	}
-
-	switch (auth_alg) {
-	case WLAN_AUTH_OPEN:
-		txt = "authOK";
-		/* IEEE 802.11 standard is not completely clear about
-		 * whether STA is considered authenticated after
-		 * authentication OK frame has been send or after it
-		 * has been ACKed. In order to reduce interoperability
-		 * issues, mark the STA authenticated before ACK. */
-		sta->flags |= WLAN_STA_AUTH;
-		break;
-
-	case WLAN_AUTH_SHARED_KEY:
-		if (auth_transaction == 1) {
-			if (sta->u.sta.challenge == NULL) {
-				sta->u.sta.challenge =
-					ap_auth_make_challenge(local->ap);
-				if (sta->u.sta.challenge == NULL) {
-					resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
-					goto fail;
-				}
-			}
-		} else {
-			if (sta->u.sta.challenge == NULL ||
-			    challenge == NULL ||
-			    memcmp(sta->u.sta.challenge, challenge,
-				   WLAN_AUTH_CHALLENGE_LEN) != 0 ||
-			    !(fc & IEEE80211_FCTL_PROTECTED)) {
-				txt = "challenge response incorrect";
-				resp = WLAN_STATUS_CHALLENGE_FAIL;
-				goto fail;
-			}
-
-			txt = "challenge OK - authOK";
-			/* IEEE 802.11 standard is not completely clear about
-			 * whether STA is considered authenticated after
-			 * authentication OK frame has been send or after it
-			 * has been ACKed. In order to reduce interoperability
-			 * issues, mark the STA authenticated before ACK. */
-			sta->flags |= WLAN_STA_AUTH;
-			kfree(sta->u.sta.challenge);
-			sta->u.sta.challenge = NULL;
-		}
-		break;
-	}
-
- fail:
-	pos = (u16 *) body;
-	*pos = cpu_to_le16(auth_alg);
-	pos++;
-	*pos = cpu_to_le16(auth_transaction + 1);
-	pos++;
-	*pos = cpu_to_le16(resp); /* status_code */
-	pos++;
-	olen = 6;
-
-	if (resp == WLAN_STATUS_SUCCESS && sta != NULL &&
-	    sta->u.sta.challenge != NULL &&
-	    auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 1) {
-		u8 *tmp = (u8 *) pos;
-		*tmp++ = WLAN_EID_CHALLENGE;
-		*tmp++ = WLAN_AUTH_CHALLENGE_LEN;
-		pos++;
-		memcpy(pos, sta->u.sta.challenge, WLAN_AUTH_CHALLENGE_LEN);
-		olen += 2 + WLAN_AUTH_CHALLENGE_LEN;
-	}
-
-	prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH,
-			 body, olen, hdr->addr2, ap->tx_callback_auth);
-
-	if (sta) {
-		sta->last_rx = jiffies;
-		atomic_dec(&sta->users);
-	}
-
-	if (resp) {
-		PDEBUG(DEBUG_AP, "%s: " MACSTR " auth (alg=%d trans#=%d "
-		       "stat=%d len=%d fc=%04x) ==> %d (%s)\n",
-		       dev->name, MAC2STR(hdr->addr2), auth_alg,
-		       auth_transaction, status_code, len, fc, resp, txt);
-	}
-}
-
-
-/* Called only as a scheduled task for pending AP frames. */
-static void handle_assoc(local_info_t *local, struct sk_buff *skb,
-			 struct hostap_80211_rx_status *rx_stats, int reassoc)
-{
-	struct net_device *dev = local->dev;
-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-	char body[12], *p, *lpos;
-	int len, left;
-	u16 *pos;
-	u16 resp = WLAN_STATUS_SUCCESS;
-	struct sta_info *sta = NULL;
-	int send_deauth = 0;
-	char *txt = "";
-	u8 prev_ap[ETH_ALEN];
-
-	left = len = skb->len - IEEE80211_MGMT_HDR_LEN;
-
-	if (len < (reassoc ? 10 : 4)) {
-		PDEBUG(DEBUG_AP, "%s: handle_assoc - too short payload "
-		       "(len=%d, reassoc=%d) from " MACSTR "\n",
-		       dev->name, len, reassoc, MAC2STR(hdr->addr2));
-		return;
-	}
-
-	spin_lock_bh(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
-		spin_unlock_bh(&local->ap->sta_table_lock);
-		txt = "trying to associate before authentication";
-		send_deauth = 1;
-		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
-		sta = NULL; /* do not decrement sta->users */
-		goto fail;
-	}
-	atomic_inc(&sta->users);
-	spin_unlock_bh(&local->ap->sta_table_lock);
-
-	pos = (u16 *) (skb->data + IEEE80211_MGMT_HDR_LEN);
-	sta->capability = __le16_to_cpu(*pos);
-	pos++; left -= 2;
-	sta->listen_interval = __le16_to_cpu(*pos);
-	pos++; left -= 2;
-
-	if (reassoc) {
-		memcpy(prev_ap, pos, ETH_ALEN);
-		pos++; pos++; pos++; left -= 6;
-	} else
-		memset(prev_ap, 0, ETH_ALEN);
-
-	if (left >= 2) {
-		unsigned int ileft;
-		unsigned char *u = (unsigned char *) pos;
-
-		if (*u == WLAN_EID_SSID) {
-			u++; left--;
-			ileft = *u;
-			u++; left--;
-
-			if (ileft > left || ileft > MAX_SSID_LEN) {
-				txt = "SSID overflow";
-				resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
-				goto fail;
-			}
-
-			if (ileft != strlen(local->essid) ||
-			    memcmp(local->essid, u, ileft) != 0) {
-				txt = "not our SSID";
-				resp = WLAN_STATUS_ASSOC_DENIED_UNSPEC;
-				goto fail;
-			}
-
-			u += ileft;
-			left -= ileft;
-		}
-
-		if (left >= 2 && *u == WLAN_EID_SUPP_RATES) {
-			u++; left--;
-			ileft = *u;
-			u++; left--;
-
-			if (ileft > left || ileft == 0 ||
-			    ileft > WLAN_SUPP_RATES_MAX) {
-				txt = "SUPP_RATES len error";
-				resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
-				goto fail;
-			}
-
-			memset(sta->supported_rates, 0,
-			       sizeof(sta->supported_rates));
-			memcpy(sta->supported_rates, u, ileft);
-			prism2_check_tx_rates(sta);
-
-			u += ileft;
-			left -= ileft;
-		}
-
-		if (left > 0) {
-			PDEBUG(DEBUG_AP, "%s: assoc from " MACSTR " with extra"
-			       " data (%d bytes) [",
-			       dev->name, MAC2STR(hdr->addr2), left);
-			while (left > 0) {
-				PDEBUG2(DEBUG_AP, "<%02x>", *u);
-				u++; left--;
-			}
-			PDEBUG2(DEBUG_AP, "]\n");
-		}
-	} else {
-		txt = "frame underflow";
-		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
-		goto fail;
-	}
-
-	/* get a unique AID */
-	if (sta->aid > 0)
-		txt = "OK, old AID";
-	else {
-		spin_lock_bh(&local->ap->sta_table_lock);
-		for (sta->aid = 1; sta->aid <= MAX_AID_TABLE_SIZE; sta->aid++)
-			if (local->ap->sta_aid[sta->aid - 1] == NULL)
-				break;
-		if (sta->aid > MAX_AID_TABLE_SIZE) {
-			sta->aid = 0;
-			spin_unlock_bh(&local->ap->sta_table_lock);
-			resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
-			txt = "no room for more AIDs";
-		} else {
-			local->ap->sta_aid[sta->aid - 1] = sta;
-			spin_unlock_bh(&local->ap->sta_table_lock);
-			txt = "OK, new AID";
-		}
-	}
-
- fail:
-	pos = (u16 *) body;
-
-	if (send_deauth) {
-		*pos = __constant_cpu_to_le16(
-			WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH);
-		pos++;
-	} else {
-		/* FIX: CF-Pollable and CF-PollReq should be set to match the
-		 * values in beacons/probe responses */
-		/* FIX: how about privacy and WEP? */
-		/* capability */
-		*pos = __constant_cpu_to_le16(WLAN_CAPABILITY_ESS);
-		pos++;
-
-		/* status_code */
-		*pos = __cpu_to_le16(resp);
-		pos++;
-
-		*pos = __cpu_to_le16((sta && sta->aid > 0 ? sta->aid : 0) |
-				     BIT(14) | BIT(15)); /* AID */
-		pos++;
-
-		/* Supported rates (Information element) */
-		p = (char *) pos;
-		*p++ = WLAN_EID_SUPP_RATES;
-		lpos = p;
-		*p++ = 0; /* len */
-		if (local->tx_rate_control & WLAN_RATE_1M) {
-			*p++ = local->basic_rates & WLAN_RATE_1M ? 0x82 : 0x02;
-			(*lpos)++;
-		}
-		if (local->tx_rate_control & WLAN_RATE_2M) {
-			*p++ = local->basic_rates & WLAN_RATE_2M ? 0x84 : 0x04;
-			(*lpos)++;
-		}
-		if (local->tx_rate_control & WLAN_RATE_5M5) {
-			*p++ = local->basic_rates & WLAN_RATE_5M5 ?
-				0x8b : 0x0b;
-			(*lpos)++;
-		}
-		if (local->tx_rate_control & WLAN_RATE_11M) {
-			*p++ = local->basic_rates & WLAN_RATE_11M ?
-				0x96 : 0x16;
-			(*lpos)++;
-		}
-		pos = (u16 *) p;
-	}
-
-	prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT |
-			 (send_deauth ? IEEE80211_STYPE_DEAUTH :
-			  (reassoc ? IEEE80211_STYPE_REASSOC_RESP :
-			   IEEE80211_STYPE_ASSOC_RESP)),
-			 body, (u8 *) pos - (u8 *) body,
-			 hdr->addr2,
-			 send_deauth ? 0 : local->ap->tx_callback_assoc);
-
-	if (sta) {
-		if (resp == WLAN_STATUS_SUCCESS) {
-			sta->last_rx = jiffies;
-			/* STA will be marked associated from TX callback, if
-			 * AssocResp is ACKed */
-		}
-		atomic_dec(&sta->users);
-	}
-
-#if 0
-	PDEBUG(DEBUG_AP, "%s: " MACSTR " %sassoc (len=%d prev_ap=" MACSTR
-	       ") => %d(%d) (%s)\n",
-	       dev->name, MAC2STR(hdr->addr2), reassoc ? "re" : "", len,
-	       MAC2STR(prev_ap), resp, send_deauth, txt);
-#endif
-}
-
-
-/* Called only as a scheduled task for pending AP frames. */
-static void handle_deauth(local_info_t *local, struct sk_buff *skb,
-			  struct hostap_80211_rx_status *rx_stats)
-{
-	struct net_device *dev = local->dev;
-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-	char *body = (char *) (skb->data + IEEE80211_MGMT_HDR_LEN);
-	int len;
-	u16 reason_code, *pos;
-	struct sta_info *sta = NULL;
-
-	len = skb->len - IEEE80211_MGMT_HDR_LEN;
-
-	if (len < 2) {
-		printk("handle_deauth - too short payload (len=%d)\n", len);
-		return;
-	}
-
-	pos = (u16 *) body;
-	reason_code = __le16_to_cpu(*pos);
-
-	PDEBUG(DEBUG_AP, "%s: deauthentication: " MACSTR " len=%d, "
-	       "reason_code=%d\n", dev->name, MAC2STR(hdr->addr2), len,
-	       reason_code);
-
-	spin_lock_bh(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta != NULL) {
-		if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap)
-			hostap_event_expired_sta(local->dev, sta);
-		sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
-	}
-	spin_unlock_bh(&local->ap->sta_table_lock);
-	if (sta == NULL) {
-		printk("%s: deauthentication from " MACSTR ", "
-	       "reason_code=%d, but STA not authenticated\n", dev->name,
-		       MAC2STR(hdr->addr2), reason_code);
-	}
-}
-
-
-/* Called only as a scheduled task for pending AP frames. */
-static void handle_disassoc(local_info_t *local, struct sk_buff *skb,
-			    struct hostap_80211_rx_status *rx_stats)
-{
-	struct net_device *dev = local->dev;
-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-	char *body = skb->data + IEEE80211_MGMT_HDR_LEN;
-	int len;
-	u16 reason_code, *pos;
-	struct sta_info *sta = NULL;
-
-	len = skb->len - IEEE80211_MGMT_HDR_LEN;
-
-	if (len < 2) {
-		printk("handle_disassoc - too short payload (len=%d)\n", len);
-		return;
-	}
-
-	pos = (u16 *) body;
-	reason_code = __le16_to_cpu(*pos);
-
-	PDEBUG(DEBUG_AP, "%s: disassociation: " MACSTR " len=%d, "
-	       "reason_code=%d\n", dev->name, MAC2STR(hdr->addr2), len,
-	       reason_code);
-
-	spin_lock_bh(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta != NULL) {
-		if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap)
-			hostap_event_expired_sta(local->dev, sta);
-		sta->flags &= ~WLAN_STA_ASSOC;
-	}
-	spin_unlock_bh(&local->ap->sta_table_lock);
-	if (sta == NULL) {
-		printk("%s: disassociation from " MACSTR ", "
-		       "reason_code=%d, but STA not authenticated\n",
-		       dev->name, MAC2STR(hdr->addr2), reason_code);
-	}
-}
-
-
-/* Called only as a scheduled task for pending AP frames. */
-static void ap_handle_data_nullfunc(local_info_t *local,
-				    struct ieee80211_hdr *hdr)
-{
-	struct net_device *dev = local->dev;
-
-	/* some STA f/w's seem to require control::ACK frame for
-	 * data::nullfunc, but at least Prism2 station f/w version 0.8.0 does
-	 * not send this..
-	 * send control::ACK for the data::nullfunc */
-
-	printk(KERN_DEBUG "Sending control::ACK for data::nullfunc\n");
-	prism2_send_mgmt(dev, IEEE80211_FTYPE_CTL | IEEE80211_STYPE_ACK,
-			 NULL, 0, hdr->addr2, 0);
-}
-
-
-/* Called only as a scheduled task for pending AP frames. */
-static void ap_handle_dropped_data(local_info_t *local,
-				   struct ieee80211_hdr *hdr)
-{
-	struct net_device *dev = local->dev;
-	struct sta_info *sta;
-	u16 reason;
-
-	spin_lock_bh(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock_bh(&local->ap->sta_table_lock);
-
-	if (sta != NULL && (sta->flags & WLAN_STA_ASSOC)) {
-		PDEBUG(DEBUG_AP, "ap_handle_dropped_data: STA is now okay?\n");
-		atomic_dec(&sta->users);
-		return;
-	}
-
-	reason = __constant_cpu_to_le16(
-		WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
-	prism2_send_mgmt(dev, IEEE80211_FTYPE_MGMT |
-			 ((sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) ?
-			  IEEE80211_STYPE_DEAUTH : IEEE80211_STYPE_DISASSOC),
-			 (char *) &reason, sizeof(reason), hdr->addr2, 0);
-
-	if (sta)
-		atomic_dec(&sta->users);
-}
-
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-/* Called only as a scheduled task for pending AP frames. */
-static void pspoll_send_buffered(local_info_t *local, struct sta_info *sta,
-				 struct sk_buff *skb)
-{
-	struct hostap_skb_tx_data *meta;
-
-	if (!(sta->flags & WLAN_STA_PS)) {
-		/* Station has moved to non-PS mode, so send all buffered
-		 * frames using normal device queue. */
-		dev_queue_xmit(skb);
-		return;
-	}
-
-	/* add a flag for hostap_handle_sta_tx() to know that this skb should
-	 * be passed through even though STA is using PS */
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-	meta->flags |= HOSTAP_TX_FLAGS_BUFFERED_FRAME;
-	if (!skb_queue_empty(&sta->tx_buf)) {
-		/* indicate to STA that more frames follow */
-		meta->flags |= HOSTAP_TX_FLAGS_ADD_MOREDATA;
-	}
-	dev_queue_xmit(skb);
-}
-
-
-/* Called only as a scheduled task for pending AP frames. */
-static void handle_pspoll(local_info_t *local,
-			  struct ieee80211_hdr *hdr,
-			  struct hostap_80211_rx_status *rx_stats)
-{
-	struct net_device *dev = local->dev;
-	struct sta_info *sta;
-	u16 aid;
-	struct sk_buff *skb;
-
-	PDEBUG(DEBUG_PS2, "handle_pspoll: BSSID=" MACSTR ", TA=" MACSTR
-	       " PWRMGT=%d\n",
-	       MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
-	       !!(le16_to_cpu(hdr->frame_ctl) & IEEE80211_FCTL_PM));
-
-	if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
-		PDEBUG(DEBUG_AP, "handle_pspoll - addr1(BSSID)=" MACSTR
-		       " not own MAC\n", MAC2STR(hdr->addr1));
-		return;
-	}
-
-	aid = __le16_to_cpu(hdr->duration_id);
-	if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14))) {
-		PDEBUG(DEBUG_PS, "   PSPOLL and AID[15:14] not set\n");
-		return;
-	}
-	aid &= ~BIT(15) & ~BIT(14);
-	if (aid == 0 || aid > MAX_AID_TABLE_SIZE) {
-		PDEBUG(DEBUG_PS, "   invalid aid=%d\n", aid);
-		return;
-	}
-	PDEBUG(DEBUG_PS2, "   aid=%d\n", aid);
-
-	spin_lock_bh(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock_bh(&local->ap->sta_table_lock);
-
-	if (sta == NULL) {
-		PDEBUG(DEBUG_PS, "   STA not found\n");
-		return;
-	}
-	if (sta->aid != aid) {
-		PDEBUG(DEBUG_PS, "   received aid=%i does not match with "
-		       "assoc.aid=%d\n", aid, sta->aid);
-		return;
-	}
-
-	/* FIX: todo:
-	 * - add timeout for buffering (clear aid in TIM vector if buffer timed
-	 *   out (expiry time must be longer than ListenInterval for
-	 *   the corresponding STA; "8802-11: 11.2.1.9 AP aging function"
-	 * - what to do, if buffered, pspolled, and sent frame is not ACKed by
-	 *   sta; store buffer for later use and leave TIM aid bit set? use
-	 *   TX event to check whether frame was ACKed?
-	 */
-
-	while ((skb = skb_dequeue(&sta->tx_buf)) != NULL) {
-		/* send buffered frame .. */
-		PDEBUG(DEBUG_PS2, "Sending buffered frame to STA after PS POLL"
-		       " (buffer_count=%d)\n", skb_queue_len(&sta->tx_buf));
-
-		pspoll_send_buffered(local, sta, skb);
-
-		if (sta->flags & WLAN_STA_PS) {
-			/* send only one buffered packet per PS Poll */
-			/* FIX: should ignore further PS Polls until the
-			 * buffered packet that was just sent is acknowledged
-			 * (Tx or TxExc event) */
-			break;
-		}
-	}
-
-	if (skb_queue_empty(&sta->tx_buf)) {
-		/* try to clear aid from TIM */
-		if (!(sta->flags & WLAN_STA_TIM))
-			PDEBUG(DEBUG_PS2,  "Re-unsetting TIM for aid %d\n",
-			       aid);
-		hostap_set_tim(local, aid, 0);
-		sta->flags &= ~WLAN_STA_TIM;
-	}
-
-	atomic_dec(&sta->users);
-}
-
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-
-static void handle_wds_oper_queue(void *data)
-{
-	local_info_t *local = data;
-	struct wds_oper_data *entry, *prev;
-
-	spin_lock_bh(&local->lock);
-	entry = local->ap->wds_oper_entries;
-	local->ap->wds_oper_entries = NULL;
-	spin_unlock_bh(&local->lock);
-
-	while (entry) {
-		PDEBUG(DEBUG_AP, "%s: %s automatic WDS connection "
-		       "to AP " MACSTR "\n",
-		       local->dev->name,
-		       entry->type == WDS_ADD ? "adding" : "removing",
-		       MAC2STR(entry->addr));
-		if (entry->type == WDS_ADD)
-			prism2_wds_add(local, entry->addr, 0);
-		else if (entry->type == WDS_DEL)
-			prism2_wds_del(local, entry->addr, 0, 1);
-
-		prev = entry;
-		entry = entry->next;
-		kfree(prev);
-	}
-}
-
-
-/* Called only as a scheduled task for pending AP frames. */
-static void handle_beacon(local_info_t *local, struct sk_buff *skb,
-			  struct hostap_80211_rx_status *rx_stats)
-{
-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-	char *body = skb->data + IEEE80211_MGMT_HDR_LEN;
-	int len, left;
-	u16 *pos, beacon_int, capability;
-	char *ssid = NULL;
-	unsigned char *supp_rates = NULL;
-	int ssid_len = 0, supp_rates_len = 0;
-	struct sta_info *sta = NULL;
-	int new_sta = 0, channel = -1;
-
-	len = skb->len - IEEE80211_MGMT_HDR_LEN;
-
-	if (len < 8 + 2 + 2) {
-		printk(KERN_DEBUG "handle_beacon - too short payload "
-		       "(len=%d)\n", len);
-		return;
-	}
-
-	pos = (u16 *) body;
-	left = len;
-
-	/* Timestamp (8 octets) */
-	pos += 4; left -= 8;
-	/* Beacon interval (2 octets) */
-	beacon_int = __le16_to_cpu(*pos);
-	pos++; left -= 2;
-	/* Capability information (2 octets) */
-	capability = __le16_to_cpu(*pos);
-	pos++; left -= 2;
-
-	if (local->ap->ap_policy != AP_OTHER_AP_EVEN_IBSS &&
-	    capability & WLAN_CAPABILITY_IBSS)
-		return;
-
-	if (left >= 2) {
-		unsigned int ileft;
-		unsigned char *u = (unsigned char *) pos;
-
-		if (*u == WLAN_EID_SSID) {
-			u++; left--;
-			ileft = *u;
-			u++; left--;
-
-			if (ileft > left || ileft > MAX_SSID_LEN) {
-				PDEBUG(DEBUG_AP, "SSID: overflow\n");
-				return;
-			}
-
-			if (local->ap->ap_policy == AP_OTHER_AP_SAME_SSID &&
-			    (ileft != strlen(local->essid) ||
-			     memcmp(local->essid, u, ileft) != 0)) {
-				/* not our SSID */
-				return;
-			}
-
-			ssid = u;
-			ssid_len = ileft;
-
-			u += ileft;
-			left -= ileft;
-		}
-
-		if (*u == WLAN_EID_SUPP_RATES) {
-			u++; left--;
-			ileft = *u;
-			u++; left--;
-
-			if (ileft > left || ileft == 0 || ileft > 8) {
-				PDEBUG(DEBUG_AP, " - SUPP_RATES len error\n");
-				return;
-			}
-
-			supp_rates = u;
-			supp_rates_len = ileft;
-
-			u += ileft;
-			left -= ileft;
-		}
-
-		if (*u == WLAN_EID_DS_PARAMS) {
-			u++; left--;
-			ileft = *u;
-			u++; left--;
-
-			if (ileft > left || ileft != 1) {
-				PDEBUG(DEBUG_AP, " - DS_PARAMS len error\n");
-				return;
-			}
-
-			channel = *u;
-
-			u += ileft;
-			left -= ileft;
-		}
-	}
-
-	spin_lock_bh(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta != NULL)
-		atomic_inc(&sta->users);
-	spin_unlock_bh(&local->ap->sta_table_lock);
-
-	if (sta == NULL) {
-		/* add new AP */
-		new_sta = 1;
-		sta = ap_add_sta(local->ap, hdr->addr2);
-		if (sta == NULL) {
-			printk(KERN_INFO "prism2: kmalloc failed for AP "
-			       "data structure\n");
-			return;
-		}
-		hostap_event_new_sta(local->dev, sta);
-
-		/* mark APs authentication and associated for pseudo ad-hoc
-		 * style communication */
-		sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC;
-
-		if (local->ap->autom_ap_wds) {
-			hostap_wds_link_oper(local, sta->addr, WDS_ADD);
-		}
-	}
-
-	sta->ap = 1;
-	if (ssid) {
-		sta->u.ap.ssid_len = ssid_len;
-		memcpy(sta->u.ap.ssid, ssid, ssid_len);
-		sta->u.ap.ssid[ssid_len] = '\0';
-	} else {
-		sta->u.ap.ssid_len = 0;
-		sta->u.ap.ssid[0] = '\0';
-	}
-	sta->u.ap.channel = channel;
-	sta->rx_packets++;
-	sta->rx_bytes += len;
-	sta->u.ap.last_beacon = sta->last_rx = jiffies;
-	sta->capability = capability;
-	sta->listen_interval = beacon_int;
-
-	atomic_dec(&sta->users);
-
-	if (new_sta) {
-		memset(sta->supported_rates, 0, sizeof(sta->supported_rates));
-		memcpy(sta->supported_rates, supp_rates, supp_rates_len);
-		prism2_check_tx_rates(sta);
-	}
-}
-
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-/* Called only as a tasklet. */
-static void handle_ap_item(local_info_t *local, struct sk_buff *skb,
-			   struct hostap_80211_rx_status *rx_stats)
-{
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	struct net_device *dev = local->dev;
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-	u16 fc, type, stype;
-	struct ieee80211_hdr *hdr;
-
-	/* FIX: should give skb->len to handler functions and check that the
-	 * buffer is long enough */
-	hdr = (struct ieee80211_hdr *) skb->data;
-	fc = le16_to_cpu(hdr->frame_ctl);
-	type = WLAN_FC_GET_TYPE(fc);
-	stype = WLAN_FC_GET_STYPE(fc);
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	if (!local->hostapd && type == IEEE80211_FTYPE_DATA) {
-		PDEBUG(DEBUG_AP, "handle_ap_item - data frame\n");
-
-		if (!(fc & IEEE80211_FCTL_TODS) ||
-		    (fc & IEEE80211_FCTL_FROMDS)) {
-			if (stype == IEEE80211_STYPE_NULLFUNC) {
-				/* no ToDS nullfunc seems to be used to check
-				 * AP association; so send reject message to
-				 * speed up re-association */
-				ap_handle_dropped_data(local, hdr);
-				goto done;
-			}
-			PDEBUG(DEBUG_AP, "   not ToDS frame (fc=0x%04x)\n",
-			       fc);
-			goto done;
-		}
-
-		if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
-			PDEBUG(DEBUG_AP, "handle_ap_item - addr1(BSSID)="
-			       MACSTR " not own MAC\n",
-			       MAC2STR(hdr->addr1));
-			goto done;
-		}
-
-		if (local->ap->nullfunc_ack &&
-		    stype == IEEE80211_STYPE_NULLFUNC)
-			ap_handle_data_nullfunc(local, hdr);
-		else
-			ap_handle_dropped_data(local, hdr);
-		goto done;
-	}
-
-	if (type == IEEE80211_FTYPE_MGMT && stype == IEEE80211_STYPE_BEACON) {
-		handle_beacon(local, skb, rx_stats);
-		goto done;
-	}
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-	if (type == IEEE80211_FTYPE_CTL && stype == IEEE80211_STYPE_PSPOLL) {
-		handle_pspoll(local, hdr, rx_stats);
-		goto done;
-	}
-
-	if (local->hostapd) {
-		PDEBUG(DEBUG_AP, "Unknown frame in AP queue: type=0x%02x "
-		       "subtype=0x%02x\n", type, stype);
-		goto done;
-	}
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	if (type != IEEE80211_FTYPE_MGMT) {
-		PDEBUG(DEBUG_AP, "handle_ap_item - not a management frame?\n");
-		goto done;
-	}
-
-	if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
-		PDEBUG(DEBUG_AP, "handle_ap_item - addr1(DA)=" MACSTR
-		       " not own MAC\n", MAC2STR(hdr->addr1));
-		goto done;
-	}
-
-	if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN)) {
-		PDEBUG(DEBUG_AP, "handle_ap_item - addr3(BSSID)=" MACSTR
-		       " not own MAC\n", MAC2STR(hdr->addr3));
-		goto done;
-	}
-
-	switch (stype) {
-	case IEEE80211_STYPE_ASSOC_REQ:
-		handle_assoc(local, skb, rx_stats, 0);
-		break;
-	case IEEE80211_STYPE_ASSOC_RESP:
-		PDEBUG(DEBUG_AP, "==> ASSOC RESP (ignored)\n");
-		break;
-	case IEEE80211_STYPE_REASSOC_REQ:
-		handle_assoc(local, skb, rx_stats, 1);
-		break;
-	case IEEE80211_STYPE_REASSOC_RESP:
-		PDEBUG(DEBUG_AP, "==> REASSOC RESP (ignored)\n");
-		break;
-	case IEEE80211_STYPE_ATIM:
-		PDEBUG(DEBUG_AP, "==> ATIM (ignored)\n");
-		break;
-	case IEEE80211_STYPE_DISASSOC:
-		handle_disassoc(local, skb, rx_stats);
-		break;
-	case IEEE80211_STYPE_AUTH:
-		handle_authen(local, skb, rx_stats);
-		break;
-	case IEEE80211_STYPE_DEAUTH:
-		handle_deauth(local, skb, rx_stats);
-		break;
-	default:
-		PDEBUG(DEBUG_AP, "Unknown mgmt frame subtype 0x%02x\n",
-		       stype >> 4);
-		break;
-	}
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
- done:
-	dev_kfree_skb(skb);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-void hostap_rx(struct net_device *dev, struct sk_buff *skb,
-	       struct hostap_80211_rx_status *rx_stats)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 fc;
-	struct ieee80211_hdr *hdr;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (skb->len < 16)
-		goto drop;
-
-	local->stats.rx_packets++;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	fc = le16_to_cpu(hdr->frame_ctl);
-
-	if (local->ap->ap_policy == AP_OTHER_AP_SKIP_ALL &&
-	    WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_MGMT &&
-	    WLAN_FC_GET_STYPE(fc) == IEEE80211_STYPE_BEACON)
-		goto drop;
-
-	skb->protocol = __constant_htons(ETH_P_HOSTAP);
-	handle_ap_item(local, skb, rx_stats);
-	return;
-
- drop:
-	dev_kfree_skb(skb);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void schedule_packet_send(local_info_t *local, struct sta_info *sta)
-{
-	struct sk_buff *skb;
-	struct ieee80211_hdr *hdr;
-	struct hostap_80211_rx_status rx_stats;
-
-	if (skb_queue_empty(&sta->tx_buf))
-		return;
-
-	skb = dev_alloc_skb(16);
-	if (skb == NULL) {
-		printk(KERN_DEBUG "%s: schedule_packet_send: skb alloc "
-		       "failed\n", local->dev->name);
-		return;
-	}
-
-	hdr = (struct ieee80211_hdr *) skb_put(skb, 16);
-
-	/* Generate a fake pspoll frame to start packet delivery */
-	hdr->frame_ctl = __constant_cpu_to_le16(
-		IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
-	memcpy(hdr->addr1, local->dev->dev_addr, ETH_ALEN);
-	memcpy(hdr->addr2, sta->addr, ETH_ALEN);
-	hdr->duration_id = cpu_to_le16(sta->aid | BIT(15) | BIT(14));
-
-	PDEBUG(DEBUG_PS2, "%s: Scheduling buffered packet delivery for "
-	       "STA " MACSTR "\n", local->dev->name, MAC2STR(sta->addr));
-
-	skb->dev = local->dev;
-
-	memset(&rx_stats, 0, sizeof(rx_stats));
-	hostap_rx(local->dev, skb, &rx_stats);
-}
-
-
-static int prism2_ap_get_sta_qual(local_info_t *local, struct sockaddr addr[],
-				  struct iw_quality qual[], int buf_size,
-				  int aplist)
-{
-	struct ap_data *ap = local->ap;
-	struct list_head *ptr;
-	int count = 0;
-
-	spin_lock_bh(&ap->sta_table_lock);
-
-	for (ptr = ap->sta_list.next; ptr != NULL && ptr != &ap->sta_list;
-	     ptr = ptr->next) {
-		struct sta_info *sta = (struct sta_info *) ptr;
-
-		if (aplist && !sta->ap)
-			continue;
-		addr[count].sa_family = ARPHRD_ETHER;
-		memcpy(addr[count].sa_data, sta->addr, ETH_ALEN);
-		if (sta->last_rx_silence == 0)
-			qual[count].qual = sta->last_rx_signal < 27 ?
-				0 : (sta->last_rx_signal - 27) * 92 / 127;
-		else
-			qual[count].qual = sta->last_rx_signal -
-				sta->last_rx_silence - 35;
-		qual[count].level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
-		qual[count].noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
-		qual[count].updated = sta->last_rx_updated;
-
-		sta->last_rx_updated = 0;
-
-		count++;
-		if (count >= buf_size)
-			break;
-	}
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	return count;
-}
-
-
-/* Translate our list of Access Points & Stations to a card independant
- * format that the Wireless Tools will understand - Jean II */
-static int prism2_ap_translate_scan(struct net_device *dev, char *buffer)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct ap_data *ap;
-	struct list_head *ptr;
-	struct iw_event iwe;
-	char *current_ev = buffer;
-	char *end_buf = buffer + IW_SCAN_MAX_DATA;
-#if !defined(PRISM2_NO_KERNEL_IEEE80211_MGMT)
-	char buf[64];
-#endif
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	ap = local->ap;
-
-	spin_lock_bh(&ap->sta_table_lock);
-
-	for (ptr = ap->sta_list.next; ptr != NULL && ptr != &ap->sta_list;
-	     ptr = ptr->next) {
-		struct sta_info *sta = (struct sta_info *) ptr;
-
-		/* First entry *MUST* be the AP MAC address */
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = SIOCGIWAP;
-		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-		memcpy(iwe.u.ap_addr.sa_data, sta->addr, ETH_ALEN);
-		iwe.len = IW_EV_ADDR_LEN;
-		current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-						  IW_EV_ADDR_LEN);
-
-		/* Use the mode to indicate if it's a station or
-		 * an Access Point */
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = SIOCGIWMODE;
-		if (sta->ap)
-			iwe.u.mode = IW_MODE_MASTER;
-		else
-			iwe.u.mode = IW_MODE_INFRA;
-		iwe.len = IW_EV_UINT_LEN;
-		current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-						  IW_EV_UINT_LEN);
-
-		/* Some quality */
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = IWEVQUAL;
-		if (sta->last_rx_silence == 0)
-			iwe.u.qual.qual = sta->last_rx_signal < 27 ?
-				0 : (sta->last_rx_signal - 27) * 92 / 127;
-		else
-			iwe.u.qual.qual = sta->last_rx_signal -
-				sta->last_rx_silence - 35;
-		iwe.u.qual.level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
-		iwe.u.qual.noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
-		iwe.u.qual.updated = sta->last_rx_updated;
-		iwe.len = IW_EV_QUAL_LEN;
-		current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-						  IW_EV_QUAL_LEN);
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-		if (sta->ap) {
-			memset(&iwe, 0, sizeof(iwe));
-			iwe.cmd = SIOCGIWESSID;
-			iwe.u.data.length = sta->u.ap.ssid_len;
-			iwe.u.data.flags = 1;
-			current_ev = iwe_stream_add_point(current_ev, end_buf,
-							  &iwe,
-							  sta->u.ap.ssid);
-
-			memset(&iwe, 0, sizeof(iwe));
-			iwe.cmd = SIOCGIWENCODE;
-			if (sta->capability & WLAN_CAPABILITY_PRIVACY)
-				iwe.u.data.flags =
-					IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-			else
-				iwe.u.data.flags = IW_ENCODE_DISABLED;
-			current_ev = iwe_stream_add_point(current_ev, end_buf,
-							  &iwe,
-							  sta->u.ap.ssid
-							  /* 0 byte memcpy */);
-
-			if (sta->u.ap.channel > 0 &&
-			    sta->u.ap.channel <= FREQ_COUNT) {
-				memset(&iwe, 0, sizeof(iwe));
-				iwe.cmd = SIOCGIWFREQ;
-				iwe.u.freq.m = freq_list[sta->u.ap.channel - 1]
-					* 100000;
-				iwe.u.freq.e = 1;
-				current_ev = iwe_stream_add_event(
-					current_ev, end_buf, &iwe,
-					IW_EV_FREQ_LEN);
-			}
-
-			memset(&iwe, 0, sizeof(iwe));
-			iwe.cmd = IWEVCUSTOM;
-			sprintf(buf, "beacon_interval=%d",
-				sta->listen_interval);
-			iwe.u.data.length = strlen(buf);
-			current_ev = iwe_stream_add_point(current_ev, end_buf,
-							  &iwe, buf);
-		}
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-		sta->last_rx_updated = 0;
-
-		/* To be continued, we should make good use of IWEVCUSTOM */
-	}
-
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	return current_ev - buffer;
-}
-
-
-static int prism2_hostapd_add_sta(struct ap_data *ap,
-				  struct prism2_hostapd_param *param)
-{
-	struct sta_info *sta;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, param->sta_addr);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	if (sta == NULL) {
-		sta = ap_add_sta(ap, param->sta_addr);
-		if (sta == NULL)
-			return -1;
-	}
-
-	if (!(sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
-		hostap_event_new_sta(sta->local->dev, sta);
-
-	sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
-	sta->last_rx = jiffies;
-	sta->aid = param->u.add_sta.aid;
-	sta->capability = param->u.add_sta.capability;
-	sta->tx_supp_rates = param->u.add_sta.tx_supp_rates;
-	if (sta->tx_supp_rates & WLAN_RATE_1M)
-		sta->supported_rates[0] = 2;
-	if (sta->tx_supp_rates & WLAN_RATE_2M)
-		sta->supported_rates[1] = 4;
- 	if (sta->tx_supp_rates & WLAN_RATE_5M5)
-		sta->supported_rates[2] = 11;
-	if (sta->tx_supp_rates & WLAN_RATE_11M)
-		sta->supported_rates[3] = 22;
-	prism2_check_tx_rates(sta);
-	atomic_dec(&sta->users);
-	return 0;
-}
-
-
-static int prism2_hostapd_remove_sta(struct ap_data *ap,
-				     struct prism2_hostapd_param *param)
-{
-	struct sta_info *sta;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, param->sta_addr);
-	if (sta) {
-		ap_sta_hash_del(ap, sta);
-		list_del(&sta->list);
-	}
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	if (!sta)
-		return -ENOENT;
-
-	if ((sta->flags & WLAN_STA_ASSOC) && !sta->ap && sta->local)
-		hostap_event_expired_sta(sta->local->dev, sta);
-	ap_free_sta(ap, sta);
-
-	return 0;
-}
-
-
-static int prism2_hostapd_get_info_sta(struct ap_data *ap,
-				       struct prism2_hostapd_param *param)
-{
-	struct sta_info *sta;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, param->sta_addr);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	if (!sta)
-		return -ENOENT;
-
-	param->u.get_info_sta.inactive_sec = (jiffies - sta->last_rx) / HZ;
-
-	atomic_dec(&sta->users);
-
-	return 1;
-}
-
-
-static int prism2_hostapd_set_flags_sta(struct ap_data *ap,
-					struct prism2_hostapd_param *param)
-{
-	struct sta_info *sta;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, param->sta_addr);
-	if (sta) {
-		sta->flags |= param->u.set_flags_sta.flags_or;
-		sta->flags &= param->u.set_flags_sta.flags_and;
-	}
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	if (!sta)
-		return -ENOENT;
-
-	return 0;
-}
-
-
-static int prism2_hostapd_sta_clear_stats(struct ap_data *ap,
-					  struct prism2_hostapd_param *param)
-{
-	struct sta_info *sta;
-	int rate;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, param->sta_addr);
-	if (sta) {
-		sta->rx_packets = sta->tx_packets = 0;
-		sta->rx_bytes = sta->tx_bytes = 0;
-		for (rate = 0; rate < WLAN_RATE_COUNT; rate++) {
-			sta->tx_count[rate] = 0;
-			sta->rx_count[rate] = 0;
-		}
-	}
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	if (!sta)
-		return -ENOENT;
-
-	return 0;
-}
-
-
-static int prism2_hostapd(struct ap_data *ap,
-			  struct prism2_hostapd_param *param)
-{
-	switch (param->cmd) {
-	case PRISM2_HOSTAPD_FLUSH:
-		ap_control_kickall(ap);
-		return 0;
-	case PRISM2_HOSTAPD_ADD_STA:
-		return prism2_hostapd_add_sta(ap, param);
-	case PRISM2_HOSTAPD_REMOVE_STA:
-		return prism2_hostapd_remove_sta(ap, param);
-	case PRISM2_HOSTAPD_GET_INFO_STA:
-		return prism2_hostapd_get_info_sta(ap, param);
-	case PRISM2_HOSTAPD_SET_FLAGS_STA:
-		return prism2_hostapd_set_flags_sta(ap, param);
-	case PRISM2_HOSTAPD_STA_CLEAR_STATS:
-		return prism2_hostapd_sta_clear_stats(ap, param);
-	default:
-		printk(KERN_WARNING "prism2_hostapd: unknown cmd=%d\n",
-		       param->cmd);
-		return -EOPNOTSUPP;
-	}
-}
-
-
-/* Update station info for host-based TX rate control and return current
- * TX rate */
-static int ap_update_sta_tx_rate(struct sta_info *sta, struct net_device *dev)
-{
-	int ret = sta->tx_rate;
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	sta->tx_count[sta->tx_rate_idx]++;
-	sta->tx_since_last_failure++;
-	sta->tx_consecutive_exc = 0;
-	if (sta->tx_since_last_failure >= WLAN_RATE_UPDATE_COUNT &&
-	    sta->tx_rate_idx < sta->tx_max_rate) {
-		/* use next higher rate */
-		int old_rate, new_rate;
-		old_rate = new_rate = sta->tx_rate_idx;
-		while (new_rate < sta->tx_max_rate) {
-			new_rate++;
-			if (ap_tx_rate_ok(new_rate, sta, local)) {
-				sta->tx_rate_idx = new_rate;
-				break;
-			}
-		}
-		if (old_rate != sta->tx_rate_idx) {
-			switch (sta->tx_rate_idx) {
-			case 0: sta->tx_rate = 10; break;
-			case 1: sta->tx_rate = 20; break;
-			case 2: sta->tx_rate = 55; break;
-			case 3: sta->tx_rate = 110; break;
-			default: sta->tx_rate = 0; break;
-			}
-			PDEBUG(DEBUG_AP, "%s: STA " MACSTR " TX rate raised to"
-			       " %d\n", dev->name, MAC2STR(sta->addr),
-			       sta->tx_rate);
-		}
-		sta->tx_since_last_failure = 0;
-	}
-
-	return ret;
-}
-
-
-/* Called only from software IRQ. Called for each TX frame prior possible
- * encryption and transmit. */
-ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx)
-{
-	struct sta_info *sta = NULL;
-	struct sk_buff *skb = tx->skb;
-	int set_tim, ret;
-	struct ieee80211_hdr *hdr;
-	struct hostap_skb_tx_data *meta;
-
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-	ret = AP_TX_CONTINUE;
-	if (local->ap == NULL || skb->len < 10 ||
-	    meta->iface->type == HOSTAP_INTERFACE_STA)
-		goto out;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-
-	if (hdr->addr1[0] & 0x01) {
-		/* broadcast/multicast frame - no AP related processing */
-		goto out;
-	}
-
-	/* unicast packet - check whether destination STA is associated */
-	spin_lock(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr1);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock(&local->ap->sta_table_lock);
-
-	if (local->iw_mode == IW_MODE_MASTER && sta == NULL &&
-	    !(meta->flags & HOSTAP_TX_FLAGS_WDS) &&
-	    meta->iface->type != HOSTAP_INTERFACE_MASTER &&
-	    meta->iface->type != HOSTAP_INTERFACE_AP) {
-#if 0
-		/* This can happen, e.g., when wlan0 is added to a bridge and
-		 * bridging code does not know which port is the correct target
-		 * for a unicast frame. In this case, the packet is send to all
-		 * ports of the bridge. Since this is a valid scenario, do not
-		 * print out any errors here. */
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "AP: drop packet to non-associated "
-			       "STA " MACSTR "\n", MAC2STR(hdr->addr1));
-		}
-#endif
-		local->ap->tx_drop_nonassoc++;
-		ret = AP_TX_DROP;
-		goto out;
-	}
-
-	if (sta == NULL)
-		goto out;
-
-	if (!(sta->flags & WLAN_STA_AUTHORIZED))
-		ret = AP_TX_CONTINUE_NOT_AUTHORIZED;
-
-	/* Set tx_rate if using host-based TX rate control */
-	if (!local->fw_tx_rate_control)
-		local->ap->last_tx_rate = meta->rate =
-			ap_update_sta_tx_rate(sta, local->dev);
-
-	if (local->iw_mode != IW_MODE_MASTER)
-		goto out;
-
-	if (!(sta->flags & WLAN_STA_PS))
-		goto out;
-
-	if (meta->flags & HOSTAP_TX_FLAGS_ADD_MOREDATA) {
-		/* indicate to STA that more frames follow */
-		hdr->frame_ctl |=
-			__constant_cpu_to_le16(IEEE80211_FCTL_MOREDATA);
-	}
-
-	if (meta->flags & HOSTAP_TX_FLAGS_BUFFERED_FRAME) {
-		/* packet was already buffered and now send due to
-		 * PS poll, so do not rebuffer it */
-		goto out;
-	}
-
-	if (skb_queue_len(&sta->tx_buf) >= STA_MAX_TX_BUFFER) {
-		PDEBUG(DEBUG_PS, "%s: No more space in STA (" MACSTR ")'s PS "
-		       "mode buffer\n", local->dev->name, MAC2STR(sta->addr));
-		/* Make sure that TIM is set for the station (it might not be
-		 * after AP wlan hw reset). */
-		/* FIX: should fix hw reset to restore bits based on STA
-		 * buffer state.. */
-		hostap_set_tim(local, sta->aid, 1);
-		sta->flags |= WLAN_STA_TIM;
-		ret = AP_TX_DROP;
-		goto out;
-	}
-
-	/* STA in PS mode, buffer frame for later delivery */
-	set_tim = skb_queue_empty(&sta->tx_buf);
-	skb_queue_tail(&sta->tx_buf, skb);
-	/* FIX: could save RX time to skb and expire buffered frames after
-	 * some time if STA does not poll for them */
-
-	if (set_tim) {
-		if (sta->flags & WLAN_STA_TIM)
-			PDEBUG(DEBUG_PS2, "Re-setting TIM for aid %d\n",
-			       sta->aid);
-		hostap_set_tim(local, sta->aid, 1);
-		sta->flags |= WLAN_STA_TIM;
-	}
-
-	ret = AP_TX_BUFFERED;
-
- out:
-	if (sta != NULL) {
-		if (ret == AP_TX_CONTINUE ||
-		    ret == AP_TX_CONTINUE_NOT_AUTHORIZED) {
-			sta->tx_packets++;
-			sta->tx_bytes += skb->len;
-			sta->last_tx = jiffies;
-		}
-
-		if ((ret == AP_TX_CONTINUE ||
-		     ret == AP_TX_CONTINUE_NOT_AUTHORIZED) &&
-		    sta->crypt && tx->host_encrypt) {
-			tx->crypt = sta->crypt;
-			tx->sta_ptr = sta; /* hostap_handle_sta_release() will
-					    * be called to release sta info
-					    * later */
-		} else
-			atomic_dec(&sta->users);
-	}
-
-	return ret;
-}
-
-
-void hostap_handle_sta_release(void *ptr)
-{
-	struct sta_info *sta = ptr;
-	atomic_dec(&sta->users);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb)
-{
-	struct sta_info *sta;
-	struct ieee80211_hdr *hdr;
-	struct hostap_skb_tx_data *meta;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-
-	spin_lock(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr1);
-	if (!sta) {
-		spin_unlock(&local->ap->sta_table_lock);
-		PDEBUG(DEBUG_AP, "%s: Could not find STA " MACSTR " for this "
-		       "TX error (@%lu)\n",
-		       local->dev->name, MAC2STR(hdr->addr1), jiffies);
-		return;
-	}
-
-	sta->tx_since_last_failure = 0;
-	sta->tx_consecutive_exc++;
-
-	if (sta->tx_consecutive_exc >= WLAN_RATE_DECREASE_THRESHOLD &&
-	    sta->tx_rate_idx > 0 && meta->rate <= sta->tx_rate) {
-		/* use next lower rate */
-		int old, rate;
-		old = rate = sta->tx_rate_idx;
-		while (rate > 0) {
-			rate--;
-			if (ap_tx_rate_ok(rate, sta, local)) {
-				sta->tx_rate_idx = rate;
-				break;
-			}
-		}
-		if (old != sta->tx_rate_idx) {
-			switch (sta->tx_rate_idx) {
-			case 0: sta->tx_rate = 10; break;
-			case 1: sta->tx_rate = 20; break;
-			case 2: sta->tx_rate = 55; break;
-			case 3: sta->tx_rate = 110; break;
-			default: sta->tx_rate = 0; break;
-			}
-			PDEBUG(DEBUG_AP, "%s: STA " MACSTR " TX rate lowered "
-			       "to %d\n", local->dev->name, MAC2STR(sta->addr),
-			       sta->tx_rate);
-		}
-		sta->tx_consecutive_exc = 0;
-	}
-	spin_unlock(&local->ap->sta_table_lock);
-}
-
-
-static void hostap_update_sta_ps2(local_info_t *local, struct sta_info *sta,
-				  int pwrmgt, int type, int stype)
-{
-	if (pwrmgt && !(sta->flags & WLAN_STA_PS)) {
-		sta->flags |= WLAN_STA_PS;
-		PDEBUG(DEBUG_PS2, "STA " MACSTR " changed to use PS "
-		       "mode (type=0x%02X, stype=0x%02X)\n",
-		       MAC2STR(sta->addr), type >> 2, stype >> 4);
-	} else if (!pwrmgt && (sta->flags & WLAN_STA_PS)) {
-		sta->flags &= ~WLAN_STA_PS;
-		PDEBUG(DEBUG_PS2, "STA " MACSTR " changed to not use "
-		       "PS mode (type=0x%02X, stype=0x%02X)\n",
-		       MAC2STR(sta->addr), type >> 2, stype >> 4);
-		if (type != IEEE80211_FTYPE_CTL ||
-		    stype != IEEE80211_STYPE_PSPOLL)
-			schedule_packet_send(local, sta);
-	}
-}
-
-
-/* Called only as a tasklet (software IRQ). Called for each RX frame to update
- * STA power saving state. pwrmgt is a flag from 802.11 frame_ctl field. */
-int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr *hdr)
-{
-	struct sta_info *sta;
-	u16 fc;
-
-	spin_lock(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock(&local->ap->sta_table_lock);
-
-	if (!sta)
-		return -1;
-
-	fc = le16_to_cpu(hdr->frame_ctl);
-	hostap_update_sta_ps2(local, sta, fc & IEEE80211_FCTL_PM,
-			      WLAN_FC_GET_TYPE(fc), WLAN_FC_GET_STYPE(fc));
-
-	atomic_dec(&sta->users);
-	return 0;
-}
-
-
-/* Called only as a tasklet (software IRQ). Called for each RX frame after
- * getting RX header and payload from hardware. */
-ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
-			       struct sk_buff *skb,
-			       struct hostap_80211_rx_status *rx_stats,
-			       int wds)
-{
-	int ret;
-	struct sta_info *sta;
-	u16 fc, type, stype;
-	struct ieee80211_hdr *hdr;
-
-	if (local->ap == NULL)
-		return AP_RX_CONTINUE;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-
-	fc = le16_to_cpu(hdr->frame_ctl);
-	type = WLAN_FC_GET_TYPE(fc);
-	stype = WLAN_FC_GET_STYPE(fc);
-
-	spin_lock(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock(&local->ap->sta_table_lock);
-
-	if (sta && !(sta->flags & WLAN_STA_AUTHORIZED))
-		ret = AP_RX_CONTINUE_NOT_AUTHORIZED;
-	else
-		ret = AP_RX_CONTINUE;
-
-
-	if (fc & IEEE80211_FCTL_TODS) {
-		if (!wds && (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
-			if (local->hostapd) {
-				prism2_rx_80211(local->apdev, skb, rx_stats,
-						PRISM2_RX_NON_ASSOC);
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-			} else {
-				printk(KERN_DEBUG "%s: dropped received packet"
-				       " from non-associated STA " MACSTR
-				       " (type=0x%02x, subtype=0x%02x)\n",
-				       dev->name, MAC2STR(hdr->addr2),
-				       type >> 2, stype >> 4);
-				hostap_rx(dev, skb, rx_stats);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-			}
-			ret = AP_RX_EXIT;
-			goto out;
-		}
-	} else if (fc & IEEE80211_FCTL_FROMDS) {
-		if (!wds) {
-			/* FromDS frame - not for us; probably
-			 * broadcast/multicast in another BSS - drop */
-			if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
-				printk(KERN_DEBUG "Odd.. FromDS packet "
-				       "received with own BSSID\n");
-				hostap_dump_rx_80211(dev->name, skb, rx_stats);
-			}
-			ret = AP_RX_DROP;
-			goto out;
-		}
-	} else if (stype == IEEE80211_STYPE_NULLFUNC && sta == NULL &&
-		   memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
-
-		if (local->hostapd) {
-			prism2_rx_80211(local->apdev, skb, rx_stats,
-					PRISM2_RX_NON_ASSOC);
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-		} else {
-			/* At least Lucent f/w seems to send data::nullfunc
-			 * frames with no ToDS flag when the current AP returns
-			 * after being unavailable for some time. Speed up
-			 * re-association by informing the station about it not
-			 * being associated. */
-			printk(KERN_DEBUG "%s: rejected received nullfunc "
-			       "frame without ToDS from not associated STA "
-			       MACSTR "\n",
-			       dev->name, MAC2STR(hdr->addr2));
-			hostap_rx(dev, skb, rx_stats);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-		}
-		ret = AP_RX_EXIT;
-		goto out;
-	} else if (stype == IEEE80211_STYPE_NULLFUNC) {
-		/* At least Lucent cards seem to send periodic nullfunc
-		 * frames with ToDS. Let these through to update SQ
-		 * stats and PS state. Nullfunc frames do not contain
-		 * any data and they will be dropped below. */
-	} else {
-		/* If BSSID (Addr3) is foreign, this frame is a normal
-		 * broadcast frame from an IBSS network. Drop it silently.
-		 * If BSSID is own, report the dropping of this frame. */
-		if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
-			printk(KERN_DEBUG "%s: dropped received packet from "
-			       MACSTR " with no ToDS flag (type=0x%02x, "
-			       "subtype=0x%02x)\n", dev->name,
-			       MAC2STR(hdr->addr2), type >> 2, stype >> 4);
-			hostap_dump_rx_80211(dev->name, skb, rx_stats);
-		}
-		ret = AP_RX_DROP;
-		goto out;
-	}
-
-	if (sta) {
-		hostap_update_sta_ps2(local, sta, fc & IEEE80211_FCTL_PM,
-				      type, stype);
-
-		sta->rx_packets++;
-		sta->rx_bytes += skb->len;
-		sta->last_rx = jiffies;
-	}
-
-	if (local->ap->nullfunc_ack && stype == IEEE80211_STYPE_NULLFUNC &&
-	    fc & IEEE80211_FCTL_TODS) {
-		if (local->hostapd) {
-			prism2_rx_80211(local->apdev, skb, rx_stats,
-					PRISM2_RX_NULLFUNC_ACK);
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-		} else {
-			/* some STA f/w's seem to require control::ACK frame
-			 * for data::nullfunc, but Prism2 f/w 0.8.0 (at least
-			 * from Compaq) does not send this.. Try to generate
-			 * ACK for these frames from the host driver to make
-			 * power saving work with, e.g., Lucent WaveLAN f/w */
-			hostap_rx(dev, skb, rx_stats);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-		}
-		ret = AP_RX_EXIT;
-		goto out;
-	}
-
- out:
-	if (sta)
-		atomic_dec(&sta->users);
-
-	return ret;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-int hostap_handle_sta_crypto(local_info_t *local,
-			     struct ieee80211_hdr *hdr,
-			     struct ieee80211_crypt_data **crypt,
-			     void **sta_ptr)
-{
-	struct sta_info *sta;
-
-	spin_lock(&local->ap->sta_table_lock);
-	sta = ap_get_sta(local->ap, hdr->addr2);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock(&local->ap->sta_table_lock);
-
-	if (!sta)
-		return -1;
-
-	if (sta->crypt) {
-		*crypt = sta->crypt;
-		*sta_ptr = sta;
-		/* hostap_handle_sta_release() will be called to release STA
-		 * info */
-	} else
-		atomic_dec(&sta->users);
-
-	return 0;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-int hostap_is_sta_assoc(struct ap_data *ap, u8 *sta_addr)
-{
-	struct sta_info *sta;
-	int ret = 0;
-
-	spin_lock(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, sta_addr);
-	if (sta != NULL && (sta->flags & WLAN_STA_ASSOC) && !sta->ap)
-		ret = 1;
-	spin_unlock(&ap->sta_table_lock);
-
-	return ret;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-int hostap_is_sta_authorized(struct ap_data *ap, u8 *sta_addr)
-{
-	struct sta_info *sta;
-	int ret = 0;
-
-	spin_lock(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, sta_addr);
-	if (sta != NULL && (sta->flags & WLAN_STA_ASSOC) && !sta->ap &&
-	    ((sta->flags & WLAN_STA_AUTHORIZED) ||
-	     ap->local->ieee_802_1x == 0))
-		ret = 1;
-	spin_unlock(&ap->sta_table_lock);
-
-	return ret;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-int hostap_add_sta(struct ap_data *ap, u8 *sta_addr)
-{
-	struct sta_info *sta;
-	int ret = 1;
-
-	if (!ap)
-		return -1;
-
-	spin_lock(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, sta_addr);
-	if (sta)
-		ret = 0;
-	spin_unlock(&ap->sta_table_lock);
-
-	if (ret == 1) {
-		sta = ap_add_sta(ap, sta_addr);
-		if (!sta)
-			ret = -1;
-		sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC;
-		sta->ap = 1;
-		memset(sta->supported_rates, 0, sizeof(sta->supported_rates));
-		/* No way of knowing which rates are supported since we did not
-		 * get supported rates element from beacon/assoc req. Assume
-		 * that remote end supports all 802.11b rates. */
-		sta->supported_rates[0] = 0x82;
-		sta->supported_rates[1] = 0x84;
-		sta->supported_rates[2] = 0x0b;
-		sta->supported_rates[3] = 0x16;
-		sta->tx_supp_rates = WLAN_RATE_1M | WLAN_RATE_2M |
-			WLAN_RATE_5M5 | WLAN_RATE_11M;
-		sta->tx_rate = 110;
-		sta->tx_max_rate = sta->tx_rate_idx = 3;
-	}
-
-	return ret;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-int hostap_update_rx_stats(struct ap_data *ap,
-			   struct ieee80211_hdr *hdr,
-			   struct hostap_80211_rx_status *rx_stats)
-{
-	struct sta_info *sta;
-
-	if (!ap)
-		return -1;
-
-	spin_lock(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, hdr->addr2);
-	if (sta) {
-		sta->last_rx_silence = rx_stats->noise;
-		sta->last_rx_signal = rx_stats->signal;
-		sta->last_rx_rate = rx_stats->rate;
-		sta->last_rx_updated = 7;
-		if (rx_stats->rate == 10)
-			sta->rx_count[0]++;
-		else if (rx_stats->rate == 20)
-			sta->rx_count[1]++;
-		else if (rx_stats->rate == 55)
-			sta->rx_count[2]++;
-		else if (rx_stats->rate == 110)
-			sta->rx_count[3]++;
-	}
-	spin_unlock(&ap->sta_table_lock);
-
-	return sta ? 0 : -1;
-}
-
-
-void hostap_update_rates(local_info_t *local)
-{
-	struct list_head *ptr;
-	struct ap_data *ap = local->ap;
-
-	if (!ap)
-		return;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	for (ptr = ap->sta_list.next; ptr != &ap->sta_list; ptr = ptr->next) {
-		struct sta_info *sta = (struct sta_info *) ptr;
-		prism2_check_tx_rates(sta);
-	}
-	spin_unlock_bh(&ap->sta_table_lock);
-}
-
-
-static void * ap_crypt_get_ptrs(struct ap_data *ap, u8 *addr, int permanent,
-				struct ieee80211_crypt_data ***crypt)
-{
-	struct sta_info *sta;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	sta = ap_get_sta(ap, addr);
-	if (sta)
-		atomic_inc(&sta->users);
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	if (!sta && permanent)
-		sta = ap_add_sta(ap, addr);
-
-	if (!sta)
-		return NULL;
-
-	if (permanent)
-		sta->flags |= WLAN_STA_PERM;
-
-	*crypt = &sta->crypt;
-
-	return sta;
-}
-
-
-void hostap_add_wds_links(local_info_t *local)
-{
-	struct ap_data *ap = local->ap;
-	struct list_head *ptr;
-
-	spin_lock_bh(&ap->sta_table_lock);
-	list_for_each(ptr, &ap->sta_list) {
-		struct sta_info *sta = list_entry(ptr, struct sta_info, list);
-		if (sta->ap)
-			hostap_wds_link_oper(local, sta->addr, WDS_ADD);
-	}
-	spin_unlock_bh(&ap->sta_table_lock);
-
-	schedule_work(&local->ap->wds_oper_queue);
-}
-
-
-void hostap_wds_link_oper(local_info_t *local, u8 *addr, wds_oper_type type)
-{
-	struct wds_oper_data *entry;
-
-	entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
-	if (!entry)
-		return;
-	memcpy(entry->addr, addr, ETH_ALEN);
-	entry->type = type;
-	spin_lock_bh(&local->lock);
-	entry->next = local->ap->wds_oper_entries;
-	local->ap->wds_oper_entries = entry;
-	spin_unlock_bh(&local->lock);
-
-	schedule_work(&local->ap->wds_oper_queue);
-}
-
-
-EXPORT_SYMBOL(hostap_init_data);
-EXPORT_SYMBOL(hostap_init_ap_proc);
-EXPORT_SYMBOL(hostap_free_data);
-EXPORT_SYMBOL(hostap_check_sta_fw_version);
-EXPORT_SYMBOL(hostap_handle_sta_tx);
-EXPORT_SYMBOL(hostap_handle_sta_release);
-EXPORT_SYMBOL(hostap_handle_sta_tx_exc);
-EXPORT_SYMBOL(hostap_update_sta_ps);
-EXPORT_SYMBOL(hostap_handle_sta_rx);
-EXPORT_SYMBOL(hostap_is_sta_assoc);
-EXPORT_SYMBOL(hostap_is_sta_authorized);
-EXPORT_SYMBOL(hostap_add_sta);
-EXPORT_SYMBOL(hostap_update_rates);
-EXPORT_SYMBOL(hostap_add_wds_links);
-EXPORT_SYMBOL(hostap_wds_link_oper);
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-EXPORT_SYMBOL(hostap_deauth_all_stas);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
diff --git a/trunk/drivers/net/wireless/hostap/hostap_ap.h b/trunk/drivers/net/wireless/hostap/hostap_ap.h
deleted file mode 100644
index 816a52bcea8f..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_ap.h
+++ /dev/null
@@ -1,261 +0,0 @@
-#ifndef HOSTAP_AP_H
-#define HOSTAP_AP_H
-
-/* AP data structures for STAs */
-
-/* maximum number of frames to buffer per STA */
-#define STA_MAX_TX_BUFFER 32
-
-/* STA flags */
-#define WLAN_STA_AUTH BIT(0)
-#define WLAN_STA_ASSOC BIT(1)
-#define WLAN_STA_PS BIT(2)
-#define WLAN_STA_TIM BIT(3) /* TIM bit is on for PS stations */
-#define WLAN_STA_PERM BIT(4) /* permanent; do not remove entry on expiration */
-#define WLAN_STA_AUTHORIZED BIT(5) /* If 802.1X is used, this flag is
-				    * controlling whether STA is authorized to
-				    * send and receive non-IEEE 802.1X frames
-				    */
-#define WLAN_STA_PENDING_POLL BIT(6) /* pending activity poll not ACKed */
-
-#define WLAN_RATE_1M BIT(0)
-#define WLAN_RATE_2M BIT(1)
-#define WLAN_RATE_5M5 BIT(2)
-#define WLAN_RATE_11M BIT(3)
-#define WLAN_RATE_COUNT 4
-
-/* Maximum size of Supported Rates info element. IEEE 802.11 has a limit of 8,
- * but some pre-standard IEEE 802.11g products use longer elements. */
-#define WLAN_SUPP_RATES_MAX 32
-
-/* Try to increase TX rate after # successfully sent consecutive packets */
-#define WLAN_RATE_UPDATE_COUNT 50
-
-/* Decrease TX rate after # consecutive dropped packets */
-#define WLAN_RATE_DECREASE_THRESHOLD 2
-
-struct sta_info {
-	struct list_head list;
-	struct sta_info *hnext; /* next entry in hash table list */
-	atomic_t users; /* number of users (do not remove if > 0) */
-	struct proc_dir_entry *proc;
-
-	u8 addr[6];
-	u16 aid; /* STA's unique AID (1 .. 2007) or 0 if not yet assigned */
-	u32 flags;
-	u16 capability;
-	u16 listen_interval; /* or beacon_int for APs */
-	u8 supported_rates[WLAN_SUPP_RATES_MAX];
-
-	unsigned long last_auth;
-	unsigned long last_assoc;
-	unsigned long last_rx;
-	unsigned long last_tx;
-	unsigned long rx_packets, tx_packets;
-	unsigned long rx_bytes, tx_bytes;
-	struct sk_buff_head tx_buf;
-	/* FIX: timeout buffers with an expiry time somehow derived from
-	 * listen_interval */
-
-	s8 last_rx_silence; /* Noise in dBm */
-	s8 last_rx_signal; /* Signal strength in dBm */
-	u8 last_rx_rate; /* TX rate in 0.1 Mbps */
-	u8 last_rx_updated; /* IWSPY's struct iw_quality::updated */
-
-	u8 tx_supp_rates; /* bit field of supported TX rates */
-	u8 tx_rate; /* current TX rate (in 0.1 Mbps) */
-	u8 tx_rate_idx; /* current TX rate (WLAN_RATE_*) */
-	u8 tx_max_rate; /* max TX rate (WLAN_RATE_*) */
-	u32 tx_count[WLAN_RATE_COUNT]; /* number of frames sent (per rate) */
-	u32 rx_count[WLAN_RATE_COUNT]; /* number of frames received (per rate)
-					*/
-	u32 tx_since_last_failure;
-	u32 tx_consecutive_exc;
-
-	struct ieee80211_crypt_data *crypt;
-
-	int ap; /* whether this station is an AP */
-
-	local_info_t *local;
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	union {
-		struct {
-			char *challenge; /* shared key authentication
-					  * challenge */
-		} sta;
-		struct {
-			int ssid_len;
-			unsigned char ssid[MAX_SSID_LEN + 1]; /* AP's ssid */
-			int channel;
-			unsigned long last_beacon; /* last RX beacon time */
-		} ap;
-	} u;
-
-	struct timer_list timer;
-	enum { STA_NULLFUNC = 0, STA_DISASSOC, STA_DEAUTH } timeout_next;
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-};
-
-
-#define MAX_STA_COUNT 1024
-
-/* Maximum number of AIDs to use for STAs; must be 2007 or lower
- * (8802.11 limitation) */
-#define MAX_AID_TABLE_SIZE 128
-
-#define STA_HASH_SIZE 256
-#define STA_HASH(sta) (sta[5])
-
-
-/* Default value for maximum station inactivity. After AP_MAX_INACTIVITY_SEC
- * has passed since last received frame from the station, a nullfunc data
- * frame is sent to the station. If this frame is not acknowledged and no other
- * frames have been received, the station will be disassociated after
- * AP_DISASSOC_DELAY. Similarily, a the station will be deauthenticated after
- * AP_DEAUTH_DELAY. AP_TIMEOUT_RESOLUTION is the resolution that is used with
- * max inactivity timer. */
-#define AP_MAX_INACTIVITY_SEC (5 * 60)
-#define AP_DISASSOC_DELAY (HZ)
-#define AP_DEAUTH_DELAY (HZ)
-
-/* ap_policy: whether to accept frames to/from other APs/IBSS */
-typedef enum {
-	AP_OTHER_AP_SKIP_ALL = 0,
-	AP_OTHER_AP_SAME_SSID = 1,
-	AP_OTHER_AP_ALL = 2,
-	AP_OTHER_AP_EVEN_IBSS = 3
-} ap_policy_enum;
-
-#define PRISM2_AUTH_OPEN BIT(0)
-#define PRISM2_AUTH_SHARED_KEY BIT(1)
-
-
-/* MAC address-based restrictions */
-struct mac_entry {
-	struct list_head list;
-	u8 addr[6];
-};
-
-struct mac_restrictions {
-	enum { MAC_POLICY_OPEN = 0, MAC_POLICY_ALLOW, MAC_POLICY_DENY } policy;
-	unsigned int entries;
-	struct list_head mac_list;
-	spinlock_t lock;
-};
-
-
-struct add_sta_proc_data {
-	u8 addr[ETH_ALEN];
-	struct add_sta_proc_data *next;
-};
-
-
-typedef enum { WDS_ADD, WDS_DEL } wds_oper_type;
-struct wds_oper_data {
-	wds_oper_type type;
-	u8 addr[ETH_ALEN];
-	struct wds_oper_data *next;
-};
-
-
-struct ap_data {
-	int initialized; /* whether ap_data has been initialized */
-	local_info_t *local;
-	int bridge_packets; /* send packet to associated STAs directly to the
-			     * wireless media instead of higher layers in the
-			     * kernel */
-	unsigned int bridged_unicast; /* number of unicast frames bridged on
-				       * wireless media */
-	unsigned int bridged_multicast; /* number of non-unicast frames
-					 * bridged on wireless media */
-	unsigned int tx_drop_nonassoc; /* number of unicast TX packets dropped
-					* because they were to an address that
-					* was not associated */
-	int nullfunc_ack; /* use workaround for nullfunc frame ACKs */
-
-	spinlock_t sta_table_lock;
-	int num_sta; /* number of entries in sta_list */
-	struct list_head sta_list; /* STA info list head */
-	struct sta_info *sta_hash[STA_HASH_SIZE];
-
-	struct proc_dir_entry *proc;
-
-	ap_policy_enum ap_policy;
-	unsigned int max_inactivity;
-	int autom_ap_wds;
-
-	struct mac_restrictions mac_restrictions; /* MAC-based auth */
-	int last_tx_rate;
-
-	struct work_struct add_sta_proc_queue;
-	struct add_sta_proc_data *add_sta_proc_entries;
-
-	struct work_struct wds_oper_queue;
-	struct wds_oper_data *wds_oper_entries;
-
-	u16 tx_callback_idx;
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	/* pointers to STA info; based on allocated AID or NULL if AID free
-	 * AID is in the range 1-2007, so sta_aid[0] corresponders to AID 1
-	 * and so on
-	 */
-	struct sta_info *sta_aid[MAX_AID_TABLE_SIZE];
-
-	u16 tx_callback_auth, tx_callback_assoc, tx_callback_poll;
-
-	/* WEP operations for generating challenges to be used with shared key
-	 * authentication */
-	struct ieee80211_crypto_ops *crypt;
-	void *crypt_priv;
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-};
-
-
-void hostap_rx(struct net_device *dev, struct sk_buff *skb,
-	       struct hostap_80211_rx_status *rx_stats);
-void hostap_init_data(local_info_t *local);
-void hostap_init_ap_proc(local_info_t *local);
-void hostap_free_data(struct ap_data *ap);
-void hostap_check_sta_fw_version(struct ap_data *ap, int sta_fw_ver);
-
-typedef enum {
-	AP_TX_CONTINUE, AP_TX_DROP, AP_TX_RETRY, AP_TX_BUFFERED,
-	AP_TX_CONTINUE_NOT_AUTHORIZED
-} ap_tx_ret;
-struct hostap_tx_data {
-	struct sk_buff *skb;
-	int host_encrypt;
-	struct ieee80211_crypt_data *crypt;
-	void *sta_ptr;
-};
-ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx);
-void hostap_handle_sta_release(void *ptr);
-void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb);
-int hostap_update_sta_ps(local_info_t *local, struct ieee80211_hdr *hdr);
-typedef enum {
-	AP_RX_CONTINUE, AP_RX_DROP, AP_RX_EXIT, AP_RX_CONTINUE_NOT_AUTHORIZED
-} ap_rx_ret;
-ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
-			       struct sk_buff *skb,
-			       struct hostap_80211_rx_status *rx_stats,
-			       int wds);
-int hostap_handle_sta_crypto(local_info_t *local, struct ieee80211_hdr *hdr,
-			     struct ieee80211_crypt_data **crypt,
-			     void **sta_ptr);
-int hostap_is_sta_assoc(struct ap_data *ap, u8 *sta_addr);
-int hostap_is_sta_authorized(struct ap_data *ap, u8 *sta_addr);
-int hostap_add_sta(struct ap_data *ap, u8 *sta_addr);
-int hostap_update_rx_stats(struct ap_data *ap, struct ieee80211_hdr *hdr,
-			   struct hostap_80211_rx_status *rx_stats);
-void hostap_update_rates(local_info_t *local);
-void hostap_add_wds_links(local_info_t *local);
-void hostap_wds_link_oper(local_info_t *local, u8 *addr, wds_oper_type type);
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-void hostap_deauth_all_stas(struct net_device *dev, struct ap_data *ap,
-			    int resend);
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-#endif /* HOSTAP_AP_H */
diff --git a/trunk/drivers/net/wireless/hostap/hostap_common.h b/trunk/drivers/net/wireless/hostap/hostap_common.h
deleted file mode 100644
index 6f4fa9dc308f..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_common.h
+++ /dev/null
@@ -1,435 +0,0 @@
-#ifndef HOSTAP_COMMON_H
-#define HOSTAP_COMMON_H
-
-#define BIT(x) (1 << (x))
-
-#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
-#define MACSTR "%02x:%02x:%02x:%02x:%02x:%02x"
-
-
-/* IEEE 802.11 defines */
-
-/* Information Element IDs */
-#define WLAN_EID_SSID 0
-#define WLAN_EID_SUPP_RATES 1
-#define WLAN_EID_FH_PARAMS 2
-#define WLAN_EID_DS_PARAMS 3
-#define WLAN_EID_CF_PARAMS 4
-#define WLAN_EID_TIM 5
-#define WLAN_EID_IBSS_PARAMS 6
-#define WLAN_EID_CHALLENGE 16
-#define WLAN_EID_RSN 48
-#define WLAN_EID_GENERIC 221
-
-
-/* HFA384X Configuration RIDs */
-#define HFA384X_RID_CNFPORTTYPE 0xFC00
-#define HFA384X_RID_CNFOWNMACADDR 0xFC01
-#define HFA384X_RID_CNFDESIREDSSID 0xFC02
-#define HFA384X_RID_CNFOWNCHANNEL 0xFC03
-#define HFA384X_RID_CNFOWNSSID 0xFC04
-#define HFA384X_RID_CNFOWNATIMWINDOW 0xFC05
-#define HFA384X_RID_CNFSYSTEMSCALE 0xFC06
-#define HFA384X_RID_CNFMAXDATALEN 0xFC07
-#define HFA384X_RID_CNFWDSADDRESS 0xFC08
-#define HFA384X_RID_CNFPMENABLED 0xFC09
-#define HFA384X_RID_CNFPMEPS 0xFC0A
-#define HFA384X_RID_CNFMULTICASTRECEIVE 0xFC0B
-#define HFA384X_RID_CNFMAXSLEEPDURATION 0xFC0C
-#define HFA384X_RID_CNFPMHOLDOVERDURATION 0xFC0D
-#define HFA384X_RID_CNFOWNNAME 0xFC0E
-#define HFA384X_RID_CNFOWNDTIMPERIOD 0xFC10
-#define HFA384X_RID_CNFWDSADDRESS1 0xFC11 /* AP f/w only */
-#define HFA384X_RID_CNFWDSADDRESS2 0xFC12 /* AP f/w only */
-#define HFA384X_RID_CNFWDSADDRESS3 0xFC13 /* AP f/w only */
-#define HFA384X_RID_CNFWDSADDRESS4 0xFC14 /* AP f/w only */
-#define HFA384X_RID_CNFWDSADDRESS5 0xFC15 /* AP f/w only */
-#define HFA384X_RID_CNFWDSADDRESS6 0xFC16 /* AP f/w only */
-#define HFA384X_RID_CNFMULTICASTPMBUFFERING 0xFC17 /* AP f/w only */
-#define HFA384X_RID_UNKNOWN1 0xFC20
-#define HFA384X_RID_UNKNOWN2 0xFC21
-#define HFA384X_RID_CNFWEPDEFAULTKEYID 0xFC23
-#define HFA384X_RID_CNFDEFAULTKEY0 0xFC24
-#define HFA384X_RID_CNFDEFAULTKEY1 0xFC25
-#define HFA384X_RID_CNFDEFAULTKEY2 0xFC26
-#define HFA384X_RID_CNFDEFAULTKEY3 0xFC27
-#define HFA384X_RID_CNFWEPFLAGS 0xFC28
-#define HFA384X_RID_CNFWEPKEYMAPPINGTABLE 0xFC29
-#define HFA384X_RID_CNFAUTHENTICATION 0xFC2A
-#define HFA384X_RID_CNFMAXASSOCSTA 0xFC2B /* AP f/w only */
-#define HFA384X_RID_CNFTXCONTROL 0xFC2C
-#define HFA384X_RID_CNFROAMINGMODE 0xFC2D
-#define HFA384X_RID_CNFHOSTAUTHENTICATION 0xFC2E /* AP f/w only */
-#define HFA384X_RID_CNFRCVCRCERROR 0xFC30
-#define HFA384X_RID_CNFMMLIFE 0xFC31
-#define HFA384X_RID_CNFALTRETRYCOUNT 0xFC32
-#define HFA384X_RID_CNFBEACONINT 0xFC33
-#define HFA384X_RID_CNFAPPCFINFO 0xFC34 /* AP f/w only */
-#define HFA384X_RID_CNFSTAPCFINFO 0xFC35
-#define HFA384X_RID_CNFPRIORITYQUSAGE 0xFC37
-#define HFA384X_RID_CNFTIMCTRL 0xFC40
-#define HFA384X_RID_UNKNOWN3 0xFC41 /* added in STA f/w 0.7.x */
-#define HFA384X_RID_CNFTHIRTY2TALLY 0xFC42 /* added in STA f/w 0.8.0 */
-#define HFA384X_RID_CNFENHSECURITY 0xFC43 /* AP f/w or STA f/w >= 1.6.3 */
-#define HFA384X_RID_CNFDBMADJUST 0xFC46 /* added in STA f/w 1.3.1 */
-#define HFA384X_RID_GENERICELEMENT 0xFC48 /* added in STA f/w 1.7.0;
-					   * write only */
-#define HFA384X_RID_PROPAGATIONDELAY 0xFC49 /* added in STA f/w 1.7.6 */
-#define HFA384X_RID_GROUPADDRESSES 0xFC80
-#define HFA384X_RID_CREATEIBSS 0xFC81
-#define HFA384X_RID_FRAGMENTATIONTHRESHOLD 0xFC82
-#define HFA384X_RID_RTSTHRESHOLD 0xFC83
-#define HFA384X_RID_TXRATECONTROL 0xFC84
-#define HFA384X_RID_PROMISCUOUSMODE 0xFC85
-#define HFA384X_RID_FRAGMENTATIONTHRESHOLD0 0xFC90 /* AP f/w only */
-#define HFA384X_RID_FRAGMENTATIONTHRESHOLD1 0xFC91 /* AP f/w only */
-#define HFA384X_RID_FRAGMENTATIONTHRESHOLD2 0xFC92 /* AP f/w only */
-#define HFA384X_RID_FRAGMENTATIONTHRESHOLD3 0xFC93 /* AP f/w only */
-#define HFA384X_RID_FRAGMENTATIONTHRESHOLD4 0xFC94 /* AP f/w only */
-#define HFA384X_RID_FRAGMENTATIONTHRESHOLD5 0xFC95 /* AP f/w only */
-#define HFA384X_RID_FRAGMENTATIONTHRESHOLD6 0xFC96 /* AP f/w only */
-#define HFA384X_RID_RTSTHRESHOLD0 0xFC97 /* AP f/w only */
-#define HFA384X_RID_RTSTHRESHOLD1 0xFC98 /* AP f/w only */
-#define HFA384X_RID_RTSTHRESHOLD2 0xFC99 /* AP f/w only */
-#define HFA384X_RID_RTSTHRESHOLD3 0xFC9A /* AP f/w only */
-#define HFA384X_RID_RTSTHRESHOLD4 0xFC9B /* AP f/w only */
-#define HFA384X_RID_RTSTHRESHOLD5 0xFC9C /* AP f/w only */
-#define HFA384X_RID_RTSTHRESHOLD6 0xFC9D /* AP f/w only */
-#define HFA384X_RID_TXRATECONTROL0 0xFC9E /* AP f/w only */
-#define HFA384X_RID_TXRATECONTROL1 0xFC9F /* AP f/w only */
-#define HFA384X_RID_TXRATECONTROL2 0xFCA0 /* AP f/w only */
-#define HFA384X_RID_TXRATECONTROL3 0xFCA1 /* AP f/w only */
-#define HFA384X_RID_TXRATECONTROL4 0xFCA2 /* AP f/w only */
-#define HFA384X_RID_TXRATECONTROL5 0xFCA3 /* AP f/w only */
-#define HFA384X_RID_TXRATECONTROL6 0xFCA4 /* AP f/w only */
-#define HFA384X_RID_CNFSHORTPREAMBLE 0xFCB0
-#define HFA384X_RID_CNFEXCLUDELONGPREAMBLE 0xFCB1
-#define HFA384X_RID_CNFAUTHENTICATIONRSPTO 0xFCB2
-#define HFA384X_RID_CNFBASICRATES 0xFCB3
-#define HFA384X_RID_CNFSUPPORTEDRATES 0xFCB4
-#define HFA384X_RID_CNFFALLBACKCTRL 0xFCB5 /* added in STA f/w 1.3.1 */
-#define HFA384X_RID_WEPKEYDISABLE 0xFCB6 /* added in STA f/w 1.3.1 */
-#define HFA384X_RID_WEPKEYMAPINDEX 0xFCB7 /* ? */
-#define HFA384X_RID_BROADCASTKEYID 0xFCB8 /* ? */
-#define HFA384X_RID_ENTSECFLAGEYID 0xFCB9 /* ? */
-#define HFA384X_RID_CNFPASSIVESCANCTRL 0xFCBA /* added in STA f/w 1.5.0 */
-#define HFA384X_RID_SSNHANDLINGMODE 0xFCBB /* added in STA f/w 1.7.0 */
-#define HFA384X_RID_MDCCONTROL 0xFCBC /* added in STA f/w 1.7.0 */
-#define HFA384X_RID_MDCCOUNTRY 0xFCBD /* added in STA f/w 1.7.0 */
-#define HFA384X_RID_TXPOWERMAX 0xFCBE /* added in STA f/w 1.7.0 */
-#define HFA384X_RID_CNFLFOENABLED 0xFCBF /* added in STA f/w 1.6.3 */
-#define HFA384X_RID_CAPINFO 0xFCC0 /* added in STA f/w 1.7.0 */
-#define HFA384X_RID_LISTENINTERVAL 0xFCC1 /* added in STA f/w 1.7.0 */
-#define HFA384X_RID_SW_ANT_DIV 0xFCC2 /* added in STA f/w 1.7.0; Prism3 */
-#define HFA384X_RID_LED_CTRL 0xFCC4 /* added in STA f/w 1.7.6 */
-#define HFA384X_RID_HFODELAY 0xFCC5 /* added in STA f/w 1.7.6 */
-#define HFA384X_RID_DISALLOWEDBSSID 0xFCC6 /* added in STA f/w 1.8.0 */
-#define HFA384X_RID_TICKTIME 0xFCE0
-#define HFA384X_RID_SCANREQUEST 0xFCE1
-#define HFA384X_RID_JOINREQUEST 0xFCE2
-#define HFA384X_RID_AUTHENTICATESTATION 0xFCE3 /* AP f/w only */
-#define HFA384X_RID_CHANNELINFOREQUEST 0xFCE4 /* AP f/w only */
-#define HFA384X_RID_HOSTSCAN 0xFCE5 /* added in STA f/w 1.3.1 */
-
-/* HFA384X Information RIDs */
-#define HFA384X_RID_MAXLOADTIME 0xFD00
-#define HFA384X_RID_DOWNLOADBUFFER 0xFD01
-#define HFA384X_RID_PRIID 0xFD02
-#define HFA384X_RID_PRISUPRANGE 0xFD03
-#define HFA384X_RID_CFIACTRANGES 0xFD04
-#define HFA384X_RID_NICSERNUM 0xFD0A
-#define HFA384X_RID_NICID 0xFD0B
-#define HFA384X_RID_MFISUPRANGE 0xFD0C
-#define HFA384X_RID_CFISUPRANGE 0xFD0D
-#define HFA384X_RID_CHANNELLIST 0xFD10
-#define HFA384X_RID_REGULATORYDOMAINS 0xFD11
-#define HFA384X_RID_TEMPTYPE 0xFD12
-#define HFA384X_RID_CIS 0xFD13
-#define HFA384X_RID_STAID 0xFD20
-#define HFA384X_RID_STASUPRANGE 0xFD21
-#define HFA384X_RID_MFIACTRANGES 0xFD22
-#define HFA384X_RID_CFIACTRANGES2 0xFD23
-#define HFA384X_RID_PRODUCTNAME 0xFD24 /* added in STA f/w 1.3.1;
-					* only Prism2.5(?) */
-#define HFA384X_RID_PORTSTATUS 0xFD40
-#define HFA384X_RID_CURRENTSSID 0xFD41
-#define HFA384X_RID_CURRENTBSSID 0xFD42
-#define HFA384X_RID_COMMSQUALITY 0xFD43
-#define HFA384X_RID_CURRENTTXRATE 0xFD44
-#define HFA384X_RID_CURRENTBEACONINTERVAL 0xFD45
-#define HFA384X_RID_CURRENTSCALETHRESHOLDS 0xFD46
-#define HFA384X_RID_PROTOCOLRSPTIME 0xFD47
-#define HFA384X_RID_SHORTRETRYLIMIT 0xFD48
-#define HFA384X_RID_LONGRETRYLIMIT 0xFD49
-#define HFA384X_RID_MAXTRANSMITLIFETIME 0xFD4A
-#define HFA384X_RID_MAXRECEIVELIFETIME 0xFD4B
-#define HFA384X_RID_CFPOLLABLE 0xFD4C
-#define HFA384X_RID_AUTHENTICATIONALGORITHMS 0xFD4D
-#define HFA384X_RID_PRIVACYOPTIONIMPLEMENTED 0xFD4F
-#define HFA384X_RID_DBMCOMMSQUALITY 0xFD51 /* added in STA f/w 1.3.1 */
-#define HFA384X_RID_CURRENTTXRATE1 0xFD80 /* AP f/w only */
-#define HFA384X_RID_CURRENTTXRATE2 0xFD81 /* AP f/w only */
-#define HFA384X_RID_CURRENTTXRATE3 0xFD82 /* AP f/w only */
-#define HFA384X_RID_CURRENTTXRATE4 0xFD83 /* AP f/w only */
-#define HFA384X_RID_CURRENTTXRATE5 0xFD84 /* AP f/w only */
-#define HFA384X_RID_CURRENTTXRATE6 0xFD85 /* AP f/w only */
-#define HFA384X_RID_OWNMACADDR 0xFD86 /* AP f/w only */
-#define HFA384X_RID_SCANRESULTSTABLE 0xFD88 /* added in STA f/w 0.8.3 */
-#define HFA384X_RID_HOSTSCANRESULTS 0xFD89 /* added in STA f/w 1.3.1 */
-#define HFA384X_RID_AUTHENTICATIONUSED 0xFD8A /* added in STA f/w 1.3.4 */
-#define HFA384X_RID_CNFFAASWITCHCTRL 0xFD8B /* added in STA f/w 1.6.3 */
-#define HFA384X_RID_ASSOCIATIONFAILURE 0xFD8D /* added in STA f/w 1.8.0 */
-#define HFA384X_RID_PHYTYPE 0xFDC0
-#define HFA384X_RID_CURRENTCHANNEL 0xFDC1
-#define HFA384X_RID_CURRENTPOWERSTATE 0xFDC2
-#define HFA384X_RID_CCAMODE 0xFDC3
-#define HFA384X_RID_SUPPORTEDDATARATES 0xFDC6
-#define HFA384X_RID_LFO_VOLT_REG_TEST_RES 0xFDC7 /* added in STA f/w 1.7.1 */
-#define HFA384X_RID_BUILDSEQ 0xFFFE
-#define HFA384X_RID_FWID 0xFFFF
-
-
-struct hfa384x_comp_ident
-{
-	u16 id;
-	u16 variant;
-	u16 major;
-	u16 minor;
-} __attribute__ ((packed));
-
-#define HFA384X_COMP_ID_PRI 0x15
-#define HFA384X_COMP_ID_STA 0x1f
-#define HFA384X_COMP_ID_FW_AP 0x14b
-
-struct hfa384x_sup_range
-{
-	u16 role;
-	u16 id;
-	u16 variant;
-	u16 bottom;
-	u16 top;
-} __attribute__ ((packed));
-
-
-struct hfa384x_build_id
-{
-	u16 pri_seq;
-	u16 sec_seq;
-} __attribute__ ((packed));
-
-/* FD01 - Download Buffer */
-struct hfa384x_rid_download_buffer
-{
-	u16 page;
-	u16 offset;
-	u16 length;
-} __attribute__ ((packed));
-
-/* BSS connection quality (RID FD43 range, RID FD51 dBm-normalized) */
-struct hfa384x_comms_quality {
-	u16 comm_qual; /* 0 .. 92 */
-	u16 signal_level; /* 27 .. 154 */
-	u16 noise_level; /* 27 .. 154 */
-} __attribute__ ((packed));
-
-
-/* netdevice private ioctls (used, e.g., with iwpriv from user space) */
-
-/* New wireless extensions API - SET/GET convention (even ioctl numbers are
- * root only)
- */
-#define PRISM2_IOCTL_PRISM2_PARAM (SIOCIWFIRSTPRIV + 0)
-#define PRISM2_IOCTL_GET_PRISM2_PARAM (SIOCIWFIRSTPRIV + 1)
-#define PRISM2_IOCTL_WRITEMIF (SIOCIWFIRSTPRIV + 2)
-#define PRISM2_IOCTL_READMIF (SIOCIWFIRSTPRIV + 3)
-#define PRISM2_IOCTL_MONITOR (SIOCIWFIRSTPRIV + 4)
-#define PRISM2_IOCTL_RESET (SIOCIWFIRSTPRIV + 6)
-#define PRISM2_IOCTL_INQUIRE (SIOCIWFIRSTPRIV + 8)
-#define PRISM2_IOCTL_WDS_ADD (SIOCIWFIRSTPRIV + 10)
-#define PRISM2_IOCTL_WDS_DEL (SIOCIWFIRSTPRIV + 12)
-#define PRISM2_IOCTL_SET_RID_WORD (SIOCIWFIRSTPRIV + 14)
-#define PRISM2_IOCTL_MACCMD (SIOCIWFIRSTPRIV + 16)
-#define PRISM2_IOCTL_ADDMAC (SIOCIWFIRSTPRIV + 18)
-#define PRISM2_IOCTL_DELMAC (SIOCIWFIRSTPRIV + 20)
-#define PRISM2_IOCTL_KICKMAC (SIOCIWFIRSTPRIV + 22)
-
-/* following are not in SIOCGIWPRIV list; check permission in the driver code
- */
-#define PRISM2_IOCTL_DOWNLOAD (SIOCDEVPRIVATE + 13)
-#define PRISM2_IOCTL_HOSTAPD (SIOCDEVPRIVATE + 14)
-
-
-/* PRISM2_IOCTL_PRISM2_PARAM ioctl() subtypes: */
-enum {
-	/* PRISM2_PARAM_PTYPE = 1, */ /* REMOVED 2003-10-22 */
-	PRISM2_PARAM_TXRATECTRL = 2,
-	PRISM2_PARAM_BEACON_INT = 3,
-	PRISM2_PARAM_PSEUDO_IBSS = 4,
-	PRISM2_PARAM_ALC = 5,
-	/* PRISM2_PARAM_TXPOWER = 6, */ /* REMOVED 2003-10-22 */
-	PRISM2_PARAM_DUMP = 7,
-	PRISM2_PARAM_OTHER_AP_POLICY = 8,
-	PRISM2_PARAM_AP_MAX_INACTIVITY = 9,
-	PRISM2_PARAM_AP_BRIDGE_PACKETS = 10,
-	PRISM2_PARAM_DTIM_PERIOD = 11,
-	PRISM2_PARAM_AP_NULLFUNC_ACK = 12,
-	PRISM2_PARAM_MAX_WDS = 13,
-	PRISM2_PARAM_AP_AUTOM_AP_WDS = 14,
-	PRISM2_PARAM_AP_AUTH_ALGS = 15,
-	PRISM2_PARAM_MONITOR_ALLOW_FCSERR = 16,
-	PRISM2_PARAM_HOST_ENCRYPT = 17,
-	PRISM2_PARAM_HOST_DECRYPT = 18,
-	/* PRISM2_PARAM_BUS_MASTER_THRESHOLD_RX = 19, REMOVED 2005-08-14 */
-	/* PRISM2_PARAM_BUS_MASTER_THRESHOLD_TX = 20, REMOVED 2005-08-14 */
-	PRISM2_PARAM_HOST_ROAMING = 21,
-	PRISM2_PARAM_BCRX_STA_KEY = 22,
-	PRISM2_PARAM_IEEE_802_1X = 23,
-	PRISM2_PARAM_ANTSEL_TX = 24,
-	PRISM2_PARAM_ANTSEL_RX = 25,
-	PRISM2_PARAM_MONITOR_TYPE = 26,
-	PRISM2_PARAM_WDS_TYPE = 27,
-	PRISM2_PARAM_HOSTSCAN = 28,
-	PRISM2_PARAM_AP_SCAN = 29,
-	PRISM2_PARAM_ENH_SEC = 30,
-	PRISM2_PARAM_IO_DEBUG = 31,
-	PRISM2_PARAM_BASIC_RATES = 32,
-	PRISM2_PARAM_OPER_RATES = 33,
-	PRISM2_PARAM_HOSTAPD = 34,
-	PRISM2_PARAM_HOSTAPD_STA = 35,
-	PRISM2_PARAM_WPA = 36,
-	PRISM2_PARAM_PRIVACY_INVOKED = 37,
-	PRISM2_PARAM_TKIP_COUNTERMEASURES = 38,
-	PRISM2_PARAM_DROP_UNENCRYPTED = 39,
-	PRISM2_PARAM_SCAN_CHANNEL_MASK = 40,
-};
-
-enum { HOSTAP_ANTSEL_DO_NOT_TOUCH = 0, HOSTAP_ANTSEL_DIVERSITY = 1,
-       HOSTAP_ANTSEL_LOW = 2, HOSTAP_ANTSEL_HIGH = 3 };
-
-
-/* PRISM2_IOCTL_MACCMD ioctl() subcommands: */
-enum { AP_MAC_CMD_POLICY_OPEN = 0, AP_MAC_CMD_POLICY_ALLOW = 1,
-       AP_MAC_CMD_POLICY_DENY = 2, AP_MAC_CMD_FLUSH = 3,
-       AP_MAC_CMD_KICKALL = 4 };
-
-
-/* PRISM2_IOCTL_DOWNLOAD ioctl() dl_cmd: */
-enum {
-	PRISM2_DOWNLOAD_VOLATILE = 1 /* RAM */,
-	/* Note! Old versions of prism2_srec have a fatal error in CRC-16
-	 * calculation, which will corrupt all non-volatile downloads.
-	 * PRISM2_DOWNLOAD_NON_VOLATILE used to be 2, but it is now 3 to
-	 * prevent use of old versions of prism2_srec for non-volatile
-	 * download. */
-	PRISM2_DOWNLOAD_NON_VOLATILE = 3 /* FLASH */,
-	PRISM2_DOWNLOAD_VOLATILE_GENESIS = 4 /* RAM in Genesis mode */,
-	/* Persistent versions of volatile download commands (keep firmware
-	 * data in memory and automatically re-download after hw_reset */
-	PRISM2_DOWNLOAD_VOLATILE_PERSISTENT = 5,
-	PRISM2_DOWNLOAD_VOLATILE_GENESIS_PERSISTENT = 6,
-};
-
-struct prism2_download_param {
-	u32 dl_cmd;
-	u32 start_addr;
-	u32 num_areas;
-	struct prism2_download_area {
-		u32 addr; /* wlan card address */
-		u32 len;
-		void __user *ptr; /* pointer to data in user space */
-	} data[0];
-};
-
-#define PRISM2_MAX_DOWNLOAD_AREA_LEN 131072
-#define PRISM2_MAX_DOWNLOAD_LEN 262144
-
-
-/* PRISM2_IOCTL_HOSTAPD ioctl() cmd: */
-enum {
-	PRISM2_HOSTAPD_FLUSH = 1,
-	PRISM2_HOSTAPD_ADD_STA = 2,
-	PRISM2_HOSTAPD_REMOVE_STA = 3,
-	PRISM2_HOSTAPD_GET_INFO_STA = 4,
-	/* REMOVED: PRISM2_HOSTAPD_RESET_TXEXC_STA = 5, */
-	PRISM2_SET_ENCRYPTION = 6,
-	PRISM2_GET_ENCRYPTION = 7,
-	PRISM2_HOSTAPD_SET_FLAGS_STA = 8,
-	PRISM2_HOSTAPD_GET_RID = 9,
-	PRISM2_HOSTAPD_SET_RID = 10,
-	PRISM2_HOSTAPD_SET_ASSOC_AP_ADDR = 11,
-	PRISM2_HOSTAPD_SET_GENERIC_ELEMENT = 12,
-	PRISM2_HOSTAPD_MLME = 13,
-	PRISM2_HOSTAPD_SCAN_REQ = 14,
-	PRISM2_HOSTAPD_STA_CLEAR_STATS = 15,
-};
-
-#define PRISM2_HOSTAPD_MAX_BUF_SIZE 1024
-#define PRISM2_HOSTAPD_RID_HDR_LEN \
-((int) (&((struct prism2_hostapd_param *) 0)->u.rid.data))
-#define PRISM2_HOSTAPD_GENERIC_ELEMENT_HDR_LEN \
-((int) (&((struct prism2_hostapd_param *) 0)->u.generic_elem.data))
-
-/* Maximum length for algorithm names (-1 for nul termination) used in ioctl()
- */
-#define HOSTAP_CRYPT_ALG_NAME_LEN 16
-
-
-struct prism2_hostapd_param {
-	u32 cmd;
-	u8 sta_addr[ETH_ALEN];
-	union {
-		struct {
-			u16 aid;
-			u16 capability;
-			u8 tx_supp_rates;
-		} add_sta;
-		struct {
-			u32 inactive_sec;
-		} get_info_sta;
-		struct {
-			u8 alg[HOSTAP_CRYPT_ALG_NAME_LEN];
-			u32 flags;
-			u32 err;
-			u8 idx;
-			u8 seq[8]; /* sequence counter (set: RX, get: TX) */
-			u16 key_len;
-			u8 key[0];
-		} crypt;
-		struct {
-			u32 flags_and;
-			u32 flags_or;
-		} set_flags_sta;
-		struct {
-			u16 rid;
-			u16 len;
-			u8 data[0];
-		} rid;
-		struct {
-			u8 len;
-			u8 data[0];
-		} generic_elem;
-		struct {
-#define MLME_STA_DEAUTH 0
-#define MLME_STA_DISASSOC 1
-			u16 cmd;
-			u16 reason_code;
-		} mlme;
-		struct {
-			u8 ssid_len;
-			u8 ssid[32];
-		} scan_req;
-	} u;
-};
-
-#define HOSTAP_CRYPT_FLAG_SET_TX_KEY BIT(0)
-#define HOSTAP_CRYPT_FLAG_PERMANENT BIT(1)
-
-#define HOSTAP_CRYPT_ERR_UNKNOWN_ALG 2
-#define HOSTAP_CRYPT_ERR_UNKNOWN_ADDR 3
-#define HOSTAP_CRYPT_ERR_CRYPT_INIT_FAILED 4
-#define HOSTAP_CRYPT_ERR_KEY_SET_FAILED 5
-#define HOSTAP_CRYPT_ERR_TX_KEY_SET_FAILED 6
-#define HOSTAP_CRYPT_ERR_CARD_CONF_FAILED 7
-
-
-#endif /* HOSTAP_COMMON_H */
diff --git a/trunk/drivers/net/wireless/hostap/hostap_config.h b/trunk/drivers/net/wireless/hostap/hostap_config.h
deleted file mode 100644
index 7ed3425d08c1..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_config.h
+++ /dev/null
@@ -1,55 +0,0 @@
-#ifndef HOSTAP_CONFIG_H
-#define HOSTAP_CONFIG_H
-
-#define PRISM2_VERSION "0.4.4-kernel"
-
-/* In the previous versions of Host AP driver, support for user space version
- * of IEEE 802.11 management (hostapd) used to be disabled in the default
- * configuration. From now on, support for hostapd is always included and it is
- * possible to disable kernel driver version of IEEE 802.11 management with a
- * separate define, PRISM2_NO_KERNEL_IEEE80211_MGMT. */
-/* #define PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-/* Maximum number of events handler per one interrupt */
-#define PRISM2_MAX_INTERRUPT_EVENTS 20
-
-/* Include code for downloading firmware images into volatile RAM. */
-#define PRISM2_DOWNLOAD_SUPPORT
-
-/* Allow kernel configuration to enable download support. */
-#if !defined(PRISM2_DOWNLOAD_SUPPORT) && defined(CONFIG_HOSTAP_FIRMWARE)
-#define PRISM2_DOWNLOAD_SUPPORT
-#endif
-
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-/* Allow writing firmware images into flash, i.e., to non-volatile storage.
- * Before you enable this option, you should make absolutely sure that you are
- * using prism2_srec utility that comes with THIS version of the driver!
- * In addition, please note that it is possible to kill your card with
- * non-volatile download if you are using incorrect image. This feature has not
- * been fully tested, so please be careful with it. */
-/* #define PRISM2_NON_VOLATILE_DOWNLOAD */
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-
-/* Save low-level I/O for debugging. This should not be enabled in normal use.
- */
-/* #define PRISM2_IO_DEBUG */
-
-/* Following defines can be used to remove unneeded parts of the driver, e.g.,
- * to limit the size of the kernel module. Definitions can be added here in
- * hostap_config.h or they can be added to make command with EXTRA_CFLAGS,
- * e.g.,
- * 'make pccard EXTRA_CFLAGS="-DPRISM2_NO_DEBUG -DPRISM2_NO_PROCFS_DEBUG"'
- */
-
-/* Do not include debug messages into the driver */
-/* #define PRISM2_NO_DEBUG */
-
-/* Do not include /proc/net/prism2/wlan#/{registers,debug} */
-/* #define PRISM2_NO_PROCFS_DEBUG */
-
-/* Do not include station functionality (i.e., allow only Master (Host AP) mode
- */
-/* #define PRISM2_NO_STATION_MODES */
-
-#endif /* HOSTAP_CONFIG_H */
diff --git a/trunk/drivers/net/wireless/hostap/hostap_cs.c b/trunk/drivers/net/wireless/hostap/hostap_cs.c
deleted file mode 100644
index faa83badf0a1..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_cs.c
+++ /dev/null
@@ -1,1030 +0,0 @@
-#define PRISM2_PCCARD
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/if.h>
-#include <linux/wait.h>
-#include <linux/timer.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/workqueue.h>
-#include <linux/wireless.h>
-#include <net/iw_handler.h>
-
-#include <pcmcia/cs_types.h>
-#include <pcmcia/cs.h>
-#include <pcmcia/cistpl.h>
-#include <pcmcia/cisreg.h>
-#include <pcmcia/ds.h>
-
-#include <asm/io.h>
-
-#include "hostap_wlan.h"
-
-
-static char *version = PRISM2_VERSION " (Jouni Malinen <jkmaline@cc.hut.fi>)";
-static dev_info_t dev_info = "hostap_cs";
-static dev_link_t *dev_list = NULL;
-
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Support for Intersil Prism2-based 802.11 wireless LAN "
-		   "cards (PC Card).");
-MODULE_SUPPORTED_DEVICE("Intersil Prism2-based WLAN cards (PC Card)");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(PRISM2_VERSION);
-
-
-static int ignore_cis_vcc;
-module_param(ignore_cis_vcc, int, 0444);
-MODULE_PARM_DESC(ignore_cis_vcc, "Ignore broken CIS VCC entry");
-
-
-/* struct local_info::hw_priv */
-struct hostap_cs_priv {
-	dev_node_t node;
-	dev_link_t *link;
-	int sandisk_connectplus;
-};
-
-
-#ifdef PRISM2_IO_DEBUG
-
-static inline void hfa384x_outb_debug(struct net_device *dev, int a, u8 v)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_OUTB, a, v);
-	outb(v, dev->base_addr + a);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-static inline u8 hfa384x_inb_debug(struct net_device *dev, int a)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-	u8 v;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	spin_lock_irqsave(&local->lock, flags);
-	v = inb(dev->base_addr + a);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INB, a, v);
-	spin_unlock_irqrestore(&local->lock, flags);
-	return v;
-}
-
-static inline void hfa384x_outw_debug(struct net_device *dev, int a, u16 v)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_OUTW, a, v);
-	outw(v, dev->base_addr + a);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-static inline u16 hfa384x_inw_debug(struct net_device *dev, int a)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-	u16 v;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	spin_lock_irqsave(&local->lock, flags);
-	v = inw(dev->base_addr + a);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INW, a, v);
-	spin_unlock_irqrestore(&local->lock, flags);
-	return v;
-}
-
-static inline void hfa384x_outsw_debug(struct net_device *dev, int a,
-				       u8 *buf, int wc)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_OUTSW, a, wc);
-	outsw(dev->base_addr + a, buf, wc);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-static inline void hfa384x_insw_debug(struct net_device *dev, int a,
-				      u8 *buf, int wc)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INSW, a, wc);
-	insw(dev->base_addr + a, buf, wc);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-#define HFA384X_OUTB(v,a) hfa384x_outb_debug(dev, (a), (v))
-#define HFA384X_INB(a) hfa384x_inb_debug(dev, (a))
-#define HFA384X_OUTW(v,a) hfa384x_outw_debug(dev, (a), (v))
-#define HFA384X_INW(a) hfa384x_inw_debug(dev, (a))
-#define HFA384X_OUTSW(a, buf, wc) hfa384x_outsw_debug(dev, (a), (buf), (wc))
-#define HFA384X_INSW(a, buf, wc) hfa384x_insw_debug(dev, (a), (buf), (wc))
-
-#else /* PRISM2_IO_DEBUG */
-
-#define HFA384X_OUTB(v,a) outb((v), dev->base_addr + (a))
-#define HFA384X_INB(a) inb(dev->base_addr + (a))
-#define HFA384X_OUTW(v,a) outw((v), dev->base_addr + (a))
-#define HFA384X_INW(a) inw(dev->base_addr + (a))
-#define HFA384X_INSW(a, buf, wc) insw(dev->base_addr + (a), buf, wc)
-#define HFA384X_OUTSW(a, buf, wc) outsw(dev->base_addr + (a), buf, wc)
-
-#endif /* PRISM2_IO_DEBUG */
-
-
-static int hfa384x_from_bap(struct net_device *dev, u16 bap, void *buf,
-			    int len)
-{
-	u16 d_off;
-	u16 *pos;
-
-	d_off = (bap == 1) ? HFA384X_DATA1_OFF : HFA384X_DATA0_OFF;
-	pos = (u16 *) buf;
-
-	if (len / 2)
-		HFA384X_INSW(d_off, buf, len / 2);
-	pos += len / 2;
-
-	if (len & 1)
-		*((char *) pos) = HFA384X_INB(d_off);
-
-	return 0;
-}
-
-
-static int hfa384x_to_bap(struct net_device *dev, u16 bap, void *buf, int len)
-{
-	u16 d_off;
-	u16 *pos;
-
-	d_off = (bap == 1) ? HFA384X_DATA1_OFF : HFA384X_DATA0_OFF;
-	pos = (u16 *) buf;
-
-	if (len / 2)
-		HFA384X_OUTSW(d_off, buf, len / 2);
-	pos += len / 2;
-
-	if (len & 1)
-		HFA384X_OUTB(*((char *) pos), d_off);
-
-	return 0;
-}
-
-
-/* FIX: This might change at some point.. */
-#include "hostap_hw.c"
-
-
-
-static void prism2_detach(dev_link_t *link);
-static void prism2_release(u_long arg);
-static int prism2_event(event_t event, int priority,
-			event_callback_args_t *args);
-
-
-static int prism2_pccard_card_present(local_info_t *local)
-{
-	struct hostap_cs_priv *hw_priv = local->hw_priv;
-	if (hw_priv != NULL && hw_priv->link != NULL &&
-	    ((hw_priv->link->state & (DEV_PRESENT | DEV_CONFIG)) ==
-	     (DEV_PRESENT | DEV_CONFIG)))
-		return 1;
-	return 0;
-}
-
-
-/*
- * SanDisk CompactFlash WLAN Flashcard - Product Manual v1.0
- * Document No. 20-10-00058, January 2004
- * http://www.sandisk.com/pdf/industrial/ProdManualCFWLANv1.0.pdf
- */
-#define SANDISK_WLAN_ACTIVATION_OFF 0x40
-#define SANDISK_HCR_OFF 0x42
-
-
-static void sandisk_set_iobase(local_info_t *local)
-{
-	int res;
-	conf_reg_t reg;
-	struct hostap_cs_priv *hw_priv = local->hw_priv;
-
-	reg.Function = 0;
-	reg.Action = CS_WRITE;
-	reg.Offset = 0x10; /* 0x3f0 IO base 1 */
-	reg.Value = hw_priv->link->io.BasePort1 & 0x00ff;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "Prism3 SanDisk - failed to set I/O base 0 -"
-		       " res=%d\n", res);
-	}
-	udelay(10);
-
-	reg.Function = 0;
-	reg.Action = CS_WRITE;
-	reg.Offset = 0x12; /* 0x3f2 IO base 2 */
-	reg.Value = (hw_priv->link->io.BasePort1 & 0xff00) >> 8;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "Prism3 SanDisk - failed to set I/O base 1 -"
-		       " res=%d\n", res);
-	}
-}
-
-
-static void sandisk_write_hcr(local_info_t *local, int hcr)
-{
-	struct net_device *dev = local->dev;
-	int i;
-
-	HFA384X_OUTB(0x80, SANDISK_WLAN_ACTIVATION_OFF);
-	udelay(50);
-	for (i = 0; i < 10; i++) {
-		HFA384X_OUTB(hcr, SANDISK_HCR_OFF);
-	}
-	udelay(55);
-	HFA384X_OUTB(0x45, SANDISK_WLAN_ACTIVATION_OFF);
-}
-
-
-static int sandisk_enable_wireless(struct net_device *dev)
-{
-	int res, ret = 0;
-	conf_reg_t reg;
-	struct hostap_interface *iface = dev->priv;
-	local_info_t *local = iface->local;
-	tuple_t tuple;
-	cisparse_t *parse = NULL;
-	u_char buf[64];
-	struct hostap_cs_priv *hw_priv = local->hw_priv;
-
-	if (hw_priv->link->io.NumPorts1 < 0x42) {
-		/* Not enough ports to be SanDisk multi-function card */
-		ret = -ENODEV;
-		goto done;
-	}
-
-	parse = kmalloc(sizeof(cisparse_t), GFP_KERNEL);
-	if (parse == NULL) {
-		ret = -ENOMEM;
-		goto done;
-	}
-
-	tuple.DesiredTuple = CISTPL_MANFID;
-	tuple.Attributes = TUPLE_RETURN_COMMON;
-	tuple.TupleData = buf;
-	tuple.TupleDataMax = sizeof(buf);
-	tuple.TupleOffset = 0;
-	if (pcmcia_get_first_tuple(hw_priv->link->handle, &tuple) ||
-	    pcmcia_get_tuple_data(hw_priv->link->handle, &tuple) ||
-	    pcmcia_parse_tuple(hw_priv->link->handle, &tuple, parse) ||
-	    parse->manfid.manf != 0xd601 || parse->manfid.card != 0x0101) {
-		/* No SanDisk manfid found */
-		ret = -ENODEV;
-		goto done;
-	}
-
-	tuple.DesiredTuple = CISTPL_LONGLINK_MFC;
-	if (pcmcia_get_first_tuple(hw_priv->link->handle, &tuple) ||
-	    pcmcia_get_tuple_data(hw_priv->link->handle, &tuple) ||
-	    pcmcia_parse_tuple(hw_priv->link->handle, &tuple, parse) ||
-		parse->longlink_mfc.nfn < 2) {
-		/* No multi-function links found */
-		ret = -ENODEV;
-		goto done;
-	}
-
-	printk(KERN_DEBUG "%s: Multi-function SanDisk ConnectPlus detected"
-	       " - using vendor-specific initialization\n", dev->name);
-	hw_priv->sandisk_connectplus = 1;
-
-	reg.Function = 0;
-	reg.Action = CS_WRITE;
-	reg.Offset = CISREG_COR;
-	reg.Value = COR_SOFT_RESET;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "%s: SanDisk - COR sreset failed (%d)\n",
-		       dev->name, res);
-		goto done;
-	}
-	mdelay(5);
-
-	reg.Function = 0;
-	reg.Action = CS_WRITE;
-	reg.Offset = CISREG_COR;
-	/*
-	 * Do not enable interrupts here to avoid some bogus events. Interrupts
-	 * will be enabled during the first cor_sreset call.
-	 */
-	reg.Value = COR_LEVEL_REQ | 0x8 | COR_ADDR_DECODE | COR_FUNC_ENA;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "%s: SanDisk - COR sreset failed (%d)\n",
-		       dev->name, res);
-		goto done;
-	}
-	mdelay(5);
-
-	sandisk_set_iobase(local);
-
-	HFA384X_OUTB(0xc5, SANDISK_WLAN_ACTIVATION_OFF);
-	udelay(10);
-	HFA384X_OUTB(0x4b, SANDISK_WLAN_ACTIVATION_OFF);
-	udelay(10);
-
-done:
-	kfree(parse);
-	return ret;
-}
-
-
-static void prism2_pccard_cor_sreset(local_info_t *local)
-{
-	int res;
-	conf_reg_t reg;
-	struct hostap_cs_priv *hw_priv = local->hw_priv;
-
-	if (!prism2_pccard_card_present(local))
-	       return;
-
-	reg.Function = 0;
-	reg.Action = CS_READ;
-	reg.Offset = CISREG_COR;
-	reg.Value = 0;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "prism2_pccard_cor_sreset failed 1 (%d)\n",
-		       res);
-		return;
-	}
-	printk(KERN_DEBUG "prism2_pccard_cor_sreset: original COR %02x\n",
-	       reg.Value);
-
-	reg.Action = CS_WRITE;
-	reg.Value |= COR_SOFT_RESET;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "prism2_pccard_cor_sreset failed 2 (%d)\n",
-		       res);
-		return;
-	}
-
-	mdelay(hw_priv->sandisk_connectplus ? 5 : 2);
-
-	reg.Value &= ~COR_SOFT_RESET;
-	if (hw_priv->sandisk_connectplus)
-		reg.Value |= COR_IREQ_ENA;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "prism2_pccard_cor_sreset failed 3 (%d)\n",
-		       res);
-		return;
-	}
-
-	mdelay(hw_priv->sandisk_connectplus ? 5 : 2);
-
-	if (hw_priv->sandisk_connectplus)
-		sandisk_set_iobase(local);
-}
-
-
-static void prism2_pccard_genesis_reset(local_info_t *local, int hcr)
-{
-	int res;
-	conf_reg_t reg;
-	int old_cor;
-	struct hostap_cs_priv *hw_priv = local->hw_priv;
-
-	if (!prism2_pccard_card_present(local))
-	       return;
-
-	if (hw_priv->sandisk_connectplus) {
-		sandisk_write_hcr(local, hcr);
-		return;
-	}
-
-	reg.Function = 0;
-	reg.Action = CS_READ;
-	reg.Offset = CISREG_COR;
-	reg.Value = 0;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "prism2_pccard_genesis_sreset failed 1 "
-		       "(%d)\n", res);
-		return;
-	}
-	printk(KERN_DEBUG "prism2_pccard_genesis_sreset: original COR %02x\n",
-	       reg.Value);
-	old_cor = reg.Value;
-
-	reg.Action = CS_WRITE;
-	reg.Value |= COR_SOFT_RESET;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "prism2_pccard_genesis_sreset failed 2 "
-		       "(%d)\n", res);
-		return;
-	}
-
-	mdelay(10);
-
-	/* Setup Genesis mode */
-	reg.Action = CS_WRITE;
-	reg.Value = hcr;
-	reg.Offset = CISREG_CCSR;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "prism2_pccard_genesis_sreset failed 3 "
-		       "(%d)\n", res);
-		return;
-	}
-	mdelay(10);
-
-	reg.Action = CS_WRITE;
-	reg.Offset = CISREG_COR;
-	reg.Value = old_cor & ~COR_SOFT_RESET;
-	res = pcmcia_access_configuration_register(hw_priv->link->handle,
-						   &reg);
-	if (res != CS_SUCCESS) {
-		printk(KERN_DEBUG "prism2_pccard_genesis_sreset failed 4 "
-		       "(%d)\n", res);
-		return;
-	}
-
-	mdelay(10);
-}
-
-
-static int prism2_pccard_dev_open(local_info_t *local)
-{
-	struct hostap_cs_priv *hw_priv = local->hw_priv;
-	hw_priv->link->open++;
-	return 0;
-}
-
-
-static int prism2_pccard_dev_close(local_info_t *local)
-{
-	struct hostap_cs_priv *hw_priv;
-
-	if (local == NULL || local->hw_priv == NULL)
-		return 1;
-	hw_priv = local->hw_priv;
-	if (hw_priv->link == NULL)
-		return 1;
-
-	if (!hw_priv->link->open) {
-		printk(KERN_WARNING "%s: prism2_pccard_dev_close(): "
-		       "link not open?!\n", local->dev->name);
-		return 1;
-	}
-
-	hw_priv->link->open--;
-
-	return 0;
-}
-
-
-static struct prism2_helper_functions prism2_pccard_funcs =
-{
-	.card_present	= prism2_pccard_card_present,
-	.cor_sreset	= prism2_pccard_cor_sreset,
-	.dev_open	= prism2_pccard_dev_open,
-	.dev_close	= prism2_pccard_dev_close,
-	.genesis_reset	= prism2_pccard_genesis_reset,
-	.hw_type	= HOSTAP_HW_PCCARD,
-};
-
-
-/* allocate local data and register with CardServices
- * initialize dev_link structure, but do not configure the card yet */
-static dev_link_t *prism2_attach(void)
-{
-	dev_link_t *link;
-	client_reg_t client_reg;
-	int ret;
-
-	link = kmalloc(sizeof(dev_link_t), GFP_KERNEL);
-	if (link == NULL)
-		return NULL;
-
-	memset(link, 0, sizeof(dev_link_t));
-
-	PDEBUG(DEBUG_HW, "%s: setting Vcc=33 (constant)\n", dev_info);
-	link->conf.Vcc = 33;
-	link->conf.IntType = INT_MEMORY_AND_IO;
-
-	/* register with CardServices */
-	link->next = dev_list;
-	dev_list = link;
-	client_reg.dev_info = &dev_info;
-	client_reg.Version = 0x0210;
-	client_reg.event_callback_args.client_data = link;
-	ret = pcmcia_register_client(&link->handle, &client_reg);
-	if (ret != CS_SUCCESS) {
-		cs_error(link->handle, RegisterClient, ret);
-		prism2_detach(link);
-		return NULL;
-	}
-	return link;
-}
-
-
-static void prism2_detach(dev_link_t *link)
-{
-	dev_link_t **linkp;
-
-	PDEBUG(DEBUG_FLOW, "prism2_detach\n");
-
-	for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
-		if (*linkp == link)
-			break;
-	if (*linkp == NULL) {
-		printk(KERN_WARNING "%s: Attempt to detach non-existing "
-		       "PCMCIA client\n", dev_info);
-		return;
-	}
-
-	if (link->state & DEV_CONFIG) {
-		prism2_release((u_long)link);
-	}
-
-	if (link->handle) {
-		int res = pcmcia_deregister_client(link->handle);
-		if (res) {
-			printk("CardService(DeregisterClient) => %d\n", res);
-			cs_error(link->handle, DeregisterClient, res);
-		}
-	}
-
-	*linkp = link->next;
-	/* release net devices */
-	if (link->priv) {
-		struct net_device *dev;
-		struct hostap_interface *iface;
-		dev = link->priv;
-		iface = netdev_priv(dev);
-		kfree(iface->local->hw_priv);
-		iface->local->hw_priv = NULL;
-		prism2_free_local_data(dev);
-	}
-	kfree(link);
-}
-
-
-#define CS_CHECK(fn, ret) \
-do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
-
-#define CFG_CHECK2(fn, retf) \
-do { int ret = (retf); \
-if (ret != 0) { \
-	PDEBUG(DEBUG_EXTRA, "CardServices(" #fn ") returned %d\n", ret); \
-	cs_error(link->handle, fn, ret); \
-	goto next_entry; \
-} \
-} while (0)
-
-
-/* run after a CARD_INSERTION event is received to configure the PCMCIA
- * socket and make the device available to the system */
-static int prism2_config(dev_link_t *link)
-{
-	struct net_device *dev;
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int ret = 1;
-	tuple_t tuple;
-	cisparse_t *parse;
-	int last_fn, last_ret;
-	u_char buf[64];
-	config_info_t conf;
-	cistpl_cftable_entry_t dflt = { 0 };
-	struct hostap_cs_priv *hw_priv;
-
-	PDEBUG(DEBUG_FLOW, "prism2_config()\n");
-
-	parse = kmalloc(sizeof(cisparse_t), GFP_KERNEL);
-	hw_priv = kmalloc(sizeof(*hw_priv), GFP_KERNEL);
-	if (parse == NULL || hw_priv == NULL) {
-		kfree(parse);
-		kfree(hw_priv);
-		ret = -ENOMEM;
-		goto failed;
-	}
-	memset(hw_priv, 0, sizeof(*hw_priv));
-
-	tuple.DesiredTuple = CISTPL_CONFIG;
-	tuple.Attributes = 0;
-	tuple.TupleData = buf;
-	tuple.TupleDataMax = sizeof(buf);
-	tuple.TupleOffset = 0;
-	CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link->handle, &tuple));
-	CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link->handle, &tuple));
-	CS_CHECK(ParseTuple, pcmcia_parse_tuple(link->handle, &tuple, parse));
-	link->conf.ConfigBase = parse->config.base;
-	link->conf.Present = parse->config.rmask[0];
-
-	CS_CHECK(GetConfigurationInfo,
-		 pcmcia_get_configuration_info(link->handle, &conf));
-	PDEBUG(DEBUG_HW, "%s: %s Vcc=%d (from config)\n", dev_info,
-	       ignore_cis_vcc ? "ignoring" : "setting", conf.Vcc);
-	link->conf.Vcc = conf.Vcc;
-
-	/* Look for an appropriate configuration table entry in the CIS */
-	tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-	CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link->handle, &tuple));
-	for (;;) {
-		cistpl_cftable_entry_t *cfg = &(parse->cftable_entry);
-		CFG_CHECK2(GetTupleData,
-			   pcmcia_get_tuple_data(link->handle, &tuple));
-		CFG_CHECK2(ParseTuple,
-			   pcmcia_parse_tuple(link->handle, &tuple, parse));
-
-		if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
-			dflt = *cfg;
-		if (cfg->index == 0)
-			goto next_entry;
-		link->conf.ConfigIndex = cfg->index;
-		PDEBUG(DEBUG_EXTRA, "Checking CFTABLE_ENTRY 0x%02X "
-		       "(default 0x%02X)\n", cfg->index, dflt.index);
-
-		/* Does this card need audio output? */
-		if (cfg->flags & CISTPL_CFTABLE_AUDIO) {
-			link->conf.Attributes |= CONF_ENABLE_SPKR;
-			link->conf.Status = CCSR_AUDIO_ENA;
-		}
-
-		/* Use power settings for Vcc and Vpp if present */
-		/*  Note that the CIS values need to be rescaled */
-		if (cfg->vcc.present & (1 << CISTPL_POWER_VNOM)) {
-			if (conf.Vcc != cfg->vcc.param[CISTPL_POWER_VNOM] /
-			    10000 && !ignore_cis_vcc) {
-				PDEBUG(DEBUG_EXTRA, "  Vcc mismatch - skipping"
-				       " this entry\n");
-				goto next_entry;
-			}
-		} else if (dflt.vcc.present & (1 << CISTPL_POWER_VNOM)) {
-			if (conf.Vcc != dflt.vcc.param[CISTPL_POWER_VNOM] /
-			    10000 && !ignore_cis_vcc) {
-				PDEBUG(DEBUG_EXTRA, "  Vcc (default) mismatch "
-				       "- skipping this entry\n");
-				goto next_entry;
-			}
-		}
-
-		if (cfg->vpp1.present & (1 << CISTPL_POWER_VNOM))
-			link->conf.Vpp1 = link->conf.Vpp2 =
-				cfg->vpp1.param[CISTPL_POWER_VNOM] / 10000;
-		else if (dflt.vpp1.present & (1 << CISTPL_POWER_VNOM))
-			link->conf.Vpp1 = link->conf.Vpp2 =
-				dflt.vpp1.param[CISTPL_POWER_VNOM] / 10000;
-
-		/* Do we need to allocate an interrupt? */
-		if (cfg->irq.IRQInfo1 || dflt.irq.IRQInfo1)
-			link->conf.Attributes |= CONF_ENABLE_IRQ;
-		else if (!(link->conf.Attributes & CONF_ENABLE_IRQ)) {
-			/* At least Compaq WL200 does not have IRQInfo1 set,
-			 * but it does not work without interrupts.. */
-			printk("Config has no IRQ info, but trying to enable "
-			       "IRQ anyway..\n");
-			link->conf.Attributes |= CONF_ENABLE_IRQ;
-		}
-
-		/* IO window settings */
-		PDEBUG(DEBUG_EXTRA, "IO window settings: cfg->io.nwin=%d "
-		       "dflt.io.nwin=%d\n",
-		       cfg->io.nwin, dflt.io.nwin);
-		link->io.NumPorts1 = link->io.NumPorts2 = 0;
-		if ((cfg->io.nwin > 0) || (dflt.io.nwin > 0)) {
-			cistpl_io_t *io = (cfg->io.nwin) ? &cfg->io : &dflt.io;
-			link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
-			PDEBUG(DEBUG_EXTRA, "io->flags = 0x%04X, "
-			       "io.base=0x%04x, len=%d\n", io->flags,
-			       io->win[0].base, io->win[0].len);
-			if (!(io->flags & CISTPL_IO_8BIT))
-				link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
-			if (!(io->flags & CISTPL_IO_16BIT))
-				link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
-			link->io.IOAddrLines = io->flags &
-				CISTPL_IO_LINES_MASK;
-			link->io.BasePort1 = io->win[0].base;
-			link->io.NumPorts1 = io->win[0].len;
-			if (io->nwin > 1) {
-				link->io.Attributes2 = link->io.Attributes1;
-				link->io.BasePort2 = io->win[1].base;
-				link->io.NumPorts2 = io->win[1].len;
-			}
-		}
-
-		/* This reserves IO space but doesn't actually enable it */
-		CFG_CHECK2(RequestIO,
-			   pcmcia_request_io(link->handle, &link->io));
-
-		/* This configuration table entry is OK */
-		break;
-
-	next_entry:
-		CS_CHECK(GetNextTuple,
-			 pcmcia_get_next_tuple(link->handle, &tuple));
-	}
-
-	/* Need to allocate net_device before requesting IRQ handler */
-	dev = prism2_init_local_data(&prism2_pccard_funcs, 0,
-				     &handle_to_dev(link->handle));
-	if (dev == NULL)
-		goto failed;
-	link->priv = dev;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	local->hw_priv = hw_priv;
-	hw_priv->link = link;
-	strcpy(hw_priv->node.dev_name, dev->name);
-	link->dev = &hw_priv->node;
-
-	/*
-	 * Allocate an interrupt line.  Note that this does not assign a
-	 * handler to the interrupt, unless the 'Handler' member of the
-	 * irq structure is initialized.
-	 */
-	if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-		link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
-		link->irq.IRQInfo1 = IRQ_LEVEL_ID;
-		link->irq.Handler = prism2_interrupt;
-		link->irq.Instance = dev;
-		CS_CHECK(RequestIRQ,
-			 pcmcia_request_irq(link->handle, &link->irq));
-	}
-
-	/*
-	 * This actually configures the PCMCIA socket -- setting up
-	 * the I/O windows and the interrupt mapping, and putting the
-	 * card and host interface into "Memory and IO" mode.
-	 */
-	CS_CHECK(RequestConfiguration,
-		 pcmcia_request_configuration(link->handle, &link->conf));
-
-	dev->irq = link->irq.AssignedIRQ;
-	dev->base_addr = link->io.BasePort1;
-
-	/* Finally, report what we've done */
-	printk(KERN_INFO "%s: index 0x%02x: Vcc %d.%d",
-	       dev_info, link->conf.ConfigIndex,
-	       link->conf.Vcc / 10, link->conf.Vcc % 10);
-	if (link->conf.Vpp1)
-		printk(", Vpp %d.%d", link->conf.Vpp1 / 10,
-		       link->conf.Vpp1 % 10);
-	if (link->conf.Attributes & CONF_ENABLE_IRQ)
-		printk(", irq %d", link->irq.AssignedIRQ);
-	if (link->io.NumPorts1)
-		printk(", io 0x%04x-0x%04x", link->io.BasePort1,
-		       link->io.BasePort1+link->io.NumPorts1-1);
-	if (link->io.NumPorts2)
-		printk(" & 0x%04x-0x%04x", link->io.BasePort2,
-		       link->io.BasePort2+link->io.NumPorts2-1);
-	printk("\n");
-
-	link->state |= DEV_CONFIG;
-	link->state &= ~DEV_CONFIG_PENDING;
-
-	local->shutdown = 0;
-
-	sandisk_enable_wireless(dev);
-
-	ret = prism2_hw_config(dev, 1);
-	if (!ret) {
-		ret = hostap_hw_ready(dev);
-		if (ret == 0 && local->ddev)
-			strcpy(hw_priv->node.dev_name, local->ddev->name);
-	}
-	kfree(parse);
-	return ret;
-
- cs_failed:
-	cs_error(link->handle, last_fn, last_ret);
-
- failed:
-	kfree(parse);
-	kfree(hw_priv);
-	prism2_release((u_long)link);
-	return ret;
-}
-
-
-static void prism2_release(u_long arg)
-{
-	dev_link_t *link = (dev_link_t *)arg;
-
-	PDEBUG(DEBUG_FLOW, "prism2_release\n");
-
-	if (link->priv) {
-		struct net_device *dev = link->priv;
-		struct hostap_interface *iface;
-
-		iface = netdev_priv(dev);
-		if (link->state & DEV_CONFIG)
-			prism2_hw_shutdown(dev, 0);
-		iface->local->shutdown = 1;
-	}
-
-	if (link->win)
-		pcmcia_release_window(link->win);
-	pcmcia_release_configuration(link->handle);
-	if (link->io.NumPorts1)
-		pcmcia_release_io(link->handle, &link->io);
-	if (link->irq.AssignedIRQ)
-		pcmcia_release_irq(link->handle, &link->irq);
-
-	link->state &= ~DEV_CONFIG;
-
-	PDEBUG(DEBUG_FLOW, "release - done\n");
-}
-
-
-static int prism2_event(event_t event, int priority,
-			event_callback_args_t *args)
-{
-	dev_link_t *link = args->client_data;
-	struct net_device *dev = (struct net_device *) link->priv;
-
-	switch (event) {
-	case CS_EVENT_CARD_INSERTION:
-		PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_CARD_INSERTION\n", dev_info);
-		link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-		if (prism2_config(link)) {
-			PDEBUG(DEBUG_EXTRA, "prism2_config() failed\n");
-		}
-		break;
-
-	case CS_EVENT_CARD_REMOVAL:
-		PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_CARD_REMOVAL\n", dev_info);
-		link->state &= ~DEV_PRESENT;
-		if (link->state & DEV_CONFIG) {
-			netif_stop_queue(dev);
-			netif_device_detach(dev);
-			prism2_release((u_long) link);
-		}
-		break;
-
-	case CS_EVENT_PM_SUSPEND:
-		PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_PM_SUSPEND\n", dev_info);
-		link->state |= DEV_SUSPEND;
-		/* fall through */
-
-	case CS_EVENT_RESET_PHYSICAL:
-		PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_RESET_PHYSICAL\n", dev_info);
-		if (link->state & DEV_CONFIG) {
-			if (link->open) {
-				netif_stop_queue(dev);
-				netif_device_detach(dev);
-			}
-			prism2_suspend(dev);
-			pcmcia_release_configuration(link->handle);
-		}
-		break;
-
-	case CS_EVENT_PM_RESUME:
-		PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_PM_RESUME\n", dev_info);
-		link->state &= ~DEV_SUSPEND;
-		/* fall through */
-
-	case CS_EVENT_CARD_RESET:
-		PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_CARD_RESET\n", dev_info);
-		if (link->state & DEV_CONFIG) {
-			pcmcia_request_configuration(link->handle,
-						     &link->conf);
-			prism2_hw_shutdown(dev, 1);
-			prism2_hw_config(dev, link->open ? 0 : 1);
-			if (link->open) {
-				netif_device_attach(dev);
-				netif_start_queue(dev);
-			}
-		}
-		break;
-
-	default:
-		PDEBUG(DEBUG_EXTRA, "%s: prism2_event() - unknown event %d\n",
-		       dev_info, event);
-		break;
-	}
-	return 0;
-}
-
-
-static struct pcmcia_device_id hostap_cs_ids[] = {
-	PCMCIA_DEVICE_MANF_CARD(0x000b, 0x7100),
-	PCMCIA_DEVICE_MANF_CARD(0x000b, 0x7300),
-	PCMCIA_DEVICE_MANF_CARD(0x0101, 0x0777),
-	PCMCIA_DEVICE_MANF_CARD(0x0126, 0x8000),
-	PCMCIA_DEVICE_MANF_CARD(0x0138, 0x0002),
-	PCMCIA_DEVICE_MANF_CARD(0x0156, 0x0002),
-	PCMCIA_DEVICE_MANF_CARD(0x0250, 0x0002),
-	PCMCIA_DEVICE_MANF_CARD(0x026f, 0x030b),
-	PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1612),
-	PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1613),
-	PCMCIA_DEVICE_MANF_CARD(0x028a, 0x0002),
-	PCMCIA_DEVICE_MANF_CARD(0x02aa, 0x0002),
-	PCMCIA_DEVICE_MANF_CARD(0x02d2, 0x0001),
-	PCMCIA_DEVICE_MANF_CARD(0x50c2, 0x0001),
-	PCMCIA_DEVICE_MANF_CARD(0x50c2, 0x7300),
-	PCMCIA_DEVICE_MANF_CARD(0xc00f, 0x0000),
-	PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0002),
-	PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0005),
-	PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0010),
-	PCMCIA_MFC_DEVICE_PROD_ID12(0, "SanDisk", "ConnectPlus",
-				    0x7a954bd9, 0x74be00c6),
-	PCMCIA_DEVICE_PROD_ID1234(
-		"Intersil", "PRISM 2_5 PCMCIA ADAPTER",	"ISL37300P",
-		"Eval-RevA",
-		0x4b801a17, 0x6345a0bf, 0xc9049a39, 0xc23adc0e),
-	PCMCIA_DEVICE_PROD_ID123(
-		"Addtron", "AWP-100 Wireless PCMCIA", "Version 01.02",
-		0xe6ec52ce, 0x08649af2, 0x4b74baa0),
-	PCMCIA_DEVICE_PROD_ID123(
-		"D", "Link DWL-650 11Mbps WLAN Card", "Version 01.02",
-		0x71b18589, 0xb6f1b0ab, 0x4b74baa0),
-	PCMCIA_DEVICE_PROD_ID123(
-		"Instant Wireless ", " Network PC CARD", "Version 01.02",
-		0x11d901af, 0x6e9bd926, 0x4b74baa0),
-	PCMCIA_DEVICE_PROD_ID123(
-		"SMC", "SMC2632W", "Version 01.02",
-		0xc4f8b18b, 0x474a1f2a, 0x4b74baa0),
-	PCMCIA_DEVICE_PROD_ID12("BUFFALO", "WLI-CF-S11G", 
-				0x2decece3, 0x82067c18),
-	PCMCIA_DEVICE_PROD_ID12("Compaq", "WL200_11Mbps_Wireless_PCI_Card",
-				0x54f7c49c, 0x15a75e5b),
-	PCMCIA_DEVICE_PROD_ID12("INTERSIL", "HFA384x/IEEE",
-				0x74c5e40d, 0xdb472a18),
-	PCMCIA_DEVICE_PROD_ID12("Linksys", "Wireless CompactFlash Card",
-				0x0733cc81, 0x0c52f395),
-	PCMCIA_DEVICE_PROD_ID12(
-		"ZoomAir 11Mbps High", "Rate wireless Networking",
-		0x273fe3db, 0x32a1eaee),
-	PCMCIA_DEVICE_NULL
-};
-MODULE_DEVICE_TABLE(pcmcia, hostap_cs_ids);
-
-
-static struct pcmcia_driver hostap_driver = {
-	.drv		= {
-		.name	= "hostap_cs",
-	},
-	.attach		= prism2_attach,
-	.detach		= prism2_detach,
-	.owner		= THIS_MODULE,
-	.event		= prism2_event,
-	.id_table	= hostap_cs_ids,
-};
-
-static int __init init_prism2_pccard(void)
-{
-	printk(KERN_INFO "%s: %s\n", dev_info, version);
-	return pcmcia_register_driver(&hostap_driver);
-}
-
-static void __exit exit_prism2_pccard(void)
-{
-	pcmcia_unregister_driver(&hostap_driver);
-	printk(KERN_INFO "%s: Driver unloaded\n", dev_info);
-}
-
-
-module_init(init_prism2_pccard);
-module_exit(exit_prism2_pccard);
diff --git a/trunk/drivers/net/wireless/hostap/hostap_download.c b/trunk/drivers/net/wireless/hostap/hostap_download.c
deleted file mode 100644
index ab26b52b3e76..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_download.c
+++ /dev/null
@@ -1,766 +0,0 @@
-static int prism2_enable_aux_port(struct net_device *dev, int enable)
-{
-	u16 val, reg;
-	int i, tries;
-	unsigned long flags;
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->no_pri) {
-		if (enable) {
-			PDEBUG(DEBUG_EXTRA2, "%s: no PRI f/w - assuming Aux "
-			       "port is already enabled\n", dev->name);
-		}
-		return 0;
-	}
-
-	spin_lock_irqsave(&local->cmdlock, flags);
-
-	/* wait until busy bit is clear */
-	tries = HFA384X_CMD_BUSY_TIMEOUT;
-	while (HFA384X_INW(HFA384X_CMD_OFF) & HFA384X_CMD_BUSY && tries > 0) {
-		tries--;
-		udelay(1);
-	}
-	if (tries == 0) {
-		reg = HFA384X_INW(HFA384X_CMD_OFF);
-		spin_unlock_irqrestore(&local->cmdlock, flags);
-		printk("%s: prism2_enable_aux_port - timeout - reg=0x%04x\n",
-		       dev->name, reg);
-		return -ETIMEDOUT;
-	}
-
-	val = HFA384X_INW(HFA384X_CONTROL_OFF);
-
-	if (enable) {
-		HFA384X_OUTW(HFA384X_AUX_MAGIC0, HFA384X_PARAM0_OFF);
-		HFA384X_OUTW(HFA384X_AUX_MAGIC1, HFA384X_PARAM1_OFF);
-		HFA384X_OUTW(HFA384X_AUX_MAGIC2, HFA384X_PARAM2_OFF);
-
-		if ((val & HFA384X_AUX_PORT_MASK) != HFA384X_AUX_PORT_DISABLED)
-			printk("prism2_enable_aux_port: was not disabled!?\n");
-		val &= ~HFA384X_AUX_PORT_MASK;
-		val |= HFA384X_AUX_PORT_ENABLE;
-	} else {
-		HFA384X_OUTW(0, HFA384X_PARAM0_OFF);
-		HFA384X_OUTW(0, HFA384X_PARAM1_OFF);
-		HFA384X_OUTW(0, HFA384X_PARAM2_OFF);
-
-		if ((val & HFA384X_AUX_PORT_MASK) != HFA384X_AUX_PORT_ENABLED)
-			printk("prism2_enable_aux_port: was not enabled!?\n");
-		val &= ~HFA384X_AUX_PORT_MASK;
-		val |= HFA384X_AUX_PORT_DISABLE;
-	}
-	HFA384X_OUTW(val, HFA384X_CONTROL_OFF);
-
-	udelay(5);
-
-	i = 10000;
-	while (i > 0) {
-		val = HFA384X_INW(HFA384X_CONTROL_OFF);
-		val &= HFA384X_AUX_PORT_MASK;
-
-		if ((enable && val == HFA384X_AUX_PORT_ENABLED) ||
-		    (!enable && val == HFA384X_AUX_PORT_DISABLED))
-			break;
-
-		udelay(10);
-		i--;
-	}
-
-	spin_unlock_irqrestore(&local->cmdlock, flags);
-
-	if (i == 0) {
-		printk("prism2_enable_aux_port(%d) timed out\n",
-		       enable);
-		return -ETIMEDOUT;
-	}
-
-	return 0;
-}
-
-
-static int hfa384x_from_aux(struct net_device *dev, unsigned int addr, int len,
-			    void *buf)
-{
-	u16 page, offset;
-	if (addr & 1 || len & 1)
-		return -1;
-
-	page = addr >> 7;
-	offset = addr & 0x7f;
-
-	HFA384X_OUTW(page, HFA384X_AUXPAGE_OFF);
-	HFA384X_OUTW(offset, HFA384X_AUXOFFSET_OFF);
-
-	udelay(5);
-
-#ifdef PRISM2_PCI
-	{
-		u16 *pos = (u16 *) buf;
-		while (len > 0) {
-			*pos++ = HFA384X_INW_DATA(HFA384X_AUXDATA_OFF);
-			len -= 2;
-		}
-	}
-#else /* PRISM2_PCI */
-	HFA384X_INSW(HFA384X_AUXDATA_OFF, buf, len / 2);
-#endif /* PRISM2_PCI */
-
-	return 0;
-}
-
-
-static int hfa384x_to_aux(struct net_device *dev, unsigned int addr, int len,
-			  void *buf)
-{
-	u16 page, offset;
-	if (addr & 1 || len & 1)
-		return -1;
-
-	page = addr >> 7;
-	offset = addr & 0x7f;
-
-	HFA384X_OUTW(page, HFA384X_AUXPAGE_OFF);
-	HFA384X_OUTW(offset, HFA384X_AUXOFFSET_OFF);
-
-	udelay(5);
-
-#ifdef PRISM2_PCI
-	{
-		u16 *pos = (u16 *) buf;
-		while (len > 0) {
-			HFA384X_OUTW_DATA(*pos++, HFA384X_AUXDATA_OFF);
-			len -= 2;
-		}
-	}
-#else /* PRISM2_PCI */
-	HFA384X_OUTSW(HFA384X_AUXDATA_OFF, buf, len / 2);
-#endif /* PRISM2_PCI */
-
-	return 0;
-}
-
-
-static int prism2_pda_ok(u8 *buf)
-{
-	u16 *pda = (u16 *) buf;
-	int pos;
-	u16 len, pdr;
-
-	if (buf[0] == 0xff && buf[1] == 0x00 && buf[2] == 0xff &&
-	    buf[3] == 0x00)
-		return 0;
-
-	pos = 0;
-	while (pos + 1 < PRISM2_PDA_SIZE / 2) {
-		len = le16_to_cpu(pda[pos]);
-		pdr = le16_to_cpu(pda[pos + 1]);
-		if (len == 0 || pos + len > PRISM2_PDA_SIZE / 2)
-			return 0;
-
-		if (pdr == 0x0000 && len == 2) {
-			/* PDA end found */
-			return 1;
-		}
-
-		pos += len + 1;
-	}
-
-	return 0;
-}
-
-
-static int prism2_download_aux_dump(struct net_device *dev,
-				     unsigned int addr, int len, u8 *buf)
-{
-	int res;
-
-	prism2_enable_aux_port(dev, 1);
-	res = hfa384x_from_aux(dev, addr, len, buf);
-	prism2_enable_aux_port(dev, 0);
-	if (res)
-		return -1;
-
-	return 0;
-}
-
-
-static u8 * prism2_read_pda(struct net_device *dev)
-{
-	u8 *buf;
-	int res, i, found = 0;
-#define NUM_PDA_ADDRS 4
-	unsigned int pda_addr[NUM_PDA_ADDRS] = {
-		0x7f0000 /* others than HFA3841 */,
-		0x3f0000 /* HFA3841 */,
-		0x390000 /* apparently used in older cards */,
-		0x7f0002 /* Intel PRO/Wireless 2011B (PCI) */,
-	};
-
-	buf = (u8 *) kmalloc(PRISM2_PDA_SIZE, GFP_KERNEL);
-	if (buf == NULL)
-		return NULL;
-
-	/* Note: wlan card should be in initial state (just after init cmd)
-	 * and no other operations should be performed concurrently. */
-
-	prism2_enable_aux_port(dev, 1);
-
-	for (i = 0; i < NUM_PDA_ADDRS; i++) {
-		PDEBUG(DEBUG_EXTRA2, "%s: trying to read PDA from 0x%08x",
-		       dev->name, pda_addr[i]);
-		res = hfa384x_from_aux(dev, pda_addr[i], PRISM2_PDA_SIZE, buf);
-		if (res)
-			continue;
-		if (res == 0 && prism2_pda_ok(buf)) {
-			PDEBUG2(DEBUG_EXTRA2, ": OK\n");
-			found = 1;
-			break;
-		} else {
-			PDEBUG2(DEBUG_EXTRA2, ": failed\n");
-		}
-	}
-
-	prism2_enable_aux_port(dev, 0);
-
-	if (!found) {
-		printk(KERN_DEBUG "%s: valid PDA not found\n", dev->name);
-		kfree(buf);
-		buf = NULL;
-	}
-
-	return buf;
-}
-
-
-static int prism2_download_volatile(local_info_t *local,
-				    struct prism2_download_data *param)
-{
-	struct net_device *dev = local->dev;
-	int ret = 0, i;
-	u16 param0, param1;
-
-	if (local->hw_downloading) {
-		printk(KERN_WARNING "%s: Already downloading - aborting new "
-		       "request\n", dev->name);
-		return -1;
-	}
-
-	local->hw_downloading = 1;
-	if (local->pri_only) {
-		hfa384x_disable_interrupts(dev);
-	} else {
-		prism2_hw_shutdown(dev, 0);
-
-		if (prism2_hw_init(dev, 0)) {
-			printk(KERN_WARNING "%s: Could not initialize card for"
-			       " download\n", dev->name);
-			ret = -1;
-			goto out;
-		}
-	}
-
-	if (prism2_enable_aux_port(dev, 1)) {
-		printk(KERN_WARNING "%s: Could not enable AUX port\n",
-		       dev->name);
-		ret = -1;
-		goto out;
-	}
-
-	param0 = param->start_addr & 0xffff;
-	param1 = param->start_addr >> 16;
-
-	HFA384X_OUTW(0, HFA384X_PARAM2_OFF);
-	HFA384X_OUTW(param1, HFA384X_PARAM1_OFF);
-	if (hfa384x_cmd_wait(dev, HFA384X_CMDCODE_DOWNLOAD |
-			     (HFA384X_PROGMODE_ENABLE_VOLATILE << 8),
-			     param0)) {
-		printk(KERN_WARNING "%s: Download command execution failed\n",
-		       dev->name);
-		ret = -1;
-		goto out;
-	}
-
-	for (i = 0; i < param->num_areas; i++) {
-		PDEBUG(DEBUG_EXTRA2, "%s: Writing %d bytes at 0x%08x\n",
-		       dev->name, param->data[i].len, param->data[i].addr);
-		if (hfa384x_to_aux(dev, param->data[i].addr,
-				   param->data[i].len, param->data[i].data)) {
-			printk(KERN_WARNING "%s: RAM download at 0x%08x "
-			       "(len=%d) failed\n", dev->name,
-			       param->data[i].addr, param->data[i].len);
-			ret = -1;
-			goto out;
-		}
-	}
-
-	HFA384X_OUTW(param1, HFA384X_PARAM1_OFF);
-	HFA384X_OUTW(0, HFA384X_PARAM2_OFF);
-	if (hfa384x_cmd_no_wait(dev, HFA384X_CMDCODE_DOWNLOAD |
-				(HFA384X_PROGMODE_DISABLE << 8), param0)) {
-		printk(KERN_WARNING "%s: Download command execution failed\n",
-		       dev->name);
-		ret = -1;
-		goto out;
-	}
-	/* ProgMode disable causes the hardware to restart itself from the
-	 * given starting address. Give hw some time and ACK command just in
-	 * case restart did not happen. */
-	mdelay(5);
-	HFA384X_OUTW(HFA384X_EV_CMD, HFA384X_EVACK_OFF);
-
-	if (prism2_enable_aux_port(dev, 0)) {
-		printk(KERN_DEBUG "%s: Disabling AUX port failed\n",
-		       dev->name);
-		/* continue anyway.. restart should have taken care of this */
-	}
-
-	mdelay(5);
-	local->hw_downloading = 0;
-	if (prism2_hw_config(dev, 2)) {
-		printk(KERN_WARNING "%s: Card configuration after RAM "
-		       "download failed\n", dev->name);
-		ret = -1;
-		goto out;
-	}
-
- out:
-	local->hw_downloading = 0;
-	return ret;
-}
-
-
-static int prism2_enable_genesis(local_info_t *local, int hcr)
-{
-	struct net_device *dev = local->dev;
-	u8 initseq[4] = { 0x00, 0xe1, 0xa1, 0xff };
-	u8 readbuf[4];
-
-	printk(KERN_DEBUG "%s: test Genesis mode with HCR 0x%02x\n",
-	       dev->name, hcr);
-	local->func->cor_sreset(local);
-	hfa384x_to_aux(dev, 0x7e0038, sizeof(initseq), initseq);
-	local->func->genesis_reset(local, hcr);
-
-	/* Readback test */
-	hfa384x_from_aux(dev, 0x7e0038, sizeof(readbuf), readbuf);
-	hfa384x_to_aux(dev, 0x7e0038, sizeof(initseq), initseq);
-	hfa384x_from_aux(dev, 0x7e0038, sizeof(readbuf), readbuf);
-
-	if (memcmp(initseq, readbuf, sizeof(initseq)) == 0) {
-		printk(KERN_DEBUG "Readback test succeeded, HCR 0x%02x\n",
-		       hcr);
-		return 0;
-	} else {
-		printk(KERN_DEBUG "Readback test failed, HCR 0x%02x "
-		       "write %02x %02x %02x %02x read %02x %02x %02x %02x\n",
-		       hcr, initseq[0], initseq[1], initseq[2], initseq[3],
-		       readbuf[0], readbuf[1], readbuf[2], readbuf[3]);
-		return 1;
-	}
-}
-
-
-static int prism2_get_ram_size(local_info_t *local)
-{
-	int ret;
-
-	/* Try to enable genesis mode; 0x1F for x8 SRAM or 0x0F for x16 SRAM */
-	if (prism2_enable_genesis(local, 0x1f) == 0)
-		ret = 8;
-	else if (prism2_enable_genesis(local, 0x0f) == 0)
-		ret = 16;
-	else
-		ret = -1;
-
-	/* Disable genesis mode */
-	local->func->genesis_reset(local, ret == 16 ? 0x07 : 0x17);
-
-	return ret;
-}
-
-
-static int prism2_download_genesis(local_info_t *local,
-				   struct prism2_download_data *param)
-{
-	struct net_device *dev = local->dev;
-	int ram16 = 0, i;
-	int ret = 0;
-
-	if (local->hw_downloading) {
-		printk(KERN_WARNING "%s: Already downloading - aborting new "
-		       "request\n", dev->name);
-		return -EBUSY;
-	}
-
-	if (!local->func->genesis_reset || !local->func->cor_sreset) {
-		printk(KERN_INFO "%s: Genesis mode downloading not supported "
-		       "with this hwmodel\n", dev->name);
-		return -EOPNOTSUPP;
-	}
-
-	local->hw_downloading = 1;
-
-	if (prism2_enable_aux_port(dev, 1)) {
-		printk(KERN_DEBUG "%s: failed to enable AUX port\n",
-		       dev->name);
-		ret = -EIO;
-		goto out;
-	}
-
-	if (local->sram_type == -1) {
-		/* 0x1F for x8 SRAM or 0x0F for x16 SRAM */
-		if (prism2_enable_genesis(local, 0x1f) == 0) {
-			ram16 = 0;
-			PDEBUG(DEBUG_EXTRA2, "%s: Genesis mode OK using x8 "
-			       "SRAM\n", dev->name);
-		} else if (prism2_enable_genesis(local, 0x0f) == 0) {
-			ram16 = 1;
-			PDEBUG(DEBUG_EXTRA2, "%s: Genesis mode OK using x16 "
-			       "SRAM\n", dev->name);
-		} else {
-			printk(KERN_DEBUG "%s: Could not initiate genesis "
-			       "mode\n", dev->name);
-			ret = -EIO;
-			goto out;
-		}
-	} else {
-		if (prism2_enable_genesis(local, local->sram_type == 8 ?
-					  0x1f : 0x0f)) {
-			printk(KERN_DEBUG "%s: Failed to set Genesis "
-			       "mode (sram_type=%d)\n", dev->name,
-			       local->sram_type);
-			ret = -EIO;
-			goto out;
-		}
-		ram16 = local->sram_type != 8;
-	}
-
-	for (i = 0; i < param->num_areas; i++) {
-		PDEBUG(DEBUG_EXTRA2, "%s: Writing %d bytes at 0x%08x\n",
-		       dev->name, param->data[i].len, param->data[i].addr);
-		if (hfa384x_to_aux(dev, param->data[i].addr,
-				   param->data[i].len, param->data[i].data)) {
-			printk(KERN_WARNING "%s: RAM download at 0x%08x "
-			       "(len=%d) failed\n", dev->name,
-			       param->data[i].addr, param->data[i].len);
-			ret = -EIO;
-			goto out;
-		}
-	}
-
-	PDEBUG(DEBUG_EXTRA2, "Disable genesis mode\n");
-	local->func->genesis_reset(local, ram16 ? 0x07 : 0x17);
-	if (prism2_enable_aux_port(dev, 0)) {
-		printk(KERN_DEBUG "%s: Failed to disable AUX port\n",
-		       dev->name);
-	}
-
-	mdelay(5);
-	local->hw_downloading = 0;
-
-	PDEBUG(DEBUG_EXTRA2, "Trying to initialize card\n");
-	/*
-	 * Make sure the INIT command does not generate a command completion
-	 * event by disabling interrupts.
-	 */
-	hfa384x_disable_interrupts(dev);
-	if (prism2_hw_init(dev, 1)) {
-		printk(KERN_DEBUG "%s: Initialization after genesis mode "
-		       "download failed\n", dev->name);
-		ret = -EIO;
-		goto out;
-	}
-
-	PDEBUG(DEBUG_EXTRA2, "Card initialized - running PRI only\n");
-	if (prism2_hw_init2(dev, 1)) {
-		printk(KERN_DEBUG "%s: Initialization(2) after genesis mode "
-		       "download failed\n", dev->name);
-		ret = -EIO;
-		goto out;
-	}
-
- out:
-	local->hw_downloading = 0;
-	return ret;
-}
-
-
-#ifdef PRISM2_NON_VOLATILE_DOWNLOAD
-/* Note! Non-volatile downloading functionality has not yet been tested
- * thoroughly and it may corrupt flash image and effectively kill the card that
- * is being updated. You have been warned. */
-
-static inline int prism2_download_block(struct net_device *dev,
-					u32 addr, u8 *data,
-					u32 bufaddr, int rest_len)
-{
-	u16 param0, param1;
-	int block_len;
-
-	block_len = rest_len < 4096 ? rest_len : 4096;
-
-	param0 = addr & 0xffff;
-	param1 = addr >> 16;
-
-	HFA384X_OUTW(block_len, HFA384X_PARAM2_OFF);
-	HFA384X_OUTW(param1, HFA384X_PARAM1_OFF);
-
-	if (hfa384x_cmd_wait(dev, HFA384X_CMDCODE_DOWNLOAD |
-			     (HFA384X_PROGMODE_ENABLE_NON_VOLATILE << 8),
-			     param0)) {
-		printk(KERN_WARNING "%s: Flash download command execution "
-		       "failed\n", dev->name);
-		return -1;
-	}
-
-	if (hfa384x_to_aux(dev, bufaddr, block_len, data)) {
-		printk(KERN_WARNING "%s: flash download at 0x%08x "
-		       "(len=%d) failed\n", dev->name, addr, block_len);
-		return -1;
-	}
-
-	HFA384X_OUTW(0, HFA384X_PARAM2_OFF);
-	HFA384X_OUTW(0, HFA384X_PARAM1_OFF);
-	if (hfa384x_cmd_wait(dev, HFA384X_CMDCODE_DOWNLOAD |
-			     (HFA384X_PROGMODE_PROGRAM_NON_VOLATILE << 8),
-			     0)) {
-		printk(KERN_WARNING "%s: Flash write command execution "
-		       "failed\n", dev->name);
-		return -1;
-	}
-
-	return block_len;
-}
-
-
-static int prism2_download_nonvolatile(local_info_t *local,
-				       struct prism2_download_data *dl)
-{
-	struct net_device *dev = local->dev;
-	int ret = 0, i;
-	struct {
-		u16 page;
-		u16 offset;
-		u16 len;
-	} dlbuffer;
-	u32 bufaddr;
-
-	if (local->hw_downloading) {
-		printk(KERN_WARNING "%s: Already downloading - aborting new "
-		       "request\n", dev->name);
-		return -1;
-	}
-
-	ret = local->func->get_rid(dev, HFA384X_RID_DOWNLOADBUFFER,
-				   &dlbuffer, 6, 0);
-
-	if (ret < 0) {
-		printk(KERN_WARNING "%s: Could not read download buffer "
-		       "parameters\n", dev->name);
-		goto out;
-	}
-
-	dlbuffer.page = le16_to_cpu(dlbuffer.page);
-	dlbuffer.offset = le16_to_cpu(dlbuffer.offset);
-	dlbuffer.len = le16_to_cpu(dlbuffer.len);
-
-	printk(KERN_DEBUG "Download buffer: %d bytes at 0x%04x:0x%04x\n",
-	       dlbuffer.len, dlbuffer.page, dlbuffer.offset);
-
-	bufaddr = (dlbuffer.page << 7) + dlbuffer.offset;
-
-	local->hw_downloading = 1;
-
-	if (!local->pri_only) {
-		prism2_hw_shutdown(dev, 0);
-
-		if (prism2_hw_init(dev, 0)) {
-			printk(KERN_WARNING "%s: Could not initialize card for"
-			       " download\n", dev->name);
-			ret = -1;
-			goto out;
-		}
-	}
-
-	hfa384x_disable_interrupts(dev);
-
-	if (prism2_enable_aux_port(dev, 1)) {
-		printk(KERN_WARNING "%s: Could not enable AUX port\n",
-		       dev->name);
-		ret = -1;
-		goto out;
-	}
-
-	printk(KERN_DEBUG "%s: starting flash download\n", dev->name);
-	for (i = 0; i < dl->num_areas; i++) {
-		int rest_len = dl->data[i].len;
-		int data_off = 0;
-
-		while (rest_len > 0) {
-			int block_len;
-
-			block_len = prism2_download_block(
-				dev, dl->data[i].addr + data_off,
-				dl->data[i].data + data_off, bufaddr,
-				rest_len);
-
-			if (block_len < 0) {
-				ret = -1;
-				goto out;
-			}
-
-			rest_len -= block_len;
-			data_off += block_len;
-		}
-	}
-
-	HFA384X_OUTW(0, HFA384X_PARAM1_OFF);
-	HFA384X_OUTW(0, HFA384X_PARAM2_OFF);
-	if (hfa384x_cmd_wait(dev, HFA384X_CMDCODE_DOWNLOAD |
-				(HFA384X_PROGMODE_DISABLE << 8), 0)) {
-		printk(KERN_WARNING "%s: Download command execution failed\n",
-		       dev->name);
-		ret = -1;
-		goto out;
-	}
-
-	if (prism2_enable_aux_port(dev, 0)) {
-		printk(KERN_DEBUG "%s: Disabling AUX port failed\n",
-		       dev->name);
-		/* continue anyway.. restart should have taken care of this */
-	}
-
-	mdelay(5);
-
-	local->func->hw_reset(dev);
-	local->hw_downloading = 0;
-	if (prism2_hw_config(dev, 2)) {
-		printk(KERN_WARNING "%s: Card configuration after flash "
-		       "download failed\n", dev->name);
-		ret = -1;
-	} else {
-		printk(KERN_INFO "%s: Card initialized successfully after "
-		       "flash download\n", dev->name);
-	}
-
- out:
-	local->hw_downloading = 0;
-	return ret;
-}
-#endif /* PRISM2_NON_VOLATILE_DOWNLOAD */
-
-
-static void prism2_download_free_data(struct prism2_download_data *dl)
-{
-	int i;
-
-	if (dl == NULL)
-		return;
-
-	for (i = 0; i < dl->num_areas; i++)
-		kfree(dl->data[i].data);
-	kfree(dl);
-}
-
-
-static int prism2_download(local_info_t *local,
-			   struct prism2_download_param *param)
-{
-	int ret = 0;
-	int i;
-	u32 total_len = 0;
-	struct prism2_download_data *dl = NULL;
-
-	printk(KERN_DEBUG "prism2_download: dl_cmd=%d start_addr=0x%08x "
-	       "num_areas=%d\n",
-	       param->dl_cmd, param->start_addr, param->num_areas);
-
-	if (param->num_areas > 100) {
-		ret = -EINVAL;
-		goto out;
-	}
-
-	dl = kmalloc(sizeof(*dl) + param->num_areas *
-		     sizeof(struct prism2_download_data_area), GFP_KERNEL);
-	if (dl == NULL) {
-		ret = -ENOMEM;
-		goto out;
-	}
-	memset(dl, 0, sizeof(*dl) + param->num_areas *
-	       sizeof(struct prism2_download_data_area));
-	dl->dl_cmd = param->dl_cmd;
-	dl->start_addr = param->start_addr;
-	dl->num_areas = param->num_areas;
-	for (i = 0; i < param->num_areas; i++) {
-		PDEBUG(DEBUG_EXTRA2,
-		       "  area %d: addr=0x%08x len=%d ptr=0x%p\n",
-		       i, param->data[i].addr, param->data[i].len,
-		       param->data[i].ptr);
-
-		dl->data[i].addr = param->data[i].addr;
-		dl->data[i].len = param->data[i].len;
-
-		total_len += param->data[i].len;
-		if (param->data[i].len > PRISM2_MAX_DOWNLOAD_AREA_LEN ||
-		    total_len > PRISM2_MAX_DOWNLOAD_LEN) {
-			ret = -E2BIG;
-			goto out;
-		}
-
-		dl->data[i].data = kmalloc(dl->data[i].len, GFP_KERNEL);
-		if (dl->data[i].data == NULL) {
-			ret = -ENOMEM;
-			goto out;
-		}
-
-		if (copy_from_user(dl->data[i].data, param->data[i].ptr,
-				   param->data[i].len)) {
-			ret = -EFAULT;
-			goto out;
-		}
-	}
-
-	switch (param->dl_cmd) {
-	case PRISM2_DOWNLOAD_VOLATILE:
-	case PRISM2_DOWNLOAD_VOLATILE_PERSISTENT:
-		ret = prism2_download_volatile(local, dl);
-		break;
-	case PRISM2_DOWNLOAD_VOLATILE_GENESIS:
-	case PRISM2_DOWNLOAD_VOLATILE_GENESIS_PERSISTENT:
-		ret = prism2_download_genesis(local, dl);
-		break;
-	case PRISM2_DOWNLOAD_NON_VOLATILE:
-#ifdef PRISM2_NON_VOLATILE_DOWNLOAD
-		ret = prism2_download_nonvolatile(local, dl);
-#else /* PRISM2_NON_VOLATILE_DOWNLOAD */
-		printk(KERN_INFO "%s: non-volatile downloading not enabled\n",
-		       local->dev->name);
-		ret = -EOPNOTSUPP;
-#endif /* PRISM2_NON_VOLATILE_DOWNLOAD */
-		break;
-	default:
-		printk(KERN_DEBUG "%s: unsupported download command %d\n",
-		       local->dev->name, param->dl_cmd);
-		ret = -EINVAL;
-		break;
-	};
-
- out:
-	if (ret == 0 && dl &&
-	    param->dl_cmd == PRISM2_DOWNLOAD_VOLATILE_GENESIS_PERSISTENT) {
-		prism2_download_free_data(local->dl_pri);
-		local->dl_pri = dl;
-	} else if (ret == 0 && dl &&
-		   param->dl_cmd == PRISM2_DOWNLOAD_VOLATILE_PERSISTENT) {
-		prism2_download_free_data(local->dl_sec);
-		local->dl_sec = dl;
-	} else
-		prism2_download_free_data(dl);
-
-	return ret;
-}
diff --git a/trunk/drivers/net/wireless/hostap/hostap_hw.c b/trunk/drivers/net/wireless/hostap/hostap_hw.c
deleted file mode 100644
index e533a663deda..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_hw.c
+++ /dev/null
@@ -1,3445 +0,0 @@
-/*
- * Host AP (software wireless LAN access point) driver for
- * Intersil Prism2/2.5/3.
- *
- * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
- * <jkmaline@cc.hut.fi>
- * Copyright (c) 2002-2005, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- *
- * FIX:
- * - there is currently no way of associating TX packets to correct wds device
- *   when TX Exc/OK event occurs, so all tx_packets and some
- *   tx_errors/tx_dropped are added to the main netdevice; using sw_support
- *   field in txdesc might be used to fix this (using Alloc event to increment
- *   tx_packets would need some further info in txfid table)
- *
- * Buffer Access Path (BAP) usage:
- *   Prism2 cards have two separate BAPs for accessing the card memory. These
- *   should allow concurrent access to two different frames and the driver
- *   previously used BAP0 for sending data and BAP1 for receiving data.
- *   However, there seems to be number of issues with concurrent access and at
- *   least one know hardware bug in using BAP0 and BAP1 concurrently with PCI
- *   Prism2.5. Therefore, the driver now only uses BAP0 for moving data between
- *   host and card memories. BAP0 accesses are protected with local->baplock
- *   (spin_lock_bh) to prevent concurrent use.
- */
-
-
-#include <linux/config.h>
-#include <linux/version.h>
-
-#include <asm/delay.h>
-#include <asm/uaccess.h>
-
-#include <linux/slab.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/proc_fs.h>
-#include <linux/if_arp.h>
-#include <linux/delay.h>
-#include <linux/random.h>
-#include <linux/wait.h>
-#include <linux/sched.h>
-#include <linux/rtnetlink.h>
-#include <linux/wireless.h>
-#include <net/iw_handler.h>
-#include <net/ieee80211.h>
-#include <net/ieee80211_crypt.h>
-#include <asm/irq.h>
-
-#include "hostap_80211.h"
-#include "hostap.h"
-#include "hostap_ap.h"
-
-
-/* #define final_version */
-
-static int mtu = 1500;
-module_param(mtu, int, 0444);
-MODULE_PARM_DESC(mtu, "Maximum transfer unit");
-
-static int channel[MAX_PARM_DEVICES] = { 3, DEF_INTS };
-module_param_array(channel, int, NULL, 0444);
-MODULE_PARM_DESC(channel, "Initial channel");
-
-static char essid[33] = "test";
-module_param_string(essid, essid, sizeof(essid), 0444);
-MODULE_PARM_DESC(essid, "Host AP's ESSID");
-
-static int iw_mode[MAX_PARM_DEVICES] = { IW_MODE_MASTER, DEF_INTS };
-module_param_array(iw_mode, int, NULL, 0444);
-MODULE_PARM_DESC(iw_mode, "Initial operation mode");
-
-static int beacon_int[MAX_PARM_DEVICES] = { 100, DEF_INTS };
-module_param_array(beacon_int, int, NULL, 0444);
-MODULE_PARM_DESC(beacon_int, "Beacon interval (1 = 1024 usec)");
-
-static int dtim_period[MAX_PARM_DEVICES] = { 1, DEF_INTS };
-module_param_array(dtim_period, int, NULL, 0444);
-MODULE_PARM_DESC(dtim_period, "DTIM period");
-
-static char dev_template[16] = "wlan%d";
-module_param_string(dev_template, dev_template, sizeof(dev_template), 0444);
-MODULE_PARM_DESC(dev_template, "Prefix for network device name (default: "
-		 "wlan%d)");
-
-#ifdef final_version
-#define EXTRA_EVENTS_WTERR 0
-#else
-/* check WTERR events (Wait Time-out) in development versions */
-#define EXTRA_EVENTS_WTERR HFA384X_EV_WTERR
-#endif
-
-/* Events that will be using BAP0 */
-#define HFA384X_BAP0_EVENTS \
-	(HFA384X_EV_TXEXC | HFA384X_EV_RX | HFA384X_EV_INFO | HFA384X_EV_TX)
-
-/* event mask, i.e., events that will result in an interrupt */
-#define HFA384X_EVENT_MASK \
-	(HFA384X_BAP0_EVENTS | HFA384X_EV_ALLOC | HFA384X_EV_INFDROP | \
-	HFA384X_EV_CMD | HFA384X_EV_TICK | \
-	EXTRA_EVENTS_WTERR)
-
-/* Default TX control flags: use 802.11 headers and request interrupt for
- * failed transmits. Frames that request ACK callback, will add
- * _TX_OK flag and _ALT_RTRY flag may be used to select different retry policy.
- */
-#define HFA384X_TX_CTRL_FLAGS \
-	(HFA384X_TX_CTRL_802_11 | HFA384X_TX_CTRL_TX_EX)
-
-
-/* ca. 1 usec */
-#define HFA384X_CMD_BUSY_TIMEOUT 5000
-#define HFA384X_BAP_BUSY_TIMEOUT 50000
-
-/* ca. 10 usec */
-#define HFA384X_CMD_COMPL_TIMEOUT 20000
-#define HFA384X_DL_COMPL_TIMEOUT 1000000
-
-/* Wait times for initialization; yield to other processes to avoid busy
- * waiting for long time. */
-#define HFA384X_INIT_TIMEOUT (HZ / 2) /* 500 ms */
-#define HFA384X_ALLOC_COMPL_TIMEOUT (HZ / 20) /* 50 ms */
-
-
-static void prism2_hw_reset(struct net_device *dev);
-static void prism2_check_sta_fw_version(local_info_t *local);
-
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-/* hostap_download.c */
-static int prism2_download_aux_dump(struct net_device *dev,
-				    unsigned int addr, int len, u8 *buf);
-static u8 * prism2_read_pda(struct net_device *dev);
-static int prism2_download(local_info_t *local,
-			   struct prism2_download_param *param);
-static void prism2_download_free_data(struct prism2_download_data *dl);
-static int prism2_download_volatile(local_info_t *local,
-				    struct prism2_download_data *param);
-static int prism2_download_genesis(local_info_t *local,
-				   struct prism2_download_data *param);
-static int prism2_get_ram_size(local_info_t *local);
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-
-
-
-
-#ifndef final_version
-/* magic value written to SWSUPPORT0 reg. for detecting whether card is still
- * present */
-#define HFA384X_MAGIC 0x8A32
-#endif
-
-
-static u16 hfa384x_read_reg(struct net_device *dev, u16 reg)
-{
-	return HFA384X_INW(reg);
-}
-
-
-static void hfa384x_read_regs(struct net_device *dev,
-			      struct hfa384x_regs *regs)
-{
-	regs->cmd = HFA384X_INW(HFA384X_CMD_OFF);
-	regs->evstat = HFA384X_INW(HFA384X_EVSTAT_OFF);
-	regs->offset0 = HFA384X_INW(HFA384X_OFFSET0_OFF);
-	regs->offset1 = HFA384X_INW(HFA384X_OFFSET1_OFF);
-	regs->swsupport0 = HFA384X_INW(HFA384X_SWSUPPORT0_OFF);
-}
-
-
-/**
- * __hostap_cmd_queue_free - Free Prism2 command queue entry (private)
- * @local: pointer to private Host AP driver data
- * @entry: Prism2 command queue entry to be freed
- * @del_req: request the entry to be removed
- *
- * Internal helper function for freeing Prism2 command queue entries.
- * Caller must have acquired local->cmdlock before calling this function.
- */
-static inline void __hostap_cmd_queue_free(local_info_t *local,
-					   struct hostap_cmd_queue *entry,
-					   int del_req)
-{
-	if (del_req) {
-		entry->del_req = 1;
-		if (!list_empty(&entry->list)) {
-			list_del_init(&entry->list);
-			local->cmd_queue_len--;
-		}
-	}
-
-	if (atomic_dec_and_test(&entry->usecnt) && entry->del_req)
-		kfree(entry);
-}
-
-
-/**
- * hostap_cmd_queue_free - Free Prism2 command queue entry
- * @local: pointer to private Host AP driver data
- * @entry: Prism2 command queue entry to be freed
- * @del_req: request the entry to be removed
- *
- * Free a Prism2 command queue entry.
- */
-static inline void hostap_cmd_queue_free(local_info_t *local,
-					 struct hostap_cmd_queue *entry,
-					 int del_req)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&local->cmdlock, flags);
-	__hostap_cmd_queue_free(local, entry, del_req);
-	spin_unlock_irqrestore(&local->cmdlock, flags);
-}
-
-
-/**
- * prism2_clear_cmd_queue - Free all pending Prism2 command queue entries
- * @local: pointer to private Host AP driver data
- */
-static void prism2_clear_cmd_queue(local_info_t *local)
-{
-	struct list_head *ptr, *n;
-	unsigned long flags;
-	struct hostap_cmd_queue *entry;
-
-	spin_lock_irqsave(&local->cmdlock, flags);
-	list_for_each_safe(ptr, n, &local->cmd_queue) {
-		entry = list_entry(ptr, struct hostap_cmd_queue, list);
-		atomic_inc(&entry->usecnt);
-		printk(KERN_DEBUG "%s: removed pending cmd_queue entry "
-		       "(type=%d, cmd=0x%04x, param0=0x%04x)\n",
-		       local->dev->name, entry->type, entry->cmd,
-		       entry->param0);
-		__hostap_cmd_queue_free(local, entry, 1);
-	}
-	if (local->cmd_queue_len) {
-		/* This should not happen; print debug message and clear
-		 * queue length. */
-		printk(KERN_DEBUG "%s: cmd_queue_len (%d) not zero after "
-		       "flush\n", local->dev->name, local->cmd_queue_len);
-		local->cmd_queue_len = 0;
-	}
-	spin_unlock_irqrestore(&local->cmdlock, flags);
-}
-
-
-/**
- * hfa384x_cmd_issue - Issue a Prism2 command to the hardware
- * @dev: pointer to net_device
- * @entry: Prism2 command queue entry to be issued
- */
-static inline int hfa384x_cmd_issue(struct net_device *dev,
-				    struct hostap_cmd_queue *entry)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int tries;
-	u16 reg;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->card_present && !local->func->card_present(local))
-		return -ENODEV;
-
-	if (entry->issued) {
-		printk(KERN_DEBUG "%s: driver bug - re-issuing command @%p\n",
-		       dev->name, entry);
-	}
-
-	/* wait until busy bit is clear; this should always be clear since the
-	 * commands are serialized */
-	tries = HFA384X_CMD_BUSY_TIMEOUT;
-	while (HFA384X_INW(HFA384X_CMD_OFF) & HFA384X_CMD_BUSY && tries > 0) {
-		tries--;
-		udelay(1);
-	}
-#ifndef final_version
-	if (tries != HFA384X_CMD_BUSY_TIMEOUT) {
-		prism2_io_debug_error(dev, 1);
-		printk(KERN_DEBUG "%s: hfa384x_cmd_issue: cmd reg was busy "
-		       "for %d usec\n", dev->name,
-		       HFA384X_CMD_BUSY_TIMEOUT - tries);
-	}
-#endif
-	if (tries == 0) {
-		reg = HFA384X_INW(HFA384X_CMD_OFF);
-		prism2_io_debug_error(dev, 2);
-		printk(KERN_DEBUG "%s: hfa384x_cmd_issue - timeout - "
-		       "reg=0x%04x\n", dev->name, reg);
-		return -ETIMEDOUT;
-	}
-
-	/* write command */
-	spin_lock_irqsave(&local->cmdlock, flags);
-	HFA384X_OUTW(entry->param0, HFA384X_PARAM0_OFF);
-	HFA384X_OUTW(entry->param1, HFA384X_PARAM1_OFF);
-	HFA384X_OUTW(entry->cmd, HFA384X_CMD_OFF);
-	entry->issued = 1;
-	spin_unlock_irqrestore(&local->cmdlock, flags);
-
-	return 0;
-}
-
-
-/**
- * hfa384x_cmd - Issue a Prism2 command and wait (sleep) for completion
- * @dev: pointer to net_device
- * @cmd: Prism2 command code (HFA384X_CMD_CODE_*)
- * @param0: value for Param0 register
- * @param1: value for Param1 register (pointer; %NULL if not used)
- * @resp0: pointer for Resp0 data or %NULL if Resp0 is not needed
- *
- * Issue given command (possibly after waiting in command queue) and sleep
- * until the command is completed (or timed out or interrupted). This can be
- * called only from user process context.
- */
-static int hfa384x_cmd(struct net_device *dev, u16 cmd, u16 param0,
-		       u16 *param1, u16 *resp0)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int err, res, issue, issued = 0;
-	unsigned long flags;
-	struct hostap_cmd_queue *entry;
-	DECLARE_WAITQUEUE(wait, current);
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (in_interrupt()) {
-		printk(KERN_DEBUG "%s: hfa384x_cmd called from interrupt "
-		       "context\n", dev->name);
-		return -1;
-	}
-
-	if (local->cmd_queue_len >= HOSTAP_CMD_QUEUE_MAX_LEN) {
-		printk(KERN_DEBUG "%s: hfa384x_cmd: cmd_queue full\n",
-		       dev->name);
-		return -1;
-	}
-
-	if (signal_pending(current))
-		return -EINTR;
-
-	entry = (struct hostap_cmd_queue *)
-		kmalloc(sizeof(*entry), GFP_ATOMIC);
-	if (entry == NULL) {
-		printk(KERN_DEBUG "%s: hfa384x_cmd - kmalloc failed\n",
-		       dev->name);
-		return -ENOMEM;
-	}
-	memset(entry, 0, sizeof(*entry));
-	atomic_set(&entry->usecnt, 1);
-	entry->type = CMD_SLEEP;
-	entry->cmd = cmd;
-	entry->param0 = param0;
-	if (param1)
-		entry->param1 = *param1;
-	init_waitqueue_head(&entry->compl);
-
-	/* prepare to wait for command completion event, but do not sleep yet
-	 */
-	add_wait_queue(&entry->compl, &wait);
-	set_current_state(TASK_INTERRUPTIBLE);
-
-	spin_lock_irqsave(&local->cmdlock, flags);
-	issue = list_empty(&local->cmd_queue);
-	if (issue)
-		entry->issuing = 1;
-	list_add_tail(&entry->list, &local->cmd_queue);
-	local->cmd_queue_len++;
-	spin_unlock_irqrestore(&local->cmdlock, flags);
-
-	err = 0;
-	if (!issue)
-		goto wait_completion;
-
-	if (signal_pending(current))
-		err = -EINTR;
-
-	if (!err) {
-		if (hfa384x_cmd_issue(dev, entry))
-			err = -ETIMEDOUT;
-		else
-			issued = 1;
-	}
-
- wait_completion:
-	if (!err && entry->type != CMD_COMPLETED) {
-		/* sleep until command is completed or timed out */
-		res = schedule_timeout(2 * HZ);
-	} else
-		res = -1;
-
-	if (!err && signal_pending(current))
-		err = -EINTR;
-
-	if (err && issued) {
-		/* the command was issued, so a CmdCompl event should occur
-		 * soon; however, there's a pending signal and
-		 * schedule_timeout() would be interrupted; wait a short period
-		 * of time to avoid removing entry from the list before
-		 * CmdCompl event */
-		udelay(300);
-	}
-
-	set_current_state(TASK_RUNNING);
-	remove_wait_queue(&entry->compl, &wait);
-
-	/* If entry->list is still in the list, it must be removed
-	 * first and in this case prism2_cmd_ev() does not yet have
-	 * local reference to it, and the data can be kfree()'d
-	 * here. If the command completion event is still generated,
-	 * it will be assigned to next (possibly) pending command, but
-	 * the driver will reset the card anyway due to timeout
-	 *
-	 * If the entry is not in the list prism2_cmd_ev() has a local
-	 * reference to it, but keeps cmdlock as long as the data is
-	 * needed, so the data can be kfree()'d here. */
-
-	/* FIX: if the entry->list is in the list, it has not been completed
-	 * yet, so removing it here is somewhat wrong.. this could cause
-	 * references to freed memory and next list_del() causing NULL pointer
-	 * dereference.. it would probably be better to leave the entry in the
-	 * list and the list should be emptied during hw reset */
-
-	spin_lock_irqsave(&local->cmdlock, flags);
-	if (!list_empty(&entry->list)) {
-		printk(KERN_DEBUG "%s: hfa384x_cmd: entry still in list? "
-		       "(entry=%p, type=%d, res=%d)\n", dev->name, entry,
-		       entry->type, res);
-		list_del_init(&entry->list);
-		local->cmd_queue_len--;
-	}
-	spin_unlock_irqrestore(&local->cmdlock, flags);
-
-	if (err) {
-		printk(KERN_DEBUG "%s: hfa384x_cmd: interrupted; err=%d\n",
-		       dev->name, err);
-		res = err;
-		goto done;
-	}
-
-	if (entry->type != CMD_COMPLETED) {
-		u16 reg = HFA384X_INW(HFA384X_EVSTAT_OFF);
-		printk(KERN_DEBUG "%s: hfa384x_cmd: command was not "
-		       "completed (res=%d, entry=%p, type=%d, cmd=0x%04x, "
-		       "param0=0x%04x, EVSTAT=%04x INTEN=%04x)\n", dev->name,
-		       res, entry, entry->type, entry->cmd, entry->param0, reg,
-		       HFA384X_INW(HFA384X_INTEN_OFF));
-		if (reg & HFA384X_EV_CMD) {
-			/* Command completion event is pending, but the
-			 * interrupt was not delivered - probably an issue
-			 * with pcmcia-cs configuration. */
-			printk(KERN_WARNING "%s: interrupt delivery does not "
-			       "seem to work\n", dev->name);
-		}
-		prism2_io_debug_error(dev, 3);
-		res = -ETIMEDOUT;
-		goto done;
-	}
-
-	if (resp0 != NULL)
-		*resp0 = entry->resp0;
-#ifndef final_version
-	if (entry->res) {
-		printk(KERN_DEBUG "%s: CMD=0x%04x => res=0x%02x, "
-		       "resp0=0x%04x\n",
-		       dev->name, cmd, entry->res, entry->resp0);
-	}
-#endif /* final_version */
-
-	res = entry->res;
- done:
-	hostap_cmd_queue_free(local, entry, 1);
-	return res;
-}
-
-
-/**
- * hfa384x_cmd_callback - Issue a Prism2 command; callback when completed
- * @dev: pointer to net_device
- * @cmd: Prism2 command code (HFA384X_CMD_CODE_*)
- * @param0: value for Param0 register
- * @callback: command completion callback function (%NULL = no callback)
- * @context: context data to be given to the callback function
- *
- * Issue given command (possibly after waiting in command queue) and use
- * callback function to indicate command completion. This can be called both
- * from user and interrupt context. The callback function will be called in
- * hardware IRQ context. It can be %NULL, when no function is called when
- * command is completed.
- */
-static int hfa384x_cmd_callback(struct net_device *dev, u16 cmd, u16 param0,
-				void (*callback)(struct net_device *dev,
-						 long context, u16 resp0,
-						 u16 status),
-				long context)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int issue, ret;
-	unsigned long flags;
-	struct hostap_cmd_queue *entry;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->cmd_queue_len >= HOSTAP_CMD_QUEUE_MAX_LEN + 2) {
-		printk(KERN_DEBUG "%s: hfa384x_cmd: cmd_queue full\n",
-		       dev->name);
-		return -1;
-	}
-
-	entry = (struct hostap_cmd_queue *)
-		kmalloc(sizeof(*entry), GFP_ATOMIC);
-	if (entry == NULL) {
-		printk(KERN_DEBUG "%s: hfa384x_cmd_callback - kmalloc "
-		       "failed\n", dev->name);
-		return -ENOMEM;
-	}
-	memset(entry, 0, sizeof(*entry));
-	atomic_set(&entry->usecnt, 1);
-	entry->type = CMD_CALLBACK;
-	entry->cmd = cmd;
-	entry->param0 = param0;
-	entry->callback = callback;
-	entry->context = context;
-
-	spin_lock_irqsave(&local->cmdlock, flags);
-	issue = list_empty(&local->cmd_queue);
-	if (issue)
-		entry->issuing = 1;
-	list_add_tail(&entry->list, &local->cmd_queue);
-	local->cmd_queue_len++;
-	spin_unlock_irqrestore(&local->cmdlock, flags);
-
-	if (issue && hfa384x_cmd_issue(dev, entry))
-		ret = -ETIMEDOUT;
-	else
-		ret = 0;
-
-	hostap_cmd_queue_free(local, entry, ret);
-
-	return ret;
-}
-
-
-/**
- * __hfa384x_cmd_no_wait - Issue a Prism2 command (private)
- * @dev: pointer to net_device
- * @cmd: Prism2 command code (HFA384X_CMD_CODE_*)
- * @param0: value for Param0 register
- * @io_debug_num: I/O debug error number
- *
- * Shared helper function for hfa384x_cmd_wait() and hfa384x_cmd_no_wait().
- */
-static int __hfa384x_cmd_no_wait(struct net_device *dev, u16 cmd, u16 param0,
-				 int io_debug_num)
-{
-	int tries;
-	u16 reg;
-
-	/* wait until busy bit is clear; this should always be clear since the
-	 * commands are serialized */
-	tries = HFA384X_CMD_BUSY_TIMEOUT;
-	while (HFA384X_INW(HFA384X_CMD_OFF) & HFA384X_CMD_BUSY && tries > 0) {
-		tries--;
-		udelay(1);
-	}
-	if (tries == 0) {
-		reg = HFA384X_INW(HFA384X_CMD_OFF);
-		prism2_io_debug_error(dev, io_debug_num);
-		printk(KERN_DEBUG "%s: __hfa384x_cmd_no_wait(%d) - timeout - "
-		       "reg=0x%04x\n", dev->name, io_debug_num, reg);
-		return -ETIMEDOUT;
-	}
-
-	/* write command */
-	HFA384X_OUTW(param0, HFA384X_PARAM0_OFF);
-	HFA384X_OUTW(cmd, HFA384X_CMD_OFF);
-
-	return 0;
-}
-
-
-/**
- * hfa384x_cmd_wait - Issue a Prism2 command and busy wait for completion
- * @dev: pointer to net_device
- * @cmd: Prism2 command code (HFA384X_CMD_CODE_*)
- * @param0: value for Param0 register
- */
-static int hfa384x_cmd_wait(struct net_device *dev, u16 cmd, u16 param0)
-{
-	int res, tries;
-	u16 reg;
-
-	res = __hfa384x_cmd_no_wait(dev, cmd, param0, 4);
-	if (res)
-		return res;
-
-        /* wait for command completion */
-	if ((cmd & HFA384X_CMDCODE_MASK) == HFA384X_CMDCODE_DOWNLOAD)
-		tries = HFA384X_DL_COMPL_TIMEOUT;
-	else
-		tries = HFA384X_CMD_COMPL_TIMEOUT;
-
-        while (!(HFA384X_INW(HFA384X_EVSTAT_OFF) & HFA384X_EV_CMD) &&
-               tries > 0) {
-                tries--;
-                udelay(10);
-        }
-        if (tries == 0) {
-                reg = HFA384X_INW(HFA384X_EVSTAT_OFF);
-		prism2_io_debug_error(dev, 5);
-                printk(KERN_DEBUG "%s: hfa384x_cmd_wait - timeout2 - "
-		       "reg=0x%04x\n", dev->name, reg);
-                return -ETIMEDOUT;
-        }
-
-        res = (HFA384X_INW(HFA384X_STATUS_OFF) &
-               (BIT(14) | BIT(13) | BIT(12) | BIT(11) | BIT(10) | BIT(9) |
-                BIT(8))) >> 8;
-#ifndef final_version
-	if (res) {
-		printk(KERN_DEBUG "%s: CMD=0x%04x => res=0x%02x\n",
-		       dev->name, cmd, res);
-	}
-#endif
-
-	HFA384X_OUTW(HFA384X_EV_CMD, HFA384X_EVACK_OFF);
-
-	return res;
-}
-
-
-/**
- * hfa384x_cmd_no_wait - Issue a Prism2 command; do not wait for completion
- * @dev: pointer to net_device
- * @cmd: Prism2 command code (HFA384X_CMD_CODE_*)
- * @param0: value for Param0 register
- */
-static inline int hfa384x_cmd_no_wait(struct net_device *dev, u16 cmd,
-				      u16 param0)
-{
-	return __hfa384x_cmd_no_wait(dev, cmd, param0, 6);
-}
-
-
-/**
- * prism2_cmd_ev - Prism2 command completion event handler
- * @dev: pointer to net_device
- *
- * Interrupt handler for command completion events. Called by the main
- * interrupt handler in hardware IRQ context. Read Resp0 and status registers
- * from the hardware and ACK the event. Depending on the issued command type
- * either wake up the sleeping process that is waiting for command completion
- * or call the callback function. Issue the next command, if one is pending.
- */
-static void prism2_cmd_ev(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct hostap_cmd_queue *entry = NULL;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock(&local->cmdlock);
-	if (!list_empty(&local->cmd_queue)) {
-		entry = list_entry(local->cmd_queue.next,
-				   struct hostap_cmd_queue, list);
-		atomic_inc(&entry->usecnt);
-		list_del_init(&entry->list);
-		local->cmd_queue_len--;
-
-		if (!entry->issued) {
-			printk(KERN_DEBUG "%s: Command completion event, but "
-			       "cmd not issued\n", dev->name);
-			__hostap_cmd_queue_free(local, entry, 1);
-			entry = NULL;
-		}
-	}
-	spin_unlock(&local->cmdlock);
-
-	if (!entry) {
-		HFA384X_OUTW(HFA384X_EV_CMD, HFA384X_EVACK_OFF);
-		printk(KERN_DEBUG "%s: Command completion event, but no "
-		       "pending commands\n", dev->name);
-		return;
-	}
-
-	entry->resp0 = HFA384X_INW(HFA384X_RESP0_OFF);
-	entry->res = (HFA384X_INW(HFA384X_STATUS_OFF) &
-		      (BIT(14) | BIT(13) | BIT(12) | BIT(11) | BIT(10) |
-		       BIT(9) | BIT(8))) >> 8;
-	HFA384X_OUTW(HFA384X_EV_CMD, HFA384X_EVACK_OFF);
-
-	/* TODO: rest of the CmdEv handling could be moved to tasklet */
-	if (entry->type == CMD_SLEEP) {
-		entry->type = CMD_COMPLETED;
-		wake_up_interruptible(&entry->compl);
-	} else if (entry->type == CMD_CALLBACK) {
-		if (entry->callback)
-			entry->callback(dev, entry->context, entry->resp0,
-					entry->res);
-	} else {
-		printk(KERN_DEBUG "%s: Invalid command completion type %d\n",
-		       dev->name, entry->type);
-	}
-	hostap_cmd_queue_free(local, entry, 1);
-
-	/* issue next command, if pending */
-	entry = NULL;
-	spin_lock(&local->cmdlock);
-	if (!list_empty(&local->cmd_queue)) {
-		entry = list_entry(local->cmd_queue.next,
-				   struct hostap_cmd_queue, list);
-		if (entry->issuing) {
-			/* hfa384x_cmd() has already started issuing this
-			 * command, so do not start here */
-			entry = NULL;
-		}
-		if (entry)
-			atomic_inc(&entry->usecnt);
-	}
-	spin_unlock(&local->cmdlock);
-
-	if (entry) {
-		/* issue next command; if command issuing fails, remove the
-		 * entry from cmd_queue */
-		int res = hfa384x_cmd_issue(dev, entry);
-		spin_lock(&local->cmdlock);
-		__hostap_cmd_queue_free(local, entry, res);
-		spin_unlock(&local->cmdlock);
-	}
-}
-
-
-static inline int hfa384x_wait_offset(struct net_device *dev, u16 o_off)
-{
-	int tries = HFA384X_BAP_BUSY_TIMEOUT;
-	int res = HFA384X_INW(o_off) & HFA384X_OFFSET_BUSY;
-
-	while (res && tries > 0) {
-		tries--;
-		udelay(1);
-		res = HFA384X_INW(o_off) & HFA384X_OFFSET_BUSY;
-	}
-	return res;
-}
-
-
-/* Offset must be even */
-static int hfa384x_setup_bap(struct net_device *dev, u16 bap, u16 id,
-			     int offset)
-{
-	u16 o_off, s_off;
-	int ret = 0;
-
-	if (offset % 2 || bap > 1)
-		return -EINVAL;
-
-	if (bap == BAP1) {
-		o_off = HFA384X_OFFSET1_OFF;
-		s_off = HFA384X_SELECT1_OFF;
-	} else {
-		o_off = HFA384X_OFFSET0_OFF;
-		s_off = HFA384X_SELECT0_OFF;
-	}
-
-	if (hfa384x_wait_offset(dev, o_off)) {
-		prism2_io_debug_error(dev, 7);
-		printk(KERN_DEBUG "%s: hfa384x_setup_bap - timeout before\n",
-		       dev->name);
-		ret = -ETIMEDOUT;
-		goto out;
-	}
-
-	HFA384X_OUTW(id, s_off);
-	HFA384X_OUTW(offset, o_off);
-
-	if (hfa384x_wait_offset(dev, o_off)) {
-		prism2_io_debug_error(dev, 8);
-		printk(KERN_DEBUG "%s: hfa384x_setup_bap - timeout after\n",
-		       dev->name);
-		ret = -ETIMEDOUT;
-		goto out;
-	}
-#ifndef final_version
-	if (HFA384X_INW(o_off) & HFA384X_OFFSET_ERR) {
-		prism2_io_debug_error(dev, 9);
-		printk(KERN_DEBUG "%s: hfa384x_setup_bap - offset error "
-		       "(%d,0x04%x,%d); reg=0x%04x\n",
-		       dev->name, bap, id, offset, HFA384X_INW(o_off));
-		ret = -EINVAL;
-	}
-#endif
-
- out:
-	return ret;
-}
-
-
-static int hfa384x_get_rid(struct net_device *dev, u16 rid, void *buf, int len,
-			   int exact_len)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int res, rlen = 0;
-	struct hfa384x_rid_hdr rec;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->no_pri) {
-		printk(KERN_DEBUG "%s: cannot get RID %04x (len=%d) - no PRI "
-		       "f/w\n", dev->name, rid, len);
-		return -ENOTTY; /* Well.. not really correct, but return
-				 * something unique enough.. */
-	}
-
-	if ((local->func->card_present && !local->func->card_present(local)) ||
-	    local->hw_downloading)
-		return -ENODEV;
-
-	res = down_interruptible(&local->rid_bap_sem);
-	if (res)
-		return res;
-
-	res = hfa384x_cmd(dev, HFA384X_CMDCODE_ACCESS, rid, NULL, NULL);
-	if (res) {
-		printk(KERN_DEBUG "%s: hfa384x_get_rid: CMDCODE_ACCESS failed "
-		       "(res=%d, rid=%04x, len=%d)\n",
-		       dev->name, res, rid, len);
-		up(&local->rid_bap_sem);
-		return res;
-	}
-
-	spin_lock_bh(&local->baplock);
-
-	res = hfa384x_setup_bap(dev, BAP0, rid, 0);
-	if (!res)
-		res = hfa384x_from_bap(dev, BAP0, &rec, sizeof(rec));
-
-	if (le16_to_cpu(rec.len) == 0) {
-		/* RID not available */
-		res = -ENODATA;
-	}
-
-	rlen = (le16_to_cpu(rec.len) - 1) * 2;
-	if (!res && exact_len && rlen != len) {
-		printk(KERN_DEBUG "%s: hfa384x_get_rid - RID len mismatch: "
-		       "rid=0x%04x, len=%d (expected %d)\n",
-		       dev->name, rid, rlen, len);
-		res = -ENODATA;
-	}
-
-	if (!res)
-		res = hfa384x_from_bap(dev, BAP0, buf, len);
-
-	spin_unlock_bh(&local->baplock);
-	up(&local->rid_bap_sem);
-
-	if (res) {
-		if (res != -ENODATA)
-			printk(KERN_DEBUG "%s: hfa384x_get_rid (rid=%04x, "
-			       "len=%d) - failed - res=%d\n", dev->name, rid,
-			       len, res);
-		if (res == -ETIMEDOUT)
-			prism2_hw_reset(dev);
-		return res;
-	}
-
-	return rlen;
-}
-
-
-static int hfa384x_set_rid(struct net_device *dev, u16 rid, void *buf, int len)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct hfa384x_rid_hdr rec;
-	int res;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->no_pri) {
-		printk(KERN_DEBUG "%s: cannot set RID %04x (len=%d) - no PRI "
-		       "f/w\n", dev->name, rid, len);
-		return -ENOTTY; /* Well.. not really correct, but return
-				 * something unique enough.. */
-	}
-
-	if ((local->func->card_present && !local->func->card_present(local)) ||
-	    local->hw_downloading)
-		return -ENODEV;
-
-	rec.rid = cpu_to_le16(rid);
-	/* RID len in words and +1 for rec.rid */
-	rec.len = cpu_to_le16(len / 2 + len % 2 + 1);
-
-	res = down_interruptible(&local->rid_bap_sem);
-	if (res)
-		return res;
-
-	spin_lock_bh(&local->baplock);
-	res = hfa384x_setup_bap(dev, BAP0, rid, 0);
-	if (!res)
-		res = hfa384x_to_bap(dev, BAP0, &rec, sizeof(rec));
-	if (!res)
-		res = hfa384x_to_bap(dev, BAP0, buf, len);
-	spin_unlock_bh(&local->baplock);
-
-	if (res) {
-		printk(KERN_DEBUG "%s: hfa384x_set_rid (rid=%04x, len=%d) - "
-		       "failed - res=%d\n", dev->name, rid, len, res);
-		up(&local->rid_bap_sem);
-		return res;
-	}
-
-	res = hfa384x_cmd(dev, HFA384X_CMDCODE_ACCESS_WRITE, rid, NULL, NULL);
-	up(&local->rid_bap_sem);
-	if (res) {
-		printk(KERN_DEBUG "%s: hfa384x_set_rid: CMDCODE_ACCESS_WRITE "
-		       "failed (res=%d, rid=%04x, len=%d)\n",
-		       dev->name, res, rid, len);
-		return res;
-	}
-
-	if (res == -ETIMEDOUT)
-		prism2_hw_reset(dev);
-
-	return res;
-}
-
-
-static void hfa384x_disable_interrupts(struct net_device *dev)
-{
-	/* disable interrupts and clear event status */
-	HFA384X_OUTW(0, HFA384X_INTEN_OFF);
-	HFA384X_OUTW(0xffff, HFA384X_EVACK_OFF);
-}
-
-
-static void hfa384x_enable_interrupts(struct net_device *dev)
-{
-	/* ack pending events and enable interrupts from selected events */
-	HFA384X_OUTW(0xffff, HFA384X_EVACK_OFF);
-	HFA384X_OUTW(HFA384X_EVENT_MASK, HFA384X_INTEN_OFF);
-}
-
-
-static void hfa384x_events_no_bap0(struct net_device *dev)
-{
-	HFA384X_OUTW(HFA384X_EVENT_MASK & ~HFA384X_BAP0_EVENTS,
-		     HFA384X_INTEN_OFF);
-}
-
-
-static void hfa384x_events_all(struct net_device *dev)
-{
-	HFA384X_OUTW(HFA384X_EVENT_MASK, HFA384X_INTEN_OFF);
-}
-
-
-static void hfa384x_events_only_cmd(struct net_device *dev)
-{
-	HFA384X_OUTW(HFA384X_EV_CMD, HFA384X_INTEN_OFF);
-}
-
-
-static u16 hfa384x_allocate_fid(struct net_device *dev, int len)
-{
-	u16 fid;
-	unsigned long delay;
-
-	/* FIX: this could be replace with hfa384x_cmd() if the Alloc event
-	 * below would be handled like CmdCompl event (sleep here, wake up from
-	 * interrupt handler */
-	if (hfa384x_cmd_wait(dev, HFA384X_CMDCODE_ALLOC, len)) {
-		printk(KERN_DEBUG "%s: cannot allocate fid, len=%d\n",
-		       dev->name, len);
-		return 0xffff;
-	}
-
-	delay = jiffies + HFA384X_ALLOC_COMPL_TIMEOUT;
-	while (!(HFA384X_INW(HFA384X_EVSTAT_OFF) & HFA384X_EV_ALLOC) &&
-	       time_before(jiffies, delay))
-		yield();
-	if (!(HFA384X_INW(HFA384X_EVSTAT_OFF) & HFA384X_EV_ALLOC)) {
-		printk("%s: fid allocate, len=%d - timeout\n", dev->name, len);
-		return 0xffff;
-	}
-
-	fid = HFA384X_INW(HFA384X_ALLOCFID_OFF);
-	HFA384X_OUTW(HFA384X_EV_ALLOC, HFA384X_EVACK_OFF);
-
-	return fid;
-}
-
-
-static int prism2_reset_port(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int res;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (!local->dev_enabled)
-		return 0;
-
-	res = hfa384x_cmd(dev, HFA384X_CMDCODE_DISABLE, 0,
-			  NULL, NULL);
-	if (res)
-		printk(KERN_DEBUG "%s: reset port failed to disable port\n",
-		       dev->name);
-	else {
-		res = hfa384x_cmd(dev, HFA384X_CMDCODE_ENABLE, 0,
-				  NULL, NULL);
-		if (res)
-			printk(KERN_DEBUG "%s: reset port failed to enable "
-			       "port\n", dev->name);
-	}
-
-	/* It looks like at least some STA firmware versions reset
-	 * fragmentation threshold back to 2346 after enable command. Restore
-	 * the configured value, if it differs from this default. */
-	if (local->fragm_threshold != 2346 &&
-	    hostap_set_word(dev, HFA384X_RID_FRAGMENTATIONTHRESHOLD,
-			    local->fragm_threshold)) {
-		printk(KERN_DEBUG "%s: failed to restore fragmentation "
-		       "threshold (%d) after Port0 enable\n",
-		       dev->name, local->fragm_threshold);
-	}
-
-	return res;
-}
-
-
-static int prism2_get_version_info(struct net_device *dev, u16 rid,
-				   const char *txt)
-{
-	struct hfa384x_comp_ident comp;
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->no_pri) {
-		/* PRI f/w not yet available - cannot read RIDs */
-		return -1;
-	}
-	if (hfa384x_get_rid(dev, rid, &comp, sizeof(comp), 1) < 0) {
-		printk(KERN_DEBUG "Could not get RID for component %s\n", txt);
-		return -1;
-	}
-
-	printk(KERN_INFO "%s: %s: id=0x%02x v%d.%d.%d\n", dev->name, txt,
-	       __le16_to_cpu(comp.id), __le16_to_cpu(comp.major),
-	       __le16_to_cpu(comp.minor), __le16_to_cpu(comp.variant));
-	return 0;
-}
-
-
-static int prism2_setup_rids(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 tmp;
-	int ret = 0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	hostap_set_word(dev, HFA384X_RID_TICKTIME, 2000);
-
-	if (!local->fw_ap) {
-		tmp = hostap_get_porttype(local);
-		ret = hostap_set_word(dev, HFA384X_RID_CNFPORTTYPE, tmp);
-		if (ret) {
-			printk("%s: Port type setting to %d failed\n",
-			       dev->name, tmp);
-			goto fail;
-		}
-	}
-
-	/* Setting SSID to empty string seems to kill the card in Host AP mode
-	 */
-	if (local->iw_mode != IW_MODE_MASTER || local->essid[0] != '\0') {
-		ret = hostap_set_string(dev, HFA384X_RID_CNFOWNSSID,
-					local->essid);
-		if (ret) {
-			printk("%s: AP own SSID setting failed\n", dev->name);
-			goto fail;
-		}
-	}
-
-	ret = hostap_set_word(dev, HFA384X_RID_CNFMAXDATALEN,
-			      PRISM2_DATA_MAXLEN);
-	if (ret) {
-		printk("%s: MAC data length setting to %d failed\n",
-		       dev->name, PRISM2_DATA_MAXLEN);
-		goto fail;
-	}
-
-	if (hfa384x_get_rid(dev, HFA384X_RID_CHANNELLIST, &tmp, 2, 1) < 0) {
-		printk("%s: Channel list read failed\n", dev->name);
-		ret = -EINVAL;
-		goto fail;
-	}
-	local->channel_mask = __le16_to_cpu(tmp);
-
-	if (local->channel < 1 || local->channel > 14 ||
-	    !(local->channel_mask & (1 << (local->channel - 1)))) {
-		printk(KERN_WARNING "%s: Channel setting out of range "
-		       "(%d)!\n", dev->name, local->channel);
-		ret = -EBUSY;
-		goto fail;
-	}
-
-	ret = hostap_set_word(dev, HFA384X_RID_CNFOWNCHANNEL, local->channel);
-	if (ret) {
-		printk("%s: Channel setting to %d failed\n",
-		       dev->name, local->channel);
-		goto fail;
-	}
-
-	ret = hostap_set_word(dev, HFA384X_RID_CNFBEACONINT,
-			      local->beacon_int);
-	if (ret) {
-		printk("%s: Beacon interval setting to %d failed\n",
-		       dev->name, local->beacon_int);
-		/* this may fail with Symbol/Lucent firmware */
-		if (ret == -ETIMEDOUT)
-			goto fail;
-	}
-
-	ret = hostap_set_word(dev, HFA384X_RID_CNFOWNDTIMPERIOD,
-			      local->dtim_period);
-	if (ret) {
-		printk("%s: DTIM period setting to %d failed\n",
-		       dev->name, local->dtim_period);
-		/* this may fail with Symbol/Lucent firmware */
-		if (ret == -ETIMEDOUT)
-			goto fail;
-	}
-
-	ret = hostap_set_word(dev, HFA384X_RID_PROMISCUOUSMODE,
-			      local->is_promisc);
-	if (ret)
-		printk(KERN_INFO "%s: Setting promiscuous mode (%d) failed\n",
-		       dev->name, local->is_promisc);
-
-	if (!local->fw_ap) {
-		ret = hostap_set_string(dev, HFA384X_RID_CNFDESIREDSSID,
-					local->essid);
-		if (ret) {
-			printk("%s: Desired SSID setting failed\n", dev->name);
-			goto fail;
-		}
-	}
-
-	/* Setup TXRateControl, defaults to allow use of 1, 2, 5.5, and
-	 * 11 Mbps in automatic TX rate fallback and 1 and 2 Mbps as basic
-	 * rates */
-	if (local->tx_rate_control == 0) {
-		local->tx_rate_control =
-			HFA384X_RATES_1MBPS |
-			HFA384X_RATES_2MBPS |
-			HFA384X_RATES_5MBPS |
-			HFA384X_RATES_11MBPS;
-	}
-	if (local->basic_rates == 0)
-		local->basic_rates = HFA384X_RATES_1MBPS | HFA384X_RATES_2MBPS;
-
-	if (!local->fw_ap) {
-		ret = hostap_set_word(dev, HFA384X_RID_TXRATECONTROL,
-				      local->tx_rate_control);
-		if (ret) {
-			printk("%s: TXRateControl setting to %d failed\n",
-			       dev->name, local->tx_rate_control);
-			goto fail;
-		}
-
-		ret = hostap_set_word(dev, HFA384X_RID_CNFSUPPORTEDRATES,
-				      local->tx_rate_control);
-		if (ret) {
-			printk("%s: cnfSupportedRates setting to %d failed\n",
-			       dev->name, local->tx_rate_control);
-		}
-
-		ret = hostap_set_word(dev, HFA384X_RID_CNFBASICRATES,
-				      local->basic_rates);
-		if (ret) {
-			printk("%s: cnfBasicRates setting to %d failed\n",
-			       dev->name, local->basic_rates);
-		}
-
-		ret = hostap_set_word(dev, HFA384X_RID_CREATEIBSS, 1);
-		if (ret) {
-			printk("%s: Create IBSS setting to 1 failed\n",
-			       dev->name);
-		}
-	}
-
-	if (local->name_set)
-		(void) hostap_set_string(dev, HFA384X_RID_CNFOWNNAME,
-					 local->name);
-
-	if (hostap_set_encryption(local)) {
-		printk(KERN_INFO "%s: could not configure encryption\n",
-		       dev->name);
-	}
-
-	(void) hostap_set_antsel(local);
-
-	if (hostap_set_roaming(local)) {
-		printk(KERN_INFO "%s: could not set host roaming\n",
-		       dev->name);
-	}
-
-	if (local->sta_fw_ver >= PRISM2_FW_VER(1,6,3) &&
-	    hostap_set_word(dev, HFA384X_RID_CNFENHSECURITY, local->enh_sec))
-		printk(KERN_INFO "%s: cnfEnhSecurity setting to 0x%x failed\n",
-		       dev->name, local->enh_sec);
-
-	/* 32-bit tallies were added in STA f/w 0.8.0, but they were apparently
-	 * not working correctly (last seven counters report bogus values).
-	 * This has been fixed in 0.8.2, so enable 32-bit tallies only
-	 * beginning with that firmware version. Another bug fix for 32-bit
-	 * tallies in 1.4.0; should 16-bit tallies be used for some other
-	 * versions, too? */
-	if (local->sta_fw_ver >= PRISM2_FW_VER(0,8,2)) {
-		if (hostap_set_word(dev, HFA384X_RID_CNFTHIRTY2TALLY, 1)) {
-			printk(KERN_INFO "%s: cnfThirty2Tally setting "
-			       "failed\n", dev->name);
-			local->tallies32 = 0;
-		} else
-			local->tallies32 = 1;
-	} else
-		local->tallies32 = 0;
-
-	hostap_set_auth_algs(local);
-
-	if (hostap_set_word(dev, HFA384X_RID_FRAGMENTATIONTHRESHOLD,
-			    local->fragm_threshold)) {
-		printk(KERN_INFO "%s: setting FragmentationThreshold to %d "
-		       "failed\n", dev->name, local->fragm_threshold);
-	}
-
-	if (hostap_set_word(dev, HFA384X_RID_RTSTHRESHOLD,
-			    local->rts_threshold)) {
-		printk(KERN_INFO "%s: setting RTSThreshold to %d failed\n",
-		       dev->name, local->rts_threshold);
-	}
-
-	if (local->manual_retry_count >= 0 &&
-	    hostap_set_word(dev, HFA384X_RID_CNFALTRETRYCOUNT,
-			    local->manual_retry_count)) {
-		printk(KERN_INFO "%s: setting cnfAltRetryCount to %d failed\n",
-		       dev->name, local->manual_retry_count);
-	}
-
-	if (local->sta_fw_ver >= PRISM2_FW_VER(1,3,1) &&
-	    hfa384x_get_rid(dev, HFA384X_RID_CNFDBMADJUST, &tmp, 2, 1) == 2) {
-		local->rssi_to_dBm = le16_to_cpu(tmp);
-	}
-
-	if (local->sta_fw_ver >= PRISM2_FW_VER(1,7,0) && local->wpa &&
-	    hostap_set_word(dev, HFA384X_RID_SSNHANDLINGMODE, 1)) {
-		printk(KERN_INFO "%s: setting ssnHandlingMode to 1 failed\n",
-		       dev->name);
-	}
-
-	if (local->sta_fw_ver >= PRISM2_FW_VER(1,7,0) && local->generic_elem &&
-	    hfa384x_set_rid(dev, HFA384X_RID_GENERICELEMENT,
-			    local->generic_elem, local->generic_elem_len)) {
-		printk(KERN_INFO "%s: setting genericElement failed\n",
-		       dev->name);
-	}
-
- fail:
-	return ret;
-}
-
-
-static int prism2_hw_init(struct net_device *dev, int initial)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int ret, first = 1;
-	unsigned long start, delay;
-
-	PDEBUG(DEBUG_FLOW, "prism2_hw_init()\n");
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	clear_bit(HOSTAP_BITS_TRANSMIT, &local->bits);
-
- init:
-	/* initialize HFA 384x */
-	ret = hfa384x_cmd_no_wait(dev, HFA384X_CMDCODE_INIT, 0);
-	if (ret) {
-		printk(KERN_INFO "%s: first command failed - assuming card "
-		       "does not have primary firmware\n", dev_info);
-	}
-
-	if (first && (HFA384X_INW(HFA384X_EVSTAT_OFF) & HFA384X_EV_CMD)) {
-		/* EvStat has Cmd bit set in some cases, so retry once if no
-		 * wait was needed */
-		HFA384X_OUTW(HFA384X_EV_CMD, HFA384X_EVACK_OFF);
-		printk(KERN_DEBUG "%s: init command completed too quickly - "
-		       "retrying\n", dev->name);
-		first = 0;
-		goto init;
-	}
-
-	start = jiffies;
-	delay = jiffies + HFA384X_INIT_TIMEOUT;
-	while (!(HFA384X_INW(HFA384X_EVSTAT_OFF) & HFA384X_EV_CMD) &&
-	       time_before(jiffies, delay))
-		yield();
-	if (!(HFA384X_INW(HFA384X_EVSTAT_OFF) & HFA384X_EV_CMD)) {
-		printk(KERN_DEBUG "%s: assuming no Primary image in "
-		       "flash - card initialization not completed\n",
-		       dev_info);
-		local->no_pri = 1;
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-			if (local->sram_type == -1)
-				local->sram_type = prism2_get_ram_size(local);
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-		return 1;
-	}
-	local->no_pri = 0;
-	printk(KERN_DEBUG "prism2_hw_init: initialized in %lu ms\n",
-	       (jiffies - start) * 1000 / HZ);
-	HFA384X_OUTW(HFA384X_EV_CMD, HFA384X_EVACK_OFF);
-	return 0;
-}
-
-
-static int prism2_hw_init2(struct net_device *dev, int initial)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int i;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-	kfree(local->pda);
-	if (local->no_pri)
-		local->pda = NULL;
-	else
-		local->pda = prism2_read_pda(dev);
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-
-	hfa384x_disable_interrupts(dev);
-
-#ifndef final_version
-	HFA384X_OUTW(HFA384X_MAGIC, HFA384X_SWSUPPORT0_OFF);
-	if (HFA384X_INW(HFA384X_SWSUPPORT0_OFF) != HFA384X_MAGIC) {
-		printk("SWSUPPORT0 write/read failed: %04X != %04X\n",
-		       HFA384X_INW(HFA384X_SWSUPPORT0_OFF), HFA384X_MAGIC);
-		goto failed;
-	}
-#endif
-
-	if (initial || local->pri_only) {
-		hfa384x_events_only_cmd(dev);
-		/* get card version information */
-		if (prism2_get_version_info(dev, HFA384X_RID_NICID, "NIC") ||
-		    prism2_get_version_info(dev, HFA384X_RID_PRIID, "PRI")) {
-			hfa384x_disable_interrupts(dev);
-			goto failed;
-		}
-
-		if (prism2_get_version_info(dev, HFA384X_RID_STAID, "STA")) {
-			printk(KERN_DEBUG "%s: Failed to read STA f/w version "
-			       "- only Primary f/w present\n", dev->name);
-			local->pri_only = 1;
-			return 0;
-		}
-		local->pri_only = 0;
-		hfa384x_disable_interrupts(dev);
-	}
-
-	/* FIX: could convert allocate_fid to use sleeping CmdCompl wait and
-	 * enable interrupts before this. This would also require some sort of
-	 * sleeping AllocEv waiting */
-
-	/* allocate TX FIDs */
-	local->txfid_len = PRISM2_TXFID_LEN;
-	for (i = 0; i < PRISM2_TXFID_COUNT; i++) {
-		local->txfid[i] = hfa384x_allocate_fid(dev, local->txfid_len);
-		if (local->txfid[i] == 0xffff && local->txfid_len > 1600) {
-			local->txfid[i] = hfa384x_allocate_fid(dev, 1600);
-			if (local->txfid[i] != 0xffff) {
-				printk(KERN_DEBUG "%s: Using shorter TX FID "
-				       "(1600 bytes)\n", dev->name);
-				local->txfid_len = 1600;
-			}
-		}
-		if (local->txfid[i] == 0xffff)
-			goto failed;
-		local->intransmitfid[i] = PRISM2_TXFID_EMPTY;
-	}
-
-	hfa384x_events_only_cmd(dev);
-
-	if (initial) {
-		struct list_head *ptr;
-		prism2_check_sta_fw_version(local);
-
-		if (hfa384x_get_rid(dev, HFA384X_RID_CNFOWNMACADDR,
-				    &dev->dev_addr, 6, 1) < 0) {
-			printk("%s: could not get own MAC address\n",
-			       dev->name);
-		}
-		list_for_each(ptr, &local->hostap_interfaces) {
-			iface = list_entry(ptr, struct hostap_interface, list);
-			memcpy(iface->dev->dev_addr, dev->dev_addr, ETH_ALEN);
-		}
-	} else if (local->fw_ap)
-		prism2_check_sta_fw_version(local);
-
-	prism2_setup_rids(dev);
-
-	/* MAC is now configured, but port 0 is not yet enabled */
-	return 0;
-
- failed:
-	if (!local->no_pri)
-		printk(KERN_WARNING "%s: Initialization failed\n", dev_info);
-	return 1;
-}
-
-
-static int prism2_hw_enable(struct net_device *dev, int initial)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int was_resetting;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	was_resetting = local->hw_resetting;
-
-	if (hfa384x_cmd(dev, HFA384X_CMDCODE_ENABLE, 0, NULL, NULL)) {
-		printk("%s: MAC port 0 enabling failed\n", dev->name);
-		return 1;
-	}
-
-	local->hw_ready = 1;
-	local->hw_reset_tries = 0;
-	local->hw_resetting = 0;
-	hfa384x_enable_interrupts(dev);
-
-	/* at least D-Link DWL-650 seems to require additional port reset
-	 * before it starts acting as an AP, so reset port automatically
-	 * here just in case */
-	if (initial && prism2_reset_port(dev)) {
-		printk("%s: MAC port 0 reseting failed\n", dev->name);
-		return 1;
-	}
-
-	if (was_resetting && netif_queue_stopped(dev)) {
-		/* If hw_reset() was called during pending transmit, netif
-		 * queue was stopped. Wake it up now since the wlan card has
-		 * been resetted. */
-		netif_wake_queue(dev);
-	}
-
-	return 0;
-}
-
-
-static int prism2_hw_config(struct net_device *dev, int initial)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->hw_downloading)
-		return 1;
-
-	if (prism2_hw_init(dev, initial)) {
-		return local->no_pri ? 0 : 1;
-	}
-
-	if (prism2_hw_init2(dev, initial))
-		return 1;
-
-	/* Enable firmware if secondary image is loaded and at least one of the
-	 * netdevices is up. */
-	if (!local->pri_only &&
-	    (initial == 0 || (initial == 2 && local->num_dev_open > 0))) {
-		if (!local->dev_enabled)
-			prism2_callback(local, PRISM2_CALLBACK_ENABLE);
-		local->dev_enabled = 1;
-		return prism2_hw_enable(dev, initial);
-	}
-
-	return 0;
-}
-
-
-static void prism2_hw_shutdown(struct net_device *dev, int no_disable)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	/* Allow only command completion events during disable */
-	hfa384x_events_only_cmd(dev);
-
-	local->hw_ready = 0;
-	if (local->dev_enabled)
-		prism2_callback(local, PRISM2_CALLBACK_DISABLE);
-	local->dev_enabled = 0;
-
-	if (local->func->card_present && !local->func->card_present(local)) {
-		printk(KERN_DEBUG "%s: card already removed or not configured "
-		       "during shutdown\n", dev->name);
-		return;
-	}
-
-	if ((no_disable & HOSTAP_HW_NO_DISABLE) == 0 &&
-	    hfa384x_cmd(dev, HFA384X_CMDCODE_DISABLE, 0, NULL, NULL))
-		printk(KERN_WARNING "%s: Shutdown failed\n", dev_info);
-
-	hfa384x_disable_interrupts(dev);
-
-	if (no_disable & HOSTAP_HW_ENABLE_CMDCOMPL)
-		hfa384x_events_only_cmd(dev);
-	else
-		prism2_clear_cmd_queue(local);
-}
-
-
-static void prism2_hw_reset(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-#if 0
-	static long last_reset = 0;
-
-	/* do not reset card more than once per second to avoid ending up in a
-	 * busy loop reseting the card */
-	if (time_before_eq(jiffies, last_reset + HZ))
-		return;
-	last_reset = jiffies;
-#endif
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (in_interrupt()) {
-		printk(KERN_DEBUG "%s: driver bug - prism2_hw_reset() called "
-		       "in interrupt context\n", dev->name);
-		return;
-	}
-
-	if (local->hw_downloading)
-		return;
-
-	if (local->hw_resetting) {
-		printk(KERN_WARNING "%s: %s: already resetting card - "
-		       "ignoring reset request\n", dev_info, dev->name);
-		return;
-	}
-
-	local->hw_reset_tries++;
-	if (local->hw_reset_tries > 10) {
-		printk(KERN_WARNING "%s: too many reset tries, skipping\n",
-		       dev->name);
-		return;
-	}
-
-	printk(KERN_WARNING "%s: %s: resetting card\n", dev_info, dev->name);
-	hfa384x_disable_interrupts(dev);
-	local->hw_resetting = 1;
-	if (local->func->cor_sreset) {
-		/* Host system seems to hang in some cases with high traffic
-		 * load or shared interrupts during COR sreset. Disable shared
-		 * interrupts during reset to avoid these crashes. COS sreset
-		 * takes quite a long time, so it is unfortunate that this
-		 * seems to be needed. Anyway, I do not know of any better way
-		 * of avoiding the crash. */
-		disable_irq(dev->irq);
-		local->func->cor_sreset(local);
-		enable_irq(dev->irq);
-	}
-	prism2_hw_shutdown(dev, 1);
-	prism2_hw_config(dev, 0);
-	local->hw_resetting = 0;
-
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-	if (local->dl_pri) {
-		printk(KERN_DEBUG "%s: persistent download of primary "
-		       "firmware\n", dev->name);
-		if (prism2_download_genesis(local, local->dl_pri) < 0)
-			printk(KERN_WARNING "%s: download (PRI) failed\n",
-			       dev->name);
-	}
-
-	if (local->dl_sec) {
-		printk(KERN_DEBUG "%s: persistent download of secondary "
-		       "firmware\n", dev->name);
-		if (prism2_download_volatile(local, local->dl_sec) < 0)
-			printk(KERN_WARNING "%s: download (SEC) failed\n",
-			       dev->name);
-	}
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-
-	/* TODO: restore beacon TIM bits for STAs that have buffered frames */
-}
-
-
-static void prism2_schedule_reset(local_info_t *local)
-{
-	schedule_work(&local->reset_queue);
-}
-
-
-/* Called only as scheduled task after noticing card timeout in interrupt
- * context */
-static void handle_reset_queue(void *data)
-{
-	local_info_t *local = (local_info_t *) data;
-
-	printk(KERN_DEBUG "%s: scheduled card reset\n", local->dev->name);
-	prism2_hw_reset(local->dev);
-
-	if (netif_queue_stopped(local->dev)) {
-		int i;
-
-		for (i = 0; i < PRISM2_TXFID_COUNT; i++)
-			if (local->intransmitfid[i] == PRISM2_TXFID_EMPTY) {
-				PDEBUG(DEBUG_EXTRA, "prism2_tx_timeout: "
-				       "wake up queue\n");
-				netif_wake_queue(local->dev);
-				break;
-			}
-	}
-}
-
-
-static int prism2_get_txfid_idx(local_info_t *local)
-{
-	int idx, end;
-	unsigned long flags;
-
-	spin_lock_irqsave(&local->txfidlock, flags);
-	end = idx = local->next_txfid;
-	do {
-		if (local->intransmitfid[idx] == PRISM2_TXFID_EMPTY) {
-			local->intransmitfid[idx] = PRISM2_TXFID_RESERVED;
-			spin_unlock_irqrestore(&local->txfidlock, flags);
-			return idx;
-		}
-		idx++;
-		if (idx >= PRISM2_TXFID_COUNT)
-			idx = 0;
-	} while (idx != end);
-	spin_unlock_irqrestore(&local->txfidlock, flags);
-
-	PDEBUG(DEBUG_EXTRA2, "prism2_get_txfid_idx: no room in txfid buf: "
-	       "packet dropped\n");
-	local->stats.tx_dropped++;
-
-	return -1;
-}
-
-
-/* Called only from hardware IRQ */
-static void prism2_transmit_cb(struct net_device *dev, long context,
-			       u16 resp0, u16 res)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int idx = (int) context;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (res) {
-		printk(KERN_DEBUG "%s: prism2_transmit_cb - res=0x%02x\n",
-		       dev->name, res);
-		return;
-	}
-
-	if (idx < 0 || idx >= PRISM2_TXFID_COUNT) {
-		printk(KERN_DEBUG "%s: prism2_transmit_cb called with invalid "
-		       "idx=%d\n", dev->name, idx);
-		return;
-	}
-
-	if (!test_and_clear_bit(HOSTAP_BITS_TRANSMIT, &local->bits)) {
-		printk(KERN_DEBUG "%s: driver bug: prism2_transmit_cb called "
-		       "with no pending transmit\n", dev->name);
-	}
-
-	if (netif_queue_stopped(dev)) {
-		/* ready for next TX, so wake up queue that was stopped in
-		 * prism2_transmit() */
-		netif_wake_queue(dev);
-	}
-
-	spin_lock(&local->txfidlock);
-
-	/* With reclaim, Resp0 contains new txfid for transmit; the old txfid
-	 * will be automatically allocated for the next TX frame */
-	local->intransmitfid[idx] = resp0;
-
-	PDEBUG(DEBUG_FID, "%s: prism2_transmit_cb: txfid[%d]=0x%04x, "
-	       "resp0=0x%04x, transmit_txfid=0x%04x\n",
-	       dev->name, idx, local->txfid[idx],
-	       resp0, local->intransmitfid[local->next_txfid]);
-
-	idx++;
-	if (idx >= PRISM2_TXFID_COUNT)
-		idx = 0;
-	local->next_txfid = idx;
-
-	/* check if all TX buffers are occupied */
-	do {
-		if (local->intransmitfid[idx] == PRISM2_TXFID_EMPTY) {
-			spin_unlock(&local->txfidlock);
-			return;
-		}
-		idx++;
-		if (idx >= PRISM2_TXFID_COUNT)
-			idx = 0;
-	} while (idx != local->next_txfid);
-	spin_unlock(&local->txfidlock);
-
-	/* no empty TX buffers, stop queue */
-	netif_stop_queue(dev);
-}
-
-
-/* Called only from software IRQ if PCI bus master is not used (with bus master
- * this can be called both from software and hardware IRQ) */
-static int prism2_transmit(struct net_device *dev, int idx)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int res;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	/* The driver tries to stop netif queue so that there would not be
-	 * more than one attempt to transmit frames going on; check that this
-	 * is really the case */
-
-	if (test_and_set_bit(HOSTAP_BITS_TRANSMIT, &local->bits)) {
-		printk(KERN_DEBUG "%s: driver bug - prism2_transmit() called "
-		       "when previous TX was pending\n", dev->name);
-		return -1;
-	}
-
-	/* stop the queue for the time that transmit is pending */
-	netif_stop_queue(dev);
-
-	/* transmit packet */
-	res = hfa384x_cmd_callback(
-		dev,
-		HFA384X_CMDCODE_TRANSMIT | HFA384X_CMD_TX_RECLAIM,
-		local->txfid[idx],
-		prism2_transmit_cb, (long) idx);
-
-	if (res) {
-		struct net_device_stats *stats;
-		printk(KERN_DEBUG "%s: prism2_transmit: CMDCODE_TRANSMIT "
-		       "failed (res=%d)\n", dev->name, res);
-		stats = hostap_get_stats(dev);
-		stats->tx_dropped++;
-		netif_wake_queue(dev);
-		return -1;
-	}
-	dev->trans_start = jiffies;
-
-	/* Since we did not wait for command completion, the card continues
-	 * to process on the background and we will finish handling when
-	 * command completion event is handled (prism2_cmd_ev() function) */
-
-	return 0;
-}
-
-
-/* Send IEEE 802.11 frame (convert the header into Prism2 TX descriptor and
- * send the payload with this descriptor) */
-/* Called only from software IRQ */
-static int prism2_tx_80211(struct sk_buff *skb, struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct hfa384x_tx_frame txdesc;
-	struct hostap_skb_tx_data *meta;
-	int hdr_len, data_len, idx, res, ret = -1;
-	u16 tx_control, fc;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	meta = (struct hostap_skb_tx_data *) skb->cb;
-
-	prism2_callback(local, PRISM2_CALLBACK_TX_START);
-
-	if ((local->func->card_present && !local->func->card_present(local)) ||
-	    !local->hw_ready || local->hw_downloading || local->pri_only) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "%s: prism2_tx_80211: hw not ready -"
-			       " skipping\n", dev->name);
-		}
-		goto fail;
-	}
-
-	memset(&txdesc, 0, sizeof(txdesc));
-
-	/* skb->data starts with txdesc->frame_control */
-	hdr_len = 24;
-	memcpy(&txdesc.frame_control, skb->data, hdr_len);
- 	fc = le16_to_cpu(txdesc.frame_control);
-	if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA &&
-	    (fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS) &&
-	    skb->len >= 30) {
-		/* Addr4 */
-		memcpy(txdesc.addr4, skb->data + hdr_len, ETH_ALEN);
-		hdr_len += ETH_ALEN;
-	}
-
-	tx_control = local->tx_control;
-	if (meta->tx_cb_idx) {
-		tx_control |= HFA384X_TX_CTRL_TX_OK;
-		txdesc.sw_support = cpu_to_le16(meta->tx_cb_idx);
-	}
-	txdesc.tx_control = cpu_to_le16(tx_control);
-	txdesc.tx_rate = meta->rate;
-
-	data_len = skb->len - hdr_len;
-	txdesc.data_len = cpu_to_le16(data_len);
-	txdesc.len = cpu_to_be16(data_len);
-
-	idx = prism2_get_txfid_idx(local);
-	if (idx < 0)
-		goto fail;
-
-	if (local->frame_dump & PRISM2_DUMP_TX_HDR)
-		hostap_dump_tx_header(dev->name, &txdesc);
-
-	spin_lock(&local->baplock);
-	res = hfa384x_setup_bap(dev, BAP0, local->txfid[idx], 0);
-
-	if (!res)
-		res = hfa384x_to_bap(dev, BAP0, &txdesc, sizeof(txdesc));
-	if (!res)
-		res = hfa384x_to_bap(dev, BAP0, skb->data + hdr_len,
-				     skb->len - hdr_len);
-	spin_unlock(&local->baplock);
-
-	if (!res)
-		res = prism2_transmit(dev, idx);
-	if (res) {
-		printk(KERN_DEBUG "%s: prism2_tx_80211 - to BAP0 failed\n",
-		       dev->name);
-		local->intransmitfid[idx] = PRISM2_TXFID_EMPTY;
-		schedule_work(&local->reset_queue);
-		goto fail;
-	}
-
-	ret = 0;
-
-fail:
-	prism2_callback(local, PRISM2_CALLBACK_TX_END);
-	return ret;
-}
-
-
-/* Some SMP systems have reported number of odd errors with hostap_pci. fid
- * register has changed values between consecutive reads for an unknown reason.
- * This should really not happen, so more debugging is needed. This test
- * version is a big slower, but it will detect most of such register changes
- * and will try to get the correct fid eventually. */
-#define EXTRA_FID_READ_TESTS
-
-static inline u16 prism2_read_fid_reg(struct net_device *dev, u16 reg)
-{
-#ifdef EXTRA_FID_READ_TESTS
-	u16 val, val2, val3;
-	int i;
-
-	for (i = 0; i < 10; i++) {
-		val = HFA384X_INW(reg);
-		val2 = HFA384X_INW(reg);
-		val3 = HFA384X_INW(reg);
-
-		if (val == val2 && val == val3)
-			return val;
-
-		printk(KERN_DEBUG "%s: detected fid change (try=%d, reg=%04x):"
-		       " %04x %04x %04x\n",
-		       dev->name, i, reg, val, val2, val3);
-		if ((val == val2 || val == val3) && val != 0)
-			return val;
-		if (val2 == val3 && val2 != 0)
-			return val2;
-	}
-	printk(KERN_WARNING "%s: Uhhuh.. could not read good fid from reg "
-	       "%04x (%04x %04x %04x)\n", dev->name, reg, val, val2, val3);
-	return val;
-#else /* EXTRA_FID_READ_TESTS */
-	return HFA384X_INW(reg);
-#endif /* EXTRA_FID_READ_TESTS */
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_rx(local_info_t *local)
-{
-	struct net_device *dev = local->dev;
-	int res, rx_pending = 0;
-	u16 len, hdr_len, rxfid, status, macport;
-	struct net_device_stats *stats;
-	struct hfa384x_rx_frame rxdesc;
-	struct sk_buff *skb = NULL;
-
-	prism2_callback(local, PRISM2_CALLBACK_RX_START);
-	stats = hostap_get_stats(dev);
-
-	rxfid = prism2_read_fid_reg(dev, HFA384X_RXFID_OFF);
-#ifndef final_version
-	if (rxfid == 0) {
-		rxfid = HFA384X_INW(HFA384X_RXFID_OFF);
-		printk(KERN_DEBUG "prism2_rx: rxfid=0 (next 0x%04x)\n",
-		       rxfid);
-		if (rxfid == 0) {
-			schedule_work(&local->reset_queue);
-			goto rx_dropped;
-		}
-		/* try to continue with the new rxfid value */
-	}
-#endif
-
-	spin_lock(&local->baplock);
-	res = hfa384x_setup_bap(dev, BAP0, rxfid, 0);
-	if (!res)
-		res = hfa384x_from_bap(dev, BAP0, &rxdesc, sizeof(rxdesc));
-
-	if (res) {
-		spin_unlock(&local->baplock);
-		printk(KERN_DEBUG "%s: copy from BAP0 failed %d\n", dev->name,
-		       res);
-		if (res == -ETIMEDOUT) {
-			schedule_work(&local->reset_queue);
-		}
-		goto rx_dropped;
-	}
-
-	len = le16_to_cpu(rxdesc.data_len);
-	hdr_len = sizeof(rxdesc);
-	status = le16_to_cpu(rxdesc.status);
-	macport = (status >> 8) & 0x07;
-
-	/* Drop frames with too large reported payload length. Monitor mode
-	 * seems to sometimes pass frames (e.g., ctrl::ack) with signed and
-	 * negative value, so allow also values 65522 .. 65534 (-14 .. -2) for
-	 * macport 7 */
-	if (len > PRISM2_DATA_MAXLEN + 8 /* WEP */) {
-		if (macport == 7 && local->iw_mode == IW_MODE_MONITOR) {
-			if (len >= (u16) -14) {
-				hdr_len -= 65535 - len;
-				hdr_len--;
-			}
-			len = 0;
-		} else {
-			spin_unlock(&local->baplock);
-			printk(KERN_DEBUG "%s: Received frame with invalid "
-			       "length 0x%04x\n", dev->name, len);
-			hostap_dump_rx_header(dev->name, &rxdesc);
-			goto rx_dropped;
-		}
-	}
-
-	skb = dev_alloc_skb(len + hdr_len);
-	if (!skb) {
-		spin_unlock(&local->baplock);
-		printk(KERN_DEBUG "%s: RX failed to allocate skb\n",
-		       dev->name);
-		goto rx_dropped;
-	}
-	skb->dev = dev;
-	memcpy(skb_put(skb, hdr_len), &rxdesc, hdr_len);
-
-	if (len > 0)
-		res = hfa384x_from_bap(dev, BAP0, skb_put(skb, len), len);
-	spin_unlock(&local->baplock);
-	if (res) {
-		printk(KERN_DEBUG "%s: RX failed to read "
-		       "frame data\n", dev->name);
-		goto rx_dropped;
-	}
-
-	skb_queue_tail(&local->rx_list, skb);
-	tasklet_schedule(&local->rx_tasklet);
-
- rx_exit:
-	prism2_callback(local, PRISM2_CALLBACK_RX_END);
-	if (!rx_pending) {
-		HFA384X_OUTW(HFA384X_EV_RX, HFA384X_EVACK_OFF);
-	}
-
-	return;
-
- rx_dropped:
-	stats->rx_dropped++;
-	if (skb)
-		dev_kfree_skb(skb);
-	goto rx_exit;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void hostap_rx_skb(local_info_t *local, struct sk_buff *skb)
-{
-	struct hfa384x_rx_frame *rxdesc;
-	struct net_device *dev = skb->dev;
-	struct hostap_80211_rx_status stats;
-	int hdrlen, rx_hdrlen;
-
-	rx_hdrlen = sizeof(*rxdesc);
-	if (skb->len < sizeof(*rxdesc)) {
-		/* Allow monitor mode to receive shorter frames */
-		if (local->iw_mode == IW_MODE_MONITOR &&
-		    skb->len >= sizeof(*rxdesc) - 30) {
-			rx_hdrlen = skb->len;
-		} else {
-			dev_kfree_skb(skb);
-			return;
-		}
-	}
-
-	rxdesc = (struct hfa384x_rx_frame *) skb->data;
-
-	if (local->frame_dump & PRISM2_DUMP_RX_HDR &&
-	    skb->len >= sizeof(*rxdesc))
-		hostap_dump_rx_header(dev->name, rxdesc);
-
-	if (le16_to_cpu(rxdesc->status) & HFA384X_RX_STATUS_FCSERR &&
-	    (!local->monitor_allow_fcserr ||
-	     local->iw_mode != IW_MODE_MONITOR))
-		goto drop;
-
-	if (skb->len > PRISM2_DATA_MAXLEN) {
-		printk(KERN_DEBUG "%s: RX: len(%d) > MAX(%d)\n",
-		       dev->name, skb->len, PRISM2_DATA_MAXLEN);
-		goto drop;
-	}
-
-	stats.mac_time = le32_to_cpu(rxdesc->time);
-	stats.signal = rxdesc->signal - local->rssi_to_dBm;
-	stats.noise = rxdesc->silence - local->rssi_to_dBm;
-	stats.rate = rxdesc->rate;
-
-	/* Convert Prism2 RX structure into IEEE 802.11 header */
-	hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(rxdesc->frame_control));
-	if (hdrlen > rx_hdrlen)
-		hdrlen = rx_hdrlen;
-
-	memmove(skb_pull(skb, rx_hdrlen - hdrlen),
-		&rxdesc->frame_control, hdrlen);
-
-	hostap_80211_rx(dev, skb, &stats);
-	return;
-
- drop:
-	dev_kfree_skb(skb);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void hostap_rx_tasklet(unsigned long data)
-{
-	local_info_t *local = (local_info_t *) data;
-	struct sk_buff *skb;
-
-	while ((skb = skb_dequeue(&local->rx_list)) != NULL)
-		hostap_rx_skb(local, skb);
-}
-
-
-/* Called only from hardware IRQ */
-static void prism2_alloc_ev(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int idx;
-	u16 fid;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	fid = prism2_read_fid_reg(dev, HFA384X_ALLOCFID_OFF);
-
-	PDEBUG(DEBUG_FID, "FID: interrupt: ALLOC - fid=0x%04x\n", fid);
-
-	spin_lock(&local->txfidlock);
-	idx = local->next_alloc;
-
-	do {
-		if (local->txfid[idx] == fid) {
-			PDEBUG(DEBUG_FID, "FID: found matching txfid[%d]\n",
-			       idx);
-
-#ifndef final_version
-			if (local->intransmitfid[idx] == PRISM2_TXFID_EMPTY)
-				printk("Already released txfid found at idx "
-				       "%d\n", idx);
-			if (local->intransmitfid[idx] == PRISM2_TXFID_RESERVED)
-				printk("Already reserved txfid found at idx "
-				       "%d\n", idx);
-#endif
-			local->intransmitfid[idx] = PRISM2_TXFID_EMPTY;
-			idx++;
-			local->next_alloc = idx >= PRISM2_TXFID_COUNT ? 0 :
-				idx;
-
-			if (!test_bit(HOSTAP_BITS_TRANSMIT, &local->bits) &&
-			    netif_queue_stopped(dev))
-				netif_wake_queue(dev);
-
-			spin_unlock(&local->txfidlock);
-			return;
-		}
-
-		idx++;
-		if (idx >= PRISM2_TXFID_COUNT)
-			idx = 0;
-	} while (idx != local->next_alloc);
-
-	printk(KERN_WARNING "%s: could not find matching txfid (0x%04x, new "
-	       "read 0x%04x) for alloc event\n", dev->name, fid,
-	       HFA384X_INW(HFA384X_ALLOCFID_OFF));
-	printk(KERN_DEBUG "TXFIDs:");
-	for (idx = 0; idx < PRISM2_TXFID_COUNT; idx++)
-		printk(" %04x[%04x]", local->txfid[idx],
-		       local->intransmitfid[idx]);
-	printk("\n");
-	spin_unlock(&local->txfidlock);
-
-	/* FIX: should probably schedule reset; reference to one txfid was lost
-	 * completely.. Bad things will happen if we run out of txfids
-	 * Actually, this will cause netdev watchdog to notice TX timeout and
-	 * then card reset after all txfids have been leaked. */
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void hostap_tx_callback(local_info_t *local,
-			       struct hfa384x_tx_frame *txdesc, int ok,
-			       char *payload)
-{
-	u16 sw_support, hdrlen, len;
-	struct sk_buff *skb;
-	struct hostap_tx_callback_info *cb;
-
-	/* Make sure that frame was from us. */
-	if (memcmp(txdesc->addr2, local->dev->dev_addr, ETH_ALEN)) {
-		printk(KERN_DEBUG "%s: TX callback - foreign frame\n",
-		       local->dev->name);
-		return;
-	}
-
-	sw_support = le16_to_cpu(txdesc->sw_support);
-
-	spin_lock(&local->lock);
-	cb = local->tx_callback;
-	while (cb != NULL && cb->idx != sw_support)
-		cb = cb->next;
-	spin_unlock(&local->lock);
-
-	if (cb == NULL) {
-		printk(KERN_DEBUG "%s: could not find TX callback (idx %d)\n",
-		       local->dev->name, sw_support);
-		return;
-	}
-
-	hdrlen = hostap_80211_get_hdrlen(le16_to_cpu(txdesc->frame_control));
-	len = le16_to_cpu(txdesc->data_len);
-	skb = dev_alloc_skb(hdrlen + len);
-	if (skb == NULL) {
-		printk(KERN_DEBUG "%s: hostap_tx_callback failed to allocate "
-		       "skb\n", local->dev->name);
-		return;
-	}
-
-	memcpy(skb_put(skb, hdrlen), (void *) &txdesc->frame_control, hdrlen);
-	if (payload)
-		memcpy(skb_put(skb, len), payload, len);
-
-	skb->dev = local->dev;
-	skb->mac.raw = skb->data;
-
-	cb->func(skb, ok, cb->data);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static int hostap_tx_compl_read(local_info_t *local, int error,
-				struct hfa384x_tx_frame *txdesc,
-				char **payload)
-{
-	u16 fid, len;
-	int res, ret = 0;
-	struct net_device *dev = local->dev;
-
-	fid = prism2_read_fid_reg(dev, HFA384X_TXCOMPLFID_OFF);
-
-	PDEBUG(DEBUG_FID, "interrupt: TX (err=%d) - fid=0x%04x\n", fid, error);
-
-	spin_lock(&local->baplock);
-	res = hfa384x_setup_bap(dev, BAP0, fid, 0);
-	if (!res)
-		res = hfa384x_from_bap(dev, BAP0, txdesc, sizeof(*txdesc));
-	if (res) {
-		PDEBUG(DEBUG_EXTRA, "%s: TX (err=%d) - fid=0x%04x - could not "
-		       "read txdesc\n", dev->name, error, fid);
-		if (res == -ETIMEDOUT) {
-			schedule_work(&local->reset_queue);
-		}
-		ret = -1;
-		goto fail;
-	}
-	if (txdesc->sw_support) {
-		len = le16_to_cpu(txdesc->data_len);
-		if (len < PRISM2_DATA_MAXLEN) {
-			*payload = (char *) kmalloc(len, GFP_ATOMIC);
-			if (*payload == NULL ||
-			    hfa384x_from_bap(dev, BAP0, *payload, len)) {
-				PDEBUG(DEBUG_EXTRA, "%s: could not read TX "
-				       "frame payload\n", dev->name);
-				kfree(*payload);
-				*payload = NULL;
-				ret = -1;
-				goto fail;
-			}
-		}
-	}
-
- fail:
-	spin_unlock(&local->baplock);
-
-	return ret;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_tx_ev(local_info_t *local)
-{
-	struct net_device *dev = local->dev;
-	char *payload = NULL;
-	struct hfa384x_tx_frame txdesc;
-
-	if (hostap_tx_compl_read(local, 0, &txdesc, &payload))
-		goto fail;
-
-	if (local->frame_dump & PRISM2_DUMP_TX_HDR) {
-		PDEBUG(DEBUG_EXTRA, "%s: TX - status=0x%04x "
-		       "retry_count=%d tx_rate=%d seq_ctrl=%d "
-		       "duration_id=%d\n",
-		       dev->name, le16_to_cpu(txdesc.status),
-		       txdesc.retry_count, txdesc.tx_rate,
-		       le16_to_cpu(txdesc.seq_ctrl),
-		       le16_to_cpu(txdesc.duration_id));
-	}
-
-	if (txdesc.sw_support)
-		hostap_tx_callback(local, &txdesc, 1, payload);
-	kfree(payload);
-
- fail:
-	HFA384X_OUTW(HFA384X_EV_TX, HFA384X_EVACK_OFF);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void hostap_sta_tx_exc_tasklet(unsigned long data)
-{
-	local_info_t *local = (local_info_t *) data;
-	struct sk_buff *skb;
-
-	while ((skb = skb_dequeue(&local->sta_tx_exc_list)) != NULL) {
-		struct hfa384x_tx_frame *txdesc =
-			(struct hfa384x_tx_frame *) skb->data;
-
-		if (skb->len >= sizeof(*txdesc)) {
-			/* Convert Prism2 RX structure into IEEE 802.11 header
-			 */
-			u16 fc = le16_to_cpu(txdesc->frame_control);
-			int hdrlen = hostap_80211_get_hdrlen(fc);
-			memmove(skb_pull(skb, sizeof(*txdesc) - hdrlen),
-				&txdesc->frame_control, hdrlen);
-
-			hostap_handle_sta_tx_exc(local, skb);
-		}
-		dev_kfree_skb(skb);
-	}
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_txexc(local_info_t *local)
-{
-	struct net_device *dev = local->dev;
-	u16 status, fc;
-	int show_dump, res;
-	char *payload = NULL;
-	struct hfa384x_tx_frame txdesc;
-
-	show_dump = local->frame_dump & PRISM2_DUMP_TXEXC_HDR;
-	local->stats.tx_errors++;
-
-	res = hostap_tx_compl_read(local, 1, &txdesc, &payload);
-	HFA384X_OUTW(HFA384X_EV_TXEXC, HFA384X_EVACK_OFF);
-	if (res)
-		return;
-
-	status = le16_to_cpu(txdesc.status);
-
-	/* We produce a TXDROP event only for retry or lifetime
-	 * exceeded, because that's the only status that really mean
-	 * that this particular node went away.
-	 * Other errors means that *we* screwed up. - Jean II */
-	if (status & (HFA384X_TX_STATUS_RETRYERR | HFA384X_TX_STATUS_AGEDERR))
-	{
-		union iwreq_data wrqu;
-
-		/* Copy 802.11 dest address. */
-		memcpy(wrqu.addr.sa_data, txdesc.addr1, ETH_ALEN);
-		wrqu.addr.sa_family = ARPHRD_ETHER;
-		wireless_send_event(dev, IWEVTXDROP, &wrqu, NULL);
-	} else
-		show_dump = 1;
-
-	if (local->iw_mode == IW_MODE_MASTER ||
-	    local->iw_mode == IW_MODE_REPEAT ||
-	    local->wds_type & HOSTAP_WDS_AP_CLIENT) {
-		struct sk_buff *skb;
-		skb = dev_alloc_skb(sizeof(txdesc));
-		if (skb) {
-			memcpy(skb_put(skb, sizeof(txdesc)), &txdesc,
-			       sizeof(txdesc));
-			skb_queue_tail(&local->sta_tx_exc_list, skb);
-			tasklet_schedule(&local->sta_tx_exc_tasklet);
-		}
-	}
-
-	if (txdesc.sw_support)
-		hostap_tx_callback(local, &txdesc, 0, payload);
-	kfree(payload);
-
-	if (!show_dump)
-		return;
-
-	PDEBUG(DEBUG_EXTRA, "%s: TXEXC - status=0x%04x (%s%s%s%s)"
-	       " tx_control=%04x\n",
-	       dev->name, status,
-	       status & HFA384X_TX_STATUS_RETRYERR ? "[RetryErr]" : "",
-	       status & HFA384X_TX_STATUS_AGEDERR ? "[AgedErr]" : "",
-	       status & HFA384X_TX_STATUS_DISCON ? "[Discon]" : "",
-	       status & HFA384X_TX_STATUS_FORMERR ? "[FormErr]" : "",
-	       le16_to_cpu(txdesc.tx_control));
-
-	fc = le16_to_cpu(txdesc.frame_control);
-	PDEBUG(DEBUG_EXTRA, "   retry_count=%d tx_rate=%d fc=0x%04x "
-	       "(%s%s%s::%d%s%s)\n",
-	       txdesc.retry_count, txdesc.tx_rate, fc,
-	       WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_MGMT ? "Mgmt" : "",
-	       WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_CTL ? "Ctrl" : "",
-	       WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA ? "Data" : "",
-	       WLAN_FC_GET_STYPE(fc) >> 4,
-	       fc & IEEE80211_FCTL_TODS ? " ToDS" : "",
-	       fc & IEEE80211_FCTL_FROMDS ? " FromDS" : "");
-	PDEBUG(DEBUG_EXTRA, "   A1=" MACSTR " A2=" MACSTR " A3="
-	       MACSTR " A4=" MACSTR "\n",
-	       MAC2STR(txdesc.addr1), MAC2STR(txdesc.addr2),
-	       MAC2STR(txdesc.addr3), MAC2STR(txdesc.addr4));
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void hostap_info_tasklet(unsigned long data)
-{
-	local_info_t *local = (local_info_t *) data;
-	struct sk_buff *skb;
-
-	while ((skb = skb_dequeue(&local->info_list)) != NULL) {
-		hostap_info_process(local, skb);
-		dev_kfree_skb(skb);
-	}
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_info(local_info_t *local)
-{
-	struct net_device *dev = local->dev;
-	u16 fid;
-	int res, left;
-	struct hfa384x_info_frame info;
-	struct sk_buff *skb;
-
-	fid = HFA384X_INW(HFA384X_INFOFID_OFF);
-
-	spin_lock(&local->baplock);
-	res = hfa384x_setup_bap(dev, BAP0, fid, 0);
-	if (!res)
-		res = hfa384x_from_bap(dev, BAP0, &info, sizeof(info));
-	if (res) {
-		spin_unlock(&local->baplock);
-		printk(KERN_DEBUG "Could not get info frame (fid=0x%04x)\n",
-		       fid);
-		if (res == -ETIMEDOUT) {
-			schedule_work(&local->reset_queue);
-		}
-		goto out;
-	}
-
-	le16_to_cpus(&info.len);
-	le16_to_cpus(&info.type);
-	left = (info.len - 1) * 2;
-
-	if (info.len & 0x8000 || info.len == 0 || left > 2060) {
-		/* data register seems to give 0x8000 in some error cases even
-		 * though busy bit is not set in offset register;
-		 * in addition, length must be at least 1 due to type field */
-		spin_unlock(&local->baplock);
-		printk(KERN_DEBUG "%s: Received info frame with invalid "
-		       "length 0x%04x (type 0x%04x)\n", dev->name, info.len,
-		       info.type);
-		goto out;
-	}
-
-	skb = dev_alloc_skb(sizeof(info) + left);
-	if (skb == NULL) {
-		spin_unlock(&local->baplock);
-		printk(KERN_DEBUG "%s: Could not allocate skb for info "
-		       "frame\n", dev->name);
-		goto out;
-	}
-
-	memcpy(skb_put(skb, sizeof(info)), &info, sizeof(info));
-	if (left > 0 && hfa384x_from_bap(dev, BAP0, skb_put(skb, left), left))
-	{
-		spin_unlock(&local->baplock);
-		printk(KERN_WARNING "%s: Info frame read failed (fid=0x%04x, "
-		       "len=0x%04x, type=0x%04x\n",
-		       dev->name, fid, info.len, info.type);
-		dev_kfree_skb(skb);
-		goto out;
-	}
-	spin_unlock(&local->baplock);
-
-	skb_queue_tail(&local->info_list, skb);
-	tasklet_schedule(&local->info_tasklet);
-
- out:
-	HFA384X_OUTW(HFA384X_EV_INFO, HFA384X_EVACK_OFF);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void hostap_bap_tasklet(unsigned long data)
-{
-	local_info_t *local = (local_info_t *) data;
-	struct net_device *dev = local->dev;
-	u16 ev;
-	int frames = 30;
-
-	if (local->func->card_present && !local->func->card_present(local))
-		return;
-
-	set_bit(HOSTAP_BITS_BAP_TASKLET, &local->bits);
-
-	/* Process all pending BAP events without generating new interrupts
-	 * for them */
-	while (frames-- > 0) {
-		ev = HFA384X_INW(HFA384X_EVSTAT_OFF);
-		if (ev == 0xffff || !(ev & HFA384X_BAP0_EVENTS))
-			break;
-		if (ev & HFA384X_EV_RX)
-			prism2_rx(local);
-		if (ev & HFA384X_EV_INFO)
-			prism2_info(local);
-		if (ev & HFA384X_EV_TX)
-			prism2_tx_ev(local);
-		if (ev & HFA384X_EV_TXEXC)
-			prism2_txexc(local);
-	}
-
-	set_bit(HOSTAP_BITS_BAP_TASKLET2, &local->bits);
-	clear_bit(HOSTAP_BITS_BAP_TASKLET, &local->bits);
-
-	/* Enable interrupts for new BAP events */
-	hfa384x_events_all(dev);
-	clear_bit(HOSTAP_BITS_BAP_TASKLET2, &local->bits);
-}
-
-
-/* Called only from hardware IRQ */
-static void prism2_infdrop(struct net_device *dev)
-{
-	static unsigned long last_inquire = 0;
-
-	PDEBUG(DEBUG_EXTRA, "%s: INFDROP event\n", dev->name);
-
-	/* some firmware versions seem to get stuck with
-	 * full CommTallies in high traffic load cases; every
-	 * packet will then cause INFDROP event and CommTallies
-	 * info frame will not be sent automatically. Try to
-	 * get out of this state by inquiring CommTallies. */
-	if (!last_inquire || time_after(jiffies, last_inquire + HZ)) {
-		hfa384x_cmd_callback(dev, HFA384X_CMDCODE_INQUIRE,
-				     HFA384X_INFO_COMMTALLIES, NULL, 0);
-		last_inquire = jiffies;
-	}
-}
-
-
-/* Called only from hardware IRQ */
-static void prism2_ev_tick(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 evstat, inten;
-	static int prev_stuck = 0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (time_after(jiffies, local->last_tick_timer + 5 * HZ) &&
-	    local->last_tick_timer) {
-		evstat = HFA384X_INW(HFA384X_EVSTAT_OFF);
-		inten = HFA384X_INW(HFA384X_INTEN_OFF);
-		if (!prev_stuck) {
-			printk(KERN_INFO "%s: SW TICK stuck? "
-			       "bits=0x%lx EvStat=%04x IntEn=%04x\n",
-			       dev->name, local->bits, evstat, inten);
-		}
-		local->sw_tick_stuck++;
-		if ((evstat & HFA384X_BAP0_EVENTS) &&
-		    (inten & HFA384X_BAP0_EVENTS)) {
-			printk(KERN_INFO "%s: trying to recover from IRQ "
-			       "hang\n", dev->name);
-			hfa384x_events_no_bap0(dev);
-		}
-		prev_stuck = 1;
-	} else
-		prev_stuck = 0;
-}
-
-
-/* Called only from hardware IRQ */
-static inline void prism2_check_magic(local_info_t *local)
-{
-	/* at least PCI Prism2.5 with bus mastering seems to sometimes
-	 * return 0x0000 in SWSUPPORT0 for unknown reason, but re-reading the
-	 * register once or twice seems to get the correct value.. PCI cards
-	 * cannot anyway be removed during normal operation, so there is not
-	 * really any need for this verification with them. */
-
-#ifndef PRISM2_PCI
-#ifndef final_version
-	static unsigned long last_magic_err = 0;
-	struct net_device *dev = local->dev;
-
-	if (HFA384X_INW(HFA384X_SWSUPPORT0_OFF) != HFA384X_MAGIC) {
-		if (!local->hw_ready)
-			return;
-		HFA384X_OUTW(0xffff, HFA384X_EVACK_OFF);
-		if (time_after(jiffies, last_magic_err + 10 * HZ)) {
-			printk("%s: Interrupt, but SWSUPPORT0 does not match: "
-			       "%04X != %04X - card removed?\n", dev->name,
-			       HFA384X_INW(HFA384X_SWSUPPORT0_OFF),
-			       HFA384X_MAGIC);
-			last_magic_err = jiffies;
-		} else if (net_ratelimit()) {
-			printk(KERN_DEBUG "%s: interrupt - SWSUPPORT0=%04x "
-			       "MAGIC=%04x\n", dev->name,
-			       HFA384X_INW(HFA384X_SWSUPPORT0_OFF),
-			       HFA384X_MAGIC);
-		}
-		if (HFA384X_INW(HFA384X_SWSUPPORT0_OFF) != 0xffff)
-			schedule_work(&local->reset_queue);
-		return;
-	}
-#endif /* final_version */
-#endif /* !PRISM2_PCI */
-}
-
-
-/* Called only from hardware IRQ */
-static irqreturn_t prism2_interrupt(int irq, void *dev_id, struct pt_regs *regs)
-{
-	struct net_device *dev = (struct net_device *) dev_id;
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int events = 0;
-	u16 ev;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INTERRUPT, 0, 0);
-
-	if (local->func->card_present && !local->func->card_present(local)) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "%s: Interrupt, but dev not OK\n",
-			       dev->name);
-		}
-		return IRQ_HANDLED;
-	}
-
-	prism2_check_magic(local);
-
-	for (;;) {
-		ev = HFA384X_INW(HFA384X_EVSTAT_OFF);
-		if (ev == 0xffff) {
-			if (local->shutdown)
-				return IRQ_HANDLED;
-			HFA384X_OUTW(0xffff, HFA384X_EVACK_OFF);
-			printk(KERN_DEBUG "%s: prism2_interrupt: ev=0xffff\n",
-			       dev->name);
-			return IRQ_HANDLED;
-		}
-
-		ev &= HFA384X_INW(HFA384X_INTEN_OFF);
-		if (ev == 0)
-			break;
-
-		if (ev & HFA384X_EV_CMD) {
-			prism2_cmd_ev(dev);
-		}
-
-		/* Above events are needed even before hw is ready, but other
-		 * events should be skipped during initialization. This may
-		 * change for AllocEv if allocate_fid is implemented without
-		 * busy waiting. */
-		if (!local->hw_ready || local->hw_resetting ||
-		    !local->dev_enabled) {
-			ev = HFA384X_INW(HFA384X_EVSTAT_OFF);
-			if (ev & HFA384X_EV_CMD)
-				goto next_event;
-			if ((ev & HFA384X_EVENT_MASK) == 0)
-				return IRQ_HANDLED;
-			if (local->dev_enabled && (ev & ~HFA384X_EV_TICK) &&
-			    net_ratelimit()) {
-				printk(KERN_DEBUG "%s: prism2_interrupt: hw "
-				       "not ready; skipping events 0x%04x "
-				       "(IntEn=0x%04x)%s%s%s\n",
-				       dev->name, ev,
-				       HFA384X_INW(HFA384X_INTEN_OFF),
-				       !local->hw_ready ? " (!hw_ready)" : "",
-				       local->hw_resetting ?
-				       " (hw_resetting)" : "",
-				       !local->dev_enabled ?
-				       " (!dev_enabled)" : "");
-			}
-			HFA384X_OUTW(ev, HFA384X_EVACK_OFF);
-			return IRQ_HANDLED;
-		}
-
-		if (ev & HFA384X_EV_TICK) {
-			prism2_ev_tick(dev);
-			HFA384X_OUTW(HFA384X_EV_TICK, HFA384X_EVACK_OFF);
-		}
-
-		if (ev & HFA384X_EV_ALLOC) {
-			prism2_alloc_ev(dev);
-			HFA384X_OUTW(HFA384X_EV_ALLOC, HFA384X_EVACK_OFF);
-		}
-
-		/* Reading data from the card is quite time consuming, so do it
-		 * in tasklets. TX, TXEXC, RX, and INFO events will be ACKed
-		 * and unmasked after needed data has been read completely. */
-		if (ev & HFA384X_BAP0_EVENTS) {
-			hfa384x_events_no_bap0(dev);
-			tasklet_schedule(&local->bap_tasklet);
-		}
-
-#ifndef final_version
-		if (ev & HFA384X_EV_WTERR) {
-			PDEBUG(DEBUG_EXTRA, "%s: WTERR event\n", dev->name);
-			HFA384X_OUTW(HFA384X_EV_WTERR, HFA384X_EVACK_OFF);
-		}
-#endif /* final_version */
-
-		if (ev & HFA384X_EV_INFDROP) {
-			prism2_infdrop(dev);
-			HFA384X_OUTW(HFA384X_EV_INFDROP, HFA384X_EVACK_OFF);
-		}
-
-	next_event:
-		events++;
-		if (events >= PRISM2_MAX_INTERRUPT_EVENTS) {
-			PDEBUG(DEBUG_EXTRA, "prism2_interrupt: >%d events "
-			       "(EvStat=0x%04x)\n",
-			       PRISM2_MAX_INTERRUPT_EVENTS,
-			       HFA384X_INW(HFA384X_EVSTAT_OFF));
-			break;
-		}
-	}
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INTERRUPT, 0, 1);
-	return IRQ_RETVAL(events);
-}
-
-
-static void prism2_check_sta_fw_version(local_info_t *local)
-{
-	struct hfa384x_comp_ident comp;
-	int id, variant, major, minor;
-
-	if (hfa384x_get_rid(local->dev, HFA384X_RID_STAID,
-			    &comp, sizeof(comp), 1) < 0)
-		return;
-
-	local->fw_ap = 0;
-	id = le16_to_cpu(comp.id);
-	if (id != HFA384X_COMP_ID_STA) {
-		if (id == HFA384X_COMP_ID_FW_AP)
-			local->fw_ap = 1;
-		return;
-	}
-
-	major = __le16_to_cpu(comp.major);
-	minor = __le16_to_cpu(comp.minor);
-	variant = __le16_to_cpu(comp.variant);
-	local->sta_fw_ver = PRISM2_FW_VER(major, minor, variant);
-
-	/* Station firmware versions before 1.4.x seem to have a bug in
-	 * firmware-based WEP encryption when using Host AP mode, so use
-	 * host_encrypt as a default for them. Firmware version 1.4.9 is the
-	 * first one that has been seen to produce correct encryption, but the
-	 * bug might be fixed before that (although, at least 1.4.2 is broken).
-	 */
-	local->fw_encrypt_ok = local->sta_fw_ver >= PRISM2_FW_VER(1,4,9);
-
-	if (local->iw_mode == IW_MODE_MASTER && !local->host_encrypt &&
-	    !local->fw_encrypt_ok) {
-		printk(KERN_DEBUG "%s: defaulting to host-based encryption as "
-		       "a workaround for firmware bug in Host AP mode WEP\n",
-		       local->dev->name);
-		local->host_encrypt = 1;
-	}
-
-	/* IEEE 802.11 standard compliant WDS frames (4 addresses) were broken
-	 * in station firmware versions before 1.5.x. With these versions, the
-	 * driver uses a workaround with bogus frame format (4th address after
-	 * the payload). This is not compatible with other AP devices. Since
-	 * the firmware bug is fixed in the latest station firmware versions,
-	 * automatically enable standard compliant mode for cards using station
-	 * firmware version 1.5.0 or newer. */
-	if (local->sta_fw_ver >= PRISM2_FW_VER(1,5,0))
-		local->wds_type |= HOSTAP_WDS_STANDARD_FRAME;
-	else {
-		printk(KERN_DEBUG "%s: defaulting to bogus WDS frame as a "
-		       "workaround for firmware bug in Host AP mode WDS\n",
-		       local->dev->name);
-	}
-
-	hostap_check_sta_fw_version(local->ap, local->sta_fw_ver);
-}
-
-
-static void prism2_crypt_deinit_entries(local_info_t *local, int force)
-{
-	struct list_head *ptr, *n;
-	struct ieee80211_crypt_data *entry;
-
-	for (ptr = local->crypt_deinit_list.next, n = ptr->next;
-	     ptr != &local->crypt_deinit_list; ptr = n, n = ptr->next) {
-		entry = list_entry(ptr, struct ieee80211_crypt_data, list);
-
-		if (atomic_read(&entry->refcnt) != 0 && !force)
-			continue;
-
-		list_del(ptr);
-
-		if (entry->ops)
-			entry->ops->deinit(entry->priv);
-		kfree(entry);
-	}
-}
-
-
-static void prism2_crypt_deinit_handler(unsigned long data)
-{
-	local_info_t *local = (local_info_t *) data;
-	unsigned long flags;
-
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_crypt_deinit_entries(local, 0);
-	if (!list_empty(&local->crypt_deinit_list)) {
-		printk(KERN_DEBUG "%s: entries remaining in delayed crypt "
-		       "deletion list\n", local->dev->name);
-		local->crypt_deinit_timer.expires = jiffies + HZ;
-		add_timer(&local->crypt_deinit_timer);
-	}
-	spin_unlock_irqrestore(&local->lock, flags);
-
-}
-
-
-static void hostap_passive_scan(unsigned long data)
-{
-	local_info_t *local = (local_info_t *) data;
-	struct net_device *dev = local->dev;
-	u16 channel;
-
-	if (local->passive_scan_interval <= 0)
-		return;
-
-	if (local->passive_scan_state == PASSIVE_SCAN_LISTEN) {
-		int max_tries = 16;
-
-		/* Even though host system does not really know when the WLAN
-		 * MAC is sending frames, try to avoid changing channels for
-		 * passive scanning when a host-generated frame is being
-		 * transmitted */
-		if (test_bit(HOSTAP_BITS_TRANSMIT, &local->bits)) {
-			printk(KERN_DEBUG "%s: passive scan detected pending "
-			       "TX - delaying\n", dev->name);
-			local->passive_scan_timer.expires = jiffies + HZ / 10;
-			add_timer(&local->passive_scan_timer);
-			return;
-		}
-
-		do {
-			local->passive_scan_channel++;
-			if (local->passive_scan_channel > 14)
-				local->passive_scan_channel = 1;
-			max_tries--;
-		} while (!(local->channel_mask &
-			   (1 << (local->passive_scan_channel - 1))) &&
-			 max_tries > 0);
-
-		if (max_tries == 0) {
-			printk(KERN_INFO "%s: no allowed passive scan channels"
-			       " found\n", dev->name);
-			return;
-		}
-
-		printk(KERN_DEBUG "%s: passive scan channel %d\n",
-		       dev->name, local->passive_scan_channel);
-		channel = local->passive_scan_channel;
-		local->passive_scan_state = PASSIVE_SCAN_WAIT;
-		local->passive_scan_timer.expires = jiffies + HZ / 10;
-	} else {
-		channel = local->channel;
-		local->passive_scan_state = PASSIVE_SCAN_LISTEN;
-		local->passive_scan_timer.expires = jiffies +
-			local->passive_scan_interval * HZ;
-	}
-
-	if (hfa384x_cmd_callback(dev, HFA384X_CMDCODE_TEST |
-				 (HFA384X_TEST_CHANGE_CHANNEL << 8),
-				 channel, NULL, 0))
-		printk(KERN_ERR "%s: passive scan channel set %d "
-		       "failed\n", dev->name, channel);
-
-	add_timer(&local->passive_scan_timer);
-}
-
-
-/* Called only as a scheduled task when communications quality values should
- * be updated. */
-static void handle_comms_qual_update(void *data)
-{
-	local_info_t *local = data;
-	prism2_update_comms_qual(local->dev);
-}
-
-
-/* Software watchdog - called as a timer. Hardware interrupt (Tick event) is
- * used to monitor that local->last_tick_timer is being updated. If not,
- * interrupt busy-loop is assumed and driver tries to recover by masking out
- * some events. */
-static void hostap_tick_timer(unsigned long data)
-{
-	static unsigned long last_inquire = 0;
-	local_info_t *local = (local_info_t *) data;
-	local->last_tick_timer = jiffies;
-
-	/* Inquire CommTallies every 10 seconds to keep the statistics updated
-	 * more often during low load and when using 32-bit tallies. */
-	if ((!last_inquire || time_after(jiffies, last_inquire + 10 * HZ)) &&
-	    !local->hw_downloading && local->hw_ready &&
-	    !local->hw_resetting && local->dev_enabled) {
-		hfa384x_cmd_callback(local->dev, HFA384X_CMDCODE_INQUIRE,
-				     HFA384X_INFO_COMMTALLIES, NULL, 0);
-		last_inquire = jiffies;
-	}
-
-	if ((local->last_comms_qual_update == 0 ||
-	     time_after(jiffies, local->last_comms_qual_update + 10 * HZ)) &&
-	    (local->iw_mode == IW_MODE_INFRA ||
-	     local->iw_mode == IW_MODE_ADHOC)) {
-		schedule_work(&local->comms_qual_update);
-	}
-
-	local->tick_timer.expires = jiffies + 2 * HZ;
-	add_timer(&local->tick_timer);
-}
-
-
-#ifndef PRISM2_NO_PROCFS_DEBUG
-static int prism2_registers_proc_read(char *page, char **start, off_t off,
-				      int count, int *eof, void *data)
-{
-	char *p = page;
-	local_info_t *local = (local_info_t *) data;
-
-	if (off != 0) {
-		*eof = 1;
-		return 0;
-	}
-
-#define SHOW_REG(n) \
-p += sprintf(p, #n "=%04x\n", hfa384x_read_reg(local->dev, HFA384X_##n##_OFF))
-
-	SHOW_REG(CMD);
-	SHOW_REG(PARAM0);
-	SHOW_REG(PARAM1);
-	SHOW_REG(PARAM2);
-	SHOW_REG(STATUS);
-	SHOW_REG(RESP0);
-	SHOW_REG(RESP1);
-	SHOW_REG(RESP2);
-	SHOW_REG(INFOFID);
-	SHOW_REG(CONTROL);
-	SHOW_REG(SELECT0);
-	SHOW_REG(SELECT1);
-	SHOW_REG(OFFSET0);
-	SHOW_REG(OFFSET1);
-	SHOW_REG(RXFID);
-	SHOW_REG(ALLOCFID);
-	SHOW_REG(TXCOMPLFID);
-	SHOW_REG(SWSUPPORT0);
-	SHOW_REG(SWSUPPORT1);
-	SHOW_REG(SWSUPPORT2);
-	SHOW_REG(EVSTAT);
-	SHOW_REG(INTEN);
-	SHOW_REG(EVACK);
-	/* Do not read data registers, because they change the state of the
-	 * MAC (offset += 2) */
-	/* SHOW_REG(DATA0); */
-	/* SHOW_REG(DATA1); */
-	SHOW_REG(AUXPAGE);
-	SHOW_REG(AUXOFFSET);
-	/* SHOW_REG(AUXDATA); */
-#ifdef PRISM2_PCI
-	SHOW_REG(PCICOR);
-	SHOW_REG(PCIHCR);
-	SHOW_REG(PCI_M0_ADDRH);
-	SHOW_REG(PCI_M0_ADDRL);
-	SHOW_REG(PCI_M0_LEN);
-	SHOW_REG(PCI_M0_CTL);
-	SHOW_REG(PCI_STATUS);
-	SHOW_REG(PCI_M1_ADDRH);
-	SHOW_REG(PCI_M1_ADDRL);
-	SHOW_REG(PCI_M1_LEN);
-	SHOW_REG(PCI_M1_CTL);
-#endif /* PRISM2_PCI */
-
-	return (p - page);
-}
-#endif /* PRISM2_NO_PROCFS_DEBUG */
-
-
-struct set_tim_data {
-	struct list_head list;
-	int aid;
-	int set;
-};
-
-static int prism2_set_tim(struct net_device *dev, int aid, int set)
-{
-	struct list_head *ptr;
-	struct set_tim_data *new_entry;
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	new_entry = (struct set_tim_data *)
-		kmalloc(sizeof(*new_entry), GFP_ATOMIC);
-	if (new_entry == NULL) {
-		printk(KERN_DEBUG "%s: prism2_set_tim: kmalloc failed\n",
-		       local->dev->name);
-		return -ENOMEM;
-	}
-	memset(new_entry, 0, sizeof(*new_entry));
-	new_entry->aid = aid;
-	new_entry->set = set;
-
-	spin_lock_bh(&local->set_tim_lock);
-	list_for_each(ptr, &local->set_tim_list) {
-		struct set_tim_data *entry =
-			list_entry(ptr, struct set_tim_data, list);
-		if (entry->aid == aid) {
-			PDEBUG(DEBUG_PS2, "%s: prism2_set_tim: aid=%d "
-			       "set=%d ==> %d\n",
-			       local->dev->name, aid, entry->set, set);
-			entry->set = set;
-			kfree(new_entry);
-			new_entry = NULL;
-			break;
-		}
-	}
-	if (new_entry)
-		list_add_tail(&new_entry->list, &local->set_tim_list);
-	spin_unlock_bh(&local->set_tim_lock);
-
-	schedule_work(&local->set_tim_queue);
-
-	return 0;
-}
-
-
-static void handle_set_tim_queue(void *data)
-{
-	local_info_t *local = (local_info_t *) data;
-	struct set_tim_data *entry;
-	u16 val;
-
-	for (;;) {
-		entry = NULL;
-		spin_lock_bh(&local->set_tim_lock);
-		if (!list_empty(&local->set_tim_list)) {
-			entry = list_entry(local->set_tim_list.next,
-					   struct set_tim_data, list);
-			list_del(&entry->list);
-		}
-		spin_unlock_bh(&local->set_tim_lock);
-		if (!entry)
-			break;
-
-		PDEBUG(DEBUG_PS2, "%s: handle_set_tim_queue: aid=%d set=%d\n",
-		       local->dev->name, entry->aid, entry->set);
-
-		val = entry->aid;
-		if (entry->set)
-			val |= 0x8000;
-		if (hostap_set_word(local->dev, HFA384X_RID_CNFTIMCTRL, val)) {
-			printk(KERN_DEBUG "%s: set_tim failed (aid=%d "
-			       "set=%d)\n",
-			       local->dev->name, entry->aid, entry->set);
-		}
-
-		kfree(entry);
-	}
-}
-
-
-static void prism2_clear_set_tim_queue(local_info_t *local)
-{
-	struct list_head *ptr, *n;
-
-	list_for_each_safe(ptr, n, &local->set_tim_list) {
-		struct set_tim_data *entry;
-		entry = list_entry(ptr, struct set_tim_data, list);
-		list_del(&entry->list);
-		kfree(entry);
-	}
-}
-
-
-static struct net_device *
-prism2_init_local_data(struct prism2_helper_functions *funcs, int card_idx,
-		       struct device *sdev)
-{
-	struct net_device *dev;
-	struct hostap_interface *iface;
-	struct local_info *local;
-	int len, i, ret;
-
-	if (funcs == NULL)
-		return NULL;
-
-	len = strlen(dev_template);
-	if (len >= IFNAMSIZ || strstr(dev_template, "%d") == NULL) {
-		printk(KERN_WARNING "hostap: Invalid dev_template='%s'\n",
-		       dev_template);
-		return NULL;
-	}
-
-	len = sizeof(struct hostap_interface) +
-		3 + sizeof(struct local_info) +
-		3 + sizeof(struct ap_data);
-
-	dev = alloc_etherdev(len);
-	if (dev == NULL)
-		return NULL;
-
-	iface = netdev_priv(dev);
-	local = (struct local_info *) ((((long) (iface + 1)) + 3) & ~3);
-	local->ap = (struct ap_data *) ((((long) (local + 1)) + 3) & ~3);
-	local->dev = iface->dev = dev;
-	iface->local = local;
-	iface->type = HOSTAP_INTERFACE_MASTER;
-	INIT_LIST_HEAD(&local->hostap_interfaces);
-
-	local->hw_module = THIS_MODULE;
-
-#ifdef PRISM2_IO_DEBUG
-	local->io_debug_enabled = 1;
-#endif /* PRISM2_IO_DEBUG */
-
-	local->func = funcs;
-	local->func->cmd = hfa384x_cmd;
-	local->func->read_regs = hfa384x_read_regs;
-	local->func->get_rid = hfa384x_get_rid;
-	local->func->set_rid = hfa384x_set_rid;
-	local->func->hw_enable = prism2_hw_enable;
-	local->func->hw_config = prism2_hw_config;
-	local->func->hw_reset = prism2_hw_reset;
-	local->func->hw_shutdown = prism2_hw_shutdown;
-	local->func->reset_port = prism2_reset_port;
-	local->func->schedule_reset = prism2_schedule_reset;
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-	local->func->read_aux = prism2_download_aux_dump;
-	local->func->download = prism2_download;
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-	local->func->tx = prism2_tx_80211;
-	local->func->set_tim = prism2_set_tim;
-	local->func->need_tx_headroom = 0; /* no need to add txdesc in
-					    * skb->data (FIX: maybe for DMA bus
-					    * mastering? */
-
-	local->mtu = mtu;
-
-	rwlock_init(&local->iface_lock);
-	spin_lock_init(&local->txfidlock);
-	spin_lock_init(&local->cmdlock);
-	spin_lock_init(&local->baplock);
-	spin_lock_init(&local->lock);
-	init_MUTEX(&local->rid_bap_sem);
-
-	if (card_idx < 0 || card_idx >= MAX_PARM_DEVICES)
-		card_idx = 0;
-	local->card_idx = card_idx;
-
-	len = strlen(essid);
-	memcpy(local->essid, essid,
-	       len > MAX_SSID_LEN ? MAX_SSID_LEN : len);
-	local->essid[MAX_SSID_LEN] = '\0';
-	i = GET_INT_PARM(iw_mode, card_idx);
-	if ((i >= IW_MODE_ADHOC && i <= IW_MODE_REPEAT) ||
-	    i == IW_MODE_MONITOR) {
-		local->iw_mode = i;
-	} else {
-		printk(KERN_WARNING "prism2: Unknown iw_mode %d; using "
-		       "IW_MODE_MASTER\n", i);
-		local->iw_mode = IW_MODE_MASTER;
-	}
-	local->channel = GET_INT_PARM(channel, card_idx);
-	local->beacon_int = GET_INT_PARM(beacon_int, card_idx);
-	local->dtim_period = GET_INT_PARM(dtim_period, card_idx);
-	local->wds_max_connections = 16;
-	local->tx_control = HFA384X_TX_CTRL_FLAGS;
-	local->manual_retry_count = -1;
-	local->rts_threshold = 2347;
-	local->fragm_threshold = 2346;
-	local->rssi_to_dBm = 100; /* default; to be overriden by
-				   * cnfDbmAdjust, if available */
-	local->auth_algs = PRISM2_AUTH_OPEN | PRISM2_AUTH_SHARED_KEY;
-	local->sram_type = -1;
-	local->scan_channel_mask = 0xffff;
-
-	/* Initialize task queue structures */
-	INIT_WORK(&local->reset_queue, handle_reset_queue, local);
-	INIT_WORK(&local->set_multicast_list_queue,
-		  hostap_set_multicast_list_queue, local->dev);
-
-	INIT_WORK(&local->set_tim_queue, handle_set_tim_queue, local);
-	INIT_LIST_HEAD(&local->set_tim_list);
-	spin_lock_init(&local->set_tim_lock);
-
-	INIT_WORK(&local->comms_qual_update, handle_comms_qual_update, local);
-
-	/* Initialize tasklets for handling hardware IRQ related operations
-	 * outside hw IRQ handler */
-#define HOSTAP_TASKLET_INIT(q, f, d) \
-do { memset((q), 0, sizeof(*(q))); (q)->func = (f); (q)->data = (d); } \
-while (0)
-	HOSTAP_TASKLET_INIT(&local->bap_tasklet, hostap_bap_tasklet,
-			    (unsigned long) local);
-
-	HOSTAP_TASKLET_INIT(&local->info_tasklet, hostap_info_tasklet,
-			    (unsigned long) local);
-	hostap_info_init(local);
-
-	HOSTAP_TASKLET_INIT(&local->rx_tasklet,
-			    hostap_rx_tasklet, (unsigned long) local);
-	skb_queue_head_init(&local->rx_list);
-
-	HOSTAP_TASKLET_INIT(&local->sta_tx_exc_tasklet,
-			    hostap_sta_tx_exc_tasklet, (unsigned long) local);
-	skb_queue_head_init(&local->sta_tx_exc_list);
-
-	INIT_LIST_HEAD(&local->cmd_queue);
-	init_waitqueue_head(&local->hostscan_wq);
-	INIT_LIST_HEAD(&local->crypt_deinit_list);
-	init_timer(&local->crypt_deinit_timer);
-	local->crypt_deinit_timer.data = (unsigned long) local;
-	local->crypt_deinit_timer.function = prism2_crypt_deinit_handler;
-
-	init_timer(&local->passive_scan_timer);
-	local->passive_scan_timer.data = (unsigned long) local;
-	local->passive_scan_timer.function = hostap_passive_scan;
-
-	init_timer(&local->tick_timer);
-	local->tick_timer.data = (unsigned long) local;
-	local->tick_timer.function = hostap_tick_timer;
-	local->tick_timer.expires = jiffies + 2 * HZ;
-	add_timer(&local->tick_timer);
-
-	INIT_LIST_HEAD(&local->bss_list);
-
-	hostap_setup_dev(dev, local, 1);
-	local->saved_eth_header_parse = dev->hard_header_parse;
-
-	dev->hard_start_xmit = hostap_master_start_xmit;
-	dev->type = ARPHRD_IEEE80211;
-	dev->hard_header_parse = hostap_80211_header_parse;
-
-	rtnl_lock();
-	ret = dev_alloc_name(dev, "wifi%d");
-	SET_NETDEV_DEV(dev, sdev);
-	if (ret >= 0)
-		ret = register_netdevice(dev);
-	rtnl_unlock();
-	if (ret < 0) {
-		printk(KERN_WARNING "%s: register netdevice failed!\n",
-		       dev_info);
-		goto fail;
-	}
-	printk(KERN_INFO "%s: Registered netdevice %s\n", dev_info, dev->name);
-
-#ifndef PRISM2_NO_PROCFS_DEBUG
-	create_proc_read_entry("registers", 0, local->proc,
-			       prism2_registers_proc_read, local);
-#endif /* PRISM2_NO_PROCFS_DEBUG */
-
-	hostap_init_data(local);
-	return dev;
-
- fail:
-	free_netdev(dev);
-	return NULL;
-}
-
-
-static int hostap_hw_ready(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	struct local_info *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-	local->ddev = hostap_add_interface(local, HOSTAP_INTERFACE_MAIN, 0,
-					   "", dev_template);
-
-	if (local->ddev) {
-		if (local->iw_mode == IW_MODE_INFRA ||
-		    local->iw_mode == IW_MODE_ADHOC) {
-			netif_carrier_off(local->dev);
-			netif_carrier_off(local->ddev);
-		}
-		hostap_init_proc(local);
-		hostap_init_ap_proc(local);
-		return 0;
-	}
-
-	return -1;
-}
-
-
-static void prism2_free_local_data(struct net_device *dev)
-{
-	struct hostap_tx_callback_info *tx_cb, *tx_cb_prev;
-	int i;
-	struct hostap_interface *iface;
-	struct local_info *local;
-	struct list_head *ptr, *n;
-
-	if (dev == NULL)
-		return;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	flush_scheduled_work();
-
-	if (timer_pending(&local->crypt_deinit_timer))
-		del_timer(&local->crypt_deinit_timer);
-	prism2_crypt_deinit_entries(local, 1);
-
-	if (timer_pending(&local->passive_scan_timer))
-		del_timer(&local->passive_scan_timer);
-
-	if (timer_pending(&local->tick_timer))
-		del_timer(&local->tick_timer);
-
-	prism2_clear_cmd_queue(local);
-
-	skb_queue_purge(&local->info_list);
-	skb_queue_purge(&local->rx_list);
-	skb_queue_purge(&local->sta_tx_exc_list);
-
-	if (local->dev_enabled)
-		prism2_callback(local, PRISM2_CALLBACK_DISABLE);
-
-	for (i = 0; i < WEP_KEYS; i++) {
-		struct ieee80211_crypt_data *crypt = local->crypt[i];
-		if (crypt) {
-			if (crypt->ops)
-				crypt->ops->deinit(crypt->priv);
-			kfree(crypt);
-			local->crypt[i] = NULL;
-		}
-	}
-
-	if (local->ap != NULL)
-		hostap_free_data(local->ap);
-
-#ifndef PRISM2_NO_PROCFS_DEBUG
-	if (local->proc != NULL)
-		remove_proc_entry("registers", local->proc);
-#endif /* PRISM2_NO_PROCFS_DEBUG */
-	hostap_remove_proc(local);
-
-	tx_cb = local->tx_callback;
-	while (tx_cb != NULL) {
-		tx_cb_prev = tx_cb;
-		tx_cb = tx_cb->next;
-		kfree(tx_cb_prev);
-	}
-
-	hostap_set_hostapd(local, 0, 0);
-	hostap_set_hostapd_sta(local, 0, 0);
-
-	for (i = 0; i < PRISM2_FRAG_CACHE_LEN; i++) {
-		if (local->frag_cache[i].skb != NULL)
-			dev_kfree_skb(local->frag_cache[i].skb);
-	}
-
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-	prism2_download_free_data(local->dl_pri);
-	prism2_download_free_data(local->dl_sec);
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-
-	list_for_each_safe(ptr, n, &local->hostap_interfaces) {
-		iface = list_entry(ptr, struct hostap_interface, list);
-		if (iface->type == HOSTAP_INTERFACE_MASTER) {
-			/* special handling for this interface below */
-			continue;
-		}
-		hostap_remove_interface(iface->dev, 0, 1);
-	}
-
-	prism2_clear_set_tim_queue(local);
-
-	list_for_each_safe(ptr, n, &local->bss_list) {
-		struct hostap_bss_info *bss =
-			list_entry(ptr, struct hostap_bss_info, list);
-		kfree(bss);
-	}
-
-	kfree(local->pda);
-	kfree(local->last_scan_results);
-	kfree(local->generic_elem);
-
-	unregister_netdev(local->dev);
-	free_netdev(local->dev);
-}
-
-
-#ifndef PRISM2_PLX
-static void prism2_suspend(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	struct local_info *local;
-	union iwreq_data wrqu;
-
-	iface = dev->priv;
-	local = iface->local;
-
-	/* Send disconnect event, e.g., to trigger reassociation after resume
-	 * if wpa_supplicant is used. */
-	memset(&wrqu, 0, sizeof(wrqu));
-	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-	wireless_send_event(local->dev, SIOCGIWAP, &wrqu, NULL);
-
-	/* Disable hardware and firmware */
-	prism2_hw_shutdown(dev, 0);
-}
-#endif /* PRISM2_PLX */
-
-
-/* These might at some point be compiled separately and used as separate
- * kernel modules or linked into one */
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-#include "hostap_download.c"
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-
-#ifdef PRISM2_CALLBACK
-/* External hostap_callback.c file can be used to, e.g., blink activity led.
- * This can use platform specific code and must define prism2_callback()
- * function (if PRISM2_CALLBACK is not defined, these function calls are not
- * used. */
-#include "hostap_callback.c"
-#endif /* PRISM2_CALLBACK */
diff --git a/trunk/drivers/net/wireless/hostap/hostap_info.c b/trunk/drivers/net/wireless/hostap/hostap_info.c
deleted file mode 100644
index 5aa998fdf1c4..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_info.c
+++ /dev/null
@@ -1,499 +0,0 @@
-/* Host AP driver Info Frame processing (part of hostap.o module) */
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_info_commtallies16(local_info_t *local, unsigned char *buf,
-				      int left)
-{
-	struct hfa384x_comm_tallies *tallies;
-
-	if (left < sizeof(struct hfa384x_comm_tallies)) {
-		printk(KERN_DEBUG "%s: too short (len=%d) commtallies "
-		       "info frame\n", local->dev->name, left);
-		return;
-	}
-
-	tallies = (struct hfa384x_comm_tallies *) buf;
-#define ADD_COMM_TALLIES(name) \
-local->comm_tallies.name += le16_to_cpu(tallies->name)
-	ADD_COMM_TALLIES(tx_unicast_frames);
-	ADD_COMM_TALLIES(tx_multicast_frames);
-	ADD_COMM_TALLIES(tx_fragments);
-	ADD_COMM_TALLIES(tx_unicast_octets);
-	ADD_COMM_TALLIES(tx_multicast_octets);
-	ADD_COMM_TALLIES(tx_deferred_transmissions);
-	ADD_COMM_TALLIES(tx_single_retry_frames);
-	ADD_COMM_TALLIES(tx_multiple_retry_frames);
-	ADD_COMM_TALLIES(tx_retry_limit_exceeded);
-	ADD_COMM_TALLIES(tx_discards);
-	ADD_COMM_TALLIES(rx_unicast_frames);
-	ADD_COMM_TALLIES(rx_multicast_frames);
-	ADD_COMM_TALLIES(rx_fragments);
-	ADD_COMM_TALLIES(rx_unicast_octets);
-	ADD_COMM_TALLIES(rx_multicast_octets);
-	ADD_COMM_TALLIES(rx_fcs_errors);
-	ADD_COMM_TALLIES(rx_discards_no_buffer);
-	ADD_COMM_TALLIES(tx_discards_wrong_sa);
-	ADD_COMM_TALLIES(rx_discards_wep_undecryptable);
-	ADD_COMM_TALLIES(rx_message_in_msg_fragments);
-	ADD_COMM_TALLIES(rx_message_in_bad_msg_fragments);
-#undef ADD_COMM_TALLIES
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_info_commtallies32(local_info_t *local, unsigned char *buf,
-				      int left)
-{
-	struct hfa384x_comm_tallies32 *tallies;
-
-	if (left < sizeof(struct hfa384x_comm_tallies32)) {
-		printk(KERN_DEBUG "%s: too short (len=%d) commtallies32 "
-		       "info frame\n", local->dev->name, left);
-		return;
-	}
-
-	tallies = (struct hfa384x_comm_tallies32 *) buf;
-#define ADD_COMM_TALLIES(name) \
-local->comm_tallies.name += le32_to_cpu(tallies->name)
-	ADD_COMM_TALLIES(tx_unicast_frames);
-	ADD_COMM_TALLIES(tx_multicast_frames);
-	ADD_COMM_TALLIES(tx_fragments);
-	ADD_COMM_TALLIES(tx_unicast_octets);
-	ADD_COMM_TALLIES(tx_multicast_octets);
-	ADD_COMM_TALLIES(tx_deferred_transmissions);
-	ADD_COMM_TALLIES(tx_single_retry_frames);
-	ADD_COMM_TALLIES(tx_multiple_retry_frames);
-	ADD_COMM_TALLIES(tx_retry_limit_exceeded);
-	ADD_COMM_TALLIES(tx_discards);
-	ADD_COMM_TALLIES(rx_unicast_frames);
-	ADD_COMM_TALLIES(rx_multicast_frames);
-	ADD_COMM_TALLIES(rx_fragments);
-	ADD_COMM_TALLIES(rx_unicast_octets);
-	ADD_COMM_TALLIES(rx_multicast_octets);
-	ADD_COMM_TALLIES(rx_fcs_errors);
-	ADD_COMM_TALLIES(rx_discards_no_buffer);
-	ADD_COMM_TALLIES(tx_discards_wrong_sa);
-	ADD_COMM_TALLIES(rx_discards_wep_undecryptable);
-	ADD_COMM_TALLIES(rx_message_in_msg_fragments);
-	ADD_COMM_TALLIES(rx_message_in_bad_msg_fragments);
-#undef ADD_COMM_TALLIES
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_info_commtallies(local_info_t *local, unsigned char *buf,
-				    int left)
-{
-	if (local->tallies32)
-		prism2_info_commtallies32(local, buf, left);
-	else
-		prism2_info_commtallies16(local, buf, left);
-}
-
-
-#ifndef PRISM2_NO_STATION_MODES
-#ifndef PRISM2_NO_DEBUG
-static const char* hfa384x_linkstatus_str(u16 linkstatus)
-{
-	switch (linkstatus) {
-	case HFA384X_LINKSTATUS_CONNECTED:
-		return "Connected";
-	case HFA384X_LINKSTATUS_DISCONNECTED:
-		return "Disconnected";
-	case HFA384X_LINKSTATUS_AP_CHANGE:
-		return "Access point change";
-	case HFA384X_LINKSTATUS_AP_OUT_OF_RANGE:
-		return "Access point out of range";
-	case HFA384X_LINKSTATUS_AP_IN_RANGE:
-		return "Access point in range";
-	case HFA384X_LINKSTATUS_ASSOC_FAILED:
-		return "Association failed";
-	default:
-		return "Unknown";
-	}
-}
-#endif /* PRISM2_NO_DEBUG */
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_info_linkstatus(local_info_t *local, unsigned char *buf,
-				    int left)
-{
-	u16 val;
-	int non_sta_mode;
-
-	/* Alloc new JoinRequests to occur since LinkStatus for the previous
-	 * has been received */
-	local->last_join_time = 0;
-
-	if (left != 2) {
-		printk(KERN_DEBUG "%s: invalid linkstatus info frame "
-		       "length %d\n", local->dev->name, left);
-		return;
-	}
-
-	non_sta_mode = local->iw_mode == IW_MODE_MASTER ||
-		local->iw_mode == IW_MODE_REPEAT ||
-		local->iw_mode == IW_MODE_MONITOR;
-
-	val = buf[0] | (buf[1] << 8);
-	if (!non_sta_mode || val != HFA384X_LINKSTATUS_DISCONNECTED) {
-		PDEBUG(DEBUG_EXTRA, "%s: LinkStatus=%d (%s)\n",
-		       local->dev->name, val, hfa384x_linkstatus_str(val));
-	}
-
-	if (non_sta_mode) {
-		netif_carrier_on(local->dev);
-		netif_carrier_on(local->ddev);
-		return;
-	}
-
-	/* Get current BSSID later in scheduled task */
-	set_bit(PRISM2_INFO_PENDING_LINKSTATUS, &local->pending_info);
-	local->prev_link_status = val;
-	schedule_work(&local->info_queue);
-}
-
-
-static void prism2_host_roaming(local_info_t *local)
-{
-	struct hfa384x_join_request req;
-	struct net_device *dev = local->dev;
-	struct hfa384x_hostscan_result *selected, *entry;
-	int i;
-	unsigned long flags;
-
-	if (local->last_join_time &&
-	    time_before(jiffies, local->last_join_time + 10 * HZ)) {
-		PDEBUG(DEBUG_EXTRA, "%s: last join request has not yet been "
-		       "completed - waiting for it before issuing new one\n",
-		       dev->name);
-		return;
-	}
-
-	/* ScanResults are sorted: first ESS results in decreasing signal
-	 * quality then IBSS results in similar order.
-	 * Trivial roaming policy: just select the first entry.
-	 * This could probably be improved by adding hysteresis to limit
-	 * number of handoffs, etc.
-	 *
-	 * Could do periodic RID_SCANREQUEST or Inquire F101 to get new
-	 * ScanResults */
-	spin_lock_irqsave(&local->lock, flags);
-	if (local->last_scan_results == NULL ||
-	    local->last_scan_results_count == 0) {
-		spin_unlock_irqrestore(&local->lock, flags);
-		PDEBUG(DEBUG_EXTRA, "%s: no scan results for host roaming\n",
-		       dev->name);
-		return;
-	}
-
-	selected = &local->last_scan_results[0];
-
-	if (local->preferred_ap[0] || local->preferred_ap[1] ||
-	    local->preferred_ap[2] || local->preferred_ap[3] ||
-	    local->preferred_ap[4] || local->preferred_ap[5]) {
-		/* Try to find preferred AP */
-		PDEBUG(DEBUG_EXTRA, "%s: Preferred AP BSSID " MACSTR "\n",
-		       dev->name, MAC2STR(local->preferred_ap));
-		for (i = 0; i < local->last_scan_results_count; i++) {
-			entry = &local->last_scan_results[i];
-			if (memcmp(local->preferred_ap, entry->bssid, 6) == 0)
-			{
-				PDEBUG(DEBUG_EXTRA, "%s: using preferred AP "
-				       "selection\n", dev->name);
-				selected = entry;
-				break;
-			}
-		}
-	}
-
-	memcpy(req.bssid, selected->bssid, 6);
-	req.channel = selected->chid;
-	spin_unlock_irqrestore(&local->lock, flags);
-
-	PDEBUG(DEBUG_EXTRA, "%s: JoinRequest: BSSID=" MACSTR " channel=%d\n",
-	       dev->name, MAC2STR(req.bssid), le16_to_cpu(req.channel));
-	if (local->func->set_rid(dev, HFA384X_RID_JOINREQUEST, &req,
-				 sizeof(req))) {
-		printk(KERN_DEBUG "%s: JoinRequest failed\n", dev->name);
-	}
-	local->last_join_time = jiffies;
-}
-
-
-static void hostap_report_scan_complete(local_info_t *local)
-{
-	union iwreq_data wrqu;
-
-	/* Inform user space about new scan results (just empty event,
-	 * SIOCGIWSCAN can be used to fetch data */
-	wrqu.data.length = 0;
-	wrqu.data.flags = 0;
-	wireless_send_event(local->dev, SIOCGIWSCAN, &wrqu, NULL);
-
-	/* Allow SIOCGIWSCAN handling to occur since we have received
-	 * scanning result */
-	local->scan_timestamp = 0;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_info_scanresults(local_info_t *local, unsigned char *buf,
-				    int left)
-{
-	u16 *pos;
-	int new_count, i;
-	unsigned long flags;
-	struct hfa384x_scan_result *res;
-	struct hfa384x_hostscan_result *results, *prev;
-
-	if (left < 4) {
-		printk(KERN_DEBUG "%s: invalid scanresult info frame "
-		       "length %d\n", local->dev->name, left);
-		return;
-	}
-
-	pos = (u16 *) buf;
-	pos++;
-	pos++;
-	left -= 4;
-
-	new_count = left / sizeof(struct hfa384x_scan_result);
-	results = kmalloc(new_count * sizeof(struct hfa384x_hostscan_result),
-			  GFP_ATOMIC);
-	if (results == NULL)
-		return;
-
-	/* Convert to hostscan result format. */
-	res = (struct hfa384x_scan_result *) pos;
-	for (i = 0; i < new_count; i++) {
-		memcpy(&results[i], &res[i],
-		       sizeof(struct hfa384x_scan_result));
-		results[i].atim = 0;
-	}
-
-	spin_lock_irqsave(&local->lock, flags);
-	local->last_scan_type = PRISM2_SCAN;
-	prev = local->last_scan_results;
-	local->last_scan_results = results;
-	local->last_scan_results_count = new_count;
-	spin_unlock_irqrestore(&local->lock, flags);
-	kfree(prev);
-
-	hostap_report_scan_complete(local);
-
-	/* Perform rest of ScanResults handling later in scheduled task */
-	set_bit(PRISM2_INFO_PENDING_SCANRESULTS, &local->pending_info);
-	schedule_work(&local->info_queue);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static void prism2_info_hostscanresults(local_info_t *local,
-					unsigned char *buf, int left)
-{
-	int i, result_size, copy_len, new_count;
-	struct hfa384x_hostscan_result *results, *prev;
-	unsigned long flags;
-	u16 *pos;
-	u8 *ptr;
-
-	wake_up_interruptible(&local->hostscan_wq);
-
-	if (left < 4) {
-		printk(KERN_DEBUG "%s: invalid hostscanresult info frame "
-		       "length %d\n", local->dev->name, left);
-		return;
-	}
-
-	pos = (u16 *) buf;
-	copy_len = result_size = le16_to_cpu(*pos);
-	if (result_size == 0) {
-		printk(KERN_DEBUG "%s: invalid result_size (0) in "
-		       "hostscanresults\n", local->dev->name);
-		return;
-	}
-	if (copy_len > sizeof(struct hfa384x_hostscan_result))
-		copy_len = sizeof(struct hfa384x_hostscan_result);
-
-	pos++;
-	pos++;
-	left -= 4;
-	ptr = (u8 *) pos;
-
-	new_count = left / result_size;
-	results = kmalloc(new_count * sizeof(struct hfa384x_hostscan_result),
-			  GFP_ATOMIC);
-	if (results == NULL)
-		return;
-	memset(results, 0, new_count * sizeof(struct hfa384x_hostscan_result));
-
-	for (i = 0; i < new_count; i++) {
-		memcpy(&results[i], ptr, copy_len);
-		ptr += result_size;
-		left -= result_size;
-	}
-
-	if (left) {
-		printk(KERN_DEBUG "%s: short HostScan result entry (%d/%d)\n",
-		       local->dev->name, left, result_size);
-	}
-
-	spin_lock_irqsave(&local->lock, flags);
-	local->last_scan_type = PRISM2_HOSTSCAN;
-	prev = local->last_scan_results;
-	local->last_scan_results = results;
-	local->last_scan_results_count = new_count;
-	spin_unlock_irqrestore(&local->lock, flags);
-	kfree(prev);
-
-	hostap_report_scan_complete(local);
-}
-#endif /* PRISM2_NO_STATION_MODES */
-
-
-/* Called only as a tasklet (software IRQ) */
-void hostap_info_process(local_info_t *local, struct sk_buff *skb)
-{
-	struct hfa384x_info_frame *info;
-	unsigned char *buf;
-	int left;
-#ifndef PRISM2_NO_DEBUG
-	int i;
-#endif /* PRISM2_NO_DEBUG */
-
-	info = (struct hfa384x_info_frame *) skb->data;
-	buf = skb->data + sizeof(*info);
-	left = skb->len - sizeof(*info);
-
-	switch (info->type) {
-	case HFA384X_INFO_COMMTALLIES:
-		prism2_info_commtallies(local, buf, left);
-		break;
-
-#ifndef PRISM2_NO_STATION_MODES
-	case HFA384X_INFO_LINKSTATUS:
-		prism2_info_linkstatus(local, buf, left);
-		break;
-
-	case HFA384X_INFO_SCANRESULTS:
-		prism2_info_scanresults(local, buf, left);
-		break;
-
-	case HFA384X_INFO_HOSTSCANRESULTS:
-		prism2_info_hostscanresults(local, buf, left);
-		break;
-#endif /* PRISM2_NO_STATION_MODES */
-
-#ifndef PRISM2_NO_DEBUG
-	default:
-		PDEBUG(DEBUG_EXTRA, "%s: INFO - len=%d type=0x%04x\n",
-		       local->dev->name, info->len, info->type);
-		PDEBUG(DEBUG_EXTRA, "Unknown info frame:");
-		for (i = 0; i < (left < 100 ? left : 100); i++)
-			PDEBUG2(DEBUG_EXTRA, " %02x", buf[i]);
-		PDEBUG2(DEBUG_EXTRA, "\n");
-		break;
-#endif /* PRISM2_NO_DEBUG */
-	}
-}
-
-
-#ifndef PRISM2_NO_STATION_MODES
-static void handle_info_queue_linkstatus(local_info_t *local)
-{
-	int val = local->prev_link_status;
-	int connected;
-	union iwreq_data wrqu;
-
-	connected =
-		val == HFA384X_LINKSTATUS_CONNECTED ||
-		val == HFA384X_LINKSTATUS_AP_CHANGE ||
-		val == HFA384X_LINKSTATUS_AP_IN_RANGE;
-
-	if (local->func->get_rid(local->dev, HFA384X_RID_CURRENTBSSID,
-				 local->bssid, ETH_ALEN, 1) < 0) {
-		printk(KERN_DEBUG "%s: could not read CURRENTBSSID after "
-		       "LinkStatus event\n", local->dev->name);
-	} else {
-		PDEBUG(DEBUG_EXTRA, "%s: LinkStatus: BSSID=" MACSTR "\n",
-		       local->dev->name,
-		       MAC2STR((unsigned char *) local->bssid));
-		if (local->wds_type & HOSTAP_WDS_AP_CLIENT)
-			hostap_add_sta(local->ap, local->bssid);
-	}
-
-	/* Get BSSID if we have a valid AP address */
-	if (connected) {
-		netif_carrier_on(local->dev);
-		netif_carrier_on(local->ddev);
-		memcpy(wrqu.ap_addr.sa_data, local->bssid, ETH_ALEN);
-	} else {
-		netif_carrier_off(local->dev);
-		netif_carrier_off(local->ddev);
-		memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
-	}
-	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-
-	/*
-	 * Filter out sequential disconnect events in order not to cause a
-	 * flood of SIOCGIWAP events that have a race condition with EAPOL
-	 * frames and can confuse wpa_supplicant about the current association
-	 * status.
-	 */
-	if (connected || local->prev_linkstatus_connected)
-		wireless_send_event(local->dev, SIOCGIWAP, &wrqu, NULL);
-	local->prev_linkstatus_connected = connected;
-}
-
-
-static void handle_info_queue_scanresults(local_info_t *local)
-{
-	if (local->host_roaming == 1 && local->iw_mode == IW_MODE_INFRA)
-		prism2_host_roaming(local);
-
-	if (local->host_roaming == 2 && local->iw_mode == IW_MODE_INFRA &&
-	    memcmp(local->preferred_ap, "\x00\x00\x00\x00\x00\x00",
-		   ETH_ALEN) != 0) {
-		/*
-		 * Firmware seems to be getting into odd state in host_roaming
-		 * mode 2 when hostscan is used without join command, so try
-		 * to fix this by re-joining the current AP. This does not
-		 * actually trigger a new association if the current AP is
-		 * still in the scan results.
-		 */
-		prism2_host_roaming(local);
-	}
-}
-
-
-/* Called only as scheduled task after receiving info frames (used to avoid
- * pending too much time in HW IRQ handler). */
-static void handle_info_queue(void *data)
-{
-	local_info_t *local = (local_info_t *) data;
-
-	if (test_and_clear_bit(PRISM2_INFO_PENDING_LINKSTATUS,
-			       &local->pending_info))
-		handle_info_queue_linkstatus(local);
-
-	if (test_and_clear_bit(PRISM2_INFO_PENDING_SCANRESULTS,
-			       &local->pending_info))
-		handle_info_queue_scanresults(local);
-}
-#endif /* PRISM2_NO_STATION_MODES */
-
-
-void hostap_info_init(local_info_t *local)
-{
-	skb_queue_head_init(&local->info_list);
-#ifndef PRISM2_NO_STATION_MODES
-	INIT_WORK(&local->info_queue, handle_info_queue, local);
-#endif /* PRISM2_NO_STATION_MODES */
-}
-
-
-EXPORT_SYMBOL(hostap_info_init);
-EXPORT_SYMBOL(hostap_info_process);
diff --git a/trunk/drivers/net/wireless/hostap/hostap_ioctl.c b/trunk/drivers/net/wireless/hostap/hostap_ioctl.c
deleted file mode 100644
index e720369a3515..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_ioctl.c
+++ /dev/null
@@ -1,4102 +0,0 @@
-/* ioctl() (mostly Linux Wireless Extensions) routines for Host AP driver */
-
-#ifdef in_atomic
-/* Get kernel_locked() for in_atomic() */
-#include <linux/smp_lock.h>
-#endif
-#include <linux/ethtool.h>
-
-
-static struct iw_statistics *hostap_get_wireless_stats(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct iw_statistics *wstats;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	/* Why are we doing that ? Jean II */
-	if (iface->type != HOSTAP_INTERFACE_MAIN)
-		return NULL;
-
-	wstats = &local->wstats;
-
-	wstats->status = 0;
-	wstats->discard.code =
-		local->comm_tallies.rx_discards_wep_undecryptable;
-	wstats->discard.misc =
-		local->comm_tallies.rx_fcs_errors +
-		local->comm_tallies.rx_discards_no_buffer +
-		local->comm_tallies.tx_discards_wrong_sa;
-
-	wstats->discard.retries =
-		local->comm_tallies.tx_retry_limit_exceeded;
-	wstats->discard.fragment =
-		local->comm_tallies.rx_message_in_bad_msg_fragments;
-
-	if (local->iw_mode != IW_MODE_MASTER &&
-	    local->iw_mode != IW_MODE_REPEAT) {
-		int update = 1;
-#ifdef in_atomic
-		/* RID reading might sleep and it must not be called in
-		 * interrupt context or while atomic. However, this
-		 * function seems to be called while atomic (at least in Linux
-		 * 2.5.59). Update signal quality values only if in suitable
-		 * context. Otherwise, previous values read from tick timer
-		 * will be used. */
-		if (in_atomic())
-			update = 0;
-#endif /* in_atomic */
-
-		if (update && prism2_update_comms_qual(dev) == 0)
-			wstats->qual.updated = 7;
-
-		wstats->qual.qual = local->comms_qual;
-		wstats->qual.level = local->avg_signal;
-		wstats->qual.noise = local->avg_noise;
-	} else {
-		wstats->qual.qual = 0;
-		wstats->qual.level = 0;
-		wstats->qual.noise = 0;
-		wstats->qual.updated = 0;
-	}
-
-	return wstats;
-}
-
-
-static int prism2_get_datarates(struct net_device *dev, u8 *rates)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u8 buf[12];
-	int len;
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	len = local->func->get_rid(dev, HFA384X_RID_SUPPORTEDDATARATES, buf,
-				   sizeof(buf), 0);
-	if (len < 2)
-		return 0;
-
-	val = le16_to_cpu(*(u16 *) buf); /* string length */
-
-	if (len - 2 < val || val > 10)
-		return 0;
-
-	memcpy(rates, buf + 2, val);
-	return val;
-}
-
-
-static int prism2_get_name(struct net_device *dev,
-			   struct iw_request_info *info,
-			   char *name, char *extra)
-{
-	u8 rates[10];
-	int len, i, over2 = 0;
-
-	len = prism2_get_datarates(dev, rates);
-
-	for (i = 0; i < len; i++) {
-		if (rates[i] == 0x0b || rates[i] == 0x16) {
-			over2 = 1;
-			break;
-		}
-	}
-
-	strcpy(name, over2 ? "IEEE 802.11b" : "IEEE 802.11-DS");
-
-	return 0;
-}
-
-
-static void prism2_crypt_delayed_deinit(local_info_t *local,
-					struct ieee80211_crypt_data **crypt)
-{
-	struct ieee80211_crypt_data *tmp;
-	unsigned long flags;
-
-	tmp = *crypt;
-	*crypt = NULL;
-
-	if (tmp == NULL)
-		return;
-
-	/* must not run ops->deinit() while there may be pending encrypt or
-	 * decrypt operations. Use a list of delayed deinits to avoid needing
-	 * locking. */
-
-	spin_lock_irqsave(&local->lock, flags);
-	list_add(&tmp->list, &local->crypt_deinit_list);
-	if (!timer_pending(&local->crypt_deinit_timer)) {
-		local->crypt_deinit_timer.expires = jiffies + HZ;
-		add_timer(&local->crypt_deinit_timer);
-	}
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-
-static int prism2_ioctl_siwencode(struct net_device *dev,
-				  struct iw_request_info *info,
-				  struct iw_point *erq, char *keybuf)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int i;
-	struct ieee80211_crypt_data **crypt;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	i = erq->flags & IW_ENCODE_INDEX;
-	if (i < 1 || i > 4)
-		i = local->tx_keyidx;
-	else
-		i--;
-	if (i < 0 || i >= WEP_KEYS)
-		return -EINVAL;
-
-	crypt = &local->crypt[i];
-
-	if (erq->flags & IW_ENCODE_DISABLED) {
-		if (*crypt)
-			prism2_crypt_delayed_deinit(local, crypt);
-		goto done;
-	}
-
-	if (*crypt != NULL && (*crypt)->ops != NULL &&
-	    strcmp((*crypt)->ops->name, "WEP") != 0) {
-		/* changing to use WEP; deinit previously used algorithm */
-		prism2_crypt_delayed_deinit(local, crypt);
-	}
-
-	if (*crypt == NULL) {
-		struct ieee80211_crypt_data *new_crypt;
-
-		/* take WEP into use */
-		new_crypt = (struct ieee80211_crypt_data *)
-			kmalloc(sizeof(struct ieee80211_crypt_data),
-				GFP_KERNEL);
-		if (new_crypt == NULL)
-			return -ENOMEM;
-		memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
-		new_crypt->ops = ieee80211_get_crypto_ops("WEP");
-		if (!new_crypt->ops) {
-			request_module("ieee80211_crypt_wep");
-			new_crypt->ops = ieee80211_get_crypto_ops("WEP");
-		}
-		if (new_crypt->ops)
-			new_crypt->priv = new_crypt->ops->init(i);
-		if (!new_crypt->ops || !new_crypt->priv) {
-			kfree(new_crypt);
-			new_crypt = NULL;
-
-			printk(KERN_WARNING "%s: could not initialize WEP: "
-			       "load module hostap_crypt_wep.o\n",
-			       dev->name);
-			return -EOPNOTSUPP;
-		}
-		*crypt = new_crypt;
-	}
-
-	if (erq->length > 0) {
-		int len = erq->length <= 5 ? 5 : 13;
-		int first = 1, j;
-		if (len > erq->length)
-			memset(keybuf + erq->length, 0, len - erq->length);
-		(*crypt)->ops->set_key(keybuf, len, NULL, (*crypt)->priv);
-		for (j = 0; j < WEP_KEYS; j++) {
-			if (j != i && local->crypt[j]) {
-				first = 0;
-				break;
-			}
-		}
-		if (first)
-			local->tx_keyidx = i;
-	} else {
-		/* No key data - just set the default TX key index */
-		local->tx_keyidx = i;
-	}
-
- done:
-	local->open_wep = erq->flags & IW_ENCODE_OPEN;
-
-	if (hostap_set_encryption(local)) {
-		printk(KERN_DEBUG "%s: set_encryption failed\n", dev->name);
-		return -EINVAL;
-	}
-
-	/* Do not reset port0 if card is in Managed mode since resetting will
-	 * generate new IEEE 802.11 authentication which may end up in looping
-	 * with IEEE 802.1X. Prism2 documentation seem to require port reset
-	 * after WEP configuration. However, keys are apparently changed at
-	 * least in Managed mode. */
-	if (local->iw_mode != IW_MODE_INFRA && local->func->reset_port(dev)) {
-		printk(KERN_DEBUG "%s: reset_port failed\n", dev->name);
-		return -EINVAL;
-	}
-
-	return 0;
-}
-
-
-static int prism2_ioctl_giwencode(struct net_device *dev,
-				  struct iw_request_info *info,
-				  struct iw_point *erq, char *key)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int i, len;
-	u16 val;
-	struct ieee80211_crypt_data *crypt;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	i = erq->flags & IW_ENCODE_INDEX;
-	if (i < 1 || i > 4)
-		i = local->tx_keyidx;
-	else
-		i--;
-	if (i < 0 || i >= WEP_KEYS)
-		return -EINVAL;
-
-	crypt = local->crypt[i];
-	erq->flags = i + 1;
-
-	if (crypt == NULL || crypt->ops == NULL) {
-		erq->length = 0;
-		erq->flags |= IW_ENCODE_DISABLED;
-		return 0;
-	}
-
-	if (strcmp(crypt->ops->name, "WEP") != 0) {
-		/* only WEP is supported with wireless extensions, so just
-		 * report that encryption is used */
-		erq->length = 0;
-		erq->flags |= IW_ENCODE_ENABLED;
-		return 0;
-	}
-
-	/* Reads from HFA384X_RID_CNFDEFAULTKEY* return bogus values, so show
-	 * the keys from driver buffer */
-	len = crypt->ops->get_key(key, WEP_KEY_LEN, NULL, crypt->priv);
-	erq->length = (len >= 0 ? len : 0);
-
-	if (local->func->get_rid(dev, HFA384X_RID_CNFWEPFLAGS, &val, 2, 1) < 0)
-	{
-		printk("CNFWEPFLAGS reading failed\n");
-		return -EOPNOTSUPP;
-	}
-	le16_to_cpus(&val);
-	if (val & HFA384X_WEPFLAGS_PRIVACYINVOKED)
-		erq->flags |= IW_ENCODE_ENABLED;
-	else
-		erq->flags |= IW_ENCODE_DISABLED;
-	if (val & HFA384X_WEPFLAGS_EXCLUDEUNENCRYPTED)
-		erq->flags |= IW_ENCODE_RESTRICTED;
-	else
-		erq->flags |= IW_ENCODE_OPEN;
-
-	return 0;
-}
-
-
-static int hostap_set_rate(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int ret, basic_rates;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	basic_rates = local->basic_rates & local->tx_rate_control;
-	if (!basic_rates || basic_rates != local->basic_rates) {
-		printk(KERN_INFO "%s: updating basic rate set automatically "
-		       "to match with the new supported rate set\n",
-		       dev->name);
-		if (!basic_rates)
-			basic_rates = local->tx_rate_control;
-
-		local->basic_rates = basic_rates;
-		if (hostap_set_word(dev, HFA384X_RID_CNFBASICRATES,
-				    basic_rates))
-			printk(KERN_WARNING "%s: failed to set "
-			       "cnfBasicRates\n", dev->name);
-	}
-
-	ret = (hostap_set_word(dev, HFA384X_RID_TXRATECONTROL,
-			       local->tx_rate_control) ||
-	       hostap_set_word(dev, HFA384X_RID_CNFSUPPORTEDRATES,
-			       local->tx_rate_control) ||
-	       local->func->reset_port(dev));
-
-	if (ret) {
-		printk(KERN_WARNING "%s: TXRateControl/cnfSupportedRates "
-		       "setting to 0x%x failed\n",
-		       dev->name, local->tx_rate_control);
-	}
-
-	/* Update TX rate configuration for all STAs based on new operational
-	 * rate set. */
-	hostap_update_rates(local);
-
-	return ret;
-}
-
-
-static int prism2_ioctl_siwrate(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_param *rrq, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (rrq->fixed) {
-		switch (rrq->value) {
-		case 11000000:
-			local->tx_rate_control = HFA384X_RATES_11MBPS;
-			break;
-		case 5500000:
-			local->tx_rate_control = HFA384X_RATES_5MBPS;
-			break;
-		case 2000000:
-			local->tx_rate_control = HFA384X_RATES_2MBPS;
-			break;
-		case 1000000:
-			local->tx_rate_control = HFA384X_RATES_1MBPS;
-			break;
-		default:
-			local->tx_rate_control = HFA384X_RATES_1MBPS |
-				HFA384X_RATES_2MBPS | HFA384X_RATES_5MBPS |
-				HFA384X_RATES_11MBPS;
-			break;
-		}
-	} else {
-		switch (rrq->value) {
-		case 11000000:
-			local->tx_rate_control = HFA384X_RATES_1MBPS |
-				HFA384X_RATES_2MBPS | HFA384X_RATES_5MBPS |
-				HFA384X_RATES_11MBPS;
-			break;
-		case 5500000:
-			local->tx_rate_control = HFA384X_RATES_1MBPS |
-				HFA384X_RATES_2MBPS | HFA384X_RATES_5MBPS;
-			break;
-		case 2000000:
-			local->tx_rate_control = HFA384X_RATES_1MBPS |
-				HFA384X_RATES_2MBPS;
-			break;
-		case 1000000:
-			local->tx_rate_control = HFA384X_RATES_1MBPS;
-			break;
-		default:
-			local->tx_rate_control = HFA384X_RATES_1MBPS |
-				HFA384X_RATES_2MBPS | HFA384X_RATES_5MBPS |
-				HFA384X_RATES_11MBPS;
-			break;
-		}
-	}
-
-	return hostap_set_rate(dev);
-}
-
-
-static int prism2_ioctl_giwrate(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_param *rrq, char *extra)
-{
-	u16 val;
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int ret = 0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->get_rid(dev, HFA384X_RID_TXRATECONTROL, &val, 2, 1) <
-	    0)
-		return -EINVAL;
-
-	if ((val & 0x1) && (val > 1))
-		rrq->fixed = 0;
-	else
-		rrq->fixed = 1;
-
-	if (local->iw_mode == IW_MODE_MASTER && local->ap != NULL &&
-	    !local->fw_tx_rate_control) {
-		/* HFA384X_RID_CURRENTTXRATE seems to always be 2 Mbps in
-		 * Host AP mode, so use the recorded TX rate of the last sent
-		 * frame */
-		rrq->value = local->ap->last_tx_rate > 0 ?
-			local->ap->last_tx_rate * 100000 : 11000000;
-		return 0;
-	}
-
-	if (local->func->get_rid(dev, HFA384X_RID_CURRENTTXRATE, &val, 2, 1) <
-	    0)
-		return -EINVAL;
-
-	switch (val) {
-	case HFA384X_RATES_1MBPS:
-		rrq->value = 1000000;
-		break;
-	case HFA384X_RATES_2MBPS:
-		rrq->value = 2000000;
-		break;
-	case HFA384X_RATES_5MBPS:
-		rrq->value = 5500000;
-		break;
-	case HFA384X_RATES_11MBPS:
-		rrq->value = 11000000;
-		break;
-	default:
-		/* should not happen */
-		rrq->value = 11000000;
-		ret = -EINVAL;
-		break;
-	}
-
-	return ret;
-}
-
-
-static int prism2_ioctl_siwsens(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_param *sens, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	/* Set the desired AP density */
-	if (sens->value < 1 || sens->value > 3)
-		return -EINVAL;
-
-	if (hostap_set_word(dev, HFA384X_RID_CNFSYSTEMSCALE, sens->value) ||
-	    local->func->reset_port(dev))
-		return -EINVAL;
-
-	return 0;
-}
-
-static int prism2_ioctl_giwsens(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_param *sens, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	/* Get the current AP density */
-	if (local->func->get_rid(dev, HFA384X_RID_CNFSYSTEMSCALE, &val, 2, 1) <
-	    0)
-		return -EINVAL;
-
-	sens->value = __le16_to_cpu(val);
-	sens->fixed = 1;
-
-	return 0;
-}
-
-
-/* Deprecated in new wireless extension API */
-static int prism2_ioctl_giwaplist(struct net_device *dev,
-				  struct iw_request_info *info,
-				  struct iw_point *data, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct sockaddr *addr;
-	struct iw_quality *qual;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->iw_mode != IW_MODE_MASTER) {
-		printk(KERN_DEBUG "SIOCGIWAPLIST is currently only supported "
-		       "in Host AP mode\n");
-		data->length = 0;
-		return -EOPNOTSUPP;
-	}
-
-	addr = kmalloc(sizeof(struct sockaddr) * IW_MAX_AP, GFP_KERNEL);
-	qual = kmalloc(sizeof(struct iw_quality) * IW_MAX_AP, GFP_KERNEL);
-	if (addr == NULL || qual == NULL) {
-		kfree(addr);
-		kfree(qual);
-		data->length = 0;
-		return -ENOMEM;
-	}
-
-	data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1);
-
-	memcpy(extra, &addr, sizeof(struct sockaddr) * data->length);
-	data->flags = 1; /* has quality information */
-	memcpy(extra + sizeof(struct sockaddr) * data->length, &qual,
-	       sizeof(struct iw_quality) * data->length);
-
-	kfree(addr);
-	kfree(qual);
-
-	return 0;
-}
-
-
-static int prism2_ioctl_siwrts(struct net_device *dev,
-			       struct iw_request_info *info,
-			       struct iw_param *rts, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (rts->disabled)
-		val = __constant_cpu_to_le16(2347);
-	else if (rts->value < 0 || rts->value > 2347)
-		return -EINVAL;
-	else
-		val = __cpu_to_le16(rts->value);
-
-	if (local->func->set_rid(dev, HFA384X_RID_RTSTHRESHOLD, &val, 2) ||
-	    local->func->reset_port(dev))
-		return -EINVAL;
-
-	local->rts_threshold = rts->value;
-
-	return 0;
-}
-
-static int prism2_ioctl_giwrts(struct net_device *dev,
-			       struct iw_request_info *info,
-			       struct iw_param *rts, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->get_rid(dev, HFA384X_RID_RTSTHRESHOLD, &val, 2, 1) <
-	    0)
-		return -EINVAL;
-
-	rts->value = __le16_to_cpu(val);
-	rts->disabled = (rts->value == 2347);
-	rts->fixed = 1;
-
-	return 0;
-}
-
-
-static int prism2_ioctl_siwfrag(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_param *rts, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (rts->disabled)
-		val = __constant_cpu_to_le16(2346);
-	else if (rts->value < 256 || rts->value > 2346)
-		return -EINVAL;
-	else
-		val = __cpu_to_le16(rts->value & ~0x1); /* even numbers only */
-
-	local->fragm_threshold = rts->value & ~0x1;
-	if (local->func->set_rid(dev, HFA384X_RID_FRAGMENTATIONTHRESHOLD, &val,
-				 2)
-	    || local->func->reset_port(dev))
-		return -EINVAL;
-
-	return 0;
-}
-
-static int prism2_ioctl_giwfrag(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_param *rts, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->get_rid(dev, HFA384X_RID_FRAGMENTATIONTHRESHOLD,
-				 &val, 2, 1) < 0)
-		return -EINVAL;
-
-	rts->value = __le16_to_cpu(val);
-	rts->disabled = (rts->value == 2346);
-	rts->fixed = 1;
-
-	return 0;
-}
-
-
-#ifndef PRISM2_NO_STATION_MODES
-static int hostap_join_ap(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct hfa384x_join_request req;
-	unsigned long flags;
-	int i;
-	struct hfa384x_hostscan_result *entry;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	memcpy(req.bssid, local->preferred_ap, ETH_ALEN);
-	req.channel = 0;
-
-	spin_lock_irqsave(&local->lock, flags);
-	for (i = 0; i < local->last_scan_results_count; i++) {
-		if (!local->last_scan_results)
-			break;
-		entry = &local->last_scan_results[i];
-		if (memcmp(local->preferred_ap, entry->bssid, ETH_ALEN) == 0) {
-			req.channel = entry->chid;
-			break;
-		}
-	}
-	spin_unlock_irqrestore(&local->lock, flags);
-
-	if (local->func->set_rid(dev, HFA384X_RID_JOINREQUEST, &req,
-				 sizeof(req))) {
-		printk(KERN_DEBUG "%s: JoinRequest " MACSTR
-		       " failed\n",
-		       dev->name, MAC2STR(local->preferred_ap));
-		return -1;
-	}
-
-	printk(KERN_DEBUG "%s: Trying to join BSSID " MACSTR "\n",
-	       dev->name, MAC2STR(local->preferred_ap));
-
-	return 0;
-}
-#endif /* PRISM2_NO_STATION_MODES */
-
-
-static int prism2_ioctl_siwap(struct net_device *dev,
-			      struct iw_request_info *info,
-			      struct sockaddr *ap_addr, char *extra)
-{
-#ifdef PRISM2_NO_STATION_MODES
-	return -EOPNOTSUPP;
-#else /* PRISM2_NO_STATION_MODES */
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	memcpy(local->preferred_ap, &ap_addr->sa_data, ETH_ALEN);
-
-	if (local->host_roaming == 1 && local->iw_mode == IW_MODE_INFRA) {
-		struct hfa384x_scan_request scan_req;
-		memset(&scan_req, 0, sizeof(scan_req));
-		scan_req.channel_list = __constant_cpu_to_le16(0x3fff);
-		scan_req.txrate = __constant_cpu_to_le16(HFA384X_RATES_1MBPS);
-		if (local->func->set_rid(dev, HFA384X_RID_SCANREQUEST,
-					 &scan_req, sizeof(scan_req))) {
-			printk(KERN_DEBUG "%s: ScanResults request failed - "
-			       "preferred AP delayed to next unsolicited "
-			       "scan\n", dev->name);
-		}
-	} else if (local->host_roaming == 2 &&
-		   local->iw_mode == IW_MODE_INFRA) {
-		if (hostap_join_ap(dev))
-			return -EINVAL;
-	} else {
-		printk(KERN_DEBUG "%s: Preferred AP (SIOCSIWAP) is used only "
-		       "in Managed mode when host_roaming is enabled\n",
-		       dev->name);
-	}
-
-	return 0;
-#endif /* PRISM2_NO_STATION_MODES */
-}
-
-static int prism2_ioctl_giwap(struct net_device *dev,
-			      struct iw_request_info *info,
-			      struct sockaddr *ap_addr, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	ap_addr->sa_family = ARPHRD_ETHER;
-	switch (iface->type) {
-	case HOSTAP_INTERFACE_AP:
-		memcpy(&ap_addr->sa_data, dev->dev_addr, ETH_ALEN);
-		break;
-	case HOSTAP_INTERFACE_STA:
-		memcpy(&ap_addr->sa_data, local->assoc_ap_addr, ETH_ALEN);
-		break;
-	case HOSTAP_INTERFACE_WDS:
-		memcpy(&ap_addr->sa_data, iface->u.wds.remote_addr, ETH_ALEN);
-		break;
-	default:
-		if (local->func->get_rid(dev, HFA384X_RID_CURRENTBSSID,
-					 &ap_addr->sa_data, ETH_ALEN, 1) < 0)
-			return -EOPNOTSUPP;
-
-		/* local->bssid is also updated in LinkStatus handler when in
-		 * station mode */
-		memcpy(local->bssid, &ap_addr->sa_data, ETH_ALEN);
-		break;
-	}
-
-	return 0;
-}
-
-
-static int prism2_ioctl_siwnickn(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_point *data, char *nickname)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	memset(local->name, 0, sizeof(local->name));
-	memcpy(local->name, nickname, data->length);
-	local->name_set = 1;
-
-	if (hostap_set_string(dev, HFA384X_RID_CNFOWNNAME, local->name) ||
-	    local->func->reset_port(dev))
-		return -EINVAL;
-
-	return 0;
-}
-
-static int prism2_ioctl_giwnickn(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_point *data, char *nickname)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int len;
-	char name[MAX_NAME_LEN + 3];
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	len = local->func->get_rid(dev, HFA384X_RID_CNFOWNNAME,
-				   &name, MAX_NAME_LEN + 2, 0);
-	val = __le16_to_cpu(*(u16 *) name);
-	if (len > MAX_NAME_LEN + 2 || len < 0 || val > MAX_NAME_LEN)
-		return -EOPNOTSUPP;
-
-	name[val + 2] = '\0';
-	data->length = val + 1;
-	memcpy(nickname, name + 2, val + 1);
-
-	return 0;
-}
-
-
-static int prism2_ioctl_siwfreq(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_freq *freq, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	/* freq => chan. */
-	if (freq->e == 1 &&
-	    freq->m / 100000 >= freq_list[0] &&
-	    freq->m / 100000 <= freq_list[FREQ_COUNT - 1]) {
-		int ch;
-		int fr = freq->m / 100000;
-		for (ch = 0; ch < FREQ_COUNT; ch++) {
-			if (fr == freq_list[ch]) {
-				freq->e = 0;
-				freq->m = ch + 1;
-				break;
-			}
-		}
-	}
-
-	if (freq->e != 0 || freq->m < 1 || freq->m > FREQ_COUNT ||
-	    !(local->channel_mask & (1 << (freq->m - 1))))
-		return -EINVAL;
-
-	local->channel = freq->m; /* channel is used in prism2_setup_rids() */
-	if (hostap_set_word(dev, HFA384X_RID_CNFOWNCHANNEL, local->channel) ||
-	    local->func->reset_port(dev))
-		return -EINVAL;
-
-	return 0;
-}
-
-static int prism2_ioctl_giwfreq(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_freq *freq, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->get_rid(dev, HFA384X_RID_CURRENTCHANNEL, &val, 2, 1) <
-	    0)
-		return -EINVAL;
-
-	le16_to_cpus(&val);
-	if (val < 1 || val > FREQ_COUNT)
-		return -EINVAL;
-
-	freq->m = freq_list[val - 1] * 100000;
-	freq->e = 1;
-
-	return 0;
-}
-
-
-static void hostap_monitor_set_type(local_info_t *local)
-{
-	struct net_device *dev = local->ddev;
-
-	if (dev == NULL)
-		return;
-
-	if (local->monitor_type == PRISM2_MONITOR_PRISM ||
-	    local->monitor_type == PRISM2_MONITOR_CAPHDR) {
-		dev->type = ARPHRD_IEEE80211_PRISM;
-		dev->hard_header_parse =
-			hostap_80211_prism_header_parse;
-	} else {
-		dev->type = ARPHRD_IEEE80211;
-		dev->hard_header_parse = hostap_80211_header_parse;
-	}
-}
-
-
-static int prism2_ioctl_siwessid(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_point *data, char *ssid)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (iface->type == HOSTAP_INTERFACE_WDS)
-		return -EOPNOTSUPP;
-
-	if (data->flags == 0)
-		ssid[0] = '\0'; /* ANY */
-
-	if (local->iw_mode == IW_MODE_MASTER && ssid[0] == '\0') {
-		/* Setting SSID to empty string seems to kill the card in
-		 * Host AP mode */
-		printk(KERN_DEBUG "%s: Host AP mode does not support "
-		       "'Any' essid\n", dev->name);
-		return -EINVAL;
-	}
-
-	memcpy(local->essid, ssid, data->length);
-	local->essid[data->length] = '\0';
-
-	if ((!local->fw_ap &&
-	     hostap_set_string(dev, HFA384X_RID_CNFDESIREDSSID, local->essid))
-	    || hostap_set_string(dev, HFA384X_RID_CNFOWNSSID, local->essid) ||
-	    local->func->reset_port(dev))
-		return -EINVAL;
-
-	return 0;
-}
-
-static int prism2_ioctl_giwessid(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_point *data, char *essid)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (iface->type == HOSTAP_INTERFACE_WDS)
-		return -EOPNOTSUPP;
-
-	data->flags = 1; /* active */
-	if (local->iw_mode == IW_MODE_MASTER) {
-		data->length = strlen(local->essid);
-		memcpy(essid, local->essid, IW_ESSID_MAX_SIZE);
-	} else {
-		int len;
-		char ssid[MAX_SSID_LEN + 2];
-		memset(ssid, 0, sizeof(ssid));
-		len = local->func->get_rid(dev, HFA384X_RID_CURRENTSSID,
-					   &ssid, MAX_SSID_LEN + 2, 0);
-		val = __le16_to_cpu(*(u16 *) ssid);
-		if (len > MAX_SSID_LEN + 2 || len < 0 || val > MAX_SSID_LEN) {
-			return -EOPNOTSUPP;
-		}
-		data->length = val;
-		memcpy(essid, ssid + 2, IW_ESSID_MAX_SIZE);
-	}
-
-	return 0;
-}
-
-
-static int prism2_ioctl_giwrange(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_point *data, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct iw_range *range = (struct iw_range *) extra;
-	u8 rates[10];
-	u16 val;
-	int i, len, over2;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	data->length = sizeof(struct iw_range);
-	memset(range, 0, sizeof(struct iw_range));
-
-	/* TODO: could fill num_txpower and txpower array with
-	 * something; however, there are 128 different values.. */
-
-	range->txpower_capa = IW_TXPOW_DBM;
-
-	if (local->iw_mode == IW_MODE_INFRA || local->iw_mode == IW_MODE_ADHOC)
-	{
-		range->min_pmp = 1 * 1024;
-		range->max_pmp = 65535 * 1024;
-		range->min_pmt = 1 * 1024;
-		range->max_pmt = 1000 * 1024;
-		range->pmp_flags = IW_POWER_PERIOD;
-		range->pmt_flags = IW_POWER_TIMEOUT;
-		range->pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT |
-			IW_POWER_UNICAST_R | IW_POWER_ALL_R;
-	}
-
-	range->we_version_compiled = WIRELESS_EXT;
-	range->we_version_source = 18;
-
-	range->retry_capa = IW_RETRY_LIMIT;
-	range->retry_flags = IW_RETRY_LIMIT;
-	range->min_retry = 0;
-	range->max_retry = 255;
-
-	range->num_channels = FREQ_COUNT;
-
-	val = 0;
-	for (i = 0; i < FREQ_COUNT; i++) {
-		if (local->channel_mask & (1 << i)) {
-			range->freq[val].i = i + 1;
-			range->freq[val].m = freq_list[i] * 100000;
-			range->freq[val].e = 1;
-			val++;
-		}
-		if (val == IW_MAX_FREQUENCIES)
-			break;
-	}
-	range->num_frequency = val;
-
-	if (local->sta_fw_ver >= PRISM2_FW_VER(1,3,1)) {
-		range->max_qual.qual = 70; /* what is correct max? This was not
-					    * documented exactly. At least
-					    * 69 has been observed. */
-		range->max_qual.level = 0; /* dB */
-		range->max_qual.noise = 0; /* dB */
-
-		/* What would be suitable values for "average/typical" qual? */
-		range->avg_qual.qual = 20;
-		range->avg_qual.level = -60;
-		range->avg_qual.noise = -95;
-	} else {
-		range->max_qual.qual = 92; /* 0 .. 92 */
-		range->max_qual.level = 154; /* 27 .. 154 */
-		range->max_qual.noise = 154; /* 27 .. 154 */
-	}
-	range->sensitivity = 3;
-
-	range->max_encoding_tokens = WEP_KEYS;
-	range->num_encoding_sizes = 2;
-	range->encoding_size[0] = 5;
-	range->encoding_size[1] = 13;
-
-	over2 = 0;
-	len = prism2_get_datarates(dev, rates);
-	range->num_bitrates = 0;
-	for (i = 0; i < len; i++) {
-		if (range->num_bitrates < IW_MAX_BITRATES) {
-			range->bitrate[range->num_bitrates] =
-				rates[i] * 500000;
-			range->num_bitrates++;
-		}
-		if (rates[i] == 0x0b || rates[i] == 0x16)
-			over2 = 1;
-	}
-	/* estimated maximum TCP throughput values (bps) */
-	range->throughput = over2 ? 5500000 : 1500000;
-
-	range->min_rts = 0;
-	range->max_rts = 2347;
-	range->min_frag = 256;
-	range->max_frag = 2346;
-
-	/* Event capability (kernel + driver) */
-	range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
-				IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
-				IW_EVENT_CAPA_MASK(SIOCGIWAP) |
-				IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
-	range->event_capa[1] = IW_EVENT_CAPA_K_1;
-	range->event_capa[4] = (IW_EVENT_CAPA_MASK(IWEVTXDROP) |
-				IW_EVENT_CAPA_MASK(IWEVCUSTOM) |
-				IW_EVENT_CAPA_MASK(IWEVREGISTERED) |
-				IW_EVENT_CAPA_MASK(IWEVEXPIRED));
-
-	range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
-		IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
-
-	return 0;
-}
-
-
-static int hostap_monitor_mode_enable(local_info_t *local)
-{
-	struct net_device *dev = local->dev;
-
-	printk(KERN_DEBUG "Enabling monitor mode\n");
-	hostap_monitor_set_type(local);
-
-	if (hostap_set_word(dev, HFA384X_RID_CNFPORTTYPE,
-			    HFA384X_PORTTYPE_PSEUDO_IBSS)) {
-		printk(KERN_DEBUG "Port type setting for monitor mode "
-		       "failed\n");
-		return -EOPNOTSUPP;
-	}
-
-	/* Host decrypt is needed to get the IV and ICV fields;
-	 * however, monitor mode seems to remove WEP flag from frame
-	 * control field */
-	if (hostap_set_word(dev, HFA384X_RID_CNFWEPFLAGS,
-			    HFA384X_WEPFLAGS_HOSTENCRYPT |
-			    HFA384X_WEPFLAGS_HOSTDECRYPT)) {
-		printk(KERN_DEBUG "WEP flags setting failed\n");
-		return -EOPNOTSUPP;
-	}
-
-	if (local->func->reset_port(dev) ||
-	    local->func->cmd(dev, HFA384X_CMDCODE_TEST |
-			     (HFA384X_TEST_MONITOR << 8),
-			     0, NULL, NULL)) {
-		printk(KERN_DEBUG "Setting monitor mode failed\n");
-		return -EOPNOTSUPP;
-	}
-
-	return 0;
-}
-
-
-static int hostap_monitor_mode_disable(local_info_t *local)
-{
-	struct net_device *dev = local->ddev;
-
-	if (dev == NULL)
-		return -1;
-
-	printk(KERN_DEBUG "%s: Disabling monitor mode\n", dev->name);
-	dev->type = ARPHRD_ETHER;
-	dev->hard_header_parse = local->saved_eth_header_parse;
-	if (local->func->cmd(dev, HFA384X_CMDCODE_TEST |
-			     (HFA384X_TEST_STOP << 8),
-			     0, NULL, NULL))
-		return -1;
-	return hostap_set_encryption(local);
-}
-
-
-static int prism2_ioctl_siwmode(struct net_device *dev,
-				struct iw_request_info *info,
-				__u32 *mode, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int double_reset = 0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (*mode != IW_MODE_ADHOC && *mode != IW_MODE_INFRA &&
-	    *mode != IW_MODE_MASTER && *mode != IW_MODE_REPEAT &&
-	    *mode != IW_MODE_MONITOR)
-		return -EOPNOTSUPP;
-
-#ifdef PRISM2_NO_STATION_MODES
-	if (*mode == IW_MODE_ADHOC || *mode == IW_MODE_INFRA)
-		return -EOPNOTSUPP;
-#endif /* PRISM2_NO_STATION_MODES */
-
-	if (*mode == local->iw_mode)
-		return 0;
-
-	if (*mode == IW_MODE_MASTER && local->essid[0] == '\0') {
-		printk(KERN_WARNING "%s: empty SSID not allowed in Master "
-		       "mode\n", dev->name);
-		return -EINVAL;
-	}
-
-	if (local->iw_mode == IW_MODE_MONITOR)
-		hostap_monitor_mode_disable(local);
-
-	if ((local->iw_mode == IW_MODE_ADHOC ||
-	     local->iw_mode == IW_MODE_MONITOR) && *mode == IW_MODE_MASTER) {
-		/* There seems to be a firmware bug in at least STA f/w v1.5.6
-		 * that leaves beacon frames to use IBSS type when moving from
-		 * IBSS to Host AP mode. Doing double Port0 reset seems to be
-		 * enough to workaround this. */
-		double_reset = 1;
-	}
-
-	printk(KERN_DEBUG "prism2: %s: operating mode changed "
-	       "%d -> %d\n", dev->name, local->iw_mode, *mode);
-	local->iw_mode = *mode;
-
-	if (local->iw_mode == IW_MODE_MONITOR)
-		hostap_monitor_mode_enable(local);
-	else if (local->iw_mode == IW_MODE_MASTER && !local->host_encrypt &&
-		 !local->fw_encrypt_ok) {
-		printk(KERN_DEBUG "%s: defaulting to host-based encryption as "
-		       "a workaround for firmware bug in Host AP mode WEP\n",
-		       dev->name);
-		local->host_encrypt = 1;
-	}
-
-	if (hostap_set_word(dev, HFA384X_RID_CNFPORTTYPE,
-			    hostap_get_porttype(local)))
-		return -EOPNOTSUPP;
-
-	if (local->func->reset_port(dev))
-		return -EINVAL;
-	if (double_reset && local->func->reset_port(dev))
-		return -EINVAL;
-
-	if (local->iw_mode != IW_MODE_INFRA && local->iw_mode != IW_MODE_ADHOC)
-	{
-		/* netif_carrier is used only in client modes for now, so make
-		 * sure carrier is on when moving to non-client modes. */
-		netif_carrier_on(local->dev);
-		netif_carrier_on(local->ddev);
-	}
-	return 0;
-}
-
-
-static int prism2_ioctl_giwmode(struct net_device *dev,
-				struct iw_request_info *info,
-				__u32 *mode, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	switch (iface->type) {
-	case HOSTAP_INTERFACE_STA:
-		*mode = IW_MODE_INFRA;
-		break;
-	case HOSTAP_INTERFACE_WDS:
-		*mode = IW_MODE_REPEAT;
-		break;
-	default:
-		*mode = local->iw_mode;
-		break;
-	}
-	return 0;
-}
-
-
-static int prism2_ioctl_siwpower(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_param *wrq, char *extra)
-{
-#ifdef PRISM2_NO_STATION_MODES
-	return -EOPNOTSUPP;
-#else /* PRISM2_NO_STATION_MODES */
-	int ret = 0;
-
-	if (wrq->disabled)
-		return hostap_set_word(dev, HFA384X_RID_CNFPMENABLED, 0);
-
-	switch (wrq->flags & IW_POWER_MODE) {
-	case IW_POWER_UNICAST_R:
-		ret = hostap_set_word(dev, HFA384X_RID_CNFMULTICASTRECEIVE, 0);
-		if (ret)
-			return ret;
-		ret = hostap_set_word(dev, HFA384X_RID_CNFPMENABLED, 1);
-		if (ret)
-			return ret;
-		break;
-	case IW_POWER_ALL_R:
-		ret = hostap_set_word(dev, HFA384X_RID_CNFMULTICASTRECEIVE, 1);
-		if (ret)
-			return ret;
-		ret = hostap_set_word(dev, HFA384X_RID_CNFPMENABLED, 1);
-		if (ret)
-			return ret;
-		break;
-	case IW_POWER_ON:
-		break;
-	default:
-		return -EINVAL;
-	}
-
-	if (wrq->flags & IW_POWER_TIMEOUT) {
-		ret = hostap_set_word(dev, HFA384X_RID_CNFPMENABLED, 1);
-		if (ret)
-			return ret;
-		ret = hostap_set_word(dev, HFA384X_RID_CNFPMHOLDOVERDURATION,
-				      wrq->value / 1024);
-		if (ret)
-			return ret;
-	}
-	if (wrq->flags & IW_POWER_PERIOD) {
-		ret = hostap_set_word(dev, HFA384X_RID_CNFPMENABLED, 1);
-		if (ret)
-			return ret;
-		ret = hostap_set_word(dev, HFA384X_RID_CNFMAXSLEEPDURATION,
-				      wrq->value / 1024);
-		if (ret)
-			return ret;
-	}
-
-	return ret;
-#endif /* PRISM2_NO_STATION_MODES */
-}
-
-
-static int prism2_ioctl_giwpower(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_param *rrq, char *extra)
-{
-#ifdef PRISM2_NO_STATION_MODES
-	return -EOPNOTSUPP;
-#else /* PRISM2_NO_STATION_MODES */
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 enable, mcast;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->get_rid(dev, HFA384X_RID_CNFPMENABLED, &enable, 2, 1)
-	    < 0)
-		return -EINVAL;
-
-	if (!__le16_to_cpu(enable)) {
-		rrq->disabled = 1;
-		return 0;
-	}
-
-	rrq->disabled = 0;
-
-	if ((rrq->flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
-		u16 timeout;
-		if (local->func->get_rid(dev,
-					 HFA384X_RID_CNFPMHOLDOVERDURATION,
-					 &timeout, 2, 1) < 0)
-			return -EINVAL;
-
-		rrq->flags = IW_POWER_TIMEOUT;
-		rrq->value = __le16_to_cpu(timeout) * 1024;
-	} else {
-		u16 period;
-		if (local->func->get_rid(dev, HFA384X_RID_CNFMAXSLEEPDURATION,
-					 &period, 2, 1) < 0)
-			return -EINVAL;
-
-		rrq->flags = IW_POWER_PERIOD;
-		rrq->value = __le16_to_cpu(period) * 1024;
-	}
-
-	if (local->func->get_rid(dev, HFA384X_RID_CNFMULTICASTRECEIVE, &mcast,
-				 2, 1) < 0)
-		return -EINVAL;
-
-	if (__le16_to_cpu(mcast))
-		rrq->flags |= IW_POWER_ALL_R;
-	else
-		rrq->flags |= IW_POWER_UNICAST_R;
-
-	return 0;
-#endif /* PRISM2_NO_STATION_MODES */
-}
-
-
-static int prism2_ioctl_siwretry(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_param *rrq, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (rrq->disabled)
-		return -EINVAL;
-
-	/* setting retry limits is not supported with the current station
-	 * firmware code; simulate this with alternative retry count for now */
-	if (rrq->flags == IW_RETRY_LIMIT) {
-		if (rrq->value < 0) {
-			/* disable manual retry count setting and use firmware
-			 * defaults */
-			local->manual_retry_count = -1;
-			local->tx_control &= ~HFA384X_TX_CTRL_ALT_RTRY;
-		} else {
-			if (hostap_set_word(dev, HFA384X_RID_CNFALTRETRYCOUNT,
-					    rrq->value)) {
-				printk(KERN_DEBUG "%s: Alternate retry count "
-				       "setting to %d failed\n",
-				       dev->name, rrq->value);
-				return -EOPNOTSUPP;
-			}
-
-			local->manual_retry_count = rrq->value;
-			local->tx_control |= HFA384X_TX_CTRL_ALT_RTRY;
-		}
-		return 0;
-	}
-
-	return -EOPNOTSUPP;
-
-#if 0
-	/* what could be done, if firmware would support this.. */
-
-	if (rrq->flags & IW_RETRY_LIMIT) {
-		if (rrq->flags & IW_RETRY_MAX)
-			HFA384X_RID_LONGRETRYLIMIT = rrq->value;
-		else if (rrq->flags & IW_RETRY_MIN)
-			HFA384X_RID_SHORTRETRYLIMIT = rrq->value;
-		else {
-			HFA384X_RID_LONGRETRYLIMIT = rrq->value;
-			HFA384X_RID_SHORTRETRYLIMIT = rrq->value;
-		}
-
-	}
-
-	if (rrq->flags & IW_RETRY_LIFETIME) {
-		HFA384X_RID_MAXTRANSMITLIFETIME = rrq->value / 1024;
-	}
-
-	return 0;
-#endif /* 0 */
-}
-
-static int prism2_ioctl_giwretry(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_param *rrq, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 shortretry, longretry, lifetime, altretry;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->get_rid(dev, HFA384X_RID_SHORTRETRYLIMIT, &shortretry,
-				 2, 1) < 0 ||
-	    local->func->get_rid(dev, HFA384X_RID_LONGRETRYLIMIT, &longretry,
-				 2, 1) < 0 ||
-	    local->func->get_rid(dev, HFA384X_RID_MAXTRANSMITLIFETIME,
-				 &lifetime, 2, 1) < 0)
-		return -EINVAL;
-
-	le16_to_cpus(&shortretry);
-	le16_to_cpus(&longretry);
-	le16_to_cpus(&lifetime);
-
-	rrq->disabled = 0;
-
-	if ((rrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
-		rrq->flags = IW_RETRY_LIFETIME;
-		rrq->value = lifetime * 1024;
-	} else {
-		if (local->manual_retry_count >= 0) {
-			rrq->flags = IW_RETRY_LIMIT;
-			if (local->func->get_rid(dev,
-						 HFA384X_RID_CNFALTRETRYCOUNT,
-						 &altretry, 2, 1) >= 0)
-				rrq->value = le16_to_cpu(altretry);
-			else
-				rrq->value = local->manual_retry_count;
-		} else if ((rrq->flags & IW_RETRY_MAX)) {
-			rrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
-			rrq->value = longretry;
-		} else {
-			rrq->flags = IW_RETRY_LIMIT;
-			rrq->value = shortretry;
-			if (shortretry != longretry)
-				rrq->flags |= IW_RETRY_MIN;
-		}
-	}
-	return 0;
-}
-
-
-/* Note! This TX power controlling is experimental and should not be used in
- * production use. It just sets raw power register and does not use any kind of
- * feedback information from the measured TX power (CR58). This is now
- * commented out to make sure that it is not used by accident. TX power
- * configuration will be enabled again after proper algorithm using feedback
- * has been implemented. */
-
-#ifdef RAW_TXPOWER_SETTING
-/* Map HFA386x's CR31 to and from dBm with some sort of ad hoc mapping..
- * This version assumes following mapping:
- * CR31 is 7-bit value with -64 to +63 range.
- * -64 is mapped into +20dBm and +63 into -43dBm.
- * This is certainly not an exact mapping for every card, but at least
- * increasing dBm value should correspond to increasing TX power.
- */
-
-static int prism2_txpower_hfa386x_to_dBm(u16 val)
-{
-	signed char tmp;
-
-	if (val > 255)
-		val = 255;
-
-	tmp = val;
-	tmp >>= 2;
-
-	return -12 - tmp;
-}
-
-static u16 prism2_txpower_dBm_to_hfa386x(int val)
-{
-	signed char tmp;
-
-	if (val > 20)
-		return 128;
-	else if (val < -43)
-		return 127;
-
-	tmp = val;
-	tmp = -12 - tmp;
-	tmp <<= 2;
-
-	return (unsigned char) tmp;
-}
-#endif /* RAW_TXPOWER_SETTING */
-
-
-static int prism2_ioctl_siwtxpow(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_param *rrq, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-#ifdef RAW_TXPOWER_SETTING
-	char *tmp;
-#endif
-	u16 val;
-	int ret = 0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (rrq->disabled) {
-		if (local->txpower_type != PRISM2_TXPOWER_OFF) {
-			val = 0xff; /* use all standby and sleep modes */
-			ret = local->func->cmd(dev, HFA384X_CMDCODE_WRITEMIF,
-					       HFA386X_CR_A_D_TEST_MODES2,
-					       &val, NULL);
-			printk(KERN_DEBUG "%s: Turning radio off: %s\n",
-			       dev->name, ret ? "failed" : "OK");
-			local->txpower_type = PRISM2_TXPOWER_OFF;
-		}
-		return (ret ? -EOPNOTSUPP : 0);
-	}
-
-	if (local->txpower_type == PRISM2_TXPOWER_OFF) {
-		val = 0; /* disable all standby and sleep modes */
-		ret = local->func->cmd(dev, HFA384X_CMDCODE_WRITEMIF,
-				       HFA386X_CR_A_D_TEST_MODES2, &val, NULL);
-		printk(KERN_DEBUG "%s: Turning radio on: %s\n",
-		       dev->name, ret ? "failed" : "OK");
-		local->txpower_type = PRISM2_TXPOWER_UNKNOWN;
-	}
-
-#ifdef RAW_TXPOWER_SETTING
-	if (!rrq->fixed && local->txpower_type != PRISM2_TXPOWER_AUTO) {
-		printk(KERN_DEBUG "Setting ALC on\n");
-		val = HFA384X_TEST_CFG_BIT_ALC;
-		local->func->cmd(dev, HFA384X_CMDCODE_TEST |
-				 (HFA384X_TEST_CFG_BITS << 8), 1, &val, NULL);
-		local->txpower_type = PRISM2_TXPOWER_AUTO;
-		return 0;
-	}
-
-	if (local->txpower_type != PRISM2_TXPOWER_FIXED) {
-		printk(KERN_DEBUG "Setting ALC off\n");
-		val = HFA384X_TEST_CFG_BIT_ALC;
-		local->func->cmd(dev, HFA384X_CMDCODE_TEST |
-				 (HFA384X_TEST_CFG_BITS << 8), 0, &val, NULL);
-			local->txpower_type = PRISM2_TXPOWER_FIXED;
-	}
-
-	if (rrq->flags == IW_TXPOW_DBM)
-		tmp = "dBm";
-	else if (rrq->flags == IW_TXPOW_MWATT)
-		tmp = "mW";
-	else
-		tmp = "UNKNOWN";
-	printk(KERN_DEBUG "Setting TX power to %d %s\n", rrq->value, tmp);
-
-	if (rrq->flags != IW_TXPOW_DBM) {
-		printk("SIOCSIWTXPOW with mW is not supported; use dBm\n");
-		return -EOPNOTSUPP;
-	}
-
-	local->txpower = rrq->value;
-	val = prism2_txpower_dBm_to_hfa386x(local->txpower);
-	if (local->func->cmd(dev, HFA384X_CMDCODE_WRITEMIF,
-			     HFA386X_CR_MANUAL_TX_POWER, &val, NULL))
-		ret = -EOPNOTSUPP;
-#else /* RAW_TXPOWER_SETTING */
-	if (rrq->fixed)
-		ret = -EOPNOTSUPP;
-#endif /* RAW_TXPOWER_SETTING */
-
-	return ret;
-}
-
-static int prism2_ioctl_giwtxpow(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_param *rrq, char *extra)
-{
-#ifdef RAW_TXPOWER_SETTING
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 resp0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	rrq->flags = IW_TXPOW_DBM;
-	rrq->disabled = 0;
-	rrq->fixed = 0;
-
-	if (local->txpower_type == PRISM2_TXPOWER_AUTO) {
-		if (local->func->cmd(dev, HFA384X_CMDCODE_READMIF,
-				     HFA386X_CR_MANUAL_TX_POWER,
-				     NULL, &resp0) == 0) {
-			rrq->value = prism2_txpower_hfa386x_to_dBm(resp0);
-		} else {
-			/* Could not get real txpower; guess 15 dBm */
-			rrq->value = 15;
-		}
-	} else if (local->txpower_type == PRISM2_TXPOWER_OFF) {
-		rrq->value = 0;
-		rrq->disabled = 1;
-	} else if (local->txpower_type == PRISM2_TXPOWER_FIXED) {
-		rrq->value = local->txpower;
-		rrq->fixed = 1;
-	} else {
-		printk("SIOCGIWTXPOW - unknown txpower_type=%d\n",
-		       local->txpower_type);
-	}
-	return 0;
-#else /* RAW_TXPOWER_SETTING */
-	return -EOPNOTSUPP;
-#endif /* RAW_TXPOWER_SETTING */
-}
-
-
-#ifndef PRISM2_NO_STATION_MODES
-
-/* HostScan request works with and without host_roaming mode. In addition, it
- * does not break current association. However, it requires newer station
- * firmware version (>= 1.3.1) than scan request. */
-static int prism2_request_hostscan(struct net_device *dev,
-				   u8 *ssid, u8 ssid_len)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct hfa384x_hostscan_request scan_req;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	memset(&scan_req, 0, sizeof(scan_req));
-	scan_req.channel_list = cpu_to_le16(local->channel_mask &
-					    local->scan_channel_mask);
-	scan_req.txrate = __constant_cpu_to_le16(HFA384X_RATES_1MBPS);
-	if (ssid) {
-		if (ssid_len > 32)
-			return -EINVAL;
-		scan_req.target_ssid_len = cpu_to_le16(ssid_len);
-		memcpy(scan_req.target_ssid, ssid, ssid_len);
-	}
-
-	if (local->func->set_rid(dev, HFA384X_RID_HOSTSCAN, &scan_req,
-				 sizeof(scan_req))) {
-		printk(KERN_DEBUG "%s: HOSTSCAN failed\n", dev->name);
-		return -EINVAL;
-	}
-	return 0;
-}
-
-
-static int prism2_request_scan(struct net_device *dev)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	struct hfa384x_scan_request scan_req;
-	int ret = 0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	memset(&scan_req, 0, sizeof(scan_req));
-	scan_req.channel_list = cpu_to_le16(local->channel_mask &
-					    local->scan_channel_mask);
-	scan_req.txrate = __constant_cpu_to_le16(HFA384X_RATES_1MBPS);
-
-	/* FIX:
-	 * It seems to be enough to set roaming mode for a short moment to
-	 * host-based and then setup scanrequest data and return the mode to
-	 * firmware-based.
-	 *
-	 * Master mode would need to drop to Managed mode for a short while
-	 * to make scanning work.. Or sweep through the different channels and
-	 * use passive scan based on beacons. */
-
-	if (!local->host_roaming)
-		hostap_set_word(dev, HFA384X_RID_CNFROAMINGMODE,
-				HFA384X_ROAMING_HOST);
-
-	if (local->func->set_rid(dev, HFA384X_RID_SCANREQUEST, &scan_req,
-				 sizeof(scan_req))) {
-		printk(KERN_DEBUG "SCANREQUEST failed\n");
-		ret = -EINVAL;
-	}
-
-	if (!local->host_roaming)
-		hostap_set_word(dev, HFA384X_RID_CNFROAMINGMODE,
-				HFA384X_ROAMING_FIRMWARE);
-
-	return 0;
-}
-
-#else /* !PRISM2_NO_STATION_MODES */
-
-static inline int prism2_request_hostscan(struct net_device *dev,
-					  u8 *ssid, u8 ssid_len)
-{
-	return -EOPNOTSUPP;
-}
-
-
-static inline int prism2_request_scan(struct net_device *dev)
-{
-	return -EOPNOTSUPP;
-}
-
-#endif /* !PRISM2_NO_STATION_MODES */
-
-
-static int prism2_ioctl_siwscan(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_point *data, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int ret;
-	u8 *ssid = NULL, ssid_len = 0;
-	struct iw_scan_req *req = (struct iw_scan_req *) extra;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (data->length < sizeof(struct iw_scan_req))
-		req = NULL;
-
-	if (local->iw_mode == IW_MODE_MASTER) {
-		/* In master mode, we just return the results of our local
-		 * tables, so we don't need to start anything...
-		 * Jean II */
-		data->length = 0;
-		return 0;
-	}
-
-	if (!local->dev_enabled)
-		return -ENETDOWN;
-
-	if (req && data->flags & IW_SCAN_THIS_ESSID) {
-		ssid = req->essid;
-		ssid_len = req->essid_len;
-
-		if (ssid_len &&
-		    ((local->iw_mode != IW_MODE_INFRA &&
-		      local->iw_mode != IW_MODE_ADHOC) ||
-		     (local->sta_fw_ver < PRISM2_FW_VER(1,3,1))))
-			return -EOPNOTSUPP;
-	}
-
-	if (local->sta_fw_ver >= PRISM2_FW_VER(1,3,1))
-		ret = prism2_request_hostscan(dev, ssid, ssid_len);
-	else
-		ret = prism2_request_scan(dev);
-
-	if (ret == 0)
-		local->scan_timestamp = jiffies;
-
-	/* Could inquire F101, F103 or wait for SIOCGIWSCAN and read RID */
-
-	return ret;
-}
-
-
-#ifndef PRISM2_NO_STATION_MODES
-static char * __prism2_translate_scan(local_info_t *local,
-				      struct hfa384x_hostscan_result *scan,
-				      struct hostap_bss_info *bss,
-				      char *current_ev, char *end_buf)
-{
-	int i, chan;
-	struct iw_event iwe;
-	char *current_val;
-	u16 capabilities;
-	u8 *pos;
-	u8 *ssid, *bssid;
-	size_t ssid_len;
-	char *buf;
-
-	if (bss) {
-		ssid = bss->ssid;
-		ssid_len = bss->ssid_len;
-		bssid = bss->bssid;
-	} else {
-		ssid = scan->ssid;
-		ssid_len = le16_to_cpu(scan->ssid_len);
-		bssid = scan->bssid;
-	}
-	if (ssid_len > 32)
-		ssid_len = 32;
-
-	/* First entry *MUST* be the AP MAC address */
-	memset(&iwe, 0, sizeof(iwe));
-	iwe.cmd = SIOCGIWAP;
-	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-	memcpy(iwe.u.ap_addr.sa_data, bssid, ETH_ALEN);
-	/* FIX:
-	 * I do not know how this is possible, but iwe_stream_add_event
-	 * seems to re-order memcpy execution so that len is set only
-	 * after copying.. Pre-setting len here "fixes" this, but real
-	 * problems should be solved (after which these iwe.len
-	 * settings could be removed from this function). */
-	iwe.len = IW_EV_ADDR_LEN;
-	current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-					  IW_EV_ADDR_LEN);
-
-	/* Other entries will be displayed in the order we give them */
-
-	memset(&iwe, 0, sizeof(iwe));
-	iwe.cmd = SIOCGIWESSID;
-	iwe.u.data.length = ssid_len;
-	iwe.u.data.flags = 1;
-	iwe.len = IW_EV_POINT_LEN + iwe.u.data.length;
-	current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, ssid);
-
-	memset(&iwe, 0, sizeof(iwe));
-	iwe.cmd = SIOCGIWMODE;
-	if (bss) {
-		capabilities = bss->capab_info;
-	} else {
-		capabilities = le16_to_cpu(scan->capability);
-	}
-	if (capabilities & (WLAN_CAPABILITY_ESS |
-			    WLAN_CAPABILITY_IBSS)) {
-		if (capabilities & WLAN_CAPABILITY_ESS)
-			iwe.u.mode = IW_MODE_MASTER;
-		else
-			iwe.u.mode = IW_MODE_ADHOC;
-		iwe.len = IW_EV_UINT_LEN;
-		current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-						  IW_EV_UINT_LEN);
-	}
-
-	memset(&iwe, 0, sizeof(iwe));
-	iwe.cmd = SIOCGIWFREQ;
-	if (scan) {
-		chan = scan->chid;
-	} else if (bss) {
-		chan = bss->chan;
-	} else {
-		chan = 0;
-	}
-
-	if (chan > 0) {
-		iwe.u.freq.m = freq_list[le16_to_cpu(chan - 1)] * 100000;
-		iwe.u.freq.e = 1;
-		iwe.len = IW_EV_FREQ_LEN;
-		current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-						  IW_EV_FREQ_LEN);
-	}
-
-	if (scan) {
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = IWEVQUAL;
-		if (local->last_scan_type == PRISM2_HOSTSCAN) {
-			iwe.u.qual.level = le16_to_cpu(scan->sl);
-			iwe.u.qual.noise = le16_to_cpu(scan->anl);
-		} else {
-			iwe.u.qual.level =
-				HFA384X_LEVEL_TO_dBm(le16_to_cpu(scan->sl));
-			iwe.u.qual.noise =
-				HFA384X_LEVEL_TO_dBm(le16_to_cpu(scan->anl));
-		}
-		iwe.len = IW_EV_QUAL_LEN;
-		current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
-						  IW_EV_QUAL_LEN);
-	}
-
-	memset(&iwe, 0, sizeof(iwe));
-	iwe.cmd = SIOCGIWENCODE;
-	if (capabilities & WLAN_CAPABILITY_PRIVACY)
-		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-	else
-		iwe.u.data.flags = IW_ENCODE_DISABLED;
-	iwe.u.data.length = 0;
-	iwe.len = IW_EV_POINT_LEN + iwe.u.data.length;
-	current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, "");
-
-	/* TODO: add SuppRates into BSS table */
-	if (scan) {
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = SIOCGIWRATE;
-		current_val = current_ev + IW_EV_LCP_LEN;
-		pos = scan->sup_rates;
-		for (i = 0; i < sizeof(scan->sup_rates); i++) {
-			if (pos[i] == 0)
-				break;
-			/* Bit rate given in 500 kb/s units (+ 0x80) */
-			iwe.u.bitrate.value = ((pos[i] & 0x7f) * 500000);
-			current_val = iwe_stream_add_value(
-				current_ev, current_val, end_buf, &iwe,
-				IW_EV_PARAM_LEN);
-		}
-		/* Check if we added any event */
-		if ((current_val - current_ev) > IW_EV_LCP_LEN)
-			current_ev = current_val;
-	}
-
-	/* TODO: add BeaconInt,resp_rate,atim into BSS table */
-	buf = kmalloc(MAX_WPA_IE_LEN * 2 + 30, GFP_KERNEL);
-	if (buf && scan) {
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = IWEVCUSTOM;
-		sprintf(buf, "bcn_int=%d", le16_to_cpu(scan->beacon_interval));
-		iwe.u.data.length = strlen(buf);
-		current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-						  buf);
-
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = IWEVCUSTOM;
-		sprintf(buf, "resp_rate=%d", le16_to_cpu(scan->rate));
-		iwe.u.data.length = strlen(buf);
-		current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe,
-						  buf);
-
-		if (local->last_scan_type == PRISM2_HOSTSCAN &&
-		    (capabilities & WLAN_CAPABILITY_IBSS)) {
-			memset(&iwe, 0, sizeof(iwe));
-			iwe.cmd = IWEVCUSTOM;
-			sprintf(buf, "atim=%d", le16_to_cpu(scan->atim));
-			iwe.u.data.length = strlen(buf);
-			current_ev = iwe_stream_add_point(current_ev, end_buf,
-							  &iwe, buf);
-		}
-	}
-	kfree(buf);
-
-	if (bss && bss->wpa_ie_len > 0 && bss->wpa_ie_len <= MAX_WPA_IE_LEN) {
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = IWEVGENIE;
-		iwe.u.data.length = bss->wpa_ie_len;
-		current_ev = iwe_stream_add_point(
-			current_ev, end_buf, &iwe, bss->wpa_ie);
-	}
-
-	if (bss && bss->rsn_ie_len > 0 && bss->rsn_ie_len <= MAX_WPA_IE_LEN) {
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = IWEVGENIE;
-		iwe.u.data.length = bss->rsn_ie_len;
-		current_ev = iwe_stream_add_point(
-			current_ev, end_buf, &iwe, bss->rsn_ie);
-	}
-
-	return current_ev;
-}
-
-
-/* Translate scan data returned from the card to a card independant
- * format that the Wireless Tools will understand - Jean II */
-static inline int prism2_translate_scan(local_info_t *local,
-					char *buffer, int buflen)
-{
-	struct hfa384x_hostscan_result *scan;
-	int entry, hostscan;
-	char *current_ev = buffer;
-	char *end_buf = buffer + buflen;
-	struct list_head *ptr;
-
-	spin_lock_bh(&local->lock);
-
-	list_for_each(ptr, &local->bss_list) {
-		struct hostap_bss_info *bss;
-		bss = list_entry(ptr, struct hostap_bss_info, list);
-		bss->included = 0;
-	}
-
-	hostscan = local->last_scan_type == PRISM2_HOSTSCAN;
-	for (entry = 0; entry < local->last_scan_results_count; entry++) {
-		int found = 0;
-		scan = &local->last_scan_results[entry];
-
-		/* Report every SSID if the AP is using multiple SSIDs. If no
-		 * BSS record is found (e.g., when WPA mode is disabled),
-		 * report the AP once. */
-		list_for_each(ptr, &local->bss_list) {
-			struct hostap_bss_info *bss;
-			bss = list_entry(ptr, struct hostap_bss_info, list);
-			if (memcmp(bss->bssid, scan->bssid, ETH_ALEN) == 0) {
-				bss->included = 1;
-				current_ev = __prism2_translate_scan(
-					local, scan, bss, current_ev, end_buf);
-				found++;
-			}
-		}
-		if (!found) {
-			current_ev = __prism2_translate_scan(
-				local, scan, NULL, current_ev, end_buf);
-		}
-		/* Check if there is space for one more entry */
-		if ((end_buf - current_ev) <= IW_EV_ADDR_LEN) {
-			/* Ask user space to try again with a bigger buffer */
-			spin_unlock_bh(&local->lock);
-			return -E2BIG;
-		}
-	}
-
-	/* Prism2 firmware has limits (32 at least in some versions) for number
-	 * of BSSes in scan results. Extend this limit by using local BSS list.
-	 */
-	list_for_each(ptr, &local->bss_list) {
-		struct hostap_bss_info *bss;
-		bss = list_entry(ptr, struct hostap_bss_info, list);
-		if (bss->included)
-			continue;
-		current_ev = __prism2_translate_scan(local, NULL, bss,
-						     current_ev, end_buf);
-		/* Check if there is space for one more entry */
-		if ((end_buf - current_ev) <= IW_EV_ADDR_LEN) {
-			/* Ask user space to try again with a bigger buffer */
-			spin_unlock_bh(&local->lock);
-			return -E2BIG;
-		}
-	}
-
-	spin_unlock_bh(&local->lock);
-
-	return current_ev - buffer;
-}
-#endif /* PRISM2_NO_STATION_MODES */
-
-
-static inline int prism2_ioctl_giwscan_sta(struct net_device *dev,
-					   struct iw_request_info *info,
-					   struct iw_point *data, char *extra)
-{
-#ifdef PRISM2_NO_STATION_MODES
-	return -EOPNOTSUPP;
-#else /* PRISM2_NO_STATION_MODES */
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int res;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	/* Wait until the scan is finished. We can probably do better
-	 * than that - Jean II */
-	if (local->scan_timestamp &&
-	    time_before(jiffies, local->scan_timestamp + 3 * HZ)) {
-		/* Important note : we don't want to block the caller
-		 * until results are ready for various reasons.
-		 * First, managing wait queues is complex and racy
-		 * (there may be multiple simultaneous callers).
-		 * Second, we grab some rtnetlink lock before comming
-		 * here (in dev_ioctl()).
-		 * Third, the caller can wait on the Wireless Event
-		 * - Jean II */
-		return -EAGAIN;
-	}
-	local->scan_timestamp = 0;
-
-	res = prism2_translate_scan(local, extra, data->length);
-
-	if (res >= 0) {
-		data->length = res;
-		return 0;
-	} else {
-		data->length = 0;
-		return res;
-	}
-#endif /* PRISM2_NO_STATION_MODES */
-}
-
-
-static int prism2_ioctl_giwscan(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_point *data, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int res;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->iw_mode == IW_MODE_MASTER) {
-		/* In MASTER mode, it doesn't make sense to go around
-		 * scanning the frequencies and make the stations we serve
-		 * wait when what the user is really interested about is the
-		 * list of stations and access points we are talking to.
-		 * So, just extract results from our cache...
-		 * Jean II */
-
-		/* Translate to WE format */
-		res = prism2_ap_translate_scan(dev, extra);
-		if (res >= 0) {
-			printk(KERN_DEBUG "Scan result translation succeeded "
-			       "(length=%d)\n", res);
-			data->length = res;
-			return 0;
-		} else {
-			printk(KERN_DEBUG
-			       "Scan result translation failed (res=%d)\n",
-			       res);
-			data->length = 0;
-			return res;
-		}
-	} else {
-		/* Station mode */
-		return prism2_ioctl_giwscan_sta(dev, info, data, extra);
-	}
-}
-
-
-static const struct iw_priv_args prism2_priv[] = {
-	{ PRISM2_IOCTL_MONITOR,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "monitor" },
-	{ PRISM2_IOCTL_READMIF,
-	  IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1,
-	  IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "readmif" },
-	{ PRISM2_IOCTL_WRITEMIF,
-	  IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 2, 0, "writemif" },
-	{ PRISM2_IOCTL_RESET,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "reset" },
-	{ PRISM2_IOCTL_INQUIRE,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "inquire" },
-	{ PRISM2_IOCTL_SET_RID_WORD,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "set_rid_word" },
-	{ PRISM2_IOCTL_MACCMD,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "maccmd" },
-	{ PRISM2_IOCTL_WDS_ADD,
-	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, "wds_add" },
-	{ PRISM2_IOCTL_WDS_DEL,
-	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, "wds_del" },
-	{ PRISM2_IOCTL_ADDMAC,
-	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, "addmac" },
-	{ PRISM2_IOCTL_DELMAC,
-	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, "delmac" },
-	{ PRISM2_IOCTL_KICKMAC,
-	  IW_PRIV_TYPE_ADDR | IW_PRIV_SIZE_FIXED | 1, 0, "kickmac" },
-	/* --- raw access to sub-ioctls --- */
-	{ PRISM2_IOCTL_PRISM2_PARAM,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "prism2_param" },
-	{ PRISM2_IOCTL_GET_PRISM2_PARAM,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getprism2_param" },
-	/* --- sub-ioctls handlers --- */
-	{ PRISM2_IOCTL_PRISM2_PARAM,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "" },
-	{ PRISM2_IOCTL_GET_PRISM2_PARAM,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "" },
-	/* --- sub-ioctls definitions --- */
-	{ PRISM2_PARAM_TXRATECTRL,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "txratectrl" },
-	{ PRISM2_PARAM_TXRATECTRL,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "gettxratectrl" },
-	{ PRISM2_PARAM_BEACON_INT,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "beacon_int" },
-	{ PRISM2_PARAM_BEACON_INT,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getbeacon_int" },
-#ifndef PRISM2_NO_STATION_MODES
-	{ PRISM2_PARAM_PSEUDO_IBSS,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "pseudo_ibss" },
-	{ PRISM2_PARAM_PSEUDO_IBSS,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getpseudo_ibss" },
-#endif /* PRISM2_NO_STATION_MODES */
-	{ PRISM2_PARAM_ALC,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "alc" },
-	{ PRISM2_PARAM_ALC,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getalc" },
-	{ PRISM2_PARAM_DUMP,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "dump" },
-	{ PRISM2_PARAM_DUMP,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getdump" },
-	{ PRISM2_PARAM_OTHER_AP_POLICY,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "other_ap_policy" },
-	{ PRISM2_PARAM_OTHER_AP_POLICY,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getother_ap_pol" },
-	{ PRISM2_PARAM_AP_MAX_INACTIVITY,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "max_inactivity" },
-	{ PRISM2_PARAM_AP_MAX_INACTIVITY,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getmax_inactivi" },
-	{ PRISM2_PARAM_AP_BRIDGE_PACKETS,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "bridge_packets" },
-	{ PRISM2_PARAM_AP_BRIDGE_PACKETS,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getbridge_packe" },
-	{ PRISM2_PARAM_DTIM_PERIOD,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "dtim_period" },
-	{ PRISM2_PARAM_DTIM_PERIOD,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getdtim_period" },
-	{ PRISM2_PARAM_AP_NULLFUNC_ACK,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "nullfunc_ack" },
-	{ PRISM2_PARAM_AP_NULLFUNC_ACK,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getnullfunc_ack" },
-	{ PRISM2_PARAM_MAX_WDS,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "max_wds" },
-	{ PRISM2_PARAM_MAX_WDS,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getmax_wds" },
-	{ PRISM2_PARAM_AP_AUTOM_AP_WDS,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "autom_ap_wds" },
-	{ PRISM2_PARAM_AP_AUTOM_AP_WDS,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getautom_ap_wds" },
-	{ PRISM2_PARAM_AP_AUTH_ALGS,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "ap_auth_algs" },
-	{ PRISM2_PARAM_AP_AUTH_ALGS,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getap_auth_algs" },
-	{ PRISM2_PARAM_MONITOR_ALLOW_FCSERR,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "allow_fcserr" },
-	{ PRISM2_PARAM_MONITOR_ALLOW_FCSERR,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getallow_fcserr" },
-	{ PRISM2_PARAM_HOST_ENCRYPT,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "host_encrypt" },
-	{ PRISM2_PARAM_HOST_ENCRYPT,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "gethost_encrypt" },
-	{ PRISM2_PARAM_HOST_DECRYPT,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "host_decrypt" },
-	{ PRISM2_PARAM_HOST_DECRYPT,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "gethost_decrypt" },
-#ifndef PRISM2_NO_STATION_MODES
-	{ PRISM2_PARAM_HOST_ROAMING,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "host_roaming" },
-	{ PRISM2_PARAM_HOST_ROAMING,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "gethost_roaming" },
-#endif /* PRISM2_NO_STATION_MODES */
-	{ PRISM2_PARAM_BCRX_STA_KEY,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "bcrx_sta_key" },
-	{ PRISM2_PARAM_BCRX_STA_KEY,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getbcrx_sta_key" },
-	{ PRISM2_PARAM_IEEE_802_1X,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "ieee_802_1x" },
-	{ PRISM2_PARAM_IEEE_802_1X,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getieee_802_1x" },
-	{ PRISM2_PARAM_ANTSEL_TX,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "antsel_tx" },
-	{ PRISM2_PARAM_ANTSEL_TX,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getantsel_tx" },
-	{ PRISM2_PARAM_ANTSEL_RX,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "antsel_rx" },
-	{ PRISM2_PARAM_ANTSEL_RX,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getantsel_rx" },
-	{ PRISM2_PARAM_MONITOR_TYPE,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "monitor_type" },
-	{ PRISM2_PARAM_MONITOR_TYPE,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getmonitor_type" },
-	{ PRISM2_PARAM_WDS_TYPE,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wds_type" },
-	{ PRISM2_PARAM_WDS_TYPE,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getwds_type" },
-	{ PRISM2_PARAM_HOSTSCAN,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "hostscan" },
-	{ PRISM2_PARAM_HOSTSCAN,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "gethostscan" },
-	{ PRISM2_PARAM_AP_SCAN,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "ap_scan" },
-	{ PRISM2_PARAM_AP_SCAN,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getap_scan" },
-	{ PRISM2_PARAM_ENH_SEC,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "enh_sec" },
-	{ PRISM2_PARAM_ENH_SEC,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getenh_sec" },
-#ifdef PRISM2_IO_DEBUG
-	{ PRISM2_PARAM_IO_DEBUG,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "io_debug" },
-	{ PRISM2_PARAM_IO_DEBUG,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getio_debug" },
-#endif /* PRISM2_IO_DEBUG */
-	{ PRISM2_PARAM_BASIC_RATES,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "basic_rates" },
-	{ PRISM2_PARAM_BASIC_RATES,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getbasic_rates" },
-	{ PRISM2_PARAM_OPER_RATES,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "oper_rates" },
-	{ PRISM2_PARAM_OPER_RATES,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getoper_rates" },
-	{ PRISM2_PARAM_HOSTAPD,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "hostapd" },
-	{ PRISM2_PARAM_HOSTAPD,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "gethostapd" },
-	{ PRISM2_PARAM_HOSTAPD_STA,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "hostapd_sta" },
-	{ PRISM2_PARAM_HOSTAPD_STA,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "gethostapd_sta" },
-	{ PRISM2_PARAM_WPA,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wpa" },
-	{ PRISM2_PARAM_WPA,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getwpa" },
-	{ PRISM2_PARAM_PRIVACY_INVOKED,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "privacy_invoked" },
-	{ PRISM2_PARAM_PRIVACY_INVOKED,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getprivacy_invo" },
-	{ PRISM2_PARAM_TKIP_COUNTERMEASURES,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "tkip_countermea" },
-	{ PRISM2_PARAM_TKIP_COUNTERMEASURES,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "gettkip_counter" },
-	{ PRISM2_PARAM_DROP_UNENCRYPTED,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "drop_unencrypte" },
-	{ PRISM2_PARAM_DROP_UNENCRYPTED,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getdrop_unencry" },
-	{ PRISM2_PARAM_SCAN_CHANNEL_MASK,
-	  IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "scan_channels" },
-	{ PRISM2_PARAM_SCAN_CHANNEL_MASK,
-	  0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getscan_channel" },
-};
-
-
-static int prism2_ioctl_priv_inquire(struct net_device *dev, int *i)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->cmd(dev, HFA384X_CMDCODE_INQUIRE, *i, NULL, NULL))
-		return -EOPNOTSUPP;
-
-	return 0;
-}
-
-
-static int prism2_ioctl_priv_prism2_param(struct net_device *dev,
-					  struct iw_request_info *info,
-					  void *wrqu, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int *i = (int *) extra;
-	int param = *i;
-	int value = *(i + 1);
-	int ret = 0;
-	u16 val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	switch (param) {
-	case PRISM2_PARAM_TXRATECTRL:
-		local->fw_tx_rate_control = value;
-		break;
-
-	case PRISM2_PARAM_BEACON_INT:
-		if (hostap_set_word(dev, HFA384X_RID_CNFBEACONINT, value) ||
-		    local->func->reset_port(dev))
-			ret = -EINVAL;
-		else
-			local->beacon_int = value;
-		break;
-
-#ifndef PRISM2_NO_STATION_MODES
-	case PRISM2_PARAM_PSEUDO_IBSS:
-		if (value == local->pseudo_adhoc)
-			break;
-
-		if (value != 0 && value != 1) {
-			ret = -EINVAL;
-			break;
-		}
-
-		printk(KERN_DEBUG "prism2: %s: pseudo IBSS change %d -> %d\n",
-		       dev->name, local->pseudo_adhoc, value);
-		local->pseudo_adhoc = value;
-		if (local->iw_mode != IW_MODE_ADHOC)
-			break;
-
-		if (hostap_set_word(dev, HFA384X_RID_CNFPORTTYPE,
-				    hostap_get_porttype(local))) {
-			ret = -EOPNOTSUPP;
-			break;
-		}
-
-		if (local->func->reset_port(dev))
-			ret = -EINVAL;
-		break;
-#endif /* PRISM2_NO_STATION_MODES */
-
-	case PRISM2_PARAM_ALC:
-		printk(KERN_DEBUG "%s: %s ALC\n", dev->name,
-		       value == 0 ? "Disabling" : "Enabling");
-		val = HFA384X_TEST_CFG_BIT_ALC;
-		local->func->cmd(dev, HFA384X_CMDCODE_TEST |
-				 (HFA384X_TEST_CFG_BITS << 8),
-				 value == 0 ? 0 : 1, &val, NULL);
-		break;
-
-	case PRISM2_PARAM_DUMP:
-		local->frame_dump = value;
-		break;
-
-	case PRISM2_PARAM_OTHER_AP_POLICY:
-		if (value < 0 || value > 3) {
-			ret = -EINVAL;
-			break;
-		}
-		if (local->ap != NULL)
-			local->ap->ap_policy = value;
-		break;
-
-	case PRISM2_PARAM_AP_MAX_INACTIVITY:
-		if (value < 0 || value > 7 * 24 * 60 * 60) {
-			ret = -EINVAL;
-			break;
-		}
-		if (local->ap != NULL)
-			local->ap->max_inactivity = value * HZ;
-		break;
-
-	case PRISM2_PARAM_AP_BRIDGE_PACKETS:
-		if (local->ap != NULL)
-			local->ap->bridge_packets = value;
-		break;
-
-	case PRISM2_PARAM_DTIM_PERIOD:
-		if (value < 0 || value > 65535) {
-			ret = -EINVAL;
-			break;
-		}
-		if (hostap_set_word(dev, HFA384X_RID_CNFOWNDTIMPERIOD, value)
-		    || local->func->reset_port(dev))
-			ret = -EINVAL;
-		else
-			local->dtim_period = value;
-		break;
-
-	case PRISM2_PARAM_AP_NULLFUNC_ACK:
-		if (local->ap != NULL)
-			local->ap->nullfunc_ack = value;
-		break;
-
-	case PRISM2_PARAM_MAX_WDS:
-		local->wds_max_connections = value;
-		break;
-
-	case PRISM2_PARAM_AP_AUTOM_AP_WDS:
-		if (local->ap != NULL) {
-			if (!local->ap->autom_ap_wds && value) {
-				/* add WDS link to all APs in STA table */
-				hostap_add_wds_links(local);
-			}
-			local->ap->autom_ap_wds = value;
-		}
-		break;
-
-	case PRISM2_PARAM_AP_AUTH_ALGS:
-		local->auth_algs = value;
-		if (hostap_set_auth_algs(local))
-			ret = -EINVAL;
-		break;
-
-	case PRISM2_PARAM_MONITOR_ALLOW_FCSERR:
-		local->monitor_allow_fcserr = value;
-		break;
-
-	case PRISM2_PARAM_HOST_ENCRYPT:
-		local->host_encrypt = value;
-		if (hostap_set_encryption(local) ||
-		    local->func->reset_port(dev))
-			ret = -EINVAL;
-		break;
-
-	case PRISM2_PARAM_HOST_DECRYPT:
-		local->host_decrypt = value;
-		if (hostap_set_encryption(local) ||
-		    local->func->reset_port(dev))
-			ret = -EINVAL;
-		break;
-
-#ifndef PRISM2_NO_STATION_MODES
-	case PRISM2_PARAM_HOST_ROAMING:
-		if (value < 0 || value > 2) {
-			ret = -EINVAL;
-			break;
-		}
-		local->host_roaming = value;
-		if (hostap_set_roaming(local) || local->func->reset_port(dev))
-			ret = -EINVAL;
-		break;
-#endif /* PRISM2_NO_STATION_MODES */
-
-	case PRISM2_PARAM_BCRX_STA_KEY:
-		local->bcrx_sta_key = value;
-		break;
-
-	case PRISM2_PARAM_IEEE_802_1X:
-		local->ieee_802_1x = value;
-		break;
-
-	case PRISM2_PARAM_ANTSEL_TX:
-		if (value < 0 || value > HOSTAP_ANTSEL_HIGH) {
-			ret = -EINVAL;
-			break;
-		}
-		local->antsel_tx = value;
-		hostap_set_antsel(local);
-		break;
-
-	case PRISM2_PARAM_ANTSEL_RX:
-		if (value < 0 || value > HOSTAP_ANTSEL_HIGH) {
-			ret = -EINVAL;
-			break;
-		}
-		local->antsel_rx = value;
-		hostap_set_antsel(local);
-		break;
-
-	case PRISM2_PARAM_MONITOR_TYPE:
-		if (value != PRISM2_MONITOR_80211 &&
-		    value != PRISM2_MONITOR_CAPHDR &&
-		    value != PRISM2_MONITOR_PRISM) {
-			ret = -EINVAL;
-			break;
-		}
-		local->monitor_type = value;
-		if (local->iw_mode == IW_MODE_MONITOR)
-			hostap_monitor_set_type(local);
-		break;
-
-	case PRISM2_PARAM_WDS_TYPE:
-		local->wds_type = value;
-		break;
-
-	case PRISM2_PARAM_HOSTSCAN:
-	{
-		struct hfa384x_hostscan_request scan_req;
-		u16 rate;
-
-		memset(&scan_req, 0, sizeof(scan_req));
-		scan_req.channel_list = __constant_cpu_to_le16(0x3fff);
-		switch (value) {
-		case 1: rate = HFA384X_RATES_1MBPS; break;
-		case 2: rate = HFA384X_RATES_2MBPS; break;
-		case 3: rate = HFA384X_RATES_5MBPS; break;
-		case 4: rate = HFA384X_RATES_11MBPS; break;
-		default: rate = HFA384X_RATES_1MBPS; break;
-		}
-		scan_req.txrate = cpu_to_le16(rate);
-		/* leave SSID empty to accept all SSIDs */
-
-		if (local->iw_mode == IW_MODE_MASTER) {
-			if (hostap_set_word(dev, HFA384X_RID_CNFPORTTYPE,
-					    HFA384X_PORTTYPE_BSS) ||
-			    local->func->reset_port(dev))
-				printk(KERN_DEBUG "Leaving Host AP mode "
-				       "for HostScan failed\n");
-		}
-
-		if (local->func->set_rid(dev, HFA384X_RID_HOSTSCAN, &scan_req,
-					 sizeof(scan_req))) {
-			printk(KERN_DEBUG "HOSTSCAN failed\n");
-			ret = -EINVAL;
-		}
-		if (local->iw_mode == IW_MODE_MASTER) {
-			wait_queue_t __wait;
-			init_waitqueue_entry(&__wait, current);
-			add_wait_queue(&local->hostscan_wq, &__wait);
-			set_current_state(TASK_INTERRUPTIBLE);
-			schedule_timeout(HZ);
-			if (signal_pending(current))
-				ret = -EINTR;
-			set_current_state(TASK_RUNNING);
-			remove_wait_queue(&local->hostscan_wq, &__wait);
-
-			if (hostap_set_word(dev, HFA384X_RID_CNFPORTTYPE,
-					    HFA384X_PORTTYPE_HOSTAP) ||
-			    local->func->reset_port(dev))
-				printk(KERN_DEBUG "Returning to Host AP mode "
-				       "after HostScan failed\n");
-		}
-		break;
-	}
-
-	case PRISM2_PARAM_AP_SCAN:
-		local->passive_scan_interval = value;
-		if (timer_pending(&local->passive_scan_timer))
-			del_timer(&local->passive_scan_timer);
-		if (value > 0) {
-			local->passive_scan_timer.expires = jiffies +
-				local->passive_scan_interval * HZ;
-			add_timer(&local->passive_scan_timer);
-		}
-		break;
-
-	case PRISM2_PARAM_ENH_SEC:
-		if (value < 0 || value > 3) {
-			ret = -EINVAL;
-			break;
-		}
-		local->enh_sec = value;
-		if (hostap_set_word(dev, HFA384X_RID_CNFENHSECURITY,
-				    local->enh_sec) ||
-		    local->func->reset_port(dev)) {
-			printk(KERN_INFO "%s: cnfEnhSecurity requires STA f/w "
-			       "1.6.3 or newer\n", dev->name);
-			ret = -EOPNOTSUPP;
-		}
-		break;
-
-#ifdef PRISM2_IO_DEBUG
-	case PRISM2_PARAM_IO_DEBUG:
-		local->io_debug_enabled = value;
-		break;
-#endif /* PRISM2_IO_DEBUG */
-
-	case PRISM2_PARAM_BASIC_RATES:
-		if ((value & local->tx_rate_control) != value || value == 0) {
-			printk(KERN_INFO "%s: invalid basic rate set - basic "
-			       "rates must be in supported rate set\n",
-			       dev->name);
-			ret = -EINVAL;
-			break;
-		}
-		local->basic_rates = value;
-		if (hostap_set_word(dev, HFA384X_RID_CNFBASICRATES,
-				    local->basic_rates) ||
-		    local->func->reset_port(dev))
-			ret = -EINVAL;
-		break;
-
-	case PRISM2_PARAM_OPER_RATES:
-		local->tx_rate_control = value;
-		if (hostap_set_rate(dev))
-			ret = -EINVAL;
-		break;
-
-	case PRISM2_PARAM_HOSTAPD:
-		ret = hostap_set_hostapd(local, value, 1);
-		break;
-
-	case PRISM2_PARAM_HOSTAPD_STA:
-		ret = hostap_set_hostapd_sta(local, value, 1);
-		break;
-
-	case PRISM2_PARAM_WPA:
-		local->wpa = value;
-		if (local->sta_fw_ver < PRISM2_FW_VER(1,7,0))
-			ret = -EOPNOTSUPP;
-		else if (hostap_set_word(dev, HFA384X_RID_SSNHANDLINGMODE,
-					 value ? 1 : 0))
-			ret = -EINVAL;
-		break;
-
-	case PRISM2_PARAM_PRIVACY_INVOKED:
-		local->privacy_invoked = value;
-		if (hostap_set_encryption(local) ||
-		    local->func->reset_port(dev))
-			ret = -EINVAL;
-		break;
-
-	case PRISM2_PARAM_TKIP_COUNTERMEASURES:
-		local->tkip_countermeasures = value;
-		break;
-
-	case PRISM2_PARAM_DROP_UNENCRYPTED:
-		local->drop_unencrypted = value;
-		break;
-
-	case PRISM2_PARAM_SCAN_CHANNEL_MASK:
-		local->scan_channel_mask = value;
-		break;
-
-	default:
-		printk(KERN_DEBUG "%s: prism2_param: unknown param %d\n",
-		       dev->name, param);
-		ret = -EOPNOTSUPP;
-		break;
-	}
-
-	return ret;
-}
-
-
-static int prism2_ioctl_priv_get_prism2_param(struct net_device *dev,
-					      struct iw_request_info *info,
-					      void *wrqu, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int *param = (int *) extra;
-	int ret = 0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	switch (*param) {
-	case PRISM2_PARAM_TXRATECTRL:
-		*param = local->fw_tx_rate_control;
-		break;
-
-	case PRISM2_PARAM_BEACON_INT:
-		*param = local->beacon_int;
-		break;
-
-	case PRISM2_PARAM_PSEUDO_IBSS:
-		*param = local->pseudo_adhoc;
-		break;
-
-	case PRISM2_PARAM_ALC:
-		ret = -EOPNOTSUPP; /* FIX */
-		break;
-
-	case PRISM2_PARAM_DUMP:
-		*param = local->frame_dump;
-		break;
-
-	case PRISM2_PARAM_OTHER_AP_POLICY:
-		if (local->ap != NULL)
-			*param = local->ap->ap_policy;
-		else
-			ret = -EOPNOTSUPP;
-		break;
-
-	case PRISM2_PARAM_AP_MAX_INACTIVITY:
-		if (local->ap != NULL)
-			*param = local->ap->max_inactivity / HZ;
-		else
-			ret = -EOPNOTSUPP;
-		break;
-
-	case PRISM2_PARAM_AP_BRIDGE_PACKETS:
-		if (local->ap != NULL)
-			*param = local->ap->bridge_packets;
-		else
-			ret = -EOPNOTSUPP;
-		break;
-
-	case PRISM2_PARAM_DTIM_PERIOD:
-		*param = local->dtim_period;
-		break;
-
-	case PRISM2_PARAM_AP_NULLFUNC_ACK:
-		if (local->ap != NULL)
-			*param = local->ap->nullfunc_ack;
-		else
-			ret = -EOPNOTSUPP;
-		break;
-
-	case PRISM2_PARAM_MAX_WDS:
-		*param = local->wds_max_connections;
-		break;
-
-	case PRISM2_PARAM_AP_AUTOM_AP_WDS:
-		if (local->ap != NULL)
-			*param = local->ap->autom_ap_wds;
-		else
-			ret = -EOPNOTSUPP;
-		break;
-
-	case PRISM2_PARAM_AP_AUTH_ALGS:
-		*param = local->auth_algs;
-		break;
-
-	case PRISM2_PARAM_MONITOR_ALLOW_FCSERR:
-		*param = local->monitor_allow_fcserr;
-		break;
-
-	case PRISM2_PARAM_HOST_ENCRYPT:
-		*param = local->host_encrypt;
-		break;
-
-	case PRISM2_PARAM_HOST_DECRYPT:
-		*param = local->host_decrypt;
-		break;
-
-	case PRISM2_PARAM_HOST_ROAMING:
-		*param = local->host_roaming;
-		break;
-
-	case PRISM2_PARAM_BCRX_STA_KEY:
-		*param = local->bcrx_sta_key;
-		break;
-
-	case PRISM2_PARAM_IEEE_802_1X:
-		*param = local->ieee_802_1x;
-		break;
-
-	case PRISM2_PARAM_ANTSEL_TX:
-		*param = local->antsel_tx;
-		break;
-
-	case PRISM2_PARAM_ANTSEL_RX:
-		*param = local->antsel_rx;
-		break;
-
-	case PRISM2_PARAM_MONITOR_TYPE:
-		*param = local->monitor_type;
-		break;
-
-	case PRISM2_PARAM_WDS_TYPE:
-		*param = local->wds_type;
-		break;
-
-	case PRISM2_PARAM_HOSTSCAN:
-		ret = -EOPNOTSUPP;
-		break;
-
-	case PRISM2_PARAM_AP_SCAN:
-		*param = local->passive_scan_interval;
-		break;
-
-	case PRISM2_PARAM_ENH_SEC:
-		*param = local->enh_sec;
-		break;
-
-#ifdef PRISM2_IO_DEBUG
-	case PRISM2_PARAM_IO_DEBUG:
-		*param = local->io_debug_enabled;
-		break;
-#endif /* PRISM2_IO_DEBUG */
-
-	case PRISM2_PARAM_BASIC_RATES:
-		*param = local->basic_rates;
-		break;
-
-	case PRISM2_PARAM_OPER_RATES:
-		*param = local->tx_rate_control;
-		break;
-
-	case PRISM2_PARAM_HOSTAPD:
-		*param = local->hostapd;
-		break;
-
-	case PRISM2_PARAM_HOSTAPD_STA:
-		*param = local->hostapd_sta;
-		break;
-
-	case PRISM2_PARAM_WPA:
-		if (local->sta_fw_ver < PRISM2_FW_VER(1,7,0))
-			ret = -EOPNOTSUPP;
-		*param = local->wpa;
-		break;
-
-	case PRISM2_PARAM_PRIVACY_INVOKED:
-		*param = local->privacy_invoked;
-		break;
-
-	case PRISM2_PARAM_TKIP_COUNTERMEASURES:
-		*param = local->tkip_countermeasures;
-		break;
-
-	case PRISM2_PARAM_DROP_UNENCRYPTED:
-		*param = local->drop_unencrypted;
-		break;
-
-	case PRISM2_PARAM_SCAN_CHANNEL_MASK:
-		*param = local->scan_channel_mask;
-		break;
-
-	default:
-		printk(KERN_DEBUG "%s: get_prism2_param: unknown param %d\n",
-		       dev->name, *param);
-		ret = -EOPNOTSUPP;
-		break;
-	}
-
-	return ret;
-}
-
-
-static int prism2_ioctl_priv_readmif(struct net_device *dev,
-				     struct iw_request_info *info,
-				     void *wrqu, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 resp0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	if (local->func->cmd(dev, HFA384X_CMDCODE_READMIF, *extra, NULL,
-			     &resp0))
-		return -EOPNOTSUPP;
-	else
-		*extra = resp0;
-
-	return 0;
-}
-
-
-static int prism2_ioctl_priv_writemif(struct net_device *dev,
-				      struct iw_request_info *info,
-				      void *wrqu, char *extra)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	u16 cr, val;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	cr = *extra;
-	val = *(extra + 1);
-	if (local->func->cmd(dev, HFA384X_CMDCODE_WRITEMIF, cr, &val, NULL))
-		return -EOPNOTSUPP;
-
-	return 0;
-}
-
-
-static int prism2_ioctl_priv_monitor(struct net_device *dev, int *i)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int ret = 0;
-	u32 mode;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	printk(KERN_DEBUG "%s: process %d (%s) used deprecated iwpriv monitor "
-	       "- update software to use iwconfig mode monitor\n",
-	       dev->name, current->pid, current->comm);
-
-	/* Backward compatibility code - this can be removed at some point */
-
-	if (*i == 0) {
-		/* Disable monitor mode - old mode was not saved, so go to
-		 * Master mode */
-		mode = IW_MODE_MASTER;
-		ret = prism2_ioctl_siwmode(dev, NULL, &mode, NULL);
-	} else if (*i == 1) {
-		/* netlink socket mode is not supported anymore since it did
-		 * not separate different devices from each other and was not
-		 * best method for delivering large amount of packets to
-		 * user space */
-		ret = -EOPNOTSUPP;
-	} else if (*i == 2 || *i == 3) {
-		switch (*i) {
-		case 2:
-			local->monitor_type = PRISM2_MONITOR_80211;
-			break;
-		case 3:
-			local->monitor_type = PRISM2_MONITOR_PRISM;
-			break;
-		}
-		mode = IW_MODE_MONITOR;
-		ret = prism2_ioctl_siwmode(dev, NULL, &mode, NULL);
-		hostap_monitor_mode_enable(local);
-	} else
-		ret = -EINVAL;
-
-	return ret;
-}
-
-
-static int prism2_ioctl_priv_reset(struct net_device *dev, int *i)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	printk(KERN_DEBUG "%s: manual reset request(%d)\n", dev->name, *i);
-	switch (*i) {
-	case 0:
-		/* Disable and enable card */
-		local->func->hw_shutdown(dev, 1);
-		local->func->hw_config(dev, 0);
-		break;
-
-	case 1:
-		/* COR sreset */
-		local->func->hw_reset(dev);
-		break;
-
-	case 2:
-		/* Disable and enable port 0 */
-		local->func->reset_port(dev);
-		break;
-
-	case 3:
-		prism2_sta_deauth(local, WLAN_REASON_DEAUTH_LEAVING);
-		if (local->func->cmd(dev, HFA384X_CMDCODE_DISABLE, 0, NULL,
-				     NULL))
-			return -EINVAL;
-		break;
-
-	case 4:
-		if (local->func->cmd(dev, HFA384X_CMDCODE_ENABLE, 0, NULL,
-				     NULL))
-			return -EINVAL;
-		break;
-
-	default:
-		printk(KERN_DEBUG "Unknown reset request %d\n", *i);
-		return -EOPNOTSUPP;
-	}
-
-	return 0;
-}
-
-
-static int prism2_ioctl_priv_set_rid_word(struct net_device *dev, int *i)
-{
-	int rid = *i;
-	int value = *(i + 1);
-
-	printk(KERN_DEBUG "%s: Set RID[0x%X] = %d\n", dev->name, rid, value);
-
-	if (hostap_set_word(dev, rid, value))
-		return -EINVAL;
-
-	return 0;
-}
-
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-static int ap_mac_cmd_ioctl(local_info_t *local, int *cmd)
-{
-	int ret = 0;
-
-	switch (*cmd) {
-	case AP_MAC_CMD_POLICY_OPEN:
-		local->ap->mac_restrictions.policy = MAC_POLICY_OPEN;
-		break;
-	case AP_MAC_CMD_POLICY_ALLOW:
-		local->ap->mac_restrictions.policy = MAC_POLICY_ALLOW;
-		break;
-	case AP_MAC_CMD_POLICY_DENY:
-		local->ap->mac_restrictions.policy = MAC_POLICY_DENY;
-		break;
-	case AP_MAC_CMD_FLUSH:
-		ap_control_flush_macs(&local->ap->mac_restrictions);
-		break;
-	case AP_MAC_CMD_KICKALL:
-		ap_control_kickall(local->ap);
-		hostap_deauth_all_stas(local->dev, local->ap, 0);
-		break;
-	default:
-		ret = -EOPNOTSUPP;
-		break;
-	}
-
-	return ret;
-}
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-static int prism2_ioctl_priv_download(local_info_t *local, struct iw_point *p)
-{
-	struct prism2_download_param *param;
-	int ret = 0;
-
-	if (p->length < sizeof(struct prism2_download_param) ||
-	    p->length > 1024 || !p->pointer)
-		return -EINVAL;
-
-	param = (struct prism2_download_param *)
-		kmalloc(p->length, GFP_KERNEL);
-	if (param == NULL)
-		return -ENOMEM;
-
-	if (copy_from_user(param, p->pointer, p->length)) {
-		ret = -EFAULT;
-		goto out;
-	}
-
-	if (p->length < sizeof(struct prism2_download_param) +
-	    param->num_areas * sizeof(struct prism2_download_area)) {
-		ret = -EINVAL;
-		goto out;
-	}
-
-	ret = local->func->download(local, param);
-
- out:
-	if (param != NULL)
-		kfree(param);
-
-	return ret;
-}
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-
-
-static int prism2_set_genericelement(struct net_device *dev, u8 *elem,
-				     size_t len)
-{
-	struct hostap_interface *iface = dev->priv;
-	local_info_t *local = iface->local;
-	u8 *buf;
-
-	/*
-	 * Add 16-bit length in the beginning of the buffer because Prism2 RID
-	 * includes it.
-	 */
-	buf = kmalloc(len + 2, GFP_KERNEL);
-	if (buf == NULL)
-		return -ENOMEM;
-
-	*((u16 *) buf) = cpu_to_le16(len);
-	memcpy(buf + 2, elem, len);
-
-	kfree(local->generic_elem);
-	local->generic_elem = buf;
-	local->generic_elem_len = len + 2;
-
-	return local->func->set_rid(local->dev, HFA384X_RID_GENERICELEMENT,
-				    buf, len + 2);
-}
-
-
-static int prism2_ioctl_siwauth(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_param *data, char *extra)
-{
-	struct hostap_interface *iface = dev->priv;
-	local_info_t *local = iface->local;
-
-	switch (data->flags & IW_AUTH_INDEX) {
-	case IW_AUTH_WPA_VERSION:
-	case IW_AUTH_CIPHER_PAIRWISE:
-	case IW_AUTH_CIPHER_GROUP:
-	case IW_AUTH_KEY_MGMT:
-		/*
-		 * Host AP driver does not use these parameters and allows
-		 * wpa_supplicant to control them internally.
-		 */
-		break;
-	case IW_AUTH_TKIP_COUNTERMEASURES:
-		local->tkip_countermeasures = data->value;
-		break;
-	case IW_AUTH_DROP_UNENCRYPTED:
-		local->drop_unencrypted = data->value;
-		break;
-	case IW_AUTH_80211_AUTH_ALG:
-		local->auth_algs = data->value;
-		break;
-	case IW_AUTH_WPA_ENABLED:
-		if (data->value == 0) {
-			local->wpa = 0;
-			if (local->sta_fw_ver < PRISM2_FW_VER(1,7,0))
-				break;
-			prism2_set_genericelement(dev, "", 0);
-			local->host_roaming = 0;
-			local->privacy_invoked = 0;
-			if (hostap_set_word(dev, HFA384X_RID_SSNHANDLINGMODE,
-					    0) ||
-			    hostap_set_roaming(local) ||
-			    hostap_set_encryption(local) ||
-			    local->func->reset_port(dev))
-				return -EINVAL;
-			break;
-		}
-		if (local->sta_fw_ver < PRISM2_FW_VER(1,7,0))
-			return -EOPNOTSUPP;
-		local->host_roaming = 2;
-		local->privacy_invoked = 1;
-		local->wpa = 1;
-		if (hostap_set_word(dev, HFA384X_RID_SSNHANDLINGMODE, 1) ||
-		    hostap_set_roaming(local) ||
-		    hostap_set_encryption(local) ||
-		    local->func->reset_port(dev))
-			return -EINVAL;
-		break;
-	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-		local->ieee_802_1x = data->value;
-		break;
-	case IW_AUTH_PRIVACY_INVOKED:
-		local->privacy_invoked = data->value;
-		break;
-	default:
-		return -EOPNOTSUPP;
-	}
-	return 0;
-}
-
-
-static int prism2_ioctl_giwauth(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_param *data, char *extra)
-{
-	struct hostap_interface *iface = dev->priv;
-	local_info_t *local = iface->local;
-
-	switch (data->flags & IW_AUTH_INDEX) {
-	case IW_AUTH_WPA_VERSION:
-	case IW_AUTH_CIPHER_PAIRWISE:
-	case IW_AUTH_CIPHER_GROUP:
-	case IW_AUTH_KEY_MGMT:
-		/*
-		 * Host AP driver does not use these parameters and allows
-		 * wpa_supplicant to control them internally.
-		 */
-		return -EOPNOTSUPP;
-	case IW_AUTH_TKIP_COUNTERMEASURES:
-		data->value = local->tkip_countermeasures;
-		break;
-	case IW_AUTH_DROP_UNENCRYPTED:
-		data->value = local->drop_unencrypted;
-		break;
-	case IW_AUTH_80211_AUTH_ALG:
-		data->value = local->auth_algs;
-		break;
-	case IW_AUTH_WPA_ENABLED:
-		data->value = local->wpa;
-		break;
-	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-		data->value = local->ieee_802_1x;
-		break;
-	default:
-		return -EOPNOTSUPP;
-	}
-	return 0;
-}
-
-
-static int prism2_ioctl_siwencodeext(struct net_device *dev,
-				     struct iw_request_info *info,
-				     struct iw_point *erq, char *extra)
-{
-	struct hostap_interface *iface = dev->priv;
-	local_info_t *local = iface->local;
-	struct iw_encode_ext *ext = (struct iw_encode_ext *) extra;
-	int i, ret = 0;
-	struct ieee80211_crypto_ops *ops;
-	struct ieee80211_crypt_data **crypt;
-	void *sta_ptr;
-	u8 *addr;
-	const char *alg, *module;
-
-	i = erq->flags & IW_ENCODE_INDEX;
-	if (i > WEP_KEYS)
-		return -EINVAL;
-	if (i < 1 || i > WEP_KEYS)
-		i = local->tx_keyidx;
-	else
-		i--;
-	if (i < 0 || i >= WEP_KEYS)
-		return -EINVAL;
-
-	addr = ext->addr.sa_data;
-	if (addr[0] == 0xff && addr[1] == 0xff && addr[2] == 0xff &&
-	    addr[3] == 0xff && addr[4] == 0xff && addr[5] == 0xff) {
-		sta_ptr = NULL;
-		crypt = &local->crypt[i];
-	} else {
-		if (i != 0)
-			return -EINVAL;
-		sta_ptr = ap_crypt_get_ptrs(local->ap, addr, 0, &crypt);
-		if (sta_ptr == NULL) {
-			if (local->iw_mode == IW_MODE_INFRA) {
-				/*
-				 * TODO: add STA entry for the current AP so
-				 * that unicast key can be used. For now, this
-				 * is emulated by using default key idx 0.
-				 */
-				i = 0;
-				crypt = &local->crypt[i];
-			} else
-				return -EINVAL;
-		}
-	}
-
-	if ((erq->flags & IW_ENCODE_DISABLED) ||
-	    ext->alg == IW_ENCODE_ALG_NONE) {
-		if (*crypt)
-			prism2_crypt_delayed_deinit(local, crypt);
-		goto done;
-	}
-
-	switch (ext->alg) {
-	case IW_ENCODE_ALG_WEP:
-		alg = "WEP";
-		module = "ieee80211_crypt_wep";
-		break;
-	case IW_ENCODE_ALG_TKIP:
-		alg = "TKIP";
-		module = "ieee80211_crypt_tkip";
-		break;
-	case IW_ENCODE_ALG_CCMP:
-		alg = "CCMP";
-		module = "ieee80211_crypt_ccmp";
-		break;
-	default:
-		printk(KERN_DEBUG "%s: unsupported algorithm %d\n",
-		       local->dev->name, ext->alg);
-		ret = -EOPNOTSUPP;
-		goto done;
-	}
-
-	ops = ieee80211_get_crypto_ops(alg);
-	if (ops == NULL) {
-		request_module(module);
-		ops = ieee80211_get_crypto_ops(alg);
-	}
-	if (ops == NULL) {
-		printk(KERN_DEBUG "%s: unknown crypto alg '%s'\n",
-		       local->dev->name, alg);
-		ret = -EOPNOTSUPP;
-		goto done;
-	}
-
-	if (sta_ptr || ext->alg != IW_ENCODE_ALG_WEP) {
-		/*
-		 * Per station encryption and other than WEP algorithms
-		 * require host-based encryption, so force them on
-		 * automatically.
-		 */
-		local->host_decrypt = local->host_encrypt = 1;
-	}
-
-	if (*crypt == NULL || (*crypt)->ops != ops) {
-		struct ieee80211_crypt_data *new_crypt;
-
-		prism2_crypt_delayed_deinit(local, crypt);
-
-		new_crypt = (struct ieee80211_crypt_data *)
-			kmalloc(sizeof(struct ieee80211_crypt_data),
-				GFP_KERNEL);
-		if (new_crypt == NULL) {
-			ret = -ENOMEM;
-			goto done;
-		}
-		memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
-		new_crypt->ops = ops;
-		new_crypt->priv = new_crypt->ops->init(i);
-		if (new_crypt->priv == NULL) {
-			kfree(new_crypt);
-			ret = -EINVAL;
-			goto done;
-		}
-
-		*crypt = new_crypt;
-	}
-
-	/*
-	 * TODO: if ext_flags does not have IW_ENCODE_EXT_RX_SEQ_VALID, the
-	 * existing seq# should not be changed.
-	 * TODO: if ext_flags has IW_ENCODE_EXT_TX_SEQ_VALID, next TX seq#
-	 * should be changed to something else than zero.
-	 */
-	if ((!(ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) || ext->key_len > 0)
-	    && (*crypt)->ops->set_key &&
-	    (*crypt)->ops->set_key(ext->key, ext->key_len, ext->rx_seq,
-				   (*crypt)->priv) < 0) {
-		printk(KERN_DEBUG "%s: key setting failed\n",
-		       local->dev->name);
-		ret = -EINVAL;
-		goto done;
-	}
-
-	if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
-		if (!sta_ptr)
-			local->tx_keyidx = i;
-		else if (i) {
-			ret = -EINVAL;
-			goto done;
-		}
-	}
-
-
-	if (sta_ptr == NULL && ext->key_len > 0) {
-		int first = 1, j;
-		for (j = 0; j < WEP_KEYS; j++) {
-			if (j != i && local->crypt[j]) {
-				first = 0;
-				break;
-			}
-		}
-		if (first)
-			local->tx_keyidx = i;
-	}
-
- done:
-	if (sta_ptr)
-		hostap_handle_sta_release(sta_ptr);
-
-	local->open_wep = erq->flags & IW_ENCODE_OPEN;
-
-	/*
-	 * Do not reset port0 if card is in Managed mode since resetting will
-	 * generate new IEEE 802.11 authentication which may end up in looping
-	 * with IEEE 802.1X. Prism2 documentation seem to require port reset
-	 * after WEP configuration. However, keys are apparently changed at
-	 * least in Managed mode.
-	 */
-	if (ret == 0 &&
-	    (hostap_set_encryption(local) ||
-	     (local->iw_mode != IW_MODE_INFRA &&
-	      local->func->reset_port(local->dev))))
-		ret = -EINVAL;
-
-	return ret;
-}
-
-
-static int prism2_ioctl_giwencodeext(struct net_device *dev,
-				     struct iw_request_info *info,
-				     struct iw_point *erq, char *extra)
-{
-	struct hostap_interface *iface = dev->priv;
-	local_info_t *local = iface->local;
-	struct ieee80211_crypt_data **crypt;
-	void *sta_ptr;
-	int max_key_len, i;
-	struct iw_encode_ext *ext = (struct iw_encode_ext *) extra;
-	u8 *addr;
-
-	max_key_len = erq->length - sizeof(*ext);
-	if (max_key_len < 0)
-		return -EINVAL;
-
-	i = erq->flags & IW_ENCODE_INDEX;
-	if (i < 1 || i > WEP_KEYS)
-		i = local->tx_keyidx;
-	else
-		i--;
-
-	addr = ext->addr.sa_data;
-	if (addr[0] == 0xff && addr[1] == 0xff && addr[2] == 0xff &&
-	    addr[3] == 0xff && addr[4] == 0xff && addr[5] == 0xff) {
-		sta_ptr = NULL;
-		crypt = &local->crypt[i];
-	} else {
-		i = 0;
-		sta_ptr = ap_crypt_get_ptrs(local->ap, addr, 0, &crypt);
-		if (sta_ptr == NULL)
-			return -EINVAL;
-	}
-	erq->flags = i + 1;
-	memset(ext, 0, sizeof(*ext));
-
-	if (*crypt == NULL || (*crypt)->ops == NULL) {
-		ext->alg = IW_ENCODE_ALG_NONE;
-		ext->key_len = 0;
-		erq->flags |= IW_ENCODE_DISABLED;
-	} else {
-		if (strcmp((*crypt)->ops->name, "WEP") == 0)
-			ext->alg = IW_ENCODE_ALG_WEP;
-		else if (strcmp((*crypt)->ops->name, "TKIP") == 0)
-			ext->alg = IW_ENCODE_ALG_TKIP;
-		else if (strcmp((*crypt)->ops->name, "CCMP") == 0)
-			ext->alg = IW_ENCODE_ALG_CCMP;
-		else
-			return -EINVAL;
-
-		if ((*crypt)->ops->get_key) {
-			ext->key_len =
-				(*crypt)->ops->get_key(ext->key,
-						       max_key_len,
-						       ext->tx_seq,
-						       (*crypt)->priv);
-			if (ext->key_len &&
-			    (ext->alg == IW_ENCODE_ALG_TKIP ||
-			     ext->alg == IW_ENCODE_ALG_CCMP))
-				ext->ext_flags |= IW_ENCODE_EXT_TX_SEQ_VALID;
-		}
-	}
-
-	if (sta_ptr)
-		hostap_handle_sta_release(sta_ptr);
-
-	return 0;
-}
-
-
-static int prism2_ioctl_set_encryption(local_info_t *local,
-				       struct prism2_hostapd_param *param,
-				       int param_len)
-{
-	int ret = 0;
-	struct ieee80211_crypto_ops *ops;
-	struct ieee80211_crypt_data **crypt;
-	void *sta_ptr;
-
-	param->u.crypt.err = 0;
-	param->u.crypt.alg[HOSTAP_CRYPT_ALG_NAME_LEN - 1] = '\0';
-
-	if (param_len !=
-	    (int) ((char *) param->u.crypt.key - (char *) param) +
-	    param->u.crypt.key_len)
-		return -EINVAL;
-
-	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
-	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
-	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
-		if (param->u.crypt.idx >= WEP_KEYS)
-			return -EINVAL;
-		sta_ptr = NULL;
-		crypt = &local->crypt[param->u.crypt.idx];
-	} else {
-		if (param->u.crypt.idx)
-			return -EINVAL;
-		sta_ptr = ap_crypt_get_ptrs(
-			local->ap, param->sta_addr,
-			(param->u.crypt.flags & HOSTAP_CRYPT_FLAG_PERMANENT),
-			&crypt);
-
-		if (sta_ptr == NULL) {
-			param->u.crypt.err = HOSTAP_CRYPT_ERR_UNKNOWN_ADDR;
-			return -EINVAL;
-		}
-	}
-
-	if (strcmp(param->u.crypt.alg, "none") == 0) {
-		if (crypt)
-			prism2_crypt_delayed_deinit(local, crypt);
-		goto done;
-	}
-
-	ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-	if (ops == NULL && strcmp(param->u.crypt.alg, "WEP") == 0) {
-		request_module("ieee80211_crypt_wep");
-		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-	} else if (ops == NULL && strcmp(param->u.crypt.alg, "TKIP") == 0) {
-		request_module("ieee80211_crypt_tkip");
-		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-	} else if (ops == NULL && strcmp(param->u.crypt.alg, "CCMP") == 0) {
-		request_module("ieee80211_crypt_ccmp");
-		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-	}
-	if (ops == NULL) {
-		printk(KERN_DEBUG "%s: unknown crypto alg '%s'\n",
-		       local->dev->name, param->u.crypt.alg);
-		param->u.crypt.err = HOSTAP_CRYPT_ERR_UNKNOWN_ALG;
-		ret = -EINVAL;
-		goto done;
-	}
-
-	/* station based encryption and other than WEP algorithms require
-	 * host-based encryption, so force them on automatically */
-	local->host_decrypt = local->host_encrypt = 1;
-
-	if (*crypt == NULL || (*crypt)->ops != ops) {
-		struct ieee80211_crypt_data *new_crypt;
-
-		prism2_crypt_delayed_deinit(local, crypt);
-
-		new_crypt = (struct ieee80211_crypt_data *)
-			kmalloc(sizeof(struct ieee80211_crypt_data),
-				GFP_KERNEL);
-		if (new_crypt == NULL) {
-			ret = -ENOMEM;
-			goto done;
-		}
-		memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
-		new_crypt->ops = ops;
-		new_crypt->priv = new_crypt->ops->init(param->u.crypt.idx);
-		if (new_crypt->priv == NULL) {
-			kfree(new_crypt);
-			param->u.crypt.err =
-				HOSTAP_CRYPT_ERR_CRYPT_INIT_FAILED;
-			ret = -EINVAL;
-			goto done;
-		}
-
-		*crypt = new_crypt;
-	}
-
-	if ((!(param->u.crypt.flags & HOSTAP_CRYPT_FLAG_SET_TX_KEY) ||
-	     param->u.crypt.key_len > 0) && (*crypt)->ops->set_key &&
-	    (*crypt)->ops->set_key(param->u.crypt.key,
-				   param->u.crypt.key_len, param->u.crypt.seq,
-				   (*crypt)->priv) < 0) {
-		printk(KERN_DEBUG "%s: key setting failed\n",
-		       local->dev->name);
-		param->u.crypt.err = HOSTAP_CRYPT_ERR_KEY_SET_FAILED;
-		ret = -EINVAL;
-		goto done;
-	}
-
-	if (param->u.crypt.flags & HOSTAP_CRYPT_FLAG_SET_TX_KEY) {
-		if (!sta_ptr)
-			local->tx_keyidx = param->u.crypt.idx;
-		else if (param->u.crypt.idx) {
-			printk(KERN_DEBUG "%s: TX key idx setting failed\n",
-			       local->dev->name);
-			param->u.crypt.err =
-				HOSTAP_CRYPT_ERR_TX_KEY_SET_FAILED;
-			ret = -EINVAL;
-			goto done;
-		}
-	}
-
- done:
-	if (sta_ptr)
-		hostap_handle_sta_release(sta_ptr);
-
-	/* Do not reset port0 if card is in Managed mode since resetting will
-	 * generate new IEEE 802.11 authentication which may end up in looping
-	 * with IEEE 802.1X. Prism2 documentation seem to require port reset
-	 * after WEP configuration. However, keys are apparently changed at
-	 * least in Managed mode. */
-	if (ret == 0 &&
-	    (hostap_set_encryption(local) ||
-	     (local->iw_mode != IW_MODE_INFRA &&
-	      local->func->reset_port(local->dev)))) {
-		param->u.crypt.err = HOSTAP_CRYPT_ERR_CARD_CONF_FAILED;
-		return -EINVAL;
-	}
-
-	return ret;
-}
-
-
-static int prism2_ioctl_get_encryption(local_info_t *local,
-				       struct prism2_hostapd_param *param,
-				       int param_len)
-{
-	struct ieee80211_crypt_data **crypt;
-	void *sta_ptr;
-	int max_key_len;
-
-	param->u.crypt.err = 0;
-
-	max_key_len = param_len -
-		(int) ((char *) param->u.crypt.key - (char *) param);
-	if (max_key_len < 0)
-		return -EINVAL;
-
-	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
-	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
-	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
-		sta_ptr = NULL;
-		if (param->u.crypt.idx >= WEP_KEYS)
-			param->u.crypt.idx = local->tx_keyidx;
-		crypt = &local->crypt[param->u.crypt.idx];
-	} else {
-		param->u.crypt.idx = 0;
-		sta_ptr = ap_crypt_get_ptrs(local->ap, param->sta_addr, 0,
-					    &crypt);
-
-		if (sta_ptr == NULL) {
-			param->u.crypt.err = HOSTAP_CRYPT_ERR_UNKNOWN_ADDR;
-			return -EINVAL;
-		}
-	}
-
-	if (*crypt == NULL || (*crypt)->ops == NULL) {
-		memcpy(param->u.crypt.alg, "none", 5);
-		param->u.crypt.key_len = 0;
-		param->u.crypt.idx = 0xff;
-	} else {
-		strncpy(param->u.crypt.alg, (*crypt)->ops->name,
-			HOSTAP_CRYPT_ALG_NAME_LEN);
-		param->u.crypt.key_len = 0;
-
-		memset(param->u.crypt.seq, 0, 8);
-		if ((*crypt)->ops->get_key) {
-			param->u.crypt.key_len =
-				(*crypt)->ops->get_key(param->u.crypt.key,
-						       max_key_len,
-						       param->u.crypt.seq,
-						       (*crypt)->priv);
-		}
-	}
-
-	if (sta_ptr)
-		hostap_handle_sta_release(sta_ptr);
-
-	return 0;
-}
-
-
-static int prism2_ioctl_get_rid(local_info_t *local,
-				struct prism2_hostapd_param *param,
-				int param_len)
-{
-	int max_len, res;
-
-	max_len = param_len - PRISM2_HOSTAPD_RID_HDR_LEN;
-	if (max_len < 0)
-		return -EINVAL;
-
-	res = local->func->get_rid(local->dev, param->u.rid.rid,
-				   param->u.rid.data, param->u.rid.len, 0);
-	if (res >= 0) {
-		param->u.rid.len = res;
-		return 0;
-	}
-
-	return res;
-}
-
-
-static int prism2_ioctl_set_rid(local_info_t *local,
-				struct prism2_hostapd_param *param,
-				int param_len)
-{
-	int max_len;
-
-	max_len = param_len - PRISM2_HOSTAPD_RID_HDR_LEN;
-	if (max_len < 0 || max_len < param->u.rid.len)
-		return -EINVAL;
-
-	return local->func->set_rid(local->dev, param->u.rid.rid,
-				    param->u.rid.data, param->u.rid.len);
-}
-
-
-static int prism2_ioctl_set_assoc_ap_addr(local_info_t *local,
-					  struct prism2_hostapd_param *param,
-					  int param_len)
-{
-	printk(KERN_DEBUG "%ssta: associated as client with AP " MACSTR "\n",
-	       local->dev->name, MAC2STR(param->sta_addr));
-	memcpy(local->assoc_ap_addr, param->sta_addr, ETH_ALEN);
-	return 0;
-}
-
-
-static int prism2_ioctl_siwgenie(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_point *data, char *extra)
-{
-	return prism2_set_genericelement(dev, extra, data->length);
-}
-
-
-static int prism2_ioctl_giwgenie(struct net_device *dev,
-				 struct iw_request_info *info,
-				 struct iw_point *data, char *extra)
-{
-	struct hostap_interface *iface = dev->priv;
-	local_info_t *local = iface->local;
-	int len = local->generic_elem_len - 2;
-
-	if (len <= 0 || local->generic_elem == NULL) {
-		data->length = 0;
-		return 0;
-	}
-
-	if (data->length < len)
-		return -E2BIG;
-
-	data->length = len;
-	memcpy(extra, local->generic_elem + 2, len);
-
-	return 0;
-}
-
-
-static int prism2_ioctl_set_generic_element(local_info_t *local,
-					    struct prism2_hostapd_param *param,
-					    int param_len)
-{
-	int max_len, len;
-
-	len = param->u.generic_elem.len;
-	max_len = param_len - PRISM2_HOSTAPD_GENERIC_ELEMENT_HDR_LEN;
-	if (max_len < 0 || max_len < len)
-		return -EINVAL;
-
-	return prism2_set_genericelement(local->dev,
-					 param->u.generic_elem.data, len);
-}
-
-
-static int prism2_ioctl_siwmlme(struct net_device *dev,
-				struct iw_request_info *info,
-				struct iw_point *data, char *extra)
-{
-	struct hostap_interface *iface = dev->priv;
-	local_info_t *local = iface->local;
-	struct iw_mlme *mlme = (struct iw_mlme *) extra;
-	u16 reason;
-
-	reason = cpu_to_le16(mlme->reason_code);
-
-	switch (mlme->cmd) {
-	case IW_MLME_DEAUTH:
-		return prism2_sta_send_mgmt(local, mlme->addr.sa_data,
-					    IEEE80211_STYPE_DEAUTH,
-					    (u8 *) &reason, 2);
-	case IW_MLME_DISASSOC:
-		return prism2_sta_send_mgmt(local, mlme->addr.sa_data,
-					    IEEE80211_STYPE_DISASSOC,
-					    (u8 *) &reason, 2);
-	default:
-		return -EOPNOTSUPP;
-	}
-}
-
-
-static int prism2_ioctl_mlme(local_info_t *local,
-			     struct prism2_hostapd_param *param)
-{
-	u16 reason;
-
-	reason = cpu_to_le16(param->u.mlme.reason_code);
-	switch (param->u.mlme.cmd) {
-	case MLME_STA_DEAUTH:
-		return prism2_sta_send_mgmt(local, param->sta_addr,
-					    IEEE80211_STYPE_DEAUTH,
-					    (u8 *) &reason, 2);
-	case MLME_STA_DISASSOC:
-		return prism2_sta_send_mgmt(local, param->sta_addr,
-					    IEEE80211_STYPE_DISASSOC,
-					    (u8 *) &reason, 2);
-	default:
-		return -EOPNOTSUPP;
-	}
-}
-
-
-static int prism2_ioctl_scan_req(local_info_t *local,
-				 struct prism2_hostapd_param *param)
-{
-#ifndef PRISM2_NO_STATION_MODES
-	if ((local->iw_mode != IW_MODE_INFRA &&
-	     local->iw_mode != IW_MODE_ADHOC) ||
-	    (local->sta_fw_ver < PRISM2_FW_VER(1,3,1)))
-		return -EOPNOTSUPP;
-
-	if (!local->dev_enabled)
-		return -ENETDOWN;
-
-	return prism2_request_hostscan(local->dev, param->u.scan_req.ssid,
-				       param->u.scan_req.ssid_len);
-#else /* PRISM2_NO_STATION_MODES */
-	return -EOPNOTSUPP;
-#endif /* PRISM2_NO_STATION_MODES */
-}
-
-
-static int prism2_ioctl_priv_hostapd(local_info_t *local, struct iw_point *p)
-{
-	struct prism2_hostapd_param *param;
-	int ret = 0;
-	int ap_ioctl = 0;
-
-	if (p->length < sizeof(struct prism2_hostapd_param) ||
-	    p->length > PRISM2_HOSTAPD_MAX_BUF_SIZE || !p->pointer)
-		return -EINVAL;
-
-	param = (struct prism2_hostapd_param *) kmalloc(p->length, GFP_KERNEL);
-	if (param == NULL)
-		return -ENOMEM;
-
-	if (copy_from_user(param, p->pointer, p->length)) {
-		ret = -EFAULT;
-		goto out;
-	}
-
-	switch (param->cmd) {
-	case PRISM2_SET_ENCRYPTION:
-		ret = prism2_ioctl_set_encryption(local, param, p->length);
-		break;
-	case PRISM2_GET_ENCRYPTION:
-		ret = prism2_ioctl_get_encryption(local, param, p->length);
-		break;
-	case PRISM2_HOSTAPD_GET_RID:
-		ret = prism2_ioctl_get_rid(local, param, p->length);
-		break;
-	case PRISM2_HOSTAPD_SET_RID:
-		ret = prism2_ioctl_set_rid(local, param, p->length);
-		break;
-	case PRISM2_HOSTAPD_SET_ASSOC_AP_ADDR:
-		ret = prism2_ioctl_set_assoc_ap_addr(local, param, p->length);
-		break;
-	case PRISM2_HOSTAPD_SET_GENERIC_ELEMENT:
-		ret = prism2_ioctl_set_generic_element(local, param,
-						       p->length);
-		break;
-	case PRISM2_HOSTAPD_MLME:
-		ret = prism2_ioctl_mlme(local, param);
-		break;
-	case PRISM2_HOSTAPD_SCAN_REQ:
-		ret = prism2_ioctl_scan_req(local, param);
-		break;
-	default:
-		ret = prism2_hostapd(local->ap, param);
-		ap_ioctl = 1;
-		break;
-	}
-
-	if (ret == 1 || !ap_ioctl) {
-		if (copy_to_user(p->pointer, param, p->length)) {
-			ret = -EFAULT;
-			goto out;
-		} else if (ap_ioctl)
-			ret = 0;
-	}
-
- out:
-	if (param != NULL)
-		kfree(param);
-
-	return ret;
-}
-
-
-static void prism2_get_drvinfo(struct net_device *dev,
-			       struct ethtool_drvinfo *info)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	strncpy(info->driver, "hostap", sizeof(info->driver) - 1);
-	strncpy(info->version, PRISM2_VERSION,
-		sizeof(info->version) - 1);
-	snprintf(info->fw_version, sizeof(info->fw_version) - 1,
-		 "%d.%d.%d", (local->sta_fw_ver >> 16) & 0xff,
-		 (local->sta_fw_ver >> 8) & 0xff,
-		 local->sta_fw_ver & 0xff);
-}
-
-static struct ethtool_ops prism2_ethtool_ops = {
-	.get_drvinfo = prism2_get_drvinfo
-};
-
-
-/* Structures to export the Wireless Handlers */
-
-static const iw_handler prism2_handler[] =
-{
-	(iw_handler) NULL,				/* SIOCSIWCOMMIT */
-	(iw_handler) prism2_get_name,			/* SIOCGIWNAME */
-	(iw_handler) NULL,				/* SIOCSIWNWID */
-	(iw_handler) NULL,				/* SIOCGIWNWID */
-	(iw_handler) prism2_ioctl_siwfreq,		/* SIOCSIWFREQ */
-	(iw_handler) prism2_ioctl_giwfreq,		/* SIOCGIWFREQ */
-	(iw_handler) prism2_ioctl_siwmode,		/* SIOCSIWMODE */
-	(iw_handler) prism2_ioctl_giwmode,		/* SIOCGIWMODE */
-	(iw_handler) prism2_ioctl_siwsens,		/* SIOCSIWSENS */
-	(iw_handler) prism2_ioctl_giwsens,		/* SIOCGIWSENS */
-	(iw_handler) NULL /* not used */,		/* SIOCSIWRANGE */
-	(iw_handler) prism2_ioctl_giwrange,		/* SIOCGIWRANGE */
-	(iw_handler) NULL /* not used */,		/* SIOCSIWPRIV */
-	(iw_handler) NULL /* kernel code */,		/* SIOCGIWPRIV */
-	(iw_handler) NULL /* not used */,		/* SIOCSIWSTATS */
-	(iw_handler) NULL /* kernel code */,		/* SIOCGIWSTATS */
-	iw_handler_set_spy,				/* SIOCSIWSPY */
-	iw_handler_get_spy,				/* SIOCGIWSPY */
-	iw_handler_set_thrspy,				/* SIOCSIWTHRSPY */
-	iw_handler_get_thrspy,				/* SIOCGIWTHRSPY */
-	(iw_handler) prism2_ioctl_siwap,		/* SIOCSIWAP */
-	(iw_handler) prism2_ioctl_giwap,		/* SIOCGIWAP */
-	(iw_handler) prism2_ioctl_siwmlme,		/* SIOCSIWMLME */
-	(iw_handler) prism2_ioctl_giwaplist,		/* SIOCGIWAPLIST */
-	(iw_handler) prism2_ioctl_siwscan,		/* SIOCSIWSCAN */
-	(iw_handler) prism2_ioctl_giwscan,		/* SIOCGIWSCAN */
-	(iw_handler) prism2_ioctl_siwessid,		/* SIOCSIWESSID */
-	(iw_handler) prism2_ioctl_giwessid,		/* SIOCGIWESSID */
-	(iw_handler) prism2_ioctl_siwnickn,		/* SIOCSIWNICKN */
-	(iw_handler) prism2_ioctl_giwnickn,		/* SIOCGIWNICKN */
-	(iw_handler) NULL,				/* -- hole -- */
-	(iw_handler) NULL,				/* -- hole -- */
-	(iw_handler) prism2_ioctl_siwrate,		/* SIOCSIWRATE */
-	(iw_handler) prism2_ioctl_giwrate,		/* SIOCGIWRATE */
-	(iw_handler) prism2_ioctl_siwrts,		/* SIOCSIWRTS */
-	(iw_handler) prism2_ioctl_giwrts,		/* SIOCGIWRTS */
-	(iw_handler) prism2_ioctl_siwfrag,		/* SIOCSIWFRAG */
-	(iw_handler) prism2_ioctl_giwfrag,		/* SIOCGIWFRAG */
-	(iw_handler) prism2_ioctl_siwtxpow,		/* SIOCSIWTXPOW */
-	(iw_handler) prism2_ioctl_giwtxpow,		/* SIOCGIWTXPOW */
-	(iw_handler) prism2_ioctl_siwretry,		/* SIOCSIWRETRY */
-	(iw_handler) prism2_ioctl_giwretry,		/* SIOCGIWRETRY */
-	(iw_handler) prism2_ioctl_siwencode,		/* SIOCSIWENCODE */
-	(iw_handler) prism2_ioctl_giwencode,		/* SIOCGIWENCODE */
-	(iw_handler) prism2_ioctl_siwpower,		/* SIOCSIWPOWER */
-	(iw_handler) prism2_ioctl_giwpower,		/* SIOCGIWPOWER */
-	(iw_handler) NULL,				/* -- hole -- */
-	(iw_handler) NULL,				/* -- hole -- */
-	(iw_handler) prism2_ioctl_siwgenie,		/* SIOCSIWGENIE */
-	(iw_handler) prism2_ioctl_giwgenie,		/* SIOCGIWGENIE */
-	(iw_handler) prism2_ioctl_siwauth,		/* SIOCSIWAUTH */
-	(iw_handler) prism2_ioctl_giwauth,		/* SIOCGIWAUTH */
-	(iw_handler) prism2_ioctl_siwencodeext,		/* SIOCSIWENCODEEXT */
-	(iw_handler) prism2_ioctl_giwencodeext,		/* SIOCGIWENCODEEXT */
-	(iw_handler) NULL,				/* SIOCSIWPMKSA */
-	(iw_handler) NULL,				/* -- hole -- */
-};
-
-static const iw_handler prism2_private_handler[] =
-{							/* SIOCIWFIRSTPRIV + */
-	(iw_handler) prism2_ioctl_priv_prism2_param,	/* 0 */
-	(iw_handler) prism2_ioctl_priv_get_prism2_param, /* 1 */
-	(iw_handler) prism2_ioctl_priv_writemif,	/* 2 */
-	(iw_handler) prism2_ioctl_priv_readmif,		/* 3 */
-};
-
-static const struct iw_handler_def hostap_iw_handler_def =
-{
-	.num_standard	= sizeof(prism2_handler) / sizeof(iw_handler),
-	.num_private	= sizeof(prism2_private_handler) / sizeof(iw_handler),
-	.num_private_args = sizeof(prism2_priv) / sizeof(struct iw_priv_args),
-	.standard	= (iw_handler *) prism2_handler,
-	.private	= (iw_handler *) prism2_private_handler,
-	.private_args	= (struct iw_priv_args *) prism2_priv,
-	.get_wireless_stats = hostap_get_wireless_stats,
-};
-
-
-int hostap_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
-{
-	struct iwreq *wrq = (struct iwreq *) ifr;
-	struct hostap_interface *iface;
-	local_info_t *local;
-	int ret = 0;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	switch (cmd) {
-		/* Private ioctls (iwpriv) that have not yet been converted
-		 * into new wireless extensions API */
-
-	case PRISM2_IOCTL_INQUIRE:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = prism2_ioctl_priv_inquire(dev, (int *) wrq->u.name);
-		break;
-
-	case PRISM2_IOCTL_MONITOR:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = prism2_ioctl_priv_monitor(dev, (int *) wrq->u.name);
-		break;
-
-	case PRISM2_IOCTL_RESET:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = prism2_ioctl_priv_reset(dev, (int *) wrq->u.name);
-		break;
-
-	case PRISM2_IOCTL_WDS_ADD:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = prism2_wds_add(local, wrq->u.ap_addr.sa_data, 1);
-		break;
-
-	case PRISM2_IOCTL_WDS_DEL:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = prism2_wds_del(local, wrq->u.ap_addr.sa_data, 1, 0);
-		break;
-
-	case PRISM2_IOCTL_SET_RID_WORD:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = prism2_ioctl_priv_set_rid_word(dev,
-							  (int *) wrq->u.name);
-		break;
-
-#ifndef PRISM2_NO_KERNEL_IEEE80211_MGMT
-	case PRISM2_IOCTL_MACCMD:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = ap_mac_cmd_ioctl(local, (int *) wrq->u.name);
-		break;
-
-	case PRISM2_IOCTL_ADDMAC:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = ap_control_add_mac(&local->ap->mac_restrictions,
-					      wrq->u.ap_addr.sa_data);
-		break;
-	case PRISM2_IOCTL_DELMAC:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = ap_control_del_mac(&local->ap->mac_restrictions,
-					      wrq->u.ap_addr.sa_data);
-		break;
-	case PRISM2_IOCTL_KICKMAC:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = ap_control_kick_mac(local->ap, local->dev,
-					       wrq->u.ap_addr.sa_data);
-		break;
-#endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
-
-
-		/* Private ioctls that are not used with iwpriv;
-		 * in SIOCDEVPRIVATE range */
-
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-	case PRISM2_IOCTL_DOWNLOAD:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = prism2_ioctl_priv_download(local, &wrq->u.data);
-		break;
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-
-	case PRISM2_IOCTL_HOSTAPD:
-		if (!capable(CAP_NET_ADMIN)) ret = -EPERM;
-		else ret = prism2_ioctl_priv_hostapd(local, &wrq->u.data);
-		break;
-
-	default:
-		ret = -EOPNOTSUPP;
-		break;
-	}
-
-	return ret;
-}
diff --git a/trunk/drivers/net/wireless/hostap/hostap_pci.c b/trunk/drivers/net/wireless/hostap/hostap_pci.c
deleted file mode 100644
index 4f567ef6178d..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_pci.c
+++ /dev/null
@@ -1,473 +0,0 @@
-#define PRISM2_PCI
-
-/* Host AP driver's support for Intersil Prism2.5 PCI cards is based on
- * driver patches from Reyk Floeter <reyk@vantronix.net> and
- * Andy Warner <andyw@pobox.com> */
-
-#include <linux/config.h>
-#include <linux/version.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/if.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/workqueue.h>
-#include <linux/wireless.h>
-#include <net/iw_handler.h>
-
-#include <linux/ioport.h>
-#include <linux/pci.h>
-#include <asm/io.h>
-
-#include "hostap_wlan.h"
-
-
-static char *version = PRISM2_VERSION " (Jouni Malinen <jkmaline@cc.hut.fi>)";
-static char *dev_info = "hostap_pci";
-
-
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Support for Intersil Prism2.5-based 802.11 wireless LAN "
-		   "PCI cards.");
-MODULE_SUPPORTED_DEVICE("Intersil Prism2.5-based WLAN PCI cards");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(PRISM2_VERSION);
-
-
-/* struct local_info::hw_priv */
-struct hostap_pci_priv {
-	void __iomem *mem_start;
-};
-
-
-/* FIX: do we need mb/wmb/rmb with memory operations? */
-
-
-static struct pci_device_id prism2_pci_id_table[] __devinitdata = {
-	/* Intersil Prism3 ISL3872 11Mb/s WLAN Controller */
-	{ 0x1260, 0x3872, PCI_ANY_ID, PCI_ANY_ID },
-	/* Intersil Prism2.5 ISL3874 11Mb/s WLAN Controller */
-	{ 0x1260, 0x3873, PCI_ANY_ID, PCI_ANY_ID },
-	/* Samsung MagicLAN SWL-2210P */
-	{ 0x167d, 0xa000, PCI_ANY_ID, PCI_ANY_ID },
-	{ 0 }
-};
-
-
-#ifdef PRISM2_IO_DEBUG
-
-static inline void hfa384x_outb_debug(struct net_device *dev, int a, u8 v)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_OUTB, a, v);
-	writeb(v, hw_priv->mem_start + a);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-static inline u8 hfa384x_inb_debug(struct net_device *dev, int a)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-	u8 v;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	v = readb(hw_priv->mem_start + a);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INB, a, v);
-	spin_unlock_irqrestore(&local->lock, flags);
-	return v;
-}
-
-static inline void hfa384x_outw_debug(struct net_device *dev, int a, u16 v)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_OUTW, a, v);
-	writew(v, hw_priv->mem_start + a);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-static inline u16 hfa384x_inw_debug(struct net_device *dev, int a)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-	u16 v;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	v = readw(hw_priv->mem_start + a);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INW, a, v);
-	spin_unlock_irqrestore(&local->lock, flags);
-	return v;
-}
-
-#define HFA384X_OUTB(v,a) hfa384x_outb_debug(dev, (a), (v))
-#define HFA384X_INB(a) hfa384x_inb_debug(dev, (a))
-#define HFA384X_OUTW(v,a) hfa384x_outw_debug(dev, (a), (v))
-#define HFA384X_INW(a) hfa384x_inw_debug(dev, (a))
-#define HFA384X_OUTW_DATA(v,a) hfa384x_outw_debug(dev, (a), cpu_to_le16((v)))
-#define HFA384X_INW_DATA(a) (u16) le16_to_cpu(hfa384x_inw_debug(dev, (a)))
-
-#else /* PRISM2_IO_DEBUG */
-
-static inline void hfa384x_outb(struct net_device *dev, int a, u8 v)
-{
-	struct hostap_interface *iface;
-	struct hostap_pci_priv *hw_priv;
-	iface = netdev_priv(dev);
-	hw_priv = iface->local->hw_priv;
-	writeb(v, hw_priv->mem_start + a);
-}
-
-static inline u8 hfa384x_inb(struct net_device *dev, int a)
-{
-	struct hostap_interface *iface;
-	struct hostap_pci_priv *hw_priv;
-	iface = netdev_priv(dev);
-	hw_priv = iface->local->hw_priv;
-	return readb(hw_priv->mem_start + a);
-}
-
-static inline void hfa384x_outw(struct net_device *dev, int a, u16 v)
-{
-	struct hostap_interface *iface;
-	struct hostap_pci_priv *hw_priv;
-	iface = netdev_priv(dev);
-	hw_priv = iface->local->hw_priv;
-	writew(v, hw_priv->mem_start + a);
-}
-
-static inline u16 hfa384x_inw(struct net_device *dev, int a)
-{
-	struct hostap_interface *iface;
-	struct hostap_pci_priv *hw_priv;
-	iface = netdev_priv(dev);
-	hw_priv = iface->local->hw_priv;
-	return readw(hw_priv->mem_start + a);
-}
-
-#define HFA384X_OUTB(v,a) hfa384x_outb(dev, (a), (v))
-#define HFA384X_INB(a) hfa384x_inb(dev, (a))
-#define HFA384X_OUTW(v,a) hfa384x_outw(dev, (a), (v))
-#define HFA384X_INW(a) hfa384x_inw(dev, (a))
-#define HFA384X_OUTW_DATA(v,a) hfa384x_outw(dev, (a), cpu_to_le16((v)))
-#define HFA384X_INW_DATA(a) (u16) le16_to_cpu(hfa384x_inw(dev, (a)))
-
-#endif /* PRISM2_IO_DEBUG */
-
-
-static int hfa384x_from_bap(struct net_device *dev, u16 bap, void *buf,
-			    int len)
-{
-	u16 d_off;
-	u16 *pos;
-
-	d_off = (bap == 1) ? HFA384X_DATA1_OFF : HFA384X_DATA0_OFF;
-	pos = (u16 *) buf;
-
-	for ( ; len > 1; len -= 2)
-		*pos++ = HFA384X_INW_DATA(d_off);
-
-	if (len & 1)
-		*((char *) pos) = HFA384X_INB(d_off);
-
-	return 0;
-}
-
-
-static int hfa384x_to_bap(struct net_device *dev, u16 bap, void *buf, int len)
-{
-	u16 d_off;
-	u16 *pos;
-
-	d_off = (bap == 1) ? HFA384X_DATA1_OFF : HFA384X_DATA0_OFF;
-	pos = (u16 *) buf;
-
-	for ( ; len > 1; len -= 2)
-		HFA384X_OUTW_DATA(*pos++, d_off);
-
-	if (len & 1)
-		HFA384X_OUTB(*((char *) pos), d_off);
-
-	return 0;
-}
-
-
-/* FIX: This might change at some point.. */
-#include "hostap_hw.c"
-
-static void prism2_pci_cor_sreset(local_info_t *local)
-{
-	struct net_device *dev = local->dev;
-	u16 reg;
-
-	reg = HFA384X_INB(HFA384X_PCICOR_OFF);
-	printk(KERN_DEBUG "%s: Original COR value: 0x%0x\n", dev->name, reg);
-
-	/* linux-wlan-ng uses extremely long hold and settle times for
-	 * COR sreset. A comment in the driver code mentions that the long
-	 * delays appear to be necessary. However, at least IBM 22P6901 seems
-	 * to work fine with shorter delays.
-	 *
-	 * Longer delays can be configured by uncommenting following line: */
-/* #define PRISM2_PCI_USE_LONG_DELAYS */
-
-#ifdef PRISM2_PCI_USE_LONG_DELAYS
-	int i;
-
-	HFA384X_OUTW(reg | 0x0080, HFA384X_PCICOR_OFF);
-	mdelay(250);
-
-	HFA384X_OUTW(reg & ~0x0080, HFA384X_PCICOR_OFF);
-	mdelay(500);
-
-	/* Wait for f/w to complete initialization (CMD:BUSY == 0) */
-	i = 2000000 / 10;
-	while ((HFA384X_INW(HFA384X_CMD_OFF) & HFA384X_CMD_BUSY) && --i)
-		udelay(10);
-
-#else /* PRISM2_PCI_USE_LONG_DELAYS */
-
-	HFA384X_OUTW(reg | 0x0080, HFA384X_PCICOR_OFF);
-	mdelay(2);
-	HFA384X_OUTW(reg & ~0x0080, HFA384X_PCICOR_OFF);
-	mdelay(2);
-
-#endif /* PRISM2_PCI_USE_LONG_DELAYS */
-
-	if (HFA384X_INW(HFA384X_CMD_OFF) & HFA384X_CMD_BUSY) {
-		printk(KERN_DEBUG "%s: COR sreset timeout\n", dev->name);
-	}
-}
-
-
-static void prism2_pci_genesis_reset(local_info_t *local, int hcr)
-{
-	struct net_device *dev = local->dev;
-
-	HFA384X_OUTW(0x00C5, HFA384X_PCICOR_OFF);
-	mdelay(10);
-	HFA384X_OUTW(hcr, HFA384X_PCIHCR_OFF);
-	mdelay(10);
-	HFA384X_OUTW(0x0045, HFA384X_PCICOR_OFF);
-	mdelay(10);
-}
-
-
-static struct prism2_helper_functions prism2_pci_funcs =
-{
-	.card_present	= NULL,
-	.cor_sreset	= prism2_pci_cor_sreset,
-	.dev_open	= NULL,
-	.dev_close	= NULL,
-	.genesis_reset	= prism2_pci_genesis_reset,
-	.hw_type	= HOSTAP_HW_PCI,
-};
-
-
-static int prism2_pci_probe(struct pci_dev *pdev,
-			    const struct pci_device_id *id)
-{
-	unsigned long phymem;
-	void __iomem *mem = NULL;
-	local_info_t *local = NULL;
-	struct net_device *dev = NULL;
-	static int cards_found /* = 0 */;
-	int irq_registered = 0;
-	struct hostap_interface *iface;
-	struct hostap_pci_priv *hw_priv;
-
-	hw_priv = kmalloc(sizeof(*hw_priv), GFP_KERNEL);
-	if (hw_priv == NULL)
-		return -ENOMEM;
-	memset(hw_priv, 0, sizeof(*hw_priv));
-
-	if (pci_enable_device(pdev))
-		return -EIO;
-
-	phymem = pci_resource_start(pdev, 0);
-
-	if (!request_mem_region(phymem, pci_resource_len(pdev, 0), "Prism2")) {
-		printk(KERN_ERR "prism2: Cannot reserve PCI memory region\n");
-		goto err_out_disable;
-	}
-
-	mem = ioremap(phymem, pci_resource_len(pdev, 0));
-	if (mem == NULL) {
-		printk(KERN_ERR "prism2: Cannot remap PCI memory region\n") ;
-		goto fail;
-	}
-
-	dev = prism2_init_local_data(&prism2_pci_funcs, cards_found,
-				     &pdev->dev);
-	if (dev == NULL)
-		goto fail;
-	iface = netdev_priv(dev);
-	local = iface->local;
-	local->hw_priv = hw_priv;
-	cards_found++;
-
-        dev->irq = pdev->irq;
-        hw_priv->mem_start = mem;
-
-	prism2_pci_cor_sreset(local);
-
-	pci_set_drvdata(pdev, dev);
-
-	if (request_irq(dev->irq, prism2_interrupt, SA_SHIRQ, dev->name,
-			dev)) {
-		printk(KERN_WARNING "%s: request_irq failed\n", dev->name);
-		goto fail;
-	} else
-		irq_registered = 1;
-
-	if (!local->pri_only && prism2_hw_config(dev, 1)) {
-		printk(KERN_DEBUG "%s: hardware initialization failed\n",
-		       dev_info);
-		goto fail;
-	}
-
-	printk(KERN_INFO "%s: Intersil Prism2.5 PCI: "
-	       "mem=0x%lx, irq=%d\n", dev->name, phymem, dev->irq);
-
-	return hostap_hw_ready(dev);
-
- fail:
-	kfree(hw_priv);
-
-	if (irq_registered && dev)
-		free_irq(dev->irq, dev);
-
-	if (mem)
-		iounmap(mem);
-
-	release_mem_region(phymem, pci_resource_len(pdev, 0));
-
- err_out_disable:
-	pci_disable_device(pdev);
-	kfree(hw_priv);
-	if (local)
-		local->hw_priv = NULL;
-	prism2_free_local_data(dev);
-
-	return -ENODEV;
-}
-
-
-static void prism2_pci_remove(struct pci_dev *pdev)
-{
-	struct net_device *dev;
-	struct hostap_interface *iface;
-	void __iomem *mem_start;
-	struct hostap_pci_priv *hw_priv;
-
-	dev = pci_get_drvdata(pdev);
-	iface = netdev_priv(dev);
-	hw_priv = iface->local->hw_priv;
-
-	/* Reset the hardware, and ensure interrupts are disabled. */
-	prism2_pci_cor_sreset(iface->local);
-	hfa384x_disable_interrupts(dev);
-
-	if (dev->irq)
-		free_irq(dev->irq, dev);
-
-	mem_start = hw_priv->mem_start;
-	kfree(hw_priv);
-	iface->local->hw_priv = NULL;
-	prism2_free_local_data(dev);
-
-	iounmap(mem_start);
-
-	release_mem_region(pci_resource_start(pdev, 0),
-			   pci_resource_len(pdev, 0));
-	pci_disable_device(pdev);
-}
-
-
-#ifdef CONFIG_PM
-static int prism2_pci_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-	struct net_device *dev = pci_get_drvdata(pdev);
-
-	if (netif_running(dev)) {
-		netif_stop_queue(dev);
-		netif_device_detach(dev);
-	}
-	prism2_suspend(dev);
-	pci_save_state(pdev);
-	pci_disable_device(pdev);
-	pci_set_power_state(pdev, 3);
-
-	return 0;
-}
-
-static int prism2_pci_resume(struct pci_dev *pdev)
-{
-	struct net_device *dev = pci_get_drvdata(pdev);
-
-	pci_enable_device(pdev);
-	pci_restore_state(pdev);
-	prism2_hw_config(dev, 0);
-	if (netif_running(dev)) {
-		netif_device_attach(dev);
-		netif_start_queue(dev);
-	}
-
-	return 0;
-}
-#endif /* CONFIG_PM */
-
-
-MODULE_DEVICE_TABLE(pci, prism2_pci_id_table);
-
-static struct pci_driver prism2_pci_drv_id = {
-	.name		= "prism2_pci",
-	.id_table	= prism2_pci_id_table,
-	.probe		= prism2_pci_probe,
-	.remove		= prism2_pci_remove,
-#ifdef CONFIG_PM
-	.suspend	= prism2_pci_suspend,
-	.resume		= prism2_pci_resume,
-#endif /* CONFIG_PM */
-	/* Linux 2.4.6 added save_state and enable_wake that are not used here
-	 */
-};
-
-
-static int __init init_prism2_pci(void)
-{
-	printk(KERN_INFO "%s: %s\n", dev_info, version);
-
-	return pci_register_driver(&prism2_pci_drv_id);
-}
-
-
-static void __exit exit_prism2_pci(void)
-{
-	pci_unregister_driver(&prism2_pci_drv_id);
-	printk(KERN_INFO "%s: Driver unloaded\n", dev_info);
-}
-
-
-module_init(init_prism2_pci);
-module_exit(exit_prism2_pci);
diff --git a/trunk/drivers/net/wireless/hostap/hostap_plx.c b/trunk/drivers/net/wireless/hostap/hostap_plx.c
deleted file mode 100644
index 474ef83d813e..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_plx.c
+++ /dev/null
@@ -1,645 +0,0 @@
-#define PRISM2_PLX
-
-/* Host AP driver's support for PC Cards on PCI adapters using PLX9052 is
- * based on:
- * - Host AP driver patch from james@madingley.org
- * - linux-wlan-ng driver, Copyright (C) AbsoluteValue Systems, Inc.
- */
-
-
-#include <linux/config.h>
-#include <linux/version.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/if.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/workqueue.h>
-#include <linux/wireless.h>
-#include <net/iw_handler.h>
-
-#include <linux/ioport.h>
-#include <linux/pci.h>
-#include <asm/io.h>
-
-#include "hostap_wlan.h"
-
-
-static char *version = PRISM2_VERSION " (Jouni Malinen <jkmaline@cc.hut.fi>)";
-static char *dev_info = "hostap_plx";
-
-
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Support for Intersil Prism2-based 802.11 wireless LAN "
-		   "cards (PLX).");
-MODULE_SUPPORTED_DEVICE("Intersil Prism2-based WLAN cards (PLX)");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(PRISM2_VERSION);
-
-
-static int ignore_cis;
-module_param(ignore_cis, int, 0444);
-MODULE_PARM_DESC(ignore_cis, "Do not verify manfid information in CIS");
-
-
-/* struct local_info::hw_priv */
-struct hostap_plx_priv {
-	void __iomem *attr_mem;
-	unsigned int cor_offset;
-};
-
-
-#define PLX_MIN_ATTR_LEN 512	/* at least 2 x 256 is needed for CIS */
-#define COR_SRESET       0x80
-#define COR_LEVLREQ      0x40
-#define COR_ENABLE_FUNC  0x01
-/* PCI Configuration Registers */
-#define PLX_PCIIPR       0x3d   /* PCI Interrupt Pin */
-/* Local Configuration Registers */
-#define PLX_INTCSR       0x4c   /* Interrupt Control/Status Register */
-#define PLX_INTCSR_PCI_INTEN BIT(6) /* PCI Interrupt Enable */
-#define PLX_CNTRL        0x50
-#define PLX_CNTRL_SERIAL_EEPROM_PRESENT BIT(28)
-
-
-#define PLXDEV(vendor,dev,str) { vendor, dev, PCI_ANY_ID, PCI_ANY_ID }
-
-static struct pci_device_id prism2_plx_id_table[] __devinitdata = {
-	PLXDEV(0x10b7, 0x7770, "3Com AirConnect PCI 777A"),
-	PLXDEV(0x111a, 0x1023, "Siemens SpeedStream SS1023"),
-	PLXDEV(0x126c, 0x8030, "Nortel emobility"),
-	PLXDEV(0x1385, 0x4100, "Netgear MA301"),
-	PLXDEV(0x15e8, 0x0130, "National Datacomm NCP130 (PLX9052)"),
-	PLXDEV(0x15e8, 0x0131, "National Datacomm NCP130 (TMD7160)"),
-	PLXDEV(0x1638, 0x1100, "Eumitcom WL11000"),
-	PLXDEV(0x16ab, 0x1101, "Global Sun Tech GL24110P (?)"),
-	PLXDEV(0x16ab, 0x1102, "Linksys WPC11 with WDT11"),
-	PLXDEV(0x16ab, 0x1103, "Longshine 8031"),
-	PLXDEV(0x16ec, 0x3685, "US Robotics USR2415"),
-	PLXDEV(0xec80, 0xec00, "Belkin F5D6000"),
-	{ 0 }
-};
-
-
-/* Array of known Prism2/2.5 PC Card manufactured ids. If your card's manfid
- * is not listed here, you will need to add it here to get the driver
- * initialized. */
-static struct prism2_plx_manfid {
-	u16 manfid1, manfid2;
-} prism2_plx_known_manfids[] = {
-	{ 0x000b, 0x7110 } /* D-Link DWL-650 Rev. P1 */,
-	{ 0x000b, 0x7300 } /* Philips 802.11b WLAN PCMCIA */,
-	{ 0x0101, 0x0777 } /* 3Com AirConnect PCI 777A */,
-	{ 0x0126, 0x8000 } /* Proxim RangeLAN */,
-	{ 0x0138, 0x0002 } /* Compaq WL100 */,
-	{ 0x0156, 0x0002 } /* Intersil Prism II Ref. Design (and others) */,
-	{ 0x026f, 0x030b } /* Buffalo WLI-CF-S11G */,
-	{ 0x0274, 0x1612 } /* Linksys WPC11 Ver 2.5 */,
-	{ 0x0274, 0x1613 } /* Linksys WPC11 Ver 3 */,
-	{ 0x028a, 0x0002 } /* D-Link DRC-650 */,
-	{ 0x0250, 0x0002 } /* Samsung SWL2000-N */,
-	{ 0xc250, 0x0002 } /* EMTAC A2424i */,
-	{ 0xd601, 0x0002 } /* Z-Com XI300 */,
-	{ 0xd601, 0x0005 } /* Zcomax XI-325H 200mW */,
-	{ 0, 0}
-};
-
-
-#ifdef PRISM2_IO_DEBUG
-
-static inline void hfa384x_outb_debug(struct net_device *dev, int a, u8 v)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_OUTB, a, v);
-	outb(v, dev->base_addr + a);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-static inline u8 hfa384x_inb_debug(struct net_device *dev, int a)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-	u8 v;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	v = inb(dev->base_addr + a);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INB, a, v);
-	spin_unlock_irqrestore(&local->lock, flags);
-	return v;
-}
-
-static inline void hfa384x_outw_debug(struct net_device *dev, int a, u16 v)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_OUTW, a, v);
-	outw(v, dev->base_addr + a);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-static inline u16 hfa384x_inw_debug(struct net_device *dev, int a)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-	u16 v;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	v = inw(dev->base_addr + a);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INW, a, v);
-	spin_unlock_irqrestore(&local->lock, flags);
-	return v;
-}
-
-static inline void hfa384x_outsw_debug(struct net_device *dev, int a,
-				       u8 *buf, int wc)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_OUTSW, a, wc);
-	outsw(dev->base_addr + a, buf, wc);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-static inline void hfa384x_insw_debug(struct net_device *dev, int a,
-				      u8 *buf, int wc)
-{
-	struct hostap_interface *iface;
-	local_info_t *local;
-	unsigned long flags;
-
-	iface = netdev_priv(dev);
-	local = iface->local;
-
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INSW, a, wc);
-	insw(dev->base_addr + a, buf, wc);
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-#define HFA384X_OUTB(v,a) hfa384x_outb_debug(dev, (a), (v))
-#define HFA384X_INB(a) hfa384x_inb_debug(dev, (a))
-#define HFA384X_OUTW(v,a) hfa384x_outw_debug(dev, (a), (v))
-#define HFA384X_INW(a) hfa384x_inw_debug(dev, (a))
-#define HFA384X_OUTSW(a, buf, wc) hfa384x_outsw_debug(dev, (a), (buf), (wc))
-#define HFA384X_INSW(a, buf, wc) hfa384x_insw_debug(dev, (a), (buf), (wc))
-
-#else /* PRISM2_IO_DEBUG */
-
-#define HFA384X_OUTB(v,a) outb((v), dev->base_addr + (a))
-#define HFA384X_INB(a) inb(dev->base_addr + (a))
-#define HFA384X_OUTW(v,a) outw((v), dev->base_addr + (a))
-#define HFA384X_INW(a) inw(dev->base_addr + (a))
-#define HFA384X_INSW(a, buf, wc) insw(dev->base_addr + (a), buf, wc)
-#define HFA384X_OUTSW(a, buf, wc) outsw(dev->base_addr + (a), buf, wc)
-
-#endif /* PRISM2_IO_DEBUG */
-
-
-static int hfa384x_from_bap(struct net_device *dev, u16 bap, void *buf,
-			    int len)
-{
-	u16 d_off;
-	u16 *pos;
-
-	d_off = (bap == 1) ? HFA384X_DATA1_OFF : HFA384X_DATA0_OFF;
-	pos = (u16 *) buf;
-
-	if (len / 2)
-		HFA384X_INSW(d_off, buf, len / 2);
-	pos += len / 2;
-
-	if (len & 1)
-		*((char *) pos) = HFA384X_INB(d_off);
-
-	return 0;
-}
-
-
-static int hfa384x_to_bap(struct net_device *dev, u16 bap, void *buf, int len)
-{
-	u16 d_off;
-	u16 *pos;
-
-	d_off = (bap == 1) ? HFA384X_DATA1_OFF : HFA384X_DATA0_OFF;
-	pos = (u16 *) buf;
-
-	if (len / 2)
-		HFA384X_OUTSW(d_off, buf, len / 2);
-	pos += len / 2;
-
-	if (len & 1)
-		HFA384X_OUTB(*((char *) pos), d_off);
-
-	return 0;
-}
-
-
-/* FIX: This might change at some point.. */
-#include "hostap_hw.c"
-
-
-static void prism2_plx_cor_sreset(local_info_t *local)
-{
-	unsigned char corsave;
-	struct hostap_plx_priv *hw_priv = local->hw_priv;
-
-	printk(KERN_DEBUG "%s: Doing reset via direct COR access.\n",
-	       dev_info);
-
-	/* Set sreset bit of COR and clear it after hold time */
-
-	if (hw_priv->attr_mem == NULL) {
-		/* TMD7160 - COR at card's first I/O addr */
-		corsave = inb(hw_priv->cor_offset);
-		outb(corsave | COR_SRESET, hw_priv->cor_offset);
-		mdelay(2);
-		outb(corsave & ~COR_SRESET, hw_priv->cor_offset);
-		mdelay(2);
-	} else {
-		/* PLX9052 */
-		corsave = readb(hw_priv->attr_mem + hw_priv->cor_offset);
-		writeb(corsave | COR_SRESET,
-		       hw_priv->attr_mem + hw_priv->cor_offset);
-		mdelay(2);
-		writeb(corsave & ~COR_SRESET,
-		       hw_priv->attr_mem + hw_priv->cor_offset);
-		mdelay(2);
-	}
-}
-
-
-static void prism2_plx_genesis_reset(local_info_t *local, int hcr)
-{
-	unsigned char corsave;
-	struct hostap_plx_priv *hw_priv = local->hw_priv;
-
-	if (hw_priv->attr_mem == NULL) {
-		/* TMD7160 - COR at card's first I/O addr */
-		corsave = inb(hw_priv->cor_offset);
-		outb(corsave | COR_SRESET, hw_priv->cor_offset);
-		mdelay(10);
-		outb(hcr, hw_priv->cor_offset + 2);
-		mdelay(10);
-		outb(corsave & ~COR_SRESET, hw_priv->cor_offset);
-		mdelay(10);
-	} else {
-		/* PLX9052 */
-		corsave = readb(hw_priv->attr_mem + hw_priv->cor_offset);
-		writeb(corsave | COR_SRESET,
-		       hw_priv->attr_mem + hw_priv->cor_offset);
-		mdelay(10);
-		writeb(hcr, hw_priv->attr_mem + hw_priv->cor_offset + 2);
-		mdelay(10);
-		writeb(corsave & ~COR_SRESET,
-		       hw_priv->attr_mem + hw_priv->cor_offset);
-		mdelay(10);
-	}
-}
-
-
-static struct prism2_helper_functions prism2_plx_funcs =
-{
-	.card_present	= NULL,
-	.cor_sreset	= prism2_plx_cor_sreset,
-	.dev_open	= NULL,
-	.dev_close	= NULL,
-	.genesis_reset	= prism2_plx_genesis_reset,
-	.hw_type	= HOSTAP_HW_PLX,
-};
-
-
-static int prism2_plx_check_cis(void __iomem *attr_mem, int attr_len,
-				unsigned int *cor_offset,
-				unsigned int *cor_index)
-{
-#define CISTPL_CONFIG 0x1A
-#define CISTPL_MANFID 0x20
-#define CISTPL_END 0xFF
-#define CIS_MAX_LEN 256
-	u8 *cis;
-	int i, pos;
-	unsigned int rmsz, rasz, manfid1, manfid2;
-	struct prism2_plx_manfid *manfid;
-
-	cis = kmalloc(CIS_MAX_LEN, GFP_KERNEL);
-	if (cis == NULL)
-		return -ENOMEM;
-
-	/* read CIS; it is in even offsets in the beginning of attr_mem */
-	for (i = 0; i < CIS_MAX_LEN; i++)
-		cis[i] = readb(attr_mem + 2 * i);
-	printk(KERN_DEBUG "%s: CIS: %02x %02x %02x %02x %02x %02x ...\n",
-	       dev_info, cis[0], cis[1], cis[2], cis[3], cis[4], cis[5]);
-
-	/* set reasonable defaults for Prism2 cards just in case CIS parsing
-	 * fails */
-	*cor_offset = 0x3e0;
-	*cor_index = 0x01;
-	manfid1 = manfid2 = 0;
-
-	pos = 0;
-	while (pos < CIS_MAX_LEN - 1 && cis[pos] != CISTPL_END) {
-		if (pos + cis[pos + 1] >= CIS_MAX_LEN)
-			goto cis_error;
-
-		switch (cis[pos]) {
-		case CISTPL_CONFIG:
-			if (cis[pos + 1] < 1)
-				goto cis_error;
-			rmsz = (cis[pos + 2] & 0x3c) >> 2;
-			rasz = cis[pos + 2] & 0x03;
-			if (4 + rasz + rmsz > cis[pos + 1])
-				goto cis_error;
-			*cor_index = cis[pos + 3] & 0x3F;
-			*cor_offset = 0;
-			for (i = 0; i <= rasz; i++)
-				*cor_offset += cis[pos + 4 + i] << (8 * i);
-			printk(KERN_DEBUG "%s: cor_index=0x%x "
-			       "cor_offset=0x%x\n", dev_info,
-			       *cor_index, *cor_offset);
-			if (*cor_offset > attr_len) {
-				printk(KERN_ERR "%s: COR offset not within "
-				       "attr_mem\n", dev_info);
-				kfree(cis);
-				return -1;
-			}
-			break;
-
-		case CISTPL_MANFID:
-			if (cis[pos + 1] < 4)
-				goto cis_error;
-			manfid1 = cis[pos + 2] + (cis[pos + 3] << 8);
-			manfid2 = cis[pos + 4] + (cis[pos + 5] << 8);
-			printk(KERN_DEBUG "%s: manfid=0x%04x, 0x%04x\n",
-			       dev_info, manfid1, manfid2);
-			break;
-		}
-
-		pos += cis[pos + 1] + 2;
-	}
-
-	if (pos >= CIS_MAX_LEN || cis[pos] != CISTPL_END)
-		goto cis_error;
-
-	for (manfid = prism2_plx_known_manfids; manfid->manfid1 != 0; manfid++)
-		if (manfid1 == manfid->manfid1 && manfid2 == manfid->manfid2) {
-			kfree(cis);
-			return 0;
-		}
-
-	printk(KERN_INFO "%s: unknown manfid 0x%04x, 0x%04x - assuming this is"
-	       " not supported card\n", dev_info, manfid1, manfid2);
-	goto fail;
-
- cis_error:
-	printk(KERN_WARNING "%s: invalid CIS data\n", dev_info);
-
- fail:
-	kfree(cis);
-	if (ignore_cis) {
-		printk(KERN_INFO "%s: ignore_cis parameter set - ignoring "
-		       "errors during CIS verification\n", dev_info);
-		return 0;
-	}
-	return -1;
-}
-
-
-static int prism2_plx_probe(struct pci_dev *pdev,
-			    const struct pci_device_id *id)
-{
-	unsigned int pccard_ioaddr, plx_ioaddr;
-	unsigned long pccard_attr_mem;
-	unsigned int pccard_attr_len;
-	void __iomem *attr_mem = NULL;
-	unsigned int cor_offset, cor_index;
-	u32 reg;
-	local_info_t *local = NULL;
-	struct net_device *dev = NULL;
-	struct hostap_interface *iface;
-	static int cards_found /* = 0 */;
-	int irq_registered = 0;
-	int tmd7160;
-	struct hostap_plx_priv *hw_priv;
-
-	hw_priv = kmalloc(sizeof(*hw_priv), GFP_KERNEL);
-	if (hw_priv == NULL)
-		return -ENOMEM;
-	memset(hw_priv, 0, sizeof(*hw_priv));
-
-	if (pci_enable_device(pdev))
-		return -EIO;
-
-	/* National Datacomm NCP130 based on TMD7160, not PLX9052. */
-	tmd7160 = (pdev->vendor == 0x15e8) && (pdev->device == 0x0131);
-
-	plx_ioaddr = pci_resource_start(pdev, 1);
-	pccard_ioaddr = pci_resource_start(pdev, tmd7160 ? 2 : 3);
-
-	if (tmd7160) {
-		/* TMD7160 */
-		attr_mem = NULL; /* no access to PC Card attribute memory */
-
-		printk(KERN_INFO "TMD7160 PCI/PCMCIA adapter: io=0x%x, "
-		       "irq=%d, pccard_io=0x%x\n",
-		       plx_ioaddr, pdev->irq, pccard_ioaddr);
-
-		cor_offset = plx_ioaddr;
-		cor_index = 0x04;
-
-		outb(cor_index | COR_LEVLREQ | COR_ENABLE_FUNC, plx_ioaddr);
-		mdelay(1);
-		reg = inb(plx_ioaddr);
-		if (reg != (cor_index | COR_LEVLREQ | COR_ENABLE_FUNC)) {
-			printk(KERN_ERR "%s: Error setting COR (expected="
-			       "0x%02x, was=0x%02x)\n", dev_info,
-			       cor_index | COR_LEVLREQ | COR_ENABLE_FUNC, reg);
-			goto fail;
-		}
-	} else {
-		/* PLX9052 */
-		pccard_attr_mem = pci_resource_start(pdev, 2);
-		pccard_attr_len = pci_resource_len(pdev, 2);
-		if (pccard_attr_len < PLX_MIN_ATTR_LEN)
-			goto fail;
-
-
-		attr_mem = ioremap(pccard_attr_mem, pccard_attr_len);
-		if (attr_mem == NULL) {
-			printk(KERN_ERR "%s: cannot remap attr_mem\n",
-			       dev_info);
-			goto fail;
-		}
-
-		printk(KERN_INFO "PLX9052 PCI/PCMCIA adapter: "
-		       "mem=0x%lx, plx_io=0x%x, irq=%d, pccard_io=0x%x\n",
-		       pccard_attr_mem, plx_ioaddr, pdev->irq, pccard_ioaddr);
-
-		if (prism2_plx_check_cis(attr_mem, pccard_attr_len,
-					 &cor_offset, &cor_index)) {
-			printk(KERN_INFO "Unknown PC Card CIS - not a "
-			       "Prism2/2.5 card?\n");
-			goto fail;
-		}
-
-		printk(KERN_DEBUG "Prism2/2.5 PC Card detected in PLX9052 "
-		       "adapter\n");
-
-		/* Write COR to enable PC Card */
-		writeb(cor_index | COR_LEVLREQ | COR_ENABLE_FUNC,
-		       attr_mem + cor_offset);
-
-		/* Enable PCI interrupts if they are not already enabled */
-		reg = inl(plx_ioaddr + PLX_INTCSR);
-		printk(KERN_DEBUG "PLX_INTCSR=0x%x\n", reg);
-		if (!(reg & PLX_INTCSR_PCI_INTEN)) {
-			outl(reg | PLX_INTCSR_PCI_INTEN,
-			     plx_ioaddr + PLX_INTCSR);
-			if (!(inl(plx_ioaddr + PLX_INTCSR) &
-			      PLX_INTCSR_PCI_INTEN)) {
-				printk(KERN_WARNING "%s: Could not enable "
-				       "Local Interrupts\n", dev_info);
-				goto fail;
-			}
-		}
-
-		reg = inl(plx_ioaddr + PLX_CNTRL);
-		printk(KERN_DEBUG "PLX_CNTRL=0x%x (Serial EEPROM "
-		       "present=%d)\n",
-		       reg, (reg & PLX_CNTRL_SERIAL_EEPROM_PRESENT) != 0);
-		/* should set PLX_PCIIPR to 0x01 (INTA#) if Serial EEPROM is
-		 * not present; but are there really such cards in use(?) */
-	}
-
-	dev = prism2_init_local_data(&prism2_plx_funcs, cards_found,
-				     &pdev->dev);
-	if (dev == NULL)
-		goto fail;
-	iface = netdev_priv(dev);
-	local = iface->local;
-	local->hw_priv = hw_priv;
-	cards_found++;
-
-	dev->irq = pdev->irq;
-	dev->base_addr = pccard_ioaddr;
-	hw_priv->attr_mem = attr_mem;
-	hw_priv->cor_offset = cor_offset;
-
-	pci_set_drvdata(pdev, dev);
-
-	if (request_irq(dev->irq, prism2_interrupt, SA_SHIRQ, dev->name,
-			dev)) {
-		printk(KERN_WARNING "%s: request_irq failed\n", dev->name);
-		goto fail;
-	} else
-		irq_registered = 1;
-
-	if (prism2_hw_config(dev, 1)) {
-		printk(KERN_DEBUG "%s: hardware initialization failed\n",
-		       dev_info);
-		goto fail;
-	}
-
-	return hostap_hw_ready(dev);
-
- fail:
-	kfree(hw_priv);
-	if (local)
-		local->hw_priv = NULL;
-	prism2_free_local_data(dev);
-
-	if (irq_registered && dev)
-		free_irq(dev->irq, dev);
-
-	if (attr_mem)
-		iounmap(attr_mem);
-
-	pci_disable_device(pdev);
-
-	return -ENODEV;
-}
-
-
-static void prism2_plx_remove(struct pci_dev *pdev)
-{
-	struct net_device *dev;
-	struct hostap_interface *iface;
-	struct hostap_plx_priv *hw_priv;
-
-	dev = pci_get_drvdata(pdev);
-	iface = netdev_priv(dev);
-	hw_priv = iface->local->hw_priv;
-
-	/* Reset the hardware, and ensure interrupts are disabled. */
-	prism2_plx_cor_sreset(iface->local);
-	hfa384x_disable_interrupts(dev);
-
-	if (hw_priv->attr_mem)
-		iounmap(hw_priv->attr_mem);
-	if (dev->irq)
-		free_irq(dev->irq, dev);
-
-	kfree(iface->local->hw_priv);
-	iface->local->hw_priv = NULL;
-	prism2_free_local_data(dev);
-	pci_disable_device(pdev);
-}
-
-
-MODULE_DEVICE_TABLE(pci, prism2_plx_id_table);
-
-static struct pci_driver prism2_plx_drv_id = {
-	.name		= "prism2_plx",
-	.id_table	= prism2_plx_id_table,
-	.probe		= prism2_plx_probe,
-	.remove		= prism2_plx_remove,
-	.suspend	= NULL,
-	.resume		= NULL,
-	.enable_wake	= NULL
-};
-
-
-static int __init init_prism2_plx(void)
-{
-	printk(KERN_INFO "%s: %s\n", dev_info, version);
-
-	return pci_register_driver(&prism2_plx_drv_id);
-}
-
-
-static void __exit exit_prism2_plx(void)
-{
-	pci_unregister_driver(&prism2_plx_drv_id);
-	printk(KERN_INFO "%s: Driver unloaded\n", dev_info);
-}
-
-
-module_init(init_prism2_plx);
-module_exit(exit_prism2_plx);
diff --git a/trunk/drivers/net/wireless/hostap/hostap_proc.c b/trunk/drivers/net/wireless/hostap/hostap_proc.c
deleted file mode 100644
index a0a4cbd4937a..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_proc.c
+++ /dev/null
@@ -1,448 +0,0 @@
-/* /proc routines for Host AP driver */
-
-#define PROC_LIMIT (PAGE_SIZE - 80)
-
-
-#ifndef PRISM2_NO_PROCFS_DEBUG
-static int prism2_debug_proc_read(char *page, char **start, off_t off,
-				  int count, int *eof, void *data)
-{
-	char *p = page;
-	local_info_t *local = (local_info_t *) data;
-	int i;
-
-	if (off != 0) {
-		*eof = 1;
-		return 0;
-	}
-
-	p += sprintf(p, "next_txfid=%d next_alloc=%d\n",
-		     local->next_txfid, local->next_alloc);
-	for (i = 0; i < PRISM2_TXFID_COUNT; i++)
-		p += sprintf(p, "FID: tx=%04X intransmit=%04X\n",
-			     local->txfid[i], local->intransmitfid[i]);
-	p += sprintf(p, "FW TX rate control: %d\n", local->fw_tx_rate_control);
-	p += sprintf(p, "beacon_int=%d\n", local->beacon_int);
-	p += sprintf(p, "dtim_period=%d\n", local->dtim_period);
-	p += sprintf(p, "wds_max_connections=%d\n",
-		     local->wds_max_connections);
-	p += sprintf(p, "dev_enabled=%d\n", local->dev_enabled);
-	p += sprintf(p, "sw_tick_stuck=%d\n", local->sw_tick_stuck);
-	for (i = 0; i < WEP_KEYS; i++) {
-		if (local->crypt[i] && local->crypt[i]->ops) {
-			p += sprintf(p, "crypt[%d]=%s\n",
-				     i, local->crypt[i]->ops->name);
-		}
-	}
-	p += sprintf(p, "pri_only=%d\n", local->pri_only);
-	p += sprintf(p, "pci=%d\n", local->func->hw_type == HOSTAP_HW_PCI);
-	p += sprintf(p, "sram_type=%d\n", local->sram_type);
-	p += sprintf(p, "no_pri=%d\n", local->no_pri);
-
-	return (p - page);
-}
-#endif /* PRISM2_NO_PROCFS_DEBUG */
-
-
-static int prism2_stats_proc_read(char *page, char **start, off_t off,
-				  int count, int *eof, void *data)
-{
-	char *p = page;
-	local_info_t *local = (local_info_t *) data;
-	struct comm_tallies_sums *sums = (struct comm_tallies_sums *)
-		&local->comm_tallies;
-
-	if (off != 0) {
-		*eof = 1;
-		return 0;
-	}
-
-	p += sprintf(p, "TxUnicastFrames=%u\n", sums->tx_unicast_frames);
-	p += sprintf(p, "TxMulticastframes=%u\n", sums->tx_multicast_frames);
-	p += sprintf(p, "TxFragments=%u\n", sums->tx_fragments);
-	p += sprintf(p, "TxUnicastOctets=%u\n", sums->tx_unicast_octets);
-	p += sprintf(p, "TxMulticastOctets=%u\n", sums->tx_multicast_octets);
-	p += sprintf(p, "TxDeferredTransmissions=%u\n",
-		     sums->tx_deferred_transmissions);
-	p += sprintf(p, "TxSingleRetryFrames=%u\n",
-		     sums->tx_single_retry_frames);
-	p += sprintf(p, "TxMultipleRetryFrames=%u\n",
-		     sums->tx_multiple_retry_frames);
-	p += sprintf(p, "TxRetryLimitExceeded=%u\n",
-		     sums->tx_retry_limit_exceeded);
-	p += sprintf(p, "TxDiscards=%u\n", sums->tx_discards);
-	p += sprintf(p, "RxUnicastFrames=%u\n", sums->rx_unicast_frames);
-	p += sprintf(p, "RxMulticastFrames=%u\n", sums->rx_multicast_frames);
-	p += sprintf(p, "RxFragments=%u\n", sums->rx_fragments);
-	p += sprintf(p, "RxUnicastOctets=%u\n", sums->rx_unicast_octets);
-	p += sprintf(p, "RxMulticastOctets=%u\n", sums->rx_multicast_octets);
-	p += sprintf(p, "RxFCSErrors=%u\n", sums->rx_fcs_errors);
-	p += sprintf(p, "RxDiscardsNoBuffer=%u\n",
-		     sums->rx_discards_no_buffer);
-	p += sprintf(p, "TxDiscardsWrongSA=%u\n", sums->tx_discards_wrong_sa);
-	p += sprintf(p, "RxDiscardsWEPUndecryptable=%u\n",
-		     sums->rx_discards_wep_undecryptable);
-	p += sprintf(p, "RxMessageInMsgFragments=%u\n",
-		     sums->rx_message_in_msg_fragments);
-	p += sprintf(p, "RxMessageInBadMsgFragments=%u\n",
-		     sums->rx_message_in_bad_msg_fragments);
-	/* FIX: this may grow too long for one page(?) */
-
-	return (p - page);
-}
-
-
-static int prism2_wds_proc_read(char *page, char **start, off_t off,
-				int count, int *eof, void *data)
-{
-	char *p = page;
-	local_info_t *local = (local_info_t *) data;
-	struct list_head *ptr;
-	struct hostap_interface *iface;
-
-	if (off > PROC_LIMIT) {
-		*eof = 1;
-		return 0;
-	}
-
-	read_lock_bh(&local->iface_lock);
-	list_for_each(ptr, &local->hostap_interfaces) {
-		iface = list_entry(ptr, struct hostap_interface, list);
-		if (iface->type != HOSTAP_INTERFACE_WDS)
-			continue;
-		p += sprintf(p, "%s\t" MACSTR "\n",
-			     iface->dev->name,
-			     MAC2STR(iface->u.wds.remote_addr));
-		if ((p - page) > PROC_LIMIT) {
-			printk(KERN_DEBUG "%s: wds proc did not fit\n",
-			       local->dev->name);
-			break;
-		}
-	}
-	read_unlock_bh(&local->iface_lock);
-
-	if ((p - page) <= off) {
-		*eof = 1;
-		return 0;
-	}
-
-	*start = page + off;
-
-	return (p - page - off);
-}
-
-
-static int prism2_bss_list_proc_read(char *page, char **start, off_t off,
-				     int count, int *eof, void *data)
-{
-	char *p = page;
-	local_info_t *local = (local_info_t *) data;
-	struct list_head *ptr;
-	struct hostap_bss_info *bss;
-	int i;
-
-	if (off > PROC_LIMIT) {
-		*eof = 1;
-		return 0;
-	}
-
-	p += sprintf(p, "#BSSID\tlast_update\tcount\tcapab_info\tSSID(txt)\t"
-		     "SSID(hex)\tWPA IE\n");
-	spin_lock_bh(&local->lock);
-	list_for_each(ptr, &local->bss_list) {
-		bss = list_entry(ptr, struct hostap_bss_info, list);
-		p += sprintf(p, MACSTR "\t%lu\t%u\t0x%x\t",
-			     MAC2STR(bss->bssid), bss->last_update,
-			     bss->count, bss->capab_info);
-		for (i = 0; i < bss->ssid_len; i++) {
-			p += sprintf(p, "%c",
-				     bss->ssid[i] >= 32 && bss->ssid[i] < 127 ?
-				     bss->ssid[i] : '_');
-		}
-		p += sprintf(p, "\t");
-		for (i = 0; i < bss->ssid_len; i++) {
-			p += sprintf(p, "%02x", bss->ssid[i]);
-		}
-		p += sprintf(p, "\t");
-		for (i = 0; i < bss->wpa_ie_len; i++) {
-			p += sprintf(p, "%02x", bss->wpa_ie[i]);
-		}
-		p += sprintf(p, "\n");
-		if ((p - page) > PROC_LIMIT) {
-			printk(KERN_DEBUG "%s: BSS proc did not fit\n",
-			       local->dev->name);
-			break;
-		}
-	}
-	spin_unlock_bh(&local->lock);
-
-	if ((p - page) <= off) {
-		*eof = 1;
-		return 0;
-	}
-
-	*start = page + off;
-
-	return (p - page - off);
-}
-
-
-static int prism2_crypt_proc_read(char *page, char **start, off_t off,
-				  int count, int *eof, void *data)
-{
-	char *p = page;
-	local_info_t *local = (local_info_t *) data;
-	int i;
-
-	if (off > PROC_LIMIT) {
-		*eof = 1;
-		return 0;
-	}
-
-	p += sprintf(p, "tx_keyidx=%d\n", local->tx_keyidx);
-	for (i = 0; i < WEP_KEYS; i++) {
-		if (local->crypt[i] && local->crypt[i]->ops &&
-		    local->crypt[i]->ops->print_stats) {
-			p = local->crypt[i]->ops->print_stats(
-				p, local->crypt[i]->priv);
-		}
-	}
-
-	if ((p - page) <= off) {
-		*eof = 1;
-		return 0;
-	}
-
-	*start = page + off;
-
-	return (p - page - off);
-}
-
-
-static int prism2_pda_proc_read(char *page, char **start, off_t off,
-				int count, int *eof, void *data)
-{
-	local_info_t *local = (local_info_t *) data;
-
-	if (local->pda == NULL || off >= PRISM2_PDA_SIZE) {
-		*eof = 1;
-		return 0;
-	}
-
-	if (off + count > PRISM2_PDA_SIZE)
-		count = PRISM2_PDA_SIZE - off;
-
-	memcpy(page, local->pda + off, count);
-	return count;
-}
-
-
-static int prism2_aux_dump_proc_read(char *page, char **start, off_t off,
-				     int count, int *eof, void *data)
-{
-	local_info_t *local = (local_info_t *) data;
-
-	if (local->func->read_aux == NULL) {
-		*eof = 1;
-		return 0;
-	}
-
-	if (local->func->read_aux(local->dev, off, count, page)) {
-		*eof = 1;
-		return 0;
-	}
-	*start = page;
-
-	return count;
-}
-
-
-#ifdef PRISM2_IO_DEBUG
-static int prism2_io_debug_proc_read(char *page, char **start, off_t off,
-				     int count, int *eof, void *data)
-{
-	local_info_t *local = (local_info_t *) data;
-	int head = local->io_debug_head;
-	int start_bytes, left, copy, copied;
-
-	if (off + count > PRISM2_IO_DEBUG_SIZE * 4) {
-		*eof = 1;
-		if (off >= PRISM2_IO_DEBUG_SIZE * 4)
-			return 0;
-		count = PRISM2_IO_DEBUG_SIZE * 4 - off;
-	}
-
-	copied = 0;
-	start_bytes = (PRISM2_IO_DEBUG_SIZE - head) * 4;
-	left = count;
-
-	if (off < start_bytes) {
-		copy = start_bytes - off;
-		if (copy > count)
-			copy = count;
-		memcpy(page, ((u8 *) &local->io_debug[head]) + off, copy);
-		left -= copy;
-		if (left > 0)
-			memcpy(&page[copy], local->io_debug, left);
-	} else {
-		memcpy(page, ((u8 *) local->io_debug) + (off - start_bytes),
-		       left);
-	}
-
-	*start = page;
-
-	return count;
-}
-#endif /* PRISM2_IO_DEBUG */
-
-
-#ifndef PRISM2_NO_STATION_MODES
-static int prism2_scan_results_proc_read(char *page, char **start, off_t off,
-					 int count, int *eof, void *data)
-{
-	char *p = page;
-	local_info_t *local = (local_info_t *) data;
-	int entry, i, len, total = 0;
-	struct hfa384x_hostscan_result *scanres;
-	u8 *pos;
-
-	p += sprintf(p, "CHID ANL SL BcnInt Capab Rate BSSID ATIM SupRates "
-		     "SSID\n");
-
-	spin_lock_bh(&local->lock);
-	for (entry = 0; entry < local->last_scan_results_count; entry++) {
-		scanres = &local->last_scan_results[entry];
-
-		if (total + (p - page) <= off) {
-			total += p - page;
-			p = page;
-		}
-		if (total + (p - page) > off + count)
-			break;
-		if ((p - page) > (PAGE_SIZE - 200))
-			break;
-
-		p += sprintf(p, "%d %d %d %d 0x%02x %d " MACSTR " %d ",
-			     le16_to_cpu(scanres->chid),
-			     (s16) le16_to_cpu(scanres->anl),
-			     (s16) le16_to_cpu(scanres->sl),
-			     le16_to_cpu(scanres->beacon_interval),
-			     le16_to_cpu(scanres->capability),
-			     le16_to_cpu(scanres->rate),
-			     MAC2STR(scanres->bssid),
-			     le16_to_cpu(scanres->atim));
-
-		pos = scanres->sup_rates;
-		for (i = 0; i < sizeof(scanres->sup_rates); i++) {
-			if (pos[i] == 0)
-				break;
-			p += sprintf(p, "<%02x>", pos[i]);
-		}
-		p += sprintf(p, " ");
-
-		pos = scanres->ssid;
-		len = le16_to_cpu(scanres->ssid_len);
-		if (len > 32)
-			len = 32;
-		for (i = 0; i < len; i++) {
-			unsigned char c = pos[i];
-			if (c >= 32 && c < 127)
-				p += sprintf(p, "%c", c);
-			else
-				p += sprintf(p, "<%02x>", c);
-		}
-		p += sprintf(p, "\n");
-	}
-	spin_unlock_bh(&local->lock);
-
-	total += (p - page);
-	if (total >= off + count)
-		*eof = 1;
-
-	if (total < off) {
-		*eof = 1;
-		return 0;
-	}
-
-	len = total - off;
-	if (len > (p - page))
-		len = p - page;
-	*start = p - len;
-	if (len > count)
-		len = count;
-
-	return len;
-}
-#endif /* PRISM2_NO_STATION_MODES */
-
-
-void hostap_init_proc(local_info_t *local)
-{
-	local->proc = NULL;
-
-	if (hostap_proc == NULL) {
-		printk(KERN_WARNING "%s: hostap proc directory not created\n",
-		       local->dev->name);
-		return;
-	}
-
-	local->proc = proc_mkdir(local->ddev->name, hostap_proc);
-	if (local->proc == NULL) {
-		printk(KERN_INFO "/proc/net/hostap/%s creation failed\n",
-		       local->ddev->name);
-		return;
-	}
-
-#ifndef PRISM2_NO_PROCFS_DEBUG
-	create_proc_read_entry("debug", 0, local->proc,
-			       prism2_debug_proc_read, local);
-#endif /* PRISM2_NO_PROCFS_DEBUG */
-	create_proc_read_entry("stats", 0, local->proc,
-			       prism2_stats_proc_read, local);
-	create_proc_read_entry("wds", 0, local->proc,
-			       prism2_wds_proc_read, local);
-	create_proc_read_entry("pda", 0, local->proc,
-			       prism2_pda_proc_read, local);
-	create_proc_read_entry("aux_dump", 0, local->proc,
-			       prism2_aux_dump_proc_read, local);
-	create_proc_read_entry("bss_list", 0, local->proc,
-			       prism2_bss_list_proc_read, local);
-	create_proc_read_entry("crypt", 0, local->proc,
-			       prism2_crypt_proc_read, local);
-#ifdef PRISM2_IO_DEBUG
-	create_proc_read_entry("io_debug", 0, local->proc,
-			       prism2_io_debug_proc_read, local);
-#endif /* PRISM2_IO_DEBUG */
-#ifndef PRISM2_NO_STATION_MODES
-	create_proc_read_entry("scan_results", 0, local->proc,
-			       prism2_scan_results_proc_read, local);
-#endif /* PRISM2_NO_STATION_MODES */
-}
-
-
-void hostap_remove_proc(local_info_t *local)
-{
-	if (local->proc != NULL) {
-#ifndef PRISM2_NO_STATION_MODES
-		remove_proc_entry("scan_results", local->proc);
-#endif /* PRISM2_NO_STATION_MODES */
-#ifdef PRISM2_IO_DEBUG
-		remove_proc_entry("io_debug", local->proc);
-#endif /* PRISM2_IO_DEBUG */
-		remove_proc_entry("pda", local->proc);
-		remove_proc_entry("aux_dump", local->proc);
-		remove_proc_entry("wds", local->proc);
-		remove_proc_entry("stats", local->proc);
-		remove_proc_entry("bss_list", local->proc);
-		remove_proc_entry("crypt", local->proc);
-#ifndef PRISM2_NO_PROCFS_DEBUG
-		remove_proc_entry("debug", local->proc);
-#endif /* PRISM2_NO_PROCFS_DEBUG */
-		if (hostap_proc != NULL)
-			remove_proc_entry(local->proc->name, hostap_proc);
-	}
-}
-
-
-EXPORT_SYMBOL(hostap_init_proc);
-EXPORT_SYMBOL(hostap_remove_proc);
diff --git a/trunk/drivers/net/wireless/hostap/hostap_wlan.h b/trunk/drivers/net/wireless/hostap/hostap_wlan.h
deleted file mode 100644
index cc061e1560d3..000000000000
--- a/trunk/drivers/net/wireless/hostap/hostap_wlan.h
+++ /dev/null
@@ -1,1033 +0,0 @@
-#ifndef HOSTAP_WLAN_H
-#define HOSTAP_WLAN_H
-
-#include "hostap_config.h"
-#include "hostap_common.h"
-
-#define MAX_PARM_DEVICES 8
-#define PARM_MIN_MAX "1-" __MODULE_STRING(MAX_PARM_DEVICES)
-#define DEF_INTS -1, -1, -1, -1, -1, -1, -1
-#define GET_INT_PARM(var,idx) var[var[idx] < 0 ? 0 : idx]
-
-
-/* Specific skb->protocol value that indicates that the packet already contains
- * txdesc header.
- * FIX: This might need own value that would be allocated especially for Prism2
- * txdesc; ETH_P_CONTROL is commented as "Card specific control frames".
- * However, these skb's should have only minimal path in the kernel side since
- * prism2_send_mgmt() sends these with dev_queue_xmit() to prism2_tx(). */
-#define ETH_P_HOSTAP ETH_P_CONTROL
-
-/* ARPHRD_IEEE80211_PRISM uses a bloated version of Prism2 RX frame header
- * (from linux-wlan-ng) */
-struct linux_wlan_ng_val {
-	u32 did;
-	u16 status, len;
-	u32 data;
-} __attribute__ ((packed));
-
-struct linux_wlan_ng_prism_hdr {
-	u32 msgcode, msglen;
-	char devname[16];
-	struct linux_wlan_ng_val hosttime, mactime, channel, rssi, sq, signal,
-		noise, rate, istx, frmlen;
-} __attribute__ ((packed));
-
-struct linux_wlan_ng_cap_hdr {
-	u32 version;
-	u32 length;
-	u64 mactime;
-	u64 hosttime;
-	u32 phytype;
-	u32 channel;
-	u32 datarate;
-	u32 antenna;
-	u32 priority;
-	u32 ssi_type;
-	s32 ssi_signal;
-	s32 ssi_noise;
-	u32 preamble;
-	u32 encoding;
-} __attribute__ ((packed));
-
-#define LWNG_CAP_DID_BASE   (4 | (1 << 6)) /* section 4, group 1 */
-#define LWNG_CAPHDR_VERSION 0x80211001
-
-struct hfa384x_rx_frame {
-	/* HFA384X RX frame descriptor */
-	u16 status; /* HFA384X_RX_STATUS_ flags */
-	u32 time; /* timestamp, 1 microsecond resolution */
-	u8 silence; /* 27 .. 154; seems to be 0 */
-	u8 signal; /* 27 .. 154 */
-	u8 rate; /* 10, 20, 55, or 110 */
-	u8 rxflow;
-	u32 reserved;
-
-	/* 802.11 */
-	u16 frame_control;
-	u16 duration_id;
-	u8 addr1[6];
-	u8 addr2[6];
-	u8 addr3[6];
-	u16 seq_ctrl;
-	u8 addr4[6];
-	u16 data_len;
-
-	/* 802.3 */
-	u8 dst_addr[6];
-	u8 src_addr[6];
-	u16 len;
-
-	/* followed by frame data; max 2304 bytes */
-} __attribute__ ((packed));
-
-
-struct hfa384x_tx_frame {
-	/* HFA384X TX frame descriptor */
-	u16 status; /* HFA384X_TX_STATUS_ flags */
-	u16 reserved1;
-	u16 reserved2;
-	u32 sw_support;
-	u8 retry_count; /* not yet implemented */
-	u8 tx_rate; /* Host AP only; 0 = firmware, or 10, 20, 55, 110 */
-	u16 tx_control; /* HFA384X_TX_CTRL_ flags */
-
-	/* 802.11 */
-	u16 frame_control; /* parts not used */
-	u16 duration_id;
-	u8 addr1[6];
-	u8 addr2[6]; /* filled by firmware */
-	u8 addr3[6];
-	u16 seq_ctrl; /* filled by firmware */
-	u8 addr4[6];
-	u16 data_len;
-
-	/* 802.3 */
-	u8 dst_addr[6];
-	u8 src_addr[6];
-	u16 len;
-
-	/* followed by frame data; max 2304 bytes */
-} __attribute__ ((packed));
-
-
-struct hfa384x_rid_hdr
-{
-	u16 len;
-	u16 rid;
-} __attribute__ ((packed));
-
-
-/* Macro for converting signal levels (range 27 .. 154) to wireless ext
- * dBm value with some accuracy */
-#define HFA384X_LEVEL_TO_dBm(v) 0x100 + (v) * 100 / 255 - 100
-
-#define HFA384X_LEVEL_TO_dBm_sign(v) (v) * 100 / 255 - 100
-
-struct hfa384x_scan_request {
-	u16 channel_list;
-	u16 txrate; /* HFA384X_RATES_* */
-} __attribute__ ((packed));
-
-struct hfa384x_hostscan_request {
-	u16 channel_list;
-	u16 txrate;
-	u16 target_ssid_len;
-	u8 target_ssid[32];
-} __attribute__ ((packed));
-
-struct hfa384x_join_request {
-	u8 bssid[6];
-	u16 channel;
-} __attribute__ ((packed));
-
-struct hfa384x_info_frame {
-	u16 len;
-	u16 type;
-} __attribute__ ((packed));
-
-struct hfa384x_comm_tallies {
-	u16 tx_unicast_frames;
-	u16 tx_multicast_frames;
-	u16 tx_fragments;
-	u16 tx_unicast_octets;
-	u16 tx_multicast_octets;
-	u16 tx_deferred_transmissions;
-	u16 tx_single_retry_frames;
-	u16 tx_multiple_retry_frames;
-	u16 tx_retry_limit_exceeded;
-	u16 tx_discards;
-	u16 rx_unicast_frames;
-	u16 rx_multicast_frames;
-	u16 rx_fragments;
-	u16 rx_unicast_octets;
-	u16 rx_multicast_octets;
-	u16 rx_fcs_errors;
-	u16 rx_discards_no_buffer;
-	u16 tx_discards_wrong_sa;
-	u16 rx_discards_wep_undecryptable;
-	u16 rx_message_in_msg_fragments;
-	u16 rx_message_in_bad_msg_fragments;
-} __attribute__ ((packed));
-
-struct hfa384x_comm_tallies32 {
-	u32 tx_unicast_frames;
-	u32 tx_multicast_frames;
-	u32 tx_fragments;
-	u32 tx_unicast_octets;
-	u32 tx_multicast_octets;
-	u32 tx_deferred_transmissions;
-	u32 tx_single_retry_frames;
-	u32 tx_multiple_retry_frames;
-	u32 tx_retry_limit_exceeded;
-	u32 tx_discards;
-	u32 rx_unicast_frames;
-	u32 rx_multicast_frames;
-	u32 rx_fragments;
-	u32 rx_unicast_octets;
-	u32 rx_multicast_octets;
-	u32 rx_fcs_errors;
-	u32 rx_discards_no_buffer;
-	u32 tx_discards_wrong_sa;
-	u32 rx_discards_wep_undecryptable;
-	u32 rx_message_in_msg_fragments;
-	u32 rx_message_in_bad_msg_fragments;
-} __attribute__ ((packed));
-
-struct hfa384x_scan_result_hdr {
-	u16 reserved;
-	u16 scan_reason;
-#define HFA384X_SCAN_IN_PROGRESS 0 /* no results available yet */
-#define HFA384X_SCAN_HOST_INITIATED 1
-#define HFA384X_SCAN_FIRMWARE_INITIATED 2
-#define HFA384X_SCAN_INQUIRY_FROM_HOST 3
-} __attribute__ ((packed));
-
-#define HFA384X_SCAN_MAX_RESULTS 32
-
-struct hfa384x_scan_result {
-	u16 chid;
-	u16 anl;
-	u16 sl;
-	u8 bssid[6];
-	u16 beacon_interval;
-	u16 capability;
-	u16 ssid_len;
-	u8 ssid[32];
-	u8 sup_rates[10];
-	u16 rate;
-} __attribute__ ((packed));
-
-struct hfa384x_hostscan_result {
-	u16 chid;
-	u16 anl;
-	u16 sl;
-	u8 bssid[6];
-	u16 beacon_interval;
-	u16 capability;
-	u16 ssid_len;
-	u8 ssid[32];
-	u8 sup_rates[10];
-	u16 rate;
-	u16 atim;
-} __attribute__ ((packed));
-
-struct comm_tallies_sums {
-	unsigned int tx_unicast_frames;
-	unsigned int tx_multicast_frames;
-	unsigned int tx_fragments;
-	unsigned int tx_unicast_octets;
-	unsigned int tx_multicast_octets;
-	unsigned int tx_deferred_transmissions;
-	unsigned int tx_single_retry_frames;
-	unsigned int tx_multiple_retry_frames;
-	unsigned int tx_retry_limit_exceeded;
-	unsigned int tx_discards;
-	unsigned int rx_unicast_frames;
-	unsigned int rx_multicast_frames;
-	unsigned int rx_fragments;
-	unsigned int rx_unicast_octets;
-	unsigned int rx_multicast_octets;
-	unsigned int rx_fcs_errors;
-	unsigned int rx_discards_no_buffer;
-	unsigned int tx_discards_wrong_sa;
-	unsigned int rx_discards_wep_undecryptable;
-	unsigned int rx_message_in_msg_fragments;
-	unsigned int rx_message_in_bad_msg_fragments;
-};
-
-
-struct hfa384x_regs {
-	u16 cmd;
-	u16 evstat;
-	u16 offset0;
-	u16 offset1;
-	u16 swsupport0;
-};
-
-
-#if defined(PRISM2_PCCARD) || defined(PRISM2_PLX)
-/* I/O ports for HFA384X Controller access */
-#define HFA384X_CMD_OFF 0x00
-#define HFA384X_PARAM0_OFF 0x02
-#define HFA384X_PARAM1_OFF 0x04
-#define HFA384X_PARAM2_OFF 0x06
-#define HFA384X_STATUS_OFF 0x08
-#define HFA384X_RESP0_OFF 0x0A
-#define HFA384X_RESP1_OFF 0x0C
-#define HFA384X_RESP2_OFF 0x0E
-#define HFA384X_INFOFID_OFF 0x10
-#define HFA384X_CONTROL_OFF 0x14
-#define HFA384X_SELECT0_OFF 0x18
-#define HFA384X_SELECT1_OFF 0x1A
-#define HFA384X_OFFSET0_OFF 0x1C
-#define HFA384X_OFFSET1_OFF 0x1E
-#define HFA384X_RXFID_OFF 0x20
-#define HFA384X_ALLOCFID_OFF 0x22
-#define HFA384X_TXCOMPLFID_OFF 0x24
-#define HFA384X_SWSUPPORT0_OFF 0x28
-#define HFA384X_SWSUPPORT1_OFF 0x2A
-#define HFA384X_SWSUPPORT2_OFF 0x2C
-#define HFA384X_EVSTAT_OFF 0x30
-#define HFA384X_INTEN_OFF 0x32
-#define HFA384X_EVACK_OFF 0x34
-#define HFA384X_DATA0_OFF 0x36
-#define HFA384X_DATA1_OFF 0x38
-#define HFA384X_AUXPAGE_OFF 0x3A
-#define HFA384X_AUXOFFSET_OFF 0x3C
-#define HFA384X_AUXDATA_OFF 0x3E
-#endif /* PRISM2_PCCARD || PRISM2_PLX */
-
-#ifdef PRISM2_PCI
-/* Memory addresses for ISL3874 controller access */
-#define HFA384X_CMD_OFF 0x00
-#define HFA384X_PARAM0_OFF 0x04
-#define HFA384X_PARAM1_OFF 0x08
-#define HFA384X_PARAM2_OFF 0x0C
-#define HFA384X_STATUS_OFF 0x10
-#define HFA384X_RESP0_OFF 0x14
-#define HFA384X_RESP1_OFF 0x18
-#define HFA384X_RESP2_OFF 0x1C
-#define HFA384X_INFOFID_OFF 0x20
-#define HFA384X_CONTROL_OFF 0x28
-#define HFA384X_SELECT0_OFF 0x30
-#define HFA384X_SELECT1_OFF 0x34
-#define HFA384X_OFFSET0_OFF 0x38
-#define HFA384X_OFFSET1_OFF 0x3C
-#define HFA384X_RXFID_OFF 0x40
-#define HFA384X_ALLOCFID_OFF 0x44
-#define HFA384X_TXCOMPLFID_OFF 0x48
-#define HFA384X_PCICOR_OFF 0x4C
-#define HFA384X_SWSUPPORT0_OFF 0x50
-#define HFA384X_SWSUPPORT1_OFF 0x54
-#define HFA384X_SWSUPPORT2_OFF 0x58
-#define HFA384X_PCIHCR_OFF 0x5C
-#define HFA384X_EVSTAT_OFF 0x60
-#define HFA384X_INTEN_OFF 0x64
-#define HFA384X_EVACK_OFF 0x68
-#define HFA384X_DATA0_OFF 0x6C
-#define HFA384X_DATA1_OFF 0x70
-#define HFA384X_AUXPAGE_OFF 0x74
-#define HFA384X_AUXOFFSET_OFF 0x78
-#define HFA384X_AUXDATA_OFF 0x7C
-#define HFA384X_PCI_M0_ADDRH_OFF 0x80
-#define HFA384X_PCI_M0_ADDRL_OFF 0x84
-#define HFA384X_PCI_M0_LEN_OFF 0x88
-#define HFA384X_PCI_M0_CTL_OFF 0x8C
-#define HFA384X_PCI_STATUS_OFF 0x98
-#define HFA384X_PCI_M1_ADDRH_OFF 0xA0
-#define HFA384X_PCI_M1_ADDRL_OFF 0xA4
-#define HFA384X_PCI_M1_LEN_OFF 0xA8
-#define HFA384X_PCI_M1_CTL_OFF 0xAC
-
-/* PCI bus master control bits (these are undocumented; based on guessing and
- * experimenting..) */
-#define HFA384X_PCI_CTL_FROM_BAP (BIT(5) | BIT(1) | BIT(0))
-#define HFA384X_PCI_CTL_TO_BAP (BIT(5) | BIT(0))
-
-#endif /* PRISM2_PCI */
-
-
-/* Command codes for CMD reg. */
-#define HFA384X_CMDCODE_INIT 0x00
-#define HFA384X_CMDCODE_ENABLE 0x01
-#define HFA384X_CMDCODE_DISABLE 0x02
-#define HFA384X_CMDCODE_ALLOC 0x0A
-#define HFA384X_CMDCODE_TRANSMIT 0x0B
-#define HFA384X_CMDCODE_INQUIRE 0x11
-#define HFA384X_CMDCODE_ACCESS 0x21
-#define HFA384X_CMDCODE_ACCESS_WRITE (0x21 | BIT(8))
-#define HFA384X_CMDCODE_DOWNLOAD 0x22
-#define HFA384X_CMDCODE_READMIF 0x30
-#define HFA384X_CMDCODE_WRITEMIF 0x31
-#define HFA384X_CMDCODE_TEST 0x38
-
-#define HFA384X_CMDCODE_MASK 0x3F
-
-/* Test mode operations */
-#define HFA384X_TEST_CHANGE_CHANNEL 0x08
-#define HFA384X_TEST_MONITOR 0x0B
-#define HFA384X_TEST_STOP 0x0F
-#define HFA384X_TEST_CFG_BITS 0x15
-#define HFA384X_TEST_CFG_BIT_ALC BIT(3)
-
-#define HFA384X_CMD_BUSY BIT(15)
-
-#define HFA384X_CMD_TX_RECLAIM BIT(8)
-
-#define HFA384X_OFFSET_ERR BIT(14)
-#define HFA384X_OFFSET_BUSY BIT(15)
-
-
-/* ProgMode for download command */
-#define HFA384X_PROGMODE_DISABLE 0
-#define HFA384X_PROGMODE_ENABLE_VOLATILE 1
-#define HFA384X_PROGMODE_ENABLE_NON_VOLATILE 2
-#define HFA384X_PROGMODE_PROGRAM_NON_VOLATILE 3
-
-#define HFA384X_AUX_MAGIC0 0xfe01
-#define HFA384X_AUX_MAGIC1 0xdc23
-#define HFA384X_AUX_MAGIC2 0xba45
-
-#define HFA384X_AUX_PORT_DISABLED 0
-#define HFA384X_AUX_PORT_DISABLE BIT(14)
-#define HFA384X_AUX_PORT_ENABLE BIT(15)
-#define HFA384X_AUX_PORT_ENABLED (BIT(14) | BIT(15))
-#define HFA384X_AUX_PORT_MASK (BIT(14) | BIT(15))
-
-#define PRISM2_PDA_SIZE 1024
-
-
-/* Events; EvStat, Interrupt mask (IntEn), and acknowledge bits (EvAck) */
-#define HFA384X_EV_TICK BIT(15)
-#define HFA384X_EV_WTERR BIT(14)
-#define HFA384X_EV_INFDROP BIT(13)
-#ifdef PRISM2_PCI
-#define HFA384X_EV_PCI_M1 BIT(9)
-#define HFA384X_EV_PCI_M0 BIT(8)
-#endif /* PRISM2_PCI */
-#define HFA384X_EV_INFO BIT(7)
-#define HFA384X_EV_DTIM BIT(5)
-#define HFA384X_EV_CMD BIT(4)
-#define HFA384X_EV_ALLOC BIT(3)
-#define HFA384X_EV_TXEXC BIT(2)
-#define HFA384X_EV_TX BIT(1)
-#define HFA384X_EV_RX BIT(0)
-
-
-/* HFA384X Information frames */
-#define HFA384X_INFO_HANDOVERADDR 0xF000 /* AP f/w ? */
-#define HFA384X_INFO_HANDOVERDEAUTHADDR 0xF001 /* AP f/w 1.3.7 */
-#define HFA384X_INFO_COMMTALLIES 0xF100
-#define HFA384X_INFO_SCANRESULTS 0xF101
-#define HFA384X_INFO_CHANNELINFORESULTS 0xF102 /* AP f/w only */
-#define HFA384X_INFO_HOSTSCANRESULTS 0xF103
-#define HFA384X_INFO_LINKSTATUS 0xF200
-#define HFA384X_INFO_ASSOCSTATUS 0xF201 /* ? */
-#define HFA384X_INFO_AUTHREQ 0xF202 /* ? */
-#define HFA384X_INFO_PSUSERCNT 0xF203 /* ? */
-#define HFA384X_INFO_KEYIDCHANGED 0xF204 /* ? */
-
-enum { HFA384X_LINKSTATUS_CONNECTED = 1,
-       HFA384X_LINKSTATUS_DISCONNECTED = 2,
-       HFA384X_LINKSTATUS_AP_CHANGE = 3,
-       HFA384X_LINKSTATUS_AP_OUT_OF_RANGE = 4,
-       HFA384X_LINKSTATUS_AP_IN_RANGE = 5,
-       HFA384X_LINKSTATUS_ASSOC_FAILED = 6 };
-
-enum { HFA384X_PORTTYPE_BSS = 1, HFA384X_PORTTYPE_WDS = 2,
-       HFA384X_PORTTYPE_PSEUDO_IBSS = 3, HFA384X_PORTTYPE_IBSS = 0,
-       HFA384X_PORTTYPE_HOSTAP = 6 };
-
-#define HFA384X_RATES_1MBPS BIT(0)
-#define HFA384X_RATES_2MBPS BIT(1)
-#define HFA384X_RATES_5MBPS BIT(2)
-#define HFA384X_RATES_11MBPS BIT(3)
-
-#define HFA384X_ROAMING_FIRMWARE 1
-#define HFA384X_ROAMING_HOST 2
-#define HFA384X_ROAMING_DISABLED 3
-
-#define HFA384X_WEPFLAGS_PRIVACYINVOKED BIT(0)
-#define HFA384X_WEPFLAGS_EXCLUDEUNENCRYPTED BIT(1)
-#define HFA384X_WEPFLAGS_HOSTENCRYPT BIT(4)
-#define HFA384X_WEPFLAGS_HOSTDECRYPT BIT(7)
-
-#define HFA384X_RX_STATUS_MSGTYPE (BIT(15) | BIT(14) | BIT(13))
-#define HFA384X_RX_STATUS_PCF BIT(12)
-#define HFA384X_RX_STATUS_MACPORT (BIT(10) | BIT(9) | BIT(8))
-#define HFA384X_RX_STATUS_UNDECR BIT(1)
-#define HFA384X_RX_STATUS_FCSERR BIT(0)
-
-#define HFA384X_RX_STATUS_GET_MSGTYPE(s) \
-(((s) & HFA384X_RX_STATUS_MSGTYPE) >> 13)
-#define HFA384X_RX_STATUS_GET_MACPORT(s) \
-(((s) & HFA384X_RX_STATUS_MACPORT) >> 8)
-
-enum { HFA384X_RX_MSGTYPE_NORMAL = 0, HFA384X_RX_MSGTYPE_RFC1042 = 1,
-       HFA384X_RX_MSGTYPE_BRIDGETUNNEL = 2, HFA384X_RX_MSGTYPE_MGMT = 4 };
-
-
-#define HFA384X_TX_CTRL_ALT_RTRY BIT(5)
-#define HFA384X_TX_CTRL_802_11 BIT(3)
-#define HFA384X_TX_CTRL_802_3 0
-#define HFA384X_TX_CTRL_TX_EX BIT(2)
-#define HFA384X_TX_CTRL_TX_OK BIT(1)
-
-#define HFA384X_TX_STATUS_RETRYERR BIT(0)
-#define HFA384X_TX_STATUS_AGEDERR BIT(1)
-#define HFA384X_TX_STATUS_DISCON BIT(2)
-#define HFA384X_TX_STATUS_FORMERR BIT(3)
-
-/* HFA3861/3863 (BBP) Control Registers */
-#define HFA386X_CR_TX_CONFIGURE 0x12 /* CR9 */
-#define HFA386X_CR_RX_CONFIGURE 0x14 /* CR10 */
-#define HFA386X_CR_A_D_TEST_MODES2 0x1A /* CR13 */
-#define HFA386X_CR_MANUAL_TX_POWER 0x3E /* CR31 */
-#define HFA386X_CR_MEASURED_TX_POWER 0x74 /* CR58 */
-
-
-#ifdef __KERNEL__
-
-#define PRISM2_TXFID_COUNT 8
-#define PRISM2_DATA_MAXLEN 2304
-#define PRISM2_TXFID_LEN (PRISM2_DATA_MAXLEN + sizeof(struct hfa384x_tx_frame))
-#define PRISM2_TXFID_EMPTY 0xffff
-#define PRISM2_TXFID_RESERVED 0xfffe
-#define PRISM2_DUMMY_FID 0xffff
-#define MAX_SSID_LEN 32
-#define MAX_NAME_LEN 32 /* this is assumed to be equal to MAX_SSID_LEN */
-
-#define PRISM2_DUMP_RX_HDR BIT(0)
-#define PRISM2_DUMP_TX_HDR BIT(1)
-#define PRISM2_DUMP_TXEXC_HDR BIT(2)
-
-struct hostap_tx_callback_info {
-	u16 idx;
-	void (*func)(struct sk_buff *, int ok, void *);
-	void *data;
-	struct hostap_tx_callback_info *next;
-};
-
-
-/* IEEE 802.11 requires that STA supports concurrent reception of at least
- * three fragmented frames. This define can be increased to support more
- * concurrent frames, but it should be noted that each entry can consume about
- * 2 kB of RAM and increasing cache size will slow down frame reassembly. */
-#define PRISM2_FRAG_CACHE_LEN 4
-
-struct prism2_frag_entry {
-	unsigned long first_frag_time;
-	unsigned int seq;
-	unsigned int last_frag;
-	struct sk_buff *skb;
-	u8 src_addr[ETH_ALEN];
-	u8 dst_addr[ETH_ALEN];
-};
-
-
-struct hostap_cmd_queue {
-	struct list_head list;
-	wait_queue_head_t compl;
-	volatile enum { CMD_SLEEP, CMD_CALLBACK, CMD_COMPLETED } type;
-	void (*callback)(struct net_device *dev, long context, u16 resp0,
-			 u16 res);
-	long context;
-	u16 cmd, param0, param1;
-	u16 resp0, res;
-	volatile int issued, issuing;
-
-	atomic_t usecnt;
-	int del_req;
-};
-
-/* options for hw_shutdown */
-#define HOSTAP_HW_NO_DISABLE BIT(0)
-#define HOSTAP_HW_ENABLE_CMDCOMPL BIT(1)
-
-typedef struct local_info local_info_t;
-
-struct prism2_helper_functions {
-	/* these functions are defined in hardware model specific files
-	 * (hostap_{cs,plx,pci}.c */
-	int (*card_present)(local_info_t *local);
-	void (*cor_sreset)(local_info_t *local);
-	int (*dev_open)(local_info_t *local);
-	int (*dev_close)(local_info_t *local);
-	void (*genesis_reset)(local_info_t *local, int hcr);
-
-	/* the following functions are from hostap_hw.c, but they may have some
-	 * hardware model specific code */
-
-	/* FIX: low-level commands like cmd might disappear at some point to
-	 * make it easier to change them if needed (e.g., cmd would be replaced
-	 * with write_mif/read_mif/testcmd/inquire); at least get_rid and
-	 * set_rid might move to hostap_{cs,plx,pci}.c */
-	int (*cmd)(struct net_device *dev, u16 cmd, u16 param0, u16 *param1,
-		   u16 *resp0);
-	void (*read_regs)(struct net_device *dev, struct hfa384x_regs *regs);
-	int (*get_rid)(struct net_device *dev, u16 rid, void *buf, int len,
-		       int exact_len);
-	int (*set_rid)(struct net_device *dev, u16 rid, void *buf, int len);
-	int (*hw_enable)(struct net_device *dev, int initial);
-	int (*hw_config)(struct net_device *dev, int initial);
-	void (*hw_reset)(struct net_device *dev);
-	void (*hw_shutdown)(struct net_device *dev, int no_disable);
-	int (*reset_port)(struct net_device *dev);
-	void (*schedule_reset)(local_info_t *local);
-	int (*download)(local_info_t *local,
-			struct prism2_download_param *param);
-	int (*tx)(struct sk_buff *skb, struct net_device *dev);
-	int (*set_tim)(struct net_device *dev, int aid, int set);
-	int (*read_aux)(struct net_device *dev, unsigned addr, int len,
-			u8 *buf);
-
-	int need_tx_headroom; /* number of bytes of headroom needed before
-			       * IEEE 802.11 header */
-	enum { HOSTAP_HW_PCCARD, HOSTAP_HW_PLX, HOSTAP_HW_PCI } hw_type;
-};
-
-
-struct prism2_download_data {
-	u32 dl_cmd;
-	u32 start_addr;
-	u32 num_areas;
-	struct prism2_download_data_area {
-		u32 addr; /* wlan card address */
-		u32 len;
-		u8 *data; /* allocated data */
-	} data[0];
-};
-
-
-#define HOSTAP_MAX_BSS_COUNT 64
-#define MAX_WPA_IE_LEN 64
-
-struct hostap_bss_info {
-	struct list_head list;
-	unsigned long last_update;
-	unsigned int count;
-	u8 bssid[ETH_ALEN];
-	u16 capab_info;
-	u8 ssid[32];
-	size_t ssid_len;
-	u8 wpa_ie[MAX_WPA_IE_LEN];
-	size_t wpa_ie_len;
-	u8 rsn_ie[MAX_WPA_IE_LEN];
-	size_t rsn_ie_len;
-	int chan;
-	int included;
-};
-
-
-/* Per radio private Host AP data - shared by all net devices interfaces used
- * by each radio (wlan#, wlan#ap, wlan#sta, WDS).
- * ((struct hostap_interface *) netdev_priv(dev))->local points to this
- * structure. */
-struct local_info {
-	struct module *hw_module;
-	int card_idx;
-	int dev_enabled;
-	int master_dev_auto_open; /* was master device opened automatically */
-	int num_dev_open; /* number of open devices */
-	struct net_device *dev; /* master radio device */
-	struct net_device *ddev; /* main data device */
-	struct list_head hostap_interfaces; /* Host AP interface list (contains
-					     * struct hostap_interface entries)
-					     */
-	rwlock_t iface_lock; /* hostap_interfaces read lock; use write lock
-			      * when removing entries from the list.
-			      * TX and RX paths can use read lock. */
-	spinlock_t cmdlock, baplock, lock;
-	struct semaphore rid_bap_sem;
-	u16 infofid; /* MAC buffer id for info frame */
-	/* txfid, intransmitfid, next_txtid, and next_alloc are protected by
-	 * txfidlock */
-	spinlock_t txfidlock;
-	int txfid_len; /* length of allocated TX buffers */
-	u16 txfid[PRISM2_TXFID_COUNT]; /* buffer IDs for TX frames */
-	/* buffer IDs for intransmit frames or PRISM2_TXFID_EMPTY if
-	 * corresponding txfid is free for next TX frame */
-	u16 intransmitfid[PRISM2_TXFID_COUNT];
-	int next_txfid; /* index to the next txfid to be checked for
-			 * availability */
-	int next_alloc; /* index to the next intransmitfid to be checked for
-			 * allocation events */
-
-	/* bitfield for atomic bitops */
-#define HOSTAP_BITS_TRANSMIT 0
-#define HOSTAP_BITS_BAP_TASKLET 1
-#define HOSTAP_BITS_BAP_TASKLET2 2
-	long bits;
-
-	struct ap_data *ap;
-
-	char essid[MAX_SSID_LEN + 1];
-	char name[MAX_NAME_LEN + 1];
-	int name_set;
-	u16 channel_mask; /* mask of allowed channels */
-	u16 scan_channel_mask; /* mask of channels to be scanned */
-	struct comm_tallies_sums comm_tallies;
-	struct net_device_stats stats;
-	struct proc_dir_entry *proc;
-	int iw_mode; /* operating mode (IW_MODE_*) */
-	int pseudo_adhoc; /* 0: IW_MODE_ADHOC is real 802.11 compliant IBSS
-			   * 1: IW_MODE_ADHOC is "pseudo IBSS" */
-	char bssid[ETH_ALEN];
-	int channel;
-	int beacon_int;
-	int dtim_period;
-	int mtu;
-	int frame_dump; /* dump RX/TX frame headers, PRISM2_DUMP_ flags */
-	int fw_tx_rate_control;
-	u16 tx_rate_control;
-	u16 basic_rates;
-	int hw_resetting;
-	int hw_ready;
-	int hw_reset_tries; /* how many times reset has been tried */
-	int hw_downloading;
-	int shutdown;
-	int pri_only;
-	int no_pri; /* no PRI f/w present */
-	int sram_type; /* 8 = x8 SRAM, 16 = x16 SRAM, -1 = unknown */
-
-	enum {
-		PRISM2_TXPOWER_AUTO = 0, PRISM2_TXPOWER_OFF,
-		PRISM2_TXPOWER_FIXED, PRISM2_TXPOWER_UNKNOWN
-	} txpower_type;
-	int txpower; /* if txpower_type == PRISM2_TXPOWER_FIXED */
-
-	/* command queue for hfa384x_cmd(); protected with cmdlock */
-	struct list_head cmd_queue;
-	/* max_len for cmd_queue; in addition, cmd_callback can use two
-	 * additional entries to prevent sleeping commands from stopping
-	 * transmits */
-#define HOSTAP_CMD_QUEUE_MAX_LEN 16
-	int cmd_queue_len; /* number of entries in cmd_queue */
-
-	/* if card timeout is detected in interrupt context, reset_queue is
-	 * used to schedule card reseting to be done in user context */
-	struct work_struct reset_queue;
-
-	/* For scheduling a change of the promiscuous mode RID */
-	int is_promisc;
-	struct work_struct set_multicast_list_queue;
-
-	struct work_struct set_tim_queue;
-	struct list_head set_tim_list;
-	spinlock_t set_tim_lock;
-
-	int wds_max_connections;
-	int wds_connections;
-#define HOSTAP_WDS_BROADCAST_RA BIT(0)
-#define HOSTAP_WDS_AP_CLIENT BIT(1)
-#define HOSTAP_WDS_STANDARD_FRAME BIT(2)
-	u32 wds_type;
-	u16 tx_control; /* flags to be used in TX description */
-	int manual_retry_count; /* -1 = use f/w default; otherwise retry count
-				 * to be used with all frames */
-
-	struct iw_statistics wstats;
-	unsigned long scan_timestamp; /* Time started to scan */
-	enum {
-		PRISM2_MONITOR_80211 = 0, PRISM2_MONITOR_PRISM = 1,
-		PRISM2_MONITOR_CAPHDR = 2
-	} monitor_type;
-	int (*saved_eth_header_parse)(struct sk_buff *skb,
-				      unsigned char *haddr);
-	int monitor_allow_fcserr;
-
-	int hostapd; /* whether user space daemon, hostapd, is used for AP
-		      * management */
-	int hostapd_sta; /* whether hostapd is used with an extra STA interface
-			  */
-	struct net_device *apdev;
-	struct net_device_stats apdevstats;
-
-	char assoc_ap_addr[ETH_ALEN];
-	struct net_device *stadev;
-	struct net_device_stats stadevstats;
-
-#define WEP_KEYS 4
-#define WEP_KEY_LEN 13
-	struct ieee80211_crypt_data *crypt[WEP_KEYS];
-	int tx_keyidx; /* default TX key index (crypt[tx_keyidx]) */
-	struct timer_list crypt_deinit_timer;
-	struct list_head crypt_deinit_list;
-
-	int open_wep; /* allow unencrypted frames */
-	int host_encrypt;
-	int host_decrypt;
-	int privacy_invoked; /* force privacy invoked flag even if no keys are
-			      * configured */
-	int fw_encrypt_ok; /* whether firmware-based WEP encrypt is working
-			    * in Host AP mode (STA f/w 1.4.9 or newer) */
-	int bcrx_sta_key; /* use individual keys to override default keys even
-			   * with RX of broad/multicast frames */
-
-	struct prism2_frag_entry frag_cache[PRISM2_FRAG_CACHE_LEN];
-	unsigned int frag_next_idx;
-
-	int ieee_802_1x; /* is IEEE 802.1X used */
-
-	int antsel_tx, antsel_rx;
-	int rts_threshold; /* dot11RTSThreshold */
-	int fragm_threshold; /* dot11FragmentationThreshold */
-	int auth_algs; /* PRISM2_AUTH_ flags */
-
-	int enh_sec; /* cnfEnhSecurity options (broadcast SSID hide/ignore) */
-	int tallies32; /* 32-bit tallies in use */
-
-	struct prism2_helper_functions *func;
-
-	u8 *pda;
-	int fw_ap;
-#define PRISM2_FW_VER(major, minor, variant) \
-(((major) << 16) | ((minor) << 8) | variant)
-	u32 sta_fw_ver;
-
-	/* Tasklets for handling hardware IRQ related operations outside hw IRQ
-	 * handler */
-	struct tasklet_struct bap_tasklet;
-
-	struct tasklet_struct info_tasklet;
-	struct sk_buff_head info_list; /* info frames as skb's for
-					* info_tasklet */
-
-	struct hostap_tx_callback_info *tx_callback; /* registered TX callbacks
-						      */
-
-	struct tasklet_struct rx_tasklet;
-	struct sk_buff_head rx_list;
-
-	struct tasklet_struct sta_tx_exc_tasklet;
-	struct sk_buff_head sta_tx_exc_list;
-
-	int host_roaming;
-	unsigned long last_join_time; /* time of last JoinRequest */
-	struct hfa384x_hostscan_result *last_scan_results;
-	int last_scan_results_count;
-	enum { PRISM2_SCAN, PRISM2_HOSTSCAN } last_scan_type;
-	struct work_struct info_queue;
-	long pending_info; /* bit field of pending info_queue items */
-#define PRISM2_INFO_PENDING_LINKSTATUS 0
-#define PRISM2_INFO_PENDING_SCANRESULTS 1
-	int prev_link_status; /* previous received LinkStatus info */
-	int prev_linkstatus_connected;
-	u8 preferred_ap[6]; /* use this AP if possible */
-
-#ifdef PRISM2_CALLBACK
-	void *callback_data; /* Can be used in callbacks; e.g., allocate
-			      * on enable event and free on disable event.
-			      * Host AP driver code does not touch this. */
-#endif /* PRISM2_CALLBACK */
-
-	wait_queue_head_t hostscan_wq;
-
-	/* Passive scan in Host AP mode */
-	struct timer_list passive_scan_timer;
-	int passive_scan_interval; /* in seconds, 0 = disabled */
-	int passive_scan_channel;
-	enum { PASSIVE_SCAN_WAIT, PASSIVE_SCAN_LISTEN } passive_scan_state;
-
-	struct timer_list tick_timer;
-	unsigned long last_tick_timer;
-	unsigned int sw_tick_stuck;
-
-	/* commsQuality / dBmCommsQuality data from periodic polling; only
-	 * valid for Managed and Ad-hoc modes */
-	unsigned long last_comms_qual_update;
-	int comms_qual; /* in some odd unit.. */
-	int avg_signal; /* in dB (note: negative) */
-	int avg_noise; /* in dB (note: negative) */
-	struct work_struct comms_qual_update;
-
-	/* RSSI to dBm adjustment (for RX descriptor fields) */
-	int rssi_to_dBm; /* substract from RSSI to get approximate dBm value */
-
-	/* BSS list / protected by local->lock */
-	struct list_head bss_list;
-	int num_bss_info;
-	int wpa; /* WPA support enabled */
-	int tkip_countermeasures;
-	int drop_unencrypted;
-	/* Generic IEEE 802.11 info element to be added to
-	 * ProbeResp/Beacon/(Re)AssocReq */
-	u8 *generic_elem;
-	size_t generic_elem_len;
-
-#ifdef PRISM2_DOWNLOAD_SUPPORT
-	/* Persistent volatile download data */
-	struct prism2_download_data *dl_pri;
-	struct prism2_download_data *dl_sec;
-#endif /* PRISM2_DOWNLOAD_SUPPORT */
-
-#ifdef PRISM2_IO_DEBUG
-#define PRISM2_IO_DEBUG_SIZE 10000
-	u32 io_debug[PRISM2_IO_DEBUG_SIZE];
-	int io_debug_head;
-	int io_debug_enabled;
-#endif /* PRISM2_IO_DEBUG */
-
-	/* Pointer to hardware model specific (cs,pci,plx) private data. */
-	void *hw_priv;
-};
-
-
-/* Per interface private Host AP data
- * Allocated for each net device that Host AP uses (wlan#, wlan#ap, wlan#sta,
- * WDS) and netdev_priv(dev) points to this structure. */
-struct hostap_interface {
-	struct list_head list; /* list entry in Host AP interface list */
-	struct net_device *dev; /* pointer to this device */
-	struct local_info *local; /* pointer to shared private data */
-	struct net_device_stats stats;
-	struct iw_spy_data spy_data; /* iwspy support */
-	struct iw_public_data wireless_data;
-
-	enum {
-		HOSTAP_INTERFACE_MASTER,
-		HOSTAP_INTERFACE_MAIN,
-		HOSTAP_INTERFACE_AP,
-		HOSTAP_INTERFACE_STA,
-		HOSTAP_INTERFACE_WDS,
-	} type;
-
-	union {
-		struct hostap_interface_wds {
-			u8 remote_addr[ETH_ALEN];
-		} wds;
-	} u;
-};
-
-
-#define HOSTAP_SKB_TX_DATA_MAGIC 0xf08a36a2
-
-/*
- * TX meta data - stored in skb->cb buffer, so this must not be increased over
- * the 40-byte limit
- */
-struct hostap_skb_tx_data {
-	u32 magic; /* HOSTAP_SKB_TX_DATA_MAGIC */
-	u8 rate; /* transmit rate */
-#define HOSTAP_TX_FLAGS_WDS BIT(0)
-#define HOSTAP_TX_FLAGS_BUFFERED_FRAME BIT(1)
-#define HOSTAP_TX_FLAGS_ADD_MOREDATA BIT(2)
-	u8 flags; /* HOSTAP_TX_FLAGS_* */
-	u16 tx_cb_idx;
-	struct hostap_interface *iface;
-	unsigned long jiffies; /* queueing timestamp */
-	unsigned short ethertype;
-};
-
-
-#ifndef PRISM2_NO_DEBUG
-
-#define DEBUG_FID BIT(0)
-#define DEBUG_PS BIT(1)
-#define DEBUG_FLOW BIT(2)
-#define DEBUG_AP BIT(3)
-#define DEBUG_HW BIT(4)
-#define DEBUG_EXTRA BIT(5)
-#define DEBUG_EXTRA2 BIT(6)
-#define DEBUG_PS2 BIT(7)
-#define DEBUG_MASK (DEBUG_PS | DEBUG_AP | DEBUG_HW | DEBUG_EXTRA)
-#define PDEBUG(n, args...) \
-do { if ((n) & DEBUG_MASK) printk(KERN_DEBUG args); } while (0)
-#define PDEBUG2(n, args...) \
-do { if ((n) & DEBUG_MASK) printk(args); } while (0)
-
-#else /* PRISM2_NO_DEBUG */
-
-#define PDEBUG(n, args...)
-#define PDEBUG2(n, args...)
-
-#endif /* PRISM2_NO_DEBUG */
-
-enum { BAP0 = 0, BAP1 = 1 };
-
-#define PRISM2_IO_DEBUG_CMD_INB 0
-#define PRISM2_IO_DEBUG_CMD_INW 1
-#define PRISM2_IO_DEBUG_CMD_INSW 2
-#define PRISM2_IO_DEBUG_CMD_OUTB 3
-#define PRISM2_IO_DEBUG_CMD_OUTW 4
-#define PRISM2_IO_DEBUG_CMD_OUTSW 5
-#define PRISM2_IO_DEBUG_CMD_ERROR 6
-#define PRISM2_IO_DEBUG_CMD_INTERRUPT 7
-
-#ifdef PRISM2_IO_DEBUG
-
-#define PRISM2_IO_DEBUG_ENTRY(cmd, reg, value) \
-(((cmd) << 24) | ((reg) << 16) | value)
-
-static inline void prism2_io_debug_add(struct net_device *dev, int cmd,
-				       int reg, int value)
-{
-	struct hostap_interface *iface = netdev_priv(dev);
-	local_info_t *local = iface->local;
-
-	if (!local->io_debug_enabled)
-		return;
-
-	local->io_debug[local->io_debug_head] =	jiffies & 0xffffffff;
-	if (++local->io_debug_head >= PRISM2_IO_DEBUG_SIZE)
-		local->io_debug_head = 0;
-	local->io_debug[local->io_debug_head] =
-		PRISM2_IO_DEBUG_ENTRY(cmd, reg, value);
-	if (++local->io_debug_head >= PRISM2_IO_DEBUG_SIZE)
-		local->io_debug_head = 0;
-}
-
-
-static inline void prism2_io_debug_error(struct net_device *dev, int err)
-{
-	struct hostap_interface *iface = netdev_priv(dev);
-	local_info_t *local = iface->local;
-	unsigned long flags;
-
-	if (!local->io_debug_enabled)
-		return;
-
-	spin_lock_irqsave(&local->lock, flags);
-	prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_ERROR, 0, err);
-	if (local->io_debug_enabled == 1) {
-		local->io_debug_enabled = 0;
-		printk(KERN_DEBUG "%s: I/O debug stopped\n", dev->name);
-	}
-	spin_unlock_irqrestore(&local->lock, flags);
-}
-
-#else /* PRISM2_IO_DEBUG */
-
-static inline void prism2_io_debug_add(struct net_device *dev, int cmd,
-				       int reg, int value)
-{
-}
-
-static inline void prism2_io_debug_error(struct net_device *dev, int err)
-{
-}
-
-#endif /* PRISM2_IO_DEBUG */
-
-
-#ifdef PRISM2_CALLBACK
-enum {
-	/* Called when card is enabled */
-	PRISM2_CALLBACK_ENABLE,
-
-	/* Called when card is disabled */
-	PRISM2_CALLBACK_DISABLE,
-
-	/* Called when RX/TX starts/ends */
-	PRISM2_CALLBACK_RX_START, PRISM2_CALLBACK_RX_END,
-	PRISM2_CALLBACK_TX_START, PRISM2_CALLBACK_TX_END
-};
-void prism2_callback(local_info_t *local, int event);
-#else /* PRISM2_CALLBACK */
-#define prism2_callback(d, e) do { } while (0)
-#endif /* PRISM2_CALLBACK */
-
-#endif /* __KERNEL__ */
-
-#endif /* HOSTAP_WLAN_H */
diff --git a/trunk/drivers/net/wireless/ieee802_11.h b/trunk/drivers/net/wireless/ieee802_11.h
new file mode 100644
index 000000000000..53dd5248f9f1
--- /dev/null
+++ b/trunk/drivers/net/wireless/ieee802_11.h
@@ -0,0 +1,78 @@
+#ifndef _IEEE802_11_H
+#define _IEEE802_11_H
+
+#define IEEE802_11_DATA_LEN		2304
+/* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
+   6.2.1.1.2.
+
+   The figure in section 7.1.2 suggests a body size of up to 2312
+   bytes is allowed, which is a bit confusing, I suspect this
+   represents the 2304 bytes of real data, plus a possible 8 bytes of
+   WEP IV and ICV. (this interpretation suggested by Ramiro Barreiro) */
+
+
+#define IEEE802_11_HLEN			30
+#define IEEE802_11_FRAME_LEN		(IEEE802_11_DATA_LEN + IEEE802_11_HLEN)
+
+struct ieee802_11_hdr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+} __attribute__ ((packed));
+
+/* Frame control field constants */
+#define IEEE802_11_FCTL_VERS		0x0002
+#define IEEE802_11_FCTL_FTYPE		0x000c
+#define IEEE802_11_FCTL_STYPE		0x00f0
+#define IEEE802_11_FCTL_TODS		0x0100
+#define IEEE802_11_FCTL_FROMDS		0x0200
+#define IEEE802_11_FCTL_MOREFRAGS	0x0400
+#define IEEE802_11_FCTL_RETRY		0x0800
+#define IEEE802_11_FCTL_PM		0x1000
+#define IEEE802_11_FCTL_MOREDATA	0x2000
+#define IEEE802_11_FCTL_WEP		0x4000
+#define IEEE802_11_FCTL_ORDER		0x8000
+
+#define IEEE802_11_FTYPE_MGMT		0x0000
+#define IEEE802_11_FTYPE_CTL		0x0004
+#define IEEE802_11_FTYPE_DATA		0x0008
+
+/* management */
+#define IEEE802_11_STYPE_ASSOC_REQ	0x0000
+#define IEEE802_11_STYPE_ASSOC_RESP 	0x0010
+#define IEEE802_11_STYPE_REASSOC_REQ	0x0020
+#define IEEE802_11_STYPE_REASSOC_RESP	0x0030
+#define IEEE802_11_STYPE_PROBE_REQ	0x0040
+#define IEEE802_11_STYPE_PROBE_RESP	0x0050
+#define IEEE802_11_STYPE_BEACON		0x0080
+#define IEEE802_11_STYPE_ATIM		0x0090
+#define IEEE802_11_STYPE_DISASSOC	0x00A0
+#define IEEE802_11_STYPE_AUTH		0x00B0
+#define IEEE802_11_STYPE_DEAUTH		0x00C0
+
+/* control */
+#define IEEE802_11_STYPE_PSPOLL		0x00A0
+#define IEEE802_11_STYPE_RTS		0x00B0
+#define IEEE802_11_STYPE_CTS		0x00C0
+#define IEEE802_11_STYPE_ACK		0x00D0
+#define IEEE802_11_STYPE_CFEND		0x00E0
+#define IEEE802_11_STYPE_CFENDACK	0x00F0
+
+/* data */
+#define IEEE802_11_STYPE_DATA		0x0000
+#define IEEE802_11_STYPE_DATA_CFACK	0x0010
+#define IEEE802_11_STYPE_DATA_CFPOLL	0x0020
+#define IEEE802_11_STYPE_DATA_CFACKPOLL	0x0030
+#define IEEE802_11_STYPE_NULLFUNC	0x0040
+#define IEEE802_11_STYPE_CFACK		0x0050
+#define IEEE802_11_STYPE_CFPOLL		0x0060
+#define IEEE802_11_STYPE_CFACKPOLL	0x0070
+
+#define IEEE802_11_SCTL_FRAG		0x000F
+#define IEEE802_11_SCTL_SEQ		0xFFF0
+
+#endif /* _IEEE802_11_H */
diff --git a/trunk/drivers/net/wireless/ipw2100.c b/trunk/drivers/net/wireless/ipw2100.c
deleted file mode 100644
index a47fce4beadf..000000000000
--- a/trunk/drivers/net/wireless/ipw2100.c
+++ /dev/null
@@ -1,8679 +0,0 @@
-/******************************************************************************
-
-  Copyright(c) 2003 - 2005 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-  Portions of this file are based on the sample_* files provided by Wireless
-  Extensions 0.26 package and copyright (c) 1997-2003 Jean Tourrilhes
-  <jt@hpl.hp.com>
-
-  Portions of this file are based on the Host AP project,
-  Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
-    <jkmaline@cc.hut.fi>
-  Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
-
-  Portions of ipw2100_mod_firmware_load, ipw2100_do_mod_firmware_load, and
-  ipw2100_fw_load are loosely based on drivers/sound/sound_firmware.c
-  available in the 2.4.25 kernel sources, and are copyright (c) Alan Cox
-
-******************************************************************************/
-/*
-
- Initial driver on which this is based was developed by Janusz Gorycki,
- Maciej Urbaniak, and Maciej Sosnowski.
-
- Promiscuous mode support added by Jacek Wysoczynski and Maciej Urbaniak.
-
-Theory of Operation
-
-Tx - Commands and Data
-
-Firmware and host share a circular queue of Transmit Buffer Descriptors (TBDs)
-Each TBD contains a pointer to the physical (dma_addr_t) address of data being
-sent to the firmware as well as the length of the data.
-
-The host writes to the TBD queue at the WRITE index.  The WRITE index points
-to the _next_ packet to be written and is advanced when after the TBD has been
-filled.
-
-The firmware pulls from the TBD queue at the READ index.  The READ index points
-to the currently being read entry, and is advanced once the firmware is
-done with a packet.
-
-When data is sent to the firmware, the first TBD is used to indicate to the
-firmware if a Command or Data is being sent.  If it is Command, all of the
-command information is contained within the physical address referred to by the
-TBD.  If it is Data, the first TBD indicates the type of data packet, number
-of fragments, etc.  The next TBD then referrs to the actual packet location.
-
-The Tx flow cycle is as follows:
-
-1) ipw2100_tx() is called by kernel with SKB to transmit
-2) Packet is move from the tx_free_list and appended to the transmit pending
-   list (tx_pend_list)
-3) work is scheduled to move pending packets into the shared circular queue.
-4) when placing packet in the circular queue, the incoming SKB is DMA mapped
-   to a physical address.  That address is entered into a TBD.  Two TBDs are
-   filled out.  The first indicating a data packet, the second referring to the
-   actual payload data.
-5) the packet is removed from tx_pend_list and placed on the end of the
-   firmware pending list (fw_pend_list)
-6) firmware is notified that the WRITE index has
-7) Once the firmware has processed the TBD, INTA is triggered.
-8) For each Tx interrupt received from the firmware, the READ index is checked
-   to see which TBDs are done being processed.
-9) For each TBD that has been processed, the ISR pulls the oldest packet
-   from the fw_pend_list.
-10)The packet structure contained in the fw_pend_list is then used
-   to unmap the DMA address and to free the SKB originally passed to the driver
-   from the kernel.
-11)The packet structure is placed onto the tx_free_list
-
-The above steps are the same for commands, only the msg_free_list/msg_pend_list
-are used instead of tx_free_list/tx_pend_list
-
-...
-
-Critical Sections / Locking :
-
-There are two locks utilized.  The first is the low level lock (priv->low_lock)
-that protects the following:
-
-- Access to the Tx/Rx queue lists via priv->low_lock. The lists are as follows:
-
-  tx_free_list : Holds pre-allocated Tx buffers.
-    TAIL modified in __ipw2100_tx_process()
-    HEAD modified in ipw2100_tx()
-
-  tx_pend_list : Holds used Tx buffers waiting to go into the TBD ring
-    TAIL modified ipw2100_tx()
-    HEAD modified by ipw2100_tx_send_data()
-
-  msg_free_list : Holds pre-allocated Msg (Command) buffers
-    TAIL modified in __ipw2100_tx_process()
-    HEAD modified in ipw2100_hw_send_command()
-
-  msg_pend_list : Holds used Msg buffers waiting to go into the TBD ring
-    TAIL modified in ipw2100_hw_send_command()
-    HEAD modified in ipw2100_tx_send_commands()
-
-  The flow of data on the TX side is as follows:
-
-  MSG_FREE_LIST + COMMAND => MSG_PEND_LIST => TBD => MSG_FREE_LIST
-  TX_FREE_LIST + DATA => TX_PEND_LIST => TBD => TX_FREE_LIST
-
-  The methods that work on the TBD ring are protected via priv->low_lock.
-
-- The internal data state of the device itself
-- Access to the firmware read/write indexes for the BD queues
-  and associated logic
-
-All external entry functions are locked with the priv->action_lock to ensure
-that only one external action is invoked at a time.
-
-
-*/
-
-#include <linux/compiler.h>
-#include <linux/config.h>
-#include <linux/errno.h>
-#include <linux/if_arp.h>
-#include <linux/in6.h>
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/kernel.h>
-#include <linux/kmod.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/ethtool.h>
-#include <linux/pci.h>
-#include <linux/dma-mapping.h>
-#include <linux/proc_fs.h>
-#include <linux/skbuff.h>
-#include <asm/uaccess.h>
-#include <asm/io.h>
-#define __KERNEL_SYSCALLS__
-#include <linux/fs.h>
-#include <linux/mm.h>
-#include <linux/slab.h>
-#include <linux/unistd.h>
-#include <linux/stringify.h>
-#include <linux/tcp.h>
-#include <linux/types.h>
-#include <linux/version.h>
-#include <linux/time.h>
-#include <linux/firmware.h>
-#include <linux/acpi.h>
-#include <linux/ctype.h>
-
-#include "ipw2100.h"
-
-#define IPW2100_VERSION "1.1.0"
-
-#define DRV_NAME	"ipw2100"
-#define DRV_VERSION	IPW2100_VERSION
-#define DRV_DESCRIPTION	"Intel(R) PRO/Wireless 2100 Network Driver"
-#define DRV_COPYRIGHT	"Copyright(c) 2003-2004 Intel Corporation"
-
-
-/* Debugging stuff */
-#ifdef CONFIG_IPW_DEBUG
-#define CONFIG_IPW2100_RX_DEBUG   /* Reception debugging */
-#endif
-
-MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
-MODULE_AUTHOR(DRV_COPYRIGHT);
-MODULE_LICENSE("GPL");
-
-static int debug = 0;
-static int mode = 0;
-static int channel = 0;
-static int associate = 1;
-static int disable = 0;
-#ifdef CONFIG_PM
-static struct ipw2100_fw ipw2100_firmware;
-#endif
-
-#include <linux/moduleparam.h>
-module_param(debug, int, 0444);
-module_param(mode, int, 0444);
-module_param(channel, int, 0444);
-module_param(associate, int, 0444);
-module_param(disable, int, 0444);
-
-MODULE_PARM_DESC(debug, "debug level");
-MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS,2=Monitor)");
-MODULE_PARM_DESC(channel, "channel");
-MODULE_PARM_DESC(associate, "auto associate when scanning (default on)");
-MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
-
-static u32 ipw2100_debug_level = IPW_DL_NONE;
-
-#ifdef CONFIG_IPW_DEBUG
-#define IPW_DEBUG(level, message...) \
-do { \
-	if (ipw2100_debug_level & (level)) { \
-		printk(KERN_DEBUG "ipw2100: %c %s ", \
-                       in_interrupt() ? 'I' : 'U',  __FUNCTION__); \
-		printk(message); \
-	} \
-} while (0)
-#else
-#define IPW_DEBUG(level, message...) do {} while (0)
-#endif /* CONFIG_IPW_DEBUG */
-
-#ifdef CONFIG_IPW_DEBUG
-static const char *command_types[] = {
-	"undefined",
-	"unused", /* HOST_ATTENTION */
-	"HOST_COMPLETE",
-	"unused", /* SLEEP */
-	"unused", /* HOST_POWER_DOWN */
-	"unused",
-	"SYSTEM_CONFIG",
-	"unused", /* SET_IMR */
-	"SSID",
-	"MANDATORY_BSSID",
-	"AUTHENTICATION_TYPE",
-	"ADAPTER_ADDRESS",
-	"PORT_TYPE",
-	"INTERNATIONAL_MODE",
-	"CHANNEL",
-	"RTS_THRESHOLD",
-	"FRAG_THRESHOLD",
-	"POWER_MODE",
-	"TX_RATES",
-	"BASIC_TX_RATES",
-	"WEP_KEY_INFO",
-	"unused",
-	"unused",
-	"unused",
-	"unused",
-	"WEP_KEY_INDEX",
-	"WEP_FLAGS",
-	"ADD_MULTICAST",
-	"CLEAR_ALL_MULTICAST",
-	"BEACON_INTERVAL",
-	"ATIM_WINDOW",
-	"CLEAR_STATISTICS",
-	"undefined",
-	"undefined",
-	"undefined",
-	"undefined",
-	"TX_POWER_INDEX",
-	"undefined",
-	"undefined",
-	"undefined",
-	"undefined",
-	"undefined",
-	"undefined",
-	"BROADCAST_SCAN",
-	"CARD_DISABLE",
-	"PREFERRED_BSSID",
-	"SET_SCAN_OPTIONS",
-	"SCAN_DWELL_TIME",
-	"SWEEP_TABLE",
-	"AP_OR_STATION_TABLE",
-	"GROUP_ORDINALS",
-	"SHORT_RETRY_LIMIT",
-	"LONG_RETRY_LIMIT",
-	"unused", /* SAVE_CALIBRATION */
-	"unused", /* RESTORE_CALIBRATION */
-	"undefined",
-	"undefined",
-	"undefined",
-	"HOST_PRE_POWER_DOWN",
-	"unused", /* HOST_INTERRUPT_COALESCING */
-	"undefined",
-	"CARD_DISABLE_PHY_OFF",
-	"MSDU_TX_RATES"
-	"undefined",
-	"undefined",
-	"SET_STATION_STAT_BITS",
-	"CLEAR_STATIONS_STAT_BITS",
-	"LEAP_ROGUE_MODE",
-	"SET_SECURITY_INFORMATION",
-	"DISASSOCIATION_BSSID",
-	"SET_WPA_ASS_IE"
-};
-#endif
-
-
-/* Pre-decl until we get the code solid and then we can clean it up */
-static void ipw2100_tx_send_commands(struct ipw2100_priv *priv);
-static void ipw2100_tx_send_data(struct ipw2100_priv *priv);
-static int ipw2100_adapter_setup(struct ipw2100_priv *priv);
-
-static void ipw2100_queues_initialize(struct ipw2100_priv *priv);
-static void ipw2100_queues_free(struct ipw2100_priv *priv);
-static int ipw2100_queues_allocate(struct ipw2100_priv *priv);
-
-static int ipw2100_fw_download(struct ipw2100_priv *priv,
-			       struct ipw2100_fw *fw);
-static int ipw2100_get_firmware(struct ipw2100_priv *priv,
-				struct ipw2100_fw *fw);
-static int ipw2100_get_fwversion(struct ipw2100_priv *priv, char *buf,
-				 size_t max);
-static int ipw2100_get_ucodeversion(struct ipw2100_priv *priv, char *buf,
-				    size_t max);
-static void ipw2100_release_firmware(struct ipw2100_priv *priv,
-				     struct ipw2100_fw *fw);
-static int ipw2100_ucode_download(struct ipw2100_priv *priv,
-				  struct ipw2100_fw *fw);
-static void ipw2100_wx_event_work(struct ipw2100_priv *priv);
-static struct iw_statistics *ipw2100_wx_wireless_stats(struct net_device * dev);
-static struct iw_handler_def ipw2100_wx_handler_def;
-
-
-static inline void read_register(struct net_device *dev, u32 reg, u32 *val)
-{
-	*val = readl((void *)(dev->base_addr + reg));
-	IPW_DEBUG_IO("r: 0x%08X => 0x%08X\n", reg, *val);
-}
-
-static inline void write_register(struct net_device *dev, u32 reg, u32 val)
-{
-	writel(val, (void *)(dev->base_addr + reg));
-	IPW_DEBUG_IO("w: 0x%08X <= 0x%08X\n", reg, val);
-}
-
-static inline void read_register_word(struct net_device *dev, u32 reg, u16 *val)
-{
-	*val = readw((void *)(dev->base_addr + reg));
-	IPW_DEBUG_IO("r: 0x%08X => %04X\n", reg, *val);
-}
-
-static inline void read_register_byte(struct net_device *dev, u32 reg, u8 *val)
-{
-	*val = readb((void *)(dev->base_addr + reg));
-	IPW_DEBUG_IO("r: 0x%08X => %02X\n", reg, *val);
-}
-
-static inline void write_register_word(struct net_device *dev, u32 reg, u16 val)
-{
-	writew(val, (void *)(dev->base_addr + reg));
-	IPW_DEBUG_IO("w: 0x%08X <= %04X\n", reg, val);
-}
-
-
-static inline void write_register_byte(struct net_device *dev, u32 reg, u8 val)
-{
-	writeb(val, (void *)(dev->base_addr + reg));
-	IPW_DEBUG_IO("w: 0x%08X =< %02X\n", reg, val);
-}
-
-static inline void read_nic_dword(struct net_device *dev, u32 addr, u32 *val)
-{
-	write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
-		       addr & IPW_REG_INDIRECT_ADDR_MASK);
-	read_register(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
-}
-
-static inline void write_nic_dword(struct net_device *dev, u32 addr, u32 val)
-{
-	write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
-		       addr & IPW_REG_INDIRECT_ADDR_MASK);
-	write_register(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
-}
-
-static inline void read_nic_word(struct net_device *dev, u32 addr, u16 *val)
-{
-	write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
-		       addr & IPW_REG_INDIRECT_ADDR_MASK);
-	read_register_word(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
-}
-
-static inline void write_nic_word(struct net_device *dev, u32 addr, u16 val)
-{
-	write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
-		       addr & IPW_REG_INDIRECT_ADDR_MASK);
-	write_register_word(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
-}
-
-static inline void read_nic_byte(struct net_device *dev, u32 addr, u8 *val)
-{
-	write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
-		       addr & IPW_REG_INDIRECT_ADDR_MASK);
-	read_register_byte(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
-}
-
-static inline void write_nic_byte(struct net_device *dev, u32 addr, u8 val)
-{
-	write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
-		       addr & IPW_REG_INDIRECT_ADDR_MASK);
-	write_register_byte(dev, IPW_REG_INDIRECT_ACCESS_DATA, val);
-}
-
-static inline void write_nic_auto_inc_address(struct net_device *dev, u32 addr)
-{
-	write_register(dev, IPW_REG_AUTOINCREMENT_ADDRESS,
-		       addr & IPW_REG_INDIRECT_ADDR_MASK);
-}
-
-static inline void write_nic_dword_auto_inc(struct net_device *dev, u32 val)
-{
-	write_register(dev, IPW_REG_AUTOINCREMENT_DATA, val);
-}
-
-static inline void write_nic_memory(struct net_device *dev, u32 addr, u32 len,
-				    const u8 *buf)
-{
-	u32 aligned_addr;
-	u32 aligned_len;
-	u32 dif_len;
-	u32 i;
-
-	/* read first nibble byte by byte */
-	aligned_addr = addr & (~0x3);
-	dif_len = addr - aligned_addr;
-	if (dif_len) {
-		/* Start reading at aligned_addr + dif_len */
-		write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
-			       aligned_addr);
-		for (i = dif_len; i < 4; i++, buf++)
-			write_register_byte(
-				dev, IPW_REG_INDIRECT_ACCESS_DATA + i,
-				*buf);
-
-		len -= dif_len;
-		aligned_addr += 4;
-	}
-
-	/* read DWs through autoincrement registers */
-	write_register(dev, IPW_REG_AUTOINCREMENT_ADDRESS,
-		       aligned_addr);
-	aligned_len = len & (~0x3);
-	for (i = 0; i < aligned_len; i += 4, buf += 4, aligned_addr += 4)
-		write_register(
-			dev, IPW_REG_AUTOINCREMENT_DATA, *(u32 *)buf);
-
-	/* copy the last nibble */
-	dif_len = len - aligned_len;
-	write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS, aligned_addr);
-	for (i = 0; i < dif_len; i++, buf++)
-		write_register_byte(
-			dev, IPW_REG_INDIRECT_ACCESS_DATA + i, *buf);
-}
-
-static inline void read_nic_memory(struct net_device *dev, u32 addr, u32 len,
-				   u8 *buf)
-{
-	u32 aligned_addr;
-	u32 aligned_len;
-	u32 dif_len;
-	u32 i;
-
-	/* read first nibble byte by byte */
-	aligned_addr = addr & (~0x3);
-	dif_len = addr - aligned_addr;
-	if (dif_len) {
-		/* Start reading at aligned_addr + dif_len */
-		write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
-			       aligned_addr);
-		for (i = dif_len; i < 4; i++, buf++)
-			read_register_byte(
-				dev, IPW_REG_INDIRECT_ACCESS_DATA + i, buf);
-
-		len -= dif_len;
-		aligned_addr += 4;
-	}
-
-	/* read DWs through autoincrement registers */
-	write_register(dev, IPW_REG_AUTOINCREMENT_ADDRESS,
-		       aligned_addr);
-	aligned_len = len & (~0x3);
-	for (i = 0; i < aligned_len; i += 4, buf += 4, aligned_addr += 4)
-		read_register(dev, IPW_REG_AUTOINCREMENT_DATA,
-			      (u32 *)buf);
-
-	/* copy the last nibble */
-	dif_len = len - aligned_len;
-	write_register(dev, IPW_REG_INDIRECT_ACCESS_ADDRESS,
-		       aligned_addr);
-	for (i = 0; i < dif_len; i++, buf++)
-		read_register_byte(dev, IPW_REG_INDIRECT_ACCESS_DATA +
-				   i, buf);
-}
-
-static inline int ipw2100_hw_is_adapter_in_system(struct net_device *dev)
-{
-	return (dev->base_addr &&
-		(readl((void *)(dev->base_addr + IPW_REG_DOA_DEBUG_AREA_START))
-		 == IPW_DATA_DOA_DEBUG_VALUE));
-}
-
-static int ipw2100_get_ordinal(struct ipw2100_priv *priv, u32 ord,
-			       void *val, u32 *len)
-{
-	struct ipw2100_ordinals *ordinals = &priv->ordinals;
-	u32 addr;
-	u32 field_info;
-	u16 field_len;
-	u16 field_count;
-	u32 total_length;
-
-	if (ordinals->table1_addr == 0) {
-		printk(KERN_WARNING DRV_NAME ": attempt to use fw ordinals "
-		       "before they have been loaded.\n");
-		return -EINVAL;
-	}
-
-	if (IS_ORDINAL_TABLE_ONE(ordinals, ord)) {
-		if (*len < IPW_ORD_TAB_1_ENTRY_SIZE) {
-			*len = IPW_ORD_TAB_1_ENTRY_SIZE;
-
-			printk(KERN_WARNING DRV_NAME
-			       ": ordinal buffer length too small, need %zd\n",
-			       IPW_ORD_TAB_1_ENTRY_SIZE);
-
-			return -EINVAL;
-		}
-
-		read_nic_dword(priv->net_dev, ordinals->table1_addr + (ord << 2),
-			       &addr);
-		read_nic_dword(priv->net_dev, addr, val);
-
-		*len = IPW_ORD_TAB_1_ENTRY_SIZE;
-
-		return 0;
-	}
-
-	if (IS_ORDINAL_TABLE_TWO(ordinals, ord)) {
-
-		ord -= IPW_START_ORD_TAB_2;
-
-		/* get the address of statistic */
-		read_nic_dword(priv->net_dev, ordinals->table2_addr + (ord << 3),
-			       &addr);
-
-		/* get the second DW of statistics ;
-		 * two 16-bit words - first is length, second is count */
-		read_nic_dword(priv->net_dev,
-			       ordinals->table2_addr + (ord << 3) + sizeof(u32),
-			       &field_info);
-
-		/* get each entry length */
-		field_len = *((u16 *)&field_info);
-
-		/* get number of entries */
-		field_count = *(((u16 *)&field_info) + 1);
-
-		/* abort if no enought memory */
-		total_length = field_len * field_count;
-		if (total_length > *len) {
-			*len = total_length;
-			return -EINVAL;
-		}
-
-		*len = total_length;
-		if (!total_length)
-			return 0;
-
-		/* read the ordinal data from the SRAM */
-		read_nic_memory(priv->net_dev, addr, total_length, val);
-
-		return 0;
-	}
-
-	printk(KERN_WARNING DRV_NAME ": ordinal %d neither in table 1 nor "
-	       "in table 2\n", ord);
-
-	return -EINVAL;
-}
-
-static int ipw2100_set_ordinal(struct ipw2100_priv *priv, u32 ord, u32 *val,
-			       u32 *len)
-{
-	struct ipw2100_ordinals *ordinals = &priv->ordinals;
-	u32 addr;
-
-	if (IS_ORDINAL_TABLE_ONE(ordinals, ord)) {
-		if (*len != IPW_ORD_TAB_1_ENTRY_SIZE) {
-			*len = IPW_ORD_TAB_1_ENTRY_SIZE;
-			IPW_DEBUG_INFO("wrong size\n");
-			return -EINVAL;
-		}
-
-		read_nic_dword(priv->net_dev, ordinals->table1_addr + (ord << 2),
-			       &addr);
-
-		write_nic_dword(priv->net_dev, addr, *val);
-
-		*len = IPW_ORD_TAB_1_ENTRY_SIZE;
-
-		return 0;
-	}
-
-	IPW_DEBUG_INFO("wrong table\n");
-	if (IS_ORDINAL_TABLE_TWO(ordinals, ord))
-		return -EINVAL;
-
-	return -EINVAL;
-}
-
-static char *snprint_line(char *buf, size_t count,
-			  const u8 *data, u32 len, u32 ofs)
-{
-	int out, i, j, l;
-	char c;
-
-	out = snprintf(buf, count, "%08X", ofs);
-
-	for (l = 0, i = 0; i < 2; i++) {
-		out += snprintf(buf + out, count - out, " ");
-		for (j = 0; j < 8 && l < len; j++, l++)
-			out += snprintf(buf + out, count - out, "%02X ",
-					data[(i * 8 + j)]);
-		for (; j < 8; j++)
-			out += snprintf(buf + out, count - out, "   ");
-	}
-
-	out += snprintf(buf + out, count - out, " ");
-	for (l = 0, i = 0; i < 2; i++) {
-		out += snprintf(buf + out, count - out, " ");
-		for (j = 0; j < 8 && l < len; j++, l++) {
-			c = data[(i * 8 + j)];
-			if (!isascii(c) || !isprint(c))
-				c = '.';
-
-			out += snprintf(buf + out, count - out, "%c", c);
-		}
-
-		for (; j < 8; j++)
-			out += snprintf(buf + out, count - out, " ");
-	}
-
-	return buf;
-}
-
-static void printk_buf(int level, const u8 *data, u32 len)
-{
-	char line[81];
-	u32 ofs = 0;
-	if (!(ipw2100_debug_level & level))
-		return;
-
-	while (len) {
-		printk(KERN_DEBUG "%s\n",
-		       snprint_line(line, sizeof(line), &data[ofs],
-				    min(len, 16U), ofs));
-		ofs += 16;
-		len -= min(len, 16U);
-	}
-}
-
-
-
-#define MAX_RESET_BACKOFF 10
-
-static inline void schedule_reset(struct ipw2100_priv *priv)
-{
-	unsigned long now = get_seconds();
-
-	/* If we haven't received a reset request within the backoff period,
-	 * then we can reset the backoff interval so this reset occurs
-	 * immediately */
-	if (priv->reset_backoff &&
-	    (now - priv->last_reset > priv->reset_backoff))
-		priv->reset_backoff = 0;
-
-	priv->last_reset = get_seconds();
-
-	if (!(priv->status & STATUS_RESET_PENDING)) {
-		IPW_DEBUG_INFO("%s: Scheduling firmware restart (%ds).\n",
-			       priv->net_dev->name, priv->reset_backoff);
-		netif_carrier_off(priv->net_dev);
-		netif_stop_queue(priv->net_dev);
-		priv->status |= STATUS_RESET_PENDING;
-		if (priv->reset_backoff)
-			queue_delayed_work(priv->workqueue, &priv->reset_work,
-					   priv->reset_backoff * HZ);
-		else
-			queue_work(priv->workqueue, &priv->reset_work);
-
-		if (priv->reset_backoff < MAX_RESET_BACKOFF)
-			priv->reset_backoff++;
-
-		wake_up_interruptible(&priv->wait_command_queue);
-	} else
-		IPW_DEBUG_INFO("%s: Firmware restart already in progress.\n",
-			       priv->net_dev->name);
-
-}
-
-#define HOST_COMPLETE_TIMEOUT (2 * HZ)
-static int ipw2100_hw_send_command(struct ipw2100_priv *priv,
-				   struct host_command * cmd)
-{
-	struct list_head *element;
-	struct ipw2100_tx_packet *packet;
-	unsigned long flags;
-	int err = 0;
-
-	IPW_DEBUG_HC("Sending %s command (#%d), %d bytes\n",
-		     command_types[cmd->host_command], cmd->host_command,
-		     cmd->host_command_length);
-	printk_buf(IPW_DL_HC, (u8*)cmd->host_command_parameters,
-		   cmd->host_command_length);
-
-	spin_lock_irqsave(&priv->low_lock, flags);
-
-	if (priv->fatal_error) {
-		IPW_DEBUG_INFO("Attempt to send command while hardware in fatal error condition.\n");
-		err = -EIO;
-		goto fail_unlock;
-	}
-
-	if (!(priv->status & STATUS_RUNNING)) {
-		IPW_DEBUG_INFO("Attempt to send command while hardware is not running.\n");
-		err = -EIO;
-		goto fail_unlock;
-	}
-
-	if (priv->status & STATUS_CMD_ACTIVE) {
-		IPW_DEBUG_INFO("Attempt to send command while another command is pending.\n");
-		err = -EBUSY;
-		goto fail_unlock;
-	}
-
-	if (list_empty(&priv->msg_free_list)) {
-		IPW_DEBUG_INFO("no available msg buffers\n");
-		goto fail_unlock;
-	}
-
-	priv->status |= STATUS_CMD_ACTIVE;
-	priv->messages_sent++;
-
-	element = priv->msg_free_list.next;
-
-	packet = list_entry(element, struct ipw2100_tx_packet, list);
-	packet->jiffy_start = jiffies;
-
-	/* initialize the firmware command packet */
-	packet->info.c_struct.cmd->host_command_reg = cmd->host_command;
-	packet->info.c_struct.cmd->host_command_reg1 = cmd->host_command1;
-	packet->info.c_struct.cmd->host_command_len_reg = cmd->host_command_length;
-	packet->info.c_struct.cmd->sequence = cmd->host_command_sequence;
-
-	memcpy(packet->info.c_struct.cmd->host_command_params_reg,
-	       cmd->host_command_parameters,
-	       sizeof(packet->info.c_struct.cmd->host_command_params_reg));
-
-	list_del(element);
-	DEC_STAT(&priv->msg_free_stat);
-
-	list_add_tail(element, &priv->msg_pend_list);
-	INC_STAT(&priv->msg_pend_stat);
-
-	ipw2100_tx_send_commands(priv);
-	ipw2100_tx_send_data(priv);
-
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-
-	/*
-	 * We must wait for this command to complete before another
-	 * command can be sent...  but if we wait more than 3 seconds
-	 * then there is a problem.
-	 */
-
-	err = wait_event_interruptible_timeout(
-		priv->wait_command_queue, !(priv->status & STATUS_CMD_ACTIVE),
-		HOST_COMPLETE_TIMEOUT);
-
-	if (err == 0) {
-		IPW_DEBUG_INFO("Command completion failed out after %dms.\n",
-			       HOST_COMPLETE_TIMEOUT / (HZ / 100));
-		priv->fatal_error = IPW2100_ERR_MSG_TIMEOUT;
-		priv->status &= ~STATUS_CMD_ACTIVE;
-		schedule_reset(priv);
-		return -EIO;
-	}
-
-	if (priv->fatal_error) {
-		printk(KERN_WARNING DRV_NAME ": %s: firmware fatal error\n",
-		       priv->net_dev->name);
-		return -EIO;
-	}
-
-	/* !!!!! HACK TEST !!!!!
-	 * When lots of debug trace statements are enabled, the driver
-	 * doesn't seem to have as many firmware restart cycles...
-	 *
-	 * As a test, we're sticking in a 1/100s delay here */
-	set_current_state(TASK_UNINTERRUPTIBLE);
-	schedule_timeout(HZ / 100);
-
-	return 0;
-
- fail_unlock:
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-
-	return err;
-}
-
-
-/*
- * Verify the values and data access of the hardware
- * No locks needed or used.  No functions called.
- */
-static int ipw2100_verify(struct ipw2100_priv *priv)
-{
-	u32 data1, data2;
-	u32 address;
-
-	u32 val1 = 0x76543210;
-	u32 val2 = 0xFEDCBA98;
-
-	/* Domain 0 check - all values should be DOA_DEBUG */
-	for (address = IPW_REG_DOA_DEBUG_AREA_START;
-	     address < IPW_REG_DOA_DEBUG_AREA_END;
-	     address += sizeof(u32)) {
-		read_register(priv->net_dev, address, &data1);
-		if (data1 != IPW_DATA_DOA_DEBUG_VALUE)
-			return -EIO;
-	}
-
-	/* Domain 1 check - use arbitrary read/write compare  */
-	for (address = 0; address < 5; address++) {
-		/* The memory area is not used now */
-		write_register(priv->net_dev, IPW_REG_DOMAIN_1_OFFSET + 0x32,
-			       val1);
-		write_register(priv->net_dev, IPW_REG_DOMAIN_1_OFFSET + 0x36,
-			       val2);
-		read_register(priv->net_dev, IPW_REG_DOMAIN_1_OFFSET + 0x32,
-			      &data1);
-		read_register(priv->net_dev, IPW_REG_DOMAIN_1_OFFSET + 0x36,
-			      &data2);
-		if (val1 == data1 && val2 == data2)
-			return 0;
-	}
-
-	return -EIO;
-}
-
-/*
- *
- * Loop until the CARD_DISABLED bit is the same value as the
- * supplied parameter
- *
- * TODO: See if it would be more efficient to do a wait/wake
- *       cycle and have the completion event trigger the wakeup
- *
- */
-#define IPW_CARD_DISABLE_COMPLETE_WAIT		    100	// 100 milli
-static int ipw2100_wait_for_card_state(struct ipw2100_priv *priv, int state)
-{
-	int i;
-	u32 card_state;
-	u32 len = sizeof(card_state);
-	int err;
-
-	for (i = 0; i <= IPW_CARD_DISABLE_COMPLETE_WAIT * 1000; i += 50) {
-		err = ipw2100_get_ordinal(priv, IPW_ORD_CARD_DISABLED,
-					  &card_state, &len);
-		if (err) {
-			IPW_DEBUG_INFO("Query of CARD_DISABLED ordinal "
-				       "failed.\n");
-			return 0;
-		}
-
-		/* We'll break out if either the HW state says it is
-		 * in the state we want, or if HOST_COMPLETE command
-		 * finishes */
-		if ((card_state == state) ||
-		    ((priv->status & STATUS_ENABLED) ?
-		     IPW_HW_STATE_ENABLED : IPW_HW_STATE_DISABLED) == state) {
-			if (state == IPW_HW_STATE_ENABLED)
-				priv->status |= STATUS_ENABLED;
-			else
-				priv->status &= ~STATUS_ENABLED;
-
-			return 0;
-		}
-
-		udelay(50);
-	}
-
-	IPW_DEBUG_INFO("ipw2100_wait_for_card_state to %s state timed out\n",
-		       state ? "DISABLED" : "ENABLED");
-	return -EIO;
-}
-
-
-/*********************************************************************
-    Procedure   :   sw_reset_and_clock
-    Purpose     :   Asserts s/w reset, asserts clock initialization
-                    and waits for clock stabilization
- ********************************************************************/
-static int sw_reset_and_clock(struct ipw2100_priv *priv)
-{
-	int i;
-	u32 r;
-
-	// assert s/w reset
-	write_register(priv->net_dev, IPW_REG_RESET_REG,
-		       IPW_AUX_HOST_RESET_REG_SW_RESET);
-
-	// wait for clock stabilization
-	for (i = 0; i < 1000; i++) {
-		udelay(IPW_WAIT_RESET_ARC_COMPLETE_DELAY);
-
-		// check clock ready bit
-		read_register(priv->net_dev, IPW_REG_RESET_REG, &r);
-		if (r & IPW_AUX_HOST_RESET_REG_PRINCETON_RESET)
-			break;
-	}
-
-	if (i == 1000)
-		return -EIO;	// TODO: better error value
-
-	/* set "initialization complete" bit to move adapter to
-	 * D0 state */
-	write_register(priv->net_dev, IPW_REG_GP_CNTRL,
-		       IPW_AUX_HOST_GP_CNTRL_BIT_INIT_DONE);
-
-	/* wait for clock stabilization */
-	for (i = 0; i < 10000; i++) {
-		udelay(IPW_WAIT_CLOCK_STABILIZATION_DELAY * 4);
-
-		/* check clock ready bit */
-		read_register(priv->net_dev, IPW_REG_GP_CNTRL, &r);
-		if (r & IPW_AUX_HOST_GP_CNTRL_BIT_CLOCK_READY)
-			break;
-	}
-
-	if (i == 10000)
-		return -EIO;	/* TODO: better error value */
-
-	/* set D0 standby bit */
-	read_register(priv->net_dev, IPW_REG_GP_CNTRL, &r);
-	write_register(priv->net_dev, IPW_REG_GP_CNTRL,
-		       r | IPW_AUX_HOST_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY);
-
-	return 0;
-}
-
-/*********************************************************************
-    Procedure   :   ipw2100_download_firmware
-    Purpose     :   Initiaze adapter after power on.
-                    The sequence is:
-                    1. assert s/w reset first!
-                    2. awake clocks & wait for clock stabilization
-                    3. hold ARC (don't ask me why...)
-                    4. load Dino ucode and reset/clock init again
-                    5. zero-out shared mem
-                    6. download f/w
- *******************************************************************/
-static int ipw2100_download_firmware(struct ipw2100_priv *priv)
-{
-	u32 address;
-	int err;
-
-#ifndef CONFIG_PM
-	/* Fetch the firmware and microcode */
-	struct ipw2100_fw ipw2100_firmware;
-#endif
-
-	if (priv->fatal_error) {
-		IPW_DEBUG_ERROR("%s: ipw2100_download_firmware called after "
-		       "fatal error %d.  Interface must be brought down.\n",
-		       priv->net_dev->name, priv->fatal_error);
-		return -EINVAL;
-	}
-
-#ifdef CONFIG_PM
-	if (!ipw2100_firmware.version) {
-		err = ipw2100_get_firmware(priv, &ipw2100_firmware);
-		if (err) {
-			IPW_DEBUG_ERROR("%s: ipw2100_get_firmware failed: %d\n",
-			       priv->net_dev->name, err);
-			priv->fatal_error = IPW2100_ERR_FW_LOAD;
-			goto fail;
-		}
-	}
-#else
-	err = ipw2100_get_firmware(priv, &ipw2100_firmware);
-	if (err) {
-		IPW_DEBUG_ERROR("%s: ipw2100_get_firmware failed: %d\n",
-		       priv->net_dev->name, err);
-		priv->fatal_error = IPW2100_ERR_FW_LOAD;
-		goto fail;
-	}
-#endif
-	priv->firmware_version = ipw2100_firmware.version;
-
-	/* s/w reset and clock stabilization */
-	err = sw_reset_and_clock(priv);
-	if (err) {
-		IPW_DEBUG_ERROR("%s: sw_reset_and_clock failed: %d\n",
-		       priv->net_dev->name, err);
-		goto fail;
-	}
-
-	err = ipw2100_verify(priv);
-	if (err) {
-		IPW_DEBUG_ERROR("%s: ipw2100_verify failed: %d\n",
-		       priv->net_dev->name, err);
-		goto fail;
-	}
-
-	/* Hold ARC */
-	write_nic_dword(priv->net_dev,
-			IPW_INTERNAL_REGISTER_HALT_AND_RESET,
-			0x80000000);
-
-	/* allow ARC to run */
-	write_register(priv->net_dev, IPW_REG_RESET_REG, 0);
-
-	/* load microcode */
-	err = ipw2100_ucode_download(priv, &ipw2100_firmware);
-	if (err) {
-		printk(KERN_ERR DRV_NAME ": %s: Error loading microcode: %d\n",
-		       priv->net_dev->name, err);
-		goto fail;
-	}
-
-	/* release ARC */
-	write_nic_dword(priv->net_dev,
-			IPW_INTERNAL_REGISTER_HALT_AND_RESET,
-			0x00000000);
-
-	/* s/w reset and clock stabilization (again!!!) */
-	err = sw_reset_and_clock(priv);
-	if (err) {
-		printk(KERN_ERR DRV_NAME ": %s: sw_reset_and_clock failed: %d\n",
-		       priv->net_dev->name, err);
-		goto fail;
-	}
-
-	/* load f/w */
-	err = ipw2100_fw_download(priv, &ipw2100_firmware);
-	if (err) {
-		IPW_DEBUG_ERROR("%s: Error loading firmware: %d\n",
-		       priv->net_dev->name, err);
-		goto fail;
-	}
-
-#ifndef CONFIG_PM
-	/*
-	 * When the .resume method of the driver is called, the other
-	 * part of the system, i.e. the ide driver could still stay in
-	 * the suspend stage. This prevents us from loading the firmware
-	 * from the disk.  --YZ
-	 */
-
-	/* free any storage allocated for firmware image */
-	ipw2100_release_firmware(priv, &ipw2100_firmware);
-#endif
-
-	/* zero out Domain 1 area indirectly (Si requirement) */
-	for (address = IPW_HOST_FW_SHARED_AREA0;
-	     address < IPW_HOST_FW_SHARED_AREA0_END; address += 4)
-		write_nic_dword(priv->net_dev, address, 0);
-	for (address = IPW_HOST_FW_SHARED_AREA1;
-	     address < IPW_HOST_FW_SHARED_AREA1_END; address += 4)
-		write_nic_dword(priv->net_dev, address, 0);
-	for (address = IPW_HOST_FW_SHARED_AREA2;
-	     address < IPW_HOST_FW_SHARED_AREA2_END; address += 4)
-		write_nic_dword(priv->net_dev, address, 0);
-	for (address = IPW_HOST_FW_SHARED_AREA3;
-	     address < IPW_HOST_FW_SHARED_AREA3_END; address += 4)
-		write_nic_dword(priv->net_dev, address, 0);
-	for (address = IPW_HOST_FW_INTERRUPT_AREA;
-	     address < IPW_HOST_FW_INTERRUPT_AREA_END; address += 4)
-		write_nic_dword(priv->net_dev, address, 0);
-
-	return 0;
-
- fail:
-	ipw2100_release_firmware(priv, &ipw2100_firmware);
-	return err;
-}
-
-static inline void ipw2100_enable_interrupts(struct ipw2100_priv *priv)
-{
-	if (priv->status & STATUS_INT_ENABLED)
-		return;
-	priv->status |= STATUS_INT_ENABLED;
-	write_register(priv->net_dev, IPW_REG_INTA_MASK, IPW_INTERRUPT_MASK);
-}
-
-static inline void ipw2100_disable_interrupts(struct ipw2100_priv *priv)
-{
-	if (!(priv->status & STATUS_INT_ENABLED))
-		return;
-	priv->status &= ~STATUS_INT_ENABLED;
-	write_register(priv->net_dev, IPW_REG_INTA_MASK, 0x0);
-}
-
-
-static void ipw2100_initialize_ordinals(struct ipw2100_priv *priv)
-{
-	struct ipw2100_ordinals *ord = &priv->ordinals;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	read_register(priv->net_dev, IPW_MEM_HOST_SHARED_ORDINALS_TABLE_1,
-		      &ord->table1_addr);
-
-	read_register(priv->net_dev, IPW_MEM_HOST_SHARED_ORDINALS_TABLE_2,
-		      &ord->table2_addr);
-
-	read_nic_dword(priv->net_dev, ord->table1_addr, &ord->table1_size);
-	read_nic_dword(priv->net_dev, ord->table2_addr, &ord->table2_size);
-
-	ord->table2_size &= 0x0000FFFF;
-
-	IPW_DEBUG_INFO("table 1 size: %d\n", ord->table1_size);
-	IPW_DEBUG_INFO("table 2 size: %d\n", ord->table2_size);
-	IPW_DEBUG_INFO("exit\n");
-}
-
-static inline void ipw2100_hw_set_gpio(struct ipw2100_priv *priv)
-{
-	u32 reg = 0;
-	/*
-	 * Set GPIO 3 writable by FW; GPIO 1 writable
-	 * by driver and enable clock
-	 */
-	reg = (IPW_BIT_GPIO_GPIO3_MASK | IPW_BIT_GPIO_GPIO1_ENABLE |
-	       IPW_BIT_GPIO_LED_OFF);
-	write_register(priv->net_dev, IPW_REG_GPIO, reg);
-}
-
-static inline int rf_kill_active(struct ipw2100_priv *priv)
-{
-#define MAX_RF_KILL_CHECKS 5
-#define RF_KILL_CHECK_DELAY 40
-
-	unsigned short value = 0;
-	u32 reg = 0;
-	int i;
-
-	if (!(priv->hw_features & HW_FEATURE_RFKILL)) {
-		priv->status &= ~STATUS_RF_KILL_HW;
-		return 0;
-	}
-
-	for (i = 0; i < MAX_RF_KILL_CHECKS; i++) {
-		udelay(RF_KILL_CHECK_DELAY);
-		read_register(priv->net_dev, IPW_REG_GPIO, &reg);
-		value = (value << 1) | ((reg & IPW_BIT_GPIO_RF_KILL) ? 0 : 1);
-	}
-
-	if (value == 0)
-		priv->status |= STATUS_RF_KILL_HW;
-	else
-		priv->status &= ~STATUS_RF_KILL_HW;
-
-	return (value == 0);
-}
-
-static int ipw2100_get_hw_features(struct ipw2100_priv *priv)
-{
-	u32 addr, len;
-	u32 val;
-
-	/*
-	 * EEPROM_SRAM_DB_START_ADDRESS using ordinal in ordinal table 1
-	 */
-	len = sizeof(addr);
-	if (ipw2100_get_ordinal(
-		    priv, IPW_ORD_EEPROM_SRAM_DB_BLOCK_START_ADDRESS,
-		    &addr, &len)) {
-		IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
-		       __LINE__);
-		return -EIO;
-	}
-
-	IPW_DEBUG_INFO("EEPROM address: %08X\n", addr);
-
-	/*
-	 * EEPROM version is the byte at offset 0xfd in firmware
-	 * We read 4 bytes, then shift out the byte we actually want */
-	read_nic_dword(priv->net_dev, addr + 0xFC, &val);
-	priv->eeprom_version = (val >> 24) & 0xFF;
-	IPW_DEBUG_INFO("EEPROM version: %d\n", priv->eeprom_version);
-
-        /*
-	 *  HW RF Kill enable is bit 0 in byte at offset 0x21 in firmware
-	 *
-	 *  notice that the EEPROM bit is reverse polarity, i.e.
-	 *     bit = 0  signifies HW RF kill switch is supported
-	 *     bit = 1  signifies HW RF kill switch is NOT supported
-	 */
-	read_nic_dword(priv->net_dev, addr + 0x20, &val);
-	if (!((val >> 24) & 0x01))
-		priv->hw_features |= HW_FEATURE_RFKILL;
-
-	IPW_DEBUG_INFO("HW RF Kill: %ssupported.\n",
-			   (priv->hw_features & HW_FEATURE_RFKILL) ?
-			   "" : "not ");
-
-	return 0;
-}
-
-/*
- * Start firmware execution after power on and intialization
- * The sequence is:
- *  1. Release ARC
- *  2. Wait for f/w initialization completes;
- */
-static int ipw2100_start_adapter(struct ipw2100_priv *priv)
-{
-	int i;
-	u32 inta, inta_mask, gpio;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	if (priv->status & STATUS_RUNNING)
-		return 0;
-
-	/*
-	 * Initialize the hw - drive adapter to DO state by setting
-	 * init_done bit. Wait for clk_ready bit and Download
-	 * fw & dino ucode
-	 */
-	if (ipw2100_download_firmware(priv)) {
-		printk(KERN_ERR DRV_NAME ": %s: Failed to power on the adapter.\n",
-		       priv->net_dev->name);
-		return -EIO;
-	}
-
-	/* Clear the Tx, Rx and Msg queues and the r/w indexes
-	 * in the firmware RBD and TBD ring queue */
-	ipw2100_queues_initialize(priv);
-
-	ipw2100_hw_set_gpio(priv);
-
-	/* TODO -- Look at disabling interrupts here to make sure none
-	 * get fired during FW initialization */
-
-	/* Release ARC - clear reset bit */
-	write_register(priv->net_dev, IPW_REG_RESET_REG, 0);
-
-	/* wait for f/w intialization complete */
-	IPW_DEBUG_FW("Waiting for f/w initialization to complete...\n");
-	i = 5000;
-	do {
-  		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(40 * HZ / 1000);
-		/* Todo... wait for sync command ... */
-
-		read_register(priv->net_dev, IPW_REG_INTA, &inta);
-
-		/* check "init done" bit */
-		if (inta & IPW2100_INTA_FW_INIT_DONE) {
-			/* reset "init done" bit */
-			write_register(priv->net_dev, IPW_REG_INTA,
-				       IPW2100_INTA_FW_INIT_DONE);
-			break;
-		}
-
-		/* check error conditions : we check these after the firmware
-		 * check so that if there is an error, the interrupt handler
-		 * will see it and the adapter will be reset */
-		if (inta &
-		    (IPW2100_INTA_FATAL_ERROR | IPW2100_INTA_PARITY_ERROR)) {
-			/* clear error conditions */
-			write_register(priv->net_dev, IPW_REG_INTA,
-				       IPW2100_INTA_FATAL_ERROR |
-				       IPW2100_INTA_PARITY_ERROR);
-		}
-	} while (i--);
-
-	/* Clear out any pending INTAs since we aren't supposed to have
-	 * interrupts enabled at this point... */
-	read_register(priv->net_dev, IPW_REG_INTA, &inta);
-	read_register(priv->net_dev, IPW_REG_INTA_MASK, &inta_mask);
-	inta &= IPW_INTERRUPT_MASK;
-	/* Clear out any pending interrupts */
-	if (inta & inta_mask)
-		write_register(priv->net_dev, IPW_REG_INTA, inta);
-
-	IPW_DEBUG_FW("f/w initialization complete: %s\n",
-		     i ? "SUCCESS" : "FAILED");
-
-	if (!i) {
-		printk(KERN_WARNING DRV_NAME ": %s: Firmware did not initialize.\n",
-		       priv->net_dev->name);
-		return -EIO;
-	}
-
-	/* allow firmware to write to GPIO1 & GPIO3 */
-	read_register(priv->net_dev, IPW_REG_GPIO, &gpio);
-
-	gpio |= (IPW_BIT_GPIO_GPIO1_MASK | IPW_BIT_GPIO_GPIO3_MASK);
-
-	write_register(priv->net_dev, IPW_REG_GPIO, gpio);
-
-	/* Ready to receive commands */
-	priv->status |= STATUS_RUNNING;
-
-	/* The adapter has been reset; we are not associated */
-	priv->status &= ~(STATUS_ASSOCIATING | STATUS_ASSOCIATED);
-
-	IPW_DEBUG_INFO("exit\n");
-
-	return 0;
-}
-
-static inline void ipw2100_reset_fatalerror(struct ipw2100_priv *priv)
-{
-	if (!priv->fatal_error)
-		return;
-
-	priv->fatal_errors[priv->fatal_index++] = priv->fatal_error;
-	priv->fatal_index %= IPW2100_ERROR_QUEUE;
-	priv->fatal_error = 0;
-}
-
-
-/* NOTE: Our interrupt is disabled when this method is called */
-static int ipw2100_power_cycle_adapter(struct ipw2100_priv *priv)
-{
-	u32 reg;
-	int i;
-
-	IPW_DEBUG_INFO("Power cycling the hardware.\n");
-
-	ipw2100_hw_set_gpio(priv);
-
-	/* Step 1. Stop Master Assert */
-	write_register(priv->net_dev, IPW_REG_RESET_REG,
-		       IPW_AUX_HOST_RESET_REG_STOP_MASTER);
-
-	/* Step 2. Wait for stop Master Assert
-	 *         (not more then 50us, otherwise ret error */
-	i = 5;
-	do {
-		udelay(IPW_WAIT_RESET_MASTER_ASSERT_COMPLETE_DELAY);
-		read_register(priv->net_dev, IPW_REG_RESET_REG, &reg);
-
-		if (reg & IPW_AUX_HOST_RESET_REG_MASTER_DISABLED)
-			break;
-	}  while(i--);
-
-	priv->status &= ~STATUS_RESET_PENDING;
-
-	if (!i) {
-		IPW_DEBUG_INFO("exit - waited too long for master assert stop\n");
-		return -EIO;
-	}
-
-	write_register(priv->net_dev, IPW_REG_RESET_REG,
-		       IPW_AUX_HOST_RESET_REG_SW_RESET);
-
-
-	/* Reset any fatal_error conditions */
-	ipw2100_reset_fatalerror(priv);
-
-	/* At this point, the adapter is now stopped and disabled */
-	priv->status &= ~(STATUS_RUNNING | STATUS_ASSOCIATING |
-			  STATUS_ASSOCIATED | STATUS_ENABLED);
-
-	return 0;
-}
-
-/*
- * Send the CARD_DISABLE_PHY_OFF comamnd to the card to disable it
- *
- * After disabling, if the card was associated, a STATUS_ASSN_LOST will be sent.
- *
- * STATUS_CARD_DISABLE_NOTIFICATION will be sent regardless of
- * if STATUS_ASSN_LOST is sent.
- */
-static int ipw2100_hw_phy_off(struct ipw2100_priv *priv)
-{
-
-#define HW_PHY_OFF_LOOP_DELAY (HZ / 5000)
-
-	struct host_command cmd = {
-		.host_command = CARD_DISABLE_PHY_OFF,
-		.host_command_sequence = 0,
-		.host_command_length = 0,
-	};
-	int err, i;
-	u32 val1, val2;
-
-	IPW_DEBUG_HC("CARD_DISABLE_PHY_OFF\n");
-
-	/* Turn off the radio */
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err)
-		return err;
-
-	for (i = 0; i < 2500; i++) {
-		read_nic_dword(priv->net_dev, IPW2100_CONTROL_REG, &val1);
-		read_nic_dword(priv->net_dev, IPW2100_COMMAND, &val2);
-
-		if ((val1 & IPW2100_CONTROL_PHY_OFF) &&
-		    (val2 & IPW2100_COMMAND_PHY_OFF))
-			return 0;
-
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(HW_PHY_OFF_LOOP_DELAY);
-	}
-
-	return -EIO;
-}
-
-
-static int ipw2100_enable_adapter(struct ipw2100_priv *priv)
-{
-	struct host_command cmd = {
-		.host_command = HOST_COMPLETE,
-		.host_command_sequence = 0,
-		.host_command_length = 0
-	};
-	int err = 0;
-
-	IPW_DEBUG_HC("HOST_COMPLETE\n");
-
-	if (priv->status & STATUS_ENABLED)
-		return 0;
-
-	down(&priv->adapter_sem);
-
-	if (rf_kill_active(priv)) {
-		IPW_DEBUG_HC("Command aborted due to RF kill active.\n");
-		goto fail_up;
-	}
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err) {
-		IPW_DEBUG_INFO("Failed to send HOST_COMPLETE command\n");
-		goto fail_up;
-	}
-
-	err = ipw2100_wait_for_card_state(priv, IPW_HW_STATE_ENABLED);
-	if (err) {
-		IPW_DEBUG_INFO(
-		       "%s: card not responding to init command.\n",
-		       priv->net_dev->name);
-		goto fail_up;
-	}
-
-	if (priv->stop_hang_check) {
-		priv->stop_hang_check = 0;
-		queue_delayed_work(priv->workqueue, &priv->hang_check, HZ / 2);
-	}
-
-fail_up:
-	up(&priv->adapter_sem);
-	return err;
-}
-
-static int ipw2100_hw_stop_adapter(struct ipw2100_priv *priv)
-{
-#define HW_POWER_DOWN_DELAY (HZ / 10)
-
-	struct host_command cmd = {
-		.host_command = HOST_PRE_POWER_DOWN,
-		.host_command_sequence = 0,
-		.host_command_length = 0,
-	};
-	int err, i;
-	u32 reg;
-
-	if (!(priv->status & STATUS_RUNNING))
-		return 0;
-
-	priv->status |= STATUS_STOPPING;
-
-	/* We can only shut down the card if the firmware is operational.  So,
-	 * if we haven't reset since a fatal_error, then we can not send the
-	 * shutdown commands. */
-	if (!priv->fatal_error) {
-		/* First, make sure the adapter is enabled so that the PHY_OFF
-		 * command can shut it down */
-		ipw2100_enable_adapter(priv);
-
-		err = ipw2100_hw_phy_off(priv);
-		if (err)
-			printk(KERN_WARNING DRV_NAME ": Error disabling radio %d\n", err);
-
-		/*
-		 * If in D0-standby mode going directly to D3 may cause a
-		 * PCI bus violation.  Therefore we must change out of the D0
-		 * state.
-		 *
-		 * Sending the PREPARE_FOR_POWER_DOWN will restrict the
-		 * hardware from going into standby mode and will transition
-		 * out of D0-standy if it is already in that state.
-		 *
-		 * STATUS_PREPARE_POWER_DOWN_COMPLETE will be sent by the
-		 * driver upon completion.  Once received, the driver can
-		 * proceed to the D3 state.
-		 *
-		 * Prepare for power down command to fw.  This command would
-		 * take HW out of D0-standby and prepare it for D3 state.
-		 *
-		 * Currently FW does not support event notification for this
-		 * event. Therefore, skip waiting for it.  Just wait a fixed
-		 * 100ms
-		 */
-		IPW_DEBUG_HC("HOST_PRE_POWER_DOWN\n");
-
-		err = ipw2100_hw_send_command(priv, &cmd);
-		if (err)
-			printk(KERN_WARNING DRV_NAME ": "
-			       "%s: Power down command failed: Error %d\n",
-			       priv->net_dev->name, err);
-		else {
-			set_current_state(TASK_UNINTERRUPTIBLE);
-			schedule_timeout(HW_POWER_DOWN_DELAY);
-		}
-	}
-
-	priv->status &= ~STATUS_ENABLED;
-
-	/*
-	 * Set GPIO 3 writable by FW; GPIO 1 writable
-	 * by driver and enable clock
-	 */
-	ipw2100_hw_set_gpio(priv);
-
-	/*
-	 * Power down adapter.  Sequence:
-	 * 1. Stop master assert (RESET_REG[9]=1)
-	 * 2. Wait for stop master (RESET_REG[8]==1)
-	 * 3. S/w reset assert (RESET_REG[7] = 1)
-	 */
-
-	/* Stop master assert */
-	write_register(priv->net_dev, IPW_REG_RESET_REG,
-		       IPW_AUX_HOST_RESET_REG_STOP_MASTER);
-
-	/* wait stop master not more than 50 usec.
-	 * Otherwise return error. */
-	for (i = 5; i > 0; i--) {
-		udelay(10);
-
-		/* Check master stop bit */
-		read_register(priv->net_dev, IPW_REG_RESET_REG, &reg);
-
-		if (reg & IPW_AUX_HOST_RESET_REG_MASTER_DISABLED)
-			break;
-	}
-
-	if (i == 0)
-		printk(KERN_WARNING DRV_NAME
-		       ": %s: Could now power down adapter.\n",
-		       priv->net_dev->name);
-
-	/* assert s/w reset */
-	write_register(priv->net_dev, IPW_REG_RESET_REG,
-		       IPW_AUX_HOST_RESET_REG_SW_RESET);
-
-	priv->status &= ~(STATUS_RUNNING | STATUS_STOPPING);
-
-	return 0;
-}
-
-
-static int ipw2100_disable_adapter(struct ipw2100_priv *priv)
-{
-	struct host_command cmd = {
-		.host_command = CARD_DISABLE,
-		.host_command_sequence = 0,
-		.host_command_length = 0
-	};
-	int err = 0;
-
-	IPW_DEBUG_HC("CARD_DISABLE\n");
-
-	if (!(priv->status & STATUS_ENABLED))
-		return 0;
-
-	/* Make sure we clear the associated state */
-	priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
-
-	if (!priv->stop_hang_check) {
-		priv->stop_hang_check = 1;
-		cancel_delayed_work(&priv->hang_check);
-	}
-
-	down(&priv->adapter_sem);
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err) {
-		printk(KERN_WARNING DRV_NAME ": exit - failed to send CARD_DISABLE command\n");
-		goto fail_up;
-	}
-
-	err = ipw2100_wait_for_card_state(priv, IPW_HW_STATE_DISABLED);
-	if (err) {
-		printk(KERN_WARNING DRV_NAME ": exit - card failed to change to DISABLED\n");
-		goto fail_up;
-	}
-
-	IPW_DEBUG_INFO("TODO: implement scan state machine\n");
-
-fail_up:
-	up(&priv->adapter_sem);
-	return err;
-}
-
-static int ipw2100_set_scan_options(struct ipw2100_priv *priv)
-{
-	struct host_command cmd = {
-		.host_command = SET_SCAN_OPTIONS,
-		.host_command_sequence = 0,
-		.host_command_length = 8
-	};
-	int err;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	IPW_DEBUG_SCAN("setting scan options\n");
-
-	cmd.host_command_parameters[0] = 0;
-
-	if (!(priv->config & CFG_ASSOCIATE))
-		cmd.host_command_parameters[0] |= IPW_SCAN_NOASSOCIATE;
-	if ((priv->sec.flags & SEC_ENABLED) && priv->sec.enabled)
-		cmd.host_command_parameters[0] |= IPW_SCAN_MIXED_CELL;
-	if (priv->config & CFG_PASSIVE_SCAN)
-		cmd.host_command_parameters[0] |= IPW_SCAN_PASSIVE;
-
-	cmd.host_command_parameters[1] = priv->channel_mask;
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	IPW_DEBUG_HC("SET_SCAN_OPTIONS 0x%04X\n",
-		     cmd.host_command_parameters[0]);
-
-	return err;
-}
-
-static int ipw2100_start_scan(struct ipw2100_priv *priv)
-{
-	struct host_command cmd = {
-		.host_command = BROADCAST_SCAN,
-		.host_command_sequence = 0,
-		.host_command_length = 4
-	};
-	int err;
-
-	IPW_DEBUG_HC("START_SCAN\n");
-
-	cmd.host_command_parameters[0] = 0;
-
-	/* No scanning if in monitor mode */
-	if (priv->ieee->iw_mode == IW_MODE_MONITOR)
-		return 1;
-
-	if (priv->status & STATUS_SCANNING) {
-		IPW_DEBUG_SCAN("Scan requested while already in scan...\n");
-		return 0;
-	}
-
-	IPW_DEBUG_INFO("enter\n");
-
-	/* Not clearing here; doing so makes iwlist always return nothing...
-	 *
-	 * We should modify the table logic to use aging tables vs. clearing
-	 * the table on each scan start.
-	 */
-	IPW_DEBUG_SCAN("starting scan\n");
-
-	priv->status |= STATUS_SCANNING;
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err)
-		priv->status &= ~STATUS_SCANNING;
-
-	IPW_DEBUG_INFO("exit\n");
-
-	return err;
-}
-
-static int ipw2100_up(struct ipw2100_priv *priv, int deferred)
-{
-	unsigned long flags;
-	int rc = 0;
-	u32 lock;
-	u32 ord_len = sizeof(lock);
-
-	/* Quite if manually disabled. */
-	if (priv->status & STATUS_RF_KILL_SW) {
-		IPW_DEBUG_INFO("%s: Radio is disabled by Manual Disable "
-			       "switch\n", priv->net_dev->name);
-		return 0;
-	}
-
-	/* If the interrupt is enabled, turn it off... */
-	spin_lock_irqsave(&priv->low_lock, flags);
-	ipw2100_disable_interrupts(priv);
-
-	/* Reset any fatal_error conditions */
-	ipw2100_reset_fatalerror(priv);
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-
-	if (priv->status & STATUS_POWERED ||
-	    (priv->status & STATUS_RESET_PENDING)) {
-		/* Power cycle the card ... */
-		if (ipw2100_power_cycle_adapter(priv)) {
-			printk(KERN_WARNING DRV_NAME ": %s: Could not cycle adapter.\n",
-					  priv->net_dev->name);
-			rc = 1;
-			goto exit;
-		}
-	} else
-		priv->status |= STATUS_POWERED;
-
-	/* Load the firmware, start the clocks, etc. */
-	if (ipw2100_start_adapter(priv)) {
-	       	printk(KERN_ERR DRV_NAME ": %s: Failed to start the firmware.\n",
-				priv->net_dev->name);
-		rc = 1;
-		goto exit;
-	}
-
-	ipw2100_initialize_ordinals(priv);
-
-	/* Determine capabilities of this particular HW configuration */
-	if (ipw2100_get_hw_features(priv)) {
-		printk(KERN_ERR DRV_NAME ": %s: Failed to determine HW features.\n",
-				priv->net_dev->name);
-		rc = 1;
-		goto exit;
-	}
-
-	lock = LOCK_NONE;
-	if (ipw2100_set_ordinal(priv, IPW_ORD_PERS_DB_LOCK, &lock, &ord_len)) {
-		printk(KERN_ERR DRV_NAME ": %s: Failed to clear ordinal lock.\n",
-				priv->net_dev->name);
-		rc = 1;
-		goto exit;
-	}
-
-	priv->status &= ~STATUS_SCANNING;
-
-	if (rf_kill_active(priv)) {
-		printk(KERN_INFO "%s: Radio is disabled by RF switch.\n",
-		       priv->net_dev->name);
-
-		if (priv->stop_rf_kill) {
-			priv->stop_rf_kill = 0;
-			queue_delayed_work(priv->workqueue, &priv->rf_kill, HZ);
-		}
-
-		deferred = 1;
-	}
-
-	/* Turn on the interrupt so that commands can be processed */
-	ipw2100_enable_interrupts(priv);
-
-	/* Send all of the commands that must be sent prior to
-	 * HOST_COMPLETE */
-	if (ipw2100_adapter_setup(priv)) {
-		printk(KERN_ERR DRV_NAME ": %s: Failed to start the card.\n",
-				priv->net_dev->name);
-		rc = 1;
-		goto exit;
-	}
-
-	if (!deferred) {
-		/* Enable the adapter - sends HOST_COMPLETE */
-		if (ipw2100_enable_adapter(priv)) {
-			printk(KERN_ERR DRV_NAME ": "
-				"%s: failed in call to enable adapter.\n",
-				priv->net_dev->name);
-			ipw2100_hw_stop_adapter(priv);
-			rc = 1;
-			goto exit;
-		}
-
-
-		/* Start a scan . . . */
-		ipw2100_set_scan_options(priv);
-		ipw2100_start_scan(priv);
-	}
-
- exit:
-	return rc;
-}
-
-/* Called by register_netdev() */
-static int ipw2100_net_init(struct net_device *dev)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	return ipw2100_up(priv, 1);
-}
-
-static void ipw2100_down(struct ipw2100_priv *priv)
-{
-	unsigned long flags;
-	union iwreq_data wrqu = {
-		.ap_addr = {
-			.sa_family = ARPHRD_ETHER
-		}
-	};
-	int associated = priv->status & STATUS_ASSOCIATED;
-
-	/* Kill the RF switch timer */
-	if (!priv->stop_rf_kill) {
-		priv->stop_rf_kill = 1;
-		cancel_delayed_work(&priv->rf_kill);
-	}
-
-	/* Kill the firmare hang check timer */
-	if (!priv->stop_hang_check) {
-		priv->stop_hang_check = 1;
-		cancel_delayed_work(&priv->hang_check);
-	}
-
-	/* Kill any pending resets */
-	if (priv->status & STATUS_RESET_PENDING)
-		cancel_delayed_work(&priv->reset_work);
-
-	/* Make sure the interrupt is on so that FW commands will be
-	 * processed correctly */
-	spin_lock_irqsave(&priv->low_lock, flags);
-	ipw2100_enable_interrupts(priv);
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-
-	if (ipw2100_hw_stop_adapter(priv))
-		printk(KERN_ERR DRV_NAME ": %s: Error stopping adapter.\n",
-		       priv->net_dev->name);
-
-	/* Do not disable the interrupt until _after_ we disable
-	 * the adaptor.  Otherwise the CARD_DISABLE command will never
-	 * be ack'd by the firmware */
-	spin_lock_irqsave(&priv->low_lock, flags);
-	ipw2100_disable_interrupts(priv);
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-
-#ifdef ACPI_CSTATE_LIMIT_DEFINED
-	if (priv->config & CFG_C3_DISABLED) {
-		IPW_DEBUG_INFO(DRV_NAME ": Resetting C3 transitions.\n");
-		acpi_set_cstate_limit(priv->cstate_limit);
-		priv->config &= ~CFG_C3_DISABLED;
-	}
-#endif
-
-	/* We have to signal any supplicant if we are disassociating */
-	if (associated)
-		wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
-
-	priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
-	netif_carrier_off(priv->net_dev);
-	netif_stop_queue(priv->net_dev);
-}
-
-static void ipw2100_reset_adapter(struct ipw2100_priv *priv)
-{
-	unsigned long flags;
-	union iwreq_data wrqu = {
-		.ap_addr = {
-			.sa_family = ARPHRD_ETHER
-		}
-	};
-	int associated = priv->status & STATUS_ASSOCIATED;
-
-	spin_lock_irqsave(&priv->low_lock, flags);
-	IPW_DEBUG_INFO(DRV_NAME ": %s: Restarting adapter.\n",
-		       priv->net_dev->name);
-	priv->resets++;
-	priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
-	priv->status |= STATUS_SECURITY_UPDATED;
-
-	/* Force a power cycle even if interface hasn't been opened
-	 * yet */
-	cancel_delayed_work(&priv->reset_work);
-	priv->status |= STATUS_RESET_PENDING;
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-
-	down(&priv->action_sem);
-	/* stop timed checks so that they don't interfere with reset */
-	priv->stop_hang_check = 1;
-	cancel_delayed_work(&priv->hang_check);
-
-	/* We have to signal any supplicant if we are disassociating */
-	if (associated)
-		wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
-
-	ipw2100_up(priv, 0);
-	up(&priv->action_sem);
-
-}
-
-
-static void isr_indicate_associated(struct ipw2100_priv *priv, u32 status)
-{
-
-#define MAC_ASSOCIATION_READ_DELAY (HZ)
-	int ret, len, essid_len;
-	char essid[IW_ESSID_MAX_SIZE];
-	u32 txrate;
-	u32 chan;
-	char *txratename;
- 	u8 bssid[ETH_ALEN];
-
-	/*
-	 * TBD: BSSID is usually 00:00:00:00:00:00 here and not
-	 *      an actual MAC of the AP. Seems like FW sets this
-	 *      address too late. Read it later and expose through
-	 *      /proc or schedule a later task to query and update
-	 */
-
-	essid_len = IW_ESSID_MAX_SIZE;
-	ret = ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_SSID,
-				  essid, &essid_len);
-	if (ret) {
-		IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
-				   __LINE__);
-		return;
-	}
-
-	len = sizeof(u32);
-	ret = ipw2100_get_ordinal(priv, IPW_ORD_CURRENT_TX_RATE,
-				  &txrate, &len);
-	if (ret) {
-		IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
-				   __LINE__);
-		return;
-	}
-
-	len = sizeof(u32);
-	ret = ipw2100_get_ordinal(priv, IPW_ORD_OUR_FREQ, &chan, &len);
-	if (ret) {
-		IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
-				   __LINE__);
-		return;
-	}
-	len = ETH_ALEN;
-        ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_AP_BSSID, &bssid,  &len);
-	if (ret) {
-		IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
-				   __LINE__);
-		return;
-	}
-	memcpy(priv->ieee->bssid, bssid, ETH_ALEN);
-
-
-	switch (txrate) {
-	case TX_RATE_1_MBIT:
-		txratename = "1Mbps";
-		break;
-	case TX_RATE_2_MBIT:
-		txratename = "2Mbsp";
-		break;
-	case TX_RATE_5_5_MBIT:
-		txratename = "5.5Mbps";
-		break;
-	case TX_RATE_11_MBIT:
-		txratename = "11Mbps";
-		break;
-	default:
-		IPW_DEBUG_INFO("Unknown rate: %d\n", txrate);
-		txratename = "unknown rate";
-		break;
-	}
-
-	IPW_DEBUG_INFO("%s: Associated with '%s' at %s, channel %d (BSSID="
-		       MAC_FMT ")\n",
-		       priv->net_dev->name, escape_essid(essid, essid_len),
-		       txratename, chan, MAC_ARG(bssid));
-
-	/* now we copy read ssid into dev */
-	if (!(priv->config & CFG_STATIC_ESSID)) {
-		priv->essid_len = min((u8)essid_len, (u8)IW_ESSID_MAX_SIZE);
-		memcpy(priv->essid, essid, priv->essid_len);
-	}
-	priv->channel = chan;
-	memcpy(priv->bssid, bssid, ETH_ALEN);
-
-	priv->status |= STATUS_ASSOCIATING;
-	priv->connect_start = get_seconds();
-
-	queue_delayed_work(priv->workqueue, &priv->wx_event_work, HZ / 10);
-}
-
-
-static int ipw2100_set_essid(struct ipw2100_priv *priv, char *essid,
-			     int length, int batch_mode)
-{
-	int ssid_len = min(length, IW_ESSID_MAX_SIZE);
-	struct host_command cmd = {
-		.host_command = SSID,
-		.host_command_sequence = 0,
-		.host_command_length = ssid_len
-	};
-	int err;
-
-	IPW_DEBUG_HC("SSID: '%s'\n", escape_essid(essid, ssid_len));
-
-	if (ssid_len)
-		memcpy((char*)cmd.host_command_parameters,
-		       essid, ssid_len);
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	/* Bug in FW currently doesn't honor bit 0 in SET_SCAN_OPTIONS to
-	 * disable auto association -- so we cheat by setting a bogus SSID */
-	if (!ssid_len && !(priv->config & CFG_ASSOCIATE)) {
-		int i;
-		u8 *bogus = (u8*)cmd.host_command_parameters;
-		for (i = 0; i < IW_ESSID_MAX_SIZE; i++)
-			bogus[i] = 0x18 + i;
-		cmd.host_command_length = IW_ESSID_MAX_SIZE;
-	}
-
-	/* NOTE:  We always send the SSID command even if the provided ESSID is
-	 * the same as what we currently think is set. */
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (!err) {
-		memset(priv->essid + ssid_len, 0,
-		       IW_ESSID_MAX_SIZE - ssid_len);
-		memcpy(priv->essid, essid, ssid_len);
-		priv->essid_len = ssid_len;
-	}
-
-	if (!batch_mode) {
-		if (ipw2100_enable_adapter(priv))
-			err = -EIO;
-	}
-
-	return err;
-}
-
-static void isr_indicate_association_lost(struct ipw2100_priv *priv, u32 status)
-{
-	IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-		  "disassociated: '%s' " MAC_FMT " \n",
-		  escape_essid(priv->essid, priv->essid_len),
-		  MAC_ARG(priv->bssid));
-
-	priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
-
-	if (priv->status & STATUS_STOPPING) {
-		IPW_DEBUG_INFO("Card is stopping itself, discard ASSN_LOST.\n");
-		return;
-	}
-
-	memset(priv->bssid, 0, ETH_ALEN);
-	memset(priv->ieee->bssid, 0, ETH_ALEN);
-
-	netif_carrier_off(priv->net_dev);
-	netif_stop_queue(priv->net_dev);
-
-	if (!(priv->status & STATUS_RUNNING))
-		return;
-
-	if (priv->status & STATUS_SECURITY_UPDATED)
-		queue_work(priv->workqueue, &priv->security_work);
-
-	queue_work(priv->workqueue, &priv->wx_event_work);
-}
-
-static void isr_indicate_rf_kill(struct ipw2100_priv *priv, u32 status)
-{
-	IPW_DEBUG_INFO("%s: RF Kill state changed to radio OFF.\n",
-	       priv->net_dev->name);
-
-	/* RF_KILL is now enabled (else we wouldn't be here) */
-	priv->status |= STATUS_RF_KILL_HW;
-
-#ifdef ACPI_CSTATE_LIMIT_DEFINED
-	if (priv->config & CFG_C3_DISABLED) {
-		IPW_DEBUG_INFO(DRV_NAME ": Resetting C3 transitions.\n");
-		acpi_set_cstate_limit(priv->cstate_limit);
-		priv->config &= ~CFG_C3_DISABLED;
-	}
-#endif
-
-	/* Make sure the RF Kill check timer is running */
-	priv->stop_rf_kill = 0;
-	cancel_delayed_work(&priv->rf_kill);
-	queue_delayed_work(priv->workqueue, &priv->rf_kill, HZ);
-}
-
-static void isr_scan_complete(struct ipw2100_priv *priv, u32 status)
-{
-	IPW_DEBUG_SCAN("scan complete\n");
-	/* Age the scan results... */
-	priv->ieee->scans++;
-	priv->status &= ~STATUS_SCANNING;
-}
-
-#ifdef CONFIG_IPW_DEBUG
-#define IPW2100_HANDLER(v, f) { v, f, # v }
-struct ipw2100_status_indicator {
-	int status;
-	void (*cb)(struct ipw2100_priv *priv, u32 status);
-	char *name;
-};
-#else
-#define IPW2100_HANDLER(v, f) { v, f }
-struct ipw2100_status_indicator {
-	int status;
-	void (*cb)(struct ipw2100_priv *priv, u32 status);
-};
-#endif /* CONFIG_IPW_DEBUG */
-
-static void isr_indicate_scanning(struct ipw2100_priv *priv, u32 status)
-{
-	IPW_DEBUG_SCAN("Scanning...\n");
-	priv->status |= STATUS_SCANNING;
-}
-
-static const struct ipw2100_status_indicator status_handlers[] = {
-	IPW2100_HANDLER(IPW_STATE_INITIALIZED, 0),
-	IPW2100_HANDLER(IPW_STATE_COUNTRY_FOUND, 0),
-	IPW2100_HANDLER(IPW_STATE_ASSOCIATED, isr_indicate_associated),
-	IPW2100_HANDLER(IPW_STATE_ASSN_LOST, isr_indicate_association_lost),
-	IPW2100_HANDLER(IPW_STATE_ASSN_CHANGED, 0),
-	IPW2100_HANDLER(IPW_STATE_SCAN_COMPLETE, isr_scan_complete),
-	IPW2100_HANDLER(IPW_STATE_ENTERED_PSP, 0),
-	IPW2100_HANDLER(IPW_STATE_LEFT_PSP, 0),
-	IPW2100_HANDLER(IPW_STATE_RF_KILL, isr_indicate_rf_kill),
-	IPW2100_HANDLER(IPW_STATE_DISABLED, 0),
-	IPW2100_HANDLER(IPW_STATE_POWER_DOWN, 0),
-	IPW2100_HANDLER(IPW_STATE_SCANNING, isr_indicate_scanning),
-	IPW2100_HANDLER(-1, 0)
-};
-
-
-static void isr_status_change(struct ipw2100_priv *priv, int status)
-{
-	int i;
-
-	if (status == IPW_STATE_SCANNING &&
-	    priv->status & STATUS_ASSOCIATED &&
-	    !(priv->status & STATUS_SCANNING)) {
-		IPW_DEBUG_INFO("Scan detected while associated, with "
-			       "no scan request.  Restarting firmware.\n");
-
-		/* Wake up any sleeping jobs */
-		schedule_reset(priv);
-	}
-
-	for (i = 0; status_handlers[i].status != -1; i++) {
-		if (status == status_handlers[i].status) {
-			IPW_DEBUG_NOTIF("Status change: %s\n",
-					 status_handlers[i].name);
-			if (status_handlers[i].cb)
-				status_handlers[i].cb(priv, status);
-			priv->wstats.status = status;
-			return;
-		}
-	}
-
-	IPW_DEBUG_NOTIF("unknown status received: %04x\n", status);
-}
-
-static void isr_rx_complete_command(
-	struct ipw2100_priv *priv,
-	struct ipw2100_cmd_header *cmd)
-{
-#ifdef CONFIG_IPW_DEBUG
-	if (cmd->host_command_reg < ARRAY_SIZE(command_types)) {
-		IPW_DEBUG_HC("Command completed '%s (%d)'\n",
-			     command_types[cmd->host_command_reg],
-			     cmd->host_command_reg);
-	}
-#endif
-	if (cmd->host_command_reg == HOST_COMPLETE)
-		priv->status |= STATUS_ENABLED;
-
-	if (cmd->host_command_reg == CARD_DISABLE)
-		priv->status &= ~STATUS_ENABLED;
-
-	priv->status &= ~STATUS_CMD_ACTIVE;
-
-	wake_up_interruptible(&priv->wait_command_queue);
-}
-
-#ifdef CONFIG_IPW_DEBUG
-static const char *frame_types[] = {
-	"COMMAND_STATUS_VAL",
-	"STATUS_CHANGE_VAL",
-	"P80211_DATA_VAL",
-	"P8023_DATA_VAL",
-	"HOST_NOTIFICATION_VAL"
-};
-#endif
-
-
-static inline int ipw2100_alloc_skb(
-	struct ipw2100_priv *priv,
-	struct ipw2100_rx_packet *packet)
-{
-	packet->skb = dev_alloc_skb(sizeof(struct ipw2100_rx));
-	if (!packet->skb)
-		return -ENOMEM;
-
-	packet->rxp = (struct ipw2100_rx *)packet->skb->data;
-	packet->dma_addr = pci_map_single(priv->pci_dev, packet->skb->data,
-					  sizeof(struct ipw2100_rx),
-					  PCI_DMA_FROMDEVICE);
-	/* NOTE: pci_map_single does not return an error code, and 0 is a valid
-	 *       dma_addr */
-
-	return 0;
-}
-
-
-#define SEARCH_ERROR   0xffffffff
-#define SEARCH_FAIL    0xfffffffe
-#define SEARCH_SUCCESS 0xfffffff0
-#define SEARCH_DISCARD 0
-#define SEARCH_SNAPSHOT 1
-
-#define SNAPSHOT_ADDR(ofs) (priv->snapshot[((ofs) >> 12) & 0xff] + ((ofs) & 0xfff))
-static inline int ipw2100_snapshot_alloc(struct ipw2100_priv *priv)
-{
-	int i;
-	if (priv->snapshot[0])
-		return 1;
-	for (i = 0; i < 0x30; i++) {
-		priv->snapshot[i] = (u8*)kmalloc(0x1000, GFP_ATOMIC);
-		if (!priv->snapshot[i]) {
-			IPW_DEBUG_INFO("%s: Error allocating snapshot "
-			       "buffer %d\n", priv->net_dev->name, i);
-			while (i > 0)
-				kfree(priv->snapshot[--i]);
-			priv->snapshot[0] = NULL;
-			return 0;
-		}
-	}
-
-	return 1;
-}
-
-static inline void ipw2100_snapshot_free(struct ipw2100_priv *priv)
-{
-	int i;
-	if (!priv->snapshot[0])
-		return;
-	for (i = 0; i < 0x30; i++)
-		kfree(priv->snapshot[i]);
-	priv->snapshot[0] = NULL;
-}
-
-static inline u32 ipw2100_match_buf(struct ipw2100_priv *priv, u8 *in_buf,
-				    size_t len, int mode)
-{
-	u32 i, j;
-	u32 tmp;
-	u8 *s, *d;
-	u32 ret;
-
-	s = in_buf;
-	if (mode == SEARCH_SNAPSHOT) {
-		if (!ipw2100_snapshot_alloc(priv))
-			mode = SEARCH_DISCARD;
-	}
-
-	for (ret = SEARCH_FAIL, i = 0; i < 0x30000; i += 4) {
-		read_nic_dword(priv->net_dev, i, &tmp);
-		if (mode == SEARCH_SNAPSHOT)
-			*(u32 *)SNAPSHOT_ADDR(i) = tmp;
-		if (ret == SEARCH_FAIL) {
-			d = (u8*)&tmp;
-			for (j = 0; j < 4; j++) {
-				if (*s != *d) {
-					s = in_buf;
-					continue;
-				}
-
-				s++;
-				d++;
-
-				if ((s - in_buf) == len)
-					ret = (i + j) - len + 1;
-			}
-		} else if (mode == SEARCH_DISCARD)
-			return ret;
-	}
-
-	return ret;
-}
-
-/*
- *
- * 0) Disconnect the SKB from the firmware (just unmap)
- * 1) Pack the ETH header into the SKB
- * 2) Pass the SKB to the network stack
- *
- * When packet is provided by the firmware, it contains the following:
- *
- * .  ieee80211_hdr
- * .  ieee80211_snap_hdr
- *
- * The size of the constructed ethernet
- *
- */
-#ifdef CONFIG_IPW2100_RX_DEBUG
-static u8 packet_data[IPW_RX_NIC_BUFFER_LENGTH];
-#endif
-
-static inline void ipw2100_corruption_detected(struct ipw2100_priv *priv,
-					       int i)
-{
-#ifdef CONFIG_IPW_DEBUG_C3
-	struct ipw2100_status *status = &priv->status_queue.drv[i];
-	u32 match, reg;
-	int j;
-#endif
-#ifdef ACPI_CSTATE_LIMIT_DEFINED
-	int limit;
-#endif
-
-	IPW_DEBUG_INFO(DRV_NAME ": PCI latency error detected at "
-		       "0x%04zX.\n", i * sizeof(struct ipw2100_status));
-
-#ifdef ACPI_CSTATE_LIMIT_DEFINED
-	IPW_DEBUG_INFO(DRV_NAME ": Disabling C3 transitions.\n");
-	limit = acpi_get_cstate_limit();
-	if (limit > 2) {
-		priv->cstate_limit = limit;
-		acpi_set_cstate_limit(2);
-		priv->config |= CFG_C3_DISABLED;
-	}
-#endif
-
-#ifdef CONFIG_IPW_DEBUG_C3
-	/* Halt the fimrware so we can get a good image */
-	write_register(priv->net_dev, IPW_REG_RESET_REG,
-		       IPW_AUX_HOST_RESET_REG_STOP_MASTER);
-	j = 5;
-	do {
-		udelay(IPW_WAIT_RESET_MASTER_ASSERT_COMPLETE_DELAY);
-		read_register(priv->net_dev, IPW_REG_RESET_REG, &reg);
-
-		if (reg & IPW_AUX_HOST_RESET_REG_MASTER_DISABLED)
-			break;
-	}  while (j--);
-
-	match = ipw2100_match_buf(priv, (u8*)status,
-				  sizeof(struct ipw2100_status),
-				  SEARCH_SNAPSHOT);
-	if (match < SEARCH_SUCCESS)
-		IPW_DEBUG_INFO("%s: DMA status match in Firmware at "
-			       "offset 0x%06X, length %d:\n",
-			       priv->net_dev->name, match,
-			       sizeof(struct ipw2100_status));
-	else
-		IPW_DEBUG_INFO("%s: No DMA status match in "
-			       "Firmware.\n", priv->net_dev->name);
-
-	printk_buf((u8*)priv->status_queue.drv,
-		   sizeof(struct ipw2100_status) * RX_QUEUE_LENGTH);
-#endif
-
-	priv->fatal_error = IPW2100_ERR_C3_CORRUPTION;
-	priv->ieee->stats.rx_errors++;
-	schedule_reset(priv);
-}
-
-static inline void isr_rx(struct ipw2100_priv *priv, int i,
-			  struct ieee80211_rx_stats *stats)
-{
-	struct ipw2100_status *status = &priv->status_queue.drv[i];
-	struct ipw2100_rx_packet *packet = &priv->rx_buffers[i];
-
-	IPW_DEBUG_RX("Handler...\n");
-
-	if (unlikely(status->frame_size > skb_tailroom(packet->skb))) {
-		IPW_DEBUG_INFO("%s: frame_size (%u) > skb_tailroom (%u)!"
-			       "  Dropping.\n",
-			       priv->net_dev->name,
-			       status->frame_size, skb_tailroom(packet->skb));
-		priv->ieee->stats.rx_errors++;
-		return;
-	}
-
-	if (unlikely(!netif_running(priv->net_dev))) {
-		priv->ieee->stats.rx_errors++;
-		priv->wstats.discard.misc++;
-		IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
-		return;
-	}
-
-	if (unlikely(priv->ieee->iw_mode == IW_MODE_MONITOR &&
-		     status->flags & IPW_STATUS_FLAG_CRC_ERROR)) {
-		IPW_DEBUG_RX("CRC error in packet.  Dropping.\n");
-		priv->ieee->stats.rx_errors++;
-		return;
-	}
-
-	if (unlikely(priv->ieee->iw_mode != IW_MODE_MONITOR &&
-		!(priv->status & STATUS_ASSOCIATED))) {
-		IPW_DEBUG_DROP("Dropping packet while not associated.\n");
-		priv->wstats.discard.misc++;
-		return;
-	}
-
-
-	pci_unmap_single(priv->pci_dev,
-			 packet->dma_addr,
-			 sizeof(struct ipw2100_rx),
-			 PCI_DMA_FROMDEVICE);
-
-	skb_put(packet->skb, status->frame_size);
-
-#ifdef CONFIG_IPW2100_RX_DEBUG
-	/* Make a copy of the frame so we can dump it to the logs if
-	 * ieee80211_rx fails */
-	memcpy(packet_data, packet->skb->data,
-	       min_t(u32, status->frame_size, IPW_RX_NIC_BUFFER_LENGTH));
-#endif
-
-	if (!ieee80211_rx(priv->ieee, packet->skb, stats)) {
-#ifdef CONFIG_IPW2100_RX_DEBUG
-		IPW_DEBUG_DROP("%s: Non consumed packet:\n",
-			       priv->net_dev->name);
-		printk_buf(IPW_DL_DROP, packet_data, status->frame_size);
-#endif
-		priv->ieee->stats.rx_errors++;
-
-		/* ieee80211_rx failed, so it didn't free the SKB */
-		dev_kfree_skb_any(packet->skb);
-		packet->skb = NULL;
-	}
-
-	/* We need to allocate a new SKB and attach it to the RDB. */
-	if (unlikely(ipw2100_alloc_skb(priv, packet))) {
-		printk(KERN_WARNING DRV_NAME ": "
-			"%s: Unable to allocate SKB onto RBD ring - disabling "
-			"adapter.\n", priv->net_dev->name);
-		/* TODO: schedule adapter shutdown */
-		IPW_DEBUG_INFO("TODO: Shutdown adapter...\n");
-	}
-
-	/* Update the RDB entry */
-	priv->rx_queue.drv[i].host_addr = packet->dma_addr;
-}
-
-static inline int ipw2100_corruption_check(struct ipw2100_priv *priv, int i)
-{
-	struct ipw2100_status *status = &priv->status_queue.drv[i];
-	struct ipw2100_rx *u = priv->rx_buffers[i].rxp;
-	u16 frame_type = status->status_fields & STATUS_TYPE_MASK;
-
-	switch (frame_type) {
-	case COMMAND_STATUS_VAL:
-		return (status->frame_size != sizeof(u->rx_data.command));
-	case STATUS_CHANGE_VAL:
-		return (status->frame_size != sizeof(u->rx_data.status));
-	case HOST_NOTIFICATION_VAL:
-		return (status->frame_size < sizeof(u->rx_data.notification));
-	case P80211_DATA_VAL:
-	case P8023_DATA_VAL:
-#ifdef CONFIG_IPW2100_MONITOR
-		return 0;
-#else
-		switch (WLAN_FC_GET_TYPE(u->rx_data.header.frame_ctl)) {
-		case IEEE80211_FTYPE_MGMT:
-		case IEEE80211_FTYPE_CTL:
-			return 0;
-		case IEEE80211_FTYPE_DATA:
-			return (status->frame_size >
-				IPW_MAX_802_11_PAYLOAD_LENGTH);
-		}
-#endif
-	}
-
-	return 1;
-}
-
-/*
- * ipw2100 interrupts are disabled at this point, and the ISR
- * is the only code that calls this method.  So, we do not need
- * to play with any locks.
- *
- * RX Queue works as follows:
- *
- * Read index - firmware places packet in entry identified by the
- *              Read index and advances Read index.  In this manner,
- *              Read index will always point to the next packet to
- *              be filled--but not yet valid.
- *
- * Write index - driver fills this entry with an unused RBD entry.
- *               This entry has not filled by the firmware yet.
- *
- * In between the W and R indexes are the RBDs that have been received
- * but not yet processed.
- *
- * The process of handling packets will start at WRITE + 1 and advance
- * until it reaches the READ index.
- *
- * The WRITE index is cached in the variable 'priv->rx_queue.next'.
- *
- */
-static inline void __ipw2100_rx_process(struct ipw2100_priv *priv)
-{
-	struct ipw2100_bd_queue *rxq = &priv->rx_queue;
-	struct ipw2100_status_queue *sq = &priv->status_queue;
-	struct ipw2100_rx_packet *packet;
-	u16 frame_type;
-	u32 r, w, i, s;
-	struct ipw2100_rx *u;
-	struct ieee80211_rx_stats stats = {
-		.mac_time = jiffies,
-	};
-
-	read_register(priv->net_dev, IPW_MEM_HOST_SHARED_RX_READ_INDEX, &r);
-	read_register(priv->net_dev, IPW_MEM_HOST_SHARED_RX_WRITE_INDEX, &w);
-
-	if (r >= rxq->entries) {
-		IPW_DEBUG_RX("exit - bad read index\n");
-		return;
-	}
-
-	i = (rxq->next + 1) % rxq->entries;
-	s = i;
-	while (i != r) {
-		/* IPW_DEBUG_RX("r = %d : w = %d : processing = %d\n",
-		   r, rxq->next, i); */
-
-		packet = &priv->rx_buffers[i];
-
-		/* Sync the DMA for the STATUS buffer so CPU is sure to get
-		 * the correct values */
-		pci_dma_sync_single_for_cpu(
-			priv->pci_dev,
-			sq->nic + sizeof(struct ipw2100_status) * i,
-			sizeof(struct ipw2100_status),
-			PCI_DMA_FROMDEVICE);
-
-		/* Sync the DMA for the RX buffer so CPU is sure to get
-		 * the correct values */
-		pci_dma_sync_single_for_cpu(priv->pci_dev, packet->dma_addr,
-					    sizeof(struct ipw2100_rx),
-					    PCI_DMA_FROMDEVICE);
-
-		if (unlikely(ipw2100_corruption_check(priv, i))) {
-			ipw2100_corruption_detected(priv, i);
-			goto increment;
-		}
-
-		u = packet->rxp;
-		frame_type = sq->drv[i].status_fields &
-			STATUS_TYPE_MASK;
-		stats.rssi = sq->drv[i].rssi + IPW2100_RSSI_TO_DBM;
-		stats.len = sq->drv[i].frame_size;
-
-		stats.mask = 0;
-		if (stats.rssi != 0)
-			stats.mask |= IEEE80211_STATMASK_RSSI;
-		stats.freq = IEEE80211_24GHZ_BAND;
-
-		IPW_DEBUG_RX(
-			"%s: '%s' frame type received (%d).\n",
-			priv->net_dev->name, frame_types[frame_type],
-			stats.len);
-
-		switch (frame_type) {
-		case COMMAND_STATUS_VAL:
-			/* Reset Rx watchdog */
-			isr_rx_complete_command(
-				priv, &u->rx_data.command);
-			break;
-
-		case STATUS_CHANGE_VAL:
-			isr_status_change(priv, u->rx_data.status);
-			break;
-
-		case P80211_DATA_VAL:
-		case P8023_DATA_VAL:
-#ifdef CONFIG_IPW2100_MONITOR
-			if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
-				isr_rx(priv, i, &stats);
-				break;
-			}
-#endif
-			if (stats.len < sizeof(u->rx_data.header))
-				break;
-			switch (WLAN_FC_GET_TYPE(u->rx_data.header.
-						 frame_ctl)) {
-			case IEEE80211_FTYPE_MGMT:
-				ieee80211_rx_mgt(priv->ieee,
-						 &u->rx_data.header,
-						 &stats);
-				break;
-
-			case IEEE80211_FTYPE_CTL:
-				break;
-
-			case IEEE80211_FTYPE_DATA:
-				isr_rx(priv, i, &stats);
-				break;
-
-			}
-			break;
-		}
-
-	increment:
-		/* clear status field associated with this RBD */
-		rxq->drv[i].status.info.field = 0;
-
-		i = (i + 1) % rxq->entries;
-	}
-
-	if (i != s) {
-		/* backtrack one entry, wrapping to end if at 0 */
-		rxq->next = (i ? i : rxq->entries) - 1;
-
-		write_register(priv->net_dev,
-			       IPW_MEM_HOST_SHARED_RX_WRITE_INDEX,
-			       rxq->next);
-	}
-}
-
-
-/*
- * __ipw2100_tx_process
- *
- * This routine will determine whether the next packet on
- * the fw_pend_list has been processed by the firmware yet.
- *
- * If not, then it does nothing and returns.
- *
- * If so, then it removes the item from the fw_pend_list, frees
- * any associated storage, and places the item back on the
- * free list of its source (either msg_free_list or tx_free_list)
- *
- * TX Queue works as follows:
- *
- * Read index - points to the next TBD that the firmware will
- *              process.  The firmware will read the data, and once
- *              done processing, it will advance the Read index.
- *
- * Write index - driver fills this entry with an constructed TBD
- *               entry.  The Write index is not advanced until the
- *               packet has been configured.
- *
- * In between the W and R indexes are the TBDs that have NOT been
- * processed.  Lagging behind the R index are packets that have
- * been processed but have not been freed by the driver.
- *
- * In order to free old storage, an internal index will be maintained
- * that points to the next packet to be freed.  When all used
- * packets have been freed, the oldest index will be the same as the
- * firmware's read index.
- *
- * The OLDEST index is cached in the variable 'priv->tx_queue.oldest'
- *
- * Because the TBD structure can not contain arbitrary data, the
- * driver must keep an internal queue of cached allocations such that
- * it can put that data back into the tx_free_list and msg_free_list
- * for use by future command and data packets.
- *
- */
-static inline int __ipw2100_tx_process(struct ipw2100_priv *priv)
-{
-	struct ipw2100_bd_queue *txq = &priv->tx_queue;
-        struct ipw2100_bd *tbd;
-	struct list_head *element;
-	struct ipw2100_tx_packet *packet;
-	int descriptors_used;
-	int e, i;
-	u32 r, w, frag_num = 0;
-
-	if (list_empty(&priv->fw_pend_list))
-		return 0;
-
-	element = priv->fw_pend_list.next;
-
-	packet = list_entry(element, struct ipw2100_tx_packet, list);
-        tbd = &txq->drv[packet->index];
-
-	/* Determine how many TBD entries must be finished... */
-	switch (packet->type) {
-	case COMMAND:
-		/* COMMAND uses only one slot; don't advance */
-		descriptors_used = 1;
-		e = txq->oldest;
-		break;
-
-	case DATA:
-		/* DATA uses two slots; advance and loop position. */
-		descriptors_used = tbd->num_fragments;
-                frag_num = tbd->num_fragments - 1;
-		e = txq->oldest + frag_num;
-		e %= txq->entries;
-		break;
-
-	default:
-		printk(KERN_WARNING DRV_NAME ": %s: Bad fw_pend_list entry!\n",
-				   priv->net_dev->name);
-		return 0;
-	}
-
-	/* if the last TBD is not done by NIC yet, then packet is
-	 * not ready to be released.
-	 *
-	 */
-	read_register(priv->net_dev, IPW_MEM_HOST_SHARED_TX_QUEUE_READ_INDEX,
-		      &r);
-	read_register(priv->net_dev, IPW_MEM_HOST_SHARED_TX_QUEUE_WRITE_INDEX,
-		      &w);
-	if (w != txq->next)
-		printk(KERN_WARNING DRV_NAME ": %s: write index mismatch\n",
-		       priv->net_dev->name);
-
-        /*
-	 * txq->next is the index of the last packet written txq->oldest is
-	 * the index of the r is the index of the next packet to be read by
-	 * firmware
-	 */
-
-
-	/*
-	 * Quick graphic to help you visualize the following
-	 * if / else statement
-	 *
-	 * ===>|                     s---->|===============
-	 *                               e>|
-	 * | a | b | c | d | e | f | g | h | i | j | k | l
-	 *       r---->|
-	 *               w
-	 *
-	 * w - updated by driver
-	 * r - updated by firmware
-	 * s - start of oldest BD entry (txq->oldest)
-	 * e - end of oldest BD entry
-	 *
-	 */
-	if (!((r <= w && (e < r || e >= w)) || (e < r && e >= w))) {
-		IPW_DEBUG_TX("exit - no processed packets ready to release.\n");
-		return 0;
-	}
-
-	list_del(element);
-	DEC_STAT(&priv->fw_pend_stat);
-
-#ifdef CONFIG_IPW_DEBUG
-	{
-		int i = txq->oldest;
-		IPW_DEBUG_TX(
-			"TX%d V=%p P=%04X T=%04X L=%d\n", i,
-			&txq->drv[i],
-			(u32)(txq->nic + i * sizeof(struct ipw2100_bd)),
-			txq->drv[i].host_addr,
-			txq->drv[i].buf_length);
-
-		if (packet->type == DATA) {
-			i = (i + 1) % txq->entries;
-
-			IPW_DEBUG_TX(
-				"TX%d V=%p P=%04X T=%04X L=%d\n", i,
-				&txq->drv[i],
-				(u32)(txq->nic + i *
-				sizeof(struct ipw2100_bd)),
-				(u32)txq->drv[i].host_addr,
-				txq->drv[i].buf_length);
-		}
-	}
-#endif
-
-	switch (packet->type) {
-	case DATA:
-		if (txq->drv[txq->oldest].status.info.fields.txType != 0)
-			printk(KERN_WARNING DRV_NAME ": %s: Queue mismatch.  "
-			       "Expecting DATA TBD but pulled "
-			       "something else: ids %d=%d.\n",
-			       priv->net_dev->name, txq->oldest, packet->index);
-
-		/* DATA packet; we have to unmap and free the SKB */
-		priv->ieee->stats.tx_packets++;
-		for (i = 0; i < frag_num; i++) {
-			tbd = &txq->drv[(packet->index + 1 + i) %
-					txq->entries];
-
-			IPW_DEBUG_TX(
-				"TX%d P=%08x L=%d\n",
-				(packet->index + 1 + i) % txq->entries,
-				tbd->host_addr, tbd->buf_length);
-
-			pci_unmap_single(priv->pci_dev,
-					 tbd->host_addr,
-					 tbd->buf_length,
-					 PCI_DMA_TODEVICE);
-		}
-
-		priv->ieee->stats.tx_bytes += packet->info.d_struct.txb->payload_size;
-		ieee80211_txb_free(packet->info.d_struct.txb);
-		packet->info.d_struct.txb = NULL;
-
-		list_add_tail(element, &priv->tx_free_list);
-		INC_STAT(&priv->tx_free_stat);
-
-		/* We have a free slot in the Tx queue, so wake up the
-		 * transmit layer if it is stopped. */
-		if (priv->status & STATUS_ASSOCIATED &&
-		    netif_queue_stopped(priv->net_dev)) {
-			IPW_DEBUG_INFO(KERN_INFO
-					   "%s: Waking net queue.\n",
-					   priv->net_dev->name);
-			netif_wake_queue(priv->net_dev);
-		}
-
-		/* A packet was processed by the hardware, so update the
-		 * watchdog */
-		priv->net_dev->trans_start = jiffies;
-
-		break;
-
-	case COMMAND:
-		if (txq->drv[txq->oldest].status.info.fields.txType != 1)
-			printk(KERN_WARNING DRV_NAME ": %s: Queue mismatch.  "
-			       "Expecting COMMAND TBD but pulled "
-			       "something else: ids %d=%d.\n",
-			       priv->net_dev->name, txq->oldest, packet->index);
-
-#ifdef CONFIG_IPW_DEBUG
-		if (packet->info.c_struct.cmd->host_command_reg <
-		    sizeof(command_types) / sizeof(*command_types))
-			IPW_DEBUG_TX(
-				"Command '%s (%d)' processed: %d.\n",
-				command_types[packet->info.c_struct.cmd->host_command_reg],
-				packet->info.c_struct.cmd->host_command_reg,
-				packet->info.c_struct.cmd->cmd_status_reg);
-#endif
-
-		list_add_tail(element, &priv->msg_free_list);
-		INC_STAT(&priv->msg_free_stat);
-		break;
-	}
-
-	/* advance oldest used TBD pointer to start of next entry */
-	txq->oldest = (e + 1) % txq->entries;
-	/* increase available TBDs number */
-	txq->available += descriptors_used;
-	SET_STAT(&priv->txq_stat, txq->available);
-
-	IPW_DEBUG_TX("packet latency (send to process)  %ld jiffies\n",
-			 jiffies - packet->jiffy_start);
-
-	return (!list_empty(&priv->fw_pend_list));
-}
-
-
-static inline void __ipw2100_tx_complete(struct ipw2100_priv *priv)
-{
-	int i = 0;
-
-	while (__ipw2100_tx_process(priv) && i < 200) i++;
-
-	if (i == 200) {
-		printk(KERN_WARNING DRV_NAME ": "
-		       "%s: Driver is running slow (%d iters).\n",
-		       priv->net_dev->name, i);
-	}
-}
-
-
-static void ipw2100_tx_send_commands(struct ipw2100_priv *priv)
-{
-	struct list_head *element;
-	struct ipw2100_tx_packet *packet;
-	struct ipw2100_bd_queue *txq = &priv->tx_queue;
-	struct ipw2100_bd *tbd;
-	int next = txq->next;
-
-	while (!list_empty(&priv->msg_pend_list)) {
-		/* if there isn't enough space in TBD queue, then
-		 * don't stuff a new one in.
-		 * NOTE: 3 are needed as a command will take one,
-		 *       and there is a minimum of 2 that must be
-		 *       maintained between the r and w indexes
-		 */
-		if (txq->available <= 3) {
-			IPW_DEBUG_TX("no room in tx_queue\n");
-			break;
-		}
-
-		element = priv->msg_pend_list.next;
-		list_del(element);
-		DEC_STAT(&priv->msg_pend_stat);
-
-		packet = list_entry(element,
-				    struct ipw2100_tx_packet, list);
-
-		IPW_DEBUG_TX("using TBD at virt=%p, phys=%p\n",
-				 &txq->drv[txq->next],
-				 (void*)(txq->nic + txq->next *
-					 sizeof(struct ipw2100_bd)));
-
-		packet->index = txq->next;
-
-		tbd = &txq->drv[txq->next];
-
-		/* initialize TBD */
-		tbd->host_addr = packet->info.c_struct.cmd_phys;
-		tbd->buf_length = sizeof(struct ipw2100_cmd_header);
-		/* not marking number of fragments causes problems
-		 * with f/w debug version */
-		tbd->num_fragments = 1;
-		tbd->status.info.field =
-			IPW_BD_STATUS_TX_FRAME_COMMAND |
-			IPW_BD_STATUS_TX_INTERRUPT_ENABLE;
-
-		/* update TBD queue counters */
-		txq->next++;
-		txq->next %= txq->entries;
-		txq->available--;
-		DEC_STAT(&priv->txq_stat);
-
-		list_add_tail(element, &priv->fw_pend_list);
-		INC_STAT(&priv->fw_pend_stat);
-	}
-
-	if (txq->next != next) {
-		/* kick off the DMA by notifying firmware the
-		 * write index has moved; make sure TBD stores are sync'd */
-		wmb();
-		write_register(priv->net_dev,
-			       IPW_MEM_HOST_SHARED_TX_QUEUE_WRITE_INDEX,
-			       txq->next);
-	}
-}
-
-
-/*
- * ipw2100_tx_send_data
- *
- */
-static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
-{
-	struct list_head *element;
-	struct ipw2100_tx_packet *packet;
-	struct ipw2100_bd_queue *txq = &priv->tx_queue;
-	struct ipw2100_bd *tbd;
-	int next = txq->next;
-        int i = 0;
-	struct ipw2100_data_header *ipw_hdr;
-	struct ieee80211_hdr *hdr;
-
-	while (!list_empty(&priv->tx_pend_list)) {
-		/* if there isn't enough space in TBD queue, then
-		 * don't stuff a new one in.
-		 * NOTE: 4 are needed as a data will take two,
-		 *       and there is a minimum of 2 that must be
-		 *       maintained between the r and w indexes
-		 */
-		element = priv->tx_pend_list.next;
-                packet = list_entry(element, struct ipw2100_tx_packet, list);
-
-		if (unlikely(1 + packet->info.d_struct.txb->nr_frags >
-			     IPW_MAX_BDS)) {
-			/* TODO: Support merging buffers if more than
-			 * IPW_MAX_BDS are used */
-			IPW_DEBUG_INFO(
-			       "%s: Maximum BD theshold exceeded.  "
-			       "Increase fragmentation level.\n",
-			       priv->net_dev->name);
-		}
-
-		if (txq->available <= 3 +
-		    packet->info.d_struct.txb->nr_frags) {
-			IPW_DEBUG_TX("no room in tx_queue\n");
-			break;
-		}
-
-		list_del(element);
-		DEC_STAT(&priv->tx_pend_stat);
-
-		tbd = &txq->drv[txq->next];
-
-		packet->index = txq->next;
-
-		ipw_hdr = packet->info.d_struct.data;
-		hdr = (struct ieee80211_hdr *)packet->info.d_struct.txb->
-			fragments[0]->data;
-
-		if (priv->ieee->iw_mode == IW_MODE_INFRA) {
-			/* To DS: Addr1 = BSSID, Addr2 = SA,
-			   Addr3 = DA */
-			memcpy(ipw_hdr->src_addr, hdr->addr2, ETH_ALEN);
-			memcpy(ipw_hdr->dst_addr, hdr->addr3, ETH_ALEN);
-		} else if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
-			/* not From/To DS: Addr1 = DA, Addr2 = SA,
-			   Addr3 = BSSID */
-			memcpy(ipw_hdr->src_addr, hdr->addr2, ETH_ALEN);
-			memcpy(ipw_hdr->dst_addr, hdr->addr1, ETH_ALEN);
-		}
-
-		ipw_hdr->host_command_reg = SEND;
-		ipw_hdr->host_command_reg1 = 0;
-
-		/* For now we only support host based encryption */
-		ipw_hdr->needs_encryption = 0;
-		ipw_hdr->encrypted = packet->info.d_struct.txb->encrypted;
-		if (packet->info.d_struct.txb->nr_frags > 1)
-			ipw_hdr->fragment_size =
-				packet->info.d_struct.txb->frag_size - IEEE80211_3ADDR_LEN;
-		else
-			ipw_hdr->fragment_size = 0;
-
-		tbd->host_addr = packet->info.d_struct.data_phys;
-		tbd->buf_length = sizeof(struct ipw2100_data_header);
-		tbd->num_fragments = 1 + packet->info.d_struct.txb->nr_frags;
-		tbd->status.info.field =
-			IPW_BD_STATUS_TX_FRAME_802_3 |
-			IPW_BD_STATUS_TX_FRAME_NOT_LAST_FRAGMENT;
-		txq->next++;
-		txq->next %= txq->entries;
-
-		IPW_DEBUG_TX(
-			"data header tbd TX%d P=%08x L=%d\n",
-			packet->index, tbd->host_addr,
-			tbd->buf_length);
-#ifdef CONFIG_IPW_DEBUG
-		if (packet->info.d_struct.txb->nr_frags > 1)
-			IPW_DEBUG_FRAG("fragment Tx: %d frames\n",
-				       packet->info.d_struct.txb->nr_frags);
-#endif
-
-                for (i = 0; i < packet->info.d_struct.txb->nr_frags; i++) {
-		        tbd = &txq->drv[txq->next];
-			if (i == packet->info.d_struct.txb->nr_frags - 1)
-				tbd->status.info.field =
-					IPW_BD_STATUS_TX_FRAME_802_3 |
-					IPW_BD_STATUS_TX_INTERRUPT_ENABLE;
-			else
-				tbd->status.info.field =
-					IPW_BD_STATUS_TX_FRAME_802_3 |
-					IPW_BD_STATUS_TX_FRAME_NOT_LAST_FRAGMENT;
-
-			tbd->buf_length = packet->info.d_struct.txb->
-				fragments[i]->len - IEEE80211_3ADDR_LEN;
-
-                        tbd->host_addr = pci_map_single(
-				priv->pci_dev,
-				packet->info.d_struct.txb->fragments[i]->data +
-				IEEE80211_3ADDR_LEN,
-				tbd->buf_length,
-				PCI_DMA_TODEVICE);
-
-			IPW_DEBUG_TX(
-				"data frag tbd TX%d P=%08x L=%d\n",
-				txq->next, tbd->host_addr, tbd->buf_length);
-
-			pci_dma_sync_single_for_device(
-				priv->pci_dev, tbd->host_addr,
-				tbd->buf_length,
-				PCI_DMA_TODEVICE);
-
-			txq->next++;
-			txq->next %= txq->entries;
-                }
-
-		txq->available -= 1 + packet->info.d_struct.txb->nr_frags;
-		SET_STAT(&priv->txq_stat, txq->available);
-
-		list_add_tail(element, &priv->fw_pend_list);
-		INC_STAT(&priv->fw_pend_stat);
-	}
-
-	if (txq->next != next) {
-		/* kick off the DMA by notifying firmware the
-		 * write index has moved; make sure TBD stores are sync'd */
-		write_register(priv->net_dev,
-			       IPW_MEM_HOST_SHARED_TX_QUEUE_WRITE_INDEX,
-			       txq->next);
-	}
-        return;
-}
-
-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv)
-{
-	struct net_device *dev = priv->net_dev;
-	unsigned long flags;
-	u32 inta, tmp;
-
-	spin_lock_irqsave(&priv->low_lock, flags);
-	ipw2100_disable_interrupts(priv);
-
-	read_register(dev, IPW_REG_INTA, &inta);
-
-	IPW_DEBUG_ISR("enter - INTA: 0x%08lX\n",
-		      (unsigned long)inta & IPW_INTERRUPT_MASK);
-
-	priv->in_isr++;
-	priv->interrupts++;
-
-	/* We do not loop and keep polling for more interrupts as this
-	 * is frowned upon and doesn't play nicely with other potentially
-	 * chained IRQs */
-	IPW_DEBUG_ISR("INTA: 0x%08lX\n",
-		      (unsigned long)inta & IPW_INTERRUPT_MASK);
-
-	if (inta & IPW2100_INTA_FATAL_ERROR) {
-		printk(KERN_WARNING DRV_NAME
-				  ": Fatal interrupt. Scheduling firmware restart.\n");
-		priv->inta_other++;
-		write_register(
-			dev, IPW_REG_INTA,
-			IPW2100_INTA_FATAL_ERROR);
-
-		read_nic_dword(dev, IPW_NIC_FATAL_ERROR, &priv->fatal_error);
-		IPW_DEBUG_INFO("%s: Fatal error value: 0x%08X\n",
-			       priv->net_dev->name, priv->fatal_error);
-
-		read_nic_dword(dev, IPW_ERROR_ADDR(priv->fatal_error), &tmp);
-		IPW_DEBUG_INFO("%s: Fatal error address value: 0x%08X\n",
-			       priv->net_dev->name, tmp);
-
-		/* Wake up any sleeping jobs */
-		schedule_reset(priv);
-	}
-
-	if (inta & IPW2100_INTA_PARITY_ERROR) {
-		printk(KERN_ERR DRV_NAME ": ***** PARITY ERROR INTERRUPT !!!! \n");
-		priv->inta_other++;
-		write_register(
-			dev, IPW_REG_INTA,
-			IPW2100_INTA_PARITY_ERROR);
-	}
-
-	if (inta & IPW2100_INTA_RX_TRANSFER) {
-		IPW_DEBUG_ISR("RX interrupt\n");
-
-		priv->rx_interrupts++;
-
-		write_register(
-			dev, IPW_REG_INTA,
-			IPW2100_INTA_RX_TRANSFER);
-
-		__ipw2100_rx_process(priv);
-		__ipw2100_tx_complete(priv);
-	}
-
-	if (inta & IPW2100_INTA_TX_TRANSFER) {
-		IPW_DEBUG_ISR("TX interrupt\n");
-
-		priv->tx_interrupts++;
-
-		write_register(dev, IPW_REG_INTA,
-			       IPW2100_INTA_TX_TRANSFER);
-
-		__ipw2100_tx_complete(priv);
-		ipw2100_tx_send_commands(priv);
-		ipw2100_tx_send_data(priv);
-	}
-
-	if (inta & IPW2100_INTA_TX_COMPLETE) {
-		IPW_DEBUG_ISR("TX complete\n");
-		priv->inta_other++;
-		write_register(
-			dev, IPW_REG_INTA,
-			IPW2100_INTA_TX_COMPLETE);
-
-		__ipw2100_tx_complete(priv);
-	}
-
-	if (inta & IPW2100_INTA_EVENT_INTERRUPT) {
-		/* ipw2100_handle_event(dev); */
-		priv->inta_other++;
-		write_register(
-			dev, IPW_REG_INTA,
-			IPW2100_INTA_EVENT_INTERRUPT);
-	}
-
-	if (inta & IPW2100_INTA_FW_INIT_DONE) {
-		IPW_DEBUG_ISR("FW init done interrupt\n");
-		priv->inta_other++;
-
-		read_register(dev, IPW_REG_INTA, &tmp);
-		if (tmp & (IPW2100_INTA_FATAL_ERROR |
-			   IPW2100_INTA_PARITY_ERROR)) {
-			write_register(
-				dev, IPW_REG_INTA,
-				IPW2100_INTA_FATAL_ERROR |
-				IPW2100_INTA_PARITY_ERROR);
-		}
-
-		write_register(dev, IPW_REG_INTA,
-			       IPW2100_INTA_FW_INIT_DONE);
-	}
-
-	if (inta & IPW2100_INTA_STATUS_CHANGE) {
-		IPW_DEBUG_ISR("Status change interrupt\n");
-		priv->inta_other++;
-		write_register(
-			dev, IPW_REG_INTA,
-			IPW2100_INTA_STATUS_CHANGE);
-	}
-
-	if (inta & IPW2100_INTA_SLAVE_MODE_HOST_COMMAND_DONE) {
-		IPW_DEBUG_ISR("slave host mode interrupt\n");
-		priv->inta_other++;
-		write_register(
-			dev, IPW_REG_INTA,
-			IPW2100_INTA_SLAVE_MODE_HOST_COMMAND_DONE);
-	}
-
-	priv->in_isr--;
-	ipw2100_enable_interrupts(priv);
-
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-
-	IPW_DEBUG_ISR("exit\n");
-}
-
-
-static irqreturn_t ipw2100_interrupt(int irq, void *data,
-				     struct pt_regs *regs)
-{
-	struct ipw2100_priv *priv = data;
-	u32 inta, inta_mask;
-
-	if (!data)
-		return IRQ_NONE;
-
- 	spin_lock(&priv->low_lock);
-
-	/* We check to see if we should be ignoring interrupts before
-	 * we touch the hardware.  During ucode load if we try and handle
-	 * an interrupt we can cause keyboard problems as well as cause
-	 * the ucode to fail to initialize */
-	if (!(priv->status & STATUS_INT_ENABLED)) {
-		/* Shared IRQ */
-		goto none;
-	}
-
-	read_register(priv->net_dev, IPW_REG_INTA_MASK, &inta_mask);
-	read_register(priv->net_dev, IPW_REG_INTA, &inta);
-
-	if (inta == 0xFFFFFFFF) {
-		/* Hardware disappeared */
-		printk(KERN_WARNING DRV_NAME ": IRQ INTA == 0xFFFFFFFF\n");
-		goto none;
-	}
-
-	inta &= IPW_INTERRUPT_MASK;
-
-	if (!(inta & inta_mask)) {
-		/* Shared interrupt */
-		goto none;
-	}
-
-	/* We disable the hardware interrupt here just to prevent unneeded
-	 * calls to be made.  We disable this again within the actual
-	 * work tasklet, so if another part of the code re-enables the
-	 * interrupt, that is fine */
-	ipw2100_disable_interrupts(priv);
-
-	tasklet_schedule(&priv->irq_tasklet);
- 	spin_unlock(&priv->low_lock);
-
-	return IRQ_HANDLED;
- none:
-	spin_unlock(&priv->low_lock);
-	return IRQ_NONE;
-}
-
-static int ipw2100_tx(struct ieee80211_txb *txb, struct net_device *dev)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	struct list_head *element;
-	struct ipw2100_tx_packet *packet;
-	unsigned long flags;
-
-	spin_lock_irqsave(&priv->low_lock, flags);
-
-	if (!(priv->status & STATUS_ASSOCIATED)) {
-		IPW_DEBUG_INFO("Can not transmit when not connected.\n");
-		priv->ieee->stats.tx_carrier_errors++;
-		netif_stop_queue(dev);
-		goto fail_unlock;
-	}
-
-	if (list_empty(&priv->tx_free_list))
-		goto fail_unlock;
-
-	element = priv->tx_free_list.next;
-	packet = list_entry(element, struct ipw2100_tx_packet, list);
-
-	packet->info.d_struct.txb = txb;
-
-	IPW_DEBUG_TX("Sending fragment (%d bytes):\n",
-			 txb->fragments[0]->len);
-	printk_buf(IPW_DL_TX, txb->fragments[0]->data,
-		   txb->fragments[0]->len);
-
-	packet->jiffy_start = jiffies;
-
-	list_del(element);
-	DEC_STAT(&priv->tx_free_stat);
-
-	list_add_tail(element, &priv->tx_pend_list);
-	INC_STAT(&priv->tx_pend_stat);
-
-	ipw2100_tx_send_data(priv);
-
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-	return 0;
-
- fail_unlock:
-	netif_stop_queue(dev);
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-	return 1;
-}
-
-
-static int ipw2100_msg_allocate(struct ipw2100_priv *priv)
-{
-	int i, j, err = -EINVAL;
-	void *v;
-	dma_addr_t p;
-
-	priv->msg_buffers = (struct ipw2100_tx_packet *)kmalloc(
-		IPW_COMMAND_POOL_SIZE * sizeof(struct ipw2100_tx_packet),
-		GFP_KERNEL);
-	if (!priv->msg_buffers) {
-		printk(KERN_ERR DRV_NAME ": %s: PCI alloc failed for msg "
-		       "buffers.\n", priv->net_dev->name);
-		return -ENOMEM;
-	}
-
-	for (i = 0; i < IPW_COMMAND_POOL_SIZE; i++) {
-		v = pci_alloc_consistent(
-			priv->pci_dev,
-			sizeof(struct ipw2100_cmd_header),
-			&p);
-		if (!v) {
-			printk(KERN_ERR DRV_NAME ": "
-			       "%s: PCI alloc failed for msg "
-			       "buffers.\n",
-			       priv->net_dev->name);
-			err = -ENOMEM;
-			break;
-		}
-
-		memset(v, 0, sizeof(struct ipw2100_cmd_header));
-
-		priv->msg_buffers[i].type = COMMAND;
-		priv->msg_buffers[i].info.c_struct.cmd =
-			(struct ipw2100_cmd_header*)v;
-		priv->msg_buffers[i].info.c_struct.cmd_phys = p;
-	}
-
-	if (i == IPW_COMMAND_POOL_SIZE)
-		return 0;
-
-	for (j = 0; j < i; j++) {
-		pci_free_consistent(
-			priv->pci_dev,
-			sizeof(struct ipw2100_cmd_header),
-			priv->msg_buffers[j].info.c_struct.cmd,
-			priv->msg_buffers[j].info.c_struct.cmd_phys);
-	}
-
-	kfree(priv->msg_buffers);
-	priv->msg_buffers = NULL;
-
-	return err;
-}
-
-static int ipw2100_msg_initialize(struct ipw2100_priv *priv)
-{
-	int i;
-
-	INIT_LIST_HEAD(&priv->msg_free_list);
-	INIT_LIST_HEAD(&priv->msg_pend_list);
-
-	for (i = 0; i < IPW_COMMAND_POOL_SIZE; i++)
-		list_add_tail(&priv->msg_buffers[i].list, &priv->msg_free_list);
-	SET_STAT(&priv->msg_free_stat, i);
-
-	return 0;
-}
-
-static void ipw2100_msg_free(struct ipw2100_priv *priv)
-{
-	int i;
-
-	if (!priv->msg_buffers)
-		return;
-
-	for (i = 0; i < IPW_COMMAND_POOL_SIZE; i++) {
-		pci_free_consistent(priv->pci_dev,
-				    sizeof(struct ipw2100_cmd_header),
-				    priv->msg_buffers[i].info.c_struct.cmd,
-				    priv->msg_buffers[i].info.c_struct.cmd_phys);
-	}
-
-	kfree(priv->msg_buffers);
-	priv->msg_buffers = NULL;
-}
-
-static ssize_t show_pci(struct device *d, struct device_attribute *attr,
-			char *buf)
-{
-	struct pci_dev *pci_dev = container_of(d, struct pci_dev, dev);
-	char *out = buf;
-	int i, j;
-	u32 val;
-
-	for (i = 0; i < 16; i++) {
-		out += sprintf(out, "[%08X] ", i * 16);
-		for (j = 0; j < 16; j += 4) {
-			pci_read_config_dword(pci_dev, i * 16 + j, &val);
-			out += sprintf(out, "%08X ", val);
-		}
-		out += sprintf(out, "\n");
-	}
-
-	return out - buf;
-}
-static DEVICE_ATTR(pci, S_IRUGO, show_pci, NULL);
-
-static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
-			char *buf)
-{
-	struct ipw2100_priv *p = d->driver_data;
-	return sprintf(buf, "0x%08x\n", (int)p->config);
-}
-static DEVICE_ATTR(cfg, S_IRUGO, show_cfg, NULL);
-
-static ssize_t show_status(struct device *d, struct device_attribute *attr,
-			char *buf)
-{
-	struct ipw2100_priv *p = d->driver_data;
-	return sprintf(buf, "0x%08x\n", (int)p->status);
-}
-static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
-
-static ssize_t show_capability(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	struct ipw2100_priv *p = d->driver_data;
-	return sprintf(buf, "0x%08x\n", (int)p->capability);
-}
-static DEVICE_ATTR(capability, S_IRUGO, show_capability, NULL);
-
-
-#define IPW2100_REG(x) { IPW_ ##x, #x }
-static const struct {
-	u32 addr;
-	const char *name;
-} hw_data[] = {
-	IPW2100_REG(REG_GP_CNTRL),
-	IPW2100_REG(REG_GPIO),
-	IPW2100_REG(REG_INTA),
-	IPW2100_REG(REG_INTA_MASK),
-	IPW2100_REG(REG_RESET_REG),
-};
-#define IPW2100_NIC(x, s) { x, #x, s }
-static const struct {
-	u32 addr;
-	const char *name;
-	size_t size;
-} nic_data[] = {
-	IPW2100_NIC(IPW2100_CONTROL_REG, 2),
-	IPW2100_NIC(0x210014, 1),
-	IPW2100_NIC(0x210000, 1),
-};
-#define IPW2100_ORD(x, d) { IPW_ORD_ ##x, #x, d }
-static const struct {
-	u8 index;
-	const char *name;
-	const char *desc;
-} ord_data[] = {
-	IPW2100_ORD(STAT_TX_HOST_REQUESTS, "requested Host Tx's (MSDU)"),
-	IPW2100_ORD(STAT_TX_HOST_COMPLETE, "successful Host Tx's (MSDU)"),
-	IPW2100_ORD(STAT_TX_DIR_DATA,	   "successful Directed Tx's (MSDU)"),
-	IPW2100_ORD(STAT_TX_DIR_DATA1,	   "successful Directed Tx's (MSDU) @ 1MB"),
-	IPW2100_ORD(STAT_TX_DIR_DATA2,	   "successful Directed Tx's (MSDU) @ 2MB"),
-	IPW2100_ORD(STAT_TX_DIR_DATA5_5,   "successful Directed Tx's (MSDU) @ 5_5MB"),
-	IPW2100_ORD(STAT_TX_DIR_DATA11,	   "successful Directed Tx's (MSDU) @ 11MB"),
-	IPW2100_ORD(STAT_TX_NODIR_DATA1,   "successful Non_Directed Tx's (MSDU) @ 1MB"),
-	IPW2100_ORD(STAT_TX_NODIR_DATA2,   "successful Non_Directed Tx's (MSDU) @ 2MB"),
-	IPW2100_ORD(STAT_TX_NODIR_DATA5_5, "successful Non_Directed Tx's (MSDU) @ 5.5MB"),
-	IPW2100_ORD(STAT_TX_NODIR_DATA11,  "successful Non_Directed Tx's (MSDU) @ 11MB"),
-	IPW2100_ORD(STAT_NULL_DATA,	   "successful NULL data Tx's"),
-	IPW2100_ORD(STAT_TX_RTS,	   "successful Tx RTS"),
-	IPW2100_ORD(STAT_TX_CTS,	   "successful Tx CTS"),
-	IPW2100_ORD(STAT_TX_ACK,	   "successful Tx ACK"),
-	IPW2100_ORD(STAT_TX_ASSN,	   "successful Association Tx's"),
-	IPW2100_ORD(STAT_TX_ASSN_RESP,	   "successful Association response Tx's"),
-	IPW2100_ORD(STAT_TX_REASSN,	   "successful Reassociation Tx's"),
-	IPW2100_ORD(STAT_TX_REASSN_RESP,   "successful Reassociation response Tx's"),
-	IPW2100_ORD(STAT_TX_PROBE,	   "probes successfully transmitted"),
-	IPW2100_ORD(STAT_TX_PROBE_RESP,	   "probe responses successfully transmitted"),
-	IPW2100_ORD(STAT_TX_BEACON,	   "tx beacon"),
-	IPW2100_ORD(STAT_TX_ATIM,	   "Tx ATIM"),
-	IPW2100_ORD(STAT_TX_DISASSN,	   "successful Disassociation TX"),
-	IPW2100_ORD(STAT_TX_AUTH,	   "successful Authentication Tx"),
-	IPW2100_ORD(STAT_TX_DEAUTH,	   "successful Deauthentication TX"),
-	IPW2100_ORD(STAT_TX_TOTAL_BYTES,   "Total successful Tx data bytes"),
-	IPW2100_ORD(STAT_TX_RETRIES,       "Tx retries"),
-	IPW2100_ORD(STAT_TX_RETRY1,        "Tx retries at 1MBPS"),
-	IPW2100_ORD(STAT_TX_RETRY2,        "Tx retries at 2MBPS"),
-	IPW2100_ORD(STAT_TX_RETRY5_5,	   "Tx retries at 5.5MBPS"),
-	IPW2100_ORD(STAT_TX_RETRY11,	   "Tx retries at 11MBPS"),
-	IPW2100_ORD(STAT_TX_FAILURES,	   "Tx Failures"),
-	IPW2100_ORD(STAT_TX_MAX_TRIES_IN_HOP,"times max tries in a hop failed"),
-	IPW2100_ORD(STAT_TX_DISASSN_FAIL,	"times disassociation failed"),
-	IPW2100_ORD(STAT_TX_ERR_CTS,         "missed/bad CTS frames"),
-	IPW2100_ORD(STAT_TX_ERR_ACK,	"tx err due to acks"),
-	IPW2100_ORD(STAT_RX_HOST,	"packets passed to host"),
-	IPW2100_ORD(STAT_RX_DIR_DATA,	"directed packets"),
-	IPW2100_ORD(STAT_RX_DIR_DATA1,	"directed packets at 1MB"),
-	IPW2100_ORD(STAT_RX_DIR_DATA2,	"directed packets at 2MB"),
-	IPW2100_ORD(STAT_RX_DIR_DATA5_5,	"directed packets at 5.5MB"),
-	IPW2100_ORD(STAT_RX_DIR_DATA11,	"directed packets at 11MB"),
-	IPW2100_ORD(STAT_RX_NODIR_DATA,"nondirected packets"),
-	IPW2100_ORD(STAT_RX_NODIR_DATA1,	"nondirected packets at 1MB"),
-	IPW2100_ORD(STAT_RX_NODIR_DATA2,	"nondirected packets at 2MB"),
-	IPW2100_ORD(STAT_RX_NODIR_DATA5_5,	"nondirected packets at 5.5MB"),
-	IPW2100_ORD(STAT_RX_NODIR_DATA11,	"nondirected packets at 11MB"),
-	IPW2100_ORD(STAT_RX_NULL_DATA,	"null data rx's"),
-	IPW2100_ORD(STAT_RX_RTS,	"Rx RTS"),
-	IPW2100_ORD(STAT_RX_CTS,	"Rx CTS"),
-	IPW2100_ORD(STAT_RX_ACK,	"Rx ACK"),
-	IPW2100_ORD(STAT_RX_CFEND,	"Rx CF End"),
-	IPW2100_ORD(STAT_RX_CFEND_ACK,	"Rx CF End + CF Ack"),
-	IPW2100_ORD(STAT_RX_ASSN,	"Association Rx's"),
-	IPW2100_ORD(STAT_RX_ASSN_RESP,	"Association response Rx's"),
-	IPW2100_ORD(STAT_RX_REASSN,	"Reassociation Rx's"),
-	IPW2100_ORD(STAT_RX_REASSN_RESP,	"Reassociation response Rx's"),
-	IPW2100_ORD(STAT_RX_PROBE,	"probe Rx's"),
-	IPW2100_ORD(STAT_RX_PROBE_RESP,	"probe response Rx's"),
-	IPW2100_ORD(STAT_RX_BEACON,	"Rx beacon"),
-	IPW2100_ORD(STAT_RX_ATIM,	"Rx ATIM"),
-	IPW2100_ORD(STAT_RX_DISASSN,	"disassociation Rx"),
-	IPW2100_ORD(STAT_RX_AUTH,	"authentication Rx"),
-	IPW2100_ORD(STAT_RX_DEAUTH,	"deauthentication Rx"),
-	IPW2100_ORD(STAT_RX_TOTAL_BYTES,"Total rx data bytes received"),
-	IPW2100_ORD(STAT_RX_ERR_CRC,	 "packets with Rx CRC error"),
-	IPW2100_ORD(STAT_RX_ERR_CRC1,	 "Rx CRC errors at 1MB"),
-	IPW2100_ORD(STAT_RX_ERR_CRC2,	 "Rx CRC errors at 2MB"),
-	IPW2100_ORD(STAT_RX_ERR_CRC5_5,	 "Rx CRC errors at 5.5MB"),
-	IPW2100_ORD(STAT_RX_ERR_CRC11,	 "Rx CRC errors at 11MB"),
-	IPW2100_ORD(STAT_RX_DUPLICATE1, "duplicate rx packets at 1MB"),
-	IPW2100_ORD(STAT_RX_DUPLICATE2,	 "duplicate rx packets at 2MB"),
-	IPW2100_ORD(STAT_RX_DUPLICATE5_5,	 "duplicate rx packets at 5.5MB"),
-	IPW2100_ORD(STAT_RX_DUPLICATE11,	 "duplicate rx packets at 11MB"),
-	IPW2100_ORD(STAT_RX_DUPLICATE, "duplicate rx packets"),
-	IPW2100_ORD(PERS_DB_LOCK,	"locking fw permanent  db"),
-	IPW2100_ORD(PERS_DB_SIZE,	"size of fw permanent  db"),
-	IPW2100_ORD(PERS_DB_ADDR,	"address of fw permanent  db"),
-	IPW2100_ORD(STAT_RX_INVALID_PROTOCOL,	"rx frames with invalid protocol"),
-	IPW2100_ORD(SYS_BOOT_TIME,	"Boot time"),
-	IPW2100_ORD(STAT_RX_NO_BUFFER,	"rx frames rejected due to no buffer"),
-	IPW2100_ORD(STAT_RX_MISSING_FRAG,	"rx frames dropped due to missing fragment"),
-	IPW2100_ORD(STAT_RX_ORPHAN_FRAG,	"rx frames dropped due to non-sequential fragment"),
-	IPW2100_ORD(STAT_RX_ORPHAN_FRAME,	"rx frames dropped due to unmatched 1st frame"),
-	IPW2100_ORD(STAT_RX_FRAG_AGEOUT,	"rx frames dropped due to uncompleted frame"),
-	IPW2100_ORD(STAT_RX_ICV_ERRORS,	"ICV errors during decryption"),
-	IPW2100_ORD(STAT_PSP_SUSPENSION,"times adapter suspended"),
-	IPW2100_ORD(STAT_PSP_BCN_TIMEOUT,	"beacon timeout"),
-	IPW2100_ORD(STAT_PSP_POLL_TIMEOUT,	"poll response timeouts"),
-	IPW2100_ORD(STAT_PSP_NONDIR_TIMEOUT, "timeouts waiting for last {broad,multi}cast pkt"),
-	IPW2100_ORD(STAT_PSP_RX_DTIMS,	"PSP DTIMs received"),
-	IPW2100_ORD(STAT_PSP_RX_TIMS,	"PSP TIMs received"),
-	IPW2100_ORD(STAT_PSP_STATION_ID,"PSP Station ID"),
-	IPW2100_ORD(LAST_ASSN_TIME,	"RTC time of last association"),
-	IPW2100_ORD(STAT_PERCENT_MISSED_BCNS,"current calculation of % missed beacons"),
-	IPW2100_ORD(STAT_PERCENT_RETRIES,"current calculation of % missed tx retries"),
-	IPW2100_ORD(ASSOCIATED_AP_PTR,	"0 if not associated, else pointer to AP table entry"),
-	IPW2100_ORD(AVAILABLE_AP_CNT,	"AP's decsribed in the AP table"),
-	IPW2100_ORD(AP_LIST_PTR,	"Ptr to list of available APs"),
-	IPW2100_ORD(STAT_AP_ASSNS,	"associations"),
-	IPW2100_ORD(STAT_ASSN_FAIL,	"association failures"),
-	IPW2100_ORD(STAT_ASSN_RESP_FAIL,"failures due to response fail"),
-	IPW2100_ORD(STAT_FULL_SCANS,	"full scans"),
-	IPW2100_ORD(CARD_DISABLED,	"Card Disabled"),
-	IPW2100_ORD(STAT_ROAM_INHIBIT,	"times roaming was inhibited due to activity"),
-	IPW2100_ORD(RSSI_AT_ASSN,	"RSSI of associated AP at time of association"),
-	IPW2100_ORD(STAT_ASSN_CAUSE1,	"reassociation: no probe response or TX on hop"),
-	IPW2100_ORD(STAT_ASSN_CAUSE2,	"reassociation: poor tx/rx quality"),
-	IPW2100_ORD(STAT_ASSN_CAUSE3,	"reassociation: tx/rx quality (excessive AP load"),
-	IPW2100_ORD(STAT_ASSN_CAUSE4,	"reassociation: AP RSSI level"),
-	IPW2100_ORD(STAT_ASSN_CAUSE5,	"reassociations due to load leveling"),
-	IPW2100_ORD(STAT_AUTH_FAIL,	"times authentication failed"),
-	IPW2100_ORD(STAT_AUTH_RESP_FAIL,"times authentication response failed"),
-	IPW2100_ORD(STATION_TABLE_CNT,	"entries in association table"),
-	IPW2100_ORD(RSSI_AVG_CURR,	"Current avg RSSI"),
-	IPW2100_ORD(POWER_MGMT_MODE,	"Power mode - 0=CAM, 1=PSP"),
-	IPW2100_ORD(COUNTRY_CODE,	"IEEE country code as recv'd from beacon"),
-	IPW2100_ORD(COUNTRY_CHANNELS,	"channels suported by country"),
-	IPW2100_ORD(RESET_CNT,	"adapter resets (warm)"),
-	IPW2100_ORD(BEACON_INTERVAL,	"Beacon interval"),
-	IPW2100_ORD(ANTENNA_DIVERSITY,	"TRUE if antenna diversity is disabled"),
-	IPW2100_ORD(DTIM_PERIOD,	"beacon intervals between DTIMs"),
-	IPW2100_ORD(OUR_FREQ,	"current radio freq lower digits - channel ID"),
-	IPW2100_ORD(RTC_TIME,	"current RTC time"),
-	IPW2100_ORD(PORT_TYPE,	"operating mode"),
-	IPW2100_ORD(CURRENT_TX_RATE,	"current tx rate"),
-	IPW2100_ORD(SUPPORTED_RATES,	"supported tx rates"),
-	IPW2100_ORD(ATIM_WINDOW,	"current ATIM Window"),
-	IPW2100_ORD(BASIC_RATES,	"basic tx rates"),
-	IPW2100_ORD(NIC_HIGHEST_RATE,	"NIC highest tx rate"),
-	IPW2100_ORD(AP_HIGHEST_RATE,	"AP highest tx rate"),
-	IPW2100_ORD(CAPABILITIES,	"Management frame capability field"),
-	IPW2100_ORD(AUTH_TYPE,	"Type of authentication"),
-	IPW2100_ORD(RADIO_TYPE,	"Adapter card platform type"),
-	IPW2100_ORD(RTS_THRESHOLD,	"Min packet length for RTS handshaking"),
-	IPW2100_ORD(INT_MODE,	"International mode"),
-	IPW2100_ORD(FRAGMENTATION_THRESHOLD,	"protocol frag threshold"),
-	IPW2100_ORD(EEPROM_SRAM_DB_BLOCK_START_ADDRESS,	"EEPROM offset in SRAM"),
-	IPW2100_ORD(EEPROM_SRAM_DB_BLOCK_SIZE,	"EEPROM size in SRAM"),
-	IPW2100_ORD(EEPROM_SKU_CAPABILITY,	"EEPROM SKU Capability"),
-	IPW2100_ORD(EEPROM_IBSS_11B_CHANNELS,	"EEPROM IBSS 11b channel set"),
-	IPW2100_ORD(MAC_VERSION,	"MAC Version"),
-	IPW2100_ORD(MAC_REVISION,	"MAC Revision"),
-	IPW2100_ORD(RADIO_VERSION,	"Radio Version"),
-	IPW2100_ORD(NIC_MANF_DATE_TIME,	"MANF Date/Time STAMP"),
-	IPW2100_ORD(UCODE_VERSION,	"Ucode Version"),
-};
-
-
-static ssize_t show_registers(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	int i;
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	struct net_device *dev = priv->net_dev;
-	char * out = buf;
-	u32 val = 0;
-
-	out += sprintf(out, "%30s [Address ] : Hex\n", "Register");
-
-	for (i = 0; i < (sizeof(hw_data) / sizeof(*hw_data)); i++) {
-		read_register(dev, hw_data[i].addr, &val);
-		out += sprintf(out, "%30s [%08X] : %08X\n",
-			       hw_data[i].name, hw_data[i].addr, val);
-	}
-
-	return out - buf;
-}
-static DEVICE_ATTR(registers, S_IRUGO, show_registers, NULL);
-
-
-static ssize_t show_hardware(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	struct net_device *dev = priv->net_dev;
-	char * out = buf;
-	int i;
-
-	out += sprintf(out, "%30s [Address ] : Hex\n", "NIC entry");
-
-	for (i = 0; i < (sizeof(nic_data) / sizeof(*nic_data)); i++) {
-		u8 tmp8;
-		u16 tmp16;
-		u32 tmp32;
-
-		switch (nic_data[i].size) {
-		case 1:
-			read_nic_byte(dev, nic_data[i].addr, &tmp8);
-			out += sprintf(out, "%30s [%08X] : %02X\n",
-				       nic_data[i].name, nic_data[i].addr,
-				       tmp8);
-			break;
-		case 2:
-			read_nic_word(dev, nic_data[i].addr, &tmp16);
-			out += sprintf(out, "%30s [%08X] : %04X\n",
-				       nic_data[i].name, nic_data[i].addr,
-				       tmp16);
-			break;
-		case 4:
-			read_nic_dword(dev, nic_data[i].addr, &tmp32);
-			out += sprintf(out, "%30s [%08X] : %08X\n",
-				       nic_data[i].name, nic_data[i].addr,
-				       tmp32);
-			break;
-		}
-	}
-	return out - buf;
-}
-static DEVICE_ATTR(hardware, S_IRUGO, show_hardware, NULL);
-
-
-static ssize_t show_memory(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	struct net_device *dev = priv->net_dev;
-	static unsigned long loop = 0;
-	int len = 0;
-	u32 buffer[4];
-	int i;
-	char line[81];
-
-	if (loop >= 0x30000)
-		loop = 0;
-
-	/* sysfs provides us PAGE_SIZE buffer */
-	while (len < PAGE_SIZE - 128 && loop < 0x30000) {
-
-		if (priv->snapshot[0]) for (i = 0; i < 4; i++)
-			buffer[i] = *(u32 *)SNAPSHOT_ADDR(loop + i * 4);
-		else for (i = 0; i < 4; i++)
-			read_nic_dword(dev, loop + i * 4, &buffer[i]);
-
-		if (priv->dump_raw)
-			len += sprintf(buf + len,
-				       "%c%c%c%c"
-				       "%c%c%c%c"
-				       "%c%c%c%c"
-				       "%c%c%c%c",
-				       ((u8*)buffer)[0x0],
-				       ((u8*)buffer)[0x1],
-				       ((u8*)buffer)[0x2],
-				       ((u8*)buffer)[0x3],
-				       ((u8*)buffer)[0x4],
-				       ((u8*)buffer)[0x5],
-				       ((u8*)buffer)[0x6],
-				       ((u8*)buffer)[0x7],
-				       ((u8*)buffer)[0x8],
-				       ((u8*)buffer)[0x9],
-				       ((u8*)buffer)[0xa],
-				       ((u8*)buffer)[0xb],
-				       ((u8*)buffer)[0xc],
-				       ((u8*)buffer)[0xd],
-				       ((u8*)buffer)[0xe],
-				       ((u8*)buffer)[0xf]);
-		else
-			len += sprintf(buf + len, "%s\n",
-				       snprint_line(line, sizeof(line),
-						    (u8*)buffer, 16, loop));
-		loop += 16;
-	}
-
-	return len;
-}
-
-static ssize_t store_memory(struct device *d, struct device_attribute *attr,
-				const char *buf, size_t count)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	struct net_device *dev = priv->net_dev;
-	const char *p = buf;
-
-	if (count < 1)
-		return count;
-
-	if (p[0] == '1' ||
-	    (count >= 2 && tolower(p[0]) == 'o' && tolower(p[1]) == 'n')) {
-		IPW_DEBUG_INFO("%s: Setting memory dump to RAW mode.\n",
-		       dev->name);
-		priv->dump_raw = 1;
-
-	} else if (p[0] == '0' || (count >= 2 && tolower(p[0]) == 'o' &&
-				  tolower(p[1]) == 'f')) {
-		IPW_DEBUG_INFO("%s: Setting memory dump to HEX mode.\n",
-		       dev->name);
-		priv->dump_raw = 0;
-
-	} else if (tolower(p[0]) == 'r') {
-		IPW_DEBUG_INFO("%s: Resetting firmware snapshot.\n",
-		       dev->name);
-		ipw2100_snapshot_free(priv);
-
-	} else
-		IPW_DEBUG_INFO("%s: Usage: 0|on = HEX, 1|off = RAW, "
-		       "reset = clear memory snapshot\n",
-		       dev->name);
-
-	return count;
-}
-static DEVICE_ATTR(memory, S_IWUSR|S_IRUGO, show_memory, store_memory);
-
-
-static ssize_t show_ordinals(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	u32 val = 0;
-	int len = 0;
-	u32 val_len;
-	static int loop = 0;
-
-	if (loop >= sizeof(ord_data) / sizeof(*ord_data))
-		loop = 0;
-
-	/* sysfs provides us PAGE_SIZE buffer */
-	while (len < PAGE_SIZE - 128 &&
-	       loop < (sizeof(ord_data) / sizeof(*ord_data))) {
-
-		val_len = sizeof(u32);
-
-		if (ipw2100_get_ordinal(priv, ord_data[loop].index, &val,
-					&val_len))
-			len += sprintf(buf + len, "[0x%02X] = ERROR    %s\n",
-				       ord_data[loop].index,
-				       ord_data[loop].desc);
-		else
-			len += sprintf(buf + len, "[0x%02X] = 0x%08X %s\n",
-				       ord_data[loop].index, val,
-				       ord_data[loop].desc);
-		loop++;
-	}
-
-	return len;
-}
-static DEVICE_ATTR(ordinals, S_IRUGO, show_ordinals, NULL);
-
-
-static ssize_t show_stats(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	char * out = buf;
-
-	out += sprintf(out, "interrupts: %d {tx: %d, rx: %d, other: %d}\n",
-		       priv->interrupts, priv->tx_interrupts,
-		       priv->rx_interrupts, priv->inta_other);
-	out += sprintf(out, "firmware resets: %d\n", priv->resets);
-	out += sprintf(out, "firmware hangs: %d\n", priv->hangs);
-#ifdef CONFIG_IPW_DEBUG
-	out += sprintf(out, "packet mismatch image: %s\n",
-		       priv->snapshot[0] ? "YES" : "NO");
-#endif
-
-	return out - buf;
-}
-static DEVICE_ATTR(stats, S_IRUGO, show_stats, NULL);
-
-
-static int ipw2100_switch_mode(struct ipw2100_priv *priv, u32 mode)
-{
-	int err;
-
-	if (mode == priv->ieee->iw_mode)
-		return 0;
-
-	err = ipw2100_disable_adapter(priv);
-	if (err) {
-		printk(KERN_ERR DRV_NAME ": %s: Could not disable adapter %d\n",
-		       priv->net_dev->name, err);
-		return err;
-	}
-
-	switch (mode) {
-	case IW_MODE_INFRA:
-		priv->net_dev->type = ARPHRD_ETHER;
-		break;
-	case IW_MODE_ADHOC:
-		priv->net_dev->type = ARPHRD_ETHER;
-		break;
-#ifdef CONFIG_IPW2100_MONITOR
-	case IW_MODE_MONITOR:
-		priv->last_mode = priv->ieee->iw_mode;
-		priv->net_dev->type = ARPHRD_IEEE80211;
-		break;
-#endif /* CONFIG_IPW2100_MONITOR */
-	}
-
-	priv->ieee->iw_mode = mode;
-
-#ifdef CONFIG_PM
-        /* Indicate ipw2100_download_firmware download firmware
-	 * from disk instead of memory. */
-	ipw2100_firmware.version = 0;
-#endif
-
-	printk(KERN_INFO "%s: Reseting on mode change.\n",
-		priv->net_dev->name);
-	priv->reset_backoff = 0;
-	schedule_reset(priv);
-
-	return 0;
-}
-
-static ssize_t show_internals(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	int len = 0;
-
-#define DUMP_VAR(x,y) len += sprintf(buf + len, # x ": %" # y "\n", priv-> x)
-
-	if (priv->status & STATUS_ASSOCIATED)
-		len += sprintf(buf + len, "connected: %lu\n",
-			       get_seconds() - priv->connect_start);
-	else
-		len += sprintf(buf + len, "not connected\n");
-
-	DUMP_VAR(ieee->crypt[priv->ieee->tx_keyidx], p);
-	DUMP_VAR(status, 08lx);
-	DUMP_VAR(config, 08lx);
-	DUMP_VAR(capability, 08lx);
-
-	len += sprintf(buf + len, "last_rtc: %lu\n", (unsigned long)priv->last_rtc);
-
-	DUMP_VAR(fatal_error, d);
-	DUMP_VAR(stop_hang_check, d);
-	DUMP_VAR(stop_rf_kill, d);
-	DUMP_VAR(messages_sent, d);
-
-	DUMP_VAR(tx_pend_stat.value, d);
-	DUMP_VAR(tx_pend_stat.hi, d);
-
-	DUMP_VAR(tx_free_stat.value, d);
-	DUMP_VAR(tx_free_stat.lo, d);
-
-	DUMP_VAR(msg_free_stat.value, d);
-	DUMP_VAR(msg_free_stat.lo, d);
-
-	DUMP_VAR(msg_pend_stat.value, d);
-	DUMP_VAR(msg_pend_stat.hi, d);
-
-	DUMP_VAR(fw_pend_stat.value, d);
-	DUMP_VAR(fw_pend_stat.hi, d);
-
-	DUMP_VAR(txq_stat.value, d);
-	DUMP_VAR(txq_stat.lo, d);
-
-	DUMP_VAR(ieee->scans, d);
-	DUMP_VAR(reset_backoff, d);
-
-	return len;
-}
-static DEVICE_ATTR(internals, S_IRUGO, show_internals, NULL);
-
-
-static ssize_t show_bssinfo(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	char essid[IW_ESSID_MAX_SIZE + 1];
-	u8 bssid[ETH_ALEN];
-	u32 chan = 0;
-	char * out = buf;
-	int length;
-	int ret;
-
-	memset(essid, 0, sizeof(essid));
-	memset(bssid, 0, sizeof(bssid));
-
-	length = IW_ESSID_MAX_SIZE;
-	ret = ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_SSID, essid, &length);
-	if (ret)
-		IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
-			       __LINE__);
-
-	length = sizeof(bssid);
-	ret = ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_AP_BSSID,
-				  bssid, &length);
-	if (ret)
-		IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
-			       __LINE__);
-
-	length = sizeof(u32);
-	ret = ipw2100_get_ordinal(priv, IPW_ORD_OUR_FREQ, &chan, &length);
-	if (ret)
-		IPW_DEBUG_INFO("failed querying ordinals at line %d\n",
-			       __LINE__);
-
-	out += sprintf(out, "ESSID: %s\n", essid);
-	out += sprintf(out, "BSSID:   %02x:%02x:%02x:%02x:%02x:%02x\n",
-		       bssid[0], bssid[1], bssid[2],
-		       bssid[3], bssid[4], bssid[5]);
-	out += sprintf(out, "Channel: %d\n", chan);
-
-	return out - buf;
-}
-static DEVICE_ATTR(bssinfo, S_IRUGO, show_bssinfo, NULL);
-
-
-#ifdef CONFIG_IPW_DEBUG
-static ssize_t show_debug_level(struct device_driver *d, char *buf)
-{
-	return sprintf(buf, "0x%08X\n", ipw2100_debug_level);
-}
-
-static ssize_t store_debug_level(struct device_driver *d, const char *buf,
-				 size_t count)
-{
-	char *p = (char *)buf;
-	u32 val;
-
-	if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
-		p++;
-		if (p[0] == 'x' || p[0] == 'X')
-			p++;
-		val = simple_strtoul(p, &p, 16);
-	} else
-		val = simple_strtoul(p, &p, 10);
-	if (p == buf)
-		IPW_DEBUG_INFO(DRV_NAME
-		       ": %s is not in hex or decimal form.\n", buf);
-	else
-		ipw2100_debug_level = val;
-
-	return strnlen(buf, count);
-}
-static DRIVER_ATTR(debug_level, S_IWUSR | S_IRUGO, show_debug_level,
-		   store_debug_level);
-#endif /* CONFIG_IPW_DEBUG */
-
-
-static ssize_t show_fatal_error(struct device *d,
-			struct device_attribute *attr, char *buf)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	char *out = buf;
-	int i;
-
-	if (priv->fatal_error)
-		out += sprintf(out, "0x%08X\n",
-			       priv->fatal_error);
-	else
-		out += sprintf(out, "0\n");
-
-	for (i = 1; i <= IPW2100_ERROR_QUEUE; i++) {
-		if (!priv->fatal_errors[(priv->fatal_index - i) %
-					IPW2100_ERROR_QUEUE])
-			continue;
-
-		out += sprintf(out, "%d. 0x%08X\n", i,
-			       priv->fatal_errors[(priv->fatal_index - i) %
-						  IPW2100_ERROR_QUEUE]);
-	}
-
-	return out - buf;
-}
-
-static ssize_t store_fatal_error(struct device *d,
-		struct device_attribute *attr, const char *buf, size_t count)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	schedule_reset(priv);
-	return count;
-}
-static DEVICE_ATTR(fatal_error, S_IWUSR|S_IRUGO, show_fatal_error, store_fatal_error);
-
-
-static ssize_t show_scan_age(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	return sprintf(buf, "%d\n", priv->ieee->scan_age);
-}
-
-static ssize_t store_scan_age(struct device *d, struct device_attribute *attr,
-				const char *buf, size_t count)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	struct net_device *dev = priv->net_dev;
-	char buffer[] = "00000000";
-	unsigned long len =
-	    (sizeof(buffer) - 1) > count ? count : sizeof(buffer) - 1;
-	unsigned long val;
-	char *p = buffer;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	strncpy(buffer, buf, len);
-	buffer[len] = 0;
-
-	if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
-		p++;
-		if (p[0] == 'x' || p[0] == 'X')
-			p++;
-		val = simple_strtoul(p, &p, 16);
-	} else
-		val = simple_strtoul(p, &p, 10);
-	if (p == buffer) {
-		IPW_DEBUG_INFO("%s: user supplied invalid value.\n",
-		       dev->name);
-	} else {
-		priv->ieee->scan_age = val;
-		IPW_DEBUG_INFO("set scan_age = %u\n", priv->ieee->scan_age);
-	}
-
-	IPW_DEBUG_INFO("exit\n");
-	return len;
-}
-static DEVICE_ATTR(scan_age, S_IWUSR | S_IRUGO, show_scan_age, store_scan_age);
-
-
-static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	/* 0 - RF kill not enabled
-	   1 - SW based RF kill active (sysfs)
-	   2 - HW based RF kill active
-	   3 - Both HW and SW baed RF kill active */
-	struct ipw2100_priv *priv = (struct ipw2100_priv *)d->driver_data;
-	int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
-		(rf_kill_active(priv) ? 0x2 : 0x0);
-	return sprintf(buf, "%i\n", val);
-}
-
-static int ipw_radio_kill_sw(struct ipw2100_priv *priv, int disable_radio)
-{
-	if ((disable_radio ? 1 : 0) ==
-	    (priv->status & STATUS_RF_KILL_SW ? 1 : 0))
-		return 0 ;
-
-	IPW_DEBUG_RF_KILL("Manual SW RF Kill set to: RADIO  %s\n",
-			  disable_radio ? "OFF" : "ON");
-
-	down(&priv->action_sem);
-
-	if (disable_radio) {
-		priv->status |= STATUS_RF_KILL_SW;
-		ipw2100_down(priv);
-	} else {
-		priv->status &= ~STATUS_RF_KILL_SW;
-		if (rf_kill_active(priv)) {
-			IPW_DEBUG_RF_KILL("Can not turn radio back on - "
-					  "disabled by HW switch\n");
-			/* Make sure the RF_KILL check timer is running */
-			priv->stop_rf_kill = 0;
-			cancel_delayed_work(&priv->rf_kill);
-			queue_delayed_work(priv->workqueue, &priv->rf_kill,
-					   HZ);
-		} else
-			schedule_reset(priv);
-	}
-
-	up(&priv->action_sem);
-	return 1;
-}
-
-static ssize_t store_rf_kill(struct device *d, struct device_attribute *attr,
-				const char *buf, size_t count)
-{
-	struct ipw2100_priv *priv = dev_get_drvdata(d);
-	ipw_radio_kill_sw(priv, buf[0] == '1');
-	return count;
-}
-static DEVICE_ATTR(rf_kill, S_IWUSR|S_IRUGO, show_rf_kill, store_rf_kill);
-
-
-static struct attribute *ipw2100_sysfs_entries[] = {
-	&dev_attr_hardware.attr,
-	&dev_attr_registers.attr,
-	&dev_attr_ordinals.attr,
-	&dev_attr_pci.attr,
-	&dev_attr_stats.attr,
-	&dev_attr_internals.attr,
-	&dev_attr_bssinfo.attr,
-	&dev_attr_memory.attr,
-	&dev_attr_scan_age.attr,
-	&dev_attr_fatal_error.attr,
-	&dev_attr_rf_kill.attr,
-	&dev_attr_cfg.attr,
-	&dev_attr_status.attr,
-	&dev_attr_capability.attr,
-	NULL,
-};
-
-static struct attribute_group ipw2100_attribute_group = {
-	.attrs = ipw2100_sysfs_entries,
-};
-
-
-static int status_queue_allocate(struct ipw2100_priv *priv, int entries)
-{
-	struct ipw2100_status_queue *q = &priv->status_queue;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	q->size = entries * sizeof(struct ipw2100_status);
-	q->drv = (struct ipw2100_status *)pci_alloc_consistent(
-		priv->pci_dev, q->size, &q->nic);
-	if (!q->drv) {
-		IPW_DEBUG_WARNING(
-		       "Can not allocate status queue.\n");
-		return -ENOMEM;
-	}
-
-	memset(q->drv, 0, q->size);
-
-	IPW_DEBUG_INFO("exit\n");
-
-	return 0;
-}
-
-static void status_queue_free(struct ipw2100_priv *priv)
-{
-	IPW_DEBUG_INFO("enter\n");
-
-	if (priv->status_queue.drv) {
-		pci_free_consistent(
-			priv->pci_dev, priv->status_queue.size,
-			priv->status_queue.drv, priv->status_queue.nic);
-		priv->status_queue.drv = NULL;
-	}
-
-	IPW_DEBUG_INFO("exit\n");
-}
-
-static int bd_queue_allocate(struct ipw2100_priv *priv,
-			     struct ipw2100_bd_queue *q, int entries)
-{
-	IPW_DEBUG_INFO("enter\n");
-
-	memset(q, 0, sizeof(struct ipw2100_bd_queue));
-
-	q->entries = entries;
-	q->size = entries * sizeof(struct ipw2100_bd);
-	q->drv = pci_alloc_consistent(priv->pci_dev, q->size, &q->nic);
-	if (!q->drv) {
-		IPW_DEBUG_INFO("can't allocate shared memory for buffer descriptors\n");
-		return -ENOMEM;
-	}
-	memset(q->drv, 0, q->size);
-
-	IPW_DEBUG_INFO("exit\n");
-
-	return 0;
-}
-
-static void bd_queue_free(struct ipw2100_priv *priv,
-			  struct ipw2100_bd_queue *q)
-{
-	IPW_DEBUG_INFO("enter\n");
-
-	if (!q)
-		return;
-
-	if (q->drv) {
-		pci_free_consistent(priv->pci_dev,
-				    q->size, q->drv, q->nic);
-		q->drv = NULL;
-	}
-
-	IPW_DEBUG_INFO("exit\n");
-}
-
-static void bd_queue_initialize(
-	struct ipw2100_priv *priv, struct ipw2100_bd_queue * q,
-	u32 base, u32 size, u32 r, u32 w)
-{
-	IPW_DEBUG_INFO("enter\n");
-
-	IPW_DEBUG_INFO("initializing bd queue at virt=%p, phys=%08x\n", q->drv, (u32)q->nic);
-
-	write_register(priv->net_dev, base, q->nic);
-	write_register(priv->net_dev, size, q->entries);
-	write_register(priv->net_dev, r, q->oldest);
-	write_register(priv->net_dev, w, q->next);
-
-	IPW_DEBUG_INFO("exit\n");
-}
-
-static void ipw2100_kill_workqueue(struct ipw2100_priv *priv)
-{
-	if (priv->workqueue) {
-		priv->stop_rf_kill = 1;
-		priv->stop_hang_check = 1;
-		cancel_delayed_work(&priv->reset_work);
-		cancel_delayed_work(&priv->security_work);
-		cancel_delayed_work(&priv->wx_event_work);
-		cancel_delayed_work(&priv->hang_check);
-		cancel_delayed_work(&priv->rf_kill);
-		destroy_workqueue(priv->workqueue);
-		priv->workqueue = NULL;
-	}
-}
-
-static int ipw2100_tx_allocate(struct ipw2100_priv *priv)
-{
-	int i, j, err = -EINVAL;
-	void *v;
-	dma_addr_t p;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	err = bd_queue_allocate(priv, &priv->tx_queue, TX_QUEUE_LENGTH);
-	if (err) {
-		IPW_DEBUG_ERROR("%s: failed bd_queue_allocate\n",
-		       priv->net_dev->name);
-		return err;
-	}
-
-	priv->tx_buffers = (struct ipw2100_tx_packet *)kmalloc(
-		TX_PENDED_QUEUE_LENGTH * sizeof(struct ipw2100_tx_packet),
-		GFP_ATOMIC);
-	if (!priv->tx_buffers) {
-		printk(KERN_ERR DRV_NAME ": %s: alloc failed form tx buffers.\n",
-		       priv->net_dev->name);
-		bd_queue_free(priv, &priv->tx_queue);
-		return -ENOMEM;
-	}
-
-	for (i = 0; i < TX_PENDED_QUEUE_LENGTH; i++) {
-		v = pci_alloc_consistent(
-			priv->pci_dev, sizeof(struct ipw2100_data_header), &p);
-		if (!v) {
-			printk(KERN_ERR DRV_NAME ": %s: PCI alloc failed for tx "
-			       "buffers.\n", priv->net_dev->name);
-			err = -ENOMEM;
-			break;
-		}
-
-		priv->tx_buffers[i].type = DATA;
-		priv->tx_buffers[i].info.d_struct.data = (struct ipw2100_data_header*)v;
-		priv->tx_buffers[i].info.d_struct.data_phys = p;
-		priv->tx_buffers[i].info.d_struct.txb = NULL;
-	}
-
-	if (i == TX_PENDED_QUEUE_LENGTH)
-		return 0;
-
-	for (j = 0; j < i; j++) {
-		pci_free_consistent(
-			priv->pci_dev,
-			sizeof(struct ipw2100_data_header),
-			priv->tx_buffers[j].info.d_struct.data,
-			priv->tx_buffers[j].info.d_struct.data_phys);
-	}
-
-	kfree(priv->tx_buffers);
-	priv->tx_buffers = NULL;
-
-	return err;
-}
-
-static void ipw2100_tx_initialize(struct ipw2100_priv *priv)
-{
-	int i;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	/*
-	 * reinitialize packet info lists
-	 */
-	INIT_LIST_HEAD(&priv->fw_pend_list);
-	INIT_STAT(&priv->fw_pend_stat);
-
-	/*
-	 * reinitialize lists
-	 */
-	INIT_LIST_HEAD(&priv->tx_pend_list);
-	INIT_LIST_HEAD(&priv->tx_free_list);
-	INIT_STAT(&priv->tx_pend_stat);
-	INIT_STAT(&priv->tx_free_stat);
-
-	for (i = 0; i < TX_PENDED_QUEUE_LENGTH; i++) {
-		/* We simply drop any SKBs that have been queued for
-		 * transmit */
-		if (priv->tx_buffers[i].info.d_struct.txb) {
-			ieee80211_txb_free(priv->tx_buffers[i].info.d_struct.txb);
-			priv->tx_buffers[i].info.d_struct.txb = NULL;
-		}
-
-		list_add_tail(&priv->tx_buffers[i].list, &priv->tx_free_list);
-	}
-
-	SET_STAT(&priv->tx_free_stat, i);
-
-	priv->tx_queue.oldest = 0;
-	priv->tx_queue.available = priv->tx_queue.entries;
-	priv->tx_queue.next = 0;
-	INIT_STAT(&priv->txq_stat);
-	SET_STAT(&priv->txq_stat, priv->tx_queue.available);
-
-	bd_queue_initialize(priv, &priv->tx_queue,
-			    IPW_MEM_HOST_SHARED_TX_QUEUE_BD_BASE,
-			    IPW_MEM_HOST_SHARED_TX_QUEUE_BD_SIZE,
-			    IPW_MEM_HOST_SHARED_TX_QUEUE_READ_INDEX,
-			    IPW_MEM_HOST_SHARED_TX_QUEUE_WRITE_INDEX);
-
-	IPW_DEBUG_INFO("exit\n");
-
-}
-
-static void ipw2100_tx_free(struct ipw2100_priv *priv)
-{
-	int i;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	bd_queue_free(priv, &priv->tx_queue);
-
-	if (!priv->tx_buffers)
-		return;
-
-	for (i = 0; i < TX_PENDED_QUEUE_LENGTH; i++) {
-		if (priv->tx_buffers[i].info.d_struct.txb) {
-			ieee80211_txb_free(priv->tx_buffers[i].info.d_struct.txb);
-			priv->tx_buffers[i].info.d_struct.txb = NULL;
-		}
-		if (priv->tx_buffers[i].info.d_struct.data)
-			pci_free_consistent(
-				priv->pci_dev,
-				sizeof(struct ipw2100_data_header),
-				priv->tx_buffers[i].info.d_struct.data,
-				priv->tx_buffers[i].info.d_struct.data_phys);
-	}
-
-	kfree(priv->tx_buffers);
-	priv->tx_buffers = NULL;
-
-	IPW_DEBUG_INFO("exit\n");
-}
-
-
-
-static int ipw2100_rx_allocate(struct ipw2100_priv *priv)
-{
-	int i, j, err = -EINVAL;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	err = bd_queue_allocate(priv, &priv->rx_queue, RX_QUEUE_LENGTH);
-	if (err) {
-		IPW_DEBUG_INFO("failed bd_queue_allocate\n");
-		return err;
-	}
-
-	err = status_queue_allocate(priv, RX_QUEUE_LENGTH);
-	if (err) {
-		IPW_DEBUG_INFO("failed status_queue_allocate\n");
-		bd_queue_free(priv, &priv->rx_queue);
-		return err;
-	}
-
-	/*
-	 * allocate packets
-	 */
-	priv->rx_buffers = (struct ipw2100_rx_packet *)
-	    kmalloc(RX_QUEUE_LENGTH * sizeof(struct ipw2100_rx_packet),
-		    GFP_KERNEL);
-	if (!priv->rx_buffers) {
-		IPW_DEBUG_INFO("can't allocate rx packet buffer table\n");
-
-		bd_queue_free(priv, &priv->rx_queue);
-
-		status_queue_free(priv);
-
-		return -ENOMEM;
-	}
-
-	for (i = 0; i < RX_QUEUE_LENGTH; i++) {
-		struct ipw2100_rx_packet *packet = &priv->rx_buffers[i];
-
-		err = ipw2100_alloc_skb(priv, packet);
-		if (unlikely(err)) {
-			err = -ENOMEM;
-			break;
-		}
-
-		/* The BD holds the cache aligned address */
-		priv->rx_queue.drv[i].host_addr = packet->dma_addr;
-		priv->rx_queue.drv[i].buf_length = IPW_RX_NIC_BUFFER_LENGTH;
-		priv->status_queue.drv[i].status_fields = 0;
-	}
-
-	if (i == RX_QUEUE_LENGTH)
-		return 0;
-
-	for (j = 0; j < i; j++) {
-		pci_unmap_single(priv->pci_dev, priv->rx_buffers[j].dma_addr,
-				 sizeof(struct ipw2100_rx_packet),
-				 PCI_DMA_FROMDEVICE);
-		dev_kfree_skb(priv->rx_buffers[j].skb);
-	}
-
-	kfree(priv->rx_buffers);
-	priv->rx_buffers = NULL;
-
-	bd_queue_free(priv, &priv->rx_queue);
-
-	status_queue_free(priv);
-
-	return err;
-}
-
-static void ipw2100_rx_initialize(struct ipw2100_priv *priv)
-{
-	IPW_DEBUG_INFO("enter\n");
-
-	priv->rx_queue.oldest = 0;
-	priv->rx_queue.available = priv->rx_queue.entries - 1;
-	priv->rx_queue.next = priv->rx_queue.entries - 1;
-
-	INIT_STAT(&priv->rxq_stat);
-	SET_STAT(&priv->rxq_stat, priv->rx_queue.available);
-
-	bd_queue_initialize(priv, &priv->rx_queue,
-			    IPW_MEM_HOST_SHARED_RX_BD_BASE,
-			    IPW_MEM_HOST_SHARED_RX_BD_SIZE,
-			    IPW_MEM_HOST_SHARED_RX_READ_INDEX,
-			    IPW_MEM_HOST_SHARED_RX_WRITE_INDEX);
-
-	/* set up the status queue */
-	write_register(priv->net_dev, IPW_MEM_HOST_SHARED_RX_STATUS_BASE,
-		       priv->status_queue.nic);
-
-	IPW_DEBUG_INFO("exit\n");
-}
-
-static void ipw2100_rx_free(struct ipw2100_priv *priv)
-{
-	int i;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	bd_queue_free(priv, &priv->rx_queue);
-	status_queue_free(priv);
-
-	if (!priv->rx_buffers)
-		return;
-
-	for (i = 0; i < RX_QUEUE_LENGTH; i++) {
-		if (priv->rx_buffers[i].rxp) {
-			pci_unmap_single(priv->pci_dev,
-					 priv->rx_buffers[i].dma_addr,
-					 sizeof(struct ipw2100_rx),
-					 PCI_DMA_FROMDEVICE);
-			dev_kfree_skb(priv->rx_buffers[i].skb);
-		}
-	}
-
-	kfree(priv->rx_buffers);
-	priv->rx_buffers = NULL;
-
-	IPW_DEBUG_INFO("exit\n");
-}
-
-static int ipw2100_read_mac_address(struct ipw2100_priv *priv)
-{
-	u32 length = ETH_ALEN;
-	u8 mac[ETH_ALEN];
-
-	int err;
-
-	err = ipw2100_get_ordinal(priv, IPW_ORD_STAT_ADAPTER_MAC,
-				  mac, &length);
-	if (err) {
-		IPW_DEBUG_INFO("MAC address read failed\n");
-		return -EIO;
-	}
-	IPW_DEBUG_INFO("card MAC is %02X:%02X:%02X:%02X:%02X:%02X\n",
-	       mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
-
-	memcpy(priv->net_dev->dev_addr, mac, ETH_ALEN);
-
-	return 0;
-}
-
-/********************************************************************
- *
- * Firmware Commands
- *
- ********************************************************************/
-
-static int ipw2100_set_mac_address(struct ipw2100_priv *priv, int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = ADAPTER_ADDRESS,
-		.host_command_sequence = 0,
-		.host_command_length = ETH_ALEN
-	};
-	int err;
-
-	IPW_DEBUG_HC("SET_MAC_ADDRESS\n");
-
-	IPW_DEBUG_INFO("enter\n");
-
-	if (priv->config & CFG_CUSTOM_MAC) {
-		memcpy(cmd.host_command_parameters, priv->mac_addr,
-		       ETH_ALEN);
-		memcpy(priv->net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
-	} else
-		memcpy(cmd.host_command_parameters, priv->net_dev->dev_addr,
-		       ETH_ALEN);
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	IPW_DEBUG_INFO("exit\n");
-	return err;
-}
-
-static int ipw2100_set_port_type(struct ipw2100_priv *priv, u32 port_type,
-				 int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = PORT_TYPE,
-		.host_command_sequence = 0,
-		.host_command_length = sizeof(u32)
-	};
-	int err;
-
-	switch (port_type) {
-	case IW_MODE_INFRA:
-		cmd.host_command_parameters[0] = IPW_BSS;
-		break;
-	case IW_MODE_ADHOC:
-		cmd.host_command_parameters[0] = IPW_IBSS;
-		break;
-	}
-
-	IPW_DEBUG_HC("PORT_TYPE: %s\n",
-		     port_type == IPW_IBSS ? "Ad-Hoc" : "Managed");
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err) {
-			printk(KERN_ERR DRV_NAME ": %s: Could not disable adapter %d\n",
-			       priv->net_dev->name, err);
-			return err;
-		}
-	}
-
-	/* send cmd to firmware */
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	if (!batch_mode)
-		ipw2100_enable_adapter(priv);
-
-	return err;
-}
-
-
-static int ipw2100_set_channel(struct ipw2100_priv *priv, u32 channel,
-			       int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = CHANNEL,
-		.host_command_sequence = 0,
-		.host_command_length = sizeof(u32)
-	};
-	int err;
-
-	cmd.host_command_parameters[0] = channel;
-
-	IPW_DEBUG_HC("CHANNEL: %d\n", channel);
-
-	/* If BSS then we don't support channel selection */
-	if (priv->ieee->iw_mode == IW_MODE_INFRA)
-		return 0;
-
-	if ((channel != 0) &&
-	    ((channel < REG_MIN_CHANNEL) || (channel > REG_MAX_CHANNEL)))
-		return -EINVAL;
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err) {
-		IPW_DEBUG_INFO("Failed to set channel to %d",
-			       channel);
-		return err;
-	}
-
-	if (channel)
-		priv->config |= CFG_STATIC_CHANNEL;
-	else
-		priv->config &= ~CFG_STATIC_CHANNEL;
-
-	priv->channel = channel;
-
-	if (!batch_mode) {
-		err = ipw2100_enable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	return 0;
-}
-
-static int ipw2100_system_config(struct ipw2100_priv *priv, int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = SYSTEM_CONFIG,
-		.host_command_sequence = 0,
-		.host_command_length = 12,
-	};
-	u32 ibss_mask, len = sizeof(u32);
-	int err;
-
-	/* Set system configuration */
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	if (priv->ieee->iw_mode == IW_MODE_ADHOC)
-		cmd.host_command_parameters[0] |= IPW_CFG_IBSS_AUTO_START;
-
-	cmd.host_command_parameters[0] |= IPW_CFG_IBSS_MASK |
-		IPW_CFG_BSS_MASK |
-		IPW_CFG_802_1x_ENABLE;
-
-	if (!(priv->config & CFG_LONG_PREAMBLE))
-		cmd.host_command_parameters[0] |= IPW_CFG_PREAMBLE_AUTO;
-
-	err = ipw2100_get_ordinal(priv,
-				  IPW_ORD_EEPROM_IBSS_11B_CHANNELS,
-				  &ibss_mask,  &len);
-	if (err)
-		ibss_mask = IPW_IBSS_11B_DEFAULT_MASK;
-
-	cmd.host_command_parameters[1] = REG_CHANNEL_MASK;
-	cmd.host_command_parameters[2] = REG_CHANNEL_MASK & ibss_mask;
-
-	/* 11b only */
-	/*cmd.host_command_parameters[0] |= DIVERSITY_ANTENNA_A;*/
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err)
-		return err;
-
-/* If IPv6 is configured in the kernel then we don't want to filter out all
- * of the multicast packets as IPv6 needs some. */
-#if !defined(CONFIG_IPV6) && !defined(CONFIG_IPV6_MODULE)
-	cmd.host_command = ADD_MULTICAST;
-	cmd.host_command_sequence = 0;
-	cmd.host_command_length = 0;
-
-	ipw2100_hw_send_command(priv, &cmd);
-#endif
-	if (!batch_mode) {
-		err = ipw2100_enable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	return 0;
-}
-
-static int ipw2100_set_tx_rates(struct ipw2100_priv *priv, u32 rate,
-				int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = BASIC_TX_RATES,
-		.host_command_sequence = 0,
-		.host_command_length = 4
-	};
-	int err;
-
-	cmd.host_command_parameters[0] = rate & TX_RATE_MASK;
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	/* Set BASIC TX Rate first */
-	ipw2100_hw_send_command(priv, &cmd);
-
-	/* Set TX Rate */
-	cmd.host_command = TX_RATES;
-	ipw2100_hw_send_command(priv, &cmd);
-
-	/* Set MSDU TX Rate */
-	cmd.host_command = MSDU_TX_RATES;
-	ipw2100_hw_send_command(priv, &cmd);
-
-	if (!batch_mode) {
-		err = ipw2100_enable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	priv->tx_rates = rate;
-
-	return 0;
-}
-
-static int ipw2100_set_power_mode(struct ipw2100_priv *priv,
-				  int power_level)
-{
-	struct host_command cmd = {
-		.host_command = POWER_MODE,
-		.host_command_sequence = 0,
-		.host_command_length = 4
-	};
-	int err;
-
-	cmd.host_command_parameters[0] = power_level;
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err)
-		return err;
-
-	if (power_level == IPW_POWER_MODE_CAM)
-		priv->power_mode = IPW_POWER_LEVEL(priv->power_mode);
-	else
-		priv->power_mode = IPW_POWER_ENABLED | power_level;
-
-#ifdef CONFIG_IPW2100_TX_POWER
-	if (priv->port_type == IBSS &&
-	    priv->adhoc_power != DFTL_IBSS_TX_POWER) {
-		/* Set beacon interval */
-		cmd.host_command = TX_POWER_INDEX;
-		cmd.host_command_parameters[0] = (u32)priv->adhoc_power;
-
-		err = ipw2100_hw_send_command(priv, &cmd);
-		if (err)
-			return err;
-	}
-#endif
-
-	return 0;
-}
-
-
-static int ipw2100_set_rts_threshold(struct ipw2100_priv *priv, u32 threshold)
-{
-	struct host_command cmd = {
-		.host_command = RTS_THRESHOLD,
-		.host_command_sequence = 0,
-		.host_command_length = 4
-	};
-	int err;
-
-	if (threshold & RTS_DISABLED)
-		cmd.host_command_parameters[0] = MAX_RTS_THRESHOLD;
-	else
-		cmd.host_command_parameters[0] = threshold & ~RTS_DISABLED;
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err)
-		return err;
-
-	priv->rts_threshold = threshold;
-
-	return 0;
-}
-
-#if 0
-int ipw2100_set_fragmentation_threshold(struct ipw2100_priv *priv,
-					u32 threshold, int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = FRAG_THRESHOLD,
-		.host_command_sequence = 0,
-		.host_command_length = 4,
-		.host_command_parameters[0] = 0,
-	};
-	int err;
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	if (threshold == 0)
-		threshold = DEFAULT_FRAG_THRESHOLD;
-	else {
-		threshold = max(threshold, MIN_FRAG_THRESHOLD);
-		threshold = min(threshold, MAX_FRAG_THRESHOLD);
-	}
-
-	cmd.host_command_parameters[0] = threshold;
-
-	IPW_DEBUG_HC("FRAG_THRESHOLD: %u\n", threshold);
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	if (!batch_mode)
-		ipw2100_enable_adapter(priv);
-
-	if (!err)
-		priv->frag_threshold = threshold;
-
-	return err;
-}
-#endif
-
-static int ipw2100_set_short_retry(struct ipw2100_priv *priv, u32 retry)
-{
-	struct host_command cmd = {
-		.host_command = SHORT_RETRY_LIMIT,
-		.host_command_sequence = 0,
-		.host_command_length = 4
-	};
-	int err;
-
-	cmd.host_command_parameters[0] = retry;
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err)
-		return err;
-
-	priv->short_retry_limit = retry;
-
-	return 0;
-}
-
-static int ipw2100_set_long_retry(struct ipw2100_priv *priv, u32 retry)
-{
-	struct host_command cmd = {
-		.host_command = LONG_RETRY_LIMIT,
-		.host_command_sequence = 0,
-		.host_command_length = 4
-	};
-	int err;
-
-	cmd.host_command_parameters[0] = retry;
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-	if (err)
-		return err;
-
-	priv->long_retry_limit = retry;
-
-	return 0;
-}
-
-
-static int ipw2100_set_mandatory_bssid(struct ipw2100_priv *priv, u8 *bssid,
-				       int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = MANDATORY_BSSID,
-		.host_command_sequence = 0,
-		.host_command_length = (bssid == NULL) ? 0 : ETH_ALEN
-	};
-	int err;
-
-#ifdef CONFIG_IPW_DEBUG
-	if (bssid != NULL)
-		IPW_DEBUG_HC(
-			"MANDATORY_BSSID: %02X:%02X:%02X:%02X:%02X:%02X\n",
-			bssid[0], bssid[1], bssid[2], bssid[3], bssid[4],
-			bssid[5]);
-	else
-		IPW_DEBUG_HC("MANDATORY_BSSID: <clear>\n");
-#endif
-	/* if BSSID is empty then we disable mandatory bssid mode */
-	if (bssid != NULL)
-		memcpy((u8 *)cmd.host_command_parameters, bssid, ETH_ALEN);
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	if (!batch_mode)
-		ipw2100_enable_adapter(priv);
-
-	return err;
-}
-
-#ifdef CONFIG_IEEE80211_WPA
-static int ipw2100_disassociate_bssid(struct ipw2100_priv *priv)
-{
-	struct host_command cmd = {
-		.host_command = DISASSOCIATION_BSSID,
-		.host_command_sequence = 0,
-		.host_command_length = ETH_ALEN
-	};
-	int err;
-	int len;
-
-	IPW_DEBUG_HC("DISASSOCIATION_BSSID\n");
-
-	len = ETH_ALEN;
-	/* The Firmware currently ignores the BSSID and just disassociates from
-	 * the currently associated AP -- but in the off chance that a future
-	 * firmware does use the BSSID provided here, we go ahead and try and
-	 * set it to the currently associated AP's BSSID */
-	memcpy(cmd.host_command_parameters, priv->bssid, ETH_ALEN);
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	return err;
-}
-#endif
-
-/*
- * Pseudo code for setting up wpa_frame:
- */
-#if 0
-void x(struct ieee80211_assoc_frame *wpa_assoc)
-{
-	struct ipw2100_wpa_assoc_frame frame;
-	frame->fixed_ie_mask = IPW_WPA_CAPABILTIES |
-		IPW_WPA_LISTENINTERVAL |
-		IPW_WPA_AP_ADDRESS;
-	frame->capab_info = wpa_assoc->capab_info;
-	frame->lisen_interval = wpa_assoc->listent_interval;
-	memcpy(frame->current_ap, wpa_assoc->current_ap, ETH_ALEN);
-
-	/* UNKNOWN -- I'm not postivive about this part; don't have any WPA
-	 * setup here to test it with.
-	 *
-	 * Walk the IEs in the wpa_assoc and figure out the total size of all
-	 * that data.  Stick that into frame->var_ie_len.  Then memcpy() all of
-	 * the IEs from wpa_frame into frame.
-	 */
-	frame->var_ie_len = calculate_ie_len(wpa_assoc);
-	memcpy(frame->var_ie,  wpa_assoc->variable, frame->var_ie_len);
-
-	ipw2100_set_wpa_ie(priv, &frame, 0);
-}
-#endif
-
-
-
-
-static int ipw2100_set_wpa_ie(struct ipw2100_priv *,
-			      struct ipw2100_wpa_assoc_frame *, int)
-__attribute__ ((unused));
-
-static int ipw2100_set_wpa_ie(struct ipw2100_priv *priv,
-			      struct ipw2100_wpa_assoc_frame *wpa_frame,
-			      int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = SET_WPA_IE,
-		.host_command_sequence = 0,
-		.host_command_length = sizeof(struct ipw2100_wpa_assoc_frame),
-	};
-	int err;
-
-	IPW_DEBUG_HC("SET_WPA_IE\n");
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	memcpy(cmd.host_command_parameters, wpa_frame,
-	       sizeof(struct ipw2100_wpa_assoc_frame));
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	if (!batch_mode) {
-		if (ipw2100_enable_adapter(priv))
-			err = -EIO;
-	}
-
-	return err;
-}
-
-struct security_info_params {
-	u32 allowed_ciphers;
-	u16 version;
-	u8 auth_mode;
-	u8 replay_counters_number;
-	u8 unicast_using_group;
-} __attribute__ ((packed));
-
-static int ipw2100_set_security_information(struct ipw2100_priv *priv,
-					    int auth_mode,
-					    int security_level,
-					    int unicast_using_group,
-					    int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = SET_SECURITY_INFORMATION,
-		.host_command_sequence = 0,
-		.host_command_length = sizeof(struct security_info_params)
-	};
-	struct security_info_params *security =
-		(struct security_info_params *)&cmd.host_command_parameters;
-	int err;
-	memset(security, 0, sizeof(*security));
-
-	/* If shared key AP authentication is turned on, then we need to
-	 * configure the firmware to try and use it.
-	 *
-	 * Actual data encryption/decryption is handled by the host. */
-	security->auth_mode = auth_mode;
-	security->unicast_using_group = unicast_using_group;
-
-	switch (security_level) {
-	default:
-	case SEC_LEVEL_0:
-		security->allowed_ciphers = IPW_NONE_CIPHER;
-		break;
-	case SEC_LEVEL_1:
-		security->allowed_ciphers = IPW_WEP40_CIPHER |
-			IPW_WEP104_CIPHER;
-		break;
-	case SEC_LEVEL_2:
-		security->allowed_ciphers = IPW_WEP40_CIPHER |
-			IPW_WEP104_CIPHER | IPW_TKIP_CIPHER;
-		break;
-	case SEC_LEVEL_2_CKIP:
-		security->allowed_ciphers = IPW_WEP40_CIPHER |
-			IPW_WEP104_CIPHER | IPW_CKIP_CIPHER;
-		break;
-	case SEC_LEVEL_3:
-		security->allowed_ciphers = IPW_WEP40_CIPHER |
-			IPW_WEP104_CIPHER | IPW_TKIP_CIPHER | IPW_CCMP_CIPHER;
-		break;
-	}
-
-	IPW_DEBUG_HC(
-		"SET_SECURITY_INFORMATION: auth:%d cipher:0x%02X (level %d)\n",
-		security->auth_mode, security->allowed_ciphers, security_level);
-
-	security->replay_counters_number = 0;
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	if (!batch_mode)
-		ipw2100_enable_adapter(priv);
-
-	return err;
-}
-
-static int ipw2100_set_tx_power(struct ipw2100_priv *priv,
-				u32 tx_power)
-{
-	struct host_command cmd = {
-		.host_command = TX_POWER_INDEX,
-		.host_command_sequence = 0,
-		.host_command_length = 4
-	};
-	int err = 0;
-
-	cmd.host_command_parameters[0] = tx_power;
-
-	if (priv->ieee->iw_mode == IW_MODE_ADHOC)
-		err = ipw2100_hw_send_command(priv, &cmd);
-	if (!err)
-		priv->tx_power = tx_power;
-
-	return 0;
-}
-
-static int ipw2100_set_ibss_beacon_interval(struct ipw2100_priv *priv,
-					    u32 interval, int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = BEACON_INTERVAL,
-		.host_command_sequence = 0,
-		.host_command_length = 4
-	};
-	int err;
-
-	cmd.host_command_parameters[0] = interval;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
-		if (!batch_mode) {
-			err = ipw2100_disable_adapter(priv);
-			if (err)
-				return err;
-		}
-
-		ipw2100_hw_send_command(priv, &cmd);
-
-		if (!batch_mode) {
-			err = ipw2100_enable_adapter(priv);
-			if (err)
-				return err;
-		}
-	}
-
-	IPW_DEBUG_INFO("exit\n");
-
-	return 0;
-}
-
-
-void ipw2100_queues_initialize(struct ipw2100_priv *priv)
-{
-	ipw2100_tx_initialize(priv);
-	ipw2100_rx_initialize(priv);
-	ipw2100_msg_initialize(priv);
-}
-
-void ipw2100_queues_free(struct ipw2100_priv *priv)
-{
-	ipw2100_tx_free(priv);
-	ipw2100_rx_free(priv);
-	ipw2100_msg_free(priv);
-}
-
-int ipw2100_queues_allocate(struct ipw2100_priv *priv)
-{
-	if (ipw2100_tx_allocate(priv) ||
-	    ipw2100_rx_allocate(priv) ||
-	    ipw2100_msg_allocate(priv))
-		goto fail;
-
-	return 0;
-
- fail:
-	ipw2100_tx_free(priv);
-	ipw2100_rx_free(priv);
-	ipw2100_msg_free(priv);
-	return -ENOMEM;
-}
-
-#define IPW_PRIVACY_CAPABLE 0x0008
-
-static int ipw2100_set_wep_flags(struct ipw2100_priv *priv, u32 flags,
-				 int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = WEP_FLAGS,
-		.host_command_sequence = 0,
-		.host_command_length = 4
-	};
-	int err;
-
-	cmd.host_command_parameters[0] = flags;
-
-	IPW_DEBUG_HC("WEP_FLAGS: flags = 0x%08X\n", flags);
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err) {
-			printk(KERN_ERR DRV_NAME ": %s: Could not disable adapter %d\n",
-			       priv->net_dev->name, err);
-			return err;
-		}
-	}
-
-	/* send cmd to firmware */
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	if (!batch_mode)
-		ipw2100_enable_adapter(priv);
-
-	return err;
-}
-
-struct ipw2100_wep_key {
-	u8 idx;
-	u8 len;
-	u8 key[13];
-};
-
-/* Macros to ease up priting WEP keys */
-#define WEP_FMT_64  "%02X%02X%02X%02X-%02X"
-#define WEP_FMT_128 "%02X%02X%02X%02X-%02X%02X%02X%02X-%02X%02X%02X"
-#define WEP_STR_64(x) x[0],x[1],x[2],x[3],x[4]
-#define WEP_STR_128(x) x[0],x[1],x[2],x[3],x[4],x[5],x[6],x[7],x[8],x[9],x[10]
-
-
-/**
- * Set a the wep key
- *
- * @priv: struct to work on
- * @idx: index of the key we want to set
- * @key: ptr to the key data to set
- * @len: length of the buffer at @key
- * @batch_mode: FIXME perform the operation in batch mode, not
- *              disabling the device.
- *
- * @returns 0 if OK, < 0 errno code on error.
- *
- * Fill out a command structure with the new wep key, length an
- * index and send it down the wire.
- */
-static int ipw2100_set_key(struct ipw2100_priv *priv,
-			   int idx, char *key, int len, int batch_mode)
-{
-	int keylen = len ? (len <= 5 ? 5 : 13) : 0;
-	struct host_command cmd = {
-		.host_command = WEP_KEY_INFO,
-		.host_command_sequence = 0,
-		.host_command_length = sizeof(struct ipw2100_wep_key),
-	};
-	struct ipw2100_wep_key *wep_key = (void*)cmd.host_command_parameters;
-	int err;
-
-	IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
-				 idx, keylen, len);
-
-	/* NOTE: We don't check cached values in case the firmware was reset
-	 * or some other problem is occuring.  If the user is setting the key,
-	 * then we push the change */
-
-	wep_key->idx = idx;
-	wep_key->len = keylen;
-
-	if (keylen) {
-		memcpy(wep_key->key, key, len);
-		memset(wep_key->key + len, 0, keylen - len);
-	}
-
-	/* Will be optimized out on debug not being configured in */
-	if (keylen == 0)
-		IPW_DEBUG_WEP("%s: Clearing key %d\n",
-				  priv->net_dev->name, wep_key->idx);
-	else if (keylen == 5)
-		IPW_DEBUG_WEP("%s: idx: %d, len: %d key: " WEP_FMT_64 "\n",
-				  priv->net_dev->name, wep_key->idx, wep_key->len,
-				  WEP_STR_64(wep_key->key));
-	else
-		IPW_DEBUG_WEP("%s: idx: %d, len: %d key: " WEP_FMT_128
-				  "\n",
-				  priv->net_dev->name, wep_key->idx, wep_key->len,
-				  WEP_STR_128(wep_key->key));
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		/* FIXME: IPG: shouldn't this prink be in _disable_adapter()? */
-		if (err) {
-			printk(KERN_ERR DRV_NAME ": %s: Could not disable adapter %d\n",
-			       priv->net_dev->name, err);
-			return err;
-		}
-	}
-
-	/* send cmd to firmware */
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	if (!batch_mode) {
-		int err2 = ipw2100_enable_adapter(priv);
-		if (err == 0)
-			err = err2;
-	}
-	return err;
-}
-
-static int ipw2100_set_key_index(struct ipw2100_priv *priv,
-				 int idx, int batch_mode)
-{
-	struct host_command cmd = {
-		.host_command = WEP_KEY_INDEX,
-		.host_command_sequence = 0,
-		.host_command_length = 4,
-		.host_command_parameters = { idx },
-	};
-	int err;
-
-	IPW_DEBUG_HC("WEP_KEY_INDEX: index = %d\n", idx);
-
-	if (idx < 0 || idx > 3)
-		return -EINVAL;
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err) {
-			printk(KERN_ERR DRV_NAME ": %s: Could not disable adapter %d\n",
-			       priv->net_dev->name, err);
-			return err;
-		}
-	}
-
-	/* send cmd to firmware */
-	err = ipw2100_hw_send_command(priv, &cmd);
-
-	if (!batch_mode)
-		ipw2100_enable_adapter(priv);
-
-	return err;
-}
-
-
-static int ipw2100_configure_security(struct ipw2100_priv *priv,
-				      int batch_mode)
-{
-	int i, err, auth_mode, sec_level, use_group;
-
-	if (!(priv->status & STATUS_RUNNING))
-		return 0;
-
-	if (!batch_mode) {
-		err = ipw2100_disable_adapter(priv);
-		if (err)
-			return err;
-	}
-
-	if (!priv->sec.enabled) {
-		err = ipw2100_set_security_information(
-			priv, IPW_AUTH_OPEN, SEC_LEVEL_0, 0, 1);
-	} else {
-		auth_mode = IPW_AUTH_OPEN;
-		if ((priv->sec.flags & SEC_AUTH_MODE) &&
-		    (priv->sec.auth_mode == WLAN_AUTH_SHARED_KEY))
-			auth_mode = IPW_AUTH_SHARED;
-
-		sec_level = SEC_LEVEL_0;
-		if (priv->sec.flags & SEC_LEVEL)
-			sec_level = priv->sec.level;
-
-		use_group = 0;
-		if (priv->sec.flags & SEC_UNICAST_GROUP)
-			use_group = priv->sec.unicast_uses_group;
-
-		err = ipw2100_set_security_information(
-			    priv, auth_mode, sec_level, use_group, 1);
-	}
-
-	if (err)
-		goto exit;
-
-	if (priv->sec.enabled) {
-		for (i = 0; i < 4; i++) {
-			if (!(priv->sec.flags & (1 << i))) {
-				memset(priv->sec.keys[i], 0, WEP_KEY_LEN);
-				priv->sec.key_sizes[i] = 0;
-			} else {
-				err = ipw2100_set_key(priv, i,
-						      priv->sec.keys[i],
-						      priv->sec.key_sizes[i],
-						      1);
-				if (err)
-					goto exit;
-			}
-		}
-
-		ipw2100_set_key_index(priv, priv->ieee->tx_keyidx, 1);
-	}
-
-	/* Always enable privacy so the Host can filter WEP packets if
-	 * encrypted data is sent up */
-	err = ipw2100_set_wep_flags(
-		priv, priv->sec.enabled ? IPW_PRIVACY_CAPABLE : 0, 1);
-	if (err)
-		goto exit;
-
-	priv->status &= ~STATUS_SECURITY_UPDATED;
-
- exit:
-	if (!batch_mode)
-		ipw2100_enable_adapter(priv);
-
-	return err;
-}
-
-static void ipw2100_security_work(struct ipw2100_priv *priv)
-{
-	/* If we happen to have reconnected before we get a chance to
-	 * process this, then update the security settings--which causes
-	 * a disassociation to occur */
-	if (!(priv->status & STATUS_ASSOCIATED) &&
-	    priv->status & STATUS_SECURITY_UPDATED)
-		ipw2100_configure_security(priv, 0);
-}
-
-static void shim__set_security(struct net_device *dev,
-			       struct ieee80211_security *sec)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int i, force_update = 0;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED))
-		goto done;
-
-	for (i = 0; i < 4; i++) {
-		if (sec->flags & (1 << i)) {
-			priv->sec.key_sizes[i] = sec->key_sizes[i];
-			if (sec->key_sizes[i] == 0)
-				priv->sec.flags &= ~(1 << i);
-			else
-				memcpy(priv->sec.keys[i], sec->keys[i],
-				       sec->key_sizes[i]);
-			priv->sec.flags |= (1 << i);
-			priv->status |= STATUS_SECURITY_UPDATED;
-		}
-	}
-
-	if ((sec->flags & SEC_ACTIVE_KEY) &&
-	    priv->sec.active_key != sec->active_key) {
-		if (sec->active_key <= 3) {
-			priv->sec.active_key = sec->active_key;
-			priv->sec.flags |= SEC_ACTIVE_KEY;
-		} else
-			priv->sec.flags &= ~SEC_ACTIVE_KEY;
-
-		priv->status |= STATUS_SECURITY_UPDATED;
-	}
-
-	if ((sec->flags & SEC_AUTH_MODE) &&
-	    (priv->sec.auth_mode != sec->auth_mode)) {
-		priv->sec.auth_mode = sec->auth_mode;
-		priv->sec.flags |= SEC_AUTH_MODE;
-		priv->status |= STATUS_SECURITY_UPDATED;
-	}
-
-	if (sec->flags & SEC_ENABLED &&
-	    priv->sec.enabled != sec->enabled) {
-		priv->sec.flags |= SEC_ENABLED;
-		priv->sec.enabled = sec->enabled;
-		priv->status |= STATUS_SECURITY_UPDATED;
-		force_update = 1;
-	}
-
-	if (sec->flags & SEC_LEVEL &&
-	    priv->sec.level != sec->level) {
-		priv->sec.level = sec->level;
-		priv->sec.flags |= SEC_LEVEL;
-		priv->status |= STATUS_SECURITY_UPDATED;
-	}
-
-	IPW_DEBUG_WEP("Security flags: %c %c%c%c%c %c%c%c%c\n",
-			  priv->sec.flags & (1<<8) ? '1' : '0',
-			  priv->sec.flags & (1<<7) ? '1' : '0',
-			  priv->sec.flags & (1<<6) ? '1' : '0',
-			  priv->sec.flags & (1<<5) ? '1' : '0',
-			  priv->sec.flags & (1<<4) ? '1' : '0',
-			  priv->sec.flags & (1<<3) ? '1' : '0',
-			  priv->sec.flags & (1<<2) ? '1' : '0',
-			  priv->sec.flags & (1<<1) ? '1' : '0',
-			  priv->sec.flags & (1<<0) ? '1' : '0');
-
-/* As a temporary work around to enable WPA until we figure out why
- * wpa_supplicant toggles the security capability of the driver, which
- * forces a disassocation with force_update...
- *
- *	if (force_update || !(priv->status & STATUS_ASSOCIATED))*/
-	if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
-		ipw2100_configure_security(priv, 0);
-done:
-	up(&priv->action_sem);
-}
-
-static int ipw2100_adapter_setup(struct ipw2100_priv *priv)
-{
-	int err;
-	int batch_mode = 1;
-	u8 *bssid;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	err = ipw2100_disable_adapter(priv);
-	if (err)
-		return err;
-#ifdef CONFIG_IPW2100_MONITOR
-	if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
-		err = ipw2100_set_channel(priv, priv->channel, batch_mode);
-		if (err)
-			return err;
-
-		IPW_DEBUG_INFO("exit\n");
-
-		return 0;
-	}
-#endif /* CONFIG_IPW2100_MONITOR */
-
-	err = ipw2100_read_mac_address(priv);
-	if (err)
-		return -EIO;
-
-	err = ipw2100_set_mac_address(priv, batch_mode);
-	if (err)
-		return err;
-
-	err = ipw2100_set_port_type(priv, priv->ieee->iw_mode, batch_mode);
-	if (err)
-		return err;
-
-	if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
-		err = ipw2100_set_channel(priv, priv->channel, batch_mode);
-		if (err)
-			return err;
-	}
-
-	err  = ipw2100_system_config(priv, batch_mode);
-	if (err)
-		return err;
-
-	err = ipw2100_set_tx_rates(priv, priv->tx_rates, batch_mode);
-	if (err)
-		return err;
-
-	/* Default to power mode OFF */
-	err = ipw2100_set_power_mode(priv, IPW_POWER_MODE_CAM);
-	if (err)
-		return err;
-
-	err = ipw2100_set_rts_threshold(priv, priv->rts_threshold);
-	if (err)
-		return err;
-
-	if (priv->config & CFG_STATIC_BSSID)
-		bssid = priv->bssid;
-	else
-		bssid = NULL;
-	err = ipw2100_set_mandatory_bssid(priv, bssid, batch_mode);
-	if (err)
-		return err;
-
-	if (priv->config & CFG_STATIC_ESSID)
-		err = ipw2100_set_essid(priv, priv->essid, priv->essid_len,
-					batch_mode);
-	else
-		err = ipw2100_set_essid(priv, NULL, 0, batch_mode);
-	if (err)
-		return err;
-
-	err = ipw2100_configure_security(priv, batch_mode);
-	if (err)
-		return err;
-
-	if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
-		err = ipw2100_set_ibss_beacon_interval(
-			priv, priv->beacon_interval, batch_mode);
-		if (err)
-			return err;
-
-		err = ipw2100_set_tx_power(priv, priv->tx_power);
-		if (err)
-			return err;
-	}
-
-	/*
-	  err = ipw2100_set_fragmentation_threshold(
-	  priv, priv->frag_threshold, batch_mode);
-	  if (err)
-	  return err;
-	*/
-
-	IPW_DEBUG_INFO("exit\n");
-
-	return 0;
-}
-
-
-/*************************************************************************
- *
- * EXTERNALLY CALLED METHODS
- *
- *************************************************************************/
-
-/* This method is called by the network layer -- not to be confused with
- * ipw2100_set_mac_address() declared above called by this driver (and this
- * method as well) to talk to the firmware */
-static int ipw2100_set_address(struct net_device *dev, void *p)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	struct sockaddr *addr = p;
-	int err = 0;
-
-	if (!is_valid_ether_addr(addr->sa_data))
-		return -EADDRNOTAVAIL;
-
-	down(&priv->action_sem);
-
-	priv->config |= CFG_CUSTOM_MAC;
-	memcpy(priv->mac_addr, addr->sa_data, ETH_ALEN);
-
-	err = ipw2100_set_mac_address(priv, 0);
-	if (err)
-		goto done;
-
-	priv->reset_backoff = 0;
-	up(&priv->action_sem);
-	ipw2100_reset_adapter(priv);
-	return 0;
-
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_open(struct net_device *dev)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	unsigned long flags;
-	IPW_DEBUG_INFO("dev->open\n");
-
-	spin_lock_irqsave(&priv->low_lock, flags);
-	if (priv->status & STATUS_ASSOCIATED) {
-		netif_carrier_on(dev);
-		netif_start_queue(dev);
-	}
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-
-	return 0;
-}
-
-static int ipw2100_close(struct net_device *dev)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	unsigned long flags;
-	struct list_head *element;
-	struct ipw2100_tx_packet *packet;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	spin_lock_irqsave(&priv->low_lock, flags);
-
-	if (priv->status & STATUS_ASSOCIATED)
-		netif_carrier_off(dev);
-	netif_stop_queue(dev);
-
-	/* Flush the TX queue ... */
-	while (!list_empty(&priv->tx_pend_list)) {
-		element = priv->tx_pend_list.next;
-                packet = list_entry(element, struct ipw2100_tx_packet, list);
-
-		list_del(element);
-		DEC_STAT(&priv->tx_pend_stat);
-
-		ieee80211_txb_free(packet->info.d_struct.txb);
-		packet->info.d_struct.txb = NULL;
-
-		list_add_tail(element, &priv->tx_free_list);
-		INC_STAT(&priv->tx_free_stat);
-	}
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-
-	IPW_DEBUG_INFO("exit\n");
-
-	return 0;
-}
-
-
-
-/*
- * TODO:  Fix this function... its just wrong
- */
-static void ipw2100_tx_timeout(struct net_device *dev)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	priv->ieee->stats.tx_errors++;
-
-#ifdef CONFIG_IPW2100_MONITOR
-	if (priv->ieee->iw_mode == IW_MODE_MONITOR)
-		return;
-#endif
-
-	IPW_DEBUG_INFO("%s: TX timed out.  Scheduling firmware restart.\n",
-		       dev->name);
-	schedule_reset(priv);
-}
-
-
-/*
- * TODO: reimplement it so that it reads statistics
- *       from the adapter using ordinal tables
- *       instead of/in addition to collecting them
- *       in the driver
- */
-static struct net_device_stats *ipw2100_stats(struct net_device *dev)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	return &priv->ieee->stats;
-}
-
-/* Support for wpa_supplicant. Will be replaced with WEXT once
- * they get WPA support. */
-#ifdef CONFIG_IEEE80211_WPA
-
-/* following definitions must match definitions in driver_ipw2100.c */
-
-#define IPW2100_IOCTL_WPA_SUPPLICANT		SIOCIWFIRSTPRIV+30
-
-#define IPW2100_CMD_SET_WPA_PARAM		1
-#define	IPW2100_CMD_SET_WPA_IE			2
-#define IPW2100_CMD_SET_ENCRYPTION		3
-#define IPW2100_CMD_MLME			4
-
-#define IPW2100_PARAM_WPA_ENABLED		1
-#define IPW2100_PARAM_TKIP_COUNTERMEASURES	2
-#define IPW2100_PARAM_DROP_UNENCRYPTED		3
-#define IPW2100_PARAM_PRIVACY_INVOKED		4
-#define IPW2100_PARAM_AUTH_ALGS			5
-#define IPW2100_PARAM_IEEE_802_1X		6
-
-#define IPW2100_MLME_STA_DEAUTH			1
-#define IPW2100_MLME_STA_DISASSOC		2
-
-#define IPW2100_CRYPT_ERR_UNKNOWN_ALG		2
-#define IPW2100_CRYPT_ERR_UNKNOWN_ADDR		3
-#define IPW2100_CRYPT_ERR_CRYPT_INIT_FAILED	4
-#define IPW2100_CRYPT_ERR_KEY_SET_FAILED	5
-#define IPW2100_CRYPT_ERR_TX_KEY_SET_FAILED	6
-#define IPW2100_CRYPT_ERR_CARD_CONF_FAILED	7
-
-#define	IPW2100_CRYPT_ALG_NAME_LEN		16
-
-struct ipw2100_param {
-	u32 cmd;
-	u8 sta_addr[ETH_ALEN];
-        union {
-		struct {
-			u8 name;
-			u32 value;
-		} wpa_param;
-		struct {
-			u32 len;
-			u8 *data;
-		} wpa_ie;
-	        struct{
-			int command;
-    			int reason_code;
-		} mlme;
-		struct {
-			u8 alg[IPW2100_CRYPT_ALG_NAME_LEN];
-			u8 set_tx;
-			u32 err;
-			u8 idx;
-			u8 seq[8]; /* sequence counter (set: RX, get: TX) */
-			u16 key_len;
-			u8 key[0];
-		} crypt;
-
-	} u;
-};
-
-/* end of driver_ipw2100.c code */
-
-static int ipw2100_wpa_enable(struct ipw2100_priv *priv, int value){
-
-	struct ieee80211_device *ieee = priv->ieee;
-	struct ieee80211_security sec = {
-		.flags = SEC_LEVEL | SEC_ENABLED,
-	};
-	int ret = 0;
-
-	ieee->wpa_enabled = value;
-
-	if (value){
-		sec.level = SEC_LEVEL_3;
-		sec.enabled = 1;
-	} else {
-		sec.level = SEC_LEVEL_0;
-		sec.enabled = 0;
-	}
-
-	if (ieee->set_security)
-		ieee->set_security(ieee->dev, &sec);
-	else
-		ret = -EOPNOTSUPP;
-
-	return ret;
-}
-
-#define AUTH_ALG_OPEN_SYSTEM			0x1
-#define AUTH_ALG_SHARED_KEY			0x2
-
-static int ipw2100_wpa_set_auth_algs(struct ipw2100_priv *priv, int value){
-
-	struct ieee80211_device *ieee = priv->ieee;
-	struct ieee80211_security sec = {
-		.flags = SEC_AUTH_MODE,
-	};
-	int ret = 0;
-
-	if (value & AUTH_ALG_SHARED_KEY){
-		sec.auth_mode = WLAN_AUTH_SHARED_KEY;
-		ieee->open_wep = 0;
-	} else {
-		sec.auth_mode = WLAN_AUTH_OPEN;
-		ieee->open_wep = 1;
-	}
-
-	if (ieee->set_security)
-		ieee->set_security(ieee->dev, &sec);
-	else
-		ret = -EOPNOTSUPP;
-
-	return ret;
-}
-
-
-static int ipw2100_wpa_set_param(struct net_device *dev, u8 name, u32 value){
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int ret=0;
-
-	switch(name){
-		case IPW2100_PARAM_WPA_ENABLED:
-			ret = ipw2100_wpa_enable(priv, value);
-			break;
-
-		case IPW2100_PARAM_TKIP_COUNTERMEASURES:
-			priv->ieee->tkip_countermeasures=value;
-			break;
-
-		case IPW2100_PARAM_DROP_UNENCRYPTED:
-			priv->ieee->drop_unencrypted=value;
-			break;
-
-		case IPW2100_PARAM_PRIVACY_INVOKED:
-			priv->ieee->privacy_invoked=value;
-			break;
-
-		case IPW2100_PARAM_AUTH_ALGS:
-			ret = ipw2100_wpa_set_auth_algs(priv, value);
-			break;
-
-		case IPW2100_PARAM_IEEE_802_1X:
-			priv->ieee->ieee802_1x=value;
-			break;
-
-		default:
-			printk(KERN_ERR DRV_NAME ": %s: Unknown WPA param: %d\n",
-					    dev->name, name);
-			ret = -EOPNOTSUPP;
-	}
-
-	return ret;
-}
-
-static int ipw2100_wpa_mlme(struct net_device *dev, int command, int reason){
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int ret=0;
-
-	switch(command){
-		case IPW2100_MLME_STA_DEAUTH:
-			// silently ignore
-			break;
-
-		case IPW2100_MLME_STA_DISASSOC:
-			ipw2100_disassociate_bssid(priv);
-			break;
-
-		default:
-			printk(KERN_ERR DRV_NAME ": %s: Unknown MLME request: %d\n",
-					    dev->name, command);
-			ret = -EOPNOTSUPP;
-	}
-
-	return ret;
-}
-
-
-void ipw2100_wpa_assoc_frame(struct ipw2100_priv *priv,
-			     char *wpa_ie, int wpa_ie_len){
-
-	struct ipw2100_wpa_assoc_frame frame;
-
-	frame.fixed_ie_mask = 0;
-
-	/* copy WPA IE */
-	memcpy(frame.var_ie, wpa_ie, wpa_ie_len);
-	frame.var_ie_len = wpa_ie_len;
-
-	/* make sure WPA is enabled */
-	ipw2100_wpa_enable(priv, 1);
-	ipw2100_set_wpa_ie(priv, &frame, 0);
-}
-
-
-static int ipw2100_wpa_set_wpa_ie(struct net_device *dev,
-				struct ipw2100_param *param, int plen){
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	struct ieee80211_device *ieee = priv->ieee;
-	u8 *buf;
-
-	if (! ieee->wpa_enabled)
-	    return -EOPNOTSUPP;
-
-	if (param->u.wpa_ie.len > MAX_WPA_IE_LEN ||
-	   (param->u.wpa_ie.len &&
-		param->u.wpa_ie.data==NULL))
-		return -EINVAL;
-
-	if (param->u.wpa_ie.len){
-		buf = kmalloc(param->u.wpa_ie.len, GFP_KERNEL);
-		if (buf == NULL)
-			return -ENOMEM;
-
-		memcpy(buf, param->u.wpa_ie.data, param->u.wpa_ie.len);
-
-		kfree(ieee->wpa_ie);
-		ieee->wpa_ie = buf;
-		ieee->wpa_ie_len = param->u.wpa_ie.len;
-
-	} else {
-		kfree(ieee->wpa_ie);
-		ieee->wpa_ie = NULL;
-		ieee->wpa_ie_len = 0;
-	}
-
-	ipw2100_wpa_assoc_frame(priv, ieee->wpa_ie, ieee->wpa_ie_len);
-
-	return 0;
-}
-
-/* implementation borrowed from hostap driver */
-
-static int ipw2100_wpa_set_encryption(struct net_device *dev,
-				struct ipw2100_param *param, int param_len){
-
-	int ret = 0;
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	struct ieee80211_device *ieee = priv->ieee;
-	struct ieee80211_crypto_ops *ops;
-	struct ieee80211_crypt_data **crypt;
-
-	struct ieee80211_security sec = {
-		.flags = 0,
-	};
-
-	param->u.crypt.err = 0;
-	param->u.crypt.alg[IPW2100_CRYPT_ALG_NAME_LEN - 1] = '\0';
-
-	if (param_len !=
-	    (int) ((char *) param->u.crypt.key - (char *) param) +
-	    param->u.crypt.key_len){
-		IPW_DEBUG_INFO("Len mismatch %d, %d\n", param_len, param->u.crypt.key_len);
-		return -EINVAL;
-	}
-	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
-	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
-	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
-		if (param->u.crypt.idx >= WEP_KEYS)
-			return -EINVAL;
-		crypt = &ieee->crypt[param->u.crypt.idx];
-	} else {
-		return -EINVAL;
-	}
-
-	if (strcmp(param->u.crypt.alg, "none") == 0) {
-		if (crypt){
-			sec.enabled = 0;
-			sec.level = SEC_LEVEL_0;
-			sec.flags |= SEC_ENABLED | SEC_LEVEL;
-			ieee80211_crypt_delayed_deinit(ieee, crypt);
-		}
-		goto done;
-	}
-	sec.enabled = 1;
-	sec.flags |= SEC_ENABLED;
-
-	ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-	if (ops == NULL && strcmp(param->u.crypt.alg, "WEP") == 0) {
-		request_module("ieee80211_crypt_wep");
-		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-	} else if (ops == NULL && strcmp(param->u.crypt.alg, "TKIP") == 0) {
-		request_module("ieee80211_crypt_tkip");
-		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-	} else if (ops == NULL && strcmp(param->u.crypt.alg, "CCMP") == 0) {
-		request_module("ieee80211_crypt_ccmp");
-		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
-	}
-	if (ops == NULL) {
-		IPW_DEBUG_INFO("%s: unknown crypto alg '%s'\n",
-		       dev->name, param->u.crypt.alg);
-		param->u.crypt.err = IPW2100_CRYPT_ERR_UNKNOWN_ALG;
-		ret = -EINVAL;
-		goto done;
-	}
-
-	if (*crypt == NULL || (*crypt)->ops != ops) {
-		struct ieee80211_crypt_data *new_crypt;
-
-		ieee80211_crypt_delayed_deinit(ieee, crypt);
-
-		new_crypt = (struct ieee80211_crypt_data *)
-			kmalloc(sizeof(struct ieee80211_crypt_data), GFP_KERNEL);
-		if (new_crypt == NULL) {
-			ret = -ENOMEM;
-			goto done;
-		}
-		memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
-		new_crypt->ops = ops;
-		if (new_crypt->ops && try_module_get(new_crypt->ops->owner))
-			new_crypt->priv = new_crypt->ops->init(param->u.crypt.idx);
-
-		if (new_crypt->priv == NULL) {
-			kfree(new_crypt);
-			param->u.crypt.err =
-				IPW2100_CRYPT_ERR_CRYPT_INIT_FAILED;
-			ret = -EINVAL;
-			goto done;
-		}
-
-		*crypt = new_crypt;
-	}
-
-	if (param->u.crypt.key_len > 0 && (*crypt)->ops->set_key &&
-	    (*crypt)->ops->set_key(param->u.crypt.key,
-				   param->u.crypt.key_len, param->u.crypt.seq,
-				   (*crypt)->priv) < 0) {
-		IPW_DEBUG_INFO("%s: key setting failed\n",
-		       dev->name);
-		param->u.crypt.err = IPW2100_CRYPT_ERR_KEY_SET_FAILED;
-		ret = -EINVAL;
-		goto done;
-	}
-
-	if (param->u.crypt.set_tx){
-		ieee->tx_keyidx = param->u.crypt.idx;
-		sec.active_key = param->u.crypt.idx;
-		sec.flags |= SEC_ACTIVE_KEY;
-	}
-
-	if (ops->name != NULL){
-
-		if (strcmp(ops->name, "WEP") == 0) {
-			memcpy(sec.keys[param->u.crypt.idx], param->u.crypt.key, param->u.crypt.key_len);
-			sec.key_sizes[param->u.crypt.idx] = param->u.crypt.key_len;
-			sec.flags |= (1 << param->u.crypt.idx);
-			sec.flags |= SEC_LEVEL;
-			sec.level = SEC_LEVEL_1;
-		} else if (strcmp(ops->name, "TKIP") == 0) {
-			sec.flags |= SEC_LEVEL;
-			sec.level = SEC_LEVEL_2;
-		} else if (strcmp(ops->name, "CCMP") == 0) {
-			sec.flags |= SEC_LEVEL;
-			sec.level = SEC_LEVEL_3;
-		}
-	}
- done:
-	if (ieee->set_security)
-		ieee->set_security(ieee->dev, &sec);
-
-	/* Do not reset port if card is in Managed mode since resetting will
-	 * generate new IEEE 802.11 authentication which may end up in looping
-	 * with IEEE 802.1X.  If your hardware requires a reset after WEP
-	 * configuration (for example... Prism2), implement the reset_port in
-	 * the callbacks structures used to initialize the 802.11 stack. */
-	if (ieee->reset_on_keychange &&
-	    ieee->iw_mode != IW_MODE_INFRA &&
-	    ieee->reset_port &&
-	    ieee->reset_port(dev)) {
-		IPW_DEBUG_INFO("%s: reset_port failed\n", dev->name);
-		param->u.crypt.err = IPW2100_CRYPT_ERR_CARD_CONF_FAILED;
-		return -EINVAL;
-	}
-
-	return ret;
-}
-
-
-static int ipw2100_wpa_supplicant(struct net_device *dev, struct iw_point *p){
-
-	struct ipw2100_param *param;
-	int ret=0;
-
-	IPW_DEBUG_IOCTL("wpa_supplicant: len=%d\n", p->length);
-
-	if (p->length < sizeof(struct ipw2100_param) || !p->pointer)
-		return -EINVAL;
-
-	param = (struct ipw2100_param *)kmalloc(p->length, GFP_KERNEL);
-	if (param == NULL)
-		return -ENOMEM;
-
-	if (copy_from_user(param, p->pointer, p->length)){
-		kfree(param);
-		return -EFAULT;
-	}
-
-	switch (param->cmd){
-
-	case IPW2100_CMD_SET_WPA_PARAM:
-		ret = ipw2100_wpa_set_param(dev, param->u.wpa_param.name,
-					    param->u.wpa_param.value);
-		break;
-
-	case IPW2100_CMD_SET_WPA_IE:
-		ret = ipw2100_wpa_set_wpa_ie(dev, param, p->length);
-		break;
-
-	case IPW2100_CMD_SET_ENCRYPTION:
-		ret = ipw2100_wpa_set_encryption(dev, param, p->length);
-		break;
-
-	case IPW2100_CMD_MLME:
-		ret = ipw2100_wpa_mlme(dev, param->u.mlme.command,
-				       param->u.mlme.reason_code);
-		break;
-
-	default:
-		printk(KERN_ERR DRV_NAME ": %s: Unknown WPA supplicant request: %d\n",
-				dev->name, param->cmd);
-		ret = -EOPNOTSUPP;
-
-	}
-
-	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
-		ret = -EFAULT;
-
-	kfree(param);
-	return ret;
-}
-#endif /* CONFIG_IEEE80211_WPA */
-
-static int ipw2100_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-{
-#ifdef CONFIG_IEEE80211_WPA
-	struct iwreq *wrq = (struct iwreq *) rq;
-	int ret=-1;
-	switch (cmd){
-	    case IPW2100_IOCTL_WPA_SUPPLICANT:
-		ret = ipw2100_wpa_supplicant(dev, &wrq->u.data);
-		return ret;
-
-	    default:
-		return -EOPNOTSUPP;
-	}
-
-#endif /* CONFIG_IEEE80211_WPA */
-
-	return -EOPNOTSUPP;
-}
-
-
-static void ipw_ethtool_get_drvinfo(struct net_device *dev,
-				    struct ethtool_drvinfo *info)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	char fw_ver[64], ucode_ver[64];
-
-	strcpy(info->driver, DRV_NAME);
-	strcpy(info->version, DRV_VERSION);
-
-	ipw2100_get_fwversion(priv, fw_ver, sizeof(fw_ver));
-	ipw2100_get_ucodeversion(priv, ucode_ver, sizeof(ucode_ver));
-
-	snprintf(info->fw_version, sizeof(info->fw_version), "%s:%d:%s",
-		 fw_ver, priv->eeprom_version, ucode_ver);
-
-	strcpy(info->bus_info, pci_name(priv->pci_dev));
-}
-
-static u32 ipw2100_ethtool_get_link(struct net_device *dev)
-{
-    struct ipw2100_priv *priv = ieee80211_priv(dev);
-    return (priv->status & STATUS_ASSOCIATED) ? 1 : 0;
-}
-
-
-static struct ethtool_ops ipw2100_ethtool_ops = {
-    .get_link        = ipw2100_ethtool_get_link,
-    .get_drvinfo     = ipw_ethtool_get_drvinfo,
-};
-
-static void ipw2100_hang_check(void *adapter)
-{
-	struct ipw2100_priv *priv = adapter;
-	unsigned long flags;
-	u32 rtc = 0xa5a5a5a5;
-	u32 len = sizeof(rtc);
-	int restart = 0;
-
-	spin_lock_irqsave(&priv->low_lock, flags);
-
-	if (priv->fatal_error != 0) {
-		/* If fatal_error is set then we need to restart */
-		IPW_DEBUG_INFO("%s: Hardware fatal error detected.\n",
-			       priv->net_dev->name);
-
-		restart = 1;
-	} else if (ipw2100_get_ordinal(priv, IPW_ORD_RTC_TIME, &rtc, &len) ||
-		   (rtc == priv->last_rtc)) {
-		/* Check if firmware is hung */
-		IPW_DEBUG_INFO("%s: Firmware RTC stalled.\n",
-			       priv->net_dev->name);
-
-		restart = 1;
-	}
-
-	if (restart) {
-		/* Kill timer */
-		priv->stop_hang_check = 1;
-		priv->hangs++;
-
-		/* Restart the NIC */
-		schedule_reset(priv);
-	}
-
-	priv->last_rtc = rtc;
-
-	if (!priv->stop_hang_check)
-		queue_delayed_work(priv->workqueue, &priv->hang_check, HZ / 2);
-
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-}
-
-
-static void ipw2100_rf_kill(void *adapter)
-{
-	struct ipw2100_priv *priv = adapter;
-	unsigned long flags;
-
-	spin_lock_irqsave(&priv->low_lock, flags);
-
-	if (rf_kill_active(priv)) {
-		IPW_DEBUG_RF_KILL("RF Kill active, rescheduling GPIO check\n");
-		if (!priv->stop_rf_kill)
-			queue_delayed_work(priv->workqueue, &priv->rf_kill, HZ);
-		goto exit_unlock;
-	}
-
-	/* RF Kill is now disabled, so bring the device back up */
-
-	if (!(priv->status & STATUS_RF_KILL_MASK)) {
-		IPW_DEBUG_RF_KILL("HW RF Kill no longer active, restarting "
-				  "device\n");
-		schedule_reset(priv);
-	} else
-		IPW_DEBUG_RF_KILL("HW RF Kill deactivated.  SW RF Kill still "
-				  "enabled\n");
-
- exit_unlock:
-	spin_unlock_irqrestore(&priv->low_lock, flags);
-}
-
-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv);
-
-/* Look into using netdev destructor to shutdown ieee80211? */
-
-static struct net_device *ipw2100_alloc_device(
-	struct pci_dev *pci_dev,
-	char *base_addr,
-	unsigned long mem_start,
-	unsigned long mem_len)
-{
-	struct ipw2100_priv *priv;
-	struct net_device *dev;
-
-	dev = alloc_ieee80211(sizeof(struct ipw2100_priv));
-	if (!dev)
-		return NULL;
-	priv = ieee80211_priv(dev);
-	priv->ieee = netdev_priv(dev);
-	priv->pci_dev = pci_dev;
-	priv->net_dev = dev;
-
-	priv->ieee->hard_start_xmit = ipw2100_tx;
-	priv->ieee->set_security = shim__set_security;
-
-	dev->open = ipw2100_open;
-	dev->stop = ipw2100_close;
-	dev->init = ipw2100_net_init;
-	dev->do_ioctl = ipw2100_ioctl;
-	dev->get_stats = ipw2100_stats;
-	dev->ethtool_ops = &ipw2100_ethtool_ops;
-	dev->tx_timeout = ipw2100_tx_timeout;
-	dev->wireless_handlers = &ipw2100_wx_handler_def;
-	dev->get_wireless_stats = ipw2100_wx_wireless_stats;
-	dev->set_mac_address = ipw2100_set_address;
-	dev->watchdog_timeo = 3*HZ;
-	dev->irq = 0;
-
-	dev->base_addr = (unsigned long)base_addr;
-	dev->mem_start = mem_start;
-	dev->mem_end = dev->mem_start + mem_len - 1;
-
-	/* NOTE: We don't use the wireless_handlers hook
-	 * in dev as the system will start throwing WX requests
-	 * to us before we're actually initialized and it just
-	 * ends up causing problems.  So, we just handle
-	 * the WX extensions through the ipw2100_ioctl interface */
-
-
-	/* memset() puts everything to 0, so we only have explicitely set
-	 * those values that need to be something else */
-
-	/* If power management is turned on, default to AUTO mode */
-	priv->power_mode = IPW_POWER_AUTO;
-
-
-
-#ifdef CONFIG_IEEE80211_WPA
-	priv->ieee->wpa_enabled = 0;
-	priv->ieee->tkip_countermeasures = 0;
-	priv->ieee->drop_unencrypted = 0;
-	priv->ieee->privacy_invoked = 0;
-	priv->ieee->ieee802_1x = 1;
-#endif /* CONFIG_IEEE80211_WPA */
-
-	/* Set module parameters */
-	switch (mode) {
-	case 1:
-		priv->ieee->iw_mode = IW_MODE_ADHOC;
-		break;
-#ifdef CONFIG_IPW2100_MONITOR
-	case 2:
-		priv->ieee->iw_mode = IW_MODE_MONITOR;
-		break;
-#endif
-	default:
-	case 0:
-		priv->ieee->iw_mode = IW_MODE_INFRA;
-		break;
-	}
-
-	if (disable == 1)
-		priv->status |= STATUS_RF_KILL_SW;
-
-	if (channel != 0 &&
-	    ((channel >= REG_MIN_CHANNEL) &&
-	     (channel <= REG_MAX_CHANNEL))) {
-		priv->config |= CFG_STATIC_CHANNEL;
-		priv->channel = channel;
-	}
-
-	if (associate)
-		priv->config |= CFG_ASSOCIATE;
-
-	priv->beacon_interval = DEFAULT_BEACON_INTERVAL;
-	priv->short_retry_limit = DEFAULT_SHORT_RETRY_LIMIT;
-	priv->long_retry_limit = DEFAULT_LONG_RETRY_LIMIT;
-	priv->rts_threshold = DEFAULT_RTS_THRESHOLD | RTS_DISABLED;
-	priv->frag_threshold = DEFAULT_FTS | FRAG_DISABLED;
-	priv->tx_power = IPW_TX_POWER_DEFAULT;
-	priv->tx_rates = DEFAULT_TX_RATES;
-
-	strcpy(priv->nick, "ipw2100");
-
-	spin_lock_init(&priv->low_lock);
-	sema_init(&priv->action_sem, 1);
-	sema_init(&priv->adapter_sem, 1);
-
-	init_waitqueue_head(&priv->wait_command_queue);
-
-	netif_carrier_off(dev);
-
-	INIT_LIST_HEAD(&priv->msg_free_list);
-	INIT_LIST_HEAD(&priv->msg_pend_list);
-	INIT_STAT(&priv->msg_free_stat);
-	INIT_STAT(&priv->msg_pend_stat);
-
-	INIT_LIST_HEAD(&priv->tx_free_list);
-	INIT_LIST_HEAD(&priv->tx_pend_list);
-	INIT_STAT(&priv->tx_free_stat);
-	INIT_STAT(&priv->tx_pend_stat);
-
-	INIT_LIST_HEAD(&priv->fw_pend_list);
-	INIT_STAT(&priv->fw_pend_stat);
-
-
-#ifdef CONFIG_SOFTWARE_SUSPEND2
-	priv->workqueue = create_workqueue(DRV_NAME, 0);
-#else
-	priv->workqueue = create_workqueue(DRV_NAME);
-#endif
-	INIT_WORK(&priv->reset_work,
-		  (void (*)(void *))ipw2100_reset_adapter, priv);
-	INIT_WORK(&priv->security_work,
-		  (void (*)(void *))ipw2100_security_work, priv);
-	INIT_WORK(&priv->wx_event_work,
-		  (void (*)(void *))ipw2100_wx_event_work, priv);
-	INIT_WORK(&priv->hang_check, ipw2100_hang_check, priv);
-	INIT_WORK(&priv->rf_kill, ipw2100_rf_kill, priv);
-
-	tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
-		     ipw2100_irq_tasklet, (unsigned long)priv);
-
-	/* NOTE:  We do not start the deferred work for status checks yet */
-	priv->stop_rf_kill = 1;
-	priv->stop_hang_check = 1;
-
-	return dev;
-}
-
-static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
-				const struct pci_device_id *ent)
-{
-	unsigned long mem_start, mem_len, mem_flags;
-	char *base_addr = NULL;
-	struct net_device *dev = NULL;
-	struct ipw2100_priv *priv = NULL;
-	int err = 0;
-	int registered = 0;
-	u32 val;
-
-	IPW_DEBUG_INFO("enter\n");
-
-	mem_start = pci_resource_start(pci_dev, 0);
-	mem_len = pci_resource_len(pci_dev, 0);
-	mem_flags = pci_resource_flags(pci_dev, 0);
-
-	if ((mem_flags & IORESOURCE_MEM) != IORESOURCE_MEM) {
-		IPW_DEBUG_INFO("weird - resource type is not memory\n");
-		err = -ENODEV;
-		goto fail;
-	}
-
-	base_addr = ioremap_nocache(mem_start, mem_len);
-	if (!base_addr) {
-		printk(KERN_WARNING DRV_NAME
-		       "Error calling ioremap_nocache.\n");
-		err = -EIO;
-		goto fail;
-	}
-
-	/* allocate and initialize our net_device */
-	dev = ipw2100_alloc_device(pci_dev, base_addr, mem_start, mem_len);
-	if (!dev) {
-		printk(KERN_WARNING DRV_NAME
-		       "Error calling ipw2100_alloc_device.\n");
-		err = -ENOMEM;
-		goto fail;
-	}
-
-	/* set up PCI mappings for device */
-	err = pci_enable_device(pci_dev);
-	if (err) {
-		printk(KERN_WARNING DRV_NAME
-		       "Error calling pci_enable_device.\n");
-		return err;
-	}
-
-	priv = ieee80211_priv(dev);
-
-	pci_set_master(pci_dev);
-	pci_set_drvdata(pci_dev, priv);
-
-	err = pci_set_dma_mask(pci_dev, DMA_32BIT_MASK);
-	if (err) {
-		printk(KERN_WARNING DRV_NAME
-		       "Error calling pci_set_dma_mask.\n");
-		pci_disable_device(pci_dev);
-		return err;
-	}
-
-	err = pci_request_regions(pci_dev, DRV_NAME);
-	if (err) {
-		printk(KERN_WARNING DRV_NAME
-		       "Error calling pci_request_regions.\n");
-		pci_disable_device(pci_dev);
-		return err;
-	}
-
-        /* We disable the RETRY_TIMEOUT register (0x41) to keep
-	 * PCI Tx retries from interfering with C3 CPU state */
-	pci_read_config_dword(pci_dev, 0x40, &val);
-	if ((val & 0x0000ff00) != 0)
-		pci_write_config_dword(pci_dev, 0x40, val & 0xffff00ff);
-
-	pci_set_power_state(pci_dev, PCI_D0);
-
-	if (!ipw2100_hw_is_adapter_in_system(dev)) {
-		printk(KERN_WARNING DRV_NAME
-		       "Device not found via register read.\n");
-		err = -ENODEV;
-		goto fail;
-	}
-
-	SET_NETDEV_DEV(dev, &pci_dev->dev);
-
-	/* Force interrupts to be shut off on the device */
-	priv->status |= STATUS_INT_ENABLED;
-	ipw2100_disable_interrupts(priv);
-
-	/* Allocate and initialize the Tx/Rx queues and lists */
-	if (ipw2100_queues_allocate(priv)) {
-		printk(KERN_WARNING DRV_NAME
-		       "Error calilng ipw2100_queues_allocate.\n");
-		err = -ENOMEM;
-		goto fail;
-	}
-	ipw2100_queues_initialize(priv);
-
-	err = request_irq(pci_dev->irq,
-			  ipw2100_interrupt, SA_SHIRQ,
-			  dev->name, priv);
-	if (err) {
-		printk(KERN_WARNING DRV_NAME
-		       "Error calling request_irq: %d.\n",
-		       pci_dev->irq);
-		goto fail;
-	}
-	dev->irq = pci_dev->irq;
-
-	IPW_DEBUG_INFO("Attempting to register device...\n");
-
-	SET_MODULE_OWNER(dev);
-
-	printk(KERN_INFO DRV_NAME
-	       ": Detected Intel PRO/Wireless 2100 Network Connection\n");
-
-	/* Bring up the interface.  Pre 0.46, after we registered the
-	 * network device we would call ipw2100_up.  This introduced a race
-	 * condition with newer hotplug configurations (network was coming
-	 * up and making calls before the device was initialized).
-	 *
-	 * If we called ipw2100_up before we registered the device, then the
-	 * device name wasn't registered.  So, we instead use the net_dev->init
-	 * member to call a function that then just turns and calls ipw2100_up.
-	 * net_dev->init is called after name allocation but before the
-	 * notifier chain is called */
-	down(&priv->action_sem);
-	err = register_netdev(dev);
-	if (err) {
-		printk(KERN_WARNING DRV_NAME
-		       "Error calling register_netdev.\n");
-		goto fail_unlock;
-	}
-	registered = 1;
-
-	IPW_DEBUG_INFO("%s: Bound to %s\n", dev->name, pci_name(pci_dev));
-
-	/* perform this after register_netdev so that dev->name is set */
-	sysfs_create_group(&pci_dev->dev.kobj, &ipw2100_attribute_group);
-	netif_carrier_off(dev);
-
-	/* If the RF Kill switch is disabled, go ahead and complete the
-	 * startup sequence */
-	if (!(priv->status & STATUS_RF_KILL_MASK)) {
-		/* Enable the adapter - sends HOST_COMPLETE */
-		if (ipw2100_enable_adapter(priv)) {
-			printk(KERN_WARNING DRV_NAME
-			       ": %s: failed in call to enable adapter.\n",
-			       priv->net_dev->name);
-			ipw2100_hw_stop_adapter(priv);
-			err = -EIO;
-			goto fail_unlock;
-		}
-
-		/* Start a scan . . . */
-		ipw2100_set_scan_options(priv);
-		ipw2100_start_scan(priv);
-	}
-
-	IPW_DEBUG_INFO("exit\n");
-
-	priv->status |= STATUS_INITIALIZED;
-
-	up(&priv->action_sem);
-
-	return 0;
-
- fail_unlock:
-	up(&priv->action_sem);
-
- fail:
-	if (dev) {
-		if (registered)
-			unregister_netdev(dev);
-
-		ipw2100_hw_stop_adapter(priv);
-
-		ipw2100_disable_interrupts(priv);
-
-		if (dev->irq)
-			free_irq(dev->irq, priv);
-
-		ipw2100_kill_workqueue(priv);
-
-		/* These are safe to call even if they weren't allocated */
-		ipw2100_queues_free(priv);
-		sysfs_remove_group(&pci_dev->dev.kobj, &ipw2100_attribute_group);
-
-		free_ieee80211(dev);
-		pci_set_drvdata(pci_dev, NULL);
-	}
-
-	if (base_addr)
-		iounmap((char*)base_addr);
-
-	pci_release_regions(pci_dev);
-	pci_disable_device(pci_dev);
-
-	return err;
-}
-
-static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
-{
-	struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
-	struct net_device *dev;
-
-	if (priv) {
-		down(&priv->action_sem);
-
-		priv->status &= ~STATUS_INITIALIZED;
-
-		dev = priv->net_dev;
-		sysfs_remove_group(&pci_dev->dev.kobj, &ipw2100_attribute_group);
-
-#ifdef CONFIG_PM
-		if (ipw2100_firmware.version)
-			ipw2100_release_firmware(priv, &ipw2100_firmware);
-#endif
-		/* Take down the hardware */
-		ipw2100_down(priv);
-
-		/* Release the semaphore so that the network subsystem can
-		 * complete any needed calls into the driver... */
-		up(&priv->action_sem);
-
-		/* Unregister the device first - this results in close()
-		 * being called if the device is open.  If we free storage
-		 * first, then close() will crash. */
-		unregister_netdev(dev);
-
-		/* ipw2100_down will ensure that there is no more pending work
-		 * in the workqueue's, so we can safely remove them now. */
-		ipw2100_kill_workqueue(priv);
-
-		ipw2100_queues_free(priv);
-
-		/* Free potential debugging firmware snapshot */
-		ipw2100_snapshot_free(priv);
-
-		if (dev->irq)
-			free_irq(dev->irq, priv);
-
-		if (dev->base_addr)
-			iounmap((unsigned char *)dev->base_addr);
-
-		free_ieee80211(dev);
-	}
-
-	pci_release_regions(pci_dev);
-	pci_disable_device(pci_dev);
-
-	IPW_DEBUG_INFO("exit\n");
-}
-
-
-#ifdef CONFIG_PM
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,11)
-static int ipw2100_suspend(struct pci_dev *pci_dev, u32 state)
-#else
-static int ipw2100_suspend(struct pci_dev *pci_dev, pm_message_t state)
-#endif
-{
-	struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
-	struct net_device *dev = priv->net_dev;
-
-	IPW_DEBUG_INFO("%s: Going into suspend...\n",
-	       dev->name);
-
-	down(&priv->action_sem);
-	if (priv->status & STATUS_INITIALIZED) {
-		/* Take down the device; powers it off, etc. */
-		ipw2100_down(priv);
-	}
-
-	/* Remove the PRESENT state of the device */
-	netif_device_detach(dev);
-
-	pci_save_state(pci_dev);
-	pci_disable_device (pci_dev);
-	pci_set_power_state(pci_dev, PCI_D3hot);
-
-	up(&priv->action_sem);
-
-	return 0;
-}
-
-static int ipw2100_resume(struct pci_dev *pci_dev)
-{
-	struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
-	struct net_device *dev = priv->net_dev;
-	u32 val;
-
-	if (IPW2100_PM_DISABLED)
-		return 0;
-
-	down(&priv->action_sem);
-
-	IPW_DEBUG_INFO("%s: Coming out of suspend...\n",
-	       dev->name);
-
-	pci_set_power_state(pci_dev, PCI_D0);
-	pci_enable_device(pci_dev);
-	pci_restore_state(pci_dev);
-
-	/*
-	 * Suspend/Resume resets the PCI configuration space, so we have to
-	 * re-disable the RETRY_TIMEOUT register (0x41) to keep PCI Tx retries
-	 * from interfering with C3 CPU state. pci_restore_state won't help
-	 * here since it only restores the first 64 bytes pci config header.
-	 */
-	pci_read_config_dword(pci_dev, 0x40, &val);
-	if ((val & 0x0000ff00) != 0)
-		pci_write_config_dword(pci_dev, 0x40, val & 0xffff00ff);
-
-	/* Set the device back into the PRESENT state; this will also wake
-	 * the queue of needed */
-	netif_device_attach(dev);
-
-        /* Bring the device back up */
-        if (!(priv->status & STATUS_RF_KILL_SW))
-                ipw2100_up(priv, 0);
-
-	up(&priv->action_sem);
-
-	return 0;
-}
-#endif
-
-
-#define IPW2100_DEV_ID(x) { PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, x }
-
-static struct pci_device_id ipw2100_pci_id_table[] __devinitdata = {
-	IPW2100_DEV_ID(0x2520), /* IN 2100A mPCI 3A */
-	IPW2100_DEV_ID(0x2521), /* IN 2100A mPCI 3B */
-	IPW2100_DEV_ID(0x2524), /* IN 2100A mPCI 3B */
-	IPW2100_DEV_ID(0x2525), /* IN 2100A mPCI 3B */
-	IPW2100_DEV_ID(0x2526), /* IN 2100A mPCI Gen A3 */
-	IPW2100_DEV_ID(0x2522), /* IN 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2523), /* IN 2100 mPCI 3A */
-	IPW2100_DEV_ID(0x2527), /* IN 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2528), /* IN 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2529), /* IN 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x252B), /* IN 2100 mPCI 3A */
-	IPW2100_DEV_ID(0x252C), /* IN 2100 mPCI 3A */
-	IPW2100_DEV_ID(0x252D), /* IN 2100 mPCI 3A */
-
-	IPW2100_DEV_ID(0x2550), /* IB 2100A mPCI 3B */
-	IPW2100_DEV_ID(0x2551), /* IB 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2553), /* IB 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2554), /* IB 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2555), /* IB 2100 mPCI 3B */
-
-	IPW2100_DEV_ID(0x2560), /* DE 2100A mPCI 3A */
-	IPW2100_DEV_ID(0x2562), /* DE 2100A mPCI 3A */
-	IPW2100_DEV_ID(0x2563), /* DE 2100A mPCI 3A */
-	IPW2100_DEV_ID(0x2561), /* DE 2100 mPCI 3A */
-	IPW2100_DEV_ID(0x2565), /* DE 2100 mPCI 3A */
-	IPW2100_DEV_ID(0x2566), /* DE 2100 mPCI 3A */
-	IPW2100_DEV_ID(0x2567), /* DE 2100 mPCI 3A */
-
-	IPW2100_DEV_ID(0x2570), /* GA 2100 mPCI 3B */
-
-	IPW2100_DEV_ID(0x2580), /* TO 2100A mPCI 3B */
-	IPW2100_DEV_ID(0x2582), /* TO 2100A mPCI 3B */
-	IPW2100_DEV_ID(0x2583), /* TO 2100A mPCI 3B */
-	IPW2100_DEV_ID(0x2581), /* TO 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2585), /* TO 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2586), /* TO 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2587), /* TO 2100 mPCI 3B */
-
-	IPW2100_DEV_ID(0x2590), /* SO 2100A mPCI 3B */
-	IPW2100_DEV_ID(0x2592), /* SO 2100A mPCI 3B */
-	IPW2100_DEV_ID(0x2591), /* SO 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2593), /* SO 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2596), /* SO 2100 mPCI 3B */
-	IPW2100_DEV_ID(0x2598), /* SO 2100 mPCI 3B */
-
-	IPW2100_DEV_ID(0x25A0), /* HP 2100 mPCI 3B */
-	{0,},
-};
-
-MODULE_DEVICE_TABLE(pci, ipw2100_pci_id_table);
-
-static struct pci_driver ipw2100_pci_driver = {
-	.name = DRV_NAME,
-	.id_table = ipw2100_pci_id_table,
-	.probe = ipw2100_pci_init_one,
-	.remove = __devexit_p(ipw2100_pci_remove_one),
-#ifdef CONFIG_PM
-	.suspend = ipw2100_suspend,
-	.resume = ipw2100_resume,
-#endif
-};
-
-
-/**
- * Initialize the ipw2100 driver/module
- *
- * @returns 0 if ok, < 0 errno node con error.
- *
- * Note: we cannot init the /proc stuff until the PCI driver is there,
- * or we risk an unlikely race condition on someone accessing
- * uninitialized data in the PCI dev struct through /proc.
- */
-static int __init ipw2100_init(void)
-{
-	int ret;
-
-	printk(KERN_INFO DRV_NAME ": %s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
-	printk(KERN_INFO DRV_NAME ": %s\n", DRV_COPYRIGHT);
-
-#ifdef CONFIG_IEEE80211_NOWEP
-	IPW_DEBUG_INFO(DRV_NAME ": Compiled with WEP disabled.\n");
-#endif
-
-	ret = pci_module_init(&ipw2100_pci_driver);
-
-#ifdef CONFIG_IPW_DEBUG
-	ipw2100_debug_level = debug;
-	driver_create_file(&ipw2100_pci_driver.driver,
-			   &driver_attr_debug_level);
-#endif
-
-	return ret;
-}
-
-
-/**
- * Cleanup ipw2100 driver registration
- */
-static void __exit ipw2100_exit(void)
-{
-	/* FIXME: IPG: check that we have no instances of the devices open */
-#ifdef CONFIG_IPW_DEBUG
-	driver_remove_file(&ipw2100_pci_driver.driver,
-			   &driver_attr_debug_level);
-#endif
-	pci_unregister_driver(&ipw2100_pci_driver);
-}
-
-module_init(ipw2100_init);
-module_exit(ipw2100_exit);
-
-#define WEXT_USECHANNELS 1
-
-static const long ipw2100_frequencies[] = {
-	2412, 2417, 2422, 2427,
-	2432, 2437, 2442, 2447,
-	2452, 2457, 2462, 2467,
-	2472, 2484
-};
-
-#define FREQ_COUNT (sizeof(ipw2100_frequencies) / \
-                    sizeof(ipw2100_frequencies[0]))
-
-static const long ipw2100_rates_11b[] = {
-	1000000,
-	2000000,
-	5500000,
-	11000000
-};
-
-#define RATE_COUNT (sizeof(ipw2100_rates_11b) / sizeof(ipw2100_rates_11b[0]))
-
-static int ipw2100_wx_get_name(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	if (!(priv->status & STATUS_ASSOCIATED))
-		strcpy(wrqu->name, "unassociated");
-	else
-		snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11b");
-
-	IPW_DEBUG_WX("Name: %s\n", wrqu->name);
-	return 0;
-}
-
-
-static int ipw2100_wx_set_freq(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	struct iw_freq *fwrq = &wrqu->freq;
-	int err = 0;
-
-	if (priv->ieee->iw_mode == IW_MODE_INFRA)
-		return -EOPNOTSUPP;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	/* if setting by freq convert to channel */
-	if (fwrq->e == 1) {
-		if ((fwrq->m >= (int) 2.412e8 &&
-		     fwrq->m <= (int) 2.487e8)) {
-			int f = fwrq->m / 100000;
-			int c = 0;
-
-			while ((c < REG_MAX_CHANNEL) &&
-			       (f != ipw2100_frequencies[c]))
-				c++;
-
-			/* hack to fall through */
-			fwrq->e = 0;
-			fwrq->m = c + 1;
-		}
-	}
-
-	if (fwrq->e > 0 || fwrq->m > 1000)
-		return -EOPNOTSUPP;
-	else { /* Set the channel */
-		IPW_DEBUG_WX("SET Freq/Channel -> %d \n", fwrq->m);
-		err = ipw2100_set_channel(priv, fwrq->m, 0);
-	}
-
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-
-static int ipw2100_wx_get_freq(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	wrqu->freq.e = 0;
-
-	/* If we are associated, trying to associate, or have a statically
-	 * configured CHANNEL then return that; otherwise return ANY */
-	if (priv->config & CFG_STATIC_CHANNEL ||
-	    priv->status & STATUS_ASSOCIATED)
-		wrqu->freq.m = priv->channel;
-	else
-		wrqu->freq.m = 0;
-
-	IPW_DEBUG_WX("GET Freq/Channel -> %d \n", priv->channel);
-	return 0;
-
-}
-
-static int ipw2100_wx_set_mode(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int err = 0;
-
-	IPW_DEBUG_WX("SET Mode -> %d \n", wrqu->mode);
-
-	if (wrqu->mode == priv->ieee->iw_mode)
-		return 0;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	switch (wrqu->mode) {
-#ifdef CONFIG_IPW2100_MONITOR
-	case IW_MODE_MONITOR:
-		err = ipw2100_switch_mode(priv, IW_MODE_MONITOR);
-		break;
-#endif /* CONFIG_IPW2100_MONITOR */
-	case IW_MODE_ADHOC:
-		err = ipw2100_switch_mode(priv, IW_MODE_ADHOC);
-		break;
-	case IW_MODE_INFRA:
-	case IW_MODE_AUTO:
-	default:
-		err = ipw2100_switch_mode(priv, IW_MODE_INFRA);
-		break;
-	}
-
-done:
-	up(&priv->action_sem);
- 	return err;
-}
-
-static int ipw2100_wx_get_mode(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	wrqu->mode = priv->ieee->iw_mode;
-	IPW_DEBUG_WX("GET Mode -> %d\n", wrqu->mode);
-
-	return 0;
-}
-
-
-#define POWER_MODES 5
-
-/* Values are in microsecond */
-static const s32 timeout_duration[POWER_MODES] = {
-	350000,
-	250000,
-	75000,
-	37000,
-	25000,
-};
-
-static const s32 period_duration[POWER_MODES] = {
-	400000,
-	700000,
-	1000000,
-	1000000,
-	1000000
-};
-
-static int ipw2100_wx_get_range(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	struct iw_range *range = (struct iw_range *)extra;
-	u16 val;
-	int i, level;
-
-	wrqu->data.length = sizeof(*range);
-	memset(range, 0, sizeof(*range));
-
-	/* Let's try to keep this struct in the same order as in
-	 * linux/include/wireless.h
-	 */
-
-	/* TODO: See what values we can set, and remove the ones we can't
-	 * set, or fill them with some default data.
-	 */
-
-	/* ~5 Mb/s real (802.11b) */
-	range->throughput = 5 * 1000 * 1000;
-
-//	range->sensitivity;	/* signal level threshold range */
-
-	range->max_qual.qual = 100;
-	/* TODO: Find real max RSSI and stick here */
-	range->max_qual.level = 0;
-	range->max_qual.noise = 0;
-	range->max_qual.updated = 7; /* Updated all three */
-
-	range->avg_qual.qual = 70; /* > 8% missed beacons is 'bad' */
-	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
-	range->avg_qual.level = 20 + IPW2100_RSSI_TO_DBM;
-	range->avg_qual.noise = 0;
-	range->avg_qual.updated = 7; /* Updated all three */
-
-	range->num_bitrates = RATE_COUNT;
-
-	for (i = 0; i < RATE_COUNT && i < IW_MAX_BITRATES; i++) {
-		range->bitrate[i] = ipw2100_rates_11b[i];
-	}
-
-	range->min_rts = MIN_RTS_THRESHOLD;
-	range->max_rts = MAX_RTS_THRESHOLD;
-	range->min_frag = MIN_FRAG_THRESHOLD;
-	range->max_frag = MAX_FRAG_THRESHOLD;
-
-	range->min_pmp = period_duration[0];	/* Minimal PM period */
-	range->max_pmp = period_duration[POWER_MODES-1];/* Maximal PM period */
-	range->min_pmt = timeout_duration[POWER_MODES-1];	/* Minimal PM timeout */
-	range->max_pmt = timeout_duration[0];/* Maximal PM timeout */
-
-        /* How to decode max/min PM period */
-	range->pmp_flags = IW_POWER_PERIOD;
-        /* How to decode max/min PM period */
-	range->pmt_flags = IW_POWER_TIMEOUT;
-	/* What PM options are supported */
-	range->pm_capa = IW_POWER_TIMEOUT | IW_POWER_PERIOD;
-
-	range->encoding_size[0] = 5;
-	range->encoding_size[1] = 13;           /* Different token sizes */
-	range->num_encoding_sizes = 2;		/* Number of entry in the list */
-	range->max_encoding_tokens = WEP_KEYS;  /* Max number of tokens */
-//	range->encoding_login_index;		/* token index for login token */
-
-	if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
-		range->txpower_capa = IW_TXPOW_DBM;
-		range->num_txpower = IW_MAX_TXPOWER;
-		for (i = 0, level = (IPW_TX_POWER_MAX_DBM * 16); i < IW_MAX_TXPOWER;
-		     i++, level -= ((IPW_TX_POWER_MAX_DBM - IPW_TX_POWER_MIN_DBM) * 16) /
-			     (IW_MAX_TXPOWER - 1))
-			range->txpower[i] = level / 16;
-	} else {
-		range->txpower_capa = 0;
-		range->num_txpower = 0;
-	}
-
-
-	/* Set the Wireless Extension versions */
-	range->we_version_compiled = WIRELESS_EXT;
-	range->we_version_source = 16;
-
-//	range->retry_capa;	/* What retry options are supported */
-//	range->retry_flags;	/* How to decode max/min retry limit */
-//	range->r_time_flags;	/* How to decode max/min retry life */
-//	range->min_retry;	/* Minimal number of retries */
-//	range->max_retry;	/* Maximal number of retries */
-//	range->min_r_time;	/* Minimal retry lifetime */
-//	range->max_r_time;	/* Maximal retry lifetime */
-
-        range->num_channels = FREQ_COUNT;
-
-	val = 0;
-	for (i = 0; i < FREQ_COUNT; i++) {
-		// TODO: Include only legal frequencies for some countries
-//		if (local->channel_mask & (1 << i)) {
-			range->freq[val].i = i + 1;
-			range->freq[val].m = ipw2100_frequencies[i] * 100000;
-			range->freq[val].e = 1;
-			val++;
-//		}
-		if (val == IW_MAX_FREQUENCIES)
-		break;
-	}
-	range->num_frequency = val;
-
-	IPW_DEBUG_WX("GET Range\n");
-
-	return 0;
-}
-
-static int ipw2100_wx_set_wap(struct net_device *dev,
-			      struct iw_request_info *info,
-			      union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int err = 0;
-
-	static const unsigned char any[] = {
-		0xff, 0xff, 0xff, 0xff, 0xff, 0xff
-	};
-	static const unsigned char off[] = {
-		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-	};
-
-	// sanity checks
-	if (wrqu->ap_addr.sa_family != ARPHRD_ETHER)
-		return -EINVAL;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	if (!memcmp(any, wrqu->ap_addr.sa_data, ETH_ALEN) ||
-	    !memcmp(off, wrqu->ap_addr.sa_data, ETH_ALEN)) {
-		/* we disable mandatory BSSID association */
-		IPW_DEBUG_WX("exit - disable mandatory BSSID\n");
-		priv->config &= ~CFG_STATIC_BSSID;
-		err = ipw2100_set_mandatory_bssid(priv, NULL, 0);
-		goto done;
-	}
-
-	priv->config |= CFG_STATIC_BSSID;
-	memcpy(priv->mandatory_bssid_mac, wrqu->ap_addr.sa_data, ETH_ALEN);
-
-	err = ipw2100_set_mandatory_bssid(priv, wrqu->ap_addr.sa_data, 0);
-
-	IPW_DEBUG_WX("SET BSSID -> %02X:%02X:%02X:%02X:%02X:%02X\n",
-		     wrqu->ap_addr.sa_data[0] & 0xff,
-		     wrqu->ap_addr.sa_data[1] & 0xff,
-		     wrqu->ap_addr.sa_data[2] & 0xff,
-		     wrqu->ap_addr.sa_data[3] & 0xff,
-		     wrqu->ap_addr.sa_data[4] & 0xff,
-		     wrqu->ap_addr.sa_data[5] & 0xff);
-
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_wx_get_wap(struct net_device *dev,
-			      struct iw_request_info *info,
-			      union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	/* If we are associated, trying to associate, or have a statically
-	 * configured BSSID then return that; otherwise return ANY */
-	if (priv->config & CFG_STATIC_BSSID ||
-	    priv->status & STATUS_ASSOCIATED) {
-		wrqu->ap_addr.sa_family = ARPHRD_ETHER;
-		memcpy(wrqu->ap_addr.sa_data, &priv->bssid, ETH_ALEN);
-	} else
-		memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
-
-	IPW_DEBUG_WX("Getting WAP BSSID: " MAC_FMT "\n",
-		     MAC_ARG(wrqu->ap_addr.sa_data));
-	return 0;
-}
-
-static int ipw2100_wx_set_essid(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	char *essid = ""; /* ANY */
-	int length = 0;
-	int err = 0;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	if (wrqu->essid.flags && wrqu->essid.length) {
-		length = wrqu->essid.length - 1;
-		essid = extra;
-	}
-
-	if (length == 0) {
-		IPW_DEBUG_WX("Setting ESSID to ANY\n");
-		priv->config &= ~CFG_STATIC_ESSID;
-		err = ipw2100_set_essid(priv, NULL, 0, 0);
-		goto done;
-	}
-
-	length = min(length, IW_ESSID_MAX_SIZE);
-
-	priv->config |= CFG_STATIC_ESSID;
-
-	if (priv->essid_len == length && !memcmp(priv->essid, extra, length)) {
-		IPW_DEBUG_WX("ESSID set to current ESSID.\n");
-		err = 0;
-		goto done;
-	}
-
-	IPW_DEBUG_WX("Setting ESSID: '%s' (%d)\n", escape_essid(essid, length),
-		     length);
-
-	priv->essid_len = length;
-	memcpy(priv->essid, essid, priv->essid_len);
-
-	err = ipw2100_set_essid(priv, essid, length, 0);
-
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_wx_get_essid(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	/* If we are associated, trying to associate, or have a statically
-	 * configured ESSID then return that; otherwise return ANY */
-	if (priv->config & CFG_STATIC_ESSID ||
-	    priv->status & STATUS_ASSOCIATED) {
-		IPW_DEBUG_WX("Getting essid: '%s'\n",
-			     escape_essid(priv->essid, priv->essid_len));
-		memcpy(extra, priv->essid, priv->essid_len);
-		wrqu->essid.length = priv->essid_len;
-		wrqu->essid.flags = 1; /* active */
-	} else {
-		IPW_DEBUG_WX("Getting essid: ANY\n");
-		wrqu->essid.length = 0;
-		wrqu->essid.flags = 0; /* active */
-	}
-
-	return 0;
-}
-
-static int ipw2100_wx_set_nick(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	if (wrqu->data.length > IW_ESSID_MAX_SIZE)
-		return -E2BIG;
-
-	wrqu->data.length = min((size_t)wrqu->data.length, sizeof(priv->nick));
-	memset(priv->nick, 0, sizeof(priv->nick));
-	memcpy(priv->nick, extra,  wrqu->data.length);
-
-	IPW_DEBUG_WX("SET Nickname -> %s \n", priv->nick);
-
-	return 0;
-}
-
-static int ipw2100_wx_get_nick(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	wrqu->data.length = strlen(priv->nick) + 1;
-	memcpy(extra, priv->nick, wrqu->data.length);
-	wrqu->data.flags = 1; /* active */
-
-	IPW_DEBUG_WX("GET Nickname -> %s \n", extra);
-
-	return 0;
-}
-
-static int ipw2100_wx_set_rate(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	u32 target_rate = wrqu->bitrate.value;
-	u32 rate;
-	int err = 0;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	rate = 0;
-
-	if (target_rate == 1000000 ||
-	    (!wrqu->bitrate.fixed && target_rate > 1000000))
-		rate |= TX_RATE_1_MBIT;
-	if (target_rate == 2000000 ||
-	    (!wrqu->bitrate.fixed && target_rate > 2000000))
-		rate |= TX_RATE_2_MBIT;
-	if (target_rate == 5500000 ||
-	    (!wrqu->bitrate.fixed && target_rate > 5500000))
-		rate |= TX_RATE_5_5_MBIT;
-	if (target_rate == 11000000 ||
-	    (!wrqu->bitrate.fixed && target_rate > 11000000))
-		rate |= TX_RATE_11_MBIT;
-	if (rate == 0)
-		rate = DEFAULT_TX_RATES;
-
-	err = ipw2100_set_tx_rates(priv, rate, 0);
-
-	IPW_DEBUG_WX("SET Rate -> %04X \n", rate);
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-
-static int ipw2100_wx_get_rate(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int val;
-	int len = sizeof(val);
-	int err = 0;
-
-	if (!(priv->status & STATUS_ENABLED) ||
-	    priv->status & STATUS_RF_KILL_MASK ||
-	    !(priv->status & STATUS_ASSOCIATED)) {
-		wrqu->bitrate.value = 0;
-		return 0;
-	}
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	err = ipw2100_get_ordinal(priv, IPW_ORD_CURRENT_TX_RATE, &val, &len);
-	if (err) {
-		IPW_DEBUG_WX("failed querying ordinals.\n");
-		return err;
-	}
-
-	switch (val & TX_RATE_MASK) {
-	case TX_RATE_1_MBIT:
-		wrqu->bitrate.value = 1000000;
-		break;
-	case TX_RATE_2_MBIT:
-		wrqu->bitrate.value = 2000000;
-		break;
-	case TX_RATE_5_5_MBIT:
-		wrqu->bitrate.value = 5500000;
-		break;
-	case TX_RATE_11_MBIT:
-		wrqu->bitrate.value = 11000000;
-		break;
-	default:
-		wrqu->bitrate.value = 0;
-	}
-
-	IPW_DEBUG_WX("GET Rate -> %d \n", wrqu->bitrate.value);
-
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_wx_set_rts(struct net_device *dev,
-			      struct iw_request_info *info,
-			      union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int value, err;
-
-	/* Auto RTS not yet supported */
-	if (wrqu->rts.fixed == 0)
-		return -EINVAL;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	if (wrqu->rts.disabled)
-		value = priv->rts_threshold | RTS_DISABLED;
-	else {
-		if (wrqu->rts.value < 1 ||
-		    wrqu->rts.value > 2304) {
-			err = -EINVAL;
-			goto done;
-		}
-		value = wrqu->rts.value;
-	}
-
-	err = ipw2100_set_rts_threshold(priv, value);
-
-	IPW_DEBUG_WX("SET RTS Threshold -> 0x%08X \n", value);
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_wx_get_rts(struct net_device *dev,
-			      struct iw_request_info *info,
-			      union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	wrqu->rts.value = priv->rts_threshold & ~RTS_DISABLED;
-	wrqu->rts.fixed = 1; /* no auto select */
-
-	/* If RTS is set to the default value, then it is disabled */
-	wrqu->rts.disabled = (priv->rts_threshold & RTS_DISABLED) ? 1 : 0;
-
-	IPW_DEBUG_WX("GET RTS Threshold -> 0x%08X \n", wrqu->rts.value);
-
-	return 0;
-}
-
-static int ipw2100_wx_set_txpow(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int err = 0, value;
-
-	if (priv->ieee->iw_mode != IW_MODE_ADHOC)
-		return -EINVAL;
-
-	if (wrqu->txpower.disabled == 1 || wrqu->txpower.fixed == 0)
-		value = IPW_TX_POWER_DEFAULT;
-	else {
-		if (wrqu->txpower.value < IPW_TX_POWER_MIN_DBM ||
-		    wrqu->txpower.value > IPW_TX_POWER_MAX_DBM)
-			return -EINVAL;
-
-		value = (wrqu->txpower.value - IPW_TX_POWER_MIN_DBM) * 16 /
-			(IPW_TX_POWER_MAX_DBM - IPW_TX_POWER_MIN_DBM);
-	}
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	err = ipw2100_set_tx_power(priv, value);
-
-	IPW_DEBUG_WX("SET TX Power -> %d \n", value);
-
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_wx_get_txpow(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	if (priv->ieee->iw_mode != IW_MODE_ADHOC) {
-		wrqu->power.disabled = 1;
-		return 0;
-	}
-
-	if (priv->tx_power == IPW_TX_POWER_DEFAULT) {
-		wrqu->power.fixed = 0;
-		wrqu->power.value = IPW_TX_POWER_MAX_DBM;
-		wrqu->power.disabled = 1;
-	} else {
-		wrqu->power.disabled = 0;
-		wrqu->power.fixed = 1;
-		wrqu->power.value =
-			(priv->tx_power *
-			 (IPW_TX_POWER_MAX_DBM - IPW_TX_POWER_MIN_DBM)) /
-			(IPW_TX_POWER_MAX - IPW_TX_POWER_MIN) +
-			IPW_TX_POWER_MIN_DBM;
-	}
-
-	wrqu->power.flags = IW_TXPOW_DBM;
-
-	IPW_DEBUG_WX("GET TX Power -> %d \n", wrqu->power.value);
-
-	return 0;
-}
-
-static int ipw2100_wx_set_frag(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	if (!wrqu->frag.fixed)
-		return -EINVAL;
-
-	if (wrqu->frag.disabled) {
-		priv->frag_threshold |= FRAG_DISABLED;
-		priv->ieee->fts = DEFAULT_FTS;
-	} else {
-		if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
-		    wrqu->frag.value > MAX_FRAG_THRESHOLD)
-			return -EINVAL;
-
-		priv->ieee->fts = wrqu->frag.value & ~0x1;
-		priv->frag_threshold = priv->ieee->fts;
-	}
-
-	IPW_DEBUG_WX("SET Frag Threshold -> %d \n", priv->ieee->fts);
-
-	return 0;
-}
-
-static int ipw2100_wx_get_frag(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	wrqu->frag.value = priv->frag_threshold & ~FRAG_DISABLED;
-	wrqu->frag.fixed = 0;	/* no auto select */
-	wrqu->frag.disabled = (priv->frag_threshold & FRAG_DISABLED) ? 1 : 0;
-
-	IPW_DEBUG_WX("GET Frag Threshold -> %d \n", wrqu->frag.value);
-
-	return 0;
-}
-
-static int ipw2100_wx_set_retry(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int err = 0;
-
-	if (wrqu->retry.flags & IW_RETRY_LIFETIME ||
-	    wrqu->retry.disabled)
-		return -EINVAL;
-
-	if (!(wrqu->retry.flags & IW_RETRY_LIMIT))
-		return 0;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	if (wrqu->retry.flags & IW_RETRY_MIN) {
-		err = ipw2100_set_short_retry(priv, wrqu->retry.value);
-		IPW_DEBUG_WX("SET Short Retry Limit -> %d \n",
-		       wrqu->retry.value);
-		goto done;
-	}
-
-	if (wrqu->retry.flags & IW_RETRY_MAX) {
-		err = ipw2100_set_long_retry(priv, wrqu->retry.value);
-		IPW_DEBUG_WX("SET Long Retry Limit -> %d \n",
-		       wrqu->retry.value);
-		goto done;
-	}
-
-	err = ipw2100_set_short_retry(priv, wrqu->retry.value);
-	if (!err)
-		err = ipw2100_set_long_retry(priv, wrqu->retry.value);
-
-	IPW_DEBUG_WX("SET Both Retry Limits -> %d \n", wrqu->retry.value);
-
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_wx_get_retry(struct net_device *dev,
-				struct iw_request_info *info,
-				union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	wrqu->retry.disabled = 0; /* can't be disabled */
-
-	if ((wrqu->retry.flags & IW_RETRY_TYPE) ==
-	    IW_RETRY_LIFETIME)
-		return -EINVAL;
-
-	if (wrqu->retry.flags & IW_RETRY_MAX) {
-		wrqu->retry.flags = IW_RETRY_LIMIT & IW_RETRY_MAX;
-		wrqu->retry.value = priv->long_retry_limit;
-	} else {
-		wrqu->retry.flags =
-		    (priv->short_retry_limit !=
-		     priv->long_retry_limit) ?
-		    IW_RETRY_LIMIT & IW_RETRY_MIN : IW_RETRY_LIMIT;
-
-		wrqu->retry.value = priv->short_retry_limit;
-	}
-
-	IPW_DEBUG_WX("GET Retry -> %d \n", wrqu->retry.value);
-
-	return 0;
-}
-
-static int ipw2100_wx_set_scan(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int err = 0;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	IPW_DEBUG_WX("Initiating scan...\n");
-	if (ipw2100_set_scan_options(priv) ||
-	    ipw2100_start_scan(priv)) {
-		IPW_DEBUG_WX("Start scan failed.\n");
-
-		/* TODO: Mark a scan as pending so when hardware initialized
-		 *       a scan starts */
-	}
-
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_wx_get_scan(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	return ieee80211_wx_get_scan(priv->ieee, info, wrqu, extra);
-}
-
-
-/*
- * Implementation based on code in hostap-driver v0.1.3 hostap_ioctl.c
- */
-static int ipw2100_wx_set_encode(struct net_device *dev,
-				 struct iw_request_info *info,
-				 union iwreq_data *wrqu, char *key)
-{
-	/*
-	 * No check of STATUS_INITIALIZED required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	return ieee80211_wx_set_encode(priv->ieee, info, wrqu, key);
-}
-
-static int ipw2100_wx_get_encode(struct net_device *dev,
-				 struct iw_request_info *info,
-				 union iwreq_data *wrqu, char *key)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	return ieee80211_wx_get_encode(priv->ieee, info, wrqu, key);
-}
-
-static int ipw2100_wx_set_power(struct net_device *dev,
-			        struct iw_request_info *info,
-			        union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int err = 0;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	if (wrqu->power.disabled) {
-		priv->power_mode = IPW_POWER_LEVEL(priv->power_mode);
-		err = ipw2100_set_power_mode(priv, IPW_POWER_MODE_CAM);
-		IPW_DEBUG_WX("SET Power Management Mode -> off\n");
-		goto done;
-	}
-
-	switch (wrqu->power.flags & IW_POWER_MODE) {
-	case IW_POWER_ON:    /* If not specified */
-	case IW_POWER_MODE:  /* If set all mask */
-	case IW_POWER_ALL_R: /* If explicitely state all */
-		break;
-	default: /* Otherwise we don't support it */
-		IPW_DEBUG_WX("SET PM Mode: %X not supported.\n",
-			     wrqu->power.flags);
-		err = -EOPNOTSUPP;
-		goto done;
-	}
-
-	/* If the user hasn't specified a power management mode yet, default
-	 * to BATTERY */
-	priv->power_mode = IPW_POWER_ENABLED | priv->power_mode;
-	err = ipw2100_set_power_mode(priv, IPW_POWER_LEVEL(priv->power_mode));
-
-	IPW_DEBUG_WX("SET Power Management Mode -> 0x%02X\n",
-		     priv->power_mode);
-
- done:
-	up(&priv->action_sem);
-	return err;
-
-}
-
-static int ipw2100_wx_get_power(struct net_device *dev,
-			        struct iw_request_info *info,
-			        union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	if (!(priv->power_mode & IPW_POWER_ENABLED)) {
-		wrqu->power.disabled = 1;
-	} else {
-		wrqu->power.disabled = 0;
-		wrqu->power.flags = 0;
-	}
-
-	IPW_DEBUG_WX("GET Power Management Mode -> %02X\n", priv->power_mode);
-
-	return 0;
-}
-
-
-/*
- *
- * IWPRIV handlers
- *
- */
-#ifdef CONFIG_IPW2100_MONITOR
-static int ipw2100_wx_set_promisc(struct net_device *dev,
-				  struct iw_request_info *info,
-				  union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int *parms = (int *)extra;
-	int enable = (parms[0] > 0);
-	int err = 0;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	if (enable) {
-		if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
-			err = ipw2100_set_channel(priv, parms[1], 0);
-			goto done;
-		}
-		priv->channel = parms[1];
-		err = ipw2100_switch_mode(priv, IW_MODE_MONITOR);
-	} else {
-		if (priv->ieee->iw_mode == IW_MODE_MONITOR)
-			err = ipw2100_switch_mode(priv, priv->last_mode);
-	}
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_wx_reset(struct net_device *dev,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	if (priv->status & STATUS_INITIALIZED)
-		schedule_reset(priv);
-	return 0;
-}
-
-#endif
-
-static int ipw2100_wx_set_powermode(struct net_device *dev,
-				    struct iw_request_info *info,
-				    union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int err = 0, mode = *(int *)extra;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	if ((mode < 1) || (mode > POWER_MODES))
-		mode = IPW_POWER_AUTO;
-
-	if (priv->power_mode != mode)
-		err = ipw2100_set_power_mode(priv, mode);
- done:
-	up(&priv->action_sem);
-	return err;
-}
-
-#define MAX_POWER_STRING 80
-static int ipw2100_wx_get_powermode(struct net_device *dev,
-				    struct iw_request_info *info,
-				    union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int level = IPW_POWER_LEVEL(priv->power_mode);
-	s32 timeout, period;
-
-	if (!(priv->power_mode & IPW_POWER_ENABLED)) {
-		snprintf(extra, MAX_POWER_STRING,
-			 "Power save level: %d (Off)", level);
-	} else {
-		switch (level) {
-		case IPW_POWER_MODE_CAM:
-			snprintf(extra, MAX_POWER_STRING,
-				 "Power save level: %d (None)", level);
-			break;
-		case IPW_POWER_AUTO:
-		snprintf(extra, MAX_POWER_STRING,
-			 "Power save level: %d (Auto)", 0);
-			break;
-		default:
-			timeout = timeout_duration[level - 1] / 1000;
-			period = period_duration[level - 1] / 1000;
-			snprintf(extra, MAX_POWER_STRING,
-				 "Power save level: %d "
-				 "(Timeout %dms, Period %dms)",
-				 level, timeout, period);
-		}
-	}
-
-	wrqu->data.length = strlen(extra) + 1;
-
-	return 0;
-}
-
-
-static int ipw2100_wx_set_preamble(struct net_device *dev,
-				   struct iw_request_info *info,
-				   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	int err, mode = *(int *)extra;
-
-	down(&priv->action_sem);
-	if (!(priv->status & STATUS_INITIALIZED)) {
-		err = -EIO;
-		goto done;
-	}
-
-	if (mode == 1)
-		priv->config |= CFG_LONG_PREAMBLE;
-	else if (mode == 0)
-		priv->config &= ~CFG_LONG_PREAMBLE;
-	else {
-		err = -EINVAL;
-		goto done;
-	}
-
-	err = ipw2100_system_config(priv, 0);
-
-done:
-	up(&priv->action_sem);
-	return err;
-}
-
-static int ipw2100_wx_get_preamble(struct net_device *dev,
-				    struct iw_request_info *info,
-				    union iwreq_data *wrqu, char *extra)
-{
-	/*
-	 * This can be called at any time.  No action lock required
-	 */
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-
-	if (priv->config & CFG_LONG_PREAMBLE)
-		snprintf(wrqu->name, IFNAMSIZ, "long (1)");
-	else
-		snprintf(wrqu->name, IFNAMSIZ, "auto (0)");
-
-	return 0;
-}
-
-static iw_handler ipw2100_wx_handlers[] =
-{
-        NULL,                     /* SIOCSIWCOMMIT */
-        ipw2100_wx_get_name,      /* SIOCGIWNAME */
-        NULL,                     /* SIOCSIWNWID */
-        NULL,                     /* SIOCGIWNWID */
-        ipw2100_wx_set_freq,      /* SIOCSIWFREQ */
-        ipw2100_wx_get_freq,      /* SIOCGIWFREQ */
-        ipw2100_wx_set_mode,      /* SIOCSIWMODE */
-        ipw2100_wx_get_mode,      /* SIOCGIWMODE */
-        NULL,                     /* SIOCSIWSENS */
-        NULL,                     /* SIOCGIWSENS */
-        NULL,                     /* SIOCSIWRANGE */
-        ipw2100_wx_get_range,     /* SIOCGIWRANGE */
-        NULL,                     /* SIOCSIWPRIV */
-        NULL,                     /* SIOCGIWPRIV */
-        NULL,                     /* SIOCSIWSTATS */
-        NULL,                     /* SIOCGIWSTATS */
-        NULL,                     /* SIOCSIWSPY */
-        NULL,                     /* SIOCGIWSPY */
-        NULL,                     /* SIOCGIWTHRSPY */
-        NULL,                     /* SIOCWIWTHRSPY */
-        ipw2100_wx_set_wap,       /* SIOCSIWAP */
-        ipw2100_wx_get_wap,       /* SIOCGIWAP */
-        NULL,                     /* -- hole -- */
-        NULL,                     /* SIOCGIWAPLIST -- deprecated */
-        ipw2100_wx_set_scan,      /* SIOCSIWSCAN */
-        ipw2100_wx_get_scan,      /* SIOCGIWSCAN */
-        ipw2100_wx_set_essid,     /* SIOCSIWESSID */
-        ipw2100_wx_get_essid,     /* SIOCGIWESSID */
-        ipw2100_wx_set_nick,      /* SIOCSIWNICKN */
-        ipw2100_wx_get_nick,      /* SIOCGIWNICKN */
-        NULL,                     /* -- hole -- */
-        NULL,                     /* -- hole -- */
-        ipw2100_wx_set_rate,      /* SIOCSIWRATE */
-        ipw2100_wx_get_rate,      /* SIOCGIWRATE */
-        ipw2100_wx_set_rts,       /* SIOCSIWRTS */
-        ipw2100_wx_get_rts,       /* SIOCGIWRTS */
-        ipw2100_wx_set_frag,      /* SIOCSIWFRAG */
-        ipw2100_wx_get_frag,      /* SIOCGIWFRAG */
-        ipw2100_wx_set_txpow,     /* SIOCSIWTXPOW */
-        ipw2100_wx_get_txpow,     /* SIOCGIWTXPOW */
-        ipw2100_wx_set_retry,     /* SIOCSIWRETRY */
-        ipw2100_wx_get_retry,     /* SIOCGIWRETRY */
-        ipw2100_wx_set_encode,    /* SIOCSIWENCODE */
-        ipw2100_wx_get_encode,    /* SIOCGIWENCODE */
-        ipw2100_wx_set_power,     /* SIOCSIWPOWER */
-        ipw2100_wx_get_power,     /* SIOCGIWPOWER */
-};
-
-#define IPW2100_PRIV_SET_MONITOR	SIOCIWFIRSTPRIV
-#define IPW2100_PRIV_RESET		SIOCIWFIRSTPRIV+1
-#define IPW2100_PRIV_SET_POWER		SIOCIWFIRSTPRIV+2
-#define IPW2100_PRIV_GET_POWER		SIOCIWFIRSTPRIV+3
-#define IPW2100_PRIV_SET_LONGPREAMBLE	SIOCIWFIRSTPRIV+4
-#define IPW2100_PRIV_GET_LONGPREAMBLE	SIOCIWFIRSTPRIV+5
-
-static const struct iw_priv_args ipw2100_private_args[] = {
-
-#ifdef CONFIG_IPW2100_MONITOR
-	{
-		IPW2100_PRIV_SET_MONITOR,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "monitor"
-	},
-	{
-		IPW2100_PRIV_RESET,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "reset"
-	},
-#endif /* CONFIG_IPW2100_MONITOR */
-
-	{
-		IPW2100_PRIV_SET_POWER,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "set_power"
-	},
-	{
-		IPW2100_PRIV_GET_POWER,
-		0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_POWER_STRING, "get_power"
-	},
-	{
-		IPW2100_PRIV_SET_LONGPREAMBLE,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "set_preamble"
-	},
-	{
-		IPW2100_PRIV_GET_LONGPREAMBLE,
-		0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | IFNAMSIZ, "get_preamble"
-	},
-};
-
-static iw_handler ipw2100_private_handler[] = {
-#ifdef CONFIG_IPW2100_MONITOR
-	ipw2100_wx_set_promisc,
-	ipw2100_wx_reset,
-#else /* CONFIG_IPW2100_MONITOR */
-	NULL,
-	NULL,
-#endif /* CONFIG_IPW2100_MONITOR */
-	ipw2100_wx_set_powermode,
-	ipw2100_wx_get_powermode,
-	ipw2100_wx_set_preamble,
-	ipw2100_wx_get_preamble,
-};
-
-static struct iw_handler_def ipw2100_wx_handler_def =
-{
-	.standard = ipw2100_wx_handlers,
-	.num_standard = sizeof(ipw2100_wx_handlers) / sizeof(iw_handler),
-	.num_private = sizeof(ipw2100_private_handler) / sizeof(iw_handler),
- 	.num_private_args = sizeof(ipw2100_private_args) /
-	sizeof(struct iw_priv_args),
-	.private = (iw_handler *)ipw2100_private_handler,
-	.private_args = (struct iw_priv_args *)ipw2100_private_args,
-};
-
-/*
- * Get wireless statistics.
- * Called by /proc/net/wireless
- * Also called by SIOCGIWSTATS
- */
-static struct iw_statistics *ipw2100_wx_wireless_stats(struct net_device * dev)
-{
-	enum {
-		POOR = 30,
-		FAIR = 60,
-		GOOD = 80,
-		VERY_GOOD = 90,
-		EXCELLENT = 95,
-		PERFECT = 100
-	};
-	int rssi_qual;
-	int tx_qual;
-	int beacon_qual;
-
-	struct ipw2100_priv *priv = ieee80211_priv(dev);
-	struct iw_statistics *wstats;
-	u32 rssi, quality, tx_retries, missed_beacons, tx_failures;
-	u32 ord_len = sizeof(u32);
-
-	if (!priv)
-		return (struct iw_statistics *) NULL;
-
-	wstats = &priv->wstats;
-
-	/* if hw is disabled, then ipw2100_get_ordinal() can't be called.
-	 * ipw2100_wx_wireless_stats seems to be called before fw is
-	 * initialized.  STATUS_ASSOCIATED will only be set if the hw is up
-	 * and associated; if not associcated, the values are all meaningless
-	 * anyway, so set them all to NULL and INVALID */
-	if (!(priv->status & STATUS_ASSOCIATED)) {
-		wstats->miss.beacon = 0;
-		wstats->discard.retries = 0;
-		wstats->qual.qual = 0;
-		wstats->qual.level = 0;
-		wstats->qual.noise = 0;
-		wstats->qual.updated = 7;
-		wstats->qual.updated |= IW_QUAL_NOISE_INVALID |
-			IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_INVALID;
-		return wstats;
-	}
-
-	if (ipw2100_get_ordinal(priv, IPW_ORD_STAT_PERCENT_MISSED_BCNS,
-				&missed_beacons, &ord_len))
-		goto fail_get_ordinal;
-
-        /* If we don't have a connection the quality and level is 0*/
-	if (!(priv->status & STATUS_ASSOCIATED)) {
-		wstats->qual.qual = 0;
-		wstats->qual.level = 0;
-	} else {
-		if (ipw2100_get_ordinal(priv, IPW_ORD_RSSI_AVG_CURR,
-					&rssi, &ord_len))
-			goto fail_get_ordinal;
-		wstats->qual.level = rssi + IPW2100_RSSI_TO_DBM;
-		if (rssi < 10)
-			rssi_qual = rssi * POOR / 10;
-		else if (rssi < 15)
-			rssi_qual = (rssi - 10) * (FAIR - POOR) / 5 + POOR;
-		else if (rssi < 20)
-			rssi_qual = (rssi - 15) * (GOOD - FAIR) / 5 + FAIR;
-		else if (rssi < 30)
-			rssi_qual = (rssi - 20) * (VERY_GOOD - GOOD) /
-				10 + GOOD;
-		else
-			rssi_qual = (rssi - 30) * (PERFECT - VERY_GOOD) /
-				10 + VERY_GOOD;
-
-		if (ipw2100_get_ordinal(priv, IPW_ORD_STAT_PERCENT_RETRIES,
-					&tx_retries, &ord_len))
-			goto fail_get_ordinal;
-
-		if (tx_retries > 75)
-			tx_qual = (90 - tx_retries) * POOR / 15;
-		else if (tx_retries > 70)
-			tx_qual = (75 - tx_retries) * (FAIR - POOR) / 5 + POOR;
-		else if (tx_retries > 65)
-			tx_qual = (70 - tx_retries) * (GOOD - FAIR) / 5 + FAIR;
-		else if (tx_retries > 50)
-			tx_qual = (65 - tx_retries) * (VERY_GOOD - GOOD) /
-				15 + GOOD;
-		else
-			tx_qual = (50 - tx_retries) *
-				(PERFECT - VERY_GOOD) / 50 + VERY_GOOD;
-
-		if (missed_beacons > 50)
-			beacon_qual = (60 - missed_beacons) * POOR / 10;
-		else if (missed_beacons > 40)
-			beacon_qual = (50 - missed_beacons) * (FAIR - POOR) /
-				10 + POOR;
-		else if (missed_beacons > 32)
-			beacon_qual = (40 - missed_beacons) * (GOOD - FAIR) /
-				18 + FAIR;
-		else if (missed_beacons > 20)
-			beacon_qual = (32 - missed_beacons) *
-				(VERY_GOOD - GOOD) / 20 + GOOD;
-		else
-			beacon_qual = (20 - missed_beacons) *
-				(PERFECT - VERY_GOOD) / 20 + VERY_GOOD;
-
-		quality = min(beacon_qual, min(tx_qual, rssi_qual));
-
-#ifdef CONFIG_IPW_DEBUG
-		if (beacon_qual == quality)
-			IPW_DEBUG_WX("Quality clamped by Missed Beacons\n");
-		else if (tx_qual == quality)
-			IPW_DEBUG_WX("Quality clamped by Tx Retries\n");
-		else if (quality != 100)
-			IPW_DEBUG_WX("Quality clamped by Signal Strength\n");
-		else
-			IPW_DEBUG_WX("Quality not clamped.\n");
-#endif
-
-		wstats->qual.qual = quality;
-		wstats->qual.level = rssi + IPW2100_RSSI_TO_DBM;
-	}
-
-	wstats->qual.noise = 0;
-	wstats->qual.updated = 7;
-	wstats->qual.updated |= IW_QUAL_NOISE_INVALID;
-
-        /* FIXME: this is percent and not a # */
-	wstats->miss.beacon = missed_beacons;
-
-	if (ipw2100_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURES,
-				&tx_failures, &ord_len))
-		goto fail_get_ordinal;
-	wstats->discard.retries = tx_failures;
-
-	return wstats;
-
- fail_get_ordinal:
-	IPW_DEBUG_WX("failed querying ordinals.\n");
-
-	return (struct iw_statistics *) NULL;
-}
-
-static void ipw2100_wx_event_work(struct ipw2100_priv *priv)
-{
-	union iwreq_data wrqu;
-	int len = ETH_ALEN;
-
-	if (priv->status & STATUS_STOPPING)
-		return;
-
-	down(&priv->action_sem);
-
-	IPW_DEBUG_WX("enter\n");
-
-	up(&priv->action_sem);
-
-	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-
-	/* Fetch BSSID from the hardware */
-	if (!(priv->status & (STATUS_ASSOCIATING | STATUS_ASSOCIATED)) ||
-	    priv->status & STATUS_RF_KILL_MASK ||
-	    ipw2100_get_ordinal(priv, IPW_ORD_STAT_ASSN_AP_BSSID,
-				&priv->bssid,  &len)) {
-		memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
-	} else {
-		/* We now have the BSSID, so can finish setting to the full
-		 * associated state */
-		memcpy(wrqu.ap_addr.sa_data, priv->bssid, ETH_ALEN);
-		memcpy(&priv->ieee->bssid, priv->bssid, ETH_ALEN);
-		priv->status &= ~STATUS_ASSOCIATING;
-		priv->status |= STATUS_ASSOCIATED;
-		netif_carrier_on(priv->net_dev);
-		if (netif_queue_stopped(priv->net_dev)) {
-			IPW_DEBUG_INFO("Waking net queue.\n");
-			netif_wake_queue(priv->net_dev);
-		} else {
-			IPW_DEBUG_INFO("Starting net queue.\n");
-			netif_start_queue(priv->net_dev);
-		}
-	}
-
-	if (!(priv->status & STATUS_ASSOCIATED)) {
-		IPW_DEBUG_WX("Configuring ESSID\n");
-		down(&priv->action_sem);
-		/* This is a disassociation event, so kick the firmware to
-		 * look for another AP */
-		if (priv->config & CFG_STATIC_ESSID)
-			ipw2100_set_essid(priv, priv->essid, priv->essid_len, 0);
-		else
-			ipw2100_set_essid(priv, NULL, 0, 0);
-		up(&priv->action_sem);
-	}
-
-	wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
-}
-
-#define IPW2100_FW_MAJOR_VERSION 1
-#define IPW2100_FW_MINOR_VERSION 3
-
-#define IPW2100_FW_MINOR(x) ((x & 0xff) >> 8)
-#define IPW2100_FW_MAJOR(x) (x & 0xff)
-
-#define IPW2100_FW_VERSION ((IPW2100_FW_MINOR_VERSION << 8) | \
-                             IPW2100_FW_MAJOR_VERSION)
-
-#define IPW2100_FW_PREFIX "ipw2100-" __stringify(IPW2100_FW_MAJOR_VERSION) \
-"." __stringify(IPW2100_FW_MINOR_VERSION)
-
-#define IPW2100_FW_NAME(x) IPW2100_FW_PREFIX "" x ".fw"
-
-
-/*
-
-BINARY FIRMWARE HEADER FORMAT
-
-offset      length   desc
-0           2        version
-2           2        mode == 0:BSS,1:IBSS,2:MONITOR
-4           4        fw_len
-8           4        uc_len
-C           fw_len   firmware data
-12 + fw_len uc_len   microcode data
-
-*/
-
-struct ipw2100_fw_header {
-	short version;
-	short mode;
-	unsigned int fw_size;
-	unsigned int uc_size;
-} __attribute__ ((packed));
-
-
-
-static int ipw2100_mod_firmware_load(struct ipw2100_fw *fw)
-{
-	struct ipw2100_fw_header *h =
-		(struct ipw2100_fw_header *)fw->fw_entry->data;
-
-	if (IPW2100_FW_MAJOR(h->version) != IPW2100_FW_MAJOR_VERSION) {
-		printk(KERN_WARNING DRV_NAME ": Firmware image not compatible "
-		       "(detected version id of %u). "
-		       "See Documentation/networking/README.ipw2100\n",
-		       h->version);
-		return 1;
-	}
-
-	fw->version = h->version;
-	fw->fw.data = fw->fw_entry->data + sizeof(struct ipw2100_fw_header);
-	fw->fw.size = h->fw_size;
-	fw->uc.data = fw->fw.data + h->fw_size;
-	fw->uc.size = h->uc_size;
-
-	return 0;
-}
-
-
-static int ipw2100_get_firmware(struct ipw2100_priv *priv,
-				struct ipw2100_fw *fw)
-{
-	char *fw_name;
-	int rc;
-
-	IPW_DEBUG_INFO("%s: Using hotplug firmware load.\n",
-	       priv->net_dev->name);
-
-	switch (priv->ieee->iw_mode) {
-	case IW_MODE_ADHOC:
-		fw_name = IPW2100_FW_NAME("-i");
-		break;
-#ifdef CONFIG_IPW2100_MONITOR
-	case IW_MODE_MONITOR:
-		fw_name = IPW2100_FW_NAME("-p");
-		break;
-#endif
-	case IW_MODE_INFRA:
-	default:
-		fw_name = IPW2100_FW_NAME("");
-		break;
-	}
-
-	rc = request_firmware(&fw->fw_entry, fw_name, &priv->pci_dev->dev);
-
-	if (rc < 0) {
-		printk(KERN_ERR DRV_NAME ": "
-		       "%s: Firmware '%s' not available or load failed.\n",
-		       priv->net_dev->name, fw_name);
-		return rc;
-	}
-	IPW_DEBUG_INFO("firmware data %p size %zd\n", fw->fw_entry->data,
-			   fw->fw_entry->size);
-
-	ipw2100_mod_firmware_load(fw);
-
-	return 0;
-}
-
-static void ipw2100_release_firmware(struct ipw2100_priv *priv,
-				     struct ipw2100_fw *fw)
-{
-	fw->version = 0;
-	if (fw->fw_entry)
-		release_firmware(fw->fw_entry);
-	fw->fw_entry = NULL;
-}
-
-
-static int ipw2100_get_fwversion(struct ipw2100_priv *priv, char *buf,
-				 size_t max)
-{
-	char ver[MAX_FW_VERSION_LEN];
-	u32 len = MAX_FW_VERSION_LEN;
-	u32 tmp;
-	int i;
-	/* firmware version is an ascii string (max len of 14) */
-	if (ipw2100_get_ordinal(priv, IPW_ORD_STAT_FW_VER_NUM,
-				ver, &len))
-		return -EIO;
-	tmp = max;
-	if (len >= max)
-		len = max - 1;
-	for (i = 0; i < len; i++)
-		buf[i] = ver[i];
-	buf[i] = '\0';
-	return tmp;
-}
-
-static int ipw2100_get_ucodeversion(struct ipw2100_priv *priv, char *buf,
-				    size_t max)
-{
-	u32 ver;
-	u32 len = sizeof(ver);
-	/* microcode version is a 32 bit integer */
-	if (ipw2100_get_ordinal(priv, IPW_ORD_UCODE_VERSION,
-				&ver, &len))
-		return -EIO;
-	return snprintf(buf, max, "%08X", ver);
-}
-
-/*
- * On exit, the firmware will have been freed from the fw list
- */
-static int ipw2100_fw_download(struct ipw2100_priv *priv,
-			       struct ipw2100_fw *fw)
-{
-	/* firmware is constructed of N contiguous entries, each entry is
-	 * structured as:
-	 *
-	 * offset    sie         desc
-	 * 0         4           address to write to
-	 * 4         2           length of data run
-         * 6         length      data
-	 */
-	unsigned int addr;
-	unsigned short len;
-
-	const unsigned char *firmware_data = fw->fw.data;
-	unsigned int firmware_data_left = fw->fw.size;
-
-	while (firmware_data_left > 0) {
-	   	addr = *(u32 *)(firmware_data);
-		firmware_data      += 4;
-		firmware_data_left -= 4;
-
-	   	len = *(u16 *)(firmware_data);
-		firmware_data      += 2;
-		firmware_data_left -= 2;
-
-		if (len > 32) {
-			printk(KERN_ERR DRV_NAME ": "
-			       "Invalid firmware run-length of %d bytes\n",
-			       len);
-			return -EINVAL;
-		}
-
-		write_nic_memory(priv->net_dev, addr, len, firmware_data);
-		firmware_data      += len;
-		firmware_data_left -= len;
-	}
-
-	return 0;
-}
-
-struct symbol_alive_response {
-	u8 cmd_id;
-	u8 seq_num;
-	u8 ucode_rev;
-	u8 eeprom_valid;
-	u16 valid_flags;
-	u8 IEEE_addr[6];
-	u16 flags;
-	u16 pcb_rev;
-	u16 clock_settle_time;	// 1us LSB
-	u16 powerup_settle_time;	// 1us LSB
-	u16 hop_settle_time;	// 1us LSB
-	u8 date[3];		// month, day, year
-	u8 time[2];		// hours, minutes
-	u8 ucode_valid;
-};
-
-static int ipw2100_ucode_download(struct ipw2100_priv *priv,
-				  struct ipw2100_fw *fw)
-{
-	struct net_device *dev = priv->net_dev;
-	const unsigned char *microcode_data = fw->uc.data;
-	unsigned int microcode_data_left = fw->uc.size;
-
-	struct symbol_alive_response response;
-	int i, j;
-	u8 data;
-
-	/* Symbol control */
-	write_nic_word(dev, IPW2100_CONTROL_REG, 0x703);
-	readl((void *)(dev->base_addr));
-	write_nic_word(dev, IPW2100_CONTROL_REG, 0x707);
-	readl((void *)(dev->base_addr));
-
-	/* HW config */
-	write_nic_byte(dev, 0x210014, 0x72);	/* fifo width =16 */
-	readl((void *)(dev->base_addr));
-	write_nic_byte(dev, 0x210014, 0x72);	/* fifo width =16 */
-	readl((void *)(dev->base_addr));
-
-	/* EN_CS_ACCESS bit to reset control store pointer */
-	write_nic_byte(dev, 0x210000, 0x40);
-	readl((void *)(dev->base_addr));
-	write_nic_byte(dev, 0x210000, 0x0);
-	readl((void *)(dev->base_addr));
-	write_nic_byte(dev, 0x210000, 0x40);
-	readl((void *)(dev->base_addr));
-
-	/* copy microcode from buffer into Symbol */
-
-	while (microcode_data_left > 0) {
-		write_nic_byte(dev, 0x210010, *microcode_data++);
-		write_nic_byte(dev, 0x210010, *microcode_data++);
-		microcode_data_left -= 2;
-	}
-
-	/* EN_CS_ACCESS bit to reset the control store pointer */
-	write_nic_byte(dev, 0x210000, 0x0);
-	readl((void *)(dev->base_addr));
-
-	/* Enable System (Reg 0)
-	 * first enable causes garbage in RX FIFO */
-	write_nic_byte(dev, 0x210000, 0x0);
-	readl((void *)(dev->base_addr));
-	write_nic_byte(dev, 0x210000, 0x80);
-	readl((void *)(dev->base_addr));
-
-	/* Reset External Baseband Reg */
-	write_nic_word(dev, IPW2100_CONTROL_REG, 0x703);
-	readl((void *)(dev->base_addr));
-	write_nic_word(dev, IPW2100_CONTROL_REG, 0x707);
-	readl((void *)(dev->base_addr));
-
-	/* HW Config (Reg 5) */
-	write_nic_byte(dev, 0x210014, 0x72);	// fifo width =16
-	readl((void *)(dev->base_addr));
-	write_nic_byte(dev, 0x210014, 0x72);	// fifo width =16
-	readl((void *)(dev->base_addr));
-
-	/* Enable System (Reg 0)
-	 * second enable should be OK */
-	write_nic_byte(dev, 0x210000, 0x00);	// clear enable system
-	readl((void *)(dev->base_addr));
-	write_nic_byte(dev, 0x210000, 0x80);	// set enable system
-
-	/* check Symbol is enabled - upped this from 5 as it wasn't always
-	 * catching the update */
-	for (i = 0; i < 10; i++) {
-		udelay(10);
-
-		/* check Dino is enabled bit */
-		read_nic_byte(dev, 0x210000, &data);
-		if (data & 0x1)
-			break;
-	}
-
-	if (i == 10) {
-		printk(KERN_ERR DRV_NAME ": %s: Error initializing Symbol\n",
-		       dev->name);
-		return -EIO;
-	}
-
-	/* Get Symbol alive response */
-	for (i = 0; i < 30; i++) {
-		/* Read alive response structure */
-		for (j = 0;
-		     j < (sizeof(struct symbol_alive_response) >> 1);
-		     j++)
-			read_nic_word(dev, 0x210004,
-				      ((u16 *)&response) + j);
-
-		if ((response.cmd_id == 1) &&
-		    (response.ucode_valid == 0x1))
-			break;
-		udelay(10);
-	}
-
-	if (i == 30) {
-		printk(KERN_ERR DRV_NAME ": %s: No response from Symbol - hw not alive\n",
-		       dev->name);
-		printk_buf(IPW_DL_ERROR, (u8*)&response, sizeof(response));
-		return -EIO;
-	}
-
-	return 0;
-}
diff --git a/trunk/drivers/net/wireless/ipw2100.h b/trunk/drivers/net/wireless/ipw2100.h
deleted file mode 100644
index 2a3cdbd50168..000000000000
--- a/trunk/drivers/net/wireless/ipw2100.h
+++ /dev/null
@@ -1,1167 +0,0 @@
-/******************************************************************************
-
-  Copyright(c) 2003 - 2005 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-******************************************************************************/
-#ifndef _IPW2100_H
-#define _IPW2100_H
-
-#include <linux/sched.h>
-#include <linux/interrupt.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/list.h>
-#include <linux/delay.h>
-#include <linux/skbuff.h>
-#include <asm/io.h>
-#include <linux/socket.h>
-#include <linux/if_arp.h>
-#include <linux/wireless.h>
-#include <linux/version.h>
-#include <net/iw_handler.h>	// new driver API
-
-#include <net/ieee80211.h>
-
-#include <linux/workqueue.h>
-
-struct ipw2100_priv;
-struct ipw2100_tx_packet;
-struct ipw2100_rx_packet;
-
-#define IPW_DL_UNINIT    0x80000000
-#define IPW_DL_NONE      0x00000000
-#define IPW_DL_ALL       0x7FFFFFFF
-
-/*
- * To use the debug system;
- *
- * If you are defining a new debug classification, simply add it to the #define
- * list here in the form of:
- *
- * #define IPW_DL_xxxx VALUE
- *
- * shifting value to the left one bit from the previous entry.  xxxx should be
- * the name of the classification (for example, WEP)
- *
- * You then need to either add a IPW2100_xxxx_DEBUG() macro definition for your
- * classification, or use IPW_DEBUG(IPW_DL_xxxx, ...) whenever you want
- * to send output to that classification.
- *
- * To add your debug level to the list of levels seen when you perform
- *
- * % cat /proc/net/ipw2100/debug_level
- *
- * you simply need to add your entry to the ipw2100_debug_levels array.
- *
- * If you do not see debug_level in /proc/net/ipw2100 then you do not have
- * CONFIG_IPW_DEBUG defined in your kernel configuration
- *
- */
-
-#define IPW_DL_ERROR         (1<<0)
-#define IPW_DL_WARNING       (1<<1)
-#define IPW_DL_INFO          (1<<2)
-#define IPW_DL_WX            (1<<3)
-#define IPW_DL_HC            (1<<5)
-#define IPW_DL_STATE         (1<<6)
-
-#define IPW_DL_NOTIF         (1<<10)
-#define IPW_DL_SCAN          (1<<11)
-#define IPW_DL_ASSOC         (1<<12)
-#define IPW_DL_DROP          (1<<13)
-
-#define IPW_DL_IOCTL         (1<<14)
-#define IPW_DL_RF_KILL       (1<<17)
-
-
-#define IPW_DL_MANAGE        (1<<15)
-#define IPW_DL_FW            (1<<16)
-
-#define IPW_DL_FRAG          (1<<21)
-#define IPW_DL_WEP           (1<<22)
-#define IPW_DL_TX            (1<<23)
-#define IPW_DL_RX            (1<<24)
-#define IPW_DL_ISR           (1<<25)
-#define IPW_DL_IO            (1<<26)
-#define IPW_DL_TRACE         (1<<28)
-
-#define IPW_DEBUG_ERROR(f, a...) printk(KERN_ERR DRV_NAME ": " f, ## a)
-#define IPW_DEBUG_WARNING(f, a...) printk(KERN_WARNING DRV_NAME ": " f, ## a)
-#define IPW_DEBUG_INFO(f...)    IPW_DEBUG(IPW_DL_INFO, ## f)
-#define IPW_DEBUG_WX(f...)     IPW_DEBUG(IPW_DL_WX, ## f)
-#define IPW_DEBUG_SCAN(f...)   IPW_DEBUG(IPW_DL_SCAN, ## f)
-#define IPW_DEBUG_NOTIF(f...) IPW_DEBUG(IPW_DL_NOTIF, ## f)
-#define IPW_DEBUG_TRACE(f...)  IPW_DEBUG(IPW_DL_TRACE, ## f)
-#define IPW_DEBUG_RX(f...)     IPW_DEBUG(IPW_DL_RX, ## f)
-#define IPW_DEBUG_TX(f...)     IPW_DEBUG(IPW_DL_TX, ## f)
-#define IPW_DEBUG_ISR(f...)    IPW_DEBUG(IPW_DL_ISR, ## f)
-#define IPW_DEBUG_MANAGEMENT(f...) IPW_DEBUG(IPW_DL_MANAGE, ## f)
-#define IPW_DEBUG_WEP(f...)    IPW_DEBUG(IPW_DL_WEP, ## f)
-#define IPW_DEBUG_HC(f...) IPW_DEBUG(IPW_DL_HC, ## f)
-#define IPW_DEBUG_FRAG(f...) IPW_DEBUG(IPW_DL_FRAG, ## f)
-#define IPW_DEBUG_FW(f...) IPW_DEBUG(IPW_DL_FW, ## f)
-#define IPW_DEBUG_RF_KILL(f...) IPW_DEBUG(IPW_DL_RF_KILL, ## f)
-#define IPW_DEBUG_DROP(f...) IPW_DEBUG(IPW_DL_DROP, ## f)
-#define IPW_DEBUG_IO(f...) IPW_DEBUG(IPW_DL_IO, ## f)
-#define IPW_DEBUG_IOCTL(f...) IPW_DEBUG(IPW_DL_IOCTL, ## f)
-#define IPW_DEBUG_STATE(f, a...) IPW_DEBUG(IPW_DL_STATE | IPW_DL_ASSOC | IPW_DL_INFO, f, ## a)
-#define IPW_DEBUG_ASSOC(f, a...) IPW_DEBUG(IPW_DL_ASSOC | IPW_DL_INFO, f, ## a)
-
-enum {
-	IPW_HW_STATE_DISABLED = 1,
-	IPW_HW_STATE_ENABLED = 0
-};
-
-struct ssid_context {
-	char ssid[IW_ESSID_MAX_SIZE + 1];
-	int ssid_len;
-	unsigned char bssid[ETH_ALEN];
-	int port_type;
-	int channel;
-
-};
-
-extern const char *port_type_str[];
-extern const char *band_str[];
-
-#define NUMBER_OF_BD_PER_COMMAND_PACKET		1
-#define NUMBER_OF_BD_PER_DATA_PACKET		2
-
-#define IPW_MAX_BDS 6
-#define NUMBER_OF_OVERHEAD_BDS_PER_PACKETR	2
-#define NUMBER_OF_BDS_TO_LEAVE_FOR_COMMANDS	1
-
-#define REQUIRED_SPACE_IN_RING_FOR_COMMAND_PACKET \
-    (IPW_BD_QUEUE_W_R_MIN_SPARE + NUMBER_OF_BD_PER_COMMAND_PACKET)
-
-struct bd_status {
-	union {
-		struct { u8 nlf:1, txType:2, intEnabled:1, reserved:4;} fields;
-		u8 field;
-	} info;
-} __attribute__ ((packed));
-
-struct ipw2100_bd {
-	u32 host_addr;
-	u32 buf_length;
-	struct bd_status status;
-        /* number of fragments for frame (should be set only for
-	 * 1st TBD) */
-	u8 num_fragments;
-	u8 reserved[6];
-} __attribute__ ((packed));
-
-#define IPW_BD_QUEUE_LENGTH(n) (1<<n)
-#define IPW_BD_ALIGNMENT(L)    (L*sizeof(struct ipw2100_bd))
-
-#define IPW_BD_STATUS_TX_FRAME_802_3             0x00
-#define IPW_BD_STATUS_TX_FRAME_NOT_LAST_FRAGMENT 0x01
-#define IPW_BD_STATUS_TX_FRAME_COMMAND		 0x02
-#define IPW_BD_STATUS_TX_FRAME_802_11	         0x04
-#define IPW_BD_STATUS_TX_INTERRUPT_ENABLE	 0x08
-
-struct ipw2100_bd_queue {
-	/* driver (virtual) pointer to queue */
-	struct ipw2100_bd *drv;
-
-	/* firmware (physical) pointer to queue */
-	dma_addr_t nic;
-
-	/* Length of phy memory allocated for BDs */
-	u32 size;
-
-	/* Number of BDs in queue (and in array) */
-	u32 entries;
-
-	/* Number of available BDs (invalid for NIC BDs) */
-	u32 available;
-
-	/* Offset of oldest used BD in array (next one to
-	 * check for completion) */
-	u32 oldest;
-
-	/* Offset of next available (unused) BD */
-	u32 next;
-};
-
-#define RX_QUEUE_LENGTH 256
-#define TX_QUEUE_LENGTH 256
-#define HW_QUEUE_LENGTH 256
-
-#define TX_PENDED_QUEUE_LENGTH (TX_QUEUE_LENGTH / NUMBER_OF_BD_PER_DATA_PACKET)
-
-#define STATUS_TYPE_MASK	0x0000000f
-#define COMMAND_STATUS_VAL	0
-#define STATUS_CHANGE_VAL	1
-#define P80211_DATA_VAL 	2
-#define P8023_DATA_VAL		3
-#define HOST_NOTIFICATION_VAL	4
-
-#define IPW2100_RSSI_TO_DBM (-98)
-
-struct ipw2100_status {
-	u32 frame_size;
-	u16 status_fields;
-	u8 flags;
-#define IPW_STATUS_FLAG_DECRYPTED	(1<<0)
-#define IPW_STATUS_FLAG_WEP_ENCRYPTED	(1<<1)
-#define IPW_STATUS_FLAG_CRC_ERROR       (1<<2)
-	u8 rssi;
-} __attribute__ ((packed));
-
-struct ipw2100_status_queue {
-	/* driver (virtual) pointer to queue */
-	struct ipw2100_status *drv;
-
-	/* firmware (physical) pointer to queue */
-	dma_addr_t nic;
-
-	/* Length of phy memory allocated for BDs */
-	u32 size;
-};
-
-#define HOST_COMMAND_PARAMS_REG_LEN	100
-#define CMD_STATUS_PARAMS_REG_LEN 	3
-
-#define IPW_WPA_CAPABILITIES   0x1
-#define IPW_WPA_LISTENINTERVAL 0x2
-#define IPW_WPA_AP_ADDRESS     0x4
-
-#define IPW_MAX_VAR_IE_LEN ((HOST_COMMAND_PARAMS_REG_LEN - 4) * sizeof(u32))
-
-struct ipw2100_wpa_assoc_frame {
-	u16 fixed_ie_mask;
-	struct {
-		u16 capab_info;
-		u16 listen_interval;
-		u8 current_ap[ETH_ALEN];
-	} fixed_ies;
-	u32 var_ie_len;
-	u8 var_ie[IPW_MAX_VAR_IE_LEN];
-};
-
-#define IPW_BSS     1
-#define IPW_MONITOR 2
-#define IPW_IBSS    3
-
-/**
- * @struct _tx_cmd - HWCommand
- * @brief H/W command structure.
- */
-struct ipw2100_cmd_header {
-	u32 host_command_reg;
-	u32 host_command_reg1;
-	u32 sequence;
-	u32 host_command_len_reg;
-	u32 host_command_params_reg[HOST_COMMAND_PARAMS_REG_LEN];
-	u32 cmd_status_reg;
-	u32 cmd_status_params_reg[CMD_STATUS_PARAMS_REG_LEN];
-	u32 rxq_base_ptr;
-	u32 rxq_next_ptr;
-	u32 rxq_host_ptr;
-	u32 txq_base_ptr;
-	u32 txq_next_ptr;
-	u32 txq_host_ptr;
-	u32 tx_status_reg;
-	u32 reserved;
-	u32 status_change_reg;
-	u32 reserved1[3];
-	u32 *ordinal1_ptr;
-	u32 *ordinal2_ptr;
-} __attribute__ ((packed));
-
-struct ipw2100_data_header {
-	u32 host_command_reg;
-	u32 host_command_reg1;
-	u8 encrypted;	// BOOLEAN in win! TRUE if frame is enc by driver
-	u8 needs_encryption;	// BOOLEAN in win! TRUE if frma need to be enc in NIC
-	u8 wep_index;		// 0 no key, 1-4 key index, 0xff immediate key
-	u8 key_size;	// 0 no imm key, 0x5 64bit encr, 0xd 128bit encr, 0x10 128bit encr and 128bit IV
-	u8 key[16];
-	u8 reserved[10];	// f/w reserved
-	u8 src_addr[ETH_ALEN];
-	u8 dst_addr[ETH_ALEN];
-	u16 fragment_size;
-} __attribute__ ((packed));
-
-/* Host command data structure */
-struct host_command {
-	u32 host_command;		// COMMAND ID
-	u32 host_command1;		// COMMAND ID
-	u32 host_command_sequence;	// UNIQUE COMMAND NUMBER (ID)
-	u32 host_command_length;	// LENGTH
-	u32 host_command_parameters[HOST_COMMAND_PARAMS_REG_LEN];	// COMMAND PARAMETERS
-} __attribute__ ((packed));
-
-
-typedef enum {
-	POWER_ON_RESET,
-	EXIT_POWER_DOWN_RESET,
-	SW_RESET,
-	EEPROM_RW,
-	SW_RE_INIT
-} ipw2100_reset_event;
-
-enum {
-	COMMAND = 0xCAFE,
-	DATA,
-	RX
-};
-
-
-struct ipw2100_tx_packet {
-	int type;
-	int index;
-	union {
-		struct { /* COMMAND */
-			struct ipw2100_cmd_header* cmd;
-			dma_addr_t cmd_phys;
-		} c_struct;
-		struct { /* DATA */
-			struct ipw2100_data_header* data;
-			dma_addr_t data_phys;
-			struct ieee80211_txb *txb;
-		} d_struct;
-	} info;
-	int jiffy_start;
-
-	struct list_head list;
-};
-
-
-struct ipw2100_rx_packet {
-	struct ipw2100_rx *rxp;
-	dma_addr_t dma_addr;
-	int jiffy_start;
-	struct sk_buff *skb;
-	struct list_head list;
-};
-
-#define FRAG_DISABLED             (1<<31)
-#define RTS_DISABLED              (1<<31)
-#define MAX_RTS_THRESHOLD         2304U
-#define MIN_RTS_THRESHOLD         1U
-#define DEFAULT_RTS_THRESHOLD     1000U
-
-#define DEFAULT_BEACON_INTERVAL   100U
-#define	DEFAULT_SHORT_RETRY_LIMIT 7U
-#define	DEFAULT_LONG_RETRY_LIMIT  4U
-
-struct ipw2100_ordinals {
-	u32 table1_addr;
-	u32 table2_addr;
-	u32 table1_size;
-	u32 table2_size;
-};
-
-/* Host Notification header */
-struct ipw2100_notification {
-	u32 hnhdr_subtype;	/* type of host notification */
-	u32 hnhdr_size;		/* size in bytes of data
-				   or number of entries, if table.
-				   Does NOT include header */
-} __attribute__ ((packed));
-
-#define MAX_KEY_SIZE	16
-#define	MAX_KEYS	8
-
-#define IPW2100_WEP_ENABLE     (1<<1)
-#define IPW2100_WEP_DROP_CLEAR (1<<2)
-
-#define IPW_NONE_CIPHER   (1<<0)
-#define IPW_WEP40_CIPHER  (1<<1)
-#define IPW_TKIP_CIPHER   (1<<2)
-#define IPW_CCMP_CIPHER   (1<<4)
-#define IPW_WEP104_CIPHER (1<<5)
-#define IPW_CKIP_CIPHER   (1<<6)
-
-#define	IPW_AUTH_OPEN     0
-#define	IPW_AUTH_SHARED   1
-
-struct statistic {
-	int value;
-	int hi;
-	int lo;
-};
-
-#define INIT_STAT(x) do {  \
-  (x)->value = (x)->hi = 0; \
-  (x)->lo = 0x7fffffff; \
-} while (0)
-#define SET_STAT(x,y) do { \
-  (x)->value = y; \
-  if ((x)->value > (x)->hi) (x)->hi = (x)->value; \
-  if ((x)->value < (x)->lo) (x)->lo = (x)->value; \
-} while (0)
-#define INC_STAT(x) do { if (++(x)->value > (x)->hi) (x)->hi = (x)->value; } \
-while (0)
-#define DEC_STAT(x) do { if (--(x)->value < (x)->lo) (x)->lo = (x)->value; } \
-while (0)
-
-#define IPW2100_ERROR_QUEUE 5
-
-/* Power management code: enable or disable? */
-enum {
-#ifdef CONFIG_PM
-	IPW2100_PM_DISABLED = 0,
-	PM_STATE_SIZE = 16,
-#else
-	IPW2100_PM_DISABLED = 1,
-	PM_STATE_SIZE = 0,
-#endif
-};
-
-#define STATUS_POWERED          (1<<0)
-#define STATUS_CMD_ACTIVE       (1<<1)  /**< host command in progress */
-#define STATUS_RUNNING          (1<<2)  /* Card initialized, but not enabled */
-#define STATUS_ENABLED          (1<<3)  /* Card enabled -- can scan,Tx,Rx */
-#define STATUS_STOPPING         (1<<4)  /* Card is in shutdown phase */
-#define STATUS_INITIALIZED      (1<<5)  /* Card is ready for external calls */
-#define STATUS_ASSOCIATING      (1<<9)  /* Associated, but no BSSID yet */
-#define STATUS_ASSOCIATED       (1<<10) /* Associated and BSSID valid */
-#define STATUS_INT_ENABLED      (1<<11)
-#define STATUS_RF_KILL_HW       (1<<12)
-#define STATUS_RF_KILL_SW       (1<<13)
-#define STATUS_RF_KILL_MASK     (STATUS_RF_KILL_HW | STATUS_RF_KILL_SW)
-#define STATUS_EXIT_PENDING     (1<<14)
-
-#define STATUS_SCAN_PENDING     (1<<23)
-#define STATUS_SCANNING         (1<<24)
-#define STATUS_SCAN_ABORTING    (1<<25)
-#define STATUS_SCAN_COMPLETE    (1<<26)
-#define STATUS_WX_EVENT_PENDING (1<<27)
-#define STATUS_RESET_PENDING    (1<<29)
-#define STATUS_SECURITY_UPDATED (1<<30) /* Security sync needed */
-
-
-
-/* Internal NIC states */
-#define IPW_STATE_INITIALIZED	(1<<0)
-#define IPW_STATE_COUNTRY_FOUND	(1<<1)
-#define IPW_STATE_ASSOCIATED    (1<<2)
-#define IPW_STATE_ASSN_LOST	(1<<3)
-#define IPW_STATE_ASSN_CHANGED 	(1<<4)
-#define IPW_STATE_SCAN_COMPLETE	(1<<5)
-#define IPW_STATE_ENTERED_PSP 	(1<<6)
-#define IPW_STATE_LEFT_PSP 	(1<<7)
-#define IPW_STATE_RF_KILL       (1<<8)
-#define IPW_STATE_DISABLED	(1<<9)
-#define IPW_STATE_POWER_DOWN	(1<<10)
-#define IPW_STATE_SCANNING      (1<<11)
-
-
-
-#define CFG_STATIC_CHANNEL      (1<<0) /* Restrict assoc. to single channel */
-#define CFG_STATIC_ESSID        (1<<1) /* Restrict assoc. to single SSID */
-#define CFG_STATIC_BSSID        (1<<2) /* Restrict assoc. to single BSSID */
-#define CFG_CUSTOM_MAC          (1<<3)
-#define CFG_LONG_PREAMBLE       (1<<4)
-#define CFG_ASSOCIATE           (1<<6)
-#define CFG_FIXED_RATE          (1<<7)
-#define CFG_ADHOC_CREATE        (1<<8)
-#define CFG_C3_DISABLED         (1<<9)
-#define CFG_PASSIVE_SCAN        (1<<10)
-
-#define CAP_SHARED_KEY          (1<<0) /* Off = OPEN */
-#define CAP_PRIVACY_ON          (1<<1) /* Off = No privacy */
-
-struct ipw2100_priv {
-
-	int stop_hang_check; /* Set 1 when shutting down to kill hang_check */
-	int stop_rf_kill; /* Set 1 when shutting down to kill rf_kill */
-
-	struct ieee80211_device *ieee;
-	unsigned long status;
-	unsigned long config;
-	unsigned long capability;
-
-	/* Statistics */
-	int resets;
-	int reset_backoff;
-
-	/* Context */
-	u8 essid[IW_ESSID_MAX_SIZE];
-	u8 essid_len;
-	u8 bssid[ETH_ALEN];
-	u8 channel;
-	int last_mode;
-	int cstate_limit;
-
-	unsigned long connect_start;
-	unsigned long last_reset;
-
-	u32 channel_mask;
-	u32 fatal_error;
-	u32 fatal_errors[IPW2100_ERROR_QUEUE];
-	u32 fatal_index;
-	int eeprom_version;
-	int firmware_version;
-	unsigned long hw_features;
-	int hangs;
-	u32 last_rtc;
-	int dump_raw; /* 1 to dump raw bytes in /sys/.../memory */
-	u8* snapshot[0x30];
-
-	u8 mandatory_bssid_mac[ETH_ALEN];
-	u8 mac_addr[ETH_ALEN];
-
-	int power_mode;
-
-	/* WEP data */
-	struct ieee80211_security sec;
-	int messages_sent;
-
-
-	int short_retry_limit;
-	int long_retry_limit;
-
-	u32 rts_threshold;
-	u32 frag_threshold;
-
-	int in_isr;
-
-	u32 tx_rates;
-	int tx_power;
-	u32 beacon_interval;
-
-	char nick[IW_ESSID_MAX_SIZE + 1];
-
-	struct ipw2100_status_queue status_queue;
-
-	struct statistic txq_stat;
-	struct statistic rxq_stat;
-	struct ipw2100_bd_queue rx_queue;
-	struct ipw2100_bd_queue tx_queue;
-	struct ipw2100_rx_packet *rx_buffers;
-
-	struct statistic fw_pend_stat;
-	struct list_head fw_pend_list;
-
-	struct statistic msg_free_stat;
-	struct statistic msg_pend_stat;
-	struct list_head msg_free_list;
-	struct list_head msg_pend_list;
-	struct ipw2100_tx_packet *msg_buffers;
-
-	struct statistic tx_free_stat;
-	struct statistic tx_pend_stat;
-	struct list_head tx_free_list;
-	struct list_head tx_pend_list;
-	struct ipw2100_tx_packet *tx_buffers;
-
-	struct ipw2100_ordinals ordinals;
-
-	struct pci_dev *pci_dev;
-
-	struct proc_dir_entry *dir_dev;
-
-	struct net_device *net_dev;
-	struct iw_statistics wstats;
-
-	struct tasklet_struct irq_tasklet;
-
-	struct workqueue_struct *workqueue;
-	struct work_struct reset_work;
-	struct work_struct security_work;
-	struct work_struct wx_event_work;
-	struct work_struct hang_check;
-	struct work_struct rf_kill;
-
-	u32 interrupts;
-	int tx_interrupts;
-	int rx_interrupts;
-	int inta_other;
-
-	spinlock_t low_lock;
-	struct semaphore action_sem;
-	struct semaphore adapter_sem;
-
-	wait_queue_head_t wait_command_queue;
-};
-
-
-/*********************************************************
- * Host Command -> From Driver to FW
- *********************************************************/
-
-/**
- * Host command identifiers
- */
-#define HOST_COMPLETE           2
-#define SYSTEM_CONFIG           6
-#define SSID                    8
-#define MANDATORY_BSSID         9
-#define AUTHENTICATION_TYPE    10
-#define ADAPTER_ADDRESS        11
-#define PORT_TYPE              12
-#define INTERNATIONAL_MODE     13
-#define CHANNEL                14
-#define RTS_THRESHOLD          15
-#define FRAG_THRESHOLD         16
-#define POWER_MODE             17
-#define TX_RATES               18
-#define BASIC_TX_RATES         19
-#define WEP_KEY_INFO           20
-#define WEP_KEY_INDEX          25
-#define WEP_FLAGS              26
-#define ADD_MULTICAST          27
-#define CLEAR_ALL_MULTICAST    28
-#define BEACON_INTERVAL        29
-#define ATIM_WINDOW            30
-#define CLEAR_STATISTICS       31
-#define SEND		       33
-#define TX_POWER_INDEX         36
-#define BROADCAST_SCAN         43
-#define CARD_DISABLE           44
-#define PREFERRED_BSSID        45
-#define SET_SCAN_OPTIONS       46
-#define SCAN_DWELL_TIME        47
-#define SWEEP_TABLE            48
-#define AP_OR_STATION_TABLE    49
-#define GROUP_ORDINALS         50
-#define SHORT_RETRY_LIMIT      51
-#define LONG_RETRY_LIMIT       52
-
-#define HOST_PRE_POWER_DOWN    58
-#define CARD_DISABLE_PHY_OFF   61
-#define MSDU_TX_RATES          62
-
-
-/* Rogue AP Detection */
-#define SET_STATION_STAT_BITS      64
-#define CLEAR_STATIONS_STAT_BITS   65
-#define LEAP_ROGUE_MODE            66	//TODO tbw replaced by CFG_LEAP_ROGUE_AP
-#define SET_SECURITY_INFORMATION   67
-#define DISASSOCIATION_BSSID	   68
-#define SET_WPA_IE                 69
-
-
-
-/* system configuration bit mask: */
-#define IPW_CFG_MONITOR               0x00004
-#define IPW_CFG_PREAMBLE_AUTO        0x00010
-#define IPW_CFG_IBSS_AUTO_START     0x00020
-#define IPW_CFG_LOOPBACK            0x00100
-#define IPW_CFG_ANSWER_BCSSID_PROBE 0x00800
-#define IPW_CFG_BT_SIDEBAND_SIGNAL	0x02000
-#define IPW_CFG_802_1x_ENABLE       0x04000
-#define IPW_CFG_BSS_MASK		0x08000
-#define IPW_CFG_IBSS_MASK		0x10000
-
-#define IPW_SCAN_NOASSOCIATE (1<<0)
-#define IPW_SCAN_MIXED_CELL (1<<1)
-/* RESERVED (1<<2) */
-#define IPW_SCAN_PASSIVE (1<<3)
-
-#define IPW_NIC_FATAL_ERROR 0x2A7F0
-#define IPW_ERROR_ADDR(x) (x & 0x3FFFF)
-#define IPW_ERROR_CODE(x) ((x & 0xFF000000) >> 24)
-#define IPW2100_ERR_C3_CORRUPTION (0x10 << 24)
-#define IPW2100_ERR_MSG_TIMEOUT   (0x11 << 24)
-#define IPW2100_ERR_FW_LOAD       (0x12 << 24)
-
-#define IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND			0x200
-#define IPW_MEM_SRAM_HOST_INTERRUPT_AREA_LOWER_BOUND  	IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0x0D80
-
-#define IPW_MEM_HOST_SHARED_RX_BD_BASE                  (IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0x40)
-#define IPW_MEM_HOST_SHARED_RX_STATUS_BASE              (IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0x44)
-#define IPW_MEM_HOST_SHARED_RX_BD_SIZE                  (IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0x48)
-#define IPW_MEM_HOST_SHARED_RX_READ_INDEX               (IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0xa0)
-
-#define IPW_MEM_HOST_SHARED_TX_QUEUE_BD_BASE          (IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0x00)
-#define IPW_MEM_HOST_SHARED_TX_QUEUE_BD_SIZE          (IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0x04)
-#define IPW_MEM_HOST_SHARED_TX_QUEUE_READ_INDEX       (IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0x80)
-
-#define IPW_MEM_HOST_SHARED_RX_WRITE_INDEX \
-    (IPW_MEM_SRAM_HOST_INTERRUPT_AREA_LOWER_BOUND + 0x20)
-
-#define IPW_MEM_HOST_SHARED_TX_QUEUE_WRITE_INDEX \
-    (IPW_MEM_SRAM_HOST_INTERRUPT_AREA_LOWER_BOUND)
-
-#define IPW_MEM_HOST_SHARED_ORDINALS_TABLE_1   (IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0x180)
-#define IPW_MEM_HOST_SHARED_ORDINALS_TABLE_2   (IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND + 0x184)
-
-#define IPW2100_INTA_TX_TRANSFER               (0x00000001)	// Bit 0 (LSB)
-#define IPW2100_INTA_RX_TRANSFER               (0x00000002)	// Bit 1
-#define IPW2100_INTA_TX_COMPLETE	       (0x00000004)	// Bit 2
-#define IPW2100_INTA_EVENT_INTERRUPT           (0x00000008)     // Bit 3
-#define IPW2100_INTA_STATUS_CHANGE             (0x00000010)	// Bit 4
-#define IPW2100_INTA_BEACON_PERIOD_EXPIRED     (0x00000020)	// Bit 5
-#define IPW2100_INTA_SLAVE_MODE_HOST_COMMAND_DONE  (0x00010000)	// Bit 16
-#define IPW2100_INTA_FW_INIT_DONE              (0x01000000)	// Bit 24
-#define IPW2100_INTA_FW_CALIBRATION_CALC       (0x02000000)	// Bit 25
-#define IPW2100_INTA_FATAL_ERROR               (0x40000000)	// Bit 30
-#define IPW2100_INTA_PARITY_ERROR              (0x80000000)	// Bit 31 (MSB)
-
-#define IPW_AUX_HOST_RESET_REG_PRINCETON_RESET              (0x00000001)
-#define IPW_AUX_HOST_RESET_REG_FORCE_NMI                    (0x00000002)
-#define IPW_AUX_HOST_RESET_REG_PCI_HOST_CLUSTER_FATAL_NMI   (0x00000004)
-#define IPW_AUX_HOST_RESET_REG_CORE_FATAL_NMI               (0x00000008)
-#define IPW_AUX_HOST_RESET_REG_SW_RESET                     (0x00000080)
-#define IPW_AUX_HOST_RESET_REG_MASTER_DISABLED              (0x00000100)
-#define IPW_AUX_HOST_RESET_REG_STOP_MASTER                  (0x00000200)
-
-#define IPW_AUX_HOST_GP_CNTRL_BIT_CLOCK_READY           (0x00000001)	// Bit 0 (LSB)
-#define IPW_AUX_HOST_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY   (0x00000002)	// Bit 1
-#define IPW_AUX_HOST_GP_CNTRL_BIT_INIT_DONE             (0x00000004)	// Bit 2
-#define IPW_AUX_HOST_GP_CNTRL_BITS_SYS_CONFIG           (0x000007c0)	// Bits 6-10
-#define IPW_AUX_HOST_GP_CNTRL_BIT_BUS_TYPE              (0x00000200)	// Bit 9
-#define IPW_AUX_HOST_GP_CNTRL_BIT_BAR0_BLOCK_SIZE       (0x00000400)	// Bit 10
-#define IPW_AUX_HOST_GP_CNTRL_BIT_USB_MODE              (0x20000000)	// Bit 29
-#define IPW_AUX_HOST_GP_CNTRL_BIT_HOST_FORCES_SYS_CLK   (0x40000000)	// Bit 30
-#define IPW_AUX_HOST_GP_CNTRL_BIT_FW_FORCES_SYS_CLK     (0x80000000)	// Bit 31 (MSB)
-
-#define IPW_BIT_GPIO_GPIO1_MASK         0x0000000C
-#define IPW_BIT_GPIO_GPIO3_MASK         0x000000C0
-#define IPW_BIT_GPIO_GPIO1_ENABLE       0x00000008
-#define IPW_BIT_GPIO_RF_KILL            0x00010000
-
-#define IPW_BIT_GPIO_LED_OFF            0x00002000	// Bit 13 = 1
-
-#define IPW_REG_DOMAIN_0_OFFSET 	0x0000
-#define IPW_REG_DOMAIN_1_OFFSET 	IPW_MEM_SRAM_HOST_SHARED_LOWER_BOUND
-
-#define IPW_REG_INTA			IPW_REG_DOMAIN_0_OFFSET + 0x0008
-#define IPW_REG_INTA_MASK		IPW_REG_DOMAIN_0_OFFSET + 0x000C
-#define IPW_REG_INDIRECT_ACCESS_ADDRESS	IPW_REG_DOMAIN_0_OFFSET + 0x0010
-#define IPW_REG_INDIRECT_ACCESS_DATA	IPW_REG_DOMAIN_0_OFFSET + 0x0014
-#define IPW_REG_AUTOINCREMENT_ADDRESS	IPW_REG_DOMAIN_0_OFFSET + 0x0018
-#define IPW_REG_AUTOINCREMENT_DATA	IPW_REG_DOMAIN_0_OFFSET + 0x001C
-#define IPW_REG_RESET_REG		IPW_REG_DOMAIN_0_OFFSET + 0x0020
-#define IPW_REG_GP_CNTRL		IPW_REG_DOMAIN_0_OFFSET + 0x0024
-#define IPW_REG_GPIO			IPW_REG_DOMAIN_0_OFFSET + 0x0030
-#define IPW_REG_FW_TYPE                 IPW_REG_DOMAIN_1_OFFSET + 0x0188
-#define IPW_REG_FW_VERSION 		IPW_REG_DOMAIN_1_OFFSET + 0x018C
-#define IPW_REG_FW_COMPATABILITY_VERSION IPW_REG_DOMAIN_1_OFFSET + 0x0190
-
-#define IPW_REG_INDIRECT_ADDR_MASK	0x00FFFFFC
-
-#define IPW_INTERRUPT_MASK		0xC1010013
-
-#define IPW2100_CONTROL_REG             0x220000
-#define IPW2100_CONTROL_PHY_OFF         0x8
-
-#define IPW2100_COMMAND			0x00300004
-#define IPW2100_COMMAND_PHY_ON		0x0
-#define IPW2100_COMMAND_PHY_OFF		0x1
-
-/* in DEBUG_AREA, values of memory always 0xd55555d5 */
-#define IPW_REG_DOA_DEBUG_AREA_START    IPW_REG_DOMAIN_0_OFFSET + 0x0090
-#define IPW_REG_DOA_DEBUG_AREA_END      IPW_REG_DOMAIN_0_OFFSET + 0x00FF
-#define IPW_DATA_DOA_DEBUG_VALUE        0xd55555d5
-
-#define IPW_INTERNAL_REGISTER_HALT_AND_RESET	0x003000e0
-
-#define IPW_WAIT_CLOCK_STABILIZATION_DELAY	    50	// micro seconds
-#define IPW_WAIT_RESET_ARC_COMPLETE_DELAY	    10	// micro seconds
-#define IPW_WAIT_RESET_MASTER_ASSERT_COMPLETE_DELAY 10	// micro seconds
-
-// BD ring queue read/write difference
-#define IPW_BD_QUEUE_W_R_MIN_SPARE 2
-
-#define IPW_CACHE_LINE_LENGTH_DEFAULT		    0x80
-
-#define IPW_CARD_DISABLE_PHY_OFF_COMPLETE_WAIT	    100	// 100 milli
-#define IPW_PREPARE_POWER_DOWN_COMPLETE_WAIT	    100	// 100 milli
-
-
-
-
-#define IPW_HEADER_802_11_SIZE		 sizeof(struct ieee80211_hdr_3addr)
-#define IPW_MAX_80211_PAYLOAD_SIZE              2304U
-#define IPW_MAX_802_11_PAYLOAD_LENGTH		2312
-#define IPW_MAX_ACCEPTABLE_TX_FRAME_LENGTH	1536
-#define IPW_MIN_ACCEPTABLE_RX_FRAME_LENGTH	60
-#define IPW_MAX_ACCEPTABLE_RX_FRAME_LENGTH \
-	(IPW_MAX_ACCEPTABLE_TX_FRAME_LENGTH + IPW_HEADER_802_11_SIZE - \
-        sizeof(struct ethhdr))
-
-#define IPW_802_11_FCS_LENGTH 4
-#define IPW_RX_NIC_BUFFER_LENGTH \
-        (IPW_MAX_802_11_PAYLOAD_LENGTH + IPW_HEADER_802_11_SIZE + \
-		IPW_802_11_FCS_LENGTH)
-
-#define IPW_802_11_PAYLOAD_OFFSET \
-        (sizeof(struct ieee80211_hdr_3addr) + \
-         sizeof(struct ieee80211_snap_hdr))
-
-struct ipw2100_rx {
-	union {
-		unsigned char payload[IPW_RX_NIC_BUFFER_LENGTH];
-		struct ieee80211_hdr header;
-		u32 status;
-		struct ipw2100_notification notification;
-		struct ipw2100_cmd_header command;
-	} rx_data;
-} __attribute__ ((packed));
-
-/* Bit 0-7 are for 802.11b tx rates - .  Bit 5-7 are reserved */
-#define TX_RATE_1_MBIT              0x0001
-#define TX_RATE_2_MBIT              0x0002
-#define TX_RATE_5_5_MBIT            0x0004
-#define TX_RATE_11_MBIT             0x0008
-#define TX_RATE_MASK                0x000F
-#define DEFAULT_TX_RATES            0x000F
-
-#define IPW_POWER_MODE_CAM           0x00	//(always on)
-#define IPW_POWER_INDEX_1            0x01
-#define IPW_POWER_INDEX_2            0x02
-#define IPW_POWER_INDEX_3            0x03
-#define IPW_POWER_INDEX_4            0x04
-#define IPW_POWER_INDEX_5            0x05
-#define IPW_POWER_AUTO               0x06
-#define IPW_POWER_MASK               0x0F
-#define IPW_POWER_ENABLED            0x10
-#define IPW_POWER_LEVEL(x)           ((x) & IPW_POWER_MASK)
-
-#define IPW_TX_POWER_AUTO            0
-#define IPW_TX_POWER_ENHANCED        1
-
-#define IPW_TX_POWER_DEFAULT         32
-#define IPW_TX_POWER_MIN             0
-#define IPW_TX_POWER_MAX             16
-#define IPW_TX_POWER_MIN_DBM         (-12)
-#define IPW_TX_POWER_MAX_DBM         16
-
-#define FW_SCAN_DONOT_ASSOCIATE     0x0001 // Dont Attempt to Associate after Scan
-#define FW_SCAN_PASSIVE             0x0008 // Force PASSSIVE Scan
-
-#define REG_MIN_CHANNEL             0
-#define REG_MAX_CHANNEL             14
-
-#define REG_CHANNEL_MASK            0x00003FFF
-#define IPW_IBSS_11B_DEFAULT_MASK   0x87ff
-
-#define DIVERSITY_EITHER            0	// Use both antennas
-#define DIVERSITY_ANTENNA_A         1	// Use antenna A
-#define DIVERSITY_ANTENNA_B         2	// Use antenna B
-
-
-#define HOST_COMMAND_WAIT 0
-#define HOST_COMMAND_NO_WAIT 1
-
-#define LOCK_NONE 0
-#define LOCK_DRIVER 1
-#define LOCK_FW 2
-
-#define TYPE_SWEEP_ORD                  0x000D
-#define TYPE_IBSS_STTN_ORD              0x000E
-#define TYPE_BSS_AP_ORD                 0x000F
-#define TYPE_RAW_BEACON_ENTRY           0x0010
-#define TYPE_CALIBRATION_DATA           0x0011
-#define TYPE_ROGUE_AP_DATA              0x0012
-#define TYPE_ASSOCIATION_REQUEST	0x0013
-#define TYPE_REASSOCIATION_REQUEST	0x0014
-
-
-#define HW_FEATURE_RFKILL (0x0001)
-#define RF_KILLSWITCH_OFF (1)
-#define RF_KILLSWITCH_ON  (0)
-
-#define IPW_COMMAND_POOL_SIZE        40
-
-#define IPW_START_ORD_TAB_1			1
-#define IPW_START_ORD_TAB_2			1000
-
-#define IPW_ORD_TAB_1_ENTRY_SIZE		sizeof(u32)
-
-#define IS_ORDINAL_TABLE_ONE(mgr,id) \
-    ((id >= IPW_START_ORD_TAB_1) && (id < mgr->table1_size))
-#define IS_ORDINAL_TABLE_TWO(mgr,id) \
-    ((id >= IPW_START_ORD_TAB_2) && (id < (mgr->table2_size + IPW_START_ORD_TAB_2)))
-
-#define BSS_ID_LENGTH               6
-
-// Fixed size data: Ordinal Table 1
-typedef enum _ORDINAL_TABLE_1 {	// NS - means Not Supported by FW
-// Transmit statistics
-	IPW_ORD_STAT_TX_HOST_REQUESTS = 1,// # of requested Host Tx's (MSDU)
-	IPW_ORD_STAT_TX_HOST_COMPLETE,	// # of successful Host Tx's (MSDU)
-	IPW_ORD_STAT_TX_DIR_DATA,	// # of successful Directed Tx's (MSDU)
-
-	IPW_ORD_STAT_TX_DIR_DATA1 = 4,	// # of successful Directed Tx's (MSDU) @ 1MB
-	IPW_ORD_STAT_TX_DIR_DATA2,	// # of successful Directed Tx's (MSDU) @ 2MB
-	IPW_ORD_STAT_TX_DIR_DATA5_5,	// # of successful Directed Tx's (MSDU) @ 5_5MB
-	IPW_ORD_STAT_TX_DIR_DATA11,	// # of successful Directed Tx's (MSDU) @ 11MB
-	IPW_ORD_STAT_TX_DIR_DATA22,	// # of successful Directed Tx's (MSDU) @ 22MB
-
-	IPW_ORD_STAT_TX_NODIR_DATA1 = 13,// # of successful Non_Directed Tx's (MSDU) @ 1MB
-	IPW_ORD_STAT_TX_NODIR_DATA2,	// # of successful Non_Directed Tx's (MSDU) @ 2MB
-	IPW_ORD_STAT_TX_NODIR_DATA5_5,	// # of successful Non_Directed Tx's (MSDU) @ 5.5MB
-	IPW_ORD_STAT_TX_NODIR_DATA11,	// # of successful Non_Directed Tx's (MSDU) @ 11MB
-
-	IPW_ORD_STAT_NULL_DATA = 21,	// # of successful NULL data Tx's
-	IPW_ORD_STAT_TX_RTS,	        // # of successful Tx RTS
-	IPW_ORD_STAT_TX_CTS,	        // # of successful Tx CTS
-	IPW_ORD_STAT_TX_ACK,	        // # of successful Tx ACK
-	IPW_ORD_STAT_TX_ASSN,	        // # of successful Association Tx's
-	IPW_ORD_STAT_TX_ASSN_RESP,	// # of successful Association response Tx's
-	IPW_ORD_STAT_TX_REASSN,	        // # of successful Reassociation Tx's
-	IPW_ORD_STAT_TX_REASSN_RESP,	// # of successful Reassociation response Tx's
-	IPW_ORD_STAT_TX_PROBE,	        // # of probes successfully transmitted
-	IPW_ORD_STAT_TX_PROBE_RESP,	// # of probe responses successfully transmitted
-	IPW_ORD_STAT_TX_BEACON,	        // # of tx beacon
-	IPW_ORD_STAT_TX_ATIM,	        // # of Tx ATIM
-	IPW_ORD_STAT_TX_DISASSN,	// # of successful Disassociation TX
-	IPW_ORD_STAT_TX_AUTH,	        // # of successful Authentication Tx
-	IPW_ORD_STAT_TX_DEAUTH,	        // # of successful Deauthentication TX
-
-	IPW_ORD_STAT_TX_TOTAL_BYTES = 41,// Total successful Tx data bytes
-	IPW_ORD_STAT_TX_RETRIES,         // # of Tx retries
-	IPW_ORD_STAT_TX_RETRY1,          // # of Tx retries at 1MBPS
-	IPW_ORD_STAT_TX_RETRY2,          // # of Tx retries at 2MBPS
-	IPW_ORD_STAT_TX_RETRY5_5,	 // # of Tx retries at 5.5MBPS
-	IPW_ORD_STAT_TX_RETRY11,	 // # of Tx retries at 11MBPS
-
-	IPW_ORD_STAT_TX_FAILURES = 51,	// # of Tx Failures
-	IPW_ORD_STAT_TX_ABORT_AT_HOP,	//NS // # of Tx's aborted at hop time
-	IPW_ORD_STAT_TX_MAX_TRIES_IN_HOP,// # of times max tries in a hop failed
-	IPW_ORD_STAT_TX_ABORT_LATE_DMA,	//NS // # of times tx aborted due to late dma setup
-	IPW_ORD_STAT_TX_ABORT_STX,	//NS // # of times backoff aborted
-	IPW_ORD_STAT_TX_DISASSN_FAIL,	// # of times disassociation failed
-	IPW_ORD_STAT_TX_ERR_CTS,         // # of missed/bad CTS frames
-	IPW_ORD_STAT_TX_BPDU,	        //NS // # of spanning tree BPDUs sent
-	IPW_ORD_STAT_TX_ERR_ACK,	// # of tx err due to acks
-
-	// Receive statistics
-	IPW_ORD_STAT_RX_HOST = 61,	// # of packets passed to host
-	IPW_ORD_STAT_RX_DIR_DATA,	// # of directed packets
-	IPW_ORD_STAT_RX_DIR_DATA1,	// # of directed packets at 1MB
-	IPW_ORD_STAT_RX_DIR_DATA2,	// # of directed packets at 2MB
-	IPW_ORD_STAT_RX_DIR_DATA5_5,	// # of directed packets at 5.5MB
-	IPW_ORD_STAT_RX_DIR_DATA11,	// # of directed packets at 11MB
-	IPW_ORD_STAT_RX_DIR_DATA22,	// # of directed packets at 22MB
-
-	IPW_ORD_STAT_RX_NODIR_DATA = 71,// # of nondirected packets
-	IPW_ORD_STAT_RX_NODIR_DATA1,	// # of nondirected packets at 1MB
-	IPW_ORD_STAT_RX_NODIR_DATA2,	// # of nondirected packets at 2MB
-	IPW_ORD_STAT_RX_NODIR_DATA5_5,	// # of nondirected packets at 5.5MB
-	IPW_ORD_STAT_RX_NODIR_DATA11,	// # of nondirected packets at 11MB
-
-	IPW_ORD_STAT_RX_NULL_DATA = 80,	// # of null data rx's
-	IPW_ORD_STAT_RX_POLL,	//NS // # of poll rx
-	IPW_ORD_STAT_RX_RTS,	// # of Rx RTS
-	IPW_ORD_STAT_RX_CTS,	// # of Rx CTS
-	IPW_ORD_STAT_RX_ACK,	// # of Rx ACK
-	IPW_ORD_STAT_RX_CFEND,	// # of Rx CF End
-	IPW_ORD_STAT_RX_CFEND_ACK,	// # of Rx CF End + CF Ack
-	IPW_ORD_STAT_RX_ASSN,	// # of Association Rx's
-	IPW_ORD_STAT_RX_ASSN_RESP,	// # of Association response Rx's
-	IPW_ORD_STAT_RX_REASSN,	// # of Reassociation Rx's
-	IPW_ORD_STAT_RX_REASSN_RESP,	// # of Reassociation response Rx's
-	IPW_ORD_STAT_RX_PROBE,	// # of probe Rx's
-	IPW_ORD_STAT_RX_PROBE_RESP,	// # of probe response Rx's
-	IPW_ORD_STAT_RX_BEACON,	// # of Rx beacon
-	IPW_ORD_STAT_RX_ATIM,	// # of Rx ATIM
-	IPW_ORD_STAT_RX_DISASSN,	// # of disassociation Rx
-	IPW_ORD_STAT_RX_AUTH,	// # of authentication Rx
-	IPW_ORD_STAT_RX_DEAUTH,	// # of deauthentication Rx
-
-	IPW_ORD_STAT_RX_TOTAL_BYTES = 101,// Total rx data bytes received
-	IPW_ORD_STAT_RX_ERR_CRC,	 // # of packets with Rx CRC error
-	IPW_ORD_STAT_RX_ERR_CRC1,	 // # of Rx CRC errors at 1MB
-	IPW_ORD_STAT_RX_ERR_CRC2,	 // # of Rx CRC errors at 2MB
-	IPW_ORD_STAT_RX_ERR_CRC5_5,	 // # of Rx CRC errors at 5.5MB
-	IPW_ORD_STAT_RX_ERR_CRC11,	 // # of Rx CRC errors at 11MB
-
-	IPW_ORD_STAT_RX_DUPLICATE1 = 112, // # of duplicate rx packets at 1MB
-	IPW_ORD_STAT_RX_DUPLICATE2,	 // # of duplicate rx packets at 2MB
-	IPW_ORD_STAT_RX_DUPLICATE5_5,	 // # of duplicate rx packets at 5.5MB
-	IPW_ORD_STAT_RX_DUPLICATE11,	 // # of duplicate rx packets at 11MB
-	IPW_ORD_STAT_RX_DUPLICATE = 119, // # of duplicate rx packets
-
-	IPW_ORD_PERS_DB_LOCK = 120,	// # locking fw permanent  db
-	IPW_ORD_PERS_DB_SIZE,	// # size of fw permanent  db
-	IPW_ORD_PERS_DB_ADDR,	// # address of fw permanent  db
-	IPW_ORD_STAT_RX_INVALID_PROTOCOL,	// # of rx frames with invalid protocol
-	IPW_ORD_SYS_BOOT_TIME,	// # Boot time
-	IPW_ORD_STAT_RX_NO_BUFFER,	// # of rx frames rejected due to no buffer
-	IPW_ORD_STAT_RX_ABORT_LATE_DMA,	//NS // # of rx frames rejected due to dma setup too late
-	IPW_ORD_STAT_RX_ABORT_AT_HOP,	//NS // # of rx frames aborted due to hop
-	IPW_ORD_STAT_RX_MISSING_FRAG,	// # of rx frames dropped due to missing fragment
-	IPW_ORD_STAT_RX_ORPHAN_FRAG,	// # of rx frames dropped due to non-sequential fragment
-	IPW_ORD_STAT_RX_ORPHAN_FRAME,	// # of rx frames dropped due to unmatched 1st frame
-	IPW_ORD_STAT_RX_FRAG_AGEOUT,	// # of rx frames dropped due to uncompleted frame
-	IPW_ORD_STAT_RX_BAD_SSID,	//NS // Bad SSID (unused)
-	IPW_ORD_STAT_RX_ICV_ERRORS,	// # of ICV errors during decryption
-
-// PSP Statistics
-	IPW_ORD_STAT_PSP_SUSPENSION = 137,// # of times adapter suspended
-	IPW_ORD_STAT_PSP_BCN_TIMEOUT,	// # of beacon timeout
-	IPW_ORD_STAT_PSP_POLL_TIMEOUT,	// # of poll response timeouts
-	IPW_ORD_STAT_PSP_NONDIR_TIMEOUT,// # of timeouts waiting for last broadcast/muticast pkt
-	IPW_ORD_STAT_PSP_RX_DTIMS,	// # of PSP DTIMs received
-	IPW_ORD_STAT_PSP_RX_TIMS,	// # of PSP TIMs received
-	IPW_ORD_STAT_PSP_STATION_ID,	// PSP Station ID
-
-// Association and roaming
-	IPW_ORD_LAST_ASSN_TIME = 147,	// RTC time of last association
-	IPW_ORD_STAT_PERCENT_MISSED_BCNS,// current calculation of % missed beacons
-	IPW_ORD_STAT_PERCENT_RETRIES,	// current calculation of % missed tx retries
-	IPW_ORD_ASSOCIATED_AP_PTR,	// If associated, this is ptr to the associated
-	// AP table entry. set to 0 if not associated
-	IPW_ORD_AVAILABLE_AP_CNT,	// # of AP's decsribed in the AP table
-	IPW_ORD_AP_LIST_PTR,	// Ptr to list of available APs
-	IPW_ORD_STAT_AP_ASSNS,	// # of associations
-	IPW_ORD_STAT_ASSN_FAIL,	// # of association failures
-	IPW_ORD_STAT_ASSN_RESP_FAIL,	// # of failuresdue to response fail
-	IPW_ORD_STAT_FULL_SCANS,	// # of full scans
-
-	IPW_ORD_CARD_DISABLED,	// # Card Disabled
-	IPW_ORD_STAT_ROAM_INHIBIT,	// # of times roaming was inhibited due to ongoing activity
-	IPW_FILLER_40,
-	IPW_ORD_RSSI_AT_ASSN = 160,	// RSSI of associated AP at time of association
-	IPW_ORD_STAT_ASSN_CAUSE1,	// # of reassociations due to no tx from AP in last N
-	// hops or no prob_ responses in last 3 minutes
-	IPW_ORD_STAT_ASSN_CAUSE2,	// # of reassociations due to poor tx/rx quality
-	IPW_ORD_STAT_ASSN_CAUSE3,	// # of reassociations due to tx/rx quality with excessive
-	// load at the AP
-	IPW_ORD_STAT_ASSN_CAUSE4,	// # of reassociations due to AP RSSI level fell below
-	// eligible group
-	IPW_ORD_STAT_ASSN_CAUSE5,	// # of reassociations due to load leveling
-	IPW_ORD_STAT_ASSN_CAUSE6,	//NS // # of reassociations due to dropped by Ap
-	IPW_FILLER_41,
-	IPW_FILLER_42,
-	IPW_FILLER_43,
-	IPW_ORD_STAT_AUTH_FAIL,	// # of times authentication failed
-	IPW_ORD_STAT_AUTH_RESP_FAIL,	// # of times authentication response failed
-	IPW_ORD_STATION_TABLE_CNT,	// # of entries in association table
-
-// Other statistics
-	IPW_ORD_RSSI_AVG_CURR = 173,	// Current avg RSSI
-	IPW_ORD_STEST_RESULTS_CURR,	//NS // Current self test results word
-	IPW_ORD_STEST_RESULTS_CUM,	//NS // Cummulative self test results word
-	IPW_ORD_SELF_TEST_STATUS,	//NS //
-	IPW_ORD_POWER_MGMT_MODE,	// Power mode - 0=CAM, 1=PSP
-	IPW_ORD_POWER_MGMT_INDEX,	//NS //
-	IPW_ORD_COUNTRY_CODE,	// IEEE country code as recv'd from beacon
-	IPW_ORD_COUNTRY_CHANNELS,	// channels suported by country
-// IPW_ORD_COUNTRY_CHANNELS:
-// For 11b the lower 2-byte are used for channels from 1-14
-//   and the higher 2-byte are not used.
-	IPW_ORD_RESET_CNT,	// # of adapter resets (warm)
-	IPW_ORD_BEACON_INTERVAL,	// Beacon interval
-
-	IPW_ORD_PRINCETON_VERSION = 184,	//NS // Princeton Version
-	IPW_ORD_ANTENNA_DIVERSITY,	// TRUE if antenna diversity is disabled
-	IPW_ORD_CCA_RSSI,	//NS // CCA RSSI value (factory programmed)
-	IPW_ORD_STAT_EEPROM_UPDATE,	//NS // # of times config EEPROM updated
-	IPW_ORD_DTIM_PERIOD,	// # of beacon intervals between DTIMs
-	IPW_ORD_OUR_FREQ,	// current radio freq lower digits - channel ID
-
-	IPW_ORD_RTC_TIME = 190,	// current RTC time
-	IPW_ORD_PORT_TYPE,	// operating mode
-	IPW_ORD_CURRENT_TX_RATE,	// current tx rate
-	IPW_ORD_SUPPORTED_RATES,	// Bitmap of supported tx rates
-	IPW_ORD_ATIM_WINDOW,	// current ATIM Window
-	IPW_ORD_BASIC_RATES,	// bitmap of basic tx rates
-	IPW_ORD_NIC_HIGHEST_RATE,	// bitmap of basic tx rates
-	IPW_ORD_AP_HIGHEST_RATE,	// bitmap of basic tx rates
-	IPW_ORD_CAPABILITIES,	// Management frame capability field
-	IPW_ORD_AUTH_TYPE,	// Type of authentication
-	IPW_ORD_RADIO_TYPE,	// Adapter card platform type
-	IPW_ORD_RTS_THRESHOLD = 201,	// Min length of packet after which RTS handshaking is used
-	IPW_ORD_INT_MODE,	// International mode
-	IPW_ORD_FRAGMENTATION_THRESHOLD,	// protocol frag threshold
-	IPW_ORD_EEPROM_SRAM_DB_BLOCK_START_ADDRESS,	// EEPROM offset in SRAM
-	IPW_ORD_EEPROM_SRAM_DB_BLOCK_SIZE,	// EEPROM size in SRAM
-	IPW_ORD_EEPROM_SKU_CAPABILITY,	// EEPROM SKU Capability    206 =
-	IPW_ORD_EEPROM_IBSS_11B_CHANNELS,	// EEPROM IBSS 11b channel set
-
-	IPW_ORD_MAC_VERSION = 209,	// MAC Version
-	IPW_ORD_MAC_REVISION,	// MAC Revision
-	IPW_ORD_RADIO_VERSION,	// Radio Version
-	IPW_ORD_NIC_MANF_DATE_TIME,	// MANF Date/Time STAMP
-	IPW_ORD_UCODE_VERSION,	// Ucode Version
-	IPW_ORD_HW_RF_SWITCH_STATE = 214,	// HW RF Kill Switch State
-} ORDINALTABLE1;
-
-// ordinal table 2
-// Variable length data:
-#define IPW_FIRST_VARIABLE_LENGTH_ORDINAL   1001
-
-typedef enum _ORDINAL_TABLE_2 {	// NS - means Not Supported by FW
-	IPW_ORD_STAT_BASE = 1000,	// contains number of variable ORDs
-	IPW_ORD_STAT_ADAPTER_MAC = 1001,	// 6 bytes: our adapter MAC address
-	IPW_ORD_STAT_PREFERRED_BSSID = 1002,	// 6 bytes: BSSID of the preferred AP
-	IPW_ORD_STAT_MANDATORY_BSSID = 1003,	// 6 bytes: BSSID of the mandatory AP
-	IPW_FILL_1,		//NS //
-	IPW_ORD_STAT_COUNTRY_TEXT = 1005,	// 36 bytes: Country name text, First two bytes are Country code
-	IPW_ORD_STAT_ASSN_SSID = 1006,	// 32 bytes: ESSID String
-	IPW_ORD_STATION_TABLE = 1007,	// ? bytes: Station/AP table (via Direct SSID Scans)
-	IPW_ORD_STAT_SWEEP_TABLE = 1008,	// ? bytes: Sweep/Host Table table (via Broadcast Scans)
-	IPW_ORD_STAT_ROAM_LOG = 1009,	// ? bytes: Roaming log
-	IPW_ORD_STAT_RATE_LOG = 1010,	//NS // 0 bytes: Rate log
-	IPW_ORD_STAT_FIFO = 1011,	//NS // 0 bytes: Fifo buffer data structures
-	IPW_ORD_STAT_FW_VER_NUM = 1012,	// 14 bytes: fw version ID string as in (a.bb.ccc; "0.08.011")
-	IPW_ORD_STAT_FW_DATE = 1013,	// 14 bytes: fw date string (mmm dd yyyy; "Mar 13 2002")
-	IPW_ORD_STAT_ASSN_AP_BSSID = 1014,	// 6 bytes: MAC address of associated AP
-	IPW_ORD_STAT_DEBUG = 1015,	//NS // ? bytes:
-	IPW_ORD_STAT_NIC_BPA_NUM = 1016,	// 11 bytes: NIC BPA number in ASCII
-	IPW_ORD_STAT_UCODE_DATE = 1017,	// 5 bytes: uCode date
-	IPW_ORD_SECURITY_NGOTIATION_RESULT = 1018,
-} ORDINALTABLE2;		// NS - means Not Supported by FW
-
-#define IPW_LAST_VARIABLE_LENGTH_ORDINAL   1018
-
-#ifndef WIRELESS_SPY
-#define WIRELESS_SPY		// enable iwspy support
-#endif
-
-#define IPW_HOST_FW_SHARED_AREA0 	0x0002f200
-#define IPW_HOST_FW_SHARED_AREA0_END 	0x0002f510	// 0x310 bytes
-
-#define IPW_HOST_FW_SHARED_AREA1 	0x0002f610
-#define IPW_HOST_FW_SHARED_AREA1_END 	0x0002f630	// 0x20 bytes
-
-#define IPW_HOST_FW_SHARED_AREA2 	0x0002fa00
-#define IPW_HOST_FW_SHARED_AREA2_END 	0x0002fa20	// 0x20 bytes
-
-#define IPW_HOST_FW_SHARED_AREA3 	0x0002fc00
-#define IPW_HOST_FW_SHARED_AREA3_END 	0x0002fc10	// 0x10 bytes
-
-#define IPW_HOST_FW_INTERRUPT_AREA 	0x0002ff80
-#define IPW_HOST_FW_INTERRUPT_AREA_END 	0x00030000	// 0x80 bytes
-
-struct ipw2100_fw_chunk {
-	unsigned char *buf;
-	long len;
-	long pos;
-	struct list_head list;
-};
-
-struct ipw2100_fw_chunk_set {
-   	const void *data;
-	unsigned long size;
-};
-
-struct ipw2100_fw {
-	int version;
-	struct ipw2100_fw_chunk_set fw;
-	struct ipw2100_fw_chunk_set uc;
-	const struct firmware *fw_entry;
-};
-
-#define MAX_FW_VERSION_LEN 14
-
-#endif /* _IPW2100_H */
diff --git a/trunk/drivers/net/wireless/ipw2200.c b/trunk/drivers/net/wireless/ipw2200.c
deleted file mode 100644
index 6d0b6b1df4ca..000000000000
--- a/trunk/drivers/net/wireless/ipw2200.c
+++ /dev/null
@@ -1,7353 +0,0 @@
-/******************************************************************************
-
-  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
-
-  802.11 status code portion of this file from ethereal-0.10.6:
-    Copyright 2000, Axis Communications AB
-    Ethereal - Network traffic analyzer
-    By Gerald Combs <gerald@ethereal.com>
-    Copyright 1998 Gerald Combs
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-******************************************************************************/
-
-#include "ipw2200.h"
-
-#define IPW2200_VERSION "1.0.0"
-#define DRV_DESCRIPTION	"Intel(R) PRO/Wireless 2200/2915 Network Driver"
-#define DRV_COPYRIGHT	"Copyright(c) 2003-2004 Intel Corporation"
-#define DRV_VERSION     IPW2200_VERSION
-
-MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
-MODULE_AUTHOR(DRV_COPYRIGHT);
-MODULE_LICENSE("GPL");
-
-static int debug = 0;
-static int channel = 0;
-static char *ifname;
-static int mode = 0;
-
-static u32 ipw_debug_level;
-static int associate = 1;
-static int auto_create = 1;
-static int disable = 0;
-static const char ipw_modes[] = {
-	'a', 'b', 'g', '?'
-};
-
-static void ipw_rx(struct ipw_priv *priv);
-static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
-				struct clx2_tx_queue *txq, int qindex);
-static int ipw_queue_reset(struct ipw_priv *priv);
-
-static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
-			     int len, int sync);
-
-static void ipw_tx_queue_free(struct ipw_priv *);
-
-static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *);
-static void ipw_rx_queue_free(struct ipw_priv *, struct ipw_rx_queue *);
-static void ipw_rx_queue_replenish(void *);
-
-static int ipw_up(struct ipw_priv *);
-static void ipw_down(struct ipw_priv *);
-static int ipw_config(struct ipw_priv *);
-static int init_supported_rates(struct ipw_priv *priv, struct ipw_supported_rates *prates);
-
-static u8 band_b_active_channel[MAX_B_CHANNELS] = {
-	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 0
-};
-static u8 band_a_active_channel[MAX_A_CHANNELS] = {
-	36, 40, 44, 48, 149, 153, 157, 161, 165, 52, 56, 60, 64, 0
-};
-
-static int is_valid_channel(int mode_mask, int channel)
-{
-	int i;
-
-	if (!channel)
-		return 0;
-
-	if (mode_mask & IEEE_A)
-		for (i = 0; i < MAX_A_CHANNELS; i++)
-			if (band_a_active_channel[i] == channel)
-				return IEEE_A;
-
-	if (mode_mask & (IEEE_B | IEEE_G))
-		for (i = 0; i < MAX_B_CHANNELS; i++)
-			if (band_b_active_channel[i] == channel)
-				return mode_mask & (IEEE_B | IEEE_G);
-
-	return 0;
-}
-
-static char *snprint_line(char *buf, size_t count,
-			  const u8 *data, u32 len, u32 ofs)
-{
-	int out, i, j, l;
-	char c;
-
-	out = snprintf(buf, count, "%08X", ofs);
-
-	for (l = 0, i = 0; i < 2; i++) {
-		out += snprintf(buf + out, count - out, " ");
-		for (j = 0; j < 8 && l < len; j++, l++)
-			out += snprintf(buf + out, count - out, "%02X ",
-					data[(i * 8 + j)]);
-		for (; j < 8; j++)
-			out += snprintf(buf + out, count - out, "   ");
-	}
-
-	out += snprintf(buf + out, count - out, " ");
-	for (l = 0, i = 0; i < 2; i++) {
-		out += snprintf(buf + out, count - out, " ");
-		for (j = 0; j < 8 && l < len; j++, l++) {
-			c = data[(i * 8 + j)];
-			if (!isascii(c) || !isprint(c))
-				c = '.';
-
-			out += snprintf(buf + out, count - out, "%c", c);
-		}
-
-		for (; j < 8; j++)
-			out += snprintf(buf + out, count - out, " ");
-	}
-
-	return buf;
-}
-
-static void printk_buf(int level, const u8 *data, u32 len)
-{
-	char line[81];
-	u32 ofs = 0;
-	if (!(ipw_debug_level & level))
-		return;
-
-	while (len) {
-		printk(KERN_DEBUG "%s\n",
-		       snprint_line(line, sizeof(line), &data[ofs],
-				    min(len, 16U), ofs));
-		ofs += 16;
-		len -= min(len, 16U);
-	}
-}
-
-static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg);
-#define ipw_read_reg32(a, b) _ipw_read_reg32(a, b)
-
-static u8 _ipw_read_reg8(struct ipw_priv *ipw, u32 reg);
-#define ipw_read_reg8(a, b) _ipw_read_reg8(a, b)
-
-static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value);
-static inline void ipw_write_reg8(struct ipw_priv *a, u32 b, u8 c)
-{
-	IPW_DEBUG_IO("%s %d: write_indirect8(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(b), (u32)(c));
-	_ipw_write_reg8(a, b, c);
-}
-
-static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg, u16 value);
-static inline void ipw_write_reg16(struct ipw_priv *a, u32 b, u16 c)
-{
-	IPW_DEBUG_IO("%s %d: write_indirect16(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(b), (u32)(c));
-	_ipw_write_reg16(a, b, c);
-}
-
-static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg, u32 value);
-static inline void ipw_write_reg32(struct ipw_priv *a, u32 b, u32 c)
-{
-	IPW_DEBUG_IO("%s %d: write_indirect32(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(b), (u32)(c));
-	_ipw_write_reg32(a, b, c);
-}
-
-#define _ipw_write8(ipw, ofs, val) writeb((val), (ipw)->hw_base + (ofs))
-#define ipw_write8(ipw, ofs, val) \
- IPW_DEBUG_IO("%s %d: write_direct8(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
- _ipw_write8(ipw, ofs, val)
-
-#define _ipw_write16(ipw, ofs, val) writew((val), (ipw)->hw_base + (ofs))
-#define ipw_write16(ipw, ofs, val) \
- IPW_DEBUG_IO("%s %d: write_direct16(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
- _ipw_write16(ipw, ofs, val)
-
-#define _ipw_write32(ipw, ofs, val) writel((val), (ipw)->hw_base + (ofs))
-#define ipw_write32(ipw, ofs, val) \
- IPW_DEBUG_IO("%s %d: write_direct32(0x%08X, 0x%08X)\n", __FILE__, __LINE__, (u32)(ofs), (u32)(val)); \
- _ipw_write32(ipw, ofs, val)
-
-#define _ipw_read8(ipw, ofs) readb((ipw)->hw_base + (ofs))
-static inline u8 __ipw_read8(char *f, u32 l, struct ipw_priv *ipw, u32 ofs) {
-	IPW_DEBUG_IO("%s %d: read_direct8(0x%08X)\n", f, l, (u32)(ofs));
-	return _ipw_read8(ipw, ofs);
-}
-#define ipw_read8(ipw, ofs) __ipw_read8(__FILE__, __LINE__, ipw, ofs)
-
-#define _ipw_read16(ipw, ofs) readw((ipw)->hw_base + (ofs))
-static inline u16 __ipw_read16(char *f, u32 l, struct ipw_priv *ipw, u32 ofs) {
-	IPW_DEBUG_IO("%s %d: read_direct16(0x%08X)\n", f, l, (u32)(ofs));
-	return _ipw_read16(ipw, ofs);
-}
-#define ipw_read16(ipw, ofs) __ipw_read16(__FILE__, __LINE__, ipw, ofs)
-
-#define _ipw_read32(ipw, ofs) readl((ipw)->hw_base + (ofs))
-static inline u32 __ipw_read32(char *f, u32 l, struct ipw_priv *ipw, u32 ofs) {
-	IPW_DEBUG_IO("%s %d: read_direct32(0x%08X)\n", f, l, (u32)(ofs));
-	return _ipw_read32(ipw, ofs);
-}
-#define ipw_read32(ipw, ofs) __ipw_read32(__FILE__, __LINE__, ipw, ofs)
-
-static void _ipw_read_indirect(struct ipw_priv *, u32, u8 *, int);
-#define ipw_read_indirect(a, b, c, d) \
-	IPW_DEBUG_IO("%s %d: read_inddirect(0x%08X) %d bytes\n", __FILE__, __LINE__, (u32)(b), d); \
-	_ipw_read_indirect(a, b, c, d)
-
-static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 *data, int num);
-#define ipw_write_indirect(a, b, c, d) \
-	IPW_DEBUG_IO("%s %d: write_indirect(0x%08X) %d bytes\n", __FILE__, __LINE__, (u32)(b), d); \
-        _ipw_write_indirect(a, b, c, d)
-
-/* indirect write s */
-static void _ipw_write_reg32(struct ipw_priv *priv, u32 reg,
-			     u32 value)
-{
-	IPW_DEBUG_IO(" %p : reg = 0x%8X : value = 0x%8X\n",
-		     priv, reg, value);
-	_ipw_write32(priv, CX2_INDIRECT_ADDR, reg);
-	_ipw_write32(priv, CX2_INDIRECT_DATA, value);
-}
-
-
-static void _ipw_write_reg8(struct ipw_priv *priv, u32 reg, u8 value)
-{
-	IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
-	_ipw_write32(priv, CX2_INDIRECT_ADDR, reg & CX2_INDIRECT_ADDR_MASK);
-	_ipw_write8(priv, CX2_INDIRECT_DATA, value);
-	IPW_DEBUG_IO(" reg = 0x%8lX : value = 0x%8X\n",
-		     (unsigned long)(priv->hw_base + CX2_INDIRECT_DATA),
-		     value);
-}
-
-static void _ipw_write_reg16(struct ipw_priv *priv, u32 reg,
-			     u16 value)
-{
-	IPW_DEBUG_IO(" reg = 0x%8X : value = 0x%8X\n", reg, value);
-	_ipw_write32(priv, CX2_INDIRECT_ADDR, reg & CX2_INDIRECT_ADDR_MASK);
-	_ipw_write16(priv, CX2_INDIRECT_DATA, value);
-}
-
-/* indirect read s */
-
-static u8 _ipw_read_reg8(struct ipw_priv *priv, u32 reg)
-{
-	u32 word;
-	_ipw_write32(priv, CX2_INDIRECT_ADDR, reg & CX2_INDIRECT_ADDR_MASK);
-	IPW_DEBUG_IO(" reg = 0x%8X : \n", reg);
-	word = _ipw_read32(priv, CX2_INDIRECT_DATA);
-	return (word >> ((reg & 0x3)*8)) & 0xff;
-}
-
-static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg)
-{
-	u32 value;
-
-	IPW_DEBUG_IO("%p : reg = 0x%08x\n", priv, reg);
-
-	_ipw_write32(priv, CX2_INDIRECT_ADDR, reg);
-	value = _ipw_read32(priv, CX2_INDIRECT_DATA);
-	IPW_DEBUG_IO(" reg = 0x%4X : value = 0x%4x \n", reg, value);
-	return value;
-}
-
-/* iterative/auto-increment 32 bit reads and writes */
-static void _ipw_read_indirect(struct ipw_priv *priv, u32 addr, u8 * buf,
-			       int num)
-{
-	u32 aligned_addr = addr & CX2_INDIRECT_ADDR_MASK;
-	u32 dif_len = addr - aligned_addr;
-	u32 aligned_len;
-	u32 i;
-
-	IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
-
-	/* Read the first nibble byte by byte */
-	if (unlikely(dif_len)) {
-		/* Start reading at aligned_addr + dif_len */
-		_ipw_write32(priv, CX2_INDIRECT_ADDR, aligned_addr);
-		for (i = dif_len; i < 4; i++, buf++)
-			*buf = _ipw_read8(priv, CX2_INDIRECT_DATA + i);
-		num -= dif_len;
-		aligned_addr += 4;
-	}
-
-	/* Read DWs through autoinc register */
-	_ipw_write32(priv, CX2_AUTOINC_ADDR, aligned_addr);
-	aligned_len = num & CX2_INDIRECT_ADDR_MASK;
-	for (i = 0; i < aligned_len; i += 4, buf += 4, aligned_addr += 4)
-		*(u32*)buf = ipw_read32(priv, CX2_AUTOINC_DATA);
-
-	/* Copy the last nibble */
-	dif_len = num - aligned_len;
-	_ipw_write32(priv, CX2_INDIRECT_ADDR, aligned_addr);
-	for (i = 0; i < dif_len; i++, buf++)
-		*buf = ipw_read8(priv, CX2_INDIRECT_DATA + i);
-}
-
-static void _ipw_write_indirect(struct ipw_priv *priv, u32 addr, u8 *buf,
-				int num)
-{
-	u32 aligned_addr = addr & CX2_INDIRECT_ADDR_MASK;
-	u32 dif_len = addr - aligned_addr;
-	u32 aligned_len;
-	u32 i;
-
-	IPW_DEBUG_IO("addr = %i, buf = %p, num = %i\n", addr, buf, num);
-
-	/* Write the first nibble byte by byte */
-	if (unlikely(dif_len)) {
-		/* Start writing at aligned_addr + dif_len */
-		_ipw_write32(priv, CX2_INDIRECT_ADDR, aligned_addr);
-		for (i = dif_len; i < 4; i++, buf++)
-			_ipw_write8(priv, CX2_INDIRECT_DATA + i, *buf);
-		num -= dif_len;
-		aligned_addr += 4;
-	}
-
-	/* Write DWs through autoinc register */
-	_ipw_write32(priv, CX2_AUTOINC_ADDR, aligned_addr);
-	aligned_len = num & CX2_INDIRECT_ADDR_MASK;
-	for (i = 0; i < aligned_len; i += 4, buf += 4, aligned_addr += 4)
-		_ipw_write32(priv, CX2_AUTOINC_DATA, *(u32*)buf);
-
-	/* Copy the last nibble */
-	dif_len = num - aligned_len;
-	_ipw_write32(priv, CX2_INDIRECT_ADDR, aligned_addr);
-	for (i = 0; i < dif_len; i++, buf++)
-		_ipw_write8(priv, CX2_INDIRECT_DATA + i, *buf);
-}
-
-static void ipw_write_direct(struct ipw_priv *priv, u32 addr, void *buf,
-			     int num)
-{
-	memcpy_toio((priv->hw_base + addr), buf, num);
-}
-
-static inline void ipw_set_bit(struct ipw_priv *priv, u32 reg, u32 mask)
-{
-	ipw_write32(priv, reg, ipw_read32(priv, reg) | mask);
-}
-
-static inline void ipw_clear_bit(struct ipw_priv *priv, u32 reg, u32 mask)
-{
-	ipw_write32(priv, reg, ipw_read32(priv, reg) & ~mask);
-}
-
-static inline void ipw_enable_interrupts(struct ipw_priv *priv)
-{
-	if (priv->status & STATUS_INT_ENABLED)
-		return;
-	priv->status |= STATUS_INT_ENABLED;
-	ipw_write32(priv, CX2_INTA_MASK_R, CX2_INTA_MASK_ALL);
-}
-
-static inline void ipw_disable_interrupts(struct ipw_priv *priv)
-{
-	if (!(priv->status & STATUS_INT_ENABLED))
-		return;
-	priv->status &= ~STATUS_INT_ENABLED;
-	ipw_write32(priv, CX2_INTA_MASK_R, ~CX2_INTA_MASK_ALL);
-}
-
-static char *ipw_error_desc(u32 val)
-{
-	switch (val) {
-	case IPW_FW_ERROR_OK:
-		return "ERROR_OK";
-	case IPW_FW_ERROR_FAIL:
-		return "ERROR_FAIL";
-	case IPW_FW_ERROR_MEMORY_UNDERFLOW:
-		return "MEMORY_UNDERFLOW";
-	case IPW_FW_ERROR_MEMORY_OVERFLOW:
-		return "MEMORY_OVERFLOW";
-	case IPW_FW_ERROR_BAD_PARAM:
-		return "ERROR_BAD_PARAM";
-	case IPW_FW_ERROR_BAD_CHECKSUM:
-		return "ERROR_BAD_CHECKSUM";
-	case IPW_FW_ERROR_NMI_INTERRUPT:
-		return "ERROR_NMI_INTERRUPT";
-	case IPW_FW_ERROR_BAD_DATABASE:
-		return "ERROR_BAD_DATABASE";
-	case IPW_FW_ERROR_ALLOC_FAIL:
-		return "ERROR_ALLOC_FAIL";
-	case IPW_FW_ERROR_DMA_UNDERRUN:
-		return "ERROR_DMA_UNDERRUN";
-	case IPW_FW_ERROR_DMA_STATUS:
-		return "ERROR_DMA_STATUS";
-	case IPW_FW_ERROR_DINOSTATUS_ERROR:
-		return "ERROR_DINOSTATUS_ERROR";
-	case IPW_FW_ERROR_EEPROMSTATUS_ERROR:
-		return "ERROR_EEPROMSTATUS_ERROR";
-	case IPW_FW_ERROR_SYSASSERT:
-		return "ERROR_SYSASSERT";
-	case IPW_FW_ERROR_FATAL_ERROR:
-		return "ERROR_FATALSTATUS_ERROR";
-	default:
-		return "UNKNOWNSTATUS_ERROR";
-	}
-}
-
-static void ipw_dump_nic_error_log(struct ipw_priv *priv)
-{
-	u32 desc, time, blink1, blink2, ilink1, ilink2, idata, i, count, base;
-
-	base = ipw_read32(priv, IPWSTATUS_ERROR_LOG);
-	count = ipw_read_reg32(priv, base);
-
-	if (ERROR_START_OFFSET <= count * ERROR_ELEM_SIZE) {
-		IPW_ERROR("Start IPW Error Log Dump:\n");
-		IPW_ERROR("Status: 0x%08X, Config: %08X\n",
-			  priv->status, priv->config);
-	}
-
-	for (i = ERROR_START_OFFSET;
-	     i <= count * ERROR_ELEM_SIZE;
-	     i += ERROR_ELEM_SIZE) {
-		desc   = ipw_read_reg32(priv, base + i);
-		time   = ipw_read_reg32(priv, base + i + 1*sizeof(u32));
-		blink1 = ipw_read_reg32(priv, base + i + 2*sizeof(u32));
-		blink2 = ipw_read_reg32(priv, base + i + 3*sizeof(u32));
-		ilink1 = ipw_read_reg32(priv, base + i + 4*sizeof(u32));
-		ilink2 = ipw_read_reg32(priv, base + i + 5*sizeof(u32));
-		idata =  ipw_read_reg32(priv, base + i + 6*sizeof(u32));
-
-		IPW_ERROR(
-			"%s %i 0x%08x  0x%08x  0x%08x  0x%08x  0x%08x\n",
-			ipw_error_desc(desc), time, blink1, blink2,
-			ilink1, ilink2, idata);
-	}
-}
-
-static void ipw_dump_nic_event_log(struct ipw_priv *priv)
-{
-	u32 ev, time, data, i, count, base;
-
-	base = ipw_read32(priv, IPW_EVENT_LOG);
-	count = ipw_read_reg32(priv, base);
-
-	if (EVENT_START_OFFSET <= count * EVENT_ELEM_SIZE)
-		IPW_ERROR("Start IPW Event Log Dump:\n");
-
-	for (i = EVENT_START_OFFSET;
-	     i <= count * EVENT_ELEM_SIZE;
-	     i += EVENT_ELEM_SIZE) {
-		ev = ipw_read_reg32(priv, base + i);
-		time  = ipw_read_reg32(priv, base + i + 1*sizeof(u32));
-		data  = ipw_read_reg32(priv, base + i + 2*sizeof(u32));
-
-#ifdef CONFIG_IPW_DEBUG
-		IPW_ERROR("%i\t0x%08x\t%i\n", time, data, ev);
-#endif
-	}
-}
-
-static int ipw_get_ordinal(struct ipw_priv *priv, u32 ord, void *val,
-			   u32 *len)
-{
-	u32 addr, field_info, field_len, field_count, total_len;
-
-	IPW_DEBUG_ORD("ordinal = %i\n", ord);
-
-	if (!priv || !val || !len) {
-		IPW_DEBUG_ORD("Invalid argument\n");
-		return -EINVAL;
-	}
-
-	/* verify device ordinal tables have been initialized */
-	if (!priv->table0_addr || !priv->table1_addr || !priv->table2_addr) {
-		IPW_DEBUG_ORD("Access ordinals before initialization\n");
-		return -EINVAL;
-	}
-
-	switch (IPW_ORD_TABLE_ID_MASK & ord) {
-	case IPW_ORD_TABLE_0_MASK:
-		/*
-		 * TABLE 0: Direct access to a table of 32 bit values
-		 *
-		 * This is a very simple table with the data directly
-		 * read from the table
-		 */
-
-		/* remove the table id from the ordinal */
-		ord &= IPW_ORD_TABLE_VALUE_MASK;
-
-		/* boundary check */
-		if (ord > priv->table0_len) {
-			IPW_DEBUG_ORD("ordinal value (%i) longer then "
-				      "max (%i)\n", ord, priv->table0_len);
-			return -EINVAL;
-		}
-
-		/* verify we have enough room to store the value */
-		if (*len < sizeof(u32)) {
-			IPW_DEBUG_ORD("ordinal buffer length too small, "
-				      "need %zd\n", sizeof(u32));
-			return -EINVAL;
-		}
-
-		IPW_DEBUG_ORD("Reading TABLE0[%i] from offset 0x%08x\n",
-			      ord, priv->table0_addr + (ord  << 2));
-
-		*len = sizeof(u32);
-		ord <<= 2;
-		*((u32 *)val) = ipw_read32(priv, priv->table0_addr + ord);
-		break;
-
-	case IPW_ORD_TABLE_1_MASK:
-		/*
-		 * TABLE 1: Indirect access to a table of 32 bit values
-		 *
-		 * This is a fairly large table of u32 values each
-		 * representing starting addr for the data (which is
-		 * also a u32)
-		 */
-
-		/* remove the table id from the ordinal */
-		ord &= IPW_ORD_TABLE_VALUE_MASK;
-
-		/* boundary check */
-		if (ord > priv->table1_len) {
-			IPW_DEBUG_ORD("ordinal value too long\n");
-			return -EINVAL;
-		}
-
-		/* verify we have enough room to store the value */
-		if (*len < sizeof(u32)) {
-			IPW_DEBUG_ORD("ordinal buffer length too small, "
-				      "need %zd\n", sizeof(u32));
-			return -EINVAL;
-		}
-
-		*((u32 *)val) = ipw_read_reg32(priv, (priv->table1_addr + (ord << 2)));
-		*len = sizeof(u32);
-		break;
-
-	case IPW_ORD_TABLE_2_MASK:
-		/*
-		 * TABLE 2: Indirect access to a table of variable sized values
-		 *
-		 * This table consist of six values, each containing
-		 *     - dword containing the starting offset of the data
-		 *     - dword containing the lengh in the first 16bits
-		 *       and the count in the second 16bits
-		 */
-
-		/* remove the table id from the ordinal */
-		ord &= IPW_ORD_TABLE_VALUE_MASK;
-
-		/* boundary check */
-		if (ord > priv->table2_len) {
-			IPW_DEBUG_ORD("ordinal value too long\n");
-			return -EINVAL;
-		}
-
-		/* get the address of statistic */
-		addr = ipw_read_reg32(priv, priv->table2_addr + (ord << 3));
-
-		/* get the second DW of statistics ;
-		 * two 16-bit words - first is length, second is count */
-		field_info = ipw_read_reg32(priv, priv->table2_addr + (ord << 3) + sizeof(u32));
-
-		/* get each entry length */
-		field_len = *((u16 *)&field_info);
-
-		/* get number of entries */
-		field_count = *(((u16 *)&field_info) + 1);
-
-		/* abort if not enought memory */
-		total_len = field_len * field_count;
-		if (total_len > *len) {
-			*len = total_len;
-			return -EINVAL;
-		}
-
-		*len = total_len;
-		if (!total_len)
-			return 0;
-
-		IPW_DEBUG_ORD("addr = 0x%08x, total_len = %i, "
-			      "field_info = 0x%08x\n",
-			      addr, total_len, field_info);
-		ipw_read_indirect(priv, addr, val, total_len);
-		break;
-
-	default:
-		IPW_DEBUG_ORD("Invalid ordinal!\n");
-		return -EINVAL;
-
-	}
-
-
-	return 0;
-}
-
-static void ipw_init_ordinals(struct ipw_priv *priv)
-{
-	priv->table0_addr = IPW_ORDINALS_TABLE_LOWER;
-	priv->table0_len = ipw_read32(priv, priv->table0_addr);
-
-	IPW_DEBUG_ORD("table 0 offset at 0x%08x, len = %i\n",
-		      priv->table0_addr, priv->table0_len);
-
-	priv->table1_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_1);
-	priv->table1_len = ipw_read_reg32(priv, priv->table1_addr);
-
-	IPW_DEBUG_ORD("table 1 offset at 0x%08x, len = %i\n",
-		      priv->table1_addr, priv->table1_len);
-
-	priv->table2_addr = ipw_read32(priv, IPW_ORDINALS_TABLE_2);
-	priv->table2_len = ipw_read_reg32(priv, priv->table2_addr);
-	priv->table2_len &= 0x0000ffff; /* use first two bytes */
-
-	IPW_DEBUG_ORD("table 2 offset at 0x%08x, len = %i\n",
-		      priv->table2_addr, priv->table2_len);
-
-}
-
-/*
- * The following adds a new attribute to the sysfs representation
- * of this device driver (i.e. a new file in /sys/bus/pci/drivers/ipw/)
- * used for controling the debug level.
- *
- * See the level definitions in ipw for details.
- */
-static ssize_t show_debug_level(struct device_driver *d, char *buf)
-{
-	return sprintf(buf, "0x%08X\n", ipw_debug_level);
-}
-static ssize_t store_debug_level(struct device_driver *d,
-				const char *buf, size_t count)
-{
-	char *p = (char *)buf;
-	u32 val;
-
-	if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
-		p++;
-		if (p[0] == 'x' || p[0] == 'X')
-			p++;
-		val = simple_strtoul(p, &p, 16);
-	} else
-		val = simple_strtoul(p, &p, 10);
-	if (p == buf)
-		printk(KERN_INFO DRV_NAME
-		       ": %s is not in hex or decimal form.\n", buf);
-	else
-		ipw_debug_level = val;
-
-	return strnlen(buf, count);
-}
-
-static DRIVER_ATTR(debug_level, S_IWUSR | S_IRUGO,
-		   show_debug_level, store_debug_level);
-
-static ssize_t show_status(struct device *d,
-			struct device_attribute *attr, char *buf)
-{
-	struct ipw_priv *p = d->driver_data;
-	return sprintf(buf, "0x%08x\n", (int)p->status);
-}
-static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
-
-static ssize_t show_cfg(struct device *d, struct device_attribute *attr,
-			char *buf)
-{
-	struct ipw_priv *p = d->driver_data;
-	return sprintf(buf, "0x%08x\n", (int)p->config);
-}
-static DEVICE_ATTR(cfg, S_IRUGO, show_cfg, NULL);
-
-static ssize_t show_nic_type(struct device *d,
-			struct device_attribute *attr, char *buf)
-{
-	struct ipw_priv *p = d->driver_data;
-	u8 type = p->eeprom[EEPROM_NIC_TYPE];
-
-	switch (type) {
-	case EEPROM_NIC_TYPE_STANDARD:
-		return sprintf(buf, "STANDARD\n");
-	case EEPROM_NIC_TYPE_DELL:
-		return sprintf(buf, "DELL\n");
-	case EEPROM_NIC_TYPE_FUJITSU:
-		return sprintf(buf, "FUJITSU\n");
-	case EEPROM_NIC_TYPE_IBM:
-		return sprintf(buf, "IBM\n");
-	case EEPROM_NIC_TYPE_HP:
-		return sprintf(buf, "HP\n");
-	}
-
-	return sprintf(buf, "UNKNOWN\n");
-}
-static DEVICE_ATTR(nic_type, S_IRUGO, show_nic_type, NULL);
-
-static ssize_t dump_error_log(struct device *d,
-		struct device_attribute *attr, const char *buf, size_t count)
-{
-	char *p = (char *)buf;
-
-	if (p[0] == '1')
-		ipw_dump_nic_error_log((struct ipw_priv*)d->driver_data);
-
-	return strnlen(buf, count);
-}
-static DEVICE_ATTR(dump_errors, S_IWUSR, NULL, dump_error_log);
-
-static ssize_t dump_event_log(struct device *d,
-		struct device_attribute *attr, const char *buf, size_t count)
-{
-	char *p = (char *)buf;
-
-	if (p[0] == '1')
-		ipw_dump_nic_event_log((struct ipw_priv*)d->driver_data);
-
-	return strnlen(buf, count);
-}
-static DEVICE_ATTR(dump_events, S_IWUSR, NULL, dump_event_log);
-
-static ssize_t show_ucode_version(struct device *d,
-			struct device_attribute *attr, char *buf)
-{
-	u32 len = sizeof(u32), tmp = 0;
-	struct ipw_priv *p = d->driver_data;
-
-	if(ipw_get_ordinal(p, IPW_ORD_STAT_UCODE_VERSION, &tmp, &len))
-		return 0;
-
-	return sprintf(buf, "0x%08x\n", tmp);
-}
-static DEVICE_ATTR(ucode_version, S_IWUSR|S_IRUGO, show_ucode_version, NULL);
-
-static ssize_t show_rtc(struct device *d, struct device_attribute *attr,
-			char *buf)
-{
-	u32 len = sizeof(u32), tmp = 0;
-	struct ipw_priv *p = d->driver_data;
-
-	if(ipw_get_ordinal(p, IPW_ORD_STAT_RTC, &tmp, &len))
-		return 0;
-
-	return sprintf(buf, "0x%08x\n", tmp);
-}
-static DEVICE_ATTR(rtc, S_IWUSR|S_IRUGO, show_rtc, NULL);
-
-/*
- * Add a device attribute to view/control the delay between eeprom
- * operations.
- */
-static ssize_t show_eeprom_delay(struct device *d,
-			struct device_attribute *attr, char *buf)
-{
-	int n = ((struct ipw_priv*)d->driver_data)->eeprom_delay;
-	return sprintf(buf, "%i\n", n);
-}
-static ssize_t store_eeprom_delay(struct device *d,
-			struct device_attribute *attr, const char *buf,
-			size_t count)
-{
-	struct ipw_priv *p = d->driver_data;
-	sscanf(buf, "%i", &p->eeprom_delay);
-	return strnlen(buf, count);
-}
-static DEVICE_ATTR(eeprom_delay, S_IWUSR|S_IRUGO,
-		   show_eeprom_delay,store_eeprom_delay);
-
-static ssize_t show_command_event_reg(struct device *d,
-			struct device_attribute *attr, char *buf)
-{
-	u32 reg = 0;
-	struct ipw_priv *p = d->driver_data;
-
-	reg = ipw_read_reg32(p, CX2_INTERNAL_CMD_EVENT);
-	return sprintf(buf, "0x%08x\n", reg);
-}
-static ssize_t store_command_event_reg(struct device *d,
-				struct device_attribute *attr, const char *buf,
-				size_t count)
-{
-	u32 reg;
-	struct ipw_priv *p = d->driver_data;
-
-	sscanf(buf, "%x", &reg);
-	ipw_write_reg32(p, CX2_INTERNAL_CMD_EVENT, reg);
-	return strnlen(buf, count);
-}
-static DEVICE_ATTR(command_event_reg, S_IWUSR|S_IRUGO,
-		   show_command_event_reg,store_command_event_reg);
-
-static ssize_t show_mem_gpio_reg(struct device *d,
-				struct device_attribute *attr, char *buf)
-{
-	u32 reg = 0;
-	struct ipw_priv *p = d->driver_data;
-
-	reg = ipw_read_reg32(p, 0x301100);
-	return sprintf(buf, "0x%08x\n", reg);
-}
-static ssize_t store_mem_gpio_reg(struct device *d,
-			struct device_attribute *attr, const char *buf,
-			size_t count)
-{
-	u32 reg;
-	struct ipw_priv *p = d->driver_data;
-
-	sscanf(buf, "%x", &reg);
-	ipw_write_reg32(p, 0x301100, reg);
-	return strnlen(buf, count);
-}
-static DEVICE_ATTR(mem_gpio_reg, S_IWUSR|S_IRUGO,
-		   show_mem_gpio_reg,store_mem_gpio_reg);
-
-static ssize_t show_indirect_dword(struct device *d,
-				struct device_attribute *attr, char *buf)
-{
-	u32 reg = 0;
-	struct ipw_priv *priv = d->driver_data;
-	if (priv->status & STATUS_INDIRECT_DWORD)
-		reg = ipw_read_reg32(priv, priv->indirect_dword);
-	else
-		reg = 0;
-
-	return sprintf(buf, "0x%08x\n", reg);
-}
-static ssize_t store_indirect_dword(struct device *d,
-				struct device_attribute *attr, const char *buf,
-				size_t count)
-{
-	struct ipw_priv *priv = d->driver_data;
-
-	sscanf(buf, "%x", &priv->indirect_dword);
-	priv->status |= STATUS_INDIRECT_DWORD;
-	return strnlen(buf, count);
-}
-static DEVICE_ATTR(indirect_dword, S_IWUSR|S_IRUGO,
-		   show_indirect_dword,store_indirect_dword);
-
-static ssize_t show_indirect_byte(struct device *d,
-			struct device_attribute *attr, char *buf)
-{
-	u8 reg = 0;
-	struct ipw_priv *priv = d->driver_data;
-	if (priv->status & STATUS_INDIRECT_BYTE)
-		reg = ipw_read_reg8(priv, priv->indirect_byte);
-	else
-		reg = 0;
-
-	return sprintf(buf, "0x%02x\n", reg);
-}
-static ssize_t store_indirect_byte(struct device *d,
-				struct device_attribute *attr, const char *buf,
-				size_t count)
-{
-	struct ipw_priv *priv = d->driver_data;
-
-	sscanf(buf, "%x", &priv->indirect_byte);
-	priv->status |= STATUS_INDIRECT_BYTE;
-	return strnlen(buf, count);
-}
-static DEVICE_ATTR(indirect_byte, S_IWUSR|S_IRUGO,
-		   show_indirect_byte, store_indirect_byte);
-
-static ssize_t show_direct_dword(struct device *d,
-				struct device_attribute *attr, char *buf)
-{
-	u32 reg = 0;
-	struct ipw_priv *priv = d->driver_data;
-
-	if (priv->status & STATUS_DIRECT_DWORD)
-		reg = ipw_read32(priv, priv->direct_dword);
-	else
-		reg = 0;
-
-	return sprintf(buf, "0x%08x\n", reg);
-}
-static ssize_t store_direct_dword(struct device *d,
-			struct device_attribute *attr, const char *buf,
-			size_t count)
-{
-	struct ipw_priv *priv = d->driver_data;
-
-	sscanf(buf, "%x", &priv->direct_dword);
-	priv->status |= STATUS_DIRECT_DWORD;
-	return strnlen(buf, count);
-}
-static DEVICE_ATTR(direct_dword, S_IWUSR|S_IRUGO,
-		   show_direct_dword,store_direct_dword);
-
-
-static inline int rf_kill_active(struct ipw_priv *priv)
-{
-	if (0 == (ipw_read32(priv, 0x30) & 0x10000))
-		priv->status |= STATUS_RF_KILL_HW;
-	else
-		priv->status &= ~STATUS_RF_KILL_HW;
-
-	return (priv->status & STATUS_RF_KILL_HW) ? 1 : 0;
-}
-
-static ssize_t show_rf_kill(struct device *d, struct device_attribute *attr,
-				char *buf)
-{
-	/* 0 - RF kill not enabled
-	   1 - SW based RF kill active (sysfs)
-	   2 - HW based RF kill active
-	   3 - Both HW and SW baed RF kill active */
-	struct ipw_priv *priv = d->driver_data;
-	int val = ((priv->status & STATUS_RF_KILL_SW) ? 0x1 : 0x0) |
-		(rf_kill_active(priv) ? 0x2 : 0x0);
-	return sprintf(buf, "%i\n", val);
-}
-
-static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
-{
-	if ((disable_radio ? 1 : 0) ==
-	    (priv->status & STATUS_RF_KILL_SW ? 1 : 0))
-		return 0 ;
-
-	IPW_DEBUG_RF_KILL("Manual SW RF Kill set to: RADIO  %s\n",
-			  disable_radio ? "OFF" : "ON");
-
-	if (disable_radio) {
-		priv->status |= STATUS_RF_KILL_SW;
-
-		if (priv->workqueue) {
-			cancel_delayed_work(&priv->request_scan);
-		}
-		wake_up_interruptible(&priv->wait_command_queue);
-		queue_work(priv->workqueue, &priv->down);
-	} else {
-		priv->status &= ~STATUS_RF_KILL_SW;
-		if (rf_kill_active(priv)) {
-			IPW_DEBUG_RF_KILL("Can not turn radio back on - "
-					  "disabled by HW switch\n");
-			/* Make sure the RF_KILL check timer is running */
-			cancel_delayed_work(&priv->rf_kill);
-			queue_delayed_work(priv->workqueue, &priv->rf_kill,
-					   2 * HZ);
-		} else
-			queue_work(priv->workqueue, &priv->up);
-	}
-
-	return 1;
-}
-
-static ssize_t store_rf_kill(struct device *d,  struct device_attribute *attr,
-				const char *buf, size_t count)
-{
-	struct ipw_priv *priv = d->driver_data;
-
-	ipw_radio_kill_sw(priv, buf[0] == '1');
-
-	return count;
-}
-static DEVICE_ATTR(rf_kill, S_IWUSR|S_IRUGO, show_rf_kill, store_rf_kill);
-
-static void ipw_irq_tasklet(struct ipw_priv *priv)
-{
-	u32 inta, inta_mask, handled = 0;
-	unsigned long flags;
-	int rc = 0;
-
-	spin_lock_irqsave(&priv->lock, flags);
-
-	inta = ipw_read32(priv, CX2_INTA_RW);
-	inta_mask = ipw_read32(priv, CX2_INTA_MASK_R);
-	inta &= (CX2_INTA_MASK_ALL & inta_mask);
-
-	/* Add any cached INTA values that need to be handled */
-	inta |= priv->isr_inta;
-
-	/* handle all the justifications for the interrupt */
-	if (inta & CX2_INTA_BIT_RX_TRANSFER) {
-		ipw_rx(priv);
-		handled |= CX2_INTA_BIT_RX_TRANSFER;
-	}
-
-	if (inta & CX2_INTA_BIT_TX_CMD_QUEUE) {
-		IPW_DEBUG_HC("Command completed.\n");
-		rc = ipw_queue_tx_reclaim( priv, &priv->txq_cmd, -1);
-		priv->status &= ~STATUS_HCMD_ACTIVE;
-		wake_up_interruptible(&priv->wait_command_queue);
-		handled |= CX2_INTA_BIT_TX_CMD_QUEUE;
-	}
-
-	if (inta & CX2_INTA_BIT_TX_QUEUE_1) {
-		IPW_DEBUG_TX("TX_QUEUE_1\n");
-		rc = ipw_queue_tx_reclaim( priv, &priv->txq[0], 0);
-		handled |= CX2_INTA_BIT_TX_QUEUE_1;
-	}
-
-	if (inta & CX2_INTA_BIT_TX_QUEUE_2) {
-		IPW_DEBUG_TX("TX_QUEUE_2\n");
-		rc = ipw_queue_tx_reclaim( priv, &priv->txq[1], 1);
-		handled |= CX2_INTA_BIT_TX_QUEUE_2;
-	}
-
-	if (inta & CX2_INTA_BIT_TX_QUEUE_3) {
-		IPW_DEBUG_TX("TX_QUEUE_3\n");
-		rc = ipw_queue_tx_reclaim( priv, &priv->txq[2], 2);
-		handled |= CX2_INTA_BIT_TX_QUEUE_3;
-	}
-
-	if (inta & CX2_INTA_BIT_TX_QUEUE_4) {
-		IPW_DEBUG_TX("TX_QUEUE_4\n");
-		rc = ipw_queue_tx_reclaim( priv, &priv->txq[3], 3);
-		handled |= CX2_INTA_BIT_TX_QUEUE_4;
-	}
-
-	if (inta & CX2_INTA_BIT_STATUS_CHANGE) {
-		IPW_WARNING("STATUS_CHANGE\n");
-		handled |= CX2_INTA_BIT_STATUS_CHANGE;
-	}
-
-	if (inta & CX2_INTA_BIT_BEACON_PERIOD_EXPIRED) {
-		IPW_WARNING("TX_PERIOD_EXPIRED\n");
-		handled |= CX2_INTA_BIT_BEACON_PERIOD_EXPIRED;
-	}
-
-	if (inta & CX2_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE) {
-		IPW_WARNING("HOST_CMD_DONE\n");
-		handled |= CX2_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE;
-	}
-
-	if (inta & CX2_INTA_BIT_FW_INITIALIZATION_DONE) {
-		IPW_WARNING("FW_INITIALIZATION_DONE\n");
-		handled |= CX2_INTA_BIT_FW_INITIALIZATION_DONE;
-	}
-
-	if (inta & CX2_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE) {
-		IPW_WARNING("PHY_OFF_DONE\n");
-		handled |= CX2_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE;
-	}
-
-	if (inta & CX2_INTA_BIT_RF_KILL_DONE) {
-		IPW_DEBUG_RF_KILL("RF_KILL_DONE\n");
-		priv->status |= STATUS_RF_KILL_HW;
-		wake_up_interruptible(&priv->wait_command_queue);
-		netif_carrier_off(priv->net_dev);
-		netif_stop_queue(priv->net_dev);
-		cancel_delayed_work(&priv->request_scan);
-		queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
-		handled |= CX2_INTA_BIT_RF_KILL_DONE;
-	}
-
-	if (inta & CX2_INTA_BIT_FATAL_ERROR) {
-		IPW_ERROR("Firmware error detected.  Restarting.\n");
-#ifdef CONFIG_IPW_DEBUG
-		if (ipw_debug_level & IPW_DL_FW_ERRORS) {
-			ipw_dump_nic_error_log(priv);
-			ipw_dump_nic_event_log(priv);
-		}
-#endif
-		queue_work(priv->workqueue, &priv->adapter_restart);
-		handled |= CX2_INTA_BIT_FATAL_ERROR;
-	}
-
-	if (inta & CX2_INTA_BIT_PARITY_ERROR) {
-		IPW_ERROR("Parity error\n");
-		handled |= CX2_INTA_BIT_PARITY_ERROR;
-	}
-
-	if (handled != inta) {
-		IPW_ERROR("Unhandled INTA bits 0x%08x\n",
-				inta & ~handled);
-	}
-
-	/* enable all interrupts */
-	ipw_enable_interrupts(priv);
-
-	spin_unlock_irqrestore(&priv->lock, flags);
-}
-
-#ifdef CONFIG_IPW_DEBUG
-#define IPW_CMD(x) case IPW_CMD_ ## x : return #x
-static char *get_cmd_string(u8 cmd)
-{
-	switch (cmd) {
-		IPW_CMD(HOST_COMPLETE);
-		IPW_CMD(POWER_DOWN);
-		IPW_CMD(SYSTEM_CONFIG);
-		IPW_CMD(MULTICAST_ADDRESS);
-		IPW_CMD(SSID);
-		IPW_CMD(ADAPTER_ADDRESS);
-		IPW_CMD(PORT_TYPE);
-		IPW_CMD(RTS_THRESHOLD);
-		IPW_CMD(FRAG_THRESHOLD);
-		IPW_CMD(POWER_MODE);
-		IPW_CMD(WEP_KEY);
-		IPW_CMD(TGI_TX_KEY);
-		IPW_CMD(SCAN_REQUEST);
-		IPW_CMD(SCAN_REQUEST_EXT);
-		IPW_CMD(ASSOCIATE);
-		IPW_CMD(SUPPORTED_RATES);
-		IPW_CMD(SCAN_ABORT);
-		IPW_CMD(TX_FLUSH);
-		IPW_CMD(QOS_PARAMETERS);
-		IPW_CMD(DINO_CONFIG);
-		IPW_CMD(RSN_CAPABILITIES);
-		IPW_CMD(RX_KEY);
-		IPW_CMD(CARD_DISABLE);
-		IPW_CMD(SEED_NUMBER);
-		IPW_CMD(TX_POWER);
-		IPW_CMD(COUNTRY_INFO);
-		IPW_CMD(AIRONET_INFO);
-		IPW_CMD(AP_TX_POWER);
-		IPW_CMD(CCKM_INFO);
-		IPW_CMD(CCX_VER_INFO);
-		IPW_CMD(SET_CALIBRATION);
-		IPW_CMD(SENSITIVITY_CALIB);
-		IPW_CMD(RETRY_LIMIT);
-		IPW_CMD(IPW_PRE_POWER_DOWN);
-		IPW_CMD(VAP_BEACON_TEMPLATE);
-		IPW_CMD(VAP_DTIM_PERIOD);
-		IPW_CMD(EXT_SUPPORTED_RATES);
-		IPW_CMD(VAP_LOCAL_TX_PWR_CONSTRAINT);
-		IPW_CMD(VAP_QUIET_INTERVALS);
-		IPW_CMD(VAP_CHANNEL_SWITCH);
-		IPW_CMD(VAP_MANDATORY_CHANNELS);
-		IPW_CMD(VAP_CELL_PWR_LIMIT);
-		IPW_CMD(VAP_CF_PARAM_SET);
-		IPW_CMD(VAP_SET_BEACONING_STATE);
-		IPW_CMD(MEASUREMENT);
-		IPW_CMD(POWER_CAPABILITY);
-		IPW_CMD(SUPPORTED_CHANNELS);
-		IPW_CMD(TPC_REPORT);
-		IPW_CMD(WME_INFO);
-		IPW_CMD(PRODUCTION_COMMAND);
-	default:
-		return "UNKNOWN";
-	}
-}
-#endif /* CONFIG_IPW_DEBUG */
-
-#define HOST_COMPLETE_TIMEOUT HZ
-static int ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
-{
-	int rc = 0;
-
-	if (priv->status & STATUS_HCMD_ACTIVE) {
-		IPW_ERROR("Already sending a command\n");
-		return -1;
-	}
-
-	priv->status |= STATUS_HCMD_ACTIVE;
-
-	IPW_DEBUG_HC("Sending %s command (#%d), %d bytes\n",
-		     get_cmd_string(cmd->cmd), cmd->cmd, cmd->len);
-	printk_buf(IPW_DL_HOST_COMMAND, (u8*)cmd->param, cmd->len);
-
-	rc = ipw_queue_tx_hcmd(priv, cmd->cmd, &cmd->param, cmd->len, 0);
-	if (rc)
-		return rc;
-
-	rc = wait_event_interruptible_timeout(
-		priv->wait_command_queue, !(priv->status & STATUS_HCMD_ACTIVE),
-		HOST_COMPLETE_TIMEOUT);
-	if (rc == 0) {
-		IPW_DEBUG_INFO("Command completion failed out after %dms.\n",
-			       jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
-		priv->status &= ~STATUS_HCMD_ACTIVE;
-		return -EIO;
-	}
-	if (priv->status & STATUS_RF_KILL_MASK) {
-		IPW_DEBUG_INFO("Command aborted due to RF Kill Switch\n");
-		return -EIO;
-	}
-
-	return 0;
-}
-
-static int ipw_send_host_complete(struct ipw_priv *priv)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_HOST_COMPLETE,
-		.len = 0
-	};
-
-	if (!priv) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send HOST_COMPLETE command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_send_system_config(struct ipw_priv *priv,
-				  struct ipw_sys_config *config)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_SYSTEM_CONFIG,
-		.len = sizeof(*config)
-	};
-
-	if (!priv || !config) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	memcpy(&cmd.param,config,sizeof(*config));
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send SYSTEM_CONFIG command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_send_ssid(struct ipw_priv *priv, u8 *ssid, int len)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_SSID,
-		.len = min(len, IW_ESSID_MAX_SIZE)
-	};
-
-	if (!priv || !ssid) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	memcpy(&cmd.param, ssid, cmd.len);
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send SSID command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_send_adapter_address(struct ipw_priv *priv, u8 *mac)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_ADAPTER_ADDRESS,
-		.len = ETH_ALEN
-	};
-
-	if (!priv || !mac) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	IPW_DEBUG_INFO("%s: Setting MAC to " MAC_FMT "\n",
-		       priv->net_dev->name, MAC_ARG(mac));
-
-	memcpy(&cmd.param, mac, ETH_ALEN);
-
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send ADAPTER_ADDRESS command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static void ipw_adapter_restart(void *adapter)
-{
-	struct ipw_priv *priv = adapter;
-
-	if (priv->status & STATUS_RF_KILL_MASK)
-		return;
-
-	ipw_down(priv);
-	if (ipw_up(priv)) {
-		IPW_ERROR("Failed to up device\n");
-		return;
-	}
-}
-
-
-
-
-#define IPW_SCAN_CHECK_WATCHDOG (5 * HZ)
-
-static void ipw_scan_check(void *data)
-{
-	struct ipw_priv *priv = data;
-	if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
-		IPW_DEBUG_SCAN("Scan completion watchdog resetting "
-			       "adapter (%dms).\n",
-			       IPW_SCAN_CHECK_WATCHDOG / 100);
-		ipw_adapter_restart(priv);
-	}
-}
-
-static int ipw_send_scan_request_ext(struct ipw_priv *priv,
-				     struct ipw_scan_request_ext *request)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_SCAN_REQUEST_EXT,
-		.len = sizeof(*request)
-	};
-
-	if (!priv || !request) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	memcpy(&cmd.param,request,sizeof(*request));
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send SCAN_REQUEST_EXT command\n");
-		return -1;
-	}
-
-	queue_delayed_work(priv->workqueue, &priv->scan_check,
-			   IPW_SCAN_CHECK_WATCHDOG);
-	return 0;
-}
-
-static int ipw_send_scan_abort(struct ipw_priv *priv)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_SCAN_ABORT,
-		.len = 0
-	};
-
-	if (!priv) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send SCAN_ABORT command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_set_sensitivity(struct ipw_priv *priv, u16 sens)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_SENSITIVITY_CALIB,
-		.len = sizeof(struct ipw_sensitivity_calib)
-	};
-	struct ipw_sensitivity_calib *calib = (struct ipw_sensitivity_calib *)
-		&cmd.param;
-	calib->beacon_rssi_raw = sens;
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send SENSITIVITY CALIB command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_send_associate(struct ipw_priv *priv,
-			      struct ipw_associate *associate)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_ASSOCIATE,
-		.len = sizeof(*associate)
-	};
-
-	if (!priv || !associate) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	memcpy(&cmd.param,associate,sizeof(*associate));
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send ASSOCIATE command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_send_supported_rates(struct ipw_priv *priv,
-				    struct ipw_supported_rates *rates)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_SUPPORTED_RATES,
-		.len = sizeof(*rates)
-	};
-
-	if (!priv || !rates) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	memcpy(&cmd.param,rates,sizeof(*rates));
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send SUPPORTED_RATES command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_set_random_seed(struct ipw_priv *priv)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_SEED_NUMBER,
-		.len = sizeof(u32)
-	};
-
-	if (!priv) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	get_random_bytes(&cmd.param, sizeof(u32));
-
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send SEED_NUMBER command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-#if 0
-static int ipw_send_card_disable(struct ipw_priv *priv, u32 phy_off)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_CARD_DISABLE,
-		.len = sizeof(u32)
-	};
-
-	if (!priv) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	*((u32*)&cmd.param) = phy_off;
-
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send CARD_DISABLE command\n");
-		return -1;
-	}
-
-	return 0;
-}
-#endif
-
-static int ipw_send_tx_power(struct ipw_priv *priv,
-			     struct ipw_tx_power *power)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_TX_POWER,
-		.len = sizeof(*power)
-	};
-
-	if (!priv || !power) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	memcpy(&cmd.param,power,sizeof(*power));
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send TX_POWER command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_send_rts_threshold(struct ipw_priv *priv, u16 rts)
-{
-	struct ipw_rts_threshold rts_threshold = {
-		.rts_threshold = rts,
-	};
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_RTS_THRESHOLD,
-		.len = sizeof(rts_threshold)
-	};
-
-	if (!priv) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	memcpy(&cmd.param, &rts_threshold, sizeof(rts_threshold));
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send RTS_THRESHOLD command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_send_frag_threshold(struct ipw_priv *priv, u16 frag)
-{
-	struct ipw_frag_threshold frag_threshold = {
-		.frag_threshold = frag,
-	};
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_FRAG_THRESHOLD,
-		.len = sizeof(frag_threshold)
-	};
-
-	if (!priv) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	memcpy(&cmd.param, &frag_threshold, sizeof(frag_threshold));
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send FRAG_THRESHOLD command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int ipw_send_power_mode(struct ipw_priv *priv, u32 mode)
-{
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_POWER_MODE,
-		.len = sizeof(u32)
-	};
-	u32 *param = (u32*)(&cmd.param);
-
-	if (!priv) {
-		IPW_ERROR("Invalid args\n");
-		return -1;
-	}
-
-	/* If on battery, set to 3, if AC set to CAM, else user
-	 * level */
-	switch (mode) {
-	case IPW_POWER_BATTERY:
-		*param = IPW_POWER_INDEX_3;
-		break;
-	case IPW_POWER_AC:
-		*param = IPW_POWER_MODE_CAM;
-		break;
-	default:
-		*param = mode;
-		break;
-	}
-
-	if (ipw_send_cmd(priv, &cmd)) {
-		IPW_ERROR("failed to send POWER_MODE command\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-/*
- * The IPW device contains a Microwire compatible EEPROM that stores
- * various data like the MAC address.  Usually the firmware has exclusive
- * access to the eeprom, but during device initialization (before the
- * device driver has sent the HostComplete command to the firmware) the
- * device driver has read access to the EEPROM by way of indirect addressing
- * through a couple of memory mapped registers.
- *
- * The following is a simplified implementation for pulling data out of the
- * the eeprom, along with some helper functions to find information in
- * the per device private data's copy of the eeprom.
- *
- * NOTE: To better understand how these functions work (i.e what is a chip
- *       select and why do have to keep driving the eeprom clock?), read
- *       just about any data sheet for a Microwire compatible EEPROM.
- */
-
-/* write a 32 bit value into the indirect accessor register */
-static inline void eeprom_write_reg(struct ipw_priv *p, u32 data)
-{
-	ipw_write_reg32(p, FW_MEM_REG_EEPROM_ACCESS, data);
-
-	/* the eeprom requires some time to complete the operation */
-	udelay(p->eeprom_delay);
-
-	return;
-}
-
-/* perform a chip select operation */
-static inline void eeprom_cs(struct ipw_priv* priv)
-{
-	eeprom_write_reg(priv,0);
-	eeprom_write_reg(priv,EEPROM_BIT_CS);
-	eeprom_write_reg(priv,EEPROM_BIT_CS|EEPROM_BIT_SK);
-	eeprom_write_reg(priv,EEPROM_BIT_CS);
-}
-
-/* perform a chip select operation */
-static inline void eeprom_disable_cs(struct ipw_priv* priv)
-{
-	eeprom_write_reg(priv,EEPROM_BIT_CS);
-	eeprom_write_reg(priv,0);
-	eeprom_write_reg(priv,EEPROM_BIT_SK);
-}
-
-/* push a single bit down to the eeprom */
-static inline void eeprom_write_bit(struct ipw_priv *p,u8 bit)
-{
-	int d = ( bit ? EEPROM_BIT_DI : 0);
-	eeprom_write_reg(p,EEPROM_BIT_CS|d);
-	eeprom_write_reg(p,EEPROM_BIT_CS|d|EEPROM_BIT_SK);
-}
-
-/* push an opcode followed by an address down to the eeprom */
-static void eeprom_op(struct ipw_priv* priv, u8 op, u8 addr)
-{
-	int i;
-
-	eeprom_cs(priv);
-	eeprom_write_bit(priv,1);
-	eeprom_write_bit(priv,op&2);
-	eeprom_write_bit(priv,op&1);
-	for ( i=7; i>=0; i-- ) {
-		eeprom_write_bit(priv,addr&(1<<i));
-	}
-}
-
-/* pull 16 bits off the eeprom, one bit at a time */
-static u16 eeprom_read_u16(struct ipw_priv* priv, u8 addr)
-{
-	int i;
-	u16 r=0;
-
-	/* Send READ Opcode */
-	eeprom_op(priv,EEPROM_CMD_READ,addr);
-
-	/* Send dummy bit */
-	eeprom_write_reg(priv,EEPROM_BIT_CS);
-
-	/* Read the byte off the eeprom one bit at a time */
-	for ( i=0; i<16; i++ ) {
-		u32 data = 0;
-		eeprom_write_reg(priv,EEPROM_BIT_CS|EEPROM_BIT_SK);
-		eeprom_write_reg(priv,EEPROM_BIT_CS);
-		data = ipw_read_reg32(priv,FW_MEM_REG_EEPROM_ACCESS);
-		r = (r<<1) | ((data & EEPROM_BIT_DO)?1:0);
-	}
-
-	/* Send another dummy bit */
-	eeprom_write_reg(priv,0);
-	eeprom_disable_cs(priv);
-
-	return r;
-}
-
-/* helper function for pulling the mac address out of the private */
-/* data's copy of the eeprom data                                 */
-static void eeprom_parse_mac(struct ipw_priv* priv, u8* mac)
-{
-	u8* ee = (u8*)priv->eeprom;
-	memcpy(mac, &ee[EEPROM_MAC_ADDRESS], 6);
-}
-
-/*
- * Either the device driver (i.e. the host) or the firmware can
- * load eeprom data into the designated region in SRAM.  If neither
- * happens then the FW will shutdown with a fatal error.
- *
- * In order to signal the FW to load the EEPROM, the EEPROM_LOAD_DISABLE
- * bit needs region of shared SRAM needs to be non-zero.
- */
-static void ipw_eeprom_init_sram(struct ipw_priv *priv)
-{
-	int i;
-	u16 *eeprom = (u16 *)priv->eeprom;
-
-	IPW_DEBUG_TRACE(">>\n");
-
-	/* read entire contents of eeprom into private buffer */
-	for ( i=0; i<128; i++ )
-		eeprom[i] = eeprom_read_u16(priv,(u8)i);
-
-	/*
-	   If the data looks correct, then copy it to our private
-	   copy.  Otherwise let the firmware know to perform the operation
-	   on it's own
-	*/
-	if ((priv->eeprom + EEPROM_VERSION) != 0) {
-		IPW_DEBUG_INFO("Writing EEPROM data into SRAM\n");
-
-		/* write the eeprom data to sram */
-		for( i=0; i<CX2_EEPROM_IMAGE_SIZE; i++ )
-			ipw_write8(priv, IPW_EEPROM_DATA + i,
-				   priv->eeprom[i]);
-
-		/* Do not load eeprom data on fatal error or suspend */
-		ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
-	} else {
-		IPW_DEBUG_INFO("Enabling FW initializationg of SRAM\n");
-
-		/* Load eeprom data on fatal error or suspend */
-		ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 1);
-	}
-
-	IPW_DEBUG_TRACE("<<\n");
-}
-
-
-static inline void ipw_zero_memory(struct ipw_priv *priv, u32 start, u32 count)
-{
-	count >>= 2;
-	if (!count) return;
-	_ipw_write32(priv, CX2_AUTOINC_ADDR, start);
-	while (count--)
-		_ipw_write32(priv, CX2_AUTOINC_DATA, 0);
-}
-
-static inline void ipw_fw_dma_reset_command_blocks(struct ipw_priv *priv)
-{
-	ipw_zero_memory(priv, CX2_SHARED_SRAM_DMA_CONTROL,
-			CB_NUMBER_OF_ELEMENTS_SMALL *
-			sizeof(struct command_block));
-}
-
-static int ipw_fw_dma_enable(struct ipw_priv *priv)
-{ /* start dma engine but no transfers yet*/
-
-	IPW_DEBUG_FW(">> : \n");
-
-	/* Start the dma */
-	ipw_fw_dma_reset_command_blocks(priv);
-
-	/* Write CB base address */
-	ipw_write_reg32(priv, CX2_DMA_I_CB_BASE, CX2_SHARED_SRAM_DMA_CONTROL);
-
-	IPW_DEBUG_FW("<< : \n");
-	return 0;
-}
-
-static void ipw_fw_dma_abort(struct ipw_priv *priv)
-{
-	u32 control = 0;
-
-	IPW_DEBUG_FW(">> :\n");
-
-	//set the Stop and Abort bit
-	control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_STOP_AND_ABORT;
-	ipw_write_reg32(priv, CX2_DMA_I_DMA_CONTROL, control);
-	priv->sram_desc.last_cb_index = 0;
-
-	IPW_DEBUG_FW("<< \n");
-}
-
-static int ipw_fw_dma_write_command_block(struct ipw_priv *priv, int index, struct command_block *cb)
-{
-	u32 address = CX2_SHARED_SRAM_DMA_CONTROL + (sizeof(struct command_block) * index);
-	IPW_DEBUG_FW(">> :\n");
-
-	ipw_write_indirect(priv, address, (u8*)cb, (int)sizeof(struct command_block));
-
-	IPW_DEBUG_FW("<< :\n");
-	return 0;
-
-}
-
-static int ipw_fw_dma_kick(struct ipw_priv *priv)
-{
-	u32 control = 0;
-	u32 index=0;
-
-	IPW_DEBUG_FW(">> :\n");
-
-	for (index = 0; index < priv->sram_desc.last_cb_index; index++)
-		ipw_fw_dma_write_command_block(priv, index, &priv->sram_desc.cb_list[index]);
-
-	/* Enable the DMA in the CSR register */
-	ipw_clear_bit(priv, CX2_RESET_REG,CX2_RESET_REG_MASTER_DISABLED | CX2_RESET_REG_STOP_MASTER);
-
-        /* Set the Start bit. */
-	control = DMA_CONTROL_SMALL_CB_CONST_VALUE | DMA_CB_START;
-	ipw_write_reg32(priv, CX2_DMA_I_DMA_CONTROL, control);
-
-	IPW_DEBUG_FW("<< :\n");
-	return 0;
-}
-
-static void ipw_fw_dma_dump_command_block(struct ipw_priv *priv)
-{
-	u32 address;
-	u32 register_value=0;
-	u32 cb_fields_address=0;
-
-	IPW_DEBUG_FW(">> :\n");
-	address = ipw_read_reg32(priv,CX2_DMA_I_CURRENT_CB);
-	IPW_DEBUG_FW_INFO("Current CB is 0x%x \n",address);
-
-	/* Read the DMA Controlor register */
-	register_value = ipw_read_reg32(priv, CX2_DMA_I_DMA_CONTROL);
-	IPW_DEBUG_FW_INFO("CX2_DMA_I_DMA_CONTROL is 0x%x \n",register_value);
-
-	/* Print the CB values*/
-	cb_fields_address = address;
-	register_value = ipw_read_reg32(priv, cb_fields_address);
-	IPW_DEBUG_FW_INFO("Current CB ControlField is 0x%x \n",register_value);
-
-	cb_fields_address += sizeof(u32);
-	register_value = ipw_read_reg32(priv, cb_fields_address);
-	IPW_DEBUG_FW_INFO("Current CB Source Field is 0x%x \n",register_value);
-
-	cb_fields_address += sizeof(u32);
-	register_value = ipw_read_reg32(priv, cb_fields_address);
-	IPW_DEBUG_FW_INFO("Current CB Destination Field is 0x%x \n",
-			  register_value);
-
-	cb_fields_address += sizeof(u32);
-	register_value = ipw_read_reg32(priv, cb_fields_address);
-	IPW_DEBUG_FW_INFO("Current CB Status Field is 0x%x \n",register_value);
-
-	IPW_DEBUG_FW(">> :\n");
-}
-
-static int ipw_fw_dma_command_block_index(struct ipw_priv *priv)
-{
-	u32 current_cb_address = 0;
-	u32 current_cb_index = 0;
-
-	IPW_DEBUG_FW("<< :\n");
-	current_cb_address= ipw_read_reg32(priv, CX2_DMA_I_CURRENT_CB);
-
-	current_cb_index = (current_cb_address - CX2_SHARED_SRAM_DMA_CONTROL )/
-		sizeof (struct command_block);
-
-	IPW_DEBUG_FW_INFO("Current CB index 0x%x address = 0x%X \n",
-			  current_cb_index, current_cb_address );
-
-	IPW_DEBUG_FW(">> :\n");
-	return current_cb_index;
-
-}
-
-static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
-					u32 src_address,
-					u32 dest_address,
-					u32 length,
-					int interrupt_enabled,
-					int is_last)
-{
-
-	u32 control = CB_VALID | CB_SRC_LE | CB_DEST_LE | CB_SRC_AUTOINC |
-		CB_SRC_IO_GATED | CB_DEST_AUTOINC | CB_SRC_SIZE_LONG |
-		CB_DEST_SIZE_LONG;
-	struct command_block *cb;
-	u32 last_cb_element=0;
-
-	IPW_DEBUG_FW_INFO("src_address=0x%x dest_address=0x%x length=0x%x\n",
-			  src_address, dest_address, length);
-
-	if (priv->sram_desc.last_cb_index >= CB_NUMBER_OF_ELEMENTS_SMALL)
-		return -1;
-
-	last_cb_element = priv->sram_desc.last_cb_index;
-	cb = &priv->sram_desc.cb_list[last_cb_element];
-	priv->sram_desc.last_cb_index++;
-
-	/* Calculate the new CB control word */
-	if (interrupt_enabled )
-		control |= CB_INT_ENABLED;
-
-	if (is_last)
-		control |= CB_LAST_VALID;
-
-	control |= length;
-
-	/* Calculate the CB Element's checksum value */
-	cb->status = control ^src_address ^dest_address;
-
-	/* Copy the Source and Destination addresses */
-	cb->dest_addr = dest_address;
-	cb->source_addr = src_address;
-
-	/* Copy the Control Word last */
-	cb->control = control;
-
-	return 0;
-}
-
-static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
-				 u32 src_phys,
-				 u32 dest_address,
-				 u32 length)
-{
-	u32 bytes_left = length;
-	u32 src_offset=0;
-	u32 dest_offset=0;
-	int status = 0;
-	IPW_DEBUG_FW(">> \n");
-	IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
-			  src_phys, dest_address, length);
-	while (bytes_left > CB_MAX_LENGTH) {
-		status = ipw_fw_dma_add_command_block( priv,
-						       src_phys + src_offset,
-						       dest_address + dest_offset,
-						       CB_MAX_LENGTH, 0, 0);
-		if (status) {
-			IPW_DEBUG_FW_INFO(": Failed\n");
-			return -1;
-		} else
-			IPW_DEBUG_FW_INFO(": Added new cb\n");
-
-		src_offset += CB_MAX_LENGTH;
-		dest_offset += CB_MAX_LENGTH;
-		bytes_left -= CB_MAX_LENGTH;
-	}
-
-	/* add the buffer tail */
-	if (bytes_left > 0) {
-		status = ipw_fw_dma_add_command_block(
-			priv, src_phys + src_offset,
-			dest_address + dest_offset,
-			bytes_left, 0, 0);
-		if (status) {
-			IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
-			return -1;
-		} else
-			IPW_DEBUG_FW_INFO(": Adding new cb - the buffer tail\n");
-	}
-
-
-	IPW_DEBUG_FW("<< \n");
-	return 0;
-}
-
-static int ipw_fw_dma_wait(struct ipw_priv *priv)
-{
-	u32 current_index = 0;
-	u32 watchdog = 0;
-
-	IPW_DEBUG_FW(">> : \n");
-
-	current_index = ipw_fw_dma_command_block_index(priv);
-	IPW_DEBUG_FW_INFO("sram_desc.last_cb_index:0x%8X\n",
-			  (int) priv->sram_desc.last_cb_index);
-
-	while (current_index < priv->sram_desc.last_cb_index) {
-		udelay(50);
-		current_index = ipw_fw_dma_command_block_index(priv);
-
-		watchdog++;
-
-		if (watchdog > 400) {
-			IPW_DEBUG_FW_INFO("Timeout\n");
-			ipw_fw_dma_dump_command_block(priv);
-			ipw_fw_dma_abort(priv);
-			return -1;
-		}
-	}
-
-	ipw_fw_dma_abort(priv);
-
-	/*Disable the DMA in the CSR register*/
- 	ipw_set_bit(priv, CX2_RESET_REG,
-		    CX2_RESET_REG_MASTER_DISABLED | CX2_RESET_REG_STOP_MASTER);
-
-	IPW_DEBUG_FW("<< dmaWaitSync \n");
-	return 0;
-}
-
-static void ipw_remove_current_network(struct ipw_priv *priv)
-{
-	struct list_head *element, *safe;
-	struct ieee80211_network *network = NULL;
-	list_for_each_safe(element, safe, &priv->ieee->network_list) {
-		network = list_entry(element, struct ieee80211_network, list);
-		if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
-			list_del(element);
-			list_add_tail(&network->list,
-				      &priv->ieee->network_free_list);
-		}
-	}
-}
-
-/**
- * Check that card is still alive.
- * Reads debug register from domain0.
- * If card is present, pre-defined value should
- * be found there.
- *
- * @param priv
- * @return 1 if card is present, 0 otherwise
- */
-static inline int ipw_alive(struct ipw_priv *priv)
-{
-	return ipw_read32(priv, 0x90) == 0xd55555d5;
-}
-
-static inline int ipw_poll_bit(struct ipw_priv *priv, u32 addr, u32 mask,
-			       int timeout)
-{
-	int i = 0;
-
-	do {
-		if ((ipw_read32(priv, addr) & mask) == mask)
-			return i;
-		mdelay(10);
-		i += 10;
-	} while (i < timeout);
-
-	return -ETIME;
-}
-
-/* These functions load the firmware and micro code for the operation of
- * the ipw hardware.  It assumes the buffer has all the bits for the
- * image and the caller is handling the memory allocation and clean up.
- */
-
-
-static int ipw_stop_master(struct ipw_priv * priv)
-{
-	int rc;
-
-	IPW_DEBUG_TRACE(">> \n");
-	/* stop master. typical delay - 0 */
-	ipw_set_bit(priv, CX2_RESET_REG, CX2_RESET_REG_STOP_MASTER);
-
-	rc = ipw_poll_bit(priv, CX2_RESET_REG,
-			  CX2_RESET_REG_MASTER_DISABLED, 100);
-	if (rc < 0) {
-		IPW_ERROR("stop master failed in 10ms\n");
-		return -1;
-	}
-
-	IPW_DEBUG_INFO("stop master %dms\n", rc);
-
-	return rc;
-}
-
-static void ipw_arc_release(struct ipw_priv *priv)
-{
-	IPW_DEBUG_TRACE(">> \n");
-	mdelay(5);
-
-	ipw_clear_bit(priv, CX2_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
-
-	/* no one knows timing, for safety add some delay */
-	mdelay(5);
-}
-
-struct fw_header {
-	u32 version;
-	u32 mode;
-};
-
-struct fw_chunk {
-	u32 address;
-	u32 length;
-};
-
-#define IPW_FW_MAJOR_VERSION 2
-#define IPW_FW_MINOR_VERSION 2
-
-#define IPW_FW_MINOR(x) ((x & 0xff) >> 8)
-#define IPW_FW_MAJOR(x) (x & 0xff)
-
-#define IPW_FW_VERSION ((IPW_FW_MINOR_VERSION << 8) | \
-                         IPW_FW_MAJOR_VERSION)
-
-#define IPW_FW_PREFIX "ipw-" __stringify(IPW_FW_MAJOR_VERSION) \
-"." __stringify(IPW_FW_MINOR_VERSION) "-"
-
-#if IPW_FW_MAJOR_VERSION >= 2 && IPW_FW_MINOR_VERSION > 0
-#define IPW_FW_NAME(x) IPW_FW_PREFIX "" x ".fw"
-#else
-#define IPW_FW_NAME(x) "ipw2200_" x ".fw"
-#endif
-
-static int ipw_load_ucode(struct ipw_priv *priv, u8 * data,
-			  size_t len)
-{
-	int rc = 0, i, addr;
-	u8 cr = 0;
-	u16 *image;
-
-	image = (u16 *)data;
-
-	IPW_DEBUG_TRACE(">> \n");
-
-	rc = ipw_stop_master(priv);
-
-	if (rc < 0)
-		return rc;
-
-//	spin_lock_irqsave(&priv->lock, flags);
-
-	for (addr = CX2_SHARED_LOWER_BOUND;
-	     addr < CX2_REGISTER_DOMAIN1_END; addr += 4) {
-		ipw_write32(priv, addr, 0);
-	}
-
-	/* no ucode (yet) */
-	memset(&priv->dino_alive, 0, sizeof(priv->dino_alive));
-	/* destroy DMA queues */
-	/* reset sequence */
-
-	ipw_write_reg32(priv, CX2_MEM_HALT_AND_RESET ,CX2_BIT_HALT_RESET_ON);
-	ipw_arc_release(priv);
-	ipw_write_reg32(priv, CX2_MEM_HALT_AND_RESET, CX2_BIT_HALT_RESET_OFF);
-	mdelay(1);
-
-	/* reset PHY */
-	ipw_write_reg32(priv, CX2_INTERNAL_CMD_EVENT, CX2_BASEBAND_POWER_DOWN);
-	mdelay(1);
-
-	ipw_write_reg32(priv, CX2_INTERNAL_CMD_EVENT, 0);
-	mdelay(1);
-
-	/* enable ucode store */
-	ipw_write_reg8(priv, DINO_CONTROL_REG, 0x0);
-	ipw_write_reg8(priv, DINO_CONTROL_REG, DINO_ENABLE_CS);
-	mdelay(1);
-
-	/* write ucode */
-	/**
-	 * @bug
-	 * Do NOT set indirect address register once and then
-	 * store data to indirect data register in the loop.
-	 * It seems very reasonable, but in this case DINO do not
-	 * accept ucode. It is essential to set address each time.
-	 */
-	/* load new ipw uCode */
-	for (i = 0; i < len / 2; i++)
-		ipw_write_reg16(priv, CX2_BASEBAND_CONTROL_STORE, image[i]);
-
-
-	/* enable DINO */
-	ipw_write_reg8(priv, CX2_BASEBAND_CONTROL_STATUS, 0);
-	ipw_write_reg8(priv, CX2_BASEBAND_CONTROL_STATUS,
-		       DINO_ENABLE_SYSTEM );
-
-	/* this is where the igx / win driver deveates from the VAP driver.*/
-
-	/* wait for alive response */
-	for (i = 0; i < 100; i++) {
-		/* poll for incoming data */
-		cr = ipw_read_reg8(priv, CX2_BASEBAND_CONTROL_STATUS);
-		if (cr & DINO_RXFIFO_DATA)
-			break;
-		mdelay(1);
-	}
-
-	if (cr & DINO_RXFIFO_DATA) {
-		/* alive_command_responce size is NOT multiple of 4 */
-		u32 response_buffer[(sizeof(priv->dino_alive) + 3) / 4];
-
-		for (i = 0; i < ARRAY_SIZE(response_buffer); i++)
-			response_buffer[i] =
-				ipw_read_reg32(priv,
-					       CX2_BASEBAND_RX_FIFO_READ);
-		memcpy(&priv->dino_alive, response_buffer,
-		       sizeof(priv->dino_alive));
-		if (priv->dino_alive.alive_command == 1
-		    && priv->dino_alive.ucode_valid == 1) {
-			rc = 0;
-			IPW_DEBUG_INFO(
-				"Microcode OK, rev. %d (0x%x) dev. %d (0x%x) "
-				"of %02d/%02d/%02d %02d:%02d\n",
-				priv->dino_alive.software_revision,
-				priv->dino_alive.software_revision,
-				priv->dino_alive.device_identifier,
-				priv->dino_alive.device_identifier,
-				priv->dino_alive.time_stamp[0],
-				priv->dino_alive.time_stamp[1],
-				priv->dino_alive.time_stamp[2],
-				priv->dino_alive.time_stamp[3],
-				priv->dino_alive.time_stamp[4]);
-		} else {
-			IPW_DEBUG_INFO("Microcode is not alive\n");
-			rc = -EINVAL;
-		}
-	} else {
-		IPW_DEBUG_INFO("No alive response from DINO\n");
-		rc = -ETIME;
-	}
-
-	/* disable DINO, otherwise for some reason
-	   firmware have problem getting alive resp. */
-	ipw_write_reg8(priv, CX2_BASEBAND_CONTROL_STATUS, 0);
-
-//	spin_unlock_irqrestore(&priv->lock, flags);
-
-	return rc;
-}
-
-static int ipw_load_firmware(struct ipw_priv *priv, u8 * data,
-			     size_t len)
-{
-	int rc = -1;
-	int offset = 0;
-	struct fw_chunk *chunk;
-	dma_addr_t shared_phys;
-	u8 *shared_virt;
-
-	IPW_DEBUG_TRACE("<< : \n");
-	shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
-
-	if (!shared_virt)
-		return -ENOMEM;
-
-	memmove(shared_virt, data, len);
-
-	/* Start the Dma */
-	rc = ipw_fw_dma_enable(priv);
-
-	if (priv->sram_desc.last_cb_index > 0) {
-		/* the DMA is already ready this would be a bug. */
-		BUG();
-		goto out;
-	}
-
-	do {
-		chunk = (struct fw_chunk *)(data + offset);
-		offset += sizeof(struct fw_chunk);
-		/* build DMA packet and queue up for sending */
-		/* dma to chunk->address, the chunk->length bytes from data +
-		 * offeset*/
-		/* Dma loading */
-		rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
-					   chunk->address, chunk->length);
-		if (rc) {
-			IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
-			goto out;
-		}
-
-		offset += chunk->length;
-	} while (offset < len);
-
-	/* Run the DMA and wait for the answer*/
-	rc = ipw_fw_dma_kick(priv);
-	if (rc) {
-		IPW_ERROR("dmaKick Failed\n");
-		goto out;
-	}
-
-	rc = ipw_fw_dma_wait(priv);
-	if (rc) {
-		IPW_ERROR("dmaWaitSync Failed\n");
-		goto out;
-	}
- out:
-	pci_free_consistent( priv->pci_dev, len, shared_virt, shared_phys);
-	return rc;
-}
-
-/* stop nic */
-static int ipw_stop_nic(struct ipw_priv *priv)
-{
-	int rc = 0;
-
-	/* stop*/
-	ipw_write32(priv, CX2_RESET_REG, CX2_RESET_REG_STOP_MASTER);
-
-	rc = ipw_poll_bit(priv, CX2_RESET_REG,
-			  CX2_RESET_REG_MASTER_DISABLED, 500);
-	if (rc < 0) {
-		IPW_ERROR("wait for reg master disabled failed\n");
-		return rc;
-	}
-
-	ipw_set_bit(priv, CX2_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
-
-	return rc;
-}
-
-static void ipw_start_nic(struct ipw_priv *priv)
-{
-	IPW_DEBUG_TRACE(">>\n");
-
-	/* prvHwStartNic  release ARC*/
-	ipw_clear_bit(priv, CX2_RESET_REG,
-		      CX2_RESET_REG_MASTER_DISABLED |
-		      CX2_RESET_REG_STOP_MASTER |
-		      CBD_RESET_REG_PRINCETON_RESET);
-
-	/* enable power management */
-	ipw_set_bit(priv, CX2_GP_CNTRL_RW, CX2_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY);
-
-	IPW_DEBUG_TRACE("<<\n");
-}
-
-static int ipw_init_nic(struct ipw_priv *priv)
-{
-	int rc;
-
-	IPW_DEBUG_TRACE(">>\n");
-	/* reset */
-	/*prvHwInitNic */
-	/* set "initialization complete" bit to move adapter to D0 state */
-	ipw_set_bit(priv, CX2_GP_CNTRL_RW, CX2_GP_CNTRL_BIT_INIT_DONE);
-
-	/* low-level PLL activation */
-	ipw_write32(priv, CX2_READ_INT_REGISTER,  CX2_BIT_INT_HOST_SRAM_READ_INT_REGISTER);
-
-	/* wait for clock stabilization */
-	rc = ipw_poll_bit(priv, CX2_GP_CNTRL_RW,
-			  CX2_GP_CNTRL_BIT_CLOCK_READY, 250);
-	if (rc < 0 )
-		IPW_DEBUG_INFO("FAILED wait for clock stablization\n");
-
-	/* assert SW reset */
-	ipw_set_bit(priv, CX2_RESET_REG, CX2_RESET_REG_SW_RESET);
-
-	udelay(10);
-
-	/* set "initialization complete" bit to move adapter to D0 state */
-	ipw_set_bit(priv, CX2_GP_CNTRL_RW, CX2_GP_CNTRL_BIT_INIT_DONE);
-
-	IPW_DEBUG_TRACE(">>\n");
-	return 0;
-}
-
-
-/* Call this function from process context, it will sleep in request_firmware.
- * Probe is an ok place to call this from.
- */
-static int ipw_reset_nic(struct ipw_priv *priv)
-{
-	int rc = 0;
-
-	IPW_DEBUG_TRACE(">>\n");
-
-	rc = ipw_init_nic(priv);
-
-	/* Clear the 'host command active' bit... */
-	priv->status &= ~STATUS_HCMD_ACTIVE;
-	wake_up_interruptible(&priv->wait_command_queue);
-
-	IPW_DEBUG_TRACE("<<\n");
-	return rc;
-}
-
-static int ipw_get_fw(struct ipw_priv *priv,
-		      const struct firmware **fw, const char *name)
-{
-	struct fw_header *header;
-	int rc;
-
-	/* ask firmware_class module to get the boot firmware off disk */
-	rc = request_firmware(fw, name, &priv->pci_dev->dev);
-	if (rc < 0) {
-		IPW_ERROR("%s load failed: Reason %d\n", name, rc);
-		return rc;
-	}
-
-	header = (struct fw_header *)(*fw)->data;
-	if (IPW_FW_MAJOR(header->version) != IPW_FW_MAJOR_VERSION) {
-		IPW_ERROR("'%s' firmware version not compatible (%d != %d)\n",
-			  name,
-			  IPW_FW_MAJOR(header->version), IPW_FW_MAJOR_VERSION);
-		return -EINVAL;
-	}
-
-	IPW_DEBUG_INFO("Loading firmware '%s' file v%d.%d (%zd bytes)\n",
-		       name,
-		       IPW_FW_MAJOR(header->version),
-		       IPW_FW_MINOR(header->version),
-		       (*fw)->size - sizeof(struct fw_header));
-	return 0;
-}
-
-#define CX2_RX_BUF_SIZE (3000)
-
-static inline void ipw_rx_queue_reset(struct ipw_priv *priv,
-				      struct ipw_rx_queue *rxq)
-{
-	unsigned long flags;
-	int i;
-
-	spin_lock_irqsave(&rxq->lock, flags);
-
-	INIT_LIST_HEAD(&rxq->rx_free);
-	INIT_LIST_HEAD(&rxq->rx_used);
-
-	/* Fill the rx_used queue with _all_ of the Rx buffers */
-	for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
-		/* In the reset function, these buffers may have been allocated
-		 * to an SKB, so we need to unmap and free potential storage */
-		if (rxq->pool[i].skb != NULL) {
-			pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
-					 CX2_RX_BUF_SIZE,
-					 PCI_DMA_FROMDEVICE);
-			dev_kfree_skb(rxq->pool[i].skb);
-		}
-		list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
-	}
-
-	/* Set us so that we have processed and used all buffers, but have
-	 * not restocked the Rx queue with fresh buffers */
-	rxq->read = rxq->write = 0;
-	rxq->processed = RX_QUEUE_SIZE - 1;
-	rxq->free_count = 0;
-	spin_unlock_irqrestore(&rxq->lock, flags);
-}
-
-#ifdef CONFIG_PM
-static int fw_loaded = 0;
-static const struct firmware *bootfw = NULL;
-static const struct firmware *firmware = NULL;
-static const struct firmware *ucode = NULL;
-#endif
-
-static int ipw_load(struct ipw_priv *priv)
-{
-#ifndef CONFIG_PM
-	const struct firmware *bootfw = NULL;
-	const struct firmware *firmware = NULL;
-	const struct firmware *ucode = NULL;
-#endif
-	int rc = 0, retries = 3;
-
-#ifdef CONFIG_PM
-	if (!fw_loaded) {
-#endif
-		rc = ipw_get_fw(priv, &bootfw, IPW_FW_NAME("boot"));
-		if (rc)
-			goto error;
-
-		switch (priv->ieee->iw_mode) {
-		case IW_MODE_ADHOC:
-			rc = ipw_get_fw(priv, &ucode,
-					IPW_FW_NAME("ibss_ucode"));
-			if (rc)
-				goto error;
-
-			rc = ipw_get_fw(priv, &firmware, IPW_FW_NAME("ibss"));
-			break;
-
-#ifdef CONFIG_IPW_PROMISC
-		case IW_MODE_MONITOR:
-			rc = ipw_get_fw(priv, &ucode,
-					IPW_FW_NAME("ibss_ucode"));
-			if (rc)
-				goto error;
-
-			rc = ipw_get_fw(priv, &firmware, IPW_FW_NAME("sniffer"));
-			break;
-#endif
-		case IW_MODE_INFRA:
-			rc = ipw_get_fw(priv, &ucode,
-					IPW_FW_NAME("bss_ucode"));
-			if (rc)
-				goto error;
-
-			rc = ipw_get_fw(priv, &firmware, IPW_FW_NAME("bss"));
-			break;
-
-		default:
-			rc = -EINVAL;
-		}
-
-		if (rc)
-			goto error;
-
-#ifdef CONFIG_PM
-		fw_loaded = 1;
-	}
-#endif
-
-	if (!priv->rxq)
-		priv->rxq = ipw_rx_queue_alloc(priv);
-	else
-		ipw_rx_queue_reset(priv, priv->rxq);
-	if (!priv->rxq) {
-		IPW_ERROR("Unable to initialize Rx queue\n");
-		goto error;
-	}
-
- retry:
-	/* Ensure interrupts are disabled */
-	ipw_write32(priv, CX2_INTA_MASK_R, ~CX2_INTA_MASK_ALL);
-	priv->status &= ~STATUS_INT_ENABLED;
-
-	/* ack pending interrupts */
-	ipw_write32(priv, CX2_INTA_RW, CX2_INTA_MASK_ALL);
-
-	ipw_stop_nic(priv);
-
-	rc = ipw_reset_nic(priv);
-	if (rc) {
-		IPW_ERROR("Unable to reset NIC\n");
-		goto error;
-	}
-
-	ipw_zero_memory(priv, CX2_NIC_SRAM_LOWER_BOUND,
-			CX2_NIC_SRAM_UPPER_BOUND - CX2_NIC_SRAM_LOWER_BOUND);
-
-	/* DMA the initial boot firmware into the device */
-	rc = ipw_load_firmware(priv, bootfw->data + sizeof(struct fw_header),
-			       bootfw->size - sizeof(struct fw_header));
-	if (rc < 0) {
-		IPW_ERROR("Unable to load boot firmware\n");
-		goto error;
-	}
-
-	/* kick start the device */
-	ipw_start_nic(priv);
-
-	/* wait for the device to finish it's initial startup sequence */
-	rc = ipw_poll_bit(priv, CX2_INTA_RW,
-			  CX2_INTA_BIT_FW_INITIALIZATION_DONE, 500);
-	if (rc < 0) {
-		IPW_ERROR("device failed to boot initial fw image\n");
-		goto error;
-	}
-	IPW_DEBUG_INFO("initial device response after %dms\n", rc);
-
-	/* ack fw init done interrupt */
-	ipw_write32(priv, CX2_INTA_RW, CX2_INTA_BIT_FW_INITIALIZATION_DONE);
-
-	/* DMA the ucode into the device */
-	rc = ipw_load_ucode(priv, ucode->data + sizeof(struct fw_header),
-			    ucode->size - sizeof(struct fw_header));
-	if (rc < 0) {
-		IPW_ERROR("Unable to load ucode\n");
-		goto error;
-	}
-
-	/* stop nic */
-	ipw_stop_nic(priv);
-
-	/* DMA bss firmware into the device */
-	rc = ipw_load_firmware(priv, firmware->data +
-			       sizeof(struct fw_header),
-			       firmware->size - sizeof(struct fw_header));
-	if (rc < 0 ) {
-		IPW_ERROR("Unable to load firmware\n");
-		goto error;
-	}
-
-	ipw_write32(priv, IPW_EEPROM_LOAD_DISABLE, 0);
-
-	rc = ipw_queue_reset(priv);
-	if (rc) {
-		IPW_ERROR("Unable to initialize queues\n");
-		goto error;
-	}
-
-	/* Ensure interrupts are disabled */
-	ipw_write32(priv, CX2_INTA_MASK_R, ~CX2_INTA_MASK_ALL);
-
-	/* kick start the device */
-	ipw_start_nic(priv);
-
-	if (ipw_read32(priv, CX2_INTA_RW) & CX2_INTA_BIT_PARITY_ERROR) {
-		if (retries > 0) {
-			IPW_WARNING("Parity error.  Retrying init.\n");
-			retries--;
-			goto retry;
-		}
-
-		IPW_ERROR("TODO: Handle parity error -- schedule restart?\n");
-		rc = -EIO;
-		goto error;
-	}
-
-	/* wait for the device */
-	rc = ipw_poll_bit(priv, CX2_INTA_RW,
-			  CX2_INTA_BIT_FW_INITIALIZATION_DONE, 500);
-	if (rc < 0) {
-		IPW_ERROR("device failed to start after 500ms\n");
-		goto error;
-	}
-	IPW_DEBUG_INFO("device response after %dms\n", rc);
-
-	/* ack fw init done interrupt */
-	ipw_write32(priv, CX2_INTA_RW, CX2_INTA_BIT_FW_INITIALIZATION_DONE);
-
-	/* read eeprom data and initialize the eeprom region of sram */
-	priv->eeprom_delay = 1;
-	ipw_eeprom_init_sram(priv);
-
-	/* enable interrupts */
-	ipw_enable_interrupts(priv);
-
-	/* Ensure our queue has valid packets */
-	ipw_rx_queue_replenish(priv);
-
-	ipw_write32(priv, CX2_RX_READ_INDEX, priv->rxq->read);
-
-	/* ack pending interrupts */
-	ipw_write32(priv, CX2_INTA_RW, CX2_INTA_MASK_ALL);
-
-#ifndef CONFIG_PM
-	release_firmware(bootfw);
-	release_firmware(ucode);
-	release_firmware(firmware);
-#endif
-	return 0;
-
- error:
-	if (priv->rxq) {
-		ipw_rx_queue_free(priv, priv->rxq);
-		priv->rxq = NULL;
-	}
-	ipw_tx_queue_free(priv);
-	if (bootfw)
-		release_firmware(bootfw);
-	if (ucode)
-		release_firmware(ucode);
-	if (firmware)
-		release_firmware(firmware);
-#ifdef CONFIG_PM
-	fw_loaded = 0;
-	bootfw = ucode = firmware = NULL;
-#endif
-
-	return rc;
-}
-
-/**
- * DMA services
- *
- * Theory of operation
- *
- * A queue is a circular buffers with 'Read' and 'Write' pointers.
- * 2 empty entries always kept in the buffer to protect from overflow.
- *
- * For Tx queue, there are low mark and high mark limits. If, after queuing
- * the packet for Tx, free space become < low mark, Tx queue stopped. When
- * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
- * Tx queue resumed.
- *
- * The IPW operates with six queues, one receive queue in the device's
- * sram, one transmit queue for sending commands to the device firmware,
- * and four transmit queues for data.
- *
- * The four transmit queues allow for performing quality of service (qos)
- * transmissions as per the 802.11 protocol.  Currently Linux does not
- * provide a mechanism to the user for utilizing prioritized queues, so
- * we only utilize the first data transmit queue (queue1).
- */
-
-/**
- * Driver allocates buffers of this size for Rx
- */
-
-static inline int ipw_queue_space(const struct clx2_queue *q)
-{
-	int s = q->last_used - q->first_empty;
-	if (s <= 0)
-		s += q->n_bd;
-	s -= 2;			/* keep some reserve to not confuse empty and full situations */
-	if (s < 0)
-		s = 0;
-	return s;
-}
-
-static inline int ipw_queue_inc_wrap(int index, int n_bd)
-{
-	return (++index == n_bd) ? 0 : index;
-}
-
-/**
- * Initialize common DMA queue structure
- *
- * @param q                queue to init
- * @param count            Number of BD's to allocate. Should be power of 2
- * @param read_register    Address for 'read' register
- *                         (not offset within BAR, full address)
- * @param write_register   Address for 'write' register
- *                         (not offset within BAR, full address)
- * @param base_register    Address for 'base' register
- *                         (not offset within BAR, full address)
- * @param size             Address for 'size' register
- *                         (not offset within BAR, full address)
- */
-static void ipw_queue_init(struct ipw_priv *priv, struct clx2_queue *q,
-			   int count, u32 read, u32 write,
-			   u32 base, u32 size)
-{
-	q->n_bd = count;
-
-	q->low_mark = q->n_bd / 4;
-	if (q->low_mark < 4)
-		q->low_mark = 4;
-
-	q->high_mark = q->n_bd / 8;
-	if (q->high_mark < 2)
-		q->high_mark = 2;
-
-	q->first_empty = q->last_used = 0;
-	q->reg_r = read;
-	q->reg_w = write;
-
-	ipw_write32(priv, base, q->dma_addr);
-	ipw_write32(priv, size, count);
-	ipw_write32(priv, read, 0);
-	ipw_write32(priv, write, 0);
-
-	_ipw_read32(priv, 0x90);
-}
-
-static int ipw_queue_tx_init(struct ipw_priv *priv,
-			     struct clx2_tx_queue *q,
-			     int count, u32 read, u32 write,
-			     u32 base, u32 size)
-{
-	struct pci_dev *dev = priv->pci_dev;
-
-	q->txb = kmalloc(sizeof(q->txb[0]) * count, GFP_KERNEL);
-	if (!q->txb) {
-		IPW_ERROR("vmalloc for auxilary BD structures failed\n");
-		return -ENOMEM;
-	}
-
-	q->bd = pci_alloc_consistent(dev,sizeof(q->bd[0])*count, &q->q.dma_addr);
-	if (!q->bd) {
-		IPW_ERROR("pci_alloc_consistent(%zd) failed\n",
-				sizeof(q->bd[0]) * count);
-		kfree(q->txb);
-		q->txb = NULL;
-		return -ENOMEM;
-	}
-
-	ipw_queue_init(priv, &q->q, count, read, write, base, size);
-	return 0;
-}
-
-/**
- * Free one TFD, those at index [txq->q.last_used].
- * Do NOT advance any indexes
- *
- * @param dev
- * @param txq
- */
-static void ipw_queue_tx_free_tfd(struct ipw_priv *priv,
-				  struct clx2_tx_queue *txq)
-{
-	struct tfd_frame *bd = &txq->bd[txq->q.last_used];
-	struct pci_dev *dev = priv->pci_dev;
-	int i;
-
-	/* classify bd */
-	if (bd->control_flags.message_type == TX_HOST_COMMAND_TYPE)
-		/* nothing to cleanup after for host commands */
-		return;
-
-	/* sanity check */
-	if (bd->u.data.num_chunks > NUM_TFD_CHUNKS) {
-		IPW_ERROR("Too many chunks: %i\n", bd->u.data.num_chunks);
-		/** @todo issue fatal error, it is quite serious situation */
-		return;
-	}
-
-	/* unmap chunks if any */
-	for (i = 0; i < bd->u.data.num_chunks; i++) {
-		pci_unmap_single(dev, bd->u.data.chunk_ptr[i],
-				 bd->u.data.chunk_len[i], PCI_DMA_TODEVICE);
-		if (txq->txb[txq->q.last_used]) {
-			ieee80211_txb_free(txq->txb[txq->q.last_used]);
-			txq->txb[txq->q.last_used] = NULL;
-		}
-	}
-}
-
-/**
- * Deallocate DMA queue.
- *
- * Empty queue by removing and destroying all BD's.
- * Free all buffers.
- *
- * @param dev
- * @param q
- */
-static void ipw_queue_tx_free(struct ipw_priv *priv,
-			    struct clx2_tx_queue *txq)
-{
-	struct clx2_queue *q = &txq->q;
-	struct pci_dev *dev = priv->pci_dev;
-
-	if (q->n_bd == 0)
-		return;
-
-	/* first, empty all BD's */
-	for (; q->first_empty != q->last_used;
-	     q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
-		ipw_queue_tx_free_tfd(priv, txq);
-	}
-
-	/* free buffers belonging to queue itself */
-	pci_free_consistent(dev, sizeof(txq->bd[0])*q->n_bd, txq->bd,
-			    q->dma_addr);
-	kfree(txq->txb);
-
-	/* 0 fill whole structure */
-	memset(txq, 0, sizeof(*txq));
-}
-
-
-/**
- * Destroy all DMA queues and structures
- *
- * @param priv
- */
-static void ipw_tx_queue_free(struct ipw_priv *priv)
-{
-	/* Tx CMD queue */
-	ipw_queue_tx_free(priv, &priv->txq_cmd);
-
-	/* Tx queues */
-	ipw_queue_tx_free(priv, &priv->txq[0]);
-	ipw_queue_tx_free(priv, &priv->txq[1]);
-	ipw_queue_tx_free(priv, &priv->txq[2]);
-	ipw_queue_tx_free(priv, &priv->txq[3]);
-}
-
-static void inline __maybe_wake_tx(struct ipw_priv *priv)
-{
-	if (netif_running(priv->net_dev)) {
-		switch (priv->port_type) {
-		case DCR_TYPE_MU_BSS:
-		case DCR_TYPE_MU_IBSS:
-			if (!(priv->status & STATUS_ASSOCIATED)) {
-				return;
-			}
-		}
-		netif_wake_queue(priv->net_dev);
-	}
-
-}
-
-static inline void ipw_create_bssid(struct ipw_priv *priv, u8 *bssid)
-{
-	/* First 3 bytes are manufacturer */
-	bssid[0] = priv->mac_addr[0];
-	bssid[1] = priv->mac_addr[1];
-	bssid[2] = priv->mac_addr[2];
-
-	/* Last bytes are random */
-        get_random_bytes(&bssid[3], ETH_ALEN-3);
-
-        bssid[0] &= 0xfe;       /* clear multicast bit */
-        bssid[0] |= 0x02;       /* set local assignment bit (IEEE802) */
-}
-
-static inline u8 ipw_add_station(struct ipw_priv *priv, u8 *bssid)
-{
-	struct ipw_station_entry entry;
-	int i;
-
-	for (i = 0; i < priv->num_stations; i++) {
-		if (!memcmp(priv->stations[i], bssid, ETH_ALEN)) {
-			/* Another node is active in network */
-			priv->missed_adhoc_beacons = 0;
-			if (!(priv->config & CFG_STATIC_CHANNEL))
-				/* when other nodes drop out, we drop out */
-				priv->config &= ~CFG_ADHOC_PERSIST;
-
-			return i;
-		}
-	}
-
-	if (i == MAX_STATIONS)
-		return IPW_INVALID_STATION;
-
-	IPW_DEBUG_SCAN("Adding AdHoc station: " MAC_FMT "\n", MAC_ARG(bssid));
-
-	entry.reserved = 0;
-	entry.support_mode = 0;
-	memcpy(entry.mac_addr, bssid, ETH_ALEN);
-	memcpy(priv->stations[i], bssid, ETH_ALEN);
-	ipw_write_direct(priv, IPW_STATION_TABLE_LOWER + i * sizeof(entry),
-			 &entry,
-			 sizeof(entry));
-	priv->num_stations++;
-
-	return i;
-}
-
-static inline u8 ipw_find_station(struct ipw_priv *priv, u8 *bssid)
-{
-	int i;
-
-	for (i = 0; i < priv->num_stations; i++)
-		if (!memcmp(priv->stations[i], bssid, ETH_ALEN))
-			return i;
-
-	return IPW_INVALID_STATION;
-}
-
-static void ipw_send_disassociate(struct ipw_priv *priv, int quiet)
-{
-	int err;
-
-	if (!(priv->status & (STATUS_ASSOCIATING | STATUS_ASSOCIATED))) {
-		IPW_DEBUG_ASSOC("Disassociating while not associated.\n");
-		return;
-	}
-
-	IPW_DEBUG_ASSOC("Disassocation attempt from " MAC_FMT " "
-			"on channel %d.\n",
-			MAC_ARG(priv->assoc_request.bssid),
-			priv->assoc_request.channel);
-
-	priv->status &= ~(STATUS_ASSOCIATING | STATUS_ASSOCIATED);
-	priv->status |= STATUS_DISASSOCIATING;
-
-	if (quiet)
-		priv->assoc_request.assoc_type = HC_DISASSOC_QUIET;
-	else
-		priv->assoc_request.assoc_type = HC_DISASSOCIATE;
-	err = ipw_send_associate(priv, &priv->assoc_request);
-	if (err) {
-		IPW_DEBUG_HC("Attempt to send [dis]associate command "
-			     "failed.\n");
-		return;
-	}
-
-}
-
-static void ipw_disassociate(void *data)
-{
-	ipw_send_disassociate(data, 0);
-}
-
-static void notify_wx_assoc_event(struct ipw_priv *priv)
-{
-	union iwreq_data wrqu;
-	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-	if (priv->status & STATUS_ASSOCIATED)
-		memcpy(wrqu.ap_addr.sa_data, priv->bssid, ETH_ALEN);
-	else
-		memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
-	wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
-}
-
-struct ipw_status_code {
-	u16 status;
-	const char *reason;
-};
-
-static const struct ipw_status_code ipw_status_codes[] = {
-	{0x00, "Successful"},
-	{0x01, "Unspecified failure"},
-	{0x0A, "Cannot support all requested capabilities in the "
-	 "Capability information field"},
-	{0x0B, "Reassociation denied due to inability to confirm that "
-	 "association exists"},
-	{0x0C, "Association denied due to reason outside the scope of this "
-	 "standard"},
-	{0x0D, "Responding station does not support the specified authentication "
-	 "algorithm"},
-	{0x0E, "Received an Authentication frame with authentication sequence "
-	 "transaction sequence number out of expected sequence"},
-	{0x0F, "Authentication rejected because of challenge failure"},
-	{0x10, "Authentication rejected due to timeout waiting for next "
-	 "frame in sequence"},
-	{0x11, "Association denied because AP is unable to handle additional "
-	 "associated stations"},
-	{0x12, "Association denied due to requesting station not supporting all "
-	 "of the datarates in the BSSBasicServiceSet Parameter"},
-	{0x13, "Association denied due to requesting station not supporting "
-	 "short preamble operation"},
-	{0x14, "Association denied due to requesting station not supporting "
-	 "PBCC encoding"},
-	{0x15, "Association denied due to requesting station not supporting "
-	 "channel agility"},
-	{0x19, "Association denied due to requesting station not supporting "
-	 "short slot operation"},
-	{0x1A, "Association denied due to requesting station not supporting "
-	 "DSSS-OFDM operation"},
-	{0x28, "Invalid Information Element"},
-	{0x29, "Group Cipher is not valid"},
-	{0x2A, "Pairwise Cipher is not valid"},
-	{0x2B, "AKMP is not valid"},
-	{0x2C, "Unsupported RSN IE version"},
-	{0x2D, "Invalid RSN IE Capabilities"},
-	{0x2E, "Cipher suite is rejected per security policy"},
-};
-
-#ifdef CONFIG_IPW_DEBUG
-static const char *ipw_get_status_code(u16 status)
-{
-	int i;
-	for (i = 0; i < ARRAY_SIZE(ipw_status_codes); i++)
-		if (ipw_status_codes[i].status == status)
-			return ipw_status_codes[i].reason;
-	return "Unknown status value.";
-}
-#endif
-
-static void inline average_init(struct average *avg)
-{
-	memset(avg, 0, sizeof(*avg));
-}
-
-static void inline average_add(struct average *avg, s16 val)
-{
-	avg->sum -= avg->entries[avg->pos];
-	avg->sum += val;
-	avg->entries[avg->pos++] = val;
-	if (unlikely(avg->pos == AVG_ENTRIES)) {
-		avg->init = 1;
-		avg->pos = 0;
-	}
-}
-
-static s16 inline average_value(struct average *avg)
-{
-	if (!unlikely(avg->init)) {
-		if (avg->pos)
-			return avg->sum / avg->pos;
-		return 0;
-	}
-
-	return avg->sum / AVG_ENTRIES;
-}
-
-static void ipw_reset_stats(struct ipw_priv *priv)
-{
-	u32 len = sizeof(u32);
-
-	priv->quality = 0;
-
-	average_init(&priv->average_missed_beacons);
-	average_init(&priv->average_rssi);
-	average_init(&priv->average_noise);
-
-	priv->last_rate = 0;
-	priv->last_missed_beacons = 0;
-	priv->last_rx_packets = 0;
-	priv->last_tx_packets = 0;
-	priv->last_tx_failures = 0;
-
-	/* Firmware managed, reset only when NIC is restarted, so we have to
-	 * normalize on the current value */
-	ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC,
-			&priv->last_rx_err, &len);
-	ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE,
-			&priv->last_tx_failures, &len);
-
-	/* Driver managed, reset with each association */
-	priv->missed_adhoc_beacons = 0;
-	priv->missed_beacons = 0;
-	priv->tx_packets = 0;
-	priv->rx_packets = 0;
-
-}
-
-
-static inline u32 ipw_get_max_rate(struct ipw_priv *priv)
-{
-	u32 i = 0x80000000;
-	u32 mask = priv->rates_mask;
-	/* If currently associated in B mode, restrict the maximum
-	 * rate match to B rates */
-	if (priv->assoc_request.ieee_mode == IPW_B_MODE)
-		mask &= IEEE80211_CCK_RATES_MASK;
-
-	/* TODO: Verify that the rate is supported by the current rates
-	 * list. */
-
-	while (i && !(mask & i)) i >>= 1;
-	switch (i) {
-	case IEEE80211_CCK_RATE_1MB_MASK: return 1000000;
-	case IEEE80211_CCK_RATE_2MB_MASK: return 2000000;
-	case IEEE80211_CCK_RATE_5MB_MASK: return 5500000;
-	case IEEE80211_OFDM_RATE_6MB_MASK: return 6000000;
-	case IEEE80211_OFDM_RATE_9MB_MASK: return 9000000;
-	case IEEE80211_CCK_RATE_11MB_MASK: return 11000000;
-	case IEEE80211_OFDM_RATE_12MB_MASK: return 12000000;
-	case IEEE80211_OFDM_RATE_18MB_MASK: return 18000000;
-	case IEEE80211_OFDM_RATE_24MB_MASK: return 24000000;
-	case IEEE80211_OFDM_RATE_36MB_MASK: return 36000000;
-	case IEEE80211_OFDM_RATE_48MB_MASK: return 48000000;
-	case IEEE80211_OFDM_RATE_54MB_MASK: return 54000000;
-	}
-
-	if (priv->ieee->mode == IEEE_B)
-		return 11000000;
-	else
-		return 54000000;
-}
-
-static u32 ipw_get_current_rate(struct ipw_priv *priv)
-{
-	u32 rate, len = sizeof(rate);
-	int err;
-
-	if (!(priv->status & STATUS_ASSOCIATED))
-		return 0;
-
-	if (priv->tx_packets > IPW_REAL_RATE_RX_PACKET_THRESHOLD) {
-		err = ipw_get_ordinal(priv, IPW_ORD_STAT_TX_CURR_RATE, &rate,
-				      &len);
-		if (err) {
-			IPW_DEBUG_INFO("failed querying ordinals.\n");
-			return 0;
-		}
-	} else
-		return ipw_get_max_rate(priv);
-
-	switch (rate) {
-	case IPW_TX_RATE_1MB:  return  1000000;
-	case IPW_TX_RATE_2MB:  return  2000000;
-	case IPW_TX_RATE_5MB:  return  5500000;
-	case IPW_TX_RATE_6MB:  return  6000000;
-	case IPW_TX_RATE_9MB:  return  9000000;
-	case IPW_TX_RATE_11MB: return 11000000;
-	case IPW_TX_RATE_12MB: return 12000000;
-	case IPW_TX_RATE_18MB: return 18000000;
-	case IPW_TX_RATE_24MB: return 24000000;
-	case IPW_TX_RATE_36MB: return 36000000;
-	case IPW_TX_RATE_48MB: return 48000000;
-	case IPW_TX_RATE_54MB: return 54000000;
-	}
-
-	return 0;
-}
-
-#define PERFECT_RSSI (-50)
-#define WORST_RSSI   (-85)
-#define IPW_STATS_INTERVAL (2 * HZ)
-static void ipw_gather_stats(struct ipw_priv *priv)
-{
-	u32 rx_err, rx_err_delta, rx_packets_delta;
-	u32 tx_failures, tx_failures_delta, tx_packets_delta;
-	u32 missed_beacons_percent, missed_beacons_delta;
-	u32 quality = 0;
-	u32 len = sizeof(u32);
-	s16 rssi;
-	u32 beacon_quality, signal_quality, tx_quality, rx_quality,
-		rate_quality;
-
-	if (!(priv->status & STATUS_ASSOCIATED)) {
-		priv->quality = 0;
-		return;
-	}
-
-	/* Update the statistics */
-	ipw_get_ordinal(priv, IPW_ORD_STAT_MISSED_BEACONS,
-			&priv->missed_beacons, &len);
-	missed_beacons_delta = priv->missed_beacons -
-		priv->last_missed_beacons;
-	priv->last_missed_beacons = priv->missed_beacons;
-	if (priv->assoc_request.beacon_interval) {
-		missed_beacons_percent = missed_beacons_delta *
-			(HZ * priv->assoc_request.beacon_interval) /
-			(IPW_STATS_INTERVAL * 10);
-	} else {
-		missed_beacons_percent = 0;
-	}
-	average_add(&priv->average_missed_beacons, missed_beacons_percent);
-
-	ipw_get_ordinal(priv, IPW_ORD_STAT_RX_ERR_CRC, &rx_err, &len);
-	rx_err_delta = rx_err - priv->last_rx_err;
-	priv->last_rx_err = rx_err;
-
-	ipw_get_ordinal(priv, IPW_ORD_STAT_TX_FAILURE, &tx_failures, &len);
-	tx_failures_delta = tx_failures - priv->last_tx_failures;
-	priv->last_tx_failures = tx_failures;
-
-	rx_packets_delta = priv->rx_packets - priv->last_rx_packets;
-	priv->last_rx_packets = priv->rx_packets;
-
-	tx_packets_delta = priv->tx_packets - priv->last_tx_packets;
-	priv->last_tx_packets = priv->tx_packets;
-
-	/* Calculate quality based on the following:
-	 *
-	 * Missed beacon: 100% = 0, 0% = 70% missed
-	 * Rate: 60% = 1Mbs, 100% = Max
-	 * Rx and Tx errors represent a straight % of total Rx/Tx
-	 * RSSI: 100% = > -50,  0% = < -80
-	 * Rx errors: 100% = 0, 0% = 50% missed
-	 *
-	 * The lowest computed quality is used.
-	 *
-	 */
-#define BEACON_THRESHOLD 5
-	beacon_quality = 100 - missed_beacons_percent;
-	if (beacon_quality < BEACON_THRESHOLD)
-		beacon_quality = 0;
-	else
-		beacon_quality = (beacon_quality - BEACON_THRESHOLD) * 100 /
-			(100 - BEACON_THRESHOLD);
-	IPW_DEBUG_STATS("Missed beacon: %3d%% (%d%%)\n",
-			beacon_quality, missed_beacons_percent);
-
-	priv->last_rate = ipw_get_current_rate(priv);
-	rate_quality =  priv->last_rate * 40 / priv->last_rate + 60;
-	IPW_DEBUG_STATS("Rate quality : %3d%% (%dMbs)\n",
-			rate_quality, priv->last_rate / 1000000);
-
-	if (rx_packets_delta > 100 &&
-	    rx_packets_delta + rx_err_delta)
-		rx_quality = 100 - (rx_err_delta * 100) /
-			(rx_packets_delta + rx_err_delta);
-	else
-		rx_quality = 100;
-	IPW_DEBUG_STATS("Rx quality   : %3d%% (%u errors, %u packets)\n",
-			rx_quality, rx_err_delta, rx_packets_delta);
-
-	if (tx_packets_delta > 100 &&
-	    tx_packets_delta + tx_failures_delta)
-		tx_quality = 100 - (tx_failures_delta * 100) /
-			(tx_packets_delta + tx_failures_delta);
-	else
-		tx_quality = 100;
-	IPW_DEBUG_STATS("Tx quality   : %3d%% (%u errors, %u packets)\n",
-			tx_quality, tx_failures_delta, tx_packets_delta);
-
-	rssi = average_value(&priv->average_rssi);
-	if (rssi > PERFECT_RSSI)
-		signal_quality = 100;
-	else if (rssi < WORST_RSSI)
-		signal_quality = 0;
-	else
-		signal_quality = (rssi - WORST_RSSI) * 100 /
-			(PERFECT_RSSI - WORST_RSSI);
-	IPW_DEBUG_STATS("Signal level : %3d%% (%d dBm)\n",
-			signal_quality, rssi);
-
-	quality = min(beacon_quality,
-		      min(rate_quality,
-			  min(tx_quality, min(rx_quality, signal_quality))));
-	if (quality == beacon_quality)
-		IPW_DEBUG_STATS(
-			"Quality (%d%%): Clamped to missed beacons.\n",
-			quality);
-	if (quality == rate_quality)
-		IPW_DEBUG_STATS(
-			"Quality (%d%%): Clamped to rate quality.\n",
-			quality);
-	if (quality == tx_quality)
-		IPW_DEBUG_STATS(
-			"Quality (%d%%): Clamped to Tx quality.\n",
-			quality);
-	if (quality == rx_quality)
-		IPW_DEBUG_STATS(
-			"Quality (%d%%): Clamped to Rx quality.\n",
-			quality);
-	if (quality == signal_quality)
-		IPW_DEBUG_STATS(
-			"Quality (%d%%): Clamped to signal quality.\n",
-			quality);
-
-	priv->quality = quality;
-
-	queue_delayed_work(priv->workqueue, &priv->gather_stats,
-			   IPW_STATS_INTERVAL);
-}
-
-/**
- * Handle host notification packet.
- * Called from interrupt routine
- */
-static inline void ipw_rx_notification(struct ipw_priv* priv,
-				       struct ipw_rx_notification *notif)
-{
-	IPW_DEBUG_NOTIF("type = %i (%d bytes)\n",
-			notif->subtype, notif->size);
-
-	switch (notif->subtype) {
-	case HOST_NOTIFICATION_STATUS_ASSOCIATED: {
-		struct notif_association *assoc = &notif->u.assoc;
-
-		switch (assoc->state) {
-		case CMAS_ASSOCIATED: {
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "associated: '%s' " MAC_FMT " \n",
-				  escape_essid(priv->essid, priv->essid_len),
-				  MAC_ARG(priv->bssid));
-
-			switch (priv->ieee->iw_mode) {
-			case IW_MODE_INFRA:
-				memcpy(priv->ieee->bssid, priv->bssid,
-				       ETH_ALEN);
-				break;
-
-			case IW_MODE_ADHOC:
-				memcpy(priv->ieee->bssid, priv->bssid,
-				       ETH_ALEN);
-
-				/* clear out the station table */
-				priv->num_stations = 0;
-
-				IPW_DEBUG_ASSOC("queueing adhoc check\n");
-				queue_delayed_work(priv->workqueue,
-						   &priv->adhoc_check,
-						   priv->assoc_request.beacon_interval);
-				break;
-			}
-
-			priv->status &= ~STATUS_ASSOCIATING;
-			priv->status |= STATUS_ASSOCIATED;
-
-			netif_carrier_on(priv->net_dev);
-			if (netif_queue_stopped(priv->net_dev)) {
-				IPW_DEBUG_NOTIF("waking queue\n");
-				netif_wake_queue(priv->net_dev);
-			} else {
-				IPW_DEBUG_NOTIF("starting queue\n");
-				netif_start_queue(priv->net_dev);
-			}
-
-			ipw_reset_stats(priv);
-			/* Ensure the rate is updated immediately */
-			priv->last_rate = ipw_get_current_rate(priv);
-			schedule_work(&priv->gather_stats);
-			notify_wx_assoc_event(priv);
-
-/*			queue_delayed_work(priv->workqueue,
-					   &priv->request_scan,
-					   SCAN_ASSOCIATED_INTERVAL);
-*/
-			break;
-		}
-
-		case CMAS_AUTHENTICATED: {
-			if (priv->status & (STATUS_ASSOCIATED | STATUS_AUTH)) {
-#ifdef CONFIG_IPW_DEBUG
-				struct notif_authenticate *auth = &notif->u.auth;
-				IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-					  "deauthenticated: '%s' " MAC_FMT ": (0x%04X) - %s \n",
-					  escape_essid(priv->essid, priv->essid_len),
-					  MAC_ARG(priv->bssid),
-					  ntohs(auth->status),
-					  ipw_get_status_code(ntohs(auth->status)));
-#endif
-
-				priv->status &= ~(STATUS_ASSOCIATING |
-						  STATUS_AUTH |
-						  STATUS_ASSOCIATED);
-
-				netif_carrier_off(priv->net_dev);
-				netif_stop_queue(priv->net_dev);
-				queue_work(priv->workqueue, &priv->request_scan);
-				notify_wx_assoc_event(priv);
-				break;
-			}
-
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "authenticated: '%s' " MAC_FMT "\n",
-				  escape_essid(priv->essid, priv->essid_len),
-				  MAC_ARG(priv->bssid));
-			break;
-		}
-
-		case CMAS_INIT: {
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "disassociated: '%s' " MAC_FMT " \n",
-				  escape_essid(priv->essid, priv->essid_len),
-				  MAC_ARG(priv->bssid));
-
-			priv->status &= ~(
-				STATUS_DISASSOCIATING |
-				STATUS_ASSOCIATING |
-				STATUS_ASSOCIATED |
-				STATUS_AUTH);
-
-			netif_stop_queue(priv->net_dev);
-			if (!(priv->status & STATUS_ROAMING)) {
-				netif_carrier_off(priv->net_dev);
-				notify_wx_assoc_event(priv);
-
-				/* Cancel any queued work ... */
-				cancel_delayed_work(&priv->request_scan);
-				cancel_delayed_work(&priv->adhoc_check);
-
-				/* Queue up another scan... */
-				queue_work(priv->workqueue,
-					   &priv->request_scan);
-
-				cancel_delayed_work(&priv->gather_stats);
-			} else {
-				priv->status |= STATUS_ROAMING;
-				queue_work(priv->workqueue,
-					   &priv->request_scan);
-			}
-
-			ipw_reset_stats(priv);
-			break;
-		}
-
-		default:
-			IPW_ERROR("assoc: unknown (%d)\n",
-				  assoc->state);
-			break;
-		}
-
-		break;
-	}
-
-	case HOST_NOTIFICATION_STATUS_AUTHENTICATE: {
-		struct notif_authenticate *auth = &notif->u.auth;
-		switch (auth->state) {
-		case CMAS_AUTHENTICATED:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
-				  "authenticated: '%s' " MAC_FMT " \n",
-				  escape_essid(priv->essid, priv->essid_len),
-				  MAC_ARG(priv->bssid));
-			priv->status |= STATUS_AUTH;
-			break;
-
-		case CMAS_INIT:
-			if (priv->status & STATUS_AUTH) {
-				IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-					  "authentication failed (0x%04X): %s\n",
-					  ntohs(auth->status),
-					  ipw_get_status_code(ntohs(auth->status)));
-			}
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "deauthenticated: '%s' " MAC_FMT "\n",
-				  escape_essid(priv->essid, priv->essid_len),
-				  MAC_ARG(priv->bssid));
-
-			priv->status &= ~(STATUS_ASSOCIATING |
-					  STATUS_AUTH |
-					  STATUS_ASSOCIATED);
-
-			netif_carrier_off(priv->net_dev);
-			netif_stop_queue(priv->net_dev);
-			queue_work(priv->workqueue, &priv->request_scan);
-			notify_wx_assoc_event(priv);
-			break;
-
-		case CMAS_TX_AUTH_SEQ_1:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "AUTH_SEQ_1\n");
-			break;
-		case CMAS_RX_AUTH_SEQ_2:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "AUTH_SEQ_2\n");
-			break;
-		case CMAS_AUTH_SEQ_1_PASS:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "AUTH_SEQ_1_PASS\n");
-			break;
-		case CMAS_AUTH_SEQ_1_FAIL:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "AUTH_SEQ_1_FAIL\n");
-			break;
-		case CMAS_TX_AUTH_SEQ_3:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "AUTH_SEQ_3\n");
-			break;
-		case CMAS_RX_AUTH_SEQ_4:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "RX_AUTH_SEQ_4\n");
-			break;
-		case CMAS_AUTH_SEQ_2_PASS:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "AUTH_SEQ_2_PASS\n");
-			break;
-		case CMAS_AUTH_SEQ_2_FAIL:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "AUT_SEQ_2_FAIL\n");
-			break;
-		case CMAS_TX_ASSOC:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "TX_ASSOC\n");
-			break;
-		case CMAS_RX_ASSOC_RESP:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "RX_ASSOC_RESP\n");
-			break;
-		case CMAS_ASSOCIATED:
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-				  "ASSOCIATED\n");
-			break;
-		default:
-			IPW_DEBUG_NOTIF("auth: failure - %d\n", auth->state);
-			break;
-		}
-		break;
-	}
-
-	case HOST_NOTIFICATION_STATUS_SCAN_CHANNEL_RESULT: {
-		struct notif_channel_result *x = &notif->u.channel_result;
-
-		if (notif->size == sizeof(*x)) {
-			IPW_DEBUG_SCAN("Scan result for channel %d\n",
-				       x->channel_num);
-		} else {
-			IPW_DEBUG_SCAN("Scan result of wrong size %d "
-				       "(should be %zd)\n",
-				       notif->size, sizeof(*x));
-		}
-		break;
-	}
-
-	case HOST_NOTIFICATION_STATUS_SCAN_COMPLETED: {
-		struct notif_scan_complete* x = &notif->u.scan_complete;
-		if (notif->size == sizeof(*x)) {
-			IPW_DEBUG_SCAN("Scan completed: type %d, %d channels, "
-				       "%d status\n",
-				       x->scan_type,
-				       x->num_channels,
-				       x->status);
-		} else {
-			IPW_ERROR("Scan completed of wrong size %d "
-				  "(should be %zd)\n",
-				  notif->size, sizeof(*x));
-		}
-
-		priv->status &= ~(STATUS_SCANNING | STATUS_SCAN_ABORTING);
-
-		cancel_delayed_work(&priv->scan_check);
-
-		if (!(priv->status & (STATUS_ASSOCIATED |
-				      STATUS_ASSOCIATING |
-				      STATUS_ROAMING |
-				      STATUS_DISASSOCIATING)))
-			queue_work(priv->workqueue, &priv->associate);
-		else if (priv->status & STATUS_ROAMING) {
-			/* If a scan completed and we are in roam mode, then
-			 * the scan that completed was the one requested as a
-			 * result of entering roam... so, schedule the
-			 * roam work */
-			queue_work(priv->workqueue, &priv->roam);
-		} else if (priv->status & STATUS_SCAN_PENDING)
-			queue_work(priv->workqueue, &priv->request_scan);
-
-		priv->ieee->scans++;
-		break;
-	}
-
-	case HOST_NOTIFICATION_STATUS_FRAG_LENGTH: {
-		struct notif_frag_length *x = &notif->u.frag_len;
-
-		if (notif->size == sizeof(*x)) {
-			IPW_ERROR("Frag length: %d\n", x->frag_length);
-		} else {
-			IPW_ERROR("Frag length of wrong size %d "
-				  "(should be %zd)\n",
-				  notif->size, sizeof(*x));
-		}
-		break;
-	}
-
-	case HOST_NOTIFICATION_STATUS_LINK_DETERIORATION: {
-		struct notif_link_deterioration *x =
-			&notif->u.link_deterioration;
-		if (notif->size==sizeof(*x)) {
-			IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
-				  "link deterioration: '%s' " MAC_FMT " \n",
-				  escape_essid(priv->essid, priv->essid_len),
-				  MAC_ARG(priv->bssid));
-			memcpy(&priv->last_link_deterioration, x, sizeof(*x));
-		} else {
-			IPW_ERROR("Link Deterioration of wrong size %d "
-				  "(should be %zd)\n",
-				  notif->size, sizeof(*x));
-		}
-		break;
-	}
-
-	case HOST_NOTIFICATION_DINO_CONFIG_RESPONSE: {
-		IPW_ERROR("Dino config\n");
-		if (priv->hcmd && priv->hcmd->cmd == HOST_CMD_DINO_CONFIG) {
-			/* TODO: Do anything special? */
-		} else {
-			IPW_ERROR("Unexpected DINO_CONFIG_RESPONSE\n");
-		}
-		break;
-	}
-
-	case HOST_NOTIFICATION_STATUS_BEACON_STATE: {
-		struct notif_beacon_state *x = &notif->u.beacon_state;
-		if (notif->size != sizeof(*x)) {
-			IPW_ERROR("Beacon state of wrong size %d (should "
-				  "be %zd)\n", notif->size, sizeof(*x));
-			break;
-		}
-
-		if (x->state == HOST_NOTIFICATION_STATUS_BEACON_MISSING) {
-			if (priv->status & STATUS_SCANNING) {
-				/* Stop scan to keep fw from getting
-				 * stuck... */
-				queue_work(priv->workqueue,
-					   &priv->abort_scan);
-			}
-
-			if (x->number > priv->missed_beacon_threshold &&
-			    priv->status & STATUS_ASSOCIATED) {
-				IPW_DEBUG(IPW_DL_INFO | IPW_DL_NOTIF |
-					  IPW_DL_STATE,
-					  "Missed beacon: %d - disassociate\n",
-					  x->number);
-				queue_work(priv->workqueue,
-					   &priv->disassociate);
-			} else if (x->number > priv->roaming_threshold) {
-				IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
-					  "Missed beacon: %d - initiate "
-					  "roaming\n",
-					  x->number);
-				queue_work(priv->workqueue,
-					   &priv->roam);
-			} else {
-				IPW_DEBUG_NOTIF("Missed beacon: %d\n",
-						x->number);
-			}
-
-			priv->notif_missed_beacons = x->number;
-
-                }
-
-
-		break;
-	}
-
-	case HOST_NOTIFICATION_STATUS_TGI_TX_KEY: {
-		struct notif_tgi_tx_key *x = &notif->u.tgi_tx_key;
-		if (notif->size==sizeof(*x)) {
-			IPW_ERROR("TGi Tx Key: state 0x%02x sec type "
-				  "0x%02x station %d\n",
-				  x->key_state,x->security_type,
-				  x->station_index);
-			break;
-		}
-
-		IPW_ERROR("TGi Tx Key of wrong size %d (should be %zd)\n",
-			  notif->size, sizeof(*x));
-		break;
-	}
-
-	case HOST_NOTIFICATION_CALIB_KEEP_RESULTS: {
-		struct notif_calibration *x = &notif->u.calibration;
-
-		if (notif->size == sizeof(*x)) {
-			memcpy(&priv->calib, x, sizeof(*x));
-			IPW_DEBUG_INFO("TODO: Calibration\n");
-			break;
-		}
-
-		IPW_ERROR("Calibration of wrong size %d (should be %zd)\n",
-			  notif->size, sizeof(*x));
-		break;
-	}
-
-	case HOST_NOTIFICATION_NOISE_STATS: {
-		if (notif->size == sizeof(u32)) {
-			priv->last_noise = (u8)(notif->u.noise.value & 0xff);
-			average_add(&priv->average_noise, priv->last_noise);
-			break;
-		}
-
-		IPW_ERROR("Noise stat is wrong size %d (should be %zd)\n",
-			  notif->size, sizeof(u32));
-		break;
-	}
-
-	default:
-		IPW_ERROR("Unknown notification: "
-			  "subtype=%d,flags=0x%2x,size=%d\n",
-			  notif->subtype, notif->flags, notif->size);
-	}
-}
-
-/**
- * Destroys all DMA structures and initialise them again
- *
- * @param priv
- * @return error code
- */
-static int ipw_queue_reset(struct ipw_priv *priv)
-{
-	int rc = 0;
-	/** @todo customize queue sizes */
-	int nTx = 64, nTxCmd = 8;
-	ipw_tx_queue_free(priv);
-	/* Tx CMD queue */
-	rc = ipw_queue_tx_init(priv, &priv->txq_cmd, nTxCmd,
-			       CX2_TX_CMD_QUEUE_READ_INDEX,
-			       CX2_TX_CMD_QUEUE_WRITE_INDEX,
-			       CX2_TX_CMD_QUEUE_BD_BASE,
-			       CX2_TX_CMD_QUEUE_BD_SIZE);
-	if (rc) {
-		IPW_ERROR("Tx Cmd queue init failed\n");
-		goto error;
-	}
-	/* Tx queue(s) */
-	rc = ipw_queue_tx_init(priv, &priv->txq[0], nTx,
-			       CX2_TX_QUEUE_0_READ_INDEX,
-			       CX2_TX_QUEUE_0_WRITE_INDEX,
-			       CX2_TX_QUEUE_0_BD_BASE,
-			       CX2_TX_QUEUE_0_BD_SIZE);
-	if (rc) {
-		IPW_ERROR("Tx 0 queue init failed\n");
-		goto error;
-	}
-	rc = ipw_queue_tx_init(priv, &priv->txq[1], nTx,
-			       CX2_TX_QUEUE_1_READ_INDEX,
-			       CX2_TX_QUEUE_1_WRITE_INDEX,
-			       CX2_TX_QUEUE_1_BD_BASE,
-			       CX2_TX_QUEUE_1_BD_SIZE);
-	if (rc) {
-		IPW_ERROR("Tx 1 queue init failed\n");
-		goto error;
-	}
-	rc = ipw_queue_tx_init(priv, &priv->txq[2], nTx,
-			       CX2_TX_QUEUE_2_READ_INDEX,
-			       CX2_TX_QUEUE_2_WRITE_INDEX,
-			       CX2_TX_QUEUE_2_BD_BASE,
-			       CX2_TX_QUEUE_2_BD_SIZE);
-	if (rc) {
-		IPW_ERROR("Tx 2 queue init failed\n");
-		goto error;
-	}
-	rc = ipw_queue_tx_init(priv, &priv->txq[3], nTx,
-			       CX2_TX_QUEUE_3_READ_INDEX,
-			       CX2_TX_QUEUE_3_WRITE_INDEX,
-			       CX2_TX_QUEUE_3_BD_BASE,
-			       CX2_TX_QUEUE_3_BD_SIZE);
-	if (rc) {
-		IPW_ERROR("Tx 3 queue init failed\n");
-		goto error;
-	}
-	/* statistics */
-	priv->rx_bufs_min = 0;
-	priv->rx_pend_max = 0;
-	return rc;
-
- error:
-	ipw_tx_queue_free(priv);
-	return rc;
-}
-
-/**
- * Reclaim Tx queue entries no more used by NIC.
- *
- * When FW adwances 'R' index, all entries between old and
- * new 'R' index need to be reclaimed. As result, some free space
- * forms. If there is enough free space (> low mark), wake Tx queue.
- *
- * @note Need to protect against garbage in 'R' index
- * @param priv
- * @param txq
- * @param qindex
- * @return Number of used entries remains in the queue
- */
-static int ipw_queue_tx_reclaim(struct ipw_priv *priv,
-				struct clx2_tx_queue *txq, int qindex)
-{
-	u32 hw_tail;
-	int used;
-	struct clx2_queue *q = &txq->q;
-
-	hw_tail = ipw_read32(priv, q->reg_r);
-	if (hw_tail >= q->n_bd) {
-		IPW_ERROR
-			("Read index for DMA queue (%d) is out of range [0-%d)\n",
-			 hw_tail, q->n_bd);
-		goto done;
-	}
-	for (; q->last_used != hw_tail;
-	     q->last_used = ipw_queue_inc_wrap(q->last_used, q->n_bd)) {
-		ipw_queue_tx_free_tfd(priv, txq);
-		priv->tx_packets++;
-	}
- done:
-	if (ipw_queue_space(q) > q->low_mark && qindex >= 0) {
-		__maybe_wake_tx(priv);
-	}
-	used = q->first_empty - q->last_used;
-	if (used < 0)
-		used += q->n_bd;
-
-	return used;
-}
-
-static int ipw_queue_tx_hcmd(struct ipw_priv *priv, int hcmd, void *buf,
-			     int len, int sync)
-{
-	struct clx2_tx_queue *txq = &priv->txq_cmd;
-	struct clx2_queue *q = &txq->q;
-	struct tfd_frame *tfd;
-
-	if (ipw_queue_space(q) < (sync ? 1 : 2)) {
-		IPW_ERROR("No space for Tx\n");
-		return -EBUSY;
-	}
-
-	tfd = &txq->bd[q->first_empty];
-	txq->txb[q->first_empty] = NULL;
-
-	memset(tfd, 0, sizeof(*tfd));
-	tfd->control_flags.message_type = TX_HOST_COMMAND_TYPE;
-	tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
-	priv->hcmd_seq++;
-	tfd->u.cmd.index = hcmd;
-	tfd->u.cmd.length = len;
-	memcpy(tfd->u.cmd.payload, buf, len);
-	q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
-	ipw_write32(priv, q->reg_w, q->first_empty);
-	_ipw_read32(priv, 0x90);
-
-	return 0;
-}
-
-
-
-/*
- * Rx theory of operation
- *
- * The host allocates 32 DMA target addresses and passes the host address
- * to the firmware at register CX2_RFDS_TABLE_LOWER + N * RFD_SIZE where N is
- * 0 to 31
- *
- * Rx Queue Indexes
- * The host/firmware share two index registers for managing the Rx buffers.
- *
- * The READ index maps to the first position that the firmware may be writing
- * to -- the driver can read up to (but not including) this position and get
- * good data.
- * The READ index is managed by the firmware once the card is enabled.
- *
- * The WRITE index maps to the last position the driver has read from -- the
- * position preceding WRITE is the last slot the firmware can place a packet.
- *
- * The queue is empty (no good data) if WRITE = READ - 1, and is full if
- * WRITE = READ.
- *
- * During initialization the host sets up the READ queue position to the first
- * INDEX position, and WRITE to the last (READ - 1 wrapped)
- *
- * When the firmware places a packet in a buffer it will advance the READ index
- * and fire the RX interrupt.  The driver can then query the READ index and
- * process as many packets as possible, moving the WRITE index forward as it
- * resets the Rx queue buffers with new memory.
- *
- * The management in the driver is as follows:
- * + A list of pre-allocated SKBs is stored in ipw->rxq->rx_free.  When
- *   ipw->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
- *   to replensish the ipw->rxq->rx_free.
- * + In ipw_rx_queue_replenish (scheduled) if 'processed' != 'read' then the
- *   ipw->rxq is replenished and the READ INDEX is updated (updating the
- *   'processed' and 'read' driver indexes as well)
- * + A received packet is processed and handed to the kernel network stack,
- *   detached from the ipw->rxq.  The driver 'processed' index is updated.
- * + The Host/Firmware ipw->rxq is replenished at tasklet time from the rx_free
- *   list. If there are no allocated buffers in ipw->rxq->rx_free, the READ
- *   INDEX is not incremented and ipw->status(RX_STALLED) is set.  If there
- *   were enough free buffers and RX_STALLED is set it is cleared.
- *
- *
- * Driver sequence:
- *
- * ipw_rx_queue_alloc()       Allocates rx_free
- * ipw_rx_queue_replenish()   Replenishes rx_free list from rx_used, and calls
- *                            ipw_rx_queue_restock
- * ipw_rx_queue_restock()     Moves available buffers from rx_free into Rx
- *                            queue, updates firmware pointers, and updates
- *                            the WRITE index.  If insufficient rx_free buffers
- *                            are available, schedules ipw_rx_queue_replenish
- *
- * -- enable interrupts --
- * ISR - ipw_rx()             Detach ipw_rx_mem_buffers from pool up to the
- *                            READ INDEX, detaching the SKB from the pool.
- *                            Moves the packet buffer from queue to rx_used.
- *                            Calls ipw_rx_queue_restock to refill any empty
- *                            slots.
- * ...
- *
- */
-
-/*
- * If there are slots in the RX queue that  need to be restocked,
- * and we have free pre-allocated buffers, fill the ranks as much
- * as we can pulling from rx_free.
- *
- * This moves the 'write' index forward to catch up with 'processed', and
- * also updates the memory address in the firmware to reference the new
- * target buffer.
- */
-static void ipw_rx_queue_restock(struct ipw_priv *priv)
-{
-	struct ipw_rx_queue *rxq = priv->rxq;
-	struct list_head *element;
-	struct ipw_rx_mem_buffer *rxb;
-	unsigned long flags;
-	int write;
-
-	spin_lock_irqsave(&rxq->lock, flags);
-	write = rxq->write;
-	while ((rxq->write != rxq->processed) && (rxq->free_count)) {
-		element = rxq->rx_free.next;
-		rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
-		list_del(element);
-
-		ipw_write32(priv, CX2_RFDS_TABLE_LOWER + rxq->write * RFD_SIZE,
-			    rxb->dma_addr);
-		rxq->queue[rxq->write] = rxb;
-		rxq->write = (rxq->write + 1) % RX_QUEUE_SIZE;
-		rxq->free_count--;
-	}
-	spin_unlock_irqrestore(&rxq->lock, flags);
-
-	/* If the pre-allocated buffer pool is dropping low, schedule to
-	 * refill it */
-	if (rxq->free_count <= RX_LOW_WATERMARK)
-		queue_work(priv->workqueue, &priv->rx_replenish);
-
-	/* If we've added more space for the firmware to place data, tell it */
-	if (write != rxq->write)
-		ipw_write32(priv, CX2_RX_WRITE_INDEX, rxq->write);
-}
-
-/*
- * Move all used packet from rx_used to rx_free, allocating a new SKB for each.
- * Also restock the Rx queue via ipw_rx_queue_restock.
- *
- * This is called as a scheduled work item (except for during intialization)
- */
-static void ipw_rx_queue_replenish(void *data)
-{
-	struct ipw_priv *priv = data;
-	struct ipw_rx_queue *rxq = priv->rxq;
-	struct list_head *element;
-	struct ipw_rx_mem_buffer *rxb;
-	unsigned long flags;
-
-	spin_lock_irqsave(&rxq->lock, flags);
-	while (!list_empty(&rxq->rx_used)) {
-		element = rxq->rx_used.next;
-		rxb = list_entry(element, struct ipw_rx_mem_buffer, list);
-		rxb->skb = alloc_skb(CX2_RX_BUF_SIZE, GFP_ATOMIC);
-		if (!rxb->skb) {
-			printk(KERN_CRIT "%s: Can not allocate SKB buffers.\n",
-			       priv->net_dev->name);
-			/* We don't reschedule replenish work here -- we will
-			 * call the restock method and if it still needs
-			 * more buffers it will schedule replenish */
-			break;
-		}
-		list_del(element);
-
-		rxb->rxb = (struct ipw_rx_buffer *)rxb->skb->data;
-		rxb->dma_addr = pci_map_single(
-			priv->pci_dev, rxb->skb->data, CX2_RX_BUF_SIZE,
-			PCI_DMA_FROMDEVICE);
-
-		list_add_tail(&rxb->list, &rxq->rx_free);
-		rxq->free_count++;
-	}
-	spin_unlock_irqrestore(&rxq->lock, flags);
-
-	ipw_rx_queue_restock(priv);
-}
-
-/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
- * If an SKB has been detached, the POOL needs to have it's SKB set to NULL
- * This free routine walks the list of POOL entries and if SKB is set to
- * non NULL it is unmapped and freed
- */
-static void ipw_rx_queue_free(struct ipw_priv *priv,
-			      struct ipw_rx_queue *rxq)
-{
-	int i;
-
-	if (!rxq)
-		return;
-
-	for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-		if (rxq->pool[i].skb != NULL) {
-			pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
-					 CX2_RX_BUF_SIZE,
-					 PCI_DMA_FROMDEVICE);
-			dev_kfree_skb(rxq->pool[i].skb);
-		}
-	}
-
-	kfree(rxq);
-}
-
-static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *priv)
-{
-	struct ipw_rx_queue *rxq;
-	int i;
-
-	rxq = (struct ipw_rx_queue *)kmalloc(sizeof(*rxq), GFP_KERNEL);
-	memset(rxq, 0, sizeof(*rxq));
-	spin_lock_init(&rxq->lock);
-	INIT_LIST_HEAD(&rxq->rx_free);
-	INIT_LIST_HEAD(&rxq->rx_used);
-
-	/* Fill the rx_used queue with _all_ of the Rx buffers */
-	for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
-		list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
-
-	/* Set us so that we have processed and used all buffers, but have
-	 * not restocked the Rx queue with fresh buffers */
-	rxq->read = rxq->write = 0;
-	rxq->processed = RX_QUEUE_SIZE - 1;
-	rxq->free_count = 0;
-
-	return rxq;
-}
-
-static int ipw_is_rate_in_mask(struct ipw_priv *priv, int ieee_mode, u8 rate)
-{
-	rate &= ~IEEE80211_BASIC_RATE_MASK;
-	if (ieee_mode == IEEE_A) {
-		switch (rate) {
-		case IEEE80211_OFDM_RATE_6MB:
-			return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ?
-				1 : 0;
-		case IEEE80211_OFDM_RATE_9MB:
-			return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ?
-				1 : 0;
-		case IEEE80211_OFDM_RATE_12MB:
-			return priv->rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ?
-				1 : 0;
-		case IEEE80211_OFDM_RATE_18MB:
-			return priv->rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ?
-				1 : 0;
-		case IEEE80211_OFDM_RATE_24MB:
-			return priv->rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ?
-				1 : 0;
-		case IEEE80211_OFDM_RATE_36MB:
-			return priv->rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ?
-				1 : 0;
-		case IEEE80211_OFDM_RATE_48MB:
-			return priv->rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ?
-				1 : 0;
-		case IEEE80211_OFDM_RATE_54MB:
-			return priv->rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ?
-				1 : 0;
-		default:
-			return 0;
-		}
-	}
-
-	/* B and G mixed */
-	switch (rate) {
-	case IEEE80211_CCK_RATE_1MB:
-		return priv->rates_mask & IEEE80211_CCK_RATE_1MB_MASK ? 1 : 0;
-	case IEEE80211_CCK_RATE_2MB:
-		return priv->rates_mask & IEEE80211_CCK_RATE_2MB_MASK ? 1 : 0;
-	case IEEE80211_CCK_RATE_5MB:
-		return priv->rates_mask & IEEE80211_CCK_RATE_5MB_MASK ? 1 : 0;
-	case IEEE80211_CCK_RATE_11MB:
-		return priv->rates_mask & IEEE80211_CCK_RATE_11MB_MASK ? 1 : 0;
-	}
-
-	/* If we are limited to B modulations, bail at this point */
-	if (ieee_mode == IEEE_B)
-		return 0;
-
-	/* G */
-	switch (rate) {
-	case IEEE80211_OFDM_RATE_6MB:
-		return priv->rates_mask & IEEE80211_OFDM_RATE_6MB_MASK ? 1 : 0;
-	case IEEE80211_OFDM_RATE_9MB:
-		return priv->rates_mask & IEEE80211_OFDM_RATE_9MB_MASK ? 1 : 0;
-	case IEEE80211_OFDM_RATE_12MB:
-		return priv->rates_mask & IEEE80211_OFDM_RATE_12MB_MASK ? 1 : 0;
-	case IEEE80211_OFDM_RATE_18MB:
-		return priv->rates_mask & IEEE80211_OFDM_RATE_18MB_MASK ? 1 : 0;
-	case IEEE80211_OFDM_RATE_24MB:
-		return priv->rates_mask & IEEE80211_OFDM_RATE_24MB_MASK ? 1 : 0;
-	case IEEE80211_OFDM_RATE_36MB:
-		return priv->rates_mask & IEEE80211_OFDM_RATE_36MB_MASK ? 1 : 0;
-	case IEEE80211_OFDM_RATE_48MB:
-		return priv->rates_mask & IEEE80211_OFDM_RATE_48MB_MASK ? 1 : 0;
-	case IEEE80211_OFDM_RATE_54MB:
-		return priv->rates_mask & IEEE80211_OFDM_RATE_54MB_MASK ? 1 : 0;
-	}
-
-	return 0;
-}
-
-static int ipw_compatible_rates(struct ipw_priv *priv,
-				const struct ieee80211_network *network,
-				struct ipw_supported_rates *rates)
-{
-	int num_rates, i;
-
-	memset(rates, 0, sizeof(*rates));
-	num_rates = min(network->rates_len, (u8)IPW_MAX_RATES);
-	rates->num_rates = 0;
-	for (i = 0; i < num_rates; i++) {
-		if (!ipw_is_rate_in_mask(priv, network->mode, network->rates[i])) {
-			IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
-				       network->rates[i], priv->rates_mask);
-			continue;
-		}
-
-		rates->supported_rates[rates->num_rates++] = network->rates[i];
-	}
-
-	num_rates = min(network->rates_ex_len, (u8)(IPW_MAX_RATES - num_rates));
-	for (i = 0; i < num_rates; i++) {
-		if (!ipw_is_rate_in_mask(priv, network->mode, network->rates_ex[i])) {
-			IPW_DEBUG_SCAN("Rate %02X masked : 0x%08X\n",
-				       network->rates_ex[i], priv->rates_mask);
-			continue;
-		}
-
-		rates->supported_rates[rates->num_rates++] = network->rates_ex[i];
-	}
-
-	return rates->num_rates;
-}
-
-static inline void ipw_copy_rates(struct ipw_supported_rates *dest,
-				  const struct ipw_supported_rates *src)
-{
-	u8 i;
-	for (i = 0; i < src->num_rates; i++)
-		dest->supported_rates[i] = src->supported_rates[i];
-	dest->num_rates = src->num_rates;
-}
-
-/* TODO: Look at sniffed packets in the air to determine if the basic rate
- * mask should ever be used -- right now all callers to add the scan rates are
- * set with the modulation = CCK, so BASIC_RATE_MASK is never set... */
-static void ipw_add_cck_scan_rates(struct ipw_supported_rates *rates,
-			       u8 modulation, u32 rate_mask)
-{
-	u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
-		IEEE80211_BASIC_RATE_MASK : 0;
-
-	if (rate_mask & IEEE80211_CCK_RATE_1MB_MASK)
-		rates->supported_rates[rates->num_rates++] =
-			IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
-
-	if (rate_mask & IEEE80211_CCK_RATE_2MB_MASK)
-		rates->supported_rates[rates->num_rates++] =
-			IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
-
-	if (rate_mask & IEEE80211_CCK_RATE_5MB_MASK)
-		rates->supported_rates[rates->num_rates++] = basic_mask |
-			IEEE80211_CCK_RATE_5MB;
-
-	if (rate_mask & IEEE80211_CCK_RATE_11MB_MASK)
-		rates->supported_rates[rates->num_rates++] = basic_mask |
-			IEEE80211_CCK_RATE_11MB;
-}
-
-static void ipw_add_ofdm_scan_rates(struct ipw_supported_rates *rates,
-				u8 modulation, u32 rate_mask)
-{
-	u8 basic_mask = (IEEE80211_OFDM_MODULATION == modulation) ?
-		IEEE80211_BASIC_RATE_MASK : 0;
-
-	if (rate_mask & IEEE80211_OFDM_RATE_6MB_MASK)
-		rates->supported_rates[rates->num_rates++] = basic_mask |
-			IEEE80211_OFDM_RATE_6MB;
-
-	if (rate_mask & IEEE80211_OFDM_RATE_9MB_MASK)
-		rates->supported_rates[rates->num_rates++] =
-			IEEE80211_OFDM_RATE_9MB;
-
-	if (rate_mask & IEEE80211_OFDM_RATE_12MB_MASK)
-		rates->supported_rates[rates->num_rates++] = basic_mask |
-			IEEE80211_OFDM_RATE_12MB;
-
-	if (rate_mask & IEEE80211_OFDM_RATE_18MB_MASK)
-		rates->supported_rates[rates->num_rates++] =
-			IEEE80211_OFDM_RATE_18MB;
-
-	if (rate_mask & IEEE80211_OFDM_RATE_24MB_MASK)
-		rates->supported_rates[rates->num_rates++] = basic_mask |
-			IEEE80211_OFDM_RATE_24MB;
-
-	if (rate_mask & IEEE80211_OFDM_RATE_36MB_MASK)
-		rates->supported_rates[rates->num_rates++] =
-			IEEE80211_OFDM_RATE_36MB;
-
-	if (rate_mask & IEEE80211_OFDM_RATE_48MB_MASK)
-		rates->supported_rates[rates->num_rates++] =
-			IEEE80211_OFDM_RATE_48MB;
-
-	if (rate_mask & IEEE80211_OFDM_RATE_54MB_MASK)
-		rates->supported_rates[rates->num_rates++] =
-			IEEE80211_OFDM_RATE_54MB;
-}
-
-struct ipw_network_match {
-	struct ieee80211_network *network;
-	struct ipw_supported_rates rates;
-};
-
-static int ipw_best_network(
-	struct ipw_priv *priv,
-	struct ipw_network_match *match,
-	struct ieee80211_network *network,
-	int roaming)
-{
-	struct ipw_supported_rates rates;
-
-	/* Verify that this network's capability is compatible with the
-	 * current mode (AdHoc or Infrastructure) */
-	if ((priv->ieee->iw_mode == IW_MODE_INFRA &&
-	     !(network->capability & WLAN_CAPABILITY_ESS)) ||
-	    (priv->ieee->iw_mode == IW_MODE_ADHOC &&
-	     !(network->capability & WLAN_CAPABILITY_IBSS))) {
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded due to "
-				"capability mismatch.\n",
-				escape_essid(network->ssid, network->ssid_len),
-				MAC_ARG(network->bssid));
-		return 0;
-	}
-
-	/* If we do not have an ESSID for this AP, we can not associate with
-	 * it */
-	if (network->flags & NETWORK_EMPTY_ESSID) {
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
-				"because of hidden ESSID.\n",
-				escape_essid(network->ssid, network->ssid_len),
-				MAC_ARG(network->bssid));
-		return 0;
-	}
-
-	if (unlikely(roaming)) {
-		/* If we are roaming, then ensure check if this is a valid
-		 * network to try and roam to */
-		if ((network->ssid_len != match->network->ssid_len) ||
-		    memcmp(network->ssid, match->network->ssid,
-			   network->ssid_len)) {
-			IPW_DEBUG_ASSOC("Netowrk '%s (" MAC_FMT ")' excluded "
-					"because of non-network ESSID.\n",
-					escape_essid(network->ssid,
-						     network->ssid_len),
-					MAC_ARG(network->bssid));
-			return 0;
-		}
-	} else {
-		/* If an ESSID has been configured then compare the broadcast
-		 * ESSID to ours */
-		if ((priv->config & CFG_STATIC_ESSID) &&
-		    ((network->ssid_len != priv->essid_len) ||
-		     memcmp(network->ssid, priv->essid,
-			    min(network->ssid_len, priv->essid_len)))) {
-			char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
-			strncpy(escaped, escape_essid(
-					network->ssid, network->ssid_len),
-				sizeof(escaped));
-			IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
-					"because of ESSID mismatch: '%s'.\n",
-					escaped, MAC_ARG(network->bssid),
-					escape_essid(priv->essid, priv->essid_len));
-			return 0;
-		}
-	}
-
-	/* If the old network rate is better than this one, don't bother
-	 * testing everything else. */
-	if (match->network && match->network->stats.rssi >
-	    network->stats.rssi) {
-		char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
-		strncpy(escaped,
-			escape_essid(network->ssid, network->ssid_len),
-			sizeof(escaped));
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded because "
-				"'%s (" MAC_FMT ")' has a stronger signal.\n",
-				escaped, MAC_ARG(network->bssid),
-				escape_essid(match->network->ssid,
-					     match->network->ssid_len),
-				MAC_ARG(match->network->bssid));
-		return 0;
-	}
-
-	/* If this network has already had an association attempt within the
-	 * last 3 seconds, do not try and associate again... */
-	if (network->last_associate &&
-	    time_after(network->last_associate + (HZ * 5UL), jiffies)) {
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
-				"because of storming (%lu since last "
-				"assoc attempt).\n",
-				escape_essid(network->ssid, network->ssid_len),
-				MAC_ARG(network->bssid),
-				(jiffies - network->last_associate) / HZ);
-		return 0;
-	}
-
-	/* Now go through and see if the requested network is valid... */
-	if (priv->ieee->scan_age != 0 &&
-	    jiffies - network->last_scanned > priv->ieee->scan_age) {
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
-				"because of age: %lums.\n",
-				escape_essid(network->ssid, network->ssid_len),
-				MAC_ARG(network->bssid),
-				(jiffies - network->last_scanned) / (HZ / 100));
-		return 0;
-	}
-
-	if ((priv->config & CFG_STATIC_CHANNEL) &&
-	    (network->channel != priv->channel)) {
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
-				"because of channel mismatch: %d != %d.\n",
-				escape_essid(network->ssid, network->ssid_len),
-				MAC_ARG(network->bssid),
-				network->channel, priv->channel);
-		return 0;
-	}
-
-	/* Verify privacy compatability */
-	if (((priv->capability & CAP_PRIVACY_ON) ? 1 : 0) !=
-	    ((network->capability & WLAN_CAPABILITY_PRIVACY) ? 1 : 0)) {
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
-				"because of privacy mismatch: %s != %s.\n",
-				escape_essid(network->ssid, network->ssid_len),
-				MAC_ARG(network->bssid),
-				priv->capability & CAP_PRIVACY_ON ? "on" :
-				"off",
-				network->capability &
-				WLAN_CAPABILITY_PRIVACY ?"on" : "off");
-		return 0;
-	}
-
-	if ((priv->config & CFG_STATIC_BSSID) &&
-	    memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
-				"because of BSSID mismatch: " MAC_FMT ".\n",
-				escape_essid(network->ssid, network->ssid_len),
-				MAC_ARG(network->bssid),
-				MAC_ARG(priv->bssid));
-		return 0;
-	}
-
-	/* Filter out any incompatible freq / mode combinations */
-	if (!ieee80211_is_valid_mode(priv->ieee, network->mode)) {
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
-				"because of invalid frequency/mode "
-				"combination.\n",
-				escape_essid(network->ssid, network->ssid_len),
-				MAC_ARG(network->bssid));
-		return 0;
-	}
-
-	ipw_compatible_rates(priv, network, &rates);
-	if (rates.num_rates == 0) {
-		IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' excluded "
-				"because of no compatible rates.\n",
-				escape_essid(network->ssid, network->ssid_len),
-				MAC_ARG(network->bssid));
-		return 0;
-	}
-
-	/* TODO: Perform any further minimal comparititive tests.  We do not
-	 * want to put too much policy logic here; intelligent scan selection
-	 * should occur within a generic IEEE 802.11 user space tool.  */
-
-	/* Set up 'new' AP to this network */
-	ipw_copy_rates(&match->rates, &rates);
-	match->network = network;
-
-	IPW_DEBUG_ASSOC("Network '%s (" MAC_FMT ")' is a viable match.\n",
-			escape_essid(network->ssid, network->ssid_len),
-			MAC_ARG(network->bssid));
-
-	return 1;
-}
-
-
-static void ipw_adhoc_create(struct ipw_priv *priv,
-			    struct ieee80211_network *network)
-{
-	/*
-	 * For the purposes of scanning, we can set our wireless mode
-	 * to trigger scans across combinations of bands, but when it
-	 * comes to creating a new ad-hoc network, we have tell the FW
-	 * exactly which band to use.
-	 *
-	 * We also have the possibility of an invalid channel for the
-	 * chossen band.  Attempting to create a new ad-hoc network
-	 * with an invalid channel for wireless mode will trigger a
-	 * FW fatal error.
-	 */
-	network->mode = is_valid_channel(priv->ieee->mode, priv->channel);
-	if (network->mode) {
-		network->channel = priv->channel;
-	} else {
-		IPW_WARNING("Overriding invalid channel\n");
-		if (priv->ieee->mode & IEEE_A) {
-			network->mode = IEEE_A;
-			priv->channel = band_a_active_channel[0];
-		} else if (priv->ieee->mode & IEEE_G) {
-			network->mode = IEEE_G;
-			priv->channel = band_b_active_channel[0];
-		} else {
-			network->mode = IEEE_B;
-			priv->channel = band_b_active_channel[0];
-		}
-	}
-
-	network->channel = priv->channel;
-	priv->config |= CFG_ADHOC_PERSIST;
-	ipw_create_bssid(priv, network->bssid);
-	network->ssid_len = priv->essid_len;
-	memcpy(network->ssid, priv->essid, priv->essid_len);
-	memset(&network->stats, 0, sizeof(network->stats));
-	network->capability = WLAN_CAPABILITY_IBSS;
-	if (priv->capability & CAP_PRIVACY_ON)
-		network->capability |= WLAN_CAPABILITY_PRIVACY;
-	network->rates_len = min(priv->rates.num_rates, MAX_RATES_LENGTH);
-	memcpy(network->rates, priv->rates.supported_rates,
-	       network->rates_len);
-	network->rates_ex_len = priv->rates.num_rates - network->rates_len;
-	memcpy(network->rates_ex,
-	       &priv->rates.supported_rates[network->rates_len],
-	       network->rates_ex_len);
-	network->last_scanned = 0;
-	network->flags = 0;
-	network->last_associate = 0;
-	network->time_stamp[0] = 0;
-	network->time_stamp[1] = 0;
-	network->beacon_interval = 100; /* Default */
-	network->listen_interval = 10;  /* Default */
-	network->atim_window = 0;       /* Default */
-#ifdef CONFIG_IEEE80211_WPA
-	network->wpa_ie_len = 0;
-	network->rsn_ie_len = 0;
-#endif /* CONFIG_IEEE80211_WPA */
-}
-
-static void ipw_send_wep_keys(struct ipw_priv *priv)
-{
-	struct ipw_wep_key *key;
-	int i;
-	struct host_cmd cmd = {
-		.cmd = IPW_CMD_WEP_KEY,
-		.len = sizeof(*key)
-	};
-
-	key = (struct ipw_wep_key *)&cmd.param;
-	key->cmd_id = DINO_CMD_WEP_KEY;
-	key->seq_num = 0;
-
-	for (i = 0; i < 4; i++) {
-		key->key_index = i;
-		if (!(priv->sec.flags & (1 << i))) {
-			key->key_size = 0;
-		} else {
-			key->key_size = priv->sec.key_sizes[i];
-			memcpy(key->key, priv->sec.keys[i], key->key_size);
-		}
-
-		if (ipw_send_cmd(priv, &cmd)) {
-			IPW_ERROR("failed to send WEP_KEY command\n");
-			return;
-		}
-	}
-}
-
-static void ipw_adhoc_check(void *data)
-{
-	struct ipw_priv *priv = data;
-
-	if (priv->missed_adhoc_beacons++ > priv->missed_beacon_threshold &&
-	    !(priv->config & CFG_ADHOC_PERSIST)) {
-		IPW_DEBUG_SCAN("Disassociating due to missed beacons\n");
-		ipw_remove_current_network(priv);
-		ipw_disassociate(priv);
-		return;
-	}
-
-	queue_delayed_work(priv->workqueue, &priv->adhoc_check,
-			   priv->assoc_request.beacon_interval);
-}
-
-#ifdef CONFIG_IPW_DEBUG
-static void ipw_debug_config(struct ipw_priv *priv)
-{
-	IPW_DEBUG_INFO("Scan completed, no valid APs matched "
-		       "[CFG 0x%08X]\n", priv->config);
-	if (priv->config & CFG_STATIC_CHANNEL)
-		IPW_DEBUG_INFO("Channel locked to %d\n",
-			       priv->channel);
-	else
-		IPW_DEBUG_INFO("Channel unlocked.\n");
-	if (priv->config & CFG_STATIC_ESSID)
-		IPW_DEBUG_INFO("ESSID locked to '%s'\n",
-			       escape_essid(priv->essid,
-					    priv->essid_len));
-	else
-		IPW_DEBUG_INFO("ESSID unlocked.\n");
-	if (priv->config & CFG_STATIC_BSSID)
-		IPW_DEBUG_INFO("BSSID locked to %d\n", priv->channel);
-	else
-		IPW_DEBUG_INFO("BSSID unlocked.\n");
-	if (priv->capability & CAP_PRIVACY_ON)
-		IPW_DEBUG_INFO("PRIVACY on\n");
-	else
-		IPW_DEBUG_INFO("PRIVACY off\n");
-	IPW_DEBUG_INFO("RATE MASK: 0x%08X\n", priv->rates_mask);
-}
-#else
-#define ipw_debug_config(x) do {} while (0)
-#endif
-
-static inline void ipw_set_fixed_rate(struct ipw_priv *priv,
-				      struct ieee80211_network *network)
-{
-	/* TODO: Verify that this works... */
-	struct ipw_fixed_rate fr = {
-		.tx_rates = priv->rates_mask
-	};
-	u32 reg;
-	u16 mask = 0;
-
-	/* Identify 'current FW band' and match it with the fixed
-	 * Tx rates */
-
-	switch (priv->ieee->freq_band) {
-	case IEEE80211_52GHZ_BAND: /* A only */
-		/* IEEE_A */
-		if (priv->rates_mask & ~IEEE80211_OFDM_RATES_MASK) {
-			/* Invalid fixed rate mask */
-			fr.tx_rates = 0;
-			break;
-		}
-
-		fr.tx_rates >>= IEEE80211_OFDM_SHIFT_MASK_A;
-		break;
-
-	default: /* 2.4Ghz or Mixed */
-		/* IEEE_B */
-		if (network->mode == IEEE_B) {
-			if (fr.tx_rates & ~IEEE80211_CCK_RATES_MASK) {
-				/* Invalid fixed rate mask */
-				fr.tx_rates = 0;
-			}
-			break;
-		}
-
-		/* IEEE_G */
-		if (fr.tx_rates & ~(IEEE80211_CCK_RATES_MASK |
-				    IEEE80211_OFDM_RATES_MASK)) {
-			/* Invalid fixed rate mask */
-			fr.tx_rates = 0;
-			break;
-		}
-
-		if (IEEE80211_OFDM_RATE_6MB_MASK & fr.tx_rates) {
-			mask |= (IEEE80211_OFDM_RATE_6MB_MASK >> 1);
-			fr.tx_rates &= ~IEEE80211_OFDM_RATE_6MB_MASK;
-		}
-
-		if (IEEE80211_OFDM_RATE_9MB_MASK & fr.tx_rates) {
-			mask |= (IEEE80211_OFDM_RATE_9MB_MASK >> 1);
-			fr.tx_rates &= ~IEEE80211_OFDM_RATE_9MB_MASK;
-		}
-
-		if (IEEE80211_OFDM_RATE_12MB_MASK & fr.tx_rates) {
-			mask |= (IEEE80211_OFDM_RATE_12MB_MASK >> 1);
-			fr.tx_rates &= ~IEEE80211_OFDM_RATE_12MB_MASK;
-		}
-
-		fr.tx_rates |= mask;
-		break;
-	}
-
-	reg = ipw_read32(priv, IPW_MEM_FIXED_OVERRIDE);
-	ipw_write_reg32(priv, reg, *(u32*)&fr);
-}
-
-static int ipw_associate_network(struct ipw_priv *priv,
-				 struct ieee80211_network *network,
-				 struct ipw_supported_rates *rates,
-				 int roaming)
-{
-	int err;
-
-	if (priv->config & CFG_FIXED_RATE)
-		ipw_set_fixed_rate(priv, network);
-
-	if (!(priv->config & CFG_STATIC_ESSID)) {
-		priv->essid_len = min(network->ssid_len,
-				      (u8)IW_ESSID_MAX_SIZE);
-		memcpy(priv->essid, network->ssid, priv->essid_len);
-	}
-
-	network->last_associate = jiffies;
-
-	memset(&priv->assoc_request, 0, sizeof(priv->assoc_request));
-	priv->assoc_request.channel = network->channel;
-	if ((priv->capability & CAP_PRIVACY_ON) &&
-	    (priv->capability & CAP_SHARED_KEY)) {
-		priv->assoc_request.auth_type = AUTH_SHARED_KEY;
-		priv->assoc_request.auth_key = priv->sec.active_key;
-	} else {
-		priv->assoc_request.auth_type = AUTH_OPEN;
-		priv->assoc_request.auth_key = 0;
-	}
-
-	if (priv->capability & CAP_PRIVACY_ON)
-		ipw_send_wep_keys(priv);
-
-	/*
-	 * It is valid for our ieee device to support multiple modes, but
-	 * when it comes to associating to a given network we have to choose
-	 * just one mode.
-	 */
-	if (network->mode & priv->ieee->mode & IEEE_A)
-		priv->assoc_request.ieee_mode = IPW_A_MODE;
-	else if (network->mode & priv->ieee->mode & IEEE_G)
-		priv->assoc_request.ieee_mode = IPW_G_MODE;
-	else if (network->mode & priv->ieee->mode & IEEE_B)
-		priv->assoc_request.ieee_mode = IPW_B_MODE;
-
-	IPW_DEBUG_ASSOC("%sssocation attempt: '%s', channel %d, "
-			"802.11%c [%d], enc=%s%s%s%c%c\n",
-			roaming ? "Rea" : "A",
-			escape_essid(priv->essid, priv->essid_len),
-			network->channel,
-			ipw_modes[priv->assoc_request.ieee_mode],
-			rates->num_rates,
-			priv->capability & CAP_PRIVACY_ON ? "on " : "off",
-			priv->capability & CAP_PRIVACY_ON ?
-			(priv->capability & CAP_SHARED_KEY ? "(shared)" :
-			 "(open)") : "",
-			priv->capability & CAP_PRIVACY_ON ? " key=" : "",
-			priv->capability & CAP_PRIVACY_ON ?
-			'1' + priv->sec.active_key : '.',
-			priv->capability & CAP_PRIVACY_ON ?
-			'.' : ' ');
-
-	priv->assoc_request.beacon_interval = network->beacon_interval;
-	if ((priv->ieee->iw_mode == IW_MODE_ADHOC) &&
-	    (network->time_stamp[0] == 0) &&
-	    (network->time_stamp[1] == 0)) {
-		priv->assoc_request.assoc_type = HC_IBSS_START;
-		priv->assoc_request.assoc_tsf_msw = 0;
-		priv->assoc_request.assoc_tsf_lsw = 0;
-	} else {
-		if (unlikely(roaming))
-			priv->assoc_request.assoc_type = HC_REASSOCIATE;
-		else
-			priv->assoc_request.assoc_type = HC_ASSOCIATE;
-		priv->assoc_request.assoc_tsf_msw = network->time_stamp[1];
-		priv->assoc_request.assoc_tsf_lsw = network->time_stamp[0];
-	}
-
-	memcpy(&priv->assoc_request.bssid, network->bssid, ETH_ALEN);
-
-	if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
-		memset(&priv->assoc_request.dest, 0xFF, ETH_ALEN);
-		priv->assoc_request.atim_window = network->atim_window;
-	} else {
-		memcpy(&priv->assoc_request.dest, network->bssid,
-		       ETH_ALEN);
-		priv->assoc_request.atim_window = 0;
-	}
-
-	priv->assoc_request.capability = network->capability;
-	priv->assoc_request.listen_interval = network->listen_interval;
-
-	err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
-	if (err) {
-		IPW_DEBUG_HC("Attempt to send SSID command failed.\n");
-		return err;
-	}
-
-	rates->ieee_mode = priv->assoc_request.ieee_mode;
-	rates->purpose = IPW_RATE_CONNECT;
-	ipw_send_supported_rates(priv, rates);
-
-	if (priv->assoc_request.ieee_mode == IPW_G_MODE)
-		priv->sys_config.dot11g_auto_detection = 1;
-	else
-		priv->sys_config.dot11g_auto_detection = 0;
-	err = ipw_send_system_config(priv, &priv->sys_config);
-	if (err) {
-		IPW_DEBUG_HC("Attempt to send sys config command failed.\n");
-		return err;
-	}
-
-	IPW_DEBUG_ASSOC("Association sensitivity: %d\n", network->stats.rssi);
-	err = ipw_set_sensitivity(priv, network->stats.rssi);
-	if (err) {
-		IPW_DEBUG_HC("Attempt to send associate command failed.\n");
-		return err;
-	}
-
-	/*
-	 * If preemption is enabled, it is possible for the association
-	 * to complete before we return from ipw_send_associate.  Therefore
-	 * we have to be sure and update our priviate data first.
-	 */
-	priv->channel = network->channel;
-	memcpy(priv->bssid, network->bssid, ETH_ALEN);
-	priv->status |= STATUS_ASSOCIATING;
-	priv->status &= ~STATUS_SECURITY_UPDATED;
-
-	priv->assoc_network = network;
-
-	err = ipw_send_associate(priv, &priv->assoc_request);
-	if (err) {
-		IPW_DEBUG_HC("Attempt to send associate command failed.\n");
-		return err;
-	}
-
-	IPW_DEBUG(IPW_DL_STATE, "associating: '%s' " MAC_FMT " \n",
-		  escape_essid(priv->essid, priv->essid_len),
-		  MAC_ARG(priv->bssid));
-
-	return 0;
-}
-
-static void ipw_roam(void *data)
-{
-	struct ipw_priv *priv = data;
-	struct ieee80211_network *network = NULL;
-	struct ipw_network_match match = {
-		.network = priv->assoc_network
-	};
-
-	/* The roaming process is as follows:
-	 *
-	 * 1.  Missed beacon threshold triggers the roaming process by
-	 *     setting the status ROAM bit and requesting a scan.
-	 * 2.  When the scan completes, it schedules the ROAM work
-	 * 3.  The ROAM work looks at all of the known networks for one that
-	 *     is a better network than the currently associated.  If none
-	 *     found, the ROAM process is over (ROAM bit cleared)
-	 * 4.  If a better network is found, a disassociation request is
-	 *     sent.
-	 * 5.  When the disassociation completes, the roam work is again
-	 *     scheduled.  The second time through, the driver is no longer
-	 *     associated, and the newly selected network is sent an
-	 *     association request.
-	 * 6.  At this point ,the roaming process is complete and the ROAM
-	 *     status bit is cleared.
-	 */
-
-	/* If we are no longer associated, and the roaming bit is no longer
-	 * set, then we are not actively roaming, so just return */
-	if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ROAMING)))
-		return;
-
-	if (priv->status & STATUS_ASSOCIATED) {
-		/* First pass through ROAM process -- look for a better
-		 * network */
-		u8 rssi = priv->assoc_network->stats.rssi;
-		priv->assoc_network->stats.rssi = -128;
-		list_for_each_entry(network, &priv->ieee->network_list, list) {
-			if (network != priv->assoc_network)
-				ipw_best_network(priv, &match, network, 1);
-		}
-		priv->assoc_network->stats.rssi = rssi;
-
-		if (match.network == priv->assoc_network) {
-			IPW_DEBUG_ASSOC("No better APs in this network to "
-					"roam to.\n");
-			priv->status &= ~STATUS_ROAMING;
-			ipw_debug_config(priv);
-			return;
-		}
-
-		ipw_send_disassociate(priv, 1);
-		priv->assoc_network = match.network;
-
-		return;
-	}
-
-	/* Second pass through ROAM process -- request association */
-	ipw_compatible_rates(priv, priv->assoc_network, &match.rates);
-	ipw_associate_network(priv, priv->assoc_network, &match.rates, 1);
-	priv->status &= ~STATUS_ROAMING;
-}
-
-static void ipw_associate(void *data)
-{
-	struct ipw_priv *priv = data;
-
-	struct ieee80211_network *network = NULL;
-	struct ipw_network_match match = {
-		.network = NULL
-	};
-	struct ipw_supported_rates *rates;
-	struct list_head *element;
-
-	if (!(priv->config & CFG_ASSOCIATE) &&
-	    !(priv->config & (CFG_STATIC_ESSID |
-			      CFG_STATIC_CHANNEL |
-			      CFG_STATIC_BSSID))) {
-		IPW_DEBUG_ASSOC("Not attempting association (associate=0)\n");
-		return;
-	}
-
-	list_for_each_entry(network, &priv->ieee->network_list, list)
-		ipw_best_network(priv, &match, network, 0);
-
-	network = match.network;
-	rates = &match.rates;
-
-	if (network == NULL &&
-	    priv->ieee->iw_mode == IW_MODE_ADHOC &&
-	    priv->config & CFG_ADHOC_CREATE &&
-	    priv->config & CFG_STATIC_ESSID &&
-	    !list_empty(&priv->ieee->network_free_list)) {
-		element = priv->ieee->network_free_list.next;
-		network = list_entry(element, struct ieee80211_network,
-				     list);
-		ipw_adhoc_create(priv, network);
-		rates = &priv->rates;
-		list_del(element);
-		list_add_tail(&network->list, &priv->ieee->network_list);
-	}
-
-	/* If we reached the end of the list, then we don't have any valid
-	 * matching APs */
-	if (!network) {
-		ipw_debug_config(priv);
-
-		queue_delayed_work(priv->workqueue, &priv->request_scan,
-				   SCAN_INTERVAL);
-
-		return;
-	}
-
-	ipw_associate_network(priv, network, rates, 0);
-}
-
-static inline void ipw_handle_data_packet(struct ipw_priv *priv,
-					      struct ipw_rx_mem_buffer *rxb,
-					      struct ieee80211_rx_stats *stats)
-{
-	struct ipw_rx_packet *pkt = (struct ipw_rx_packet *)rxb->skb->data;
-
-	/* We received data from the HW, so stop the watchdog */
-	priv->net_dev->trans_start = jiffies;
-
-	/* We only process data packets if the
-	 * interface is open */
-	if (unlikely((pkt->u.frame.length + IPW_RX_FRAME_SIZE) >
-		     skb_tailroom(rxb->skb))) {
-		priv->ieee->stats.rx_errors++;
-		priv->wstats.discard.misc++;
-		IPW_DEBUG_DROP("Corruption detected! Oh no!\n");
-		return;
-	} else if (unlikely(!netif_running(priv->net_dev))) {
-		priv->ieee->stats.rx_dropped++;
-		priv->wstats.discard.misc++;
-		IPW_DEBUG_DROP("Dropping packet while interface is not up.\n");
-		return;
-	}
-
-	/* Advance skb->data to the start of the actual payload */
-	skb_reserve(rxb->skb, offsetof(struct ipw_rx_packet, u.frame.data));
-
-	/* Set the size of the skb to the size of the frame */
-	skb_put(rxb->skb, pkt->u.frame.length);
-
-	IPW_DEBUG_RX("Rx packet of %d bytes.\n", rxb->skb->len);
-
-	if (!ieee80211_rx(priv->ieee, rxb->skb, stats))
-		priv->ieee->stats.rx_errors++;
-	else /* ieee80211_rx succeeded, so it now owns the SKB */
-		rxb->skb = NULL;
-}
-
-
-/*
- * Main entry function for recieving a packet with 80211 headers.  This
- * should be called when ever the FW has notified us that there is a new
- * skb in the recieve queue.
- */
-static void ipw_rx(struct ipw_priv *priv)
-{
-	struct ipw_rx_mem_buffer *rxb;
-	struct ipw_rx_packet *pkt;
-	struct ieee80211_hdr *header;
-	u32 r, w, i;
-	u8 network_packet;
-
-	r = ipw_read32(priv, CX2_RX_READ_INDEX);
-	w = ipw_read32(priv, CX2_RX_WRITE_INDEX);
-	i = (priv->rxq->processed + 1) % RX_QUEUE_SIZE;
-
-	while (i != r) {
-		rxb = priv->rxq->queue[i];
-#ifdef CONFIG_IPW_DEBUG
-		if (unlikely(rxb == NULL)) {
-			printk(KERN_CRIT "Queue not allocated!\n");
-			break;
-		}
-#endif
-		priv->rxq->queue[i] = NULL;
-
-		pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
-					    CX2_RX_BUF_SIZE,
-					    PCI_DMA_FROMDEVICE);
-
-		pkt = (struct ipw_rx_packet *)rxb->skb->data;
-		IPW_DEBUG_RX("Packet: type=%02X seq=%02X bits=%02X\n",
-			     pkt->header.message_type,
-			     pkt->header.rx_seq_num,
-			     pkt->header.control_bits);
-
-		switch (pkt->header.message_type) {
-		case RX_FRAME_TYPE: /* 802.11 frame */ {
-			struct ieee80211_rx_stats stats = {
-				.rssi = pkt->u.frame.rssi_dbm -
-				IPW_RSSI_TO_DBM,
-				.signal = pkt->u.frame.signal,
-				.rate = pkt->u.frame.rate,
-				.mac_time = jiffies,
-	       			.received_channel =
-				pkt->u.frame.received_channel,
-				.freq = (pkt->u.frame.control & (1<<0)) ?
-				IEEE80211_24GHZ_BAND : IEEE80211_52GHZ_BAND,
-				.len = pkt->u.frame.length,
-			};
-
-			if (stats.rssi != 0)
-				stats.mask |= IEEE80211_STATMASK_RSSI;
-			if (stats.signal != 0)
-				stats.mask |= IEEE80211_STATMASK_SIGNAL;
-			if (stats.rate != 0)
-				stats.mask |= IEEE80211_STATMASK_RATE;
-
-			priv->rx_packets++;
-
-#ifdef CONFIG_IPW_PROMISC
-			if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
-				ipw_handle_data_packet(priv, rxb, &stats);
-				break;
-			}
-#endif
-
-			header = (struct ieee80211_hdr *)(rxb->skb->data +
-							  IPW_RX_FRAME_SIZE);
-				/* TODO: Check Ad-Hoc dest/source and make sure
-				 * that we are actually parsing these packets
-				 * correctly -- we should probably use the
-				 * frame control of the packet and disregard
-				 * the current iw_mode */
-			switch (priv->ieee->iw_mode) {
-			case IW_MODE_ADHOC:
-				network_packet =
-					!memcmp(header->addr1,
-						priv->net_dev->dev_addr,
-						ETH_ALEN) ||
-					!memcmp(header->addr3,
-						priv->bssid, ETH_ALEN) ||
-					is_broadcast_ether_addr(header->addr1) ||
-					is_multicast_ether_addr(header->addr1);
-				break;
-
-			case IW_MODE_INFRA:
-			default:
-				network_packet =
-					!memcmp(header->addr3,
-						priv->bssid, ETH_ALEN) ||
-					!memcmp(header->addr1,
-						priv->net_dev->dev_addr,
-						ETH_ALEN) ||
-					is_broadcast_ether_addr(header->addr1) ||
-					is_multicast_ether_addr(header->addr1);
-				break;
-			}
-
-			if (network_packet && priv->assoc_network) {
-				priv->assoc_network->stats.rssi = stats.rssi;
-				average_add(&priv->average_rssi,
-					    stats.rssi);
-				priv->last_rx_rssi = stats.rssi;
-			}
-
-			IPW_DEBUG_RX("Frame: len=%u\n", pkt->u.frame.length);
-
-			if (pkt->u.frame.length < frame_hdr_len(header)) {
-				IPW_DEBUG_DROP("Received packet is too small. "
-					       "Dropping.\n");
-				priv->ieee->stats.rx_errors++;
-				priv->wstats.discard.misc++;
-				break;
-			}
-
-			switch (WLAN_FC_GET_TYPE(header->frame_ctl)) {
-			case IEEE80211_FTYPE_MGMT:
-				ieee80211_rx_mgt(priv->ieee, header, &stats);
-				if (priv->ieee->iw_mode == IW_MODE_ADHOC &&
-				    ((WLAN_FC_GET_STYPE(header->frame_ctl) ==
-				      IEEE80211_STYPE_PROBE_RESP) ||
-				     (WLAN_FC_GET_STYPE(header->frame_ctl) ==
-				      IEEE80211_STYPE_BEACON)) &&
-				    !memcmp(header->addr3, priv->bssid, ETH_ALEN))
-					ipw_add_station(priv, header->addr2);
-				break;
-
-			case IEEE80211_FTYPE_CTL:
-				break;
-
-			case IEEE80211_FTYPE_DATA:
-				if (network_packet)
-					ipw_handle_data_packet(priv, rxb, &stats);
-				else
-					IPW_DEBUG_DROP("Dropping: " MAC_FMT
-						       ", " MAC_FMT ", " MAC_FMT "\n",
-						       MAC_ARG(header->addr1), MAC_ARG(header->addr2),
-						       MAC_ARG(header->addr3));
-				break;
-			}
-			break;
-		}
-
-		case RX_HOST_NOTIFICATION_TYPE: {
-			IPW_DEBUG_RX("Notification: subtype=%02X flags=%02X size=%d\n",
-				     pkt->u.notification.subtype,
-				     pkt->u.notification.flags,
-				     pkt->u.notification.size);
-			ipw_rx_notification(priv, &pkt->u.notification);
-			break;
-		}
-
-		default:
-			IPW_DEBUG_RX("Bad Rx packet of type %d\n",
-				     pkt->header.message_type);
-			break;
-		}
-
-		/* For now we just don't re-use anything.  We can tweak this
-		 * later to try and re-use notification packets and SKBs that
-		 * fail to Rx correctly */
-		if (rxb->skb != NULL) {
-			dev_kfree_skb_any(rxb->skb);
-			rxb->skb = NULL;
-		}
-
-		pci_unmap_single(priv->pci_dev, rxb->dma_addr,
-				 CX2_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
-		list_add_tail(&rxb->list, &priv->rxq->rx_used);
-
-		i = (i + 1) % RX_QUEUE_SIZE;
-	}
-
-	/* Backtrack one entry */
-	priv->rxq->processed = (i ? i : RX_QUEUE_SIZE) - 1;
-
-	ipw_rx_queue_restock(priv);
-}
-
-static void ipw_abort_scan(struct ipw_priv *priv)
-{
-	int err;
-
-	if (priv->status & STATUS_SCAN_ABORTING) {
-		IPW_DEBUG_HC("Ignoring concurrent scan abort request.\n");
-		return;
-	}
-	priv->status |= STATUS_SCAN_ABORTING;
-
-	err = ipw_send_scan_abort(priv);
-	if (err)
-		IPW_DEBUG_HC("Request to abort scan failed.\n");
-}
-
-static int ipw_request_scan(struct ipw_priv *priv)
-{
-	struct ipw_scan_request_ext scan;
-	int channel_index = 0;
-	int i, err, scan_type;
-
-	if (priv->status & STATUS_EXIT_PENDING) {
-		IPW_DEBUG_SCAN("Aborting scan due to device shutdown\n");
-		priv->status |= STATUS_SCAN_PENDING;
-		return 0;
-	}
-
-	if (priv->status & STATUS_SCANNING) {
-		IPW_DEBUG_HC("Concurrent scan requested.  Aborting first.\n");
-		priv->status |= STATUS_SCAN_PENDING;
-		ipw_abort_scan(priv);
-		return 0;
-	}
-
-	if (priv->status & STATUS_SCAN_ABORTING) {
-		IPW_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
-		priv->status |= STATUS_SCAN_PENDING;
-		return 0;
-	}
-
-	if (priv->status & STATUS_RF_KILL_MASK) {
-		IPW_DEBUG_HC("Aborting scan due to RF Kill activation\n");
-		priv->status |= STATUS_SCAN_PENDING;
-		return 0;
-	}
-
-	memset(&scan, 0, sizeof(scan));
-
-	scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] = 20;
-	scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] = 20;
-	scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = 20;
-
-	scan.full_scan_index = ieee80211_get_scans(priv->ieee);
-	/* If we are roaming, then make this a directed scan for the current
-	 * network.  Otherwise, ensure that every other scan is a fast
-	 * channel hop scan */
-	if ((priv->status & STATUS_ROAMING) || (
-		    !(priv->status & STATUS_ASSOCIATED) &&
-		    (priv->config & CFG_STATIC_ESSID) &&
-		    (scan.full_scan_index % 2))) {
-		err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
-		if (err) {
-			IPW_DEBUG_HC("Attempt to send SSID command failed.\n");
-			return err;
-		}
-
-		scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
-	} else {
-		scan_type = IPW_SCAN_ACTIVE_BROADCAST_SCAN;
-	}
-
-        if (priv->ieee->freq_band & IEEE80211_52GHZ_BAND) {
-		int start = channel_index;
-		for (i = 0; i < MAX_A_CHANNELS; i++) {
-			if (band_a_active_channel[i] == 0)
-				break;
-			if ((priv->status & STATUS_ASSOCIATED) &&
-			    band_a_active_channel[i] == priv->channel)
-				continue;
-			channel_index++;
-			scan.channels_list[channel_index] =
-				band_a_active_channel[i];
-			ipw_set_scan_type(&scan, channel_index, scan_type);
-		}
-
-		if (start != channel_index) {
-			scan.channels_list[start] = (u8)(IPW_A_MODE << 6) |
-				(channel_index - start);
-			channel_index++;
-		}
-	}
-
-        if (priv->ieee->freq_band & IEEE80211_24GHZ_BAND) {
-		int start = channel_index;
-		for (i = 0; i < MAX_B_CHANNELS; i++) {
-			if (band_b_active_channel[i] == 0)
-				break;
-			if ((priv->status & STATUS_ASSOCIATED) &&
-			    band_b_active_channel[i] == priv->channel)
-				continue;
-			channel_index++;
-			scan.channels_list[channel_index] =
-				band_b_active_channel[i];
-			ipw_set_scan_type(&scan, channel_index, scan_type);
-		}
-
-		if (start != channel_index) {
-			scan.channels_list[start] = (u8)(IPW_B_MODE << 6) |
-				(channel_index - start);
-		}
-	}
-
-	err = ipw_send_scan_request_ext(priv, &scan);
-	if (err) {
-		IPW_DEBUG_HC("Sending scan command failed: %08X\n",
-			     err);
-		return -EIO;
-	}
-
-	priv->status |= STATUS_SCANNING;
-	priv->status &= ~STATUS_SCAN_PENDING;
-
-	return 0;
-}
-
-/*
- * This file defines the Wireless Extension handlers.  It does not
- * define any methods of hardware manipulation and relies on the
- * functions defined in ipw_main to provide the HW interaction.
- *
- * The exception to this is the use of the ipw_get_ordinal()
- * function used to poll the hardware vs. making unecessary calls.
- *
- */
-
-static int ipw_wx_get_name(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	if (!(priv->status & STATUS_ASSOCIATED))
-		strcpy(wrqu->name, "unassociated");
-	else
-		snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11%c",
-			 ipw_modes[priv->assoc_request.ieee_mode]);
-	IPW_DEBUG_WX("Name: %s\n", wrqu->name);
-	return 0;
-}
-
-static int ipw_set_channel(struct ipw_priv *priv, u8 channel)
-{
-	if (channel == 0) {
-		IPW_DEBUG_INFO("Setting channel to ANY (0)\n");
-		priv->config &= ~CFG_STATIC_CHANNEL;
-		if (!(priv->status & (STATUS_SCANNING | STATUS_ASSOCIATED |
-				      STATUS_ASSOCIATING))) {
-			IPW_DEBUG_ASSOC("Attempting to associate with new "
-					"parameters.\n");
-			ipw_associate(priv);
-		}
-
-		return 0;
-	}
-
-	priv->config |= CFG_STATIC_CHANNEL;
-
-	if (priv->channel == channel) {
-		IPW_DEBUG_INFO(
-			"Request to set channel to current value (%d)\n",
-			channel);
-		return 0;
-	}
-
-	IPW_DEBUG_INFO("Setting channel to %i\n", (int)channel);
-	priv->channel = channel;
-
-	/* If we are currently associated, or trying to associate
-	 * then see if this is a new channel (causing us to disassociate) */
-	if (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
-		IPW_DEBUG_ASSOC("Disassociating due to channel change.\n");
-		ipw_disassociate(priv);
-	} else {
-		ipw_associate(priv);
-	}
-
-	return 0;
-}
-
-static int ipw_wx_set_freq(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	struct iw_freq *fwrq = &wrqu->freq;
-
-	/* if setting by freq convert to channel */
-	if (fwrq->e == 1) {
-		if ((fwrq->m >= (int) 2.412e8 &&
-		     fwrq->m <= (int) 2.487e8)) {
-			int f = fwrq->m / 100000;
-			int c = 0;
-
-			while ((c < REG_MAX_CHANNEL) &&
-			       (f != ipw_frequencies[c]))
-				c++;
-
-			/* hack to fall through */
-			fwrq->e = 0;
-			fwrq->m = c + 1;
-		}
-	}
-
-	if (fwrq->e > 0 || fwrq->m > 1000)
-		return -EOPNOTSUPP;
-
-	IPW_DEBUG_WX("SET Freq/Channel -> %d \n", fwrq->m);
-	return ipw_set_channel(priv, (u8)fwrq->m);
-
-	return 0;
-}
-
-
-static int ipw_wx_get_freq(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	wrqu->freq.e = 0;
-
-	/* If we are associated, trying to associate, or have a statically
-	 * configured CHANNEL then return that; otherwise return ANY */
-	if (priv->config & CFG_STATIC_CHANNEL ||
-	    priv->status & (STATUS_ASSOCIATING | STATUS_ASSOCIATED))
-		wrqu->freq.m = priv->channel;
-	else
-		wrqu->freq.m = 0;
-
-	IPW_DEBUG_WX("GET Freq/Channel -> %d \n", priv->channel);
-	return 0;
-}
-
-static int ipw_wx_set_mode(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	int err = 0;
-
-	IPW_DEBUG_WX("Set MODE: %d\n", wrqu->mode);
-
-	if (wrqu->mode == priv->ieee->iw_mode)
-		return 0;
-
-	switch (wrqu->mode) {
-#ifdef CONFIG_IPW_PROMISC
-	case IW_MODE_MONITOR:
-#endif
-	case IW_MODE_ADHOC:
-	case IW_MODE_INFRA:
-		break;
-	case IW_MODE_AUTO:
-		wrqu->mode = IW_MODE_INFRA;
-		break;
-	default:
-		return -EINVAL;
-	}
-
-#ifdef CONFIG_IPW_PROMISC
-	if (priv->ieee->iw_mode == IW_MODE_MONITOR)
-		priv->net_dev->type = ARPHRD_ETHER;
-
-	if (wrqu->mode == IW_MODE_MONITOR)
-		priv->net_dev->type = ARPHRD_IEEE80211;
-#endif /* CONFIG_IPW_PROMISC */
-
-#ifdef CONFIG_PM
-	/* Free the existing firmware and reset the fw_loaded
-	 * flag so ipw_load() will bring in the new firmawre */
-	if (fw_loaded) {
-		fw_loaded = 0;
-	}
-
-	release_firmware(bootfw);
-	release_firmware(ucode);
-	release_firmware(firmware);
-	bootfw = ucode = firmware = NULL;
-#endif
-
-	priv->ieee->iw_mode = wrqu->mode;
-	ipw_adapter_restart(priv);
-
- 	return err;
-}
-
-static int ipw_wx_get_mode(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	wrqu->mode = priv->ieee->iw_mode;
-	IPW_DEBUG_WX("Get MODE -> %d\n", wrqu->mode);
-
-	return 0;
-}
-
-
-#define DEFAULT_RTS_THRESHOLD     2304U
-#define MIN_RTS_THRESHOLD         1U
-#define MAX_RTS_THRESHOLD         2304U
-#define DEFAULT_BEACON_INTERVAL   100U
-#define	DEFAULT_SHORT_RETRY_LIMIT 7U
-#define	DEFAULT_LONG_RETRY_LIMIT  4U
-
-/* Values are in microsecond */
-static const s32 timeout_duration[] = {
-	350000,
-	250000,
-	75000,
-	37000,
-	25000,
-};
-
-static const s32 period_duration[] = {
-	400000,
-	700000,
-	1000000,
-	1000000,
-	1000000
-};
-
-static int ipw_wx_get_range(struct net_device *dev,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	struct iw_range *range = (struct iw_range *)extra;
-	u16 val;
-	int i;
-
-	wrqu->data.length = sizeof(*range);
-	memset(range, 0, sizeof(*range));
-
-	/* 54Mbs == ~27 Mb/s real (802.11g) */
-	range->throughput = 27 * 1000 * 1000;
-
-	range->max_qual.qual = 100;
-	/* TODO: Find real max RSSI and stick here */
-	range->max_qual.level = 0;
-	range->max_qual.noise = 0;
-	range->max_qual.updated = 7; /* Updated all three */
-
-	range->avg_qual.qual = 70;
-	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
-	range->avg_qual.level = 0; /* FIXME to real average level */
-	range->avg_qual.noise = 0;
-	range->avg_qual.updated = 7; /* Updated all three */
-
-	range->num_bitrates = min(priv->rates.num_rates, (u8)IW_MAX_BITRATES);
-
-	for (i = 0; i < range->num_bitrates; i++)
-		range->bitrate[i] = (priv->rates.supported_rates[i] & 0x7F) *
-			500000;
-
-	range->max_rts = DEFAULT_RTS_THRESHOLD;
-	range->min_frag = MIN_FRAG_THRESHOLD;
-	range->max_frag = MAX_FRAG_THRESHOLD;
-
-	range->encoding_size[0] = 5;
-	range->encoding_size[1] = 13;
-	range->num_encoding_sizes = 2;
-	range->max_encoding_tokens = WEP_KEYS;
-
-	/* Set the Wireless Extension versions */
-	range->we_version_compiled = WIRELESS_EXT;
-	range->we_version_source = 16;
-
-        range->num_channels = FREQ_COUNT;
-
-	val = 0;
-	for (i = 0; i < FREQ_COUNT; i++) {
-		range->freq[val].i = i + 1;
-		range->freq[val].m = ipw_frequencies[i] * 100000;
-		range->freq[val].e = 1;
-		val++;
-
-		if (val == IW_MAX_FREQUENCIES)
-			break;
-	}
-	range->num_frequency = val;
-
-	IPW_DEBUG_WX("GET Range\n");
-	return 0;
-}
-
-static int ipw_wx_set_wap(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	static const unsigned char any[] = {
-		0xff, 0xff, 0xff, 0xff, 0xff, 0xff
-	};
-	static const unsigned char off[] = {
-		0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-	};
-
-	if (wrqu->ap_addr.sa_family != ARPHRD_ETHER)
-		return -EINVAL;
-
-	if (!memcmp(any, wrqu->ap_addr.sa_data, ETH_ALEN) ||
-	    !memcmp(off, wrqu->ap_addr.sa_data, ETH_ALEN)) {
-		/* we disable mandatory BSSID association */
-		IPW_DEBUG_WX("Setting AP BSSID to ANY\n");
-		priv->config &= ~CFG_STATIC_BSSID;
-		if (!(priv->status & (STATUS_SCANNING | STATUS_ASSOCIATED |
-				      STATUS_ASSOCIATING))) {
-			IPW_DEBUG_ASSOC("Attempting to associate with new "
-					"parameters.\n");
-			ipw_associate(priv);
-		}
-
-		return 0;
-	}
-
-	priv->config |= CFG_STATIC_BSSID;
-	if (!memcmp(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN)) {
-		IPW_DEBUG_WX("BSSID set to current BSSID.\n");
-		return 0;
-	}
-
-	IPW_DEBUG_WX("Setting mandatory BSSID to " MAC_FMT "\n",
-		     MAC_ARG(wrqu->ap_addr.sa_data));
-
-	memcpy(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN);
-
-	/* If we are currently associated, or trying to associate
-	 * then see if this is a new BSSID (causing us to disassociate) */
-	if (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
-		IPW_DEBUG_ASSOC("Disassociating due to BSSID change.\n");
-		ipw_disassociate(priv);
-	} else {
-		ipw_associate(priv);
-	}
-
-	return 0;
-}
-
-static int ipw_wx_get_wap(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	/* If we are associated, trying to associate, or have a statically
-	 * configured BSSID then return that; otherwise return ANY */
-	if (priv->config & CFG_STATIC_BSSID ||
-	    priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
-		wrqu->ap_addr.sa_family = ARPHRD_ETHER;
-		memcpy(wrqu->ap_addr.sa_data, &priv->bssid, ETH_ALEN);
-	} else
-		memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
-
-	IPW_DEBUG_WX("Getting WAP BSSID: " MAC_FMT "\n",
-		     MAC_ARG(wrqu->ap_addr.sa_data));
-	return 0;
-}
-
-static int ipw_wx_set_essid(struct net_device *dev,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	char *essid = ""; /* ANY */
-	int length = 0;
-
-	if (wrqu->essid.flags && wrqu->essid.length) {
-		length = wrqu->essid.length - 1;
-		essid = extra;
-	}
-	if (length == 0) {
-		IPW_DEBUG_WX("Setting ESSID to ANY\n");
-		priv->config &= ~CFG_STATIC_ESSID;
-		if (!(priv->status & (STATUS_SCANNING | STATUS_ASSOCIATED |
-				      STATUS_ASSOCIATING))) {
-			IPW_DEBUG_ASSOC("Attempting to associate with new "
-					"parameters.\n");
-			ipw_associate(priv);
-		}
-
-		return 0;
-	}
-
-	length = min(length, IW_ESSID_MAX_SIZE);
-
-	priv->config |= CFG_STATIC_ESSID;
-
-	if (priv->essid_len == length && !memcmp(priv->essid, extra, length)) {
-		IPW_DEBUG_WX("ESSID set to current ESSID.\n");
-		return 0;
-	}
-
-	IPW_DEBUG_WX("Setting ESSID: '%s' (%d)\n", escape_essid(essid, length),
-		     length);
-
-	priv->essid_len = length;
-	memcpy(priv->essid, essid, priv->essid_len);
-
-	/* If we are currently associated, or trying to associate
-	 * then see if this is a new ESSID (causing us to disassociate) */
-	if (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
-		IPW_DEBUG_ASSOC("Disassociating due to ESSID change.\n");
-		ipw_disassociate(priv);
-	} else {
-		ipw_associate(priv);
-	}
-
-	return 0;
-}
-
-static int ipw_wx_get_essid(struct net_device *dev,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	/* If we are associated, trying to associate, or have a statically
-	 * configured ESSID then return that; otherwise return ANY */
-	if (priv->config & CFG_STATIC_ESSID ||
-	    priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
-		IPW_DEBUG_WX("Getting essid: '%s'\n",
-			     escape_essid(priv->essid, priv->essid_len));
-		memcpy(extra, priv->essid, priv->essid_len);
-		wrqu->essid.length = priv->essid_len;
-		wrqu->essid.flags = 1; /* active */
-	} else {
-		IPW_DEBUG_WX("Getting essid: ANY\n");
-		wrqu->essid.length = 0;
-		wrqu->essid.flags = 0; /* active */
-	}
-
-	return 0;
-}
-
-static int ipw_wx_set_nick(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	IPW_DEBUG_WX("Setting nick to '%s'\n", extra);
-	if (wrqu->data.length > IW_ESSID_MAX_SIZE)
-		return -E2BIG;
-
-	wrqu->data.length = min((size_t)wrqu->data.length, sizeof(priv->nick));
-	memset(priv->nick, 0, sizeof(priv->nick));
-	memcpy(priv->nick, extra,  wrqu->data.length);
-	IPW_DEBUG_TRACE("<<\n");
-	return 0;
-
-}
-
-
-static int ipw_wx_get_nick(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	IPW_DEBUG_WX("Getting nick\n");
-	wrqu->data.length = strlen(priv->nick) + 1;
-	memcpy(extra, priv->nick, wrqu->data.length);
-	wrqu->data.flags = 1; /* active */
-	return 0;
-}
-
-
-static int ipw_wx_set_rate(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	IPW_DEBUG_WX("0x%p, 0x%p, 0x%p\n", dev, info, wrqu);
-	return -EOPNOTSUPP;
-}
-
-static int ipw_wx_get_rate(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv * priv = ieee80211_priv(dev);
-	wrqu->bitrate.value = priv->last_rate;
-
-	IPW_DEBUG_WX("GET Rate -> %d \n", wrqu->bitrate.value);
-	return 0;
-}
-
-
-static int ipw_wx_set_rts(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	if (wrqu->rts.disabled)
-		priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
-	else {
-		if (wrqu->rts.value < MIN_RTS_THRESHOLD ||
-		    wrqu->rts.value > MAX_RTS_THRESHOLD)
-			return -EINVAL;
-
-		priv->rts_threshold = wrqu->rts.value;
-	}
-
-	ipw_send_rts_threshold(priv, priv->rts_threshold);
-	IPW_DEBUG_WX("SET RTS Threshold -> %d \n", priv->rts_threshold);
-	return 0;
-}
-
-static int ipw_wx_get_rts(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	wrqu->rts.value = priv->rts_threshold;
-	wrqu->rts.fixed = 0;	/* no auto select */
-	wrqu->rts.disabled =
-		(wrqu->rts.value == DEFAULT_RTS_THRESHOLD);
-
-	IPW_DEBUG_WX("GET RTS Threshold -> %d \n", wrqu->rts.value);
-	return 0;
-}
-
-
-static int ipw_wx_set_txpow(struct net_device *dev,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	struct ipw_tx_power tx_power;
-	int i;
-
-	if (ipw_radio_kill_sw(priv, wrqu->power.disabled))
-		return -EINPROGRESS;
-
-	if (wrqu->power.flags != IW_TXPOW_DBM)
-		return -EINVAL;
-
-	if ((wrqu->power.value > 20) ||
-	    (wrqu->power.value < -12))
-		return -EINVAL;
-
-	priv->tx_power = wrqu->power.value;
-
-	memset(&tx_power, 0, sizeof(tx_power));
-
-	/* configure device for 'G' band */
-	tx_power.ieee_mode = IPW_G_MODE;
-	tx_power.num_channels = 11;
-	for (i = 0; i < 11; i++) {
-		tx_power.channels_tx_power[i].channel_number = i + 1;
-		tx_power.channels_tx_power[i].tx_power = priv->tx_power;
-	}
-	if (ipw_send_tx_power(priv, &tx_power))
-		goto error;
-
-	/* configure device to also handle 'B' band */
-	tx_power.ieee_mode = IPW_B_MODE;
-	if (ipw_send_tx_power(priv, &tx_power))
-		goto error;
-
-	return 0;
-
- error:
-	return -EIO;
-}
-
-
-static int ipw_wx_get_txpow(struct net_device *dev,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	wrqu->power.value = priv->tx_power;
-	wrqu->power.fixed = 1;
-	wrqu->power.flags = IW_TXPOW_DBM;
-	wrqu->power.disabled = (priv->status & STATUS_RF_KILL_MASK) ? 1 : 0;
-
-	IPW_DEBUG_WX("GET TX Power -> %s %d \n",
-		     wrqu->power.disabled ? "ON" : "OFF",
-		     wrqu->power.value);
-
-	return 0;
-}
-
-static int ipw_wx_set_frag(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	if (wrqu->frag.disabled)
-		priv->ieee->fts = DEFAULT_FTS;
-	else {
-		if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
-		    wrqu->frag.value > MAX_FRAG_THRESHOLD)
-			return -EINVAL;
-
-		priv->ieee->fts = wrqu->frag.value & ~0x1;
-	}
-
-	ipw_send_frag_threshold(priv, wrqu->frag.value);
-	IPW_DEBUG_WX("SET Frag Threshold -> %d \n", wrqu->frag.value);
-	return 0;
-}
-
-static int ipw_wx_get_frag(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	wrqu->frag.value = priv->ieee->fts;
-	wrqu->frag.fixed = 0;	/* no auto select */
-	wrqu->frag.disabled =
-		(wrqu->frag.value == DEFAULT_FTS);
-
-	IPW_DEBUG_WX("GET Frag Threshold -> %d \n", wrqu->frag.value);
-
-	return 0;
-}
-
-static int ipw_wx_set_retry(struct net_device *dev,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *extra)
-{
-	IPW_DEBUG_WX("0x%p, 0x%p, 0x%p\n", dev, info, wrqu);
-	return -EOPNOTSUPP;
-}
-
-
-static int ipw_wx_get_retry(struct net_device *dev,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *extra)
-{
-	IPW_DEBUG_WX("0x%p, 0x%p, 0x%p\n", dev, info, wrqu);
-	return -EOPNOTSUPP;
-}
-
-
-static int ipw_wx_set_scan(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	IPW_DEBUG_WX("Start scan\n");
-	if (ipw_request_scan(priv))
-		return -EIO;
-	return 0;
-}
-
-static int ipw_wx_get_scan(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	return ieee80211_wx_get_scan(priv->ieee, info, wrqu, extra);
-}
-
-static int ipw_wx_set_encode(struct net_device *dev,
-				 struct iw_request_info *info,
-				 union iwreq_data *wrqu, char *key)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	return ieee80211_wx_set_encode(priv->ieee, info, wrqu, key);
-}
-
-static int ipw_wx_get_encode(struct net_device *dev,
-				 struct iw_request_info *info,
-				 union iwreq_data *wrqu, char *key)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	return ieee80211_wx_get_encode(priv->ieee, info, wrqu, key);
-}
-
-static int ipw_wx_set_power(struct net_device *dev,
-			        struct iw_request_info *info,
-			        union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	int err;
-
-	if (wrqu->power.disabled) {
-		priv->power_mode = IPW_POWER_LEVEL(priv->power_mode);
-		err = ipw_send_power_mode(priv, IPW_POWER_MODE_CAM);
-		if (err) {
-			IPW_DEBUG_WX("failed setting power mode.\n");
-			return err;
-		}
-
-		IPW_DEBUG_WX("SET Power Management Mode -> off\n");
-
-		return 0;
-	}
-
-	switch (wrqu->power.flags & IW_POWER_MODE) {
-	case IW_POWER_ON:    /* If not specified */
-	case IW_POWER_MODE:  /* If set all mask */
-	case IW_POWER_ALL_R: /* If explicitely state all */
-		break;
-	default: /* Otherwise we don't support it */
-		IPW_DEBUG_WX("SET PM Mode: %X not supported.\n",
-			     wrqu->power.flags);
-		return -EOPNOTSUPP;
-	}
-
-	/* If the user hasn't specified a power management mode yet, default
-	 * to BATTERY */
-        if (IPW_POWER_LEVEL(priv->power_mode) == IPW_POWER_AC)
-		priv->power_mode = IPW_POWER_ENABLED | IPW_POWER_BATTERY;
-	else
-		priv->power_mode = IPW_POWER_ENABLED | priv->power_mode;
-	err = ipw_send_power_mode(priv, IPW_POWER_LEVEL(priv->power_mode));
-	if (err) {
-		IPW_DEBUG_WX("failed setting power mode.\n");
-		return err;
-	}
-
-	IPW_DEBUG_WX("SET Power Management Mode -> 0x%02X\n",
-		     priv->power_mode);
-
-	return 0;
-}
-
-static int ipw_wx_get_power(struct net_device *dev,
-			        struct iw_request_info *info,
-			        union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	if (!(priv->power_mode & IPW_POWER_ENABLED)) {
-		wrqu->power.disabled = 1;
-	} else {
-		wrqu->power.disabled = 0;
-	}
-
-	IPW_DEBUG_WX("GET Power Management Mode -> %02X\n", priv->power_mode);
-
-	return 0;
-}
-
-static int ipw_wx_set_powermode(struct net_device *dev,
-				    struct iw_request_info *info,
-				    union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	int mode = *(int *)extra;
-	int err;
-
-	if ((mode < 1) || (mode > IPW_POWER_LIMIT)) {
-		mode = IPW_POWER_AC;
-		priv->power_mode = mode;
-	} else {
-		priv->power_mode = IPW_POWER_ENABLED | mode;
-	}
-
-	if (priv->power_mode != mode) {
-		err = ipw_send_power_mode(priv, mode);
-
-		if (err) {
-			IPW_DEBUG_WX("failed setting power mode.\n");
-			return err;
-		}
-	}
-
-	return 0;
-}
-
-#define MAX_WX_STRING 80
-static int ipw_wx_get_powermode(struct net_device *dev,
-				    struct iw_request_info *info,
-				    union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	int level = IPW_POWER_LEVEL(priv->power_mode);
-	char *p = extra;
-
-	p += snprintf(p, MAX_WX_STRING, "Power save level: %d ", level);
-
-	switch (level) {
-	case IPW_POWER_AC:
-		p += snprintf(p, MAX_WX_STRING - (p - extra), "(AC)");
-		break;
-	case IPW_POWER_BATTERY:
-		p += snprintf(p, MAX_WX_STRING - (p - extra), "(BATTERY)");
-		break;
-	default:
-		p += snprintf(p, MAX_WX_STRING - (p - extra),
-			      "(Timeout %dms, Period %dms)",
-			      timeout_duration[level - 1] / 1000,
-			      period_duration[level - 1] / 1000);
-	}
-
-	if (!(priv->power_mode & IPW_POWER_ENABLED))
-		p += snprintf(p, MAX_WX_STRING - (p - extra)," OFF");
-
-	wrqu->data.length = p - extra + 1;
-
-	return 0;
-}
-
-static int ipw_wx_set_wireless_mode(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    union iwreq_data *wrqu, char *extra)
-{
-        struct ipw_priv *priv = ieee80211_priv(dev);
-	int mode = *(int *)extra;
-	u8 band = 0, modulation = 0;
-
-	if (mode == 0 || mode & ~IEEE_MODE_MASK) {
-		IPW_WARNING("Attempt to set invalid wireless mode: %d\n",
-			    mode);
-		return -EINVAL;
-	}
-
-	if (priv->adapter == IPW_2915ABG) {
-		priv->ieee->abg_ture = 1;
-		if (mode & IEEE_A) {
-			band |= IEEE80211_52GHZ_BAND;
-			modulation |= IEEE80211_OFDM_MODULATION;
-		} else
-			priv->ieee->abg_ture = 0;
-	} else {
-		if (mode & IEEE_A) {
-			IPW_WARNING("Attempt to set 2200BG into "
-				    "802.11a mode\n");
-			return -EINVAL;
-		}
-
-		priv->ieee->abg_ture = 0;
-	}
-
-	if (mode & IEEE_B) {
-		band |= IEEE80211_24GHZ_BAND;
-		modulation |= IEEE80211_CCK_MODULATION;
-	} else
-		priv->ieee->abg_ture = 0;
-
-	if (mode & IEEE_G) {
-		band |= IEEE80211_24GHZ_BAND;
-		modulation |= IEEE80211_OFDM_MODULATION;
-	} else
-		priv->ieee->abg_ture = 0;
-
-	priv->ieee->mode = mode;
-	priv->ieee->freq_band = band;
-	priv->ieee->modulation = modulation;
-      	init_supported_rates(priv, &priv->rates);
-
-	/* If we are currently associated, or trying to associate
-         * then see if this is a new configuration (causing us to
-	 * disassociate) */
-        if (priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) {
-		/* The resulting association will trigger
-		 * the new rates to be sent to the device */
-                IPW_DEBUG_ASSOC("Disassociating due to mode change.\n");
-                ipw_disassociate(priv);
-	} else
-		ipw_send_supported_rates(priv, &priv->rates);
-
-	IPW_DEBUG_WX("PRIV SET MODE: %c%c%c\n",
-		     mode & IEEE_A ? 'a' : '.',
-		     mode & IEEE_B ? 'b' : '.',
-		     mode & IEEE_G ? 'g' : '.');
-	return 0;
-}
-
-static int ipw_wx_get_wireless_mode(struct net_device *dev,
-                                    struct iw_request_info *info,
-                                    union iwreq_data *wrqu, char *extra)
-{
-        struct ipw_priv *priv = ieee80211_priv(dev);
-
-	switch (priv->ieee->freq_band) {
-	case IEEE80211_24GHZ_BAND:
-		switch (priv->ieee->modulation) {
-		case IEEE80211_CCK_MODULATION:
-			strncpy(extra, "802.11b (2)", MAX_WX_STRING);
-			break;
-		case IEEE80211_OFDM_MODULATION:
-			strncpy(extra, "802.11g (4)", MAX_WX_STRING);
-			break;
-		default:
-			strncpy(extra, "802.11bg (6)", MAX_WX_STRING);
-			break;
-		}
-		break;
-
-	case IEEE80211_52GHZ_BAND:
-		strncpy(extra, "802.11a (1)", MAX_WX_STRING);
-		break;
-
-	default: /* Mixed Band */
-		switch (priv->ieee->modulation) {
-		case IEEE80211_CCK_MODULATION:
-			strncpy(extra, "802.11ab (3)", MAX_WX_STRING);
-			break;
-		case IEEE80211_OFDM_MODULATION:
-			strncpy(extra, "802.11ag (5)", MAX_WX_STRING);
-			break;
-		default:
-			strncpy(extra, "802.11abg (7)", MAX_WX_STRING);
-			break;
-		}
-		break;
-	}
-
-	IPW_DEBUG_WX("PRIV GET MODE: %s\n", extra);
-
-        wrqu->data.length = strlen(extra) + 1;
-
-        return 0;
-}
-
-#ifdef CONFIG_IPW_PROMISC
-static int ipw_wx_set_promisc(struct net_device *dev,
-			      struct iw_request_info *info,
-			      union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	int *parms = (int *)extra;
-	int enable = (parms[0] > 0);
-
-	IPW_DEBUG_WX("SET PROMISC: %d %d\n", enable, parms[1]);
-	if (enable) {
-		if (priv->ieee->iw_mode != IW_MODE_MONITOR) {
-			priv->net_dev->type = ARPHRD_IEEE80211;
-			ipw_adapter_restart(priv);
-		}
-
-		ipw_set_channel(priv, parms[1]);
-	} else {
-		if (priv->ieee->iw_mode != IW_MODE_MONITOR)
-			return 0;
-		priv->net_dev->type = ARPHRD_ETHER;
-		ipw_adapter_restart(priv);
-	}
-	return 0;
-}
-
-
-static int ipw_wx_reset(struct net_device *dev,
-			struct iw_request_info *info,
-			union iwreq_data *wrqu, char *extra)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	IPW_DEBUG_WX("RESET\n");
-	ipw_adapter_restart(priv);
-	return 0;
-}
-#endif // CONFIG_IPW_PROMISC
-
-/* Rebase the WE IOCTLs to zero for the handler array */
-#define IW_IOCTL(x) [(x)-SIOCSIWCOMMIT]
-static iw_handler ipw_wx_handlers[] =
-{
-	IW_IOCTL(SIOCGIWNAME)   = ipw_wx_get_name,
-	IW_IOCTL(SIOCSIWFREQ)   = ipw_wx_set_freq,
-	IW_IOCTL(SIOCGIWFREQ)   = ipw_wx_get_freq,
-	IW_IOCTL(SIOCSIWMODE)   = ipw_wx_set_mode,
-	IW_IOCTL(SIOCGIWMODE)   = ipw_wx_get_mode,
-	IW_IOCTL(SIOCGIWRANGE)  = ipw_wx_get_range,
-	IW_IOCTL(SIOCSIWAP)     = ipw_wx_set_wap,
-	IW_IOCTL(SIOCGIWAP)     = ipw_wx_get_wap,
-	IW_IOCTL(SIOCSIWSCAN)   = ipw_wx_set_scan,
-	IW_IOCTL(SIOCGIWSCAN)   = ipw_wx_get_scan,
-	IW_IOCTL(SIOCSIWESSID)  = ipw_wx_set_essid,
-	IW_IOCTL(SIOCGIWESSID)  = ipw_wx_get_essid,
-	IW_IOCTL(SIOCSIWNICKN)  = ipw_wx_set_nick,
-	IW_IOCTL(SIOCGIWNICKN)  = ipw_wx_get_nick,
-	IW_IOCTL(SIOCSIWRATE)   = ipw_wx_set_rate,
-	IW_IOCTL(SIOCGIWRATE)   = ipw_wx_get_rate,
-	IW_IOCTL(SIOCSIWRTS)    = ipw_wx_set_rts,
-	IW_IOCTL(SIOCGIWRTS)    = ipw_wx_get_rts,
-	IW_IOCTL(SIOCSIWFRAG)   = ipw_wx_set_frag,
-	IW_IOCTL(SIOCGIWFRAG)   = ipw_wx_get_frag,
-	IW_IOCTL(SIOCSIWTXPOW)  = ipw_wx_set_txpow,
-	IW_IOCTL(SIOCGIWTXPOW)  = ipw_wx_get_txpow,
-	IW_IOCTL(SIOCSIWRETRY)  = ipw_wx_set_retry,
-	IW_IOCTL(SIOCGIWRETRY)  = ipw_wx_get_retry,
-	IW_IOCTL(SIOCSIWENCODE) = ipw_wx_set_encode,
-	IW_IOCTL(SIOCGIWENCODE) = ipw_wx_get_encode,
-	IW_IOCTL(SIOCSIWPOWER)  = ipw_wx_set_power,
-	IW_IOCTL(SIOCGIWPOWER)  = ipw_wx_get_power,
-};
-
-#define IPW_PRIV_SET_POWER	SIOCIWFIRSTPRIV
-#define IPW_PRIV_GET_POWER	SIOCIWFIRSTPRIV+1
-#define IPW_PRIV_SET_MODE	SIOCIWFIRSTPRIV+2
-#define IPW_PRIV_GET_MODE	SIOCIWFIRSTPRIV+3
-#define IPW_PRIV_SET_PROMISC	SIOCIWFIRSTPRIV+4
-#define IPW_PRIV_RESET		SIOCIWFIRSTPRIV+5
-
-
-static struct iw_priv_args ipw_priv_args[] = {
-	{
-		.cmd = IPW_PRIV_SET_POWER,
-		.set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-		.name = "set_power"
-	},
-	{
-		.cmd = IPW_PRIV_GET_POWER,
-		.get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-		.name = "get_power"
-	},
-	{
-		.cmd = IPW_PRIV_SET_MODE,
-		.set_args = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-		.name = "set_mode"
-	},
-	{
-		.cmd = IPW_PRIV_GET_MODE,
-		.get_args = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-		.name = "get_mode"
-	},
-#ifdef CONFIG_IPW_PROMISC
-	{
-		IPW_PRIV_SET_PROMISC,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "monitor"
-	},
-	{
-		IPW_PRIV_RESET,
-		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 0, 0, "reset"
-	},
-#endif /* CONFIG_IPW_PROMISC */
-};
-
-static iw_handler ipw_priv_handler[] = {
-	ipw_wx_set_powermode,
-	ipw_wx_get_powermode,
-	ipw_wx_set_wireless_mode,
-	ipw_wx_get_wireless_mode,
-#ifdef CONFIG_IPW_PROMISC
-	ipw_wx_set_promisc,
-	ipw_wx_reset,
-#endif
-};
-
-static struct iw_handler_def ipw_wx_handler_def =
-{
-	.standard 	= ipw_wx_handlers,
-	.num_standard	= ARRAY_SIZE(ipw_wx_handlers),
-	.num_private	= ARRAY_SIZE(ipw_priv_handler),
- 	.num_private_args = ARRAY_SIZE(ipw_priv_args),
-	.private	= ipw_priv_handler,
-	.private_args	= ipw_priv_args,
-};
-
-
-
-
-/*
- * Get wireless statistics.
- * Called by /proc/net/wireless
- * Also called by SIOCGIWSTATS
- */
-static struct iw_statistics *ipw_get_wireless_stats(struct net_device * dev)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	struct iw_statistics *wstats;
-
-	wstats = &priv->wstats;
-
-	/* if hw is disabled, then ipw2100_get_ordinal() can't be called.
-	 * ipw2100_wx_wireless_stats seems to be called before fw is
-	 * initialized.  STATUS_ASSOCIATED will only be set if the hw is up
-	 * and associated; if not associcated, the values are all meaningless
-	 * anyway, so set them all to NULL and INVALID */
-	if (!(priv->status & STATUS_ASSOCIATED)) {
-		wstats->miss.beacon = 0;
-		wstats->discard.retries = 0;
-		wstats->qual.qual = 0;
-		wstats->qual.level = 0;
-		wstats->qual.noise = 0;
-		wstats->qual.updated = 7;
-		wstats->qual.updated |= IW_QUAL_NOISE_INVALID |
-			IW_QUAL_QUAL_INVALID | IW_QUAL_LEVEL_INVALID;
-		return wstats;
-	}
-
-	wstats->qual.qual = priv->quality;
-	wstats->qual.level = average_value(&priv->average_rssi);
-	wstats->qual.noise = average_value(&priv->average_noise);
-	wstats->qual.updated = IW_QUAL_QUAL_UPDATED | IW_QUAL_LEVEL_UPDATED |
-		IW_QUAL_NOISE_UPDATED;
-
-	wstats->miss.beacon = average_value(&priv->average_missed_beacons);
-	wstats->discard.retries = priv->last_tx_failures;
-	wstats->discard.code = priv->ieee->ieee_stats.rx_discards_undecryptable;
-
-/*	if (ipw_get_ordinal(priv, IPW_ORD_STAT_TX_RETRY, &tx_retry, &len))
-	goto fail_get_ordinal;
-	wstats->discard.retries += tx_retry; */
-
-	return wstats;
-}
-
-
-/* net device stuff */
-
-static inline void init_sys_config(struct ipw_sys_config *sys_config)
-{
-        memset(sys_config, 0, sizeof(struct ipw_sys_config));
-	sys_config->bt_coexistence = 1; /* We may need to look into prvStaBtConfig */
-	sys_config->answer_broadcast_ssid_probe = 0;
-	sys_config->accept_all_data_frames = 0;
-	sys_config->accept_non_directed_frames = 1;
-	sys_config->exclude_unicast_unencrypted = 0;
-	sys_config->disable_unicast_decryption = 1;
-	sys_config->exclude_multicast_unencrypted = 0;
-	sys_config->disable_multicast_decryption = 1;
-	sys_config->antenna_diversity = CFG_SYS_ANTENNA_BOTH;
-	sys_config->pass_crc_to_host = 0; /* TODO: See if 1 gives us FCS */
-	sys_config->dot11g_auto_detection = 0;
-	sys_config->enable_cts_to_self = 0;
-	sys_config->bt_coexist_collision_thr = 0;
-	sys_config->pass_noise_stats_to_host = 1;
-}
-
-static int ipw_net_open(struct net_device *dev)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	IPW_DEBUG_INFO("dev->open\n");
-	/* we should be verifying the device is ready to be opened */
-	if (!(priv->status & STATUS_RF_KILL_MASK) &&
-	    (priv->status & STATUS_ASSOCIATED))
-		netif_start_queue(dev);
-	return 0;
-}
-
-static int ipw_net_stop(struct net_device *dev)
-{
-	IPW_DEBUG_INFO("dev->close\n");
-	netif_stop_queue(dev);
-	return 0;
-}
-
-/*
-todo:
-
-modify to send one tfd per fragment instead of using chunking.  otherwise
-we need to heavily modify the ieee80211_skb_to_txb.
-*/
-
-static inline void ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb)
-{
-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)
-		txb->fragments[0]->data;
-	int i = 0;
-	struct tfd_frame *tfd;
-	struct clx2_tx_queue *txq = &priv->txq[0];
-	struct clx2_queue *q = &txq->q;
-	u8 id, hdr_len, unicast;
-	u16 remaining_bytes;
-
-	switch (priv->ieee->iw_mode) {
-	case IW_MODE_ADHOC:
-		hdr_len = IEEE80211_3ADDR_LEN;
-		unicast = !is_broadcast_ether_addr(hdr->addr1) &&
-			!is_multicast_ether_addr(hdr->addr1);
-		id = ipw_find_station(priv, hdr->addr1);
-		if (id == IPW_INVALID_STATION) {
-			id = ipw_add_station(priv, hdr->addr1);
-			if (id == IPW_INVALID_STATION) {
-				IPW_WARNING("Attempt to send data to "
-					    "invalid cell: " MAC_FMT "\n",
-					    MAC_ARG(hdr->addr1));
-				goto drop;
-			}
-		}
-		break;
-
-	case IW_MODE_INFRA:
-	default:
-		unicast = !is_broadcast_ether_addr(hdr->addr3) &&
-			!is_multicast_ether_addr(hdr->addr3);
-		hdr_len = IEEE80211_3ADDR_LEN;
-		id = 0;
-		break;
-	}
-
-	tfd = &txq->bd[q->first_empty];
-	txq->txb[q->first_empty] = txb;
-	memset(tfd, 0, sizeof(*tfd));
-	tfd->u.data.station_number = id;
-
-	tfd->control_flags.message_type = TX_FRAME_TYPE;
-	tfd->control_flags.control_bits = TFD_NEED_IRQ_MASK;
-
-	tfd->u.data.cmd_id = DINO_CMD_TX;
-	tfd->u.data.len = txb->payload_size;
-	remaining_bytes = txb->payload_size;
-	if (unlikely(!unicast))
-		tfd->u.data.tx_flags = DCT_FLAG_NO_WEP;
-	else
-		tfd->u.data.tx_flags = DCT_FLAG_NO_WEP | DCT_FLAG_ACK_REQD;
-
-	if (priv->assoc_request.ieee_mode == IPW_B_MODE)
-		tfd->u.data.tx_flags_ext = DCT_FLAG_EXT_MODE_CCK;
-	else
-		tfd->u.data.tx_flags_ext = DCT_FLAG_EXT_MODE_OFDM;
-
-	if (priv->config & CFG_PREAMBLE)
-		tfd->u.data.tx_flags |= DCT_FLAG_SHORT_PREMBL;
-
-	memcpy(&tfd->u.data.tfd.tfd_24.mchdr, hdr, hdr_len);
-
-	/* payload */
-	tfd->u.data.num_chunks = min((u8)(NUM_TFD_CHUNKS - 2), txb->nr_frags);
-	for (i = 0; i < tfd->u.data.num_chunks; i++) {
-		IPW_DEBUG_TX("Dumping TX packet frag %i of %i (%d bytes):\n",
-			     i, tfd->u.data.num_chunks,
-			     txb->fragments[i]->len - hdr_len);
-		printk_buf(IPW_DL_TX, txb->fragments[i]->data + hdr_len,
-			   txb->fragments[i]->len - hdr_len);
-
-		tfd->u.data.chunk_ptr[i] = pci_map_single(
-			priv->pci_dev, txb->fragments[i]->data + hdr_len,
-			txb->fragments[i]->len - hdr_len, PCI_DMA_TODEVICE);
-		tfd->u.data.chunk_len[i] = txb->fragments[i]->len - hdr_len;
-	}
-
-	if (i != txb->nr_frags) {
-		struct sk_buff *skb;
-		u16 remaining_bytes = 0;
-		int j;
-
-		for (j = i; j < txb->nr_frags; j++)
-			remaining_bytes += txb->fragments[j]->len - hdr_len;
-
-		printk(KERN_INFO "Trying to reallocate for %d bytes\n",
-		       remaining_bytes);
-		skb = alloc_skb(remaining_bytes, GFP_ATOMIC);
-		if (skb != NULL) {
-			tfd->u.data.chunk_len[i] = remaining_bytes;
-			for (j = i; j < txb->nr_frags; j++) {
-				int size = txb->fragments[j]->len - hdr_len;
-				printk(KERN_INFO "Adding frag %d %d...\n",
-					j, size);
-				memcpy(skb_put(skb, size),
-					txb->fragments[j]->data + hdr_len,
-					size);
-			}
-			dev_kfree_skb_any(txb->fragments[i]);
-			txb->fragments[i] = skb;
-			tfd->u.data.chunk_ptr[i] = pci_map_single(
-				priv->pci_dev, skb->data,
-				tfd->u.data.chunk_len[i], PCI_DMA_TODEVICE);
-			tfd->u.data.num_chunks++;
-		}
-	}
-
-	/* kick DMA */
-	q->first_empty = ipw_queue_inc_wrap(q->first_empty, q->n_bd);
-	ipw_write32(priv, q->reg_w, q->first_empty);
-
-	if (ipw_queue_space(q) < q->high_mark)
-		netif_stop_queue(priv->net_dev);
-
-	return;
-
- drop:
-	IPW_DEBUG_DROP("Silently dropping Tx packet.\n");
-	ieee80211_txb_free(txb);
-}
-
-static int ipw_net_hard_start_xmit(struct ieee80211_txb *txb,
-				   struct net_device *dev)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	unsigned long flags;
-
-	IPW_DEBUG_TX("dev->xmit(%d bytes)\n", txb->payload_size);
-
-	spin_lock_irqsave(&priv->lock, flags);
-
-	if (!(priv->status & STATUS_ASSOCIATED)) {
-		IPW_DEBUG_INFO("Tx attempt while not associated.\n");
-		priv->ieee->stats.tx_carrier_errors++;
-		netif_stop_queue(dev);
-		goto fail_unlock;
-	}
-
-	ipw_tx_skb(priv, txb);
-
-	spin_unlock_irqrestore(&priv->lock, flags);
-	return 0;
-
- fail_unlock:
-	spin_unlock_irqrestore(&priv->lock, flags);
-	return 1;
-}
-
-static struct net_device_stats *ipw_net_get_stats(struct net_device *dev)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	priv->ieee->stats.tx_packets = priv->tx_packets;
-	priv->ieee->stats.rx_packets = priv->rx_packets;
-	return &priv->ieee->stats;
-}
-
-static void ipw_net_set_multicast_list(struct net_device *dev)
-{
-
-}
-
-static int ipw_net_set_mac_address(struct net_device *dev, void *p)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	struct sockaddr *addr = p;
-	if (!is_valid_ether_addr(addr->sa_data))
-		return -EADDRNOTAVAIL;
-	priv->config |= CFG_CUSTOM_MAC;
-	memcpy(priv->mac_addr, addr->sa_data, ETH_ALEN);
-	printk(KERN_INFO "%s: Setting MAC to " MAC_FMT "\n",
-	       priv->net_dev->name, MAC_ARG(priv->mac_addr));
-	ipw_adapter_restart(priv);
-	return 0;
-}
-
-static void ipw_ethtool_get_drvinfo(struct net_device *dev,
-				    struct ethtool_drvinfo *info)
-{
-	struct ipw_priv *p = ieee80211_priv(dev);
-	char vers[64];
-	char date[32];
-	u32 len;
-
-	strcpy(info->driver, DRV_NAME);
-	strcpy(info->version, DRV_VERSION);
-
-	len = sizeof(vers);
-	ipw_get_ordinal(p, IPW_ORD_STAT_FW_VERSION, vers, &len);
-	len = sizeof(date);
-	ipw_get_ordinal(p, IPW_ORD_STAT_FW_DATE, date, &len);
-
-	snprintf(info->fw_version, sizeof(info->fw_version),"%s (%s)",
-		 vers, date);
-	strcpy(info->bus_info, pci_name(p->pci_dev));
-	info->eedump_len = CX2_EEPROM_IMAGE_SIZE;
-}
-
-static u32 ipw_ethtool_get_link(struct net_device *dev)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	return (priv->status & STATUS_ASSOCIATED) != 0;
-}
-
-static int ipw_ethtool_get_eeprom_len(struct net_device *dev)
-{
-	return CX2_EEPROM_IMAGE_SIZE;
-}
-
-static int ipw_ethtool_get_eeprom(struct net_device *dev,
-				  struct ethtool_eeprom *eeprom, u8 *bytes)
-{
-	struct ipw_priv *p = ieee80211_priv(dev);
-
-	if (eeprom->offset + eeprom->len > CX2_EEPROM_IMAGE_SIZE)
-		return -EINVAL;
-
-	memcpy(bytes, &((u8 *)p->eeprom)[eeprom->offset], eeprom->len);
-	return 0;
-}
-
-static int ipw_ethtool_set_eeprom(struct net_device *dev,
-				  struct ethtool_eeprom *eeprom, u8 *bytes)
-{
-	struct ipw_priv *p = ieee80211_priv(dev);
-	int i;
-
-	if (eeprom->offset + eeprom->len > CX2_EEPROM_IMAGE_SIZE)
-		return -EINVAL;
-
-	memcpy(&((u8 *)p->eeprom)[eeprom->offset], bytes, eeprom->len);
-	for (i = IPW_EEPROM_DATA;
-	     i < IPW_EEPROM_DATA + CX2_EEPROM_IMAGE_SIZE;
-	     i++)
-		ipw_write8(p, i, p->eeprom[i]);
-
-	return 0;
-}
-
-static struct ethtool_ops ipw_ethtool_ops = {
-	 .get_link       = ipw_ethtool_get_link,
-	 .get_drvinfo	 = ipw_ethtool_get_drvinfo,
-	 .get_eeprom_len = ipw_ethtool_get_eeprom_len,
-	 .get_eeprom	 = ipw_ethtool_get_eeprom,
-	 .set_eeprom	 = ipw_ethtool_set_eeprom,
-};
-
-static irqreturn_t ipw_isr(int irq, void *data, struct pt_regs *regs)
-{
-	struct ipw_priv *priv = data;
-	u32 inta, inta_mask;
-
-	if (!priv)
-		return IRQ_NONE;
-
-	spin_lock(&priv->lock);
-
-	if (!(priv->status & STATUS_INT_ENABLED)) {
-		/* Shared IRQ */
-		goto none;
-	}
-
-	inta = ipw_read32(priv, CX2_INTA_RW);
-	inta_mask = ipw_read32(priv, CX2_INTA_MASK_R);
-
-	if (inta == 0xFFFFFFFF) {
-		/* Hardware disappeared */
-		IPW_WARNING("IRQ INTA == 0xFFFFFFFF\n");
-		goto none;
-	}
-
-	if (!(inta & (CX2_INTA_MASK_ALL & inta_mask))) {
-		/* Shared interrupt */
-		goto none;
-	}
-
-	/* tell the device to stop sending interrupts */
-	ipw_disable_interrupts(priv);
-
-	/* ack current interrupts */
-	inta &= (CX2_INTA_MASK_ALL & inta_mask);
-	ipw_write32(priv, CX2_INTA_RW, inta);
-
-	/* Cache INTA value for our tasklet */
-	priv->isr_inta = inta;
-
-	tasklet_schedule(&priv->irq_tasklet);
-
- 	spin_unlock(&priv->lock);
-
-	return IRQ_HANDLED;
- none:
-	spin_unlock(&priv->lock);
-	return IRQ_NONE;
-}
-
-static void ipw_rf_kill(void *adapter)
-{
-	struct ipw_priv *priv = adapter;
-	unsigned long flags;
-
-	spin_lock_irqsave(&priv->lock, flags);
-
-	if (rf_kill_active(priv)) {
-		IPW_DEBUG_RF_KILL("RF Kill active, rescheduling GPIO check\n");
-		if (priv->workqueue)
-			queue_delayed_work(priv->workqueue,
-					   &priv->rf_kill, 2 * HZ);
-		goto exit_unlock;
-	}
-
-	/* RF Kill is now disabled, so bring the device back up */
-
-	if (!(priv->status & STATUS_RF_KILL_MASK)) {
-		IPW_DEBUG_RF_KILL("HW RF Kill no longer active, restarting "
-				  "device\n");
-
-		/* we can not do an adapter restart while inside an irq lock */
-		queue_work(priv->workqueue, &priv->adapter_restart);
-	} else
-		IPW_DEBUG_RF_KILL("HW RF Kill deactivated.  SW RF Kill still "
-				  "enabled\n");
-
- exit_unlock:
-	spin_unlock_irqrestore(&priv->lock, flags);
-}
-
-static int ipw_setup_deferred_work(struct ipw_priv *priv)
-{
-	int ret = 0;
-
-	priv->workqueue = create_workqueue(DRV_NAME);
-	init_waitqueue_head(&priv->wait_command_queue);
-
-	INIT_WORK(&priv->adhoc_check, ipw_adhoc_check, priv);
-	INIT_WORK(&priv->associate, ipw_associate, priv);
-	INIT_WORK(&priv->disassociate, ipw_disassociate, priv);
-	INIT_WORK(&priv->rx_replenish, ipw_rx_queue_replenish, priv);
-	INIT_WORK(&priv->adapter_restart, ipw_adapter_restart, priv);
-	INIT_WORK(&priv->rf_kill, ipw_rf_kill, priv);
-	INIT_WORK(&priv->up, (void (*)(void *))ipw_up, priv);
-	INIT_WORK(&priv->down, (void (*)(void *))ipw_down, priv);
-	INIT_WORK(&priv->request_scan,
-		  (void (*)(void *))ipw_request_scan, priv);
-	INIT_WORK(&priv->gather_stats,
-		  (void (*)(void *))ipw_gather_stats, priv);
-	INIT_WORK(&priv->abort_scan, (void (*)(void *))ipw_abort_scan, priv);
-	INIT_WORK(&priv->roam, ipw_roam, priv);
-	INIT_WORK(&priv->scan_check, ipw_scan_check, priv);
-
-	tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
-		     ipw_irq_tasklet, (unsigned long)priv);
-
-	return ret;
-}
-
-
-static void shim__set_security(struct net_device *dev,
-			       struct ieee80211_security *sec)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-	int i;
-
-	for (i = 0; i < 4; i++) {
-		if (sec->flags & (1 << i)) {
-			priv->sec.key_sizes[i] = sec->key_sizes[i];
-			if (sec->key_sizes[i] == 0)
-				priv->sec.flags &= ~(1 << i);
-			else
-				memcpy(priv->sec.keys[i], sec->keys[i],
-				       sec->key_sizes[i]);
-			priv->sec.flags |= (1 << i);
-			priv->status |= STATUS_SECURITY_UPDATED;
-		}
-	}
-
-	if ((sec->flags & SEC_ACTIVE_KEY) &&
-	    priv->sec.active_key != sec->active_key) {
-		if (sec->active_key <= 3) {
-			priv->sec.active_key = sec->active_key;
-			priv->sec.flags |= SEC_ACTIVE_KEY;
-		} else
-			priv->sec.flags &= ~SEC_ACTIVE_KEY;
-		priv->status |= STATUS_SECURITY_UPDATED;
-	}
-
-	if ((sec->flags & SEC_AUTH_MODE) &&
-	    (priv->sec.auth_mode != sec->auth_mode)) {
-		priv->sec.auth_mode = sec->auth_mode;
-		priv->sec.flags |= SEC_AUTH_MODE;
-		if (sec->auth_mode == WLAN_AUTH_SHARED_KEY)
-			priv->capability |= CAP_SHARED_KEY;
-		else
-			priv->capability &= ~CAP_SHARED_KEY;
-		priv->status |= STATUS_SECURITY_UPDATED;
-	}
-
-	if (sec->flags & SEC_ENABLED &&
-	    priv->sec.enabled != sec->enabled) {
-		priv->sec.flags |= SEC_ENABLED;
-		priv->sec.enabled = sec->enabled;
-		priv->status |= STATUS_SECURITY_UPDATED;
-		if (sec->enabled)
-			priv->capability |= CAP_PRIVACY_ON;
-		else
-			priv->capability &= ~CAP_PRIVACY_ON;
-	}
-
-	if (sec->flags & SEC_LEVEL &&
-	    priv->sec.level != sec->level) {
-		priv->sec.level = sec->level;
-		priv->sec.flags |= SEC_LEVEL;
-		priv->status |= STATUS_SECURITY_UPDATED;
-	}
-
-	/* To match current functionality of ipw2100 (which works well w/
-	 * various supplicants, we don't force a disassociate if the
-	 * privacy capability changes ... */
-#if 0
-	if ((priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)) &&
-	    (((priv->assoc_request.capability &
-	       WLAN_CAPABILITY_PRIVACY) && !sec->enabled) ||
-	     (!(priv->assoc_request.capability &
-		 WLAN_CAPABILITY_PRIVACY) && sec->enabled))) {
-		IPW_DEBUG_ASSOC("Disassociating due to capability "
-				"change.\n");
-		ipw_disassociate(priv);
-	}
-#endif
-}
-
-static int init_supported_rates(struct ipw_priv *priv,
-				struct ipw_supported_rates *rates)
-{
-	/* TODO: Mask out rates based on priv->rates_mask */
-
-	memset(rates, 0, sizeof(*rates));
-        /* configure supported rates */
-	switch (priv->ieee->freq_band) {
-	case IEEE80211_52GHZ_BAND:
-		rates->ieee_mode = IPW_A_MODE;
-		rates->purpose = IPW_RATE_CAPABILITIES;
-		ipw_add_ofdm_scan_rates(rates, IEEE80211_CCK_MODULATION,
-					IEEE80211_OFDM_DEFAULT_RATES_MASK);
-		break;
-
-	default: /* Mixed or 2.4Ghz */
-		rates->ieee_mode = IPW_G_MODE;
-		rates->purpose = IPW_RATE_CAPABILITIES;
-		ipw_add_cck_scan_rates(rates, IEEE80211_CCK_MODULATION,
-				       IEEE80211_CCK_DEFAULT_RATES_MASK);
-		if (priv->ieee->modulation & IEEE80211_OFDM_MODULATION) {
-			ipw_add_ofdm_scan_rates(rates, IEEE80211_CCK_MODULATION,
-						IEEE80211_OFDM_DEFAULT_RATES_MASK);
-		}
-		break;
-	}
-
-	return 0;
-}
-
-static int ipw_config(struct ipw_priv *priv)
-{
-	int i;
-	struct ipw_tx_power tx_power;
-
-	memset(&priv->sys_config, 0, sizeof(priv->sys_config));
-	memset(&tx_power, 0, sizeof(tx_power));
-
-	/* This is only called from ipw_up, which resets/reloads the firmware
-	   so, we don't need to first disable the card before we configure
-	   it */
-
-	/* configure device for 'G' band */
-	tx_power.ieee_mode = IPW_G_MODE;
-	tx_power.num_channels = 11;
-	for (i = 0; i < 11; i++) {
-		tx_power.channels_tx_power[i].channel_number = i + 1;
-		tx_power.channels_tx_power[i].tx_power = priv->tx_power;
-	}
-	if (ipw_send_tx_power(priv, &tx_power))
-		goto error;
-
-	/* configure device to also handle 'B' band */
-	tx_power.ieee_mode = IPW_B_MODE;
-	if (ipw_send_tx_power(priv, &tx_power))
-		goto error;
-
-	/* initialize adapter address */
-	if (ipw_send_adapter_address(priv, priv->net_dev->dev_addr))
-		goto error;
-
-	/* set basic system config settings */
-	init_sys_config(&priv->sys_config);
-	if (ipw_send_system_config(priv, &priv->sys_config))
-		goto error;
-
-        init_supported_rates(priv, &priv->rates);
-        if (ipw_send_supported_rates(priv, &priv->rates))
-		goto error;
-
-	/* Set request-to-send threshold */
-	if (priv->rts_threshold) {
-		if (ipw_send_rts_threshold(priv, priv->rts_threshold))
-			goto error;
-	}
-
-	if (ipw_set_random_seed(priv))
-		goto error;
-
-	/* final state transition to the RUN state */
-	if (ipw_send_host_complete(priv))
-		goto error;
-
-	/* If configured to try and auto-associate, kick off a scan */
-	if ((priv->config & CFG_ASSOCIATE) && ipw_request_scan(priv))
-		goto error;
-
-	return 0;
-
- error:
-	return -EIO;
-}
-
-#define MAX_HW_RESTARTS 5
-static int ipw_up(struct ipw_priv *priv)
-{
-	int rc, i;
-
-	if (priv->status & STATUS_EXIT_PENDING)
-		return -EIO;
-
-	for (i = 0; i < MAX_HW_RESTARTS; i++ ) {
-		/* Load the microcode, firmware, and eeprom.
-		 * Also start the clocks. */
-		rc = ipw_load(priv);
-		if (rc) {
-			IPW_ERROR("Unable to load firmware: 0x%08X\n",
-					rc);
-			return rc;
-		}
-
-		ipw_init_ordinals(priv);
-		if (!(priv->config & CFG_CUSTOM_MAC))
-			eeprom_parse_mac(priv, priv->mac_addr);
-		memcpy(priv->net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
-
-		if (priv->status & STATUS_RF_KILL_MASK)
-			return 0;
-
-		rc = ipw_config(priv);
-		if (!rc) {
-			IPW_DEBUG_INFO("Configured device on count %i\n", i);
-			priv->notif_missed_beacons = 0;
-			netif_start_queue(priv->net_dev);
-			return 0;
-		} else {
-			IPW_DEBUG_INFO("Device configuration failed: 0x%08X\n",
-				       rc);
-		}
-
-		IPW_DEBUG_INFO("Failed to config device on retry %d of %d\n",
-			       i, MAX_HW_RESTARTS);
-
-		/* We had an error bringing up the hardware, so take it
-		 * all the way back down so we can try again */
-		ipw_down(priv);
-	}
-
-	/* tried to restart and config the device for as long as our
-	 * patience could withstand */
-	IPW_ERROR("Unable to initialize device after %d attempts.\n",
-		  i);
-	return -EIO;
-}
-
-static void ipw_down(struct ipw_priv *priv)
-{
-	/* Attempt to disable the card */
-#if 0
-	ipw_send_card_disable(priv, 0);
-#endif
-
-	/* tell the device to stop sending interrupts */
-	ipw_disable_interrupts(priv);
-
-	/* Clear all bits but the RF Kill */
-	priv->status &= STATUS_RF_KILL_MASK;
-
-	netif_carrier_off(priv->net_dev);
-	netif_stop_queue(priv->net_dev);
-
-	ipw_stop_nic(priv);
-}
-
-/* Called by register_netdev() */
-static int ipw_net_init(struct net_device *dev)
-{
-	struct ipw_priv *priv = ieee80211_priv(dev);
-
-	if (priv->status & STATUS_RF_KILL_SW) {
-		IPW_WARNING("Radio disabled by module parameter.\n");
-		return 0;
-	} else if (rf_kill_active(priv)) {
-		IPW_WARNING("Radio Frequency Kill Switch is On:\n"
-			    "Kill switch must be turned off for "
-			    "wireless networking to work.\n");
-		queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
-		return 0;
-	}
-
-	if (ipw_up(priv))
-		return -EIO;
-
-	return 0;
-}
-
-/* PCI driver stuff */
-static struct pci_device_id card_ids[] = {
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2701, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2702, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2711, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2712, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2721, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2722, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2731, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2732, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2741, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x103c, 0x2741, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2742, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2751, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2752, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2753, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2754, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2761, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2762, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x104f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
-	{PCI_VENDOR_ID_INTEL, 0x4220, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* BG */
-	{PCI_VENDOR_ID_INTEL, 0x4221, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* 2225BG */
-	{PCI_VENDOR_ID_INTEL, 0x4223, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* ABG */
-	{PCI_VENDOR_ID_INTEL, 0x4224, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, /* ABG */
-
-	/* required last entry */
-	{0,}
-};
-
-MODULE_DEVICE_TABLE(pci, card_ids);
-
-static struct attribute *ipw_sysfs_entries[] = {
-	&dev_attr_rf_kill.attr,
-	&dev_attr_direct_dword.attr,
-	&dev_attr_indirect_byte.attr,
-	&dev_attr_indirect_dword.attr,
-	&dev_attr_mem_gpio_reg.attr,
-	&dev_attr_command_event_reg.attr,
-	&dev_attr_nic_type.attr,
-	&dev_attr_status.attr,
-	&dev_attr_cfg.attr,
-	&dev_attr_dump_errors.attr,
-	&dev_attr_dump_events.attr,
-	&dev_attr_eeprom_delay.attr,
-	&dev_attr_ucode_version.attr,
-	&dev_attr_rtc.attr,
-	NULL
-};
-
-static struct attribute_group ipw_attribute_group = {
-	.name = NULL,		/* put in device directory */
-	.attrs	= ipw_sysfs_entries,
-};
-
-static int ipw_pci_probe(struct pci_dev *pdev,
-			 const struct pci_device_id *ent)
-{
-	int err = 0;
-	struct net_device *net_dev;
-	void __iomem *base;
-	u32 length, val;
-	struct ipw_priv *priv;
-	int band, modulation;
-
-	net_dev = alloc_ieee80211(sizeof(struct ipw_priv));
-	if (net_dev == NULL) {
-		err = -ENOMEM;
-		goto out;
-	}
-
-	priv = ieee80211_priv(net_dev);
-	priv->ieee = netdev_priv(net_dev);
-	priv->net_dev = net_dev;
-	priv->pci_dev = pdev;
-#ifdef CONFIG_IPW_DEBUG
-	ipw_debug_level = debug;
-#endif
-	spin_lock_init(&priv->lock);
-
-	if (pci_enable_device(pdev)) {
-		err = -ENODEV;
-		goto out_free_ieee80211;
-	}
-
-	pci_set_master(pdev);
-
-	err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
-	if (!err)
-		err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
-	if (err) {
-		printk(KERN_WARNING DRV_NAME ": No suitable DMA available.\n");
-		goto out_pci_disable_device;
-	}
-
-	pci_set_drvdata(pdev, priv);
-
-	err = pci_request_regions(pdev, DRV_NAME);
-	if (err)
-		goto out_pci_disable_device;
-
-	/* We disable the RETRY_TIMEOUT register (0x41) to keep
-	 * PCI Tx retries from interfering with C3 CPU state */
-	pci_read_config_dword(pdev, 0x40, &val);
-	if ((val & 0x0000ff00) != 0)
-		pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
-
-	length = pci_resource_len(pdev, 0);
-	priv->hw_len = length;
-
-	base = ioremap_nocache(pci_resource_start(pdev, 0), length);
-	if (!base) {
-		err = -ENODEV;
-		goto out_pci_release_regions;
-	}
-
-	priv->hw_base = base;
-	IPW_DEBUG_INFO("pci_resource_len = 0x%08x\n", length);
-	IPW_DEBUG_INFO("pci_resource_base = %p\n", base);
-
-	err = ipw_setup_deferred_work(priv);
-	if (err) {
-		IPW_ERROR("Unable to setup deferred work\n");
-		goto out_iounmap;
-	}
-
-	/* Initialize module parameter values here */
-	if (ifname)
-		strncpy(net_dev->name, ifname, IFNAMSIZ);
-
-	if (associate)
-		priv->config |= CFG_ASSOCIATE;
-	else
-		IPW_DEBUG_INFO("Auto associate disabled.\n");
-
-	if (auto_create)
-		priv->config |= CFG_ADHOC_CREATE;
-	else
-		IPW_DEBUG_INFO("Auto adhoc creation disabled.\n");
-
-	if (disable) {
-		priv->status |= STATUS_RF_KILL_SW;
-		IPW_DEBUG_INFO("Radio disabled.\n");
-	}
-
-	if (channel != 0) {
-		priv->config |= CFG_STATIC_CHANNEL;
-		priv->channel = channel;
-		IPW_DEBUG_INFO("Bind to static channel %d\n", channel);
- 		IPW_DEBUG_INFO("Bind to static channel %d\n", channel);
-		/* TODO: Validate that provided channel is in range */
-	}
-
-	switch (mode) {
-	case 1:
-		priv->ieee->iw_mode = IW_MODE_ADHOC;
-		break;
-#ifdef CONFIG_IPW_PROMISC
-	case 2:
-		priv->ieee->iw_mode = IW_MODE_MONITOR;
-		break;
-#endif
-	default:
-	case 0:
-		priv->ieee->iw_mode = IW_MODE_INFRA;
-		break;
-	}
-
-	if ((priv->pci_dev->device == 0x4223) ||
-	    (priv->pci_dev->device == 0x4224)) {
-		printk(KERN_INFO DRV_NAME
-		       ": Detected Intel PRO/Wireless 2915ABG Network "
-		       "Connection\n");
-		priv->ieee->abg_ture = 1;
-		band = IEEE80211_52GHZ_BAND | IEEE80211_24GHZ_BAND;
-		modulation = IEEE80211_OFDM_MODULATION |
-			IEEE80211_CCK_MODULATION;
-		priv->adapter = IPW_2915ABG;
-		priv->ieee->mode = IEEE_A|IEEE_G|IEEE_B;
-	} else {
-		if (priv->pci_dev->device == 0x4221)
-			printk(KERN_INFO DRV_NAME
-			       ": Detected Intel PRO/Wireless 2225BG Network "
-			       "Connection\n");
-		else
-			printk(KERN_INFO DRV_NAME
-			       ": Detected Intel PRO/Wireless 2200BG Network "
-			       "Connection\n");
-
-		priv->ieee->abg_ture = 0;
-		band = IEEE80211_24GHZ_BAND;
-		modulation = IEEE80211_OFDM_MODULATION |
-			IEEE80211_CCK_MODULATION;
-		priv->adapter = IPW_2200BG;
-		priv->ieee->mode = IEEE_G|IEEE_B;
-	}
-
-	priv->ieee->freq_band = band;
-	priv->ieee->modulation = modulation;
-
-	priv->rates_mask = IEEE80211_DEFAULT_RATES_MASK;
-
-	priv->missed_beacon_threshold = IPW_MB_DISASSOCIATE_THRESHOLD_DEFAULT;
-	priv->roaming_threshold = IPW_MB_ROAMING_THRESHOLD_DEFAULT;
-
-	priv->rts_threshold = DEFAULT_RTS_THRESHOLD;
-
-	/* If power management is turned on, default to AC mode */
-        priv->power_mode = IPW_POWER_AC;
-	priv->tx_power = IPW_DEFAULT_TX_POWER;
-
-	err = request_irq(pdev->irq, ipw_isr, SA_SHIRQ, DRV_NAME,
-			  priv);
-	if (err) {
-		IPW_ERROR("Error allocating IRQ %d\n", pdev->irq);
-		goto out_destroy_workqueue;
-	}
-
-	SET_MODULE_OWNER(net_dev);
-	SET_NETDEV_DEV(net_dev, &pdev->dev);
-
-	priv->ieee->hard_start_xmit = ipw_net_hard_start_xmit;
-	priv->ieee->set_security = shim__set_security;
-
-	net_dev->open = ipw_net_open;
-	net_dev->stop = ipw_net_stop;
-	net_dev->init = ipw_net_init;
-	net_dev->get_stats = ipw_net_get_stats;
-	net_dev->set_multicast_list = ipw_net_set_multicast_list;
-	net_dev->set_mac_address = ipw_net_set_mac_address;
-	net_dev->get_wireless_stats = ipw_get_wireless_stats;
-	net_dev->wireless_handlers = &ipw_wx_handler_def;
-	net_dev->ethtool_ops = &ipw_ethtool_ops;
-	net_dev->irq = pdev->irq;
-	net_dev->base_addr = (unsigned long )priv->hw_base;
-	net_dev->mem_start = pci_resource_start(pdev, 0);
-	net_dev->mem_end = net_dev->mem_start + pci_resource_len(pdev, 0) - 1;
-
-	err = sysfs_create_group(&pdev->dev.kobj, &ipw_attribute_group);
-	if (err) {
-		IPW_ERROR("failed to create sysfs device attributes\n");
-		goto out_release_irq;
-	}
-
-	err = register_netdev(net_dev);
-	if (err) {
-		IPW_ERROR("failed to register network device\n");
-		goto out_remove_group;
-	}
-
-	return 0;
-
- out_remove_group:
-	sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
- out_release_irq:
-	free_irq(pdev->irq, priv);
- out_destroy_workqueue:
-	destroy_workqueue(priv->workqueue);
-	priv->workqueue = NULL;
- out_iounmap:
-	iounmap(priv->hw_base);
- out_pci_release_regions:
-	pci_release_regions(pdev);
- out_pci_disable_device:
-	pci_disable_device(pdev);
-	pci_set_drvdata(pdev, NULL);
- out_free_ieee80211:
-	free_ieee80211(priv->net_dev);
- out:
-	return err;
-}
-
-static void ipw_pci_remove(struct pci_dev *pdev)
-{
-	struct ipw_priv *priv = pci_get_drvdata(pdev);
-	if (!priv)
-		return;
-
-	priv->status |= STATUS_EXIT_PENDING;
-
-	sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
-
-	ipw_down(priv);
-
-	unregister_netdev(priv->net_dev);
-
-	if (priv->rxq) {
-		ipw_rx_queue_free(priv, priv->rxq);
-		priv->rxq = NULL;
-	}
-	ipw_tx_queue_free(priv);
-
-	/* ipw_down will ensure that there is no more pending work
-	 * in the workqueue's, so we can safely remove them now. */
-	if (priv->workqueue) {
-		cancel_delayed_work(&priv->adhoc_check);
-		cancel_delayed_work(&priv->gather_stats);
-		cancel_delayed_work(&priv->request_scan);
-		cancel_delayed_work(&priv->rf_kill);
-		cancel_delayed_work(&priv->scan_check);
-		destroy_workqueue(priv->workqueue);
-		priv->workqueue = NULL;
-	}
-
-	free_irq(pdev->irq, priv);
-	iounmap(priv->hw_base);
-	pci_release_regions(pdev);
-	pci_disable_device(pdev);
-	pci_set_drvdata(pdev, NULL);
-	free_ieee80211(priv->net_dev);
-
-#ifdef CONFIG_PM
-	if (fw_loaded) {
-		release_firmware(bootfw);
-		release_firmware(ucode);
-		release_firmware(firmware);
-		fw_loaded = 0;
-	}
-#endif
-}
-
-
-#ifdef CONFIG_PM
-static int ipw_pci_suspend(struct pci_dev *pdev, u32 state)
-{
-	struct ipw_priv *priv = pci_get_drvdata(pdev);
-	struct net_device *dev = priv->net_dev;
-
-	printk(KERN_INFO "%s: Going into suspend...\n", dev->name);
-
- 	/* Take down the device; powers it off, etc. */
-	ipw_down(priv);
-
-	/* Remove the PRESENT state of the device */
-	netif_device_detach(dev);
-
-	pci_save_state(pdev);
-	pci_disable_device(pdev);
-	pci_set_power_state(pdev, state);
-
-	return 0;
-}
-
-static int ipw_pci_resume(struct pci_dev *pdev)
-{
-	struct ipw_priv *priv = pci_get_drvdata(pdev);
-	struct net_device *dev = priv->net_dev;
-	u32 val;
-
-	printk(KERN_INFO "%s: Coming out of suspend...\n", dev->name);
-
-	pci_set_power_state(pdev, 0);
-	pci_enable_device(pdev);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
-	pci_restore_state(pdev, priv->pm_state);
-#else
-	pci_restore_state(pdev);
-#endif
-	/*
-	 * Suspend/Resume resets the PCI configuration space, so we have to
-	 * re-disable the RETRY_TIMEOUT register (0x41) to keep PCI Tx retries
-	 * from interfering with C3 CPU state. pci_restore_state won't help
-	 * here since it only restores the first 64 bytes pci config header.
-	 */
-	pci_read_config_dword(pdev, 0x40, &val);
-	if ((val & 0x0000ff00) != 0)
-		pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
-
-	/* Set the device back into the PRESENT state; this will also wake
-	 * the queue of needed */
-	netif_device_attach(dev);
-
-	/* Bring the device back up */
-	queue_work(priv->workqueue, &priv->up);
-
-	return 0;
-}
-#endif
-
-/* driver initialization stuff */
-static struct pci_driver ipw_driver = {
-	.name = DRV_NAME,
-	.id_table = card_ids,
-	.probe = ipw_pci_probe,
-	.remove = __devexit_p(ipw_pci_remove),
-#ifdef CONFIG_PM
-	.suspend = ipw_pci_suspend,
-	.resume = ipw_pci_resume,
-#endif
-};
-
-static int __init ipw_init(void)
-{
-	int ret;
-
-	printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION ", " DRV_VERSION "\n");
-	printk(KERN_INFO DRV_NAME ": " DRV_COPYRIGHT "\n");
-
-	ret = pci_module_init(&ipw_driver);
-	if (ret) {
-		IPW_ERROR("Unable to initialize PCI module\n");
-		return ret;
-	}
-
-	ret = driver_create_file(&ipw_driver.driver,
-				 &driver_attr_debug_level);
-	if (ret) {
-		IPW_ERROR("Unable to create driver sysfs file\n");
-		pci_unregister_driver(&ipw_driver);
-		return ret;
-	}
-
-	return ret;
-}
-
-static void __exit ipw_exit(void)
-{
-	driver_remove_file(&ipw_driver.driver, &driver_attr_debug_level);
-	pci_unregister_driver(&ipw_driver);
-}
-
-module_param(disable, int, 0444);
-MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
-
-module_param(associate, int, 0444);
-MODULE_PARM_DESC(associate, "auto associate when scanning (default on)");
-
-module_param(auto_create, int, 0444);
-MODULE_PARM_DESC(auto_create, "auto create adhoc network (default on)");
-
-module_param(debug, int, 0444);
-MODULE_PARM_DESC(debug, "debug output mask");
-
-module_param(channel, int, 0444);
-MODULE_PARM_DESC(channel, "channel to limit associate to (default 0 [ANY])");
-
-module_param(ifname, charp, 0444);
-MODULE_PARM_DESC(ifname, "network device name (default eth%d)");
-
-#ifdef CONFIG_IPW_PROMISC
-module_param(mode, int, 0444);
-MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS,2=Monitor)");
-#else
-module_param(mode, int, 0444);
-MODULE_PARM_DESC(mode, "network mode (0=BSS,1=IBSS)");
-#endif
-
-module_exit(ipw_exit);
-module_init(ipw_init);
diff --git a/trunk/drivers/net/wireless/ipw2200.h b/trunk/drivers/net/wireless/ipw2200.h
deleted file mode 100644
index 3bff09d93154..000000000000
--- a/trunk/drivers/net/wireless/ipw2200.h
+++ /dev/null
@@ -1,1742 +0,0 @@
-/******************************************************************************
-
-  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-******************************************************************************/
-
-#ifndef __ipw2200_h__
-#define __ipw2200_h__
-
-#define WEXT_USECHANNELS 1
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/config.h>
-#include <linux/init.h>
-
-#include <linux/version.h>
-#include <linux/pci.h>
-#include <linux/netdevice.h>
-#include <linux/ethtool.h>
-#include <linux/skbuff.h>
-#include <linux/etherdevice.h>
-#include <linux/delay.h>
-#include <linux/random.h>
-
-#include <linux/firmware.h>
-#include <linux/wireless.h>
-#include <asm/io.h>
-
-#include <net/ieee80211.h>
-
-#define DRV_NAME	"ipw2200"
-
-#include <linux/workqueue.h>
-
-/* Authentication  and Association States */
-enum connection_manager_assoc_states
-{
-	CMAS_INIT = 0,
-	CMAS_TX_AUTH_SEQ_1,
-	CMAS_RX_AUTH_SEQ_2,
-	CMAS_AUTH_SEQ_1_PASS,
-	CMAS_AUTH_SEQ_1_FAIL,
-	CMAS_TX_AUTH_SEQ_3,
-	CMAS_RX_AUTH_SEQ_4,
-	CMAS_AUTH_SEQ_2_PASS,
-	CMAS_AUTH_SEQ_2_FAIL,
-	CMAS_AUTHENTICATED,
-	CMAS_TX_ASSOC,
-	CMAS_RX_ASSOC_RESP,
-	CMAS_ASSOCIATED,
-	CMAS_LAST
-};
-
-
-#define IPW_WAIT                     (1<<0)
-#define IPW_QUIET                    (1<<1)
-#define IPW_ROAMING                  (1<<2)
-
-#define IPW_POWER_MODE_CAM           0x00	//(always on)
-#define IPW_POWER_INDEX_1            0x01
-#define IPW_POWER_INDEX_2            0x02
-#define IPW_POWER_INDEX_3            0x03
-#define IPW_POWER_INDEX_4            0x04
-#define IPW_POWER_INDEX_5            0x05
-#define IPW_POWER_AC                 0x06
-#define IPW_POWER_BATTERY            0x07
-#define IPW_POWER_LIMIT              0x07
-#define IPW_POWER_MASK               0x0F
-#define IPW_POWER_ENABLED            0x10
-#define IPW_POWER_LEVEL(x)           ((x) & IPW_POWER_MASK)
-
-#define IPW_CMD_HOST_COMPLETE                 2
-#define IPW_CMD_POWER_DOWN                    4
-#define IPW_CMD_SYSTEM_CONFIG                 6
-#define IPW_CMD_MULTICAST_ADDRESS             7
-#define IPW_CMD_SSID                          8
-#define IPW_CMD_ADAPTER_ADDRESS              11
-#define IPW_CMD_PORT_TYPE                    12
-#define IPW_CMD_RTS_THRESHOLD                15
-#define IPW_CMD_FRAG_THRESHOLD               16
-#define IPW_CMD_POWER_MODE                   17
-#define IPW_CMD_WEP_KEY                      18
-#define IPW_CMD_TGI_TX_KEY                   19
-#define IPW_CMD_SCAN_REQUEST                 20
-#define IPW_CMD_ASSOCIATE                    21
-#define IPW_CMD_SUPPORTED_RATES              22
-#define IPW_CMD_SCAN_ABORT                   23
-#define IPW_CMD_TX_FLUSH                     24
-#define IPW_CMD_QOS_PARAMETERS               25
-#define IPW_CMD_SCAN_REQUEST_EXT             26
-#define IPW_CMD_DINO_CONFIG                  30
-#define IPW_CMD_RSN_CAPABILITIES             31
-#define IPW_CMD_RX_KEY                       32
-#define IPW_CMD_CARD_DISABLE                 33
-#define IPW_CMD_SEED_NUMBER                  34
-#define IPW_CMD_TX_POWER                     35
-#define IPW_CMD_COUNTRY_INFO                 36
-#define IPW_CMD_AIRONET_INFO                 37
-#define IPW_CMD_AP_TX_POWER                  38
-#define IPW_CMD_CCKM_INFO                    39
-#define IPW_CMD_CCX_VER_INFO                 40
-#define IPW_CMD_SET_CALIBRATION              41
-#define IPW_CMD_SENSITIVITY_CALIB            42
-#define IPW_CMD_RETRY_LIMIT                  51
-#define IPW_CMD_IPW_PRE_POWER_DOWN           58
-#define IPW_CMD_VAP_BEACON_TEMPLATE          60
-#define IPW_CMD_VAP_DTIM_PERIOD              61
-#define IPW_CMD_EXT_SUPPORTED_RATES          62
-#define IPW_CMD_VAP_LOCAL_TX_PWR_CONSTRAINT  63
-#define IPW_CMD_VAP_QUIET_INTERVALS          64
-#define IPW_CMD_VAP_CHANNEL_SWITCH           65
-#define IPW_CMD_VAP_MANDATORY_CHANNELS       66
-#define IPW_CMD_VAP_CELL_PWR_LIMIT           67
-#define IPW_CMD_VAP_CF_PARAM_SET             68
-#define IPW_CMD_VAP_SET_BEACONING_STATE      69
-#define IPW_CMD_MEASUREMENT                  80
-#define IPW_CMD_POWER_CAPABILITY             81
-#define IPW_CMD_SUPPORTED_CHANNELS           82
-#define IPW_CMD_TPC_REPORT                   83
-#define IPW_CMD_WME_INFO                     84
-#define IPW_CMD_PRODUCTION_COMMAND	     85
-#define IPW_CMD_LINKSYS_EOU_INFO             90
-
-#define RFD_SIZE                              4
-#define NUM_TFD_CHUNKS                        6
-
-#define TX_QUEUE_SIZE                        32
-#define RX_QUEUE_SIZE                        32
-
-#define DINO_CMD_WEP_KEY                   0x08
-#define DINO_CMD_TX                        0x0B
-#define DCT_ANTENNA_A                      0x01
-#define DCT_ANTENNA_B                      0x02
-
-#define IPW_A_MODE                         0
-#define IPW_B_MODE                         1
-#define IPW_G_MODE                         2
-
-/*
- * TX Queue Flag Definitions
- */
-
-/* abort attempt if mgmt frame is rx'd */
-#define DCT_FLAG_ABORT_MGMT                0x01
-
-/* require CTS */
-#define DCT_FLAG_CTS_REQUIRED              0x02
-
-/* use short preamble */
-#define DCT_FLAG_SHORT_PREMBL              0x04
-
-/* RTS/CTS first */
-#define DCT_FLAG_RTS_REQD                  0x08
-
-/* dont calculate duration field */
-#define DCT_FLAG_DUR_SET                   0x10
-
-/* even if MAC WEP set (allows pre-encrypt) */
-#define DCT_FLAG_NO_WEP              0x20
-
-/* overwrite TSF field */
-#define DCT_FLAG_TSF_REQD                  0x40
-
-/* ACK rx is expected to follow */
-#define DCT_FLAG_ACK_REQD                  0x80
-
-#define DCT_FLAG_EXT_MODE_CCK  0x01
-#define DCT_FLAG_EXT_MODE_OFDM 0x00
-
-
-#define TX_RX_TYPE_MASK                    0xFF
-#define TX_FRAME_TYPE                      0x00
-#define TX_HOST_COMMAND_TYPE               0x01
-#define RX_FRAME_TYPE                      0x09
-#define RX_HOST_NOTIFICATION_TYPE          0x03
-#define RX_HOST_CMD_RESPONSE_TYPE          0x04
-#define RX_TX_FRAME_RESPONSE_TYPE          0x05
-#define TFD_NEED_IRQ_MASK                  0x04
-
-#define HOST_CMD_DINO_CONFIG               30
-
-#define HOST_NOTIFICATION_STATUS_ASSOCIATED             10
-#define HOST_NOTIFICATION_STATUS_AUTHENTICATE           11
-#define HOST_NOTIFICATION_STATUS_SCAN_CHANNEL_RESULT    12
-#define HOST_NOTIFICATION_STATUS_SCAN_COMPLETED         13
-#define HOST_NOTIFICATION_STATUS_FRAG_LENGTH            14
-#define HOST_NOTIFICATION_STATUS_LINK_DETERIORATION     15
-#define HOST_NOTIFICATION_DINO_CONFIG_RESPONSE          16
-#define HOST_NOTIFICATION_STATUS_BEACON_STATE           17
-#define HOST_NOTIFICATION_STATUS_TGI_TX_KEY             18
-#define HOST_NOTIFICATION_TX_STATUS                     19
-#define HOST_NOTIFICATION_CALIB_KEEP_RESULTS            20
-#define HOST_NOTIFICATION_MEASUREMENT_STARTED           21
-#define HOST_NOTIFICATION_MEASUREMENT_ENDED             22
-#define HOST_NOTIFICATION_CHANNEL_SWITCHED              23
-#define HOST_NOTIFICATION_RX_DURING_QUIET_PERIOD        24
-#define HOST_NOTIFICATION_NOISE_STATS			25
-#define HOST_NOTIFICATION_S36_MEASUREMENT_ACCEPTED      30
-#define HOST_NOTIFICATION_S36_MEASUREMENT_REFUSED       31
-
-#define HOST_NOTIFICATION_STATUS_BEACON_MISSING         1
-#define IPW_MB_DISASSOCIATE_THRESHOLD_DEFAULT           24
-#define IPW_MB_ROAMING_THRESHOLD_DEFAULT                8
-#define IPW_REAL_RATE_RX_PACKET_THRESHOLD               300
-
-#define MACADRR_BYTE_LEN                     6
-
-#define DCR_TYPE_AP                       0x01
-#define DCR_TYPE_WLAP                     0x02
-#define DCR_TYPE_MU_ESS                   0x03
-#define DCR_TYPE_MU_IBSS                  0x04
-#define DCR_TYPE_MU_PIBSS                 0x05
-#define DCR_TYPE_SNIFFER                  0x06
-#define DCR_TYPE_MU_BSS        DCR_TYPE_MU_ESS
-
-/**
- * Generic queue structure
- *
- * Contains common data for Rx and Tx queues
- */
-struct clx2_queue {
-	int n_bd;                      /**< number of BDs in this queue */
-	int first_empty;               /**< 1-st empty entry (index) */
-	int last_used;                 /**< last used entry (index) */
-	u32 reg_w;                   /**< 'write' reg (queue head), addr in domain 1 */
-	u32 reg_r;                   /**< 'read' reg (queue tail), addr in domain 1 */
-	dma_addr_t dma_addr;            /**< physical addr for BD's */
-	int low_mark;                  /**< low watermark, resume queue if free space more than this */
-	int high_mark;                 /**< high watermark, stop queue if free space less than this */
-} __attribute__ ((packed));
-
-struct machdr32
-{
-	u16 frame_ctl;
-	u16 duration;     // watch out for endians!
-	u8 addr1[ MACADRR_BYTE_LEN ];
-	u8 addr2[ MACADRR_BYTE_LEN ];
-	u8 addr3[ MACADRR_BYTE_LEN ];
-	u16 seq_ctrl;     // more endians!
-	u8 addr4[ MACADRR_BYTE_LEN ];
-	u16 qos_ctrl;
-} __attribute__ ((packed)) ;
-
-struct machdr30
-{
-	u16 frame_ctl;
-	u16 duration;     // watch out for endians!
-	u8 addr1[ MACADRR_BYTE_LEN ];
-	u8 addr2[ MACADRR_BYTE_LEN ];
-	u8 addr3[ MACADRR_BYTE_LEN ];
-	u16 seq_ctrl;     // more endians!
-	u8 addr4[ MACADRR_BYTE_LEN ];
-} __attribute__ ((packed)) ;
-
-struct machdr26
-{
-	u16 frame_ctl;
-	u16 duration;     // watch out for endians!
-	u8 addr1[ MACADRR_BYTE_LEN ];
-	u8 addr2[ MACADRR_BYTE_LEN ];
-	u8 addr3[ MACADRR_BYTE_LEN ];
-	u16 seq_ctrl;     // more endians!
-	u16 qos_ctrl;
-} __attribute__ ((packed)) ;
-
-struct machdr24
-{
-	u16 frame_ctl;
-	u16 duration;     // watch out for endians!
-	u8 addr1[ MACADRR_BYTE_LEN ];
-	u8 addr2[ MACADRR_BYTE_LEN ];
-	u8 addr3[ MACADRR_BYTE_LEN ];
-	u16 seq_ctrl;     // more endians!
-} __attribute__ ((packed)) ;
-
-// TX TFD with 32 byte MAC Header
-struct tx_tfd_32
-{
-	struct machdr32    mchdr;                      // 32
-	u32                uivplaceholder[2];          // 8
-} __attribute__ ((packed)) ;
-
-// TX TFD with 30 byte MAC Header
-struct tx_tfd_30
-{
-	struct machdr30    mchdr;                      // 30
-	u8                 reserved[2];                // 2
-	u32                uivplaceholder[2];          // 8
-} __attribute__ ((packed)) ;
-
-// tx tfd with 26 byte mac header
-struct tx_tfd_26
-{
-	struct machdr26    mchdr;                      // 26
-	u8                 reserved1[2];               // 2
-	u32                uivplaceholder[2];          // 8
-	u8                 reserved2[4];               // 4
-} __attribute__ ((packed)) ;
-
-// tx tfd with 24 byte mac header
-struct tx_tfd_24
-{
-	struct machdr24    mchdr;                      // 24
-	u32                uivplaceholder[2];          // 8
-	u8                 reserved[8];                // 8
-} __attribute__ ((packed)) ;
-
-
-#define DCT_WEP_KEY_FIELD_LENGTH 16
-
-struct tfd_command
-{
-	u8 index;
-	u8 length;
-	u16 reserved;
-	u8 payload[0];
-} __attribute__ ((packed)) ;
-
-struct tfd_data {
-	/* Header */
-	u32 work_area_ptr;
-	u8 station_number; /* 0 for BSS */
-	u8 reserved1;
-	u16 reserved2;
-
-	/* Tx Parameters */
-	u8 cmd_id;
-	u8 seq_num;
-	u16 len;
-	u8 priority;
-	u8 tx_flags;
-	u8 tx_flags_ext;
-	u8 key_index;
-	u8 wepkey[DCT_WEP_KEY_FIELD_LENGTH];
-	u8 rate;
-	u8 antenna;
-	u16 next_packet_duration;
-	u16 next_frag_len;
-	u16 back_off_counter; //////txop;
-	u8 retrylimit;
-	u16 cwcurrent;
-	u8 reserved3;
-
-	/* 802.11 MAC Header */
-	union
-	{
-		struct tx_tfd_24 tfd_24;
-		struct tx_tfd_26 tfd_26;
-		struct tx_tfd_30 tfd_30;
-		struct tx_tfd_32 tfd_32;
-	} tfd;
-
-	/* Payload DMA info */
-	u32 num_chunks;
-	u32 chunk_ptr[NUM_TFD_CHUNKS];
-	u16 chunk_len[NUM_TFD_CHUNKS];
-} __attribute__ ((packed));
-
-struct txrx_control_flags
-{
-	u8 message_type;
-	u8 rx_seq_num;
-	u8 control_bits;
-	u8 reserved;
-} __attribute__ ((packed));
-
-#define  TFD_SIZE                           128
-#define  TFD_CMD_IMMEDIATE_PAYLOAD_LENGTH   (TFD_SIZE - sizeof(struct txrx_control_flags))
-
-struct tfd_frame
-{
-	struct txrx_control_flags control_flags;
-	union {
-		struct tfd_data data;
-		struct tfd_command cmd;
-		u8 raw[TFD_CMD_IMMEDIATE_PAYLOAD_LENGTH];
-	} u;
-} __attribute__ ((packed)) ;
-
-typedef void destructor_func(const void*);
-
-/**
- * Tx Queue for DMA. Queue consists of circular buffer of
- * BD's and required locking structures.
- */
-struct clx2_tx_queue {
-	struct clx2_queue q;
-	struct tfd_frame* bd;
-	struct ieee80211_txb **txb;
-};
-
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 32
-#define RX_LOW_WATERMARK 8
-
-#define SUP_RATE_11A_MAX_NUM_CHANNELS  (8)
-#define SUP_RATE_11B_MAX_NUM_CHANNELS  (4)
-#define SUP_RATE_11G_MAX_NUM_CHANNELS  (12)
-
-// Used for passing to driver number of successes and failures per rate
-struct rate_histogram
-{
-	union {
-		u32 a[SUP_RATE_11A_MAX_NUM_CHANNELS];
-		u32 b[SUP_RATE_11B_MAX_NUM_CHANNELS];
-		u32 g[SUP_RATE_11G_MAX_NUM_CHANNELS];
-	} success;
-	union {
-		u32 a[SUP_RATE_11A_MAX_NUM_CHANNELS];
-		u32 b[SUP_RATE_11B_MAX_NUM_CHANNELS];
-		u32 g[SUP_RATE_11G_MAX_NUM_CHANNELS];
-	} failed;
-} __attribute__ ((packed));
-
-/* statistics command response */
-struct ipw_cmd_stats {
-	u8 cmd_id;
-	u8 seq_num;
-	u16 good_sfd;
-	u16 bad_plcp;
-	u16 wrong_bssid;
-	u16 valid_mpdu;
-	u16 bad_mac_header;
-	u16 reserved_frame_types;
-	u16 rx_ina;
-	u16 bad_crc32;
-	u16 invalid_cts;
-	u16 invalid_acks;
-	u16 long_distance_ina_fina;
-	u16 dsp_silence_unreachable;
-	u16 accumulated_rssi;
-	u16 rx_ovfl_frame_tossed;
-	u16 rssi_silence_threshold;
-	u16 rx_ovfl_frame_supplied;
-	u16 last_rx_frame_signal;
-	u16 last_rx_frame_noise;
-	u16 rx_autodetec_no_ofdm;
-	u16 rx_autodetec_no_barker;
-	u16 reserved;
-} __attribute__ ((packed));
-
-struct notif_channel_result {
-	u8 channel_num;
-	struct ipw_cmd_stats stats;
-	u8 uReserved;
-} __attribute__ ((packed));
-
-struct notif_scan_complete {
-	u8 scan_type;
-	u8 num_channels;
-	u8 status;
-	u8 reserved;
-}  __attribute__ ((packed));
-
-struct notif_frag_length {
-	u16 frag_length;
-	u16 reserved;
-}  __attribute__ ((packed));
-
-struct notif_beacon_state {
-	u32 state;
-	u32 number;
-} __attribute__ ((packed));
-
-struct notif_tgi_tx_key {
-	u8 key_state;
-	u8 security_type;
-	u8 station_index;
-	u8 reserved;
-} __attribute__ ((packed));
-
-struct notif_link_deterioration {
-	struct ipw_cmd_stats stats;
-	u8 rate;
-	u8 modulation;
-	struct rate_histogram histogram;
-	u8 reserved1;
-	u16 reserved2;
-} __attribute__ ((packed));
-
-struct notif_association {
-	u8 state;
-} __attribute__ ((packed));
-
-struct notif_authenticate {
-	u8 state;
-	struct machdr24 addr;
-	u16 status;
-} __attribute__ ((packed));
-
-struct notif_calibration {
-	u8 data[104];
-} __attribute__ ((packed));
-
-struct notif_noise {
-	u32 value;
-} __attribute__ ((packed));
-
-struct ipw_rx_notification {
-	u8 reserved[8];
-	u8 subtype;
-	u8 flags;
-	u16 size;
-	union {
-		struct notif_association assoc;
-		struct notif_authenticate auth;
-		struct notif_channel_result channel_result;
-		struct notif_scan_complete scan_complete;
-		struct notif_frag_length frag_len;
-		struct notif_beacon_state beacon_state;
-		struct notif_tgi_tx_key tgi_tx_key;
-		struct notif_link_deterioration link_deterioration;
-		struct notif_calibration calibration;
-		struct notif_noise noise;
-		u8 raw[0];
-	} u;
-} __attribute__ ((packed));
-
-struct ipw_rx_frame {
-	u32 reserved1;
-	u8 parent_tsf[4];     // fw_use[0] is boolean for OUR_TSF_IS_GREATER
-	u8 received_channel;  // The channel that this frame was received on.
-			      // Note that for .11b this does not have to be
-	                      // the same as the channel that it was sent.
-                              // Filled by LMAC
-	u8 frameStatus;
-	u8 rate;
-	u8 rssi;
-	u8 agc;
-	u8 rssi_dbm;
-	u16 signal;
-	u16 noise;
-	u8 antennaAndPhy;
-	u8 control;           // control bit should be on in bg
-	u8 rtscts_rate;       // rate of rts or cts (in rts cts sequence rate
-	                      // is identical)
-	u8 rtscts_seen;       // 0x1 RTS seen ; 0x2 CTS seen
-	u16 length;
-	u8 data[0];
-} __attribute__ ((packed));
-
-struct ipw_rx_header {
-	u8 message_type;
-	u8 rx_seq_num;
-	u8 control_bits;
-	u8 reserved;
-} __attribute__ ((packed));
-
-struct ipw_rx_packet
-{
-	struct ipw_rx_header header;
-	union {
-		struct ipw_rx_frame frame;
-		struct ipw_rx_notification notification;
-	} u;
-} __attribute__ ((packed));
-
-#define IPW_RX_NOTIFICATION_SIZE sizeof(struct ipw_rx_header) + 12
-#define IPW_RX_FRAME_SIZE        sizeof(struct ipw_rx_header) + \
-                                 sizeof(struct ipw_rx_frame)
-
-struct ipw_rx_mem_buffer {
-	dma_addr_t dma_addr;
-	struct ipw_rx_buffer *rxb;
-	struct sk_buff *skb;
-	struct list_head list;
-}; /* Not transferred over network, so not  __attribute__ ((packed)) */
-
-struct ipw_rx_queue {
-	struct ipw_rx_mem_buffer pool[RX_QUEUE_SIZE + RX_FREE_BUFFERS];
-	struct ipw_rx_mem_buffer *queue[RX_QUEUE_SIZE];
-	u32 processed; /* Internal index to last handled Rx packet */
-	u32 read;      /* Shared index to newest available Rx buffer */
-	u32 write;     /* Shared index to oldest written Rx packet */
-	u32 free_count;/* Number of pre-allocated buffers in rx_free */
-	/* Each of these lists is used as a FIFO for ipw_rx_mem_buffers */
-	struct list_head rx_free;  /* Own an SKBs */
-	struct list_head rx_used;  /* No SKB allocated */
-	spinlock_t lock;
-}; /* Not transferred over network, so not  __attribute__ ((packed)) */
-
-
-struct alive_command_responce {
-	u8 alive_command;
-	u8 sequence_number;
-	u16 software_revision;
-	u8 device_identifier;
-	u8 reserved1[5];
-	u16 reserved2;
-	u16 reserved3;
-	u16 clock_settle_time;
-	u16 powerup_settle_time;
-	u16 reserved4;
-	u8 time_stamp[5];	/* month, day, year, hours, minutes */
-	u8 ucode_valid;
-} __attribute__ ((packed));
-
-#define IPW_MAX_RATES 12
-
-struct ipw_rates {
-	u8 num_rates;
-	u8 rates[IPW_MAX_RATES];
-} __attribute__ ((packed));
-
-struct command_block
-{
-	unsigned int control;
-	u32 source_addr;
-	u32 dest_addr;
-	unsigned int status;
-} __attribute__ ((packed));
-
-#define CB_NUMBER_OF_ELEMENTS_SMALL 64
-struct fw_image_desc
-{
-	unsigned long last_cb_index;
-	unsigned long current_cb_index;
-	struct command_block cb_list[CB_NUMBER_OF_ELEMENTS_SMALL];
-	void * v_addr;
-	unsigned long p_addr;
-	unsigned long len;
-};
-
-struct ipw_sys_config
-{
-	u8 bt_coexistence;
-	u8 reserved1;
-	u8 answer_broadcast_ssid_probe;
-	u8 accept_all_data_frames;
-	u8 accept_non_directed_frames;
-	u8 exclude_unicast_unencrypted;
-	u8 disable_unicast_decryption;
-	u8 exclude_multicast_unencrypted;
-	u8 disable_multicast_decryption;
-	u8 antenna_diversity;
-	u8 pass_crc_to_host;
-	u8 dot11g_auto_detection;
-	u8 enable_cts_to_self;
-	u8 enable_multicast_filtering;
-	u8 bt_coexist_collision_thr;
-	u8 reserved2;
-	u8 accept_all_mgmt_bcpr;
-	u8 accept_all_mgtm_frames;
-	u8 pass_noise_stats_to_host;
-	u8 reserved3;
-} __attribute__ ((packed));
-
-struct ipw_multicast_addr
-{
-	u8 num_of_multicast_addresses;
-	u8 reserved[3];
-	u8 mac1[6];
-	u8 mac2[6];
-	u8 mac3[6];
-	u8 mac4[6];
-} __attribute__ ((packed));
-
-struct ipw_wep_key
-{
-	u8 cmd_id;
-	u8 seq_num;
-	u8 key_index;
-	u8 key_size;
-	u8 key[16];
-} __attribute__ ((packed));
-
-struct ipw_tgi_tx_key
-{
-	u8 key_id;
-	u8 security_type;
-	u8 station_index;
-	u8 flags;
-	u8 key[16];
-	u32 tx_counter[2];
-} __attribute__ ((packed));
-
-#define IPW_SCAN_CHANNELS 54
-
-struct ipw_scan_request
-{
-	u8 scan_type;
-	u16 dwell_time;
-	u8 channels_list[IPW_SCAN_CHANNELS];
-	u8 channels_reserved[3];
-} __attribute__ ((packed));
-
-enum {
-	IPW_SCAN_PASSIVE_TILL_FIRST_BEACON_SCAN = 0,
-	IPW_SCAN_PASSIVE_FULL_DWELL_SCAN,
-	IPW_SCAN_ACTIVE_DIRECT_SCAN,
-	IPW_SCAN_ACTIVE_BROADCAST_SCAN,
-	IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN,
-	IPW_SCAN_TYPES
-};
-
-struct ipw_scan_request_ext
-{
-	u32 full_scan_index;
-	u8 channels_list[IPW_SCAN_CHANNELS];
-	u8 scan_type[IPW_SCAN_CHANNELS / 2];
-	u8 reserved;
-	u16 dwell_time[IPW_SCAN_TYPES];
-} __attribute__ ((packed));
-
-extern inline u8 ipw_get_scan_type(struct ipw_scan_request_ext *scan, u8 index)
-{
-	if (index % 2)
-		return scan->scan_type[index / 2] & 0x0F;
-	else
-		return (scan->scan_type[index / 2] & 0xF0) >> 4;
-}
-
-extern inline void ipw_set_scan_type(struct ipw_scan_request_ext *scan,
-				     u8 index, u8 scan_type)
-{
-	if (index % 2)
-		scan->scan_type[index / 2] =
-			(scan->scan_type[index / 2] & 0xF0) |
-			(scan_type & 0x0F);
-	else
-		scan->scan_type[index / 2] =
-			(scan->scan_type[index / 2] & 0x0F) |
-			((scan_type & 0x0F) << 4);
-}
-
-struct ipw_associate
-{
-	u8 channel;
-	u8 auth_type:4,
-	   auth_key:4;
-	u8 assoc_type;
-	u8 reserved;
-	u16 policy_support;
-	u8 preamble_length;
-	u8 ieee_mode;
-	u8 bssid[ETH_ALEN];
-	u32 assoc_tsf_msw;
-	u32 assoc_tsf_lsw;
-	u16 capability;
-	u16 listen_interval;
-	u16 beacon_interval;
-	u8 dest[ETH_ALEN];
-	u16 atim_window;
-	u8 smr;
-	u8 reserved1;
-	u16 reserved2;
-} __attribute__ ((packed));
-
-struct ipw_supported_rates
-{
-	u8 ieee_mode;
-	u8 num_rates;
-	u8 purpose;
-	u8 reserved;
-	u8 supported_rates[IPW_MAX_RATES];
-} __attribute__ ((packed));
-
-struct ipw_rts_threshold
-{
-	u16 rts_threshold;
-	u16 reserved;
-} __attribute__ ((packed));
-
-struct ipw_frag_threshold
-{
-	u16 frag_threshold;
-	u16 reserved;
-} __attribute__ ((packed));
-
-struct ipw_retry_limit
-{
-	u8 short_retry_limit;
-	u8 long_retry_limit;
-	u16 reserved;
-} __attribute__ ((packed));
-
-struct ipw_dino_config
-{
-	u32 dino_config_addr;
-	u16 dino_config_size;
-	u8 dino_response;
-	u8 reserved;
-} __attribute__ ((packed));
-
-struct ipw_aironet_info
-{
-	u8 id;
-	u8 length;
-	u16 reserved;
-} __attribute__ ((packed));
-
-struct ipw_rx_key
-{
-	u8 station_index;
-	u8 key_type;
-	u8 key_id;
-	u8 key_flag;
-	u8 key[16];
-	u8 station_address[6];
-	u8 key_index;
-	u8 reserved;
-} __attribute__ ((packed));
-
-struct ipw_country_channel_info
-{
-	u8 first_channel;
-	u8 no_channels;
-	s8 max_tx_power;
-} __attribute__ ((packed));
-
-struct ipw_country_info
-{
-	u8 id;
-	u8 length;
-	u8 country_str[3];
-	struct ipw_country_channel_info groups[7];
-} __attribute__ ((packed));
-
-struct ipw_channel_tx_power
-{
-	u8 channel_number;
-	s8 tx_power;
-} __attribute__ ((packed));
-
-#define SCAN_ASSOCIATED_INTERVAL (HZ)
-#define SCAN_INTERVAL (HZ / 10)
-#define MAX_A_CHANNELS  37
-#define MAX_B_CHANNELS  14
-
-struct ipw_tx_power
-{
-	u8 num_channels;
-	u8 ieee_mode;
-	struct ipw_channel_tx_power channels_tx_power[MAX_A_CHANNELS];
-} __attribute__ ((packed));
-
-struct ipw_qos_parameters
-{
-	u16 cw_min[4];
-	u16 cw_max[4];
-	u8 aifs[4];
-	u8 flag[4];
-	u16 tx_op_limit[4];
-} __attribute__ ((packed));
-
-struct ipw_rsn_capabilities
-{
-	u8 id;
-	u8 length;
-	u16 version;
-} __attribute__ ((packed));
-
-struct ipw_sensitivity_calib
-{
-	u16 beacon_rssi_raw;
-	u16 reserved;
-} __attribute__ ((packed));
-
-/**
- * Host command structure.
- *
- * On input, the following fields should be filled:
- * - cmd
- * - len
- * - status_len
- * - param (if needed)
- *
- * On output,
- * - \a status contains status;
- * - \a param filled with status parameters.
- */
-struct ipw_cmd {
-  u32 cmd;         /**< Host command */
-  u32 status;      /**< Status */
-  u32 status_len;  /**< How many 32 bit parameters in the status */
-  u32 len;         /**< incoming parameters length, bytes */
-  /**
-   * command parameters.
-   * There should be enough space for incoming and
-   * outcoming parameters.
-   * Incoming parameters listed 1-st, followed by outcoming params.
-   * nParams=(len+3)/4+status_len
-   */
-  u32 param[0];
-} __attribute__ ((packed));
-
-#define STATUS_HCMD_ACTIVE      (1<<0)  /**< host command in progress */
-
-#define STATUS_INT_ENABLED      (1<<1)
-#define STATUS_RF_KILL_HW       (1<<2)
-#define STATUS_RF_KILL_SW       (1<<3)
-#define STATUS_RF_KILL_MASK     (STATUS_RF_KILL_HW | STATUS_RF_KILL_SW)
-
-#define STATUS_INIT             (1<<5)
-#define STATUS_AUTH             (1<<6)
-#define STATUS_ASSOCIATED       (1<<7)
-#define STATUS_STATE_MASK       (STATUS_INIT | STATUS_AUTH | STATUS_ASSOCIATED)
-
-#define STATUS_ASSOCIATING      (1<<8)
-#define STATUS_DISASSOCIATING   (1<<9)
-#define STATUS_ROAMING          (1<<10)
-#define STATUS_EXIT_PENDING     (1<<11)
-#define STATUS_DISASSOC_PENDING (1<<12)
-#define STATUS_STATE_PENDING    (1<<13)
-
-#define STATUS_SCAN_PENDING     (1<<20)
-#define STATUS_SCANNING         (1<<21)
-#define STATUS_SCAN_ABORTING    (1<<22)
-
-#define STATUS_INDIRECT_BYTE    (1<<28) /* sysfs entry configured for access */
-#define STATUS_INDIRECT_DWORD   (1<<29) /* sysfs entry configured for access */
-#define STATUS_DIRECT_DWORD     (1<<30) /* sysfs entry configured for access */
-
-#define STATUS_SECURITY_UPDATED (1<<31) /* Security sync needed */
-
-#define CFG_STATIC_CHANNEL      (1<<0) /* Restrict assoc. to single channel */
-#define CFG_STATIC_ESSID        (1<<1) /* Restrict assoc. to single SSID */
-#define CFG_STATIC_BSSID        (1<<2) /* Restrict assoc. to single BSSID */
-#define CFG_CUSTOM_MAC          (1<<3)
-#define CFG_PREAMBLE            (1<<4)
-#define CFG_ADHOC_PERSIST       (1<<5)
-#define CFG_ASSOCIATE           (1<<6)
-#define CFG_FIXED_RATE          (1<<7)
-#define CFG_ADHOC_CREATE        (1<<8)
-
-#define CAP_SHARED_KEY          (1<<0) /* Off = OPEN */
-#define CAP_PRIVACY_ON          (1<<1) /* Off = No privacy */
-
-#define MAX_STATIONS            32
-#define IPW_INVALID_STATION     (0xff)
-
-struct ipw_station_entry {
-	u8 mac_addr[ETH_ALEN];
-	u8 reserved;
-	u8 support_mode;
-};
-
-#define AVG_ENTRIES 8
-struct average {
-	s16 entries[AVG_ENTRIES];
-	u8 pos;
-	u8 init;
-	s32 sum;
-};
-
-struct ipw_priv {
-	/* ieee device used by generic ieee processing code */
-	struct ieee80211_device *ieee;
-	struct ieee80211_security sec;
-
-	/* spinlock */
-	spinlock_t lock;
-
-	/* basic pci-network driver stuff */
-	struct pci_dev *pci_dev;
-	struct net_device *net_dev;
-
-	/* pci hardware address support */
-	void __iomem *hw_base;
-	unsigned long hw_len;
-
-	struct fw_image_desc sram_desc;
-
-	/* result of ucode download */
-	struct alive_command_responce dino_alive;
-
-  	wait_queue_head_t wait_command_queue;
-  	wait_queue_head_t wait_state;
-
-	/* Rx and Tx DMA processing queues */
-	struct ipw_rx_queue *rxq;
-	struct clx2_tx_queue txq_cmd;
-	struct clx2_tx_queue txq[4];
-	u32 status;
-	u32 config;
-	u32 capability;
-
-	u8 last_rx_rssi;
-	u8 last_noise;
-	struct average average_missed_beacons;
-	struct average average_rssi;
-	struct average average_noise;
-	u32 port_type;
-	int rx_bufs_min;          /**< minimum number of bufs in Rx queue */
-	int rx_pend_max;          /**< maximum pending buffers for one IRQ */
-	u32 hcmd_seq;             /**< sequence number for hcmd */
-	u32 missed_beacon_threshold;
-	u32 roaming_threshold;
-
-	struct ipw_associate assoc_request;
-	struct ieee80211_network *assoc_network;
-
-	unsigned long ts_scan_abort;
-	struct ipw_supported_rates rates;
-	struct ipw_rates phy[3];           /**< PHY restrictions, per band */
-	struct ipw_rates supp;             /**< software defined */
-	struct ipw_rates extended;         /**< use for corresp. IE, AP only */
-
-	struct notif_link_deterioration last_link_deterioration; /** for statistics */
-	struct ipw_cmd* hcmd; /**< host command currently executed */
-
-	wait_queue_head_t hcmd_wq;     /**< host command waits for execution */
-	u32 tsf_bcn[2];              /**< TSF from latest beacon */
-
-	struct notif_calibration calib; /**< last calibration */
-
-	/* ordinal interface with firmware */
-	u32 table0_addr;
-	u32 table0_len;
-	u32 table1_addr;
-	u32 table1_len;
-	u32 table2_addr;
-	u32 table2_len;
-
-	/* context information */
-	u8 essid[IW_ESSID_MAX_SIZE];
-	u8 essid_len;
-	u8 nick[IW_ESSID_MAX_SIZE];
-	u16 rates_mask;
-	u8 channel;
-	struct ipw_sys_config sys_config;
-	u32 power_mode;
-	u8 bssid[ETH_ALEN];
-	u16 rts_threshold;
-	u8 mac_addr[ETH_ALEN];
-	u8 num_stations;
-	u8 stations[MAX_STATIONS][ETH_ALEN];
-
-	u32 notif_missed_beacons;
-
-	/* Statistics and counters normalized with each association */
-	u32 last_missed_beacons;
-	u32 last_tx_packets;
-	u32 last_rx_packets;
-	u32 last_tx_failures;
-	u32 last_rx_err;
-	u32 last_rate;
-
-	u32 missed_adhoc_beacons;
-	u32 missed_beacons;
-	u32 rx_packets;
-	u32 tx_packets;
-	u32 quality;
-
-        /* eeprom */
-	u8 eeprom[0x100];  /* 256 bytes of eeprom */
-	int eeprom_delay;
-
-	struct iw_statistics wstats;
-
-	struct workqueue_struct *workqueue;
-
-	struct work_struct adhoc_check;
-	struct work_struct associate;
-	struct work_struct disassociate;
-	struct work_struct rx_replenish;
-	struct work_struct request_scan;
-	struct work_struct adapter_restart;
-	struct work_struct rf_kill;
-	struct work_struct up;
-	struct work_struct down;
-	struct work_struct gather_stats;
-	struct work_struct abort_scan;
-	struct work_struct roam;
-	struct work_struct scan_check;
-
-	struct tasklet_struct irq_tasklet;
-
-
-#define IPW_2200BG  1
-#define IPW_2915ABG 2
-	u8 adapter;
-
-#define IPW_DEFAULT_TX_POWER 0x14
-	u8 tx_power;
-
-#ifdef CONFIG_PM
-	u32 pm_state[16];
-#endif
-
-	/* network state */
-
-	/* Used to pass the current INTA value from ISR to Tasklet */
-	u32 isr_inta;
-
-	/* debugging info */
-	u32 indirect_dword;
-	u32 direct_dword;
-	u32 indirect_byte;
-};				/*ipw_priv */
-
-
-/* debug macros */
-
-#ifdef CONFIG_IPW_DEBUG
-#define IPW_DEBUG(level, fmt, args...) \
-do { if (ipw_debug_level & (level)) \
-  printk(KERN_DEBUG DRV_NAME": %c %s " fmt, \
-         in_interrupt() ? 'I' : 'U', __FUNCTION__ , ## args); } while (0)
-#else
-#define IPW_DEBUG(level, fmt, args...) do {} while (0)
-#endif				/* CONFIG_IPW_DEBUG */
-
-/*
- * To use the debug system;
- *
- * If you are defining a new debug classification, simply add it to the #define
- * list here in the form of:
- *
- * #define IPW_DL_xxxx VALUE
- *
- * shifting value to the left one bit from the previous entry.  xxxx should be
- * the name of the classification (for example, WEP)
- *
- * You then need to either add a IPW_xxxx_DEBUG() macro definition for your
- * classification, or use IPW_DEBUG(IPW_DL_xxxx, ...) whenever you want
- * to send output to that classification.
- *
- * To add your debug level to the list of levels seen when you perform
- *
- * % cat /proc/net/ipw/debug_level
- *
- * you simply need to add your entry to the ipw_debug_levels array.
- *
- * If you do not see debug_level in /proc/net/ipw then you do not have
- * CONFIG_IPW_DEBUG defined in your kernel configuration
- *
- */
-
-#define IPW_DL_ERROR         (1<<0)
-#define IPW_DL_WARNING       (1<<1)
-#define IPW_DL_INFO          (1<<2)
-#define IPW_DL_WX            (1<<3)
-#define IPW_DL_HOST_COMMAND  (1<<5)
-#define IPW_DL_STATE         (1<<6)
-
-#define IPW_DL_NOTIF         (1<<10)
-#define IPW_DL_SCAN          (1<<11)
-#define IPW_DL_ASSOC         (1<<12)
-#define IPW_DL_DROP          (1<<13)
-#define IPW_DL_IOCTL         (1<<14)
-
-#define IPW_DL_MANAGE        (1<<15)
-#define IPW_DL_FW            (1<<16)
-#define IPW_DL_RF_KILL       (1<<17)
-#define IPW_DL_FW_ERRORS     (1<<18)
-
-
-#define IPW_DL_ORD           (1<<20)
-
-#define IPW_DL_FRAG          (1<<21)
-#define IPW_DL_WEP           (1<<22)
-#define IPW_DL_TX            (1<<23)
-#define IPW_DL_RX            (1<<24)
-#define IPW_DL_ISR           (1<<25)
-#define IPW_DL_FW_INFO       (1<<26)
-#define IPW_DL_IO            (1<<27)
-#define IPW_DL_TRACE         (1<<28)
-
-#define IPW_DL_STATS         (1<<29)
-
-
-#define IPW_ERROR(f, a...) printk(KERN_ERR DRV_NAME ": " f, ## a)
-#define IPW_WARNING(f, a...) printk(KERN_WARNING DRV_NAME ": " f, ## a)
-#define IPW_DEBUG_INFO(f, a...)    IPW_DEBUG(IPW_DL_INFO, f, ## a)
-
-#define IPW_DEBUG_WX(f, a...)     IPW_DEBUG(IPW_DL_WX, f, ## a)
-#define IPW_DEBUG_SCAN(f, a...)   IPW_DEBUG(IPW_DL_SCAN, f, ## a)
-#define IPW_DEBUG_STATUS(f, a...) IPW_DEBUG(IPW_DL_STATUS, f, ## a)
-#define IPW_DEBUG_TRACE(f, a...)  IPW_DEBUG(IPW_DL_TRACE, f, ## a)
-#define IPW_DEBUG_RX(f, a...)     IPW_DEBUG(IPW_DL_RX, f, ## a)
-#define IPW_DEBUG_TX(f, a...)     IPW_DEBUG(IPW_DL_TX, f, ## a)
-#define IPW_DEBUG_ISR(f, a...)    IPW_DEBUG(IPW_DL_ISR, f, ## a)
-#define IPW_DEBUG_MANAGEMENT(f, a...) IPW_DEBUG(IPW_DL_MANAGE, f, ## a)
-#define IPW_DEBUG_WEP(f, a...)    IPW_DEBUG(IPW_DL_WEP, f, ## a)
-#define IPW_DEBUG_HC(f, a...) IPW_DEBUG(IPW_DL_HOST_COMMAND, f, ## a)
-#define IPW_DEBUG_FRAG(f, a...) IPW_DEBUG(IPW_DL_FRAG, f, ## a)
-#define IPW_DEBUG_FW(f, a...) IPW_DEBUG(IPW_DL_FW, f, ## a)
-#define IPW_DEBUG_RF_KILL(f, a...) IPW_DEBUG(IPW_DL_RF_KILL, f, ## a)
-#define IPW_DEBUG_DROP(f, a...) IPW_DEBUG(IPW_DL_DROP, f, ## a)
-#define IPW_DEBUG_IO(f, a...) IPW_DEBUG(IPW_DL_IO, f, ## a)
-#define IPW_DEBUG_ORD(f, a...) IPW_DEBUG(IPW_DL_ORD, f, ## a)
-#define IPW_DEBUG_FW_INFO(f, a...) IPW_DEBUG(IPW_DL_FW_INFO, f, ## a)
-#define IPW_DEBUG_NOTIF(f, a...) IPW_DEBUG(IPW_DL_NOTIF, f, ## a)
-#define IPW_DEBUG_STATE(f, a...) IPW_DEBUG(IPW_DL_STATE | IPW_DL_ASSOC | IPW_DL_INFO, f, ## a)
-#define IPW_DEBUG_ASSOC(f, a...) IPW_DEBUG(IPW_DL_ASSOC | IPW_DL_INFO, f, ## a)
-#define IPW_DEBUG_STATS(f, a...) IPW_DEBUG(IPW_DL_STATS, f, ## a)
-
-#include <linux/ctype.h>
-
-/*
-* Register bit definitions
-*/
-
-/* Dino control registers bits */
-
-#define DINO_ENABLE_SYSTEM 0x80
-#define DINO_ENABLE_CS     0x40
-#define DINO_RXFIFO_DATA   0x01
-#define DINO_CONTROL_REG   0x00200000
-
-#define CX2_INTA_RW       0x00000008
-#define CX2_INTA_MASK_R   0x0000000C
-#define CX2_INDIRECT_ADDR 0x00000010
-#define CX2_INDIRECT_DATA 0x00000014
-#define CX2_AUTOINC_ADDR  0x00000018
-#define CX2_AUTOINC_DATA  0x0000001C
-#define CX2_RESET_REG     0x00000020
-#define CX2_GP_CNTRL_RW   0x00000024
-
-#define CX2_READ_INT_REGISTER 0xFF4
-
-#define CX2_GP_CNTRL_BIT_INIT_DONE	0x00000004
-
-#define CX2_REGISTER_DOMAIN1_END        0x00001000
-#define CX2_SRAM_READ_INT_REGISTER 	0x00000ff4
-
-#define CX2_SHARED_LOWER_BOUND          0x00000200
-#define CX2_INTERRUPT_AREA_LOWER_BOUND  0x00000f80
-
-#define CX2_NIC_SRAM_LOWER_BOUND        0x00000000
-#define CX2_NIC_SRAM_UPPER_BOUND        0x00030000
-
-#define CX2_BIT_INT_HOST_SRAM_READ_INT_REGISTER (1 << 29)
-#define CX2_GP_CNTRL_BIT_CLOCK_READY    0x00000001
-#define CX2_GP_CNTRL_BIT_HOST_ALLOWS_STANDBY 0x00000002
-
-/*
- * RESET Register Bit Indexes
- */
-#define CBD_RESET_REG_PRINCETON_RESET 0x00000001  /* Bit 0 (LSB) */
-#define CX2_RESET_REG_SW_RESET        0x00000080  /* Bit 7       */
-#define CX2_RESET_REG_MASTER_DISABLED 0x00000100  /* Bit 8       */
-#define CX2_RESET_REG_STOP_MASTER     0x00000200  /* Bit 9       */
-#define CX2_ARC_KESHET_CONFIG         0x08000000  /* Bit 27      */
-#define CX2_START_STANDBY             0x00000004  /* Bit 2       */
-
-#define CX2_CSR_CIS_UPPER_BOUND	0x00000200
-#define CX2_DOMAIN_0_END 0x1000
-#define CLX_MEM_BAR_SIZE 0x1000
-
-#define CX2_BASEBAND_CONTROL_STATUS	0X00200000
-#define CX2_BASEBAND_TX_FIFO_WRITE	0X00200004
-#define CX2_BASEBAND_RX_FIFO_READ	0X00200004
-#define CX2_BASEBAND_CONTROL_STORE	0X00200010
-
-#define CX2_INTERNAL_CMD_EVENT 	0X00300004
-#define CX2_BASEBAND_POWER_DOWN 0x00000001
-
-#define CX2_MEM_HALT_AND_RESET  0x003000e0
-
-/* defgroup bits_halt_reset MEM_HALT_AND_RESET register bits */
-#define CX2_BIT_HALT_RESET_ON	0x80000000
-#define CX2_BIT_HALT_RESET_OFF 	0x00000000
-
-#define CB_LAST_VALID     0x20000000
-#define CB_INT_ENABLED    0x40000000
-#define CB_VALID          0x80000000
-#define CB_SRC_LE         0x08000000
-#define CB_DEST_LE        0x04000000
-#define CB_SRC_AUTOINC    0x00800000
-#define CB_SRC_IO_GATED   0x00400000
-#define CB_DEST_AUTOINC   0x00080000
-#define CB_SRC_SIZE_LONG  0x00200000
-#define CB_DEST_SIZE_LONG 0x00020000
-
-
-/* DMA DEFINES */
-
-#define DMA_CONTROL_SMALL_CB_CONST_VALUE 0x00540000
-#define DMA_CB_STOP_AND_ABORT            0x00000C00
-#define DMA_CB_START                     0x00000100
-
-
-#define CX2_SHARED_SRAM_SIZE               0x00030000
-#define CX2_SHARED_SRAM_DMA_CONTROL        0x00027000
-#define CB_MAX_LENGTH                      0x1FFF
-
-#define CX2_HOST_EEPROM_DATA_SRAM_SIZE 0xA18
-#define CX2_EEPROM_IMAGE_SIZE          0x100
-
-
-/* DMA defs */
-#define CX2_DMA_I_CURRENT_CB  0x003000D0
-#define CX2_DMA_O_CURRENT_CB  0x003000D4
-#define CX2_DMA_I_DMA_CONTROL 0x003000A4
-#define CX2_DMA_I_CB_BASE     0x003000A0
-
-#define CX2_TX_CMD_QUEUE_BD_BASE        (0x00000200)
-#define CX2_TX_CMD_QUEUE_BD_SIZE        (0x00000204)
-#define CX2_TX_QUEUE_0_BD_BASE          (0x00000208)
-#define CX2_TX_QUEUE_0_BD_SIZE          (0x0000020C)
-#define CX2_TX_QUEUE_1_BD_BASE          (0x00000210)
-#define CX2_TX_QUEUE_1_BD_SIZE          (0x00000214)
-#define CX2_TX_QUEUE_2_BD_BASE          (0x00000218)
-#define CX2_TX_QUEUE_2_BD_SIZE          (0x0000021C)
-#define CX2_TX_QUEUE_3_BD_BASE          (0x00000220)
-#define CX2_TX_QUEUE_3_BD_SIZE          (0x00000224)
-#define CX2_RX_BD_BASE                  (0x00000240)
-#define CX2_RX_BD_SIZE                  (0x00000244)
-#define CX2_RFDS_TABLE_LOWER            (0x00000500)
-
-#define CX2_TX_CMD_QUEUE_READ_INDEX     (0x00000280)
-#define CX2_TX_QUEUE_0_READ_INDEX       (0x00000284)
-#define CX2_TX_QUEUE_1_READ_INDEX       (0x00000288)
-#define CX2_TX_QUEUE_2_READ_INDEX       (0x0000028C)
-#define CX2_TX_QUEUE_3_READ_INDEX       (0x00000290)
-#define CX2_RX_READ_INDEX               (0x000002A0)
-
-#define CX2_TX_CMD_QUEUE_WRITE_INDEX    (0x00000F80)
-#define CX2_TX_QUEUE_0_WRITE_INDEX      (0x00000F84)
-#define CX2_TX_QUEUE_1_WRITE_INDEX      (0x00000F88)
-#define CX2_TX_QUEUE_2_WRITE_INDEX      (0x00000F8C)
-#define CX2_TX_QUEUE_3_WRITE_INDEX      (0x00000F90)
-#define CX2_RX_WRITE_INDEX              (0x00000FA0)
-
-/*
- * EEPROM Related Definitions
- */
-
-#define IPW_EEPROM_DATA_SRAM_ADDRESS (CX2_SHARED_LOWER_BOUND + 0x814)
-#define IPW_EEPROM_DATA_SRAM_SIZE    (CX2_SHARED_LOWER_BOUND + 0x818)
-#define IPW_EEPROM_LOAD_DISABLE      (CX2_SHARED_LOWER_BOUND + 0x81C)
-#define IPW_EEPROM_DATA              (CX2_SHARED_LOWER_BOUND + 0x820)
-#define IPW_EEPROM_UPPER_ADDRESS     (CX2_SHARED_LOWER_BOUND + 0x9E0)
-
-#define IPW_STATION_TABLE_LOWER      (CX2_SHARED_LOWER_BOUND + 0xA0C)
-#define IPW_STATION_TABLE_UPPER      (CX2_SHARED_LOWER_BOUND + 0xB0C)
-#define IPW_REQUEST_ATIM             (CX2_SHARED_LOWER_BOUND + 0xB0C)
-#define IPW_ATIM_SENT                (CX2_SHARED_LOWER_BOUND + 0xB10)
-#define IPW_WHO_IS_AWAKE             (CX2_SHARED_LOWER_BOUND + 0xB14)
-#define IPW_DURING_ATIM_WINDOW       (CX2_SHARED_LOWER_BOUND + 0xB18)
-
-
-#define MSB                             1
-#define LSB                             0
-#define WORD_TO_BYTE(_word)             ((_word) * sizeof(u16))
-
-#define GET_EEPROM_ADDR(_wordoffset,_byteoffset) \
-    ( WORD_TO_BYTE(_wordoffset) + (_byteoffset) )
-
-/* EEPROM access by BYTE */
-#define EEPROM_PME_CAPABILITY   (GET_EEPROM_ADDR(0x09,MSB))     /* 1 byte   */
-#define EEPROM_MAC_ADDRESS      (GET_EEPROM_ADDR(0x21,LSB))     /* 6 byte   */
-#define EEPROM_VERSION          (GET_EEPROM_ADDR(0x24,MSB))     /* 1 byte   */
-#define EEPROM_NIC_TYPE         (GET_EEPROM_ADDR(0x25,LSB))     /* 1 byte   */
-#define EEPROM_SKU_CAPABILITY   (GET_EEPROM_ADDR(0x25,MSB))     /* 1 byte   */
-#define EEPROM_COUNTRY_CODE     (GET_EEPROM_ADDR(0x26,LSB))     /* 3 bytes  */
-#define EEPROM_IBSS_CHANNELS_BG (GET_EEPROM_ADDR(0x28,LSB))     /* 2 bytes  */
-#define EEPROM_IBSS_CHANNELS_A  (GET_EEPROM_ADDR(0x29,MSB))     /* 5 bytes  */
-#define EEPROM_BSS_CHANNELS_BG  (GET_EEPROM_ADDR(0x2c,LSB))     /* 2 bytes  */
-#define EEPROM_HW_VERSION       (GET_EEPROM_ADDR(0x72,LSB))     /* 2 bytes  */
-
-/* NIC type as found in the one byte EEPROM_NIC_TYPE  offset*/
-#define EEPROM_NIC_TYPE_STANDARD        0
-#define EEPROM_NIC_TYPE_DELL            1
-#define EEPROM_NIC_TYPE_FUJITSU         2
-#define EEPROM_NIC_TYPE_IBM             3
-#define EEPROM_NIC_TYPE_HP              4
-
-#define FW_MEM_REG_LOWER_BOUND          0x00300000
-#define FW_MEM_REG_EEPROM_ACCESS        (FW_MEM_REG_LOWER_BOUND + 0x40)
-
-#define EEPROM_BIT_SK                   (1<<0)
-#define EEPROM_BIT_CS                   (1<<1)
-#define EEPROM_BIT_DI                   (1<<2)
-#define EEPROM_BIT_DO                   (1<<4)
-
-#define EEPROM_CMD_READ                 0x2
-
-/* Interrupts masks */
-#define CX2_INTA_NONE   0x00000000
-
-#define CX2_INTA_BIT_RX_TRANSFER                   0x00000002
-#define CX2_INTA_BIT_STATUS_CHANGE                 0x00000010
-#define CX2_INTA_BIT_BEACON_PERIOD_EXPIRED         0x00000020
-
-//Inta Bits for CF
-#define CX2_INTA_BIT_TX_CMD_QUEUE                  0x00000800
-#define CX2_INTA_BIT_TX_QUEUE_1                    0x00001000
-#define CX2_INTA_BIT_TX_QUEUE_2                    0x00002000
-#define CX2_INTA_BIT_TX_QUEUE_3                    0x00004000
-#define CX2_INTA_BIT_TX_QUEUE_4                    0x00008000
-
-#define CX2_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE      0x00010000
-
-#define CX2_INTA_BIT_PREPARE_FOR_POWER_DOWN        0x00100000
-#define CX2_INTA_BIT_POWER_DOWN                    0x00200000
-
-#define CX2_INTA_BIT_FW_INITIALIZATION_DONE        0x01000000
-#define CX2_INTA_BIT_FW_CARD_DISABLE_PHY_OFF_DONE  0x02000000
-#define CX2_INTA_BIT_RF_KILL_DONE                  0x04000000
-#define CX2_INTA_BIT_FATAL_ERROR             0x40000000
-#define CX2_INTA_BIT_PARITY_ERROR            0x80000000
-
-/* Interrupts enabled at init time. */
-#define CX2_INTA_MASK_ALL                        \
-        (CX2_INTA_BIT_TX_QUEUE_1               | \
-	 CX2_INTA_BIT_TX_QUEUE_2               | \
-	 CX2_INTA_BIT_TX_QUEUE_3               | \
-	 CX2_INTA_BIT_TX_QUEUE_4               | \
-	 CX2_INTA_BIT_TX_CMD_QUEUE             | \
-	 CX2_INTA_BIT_RX_TRANSFER              | \
-	 CX2_INTA_BIT_FATAL_ERROR              | \
-	 CX2_INTA_BIT_PARITY_ERROR             | \
-	 CX2_INTA_BIT_STATUS_CHANGE            | \
-	 CX2_INTA_BIT_FW_INITIALIZATION_DONE   | \
-	 CX2_INTA_BIT_BEACON_PERIOD_EXPIRED    | \
-	 CX2_INTA_BIT_SLAVE_MODE_HOST_CMD_DONE | \
-	 CX2_INTA_BIT_PREPARE_FOR_POWER_DOWN   | \
-	 CX2_INTA_BIT_POWER_DOWN               | \
-         CX2_INTA_BIT_RF_KILL_DONE )
-
-#define IPWSTATUS_ERROR_LOG     (CX2_SHARED_LOWER_BOUND + 0x410)
-#define IPW_EVENT_LOG     (CX2_SHARED_LOWER_BOUND + 0x414)
-
-/* FW event log definitions */
-#define EVENT_ELEM_SIZE     (3 * sizeof(u32))
-#define EVENT_START_OFFSET  (1 * sizeof(u32) + 2 * sizeof(u16))
-
-/* FW error log definitions */
-#define ERROR_ELEM_SIZE     (7 * sizeof(u32))
-#define ERROR_START_OFFSET  (1 * sizeof(u32))
-
-enum {
-	IPW_FW_ERROR_OK = 0,
-	IPW_FW_ERROR_FAIL,
-	IPW_FW_ERROR_MEMORY_UNDERFLOW,
-	IPW_FW_ERROR_MEMORY_OVERFLOW,
-	IPW_FW_ERROR_BAD_PARAM,
-	IPW_FW_ERROR_BAD_CHECKSUM,
-	IPW_FW_ERROR_NMI_INTERRUPT,
-	IPW_FW_ERROR_BAD_DATABASE,
-	IPW_FW_ERROR_ALLOC_FAIL,
-	IPW_FW_ERROR_DMA_UNDERRUN,
-	IPW_FW_ERROR_DMA_STATUS,
-	IPW_FW_ERROR_DINOSTATUS_ERROR,
-	IPW_FW_ERROR_EEPROMSTATUS_ERROR,
-	IPW_FW_ERROR_SYSASSERT,
-	IPW_FW_ERROR_FATAL_ERROR
-};
-
-#define AUTH_OPEN       0
-#define AUTH_SHARED_KEY 1
-#define AUTH_IGNORE     3
-
-#define HC_ASSOCIATE      0
-#define HC_REASSOCIATE    1
-#define HC_DISASSOCIATE   2
-#define HC_IBSS_START     3
-#define HC_IBSS_RECONF    4
-#define HC_DISASSOC_QUIET 5
-
-#define IPW_RATE_CAPABILITIES 1
-#define IPW_RATE_CONNECT      0
-
-
-/*
- * Rate values and masks
- */
-#define IPW_TX_RATE_1MB  0x0A
-#define IPW_TX_RATE_2MB  0x14
-#define IPW_TX_RATE_5MB  0x37
-#define IPW_TX_RATE_6MB  0x0D
-#define IPW_TX_RATE_9MB  0x0F
-#define IPW_TX_RATE_11MB 0x6E
-#define IPW_TX_RATE_12MB 0x05
-#define IPW_TX_RATE_18MB 0x07
-#define IPW_TX_RATE_24MB 0x09
-#define IPW_TX_RATE_36MB 0x0B
-#define IPW_TX_RATE_48MB 0x01
-#define IPW_TX_RATE_54MB 0x03
-
-#define IPW_ORD_TABLE_ID_MASK             0x0000FF00
-#define IPW_ORD_TABLE_VALUE_MASK          0x000000FF
-
-#define IPW_ORD_TABLE_0_MASK              0x0000F000
-#define IPW_ORD_TABLE_1_MASK              0x0000F100
-#define IPW_ORD_TABLE_2_MASK              0x0000F200
-#define IPW_ORD_TABLE_3_MASK              0x0000F300
-#define IPW_ORD_TABLE_4_MASK              0x0000F400
-#define IPW_ORD_TABLE_5_MASK              0x0000F500
-#define IPW_ORD_TABLE_6_MASK              0x0000F600
-#define IPW_ORD_TABLE_7_MASK              0x0000F700
-
-/*
- * Table 0 Entries (all entries are 32 bits)
- */
-enum {
-	IPW_ORD_STAT_TX_CURR_RATE = IPW_ORD_TABLE_0_MASK + 1,
-	IPW_ORD_STAT_FRAG_TRESHOLD,
-	IPW_ORD_STAT_RTS_THRESHOLD,
-	IPW_ORD_STAT_TX_HOST_REQUESTS,
-	IPW_ORD_STAT_TX_HOST_COMPLETE,
-	IPW_ORD_STAT_TX_DIR_DATA,
-	IPW_ORD_STAT_TX_DIR_DATA_B_1,
-	IPW_ORD_STAT_TX_DIR_DATA_B_2,
-	IPW_ORD_STAT_TX_DIR_DATA_B_5_5,
-	IPW_ORD_STAT_TX_DIR_DATA_B_11,
-	/* Hole */
-
-
-
-
-
-
-
-	IPW_ORD_STAT_TX_DIR_DATA_G_1 = IPW_ORD_TABLE_0_MASK + 19,
-	IPW_ORD_STAT_TX_DIR_DATA_G_2,
-	IPW_ORD_STAT_TX_DIR_DATA_G_5_5,
-	IPW_ORD_STAT_TX_DIR_DATA_G_6,
-	IPW_ORD_STAT_TX_DIR_DATA_G_9,
-	IPW_ORD_STAT_TX_DIR_DATA_G_11,
-	IPW_ORD_STAT_TX_DIR_DATA_G_12,
-	IPW_ORD_STAT_TX_DIR_DATA_G_18,
-	IPW_ORD_STAT_TX_DIR_DATA_G_24,
-	IPW_ORD_STAT_TX_DIR_DATA_G_36,
-	IPW_ORD_STAT_TX_DIR_DATA_G_48,
-	IPW_ORD_STAT_TX_DIR_DATA_G_54,
-	IPW_ORD_STAT_TX_NON_DIR_DATA,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_B_1,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_B_2,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_B_5_5,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_B_11,
-	/* Hole */
-
-
-
-
-
-
-
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_1 = IPW_ORD_TABLE_0_MASK + 44,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_2,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_5_5,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_6,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_9,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_11,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_12,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_18,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_24,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_36,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_48,
-	IPW_ORD_STAT_TX_NON_DIR_DATA_G_54,
-	IPW_ORD_STAT_TX_RETRY,
-	IPW_ORD_STAT_TX_FAILURE,
-	IPW_ORD_STAT_RX_ERR_CRC,
-	IPW_ORD_STAT_RX_ERR_ICV,
-	IPW_ORD_STAT_RX_NO_BUFFER,
-	IPW_ORD_STAT_FULL_SCANS,
-	IPW_ORD_STAT_PARTIAL_SCANS,
-	IPW_ORD_STAT_TGH_ABORTED_SCANS,
-	IPW_ORD_STAT_TX_TOTAL_BYTES,
-	IPW_ORD_STAT_CURR_RSSI_RAW,
-	IPW_ORD_STAT_RX_BEACON,
-	IPW_ORD_STAT_MISSED_BEACONS,
-	IPW_ORD_TABLE_0_LAST
-};
-
-#define IPW_RSSI_TO_DBM 112
-
-/* Table 1 Entries
- */
-enum {
-	IPW_ORD_TABLE_1_LAST = IPW_ORD_TABLE_1_MASK | 1,
-};
-
-/*
- * Table 2 Entries
- *
- * FW_VERSION:    16 byte string
- * FW_DATE:       16 byte string (only 14 bytes used)
- * UCODE_VERSION: 4 byte version code
- * UCODE_DATE:    5 bytes code code
- * ADDAPTER_MAC:  6 byte MAC address
- * RTC:           4 byte clock
- */
-enum {
-	IPW_ORD_STAT_FW_VERSION = IPW_ORD_TABLE_2_MASK | 1,
-	IPW_ORD_STAT_FW_DATE,
-	IPW_ORD_STAT_UCODE_VERSION,
-	IPW_ORD_STAT_UCODE_DATE,
-	IPW_ORD_STAT_ADAPTER_MAC,
-	IPW_ORD_STAT_RTC,
-	IPW_ORD_TABLE_2_LAST
-};
-
-/* Table 3 */
-enum {
-	IPW_ORD_STAT_TX_PACKET = IPW_ORD_TABLE_3_MASK | 0,
-	IPW_ORD_STAT_TX_PACKET_FAILURE,
-	IPW_ORD_STAT_TX_PACKET_SUCCESS,
-	IPW_ORD_STAT_TX_PACKET_ABORTED,
-	IPW_ORD_TABLE_3_LAST
-};
-
-/* Table 4 */
-enum {
-	IPW_ORD_TABLE_4_LAST = IPW_ORD_TABLE_4_MASK
-};
-
-/* Table 5 */
-enum {
-	IPW_ORD_STAT_AVAILABLE_AP_COUNT = IPW_ORD_TABLE_5_MASK,
-	IPW_ORD_STAT_AP_ASSNS,
-	IPW_ORD_STAT_ROAM,
-	IPW_ORD_STAT_ROAM_CAUSE_MISSED_BEACONS,
-	IPW_ORD_STAT_ROAM_CAUSE_UNASSOC,
-	IPW_ORD_STAT_ROAM_CAUSE_RSSI,
-	IPW_ORD_STAT_ROAM_CAUSE_LINK_QUALITY,
-	IPW_ORD_STAT_ROAM_CAUSE_AP_LOAD_BALANCE,
-	IPW_ORD_STAT_ROAM_CAUSE_AP_NO_TX,
-	IPW_ORD_STAT_LINK_UP,
-	IPW_ORD_STAT_LINK_DOWN,
-	IPW_ORD_ANTENNA_DIVERSITY,
-	IPW_ORD_CURR_FREQ,
-	IPW_ORD_TABLE_5_LAST
-};
-
-/* Table 6 */
-enum {
-	IPW_ORD_COUNTRY_CODE = IPW_ORD_TABLE_6_MASK,
-	IPW_ORD_CURR_BSSID,
-	IPW_ORD_CURR_SSID,
-	IPW_ORD_TABLE_6_LAST
-};
-
-/* Table 7 */
-enum {
-	IPW_ORD_STAT_PERCENT_MISSED_BEACONS = IPW_ORD_TABLE_7_MASK,
-	IPW_ORD_STAT_PERCENT_TX_RETRIES,
-	IPW_ORD_STAT_PERCENT_LINK_QUALITY,
-	IPW_ORD_STAT_CURR_RSSI_DBM,
-	IPW_ORD_TABLE_7_LAST
-};
-
-#define IPW_ORDINALS_TABLE_LOWER        (CX2_SHARED_LOWER_BOUND + 0x500)
-#define IPW_ORDINALS_TABLE_0            (CX2_SHARED_LOWER_BOUND + 0x180)
-#define IPW_ORDINALS_TABLE_1            (CX2_SHARED_LOWER_BOUND + 0x184)
-#define IPW_ORDINALS_TABLE_2            (CX2_SHARED_LOWER_BOUND + 0x188)
-#define IPW_MEM_FIXED_OVERRIDE          (CX2_SHARED_LOWER_BOUND + 0x41C)
-
-struct ipw_fixed_rate {
-	u16 tx_rates;
-	u16 reserved;
-} __attribute__ ((packed));
-
-#define CX2_INDIRECT_ADDR_MASK (~0x3ul)
-
-struct host_cmd {
-	u8 cmd;
-	u8 len;
-	u16 reserved;
-	u32 param[TFD_CMD_IMMEDIATE_PAYLOAD_LENGTH];
-} __attribute__ ((packed));
-
-#define CFG_BT_COEXISTENCE_MIN                  0x00
-#define CFG_BT_COEXISTENCE_DEFER                0x02
-#define CFG_BT_COEXISTENCE_KILL                 0x04
-#define CFG_BT_COEXISTENCE_WME_OVER_BT          0x08
-#define CFG_BT_COEXISTENCE_OOB                  0x10
-#define CFG_BT_COEXISTENCE_MAX                  0xFF
-#define CFG_BT_COEXISTENCE_DEF                  0x80 /* read Bt from EEPROM*/
-
-#define CFG_CTS_TO_ITSELF_ENABLED_MIN	0x0
-#define CFG_CTS_TO_ITSELF_ENABLED_MAX	0x1
-#define CFG_CTS_TO_ITSELF_ENABLED_DEF	CFG_CTS_TO_ITSELF_ENABLED_MIN
-
-#define CFG_SYS_ANTENNA_BOTH                      0x000
-#define CFG_SYS_ANTENNA_A                         0x001
-#define CFG_SYS_ANTENNA_B                         0x003
-
-/*
- * The definitions below were lifted off the ipw2100 driver, which only
- * supports 'b' mode, so I'm sure these are not exactly correct.
- *
- * Somebody fix these!!
- */
-#define REG_MIN_CHANNEL             0
-#define REG_MAX_CHANNEL             14
-
-#define REG_CHANNEL_MASK            0x00003FFF
-#define IPW_IBSS_11B_DEFAULT_MASK   0x87ff
-
-static const long ipw_frequencies[] = {
-	2412, 2417, 2422, 2427,
-	2432, 2437, 2442, 2447,
-	2452, 2457, 2462, 2467,
-	2472, 2484
-};
-
-#define FREQ_COUNT ARRAY_SIZE(ipw_frequencies)
-
-#define IPW_MAX_CONFIG_RETRIES 10
-
-static inline u32 frame_hdr_len(struct ieee80211_hdr *hdr)
-{
-	u32 retval;
-	u16 fc;
-
-	retval = sizeof(struct ieee80211_hdr);
-	fc = le16_to_cpu(hdr->frame_ctl);
-
-	/*
-	 * Function	ToDS	FromDS
-	 * IBSS		0	0
-	 * To AP	1	0
-	 * From AP	0	1
-	 * WDS (bridge)	1	1
-	 *
-	 * Only WDS frames use Address4 among them. --YZ
-	 */
-	if (!(fc & IEEE80211_FCTL_TODS) || !(fc & IEEE80211_FCTL_FROMDS))
-		retval -= ETH_ALEN;
-
-	return retval;
-}
-
-#endif /* __ipw2200_h__ */
diff --git a/trunk/drivers/net/wireless/orinoco.c b/trunk/drivers/net/wireless/orinoco.c
index d7947358e49d..9c2d07cde010 100644
--- a/trunk/drivers/net/wireless/orinoco.c
+++ b/trunk/drivers/net/wireless/orinoco.c
@@ -94,8 +94,6 @@
 #include <net/iw_handler.h>
 #include <net/ieee80211.h>
 
-#include <net/ieee80211.h>
-
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/system.h>
@@ -103,6 +101,7 @@
 #include "hermes.h"
 #include "hermes_rid.h"
 #include "orinoco.h"
+#include "ieee802_11.h"
 
 /********************************************************************/
 /* Module information                                               */
@@ -151,7 +150,7 @@ static const u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
 #define ENCAPS_OVERHEAD		(sizeof(encaps_hdr) + 2)
 
 #define ORINOCO_MIN_MTU		256
-#define ORINOCO_MAX_MTU		(IEEE80211_DATA_LEN - ENCAPS_OVERHEAD)
+#define ORINOCO_MAX_MTU		(IEEE802_11_DATA_LEN - ENCAPS_OVERHEAD)
 
 #define SYMBOL_MAX_VER_LEN	(14)
 #define USER_BAP		0
@@ -443,7 +442,7 @@ static int orinoco_change_mtu(struct net_device *dev, int new_mtu)
 	if ( (new_mtu < ORINOCO_MIN_MTU) || (new_mtu > ORINOCO_MAX_MTU) )
 		return -EINVAL;
 
-	if ( (new_mtu + ENCAPS_OVERHEAD + IEEE80211_HLEN) >
+	if ( (new_mtu + ENCAPS_OVERHEAD + IEEE802_11_HLEN) >
 	     (priv->nicbuf_size - ETH_HLEN) )
 		return -EINVAL;
 
@@ -919,7 +918,7 @@ static void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw)
                    data. */
 		return;
 	}
-	if (length > IEEE80211_DATA_LEN) {
+	if (length > IEEE802_11_DATA_LEN) {
 		printk(KERN_WARNING "%s: Oversized frame received (%d bytes)\n",
 		       dev->name, length);
 		stats->rx_length_errors++;
@@ -2273,7 +2272,7 @@ static int orinoco_init(struct net_device *dev)
 
 	/* No need to lock, the hw_unavailable flag is already set in
 	 * alloc_orinocodev() */
-	priv->nicbuf_size = IEEE80211_FRAME_LEN + ETH_HLEN;
+	priv->nicbuf_size = IEEE802_11_FRAME_LEN + ETH_HLEN;
 
 	/* Initialize the firmware */
 	err = orinoco_reinit_firmware(dev);
diff --git a/trunk/drivers/net/wireless/strip.c b/trunk/drivers/net/wireless/strip.c
index 4b0acae22b0d..6c42b573a95a 100644
--- a/trunk/drivers/net/wireless/strip.c
+++ b/trunk/drivers/net/wireless/strip.c
@@ -209,7 +209,7 @@ enum {
 	NoStructure = 0,	/* Really old firmware */
 	StructuredMessages = 1,	/* Parsable AT response msgs */
 	ChecksummedMessages = 2	/* Parsable AT response msgs with checksums */
-};
+} FirmwareLevel;
 
 struct strip {
 	int magic;
diff --git a/trunk/drivers/net/wireless/wavelan_cs.c b/trunk/drivers/net/wireless/wavelan_cs.c
index 183c4732ef65..f6130a53b796 100644
--- a/trunk/drivers/net/wireless/wavelan_cs.c
+++ b/trunk/drivers/net/wireless/wavelan_cs.c
@@ -59,12 +59,6 @@
 /* Do *NOT* add other headers here, you are guaranteed to be wrong - Jean II */
 #include "wavelan_cs.p.h"		/* Private header */
 
-#ifdef WAVELAN_ROAMING
-static void wl_cell_expiry(unsigned long data);
-static void wl_del_wavepoint(wavepoint_history *wavepoint, struct net_local *lp);
-static void wv_nwid_filter(unsigned char mode, net_local *lp);
-#endif  /*  WAVELAN_ROAMING  */
-
 /************************* MISC SUBROUTINES **************************/
 /*
  * Subroutines which won't fit in one of the following category
@@ -506,9 +500,9 @@ fee_write(u_long	base,	/* i/o port of the card */
 
 #ifdef WAVELAN_ROAMING	/* Conditional compile, see wavelan_cs.h */
 
-static unsigned char WAVELAN_BEACON_ADDRESS[] = {0x09,0x00,0x0e,0x20,0x03,0x00};
+unsigned char WAVELAN_BEACON_ADDRESS[]= {0x09,0x00,0x0e,0x20,0x03,0x00};
   
-static void wv_roam_init(struct net_device *dev)
+void wv_roam_init(struct net_device *dev)
 {
   net_local  *lp= netdev_priv(dev);
 
@@ -537,7 +531,7 @@ static void wv_roam_init(struct net_device *dev)
   printk(KERN_DEBUG "WaveLAN: Roaming enabled on device %s\n",dev->name);
 }
  
-static void wv_roam_cleanup(struct net_device *dev)
+void wv_roam_cleanup(struct net_device *dev)
 {
   wavepoint_history *ptr,*old_ptr;
   net_local *lp= netdev_priv(dev);
@@ -556,7 +550,7 @@ static void wv_roam_cleanup(struct net_device *dev)
 }
 
 /* Enable/Disable NWID promiscuous mode on a given device */
-static void wv_nwid_filter(unsigned char mode, net_local *lp)
+void wv_nwid_filter(unsigned char mode, net_local *lp)
 {
   mm_t                  m;
   unsigned long         flags;
@@ -581,7 +575,7 @@ static void wv_nwid_filter(unsigned char mode, net_local *lp)
 }
 
 /* Find a record in the WavePoint table matching a given NWID */
-static wavepoint_history *wl_roam_check(unsigned short nwid, net_local *lp)
+wavepoint_history *wl_roam_check(unsigned short nwid, net_local *lp)
 {
   wavepoint_history	*ptr=lp->wavepoint_table.head;
   
@@ -594,7 +588,7 @@ static wavepoint_history *wl_roam_check(unsigned short nwid, net_local *lp)
 }
 
 /* Create a new wavepoint table entry */
-static wavepoint_history *wl_new_wavepoint(unsigned short nwid, unsigned char seq, net_local* lp)
+wavepoint_history *wl_new_wavepoint(unsigned short nwid, unsigned char seq, net_local* lp)
 {
   wavepoint_history *new_wavepoint;
 
@@ -630,7 +624,7 @@ static wavepoint_history *wl_new_wavepoint(unsigned short nwid, unsigned char se
 }
 
 /* Remove a wavepoint entry from WavePoint table */
-static void wl_del_wavepoint(wavepoint_history *wavepoint, struct net_local *lp)
+void wl_del_wavepoint(wavepoint_history *wavepoint, struct net_local *lp)
 {
   if(wavepoint==NULL)
     return;
@@ -652,7 +646,7 @@ static void wl_del_wavepoint(wavepoint_history *wavepoint, struct net_local *lp)
 }
 
 /* Timer callback function - checks WavePoint table for stale entries */ 
-static void wl_cell_expiry(unsigned long data)
+void wl_cell_expiry(unsigned long data)
 {
   net_local *lp=(net_local *)data;
   wavepoint_history *wavepoint=lp->wavepoint_table.head,*old_point;
@@ -692,7 +686,7 @@ static void wl_cell_expiry(unsigned long data)
 }
 
 /* Update SNR history of a wavepoint */
-static void wl_update_history(wavepoint_history *wavepoint, unsigned char sigqual, unsigned char seq)	
+void wl_update_history(wavepoint_history *wavepoint, unsigned char sigqual, unsigned char seq)	
 {
   int i=0,num_missed=0,ptr=0;
   int average_fast=0,average_slow=0;
@@ -729,7 +723,7 @@ static void wl_update_history(wavepoint_history *wavepoint, unsigned char sigqua
 }
 
 /* Perform a handover to a new WavePoint */
-static void wv_roam_handover(wavepoint_history *wavepoint, net_local *lp)
+void wv_roam_handover(wavepoint_history *wavepoint, net_local *lp)
 {
   kio_addr_t		base = lp->dev->base_addr;
   mm_t                  m;
diff --git a/trunk/drivers/net/wireless/wavelan_cs.h b/trunk/drivers/net/wireless/wavelan_cs.h
index fabc63ee153c..29cff6daf860 100644
--- a/trunk/drivers/net/wireless/wavelan_cs.h
+++ b/trunk/drivers/net/wireless/wavelan_cs.h
@@ -62,7 +62,7 @@
  * like DEC RoamAbout, or Digital Ocean, Epson, ...), you must modify this
  * part to accommodate your hardware...
  */
-static const unsigned char	MAC_ADDRESSES[][3] =
+const unsigned char	MAC_ADDRESSES[][3] =
 {
   { 0x08, 0x00, 0x0E },		/* AT&T Wavelan (standard) & DEC RoamAbout */
   { 0x08, 0x00, 0x6A },		/* AT&T Wavelan (alternate) */
@@ -79,14 +79,14 @@ static const unsigned char	MAC_ADDRESSES[][3] =
  * (as read in the offset register of the dac area).
  * Used to map channel numbers used by `wfreqsel' to frequencies
  */
-static const short	channel_bands[] = { 0x30, 0x58, 0x64, 0x7A, 0x80, 0xA8,
+const short	channel_bands[] = { 0x30, 0x58, 0x64, 0x7A, 0x80, 0xA8,
 				    0xD0, 0xF0, 0xF8, 0x150 };
 
 /* Frequencies of the 1.0 modem (fixed frequencies).
  * Use to map the PSA `subband' to a frequency
  * Note : all frequencies apart from the first one need to be multiplied by 10
  */
-static const int	fixed_bands[] = { 915e6, 2.425e8, 2.46e8, 2.484e8, 2.4305e8 };
+const int	fixed_bands[] = { 915e6, 2.425e8, 2.46e8, 2.484e8, 2.4305e8 };
 
 
 /*************************** PC INTERFACE ****************************/
diff --git a/trunk/drivers/net/wireless/wavelan_cs.p.h b/trunk/drivers/net/wireless/wavelan_cs.p.h
index 01d882be8790..677ff71883cb 100644
--- a/trunk/drivers/net/wireless/wavelan_cs.p.h
+++ b/trunk/drivers/net/wireless/wavelan_cs.p.h
@@ -647,6 +647,23 @@ struct net_local
   void __iomem *mem;
 };
 
+/**************************** PROTOTYPES ****************************/
+
+#ifdef WAVELAN_ROAMING
+/* ---------------------- ROAMING SUBROUTINES -----------------------*/
+
+wavepoint_history *wl_roam_check(unsigned short nwid, net_local *lp);
+wavepoint_history *wl_new_wavepoint(unsigned short nwid, unsigned char seq, net_local *lp);
+void wl_del_wavepoint(wavepoint_history *wavepoint, net_local *lp);
+void wl_cell_expiry(unsigned long data);
+wavepoint_history *wl_best_sigqual(int fast_search, net_local *lp);
+void wl_update_history(wavepoint_history *wavepoint, unsigned char sigqual, unsigned char seq);
+void wv_roam_handover(wavepoint_history *wavepoint, net_local *lp);
+void wv_nwid_filter(unsigned char mode, net_local *lp);
+void wv_roam_init(struct net_device *dev);
+void wv_roam_cleanup(struct net_device *dev);
+#endif	/* WAVELAN_ROAMING */
+
 /* ----------------- MODEM MANAGEMENT SUBROUTINES ----------------- */
 static inline u_char		/* data */
 	hasr_read(u_long);	/* Read the host interface : base address */
diff --git a/trunk/drivers/net/wireless/wl3501.h b/trunk/drivers/net/wireless/wl3501.h
index b5719437e981..8636d9306785 100644
--- a/trunk/drivers/net/wireless/wl3501.h
+++ b/trunk/drivers/net/wireless/wl3501.h
@@ -2,7 +2,7 @@
 #define __WL3501_H__
 
 #include <linux/spinlock.h>
-#include <net/ieee80211.h>
+#include "ieee802_11.h"
 
 /* define for WLA 2.0 */
 #define WL3501_BLKSZ 256
@@ -548,7 +548,7 @@ struct wl3501_80211_tx_plcp_hdr {
 
 struct wl3501_80211_tx_hdr {
 	struct wl3501_80211_tx_plcp_hdr	pclp_hdr;
-	struct ieee80211_hdr		mac_hdr;
+	struct ieee802_11_hdr		mac_hdr;
 } __attribute__ ((packed));
 
 /*
diff --git a/trunk/drivers/net/wireless/wl3501_cs.c b/trunk/drivers/net/wireless/wl3501_cs.c
index 7cc5edbf6ede..dd902126d018 100644
--- a/trunk/drivers/net/wireless/wl3501_cs.c
+++ b/trunk/drivers/net/wireless/wl3501_cs.c
@@ -296,8 +296,7 @@ static int wl3501_get_flash_mac_addr(struct wl3501_card *this)
  *
  * Move 'size' bytes from PC to card. (Shouldn't be interrupted)
  */
-static void wl3501_set_to_wla(struct wl3501_card *this, u16 dest, void *src,
-			      int size)
+void wl3501_set_to_wla(struct wl3501_card *this, u16 dest, void *src, int size)
 {
 	/* switch to SRAM Page 0 */
 	wl3501_switch_page(this, (dest & 0x8000) ? WL3501_BSS_SPAGE1 :
@@ -318,8 +317,8 @@ static void wl3501_set_to_wla(struct wl3501_card *this, u16 dest, void *src,
  *
  * Move 'size' bytes from card to PC. (Shouldn't be interrupted)
  */
-static void wl3501_get_from_wla(struct wl3501_card *this, u16 src, void *dest,
-				int size)
+void wl3501_get_from_wla(struct wl3501_card *this, u16 src, void *dest,
+			 int size)
 {
 	/* switch to SRAM Page 0 */
 	wl3501_switch_page(this, (src & 0x8000) ? WL3501_BSS_SPAGE1 :
@@ -1439,14 +1438,14 @@ static int wl3501_open(struct net_device *dev)
 	goto out;
 }
 
-static struct net_device_stats *wl3501_get_stats(struct net_device *dev)
+struct net_device_stats *wl3501_get_stats(struct net_device *dev)
 {
 	struct wl3501_card *this = dev->priv;
 
 	return &this->stats;
 }
 
-static struct iw_statistics *wl3501_get_wireless_stats(struct net_device *dev)
+struct iw_statistics *wl3501_get_wireless_stats(struct net_device *dev)
 {
 	struct wl3501_card *this = dev->priv;
 	struct iw_statistics *wstats = &this->wstats;
diff --git a/trunk/drivers/pci/rom.c b/trunk/drivers/pci/rom.c
index 49bd21702314..713c78f3a65d 100644
--- a/trunk/drivers/pci/rom.c
+++ b/trunk/drivers/pci/rom.c
@@ -21,21 +21,13 @@
  * between the ROM and other resources, so enabling it may disable access
  * to MMIO registers or other card memory.
  */
-static int pci_enable_rom(struct pci_dev *pdev)
+static void pci_enable_rom(struct pci_dev *pdev)
 {
-	struct resource *res = pdev->resource + PCI_ROM_RESOURCE;
-	struct pci_bus_region region;
 	u32 rom_addr;
 
-	if (!res->flags)
-		return -1;
-
-	pcibios_resource_to_bus(pdev, &region, res);
 	pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr);
-	rom_addr &= ~PCI_ROM_ADDRESS_MASK;
-	rom_addr |= region.start | PCI_ROM_ADDRESS_ENABLE;
+	rom_addr |= PCI_ROM_ADDRESS_ENABLE;
 	pci_write_config_dword(pdev, pdev->rom_base_reg, rom_addr);
-	return 0;
 }
 
 /**
@@ -79,21 +71,19 @@ void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
 	} else {
 		if (res->flags & IORESOURCE_ROM_COPY) {
 			*size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
-			return (void __iomem *)pci_resource_start(pdev,
-							     PCI_ROM_RESOURCE);
+			return (void __iomem *)pci_resource_start(pdev, PCI_ROM_RESOURCE);
 		} else {
 			/* assign the ROM an address if it doesn't have one */
-			if (res->parent == NULL &&
-			    pci_assign_resource(pdev,PCI_ROM_RESOURCE))
-				return NULL;
+			if (res->parent == NULL)
+				pci_assign_resource(pdev, PCI_ROM_RESOURCE);
+
 			start = pci_resource_start(pdev, PCI_ROM_RESOURCE);
 			*size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
 			if (*size == 0)
 				return NULL;
 
 			/* Enable ROM space decodes */
-			if (pci_enable_rom(pdev))
-				return NULL;
+			pci_enable_rom(pdev);
 		}
 	}
 
diff --git a/trunk/drivers/pci/setup-bus.c b/trunk/drivers/pci/setup-bus.c
index 6b0e6464eb39..6d864c502a1f 100644
--- a/trunk/drivers/pci/setup-bus.c
+++ b/trunk/drivers/pci/setup-bus.c
@@ -40,7 +40,7 @@
  * FIXME: IO should be max 256 bytes.  However, since we may
  * have a P2P bridge below a cardbus bridge, we need 4K.
  */
-#define CARDBUS_IO_SIZE		(4*1024)
+#define CARDBUS_IO_SIZE		(256)
 #define CARDBUS_MEM_SIZE	(32*1024*1024)
 
 static void __devinit
diff --git a/trunk/drivers/scsi/ahci.c b/trunk/drivers/scsi/ahci.c
index 179c95c878ac..841f4e2cfe08 100644
--- a/trunk/drivers/scsi/ahci.c
+++ b/trunk/drivers/scsi/ahci.c
@@ -1,34 +1,26 @@
 /*
  *  ahci.c - AHCI SATA support
  *
- *  Maintained by:  Jeff Garzik <jgarzik@pobox.com>
- *    		    Please ALWAYS copy linux-ide@vger.kernel.org
- *		    on emails.
+ *  Copyright 2004 Red Hat, Inc.
  *
- *  Copyright 2004-2005 Red Hat, Inc.
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- * libata documentation is available via 'make {ps|pdf}docs',
- * as Documentation/DocBook/libata.*
- *
- * AHCI hardware documentation:
+ * Version 1.0 of the AHCI specification:
  * http://www.intel.com/technology/serialata/pdf/rev1_0.pdf
- * http://www.intel.com/technology/serialata/pdf/rev1_1.pdf
  *
  */
 
diff --git a/trunk/drivers/scsi/ata_piix.c b/trunk/drivers/scsi/ata_piix.c
index fb28c1261848..03695616e59e 100644
--- a/trunk/drivers/scsi/ata_piix.c
+++ b/trunk/drivers/scsi/ata_piix.c
@@ -1,42 +1,24 @@
 /*
- *    ata_piix.c - Intel PATA/SATA controllers
- *
- *    Maintained by:  Jeff Garzik <jgarzik@pobox.com>
- *    		    Please ALWAYS copy linux-ide@vger.kernel.org
- *		    on emails.
- *
- *
- *	Copyright 2003-2005 Red Hat Inc
- *	Copyright 2003-2005 Jeff Garzik
- *
- *
- *	Copyright header from piix.c:
- *
- *  Copyright (C) 1998-1999 Andrzej Krzysztofowicz, Author and Maintainer
- *  Copyright (C) 1998-2000 Andre Hedrick <andre@linux-ide.org>
- *  Copyright (C) 2003 Red Hat Inc <alan@redhat.com>
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware documentation available at http://developer.intel.com/
- *
+
+    ata_piix.c - Intel PATA/SATA controllers
+
+    Maintained by:  Jeff Garzik <jgarzik@pobox.com>
+    		    Please ALWAYS copy linux-ide@vger.kernel.org
+		    on emails.
+
+
+	Copyright 2003-2004 Red Hat Inc
+	Copyright 2003-2004 Jeff Garzik
+
+
+	Copyright header from piix.c:
+
+    Copyright (C) 1998-1999 Andrzej Krzysztofowicz, Author and Maintainer
+    Copyright (C) 1998-2000 Andre Hedrick <andre@linux-ide.org>
+    Copyright (C) 2003 Red Hat Inc <alan@redhat.com>
+
+    May be copied or modified under the terms of the GNU General Public License
+
  */
 
 #include <linux/kernel.h>
diff --git a/trunk/drivers/scsi/ibmvscsi/ibmvscsi.c b/trunk/drivers/scsi/ibmvscsi/ibmvscsi.c
index 2cb3c8340ca8..fe09d145542a 100644
--- a/trunk/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/trunk/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -1442,7 +1442,7 @@ static int ibmvscsi_remove(struct vio_dev *vdev)
  */
 static struct vio_device_id ibmvscsi_device_table[] __devinitdata = {
 	{"vscsi", "IBM,v-scsi"},
-	{ "", "" }
+	{0,}
 };
 
 MODULE_DEVICE_TABLE(vio, ibmvscsi_device_table);
diff --git a/trunk/drivers/scsi/ibmvscsi/rpa_vscsi.c b/trunk/drivers/scsi/ibmvscsi/rpa_vscsi.c
index 8bf5652f1060..035f615817d7 100644
--- a/trunk/drivers/scsi/ibmvscsi/rpa_vscsi.c
+++ b/trunk/drivers/scsi/ibmvscsi/rpa_vscsi.c
@@ -28,7 +28,6 @@
  */
 
 #include <asm/vio.h>
-#include <asm/prom.h>
 #include <asm/iommu.h>
 #include <asm/hvcall.h>
 #include <linux/dma-mapping.h>
diff --git a/trunk/drivers/scsi/libata-core.c b/trunk/drivers/scsi/libata-core.c
index dee4b12b0342..f15a07f9f471 100644
--- a/trunk/drivers/scsi/libata-core.c
+++ b/trunk/drivers/scsi/libata-core.c
@@ -1,35 +1,25 @@
 /*
- *  libata-core.c - helper library for ATA
- *
- *  Maintained by:  Jeff Garzik <jgarzik@pobox.com>
- *    		    Please ALWAYS copy linux-ide@vger.kernel.org
- *		    on emails.
- *
- *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
- *  Copyright 2003-2004 Jeff Garzik
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware documentation available from http://www.t13.org/ and
- *  http://www.sata-io.org/
- *
+   libata-core.c - helper library for ATA
+
+   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+   Copyright 2003-2004 Jeff Garzik
+
+   The contents of this file are subject to the Open
+   Software License version 1.1 that can be found at
+   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+   by reference.
+
+   Alternatively, the contents of this file may be used under the terms
+   of the GNU General Public License version 2 (the "GPL") as distributed
+   in the kernel source COPYING file, in which case the provisions of
+   the GPL are applicable instead of the above.  If you wish to allow
+   the use of your version of this file only under the terms of the
+   GPL and not to allow others to use your version of this file under
+   the OSL, indicate your decision by deleting the provisions above and
+   replace them with the notice and other provisions required by the GPL.
+   If you do not delete the provisions above, a recipient may use your
+   version of this file under either the OSL or the GPL.
+
  */
 
 #include <linux/config.h>
diff --git a/trunk/drivers/scsi/libata-scsi.c b/trunk/drivers/scsi/libata-scsi.c
index 346eb36b1e31..4074e7877ba3 100644
--- a/trunk/drivers/scsi/libata-scsi.c
+++ b/trunk/drivers/scsi/libata-scsi.c
@@ -1,36 +1,25 @@
 /*
- *  libata-scsi.c - helper library for ATA
- *
- *  Maintained by:  Jeff Garzik <jgarzik@pobox.com>
- *    		    Please ALWAYS copy linux-ide@vger.kernel.org
- *		    on emails.
- *
- *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
- *  Copyright 2003-2004 Jeff Garzik
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware documentation available from
- *  - http://www.t10.org/
- *  - http://www.t13.org/
- *
+   libata-scsi.c - helper library for ATA
+
+   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+   Copyright 2003-2004 Jeff Garzik
+
+   The contents of this file are subject to the Open
+   Software License version 1.1 that can be found at
+   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+   by reference.
+
+   Alternatively, the contents of this file may be used under the terms
+   of the GNU General Public License version 2 (the "GPL") as distributed
+   in the kernel source COPYING file, in which case the provisions of
+   the GPL are applicable instead of the above.  If you wish to allow
+   the use of your version of this file only under the terms of the
+   GPL and not to allow others to use your version of this file under
+   the OSL, indicate your decision by deleting the provisions above and
+   replace them with the notice and other provisions required by the GPL.
+   If you do not delete the provisions above, a recipient may use your
+   version of this file under either the OSL or the GPL.
+
  */
 
 #include <linux/kernel.h>
diff --git a/trunk/drivers/scsi/libata.h b/trunk/drivers/scsi/libata.h
index 809c634afbcd..620d21772bd6 100644
--- a/trunk/drivers/scsi/libata.h
+++ b/trunk/drivers/scsi/libata.h
@@ -1,28 +1,25 @@
 /*
- *  libata.h - helper library for ATA
- *
- *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
- *  Copyright 2003-2004 Jeff Garzik
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
+   libata.h - helper library for ATA
+
+   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+   Copyright 2003-2004 Jeff Garzik
+
+   The contents of this file are subject to the Open
+   Software License version 1.1 that can be found at
+   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+   by reference.
+
+   Alternatively, the contents of this file may be used under the terms
+   of the GNU General Public License version 2 (the "GPL") as distributed
+   in the kernel source COPYING file, in which case the provisions of
+   the GPL are applicable instead of the above.  If you wish to allow
+   the use of your version of this file only under the terms of the
+   GPL and not to allow others to use your version of this file under
+   the OSL, indicate your decision by deleting the provisions above and
+   replace them with the notice and other provisions required by the GPL.
+   If you do not delete the provisions above, a recipient may use your
+   version of this file under either the OSL or the GPL.
+
  */
 
 #ifndef __LIBATA_H__
diff --git a/trunk/drivers/scsi/sata_nv.c b/trunk/drivers/scsi/sata_nv.c
index 03d9bc6e69df..41a3421b02b4 100644
--- a/trunk/drivers/scsi/sata_nv.c
+++ b/trunk/drivers/scsi/sata_nv.c
@@ -4,31 +4,21 @@
  *  Copyright 2004 NVIDIA Corp.  All rights reserved.
  *  Copyright 2004 Andrew Chew
  *
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  No hardware documentation available outside of NVIDIA.
- *  This driver programs the NVIDIA SATA controller in a similar
- *  fashion as with other PCI IDE BMDMA controllers, with a few
- *  NV-specific details such as register offsets, SATA phy location,
- *  hotplug info, etc.
- *
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
  *  0.08
  *     - Added support for MCP51 and MCP55.
diff --git a/trunk/drivers/scsi/sata_promise.c b/trunk/drivers/scsi/sata_promise.c
index 7c4f6ecc1cc9..b8dc49fed769 100644
--- a/trunk/drivers/scsi/sata_promise.c
+++ b/trunk/drivers/scsi/sata_promise.c
@@ -7,26 +7,21 @@
  *
  *  Copyright 2003-2004 Red Hat, Inc.
  *
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware information only available under NDA.
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
  */
 
@@ -84,8 +79,7 @@ static irqreturn_t pdc_interrupt (int irq, void *dev_instance, struct pt_regs *r
 static void pdc_eng_timeout(struct ata_port *ap);
 static int pdc_port_start(struct ata_port *ap);
 static void pdc_port_stop(struct ata_port *ap);
-static void pdc_pata_phy_reset(struct ata_port *ap);
-static void pdc_sata_phy_reset(struct ata_port *ap);
+static void pdc_phy_reset(struct ata_port *ap);
 static void pdc_qc_prep(struct ata_queued_cmd *qc);
 static void pdc_tf_load_mmio(struct ata_port *ap, struct ata_taskfile *tf);
 static void pdc_exec_command_mmio(struct ata_port *ap, struct ata_taskfile *tf);
@@ -112,22 +106,19 @@ static Scsi_Host_Template pdc_ata_sht = {
 	.ordered_flush		= 1,
 };
 
-static struct ata_port_operations pdc_sata_ops = {
+static struct ata_port_operations pdc_ata_ops = {
 	.port_disable		= ata_port_disable,
 	.tf_load		= pdc_tf_load_mmio,
 	.tf_read		= ata_tf_read,
 	.check_status		= ata_check_status,
 	.exec_command		= pdc_exec_command_mmio,
 	.dev_select		= ata_std_dev_select,
-
-	.phy_reset		= pdc_sata_phy_reset,
-
+	.phy_reset		= pdc_phy_reset,
 	.qc_prep		= pdc_qc_prep,
 	.qc_issue		= pdc_qc_issue_prot,
 	.eng_timeout		= pdc_eng_timeout,
 	.irq_handler		= pdc_interrupt,
 	.irq_clear		= pdc_irq_clear,
-
 	.scr_read		= pdc_sata_scr_read,
 	.scr_write		= pdc_sata_scr_write,
 	.port_start		= pdc_port_start,
@@ -135,27 +126,6 @@ static struct ata_port_operations pdc_sata_ops = {
 	.host_stop		= ata_host_stop,
 };
 
-static struct ata_port_operations pdc_pata_ops = {
-	.port_disable		= ata_port_disable,
-	.tf_load		= pdc_tf_load_mmio,
-	.tf_read		= ata_tf_read,
-	.check_status		= ata_check_status,
-	.exec_command		= pdc_exec_command_mmio,
-	.dev_select		= ata_std_dev_select,
-
-	.phy_reset		= pdc_pata_phy_reset,
-
-	.qc_prep		= pdc_qc_prep,
-	.qc_issue		= pdc_qc_issue_prot,
-	.eng_timeout		= pdc_eng_timeout,
-	.irq_handler		= pdc_interrupt,
-	.irq_clear		= pdc_irq_clear,
-
-	.port_start		= pdc_port_start,
-	.port_stop		= pdc_port_stop,
-	.host_stop		= ata_host_stop,
-};
-
 static struct ata_port_info pdc_port_info[] = {
 	/* board_2037x */
 	{
@@ -165,7 +135,7 @@ static struct ata_port_info pdc_port_info[] = {
 		.pio_mask	= 0x1f, /* pio0-4 */
 		.mwdma_mask	= 0x07, /* mwdma0-2 */
 		.udma_mask	= 0x7f, /* udma0-6 ; FIXME */
-		.port_ops	= &pdc_sata_ops,
+		.port_ops	= &pdc_ata_ops,
 	},
 
 	/* board_20319 */
@@ -176,7 +146,7 @@ static struct ata_port_info pdc_port_info[] = {
 		.pio_mask	= 0x1f, /* pio0-4 */
 		.mwdma_mask	= 0x07, /* mwdma0-2 */
 		.udma_mask	= 0x7f, /* udma0-6 ; FIXME */
-		.port_ops	= &pdc_sata_ops,
+		.port_ops	= &pdc_ata_ops,
 	},
 
 	/* board_20619 */
@@ -187,7 +157,7 @@ static struct ata_port_info pdc_port_info[] = {
 		.pio_mask	= 0x1f, /* pio0-4 */
 		.mwdma_mask	= 0x07, /* mwdma0-2 */
 		.udma_mask	= 0x7f, /* udma0-6 ; FIXME */
-		.port_ops	= &pdc_pata_ops,
+		.port_ops	= &pdc_ata_ops,
 	},
 };
 
@@ -302,23 +272,12 @@ static void pdc_reset_port(struct ata_port *ap)
 	readl(mmio);	/* flush */
 }
 
-static void pdc_sata_phy_reset(struct ata_port *ap)
+static void pdc_phy_reset(struct ata_port *ap)
 {
 	pdc_reset_port(ap);
 	sata_phy_reset(ap);
 }
 
-static void pdc_pata_phy_reset(struct ata_port *ap)
-{
-	/* FIXME: add cable detect.  Don't assume 40-pin cable */
-	ap->cbl = ATA_CBL_PATA40;
-	ap->udma_mask &= ATA_UDMA_MASK_40C;
-
-	pdc_reset_port(ap);
-	ata_port_probe(ap);
-	ata_bus_reset(ap);
-}
-
 static u32 pdc_sata_scr_read (struct ata_port *ap, unsigned int sc_reg)
 {
 	if (sc_reg > SCR_CONTROL)
diff --git a/trunk/drivers/scsi/sata_promise.h b/trunk/drivers/scsi/sata_promise.h
index 6ee5e190262d..6e7e96b9ee13 100644
--- a/trunk/drivers/scsi/sata_promise.h
+++ b/trunk/drivers/scsi/sata_promise.h
@@ -3,24 +3,21 @@
  *
  *  Copyright 2003-2004 Red Hat, Inc.
  *
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
  */
 
diff --git a/trunk/drivers/scsi/sata_qstor.c b/trunk/drivers/scsi/sata_qstor.c
index 9c99ab433bd3..93fd06fb4f15 100644
--- a/trunk/drivers/scsi/sata_qstor.c
+++ b/trunk/drivers/scsi/sata_qstor.c
@@ -6,24 +6,21 @@
  *  Copyright 2005 Pacific Digital Corporation.
  *  (OSL/GPL code release authorized by Jalil Fadavi).
  *
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
  */
 
diff --git a/trunk/drivers/scsi/sata_sil.c b/trunk/drivers/scsi/sata_sil.c
index 71d49548f0a3..9d24d6c328b4 100644
--- a/trunk/drivers/scsi/sata_sil.c
+++ b/trunk/drivers/scsi/sata_sil.c
@@ -5,27 +5,24 @@
  *  		    Please ALWAYS copy linux-ide@vger.kernel.org
  *		    on emails.
  *
- *  Copyright 2003-2005 Red Hat, Inc.
+ *  Copyright 2003 Red Hat, Inc.
  *  Copyright 2003 Benjamin Herrenschmidt
  *
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
  *  Documentation for SiI 3112:
  *  http://gkernel.sourceforge.net/specs/sii/3112A_SiI-DS-0095-B2.pdf.bz2
diff --git a/trunk/drivers/scsi/sata_sis.c b/trunk/drivers/scsi/sata_sis.c
index 43af445b3ad2..b250ae0c7773 100644
--- a/trunk/drivers/scsi/sata_sis.c
+++ b/trunk/drivers/scsi/sata_sis.c
@@ -7,26 +7,21 @@
  *
  *  Copyright 2004 Uwe Koziolek
  *
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware documentation available under NDA.
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
  */
 
diff --git a/trunk/drivers/scsi/sata_svw.c b/trunk/drivers/scsi/sata_svw.c
index 19d3bb3b0fb6..6fd2ce1ffcd8 100644
--- a/trunk/drivers/scsi/sata_svw.c
+++ b/trunk/drivers/scsi/sata_svw.c
@@ -13,26 +13,21 @@
  *  This driver probably works with non-Apple versions of the
  *  Broadcom chipset...
  *
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware documentation available under NDA.
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
  */
 
diff --git a/trunk/drivers/scsi/sata_sx4.c b/trunk/drivers/scsi/sata_sx4.c
index c72fcc46f0fa..a20d4285090a 100644
--- a/trunk/drivers/scsi/sata_sx4.c
+++ b/trunk/drivers/scsi/sata_sx4.c
@@ -7,26 +7,21 @@
  *
  *  Copyright 2003-2004 Red Hat, Inc.
  *
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware documentation available under NDA.
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
  */
 
diff --git a/trunk/drivers/scsi/sata_uli.c b/trunk/drivers/scsi/sata_uli.c
index 1566886815fb..eb202a73bc0e 100644
--- a/trunk/drivers/scsi/sata_uli.c
+++ b/trunk/drivers/scsi/sata_uli.c
@@ -1,26 +1,21 @@
 /*
  *  sata_uli.c - ULi Electronics SATA
  *
+ *  The contents of this file are subject to the Open
+ *  Software License version 1.1 that can be found at
+ *  http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+ *  by reference.
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware documentation available under NDA.
+ *  Alternatively, the contents of this file may be used under the terms
+ *  of the GNU General Public License version 2 (the "GPL") as distributed
+ *  in the kernel source COPYING file, in which case the provisions of
+ *  the GPL are applicable instead of the above.  If you wish to allow
+ *  the use of your version of this file only under the terms of the
+ *  GPL and not to allow others to use your version of this file under
+ *  the OSL, indicate your decision by deleting the provisions above and
+ *  replace them with the notice and other provisions required by the GPL.
+ *  If you do not delete the provisions above, a recipient may use your
+ *  version of this file under either the OSL or the GPL.
  *
  */
 
diff --git a/trunk/drivers/scsi/sata_via.c b/trunk/drivers/scsi/sata_via.c
index 128b996b07b7..feff10980487 100644
--- a/trunk/drivers/scsi/sata_via.c
+++ b/trunk/drivers/scsi/sata_via.c
@@ -1,38 +1,34 @@
 /*
- *  sata_via.c - VIA Serial ATA controllers
- *
- *  Maintained by:  Jeff Garzik <jgarzik@pobox.com>
- * 		   Please ALWAYS copy linux-ide@vger.kernel.org
+   sata_via.c - VIA Serial ATA controllers
+
+   Maintained by:  Jeff Garzik <jgarzik@pobox.com>
+   		   Please ALWAYS copy linux-ide@vger.kernel.org
  		   on emails.
- *
- *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
- *  Copyright 2003-2004 Jeff Garzik
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware documentation available under NDA.
- *
- *
- *  To-do list:
- *  - VT6421 PATA support
- *
+
+   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+   Copyright 2003-2004 Jeff Garzik
+
+   The contents of this file are subject to the Open
+   Software License version 1.1 that can be found at
+   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+   by reference.
+
+   Alternatively, the contents of this file may be used under the terms
+   of the GNU General Public License version 2 (the "GPL") as distributed
+   in the kernel source COPYING file, in which case the provisions of
+   the GPL are applicable instead of the above.  If you wish to allow
+   the use of your version of this file only under the terms of the
+   GPL and not to allow others to use your version of this file under
+   the OSL, indicate your decision by deleting the provisions above and
+   replace them with the notice and other provisions required by the GPL.
+   If you do not delete the provisions above, a recipient may use your
+   version of this file under either the OSL or the GPL.
+
+   ----------------------------------------------------------------------
+
+   To-do list:
+   * VT6421 PATA support
+
  */
 
 #include <linux/kernel.h>
diff --git a/trunk/drivers/scsi/sata_vsc.c b/trunk/drivers/scsi/sata_vsc.c
index 3985f344da4d..6f2562171be0 100644
--- a/trunk/drivers/scsi/sata_vsc.c
+++ b/trunk/drivers/scsi/sata_vsc.c
@@ -9,29 +9,9 @@
  *
  *  Bits from Jeff Garzik, Copyright RedHat, Inc.
  *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Vitesse hardware documentation presumably available under NDA.
- *  Intel 31244 (same hardware interface) documentation presumably
- *  available from http://developer.intel.com/
- *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License.  See the file "COPYING" in the main directory of this archive
+ *  for more details.
  */
 
 #include <linux/kernel.h>
diff --git a/trunk/drivers/usb/net/Makefile b/trunk/drivers/usb/net/Makefile
index fe3fd4115e1e..16f352195512 100644
--- a/trunk/drivers/usb/net/Makefile
+++ b/trunk/drivers/usb/net/Makefile
@@ -8,3 +8,5 @@ obj-$(CONFIG_USB_PEGASUS)	+= pegasus.o
 obj-$(CONFIG_USB_RTL8150)	+= rtl8150.o
 obj-$(CONFIG_USB_USBNET)	+= usbnet.o
 obj-$(CONFIG_USB_ZD1201)	+= zd1201.o
+
+CFLAGS_zd1201.o = -Idrivers/net/wireless/
diff --git a/trunk/drivers/usb/net/usbnet.c b/trunk/drivers/usb/net/usbnet.c
index a2f67245f6da..4528a00c45b0 100644
--- a/trunk/drivers/usb/net/usbnet.c
+++ b/trunk/drivers/usb/net/usbnet.c
@@ -2903,18 +2903,19 @@ static struct net_device_stats *usbnet_get_stats (struct net_device *net)
  * completion callbacks.  2.5 should have fixed those bugs...
  */
 
-static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_head *list)
+static void defer_bh (struct usbnet *dev, struct sk_buff *skb)
 {
+	struct sk_buff_head	*list = skb->list;
 	unsigned long		flags;
 
-	spin_lock_irqsave(&list->lock, flags);
-	__skb_unlink(skb, list);
-	spin_unlock(&list->lock);
-	spin_lock(&dev->done.lock);
-	__skb_queue_tail(&dev->done, skb);
+	spin_lock_irqsave (&list->lock, flags);
+	__skb_unlink (skb, list);
+	spin_unlock (&list->lock);
+	spin_lock (&dev->done.lock);
+	__skb_queue_tail (&dev->done, skb);
 	if (dev->done.qlen == 1)
-		tasklet_schedule(&dev->bh);
-	spin_unlock_irqrestore(&dev->done.lock, flags);
+		tasklet_schedule (&dev->bh);
+	spin_unlock_irqrestore (&dev->done.lock, flags);
 }
 
 /* some work can't be done in tasklets, so we use keventd
@@ -3119,7 +3120,7 @@ static void rx_complete (struct urb *urb, struct pt_regs *regs)
 		break;
 	}
 
-	defer_bh(dev, skb, &dev->rxq);
+	defer_bh (dev, skb);
 
 	if (urb) {
 		if (netif_running (dev->net)
@@ -3489,7 +3490,7 @@ static void tx_complete (struct urb *urb, struct pt_regs *regs)
 
 	urb->dev = NULL;
 	entry->state = tx_done;
-	defer_bh(dev, skb, &dev->txq);
+	defer_bh (dev, skb);
 }
 
 /*-------------------------------------------------------------------------*/
diff --git a/trunk/drivers/usb/net/zd1201.c b/trunk/drivers/usb/net/zd1201.c
index fc013978837e..e32a80b39182 100644
--- a/trunk/drivers/usb/net/zd1201.c
+++ b/trunk/drivers/usb/net/zd1201.c
@@ -21,7 +21,7 @@
 #include <linux/string.h>
 #include <linux/if_arp.h>
 #include <linux/firmware.h>
-#include <net/ieee80211.h>
+#include <ieee802_11.h>
 #include "zd1201.h"
 
 static struct usb_device_id zd1201_table[] = {
@@ -338,24 +338,24 @@ static void zd1201_usbrx(struct urb *urb, struct pt_regs *regs)
 			goto resubmit;
 		}
 			
-		if ((seq & IEEE80211_SCTL_FRAG) ||
-		    (fc & IEEE80211_FCTL_MOREFRAGS)) {
+		if ((seq & IEEE802_11_SCTL_FRAG) ||
+		    (fc & IEEE802_11_FCTL_MOREFRAGS)) {
 			struct zd1201_frag *frag = NULL;
 			char *ptr;
 
 			if (datalen<14)
 				goto resubmit;
-			if ((seq & IEEE80211_SCTL_FRAG) == 0) {
+			if ((seq & IEEE802_11_SCTL_FRAG) == 0) {
 				frag = kmalloc(sizeof(*frag), GFP_ATOMIC);
 				if (!frag)
 					goto resubmit;
-				skb = dev_alloc_skb(IEEE80211_DATA_LEN +14+2);
+				skb = dev_alloc_skb(IEEE802_11_DATA_LEN +14+2);
 				if (!skb) {
 					kfree(frag);
 					goto resubmit;
 				}
 				frag->skb = skb;
-				frag->seq = seq & IEEE80211_SCTL_SEQ;
+				frag->seq = seq & IEEE802_11_SCTL_SEQ;
 				skb_reserve(skb, 2);
 				memcpy(skb_put(skb, 12), &data[datalen-14], 12);
 				memcpy(skb_put(skb, 2), &data[6], 2);
@@ -364,7 +364,7 @@ static void zd1201_usbrx(struct urb *urb, struct pt_regs *regs)
 				goto resubmit;
 			}
 			hlist_for_each_entry(frag, node, &zd->fraglist, fnode)
-				if(frag->seq == (seq&IEEE80211_SCTL_SEQ))
+				if(frag->seq == (seq&IEEE802_11_SCTL_SEQ))
 					break;
 			if (!frag)
 				goto resubmit;
@@ -372,7 +372,7 @@ static void zd1201_usbrx(struct urb *urb, struct pt_regs *regs)
 			ptr = skb_put(skb, len);
 			if (ptr)
 				memcpy(ptr, data+8, len);
-			if (fc & IEEE80211_FCTL_MOREFRAGS)
+			if (fc & IEEE802_11_FCTL_MOREFRAGS)
 				goto resubmit;
 			hlist_del_init(&frag->fnode);
 			kfree(frag);
diff --git a/trunk/drivers/w1/w1_int.c b/trunk/drivers/w1/w1_int.c
index 498ad505fa5f..b5a5e04b6d37 100644
--- a/trunk/drivers/w1/w1_int.c
+++ b/trunk/drivers/w1/w1_int.c
@@ -86,9 +86,9 @@ static struct w1_master * w1_alloc_dev(u32 id, int slave_count, int slave_ttl,
 
 	dev->driver = driver;
 
-	dev->groups = 1;
+	dev->groups = 23;
 	dev->seq = 1;
-	dev->nls = netlink_kernel_create(NETLINK_W1, 1, NULL, THIS_MODULE);
+	dev->nls = netlink_kernel_create(NETLINK_W1, NULL);
 	if (!dev->nls) {
 		printk(KERN_ERR "Failed to create new netlink socket(%u) for w1 master %s.\n",
 			NETLINK_NFLOG, dev->dev.bus_id);
@@ -225,5 +225,3 @@ void w1_remove_master_device(struct w1_bus_master *bm)
 
 EXPORT_SYMBOL(w1_add_master_device);
 EXPORT_SYMBOL(w1_remove_master_device);
-
-MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_W1);
diff --git a/trunk/drivers/w1/w1_netlink.c b/trunk/drivers/w1/w1_netlink.c
index e7b774423dd6..2a82fb055c70 100644
--- a/trunk/drivers/w1/w1_netlink.c
+++ b/trunk/drivers/w1/w1_netlink.c
@@ -51,7 +51,7 @@ void w1_netlink_send(struct w1_master *dev, struct w1_netlink_msg *msg)
 
 	memcpy(data, msg, sizeof(struct w1_netlink_msg));
 
-	NETLINK_CB(skb).dst_group = dev->groups;
+	NETLINK_CB(skb).dst_groups = dev->groups;
 	netlink_broadcast(dev->nls, skb, 0, dev->groups, GFP_ATOMIC);
 
 nlmsg_failure:
diff --git a/trunk/fs/jfs/namei.c b/trunk/fs/jfs/namei.c
index 49ccde3937f9..1cae14e741eb 100644
--- a/trunk/fs/jfs/namei.c
+++ b/trunk/fs/jfs/namei.c
@@ -1390,8 +1390,6 @@ static struct dentry *jfs_lookup(struct inode *dip, struct dentry *dentry, struc
 
 	jfs_info("jfs_lookup: name = %s", name);
 
-	if (JFS_SBI(dip->i_sb)->mntflag & JFS_OS2)
-		dentry->d_op = &jfs_ci_dentry_operations;
 
 	if ((name[0] == '.') && (len == 1))
 		inum = dip->i_ino;
@@ -1419,6 +1417,9 @@ static struct dentry *jfs_lookup(struct inode *dip, struct dentry *dentry, struc
 		return ERR_PTR(-EACCES);
 	}
 
+	if (JFS_SBI(dip->i_sb)->mntflag & JFS_OS2)
+		dentry->d_op = &jfs_ci_dentry_operations;
+
 	dentry = d_splice_alias(ip, dentry);
 
 	if (dentry && (JFS_SBI(dip->i_sb)->mntflag & JFS_OS2))
diff --git a/trunk/fs/smbfs/sock.c b/trunk/fs/smbfs/sock.c
index 6815b1b12b68..93f3cd22a2e9 100644
--- a/trunk/fs/smbfs/sock.c
+++ b/trunk/fs/smbfs/sock.c
@@ -15,12 +15,12 @@
 #include <linux/file.h>
 #include <linux/in.h>
 #include <linux/net.h>
+#include <linux/tcp.h>
 #include <linux/mm.h>
 #include <linux/netdevice.h>
 #include <linux/smp_lock.h>
 #include <linux/workqueue.h>
 #include <net/scm.h>
-#include <net/tcp_states.h>
 #include <net/ip.h>
 
 #include <linux/smb_fs.h>
diff --git a/trunk/include/asm-alpha/socket.h b/trunk/include/asm-alpha/socket.h
index b5193229132a..d00259d3dc78 100644
--- a/trunk/include/asm-alpha/socket.h
+++ b/trunk/include/asm-alpha/socket.h
@@ -25,8 +25,6 @@
 #define SO_ERROR	0x1007
 #define SO_SNDBUF	0x1001
 #define SO_RCVBUF	0x1002
-#define SO_SNDBUFFORCE	0x100a
-#define SO_RCVBUFFORCE	0x100b
 #define	SO_RCVLOWAT	0x1010
 #define	SO_SNDLOWAT	0x1011
 #define	SO_RCVTIMEO	0x1012
diff --git a/trunk/include/asm-arm/socket.h b/trunk/include/asm-arm/socket.h
index 3c51da6438c9..46d20585d951 100644
--- a/trunk/include/asm-arm/socket.h
+++ b/trunk/include/asm-arm/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-arm/unistd.h b/trunk/include/asm-arm/unistd.h
index 94619ccee789..278de61224d1 100644
--- a/trunk/include/asm-arm/unistd.h
+++ b/trunk/include/asm-arm/unistd.h
@@ -295,7 +295,7 @@
 #define __NR_fstatfs64			(__NR_SYSCALL_BASE+267)
 #define __NR_tgkill			(__NR_SYSCALL_BASE+268)
 #define __NR_utimes			(__NR_SYSCALL_BASE+269)
-#define __NR_fadvise64_64		(__NR_SYSCALL_BASE+270)
+#define __NR_arm_fadvise64_64		(__NR_SYSCALL_BASE+270)
 #define __NR_pciconfig_iobase		(__NR_SYSCALL_BASE+271)
 #define __NR_pciconfig_read		(__NR_SYSCALL_BASE+272)
 #define __NR_pciconfig_write		(__NR_SYSCALL_BASE+273)
diff --git a/trunk/include/asm-arm26/socket.h b/trunk/include/asm-arm26/socket.h
index 3c51da6438c9..46d20585d951 100644
--- a/trunk/include/asm-arm26/socket.h
+++ b/trunk/include/asm-arm26/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-cris/socket.h b/trunk/include/asm-cris/socket.h
index 8b1da3e58c55..f159b4f165f7 100644
--- a/trunk/include/asm-cris/socket.h
+++ b/trunk/include/asm-cris/socket.h
@@ -16,8 +16,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-frv/socket.h b/trunk/include/asm-frv/socket.h
index 7177f8b9817c..c3be17c7de4b 100644
--- a/trunk/include/asm-frv/socket.h
+++ b/trunk/include/asm-frv/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-h8300/socket.h b/trunk/include/asm-h8300/socket.h
index d98cf85bafc1..af33b8525dcf 100644
--- a/trunk/include/asm-h8300/socket.h
+++ b/trunk/include/asm-h8300/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-i386/checksum.h b/trunk/include/asm-i386/checksum.h
index 67d3630c4e89..f949e44c2a35 100644
--- a/trunk/include/asm-i386/checksum.h
+++ b/trunk/include/asm-i386/checksum.h
@@ -83,7 +83,7 @@ static inline unsigned short ip_fast_csum(unsigned char * iph,
 	    "adcl $0, %0	;\n"
 	    "notl %0		;\n"
 "2:				;\n"
-	/* Since the input registers which are loaded with iph and ihl
+	/* Since the input registers which are loaded with iph and ipl
 	   are modified, we must also specify them as outputs, or gcc
 	   will assume they contain their original values. */
 	: "=r" (sum), "=r" (iph), "=r" (ihl)
diff --git a/trunk/include/asm-i386/socket.h b/trunk/include/asm-i386/socket.h
index 802ae76195b7..07f6b38ad140 100644
--- a/trunk/include/asm-i386/socket.h
+++ b/trunk/include/asm-i386/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-ia64/acpi.h b/trunk/include/asm-ia64/acpi.h
index 3a544ffc5008..4c06d455139c 100644
--- a/trunk/include/asm-ia64/acpi.h
+++ b/trunk/include/asm-ia64/acpi.h
@@ -116,11 +116,6 @@ extern int __initdata nid_to_pxm_map[MAX_NUMNODES];
 
 extern u16 ia64_acpiid_to_sapicid[];
 
-/*
- * Refer Intel ACPI _PDC support document for bit definitions
- */
-#define ACPI_PDC_EST_CAPABILITY_SMP     0x8
-
 #endif /*__KERNEL__*/
 
 #endif /*_ASM_ACPI_H*/
diff --git a/trunk/include/asm-ia64/fcntl.h b/trunk/include/asm-ia64/fcntl.h
index cee16ea1780a..c9f8d835d0cc 100644
--- a/trunk/include/asm-ia64/fcntl.h
+++ b/trunk/include/asm-ia64/fcntl.h
@@ -81,7 +81,6 @@ struct flock {
 
 #define F_LINUX_SPECIFIC_BASE	1024
 
-#define force_o_largefile()	\
-		(personality(current->personality) != PER_LINUX32)
+#define force_o_largefile() ( ! (current->personality & PER_LINUX32) )
 
 #endif /* _ASM_IA64_FCNTL_H */
diff --git a/trunk/include/asm-ia64/io.h b/trunk/include/asm-ia64/io.h
index cf772a67f858..54e7637a326c 100644
--- a/trunk/include/asm-ia64/io.h
+++ b/trunk/include/asm-ia64/io.h
@@ -23,7 +23,7 @@
 #define __SLOW_DOWN_IO	do { } while (0)
 #define SLOW_DOWN_IO	do { } while (0)
 
-#define __IA64_UNCACHED_OFFSET	RGN_BASE(RGN_UNCACHED)
+#define __IA64_UNCACHED_OFFSET	0xc000000000000000UL	/* region 6 */
 
 /*
  * The legacy I/O space defined by the ia64 architecture supports only 65536 ports, but
@@ -41,7 +41,7 @@
 #define IO_SPACE_BASE(space)		((space) << IO_SPACE_BITS)
 #define IO_SPACE_PORT(port)		((port) & (IO_SPACE_SIZE - 1))
 
-#define IO_SPACE_SPARSE_ENCODING(p)	((((p) >> 2) << 12) | ((p) & 0xfff))
+#define IO_SPACE_SPARSE_ENCODING(p)	((((p) >> 2) << 12) | (p & 0xfff))
 
 struct io_space {
 	unsigned long mmio_base;	/* base in MMIO space */
diff --git a/trunk/include/asm-ia64/mmu.h b/trunk/include/asm-ia64/mmu.h
index 611432ba579c..ae1525352a25 100644
--- a/trunk/include/asm-ia64/mmu.h
+++ b/trunk/include/asm-ia64/mmu.h
@@ -2,12 +2,10 @@
 #define __MMU_H
 
 /*
- * Type for a context number.  We declare it volatile to ensure proper
- * ordering when it's accessed outside of spinlock'd critical sections
- * (e.g., as done in activate_mm() and init_new_context()).
+ * Type for a context number.  We declare it volatile to ensure proper ordering when it's
+ * accessed outside of spinlock'd critical sections (e.g., as done in activate_mm() and
+ * init_new_context()).
  */
 typedef volatile unsigned long mm_context_t;
 
-typedef unsigned long nv_mm_context_t;
-
 #endif
diff --git a/trunk/include/asm-ia64/mmu_context.h b/trunk/include/asm-ia64/mmu_context.h
index 8d6e72f7b08e..e3e5fededb04 100644
--- a/trunk/include/asm-ia64/mmu_context.h
+++ b/trunk/include/asm-ia64/mmu_context.h
@@ -19,7 +19,6 @@
 
 #define ia64_rid(ctx,addr)	(((ctx) << 3) | (addr >> 61))
 
-# include <asm/page.h>
 # ifndef __ASSEMBLY__
 
 #include <linux/compiler.h>
@@ -56,46 +55,34 @@ static inline void
 delayed_tlb_flush (void)
 {
 	extern void local_flush_tlb_all (void);
-	unsigned long flags;
 
 	if (unlikely(__ia64_per_cpu_var(ia64_need_tlb_flush))) {
-		spin_lock_irqsave(&ia64_ctx.lock, flags);
-		{
-			if (__ia64_per_cpu_var(ia64_need_tlb_flush)) {
-				local_flush_tlb_all();
-				__ia64_per_cpu_var(ia64_need_tlb_flush) = 0;
-			}
-		}
-		spin_unlock_irqrestore(&ia64_ctx.lock, flags);
+		local_flush_tlb_all();
+		__ia64_per_cpu_var(ia64_need_tlb_flush) = 0;
 	}
 }
 
-static inline nv_mm_context_t
+static inline mm_context_t
 get_mmu_context (struct mm_struct *mm)
 {
 	unsigned long flags;
-	nv_mm_context_t context = mm->context;
-
-	if (unlikely(!context)) {
-		spin_lock_irqsave(&ia64_ctx.lock, flags);
-		{
-			/* re-check, now that we've got the lock: */
-			context = mm->context;
-			if (context == 0) {
-				cpus_clear(mm->cpu_vm_mask);
-				if (ia64_ctx.next >= ia64_ctx.limit)
-					wrap_mmu_context(mm);
-				mm->context = context = ia64_ctx.next++;
-			}
+	mm_context_t context = mm->context;
+
+	if (context)
+		return context;
+
+	spin_lock_irqsave(&ia64_ctx.lock, flags);
+	{
+		/* re-check, now that we've got the lock: */
+		context = mm->context;
+		if (context == 0) {
+			cpus_clear(mm->cpu_vm_mask);
+			if (ia64_ctx.next >= ia64_ctx.limit)
+				wrap_mmu_context(mm);
+			mm->context = context = ia64_ctx.next++;
 		}
-		spin_unlock_irqrestore(&ia64_ctx.lock, flags);
 	}
-	/*
-	 * Ensure we're not starting to use "context" before any old
-	 * uses of it are gone from our TLB.
-	 */
-	delayed_tlb_flush();
-
+	spin_unlock_irqrestore(&ia64_ctx.lock, flags);
 	return context;
 }
 
@@ -117,13 +104,13 @@ destroy_context (struct mm_struct *mm)
 }
 
 static inline void
-reload_context (nv_mm_context_t context)
+reload_context (mm_context_t context)
 {
 	unsigned long rid;
 	unsigned long rid_incr = 0;
 	unsigned long rr0, rr1, rr2, rr3, rr4, old_rr4;
 
-	old_rr4 = ia64_get_rr(RGN_BASE(RGN_HPAGE));
+	old_rr4 = ia64_get_rr(0x8000000000000000UL);
 	rid = context << 3;	/* make space for encoding the region number */
 	rid_incr = 1 << 8;
 
@@ -135,10 +122,6 @@ reload_context (nv_mm_context_t context)
 	rr4 = rr0 + 4*rid_incr;
 #ifdef  CONFIG_HUGETLB_PAGE
 	rr4 = (rr4 & (~(0xfcUL))) | (old_rr4 & 0xfc);
-
-#  if RGN_HPAGE != 4
-#    error "reload_context assumes RGN_HPAGE is 4"
-#  endif
 #endif
 
 	ia64_set_rr(0x0000000000000000UL, rr0);
@@ -155,7 +138,7 @@ reload_context (nv_mm_context_t context)
 static inline void
 activate_context (struct mm_struct *mm)
 {
-	nv_mm_context_t context;
+	mm_context_t context;
 
 	do {
 		context = get_mmu_context(mm);
@@ -174,6 +157,8 @@ activate_context (struct mm_struct *mm)
 static inline void
 activate_mm (struct mm_struct *prev, struct mm_struct *next)
 {
+	delayed_tlb_flush();
+
 	/*
 	 * We may get interrupts here, but that's OK because interrupt handlers cannot
 	 * touch user-space.
diff --git a/trunk/include/asm-ia64/page.h b/trunk/include/asm-ia64/page.h
index 9edffad8c28b..08894f73abf0 100644
--- a/trunk/include/asm-ia64/page.h
+++ b/trunk/include/asm-ia64/page.h
@@ -12,19 +12,6 @@
 #include <asm/intrinsics.h>
 #include <asm/types.h>
 
-/*
- * The top three bits of an IA64 address are its Region Number.
- * Different regions are assigned to different purposes.
- */
-#define RGN_SHIFT	(61)
-#define RGN_BASE(r)	(__IA64_UL_CONST(r)<<RGN_SHIFT)
-#define RGN_BITS	(RGN_BASE(-1))
-
-#define RGN_KERNEL	7	/* Identity mapped region */
-#define RGN_UNCACHED    6	/* Identity mapped I/O region */
-#define RGN_GATE	5	/* Gate page, Kernel text, etc */
-#define RGN_HPAGE	4	/* For Huge TLB pages */
-
 /*
  * PAGE_SHIFT determines the actual kernel page size.
  */
@@ -49,9 +36,10 @@
 
 #define RGN_MAP_LIMIT	((1UL << (4*PAGE_SHIFT - 12)) - PAGE_SIZE)	/* per region addr limit */
 
-
 #ifdef CONFIG_HUGETLB_PAGE
-# define HPAGE_REGION_BASE	RGN_BASE(RGN_HPAGE)
+# define REGION_HPAGE		(4UL)	/* note: this is hardcoded in reload_context()!*/
+# define REGION_SHIFT		61
+# define HPAGE_REGION_BASE	(REGION_HPAGE << REGION_SHIFT)
 # define HPAGE_SHIFT		hpage_shift
 # define HPAGE_SHIFT_DEFAULT	28	/* check ia64 SDM for architecture supported size */
 # define HPAGE_SIZE		(__IA64_UL_CONST(1) << HPAGE_SHIFT)
@@ -142,13 +130,16 @@ typedef union ia64_va {
 #define REGION_NUMBER(x)	({ia64_va _v; _v.l = (long) (x); _v.f.reg;})
 #define REGION_OFFSET(x)	({ia64_va _v; _v.l = (long) (x); _v.f.off;})
 
+#define REGION_SIZE		REGION_NUMBER(1)
+#define REGION_KERNEL		7
+
 #ifdef CONFIG_HUGETLB_PAGE
 # define htlbpage_to_page(x)	(((unsigned long) REGION_NUMBER(x) << 61)			\
 				 | (REGION_OFFSET(x) >> (HPAGE_SHIFT-PAGE_SHIFT)))
 # define HUGETLB_PAGE_ORDER	(HPAGE_SHIFT - PAGE_SHIFT)
 # define is_hugepage_only_range(mm, addr, len)		\
-	 (REGION_NUMBER(addr) == RGN_HPAGE &&	\
-	  REGION_NUMBER((addr)+(len)-1) == RGN_HPAGE)
+	 (REGION_NUMBER(addr) == REGION_HPAGE &&	\
+	  REGION_NUMBER((addr)+(len)-1) == REGION_HPAGE)
 extern unsigned int hpage_shift;
 #endif
 
@@ -206,7 +197,7 @@ get_order (unsigned long size)
 # define __pgprot(x)	(x)
 #endif /* !STRICT_MM_TYPECHECKS */
 
-#define PAGE_OFFSET			RGN_BASE(RGN_KERNEL)
+#define PAGE_OFFSET			__IA64_UL_CONST(0xe000000000000000)
 
 #define VM_DATA_DEFAULT_FLAGS		(VM_READ | VM_WRITE |					\
 					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC |		\
diff --git a/trunk/include/asm-ia64/pal.h b/trunk/include/asm-ia64/pal.h
index e828377ad295..2303a10ee595 100644
--- a/trunk/include/asm-ia64/pal.h
+++ b/trunk/include/asm-ia64/pal.h
@@ -75,8 +75,6 @@
 #define PAL_CACHE_READ		259	/* read tag & data of cacheline for diagnostic testing */
 #define PAL_CACHE_WRITE		260	/* write tag & data of cacheline for diagnostic testing */
 #define PAL_VM_TR_READ		261	/* read contents of translation register */
-#define PAL_GET_PSTATE		262	/* get the current P-state */
-#define PAL_SET_PSTATE		263	/* set the P-state */
 
 #ifndef __ASSEMBLY__
 
@@ -1113,25 +1111,6 @@ ia64_pal_halt_info (pal_power_mgmt_info_u_t *power_buf)
 	return iprv.status;
 }
 
-/* Get the current P-state information */
-static inline s64
-ia64_pal_get_pstate (u64 *pstate_index)
-{
-	struct ia64_pal_retval iprv;
-	PAL_CALL_STK(iprv, PAL_GET_PSTATE, 0, 0, 0);
-	*pstate_index = iprv.v0;
-	return iprv.status;
-}
-
-/* Set the P-state */
-static inline s64
-ia64_pal_set_pstate (u64 pstate_index)
-{
-	struct ia64_pal_retval iprv;
-	PAL_CALL_STK(iprv, PAL_SET_PSTATE, pstate_index, 0, 0);
-	return iprv.status;
-}
-
 /* Cause the processor to enter LIGHT HALT state, where prefetching and execution are
  * suspended, but cache and TLB coherency is maintained.
  */
diff --git a/trunk/include/asm-ia64/pgtable.h b/trunk/include/asm-ia64/pgtable.h
index 2e34c06e6777..48586e08f432 100644
--- a/trunk/include/asm-ia64/pgtable.h
+++ b/trunk/include/asm-ia64/pgtable.h
@@ -204,18 +204,21 @@ ia64_phys_addr_valid (unsigned long addr)
 #define set_pte(ptep, pteval)	(*(ptep) = (pteval))
 #define set_pte_at(mm,addr,ptep,pteval) set_pte(ptep,pteval)
 
-#define VMALLOC_START		(RGN_BASE(RGN_GATE) + 0x200000000UL)
+#define RGN_SIZE	(1UL << 61)
+#define RGN_KERNEL	7
+
+#define VMALLOC_START		0xa000000200000000UL
 #ifdef CONFIG_VIRTUAL_MEM_MAP
-# define VMALLOC_END_INIT	(RGN_BASE(RGN_GATE) + (1UL << (4*PAGE_SHIFT - 9)))
+# define VMALLOC_END_INIT	(0xa000000000000000UL + (1UL << (4*PAGE_SHIFT - 9)))
 # define VMALLOC_END		vmalloc_end
   extern unsigned long vmalloc_end;
 #else
-# define VMALLOC_END		(RGN_BASE(RGN_GATE) + (1UL << (4*PAGE_SHIFT - 9)))
+# define VMALLOC_END		(0xa000000000000000UL + (1UL << (4*PAGE_SHIFT - 9)))
 #endif
 
 /* fs/proc/kcore.c */
-#define	kc_vaddr_to_offset(v) ((v) - RGN_BASE(RGN_GATE))
-#define	kc_offset_to_vaddr(o) ((o) + RGN_BASE(RGN_GATE))
+#define	kc_vaddr_to_offset(v) ((v) - 0xa000000000000000UL)
+#define	kc_offset_to_vaddr(o) ((o) + 0xa000000000000000UL)
 
 /*
  * Conversion functions: convert page frame number (pfn) and a protection value to a page
diff --git a/trunk/include/asm-ia64/rwsem.h b/trunk/include/asm-ia64/rwsem.h
index e18b5ab0cb75..6ece5061dc19 100644
--- a/trunk/include/asm-ia64/rwsem.h
+++ b/trunk/include/asm-ia64/rwsem.h
@@ -3,7 +3,6 @@
  *
  * Copyright (C) 2003 Ken Chen <kenneth.w.chen@intel.com>
  * Copyright (C) 2003 Asit Mallick <asit.k.mallick@intel.com>
- * Copyright (C) 2005 Christoph Lameter <clameter@sgi.com>
  *
  * Based on asm-i386/rwsem.h and other architecture implementation.
  *
@@ -12,9 +11,9 @@
  *
  * The lock count is initialized to 0 (no active and no waiting lockers).
  *
- * When a writer subtracts WRITE_BIAS, it'll get 0xffffffff00000001 for
- * the case of an uncontended lock. Readers increment by 1 and see a positive
- * value when uncontended, negative if there are writers (and maybe) readers
+ * When a writer subtracts WRITE_BIAS, it'll get 0xffff0001 for the case
+ * of an uncontended lock. Readers increment by 1 and see a positive value
+ * when uncontended, negative if there are writers (and maybe) readers
  * waiting (in which case it goes to sleep).
  */
 
@@ -30,7 +29,7 @@
  * the semaphore definition
  */
 struct rw_semaphore {
-	signed long		count;
+	signed int		count;
 	spinlock_t		wait_lock;
 	struct list_head	wait_list;
 #if RWSEM_DEBUG
@@ -38,10 +37,10 @@ struct rw_semaphore {
 #endif
 };
 
-#define RWSEM_UNLOCKED_VALUE		__IA64_UL_CONST(0x0000000000000000)
-#define RWSEM_ACTIVE_BIAS		__IA64_UL_CONST(0x0000000000000001)
-#define RWSEM_ACTIVE_MASK		__IA64_UL_CONST(0x00000000ffffffff)
-#define RWSEM_WAITING_BIAS		-__IA64_UL_CONST(0x0000000100000000)
+#define RWSEM_UNLOCKED_VALUE		0x00000000
+#define RWSEM_ACTIVE_BIAS		0x00000001
+#define RWSEM_ACTIVE_MASK		0x0000ffff
+#define RWSEM_WAITING_BIAS		(-0x00010000)
 #define RWSEM_ACTIVE_READ_BIAS		RWSEM_ACTIVE_BIAS
 #define RWSEM_ACTIVE_WRITE_BIAS		(RWSEM_WAITING_BIAS + RWSEM_ACTIVE_BIAS)
 
@@ -84,7 +83,7 @@ init_rwsem (struct rw_semaphore *sem)
 static inline void
 __down_read (struct rw_semaphore *sem)
 {
-	long result = ia64_fetchadd8_acq((unsigned long *)&sem->count, 1);
+	int result = ia64_fetchadd4_acq((unsigned int *)&sem->count, 1);
 
 	if (result < 0)
 		rwsem_down_read_failed(sem);
@@ -96,7 +95,7 @@ __down_read (struct rw_semaphore *sem)
 static inline void
 __down_write (struct rw_semaphore *sem)
 {
-	long old, new;
+	int old, new;
 
 	do {
 		old = sem->count;
@@ -113,7 +112,7 @@ __down_write (struct rw_semaphore *sem)
 static inline void
 __up_read (struct rw_semaphore *sem)
 {
-	long result = ia64_fetchadd8_rel((unsigned long *)&sem->count, -1);
+	int result = ia64_fetchadd4_rel((unsigned int *)&sem->count, -1);
 
 	if (result < 0 && (--result & RWSEM_ACTIVE_MASK) == 0)
 		rwsem_wake(sem);
@@ -125,7 +124,7 @@ __up_read (struct rw_semaphore *sem)
 static inline void
 __up_write (struct rw_semaphore *sem)
 {
-	long old, new;
+	int old, new;
 
 	do {
 		old = sem->count;
@@ -142,7 +141,7 @@ __up_write (struct rw_semaphore *sem)
 static inline int
 __down_read_trylock (struct rw_semaphore *sem)
 {
-	long tmp;
+	int tmp;
 	while ((tmp = sem->count) >= 0) {
 		if (tmp == cmpxchg_acq(&sem->count, tmp, tmp+1)) {
 			return 1;
@@ -157,7 +156,7 @@ __down_read_trylock (struct rw_semaphore *sem)
 static inline int
 __down_write_trylock (struct rw_semaphore *sem)
 {
-	long tmp = cmpxchg_acq(&sem->count, RWSEM_UNLOCKED_VALUE,
+	int tmp = cmpxchg_acq(&sem->count, RWSEM_UNLOCKED_VALUE,
 			      RWSEM_ACTIVE_WRITE_BIAS);
 	return tmp == RWSEM_UNLOCKED_VALUE;
 }
@@ -168,7 +167,7 @@ __down_write_trylock (struct rw_semaphore *sem)
 static inline void
 __downgrade_write (struct rw_semaphore *sem)
 {
-	long old, new;
+	int old, new;
 
 	do {
 		old = sem->count;
@@ -183,7 +182,7 @@ __downgrade_write (struct rw_semaphore *sem)
  * Implement atomic add functionality.  These used to be "inline" functions, but GCC v3.1
  * doesn't quite optimize this stuff right and ends up with bad calls to fetchandadd.
  */
-#define rwsem_atomic_add(delta, sem)	atomic64_add(delta, (atomic64_t *)(&(sem)->count))
-#define rwsem_atomic_update(delta, sem)	atomic64_add_return(delta, (atomic64_t *)(&(sem)->count))
+#define rwsem_atomic_add(delta, sem)	atomic_add(delta, (atomic_t *)(&(sem)->count))
+#define rwsem_atomic_update(delta, sem)	atomic_add_return(delta, (atomic_t *)(&(sem)->count))
 
 #endif /* _ASM_IA64_RWSEM_H */
diff --git a/trunk/include/asm-ia64/sn/addrs.h b/trunk/include/asm-ia64/sn/addrs.h
index 2c32e4b77b54..103d745dc5f2 100644
--- a/trunk/include/asm-ia64/sn/addrs.h
+++ b/trunk/include/asm-ia64/sn/addrs.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 1992-1999,2001-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (c) 1992-1999,2001-2004 Silicon Graphics, Inc. All rights reserved.
  */
 
 #ifndef _ASM_IA64_SN_ADDRS_H
@@ -65,6 +65,7 @@
 
 #define NASID_MASK              ((u64)NASID_BITMASK << NASID_SHIFT)
 #define AS_MASK			((u64)AS_BITMASK << AS_SHIFT)
+#define REGION_BITS		0xe000000000000000UL
 
 
 /*
@@ -78,30 +79,38 @@
 #define AS_CAC_SPACE		(AS_CAC_VAL << AS_SHIFT)
 
 
+/*
+ * Base addresses for various address ranges.
+ */
+#define CACHED			0xe000000000000000UL
+#define UNCACHED                0xc000000000000000UL
+#define UNCACHED_PHYS           0x8000000000000000UL
+
+
 /* 
  * Virtual Mode Local & Global MMR space.  
  */
 #define SH1_LOCAL_MMR_OFFSET	0x8000000000UL
 #define SH2_LOCAL_MMR_OFFSET	0x0200000000UL
 #define LOCAL_MMR_OFFSET	(is_shub2() ? SH2_LOCAL_MMR_OFFSET : SH1_LOCAL_MMR_OFFSET)
-#define LOCAL_MMR_SPACE		(__IA64_UNCACHED_OFFSET | LOCAL_MMR_OFFSET)
-#define LOCAL_PHYS_MMR_SPACE	(RGN_BASE(RGN_HPAGE) | LOCAL_MMR_OFFSET)
+#define LOCAL_MMR_SPACE		(UNCACHED | LOCAL_MMR_OFFSET)
+#define LOCAL_PHYS_MMR_SPACE	(UNCACHED_PHYS | LOCAL_MMR_OFFSET)
 
 #define SH1_GLOBAL_MMR_OFFSET	0x0800000000UL
 #define SH2_GLOBAL_MMR_OFFSET	0x0300000000UL
 #define GLOBAL_MMR_OFFSET	(is_shub2() ? SH2_GLOBAL_MMR_OFFSET : SH1_GLOBAL_MMR_OFFSET)
-#define GLOBAL_MMR_SPACE	(__IA64_UNCACHED_OFFSET | GLOBAL_MMR_OFFSET)
+#define GLOBAL_MMR_SPACE	(UNCACHED | GLOBAL_MMR_OFFSET)
 
 /*
  * Physical mode addresses
  */
-#define GLOBAL_PHYS_MMR_SPACE	(RGN_BASE(RGN_HPAGE) | GLOBAL_MMR_OFFSET)
+#define GLOBAL_PHYS_MMR_SPACE	(UNCACHED_PHYS | GLOBAL_MMR_OFFSET)
 
 
 /*
  * Clear region & AS bits.
  */
-#define TO_PHYS_MASK		(~(RGN_BITS | AS_MASK))
+#define TO_PHYS_MASK		(~(REGION_BITS | AS_MASK))
 
 
 /*
@@ -117,7 +126,6 @@
 #define GLOBAL_MMR_PHYS_ADDR(n,a) (GLOBAL_PHYS_MMR_SPACE | REMOTE_ADDR(n,a))
 #define GLOBAL_CAC_ADDR(n,a)	(CAC_BASE | REMOTE_ADDR(n,a))
 #define CHANGE_NASID(n,x)	((void *)(((u64)(x) & ~NASID_MASK) | NASID_SPACE(n)))
-#define IS_TIO_NASID(n)		((n) & 1)
 
 
 /* non-II mmr's start at top of big window space (4G) */
@@ -126,10 +134,10 @@
 /*
  * general address defines
  */
-#define CAC_BASE		(PAGE_OFFSET | AS_CAC_SPACE)
-#define AMO_BASE		(__IA64_UNCACHED_OFFSET | AS_AMO_SPACE)
-#define AMO_PHYS_BASE		(RGN_BASE(RGN_HPAGE) | AS_AMO_SPACE)
-#define GET_BASE		(PAGE_OFFSET | AS_GET_SPACE)
+#define CAC_BASE		(CACHED   | AS_CAC_SPACE)
+#define AMO_BASE		(UNCACHED | AS_AMO_SPACE)
+#define AMO_PHYS_BASE		(UNCACHED_PHYS | AS_AMO_SPACE)
+#define GET_BASE		(CACHED   | AS_GET_SPACE)
 
 /*
  * Convert Memory addresses between various addressing modes.
@@ -147,35 +155,17 @@
  *           the chiplet id is zero.  If we implement TIO-TIO dma, we might need
  *           to insert a chiplet id into this macro.  However, it is our belief
  *           right now that this chiplet id will be ICE, which is also zero.
+ *           Nasid starts on bit 40.
  */
-#define SH1_TIO_PHYS_TO_DMA(x) 						\
-	((((u64)(NASID_GET(x))) << 40) | NODE_OFFSET(x))
-
-#define SH2_NETWORK_BANK_OFFSET(x) 					\
-        ((u64)(x) & ((1UL << (sn_hub_info->nasid_shift - 4)) -1))
-
-#define SH2_NETWORK_BANK_SELECT(x) 					\
-        ((((u64)(x) & (0x3UL << (sn_hub_info->nasid_shift - 4)))	\
-        	>> (sn_hub_info->nasid_shift - 4)) << 36)
-
-#define SH2_NETWORK_ADDRESS(x) 						\
-	(SH2_NETWORK_BANK_OFFSET(x) | SH2_NETWORK_BANK_SELECT(x))
-
-#define SH2_TIO_PHYS_TO_DMA(x) 						\
-        (((u64)(NASID_GET(x)) << 40) | 	SH2_NETWORK_ADDRESS(x))
-
-#define PHYS_TO_TIODMA(x)						\
-	(is_shub1() ? SH1_TIO_PHYS_TO_DMA(x) : SH2_TIO_PHYS_TO_DMA(x))
-
-#define PHYS_TO_DMA(x)							\
-	((((u64)(x) & NASID_MASK) >> 2) | NODE_OFFSET(x))
+#define PHYS_TO_TIODMA(x)	( (((u64)(NASID_GET(x))) << 40) | NODE_OFFSET(x))
+#define PHYS_TO_DMA(x)          ( (((u64)(x) & NASID_MASK) >> 2) | NODE_OFFSET(x))
 
 
 /*
  * Macros to test for address type.
  */
-#define IS_AMO_ADDRESS(x)	(((u64)(x) & (RGN_BITS | AS_MASK)) == AMO_BASE)
-#define IS_AMO_PHYS_ADDRESS(x)	(((u64)(x) & (RGN_BITS | AS_MASK)) == AMO_PHYS_BASE)
+#define IS_AMO_ADDRESS(x)	(((u64)(x) & (REGION_BITS | AS_MASK)) == AMO_BASE)
+#define IS_AMO_PHYS_ADDRESS(x)	(((u64)(x) & (REGION_BITS | AS_MASK)) == AMO_PHYS_BASE)
 
 
 /*
@@ -190,20 +180,18 @@
 #define TIO_SWIN_BASE(n, w) 		(TIO_IO_BASE(n) + \
 					    ((u64) (w) << TIO_SWIN_SIZE_BITS))
 #define NODE_IO_BASE(n)			(GLOBAL_MMR_SPACE | NASID_SPACE(n))
-#define TIO_IO_BASE(n)                  (__IA64_UNCACHED_OFFSET | NASID_SPACE(n))
+#define TIO_IO_BASE(n)                  (UNCACHED | NASID_SPACE(n))
 #define BWIN_SIZE			(1UL << BWIN_SIZE_BITS)
 #define NODE_BWIN_BASE0(n)		(NODE_IO_BASE(n) + BWIN_SIZE)
 #define NODE_BWIN_BASE(n, w)		(NODE_BWIN_BASE0(n) + ((u64) (w) << BWIN_SIZE_BITS))
 #define RAW_NODE_SWIN_BASE(n, w)	(NODE_IO_BASE(n) + ((u64) (w) << SWIN_SIZE_BITS))
 #define BWIN_WIDGET_MASK		0x7
 #define BWIN_WINDOWNUM(x)		(((x) >> BWIN_SIZE_BITS) & BWIN_WIDGET_MASK)
-#define SH1_IS_BIG_WINDOW_ADDR(x)	((x) & BWIN_TOP)
 
 #define TIO_BWIN_WINDOW_SELECT_MASK	0x7
 #define TIO_BWIN_WINDOWNUM(x)		(((x) >> TIO_BWIN_SIZE_BITS) & TIO_BWIN_WINDOW_SELECT_MASK)
 
-#define TIO_HWIN_SHIFT_BITS		33
-#define TIO_HWIN(x)			(NODE_OFFSET(x) >> TIO_HWIN_SHIFT_BITS)
+
 
 /*
  * The following definitions pertain to the IO special address
@@ -228,6 +216,10 @@
 #define TIO_SWIN_WIDGETNUM(x)		(((x)  >> TIO_SWIN_SIZE_BITS) & TIO_SWIN_WIDGET_MASK)
 
 
+#define TIO_IOSPACE_ADDR(n,x)					\
+	/* Move in the Chiplet ID for TIO Local Block MMR */	\
+	(REMOTE_ADDR(n,x) | 1UL << (NASID_SHIFT - 2))
+
 /*
  * The following macros produce the correct base virtual address for
  * the hub registers. The REMOTE_HUB_* macro produce
@@ -242,40 +234,18 @@
  *	Otherwise, the recommended approach is to use *_HUB_L() and *_HUB_S().
  *	They're always safe.
  */
-/* Shub1 TIO & MMR addressing macros */
-#define SH1_TIO_IOSPACE_ADDR(n,x)					\
-	GLOBAL_MMR_ADDR(n,x)
-
-#define SH1_REMOTE_BWIN_MMR(n,x)					\
-	GLOBAL_MMR_ADDR(n,x)
-
-#define SH1_REMOTE_SWIN_MMR(n,x)					\
-	(NODE_SWIN_BASE(n,1) + 0x800000UL + (x))
-
-#define SH1_REMOTE_MMR(n,x)						\
-	(SH1_IS_BIG_WINDOW_ADDR(x) ? SH1_REMOTE_BWIN_MMR(n,x) :		\
-	 	SH1_REMOTE_SWIN_MMR(n,x))
-
-/* Shub1 TIO & MMR addressing macros */
-#define SH2_TIO_IOSPACE_ADDR(n,x)					\
-	((__IA64_UNCACHED_OFFSET | REMOTE_ADDR(n,x) | 1UL << (NASID_SHIFT - 2)))
-
-#define SH2_REMOTE_MMR(n,x)						\
-	GLOBAL_MMR_ADDR(n,x)
-
-
-/* TIO & MMR addressing macros that work on both shub1 & shub2 */
-#define TIO_IOSPACE_ADDR(n,x)						\
-	((u64 *)(is_shub1() ? SH1_TIO_IOSPACE_ADDR(n,x) :		\
-		 SH2_TIO_IOSPACE_ADDR(n,x)))
-
-#define SH_REMOTE_MMR(n,x)						\
-	(is_shub1() ? SH1_REMOTE_MMR(n,x) : SH2_REMOTE_MMR(n,x))
-
 #define REMOTE_HUB_ADDR(n,x)						\
-	(IS_TIO_NASID(n) ?  ((volatile u64*)TIO_IOSPACE_ADDR(n,x)) :	\
-	 ((volatile u64*)SH_REMOTE_MMR(n,x)))
-
+	((n & 1) ?							\
+	/* TIO: */							\
+	(is_shub2() ?							\
+	/* TIO on Shub2 */						\
+	(volatile u64 *)(TIO_IOSPACE_ADDR(n,x))				\
+	: /* TIO on shub1 */						\
+	(volatile u64 *)(GLOBAL_MMR_ADDR(n,x)))				\
+									\
+	: /* SHUB1 and SHUB2 MMRs: */					\
+	(((x) & BWIN_TOP) ? ((volatile u64 *)(GLOBAL_MMR_ADDR(n,x)))	\
+	: ((volatile u64 *)(NODE_SWIN_BASE(n,1) + 0x800000 + (x)))))
 
 #define HUB_L(x)			(*((volatile typeof(*x) *)x))
 #define	HUB_S(x,d)			(*((volatile typeof(*x) *)x) = (d))
diff --git a/trunk/include/asm-ia64/sn/geo.h b/trunk/include/asm-ia64/sn/geo.h
index f083c9434066..84b254603b8d 100644
--- a/trunk/include/asm-ia64/sn/geo.h
+++ b/trunk/include/asm-ia64/sn/geo.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1992 - 1997, 2000-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 1992 - 1997, 2000-2004 Silicon Graphics, Inc. All rights reserved.
  */
 
 #ifndef _ASM_IA64_SN_GEO_H
@@ -108,6 +108,7 @@ typedef union geoid_u {
 #define INVALID_SLAB            (slabid_t)-1
 #define INVALID_SLOT            (slotid_t)-1
 #define INVALID_MODULE          ((moduleid_t)-1)
+#define INVALID_PARTID          ((partid_t)-1)
 
 static inline slabid_t geo_slab(geoid_t g)
 {
diff --git a/trunk/include/asm-ia64/sn/intr.h b/trunk/include/asm-ia64/sn/intr.h
index e35074f526d9..e190dd4213d5 100644
--- a/trunk/include/asm-ia64/sn/intr.h
+++ b/trunk/include/asm-ia64/sn/intr.h
@@ -12,12 +12,13 @@
 #include <linux/rcupdate.h>
 
 #define SGI_UART_VECTOR		(0xe9)
+#define SGI_PCIBR_ERROR		(0x33)
 
 /* Reserved IRQs : Note, not to exceed IA64_SN2_FIRST_DEVICE_VECTOR */
 #define SGI_XPC_ACTIVATE                (0x30)
 #define SGI_II_ERROR                    (0x31)
 #define SGI_XBOW_ERROR                  (0x32)
-#define SGI_PCIASIC_ERROR               (0x33)
+#define SGI_PCIBR_ERROR                 (0x33)
 #define SGI_ACPI_SCI_INT                (0x34)
 #define SGI_TIOCA_ERROR                 (0x35)
 #define SGI_TIO_ERROR                   (0x36)
diff --git a/trunk/include/asm-ia64/sn/nodepda.h b/trunk/include/asm-ia64/sn/nodepda.h
index 47bb8100fd00..7138b1eafd6b 100644
--- a/trunk/include/asm-ia64/sn/nodepda.h
+++ b/trunk/include/asm-ia64/sn/nodepda.h
@@ -37,6 +37,7 @@ struct phys_cpuid {
 
 struct nodepda_s {
 	void 		*pdinfo;	/* Platform-dependent per-node info */
+	spinlock_t		bist_lock;
 
 	/*
 	 * The BTEs on this node are shared by the local cpus
@@ -54,8 +55,6 @@ struct nodepda_s {
 	 * Array of physical cpu identifiers. Indexed by cpuid.
 	 */
 	struct phys_cpuid	phys_cpuid[NR_CPUS];
-	spinlock_t		ptc_lock ____cacheline_aligned_in_smp;
-	spinlock_t		bist_lock;
 };
 
 typedef struct nodepda_s nodepda_t;
diff --git a/trunk/include/asm-ia64/sn/pcibus_provider_defs.h b/trunk/include/asm-ia64/sn/pcibus_provider_defs.h
index ad0e8e8ae53f..976f5eff0539 100644
--- a/trunk/include/asm-ia64/sn/pcibus_provider_defs.h
+++ b/trunk/include/asm-ia64/sn/pcibus_provider_defs.h
@@ -18,9 +18,8 @@
 #define PCIIO_ASIC_TYPE_PIC	2
 #define PCIIO_ASIC_TYPE_TIOCP	3
 #define PCIIO_ASIC_TYPE_TIOCA	4
-#define PCIIO_ASIC_TYPE_TIOCE	5
 
-#define PCIIO_ASIC_MAX_TYPES	6
+#define PCIIO_ASIC_MAX_TYPES	5
 
 /*
  * Common pciio bus provider data.  There should be one of these as the
@@ -31,8 +30,7 @@
 struct pcibus_bussoft {
 	uint32_t		bs_asic_type;	/* chipset type */
 	uint32_t		bs_xid;		/* xwidget id */
-	uint32_t		bs_persist_busnum; /* Persistent Bus Number */
-	uint32_t		bs_persist_segment; /* Segment Number */
+	uint64_t		bs_persist_busnum; /* Persistent Bus Number */
 	uint64_t		bs_legacy_io;	/* legacy io pio addr */
 	uint64_t		bs_legacy_mem;	/* legacy mem pio addr */
 	uint64_t		bs_base;	/* widget base */
@@ -49,8 +47,6 @@ struct sn_pcibus_provider {
 	dma_addr_t	(*dma_map_consistent)(struct pci_dev *, unsigned long, size_t);
 	void		(*dma_unmap)(struct pci_dev *, dma_addr_t, int);
 	void *		(*bus_fixup)(struct pcibus_bussoft *, struct pci_controller *);
- 	void		(*force_interrupt)(struct sn_irq_info *);
- 	void		(*target_interrupt)(struct sn_irq_info *);
 };
 
 extern struct sn_pcibus_provider *sn_pci_provider[];
diff --git a/trunk/include/asm-ia64/sn/pda.h b/trunk/include/asm-ia64/sn/pda.h
index 1c5108d44d8b..ea5590c76ca4 100644
--- a/trunk/include/asm-ia64/sn/pda.h
+++ b/trunk/include/asm-ia64/sn/pda.h
@@ -39,6 +39,7 @@ typedef struct pda_s {
 	unsigned long pio_write_status_val;
 	volatile unsigned long *pio_shub_war_cam_addr;
 
+	unsigned long	sn_soft_irr[4];
 	unsigned long	sn_in_service_ivecs[4];
 	int		sn_lb_int_war_ticks;
 	int		sn_last_irq;
diff --git a/trunk/include/asm-ia64/sn/sn2/sn_hwperf.h b/trunk/include/asm-ia64/sn/sn2/sn_hwperf.h
index 291ef3d69da2..df75f4c4aec3 100644
--- a/trunk/include/asm-ia64/sn/sn2/sn_hwperf.h
+++ b/trunk/include/asm-ia64/sn/sn2/sn_hwperf.h
@@ -43,7 +43,6 @@ struct sn_hwperf_object_info {
 
 /* macros for object classification */
 #define SN_HWPERF_IS_NODE(x)		((x) && strstr((x)->name, "SHub"))
-#define SN_HWPERF_IS_NODE_SHUB2(x)	((x) && strstr((x)->name, "SHub 2."))
 #define SN_HWPERF_IS_IONODE(x)		((x) && strstr((x)->name, "TIO"))
 #define SN_HWPERF_IS_ROUTER(x)		((x) && strstr((x)->name, "Router"))
 #define SN_HWPERF_IS_NL3ROUTER(x)	((x) && strstr((x)->name, "NL3Router"))
@@ -215,15 +214,6 @@ struct sn_hwperf_ioctl_args {
  */
 #define SN_HWPERF_GET_NODE_NASID	(102|SN_HWPERF_OP_MEM_COPYOUT)
 
-/*
- * Given a node id, determine the id of the nearest node with CPUs
- * and the id of the nearest node that has memory. The argument
- * node would normally be a "headless" node, e.g. an "IO node".
- * Return 0 on success.
- */
-extern int sn_hwperf_get_nearest_node(cnodeid_t node,
-	cnodeid_t *near_mem, cnodeid_t *near_cpu);
-
 /* return codes */
 #define SN_HWPERF_OP_OK			0
 #define SN_HWPERF_OP_NOMEM		1
diff --git a/trunk/include/asm-ia64/sn/sn_sal.h b/trunk/include/asm-ia64/sn/sn_sal.h
index e67825ad1930..27976d223186 100644
--- a/trunk/include/asm-ia64/sn/sn_sal.h
+++ b/trunk/include/asm-ia64/sn/sn_sal.h
@@ -55,6 +55,7 @@
 #define  SN_SAL_BUS_CONFIG		   	   0x02000037
 #define  SN_SAL_SYS_SERIAL_GET			   0x02000038
 #define  SN_SAL_PARTITION_SERIAL_GET		   0x02000039
+#define  SN_SAL_SYSCTL_PARTITION_GET		   0x0200003a
 #define  SN_SAL_SYSTEM_POWER_DOWN		   0x0200003b
 #define  SN_SAL_GET_MASTER_BASEIO_NASID		   0x0200003c
 #define  SN_SAL_COHERENCE                          0x0200003d
@@ -77,8 +78,7 @@
 
 #define SN_SAL_HUB_ERROR_INTERRUPT		   0x02000060
 #define SN_SAL_BTE_RECOVER			   0x02000061
-#define SN_SAL_RESERVED_DO_NOT_USE		   0x02000062
-#define SN_SAL_IOIF_GET_PCI_TOPOLOGY		   0x02000064
+#define SN_SAL_IOIF_GET_PCI_TOPOLOGY	           0x02000062
 
 /*
  * Service-specific constants
@@ -585,6 +585,35 @@ sn_partition_serial_number_val(void) {
 	return sn_partition_serial_number;
 }
 
+/*
+ * Returns the partition id of the nasid passed in as an argument,
+ * or INVALID_PARTID if the partition id cannot be retrieved.
+ */
+static inline partid_t
+ia64_sn_sysctl_partition_get(nasid_t nasid)
+{
+	struct ia64_sal_retval ret_stuff;
+	ia64_sal_oemcall_nolock(&ret_stuff, SN_SAL_SYSCTL_PARTITION_GET, nasid,
+				0, 0, 0, 0, 0, 0);
+	if (ret_stuff.status != 0)
+	    return INVALID_PARTID;
+	return ((partid_t)ret_stuff.v0);
+}
+
+/*
+ * Returns the partition id of the current processor.
+ */
+
+extern partid_t sn_partid;
+
+static inline partid_t
+sn_local_partid(void) {
+	if (unlikely(sn_partid < 0)) {
+		sn_partid = ia64_sn_sysctl_partition_get(cpuid_to_nasid(smp_processor_id()));
+	}
+	return sn_partid;
+}
+
 /*
  * Returns the physical address of the partition's reserved page through
  * an iterative number of calls.
@@ -720,8 +749,7 @@ ia64_sn_power_down(void)
 {
 	struct ia64_sal_retval ret_stuff;
 	SAL_CALL(ret_stuff, SN_SAL_SYSTEM_POWER_DOWN, 0, 0, 0, 0, 0, 0, 0);
-	while(1)
-		cpu_relax();
+	while(1);
 	/* never returns */
 }
 
@@ -990,6 +1018,24 @@ ia64_sn_get_sn_info(int fc, u8 *shubtype, u16 *nasid_bitmask, u8 *nasid_shift,
 	ret_stuff.v2 = 0;
 	SAL_CALL_NOLOCK(ret_stuff, SN_SAL_GET_SN_INFO, fc, 0, 0, 0, 0, 0, 0);
 
+/***** BEGIN HACK - temp til old proms no longer supported ********/
+	if (ret_stuff.status == SALRET_NOT_IMPLEMENTED) {
+		int nasid = get_sapicid() & 0xfff;;
+#define SH_SHUB_ID_NODES_PER_BIT_MASK 0x001f000000000000UL                                               
+#define SH_SHUB_ID_NODES_PER_BIT_SHFT 48                                                               
+		if (shubtype) *shubtype = 0;
+		if (nasid_bitmask) *nasid_bitmask = 0x7ff;
+		if (nasid_shift) *nasid_shift = 38;
+		if (systemsize) *systemsize = 11;
+		if (sharing_domain_size) *sharing_domain_size = 9;
+		if (partid) *partid = ia64_sn_sysctl_partition_get(nasid);
+		if (coher) *coher = nasid >> 9;
+		if (reg) *reg = (HUB_L((u64 *) LOCAL_MMR_ADDR(SH1_SHUB_ID)) & SH_SHUB_ID_NODES_PER_BIT_MASK) >>
+			SH_SHUB_ID_NODES_PER_BIT_SHFT;
+		return 0;
+	}
+/***** END HACK *******/
+
 	if (ret_stuff.status < 0)
 		return ret_stuff.status;
 
@@ -1022,10 +1068,12 @@ ia64_sn_hwperf_op(nasid_t nasid, u64 opcode, u64 a0, u64 a1, u64 a2,
 }
 
 static inline int
-ia64_sn_ioif_get_pci_topology(u64 buf, u64 len)
+ia64_sn_ioif_get_pci_topology(u64 rack, u64 bay, u64 slot, u64 slab,
+			      u64 buf, u64 len)
 {
 	struct ia64_sal_retval rv;
-	SAL_CALL_NOLOCK(rv, SN_SAL_IOIF_GET_PCI_TOPOLOGY, buf, len, 0, 0, 0, 0, 0);
+	SAL_CALL_NOLOCK(rv, SN_SAL_IOIF_GET_PCI_TOPOLOGY,
+		rack, bay, slot, slab, buf, len, 0);
 	return (int) rv.status;
 }
 
diff --git a/trunk/include/asm-ia64/sn/tioce.h b/trunk/include/asm-ia64/sn/tioce.h
deleted file mode 100644
index 22879853e46c..000000000000
--- a/trunk/include/asm-ia64/sn/tioce.h
+++ /dev/null
@@ -1,740 +0,0 @@
-/**************************************************************************
- *                                                                        *
- *  Unpublished copyright (c) 2005, Silicon Graphics, Inc.                *
- *  THIS IS UNPUBLISHED CONFIDENTIAL AND PROPRIETARY SOURCE CODE OF SGI.  *
- *                                                                        *
- *  The copyright notice above does  not evidence any actual or intended  *
- *  publication  or  disclosure  of  this source  code,  which  includes  *
- *  information that is confidential  and/or proprietary, and is a trade  *
- *  secret, of  Silicon Graphics, Inc.   ANY REPRODUCTION, MODIFICATION,  *
- *  DISTRIBUTION, PUBLIC  PERFORMANCE, OR  PUBLIC DISPLAY OF  OR THROUGH  *
- *  USE  OF THIS  SOURCE CODE  WITHOUT  THE EXPRESS  WRITTEN CONSENT  OF  *
- *  SILICON GRAPHICS, INC.  IS  STRICTLY PROHIBITED, AND IN VIOLATION OF  *
- *  APPLICABLE  LAWS   AND  INTERNATIONAL  TREATIES.    THE  RECEIPT  OR  *
- *  POSSESSION OF  THIS SOURCE CODE AND/OR RELATED  INFORMATION DOES NOT  *
- *  CONVEY OR IMPLY ANY RIGHTS  TO REPRODUCE, DISCLOSE OR DISTRIBUTE ITS  *
- *  CONTENTS,  OR TO  MANUFACTURE, USE,  OR  SELL ANYTHING  THAT IT  MAY  *
- *  DESCRIBE, IN WHOLE OR IN PART.                                        *
- *                                                                        *
- **************************************************************************/
-
-#ifndef __ASM_IA64_SN_TIOCE_H__
-#define __ASM_IA64_SN_TIOCE_H__
-
-/* CE ASIC part & mfgr information  */
-#define TIOCE_PART_NUM			0xCE00
-#define TIOCE_MFGR_NUM			0x36
-#define TIOCE_REV_A			0x1
-
-/* CE Virtual PPB Vendor/Device IDs */
-#define CE_VIRT_PPB_VENDOR_ID		0x10a9
-#define CE_VIRT_PPB_DEVICE_ID		0x4002
-
-/* CE Host Bridge Vendor/Device IDs */
-#define CE_HOST_BRIDGE_VENDOR_ID	0x10a9
-#define CE_HOST_BRIDGE_DEVICE_ID	0x4003
-
-
-#define TIOCE_NUM_M40_ATES		4096
-#define TIOCE_NUM_M3240_ATES		2048
-#define TIOCE_NUM_PORTS			2
-
-/*
- * Register layout for TIOCE.  MMR offsets are shown at the far right of the
- * structure definition.
- */
-typedef volatile struct tioce {
-	/*
-	 * ADMIN : Administration Registers
-	 */
-	uint64_t	ce_adm_id;				/* 0x000000 */
-	uint64_t	ce_pad_000008;				/* 0x000008 */
-	uint64_t	ce_adm_dyn_credit_status;		/* 0x000010 */
-	uint64_t	ce_adm_last_credit_status;		/* 0x000018 */
-	uint64_t	ce_adm_credit_limit;			/* 0x000020 */
-	uint64_t	ce_adm_force_credit;			/* 0x000028 */
-	uint64_t	ce_adm_control;				/* 0x000030 */
-	uint64_t	ce_adm_mmr_chn_timeout;			/* 0x000038 */
-	uint64_t	ce_adm_ssp_ure_timeout;			/* 0x000040 */
-	uint64_t	ce_adm_ssp_dre_timeout;			/* 0x000048 */
-	uint64_t	ce_adm_ssp_debug_sel;			/* 0x000050 */
-	uint64_t	ce_adm_int_status;			/* 0x000058 */
-	uint64_t	ce_adm_int_status_alias;		/* 0x000060 */
-	uint64_t	ce_adm_int_mask;			/* 0x000068 */
-	uint64_t	ce_adm_int_pending;			/* 0x000070 */
-	uint64_t	ce_adm_force_int;			/* 0x000078 */
-	uint64_t	ce_adm_ure_ups_buf_barrier_flush;	/* 0x000080 */
-	uint64_t	ce_adm_int_dest[15];	    /* 0x000088 -- 0x0000F8 */
-	uint64_t	ce_adm_error_summary;			/* 0x000100 */
-	uint64_t	ce_adm_error_summary_alias;		/* 0x000108 */
-	uint64_t	ce_adm_error_mask;			/* 0x000110 */
-	uint64_t	ce_adm_first_error;			/* 0x000118 */
-	uint64_t	ce_adm_error_overflow;			/* 0x000120 */
-	uint64_t	ce_adm_error_overflow_alias;		/* 0x000128 */
-	uint64_t	ce_pad_000130[2];	    /* 0x000130 -- 0x000138 */
-	uint64_t	ce_adm_tnum_error;			/* 0x000140 */
-	uint64_t	ce_adm_mmr_err_detail;			/* 0x000148 */
-	uint64_t	ce_adm_msg_sram_perr_detail;		/* 0x000150 */
-	uint64_t	ce_adm_bap_sram_perr_detail;		/* 0x000158 */
-	uint64_t	ce_adm_ce_sram_perr_detail;		/* 0x000160 */
-	uint64_t	ce_adm_ce_credit_oflow_detail;		/* 0x000168 */
-	uint64_t	ce_adm_tx_link_idle_max_timer;		/* 0x000170 */
-	uint64_t	ce_adm_pcie_debug_sel;			/* 0x000178 */
-	uint64_t	ce_pad_000180[16];	    /* 0x000180 -- 0x0001F8 */
-
-	uint64_t	ce_adm_pcie_debug_sel_top;		/* 0x000200 */
-	uint64_t	ce_adm_pcie_debug_lat_sel_lo_top;	/* 0x000208 */
-	uint64_t	ce_adm_pcie_debug_lat_sel_hi_top;	/* 0x000210 */
-	uint64_t	ce_adm_pcie_debug_trig_sel_top;		/* 0x000218 */
-	uint64_t	ce_adm_pcie_debug_trig_lat_sel_lo_top;	/* 0x000220 */
-	uint64_t	ce_adm_pcie_debug_trig_lat_sel_hi_top;	/* 0x000228 */
-	uint64_t	ce_adm_pcie_trig_compare_top;		/* 0x000230 */
-	uint64_t	ce_adm_pcie_trig_compare_en_top;	/* 0x000238 */
-	uint64_t	ce_adm_ssp_debug_sel_top;		/* 0x000240 */
-	uint64_t	ce_adm_ssp_debug_lat_sel_lo_top;	/* 0x000248 */
-	uint64_t	ce_adm_ssp_debug_lat_sel_hi_top;	/* 0x000250 */
-	uint64_t	ce_adm_ssp_debug_trig_sel_top;		/* 0x000258 */
-	uint64_t	ce_adm_ssp_debug_trig_lat_sel_lo_top;	/* 0x000260 */
-	uint64_t	ce_adm_ssp_debug_trig_lat_sel_hi_top;	/* 0x000268 */
-	uint64_t	ce_adm_ssp_trig_compare_top;		/* 0x000270 */
-	uint64_t	ce_adm_ssp_trig_compare_en_top;		/* 0x000278 */
-	uint64_t	ce_pad_000280[48];	    /* 0x000280 -- 0x0003F8 */
-
-	uint64_t	ce_adm_bap_ctrl;			/* 0x000400 */
-	uint64_t	ce_pad_000408[127];	    /* 0x000408 -- 0x0007F8 */
-
-	uint64_t	ce_msg_buf_data63_0[35];    /* 0x000800 -- 0x000918 */
-	uint64_t	ce_pad_000920[29];	    /* 0x000920 -- 0x0009F8 */
-
-	uint64_t	ce_msg_buf_data127_64[35];  /* 0x000A00 -- 0x000B18 */
-	uint64_t	ce_pad_000B20[29];	    /* 0x000B20 -- 0x000BF8 */
-
-	uint64_t	ce_msg_buf_parity[35];	    /* 0x000C00 -- 0x000D18 */
-	uint64_t	ce_pad_000D20[29];	    /* 0x000D20 -- 0x000DF8 */
-
-	uint64_t	ce_pad_000E00[576];	    /* 0x000E00 -- 0x001FF8 */
-
-	/*
-	 * LSI : LSI's PCI Express Link Registers (Link#1 and Link#2)
-	 * Link#1 MMRs at start at 0x002000, Link#2 MMRs at 0x003000
-	 * NOTE: the comment offsets at far right: let 'z' = {2 or 3}
-	 */
-	#define ce_lsi(link_num)	ce_lsi[link_num-1]
-	struct ce_lsi_reg {
-		uint64_t	ce_lsi_lpu_id;			/* 0x00z000 */
-		uint64_t	ce_lsi_rst;			/* 0x00z008 */
-		uint64_t	ce_lsi_dbg_stat;		/* 0x00z010 */
-		uint64_t	ce_lsi_dbg_cfg;			/* 0x00z018 */
-		uint64_t	ce_lsi_ltssm_ctrl;		/* 0x00z020 */
-		uint64_t	ce_lsi_lk_stat;			/* 0x00z028 */
-		uint64_t	ce_pad_00z030[2];   /* 0x00z030 -- 0x00z038 */
-		uint64_t	ce_lsi_int_and_stat;		/* 0x00z040 */
-		uint64_t	ce_lsi_int_mask;		/* 0x00z048 */
-		uint64_t	ce_pad_00z050[22];  /* 0x00z050 -- 0x00z0F8 */
-		uint64_t	ce_lsi_lk_perf_cnt_sel;		/* 0x00z100 */
-		uint64_t	ce_pad_00z108;			/* 0x00z108 */
-		uint64_t	ce_lsi_lk_perf_cnt_ctrl;	/* 0x00z110 */
-		uint64_t	ce_pad_00z118;			/* 0x00z118 */
-		uint64_t	ce_lsi_lk_perf_cnt1;		/* 0x00z120 */
-		uint64_t	ce_lsi_lk_perf_cnt1_test;	/* 0x00z128 */
-		uint64_t	ce_lsi_lk_perf_cnt2;		/* 0x00z130 */
-		uint64_t	ce_lsi_lk_perf_cnt2_test;	/* 0x00z138 */
-		uint64_t	ce_pad_00z140[24];  /* 0x00z140 -- 0x00z1F8 */
-		uint64_t	ce_lsi_lk_lyr_cfg;		/* 0x00z200 */
-		uint64_t	ce_lsi_lk_lyr_status;		/* 0x00z208 */
-		uint64_t	ce_lsi_lk_lyr_int_stat;		/* 0x00z210 */
-		uint64_t	ce_lsi_lk_ly_int_stat_test;	/* 0x00z218 */
-		uint64_t	ce_lsi_lk_ly_int_stat_mask;	/* 0x00z220 */
-		uint64_t	ce_pad_00z228[3];   /* 0x00z228 -- 0x00z238 */
-		uint64_t	ce_lsi_fc_upd_ctl;		/* 0x00z240 */
-		uint64_t	ce_pad_00z248[3];   /* 0x00z248 -- 0x00z258 */
-		uint64_t	ce_lsi_flw_ctl_upd_to_timer;	/* 0x00z260 */
-		uint64_t	ce_lsi_flw_ctl_upd_timer0;	/* 0x00z268 */
-		uint64_t	ce_lsi_flw_ctl_upd_timer1;	/* 0x00z270 */
-		uint64_t	ce_pad_00z278[49];  /* 0x00z278 -- 0x00z3F8 */
-		uint64_t	ce_lsi_freq_nak_lat_thrsh;	/* 0x00z400 */
-		uint64_t	ce_lsi_ack_nak_lat_tmr;		/* 0x00z408 */
-		uint64_t	ce_lsi_rply_tmr_thr;		/* 0x00z410 */
-		uint64_t	ce_lsi_rply_tmr;		/* 0x00z418 */
-		uint64_t	ce_lsi_rply_num_stat;		/* 0x00z420 */
-		uint64_t	ce_lsi_rty_buf_max_addr;	/* 0x00z428 */
-		uint64_t	ce_lsi_rty_fifo_ptr;		/* 0x00z430 */
-		uint64_t	ce_lsi_rty_fifo_rd_wr_ptr;	/* 0x00z438 */
-		uint64_t	ce_lsi_rty_fifo_cred;		/* 0x00z440 */
-		uint64_t	ce_lsi_seq_cnt;			/* 0x00z448 */
-		uint64_t	ce_lsi_ack_sent_seq_num;	/* 0x00z450 */
-		uint64_t	ce_lsi_seq_cnt_fifo_max_addr;	/* 0x00z458 */
-		uint64_t	ce_lsi_seq_cnt_fifo_ptr;	/* 0x00z460 */
-		uint64_t	ce_lsi_seq_cnt_rd_wr_ptr;	/* 0x00z468 */
-		uint64_t	ce_lsi_tx_lk_ts_ctl;		/* 0x00z470 */
-		uint64_t	ce_pad_00z478;			/* 0x00z478 */
-		uint64_t	ce_lsi_mem_addr_ctl;		/* 0x00z480 */
-		uint64_t	ce_lsi_mem_d_ld0;		/* 0x00z488 */
-		uint64_t	ce_lsi_mem_d_ld1;		/* 0x00z490 */
-		uint64_t	ce_lsi_mem_d_ld2;		/* 0x00z498 */
-		uint64_t	ce_lsi_mem_d_ld3;		/* 0x00z4A0 */
-		uint64_t	ce_lsi_mem_d_ld4;		/* 0x00z4A8 */
-		uint64_t	ce_pad_00z4B0[2];   /* 0x00z4B0 -- 0x00z4B8 */
-		uint64_t	ce_lsi_rty_d_cnt;		/* 0x00z4C0 */
-		uint64_t	ce_lsi_seq_buf_cnt;		/* 0x00z4C8 */
-		uint64_t	ce_lsi_seq_buf_bt_d;		/* 0x00z4D0 */
-		uint64_t	ce_pad_00z4D8;			/* 0x00z4D8 */
-		uint64_t	ce_lsi_ack_lat_thr;		/* 0x00z4E0 */
-		uint64_t	ce_pad_00z4E8[3];   /* 0x00z4E8 -- 0x00z4F8 */
-		uint64_t	ce_lsi_nxt_rcv_seq_1_cntr;	/* 0x00z500 */
-		uint64_t	ce_lsi_unsp_dllp_rcvd;		/* 0x00z508 */
-		uint64_t	ce_lsi_rcv_lk_ts_ctl;		/* 0x00z510 */
-		uint64_t	ce_pad_00z518[29];  /* 0x00z518 -- 0x00z5F8 */
-		uint64_t	ce_lsi_phy_lyr_cfg;		/* 0x00z600 */
-		uint64_t	ce_pad_00z608;			/* 0x00z608 */
-		uint64_t	ce_lsi_phy_lyr_int_stat;	/* 0x00z610 */
-		uint64_t	ce_lsi_phy_lyr_int_stat_test;	/* 0x00z618 */
-		uint64_t	ce_lsi_phy_lyr_int_mask;	/* 0x00z620 */
-		uint64_t	ce_pad_00z628[11];  /* 0x00z628 -- 0x00z678 */
-		uint64_t	ce_lsi_rcv_phy_cfg;		/* 0x00z680 */
-		uint64_t	ce_lsi_rcv_phy_stat1;		/* 0x00z688 */
-		uint64_t	ce_lsi_rcv_phy_stat2;		/* 0x00z690 */
-		uint64_t	ce_lsi_rcv_phy_stat3;		/* 0x00z698 */
-		uint64_t	ce_lsi_rcv_phy_int_stat;	/* 0x00z6A0 */
-		uint64_t	ce_lsi_rcv_phy_int_stat_test;	/* 0x00z6A8 */
-		uint64_t	ce_lsi_rcv_phy_int_mask;	/* 0x00z6B0 */
-		uint64_t	ce_pad_00z6B8[9];   /* 0x00z6B8 -- 0x00z6F8 */
-		uint64_t	ce_lsi_tx_phy_cfg;		/* 0x00z700 */
-		uint64_t	ce_lsi_tx_phy_stat;		/* 0x00z708 */
-		uint64_t	ce_lsi_tx_phy_int_stat;		/* 0x00z710 */
-		uint64_t	ce_lsi_tx_phy_int_stat_test;	/* 0x00z718 */
-		uint64_t	ce_lsi_tx_phy_int_mask;		/* 0x00z720 */
-		uint64_t	ce_lsi_tx_phy_stat2;		/* 0x00z728 */
-		uint64_t	ce_pad_00z730[10];  /* 0x00z730 -- 0x00z77F */
-		uint64_t	ce_lsi_ltssm_cfg1;		/* 0x00z780 */
-		uint64_t	ce_lsi_ltssm_cfg2;		/* 0x00z788 */
-		uint64_t	ce_lsi_ltssm_cfg3;		/* 0x00z790 */
-		uint64_t	ce_lsi_ltssm_cfg4;		/* 0x00z798 */
-		uint64_t	ce_lsi_ltssm_cfg5;		/* 0x00z7A0 */
-		uint64_t	ce_lsi_ltssm_stat1;		/* 0x00z7A8 */
-		uint64_t	ce_lsi_ltssm_stat2;		/* 0x00z7B0 */
-		uint64_t	ce_lsi_ltssm_int_stat;		/* 0x00z7B8 */
-		uint64_t	ce_lsi_ltssm_int_stat_test;	/* 0x00z7C0 */
-		uint64_t	ce_lsi_ltssm_int_mask;		/* 0x00z7C8 */
-		uint64_t	ce_lsi_ltssm_stat_wr_en;	/* 0x00z7D0 */
-		uint64_t	ce_pad_00z7D8[5];   /* 0x00z7D8 -- 0x00z7F8 */
-		uint64_t	ce_lsi_gb_cfg1;			/* 0x00z800 */
-		uint64_t	ce_lsi_gb_cfg2;			/* 0x00z808 */
-		uint64_t	ce_lsi_gb_cfg3;			/* 0x00z810 */
-		uint64_t	ce_lsi_gb_cfg4;			/* 0x00z818 */
-		uint64_t	ce_lsi_gb_stat;			/* 0x00z820 */
-		uint64_t	ce_lsi_gb_int_stat;		/* 0x00z828 */
-		uint64_t	ce_lsi_gb_int_stat_test;	/* 0x00z830 */
-		uint64_t	ce_lsi_gb_int_mask;		/* 0x00z838 */
-		uint64_t	ce_lsi_gb_pwr_dn1;		/* 0x00z840 */
-		uint64_t	ce_lsi_gb_pwr_dn2;		/* 0x00z848 */
-		uint64_t	ce_pad_00z850[246]; /* 0x00z850 -- 0x00zFF8 */
-	} ce_lsi[2];
-
-	uint64_t	ce_pad_004000[10];	    /* 0x004000 -- 0x004048 */
-
-	/*
-	 * CRM: Coretalk Receive Module Registers
-	 */
-	uint64_t	ce_crm_debug_mux;			/* 0x004050 */
-	uint64_t	ce_pad_004058;				/* 0x004058 */
-	uint64_t	ce_crm_ssp_err_cmd_wrd;			/* 0x004060 */
-	uint64_t	ce_crm_ssp_err_addr;			/* 0x004068 */
-	uint64_t	ce_crm_ssp_err_syn;			/* 0x004070 */
-
-	uint64_t	ce_pad_004078[499];	    /* 0x004078 -- 0x005008 */
-
-	/*
-         * CXM: Coretalk Xmit Module Registers
-         */
-	uint64_t	ce_cxm_dyn_credit_status;		/* 0x005010 */
-	uint64_t	ce_cxm_last_credit_status;		/* 0x005018 */
-	uint64_t	ce_cxm_credit_limit;			/* 0x005020 */
-	uint64_t	ce_cxm_force_credit;			/* 0x005028 */
-	uint64_t	ce_cxm_disable_bypass;			/* 0x005030 */
-	uint64_t	ce_pad_005038[3];	    /* 0x005038 -- 0x005048 */
-	uint64_t	ce_cxm_debug_mux;			/* 0x005050 */
-
-        uint64_t        ce_pad_005058[501];         /* 0x005058 -- 0x005FF8 */
-
-	/*
-	 * DTL: Downstream Transaction Layer Regs (Link#1 and Link#2)
-	 * DTL: Link#1 MMRs at start at 0x006000, Link#2 MMRs at 0x008000
-	 * DTL: the comment offsets at far right: let 'y' = {6 or 8}
-	 *
-	 * UTL: Downstream Transaction Layer Regs (Link#1 and Link#2)
-	 * UTL: Link#1 MMRs at start at 0x007000, Link#2 MMRs at 0x009000
-	 * UTL: the comment offsets at far right: let 'z' = {7 or 9}
-	 */
-	#define ce_dtl(link_num)	ce_dtl_utl[link_num-1]
-	#define ce_utl(link_num)	ce_dtl_utl[link_num-1]
-	struct ce_dtl_utl_reg {
-		/* DTL */
-		uint64_t	ce_dtl_dtdr_credit_limit;	/* 0x00y000 */
-		uint64_t	ce_dtl_dtdr_credit_force;	/* 0x00y008 */
-		uint64_t	ce_dtl_dyn_credit_status;	/* 0x00y010 */
-		uint64_t	ce_dtl_dtl_last_credit_stat;	/* 0x00y018 */
-		uint64_t	ce_dtl_dtl_ctrl;		/* 0x00y020 */
-		uint64_t	ce_pad_00y028[5];   /* 0x00y028 -- 0x00y048 */
-		uint64_t	ce_dtl_debug_sel;		/* 0x00y050 */
-		uint64_t	ce_pad_00y058[501]; /* 0x00y058 -- 0x00yFF8 */
-
-		/* UTL */
-		uint64_t	ce_utl_utl_ctrl;		/* 0x00z000 */
-		uint64_t	ce_utl_debug_sel;		/* 0x00z008 */
-		uint64_t	ce_pad_00z010[510]; /* 0x00z010 -- 0x00zFF8 */
-	} ce_dtl_utl[2];
-
-	uint64_t	ce_pad_00A000[514];	    /* 0x00A000 -- 0x00B008 */
-
-	/*
-	 * URE: Upstream Request Engine
-         */
-	uint64_t	ce_ure_dyn_credit_status;		/* 0x00B010 */
-	uint64_t	ce_ure_last_credit_status;		/* 0x00B018 */
-	uint64_t	ce_ure_credit_limit;			/* 0x00B020 */
-	uint64_t	ce_pad_00B028;				/* 0x00B028 */
-	uint64_t	ce_ure_control;				/* 0x00B030 */
-	uint64_t	ce_ure_status;				/* 0x00B038 */
-	uint64_t	ce_pad_00B040[2];	    /* 0x00B040 -- 0x00B048 */
-	uint64_t	ce_ure_debug_sel;			/* 0x00B050 */
-	uint64_t	ce_ure_pcie_debug_sel;			/* 0x00B058 */
-	uint64_t	ce_ure_ssp_err_cmd_wrd;			/* 0x00B060 */
-	uint64_t	ce_ure_ssp_err_addr;			/* 0x00B068 */
-	uint64_t	ce_ure_page_map;			/* 0x00B070 */
-	uint64_t	ce_ure_dir_map[TIOCE_NUM_PORTS];	/* 0x00B078 */
-	uint64_t	ce_ure_pipe_sel1;			/* 0x00B088 */
-	uint64_t	ce_ure_pipe_mask1;			/* 0x00B090 */
-	uint64_t	ce_ure_pipe_sel2;			/* 0x00B098 */
-	uint64_t	ce_ure_pipe_mask2;			/* 0x00B0A0 */
-	uint64_t	ce_ure_pcie1_credits_sent;		/* 0x00B0A8 */
-	uint64_t	ce_ure_pcie1_credits_used;		/* 0x00B0B0 */
-	uint64_t	ce_ure_pcie1_credit_limit;		/* 0x00B0B8 */
-	uint64_t	ce_ure_pcie2_credits_sent;		/* 0x00B0C0 */
-	uint64_t	ce_ure_pcie2_credits_used;		/* 0x00B0C8 */
-	uint64_t	ce_ure_pcie2_credit_limit;		/* 0x00B0D0 */
-	uint64_t	ce_ure_pcie_force_credit;		/* 0x00B0D8 */
-	uint64_t	ce_ure_rd_tnum_val;			/* 0x00B0E0 */
-	uint64_t	ce_ure_rd_tnum_rsp_rcvd;		/* 0x00B0E8 */
-	uint64_t	ce_ure_rd_tnum_esent_timer;		/* 0x00B0F0 */
-	uint64_t	ce_ure_rd_tnum_error;			/* 0x00B0F8 */
-	uint64_t	ce_ure_rd_tnum_first_cl;		/* 0x00B100 */
-	uint64_t	ce_ure_rd_tnum_link_buf;		/* 0x00B108 */
-	uint64_t	ce_ure_wr_tnum_val;			/* 0x00B110 */
-	uint64_t	ce_ure_sram_err_addr0;			/* 0x00B118 */
-	uint64_t	ce_ure_sram_err_addr1;			/* 0x00B120 */
-	uint64_t	ce_ure_sram_err_addr2;			/* 0x00B128 */
-	uint64_t	ce_ure_sram_rd_addr0;			/* 0x00B130 */
-	uint64_t	ce_ure_sram_rd_addr1;			/* 0x00B138 */
-	uint64_t	ce_ure_sram_rd_addr2;			/* 0x00B140 */
-	uint64_t	ce_ure_sram_wr_addr0;			/* 0x00B148 */
-	uint64_t	ce_ure_sram_wr_addr1;			/* 0x00B150 */
-	uint64_t	ce_ure_sram_wr_addr2;			/* 0x00B158 */
-	uint64_t	ce_ure_buf_flush10;			/* 0x00B160 */
-	uint64_t	ce_ure_buf_flush11;			/* 0x00B168 */
-	uint64_t	ce_ure_buf_flush12;			/* 0x00B170 */
-	uint64_t	ce_ure_buf_flush13;			/* 0x00B178 */
-	uint64_t	ce_ure_buf_flush20;			/* 0x00B180 */
-	uint64_t	ce_ure_buf_flush21;			/* 0x00B188 */
-	uint64_t	ce_ure_buf_flush22;			/* 0x00B190 */
-	uint64_t	ce_ure_buf_flush23;			/* 0x00B198 */
-	uint64_t	ce_ure_pcie_control1;			/* 0x00B1A0 */
-	uint64_t	ce_ure_pcie_control2;			/* 0x00B1A8 */
-
-	uint64_t	ce_pad_00B1B0[458];	    /* 0x00B1B0 -- 0x00BFF8 */
-
-	/* Upstream Data Buffer, Port1 */
-	struct ce_ure_maint_ups_dat1_data {
-		uint64_t	data63_0[512];	    /* 0x00C000 -- 0x00CFF8 */
-		uint64_t	data127_64[512];    /* 0x00D000 -- 0x00DFF8 */
-		uint64_t	parity[512];	    /* 0x00E000 -- 0x00EFF8 */
-	} ce_ure_maint_ups_dat1;
-
-	/* Upstream Header Buffer, Port1 */
-	struct ce_ure_maint_ups_hdr1_data {
-		uint64_t	data63_0[512];	    /* 0x00F000 -- 0x00FFF8 */
-		uint64_t	data127_64[512];    /* 0x010000 -- 0x010FF8 */
-		uint64_t	parity[512];	    /* 0x011000 -- 0x011FF8 */
-	} ce_ure_maint_ups_hdr1;
-
-	/* Upstream Data Buffer, Port2 */
-	struct ce_ure_maint_ups_dat2_data {
-		uint64_t	data63_0[512];	    /* 0x012000 -- 0x012FF8 */
-		uint64_t	data127_64[512];    /* 0x013000 -- 0x013FF8 */
-		uint64_t	parity[512];	    /* 0x014000 -- 0x014FF8 */
-	} ce_ure_maint_ups_dat2;
-
-	/* Upstream Header Buffer, Port2 */
-	struct ce_ure_maint_ups_hdr2_data {
-		uint64_t	data63_0[512];	    /* 0x015000 -- 0x015FF8 */
-		uint64_t	data127_64[512];    /* 0x016000 -- 0x016FF8 */
-		uint64_t	parity[512];	    /* 0x017000 -- 0x017FF8 */
-	} ce_ure_maint_ups_hdr2;
-
-	/* Downstream Data Buffer */
-	struct ce_ure_maint_dns_dat_data {
-		uint64_t	data63_0[512];	    /* 0x018000 -- 0x018FF8 */
-		uint64_t	data127_64[512];    /* 0x019000 -- 0x019FF8 */
-		uint64_t	parity[512];	    /* 0x01A000 -- 0x01AFF8 */
-	} ce_ure_maint_dns_dat;
-
-	/* Downstream Header Buffer */
-	struct	ce_ure_maint_dns_hdr_data {
-		uint64_t	data31_0[64];	    /* 0x01B000 -- 0x01B1F8 */
-		uint64_t	data95_32[64];	    /* 0x01B200 -- 0x01B3F8 */
-		uint64_t	parity[64];	    /* 0x01B400 -- 0x01B5F8 */
-	} ce_ure_maint_dns_hdr;
-
-	/* RCI Buffer Data */
-	struct	ce_ure_maint_rci_data {
-		uint64_t	data41_0[64];	    /* 0x01B600 -- 0x01B7F8 */
-		uint64_t	data69_42[64];	    /* 0x01B800 -- 0x01B9F8 */
-	} ce_ure_maint_rci;
-
-	/* Response Queue */
-	uint64_t	ce_ure_maint_rspq[64];	    /* 0x01BA00 -- 0x01BBF8 */
-
-	uint64_t	ce_pad_01C000[4224];	    /* 0x01BC00 -- 0x023FF8 */
-
-	/* Admin Build-a-Packet Buffer */
-	struct	ce_adm_maint_bap_buf_data {
-		uint64_t	data63_0[258];	    /* 0x024000 -- 0x024808 */
-		uint64_t	data127_64[258];    /* 0x024810 -- 0x025018 */
-		uint64_t	parity[258];	    /* 0x025020 -- 0x025828 */
-	} ce_adm_maint_bap_buf;
-
-	uint64_t	ce_pad_025830[5370];	    /* 0x025830 -- 0x02FFF8 */
-
-	/* URE: 40bit PMU ATE Buffer */		    /* 0x030000 -- 0x037FF8 */
-	uint64_t	ce_ure_ate40[TIOCE_NUM_M40_ATES];
-
-	/* URE: 32/40bit PMU ATE Buffer */	    /* 0x038000 -- 0x03BFF8 */
-	uint64_t	ce_ure_ate3240[TIOCE_NUM_M3240_ATES];
-
-	uint64_t	ce_pad_03C000[2050];	    /* 0x03C000 -- 0x040008 */
-
-	/*
-	 * DRE: Down Stream Request Engine
-         */
-	uint64_t	ce_dre_dyn_credit_status1;		/* 0x040010 */
-	uint64_t	ce_dre_dyn_credit_status2;		/* 0x040018 */
-	uint64_t	ce_dre_last_credit_status1;		/* 0x040020 */
-	uint64_t	ce_dre_last_credit_status2;		/* 0x040028 */
-	uint64_t	ce_dre_credit_limit1;			/* 0x040030 */
-	uint64_t	ce_dre_credit_limit2;			/* 0x040038 */
-	uint64_t	ce_dre_force_credit1;			/* 0x040040 */
-	uint64_t	ce_dre_force_credit2;			/* 0x040048 */
-	uint64_t	ce_dre_debug_mux1;			/* 0x040050 */
-	uint64_t	ce_dre_debug_mux2;			/* 0x040058 */
-	uint64_t	ce_dre_ssp_err_cmd_wrd;			/* 0x040060 */
-	uint64_t	ce_dre_ssp_err_addr;			/* 0x040068 */
-	uint64_t	ce_dre_comp_err_cmd_wrd;		/* 0x040070 */
-	uint64_t	ce_dre_comp_err_addr;			/* 0x040078 */
-	uint64_t	ce_dre_req_status;			/* 0x040080 */
-	uint64_t	ce_dre_config1;				/* 0x040088 */
-	uint64_t	ce_dre_config2;				/* 0x040090 */
-	uint64_t	ce_dre_config_req_status;		/* 0x040098 */
-	uint64_t	ce_pad_0400A0[12];	    /* 0x0400A0 -- 0x0400F8 */
-	uint64_t	ce_dre_dyn_fifo;			/* 0x040100 */
-	uint64_t	ce_pad_040108[3];	    /* 0x040108 -- 0x040118 */
-	uint64_t	ce_dre_last_fifo;			/* 0x040120 */
-
-	uint64_t	ce_pad_040128[27];	    /* 0x040128 -- 0x0401F8 */
-
-	/* DRE Downstream Head Queue */
-	struct	ce_dre_maint_ds_head_queue {
-		uint64_t	data63_0[32];	    /* 0x040200 -- 0x0402F8 */
-		uint64_t	data127_64[32];	    /* 0x040300 -- 0x0403F8 */
-		uint64_t	parity[32];	    /* 0x040400 -- 0x0404F8 */
-	} ce_dre_maint_ds_head_q;
-
-	uint64_t	ce_pad_040500[352];	    /* 0x040500 -- 0x040FF8 */
-
-	/* DRE Downstream Data Queue */
-	struct	ce_dre_maint_ds_data_queue {
-		uint64_t	data63_0[256];	    /* 0x041000 -- 0x0417F8 */
-		uint64_t	ce_pad_041800[256]; /* 0x041800 -- 0x041FF8 */
-		uint64_t	data127_64[256];    /* 0x042000 -- 0x0427F8 */
-		uint64_t	ce_pad_042800[256]; /* 0x042800 -- 0x042FF8 */
-		uint64_t	parity[256];	    /* 0x043000 -- 0x0437F8 */
-		uint64_t	ce_pad_043800[256]; /* 0x043800 -- 0x043FF8 */
-	} ce_dre_maint_ds_data_q;
-
-	/* DRE URE Upstream Response Queue */
-	struct	ce_dre_maint_ure_us_rsp_queue {
-		uint64_t	data63_0[8];	    /* 0x044000 -- 0x044038 */
-		uint64_t	ce_pad_044040[24];  /* 0x044040 -- 0x0440F8 */
-		uint64_t	data127_64[8];      /* 0x044100 -- 0x044138 */
-		uint64_t	ce_pad_044140[24];  /* 0x044140 -- 0x0441F8 */
-		uint64_t	parity[8];	    /* 0x044200 -- 0x044238 */
-		uint64_t	ce_pad_044240[24];  /* 0x044240 -- 0x0442F8 */
-	} ce_dre_maint_ure_us_rsp_q;
-
-	uint64_t 	ce_dre_maint_us_wrt_rsp[32];/* 0x044300 -- 0x0443F8 */
-
-	uint64_t	ce_end_of_struct;			/* 0x044400 */
-} tioce_t;
-
-
-/* ce_adm_int_mask/ce_adm_int_status register bit defines */
-#define CE_ADM_INT_CE_ERROR_SHFT		0
-#define CE_ADM_INT_LSI1_IP_ERROR_SHFT		1
-#define CE_ADM_INT_LSI2_IP_ERROR_SHFT		2
-#define CE_ADM_INT_PCIE_ERROR_SHFT		3
-#define CE_ADM_INT_PORT1_HOTPLUG_EVENT_SHFT	4
-#define CE_ADM_INT_PORT2_HOTPLUG_EVENT_SHFT	5
-#define CE_ADM_INT_PCIE_PORT1_DEV_A_SHFT	6
-#define CE_ADM_INT_PCIE_PORT1_DEV_B_SHFT	7
-#define CE_ADM_INT_PCIE_PORT1_DEV_C_SHFT	8
-#define CE_ADM_INT_PCIE_PORT1_DEV_D_SHFT	9
-#define CE_ADM_INT_PCIE_PORT2_DEV_A_SHFT	10
-#define CE_ADM_INT_PCIE_PORT2_DEV_B_SHFT	11
-#define CE_ADM_INT_PCIE_PORT2_DEV_C_SHFT	12
-#define CE_ADM_INT_PCIE_PORT2_DEV_D_SHFT	13
-#define CE_ADM_INT_PCIE_MSG_SHFT		14 /*see int_dest_14*/
-#define CE_ADM_INT_PCIE_MSG_SLOT_0_SHFT		14
-#define CE_ADM_INT_PCIE_MSG_SLOT_1_SHFT		15
-#define CE_ADM_INT_PCIE_MSG_SLOT_2_SHFT		16
-#define CE_ADM_INT_PCIE_MSG_SLOT_3_SHFT		17
-#define CE_ADM_INT_PORT1_PM_PME_MSG_SHFT	22
-#define CE_ADM_INT_PORT2_PM_PME_MSG_SHFT	23
-
-/* ce_adm_force_int register bit defines */
-#define CE_ADM_FORCE_INT_PCIE_PORT1_DEV_A_SHFT	0
-#define CE_ADM_FORCE_INT_PCIE_PORT1_DEV_B_SHFT	1
-#define CE_ADM_FORCE_INT_PCIE_PORT1_DEV_C_SHFT	2
-#define CE_ADM_FORCE_INT_PCIE_PORT1_DEV_D_SHFT	3
-#define CE_ADM_FORCE_INT_PCIE_PORT2_DEV_A_SHFT	4
-#define CE_ADM_FORCE_INT_PCIE_PORT2_DEV_B_SHFT	5
-#define CE_ADM_FORCE_INT_PCIE_PORT2_DEV_C_SHFT	6
-#define CE_ADM_FORCE_INT_PCIE_PORT2_DEV_D_SHFT	7
-#define CE_ADM_FORCE_INT_ALWAYS_SHFT		8
-
-/* ce_adm_int_dest register bit masks & shifts */
-#define INTR_VECTOR_SHFT			56
-
-/* ce_adm_error_mask and ce_adm_error_summary register bit masks */
-#define CE_ADM_ERR_CRM_SSP_REQ_INVALID			(0x1ULL <<  0)
-#define CE_ADM_ERR_SSP_REQ_HEADER			(0x1ULL <<  1)
-#define CE_ADM_ERR_SSP_RSP_HEADER			(0x1ULL <<  2)
-#define CE_ADM_ERR_SSP_PROTOCOL_ERROR			(0x1ULL <<  3)
-#define CE_ADM_ERR_SSP_SBE				(0x1ULL <<  4)
-#define CE_ADM_ERR_SSP_MBE				(0x1ULL <<  5)
-#define CE_ADM_ERR_CXM_CREDIT_OFLOW			(0x1ULL <<  6)
-#define CE_ADM_ERR_DRE_SSP_REQ_INVAL			(0x1ULL <<  7)
-#define CE_ADM_ERR_SSP_REQ_LONG				(0x1ULL <<  8)
-#define CE_ADM_ERR_SSP_REQ_OFLOW			(0x1ULL <<  9)
-#define CE_ADM_ERR_SSP_REQ_SHORT			(0x1ULL << 10)
-#define CE_ADM_ERR_SSP_REQ_SIDEBAND			(0x1ULL << 11)
-#define CE_ADM_ERR_SSP_REQ_ADDR_ERR			(0x1ULL << 12)
-#define CE_ADM_ERR_SSP_REQ_BAD_BE			(0x1ULL << 13)
-#define CE_ADM_ERR_PCIE_COMPL_TIMEOUT			(0x1ULL << 14)
-#define CE_ADM_ERR_PCIE_UNEXP_COMPL			(0x1ULL << 15)
-#define CE_ADM_ERR_PCIE_ERR_COMPL			(0x1ULL << 16)
-#define CE_ADM_ERR_DRE_CREDIT_OFLOW			(0x1ULL << 17)
-#define CE_ADM_ERR_DRE_SRAM_PE				(0x1ULL << 18)
-#define CE_ADM_ERR_SSP_RSP_INVALID			(0x1ULL << 19)
-#define CE_ADM_ERR_SSP_RSP_LONG				(0x1ULL << 20)
-#define CE_ADM_ERR_SSP_RSP_SHORT			(0x1ULL << 21)
-#define CE_ADM_ERR_SSP_RSP_SIDEBAND			(0x1ULL << 22)
-#define CE_ADM_ERR_URE_SSP_RSP_UNEXP			(0x1ULL << 23)
-#define CE_ADM_ERR_URE_SSP_WR_REQ_TIMEOUT		(0x1ULL << 24)
-#define CE_ADM_ERR_URE_SSP_RD_REQ_TIMEOUT		(0x1ULL << 25)
-#define CE_ADM_ERR_URE_ATE3240_PAGE_FAULT		(0x1ULL << 26)
-#define CE_ADM_ERR_URE_ATE40_PAGE_FAULT			(0x1ULL << 27)
-#define CE_ADM_ERR_URE_CREDIT_OFLOW			(0x1ULL << 28)
-#define CE_ADM_ERR_URE_SRAM_PE				(0x1ULL << 29)
-#define CE_ADM_ERR_ADM_SSP_RSP_UNEXP			(0x1ULL << 30)
-#define CE_ADM_ERR_ADM_SSP_REQ_TIMEOUT			(0x1ULL << 31)
-#define CE_ADM_ERR_MMR_ACCESS_ERROR			(0x1ULL << 32)
-#define CE_ADM_ERR_MMR_ADDR_ERROR			(0x1ULL << 33)
-#define CE_ADM_ERR_ADM_CREDIT_OFLOW			(0x1ULL << 34)
-#define CE_ADM_ERR_ADM_SRAM_PE				(0x1ULL << 35)
-#define CE_ADM_ERR_DTL1_MIN_PDATA_CREDIT_ERR		(0x1ULL << 36)
-#define CE_ADM_ERR_DTL1_INF_COMPL_CRED_UPDT_ERR		(0x1ULL << 37)
-#define CE_ADM_ERR_DTL1_INF_POSTED_CRED_UPDT_ERR	(0x1ULL << 38)
-#define CE_ADM_ERR_DTL1_INF_NPOSTED_CRED_UPDT_ERR	(0x1ULL << 39)
-#define CE_ADM_ERR_DTL1_COMP_HD_CRED_MAX_ERR		(0x1ULL << 40)
-#define CE_ADM_ERR_DTL1_COMP_D_CRED_MAX_ERR		(0x1ULL << 41)
-#define CE_ADM_ERR_DTL1_NPOSTED_HD_CRED_MAX_ERR		(0x1ULL << 42)
-#define CE_ADM_ERR_DTL1_NPOSTED_D_CRED_MAX_ERR		(0x1ULL << 43)
-#define CE_ADM_ERR_DTL1_POSTED_HD_CRED_MAX_ERR		(0x1ULL << 44)
-#define CE_ADM_ERR_DTL1_POSTED_D_CRED_MAX_ERR		(0x1ULL << 45)
-#define CE_ADM_ERR_DTL2_MIN_PDATA_CREDIT_ERR		(0x1ULL << 46)
-#define CE_ADM_ERR_DTL2_INF_COMPL_CRED_UPDT_ERR		(0x1ULL << 47)
-#define CE_ADM_ERR_DTL2_INF_POSTED_CRED_UPDT_ERR	(0x1ULL << 48)
-#define CE_ADM_ERR_DTL2_INF_NPOSTED_CRED_UPDT_ERR	(0x1ULL << 49)
-#define CE_ADM_ERR_DTL2_COMP_HD_CRED_MAX_ERR		(0x1ULL << 50)
-#define CE_ADM_ERR_DTL2_COMP_D_CRED_MAX_ERR		(0x1ULL << 51)
-#define CE_ADM_ERR_DTL2_NPOSTED_HD_CRED_MAX_ERR		(0x1ULL << 52)
-#define CE_ADM_ERR_DTL2_NPOSTED_D_CRED_MAX_ERR		(0x1ULL << 53)
-#define CE_ADM_ERR_DTL2_POSTED_HD_CRED_MAX_ERR		(0x1ULL << 54)
-#define CE_ADM_ERR_DTL2_POSTED_D_CRED_MAX_ERR		(0x1ULL << 55)
-#define CE_ADM_ERR_PORT1_PCIE_COR_ERR			(0x1ULL << 56)
-#define CE_ADM_ERR_PORT1_PCIE_NFAT_ERR			(0x1ULL << 57)
-#define CE_ADM_ERR_PORT1_PCIE_FAT_ERR			(0x1ULL << 58)
-#define CE_ADM_ERR_PORT2_PCIE_COR_ERR			(0x1ULL << 59)
-#define CE_ADM_ERR_PORT2_PCIE_NFAT_ERR			(0x1ULL << 60)
-#define CE_ADM_ERR_PORT2_PCIE_FAT_ERR			(0x1ULL << 61)
-
-/* ce_adm_ure_ups_buf_barrier_flush register bit masks and shifts */
-#define FLUSH_SEL_PORT1_PIPE0_SHFT	0
-#define FLUSH_SEL_PORT1_PIPE1_SHFT	4
-#define FLUSH_SEL_PORT1_PIPE2_SHFT	8
-#define FLUSH_SEL_PORT1_PIPE3_SHFT	12
-#define FLUSH_SEL_PORT2_PIPE0_SHFT	16
-#define FLUSH_SEL_PORT2_PIPE1_SHFT	20
-#define FLUSH_SEL_PORT2_PIPE2_SHFT	24
-#define FLUSH_SEL_PORT2_PIPE3_SHFT	28
-
-/* ce_dre_config1 register bit masks and shifts */
-#define CE_DRE_RO_ENABLE		(0x1ULL << 0)
-#define CE_DRE_DYN_RO_ENABLE		(0x1ULL << 1)
-#define CE_DRE_SUP_CONFIG_COMP_ERROR	(0x1ULL << 2)
-#define CE_DRE_SUP_IO_COMP_ERROR	(0x1ULL << 3)
-#define CE_DRE_ADDR_MODE_SHFT		4
-
-/* ce_dre_config_req_status register bit masks */
-#define CE_DRE_LAST_CONFIG_COMPLETION	(0x7ULL << 0)
-#define CE_DRE_DOWNSTREAM_CONFIG_ERROR	(0x1ULL << 3)
-#define CE_DRE_CONFIG_COMPLETION_VALID	(0x1ULL << 4)
-#define CE_DRE_CONFIG_REQUEST_ACTIVE	(0x1ULL << 5)
-
-/* ce_ure_control register bit masks & shifts */
-#define CE_URE_RD_MRG_ENABLE		(0x1ULL << 0)
-#define CE_URE_WRT_MRG_ENABLE1		(0x1ULL << 4)
-#define CE_URE_WRT_MRG_ENABLE2		(0x1ULL << 5)
-#define CE_URE_RSPQ_BYPASS_DISABLE	(0x1ULL << 24)
-#define CE_URE_UPS_DAT1_PAR_DISABLE	(0x1ULL << 32)
-#define CE_URE_UPS_HDR1_PAR_DISABLE	(0x1ULL << 33)
-#define CE_URE_UPS_DAT2_PAR_DISABLE	(0x1ULL << 34)
-#define CE_URE_UPS_HDR2_PAR_DISABLE	(0x1ULL << 35)
-#define CE_URE_ATE_PAR_DISABLE		(0x1ULL << 36)
-#define CE_URE_RCI_PAR_DISABLE		(0x1ULL << 37)
-#define CE_URE_RSPQ_PAR_DISABLE		(0x1ULL << 38)
-#define CE_URE_DNS_DAT_PAR_DISABLE	(0x1ULL << 39)
-#define CE_URE_DNS_HDR_PAR_DISABLE	(0x1ULL << 40)
-#define CE_URE_MALFORM_DISABLE		(0x1ULL << 44)
-#define CE_URE_UNSUP_DISABLE		(0x1ULL << 45)
-
-/* ce_ure_page_map register bit masks & shifts */
-#define CE_URE_ATE3240_ENABLE		(0x1ULL << 0)
-#define CE_URE_ATE40_ENABLE 		(0x1ULL << 1)
-#define CE_URE_PAGESIZE_SHFT		4
-#define CE_URE_PAGESIZE_MASK		(0x7ULL << CE_URE_PAGESIZE_SHFT)
-#define CE_URE_4K_PAGESIZE		(0x0ULL << CE_URE_PAGESIZE_SHFT)
-#define CE_URE_16K_PAGESIZE		(0x1ULL << CE_URE_PAGESIZE_SHFT)
-#define CE_URE_64K_PAGESIZE		(0x2ULL << CE_URE_PAGESIZE_SHFT)
-#define CE_URE_128K_PAGESIZE		(0x3ULL << CE_URE_PAGESIZE_SHFT)
-#define CE_URE_256K_PAGESIZE		(0x4ULL << CE_URE_PAGESIZE_SHFT)
-
-/* ce_ure_pipe_sel register bit masks & shifts */
-#define PKT_TRAFIC_SHRT			16
-#define BUS_SRC_ID_SHFT			8
-#define DEV_SRC_ID_SHFT			3
-#define FNC_SRC_ID_SHFT			0
-#define CE_URE_TC_MASK			(0x07ULL << PKT_TRAFIC_SHRT)
-#define CE_URE_BUS_MASK			(0xFFULL << BUS_SRC_ID_SHFT)
-#define CE_URE_DEV_MASK			(0x1FULL << DEV_SRC_ID_SHFT)
-#define CE_URE_FNC_MASK			(0x07ULL << FNC_SRC_ID_SHFT)
-#define CE_URE_PIPE_BUS(b)		(((uint64_t)(b) << BUS_SRC_ID_SHFT) & \
-					 CE_URE_BUS_MASK)
-#define CE_URE_PIPE_DEV(d)		(((uint64_t)(d) << DEV_SRC_ID_SHFT) & \
-					 CE_URE_DEV_MASK)
-#define CE_URE_PIPE_FNC(f)		(((uint64_t)(f) << FNC_SRC_ID_SHFT) & \
-					 CE_URE_FNC_MASK)
-
-#define CE_URE_SEL1_SHFT		0
-#define CE_URE_SEL2_SHFT		20
-#define CE_URE_SEL3_SHFT		40
-#define CE_URE_SEL1_MASK		(0x7FFFFULL << CE_URE_SEL1_SHFT)
-#define CE_URE_SEL2_MASK		(0x7FFFFULL << CE_URE_SEL2_SHFT)
-#define CE_URE_SEL3_MASK		(0x7FFFFULL << CE_URE_SEL3_SHFT)
-
-
-/* ce_ure_pipe_mask register bit masks & shifts */
-#define CE_URE_MASK1_SHFT		0
-#define CE_URE_MASK2_SHFT		20
-#define CE_URE_MASK3_SHFT		40
-#define CE_URE_MASK1_MASK		(0x7FFFFULL << CE_URE_MASK1_SHFT)
-#define CE_URE_MASK2_MASK		(0x7FFFFULL << CE_URE_MASK2_SHFT)
-#define CE_URE_MASK3_MASK		(0x7FFFFULL << CE_URE_MASK3_SHFT)
-
-
-/* ce_ure_pcie_control1 register bit masks & shifts */
-#define CE_URE_SI			(0x1ULL << 0)
-#define CE_URE_ELAL_SHFT		4
-#define CE_URE_ELAL_MASK		(0x7ULL << CE_URE_ELAL_SHFT)
-#define CE_URE_ELAL1_SHFT		8
-#define CE_URE_ELAL1_MASK		(0x7ULL << CE_URE_ELAL1_SHFT)
-#define CE_URE_SCC			(0x1ULL << 12)
-#define CE_URE_PN1_SHFT			16
-#define CE_URE_PN1_MASK			(0xFFULL << CE_URE_PN1_SHFT)
-#define CE_URE_PN2_SHFT			24
-#define CE_URE_PN2_MASK			(0xFFULL << CE_URE_PN2_SHFT)
-#define CE_URE_PN1_SET(n)		(((uint64_t)(n) << CE_URE_PN1_SHFT) & \
-					 CE_URE_PN1_MASK)
-#define CE_URE_PN2_SET(n)		(((uint64_t)(n) << CE_URE_PN2_SHFT) & \
-					 CE_URE_PN2_MASK)
-
-/* ce_ure_pcie_control2 register bit masks & shifts */
-#define CE_URE_ABP			(0x1ULL << 0)
-#define CE_URE_PCP			(0x1ULL << 1)
-#define CE_URE_MSP			(0x1ULL << 2)
-#define CE_URE_AIP			(0x1ULL << 3)
-#define CE_URE_PIP			(0x1ULL << 4)
-#define CE_URE_HPS			(0x1ULL << 5)
-#define CE_URE_HPC			(0x1ULL << 6)
-#define CE_URE_SPLV_SHFT		7
-#define CE_URE_SPLV_MASK		(0xFFULL << CE_URE_SPLV_SHFT)
-#define CE_URE_SPLS_SHFT		15
-#define CE_URE_SPLS_MASK		(0x3ULL << CE_URE_SPLS_SHFT)
-#define CE_URE_PSN1_SHFT		19
-#define CE_URE_PSN1_MASK		(0x1FFFULL << CE_URE_PSN1_SHFT)
-#define CE_URE_PSN2_SHFT		32
-#define CE_URE_PSN2_MASK		(0x1FFFULL << CE_URE_PSN2_SHFT)
-#define CE_URE_PSN1_SET(n)		(((uint64_t)(n) << CE_URE_PSN1_SHFT) & \
-					 CE_URE_PSN1_MASK)
-#define CE_URE_PSN2_SET(n)		(((uint64_t)(n) << CE_URE_PSN2_SHFT) & \
-					 CE_URE_PSN2_MASK)
-
-/*
- * PIO address space ranges for CE
- */
-
-/* Local CE Registers Space */
-#define CE_PIO_MMR			0x00000000
-#define CE_PIO_MMR_LEN			0x04000000
-
-/* PCI Compatible Config Space */
-#define CE_PIO_CONFIG_SPACE		0x04000000
-#define CE_PIO_CONFIG_SPACE_LEN		0x04000000
-
-/* PCI I/O Space Alias */
-#define CE_PIO_IO_SPACE_ALIAS		0x08000000
-#define CE_PIO_IO_SPACE_ALIAS_LEN	0x08000000
-
-/* PCI Enhanced Config Space */
-#define CE_PIO_E_CONFIG_SPACE		0x10000000
-#define CE_PIO_E_CONFIG_SPACE_LEN	0x10000000
-
-/* PCI I/O Space */
-#define CE_PIO_IO_SPACE			0x100000000
-#define CE_PIO_IO_SPACE_LEN		0x100000000
-
-/* PCI MEM Space */
-#define CE_PIO_MEM_SPACE		0x200000000
-#define CE_PIO_MEM_SPACE_LEN		TIO_HWIN_SIZE
-
-
-/*
- * CE PCI Enhanced Config Space shifts & masks
- */
-#define CE_E_CONFIG_BUS_SHFT		20
-#define CE_E_CONFIG_BUS_MASK		(0xFF << CE_E_CONFIG_BUS_SHFT)
-#define CE_E_CONFIG_DEVICE_SHFT		15
-#define CE_E_CONFIG_DEVICE_MASK		(0x1F << CE_E_CONFIG_DEVICE_SHFT)
-#define CE_E_CONFIG_FUNC_SHFT		12
-#define CE_E_CONFIG_FUNC_MASK		(0x7  << CE_E_CONFIG_FUNC_SHFT)
-
-#endif /* __ASM_IA64_SN_TIOCE_H__ */
diff --git a/trunk/include/asm-ia64/sn/tioce_provider.h b/trunk/include/asm-ia64/sn/tioce_provider.h
deleted file mode 100644
index 7f63dec0a79a..000000000000
--- a/trunk/include/asm-ia64/sn/tioce_provider.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/**************************************************************************
- *             Copyright (C) 2005, Silicon Graphics, Inc.                 *
- *									  *
- *  These coded instructions, statements, and computer programs	 contain  *
- *  unpublished	 proprietary  information of Silicon Graphics, Inc., and  *
- *  are protected by Federal copyright law.  They  may	not be disclosed  *
- *  to	third  parties	or copied or duplicated in any form, in whole or  *
- *  in part, without the prior written consent of Silicon Graphics, Inc.  *
- *									  *
- **************************************************************************/
-
-#ifndef _ASM_IA64_SN_CE_PROVIDER_H
-#define _ASM_IA64_SN_CE_PROVIDER_H
-
-#include <asm/sn/pcibus_provider_defs.h>
-#include <asm/sn/tioce.h>
-
-/*
- * Common TIOCE structure shared between the prom and kernel
- *
- * DO NOT CHANGE THIS STRUCT WITHOUT MAKING CORRESPONDING CHANGES TO THE
- * PROM VERSION.
- */
-struct tioce_common {
-	struct pcibus_bussoft	ce_pcibus;	/* common pciio header */
-
-	uint32_t		ce_rev;
-	uint64_t		ce_kernel_private;
-	uint64_t		ce_prom_private;
-};
-
-struct tioce_kernel {
-	struct tioce_common	*ce_common;
-	spinlock_t		ce_lock;
-	struct list_head	ce_dmamap_list;
-
-	uint64_t		ce_ate40_shadow[TIOCE_NUM_M40_ATES];
-	uint64_t		ce_ate3240_shadow[TIOCE_NUM_M3240_ATES];
-	uint32_t		ce_ate3240_pagesize;
-
-	uint8_t			ce_port1_secondary;
-
-	/* per-port resources */
-	struct {
-		int 		dirmap_refcnt;
-		uint64_t	dirmap_shadow;
-	} ce_port[TIOCE_NUM_PORTS];
-};
-
-struct tioce_dmamap {
-	struct list_head	ce_dmamap_list;	/* headed by tioce_kernel */
-	uint32_t		refcnt;
-
-	uint64_t		nbytes;		/* # bytes mapped */
-
-	uint64_t		ct_start;	/* coretalk start address */
-	uint64_t		pci_start;	/* bus start address */
-
-	uint64_t		*ate_hw;	/* hw ptr of first ate in map */
-	uint64_t		*ate_shadow;	/* shadow ptr of firat ate */
-	uint16_t		ate_count;	/* # ate's in the map */
-};
-
-extern int tioce_init_provider(void);
-
-#endif  /* __ASM_IA64_SN_CE_PROVIDER_H */
diff --git a/trunk/include/asm-ia64/socket.h b/trunk/include/asm-ia64/socket.h
index a255006fb7b5..21a9f10d6baa 100644
--- a/trunk/include/asm-ia64/socket.h
+++ b/trunk/include/asm-ia64/socket.h
@@ -23,8 +23,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-ia64/spinlock.h b/trunk/include/asm-ia64/spinlock.h
index d2430aa0d49d..909936f25512 100644
--- a/trunk/include/asm-ia64/spinlock.h
+++ b/trunk/include/asm-ia64/spinlock.h
@@ -93,15 +93,7 @@ _raw_spin_lock_flags (spinlock_t *lock, unsigned long flags)
 # endif /* CONFIG_MCKINLEY */
 #endif
 }
-
 #define _raw_spin_lock(lock) _raw_spin_lock_flags(lock, 0)
-
-/* Unlock by doing an ordered store and releasing the cacheline with nta */
-static inline void _raw_spin_unlock(spinlock_t *x) {
-	barrier();
-	asm volatile ("st4.rel.nta [%0] = r0\n\t" :: "r"(x));
-}
-
 #else /* !ASM_SUPPORTED */
 #define _raw_spin_lock_flags(lock, flags) _raw_spin_lock(lock)
 # define _raw_spin_lock(x)								\
@@ -117,16 +109,16 @@ do {											\
 		} while (ia64_spinlock_val);						\
 	}										\
 } while (0)
-#define _raw_spin_unlock(x)	do { barrier(); ((spinlock_t *) x)->lock = 0; } while (0)
 #endif /* !ASM_SUPPORTED */
 
 #define spin_is_locked(x)	((x)->lock != 0)
+#define _raw_spin_unlock(x)	do { barrier(); ((spinlock_t *) x)->lock = 0; } while (0)
 #define _raw_spin_trylock(x)	(cmpxchg_acq(&(x)->lock, 0, 1) == 0)
 #define spin_unlock_wait(x)	do { barrier(); } while ((x)->lock)
 
 typedef struct {
-	volatile unsigned int read_counter	: 24;
-	volatile unsigned int write_lock	:  8;
+	volatile unsigned int read_counter	: 31;
+	volatile unsigned int write_lock	:  1;
 #ifdef CONFIG_PREEMPT
 	unsigned int break_lock;
 #endif
@@ -182,13 +174,6 @@ do {										\
 	(result == 0);								\
 })
 
-static inline void _raw_write_unlock(rwlock_t *x)
-{
-	u8 *y = (u8 *)x;
-	barrier();
-	asm volatile ("st1.rel.nta [%0] = r0\n\t" :: "r"(y+3) : "memory" );
-}
-
 #else /* !ASM_SUPPORTED */
 
 #define _raw_write_lock(l)								\
@@ -210,14 +195,14 @@ static inline void _raw_write_unlock(rwlock_t *x)
 	(ia64_val == 0);						\
 })
 
-static inline void _raw_write_unlock(rwlock_t *x)
-{
-	barrier();
-	x->write_lock = 0;
-}
-
 #endif /* !ASM_SUPPORTED */
 
 #define _raw_read_trylock(lock) generic_raw_read_trylock(lock)
 
+#define _raw_write_unlock(x)								\
+({											\
+	smp_mb__before_clear_bit();	/* need barrier before releasing lock... */	\
+	clear_bit(31, (x));								\
+})
+
 #endif /*  _ASM_IA64_SPINLOCK_H */
diff --git a/trunk/include/asm-ia64/system.h b/trunk/include/asm-ia64/system.h
index 33256db4a7cf..cd2cf76b2db1 100644
--- a/trunk/include/asm-ia64/system.h
+++ b/trunk/include/asm-ia64/system.h
@@ -19,13 +19,12 @@
 #include <asm/pal.h>
 #include <asm/percpu.h>
 
-#define GATE_ADDR		RGN_BASE(RGN_GATE)
-
+#define GATE_ADDR		__IA64_UL_CONST(0xa000000000000000)
 /*
  * 0xa000000000000000+2*PERCPU_PAGE_SIZE
  * - 0xa000000000000000+3*PERCPU_PAGE_SIZE remain unmapped (guard page)
  */
-#define KERNEL_START		 (GATE_ADDR+0x100000000)
+#define KERNEL_START		 __IA64_UL_CONST(0xa000000100000000)
 #define PERCPU_ADDR		(-PERCPU_PAGE_SIZE)
 
 #ifndef __ASSEMBLY__
diff --git a/trunk/include/asm-m32r/checksum.h b/trunk/include/asm-m32r/checksum.h
index 877ebf46e9ff..99f37dbf2558 100644
--- a/trunk/include/asm-m32r/checksum.h
+++ b/trunk/include/asm-m32r/checksum.h
@@ -105,7 +105,7 @@ static inline unsigned short ip_fast_csum(unsigned char * iph,
 		"	addx	%0, %3 \n"
 		"	.fillinsn\n"
 		"2: \n"
-	/* Since the input registers which are loaded with iph and ihl
+	/* Since the input registers which are loaded with iph and ipl
 	   are modified, we must also specify them as outputs, or gcc
 	   will assume they contain their original values. */
 	: "=&r" (sum), "=r" (iph), "=r" (ihl), "=&r" (tmpreg0), "=&r" (tmpreg1)
diff --git a/trunk/include/asm-m32r/socket.h b/trunk/include/asm-m32r/socket.h
index 8b6680f223c0..159519d99042 100644
--- a/trunk/include/asm-m32r/socket.h
+++ b/trunk/include/asm-m32r/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-m68k/socket.h b/trunk/include/asm-m68k/socket.h
index f578ca4b776a..8d0b9fc2d07e 100644
--- a/trunk/include/asm-m68k/socket.h
+++ b/trunk/include/asm-m68k/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-mips/socket.h b/trunk/include/asm-mips/socket.h
index d478a86294ee..020b4db70ee5 100644
--- a/trunk/include/asm-mips/socket.h
+++ b/trunk/include/asm-mips/socket.h
@@ -37,8 +37,6 @@ To add: #define SO_REUSEPORT 0x0200	/* Allow local address and port reuse.  */
 #define SO_ERROR	0x1007	/* get error status and clear */
 #define SO_SNDBUF	0x1001	/* Send buffer size. */
 #define SO_RCVBUF	0x1002	/* Receive buffer. */
-#define SO_SNDBUFFORCE	0x100a
-#define SO_RCVBUFFORCE	0x100b
 #define SO_SNDLOWAT	0x1003	/* send low-water mark */
 #define SO_RCVLOWAT	0x1004	/* receive low-water mark */
 #define SO_SNDTIMEO	0x1005	/* send timeout */
diff --git a/trunk/include/asm-parisc/socket.h b/trunk/include/asm-parisc/socket.h
index 1bf54dc53c10..4a77996c1862 100644
--- a/trunk/include/asm-parisc/socket.h
+++ b/trunk/include/asm-parisc/socket.h
@@ -16,8 +16,6 @@
 /* To add :#define SO_REUSEPORT 0x0200 */
 #define SO_SNDBUF	0x1001
 #define SO_RCVBUF	0x1002
-#define SO_SNDBUFFORCE	0x100a
-#define SO_RCVBUFFORCE	0x100b
 #define SO_SNDLOWAT	0x1003
 #define SO_RCVLOWAT	0x1004
 #define SO_SNDTIMEO	0x1005
diff --git a/trunk/include/asm-powerpc/cputime.h b/trunk/include/asm-powerpc/cputime.h
deleted file mode 100644
index 6d68ad7e0ea3..000000000000
--- a/trunk/include/asm-powerpc/cputime.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/cputime.h>
diff --git a/trunk/include/asm-powerpc/emergency-restart.h b/trunk/include/asm-powerpc/emergency-restart.h
deleted file mode 100644
index 3711bd9d50bd..000000000000
--- a/trunk/include/asm-powerpc/emergency-restart.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/emergency-restart.h>
diff --git a/trunk/include/asm-powerpc/percpu.h b/trunk/include/asm-powerpc/percpu.h
deleted file mode 100644
index 06a959d67234..000000000000
--- a/trunk/include/asm-powerpc/percpu.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/percpu.h>
diff --git a/trunk/include/asm-powerpc/resource.h b/trunk/include/asm-powerpc/resource.h
deleted file mode 100644
index 04bc4db8921b..000000000000
--- a/trunk/include/asm-powerpc/resource.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/resource.h>
diff --git a/trunk/include/asm-powerpc/8253pit.h b/trunk/include/asm-ppc/8253pit.h
similarity index 74%
rename from trunk/include/asm-powerpc/8253pit.h
rename to trunk/include/asm-ppc/8253pit.h
index 862708a749b0..285f78488ccb 100644
--- a/trunk/include/asm-powerpc/8253pit.h
+++ b/trunk/include/asm-ppc/8253pit.h
@@ -5,6 +5,6 @@
 #ifndef _8253PIT_H
 #define _8253PIT_H
 
-#define PIT_TICK_RATE	1193182UL
+#define PIT_TICK_RATE 	1193182UL
 
 #endif
diff --git a/trunk/include/asm-powerpc/agp.h b/trunk/include/asm-ppc/agp.h
similarity index 100%
rename from trunk/include/asm-powerpc/agp.h
rename to trunk/include/asm-ppc/agp.h
diff --git a/trunk/include/asm-ppc/cputime.h b/trunk/include/asm-ppc/cputime.h
new file mode 100644
index 000000000000..8e9faf5ce720
--- /dev/null
+++ b/trunk/include/asm-ppc/cputime.h
@@ -0,0 +1,6 @@
+#ifndef __PPC_CPUTIME_H
+#define __PPC_CPUTIME_H
+
+#include <asm-generic/cputime.h>
+
+#endif /* __PPC_CPUTIME_H */
diff --git a/trunk/include/asm-powerpc/div64.h b/trunk/include/asm-ppc/div64.h
similarity index 100%
rename from trunk/include/asm-powerpc/div64.h
rename to trunk/include/asm-ppc/div64.h
diff --git a/trunk/include/asm-ppc/emergency-restart.h b/trunk/include/asm-ppc/emergency-restart.h
new file mode 100644
index 000000000000..108d8c48e42e
--- /dev/null
+++ b/trunk/include/asm-ppc/emergency-restart.h
@@ -0,0 +1,6 @@
+#ifndef _ASM_EMERGENCY_RESTART_H
+#define _ASM_EMERGENCY_RESTART_H
+
+#include <asm-generic/emergency-restart.h>
+
+#endif /* _ASM_EMERGENCY_RESTART_H */
diff --git a/trunk/include/asm-powerpc/errno.h b/trunk/include/asm-ppc/errno.h
similarity index 100%
rename from trunk/include/asm-powerpc/errno.h
rename to trunk/include/asm-ppc/errno.h
diff --git a/trunk/include/asm-ppc/hdreg.h b/trunk/include/asm-ppc/hdreg.h
new file mode 100644
index 000000000000..7f7fd1af0af3
--- /dev/null
+++ b/trunk/include/asm-ppc/hdreg.h
@@ -0,0 +1 @@
+#include <asm-generic/hdreg.h>
diff --git a/trunk/include/asm-powerpc/ioctl.h b/trunk/include/asm-ppc/ioctl.h
similarity index 100%
rename from trunk/include/asm-powerpc/ioctl.h
rename to trunk/include/asm-ppc/ioctl.h
diff --git a/trunk/include/asm-powerpc/ioctls.h b/trunk/include/asm-ppc/ioctls.h
similarity index 100%
rename from trunk/include/asm-powerpc/ioctls.h
rename to trunk/include/asm-ppc/ioctls.h
diff --git a/trunk/include/asm-powerpc/ipc.h b/trunk/include/asm-ppc/ipc.h
similarity index 100%
rename from trunk/include/asm-powerpc/ipc.h
rename to trunk/include/asm-ppc/ipc.h
diff --git a/trunk/include/asm-powerpc/linkage.h b/trunk/include/asm-ppc/linkage.h
similarity index 100%
rename from trunk/include/asm-powerpc/linkage.h
rename to trunk/include/asm-ppc/linkage.h
diff --git a/trunk/include/asm-ppc/local.h b/trunk/include/asm-ppc/local.h
new file mode 100644
index 000000000000..b08e3eced10e
--- /dev/null
+++ b/trunk/include/asm-ppc/local.h
@@ -0,0 +1,6 @@
+#ifndef __PPC_LOCAL_H
+#define __PPC_LOCAL_H
+
+#include <asm-generic/local.h>
+
+#endif /* __PPC_LOCAL_H */
diff --git a/trunk/include/asm-powerpc/namei.h b/trunk/include/asm-ppc/namei.h
similarity index 100%
rename from trunk/include/asm-powerpc/namei.h
rename to trunk/include/asm-ppc/namei.h
diff --git a/trunk/include/asm-ppc/percpu.h b/trunk/include/asm-ppc/percpu.h
new file mode 100644
index 000000000000..d66667cd5878
--- /dev/null
+++ b/trunk/include/asm-ppc/percpu.h
@@ -0,0 +1,6 @@
+#ifndef __ARCH_PPC_PERCPU__
+#define __ARCH_PPC_PERCPU__
+
+#include <asm-generic/percpu.h>
+
+#endif /* __ARCH_PPC_PERCPU__ */
diff --git a/trunk/include/asm-powerpc/poll.h b/trunk/include/asm-ppc/poll.h
similarity index 100%
rename from trunk/include/asm-powerpc/poll.h
rename to trunk/include/asm-ppc/poll.h
diff --git a/trunk/include/asm-ppc/resource.h b/trunk/include/asm-ppc/resource.h
new file mode 100644
index 000000000000..86a1ea23a6ed
--- /dev/null
+++ b/trunk/include/asm-ppc/resource.h
@@ -0,0 +1,6 @@
+#ifndef _PPC_RESOURCE_H
+#define _PPC_RESOURCE_H
+
+#include <asm-generic/resource.h>
+
+#endif
diff --git a/trunk/include/asm-powerpc/shmparam.h b/trunk/include/asm-ppc/shmparam.h
similarity index 100%
rename from trunk/include/asm-powerpc/shmparam.h
rename to trunk/include/asm-ppc/shmparam.h
diff --git a/trunk/include/asm-ppc/socket.h b/trunk/include/asm-ppc/socket.h
index 296e1a3469d0..4134376b0f66 100644
--- a/trunk/include/asm-ppc/socket.h
+++ b/trunk/include/asm-ppc/socket.h
@@ -20,8 +20,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-powerpc/string.h b/trunk/include/asm-ppc/string.h
similarity index 100%
rename from trunk/include/asm-powerpc/string.h
rename to trunk/include/asm-ppc/string.h
diff --git a/trunk/include/asm-powerpc/unaligned.h b/trunk/include/asm-ppc/unaligned.h
similarity index 100%
rename from trunk/include/asm-powerpc/unaligned.h
rename to trunk/include/asm-ppc/unaligned.h
diff --git a/trunk/include/asm-powerpc/xor.h b/trunk/include/asm-ppc/xor.h
similarity index 100%
rename from trunk/include/asm-powerpc/xor.h
rename to trunk/include/asm-ppc/xor.h
diff --git a/trunk/include/asm-ppc64/8253pit.h b/trunk/include/asm-ppc64/8253pit.h
new file mode 100644
index 000000000000..285f78488ccb
--- /dev/null
+++ b/trunk/include/asm-ppc64/8253pit.h
@@ -0,0 +1,10 @@
+/*
+ * 8253/8254 Programmable Interval Timer
+ */
+
+#ifndef _8253PIT_H
+#define _8253PIT_H
+
+#define PIT_TICK_RATE 	1193182UL
+
+#endif
diff --git a/trunk/include/asm-ppc64/abs_addr.h b/trunk/include/asm-ppc64/abs_addr.h
index 84c24d4cdb71..6d4e8e787058 100644
--- a/trunk/include/asm-ppc64/abs_addr.h
+++ b/trunk/include/asm-ppc64/abs_addr.h
@@ -16,51 +16,93 @@
 #include <asm/page.h>
 #include <asm/prom.h>
 #include <asm/lmb.h>
-#include <asm/firmware.h>
 
-struct mschunks_map {
+typedef u32 msChunks_entry;
+struct msChunks {
         unsigned long num_chunks;
         unsigned long chunk_size;
         unsigned long chunk_shift;
         unsigned long chunk_mask;
-        u32 *mapping;
+        msChunks_entry *abs;
 };
 
-extern struct mschunks_map mschunks_map;
+extern struct msChunks msChunks;
 
-/* Chunks are 256 KB */
-#define MSCHUNKS_CHUNK_SHIFT	(18)
-#define MSCHUNKS_CHUNK_SIZE	(1UL << MSCHUNKS_CHUNK_SHIFT)
-#define MSCHUNKS_OFFSET_MASK	(MSCHUNKS_CHUNK_SIZE - 1)
+extern unsigned long msChunks_alloc(unsigned long, unsigned long, unsigned long);
+extern unsigned long reloc_offset(void);
 
-static inline unsigned long chunk_to_addr(unsigned long chunk)
+#ifdef CONFIG_MSCHUNKS
+
+static inline unsigned long
+chunk_to_addr(unsigned long chunk)
 {
-	return chunk << MSCHUNKS_CHUNK_SHIFT;
+	unsigned long offset = reloc_offset();
+	struct msChunks *_msChunks = PTRRELOC(&msChunks);
+
+	return chunk << _msChunks->chunk_shift;
 }
 
-static inline unsigned long addr_to_chunk(unsigned long addr)
+static inline unsigned long
+addr_to_chunk(unsigned long addr)
 {
-	return addr >> MSCHUNKS_CHUNK_SHIFT;
+	unsigned long offset = reloc_offset();
+	struct msChunks *_msChunks = PTRRELOC(&msChunks);
+
+	return addr >> _msChunks->chunk_shift;
 }
 
-static inline unsigned long phys_to_abs(unsigned long pa)
+static inline unsigned long
+chunk_offset(unsigned long addr)
 {
-	unsigned long chunk;
+	unsigned long offset = reloc_offset();
+	struct msChunks *_msChunks = PTRRELOC(&msChunks);
 
-	/* This is a no-op on non-iSeries */
-	if (!firmware_has_feature(FW_FEATURE_ISERIES))
-		return pa;
+	return addr & _msChunks->chunk_mask;
+}
 
-	chunk = addr_to_chunk(pa);
+static inline unsigned long
+abs_chunk(unsigned long pchunk)
+{
+	unsigned long offset = reloc_offset();
+	struct msChunks *_msChunks = PTRRELOC(&msChunks);
+	if ( pchunk >= _msChunks->num_chunks ) {
+		return pchunk;
+	}
+	return PTRRELOC(_msChunks->abs)[pchunk];
+}
 
-	if (chunk < mschunks_map.num_chunks)
-		chunk = mschunks_map.mapping[chunk];
+/* A macro so it can take pointers or unsigned long. */
+#define phys_to_abs(pa)						     \
+	({ unsigned long _pa = (unsigned long)(pa);			     \
+	   chunk_to_addr(abs_chunk(addr_to_chunk(_pa))) + chunk_offset(_pa); \
+	})
 
-	return chunk_to_addr(chunk) + (pa & MSCHUNKS_OFFSET_MASK);
+static inline unsigned long
+physRpn_to_absRpn(unsigned long rpn)
+{
+	unsigned long pa = rpn << PAGE_SHIFT;
+	unsigned long aa = phys_to_abs(pa);
+	return (aa >> PAGE_SHIFT);
 }
 
+/* A macro so it can take pointers or unsigned long. */
+#define abs_to_phys(aa) lmb_abs_to_phys((unsigned long)(aa))
+
+#else  /* !CONFIG_MSCHUNKS */
+
+#define chunk_to_addr(chunk) ((unsigned long)(chunk))
+#define addr_to_chunk(addr) (addr)
+#define chunk_offset(addr) (0)
+#define abs_chunk(pchunk) (pchunk)
+
+#define phys_to_abs(pa) (pa)
+#define physRpn_to_absRpn(rpn) (rpn)
+#define abs_to_phys(aa) (aa)
+
+#endif /* !CONFIG_MSCHUNKS */
+
 /* Convenience macros */
 #define virt_to_abs(va) phys_to_abs(__pa(va))
-#define abs_to_virt(aa) __va(aa)
+#define abs_to_virt(aa) __va(abs_to_phys(aa))
 
 #endif /* _ABS_ADDR_H */
diff --git a/trunk/include/asm-ppc64/agp.h b/trunk/include/asm-ppc64/agp.h
new file mode 100644
index 000000000000..ca9e423307f4
--- /dev/null
+++ b/trunk/include/asm-ppc64/agp.h
@@ -0,0 +1,23 @@
+#ifndef AGP_H
+#define AGP_H 1
+
+#include <asm/io.h>
+
+/* nothing much needed here */
+
+#define map_page_into_agp(page)
+#define unmap_page_from_agp(page)
+#define flush_agp_mappings()
+#define flush_agp_cache() mb()
+
+/* Convert a physical address to an address suitable for the GART. */
+#define phys_to_gart(x) (x)
+#define gart_to_phys(x) (x)
+
+/* GATT allocation. Returns/accepts GATT kernel virtual address. */
+#define alloc_gatt_pages(order)		\
+	((char *)__get_free_pages(GFP_KERNEL, (order)))
+#define free_gatt_pages(table, order)	\
+	free_pages((unsigned long)(table), (order))
+
+#endif
diff --git a/trunk/include/asm-ppc64/cputable.h b/trunk/include/asm-ppc64/cputable.h
index ae6cf3830108..d67fa9e26079 100644
--- a/trunk/include/asm-ppc64/cputable.h
+++ b/trunk/include/asm-ppc64/cputable.h
@@ -56,6 +56,11 @@ struct cpu_spec {
 	 * BHT, SPD, etc... from head.S before branching to identify_machine
 	 */
 	cpu_setup_t	cpu_setup;
+
+	/* This is used to identify firmware features which are available
+	 * to the kernel.
+	 */
+	unsigned long   firmware_features;
 };
 
 extern struct cpu_spec		cpu_specs[];
@@ -66,6 +71,39 @@ static inline unsigned long cpu_has_feature(unsigned long feature)
 	return cur_cpu_spec->cpu_features & feature;
 }
 
+
+/* firmware feature bitmask values */
+#define FIRMWARE_MAX_FEATURES 63
+
+#define FW_FEATURE_PFT		(1UL<<0)
+#define FW_FEATURE_TCE		(1UL<<1)	
+#define FW_FEATURE_SPRG0	(1UL<<2)	
+#define FW_FEATURE_DABR		(1UL<<3)	
+#define FW_FEATURE_COPY		(1UL<<4)	
+#define FW_FEATURE_ASR		(1UL<<5)	
+#define FW_FEATURE_DEBUG	(1UL<<6)	
+#define FW_FEATURE_TERM		(1UL<<7)	
+#define FW_FEATURE_PERF		(1UL<<8)	
+#define FW_FEATURE_DUMP		(1UL<<9)	
+#define FW_FEATURE_INTERRUPT	(1UL<<10)	
+#define FW_FEATURE_MIGRATE	(1UL<<11)	
+#define FW_FEATURE_PERFMON	(1UL<<12)	
+#define FW_FEATURE_CRQ   	(1UL<<13)	
+#define FW_FEATURE_VIO   	(1UL<<14)	
+#define FW_FEATURE_RDMA   	(1UL<<15)	
+#define FW_FEATURE_LLAN   	(1UL<<16)	
+#define FW_FEATURE_BULK   	(1UL<<17)	
+#define FW_FEATURE_XDABR   	(1UL<<18)	
+#define FW_FEATURE_MULTITCE   	(1UL<<19)	
+#define FW_FEATURE_SPLPAR   	(1UL<<20)	
+
+typedef struct {
+    unsigned long val;
+    char * name;
+} firmware_feature_t;
+
+extern firmware_feature_t firmware_features_table[];
+
 #endif /* __ASSEMBLY__ */
 
 /* CPU kernel features */
@@ -102,8 +140,10 @@ static inline unsigned long cpu_has_feature(unsigned long feature)
 #define CPU_FTR_MMCRA_SIHV		ASM_CONST(0x0000080000000000)
 #define CPU_FTR_CTRL			ASM_CONST(0x0000100000000000)
 
-#ifndef __ASSEMBLY__
+/* Platform firmware features */
+#define FW_FTR_				ASM_CONST(0x0000000000000001)
 
+#ifndef __ASSEMBLY__
 #define COMMON_USER_PPC64	(PPC_FEATURE_32 | PPC_FEATURE_64 | \
 			         PPC_FEATURE_HAS_FPU | PPC_FEATURE_HAS_MMU)
 
@@ -116,9 +156,10 @@ static inline unsigned long cpu_has_feature(unsigned long feature)
 #define CPU_FTR_PPCAS_ARCH_V2	(CPU_FTR_PPCAS_ARCH_V2_BASE)
 #else
 #define CPU_FTR_PPCAS_ARCH_V2	(CPU_FTR_PPCAS_ARCH_V2_BASE | CPU_FTR_16M_PAGE)
-#endif /* CONFIG_PPC_ISERIES */
+#endif
 
-#endif /* __ASSEMBLY */
+#define COMMON_PPC64_FW	(0)
+#endif
 
 #ifdef __ASSEMBLY__
 
diff --git a/trunk/include/asm-ppc64/cputime.h b/trunk/include/asm-ppc64/cputime.h
new file mode 100644
index 000000000000..8e9faf5ce720
--- /dev/null
+++ b/trunk/include/asm-ppc64/cputime.h
@@ -0,0 +1,6 @@
+#ifndef __PPC_CPUTIME_H
+#define __PPC_CPUTIME_H
+
+#include <asm-generic/cputime.h>
+
+#endif /* __PPC_CPUTIME_H */
diff --git a/trunk/include/asm-ppc64/div64.h b/trunk/include/asm-ppc64/div64.h
new file mode 100644
index 000000000000..6cd978cefb28
--- /dev/null
+++ b/trunk/include/asm-ppc64/div64.h
@@ -0,0 +1 @@
+#include <asm-generic/div64.h>
diff --git a/trunk/include/asm-ppc64/emergency-restart.h b/trunk/include/asm-ppc64/emergency-restart.h
new file mode 100644
index 000000000000..108d8c48e42e
--- /dev/null
+++ b/trunk/include/asm-ppc64/emergency-restart.h
@@ -0,0 +1,6 @@
+#ifndef _ASM_EMERGENCY_RESTART_H
+#define _ASM_EMERGENCY_RESTART_H
+
+#include <asm-generic/emergency-restart.h>
+
+#endif /* _ASM_EMERGENCY_RESTART_H */
diff --git a/trunk/include/asm-ppc64/errno.h b/trunk/include/asm-ppc64/errno.h
new file mode 100644
index 000000000000..69bc3b0c6cbe
--- /dev/null
+++ b/trunk/include/asm-ppc64/errno.h
@@ -0,0 +1,18 @@
+#ifndef _PPC64_ERRNO_H
+#define _PPC64_ERRNO_H
+
+/* 
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <asm-generic/errno.h>
+
+#undef	EDEADLOCK
+#define	EDEADLOCK	58	/* File locking deadlock error */
+
+#define _LAST_ERRNO	516
+
+#endif
diff --git a/trunk/include/asm-ppc64/firmware.h b/trunk/include/asm-ppc64/firmware.h
deleted file mode 100644
index 22bb85cf60af..000000000000
--- a/trunk/include/asm-ppc64/firmware.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- *  include/asm-ppc64/firmware.h
- *
- *  Extracted from include/asm-ppc64/cputable.h
- *
- *  Copyright (C) 2001 Ben. Herrenschmidt (benh@kernel.crashing.org)
- *
- *  Modifications for ppc64:
- *      Copyright (C) 2003 Dave Engebretsen <engebret@us.ibm.com>
- *
- *  This program is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU General Public License
- *  as published by the Free Software Foundation; either version
- *  2 of the License, or (at your option) any later version.
- */
-#ifndef __ASM_PPC_FIRMWARE_H
-#define __ASM_PPC_FIRMWARE_H
-
-#ifdef __KERNEL__
-
-#ifndef __ASSEMBLY__
-
-/* firmware feature bitmask values */
-#define FIRMWARE_MAX_FEATURES 63
-
-#define FW_FEATURE_PFT		(1UL<<0)
-#define FW_FEATURE_TCE		(1UL<<1)
-#define FW_FEATURE_SPRG0	(1UL<<2)
-#define FW_FEATURE_DABR		(1UL<<3)
-#define FW_FEATURE_COPY		(1UL<<4)
-#define FW_FEATURE_ASR		(1UL<<5)
-#define FW_FEATURE_DEBUG	(1UL<<6)
-#define FW_FEATURE_TERM		(1UL<<7)
-#define FW_FEATURE_PERF		(1UL<<8)
-#define FW_FEATURE_DUMP		(1UL<<9)
-#define FW_FEATURE_INTERRUPT	(1UL<<10)
-#define FW_FEATURE_MIGRATE	(1UL<<11)
-#define FW_FEATURE_PERFMON	(1UL<<12)
-#define FW_FEATURE_CRQ		(1UL<<13)
-#define FW_FEATURE_VIO		(1UL<<14)
-#define FW_FEATURE_RDMA		(1UL<<15)
-#define FW_FEATURE_LLAN		(1UL<<16)
-#define FW_FEATURE_BULK		(1UL<<17)
-#define FW_FEATURE_XDABR	(1UL<<18)
-#define FW_FEATURE_MULTITCE	(1UL<<19)
-#define FW_FEATURE_SPLPAR	(1UL<<20)
-#define FW_FEATURE_ISERIES	(1UL<<21)
-
-enum {
-	FW_FEATURE_PSERIES_POSSIBLE = FW_FEATURE_PFT | FW_FEATURE_TCE |
-		FW_FEATURE_SPRG0 | FW_FEATURE_DABR | FW_FEATURE_COPY |
-		FW_FEATURE_ASR | FW_FEATURE_DEBUG | FW_FEATURE_TERM |
-		FW_FEATURE_PERF | FW_FEATURE_DUMP | FW_FEATURE_INTERRUPT |
-		FW_FEATURE_MIGRATE | FW_FEATURE_PERFMON | FW_FEATURE_CRQ |
-		FW_FEATURE_VIO | FW_FEATURE_RDMA | FW_FEATURE_LLAN |
-		FW_FEATURE_BULK | FW_FEATURE_XDABR | FW_FEATURE_MULTITCE |
-		FW_FEATURE_SPLPAR,
-	FW_FEATURE_PSERIES_ALWAYS = 0,
-	FW_FEATURE_ISERIES_POSSIBLE = FW_FEATURE_ISERIES,
-	FW_FEATURE_ISERIES_ALWAYS = FW_FEATURE_ISERIES,
-	FW_FEATURE_POSSIBLE =
-#ifdef CONFIG_PPC_PSERIES
-		FW_FEATURE_PSERIES_POSSIBLE |
-#endif
-#ifdef CONFIG_PPC_ISERIES
-		FW_FEATURE_ISERIES_POSSIBLE |
-#endif
-		0,
-	FW_FEATURE_ALWAYS =
-#ifdef CONFIG_PPC_PSERIES
-		FW_FEATURE_PSERIES_ALWAYS &
-#endif
-#ifdef CONFIG_PPC_ISERIES
-		FW_FEATURE_ISERIES_ALWAYS &
-#endif
-		FW_FEATURE_POSSIBLE,
-};
-
-/* This is used to identify firmware features which are available
- * to the kernel.
- */
-extern unsigned long	ppc64_firmware_features;
-
-static inline unsigned long firmware_has_feature(unsigned long feature)
-{
-	return (FW_FEATURE_ALWAYS & feature) ||
-		(FW_FEATURE_POSSIBLE & ppc64_firmware_features & feature);
-}
-
-#ifdef CONFIG_PPC_PSERIES
-typedef struct {
-    unsigned long val;
-    char * name;
-} firmware_feature_t;
-
-extern firmware_feature_t firmware_features_table[];
-#endif
-
-#endif /* __ASSEMBLY__ */
-#endif /* __KERNEL__ */
-#endif /* __ASM_PPC_FIRMWARE_H */
diff --git a/trunk/include/asm-ppc64/hdreg.h b/trunk/include/asm-ppc64/hdreg.h
new file mode 100644
index 000000000000..7f7fd1af0af3
--- /dev/null
+++ b/trunk/include/asm-ppc64/hdreg.h
@@ -0,0 +1 @@
+#include <asm-generic/hdreg.h>
diff --git a/trunk/include/asm-ppc64/imalloc.h b/trunk/include/asm-ppc64/imalloc.h
index 42adf7033a81..e46ff68a6e41 100644
--- a/trunk/include/asm-ppc64/imalloc.h
+++ b/trunk/include/asm-ppc64/imalloc.h
@@ -6,7 +6,7 @@
  */
 #define PHBS_IO_BASE  	  VMALLOC_END
 #define IMALLOC_BASE      (PHBS_IO_BASE + 0x80000000ul)	/* Reserve 2 gigs for PHBs */
-#define IMALLOC_END       (VMALLOC_START + PGTABLE_RANGE)
+#define IMALLOC_END       (VMALLOC_START + EADDR_MASK)
 
 
 /* imalloc region types */
diff --git a/trunk/include/asm-ppc64/ioctl.h b/trunk/include/asm-ppc64/ioctl.h
new file mode 100644
index 000000000000..42b8c5da7fbc
--- /dev/null
+++ b/trunk/include/asm-ppc64/ioctl.h
@@ -0,0 +1,74 @@
+#ifndef _PPC64_IOCTL_H
+#define _PPC64_IOCTL_H
+
+
+/*
+ * This was copied from the alpha as it's a bit cleaner there.
+ *                         -- Cort
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#define _IOC_NRBITS	8
+#define _IOC_TYPEBITS	8
+#define _IOC_SIZEBITS	13
+#define _IOC_DIRBITS	3
+
+#define _IOC_NRMASK	((1 << _IOC_NRBITS)-1)
+#define _IOC_TYPEMASK	((1 << _IOC_TYPEBITS)-1)
+#define _IOC_SIZEMASK	((1 << _IOC_SIZEBITS)-1)
+#define _IOC_DIRMASK	((1 << _IOC_DIRBITS)-1)
+
+#define _IOC_NRSHIFT	0
+#define _IOC_TYPESHIFT	(_IOC_NRSHIFT+_IOC_NRBITS)
+#define _IOC_SIZESHIFT	(_IOC_TYPESHIFT+_IOC_TYPEBITS)
+#define _IOC_DIRSHIFT	(_IOC_SIZESHIFT+_IOC_SIZEBITS)
+
+/*
+ * Direction bits _IOC_NONE could be 0, but OSF/1 gives it a bit.
+ * And this turns out useful to catch old ioctl numbers in header
+ * files for us.
+ */
+#define _IOC_NONE	1U
+#define _IOC_READ	2U
+#define _IOC_WRITE	4U
+
+#define _IOC(dir,type,nr,size) \
+	(((dir)  << _IOC_DIRSHIFT) | \
+	 ((type) << _IOC_TYPESHIFT) | \
+	 ((nr)   << _IOC_NRSHIFT) | \
+	 ((size) << _IOC_SIZESHIFT))
+
+/* provoke compile error for invalid uses of size argument */
+extern unsigned int __invalid_size_argument_for_IOC;
+#define _IOC_TYPECHECK(t) \
+       ((sizeof(t) == sizeof(t[1]) && \
+         sizeof(t) < (1 << _IOC_SIZEBITS)) ? \
+         sizeof(t) : __invalid_size_argument_for_IOC)
+
+/* used to create numbers */
+#define _IO(type,nr)		_IOC(_IOC_NONE,(type),(nr),0)
+#define _IOR(type,nr,size)	_IOC(_IOC_READ,(type),(nr),(_IOC_TYPECHECK(size)))
+#define _IOW(type,nr,size)	_IOC(_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
+#define _IOWR(type,nr,size)	_IOC(_IOC_READ|_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
+#define _IOR_BAD(type,nr,size)	_IOC(_IOC_READ,(type),(nr),sizeof(size))
+#define _IOW_BAD(type,nr,size)	_IOC(_IOC_WRITE,(type),(nr),sizeof(size))
+#define _IOWR_BAD(type,nr,size)	_IOC(_IOC_READ|_IOC_WRITE,(type),(nr),sizeof(size))
+
+/* used to decode them.. */
+#define _IOC_DIR(nr)		(((nr) >> _IOC_DIRSHIFT) & _IOC_DIRMASK)
+#define _IOC_TYPE(nr)		(((nr) >> _IOC_TYPESHIFT) & _IOC_TYPEMASK)
+#define _IOC_NR(nr)		(((nr) >> _IOC_NRSHIFT) & _IOC_NRMASK)
+#define _IOC_SIZE(nr)		(((nr) >> _IOC_SIZESHIFT) & _IOC_SIZEMASK)
+
+/* various drivers, such as the pcmcia stuff, need these... */
+#define IOC_IN		(_IOC_WRITE << _IOC_DIRSHIFT)
+#define IOC_OUT		(_IOC_READ << _IOC_DIRSHIFT)
+#define IOC_INOUT	((_IOC_WRITE|_IOC_READ) << _IOC_DIRSHIFT)
+#define IOCSIZE_MASK	(_IOC_SIZEMASK << _IOC_SIZESHIFT)
+#define IOCSIZE_SHIFT	(_IOC_SIZESHIFT)
+
+#endif /* _PPC64_IOCTL_H */
diff --git a/trunk/include/asm-ppc64/ioctls.h b/trunk/include/asm-ppc64/ioctls.h
new file mode 100644
index 000000000000..48796bf3e4fc
--- /dev/null
+++ b/trunk/include/asm-ppc64/ioctls.h
@@ -0,0 +1,114 @@
+#ifndef _ASM_PPC64_IOCTLS_H
+#define _ASM_PPC64_IOCTLS_H
+
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <asm/ioctl.h>
+
+#define FIOCLEX		_IO('f', 1)
+#define FIONCLEX	_IO('f', 2)
+#define FIOASYNC	_IOW('f', 125, int)
+#define FIONBIO		_IOW('f', 126, int)
+#define FIONREAD	_IOR('f', 127, int)
+#define TIOCINQ		FIONREAD
+#define FIOQSIZE        _IOR('f', 128, loff_t)
+
+#define TIOCGETP	_IOR('t', 8, struct sgttyb)
+#define TIOCSETP	_IOW('t', 9, struct sgttyb)
+#define TIOCSETN	_IOW('t', 10, struct sgttyb)	/* TIOCSETP wo flush */
+
+#define TIOCSETC	_IOW('t', 17, struct tchars)
+#define TIOCGETC	_IOR('t', 18, struct tchars)
+#define TCGETS		_IOR('t', 19, struct termios)
+#define TCSETS		_IOW('t', 20, struct termios)
+#define TCSETSW		_IOW('t', 21, struct termios)
+#define TCSETSF		_IOW('t', 22, struct termios)
+
+#define TCGETA		_IOR('t', 23, struct termio)
+#define TCSETA		_IOW('t', 24, struct termio)
+#define TCSETAW		_IOW('t', 25, struct termio)
+#define TCSETAF		_IOW('t', 28, struct termio)
+
+#define TCSBRK		_IO('t', 29)
+#define TCXONC		_IO('t', 30)
+#define TCFLSH		_IO('t', 31)
+
+#define TIOCSWINSZ	_IOW('t', 103, struct winsize)
+#define TIOCGWINSZ	_IOR('t', 104, struct winsize)
+#define	TIOCSTART	_IO('t', 110)		/* start output, like ^Q */
+#define	TIOCSTOP	_IO('t', 111)		/* stop output, like ^S */
+#define TIOCOUTQ        _IOR('t', 115, int)     /* output queue size */
+
+#define TIOCGLTC	_IOR('t', 116, struct ltchars)
+#define TIOCSLTC	_IOW('t', 117, struct ltchars)
+#define TIOCSPGRP	_IOW('t', 118, int)
+#define TIOCGPGRP	_IOR('t', 119, int)
+
+#define TIOCEXCL	0x540C
+#define TIOCNXCL	0x540D
+#define TIOCSCTTY	0x540E
+
+#define TIOCSTI		0x5412
+#define TIOCMGET	0x5415
+#define TIOCMBIS	0x5416
+#define TIOCMBIC	0x5417
+#define TIOCMSET	0x5418
+# define TIOCM_LE	0x001
+# define TIOCM_DTR	0x002
+# define TIOCM_RTS	0x004
+# define TIOCM_ST	0x008
+# define TIOCM_SR	0x010
+# define TIOCM_CTS	0x020
+# define TIOCM_CAR	0x040
+# define TIOCM_RNG	0x080
+# define TIOCM_DSR	0x100
+# define TIOCM_CD	TIOCM_CAR
+# define TIOCM_RI	TIOCM_RNG
+
+#define TIOCGSOFTCAR	0x5419
+#define TIOCSSOFTCAR	0x541A
+#define TIOCLINUX	0x541C
+#define TIOCCONS	0x541D
+#define TIOCGSERIAL	0x541E
+#define TIOCSSERIAL	0x541F
+#define TIOCPKT		0x5420
+# define TIOCPKT_DATA		 0
+# define TIOCPKT_FLUSHREAD	 1
+# define TIOCPKT_FLUSHWRITE	 2
+# define TIOCPKT_STOP		 4
+# define TIOCPKT_START		 8
+# define TIOCPKT_NOSTOP		16
+# define TIOCPKT_DOSTOP		32
+
+
+#define TIOCNOTTY	0x5422
+#define TIOCSETD	0x5423
+#define TIOCGETD	0x5424
+#define TCSBRKP		0x5425	/* Needed for POSIX tcsendbreak() */
+#define TIOCSBRK	0x5427  /* BSD compatibility */
+#define TIOCCBRK	0x5428  /* BSD compatibility */
+#define TIOCGSID	0x5429  /* Return the session ID of FD */
+#define TIOCGPTN	_IOR('T',0x30, unsigned int) /* Get Pty Number (of pty-mux device) */
+#define TIOCSPTLCK	_IOW('T',0x31, int)  /* Lock/unlock Pty */
+
+#define TIOCSERCONFIG	0x5453
+#define TIOCSERGWILD	0x5454
+#define TIOCSERSWILD	0x5455
+#define TIOCGLCKTRMIOS	0x5456
+#define TIOCSLCKTRMIOS	0x5457
+#define TIOCSERGSTRUCT	0x5458 /* For debugging only */
+#define TIOCSERGETLSR   0x5459 /* Get line status register */
+  /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
+# define TIOCSER_TEMT    0x01	/* Transmitter physically empty */
+#define TIOCSERGETMULTI 0x545A /* Get multiport config  */
+#define TIOCSERSETMULTI 0x545B /* Set multiport config */
+
+#define TIOCMIWAIT	0x545C	/* wait for a change on serial input line(s) */
+#define TIOCGICOUNT	0x545D	/* read serial port inline interrupt counts */
+
+#endif /* _ASM_PPC64_IOCTLS_H */
diff --git a/trunk/include/asm-ppc64/iommu.h b/trunk/include/asm-ppc64/iommu.h
index 72dcf8116b04..729de5cc21d9 100644
--- a/trunk/include/asm-ppc64/iommu.h
+++ b/trunk/include/asm-ppc64/iommu.h
@@ -104,6 +104,9 @@ extern void iommu_devnode_init_pSeries(struct device_node *dn);
 
 #ifdef CONFIG_PPC_ISERIES
 
+/* Initializes tables for bio buses */
+extern void __init iommu_vio_init(void);
+
 struct iSeries_Device_Node;
 /* Creates table for an individual device node */
 extern void iommu_devnode_init_iSeries(struct iSeries_Device_Node *dn);
diff --git a/trunk/include/asm-ppc64/ipc.h b/trunk/include/asm-ppc64/ipc.h
new file mode 100644
index 000000000000..a46e3d9c2a3f
--- /dev/null
+++ b/trunk/include/asm-ppc64/ipc.h
@@ -0,0 +1 @@
+#include <asm-generic/ipc.h>
diff --git a/trunk/include/asm-ppc64/linkage.h b/trunk/include/asm-ppc64/linkage.h
new file mode 100644
index 000000000000..291c2d01c44f
--- /dev/null
+++ b/trunk/include/asm-ppc64/linkage.h
@@ -0,0 +1,6 @@
+#ifndef __ASM_LINKAGE_H
+#define __ASM_LINKAGE_H
+
+/* Nothing to see here... */
+
+#endif
diff --git a/trunk/include/asm-ppc64/lmb.h b/trunk/include/asm-ppc64/lmb.h
index cb368bf0f264..a6cbca21ac1d 100644
--- a/trunk/include/asm-ppc64/lmb.h
+++ b/trunk/include/asm-ppc64/lmb.h
@@ -22,6 +22,7 @@
 
 struct lmb_property {
 	unsigned long base;
+	unsigned long physbase;
 	unsigned long size;
 };
 
diff --git a/trunk/include/asm-powerpc/local.h b/trunk/include/asm-ppc64/local.h
similarity index 100%
rename from trunk/include/asm-powerpc/local.h
rename to trunk/include/asm-ppc64/local.h
diff --git a/trunk/include/asm-ppc64/machdep.h b/trunk/include/asm-ppc64/machdep.h
index ff2c9287d3b6..f0ef06375947 100644
--- a/trunk/include/asm-ppc64/machdep.h
+++ b/trunk/include/asm-ppc64/machdep.h
@@ -140,9 +140,6 @@ struct machdep_calls {
 
 	/* Idle loop for this platform, leave empty for default idle loop */
 	int		(*idle_loop)(void);
-
-	/* Function to enable pmcs for this platform, called once per cpu. */
-	void		(*enable_pmcs)(void);
 };
 
 extern int default_idle(void);
diff --git a/trunk/include/asm-ppc64/mmu.h b/trunk/include/asm-ppc64/mmu.h
index ad36bb28de29..70348a851313 100644
--- a/trunk/include/asm-ppc64/mmu.h
+++ b/trunk/include/asm-ppc64/mmu.h
@@ -28,12 +28,9 @@
 #define STE_VSID_SHIFT	12
 
 /* Location of cpu0's segment table */
-#define STAB0_PAGE	0x6
+#define STAB0_PAGE	0x9
 #define STAB0_PHYS_ADDR	(STAB0_PAGE<<PAGE_SHIFT)
-
-#ifndef __ASSEMBLY__
-extern char initial_stab[];
-#endif /* ! __ASSEMBLY */
+#define STAB0_VIRT_ADDR	(KERNELBASE+STAB0_PHYS_ADDR)
 
 /*
  * SLB
@@ -262,10 +259,8 @@ extern void stabs_alloc(void);
 #define VSID_BITS	36
 #define VSID_MODULUS	((1UL<<VSID_BITS)-1)
 
-#define CONTEXT_BITS	19
-#define USER_ESID_BITS	16
-
-#define USER_VSID_RANGE	(1UL << (USER_ESID_BITS + SID_SHIFT))
+#define CONTEXT_BITS	20
+#define USER_ESID_BITS	15
 
 /*
  * This macro generates asm code to compute the VSID scramble
@@ -307,7 +302,8 @@ typedef unsigned long mm_context_id_t;
 typedef struct {
 	mm_context_id_t id;
 #ifdef CONFIG_HUGETLB_PAGE
-	u16 low_htlb_areas, high_htlb_areas;
+	pgd_t *huge_pgdir;
+	u16 htlb_segs; /* bitmask */
 #endif
 } mm_context_t;
 
diff --git a/trunk/include/asm-ppc64/naca.h b/trunk/include/asm-ppc64/naca.h
index d2afe6447597..bfb7caa32eaf 100644
--- a/trunk/include/asm-ppc64/naca.h
+++ b/trunk/include/asm-ppc64/naca.h
@@ -12,6 +12,8 @@
 
 #include <asm/types.h>
 
+#ifndef __ASSEMBLY__
+
 struct naca_struct {
 	/* Kernel only data - undefined for user space */
 	void *xItVpdAreas;              /* VPD Data                  0x00 */
@@ -21,4 +23,9 @@ struct naca_struct {
 
 extern struct naca_struct naca;
 
+#endif /* __ASSEMBLY__ */
+
+#define NACA_PAGE      0x4
+#define NACA_PHYS_ADDR (NACA_PAGE<<PAGE_SHIFT)
+
 #endif /* _NACA_H */
diff --git a/trunk/include/asm-ppc64/namei.h b/trunk/include/asm-ppc64/namei.h
new file mode 100644
index 000000000000..a1412a2d102a
--- /dev/null
+++ b/trunk/include/asm-ppc64/namei.h
@@ -0,0 +1,23 @@
+/* 
+ * linux/include/asm-ppc/namei.h
+ * Adapted from linux/include/asm-alpha/namei.h
+ *
+ * Included from linux/fs/namei.c
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#ifndef __PPC64_NAMEI_H
+#define __PPC64_NAMEI_H
+
+/* This dummy routine maybe changed to something useful
+ * for /usr/gnemul/ emulation stuff.
+ * Look at asm-sparc/namei.h for details.
+ */
+
+#define __emul_prefix() NULL
+
+#endif /* __PPC64_NAMEI_H */
diff --git a/trunk/include/asm-ppc64/page.h b/trunk/include/asm-ppc64/page.h
index a79a08df62bd..a5893a305a09 100644
--- a/trunk/include/asm-ppc64/page.h
+++ b/trunk/include/asm-ppc64/page.h
@@ -37,45 +37,39 @@
 
 #define HUGETLB_PAGE_ORDER	(HPAGE_SHIFT - PAGE_SHIFT)
 
-#define HTLB_AREA_SHIFT		40
-#define HTLB_AREA_SIZE		(1UL << HTLB_AREA_SHIFT)
-#define GET_HTLB_AREA(x)	((x) >> HTLB_AREA_SHIFT)
+/* For 64-bit processes the hugepage range is 1T-1.5T */
+#define TASK_HPAGE_BASE ASM_CONST(0x0000010000000000)
+#define TASK_HPAGE_END 	ASM_CONST(0x0000018000000000)
 
 #define LOW_ESID_MASK(addr, len)	(((1U << (GET_ESID(addr+len-1)+1)) \
 	   	                	- (1U << GET_ESID(addr))) & 0xffff)
-#define HTLB_AREA_MASK(addr, len)	(((1U << (GET_HTLB_AREA(addr+len-1)+1)) \
-	   	                	- (1U << GET_HTLB_AREA(addr))) & 0xffff)
 
 #define ARCH_HAS_HUGEPAGE_ONLY_RANGE
 #define ARCH_HAS_PREPARE_HUGEPAGE_RANGE
-#define ARCH_HAS_SETCLEAR_HUGE_PTE
 
 #define touches_hugepage_low_range(mm, addr, len) \
-	(LOW_ESID_MASK((addr), (len)) & (mm)->context.low_htlb_areas)
-#define touches_hugepage_high_range(mm, addr, len) \
-	(HTLB_AREA_MASK((addr), (len)) & (mm)->context.high_htlb_areas)
+	(LOW_ESID_MASK((addr), (len)) & mm->context.htlb_segs)
+#define touches_hugepage_high_range(addr, len) \
+	(((addr) > (TASK_HPAGE_BASE-(len))) && ((addr) < TASK_HPAGE_END))
 
 #define __within_hugepage_low_range(addr, len, segmask) \
 	((LOW_ESID_MASK((addr), (len)) | (segmask)) == (segmask))
 #define within_hugepage_low_range(addr, len) \
 	__within_hugepage_low_range((addr), (len), \
-				    current->mm->context.low_htlb_areas)
-#define __within_hugepage_high_range(addr, len, zonemask) \
-	((HTLB_AREA_MASK((addr), (len)) | (zonemask)) == (zonemask))
-#define within_hugepage_high_range(addr, len) \
-	__within_hugepage_high_range((addr), (len), \
-				    current->mm->context.high_htlb_areas)
+				    current->mm->context.htlb_segs)
+#define within_hugepage_high_range(addr, len) (((addr) >= TASK_HPAGE_BASE) \
+	  && ((addr)+(len) <= TASK_HPAGE_END) && ((addr)+(len) >= (addr)))
 
 #define is_hugepage_only_range(mm, addr, len) \
-	(touches_hugepage_high_range((mm), (addr), (len)) || \
+	(touches_hugepage_high_range((addr), (len)) || \
 	  touches_hugepage_low_range((mm), (addr), (len)))
 #define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
 
 #define in_hugepage_area(context, addr) \
 	(cpu_has_feature(CPU_FTR_16M_PAGE) && \
-	 ( ((1 << GET_HTLB_AREA(addr)) & (context).high_htlb_areas) || \
+	 ( (((addr) >= TASK_HPAGE_BASE) && ((addr) < TASK_HPAGE_END)) || \
 	   ( ((addr) < 0x100000000L) && \
-	     ((1 << GET_ESID(addr)) & (context).low_htlb_areas) ) ) )
+	     ((1 << GET_ESID(addr)) & (context).htlb_segs) ) ) )
 
 #else /* !CONFIG_HUGETLB_PAGE */
 
@@ -131,42 +125,36 @@ extern void copy_user_page(void *to, void *from, unsigned long vaddr, struct pag
  * Entries in the pte table are 64b, while entries in the pgd & pmd are 32b.
  */
 typedef struct { unsigned long pte; } pte_t;
-typedef struct { unsigned long pmd; } pmd_t;
-typedef struct { unsigned long pud; } pud_t;
-typedef struct { unsigned long pgd; } pgd_t;
+typedef struct { unsigned int  pmd; } pmd_t;
+typedef struct { unsigned int  pgd; } pgd_t;
 typedef struct { unsigned long pgprot; } pgprot_t;
 
 #define pte_val(x)	((x).pte)
 #define pmd_val(x)	((x).pmd)
-#define pud_val(x)	((x).pud)
 #define pgd_val(x)	((x).pgd)
 #define pgprot_val(x)	((x).pgprot)
 
-#define __pte(x)	((pte_t) { (x) })
-#define __pmd(x)	((pmd_t) { (x) })
-#define __pud(x)	((pud_t) { (x) })
-#define __pgd(x)	((pgd_t) { (x) })
-#define __pgprot(x)	((pgprot_t) { (x) })
+#define __pte(x)	((pte_t) { (x) } )
+#define __pmd(x)	((pmd_t) { (x) } )
+#define __pgd(x)	((pgd_t) { (x) } )
+#define __pgprot(x)	((pgprot_t) { (x) } )
 
 #else
 /*
  * .. while these make it easier on the compiler
  */
 typedef unsigned long pte_t;
-typedef unsigned long pmd_t;
-typedef unsigned long pud_t;
-typedef unsigned long pgd_t;
+typedef unsigned int  pmd_t;
+typedef unsigned int  pgd_t;
 typedef unsigned long pgprot_t;
 
 #define pte_val(x)	(x)
 #define pmd_val(x)	(x)
-#define pud_val(x)	(x)
 #define pgd_val(x)	(x)
 #define pgprot_val(x)	(x)
 
 #define __pte(x)	(x)
 #define __pmd(x)	(x)
-#define __pud(x)	(x)
 #define __pgd(x)	(x)
 #define __pgprot(x)	(x)
 
@@ -220,6 +208,9 @@ extern u64 ppc64_pft_size;		/* Log 2 of page table size */
 #define USER_REGION_ID     (0UL)
 #define REGION_ID(ea)	   (((unsigned long)(ea)) >> REGION_SHIFT)
 
+#define __bpn_to_ba(x) ((((unsigned long)(x)) << PAGE_SHIFT) + KERNELBASE)
+#define __ba_to_bpn(x) ((((unsigned long)(x)) & ~REGION_MASK) >> PAGE_SHIFT)
+
 #define __va(x) ((void *)((unsigned long)(x) + KERNELBASE))
 
 #ifdef CONFIG_DISCONTIGMEM
diff --git a/trunk/include/asm-ppc64/param.h b/trunk/include/asm-ppc64/param.h
index 76c212d475b3..1fad38dcf707 100644
--- a/trunk/include/asm-ppc64/param.h
+++ b/trunk/include/asm-ppc64/param.h
@@ -1,8 +1,6 @@
 #ifndef _ASM_PPC64_PARAM_H
 #define _ASM_PPC64_PARAM_H
 
-#include <linux/config.h>
-
 /*
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -11,7 +9,7 @@
  */
 
 #ifdef __KERNEL__
-# define HZ		CONFIG_HZ	/* Internal kernel timer frequency */
+# define HZ		1000		/* Internal kernel timer frequency */
 # define USER_HZ	100		/* .. some user interfaces are in "ticks" */
 # define CLOCKS_PER_SEC	(USER_HZ)	/* like times() */
 #endif
diff --git a/trunk/include/asm-ppc64/percpu.h b/trunk/include/asm-ppc64/percpu.h
new file mode 100644
index 000000000000..60a659a4ce1f
--- /dev/null
+++ b/trunk/include/asm-ppc64/percpu.h
@@ -0,0 +1,6 @@
+#ifndef __ARCH_PPC64_PERCPU__
+#define __ARCH_PPC64_PERCPU__
+
+#include <asm-generic/percpu.h>
+
+#endif /* __ARCH_PPC64_PERCPU__ */
diff --git a/trunk/include/asm-ppc64/pgalloc.h b/trunk/include/asm-ppc64/pgalloc.h
index 26bc49c1108d..4fc4b739b380 100644
--- a/trunk/include/asm-ppc64/pgalloc.h
+++ b/trunk/include/asm-ppc64/pgalloc.h
@@ -6,12 +6,7 @@
 #include <linux/cpumask.h>
 #include <linux/percpu.h>
 
-extern kmem_cache_t *pgtable_cache[];
-
-#define PTE_CACHE_NUM	0
-#define PMD_CACHE_NUM	1
-#define PUD_CACHE_NUM	1
-#define PGD_CACHE_NUM	0
+extern kmem_cache_t *zero_cache;
 
 /*
  * This program is free software; you can redistribute it and/or
@@ -20,40 +15,30 @@ extern kmem_cache_t *pgtable_cache[];
  * 2 of the License, or (at your option) any later version.
  */
 
-static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+static inline pgd_t *
+pgd_alloc(struct mm_struct *mm)
 {
-	return kmem_cache_alloc(pgtable_cache[PGD_CACHE_NUM], GFP_KERNEL);
+	return kmem_cache_alloc(zero_cache, GFP_KERNEL);
 }
 
-static inline void pgd_free(pgd_t *pgd)
+static inline void
+pgd_free(pgd_t *pgd)
 {
-	kmem_cache_free(pgtable_cache[PGD_CACHE_NUM], pgd);
-}
-
-#define pgd_populate(MM, PGD, PUD)	pgd_set(PGD, PUD)
-
-static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
-{
-	return kmem_cache_alloc(pgtable_cache[PUD_CACHE_NUM],
-				GFP_KERNEL|__GFP_REPEAT);
-}
-
-static inline void pud_free(pud_t *pud)
-{
-	kmem_cache_free(pgtable_cache[PUD_CACHE_NUM], pud);
+	kmem_cache_free(zero_cache, pgd);
 }
 
 #define pud_populate(MM, PUD, PMD)	pud_set(PUD, PMD)
 
-static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
+static inline pmd_t *
+pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-	return kmem_cache_alloc(pgtable_cache[PMD_CACHE_NUM],
-				GFP_KERNEL|__GFP_REPEAT);
+	return kmem_cache_alloc(zero_cache, GFP_KERNEL|__GFP_REPEAT);
 }
 
-static inline void pmd_free(pmd_t *pmd)
+static inline void
+pmd_free(pmd_t *pmd)
 {
-	kmem_cache_free(pgtable_cache[PMD_CACHE_NUM], pmd);
+	kmem_cache_free(zero_cache, pmd);
 }
 
 #define pmd_populate_kernel(mm, pmd, pte) pmd_set(pmd, pte)
@@ -62,58 +47,44 @@ static inline void pmd_free(pmd_t *pmd)
 
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
 {
-	return kmem_cache_alloc(pgtable_cache[PTE_CACHE_NUM],
-				GFP_KERNEL|__GFP_REPEAT);
+	return kmem_cache_alloc(zero_cache, GFP_KERNEL|__GFP_REPEAT);
 }
 
 static inline struct page *pte_alloc_one(struct mm_struct *mm, unsigned long address)
 {
-	return virt_to_page(pte_alloc_one_kernel(mm, address));
+	pte_t *pte = kmem_cache_alloc(zero_cache, GFP_KERNEL|__GFP_REPEAT);
+	if (pte)
+		return virt_to_page(pte);
+	return NULL;
 }
 		
 static inline void pte_free_kernel(pte_t *pte)
 {
-	kmem_cache_free(pgtable_cache[PTE_CACHE_NUM], pte);
+	kmem_cache_free(zero_cache, pte);
 }
 
 static inline void pte_free(struct page *ptepage)
 {
-	pte_free_kernel(page_address(ptepage));
+	kmem_cache_free(zero_cache, page_address(ptepage));
 }
 
-#define PGF_CACHENUM_MASK	0xf
-
-typedef struct pgtable_free {
-	unsigned long val;
-} pgtable_free_t;
-
-static inline pgtable_free_t pgtable_free_cache(void *p, int cachenum,
-						unsigned long mask)
+struct pte_freelist_batch
 {
-	BUG_ON(cachenum > PGF_CACHENUM_MASK);
+	struct rcu_head	rcu;
+	unsigned int	index;
+	struct page *	pages[0];
+};
 
-	return (pgtable_free_t){.val = ((unsigned long) p & ~mask) | cachenum};
-}
+#define PTE_FREELIST_SIZE	((PAGE_SIZE - sizeof(struct pte_freelist_batch)) / \
+				  sizeof(struct page *))
 
-static inline void pgtable_free(pgtable_free_t pgf)
-{
-	void *p = (void *)(pgf.val & ~PGF_CACHENUM_MASK);
-	int cachenum = pgf.val & PGF_CACHENUM_MASK;
+extern void pte_free_now(struct page *ptepage);
+extern void pte_free_submit(struct pte_freelist_batch *batch);
 
-	kmem_cache_free(pgtable_cache[cachenum], p);
-}
+DECLARE_PER_CPU(struct pte_freelist_batch *, pte_freelist_cur);
 
-void pgtable_free_tlb(struct mmu_gather *tlb, pgtable_free_t pgf);
-
-#define __pte_free_tlb(tlb, ptepage)	\
-	pgtable_free_tlb(tlb, pgtable_free_cache(page_address(ptepage), \
-		PTE_CACHE_NUM, PTE_TABLE_SIZE-1))
-#define __pmd_free_tlb(tlb, pmd) 	\
-	pgtable_free_tlb(tlb, pgtable_free_cache(pmd, \
-		PMD_CACHE_NUM, PMD_TABLE_SIZE-1))
-#define __pud_free_tlb(tlb, pmd)	\
-	pgtable_free_tlb(tlb, pgtable_free_cache(pud, \
-		PUD_CACHE_NUM, PUD_TABLE_SIZE-1))
+void __pte_free_tlb(struct mmu_gather *tlb, struct page *ptepage);
+#define __pmd_free_tlb(tlb, pmd)	__pte_free_tlb(tlb, virt_to_page(pmd))
 
 #define check_pgt_cache()	do { } while (0)
 
diff --git a/trunk/include/asm-ppc64/pgtable.h b/trunk/include/asm-ppc64/pgtable.h
index c83679c9d2b0..46cf61c2ff69 100644
--- a/trunk/include/asm-ppc64/pgtable.h
+++ b/trunk/include/asm-ppc64/pgtable.h
@@ -15,24 +15,19 @@
 #include <asm/tlbflush.h>
 #endif /* __ASSEMBLY__ */
 
+#include <asm-generic/pgtable-nopud.h>
+
 /*
  * Entries per page directory level.  The PTE level must use a 64b record
  * for each page table entry.  The PMD and PGD level use a 32b record for 
  * each entry by assuming that each entry is page aligned.
  */
 #define PTE_INDEX_SIZE  9
-#define PMD_INDEX_SIZE  7
-#define PUD_INDEX_SIZE  7
-#define PGD_INDEX_SIZE  9
-
-#define PTE_TABLE_SIZE	(sizeof(pte_t) << PTE_INDEX_SIZE)
-#define PMD_TABLE_SIZE	(sizeof(pmd_t) << PMD_INDEX_SIZE)
-#define PUD_TABLE_SIZE	(sizeof(pud_t) << PUD_INDEX_SIZE)
-#define PGD_TABLE_SIZE	(sizeof(pgd_t) << PGD_INDEX_SIZE)
+#define PMD_INDEX_SIZE  10
+#define PGD_INDEX_SIZE  10
 
 #define PTRS_PER_PTE	(1 << PTE_INDEX_SIZE)
 #define PTRS_PER_PMD	(1 << PMD_INDEX_SIZE)
-#define PTRS_PER_PUD	(1 << PMD_INDEX_SIZE)
 #define PTRS_PER_PGD	(1 << PGD_INDEX_SIZE)
 
 /* PMD_SHIFT determines what a second-level page table entry can map */
@@ -40,13 +35,8 @@
 #define PMD_SIZE	(1UL << PMD_SHIFT)
 #define PMD_MASK	(~(PMD_SIZE-1))
 
-/* PUD_SHIFT determines what a third-level page table entry can map */
-#define PUD_SHIFT	(PMD_SHIFT + PMD_INDEX_SIZE)
-#define PUD_SIZE	(1UL << PUD_SHIFT)
-#define PUD_MASK	(~(PUD_SIZE-1))
-
-/* PGDIR_SHIFT determines what a fourth-level page table entry can map */
-#define PGDIR_SHIFT	(PUD_SHIFT + PUD_INDEX_SIZE)
+/* PGDIR_SHIFT determines what a third-level page table entry can map */
+#define PGDIR_SHIFT	(PMD_SHIFT + PMD_INDEX_SIZE)
 #define PGDIR_SIZE	(1UL << PGDIR_SHIFT)
 #define PGDIR_MASK	(~(PGDIR_SIZE-1))
 
@@ -55,23 +45,15 @@
 /*
  * Size of EA range mapped by our pagetables.
  */
-#define PGTABLE_EADDR_SIZE (PTE_INDEX_SIZE + PMD_INDEX_SIZE + \
-                	    PUD_INDEX_SIZE + PGD_INDEX_SIZE + PAGE_SHIFT)
-#define PGTABLE_RANGE (1UL << PGTABLE_EADDR_SIZE)
-
-#if TASK_SIZE_USER64 > PGTABLE_RANGE
-#error TASK_SIZE_USER64 exceeds pagetable range
-#endif
-
-#if TASK_SIZE_USER64 > (1UL << (USER_ESID_BITS + SID_SHIFT))
-#error TASK_SIZE_USER64 exceeds user VSID range
-#endif
+#define EADDR_SIZE (PTE_INDEX_SIZE + PMD_INDEX_SIZE + \
+                    PGD_INDEX_SIZE + PAGE_SHIFT)
+#define EADDR_MASK ((1UL << EADDR_SIZE) - 1)
 
 /*
  * Define the address range of the vmalloc VM area.
  */
 #define VMALLOC_START (0xD000000000000000ul)
-#define VMALLOC_SIZE  (0x80000000000UL)
+#define VMALLOC_SIZE  (0x10000000000UL)
 #define VMALLOC_END   (VMALLOC_START + VMALLOC_SIZE)
 
 /*
@@ -172,6 +154,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE/sizeof(unsigned long)];
 #ifndef __ASSEMBLY__
 int hash_huge_page(struct mm_struct *mm, unsigned long access,
 		   unsigned long ea, unsigned long vsid, int local);
+
+void hugetlb_mm_free_pgd(struct mm_struct *mm);
 #endif /* __ASSEMBLY__ */
 
 #define HAVE_ARCH_UNMAPPED_AREA
@@ -179,6 +163,7 @@ int hash_huge_page(struct mm_struct *mm, unsigned long access,
 #else
 
 #define hash_huge_page(mm,a,ea,vsid,local)	-1
+#define hugetlb_mm_free_pgd(mm)			do {} while (0)
 
 #endif
 
@@ -212,45 +197,39 @@ static inline pte_t pfn_pte(unsigned long pfn, pgprot_t pgprot)
 #define pte_pfn(x)		((unsigned long)((pte_val(x) >> PTE_SHIFT)))
 #define pte_page(x)		pfn_to_page(pte_pfn(x))
 
-#define pmd_set(pmdp, ptep) 	({BUG_ON((u64)ptep < KERNELBASE); pmd_val(*(pmdp)) = (unsigned long)(ptep);})
+#define pmd_set(pmdp, ptep) 	\
+	(pmd_val(*(pmdp)) = __ba_to_bpn(ptep))
 #define pmd_none(pmd)		(!pmd_val(pmd))
 #define	pmd_bad(pmd)		(pmd_val(pmd) == 0)
 #define	pmd_present(pmd)	(pmd_val(pmd) != 0)
 #define	pmd_clear(pmdp)		(pmd_val(*(pmdp)) = 0)
-#define pmd_page_kernel(pmd)	(pmd_val(pmd))
+#define pmd_page_kernel(pmd)	(__bpn_to_ba(pmd_val(pmd)))
 #define pmd_page(pmd)		virt_to_page(pmd_page_kernel(pmd))
 
-#define pud_set(pudp, pmdp)	(pud_val(*(pudp)) = (unsigned long)(pmdp))
+#define pud_set(pudp, pmdp)	(pud_val(*(pudp)) = (__ba_to_bpn(pmdp)))
 #define pud_none(pud)		(!pud_val(pud))
-#define pud_bad(pud)		((pud_val(pud)) == 0)
-#define pud_present(pud)	(pud_val(pud) != 0)
-#define pud_clear(pudp)		(pud_val(*(pudp)) = 0)
-#define pud_page(pud)		(pud_val(pud))
-
-#define pgd_set(pgdp, pudp)	({pgd_val(*(pgdp)) = (unsigned long)(pudp);})
-#define pgd_none(pgd)		(!pgd_val(pgd))
-#define pgd_bad(pgd)		(pgd_val(pgd) == 0)
-#define pgd_present(pgd)	(pgd_val(pgd) != 0)
-#define pgd_clear(pgdp)		(pgd_val(*(pgdp)) = 0)
-#define pgd_page(pgd)		(pgd_val(pgd))
+#define pud_bad(pud)		((pud_val(pud)) == 0UL)
+#define pud_present(pud)	(pud_val(pud) != 0UL)
+#define pud_clear(pudp)		(pud_val(*(pudp)) = 0UL)
+#define pud_page(pud)		(__bpn_to_ba(pud_val(pud)))
 
 /* 
  * Find an entry in a page-table-directory.  We combine the address region 
  * (the high order N bits) and the pgd portion of the address.
  */
 /* to avoid overflow in free_pgtables we don't use PTRS_PER_PGD here */
-#define pgd_index(address) (((address) >> (PGDIR_SHIFT)) & 0x1ff)
+#define pgd_index(address) (((address) >> (PGDIR_SHIFT)) & 0x7ff)
 
 #define pgd_offset(mm, address)	 ((mm)->pgd + pgd_index(address))
 
-#define pud_offset(pgdp, addr)	\
-  (((pud_t *) pgd_page(*(pgdp))) + (((addr) >> PUD_SHIFT) & (PTRS_PER_PUD - 1)))
-
+/* Find an entry in the second-level page table.. */
 #define pmd_offset(pudp,addr) \
-  (((pmd_t *) pud_page(*(pudp))) + (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1)))
+  ((pmd_t *) pud_page(*(pudp)) + (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1)))
 
+/* Find an entry in the third-level page table.. */
 #define pte_offset_kernel(dir,addr) \
-  (((pte_t *) pmd_page_kernel(*(dir))) + (((addr) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1)))
+  ((pte_t *) pmd_page_kernel(*(dir)) \
+ + (((addr) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1)))
 
 #define pte_offset_map(dir,addr)	pte_offset_kernel((dir), (addr))
 #define pte_offset_map_nested(dir,addr)	pte_offset_kernel((dir), (addr))
@@ -479,20 +458,23 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long addr,
 #define pte_same(A,B)	(((pte_val(A) ^ pte_val(B)) & ~_PAGE_HPTEFLAGS) == 0)
 
 #define pmd_ERROR(e) \
-	printk("%s:%d: bad pmd %08lx.\n", __FILE__, __LINE__, pmd_val(e))
-#define pud_ERROR(e) \
-	printk("%s:%d: bad pmd %08lx.\n", __FILE__, __LINE__, pud_val(e))
+	printk("%s:%d: bad pmd %08x.\n", __FILE__, __LINE__, pmd_val(e))
 #define pgd_ERROR(e) \
-	printk("%s:%d: bad pgd %08lx.\n", __FILE__, __LINE__, pgd_val(e))
+	printk("%s:%d: bad pgd %08x.\n", __FILE__, __LINE__, pgd_val(e))
 
 extern pgd_t swapper_pg_dir[];
 
 extern void paging_init(void);
 
-#ifdef CONFIG_HUGETLB_PAGE
+/*
+ * Because the huge pgtables are only 2 level, they can take
+ * at most around 4M, much less than one hugepage which the
+ * process is presumably entitled to use.  So we don't bother
+ * freeing up the pagetables on unmap, and wait until
+ * destroy_context() to clean up the lot.
+ */
 #define hugetlb_free_pgd_range(tlb, addr, end, floor, ceiling) \
-	free_pgd_range(tlb, addr, end, floor, ceiling)
-#endif
+						do { } while (0)
 
 /*
  * This gets called at the end of handling a page fault, when
diff --git a/trunk/include/asm-ppc64/pmc.h b/trunk/include/asm-ppc64/pmc.h
index d1d297dbccfe..c924748c0bea 100644
--- a/trunk/include/asm-ppc64/pmc.h
+++ b/trunk/include/asm-ppc64/pmc.h
@@ -26,6 +26,4 @@ typedef void (*perf_irq_t)(struct pt_regs *);
 int reserve_pmc_hardware(perf_irq_t new_perf_irq);
 void release_pmc_hardware(void);
 
-void power4_enable_pmcs(void);
-
 #endif /* _PPC64_PMC_H */
diff --git a/trunk/include/asm-ppc64/poll.h b/trunk/include/asm-ppc64/poll.h
new file mode 100644
index 000000000000..370fa3ba0db4
--- /dev/null
+++ b/trunk/include/asm-ppc64/poll.h
@@ -0,0 +1,32 @@
+#ifndef __PPC64_POLL_H
+#define __PPC64_POLL_H
+
+/*
+ * Copyright (C) 2001 PPC64 Team, IBM Corp
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#define POLLIN		0x0001
+#define POLLPRI		0x0002
+#define POLLOUT		0x0004
+#define POLLERR		0x0008
+#define POLLHUP		0x0010
+#define POLLNVAL	0x0020
+#define POLLRDNORM	0x0040
+#define POLLRDBAND	0x0080
+#define POLLWRNORM	0x0100
+#define POLLWRBAND	0x0200
+#define POLLMSG		0x0400
+#define POLLREMOVE	0x1000
+
+struct pollfd {
+	int fd;
+	short events;
+	short revents;
+};
+
+#endif /* __PPC64_POLL_H */
diff --git a/trunk/include/asm-ppc64/processor.h b/trunk/include/asm-ppc64/processor.h
index 7bd4796f1236..352306cfb579 100644
--- a/trunk/include/asm-ppc64/processor.h
+++ b/trunk/include/asm-ppc64/processor.h
@@ -268,7 +268,6 @@
 #define PV_970FX	0x003C
 #define	PV_630        	0x0040
 #define	PV_630p	        0x0041
-#define	PV_970MP	0x0044
 #define	PV_BE		0x0070
 
 /* Platforms supported by PPC64 */
@@ -383,8 +382,8 @@ extern long kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
 extern struct task_struct *last_task_used_math;
 extern struct task_struct *last_task_used_altivec;
 
-/* 64-bit user address space is 44-bits (16TB user VM) */
-#define TASK_SIZE_USER64 (0x0000100000000000UL)
+/* 64-bit user address space is 41-bits (2TBs user VM) */
+#define TASK_SIZE_USER64 (0x0000020000000000UL)
 
 /* 
  * 32-bit user address space is 4GB - 1 page 
diff --git a/trunk/include/asm-ppc64/prom.h b/trunk/include/asm-ppc64/prom.h
index dc5330b39509..04b1a84f7ca3 100644
--- a/trunk/include/asm-ppc64/prom.h
+++ b/trunk/include/asm-ppc64/prom.h
@@ -22,15 +22,13 @@
 #define RELOC(x)        (*PTRRELOC(&(x)))
 
 /* Definitions used by the flattened device tree */
-#define OF_DT_HEADER		0xd00dfeed	/* marker */
-#define OF_DT_BEGIN_NODE	0x1		/* Start of node, full name */
+#define OF_DT_HEADER		0xd00dfeed	/* 4: version, 4: total size */
+#define OF_DT_BEGIN_NODE	0x1		/* Start node: full name */
 #define OF_DT_END_NODE		0x2		/* End node */
-#define OF_DT_PROP		0x3		/* Property: name off, size,
-						 * content */
-#define OF_DT_NOP		0x4		/* nop */
+#define OF_DT_PROP		0x3		/* Property: name off, size, content */
 #define OF_DT_END		0x9
 
-#define OF_DT_VERSION		0x10
+#define OF_DT_VERSION		1
 
 /*
  * This is what gets passed to the kernel by prom_init or kexec
@@ -56,9 +54,7 @@ struct boot_param_header
 	u32	version;		/* format version */
 	u32	last_comp_version;	/* last compatible version */
 	/* version 2 fields below */
-	u32	boot_cpuid_phys;	/* Physical CPU id we're booting on */
-	/* version 3 fields below */
-	u32	dt_strings_size;	/* size of the DT strings block */
+	u32	boot_cpuid_phys;	/* Which physical CPU id we're booting on */
 };
 
 
diff --git a/trunk/include/asm-ppc64/resource.h b/trunk/include/asm-ppc64/resource.h
new file mode 100644
index 000000000000..add031b9dfd4
--- /dev/null
+++ b/trunk/include/asm-ppc64/resource.h
@@ -0,0 +1,6 @@
+#ifndef _PPC64_RESOURCE_H
+#define _PPC64_RESOURCE_H
+
+#include <asm-generic/resource.h>
+
+#endif /* _PPC64_RESOURCE_H */
diff --git a/trunk/include/asm-ppc64/shmparam.h b/trunk/include/asm-ppc64/shmparam.h
new file mode 100644
index 000000000000..b2825ceff05e
--- /dev/null
+++ b/trunk/include/asm-ppc64/shmparam.h
@@ -0,0 +1,13 @@
+#ifndef _PPC64_SHMPARAM_H
+#define _PPC64_SHMPARAM_H
+
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#define	SHMLBA PAGE_SIZE		 /* attach addr a multiple of this */
+
+#endif /* _PPC64_SHMPARAM_H */
diff --git a/trunk/include/asm-ppc64/socket.h b/trunk/include/asm-ppc64/socket.h
index 9e1af8eb2d96..59e00dfc8b8e 100644
--- a/trunk/include/asm-ppc64/socket.h
+++ b/trunk/include/asm-ppc64/socket.h
@@ -21,8 +21,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-ppc64/string.h b/trunk/include/asm-ppc64/string.h
new file mode 100644
index 000000000000..eeca68ef1e91
--- /dev/null
+++ b/trunk/include/asm-ppc64/string.h
@@ -0,0 +1,35 @@
+#ifndef _PPC64_STRING_H_
+#define _PPC64_STRING_H_
+
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#define __HAVE_ARCH_STRCPY
+#define __HAVE_ARCH_STRNCPY
+#define __HAVE_ARCH_STRLEN
+#define __HAVE_ARCH_STRCMP
+#define __HAVE_ARCH_STRCAT
+#define __HAVE_ARCH_MEMSET
+#define __HAVE_ARCH_MEMCPY
+#define __HAVE_ARCH_MEMMOVE
+#define __HAVE_ARCH_MEMCMP
+#define __HAVE_ARCH_MEMCHR
+
+extern int strcasecmp(const char *, const char *);
+extern int strncasecmp(const char *, const char *, int);
+extern char * strcpy(char *,const char *);
+extern char * strncpy(char *,const char *, __kernel_size_t);
+extern __kernel_size_t strlen(const char *);
+extern int strcmp(const char *,const char *);
+extern char * strcat(char *, const char *);
+extern void * memset(void *,int,__kernel_size_t);
+extern void * memcpy(void *,const void *,__kernel_size_t);
+extern void * memmove(void *,const void *,__kernel_size_t);
+extern int memcmp(const void *,const void *,__kernel_size_t);
+extern void * memchr(const void *,int,__kernel_size_t);
+
+#endif /* _PPC64_STRING_H_ */
diff --git a/trunk/include/asm-ppc64/system.h b/trunk/include/asm-ppc64/system.h
index b9e1835351e9..98d120ca8a91 100644
--- a/trunk/include/asm-ppc64/system.h
+++ b/trunk/include/asm-ppc64/system.h
@@ -88,7 +88,7 @@ DEBUGGER_BOILERPLATE(debugger_dabr_match)
 DEBUGGER_BOILERPLATE(debugger_fault_handler)
 
 #ifdef CONFIG_XMON
-extern void xmon_init(int enable);
+extern void xmon_init(void);
 #endif
 
 #else
@@ -302,7 +302,5 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
 
 #define arch_align_stack(x) (x)
 
-extern unsigned long reloc_offset(void);
-
 #endif /* __KERNEL__ */
 #endif
diff --git a/trunk/include/asm-ppc64/unaligned.h b/trunk/include/asm-ppc64/unaligned.h
new file mode 100644
index 000000000000..636e93c4f379
--- /dev/null
+++ b/trunk/include/asm-ppc64/unaligned.h
@@ -0,0 +1,21 @@
+#ifndef __PPC64_UNALIGNED_H
+#define __PPC64_UNALIGNED_H
+
+/*
+ * The PowerPC can do unaligned accesses itself in big endian mode. 
+ *
+ * The strange macros are there to make sure these can't
+ * be misused in a way that makes them not work on other
+ * architectures where unaligned accesses aren't as simple.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#define get_unaligned(ptr) (*(ptr))
+
+#define put_unaligned(val, ptr) ((void)( *(ptr) = (val) ))
+
+#endif /* __PPC64_UNALIGNED_H */
diff --git a/trunk/include/asm-ppc64/vio.h b/trunk/include/asm-ppc64/vio.h
index 03f1b95f433b..20cd98ee6337 100644
--- a/trunk/include/asm-ppc64/vio.h
+++ b/trunk/include/asm-ppc64/vio.h
@@ -19,15 +19,13 @@
 #include <linux/errno.h>
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
-#include <linux/mod_devicetable.h>
-
 #include <asm/hvcall.h>
+#include <asm/prom.h>
 #include <asm/scatterlist.h>
-
-/*
+/* 
  * Architecture-specific constants for drivers to
  * extract attributes of the device using vio_get_attribute()
- */
+*/
 #define VETH_MAC_ADDR "local-mac-address"
 #define VETH_MCAST_FILTER_SIZE "ibm,mac-address-filters"
 
@@ -39,65 +37,64 @@
 #define VIO_IRQ_DISABLE		0UL
 #define VIO_IRQ_ENABLE		1UL
 
+struct vio_dev;
+struct vio_driver;
+struct vio_device_id;
 struct iommu_table;
 
-/*
- * The vio_dev structure is used to describe virtual I/O devices.
- */
-struct vio_dev {
-	struct iommu_table *iommu_table;     /* vio_map_* uses this */
-	char *name;
+int vio_register_driver(struct vio_driver *drv);
+void vio_unregister_driver(struct vio_driver *drv);
+
+#ifdef CONFIG_PPC_PSERIES
+struct vio_dev * __devinit vio_register_device_node(
+		struct device_node *node_vdev);
+#endif
+void __devinit vio_unregister_device(struct vio_dev *dev);
+struct vio_dev *vio_find_node(struct device_node *vnode);
+
+const void * vio_get_attribute(struct vio_dev *vdev, void* which, int* length);
+int vio_get_irq(struct vio_dev *dev);
+int vio_enable_interrupts(struct vio_dev *dev);
+int vio_disable_interrupts(struct vio_dev *dev);
+
+extern struct dma_mapping_ops vio_dma_ops;
+
+extern struct bus_type vio_bus_type;
+
+struct vio_device_id {
 	char *type;
-	uint32_t unit_address;
-	unsigned int irq;
-	struct device dev;
+	char *compat;
 };
 
 struct vio_driver {
 	struct list_head node;
 	char *name;
-	const struct vio_device_id *id_table;
-	int (*probe)(struct vio_dev *dev, const struct vio_device_id *id);
-	int (*remove)(struct vio_dev *dev);
+	const struct vio_device_id *id_table;	/* NULL if wants all devices */
+	int  (*probe)  (struct vio_dev *dev, const struct vio_device_id *id);	/* New device inserted */
+	int (*remove) (struct vio_dev *dev);	/* Device removed (NULL if not a hot-plug capable driver) */
 	unsigned long driver_data;
-	struct device_driver driver;
-};
 
-struct vio_bus_ops {
-	int (*match)(const struct vio_device_id *id, const struct vio_dev *dev);
-	void (*unregister_device)(struct vio_dev *);
-	void (*release_device)(struct device *);
+	struct device_driver driver;
 };
 
-extern struct dma_mapping_ops vio_dma_ops;
-extern struct bus_type vio_bus_type;
-extern struct vio_dev vio_bus_device;
-
-extern int vio_register_driver(struct vio_driver *drv);
-extern void vio_unregister_driver(struct vio_driver *drv);
-
-extern struct vio_dev * __devinit vio_register_device(struct vio_dev *viodev);
-extern void __devinit vio_unregister_device(struct vio_dev *dev);
-
-extern int vio_bus_init(struct vio_bus_ops *);
-
-#ifdef CONFIG_PPC_PSERIES
-struct device_node;
-
-extern struct vio_dev * __devinit vio_register_device_node(
-		struct device_node *node_vdev);
-extern struct vio_dev *vio_find_node(struct device_node *vnode);
-extern const void *vio_get_attribute(struct vio_dev *vdev, void *which,
-		int *length);
-extern int vio_enable_interrupts(struct vio_dev *dev);
-extern int vio_disable_interrupts(struct vio_dev *dev);
-#endif
-
 static inline struct vio_driver *to_vio_driver(struct device_driver *drv)
 {
 	return container_of(drv, struct vio_driver, driver);
 }
 
+/*
+ * The vio_dev structure is used to describe virtual I/O devices.
+ */
+struct vio_dev {
+	struct iommu_table *iommu_table;     /* vio_map_* uses this */
+	char *name;
+	char *type;
+	uint32_t unit_address;	
+	unsigned int irq;
+
+	struct device dev;
+};
+
 static inline struct vio_dev *to_vio_dev(struct device *dev)
 {
 	return container_of(dev, struct vio_dev, dev);
diff --git a/trunk/include/asm-ppc64/xor.h b/trunk/include/asm-ppc64/xor.h
new file mode 100644
index 000000000000..c82eb12a5b18
--- /dev/null
+++ b/trunk/include/asm-ppc64/xor.h
@@ -0,0 +1 @@
+#include <asm-generic/xor.h>
diff --git a/trunk/include/asm-s390/socket.h b/trunk/include/asm-s390/socket.h
index 15a5298c8744..0e96eeca4e6b 100644
--- a/trunk/include/asm-s390/socket.h
+++ b/trunk/include/asm-s390/socket.h
@@ -22,8 +22,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-sh/socket.h b/trunk/include/asm-sh/socket.h
index 553904ff9336..dde696c3b4c7 100644
--- a/trunk/include/asm-sh/socket.h
+++ b/trunk/include/asm-sh/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_RCVBUFFORCE	32
-#define SO_SNDBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-sparc/processor.h b/trunk/include/asm-sparc/processor.h
index 5a7a1a8d29ac..32c9699367cf 100644
--- a/trunk/include/asm-sparc/processor.h
+++ b/trunk/include/asm-sparc/processor.h
@@ -19,6 +19,7 @@
 #include <asm/ptrace.h>
 #include <asm/head.h>
 #include <asm/signal.h>
+#include <asm/segment.h>
 #include <asm/btfixup.h>
 #include <asm/page.h>
 
diff --git a/trunk/include/asm-sparc/segment.h b/trunk/include/asm-sparc/segment.h
new file mode 100644
index 000000000000..a1b7ffc9eec9
--- /dev/null
+++ b/trunk/include/asm-sparc/segment.h
@@ -0,0 +1,6 @@
+#ifndef __SPARC_SEGMENT_H
+#define __SPARC_SEGMENT_H
+
+/* Only here because we have some old header files that expect it.. */
+
+#endif
diff --git a/trunk/include/asm-sparc/socket.h b/trunk/include/asm-sparc/socket.h
index 09575b608adb..c1154e3ecfdf 100644
--- a/trunk/include/asm-sparc/socket.h
+++ b/trunk/include/asm-sparc/socket.h
@@ -29,8 +29,6 @@
 
 #define SO_SNDBUF	0x1001
 #define SO_RCVBUF	0x1002
-#define SO_SNDBUFFORCE	0x100a
-#define SO_RCVBUFFORCE	0x100b
 #define SO_ERROR	0x1007
 #define SO_TYPE		0x1008
 
diff --git a/trunk/include/asm-sparc/system.h b/trunk/include/asm-sparc/system.h
index 3557781a4bfd..898562ebe94c 100644
--- a/trunk/include/asm-sparc/system.h
+++ b/trunk/include/asm-sparc/system.h
@@ -9,6 +9,7 @@
 #include <linux/threads.h>	/* NR_CPUS */
 #include <linux/thread_info.h>
 
+#include <asm/segment.h>
 #include <asm/page.h>
 #include <asm/psr.h>
 #include <asm/ptrace.h>
diff --git a/trunk/include/asm-sparc64/atomic.h b/trunk/include/asm-sparc64/atomic.h
index e175afcf2cde..d80f3379669b 100644
--- a/trunk/include/asm-sparc64/atomic.h
+++ b/trunk/include/asm-sparc64/atomic.h
@@ -72,10 +72,10 @@ extern int atomic64_sub_ret(int, atomic64_t *);
 
 /* Atomic operations are already serializing */
 #ifdef CONFIG_SMP
-#define smp_mb__before_atomic_dec()	membar_storeload_loadload();
-#define smp_mb__after_atomic_dec()	membar_storeload_storestore();
-#define smp_mb__before_atomic_inc()	membar_storeload_loadload();
-#define smp_mb__after_atomic_inc()	membar_storeload_storestore();
+#define smp_mb__before_atomic_dec()	membar("#StoreLoad | #LoadLoad")
+#define smp_mb__after_atomic_dec()	membar("#StoreLoad | #StoreStore")
+#define smp_mb__before_atomic_inc()	membar("#StoreLoad | #LoadLoad")
+#define smp_mb__after_atomic_inc()	membar("#StoreLoad | #StoreStore")
 #else
 #define smp_mb__before_atomic_dec()	barrier()
 #define smp_mb__after_atomic_dec()	barrier()
diff --git a/trunk/include/asm-sparc64/bitops.h b/trunk/include/asm-sparc64/bitops.h
index 6388b8376c50..9c5e71970287 100644
--- a/trunk/include/asm-sparc64/bitops.h
+++ b/trunk/include/asm-sparc64/bitops.h
@@ -72,8 +72,8 @@ static inline int __test_and_change_bit(int nr, volatile unsigned long *addr)
 }
 
 #ifdef CONFIG_SMP
-#define smp_mb__before_clear_bit()	membar_storeload_loadload()
-#define smp_mb__after_clear_bit()	membar_storeload_storestore()
+#define smp_mb__before_clear_bit()	membar("#StoreLoad | #LoadLoad")
+#define smp_mb__after_clear_bit()	membar("#StoreLoad | #StoreStore")
 #else
 #define smp_mb__before_clear_bit()	barrier()
 #define smp_mb__after_clear_bit()	barrier()
diff --git a/trunk/include/asm-sparc64/processor.h b/trunk/include/asm-sparc64/processor.h
index 3169f3e2237e..d0bee2413560 100644
--- a/trunk/include/asm-sparc64/processor.h
+++ b/trunk/include/asm-sparc64/processor.h
@@ -18,6 +18,7 @@
 #include <asm/a.out.h>
 #include <asm/pstate.h>
 #include <asm/ptrace.h>
+#include <asm/segment.h>
 #include <asm/page.h>
 
 /* The sparc has no problems with write protection */
diff --git a/trunk/include/asm-sparc64/segment.h b/trunk/include/asm-sparc64/segment.h
new file mode 100644
index 000000000000..b03e709fc945
--- /dev/null
+++ b/trunk/include/asm-sparc64/segment.h
@@ -0,0 +1,6 @@
+#ifndef __SPARC64_SEGMENT_H
+#define __SPARC64_SEGMENT_H
+
+/* Only here because we have some old header files that expect it.. */
+
+#endif
diff --git a/trunk/include/asm-sparc64/sfafsr.h b/trunk/include/asm-sparc64/sfafsr.h
deleted file mode 100644
index 2f792c20b53c..000000000000
--- a/trunk/include/asm-sparc64/sfafsr.h
+++ /dev/null
@@ -1,82 +0,0 @@
-#ifndef _SPARC64_SFAFSR_H
-#define _SPARC64_SFAFSR_H
-
-#include <asm/const.h>
-
-/* Spitfire Asynchronous Fault Status register, ASI=0x4C VA<63:0>=0x0 */
-
-#define SFAFSR_ME		(_AC(1,UL) << SFAFSR_ME_SHIFT)
-#define SFAFSR_ME_SHIFT		32
-#define SFAFSR_PRIV		(_AC(1,UL) << SFAFSR_PRIV_SHIFT)
-#define SFAFSR_PRIV_SHIFT	31
-#define SFAFSR_ISAP		(_AC(1,UL) << SFAFSR_ISAP_SHIFT)
-#define SFAFSR_ISAP_SHIFT	30
-#define SFAFSR_ETP		(_AC(1,UL) << SFAFSR_ETP_SHIFT)
-#define SFAFSR_ETP_SHIFT	29
-#define SFAFSR_IVUE		(_AC(1,UL) << SFAFSR_IVUE_SHIFT)
-#define SFAFSR_IVUE_SHIFT	28
-#define SFAFSR_TO		(_AC(1,UL) << SFAFSR_TO_SHIFT)
-#define SFAFSR_TO_SHIFT		27
-#define SFAFSR_BERR		(_AC(1,UL) << SFAFSR_BERR_SHIFT)
-#define SFAFSR_BERR_SHIFT	26
-#define SFAFSR_LDP		(_AC(1,UL) << SFAFSR_LDP_SHIFT)
-#define SFAFSR_LDP_SHIFT	25
-#define SFAFSR_CP		(_AC(1,UL) << SFAFSR_CP_SHIFT)
-#define SFAFSR_CP_SHIFT		24
-#define SFAFSR_WP		(_AC(1,UL) << SFAFSR_WP_SHIFT)
-#define SFAFSR_WP_SHIFT		23
-#define SFAFSR_EDP		(_AC(1,UL) << SFAFSR_EDP_SHIFT)
-#define SFAFSR_EDP_SHIFT	22
-#define SFAFSR_UE		(_AC(1,UL) << SFAFSR_UE_SHIFT)
-#define SFAFSR_UE_SHIFT		21
-#define SFAFSR_CE		(_AC(1,UL) << SFAFSR_CE_SHIFT)
-#define SFAFSR_CE_SHIFT		20
-#define SFAFSR_ETS		(_AC(0xf,UL) << SFAFSR_ETS_SHIFT)
-#define SFAFSR_ETS_SHIFT	16
-#define SFAFSR_PSYND		(_AC(0xffff,UL) << SFAFSR_PSYND_SHIFT)
-#define SFAFSR_PSYND_SHIFT	0
-
-/* UDB Error Register, ASI=0x7f VA<63:0>=0x0(High),0x18(Low) for read
- *                     ASI=0x77 VA<63:0>=0x0(High),0x18(Low) for write
- */
-
-#define UDBE_UE			(_AC(1,UL) << 9)
-#define UDBE_CE			(_AC(1,UL) << 8)
-#define UDBE_E_SYNDR		(_AC(0xff,UL) << 0)
-
-/* The trap handlers for asynchronous errors encode the AFSR and
- * other pieces of information into a 64-bit argument for C code
- * encoded as follows:
- *
- * -----------------------------------------------
- * |  UDB_H  |  UDB_L  | TL>1  |  TT  |   AFSR   |
- * -----------------------------------------------
- *  63     54 53     44    42   41  33 32       0
- *
- * The AFAR is passed in unchanged.
- */
-#define SFSTAT_UDBH_MASK	(_AC(0x3ff,UL) << SFSTAT_UDBH_SHIFT)
-#define SFSTAT_UDBH_SHIFT	54
-#define SFSTAT_UDBL_MASK	(_AC(0x3ff,UL) << SFSTAT_UDBH_SHIFT)
-#define SFSTAT_UDBL_SHIFT	44
-#define SFSTAT_TL_GT_ONE	(_AC(1,UL) << SFSTAT_TL_GT_ONE_SHIFT)
-#define SFSTAT_TL_GT_ONE_SHIFT	42
-#define SFSTAT_TRAP_TYPE	(_AC(0x1FF,UL) << SFSTAT_TRAP_TYPE_SHIFT)
-#define SFSTAT_TRAP_TYPE_SHIFT	33
-#define SFSTAT_AFSR_MASK	(_AC(0x1ffffffff,UL) << SFSTAT_AFSR_SHIFT)
-#define SFSTAT_AFSR_SHIFT	0
-
-/* ESTATE Error Enable Register, ASI=0x4b VA<63:0>=0x0 */
-#define ESTATE_ERR_CE		0x1 /* Correctable errors                    */
-#define ESTATE_ERR_NCE		0x2 /* TO, BERR, LDP, ETP, EDP, WP, UE, IVUE */
-#define ESTATE_ERR_ISAP		0x4 /* System address parity error           */
-#define ESTATE_ERR_ALL		(ESTATE_ERR_CE | \
-				 ESTATE_ERR_NCE | \
-				 ESTATE_ERR_ISAP)
-
-/* The various trap types that report using the above state. */
-#define TRAP_TYPE_IAE		0x09 /* Instruction Access Error             */
-#define TRAP_TYPE_DAE		0x32 /* Data Access Error                    */
-#define TRAP_TYPE_CEE		0x63 /* Correctable ECC Error                */
-
-#endif /* _SPARC64_SFAFSR_H */
diff --git a/trunk/include/asm-sparc64/socket.h b/trunk/include/asm-sparc64/socket.h
index 59987dad3359..865547a23908 100644
--- a/trunk/include/asm-sparc64/socket.h
+++ b/trunk/include/asm-sparc64/socket.h
@@ -29,8 +29,6 @@
 
 #define SO_SNDBUF	0x1001
 #define SO_RCVBUF	0x1002
-#define SO_SNDBUFFORCE	0x100a
-#define SO_RCVBUFFORCE	0x100b
 #define SO_ERROR	0x1007
 #define SO_TYPE		0x1008
 
diff --git a/trunk/include/asm-sparc64/spinlock.h b/trunk/include/asm-sparc64/spinlock.h
index a02c4370eb42..9cb93a5c2b4f 100644
--- a/trunk/include/asm-sparc64/spinlock.h
+++ b/trunk/include/asm-sparc64/spinlock.h
@@ -43,7 +43,7 @@ typedef struct {
 #define spin_is_locked(lp)  ((lp)->lock != 0)
 
 #define spin_unlock_wait(lp)	\
-do {	rmb();			\
+do {	membar("#LoadLoad");	\
 } while((lp)->lock)
 
 static inline void _raw_spin_lock(spinlock_t *lock)
@@ -129,18 +129,15 @@ typedef struct {
 #define spin_is_locked(__lock)	((__lock)->lock != 0)
 #define spin_unlock_wait(__lock)	\
 do { \
-	rmb(); \
+	membar("#LoadLoad"); \
 } while((__lock)->lock)
 
-extern void _do_spin_lock(spinlock_t *lock, char *str, unsigned long caller);
-extern void _do_spin_unlock(spinlock_t *lock);
-extern int _do_spin_trylock(spinlock_t *lock, unsigned long caller);
+extern void _do_spin_lock (spinlock_t *lock, char *str);
+extern void _do_spin_unlock (spinlock_t *lock);
+extern int _do_spin_trylock (spinlock_t *lock);
 
-#define _raw_spin_trylock(lp)	\
-	_do_spin_trylock(lp, (unsigned long) __builtin_return_address(0))
-#define _raw_spin_lock(lock)	\
-	_do_spin_lock(lock, "spin_lock", \
-		      (unsigned long) __builtin_return_address(0))
+#define _raw_spin_trylock(lp)	_do_spin_trylock(lp)
+#define _raw_spin_lock(lock)	_do_spin_lock(lock, "spin_lock")
 #define _raw_spin_unlock(lock)	_do_spin_unlock(lock)
 #define _raw_spin_lock_flags(lock, flags) _raw_spin_lock(lock)
 
@@ -282,41 +279,37 @@ typedef struct {
 #define RW_LOCK_UNLOCKED	(rwlock_t) { 0, 0, 0xff, { } }
 #define rwlock_init(lp) do { *(lp) = RW_LOCK_UNLOCKED; } while(0)
 
-extern void _do_read_lock(rwlock_t *rw, char *str, unsigned long caller);
-extern void _do_read_unlock(rwlock_t *rw, char *str, unsigned long caller);
-extern void _do_write_lock(rwlock_t *rw, char *str, unsigned long caller);
-extern void _do_write_unlock(rwlock_t *rw, unsigned long caller);
-extern int _do_write_trylock(rwlock_t *rw, char *str, unsigned long caller);
+extern void _do_read_lock(rwlock_t *rw, char *str);
+extern void _do_read_unlock(rwlock_t *rw, char *str);
+extern void _do_write_lock(rwlock_t *rw, char *str);
+extern void _do_write_unlock(rwlock_t *rw);
+extern int _do_write_trylock(rwlock_t *rw, char *str);
 
 #define _raw_read_lock(lock) \
 do {	unsigned long flags; \
 	local_irq_save(flags); \
-	_do_read_lock(lock, "read_lock", \
-		      (unsigned long) __builtin_return_address(0)); \
+	_do_read_lock(lock, "read_lock"); \
 	local_irq_restore(flags); \
 } while(0)
 
 #define _raw_read_unlock(lock) \
 do {	unsigned long flags; \
 	local_irq_save(flags); \
-	_do_read_unlock(lock, "read_unlock", \
-		      (unsigned long) __builtin_return_address(0)); \
+	_do_read_unlock(lock, "read_unlock"); \
 	local_irq_restore(flags); \
 } while(0)
 
 #define _raw_write_lock(lock) \
 do {	unsigned long flags; \
 	local_irq_save(flags); \
-	_do_write_lock(lock, "write_lock", \
-		      (unsigned long) __builtin_return_address(0)); \
+	_do_write_lock(lock, "write_lock"); \
 	local_irq_restore(flags); \
 } while(0)
 
 #define _raw_write_unlock(lock) \
 do {	unsigned long flags; \
 	local_irq_save(flags); \
-	_do_write_unlock(lock, \
-		      (unsigned long) __builtin_return_address(0)); \
+	_do_write_unlock(lock); \
 	local_irq_restore(flags); \
 } while(0)
 
@@ -324,8 +317,7 @@ do {	unsigned long flags; \
 ({	unsigned long flags; \
 	int val; \
 	local_irq_save(flags); \
-	val = _do_write_trylock(lock, "write_trylock", \
-				(unsigned long) __builtin_return_address(0)); \
+	val = _do_write_trylock(lock, "write_trylock"); \
 	local_irq_restore(flags); \
 	val; \
 })
diff --git a/trunk/include/asm-sparc64/system.h b/trunk/include/asm-sparc64/system.h
index 5e94c05dc2fc..ee4bdfc6b88f 100644
--- a/trunk/include/asm-sparc64/system.h
+++ b/trunk/include/asm-sparc64/system.h
@@ -28,14 +28,6 @@ enum sparc_cpu {
 #define ARCH_SUN4C_SUN4 0
 #define ARCH_SUN4 0
 
-extern void mb(void);
-extern void rmb(void);
-extern void wmb(void);
-extern void membar_storeload(void);
-extern void membar_storeload_storestore(void);
-extern void membar_storeload_loadload(void);
-extern void membar_storestore_loadstore(void);
-
 #endif
 
 #define setipl(__new_ipl) \
@@ -86,11 +78,16 @@ extern void membar_storestore_loadstore(void);
 
 #define nop() 		__asm__ __volatile__ ("nop")
 
+#define membar(type)	__asm__ __volatile__ ("membar " type : : : "memory")
+#define mb()		\
+	membar("#LoadLoad | #LoadStore | #StoreStore | #StoreLoad")
+#define rmb()		membar("#LoadLoad")
+#define wmb()		membar("#StoreStore")
 #define read_barrier_depends()		do { } while(0)
 #define set_mb(__var, __value) \
-	do { __var = __value; membar_storeload_storestore(); } while(0)
+	do { __var = __value; membar("#StoreLoad | #StoreStore"); } while(0)
 #define set_wmb(__var, __value) \
-	do { __var = __value; wmb(); } while(0)
+	do { __var = __value; membar("#StoreStore"); } while(0)
 
 #ifdef CONFIG_SMP
 #define smp_mb()	mb()
diff --git a/trunk/include/asm-v850/socket.h b/trunk/include/asm-v850/socket.h
index 0240d366a0a4..213b852af53e 100644
--- a/trunk/include/asm-v850/socket.h
+++ b/trunk/include/asm-v850/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-x86_64/checksum.h b/trunk/include/asm-x86_64/checksum.h
index 989469e8e0b7..d01356f01448 100644
--- a/trunk/include/asm-x86_64/checksum.h
+++ b/trunk/include/asm-x86_64/checksum.h
@@ -64,7 +64,7 @@ static inline unsigned short ip_fast_csum(unsigned char *iph, unsigned int ihl)
 		"  adcl $0, %0\n"
 		"  notl %0\n"
 		"2:"
-	/* Since the input registers which are loaded with iph and ihl
+	/* Since the input registers which are loaded with iph and ipl
 	   are modified, we must also specify them as outputs, or gcc
 	   will assume they contain their original values. */
 	: "=r" (sum), "=r" (iph), "=r" (ihl)
diff --git a/trunk/include/asm-x86_64/socket.h b/trunk/include/asm-x86_64/socket.h
index f2cdbeae5d5b..d9a252ea8210 100644
--- a/trunk/include/asm-x86_64/socket.h
+++ b/trunk/include/asm-x86_64/socket.h
@@ -14,8 +14,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/asm-xtensa/socket.h b/trunk/include/asm-xtensa/socket.h
index 00f83f3a6d72..daccd05a14cd 100644
--- a/trunk/include/asm-xtensa/socket.h
+++ b/trunk/include/asm-xtensa/socket.h
@@ -24,8 +24,6 @@
 #define SO_BROADCAST	6
 #define SO_SNDBUF	7
 #define SO_RCVBUF	8
-#define SO_SNDBUFFORCE	32
-#define SO_RCVBUFFORCE	33
 #define SO_KEEPALIVE	9
 #define SO_OOBINLINE	10
 #define SO_NO_CHECK	11
diff --git a/trunk/include/linux/ata.h b/trunk/include/linux/ata.h
index a5b74efab067..9d25e9886d60 100644
--- a/trunk/include/linux/ata.h
+++ b/trunk/include/linux/ata.h
@@ -1,29 +1,24 @@
 
 /*
- *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
- *  Copyright 2003-2004 Jeff Garzik
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
- *  Hardware documentation available from http://www.t13.org/
- *
+   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+   Copyright 2003-2004 Jeff Garzik
+
+   The contents of this file are subject to the Open
+   Software License version 1.1 that can be found at
+   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+   by reference.
+
+   Alternatively, the contents of this file may be used under the terms
+   of the GNU General Public License version 2 (the "GPL") as distributed
+   in the kernel source COPYING file, in which case the provisions of
+   the GPL are applicable instead of the above.  If you wish to allow
+   the use of your version of this file only under the terms of the
+   GPL and not to allow others to use your version of this file under
+   the OSL, indicate your decision by deleting the provisions above and
+   replace them with the notice and other provisions required by the GPL.
+   If you do not delete the provisions above, a recipient may use your
+   version of this file under either the OSL or the GPL.
+
  */
 
 #ifndef __LINUX_ATA_H__
diff --git a/trunk/include/linux/dccp.h b/trunk/include/linux/dccp.h
deleted file mode 100644
index 007c290f74d4..000000000000
--- a/trunk/include/linux/dccp.h
+++ /dev/null
@@ -1,456 +0,0 @@
-#ifndef _LINUX_DCCP_H
-#define _LINUX_DCCP_H
-
-#include <linux/types.h>
-#include <asm/byteorder.h>
-
-/* Structure describing an Internet (DCCP) socket address. */
-struct sockaddr_dccp {
-	__u16	sdccp_family;	/* Address family   */
-	__u16	sdccp_port;	/* Port number	    */
-	__u32	sdccp_addr;	/* Internet address */
-	__u32	sdccp_service;	/* Service	    */
-	/* Pad to size of `struct sockaddr': 16 bytes . */
-	__u32	sdccp_pad;
-};
-
-/**
- * struct dccp_hdr - generic part of DCCP packet header
- *
- * @dccph_sport - Relevant port on the endpoint that sent this packet
- * @dccph_dport - Relevant port on the other endpoint
- * @dccph_doff - Data Offset from the start of the DCCP header, in 32-bit words
- * @dccph_ccval - Used by the HC-Sender CCID
- * @dccph_cscov - Parts of the packet that are covered by the Checksum field
- * @dccph_checksum - Internet checksum, depends on dccph_cscov
- * @dccph_x - 0 = 24 bit sequence number, 1 = 48
- * @dccph_type - packet type, see DCCP_PKT_ prefixed macros
- * @dccph_seq - sequence number high or low order 24 bits, depends on dccph_x
- */
-struct dccp_hdr {
-	__u16	dccph_sport,
-		dccph_dport;
-	__u8	dccph_doff;
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	__u8	dccph_cscov:4,
-		dccph_ccval:4;
-#elif defined(__BIG_ENDIAN_BITFIELD)
-	__u8	dccph_ccval:4,
-		dccph_cscov:4;
-#else
-#error  "Adjust your <asm/byteorder.h> defines"
-#endif
-	__u16	dccph_checksum;
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	__u32	dccph_x:1,
-		dccph_type:4,
-		dccph_reserved:3,
-		dccph_seq:24;
-#elif defined(__BIG_ENDIAN_BITFIELD)
-	__u32	dccph_reserved:3,
-		dccph_type:4,
-		dccph_x:1,
-		dccph_seq:24;
-#else
-#error  "Adjust your <asm/byteorder.h> defines"
-#endif
-};
-
-/**
- * struct dccp_hdr_ext - the low bits of a 48 bit seq packet
- *
- * @dccph_seq_low - low 24 bits of a 48 bit seq packet
- */
-struct dccp_hdr_ext {
-	__u32	dccph_seq_low;
-};
-
-/**
- * struct dccp_hdr_request - Conection initiation request header
- *
- * @dccph_req_service - Service to which the client app wants to connect
- * @dccph_req_options - list of options (must be a multiple of 32 bits
- */
-struct dccp_hdr_request {
-	__u32	dccph_req_service;
-};
-/**
- * struct dccp_hdr_ack_bits - acknowledgment bits common to most packets
- *
- * @dccph_resp_ack_nr_high - 48 bit ack number high order bits, contains GSR
- * @dccph_resp_ack_nr_low - 48 bit ack number low order bits, contains GSR
- */
-struct dccp_hdr_ack_bits {
-	__u32	dccph_reserved1:8,
-		dccph_ack_nr_high:24;
-	__u32	dccph_ack_nr_low;
-};
-/**
- * struct dccp_hdr_response - Conection initiation response header
- *
- * @dccph_resp_ack_nr_high - 48 bit ack number high order bits, contains GSR
- * @dccph_resp_ack_nr_low - 48 bit ack number low order bits, contains GSR
- * @dccph_resp_service - Echoes the Service Code on a received DCCP-Request
- * @dccph_resp_options - list of options (must be a multiple of 32 bits
- */
-struct dccp_hdr_response {
-	struct dccp_hdr_ack_bits	dccph_resp_ack;
-	__u32				dccph_resp_service;
-};
-
-/**
- * struct dccp_hdr_reset - Unconditionally shut down a connection
- *
- * @dccph_reset_service - Echoes the Service Code on a received DCCP-Request
- * @dccph_reset_options - list of options (must be a multiple of 32 bits
- */
-struct dccp_hdr_reset {
-	struct dccp_hdr_ack_bits	dccph_reset_ack;
-	__u8				dccph_reset_code,
-					dccph_reset_data[3];
-};
-
-enum dccp_pkt_type {
-	DCCP_PKT_REQUEST = 0,
-	DCCP_PKT_RESPONSE,
-	DCCP_PKT_DATA,
-	DCCP_PKT_ACK,
-	DCCP_PKT_DATAACK,
-	DCCP_PKT_CLOSEREQ,
-	DCCP_PKT_CLOSE,
-	DCCP_PKT_RESET,
-	DCCP_PKT_SYNC,
-	DCCP_PKT_SYNCACK,
-	DCCP_PKT_INVALID,
-};
-
-#define DCCP_NR_PKT_TYPES DCCP_PKT_INVALID
-
-static inline unsigned int dccp_packet_hdr_len(const __u8 type)
-{
-	if (type == DCCP_PKT_DATA)
-		return 0;
-	if (type == DCCP_PKT_DATAACK	||
-	    type == DCCP_PKT_ACK	||
-	    type == DCCP_PKT_SYNC	||
-	    type == DCCP_PKT_SYNCACK	||
-	    type == DCCP_PKT_CLOSE	||
-	    type == DCCP_PKT_CLOSEREQ)
-		return sizeof(struct dccp_hdr_ack_bits);
-	if (type == DCCP_PKT_REQUEST)
-		return sizeof(struct dccp_hdr_request);
-	if (type == DCCP_PKT_RESPONSE)
-		return sizeof(struct dccp_hdr_response);
-	return sizeof(struct dccp_hdr_reset);
-}
-enum dccp_reset_codes {
-	DCCP_RESET_CODE_UNSPECIFIED = 0,
-	DCCP_RESET_CODE_CLOSED,
-	DCCP_RESET_CODE_ABORTED,
-	DCCP_RESET_CODE_NO_CONNECTION,
-	DCCP_RESET_CODE_PACKET_ERROR,
-	DCCP_RESET_CODE_OPTION_ERROR,
-	DCCP_RESET_CODE_MANDATORY_ERROR,
-	DCCP_RESET_CODE_CONNECTION_REFUSED,
-	DCCP_RESET_CODE_BAD_SERVICE_CODE,
-	DCCP_RESET_CODE_TOO_BUSY,
-	DCCP_RESET_CODE_BAD_INIT_COOKIE,
-	DCCP_RESET_CODE_AGGRESSION_PENALTY,
-};
-
-/* DCCP options */
-enum {
-	DCCPO_PADDING = 0,
-	DCCPO_MANDATORY = 1,
-	DCCPO_MIN_RESERVED = 3,
-	DCCPO_MAX_RESERVED = 31,
-	DCCPO_NDP_COUNT = 37,
-	DCCPO_ACK_VECTOR_0 = 38,
-	DCCPO_ACK_VECTOR_1 = 39,
-	DCCPO_TIMESTAMP = 41,
-	DCCPO_TIMESTAMP_ECHO = 42,
-	DCCPO_ELAPSED_TIME = 43,
-	DCCPO_MAX = 45,
-	DCCPO_MIN_CCID_SPECIFIC = 128,
-	DCCPO_MAX_CCID_SPECIFIC = 255,
-};
-
-/* DCCP features */
-enum {
-	DCCPF_RESERVED = 0,
-	DCCPF_SEQUENCE_WINDOW = 3,
-	DCCPF_SEND_ACK_VECTOR = 6,
-	DCCPF_SEND_NDP_COUNT = 7,
-	/* 10-127 reserved */
-	DCCPF_MIN_CCID_SPECIFIC = 128,
-	DCCPF_MAX_CCID_SPECIFIC = 255,
-};
-
-/* DCCP socket options */
-#define DCCP_SOCKOPT_PACKET_SIZE	1
-
-#ifdef __KERNEL__
-
-#include <linux/in.h>
-#include <linux/list.h>
-#include <linux/uio.h>
-#include <linux/workqueue.h>
-
-#include <net/inet_connection_sock.h>
-#include <net/inet_timewait_sock.h>
-#include <net/sock.h>
-#include <net/tcp_states.h>
-#include <net/tcp.h>
-
-enum dccp_state {
-	DCCP_OPEN	= TCP_ESTABLISHED,
-	DCCP_REQUESTING	= TCP_SYN_SENT,
-	DCCP_PARTOPEN	= TCP_FIN_WAIT1, /* FIXME:
-					    This mapping is horrible, but TCP has
-					    no matching state for DCCP_PARTOPEN,
-					    as TCP_SYN_RECV is already used by
-					    DCCP_RESPOND, why don't stop using TCP
-					    mapping of states? OK, now we don't use
-					    sk_stream_sendmsg anymore, so doesn't
-					    seem to exist any reason for us to
-					    do the TCP mapping here */
-	DCCP_LISTEN	= TCP_LISTEN,
-	DCCP_RESPOND	= TCP_SYN_RECV,
-	DCCP_CLOSING	= TCP_CLOSING,
-	DCCP_TIME_WAIT	= TCP_TIME_WAIT,
-	DCCP_CLOSED	= TCP_CLOSE,
-	DCCP_MAX_STATES = TCP_MAX_STATES,
-};
-
-#define DCCP_STATE_MASK 0xf
-#define DCCP_ACTION_FIN (1<<7)
-
-enum {
-	DCCPF_OPEN	 = TCPF_ESTABLISHED,
-	DCCPF_REQUESTING = TCPF_SYN_SENT,
-	DCCPF_PARTOPEN	 = TCPF_FIN_WAIT1,
-	DCCPF_LISTEN	 = TCPF_LISTEN,
-	DCCPF_RESPOND	 = TCPF_SYN_RECV,
-	DCCPF_CLOSING	 = TCPF_CLOSING,
-	DCCPF_TIME_WAIT	 = TCPF_TIME_WAIT,
-	DCCPF_CLOSED	 = TCPF_CLOSE,
-};
-
-static inline struct dccp_hdr *dccp_hdr(const struct sk_buff *skb)
-{
-	return (struct dccp_hdr *)skb->h.raw;
-}
-
-static inline struct dccp_hdr_ext *dccp_hdrx(const struct sk_buff *skb)
-{
-	return (struct dccp_hdr_ext *)(skb->h.raw + sizeof(struct dccp_hdr));
-}
-
-static inline unsigned int __dccp_basic_hdr_len(const struct dccp_hdr *dh)
-{
-	return sizeof(*dh) + (dh->dccph_x ? sizeof(struct dccp_hdr_ext) : 0);
-}
-
-static inline unsigned int dccp_basic_hdr_len(const struct sk_buff *skb)
-{
-	const struct dccp_hdr *dh = dccp_hdr(skb);
-	return __dccp_basic_hdr_len(dh);
-}
-
-static inline __u64 dccp_hdr_seq(const struct sk_buff *skb)
-{
-	const struct dccp_hdr *dh = dccp_hdr(skb);
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	__u64 seq_nr = ntohl(dh->dccph_seq << 8);
-#elif defined(__BIG_ENDIAN_BITFIELD)
-	__u64 seq_nr = ntohl(dh->dccph_seq);
-#else
-#error  "Adjust your <asm/byteorder.h> defines"
-#endif
-
-	if (dh->dccph_x != 0)
-		seq_nr = (seq_nr << 32) + ntohl(dccp_hdrx(skb)->dccph_seq_low);
-
-	return seq_nr;
-}
-
-static inline struct dccp_hdr_request *dccp_hdr_request(struct sk_buff *skb)
-{
-	return (struct dccp_hdr_request *)(skb->h.raw + dccp_basic_hdr_len(skb));
-}
-
-static inline struct dccp_hdr_ack_bits *dccp_hdr_ack_bits(const struct sk_buff *skb)
-{
-	return (struct dccp_hdr_ack_bits *)(skb->h.raw + dccp_basic_hdr_len(skb));
-}
-
-static inline u64 dccp_hdr_ack_seq(const struct sk_buff *skb)
-{
-	const struct dccp_hdr_ack_bits *dhack = dccp_hdr_ack_bits(skb);
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	return (((u64)ntohl(dhack->dccph_ack_nr_high << 8)) << 32) + ntohl(dhack->dccph_ack_nr_low);
-#elif defined(__BIG_ENDIAN_BITFIELD)
-	return (((u64)ntohl(dhack->dccph_ack_nr_high)) << 32) + ntohl(dhack->dccph_ack_nr_low);
-#else
-#error  "Adjust your <asm/byteorder.h> defines"
-#endif
-}
-
-static inline struct dccp_hdr_response *dccp_hdr_response(struct sk_buff *skb)
-{
-	return (struct dccp_hdr_response *)(skb->h.raw + dccp_basic_hdr_len(skb));
-}
-
-static inline struct dccp_hdr_reset *dccp_hdr_reset(struct sk_buff *skb)
-{
-	return (struct dccp_hdr_reset *)(skb->h.raw + dccp_basic_hdr_len(skb));
-}
-
-static inline unsigned int __dccp_hdr_len(const struct dccp_hdr *dh)
-{
-	return __dccp_basic_hdr_len(dh) +
-	       dccp_packet_hdr_len(dh->dccph_type);
-}
-
-static inline unsigned int dccp_hdr_len(const struct sk_buff *skb)
-{
-	return __dccp_hdr_len(dccp_hdr(skb));
-}
-
-
-/* initial values for each feature */
-#define DCCPF_INITIAL_SEQUENCE_WINDOW		100
-/* FIXME: for now we're using CCID 3 (TFRC) */
-#define DCCPF_INITIAL_CCID			3
-#define DCCPF_INITIAL_SEND_ACK_VECTOR		0
-/* FIXME: for now we're default to 1 but it should really be 0 */
-#define DCCPF_INITIAL_SEND_NDP_COUNT		1
-
-#define DCCP_NDP_LIMIT 0xFFFFFF
-
-/**
-  * struct dccp_options - option values for a DCCP connection
-  *	@dccpo_sequence_window - Sequence Window Feature (section 7.5.2)
-  *	@dccpo_ccid - Congestion Control Id (CCID) (section 10)
-  *	@dccpo_send_ack_vector - Send Ack Vector Feature (section 11.5)
-  *	@dccpo_send_ndp_count - Send NDP Count Feature (7.7.2)
-  */
-struct dccp_options {
-	__u64	dccpo_sequence_window;
-	__u8	dccpo_ccid;
-	__u8	dccpo_send_ack_vector;
-	__u8	dccpo_send_ndp_count;
-};
-
-extern void __dccp_options_init(struct dccp_options *dccpo);
-extern void dccp_options_init(struct dccp_options *dccpo);
-extern int dccp_parse_options(struct sock *sk, struct sk_buff *skb);
-
-struct dccp_request_sock {
-	struct inet_request_sock dreq_inet_rsk;
-	__u64			 dreq_iss;
-	__u64			 dreq_isr;
-	__u32			 dreq_service;
-};
-
-static inline struct dccp_request_sock *dccp_rsk(const struct request_sock *req)
-{
-	return (struct dccp_request_sock *)req;
-}
-
-extern struct inet_timewait_death_row dccp_death_row;
-
-/* Read about the ECN nonce to see why it is 253 */
-#define DCCP_MAX_ACK_VECTOR_LEN 253
-
-struct dccp_options_received {
-	u32	dccpor_ndp:24,
-		dccpor_ack_vector_len:8;
-	u32	dccpor_ack_vector_idx:10;
-	/* 22 bits hole, try to pack */
-	u32	dccpor_timestamp;
-	u32	dccpor_timestamp_echo;
-	u32	dccpor_elapsed_time;
-};
-
-struct ccid;
-
-enum dccp_role {
-	DCCP_ROLE_UNDEFINED,
-	DCCP_ROLE_LISTEN,
-	DCCP_ROLE_CLIENT,
-	DCCP_ROLE_SERVER,
-};
-
-/**
- * struct dccp_sock - DCCP socket state
- *
- * @dccps_swl - sequence number window low
- * @dccps_swh - sequence number window high
- * @dccps_awl - acknowledgement number window low
- * @dccps_awh - acknowledgement number window high
- * @dccps_iss - initial sequence number sent
- * @dccps_isr - initial sequence number received
- * @dccps_osr - first OPEN sequence number received
- * @dccps_gss - greatest sequence number sent
- * @dccps_gsr - greatest valid sequence number received
- * @dccps_gar - greatest valid ack number received on a non-Sync; initialized to %dccps_iss
- * @dccps_timestamp_time - time of latest TIMESTAMP option
- * @dccps_timestamp_echo - latest timestamp received on a TIMESTAMP option
- * @dccps_ext_header_len - network protocol overhead (IP/IPv6 options)
- * @dccps_pmtu_cookie - Last pmtu seen by socket
- * @dccps_packet_size - Set thru setsockopt
- * @dccps_role - Role of this sock, one of %dccp_role
- * @dccps_ndp_count - number of Non Data Packets since last data packet
- * @dccps_hc_rx_ackpkts - receiver half connection acked packets
- */
-struct dccp_sock {
-	/* inet_connection_sock has to be the first member of dccp_sock */
-	struct inet_connection_sock	dccps_inet_connection;
-	__u64				dccps_swl;
-	__u64				dccps_swh;
-	__u64				dccps_awl;
-	__u64				dccps_awh;
-	__u64				dccps_iss;
-	__u64				dccps_isr;
-	__u64				dccps_osr;
-	__u64				dccps_gss;
-	__u64				dccps_gsr;
-	__u64				dccps_gar;
-	unsigned long			dccps_service;
-	struct timeval			dccps_timestamp_time;
-	__u32				dccps_timestamp_echo;
-	__u32				dccps_packet_size;
-	unsigned long			dccps_ndp_count;
-	__u16				dccps_ext_header_len;
-	__u32				dccps_pmtu_cookie;
-	__u32				dccps_mss_cache;
-	struct dccp_options		dccps_options;
-	struct dccp_ackpkts		*dccps_hc_rx_ackpkts;
-	void				*dccps_hc_rx_ccid_private;
-	void				*dccps_hc_tx_ccid_private;
-	struct ccid			*dccps_hc_rx_ccid;
-	struct ccid			*dccps_hc_tx_ccid;
-	struct dccp_options_received	dccps_options_received;
-	enum dccp_role			dccps_role:2;
-};
- 
-static inline struct dccp_sock *dccp_sk(const struct sock *sk)
-{
-	return (struct dccp_sock *)sk;
-}
-
-static inline const char *dccp_role(const struct sock *sk)
-{
-	switch (dccp_sk(sk)->dccps_role) {
-	case DCCP_ROLE_UNDEFINED: return "undefined";
-	case DCCP_ROLE_LISTEN:	  return "listen";
-	case DCCP_ROLE_SERVER:	  return "server";
-	case DCCP_ROLE_CLIENT:	  return "client";
-	}
-	return NULL;
-}
-
-#endif /* __KERNEL__ */
-
-#endif /* _LINUX_DCCP_H */
diff --git a/trunk/include/linux/etherdevice.h b/trunk/include/linux/etherdevice.h
index 4522c7186bf3..ce8518e658b6 100644
--- a/trunk/include/linux/etherdevice.h
+++ b/trunk/include/linux/etherdevice.h
@@ -69,12 +69,6 @@ static inline int is_multicast_ether_addr(const u8 *addr)
 	return ((addr[0] != 0xff) && (0x01 & addr[0]));
 }
 
-static inline int is_broadcast_ether_addr(const u8 *addr)
-{
-        return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) &&  
-		(addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
-}
-
 /**
  * is_valid_ether_addr - Determine if the given Ethernet address is valid
  * @addr: Pointer to a six-byte array containing the Ethernet address
diff --git a/trunk/include/linux/ethtool.h b/trunk/include/linux/ethtool.h
index ed1440ea4c91..d7021c391b2b 100644
--- a/trunk/include/linux/ethtool.h
+++ b/trunk/include/linux/ethtool.h
@@ -250,12 +250,6 @@ struct ethtool_stats {
 	u64	data[0];
 };
 
-struct ethtool_perm_addr {
-	u32	cmd;		/* ETHTOOL_GPERMADDR */
-	u32	size;
-	u8	data[0];
-};
-
 struct net_device;
 
 /* Some generic methods drivers may use in their ethtool_ops */
@@ -267,8 +261,6 @@ u32 ethtool_op_get_sg(struct net_device *dev);
 int ethtool_op_set_sg(struct net_device *dev, u32 data);
 u32 ethtool_op_get_tso(struct net_device *dev);
 int ethtool_op_set_tso(struct net_device *dev, u32 data);
-int ethtool_op_get_perm_addr(struct net_device *dev, 
-			     struct ethtool_perm_addr *addr, u8 *data);
 
 /**
  * &ethtool_ops - Alter and report network device settings
@@ -302,8 +294,7 @@ int ethtool_op_get_perm_addr(struct net_device *dev,
  * get_strings: Return a set of strings that describe the requested objects 
  * phys_id: Identify the device
  * get_stats: Return statistics about the device
- * get_perm_addr: Gets the permanent hardware address
- * 
+ *
  * Description:
  *
  * get_settings:
@@ -361,7 +352,6 @@ struct ethtool_ops {
 	int	(*phys_id)(struct net_device *, u32);
 	int	(*get_stats_count)(struct net_device *);
 	void	(*get_ethtool_stats)(struct net_device *, struct ethtool_stats *, u64 *);
-	int	(*get_perm_addr)(struct net_device *, struct ethtool_perm_addr *, u8 *);
 	int	(*begin)(struct net_device *);
 	void	(*complete)(struct net_device *);
 };
@@ -399,7 +389,6 @@ struct ethtool_ops {
 #define ETHTOOL_GSTATS		0x0000001d /* get NIC-specific statistics */
 #define ETHTOOL_GTSO		0x0000001e /* Get TSO enable (ethtool_value) */
 #define ETHTOOL_STSO		0x0000001f /* Set TSO enable (ethtool_value) */
-#define ETHTOOL_GPERMADDR	0x00000020 /* Get permanent hardware address */
 
 /* compatibility with older code */
 #define SPARC_ETH_GSET		ETHTOOL_GSET
diff --git a/trunk/include/linux/hippidevice.h b/trunk/include/linux/hippidevice.h
index bab303dafd6e..9debe6bbe5f0 100644
--- a/trunk/include/linux/hippidevice.h
+++ b/trunk/include/linux/hippidevice.h
@@ -26,12 +26,8 @@
 #include <linux/if_hippi.h>
 
 #ifdef __KERNEL__
-
-struct hippi_cb {
-	__u32	ifield;
-};
-
-extern __be16 hippi_type_trans(struct sk_buff *skb, struct net_device *dev);
+extern unsigned short hippi_type_trans(struct sk_buff *skb,
+				       struct net_device *dev);
 
 extern struct net_device *alloc_hippi_dev(int sizeof_priv);
 #endif
diff --git a/trunk/include/linux/if_ether.h b/trunk/include/linux/if_ether.h
index fc2d4c8225aa..b5b58e9c054c 100644
--- a/trunk/include/linux/if_ether.h
+++ b/trunk/include/linux/if_ether.h
@@ -110,8 +110,6 @@ static inline struct ethhdr *eth_hdr(const struct sk_buff *skb)
 {
 	return (struct ethhdr *)skb->mac.raw;
 }
-
-extern struct ctl_table ether_table[];
 #endif
 
 #endif	/* _LINUX_IF_ETHER_H */
diff --git a/trunk/include/linux/if_fc.h b/trunk/include/linux/if_fc.h
index 376a34ea4723..33330b458b95 100644
--- a/trunk/include/linux/if_fc.h
+++ b/trunk/include/linux/if_fc.h
@@ -44,7 +44,7 @@ struct fcllc {
 	__u8  ssap;			/* source SAP */
 	__u8  llc;			/* LLC control field */
 	__u8  protid[3];		/* protocol id */
-	__be16 ethertype;		/* ether type field */
+	__u16 ethertype;		/* ether type field */
 };
 
 #endif	/* _LINUX_IF_FC_H */
diff --git a/trunk/include/linux/if_fddi.h b/trunk/include/linux/if_fddi.h
index 1288a161bc0b..a912818e6361 100644
--- a/trunk/include/linux/if_fddi.h
+++ b/trunk/include/linux/if_fddi.h
@@ -85,7 +85,7 @@ struct fddi_snap_hdr
 	__u8	ssap;					/* always 0xAA */
 	__u8	ctrl;					/* always 0x03 */
 	__u8	oui[FDDI_K_OUI_LEN];	/* organizational universal id */
-	__be16	ethertype;				/* packet type ID field */
+	__u16	ethertype;				/* packet type ID field */
 	} __attribute__ ((packed));
 
 /* Define FDDI LLC frame header */
diff --git a/trunk/include/linux/if_frad.h b/trunk/include/linux/if_frad.h
index 511999c7eeda..3c94b1736570 100644
--- a/trunk/include/linux/if_frad.h
+++ b/trunk/include/linux/if_frad.h
@@ -191,12 +191,10 @@ struct frad_local
    int               buffer;		/* current buffer for S508 firmware */
 };
 
+extern void dlci_ioctl_set(int (*hook)(unsigned int, void __user *));
+
 #endif /* __KERNEL__ */
 
 #endif /* CONFIG_DLCI || CONFIG_DLCI_MODULE */
 
-#ifdef __KERNEL__
-extern void dlci_ioctl_set(int (*hook)(unsigned int, void __user *));
-#endif
-
 #endif
diff --git a/trunk/include/linux/if_hippi.h b/trunk/include/linux/if_hippi.h
index 94d31ca7d71a..c8ca72c46f76 100644
--- a/trunk/include/linux/if_hippi.h
+++ b/trunk/include/linux/if_hippi.h
@@ -102,9 +102,9 @@ struct hippi_fp_hdr
 #error	"Please fix <asm/byteorder.h>"
 #endif
 #else
-	__be32		fixed;
+	__u32		fixed;
 #endif
-	__be32		d2_size;
+	__u32		d2_size;
 } __attribute__ ((packed));
 
 struct hippi_le_hdr
@@ -144,7 +144,7 @@ struct hippi_snap_hdr
 	__u8	ssap;			/* always 0xAA */
 	__u8	ctrl;			/* always 0x03 */
 	__u8	oui[HIPPI_OUI_LEN];	/* organizational universal id (zero)*/
-	__be16	ethertype;		/* packet type ID field */
+	__u16	ethertype;		/* packet type ID field */
 } __attribute__ ((packed));
 
 struct hippi_hdr
diff --git a/trunk/include/linux/if_tr.h b/trunk/include/linux/if_tr.h
index 5502f597cf0e..3fba9e2f5427 100644
--- a/trunk/include/linux/if_tr.h
+++ b/trunk/include/linux/if_tr.h
@@ -43,16 +43,12 @@ struct trh_hdr {
 };
 
 #ifdef __KERNEL__
-#include <linux/config.h>
 #include <linux/skbuff.h>
 
 static inline struct trh_hdr *tr_hdr(const struct sk_buff *skb)
 {
 	return (struct trh_hdr *)skb->mac.raw;
 }
-#ifdef CONFIG_SYSCTL
-extern struct ctl_table tr_table[];
-#endif
 #endif
 
 /* This is an Token-Ring LLC structure */
diff --git a/trunk/include/linux/if_vlan.h b/trunk/include/linux/if_vlan.h
index 17d0c0d40b0e..62a9d89dfbe2 100644
--- a/trunk/include/linux/if_vlan.h
+++ b/trunk/include/linux/if_vlan.h
@@ -155,6 +155,7 @@ static inline int __vlan_hwaccel_rx(struct sk_buff *skb,
 {
 	struct net_device_stats *stats;
 
+	skb->real_dev = skb->dev;
 	skb->dev = grp->vlan_devices[vlan_tag & VLAN_VID_MASK];
 	if (skb->dev == NULL) {
 		dev_kfree_skb_any(skb);
diff --git a/trunk/include/linux/igmp.h b/trunk/include/linux/igmp.h
index 28f4f3b36950..0c31ef0b5bad 100644
--- a/trunk/include/linux/igmp.h
+++ b/trunk/include/linux/igmp.h
@@ -129,9 +129,6 @@ struct igmpv3_query {
 #include <linux/skbuff.h>
 #include <linux/in.h>
 
-extern int sysctl_igmp_max_memberships;
-extern int sysctl_igmp_max_msf;
-
 struct ip_sf_socklist
 {
 	unsigned int		sl_max;
diff --git a/trunk/include/linux/in.h b/trunk/include/linux/in.h
index ba355384016a..fb88c66d748d 100644
--- a/trunk/include/linux/in.h
+++ b/trunk/include/linux/in.h
@@ -32,7 +32,6 @@ enum {
   IPPROTO_PUP = 12,		/* PUP protocol				*/
   IPPROTO_UDP = 17,		/* User Datagram Protocol		*/
   IPPROTO_IDP = 22,		/* XNS IDP protocol			*/
-  IPPROTO_DCCP = 33,		/* Datagram Congestion Control Protocol */
   IPPROTO_RSVP = 46,		/* RSVP protocol			*/
   IPPROTO_GRE = 47,		/* Cisco GRE tunnels (rfc 1701,1702)	*/
 
diff --git a/trunk/include/linux/inet_diag.h b/trunk/include/linux/inet_diag.h
deleted file mode 100644
index a4606e5810e5..000000000000
--- a/trunk/include/linux/inet_diag.h
+++ /dev/null
@@ -1,138 +0,0 @@
-#ifndef _INET_DIAG_H_
-#define _INET_DIAG_H_ 1
-
-/* Just some random number */
-#define TCPDIAG_GETSOCK 18
-#define DCCPDIAG_GETSOCK 19
-
-#define INET_DIAG_GETSOCK_MAX 24
-
-/* Socket identity */
-struct inet_diag_sockid {
-	__u16	idiag_sport;
-	__u16	idiag_dport;
-	__u32	idiag_src[4];
-	__u32	idiag_dst[4];
-	__u32	idiag_if;
-	__u32	idiag_cookie[2];
-#define INET_DIAG_NOCOOKIE (~0U)
-};
-
-/* Request structure */
-
-struct inet_diag_req {
-	__u8	idiag_family;		/* Family of addresses. */
-	__u8	idiag_src_len;
-	__u8	idiag_dst_len;
-	__u8	idiag_ext;		/* Query extended information */
-
-	struct inet_diag_sockid id;
-
-	__u32	idiag_states;		/* States to dump */
-	__u32	idiag_dbs;		/* Tables to dump (NI) */
-};
-
-enum {
-	INET_DIAG_REQ_NONE,
-	INET_DIAG_REQ_BYTECODE,
-};
-
-#define INET_DIAG_REQ_MAX INET_DIAG_REQ_BYTECODE
-
-/* Bytecode is sequence of 4 byte commands followed by variable arguments.
- * All the commands identified by "code" are conditional jumps forward:
- * to offset cc+"yes" or to offset cc+"no". "yes" is supposed to be
- * length of the command and its arguments.
- */
- 
-struct inet_diag_bc_op {
-	unsigned char	code;
-	unsigned char	yes;
-	unsigned short	no;
-};
-
-enum {
-	INET_DIAG_BC_NOP,
-	INET_DIAG_BC_JMP,
-	INET_DIAG_BC_S_GE,
-	INET_DIAG_BC_S_LE,
-	INET_DIAG_BC_D_GE,
-	INET_DIAG_BC_D_LE,
-	INET_DIAG_BC_AUTO,
-	INET_DIAG_BC_S_COND,
-	INET_DIAG_BC_D_COND,
-};
-
-struct inet_diag_hostcond {
-	__u8	family;
-	__u8	prefix_len;
-	int	port;
-	__u32	addr[0];
-};
-
-/* Base info structure. It contains socket identity (addrs/ports/cookie)
- * and, alas, the information shown by netstat. */
-struct inet_diag_msg {
-	__u8	idiag_family;
-	__u8	idiag_state;
-	__u8	idiag_timer;
-	__u8	idiag_retrans;
-
-	struct inet_diag_sockid id;
-
-	__u32	idiag_expires;
-	__u32	idiag_rqueue;
-	__u32	idiag_wqueue;
-	__u32	idiag_uid;
-	__u32	idiag_inode;
-};
-
-/* Extensions */
-
-enum {
-	INET_DIAG_NONE,
-	INET_DIAG_MEMINFO,
-	INET_DIAG_INFO,
-	INET_DIAG_VEGASINFO,
-	INET_DIAG_CONG,
-};
-
-#define INET_DIAG_MAX INET_DIAG_CONG
-
-
-/* INET_DIAG_MEM */
-
-struct inet_diag_meminfo {
-	__u32	idiag_rmem;
-	__u32	idiag_wmem;
-	__u32	idiag_fmem;
-	__u32	idiag_tmem;
-};
-
-/* INET_DIAG_VEGASINFO */
-
-struct tcpvegas_info {
-	__u32	tcpv_enabled;
-	__u32	tcpv_rttcnt;
-	__u32	tcpv_rtt;
-	__u32	tcpv_minrtt;
-};
-
-#ifdef __KERNEL__
-struct sock;
-struct inet_hashinfo;
-
-struct inet_diag_handler {
-	struct inet_hashinfo    *idiag_hashinfo;
-	void			(*idiag_get_info)(struct sock *sk,
-						  struct inet_diag_msg *r,
-						  void *info);
-	__u16                   idiag_info_size;
-	__u16                   idiag_type;
-};
-
-extern int  inet_diag_register(const struct inet_diag_handler *handler);
-extern void inet_diag_unregister(const struct inet_diag_handler *handler);
-#endif /* __KERNEL__ */
-
-#endif /* _INET_DIAG_H_ */
diff --git a/trunk/include/linux/ip.h b/trunk/include/linux/ip.h
index 33e8a19a1a0f..31e7cedd9f84 100644
--- a/trunk/include/linux/ip.h
+++ b/trunk/include/linux/ip.h
@@ -196,8 +196,6 @@ static inline void inet_sk_copy_descendant(struct sock *sk_to,
 #endif
 #endif
 
-extern int inet_sk_rebuild_header(struct sock *sk);
-
 struct iphdr {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
 	__u8	ihl:4,
diff --git a/trunk/include/linux/ipv6.h b/trunk/include/linux/ipv6.h
index 3c7dbc6a0a70..6fcd6a0ade24 100644
--- a/trunk/include/linux/ipv6.h
+++ b/trunk/include/linux/ipv6.h
@@ -193,11 +193,6 @@ struct inet6_skb_parm {
 
 #define IP6CB(skb)	((struct inet6_skb_parm*)((skb)->cb))
 
-static inline int inet6_iif(const struct sk_buff *skb)
-{
-	return IP6CB(skb)->iif;
-}
-
 struct tcp6_request_sock {
 	struct tcp_request_sock	req;
 	struct in6_addr		loc_addr;
@@ -313,36 +308,6 @@ static inline void inet_sk_copy_descendant(struct sock *sk_to,
 
 #define __ipv6_only_sock(sk)	(inet6_sk(sk)->ipv6only)
 #define ipv6_only_sock(sk)	((sk)->sk_family == PF_INET6 && __ipv6_only_sock(sk))
-
-#include <linux/tcp.h>
-
-struct tcp6_timewait_sock {
-	struct tcp_timewait_sock tw_v6_sk;
-	struct in6_addr		 tw_v6_daddr;
-	struct in6_addr		 tw_v6_rcv_saddr;
-};
-
-static inline struct tcp6_timewait_sock *tcp6_twsk(const struct sock *sk)
-{
-	return (struct tcp6_timewait_sock *)sk;
-}
-
-static inline struct in6_addr *__tcp_v6_rcv_saddr(const struct sock *sk)
-{
-	return likely(sk->sk_state != TCP_TIME_WAIT) ?
-		&inet6_sk(sk)->rcv_saddr : &tcp6_twsk(sk)->tw_v6_rcv_saddr;
-}
-
-static inline struct in6_addr *tcp_v6_rcv_saddr(const struct sock *sk)
-{
-	return sk->sk_family == AF_INET6 ? __tcp_v6_rcv_saddr(sk) : NULL;
-}
-
-static inline int inet_v6_ipv6only(const struct sock *sk)
-{
-	return likely(sk->sk_state != TCP_TIME_WAIT) ?
-		ipv6_only_sock(sk) : inet_twsk(sk)->tw_ipv6only;
-}
 #else
 #define __ipv6_only_sock(sk)	0
 #define ipv6_only_sock(sk)	0
@@ -357,19 +322,8 @@ static inline struct raw6_sock *raw6_sk(const struct sock *sk)
 	return NULL;
 }
 
-#define __tcp_v6_rcv_saddr(__sk)	NULL
-#define tcp_v6_rcv_saddr(__sk)		NULL
-#define tcp_twsk_ipv6only(__sk)		0
-#define inet_v6_ipv6only(__sk)		0
-#endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
-
-#define INET6_MATCH(__sk, __saddr, __daddr, __ports, __dif)	   \
-	(((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))  	&& \
-	 ((__sk)->sk_family		== AF_INET6)		&& \
-	 ipv6_addr_equal(&inet6_sk(__sk)->daddr, (__saddr))	&& \
-	 ipv6_addr_equal(&inet6_sk(__sk)->rcv_saddr, (__daddr))	&& \
-	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
+#endif
 
-#endif /* __KERNEL__ */
+#endif
 
-#endif /* _IPV6_H */
+#endif
diff --git a/trunk/include/linux/libata.h b/trunk/include/linux/libata.h
index fc05a9899288..7c09540c52bc 100644
--- a/trunk/include/linux/libata.h
+++ b/trunk/include/linux/libata.h
@@ -1,26 +1,23 @@
 /*
- *  Copyright 2003-2005 Red Hat, Inc.  All rights reserved.
- *  Copyright 2003-2005 Jeff Garzik
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2, or (at your option)
- *  any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; see the file COPYING.  If not, write to
- *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- *  libata documentation is available via 'make {ps|pdf}docs',
- *  as Documentation/DocBook/libata.*
- *
+   Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
+   Copyright 2003-2004 Jeff Garzik
+
+   The contents of this file are subject to the Open
+   Software License version 1.1 that can be found at
+   http://www.opensource.org/licenses/osl-1.1.txt and is included herein
+   by reference.
+
+   Alternatively, the contents of this file may be used under the terms
+   of the GNU General Public License version 2 (the "GPL") as distributed
+   in the kernel source COPYING file, in which case the provisions of
+   the GPL are applicable instead of the above.  If you wish to allow
+   the use of your version of this file only under the terms of the
+   GPL and not to allow others to use your version of this file under
+   the OSL, indicate your decision by deleting the provisions above and
+   replace them with the notice and other provisions required by the GPL.
+   If you do not delete the provisions above, a recipient may use your
+   version of this file under either the OSL or the GPL.
+
  */
 
 #ifndef __LINUX_LIBATA_H__
diff --git a/trunk/include/linux/list.h b/trunk/include/linux/list.h
index e6ec59682274..aab2db21b013 100644
--- a/trunk/include/linux/list.h
+++ b/trunk/include/linux/list.h
@@ -418,20 +418,6 @@ static inline void list_splice_init(struct list_head *list,
 	     &pos->member != (head); 					\
 	     pos = n, n = list_entry(n->member.next, typeof(*n), member))
 
-/**
- * list_for_each_entry_safe_continue -	iterate over list of given type
- *			continuing after existing point safe against removal of list entry
- * @pos:	the type * to use as a loop counter.
- * @n:		another type * to use as temporary storage
- * @head:	the head for your list.
- * @member:	the name of the list_struct within the struct.
- */
-#define list_for_each_entry_safe_continue(pos, n, head, member) 		\
-	for (pos = list_entry(pos->member.next, typeof(*pos), member), 		\
-		n = list_entry(pos->member.next, typeof(*pos), member);		\
-	     &pos->member != (head);						\
-	     pos = n, n = list_entry(n->member.next, typeof(*n), member))
-
 /**
  * list_for_each_rcu	-	iterate over an rcu-protected list
  * @pos:	the &struct list_head to use as a loop counter.
@@ -634,57 +620,6 @@ static inline void hlist_add_after(struct hlist_node *n,
 		next->next->pprev  = &next->next;
 }
 
-/**
- * hlist_add_before_rcu - adds the specified element to the specified hlist
- * before the specified node while permitting racing traversals.
- * @n: the new element to add to the hash list.
- * @next: the existing element to add the new element before.
- *
- * The caller must take whatever precautions are necessary
- * (such as holding appropriate locks) to avoid racing
- * with another list-mutation primitive, such as hlist_add_head_rcu()
- * or hlist_del_rcu(), running on this same list.
- * However, it is perfectly legal to run concurrently with
- * the _rcu list-traversal primitives, such as
- * hlist_for_each_rcu(), used to prevent memory-consistency
- * problems on Alpha CPUs.
- */
-static inline void hlist_add_before_rcu(struct hlist_node *n,
-					struct hlist_node *next)
-{
-	n->pprev = next->pprev;
-	n->next = next;
-	smp_wmb();
-	next->pprev = &n->next;
-	*(n->pprev) = n;
-}
-
-/**
- * hlist_add_after_rcu - adds the specified element to the specified hlist
- * after the specified node while permitting racing traversals.
- * @prev: the existing element to add the new element after.
- * @n: the new element to add to the hash list.
- *
- * The caller must take whatever precautions are necessary
- * (such as holding appropriate locks) to avoid racing
- * with another list-mutation primitive, such as hlist_add_head_rcu()
- * or hlist_del_rcu(), running on this same list.
- * However, it is perfectly legal to run concurrently with
- * the _rcu list-traversal primitives, such as
- * hlist_for_each_rcu(), used to prevent memory-consistency
- * problems on Alpha CPUs.
- */
-static inline void hlist_add_after_rcu(struct hlist_node *prev,
-				       struct hlist_node *n)
-{
-	n->next = prev->next;
-	n->pprev = &prev->next;
-	smp_wmb();
-	prev->next = n;
-	if (n->next)
-		n->next->pprev = &n->next;
-}
-
 #define hlist_entry(ptr, type, member) container_of(ptr,type,member)
 
 #define hlist_for_each(pos, head) \
diff --git a/trunk/include/linux/mod_devicetable.h b/trunk/include/linux/mod_devicetable.h
index 47da39ba3f03..97bbccdbcca3 100644
--- a/trunk/include/linux/mod_devicetable.h
+++ b/trunk/include/linux/mod_devicetable.h
@@ -1,6 +1,6 @@
 /*
  * Device tables which are exported to userspace via
- * scripts/mod/file2alias.c.  You must keep that file in sync with this
+ * scripts/table2alias.c.  You must keep that file in sync with this
  * header.
  */
 
@@ -190,11 +190,6 @@ struct of_device_id
 #endif
 };
 
-/* VIO */
-struct vio_device_id {
-	char type[32];
-	char compat[32];
-};
 
 /* PCMCIA */
 
diff --git a/trunk/include/linux/net.h b/trunk/include/linux/net.h
index 4e981585a89a..20cb226b2268 100644
--- a/trunk/include/linux/net.h
+++ b/trunk/include/linux/net.h
@@ -84,7 +84,6 @@ enum sock_type {
 	SOCK_RAW	= 3,
 	SOCK_RDM	= 4,
 	SOCK_SEQPACKET	= 5,
-	SOCK_DCCP	= 6,
 	SOCK_PACKET	= 10,
 };
 
@@ -283,15 +282,5 @@ static struct proto_ops name##_ops = {			\
 #define MODULE_ALIAS_NETPROTO(proto) \
 	MODULE_ALIAS("net-pf-" __stringify(proto))
 
-#define MODULE_ALIAS_NET_PF_PROTO(pf, proto) \
-	MODULE_ALIAS("net-pf-" __stringify(pf) "-proto-" __stringify(proto))
-
-#ifdef CONFIG_SYSCTL
-#include <linux/sysctl.h>
-extern ctl_table net_table[];
-extern int net_msg_cost;
-extern int net_msg_burst;
-#endif
-
 #endif /* __KERNEL__ */
 #endif	/* _LINUX_NET_H */
diff --git a/trunk/include/linux/netdevice.h b/trunk/include/linux/netdevice.h
index 7c717907896d..3a0ed7f9e801 100644
--- a/trunk/include/linux/netdevice.h
+++ b/trunk/include/linux/netdevice.h
@@ -244,7 +244,6 @@ struct netdev_boot_setup {
 };
 #define NETDEV_BOOT_SETUP_MAX 8
 
-extern int __init netdev_boot_setup(char *str);
 
 /*
  *	The DEVICE structure.
@@ -337,7 +336,6 @@ struct net_device
 	/* Interface address info. */
 	unsigned char		broadcast[MAX_ADDR_LEN];	/* hw bcast add	*/
 	unsigned char		dev_addr[MAX_ADDR_LEN];	/* hw address	*/
-	unsigned char		perm_addr[MAX_ADDR_LEN]; /* permanent hw address */
 	unsigned char		addr_len;	/* hardware address length	*/
 	unsigned short          dev_id;		/* for shared network cards */
 
@@ -499,12 +497,10 @@ static inline void *netdev_priv(struct net_device *dev)
 #define SET_NETDEV_DEV(net, pdev)	((net)->class_dev.dev = (pdev))
 
 struct packet_type {
-	__be16			type;	/* This is really htons(ether_type). */
-	struct net_device	*dev;	/* NULL is wildcarded here	     */
-	int			(*func) (struct sk_buff *,
-					 struct net_device *,
-					 struct packet_type *,
-					 struct net_device *);
+	__be16			type;	/* This is really htons(ether_type).	*/
+	struct net_device		*dev;	/* NULL is wildcarded here		*/
+	int			(*func) (struct sk_buff *, struct net_device *,
+					 struct packet_type *);
 	void			*af_packet_priv;
 	struct list_head	list;
 };
@@ -675,7 +671,6 @@ extern void		dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev);
 extern void		dev_init(void);
 
 extern int		netdev_nit;
-extern int		netdev_budget;
 
 /* Called by rtnetlink.c:rtnl_unlock() */
 extern void netdev_run_todo(void);
@@ -702,9 +697,19 @@ static inline int netif_carrier_ok(const struct net_device *dev)
 
 extern void __netdev_watchdog_up(struct net_device *dev);
 
-extern void netif_carrier_on(struct net_device *dev);
+static inline void netif_carrier_on(struct net_device *dev)
+{
+	if (test_and_clear_bit(__LINK_STATE_NOCARRIER, &dev->state))
+		linkwatch_fire_event(dev);
+	if (netif_running(dev))
+		__netdev_watchdog_up(dev);
+}
 
-extern void netif_carrier_off(struct net_device *dev);
+static inline void netif_carrier_off(struct net_device *dev)
+{
+	if (!test_and_set_bit(__LINK_STATE_NOCARRIER, &dev->state))
+		linkwatch_fire_event(dev);
+}
 
 /* Hot-plugging. */
 static inline int netif_device_present(struct net_device *dev)
@@ -911,14 +916,6 @@ extern int skb_checksum_help(struct sk_buff *skb, int inward);
 extern void		net_enable_timestamp(void);
 extern void		net_disable_timestamp(void);
 
-#ifdef CONFIG_PROC_FS
-extern void *dev_seq_start(struct seq_file *seq, loff_t *pos);
-extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos);
-extern void dev_seq_stop(struct seq_file *seq, void *v);
-#endif
-
-extern void linkwatch_run_queue(void);
-
 #endif /* __KERNEL__ */
 
 #endif	/* _LINUX_DEV_H */
diff --git a/trunk/include/linux/netfilter.h b/trunk/include/linux/netfilter.h
index be365e70ee99..2e2045482cb1 100644
--- a/trunk/include/linux/netfilter.h
+++ b/trunk/include/linux/netfilter.h
@@ -21,23 +21,10 @@
 #define NF_STOP 5
 #define NF_MAX_VERDICT NF_STOP
 
-/* we overload the higher bits for encoding auxiliary data such as the queue
- * number. Not nice, but better than additional function arguments. */
-#define NF_VERDICT_MASK 0x0000ffff
-#define NF_VERDICT_BITS 16
-
-#define NF_VERDICT_QMASK 0xffff0000
-#define NF_VERDICT_QBITS 16
-
-#define NF_QUEUE_NR(x) (((x << NF_VERDICT_QBITS) & NF_VERDICT_QMASK) | NF_QUEUE)
-
-/* only for userspace compatibility */
-#ifndef __KERNEL__
 /* Generic cache responses from hook functions.
    <= 0x2000 is used for protocol-flags. */
 #define NFC_UNKNOWN 0x4000
 #define NFC_ALTERED 0x8000
-#endif
 
 #ifdef __KERNEL__
 #include <linux/config.h>
@@ -114,51 +101,15 @@ void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
 
 extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
 
-/* those NF_LOG_* defines and struct nf_loginfo are legacy definitios that will
- * disappear once iptables is replaced with pkttables.  Please DO NOT use them
- * for any new code! */
-#define NF_LOG_TCPSEQ		0x01	/* Log TCP sequence numbers */
-#define NF_LOG_TCPOPT		0x02	/* Log TCP options */
-#define NF_LOG_IPOPT		0x04	/* Log IP options */
-#define NF_LOG_UID		0x08	/* Log UID owning local socket */
-#define NF_LOG_MASK		0x0f
-
-#define NF_LOG_TYPE_LOG		0x01
-#define NF_LOG_TYPE_ULOG	0x02
-
-struct nf_loginfo {
-	u_int8_t type;
-	union {
-		struct {
-			u_int32_t copy_len;
-			u_int16_t group;
-			u_int16_t qthreshold;
-		} ulog;
-		struct {
-			u_int8_t level;
-			u_int8_t logflags;
-		} log;
-	} u;
-};
-
-typedef void nf_logfn(unsigned int pf,
-		      unsigned int hooknum,
+typedef void nf_logfn(unsigned int hooknum,
 		      const struct sk_buff *skb,
 		      const struct net_device *in,
 		      const struct net_device *out,
-		      const struct nf_loginfo *li,
 		      const char *prefix);
 
-struct nf_logger {
-	struct module	*me;
-	nf_logfn 	*logfn;
-	char		*name;
-};
-
 /* Function to register/unregister log function. */
-int nf_log_register(int pf, struct nf_logger *logger);
-int nf_log_unregister_pf(int pf);
-void nf_log_unregister_logger(struct nf_logger *logger);
+int nf_log_register(int pf, nf_logfn *logfn);
+void nf_log_unregister(int pf, nf_logfn *logfn);
 
 /* Calls the registered backend logging function */
 void nf_log_packet(int pf,
@@ -166,7 +117,6 @@ void nf_log_packet(int pf,
 		   const struct sk_buff *skb,
 		   const struct net_device *in,
 		   const struct net_device *out,
-		   struct nf_loginfo *li,
 		   const char *fmt, ...);
                    
 /* Activate hook; either okfn or kfree_skb called, unless a hook
@@ -225,16 +175,11 @@ int nf_getsockopt(struct sock *sk, int pf, int optval, char __user *opt,
 		  int *len);
 
 /* Packet queuing */
-struct nf_queue_handler {
-	int (*outfn)(struct sk_buff *skb, struct nf_info *info,
-		     unsigned int queuenum, void *data);
-	void *data;
-	char *name;
-};
+typedef int (*nf_queue_outfn_t)(struct sk_buff *skb, 
+                                struct nf_info *info, void *data);
 extern int nf_register_queue_handler(int pf, 
-                                     struct nf_queue_handler *qh);
+                                     nf_queue_outfn_t outfn, void *data);
 extern int nf_unregister_queue_handler(int pf);
-extern void nf_unregister_queue_handlers(struct nf_queue_handler *qh);
 extern void nf_reinject(struct sk_buff *skb,
 			struct nf_info *info,
 			unsigned int verdict);
@@ -245,27 +190,6 @@ extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
 /* FIXME: Before cache is ever used, this must be implemented for real. */
 extern void nf_invalidate_cache(int pf);
 
-/* Call this before modifying an existing packet: ensures it is
-   modifiable and linear to the point you care about (writable_len).
-   Returns true or false. */
-extern int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len);
-
-struct nf_queue_rerouter {
-	void (*save)(const struct sk_buff *skb, struct nf_info *info);
-	int (*reroute)(struct sk_buff **skb, const struct nf_info *info);
-	int rer_size;
-};
-
-#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
-
-extern int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer);
-extern int nf_unregister_queue_rerouter(int pf);
-
-#ifdef CONFIG_PROC_FS
-#include <linux/proc_fs.h>
-extern struct proc_dir_entry *proc_net_netfilter;
-#endif
-
 #else /* !CONFIG_NETFILTER */
 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
diff --git a/trunk/include/linux/netfilter/nfnetlink.h b/trunk/include/linux/netfilter/nfnetlink.h
deleted file mode 100644
index 1d5b10ae2399..000000000000
--- a/trunk/include/linux/netfilter/nfnetlink.h
+++ /dev/null
@@ -1,169 +0,0 @@
-#ifndef _NFNETLINK_H
-#define _NFNETLINK_H
-#include <linux/types.h>
-
-#ifndef __KERNEL__
-/* nfnetlink groups: Up to 32 maximum - backwards compatibility for userspace */
-#define NF_NETLINK_CONNTRACK_NEW 		0x00000001
-#define NF_NETLINK_CONNTRACK_UPDATE		0x00000002
-#define NF_NETLINK_CONNTRACK_DESTROY		0x00000004
-#define NF_NETLINK_CONNTRACK_EXP_NEW		0x00000008
-#define NF_NETLINK_CONNTRACK_EXP_UPDATE		0x00000010
-#define NF_NETLINK_CONNTRACK_EXP_DESTROY	0x00000020
-#endif
-
-enum nfnetlink_groups {
-	NFNLGRP_NONE,
-#define NFNLGRP_NONE			NFNLGRP_NONE
-	NFNLGRP_CONNTRACK_NEW,
-#define NFNLGRP_CONNTRACK_NEW		NFNLGRP_CONNTRACK_NEW
-	NFNLGRP_CONNTRACK_UPDATE,
-#define NFNLGRP_CONNTRACK_UPDATE	NFNLGRP_CONNTRACK_UPDATE
-	NFNLGRP_CONNTRACK_DESTROY,
-#define NFNLGRP_CONNTRACK_DESTROY	NFNLGRP_CONNTRACK_DESTROY
-	NFNLGRP_CONNTRACK_EXP_NEW,
-#define	NFNLGRP_CONNTRACK_EXP_NEW	NFNLGRP_CONNTRACK_EXP_NEW
-	NFNLGRP_CONNTRACK_EXP_UPDATE,
-#define NFNLGRP_CONNTRACK_EXP_UPDATE	NFNLGRP_CONNTRACK_EXP_UPDATE
-	NFNLGRP_CONNTRACK_EXP_DESTROY,
-#define NFNLGRP_CONNTRACK_EXP_DESTROY	NFNLGRP_CONNTRACK_EXP_DESTROY
-	__NFNLGRP_MAX,
-};
-#define NFNLGRP_MAX	(__NFNLGRP_MAX - 1)
-
-/* Generic structure for encapsulation optional netfilter information.
- * It is reminiscent of sockaddr, but with sa_family replaced
- * with attribute type. 
- * ! This should someday be put somewhere generic as now rtnetlink and
- * ! nfnetlink use the same attributes methods. - J. Schulist.
- */
-
-struct nfattr
-{
-	u_int16_t nfa_len;
-	u_int16_t nfa_type;
-} __attribute__ ((packed));
-
-/* FIXME: Shamelessly copy and pasted from rtnetlink.h, it's time
- * 	  to put this in a generic file */
-
-#define NFA_ALIGNTO     4
-#define NFA_ALIGN(len)	(((len) + NFA_ALIGNTO - 1) & ~(NFA_ALIGNTO - 1))
-#define NFA_OK(nfa,len)	((len) > 0 && (nfa)->nfa_len >= sizeof(struct nfattr) \
-	&& (nfa)->nfa_len <= (len))
-#define NFA_NEXT(nfa,attrlen)	((attrlen) -= NFA_ALIGN((nfa)->nfa_len), \
-	(struct nfattr *)(((char *)(nfa)) + NFA_ALIGN((nfa)->nfa_len)))
-#define NFA_LENGTH(len)	(NFA_ALIGN(sizeof(struct nfattr)) + (len))
-#define NFA_SPACE(len)	NFA_ALIGN(NFA_LENGTH(len))
-#define NFA_DATA(nfa)   ((void *)(((char *)(nfa)) + NFA_LENGTH(0)))
-#define NFA_PAYLOAD(nfa) ((int)((nfa)->nfa_len) - NFA_LENGTH(0))
-#define NFA_NEST(skb, type) \
-({	struct nfattr *__start = (struct nfattr *) (skb)->tail; \
-	NFA_PUT(skb, type, 0, NULL); \
-	__start;  })
-#define NFA_NEST_END(skb, start) \
-({      (start)->nfa_len = ((skb)->tail - (unsigned char *) (start)); \
-        (skb)->len; })
-#define NFA_NEST_CANCEL(skb, start) \
-({      if (start) \
-                skb_trim(skb, (unsigned char *) (start) - (skb)->data); \
-        -1; })
-
-/* General form of address family dependent message.
- */
-struct nfgenmsg {
-	u_int8_t  nfgen_family;		/* AF_xxx */
-	u_int8_t  version;		/* nfnetlink version */
-	u_int16_t res_id;		/* resource id */
-} __attribute__ ((packed));
-
-#define NFNETLINK_V0	0
-
-#define NFM_NFA(n)      ((struct nfattr *)(((char *)(n)) \
-        + NLMSG_ALIGN(sizeof(struct nfgenmsg))))
-#define NFM_PAYLOAD(n)  NLMSG_PAYLOAD(n, sizeof(struct nfgenmsg))
-
-/* netfilter netlink message types are split in two pieces:
- * 8 bit subsystem, 8bit operation.
- */
-
-#define NFNL_SUBSYS_ID(x)	((x & 0xff00) >> 8)
-#define NFNL_MSG_TYPE(x)	(x & 0x00ff)
-
-/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS()
- * won't work anymore */
-#define NFNL_SUBSYS_NONE 		0
-#define NFNL_SUBSYS_CTNETLINK		1
-#define NFNL_SUBSYS_CTNETLINK_EXP	2
-#define NFNL_SUBSYS_QUEUE		3
-#define NFNL_SUBSYS_ULOG		4
-#define NFNL_SUBSYS_COUNT		5
-
-#ifdef __KERNEL__
-
-#include <linux/netlink.h>
-#include <linux/capability.h>
-
-struct nfnl_callback
-{
-	int (*call)(struct sock *nl, struct sk_buff *skb, 
-		struct nlmsghdr *nlh, struct nfattr *cda[], int *errp);
-	kernel_cap_t cap_required; /* capabilities required for this msg */
-	u_int16_t attr_count;	/* number of nfattr's */
-};
-
-struct nfnetlink_subsystem
-{
-	const char *name;
-	__u8 subsys_id;		/* nfnetlink subsystem ID */
-	__u8 cb_count;		/* number of callbacks */
-	struct nfnl_callback *cb; /* callback for individual types */
-};
-
-extern void __nfa_fill(struct sk_buff *skb, int attrtype,
-        int attrlen, const void *data);
-#define NFA_PUT(skb, attrtype, attrlen, data) \
-({ if (skb_tailroom(skb) < (int)NFA_SPACE(attrlen)) goto nfattr_failure; \
-   __nfa_fill(skb, attrtype, attrlen, data); })
-
-extern struct semaphore nfnl_sem;
-
-#define nfnl_shlock()		down(&nfnl_sem)
-#define nfnl_shlock_nowait()	down_trylock(&nfnl_sem)
-
-#define nfnl_shunlock()		do { up(&nfnl_sem); \
-				     if(nfnl && nfnl->sk_receive_queue.qlen) \
-					    nfnl->sk_data_ready(nfnl, 0); \
-                        	} while(0)
-
-extern void nfnl_lock(void);
-extern void nfnl_unlock(void);
-
-extern int nfnetlink_subsys_register(struct nfnetlink_subsystem *n);
-extern int nfnetlink_subsys_unregister(struct nfnetlink_subsystem *n);
-
-extern int nfattr_parse(struct nfattr *tb[], int maxattr, 
-			struct nfattr *nfa, int len);
-
-#define nfattr_parse_nested(tb, max, nfa) \
-	nfattr_parse((tb), (max), NFA_DATA((nfa)), NFA_PAYLOAD((nfa)))
-
-#define nfattr_bad_size(tb, max, cta_min)				\
-({	int __i, __res = 0;						\
- 	for (__i=0; __i<max; __i++) 					\
- 		if (tb[__i] && NFA_PAYLOAD(tb[__i]) < cta_min[__i]){	\
- 			__res = 1;					\
- 			break;						\
- 		}							\
- 	__res;								\
-})
-
-extern int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, 
-			  int echo);
-extern int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags);
-
-#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
-	MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
-
-#endif	/* __KERNEL__ */
-#endif	/* _NFNETLINK_H */
diff --git a/trunk/include/linux/netfilter/nfnetlink_conntrack.h b/trunk/include/linux/netfilter/nfnetlink_conntrack.h
deleted file mode 100644
index 5c55751c78e4..000000000000
--- a/trunk/include/linux/netfilter/nfnetlink_conntrack.h
+++ /dev/null
@@ -1,124 +0,0 @@
-#ifndef _IPCONNTRACK_NETLINK_H
-#define _IPCONNTRACK_NETLINK_H
-#include <linux/netfilter/nfnetlink.h>
-
-enum cntl_msg_types {
-	IPCTNL_MSG_CT_NEW,
-	IPCTNL_MSG_CT_GET,
-	IPCTNL_MSG_CT_DELETE,
-	IPCTNL_MSG_CT_GET_CTRZERO,
-
-	IPCTNL_MSG_MAX
-};
-
-enum ctnl_exp_msg_types {
-	IPCTNL_MSG_EXP_NEW,
-	IPCTNL_MSG_EXP_GET,
-	IPCTNL_MSG_EXP_DELETE,
-
-	IPCTNL_MSG_EXP_MAX
-};
-
-
-enum ctattr_type {
-	CTA_UNSPEC,
-	CTA_TUPLE_ORIG,
-	CTA_TUPLE_REPLY,
-	CTA_STATUS,
-	CTA_PROTOINFO,
-	CTA_HELP,
-	CTA_NAT,
-	CTA_TIMEOUT,
-	CTA_MARK,
-	CTA_COUNTERS_ORIG,
-	CTA_COUNTERS_REPLY,
-	CTA_USE,
-	CTA_ID,
-	__CTA_MAX
-};
-#define CTA_MAX (__CTA_MAX - 1)
-
-enum ctattr_tuple {
-	CTA_TUPLE_UNSPEC,
-	CTA_TUPLE_IP,
-	CTA_TUPLE_PROTO,
-	__CTA_TUPLE_MAX
-};
-#define CTA_TUPLE_MAX (__CTA_TUPLE_MAX - 1)
-
-enum ctattr_ip {
-	CTA_IP_UNSPEC,
-	CTA_IP_V4_SRC,
-	CTA_IP_V4_DST,
-	CTA_IP_V6_SRC,
-	CTA_IP_V6_DST,
-	__CTA_IP_MAX
-};
-#define CTA_IP_MAX (__CTA_IP_MAX - 1)
-
-enum ctattr_l4proto {
-	CTA_PROTO_UNSPEC,
-	CTA_PROTO_NUM,
-	CTA_PROTO_SRC_PORT,
-	CTA_PROTO_DST_PORT,
-	CTA_PROTO_ICMP_ID,
-	CTA_PROTO_ICMP_TYPE,
-	CTA_PROTO_ICMP_CODE,
-	__CTA_PROTO_MAX
-};
-#define CTA_PROTO_MAX (__CTA_PROTO_MAX - 1)
-
-enum ctattr_protoinfo {
-	CTA_PROTOINFO_UNSPEC,
-	CTA_PROTOINFO_TCP_STATE,
-	__CTA_PROTOINFO_MAX
-};
-#define CTA_PROTOINFO_MAX (__CTA_PROTOINFO_MAX - 1)
-
-enum ctattr_counters {
-	CTA_COUNTERS_UNSPEC,
-	CTA_COUNTERS_PACKETS,
-	CTA_COUNTERS_BYTES,
-	__CTA_COUNTERS_MAX
-};
-#define CTA_COUNTERS_MAX (__CTA_COUNTERS_MAX - 1)
-
-enum ctattr_nat {
-	CTA_NAT_UNSPEC,
-	CTA_NAT_MINIP,
-	CTA_NAT_MAXIP,
-	CTA_NAT_PROTO,
-	__CTA_NAT_MAX
-};
-#define CTA_NAT_MAX (__CTA_NAT_MAX - 1)
-
-enum ctattr_protonat {
-	CTA_PROTONAT_UNSPEC,
-	CTA_PROTONAT_PORT_MIN,
-	CTA_PROTONAT_PORT_MAX,
-	__CTA_PROTONAT_MAX
-};
-#define CTA_PROTONAT_MAX (__CTA_PROTONAT_MAX - 1)
-
-enum ctattr_expect {
-	CTA_EXPECT_UNSPEC,
-	CTA_EXPECT_MASTER,
-	CTA_EXPECT_TUPLE,
-	CTA_EXPECT_MASK,
-	CTA_EXPECT_TIMEOUT,
-	CTA_EXPECT_ID,
-	CTA_EXPECT_HELP_NAME,
-	__CTA_EXPECT_MAX
-};
-#define CTA_EXPECT_MAX (__CTA_EXPECT_MAX - 1)
-
-enum ctattr_help {
-	CTA_HELP_UNSPEC,
-	CTA_HELP_NAME,
-	__CTA_HELP_MAX
-};
-#define CTA_HELP_MAX (__CTA_HELP_MAX - 1)
-
-#define CTA_HELP_MAXNAMESIZE	32
-
-#endif /* _IPCONNTRACK_NETLINK_H */
diff --git a/trunk/include/linux/netfilter/nfnetlink_log.h b/trunk/include/linux/netfilter/nfnetlink_log.h
deleted file mode 100644
index b04b03880595..000000000000
--- a/trunk/include/linux/netfilter/nfnetlink_log.h
+++ /dev/null
@@ -1,88 +0,0 @@
-#ifndef _NFNETLINK_LOG_H
-#define _NFNETLINK_LOG_H
-
-/* This file describes the netlink messages (i.e. 'protocol packets'),
- * and not any kind of function definitions.  It is shared between kernel and
- * userspace.  Don't put kernel specific stuff in here */
-
-#include <linux/types.h>
-#include <linux/netfilter/nfnetlink.h>
-
-enum nfulnl_msg_types {
-	NFULNL_MSG_PACKET,		/* packet from kernel to userspace */
-	NFULNL_MSG_CONFIG,		/* connect to a particular queue */
-
-	NFULNL_MSG_MAX
-};
-
-struct nfulnl_msg_packet_hdr {
-	u_int16_t	hw_protocol;	/* hw protocol (network order) */
-	u_int8_t	hook;		/* netfilter hook */
-	u_int8_t	_pad;
-} __attribute__ ((packed));
-
-struct nfulnl_msg_packet_hw {
-	u_int16_t	hw_addrlen;
-	u_int16_t	_pad;
-	u_int8_t	hw_addr[8];
-} __attribute__ ((packed));
-
-struct nfulnl_msg_packet_timestamp {
-	aligned_u64	sec;
-	aligned_u64	usec;
-} __attribute__ ((packed));
-
-#define NFULNL_PREFIXLEN	30	/* just like old log target */
-
-enum nfulnl_attr_type {
-	NFULA_UNSPEC,
-	NFULA_PACKET_HDR,
-	NFULA_MARK,			/* u_int32_t nfmark */
-	NFULA_TIMESTAMP,		/* nfulnl_msg_packet_timestamp */
-	NFULA_IFINDEX_INDEV,		/* u_int32_t ifindex */
-	NFULA_IFINDEX_OUTDEV,		/* u_int32_t ifindex */
-	NFULA_IFINDEX_PHYSINDEV,	/* u_int32_t ifindex */
-	NFULA_IFINDEX_PHYSOUTDEV,	/* u_int32_t ifindex */
-	NFULA_HWADDR,			/* nfulnl_msg_packet_hw */
-	NFULA_PAYLOAD,			/* opaque data payload */
-	NFULA_PREFIX,			/* string prefix */
-	NFULA_UID,			/* user id of socket */
-
-	__NFULA_MAX
-};
-#define NFULA_MAX (__NFULA_MAX - 1)
-
-enum nfulnl_msg_config_cmds {
-	NFULNL_CFG_CMD_NONE,
-	NFULNL_CFG_CMD_BIND,
-	NFULNL_CFG_CMD_UNBIND,
-	NFULNL_CFG_CMD_PF_BIND,
-	NFULNL_CFG_CMD_PF_UNBIND,
-};
-
-struct nfulnl_msg_config_cmd {
-	u_int8_t	command;	/* nfulnl_msg_config_cmds */
-} __attribute__ ((packed));
-
-struct nfulnl_msg_config_mode {
-	u_int32_t	copy_range;
-	u_int8_t	copy_mode;
-	u_int8_t	_pad;
-} __attribute__ ((packed));
-
-enum nfulnl_attr_config {
-	NFULA_CFG_UNSPEC,
-	NFULA_CFG_CMD,			/* nfulnl_msg_config_cmd */
-	NFULA_CFG_MODE,			/* nfulnl_msg_config_mode */
-	NFULA_CFG_NLBUFSIZ,		/* u_int32_t buffer size */
-	NFULA_CFG_TIMEOUT,		/* u_int32_t in 1/100 s */
-	NFULA_CFG_QTHRESH,		/* u_int32_t */
-	__NFULA_CFG_MAX
-};
-#define NFULA_CFG_MAX (__NFULA_CFG_MAX -1)
-
-#define NFULNL_COPY_NONE	0x00
-#define NFULNL_COPY_META	0x01
-#define NFULNL_COPY_PACKET	0x02
-
-#endif /* _NFNETLINK_LOG_H */
diff --git a/trunk/include/linux/netfilter/nfnetlink_queue.h b/trunk/include/linux/netfilter/nfnetlink_queue.h
deleted file mode 100644
index 9e774373244c..000000000000
--- a/trunk/include/linux/netfilter/nfnetlink_queue.h
+++ /dev/null
@@ -1,89 +0,0 @@
-#ifndef _NFNETLINK_QUEUE_H
-#define _NFNETLINK_QUEUE_H
-
-#include <linux/types.h>
-#include <linux/netfilter/nfnetlink.h>
-
-enum nfqnl_msg_types {
-	NFQNL_MSG_PACKET,		/* packet from kernel to userspace */
-	NFQNL_MSG_VERDICT,		/* verdict from userspace to kernel */
-	NFQNL_MSG_CONFIG,		/* connect to a particular queue */
-
-	NFQNL_MSG_MAX
-};
-
-struct nfqnl_msg_packet_hdr {
-	u_int32_t	packet_id;	/* unique ID of packet in queue */
-	u_int16_t	hw_protocol;	/* hw protocol (network order) */
-	u_int8_t	hook;		/* netfilter hook */
-} __attribute__ ((packed));
-
-struct nfqnl_msg_packet_hw {
-	u_int16_t	hw_addrlen;
-	u_int16_t	_pad;
-	u_int8_t	hw_addr[8];
-} __attribute__ ((packed));
-
-struct nfqnl_msg_packet_timestamp {
-	aligned_u64	sec;
-	aligned_u64	usec;
-} __attribute__ ((packed));
-
-enum nfqnl_attr_type {
-	NFQA_UNSPEC,
-	NFQA_PACKET_HDR,
-	NFQA_VERDICT_HDR,		/* nfqnl_msg_verdict_hrd */
-	NFQA_MARK,			/* u_int32_t nfmark */
-	NFQA_TIMESTAMP,			/* nfqnl_msg_packet_timestamp */
-	NFQA_IFINDEX_INDEV,		/* u_int32_t ifindex */
-	NFQA_IFINDEX_OUTDEV,		/* u_int32_t ifindex */
-	NFQA_IFINDEX_PHYSINDEV,		/* u_int32_t ifindex */
-	NFQA_IFINDEX_PHYSOUTDEV,	/* u_int32_t ifindex */
-	NFQA_HWADDR,			/* nfqnl_msg_packet_hw */
-	NFQA_PAYLOAD,			/* opaque data payload */
-
-	__NFQA_MAX
-};
-#define NFQA_MAX (__NFQA_MAX - 1)
-
-struct nfqnl_msg_verdict_hdr {
-	u_int32_t verdict;
-	u_int32_t id;
-} __attribute__ ((packed));
-
-
-enum nfqnl_msg_config_cmds {
-	NFQNL_CFG_CMD_NONE,
-	NFQNL_CFG_CMD_BIND,
-	NFQNL_CFG_CMD_UNBIND,
-	NFQNL_CFG_CMD_PF_BIND,
-	NFQNL_CFG_CMD_PF_UNBIND,
-};
-
-struct nfqnl_msg_config_cmd {
-	u_int8_t	command;	/* nfqnl_msg_config_cmds */
-	u_int8_t	_pad;
-	u_int16_t	pf;		/* AF_xxx for PF_[UN]BIND */
-} __attribute__ ((packed));
-
-enum nfqnl_config_mode {
-	NFQNL_COPY_NONE,
-	NFQNL_COPY_META,
-	NFQNL_COPY_PACKET,
-};
-
-struct nfqnl_msg_config_params {
-	u_int32_t	copy_range;
-	u_int8_t	copy_mode;	/* enum nfqnl_config_mode */
-} __attribute__ ((packed));
-
-
-enum nfqnl_attr_config {
-	NFQA_CFG_UNSPEC,
-	NFQA_CFG_CMD,			/* nfqnl_msg_config_cmd */
-	NFQA_CFG_PARAMS,		/* nfqnl_msg_config_params */
-	__NFQA_CFG_MAX
-};
-#define NFQA_CFG_MAX (__NFQA_CFG_MAX-1)
-
-#endif /* _NFNETLINK_QUEUE_H */
diff --git a/trunk/include/linux/netfilter_decnet.h b/trunk/include/linux/netfilter_decnet.h
index 6f425369ee29..3064eec9cb8e 100644
--- a/trunk/include/linux/netfilter_decnet.h
+++ b/trunk/include/linux/netfilter_decnet.h
@@ -9,8 +9,6 @@
 
 #include <linux/netfilter.h>
 
-/* only for userspace compatibility */
-#ifndef __KERNEL__
 /* IP Cache bits. */
 /* Src IP address. */
 #define NFC_DN_SRC		0x0001
@@ -20,7 +18,6 @@
 #define NFC_DN_IF_IN		0x0004
 /* Output device. */
 #define NFC_DN_IF_OUT		0x0008
-#endif /* ! __KERNEL__ */
 
 /* DECnet Hooks */
 /* After promisc drops, checksum checks. */
@@ -56,21 +53,7 @@ struct nf_dn_rtmsg {
 
 #define NFDN_RTMSG(r) ((unsigned char *)(r) + NLMSG_ALIGN(sizeof(struct nf_dn_rtmsg)))
 
-#ifndef __KERNEL__
-/* backwards compatibility for userspace */
 #define DNRMG_L1_GROUP 0x01
 #define DNRMG_L2_GROUP 0x02
-#endif
-
-enum {
-	DNRNG_NLGRP_NONE,
-#define DNRNG_NLGRP_NONE	DNRNG_NLGRP_NONE
-	DNRNG_NLGRP_L1,
-#define DNRNG_NLGRP_L1		DNRNG_NLGRP_L1
-	DNRNG_NLGRP_L2,
-#define DNRNG_NLGRP_L2		DNRNG_NLGRP_L2
-	__DNRNG_NLGRP_MAX
-};
-#define DNRNG_NLGRP_MAX	(__DNRNG_NLGRP_MAX - 1)
 
 #endif /*__LINUX_DECNET_NETFILTER_H*/
diff --git a/trunk/include/linux/netfilter_ipv4.h b/trunk/include/linux/netfilter_ipv4.h
index fdc4a9527343..3ebc36afae1a 100644
--- a/trunk/include/linux/netfilter_ipv4.h
+++ b/trunk/include/linux/netfilter_ipv4.h
@@ -8,8 +8,6 @@
 #include <linux/config.h>
 #include <linux/netfilter.h>
 
-/* only for userspace compatibility */
-#ifndef __KERNEL__
 /* IP Cache bits. */
 /* Src IP address. */
 #define NFC_IP_SRC		0x0001
@@ -37,7 +35,6 @@
 #define NFC_IP_DST_PT		0x0400
 /* Something else about the proto */
 #define NFC_IP_PROTO_UNKNOWN	0x2000
-#endif /* ! __KERNEL__ */
 
 /* IP Hooks */
 /* After promisc drops, checksum checks. */
@@ -80,6 +77,11 @@ enum nf_ip_hook_priorities {
 #ifdef __KERNEL__
 extern int ip_route_me_harder(struct sk_buff **pskb);
 
+/* Call this before modifying an existing IP packet: ensures it is
+   modifiable and linear to the point you care about (writable_len).
+   Returns true or false. */
+extern int skb_ip_make_writable(struct sk_buff **pskb,
+				unsigned int writable_len);
 #endif /*__KERNEL__*/
 
 #endif /*__LINUX_IP_NETFILTER_H*/
diff --git a/trunk/include/linux/netfilter_ipv4/ip_conntrack.h b/trunk/include/linux/netfilter_ipv4/ip_conntrack.h
index 088742befe49..08fe5f7d14a0 100644
--- a/trunk/include/linux/netfilter_ipv4/ip_conntrack.h
+++ b/trunk/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -65,63 +65,6 @@ enum ip_conntrack_status {
 
 	/* Both together */
 	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
-
-	/* Connection is dying (removed from lists), can not be unset. */
-	IPS_DYING_BIT = 9,
-	IPS_DYING = (1 << IPS_DYING_BIT),
-};
-
-/* Connection tracking event bits */
-enum ip_conntrack_events
-{
-	/* New conntrack */
-	IPCT_NEW_BIT = 0,
-	IPCT_NEW = (1 << IPCT_NEW_BIT),
-
-	/* Expected connection */
-	IPCT_RELATED_BIT = 1,
-	IPCT_RELATED = (1 << IPCT_RELATED_BIT),
-
-	/* Destroyed conntrack */
-	IPCT_DESTROY_BIT = 2,
-	IPCT_DESTROY = (1 << IPCT_DESTROY_BIT),
-
-	/* Timer has been refreshed */
-	IPCT_REFRESH_BIT = 3,
-	IPCT_REFRESH = (1 << IPCT_REFRESH_BIT),
-
-	/* Status has changed */
-	IPCT_STATUS_BIT = 4,
-	IPCT_STATUS = (1 << IPCT_STATUS_BIT),
-
-	/* Update of protocol info */
-	IPCT_PROTOINFO_BIT = 5,
-	IPCT_PROTOINFO = (1 << IPCT_PROTOINFO_BIT),
-
-	/* Volatile protocol info */
-	IPCT_PROTOINFO_VOLATILE_BIT = 6,
-	IPCT_PROTOINFO_VOLATILE = (1 << IPCT_PROTOINFO_VOLATILE_BIT),
-
-	/* New helper for conntrack */
-	IPCT_HELPER_BIT = 7,
-	IPCT_HELPER = (1 << IPCT_HELPER_BIT),
-
-	/* Update of helper info */
-	IPCT_HELPINFO_BIT = 8,
-	IPCT_HELPINFO = (1 << IPCT_HELPINFO_BIT),
-
-	/* Volatile helper info */
-	IPCT_HELPINFO_VOLATILE_BIT = 9,
-	IPCT_HELPINFO_VOLATILE = (1 << IPCT_HELPINFO_VOLATILE_BIT),
-
-	/* NAT info */
-	IPCT_NATINFO_BIT = 10,
-	IPCT_NATINFO = (1 << IPCT_NATINFO_BIT),
-};
-
-enum ip_conntrack_expect_events {
-	IPEXP_NEW_BIT = 0,
-	IPEXP_NEW = (1 << IPEXP_NEW_BIT),
 };
 
 #ifdef __KERNEL__
@@ -209,9 +152,6 @@ struct ip_conntrack
 	/* Current number of expected connections */
 	unsigned int expecting;
 
-	/* Unique ID that identifies this conntrack*/
-	unsigned int id;
-
 	/* Helper, if any. */
 	struct ip_conntrack_helper *helper;
 
@@ -231,7 +171,7 @@ struct ip_conntrack
 #endif /* CONFIG_IP_NF_NAT_NEEDED */
 
 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
-	u_int32_t mark;
+	unsigned long mark;
 #endif
 
 	/* Traversed often, so hopefully in different cacheline to top */
@@ -260,9 +200,6 @@ struct ip_conntrack_expect
 	/* Usage count. */
 	atomic_t use;
 
-	/* Unique ID */
-	unsigned int id;
-
 #ifdef CONFIG_IP_NF_NAT_NEEDED
 	/* This is the original per-proto part, used to map the
 	 * expected connection the way the recipient expects. */
@@ -302,12 +239,7 @@ ip_conntrack_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
 }
 
 /* decrement reference count on a conntrack */
-static inline void
-ip_conntrack_put(struct ip_conntrack *ct)
-{
-	IP_NF_ASSERT(ct);
-	nf_conntrack_put(&ct->ct_general);
-}
+extern void ip_conntrack_put(struct ip_conntrack *ct);
 
 /* call to create an explicit dependency on ip_conntrack. */
 extern void need_ip_conntrack(void);
@@ -342,50 +274,12 @@ extern void
 ip_ct_iterate_cleanup(int (*iter)(struct ip_conntrack *i, void *data),
 		      void *data);
 
-extern struct ip_conntrack_helper *
-__ip_conntrack_helper_find_byname(const char *);
-extern struct ip_conntrack_helper *
-ip_conntrack_helper_find_get(const struct ip_conntrack_tuple *tuple);
-extern void ip_conntrack_helper_put(struct ip_conntrack_helper *helper);
-
-extern struct ip_conntrack_protocol *
-__ip_conntrack_proto_find(u_int8_t protocol);
-extern struct ip_conntrack_protocol *
-ip_conntrack_proto_find_get(u_int8_t protocol);
-extern void ip_conntrack_proto_put(struct ip_conntrack_protocol *proto);
-
-extern void ip_ct_remove_expectations(struct ip_conntrack *ct);
-
-extern struct ip_conntrack *ip_conntrack_alloc(struct ip_conntrack_tuple *,
-					       struct ip_conntrack_tuple *);
-
-extern void ip_conntrack_free(struct ip_conntrack *ct);
-
-extern void ip_conntrack_hash_insert(struct ip_conntrack *ct);
-
-extern struct ip_conntrack_expect *
-__ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple);
-
-extern struct ip_conntrack_expect *
-ip_conntrack_expect_find_get(const struct ip_conntrack_tuple *tuple);
-
-extern struct ip_conntrack_tuple_hash *
-__ip_conntrack_find(const struct ip_conntrack_tuple *tuple,
-                    const struct ip_conntrack *ignored_conntrack);
-
-extern void ip_conntrack_flush(void);
-
 /* It's confirmed if it is, or has been in the hash table. */
 static inline int is_confirmed(struct ip_conntrack *ct)
 {
 	return test_bit(IPS_CONFIRMED_BIT, &ct->status);
 }
 
-static inline int is_dying(struct ip_conntrack *ct)
-{
-	return test_bit(IPS_DYING_BIT, &ct->status);
-}
-
 extern unsigned int ip_conntrack_htable_size;
  
 struct ip_conntrack_stat
@@ -409,85 +303,6 @@ struct ip_conntrack_stat
 
 #define CONNTRACK_STAT_INC(count) (__get_cpu_var(ip_conntrack_stat).count++)
 
-#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-#include <linux/notifier.h>
-#include <linux/interrupt.h>
-
-struct ip_conntrack_ecache {
-	struct ip_conntrack *ct;
-	unsigned int events;
-};
-DECLARE_PER_CPU(struct ip_conntrack_ecache, ip_conntrack_ecache);
-
-#define CONNTRACK_ECACHE(x)	(__get_cpu_var(ip_conntrack_ecache).x)
- 
-extern struct notifier_block *ip_conntrack_chain;
-extern struct notifier_block *ip_conntrack_expect_chain;
-
-static inline int ip_conntrack_register_notifier(struct notifier_block *nb)
-{
-	return notifier_chain_register(&ip_conntrack_chain, nb);
-}
-
-static inline int ip_conntrack_unregister_notifier(struct notifier_block *nb)
-{
-	return notifier_chain_unregister(&ip_conntrack_chain, nb);
-}
-
-static inline int 
-ip_conntrack_expect_register_notifier(struct notifier_block *nb)
-{
-	return notifier_chain_register(&ip_conntrack_expect_chain, nb);
-}
-
-static inline int
-ip_conntrack_expect_unregister_notifier(struct notifier_block *nb)
-{
-	return notifier_chain_unregister(&ip_conntrack_expect_chain, nb);
-}
-
-extern void ip_ct_deliver_cached_events(const struct ip_conntrack *ct);
-extern void __ip_ct_event_cache_init(struct ip_conntrack *ct);
-
-static inline void 
-ip_conntrack_event_cache(enum ip_conntrack_events event,
-			 const struct sk_buff *skb)
-{
-	struct ip_conntrack *ct = (struct ip_conntrack *)skb->nfct;
-	struct ip_conntrack_ecache *ecache;
-	
-	local_bh_disable();
-	ecache = &__get_cpu_var(ip_conntrack_ecache);
-	if (ct != ecache->ct)
-		__ip_ct_event_cache_init(ct);
-	ecache->events |= event;
-	local_bh_enable();
-}
-
-static inline void ip_conntrack_event(enum ip_conntrack_events event,
-				      struct ip_conntrack *ct)
-{
-	if (is_confirmed(ct) && !is_dying(ct))
-		notifier_call_chain(&ip_conntrack_chain, event, ct);
-}
-
-static inline void 
-ip_conntrack_expect_event(enum ip_conntrack_expect_events event,
-			  struct ip_conntrack_expect *exp)
-{
-	notifier_call_chain(&ip_conntrack_expect_chain, event, exp);
-}
-#else /* CONFIG_IP_NF_CONNTRACK_EVENTS */
-static inline void ip_conntrack_event_cache(enum ip_conntrack_events event, 
-					    const struct sk_buff *skb) {}
-static inline void ip_conntrack_event(enum ip_conntrack_events event, 
-				      struct ip_conntrack *ct) {}
-static inline void ip_ct_deliver_cached_events(const struct ip_conntrack *ct) {}
-static inline void 
-ip_conntrack_expect_event(enum ip_conntrack_expect_events event, 
-			  struct ip_conntrack_expect *exp) {}
-#endif /* CONFIG_IP_NF_CONNTRACK_EVENTS */
-
 #ifdef CONFIG_IP_NF_NAT_NEEDED
 static inline int ip_nat_initialized(struct ip_conntrack *conntrack,
 				     enum ip_nat_manip_type manip)
diff --git a/trunk/include/linux/netfilter_ipv4/ip_conntrack_core.h b/trunk/include/linux/netfilter_ipv4/ip_conntrack_core.h
index dc4d2a0575de..694aec9b4784 100644
--- a/trunk/include/linux/netfilter_ipv4/ip_conntrack_core.h
+++ b/trunk/include/linux/netfilter_ipv4/ip_conntrack_core.h
@@ -2,9 +2,6 @@
 #define _IP_CONNTRACK_CORE_H
 #include <linux/netfilter.h>
 
-#define MAX_IP_CT_PROTO 256
-extern struct ip_conntrack_protocol *ip_ct_protos[MAX_IP_CT_PROTO];
-
 /* This header is used to share core functionality between the
    standalone connection tracking module, and the compatibility layer's use
    of connection tracking. */
@@ -41,19 +38,12 @@ extern int __ip_conntrack_confirm(struct sk_buff **pskb);
 /* Confirm a connection: returns NF_DROP if packet must be dropped. */
 static inline int ip_conntrack_confirm(struct sk_buff **pskb)
 {
-	struct ip_conntrack *ct = (struct ip_conntrack *)(*pskb)->nfct;
-	int ret = NF_ACCEPT;
-
-	if (ct) {
-		if (!is_confirmed(ct))
-			ret = __ip_conntrack_confirm(pskb);
-		ip_ct_deliver_cached_events(ct);
-	}
-	return ret;
+	if ((*pskb)->nfct
+	    && !is_confirmed((struct ip_conntrack *)(*pskb)->nfct))
+		return __ip_conntrack_confirm(pskb);
+	return NF_ACCEPT;
 }
 
-extern void __ip_ct_expect_unlink_destroy(struct ip_conntrack_expect *exp);
-
 extern struct list_head *ip_conntrack_hash;
 extern struct list_head ip_conntrack_expect_list;
 extern rwlock_t ip_conntrack_lock;
diff --git a/trunk/include/linux/netfilter_ipv4/ip_conntrack_helper.h b/trunk/include/linux/netfilter_ipv4/ip_conntrack_helper.h
index 8d69279ccfe4..3692daa93dec 100644
--- a/trunk/include/linux/netfilter_ipv4/ip_conntrack_helper.h
+++ b/trunk/include/linux/netfilter_ipv4/ip_conntrack_helper.h
@@ -24,8 +24,6 @@ struct ip_conntrack_helper
 	int (*help)(struct sk_buff **pskb,
 		    struct ip_conntrack *ct,
 		    enum ip_conntrack_info conntrackinfo);
-
-	int (*to_nfattr)(struct sk_buff *skb, const struct ip_conntrack *ct);
 };
 
 extern int ip_conntrack_helper_register(struct ip_conntrack_helper *);
diff --git a/trunk/include/linux/netfilter_ipv4/ip_conntrack_protocol.h b/trunk/include/linux/netfilter_ipv4/ip_conntrack_protocol.h
index b6b99be8632a..e20b57c5e1b7 100644
--- a/trunk/include/linux/netfilter_ipv4/ip_conntrack_protocol.h
+++ b/trunk/include/linux/netfilter_ipv4/ip_conntrack_protocol.h
@@ -2,7 +2,6 @@
 #ifndef _IP_CONNTRACK_PROTOCOL_H
 #define _IP_CONNTRACK_PROTOCOL_H
 #include <linux/netfilter_ipv4/ip_conntrack.h>
-#include <linux/netfilter/nfnetlink_conntrack.h>
 
 struct seq_file;
 
@@ -48,22 +47,22 @@ struct ip_conntrack_protocol
 	int (*error)(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 		     unsigned int hooknum);
 
-	/* convert protoinfo to nfnetink attributes */
-	int (*to_nfattr)(struct sk_buff *skb, struct nfattr *nfa,
-			 const struct ip_conntrack *ct);
-
-	int (*tuple_to_nfattr)(struct sk_buff *skb,
-			       const struct ip_conntrack_tuple *t);
-	int (*nfattr_to_tuple)(struct nfattr *tb[],
-			       struct ip_conntrack_tuple *t);
-
 	/* Module (if any) which this is connected to. */
 	struct module *me;
 };
 
+#define MAX_IP_CT_PROTO 256
+extern struct ip_conntrack_protocol *ip_ct_protos[MAX_IP_CT_PROTO];
+
 /* Protocol registration. */
 extern int ip_conntrack_protocol_register(struct ip_conntrack_protocol *proto);
 extern void ip_conntrack_protocol_unregister(struct ip_conntrack_protocol *proto);
+
+static inline struct ip_conntrack_protocol *ip_ct_find_proto(u_int8_t protocol)
+{
+	return ip_ct_protos[protocol];
+}
+
 /* Existing built-in protocols */
 extern struct ip_conntrack_protocol ip_conntrack_protocol_tcp;
 extern struct ip_conntrack_protocol ip_conntrack_protocol_udp;
@@ -74,11 +73,6 @@ extern int ip_conntrack_protocol_tcp_init(void);
 /* Log invalid packets */
 extern unsigned int ip_ct_log_invalid;
 
-extern int ip_ct_port_tuple_to_nfattr(struct sk_buff *,
-				      const struct ip_conntrack_tuple *);
-extern int ip_ct_port_nfattr_to_tuple(struct nfattr *tb[],
-				      struct ip_conntrack_tuple *);
-
 #ifdef CONFIG_SYSCTL
 #ifdef DEBUG_INVALID_PACKETS
 #define LOG_INVALID(proto) \
diff --git a/trunk/include/linux/netfilter_ipv4/ip_logging.h b/trunk/include/linux/netfilter_ipv4/ip_logging.h
new file mode 100644
index 000000000000..0c5c52cb6589
--- /dev/null
+++ b/trunk/include/linux/netfilter_ipv4/ip_logging.h
@@ -0,0 +1,20 @@
+/* IPv4 macros for the internal logging interface. */
+#ifndef __IP_LOGGING_H
+#define __IP_LOGGING_H
+
+#ifdef __KERNEL__
+#include <linux/socket.h>
+#include <linux/netfilter_logging.h>
+
+#define nf_log_ip_packet(pskb,hooknum,in,out,fmt,args...) \
+	nf_log_packet(AF_INET,pskb,hooknum,in,out,fmt,##args)
+
+#define nf_log_ip(pfh,len,fmt,args...) \
+	nf_log(AF_INET,pfh,len,fmt,##args)
+
+#define nf_ip_log_register(logging) nf_log_register(AF_INET,logging)
+#define nf_ip_log_unregister(logging) nf_log_unregister(AF_INET,logging)
+	
+#endif /*__KERNEL__*/
+
+#endif /*__IP_LOGGING_H*/
diff --git a/trunk/include/linux/netfilter_ipv4/ip_nat_protocol.h b/trunk/include/linux/netfilter_ipv4/ip_nat_protocol.h
index ef63aa991a06..129708c22386 100644
--- a/trunk/include/linux/netfilter_ipv4/ip_nat_protocol.h
+++ b/trunk/include/linux/netfilter_ipv4/ip_nat_protocol.h
@@ -4,9 +4,6 @@
 #include <linux/init.h>
 #include <linux/list.h>
 
-#include <linux/netfilter_ipv4/ip_nat.h>
-#include <linux/netfilter/nfnetlink_conntrack.h>
-
 struct iphdr;
 struct ip_nat_range;
 
@@ -18,8 +15,6 @@ struct ip_nat_protocol
 	/* Protocol number. */
 	unsigned int protonum;
 
-	struct module *me;
-
 	/* Translate a packet to the target according to manip type.
 	   Return true if succeeded. */
 	int (*manip_pkt)(struct sk_buff **pskb,
@@ -48,20 +43,19 @@ struct ip_nat_protocol
 
 	unsigned int (*print_range)(char *buffer,
 				    const struct ip_nat_range *range);
-
-	int (*range_to_nfattr)(struct sk_buff *skb,
-			       const struct ip_nat_range *range);
-
-	int (*nfattr_to_range)(struct nfattr *tb[],
-			       struct ip_nat_range *range);
 };
 
+#define MAX_IP_NAT_PROTO 256
+extern struct ip_nat_protocol *ip_nat_protos[MAX_IP_NAT_PROTO];
+
 /* Protocol registration. */
 extern int ip_nat_protocol_register(struct ip_nat_protocol *proto);
 extern void ip_nat_protocol_unregister(struct ip_nat_protocol *proto);
 
-extern struct ip_nat_protocol *ip_nat_proto_find_get(u_int8_t protocol);
-extern void ip_nat_proto_put(struct ip_nat_protocol *proto);
+static inline struct ip_nat_protocol *ip_nat_find_proto(u_int8_t protocol)
+{
+	return ip_nat_protos[protocol];
+}
 
 /* Built-in protocols. */
 extern struct ip_nat_protocol ip_nat_protocol_tcp;
@@ -73,9 +67,4 @@ extern int init_protocols(void) __init;
 extern void cleanup_protocols(void);
 extern struct ip_nat_protocol *find_nat_proto(u_int16_t protonum);
 
-extern int ip_nat_port_range_to_nfattr(struct sk_buff *skb,
-				       const struct ip_nat_range *range);
-extern int ip_nat_port_nfattr_to_range(struct nfattr *tb[],
-				       struct ip_nat_range *range);
-
 #endif /*_IP_NAT_PROTO_H*/
diff --git a/trunk/include/linux/netfilter_ipv4/ip_tables.h b/trunk/include/linux/netfilter_ipv4/ip_tables.h
index d19d65cf4530..12ce47808e7d 100644
--- a/trunk/include/linux/netfilter_ipv4/ip_tables.h
+++ b/trunk/include/linux/netfilter_ipv4/ip_tables.h
@@ -109,8 +109,7 @@ struct ipt_counters
 
 /* Values for "flag" field in struct ipt_ip (general ip structure). */
 #define IPT_F_FRAG		0x01	/* Set if rule is a fragment rule */
-#define IPT_F_GOTO		0x02	/* Set if jump is a goto */
-#define IPT_F_MASK		0x03	/* All possible flag bits mask. */
+#define IPT_F_MASK		0x01	/* All possible flag bits mask. */
 
 /* Values for "inv" field in struct ipt_ip. */
 #define IPT_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
diff --git a/trunk/include/linux/netfilter_ipv4/ipt_LOG.h b/trunk/include/linux/netfilter_ipv4/ipt_LOG.h
index 22d16177319b..d25f782e57d1 100644
--- a/trunk/include/linux/netfilter_ipv4/ipt_LOG.h
+++ b/trunk/include/linux/netfilter_ipv4/ipt_LOG.h
@@ -1,7 +1,6 @@
 #ifndef _IPT_LOG_H
 #define _IPT_LOG_H
 
-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */
 #define IPT_LOG_TCPSEQ		0x01	/* Log TCP sequence numbers */
 #define IPT_LOG_TCPOPT		0x02	/* Log TCP options */
 #define IPT_LOG_IPOPT		0x04	/* Log IP options */
diff --git a/trunk/include/linux/netfilter_ipv4/ipt_NFQUEUE.h b/trunk/include/linux/netfilter_ipv4/ipt_NFQUEUE.h
deleted file mode 100644
index b5b2943b0c66..000000000000
--- a/trunk/include/linux/netfilter_ipv4/ipt_NFQUEUE.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/* iptables module for using NFQUEUE mechanism
- *
- * (C) 2005 Harald Welte <laforge@netfilter.org>
- *
- * This software is distributed under GNU GPL v2, 1991
- * 
-*/
-#ifndef _IPT_NFQ_TARGET_H
-#define _IPT_NFQ_TARGET_H
-
-/* target info */
-struct ipt_NFQ_info {
-	u_int16_t queuenum;
-};
-
-#endif /* _IPT_DSCP_TARGET_H */
diff --git a/trunk/include/linux/netfilter_ipv4/ipt_TTL.h b/trunk/include/linux/netfilter_ipv4/ipt_TTL.h
deleted file mode 100644
index ee6611edc112..000000000000
--- a/trunk/include/linux/netfilter_ipv4/ipt_TTL.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* TTL modification module for IP tables
- * (C) 2000 by Harald Welte <laforge@netfilter.org> */
-
-#ifndef _IPT_TTL_H
-#define _IPT_TTL_H
-
-enum {
-	IPT_TTL_SET = 0,
-	IPT_TTL_INC,
-	IPT_TTL_DEC
-};
-
-#define IPT_TTL_MAXMODE	IPT_TTL_DEC
-
-struct ipt_TTL_info {
-	u_int8_t	mode;
-	u_int8_t	ttl;
-};
-
-
-#endif
diff --git a/trunk/include/linux/netfilter_ipv4/ipt_connbytes.h b/trunk/include/linux/netfilter_ipv4/ipt_connbytes.h
deleted file mode 100644
index 9e5532f8d8ac..000000000000
--- a/trunk/include/linux/netfilter_ipv4/ipt_connbytes.h
+++ /dev/null
@@ -1,25 +0,0 @@
-#ifndef _IPT_CONNBYTES_H
-#define _IPT_CONNBYTES_H
-
-enum ipt_connbytes_what {
-	IPT_CONNBYTES_PKTS,
-	IPT_CONNBYTES_BYTES,
-	IPT_CONNBYTES_AVGPKT,
-};
-
-enum ipt_connbytes_direction {
-	IPT_CONNBYTES_DIR_ORIGINAL,
-	IPT_CONNBYTES_DIR_REPLY,
-	IPT_CONNBYTES_DIR_BOTH,
-};
-
-struct ipt_connbytes_info
-{
-	struct {
-		aligned_u64 from;	/* count to be matched */
-		aligned_u64 to;		/* count to be matched */
-	} count;
-	u_int8_t what;		/* ipt_connbytes_what */
-	u_int8_t direction;	/* ipt_connbytes_direction */
-};
-#endif
diff --git a/trunk/include/linux/netfilter_ipv4/ipt_dccp.h b/trunk/include/linux/netfilter_ipv4/ipt_dccp.h
deleted file mode 100644
index 3cb3a522e62b..000000000000
--- a/trunk/include/linux/netfilter_ipv4/ipt_dccp.h
+++ /dev/null
@@ -1,23 +0,0 @@
-#ifndef _IPT_DCCP_H_
-#define _IPT_DCCP_H_
-
-#define IPT_DCCP_SRC_PORTS	        0x01
-#define IPT_DCCP_DEST_PORTS	        0x02
-#define IPT_DCCP_TYPE			0x04
-#define IPT_DCCP_OPTION			0x08
-
-#define IPT_DCCP_VALID_FLAGS		0x0f
-
-struct ipt_dccp_info {
-	u_int16_t dpts[2];  /* Min, Max */
-	u_int16_t spts[2];  /* Min, Max */
-
-	u_int16_t flags;
-	u_int16_t invflags;
-
-	u_int16_t typemask;
-	u_int8_t option;
-};
-
-#endif /* _IPT_DCCP_H_ */
-
diff --git a/trunk/include/linux/netfilter_ipv4/ipt_string.h b/trunk/include/linux/netfilter_ipv4/ipt_string.h
deleted file mode 100644
index a265f6e44eab..000000000000
--- a/trunk/include/linux/netfilter_ipv4/ipt_string.h
+++ /dev/null
@@ -1,18 +0,0 @@
-#ifndef _IPT_STRING_H
-#define _IPT_STRING_H
-
-#define IPT_STRING_MAX_PATTERN_SIZE 128
-#define IPT_STRING_MAX_ALGO_NAME_SIZE 16
-
-struct ipt_string_info
-{
-	u_int16_t from_offset;
-	u_int16_t to_offset;
-	char	  algo[IPT_STRING_MAX_ALGO_NAME_SIZE];
-	char 	  pattern[IPT_STRING_MAX_PATTERN_SIZE];
-	u_int8_t  patlen;
-	u_int8_t  invert;
-	struct ts_config __attribute__((aligned(8))) *config;
-};
-
-#endif /*_IPT_STRING_H*/
diff --git a/trunk/include/linux/netfilter_ipv6.h b/trunk/include/linux/netfilter_ipv6.h
index edcc2c6eb5c7..bee7a5ec7c66 100644
--- a/trunk/include/linux/netfilter_ipv6.h
+++ b/trunk/include/linux/netfilter_ipv6.h
@@ -10,8 +10,6 @@
 
 #include <linux/netfilter.h>
 
-/* only for userspace compatibility */
-#ifndef __KERNEL__
 /* IP Cache bits. */
 /* Src IP address. */
 #define NFC_IP6_SRC              0x0001
@@ -40,7 +38,6 @@
 #define NFC_IP6_DST_PT           0x0400
 /* Something else about the proto */
 #define NFC_IP6_PROTO_UNKNOWN    0x2000
-#endif /* ! __KERNEL__ */
 
 
 /* IP6 Hooks */
@@ -71,7 +68,4 @@ enum nf_ip6_hook_priorities {
 	NF_IP6_PRI_LAST = INT_MAX,
 };
 
-extern int ipv6_netfilter_init(void);
-extern void ipv6_netfilter_fini(void);
-
 #endif /*__LINUX_IP6_NETFILTER_H*/
diff --git a/trunk/include/linux/netfilter_ipv6/ip6_logging.h b/trunk/include/linux/netfilter_ipv6/ip6_logging.h
new file mode 100644
index 000000000000..a0b2ee3043aa
--- /dev/null
+++ b/trunk/include/linux/netfilter_ipv6/ip6_logging.h
@@ -0,0 +1,20 @@
+/* IPv6 macros for the nternal logging interface. */
+#ifndef __IP6_LOGGING_H
+#define __IP6_LOGGING_H
+
+#ifdef __KERNEL__
+#include <linux/socket.h>
+#include <linux/netfilter_logging.h>
+
+#define nf_log_ip6_packet(pskb,hooknum,in,out,fmt,args...) \
+	nf_log_packet(AF_INET6,pskb,hooknum,in,out,fmt,##args)
+
+#define nf_log_ip6(pfh,len,fmt,args...) \
+	nf_log(AF_INET6,pfh,len,fmt,##args)
+
+#define nf_ip6_log_register(logging) nf_log_register(AF_INET6,logging)
+#define nf_ip6_log_unregister(logging) nf_log_unregister(AF_INET6,logging)
+	
+#endif /*__KERNEL__*/
+
+#endif /*__IP6_LOGGING_H*/
diff --git a/trunk/include/linux/netfilter_ipv6/ip6_tables.h b/trunk/include/linux/netfilter_ipv6/ip6_tables.h
index 58c72a52dc65..f1ce3b009853 100644
--- a/trunk/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/trunk/include/linux/netfilter_ipv6/ip6_tables.h
@@ -111,8 +111,7 @@ struct ip6t_counters
 #define IP6T_F_PROTO		0x01	/* Set if rule cares about upper 
 					   protocols */
 #define IP6T_F_TOS		0x02	/* Match the TOS. */
-#define IP6T_F_GOTO		0x04	/* Set if jump is a goto */
-#define IP6T_F_MASK		0x07	/* All possible flag bits mask. */
+#define IP6T_F_MASK		0x03	/* All possible flag bits mask. */
 
 /* Values for "inv" field in struct ip6t_ip6. */
 #define IP6T_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
diff --git a/trunk/include/linux/netfilter_ipv6/ip6t_HL.h b/trunk/include/linux/netfilter_ipv6/ip6t_HL.h
deleted file mode 100644
index afb7813d45ab..000000000000
--- a/trunk/include/linux/netfilter_ipv6/ip6t_HL.h
+++ /dev/null
@@ -1,22 +0,0 @@
-/* Hop Limit modification module for ip6tables
- * Maciej Soltysiak <solt@dns.toxicfilms.tv>
- * Based on HW's TTL module */
-
-#ifndef _IP6T_HL_H
-#define _IP6T_HL_H
-
-enum {
-	IP6T_HL_SET = 0,
-	IP6T_HL_INC,
-	IP6T_HL_DEC
-};
-
-#define IP6T_HL_MAXMODE	IP6T_HL_DEC
-
-struct ip6t_HL_info {
-	u_int8_t	mode;
-	u_int8_t	hop_limit;
-};
-
-
-#endif
diff --git a/trunk/include/linux/netfilter_ipv6/ip6t_LOG.h b/trunk/include/linux/netfilter_ipv6/ip6t_LOG.h
index 9008ff5c40ae..42996a43bb39 100644
--- a/trunk/include/linux/netfilter_ipv6/ip6t_LOG.h
+++ b/trunk/include/linux/netfilter_ipv6/ip6t_LOG.h
@@ -1,7 +1,6 @@
 #ifndef _IP6T_LOG_H
 #define _IP6T_LOG_H
 
-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */
 #define IP6T_LOG_TCPSEQ		0x01	/* Log TCP sequence numbers */
 #define IP6T_LOG_TCPOPT		0x02	/* Log TCP options */
 #define IP6T_LOG_IPOPT		0x04	/* Log IP options */
diff --git a/trunk/include/linux/netfilter_ipv6/ip6t_REJECT.h b/trunk/include/linux/netfilter_ipv6/ip6t_REJECT.h
deleted file mode 100644
index 6be6504162bb..000000000000
--- a/trunk/include/linux/netfilter_ipv6/ip6t_REJECT.h
+++ /dev/null
@@ -1,18 +0,0 @@
-#ifndef _IP6T_REJECT_H
-#define _IP6T_REJECT_H
-
-enum ip6t_reject_with {
-	IP6T_ICMP6_NO_ROUTE,
-	IP6T_ICMP6_ADM_PROHIBITED,
-	IP6T_ICMP6_NOT_NEIGHBOUR,
-	IP6T_ICMP6_ADDR_UNREACH,
-	IP6T_ICMP6_PORT_UNREACH,
-	IP6T_ICMP6_ECHOREPLY,
-	IP6T_TCP_RESET
-};
-
-struct ip6t_reject_info {
-	u_int32_t	with;	/* reject type */
-};
-
-#endif /*_IP6T_REJECT_H*/
diff --git a/trunk/include/linux/netlink.h b/trunk/include/linux/netlink.h
index 167518668936..6552b71bfa73 100644
--- a/trunk/include/linux/netlink.h
+++ b/trunk/include/linux/netlink.h
@@ -8,7 +8,7 @@
 #define NETLINK_W1		1	/* 1-wire subsystem				*/
 #define NETLINK_USERSOCK	2	/* Reserved for user mode socket protocols 	*/
 #define NETLINK_FIREWALL	3	/* Firewalling hook				*/
-#define NETLINK_INET_DIAG	4	/* INET socket monitoring			*/
+#define NETLINK_TCPDIAG		4	/* TCP socket monitoring			*/
 #define NETLINK_NFLOG		5	/* netfilter/iptables ULOG */
 #define NETLINK_XFRM		6	/* ipsec */
 #define NETLINK_SELINUX		7	/* SELinux event notifications */
@@ -90,15 +90,6 @@ struct nlmsgerr
 	struct nlmsghdr msg;
 };
 
-#define NETLINK_ADD_MEMBERSHIP	1
-#define NETLINK_DROP_MEMBERSHIP	2
-#define NETLINK_PKTINFO		3
-
-struct nl_pktinfo
-{
-	__u32	group;
-};
-
 #define NET_MAJOR 36		/* Major 36 is reserved for networking 						*/
 
 enum {
@@ -115,8 +106,9 @@ struct netlink_skb_parms
 {
 	struct ucred		creds;		/* Skb credentials	*/
 	__u32			pid;
+	__u32			groups;
 	__u32			dst_pid;
-	__u32			dst_group;
+	__u32			dst_groups;
 	kernel_cap_t		eff_cap;
 	__u32			loginuid;	/* Login (audit) uid */
 };
@@ -125,11 +117,11 @@ struct netlink_skb_parms
 #define NETLINK_CREDS(skb)	(&NETLINK_CB((skb)).creds)
 
 
-extern struct sock *netlink_kernel_create(int unit, unsigned int groups, void (*input)(struct sock *sk, int len), struct module *module);
+extern struct sock *netlink_kernel_create(int unit, void (*input)(struct sock *sk, int len));
 extern void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err);
 extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 pid, int nonblock);
 extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 pid,
-			     __u32 group, unsigned int __nocast allocation);
+			     __u32 group, int allocation);
 extern void netlink_set_err(struct sock *ssk, __u32 pid, __u32 group, int code);
 extern int netlink_register_notifier(struct notifier_block *nb);
 extern int netlink_unregister_notifier(struct notifier_block *nb);
diff --git a/trunk/include/linux/pci_ids.h b/trunk/include/linux/pci_ids.h
index d513c1634006..499a5325f67f 100644
--- a/trunk/include/linux/pci_ids.h
+++ b/trunk/include/linux/pci_ids.h
@@ -2145,7 +2145,6 @@
 #define PCI_DEVICE_ID_ENE_1225		0x1225
 #define PCI_DEVICE_ID_ENE_1410		0x1410
 #define PCI_DEVICE_ID_ENE_1420		0x1420
-#define PCI_VENDOR_ID_CHELSIO		0x1425
 
 #define PCI_VENDOR_ID_SYBA		0x1592
 #define PCI_DEVICE_ID_SYBA_2P_EPP	0x0782
diff --git a/trunk/include/linux/random.h b/trunk/include/linux/random.h
index 7b2adb3322d5..cc6703449916 100644
--- a/trunk/include/linux/random.h
+++ b/trunk/include/linux/random.h
@@ -59,8 +59,6 @@ extern __u32 secure_tcp_sequence_number(__u32 saddr, __u32 daddr,
 					__u16 sport, __u16 dport);
 extern __u32 secure_tcpv6_sequence_number(__u32 *saddr, __u32 *daddr,
 					  __u16 sport, __u16 dport);
-extern u64 secure_dccp_sequence_number(__u32 saddr, __u32 daddr,
-				       __u16 sport, __u16 dport);
 
 #ifndef MODULE
 extern struct file_operations random_fops, urandom_fops;
diff --git a/trunk/include/linux/rtnetlink.h b/trunk/include/linux/rtnetlink.h
index c231e9a08f0b..657c05ab8f9e 100644
--- a/trunk/include/linux/rtnetlink.h
+++ b/trunk/include/linux/rtnetlink.h
@@ -826,8 +826,9 @@ enum
 #define TCA_RTA(r)  ((struct rtattr*)(((char*)(r)) + NLMSG_ALIGN(sizeof(struct tcmsg))))
 #define TCA_PAYLOAD(n) NLMSG_PAYLOAD(n,sizeof(struct tcmsg))
 
-#ifndef __KERNEL__
-/* RTnetlink multicast groups - backwards compatibility for userspace */
+
+/* RTnetlink multicast groups */
+
 #define RTMGRP_LINK		1
 #define RTMGRP_NOTIFY		2
 #define RTMGRP_NEIGH		4
@@ -846,43 +847,6 @@ enum
 #define RTMGRP_DECnet_ROUTE     0x4000
 
 #define RTMGRP_IPV6_PREFIX	0x20000
-#endif
-
-/* RTnetlink multicast groups */
-enum rtnetlink_groups {
-	RTNLGRP_NONE,
-#define RTNLGRP_NONE		RTNLGRP_NONE
-	RTNLGRP_LINK,
-#define RTNLGRP_LINK		RTNLGRP_LINK
-	RTNLGRP_NOTIFY,
-#define RTNLGRP_NOTIFY		RTNLGRP_NOTIFY
-	RTNLGRP_NEIGH,
-#define RTNLGRP_NEIGH		RTNLGRP_NEIGH
-	RTNLGRP_TC,
-#define RTNLGRP_TC		RTNLGRP_TC
-	RTNLGRP_IPV4_IFADDR,
-#define RTNLGRP_IPV4_IFADDR	RTNLGRP_IPV4_IFADDR
-	RTNLGRP_IPV4_MROUTE,
-#define	RTNLGRP_IPV4_MROUTE	RTNLGRP_IPV4_MROUTE
-	RTNLGRP_IPV4_ROUTE,
-#define RTNLGRP_IPV4_ROUTE	RTNLGRP_IPV4_ROUTE
-	RTNLGRP_IPV6_IFADDR,
-#define RTNLGRP_IPV6_IFADDR	RTNLGRP_IPV6_IFADDR
-	RTNLGRP_IPV6_MROUTE,
-#define RTNLGRP_IPV6_MROUTE	RTNLGRP_IPV6_MROUTE
-	RTNLGRP_IPV6_ROUTE,
-#define RTNLGRP_IPV6_ROUTE	RTNLGRP_IPV6_ROUTE
-	RTNLGRP_IPV6_IFINFO,
-#define RTNLGRP_IPV6_IFINFO	RTNLGRP_IPV6_IFINFO
-	RTNLGRP_DECnet_IFADDR,
-#define RTNLGRP_DECnet_IFADDR	RTNLGRP_DECnet_IFADDR
-	RTNLGRP_DECnet_ROUTE,
-#define RTNLGRP_DECnet_ROUTE	RTNLGRP_DECnet_ROUTE
-	RTNLGRP_IPV6_PREFIX,
-#define RTNLGRP_IPV6_PREFIX	RTNLGRP_IPV6_PREFIX
-	__RTNLGRP_MAX
-};
-#define RTNLGRP_MAX	(__RTNLGRP_MAX - 1)
 
 /* TC action piece */
 struct tcamsg
diff --git a/trunk/include/linux/security.h b/trunk/include/linux/security.h
index 7aab6ab7c57f..b42095a68b1c 100644
--- a/trunk/include/linux/security.h
+++ b/trunk/include/linux/security.h
@@ -2727,8 +2727,7 @@ static inline int security_socket_getpeersec(struct socket *sock, char __user *o
 	return security_ops->socket_getpeersec(sock, optval, optlen, len);
 }
 
-static inline int security_sk_alloc(struct sock *sk, int family,
-				    unsigned int __nocast priority)
+static inline int security_sk_alloc(struct sock *sk, int family, int priority)
 {
 	return security_ops->sk_alloc_security(sk, family, priority);
 }
@@ -2845,8 +2844,7 @@ static inline int security_socket_getpeersec(struct socket *sock, char __user *o
 	return -ENOPROTOOPT;
 }
 
-static inline int security_sk_alloc(struct sock *sk, int family,
-				    unsigned int __nocast priority)
+static inline int security_sk_alloc(struct sock *sk, int family, int priority)
 {
 	return 0;
 }
diff --git a/trunk/include/linux/selinux_netlink.h b/trunk/include/linux/selinux_netlink.h
index bbf489decd84..957e6ebca4e6 100644
--- a/trunk/include/linux/selinux_netlink.h
+++ b/trunk/include/linux/selinux_netlink.h
@@ -20,21 +20,10 @@ enum {
 	SELNL_MSG_MAX
 };
 
-#ifndef __KERNEL__
-/* Multicast groups - backwards compatiblility for userspace */
+/* Multicast groups */
 #define SELNL_GRP_NONE		0x00000000
 #define SELNL_GRP_AVC		0x00000001	/* AVC notifications */
 #define SELNL_GRP_ALL		0xffffffff
-#endif
-
-enum selinux_nlgroups {
-	SELNLGRP_NONE,
-#define SELNLGRP_NONE	SELNLGRP_NONE
-	SELNLGRP_AVC,
-#define SELNLGRP_AVC	SELNLGRP_AVC
-	__SELNLGRP_MAX
-};
-#define SELNLGRP_MAX	(__SELNLGRP_MAX - 1)
 
 /* Message structures */
 struct selnl_msg_setenforce {
diff --git a/trunk/include/linux/skbuff.h b/trunk/include/linux/skbuff.h
index 42edce6abe23..948527e42a60 100644
--- a/trunk/include/linux/skbuff.h
+++ b/trunk/include/linux/skbuff.h
@@ -155,29 +155,16 @@ struct skb_shared_info {
 #define SKB_DATAREF_SHIFT 16
 #define SKB_DATAREF_MASK ((1 << SKB_DATAREF_SHIFT) - 1)
 
-extern struct timeval skb_tv_base;
-
-struct skb_timeval {
-	u32	off_sec;
-	u32	off_usec;
-};
-
-
-enum {
-	SKB_FCLONE_UNAVAILABLE,
-	SKB_FCLONE_ORIG,
-	SKB_FCLONE_CLONE,
-};
-
 /** 
  *	struct sk_buff - socket buffer
  *	@next: Next buffer in list
  *	@prev: Previous buffer in list
  *	@list: List we are on
  *	@sk: Socket we are owned by
- *	@tstamp: Time we arrived stored as offset to skb_tv_base
+ *	@stamp: Time we arrived
  *	@dev: Device we arrived on/are leaving by
  *	@input_dev: Device we arrived on
+ *      @real_dev: The real device we are using
  *	@h: Transport layer header
  *	@nh: Network layer header
  *	@mac: Link layer header
@@ -203,11 +190,14 @@ enum {
  *	@end: End pointer
  *	@destructor: Destruct function
  *	@nfmark: Can be used for communication between hooks
+ *	@nfcache: Cache info
  *	@nfct: Associated connection, if any
  *	@nfctinfo: Relationship of this skb to the connection
  *	@nf_bridge: Saved data about a bridged frame - see br_netfilter.c
+ *      @private: Data which is private to the HIPPI implementation
  *	@tc_index: Traffic control index
  *	@tc_verd: traffic control verdict
+ *	@tc_classid: traffic control classid
  */
 
 struct sk_buff {
@@ -215,10 +205,12 @@ struct sk_buff {
 	struct sk_buff		*next;
 	struct sk_buff		*prev;
 
+	struct sk_buff_head	*list;
 	struct sock		*sk;
-	struct skb_timeval	tstamp;
+	struct timeval		stamp;
 	struct net_device	*dev;
 	struct net_device	*input_dev;
+	struct net_device	*real_dev;
 
 	union {
 		struct tcphdr	*th;
@@ -260,28 +252,33 @@ struct sk_buff {
 	__u8			local_df:1,
 				cloned:1,
 				ip_summed:2,
-				nohdr:1,
-				nfctinfo:3;
-	__u8			pkt_type:3,
-				fclone:2;
+				nohdr:1;
+				/* 3 bits spare */
+	__u8			pkt_type;
 	__be16			protocol;
 
 	void			(*destructor)(struct sk_buff *skb);
 #ifdef CONFIG_NETFILTER
-	__u32			nfmark;
+	unsigned long		nfmark;
+	__u32			nfcache;
+	__u32			nfctinfo;
 	struct nf_conntrack	*nfct;
-#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
-	__u8			ipvs_property:1;
-#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
 	struct nf_bridge_info	*nf_bridge;
 #endif
 #endif /* CONFIG_NETFILTER */
+#if defined(CONFIG_HIPPI)
+	union {
+		__u32		ifield;
+	} private;
+#endif
 #ifdef CONFIG_NET_SCHED
-	__u16			tc_index;	/* traffic control index */
+       __u32			tc_index;        /* traffic control index */
 #ifdef CONFIG_NET_CLS_ACT
-	__u16			tc_verd;	/* traffic control verdict */
+	__u32           tc_verd;               /* traffic control verdict */
+	__u32           tc_classid;            /* traffic control classid */
 #endif
+
 #endif
 
 
@@ -303,20 +300,8 @@ struct sk_buff {
 #include <asm/system.h>
 
 extern void	       __kfree_skb(struct sk_buff *skb);
-extern struct sk_buff *__alloc_skb(unsigned int size,
-				   unsigned int __nocast priority, int fclone);
-static inline struct sk_buff *alloc_skb(unsigned int size,
-					unsigned int __nocast priority)
-{
-	return __alloc_skb(size, priority, 0);
-}
-
-static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
-					       unsigned int __nocast priority)
-{
-	return __alloc_skb(size, priority, 1);
-}
-
+extern struct sk_buff *alloc_skb(unsigned int size,
+				 unsigned int __nocast priority);
 extern struct sk_buff *alloc_skb_from_cache(kmem_cache_t *cp,
 					    unsigned int size,
 					    unsigned int __nocast priority);
@@ -612,6 +597,7 @@ static inline void __skb_queue_head(struct sk_buff_head *list,
 {
 	struct sk_buff *prev, *next;
 
+	newsk->list = list;
 	list->qlen++;
 	prev = (struct sk_buff *)list;
 	next = prev->next;
@@ -636,6 +622,7 @@ static inline void __skb_queue_tail(struct sk_buff_head *list,
 {
 	struct sk_buff *prev, *next;
 
+	newsk->list = list;
 	list->qlen++;
 	next = (struct sk_buff *)list;
 	prev = next->prev;
@@ -668,6 +655,7 @@ static inline struct sk_buff *__skb_dequeue(struct sk_buff_head *list)
 		next->prev   = prev;
 		prev->next   = next;
 		result->next = result->prev = NULL;
+		result->list = NULL;
 	}
 	return result;
 }
@@ -676,7 +664,7 @@ static inline struct sk_buff *__skb_dequeue(struct sk_buff_head *list)
 /*
  *	Insert a packet on a list.
  */
-extern void        skb_insert(struct sk_buff *old, struct sk_buff *newsk, struct sk_buff_head *list);
+extern void        skb_insert(struct sk_buff *old, struct sk_buff *newsk);
 static inline void __skb_insert(struct sk_buff *newsk,
 				struct sk_buff *prev, struct sk_buff *next,
 				struct sk_buff_head *list)
@@ -684,23 +672,24 @@ static inline void __skb_insert(struct sk_buff *newsk,
 	newsk->next = next;
 	newsk->prev = prev;
 	next->prev  = prev->next = newsk;
+	newsk->list = list;
 	list->qlen++;
 }
 
 /*
  *	Place a packet after a given packet in a list.
  */
-extern void	   skb_append(struct sk_buff *old, struct sk_buff *newsk, struct sk_buff_head *list);
-static inline void __skb_append(struct sk_buff *old, struct sk_buff *newsk, struct sk_buff_head *list)
+extern void	   skb_append(struct sk_buff *old, struct sk_buff *newsk);
+static inline void __skb_append(struct sk_buff *old, struct sk_buff *newsk)
 {
-	__skb_insert(newsk, old, old->next, list);
+	__skb_insert(newsk, old, old->next, old->list);
 }
 
 /*
  * remove sk_buff from list. _Must_ be called atomically, and with
  * the list known..
  */
-extern void	   skb_unlink(struct sk_buff *skb, struct sk_buff_head *list);
+extern void	   skb_unlink(struct sk_buff *skb);
 static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
 {
 	struct sk_buff *next, *prev;
@@ -709,6 +698,7 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
 	next	   = skb->next;
 	prev	   = skb->prev;
 	skb->next  = skb->prev = NULL;
+	skb->list  = NULL;
 	next->prev = prev;
 	prev->next = next;
 }
@@ -1223,8 +1213,6 @@ extern void	       skb_copy_and_csum_dev(const struct sk_buff *skb, u8 *to);
 extern void	       skb_split(struct sk_buff *skb,
 				 struct sk_buff *skb1, const u32 len);
 
-extern void	       skb_release_data(struct sk_buff *skb);
-
 static inline void *skb_header_pointer(const struct sk_buff *skb, int offset,
 				       int len, void *buffer)
 {
@@ -1242,42 +1230,6 @@ static inline void *skb_header_pointer(const struct sk_buff *skb, int offset,
 extern void skb_init(void);
 extern void skb_add_mtu(int mtu);
 
-/**
- *	skb_get_timestamp - get timestamp from a skb
- *	@skb: skb to get stamp from
- *	@stamp: pointer to struct timeval to store stamp in
- *
- *	Timestamps are stored in the skb as offsets to a base timestamp.
- *	This function converts the offset back to a struct timeval and stores
- *	it in stamp.
- */
-static inline void skb_get_timestamp(struct sk_buff *skb, struct timeval *stamp)
-{
-	stamp->tv_sec  = skb->tstamp.off_sec;
-	stamp->tv_usec = skb->tstamp.off_usec;
-	if (skb->tstamp.off_sec) {
-		stamp->tv_sec  += skb_tv_base.tv_sec;
-		stamp->tv_usec += skb_tv_base.tv_usec;
-	}
-}
-
-/**
- * 	skb_set_timestamp - set timestamp of a skb
- *	@skb: skb to set stamp of
- *	@stamp: pointer to struct timeval to get stamp from
- *
- *	Timestamps are stored in the skb as offsets to a base timestamp.
- *	This function converts a struct timeval to an offset and stores
- *	it in the skb.
- */
-static inline void skb_set_timestamp(struct sk_buff *skb, struct timeval *stamp)
-{
-	skb->tstamp.off_sec  = stamp->tv_sec - skb_tv_base.tv_sec;
-	skb->tstamp.off_usec = stamp->tv_usec - skb_tv_base.tv_usec;
-}
-
-extern void __net_timestamp(struct sk_buff *skb);
-
 #ifdef CONFIG_NETFILTER
 static inline void nf_conntrack_put(struct nf_conntrack *nfct)
 {
diff --git a/trunk/include/linux/socket.h b/trunk/include/linux/socket.h
index 1739c2d5b95b..a5c7d96e4d2e 100644
--- a/trunk/include/linux/socket.h
+++ b/trunk/include/linux/socket.h
@@ -26,13 +26,6 @@ struct __kernel_sockaddr_storage {
 #include <linux/types.h>		/* pid_t			*/
 #include <linux/compiler.h>		/* __user			*/
 
-extern int sysctl_somaxconn;
-extern void sock_init(void);
-#ifdef CONFIG_PROC_FS
-struct seq_file;
-extern void socket_seq_show(struct seq_file *seq);
-#endif
-
 typedef unsigned short	sa_family_t;
 
 /*
@@ -278,8 +271,6 @@ struct ucred {
 #define SOL_IRDA        266
 #define SOL_NETBEUI	267
 #define SOL_LLC		268
-#define SOL_DCCP	269
-#define SOL_NETLINK	270
 
 /* IPX options */
 #define IPX_TYPE	1
diff --git a/trunk/include/linux/sound.h b/trunk/include/linux/sound.h
index 72b9af4c3fd4..428f59794f48 100644
--- a/trunk/include/linux/sound.h
+++ b/trunk/include/linux/sound.h
@@ -29,9 +29,7 @@
  *	Sound core interface functions
  */
  
-struct device;
 extern int register_sound_special(struct file_operations *fops, int unit);
-extern int register_sound_special_device(struct file_operations *fops, int unit, struct device *dev);
 extern int register_sound_mixer(struct file_operations *fops, int dev);
 extern int register_sound_midi(struct file_operations *fops, int dev);
 extern int register_sound_dsp(struct file_operations *fops, int dev);
diff --git a/trunk/include/linux/tcp.h b/trunk/include/linux/tcp.h
index ac4ca44c75ca..e4fd82e42104 100644
--- a/trunk/include/linux/tcp.h
+++ b/trunk/include/linux/tcp.h
@@ -55,6 +55,24 @@ struct tcphdr {
 	__u16	urg_ptr;
 };
 
+
+enum {
+  TCP_ESTABLISHED = 1,
+  TCP_SYN_SENT,
+  TCP_SYN_RECV,
+  TCP_FIN_WAIT1,
+  TCP_FIN_WAIT2,
+  TCP_TIME_WAIT,
+  TCP_CLOSE,
+  TCP_CLOSE_WAIT,
+  TCP_LAST_ACK,
+  TCP_LISTEN,
+  TCP_CLOSING,	 /* now a valid state */
+
+  TCP_MAX_STATES /* Leave at the end! */
+};
+
+#define TCP_STATE_MASK	0xF
 #define TCP_ACTION_FIN	(1 << 7)
 
 enum {
@@ -177,9 +195,8 @@ struct tcp_info
 
 #include <linux/config.h>
 #include <linux/skbuff.h>
+#include <linux/ip.h>
 #include <net/sock.h>
-#include <net/inet_connection_sock.h>
-#include <net/inet_timewait_sock.h>
 
 /* This defines a selective acknowledgement block. */
 struct tcp_sack_block {
@@ -219,8 +236,8 @@ static inline struct tcp_request_sock *tcp_rsk(const struct request_sock *req)
 }
 
 struct tcp_sock {
-	/* inet_connection_sock has to be the first member of tcp_sock */
-	struct inet_connection_sock	inet_conn;
+	/* inet_sock has to be the first member of tcp_sock */
+	struct inet_sock	inet;
 	int	tcp_header_len;	/* Bytes of tcp header to send		*/
 
 /*
@@ -241,6 +258,19 @@ struct tcp_sock {
  	__u32	snd_sml;	/* Last byte of the most recently transmitted small packet */
 	__u32	rcv_tstamp;	/* timestamp of last received ACK (for keepalives) */
 	__u32	lsndtime;	/* timestamp of last sent data packet (for restart window) */
+	struct tcp_bind_bucket *bind_hash;
+	/* Delayed ACK control data */
+	struct {
+		__u8	pending;	/* ACK is pending */
+		__u8	quick;		/* Scheduled number of quick acks	*/
+		__u8	pingpong;	/* The session is interactive		*/
+		__u8	blocked;	/* Delayed ACK was blocked by socket lock*/
+		__u32	ato;		/* Predicted tick of soft clock		*/
+		unsigned long timeout;	/* Currently scheduled timeout		*/
+		__u32	lrcvtime;	/* timestamp of last received data packet*/
+		__u16	last_seg_size;	/* Size of last incoming segment	*/
+		__u16	rcv_mss;	/* MSS used for delayed ACK decisions	*/ 
+	} ack;
 
 	/* Data for direct copy to user */
 	struct {
@@ -258,15 +288,19 @@ struct tcp_sock {
 	__u32	mss_cache;	/* Cached effective mss, not including SACKS */
 	__u16	xmit_size_goal;	/* Goal for segmenting output packets	*/
 	__u16	ext_header_len;	/* Network protocol overhead (IP/IPv6 options) */
+	__u8	ca_state;	/* State of fast-retransmit machine 	*/
+	__u8	retransmits;	/* Number of unrecovered RTO timeouts.	*/
 
+	__u16	advmss;		/* Advertised MSS			*/
 	__u32	window_clamp;	/* Maximal window to advertise		*/
 	__u32	rcv_ssthresh;	/* Current window clamp			*/
 
 	__u32	frto_highmark;	/* snd_nxt when RTO occurred */
 	__u8	reordering;	/* Packet reordering metric.		*/
 	__u8	frto_counter;	/* Number of new acks after RTO */
-	__u8	nonagle;	/* Disable Nagle algorithm?             */
-	__u8	keepalive_probes; /* num of allowed keep alive probes	*/
+
+	__u8	unused;
+	__u8	defer_accept;	/* User waits for some data after accept() */
 
 /* RTT measurement */
 	__u32	srtt;		/* smoothed round trip time << 3	*/
@@ -274,13 +308,19 @@ struct tcp_sock {
 	__u32	mdev_max;	/* maximal mdev for the last rtt period	*/
 	__u32	rttvar;		/* smoothed mdev_max			*/
 	__u32	rtt_seq;	/* sequence number to update rttvar	*/
+	__u32	rto;		/* retransmit timeout			*/
 
 	__u32	packets_out;	/* Packets which are "in flight"	*/
 	__u32	left_out;	/* Packets which leaved network	*/
 	__u32	retrans_out;	/* Retransmitted packets out		*/
+	__u8	backoff;	/* backoff				*/
 /*
  *      Options received (usually on last packet, some only on SYN packets).
  */
+	__u8	nonagle;	/* Disable Nagle algorithm?             */
+	__u8	keepalive_probes; /* num of allowed keep alive probes	*/
+
+	__u8	probes_out;	/* unanswered 0 window probes		*/
 	struct tcp_options_received rx_opt;
 
 /*
@@ -293,6 +333,11 @@ struct tcp_sock {
 	__u32	snd_cwnd_used;
 	__u32	snd_cwnd_stamp;
 
+	/* Two commonly used timers in both sender and receiver paths. */
+	unsigned long		timeout;
+ 	struct timer_list	retransmit_timer;	/* Resend (no ack)	*/
+ 	struct timer_list	delack_timer;		/* Ack delay 		*/
+
 	struct sk_buff_head	out_of_order_queue; /* Out of order segments go here */
 
 	struct tcp_func		*af_specific;	/* Operations which are AF_INET{4,6} specific	*/
@@ -307,7 +352,8 @@ struct tcp_sock {
 	struct tcp_sack_block duplicate_sack[1]; /* D-SACK block */
 	struct tcp_sack_block selective_acks[4]; /* The SACKS themselves*/
 
-	__u16	advmss;		/* Advertised MSS			*/
+	__u8	syn_retries;	/* num of allowed syn retries */
+	__u8	ecn_flags;	/* ECN status bits.			*/
 	__u16	prior_ssthresh; /* ssthresh saved at recovery start	*/
 	__u32	lost_out;	/* Lost packets			*/
 	__u32	sacked_out;	/* SACK'd packets			*/
@@ -321,12 +367,14 @@ struct tcp_sock {
 	int	undo_retrans;	/* number of undoable retransmissions. */
 	__u32	urg_seq;	/* Seq of received urgent pointer */
 	__u16	urg_data;	/* Saved octet of OOB data and control flags */
+	__u8	pending;	/* Scheduled timer event	*/
 	__u8	urg_mode;	/* In urgent mode		*/
-	__u8	ecn_flags;	/* ECN status bits.			*/
 	__u32	snd_up;		/* Urgent pointer		*/
 
 	__u32	total_retrans;	/* Total retransmits for entire connection */
 
+	struct request_sock_queue accept_queue; /* FIFO of established children */
+
 	unsigned int		keepalive_time;	  /* time before keep alive takes place */
 	unsigned int		keepalive_intvl;  /* time interval between keep alive probes */
 	int			linger2;
@@ -346,6 +394,11 @@ struct tcp_sock {
 		__u32	seq;
 		__u32	time;
 	} rcvq_space;
+
+	/* Pluggable TCP congestion control hook */
+	struct tcp_congestion_ops *ca_ops;
+	u32	ca_priv[16];
+#define TCP_CA_PRIV_SIZE	(16*sizeof(u32))
 };
 
 static inline struct tcp_sock *tcp_sk(const struct sock *sk)
@@ -353,18 +406,9 @@ static inline struct tcp_sock *tcp_sk(const struct sock *sk)
 	return (struct tcp_sock *)sk;
 }
 
-struct tcp_timewait_sock {
-	struct inet_timewait_sock tw_sk;
-	__u32			  tw_rcv_nxt;
-	__u32			  tw_snd_nxt;
-	__u32			  tw_rcv_wnd;
-	__u32			  tw_ts_recent;
-	long			  tw_ts_recent_stamp;
-};
-
-static inline struct tcp_timewait_sock *tcp_twsk(const struct sock *sk)
+static inline void *tcp_ca(const struct tcp_sock *tp)
 {
-	return (struct tcp_timewait_sock *)sk;
+	return (void *) tp->ca_priv;
 }
 
 #endif
diff --git a/trunk/include/linux/tcp_diag.h b/trunk/include/linux/tcp_diag.h
new file mode 100644
index 000000000000..7a5996743946
--- /dev/null
+++ b/trunk/include/linux/tcp_diag.h
@@ -0,0 +1,127 @@
+#ifndef _TCP_DIAG_H_
+#define _TCP_DIAG_H_ 1
+
+/* Just some random number */
+#define TCPDIAG_GETSOCK 18
+
+/* Socket identity */
+struct tcpdiag_sockid
+{
+	__u16	tcpdiag_sport;
+	__u16	tcpdiag_dport;
+	__u32	tcpdiag_src[4];
+	__u32	tcpdiag_dst[4];
+	__u32	tcpdiag_if;
+	__u32	tcpdiag_cookie[2];
+#define TCPDIAG_NOCOOKIE (~0U)
+};
+
+/* Request structure */
+
+struct tcpdiagreq
+{
+	__u8	tcpdiag_family;		/* Family of addresses. */
+	__u8	tcpdiag_src_len;
+	__u8	tcpdiag_dst_len;
+	__u8	tcpdiag_ext;		/* Query extended information */
+
+	struct tcpdiag_sockid id;
+
+	__u32	tcpdiag_states;		/* States to dump */
+	__u32	tcpdiag_dbs;		/* Tables to dump (NI) */
+};
+
+enum
+{
+	TCPDIAG_REQ_NONE,
+	TCPDIAG_REQ_BYTECODE,
+};
+
+#define TCPDIAG_REQ_MAX TCPDIAG_REQ_BYTECODE
+
+/* Bytecode is sequence of 4 byte commands followed by variable arguments.
+ * All the commands identified by "code" are conditional jumps forward:
+ * to offset cc+"yes" or to offset cc+"no". "yes" is supposed to be
+ * length of the command and its arguments.
+ */
+ 
+struct tcpdiag_bc_op
+{
+	unsigned char	code;
+	unsigned char	yes;
+	unsigned short	no;
+};
+
+enum
+{
+	TCPDIAG_BC_NOP,
+	TCPDIAG_BC_JMP,
+	TCPDIAG_BC_S_GE,
+	TCPDIAG_BC_S_LE,
+	TCPDIAG_BC_D_GE,
+	TCPDIAG_BC_D_LE,
+	TCPDIAG_BC_AUTO,
+	TCPDIAG_BC_S_COND,
+	TCPDIAG_BC_D_COND,
+};
+
+struct tcpdiag_hostcond
+{
+	__u8	family;
+	__u8	prefix_len;
+	int	port;
+	__u32	addr[0];
+};
+
+/* Base info structure. It contains socket identity (addrs/ports/cookie)
+ * and, alas, the information shown by netstat. */
+struct tcpdiagmsg
+{
+	__u8	tcpdiag_family;
+	__u8	tcpdiag_state;
+	__u8	tcpdiag_timer;
+	__u8	tcpdiag_retrans;
+
+	struct tcpdiag_sockid id;
+
+	__u32	tcpdiag_expires;
+	__u32	tcpdiag_rqueue;
+	__u32	tcpdiag_wqueue;
+	__u32	tcpdiag_uid;
+	__u32	tcpdiag_inode;
+};
+
+/* Extensions */
+
+enum
+{
+	TCPDIAG_NONE,
+	TCPDIAG_MEMINFO,
+	TCPDIAG_INFO,
+	TCPDIAG_VEGASINFO,
+	TCPDIAG_CONG,
+};
+
+#define TCPDIAG_MAX TCPDIAG_CONG
+
+
+/* TCPDIAG_MEM */
+
+struct tcpdiag_meminfo
+{
+	__u32	tcpdiag_rmem;
+	__u32	tcpdiag_wmem;
+	__u32	tcpdiag_fmem;
+	__u32	tcpdiag_tmem;
+};
+
+/* TCPDIAG_VEGASINFO */
+
+struct tcpvegas_info {
+	__u32	tcpv_enabled;
+	__u32	tcpv_rttcnt;
+	__u32	tcpv_rtt;
+	__u32	tcpv_minrtt;
+};
+
+#endif /* _TCP_DIAG_H_ */
diff --git a/trunk/include/linux/types.h b/trunk/include/linux/types.h
index 2b678c22ca4a..dcb13f865df9 100644
--- a/trunk/include/linux/types.h
+++ b/trunk/include/linux/types.h
@@ -123,9 +123,6 @@ typedef		__u64		u_int64_t;
 typedef		__s64		int64_t;
 #endif
 
-/* this is a special 64bit data type that is 8-byte aligned */
-#define aligned_u64 unsigned long long __attribute__((aligned(8)))
-
 /*
  * The type used for indexing onto a disc or disc partition.
  * If required, asm/types.h can override it and define
diff --git a/trunk/include/linux/xfrm.h b/trunk/include/linux/xfrm.h
index 0fb077d68441..f0d423300d84 100644
--- a/trunk/include/linux/xfrm.h
+++ b/trunk/include/linux/xfrm.h
@@ -258,27 +258,9 @@ struct xfrm_usersa_flush {
 	__u8				proto;
 };
 
-#ifndef __KERNEL__
-/* backwards compatibility for userspace */
 #define XFRMGRP_ACQUIRE		1
 #define XFRMGRP_EXPIRE		2
 #define XFRMGRP_SA		4
 #define XFRMGRP_POLICY		8
-#endif
-
-enum xfrm_nlgroups {
-	XFRMNLGRP_NONE,
-#define XFRMNLGRP_NONE		XFRMNLGRP_NONE
-	XFRMNLGRP_ACQUIRE,
-#define XFRMNLGRP_ACQUIRE	XFRMNLGRP_ACQUIRE
-	XFRMNLGRP_EXPIRE,
-#define XFRMNLGRP_EXPIRE	XFRMNLGRP_EXPIRE
-	XFRMNLGRP_SA,
-#define XFRMNLGRP_SA		XFRMNLGRP_SA
-	XFRMNLGRP_POLICY,
-#define XFRMNLGRP_POLICY	XFRMNLGRP_POLICY
-	__XFRMNLGRP_MAX
-};
-#define XFRMNLGRP_MAX	(__XFRMNLGRP_MAX - 1)
 
 #endif /* _LINUX_XFRM_H */
diff --git a/trunk/include/net/act_api.h b/trunk/include/net/act_api.h
index b55eb7c7f033..ed00a995f576 100644
--- a/trunk/include/net/act_api.h
+++ b/trunk/include/net/act_api.h
@@ -63,7 +63,7 @@ struct tc_action_ops
 	__u32   type; /* TBD to match kind */
 	__u32 	capab;  /* capabilities includes 4 bit version */
 	struct module		*owner;
-	int     (*act)(struct sk_buff **, struct tc_action *, struct tcf_result *);
+	int     (*act)(struct sk_buff **, struct tc_action *);
 	int     (*get_stats)(struct sk_buff *, struct tc_action *);
 	int     (*dump)(struct sk_buff *, struct tc_action *,int , int);
 	int     (*cleanup)(struct tc_action *, int bind);
diff --git a/trunk/include/net/addrconf.h b/trunk/include/net/addrconf.h
index 750e2508dd90..a0ed93672176 100644
--- a/trunk/include/net/addrconf.h
+++ b/trunk/include/net/addrconf.h
@@ -45,7 +45,6 @@ struct prefix_info {
 
 #ifdef __KERNEL__
 
-#include <linux/config.h>
 #include <linux/netdevice.h>
 #include <net/if_inet6.h>
 #include <net/ipv6.h>
@@ -239,10 +238,5 @@ static inline int ipv6_addr_is_ll_all_routers(const struct in6_addr *addr)
 		addr->s6_addr32[3] == htonl(0x00000002));
 }
 
-#ifdef CONFIG_PROC_FS
-extern int if6_proc_init(void);
-extern void if6_proc_exit(void);
-#endif
-
 #endif
 #endif
diff --git a/trunk/include/net/af_unix.h b/trunk/include/net/af_unix.h
index b5d785ab4a0e..b60b3846b9d1 100644
--- a/trunk/include/net/af_unix.h
+++ b/trunk/include/net/af_unix.h
@@ -1,11 +1,5 @@
 #ifndef __LINUX_NET_AFUNIX_H
 #define __LINUX_NET_AFUNIX_H
-
-#include <linux/config.h>
-#include <linux/socket.h>
-#include <linux/un.h>
-#include <net/sock.h>
-
 extern void unix_inflight(struct file *fp);
 extern void unix_notinflight(struct file *fp);
 extern void unix_gc(void);
@@ -80,14 +74,5 @@ struct unix_sock {
         wait_queue_head_t       peer_wait;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
-
-#ifdef CONFIG_SYSCTL
-extern int sysctl_unix_max_dgram_qlen;
-extern void unix_sysctl_register(void);
-extern void unix_sysctl_unregister(void);
-#else
-static inline void unix_sysctl_register(void) {}
-static inline void unix_sysctl_unregister(void) {}
-#endif
 #endif
 #endif
diff --git a/trunk/include/net/arp.h b/trunk/include/net/arp.h
index a13e30c35f42..a1f09fad6a52 100644
--- a/trunk/include/net/arp.h
+++ b/trunk/include/net/arp.h
@@ -11,7 +11,7 @@ extern struct neigh_table arp_tbl;
 
 extern void	arp_init(void);
 extern int	arp_rcv(struct sk_buff *skb, struct net_device *dev,
-			struct packet_type *pt, struct net_device *orig_dev);
+			struct packet_type *pt);
 extern int	arp_find(unsigned char *haddr, struct sk_buff *skb);
 extern int	arp_ioctl(unsigned int cmd, void __user *arg);
 extern void     arp_send(int type, int ptype, u32 dest_ip, 
diff --git a/trunk/include/net/ax25.h b/trunk/include/net/ax25.h
index 926eed543023..3696f988a9f1 100644
--- a/trunk/include/net/ax25.h
+++ b/trunk/include/net/ax25.h
@@ -316,7 +316,7 @@ extern int  ax25_protocol_is_registered(unsigned int);
 
 /* ax25_in.c */
 extern int  ax25_rx_iframe(ax25_cb *, struct sk_buff *);
-extern int  ax25_kiss_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
+extern int  ax25_kiss_rcv(struct sk_buff *, struct net_device *, struct packet_type *);
 
 /* ax25_ip.c */
 extern int  ax25_encapsulate(struct sk_buff *, struct net_device *, unsigned short, void *, void *, unsigned int);
diff --git a/trunk/include/net/bluetooth/bluetooth.h b/trunk/include/net/bluetooth/bluetooth.h
index 6dfa4a61ffd0..06b24f637026 100644
--- a/trunk/include/net/bluetooth/bluetooth.h
+++ b/trunk/include/net/bluetooth/bluetooth.h
@@ -131,12 +131,11 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 
 /* Skb helpers */
 struct bt_skb_cb {
-	__u8 pkt_type;
-	__u8 incoming;
+	int incoming;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)(skb->cb)) 
 
-static inline struct sk_buff *bt_skb_alloc(unsigned int len, unsigned int __nocast how)
+static inline struct sk_buff *bt_skb_alloc(unsigned int len, int how)
 {
 	struct sk_buff *skb;
 
diff --git a/trunk/include/net/bluetooth/hci.h b/trunk/include/net/bluetooth/hci.h
index 371e7d3f2e6f..6f0706f4af68 100644
--- a/trunk/include/net/bluetooth/hci.h
+++ b/trunk/include/net/bluetooth/hci.h
@@ -453,15 +453,6 @@ struct inquiry_info_with_rssi {
 	__u16    clock_offset;
 	__s8     rssi;
 } __attribute__ ((packed));
-struct inquiry_info_with_rssi_and_pscan_mode {
-	bdaddr_t bdaddr;
-	__u8     pscan_rep_mode;
-	__u8     pscan_period_mode;
-	__u8     pscan_mode;
-	__u8     dev_class[3];
-	__u16    clock_offset;
-	__s8     rssi;
-} __attribute__ ((packed));
 
 #define HCI_EV_CONN_COMPLETE 	0x03
 struct hci_ev_conn_complete {
@@ -593,12 +584,6 @@ struct hci_ev_clock_offset {
 	__u16    clock_offset;
 } __attribute__ ((packed));
 
-#define HCI_EV_PSCAN_REP_MODE	0x20
-struct hci_ev_pscan_rep_mode {
-	bdaddr_t bdaddr;
-	__u8     pscan_rep_mode;
-} __attribute__ ((packed));
-
 /* Internal events generated by Bluetooth stack */
 #define HCI_EV_STACK_INTERNAL	0xFD
 struct hci_ev_stack_internal {
diff --git a/trunk/include/net/bluetooth/hci_core.h b/trunk/include/net/bluetooth/hci_core.h
index 7f933f302078..6d63a47c731b 100644
--- a/trunk/include/net/bluetooth/hci_core.h
+++ b/trunk/include/net/bluetooth/hci_core.h
@@ -404,7 +404,7 @@ static inline int hci_recv_frame(struct sk_buff *skb)
 	bt_cb(skb)->incoming = 1;
 
 	/* Time stamp */
-	__net_timestamp(skb);
+	do_gettimeofday(&skb->stamp);
 
 	/* Queue frame for rx task */
 	skb_queue_tail(&hdev->rx_q, skb);
diff --git a/trunk/include/net/bluetooth/rfcomm.h b/trunk/include/net/bluetooth/rfcomm.h
index ffea9d54071f..13669bad00b3 100644
--- a/trunk/include/net/bluetooth/rfcomm.h
+++ b/trunk/include/net/bluetooth/rfcomm.h
@@ -80,9 +80,9 @@
 #define RFCOMM_RPN_STOP_15	1
 
 #define RFCOMM_RPN_PARITY_NONE	0x0
-#define RFCOMM_RPN_PARITY_ODD	0x1
-#define RFCOMM_RPN_PARITY_EVEN	0x3
-#define RFCOMM_RPN_PARITY_MARK	0x5
+#define RFCOMM_RPN_PARITY_ODD	0x4
+#define RFCOMM_RPN_PARITY_EVEN	0x5
+#define RFCOMM_RPN_PARITY_MARK	0x6
 #define RFCOMM_RPN_PARITY_SPACE	0x7
 
 #define RFCOMM_RPN_FLOW_NONE	0x00
@@ -223,14 +223,8 @@ struct rfcomm_dlc {
 #define RFCOMM_CFC_DISABLED 0
 #define RFCOMM_CFC_ENABLED  RFCOMM_MAX_CREDITS
 
-/* ---- RFCOMM SEND RPN ---- */
-int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
-			u8 bit_rate, u8 data_bits, u8 stop_bits,
-			u8 parity, u8 flow_ctrl_settings, 
-			u8 xon_char, u8 xoff_char, u16 param_mask);
-
 /* ---- RFCOMM DLCs (channels) ---- */
-struct rfcomm_dlc *rfcomm_dlc_alloc(unsigned int __nocast prio);
+struct rfcomm_dlc *rfcomm_dlc_alloc(int prio);
 void rfcomm_dlc_free(struct rfcomm_dlc *d);
 int  rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel);
 int  rfcomm_dlc_close(struct rfcomm_dlc *d, int reason);
diff --git a/trunk/include/net/datalink.h b/trunk/include/net/datalink.h
index deb7ca75db48..5797ba3d2eb5 100644
--- a/trunk/include/net/datalink.h
+++ b/trunk/include/net/datalink.h
@@ -9,7 +9,7 @@ struct datalink_proto {
         unsigned short  header_length;
 
         int     (*rcvfunc)(struct sk_buff *, struct net_device *,
-                                struct packet_type *, struct net_device *);
+                                struct packet_type *);
 	int     (*request)(struct datalink_proto *, struct sk_buff *,
                                         unsigned char *);
 	struct list_head node;
diff --git a/trunk/include/net/dn.h b/trunk/include/net/dn.h
index c1dbbd222793..5551c46db397 100644
--- a/trunk/include/net/dn.h
+++ b/trunk/include/net/dn.h
@@ -3,7 +3,6 @@
 
 #include <linux/dn.h>
 #include <net/sock.h>
-#include <net/tcp.h>
 #include <asm/byteorder.h>
 
 typedef unsigned short dn_address;
diff --git a/trunk/include/net/icmp.h b/trunk/include/net/icmp.h
index 6cdebeee5f96..e5ef0d15fb45 100644
--- a/trunk/include/net/icmp.h
+++ b/trunk/include/net/icmp.h
@@ -57,11 +57,4 @@ static inline struct raw_sock *raw_sk(const struct sock *sk)
 	return (struct raw_sock *)sk;
 }
 
-extern int sysctl_icmp_echo_ignore_all;
-extern int sysctl_icmp_echo_ignore_broadcasts;
-extern int sysctl_icmp_ignore_bogus_error_responses;
-extern int sysctl_icmp_errors_use_inbound_ifaddr;
-extern int sysctl_icmp_ratelimit;
-extern int sysctl_icmp_ratemask;
-
 #endif	/* _ICMP_H */
diff --git a/trunk/include/net/ieee80211.h b/trunk/include/net/ieee80211.h
index dc36b1be6745..db09580ad14b 100644
--- a/trunk/include/net/ieee80211.h
+++ b/trunk/include/net/ieee80211.h
@@ -20,9 +20,18 @@
  */
 #ifndef IEEE80211_H
 #define IEEE80211_H
+
 #include <linux/if_ether.h> /* ETH_ALEN */
 #include <linux/kernel.h>   /* ARRAY_SIZE */
-#include <linux/wireless.h>
+
+#if WIRELESS_EXT < 17
+#define IW_QUAL_QUAL_INVALID   0x10
+#define IW_QUAL_LEVEL_INVALID  0x20
+#define IW_QUAL_NOISE_INVALID  0x40
+#define IW_QUAL_QUAL_UPDATED   0x1
+#define IW_QUAL_LEVEL_UPDATED  0x2
+#define IW_QUAL_NOISE_UPDATED  0x4
+#endif
 
 #define IEEE80211_DATA_LEN		2304
 /* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
@@ -38,22 +47,51 @@
 #define IEEE80211_FRAME_LEN		(IEEE80211_DATA_LEN + IEEE80211_HLEN)
 
 struct ieee80211_hdr {
-	__le16 frame_ctl;
-	__le16 duration_id;
+	u16 frame_ctl;
+	u16 duration_id;
 	u8 addr1[ETH_ALEN];
 	u8 addr2[ETH_ALEN];
 	u8 addr3[ETH_ALEN];
-	__le16 seq_ctl;
+	u16 seq_ctl;
 	u8 addr4[ETH_ALEN];
 } __attribute__ ((packed));
 
 struct ieee80211_hdr_3addr {
-	__le16 frame_ctl;
-	__le16 duration_id;
+	u16 frame_ctl;
+	u16 duration_id;
 	u8 addr1[ETH_ALEN];
 	u8 addr2[ETH_ALEN];
 	u8 addr3[ETH_ALEN];
-	__le16 seq_ctl;
+	u16 seq_ctl;
+} __attribute__ ((packed));
+
+enum eap_type {
+	EAP_PACKET = 0,
+	EAPOL_START,
+	EAPOL_LOGOFF,
+	EAPOL_KEY,
+	EAPOL_ENCAP_ASF_ALERT
+};
+
+static const char *eap_types[] = {
+	[EAP_PACKET]		= "EAP-Packet",
+	[EAPOL_START]		= "EAPOL-Start",
+	[EAPOL_LOGOFF]		= "EAPOL-Logoff",
+	[EAPOL_KEY]		= "EAPOL-Key",
+	[EAPOL_ENCAP_ASF_ALERT]	= "EAPOL-Encap-ASF-Alert"
+};
+
+static inline const char *eap_get_type(int type)
+{
+	return (type >= ARRAY_SIZE(eap_types)) ? "Unknown" : eap_types[type];
+}
+
+struct eapol {
+	u8 snap[6];
+	u16 ethertype;
+	u8 version;
+	u8 type;
+	u16 length;
 } __attribute__ ((packed));
 
 #define IEEE80211_1ADDR_LEN 10
@@ -66,7 +104,7 @@ struct ieee80211_hdr_3addr {
 #define	MAX_FRAG_THRESHOLD     2346U
 
 /* Frame control field constants */
-#define IEEE80211_FCTL_VERS		0x0003
+#define IEEE80211_FCTL_VERS		0x0002
 #define IEEE80211_FCTL_FTYPE		0x000c
 #define IEEE80211_FCTL_STYPE		0x00f0
 #define IEEE80211_FCTL_TODS		0x0100
@@ -74,8 +112,8 @@ struct ieee80211_hdr_3addr {
 #define IEEE80211_FCTL_MOREFRAGS	0x0400
 #define IEEE80211_FCTL_RETRY		0x0800
 #define IEEE80211_FCTL_PM		0x1000
-#define IEEE80211_FCTL_MOREDATA		0x2000
-#define IEEE80211_FCTL_PROTECTED	0x4000
+#define IEEE80211_FCTL_MOREDATA	0x2000
+#define IEEE80211_FCTL_WEP		0x4000
 #define IEEE80211_FCTL_ORDER		0x8000
 
 #define IEEE80211_FTYPE_MGMT		0x0000
@@ -94,7 +132,6 @@ struct ieee80211_hdr_3addr {
 #define IEEE80211_STYPE_DISASSOC	0x00A0
 #define IEEE80211_STYPE_AUTH		0x00B0
 #define IEEE80211_STYPE_DEAUTH		0x00C0
-#define IEEE80211_STYPE_ACTION		0x00D0
 
 /* control */
 #define IEEE80211_STYPE_PSPOLL		0x00A0
@@ -130,19 +167,8 @@ do { if (ieee80211_debug_level & (level)) \
 #define IEEE80211_DEBUG(level, fmt, args...) do {} while (0)
 #endif	/* CONFIG_IEEE80211_DEBUG */
 
-
-/* debug macros not dependent on CONFIG_IEEE80211_DEBUG */
-
-#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
-#define MAC_ARG(x) ((u8*)(x))[0],((u8*)(x))[1],((u8*)(x))[2],((u8*)(x))[3],((u8*)(x))[4],((u8*)(x))[5]
-
-/* escape_essid() is intended to be used in debug (and possibly error)
- * messages. It should never be used for passing essid to user space. */
-const char *escape_essid(const char *essid, u8 essid_len);
-
-
 /*
- * To use the debug system:
+ * To use the debug system;
  *
  * If you are defining a new debug classification, simply add it to the #define
  * list here in the form of:
@@ -158,11 +184,11 @@ const char *escape_essid(const char *essid, u8 essid_len);
  *
  * To add your debug level to the list of levels seen when you perform
  *
- * % cat /proc/net/ieee80211/debug_level
+ * % cat /proc/net/ipw/debug_level
  *
- * you simply need to add your entry to the ieee80211_debug_level array.
+ * you simply need to add your entry to the ipw_debug_levels array.
  *
- * If you do not see debug_level in /proc/net/ieee80211 then you do not have
+ * If you do not see debug_level in /proc/net/ipw then you do not have
  * CONFIG_IEEE80211_DEBUG defined in your kernel configuration
  *
  */
@@ -173,6 +199,7 @@ const char *escape_essid(const char *essid, u8 essid_len);
 #define IEEE80211_DL_STATE         (1<<3)
 #define IEEE80211_DL_MGMT          (1<<4)
 #define IEEE80211_DL_FRAG          (1<<5)
+#define IEEE80211_DL_EAP           (1<<6)
 #define IEEE80211_DL_DROP          (1<<7)
 
 #define IEEE80211_DL_TX            (1<<8)
@@ -187,6 +214,7 @@ const char *escape_essid(const char *essid, u8 essid_len);
 #define IEEE80211_DEBUG_STATE(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_STATE, f, ## a)
 #define IEEE80211_DEBUG_MGMT(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_MGMT, f, ## a)
 #define IEEE80211_DEBUG_FRAG(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_FRAG, f, ## a)
+#define IEEE80211_DEBUG_EAP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_EAP, f, ## a)
 #define IEEE80211_DEBUG_DROP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_DROP, f, ## a)
 #define IEEE80211_DEBUG_TX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_TX, f, ## a)
 #define IEEE80211_DEBUG_RX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_RX, f, ## a)
@@ -195,9 +223,9 @@ const char *escape_essid(const char *essid, u8 essid_len);
 #include <linux/if_arp.h> /* ARPHRD_ETHER */
 
 #ifndef WIRELESS_SPY
-#define WIRELESS_SPY		/* enable iwspy support */
+#define WIRELESS_SPY		// enable iwspy support
 #endif
-#include <net/iw_handler.h>	/* new driver API */
+#include <net/iw_handler.h>	// new driver API
 
 #ifndef ETH_P_PAE
 #define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
@@ -224,7 +252,6 @@ struct ieee80211_snap_hdr {
 
 #define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
 
-#define WLAN_FC_GET_VERS(fc) ((fc) & IEEE80211_FCTL_VERS)
 #define WLAN_FC_GET_TYPE(fc) ((fc) & IEEE80211_FCTL_FTYPE)
 #define WLAN_FC_GET_STYPE(fc) ((fc) & IEEE80211_FCTL_STYPE)
 
@@ -237,7 +264,7 @@ struct ieee80211_snap_hdr {
 
 #define WLAN_AUTH_CHALLENGE_LEN 128
 
-#define WLAN_CAPABILITY_ESS (1<<0)
+#define WLAN_CAPABILITY_BSS (1<<0)
 #define WLAN_CAPABILITY_IBSS (1<<1)
 #define WLAN_CAPABILITY_CF_POLLABLE (1<<2)
 #define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
@@ -245,72 +272,34 @@ struct ieee80211_snap_hdr {
 #define WLAN_CAPABILITY_SHORT_PREAMBLE (1<<5)
 #define WLAN_CAPABILITY_PBCC (1<<6)
 #define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
-#define WLAN_CAPABILITY_SPECTRUM_MGMT (1<<8)
-#define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
-#define WLAN_CAPABILITY_OSSS_OFDM (1<<13)
 
 /* Status codes */
-enum ieee80211_statuscode {
-	WLAN_STATUS_SUCCESS = 0,
-	WLAN_STATUS_UNSPECIFIED_FAILURE = 1,
-	WLAN_STATUS_CAPS_UNSUPPORTED = 10,
-	WLAN_STATUS_REASSOC_NO_ASSOC = 11,
-	WLAN_STATUS_ASSOC_DENIED_UNSPEC = 12,
-	WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG = 13,
-	WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION = 14,
-	WLAN_STATUS_CHALLENGE_FAIL = 15,
-	WLAN_STATUS_AUTH_TIMEOUT = 16,
-	WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA = 17,
-	WLAN_STATUS_ASSOC_DENIED_RATES = 18,
-	/* 802.11b */
-	WLAN_STATUS_ASSOC_DENIED_NOSHORTPREAMBLE = 19,
-	WLAN_STATUS_ASSOC_DENIED_NOPBCC = 20,
-	WLAN_STATUS_ASSOC_DENIED_NOAGILITY = 21,
-	/* 802.11h */
-	WLAN_STATUS_ASSOC_DENIED_NOSPECTRUM = 22,
-	WLAN_STATUS_ASSOC_REJECTED_BAD_POWER = 23,
-	WLAN_STATUS_ASSOC_REJECTED_BAD_SUPP_CHAN = 24,
-	/* 802.11g */
-	WLAN_STATUS_ASSOC_DENIED_NOSHORTTIME = 25,
-	WLAN_STATUS_ASSOC_DENIED_NODSSSOFDM = 26,
-	/* 802.11i */
-	WLAN_STATUS_INVALID_IE = 40,
-	WLAN_STATUS_INVALID_GROUP_CIPHER = 41,
-	WLAN_STATUS_INVALID_PAIRWISE_CIPHER = 42,
-	WLAN_STATUS_INVALID_AKMP = 43,
-	WLAN_STATUS_UNSUPP_RSN_VERSION = 44,
-	WLAN_STATUS_INVALID_RSN_IE_CAP = 45,
-	WLAN_STATUS_CIPHER_SUITE_REJECTED = 46,
-};
+#define WLAN_STATUS_SUCCESS 0
+#define WLAN_STATUS_UNSPECIFIED_FAILURE 1
+#define WLAN_STATUS_CAPS_UNSUPPORTED 10
+#define WLAN_STATUS_REASSOC_NO_ASSOC 11
+#define WLAN_STATUS_ASSOC_DENIED_UNSPEC 12
+#define WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG 13
+#define WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION 14
+#define WLAN_STATUS_CHALLENGE_FAIL 15
+#define WLAN_STATUS_AUTH_TIMEOUT 16
+#define WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA 17
+#define WLAN_STATUS_ASSOC_DENIED_RATES 18
+/* 802.11b */
+#define WLAN_STATUS_ASSOC_DENIED_NOSHORT 19
+#define WLAN_STATUS_ASSOC_DENIED_NOPBCC 20
+#define WLAN_STATUS_ASSOC_DENIED_NOAGILITY 21
 
 /* Reason codes */
-enum ieee80211_reasoncode {
-	WLAN_REASON_UNSPECIFIED = 1,
-	WLAN_REASON_PREV_AUTH_NOT_VALID = 2,
-	WLAN_REASON_DEAUTH_LEAVING = 3,
-	WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY = 4,
-	WLAN_REASON_DISASSOC_AP_BUSY = 5,
-	WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA = 6,
-	WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA = 7,
-	WLAN_REASON_DISASSOC_STA_HAS_LEFT = 8,
-	WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH = 9,
-	/* 802.11h */
-	WLAN_REASON_DISASSOC_BAD_POWER = 10,
-	WLAN_REASON_DISASSOC_BAD_SUPP_CHAN = 11,
-	/* 802.11i */
-	WLAN_REASON_INVALID_IE = 13,
-	WLAN_REASON_MIC_FAILURE = 14,
-	WLAN_REASON_4WAY_HANDSHAKE_TIMEOUT = 15,
-	WLAN_REASON_GROUP_KEY_HANDSHAKE_TIMEOUT = 16,
-	WLAN_REASON_IE_DIFFERENT = 17,
-	WLAN_REASON_INVALID_GROUP_CIPHER = 18,
-	WLAN_REASON_INVALID_PAIRWISE_CIPHER = 19,
-	WLAN_REASON_INVALID_AKMP = 20,
-	WLAN_REASON_UNSUPP_RSN_VERSION = 21,
-	WLAN_REASON_INVALID_RSN_IE_CAP = 22,
-	WLAN_REASON_IEEE8021X_FAILED = 23,
-	WLAN_REASON_CIPHER_SUITE_REJECTED = 24,
-};
+#define WLAN_REASON_UNSPECIFIED 1
+#define WLAN_REASON_PREV_AUTH_NOT_VALID 2
+#define WLAN_REASON_DEAUTH_LEAVING 3
+#define WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY 4
+#define WLAN_REASON_DISASSOC_AP_BUSY 5
+#define WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA 6
+#define WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA 7
+#define WLAN_REASON_DISASSOC_STA_HAS_LEFT 8
+#define WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH 9
 
 
 #define IEEE80211_STATMASK_SIGNAL (1<<0)
@@ -437,7 +426,9 @@ struct ieee80211_stats {
 
 struct ieee80211_device;
 
+#if 0 /* for later */
 #include "ieee80211_crypt.h"
+#endif
 
 #define SEC_KEY_1         (1<<0)
 #define SEC_KEY_2         (1<<1)
@@ -489,34 +480,17 @@ Total: 28-2340 bytes
 #define BEACON_PROBE_SSID_ID_POSITION 12
 
 /* Management Frame Information Element Types */
-enum ieee80211_mfie {
-	MFIE_TYPE_SSID = 0,
-	MFIE_TYPE_RATES = 1,
-	MFIE_TYPE_FH_SET = 2,
-	MFIE_TYPE_DS_SET = 3,
-	MFIE_TYPE_CF_SET =  4,
-	MFIE_TYPE_TIM = 5,
-	MFIE_TYPE_IBSS_SET = 6,
-	MFIE_TYPE_COUNTRY = 7,
-	MFIE_TYPE_HOP_PARAMS = 8,
-	MFIE_TYPE_HOP_TABLE = 9,
-	MFIE_TYPE_REQUEST = 10,
-	MFIE_TYPE_CHALLENGE = 16,
-	MFIE_TYPE_POWER_CONSTRAINT = 32,
-	MFIE_TYPE_POWER_CAPABILITY = 33,
-	MFIE_TYPE_TPC_REQUEST = 34,
-	MFIE_TYPE_TPC_REPORT = 35,
-	MFIE_TYPE_SUPP_CHANNELS = 36,
-	MFIE_TYPE_CSA = 37,
-	MFIE_TYPE_MEASURE_REQUEST = 38,
-	MFIE_TYPE_MEASURE_REPORT = 39,
-	MFIE_TYPE_QUIET = 40,
-	MFIE_TYPE_IBSS_DFS = 41,
-	MFIE_TYPE_ERP_INFO = 42,
-	MFIE_TYPE_RSN = 48,
-	MFIE_TYPE_RATES_EX = 50,
-	MFIE_TYPE_GENERIC = 221,
-};
+#define MFIE_TYPE_SSID       0
+#define MFIE_TYPE_RATES      1
+#define MFIE_TYPE_FH_SET     2
+#define MFIE_TYPE_DS_SET     3
+#define MFIE_TYPE_CF_SET     4
+#define MFIE_TYPE_TIM        5
+#define MFIE_TYPE_IBSS_SET   6
+#define MFIE_TYPE_CHALLENGE  16
+#define MFIE_TYPE_RSN	     48
+#define MFIE_TYPE_RATES_EX   50
+#define MFIE_TYPE_GENERIC    221
 
 struct ieee80211_info_element_hdr {
 	u8 id;
@@ -548,9 +522,9 @@ struct ieee80211_info_element {
 
 struct ieee80211_authentication {
 	struct ieee80211_hdr_3addr header;
-	__le16 algorithm;
-	__le16 transaction;
-	__le16 status;
+	u16 algorithm;
+	u16 transaction;
+	u16 status;
 	struct ieee80211_info_element info_element;
 } __attribute__ ((packed));
 
@@ -558,23 +532,23 @@ struct ieee80211_authentication {
 struct ieee80211_probe_response {
 	struct ieee80211_hdr_3addr header;
 	u32 time_stamp[2];
-	__le16 beacon_interval;
-	__le16 capability;
+	u16 beacon_interval;
+	u16 capability;
 	struct ieee80211_info_element info_element;
 } __attribute__ ((packed));
 
 struct ieee80211_assoc_request_frame {
-	__le16 capability;
-	__le16 listen_interval;
+	u16 capability;
+	u16 listen_interval;
 	u8 current_ap[ETH_ALEN];
 	struct ieee80211_info_element info_element;
 } __attribute__ ((packed));
 
 struct ieee80211_assoc_response_frame {
 	struct ieee80211_hdr_3addr header;
-	__le16 capability;
-	__le16 status;
-	__le16 aid;
+	u16 capability;
+	u16 status;
+	u16 aid;
 	struct ieee80211_info_element info_element; /* supported rates */
 } __attribute__ ((packed));
 
@@ -589,7 +563,7 @@ struct ieee80211_txb {
 };
 
 
-/* SWEEP TABLE ENTRIES NUMBER */
+/* SWEEP TABLE ENTRIES NUMBER*/
 #define MAX_SWEEP_TAB_ENTRIES		  42
 #define MAX_SWEEP_TAB_ENTRIES_PER_PACKET  7
 /* MAX_RATES_LENGTH needs to be 12.  The spec says 8, and many APs
@@ -650,6 +624,8 @@ enum ieee80211_state {
 
 #define DEFAULT_MAX_SCAN_AGE (15 * HZ)
 #define DEFAULT_FTS 2346
+#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC_ARG(x) ((u8*)(x))[0],((u8*)(x))[1],((u8*)(x))[2],((u8*)(x))[3],((u8*)(x))[4],((u8*)(x))[5]
 
 
 #define CFG_IEEE80211_RESERVE_FCS (1<<0)
@@ -817,6 +793,8 @@ extern struct net_device *alloc_ieee80211(int sizeof_priv);
 extern int ieee80211_set_encryption(struct ieee80211_device *ieee);
 
 /* ieee80211_tx.c */
+
+
 extern int ieee80211_xmit(struct sk_buff *skb,
 			  struct net_device *dev);
 extern void ieee80211_txb_free(struct ieee80211_txb *);
@@ -829,7 +807,7 @@ extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
 			     struct ieee80211_hdr *header,
 			     struct ieee80211_rx_stats *stats);
 
-/* ieee80211_wx.c */
+/* iee80211_wx.c */
 extern int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
 				 struct iw_request_info *info,
 				 union iwreq_data *wrqu, char *key);
@@ -851,5 +829,28 @@ extern inline int ieee80211_get_scans(struct ieee80211_device *ieee)
 	return ieee->scans;
 }
 
+static inline const char *escape_essid(const char *essid, u8 essid_len) {
+	static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
+	const char *s = essid;
+	char *d = escaped;
+
+	if (ieee80211_is_empty_essid(essid, essid_len)) {
+		memcpy(escaped, "<hidden>", sizeof("<hidden>"));
+		return escaped;
+	}
+
+	essid_len = min(essid_len, (u8)IW_ESSID_MAX_SIZE);
+	while (essid_len--) {
+		if (*s == '\0') {
+			*d++ = '\\';
+			*d++ = '0';
+			s++;
+		} else {
+			*d++ = *s++;
+		}
+	}
+	*d = '\0';
+	return escaped;
+}
 
 #endif /* IEEE80211_H */
diff --git a/trunk/include/net/ieee80211_crypt.h b/trunk/include/net/ieee80211_crypt.h
deleted file mode 100644
index b58a3bcc0dc0..000000000000
--- a/trunk/include/net/ieee80211_crypt.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Original code based on Host AP (software wireless LAN access point) driver
- * for Intersil Prism2/2.5/3.
- *
- * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
- * <jkmaline@cc.hut.fi>
- * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * Adaption to a generic IEEE 802.11 stack by James Ketrenos
- * <jketreno@linux.intel.com>
- *
- * Copyright (c) 2004, Intel Corporation
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-
-/*
- * This file defines the interface to the ieee80211 crypto module.
- */
-#ifndef IEEE80211_CRYPT_H
-#define IEEE80211_CRYPT_H
-
-#include <linux/skbuff.h>
-
-struct ieee80211_crypto_ops {
-	const char *name;
-
-	/* init new crypto context (e.g., allocate private data space,
-	 * select IV, etc.); returns NULL on failure or pointer to allocated
-	 * private data on success */
-	void * (*init)(int keyidx);
-
-	/* deinitialize crypto context and free allocated private data */
-	void (*deinit)(void *priv);
-
-	/* encrypt/decrypt return < 0 on error or >= 0 on success. The return
-	 * value from decrypt_mpdu is passed as the keyidx value for
-	 * decrypt_msdu. skb must have enough head and tail room for the
-	 * encryption; if not, error will be returned; these functions are
-	 * called for all MPDUs (i.e., fragments).
-	 */
-	int (*encrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
-	int (*decrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
-
-	/* These functions are called for full MSDUs, i.e. full frames.
-	 * These can be NULL if full MSDU operations are not needed. */
-	int (*encrypt_msdu)(struct sk_buff *skb, int hdr_len, void *priv);
-	int (*decrypt_msdu)(struct sk_buff *skb, int keyidx, int hdr_len,
-			    void *priv);
-
-	int (*set_key)(void *key, int len, u8 *seq, void *priv);
-	int (*get_key)(void *key, int len, u8 *seq, void *priv);
-
-	/* procfs handler for printing out key information and possible
-	 * statistics */
-	char * (*print_stats)(char *p, void *priv);
-
-	/* maximum number of bytes added by encryption; encrypt buf is
-	 * allocated with extra_prefix_len bytes, copy of in_buf, and
-	 * extra_postfix_len; encrypt need not use all this space, but
-	 * the result must start at the beginning of the buffer and correct
-	 * length must be returned */
-	int extra_prefix_len, extra_postfix_len;
-
-	struct module *owner;
-};
-
-struct ieee80211_crypt_data {
-	struct list_head list; /* delayed deletion list */
-	struct ieee80211_crypto_ops *ops;
-	void *priv;
-	atomic_t refcnt;
-};
-
-int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops);
-int ieee80211_unregister_crypto_ops(struct ieee80211_crypto_ops *ops);
-struct ieee80211_crypto_ops * ieee80211_get_crypto_ops(const char *name);
-void ieee80211_crypt_deinit_entries(struct ieee80211_device *, int);
-void ieee80211_crypt_deinit_handler(unsigned long);
-void ieee80211_crypt_delayed_deinit(struct ieee80211_device *ieee,
-				    struct ieee80211_crypt_data **crypt);
-
-#endif
diff --git a/trunk/include/net/inet6_hashtables.h b/trunk/include/net/inet6_hashtables.h
deleted file mode 100644
index 03df3b157960..000000000000
--- a/trunk/include/net/inet6_hashtables.h
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * INET		An implementation of the TCP/IP protocol suite for the LINUX
- *		operating system.  INET is implemented using the BSD Socket
- *		interface as the means of communication with the user level.
- *
- * Authors:	Lotsa people, from code originally in tcp
- *
- *	This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-
-#ifndef _INET6_HASHTABLES_H
-#define _INET6_HASHTABLES_H
-
-#include <linux/config.h>
-
-#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
-#include <linux/in6.h>
-#include <linux/ipv6.h>
-#include <linux/types.h>
-
-#include <net/ipv6.h>
-
-struct inet_hashinfo;
-
-/* I have no idea if this is a good hash for v6 or not. -DaveM */
-static inline int inet6_ehashfn(const struct in6_addr *laddr, const u16 lport,
-				const struct in6_addr *faddr, const u16 fport,
-				const int ehash_size)
-{
-	int hashent = (lport ^ fport);
-
-	hashent ^= (laddr->s6_addr32[3] ^ faddr->s6_addr32[3]);
-	hashent ^= hashent >> 16;
-	hashent ^= hashent >> 8;
-	return (hashent & (ehash_size - 1));
-}
-
-static inline int inet6_sk_ehashfn(const struct sock *sk, const int ehash_size)
-{
-	const struct inet_sock *inet = inet_sk(sk);
-	const struct ipv6_pinfo *np = inet6_sk(sk);
-	const struct in6_addr *laddr = &np->rcv_saddr;
-	const struct in6_addr *faddr = &np->daddr;
-	const __u16 lport = inet->num;
-	const __u16 fport = inet->dport;
-	return inet6_ehashfn(laddr, lport, faddr, fport, ehash_size);
-}
-
-/*
- * Sockets in TCP_CLOSE state are _always_ taken out of the hash, so
- * we need not check it for TCP lookups anymore, thanks Alexey. -DaveM
- *
- * The sockhash lock must be held as a reader here.
- */
-static inline struct sock *
-		__inet6_lookup_established(struct inet_hashinfo *hashinfo,
-					   const struct in6_addr *saddr,
-					   const u16 sport,
-					   const struct in6_addr *daddr,
-					   const u16 hnum,
-					   const int dif)
-{
-	struct sock *sk;
-	const struct hlist_node *node;
-	const __u32 ports = INET_COMBINED_PORTS(sport, hnum);
-	/* Optimize here for direct hit, only listening connections can
-	 * have wildcards anyways.
-	 */
-	const int hash = inet6_ehashfn(daddr, hnum, saddr, sport,
-				       hashinfo->ehash_size);
-	struct inet_ehash_bucket *head = &hashinfo->ehash[hash];
-
-	read_lock(&head->lock);
-	sk_for_each(sk, node, &head->chain) {
-		/* For IPV6 do the cheaper port and family tests first. */
-		if (INET6_MATCH(sk, saddr, daddr, ports, dif))
-			goto hit; /* You sunk my battleship! */
-	}
-	/* Must check for a TIME_WAIT'er before going to listener hash. */
-	sk_for_each(sk, node, &(head + hashinfo->ehash_size)->chain) {
-		const struct inet_timewait_sock *tw = inet_twsk(sk);
-
-		if(*((__u32 *)&(tw->tw_dport))	== ports	&&
-		   sk->sk_family		== PF_INET6) {
-			const struct tcp6_timewait_sock *tcp6tw = tcp6_twsk(sk);
-
-			if (ipv6_addr_equal(&tcp6tw->tw_v6_daddr, saddr)	&&
-			    ipv6_addr_equal(&tcp6tw->tw_v6_rcv_saddr, daddr)	&&
-			    (!sk->sk_bound_dev_if || sk->sk_bound_dev_if == dif))
-				goto hit;
-		}
-	}
-	read_unlock(&head->lock);
-	return NULL;
-
-hit:
-	sock_hold(sk);
-	read_unlock(&head->lock);
-	return sk;
-}
-
-extern struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
-					  const struct in6_addr *daddr,
-					  const unsigned short hnum,
-					  const int dif);
-
-static inline struct sock *__inet6_lookup(struct inet_hashinfo *hashinfo,
-					  const struct in6_addr *saddr,
-					  const u16 sport,
-					  const struct in6_addr *daddr,
-					  const u16 hnum,
-					  const int dif)
-{
-	struct sock *sk = __inet6_lookup_established(hashinfo, saddr, sport,
-						     daddr, hnum, dif);
-	if (sk)
-		return sk;
-
-	return inet6_lookup_listener(hashinfo, daddr, hnum, dif);
-}
-
-extern struct sock *inet6_lookup(struct inet_hashinfo *hashinfo,
-				 const struct in6_addr *saddr, const u16 sport,
-				 const struct in6_addr *daddr, const u16 dport,
-				 const int dif);
-#endif /* defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE) */
-#endif /* _INET6_HASHTABLES_H */
diff --git a/trunk/include/net/inet_common.h b/trunk/include/net/inet_common.h
index f943306ce5ff..fbc1f4d140d8 100644
--- a/trunk/include/net/inet_common.h
+++ b/trunk/include/net/inet_common.h
@@ -8,11 +8,6 @@ extern struct proto_ops		inet_dgram_ops;
  *	INET4 prototypes used by INET6
  */
 
-struct msghdr;
-struct sock;
-struct sockaddr;
-struct socket;
-
 extern void			inet_remove_sock(struct sock *sk1);
 extern void			inet_put_sock(unsigned short num, 
 					      struct sock *sk);
@@ -34,6 +29,7 @@ extern unsigned int		inet_poll(struct file * file, struct socket *sock, struct p
 extern int			inet_listen(struct socket *sock, int backlog);
 
 extern void			inet_sock_destruct(struct sock *sk);
+extern atomic_t			inet_sock_nr;
 
 extern int			inet_bind(struct socket *sock, 
 					  struct sockaddr *uaddr, int addr_len);
diff --git a/trunk/include/net/inet_connection_sock.h b/trunk/include/net/inet_connection_sock.h
deleted file mode 100644
index 651f824c1008..000000000000
--- a/trunk/include/net/inet_connection_sock.h
+++ /dev/null
@@ -1,276 +0,0 @@
-/*
- * NET		Generic infrastructure for INET connection oriented protocols.
- *
- *		Definitions for inet_connection_sock 
- *
- * Authors:	Many people, see the TCP sources
- *
- * 		From code originally in TCP
- *
- *		This program is free software; you can redistribute it and/or
- *		modify it under the terms of the GNU General Public License
- *		as published by the Free Software Foundation; either version
- *		2 of the License, or (at your option) any later version.
- */
-#ifndef _INET_CONNECTION_SOCK_H
-#define _INET_CONNECTION_SOCK_H
-
-#include <linux/ip.h>
-#include <linux/string.h>
-#include <linux/timer.h>
-#include <net/request_sock.h>
-
-#define INET_CSK_DEBUG 1
-
-/* Cancel timers, when they are not required. */
-#undef INET_CSK_CLEAR_TIMERS
-
-struct inet_bind_bucket;
-struct inet_hashinfo;
-struct tcp_congestion_ops;
-
-/** inet_connection_sock - INET connection oriented sock
- *
- * @icsk_accept_queue:	   FIFO of established children 
- * @icsk_bind_hash:	   Bind node
- * @icsk_timeout:	   Timeout
- * @icsk_retransmit_timer: Resend (no ack)
- * @icsk_rto:		   Retransmit timeout
- * @icsk_ca_ops		   Pluggable congestion control hook
- * @icsk_ca_state:	   Congestion control state
- * @icsk_retransmits:	   Number of unrecovered [RTO] timeouts
- * @icsk_pending:	   Scheduled timer event
- * @icsk_backoff:	   Backoff
- * @icsk_syn_retries:      Number of allowed SYN (or equivalent) retries
- * @icsk_probes_out:	   unanswered 0 window probes
- * @icsk_ack:		   Delayed ACK control data
- */
-struct inet_connection_sock {
-	/* inet_sock has to be the first member! */
-	struct inet_sock	  icsk_inet;
-	struct request_sock_queue icsk_accept_queue;
-	struct inet_bind_bucket	  *icsk_bind_hash;
-	unsigned long		  icsk_timeout;
- 	struct timer_list	  icsk_retransmit_timer;
- 	struct timer_list	  icsk_delack_timer;
-	__u32			  icsk_rto;
-	struct tcp_congestion_ops *icsk_ca_ops;
-	__u8			  icsk_ca_state;
-	__u8			  icsk_retransmits;
-	__u8			  icsk_pending;
-	__u8			  icsk_backoff;
-	__u8			  icsk_syn_retries;
-	__u8			  icsk_probes_out;
-	/* 2 BYTES HOLE, TRY TO PACK! */
-	struct {
-		__u8		  pending;	 /* ACK is pending			   */
-		__u8		  quick;	 /* Scheduled number of quick acks	   */
-		__u8		  pingpong;	 /* The session is interactive		   */
-		__u8		  blocked;	 /* Delayed ACK was blocked by socket lock */
-		__u32		  ato;		 /* Predicted tick of soft clock	   */
-		unsigned long	  timeout;	 /* Currently scheduled timeout		   */
-		__u32		  lrcvtime;	 /* timestamp of last received data packet */
-		__u16		  last_seg_size; /* Size of last incoming segment	   */
-		__u16		  rcv_mss;	 /* MSS used for delayed ACK decisions	   */ 
-	} icsk_ack;
-	u32			  icsk_ca_priv[16];
-#define ICSK_CA_PRIV_SIZE	(16 * sizeof(u32))
-};
-
-#define ICSK_TIME_RETRANS	1	/* Retransmit timer */
-#define ICSK_TIME_DACK		2	/* Delayed ack timer */
-#define ICSK_TIME_PROBE0	3	/* Zero window probe timer */
-#define ICSK_TIME_KEEPOPEN	4	/* Keepalive timer */
-
-static inline struct inet_connection_sock *inet_csk(const struct sock *sk)
-{
-	return (struct inet_connection_sock *)sk;
-}
-
-static inline void *inet_csk_ca(const struct sock *sk)
-{
-	return (void *)inet_csk(sk)->icsk_ca_priv;
-}
-
-extern struct sock *inet_csk_clone(struct sock *sk,
-				   const struct request_sock *req,
-				   const unsigned int __nocast priority);
-
-enum inet_csk_ack_state_t {
-	ICSK_ACK_SCHED	= 1,
-	ICSK_ACK_TIMER  = 2,
-	ICSK_ACK_PUSHED = 4
-};
-
-extern void inet_csk_init_xmit_timers(struct sock *sk,
-				      void (*retransmit_handler)(unsigned long),
-				      void (*delack_handler)(unsigned long),
-				      void (*keepalive_handler)(unsigned long));
-extern void inet_csk_clear_xmit_timers(struct sock *sk);
-
-static inline void inet_csk_schedule_ack(struct sock *sk)
-{
-	inet_csk(sk)->icsk_ack.pending |= ICSK_ACK_SCHED;
-}
-
-static inline int inet_csk_ack_scheduled(const struct sock *sk)
-{
-	return inet_csk(sk)->icsk_ack.pending & ICSK_ACK_SCHED;
-}
-
-static inline void inet_csk_delack_init(struct sock *sk)
-{
-	memset(&inet_csk(sk)->icsk_ack, 0, sizeof(inet_csk(sk)->icsk_ack));
-}
-
-extern void inet_csk_delete_keepalive_timer(struct sock *sk);
-extern void inet_csk_reset_keepalive_timer(struct sock *sk, unsigned long timeout);
-
-#ifdef INET_CSK_DEBUG
-extern const char inet_csk_timer_bug_msg[];
-#endif
-
-static inline void inet_csk_clear_xmit_timer(struct sock *sk, const int what)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	
-	if (what == ICSK_TIME_RETRANS || what == ICSK_TIME_PROBE0) {
-		icsk->icsk_pending = 0;
-#ifdef INET_CSK_CLEAR_TIMERS
-		sk_stop_timer(sk, &icsk->icsk_retransmit_timer);
-#endif
-	} else if (what == ICSK_TIME_DACK) {
-		icsk->icsk_ack.blocked = icsk->icsk_ack.pending = 0;
-#ifdef INET_CSK_CLEAR_TIMERS
-		sk_stop_timer(sk, &icsk->icsk_delack_timer);
-#endif
-	}
-#ifdef INET_CSK_DEBUG
-	else {
-		pr_debug("%s", inet_csk_timer_bug_msg);
-	}
-#endif
-}
-
-/*
- *	Reset the retransmission timer
- */
-static inline void inet_csk_reset_xmit_timer(struct sock *sk, const int what,
-					     unsigned long when,
-					     const unsigned long max_when)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-
-	if (when > max_when) {
-#ifdef INET_CSK_DEBUG
-		pr_debug("reset_xmit_timer: sk=%p %d when=0x%lx, caller=%p\n",
-			 sk, what, when, current_text_addr());
-#endif
-		when = max_when;
-	}
-
-	if (what == ICSK_TIME_RETRANS || what == ICSK_TIME_PROBE0) {
-		icsk->icsk_pending = what;
-		icsk->icsk_timeout = jiffies + when;
-		sk_reset_timer(sk, &icsk->icsk_retransmit_timer, icsk->icsk_timeout);
-	} else if (what == ICSK_TIME_DACK) {
-		icsk->icsk_ack.pending |= ICSK_ACK_TIMER;
-		icsk->icsk_ack.timeout = jiffies + when;
-		sk_reset_timer(sk, &icsk->icsk_delack_timer, icsk->icsk_ack.timeout);
-	}
-#ifdef INET_CSK_DEBUG
-	else {
-		pr_debug("%s", inet_csk_timer_bug_msg);
-	}
-#endif
-}
-
-extern struct sock *inet_csk_accept(struct sock *sk, int flags, int *err);
-
-extern struct request_sock *inet_csk_search_req(const struct sock *sk,
-						struct request_sock ***prevp,
-						const __u16 rport,
-						const __u32 raddr,
-						const __u32 laddr);
-extern int inet_csk_get_port(struct inet_hashinfo *hashinfo,
-			     struct sock *sk, unsigned short snum);
-
-extern struct dst_entry* inet_csk_route_req(struct sock *sk,
-					    const struct request_sock *req);
-
-static inline void inet_csk_reqsk_queue_add(struct sock *sk,
-					    struct request_sock *req,
-					    struct sock *child)
-{
-	reqsk_queue_add(&inet_csk(sk)->icsk_accept_queue, req, sk, child);
-}
-
-extern void inet_csk_reqsk_queue_hash_add(struct sock *sk,
-					  struct request_sock *req,
-					  const unsigned timeout);
-
-static inline void inet_csk_reqsk_queue_removed(struct sock *sk,
-						struct request_sock *req)
-{
-	if (reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req) == 0)
-		inet_csk_delete_keepalive_timer(sk);
-}
-
-static inline void inet_csk_reqsk_queue_added(struct sock *sk,
-					      const unsigned long timeout)
-{
-	if (reqsk_queue_added(&inet_csk(sk)->icsk_accept_queue) == 0)
-		inet_csk_reset_keepalive_timer(sk, timeout);
-}
-
-static inline int inet_csk_reqsk_queue_len(const struct sock *sk)
-{
-	return reqsk_queue_len(&inet_csk(sk)->icsk_accept_queue);
-}
-
-static inline int inet_csk_reqsk_queue_young(const struct sock *sk)
-{
-	return reqsk_queue_len_young(&inet_csk(sk)->icsk_accept_queue);
-}
-
-static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)
-{
-	return reqsk_queue_is_full(&inet_csk(sk)->icsk_accept_queue);
-}
-
-static inline void inet_csk_reqsk_queue_unlink(struct sock *sk,
-					       struct request_sock *req,
-					       struct request_sock **prev)
-{
-	reqsk_queue_unlink(&inet_csk(sk)->icsk_accept_queue, req, prev);
-}
-
-static inline void inet_csk_reqsk_queue_drop(struct sock *sk,
-					     struct request_sock *req,
-					     struct request_sock **prev)
-{
-	inet_csk_reqsk_queue_unlink(sk, req, prev);
-	inet_csk_reqsk_queue_removed(sk, req);
-	reqsk_free(req);
-}
-
-extern void inet_csk_reqsk_queue_prune(struct sock *parent,
-				       const unsigned long interval,
-				       const unsigned long timeout,
-				       const unsigned long max_rto);
-
-extern void inet_csk_destroy_sock(struct sock *sk);
-
-/*
- * LISTEN is a special case for poll..
- */
-static inline unsigned int inet_csk_listen_poll(const struct sock *sk)
-{
-	return !reqsk_queue_empty(&inet_csk(sk)->icsk_accept_queue) ?
-			(POLLIN | POLLRDNORM) : 0;
-}
-
-extern int  inet_csk_listen_start(struct sock *sk, const int nr_table_entries);
-extern void inet_csk_listen_stop(struct sock *sk);
-
-#endif /* _INET_CONNECTION_SOCK_H */
diff --git a/trunk/include/net/inet_hashtables.h b/trunk/include/net/inet_hashtables.h
deleted file mode 100644
index 646b6ea7fe26..000000000000
--- a/trunk/include/net/inet_hashtables.h
+++ /dev/null
@@ -1,427 +0,0 @@
-/*
- * INET		An implementation of the TCP/IP protocol suite for the LINUX
- *		operating system.  INET is implemented using the BSD Socket
- *		interface as the means of communication with the user level.
- *
- * Authors:	Lotsa people, from code originally in tcp
- *
- *	This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-
-#ifndef _INET_HASHTABLES_H
-#define _INET_HASHTABLES_H
-
-#include <linux/config.h>
-
-#include <linux/interrupt.h>
-#include <linux/ipv6.h>
-#include <linux/list.h>
-#include <linux/slab.h>
-#include <linux/socket.h>
-#include <linux/spinlock.h>
-#include <linux/types.h>
-#include <linux/wait.h>
-
-#include <net/inet_connection_sock.h>
-#include <net/route.h>
-#include <net/sock.h>
-#include <net/tcp_states.h>
-
-#include <asm/atomic.h>
-#include <asm/byteorder.h>
-
-/* This is for all connections with a full identity, no wildcards.
- * New scheme, half the table is for TIME_WAIT, the other half is
- * for the rest.  I'll experiment with dynamic table growth later.
- */
-struct inet_ehash_bucket {
-	rwlock_t	  lock;
-	struct hlist_head chain;
-} __attribute__((__aligned__(8)));
-
-/* There are a few simple rules, which allow for local port reuse by
- * an application.  In essence:
- *
- *	1) Sockets bound to different interfaces may share a local port.
- *	   Failing that, goto test 2.
- *	2) If all sockets have sk->sk_reuse set, and none of them are in
- *	   TCP_LISTEN state, the port may be shared.
- *	   Failing that, goto test 3.
- *	3) If all sockets are bound to a specific inet_sk(sk)->rcv_saddr local
- *	   address, and none of them are the same, the port may be
- *	   shared.
- *	   Failing this, the port cannot be shared.
- *
- * The interesting point, is test #2.  This is what an FTP server does
- * all day.  To optimize this case we use a specific flag bit defined
- * below.  As we add sockets to a bind bucket list, we perform a
- * check of: (newsk->sk_reuse && (newsk->sk_state != TCP_LISTEN))
- * As long as all sockets added to a bind bucket pass this test,
- * the flag bit will be set.
- * The resulting situation is that tcp_v[46]_verify_bind() can just check
- * for this flag bit, if it is set and the socket trying to bind has
- * sk->sk_reuse set, we don't even have to walk the owners list at all,
- * we return that it is ok to bind this socket to the requested local port.
- *
- * Sounds like a lot of work, but it is worth it.  In a more naive
- * implementation (ie. current FreeBSD etc.) the entire list of ports
- * must be walked for each data port opened by an ftp server.  Needless
- * to say, this does not scale at all.  With a couple thousand FTP
- * users logged onto your box, isn't it nice to know that new data
- * ports are created in O(1) time?  I thought so. ;-)	-DaveM
- */
-struct inet_bind_bucket {
-	unsigned short		port;
-	signed short		fastreuse;
-	struct hlist_node	node;
-	struct hlist_head	owners;
-};
-
-#define inet_bind_bucket_for_each(tb, node, head) \
-	hlist_for_each_entry(tb, node, head, node)
-
-struct inet_bind_hashbucket {
-	spinlock_t		lock;
-	struct hlist_head	chain;
-};
-
-/* This is for listening sockets, thus all sockets which possess wildcards. */
-#define INET_LHTABLE_SIZE	32	/* Yes, really, this is all you need. */
-
-struct inet_hashinfo {
-	/* This is for sockets with full identity only.  Sockets here will
-	 * always be without wildcards and will have the following invariant:
-	 *
-	 *          TCP_ESTABLISHED <= sk->sk_state < TCP_CLOSE
-	 *
-	 * First half of the table is for sockets not in TIME_WAIT, second half
-	 * is for TIME_WAIT sockets only.
-	 */
-	struct inet_ehash_bucket	*ehash;
-
-	/* Ok, let's try this, I give up, we do need a local binding
-	 * TCP hash as well as the others for fast bind/connect.
-	 */
-	struct inet_bind_hashbucket	*bhash;
-
-	int				bhash_size;
-	int				ehash_size;
-
-	/* All sockets in TCP_LISTEN state will be in here.  This is the only
-	 * table where wildcard'd TCP sockets can exist.  Hash function here
-	 * is just local port number.
-	 */
-	struct hlist_head		listening_hash[INET_LHTABLE_SIZE];
-
-	/* All the above members are written once at bootup and
-	 * never written again _or_ are predominantly read-access.
-	 *
-	 * Now align to a new cache line as all the following members
-	 * are often dirty.
-	 */
-	rwlock_t			lhash_lock ____cacheline_aligned;
-	atomic_t			lhash_users;
-	wait_queue_head_t		lhash_wait;
-	spinlock_t			portalloc_lock;
-	kmem_cache_t			*bind_bucket_cachep;
-	int				port_rover;
-};
-
-static inline int inet_ehashfn(const __u32 laddr, const __u16 lport,
-			       const __u32 faddr, const __u16 fport,
-			       const int ehash_size)
-{
-	int h = (laddr ^ lport) ^ (faddr ^ fport);
-	h ^= h >> 16;
-	h ^= h >> 8;
-	return h & (ehash_size - 1);
-}
-
-static inline int inet_sk_ehashfn(const struct sock *sk, const int ehash_size)
-{
-	const struct inet_sock *inet = inet_sk(sk);
-	const __u32 laddr = inet->rcv_saddr;
-	const __u16 lport = inet->num;
-	const __u32 faddr = inet->daddr;
-	const __u16 fport = inet->dport;
-
-	return inet_ehashfn(laddr, lport, faddr, fport, ehash_size);
-}
-
-extern struct inet_bind_bucket *
-		    inet_bind_bucket_create(kmem_cache_t *cachep,
-					    struct inet_bind_hashbucket *head,
-					    const unsigned short snum);
-extern void inet_bind_bucket_destroy(kmem_cache_t *cachep,
-				     struct inet_bind_bucket *tb);
-
-static inline int inet_bhashfn(const __u16 lport, const int bhash_size)
-{
-	return lport & (bhash_size - 1);
-}
-
-extern void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
-			   const unsigned short snum);
-
-/* These can have wildcards, don't try too hard. */
-static inline int inet_lhashfn(const unsigned short num)
-{
-	return num & (INET_LHTABLE_SIZE - 1);
-}
-
-static inline int inet_sk_listen_hashfn(const struct sock *sk)
-{
-	return inet_lhashfn(inet_sk(sk)->num);
-}
-
-/* Caller must disable local BH processing. */
-static inline void __inet_inherit_port(struct inet_hashinfo *table,
-				       struct sock *sk, struct sock *child)
-{
-	const int bhash = inet_bhashfn(inet_sk(child)->num, table->bhash_size);
-	struct inet_bind_hashbucket *head = &table->bhash[bhash];
-	struct inet_bind_bucket *tb;
-
-	spin_lock(&head->lock);
-	tb = inet_csk(sk)->icsk_bind_hash;
-	sk_add_bind_node(child, &tb->owners);
-	inet_csk(child)->icsk_bind_hash = tb;
-	spin_unlock(&head->lock);
-}
-
-static inline void inet_inherit_port(struct inet_hashinfo *table,
-				     struct sock *sk, struct sock *child)
-{
-	local_bh_disable();
-	__inet_inherit_port(table, sk, child);
-	local_bh_enable();
-}
-
-extern void inet_put_port(struct inet_hashinfo *table, struct sock *sk);
-
-extern void inet_listen_wlock(struct inet_hashinfo *hashinfo);
-
-/*
- * - We may sleep inside this lock.
- * - If sleeping is not required (or called from BH),
- *   use plain read_(un)lock(&inet_hashinfo.lhash_lock).
- */
-static inline void inet_listen_lock(struct inet_hashinfo *hashinfo)
-{
-	/* read_lock synchronizes to candidates to writers */
-	read_lock(&hashinfo->lhash_lock);
-	atomic_inc(&hashinfo->lhash_users);
-	read_unlock(&hashinfo->lhash_lock);
-}
-
-static inline void inet_listen_unlock(struct inet_hashinfo *hashinfo)
-{
-	if (atomic_dec_and_test(&hashinfo->lhash_users))
-		wake_up(&hashinfo->lhash_wait);
-}
-
-static inline void __inet_hash(struct inet_hashinfo *hashinfo,
-			       struct sock *sk, const int listen_possible)
-{
-	struct hlist_head *list;
-	rwlock_t *lock;
-
-	BUG_TRAP(sk_unhashed(sk));
-	if (listen_possible && sk->sk_state == TCP_LISTEN) {
-		list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
-		lock = &hashinfo->lhash_lock;
-		inet_listen_wlock(hashinfo);
-	} else {
-		sk->sk_hashent = inet_sk_ehashfn(sk, hashinfo->ehash_size);
-		list = &hashinfo->ehash[sk->sk_hashent].chain;
-		lock = &hashinfo->ehash[sk->sk_hashent].lock;
-		write_lock(lock);
-	}
-	__sk_add_node(sk, list);
-	sock_prot_inc_use(sk->sk_prot);
-	write_unlock(lock);
-	if (listen_possible && sk->sk_state == TCP_LISTEN)
-		wake_up(&hashinfo->lhash_wait);
-}
-
-static inline void inet_hash(struct inet_hashinfo *hashinfo, struct sock *sk)
-{
-	if (sk->sk_state != TCP_CLOSE) {
-		local_bh_disable();
-		__inet_hash(hashinfo, sk, 1);
-		local_bh_enable();
-	}
-}
-
-static inline void inet_unhash(struct inet_hashinfo *hashinfo, struct sock *sk)
-{
-	rwlock_t *lock;
-
-	if (sk_unhashed(sk))
-		goto out;
-
-	if (sk->sk_state == TCP_LISTEN) {
-		local_bh_disable();
-		inet_listen_wlock(hashinfo);
-		lock = &hashinfo->lhash_lock;
-	} else {
-		struct inet_ehash_bucket *head = &hashinfo->ehash[sk->sk_hashent];
-		lock = &head->lock;
-		write_lock_bh(&head->lock);
-	}
-
-	if (__sk_del_node_init(sk))
-		sock_prot_dec_use(sk->sk_prot);
-	write_unlock_bh(lock);
-out:
-	if (sk->sk_state == TCP_LISTEN)
-		wake_up(&hashinfo->lhash_wait);
-}
-
-static inline int inet_iif(const struct sk_buff *skb)
-{
-	return ((struct rtable *)skb->dst)->rt_iif;
-}
-
-extern struct sock *__inet_lookup_listener(const struct hlist_head *head,
-					   const u32 daddr,
-					   const unsigned short hnum,
-					   const int dif);
-
-/* Optimize the common listener case. */
-static inline struct sock *
-		inet_lookup_listener(struct inet_hashinfo *hashinfo,
-				     const u32 daddr,
-				     const unsigned short hnum, const int dif)
-{
-	struct sock *sk = NULL;
-	const struct hlist_head *head;
-
-	read_lock(&hashinfo->lhash_lock);
-	head = &hashinfo->listening_hash[inet_lhashfn(hnum)];
-	if (!hlist_empty(head)) {
-		const struct inet_sock *inet = inet_sk((sk = __sk_head(head)));
-
-		if (inet->num == hnum && !sk->sk_node.next &&
-		    (!inet->rcv_saddr || inet->rcv_saddr == daddr) &&
-		    (sk->sk_family == PF_INET || !ipv6_only_sock(sk)) &&
-		    !sk->sk_bound_dev_if)
-			goto sherry_cache;
-		sk = __inet_lookup_listener(head, daddr, hnum, dif);
-	}
-	if (sk) {
-sherry_cache:
-		sock_hold(sk);
-	}
-	read_unlock(&hashinfo->lhash_lock);
-	return sk;
-}
-
-/* Socket demux engine toys. */
-#ifdef __BIG_ENDIAN
-#define INET_COMBINED_PORTS(__sport, __dport) \
-	(((__u32)(__sport) << 16) | (__u32)(__dport))
-#else /* __LITTLE_ENDIAN */
-#define INET_COMBINED_PORTS(__sport, __dport) \
-	(((__u32)(__dport) << 16) | (__u32)(__sport))
-#endif
-
-#if (BITS_PER_LONG == 64)
-#ifdef __BIG_ENDIAN
-#define INET_ADDR_COOKIE(__name, __saddr, __daddr) \
-	const __u64 __name = (((__u64)(__saddr)) << 32) | ((__u64)(__daddr));
-#else /* __LITTLE_ENDIAN */
-#define INET_ADDR_COOKIE(__name, __saddr, __daddr) \
-	const __u64 __name = (((__u64)(__daddr)) << 32) | ((__u64)(__saddr));
-#endif /* __BIG_ENDIAN */
-#define INET_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
-	(((*((__u64 *)&(inet_sk(__sk)->daddr))) == (__cookie))	&&	\
-	 ((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))	&&	\
-	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#define INET_TW_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
-	(((*((__u64 *)&(inet_twsk(__sk)->tw_daddr))) == (__cookie)) &&	\
-	 ((*((__u32 *)&(inet_twsk(__sk)->tw_dport))) == (__ports)) &&	\
-	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#else /* 32-bit arch */
-#define INET_ADDR_COOKIE(__name, __saddr, __daddr)
-#define INET_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)	\
-	((inet_sk(__sk)->daddr		== (__saddr))		&&	\
-	 (inet_sk(__sk)->rcv_saddr	== (__daddr))		&&	\
-	 ((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))	&&	\
-	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#define INET_TW_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)	\
-	((inet_twsk(__sk)->tw_daddr	== (__saddr))		&&	\
-	 (inet_twsk(__sk)->tw_rcv_saddr	== (__daddr))		&&	\
-	 ((*((__u32 *)&(inet_twsk(__sk)->tw_dport))) == (__ports)) &&	\
-	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#endif /* 64-bit arch */
-
-/*
- * Sockets in TCP_CLOSE state are _always_ taken out of the hash, so we need
- * not check it for lookups anymore, thanks Alexey. -DaveM
- *
- * Local BH must be disabled here.
- */
-static inline struct sock *
-	__inet_lookup_established(struct inet_hashinfo *hashinfo,
-				  const u32 saddr, const u16 sport,
-				  const u32 daddr, const u16 hnum,
-				  const int dif)
-{
-	INET_ADDR_COOKIE(acookie, saddr, daddr)
-	const __u32 ports = INET_COMBINED_PORTS(sport, hnum);
-	struct sock *sk;
-	const struct hlist_node *node;
-	/* Optimize here for direct hit, only listening connections can
-	 * have wildcards anyways.
-	 */
-	const int hash = inet_ehashfn(daddr, hnum, saddr, sport, hashinfo->ehash_size);
-	struct inet_ehash_bucket *head = &hashinfo->ehash[hash];
-
-	read_lock(&head->lock);
-	sk_for_each(sk, node, &head->chain) {
-		if (INET_MATCH(sk, acookie, saddr, daddr, ports, dif))
-			goto hit; /* You sunk my battleship! */
-	}
-
-	/* Must check for a TIME_WAIT'er before going to listener hash. */
-	sk_for_each(sk, node, &(head + hashinfo->ehash_size)->chain) {
-		if (INET_TW_MATCH(sk, acookie, saddr, daddr, ports, dif))
-			goto hit;
-	}
-	sk = NULL;
-out:
-	read_unlock(&head->lock);
-	return sk;
-hit:
-	sock_hold(sk);
-	goto out;
-}
-
-static inline struct sock *__inet_lookup(struct inet_hashinfo *hashinfo,
-					 const u32 saddr, const u16 sport,
-					 const u32 daddr, const u16 hnum,
-					 const int dif)
-{
-	struct sock *sk = __inet_lookup_established(hashinfo, saddr, sport, daddr,
-						    hnum, dif);
-	return sk ? : inet_lookup_listener(hashinfo, daddr, hnum, dif);
-}
-
-static inline struct sock *inet_lookup(struct inet_hashinfo *hashinfo,
-				       const u32 saddr, const u16 sport,
-				       const u32 daddr, const u16 dport,
-				       const int dif)
-{
-	struct sock *sk;
-
-	local_bh_disable();
-	sk = __inet_lookup(hashinfo, saddr, sport, daddr, ntohs(dport), dif);
-	local_bh_enable();
-
-	return sk;
-}
-#endif /* _INET_HASHTABLES_H */
diff --git a/trunk/include/net/inet_timewait_sock.h b/trunk/include/net/inet_timewait_sock.h
deleted file mode 100644
index 3b070352e869..000000000000
--- a/trunk/include/net/inet_timewait_sock.h
+++ /dev/null
@@ -1,219 +0,0 @@
-/*
- * INET		An implementation of the TCP/IP protocol suite for the LINUX
- *		operating system.  INET is implemented using the  BSD Socket
- *		interface as the means of communication with the user level.
- *
- *		Definitions for a generic INET TIMEWAIT sock
- *
- *		From code originally in net/tcp.h
- *
- *		This program is free software; you can redistribute it and/or
- *		modify it under the terms of the GNU General Public License
- *		as published by the Free Software Foundation; either version
- *		2 of the License, or (at your option) any later version.
- */
-#ifndef _INET_TIMEWAIT_SOCK_
-#define _INET_TIMEWAIT_SOCK_
-
-#include <linux/config.h>
-
-#include <linux/ip.h>
-#include <linux/list.h>
-#include <linux/timer.h>
-#include <linux/types.h>
-#include <linux/workqueue.h>
-
-#include <net/sock.h>
-#include <net/tcp_states.h>
-
-#include <asm/atomic.h>
-
-struct inet_hashinfo;
-
-#define INET_TWDR_RECYCLE_SLOTS_LOG	5
-#define INET_TWDR_RECYCLE_SLOTS		(1 << INET_TWDR_RECYCLE_SLOTS_LOG)
-
-/*
- * If time > 4sec, it is "slow" path, no recycling is required,
- * so that we select tick to get range about 4 seconds.
- */
-#if HZ <= 16 || HZ > 4096
-# error Unsupported: HZ <= 16 or HZ > 4096
-#elif HZ <= 32
-# define INET_TWDR_RECYCLE_TICK (5 + 2 - INET_TWDR_RECYCLE_SLOTS_LOG)
-#elif HZ <= 64
-# define INET_TWDR_RECYCLE_TICK (6 + 2 - INET_TWDR_RECYCLE_SLOTS_LOG)
-#elif HZ <= 128
-# define INET_TWDR_RECYCLE_TICK (7 + 2 - INET_TWDR_RECYCLE_SLOTS_LOG)
-#elif HZ <= 256
-# define INET_TWDR_RECYCLE_TICK (8 + 2 - INET_TWDR_RECYCLE_SLOTS_LOG)
-#elif HZ <= 512
-# define INET_TWDR_RECYCLE_TICK (9 + 2 - INET_TWDR_RECYCLE_SLOTS_LOG)
-#elif HZ <= 1024
-# define INET_TWDR_RECYCLE_TICK (10 + 2 - INET_TWDR_RECYCLE_SLOTS_LOG)
-#elif HZ <= 2048
-# define INET_TWDR_RECYCLE_TICK (11 + 2 - INET_TWDR_RECYCLE_SLOTS_LOG)
-#else
-# define INET_TWDR_RECYCLE_TICK (12 + 2 - INET_TWDR_RECYCLE_SLOTS_LOG)
-#endif
-
-/* TIME_WAIT reaping mechanism. */
-#define INET_TWDR_TWKILL_SLOTS	8 /* Please keep this a power of 2. */
-
-#define INET_TWDR_TWKILL_QUOTA 100
-
-struct inet_timewait_death_row {
-	/* Short-time timewait calendar */
-	int			twcal_hand;
-	int			twcal_jiffie;
-	struct timer_list	twcal_timer;
-	struct hlist_head	twcal_row[INET_TWDR_RECYCLE_SLOTS];
-
-	spinlock_t		death_lock;
-	int			tw_count;
-	int			period;
-	u32			thread_slots;
-	struct work_struct	twkill_work;
-	struct timer_list	tw_timer;
-	int			slot;
-	struct hlist_head	cells[INET_TWDR_TWKILL_SLOTS];
-	struct inet_hashinfo 	*hashinfo;
-	int			sysctl_tw_recycle;
-	int			sysctl_max_tw_buckets;
-};
-
-extern void inet_twdr_hangman(unsigned long data);
-extern void inet_twdr_twkill_work(void *data);
-extern void inet_twdr_twcal_tick(unsigned long data);
-
-#if (BITS_PER_LONG == 64)
-#define INET_TIMEWAIT_ADDRCMP_ALIGN_BYTES 8
-#else
-#define INET_TIMEWAIT_ADDRCMP_ALIGN_BYTES 4
-#endif
-
-struct inet_bind_bucket;
-
-/*
- * This is a TIME_WAIT sock. It works around the memory consumption
- * problems of sockets in such a state on heavily loaded servers, but
- * without violating the protocol specification.
- */
-struct inet_timewait_sock {
-	/*
-	 * Now struct sock also uses sock_common, so please just
-	 * don't add nothing before this first member (__tw_common) --acme
-	 */
-	struct sock_common	__tw_common;
-#define tw_family		__tw_common.skc_family
-#define tw_state		__tw_common.skc_state
-#define tw_reuse		__tw_common.skc_reuse
-#define tw_bound_dev_if		__tw_common.skc_bound_dev_if
-#define tw_node			__tw_common.skc_node
-#define tw_bind_node		__tw_common.skc_bind_node
-#define tw_refcnt		__tw_common.skc_refcnt
-#define tw_prot			__tw_common.skc_prot
-	volatile unsigned char	tw_substate;
-	/* 3 bits hole, try to pack */
-	unsigned char		tw_rcv_wscale;
-	/* Socket demultiplex comparisons on incoming packets. */
-	/* these five are in inet_sock */
-	__u16			tw_sport;
-	__u32			tw_daddr __attribute__((aligned(INET_TIMEWAIT_ADDRCMP_ALIGN_BYTES)));
-	__u32			tw_rcv_saddr;
-	__u16			tw_dport;
-	__u16			tw_num;
-	/* And these are ours. */
-	__u8			tw_ipv6only:1;
-	/* 31 bits hole, try to pack */
-	int			tw_hashent;
-	int			tw_timeout;
-	unsigned long		tw_ttd;
-	struct inet_bind_bucket	*tw_tb;
-	struct hlist_node	tw_death_node;
-};
-
-static inline void inet_twsk_add_node(struct inet_timewait_sock *tw,
-				      struct hlist_head *list)
-{
-	hlist_add_head(&tw->tw_node, list);
-}
-
-static inline void inet_twsk_add_bind_node(struct inet_timewait_sock *tw,
-					   struct hlist_head *list)
-{
-	hlist_add_head(&tw->tw_bind_node, list);
-}
-
-static inline int inet_twsk_dead_hashed(const struct inet_timewait_sock *tw)
-{
-	return tw->tw_death_node.pprev != NULL;
-}
-
-static inline void inet_twsk_dead_node_init(struct inet_timewait_sock *tw)
-{
-	tw->tw_death_node.pprev = NULL;
-}
-
-static inline void __inet_twsk_del_dead_node(struct inet_timewait_sock *tw)
-{
-	__hlist_del(&tw->tw_death_node);
-	inet_twsk_dead_node_init(tw);
-}
-
-static inline int inet_twsk_del_dead_node(struct inet_timewait_sock *tw)
-{
-	if (inet_twsk_dead_hashed(tw)) {
-		__inet_twsk_del_dead_node(tw);
-		return 1;
-	}
-	return 0;
-}
-
-#define inet_twsk_for_each(tw, node, head) \
-	hlist_for_each_entry(tw, node, head, tw_node)
-
-#define inet_twsk_for_each_inmate(tw, node, jail) \
-	hlist_for_each_entry(tw, node, jail, tw_death_node)
-
-#define inet_twsk_for_each_inmate_safe(tw, node, safe, jail) \
-	hlist_for_each_entry_safe(tw, node, safe, jail, tw_death_node)
-
-static inline struct inet_timewait_sock *inet_twsk(const struct sock *sk)
-{
-	return (struct inet_timewait_sock *)sk;
-}
-
-static inline u32 inet_rcv_saddr(const struct sock *sk)
-{
-	return likely(sk->sk_state != TCP_TIME_WAIT) ?
-		inet_sk(sk)->rcv_saddr : inet_twsk(sk)->tw_rcv_saddr;
-}
-
-static inline void inet_twsk_put(struct inet_timewait_sock *tw)
-{
-	if (atomic_dec_and_test(&tw->tw_refcnt)) {
-#ifdef SOCK_REFCNT_DEBUG
-		printk(KERN_DEBUG "%s timewait_sock %p released\n",
-		       tw->tw_prot->name, tw);
-#endif
-		kmem_cache_free(tw->tw_prot->twsk_slab, tw);
-	}
-}
-
-extern struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk,
-						  const int state);
-
-extern void __inet_twsk_kill(struct inet_timewait_sock *tw,
-			     struct inet_hashinfo *hashinfo);
-
-extern void __inet_twsk_hashdance(struct inet_timewait_sock *tw,
-				  struct sock *sk,
-				  struct inet_hashinfo *hashinfo);
-
-extern void inet_twsk_schedule(struct inet_timewait_sock *tw,
-			       struct inet_timewait_death_row *twdr,
-			       const int timeo, const int timewait_len);
-extern void inet_twsk_deschedule(struct inet_timewait_sock *tw,
-				 struct inet_timewait_death_row *twdr);
-#endif	/* _INET_TIMEWAIT_SOCK_ */
diff --git a/trunk/include/net/ip.h b/trunk/include/net/ip.h
index e4563bbee6ea..32360bbe143f 100644
--- a/trunk/include/net/ip.h
+++ b/trunk/include/net/ip.h
@@ -86,7 +86,7 @@ extern int		ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
 					      u32 saddr, u32 daddr,
 					      struct ip_options *opt);
 extern int		ip_rcv(struct sk_buff *skb, struct net_device *dev,
-			       struct packet_type *pt, struct net_device *orig_dev);
+			       struct packet_type *pt);
 extern int		ip_local_deliver(struct sk_buff *skb);
 extern int		ip_mr_input(struct sk_buff *skb);
 extern int		ip_output(struct sk_buff *skb);
@@ -140,6 +140,8 @@ struct ip_reply_arg {
 void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *arg,
 		   unsigned int len); 
 
+extern int ip_finish_output(struct sk_buff *skb);
+
 struct ipv4_config
 {
 	int	log_martians;
@@ -163,24 +165,6 @@ extern int sysctl_local_port_range[2];
 extern int sysctl_ip_default_ttl;
 extern int sysctl_ip_nonlocal_bind;
 
-/* From ip_fragment.c */
-extern int sysctl_ipfrag_high_thresh; 
-extern int sysctl_ipfrag_low_thresh;
-extern int sysctl_ipfrag_time;
-extern int sysctl_ipfrag_secret_interval;
-
-/* From inetpeer.c */
-extern int inet_peer_threshold;
-extern int inet_peer_minttl;
-extern int inet_peer_maxttl;
-extern int inet_peer_gc_mintime;
-extern int inet_peer_gc_maxtime;
-
-/* From ip_output.c */
-extern int sysctl_ip_dynaddr;
-
-extern void ipfrag_init(void);
-
 #ifdef CONFIG_INET
 /* The function in 2.2 was invalid, producing wrong result for
  * check=0xFEFF. It was noticed by Arthur Skawina _year_ ago. --ANK(000625) */
@@ -335,10 +319,7 @@ extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt, u32 da
 extern int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb);
 extern void ip_options_fragment(struct sk_buff *skb);
 extern int ip_options_compile(struct ip_options *opt, struct sk_buff *skb);
-extern int ip_options_get(struct ip_options **optp,
-			  unsigned char *data, int optlen);
-extern int ip_options_get_from_user(struct ip_options **optp,
-				    unsigned char __user *data, int optlen);
+extern int ip_options_get(struct ip_options **optp, unsigned char *data, int optlen, int user);
 extern void ip_options_undo(struct ip_options * opt);
 extern void ip_forward_options(struct sk_buff *skb);
 extern int ip_options_rcv_srr(struct sk_buff *skb);
@@ -369,10 +350,5 @@ int ipv4_doint_and_flush_strategy(ctl_table *table, int __user *name, int nlen,
 				  void __user *oldval, size_t __user *oldlenp,
 				  void __user *newval, size_t newlen, 
 				  void **context);
-#ifdef CONFIG_PROC_FS
-extern int ip_misc_proc_init(void);
-#endif
-
-extern struct ctl_table ipv4_table[];
 
 #endif	/* _IP_H */
diff --git a/trunk/include/net/ip6_route.h b/trunk/include/net/ip6_route.h
index 1f2e428ca364..f920706d526b 100644
--- a/trunk/include/net/ip6_route.h
+++ b/trunk/include/net/ip6_route.h
@@ -12,6 +12,7 @@
 #include <net/flow.h>
 #include <net/ip6_fib.h>
 #include <net/sock.h>
+#include <linux/tcp.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 
diff --git a/trunk/include/net/ip_fib.h b/trunk/include/net/ip_fib.h
index 14de4ebd1211..a4208a336ac0 100644
--- a/trunk/include/net/ip_fib.h
+++ b/trunk/include/net/ip_fib.h
@@ -295,9 +295,4 @@ static inline void fib_res_put(struct fib_result *res)
 #endif
 }
 
-#ifdef CONFIG_PROC_FS
-extern int  fib_proc_init(void);
-extern void fib_proc_exit(void);
-#endif
-
 #endif  /* _NET_FIB_H */
diff --git a/trunk/include/net/ip_vs.h b/trunk/include/net/ip_vs.h
index 7a3c43711a17..52da5d26617a 100644
--- a/trunk/include/net/ip_vs.h
+++ b/trunk/include/net/ip_vs.h
@@ -255,6 +255,7 @@ struct ip_vs_daemon_user {
 #include <asm/atomic.h>                 /* for struct atomic_t */
 #include <linux/netdevice.h>		/* for struct neighbour */
 #include <net/dst.h>			/* for struct dst_entry */
+#include <net/tcp.h>
 #include <net/udp.h>
 #include <linux/compiler.h>
 
diff --git a/trunk/include/net/ipv6.h b/trunk/include/net/ipv6.h
index 3203eaff4bd4..69324465e8b3 100644
--- a/trunk/include/net/ipv6.h
+++ b/trunk/include/net/ipv6.h
@@ -104,7 +104,6 @@ struct frag_hdr {
 
 #ifdef __KERNEL__
 
-#include <linux/config.h>
 #include <net/sock.h>
 
 /* sysctls */
@@ -146,6 +145,7 @@ DECLARE_SNMP_STAT(struct udp_mib, udp_stats_in6);
 #define UDP6_INC_STATS(field)		SNMP_INC_STATS(udp_stats_in6, field)
 #define UDP6_INC_STATS_BH(field)	SNMP_INC_STATS_BH(udp_stats_in6, field)
 #define UDP6_INC_STATS_USER(field) 	SNMP_INC_STATS_USER(udp_stats_in6, field)
+extern atomic_t			inet6_sock_nr;
 
 int snmp6_register_dev(struct inet6_dev *idev);
 int snmp6_unregister_dev(struct inet6_dev *idev);
@@ -346,8 +346,7 @@ static inline int ipv6_addr_any(const struct in6_addr *a)
 
 extern int			ipv6_rcv(struct sk_buff *skb, 
 					 struct net_device *dev, 
-					 struct packet_type *pt,
-					 struct net_device *orig_dev);
+					 struct packet_type *pt);
 
 /*
  *	upper-layer output functions
@@ -465,38 +464,8 @@ extern int sysctl_ip6frag_low_thresh;
 extern int sysctl_ip6frag_time;
 extern int sysctl_ip6frag_secret_interval;
 
-extern struct proto_ops inet6_stream_ops;
-extern struct proto_ops inet6_dgram_ops;
-
-extern int ip6_mc_source(int add, int omode, struct sock *sk,
-			 struct group_source_req *pgsr);
-extern int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf);
-extern int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
-			 struct group_filter __user *optval,
-			 int __user *optlen);
-
-#ifdef CONFIG_PROC_FS
-extern int  ac6_proc_init(void);
-extern void ac6_proc_exit(void);
-extern int  raw6_proc_init(void);
-extern void raw6_proc_exit(void);
-extern int  tcp6_proc_init(void);
-extern void tcp6_proc_exit(void);
-extern int  udp6_proc_init(void);
-extern void udp6_proc_exit(void);
-extern int  ipv6_misc_proc_init(void);
-extern void ipv6_misc_proc_exit(void);
-
-extern struct rt6_statistics rt6_stats;
-#endif
+#endif /* __KERNEL__ */
+#endif /* _NET_IPV6_H */
 
-#ifdef CONFIG_SYSCTL
-extern ctl_table ipv6_route_table[];
-extern ctl_table ipv6_icmp_table[];
 
-extern void ipv6_sysctl_register(void);
-extern void ipv6_sysctl_unregister(void);
-#endif
 
-#endif /* __KERNEL__ */
-#endif /* _NET_IPV6_H */
diff --git a/trunk/include/net/llc.h b/trunk/include/net/llc.h
index 71769a5aeef3..c9aed2a8b4e2 100644
--- a/trunk/include/net/llc.h
+++ b/trunk/include/net/llc.h
@@ -46,8 +46,7 @@ struct llc_sap {
 	unsigned char	 f_bit;
 	int		 (*rcv_func)(struct sk_buff *skb,
 				     struct net_device *dev,
-				     struct packet_type *pt,
-				     struct net_device *orig_dev);
+				     struct packet_type *pt);
 	struct llc_addr	 laddr;
 	struct list_head node;
 	struct {
@@ -65,7 +64,7 @@ extern rwlock_t llc_sap_list_lock;
 extern unsigned char llc_station_mac_sa[ETH_ALEN];
 
 extern int llc_rcv(struct sk_buff *skb, struct net_device *dev,
-		   struct packet_type *pt, struct net_device *orig_dev);
+		   struct packet_type *pt);
 
 extern int llc_mac_hdr_init(struct sk_buff *skb,
 			    unsigned char *sa, unsigned char *da);
@@ -79,8 +78,7 @@ extern void llc_set_station_handler(void (*handler)(struct sk_buff *skb));
 extern struct llc_sap *llc_sap_open(unsigned char lsap,
 				    int (*rcv)(struct sk_buff *skb,
 					       struct net_device *dev,
-					       struct packet_type *pt,
-					       struct net_device *orig_dev));
+					       struct packet_type *pt));
 extern void llc_sap_close(struct llc_sap *sap);
 
 extern struct llc_sap *llc_sap_find(unsigned char sap_value);
diff --git a/trunk/include/net/neighbour.h b/trunk/include/net/neighbour.h
index 34c07731933d..89809891e5ab 100644
--- a/trunk/include/net/neighbour.h
+++ b/trunk/include/net/neighbour.h
@@ -363,14 +363,7 @@ __neigh_lookup_errno(struct neigh_table *tbl, const void *pkey,
 	return neigh_create(tbl, pkey, dev);
 }
 
-struct neighbour_cb {
-	unsigned long sched_next;
-	unsigned int flags;
-};
-
-#define LOCALLY_ENQUEUED 0x1
-
-#define NEIGH_CB(skb)	((struct neighbour_cb *)(skb)->cb)
+#define LOCALLY_ENQUEUED -2
 
 #endif
 #endif
diff --git a/trunk/include/net/p8022.h b/trunk/include/net/p8022.h
index 42e9fac51b31..3c99a86c3581 100644
--- a/trunk/include/net/p8022.h
+++ b/trunk/include/net/p8022.h
@@ -4,10 +4,7 @@ extern struct datalink_proto *
 	register_8022_client(unsigned char type,
 			     int (*func)(struct sk_buff *skb,
 					 struct net_device *dev,
-					 struct packet_type *pt,
-					 struct net_device *orig_dev));
+					 struct packet_type *pt));
 extern void unregister_8022_client(struct datalink_proto *proto);
 
-extern struct datalink_proto *make_8023_client(void);
-extern void destroy_8023_client(struct datalink_proto *dl);
 #endif
diff --git a/trunk/include/net/pkt_cls.h b/trunk/include/net/pkt_cls.h
index b902d24a3256..4abda6aec05a 100644
--- a/trunk/include/net/pkt_cls.h
+++ b/trunk/include/net/pkt_cls.h
@@ -352,10 +352,10 @@ tcf_change_indev(struct tcf_proto *tp, char *indev, struct rtattr *indev_tlv)
 static inline int
 tcf_match_indev(struct sk_buff *skb, char *indev)
 {
-	if (indev[0]) {
-		if  (!skb->input_dev)
+	if (0 != indev[0]) {
+		if  (NULL == skb->input_dev)
 			return 0;
-		if (strcmp(indev, skb->input_dev->name))
+		else if (0 != strcmp(indev, skb->input_dev->name))
 			return 0;
 	}
 
diff --git a/trunk/include/net/psnap.h b/trunk/include/net/psnap.h
index b2e01cc3fc8a..9c94e8f98b36 100644
--- a/trunk/include/net/psnap.h
+++ b/trunk/include/net/psnap.h
@@ -1,7 +1,7 @@
 #ifndef _NET_PSNAP_H
 #define _NET_PSNAP_H
 
-extern struct datalink_proto *register_snap_client(unsigned char *desc, int (*rcvfunc)(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *orig_dev));
+extern struct datalink_proto *register_snap_client(unsigned char *desc, int (*rcvfunc)(struct sk_buff *, struct net_device *, struct packet_type *));
 extern void unregister_snap_client(struct datalink_proto *proto);
 
 #endif
diff --git a/trunk/include/net/raw.h b/trunk/include/net/raw.h
index f47917469b12..1c411c45587a 100644
--- a/trunk/include/net/raw.h
+++ b/trunk/include/net/raw.h
@@ -17,10 +17,10 @@
 #ifndef _RAW_H
 #define _RAW_H
 
-#include <linux/config.h>
 
 extern struct proto raw_prot;
 
+
 extern void 	raw_err(struct sock *, struct sk_buff *, u32 info);
 extern int 	raw_rcv(struct sock *, struct sk_buff *);
 
@@ -37,11 +37,6 @@ extern struct sock *__raw_v4_lookup(struct sock *sk, unsigned short num,
 				    unsigned long raddr, unsigned long laddr,
 				    int dif);
 
-extern int raw_v4_input(struct sk_buff *skb, struct iphdr *iph, int hash);
-
-#ifdef CONFIG_PROC_FS
-extern int  raw_proc_init(void);
-extern void raw_proc_exit(void);
-#endif
+extern void raw_v4_input(struct sk_buff *skb, struct iphdr *iph, int hash);
 
 #endif	/* _RAW_H */
diff --git a/trunk/include/net/rawv6.h b/trunk/include/net/rawv6.h
index 14476a71725e..23fd9a6a221a 100644
--- a/trunk/include/net/rawv6.h
+++ b/trunk/include/net/rawv6.h
@@ -7,11 +7,10 @@
 extern struct hlist_head raw_v6_htable[RAWV6_HTABLE_SIZE];
 extern rwlock_t raw_v6_lock;
 
-extern int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr);
+extern void ipv6_raw_deliver(struct sk_buff *skb, int nexthdr);
 
 extern struct sock *__raw_v6_lookup(struct sock *sk, unsigned short num,
-				    struct in6_addr *loc_addr, struct in6_addr *rmt_addr,
-				    int dif);
+				    struct in6_addr *loc_addr, struct in6_addr *rmt_addr);
 
 extern int			rawv6_rcv(struct sock *sk,
 					  struct sk_buff *skb);
diff --git a/trunk/include/net/request_sock.h b/trunk/include/net/request_sock.h
index b52cc52ffe39..72fd6f5e86b1 100644
--- a/trunk/include/net/request_sock.h
+++ b/trunk/include/net/request_sock.h
@@ -89,7 +89,6 @@ struct listen_sock {
 	int			qlen_young;
 	int			clock_hand;
 	u32			hash_rnd;
-	u32			nr_table_entries;
 	struct request_sock	*syn_table[0];
 };
 
@@ -97,7 +96,6 @@ struct listen_sock {
  *
  * @rskq_accept_head - FIFO head of established children
  * @rskq_accept_tail - FIFO tail of established children
- * @rskq_defer_accept - User waits for some data after accept()
  * @syn_wait_lock - serializer
  *
  * %syn_wait_lock is necessary only to avoid proc interface having to grab the main
@@ -113,8 +111,6 @@ struct request_sock_queue {
 	struct request_sock	*rskq_accept_head;
 	struct request_sock	*rskq_accept_tail;
 	rwlock_t		syn_wait_lock;
-	u8			rskq_defer_accept;
-	/* 3 bytes hole, try to pack */
 	struct listen_sock	*listen_opt;
 };
 
@@ -133,13 +129,11 @@ static inline struct listen_sock *reqsk_queue_yank_listen_sk(struct request_sock
 	return lopt;
 }
 
-static inline void __reqsk_queue_destroy(struct request_sock_queue *queue)
+static inline void reqsk_queue_destroy(struct request_sock_queue *queue)
 {
 	kfree(reqsk_queue_yank_listen_sk(queue));
 }
 
-extern void reqsk_queue_destroy(struct request_sock_queue *queue);
-
 static inline struct request_sock *
 	reqsk_queue_yank_acceptq(struct request_sock_queue *queue)
 {
@@ -227,17 +221,17 @@ static inline int reqsk_queue_added(struct request_sock_queue *queue)
 	return prev_qlen;
 }
 
-static inline int reqsk_queue_len(const struct request_sock_queue *queue)
+static inline int reqsk_queue_len(struct request_sock_queue *queue)
 {
 	return queue->listen_opt != NULL ? queue->listen_opt->qlen : 0;
 }
 
-static inline int reqsk_queue_len_young(const struct request_sock_queue *queue)
+static inline int reqsk_queue_len_young(struct request_sock_queue *queue)
 {
 	return queue->listen_opt->qlen_young;
 }
 
-static inline int reqsk_queue_is_full(const struct request_sock_queue *queue)
+static inline int reqsk_queue_is_full(struct request_sock_queue *queue)
 {
 	return queue->listen_opt->qlen >> queue->listen_opt->max_qlen_log;
 }
diff --git a/trunk/include/net/route.h b/trunk/include/net/route.h
index dbe79ca67d31..c3cd069a9aca 100644
--- a/trunk/include/net/route.h
+++ b/trunk/include/net/route.h
@@ -105,6 +105,10 @@ struct rt_cache_stat
         unsigned int out_hlist_search;
 };
 
+extern struct rt_cache_stat *rt_cache_stat;
+#define RT_CACHE_STAT_INC(field)					  \
+		(per_cpu_ptr(rt_cache_stat, raw_smp_processor_id())->field++)
+
 extern struct ip_rt_acct *ip_rt_acct;
 
 struct in_device;
@@ -195,6 +199,4 @@ static inline struct inet_peer *rt_get_peer(struct rtable *rt)
 	return rt->peer;
 }
 
-extern ctl_table ipv4_route_table[];
-
 #endif	/* _ROUTE_H */
diff --git a/trunk/include/net/sctp/constants.h b/trunk/include/net/sctp/constants.h
index c51541ee0247..5999e5684bbf 100644
--- a/trunk/include/net/sctp/constants.h
+++ b/trunk/include/net/sctp/constants.h
@@ -47,10 +47,10 @@
 #ifndef __sctp_constants_h__
 #define __sctp_constants_h__
 
+#include <linux/tcp.h>  /* For TCP states used in sctp_sock_state_t */
 #include <linux/sctp.h>
 #include <linux/ipv6.h> /* For ipv6hdr. */
 #include <net/sctp/user.h>
-#include <net/tcp_states.h>  /* For TCP states used in sctp_sock_state_t */
 
 /* Value used for stream negotiation. */
 enum { SCTP_MAX_STREAM = 0xffff };
diff --git a/trunk/include/net/sock.h b/trunk/include/net/sock.h
index 312cb25cbd18..e9b1dbab90d0 100644
--- a/trunk/include/net/sock.h
+++ b/trunk/include/net/sock.h
@@ -88,7 +88,6 @@ do {	spin_lock_init(&((__sk)->sk_lock.slock)); \
 } while(0)
 
 struct sock;
-struct proto;
 
 /**
  *	struct sock_common - minimal network layer representation of sockets
@@ -99,11 +98,10 @@ struct proto;
  *	@skc_node: main hash linkage for various protocol lookup tables
  *	@skc_bind_node: bind hash linkage for various protocol lookup tables
  *	@skc_refcnt: reference count
- *	@skc_prot: protocol handlers inside a network family
  *
  *	This is the minimal network layer representation of sockets, the header
- *	for struct sock and struct inet_timewait_sock.
- */
+ *	for struct sock and struct tcp_tw_bucket.
+  */
 struct sock_common {
 	unsigned short		skc_family;
 	volatile unsigned char	skc_state;
@@ -112,12 +110,11 @@ struct sock_common {
 	struct hlist_node	skc_node;
 	struct hlist_node	skc_bind_node;
 	atomic_t		skc_refcnt;
-	struct proto		*skc_prot;
 };
 
 /**
   *	struct sock - network layer representation of sockets
-  *	@__sk_common: shared layout with inet_timewait_sock
+  *	@__sk_common: shared layout with tcp_tw_bucket
   *	@sk_shutdown: mask of %SEND_SHUTDOWN and/or %RCV_SHUTDOWN
   *	@sk_userlocks: %SO_SNDBUF and %SO_RCVBUF settings
   *	@sk_lock:	synchronizer
@@ -139,10 +136,11 @@ struct sock_common {
   *	@sk_no_check: %SO_NO_CHECK setting, wether or not checkup packets
   *	@sk_route_caps: route capabilities (e.g. %NETIF_F_TSO)
   *	@sk_lingertime: %SO_LINGER l_linger setting
-  *	@sk_hashent: hash entry in several tables (e.g. inet_hashinfo.ehash)
+  *	@sk_hashent: hash entry in several tables (e.g. tcp_ehash)
   *	@sk_backlog: always used with the per-socket spinlock held
   *	@sk_callback_lock: used with the callbacks in the end of this struct
   *	@sk_error_queue: rarely used
+  *	@sk_prot: protocol handlers inside a network family
   *	@sk_prot_creator: sk_prot of original sock creator (see ipv6_setsockopt, IPV6_ADDRFORM for instance)
   *	@sk_err: last error
   *	@sk_err_soft: errors that don't cause failure but are the cause of a persistent failure not just 'timed out'
@@ -175,7 +173,7 @@ struct sock_common {
  */
 struct sock {
 	/*
-	 * Now struct inet_timewait_sock also uses sock_common, so please just
+	 * Now struct tcp_tw_bucket also uses sock_common, so please just
 	 * don't add nothing before this first member (__sk_common) --acme
 	 */
 	struct sock_common	__sk_common;
@@ -186,7 +184,6 @@ struct sock {
 #define sk_node			__sk_common.skc_node
 #define sk_bind_node		__sk_common.skc_bind_node
 #define sk_refcnt		__sk_common.skc_refcnt
-#define sk_prot			__sk_common.skc_prot
 	unsigned char		sk_shutdown : 2,
 				sk_no_check : 2,
 				sk_userlocks : 4;
@@ -221,6 +218,7 @@ struct sock {
 		struct sk_buff *tail;
 	} sk_backlog;
 	struct sk_buff_head	sk_error_queue;
+	struct proto		*sk_prot;
 	struct proto		*sk_prot_creator;
 	rwlock_t		sk_callback_lock;
 	int			sk_err,
@@ -255,28 +253,28 @@ struct sock {
 /*
  * Hashed lists helper routines
  */
-static inline struct sock *__sk_head(const struct hlist_head *head)
+static inline struct sock *__sk_head(struct hlist_head *head)
 {
 	return hlist_entry(head->first, struct sock, sk_node);
 }
 
-static inline struct sock *sk_head(const struct hlist_head *head)
+static inline struct sock *sk_head(struct hlist_head *head)
 {
 	return hlist_empty(head) ? NULL : __sk_head(head);
 }
 
-static inline struct sock *sk_next(const struct sock *sk)
+static inline struct sock *sk_next(struct sock *sk)
 {
 	return sk->sk_node.next ?
 		hlist_entry(sk->sk_node.next, struct sock, sk_node) : NULL;
 }
 
-static inline int sk_unhashed(const struct sock *sk)
+static inline int sk_unhashed(struct sock *sk)
 {
 	return hlist_unhashed(&sk->sk_node);
 }
 
-static inline int sk_hashed(const struct sock *sk)
+static inline int sk_hashed(struct sock *sk)
 {
 	return sk->sk_node.pprev != NULL;
 }
@@ -556,10 +554,6 @@ struct proto {
 	kmem_cache_t		*slab;
 	unsigned int		obj_size;
 
-	kmem_cache_t		*twsk_slab;
-	unsigned int		twsk_obj_size;
-	atomic_t		*orphan_count;
-
 	struct request_sock_ops	*rsk_prot;
 
 	struct module		*owner;
@@ -567,9 +561,7 @@ struct proto {
 	char			name[32];
 
 	struct list_head	node;
-#ifdef SOCK_REFCNT_DEBUG
-	atomic_t		socks;
-#endif
+
 	struct {
 		int inuse;
 		u8  __pad[SMP_CACHE_BYTES - sizeof(int)];
@@ -579,31 +571,6 @@ struct proto {
 extern int proto_register(struct proto *prot, int alloc_slab);
 extern void proto_unregister(struct proto *prot);
 
-#ifdef SOCK_REFCNT_DEBUG
-static inline void sk_refcnt_debug_inc(struct sock *sk)
-{
-	atomic_inc(&sk->sk_prot->socks);
-}
-
-static inline void sk_refcnt_debug_dec(struct sock *sk)
-{
-	atomic_dec(&sk->sk_prot->socks);
-	printk(KERN_DEBUG "%s socket %p released, %d are still alive\n",
-	       sk->sk_prot->name, sk, atomic_read(&sk->sk_prot->socks));
-}
-
-static inline void sk_refcnt_debug_release(const struct sock *sk)
-{
-	if (atomic_read(&sk->sk_refcnt) != 1)
-		printk(KERN_DEBUG "Destruction of the %s socket %p delayed, refcnt=%d\n",
-		       sk->sk_prot->name, sk, atomic_read(&sk->sk_refcnt));
-}
-#else /* SOCK_REFCNT_DEBUG */
-#define sk_refcnt_debug_inc(sk) do { } while (0)
-#define sk_refcnt_debug_dec(sk) do { } while (0)
-#define sk_refcnt_debug_release(sk) do { } while (0)
-#endif /* SOCK_REFCNT_DEBUG */
-
 /* Called with local bh disabled */
 static __inline__ void sock_prot_inc_use(struct proto *prot)
 {
@@ -615,15 +582,6 @@ static __inline__ void sock_prot_dec_use(struct proto *prot)
 	prot->stats[smp_processor_id()].inuse--;
 }
 
-/* With per-bucket locks this operation is not-atomic, so that
- * this version is not worse.
- */
-static inline void __sk_prot_rehash(struct sock *sk)
-{
-	sk->sk_prot->unhash(sk);
-	sk->sk_prot->hash(sk);
-}
-
 /* About 10 seconds */
 #define SOCK_DESTROY_TIME (10*HZ)
 
@@ -735,8 +693,6 @@ extern struct sock		*sk_alloc(int family,
 					  unsigned int __nocast priority,
 					  struct proto *prot, int zero_it);
 extern void			sk_free(struct sock *sk);
-extern struct sock		*sk_clone(const struct sock *sk,
-					  const unsigned int __nocast priority);
 
 extern struct sk_buff		*sock_wmalloc(struct sock *sk,
 					      unsigned long size, int force,
@@ -1030,16 +986,6 @@ sk_dst_check(struct sock *sk, u32 cookie)
 	return dst;
 }
 
-static inline void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
-{
-	__sk_dst_set(sk, dst);
-	sk->sk_route_caps = dst->dev->features;
-	if (sk->sk_route_caps & NETIF_F_TSO) {
-		if (sock_flag(sk, SOCK_NO_LARGESEND) || dst->header_len)
-			sk->sk_route_caps &= ~NETIF_F_TSO;
-	}
-}
-
 static inline void sk_charge_skb(struct sock *sk, struct sk_buff *skb)
 {
 	sk->sk_wmem_queued   += skb->truesize;
@@ -1200,7 +1146,7 @@ static inline struct sk_buff *sk_stream_alloc_pskb(struct sock *sk,
 	int hdr_len;
 
 	hdr_len = SKB_DATA_ALIGN(sk->sk_prot->max_header);
-	skb = alloc_skb_fclone(size + hdr_len, gfp);
+	skb = alloc_skb(size + hdr_len, gfp);
 	if (skb) {
 		skb->truesize += mem;
 		if (sk->sk_forward_alloc >= (int)skb->truesize ||
@@ -1282,19 +1228,16 @@ static inline int sock_intr_errno(long timeo)
 static __inline__ void
 sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
 {
-	struct timeval stamp;
-
-	skb_get_timestamp(skb, &stamp);
+	struct timeval *stamp = &skb->stamp;
 	if (sock_flag(sk, SOCK_RCVTSTAMP)) {
 		/* Race occurred between timestamp enabling and packet
 		   receiving.  Fill in the current time for now. */
-		if (stamp.tv_sec == 0)
-			do_gettimeofday(&stamp);
-		skb_set_timestamp(skb, &stamp);
+		if (stamp->tv_sec == 0)
+			do_gettimeofday(stamp);
 		put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMP, sizeof(struct timeval),
-			 &stamp);
+			 stamp);
 	} else
-		sk->sk_stamp = stamp;
+		sk->sk_stamp = *stamp;
 }
 
 /**
@@ -1319,11 +1262,11 @@ extern int sock_get_timestamp(struct sock *, struct timeval __user *);
  */
 
 #if 0
-#define NETDEBUG(fmt, args...)	do { } while (0)
-#define LIMIT_NETDEBUG(fmt, args...) do { } while(0)
+#define NETDEBUG(x)	do { } while (0)
+#define LIMIT_NETDEBUG(x) do {} while(0)
 #else
-#define NETDEBUG(fmt, args...)	printk(fmt,##args)
-#define LIMIT_NETDEBUG(fmt, args...) do { if (net_ratelimit()) printk(fmt,##args); } while(0)
+#define NETDEBUG(x)	do { x; } while (0)
+#define LIMIT_NETDEBUG(x) do { if (net_ratelimit()) { x; } } while(0)
 #endif
 
 /*
@@ -1370,14 +1313,4 @@ static inline int siocdevprivate_ioctl(unsigned int fd, unsigned int cmd, unsign
 }
 #endif
 
-extern void sk_init(void);
-
-#ifdef CONFIG_SYSCTL
-extern struct ctl_table core_table[];
-extern int sysctl_optmem_max;
-#endif
-
-extern __u32 sysctl_wmem_default;
-extern __u32 sysctl_rmem_default;
-
 #endif	/* _SOCK_H */
diff --git a/trunk/include/net/tcp.h b/trunk/include/net/tcp.h
index d6bcf1317a6a..5010f0c5a56e 100644
--- a/trunk/include/net/tcp.h
+++ b/trunk/include/net/tcp.h
@@ -21,29 +21,360 @@
 #define TCP_DEBUG 1
 #define FASTRETRANS_DEBUG 1
 
+/* Cancel timers, when they are not required. */
+#undef TCP_CLEAR_TIMERS
+
 #include <linux/config.h>
 #include <linux/list.h>
 #include <linux/tcp.h>
 #include <linux/slab.h>
 #include <linux/cache.h>
 #include <linux/percpu.h>
-
-#include <net/inet_connection_sock.h>
-#include <net/inet_timewait_sock.h>
-#include <net/inet_hashtables.h>
 #include <net/checksum.h>
 #include <net/request_sock.h>
 #include <net/sock.h>
 #include <net/snmp.h>
 #include <net/ip.h>
-#include <net/tcp_states.h>
-
+#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
+#include <linux/ipv6.h>
+#endif
 #include <linux/seq_file.h>
 
-extern struct inet_hashinfo tcp_hashinfo;
+/* This is for all connections with a full identity, no wildcards.
+ * New scheme, half the table is for TIME_WAIT, the other half is
+ * for the rest.  I'll experiment with dynamic table growth later.
+ */
+struct tcp_ehash_bucket {
+	rwlock_t	  lock;
+	struct hlist_head chain;
+} __attribute__((__aligned__(8)));
+
+/* This is for listening sockets, thus all sockets which possess wildcards. */
+#define TCP_LHTABLE_SIZE	32	/* Yes, really, this is all you need. */
+
+/* There are a few simple rules, which allow for local port reuse by
+ * an application.  In essence:
+ *
+ *	1) Sockets bound to different interfaces may share a local port.
+ *	   Failing that, goto test 2.
+ *	2) If all sockets have sk->sk_reuse set, and none of them are in
+ *	   TCP_LISTEN state, the port may be shared.
+ *	   Failing that, goto test 3.
+ *	3) If all sockets are bound to a specific inet_sk(sk)->rcv_saddr local
+ *	   address, and none of them are the same, the port may be
+ *	   shared.
+ *	   Failing this, the port cannot be shared.
+ *
+ * The interesting point, is test #2.  This is what an FTP server does
+ * all day.  To optimize this case we use a specific flag bit defined
+ * below.  As we add sockets to a bind bucket list, we perform a
+ * check of: (newsk->sk_reuse && (newsk->sk_state != TCP_LISTEN))
+ * As long as all sockets added to a bind bucket pass this test,
+ * the flag bit will be set.
+ * The resulting situation is that tcp_v[46]_verify_bind() can just check
+ * for this flag bit, if it is set and the socket trying to bind has
+ * sk->sk_reuse set, we don't even have to walk the owners list at all,
+ * we return that it is ok to bind this socket to the requested local port.
+ *
+ * Sounds like a lot of work, but it is worth it.  In a more naive
+ * implementation (ie. current FreeBSD etc.) the entire list of ports
+ * must be walked for each data port opened by an ftp server.  Needless
+ * to say, this does not scale at all.  With a couple thousand FTP
+ * users logged onto your box, isn't it nice to know that new data
+ * ports are created in O(1) time?  I thought so. ;-)	-DaveM
+ */
+struct tcp_bind_bucket {
+	unsigned short		port;
+	signed short		fastreuse;
+	struct hlist_node	node;
+	struct hlist_head	owners;
+};
+
+#define tb_for_each(tb, node, head) hlist_for_each_entry(tb, node, head, node)
+
+struct tcp_bind_hashbucket {
+	spinlock_t		lock;
+	struct hlist_head	chain;
+};
+
+static inline struct tcp_bind_bucket *__tb_head(struct tcp_bind_hashbucket *head)
+{
+	return hlist_entry(head->chain.first, struct tcp_bind_bucket, node);
+}
+
+static inline struct tcp_bind_bucket *tb_head(struct tcp_bind_hashbucket *head)
+{
+	return hlist_empty(&head->chain) ? NULL : __tb_head(head);
+}
+
+extern struct tcp_hashinfo {
+	/* This is for sockets with full identity only.  Sockets here will
+	 * always be without wildcards and will have the following invariant:
+	 *
+	 *          TCP_ESTABLISHED <= sk->sk_state < TCP_CLOSE
+	 *
+	 * First half of the table is for sockets not in TIME_WAIT, second half
+	 * is for TIME_WAIT sockets only.
+	 */
+	struct tcp_ehash_bucket *__tcp_ehash;
+
+	/* Ok, let's try this, I give up, we do need a local binding
+	 * TCP hash as well as the others for fast bind/connect.
+	 */
+	struct tcp_bind_hashbucket *__tcp_bhash;
+
+	int __tcp_bhash_size;
+	int __tcp_ehash_size;
+
+	/* All sockets in TCP_LISTEN state will be in here.  This is the only
+	 * table where wildcard'd TCP sockets can exist.  Hash function here
+	 * is just local port number.
+	 */
+	struct hlist_head __tcp_listening_hash[TCP_LHTABLE_SIZE];
+
+	/* All the above members are written once at bootup and
+	 * never written again _or_ are predominantly read-access.
+	 *
+	 * Now align to a new cache line as all the following members
+	 * are often dirty.
+	 */
+	rwlock_t __tcp_lhash_lock ____cacheline_aligned;
+	atomic_t __tcp_lhash_users;
+	wait_queue_head_t __tcp_lhash_wait;
+	spinlock_t __tcp_portalloc_lock;
+} tcp_hashinfo;
+
+#define tcp_ehash	(tcp_hashinfo.__tcp_ehash)
+#define tcp_bhash	(tcp_hashinfo.__tcp_bhash)
+#define tcp_ehash_size	(tcp_hashinfo.__tcp_ehash_size)
+#define tcp_bhash_size	(tcp_hashinfo.__tcp_bhash_size)
+#define tcp_listening_hash (tcp_hashinfo.__tcp_listening_hash)
+#define tcp_lhash_lock	(tcp_hashinfo.__tcp_lhash_lock)
+#define tcp_lhash_users	(tcp_hashinfo.__tcp_lhash_users)
+#define tcp_lhash_wait	(tcp_hashinfo.__tcp_lhash_wait)
+#define tcp_portalloc_lock (tcp_hashinfo.__tcp_portalloc_lock)
+
+extern kmem_cache_t *tcp_bucket_cachep;
+extern struct tcp_bind_bucket *tcp_bucket_create(struct tcp_bind_hashbucket *head,
+						 unsigned short snum);
+extern void tcp_bucket_destroy(struct tcp_bind_bucket *tb);
+extern void tcp_bucket_unlock(struct sock *sk);
+extern int tcp_port_rover;
+
+/* These are AF independent. */
+static __inline__ int tcp_bhashfn(__u16 lport)
+{
+	return (lport & (tcp_bhash_size - 1));
+}
+
+extern void tcp_bind_hash(struct sock *sk, struct tcp_bind_bucket *tb,
+			  unsigned short snum);
+
+#if (BITS_PER_LONG == 64)
+#define TCP_ADDRCMP_ALIGN_BYTES 8
+#else
+#define TCP_ADDRCMP_ALIGN_BYTES 4
+#endif
+
+/* This is a TIME_WAIT bucket.  It works around the memory consumption
+ * problems of sockets in such a state on heavily loaded servers, but
+ * without violating the protocol specification.
+ */
+struct tcp_tw_bucket {
+	/*
+	 * Now struct sock also uses sock_common, so please just
+	 * don't add nothing before this first member (__tw_common) --acme
+	 */
+	struct sock_common	__tw_common;
+#define tw_family		__tw_common.skc_family
+#define tw_state		__tw_common.skc_state
+#define tw_reuse		__tw_common.skc_reuse
+#define tw_bound_dev_if		__tw_common.skc_bound_dev_if
+#define tw_node			__tw_common.skc_node
+#define tw_bind_node		__tw_common.skc_bind_node
+#define tw_refcnt		__tw_common.skc_refcnt
+	volatile unsigned char	tw_substate;
+	unsigned char		tw_rcv_wscale;
+	__u16			tw_sport;
+	/* Socket demultiplex comparisons on incoming packets. */
+	/* these five are in inet_sock */
+	__u32			tw_daddr
+		__attribute__((aligned(TCP_ADDRCMP_ALIGN_BYTES)));
+	__u32			tw_rcv_saddr;
+	__u16			tw_dport;
+	__u16			tw_num;
+	/* And these are ours. */
+	int			tw_hashent;
+	int			tw_timeout;
+	__u32			tw_rcv_nxt;
+	__u32			tw_snd_nxt;
+	__u32			tw_rcv_wnd;
+	__u32			tw_ts_recent;
+	long			tw_ts_recent_stamp;
+	unsigned long		tw_ttd;
+	struct tcp_bind_bucket	*tw_tb;
+	struct hlist_node	tw_death_node;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+	struct in6_addr		tw_v6_daddr;
+	struct in6_addr		tw_v6_rcv_saddr;
+	int			tw_v6_ipv6only;
+#endif
+};
+
+static __inline__ void tw_add_node(struct tcp_tw_bucket *tw,
+				   struct hlist_head *list)
+{
+	hlist_add_head(&tw->tw_node, list);
+}
+
+static __inline__ void tw_add_bind_node(struct tcp_tw_bucket *tw,
+					struct hlist_head *list)
+{
+	hlist_add_head(&tw->tw_bind_node, list);
+}
+
+static inline int tw_dead_hashed(struct tcp_tw_bucket *tw)
+{
+	return tw->tw_death_node.pprev != NULL;
+}
+
+static __inline__ void tw_dead_node_init(struct tcp_tw_bucket *tw)
+{
+	tw->tw_death_node.pprev = NULL;
+}
+
+static __inline__ void __tw_del_dead_node(struct tcp_tw_bucket *tw)
+{
+	__hlist_del(&tw->tw_death_node);
+	tw_dead_node_init(tw);
+}
+
+static __inline__ int tw_del_dead_node(struct tcp_tw_bucket *tw)
+{
+	if (tw_dead_hashed(tw)) {
+		__tw_del_dead_node(tw);
+		return 1;
+	}
+	return 0;
+}
+
+#define tw_for_each(tw, node, head) \
+	hlist_for_each_entry(tw, node, head, tw_node)
+
+#define tw_for_each_inmate(tw, node, jail) \
+	hlist_for_each_entry(tw, node, jail, tw_death_node)
+
+#define tw_for_each_inmate_safe(tw, node, safe, jail) \
+	hlist_for_each_entry_safe(tw, node, safe, jail, tw_death_node)
+
+#define tcptw_sk(__sk)	((struct tcp_tw_bucket *)(__sk))
+
+static inline u32 tcp_v4_rcv_saddr(const struct sock *sk)
+{
+	return likely(sk->sk_state != TCP_TIME_WAIT) ?
+		inet_sk(sk)->rcv_saddr : tcptw_sk(sk)->tw_rcv_saddr;
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static inline struct in6_addr *__tcp_v6_rcv_saddr(const struct sock *sk)
+{
+	return likely(sk->sk_state != TCP_TIME_WAIT) ?
+		&inet6_sk(sk)->rcv_saddr : &tcptw_sk(sk)->tw_v6_rcv_saddr;
+}
+
+static inline struct in6_addr *tcp_v6_rcv_saddr(const struct sock *sk)
+{
+	return sk->sk_family == AF_INET6 ? __tcp_v6_rcv_saddr(sk) : NULL;
+}
+
+#define tcptw_sk_ipv6only(__sk)	(tcptw_sk(__sk)->tw_v6_ipv6only)
+
+static inline int tcp_v6_ipv6only(const struct sock *sk)
+{
+	return likely(sk->sk_state != TCP_TIME_WAIT) ?
+		ipv6_only_sock(sk) : tcptw_sk_ipv6only(sk);
+}
+#else
+# define __tcp_v6_rcv_saddr(__sk)	NULL
+# define tcp_v6_rcv_saddr(__sk)		NULL
+# define tcptw_sk_ipv6only(__sk)	0
+# define tcp_v6_ipv6only(__sk)		0
+#endif
+
+extern kmem_cache_t *tcp_timewait_cachep;
+
+static inline void tcp_tw_put(struct tcp_tw_bucket *tw)
+{
+	if (atomic_dec_and_test(&tw->tw_refcnt)) {
+#ifdef INET_REFCNT_DEBUG
+		printk(KERN_DEBUG "tw_bucket %p released\n", tw);
+#endif
+		kmem_cache_free(tcp_timewait_cachep, tw);
+	}
+}
 
 extern atomic_t tcp_orphan_count;
+extern int tcp_tw_count;
 extern void tcp_time_wait(struct sock *sk, int state, int timeo);
+extern void tcp_tw_deschedule(struct tcp_tw_bucket *tw);
+
+
+/* Socket demux engine toys. */
+#ifdef __BIG_ENDIAN
+#define TCP_COMBINED_PORTS(__sport, __dport) \
+	(((__u32)(__sport)<<16) | (__u32)(__dport))
+#else /* __LITTLE_ENDIAN */
+#define TCP_COMBINED_PORTS(__sport, __dport) \
+	(((__u32)(__dport)<<16) | (__u32)(__sport))
+#endif
+
+#if (BITS_PER_LONG == 64)
+#ifdef __BIG_ENDIAN
+#define TCP_V4_ADDR_COOKIE(__name, __saddr, __daddr) \
+	__u64 __name = (((__u64)(__saddr))<<32)|((__u64)(__daddr));
+#else /* __LITTLE_ENDIAN */
+#define TCP_V4_ADDR_COOKIE(__name, __saddr, __daddr) \
+	__u64 __name = (((__u64)(__daddr))<<32)|((__u64)(__saddr));
+#endif /* __BIG_ENDIAN */
+#define TCP_IPV4_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
+	(((*((__u64 *)&(inet_sk(__sk)->daddr)))== (__cookie))	&&	\
+	 ((*((__u32 *)&(inet_sk(__sk)->dport)))== (__ports))	&&	\
+	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
+#define TCP_IPV4_TW_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
+	(((*((__u64 *)&(tcptw_sk(__sk)->tw_daddr))) == (__cookie)) &&	\
+	 ((*((__u32 *)&(tcptw_sk(__sk)->tw_dport))) == (__ports)) &&	\
+	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
+#else /* 32-bit arch */
+#define TCP_V4_ADDR_COOKIE(__name, __saddr, __daddr)
+#define TCP_IPV4_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
+	((inet_sk(__sk)->daddr			== (__saddr))	&&	\
+	 (inet_sk(__sk)->rcv_saddr		== (__daddr))	&&	\
+	 ((*((__u32 *)&(inet_sk(__sk)->dport)))== (__ports))	&&	\
+	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
+#define TCP_IPV4_TW_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
+	((tcptw_sk(__sk)->tw_daddr		== (__saddr))	&&	\
+	 (tcptw_sk(__sk)->tw_rcv_saddr		== (__daddr))	&&	\
+	 ((*((__u32 *)&(tcptw_sk(__sk)->tw_dport))) == (__ports)) &&	\
+	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
+#endif /* 64-bit arch */
+
+#define TCP_IPV6_MATCH(__sk, __saddr, __daddr, __ports, __dif)	   \
+	(((*((__u32 *)&(inet_sk(__sk)->dport)))== (__ports))   	&& \
+	 ((__sk)->sk_family		== AF_INET6)		&& \
+	 ipv6_addr_equal(&inet6_sk(__sk)->daddr, (__saddr))	&& \
+	 ipv6_addr_equal(&inet6_sk(__sk)->rcv_saddr, (__daddr))	&& \
+	 (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
+
+/* These can have wildcards, don't try too hard. */
+static __inline__ int tcp_lhashfn(unsigned short num)
+{
+	return num & (TCP_LHTABLE_SIZE - 1);
+}
+
+static __inline__ int tcp_sk_listen_hashfn(struct sock *sk)
+{
+	return tcp_lhashfn(inet_sk(sk)->num);
+}
 
 #define MAX_TCP_HEADER	(128 + MAX_HEADER)
 
@@ -147,6 +478,33 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 					 * timestamps. It must be less than
 					 * minimal timewait lifetime.
 					 */
+
+#define TCP_TW_RECYCLE_SLOTS_LOG	5
+#define TCP_TW_RECYCLE_SLOTS		(1<<TCP_TW_RECYCLE_SLOTS_LOG)
+
+/* If time > 4sec, it is "slow" path, no recycling is required,
+   so that we select tick to get range about 4 seconds.
+ */
+
+#if HZ <= 16 || HZ > 4096
+# error Unsupported: HZ <= 16 or HZ > 4096
+#elif HZ <= 32
+# define TCP_TW_RECYCLE_TICK (5+2-TCP_TW_RECYCLE_SLOTS_LOG)
+#elif HZ <= 64
+# define TCP_TW_RECYCLE_TICK (6+2-TCP_TW_RECYCLE_SLOTS_LOG)
+#elif HZ <= 128
+# define TCP_TW_RECYCLE_TICK (7+2-TCP_TW_RECYCLE_SLOTS_LOG)
+#elif HZ <= 256
+# define TCP_TW_RECYCLE_TICK (8+2-TCP_TW_RECYCLE_SLOTS_LOG)
+#elif HZ <= 512
+# define TCP_TW_RECYCLE_TICK (9+2-TCP_TW_RECYCLE_SLOTS_LOG)
+#elif HZ <= 1024
+# define TCP_TW_RECYCLE_TICK (10+2-TCP_TW_RECYCLE_SLOTS_LOG)
+#elif HZ <= 2048
+# define TCP_TW_RECYCLE_TICK (11+2-TCP_TW_RECYCLE_SLOTS_LOG)
+#else
+# define TCP_TW_RECYCLE_TICK (12+2-TCP_TW_RECYCLE_SLOTS_LOG)
+#endif
 /*
  *	TCP option
  */
@@ -176,18 +534,22 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCPOLEN_SACK_BASE_ALIGNED	4
 #define TCPOLEN_SACK_PERBLOCK		8
 
+#define TCP_TIME_RETRANS	1	/* Retransmit timer */
+#define TCP_TIME_DACK		2	/* Delayed ack timer */
+#define TCP_TIME_PROBE0		3	/* Zero window probe timer */
+#define TCP_TIME_KEEPOPEN	4	/* Keepalive timer */
+
 /* Flags in tp->nonagle */
 #define TCP_NAGLE_OFF		1	/* Nagle's algo is disabled */
 #define TCP_NAGLE_CORK		2	/* Socket is corked	    */
 #define TCP_NAGLE_PUSH		4	/* Cork is overriden for already queued data */
 
-extern struct inet_timewait_death_row tcp_death_row;
-
 /* sysctl variables for tcp */
 extern int sysctl_tcp_timestamps;
 extern int sysctl_tcp_window_scaling;
 extern int sysctl_tcp_sack;
 extern int sysctl_tcp_fin_timeout;
+extern int sysctl_tcp_tw_recycle;
 extern int sysctl_tcp_keepalive_time;
 extern int sysctl_tcp_keepalive_probes;
 extern int sysctl_tcp_keepalive_intvl;
@@ -202,6 +564,7 @@ extern int sysctl_tcp_stdurg;
 extern int sysctl_tcp_rfc1337;
 extern int sysctl_tcp_abort_on_overflow;
 extern int sysctl_tcp_max_orphans;
+extern int sysctl_tcp_max_tw_buckets;
 extern int sysctl_tcp_fack;
 extern int sysctl_tcp_reordering;
 extern int sysctl_tcp_ecn;
@@ -222,6 +585,12 @@ extern atomic_t tcp_memory_allocated;
 extern atomic_t tcp_sockets_allocated;
 extern int tcp_memory_pressure;
 
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+#define TCP_INET_FAMILY(fam) ((fam) == AF_INET)
+#else
+#define TCP_INET_FAMILY(fam) 1
+#endif
+
 /*
  *	Pointers to address related TCP functions
  *	(i.e. things that depend on the address family)
@@ -302,6 +671,9 @@ DECLARE_SNMP_STAT(struct tcp_mib, tcp_statistics);
 #define TCP_ADD_STATS_BH(field, val)	SNMP_ADD_STATS_BH(tcp_statistics, field, val)
 #define TCP_ADD_STATS_USER(field, val)	SNMP_ADD_STATS_USER(tcp_statistics, field, val)
 
+extern void			tcp_put_port(struct sock *sk);
+extern void			tcp_inherit_port(struct sock *sk, struct sock *child);
+
 extern void			tcp_v4_err(struct sk_buff *skb, u32);
 
 extern void			tcp_shutdown (struct sock *sk, int how);
@@ -310,7 +682,7 @@ extern int			tcp_v4_rcv(struct sk_buff *skb);
 
 extern int			tcp_v4_remember_stamp(struct sock *sk);
 
-extern int		    	tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
+extern int		    	tcp_v4_tw_remember_stamp(struct tcp_tw_bucket *tw);
 
 extern int			tcp_sendmsg(struct kiocb *iocb, struct sock *sk,
 					    struct msghdr *msg, size_t size);
@@ -332,22 +704,42 @@ extern int			tcp_rcv_established(struct sock *sk,
 
 extern void			tcp_rcv_space_adjust(struct sock *sk);
 
-static inline void tcp_dec_quickack_mode(struct sock *sk,
-					 const unsigned int pkts)
+enum tcp_ack_state_t
+{
+	TCP_ACK_SCHED = 1,
+	TCP_ACK_TIMER = 2,
+	TCP_ACK_PUSHED= 4
+};
+
+static inline void tcp_schedule_ack(struct tcp_sock *tp)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
+	tp->ack.pending |= TCP_ACK_SCHED;
+}
+
+static inline int tcp_ack_scheduled(struct tcp_sock *tp)
+{
+	return tp->ack.pending&TCP_ACK_SCHED;
+}
+
+static __inline__ void tcp_dec_quickack_mode(struct tcp_sock *tp, unsigned int pkts)
+{
+	if (tp->ack.quick) {
+		if (pkts >= tp->ack.quick) {
+			tp->ack.quick = 0;
 
-	if (icsk->icsk_ack.quick) {
-		if (pkts >= icsk->icsk_ack.quick) {
-			icsk->icsk_ack.quick = 0;
 			/* Leaving quickack mode we deflate ATO. */
-			icsk->icsk_ack.ato   = TCP_ATO_MIN;
+			tp->ack.ato = TCP_ATO_MIN;
 		} else
-			icsk->icsk_ack.quick -= pkts;
+			tp->ack.quick -= pkts;
 	}
 }
 
-extern void tcp_enter_quickack_mode(struct sock *sk);
+extern void tcp_enter_quickack_mode(struct tcp_sock *tp);
+
+static __inline__ void tcp_delack_init(struct tcp_sock *tp)
+{
+	memset(&tp->ack, 0, sizeof(tp->ack));
+}
 
 static inline void tcp_clear_options(struct tcp_options_received *rx_opt)
 {
@@ -363,9 +755,10 @@ enum tcp_tw_status
 };
 
 
-extern enum tcp_tw_status	tcp_timewait_state_process(struct inet_timewait_sock *tw,
+extern enum tcp_tw_status	tcp_timewait_state_process(struct tcp_tw_bucket *tw,
 							   struct sk_buff *skb,
-							   const struct tcphdr *th);
+							   struct tcphdr *th,
+							   unsigned len);
 
 extern struct sock *		tcp_check_req(struct sock *sk,struct sk_buff *skb,
 					      struct request_sock *req,
@@ -380,6 +773,7 @@ extern void			tcp_update_metrics(struct sock *sk);
 
 extern void			tcp_close(struct sock *sk, 
 					  long timeout);
+extern struct sock *		tcp_accept(struct sock *sk, int flags, int *err);
 extern unsigned int		tcp_poll(struct file * file, struct socket *sock, struct poll_table_struct *wait);
 
 extern int			tcp_getsockopt(struct sock *sk, int level, 
@@ -395,6 +789,8 @@ extern int			tcp_recvmsg(struct kiocb *iocb, struct sock *sk,
 					    size_t len, int nonblock, 
 					    int flags, int *addr_len);
 
+extern int			tcp_listen_start(struct sock *sk);
+
 extern void			tcp_parse_options(struct sk_buff *skb,
 						  struct tcp_options_received *opt_rx,
 						  int estab);
@@ -403,6 +799,11 @@ extern void			tcp_parse_options(struct sk_buff *skb,
  *	TCP v4 functions exported for the inet6 API
  */
 
+extern int		       	tcp_v4_rebuild_header(struct sock *sk);
+
+extern int		       	tcp_v4_build_header(struct sock *sk, 
+						    struct sk_buff *skb);
+
 extern void		       	tcp_v4_send_check(struct sock *sk, 
 						  struct tcphdr *th, int len, 
 						  struct sk_buff *skb);
@@ -471,15 +872,18 @@ extern void tcp_cwnd_application_limited(struct sock *sk);
 
 /* tcp_timer.c */
 extern void tcp_init_xmit_timers(struct sock *);
-static inline void tcp_clear_xmit_timers(struct sock *sk)
-{
-	inet_csk_clear_xmit_timers(sk);
-}
+extern void tcp_clear_xmit_timers(struct sock *);
 
+extern void tcp_delete_keepalive_timer(struct sock *);
+extern void tcp_reset_keepalive_timer(struct sock *, unsigned long);
 extern unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu);
 extern unsigned int tcp_current_mss(struct sock *sk, int large);
 
-/* tcp.c */
+#ifdef TCP_DEBUG
+extern const char tcp_timer_bug_msg[];
+#endif
+
+/* tcp_diag.c */
 extern void tcp_get_info(struct sock *, struct tcp_info *);
 
 /* Read 'sendfile()'-style from a TCP socket */
@@ -488,6 +892,72 @@ typedef int (*sk_read_actor_t)(read_descriptor_t *, struct sk_buff *,
 extern int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
 			 sk_read_actor_t recv_actor);
 
+static inline void tcp_clear_xmit_timer(struct sock *sk, int what)
+{
+	struct tcp_sock *tp = tcp_sk(sk);
+	
+	switch (what) {
+	case TCP_TIME_RETRANS:
+	case TCP_TIME_PROBE0:
+		tp->pending = 0;
+
+#ifdef TCP_CLEAR_TIMERS
+		sk_stop_timer(sk, &tp->retransmit_timer);
+#endif
+		break;
+	case TCP_TIME_DACK:
+		tp->ack.blocked = 0;
+		tp->ack.pending = 0;
+
+#ifdef TCP_CLEAR_TIMERS
+		sk_stop_timer(sk, &tp->delack_timer);
+#endif
+		break;
+	default:
+#ifdef TCP_DEBUG
+		printk(tcp_timer_bug_msg);
+#endif
+		return;
+	};
+
+}
+
+/*
+ *	Reset the retransmission timer
+ */
+static inline void tcp_reset_xmit_timer(struct sock *sk, int what, unsigned long when)
+{
+	struct tcp_sock *tp = tcp_sk(sk);
+
+	if (when > TCP_RTO_MAX) {
+#ifdef TCP_DEBUG
+		printk(KERN_DEBUG "reset_xmit_timer sk=%p %d when=0x%lx, caller=%p\n", sk, what, when, current_text_addr());
+#endif
+		when = TCP_RTO_MAX;
+	}
+
+	switch (what) {
+	case TCP_TIME_RETRANS:
+	case TCP_TIME_PROBE0:
+		tp->pending = what;
+		tp->timeout = jiffies+when;
+		sk_reset_timer(sk, &tp->retransmit_timer, tp->timeout);
+		break;
+
+	case TCP_TIME_DACK:
+		tp->ack.pending |= TCP_ACK_TIMER;
+		tp->ack.timeout = jiffies+when;
+		sk_reset_timer(sk, &tp->delack_timer, tp->ack.timeout);
+		break;
+
+	default:
+#ifdef TCP_DEBUG
+		printk(tcp_timer_bug_msg);
+#endif
+		return;
+	};
+}
+
 /* Initialize RCV_MSS value.
  * RCV_MSS is an our guess about MSS used by the peer.
  * We haven't any direct information about the MSS.
@@ -505,7 +975,7 @@ static inline void tcp_initialize_rcv_mss(struct sock *sk)
 	hint = min(hint, TCP_MIN_RCVMSS);
 	hint = max(hint, TCP_MIN_MSS);
 
-	inet_csk(sk)->icsk_ack.rcv_mss = hint;
+	tp->ack.rcv_mss = hint;
 }
 
 static __inline__ void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
@@ -640,8 +1110,7 @@ static inline void tcp_packets_out_inc(struct sock *sk,
 
 	tp->packets_out += tcp_skb_pcount(skb);
 	if (!orig)
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-					  inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
+		tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS, tp->rto);
 }
 
 static inline void tcp_packets_out_dec(struct tcp_sock *tp, 
@@ -669,29 +1138,29 @@ struct tcp_congestion_ops {
 	struct list_head	list;
 
 	/* initialize private data (optional) */
-	void (*init)(struct sock *sk);
+	void (*init)(struct tcp_sock *tp);
 	/* cleanup private data  (optional) */
-	void (*release)(struct sock *sk);
+	void (*release)(struct tcp_sock *tp);
 
 	/* return slow start threshold (required) */
-	u32 (*ssthresh)(struct sock *sk);
+	u32 (*ssthresh)(struct tcp_sock *tp);
 	/* lower bound for congestion window (optional) */
-	u32 (*min_cwnd)(struct sock *sk);
+	u32 (*min_cwnd)(struct tcp_sock *tp);
 	/* do new cwnd calculation (required) */
-	void (*cong_avoid)(struct sock *sk, u32 ack,
+	void (*cong_avoid)(struct tcp_sock *tp, u32 ack,
 			   u32 rtt, u32 in_flight, int good_ack);
 	/* round trip time sample per acked packet (optional) */
-	void (*rtt_sample)(struct sock *sk, u32 usrtt);
+	void (*rtt_sample)(struct tcp_sock *tp, u32 usrtt);
 	/* call before changing ca_state (optional) */
-	void (*set_state)(struct sock *sk, u8 new_state);
+	void (*set_state)(struct tcp_sock *tp, u8 new_state);
 	/* call when cwnd event occurs (optional) */
-	void (*cwnd_event)(struct sock *sk, enum tcp_ca_event ev);
+	void (*cwnd_event)(struct tcp_sock *tp, enum tcp_ca_event ev);
 	/* new value of cwnd after loss (optional) */
-	u32  (*undo_cwnd)(struct sock *sk);
+	u32  (*undo_cwnd)(struct tcp_sock *tp);
 	/* hook for packet ack accounting (optional) */
-	void (*pkts_acked)(struct sock *sk, u32 num_acked);
-	/* get info for inet_diag (optional) */
-	void (*get_info)(struct sock *sk, u32 ext, struct sk_buff *skb);
+	void (*pkts_acked)(struct tcp_sock *tp, u32 num_acked);
+	/* get info for tcp_diag (optional) */
+	void (*get_info)(struct tcp_sock *tp, u32 ext, struct sk_buff *skb);
 
 	char 		name[TCP_CA_NAME_MAX];
 	struct module 	*owner;
@@ -700,34 +1169,30 @@ struct tcp_congestion_ops {
 extern int tcp_register_congestion_control(struct tcp_congestion_ops *type);
 extern void tcp_unregister_congestion_control(struct tcp_congestion_ops *type);
 
-extern void tcp_init_congestion_control(struct sock *sk);
-extern void tcp_cleanup_congestion_control(struct sock *sk);
+extern void tcp_init_congestion_control(struct tcp_sock *tp);
+extern void tcp_cleanup_congestion_control(struct tcp_sock *tp);
 extern int tcp_set_default_congestion_control(const char *name);
 extern void tcp_get_default_congestion_control(char *name);
-extern int tcp_set_congestion_control(struct sock *sk, const char *name);
+extern int tcp_set_congestion_control(struct tcp_sock *tp, const char *name);
 
 extern struct tcp_congestion_ops tcp_init_congestion_ops;
-extern u32 tcp_reno_ssthresh(struct sock *sk);
-extern void tcp_reno_cong_avoid(struct sock *sk, u32 ack,
+extern u32 tcp_reno_ssthresh(struct tcp_sock *tp);
+extern void tcp_reno_cong_avoid(struct tcp_sock *tp, u32 ack,
 				u32 rtt, u32 in_flight, int flag);
-extern u32 tcp_reno_min_cwnd(struct sock *sk);
+extern u32 tcp_reno_min_cwnd(struct tcp_sock *tp);
 extern struct tcp_congestion_ops tcp_reno;
 
-static inline void tcp_set_ca_state(struct sock *sk, const u8 ca_state)
+static inline void tcp_set_ca_state(struct tcp_sock *tp, u8 ca_state)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
-
-	if (icsk->icsk_ca_ops->set_state)
-		icsk->icsk_ca_ops->set_state(sk, ca_state);
-	icsk->icsk_ca_state = ca_state;
+	if (tp->ca_ops->set_state)
+		tp->ca_ops->set_state(tp, ca_state);
+	tp->ca_state = ca_state;
 }
 
-static inline void tcp_ca_event(struct sock *sk, const enum tcp_ca_event event)
+static inline void tcp_ca_event(struct tcp_sock *tp, enum tcp_ca_event event)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-
-	if (icsk->icsk_ca_ops->cwnd_event)
-		icsk->icsk_ca_ops->cwnd_event(sk, event);
+	if (tp->ca_ops->cwnd_event)
+		tp->ca_ops->cwnd_event(tp, event);
 }
 
 /* This determines how many packets are "in the network" to the best
@@ -753,10 +1218,9 @@ static __inline__ unsigned int tcp_packets_in_flight(const struct tcp_sock *tp)
  * The exception is rate halving phase, when cwnd is decreasing towards
  * ssthresh.
  */
-static inline __u32 tcp_current_ssthresh(const struct sock *sk)
+static inline __u32 tcp_current_ssthresh(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	if ((1 << inet_csk(sk)->icsk_ca_state) & (TCPF_CA_CWR | TCPF_CA_Recovery))
+	if ((1<<tp->ca_state)&(TCPF_CA_CWR|TCPF_CA_Recovery))
 		return tp->snd_ssthresh;
 	else
 		return max(tp->snd_ssthresh,
@@ -773,13 +1237,10 @@ static inline void tcp_sync_left_out(struct tcp_sock *tp)
 }
 
 /* Set slow start threshold and cwnd not falling to slow start */
-static inline void __tcp_enter_cwr(struct sock *sk)
+static inline void __tcp_enter_cwr(struct tcp_sock *tp)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	struct tcp_sock *tp = tcp_sk(sk);
-
 	tp->undo_marker = 0;
-	tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
+	tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
 	tp->snd_cwnd = min(tp->snd_cwnd,
 			   tcp_packets_in_flight(tp) + 1U);
 	tp->snd_cwnd_cnt = 0;
@@ -788,14 +1249,12 @@ static inline void __tcp_enter_cwr(struct sock *sk)
 	TCP_ECN_queue_cwr(tp);
 }
 
-static inline void tcp_enter_cwr(struct sock *sk)
+static inline void tcp_enter_cwr(struct tcp_sock *tp)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-
 	tp->prior_ssthresh = 0;
-	if (inet_csk(sk)->icsk_ca_state < TCP_CA_CWR) {
-		__tcp_enter_cwr(sk);
-		tcp_set_ca_state(sk, TCP_CA_CWR);
+	if (tp->ca_state < TCP_CA_CWR) {
+		__tcp_enter_cwr(tp);
+		tcp_set_ca_state(tp, TCP_CA_CWR);
 	}
 }
 
@@ -818,10 +1277,8 @@ static __inline__ void tcp_minshall_update(struct tcp_sock *tp, int mss,
 
 static __inline__ void tcp_check_probe_timer(struct sock *sk, struct tcp_sock *tp)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	if (!tp->packets_out && !icsk->icsk_pending)
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
-					  icsk->icsk_rto, TCP_RTO_MAX);
+	if (!tp->packets_out && !tp->pending)
+		tcp_reset_xmit_timer(sk, TCP_TIME_PROBE0, tp->rto);
 }
 
 static __inline__ void tcp_push_pending_frames(struct sock *sk,
@@ -840,6 +1297,9 @@ static __inline__ void tcp_update_wl(struct tcp_sock *tp, u32 ack, u32 seq)
 	tp->snd_wl1 = seq;
 }
 
+extern void tcp_destroy_sock(struct sock *sk);
+
+
 /*
  * Calculate(/check) TCP checksum
  */
@@ -899,10 +1359,8 @@ static __inline__ int tcp_prequeue(struct sock *sk, struct sk_buff *skb)
 			tp->ucopy.memory = 0;
 		} else if (skb_queue_len(&tp->ucopy.prequeue) == 1) {
 			wake_up_interruptible(sk->sk_sleep);
-			if (!inet_csk_ack_scheduled(sk))
-				inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-						          (3 * TCP_RTO_MIN) / 4,
-							  TCP_RTO_MAX);
+			if (!tcp_ack_scheduled(tp))
+				tcp_reset_xmit_timer(sk, TCP_TIME_DACK, (3*TCP_RTO_MIN)/4);
 		}
 		return 1;
 	}
@@ -935,9 +1393,9 @@ static __inline__ void tcp_set_state(struct sock *sk, int state)
 			TCP_INC_STATS(TCP_MIB_ESTABRESETS);
 
 		sk->sk_prot->unhash(sk);
-		if (inet_csk(sk)->icsk_bind_hash &&
+		if (tcp_sk(sk)->bind_hash &&
 		    !(sk->sk_userlocks & SOCK_BINDPORT_LOCK))
-			inet_put_port(&tcp_hashinfo, sk);
+			tcp_put_port(sk);
 		/* fall through */
 	default:
 		if (oldstate==TCP_ESTABLISHED)
@@ -964,7 +1422,7 @@ static __inline__ void tcp_done(struct sock *sk)
 	if (!sock_flag(sk, SOCK_DEAD))
 		sk->sk_state_change(sk);
 	else
-		inet_csk_destroy_sock(sk);
+		tcp_destroy_sock(sk);
 }
 
 static __inline__ void tcp_sack_reset(struct tcp_options_received *rx_opt)
@@ -1066,6 +1524,54 @@ static inline int tcp_full_space(const struct sock *sk)
 	return tcp_win_from_space(sk->sk_rcvbuf); 
 }
 
+static inline void tcp_acceptq_queue(struct sock *sk, struct request_sock *req,
+					 struct sock *child)
+{
+	reqsk_queue_add(&tcp_sk(sk)->accept_queue, req, sk, child);
+}
+
+static inline void
+tcp_synq_removed(struct sock *sk, struct request_sock *req)
+{
+	if (reqsk_queue_removed(&tcp_sk(sk)->accept_queue, req) == 0)
+		tcp_delete_keepalive_timer(sk);
+}
+
+static inline void tcp_synq_added(struct sock *sk)
+{
+	if (reqsk_queue_added(&tcp_sk(sk)->accept_queue) == 0)
+		tcp_reset_keepalive_timer(sk, TCP_TIMEOUT_INIT);
+}
+
+static inline int tcp_synq_len(struct sock *sk)
+{
+	return reqsk_queue_len(&tcp_sk(sk)->accept_queue);
+}
+
+static inline int tcp_synq_young(struct sock *sk)
+{
+	return reqsk_queue_len_young(&tcp_sk(sk)->accept_queue);
+}
+
+static inline int tcp_synq_is_full(struct sock *sk)
+{
+	return reqsk_queue_is_full(&tcp_sk(sk)->accept_queue);
+}
+
+static inline void tcp_synq_unlink(struct tcp_sock *tp, struct request_sock *req,
+				   struct request_sock **prev)
+{
+	reqsk_queue_unlink(&tp->accept_queue, req, prev);
+}
+
+static inline void tcp_synq_drop(struct sock *sk, struct request_sock *req,
+				     struct request_sock **prev)
+{
+	tcp_synq_unlink(tcp_sk(sk), req, prev);
+	tcp_synq_removed(sk, req);
+	reqsk_free(req);
+}
+
 static __inline__ void tcp_openreq_init(struct request_sock *req,
 					struct tcp_options_received *rx_opt,
 					struct sk_buff *skb)
@@ -1087,6 +1593,27 @@ static __inline__ void tcp_openreq_init(struct request_sock *req,
 
 extern void tcp_enter_memory_pressure(void);
 
+extern void tcp_listen_wlock(void);
+
+/* - We may sleep inside this lock.
+ * - If sleeping is not required (or called from BH),
+ *   use plain read_(un)lock(&tcp_lhash_lock).
+ */
+
+static inline void tcp_listen_lock(void)
+{
+	/* read_lock synchronizes to candidates to writers */
+	read_lock(&tcp_lhash_lock);
+	atomic_inc(&tcp_lhash_users);
+	read_unlock(&tcp_lhash_lock);
+}
+
+static inline void tcp_listen_unlock(void)
+{
+	if (atomic_dec_and_test(&tcp_lhash_users))
+		wake_up(&tcp_lhash_wait);
+}
+
 static inline int keepalive_intvl_when(const struct tcp_sock *tp)
 {
 	return tp->keepalive_intvl ? : sysctl_tcp_keepalive_intvl;
@@ -1097,13 +1624,12 @@ static inline int keepalive_time_when(const struct tcp_sock *tp)
 	return tp->keepalive_time ? : sysctl_tcp_keepalive_time;
 }
 
-static inline int tcp_fin_time(const struct sock *sk)
+static inline int tcp_fin_time(const struct tcp_sock *tp)
 {
-	int fin_timeout = tcp_sk(sk)->linger2 ? : sysctl_tcp_fin_timeout;
-	const int rto = inet_csk(sk)->icsk_rto;
+	int fin_timeout = tp->linger2 ? : sysctl_tcp_fin_timeout;
 
-	if (fin_timeout < (rto << 2) - (rto >> 1))
-		fin_timeout = (rto << 2) - (rto >> 1);
+	if (fin_timeout < (tp->rto<<2) - (tp->rto>>1))
+		fin_timeout = (tp->rto<<2) - (tp->rto>>1);
 
 	return fin_timeout;
 }
@@ -1132,6 +1658,15 @@ static inline int tcp_paws_check(const struct tcp_options_received *rx_opt, int
 	return 1;
 }
 
+static inline void tcp_v4_setup_caps(struct sock *sk, struct dst_entry *dst)
+{
+	sk->sk_route_caps = dst->dev->features;
+	if (sk->sk_route_caps & NETIF_F_TSO) {
+		if (sock_flag(sk, SOCK_NO_LARGESEND) || dst->header_len)
+			sk->sk_route_caps &= ~NETIF_F_TSO;
+	}
+}
+
 #define TCP_CHECK_TIMER(sk) do { } while (0)
 
 static inline int tcp_use_frto(const struct sock *sk)
@@ -1183,16 +1718,4 @@ struct tcp_iter_state {
 extern int tcp_proc_register(struct tcp_seq_afinfo *afinfo);
 extern void tcp_proc_unregister(struct tcp_seq_afinfo *afinfo);
 
-extern struct request_sock_ops tcp_request_sock_ops;
-
-extern int tcp_v4_destroy_sock(struct sock *sk);
-
-#ifdef CONFIG_PROC_FS
-extern int  tcp4_proc_init(void);
-extern void tcp4_proc_exit(void);
-#endif
-
-extern void tcp_v4_init(struct net_proto_family *ops);
-extern void tcp_init(void);
-
 #endif	/* _TCP_H */
diff --git a/trunk/include/net/tcp_ecn.h b/trunk/include/net/tcp_ecn.h
index c6b84397448d..64980ee8c92a 100644
--- a/trunk/include/net/tcp_ecn.h
+++ b/trunk/include/net/tcp_ecn.h
@@ -88,7 +88,7 @@ static inline void TCP_ECN_check_ce(struct tcp_sock *tp, struct sk_buff *skb)
 		 * it is surely retransmit. It is not in ECN RFC,
 		 * but Linux follows this rule. */
 		else if (INET_ECN_is_not_ect((TCP_SKB_CB(skb)->flags)))
-			tcp_enter_quickack_mode((struct sock *)tp);
+			tcp_enter_quickack_mode(tp);
 	}
 }
 
diff --git a/trunk/include/net/tcp_states.h b/trunk/include/net/tcp_states.h
deleted file mode 100644
index b9d4176b2d15..000000000000
--- a/trunk/include/net/tcp_states.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * INET		An implementation of the TCP/IP protocol suite for the LINUX
- *		operating system.  INET is implemented using the  BSD Socket
- *		interface as the means of communication with the user level.
- *
- *		Definitions for the TCP protocol sk_state field.
- *
- *		This program is free software; you can redistribute it and/or
- *		modify it under the terms of the GNU General Public License
- *		as published by the Free Software Foundation; either version
- *		2 of the License, or (at your option) any later version.
- */
-#ifndef _LINUX_TCP_STATES_H
-#define _LINUX_TCP_STATES_H
-
-enum {
-	TCP_ESTABLISHED = 1,
-	TCP_SYN_SENT,
-	TCP_SYN_RECV,
-	TCP_FIN_WAIT1,
-	TCP_FIN_WAIT2,
-	TCP_TIME_WAIT,
-	TCP_CLOSE,
-	TCP_CLOSE_WAIT,
-	TCP_LAST_ACK,
-	TCP_LISTEN,
-	TCP_CLOSING,	/* Now a valid state */
-
-	TCP_MAX_STATES	/* Leave at the end! */
-};
-
-#define TCP_STATE_MASK	0xF
-
-#endif	/* _LINUX_TCP_STATES_H */
diff --git a/trunk/include/net/udp.h b/trunk/include/net/udp.h
index 107b9d791a1f..ac229b761dbc 100644
--- a/trunk/include/net/udp.h
+++ b/trunk/include/net/udp.h
@@ -94,11 +94,6 @@ struct udp_iter_state {
 	struct seq_operations	seq_ops;
 };
 
-#ifdef CONFIG_PROC_FS
 extern int udp_proc_register(struct udp_seq_afinfo *afinfo);
 extern void udp_proc_unregister(struct udp_seq_afinfo *afinfo);
-
-extern int  udp4_proc_init(void);
-extern void udp4_proc_exit(void);
-#endif
 #endif	/* _UDP_H */
diff --git a/trunk/include/net/x25.h b/trunk/include/net/x25.h
index fee62ff8c194..8b39b98876e8 100644
--- a/trunk/include/net/x25.h
+++ b/trunk/include/net/x25.h
@@ -175,7 +175,7 @@ extern void x25_kill_by_neigh(struct x25_neigh *);
 
 /* x25_dev.c */
 extern void x25_send_frame(struct sk_buff *, struct x25_neigh *);
-extern int  x25_lapb_receive_frame(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
+extern int  x25_lapb_receive_frame(struct sk_buff *, struct net_device *, struct packet_type *);
 extern void x25_establish_link(struct x25_neigh *);
 extern void x25_terminate_link(struct x25_neigh *);
 
diff --git a/trunk/include/net/x25device.h b/trunk/include/net/x25device.h
index 1a318374faef..d45ae883bd1d 100644
--- a/trunk/include/net/x25device.h
+++ b/trunk/include/net/x25device.h
@@ -8,6 +8,7 @@
 static inline __be16 x25_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
 	skb->mac.raw = skb->data;
+	skb->input_dev = skb->dev = dev;
 	skb->pkt_type = PACKET_HOST;
 	
 	return htons(ETH_P_X25);
diff --git a/trunk/include/net/xfrm.h b/trunk/include/net/xfrm.h
index a9d0d8c5dfbf..868ef88ef971 100644
--- a/trunk/include/net/xfrm.h
+++ b/trunk/include/net/xfrm.h
@@ -818,6 +818,7 @@ extern void xfrm6_init(void);
 extern void xfrm6_fini(void);
 extern void xfrm_state_init(void);
 extern void xfrm4_state_init(void);
+extern void xfrm4_state_fini(void);
 extern void xfrm6_state_init(void);
 extern void xfrm6_state_fini(void);
 
diff --git a/trunk/include/sound/ac97_codec.h b/trunk/include/sound/ac97_codec.h
index 2857cf0472df..1309c12b8f71 100644
--- a/trunk/include/sound/ac97_codec.h
+++ b/trunk/include/sound/ac97_codec.h
@@ -26,7 +26,6 @@
  */
 
 #include <linux/bitops.h>
-#include <linux/device.h>
 #include "pcm.h"
 #include "control.h"
 #include "info.h"
@@ -375,9 +374,6 @@
 #define AC97_HAS_NO_PC_BEEP	(1<<12) /* no PC Beep volume */
 #define AC97_HAS_NO_VIDEO	(1<<13) /* no Video volume */
 #define AC97_HAS_NO_CD		(1<<14) /* no CD volume */
-#define AC97_HAS_NO_MIC	(1<<15) /* no MIC volume */
-#define AC97_HAS_NO_TONE	(1<<16) /* no Tone volume */
-#define AC97_HAS_NO_STD_PCM	(1<<17)	/* no standard AC97 PCM volume and mute */
 
 /* rates indexes */
 #define AC97_RATES_FRONT_DAC	0
@@ -524,7 +520,6 @@ struct _snd_ac97 {
 	/* jack-sharing info */
 	unsigned char indep_surround;
 	unsigned char channel_mode;
-	struct device dev;
 };
 
 /* conditions */
@@ -604,8 +599,4 @@ struct ac97_enum {
 	unsigned short mask;
 	const char **texts;
 };
-
-/* ad hoc AC97 device driver access */
-extern struct bus_type ac97_bus_type;
-
 #endif /* __SOUND_AC97_CODEC_H */
diff --git a/trunk/include/sound/ad1816a.h b/trunk/include/sound/ad1816a.h
index ca2e0e4fa937..395978e375cf 100644
--- a/trunk/include/sound/ad1816a.h
+++ b/trunk/include/sound/ad1816a.h
@@ -138,7 +138,6 @@ struct _snd_ad1816a {
 	spinlock_t lock;
 
 	unsigned short mode;
-	unsigned int clock_freq;
 
 	snd_card_t *card;
 	snd_pcm_t *pcm;
diff --git a/trunk/include/sound/asound.h b/trunk/include/sound/asound.h
index 8e552d627fa5..9974f83cca44 100644
--- a/trunk/include/sound/asound.h
+++ b/trunk/include/sound/asound.h
@@ -560,7 +560,7 @@ enum {
  *  Timer section - /dev/snd/timer
  */
 
-#define SNDRV_TIMER_VERSION		SNDRV_PROTOCOL_VERSION(2, 0, 5)
+#define SNDRV_TIMER_VERSION		SNDRV_PROTOCOL_VERSION(2, 0, 4)
 
 enum sndrv_timer_class {
 	SNDRV_TIMER_CLASS_NONE = -1,
@@ -693,15 +693,11 @@ enum sndrv_timer_event {
 	SNDRV_TIMER_EVENT_CONTINUE,		/* val = resolution in ns */
 	SNDRV_TIMER_EVENT_PAUSE,		/* val = 0 */
 	SNDRV_TIMER_EVENT_EARLY,		/* val = 0, early event */
-	SNDRV_TIMER_EVENT_SUSPEND,		/* val = 0 */
-	SNDRV_TIMER_EVENT_RESUME,		/* val = resolution in ns */
 	/* master timer events for slave timer instances */
 	SNDRV_TIMER_EVENT_MSTART = SNDRV_TIMER_EVENT_START + 10,
 	SNDRV_TIMER_EVENT_MSTOP = SNDRV_TIMER_EVENT_STOP + 10,
 	SNDRV_TIMER_EVENT_MCONTINUE = SNDRV_TIMER_EVENT_CONTINUE + 10,
 	SNDRV_TIMER_EVENT_MPAUSE = SNDRV_TIMER_EVENT_PAUSE + 10,
-	SNDRV_TIMER_EVENT_MSUSPEND = SNDRV_TIMER_EVENT_SUSPEND + 10,
-	SNDRV_TIMER_EVENT_MRESUME = SNDRV_TIMER_EVENT_RESUME + 10,
 };
 
 struct sndrv_timer_tread {
diff --git a/trunk/include/sound/cs46xx.h b/trunk/include/sound/cs46xx.h
index 9b94510eda60..182dd276ee74 100644
--- a/trunk/include/sound/cs46xx.h
+++ b/trunk/include/sound/cs46xx.h
@@ -1748,7 +1748,7 @@ int snd_cs46xx_pcm(cs46xx_t *chip, int device, snd_pcm_t **rpcm);
 int snd_cs46xx_pcm_rear(cs46xx_t *chip, int device, snd_pcm_t **rpcm);
 int snd_cs46xx_pcm_iec958(cs46xx_t *chip, int device, snd_pcm_t **rpcm);
 int snd_cs46xx_pcm_center_lfe(cs46xx_t *chip, int device, snd_pcm_t **rpcm);
-int snd_cs46xx_mixer(cs46xx_t *chip, int spdif_device);
+int snd_cs46xx_mixer(cs46xx_t *chip);
 int snd_cs46xx_midi(cs46xx_t *chip, int device, snd_rawmidi_t **rmidi);
 int snd_cs46xx_start_dsp(cs46xx_t *chip);
 int snd_cs46xx_gameport(cs46xx_t *chip);
diff --git a/trunk/include/sound/emu10k1.h b/trunk/include/sound/emu10k1.h
index 4e3993dfcefe..c2ef3f023687 100644
--- a/trunk/include/sound/emu10k1.h
+++ b/trunk/include/sound/emu10k1.h
@@ -1178,7 +1178,7 @@ int snd_p16v_free(emu10k1_t * emu);
 int snd_p16v_mixer(emu10k1_t * emu);
 int snd_emu10k1_pcm_multi(emu10k1_t * emu, int device, snd_pcm_t ** rpcm);
 int snd_emu10k1_fx8010_pcm(emu10k1_t * emu, int device, snd_pcm_t ** rpcm);
-int snd_emu10k1_mixer(emu10k1_t * emu, int pcm_device, int multi_device);
+int snd_emu10k1_mixer(emu10k1_t * emu);
 int snd_emu10k1_timer(emu10k1_t * emu, int device);
 int snd_emu10k1_fx8010_new(emu10k1_t *emu, int device, snd_hwdep_t ** rhwdep);
 
diff --git a/trunk/include/sound/gus.h b/trunk/include/sound/gus.h
index 7000d9d9199d..b4b461ca173d 100644
--- a/trunk/include/sound/gus.h
+++ b/trunk/include/sound/gus.h
@@ -512,13 +512,13 @@ extern void snd_gf1_ctrl_stop(snd_gus_card_t * gus, unsigned char reg);
 
 extern void snd_gf1_write8(snd_gus_card_t * gus, unsigned char reg, unsigned char data);
 extern unsigned char snd_gf1_look8(snd_gus_card_t * gus, unsigned char reg);
-static inline unsigned char snd_gf1_read8(snd_gus_card_t * gus, unsigned char reg)
+extern inline unsigned char snd_gf1_read8(snd_gus_card_t * gus, unsigned char reg)
 {
 	return snd_gf1_look8(gus, reg | 0x80);
 }
 extern void snd_gf1_write16(snd_gus_card_t * gus, unsigned char reg, unsigned int data);
 extern unsigned short snd_gf1_look16(snd_gus_card_t * gus, unsigned char reg);
-static inline unsigned short snd_gf1_read16(snd_gus_card_t * gus, unsigned char reg)
+extern inline unsigned short snd_gf1_read16(snd_gus_card_t * gus, unsigned char reg)
 {
 	return snd_gf1_look16(gus, reg | 0x80);
 }
@@ -532,12 +532,12 @@ extern void snd_gf1_i_ctrl_stop(snd_gus_card_t * gus, unsigned char reg);
 extern void snd_gf1_i_write8(snd_gus_card_t * gus, unsigned char reg, unsigned char data);
 extern unsigned char snd_gf1_i_look8(snd_gus_card_t * gus, unsigned char reg);
 extern void snd_gf1_i_write16(snd_gus_card_t * gus, unsigned char reg, unsigned int data);
-static inline unsigned char snd_gf1_i_read8(snd_gus_card_t * gus, unsigned char reg)
+extern inline unsigned char snd_gf1_i_read8(snd_gus_card_t * gus, unsigned char reg)
 {
 	return snd_gf1_i_look8(gus, reg | 0x80);
 }
 extern unsigned short snd_gf1_i_look16(snd_gus_card_t * gus, unsigned char reg);
-static inline unsigned short snd_gf1_i_read16(snd_gus_card_t * gus, unsigned char reg)
+extern inline unsigned short snd_gf1_i_read16(snd_gus_card_t * gus, unsigned char reg)
 {
 	return snd_gf1_i_look16(gus, reg | 0x80);
 }
diff --git a/trunk/include/sound/pcm.h b/trunk/include/sound/pcm.h
index fa23ebfb857a..d935417575b5 100644
--- a/trunk/include/sound/pcm.h
+++ b/trunk/include/sound/pcm.h
@@ -379,6 +379,7 @@ struct _snd_pcm_substream {
 	unsigned int dma_buf_id;
 	size_t dma_max;
 	/* -- hardware operations -- */
+	unsigned int open_flag: 1;	/* lowlevel device has been opened */
 	snd_pcm_ops_t *ops;
 	/* -- runtime information -- */
 	snd_pcm_runtime_t *runtime;
diff --git a/trunk/include/sound/version.h b/trunk/include/sound/version.h
index 8d19bfabb7e0..c085136f391f 100644
--- a/trunk/include/sound/version.h
+++ b/trunk/include/sound/version.h
@@ -1,3 +1,3 @@
 /* include/version.h.  Generated by configure.  */
-#define CONFIG_SND_VERSION "1.0.10rc1"
-#define CONFIG_SND_DATE " (Tue Aug 30 05:31:08 2005 UTC)"
+#define CONFIG_SND_VERSION "1.0.9b"
+#define CONFIG_SND_DATE " (Thu Jul 28 12:20:13 2005 UTC)"
diff --git a/trunk/include/sound/ymfpci.h b/trunk/include/sound/ymfpci.h
index 9a3c1e6c820a..4b570684a6aa 100644
--- a/trunk/include/sound/ymfpci.h
+++ b/trunk/include/sound/ymfpci.h
@@ -295,7 +295,6 @@ struct _snd_ymfpci_pcm {
 	unsigned int running: 1;
 	unsigned int output_front: 1;
 	unsigned int output_rear: 1;
-	unsigned int update_pcm_vol;
 	u32 period_size;		/* cached from runtime->period_size */
 	u32 buffer_size;		/* cached from runtime->buffer_size */
 	u32 period_pos;
@@ -368,11 +367,6 @@ struct _snd_ymfpci {
 	int mode_dup4ch;
 	int rear_opened;
 	int spdif_opened;
-	struct {
-		u16 left;
-		u16 right;
-		snd_kcontrol_t *ctl;
-	} pcm_mixer[32];
 
 	spinlock_t reg_lock;
 	spinlock_t voice_lock;
diff --git a/trunk/init/main.c b/trunk/init/main.c
index ff410063e4e1..c9c311cf1771 100644
--- a/trunk/init/main.c
+++ b/trunk/init/main.c
@@ -47,7 +47,6 @@
 #include <linux/rmap.h>
 #include <linux/mempolicy.h>
 #include <linux/key.h>
-#include <net/sock.h>
 
 #include <asm/io.h>
 #include <asm/bugs.h>
@@ -81,6 +80,7 @@
 static int init(void *);
 
 extern void init_IRQ(void);
+extern void sock_init(void);
 extern void fork_init(unsigned long);
 extern void mca_init(void);
 extern void sbus_init(void);
diff --git a/trunk/kernel/audit.c b/trunk/kernel/audit.c
index 7f0699790d46..ef35166fdc29 100644
--- a/trunk/kernel/audit.c
+++ b/trunk/kernel/audit.c
@@ -514,8 +514,7 @@ static int __init audit_init(void)
 {
 	printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
 	       audit_default ? "enabled" : "disabled");
-	audit_sock = netlink_kernel_create(NETLINK_AUDIT, 0, audit_receive,
-					   THIS_MODULE);
+	audit_sock = netlink_kernel_create(NETLINK_AUDIT, audit_receive);
 	if (!audit_sock)
 		audit_panic("cannot initialize netlink socket");
 
diff --git a/trunk/kernel/sysctl.c b/trunk/kernel/sysctl.c
index 8e56e2495542..3e0bbee549ea 100644
--- a/trunk/kernel/sysctl.c
+++ b/trunk/kernel/sysctl.c
@@ -31,7 +31,6 @@
 #include <linux/smp_lock.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/net.h>
 #include <linux/sysrq.h>
 #include <linux/highuid.h>
 #include <linux/writeback.h>
@@ -137,6 +136,9 @@ static struct ctl_table_header root_table_header =
 
 static ctl_table kern_table[];
 static ctl_table vm_table[];
+#ifdef CONFIG_NET
+extern ctl_table net_table[];
+#endif
 static ctl_table proc_table[];
 static ctl_table fs_table[];
 static ctl_table debug_table[];
diff --git a/trunk/lib/Kconfig b/trunk/lib/Kconfig
index e43197efeb9c..eeb429a52152 100644
--- a/trunk/lib/Kconfig
+++ b/trunk/lib/Kconfig
@@ -72,9 +72,6 @@ config TEXTSEARCH
 config TEXTSEARCH_KMP
 	tristate
 
-config TEXTSEARCH_BM
-	tristate
-
 config TEXTSEARCH_FSM
 	tristate
 
diff --git a/trunk/lib/Makefile b/trunk/lib/Makefile
index 52f83380f704..f28d9031303c 100644
--- a/trunk/lib/Makefile
+++ b/trunk/lib/Makefile
@@ -38,7 +38,6 @@ obj-$(CONFIG_REED_SOLOMON) += reed_solomon/
 
 obj-$(CONFIG_TEXTSEARCH) += textsearch.o
 obj-$(CONFIG_TEXTSEARCH_KMP) += ts_kmp.o
-obj-$(CONFIG_TEXTSEARCH_BM) += ts_bm.o
 obj-$(CONFIG_TEXTSEARCH_FSM) += ts_fsm.o
 
 hostprogs-y	:= gen_crc32table
diff --git a/trunk/lib/kobject_uevent.c b/trunk/lib/kobject_uevent.c
index 04ca4429ddfa..8e49d21057e4 100644
--- a/trunk/lib/kobject_uevent.c
+++ b/trunk/lib/kobject_uevent.c
@@ -93,7 +93,6 @@ static int send_uevent(const char *signal, const char *obj,
 		}
 	}
 
-	NETLINK_CB(skb).dst_group = 1;
 	return netlink_broadcast(uevent_sock, skb, 0, 1, gfp_mask);
 }
 
@@ -154,8 +153,7 @@ EXPORT_SYMBOL_GPL(kobject_uevent_atomic);
 
 static int __init kobject_uevent_init(void)
 {
-	uevent_sock = netlink_kernel_create(NETLINK_KOBJECT_UEVENT, 1, NULL,
-					    THIS_MODULE);
+	uevent_sock = netlink_kernel_create(NETLINK_KOBJECT_UEVENT, NULL);
 
 	if (!uevent_sock) {
 		printk(KERN_ERR
diff --git a/trunk/lib/ts_bm.c b/trunk/lib/ts_bm.c
deleted file mode 100644
index 2cc79112ecc3..000000000000
--- a/trunk/lib/ts_bm.c
+++ /dev/null
@@ -1,185 +0,0 @@
-/*
- * lib/ts_bm.c		Boyer-Moore text search implementation
- *
- *		This program is free software; you can redistribute it and/or
- *		modify it under the terms of the GNU General Public License
- *		as published by the Free Software Foundation; either version
- *		2 of the License, or (at your option) any later version.
- *
- * Authors:	Pablo Neira Ayuso <pablo@eurodev.net>
- *
- * ==========================================================================
- * 
- *   Implements Boyer-Moore string matching algorithm:
- *
- *   [1] A Fast String Searching Algorithm, R.S. Boyer and Moore.
- *       Communications of the Association for Computing Machinery, 
- *       20(10), 1977, pp. 762-772.
- *       http://www.cs.utexas.edu/users/moore/publications/fstrpos.pdf
- *
- *   [2] Handbook of Exact String Matching Algorithms, Thierry Lecroq, 2004
- *       http://www-igm.univ-mlv.fr/~lecroq/string/string.pdf
- *
- *   Note: Since Boyer-Moore (BM) performs searches for matchings from right 
- *   to left, it's still possible that a matching could be spread over 
- *   multiple blocks, in that case this algorithm won't find any coincidence.
- *   
- *   If you're willing to ensure that such thing won't ever happen, use the
- *   Knuth-Pratt-Morris (KMP) implementation instead. In conclusion, choose 
- *   the proper string search algorithm depending on your setting. 
- *
- *   Say you're using the textsearch infrastructure for filtering, NIDS or 
- *   any similar security focused purpose, then go KMP. Otherwise, if you 
- *   really care about performance, say you're classifying packets to apply
- *   Quality of Service (QoS) policies, and you don't mind about possible
- *   matchings spread over multiple fragments, then go BM.
- */
-
-#include <linux/config.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/string.h>
-#include <linux/textsearch.h>
-
-/* Alphabet size, use ASCII */
-#define ASIZE 256
-
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(args, format...)
-#endif
-
-struct ts_bm
-{
-	u8 *		pattern;
-	unsigned int	patlen;
-	unsigned int 	bad_shift[ASIZE];
-	unsigned int	good_shift[0];
-};
-
-static unsigned int bm_find(struct ts_config *conf, struct ts_state *state)
-{
-	struct ts_bm *bm = ts_config_priv(conf);
-	unsigned int i, text_len, consumed = state->offset;
-	const u8 *text;
-	int shift = bm->patlen, bs;
-
-	for (;;) {
-		text_len = conf->get_next_block(consumed, &text, conf, state);
-
-		if (unlikely(text_len == 0))
-			break;
-
-		while (shift < text_len) {
-			DEBUGP("Searching in position %d (%c)\n", 
-				shift, text[shift]);
-			for (i = 0; i < bm->patlen; i++) 
-			     if (text[shift-i] != bm->pattern[bm->patlen-1-i])
-				     goto next;
-
-			/* London calling... */
-			DEBUGP("found!\n");
-			return consumed += (shift-(bm->patlen-1));
-
-next:			bs = bm->bad_shift[text[shift-i]];
-
-			/* Now jumping to... */
-			shift = max_t(int, shift-i+bs, shift+bm->good_shift[i]);
-		}
-		consumed += text_len;
-	}
-
-	return UINT_MAX;
-}
-
-static void compute_prefix_tbl(struct ts_bm *bm, const u8 *pattern,
-			       unsigned int len)
-{
-	int i, j, ended, l[ASIZE];
-
-	for (i = 0; i < ASIZE; i++)
-		bm->bad_shift[i] = len;
-	for (i = 0; i < len - 1; i++)
-		bm->bad_shift[pattern[i]] = len - 1 - i;
-
-	/* Compute the good shift array, used to match reocurrences 
-	 * of a subpattern */
-	for (i = 1; i < bm->patlen; i++) {
-		for (j = 0; j < bm->patlen && bm->pattern[bm->patlen - 1 - j]
-				== bm->pattern[bm->patlen - 1 - i - j]; j++);
-		l[i] = j;
-	}  
-
-	bm->good_shift[0] = 1;
-	for (i = 1; i < bm->patlen; i++)
-		bm->good_shift[i] = bm->patlen;
-	for (i = bm->patlen - 1; i > 0; i--)
-		bm->good_shift[l[i]] = i;
-	ended = 0;
-	for (i = 0; i < bm->patlen; i++) {
-		if (l[i] == bm->patlen - 1 - i)
-			ended = i;
-		if (ended)
-			bm->good_shift[i] = ended;
-	}
-}
-
-static struct ts_config *bm_init(const void *pattern, unsigned int len,
-				 int gfp_mask)
-{
-	struct ts_config *conf;
-	struct ts_bm *bm;
-	unsigned int prefix_tbl_len = len * sizeof(unsigned int);
-	size_t priv_size = sizeof(*bm) + len + prefix_tbl_len;
-
-	conf = alloc_ts_config(priv_size, gfp_mask);
-	if (IS_ERR(conf))
-		return conf;
-
-	bm = ts_config_priv(conf);
-	bm->patlen = len;
-	bm->pattern = (u8 *) bm->good_shift + prefix_tbl_len;
-	compute_prefix_tbl(bm, pattern, len);
-	memcpy(bm->pattern, pattern, len);
-
-	return conf;
-}
-
-static void *bm_get_pattern(struct ts_config *conf)
-{
-	struct ts_bm *bm = ts_config_priv(conf);
-	return bm->pattern;
-}
-
-static unsigned int bm_get_pattern_len(struct ts_config *conf)
-{
-	struct ts_bm *bm = ts_config_priv(conf);
-	return bm->patlen;
-}
-
-static struct ts_ops bm_ops = {
-	.name		  = "bm",
-	.find		  = bm_find,
-	.init		  = bm_init,
-	.get_pattern	  = bm_get_pattern,
-	.get_pattern_len  = bm_get_pattern_len,
-	.owner		  = THIS_MODULE,
-	.list		  = LIST_HEAD_INIT(bm_ops.list)
-};
-
-static int __init init_bm(void)
-{
-	return textsearch_register(&bm_ops);
-}
-
-static void __exit exit_bm(void)
-{
-	textsearch_unregister(&bm_ops);
-}
-
-MODULE_LICENSE("GPL");
-
-module_init(init_bm);
-module_exit(exit_bm);
diff --git a/trunk/mm/memory.c b/trunk/mm/memory.c
index a596c1172248..e046b7e4b530 100644
--- a/trunk/mm/memory.c
+++ b/trunk/mm/memory.c
@@ -498,17 +498,6 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
 	unsigned long addr = vma->vm_start;
 	unsigned long end = vma->vm_end;
 
-	/*
-	 * Don't copy ptes where a page fault will fill them correctly.
-	 * Fork becomes much lighter when there are big shared or private
-	 * readonly mappings. The tradeoff is that copy_page_range is more
-	 * efficient than faulting.
-	 */
-	if (!(vma->vm_flags & (VM_HUGETLB|VM_NONLINEAR|VM_RESERVED))) {
-		if (!vma->anon_vma)
-			return 0;
-	}
-
 	if (is_vm_hugetlb_page(vma))
 		return copy_hugetlb_page_range(dst_mm, src_mm, vma);
 
diff --git a/trunk/net/802/fc.c b/trunk/net/802/fc.c
index 282c4ab1abe6..640d34e026c2 100644
--- a/trunk/net/802/fc.c
+++ b/trunk/net/802/fc.c
@@ -87,7 +87,7 @@ static int fc_rebuild_header(struct sk_buff *skb)
 	struct fch_hdr *fch=(struct fch_hdr *)skb->data;
 	struct fcllc *fcllc=(struct fcllc *)(skb->data+sizeof(struct fch_hdr));
 	if(fcllc->ethertype != htons(ETH_P_IP)) {
-		printk("fc_rebuild_header: Don't know how to resolve type %04X addresses ?\n", ntohs(fcllc->ethertype));
+		printk("fc_rebuild_header: Don't know how to resolve type %04X addresses ?\n",(unsigned int)htons(fcllc->ethertype));
 		return 0;
 	}
 #ifdef CONFIG_INET
diff --git a/trunk/net/802/fddi.c b/trunk/net/802/fddi.c
index ac242a4bc346..5ce24c4bb840 100644
--- a/trunk/net/802/fddi.c
+++ b/trunk/net/802/fddi.c
@@ -108,8 +108,8 @@ static int fddi_rebuild_header(struct sk_buff	*skb)
 	else
 #endif	
 	{
-		printk("%s: Don't know how to resolve type %04X addresses.\n",
-		       skb->dev->name, ntohs(fddi->hdr.llc_snap.ethertype));
+		printk("%s: Don't know how to resolve type %02X addresses.\n",
+		       skb->dev->name, htons(fddi->hdr.llc_snap.ethertype));
 		return(0);
 	}
 }
diff --git a/trunk/net/802/hippi.c b/trunk/net/802/hippi.c
index 6d7fed3dd99a..051e8af56a77 100644
--- a/trunk/net/802/hippi.c
+++ b/trunk/net/802/hippi.c
@@ -51,7 +51,6 @@ static int hippi_header(struct sk_buff *skb, struct net_device *dev,
 			unsigned len)
 {
 	struct hippi_hdr *hip = (struct hippi_hdr *)skb_push(skb, HIPPI_HLEN);
-	struct hippi_cb *hcb = (struct hippi_cb *) skb->cb;
 
 	if (!len){
 		len = skb->len - HIPPI_HLEN;
@@ -85,10 +84,9 @@ static int hippi_header(struct sk_buff *skb, struct net_device *dev,
 	if (daddr)
 	{
 		memcpy(hip->le.dest_switch_addr, daddr + 3, 3);
-		memcpy(&hcb->ifield, daddr + 2, 4);
+		memcpy(&skb->private.ifield, daddr + 2, 4);
 		return HIPPI_HLEN;
 	}
-	hcb->ifield = 0;
 	return -((int)HIPPI_HLEN);
 }
 
@@ -124,7 +122,7 @@ static int hippi_rebuild_header(struct sk_buff *skb)
  *	Determine the packet's protocol ID.
  */
  
-__be16 hippi_type_trans(struct sk_buff *skb, struct net_device *dev)
+unsigned short hippi_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
 	struct hippi_hdr *hip;
 	
diff --git a/trunk/net/802/p8022.c b/trunk/net/802/p8022.c
index b24817c63ca8..5ae63416df6d 100644
--- a/trunk/net/802/p8022.c
+++ b/trunk/net/802/p8022.c
@@ -35,8 +35,7 @@ static int p8022_request(struct datalink_proto *dl, struct sk_buff *skb,
 struct datalink_proto *register_8022_client(unsigned char type,
 					    int (*func)(struct sk_buff *skb,
 							struct net_device *dev,
-							struct packet_type *pt,
-							struct net_device *orig_dev))
+							struct packet_type *pt))
 {
 	struct datalink_proto *proto;
 
diff --git a/trunk/net/802/p8023.c b/trunk/net/802/p8023.c
index 6368d3dce444..a0b61b40225f 100644
--- a/trunk/net/802/p8023.c
+++ b/trunk/net/802/p8023.c
@@ -20,7 +20,6 @@
 #include <linux/skbuff.h>
 
 #include <net/datalink.h>
-#include <net/p8022.h>
 
 /*
  *	Place an 802.3 header on a packet. The driver will do the mac
diff --git a/trunk/net/802/psnap.c b/trunk/net/802/psnap.c
index ab80b1fab53c..1053821ddf93 100644
--- a/trunk/net/802/psnap.c
+++ b/trunk/net/802/psnap.c
@@ -47,7 +47,7 @@ static struct datalink_proto *find_snap_client(unsigned char *desc)
  *	A SNAP packet has arrived
  */
 static int snap_rcv(struct sk_buff *skb, struct net_device *dev,
-		    struct packet_type *pt, struct net_device *orig_dev)
+		    struct packet_type *pt)
 {
 	int rc = 1;
 	struct datalink_proto *proto;
@@ -61,7 +61,7 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev,
 		/* Pass the frame on. */
 		skb->h.raw  += 5;
 		skb_pull(skb, 5);
-		rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev);
+		rc = proto->rcvfunc(skb, dev, &snap_packet_type);
 	} else {
 		skb->sk = NULL;
 		kfree_skb(skb);
@@ -118,8 +118,7 @@ module_exit(snap_exit);
 struct datalink_proto *register_snap_client(unsigned char *desc,
 					    int (*rcvfunc)(struct sk_buff *,
 						    	   struct net_device *,
-							   struct packet_type *,
-							   struct net_device *))
+							   struct packet_type *))
 {
 	struct datalink_proto *proto = NULL;
 
diff --git a/trunk/net/802/sysctl_net_802.c b/trunk/net/802/sysctl_net_802.c
index 700129556c13..36079630c49f 100644
--- a/trunk/net/802/sysctl_net_802.c
+++ b/trunk/net/802/sysctl_net_802.c
@@ -10,10 +10,9 @@
  *		2 of the License, or (at your option) any later version.
  */
 
-#include <linux/config.h>
 #include <linux/mm.h>
-#include <linux/if_tr.h>
 #include <linux/sysctl.h>
+#include <linux/config.h>
 
 #ifdef CONFIG_TR
 extern int sysctl_tr_rif_timeout;
diff --git a/trunk/net/8021q/vlan.h b/trunk/net/8021q/vlan.h
index 9ae3a14dd016..508b1fa14546 100644
--- a/trunk/net/8021q/vlan.h
+++ b/trunk/net/8021q/vlan.h
@@ -51,7 +51,7 @@ struct net_device *__find_vlan_dev(struct net_device* real_dev,
 /* found in vlan_dev.c */
 int vlan_dev_rebuild_header(struct sk_buff *skb);
 int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
-                  struct packet_type *ptype, struct net_device *orig_dev);
+                  struct packet_type* ptype);
 int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
                          unsigned short type, void *daddr, void *saddr,
                          unsigned len);
diff --git a/trunk/net/8021q/vlan_dev.c b/trunk/net/8021q/vlan_dev.c
index 145f5cde96cf..49c487413518 100644
--- a/trunk/net/8021q/vlan_dev.c
+++ b/trunk/net/8021q/vlan_dev.c
@@ -113,7 +113,7 @@ static inline struct sk_buff *vlan_check_reorder_header(struct sk_buff *skb)
  *
  */
 int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
-                  struct packet_type* ptype, struct net_device *orig_dev)
+                  struct packet_type* ptype)
 {
 	unsigned char *rawp = NULL;
 	struct vlan_hdr *vhdr = (struct vlan_hdr *)(skb->data);
diff --git a/trunk/net/Kconfig b/trunk/net/Kconfig
index 2bdd5623fdd5..40a31ba86d2c 100644
--- a/trunk/net/Kconfig
+++ b/trunk/net/Kconfig
@@ -147,7 +147,6 @@ source "net/bridge/netfilter/Kconfig"
 
 endif
 
-source "net/dccp/Kconfig"
 source "net/sctp/Kconfig"
 source "net/atm/Kconfig"
 source "net/bridge/Kconfig"
@@ -206,8 +205,6 @@ config NET_PKTGEN
 	  To compile this code as a module, choose M here: the
 	  module will be called pktgen.
 
-source "net/netfilter/Kconfig"
-
 endmenu
 
 endmenu
@@ -215,7 +212,6 @@ endmenu
 source "net/ax25/Kconfig"
 source "net/irda/Kconfig"
 source "net/bluetooth/Kconfig"
-source "net/ieee80211/Kconfig"
 
 endif   # if NET
 endmenu # Networking
diff --git a/trunk/net/Makefile b/trunk/net/Makefile
index 4aa2f46d2a56..8e2bdc025ab8 100644
--- a/trunk/net/Makefile
+++ b/trunk/net/Makefile
@@ -16,7 +16,6 @@ obj-$(CONFIG_NET)		+= $(tmp-y)
 obj-$(CONFIG_LLC)		+= llc/
 obj-$(CONFIG_NET)		+= ethernet/ 802/ sched/ netlink/
 obj-$(CONFIG_INET)		+= ipv4/
-obj-$(CONFIG_NETFILTER)		+= netfilter/
 obj-$(CONFIG_XFRM)		+= xfrm/
 obj-$(CONFIG_UNIX)		+= unix/
 ifneq ($(CONFIG_IPV6),)
@@ -42,9 +41,7 @@ obj-$(CONFIG_ATM)		+= atm/
 obj-$(CONFIG_DECNET)		+= decnet/
 obj-$(CONFIG_ECONET)		+= econet/
 obj-$(CONFIG_VLAN_8021Q)	+= 8021q/
-obj-$(CONFIG_IP_DCCP)		+= dccp/
 obj-$(CONFIG_IP_SCTP)		+= sctp/
-obj-$(CONFIG_IEEE80211)		+= ieee80211/
 
 ifeq ($(CONFIG_NET),y)
 obj-$(CONFIG_SYSCTL)		+= sysctl_net.o
diff --git a/trunk/net/appletalk/aarp.c b/trunk/net/appletalk/aarp.c
index 7076097debc2..c34614ea5fce 100644
--- a/trunk/net/appletalk/aarp.c
+++ b/trunk/net/appletalk/aarp.c
@@ -698,7 +698,7 @@ static void __aarp_resolved(struct aarp_entry **list, struct aarp_entry *a,
  *	frame. We currently only support Ethernet.
  */
 static int aarp_rcv(struct sk_buff *skb, struct net_device *dev,
-		    struct packet_type *pt, struct net_device *orig_dev)
+		    struct packet_type *pt)
 {
 	struct elapaarp *ea = aarp_hdr(skb);
 	int hash, ret = 0;
diff --git a/trunk/net/appletalk/ddp.c b/trunk/net/appletalk/ddp.c
index 1d31b3a3f1e5..192b529f86a4 100644
--- a/trunk/net/appletalk/ddp.c
+++ b/trunk/net/appletalk/ddp.c
@@ -53,12 +53,12 @@
 
 #include <linux/config.h>
 #include <linux/module.h>
+#include <linux/tcp.h>
 #include <linux/if_arp.h>
 #include <linux/termios.h>	/* For TIOCOUTQ/INQ */
 #include <net/datalink.h>
 #include <net/psnap.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
 #include <net/route.h>
 #include <linux/atalk.h>
 
@@ -1390,7 +1390,7 @@ static void atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
  *	[ie ARPHRD_ETHERTALK]
  */
 static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
-		     struct packet_type *pt, struct net_device *orig_dev)
+		     struct packet_type *pt)
 {
 	struct ddpehdr *ddp;
 	struct sock *sock;
@@ -1482,7 +1482,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
  * header and append a long one.
  */
 static int ltalk_rcv(struct sk_buff *skb, struct net_device *dev,
-		     struct packet_type *pt, struct net_device *orig_dev)
+			struct packet_type *pt)
 {
 	/* Expand any short form frames */
 	if (skb->mac.raw[2] == 1) {
@@ -1528,7 +1528,7 @@ static int ltalk_rcv(struct sk_buff *skb, struct net_device *dev,
 	}
 	skb->h.raw = skb->data;
 
-	return atalk_rcv(skb, dev, pt, orig_dev);
+	return atalk_rcv(skb, dev, pt);
 freeit:
 	kfree_skb(skb);
 	return 0;
diff --git a/trunk/net/atm/ipcommon.c b/trunk/net/atm/ipcommon.c
index 4b1faca5013f..181a3002d8ad 100644
--- a/trunk/net/atm/ipcommon.c
+++ b/trunk/net/atm/ipcommon.c
@@ -34,6 +34,7 @@
 
 void skb_migrate(struct sk_buff_head *from,struct sk_buff_head *to)
 {
+	struct sk_buff *skb;
 	unsigned long flags;
 	struct sk_buff *skb_from = (struct sk_buff *) from;
 	struct sk_buff *skb_to = (struct sk_buff *) to;
@@ -46,6 +47,8 @@ void skb_migrate(struct sk_buff_head *from,struct sk_buff_head *to)
 	prev->next = skb_to;
 	to->prev->next = from->next;
 	to->prev = from->prev;
+	for (skb = from->next; skb != skb_to; skb = skb->next)
+		skb->list = to;
 	to->qlen += from->qlen;
 	spin_unlock(&to->lock);
 	from->prev = skb_from;
diff --git a/trunk/net/ax25/af_ax25.c b/trunk/net/ax25/af_ax25.c
index ea43dfb774e2..a5c94f11547c 100644
--- a/trunk/net/ax25/af_ax25.c
+++ b/trunk/net/ax25/af_ax25.c
@@ -45,7 +45,7 @@
 #include <linux/sysctl.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <net/ip.h>
 #include <net/arp.h>
 
diff --git a/trunk/net/ax25/ax25_ds_in.c b/trunk/net/ax25/ax25_ds_in.c
index edcaa897027c..8adc0022cf58 100644
--- a/trunk/net/ax25/ax25_ds_in.c
+++ b/trunk/net/ax25/ax25_ds_in.c
@@ -22,7 +22,8 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/ip.h>			/* For ip_rcv */
+#include <net/tcp.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
diff --git a/trunk/net/ax25/ax25_ds_timer.c b/trunk/net/ax25/ax25_ds_timer.c
index 061083efc1dc..3a8b67316fc3 100644
--- a/trunk/net/ax25/ax25_ds_timer.c
+++ b/trunk/net/ax25/ax25_ds_timer.c
@@ -18,7 +18,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/trunk/net/ax25/ax25_in.c b/trunk/net/ax25/ax25_in.c
index 810c9c76c2e0..3dc808fde33f 100644
--- a/trunk/net/ax25/ax25_in.c
+++ b/trunk/net/ax25/ax25_in.c
@@ -9,6 +9,7 @@
  * Copyright (C) Joerg Reuter DL1BKE (jreuter@yaina.de)
  * Copyright (C) Hans-Joachim Hetscher DD8NE (dd8ne@bnv-bamberg.de)
  */
+#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -25,7 +26,9 @@
 #include <linux/skbuff.h>
 #include <linux/netfilter.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/ip.h>			/* For ip_rcv */
+#include <net/tcp.h>
+#include <net/arp.h>			/* For arp_rcv */
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
@@ -111,6 +114,7 @@ int ax25_rx_iframe(ax25_cb *ax25, struct sk_buff *skb)
 
 	pid = *skb->data;
 
+#ifdef CONFIG_INET
 	if (pid == AX25_P_IP) {
 		/* working around a TCP bug to keep additional listeners
 		 * happy. TCP re-uses the buffer and destroys the original
@@ -128,9 +132,10 @@ int ax25_rx_iframe(ax25_cb *ax25, struct sk_buff *skb)
 		skb->dev      = ax25->ax25_dev->dev;
 		skb->pkt_type = PACKET_HOST;
 		skb->protocol = htons(ETH_P_IP);
-		netif_rx(skb);
+		ip_rcv(skb, skb->dev, NULL);	/* Wrong ptype */
 		return 1;
 	}
+#endif
 	if (pid == AX25_P_SEGMENT) {
 		skb_pull(skb, 1);	/* Remove PID */
 		return ax25_rx_fragment(ax25, skb);
@@ -245,6 +250,7 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev,
 
 		/* Now we are pointing at the pid byte */
 		switch (skb->data[1]) {
+#ifdef CONFIG_INET
 		case AX25_P_IP:
 			skb_pull(skb,2);		/* drop PID/CTRL */
 			skb->h.raw    = skb->data;
@@ -252,7 +258,7 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev,
 			skb->dev      = dev;
 			skb->pkt_type = PACKET_HOST;
 			skb->protocol = htons(ETH_P_IP);
-			netif_rx(skb);
+			ip_rcv(skb, dev, ptype);	/* Note ptype here is the wrong one, fix me later */
 			break;
 
 		case AX25_P_ARP:
@@ -262,8 +268,9 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev,
 			skb->dev      = dev;
 			skb->pkt_type = PACKET_HOST;
 			skb->protocol = htons(ETH_P_ARP);
-			netif_rx(skb);
+			arp_rcv(skb, dev, ptype);	/* Note ptype here is wrong... */
 			break;
+#endif
 		case AX25_P_TEXT:
 			/* Now find a suitable dgram socket */
 			sk = ax25_get_socket(&dest, &src, SOCK_DGRAM);
@@ -447,7 +454,7 @@ static int ax25_rcv(struct sk_buff *skb, struct net_device *dev,
  *	Receive an AX.25 frame via a SLIP interface.
  */
 int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
-		  struct packet_type *ptype, struct net_device *orig_dev)
+		  struct packet_type *ptype)
 {
 	skb->sk = NULL;		/* Initially we don't know who it's for */
 	skb->destructor = NULL;	/* Who initializes this, dammit?! */
diff --git a/trunk/net/ax25/ax25_std_in.c b/trunk/net/ax25/ax25_std_in.c
index f6ed283e9de8..7131873322c4 100644
--- a/trunk/net/ax25/ax25_std_in.c
+++ b/trunk/net/ax25/ax25_std_in.c
@@ -29,7 +29,8 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/ip.h>			/* For ip_rcv */
+#include <net/tcp.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
diff --git a/trunk/net/ax25/ax25_std_timer.c b/trunk/net/ax25/ax25_std_timer.c
index a29c480a4dc1..066897bc0749 100644
--- a/trunk/net/ax25/ax25_std_timer.c
+++ b/trunk/net/ax25/ax25_std_timer.c
@@ -24,7 +24,7 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
diff --git a/trunk/net/ax25/ax25_subr.c b/trunk/net/ax25/ax25_subr.c
index c41dbe5fadee..99694b57f6f5 100644
--- a/trunk/net/ax25/ax25_subr.c
+++ b/trunk/net/ax25/ax25_subr.c
@@ -24,7 +24,7 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
@@ -76,7 +76,7 @@ void ax25_requeue_frames(ax25_cb *ax25)
 		if (skb_prev == NULL)
 			skb_queue_head(&ax25->write_queue, skb);
 		else
-			skb_append(skb_prev, skb, &ax25->write_queue);
+			skb_append(skb_prev, skb);
 		skb_prev = skb;
 	}
 }
diff --git a/trunk/net/bluetooth/hci_core.c b/trunk/net/bluetooth/hci_core.c
index 55dc42eac92c..ffa26c10bfe8 100644
--- a/trunk/net/bluetooth/hci_core.c
+++ b/trunk/net/bluetooth/hci_core.c
@@ -191,7 +191,7 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 
 	/* Special commands */
 	while ((skb = skb_dequeue(&hdev->driver_init))) {
-		bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
+		skb->pkt_type = HCI_COMMAND_PKT;
 		skb->dev = (void *) hdev;
 		skb_queue_tail(&hdev->cmd_q, skb);
 		hci_sched_cmd(hdev);
@@ -995,11 +995,11 @@ static int hci_send_frame(struct sk_buff *skb)
 		return -ENODEV;
 	}
 
-	BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
+	BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
 
 	if (atomic_read(&hdev->promisc)) {
 		/* Time stamp */
-		__net_timestamp(skb);
+		do_gettimeofday(&skb->stamp);
 
 		hci_send_to_sock(hdev, skb);
 	}
@@ -1034,7 +1034,7 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *p
 
 	BT_DBG("skb len %d", skb->len);
 
-	bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
+	skb->pkt_type = HCI_COMMAND_PKT;
 	skb->dev = (void *) hdev;
 	skb_queue_tail(&hdev->cmd_q, skb);
 	hci_sched_cmd(hdev);
@@ -1081,7 +1081,7 @@ int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
 	BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
 
 	skb->dev = (void *) hdev;
-	bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
+	skb->pkt_type = HCI_ACLDATA_PKT;
 	hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
 
 	if (!(list = skb_shinfo(skb)->frag_list)) {
@@ -1103,7 +1103,7 @@ int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
 			skb = list; list = list->next;
 			
 			skb->dev = (void *) hdev;
-			bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
+			skb->pkt_type = HCI_ACLDATA_PKT;
 			hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
 
 			BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
@@ -1139,7 +1139,7 @@ int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
 	memcpy(skb->h.raw, &hdr, HCI_SCO_HDR_SIZE);
 
 	skb->dev = (void *) hdev;
-	bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
+	skb->pkt_type = HCI_SCODATA_PKT;
 	skb_queue_tail(&conn->data_q, skb);
 	hci_sched_tx(hdev);
 	return 0;
@@ -1369,7 +1369,7 @@ void hci_rx_task(unsigned long arg)
 
 		if (test_bit(HCI_INIT, &hdev->flags)) {
 			/* Don't process data packets in this states. */
-			switch (bt_cb(skb)->pkt_type) {
+			switch (skb->pkt_type) {
 			case HCI_ACLDATA_PKT:
 			case HCI_SCODATA_PKT:
 				kfree_skb(skb);
@@ -1378,7 +1378,7 @@ void hci_rx_task(unsigned long arg)
 		}
 
 		/* Process frame */
-		switch (bt_cb(skb)->pkt_type) {
+		switch (skb->pkt_type) {
 		case HCI_EVENT_PKT:
 			hci_event_packet(hdev, skb);
 			break;
diff --git a/trunk/net/bluetooth/hci_event.c b/trunk/net/bluetooth/hci_event.c
index d6da0939216d..46367bd129c3 100644
--- a/trunk/net/bluetooth/hci_event.c
+++ b/trunk/net/bluetooth/hci_event.c
@@ -484,18 +484,14 @@ static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff
 /* Inquiry Result */
 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-	struct inquiry_data data;
 	struct inquiry_info *info = (struct inquiry_info *) (skb->data + 1);
 	int num_rsp = *((__u8 *) skb->data);
 
 	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 
-	if (!num_rsp)
-		return;
-
 	hci_dev_lock(hdev);
-
 	for (; num_rsp; num_rsp--) {
+		struct inquiry_data data;
 		bacpy(&data.bdaddr, &info->bdaddr);
 		data.pscan_rep_mode	= info->pscan_rep_mode;
 		data.pscan_period_mode	= info->pscan_period_mode;
@@ -506,55 +502,30 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
 		info++;
 		hci_inquiry_cache_update(hdev, &data);
 	}
-
 	hci_dev_unlock(hdev);
 }
 
 /* Inquiry Result With RSSI */
 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-	struct inquiry_data data;
+	struct inquiry_info_with_rssi *info = (struct inquiry_info_with_rssi *) (skb->data + 1);
 	int num_rsp = *((__u8 *) skb->data);
 
 	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 
-	if (!num_rsp)
-		return;
-
 	hci_dev_lock(hdev);
-
-	if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
-		struct inquiry_info_with_rssi_and_pscan_mode *info =
-			(struct inquiry_info_with_rssi_and_pscan_mode *) (skb->data + 1);
-
-		for (; num_rsp; num_rsp--) {
-			bacpy(&data.bdaddr, &info->bdaddr);
-			data.pscan_rep_mode	= info->pscan_rep_mode;
-			data.pscan_period_mode	= info->pscan_period_mode;
-			data.pscan_mode		= info->pscan_mode;
-			memcpy(data.dev_class, info->dev_class, 3);
-			data.clock_offset	= info->clock_offset;
-			data.rssi		= info->rssi;
-			info++;
-			hci_inquiry_cache_update(hdev, &data);
-		}
-	} else {
-		struct inquiry_info_with_rssi *info =
-			(struct inquiry_info_with_rssi *) (skb->data + 1);
-
-		for (; num_rsp; num_rsp--) {
-			bacpy(&data.bdaddr, &info->bdaddr);
-			data.pscan_rep_mode	= info->pscan_rep_mode;
-			data.pscan_period_mode	= info->pscan_period_mode;
-			data.pscan_mode		= 0x00;
-			memcpy(data.dev_class, info->dev_class, 3);
-			data.clock_offset	= info->clock_offset;
-			data.rssi		= info->rssi;
-			info++;
-			hci_inquiry_cache_update(hdev, &data);
-		}
+	for (; num_rsp; num_rsp--) {
+		struct inquiry_data data;
+		bacpy(&data.bdaddr, &info->bdaddr);
+		data.pscan_rep_mode	= info->pscan_rep_mode;
+		data.pscan_period_mode	= info->pscan_period_mode;
+		data.pscan_mode		= 0x00;
+		memcpy(data.dev_class, info->dev_class, 3);
+		data.clock_offset	= info->clock_offset;
+		data.rssi		= info->rssi;
+		info++;
+		hci_inquiry_cache_update(hdev, &data);
 	}
-
 	hci_dev_unlock(hdev);
 }
 
@@ -894,24 +865,6 @@ static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *sk
 	hci_dev_unlock(hdev);
 }
 
-/* Page Scan Repetition Mode */
-static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
-{
-	struct hci_ev_pscan_rep_mode *ev = (struct hci_ev_pscan_rep_mode *) skb->data;
-	struct inquiry_entry *ie;
-
-	BT_DBG("%s", hdev->name);
-
-	hci_dev_lock(hdev);
-
-	if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr))) {
-		ie->data.pscan_rep_mode = ev->pscan_rep_mode;
-		ie->timestamp = jiffies;
-	}
-
-	hci_dev_unlock(hdev);
-}
-
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
 {
 	struct hci_event_hdr *hdr = (struct hci_event_hdr *) skb->data;
@@ -984,10 +937,6 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
 		hci_clock_offset_evt(hdev, skb);
 		break;
 
-	case HCI_EV_PSCAN_REP_MODE:
-		hci_pscan_rep_mode_evt(hdev, skb);
-		break;
-
 	case HCI_EV_CMD_STATUS:
 		cs = (struct hci_ev_cmd_status *) skb->data;
 		skb_pull(skb, sizeof(cs));
@@ -1087,9 +1036,9 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
 	memcpy(ev->data, data, dlen);
 
 	bt_cb(skb)->incoming = 1;
-	__net_timestamp(skb);
+	do_gettimeofday(&skb->stamp);
 
-	bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
+	skb->pkt_type = HCI_EVENT_PKT;
 	skb->dev = (void *) hdev;
 	hci_send_to_sock(hdev, skb);
 	kfree_skb(skb);
diff --git a/trunk/net/bluetooth/hci_sock.c b/trunk/net/bluetooth/hci_sock.c
index 32ef7975a139..ebdcce5e7ca0 100644
--- a/trunk/net/bluetooth/hci_sock.c
+++ b/trunk/net/bluetooth/hci_sock.c
@@ -110,11 +110,11 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 		/* Apply filter */
 		flt = &hci_pi(sk)->filter;
 
-		if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
-				0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
+		if (!test_bit((skb->pkt_type == HCI_VENDOR_PKT) ?
+				0 : (skb->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
 			continue;
 
-		if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
+		if (skb->pkt_type == HCI_EVENT_PKT) {
 			register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
 
 			if (!hci_test_bit(evt, &flt->event_mask))
@@ -131,7 +131,7 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 			continue;
 
 		/* Put type byte before the data */
-		memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
+		memcpy(skb_push(nskb, 1), &nskb->pkt_type, 1);
 
 		if (sock_queue_rcv_skb(sk, nskb))
 			kfree_skb(nskb);
@@ -327,17 +327,11 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
 {
 	__u32 mask = hci_pi(sk)->cmsg_mask;
 
-	if (mask & HCI_CMSG_DIR) {
-		int incoming = bt_cb(skb)->incoming;
-		put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
-	}
-
-	if (mask & HCI_CMSG_TSTAMP) {
-		struct timeval tv;
+	if (mask & HCI_CMSG_DIR)
+		put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(int), &bt_cb(skb)->incoming);
 
-		skb_get_timestamp(skb, &tv);
-		put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(tv), &tv);
-	}
+	if (mask & HCI_CMSG_TSTAMP)
+		put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(skb->stamp), &skb->stamp);
 }
  
 static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 
@@ -411,11 +405,11 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 		goto drop;
 	}
 
-	bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
+	skb->pkt_type = *((unsigned char *) skb->data);
 	skb_pull(skb, 1);
 	skb->dev = (void *) hdev;
 
-	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
+	if (skb->pkt_type == HCI_COMMAND_PKT) {
 		u16 opcode = __le16_to_cpu(get_unaligned((u16 *)skb->data));
 		u16 ogf = hci_opcode_ogf(opcode);
 		u16 ocf = hci_opcode_ocf(opcode);
diff --git a/trunk/net/bluetooth/l2cap.c b/trunk/net/bluetooth/l2cap.c
index d3d6bc547212..32fccfb5bfa5 100644
--- a/trunk/net/bluetooth/l2cap.c
+++ b/trunk/net/bluetooth/l2cap.c
@@ -372,7 +372,7 @@ static struct proto l2cap_proto = {
 	.obj_size	= sizeof(struct l2cap_pinfo)
 };
 
-static struct sock *l2cap_sock_alloc(struct socket *sock, int proto, unsigned int __nocast prio)
+static struct sock *l2cap_sock_alloc(struct socket *sock, int proto, int prio)
 {
 	struct sock *sk;
 
diff --git a/trunk/net/bluetooth/rfcomm/core.c b/trunk/net/bluetooth/rfcomm/core.c
index 173f46e8cdae..27bf5047cd33 100644
--- a/trunk/net/bluetooth/rfcomm/core.c
+++ b/trunk/net/bluetooth/rfcomm/core.c
@@ -21,6 +21,10 @@
    SOFTWARE IS DISCLAIMED.
 */
 
+/* 
+   RPN support    -    Dirk Husemann <hud@zurich.ibm.com>
+*/
+
 /*
  * Bluetooth RFCOMM core.
  *
@@ -111,10 +115,10 @@ static void rfcomm_session_del(struct rfcomm_session *s);
 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 
 /* RPN macros */
-#define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
+#define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x3) << 3))
 #define __get_rpn_data_bits(line) ((line) & 0x3)
 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
-#define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
+#define __get_rpn_parity(line)    (((line) >> 3) & 0x3)
 
 static inline void rfcomm_schedule(uint event)
 {
@@ -229,7 +233,7 @@ static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 	d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 }
 
-struct rfcomm_dlc *rfcomm_dlc_alloc(unsigned int __nocast prio)
+struct rfcomm_dlc *rfcomm_dlc_alloc(int prio)
 {
 	struct rfcomm_dlc *d = kmalloc(sizeof(*d), prio);
 	if (!d)
@@ -776,10 +780,10 @@ static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d
 	return rfcomm_send_frame(s, buf, ptr - buf);
 }
 
-int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
-			u8 bit_rate, u8 data_bits, u8 stop_bits,
-			u8 parity, u8 flow_ctrl_settings, 
-			u8 xon_char, u8 xoff_char, u16 param_mask)
+static int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
+			   u8 bit_rate, u8 data_bits, u8 stop_bits,
+			   u8 parity, u8 flow_ctrl_settings, 
+			   u8 xon_char, u8 xoff_char, u16 param_mask)
 {
 	struct rfcomm_hdr *hdr;
 	struct rfcomm_mcc *mcc;
@@ -787,9 +791,9 @@ int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 	u8 buf[16], *ptr = buf;
 
 	BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
-			" flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x", 
-		s, cr, dlci, bit_rate, data_bits, stop_bits, parity, 
-		flow_ctrl_settings, xon_char, xoff_char, param_mask);
+	       "flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x", 
+			s, cr, dlci, bit_rate, data_bits, stop_bits, parity, 
+			flow_ctrl_settings, xon_char, xoff_char, param_mask);
 
 	hdr = (void *) ptr; ptr += sizeof(*hdr);
 	hdr->addr = __addr(s->initiator, 0);
@@ -1261,16 +1265,16 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 	u8 xon_char  = 0;
 	u8 xoff_char = 0;
 	u16 rpn_mask = RFCOMM_RPN_PM_ALL;
-
-	BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
-		dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
-		rpn->xon_char, rpn->xoff_char, rpn->param_mask);
-
-	if (!cr)
+	
+	BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x", 
+	       dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
+	       rpn->xon_char, rpn->xoff_char, rpn->param_mask);
+	
+	if (!cr) 
 		return 0;
-
+	
 	if (len == 1) {
-		/* This is a request, return default settings */
+		/* request: return default setting */
 		bit_rate  = RFCOMM_RPN_BR_115200;
 		data_bits = RFCOMM_RPN_DATA_8;
 		stop_bits = RFCOMM_RPN_STOP_1;
@@ -1278,12 +1282,11 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 		flow_ctrl = RFCOMM_RPN_FLOW_NONE;
 		xon_char  = RFCOMM_RPN_XON_CHAR;
 		xoff_char = RFCOMM_RPN_XOFF_CHAR;
+
 		goto rpn_out;
 	}
-
-	/* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
-	 * no parity, no flow control lines, normal XON/XOFF chars */
-
+	/* check for sane values: ignore/accept bit_rate, 8 bits, 1 stop bit, no parity,
+	                          no flow control lines, normal XON/XOFF chars */
 	if (rpn->param_mask & RFCOMM_RPN_PM_BITRATE) {
 		bit_rate = rpn->bit_rate;
 		if (bit_rate != RFCOMM_RPN_BR_115200) {
@@ -1292,7 +1295,6 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 			rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
 		}
 	}
-
 	if (rpn->param_mask & RFCOMM_RPN_PM_DATA) {
 		data_bits = __get_rpn_data_bits(rpn->line_settings);
 		if (data_bits != RFCOMM_RPN_DATA_8) {
@@ -1301,7 +1303,6 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 			rpn_mask ^= RFCOMM_RPN_PM_DATA;
 		}
 	}
-
 	if (rpn->param_mask & RFCOMM_RPN_PM_STOP) {
 		stop_bits = __get_rpn_stop_bits(rpn->line_settings);
 		if (stop_bits != RFCOMM_RPN_STOP_1) {
@@ -1310,7 +1311,6 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 			rpn_mask ^= RFCOMM_RPN_PM_STOP;
 		}
 	}
-
 	if (rpn->param_mask & RFCOMM_RPN_PM_PARITY) {
 		parity = __get_rpn_parity(rpn->line_settings);
 		if (parity != RFCOMM_RPN_PARITY_NONE) {
@@ -1319,7 +1319,6 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 			rpn_mask ^= RFCOMM_RPN_PM_PARITY;
 		}
 	}
-
 	if (rpn->param_mask & RFCOMM_RPN_PM_FLOW) {
 		flow_ctrl = rpn->flow_ctrl;
 		if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
@@ -1328,7 +1327,6 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 			rpn_mask ^= RFCOMM_RPN_PM_FLOW;
 		}
 	}
-
 	if (rpn->param_mask & RFCOMM_RPN_PM_XON) {
 		xon_char = rpn->xon_char;
 		if (xon_char != RFCOMM_RPN_XON_CHAR) {
@@ -1337,7 +1335,6 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 			rpn_mask ^= RFCOMM_RPN_PM_XON;
 		}
 	}
-
 	if (rpn->param_mask & RFCOMM_RPN_PM_XOFF) {
 		xoff_char = rpn->xoff_char;
 		if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
@@ -1348,8 +1345,9 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 	}
 
 rpn_out:
-	rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
-			parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
+	rfcomm_send_rpn(s, 0, dlci, 
+			bit_rate, data_bits, stop_bits, parity, flow_ctrl,
+			xon_char, xoff_char, rpn_mask);
 
 	return 0;
 }
@@ -1360,13 +1358,14 @@ static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb
 	u8 dlci = __get_dlci(rls->dlci);
 
 	BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
-
+	
 	if (!cr)
 		return 0;
 
-	/* We should probably do something with this information here. But
-	 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
-	 * mandatory to recognise and respond to RLS */
+	/* FIXME: We should probably do something with this
+	   information here. But for now it's sufficient just
+	   to reply -- Bluetooth 1.1 says it's mandatory to 
+	   recognise and respond to RLS */
 
 	rfcomm_send_rls(s, 0, dlci, rls->status);
 
@@ -1382,7 +1381,7 @@ static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb
 	BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
 
 	d = rfcomm_dlc_get(s, dlci);
-	if (!d)
+	if (!d) 
 		return 0;
 
 	if (cr) {
@@ -1390,7 +1389,7 @@ static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb
 			set_bit(RFCOMM_TX_THROTTLED, &d->flags);
 		else
 			clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
-
+		
 		rfcomm_dlc_lock(d);
 		if (d->modem_status)
 			d->modem_status(d, msc->v24_sig);
@@ -1399,7 +1398,7 @@ static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb
 		rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
 
 		d->mscex |= RFCOMM_MSCEX_RX;
-	} else
+	} else 
 		d->mscex |= RFCOMM_MSCEX_TX;
 
 	return 0;
diff --git a/trunk/net/bluetooth/rfcomm/sock.c b/trunk/net/bluetooth/rfcomm/sock.c
index 90e19eb6d3cc..63a123c5c41b 100644
--- a/trunk/net/bluetooth/rfcomm/sock.c
+++ b/trunk/net/bluetooth/rfcomm/sock.c
@@ -284,7 +284,7 @@ static struct proto rfcomm_proto = {
 	.obj_size	= sizeof(struct rfcomm_pinfo)
 };
 
-static struct sock *rfcomm_sock_alloc(struct socket *sock, int proto, unsigned int __nocast prio)
+static struct sock *rfcomm_sock_alloc(struct socket *sock, int proto, int prio)
 {
 	struct rfcomm_dlc *d;
 	struct sock *sk;
diff --git a/trunk/net/bluetooth/rfcomm/tty.c b/trunk/net/bluetooth/rfcomm/tty.c
index 1bca860a6109..6304590fd36a 100644
--- a/trunk/net/bluetooth/rfcomm/tty.c
+++ b/trunk/net/bluetooth/rfcomm/tty.c
@@ -286,7 +286,7 @@ static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *de
 	skb->destructor = rfcomm_wfree;
 }
 
-static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, unsigned int __nocast priority)
+static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, int priority)
 {
 	if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 		struct sk_buff *skb = alloc_skb(size, priority);
@@ -528,14 +528,9 @@ static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 	struct rfcomm_dev *dev = dlc->owner;
 	if (!dev)
 		return;
-
+	
 	BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 
-	if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
-		if (dev->tty && !C_CLOCAL(dev->tty))
-			tty_hangup(dev->tty);
-	}
-
 	dev->modem_status = 
 		((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 		((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
@@ -745,143 +740,20 @@ static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned
 	return -ENOIOCTLCMD;
 }
 
+#define RELEVANT_IFLAG(iflag) (iflag & (IGNBRK|BRKINT|IGNPAR|PARMRK|INPCK))
+
 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct termios *old)
 {
-	struct termios *new = (struct termios *) tty->termios;
-	int old_baud_rate = tty_termios_baud_rate(old);
-	int new_baud_rate = tty_termios_baud_rate(new);
-
-	u8 baud, data_bits, stop_bits, parity, x_on, x_off;
-	u16 changes = 0;
-
-	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-
-	BT_DBG("tty %p termios %p", tty, old);
-
-	/* Handle turning off CRTSCTS */
-	if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS)) 
-		BT_DBG("Turning off CRTSCTS unsupported");
-
-	/* Parity on/off and when on, odd/even */
-	if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
-			((old->c_cflag & PARODD) != (new->c_cflag & PARODD)) ) {
-		changes |= RFCOMM_RPN_PM_PARITY;
-		BT_DBG("Parity change detected.");
-	}
-
-	/* Mark and space parity are not supported! */
-	if (new->c_cflag & PARENB) {
-		if (new->c_cflag & PARODD) {
-			BT_DBG("Parity is ODD");
-			parity = RFCOMM_RPN_PARITY_ODD;
-		} else {
-			BT_DBG("Parity is EVEN");
-			parity = RFCOMM_RPN_PARITY_EVEN;
-		}
-	} else {
-		BT_DBG("Parity is OFF");
-		parity = RFCOMM_RPN_PARITY_NONE;
-	}
-
-	/* Setting the x_on / x_off characters */
-	if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
-		BT_DBG("XOFF custom");
-		x_on = new->c_cc[VSTOP];
-		changes |= RFCOMM_RPN_PM_XON;
-	} else {
-		BT_DBG("XOFF default");
-		x_on = RFCOMM_RPN_XON_CHAR;
-	}
-
-	if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
-		BT_DBG("XON custom");
-		x_off = new->c_cc[VSTART];
-		changes |= RFCOMM_RPN_PM_XOFF;
-	} else {
-		BT_DBG("XON default");
-		x_off = RFCOMM_RPN_XOFF_CHAR;
-	}
-
-	/* Handle setting of stop bits */
-	if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
-		changes |= RFCOMM_RPN_PM_STOP;
-
-	/* POSIX does not support 1.5 stop bits and RFCOMM does not
-	 * support 2 stop bits. So a request for 2 stop bits gets
-	 * translated to 1.5 stop bits */
-	if (new->c_cflag & CSTOPB) {
-		stop_bits = RFCOMM_RPN_STOP_15;
-	} else {
-		stop_bits = RFCOMM_RPN_STOP_1;
-	}
-
-	/* Handle number of data bits [5-8] */
-	if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE)) 
-		changes |= RFCOMM_RPN_PM_DATA;
-
-	switch (new->c_cflag & CSIZE) {
-	case CS5:
-		data_bits = RFCOMM_RPN_DATA_5;
-		break;
-	case CS6:
-		data_bits = RFCOMM_RPN_DATA_6;
-		break;
-	case CS7:
-		data_bits = RFCOMM_RPN_DATA_7;
-		break;
-	case CS8:
-		data_bits = RFCOMM_RPN_DATA_8;
-		break;
-	default:
-		data_bits = RFCOMM_RPN_DATA_8;
-		break;
-	}
+	BT_DBG("tty %p", tty);
 
-	/* Handle baudrate settings */
-	if (old_baud_rate != new_baud_rate)
-		changes |= RFCOMM_RPN_PM_BITRATE;
+	if ((tty->termios->c_cflag == old->c_cflag) &&
+		(RELEVANT_IFLAG(tty->termios->c_iflag) == RELEVANT_IFLAG(old->c_iflag)))
+		return;
 
-	switch (new_baud_rate) {
-	case 2400:
-		baud = RFCOMM_RPN_BR_2400;
-		break;
-	case 4800:
-		baud = RFCOMM_RPN_BR_4800;
-		break;
-	case 7200:
-		baud = RFCOMM_RPN_BR_7200;
-		break;
-	case 9600:
-		baud = RFCOMM_RPN_BR_9600;
-		break;
-	case 19200: 
-		baud = RFCOMM_RPN_BR_19200;
-		break;
-	case 38400:
-		baud = RFCOMM_RPN_BR_38400;
-		break;
-	case 57600:
-		baud = RFCOMM_RPN_BR_57600;
-		break;
-	case 115200:
-		baud = RFCOMM_RPN_BR_115200;
-		break;
-	case 230400:
-		baud = RFCOMM_RPN_BR_230400;
-		break;
-	default:
-		/* 9600 is standard accordinag to the RFCOMM specification */
-		baud = RFCOMM_RPN_BR_9600;
-		break;
-	
+	/* handle turning off CRTSCTS */
+	if ((old->c_cflag & CRTSCTS) && !(tty->termios->c_cflag & CRTSCTS)) {
+		BT_DBG("turning off CRTSCTS");
 	}
-
-	if (changes)
-		rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
-				data_bits, stop_bits, parity,
-				RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
-
-	return;
 }
 
 static void rfcomm_tty_throttle(struct tty_struct *tty)
@@ -889,7 +761,7 @@ static void rfcomm_tty_throttle(struct tty_struct *tty)
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 
 	BT_DBG("tty %p dev %p", tty, dev);
-
+	
 	rfcomm_dlc_throttle(dev->dlc);
 }
 
@@ -898,7 +770,7 @@ static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 
 	BT_DBG("tty %p dev %p", tty, dev);
-
+	
 	rfcomm_dlc_unthrottle(dev->dlc);
 }
 
@@ -969,35 +841,35 @@ static int rfcomm_tty_tiocmget(struct tty_struct *tty, struct file *filp)
 
 static int rfcomm_tty_tiocmset(struct tty_struct *tty, struct file *filp, unsigned int set, unsigned int clear)
 {
-	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	struct rfcomm_dlc *dlc = dev->dlc;
-	u8 v24_sig;
+ 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+ 	struct rfcomm_dlc *dlc = dev->dlc;
+ 	u8 v24_sig;
 
 	BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
 
-	rfcomm_dlc_get_modem_status(dlc, &v24_sig);
-
-	if (set & TIOCM_DSR || set & TIOCM_DTR)
-		v24_sig |= RFCOMM_V24_RTC;
-	if (set & TIOCM_RTS || set & TIOCM_CTS)
-		v24_sig |= RFCOMM_V24_RTR;
-	if (set & TIOCM_RI)
-		v24_sig |= RFCOMM_V24_IC;
-	if (set & TIOCM_CD)
-		v24_sig |= RFCOMM_V24_DV;
-
-	if (clear & TIOCM_DSR || clear & TIOCM_DTR)
-		v24_sig &= ~RFCOMM_V24_RTC;
-	if (clear & TIOCM_RTS || clear & TIOCM_CTS)
-		v24_sig &= ~RFCOMM_V24_RTR;
-	if (clear & TIOCM_RI)
-		v24_sig &= ~RFCOMM_V24_IC;
-	if (clear & TIOCM_CD)
-		v24_sig &= ~RFCOMM_V24_DV;
-
-	rfcomm_dlc_set_modem_status(dlc, v24_sig);
-
-	return 0;
+ 	rfcomm_dlc_get_modem_status(dlc, &v24_sig);
+
+ 	if (set & TIOCM_DSR || set & TIOCM_DTR)
+ 		v24_sig |= RFCOMM_V24_RTC;
+ 	if (set & TIOCM_RTS || set & TIOCM_CTS)
+ 		v24_sig |= RFCOMM_V24_RTR;
+ 	if (set & TIOCM_RI)
+ 		v24_sig |= RFCOMM_V24_IC;
+ 	if (set & TIOCM_CD)
+ 		v24_sig |= RFCOMM_V24_DV;
+
+ 	if (clear & TIOCM_DSR || clear & TIOCM_DTR)
+ 		v24_sig &= ~RFCOMM_V24_RTC;
+ 	if (clear & TIOCM_RTS || clear & TIOCM_CTS)
+ 		v24_sig &= ~RFCOMM_V24_RTR;
+ 	if (clear & TIOCM_RI)
+ 		v24_sig &= ~RFCOMM_V24_IC;
+ 	if (clear & TIOCM_CD)
+ 		v24_sig &= ~RFCOMM_V24_DV;
+
+ 	rfcomm_dlc_set_modem_status(dlc, v24_sig);
+
+ 	return 0;
 }
 
 /* ---- TTY structure ---- */
diff --git a/trunk/net/bluetooth/sco.c b/trunk/net/bluetooth/sco.c
index ce7ab7dfa0b2..746c11fc017e 100644
--- a/trunk/net/bluetooth/sco.c
+++ b/trunk/net/bluetooth/sco.c
@@ -418,7 +418,7 @@ static struct proto sco_proto = {
 	.obj_size	= sizeof(struct sco_pinfo)
 };
 
-static struct sock *sco_sock_alloc(struct socket *sock, int proto, unsigned int __nocast prio)
+static struct sock *sco_sock_alloc(struct socket *sock, int proto, int prio)
 {
 	struct sock *sk;
 
diff --git a/trunk/net/bridge/br_fdb.c b/trunk/net/bridge/br_fdb.c
index 24396b914d11..e6c2200b7ca3 100644
--- a/trunk/net/bridge/br_fdb.c
+++ b/trunk/net/bridge/br_fdb.c
@@ -23,7 +23,7 @@
 #include <asm/atomic.h>
 #include "br_private.h"
 
-static kmem_cache_t *br_fdb_cache __read_mostly;
+static kmem_cache_t *br_fdb_cache;
 static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
 		      const unsigned char *addr);
 
diff --git a/trunk/net/bridge/netfilter/ebt_mark.c b/trunk/net/bridge/netfilter/ebt_mark.c
index c93d35ab95c0..02c632b4d325 100644
--- a/trunk/net/bridge/netfilter/ebt_mark.c
+++ b/trunk/net/bridge/netfilter/ebt_mark.c
@@ -23,9 +23,10 @@ static int ebt_target_mark(struct sk_buff **pskb, unsigned int hooknr,
 {
 	struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
 
-	if ((*pskb)->nfmark != info->mark)
+	if ((*pskb)->nfmark != info->mark) {
 		(*pskb)->nfmark = info->mark;
-
+		(*pskb)->nfcache |= NFC_ALTERED;
+	}
 	return info->target;
 }
 
diff --git a/trunk/net/bridge/netfilter/ebt_ulog.c b/trunk/net/bridge/netfilter/ebt_ulog.c
index aae26ae2e61f..01af4fcef26d 100644
--- a/trunk/net/bridge/netfilter/ebt_ulog.c
+++ b/trunk/net/bridge/netfilter/ebt_ulog.c
@@ -78,8 +78,8 @@ static void ulog_send(unsigned int nlgroup)
 	if (ub->qlen > 1)
 		ub->lastnlh->nlmsg_type = NLMSG_DONE;
 
-	NETLINK_CB(ub->skb).dst_group = nlgroup + 1;
-	netlink_broadcast(ebtulognl, ub->skb, 0, nlgroup + 1, GFP_ATOMIC);
+	NETLINK_CB(ub->skb).dst_groups = 1 << nlgroup;
+	netlink_broadcast(ebtulognl, ub->skb, 0, 1 << nlgroup, GFP_ATOMIC);
 
 	ub->qlen = 0;
 	ub->skb = NULL;
@@ -162,7 +162,7 @@ static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
 	pm->version = EBT_ULOG_VERSION;
 	do_gettimeofday(&pm->stamp);
 	if (ub->qlen == 1)
-		skb_set_timestamp(ub->skb, &pm->stamp);
+		ub->skb->stamp = pm->stamp;
 	pm->data_len = copy_len;
 	pm->mark = skb->nfmark;
 	pm->hook = hooknr;
@@ -258,8 +258,7 @@ static int __init init(void)
 		spin_lock_init(&ulog_buffers[i].lock);
 	}
 
-	ebtulognl = netlink_kernel_create(NETLINK_NFLOG, EBT_ULOG_MAXNLGROUPS,
-	                                  NULL, THIS_MODULE);
+	ebtulognl = netlink_kernel_create(NETLINK_NFLOG, NULL);
 	if (!ebtulognl)
 		ret = -ENOMEM;
 	else if ((ret = ebt_register_watcher(&ulog)))
diff --git a/trunk/net/core/Makefile b/trunk/net/core/Makefile
index 630da0f0579e..f5f5e58943e8 100644
--- a/trunk/net/core/Makefile
+++ b/trunk/net/core/Makefile
@@ -12,6 +12,7 @@ obj-y		     += dev.o ethtool.o dev_mcast.o dst.o \
 
 obj-$(CONFIG_XFRM) += flow.o
 obj-$(CONFIG_SYSFS) += net-sysfs.o
+obj-$(CONFIG_NETFILTER) += netfilter.o
 obj-$(CONFIG_NET_DIVERT) += dv.o
 obj-$(CONFIG_NET_PKTGEN) += pktgen.o
 obj-$(CONFIG_NET_RADIO) += wireless.o
diff --git a/trunk/net/core/datagram.c b/trunk/net/core/datagram.c
index da9bf71421a7..fcee054b6f75 100644
--- a/trunk/net/core/datagram.c
+++ b/trunk/net/core/datagram.c
@@ -43,6 +43,7 @@
 #include <linux/errno.h>
 #include <linux/sched.h>
 #include <linux/inet.h>
+#include <linux/tcp.h>
 #include <linux/netdevice.h>
 #include <linux/rtnetlink.h>
 #include <linux/poll.h>
@@ -50,10 +51,9 @@
 
 #include <net/protocol.h>
 #include <linux/skbuff.h>
-
-#include <net/checksum.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/checksum.h>
+
 
 /*
  *	Is a socket 'connection oriented' ?
diff --git a/trunk/net/core/dev.c b/trunk/net/core/dev.c
index c01511e3d0c1..faf59b02c4bf 100644
--- a/trunk/net/core/dev.c
+++ b/trunk/net/core/dev.c
@@ -267,6 +267,10 @@ void dev_add_pack(struct packet_type *pt)
 	spin_unlock_bh(&ptype_lock);
 }
 
+extern void linkwatch_run_queue(void);
+
+
+
 /**
  *	__dev_remove_pack	 - remove packet handler
  *	@pt: packet type declaration
@@ -1005,22 +1009,13 @@ void net_disable_timestamp(void)
 	atomic_dec(&netstamp_needed);
 }
 
-void __net_timestamp(struct sk_buff *skb)
-{
-	struct timeval tv;
-
-	do_gettimeofday(&tv);
-	skb_set_timestamp(skb, &tv);
-}
-EXPORT_SYMBOL(__net_timestamp);
-
-static inline void net_timestamp(struct sk_buff *skb)
+static inline void net_timestamp(struct timeval *stamp)
 {
 	if (atomic_read(&netstamp_needed))
-		__net_timestamp(skb);
+		do_gettimeofday(stamp);
 	else {
-		skb->tstamp.off_sec = 0;
-		skb->tstamp.off_usec = 0;
+		stamp->tv_sec = 0;
+		stamp->tv_usec = 0;
 	}
 }
 
@@ -1032,8 +1027,7 @@ static inline void net_timestamp(struct sk_buff *skb)
 void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct packet_type *ptype;
-
-	net_timestamp(skb);
+	net_timestamp(&skb->stamp);
 
 	rcu_read_lock();
 	list_for_each_entry_rcu(ptype, &ptype_all, list) {
@@ -1064,7 +1058,7 @@ void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
 
 			skb2->h.raw = skb2->nh.raw;
 			skb2->pkt_type = PACKET_OUTGOING;
-			ptype->func(skb2, skb->dev, ptype, skb->dev);
+			ptype->func(skb2, skb->dev, ptype);
 		}
 	}
 	rcu_read_unlock();
@@ -1129,6 +1123,8 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
 #define illegal_highdma(dev, skb)	(0)
 #endif
 
+extern void skb_release_data(struct sk_buff *);
+
 /* Keep head the same: replace data */
 int __skb_linearize(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
@@ -1383,8 +1379,8 @@ int netif_rx(struct sk_buff *skb)
 	if (netpoll_rx(skb))
 		return NET_RX_DROP;
 
-	if (!skb->tstamp.off_sec)
-		net_timestamp(skb);
+	if (!skb->stamp.tv_sec)
+		net_timestamp(&skb->stamp);
 
 	/*
 	 * The code is rearranged so that the path is the most
@@ -1429,14 +1425,14 @@ int netif_rx_ni(struct sk_buff *skb)
 
 EXPORT_SYMBOL(netif_rx_ni);
 
-static inline struct net_device *skb_bond(struct sk_buff *skb)
+static __inline__ void skb_bond(struct sk_buff *skb)
 {
 	struct net_device *dev = skb->dev;
 
-	if (dev->master)
+	if (dev->master) {
+		skb->real_dev = skb->dev;
 		skb->dev = dev->master;
-
-	return dev;
+	}
 }
 
 static void net_tx_action(struct softirq_action *h)
@@ -1486,11 +1482,10 @@ static void net_tx_action(struct softirq_action *h)
 }
 
 static __inline__ int deliver_skb(struct sk_buff *skb,
-				  struct packet_type *pt_prev,
-				  struct net_device *orig_dev)
+				  struct packet_type *pt_prev)
 {
 	atomic_inc(&skb->users);
-	return pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
+	return pt_prev->func(skb, skb->dev, pt_prev);
 }
 
 #if defined(CONFIG_BRIDGE) || defined (CONFIG_BRIDGE_MODULE)
@@ -1501,8 +1496,7 @@ struct net_bridge_fdb_entry *(*br_fdb_get_hook)(struct net_bridge *br,
 void (*br_fdb_put_hook)(struct net_bridge_fdb_entry *ent);
 
 static __inline__ int handle_bridge(struct sk_buff **pskb,
-				    struct packet_type **pt_prev, int *ret,
-				    struct net_device *orig_dev)
+				    struct packet_type **pt_prev, int *ret)
 {
 	struct net_bridge_port *port;
 
@@ -1511,14 +1505,14 @@ static __inline__ int handle_bridge(struct sk_buff **pskb,
 		return 0;
 
 	if (*pt_prev) {
-		*ret = deliver_skb(*pskb, *pt_prev, orig_dev);
+		*ret = deliver_skb(*pskb, *pt_prev);
 		*pt_prev = NULL;
 	} 
 	
 	return br_handle_frame_hook(port, pskb);
 }
 #else
-#define handle_bridge(skb, pt_prev, ret, orig_dev)	(0)
+#define handle_bridge(skb, pt_prev, ret)	(0)
 #endif
 
 #ifdef CONFIG_NET_CLS_ACT
@@ -1540,14 +1534,17 @@ static int ing_filter(struct sk_buff *skb)
 		__u32 ttl = (__u32) G_TC_RTTL(skb->tc_verd);
 		if (MAX_RED_LOOP < ttl++) {
 			printk("Redir loop detected Dropping packet (%s->%s)\n",
-				skb->input_dev->name, skb->dev->name);
+				skb->input_dev?skb->input_dev->name:"??",skb->dev->name);
 			return TC_ACT_SHOT;
 		}
 
 		skb->tc_verd = SET_TC_RTTL(skb->tc_verd,ttl);
 
 		skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_INGRESS);
-
+		if (NULL == skb->input_dev) {
+			skb->input_dev = skb->dev;
+			printk("ing_filter:  fixed  %s out %s\n",skb->input_dev->name,skb->dev->name);
+		}
 		spin_lock(&dev->ingress_lock);
 		if ((q = dev->qdisc_ingress) != NULL)
 			result = q->enqueue(skb, q);
@@ -1562,7 +1559,6 @@ static int ing_filter(struct sk_buff *skb)
 int netif_receive_skb(struct sk_buff *skb)
 {
 	struct packet_type *ptype, *pt_prev;
-	struct net_device *orig_dev;
 	int ret = NET_RX_DROP;
 	unsigned short type;
 
@@ -1570,13 +1566,10 @@ int netif_receive_skb(struct sk_buff *skb)
 	if (skb->dev->poll && netpoll_rx(skb))
 		return NET_RX_DROP;
 
-	if (!skb->tstamp.off_sec)
-		net_timestamp(skb);
-
-	if (!skb->input_dev)
-		skb->input_dev = skb->dev;
+	if (!skb->stamp.tv_sec)
+		net_timestamp(&skb->stamp);
 
-	orig_dev = skb_bond(skb);
+	skb_bond(skb);
 
 	__get_cpu_var(netdev_rx_stat).total++;
 
@@ -1597,14 +1590,14 @@ int netif_receive_skb(struct sk_buff *skb)
 	list_for_each_entry_rcu(ptype, &ptype_all, list) {
 		if (!ptype->dev || ptype->dev == skb->dev) {
 			if (pt_prev) 
-				ret = deliver_skb(skb, pt_prev, orig_dev);
+				ret = deliver_skb(skb, pt_prev);
 			pt_prev = ptype;
 		}
 	}
 
 #ifdef CONFIG_NET_CLS_ACT
 	if (pt_prev) {
-		ret = deliver_skb(skb, pt_prev, orig_dev);
+		ret = deliver_skb(skb, pt_prev);
 		pt_prev = NULL; /* noone else should process this after*/
 	} else {
 		skb->tc_verd = SET_TC_OK2MUNGE(skb->tc_verd);
@@ -1623,7 +1616,7 @@ int netif_receive_skb(struct sk_buff *skb)
 
 	handle_diverter(skb);
 
-	if (handle_bridge(&skb, &pt_prev, &ret, orig_dev))
+	if (handle_bridge(&skb, &pt_prev, &ret))
 		goto out;
 
 	type = skb->protocol;
@@ -1631,13 +1624,13 @@ int netif_receive_skb(struct sk_buff *skb)
 		if (ptype->type == type &&
 		    (!ptype->dev || ptype->dev == skb->dev)) {
 			if (pt_prev) 
-				ret = deliver_skb(skb, pt_prev, orig_dev);
+				ret = deliver_skb(skb, pt_prev);
 			pt_prev = ptype;
 		}
 	}
 
 	if (pt_prev) {
-		ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
+		ret = pt_prev->func(skb, skb->dev, pt_prev);
 	} else {
 		kfree_skb(skb);
 		/* Jamal, now you will not able to escape explaining
diff --git a/trunk/net/core/ethtool.c b/trunk/net/core/ethtool.c
index 289c1b5a8e4a..a3eeb88e1c81 100644
--- a/trunk/net/core/ethtool.c
+++ b/trunk/net/core/ethtool.c
@@ -81,18 +81,6 @@ int ethtool_op_set_tso(struct net_device *dev, u32 data)
 	return 0;
 }
 
-int ethtool_op_get_perm_addr(struct net_device *dev, struct ethtool_perm_addr *addr, u8 *data)
-{
-	unsigned char len = dev->addr_len;
-	if ( addr->size < len )
-		return -ETOOSMALL;
-	
-	addr->size = len;
-	memcpy(data, dev->perm_addr, len);
-	return 0;
-}
- 
-
 /* Handlers for each ethtool command */
 
 static int ethtool_get_settings(struct net_device *dev, void __user *useraddr)
@@ -695,39 +683,6 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
 	return ret;
 }
 
-static int ethtool_get_perm_addr(struct net_device *dev, void *useraddr)
-{
-	struct ethtool_perm_addr epaddr;
-	u8 *data;
-	int ret;
-
-	if (!dev->ethtool_ops->get_perm_addr)
-		return -EOPNOTSUPP;
-
-	if (copy_from_user(&epaddr,useraddr,sizeof(epaddr)))
-		return -EFAULT;
-
-	data = kmalloc(epaddr.size, GFP_USER);
-	if (!data)
-		return -ENOMEM;
-
-	ret = dev->ethtool_ops->get_perm_addr(dev,&epaddr,data);
-	if (ret)
-		return ret;
-
-	ret = -EFAULT;
-	if (copy_to_user(useraddr, &epaddr, sizeof(epaddr)))
-		goto out;
-	useraddr += sizeof(epaddr);
-	if (copy_to_user(useraddr, data, epaddr.size))
-		goto out;
-	ret = 0;
-
- out:
-	kfree(data);
-	return ret;
-}
-
 /* The main entry point in this file.  Called from net/core/dev.c */
 
 int dev_ethtool(struct ifreq *ifr)
@@ -851,9 +806,6 @@ int dev_ethtool(struct ifreq *ifr)
 	case ETHTOOL_GSTATS:
 		rc = ethtool_get_stats(dev, useraddr);
 		break;
-	case ETHTOOL_GPERMADDR:
-		rc = ethtool_get_perm_addr(dev, useraddr);
-		break;
 	default:
 		rc =  -EOPNOTSUPP;
 	}
@@ -874,7 +826,6 @@ int dev_ethtool(struct ifreq *ifr)
 
 EXPORT_SYMBOL(dev_ethtool);
 EXPORT_SYMBOL(ethtool_op_get_link);
-EXPORT_SYMBOL_GPL(ethtool_op_get_perm_addr);
 EXPORT_SYMBOL(ethtool_op_get_sg);
 EXPORT_SYMBOL(ethtool_op_get_tso);
 EXPORT_SYMBOL(ethtool_op_get_tx_csum);
diff --git a/trunk/net/core/flow.c b/trunk/net/core/flow.c
index 7e95b39de9fd..f289570b15a3 100644
--- a/trunk/net/core/flow.c
+++ b/trunk/net/core/flow.c
@@ -42,7 +42,7 @@ static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
 
 #define flow_table(cpu) (per_cpu(flow_tables, cpu))
 
-static kmem_cache_t *flow_cachep __read_mostly;
+static kmem_cache_t *flow_cachep;
 
 static int flow_lwm, flow_hwm;
 
diff --git a/trunk/net/core/neighbour.c b/trunk/net/core/neighbour.c
index 39fc55edf691..1beb782ac41b 100644
--- a/trunk/net/core/neighbour.c
+++ b/trunk/net/core/neighbour.c
@@ -1217,7 +1217,7 @@ static void neigh_proxy_process(unsigned long arg)
 
 	while (skb != (struct sk_buff *)&tbl->proxy_queue) {
 		struct sk_buff *back = skb;
-		long tdif = NEIGH_CB(back)->sched_next - now;
+		long tdif = back->stamp.tv_usec - now;
 
 		skb = skb->next;
 		if (tdif <= 0) {
@@ -1248,9 +1248,8 @@ void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
 		kfree_skb(skb);
 		return;
 	}
-
-	NEIGH_CB(skb)->sched_next = sched_next;
-	NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
+	skb->stamp.tv_sec  = LOCALLY_ENQUEUED;
+	skb->stamp.tv_usec = sched_next;
 
 	spin_lock(&tbl->proxy_queue.lock);
 	if (del_timer(&tbl->proxy_timer)) {
@@ -2343,8 +2342,8 @@ void neigh_app_ns(struct neighbour *n)
 	}
 	nlh			   = (struct nlmsghdr *)skb->data;
 	nlh->nlmsg_flags	   = NLM_F_REQUEST;
-	NETLINK_CB(skb).dst_group  = RTNLGRP_NEIGH;
-	netlink_broadcast(rtnl, skb, 0, RTNLGRP_NEIGH, GFP_ATOMIC);
+	NETLINK_CB(skb).dst_groups = RTMGRP_NEIGH;
+	netlink_broadcast(rtnl, skb, 0, RTMGRP_NEIGH, GFP_ATOMIC);
 }
 
 static void neigh_app_notify(struct neighbour *n)
@@ -2361,8 +2360,8 @@ static void neigh_app_notify(struct neighbour *n)
 		return;
 	}
 	nlh			   = (struct nlmsghdr *)skb->data;
-	NETLINK_CB(skb).dst_group  = RTNLGRP_NEIGH;
-	netlink_broadcast(rtnl, skb, 0, RTNLGRP_NEIGH, GFP_ATOMIC);
+	NETLINK_CB(skb).dst_groups = RTMGRP_NEIGH;
+	netlink_broadcast(rtnl, skb, 0, RTMGRP_NEIGH, GFP_ATOMIC);
 }
 
 #endif /* CONFIG_ARPD */
diff --git a/trunk/net/core/netfilter.c b/trunk/net/core/netfilter.c
new file mode 100644
index 000000000000..076c156d5eda
--- /dev/null
+++ b/trunk/net/core/netfilter.c
@@ -0,0 +1,648 @@
+/* netfilter.c: look after the filters for various protocols. 
+ * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
+ *
+ * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
+ * way.
+ *
+ * Rusty Russell (C)2000 -- This code is GPL.
+ *
+ * February 2000: Modified by James Morris to have 1 queue per protocol.
+ * 15-Mar-2000:   Added NF_REPEAT --RR.
+ * 08-May-2003:	  Internal logging interface added by Jozsef Kadlecsik.
+ */
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/netfilter.h>
+#include <net/protocol.h>
+#include <linux/init.h>
+#include <linux/skbuff.h>
+#include <linux/wait.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/if.h>
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
+#include <linux/icmp.h>
+#include <net/sock.h>
+#include <net/route.h>
+#include <linux/ip.h>
+
+/* In this code, we can be waiting indefinitely for userspace to
+ * service a packet if a hook returns NF_QUEUE.  We could keep a count
+ * of skbuffs queued for userspace, and not deregister a hook unless
+ * this is zero, but that sucks.  Now, we simply check when the
+ * packets come back: if the hook is gone, the packet is discarded. */
+#ifdef CONFIG_NETFILTER_DEBUG
+#define NFDEBUG(format, args...)  printk(format , ## args)
+#else
+#define NFDEBUG(format, args...)
+#endif
+
+/* Sockopts only registered and called from user context, so
+   net locking would be overkill.  Also, [gs]etsockopt calls may
+   sleep. */
+static DECLARE_MUTEX(nf_sockopt_mutex);
+
+struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
+static LIST_HEAD(nf_sockopts);
+static DEFINE_SPINLOCK(nf_hook_lock);
+
+/* 
+ * A queue handler may be registered for each protocol.  Each is protected by
+ * long term mutex.  The handler must provide an an outfn() to accept packets
+ * for queueing and must reinject all packets it receives, no matter what.
+ */
+static struct nf_queue_handler_t {
+	nf_queue_outfn_t outfn;
+	void *data;
+} queue_handler[NPROTO];
+static DEFINE_RWLOCK(queue_handler_lock);
+
+int nf_register_hook(struct nf_hook_ops *reg)
+{
+	struct list_head *i;
+
+	spin_lock_bh(&nf_hook_lock);
+	list_for_each(i, &nf_hooks[reg->pf][reg->hooknum]) {
+		if (reg->priority < ((struct nf_hook_ops *)i)->priority)
+			break;
+	}
+	list_add_rcu(&reg->list, i->prev);
+	spin_unlock_bh(&nf_hook_lock);
+
+	synchronize_net();
+	return 0;
+}
+
+void nf_unregister_hook(struct nf_hook_ops *reg)
+{
+	spin_lock_bh(&nf_hook_lock);
+	list_del_rcu(&reg->list);
+	spin_unlock_bh(&nf_hook_lock);
+
+	synchronize_net();
+}
+
+/* Do exclusive ranges overlap? */
+static inline int overlap(int min1, int max1, int min2, int max2)
+{
+	return max1 > min2 && min1 < max2;
+}
+
+/* Functions to register sockopt ranges (exclusive). */
+int nf_register_sockopt(struct nf_sockopt_ops *reg)
+{
+	struct list_head *i;
+	int ret = 0;
+
+	if (down_interruptible(&nf_sockopt_mutex) != 0)
+		return -EINTR;
+
+	list_for_each(i, &nf_sockopts) {
+		struct nf_sockopt_ops *ops = (struct nf_sockopt_ops *)i;
+		if (ops->pf == reg->pf
+		    && (overlap(ops->set_optmin, ops->set_optmax, 
+				reg->set_optmin, reg->set_optmax)
+			|| overlap(ops->get_optmin, ops->get_optmax, 
+				   reg->get_optmin, reg->get_optmax))) {
+			NFDEBUG("nf_sock overlap: %u-%u/%u-%u v %u-%u/%u-%u\n",
+				ops->set_optmin, ops->set_optmax, 
+				ops->get_optmin, ops->get_optmax, 
+				reg->set_optmin, reg->set_optmax,
+				reg->get_optmin, reg->get_optmax);
+			ret = -EBUSY;
+			goto out;
+		}
+	}
+
+	list_add(&reg->list, &nf_sockopts);
+out:
+	up(&nf_sockopt_mutex);
+	return ret;
+}
+
+void nf_unregister_sockopt(struct nf_sockopt_ops *reg)
+{
+	/* No point being interruptible: we're probably in cleanup_module() */
+ restart:
+	down(&nf_sockopt_mutex);
+	if (reg->use != 0) {
+		/* To be woken by nf_sockopt call... */
+		/* FIXME: Stuart Young's name appears gratuitously. */
+		set_current_state(TASK_UNINTERRUPTIBLE);
+		reg->cleanup_task = current;
+		up(&nf_sockopt_mutex);
+		schedule();
+		goto restart;
+	}
+	list_del(&reg->list);
+	up(&nf_sockopt_mutex);
+}
+
+/* Call get/setsockopt() */
+static int nf_sockopt(struct sock *sk, int pf, int val, 
+		      char __user *opt, int *len, int get)
+{
+	struct list_head *i;
+	struct nf_sockopt_ops *ops;
+	int ret;
+
+	if (down_interruptible(&nf_sockopt_mutex) != 0)
+		return -EINTR;
+
+	list_for_each(i, &nf_sockopts) {
+		ops = (struct nf_sockopt_ops *)i;
+		if (ops->pf == pf) {
+			if (get) {
+				if (val >= ops->get_optmin
+				    && val < ops->get_optmax) {
+					ops->use++;
+					up(&nf_sockopt_mutex);
+					ret = ops->get(sk, val, opt, len);
+					goto out;
+				}
+			} else {
+				if (val >= ops->set_optmin
+				    && val < ops->set_optmax) {
+					ops->use++;
+					up(&nf_sockopt_mutex);
+					ret = ops->set(sk, val, opt, *len);
+					goto out;
+				}
+			}
+		}
+	}
+	up(&nf_sockopt_mutex);
+	return -ENOPROTOOPT;
+	
+ out:
+	down(&nf_sockopt_mutex);
+	ops->use--;
+	if (ops->cleanup_task)
+		wake_up_process(ops->cleanup_task);
+	up(&nf_sockopt_mutex);
+	return ret;
+}
+
+int nf_setsockopt(struct sock *sk, int pf, int val, char __user *opt,
+		  int len)
+{
+	return nf_sockopt(sk, pf, val, opt, &len, 0);
+}
+
+int nf_getsockopt(struct sock *sk, int pf, int val, char __user *opt, int *len)
+{
+	return nf_sockopt(sk, pf, val, opt, len, 1);
+}
+
+static unsigned int nf_iterate(struct list_head *head,
+			       struct sk_buff **skb,
+			       int hook,
+			       const struct net_device *indev,
+			       const struct net_device *outdev,
+			       struct list_head **i,
+			       int (*okfn)(struct sk_buff *),
+			       int hook_thresh)
+{
+	unsigned int verdict;
+
+	/*
+	 * The caller must not block between calls to this
+	 * function because of risk of continuing from deleted element.
+	 */
+	list_for_each_continue_rcu(*i, head) {
+		struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
+
+		if (hook_thresh > elem->priority)
+			continue;
+
+		/* Optimization: we don't need to hold module
+                   reference here, since function can't sleep. --RR */
+		verdict = elem->hook(hook, skb, indev, outdev, okfn);
+		if (verdict != NF_ACCEPT) {
+#ifdef CONFIG_NETFILTER_DEBUG
+			if (unlikely(verdict > NF_MAX_VERDICT)) {
+				NFDEBUG("Evil return from %p(%u).\n",
+				        elem->hook, hook);
+				continue;
+			}
+#endif
+			if (verdict != NF_REPEAT)
+				return verdict;
+			*i = (*i)->prev;
+		}
+	}
+	return NF_ACCEPT;
+}
+
+int nf_register_queue_handler(int pf, nf_queue_outfn_t outfn, void *data)
+{      
+	int ret;
+
+	write_lock_bh(&queue_handler_lock);
+	if (queue_handler[pf].outfn)
+		ret = -EBUSY;
+	else {
+		queue_handler[pf].outfn = outfn;
+		queue_handler[pf].data = data;
+		ret = 0;
+	}
+	write_unlock_bh(&queue_handler_lock);
+
+	return ret;
+}
+
+/* The caller must flush their queue before this */
+int nf_unregister_queue_handler(int pf)
+{
+	write_lock_bh(&queue_handler_lock);
+	queue_handler[pf].outfn = NULL;
+	queue_handler[pf].data = NULL;
+	write_unlock_bh(&queue_handler_lock);
+	
+	return 0;
+}
+
+/* 
+ * Any packet that leaves via this function must come back 
+ * through nf_reinject().
+ */
+static int nf_queue(struct sk_buff *skb, 
+		    struct list_head *elem, 
+		    int pf, unsigned int hook,
+		    struct net_device *indev,
+		    struct net_device *outdev,
+		    int (*okfn)(struct sk_buff *))
+{
+	int status;
+	struct nf_info *info;
+#ifdef CONFIG_BRIDGE_NETFILTER
+	struct net_device *physindev = NULL;
+	struct net_device *physoutdev = NULL;
+#endif
+
+	/* QUEUE == DROP if noone is waiting, to be safe. */
+	read_lock(&queue_handler_lock);
+	if (!queue_handler[pf].outfn) {
+		read_unlock(&queue_handler_lock);
+		kfree_skb(skb);
+		return 1;
+	}
+
+	info = kmalloc(sizeof(*info), GFP_ATOMIC);
+	if (!info) {
+		if (net_ratelimit())
+			printk(KERN_ERR "OOM queueing packet %p\n",
+			       skb);
+		read_unlock(&queue_handler_lock);
+		kfree_skb(skb);
+		return 1;
+	}
+
+	*info = (struct nf_info) { 
+		(struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
+
+	/* If it's going away, ignore hook. */
+	if (!try_module_get(info->elem->owner)) {
+		read_unlock(&queue_handler_lock);
+		kfree(info);
+		return 0;
+	}
+
+	/* Bump dev refs so they don't vanish while packet is out */
+	if (indev) dev_hold(indev);
+	if (outdev) dev_hold(outdev);
+
+#ifdef CONFIG_BRIDGE_NETFILTER
+	if (skb->nf_bridge) {
+		physindev = skb->nf_bridge->physindev;
+		if (physindev) dev_hold(physindev);
+		physoutdev = skb->nf_bridge->physoutdev;
+		if (physoutdev) dev_hold(physoutdev);
+	}
+#endif
+
+	status = queue_handler[pf].outfn(skb, info, queue_handler[pf].data);
+	read_unlock(&queue_handler_lock);
+
+	if (status < 0) {
+		/* James M doesn't say fuck enough. */
+		if (indev) dev_put(indev);
+		if (outdev) dev_put(outdev);
+#ifdef CONFIG_BRIDGE_NETFILTER
+		if (physindev) dev_put(physindev);
+		if (physoutdev) dev_put(physoutdev);
+#endif
+		module_put(info->elem->owner);
+		kfree(info);
+		kfree_skb(skb);
+		return 1;
+	}
+	return 1;
+}
+
+/* Returns 1 if okfn() needs to be executed by the caller,
+ * -EPERM for NF_DROP, 0 otherwise. */
+int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
+		 struct net_device *indev,
+		 struct net_device *outdev,
+		 int (*okfn)(struct sk_buff *),
+		 int hook_thresh)
+{
+	struct list_head *elem;
+	unsigned int verdict;
+	int ret = 0;
+
+	/* We may already have this, but read-locks nest anyway */
+	rcu_read_lock();
+
+	elem = &nf_hooks[pf][hook];
+next_hook:
+	verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
+			     outdev, &elem, okfn, hook_thresh);
+	if (verdict == NF_ACCEPT || verdict == NF_STOP) {
+		ret = 1;
+		goto unlock;
+	} else if (verdict == NF_DROP) {
+		kfree_skb(*pskb);
+		ret = -EPERM;
+	} else if (verdict == NF_QUEUE) {
+		NFDEBUG("nf_hook: Verdict = QUEUE.\n");
+		if (!nf_queue(*pskb, elem, pf, hook, indev, outdev, okfn))
+			goto next_hook;
+	}
+unlock:
+	rcu_read_unlock();
+	return ret;
+}
+
+void nf_reinject(struct sk_buff *skb, struct nf_info *info,
+		 unsigned int verdict)
+{
+	struct list_head *elem = &info->elem->list;
+	struct list_head *i;
+
+	rcu_read_lock();
+
+	/* Release those devices we held, or Alexey will kill me. */
+	if (info->indev) dev_put(info->indev);
+	if (info->outdev) dev_put(info->outdev);
+#ifdef CONFIG_BRIDGE_NETFILTER
+	if (skb->nf_bridge) {
+		if (skb->nf_bridge->physindev)
+			dev_put(skb->nf_bridge->physindev);
+		if (skb->nf_bridge->physoutdev)
+			dev_put(skb->nf_bridge->physoutdev);
+	}
+#endif
+
+	/* Drop reference to owner of hook which queued us. */
+	module_put(info->elem->owner);
+
+	list_for_each_rcu(i, &nf_hooks[info->pf][info->hook]) {
+		if (i == elem) 
+  			break;
+  	}
+  
+	if (elem == &nf_hooks[info->pf][info->hook]) {
+		/* The module which sent it to userspace is gone. */
+		NFDEBUG("%s: module disappeared, dropping packet.\n",
+			__FUNCTION__);
+		verdict = NF_DROP;
+	}
+
+	/* Continue traversal iff userspace said ok... */
+	if (verdict == NF_REPEAT) {
+		elem = elem->prev;
+		verdict = NF_ACCEPT;
+	}
+
+	if (verdict == NF_ACCEPT) {
+	next_hook:
+		verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
+				     &skb, info->hook, 
+				     info->indev, info->outdev, &elem,
+				     info->okfn, INT_MIN);
+	}
+
+	switch (verdict) {
+	case NF_ACCEPT:
+		info->okfn(skb);
+		break;
+
+	case NF_QUEUE:
+		if (!nf_queue(skb, elem, info->pf, info->hook, 
+			      info->indev, info->outdev, info->okfn))
+			goto next_hook;
+		break;
+	}
+	rcu_read_unlock();
+
+	if (verdict == NF_DROP)
+		kfree_skb(skb);
+
+	kfree(info);
+	return;
+}
+
+#ifdef CONFIG_INET
+/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
+int ip_route_me_harder(struct sk_buff **pskb)
+{
+	struct iphdr *iph = (*pskb)->nh.iph;
+	struct rtable *rt;
+	struct flowi fl = {};
+	struct dst_entry *odst;
+	unsigned int hh_len;
+
+	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
+	 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
+	 */
+	if (inet_addr_type(iph->saddr) == RTN_LOCAL) {
+		fl.nl_u.ip4_u.daddr = iph->daddr;
+		fl.nl_u.ip4_u.saddr = iph->saddr;
+		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
+		fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
+#ifdef CONFIG_IP_ROUTE_FWMARK
+		fl.nl_u.ip4_u.fwmark = (*pskb)->nfmark;
+#endif
+		fl.proto = iph->protocol;
+		if (ip_route_output_key(&rt, &fl) != 0)
+			return -1;
+
+		/* Drop old route. */
+		dst_release((*pskb)->dst);
+		(*pskb)->dst = &rt->u.dst;
+	} else {
+		/* non-local src, find valid iif to satisfy
+		 * rp-filter when calling ip_route_input. */
+		fl.nl_u.ip4_u.daddr = iph->saddr;
+		if (ip_route_output_key(&rt, &fl) != 0)
+			return -1;
+
+		odst = (*pskb)->dst;
+		if (ip_route_input(*pskb, iph->daddr, iph->saddr,
+				   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
+			dst_release(&rt->u.dst);
+			return -1;
+		}
+		dst_release(&rt->u.dst);
+		dst_release(odst);
+	}
+	
+	if ((*pskb)->dst->error)
+		return -1;
+
+	/* Change in oif may mean change in hh_len. */
+	hh_len = (*pskb)->dst->dev->hard_header_len;
+	if (skb_headroom(*pskb) < hh_len) {
+		struct sk_buff *nskb;
+
+		nskb = skb_realloc_headroom(*pskb, hh_len);
+		if (!nskb) 
+			return -1;
+		if ((*pskb)->sk)
+			skb_set_owner_w(nskb, (*pskb)->sk);
+		kfree_skb(*pskb);
+		*pskb = nskb;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL(ip_route_me_harder);
+
+int skb_ip_make_writable(struct sk_buff **pskb, unsigned int writable_len)
+{
+	struct sk_buff *nskb;
+
+	if (writable_len > (*pskb)->len)
+		return 0;
+
+	/* Not exclusive use of packet?  Must copy. */
+	if (skb_shared(*pskb) || skb_cloned(*pskb))
+		goto copy_skb;
+
+	return pskb_may_pull(*pskb, writable_len);
+
+copy_skb:
+	nskb = skb_copy(*pskb, GFP_ATOMIC);
+	if (!nskb)
+		return 0;
+	BUG_ON(skb_is_nonlinear(nskb));
+
+	/* Rest of kernel will get very unhappy if we pass it a
+	   suddenly-orphaned skbuff */
+	if ((*pskb)->sk)
+		skb_set_owner_w(nskb, (*pskb)->sk);
+	kfree_skb(*pskb);
+	*pskb = nskb;
+	return 1;
+}
+EXPORT_SYMBOL(skb_ip_make_writable);
+#endif /*CONFIG_INET*/
+
+/* Internal logging interface, which relies on the real 
+   LOG target modules */
+
+#define NF_LOG_PREFIXLEN		128
+
+static nf_logfn *nf_logging[NPROTO]; /* = NULL */
+static int reported = 0;
+static DEFINE_SPINLOCK(nf_log_lock);
+
+int nf_log_register(int pf, nf_logfn *logfn)
+{
+	int ret = -EBUSY;
+
+	/* Any setup of logging members must be done before
+	 * substituting pointer. */
+	spin_lock(&nf_log_lock);
+	if (!nf_logging[pf]) {
+		rcu_assign_pointer(nf_logging[pf], logfn);
+		ret = 0;
+	}
+	spin_unlock(&nf_log_lock);
+	return ret;
+}		
+
+void nf_log_unregister(int pf, nf_logfn *logfn)
+{
+	spin_lock(&nf_log_lock);
+	if (nf_logging[pf] == logfn)
+		nf_logging[pf] = NULL;
+	spin_unlock(&nf_log_lock);
+
+	/* Give time to concurrent readers. */
+	synchronize_net();
+}		
+
+void nf_log_packet(int pf,
+		   unsigned int hooknum,
+		   const struct sk_buff *skb,
+		   const struct net_device *in,
+		   const struct net_device *out,
+		   const char *fmt, ...)
+{
+	va_list args;
+	char prefix[NF_LOG_PREFIXLEN];
+	nf_logfn *logfn;
+	
+	rcu_read_lock();
+	logfn = rcu_dereference(nf_logging[pf]);
+	if (logfn) {
+		va_start(args, fmt);
+		vsnprintf(prefix, sizeof(prefix), fmt, args);
+		va_end(args);
+		/* We must read logging before nf_logfn[pf] */
+		logfn(hooknum, skb, in, out, prefix);
+	} else if (!reported) {
+		printk(KERN_WARNING "nf_log_packet: can\'t log yet, "
+		       "no backend logging module loaded in!\n");
+		reported++;
+	}
+	rcu_read_unlock();
+}
+EXPORT_SYMBOL(nf_log_register);
+EXPORT_SYMBOL(nf_log_unregister);
+EXPORT_SYMBOL(nf_log_packet);
+
+/* This does not belong here, but locally generated errors need it if connection
+   tracking in use: without this, connection may not be in hash table, and hence
+   manufactured ICMP or RST packets will not be associated with it. */
+void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
+
+void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb)
+{
+	void (*attach)(struct sk_buff *, struct sk_buff *);
+
+	if (skb->nfct && (attach = ip_ct_attach) != NULL) {
+		mb(); /* Just to be sure: must be read before executing this */
+		attach(new, skb);
+	}
+}
+
+void __init netfilter_init(void)
+{
+	int i, h;
+
+	for (i = 0; i < NPROTO; i++) {
+		for (h = 0; h < NF_MAX_HOOKS; h++)
+			INIT_LIST_HEAD(&nf_hooks[i][h]);
+	}
+}
+
+EXPORT_SYMBOL(ip_ct_attach);
+EXPORT_SYMBOL(nf_ct_attach);
+EXPORT_SYMBOL(nf_getsockopt);
+EXPORT_SYMBOL(nf_hook_slow);
+EXPORT_SYMBOL(nf_hooks);
+EXPORT_SYMBOL(nf_register_hook);
+EXPORT_SYMBOL(nf_register_queue_handler);
+EXPORT_SYMBOL(nf_register_sockopt);
+EXPORT_SYMBOL(nf_reinject);
+EXPORT_SYMBOL(nf_setsockopt);
+EXPORT_SYMBOL(nf_unregister_hook);
+EXPORT_SYMBOL(nf_unregister_queue_handler);
+EXPORT_SYMBOL(nf_unregister_sockopt);
diff --git a/trunk/net/core/request_sock.c b/trunk/net/core/request_sock.c
index b8203de5ff07..bb55675f0685 100644
--- a/trunk/net/core/request_sock.c
+++ b/trunk/net/core/request_sock.c
@@ -32,6 +32,7 @@
  * Further increasing requires to change hash table size.
  */
 int sysctl_max_syn_backlog = 256;
+EXPORT_SYMBOL(sysctl_max_syn_backlog);
 
 int reqsk_queue_alloc(struct request_sock_queue *queue,
 		      const int nr_table_entries)
@@ -52,8 +53,6 @@ int reqsk_queue_alloc(struct request_sock_queue *queue,
 	get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd));
 	rwlock_init(&queue->syn_wait_lock);
 	queue->rskq_accept_head = queue->rskq_accept_head = NULL;
-	queue->rskq_defer_accept = 0;
-	lopt->nr_table_entries = nr_table_entries;
 
 	write_lock_bh(&queue->syn_wait_lock);
 	queue->listen_opt = lopt;
@@ -63,28 +62,3 @@ int reqsk_queue_alloc(struct request_sock_queue *queue,
 }
 
 EXPORT_SYMBOL(reqsk_queue_alloc);
-
-void reqsk_queue_destroy(struct request_sock_queue *queue)
-{
-	/* make all the listen_opt local to us */
-	struct listen_sock *lopt = reqsk_queue_yank_listen_sk(queue);
-
-	if (lopt->qlen != 0) {
-		int i;
-
-		for (i = 0; i < lopt->nr_table_entries; i++) {
-			struct request_sock *req;
-
-			while ((req = lopt->syn_table[i]) != NULL) {
-				lopt->syn_table[i] = req->dl_next;
-				lopt->qlen--;
-				reqsk_free(req);
-			}
-		}
-	}
-
-	BUG_TRAP(lopt->qlen == 0);
-	kfree(lopt);
-}
-
-EXPORT_SYMBOL(reqsk_queue_destroy);
diff --git a/trunk/net/core/rtnetlink.c b/trunk/net/core/rtnetlink.c
index 9bed7569ce3f..4b1bb30e6381 100644
--- a/trunk/net/core/rtnetlink.c
+++ b/trunk/net/core/rtnetlink.c
@@ -148,7 +148,7 @@ int rtnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, int echo)
 {
 	int err = 0;
 
-	NETLINK_CB(skb).dst_group = group;
+	NETLINK_CB(skb).dst_groups = group;
 	if (echo)
 		atomic_inc(&skb->users);
 	netlink_broadcast(rtnl, skb, pid, group, GFP_KERNEL);
@@ -458,8 +458,8 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
 		kfree_skb(skb);
 		return;
 	}
-	NETLINK_CB(skb).dst_group = RTNLGRP_LINK;
-	netlink_broadcast(rtnl, skb, 0, RTNLGRP_LINK, GFP_KERNEL);
+	NETLINK_CB(skb).dst_groups = RTMGRP_LINK;
+	netlink_broadcast(rtnl, skb, 0, RTMGRP_LINK, GFP_KERNEL);
 }
 
 static int rtnetlink_done(struct netlink_callback *cb)
@@ -708,8 +708,7 @@ void __init rtnetlink_init(void)
 	if (!rta_buf)
 		panic("rtnetlink_init: cannot allocate rta_buf\n");
 
-	rtnl = netlink_kernel_create(NETLINK_ROUTE, RTNLGRP_MAX, rtnetlink_rcv,
-	                             THIS_MODULE);
+	rtnl = netlink_kernel_create(NETLINK_ROUTE, rtnetlink_rcv);
 	if (rtnl == NULL)
 		panic("rtnetlink_init: cannot initialize rtnetlink\n");
 	netlink_set_nonroot(NETLINK_ROUTE, NL_NONROOT_RECV);
diff --git a/trunk/net/core/skbuff.c b/trunk/net/core/skbuff.c
index f80a28785610..7eab867ede59 100644
--- a/trunk/net/core/skbuff.c
+++ b/trunk/net/core/skbuff.c
@@ -68,10 +68,7 @@
 #include <asm/uaccess.h>
 #include <asm/system.h>
 
-static kmem_cache_t *skbuff_head_cache __read_mostly;
-static kmem_cache_t *skbuff_fclone_cache __read_mostly;
-
-struct timeval __read_mostly skb_tv_base;
+static kmem_cache_t *skbuff_head_cache;
 
 /*
  *	Keep out-of-line to prevent kernel bloat.
@@ -121,7 +118,7 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
  */
 
 /**
- *	__alloc_skb	-	allocate a network buffer
+ *	alloc_skb	-	allocate a network buffer
  *	@size: size to allocate
  *	@gfp_mask: allocation mask
  *
@@ -132,20 +129,14 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
  *	Buffers may only be allocated from interrupts using a @gfp_mask of
  *	%GFP_ATOMIC.
  */
-struct sk_buff *__alloc_skb(unsigned int size, unsigned int __nocast gfp_mask,
-			    int fclone)
+struct sk_buff *alloc_skb(unsigned int size, unsigned int __nocast gfp_mask)
 {
 	struct sk_buff *skb;
 	u8 *data;
 
 	/* Get the HEAD */
-	if (fclone)
-		skb = kmem_cache_alloc(skbuff_fclone_cache,
-				       gfp_mask & ~__GFP_DMA);
-	else
-		skb = kmem_cache_alloc(skbuff_head_cache,
-				       gfp_mask & ~__GFP_DMA);
-
+	skb = kmem_cache_alloc(skbuff_head_cache,
+			       gfp_mask & ~__GFP_DMA);
 	if (!skb)
 		goto out;
 
@@ -162,15 +153,7 @@ struct sk_buff *__alloc_skb(unsigned int size, unsigned int __nocast gfp_mask,
 	skb->data = data;
 	skb->tail = data;
 	skb->end  = data + size;
-	if (fclone) {
-		struct sk_buff *child = skb + 1;
-		atomic_t *fclone_ref = (atomic_t *) (child + 1);
 
-		skb->fclone = SKB_FCLONE_ORIG;
-		atomic_set(fclone_ref, 1);
-
-		child->fclone = SKB_FCLONE_UNAVAILABLE;
-	}
 	atomic_set(&(skb_shinfo(skb)->dataref), 1);
 	skb_shinfo(skb)->nr_frags  = 0;
 	skb_shinfo(skb)->tso_size = 0;
@@ -283,34 +266,8 @@ void skb_release_data(struct sk_buff *skb)
  */
 void kfree_skbmem(struct sk_buff *skb)
 {
-	struct sk_buff *other;
-	atomic_t *fclone_ref;
-
 	skb_release_data(skb);
-	switch (skb->fclone) {
-	case SKB_FCLONE_UNAVAILABLE:
-		kmem_cache_free(skbuff_head_cache, skb);
-		break;
-
-	case SKB_FCLONE_ORIG:
-		fclone_ref = (atomic_t *) (skb + 2);
-		if (atomic_dec_and_test(fclone_ref))
-			kmem_cache_free(skbuff_fclone_cache, skb);
-		break;
-
-	case SKB_FCLONE_CLONE:
-		fclone_ref = (atomic_t *) (skb + 1);
-		other = skb - 1;
-
-		/* The clone portion is available for
-		 * fast-cloning again.
-		 */
-		skb->fclone = SKB_FCLONE_UNAVAILABLE;
-
-		if (atomic_dec_and_test(fclone_ref))
-			kmem_cache_free(skbuff_fclone_cache, other);
-		break;
-	};
+	kmem_cache_free(skbuff_head_cache, skb);
 }
 
 /**
@@ -324,6 +281,8 @@ void kfree_skbmem(struct sk_buff *skb)
 
 void __kfree_skb(struct sk_buff *skb)
 {
+	BUG_ON(skb->list != NULL);
+
 	dst_release(skb->dst);
 #ifdef CONFIG_XFRM
 	secpath_put(skb->sp);
@@ -343,6 +302,7 @@ void __kfree_skb(struct sk_buff *skb)
 	skb->tc_index = 0;
 #ifdef CONFIG_NET_CLS_ACT
 	skb->tc_verd = 0;
+	skb->tc_classid = 0;
 #endif
 #endif
 
@@ -365,27 +325,19 @@ void __kfree_skb(struct sk_buff *skb)
 
 struct sk_buff *skb_clone(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
-	struct sk_buff *n;
-
-	n = skb + 1;
-	if (skb->fclone == SKB_FCLONE_ORIG &&
-	    n->fclone == SKB_FCLONE_UNAVAILABLE) {
-		atomic_t *fclone_ref = (atomic_t *) (n + 1);
-		n->fclone = SKB_FCLONE_CLONE;
-		atomic_inc(fclone_ref);
-	} else {
-		n = kmem_cache_alloc(skbuff_head_cache, gfp_mask);
-		if (!n)
-			return NULL;
-		n->fclone = SKB_FCLONE_UNAVAILABLE;
-	}
+	struct sk_buff *n = kmem_cache_alloc(skbuff_head_cache, gfp_mask);
+
+	if (!n) 
+		return NULL;
 
 #define C(x) n->x = skb->x
 
 	n->next = n->prev = NULL;
+	n->list = NULL;
 	n->sk = NULL;
-	C(tstamp);
+	C(stamp);
 	C(dev);
+	C(real_dev);
 	C(h);
 	C(nh);
 	C(mac);
@@ -409,6 +361,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 	n->destructor = NULL;
 #ifdef CONFIG_NETFILTER
 	C(nfmark);
+	C(nfcache);
 	C(nfct);
 	nf_conntrack_get(skb->nfct);
 	C(nfctinfo);
@@ -417,6 +370,9 @@ struct sk_buff *skb_clone(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 	nf_bridge_get(skb->nf_bridge);
 #endif
 #endif /*CONFIG_NETFILTER*/
+#if defined(CONFIG_HIPPI)
+	C(private);
+#endif
 #ifdef CONFIG_NET_SCHED
 	C(tc_index);
 #ifdef CONFIG_NET_CLS_ACT
@@ -424,6 +380,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 	n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
 	n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
 	C(input_dev);
+	C(tc_classid);
 #endif
 
 #endif
@@ -447,8 +404,10 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 	 */
 	unsigned long offset = new->data - old->data;
 
+	new->list	= NULL;
 	new->sk		= NULL;
 	new->dev	= old->dev;
+	new->real_dev	= old->real_dev;
 	new->priority	= old->priority;
 	new->protocol	= old->protocol;
 	new->dst	= dst_clone(old->dst);
@@ -460,12 +419,12 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 	new->mac.raw	= old->mac.raw + offset;
 	memcpy(new->cb, old->cb, sizeof(old->cb));
 	new->local_df	= old->local_df;
-	new->fclone	= SKB_FCLONE_UNAVAILABLE;
 	new->pkt_type	= old->pkt_type;
-	new->tstamp	= old->tstamp;
+	new->stamp	= old->stamp;
 	new->destructor = NULL;
 #ifdef CONFIG_NETFILTER
 	new->nfmark	= old->nfmark;
+	new->nfcache	= old->nfcache;
 	new->nfct	= old->nfct;
 	nf_conntrack_get(old->nfct);
 	new->nfctinfo	= old->nfctinfo;
@@ -1385,43 +1344,50 @@ void skb_queue_tail(struct sk_buff_head *list, struct sk_buff *newsk)
 	__skb_queue_tail(list, newsk);
 	spin_unlock_irqrestore(&list->lock, flags);
 }
-
 /**
  *	skb_unlink	-	remove a buffer from a list
  *	@skb: buffer to remove
- *	@list: list to use
  *
- *	Remove a packet from a list. The list locks are taken and this
- *	function is atomic with respect to other list locked calls
+ *	Place a packet after a given packet in a list. The list locks are taken
+ *	and this function is atomic with respect to other list locked calls
  *
- *	You must know what list the SKB is on.
+ *	Works even without knowing the list it is sitting on, which can be
+ *	handy at times. It also means that THE LIST MUST EXIST when you
+ *	unlink. Thus a list must have its contents unlinked before it is
+ *	destroyed.
  */
-void skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
+void skb_unlink(struct sk_buff *skb)
 {
-	unsigned long flags;
+	struct sk_buff_head *list = skb->list;
 
-	spin_lock_irqsave(&list->lock, flags);
-	__skb_unlink(skb, list);
-	spin_unlock_irqrestore(&list->lock, flags);
+	if (list) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&list->lock, flags);
+		if (skb->list == list)
+			__skb_unlink(skb, skb->list);
+		spin_unlock_irqrestore(&list->lock, flags);
+	}
 }
 
+
 /**
  *	skb_append	-	append a buffer
  *	@old: buffer to insert after
  *	@newsk: buffer to insert
- *	@list: list to use
  *
  *	Place a packet after a given packet in a list. The list locks are taken
  *	and this function is atomic with respect to other list locked calls.
  *	A buffer cannot be placed on two lists at the same time.
  */
-void skb_append(struct sk_buff *old, struct sk_buff *newsk, struct sk_buff_head *list)
+
+void skb_append(struct sk_buff *old, struct sk_buff *newsk)
 {
 	unsigned long flags;
 
-	spin_lock_irqsave(&list->lock, flags);
-	__skb_append(old, newsk, list);
-	spin_unlock_irqrestore(&list->lock, flags);
+	spin_lock_irqsave(&old->list->lock, flags);
+	__skb_append(old, newsk);
+	spin_unlock_irqrestore(&old->list->lock, flags);
 }
 
 
@@ -1429,21 +1395,19 @@ void skb_append(struct sk_buff *old, struct sk_buff *newsk, struct sk_buff_head
  *	skb_insert	-	insert a buffer
  *	@old: buffer to insert before
  *	@newsk: buffer to insert
- *	@list: list to use
- *
- *	Place a packet before a given packet in a list. The list locks are
- * 	taken and this function is atomic with respect to other list locked
- *	calls.
  *
+ *	Place a packet before a given packet in a list. The list locks are taken
+ *	and this function is atomic with respect to other list locked calls
  *	A buffer cannot be placed on two lists at the same time.
  */
-void skb_insert(struct sk_buff *old, struct sk_buff *newsk, struct sk_buff_head *list)
+
+void skb_insert(struct sk_buff *old, struct sk_buff *newsk)
 {
 	unsigned long flags;
 
-	spin_lock_irqsave(&list->lock, flags);
-	__skb_insert(newsk, old->prev, old, list);
-	spin_unlock_irqrestore(&list->lock, flags);
+	spin_lock_irqsave(&old->list->lock, flags);
+	__skb_insert(newsk, old->prev, old, old->list);
+	spin_unlock_irqrestore(&old->list->lock, flags);
 }
 
 #if 0
@@ -1699,23 +1663,12 @@ void __init skb_init(void)
 					      NULL, NULL);
 	if (!skbuff_head_cache)
 		panic("cannot create skbuff cache");
-
-	skbuff_fclone_cache = kmem_cache_create("skbuff_fclone_cache",
-						(2*sizeof(struct sk_buff)) +
-						sizeof(atomic_t),
-						0,
-						SLAB_HWCACHE_ALIGN,
-						NULL, NULL);
-	if (!skbuff_fclone_cache)
-		panic("cannot create skbuff cache");
-
-	do_gettimeofday(&skb_tv_base);
 }
 
 EXPORT_SYMBOL(___pskb_trim);
 EXPORT_SYMBOL(__kfree_skb);
 EXPORT_SYMBOL(__pskb_pull_tail);
-EXPORT_SYMBOL(__alloc_skb);
+EXPORT_SYMBOL(alloc_skb);
 EXPORT_SYMBOL(pskb_copy);
 EXPORT_SYMBOL(pskb_expand_head);
 EXPORT_SYMBOL(skb_checksum);
@@ -1743,4 +1696,3 @@ EXPORT_SYMBOL(skb_prepare_seq_read);
 EXPORT_SYMBOL(skb_seq_read);
 EXPORT_SYMBOL(skb_abort_seq_read);
 EXPORT_SYMBOL(skb_find_text);
-EXPORT_SYMBOL(skb_tv_base);
diff --git a/trunk/net/core/sock.c b/trunk/net/core/sock.c
index ccd10fd65682..12f6d9a2a522 100644
--- a/trunk/net/core/sock.c
+++ b/trunk/net/core/sock.c
@@ -260,7 +260,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 			   
 			if (val > sysctl_wmem_max)
 				val = sysctl_wmem_max;
-set_sndbuf:
+
 			sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
 			if ((val * 2) < SOCK_MIN_SNDBUF)
 				sk->sk_sndbuf = SOCK_MIN_SNDBUF;
@@ -274,13 +274,6 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 			sk->sk_write_space(sk);
 			break;
 
-		case SO_SNDBUFFORCE:
-			if (!capable(CAP_NET_ADMIN)) {
-				ret = -EPERM;
-				break;
-			}
-			goto set_sndbuf;
-
 		case SO_RCVBUF:
 			/* Don't error on this BSD doesn't and if you think
 			   about it this is right. Otherwise apps have to
@@ -289,7 +282,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 			  
 			if (val > sysctl_rmem_max)
 				val = sysctl_rmem_max;
-set_rcvbuf:
+
 			sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
 			/* FIXME: is this lower bound the right one? */
 			if ((val * 2) < SOCK_MIN_RCVBUF)
@@ -298,13 +291,6 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 				sk->sk_rcvbuf = val * 2;
 			break;
 
-		case SO_RCVBUFFORCE:
-			if (!capable(CAP_NET_ADMIN)) {
-				ret = -EPERM;
-				break;
-			}
-			goto set_rcvbuf;
-
 		case SO_KEEPALIVE:
 #ifdef CONFIG_INET
 			if (sk->sk_protocol == IPPROTO_TCP)
@@ -700,80 +686,6 @@ void sk_free(struct sock *sk)
 	module_put(owner);
 }
 
-struct sock *sk_clone(const struct sock *sk, const unsigned int __nocast priority)
-{
-	struct sock *newsk = sk_alloc(sk->sk_family, priority, sk->sk_prot, 0);
-
-	if (newsk != NULL) {
-		struct sk_filter *filter;
-
-		memcpy(newsk, sk, sk->sk_prot->obj_size);
-
-		/* SANITY */
-		sk_node_init(&newsk->sk_node);
-		sock_lock_init(newsk);
-		bh_lock_sock(newsk);
-
-		atomic_set(&newsk->sk_rmem_alloc, 0);
-		atomic_set(&newsk->sk_wmem_alloc, 0);
-		atomic_set(&newsk->sk_omem_alloc, 0);
-		skb_queue_head_init(&newsk->sk_receive_queue);
-		skb_queue_head_init(&newsk->sk_write_queue);
-
-		rwlock_init(&newsk->sk_dst_lock);
-		rwlock_init(&newsk->sk_callback_lock);
-
-		newsk->sk_dst_cache	= NULL;
-		newsk->sk_wmem_queued	= 0;
-		newsk->sk_forward_alloc = 0;
-		newsk->sk_send_head	= NULL;
-		newsk->sk_backlog.head	= newsk->sk_backlog.tail = NULL;
-		newsk->sk_userlocks	= sk->sk_userlocks & ~SOCK_BINDPORT_LOCK;
-
-		sock_reset_flag(newsk, SOCK_DONE);
-		skb_queue_head_init(&newsk->sk_error_queue);
-
-		filter = newsk->sk_filter;
-		if (filter != NULL)
-			sk_filter_charge(newsk, filter);
-
-		if (unlikely(xfrm_sk_clone_policy(newsk))) {
-			/* It is still raw copy of parent, so invalidate
-			 * destructor and make plain sk_free() */
-			newsk->sk_destruct = NULL;
-			sk_free(newsk);
-			newsk = NULL;
-			goto out;
-		}
-
-		newsk->sk_err	   = 0;
-		newsk->sk_priority = 0;
-		atomic_set(&newsk->sk_refcnt, 2);
-
-		/*
-		 * Increment the counter in the same struct proto as the master
-		 * sock (sk_refcnt_debug_inc uses newsk->sk_prot->socks, that
-		 * is the same as sk->sk_prot->socks, as this field was copied
-		 * with memcpy).
-		 *
-		 * This _changes_ the previous behaviour, where
-		 * tcp_create_openreq_child always was incrementing the
-		 * equivalent to tcp_prot->socks (inet_sock_nr), so this have
-		 * to be taken into account in all callers. -acme
-		 */
-		sk_refcnt_debug_inc(newsk);
-		newsk->sk_socket = NULL;
-		newsk->sk_sleep	 = NULL;
-
-		if (newsk->sk_prot->sockets_allocated)
-			atomic_inc(newsk->sk_prot->sockets_allocated);
-	}
-out:
-	return newsk;
-}
-
-EXPORT_SYMBOL_GPL(sk_clone);
-
 void __init sk_init(void)
 {
 	if (num_physpages <= 4096) {
@@ -1441,7 +1353,11 @@ void sk_common_release(struct sock *sk)
 
 	xfrm_sk_free_policy(sk);
 
-	sk_refcnt_debug_release(sk);
+#ifdef INET_REFCNT_DEBUG
+	if (atomic_read(&sk->sk_refcnt) != 1)
+		printk(KERN_DEBUG "Destruction of the socket %p delayed, c=%d\n",
+		       sk, atomic_read(&sk->sk_refcnt));
+#endif
 	sock_put(sk);
 }
 
@@ -1452,8 +1368,7 @@ static LIST_HEAD(proto_list);
 
 int proto_register(struct proto *prot, int alloc_slab)
 {
-	char *request_sock_slab_name = NULL;
-	char *timewait_sock_slab_name;
+	char *request_sock_slab_name;
 	int rc = -ENOBUFS;
 
 	if (alloc_slab) {
@@ -1484,23 +1399,6 @@ int proto_register(struct proto *prot, int alloc_slab)
 				goto out_free_request_sock_slab_name;
 			}
 		}
-
-		if (prot->twsk_obj_size) {
-			static const char mask[] = "tw_sock_%s";
-
-			timewait_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
-
-			if (timewait_sock_slab_name == NULL)
-				goto out_free_request_sock_slab;
-
-			sprintf(timewait_sock_slab_name, mask, prot->name);
-			prot->twsk_slab = kmem_cache_create(timewait_sock_slab_name,
-							    prot->twsk_obj_size,
-							    0, SLAB_HWCACHE_ALIGN,
-							    NULL, NULL);
-			if (prot->twsk_slab == NULL)
-				goto out_free_timewait_sock_slab_name;
-		}
 	}
 
 	write_lock(&proto_list_lock);
@@ -1509,13 +1407,6 @@ int proto_register(struct proto *prot, int alloc_slab)
 	rc = 0;
 out:
 	return rc;
-out_free_timewait_sock_slab_name:
-	kfree(timewait_sock_slab_name);
-out_free_request_sock_slab:
-	if (prot->rsk_prot && prot->rsk_prot->slab) {
-		kmem_cache_destroy(prot->rsk_prot->slab);
-		prot->rsk_prot->slab = NULL;
-	}
 out_free_request_sock_slab_name:
 	kfree(request_sock_slab_name);
 out_free_sock_slab:
@@ -1543,14 +1434,6 @@ void proto_unregister(struct proto *prot)
 		prot->rsk_prot->slab = NULL;
 	}
 
-	if (prot->twsk_slab != NULL) {
-		const char *name = kmem_cache_name(prot->twsk_slab);
-
-		kmem_cache_destroy(prot->twsk_slab);
-		kfree(name);
-		prot->twsk_slab = NULL;
-	}
-
 	list_del(&prot->node);
 	write_unlock(&proto_list_lock);
 }
diff --git a/trunk/net/core/sysctl_net_core.c b/trunk/net/core/sysctl_net_core.c
index 2f278c8e4743..8f817ad9f546 100644
--- a/trunk/net/core/sysctl_net_core.c
+++ b/trunk/net/core/sysctl_net_core.c
@@ -9,18 +9,23 @@
 #include <linux/sysctl.h>
 #include <linux/config.h>
 #include <linux/module.h>
-#include <linux/socket.h>
-#include <net/sock.h>
 
 #ifdef CONFIG_SYSCTL
 
 extern int netdev_max_backlog;
+extern int netdev_budget;
 extern int weight_p;
+extern int net_msg_cost;
+extern int net_msg_burst;
 
 extern __u32 sysctl_wmem_max;
 extern __u32 sysctl_rmem_max;
+extern __u32 sysctl_wmem_default;
+extern __u32 sysctl_rmem_default;
 
 extern int sysctl_core_destroy_delay;
+extern int sysctl_optmem_max;
+extern int sysctl_somaxconn;
 
 #ifdef CONFIG_NET_DIVERT
 extern char sysctl_divert_version[];
diff --git a/trunk/net/core/utils.c b/trunk/net/core/utils.c
index 7b5970fc9e40..88eb8b68e26b 100644
--- a/trunk/net/core/utils.c
+++ b/trunk/net/core/utils.c
@@ -16,9 +16,7 @@
 #include <linux/module.h>
 #include <linux/jiffies.h>
 #include <linux/kernel.h>
-#include <linux/inet.h>
 #include <linux/mm.h>
-#include <linux/net.h>
 #include <linux/string.h>
 #include <linux/types.h>
 #include <linux/random.h>
diff --git a/trunk/net/core/wireless.c b/trunk/net/core/wireless.c
index 5caae2399f3a..3ff5639c0b78 100644
--- a/trunk/net/core/wireless.c
+++ b/trunk/net/core/wireless.c
@@ -571,6 +571,10 @@ static int wireless_seq_show(struct seq_file *seq, void *v)
 	return 0;
 }
 
+extern void *dev_seq_start(struct seq_file *seq, loff_t *pos);
+extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos);
+extern void dev_seq_stop(struct seq_file *seq, void *v);
+
 static struct seq_operations wireless_seq_ops = {
 	.start = dev_seq_start,
 	.next  = dev_seq_next,
@@ -1140,8 +1144,8 @@ static inline void rtmsg_iwinfo(struct net_device *	dev,
 		kfree_skb(skb);
 		return;
 	}
-	NETLINK_CB(skb).dst_group = RTNLGRP_LINK;
-	netlink_broadcast(rtnl, skb, 0, RTNLGRP_LINK, GFP_ATOMIC);
+	NETLINK_CB(skb).dst_groups = RTMGRP_LINK;
+	netlink_broadcast(rtnl, skb, 0, RTMGRP_LINK, GFP_ATOMIC);
 }
 #endif	/* WE_EVENT_NETLINK */
 
diff --git a/trunk/net/dccp/Kconfig b/trunk/net/dccp/Kconfig
deleted file mode 100644
index 187ac182e24b..000000000000
--- a/trunk/net/dccp/Kconfig
+++ /dev/null
@@ -1,50 +0,0 @@
-menu "DCCP Configuration (EXPERIMENTAL)"
-	depends on INET && EXPERIMENTAL
-
-config IP_DCCP
-	tristate "The DCCP Protocol (EXPERIMENTAL)"
-	---help---
-	  Datagram Congestion Control Protocol
-
-	  From draft-ietf-dccp-spec-11 <http://www.icir.org/kohler/dcp/draft-ietf-dccp-spec-11.txt>.
-
-	  The Datagram Congestion Control Protocol (DCCP) is a transport
-	  protocol that implements bidirectional, unicast connections of
-	  congestion-controlled, unreliable datagrams. It should be suitable
-	  for use by applications such as streaming media, Internet telephony,
-	  and on-line games
-
-	  To compile this protocol support as a module, choose M here: the
-	  module will be called dccp.
-
-	  If in doubt, say N.
-
-config INET_DCCP_DIAG
-	depends on IP_DCCP && INET_DIAG
-	def_tristate y if (IP_DCCP = y && INET_DIAG = y)
-	def_tristate m
-
-source "net/dccp/ccids/Kconfig"
-
-menu "DCCP Kernel Hacking"
-	depends on IP_DCCP && DEBUG_KERNEL=y
-
-config IP_DCCP_DEBUG
-	bool "DCCP debug messages"
-	---help---
-	  Only use this if you're hacking DCCP.
-
-	  Just say N.
-
-config IP_DCCP_UNLOAD_HACK
-	depends on IP_DCCP=m && IP_DCCP_CCID3=m
-	bool "DCCP control sock unload hack"
-	---help---
-	  Enable this to be able to unload the dccp module when the it
-	  has only one refcount held, the control sock one. Just execute
-	  "rmmod dccp_ccid3 dccp"
-
-	  Just say N.
-endmenu
-
-endmenu
diff --git a/trunk/net/dccp/Makefile b/trunk/net/dccp/Makefile
deleted file mode 100644
index fb97bb042455..000000000000
--- a/trunk/net/dccp/Makefile
+++ /dev/null
@@ -1,10 +0,0 @@
-obj-$(CONFIG_IP_DCCP) += dccp.o
-
-dccp-y := ccid.o input.o ipv4.o minisocks.o options.o output.o proto.o \
-	  timer.o
-
-obj-$(CONFIG_INET_DCCP_DIAG) += dccp_diag.o
-
-dccp_diag-y := diag.o
-
-obj-y += ccids/
diff --git a/trunk/net/dccp/ccid.c b/trunk/net/dccp/ccid.c
deleted file mode 100644
index 9d8fc0e289ea..000000000000
--- a/trunk/net/dccp/ccid.c
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
- *  net/dccp/ccid.c
- *
- *  An implementation of the DCCP protocol
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *  CCID infrastructure
- *
- *	This program is free software; you can redistribute it and/or modify it
- *	under the terms of the GNU General Public License version 2 as
- *	published by the Free Software Foundation.
- */
-
-#include "ccid.h"
-
-static struct ccid *ccids[CCID_MAX];
-#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)
-static atomic_t ccids_lockct = ATOMIC_INIT(0);
-static DEFINE_SPINLOCK(ccids_lock);
-
-/*
- * The strategy is: modifications ccids vector are short, do not sleep and
- * veeery rare, but read access should be free of any exclusive locks.
- */
-static void ccids_write_lock(void)
-{
-	spin_lock(&ccids_lock);
-	while (atomic_read(&ccids_lockct) != 0) {
-		spin_unlock(&ccids_lock);
-		yield();
-		spin_lock(&ccids_lock);
-	}
-}
-
-static inline void ccids_write_unlock(void)
-{
-	spin_unlock(&ccids_lock);
-}
-
-static inline void ccids_read_lock(void)
-{
-	atomic_inc(&ccids_lockct);
-	spin_unlock_wait(&ccids_lock);
-}
-
-static inline void ccids_read_unlock(void)
-{
-	atomic_dec(&ccids_lockct);
-}
-
-#else
-#define ccids_write_lock() do { } while(0)
-#define ccids_write_unlock() do { } while(0)
-#define ccids_read_lock() do { } while(0)
-#define ccids_read_unlock() do { } while(0)
-#endif
-
-int ccid_register(struct ccid *ccid)
-{
-	int err;
-
-	if (ccid->ccid_init == NULL)
-		return -1;
-
-	ccids_write_lock();
-	err = -EEXIST;
-	if (ccids[ccid->ccid_id] == NULL) {
-		ccids[ccid->ccid_id] = ccid;
-		err = 0;
-	}
-	ccids_write_unlock();
-	if (err == 0)
-		pr_info("CCID: Registered CCID %d (%s)\n",
-			ccid->ccid_id, ccid->ccid_name);
-	return err;
-}
-
-EXPORT_SYMBOL_GPL(ccid_register);
-
-int ccid_unregister(struct ccid *ccid)
-{
-	ccids_write_lock();
-	ccids[ccid->ccid_id] = NULL;
-	ccids_write_unlock();
-	pr_info("CCID: Unregistered CCID %d (%s)\n",
-		ccid->ccid_id, ccid->ccid_name);
-	return 0;
-}
-
-EXPORT_SYMBOL_GPL(ccid_unregister);
-
-struct ccid *ccid_init(unsigned char id, struct sock *sk)
-{
-	struct ccid *ccid;
-
-#ifdef CONFIG_KMOD
-	if (ccids[id] == NULL)
-		request_module("net-dccp-ccid-%d", id);
-#endif
-	ccids_read_lock();
-
-	ccid = ccids[id];
-	if (ccid == NULL)
-		goto out;
-
-	if (!try_module_get(ccid->ccid_owner))
-		goto out_err;
-
-	if (ccid->ccid_init(sk) != 0)
-		goto out_module_put;
-out:
-	ccids_read_unlock();
-	return ccid;
-out_module_put:
-	module_put(ccid->ccid_owner);
-out_err:
-	ccid = NULL;
-	goto out;
-}
-
-EXPORT_SYMBOL_GPL(ccid_init);
-
-void ccid_exit(struct ccid *ccid, struct sock *sk)
-{
-	if (ccid == NULL)
-		return;
-
-	ccids_read_lock();
-
-	if (ccids[ccid->ccid_id] != NULL) {
-		if (ccid->ccid_exit != NULL)
-			ccid->ccid_exit(sk);
-		module_put(ccid->ccid_owner);
-	}
-
-	ccids_read_unlock();
-}
-
-EXPORT_SYMBOL_GPL(ccid_exit);
diff --git a/trunk/net/dccp/ccid.h b/trunk/net/dccp/ccid.h
deleted file mode 100644
index 962f1e9e2f7e..000000000000
--- a/trunk/net/dccp/ccid.h
+++ /dev/null
@@ -1,180 +0,0 @@
-#ifndef _CCID_H
-#define _CCID_H
-/*
- *  net/dccp/ccid.h
- *
- *  An implementation of the DCCP protocol
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *  CCID infrastructure
- *
- *	This program is free software; you can redistribute it and/or modify it
- *	under the terms of the GNU General Public License version 2 as
- *	published by the Free Software Foundation.
- */
-
-#include <net/sock.h>
-#include <linux/dccp.h>
-#include <linux/list.h>
-#include <linux/module.h>
-
-#define CCID_MAX 255
-
-struct ccid {
-	unsigned char	ccid_id;
-	const char	*ccid_name;
-	struct module	*ccid_owner;
-	int		(*ccid_init)(struct sock *sk);
-	void		(*ccid_exit)(struct sock *sk);
-	int		(*ccid_hc_rx_init)(struct sock *sk);
-	int		(*ccid_hc_tx_init)(struct sock *sk);
-	void		(*ccid_hc_rx_exit)(struct sock *sk);
-	void		(*ccid_hc_tx_exit)(struct sock *sk);
-	void		(*ccid_hc_rx_packet_recv)(struct sock *sk,
-						  struct sk_buff *skb);
-	int		(*ccid_hc_rx_parse_options)(struct sock *sk,
-						    unsigned char option,
-						    unsigned char len, u16 idx,
-						    unsigned char* value);
-	void		(*ccid_hc_rx_insert_options)(struct sock *sk,
-						     struct sk_buff *skb);
-	void		(*ccid_hc_tx_insert_options)(struct sock *sk,
-						     struct sk_buff *skb);
-	void		(*ccid_hc_tx_packet_recv)(struct sock *sk,
-						  struct sk_buff *skb);
-	int		(*ccid_hc_tx_parse_options)(struct sock *sk,
-						    unsigned char option,
-						    unsigned char len, u16 idx,
-						    unsigned char* value);
-	int		(*ccid_hc_tx_send_packet)(struct sock *sk,
-						  struct sk_buff *skb, int len);
-	void		(*ccid_hc_tx_packet_sent)(struct sock *sk, int more,
-						  int len);
-	void		(*ccid_hc_rx_get_info)(struct sock *sk,
-					       struct tcp_info *info);
-	void		(*ccid_hc_tx_get_info)(struct sock *sk,
-					       struct tcp_info *info);
-};
-
-extern int	   ccid_register(struct ccid *ccid);
-extern int	   ccid_unregister(struct ccid *ccid);
-
-extern struct ccid *ccid_init(unsigned char id, struct sock *sk);
-extern void	   ccid_exit(struct ccid *ccid, struct sock *sk);
-
-static inline void __ccid_get(struct ccid *ccid)
-{
-	__module_get(ccid->ccid_owner);
-}
-
-static inline int ccid_hc_tx_send_packet(struct ccid *ccid, struct sock *sk,
-					 struct sk_buff *skb, int len)
-{
-	int rc = 0;
-	if (ccid->ccid_hc_tx_send_packet != NULL)
-		rc = ccid->ccid_hc_tx_send_packet(sk, skb, len);
-	return rc;
-}
-
-static inline void ccid_hc_tx_packet_sent(struct ccid *ccid, struct sock *sk,
-					  int more, int len)
-{
-	if (ccid->ccid_hc_tx_packet_sent != NULL)
-		ccid->ccid_hc_tx_packet_sent(sk, more, len);
-}
-
-static inline int ccid_hc_rx_init(struct ccid *ccid, struct sock *sk)
-{
-	int rc = 0;
-	if (ccid->ccid_hc_rx_init != NULL)
-		rc = ccid->ccid_hc_rx_init(sk);
-	return rc;
-}
-
-static inline int ccid_hc_tx_init(struct ccid *ccid, struct sock *sk)
-{
-	int rc = 0;
-	if (ccid->ccid_hc_tx_init != NULL)
-		rc = ccid->ccid_hc_tx_init(sk);
-	return rc;
-}
-
-static inline void ccid_hc_rx_exit(struct ccid *ccid, struct sock *sk)
-{
-	if (ccid->ccid_hc_rx_exit != NULL &&
-	    dccp_sk(sk)->dccps_hc_rx_ccid_private != NULL)
-		ccid->ccid_hc_rx_exit(sk);
-}
-
-static inline void ccid_hc_tx_exit(struct ccid *ccid, struct sock *sk)
-{
-	if (ccid->ccid_hc_tx_exit != NULL &&
-	    dccp_sk(sk)->dccps_hc_tx_ccid_private != NULL)
-		ccid->ccid_hc_tx_exit(sk);
-}
-
-static inline void ccid_hc_rx_packet_recv(struct ccid *ccid, struct sock *sk,
-					  struct sk_buff *skb)
-{
-	if (ccid->ccid_hc_rx_packet_recv != NULL)
-		ccid->ccid_hc_rx_packet_recv(sk, skb);
-}
-
-static inline void ccid_hc_tx_packet_recv(struct ccid *ccid, struct sock *sk,
-					  struct sk_buff *skb)
-{
-	if (ccid->ccid_hc_tx_packet_recv != NULL)
-		ccid->ccid_hc_tx_packet_recv(sk, skb);
-}
-
-static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
-					   unsigned char option,
-					   unsigned char len, u16 idx,
-					   unsigned char* value)
-{
-	int rc = 0;
-	if (ccid->ccid_hc_tx_parse_options != NULL)
-		rc = ccid->ccid_hc_tx_parse_options(sk, option, len, idx,
-						    value);
-	return rc;
-}
-
-static inline int ccid_hc_rx_parse_options(struct ccid *ccid, struct sock *sk,
-					   unsigned char option,
-					   unsigned char len, u16 idx,
-					   unsigned char* value)
-{
-	int rc = 0;
-	if (ccid->ccid_hc_rx_parse_options != NULL)
-		rc = ccid->ccid_hc_rx_parse_options(sk, option, len, idx, value);
-	return rc;
-}
-
-static inline void ccid_hc_tx_insert_options(struct ccid *ccid, struct sock *sk,
-					     struct sk_buff *skb)
-{
-	if (ccid->ccid_hc_tx_insert_options != NULL)
-		ccid->ccid_hc_tx_insert_options(sk, skb);
-}
-
-static inline void ccid_hc_rx_insert_options(struct ccid *ccid, struct sock *sk,
-					     struct sk_buff *skb)
-{
-	if (ccid->ccid_hc_rx_insert_options != NULL)
-		ccid->ccid_hc_rx_insert_options(sk, skb);
-}
-
-static inline void ccid_hc_rx_get_info(struct ccid *ccid, struct sock *sk,
-				       struct tcp_info *info)
-{
-	if (ccid->ccid_hc_rx_get_info != NULL)
-		ccid->ccid_hc_rx_get_info(sk, info);
-}
-
-static inline void ccid_hc_tx_get_info(struct ccid *ccid, struct sock *sk,
-				       struct tcp_info *info)
-{
-	if (ccid->ccid_hc_tx_get_info != NULL)
-		ccid->ccid_hc_tx_get_info(sk, info);
-}
-#endif /* _CCID_H */
diff --git a/trunk/net/dccp/ccids/Kconfig b/trunk/net/dccp/ccids/Kconfig
deleted file mode 100644
index 7684d83946a4..000000000000
--- a/trunk/net/dccp/ccids/Kconfig
+++ /dev/null
@@ -1,29 +0,0 @@
-menu "DCCP CCIDs Configuration (EXPERIMENTAL)"
-	depends on IP_DCCP && EXPERIMENTAL
-
-config IP_DCCP_CCID3
-	tristate "CCID3 (TFRC) (EXPERIMENTAL)"
-	depends on IP_DCCP
-	---help---
-	  CCID 3 denotes TCP-Friendly Rate Control (TFRC), an equation-based
-	  rate-controlled congestion control mechanism.  TFRC is designed to
-	  be reasonably fair when competing for bandwidth with TCP-like flows,
-	  where a flow is "reasonably fair" if its sending rate is generally
-	  within a factor of two of the sending rate of a TCP flow under the
-	  same conditions.  However, TFRC has a much lower variation of
-	  throughput over time compared with TCP, which makes CCID 3 more
-	  suitable than CCID 2 for applications such streaming media where a
-	  relatively smooth sending rate is of importance.
-
-	  CCID 3 is further described in [CCID 3 PROFILE]. The TFRC
-	  congestion control algorithms were initially described in RFC 3448.
-
-	  This text was extracted from draft-ietf-dccp-spec-11.txt.
-	  
-	  If in doubt, say M.
-
-config IP_DCCP_TFRC_LIB
-	depends on IP_DCCP_CCID3
-	def_tristate IP_DCCP_CCID3
-
-endmenu
diff --git a/trunk/net/dccp/ccids/Makefile b/trunk/net/dccp/ccids/Makefile
deleted file mode 100644
index 956f79f50743..000000000000
--- a/trunk/net/dccp/ccids/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-obj-$(CONFIG_IP_DCCP_CCID3) += dccp_ccid3.o
-
-dccp_ccid3-y := ccid3.o
-
-obj-y += lib/
diff --git a/trunk/net/dccp/ccids/ccid3.c b/trunk/net/dccp/ccids/ccid3.c
deleted file mode 100644
index 7bf3b3a91e97..000000000000
--- a/trunk/net/dccp/ccids/ccid3.c
+++ /dev/null
@@ -1,1221 +0,0 @@
-/*
- *  net/dccp/ccids/ccid3.c
- *
- *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
- *
- *  An implementation of the DCCP protocol
- *
- *  This code has been developed by the University of Waikato WAND
- *  research group. For further information please see http://www.wand.net.nz/
- *
- *  This code also uses code from Lulea University, rereleased as GPL by its
- *  authors:
- *  Copyright (c) 2003 Nils-Erik Mattsson, Joacim Haggmark, Magnus Erixzon
- *
- *  Changes to meet Linux coding standards, to make it meet latest ccid3 draft
- *  and to make it work as a loadable module in the DCCP stack written by
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>.
- *
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#include <linux/config.h>
-#include "../ccid.h"
-#include "../dccp.h"
-#include "lib/packet_history.h"
-#include "lib/loss_interval.h"
-#include "lib/tfrc.h"
-#include "ccid3.h"
-
-/*
- * Reason for maths with 10 here is to avoid 32 bit overflow when a is big.
- */
-static inline u32 usecs_div(const u32 a, const u32 b)
-{
-	const u32 tmp = a * (USEC_PER_SEC / 10);
-	return b > 20 ? tmp / (b / 10) : tmp;
-}
-
-static int ccid3_debug;
-
-#ifdef CCID3_DEBUG
-#define ccid3_pr_debug(format, a...) \
-	do { if (ccid3_debug) \
-		printk(KERN_DEBUG "%s: " format, __FUNCTION__, ##a); \
-	} while (0)
-#else
-#define ccid3_pr_debug(format, a...)
-#endif
-
-static struct dccp_tx_hist *ccid3_tx_hist;
-static struct dccp_rx_hist *ccid3_rx_hist;
-static struct dccp_li_hist *ccid3_li_hist;
-
-static int ccid3_init(struct sock *sk)
-{
-	ccid3_pr_debug("%s, sk=%p\n", dccp_role(sk), sk);
-	return 0;
-}
-
-static void ccid3_exit(struct sock *sk)
-{
-	ccid3_pr_debug("%s, sk=%p\n", dccp_role(sk), sk);
-}
-
-/* TFRC sender states */
-enum ccid3_hc_tx_states {
-       	TFRC_SSTATE_NO_SENT = 1,
-	TFRC_SSTATE_NO_FBACK,
-	TFRC_SSTATE_FBACK,
-	TFRC_SSTATE_TERM,
-};
-
-#ifdef CCID3_DEBUG
-static const char *ccid3_tx_state_name(enum ccid3_hc_tx_states state)
-{
-	static char *ccid3_state_names[] = {
-	[TFRC_SSTATE_NO_SENT]  = "NO_SENT",
-	[TFRC_SSTATE_NO_FBACK] = "NO_FBACK",
-	[TFRC_SSTATE_FBACK]    = "FBACK",
-	[TFRC_SSTATE_TERM]     = "TERM",
-	};
-
-	return ccid3_state_names[state];
-}
-#endif
-
-static inline void ccid3_hc_tx_set_state(struct sock *sk,
-					 enum ccid3_hc_tx_states state)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-	enum ccid3_hc_tx_states oldstate = hctx->ccid3hctx_state;
-
-	ccid3_pr_debug("%s(%p) %-8.8s -> %s\n",
-		       dccp_role(sk), sk, ccid3_tx_state_name(oldstate),
-		       ccid3_tx_state_name(state));
-	WARN_ON(state == oldstate);
-	hctx->ccid3hctx_state = state;
-}
-
-/* Calculate new t_ipi (inter packet interval) by t_ipi = s / X_inst */
-static inline void ccid3_calc_new_t_ipi(struct ccid3_hc_tx_sock *hctx)
-{
-	/*
-	 * If no feedback spec says t_ipi is 1 second (set elsewhere and then
-	 * doubles after every no feedback timer (separate function)
-	 */
-	if (hctx->ccid3hctx_state != TFRC_SSTATE_NO_FBACK)
-		hctx->ccid3hctx_t_ipi = usecs_div(hctx->ccid3hctx_s,
-						  hctx->ccid3hctx_x);
-}
-
-/* Calculate new delta by delta = min(t_ipi / 2, t_gran / 2) */
-static inline void ccid3_calc_new_delta(struct ccid3_hc_tx_sock *hctx)
-{
-	hctx->ccid3hctx_delta = min_t(u32, hctx->ccid3hctx_t_ipi / 2,
-					   TFRC_OPSYS_HALF_TIME_GRAN);
-}
-
-/*
- * Update X by
- *    If (p > 0)
- *       x_calc = calcX(s, R, p);
- *       X = max(min(X_calc, 2 * X_recv), s / t_mbi);
- *    Else
- *       If (now - tld >= R)
- *          X = max(min(2 * X, 2 * X_recv), s / R);
- *          tld = now;
- */ 
-static void ccid3_hc_tx_update_x(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-
-	/* To avoid large error in calcX */
-	if (hctx->ccid3hctx_p >= TFRC_SMALLEST_P) {
-		hctx->ccid3hctx_x_calc = tfrc_calc_x(hctx->ccid3hctx_s,
-						     hctx->ccid3hctx_rtt,
-						     hctx->ccid3hctx_p);
-		hctx->ccid3hctx_x = max_t(u32, min_t(u32, hctx->ccid3hctx_x_calc,
-							  2 * hctx->ccid3hctx_x_recv),
-					       (hctx->ccid3hctx_s /
-					        TFRC_MAX_BACK_OFF_TIME));
-	} else {
-		struct timeval now;
-
-		do_gettimeofday(&now);
-	       	if (timeval_delta(&now, &hctx->ccid3hctx_t_ld) >=
-		    hctx->ccid3hctx_rtt) {
-			hctx->ccid3hctx_x = max_t(u32, min_t(u32, hctx->ccid3hctx_x_recv,
-								  hctx->ccid3hctx_x) * 2,
-						       usecs_div(hctx->ccid3hctx_s,
-							       	 hctx->ccid3hctx_rtt));
-			hctx->ccid3hctx_t_ld = now;
-		}
-	}
-}
-
-static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
-{
-	struct sock *sk = (struct sock *)data;
-	struct dccp_sock *dp = dccp_sk(sk);
-	unsigned long next_tmout = 0;
-	struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-
-	bh_lock_sock(sk);
-	if (sock_owned_by_user(sk)) {
-		/* Try again later. */
-		/* XXX: set some sensible MIB */
-		sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer,
-			       jiffies + HZ / 5);
-		goto out;
-	}
-
-	ccid3_pr_debug("%s, sk=%p, state=%s\n", dccp_role(sk), sk,
-		       ccid3_tx_state_name(hctx->ccid3hctx_state));
-	
-	switch (hctx->ccid3hctx_state) {
-	case TFRC_SSTATE_TERM:
-		goto out;
-	case TFRC_SSTATE_NO_FBACK:
-		/* Halve send rate */
-		hctx->ccid3hctx_x /= 2;
-		if (hctx->ccid3hctx_x < (hctx->ccid3hctx_s /
-					 TFRC_MAX_BACK_OFF_TIME))
-			hctx->ccid3hctx_x = (hctx->ccid3hctx_s /
-					     TFRC_MAX_BACK_OFF_TIME);
-
-		ccid3_pr_debug("%s, sk=%p, state=%s, updated tx rate to %d "
-			       "bytes/s\n",
-			       dccp_role(sk), sk,
-			       ccid3_tx_state_name(hctx->ccid3hctx_state),
-			       hctx->ccid3hctx_x);
-		next_tmout = max_t(u32, 2 * usecs_div(hctx->ccid3hctx_s,
-						      hctx->ccid3hctx_x),
-					TFRC_INITIAL_TIMEOUT);
-		/*
-		 * FIXME - not sure above calculation is correct. See section
-		 * 5 of CCID3 11 should adjust tx_t_ipi and double that to
-		 * achieve it really
-		 */
-		break;
-	case TFRC_SSTATE_FBACK:
-		/*
-		 * Check if IDLE since last timeout and recv rate is less than
-		 * 4 packets per RTT
-		 */
-		if (!hctx->ccid3hctx_idle ||
-		    (hctx->ccid3hctx_x_recv >=
-		     4 * usecs_div(hctx->ccid3hctx_s, hctx->ccid3hctx_rtt))) {
-			ccid3_pr_debug("%s, sk=%p, state=%s, not idle\n",
-				       dccp_role(sk), sk,
-				       ccid3_tx_state_name(hctx->ccid3hctx_state));
-			/* Halve sending rate */
-
-			/*  If (X_calc > 2 * X_recv)
-			 *    X_recv = max(X_recv / 2, s / (2 * t_mbi));
-			 *  Else
-			 *    X_recv = X_calc / 4;
-			 */
-			BUG_ON(hctx->ccid3hctx_p >= TFRC_SMALLEST_P &&
-			       hctx->ccid3hctx_x_calc == 0);
-
-			/* check also if p is zero -> x_calc is infinity? */
-			if (hctx->ccid3hctx_p < TFRC_SMALLEST_P ||
-			    hctx->ccid3hctx_x_calc > 2 * hctx->ccid3hctx_x_recv)
-				hctx->ccid3hctx_x_recv = max_t(u32, hctx->ccid3hctx_x_recv / 2,
-								    hctx->ccid3hctx_s / (2 * TFRC_MAX_BACK_OFF_TIME));
-			else
-				hctx->ccid3hctx_x_recv = hctx->ccid3hctx_x_calc / 4;
-
-			/* Update sending rate */
-			ccid3_hc_tx_update_x(sk);
-		}
-		/*
-		 * Schedule no feedback timer to expire in
-		 * max(4 * R, 2 * s / X)
-		 */
-		next_tmout = max_t(u32, hctx->ccid3hctx_t_rto, 
-					2 * usecs_div(hctx->ccid3hctx_s,
-						      hctx->ccid3hctx_x));
-		break;
-	default:
-		printk(KERN_CRIT "%s: %s, sk=%p, Illegal state (%d)!\n",
-		       __FUNCTION__, dccp_role(sk), sk, hctx->ccid3hctx_state);
-		dump_stack();
-		goto out;
-	}
-
-	sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer, 
-		      jiffies + max_t(u32, 1, usecs_to_jiffies(next_tmout)));
-	hctx->ccid3hctx_idle = 1;
-out:
-	bh_unlock_sock(sk);
-	sock_put(sk);
-}
-
-static int ccid3_hc_tx_send_packet(struct sock *sk,
-				   struct sk_buff *skb, int len)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-	struct dccp_tx_hist_entry *new_packet;
-	struct timeval now;
-	long delay;
-	int rc = -ENOTCONN;
-
-	/* Check if pure ACK or Terminating*/
-
-	/*
-	 * XXX: We only call this function for DATA and DATAACK, on, these
-	 * packets can have zero length, but why the comment about "pure ACK"?
-	 */
-	if (hctx == NULL || len == 0 ||
-	    hctx->ccid3hctx_state == TFRC_SSTATE_TERM)
-		goto out;
-
-	/* See if last packet allocated was not sent */
-	new_packet = dccp_tx_hist_head(&hctx->ccid3hctx_hist);
-	if (new_packet == NULL || new_packet->dccphtx_sent) {
-		new_packet = dccp_tx_hist_entry_new(ccid3_tx_hist,
-						    SLAB_ATOMIC);
-
-		rc = -ENOBUFS;
-		if (new_packet == NULL) {
-			ccid3_pr_debug("%s, sk=%p, not enough mem to add "
-				       "to history, send refused\n",
-				       dccp_role(sk), sk);
-			goto out;
-		}
-
-		dccp_tx_hist_add_entry(&hctx->ccid3hctx_hist, new_packet);
-	}
-
-	do_gettimeofday(&now);
-
-	switch (hctx->ccid3hctx_state) {
-	case TFRC_SSTATE_NO_SENT:
-		ccid3_pr_debug("%s, sk=%p, first packet(%llu)\n",
-			       dccp_role(sk), sk, dp->dccps_gss);
-
-		hctx->ccid3hctx_no_feedback_timer.function = ccid3_hc_tx_no_feedback_timer;
-		hctx->ccid3hctx_no_feedback_timer.data     = (unsigned long)sk;
-		sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer,
-			       jiffies + usecs_to_jiffies(TFRC_INITIAL_TIMEOUT));
-		hctx->ccid3hctx_last_win_count	 = 0;
-		hctx->ccid3hctx_t_last_win_count = now;
-		ccid3_hc_tx_set_state(sk, TFRC_SSTATE_NO_FBACK);
-		hctx->ccid3hctx_t_ipi = TFRC_INITIAL_TIMEOUT;
-
-		/* Set nominal send time for initial packet */
-		hctx->ccid3hctx_t_nom = now;
-		timeval_add_usecs(&hctx->ccid3hctx_t_nom,
-				  hctx->ccid3hctx_t_ipi);
-		ccid3_calc_new_delta(hctx);
-		rc = 0;
-		break;
-	case TFRC_SSTATE_NO_FBACK:
-	case TFRC_SSTATE_FBACK:
-		delay = (timeval_delta(&now, &hctx->ccid3hctx_t_nom) -
-		         hctx->ccid3hctx_delta);
-		ccid3_pr_debug("send_packet delay=%ld\n", delay);
-		delay /= -1000;
-		/* divide by -1000 is to convert to ms and get sign right */
-		rc = delay > 0 ? delay : 0;
-		break;
-	default:
-		printk(KERN_CRIT "%s: %s, sk=%p, Illegal state (%d)!\n",
-		       __FUNCTION__, dccp_role(sk), sk, hctx->ccid3hctx_state);
-		dump_stack();
-		rc = -EINVAL;
-		break;
-	}
-
-	/* Can we send? if so add options and add to packet history */
-	if (rc == 0)
-		new_packet->dccphtx_ccval =
-			DCCP_SKB_CB(skb)->dccpd_ccval =
-				hctx->ccid3hctx_last_win_count;
-out:
-	return rc;
-}
-
-static void ccid3_hc_tx_packet_sent(struct sock *sk, int more, int len)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-	struct timeval now;
-
-	BUG_ON(hctx == NULL);
-
-	if (hctx->ccid3hctx_state == TFRC_SSTATE_TERM) {
-		ccid3_pr_debug("%s, sk=%p, while state is TFRC_SSTATE_TERM!\n",
-			       dccp_role(sk), sk);
-		return;
-	}
-
-	do_gettimeofday(&now);
-
-	/* check if we have sent a data packet */
-	if (len > 0) {
-		unsigned long quarter_rtt;
-		struct dccp_tx_hist_entry *packet;
-
-		packet = dccp_tx_hist_head(&hctx->ccid3hctx_hist);
-		if (packet == NULL) {
-			printk(KERN_CRIT "%s: packet doesn't exists in "
-					 "history!\n", __FUNCTION__);
-			return;
-		}
-		if (packet->dccphtx_sent) {
-			printk(KERN_CRIT "%s: no unsent packet in history!\n",
-			       __FUNCTION__);
-			return;
-		}
-		packet->dccphtx_tstamp = now;
-		packet->dccphtx_seqno  = dp->dccps_gss;
-		/*
-		 * Check if win_count have changed
-		 * Algorithm in "8.1. Window Counter Valuer" in
-		 * draft-ietf-dccp-ccid3-11.txt
-		 */
-		quarter_rtt = timeval_delta(&now, &hctx->ccid3hctx_t_last_win_count);
-		if (likely(hctx->ccid3hctx_rtt > 8))
-			quarter_rtt /= hctx->ccid3hctx_rtt / 4;
-
-		if (quarter_rtt > 0) {
-			hctx->ccid3hctx_t_last_win_count = now;
-			hctx->ccid3hctx_last_win_count	 = (hctx->ccid3hctx_last_win_count +
-							    min_t(unsigned long, quarter_rtt, 5)) % 16;
-			ccid3_pr_debug("%s, sk=%p, window changed from "
-				       "%u to %u!\n",
-				       dccp_role(sk), sk,
-				       packet->dccphtx_ccval,
-				       hctx->ccid3hctx_last_win_count);
-		}
-
-		hctx->ccid3hctx_idle = 0;
-		packet->dccphtx_rtt  = hctx->ccid3hctx_rtt;
-		packet->dccphtx_sent = 1;
-	} else
-		ccid3_pr_debug("%s, sk=%p, seqno=%llu NOT inserted!\n",
-			       dccp_role(sk), sk, dp->dccps_gss);
-
-	switch (hctx->ccid3hctx_state) {
-	case TFRC_SSTATE_NO_SENT:
-		/* if first wasn't pure ack */
-		if (len != 0)
-			printk(KERN_CRIT "%s: %s, First packet sent is noted "
-					 "as a data packet\n",
-			       __FUNCTION__, dccp_role(sk));
-		return;
-	case TFRC_SSTATE_NO_FBACK:
-	case TFRC_SSTATE_FBACK:
-		if (len > 0) {
-			hctx->ccid3hctx_t_nom = now;
-			ccid3_calc_new_t_ipi(hctx);
-			ccid3_calc_new_delta(hctx);
-			timeval_add_usecs(&hctx->ccid3hctx_t_nom,
-					  hctx->ccid3hctx_t_ipi);
-		}
-		break;
-	default:
-		printk(KERN_CRIT "%s: %s, sk=%p, Illegal state (%d)!\n",
-		       __FUNCTION__, dccp_role(sk), sk, hctx->ccid3hctx_state);
-		dump_stack();
-		break;
-	}
-}
-
-static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-	struct ccid3_options_received *opt_recv;
-	struct dccp_tx_hist_entry *packet;
-	unsigned long next_tmout; 
-	u32 t_elapsed;
-	u32 pinv;
-	u32 x_recv;
-	u32 r_sample;
-
-	if (hctx == NULL)
-		return;
-
-	if (hctx->ccid3hctx_state == TFRC_SSTATE_TERM) {
-		ccid3_pr_debug("%s, sk=%p, received a packet when "
-			       "terminating!\n", dccp_role(sk), sk);
-		return;
-	}
-
-	/* we are only interested in ACKs */
-	if (!(DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_ACK ||
-	      DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_DATAACK))
-		return;
-
-	opt_recv = &hctx->ccid3hctx_options_received;
-
-	t_elapsed = dp->dccps_options_received.dccpor_elapsed_time;
-	x_recv = opt_recv->ccid3or_receive_rate;
-	pinv = opt_recv->ccid3or_loss_event_rate;
-
-	switch (hctx->ccid3hctx_state) {
-	case TFRC_SSTATE_NO_SENT:
-		/* FIXME: what to do here? */
-		return;
-	case TFRC_SSTATE_NO_FBACK:
-	case TFRC_SSTATE_FBACK:
-		/* Calculate new round trip sample by
-		 * R_sample = (now - t_recvdata) - t_delay */
-		/* get t_recvdata from history */
-		packet = dccp_tx_hist_find_entry(&hctx->ccid3hctx_hist,
-						 DCCP_SKB_CB(skb)->dccpd_ack_seq);
-		if (packet == NULL) {
-			ccid3_pr_debug("%s, sk=%p, seqno %llu(%s) does't "
-				       "exist in history!\n",
-				       dccp_role(sk), sk,
-				       DCCP_SKB_CB(skb)->dccpd_ack_seq,
-				       dccp_packet_name(DCCP_SKB_CB(skb)->dccpd_type));
-			return;
-		}
-
-		/* Update RTT */
-		r_sample = timeval_now_delta(&packet->dccphtx_tstamp);
-		/* FIXME: */
-		// r_sample -= usecs_to_jiffies(t_elapsed * 10);
-
-		/* Update RTT estimate by 
-		 * If (No feedback recv)
-		 *    R = R_sample;
-		 * Else
-		 *    R = q * R + (1 - q) * R_sample;
-		 *
-		 * q is a constant, RFC 3448 recomments 0.9
-		 */
-		if (hctx->ccid3hctx_state == TFRC_SSTATE_NO_FBACK) {
-			ccid3_hc_tx_set_state(sk, TFRC_SSTATE_FBACK);
-			hctx->ccid3hctx_rtt = r_sample;
-		} else
-			hctx->ccid3hctx_rtt = (hctx->ccid3hctx_rtt * 9) / 10 +
-					      r_sample / 10;
-
-		ccid3_pr_debug("%s, sk=%p, New RTT estimate=%uus, "
-			       "r_sample=%us\n", dccp_role(sk), sk,
-			       hctx->ccid3hctx_rtt, r_sample);
-
-		/* Update timeout interval */
-		hctx->ccid3hctx_t_rto = max_t(u32, 4 * hctx->ccid3hctx_rtt,
-					      USEC_PER_SEC);
-
-		/* Update receive rate */
-		hctx->ccid3hctx_x_recv = x_recv;/* X_recv in bytes per sec */
-
-		/* Update loss event rate */
-		if (pinv == ~0 || pinv == 0)
-			hctx->ccid3hctx_p = 0;
-		else {
-			hctx->ccid3hctx_p = 1000000 / pinv;
-
-			if (hctx->ccid3hctx_p < TFRC_SMALLEST_P) {
-				hctx->ccid3hctx_p = TFRC_SMALLEST_P;
-				ccid3_pr_debug("%s, sk=%p, Smallest p used!\n",
-					       dccp_role(sk), sk);
-			}
-		}
-
-		/* unschedule no feedback timer */
-		sk_stop_timer(sk, &hctx->ccid3hctx_no_feedback_timer);
-
-		/* Update sending rate */
-		ccid3_hc_tx_update_x(sk);
-
-		/* Update next send time */
-		timeval_sub_usecs(&hctx->ccid3hctx_t_nom,
-				  hctx->ccid3hctx_t_ipi);
-		ccid3_calc_new_t_ipi(hctx);
-		timeval_add_usecs(&hctx->ccid3hctx_t_nom,
-				  hctx->ccid3hctx_t_ipi);
-		ccid3_calc_new_delta(hctx);
-
-		/* remove all packets older than the one acked from history */
-		dccp_tx_hist_purge_older(ccid3_tx_hist,
-					 &hctx->ccid3hctx_hist, packet);
-		/*
-		 * As we have calculated new ipi, delta, t_nom it is possible that
-		 * we now can send a packet, so wake up dccp_wait_for_ccids.
-		 */
-		sk->sk_write_space(sk);
-
-		/*
-		 * Schedule no feedback timer to expire in
-		 * max(4 * R, 2 * s / X)
-		 */
-		next_tmout = max(hctx->ccid3hctx_t_rto,
-				 2 * usecs_div(hctx->ccid3hctx_s,
-					       hctx->ccid3hctx_x));
-			
-		ccid3_pr_debug("%s, sk=%p, Scheduled no feedback timer to "
-			       "expire in %lu jiffies (%luus)\n",
-			       dccp_role(sk), sk,
-			       usecs_to_jiffies(next_tmout), next_tmout); 
-
-		sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer, 
-			       jiffies + max_t(u32, 1, usecs_to_jiffies(next_tmout)));
-
-		/* set idle flag */
-		hctx->ccid3hctx_idle = 1;   
-		break;
-	default:
-		printk(KERN_CRIT "%s: %s, sk=%p, Illegal state (%d)!\n",
-		       __FUNCTION__, dccp_role(sk), sk, hctx->ccid3hctx_state);
-		dump_stack();
-		break;
-	}
-}
-
-static void ccid3_hc_tx_insert_options(struct sock *sk, struct sk_buff *skb)
-{
-	const struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-
-	if (hctx == NULL || !(sk->sk_state == DCCP_OPEN ||
-			      sk->sk_state == DCCP_PARTOPEN))
-		return;
-
-	 DCCP_SKB_CB(skb)->dccpd_ccval = hctx->ccid3hctx_last_win_count;
-}
-
-static int ccid3_hc_tx_parse_options(struct sock *sk, unsigned char option,
-				     unsigned char len, u16 idx,
-				     unsigned char *value)
-{
-	int rc = 0;
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-	struct ccid3_options_received *opt_recv;
-
-	if (hctx == NULL)
-		return 0;
-
-	opt_recv = &hctx->ccid3hctx_options_received;
-
-	if (opt_recv->ccid3or_seqno != dp->dccps_gsr) {
-		opt_recv->ccid3or_seqno		     = dp->dccps_gsr;
-		opt_recv->ccid3or_loss_event_rate    = ~0;
-		opt_recv->ccid3or_loss_intervals_idx = 0;
-		opt_recv->ccid3or_loss_intervals_len = 0;
-		opt_recv->ccid3or_receive_rate	     = 0;
-	}
-
-	switch (option) {
-	case TFRC_OPT_LOSS_EVENT_RATE:
-		if (len != 4) {
-			ccid3_pr_debug("%s, sk=%p, invalid len for "
-				       "TFRC_OPT_LOSS_EVENT_RATE\n",
-				       dccp_role(sk), sk);
-			rc = -EINVAL;
-		} else {
-			opt_recv->ccid3or_loss_event_rate = ntohl(*(u32 *)value);
-			ccid3_pr_debug("%s, sk=%p, LOSS_EVENT_RATE=%u\n",
-				       dccp_role(sk), sk,
-				       opt_recv->ccid3or_loss_event_rate);
-		}
-		break;
-	case TFRC_OPT_LOSS_INTERVALS:
-		opt_recv->ccid3or_loss_intervals_idx = idx;
-		opt_recv->ccid3or_loss_intervals_len = len;
-		ccid3_pr_debug("%s, sk=%p, LOSS_INTERVALS=(%u, %u)\n",
-			       dccp_role(sk), sk,
-			       opt_recv->ccid3or_loss_intervals_idx,
-			       opt_recv->ccid3or_loss_intervals_len);
-		break;
-	case TFRC_OPT_RECEIVE_RATE:
-		if (len != 4) {
-			ccid3_pr_debug("%s, sk=%p, invalid len for "
-				       "TFRC_OPT_RECEIVE_RATE\n",
-				       dccp_role(sk), sk);
-			rc = -EINVAL;
-		} else {
-			opt_recv->ccid3or_receive_rate = ntohl(*(u32 *)value);
-			ccid3_pr_debug("%s, sk=%p, RECEIVE_RATE=%u\n",
-				       dccp_role(sk), sk,
-				       opt_recv->ccid3or_receive_rate);
-		}
-		break;
-	}
-
-	return rc;
-}
-
-static int ccid3_hc_tx_init(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_tx_sock *hctx;
-
-	ccid3_pr_debug("%s, sk=%p\n", dccp_role(sk), sk);
-
-	hctx = dp->dccps_hc_tx_ccid_private = kmalloc(sizeof(*hctx),
-						      gfp_any());
-	if (hctx == NULL)
-		return -ENOMEM;
-
-	memset(hctx, 0, sizeof(*hctx));
-
-	if (dp->dccps_packet_size >= TFRC_MIN_PACKET_SIZE &&
-	    dp->dccps_packet_size <= TFRC_MAX_PACKET_SIZE)
-		hctx->ccid3hctx_s = dp->dccps_packet_size;
-	else
-		hctx->ccid3hctx_s = TFRC_STD_PACKET_SIZE;
-
-	/* Set transmission rate to 1 packet per second */
-	hctx->ccid3hctx_x     = hctx->ccid3hctx_s;
-	hctx->ccid3hctx_t_rto = USEC_PER_SEC;
-	hctx->ccid3hctx_state = TFRC_SSTATE_NO_SENT;
-	INIT_LIST_HEAD(&hctx->ccid3hctx_hist);
-	init_timer(&hctx->ccid3hctx_no_feedback_timer);
-
-	return 0;
-}
-
-static void ccid3_hc_tx_exit(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-
-	ccid3_pr_debug("%s, sk=%p\n", dccp_role(sk), sk);
-	BUG_ON(hctx == NULL);
-
-	ccid3_hc_tx_set_state(sk, TFRC_SSTATE_TERM);
-	sk_stop_timer(sk, &hctx->ccid3hctx_no_feedback_timer);
-
-	/* Empty packet history */
-	dccp_tx_hist_purge(ccid3_tx_hist, &hctx->ccid3hctx_hist);
-
-	kfree(dp->dccps_hc_tx_ccid_private);
-	dp->dccps_hc_tx_ccid_private = NULL;
-}
-
-/*
- * RX Half Connection methods
- */
-
-/* TFRC receiver states */
-enum ccid3_hc_rx_states {
-       	TFRC_RSTATE_NO_DATA = 1,
-	TFRC_RSTATE_DATA,
-	TFRC_RSTATE_TERM    = 127,
-};
-
-#ifdef CCID3_DEBUG
-static const char *ccid3_rx_state_name(enum ccid3_hc_rx_states state)
-{
-	static char *ccid3_rx_state_names[] = {
-	[TFRC_RSTATE_NO_DATA] = "NO_DATA",
-	[TFRC_RSTATE_DATA]    = "DATA",
-	[TFRC_RSTATE_TERM]    = "TERM",
-	};
-
-	return ccid3_rx_state_names[state];
-}
-#endif
-
-static inline void ccid3_hc_rx_set_state(struct sock *sk,
-					 enum ccid3_hc_rx_states state)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_rx_sock *hcrx = dp->dccps_hc_rx_ccid_private;
-	enum ccid3_hc_rx_states oldstate = hcrx->ccid3hcrx_state;
-
-	ccid3_pr_debug("%s(%p) %-8.8s -> %s\n",
-		       dccp_role(sk), sk, ccid3_rx_state_name(oldstate),
-		       ccid3_rx_state_name(state));
-	WARN_ON(state == oldstate);
-	hcrx->ccid3hcrx_state = state;
-}
-
-static void ccid3_hc_rx_send_feedback(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_rx_sock *hcrx = dp->dccps_hc_rx_ccid_private;
-	struct dccp_rx_hist_entry *packet;
-	struct timeval now;
-
-	ccid3_pr_debug("%s, sk=%p\n", dccp_role(sk), sk);
-
-	do_gettimeofday(&now);
-
-	switch (hcrx->ccid3hcrx_state) {
-	case TFRC_RSTATE_NO_DATA:
-		hcrx->ccid3hcrx_x_recv = 0;
-		break;
-	case TFRC_RSTATE_DATA: {
-		const u32 delta = timeval_delta(&now,
-					&hcrx->ccid3hcrx_tstamp_last_feedback);
-
-		hcrx->ccid3hcrx_x_recv = (hcrx->ccid3hcrx_bytes_recv *
-					  USEC_PER_SEC);
-		if (likely(delta > 1))
-			hcrx->ccid3hcrx_x_recv /= delta;
-	}
-		break;
-	default:
-		printk(KERN_CRIT "%s: %s, sk=%p, Illegal state (%d)!\n",
-		       __FUNCTION__, dccp_role(sk), sk, hcrx->ccid3hcrx_state);
-		dump_stack();
-		return;
-	}
-
-	packet = dccp_rx_hist_find_data_packet(&hcrx->ccid3hcrx_hist);
-	if (packet == NULL) {
-		printk(KERN_CRIT "%s: %s, sk=%p, no data packet in history!\n",
-		       __FUNCTION__, dccp_role(sk), sk);
-		dump_stack();
-		return;
-	}
-
-	hcrx->ccid3hcrx_tstamp_last_feedback = now;
-	hcrx->ccid3hcrx_last_counter	     = packet->dccphrx_ccval;
-	hcrx->ccid3hcrx_seqno_last_counter   = packet->dccphrx_seqno;
-	hcrx->ccid3hcrx_bytes_recv	     = 0;
-
-	/* Convert to multiples of 10us */
-	hcrx->ccid3hcrx_elapsed_time =
-			timeval_delta(&now, &packet->dccphrx_tstamp) / 10;
-	if (hcrx->ccid3hcrx_p == 0)
-		hcrx->ccid3hcrx_pinv = ~0;
-	else
-		hcrx->ccid3hcrx_pinv = 1000000 / hcrx->ccid3hcrx_p;
-	dccp_send_ack(sk);
-}
-
-static void ccid3_hc_rx_insert_options(struct sock *sk, struct sk_buff *skb)
-{
-	const struct dccp_sock *dp = dccp_sk(sk);
-	u32 x_recv, pinv;
-	struct ccid3_hc_rx_sock *hcrx = dp->dccps_hc_rx_ccid_private;
-
-	if (hcrx == NULL || !(sk->sk_state == DCCP_OPEN ||
-			      sk->sk_state == DCCP_PARTOPEN))
-		return;
-
-	DCCP_SKB_CB(skb)->dccpd_ccval = hcrx->ccid3hcrx_last_counter;
-
-	if (dccp_packet_without_ack(skb))
-		return;
-		
-	if (hcrx->ccid3hcrx_elapsed_time != 0)
-		dccp_insert_option_elapsed_time(sk, skb,
-						hcrx->ccid3hcrx_elapsed_time);
-	dccp_insert_option_timestamp(sk, skb);
-	x_recv = htonl(hcrx->ccid3hcrx_x_recv);
-	pinv   = htonl(hcrx->ccid3hcrx_pinv);
-	dccp_insert_option(sk, skb, TFRC_OPT_LOSS_EVENT_RATE,
-			   &pinv, sizeof(pinv));
-	dccp_insert_option(sk, skb, TFRC_OPT_RECEIVE_RATE,
-			   &x_recv, sizeof(x_recv));
-}
-
-/* calculate first loss interval
- *
- * returns estimated loss interval in usecs */
-
-static u32 ccid3_hc_rx_calc_first_li(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_rx_sock *hcrx = dp->dccps_hc_rx_ccid_private;
-	struct dccp_rx_hist_entry *entry, *next, *tail = NULL;
-	u32 rtt, delta, x_recv, fval, p, tmp2;
-	struct timeval tstamp = { 0, };
-	int interval = 0;
-	int win_count = 0;
-	int step = 0;
-	u64 tmp1;
-
-	list_for_each_entry_safe(entry, next, &hcrx->ccid3hcrx_hist,
-				 dccphrx_node) {
-		if (dccp_rx_hist_entry_data_packet(entry)) {
-			tail = entry;
-
-			switch (step) {
-			case 0:
-				tstamp	  = entry->dccphrx_tstamp;
-				win_count = entry->dccphrx_ccval;
-				step = 1;
-				break;
-			case 1:
-				interval = win_count - entry->dccphrx_ccval;
-				if (interval < 0)
-					interval += TFRC_WIN_COUNT_LIMIT;
-				if (interval > 4)
-					goto found;
-				break;
-			}
-		}
-	}
-
-	if (step == 0) {
-		printk(KERN_CRIT "%s: %s, sk=%p, packet history contains no "
-				 "data packets!\n",
-		       __FUNCTION__, dccp_role(sk), sk);
-		return ~0;
-	}
-
-	if (interval == 0) {
-		ccid3_pr_debug("%s, sk=%p, Could not find a win_count "
-			       "interval > 0. Defaulting to 1\n",
-			       dccp_role(sk), sk);
-		interval = 1;
-	}
-found:
-	rtt = timeval_delta(&tstamp, &tail->dccphrx_tstamp) * 4 / interval;
-	ccid3_pr_debug("%s, sk=%p, approximated RTT to %uus\n",
-		       dccp_role(sk), sk, rtt);
-	if (rtt == 0)
-		rtt = 1;
-
-	delta = timeval_now_delta(&hcrx->ccid3hcrx_tstamp_last_feedback);
-	x_recv = hcrx->ccid3hcrx_bytes_recv * USEC_PER_SEC;
-	if (likely(delta > 1))
-		x_recv /= delta;
-
-	tmp1 = (u64)x_recv * (u64)rtt;
-	do_div(tmp1,10000000);
-	tmp2 = (u32)tmp1;
-	fval = (hcrx->ccid3hcrx_s * 100000) / tmp2;
-	/* do not alter order above or you will get overflow on 32 bit */
-	p = tfrc_calc_x_reverse_lookup(fval);
-	ccid3_pr_debug("%s, sk=%p, receive rate=%u bytes/s, implied "
-		       "loss rate=%u\n", dccp_role(sk), sk, x_recv, p);
-
-	if (p == 0)
-		return ~0;
-	else
-		return 1000000 / p; 
-}
-
-static void ccid3_hc_rx_update_li(struct sock *sk, u64 seq_loss, u8 win_loss)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_rx_sock *hcrx = dp->dccps_hc_rx_ccid_private;
-
-	if (seq_loss != DCCP_MAX_SEQNO + 1 &&
-	    list_empty(&hcrx->ccid3hcrx_li_hist)) {
-		struct dccp_li_hist_entry *li_tail;
-
-		li_tail = dccp_li_hist_interval_new(ccid3_li_hist,
-						    &hcrx->ccid3hcrx_li_hist,
-						    seq_loss, win_loss);
-		if (li_tail == NULL)
-			return;
-		li_tail->dccplih_interval = ccid3_hc_rx_calc_first_li(sk);
-	}
-	/* FIXME: find end of interval */
-}
-
-static void ccid3_hc_rx_detect_loss(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_rx_sock *hcrx = dp->dccps_hc_rx_ccid_private;
-	u8 win_loss;
-	const u64 seq_loss = dccp_rx_hist_detect_loss(&hcrx->ccid3hcrx_hist,
-						      &hcrx->ccid3hcrx_li_hist,
-						      &win_loss);
-
-	ccid3_hc_rx_update_li(sk, seq_loss, win_loss);
-}
-
-static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_rx_sock *hcrx = dp->dccps_hc_rx_ccid_private;
-	const struct dccp_options_received *opt_recv;
-	struct dccp_rx_hist_entry *packet;
-	struct timeval now;
-	u8 win_count;
-	u32 p_prev;
-	int ins;
-
-	if (hcrx == NULL)
-		return;
-
-	BUG_ON(!(hcrx->ccid3hcrx_state == TFRC_RSTATE_NO_DATA ||
-		 hcrx->ccid3hcrx_state == TFRC_RSTATE_DATA));
-
-	opt_recv = &dp->dccps_options_received;
-
-	switch (DCCP_SKB_CB(skb)->dccpd_type) {
-	case DCCP_PKT_ACK:
-		if (hcrx->ccid3hcrx_state == TFRC_RSTATE_NO_DATA)
-			return;
-	case DCCP_PKT_DATAACK:
-		if (opt_recv->dccpor_timestamp_echo == 0)
-			break;
-		p_prev = hcrx->ccid3hcrx_rtt;
-		do_gettimeofday(&now);
-		hcrx->ccid3hcrx_rtt = timeval_usecs(&now) -
-				     (opt_recv->dccpor_timestamp_echo -
-				      opt_recv->dccpor_elapsed_time) * 10;
-		if (p_prev != hcrx->ccid3hcrx_rtt)
-			ccid3_pr_debug("%s, New RTT=%luus, elapsed time=%u\n",
-				       dccp_role(sk), hcrx->ccid3hcrx_rtt,
-				       opt_recv->dccpor_elapsed_time);
-		break;
-	case DCCP_PKT_DATA:
-		break;
-	default:
-		ccid3_pr_debug("%s, sk=%p, not DATA/DATAACK/ACK packet(%s)\n",
-			       dccp_role(sk), sk,
-			       dccp_packet_name(DCCP_SKB_CB(skb)->dccpd_type));
-		return;
-	}
-
-	packet = dccp_rx_hist_entry_new(ccid3_rx_hist, opt_recv->dccpor_ndp,
-					skb, SLAB_ATOMIC);
-	if (packet == NULL) {
-		ccid3_pr_debug("%s, sk=%p, Not enough mem to add rx packet "
-			       "to history (consider it lost)!",
-			       dccp_role(sk), sk);
-		return;
-	}
-
-	win_count = packet->dccphrx_ccval;
-
-	ins = dccp_rx_hist_add_packet(ccid3_rx_hist, &hcrx->ccid3hcrx_hist,
-				      &hcrx->ccid3hcrx_li_hist, packet);
-
-	if (DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_ACK)
-		return;
-
-	switch (hcrx->ccid3hcrx_state) {
-	case TFRC_RSTATE_NO_DATA:
-		ccid3_pr_debug("%s, sk=%p(%s), skb=%p, sending initial "
-			       "feedback\n",
-			       dccp_role(sk), sk,
-			       dccp_state_name(sk->sk_state), skb);
-		ccid3_hc_rx_send_feedback(sk);
-		ccid3_hc_rx_set_state(sk, TFRC_RSTATE_DATA);
-		return;
-	case TFRC_RSTATE_DATA:
-		hcrx->ccid3hcrx_bytes_recv += skb->len -
-					      dccp_hdr(skb)->dccph_doff * 4;
-		if (ins != 0)
-			break;
-
-		do_gettimeofday(&now);
-		if (timeval_delta(&now, &hcrx->ccid3hcrx_tstamp_last_ack) >=
-		    hcrx->ccid3hcrx_rtt) {
-			hcrx->ccid3hcrx_tstamp_last_ack = now;
-			ccid3_hc_rx_send_feedback(sk);
-		}
-		return;
-	default:
-		printk(KERN_CRIT "%s: %s, sk=%p, Illegal state (%d)!\n",
-		       __FUNCTION__, dccp_role(sk), sk, hcrx->ccid3hcrx_state);
-		dump_stack();
-		return;
-	}
-
-	/* Dealing with packet loss */
-	ccid3_pr_debug("%s, sk=%p(%s), data loss! Reacting...\n",
-		       dccp_role(sk), sk, dccp_state_name(sk->sk_state));
-
-	ccid3_hc_rx_detect_loss(sk);
-	p_prev = hcrx->ccid3hcrx_p;
-	
-	/* Calculate loss event rate */
-	if (!list_empty(&hcrx->ccid3hcrx_li_hist))
-		/* Scaling up by 1000000 as fixed decimal */
-		hcrx->ccid3hcrx_p = 1000000 / dccp_li_hist_calc_i_mean(&hcrx->ccid3hcrx_li_hist);
-
-	if (hcrx->ccid3hcrx_p > p_prev) {
-		ccid3_hc_rx_send_feedback(sk);
-		return;
-	}
-}
-
-static int ccid3_hc_rx_init(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_rx_sock *hcrx;
-
-	ccid3_pr_debug("%s, sk=%p\n", dccp_role(sk), sk);
-
-	hcrx = dp->dccps_hc_rx_ccid_private = kmalloc(sizeof(*hcrx),
-						      gfp_any());
-	if (hcrx == NULL)
-		return -ENOMEM;
-
-	memset(hcrx, 0, sizeof(*hcrx));
-
-	if (dp->dccps_packet_size >= TFRC_MIN_PACKET_SIZE &&
-	    dp->dccps_packet_size <= TFRC_MAX_PACKET_SIZE)
-		hcrx->ccid3hcrx_s = dp->dccps_packet_size;
-	else
-		hcrx->ccid3hcrx_s = TFRC_STD_PACKET_SIZE;
-
-	hcrx->ccid3hcrx_state = TFRC_RSTATE_NO_DATA;
-	INIT_LIST_HEAD(&hcrx->ccid3hcrx_hist);
-	INIT_LIST_HEAD(&hcrx->ccid3hcrx_li_hist);
-	/*
-	 * XXX this seems to be paranoid, need to think more about this, for
-	 * now start with something different than zero. -acme
-	 */
-	hcrx->ccid3hcrx_rtt = USEC_PER_SEC / 5;
-	return 0;
-}
-
-static void ccid3_hc_rx_exit(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct ccid3_hc_rx_sock *hcrx = dp->dccps_hc_rx_ccid_private;
-
-	ccid3_pr_debug("%s, sk=%p\n", dccp_role(sk), sk);
-
-	if (hcrx == NULL)
-		return;
-
-	ccid3_hc_rx_set_state(sk, TFRC_RSTATE_TERM);
-
-	/* Empty packet history */
-	dccp_rx_hist_purge(ccid3_rx_hist, &hcrx->ccid3hcrx_hist);
-
-	/* Empty loss interval history */
-	dccp_li_hist_purge(ccid3_li_hist, &hcrx->ccid3hcrx_li_hist);
-
-	kfree(dp->dccps_hc_rx_ccid_private);
-	dp->dccps_hc_rx_ccid_private = NULL;
-}
-
-static void ccid3_hc_rx_get_info(struct sock *sk, struct tcp_info *info)
-{
-	const struct dccp_sock *dp = dccp_sk(sk);
-	const struct ccid3_hc_rx_sock *hcrx = dp->dccps_hc_rx_ccid_private;
-
-	if (hcrx == NULL)
-		return;
-
-	info->tcpi_ca_state	= hcrx->ccid3hcrx_state;
-	info->tcpi_options	|= TCPI_OPT_TIMESTAMPS;
-	info->tcpi_rcv_rtt	= hcrx->ccid3hcrx_rtt;
-}
-
-static void ccid3_hc_tx_get_info(struct sock *sk, struct tcp_info *info)
-{
-	const struct dccp_sock *dp = dccp_sk(sk);
-	const struct ccid3_hc_tx_sock *hctx = dp->dccps_hc_tx_ccid_private;
-
-	if (hctx == NULL)
-		return;
-
-	info->tcpi_rto = hctx->ccid3hctx_t_rto;
-	info->tcpi_rtt = hctx->ccid3hctx_rtt;
-}
-
-static struct ccid ccid3 = {
-	.ccid_id		   = 3,
-	.ccid_name		   = "ccid3",
-	.ccid_owner		   = THIS_MODULE,
-	.ccid_init		   = ccid3_init,
-	.ccid_exit		   = ccid3_exit,
-	.ccid_hc_tx_init	   = ccid3_hc_tx_init,
-	.ccid_hc_tx_exit	   = ccid3_hc_tx_exit,
-	.ccid_hc_tx_send_packet	   = ccid3_hc_tx_send_packet,
-	.ccid_hc_tx_packet_sent	   = ccid3_hc_tx_packet_sent,
-	.ccid_hc_tx_packet_recv	   = ccid3_hc_tx_packet_recv,
-	.ccid_hc_tx_insert_options = ccid3_hc_tx_insert_options,
-	.ccid_hc_tx_parse_options  = ccid3_hc_tx_parse_options,
-	.ccid_hc_rx_init	   = ccid3_hc_rx_init,
-	.ccid_hc_rx_exit	   = ccid3_hc_rx_exit,
-	.ccid_hc_rx_insert_options = ccid3_hc_rx_insert_options,
-	.ccid_hc_rx_packet_recv	   = ccid3_hc_rx_packet_recv,
-	.ccid_hc_rx_get_info	   = ccid3_hc_rx_get_info,
-	.ccid_hc_tx_get_info	   = ccid3_hc_tx_get_info,
-};
- 
-module_param(ccid3_debug, int, 0444);
-MODULE_PARM_DESC(ccid3_debug, "Enable debug messages");
-
-static __init int ccid3_module_init(void)
-{
-	int rc = -ENOBUFS;
-
-	ccid3_rx_hist = dccp_rx_hist_new("ccid3");
-	if (ccid3_rx_hist == NULL)
-		goto out;
-
-	ccid3_tx_hist = dccp_tx_hist_new("ccid3");
-	if (ccid3_tx_hist == NULL)
-		goto out_free_rx;
-
-	ccid3_li_hist = dccp_li_hist_new("ccid3");
-	if (ccid3_li_hist == NULL)
-		goto out_free_tx;
-
-	rc = ccid_register(&ccid3);
-	if (rc != 0) 
-		goto out_free_loss_interval_history;
-out:
-	return rc;
-
-out_free_loss_interval_history:
-	dccp_li_hist_delete(ccid3_li_hist);
-	ccid3_li_hist = NULL;
-out_free_tx:
-	dccp_tx_hist_delete(ccid3_tx_hist);
-	ccid3_tx_hist = NULL;
-out_free_rx:
-	dccp_rx_hist_delete(ccid3_rx_hist);
-	ccid3_rx_hist = NULL;
-	goto out;
-}
-module_init(ccid3_module_init);
-
-static __exit void ccid3_module_exit(void)
-{
-#ifdef CONFIG_IP_DCCP_UNLOAD_HACK
-	/*
-	 * Hack to use while developing, so that we get rid of the control
-	 * sock, that is what keeps a refcount on dccp.ko -acme
-	 */
-	extern void dccp_ctl_sock_exit(void);
-
-	dccp_ctl_sock_exit();
-#endif
-	ccid_unregister(&ccid3);
-
-	if (ccid3_tx_hist != NULL) {
-		dccp_tx_hist_delete(ccid3_tx_hist);
-		ccid3_tx_hist = NULL;
-	}
-	if (ccid3_rx_hist != NULL) {
-		dccp_rx_hist_delete(ccid3_rx_hist);
-		ccid3_rx_hist = NULL;
-	}
-	if (ccid3_li_hist != NULL) {
-		dccp_li_hist_delete(ccid3_li_hist);
-		ccid3_li_hist = NULL;
-	}
-}
-module_exit(ccid3_module_exit);
-
-MODULE_AUTHOR("Ian McDonald <iam4@cs.waikato.ac.nz>, "
-	      "Arnaldo Carvalho de Melo <acme@ghostprotocols.net>");
-MODULE_DESCRIPTION("DCCP TFRC CCID3 CCID");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("net-dccp-ccid-3");
diff --git a/trunk/net/dccp/ccids/ccid3.h b/trunk/net/dccp/ccids/ccid3.h
deleted file mode 100644
index ee8cbace6630..000000000000
--- a/trunk/net/dccp/ccids/ccid3.h
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- *  net/dccp/ccids/ccid3.h
- *
- *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *
- *  An implementation of the DCCP protocol
- *
- *  This code has been developed by the University of Waikato WAND
- *  research group. For further information please see http://www.wand.net.nz/
- *  or e-mail Ian McDonald - iam4@cs.waikato.ac.nz
- *
- *  This code also uses code from Lulea University, rereleased as GPL by its
- *  authors:
- *  Copyright (c) 2003 Nils-Erik Mattsson, Joacim Haggmark, Magnus Erixzon
- *
- *  Changes to meet Linux coding standards, to make it meet latest ccid3 draft
- *  and to make it work as a loadable module in the DCCP stack written by
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>.
- *
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-#ifndef _DCCP_CCID3_H_
-#define _DCCP_CCID3_H_
-
-#include <linux/config.h>
-#include <linux/list.h>
-#include <linux/time.h>
-#include <linux/types.h>
-
-#define TFRC_MIN_PACKET_SIZE	   16
-#define TFRC_STD_PACKET_SIZE	  256
-#define TFRC_MAX_PACKET_SIZE	65535
-
-/* Two seconds as per CCID3 spec */
-#define TFRC_INITIAL_TIMEOUT	   (2 * USEC_PER_SEC)
-
-/* In usecs - half the scheduling granularity as per RFC3448 4.6 */
-#define TFRC_OPSYS_HALF_TIME_GRAN  (USEC_PER_SEC / (2 * HZ))
-
-/* In seconds */
-#define TFRC_MAX_BACK_OFF_TIME	   64
-
-#define TFRC_SMALLEST_P		   40
-
-enum ccid3_options {
-	TFRC_OPT_LOSS_EVENT_RATE = 192,
-	TFRC_OPT_LOSS_INTERVALS	 = 193,
-	TFRC_OPT_RECEIVE_RATE	 = 194,
-};
-
-struct ccid3_options_received {
-	u64 ccid3or_seqno:48,
-	    ccid3or_loss_intervals_idx:16;
-	u16 ccid3or_loss_intervals_len;
-	u32 ccid3or_loss_event_rate;
-	u32 ccid3or_receive_rate;
-};
-
-/** struct ccid3_hc_tx_sock - CCID3 sender half connection sock
- *
-  * @ccid3hctx_state - Sender state
-  * @ccid3hctx_x - Current sending rate
-  * @ccid3hctx_x_recv - Receive rate
-  * @ccid3hctx_x_calc - Calculated send (?) rate
-  * @ccid3hctx_s - Packet size
-  * @ccid3hctx_rtt - Estimate of current round trip time in usecs
-  * @@ccid3hctx_p - Current loss event rate (0-1) scaled by 1000000
-  * @ccid3hctx_last_win_count - Last window counter sent
-  * @ccid3hctx_t_last_win_count - Timestamp of earliest packet
-  * 				  with last_win_count value sent
-  * @ccid3hctx_no_feedback_timer - Handle to no feedback timer
-  * @ccid3hctx_idle - FIXME
-  * @ccid3hctx_t_ld - Time last doubled during slow start
-  * @ccid3hctx_t_nom - Nominal send time of next packet
-  * @ccid3hctx_t_ipi - Interpacket (send) interval
-  * @ccid3hctx_delta - Send timer delta
-  * @ccid3hctx_hist - Packet history
-  */
-struct ccid3_hc_tx_sock {
-	u32				ccid3hctx_x;
-	u32				ccid3hctx_x_recv;
-	u32				ccid3hctx_x_calc;
-	u16				ccid3hctx_s;
-	u32				ccid3hctx_rtt;
-	u32				ccid3hctx_p;
-  	u8				ccid3hctx_state;
-	u8				ccid3hctx_last_win_count;
-	u8				ccid3hctx_idle;
-	struct timeval			ccid3hctx_t_last_win_count;
-	struct timer_list		ccid3hctx_no_feedback_timer;
-	struct timeval			ccid3hctx_t_ld;
-	struct timeval			ccid3hctx_t_nom;
-	u32				ccid3hctx_t_rto;
-	u32				ccid3hctx_t_ipi;
-	u32				ccid3hctx_delta;
-	struct list_head		ccid3hctx_hist;
-	struct ccid3_options_received	ccid3hctx_options_received;
-};
-
-struct ccid3_hc_rx_sock {
-  	u64			ccid3hcrx_seqno_last_counter:48,
-				ccid3hcrx_state:8,
-				ccid3hcrx_last_counter:4;
-	unsigned long		ccid3hcrx_rtt;
-  	u32			ccid3hcrx_p;
-  	u32			ccid3hcrx_bytes_recv;
-  	struct timeval		ccid3hcrx_tstamp_last_feedback;
-  	struct timeval		ccid3hcrx_tstamp_last_ack;
-	struct list_head	ccid3hcrx_hist;
-	struct list_head	ccid3hcrx_li_hist;
-  	u16			ccid3hcrx_s;
-  	u32			ccid3hcrx_pinv;
-  	u32			ccid3hcrx_elapsed_time;
-  	u32			ccid3hcrx_x_recv;
-};
-
-#define ccid3_hc_tx_field(s,field) (s->dccps_hc_tx_ccid_private == NULL ? 0 : \
-    ((struct ccid3_hc_tx_sock *)s->dccps_hc_tx_ccid_private)->ccid3hctx_##field)
-
-#define ccid3_hc_rx_field(s,field) (s->dccps_hc_rx_ccid_private == NULL ? 0 : \
-    ((struct ccid3_hc_rx_sock *)s->dccps_hc_rx_ccid_private)->ccid3hcrx_##field)
-
-#endif /* _DCCP_CCID3_H_ */
diff --git a/trunk/net/dccp/ccids/lib/Makefile b/trunk/net/dccp/ccids/lib/Makefile
deleted file mode 100644
index 5f940a6cbaca..000000000000
--- a/trunk/net/dccp/ccids/lib/Makefile
+++ /dev/null
@@ -1,3 +0,0 @@
-obj-$(CONFIG_IP_DCCP_TFRC_LIB) += dccp_tfrc_lib.o
-
-dccp_tfrc_lib-y := loss_interval.o packet_history.o tfrc_equation.o
diff --git a/trunk/net/dccp/ccids/lib/loss_interval.c b/trunk/net/dccp/ccids/lib/loss_interval.c
deleted file mode 100644
index 4c01a54143ad..000000000000
--- a/trunk/net/dccp/ccids/lib/loss_interval.c
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- *  net/dccp/ccids/lib/loss_interval.c
- *
- *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-
-#include "loss_interval.h"
-
-struct dccp_li_hist *dccp_li_hist_new(const char *name)
-{
-	struct dccp_li_hist *hist = kmalloc(sizeof(*hist), GFP_ATOMIC);
-	static const char dccp_li_hist_mask[] = "li_hist_%s";
-	char *slab_name;
-
-	if (hist == NULL)
-		goto out;
-
-	slab_name = kmalloc(strlen(name) + sizeof(dccp_li_hist_mask) - 1,
-			    GFP_ATOMIC);
-	if (slab_name == NULL)
-		goto out_free_hist;
-
-	sprintf(slab_name, dccp_li_hist_mask, name);
-	hist->dccplih_slab = kmem_cache_create(slab_name,
-					     sizeof(struct dccp_li_hist_entry),
-					       0, SLAB_HWCACHE_ALIGN,
-					       NULL, NULL);
-	if (hist->dccplih_slab == NULL)
-		goto out_free_slab_name;
-out:
-	return hist;
-out_free_slab_name:
-	kfree(slab_name);
-out_free_hist:
-	kfree(hist);
-	hist = NULL;
-	goto out;
-}
-
-EXPORT_SYMBOL_GPL(dccp_li_hist_new);
-
-void dccp_li_hist_delete(struct dccp_li_hist *hist)
-{
-	const char* name = kmem_cache_name(hist->dccplih_slab);
-
-	kmem_cache_destroy(hist->dccplih_slab);
-	kfree(name);
-	kfree(hist);
-}
-
-EXPORT_SYMBOL_GPL(dccp_li_hist_delete);
-
-void dccp_li_hist_purge(struct dccp_li_hist *hist, struct list_head *list)
-{
-	struct dccp_li_hist_entry *entry, *next;
-
-	list_for_each_entry_safe(entry, next, list, dccplih_node) {
-		list_del_init(&entry->dccplih_node);
-		kmem_cache_free(hist->dccplih_slab, entry);
-	}
-}
-
-EXPORT_SYMBOL_GPL(dccp_li_hist_purge);
-
-/* Weights used to calculate loss event rate */
-/*
- * These are integers as per section 8 of RFC3448. We can then divide by 4 *
- * when we use it.
- */
-static const int dccp_li_hist_w[DCCP_LI_HIST_IVAL_F_LENGTH] = {
-	4, 4, 4, 4, 3, 2, 1, 1,
-};
-
-u32 dccp_li_hist_calc_i_mean(struct list_head *list)
-{
-	struct dccp_li_hist_entry *li_entry, *li_next;
-	int i = 0;
-	u32 i_tot;
-	u32 i_tot0 = 0;
-	u32 i_tot1 = 0;
-	u32 w_tot  = 0;
-
-	list_for_each_entry_safe(li_entry, li_next, list, dccplih_node) {
-		if (i < DCCP_LI_HIST_IVAL_F_LENGTH) {
-			i_tot0 += li_entry->dccplih_interval * dccp_li_hist_w[i];
-			w_tot  += dccp_li_hist_w[i];
-		}
-
-		if (i != 0)
-			i_tot1 += li_entry->dccplih_interval * dccp_li_hist_w[i - 1];
-
-		if (++i > DCCP_LI_HIST_IVAL_F_LENGTH)
-			break;
-	}
-
-	if (i != DCCP_LI_HIST_IVAL_F_LENGTH)
-		return 0;
-
-	i_tot = max(i_tot0, i_tot1);
-
-	/* FIXME: Why do we do this? -Ian McDonald */
-	if (i_tot * 4 < w_tot)
-		i_tot = w_tot * 4;
-
-	return i_tot * 4 / w_tot;
-}
-
-EXPORT_SYMBOL_GPL(dccp_li_hist_calc_i_mean);
-
-struct dccp_li_hist_entry *dccp_li_hist_interval_new(struct dccp_li_hist *hist,
-						     struct list_head *list,
-						     const u64 seq_loss,
-						     const u8 win_loss)
-{
-	struct dccp_li_hist_entry *tail = NULL, *entry;
-	int i;
-
-	for (i = 0; i <= DCCP_LI_HIST_IVAL_F_LENGTH; ++i) {
-		entry = dccp_li_hist_entry_new(hist, SLAB_ATOMIC);
-		if (entry == NULL) {
-			dccp_li_hist_purge(hist, list);
-			return NULL;
-		}
-		if (tail == NULL)
-			tail = entry;
-		list_add(&entry->dccplih_node, list);
-	}
-
-	entry->dccplih_seqno     = seq_loss;
-	entry->dccplih_win_count = win_loss;
-	return tail;
-}
-
-EXPORT_SYMBOL_GPL(dccp_li_hist_interval_new);
diff --git a/trunk/net/dccp/ccids/lib/loss_interval.h b/trunk/net/dccp/ccids/lib/loss_interval.h
deleted file mode 100644
index 13ad47ba1420..000000000000
--- a/trunk/net/dccp/ccids/lib/loss_interval.h
+++ /dev/null
@@ -1,61 +0,0 @@
-#ifndef _DCCP_LI_HIST_
-#define _DCCP_LI_HIST_
-/*
- *  net/dccp/ccids/lib/loss_interval.h
- *
- *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *  This program is free software; you can redistribute it and/or modify it
- *  under the terms of the GNU General Public License as published by the Free
- *  Software Foundation; either version 2 of the License, or (at your option)
- *  any later version.
- */
-
-#include <linux/config.h>
-#include <linux/list.h>
-#include <linux/slab.h>
-#include <linux/time.h>
-
-#define DCCP_LI_HIST_IVAL_F_LENGTH  8
-
-struct dccp_li_hist {
-	kmem_cache_t *dccplih_slab;
-};
-
-extern struct dccp_li_hist *dccp_li_hist_new(const char *name);
-extern void dccp_li_hist_delete(struct dccp_li_hist *hist);
-
-struct dccp_li_hist_entry {
-	struct list_head dccplih_node;
-	u64		 dccplih_seqno:48,
-			 dccplih_win_count:4;
-	u32		 dccplih_interval;
-};
-
-static inline struct dccp_li_hist_entry *
-		dccp_li_hist_entry_new(struct dccp_li_hist *hist,
-				       const unsigned int __nocast prio)
-{
-	return kmem_cache_alloc(hist->dccplih_slab, prio);
-}
-
-static inline void dccp_li_hist_entry_delete(struct dccp_li_hist *hist,
-					     struct dccp_li_hist_entry *entry)
-{
-	if (entry != NULL)
-		kmem_cache_free(hist->dccplih_slab, entry);
-}
-
-extern void dccp_li_hist_purge(struct dccp_li_hist *hist,
-			       struct list_head *list);
-
-extern u32 dccp_li_hist_calc_i_mean(struct list_head *list);
-
-extern struct dccp_li_hist_entry *
-			dccp_li_hist_interval_new(struct dccp_li_hist *hist,
-						  struct list_head *list,
-						  const u64 seq_loss,
-						  const u8 win_loss);
-#endif /* _DCCP_LI_HIST_ */
diff --git a/trunk/net/dccp/ccids/lib/packet_history.c b/trunk/net/dccp/ccids/lib/packet_history.c
deleted file mode 100644
index d3f9d2053830..000000000000
--- a/trunk/net/dccp/ccids/lib/packet_history.c
+++ /dev/null
@@ -1,398 +0,0 @@
-/*
- *  net/dccp/packet_history.h
- *
- *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *
- *  An implementation of the DCCP protocol
- *
- *  This code has been developed by the University of Waikato WAND
- *  research group. For further information please see http://www.wand.net.nz/
- *  or e-mail Ian McDonald - iam4@cs.waikato.ac.nz
- *
- *  This code also uses code from Lulea University, rereleased as GPL by its
- *  authors:
- *  Copyright (c) 2003 Nils-Erik Mattsson, Joacim Haggmark, Magnus Erixzon
- *
- *  Changes to meet Linux coding standards, to make it meet latest ccid3 draft
- *  and to make it work as a loadable module in the DCCP stack written by
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>.
- *
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/string.h>
-
-#include "packet_history.h"
-
-struct dccp_rx_hist *dccp_rx_hist_new(const char *name)
-{
-	struct dccp_rx_hist *hist = kmalloc(sizeof(*hist), GFP_ATOMIC);
-	static const char dccp_rx_hist_mask[] = "rx_hist_%s";
-	char *slab_name;
-
-	if (hist == NULL)
-		goto out;
-
-	slab_name = kmalloc(strlen(name) + sizeof(dccp_rx_hist_mask) - 1,
-			    GFP_ATOMIC);
-	if (slab_name == NULL)
-		goto out_free_hist;
-
-	sprintf(slab_name, dccp_rx_hist_mask, name);
-	hist->dccprxh_slab = kmem_cache_create(slab_name,
-					     sizeof(struct dccp_rx_hist_entry),
-					       0, SLAB_HWCACHE_ALIGN,
-					       NULL, NULL);
-	if (hist->dccprxh_slab == NULL)
-		goto out_free_slab_name;
-out:
-	return hist;
-out_free_slab_name:
-	kfree(slab_name);
-out_free_hist:
-	kfree(hist);
-	hist = NULL;
-	goto out;
-}
-
-EXPORT_SYMBOL_GPL(dccp_rx_hist_new);
-
-void dccp_rx_hist_delete(struct dccp_rx_hist *hist)
-{
-	const char* name = kmem_cache_name(hist->dccprxh_slab);
-
-	kmem_cache_destroy(hist->dccprxh_slab);
-	kfree(name);
-	kfree(hist);
-}
-
-EXPORT_SYMBOL_GPL(dccp_rx_hist_delete);
-
-void dccp_rx_hist_purge(struct dccp_rx_hist *hist, struct list_head *list)
-{
-	struct dccp_rx_hist_entry *entry, *next;
-
-	list_for_each_entry_safe(entry, next, list, dccphrx_node) {
-		list_del_init(&entry->dccphrx_node);
-		kmem_cache_free(hist->dccprxh_slab, entry);
-	}
-}
-
-EXPORT_SYMBOL_GPL(dccp_rx_hist_purge);
-
-struct dccp_rx_hist_entry *
-		dccp_rx_hist_find_data_packet(const struct list_head *list)
-{
-	struct dccp_rx_hist_entry *entry, *packet = NULL;
-
-	list_for_each_entry(entry, list, dccphrx_node)
-		if (entry->dccphrx_type == DCCP_PKT_DATA ||
-		    entry->dccphrx_type == DCCP_PKT_DATAACK) {
-			packet = entry;
-			break;
-		}
-
-	return packet;
-}
-
-EXPORT_SYMBOL_GPL(dccp_rx_hist_find_data_packet);
-
-int dccp_rx_hist_add_packet(struct dccp_rx_hist *hist,
-			    struct list_head *rx_list,
-			    struct list_head *li_list,
-			    struct dccp_rx_hist_entry *packet)
-{
-	struct dccp_rx_hist_entry *entry, *next, *iter;
-	u8 num_later = 0;
-
-	iter = dccp_rx_hist_head(rx_list);
-	if (iter == NULL)
-		dccp_rx_hist_add_entry(rx_list, packet);
-	else {
-		const u64 seqno = packet->dccphrx_seqno;
-
-		if (after48(seqno, iter->dccphrx_seqno))
-			dccp_rx_hist_add_entry(rx_list, packet);
-		else {
-			if (dccp_rx_hist_entry_data_packet(iter))
-				num_later = 1;
-
-			list_for_each_entry_continue(iter, rx_list,
-						     dccphrx_node) {
-				if (after48(seqno, iter->dccphrx_seqno)) {
-					dccp_rx_hist_add_entry(&iter->dccphrx_node,
-							       packet);
-					goto trim_history;
-				}
-
-				if (dccp_rx_hist_entry_data_packet(iter))
-					num_later++;
-
-				if (num_later == TFRC_RECV_NUM_LATE_LOSS) {
-					dccp_rx_hist_entry_delete(hist, packet);
-					return 1;
-				}
-			}
-
-			if (num_later < TFRC_RECV_NUM_LATE_LOSS)
-				dccp_rx_hist_add_entry(rx_list, packet);
-			/*
-			 * FIXME: else what? should we destroy the packet
-			 * like above?
-			 */
-		}
-	}
-
-trim_history:
-	/*
-	 * Trim history (remove all packets after the NUM_LATE_LOSS + 1
-	 * data packets)
-	 */
-	num_later = TFRC_RECV_NUM_LATE_LOSS + 1;
-
-	if (!list_empty(li_list)) {
-		list_for_each_entry_safe(entry, next, rx_list, dccphrx_node) {
-			if (num_later == 0) {
-				list_del_init(&entry->dccphrx_node);
-				dccp_rx_hist_entry_delete(hist, entry);
-			} else if (dccp_rx_hist_entry_data_packet(entry))
-				--num_later;
-		}
-	} else {
-		int step = 0;
-		u8 win_count = 0; /* Not needed, but lets shut up gcc */
-		int tmp;
-		/*
-		 * We have no loss interval history so we need at least one
-		 * rtt:s of data packets to approximate rtt.
-		 */
-		list_for_each_entry_safe(entry, next, rx_list, dccphrx_node) {
-			if (num_later == 0) {
-				switch (step) {
-				case 0:
-					step = 1;
-					/* OK, find next data packet */
-					num_later = 1;
-					break;
-				case 1:
-					step = 2;
-					/* OK, find next data packet */
-					num_later = 1;
-					win_count = entry->dccphrx_ccval;
-					break;
-				case 2:
-					tmp = win_count - entry->dccphrx_ccval;
-					if (tmp < 0)
-						tmp += TFRC_WIN_COUNT_LIMIT;
-					if (tmp > TFRC_WIN_COUNT_PER_RTT + 1) {
-						/*
-						 * We have found a packet older
-						 * than one rtt remove the rest
-						 */
-						step = 3;
-					} else /* OK, find next data packet */
-						num_later = 1;
-					break;
-				case 3:
-					list_del_init(&entry->dccphrx_node);
-					dccp_rx_hist_entry_delete(hist, entry);
-					break;
-				}
-			} else if (dccp_rx_hist_entry_data_packet(entry))
-				--num_later;
-		}
-	}
-
-	return 0;
-}
-
-EXPORT_SYMBOL_GPL(dccp_rx_hist_add_packet);
-
-u64 dccp_rx_hist_detect_loss(struct list_head *rx_list,
-			     struct list_head *li_list, u8 *win_loss)
-{
-	struct dccp_rx_hist_entry *entry, *next, *packet;
-	struct dccp_rx_hist_entry *a_loss = NULL;
-	struct dccp_rx_hist_entry *b_loss = NULL;
-	u64 seq_loss = DCCP_MAX_SEQNO + 1;
-	u8 num_later = TFRC_RECV_NUM_LATE_LOSS;
-
-	list_for_each_entry_safe(entry, next, rx_list, dccphrx_node) {
-		if (num_later == 0) {
-			b_loss = entry;
-			break;
-		} else if (dccp_rx_hist_entry_data_packet(entry))
-			--num_later;
-	}
-
-	if (b_loss == NULL)
-		goto out;
-
-	num_later = 1;
-	list_for_each_entry_safe_continue(entry, next, rx_list, dccphrx_node) {
-		if (num_later == 0) {
-			a_loss = entry;
-			break;
-		} else if (dccp_rx_hist_entry_data_packet(entry))
-			--num_later;
-	}
-
-	if (a_loss == NULL) {
-		if (list_empty(li_list)) {
-			/* no loss event have occured yet */
-			LIMIT_NETDEBUG("%s: TODO: find a lost data packet by "
-				       "comparing to initial seqno\n",
-				       __FUNCTION__);
-			goto out;
-		} else {
-			LIMIT_NETDEBUG("%s: Less than 4 data pkts in history!",
-				       __FUNCTION__);
-			goto out;
-		}
-	}
-
-	/* Locate a lost data packet */
-	entry = packet = b_loss;
-	list_for_each_entry_safe_continue(entry, next, rx_list, dccphrx_node) {
-		u64 delta = dccp_delta_seqno(entry->dccphrx_seqno,
-					     packet->dccphrx_seqno);
-
-		if (delta != 0) {
-			if (dccp_rx_hist_entry_data_packet(packet))
-				--delta;
-			/*
-			 * FIXME: check this, probably this % usage is because
-			 * in earlier drafts the ndp count was just 8 bits
-			 * long, but now it cam be up to 24 bits long.
-			 */
-#if 0
-			if (delta % DCCP_NDP_LIMIT !=
-			    (packet->dccphrx_ndp -
-			     entry->dccphrx_ndp) % DCCP_NDP_LIMIT)
-#endif
-			if (delta != packet->dccphrx_ndp - entry->dccphrx_ndp) {
-				seq_loss = entry->dccphrx_seqno;
-				dccp_inc_seqno(&seq_loss);
-			}
-		}
-		packet = entry;
-		if (packet == a_loss)
-			break;
-	}
-out:
-	if (seq_loss != DCCP_MAX_SEQNO + 1)
-		*win_loss = a_loss->dccphrx_ccval;
-	else
-		*win_loss = 0; /* Paranoia */
-
-	return seq_loss;
-}
-
-EXPORT_SYMBOL_GPL(dccp_rx_hist_detect_loss);
-
-struct dccp_tx_hist *dccp_tx_hist_new(const char *name)
-{
-	struct dccp_tx_hist *hist = kmalloc(sizeof(*hist), GFP_ATOMIC);
-	static const char dccp_tx_hist_mask[] = "tx_hist_%s";
-	char *slab_name;
-
-	if (hist == NULL)
-		goto out;
-
-	slab_name = kmalloc(strlen(name) + sizeof(dccp_tx_hist_mask) - 1,
-			    GFP_ATOMIC);
-	if (slab_name == NULL)
-		goto out_free_hist;
-
-	sprintf(slab_name, dccp_tx_hist_mask, name);
-	hist->dccptxh_slab = kmem_cache_create(slab_name,
-					     sizeof(struct dccp_tx_hist_entry),
-					       0, SLAB_HWCACHE_ALIGN,
-					       NULL, NULL);
-	if (hist->dccptxh_slab == NULL)
-		goto out_free_slab_name;
-out:
-	return hist;
-out_free_slab_name:
-	kfree(slab_name);
-out_free_hist:
-	kfree(hist);
-	hist = NULL;
-	goto out;
-}
-
-EXPORT_SYMBOL_GPL(dccp_tx_hist_new);
-
-void dccp_tx_hist_delete(struct dccp_tx_hist *hist)
-{
-	const char* name = kmem_cache_name(hist->dccptxh_slab);
-
-	kmem_cache_destroy(hist->dccptxh_slab);
-	kfree(name);
-	kfree(hist);
-}
-
-EXPORT_SYMBOL_GPL(dccp_tx_hist_delete);
-
-struct dccp_tx_hist_entry *
-	dccp_tx_hist_find_entry(const struct list_head *list, const u64 seq)
-{
-	struct dccp_tx_hist_entry *packet = NULL, *entry;
-
-	list_for_each_entry(entry, list, dccphtx_node)
-		if (entry->dccphtx_seqno == seq) {
-			packet = entry;
-			break;
-		}
-
-	return packet;
-}
-
-EXPORT_SYMBOL_GPL(dccp_tx_hist_find_entry);
-
-void dccp_tx_hist_purge_older(struct dccp_tx_hist *hist,
-			      struct list_head *list,
-			      struct dccp_tx_hist_entry *packet)
-{
-	struct dccp_tx_hist_entry *next;
-
-	list_for_each_entry_safe_continue(packet, next, list, dccphtx_node) {
-		list_del_init(&packet->dccphtx_node);
-		dccp_tx_hist_entry_delete(hist, packet);
-	}
-}
-
-EXPORT_SYMBOL_GPL(dccp_tx_hist_purge_older);
-
-void dccp_tx_hist_purge(struct dccp_tx_hist *hist, struct list_head *list)
-{
-	struct dccp_tx_hist_entry *entry, *next;
-
-	list_for_each_entry_safe(entry, next, list, dccphtx_node) {
-		list_del_init(&entry->dccphtx_node);
-		dccp_tx_hist_entry_delete(hist, entry);
-	}
-}
-
-EXPORT_SYMBOL_GPL(dccp_tx_hist_purge);
-
-MODULE_AUTHOR("Ian McDonald <iam4@cs.waikato.ac.nz>, "
-	      "Arnaldo Carvalho de Melo <acme@ghostprotocols.net>");
-MODULE_DESCRIPTION("DCCP TFRC library");
-MODULE_LICENSE("GPL");
diff --git a/trunk/net/dccp/ccids/lib/packet_history.h b/trunk/net/dccp/ccids/lib/packet_history.h
deleted file mode 100644
index fb90a91aa93d..000000000000
--- a/trunk/net/dccp/ccids/lib/packet_history.h
+++ /dev/null
@@ -1,199 +0,0 @@
-/*
- *  net/dccp/packet_history.h
- *
- *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *
- *  An implementation of the DCCP protocol
- *
- *  This code has been developed by the University of Waikato WAND
- *  research group. For further information please see http://www.wand.net.nz/
- *  or e-mail Ian McDonald - iam4@cs.waikato.ac.nz
- *
- *  This code also uses code from Lulea University, rereleased as GPL by its
- *  authors:
- *  Copyright (c) 2003 Nils-Erik Mattsson, Joacim Haggmark, Magnus Erixzon
- *
- *  Changes to meet Linux coding standards, to make it meet latest ccid3 draft
- *  and to make it work as a loadable module in the DCCP stack written by
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>.
- *
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#ifndef _DCCP_PKT_HIST_
-#define _DCCP_PKT_HIST_
-
-#include <linux/config.h>
-#include <linux/list.h>
-#include <linux/slab.h>
-#include <linux/time.h>
-
-#include "../../dccp.h"
-
-/* Number of later packets received before one is considered lost */
-#define TFRC_RECV_NUM_LATE_LOSS	 3
-
-#define TFRC_WIN_COUNT_PER_RTT	 4
-#define TFRC_WIN_COUNT_LIMIT	16
-
-struct dccp_tx_hist_entry {
-	struct list_head dccphtx_node;
-	u64		 dccphtx_seqno:48,
-			 dccphtx_ccval:4,
-			 dccphtx_sent:1;
-	u32		 dccphtx_rtt;
-	struct timeval	 dccphtx_tstamp;
-};
-
-struct dccp_rx_hist_entry {
-	struct list_head dccphrx_node;
-	u64		 dccphrx_seqno:48,
-			 dccphrx_ccval:4,
-			 dccphrx_type:4;
-	u32		 dccphrx_ndp; /* In fact it is from 8 to 24 bits */
-	struct timeval	 dccphrx_tstamp;
-};
-
-struct dccp_tx_hist {
-	kmem_cache_t *dccptxh_slab;
-};
-
-extern struct dccp_tx_hist *dccp_tx_hist_new(const char *name);
-extern void dccp_tx_hist_delete(struct dccp_tx_hist *hist);
-
-struct dccp_rx_hist {
-	kmem_cache_t *dccprxh_slab;
-};
-
-extern struct dccp_rx_hist *dccp_rx_hist_new(const char *name);
-extern void dccp_rx_hist_delete(struct dccp_rx_hist *hist);
-extern struct dccp_rx_hist_entry *
-		dccp_rx_hist_find_data_packet(const struct list_head *list);
-
-static inline struct dccp_tx_hist_entry *
-		dccp_tx_hist_entry_new(struct dccp_tx_hist *hist,
-				       const unsigned int __nocast prio)
-{
-	struct dccp_tx_hist_entry *entry = kmem_cache_alloc(hist->dccptxh_slab,
-							    prio);
-
-	if (entry != NULL)
-		entry->dccphtx_sent = 0;
-
-	return entry;
-}
-
-static inline void dccp_tx_hist_entry_delete(struct dccp_tx_hist *hist,
-					     struct dccp_tx_hist_entry *entry)
-{
-	if (entry != NULL)
-		kmem_cache_free(hist->dccptxh_slab, entry);
-}
-
-extern struct dccp_tx_hist_entry *
-			dccp_tx_hist_find_entry(const struct list_head *list,
-						const u64 seq);
-
-static inline void dccp_tx_hist_add_entry(struct list_head *list,
-					  struct dccp_tx_hist_entry *entry)
-{
-	list_add(&entry->dccphtx_node, list);
-}
-
-extern void dccp_tx_hist_purge_older(struct dccp_tx_hist *hist,
-				     struct list_head *list,
-				     struct dccp_tx_hist_entry *next);
-
-extern void dccp_tx_hist_purge(struct dccp_tx_hist *hist,
-			       struct list_head *list);
-
-static inline struct dccp_tx_hist_entry *
-		dccp_tx_hist_head(struct list_head *list)
-{
-	struct dccp_tx_hist_entry *head = NULL;
-
-	if (!list_empty(list))
-		head = list_entry(list->next, struct dccp_tx_hist_entry,
-				  dccphtx_node);
-	return head;
-}
-
-static inline struct dccp_rx_hist_entry *
-		     dccp_rx_hist_entry_new(struct dccp_rx_hist *hist,
-				     	    const u32 ndp, 
-					    const struct sk_buff *skb,
-					    const unsigned int __nocast prio)
-{
-	struct dccp_rx_hist_entry *entry = kmem_cache_alloc(hist->dccprxh_slab,
-							    prio);
-
-	if (entry != NULL) {
-		const struct dccp_hdr *dh = dccp_hdr(skb);
-
-		entry->dccphrx_seqno = DCCP_SKB_CB(skb)->dccpd_seq;
-		entry->dccphrx_ccval = dh->dccph_ccval;
-		entry->dccphrx_type  = dh->dccph_type;
-		entry->dccphrx_ndp   = ndp;
-		do_gettimeofday(&(entry->dccphrx_tstamp));
-	}
-
-	return entry;
-}
-
-static inline void dccp_rx_hist_entry_delete(struct dccp_rx_hist *hist,
-					     struct dccp_rx_hist_entry *entry)
-{
-	if (entry != NULL)
-		kmem_cache_free(hist->dccprxh_slab, entry);
-}
-
-extern void dccp_rx_hist_purge(struct dccp_rx_hist *hist,
-			       struct list_head *list);
-
-static inline void dccp_rx_hist_add_entry(struct list_head *list,
-					  struct dccp_rx_hist_entry *entry)
-{
-	list_add(&entry->dccphrx_node, list);
-}
-
-static inline struct dccp_rx_hist_entry *
-		dccp_rx_hist_head(struct list_head *list)
-{
-	struct dccp_rx_hist_entry *head = NULL;
-
-	if (!list_empty(list))
-		head = list_entry(list->next, struct dccp_rx_hist_entry,
-				  dccphrx_node);
-	return head;
-}
-
-static inline int
-	dccp_rx_hist_entry_data_packet(const struct dccp_rx_hist_entry *entry)
-{
-	return entry->dccphrx_type == DCCP_PKT_DATA ||
-	       entry->dccphrx_type == DCCP_PKT_DATAACK;
-}
-
-extern int dccp_rx_hist_add_packet(struct dccp_rx_hist *hist,
-				   struct list_head *rx_list,
-				   struct list_head *li_list,
-				   struct dccp_rx_hist_entry *packet);
-
-extern u64 dccp_rx_hist_detect_loss(struct list_head *rx_list,
-				    struct list_head *li_list, u8 *win_loss);
-
-#endif /* _DCCP_PKT_HIST_ */
diff --git a/trunk/net/dccp/ccids/lib/tfrc.h b/trunk/net/dccp/ccids/lib/tfrc.h
deleted file mode 100644
index 130c4c40cfe3..000000000000
--- a/trunk/net/dccp/ccids/lib/tfrc.h
+++ /dev/null
@@ -1,22 +0,0 @@
-#ifndef _TFRC_H_
-#define _TFRC_H_
-/*
- *  net/dccp/ccids/lib/tfrc.h
- *
- *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *  Copyright (c) 2003 Nils-Erik Mattsson, Joacim Haggmark, Magnus Erixzon
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- */
-
-#include <linux/types.h>
-
-extern u32 tfrc_calc_x(u16 s, u32 R, u32 p);
-extern u32 tfrc_calc_x_reverse_lookup(u32 fvalue);
-
-#endif /* _TFRC_H_ */
diff --git a/trunk/net/dccp/ccids/lib/tfrc_equation.c b/trunk/net/dccp/ccids/lib/tfrc_equation.c
deleted file mode 100644
index d2b5933b4510..000000000000
--- a/trunk/net/dccp/ccids/lib/tfrc_equation.c
+++ /dev/null
@@ -1,644 +0,0 @@
-/*
- *  net/dccp/ccids/lib/tfrc_equation.c
- *
- *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *  Copyright (c) 2003 Nils-Erik Mattsson, Joacim Haggmark, Magnus Erixzon
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-
-#include <asm/bug.h>
-#include <asm/div64.h>
-
-#include "tfrc.h"
-
-#define TFRC_CALC_X_ARRSIZE 500
-
-#define TFRC_CALC_X_SPLIT 50000
-/* equivalent to 0.05 */
-
-static const u32 tfrc_calc_x_lookup[TFRC_CALC_X_ARRSIZE][2] = {
-	{     37172,   8172 },
-	{     53499,  11567 },
-	{     66664,  14180 },
-	{     78298,  16388 },
-	{     89021,  18339 },
-	{     99147,  20108 },
-	{    108858,  21738 },
-	{    118273,  23260 },
-	{    127474,  24693 },
-	{    136520,  26052 },
-	{    145456,  27348 },
-	{    154316,  28589 },
-	{    163130,  29783 },
-	{    171919,  30935 },
-	{    180704,  32049 },
-	{    189502,  33130 },
-	{    198328,  34180 },
-	{    207194,  35202 },
-	{    216114,  36198 },
-	{    225097,  37172 },
-	{    234153,  38123 },
-	{    243294,  39055 },
-	{    252527,  39968 },
-	{    261861,  40864 },
-	{    271305,  41743 },
-	{    280866,  42607 },
-	{    290553,  43457 },
-	{    300372,  44293 },
-	{    310333,  45117 },
-	{    320441,  45929 },
-	{    330705,  46729 },
-	{    341131,  47518 },
-	{    351728,  48297 },
-	{    362501,  49066 },
-	{    373460,  49826 },
-	{    384609,  50577 },
-	{    395958,  51320 },
-	{    407513,  52054 },
-	{    419281,  52780 },
-	{    431270,  53499 },
-	{    443487,  54211 },
-	{    455940,  54916 },
-	{    468635,  55614 },
-	{    481581,  56306 },
-	{    494785,  56991 },
-	{    508254,  57671 },
-	{    521996,  58345 },
-	{    536019,  59014 },
-	{    550331,  59677 },
-	{    564939,  60335 },
-	{    579851,  60988 },
-	{    595075,  61636 },
-	{    610619,  62279 },
-	{    626491,  62918 },
-	{    642700,  63553 },
-	{    659253,  64183 },
-	{    676158,  64809 },
-	{    693424,  65431 },
-	{    711060,  66050 },
-	{    729073,  66664 },
-	{    747472,  67275 },
-	{    766266,  67882 },
-	{    785464,  68486 },
-	{    805073,  69087 },
-	{    825103,  69684 },
-	{    845562,  70278 },
-	{    866460,  70868 },
-	{    887805,  71456 },
-	{    909606,  72041 },
-	{    931873,  72623 },
-	{    954614,  73202 },
-	{    977839,  73778 },
-	{   1001557,  74352 },
-	{   1025777,  74923 },
-	{   1050508,  75492 },
-	{   1075761,  76058 },
-	{   1101544,  76621 },
-	{   1127867,  77183 },
-	{   1154739,  77741 },
-	{   1182172,  78298 },
-	{   1210173,  78852 },
-	{   1238753,  79405 },
-	{   1267922,  79955 },
-	{   1297689,  80503 },
-	{   1328066,  81049 },
-	{   1359060,  81593 },
-	{   1390684,  82135 },
-	{   1422947,  82675 },
-	{   1455859,  83213 },
-	{   1489430,  83750 },
-	{   1523671,  84284 },
-	{   1558593,  84817 },
-	{   1594205,  85348 },
-	{   1630518,  85878 },
-	{   1667543,  86406 },
-	{   1705290,  86932 },
-	{   1743770,  87457 },
-	{   1782994,  87980 },
-	{   1822973,  88501 },
-	{   1863717,  89021 },
-	{   1905237,  89540 },
-	{   1947545,  90057 },
-	{   1990650,  90573 },
-	{   2034566,  91087 },
-	{   2079301,  91600 },
-	{   2124869,  92111 },
-	{   2171279,  92622 },
-	{   2218543,  93131 },
-	{   2266673,  93639 },
-	{   2315680,  94145 },
-	{   2365575,  94650 },
-	{   2416371,  95154 },
-	{   2468077,  95657 },
-	{   2520707,  96159 },
-	{   2574271,  96660 },
-	{   2628782,  97159 },
-	{   2684250,  97658 },
-	{   2740689,  98155 },
-	{   2798110,  98651 },
-	{   2856524,  99147 },
-	{   2915944,  99641 },
-	{   2976382, 100134 },
-	{   3037850, 100626 },
-	{   3100360, 101117 },
-	{   3163924, 101608 },
-	{   3228554, 102097 },
-	{   3294263, 102586 },
-	{   3361063, 103073 },
-	{   3428966, 103560 },
-	{   3497984, 104045 },
-	{   3568131, 104530 },
-	{   3639419, 105014 },
-	{   3711860, 105498 },
-	{   3785467, 105980 },
-	{   3860253, 106462 },
-	{   3936229, 106942 },
-	{   4013410, 107422 },
-	{   4091808, 107902 },
-	{   4171435, 108380 },
-	{   4252306, 108858 },
-	{   4334431, 109335 },
-	{   4417825, 109811 },
-	{   4502501, 110287 },
-	{   4588472, 110762 },
-	{   4675750, 111236 },
-	{   4764349, 111709 },
-	{   4854283, 112182 },
-	{   4945564, 112654 },
-	{   5038206, 113126 },
-	{   5132223, 113597 },
-	{   5227627, 114067 },
-	{   5324432, 114537 },
-	{   5422652, 115006 },
-	{   5522299, 115474 },
-	{   5623389, 115942 },
-	{   5725934, 116409 },
-	{   5829948, 116876 },
-	{   5935446, 117342 },
-	{   6042439, 117808 },
-	{   6150943, 118273 },
-	{   6260972, 118738 },
-	{   6372538, 119202 },
-	{   6485657, 119665 },
-	{   6600342, 120128 },
-	{   6716607, 120591 },
-	{   6834467, 121053 },
-	{   6953935, 121514 },
-	{   7075025, 121976 },
-	{   7197752, 122436 },
-	{   7322131, 122896 },
-	{   7448175, 123356 },
-	{   7575898, 123815 },
-	{   7705316, 124274 },
-	{   7836442, 124733 },
-	{   7969291, 125191 },
-	{   8103877, 125648 },
-	{   8240216, 126105 },
-	{   8378321, 126562 },
-	{   8518208, 127018 },
-	{   8659890, 127474 },
-	{   8803384, 127930 },
-	{   8948702, 128385 },
-	{   9095861, 128840 },
-	{   9244875, 129294 },
-	{   9395760, 129748 },
-	{   9548529, 130202 },
-	{   9703198, 130655 },
-	{   9859782, 131108 },
-	{  10018296, 131561 },
-	{  10178755, 132014 },
-	{  10341174, 132466 },
-	{  10505569, 132917 },
-	{  10671954, 133369 },
-	{  10840345, 133820 },
-	{  11010757, 134271 },
-	{  11183206, 134721 },
-	{  11357706, 135171 },
-	{  11534274, 135621 },
-	{  11712924, 136071 },
-	{  11893673, 136520 },
-	{  12076536, 136969 },
-	{  12261527, 137418 },
-	{  12448664, 137867 },
-	{  12637961, 138315 },
-	{  12829435, 138763 },
-	{  13023101, 139211 },
-	{  13218974, 139658 },
-	{  13417071, 140106 },
-	{  13617407, 140553 },
-	{  13819999, 140999 },
-	{  14024862, 141446 },
-	{  14232012, 141892 },
-	{  14441465, 142339 },
-	{  14653238, 142785 },
-	{  14867346, 143230 },
-	{  15083805, 143676 },
-	{  15302632, 144121 },
-	{  15523842, 144566 },
-	{  15747453, 145011 },
-	{  15973479, 145456 },
-	{  16201939, 145900 },
-	{  16432847, 146345 },
-	{  16666221, 146789 },
-	{  16902076, 147233 },
-	{  17140429, 147677 },
-	{  17381297, 148121 },
-	{  17624696, 148564 },
-	{  17870643, 149007 },
-	{  18119154, 149451 },
-	{  18370247, 149894 },
-	{  18623936, 150336 },
-	{  18880241, 150779 },
-	{  19139176, 151222 },
-	{  19400759, 151664 },
-	{  19665007, 152107 },
-	{  19931936, 152549 },
-	{  20201564, 152991 },
-	{  20473907, 153433 },
-	{  20748982, 153875 },
-	{  21026807, 154316 },
-	{  21307399, 154758 },
-	{  21590773, 155199 },
-	{  21876949, 155641 },
-	{  22165941, 156082 },
-	{  22457769, 156523 },
-	{  22752449, 156964 },
-	{  23049999, 157405 },
-	{  23350435, 157846 },
-	{  23653774, 158287 },
-	{  23960036, 158727 },
-	{  24269236, 159168 },
-	{  24581392, 159608 },
-	{  24896521, 160049 },
-	{  25214642, 160489 },
-	{  25535772, 160929 },
-	{  25859927, 161370 },
-	{  26187127, 161810 },
-	{  26517388, 162250 },
-	{  26850728, 162690 },
-	{  27187165, 163130 },
-	{  27526716, 163569 },
-	{  27869400, 164009 },
-	{  28215234, 164449 },
-	{  28564236, 164889 },
-	{  28916423, 165328 },
-	{  29271815, 165768 },
-	{  29630428, 166208 },
-	{  29992281, 166647 },
-	{  30357392, 167087 },
-	{  30725779, 167526 },
-	{  31097459, 167965 },
-	{  31472452, 168405 },
-	{  31850774, 168844 },
-	{  32232445, 169283 },
-	{  32617482, 169723 },
-	{  33005904, 170162 },
-	{  33397730, 170601 },
-	{  33792976, 171041 },
-	{  34191663, 171480 },
-	{  34593807, 171919 },
-	{  34999428, 172358 },
-	{  35408544, 172797 },
-	{  35821174, 173237 },
-	{  36237335, 173676 },
-	{  36657047, 174115 },
-	{  37080329, 174554 },
-	{  37507197, 174993 },
-	{  37937673, 175433 },
-	{  38371773, 175872 },
-	{  38809517, 176311 },
-	{  39250924, 176750 },
-	{  39696012, 177190 },
-	{  40144800, 177629 },
-	{  40597308, 178068 },
-	{  41053553, 178507 },
-	{  41513554, 178947 },
-	{  41977332, 179386 },
-	{  42444904, 179825 },
-	{  42916290, 180265 },
-	{  43391509, 180704 },
-	{  43870579, 181144 },
-	{  44353520, 181583 },
-	{  44840352, 182023 },
-	{  45331092, 182462 },
-	{  45825761, 182902 },
-	{  46324378, 183342 },
-	{  46826961, 183781 },
-	{  47333531, 184221 },
-	{  47844106, 184661 },
-	{  48358706, 185101 },
-	{  48877350, 185541 },
-	{  49400058, 185981 },
-	{  49926849, 186421 },
-	{  50457743, 186861 },
-	{  50992759, 187301 },
-	{  51531916, 187741 },
-	{  52075235, 188181 },
-	{  52622735, 188622 },
-	{  53174435, 189062 },
-	{  53730355, 189502 },
-	{  54290515, 189943 },
-	{  54854935, 190383 },
-	{  55423634, 190824 },
-	{  55996633, 191265 },
-	{  56573950, 191706 },
-	{  57155606, 192146 },
-	{  57741621, 192587 },
-	{  58332014, 193028 },
-	{  58926806, 193470 },
-	{  59526017, 193911 },
-	{  60129666, 194352 },
-	{  60737774, 194793 },
-	{  61350361, 195235 },
-	{  61967446, 195677 },
-	{  62589050, 196118 },
-	{  63215194, 196560 },
-	{  63845897, 197002 },
-	{  64481179, 197444 },
-	{  65121061, 197886 },
-	{  65765563, 198328 },
-	{  66414705, 198770 },
-	{  67068508, 199213 },
-	{  67726992, 199655 },
-	{  68390177, 200098 },
-	{  69058085, 200540 },
-	{  69730735, 200983 },
-	{  70408147, 201426 },
-	{  71090343, 201869 },
-	{  71777343, 202312 },
-	{  72469168, 202755 },
-	{  73165837, 203199 },
-	{  73867373, 203642 },
-	{  74573795, 204086 },
-	{  75285124, 204529 },
-	{  76001380, 204973 },
-	{  76722586, 205417 },
-	{  77448761, 205861 },
-	{  78179926, 206306 },
-	{  78916102, 206750 },
-	{  79657310, 207194 },
-	{  80403571, 207639 },
-	{  81154906, 208084 },
-	{  81911335, 208529 },
-	{  82672880, 208974 },
-	{  83439562, 209419 },
-	{  84211402, 209864 },
-	{  84988421, 210309 },
-	{  85770640, 210755 },
-	{  86558080, 211201 },
-	{  87350762, 211647 },
-	{  88148708, 212093 },
-	{  88951938, 212539 },
-	{  89760475, 212985 },
-	{  90574339, 213432 },
-	{  91393551, 213878 },
-	{  92218133, 214325 },
-	{  93048107, 214772 },
-	{  93883493, 215219 },
-	{  94724314, 215666 },
-	{  95570590, 216114 },
-	{  96422343, 216561 },
-	{  97279594, 217009 },
-	{  98142366, 217457 },
-	{  99010679, 217905 },
-	{  99884556, 218353 },
-	{ 100764018, 218801 },
-	{ 101649086, 219250 },
-	{ 102539782, 219698 },
-	{ 103436128, 220147 },
-	{ 104338146, 220596 },
-	{ 105245857, 221046 },
-	{ 106159284, 221495 },
-	{ 107078448, 221945 },
-	{ 108003370, 222394 },
-	{ 108934074, 222844 },
-	{ 109870580, 223294 },
-	{ 110812910, 223745 },
-	{ 111761087, 224195 },
-	{ 112715133, 224646 },
-	{ 113675069, 225097 },
-	{ 114640918, 225548 },
-	{ 115612702, 225999 },
-	{ 116590442, 226450 },
-	{ 117574162, 226902 },
-	{ 118563882, 227353 },
-	{ 119559626, 227805 },
-	{ 120561415, 228258 },
-	{ 121569272, 228710 },
-	{ 122583219, 229162 },
-	{ 123603278, 229615 },
-	{ 124629471, 230068 },
-	{ 125661822, 230521 },
-	{ 126700352, 230974 },
-	{ 127745083, 231428 },
-	{ 128796039, 231882 },
-	{ 129853241, 232336 },
-	{ 130916713, 232790 },
-	{ 131986475, 233244 },
-	{ 133062553, 233699 },
-	{ 134144966, 234153 },
-	{ 135233739, 234608 },
-	{ 136328894, 235064 },
-	{ 137430453, 235519 },
-	{ 138538440, 235975 },
-	{ 139652876, 236430 },
-	{ 140773786, 236886 },
-	{ 141901190, 237343 },
-	{ 143035113, 237799 },
-	{ 144175576, 238256 },
-	{ 145322604, 238713 },
-	{ 146476218, 239170 },
-	{ 147636442, 239627 },
-	{ 148803298, 240085 },
-	{ 149976809, 240542 },
-	{ 151156999, 241000 },
-	{ 152343890, 241459 },
-	{ 153537506, 241917 },
-	{ 154737869, 242376 },
-	{ 155945002, 242835 },
-	{ 157158929, 243294 },
-	{ 158379673, 243753 },
-	{ 159607257, 244213 },
-	{ 160841704, 244673 },
-	{ 162083037, 245133 },
-	{ 163331279, 245593 },
-	{ 164586455, 246054 },
-	{ 165848586, 246514 },
-	{ 167117696, 246975 },
-	{ 168393810, 247437 },
-	{ 169676949, 247898 },
-	{ 170967138, 248360 },
-	{ 172264399, 248822 },
-	{ 173568757, 249284 },
-	{ 174880235, 249747 },
-	{ 176198856, 250209 },
-	{ 177524643, 250672 },
-	{ 178857621, 251136 },
-	{ 180197813, 251599 },
-	{ 181545242, 252063 },
-	{ 182899933, 252527 },
-	{ 184261908, 252991 },
-	{ 185631191, 253456 },
-	{ 187007807, 253920 },
-	{ 188391778, 254385 },
-	{ 189783129, 254851 },
-	{ 191181884, 255316 },
-	{ 192588065, 255782 },
-	{ 194001698, 256248 },
-	{ 195422805, 256714 },
-	{ 196851411, 257181 },
-	{ 198287540, 257648 },
-	{ 199731215, 258115 },
-	{ 201182461, 258582 },
-	{ 202641302, 259050 },
-	{ 204107760, 259518 },
-	{ 205581862, 259986 },
-	{ 207063630, 260454 },
-	{ 208553088, 260923 },
-	{ 210050262, 261392 },
-	{ 211555174, 261861 },
-	{ 213067849, 262331 },
-	{ 214588312, 262800 },
-	{ 216116586, 263270 },
-	{ 217652696, 263741 },
-	{ 219196666, 264211 },
-	{ 220748520, 264682 },
-	{ 222308282, 265153 },
-	{ 223875978, 265625 },
-	{ 225451630, 266097 },
-	{ 227035265, 266569 },
-	{ 228626905, 267041 },
-	{ 230226576, 267514 },
-	{ 231834302, 267986 },
-	{ 233450107, 268460 },
-	{ 235074016, 268933 },
-	{ 236706054, 269407 },
-	{ 238346244, 269881 },
-	{ 239994613, 270355 },
-	{ 241651183, 270830 },
-	{ 243315981, 271305 }
-};
-
-/* Calculate the send rate as per section 3.1 of RFC3448
- 
-Returns send rate in bytes per second
-
-Integer maths and lookups are used as not allowed floating point in kernel
-
-The function for Xcalc as per section 3.1 of RFC3448 is:
-
-X =                            s
-     -------------------------------------------------------------
-     R*sqrt(2*b*p/3) + (t_RTO * (3*sqrt(3*b*p/8) * p * (1+32*p^2)))
-
-where 
-X is the trasmit rate in bytes/second
-s is the packet size in bytes
-R is the round trip time in seconds
-p is the loss event rate, between 0 and 1.0, of the number of loss events 
-  as a fraction of the number of packets transmitted
-t_RTO is the TCP retransmission timeout value in seconds
-b is the number of packets acknowledged by a single TCP acknowledgement
-
-we can assume that b = 1 and t_RTO is 4 * R. With this the equation becomes:
-
-X =                            s
-     -----------------------------------------------------------------------
-     R * sqrt(2 * p / 3) + (12 * R * (sqrt(3 * p / 8) * p * (1 + 32 * p^2)))
-
-
-which we can break down into:
-
-X =     s
-     --------
-     R * f(p)
-
-where f(p) = sqrt(2 * p / 3) + (12 * sqrt(3 * p / 8) * p * (1 + 32 * p * p))
-
-Function parameters:
-s - bytes
-R - RTT in usecs
-p - loss rate (decimal fraction multiplied by 1,000,000)
-
-Returns Xcalc in bytes per second
-
-DON'T alter this code unless you run test cases against it as the code
-has been manipulated to stop underflow/overlow.
-
-*/
-u32 tfrc_calc_x(u16 s, u32 R, u32 p)
-{
-	int index;
-	u32 f;
-	u64 tmp1, tmp2;
-
-	if (p < TFRC_CALC_X_SPLIT)
-		index = (p / (TFRC_CALC_X_SPLIT / TFRC_CALC_X_ARRSIZE)) - 1;
-	else
-		index = (p / (1000000 / TFRC_CALC_X_ARRSIZE)) - 1;
-
-	if (index < 0)
-		/* p should be 0 unless there is a bug in my code */
-		index = 0;
-
-	if (R == 0)
-		R = 1; /* RTT can't be zero or else divide by zero */
-
-	BUG_ON(index >= TFRC_CALC_X_ARRSIZE);
-
-	if (p >= TFRC_CALC_X_SPLIT)
-		f = tfrc_calc_x_lookup[index][0];
-	else
-		f = tfrc_calc_x_lookup[index][1];
-
-	tmp1 = ((u64)s * 100000000);
-	tmp2 = ((u64)R * (u64)f);
-	do_div(tmp2, 10000);
-	do_div(tmp1, tmp2); 
-	/* Don't alter above math unless you test due to overflow on 32 bit */
-
-	return (u32)tmp1; 
-}
-
-EXPORT_SYMBOL_GPL(tfrc_calc_x);
-
-/*
- * args: fvalue - function value to match
- * returns: p closest to that value
- *
- * both fvalue and p are multiplied by 1,000,000 to use ints
- */
-u32 tfrc_calc_x_reverse_lookup(u32 fvalue)
-{
-	int ctr = 0;
-	int small;
-
-	if (fvalue < tfrc_calc_x_lookup[0][1])
-		return 0;
-
-	if (fvalue <= tfrc_calc_x_lookup[TFRC_CALC_X_ARRSIZE - 1][1])
-		small = 1;
-	else if (fvalue > tfrc_calc_x_lookup[TFRC_CALC_X_ARRSIZE - 1][0])
-		return 1000000;
-	else
-		small = 0;
-
-	while (fvalue > tfrc_calc_x_lookup[ctr][small])
-		ctr++;
-
-	if (small)
-		return TFRC_CALC_X_SPLIT * ctr / TFRC_CALC_X_ARRSIZE;
-	else
-		return 1000000 * ctr / TFRC_CALC_X_ARRSIZE;
-}
-
-EXPORT_SYMBOL_GPL(tfrc_calc_x_reverse_lookup);
diff --git a/trunk/net/dccp/dccp.h b/trunk/net/dccp/dccp.h
deleted file mode 100644
index 33456c0d5937..000000000000
--- a/trunk/net/dccp/dccp.h
+++ /dev/null
@@ -1,493 +0,0 @@
-#ifndef _DCCP_H
-#define _DCCP_H
-/*
- *  net/dccp/dccp.h
- *
- *  An implementation of the DCCP protocol
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
- *
- *	This program is free software; you can redistribute it and/or modify it
- *	under the terms of the GNU General Public License version 2 as
- *	published by the Free Software Foundation.
- */
-
-#include <linux/config.h>
-#include <linux/dccp.h>
-#include <net/snmp.h>
-#include <net/sock.h>
-#include <net/tcp.h>
-
-#ifdef CONFIG_IP_DCCP_DEBUG
-extern int dccp_debug;
-
-#define dccp_pr_debug(format, a...) \
-	do { if (dccp_debug) \
-		printk(KERN_DEBUG "%s: " format, __FUNCTION__ , ##a); \
-	} while (0)
-#define dccp_pr_debug_cat(format, a...) do { if (dccp_debug) \
-					     printk(format, ##a); } while (0)
-#else
-#define dccp_pr_debug(format, a...)
-#define dccp_pr_debug_cat(format, a...)
-#endif
-
-extern struct inet_hashinfo dccp_hashinfo;
-
-extern atomic_t dccp_orphan_count;
-extern int dccp_tw_count;
-extern void dccp_tw_deschedule(struct inet_timewait_sock *tw);
-
-extern void dccp_time_wait(struct sock *sk, int state, int timeo);
-
-/* FIXME: Right size this */
-#define DCCP_MAX_OPT_LEN 128
-
-#define DCCP_MAX_PACKET_HDR 32
-
-#define MAX_DCCP_HEADER  (DCCP_MAX_PACKET_HDR + DCCP_MAX_OPT_LEN + MAX_HEADER)
-
-#define DCCP_TIMEWAIT_LEN (60 * HZ) /* how long to wait to destroy TIME-WAIT
-				     * state, about 60 seconds */
-
-/* draft-ietf-dccp-spec-11.txt initial RTO value */
-#define DCCP_TIMEOUT_INIT ((unsigned)(3 * HZ))
-
-/* Maximal interval between probes for local resources.  */
-#define DCCP_RESOURCE_PROBE_INTERVAL ((unsigned)(HZ / 2U))
-
-#define DCCP_RTO_MAX ((unsigned)(120 * HZ)) /* FIXME: using TCP value */
-
-extern struct proto dccp_v4_prot;
-
-/* is seq1 < seq2 ? */
-static inline int before48(const u64 seq1, const u64 seq2)
-{
-	return (s64)((seq1 << 16) - (seq2 << 16)) < 0;
-}
-
-/* is seq1 > seq2 ? */
-static inline int after48(const u64 seq1, const u64 seq2)
-{
-	return (s64)((seq2 << 16) - (seq1 << 16)) < 0;
-}
-
-/* is seq2 <= seq1 <= seq3 ? */
-static inline int between48(const u64 seq1, const u64 seq2, const u64 seq3)
-{
-	return (seq3 << 16) - (seq2 << 16) >= (seq1 << 16) - (seq2 << 16);
-}
-
-static inline u64 max48(const u64 seq1, const u64 seq2)
-{
-	return after48(seq1, seq2) ? seq1 : seq2;
-}
-
-enum {
-	DCCP_MIB_NUM = 0,
-	DCCP_MIB_ACTIVEOPENS,			/* ActiveOpens */
-	DCCP_MIB_ESTABRESETS,			/* EstabResets */
-	DCCP_MIB_CURRESTAB,			/* CurrEstab */
-	DCCP_MIB_OUTSEGS,			/* OutSegs */ 
-	DCCP_MIB_OUTRSTS,
-	DCCP_MIB_ABORTONTIMEOUT,
-	DCCP_MIB_TIMEOUTS,
-	DCCP_MIB_ABORTFAILED,
-	DCCP_MIB_PASSIVEOPENS,
-	DCCP_MIB_ATTEMPTFAILS,
-	DCCP_MIB_OUTDATAGRAMS,
-	DCCP_MIB_INERRS,
-	DCCP_MIB_OPTMANDATORYERROR,
-	DCCP_MIB_INVALIDOPT,
-	__DCCP_MIB_MAX
-};
-
-#define DCCP_MIB_MAX	__DCCP_MIB_MAX
-struct dccp_mib {
-	unsigned long	mibs[DCCP_MIB_MAX];
-} __SNMP_MIB_ALIGN__;
-
-DECLARE_SNMP_STAT(struct dccp_mib, dccp_statistics);
-#define DCCP_INC_STATS(field)	    SNMP_INC_STATS(dccp_statistics, field)
-#define DCCP_INC_STATS_BH(field)    SNMP_INC_STATS_BH(dccp_statistics, field)
-#define DCCP_INC_STATS_USER(field)  SNMP_INC_STATS_USER(dccp_statistics, field)
-#define DCCP_DEC_STATS(field)	    SNMP_DEC_STATS(dccp_statistics, field)
-#define DCCP_ADD_STATS_BH(field, val) \
-			SNMP_ADD_STATS_BH(dccp_statistics, field, val)
-#define DCCP_ADD_STATS_USER(field, val)	\
-			SNMP_ADD_STATS_USER(dccp_statistics, field, val)
-
-extern int  dccp_transmit_skb(struct sock *sk, struct sk_buff *skb);
-extern int  dccp_retransmit_skb(struct sock *sk, struct sk_buff *skb);
-
-extern int dccp_send_response(struct sock *sk);
-extern void dccp_send_ack(struct sock *sk);
-extern void dccp_send_delayed_ack(struct sock *sk);
-extern void dccp_send_sync(struct sock *sk, const u64 seq,
-			   const enum dccp_pkt_type pkt_type);
-
-extern int dccp_write_xmit(struct sock *sk, struct sk_buff *skb, long *timeo);
-extern void dccp_write_space(struct sock *sk);
-
-extern void dccp_init_xmit_timers(struct sock *sk);
-static inline void dccp_clear_xmit_timers(struct sock *sk)
-{
-	inet_csk_clear_xmit_timers(sk);
-}
-
-extern unsigned int dccp_sync_mss(struct sock *sk, u32 pmtu);
-
-extern const char *dccp_packet_name(const int type);
-extern const char *dccp_state_name(const int state);
-
-static inline void dccp_set_state(struct sock *sk, const int state)
-{
-	const int oldstate = sk->sk_state;
-
-	dccp_pr_debug("%s(%p) %-10.10s -> %s\n",
-		      dccp_role(sk), sk,
-		      dccp_state_name(oldstate), dccp_state_name(state));
-	WARN_ON(state == oldstate);
-
-	switch (state) {
-	case DCCP_OPEN:
-		if (oldstate != DCCP_OPEN)
-			DCCP_INC_STATS(DCCP_MIB_CURRESTAB);
-		break;
-
-	case DCCP_CLOSED:
-		if (oldstate == DCCP_CLOSING || oldstate == DCCP_OPEN)
-			DCCP_INC_STATS(DCCP_MIB_ESTABRESETS);
-
-		sk->sk_prot->unhash(sk);
-		if (inet_csk(sk)->icsk_bind_hash != NULL &&
-		    !(sk->sk_userlocks & SOCK_BINDPORT_LOCK))
-			inet_put_port(&dccp_hashinfo, sk);
-		/* fall through */
-	default:
-		if (oldstate == DCCP_OPEN)
-			DCCP_DEC_STATS(DCCP_MIB_CURRESTAB);
-	}
-
-	/* Change state AFTER socket is unhashed to avoid closed
-	 * socket sitting in hash tables.
-	 */
-	sk->sk_state = state;
-}
-
-static inline void dccp_done(struct sock *sk)
-{
-	dccp_set_state(sk, DCCP_CLOSED);
-	dccp_clear_xmit_timers(sk);
-
-	sk->sk_shutdown = SHUTDOWN_MASK;
-
-	if (!sock_flag(sk, SOCK_DEAD))
-		sk->sk_state_change(sk);
-	else
-		inet_csk_destroy_sock(sk);
-}
-
-static inline void dccp_openreq_init(struct request_sock *req,
-				     struct dccp_sock *dp,
-				     struct sk_buff *skb)
-{
-	/*
-	 * FIXME: fill in the other req fields from the DCCP options
-	 * received
-	 */
-	inet_rsk(req)->rmt_port = dccp_hdr(skb)->dccph_sport;
-	inet_rsk(req)->acked	= 0;
-	req->rcv_wnd = 0;
-}
-
-extern int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb);
-
-extern struct sock *dccp_create_openreq_child(struct sock *sk,
-					      const struct request_sock *req,
-					      const struct sk_buff *skb);
-
-extern int dccp_v4_do_rcv(struct sock *sk, struct sk_buff *skb);
-
-extern void dccp_v4_err(struct sk_buff *skb, u32);
-
-extern int dccp_v4_rcv(struct sk_buff *skb);
-
-extern struct sock *dccp_v4_request_recv_sock(struct sock *sk,
-					      struct sk_buff *skb,
-					      struct request_sock *req,
-					      struct dst_entry *dst);
-extern struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
-				   struct request_sock *req,
-				   struct request_sock **prev);
-
-extern int dccp_child_process(struct sock *parent, struct sock *child,
-			      struct sk_buff *skb);
-extern int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
-				  struct dccp_hdr *dh, unsigned len);
-extern int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
-				const struct dccp_hdr *dh, const unsigned len);
-
-extern void		dccp_close(struct sock *sk, long timeout);
-extern struct sk_buff	*dccp_make_response(struct sock *sk,
-					    struct dst_entry *dst,
-					    struct request_sock *req);
-extern struct sk_buff	*dccp_make_reset(struct sock *sk,
-					 struct dst_entry *dst,
-					 enum dccp_reset_codes code);
-
-extern int	   dccp_connect(struct sock *sk);
-extern int	   dccp_disconnect(struct sock *sk, int flags);
-extern int	   dccp_getsockopt(struct sock *sk, int level, int optname,
-				   char __user *optval, int __user *optlen);
-extern int	   dccp_setsockopt(struct sock *sk, int level, int optname,
-				   char __user *optval, int optlen);
-extern int	   dccp_ioctl(struct sock *sk, int cmd, unsigned long arg);
-extern int	   dccp_sendmsg(struct kiocb *iocb, struct sock *sk,
-				struct msghdr *msg, size_t size);
-extern int	   dccp_recvmsg(struct kiocb *iocb, struct sock *sk,
-				struct msghdr *msg, size_t len, int nonblock,
-				int flags, int *addr_len);
-extern void	   dccp_shutdown(struct sock *sk, int how);
-
-extern int	   dccp_v4_checksum(const struct sk_buff *skb,
-				    const u32 saddr, const u32 daddr);
-
-extern int	   dccp_v4_send_reset(struct sock *sk,
-				      enum dccp_reset_codes code);
-extern void	   dccp_send_close(struct sock *sk, const int active);
-
-struct dccp_skb_cb {
-	__u8 dccpd_type;
-	__u8 dccpd_reset_code;
-	__u8 dccpd_service;
-	__u8 dccpd_ccval;
-	__u64 dccpd_seq;
-	__u64 dccpd_ack_seq;
-	int  dccpd_opt_len;
-};
-
-#define DCCP_SKB_CB(__skb) ((struct dccp_skb_cb *)&((__skb)->cb[0]))
-
-static inline int dccp_non_data_packet(const struct sk_buff *skb)
-{
-	const __u8 type = DCCP_SKB_CB(skb)->dccpd_type;
-
-	return type == DCCP_PKT_ACK	 ||
-	       type == DCCP_PKT_CLOSE	 ||
-	       type == DCCP_PKT_CLOSEREQ ||
-	       type == DCCP_PKT_RESET	 ||
-	       type == DCCP_PKT_SYNC	 ||
-	       type == DCCP_PKT_SYNCACK;
-}
-
-static inline int dccp_packet_without_ack(const struct sk_buff *skb)
-{
-	const __u8 type = DCCP_SKB_CB(skb)->dccpd_type;
-
-	return type == DCCP_PKT_DATA || type == DCCP_PKT_REQUEST;
-}
-
-#define DCCP_MAX_SEQNO ((((u64)1) << 48) - 1)
-#define DCCP_PKT_WITHOUT_ACK_SEQ (DCCP_MAX_SEQNO << 2)
-
-static inline void dccp_set_seqno(u64 *seqno, u64 value)
-{
-	if (value > DCCP_MAX_SEQNO)
-		value -= DCCP_MAX_SEQNO + 1;
-	*seqno = value;
-}
-
-static inline u64 dccp_delta_seqno(u64 seqno1, u64 seqno2)
-{
-	return ((seqno2 << 16) - (seqno1 << 16)) >> 16;
-}
-
-static inline void dccp_inc_seqno(u64 *seqno)
-{
-	if (++*seqno > DCCP_MAX_SEQNO)
-		*seqno = 0;
-}
-
-static inline void dccp_hdr_set_seq(struct dccp_hdr *dh, const u64 gss)
-{
-	struct dccp_hdr_ext *dhx = (struct dccp_hdr_ext *)((void *)dh +
-							   sizeof(*dh));
-
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	dh->dccph_seq	   = htonl((gss >> 32)) >> 8;
-#elif defined(__BIG_ENDIAN_BITFIELD)
-	dh->dccph_seq	   = htonl((gss >> 32));
-#else
-#error  "Adjust your <asm/byteorder.h> defines"
-#endif
-	dhx->dccph_seq_low = htonl(gss & 0xffffffff);
-}
-
-static inline void dccp_hdr_set_ack(struct dccp_hdr_ack_bits *dhack,
-				    const u64 gsr)
-{
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-	dhack->dccph_ack_nr_high = htonl((gsr >> 32)) >> 8;
-#elif defined(__BIG_ENDIAN_BITFIELD)
-	dhack->dccph_ack_nr_high = htonl((gsr >> 32));
-#else
-#error  "Adjust your <asm/byteorder.h> defines"
-#endif
-	dhack->dccph_ack_nr_low  = htonl(gsr & 0xffffffff);
-}
-
-static inline void dccp_update_gsr(struct sock *sk, u64 seq)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-
-	dp->dccps_gsr = seq;
-	dccp_set_seqno(&dp->dccps_swl,
-		       (dp->dccps_gsr + 1 -
-		        (dp->dccps_options.dccpo_sequence_window / 4)));
-	dccp_set_seqno(&dp->dccps_swh,
-		       (dp->dccps_gsr +
-			(3 * dp->dccps_options.dccpo_sequence_window) / 4));
-}
-
-static inline void dccp_update_gss(struct sock *sk, u64 seq)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-
-	dp->dccps_awh = dp->dccps_gss = seq;
-	dccp_set_seqno(&dp->dccps_awl,
-		       (dp->dccps_gss -
-			dp->dccps_options.dccpo_sequence_window + 1));
-}
-
-extern void dccp_insert_options(struct sock *sk, struct sk_buff *skb);
-extern void dccp_insert_option_elapsed_time(struct sock *sk,
-					    struct sk_buff *skb,
-					    u32 elapsed_time);
-extern void dccp_insert_option_timestamp(struct sock *sk,
-					 struct sk_buff *skb);
-extern void dccp_insert_option(struct sock *sk, struct sk_buff *skb,
-			       unsigned char option,
-			       const void *value, unsigned char len);
-
-extern struct socket *dccp_ctl_socket;
-
-#define DCCP_ACKPKTS_STATE_RECEIVED	0
-#define DCCP_ACKPKTS_STATE_ECN_MARKED	(1 << 6)
-#define DCCP_ACKPKTS_STATE_NOT_RECEIVED	(3 << 6)
-
-#define DCCP_ACKPKTS_STATE_MASK		0xC0 /* 11000000 */
-#define DCCP_ACKPKTS_LEN_MASK		0x3F /* 00111111 */
-
-/** struct dccp_ackpkts - acknowledgeable packets
- *
- * This data structure is the one defined in the DCCP draft
- * Appendix A.
- *
- * @dccpap_buf_head - circular buffer head
- * @dccpap_buf_tail - circular buffer tail
- * @dccpap_buf_ackno - ack # of the most recent packet acknowledgeable in the
- * 		       buffer (i.e. %dccpap_buf_head)
- * @dccpap_buf_nonce - the one-bit sum of the ECN Nonces on all packets acked
- * 		       by the buffer with State 0
- *
- * Additionally, the HC-Receiver must keep some information about the
- * Ack Vectors it has recently sent. For each packet sent carrying an
- * Ack Vector, it remembers four variables:
- *
- * @dccpap_ack_seqno - the Sequence Number used for the packet
- * 		       (HC-Receiver seqno)
- * @dccpap_ack_ptr - the value of buf_head at the time of acknowledgement.
- * @dccpap_ack_ackno - the Acknowledgement Number used for the packet
- * 		       (HC-Sender seqno)
- * @dccpap_ack_nonce - the one-bit sum of the ECN Nonces for all State 0.
- *
- * @dccpap_buf_len - circular buffer length
- * @dccpap_time		- the time in usecs
- * @dccpap_buf - circular buffer of acknowledgeable packets
- */
-struct dccp_ackpkts {
-	unsigned int		dccpap_buf_head;
-	unsigned int		dccpap_buf_tail;
-	u64			dccpap_buf_ackno;
-	u64			dccpap_ack_seqno;
-	u64			dccpap_ack_ackno;
-	unsigned int		dccpap_ack_ptr;
-	unsigned int		dccpap_buf_vector_len;
-	unsigned int		dccpap_ack_vector_len;
-	unsigned int		dccpap_buf_len;
-	struct timeval		dccpap_time;
-	u8			dccpap_buf_nonce;
-	u8			dccpap_ack_nonce;
-	u8			dccpap_buf[0];
-};
-
-extern struct dccp_ackpkts *
-		dccp_ackpkts_alloc(unsigned int len,
-				  const unsigned int __nocast priority);
-extern void dccp_ackpkts_free(struct dccp_ackpkts *ap);
-extern int dccp_ackpkts_add(struct dccp_ackpkts *ap, u64 ackno, u8 state);
-extern void dccp_ackpkts_check_rcv_ackno(struct dccp_ackpkts *ap,
-					 struct sock *sk, u64 ackno);
-
-static inline suseconds_t timeval_usecs(const struct timeval *tv)
-{
-	return tv->tv_sec * USEC_PER_SEC + tv->tv_usec;
-}
-
-static inline suseconds_t timeval_delta(const struct timeval *large,
-					const struct timeval *small)
-{
-	time_t	    secs  = large->tv_sec  - small->tv_sec;
-	suseconds_t usecs = large->tv_usec - small->tv_usec;
-
-	if (usecs < 0) {
-		secs--;
-		usecs += USEC_PER_SEC;
-	}
-	return secs * USEC_PER_SEC + usecs;
-}
-
-static inline void timeval_add_usecs(struct timeval *tv,
-				     const suseconds_t usecs)
-{
-	tv->tv_usec += usecs;
-	while (tv->tv_usec >= USEC_PER_SEC) {
-		tv->tv_sec++;
-		tv->tv_usec -= USEC_PER_SEC;
-	}
-}
-
-static inline void timeval_sub_usecs(struct timeval *tv,
-				     const suseconds_t usecs)
-{
-	tv->tv_usec -= usecs;
-	while (tv->tv_usec < 0) {
-		tv->tv_sec--;
-		tv->tv_usec += USEC_PER_SEC;
-	}
-}
-
-/*
- * Returns the difference in usecs between timeval
- * passed in and current time
- */
-static inline suseconds_t timeval_now_delta(const struct timeval *tv)
-{
-	struct timeval now;
-	do_gettimeofday(&now);
-	return timeval_delta(&now, tv);
-}
-
-#ifdef CONFIG_IP_DCCP_DEBUG
-extern void dccp_ackvector_print(const u64 ackno,
-				 const unsigned char *vector, int len);
-extern void dccp_ackpkts_print(const struct dccp_ackpkts *ap);
-#else
-static inline void dccp_ackvector_print(const u64 ackno,
-					const unsigned char *vector,
-					int len) { }
-static inline void dccp_ackpkts_print(const struct dccp_ackpkts *ap) { }
-#endif
-
-#endif /* _DCCP_H */
diff --git a/trunk/net/dccp/diag.c b/trunk/net/dccp/diag.c
deleted file mode 100644
index f675d8e642d3..000000000000
--- a/trunk/net/dccp/diag.c
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- *  net/dccp/diag.c
- *
- *  An implementation of the DCCP protocol
- *  Arnaldo Carvalho de Melo <acme@mandriva.com>
- *
- *	This program is free software; you can redistribute it and/or modify it
- *	under the terms of the GNU General Public License version 2 as
- *	published by the Free Software Foundation.
- */
-
-#include <linux/config.h>
-
-#include <linux/module.h>
-#include <linux/inet_diag.h>
-
-#include "ccid.h"
-#include "dccp.h"
-
-static void dccp_get_info(struct sock *sk, struct tcp_info *info)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-
-	memset(info, 0, sizeof(*info));
-
-	info->tcpi_state	= sk->sk_state;
-	info->tcpi_retransmits	= icsk->icsk_retransmits;
-	info->tcpi_probes	= icsk->icsk_probes_out;
-	info->tcpi_backoff	= icsk->icsk_backoff;
-	info->tcpi_pmtu		= dp->dccps_pmtu_cookie;
-
-	if (dp->dccps_options.dccpo_send_ack_vector)
-		info->tcpi_options |= TCPI_OPT_SACK;
-
-	ccid_hc_rx_get_info(dp->dccps_hc_rx_ccid, sk, info);
-	ccid_hc_tx_get_info(dp->dccps_hc_tx_ccid, sk, info);
-}
-
-static void dccp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
-			       void *_info)
-{
-	r->idiag_rqueue = r->idiag_wqueue = 0;
-
-	if (_info != NULL)
-		dccp_get_info(sk, _info);
-}
-
-static struct inet_diag_handler dccp_diag_handler = {
-	.idiag_hashinfo	 = &dccp_hashinfo,
-	.idiag_get_info	 = dccp_diag_get_info,
-	.idiag_type	 = DCCPDIAG_GETSOCK,
-	.idiag_info_size = sizeof(struct tcp_info),
-};
-
-static int __init dccp_diag_init(void)
-{
-	return inet_diag_register(&dccp_diag_handler);
-}
-
-static void __exit dccp_diag_fini(void)
-{
-	inet_diag_unregister(&dccp_diag_handler);
-}
-
-module_init(dccp_diag_init);
-module_exit(dccp_diag_fini);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
-MODULE_DESCRIPTION("DCCP inet_diag handler");
diff --git a/trunk/net/dccp/input.c b/trunk/net/dccp/input.c
deleted file mode 100644
index ef29cef1dafe..000000000000
--- a/trunk/net/dccp/input.c
+++ /dev/null
@@ -1,600 +0,0 @@
-/*
- *  net/dccp/input.c
- * 
- *  An implementation of the DCCP protocol
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *	This program is free software; you can redistribute it and/or
- *	modify it under the terms of the GNU General Public License
- *	as published by the Free Software Foundation; either version
- *	2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/dccp.h>
-#include <linux/skbuff.h>
-
-#include <net/sock.h>
-
-#include "ccid.h"
-#include "dccp.h"
-
-static void dccp_fin(struct sock *sk, struct sk_buff *skb)
-{
-	sk->sk_shutdown |= RCV_SHUTDOWN;
-	sock_set_flag(sk, SOCK_DONE);
-	__skb_pull(skb, dccp_hdr(skb)->dccph_doff * 4);
-	__skb_queue_tail(&sk->sk_receive_queue, skb);
-	skb_set_owner_r(skb, sk);
-	sk->sk_data_ready(sk, 0);
-}
-
-static void dccp_rcv_close(struct sock *sk, struct sk_buff *skb)
-{
-	dccp_v4_send_reset(sk, DCCP_RESET_CODE_CLOSED);
-	dccp_fin(sk, skb);
-	dccp_set_state(sk, DCCP_CLOSED);
-	sk_wake_async(sk, 1, POLL_HUP);
-}
-
-static void dccp_rcv_closereq(struct sock *sk, struct sk_buff *skb)
-{
-	/*
-	 *   Step 7: Check for unexpected packet types
-	 *      If (S.is_server and P.type == CloseReq)
-	 *	  Send Sync packet acknowledging P.seqno
-	 *	  Drop packet and return
-	 */
-	if (dccp_sk(sk)->dccps_role != DCCP_ROLE_CLIENT) {
-		dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq, DCCP_PKT_SYNC);
-		return;
-	}
-
-	dccp_set_state(sk, DCCP_CLOSING);
-	dccp_send_close(sk, 0);
-}
-
-static inline void dccp_event_ack_recv(struct sock *sk, struct sk_buff *skb)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-
-	if (dp->dccps_options.dccpo_send_ack_vector)
-		dccp_ackpkts_check_rcv_ackno(dp->dccps_hc_rx_ackpkts, sk,
-					     DCCP_SKB_CB(skb)->dccpd_ack_seq);
-}
-
-static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
-{
-	const struct dccp_hdr *dh = dccp_hdr(skb);
-	struct dccp_sock *dp = dccp_sk(sk);
-	u64 lswl, lawl;
-
-	/*
-	 *   Step 5: Prepare sequence numbers for Sync
-	 *     If P.type == Sync or P.type == SyncAck,
-	 *	  If S.AWL <= P.ackno <= S.AWH and P.seqno >= S.SWL,
-	 *	     / * P is valid, so update sequence number variables
-	 *		 accordingly.  After this update, P will pass the tests
-	 *		 in Step 6.  A SyncAck is generated if necessary in
-	 *		 Step 15 * /
-	 *	     Update S.GSR, S.SWL, S.SWH
-	 *	  Otherwise,
-	 *	     Drop packet and return
-	 */
-	if (dh->dccph_type == DCCP_PKT_SYNC || 
-	    dh->dccph_type == DCCP_PKT_SYNCACK) {
-		if (between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
-			      dp->dccps_awl, dp->dccps_awh) &&
-		    !before48(DCCP_SKB_CB(skb)->dccpd_seq, dp->dccps_swl))
-			dccp_update_gsr(sk, DCCP_SKB_CB(skb)->dccpd_seq);
-		else
-			return -1;
-	}
-	
-	/*
-	 *   Step 6: Check sequence numbers
-	 *      Let LSWL = S.SWL and LAWL = S.AWL
-	 *      If P.type == CloseReq or P.type == Close or P.type == Reset,
-	 *	  LSWL := S.GSR + 1, LAWL := S.GAR
-	 *      If LSWL <= P.seqno <= S.SWH
-	 *	     and (P.ackno does not exist or LAWL <= P.ackno <= S.AWH),
-	 *	  Update S.GSR, S.SWL, S.SWH
-	 *	  If P.type != Sync,
-	 *	     Update S.GAR
-	 *      Otherwise,
-	 *	  Send Sync packet acknowledging P.seqno
-	 *	  Drop packet and return
-	 */
-	lswl = dp->dccps_swl;
-	lawl = dp->dccps_awl;
-
-	if (dh->dccph_type == DCCP_PKT_CLOSEREQ ||
-	    dh->dccph_type == DCCP_PKT_CLOSE ||
-	    dh->dccph_type == DCCP_PKT_RESET) {
-		lswl = dp->dccps_gsr;
-		dccp_inc_seqno(&lswl);
-		lawl = dp->dccps_gar;
-	}
-
-	if (between48(DCCP_SKB_CB(skb)->dccpd_seq, lswl, dp->dccps_swh) &&
-	    (DCCP_SKB_CB(skb)->dccpd_ack_seq == DCCP_PKT_WITHOUT_ACK_SEQ ||
-	     between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
-		       lawl, dp->dccps_awh))) {
-		dccp_update_gsr(sk, DCCP_SKB_CB(skb)->dccpd_seq);
-
-		if (dh->dccph_type != DCCP_PKT_SYNC &&
-		    (DCCP_SKB_CB(skb)->dccpd_ack_seq !=
-		     DCCP_PKT_WITHOUT_ACK_SEQ))
-			dp->dccps_gar = DCCP_SKB_CB(skb)->dccpd_ack_seq;
-	} else {
-		LIMIT_NETDEBUG(KERN_WARNING "DCCP: Step 6 failed for %s packet, "
-					    "(LSWL(%llu) <= P.seqno(%llu) <= S.SWH(%llu)) and "
-					    "(P.ackno %s or LAWL(%llu) <= P.ackno(%llu) <= S.AWH(%llu), "
-					    "sending SYNC...\n",
-			       dccp_packet_name(dh->dccph_type),
-			       (unsigned long long) lswl,
-			       (unsigned long long)
-			       DCCP_SKB_CB(skb)->dccpd_seq,
-			       (unsigned long long) dp->dccps_swh,
-			       (DCCP_SKB_CB(skb)->dccpd_ack_seq ==
-			        DCCP_PKT_WITHOUT_ACK_SEQ) ? "doesn't exist" : "exists",
-			       (unsigned long long) lawl,
-			       (unsigned long long)
-			       DCCP_SKB_CB(skb)->dccpd_ack_seq,
-			       (unsigned long long) dp->dccps_awh);
-		dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq, DCCP_PKT_SYNC);
-		return -1;
-	}
-
-	return 0;
-}
-
-int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
-			 const struct dccp_hdr *dh, const unsigned len)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-
-	if (dccp_check_seqno(sk, skb))
-		goto discard;
-
-	if (dccp_parse_options(sk, skb))
-		goto discard;
-
-	if (DCCP_SKB_CB(skb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
-		dccp_event_ack_recv(sk, skb);
-
-	/*
-	 * FIXME: check ECN to see if we should use
-	 * DCCP_ACKPKTS_STATE_ECN_MARKED
-	 */
-	if (dp->dccps_options.dccpo_send_ack_vector) {
-		struct dccp_ackpkts *ap = dp->dccps_hc_rx_ackpkts;
-
-		if (dccp_ackpkts_add(dp->dccps_hc_rx_ackpkts,
-				     DCCP_SKB_CB(skb)->dccpd_seq,
-				     DCCP_ACKPKTS_STATE_RECEIVED)) {
-			LIMIT_NETDEBUG(KERN_WARNING "DCCP: acknowledgeable "
-						    "packets buffer full!\n");
-			ap->dccpap_ack_seqno = DCCP_MAX_SEQNO + 1;
-			inet_csk_schedule_ack(sk);
-			inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-						  TCP_DELACK_MIN,
-						  DCCP_RTO_MAX);
-			goto discard;
-		}
-
-		/*
-		 * FIXME: this activation is probably wrong, have to study more
-		 * TCP delack machinery and how it fits into DCCP draft, but
-		 * for now it kinda "works" 8)
-		 */
-		if (!inet_csk_ack_scheduled(sk)) {
-			inet_csk_schedule_ack(sk);
-			inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK, 5 * HZ,
-						  DCCP_RTO_MAX);
-		}
-	}
-
-	ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
-	ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-
-	switch (dccp_hdr(skb)->dccph_type) {
-	case DCCP_PKT_DATAACK:
-	case DCCP_PKT_DATA:
-		/*
-		 * FIXME: check if sk_receive_queue is full, schedule DATA_DROPPED
-		 * option if it is.
-		 */
-		__skb_pull(skb, dh->dccph_doff * 4);
-		__skb_queue_tail(&sk->sk_receive_queue, skb);
-		skb_set_owner_r(skb, sk);
-		sk->sk_data_ready(sk, 0);
-		return 0;
-	case DCCP_PKT_ACK:
-		goto discard;
-	case DCCP_PKT_RESET:
-		/*
-		 *  Step 9: Process Reset
-		 *	If P.type == Reset,
-		 *		Tear down connection
-		 *		S.state := TIMEWAIT
-		 *		Set TIMEWAIT timer
-		 *		Drop packet and return
-		*/
-		dccp_fin(sk, skb);
-		dccp_time_wait(sk, DCCP_TIME_WAIT, 0);
-		return 0;
-	case DCCP_PKT_CLOSEREQ:
-		dccp_rcv_closereq(sk, skb);
-		goto discard;
-	case DCCP_PKT_CLOSE:
-		dccp_rcv_close(sk, skb);
-		return 0;
-	case DCCP_PKT_REQUEST:
-		/* Step 7 
-            	 *   or (S.is_server and P.type == Response)
-		 *   or (S.is_client and P.type == Request)
-		 *   or (S.state >= OPEN and P.type == Request
-		 *	and P.seqno >= S.OSR)
-		 *    or (S.state >= OPEN and P.type == Response
-		 *	and P.seqno >= S.OSR)
-		 *    or (S.state == RESPOND and P.type == Data),
-		 *  Send Sync packet acknowledging P.seqno
-		 *  Drop packet and return
-		 */
-		if (dp->dccps_role != DCCP_ROLE_LISTEN)
-			goto send_sync;
-		goto check_seq;
-	case DCCP_PKT_RESPONSE:
-		if (dp->dccps_role != DCCP_ROLE_CLIENT)
-			goto send_sync;
-check_seq:
-		if (!before48(DCCP_SKB_CB(skb)->dccpd_seq, dp->dccps_osr)) {
-send_sync:
-			dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq,
-				       DCCP_PKT_SYNC);
-		}
-		break;
-	case DCCP_PKT_SYNC:
-		dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq,
-			       DCCP_PKT_SYNCACK);
-		/*
-		 * From the draft:
-		 *
-		 * As with DCCP-Ack packets, DCCP-Sync and DCCP-SyncAck packets
-		 * MAY have non-zero-length application data areas, whose
-		 * contents * receivers MUST ignore.
-		 */
-		goto discard;
-	}
-
-	DCCP_INC_STATS_BH(DCCP_MIB_INERRS);
-discard:
-	__kfree_skb(skb);
-	return 0;
-}
-
-static int dccp_rcv_request_sent_state_process(struct sock *sk,
-					       struct sk_buff *skb,
-					       const struct dccp_hdr *dh,
-					       const unsigned len)
-{
-	/* 
-	 *  Step 4: Prepare sequence numbers in REQUEST
-	 *     If S.state == REQUEST,
-	 *	  If (P.type == Response or P.type == Reset)
-	 *		and S.AWL <= P.ackno <= S.AWH,
-	 *	     / * Set sequence number variables corresponding to the
-	 *		other endpoint, so P will pass the tests in Step 6 * /
-	 *	     Set S.GSR, S.ISR, S.SWL, S.SWH
-	 *	     / * Response processing continues in Step 10; Reset
-	 *		processing continues in Step 9 * /
-	*/
-	if (dh->dccph_type == DCCP_PKT_RESPONSE) {
-		const struct inet_connection_sock *icsk = inet_csk(sk);
-		struct dccp_sock *dp = dccp_sk(sk);
-
-		/* Stop the REQUEST timer */
-		inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
-		BUG_TRAP(sk->sk_send_head != NULL);
-		__kfree_skb(sk->sk_send_head);
-		sk->sk_send_head = NULL;
-
-		if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
-			       dp->dccps_awl, dp->dccps_awh)) {
-			dccp_pr_debug("invalid ackno: S.AWL=%llu, "
-				      "P.ackno=%llu, S.AWH=%llu \n",
-				      (unsigned long long)dp->dccps_awl,
-			   (unsigned long long)DCCP_SKB_CB(skb)->dccpd_ack_seq,
-				      (unsigned long long)dp->dccps_awh);
-			goto out_invalid_packet;
-		}
-
-		dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq;
-		dccp_update_gsr(sk, dp->dccps_isr);
-		/*
-		 * SWL and AWL are initially adjusted so that they are not less than
-		 * the initial Sequence Numbers received and sent, respectively:
-		 *	SWL := max(GSR + 1 - floor(W/4), ISR),
-		 *	AWL := max(GSS - W' + 1, ISS).
-		 * These adjustments MUST be applied only at the beginning of the
-		 * connection.
-		 *
-		 * AWL was adjusted in dccp_v4_connect -acme
-		 */
-		dccp_set_seqno(&dp->dccps_swl,
-			       max48(dp->dccps_swl, dp->dccps_isr));
-
-		if (ccid_hc_rx_init(dp->dccps_hc_rx_ccid, sk) != 0 ||
-		    ccid_hc_tx_init(dp->dccps_hc_tx_ccid, sk) != 0) {
-			ccid_hc_rx_exit(dp->dccps_hc_rx_ccid, sk);
-			ccid_hc_tx_exit(dp->dccps_hc_tx_ccid, sk);
-			/* FIXME: send appropriate RESET code */
-			goto out_invalid_packet;
-		}
-
-		dccp_sync_mss(sk, dp->dccps_pmtu_cookie);
-
-		/*
-		 *    Step 10: Process REQUEST state (second part)
-		 *       If S.state == REQUEST,
-		 *	  / * If we get here, P is a valid Response from the
-		 *	      server (see Step 4), and we should move to
-		 *	      PARTOPEN state. PARTOPEN means send an Ack,
-		 *	      don't send Data packets, retransmit Acks
-		 *	      periodically, and always include any Init Cookie
-		 *	      from the Response * /
-		 *	  S.state := PARTOPEN
-		 *	  Set PARTOPEN timer
-		 * 	  Continue with S.state == PARTOPEN
-		 *	  / * Step 12 will send the Ack completing the
-		 *	      three-way handshake * /
-		 */
-		dccp_set_state(sk, DCCP_PARTOPEN);
-
-		/* Make sure socket is routed, for correct metrics. */
-		inet_sk_rebuild_header(sk);
-
-		if (!sock_flag(sk, SOCK_DEAD)) {
-			sk->sk_state_change(sk);
-			sk_wake_async(sk, 0, POLL_OUT);
-		}
-
-		if (sk->sk_write_pending || icsk->icsk_ack.pingpong ||
-		    icsk->icsk_accept_queue.rskq_defer_accept) {
-			/* Save one ACK. Data will be ready after
-			 * several ticks, if write_pending is set.
-			 *
-			 * It may be deleted, but with this feature tcpdumps
-			 * look so _wonderfully_ clever, that I was not able
-			 * to stand against the temptation 8)     --ANK
-			 */
-			/*
-			 * OK, in DCCP we can as well do a similar trick, its
-			 * even in the draft, but there is no need for us to
-			 * schedule an ack here, as dccp_sendmsg does this for
-			 * us, also stated in the draft. -acme
-			 */
-			__kfree_skb(skb);
-			return 0;
-		} 
-		dccp_send_ack(sk);
-		return -1;
-	}
-
-out_invalid_packet:
-	return 1; /* dccp_v4_do_rcv will send a reset, but...
-		     FIXME: the reset code should be
-			    DCCP_RESET_CODE_PACKET_ERROR */
-}
-
-static int dccp_rcv_respond_partopen_state_process(struct sock *sk,
-						   struct sk_buff *skb,
-						   const struct dccp_hdr *dh,
-						   const unsigned len)
-{
-	int queued = 0;
-
-	switch (dh->dccph_type) {
-	case DCCP_PKT_RESET:
-		inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
-		break;
-	case DCCP_PKT_DATAACK:
-	case DCCP_PKT_ACK:
-		/*
-		 * FIXME: we should be reseting the PARTOPEN (DELACK) timer
-		 * here but only if we haven't used the DELACK timer for
-		 * something else, like sending a delayed ack for a TIMESTAMP
-		 * echo, etc, for now were not clearing it, sending an extra
-		 * ACK when there is nothing else to do in DELACK is not a big
-		 * deal after all.
-		 */
-
-		/* Stop the PARTOPEN timer */
-		if (sk->sk_state == DCCP_PARTOPEN)
-			inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
-
-		dccp_sk(sk)->dccps_osr = DCCP_SKB_CB(skb)->dccpd_seq;
-		dccp_set_state(sk, DCCP_OPEN);
-
-		if (dh->dccph_type == DCCP_PKT_DATAACK) {
-			dccp_rcv_established(sk, skb, dh, len);
-			queued = 1; /* packet was queued
-				       (by dccp_rcv_established) */
-		}
-		break;
-	}
-
-	return queued;
-}
-
-int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
-			   struct dccp_hdr *dh, unsigned len)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	const int old_state = sk->sk_state;
-	int queued = 0;
-
-	/*
-	 *  Step 3: Process LISTEN state
-	 *  	(Continuing from dccp_v4_do_rcv and dccp_v6_do_rcv)
-	 *
-	 *     If S.state == LISTEN,
-	 *	  If P.type == Request or P contains a valid Init Cookie
-	 *	  	option,
-	 *	     * Must scan the packet's options to check for an Init
-	 *		Cookie.  Only the Init Cookie is processed here,
-	 *		however; other options are processed in Step 8.  This
-	 *		scan need only be performed if the endpoint uses Init
-	 *		Cookies *
-	 *	     * Generate a new socket and switch to that socket *
-	 *	     Set S := new socket for this port pair
-	 *	     S.state = RESPOND
-	 *	     Choose S.ISS (initial seqno) or set from Init Cookie
-	 *	     Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
-	 *	     Continue with S.state == RESPOND
-	 *	     * A Response packet will be generated in Step 11 *
-	 *	  Otherwise,
-	 *	     Generate Reset(No Connection) unless P.type == Reset
-	 *	     Drop packet and return
-	 *
-	 * NOTE: the check for the packet types is done in
-	 *	 dccp_rcv_state_process
-	 */
-	if (sk->sk_state == DCCP_LISTEN) {
-		if (dh->dccph_type == DCCP_PKT_REQUEST) {
-			if (dccp_v4_conn_request(sk, skb) < 0)
-				return 1;
-
-			/* FIXME: do congestion control initialization */
-			goto discard;
-		}
-		if (dh->dccph_type == DCCP_PKT_RESET)
-			goto discard;
-
-		/* Caller (dccp_v4_do_rcv) will send Reset(No Connection)*/
-		return 1;
-	}
-
-	if (sk->sk_state != DCCP_REQUESTING) {
-		if (dccp_check_seqno(sk, skb))
-			goto discard;
-
-		/*
-		 * Step 8: Process options and mark acknowledgeable
-		 */
-		if (dccp_parse_options(sk, skb))
-			goto discard;
-
-		if (DCCP_SKB_CB(skb)->dccpd_ack_seq !=
-		    DCCP_PKT_WITHOUT_ACK_SEQ)
-			dccp_event_ack_recv(sk, skb);
-
-		ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
-		ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-
-		/*
-		 * FIXME: check ECN to see if we should use
-		 * DCCP_ACKPKTS_STATE_ECN_MARKED
-		 */
-		if (dp->dccps_options.dccpo_send_ack_vector) {
-			if (dccp_ackpkts_add(dp->dccps_hc_rx_ackpkts,
-					     DCCP_SKB_CB(skb)->dccpd_seq,
-					     DCCP_ACKPKTS_STATE_RECEIVED))
-				goto discard;
-			/*
-			 * FIXME: this activation is probably wrong, have to
-			 * study more TCP delack machinery and how it fits into
-			 * DCCP draft, but for now it kinda "works" 8)
-			 */
-			if ((dp->dccps_hc_rx_ackpkts->dccpap_ack_seqno ==
-			     DCCP_MAX_SEQNO + 1) &&
-			    !inet_csk_ack_scheduled(sk)) {
-				inet_csk_schedule_ack(sk);
-				inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-							  TCP_DELACK_MIN,
-							  DCCP_RTO_MAX);
-			}
-		}
-	}
-
-	/*
-	 *  Step 9: Process Reset
-	 *	If P.type == Reset,
-	 *		Tear down connection
-	 *		S.state := TIMEWAIT
-	 *		Set TIMEWAIT timer
-	 *		Drop packet and return
-	*/
-	if (dh->dccph_type == DCCP_PKT_RESET) {
-		/*
-		 * Queue the equivalent of TCP fin so that dccp_recvmsg
-		 * exits the loop
-		 */
-		dccp_fin(sk, skb);
-		dccp_time_wait(sk, DCCP_TIME_WAIT, 0);
-		return 0;
-		/*
-		 *   Step 7: Check for unexpected packet types
-		 *      If (S.is_server and P.type == CloseReq)
-		 *	    or (S.is_server and P.type == Response)
-		 *	    or (S.is_client and P.type == Request)
-		 *	    or (S.state == RESPOND and P.type == Data),
-		 *	  Send Sync packet acknowledging P.seqno
-		 *	  Drop packet and return
-		 */
-	} else if ((dp->dccps_role != DCCP_ROLE_CLIENT &&
-		    (dh->dccph_type == DCCP_PKT_RESPONSE ||
-		     dh->dccph_type == DCCP_PKT_CLOSEREQ)) ||
-		    (dp->dccps_role == DCCP_ROLE_CLIENT &&
-		     dh->dccph_type == DCCP_PKT_REQUEST) ||
-		    (sk->sk_state == DCCP_RESPOND &&
-		     dh->dccph_type == DCCP_PKT_DATA)) {
-		dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq,
-			       DCCP_PKT_SYNC);
-		goto discard;
-	} else if (dh->dccph_type == DCCP_PKT_CLOSEREQ) {
-		dccp_rcv_closereq(sk, skb);
-		goto discard;
-	} else if (dh->dccph_type == DCCP_PKT_CLOSE) {
-		dccp_rcv_close(sk, skb);
-		return 0;
-	}
-
-	switch (sk->sk_state) {
-	case DCCP_CLOSED:
-		return 1;
-
-	case DCCP_REQUESTING:
-		/* FIXME: do congestion control initialization */
-
-		queued = dccp_rcv_request_sent_state_process(sk, skb, dh, len);
-		if (queued >= 0)
-			return queued;
-
-		__kfree_skb(skb);
-		return 0;
-
-	case DCCP_RESPOND:
-	case DCCP_PARTOPEN:
-		queued = dccp_rcv_respond_partopen_state_process(sk, skb,
-								 dh, len);
-		break;
-	}
-
-	if (dh->dccph_type == DCCP_PKT_ACK ||
-	    dh->dccph_type == DCCP_PKT_DATAACK) {
-		switch (old_state) {
-		case DCCP_PARTOPEN:
-			sk->sk_state_change(sk);
-			sk_wake_async(sk, 0, POLL_OUT);
-			break;
-		}
-	}
-
-	if (!queued) { 
-discard:
-		__kfree_skb(skb);
-	}
-	return 0;
-}
diff --git a/trunk/net/dccp/ipv4.c b/trunk/net/dccp/ipv4.c
deleted file mode 100644
index 3fc75dbee4b8..000000000000
--- a/trunk/net/dccp/ipv4.c
+++ /dev/null
@@ -1,1356 +0,0 @@
-/*
- *  net/dccp/ipv4.c
- *
- *  An implementation of the DCCP protocol
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *	This program is free software; you can redistribute it and/or
- *	modify it under the terms of the GNU General Public License
- *	as published by the Free Software Foundation; either version
- *	2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/dccp.h>
-#include <linux/icmp.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/random.h>
-
-#include <net/icmp.h>
-#include <net/inet_hashtables.h>
-#include <net/sock.h>
-#include <net/tcp_states.h>
-#include <net/xfrm.h>
-
-#include "ccid.h"
-#include "dccp.h"
-
-struct inet_hashinfo __cacheline_aligned dccp_hashinfo = {
-	.lhash_lock	= RW_LOCK_UNLOCKED,
-	.lhash_users	= ATOMIC_INIT(0),
-	.lhash_wait = __WAIT_QUEUE_HEAD_INITIALIZER(dccp_hashinfo.lhash_wait),
-	.portalloc_lock	= SPIN_LOCK_UNLOCKED,
-	.port_rover	= 1024 - 1,
-};
-
-EXPORT_SYMBOL_GPL(dccp_hashinfo);
-
-static int dccp_v4_get_port(struct sock *sk, const unsigned short snum)
-{
-	return inet_csk_get_port(&dccp_hashinfo, sk, snum);
-}
-
-static void dccp_v4_hash(struct sock *sk)
-{
-	inet_hash(&dccp_hashinfo, sk);
-}
-
-static void dccp_v4_unhash(struct sock *sk)
-{
-	inet_unhash(&dccp_hashinfo, sk);
-}
-
-/* called with local bh disabled */
-static int __dccp_v4_check_established(struct sock *sk, const __u16 lport,
-				      struct inet_timewait_sock **twp)
-{
-	struct inet_sock *inet = inet_sk(sk);
-	const u32 daddr = inet->rcv_saddr;
-	const u32 saddr = inet->daddr;
-	const int dif = sk->sk_bound_dev_if;
-	INET_ADDR_COOKIE(acookie, saddr, daddr)
-	const __u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
-	const int hash = inet_ehashfn(daddr, lport, saddr, inet->dport,
-				      dccp_hashinfo.ehash_size);
-	struct inet_ehash_bucket *head = &dccp_hashinfo.ehash[hash];
-	const struct sock *sk2;
-	const struct hlist_node *node;
-	struct inet_timewait_sock *tw;
-
-	write_lock(&head->lock);
-
-	/* Check TIME-WAIT sockets first. */
-	sk_for_each(sk2, node, &(head + dccp_hashinfo.ehash_size)->chain) {
-		tw = inet_twsk(sk2);
-
-		if (INET_TW_MATCH(sk2, acookie, saddr, daddr, ports, dif))
-			goto not_unique;
-	}
-	tw = NULL;
-
-	/* And established part... */
-	sk_for_each(sk2, node, &head->chain) {
-		if (INET_MATCH(sk2, acookie, saddr, daddr, ports, dif))
-			goto not_unique;
-	}
-
-	/* Must record num and sport now. Otherwise we will see
-	 * in hash table socket with a funny identity. */
-	inet->num = lport;
-	inet->sport = htons(lport);
-	sk->sk_hashent = hash;
-	BUG_TRAP(sk_unhashed(sk));
-	__sk_add_node(sk, &head->chain);
-	sock_prot_inc_use(sk->sk_prot);
-	write_unlock(&head->lock);
-
-	if (twp != NULL) {
-		*twp = tw;
-		NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
-	} else if (tw != NULL) {
-		/* Silly. Should hash-dance instead... */
-		inet_twsk_deschedule(tw, &dccp_death_row);
-		NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
-
-		inet_twsk_put(tw);
-	}
-
-	return 0;
-
-not_unique:
-	write_unlock(&head->lock);
-	return -EADDRNOTAVAIL;
-}
-
-/*
- * Bind a port for a connect operation and hash it.
- */
-static int dccp_v4_hash_connect(struct sock *sk)
-{
-	const unsigned short snum = inet_sk(sk)->num;
- 	struct inet_bind_hashbucket *head;
- 	struct inet_bind_bucket *tb;
-	int ret;
-
- 	if (snum == 0) {
- 		int rover;
- 		int low = sysctl_local_port_range[0];
- 		int high = sysctl_local_port_range[1];
- 		int remaining = (high - low) + 1;
-		struct hlist_node *node;
- 		struct inet_timewait_sock *tw = NULL;
-
- 		local_bh_disable();
-
- 		/* TODO. Actually it is not so bad idea to remove
- 		 * dccp_hashinfo.portalloc_lock before next submission to
-		 * Linus.
- 		 * As soon as we touch this place at all it is time to think.
- 		 *
- 		 * Now it protects single _advisory_ variable
-		 * dccp_hashinfo.port_rover, hence it is mostly useless.
- 		 * Code will work nicely if we just delete it, but
- 		 * I am afraid in contented case it will work not better or
- 		 * even worse: another cpu just will hit the same bucket
- 		 * and spin there.
- 		 * So some cpu salt could remove both contention and
- 		 * memory pingpong. Any ideas how to do this in a nice way?
- 		 */
- 		spin_lock(&dccp_hashinfo.portalloc_lock);
- 		rover = dccp_hashinfo.port_rover;
-
- 		do {
- 			rover++;
- 			if ((rover < low) || (rover > high))
- 				rover = low;
- 			head = &dccp_hashinfo.bhash[inet_bhashfn(rover,
-						    dccp_hashinfo.bhash_size)];
- 			spin_lock(&head->lock);
-
- 			/* Does not bother with rcv_saddr checks,
- 			 * because the established check is already
- 			 * unique enough.
- 			 */
-			inet_bind_bucket_for_each(tb, node, &head->chain) {
- 				if (tb->port == rover) {
- 					BUG_TRAP(!hlist_empty(&tb->owners));
- 					if (tb->fastreuse >= 0)
- 						goto next_port;
- 					if (!__dccp_v4_check_established(sk,
-									 rover,
-									 &tw))
- 						goto ok;
- 					goto next_port;
- 				}
- 			}
-
- 			tb = inet_bind_bucket_create(dccp_hashinfo.bind_bucket_cachep,
-						     head, rover);
- 			if (tb == NULL) {
- 				spin_unlock(&head->lock);
- 				break;
- 			}
- 			tb->fastreuse = -1;
- 			goto ok;
-
- 		next_port:
- 			spin_unlock(&head->lock);
- 		} while (--remaining > 0);
- 		dccp_hashinfo.port_rover = rover;
- 		spin_unlock(&dccp_hashinfo.portalloc_lock);
-
- 		local_bh_enable();
-
- 		return -EADDRNOTAVAIL;
-
-ok:
- 		/* All locks still held and bhs disabled */
- 		dccp_hashinfo.port_rover = rover;
- 		spin_unlock(&dccp_hashinfo.portalloc_lock);
-
- 		inet_bind_hash(sk, tb, rover);
-		if (sk_unhashed(sk)) {
- 			inet_sk(sk)->sport = htons(rover);
- 			__inet_hash(&dccp_hashinfo, sk, 0);
- 		}
- 		spin_unlock(&head->lock);
-
- 		if (tw != NULL) {
- 			inet_twsk_deschedule(tw, &dccp_death_row);
- 			inet_twsk_put(tw);
- 		}
-
-		ret = 0;
-		goto out;
- 	}
-
- 	head = &dccp_hashinfo.bhash[inet_bhashfn(snum,
-						 dccp_hashinfo.bhash_size)];
- 	tb   = inet_csk(sk)->icsk_bind_hash;
-	spin_lock_bh(&head->lock);
-	if (sk_head(&tb->owners) == sk && sk->sk_bind_node.next == NULL) {
-		__inet_hash(&dccp_hashinfo, sk, 0);
-		spin_unlock_bh(&head->lock);
-		return 0;
-	} else {
-		spin_unlock(&head->lock);
-		/* No definite answer... Walk to established hash table */
-		ret = __dccp_v4_check_established(sk, snum, NULL);
-out:
-		local_bh_enable();
-		return ret;
-	}
-}
-
-static int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr,
-			   int addr_len)
-{
-	struct inet_sock *inet = inet_sk(sk);
-	struct dccp_sock *dp = dccp_sk(sk);
-	const struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
-	struct rtable *rt;
-	u32 daddr, nexthop;
-	int tmp;
-	int err;
-
-	dp->dccps_role = DCCP_ROLE_CLIENT;
-
-	if (addr_len < sizeof(struct sockaddr_in))
-		return -EINVAL;
-
-	if (usin->sin_family != AF_INET)
-		return -EAFNOSUPPORT;
-
-	nexthop = daddr = usin->sin_addr.s_addr;
-	if (inet->opt != NULL && inet->opt->srr) {
-		if (daddr == 0)
-			return -EINVAL;
-		nexthop = inet->opt->faddr;
-	}
-
-	tmp = ip_route_connect(&rt, nexthop, inet->saddr,
-			       RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
-			       IPPROTO_DCCP,
-			       inet->sport, usin->sin_port, sk);
-	if (tmp < 0)
-		return tmp;
-
-	if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) {
-		ip_rt_put(rt);
-		return -ENETUNREACH;
-	}
-
-	if (inet->opt == NULL || !inet->opt->srr)
-		daddr = rt->rt_dst;
-
-	if (inet->saddr == 0)
-		inet->saddr = rt->rt_src;
-	inet->rcv_saddr = inet->saddr;
-
-	inet->dport = usin->sin_port;
-	inet->daddr = daddr;
-
-	dp->dccps_ext_header_len = 0;
-	if (inet->opt != NULL)
-		dp->dccps_ext_header_len = inet->opt->optlen;
-	/*
-	 * Socket identity is still unknown (sport may be zero).
-	 * However we set state to DCCP_REQUESTING and not releasing socket
-	 * lock select source port, enter ourselves into the hash tables and
-	 * complete initialization after this.
-	 */
-	dccp_set_state(sk, DCCP_REQUESTING);
-	err = dccp_v4_hash_connect(sk);
-	if (err != 0)
-		goto failure;
-
-	err = ip_route_newports(&rt, inet->sport, inet->dport, sk);
-	if (err != 0)
-		goto failure;
-
-	/* OK, now commit destination to socket.  */
-	sk_setup_caps(sk, &rt->u.dst);
-
-	dp->dccps_gar =
-		dp->dccps_iss = secure_dccp_sequence_number(inet->saddr,
-							    inet->daddr,
-							    inet->sport,
-							    usin->sin_port);
-	dccp_update_gss(sk, dp->dccps_iss);
-
-	/*
-	 * SWL and AWL are initially adjusted so that they are not less than
-	 * the initial Sequence Numbers received and sent, respectively:
-	 *	SWL := max(GSR + 1 - floor(W/4), ISR),
-	 *	AWL := max(GSS - W' + 1, ISS).
-	 * These adjustments MUST be applied only at the beginning of the
-	 * connection.
-	 */
-	dccp_set_seqno(&dp->dccps_awl, max48(dp->dccps_awl, dp->dccps_iss));
-
-	inet->id = dp->dccps_iss ^ jiffies;
-
-	err = dccp_connect(sk);
-	rt = NULL;
-	if (err != 0)
-		goto failure;
-out:
-	return err;
-failure:
-	/*
-	 * This unhashes the socket and releases the local port, if necessary.
-	 */
-	dccp_set_state(sk, DCCP_CLOSED);
-	ip_rt_put(rt);
-	sk->sk_route_caps = 0;
-	inet->dport = 0;
-	goto out;
-}
-
-/*
- * This routine does path mtu discovery as defined in RFC1191.
- */
-static inline void dccp_do_pmtu_discovery(struct sock *sk,
-					  const struct iphdr *iph,
-					  u32 mtu)
-{
-	struct dst_entry *dst;
-	const struct inet_sock *inet = inet_sk(sk);
-	const struct dccp_sock *dp = dccp_sk(sk);
-
-	/* We are not interested in DCCP_LISTEN and request_socks (RESPONSEs
-	 * send out by Linux are always < 576bytes so they should go through
-	 * unfragmented).
-	 */
-	if (sk->sk_state == DCCP_LISTEN)
-		return;
-
-	/* We don't check in the destentry if pmtu discovery is forbidden
-	 * on this route. We just assume that no packet_to_big packets
-	 * are send back when pmtu discovery is not active.
-     	 * There is a small race when the user changes this flag in the
-	 * route, but I think that's acceptable.
-	 */
-	if ((dst = __sk_dst_check(sk, 0)) == NULL)
-		return;
-
-	dst->ops->update_pmtu(dst, mtu);
-
-	/* Something is about to be wrong... Remember soft error
-	 * for the case, if this connection will not able to recover.
-	 */
-	if (mtu < dst_mtu(dst) && ip_dont_fragment(sk, dst))
-		sk->sk_err_soft = EMSGSIZE;
-
-	mtu = dst_mtu(dst);
-
-	if (inet->pmtudisc != IP_PMTUDISC_DONT &&
-	    dp->dccps_pmtu_cookie > mtu) {
-		dccp_sync_mss(sk, mtu);
-
-		/*
-		 * From: draft-ietf-dccp-spec-11.txt
-		 *
-		 *	DCCP-Sync packets are the best choice for upward
-		 *	probing, since DCCP-Sync probes do not risk application
-		 *	data loss.
-		 */
-		dccp_send_sync(sk, dp->dccps_gsr, DCCP_PKT_SYNC);
-	} /* else let the usual retransmit timer handle it */
-}
-
-static void dccp_v4_ctl_send_ack(struct sk_buff *rxskb)
-{
-	int err;
-	struct dccp_hdr *rxdh = dccp_hdr(rxskb), *dh;
-	const int dccp_hdr_ack_len = sizeof(struct dccp_hdr) +
-				     sizeof(struct dccp_hdr_ext) +
-				     sizeof(struct dccp_hdr_ack_bits);
-	struct sk_buff *skb;
-
-	if (((struct rtable *)rxskb->dst)->rt_type != RTN_LOCAL)
-		return;
-
-	skb = alloc_skb(MAX_DCCP_HEADER + 15, GFP_ATOMIC);
-	if (skb == NULL)
-		return;
-
-	/* Reserve space for headers. */
-	skb_reserve(skb, MAX_DCCP_HEADER);
-
-	skb->dst = dst_clone(rxskb->dst);
-
-	skb->h.raw = skb_push(skb, dccp_hdr_ack_len);
-	dh = dccp_hdr(skb);
-	memset(dh, 0, dccp_hdr_ack_len);
-
-	/* Build DCCP header and checksum it. */
-	dh->dccph_type	   = DCCP_PKT_ACK;
-	dh->dccph_sport	   = rxdh->dccph_dport;
-	dh->dccph_dport	   = rxdh->dccph_sport;
-	dh->dccph_doff	   = dccp_hdr_ack_len / 4;
-	dh->dccph_x	   = 1;
-
-	dccp_hdr_set_seq(dh, DCCP_SKB_CB(rxskb)->dccpd_ack_seq);
-	dccp_hdr_set_ack(dccp_hdr_ack_bits(skb),
-			 DCCP_SKB_CB(rxskb)->dccpd_seq);
-
-	bh_lock_sock(dccp_ctl_socket->sk);
-	err = ip_build_and_send_pkt(skb, dccp_ctl_socket->sk,
-				    rxskb->nh.iph->daddr,
-				    rxskb->nh.iph->saddr, NULL);
-	bh_unlock_sock(dccp_ctl_socket->sk);
-
-	if (err == NET_XMIT_CN || err == 0) {
-		DCCP_INC_STATS_BH(DCCP_MIB_OUTSEGS);
-		DCCP_INC_STATS_BH(DCCP_MIB_OUTRSTS);
-	}
-}
-
-static void dccp_v4_reqsk_send_ack(struct sk_buff *skb,
-				   struct request_sock *req)
-{
-	dccp_v4_ctl_send_ack(skb);
-}
-
-static int dccp_v4_send_response(struct sock *sk, struct request_sock *req,
-				 struct dst_entry *dst)
-{
-	int err = -1;
-	struct sk_buff *skb;
-
-	/* First, grab a route. */
-	
-	if (dst == NULL && (dst = inet_csk_route_req(sk, req)) == NULL)
-		goto out;
-
-	skb = dccp_make_response(sk, dst, req);
-	if (skb != NULL) {
-		const struct inet_request_sock *ireq = inet_rsk(req);
-
-		err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
-					    ireq->rmt_addr,
-					    ireq->opt);
-		if (err == NET_XMIT_CN)
-			err = 0;
-	}
-
-out:
-	dst_release(dst);
-	return err;
-}
-
-/*
- * This routine is called by the ICMP module when it gets some sort of error
- * condition. If err < 0 then the socket should be closed and the error
- * returned to the user. If err > 0 it's just the icmp type << 8 | icmp code.
- * After adjustment header points to the first 8 bytes of the tcp header. We
- * need to find the appropriate port.
- *
- * The locking strategy used here is very "optimistic". When someone else
- * accesses the socket the ICMP is just dropped and for some paths there is no
- * check at all. A more general error queue to queue errors for later handling
- * is probably better.
- */
-void dccp_v4_err(struct sk_buff *skb, u32 info)
-{
-	const struct iphdr *iph = (struct iphdr *)skb->data;
-	const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data +
-							(iph->ihl << 2));
-	struct dccp_sock *dp;
-	struct inet_sock *inet;
-	const int type = skb->h.icmph->type;
-	const int code = skb->h.icmph->code;
-	struct sock *sk;
-	__u64 seq;
-	int err;
-
-	if (skb->len < (iph->ihl << 2) + 8) {
-		ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
-		return;
-	}
-
-	sk = inet_lookup(&dccp_hashinfo, iph->daddr, dh->dccph_dport,
-			 iph->saddr, dh->dccph_sport, inet_iif(skb));
-	if (sk == NULL) {
-		ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
-		return;
-	}
-
-	if (sk->sk_state == DCCP_TIME_WAIT) {
-		inet_twsk_put((struct inet_timewait_sock *)sk);
-		return;
-	}
-
-	bh_lock_sock(sk);
-	/* If too many ICMPs get dropped on busy
-	 * servers this needs to be solved differently.
-	 */
-	if (sock_owned_by_user(sk))
-		NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
-
-	if (sk->sk_state == DCCP_CLOSED)
-		goto out;
-
-	dp = dccp_sk(sk);
-	seq = dccp_hdr_seq(skb);
-	if (sk->sk_state != DCCP_LISTEN &&
-	    !between48(seq, dp->dccps_swl, dp->dccps_swh)) {
-		NET_INC_STATS(LINUX_MIB_OUTOFWINDOWICMPS);
-		goto out;
-	}
-
-	switch (type) {
-	case ICMP_SOURCE_QUENCH:
-		/* Just silently ignore these. */
-		goto out;
-	case ICMP_PARAMETERPROB:
-		err = EPROTO;
-		break;
-	case ICMP_DEST_UNREACH:
-		if (code > NR_ICMP_UNREACH)
-			goto out;
-
-		if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */
-			if (!sock_owned_by_user(sk))
-				dccp_do_pmtu_discovery(sk, iph, info);
-			goto out;
-		}
-
-		err = icmp_err_convert[code].errno;
-		break;
-	case ICMP_TIME_EXCEEDED:
-		err = EHOSTUNREACH;
-		break;
-	default:
-		goto out;
-	}
-
-	switch (sk->sk_state) {
-		struct request_sock *req , **prev;
-	case DCCP_LISTEN:
-		if (sock_owned_by_user(sk))
-			goto out;
-		req = inet_csk_search_req(sk, &prev, dh->dccph_dport,
-					  iph->daddr, iph->saddr);
-		if (!req)
-			goto out;
-
-		/*
-		 * ICMPs are not backlogged, hence we cannot get an established
-		 * socket here.
-		 */
-		BUG_TRAP(!req->sk);
-
-		if (seq != dccp_rsk(req)->dreq_iss) {
-			NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
-			goto out;
-		}
-		/*
-		 * Still in RESPOND, just remove it silently.
-		 * There is no good way to pass the error to the newly
-		 * created socket, and POSIX does not want network
-		 * errors returned from accept().
-		 */
-		inet_csk_reqsk_queue_drop(sk, req, prev);
-		goto out;
-
-	case DCCP_REQUESTING:
-	case DCCP_RESPOND:
-		if (!sock_owned_by_user(sk)) {
-			DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS);
-			sk->sk_err = err;
-
-			sk->sk_error_report(sk);
-
-			dccp_done(sk);
-		} else
-			sk->sk_err_soft = err;
-		goto out;
-	}
-
-	/* If we've already connected we will keep trying
-	 * until we time out, or the user gives up.
-	 *
-	 * rfc1122 4.2.3.9 allows to consider as hard errors
-	 * only PROTO_UNREACH and PORT_UNREACH (well, FRAG_FAILED too,
-	 * but it is obsoleted by pmtu discovery).
-	 *
-	 * Note, that in modern internet, where routing is unreliable
-	 * and in each dark corner broken firewalls sit, sending random
-	 * errors ordered by their masters even this two messages finally lose
-	 * their original sense (even Linux sends invalid PORT_UNREACHs)
-	 *
-	 * Now we are in compliance with RFCs.
-	 *							--ANK (980905)
-	 */
-
-	inet = inet_sk(sk);
-	if (!sock_owned_by_user(sk) && inet->recverr) {
-		sk->sk_err = err;
-		sk->sk_error_report(sk);
-	} else /* Only an error on timeout */
-		sk->sk_err_soft = err;
-out:
-	bh_unlock_sock(sk);
-	sock_put(sk);
-}
-
-int dccp_v4_send_reset(struct sock *sk, enum dccp_reset_codes code)
-{
-	struct sk_buff *skb;
-	/*
-	 * FIXME: what if rebuild_header fails?
-	 * Should we be doing a rebuild_header here?
-	 */
-	int err = inet_sk_rebuild_header(sk);
-
-	if (err != 0)
-		return err;
-
-	skb = dccp_make_reset(sk, sk->sk_dst_cache, code);
-	if (skb != NULL) {
-		const struct dccp_sock *dp = dccp_sk(sk);
-		const struct inet_sock *inet = inet_sk(sk);
-
-		err = ip_build_and_send_pkt(skb, sk,
-					    inet->saddr, inet->daddr, NULL);
-		if (err == NET_XMIT_CN)
-			err = 0;
-
-		ccid_hc_rx_exit(dp->dccps_hc_rx_ccid, sk);
-		ccid_hc_tx_exit(dp->dccps_hc_tx_ccid, sk);
-	}
-
-	return err;
-}
-
-static inline u64 dccp_v4_init_sequence(const struct sock *sk,
-					const struct sk_buff *skb)
-{
-	return secure_dccp_sequence_number(skb->nh.iph->daddr,
-					   skb->nh.iph->saddr,
-					   dccp_hdr(skb)->dccph_dport,
-					   dccp_hdr(skb)->dccph_sport);
-}
-
-int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
-{
-	struct inet_request_sock *ireq;
-	struct dccp_sock dp;
-	struct request_sock *req;
-	struct dccp_request_sock *dreq;
-	const __u32 saddr = skb->nh.iph->saddr;
-	const __u32 daddr = skb->nh.iph->daddr;
-	struct dst_entry *dst = NULL;
-
-	/* Never answer to DCCP_PKT_REQUESTs send to broadcast or multicast */
-	if (((struct rtable *)skb->dst)->rt_flags &
-	    (RTCF_BROADCAST | RTCF_MULTICAST))
-		goto drop;
-
-	/*
-	 * TW buckets are converted to open requests without
-	 * limitations, they conserve resources and peer is
-	 * evidently real one.
-	 */
-	if (inet_csk_reqsk_queue_is_full(sk))
-		goto drop;
-
-	/*
-	 * Accept backlog is full. If we have already queued enough
-	 * of warm entries in syn queue, drop request. It is better than
-	 * clogging syn queue with openreqs with exponentially increasing
-	 * timeout.
-	 */
-	if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
-		goto drop;
-
-	req = reqsk_alloc(sk->sk_prot->rsk_prot);
-	if (req == NULL)
-		goto drop;
-
-	/* FIXME: process options */
-
-	dccp_openreq_init(req, &dp, skb);
-
-	ireq = inet_rsk(req);
-	ireq->loc_addr = daddr;
-	ireq->rmt_addr = saddr;
-	/* FIXME: Merge Aristeu's option parsing code when ready */
-	req->rcv_wnd	= 100; /* Fake, option parsing will get the
-				  right value */
-	ireq->opt	= NULL;
-
-	/* 
-	 * Step 3: Process LISTEN state
-	 *
-	 * Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
-	 *
-	 * In fact we defer setting S.GSR, S.SWL, S.SWH to
-	 * dccp_create_openreq_child.
-	 */
-	dreq = dccp_rsk(req);
-	dreq->dreq_isr = DCCP_SKB_CB(skb)->dccpd_seq;
-	dreq->dreq_iss = dccp_v4_init_sequence(sk, skb);
-	dreq->dreq_service = dccp_hdr_request(skb)->dccph_req_service;
-
-	if (dccp_v4_send_response(sk, req, dst))
-		goto drop_and_free;
-
-	inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
-	return 0;
-
-drop_and_free:
-	/*
-	 * FIXME: should be reqsk_free after implementing req->rsk_ops
-	 */
-	__reqsk_free(req);
-drop:
-	DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS);
-	return -1;
-}
-
-/*
- * The three way handshake has completed - we got a valid ACK or DATAACK -
- * now create the new socket.
- *
- * This is the equivalent of TCP's tcp_v4_syn_recv_sock
- */
-struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb,
-				       struct request_sock *req,
-				       struct dst_entry *dst)
-{
-	struct inet_request_sock *ireq;
-	struct inet_sock *newinet;
-	struct dccp_sock *newdp;
-	struct sock *newsk;
-
-	if (sk_acceptq_is_full(sk))
-		goto exit_overflow;
-
-	if (dst == NULL && (dst = inet_csk_route_req(sk, req)) == NULL)
-		goto exit;
-
-	newsk = dccp_create_openreq_child(sk, req, skb);
-	if (newsk == NULL)
-		goto exit;
-
-	sk_setup_caps(newsk, dst);
-
-	newdp		   = dccp_sk(newsk);
-	newinet		   = inet_sk(newsk);
-	ireq		   = inet_rsk(req);
-	newinet->daddr	   = ireq->rmt_addr;
-	newinet->rcv_saddr = ireq->loc_addr;
-	newinet->saddr	   = ireq->loc_addr;
-	newinet->opt	   = ireq->opt;
-	ireq->opt	   = NULL;
-	newinet->mc_index  = inet_iif(skb);
-	newinet->mc_ttl	   = skb->nh.iph->ttl;
-	newinet->id	   = jiffies;
-
-	dccp_sync_mss(newsk, dst_mtu(dst));
-
-	__inet_hash(&dccp_hashinfo, newsk, 0);
-	__inet_inherit_port(&dccp_hashinfo, sk, newsk);
-
-	return newsk;
-
-exit_overflow:
-	NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
-exit:
-	NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
-	dst_release(dst);
-	return NULL;
-}
-
-static struct sock *dccp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
-{
-	const struct dccp_hdr *dh = dccp_hdr(skb);
-	const struct iphdr *iph = skb->nh.iph;
-	struct sock *nsk;
-	struct request_sock **prev;
-	/* Find possible connection requests. */
-	struct request_sock *req = inet_csk_search_req(sk, &prev,
-						       dh->dccph_sport,
-						       iph->saddr, iph->daddr);
-	if (req != NULL)
-		return dccp_check_req(sk, skb, req, prev);
-
-	nsk = __inet_lookup_established(&dccp_hashinfo,
-					iph->saddr, dh->dccph_sport,
-					iph->daddr, ntohs(dh->dccph_dport),
-					inet_iif(skb));
-	if (nsk != NULL) {
-		if (nsk->sk_state != DCCP_TIME_WAIT) {
-			bh_lock_sock(nsk);
-			return nsk;
-		}
-		inet_twsk_put((struct inet_timewait_sock *)nsk);
-		return NULL;
-	}
-
-	return sk;
-}
-
-int dccp_v4_checksum(const struct sk_buff *skb, const u32 saddr,
-		     const u32 daddr)
-{
-	const struct dccp_hdr* dh = dccp_hdr(skb);
-	int checksum_len;
-	u32 tmp;
-
-	if (dh->dccph_cscov == 0)
-		checksum_len = skb->len;
-	else {
-		checksum_len = (dh->dccph_cscov + dh->dccph_x) * sizeof(u32);
-		checksum_len = checksum_len < skb->len ? checksum_len :
-							 skb->len;
-	}
-
-	tmp = csum_partial((unsigned char *)dh, checksum_len, 0);
-	return csum_tcpudp_magic(saddr, daddr, checksum_len,
-				 IPPROTO_DCCP, tmp);
-}
-
-static int dccp_v4_verify_checksum(struct sk_buff *skb,
-				   const u32 saddr, const u32 daddr)
-{
-	struct dccp_hdr *dh = dccp_hdr(skb);
-	int checksum_len;
-	u32 tmp;
-
-	if (dh->dccph_cscov == 0)
-		checksum_len = skb->len;
-	else {
-		checksum_len = (dh->dccph_cscov + dh->dccph_x) * sizeof(u32);
-		checksum_len = checksum_len < skb->len ? checksum_len :
-							 skb->len;
-	}
-	tmp = csum_partial((unsigned char *)dh, checksum_len, 0);
-	return csum_tcpudp_magic(saddr, daddr, checksum_len,
-				 IPPROTO_DCCP, tmp) == 0 ? 0 : -1;
-}
-
-static struct dst_entry* dccp_v4_route_skb(struct sock *sk,
-					   struct sk_buff *skb)
-{
-	struct rtable *rt;
-	struct flowi fl = { .oif = ((struct rtable *)skb->dst)->rt_iif,
-			    .nl_u = { .ip4_u =
-				      { .daddr = skb->nh.iph->saddr,
-					.saddr = skb->nh.iph->daddr,
-					.tos = RT_CONN_FLAGS(sk) } },
-			    .proto = sk->sk_protocol,
-			    .uli_u = { .ports =
-				       { .sport = dccp_hdr(skb)->dccph_dport,
-					 .dport = dccp_hdr(skb)->dccph_sport }
-			   	     }
-			  };
-
-	if (ip_route_output_flow(&rt, &fl, sk, 0)) {
-		IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
-		return NULL;
-	}
-
-	return &rt->u.dst;
-}
-
-static void dccp_v4_ctl_send_reset(struct sk_buff *rxskb)
-{
-	int err;
-	struct dccp_hdr *rxdh = dccp_hdr(rxskb), *dh;
-	const int dccp_hdr_reset_len = sizeof(struct dccp_hdr) +
-				       sizeof(struct dccp_hdr_ext) +
-				       sizeof(struct dccp_hdr_reset);
-	struct sk_buff *skb;
-	struct dst_entry *dst;
-	u64 seqno;
-
-	/* Never send a reset in response to a reset. */
-	if (rxdh->dccph_type == DCCP_PKT_RESET)
-		return;
-
-	if (((struct rtable *)rxskb->dst)->rt_type != RTN_LOCAL)
-		return;
-
-	dst = dccp_v4_route_skb(dccp_ctl_socket->sk, rxskb);
-	if (dst == NULL)
-		return;
-
-	skb = alloc_skb(MAX_DCCP_HEADER + 15, GFP_ATOMIC);
-	if (skb == NULL)
-		goto out;
-
-	/* Reserve space for headers. */
-	skb_reserve(skb, MAX_DCCP_HEADER);
-	skb->dst = dst_clone(dst);
-
-	skb->h.raw = skb_push(skb, dccp_hdr_reset_len);
-	dh = dccp_hdr(skb);
-	memset(dh, 0, dccp_hdr_reset_len);
-
-	/* Build DCCP header and checksum it. */
-	dh->dccph_type	   = DCCP_PKT_RESET;
-	dh->dccph_sport	   = rxdh->dccph_dport;
-	dh->dccph_dport	   = rxdh->dccph_sport;
-	dh->dccph_doff	   = dccp_hdr_reset_len / 4;
-	dh->dccph_x	   = 1;
-	dccp_hdr_reset(skb)->dccph_reset_code =
-				DCCP_SKB_CB(rxskb)->dccpd_reset_code;
-
-	/* See "8.3.1. Abnormal Termination" in draft-ietf-dccp-spec-11 */
-	seqno = 0;
-	if (DCCP_SKB_CB(rxskb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
-		dccp_set_seqno(&seqno, DCCP_SKB_CB(rxskb)->dccpd_ack_seq + 1);
-
-	dccp_hdr_set_seq(dh, seqno);
-	dccp_hdr_set_ack(dccp_hdr_ack_bits(skb),
-			 DCCP_SKB_CB(rxskb)->dccpd_seq);
-
-	dh->dccph_checksum = dccp_v4_checksum(skb, rxskb->nh.iph->saddr,
-					      rxskb->nh.iph->daddr);
-
-	bh_lock_sock(dccp_ctl_socket->sk);
-	err = ip_build_and_send_pkt(skb, dccp_ctl_socket->sk,
-				    rxskb->nh.iph->daddr,
-				    rxskb->nh.iph->saddr, NULL);
-	bh_unlock_sock(dccp_ctl_socket->sk);
-
-	if (err == NET_XMIT_CN || err == 0) {
-		DCCP_INC_STATS_BH(DCCP_MIB_OUTSEGS);
-		DCCP_INC_STATS_BH(DCCP_MIB_OUTRSTS);
-	}
-out:
-	 dst_release(dst);
-}
-
-int dccp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
-{
-	struct dccp_hdr *dh = dccp_hdr(skb);
-
-	if (sk->sk_state == DCCP_OPEN) { /* Fast path */
-		if (dccp_rcv_established(sk, skb, dh, skb->len))
-			goto reset;
-		return 0;
-	}
-
-	/*
-	 *  Step 3: Process LISTEN state
-	 *     If S.state == LISTEN,
-	 *	  If P.type == Request or P contains a valid Init Cookie
-	 *	  	option,
-	 *	     * Must scan the packet's options to check for an Init
-	 *		Cookie.  Only the Init Cookie is processed here,
-	 *		however; other options are processed in Step 8.  This
-	 *		scan need only be performed if the endpoint uses Init
-	 *		Cookies *
-	 *	     * Generate a new socket and switch to that socket *
-	 *	     Set S := new socket for this port pair
-	 *	     S.state = RESPOND
-	 *	     Choose S.ISS (initial seqno) or set from Init Cookie
-	 *	     Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
-	 *	     Continue with S.state == RESPOND
-	 *	     * A Response packet will be generated in Step 11 *
-	 *	  Otherwise,
-	 *	     Generate Reset(No Connection) unless P.type == Reset
-	 *	     Drop packet and return
-	 *
-	 * NOTE: the check for the packet types is done in
-	 *	 dccp_rcv_state_process
-	 */
-	if (sk->sk_state == DCCP_LISTEN) {
-		struct sock *nsk = dccp_v4_hnd_req(sk, skb);
-
-		if (nsk == NULL)
-			goto discard;
-
-		if (nsk != sk) {
-			if (dccp_child_process(sk, nsk, skb))
-				goto reset;
-			return 0;
-		}
-	}
-
-	if (dccp_rcv_state_process(sk, skb, dh, skb->len))
-		goto reset;
-	return 0;
-
-reset:
-	DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
-	dccp_v4_ctl_send_reset(skb);
-discard:
-	kfree_skb(skb);
-	return 0;
-}
-
-static inline int dccp_invalid_packet(struct sk_buff *skb)
-{
-	const struct dccp_hdr *dh;
-
-	if (skb->pkt_type != PACKET_HOST)
-		return 1;
-
-	if (!pskb_may_pull(skb, sizeof(struct dccp_hdr))) {
-		LIMIT_NETDEBUG(KERN_WARNING "DCCP: pskb_may_pull failed\n");
-		return 1;
-	}
-
-	dh = dccp_hdr(skb);
-
-	/* If the packet type is not understood, drop packet and return */
-	if (dh->dccph_type >= DCCP_PKT_INVALID) {
-		LIMIT_NETDEBUG(KERN_WARNING "DCCP: invalid packet type\n");
-		return 1;
-	}
-
-	/*
-	 * If P.Data Offset is too small for packet type, or too large for
-	 * packet, drop packet and return
-	 */
-	if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
-		LIMIT_NETDEBUG(KERN_WARNING "DCCP: P.Data Offset(%u) "
-					    "too small 1\n",
-			       dh->dccph_doff);
-		return 1;
-	}
-
-	if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) {
-		LIMIT_NETDEBUG(KERN_WARNING "DCCP: P.Data Offset(%u) "
-					    "too small 2\n",
-			       dh->dccph_doff);
-		return 1;
-	}
-
-	dh = dccp_hdr(skb);
-
-	/*
-	 * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
-	 * has short sequence numbers), drop packet and return
-	 */
-	if (dh->dccph_x == 0 &&
-	    dh->dccph_type != DCCP_PKT_DATA &&
-	    dh->dccph_type != DCCP_PKT_ACK &&
-	    dh->dccph_type != DCCP_PKT_DATAACK) {
-		LIMIT_NETDEBUG(KERN_WARNING "DCCP: P.type (%s) not Data, Ack "
-					    "nor DataAck and P.X == 0\n",
-			       dccp_packet_name(dh->dccph_type));
-		return 1;
-	}
-
-	/* If the header checksum is incorrect, drop packet and return */
-	if (dccp_v4_verify_checksum(skb, skb->nh.iph->saddr,
-				    skb->nh.iph->daddr) < 0) {
-		LIMIT_NETDEBUG(KERN_WARNING "DCCP: header checksum is "
-					    "incorrect\n");
-		return 1;
-	}
-
-	return 0;
-}
-
-/* this is called when real data arrives */
-int dccp_v4_rcv(struct sk_buff *skb)
-{
-	const struct dccp_hdr *dh;
-	struct sock *sk;
-	int rc;
-
-	/* Step 1: Check header basics: */
-
-	if (dccp_invalid_packet(skb))
-		goto discard_it;
-
-	dh = dccp_hdr(skb);
-#if 0
-	/*
-	 * Use something like this to simulate some DATA/DATAACK loss to test
-	 * dccp_ackpkts_add, you'll get something like this on a session that
-	 * sends 10 DATA/DATAACK packets:
-	 *
-	 * ackpkts_print: 281473596467422 |0,0|3,0|0,0|3,0|0,0|3,0|0,0|3,0|0,1|
-	 *
-	 * 0, 0 means: DCCP_ACKPKTS_STATE_RECEIVED, RLE == just this packet
-	 * 0, 1 means: DCCP_ACKPKTS_STATE_RECEIVED, RLE == two adjacent packets
-	 * 						   with the same state
-	 * 3, 0 means: DCCP_ACKPKTS_STATE_NOT_RECEIVED, RLE == just this packet
-	 *
-	 * So...
-	 *
-	 * 281473596467422 was received
-	 * 281473596467421 was not received
-	 * 281473596467420 was received
-	 * 281473596467419 was not received
-	 * 281473596467418 was received
-	 * 281473596467417 was not received
-	 * 281473596467416 was received
-	 * 281473596467415 was not received
-	 * 281473596467414 was received
-	 * 281473596467413 was received (this one was the 3way handshake
-	 * 				 RESPONSE)
-	 *
-	 */
-	if (dh->dccph_type == DCCP_PKT_DATA ||
-	    dh->dccph_type == DCCP_PKT_DATAACK) {
-		static int discard = 0;
-
-		if (discard) {
-			discard = 0;
-			goto discard_it;
-		}
-		discard = 1;
-	}
-#endif
-	DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(skb);
-	DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;
-
-	dccp_pr_debug("%8.8s "
-		      "src=%u.%u.%u.%u@%-5d "
-		      "dst=%u.%u.%u.%u@%-5d seq=%llu",
-		      dccp_packet_name(dh->dccph_type),
-		      NIPQUAD(skb->nh.iph->saddr), ntohs(dh->dccph_sport),
-		      NIPQUAD(skb->nh.iph->daddr), ntohs(dh->dccph_dport),
-		      (unsigned long long) DCCP_SKB_CB(skb)->dccpd_seq);
-
-	if (dccp_packet_without_ack(skb)) {
-		DCCP_SKB_CB(skb)->dccpd_ack_seq = DCCP_PKT_WITHOUT_ACK_SEQ;
-		dccp_pr_debug_cat("\n");
-	} else {
-		DCCP_SKB_CB(skb)->dccpd_ack_seq = dccp_hdr_ack_seq(skb);
-		dccp_pr_debug_cat(", ack=%llu\n",
-				  (unsigned long long)
-				  DCCP_SKB_CB(skb)->dccpd_ack_seq);
-	}
-
-	/* Step 2:
-	 * 	Look up flow ID in table and get corresponding socket */
-	sk = __inet_lookup(&dccp_hashinfo,
-			   skb->nh.iph->saddr, dh->dccph_sport,
-			   skb->nh.iph->daddr, ntohs(dh->dccph_dport),
-			   inet_iif(skb));
-
-	/* 
-	 * Step 2:
-	 * 	If no socket ...
-	 *		Generate Reset(No Connection) unless P.type == Reset
-	 *		Drop packet and return
-	 */
-	if (sk == NULL) {
-		dccp_pr_debug("failed to look up flow ID in table and "
-			      "get corresponding socket\n");
-		goto no_dccp_socket;
-	}
-
-	/* 
-	 * Step 2:
-	 * 	... or S.state == TIMEWAIT,
-	 *		Generate Reset(No Connection) unless P.type == Reset
-	 *		Drop packet and return
-	 */
-	       
-	if (sk->sk_state == DCCP_TIME_WAIT) {
-		dccp_pr_debug("sk->sk_state == DCCP_TIME_WAIT: "
-			      "do_time_wait\n");
-                goto do_time_wait;
-	}
-
-	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
-		dccp_pr_debug("xfrm4_policy_check failed\n");
-		goto discard_and_relse;
-	}
-
-        if (sk_filter(sk, skb, 0)) {
-		dccp_pr_debug("sk_filter failed\n");
-                goto discard_and_relse;
-	}
-
-	skb->dev = NULL;
-
-	bh_lock_sock(sk);
-	rc = 0;
-	if (!sock_owned_by_user(sk))
-		rc = dccp_v4_do_rcv(sk, skb);
-	else
-		sk_add_backlog(sk, skb);
-	bh_unlock_sock(sk);
-
-	sock_put(sk);
-	return rc;
-
-no_dccp_socket:
-	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
-		goto discard_it;
-	/*
-	 * Step 2:
-	 *		Generate Reset(No Connection) unless P.type == Reset
-	 *		Drop packet and return
-	 */
-	if (dh->dccph_type != DCCP_PKT_RESET) {
-		DCCP_SKB_CB(skb)->dccpd_reset_code =
-					DCCP_RESET_CODE_NO_CONNECTION;
-		dccp_v4_ctl_send_reset(skb);
-	}
-
-discard_it:
-	/* Discard frame. */
-	kfree_skb(skb);
-	return 0;
-
-discard_and_relse:
-	sock_put(sk);
-	goto discard_it;
-
-do_time_wait:
-	inet_twsk_put((struct inet_timewait_sock *)sk);
-	goto no_dccp_socket;
-}
-
-static int dccp_v4_init_sock(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	static int dccp_ctl_socket_init = 1;
-
-	dccp_options_init(&dp->dccps_options);
-
-	if (dp->dccps_options.dccpo_send_ack_vector) {
-		dp->dccps_hc_rx_ackpkts =
-			dccp_ackpkts_alloc(DCCP_MAX_ACK_VECTOR_LEN,
-					   GFP_KERNEL);
-
-		if (dp->dccps_hc_rx_ackpkts == NULL)
-			return -ENOMEM;
-	}
-
-	/*
-	 * FIXME: We're hardcoding the CCID, and doing this at this point makes
-	 * the listening (master) sock get CCID control blocks, which is not
-	 * necessary, but for now, to not mess with the test userspace apps,
-	 * lets leave it here, later the real solution is to do this in a
-	 * setsockopt(CCIDs-I-want/accept). -acme
-	 */
-	if (likely(!dccp_ctl_socket_init)) {
-		dp->dccps_hc_rx_ccid = ccid_init(dp->dccps_options.dccpo_ccid,
-						 sk);
-		dp->dccps_hc_tx_ccid = ccid_init(dp->dccps_options.dccpo_ccid,
-						 sk);
-	    	if (dp->dccps_hc_rx_ccid == NULL ||
-		    dp->dccps_hc_tx_ccid == NULL) {
-			ccid_exit(dp->dccps_hc_rx_ccid, sk);
-			ccid_exit(dp->dccps_hc_tx_ccid, sk);
-			dccp_ackpkts_free(dp->dccps_hc_rx_ackpkts);
-			dp->dccps_hc_rx_ackpkts = NULL;
-			dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
-			return -ENOMEM;
-		}
-	} else
-		dccp_ctl_socket_init = 0;
-
-	dccp_init_xmit_timers(sk);
-	inet_csk(sk)->icsk_rto = DCCP_TIMEOUT_INIT;
-	sk->sk_state = DCCP_CLOSED;
-	sk->sk_write_space = dccp_write_space;
-	dp->dccps_mss_cache = 536;
-	dp->dccps_role = DCCP_ROLE_UNDEFINED;
-
-	return 0;
-}
-
-static int dccp_v4_destroy_sock(struct sock *sk)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-
-	/*
-	 * DCCP doesn't use sk_qrite_queue, just sk_send_head
-	 * for retransmissions
-	 */
-	if (sk->sk_send_head != NULL) {
-		kfree_skb(sk->sk_send_head);
-		sk->sk_send_head = NULL;
-	}
-
-	/* Clean up a referenced DCCP bind bucket. */
-	if (inet_csk(sk)->icsk_bind_hash != NULL)
-		inet_put_port(&dccp_hashinfo, sk);
-
-	ccid_hc_rx_exit(dp->dccps_hc_rx_ccid, sk);
-	ccid_hc_tx_exit(dp->dccps_hc_tx_ccid, sk);
-	dccp_ackpkts_free(dp->dccps_hc_rx_ackpkts);
-	dp->dccps_hc_rx_ackpkts = NULL;
-	ccid_exit(dp->dccps_hc_rx_ccid, sk);
-	ccid_exit(dp->dccps_hc_tx_ccid, sk);
-	dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
-
-	return 0;
-}
-
-static void dccp_v4_reqsk_destructor(struct request_sock *req)
-{
-	kfree(inet_rsk(req)->opt);
-}
-
-static struct request_sock_ops dccp_request_sock_ops = {
-	.family		= PF_INET,
-	.obj_size	= sizeof(struct dccp_request_sock),
-	.rtx_syn_ack	= dccp_v4_send_response,
-	.send_ack	= dccp_v4_reqsk_send_ack,
-	.destructor	= dccp_v4_reqsk_destructor,
-	.send_reset	= dccp_v4_ctl_send_reset,
-};
-
-struct proto dccp_v4_prot = {
-	.name			= "DCCP",
-	.owner			= THIS_MODULE,
-	.close			= dccp_close,
-	.connect		= dccp_v4_connect,
-	.disconnect		= dccp_disconnect,
-	.ioctl			= dccp_ioctl,
-	.init			= dccp_v4_init_sock,
-	.setsockopt		= dccp_setsockopt,
-	.getsockopt		= dccp_getsockopt,
-	.sendmsg		= dccp_sendmsg,
-	.recvmsg		= dccp_recvmsg,
-	.backlog_rcv		= dccp_v4_do_rcv,
-	.hash			= dccp_v4_hash,
-	.unhash			= dccp_v4_unhash,
-	.accept			= inet_csk_accept,
-	.get_port		= dccp_v4_get_port,
-	.shutdown		= dccp_shutdown,
-	.destroy		= dccp_v4_destroy_sock,
-	.orphan_count		= &dccp_orphan_count,
-	.max_header		= MAX_DCCP_HEADER,
-	.obj_size		= sizeof(struct dccp_sock),
-	.rsk_prot		= &dccp_request_sock_ops,
-	.twsk_obj_size		= sizeof(struct inet_timewait_sock),
-};
diff --git a/trunk/net/dccp/minisocks.c b/trunk/net/dccp/minisocks.c
deleted file mode 100644
index ce5dff4ac22e..000000000000
--- a/trunk/net/dccp/minisocks.c
+++ /dev/null
@@ -1,264 +0,0 @@
-/*
- *  net/dccp/minisocks.c
- *
- *  An implementation of the DCCP protocol
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *	This program is free software; you can redistribute it and/or
- *	modify it under the terms of the GNU General Public License
- *	as published by the Free Software Foundation; either version
- *	2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/dccp.h>
-#include <linux/skbuff.h>
-#include <linux/timer.h>
-
-#include <net/sock.h>
-#include <net/xfrm.h>
-#include <net/inet_timewait_sock.h>
-
-#include "ccid.h"
-#include "dccp.h"
-
-struct inet_timewait_death_row dccp_death_row = {
-	.sysctl_max_tw_buckets = NR_FILE * 2,
-	.period		= DCCP_TIMEWAIT_LEN / INET_TWDR_TWKILL_SLOTS,
-	.death_lock	= SPIN_LOCK_UNLOCKED,
-	.hashinfo	= &dccp_hashinfo,
-	.tw_timer	= TIMER_INITIALIZER(inet_twdr_hangman, 0,
-					    (unsigned long)&dccp_death_row),
-	.twkill_work	= __WORK_INITIALIZER(dccp_death_row.twkill_work,
-					     inet_twdr_twkill_work,
-					     &dccp_death_row),
-/* Short-time timewait calendar */
-
-	.twcal_hand	= -1,
-	.twcal_timer	= TIMER_INITIALIZER(inet_twdr_twcal_tick, 0,
-					    (unsigned long)&dccp_death_row),
-};
-
-void dccp_time_wait(struct sock *sk, int state, int timeo)
-{
-	struct inet_timewait_sock *tw = NULL;
-
-	if (dccp_death_row.tw_count < dccp_death_row.sysctl_max_tw_buckets)
-		tw = inet_twsk_alloc(sk, state);
-
-	if (tw != NULL) {
-		const struct inet_connection_sock *icsk = inet_csk(sk);
-		const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
-
-		/* Linkage updates. */
-		__inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
-
-		/* Get the TIME_WAIT timeout firing. */
-		if (timeo < rto)
-			timeo = rto;
-
-		tw->tw_timeout = DCCP_TIMEWAIT_LEN;
-		if (state == DCCP_TIME_WAIT)
-			timeo = DCCP_TIMEWAIT_LEN;
-
-		inet_twsk_schedule(tw, &dccp_death_row, timeo,
-				   DCCP_TIMEWAIT_LEN);
-		inet_twsk_put(tw);
-	} else {
-		/* Sorry, if we're out of memory, just CLOSE this
-		 * socket up.  We've got bigger problems than
-		 * non-graceful socket closings.
-		 */
-		LIMIT_NETDEBUG(KERN_INFO "DCCP: time wait bucket "
-					 "table overflow\n");
-	}
-
-	dccp_done(sk);
-}
-
-struct sock *dccp_create_openreq_child(struct sock *sk,
-				       const struct request_sock *req,
-				       const struct sk_buff *skb)
-{
-	/*
-	 * Step 3: Process LISTEN state
-	 *
-	 * // Generate a new socket and switch to that socket
-	 * Set S := new socket for this port pair
-	 */
-	struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC);
-
-	if (newsk != NULL) {
-		const struct dccp_request_sock *dreq = dccp_rsk(req);
-		struct inet_connection_sock *newicsk = inet_csk(sk);
-		struct dccp_sock *newdp = dccp_sk(newsk);
-
-		newdp->dccps_hc_rx_ackpkts = NULL;
-		newdp->dccps_role = DCCP_ROLE_SERVER;
-		newicsk->icsk_rto = DCCP_TIMEOUT_INIT;
-
-		if (newdp->dccps_options.dccpo_send_ack_vector) {
-			newdp->dccps_hc_rx_ackpkts =
-				dccp_ackpkts_alloc(DCCP_MAX_ACK_VECTOR_LEN,
-						   GFP_ATOMIC);
-			/*
-			 * XXX: We're using the same CCIDs set on the parent,
-			 * i.e. sk_clone copied the master sock and left the
-			 * CCID pointers for this child, that is why we do the
-			 * __ccid_get calls.
-			 */
-			if (unlikely(newdp->dccps_hc_rx_ackpkts == NULL))
-				goto out_free;
-		}
-
-		if (unlikely(ccid_hc_rx_init(newdp->dccps_hc_rx_ccid,
-					     newsk) != 0 ||
-			     ccid_hc_tx_init(newdp->dccps_hc_tx_ccid,
-				     	     newsk) != 0)) {
-			dccp_ackpkts_free(newdp->dccps_hc_rx_ackpkts);
-			ccid_hc_rx_exit(newdp->dccps_hc_rx_ccid, newsk);
-			ccid_hc_tx_exit(newdp->dccps_hc_tx_ccid, newsk);
-out_free:
-			/* It is still raw copy of parent, so invalidate
-			 * destructor and make plain sk_free() */
-			newsk->sk_destruct = NULL;
-			sk_free(newsk);
-			return NULL;
-		}
-
-		__ccid_get(newdp->dccps_hc_rx_ccid);
-		__ccid_get(newdp->dccps_hc_tx_ccid);
-
-		/*
-		 * Step 3: Process LISTEN state
-		 *
-		 *	Choose S.ISS (initial seqno) or set from Init Cookie
-		 *	Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init
-		 *	Cookie
-		 */
-
-		/* See dccp_v4_conn_request */
-		newdp->dccps_options.dccpo_sequence_window = req->rcv_wnd;
-
-		newdp->dccps_gar = newdp->dccps_isr = dreq->dreq_isr;
-		dccp_update_gsr(newsk, dreq->dreq_isr);
-
-		newdp->dccps_iss = dreq->dreq_iss;
-		dccp_update_gss(newsk, dreq->dreq_iss);
-
-		/*
-		 * SWL and AWL are initially adjusted so that they are not less than
-		 * the initial Sequence Numbers received and sent, respectively:
-		 *	SWL := max(GSR + 1 - floor(W/4), ISR),
-		 *	AWL := max(GSS - W' + 1, ISS).
-		 * These adjustments MUST be applied only at the beginning of the
-		 * connection.
-		 */
-		dccp_set_seqno(&newdp->dccps_swl,
-			       max48(newdp->dccps_swl, newdp->dccps_isr));
-		dccp_set_seqno(&newdp->dccps_awl,
-			       max48(newdp->dccps_awl, newdp->dccps_iss));
-
-		dccp_init_xmit_timers(newsk);
-
-		DCCP_INC_STATS_BH(DCCP_MIB_PASSIVEOPENS);
-	}
-	return newsk;
-}
-
-/* 
- * Process an incoming packet for RESPOND sockets represented
- * as an request_sock.
- */
-struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
-			    struct request_sock *req,
-			    struct request_sock **prev)
-{
-	struct sock *child = NULL;
-
-	/* Check for retransmitted REQUEST */
-	if (dccp_hdr(skb)->dccph_type == DCCP_PKT_REQUEST) {
-		if (after48(DCCP_SKB_CB(skb)->dccpd_seq,
-			    dccp_rsk(req)->dreq_isr)) {
-			struct dccp_request_sock *dreq = dccp_rsk(req);
-
-			dccp_pr_debug("Retransmitted REQUEST\n");
-			/* Send another RESPONSE packet */
-			dccp_set_seqno(&dreq->dreq_iss, dreq->dreq_iss + 1);
-			dccp_set_seqno(&dreq->dreq_isr,
-				       DCCP_SKB_CB(skb)->dccpd_seq);
-			req->rsk_ops->rtx_syn_ack(sk, req, NULL);
-		}
-		/* Network Duplicate, discard packet */
-		return NULL;
-	}
-
-	DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_PACKET_ERROR;
-
-	if (dccp_hdr(skb)->dccph_type != DCCP_PKT_ACK &&
-	    dccp_hdr(skb)->dccph_type != DCCP_PKT_DATAACK)
-		goto drop;
-
-	/* Invalid ACK */
-	if (DCCP_SKB_CB(skb)->dccpd_ack_seq != dccp_rsk(req)->dreq_iss) {
-		dccp_pr_debug("Invalid ACK number: ack_seq=%llu, "
-			      "dreq_iss=%llu\n",
-			      (unsigned long long)
-			      DCCP_SKB_CB(skb)->dccpd_ack_seq,
-			      (unsigned long long)
-			      dccp_rsk(req)->dreq_iss);
-		goto drop;
-	}
-
-	child = dccp_v4_request_recv_sock(sk, skb, req, NULL);
-	if (child == NULL)
-		goto listen_overflow;
-
-	/* FIXME: deal with options */
-
-	inet_csk_reqsk_queue_unlink(sk, req, prev);
-	inet_csk_reqsk_queue_removed(sk, req);
-	inet_csk_reqsk_queue_add(sk, req, child);
-out:
-	return child;
-listen_overflow:
-	dccp_pr_debug("listen_overflow!\n");
-	DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
-drop:
-	if (dccp_hdr(skb)->dccph_type != DCCP_PKT_RESET)
-		req->rsk_ops->send_reset(skb);
-
-	inet_csk_reqsk_queue_drop(sk, req, prev);
-	goto out;
-}
-
-/*
- *  Queue segment on the new socket if the new socket is active,
- *  otherwise we just shortcircuit this and continue with
- *  the new socket.
- */
-int dccp_child_process(struct sock *parent, struct sock *child,
-		       struct sk_buff *skb)
-{
-	int ret = 0;
-	const int state = child->sk_state;
-
-	if (!sock_owned_by_user(child)) {
-		ret = dccp_rcv_state_process(child, skb, dccp_hdr(skb),
-					     skb->len);
-
-		/* Wakeup parent, send SIGIO */
-		if (state == DCCP_RESPOND && child->sk_state != state)
-			parent->sk_data_ready(parent, 0);
-	} else {
-		/* Alas, it is possible again, because we do lookup
-		 * in main socket hash table and lock on listening
-		 * socket does not protect us more.
-		 */
-		sk_add_backlog(child, skb);
-	}
-
-	bh_unlock_sock(child);
-	sock_put(child);
-	return ret;
-}
diff --git a/trunk/net/dccp/options.c b/trunk/net/dccp/options.c
deleted file mode 100644
index 382c5894acb2..000000000000
--- a/trunk/net/dccp/options.c
+++ /dev/null
@@ -1,855 +0,0 @@
-/*
- *  net/dccp/options.c
- *
- *  An implementation of the DCCP protocol
- *  Copyright (c) 2005 Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>
- *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
- *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-#include <linux/config.h>
-#include <linux/dccp.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/skbuff.h>
-
-#include "ccid.h"
-#include "dccp.h"
-
-static void dccp_ackpkts_check_rcv_ackvector(struct dccp_ackpkts *ap,
-					     struct sock *sk,
-					     const u64 ackno,
-					     const unsigned char len,
-					     const unsigned char *vector);
-
-/* stores the default values for new connection. may be changed with sysctl */
-static const struct dccp_options dccpo_default_values = {
-	.dccpo_sequence_window	  = DCCPF_INITIAL_SEQUENCE_WINDOW,
-	.dccpo_ccid		  = DCCPF_INITIAL_CCID,
-	.dccpo_send_ack_vector	  = DCCPF_INITIAL_SEND_ACK_VECTOR,
-	.dccpo_send_ndp_count	  = DCCPF_INITIAL_SEND_NDP_COUNT,
-};
-
-void dccp_options_init(struct dccp_options *dccpo)
-{
-	memcpy(dccpo, &dccpo_default_values, sizeof(*dccpo));
-}
-
-static u32 dccp_decode_value_var(const unsigned char *bf, const u8 len)
-{
-	u32 value = 0;
-
-	if (len > 3)
-		value += *bf++ << 24;
-	if (len > 2)
-		value += *bf++ << 16;
-	if (len > 1)
-		value += *bf++ << 8;
-	if (len > 0)
-		value += *bf;
-
-	return value;
-}
-
-int dccp_parse_options(struct sock *sk, struct sk_buff *skb)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-#ifdef CONFIG_IP_DCCP_DEBUG
-	const char *debug_prefix = dp->dccps_role == DCCP_ROLE_CLIENT ?
-					"CLIENT rx opt: " : "server rx opt: ";
-#endif
-	const struct dccp_hdr *dh = dccp_hdr(skb);
-	const u8 pkt_type = DCCP_SKB_CB(skb)->dccpd_type;
-	unsigned char *options = (unsigned char *)dh + dccp_hdr_len(skb);
-	unsigned char *opt_ptr = options;
-	const unsigned char *opt_end = (unsigned char *)dh +
-					(dh->dccph_doff * 4);
-	struct dccp_options_received *opt_recv = &dp->dccps_options_received;
-	unsigned char opt, len;
-	unsigned char *value;
-
-	memset(opt_recv, 0, sizeof(*opt_recv));
-
-	while (opt_ptr != opt_end) {
-		opt   = *opt_ptr++;
-		len   = 0;
-		value = NULL;
-
-		/* Check if this isn't a single byte option */
-		if (opt > DCCPO_MAX_RESERVED) {
-			if (opt_ptr == opt_end)
-				goto out_invalid_option;
-
-			len = *opt_ptr++;
-			if (len < 3)
-				goto out_invalid_option;
-			/*
-			 * Remove the type and len fields, leaving
-			 * just the value size
-			 */
-			len	-= 2;
-			value	= opt_ptr;
-			opt_ptr += len;
-
-			if (opt_ptr > opt_end)
-				goto out_invalid_option;
-		}
-
-		switch (opt) {
-		case DCCPO_PADDING:
-			break;
-		case DCCPO_NDP_COUNT:
-			if (len > 3)
-				goto out_invalid_option;
-
-			opt_recv->dccpor_ndp = dccp_decode_value_var(value, len);
-			dccp_pr_debug("%sNDP count=%d\n", debug_prefix,
-				      opt_recv->dccpor_ndp);
-			break;
-		case DCCPO_ACK_VECTOR_0:
-			if (len > DCCP_MAX_ACK_VECTOR_LEN)
-				goto out_invalid_option;
-
-			if (pkt_type == DCCP_PKT_DATA)
-				continue;
-
-			opt_recv->dccpor_ack_vector_len = len;
-			opt_recv->dccpor_ack_vector_idx = value - options;
-
-			dccp_pr_debug("%sACK vector 0, len=%d, ack_ackno=%llu\n",
-				      debug_prefix, len,
-				      (unsigned long long)
-				      DCCP_SKB_CB(skb)->dccpd_ack_seq);
-			dccp_ackvector_print(DCCP_SKB_CB(skb)->dccpd_ack_seq,
-					     value, len);
-			dccp_ackpkts_check_rcv_ackvector(dp->dccps_hc_rx_ackpkts,
-							 sk,
-						 DCCP_SKB_CB(skb)->dccpd_ack_seq,
-							 len, value);
-			break;
-		case DCCPO_TIMESTAMP:
-			if (len != 4)
-				goto out_invalid_option;
-
-			opt_recv->dccpor_timestamp = ntohl(*(u32 *)value);
-
-			dp->dccps_timestamp_echo = opt_recv->dccpor_timestamp;
-			do_gettimeofday(&dp->dccps_timestamp_time);
-
-			dccp_pr_debug("%sTIMESTAMP=%u, ackno=%llu\n",
-				      debug_prefix, opt_recv->dccpor_timestamp,
-				      (unsigned long long)
-				      DCCP_SKB_CB(skb)->dccpd_ack_seq);
-			break;
-		case DCCPO_TIMESTAMP_ECHO:
-			if (len != 4 && len != 6 && len != 8)
-				goto out_invalid_option;
-
-			opt_recv->dccpor_timestamp_echo = ntohl(*(u32 *)value);
-
-			dccp_pr_debug("%sTIMESTAMP_ECHO=%u, len=%d, ackno=%llu, ",
-				      debug_prefix,
-				      opt_recv->dccpor_timestamp_echo,
-				      len + 2,
-				      (unsigned long long)
-				      DCCP_SKB_CB(skb)->dccpd_ack_seq);
-
-			if (len > 4) {
-				if (len == 6)
-					opt_recv->dccpor_elapsed_time =
-						 ntohs(*(u16 *)(value + 4));
-				else
-					opt_recv->dccpor_elapsed_time =
-						 ntohl(*(u32 *)(value + 4));
-
-				dccp_pr_debug("%sTIMESTAMP_ECHO ELAPSED_TIME=%d\n",
-				      debug_prefix,
-				      opt_recv->dccpor_elapsed_time);
-			}
-			break;
-		case DCCPO_ELAPSED_TIME:
-			if (len != 2 && len != 4)
-				goto out_invalid_option;
-
-			if (pkt_type == DCCP_PKT_DATA)
-				continue;
-
-			if (len == 2)
-				opt_recv->dccpor_elapsed_time =
-							ntohs(*(u16 *)value);
-			else
-				opt_recv->dccpor_elapsed_time =
-							ntohl(*(u32 *)value);
-
-			dccp_pr_debug("%sELAPSED_TIME=%d\n", debug_prefix,
-				      opt_recv->dccpor_elapsed_time);
-			break;
-			/*
-			 * From draft-ietf-dccp-spec-11.txt:
-			 *
-			 *	Option numbers 128 through 191 are for
-			 *	options sent from the HC-Sender to the
-			 *	HC-Receiver; option numbers 192 through 255
-			 *	are for options sent from the HC-Receiver to
-			 *	the HC-Sender.
-			 */
-		case 128 ... 191: {
-			const u16 idx = value - options;
-
-			if (ccid_hc_rx_parse_options(dp->dccps_hc_rx_ccid, sk,
-						     opt, len, idx,
-						     value) != 0)
-				goto out_invalid_option;
-		}
-			break;
-		case 192 ... 255: {
-			const u16 idx = value - options;
-
-			if (ccid_hc_tx_parse_options(dp->dccps_hc_tx_ccid, sk,
-						     opt, len, idx,
-						     value) != 0)
-				goto out_invalid_option;
-		}
-			break;
-		default:
-			pr_info("DCCP(%p): option %d(len=%d) not "
-				"implemented, ignoring\n",
-				sk, opt, len);
-			break;
-	        }
-	}
-
-	return 0;
-
-out_invalid_option:
-	DCCP_INC_STATS_BH(DCCP_MIB_INVALIDOPT);
-	DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_OPTION_ERROR;
-	pr_info("DCCP(%p): invalid option %d, len=%d\n", sk, opt, len);
-	return -1;
-}
-
-static void dccp_encode_value_var(const u32 value, unsigned char *to,
-				  const unsigned int len)
-{
-	if (len > 3)
-		*to++ = (value & 0xFF000000) >> 24;
-	if (len > 2)
-		*to++ = (value & 0xFF0000) >> 16;
-	if (len > 1)
-		*to++ = (value & 0xFF00) >> 8;
-	if (len > 0)
-		*to++ = (value & 0xFF);
-}
-
-static inline int dccp_ndp_len(const int ndp)
-{
-	return likely(ndp <= 0xFF) ? 1 : ndp <= 0xFFFF ? 2 : 3;
-}
-
-void dccp_insert_option(struct sock *sk, struct sk_buff *skb,
-			const unsigned char option,
-			const void *value, const unsigned char len)
-{
-	unsigned char *to;
-
-	if (DCCP_SKB_CB(skb)->dccpd_opt_len + len + 2 > DCCP_MAX_OPT_LEN) {
-		LIMIT_NETDEBUG(KERN_INFO "DCCP: packet too small to insert "
-			       "%d option!\n", option);
-		return;
-	}
-
-	DCCP_SKB_CB(skb)->dccpd_opt_len += len + 2;
-
-	to    = skb_push(skb, len + 2);
-	*to++ = option;
-	*to++ = len + 2;
-
-	memcpy(to, value, len);
-}
-
-EXPORT_SYMBOL_GPL(dccp_insert_option);
-
-static void dccp_insert_option_ndp(struct sock *sk, struct sk_buff *skb)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	int ndp = dp->dccps_ndp_count;
-
-	if (dccp_non_data_packet(skb))
-		++dp->dccps_ndp_count;
-	else
-		dp->dccps_ndp_count = 0;
-
-	if (ndp > 0) {
-		unsigned char *ptr;
-		const int ndp_len = dccp_ndp_len(ndp);
-		const int len = ndp_len + 2;
-
-		if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN)
-			return;
-
-		DCCP_SKB_CB(skb)->dccpd_opt_len += len;
-
-		ptr = skb_push(skb, len);
-		*ptr++ = DCCPO_NDP_COUNT;
-		*ptr++ = len;
-		dccp_encode_value_var(ndp, ptr, ndp_len);
-	}
-}
-
-static inline int dccp_elapsed_time_len(const u32 elapsed_time)
-{
-	return elapsed_time == 0 ? 0 : elapsed_time <= 0xFFFF ? 2 : 4;
-}
-
-void dccp_insert_option_elapsed_time(struct sock *sk,
-				     struct sk_buff *skb,
-				     u32 elapsed_time)
-{
-#ifdef CONFIG_IP_DCCP_DEBUG
-	struct dccp_sock *dp = dccp_sk(sk);
-	const char *debug_prefix = dp->dccps_role == DCCP_ROLE_CLIENT ?
-					"CLIENT TX opt: " : "server TX opt: ";
-#endif
-	const int elapsed_time_len = dccp_elapsed_time_len(elapsed_time);
-	const int len = 2 + elapsed_time_len;
-	unsigned char *to;
-
-	if (elapsed_time_len == 0)
-		return;
-
-	if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) {
-		LIMIT_NETDEBUG(KERN_INFO "DCCP: packet too small to "
-					 "insert elapsed time!\n");
-		return;
-	}
-
-	DCCP_SKB_CB(skb)->dccpd_opt_len += len;
-
-	to    = skb_push(skb, len);
-	*to++ = DCCPO_ELAPSED_TIME;
-	*to++ = len;
-
-	if (elapsed_time_len == 2) {
-		const u16 var16 = htons((u16)elapsed_time);
-		memcpy(to, &var16, 2);
-	} else {
-		const u32 var32 = htonl(elapsed_time);
-		memcpy(to, &var32, 4);
-	}
-
-	dccp_pr_debug("%sELAPSED_TIME=%u, len=%d, seqno=%llu\n",
-		      debug_prefix, elapsed_time,
-		      len,
-		      (unsigned long long) DCCP_SKB_CB(skb)->dccpd_seq);
-}
-
-EXPORT_SYMBOL_GPL(dccp_insert_option_elapsed_time);
-
-static void dccp_insert_option_ack_vector(struct sock *sk, struct sk_buff *skb)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-#ifdef CONFIG_IP_DCCP_DEBUG
-	const char *debug_prefix = dp->dccps_role == DCCP_ROLE_CLIENT ?
-					"CLIENT TX opt: " : "server TX opt: ";
-#endif
-	struct dccp_ackpkts *ap = dp->dccps_hc_rx_ackpkts;
-	int len = ap->dccpap_buf_vector_len + 2;
-	const u32 elapsed_time = timeval_now_delta(&ap->dccpap_time) / 10;
-	unsigned char *to, *from;
-
-	if (elapsed_time != 0)
-		dccp_insert_option_elapsed_time(sk, skb, elapsed_time);
-
-	if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) {
-		LIMIT_NETDEBUG(KERN_INFO "DCCP: packet too small to "
-					 "insert ACK Vector!\n");
-		return;
-	}
-
-	/*
-	 * XXX: now we have just one ack vector sent record, so
-	 * we have to wait for it to be cleared.
-	 *
-	 * Of course this is not acceptable, but this is just for
-	 * basic testing now.
-	 */
-	if (ap->dccpap_ack_seqno != DCCP_MAX_SEQNO + 1)
-		return;
-
-	DCCP_SKB_CB(skb)->dccpd_opt_len += len;
-
-	to    = skb_push(skb, len);
-	*to++ = DCCPO_ACK_VECTOR_0;
-	*to++ = len;
-
-	len  = ap->dccpap_buf_vector_len;
-	from = ap->dccpap_buf + ap->dccpap_buf_head;
-
-	/* Check if buf_head wraps */
-	if (ap->dccpap_buf_head + len > ap->dccpap_buf_len) {
-		const unsigned int tailsize = (ap->dccpap_buf_len -
-					       ap->dccpap_buf_head);
-
-		memcpy(to, from, tailsize);
-		to   += tailsize;
-		len  -= tailsize;
-		from = ap->dccpap_buf;
-	}
-
-	memcpy(to, from, len);
-	/*
-	 *	From draft-ietf-dccp-spec-11.txt:
-	 *
-	 *	For each acknowledgement it sends, the HC-Receiver will add an
-	 *	acknowledgement record.  ack_seqno will equal the HC-Receiver
-	 *	sequence number it used for the ack packet; ack_ptr will equal
-	 *	buf_head; ack_ackno will equal buf_ackno; and ack_nonce will
-	 *	equal buf_nonce.
-	 *
-	 * This implemention uses just one ack record for now.
-	 */
-	ap->dccpap_ack_seqno	  = DCCP_SKB_CB(skb)->dccpd_seq;
-	ap->dccpap_ack_ptr	  = ap->dccpap_buf_head;
-	ap->dccpap_ack_ackno	  = ap->dccpap_buf_ackno;
-	ap->dccpap_ack_nonce	  = ap->dccpap_buf_nonce;
-	ap->dccpap_ack_vector_len = ap->dccpap_buf_vector_len;
-
-	dccp_pr_debug("%sACK Vector 0, len=%d, ack_seqno=%llu, "
-		      "ack_ackno=%llu\n",
-		      debug_prefix, ap->dccpap_ack_vector_len,
-		      (unsigned long long) ap->dccpap_ack_seqno,
-		      (unsigned long long) ap->dccpap_ack_ackno);
-}
-
-void dccp_insert_option_timestamp(struct sock *sk, struct sk_buff *skb)
-{
-	struct timeval tv;
-	u32 now;
-	
-	do_gettimeofday(&tv);
-	now = (tv.tv_sec * USEC_PER_SEC + tv.tv_usec) / 10;
-	/* yes this will overflow but that is the point as we want a
-	 * 10 usec 32 bit timer which mean it wraps every 11.9 hours */
-
-	now = htonl(now);
-	dccp_insert_option(sk, skb, DCCPO_TIMESTAMP, &now, sizeof(now));
-}
-
-EXPORT_SYMBOL_GPL(dccp_insert_option_timestamp);
-
-static void dccp_insert_option_timestamp_echo(struct sock *sk,
-					      struct sk_buff *skb)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-#ifdef CONFIG_IP_DCCP_DEBUG
-	const char *debug_prefix = dp->dccps_role == DCCP_ROLE_CLIENT ?
-					"CLIENT TX opt: " : "server TX opt: ";
-#endif
-	u32 tstamp_echo;
-	const u32 elapsed_time =
-			timeval_now_delta(&dp->dccps_timestamp_time) / 10;
-	const int elapsed_time_len = dccp_elapsed_time_len(elapsed_time);
-	const int len = 6 + elapsed_time_len;
-	unsigned char *to;
-
-	if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) {
-		LIMIT_NETDEBUG(KERN_INFO "DCCP: packet too small to insert "
-					 "timestamp echo!\n");
-		return;
-	}
-
-	DCCP_SKB_CB(skb)->dccpd_opt_len += len;
-
-	to    = skb_push(skb, len);
-	*to++ = DCCPO_TIMESTAMP_ECHO;
-	*to++ = len;
-
-	tstamp_echo = htonl(dp->dccps_timestamp_echo);
-	memcpy(to, &tstamp_echo, 4);
-	to += 4;
-	
-	if (elapsed_time_len == 2) {
-		const u16 var16 = htons((u16)elapsed_time);
-		memcpy(to, &var16, 2);
-	} else if (elapsed_time_len == 4) {
-		const u32 var32 = htonl(elapsed_time);
-		memcpy(to, &var32, 4);
-	}
-
-	dccp_pr_debug("%sTIMESTAMP_ECHO=%u, len=%d, seqno=%llu\n",
-		      debug_prefix, dp->dccps_timestamp_echo,
-		      len,
-		      (unsigned long long) DCCP_SKB_CB(skb)->dccpd_seq);
-
-	dp->dccps_timestamp_echo = 0;
-	dp->dccps_timestamp_time.tv_sec = 0;
-	dp->dccps_timestamp_time.tv_usec = 0;
-}
-
-void dccp_insert_options(struct sock *sk, struct sk_buff *skb)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-
-	DCCP_SKB_CB(skb)->dccpd_opt_len = 0;
-
-	if (dp->dccps_options.dccpo_send_ndp_count)
-		dccp_insert_option_ndp(sk, skb);
-
-	if (!dccp_packet_without_ack(skb)) {
-		if (dp->dccps_options.dccpo_send_ack_vector &&
-		    (dp->dccps_hc_rx_ackpkts->dccpap_buf_ackno !=
-		     DCCP_MAX_SEQNO + 1))
-			dccp_insert_option_ack_vector(sk, skb);
-
-		if (dp->dccps_timestamp_echo != 0)
-			dccp_insert_option_timestamp_echo(sk, skb);
-	}
-
-	ccid_hc_rx_insert_options(dp->dccps_hc_rx_ccid, sk, skb);
-	ccid_hc_tx_insert_options(dp->dccps_hc_tx_ccid, sk, skb);
-
-	/* XXX: insert other options when appropriate */
-
-	if (DCCP_SKB_CB(skb)->dccpd_opt_len != 0) {
-		/* The length of all options has to be a multiple of 4 */
-		int padding = DCCP_SKB_CB(skb)->dccpd_opt_len % 4;
-
-		if (padding != 0) {
-			padding = 4 - padding;
-			memset(skb_push(skb, padding), 0, padding);
-			DCCP_SKB_CB(skb)->dccpd_opt_len += padding;
-		}
-	}
-}
-
-struct dccp_ackpkts *dccp_ackpkts_alloc(const unsigned int len,
-				        const unsigned int __nocast priority)
-{
-	struct dccp_ackpkts *ap = kmalloc(sizeof(*ap) + len, priority);
-
-	if (ap != NULL) {
-#ifdef CONFIG_IP_DCCP_DEBUG
-		memset(ap->dccpap_buf, 0xFF, len);
-#endif
-		ap->dccpap_buf_len   = len;
-		ap->dccpap_buf_head  =
-			ap->dccpap_buf_tail =
-				ap->dccpap_buf_len - 1;
-		ap->dccpap_buf_ackno =
-			ap->dccpap_ack_ackno =
-				ap->dccpap_ack_seqno = DCCP_MAX_SEQNO + 1;
-		ap->dccpap_buf_nonce = ap->dccpap_buf_nonce = 0;
-		ap->dccpap_ack_ptr   = 0;
-		ap->dccpap_time.tv_sec = 0;
-		ap->dccpap_time.tv_usec = 0;
-		ap->dccpap_buf_vector_len = ap->dccpap_ack_vector_len = 0;
-	}
-
-	return ap;
-}
-
-void dccp_ackpkts_free(struct dccp_ackpkts *ap)
-{
-	if (ap != NULL) {
-#ifdef CONFIG_IP_DCCP_DEBUG
-		memset(ap, 0xFF, sizeof(*ap) + ap->dccpap_buf_len);
-#endif
-		kfree(ap);
-	}
-}
-
-static inline u8 dccp_ackpkts_state(const struct dccp_ackpkts *ap,
-				    const unsigned int index)
-{
-	return ap->dccpap_buf[index] & DCCP_ACKPKTS_STATE_MASK;
-}
-
-static inline u8 dccp_ackpkts_len(const struct dccp_ackpkts *ap,
-				  const unsigned int index)
-{
-	return ap->dccpap_buf[index] & DCCP_ACKPKTS_LEN_MASK;
-}
-
-/*
- * If several packets are missing, the HC-Receiver may prefer to enter multiple
- * bytes with run length 0, rather than a single byte with a larger run length;
- * this simplifies table updates if one of the missing packets arrives.
- */
-static inline int dccp_ackpkts_set_buf_head_state(struct dccp_ackpkts *ap,
-						  const unsigned int packets,
-						  const unsigned char state)
-{
-	unsigned int gap;
-	signed long new_head;
-
-	if (ap->dccpap_buf_vector_len + packets > ap->dccpap_buf_len)
-		return -ENOBUFS;
-
-	gap	 = packets - 1;
-	new_head = ap->dccpap_buf_head - packets;
-
-	if (new_head < 0) {
-		if (gap > 0) {
-			memset(ap->dccpap_buf, DCCP_ACKPKTS_STATE_NOT_RECEIVED,
-			       gap + new_head + 1);
-			gap = -new_head;
-		}
-		new_head += ap->dccpap_buf_len;
-	} 
-
-	ap->dccpap_buf_head = new_head;
-
-	if (gap > 0)
-		memset(ap->dccpap_buf + ap->dccpap_buf_head + 1,
-		       DCCP_ACKPKTS_STATE_NOT_RECEIVED, gap);
-
-	ap->dccpap_buf[ap->dccpap_buf_head] = state;
-	ap->dccpap_buf_vector_len += packets;
-	return 0;
-}
-
-/*
- * Implements the draft-ietf-dccp-spec-11.txt Appendix A
- */
-int dccp_ackpkts_add(struct dccp_ackpkts *ap, u64 ackno, u8 state)
-{
-	/*
-	 * Check at the right places if the buffer is full, if it is, tell the
-	 * caller to start dropping packets till the HC-Sender acks our ACK
-	 * vectors, when we will free up space in dccpap_buf.
-	 *
-	 * We may well decide to do buffer compression, etc, but for now lets
-	 * just drop.
-	 *
-	 * From Appendix A:
-	 *
-	 *	Of course, the circular buffer may overflow, either when the
-	 *	HC-Sender is sending data at a very high rate, when the
-	 *	HC-Receiver's acknowledgements are not reaching the HC-Sender,
-	 *	or when the HC-Sender is forgetting to acknowledge those acks
-	 *	(so the HC-Receiver is unable to clean up old state). In this
-	 *	case, the HC-Receiver should either compress the buffer (by
-	 *	increasing run lengths when possible), transfer its state to
-	 *	a larger buffer, or, as a last resort, drop all received
-	 *	packets, without processing them whatsoever, until its buffer
-	 *	shrinks again.
-	 */
-
-	/* See if this is the first ackno being inserted */
-	if (ap->dccpap_buf_vector_len == 0) {
-		ap->dccpap_buf[ap->dccpap_buf_head] = state;
-		ap->dccpap_buf_vector_len = 1;
-	} else if (after48(ackno, ap->dccpap_buf_ackno)) {
-		const u64 delta = dccp_delta_seqno(ap->dccpap_buf_ackno,
-						   ackno);
-
-		/*
-		 * Look if the state of this packet is the same as the
-		 * previous ackno and if so if we can bump the head len.
-		 */
-		if (delta == 1 &&
-		    dccp_ackpkts_state(ap, ap->dccpap_buf_head) == state &&
-		    (dccp_ackpkts_len(ap, ap->dccpap_buf_head) <
-		     DCCP_ACKPKTS_LEN_MASK))
-			ap->dccpap_buf[ap->dccpap_buf_head]++;
-		else if (dccp_ackpkts_set_buf_head_state(ap, delta, state))
-			return -ENOBUFS;
-	} else {
-		/*
-		 * A.1.2.  Old Packets
-		 *
-		 *	When a packet with Sequence Number S arrives, and
-		 *	S <= buf_ackno, the HC-Receiver will scan the table
-		 *	for the byte corresponding to S. (Indexing structures
-		 *	could reduce the complexity of this scan.)
-		 */
-		u64 delta = dccp_delta_seqno(ackno, ap->dccpap_buf_ackno);
-		unsigned int index = ap->dccpap_buf_head;
-
-		while (1) {
-			const u8 len = dccp_ackpkts_len(ap, index);
-			const u8 state = dccp_ackpkts_state(ap, index);
-			/*
-			 * valid packets not yet in dccpap_buf have a reserved
-			 * entry, with a len equal to 0.
-			 */
-			if (state == DCCP_ACKPKTS_STATE_NOT_RECEIVED &&
-			    len == 0 && delta == 0) { /* Found our
-							 reserved seat! */
-				dccp_pr_debug("Found %llu reserved seat!\n",
-					      (unsigned long long) ackno);
-				ap->dccpap_buf[index] = state;
-				goto out;
-			}
-			/* len == 0 means one packet */
-			if (delta < len + 1)
-				goto out_duplicate;
-
-			delta -= len + 1;
-			if (++index == ap->dccpap_buf_len)
-				index = 0;
-		}
-	}
-
-	ap->dccpap_buf_ackno = ackno;
-	do_gettimeofday(&ap->dccpap_time);
-out:
-	dccp_pr_debug("");
-	dccp_ackpkts_print(ap);
-	return 0;
-
-out_duplicate:
-	/* Duplicate packet */
-	dccp_pr_debug("Received a dup or already considered lost "
-		      "packet: %llu\n", (unsigned long long) ackno);
-	return -EILSEQ;
-}
-
-#ifdef CONFIG_IP_DCCP_DEBUG
-void dccp_ackvector_print(const u64 ackno, const unsigned char *vector,
-			  int len)
-{
-	if (!dccp_debug)
-		return;
-
-	printk("ACK vector len=%d, ackno=%llu |", len,
-	       (unsigned long long) ackno);
-
-	while (len--) {
-		const u8 state = (*vector & DCCP_ACKPKTS_STATE_MASK) >> 6;
-		const u8 rl = (*vector & DCCP_ACKPKTS_LEN_MASK);
-
-		printk("%d,%d|", state, rl);
-		++vector;
-	}
-
-	printk("\n");
-}
-
-void dccp_ackpkts_print(const struct dccp_ackpkts *ap)
-{
-	dccp_ackvector_print(ap->dccpap_buf_ackno,
-			     ap->dccpap_buf + ap->dccpap_buf_head,
-			     ap->dccpap_buf_vector_len);
-}
-#endif
-
-static void dccp_ackpkts_trow_away_ack_record(struct dccp_ackpkts *ap)
-{
-	/*
-	 * As we're keeping track of the ack vector size
-	 * (dccpap_buf_vector_len) and the sent ack vector size
-	 * (dccpap_ack_vector_len) we don't need dccpap_buf_tail at all, but
-	 * keep this code here as in the future we'll implement a vector of
-	 * ack records, as suggested in draft-ietf-dccp-spec-11.txt
-	 * Appendix A. -acme
-	 */
-#if 0
-	ap->dccpap_buf_tail = ap->dccpap_ack_ptr + 1;
-	if (ap->dccpap_buf_tail >= ap->dccpap_buf_len)
-		ap->dccpap_buf_tail -= ap->dccpap_buf_len;
-#endif
-	ap->dccpap_buf_vector_len -= ap->dccpap_ack_vector_len;
-}
-
-void dccp_ackpkts_check_rcv_ackno(struct dccp_ackpkts *ap, struct sock *sk,
-				 u64 ackno)
-{
-	/* Check if we actually sent an ACK vector */
-	if (ap->dccpap_ack_seqno == DCCP_MAX_SEQNO + 1)
-		return;
-
-	if (ackno == ap->dccpap_ack_seqno) {
-#ifdef CONFIG_IP_DCCP_DEBUG
-		struct dccp_sock *dp = dccp_sk(sk);
-		const char *debug_prefix = dp->dccps_role == DCCP_ROLE_CLIENT ?
-					"CLIENT rx ack: " : "server rx ack: ";
-#endif
-		dccp_pr_debug("%sACK packet 0, len=%d, ack_seqno=%llu, "
-			      "ack_ackno=%llu, ACKED!\n",
-			      debug_prefix, 1,
-			      (unsigned long long) ap->dccpap_ack_seqno,
-			      (unsigned long long) ap->dccpap_ack_ackno);
-		dccp_ackpkts_trow_away_ack_record(ap);
-		ap->dccpap_ack_seqno = DCCP_MAX_SEQNO + 1;
-	}
-}
-
-static void dccp_ackpkts_check_rcv_ackvector(struct dccp_ackpkts *ap,
-					     struct sock *sk, u64 ackno,
-					     const unsigned char len,
-					     const unsigned char *vector)
-{
-	unsigned char i;
-
-	/* Check if we actually sent an ACK vector */
-	if (ap->dccpap_ack_seqno == DCCP_MAX_SEQNO + 1)
-		return;
-	/*
-	 * We're in the receiver half connection, so if the received an ACK
-	 * vector ackno (e.g. 50) before dccpap_ack_seqno (e.g. 52), we're
-	 * not interested.
-	 *
-	 * Extra explanation with example:
-	 * 
-	 * if we received an ACK vector with ackno 50, it can only be acking
-	 * 50, 49, 48, etc, not 52 (the seqno for the ACK vector we sent).
-	 */
-	/* dccp_pr_debug("is %llu < %llu? ", ackno, ap->dccpap_ack_seqno); */
-	if (before48(ackno, ap->dccpap_ack_seqno)) {
-		/* dccp_pr_debug_cat("yes\n"); */
-		return;
-	}
-	/* dccp_pr_debug_cat("no\n"); */
-
-	i = len;
-	while (i--) {
-		const u8 rl = (*vector & DCCP_ACKPKTS_LEN_MASK);
-		u64 ackno_end_rl;
-
-		dccp_set_seqno(&ackno_end_rl, ackno - rl);
-
-		/*
-		 * dccp_pr_debug("is %llu <= %llu <= %llu? ", ackno_end_rl,
-		 * ap->dccpap_ack_seqno, ackno);
-		 */
-		if (between48(ap->dccpap_ack_seqno, ackno_end_rl, ackno)) {
-			const u8 state = (*vector &
-					  DCCP_ACKPKTS_STATE_MASK) >> 6;
-			/* dccp_pr_debug_cat("yes\n"); */
-
-			if (state != DCCP_ACKPKTS_STATE_NOT_RECEIVED) {
-#ifdef CONFIG_IP_DCCP_DEBUG
-				struct dccp_sock *dp = dccp_sk(sk);
-				const char *debug_prefix =
-					dp->dccps_role == DCCP_ROLE_CLIENT ?
-					"CLIENT rx ack: " : "server rx ack: ";
-#endif
-				dccp_pr_debug("%sACK vector 0, len=%d, "
-					      "ack_seqno=%llu, ack_ackno=%llu, "
-					      "ACKED!\n",
-					      debug_prefix, len,
-					      (unsigned long long)
-					      ap->dccpap_ack_seqno,
-					      (unsigned long long)
-					      ap->dccpap_ack_ackno);
-				dccp_ackpkts_trow_away_ack_record(ap);
-			}
-			/*
-			 * If dccpap_ack_seqno was not received, no problem
-			 * we'll send another ACK vector.
-			 */
-			ap->dccpap_ack_seqno = DCCP_MAX_SEQNO + 1;
-			break;
-		}
-		/* dccp_pr_debug_cat("no\n"); */
-
-		dccp_set_seqno(&ackno, ackno_end_rl - 1);
-		++vector;
-	}
-}
diff --git a/trunk/net/dccp/output.c b/trunk/net/dccp/output.c
deleted file mode 100644
index 28de157a4326..000000000000
--- a/trunk/net/dccp/output.c
+++ /dev/null
@@ -1,528 +0,0 @@
-/*
- *  net/dccp/output.c
- * 
- *  An implementation of the DCCP protocol
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *	This program is free software; you can redistribute it and/or
- *	modify it under the terms of the GNU General Public License
- *	as published by the Free Software Foundation; either version
- *	2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/dccp.h>
-#include <linux/skbuff.h>
-
-#include <net/sock.h>
-
-#include "ccid.h"
-#include "dccp.h"
-
-static inline void dccp_event_ack_sent(struct sock *sk)
-{
-	inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
-}
-
-/*
- * All SKB's seen here are completely headerless. It is our
- * job to build the DCCP header, and pass the packet down to
- * IP so it can do the same plus pass the packet off to the
- * device.
- */
-int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
-{
-	if (likely(skb != NULL)) {
-		const struct inet_sock *inet = inet_sk(sk);
-		struct dccp_sock *dp = dccp_sk(sk);
-		struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
-		struct dccp_hdr *dh;
-		/* XXX For now we're using only 48 bits sequence numbers */
-		const int dccp_header_size = sizeof(*dh) +
-					     sizeof(struct dccp_hdr_ext) +
-					  dccp_packet_hdr_len(dcb->dccpd_type);
-		int err, set_ack = 1;
-		u64 ackno = dp->dccps_gsr;
-
-		dccp_inc_seqno(&dp->dccps_gss);
-
-		switch (dcb->dccpd_type) {
-		case DCCP_PKT_DATA:
-			set_ack = 0;
-			break;
-		case DCCP_PKT_SYNC:
-		case DCCP_PKT_SYNCACK:
-			ackno = dcb->dccpd_seq;
-			break;
-		}
-
-		dcb->dccpd_seq = dp->dccps_gss;
-		dccp_insert_options(sk, skb);
-		
-		skb->h.raw = skb_push(skb, dccp_header_size);
-		dh = dccp_hdr(skb);
-		/*
-		 * Data packets are not cloned as they are never retransmitted
-		 */
-		if (skb_cloned(skb))
-			skb_set_owner_w(skb, sk);
-
-		/* Build DCCP header and checksum it. */
-		memset(dh, 0, dccp_header_size);
-		dh->dccph_type	= dcb->dccpd_type;
-		dh->dccph_sport	= inet->sport;
-		dh->dccph_dport	= inet->dport;
-		dh->dccph_doff	= (dccp_header_size + dcb->dccpd_opt_len) / 4;
-		dh->dccph_ccval	= dcb->dccpd_ccval;
-		/* XXX For now we're using only 48 bits sequence numbers */
-		dh->dccph_x	= 1;
-
-		dp->dccps_awh = dp->dccps_gss;
-		dccp_hdr_set_seq(dh, dp->dccps_gss);
-		if (set_ack)
-			dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), ackno);
-
-		switch (dcb->dccpd_type) {
-		case DCCP_PKT_REQUEST:
-			dccp_hdr_request(skb)->dccph_req_service =
-							dcb->dccpd_service;
-			break;
-		case DCCP_PKT_RESET:
-			dccp_hdr_reset(skb)->dccph_reset_code =
-							dcb->dccpd_reset_code;
-			break;
-		}
-
-		dh->dccph_checksum = dccp_v4_checksum(skb, inet->saddr,
-						      inet->daddr);
-
-		if (set_ack)
-			dccp_event_ack_sent(sk);
-
-		DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
-
-		err = ip_queue_xmit(skb, 0);
-		if (err <= 0)
-			return err;
-
-		/* NET_XMIT_CN is special. It does not guarantee,
-		 * that this packet is lost. It tells that device
-		 * is about to start to drop packets or already
-		 * drops some packets of the same priority and
-		 * invokes us to send less aggressively.
-		 */
-		return err == NET_XMIT_CN ? 0 : err;
-	}
-	return -ENOBUFS;
-}
-
-unsigned int dccp_sync_mss(struct sock *sk, u32 pmtu)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	int mss_now;
-
-	/*
-	 * FIXME: we really should be using the af_specific thing to support
-	 * 	  IPv6.
-	 * mss_now = pmtu - tp->af_specific->net_header_len -
-	 * 	     sizeof(struct dccp_hdr) - sizeof(struct dccp_hdr_ext);
-	 */
-	mss_now = pmtu - sizeof(struct iphdr) - sizeof(struct dccp_hdr) -
-		  sizeof(struct dccp_hdr_ext);
-
-	/* Now subtract optional transport overhead */
-	mss_now -= dp->dccps_ext_header_len;
-
-	/*
-	 * FIXME: this should come from the CCID infrastructure, where, say,
-	 * TFRC will say it wants TIMESTAMPS, ELAPSED time, etc, for now lets
-	 * put a rough estimate for NDP + TIMESTAMP + TIMESTAMP_ECHO + ELAPSED
-	 * TIME + TFRC_OPT_LOSS_EVENT_RATE + TFRC_OPT_RECEIVE_RATE + padding to
-	 * make it a multiple of 4
-	 */
-
-	mss_now -= ((5 + 6 + 10 + 6 + 6 + 6 + 3) / 4) * 4;
-
-	/* And store cached results */
-	dp->dccps_pmtu_cookie = pmtu;
-	dp->dccps_mss_cache = mss_now;
-
-	return mss_now;
-}
-
-void dccp_write_space(struct sock *sk)
-{
-	read_lock(&sk->sk_callback_lock);
-
-	if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-		wake_up_interruptible(sk->sk_sleep);
-	/* Should agree with poll, otherwise some programs break */
-	if (sock_writeable(sk))
-		sk_wake_async(sk, 2, POLL_OUT);
-
-	read_unlock(&sk->sk_callback_lock);
-}
-
-/**
- * dccp_wait_for_ccid - Wait for ccid to tell us we can send a packet
- * @sk: socket to wait for
- * @timeo: for how long
- */
-static int dccp_wait_for_ccid(struct sock *sk, struct sk_buff *skb,
-			      long *timeo)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	DEFINE_WAIT(wait);
-	long delay;
-	int rc;
-
-	while (1) {
-		prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
-
-		if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
-			goto do_error;
-		if (!*timeo)
-			goto do_nonblock;
-		if (signal_pending(current))
-			goto do_interrupted;
-
-		rc = ccid_hc_tx_send_packet(dp->dccps_hc_tx_ccid, sk, skb,
-					    skb->len);
-		if (rc <= 0)
-			break;
-		delay = msecs_to_jiffies(rc);
-		if (delay > *timeo || delay < 0)
-			goto do_nonblock;
-
-		sk->sk_write_pending++;
-		release_sock(sk);
-		*timeo -= schedule_timeout(delay);
-		lock_sock(sk);
-		sk->sk_write_pending--;
-	}
-out:
-	finish_wait(sk->sk_sleep, &wait);
-	return rc;
-
-do_error:
-	rc = -EPIPE;
-	goto out;
-do_nonblock:
-	rc = -EAGAIN;
-	goto out;
-do_interrupted:
-	rc = sock_intr_errno(*timeo);
-	goto out;
-}
-
-int dccp_write_xmit(struct sock *sk, struct sk_buff *skb, long *timeo)
-{
-	const struct dccp_sock *dp = dccp_sk(sk);
-	int err = ccid_hc_tx_send_packet(dp->dccps_hc_tx_ccid, sk, skb,
-					 skb->len);
-
-	if (err > 0)
-		err = dccp_wait_for_ccid(sk, skb, timeo);
-
-	if (err == 0) {
-		const struct dccp_ackpkts *ap = dp->dccps_hc_rx_ackpkts;
-		struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
-		const int len = skb->len;
-
-		if (sk->sk_state == DCCP_PARTOPEN) {
-			/* See 8.1.5.  Handshake Completion */
-			inet_csk_schedule_ack(sk);
-			inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-						  inet_csk(sk)->icsk_rto,
-						  DCCP_RTO_MAX);
-			dcb->dccpd_type = DCCP_PKT_DATAACK;
-			/*
-			 * FIXME: we really should have a
-			 * dccps_ack_pending or use icsk.
-			 */
-		} else if (inet_csk_ack_scheduled(sk) ||
-			   dp->dccps_timestamp_echo != 0 ||
-			   (dp->dccps_options.dccpo_send_ack_vector &&
-			    ap->dccpap_buf_ackno != DCCP_MAX_SEQNO + 1 &&
-			    ap->dccpap_ack_seqno == DCCP_MAX_SEQNO + 1))
-			dcb->dccpd_type = DCCP_PKT_DATAACK;
-		else
-			dcb->dccpd_type = DCCP_PKT_DATA;
-
-		err = dccp_transmit_skb(sk, skb);
-		ccid_hc_tx_packet_sent(dp->dccps_hc_tx_ccid, sk, 0, len);
-	}
-
-	return err;
-}
-
-int dccp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
-{
-	if (inet_sk_rebuild_header(sk) != 0)
-		return -EHOSTUNREACH; /* Routing failure or similar. */
-
-	return dccp_transmit_skb(sk, (skb_cloned(skb) ?
-				      pskb_copy(skb, GFP_ATOMIC):
-				      skb_clone(skb, GFP_ATOMIC)));
-}
-
-struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
-				   struct request_sock *req)
-{
-	struct dccp_hdr *dh;
-	const int dccp_header_size = sizeof(struct dccp_hdr) +
-				     sizeof(struct dccp_hdr_ext) +
-				     sizeof(struct dccp_hdr_response);
-	struct sk_buff *skb = sock_wmalloc(sk, MAX_HEADER + DCCP_MAX_OPT_LEN +
-					       dccp_header_size, 1,
-					   GFP_ATOMIC);
-	if (skb == NULL)
-		return NULL;
-
-	/* Reserve space for headers. */
-	skb_reserve(skb, MAX_HEADER + DCCP_MAX_OPT_LEN + dccp_header_size);
-
-	skb->dst = dst_clone(dst);
-	skb->csum = 0;
-
-	DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_RESPONSE;
-	DCCP_SKB_CB(skb)->dccpd_seq  = dccp_rsk(req)->dreq_iss;
-	dccp_insert_options(sk, skb);
-
-	skb->h.raw = skb_push(skb, dccp_header_size);
-
-	dh = dccp_hdr(skb);
-	memset(dh, 0, dccp_header_size);
-
-	dh->dccph_sport	= inet_sk(sk)->sport;
-	dh->dccph_dport	= inet_rsk(req)->rmt_port;
-	dh->dccph_doff	= (dccp_header_size +
-			   DCCP_SKB_CB(skb)->dccpd_opt_len) / 4;
-	dh->dccph_type	= DCCP_PKT_RESPONSE;
-	dh->dccph_x	= 1;
-	dccp_hdr_set_seq(dh, dccp_rsk(req)->dreq_iss);
-	dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), dccp_rsk(req)->dreq_isr);
-
-	dh->dccph_checksum = dccp_v4_checksum(skb, inet_rsk(req)->loc_addr,
-					      inet_rsk(req)->rmt_addr);
-
-	DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
-	return skb;
-}
-
-struct sk_buff *dccp_make_reset(struct sock *sk, struct dst_entry *dst,
-				const enum dccp_reset_codes code)
-				   
-{
-	struct dccp_hdr *dh;
-	struct dccp_sock *dp = dccp_sk(sk);
-	const int dccp_header_size = sizeof(struct dccp_hdr) +
-				     sizeof(struct dccp_hdr_ext) +
-				     sizeof(struct dccp_hdr_reset);
-	struct sk_buff *skb = sock_wmalloc(sk, MAX_HEADER + DCCP_MAX_OPT_LEN +
-					       dccp_header_size, 1,
-					   GFP_ATOMIC);
-	if (skb == NULL)
-		return NULL;
-
-	/* Reserve space for headers. */
-	skb_reserve(skb, MAX_HEADER + DCCP_MAX_OPT_LEN + dccp_header_size);
-
-	skb->dst = dst_clone(dst);
-	skb->csum = 0;
-
-	dccp_inc_seqno(&dp->dccps_gss);
-
-	DCCP_SKB_CB(skb)->dccpd_reset_code = code;
-	DCCP_SKB_CB(skb)->dccpd_type	   = DCCP_PKT_RESET;
-	DCCP_SKB_CB(skb)->dccpd_seq	   = dp->dccps_gss;
-	dccp_insert_options(sk, skb);
-
-	skb->h.raw = skb_push(skb, dccp_header_size);
-
-	dh = dccp_hdr(skb);
-	memset(dh, 0, dccp_header_size);
-
-	dh->dccph_sport	= inet_sk(sk)->sport;
-	dh->dccph_dport	= inet_sk(sk)->dport;
-	dh->dccph_doff	= (dccp_header_size +
-			   DCCP_SKB_CB(skb)->dccpd_opt_len) / 4;
-	dh->dccph_type	= DCCP_PKT_RESET;
-	dh->dccph_x	= 1;
-	dccp_hdr_set_seq(dh, dp->dccps_gss);
-	dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), dp->dccps_gsr);
-
-	dccp_hdr_reset(skb)->dccph_reset_code = code;
-
-	dh->dccph_checksum = dccp_v4_checksum(skb, inet_sk(sk)->saddr,
-					      inet_sk(sk)->daddr);
-
-	DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
-	return skb;
-}
-
-/*
- * Do all connect socket setups that can be done AF independent.
- */
-static inline void dccp_connect_init(struct sock *sk)
-{
-	struct dst_entry *dst = __sk_dst_get(sk);
-	struct inet_connection_sock *icsk = inet_csk(sk);
-
-	sk->sk_err = 0;
-	sock_reset_flag(sk, SOCK_DONE);
-	
-	dccp_sync_mss(sk, dst_mtu(dst));
-
-	/*
-	 * FIXME: set dp->{dccps_swh,dccps_swl}, with
-	 * something like dccp_inc_seq
-	 */
-
-	icsk->icsk_retransmits = 0;
-}
-
-int dccp_connect(struct sock *sk)
-{
-	struct sk_buff *skb;
-	struct inet_connection_sock *icsk = inet_csk(sk);
-
-	dccp_connect_init(sk);
-
-	skb = alloc_skb(MAX_DCCP_HEADER + 15, sk->sk_allocation);
-	if (unlikely(skb == NULL))
-		return -ENOBUFS;
-
-	/* Reserve space for headers. */
-	skb_reserve(skb, MAX_DCCP_HEADER);
-
-	DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_REQUEST;
-	/* FIXME: set service to something meaningful, coming
-	 * from userspace*/
-	DCCP_SKB_CB(skb)->dccpd_service = 0;
-	skb->csum = 0;
-	skb_set_owner_w(skb, sk);
-
-	BUG_TRAP(sk->sk_send_head == NULL);
-	sk->sk_send_head = skb;
-	dccp_transmit_skb(sk, skb_clone(skb, GFP_KERNEL));
-	DCCP_INC_STATS(DCCP_MIB_ACTIVEOPENS);
-
-	/* Timer for repeating the REQUEST until an answer. */
-	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-				  icsk->icsk_rto, DCCP_RTO_MAX);
-	return 0;
-}
-
-void dccp_send_ack(struct sock *sk)
-{
-	/* If we have been reset, we may not send again. */
-	if (sk->sk_state != DCCP_CLOSED) {
-		struct sk_buff *skb = alloc_skb(MAX_DCCP_HEADER, GFP_ATOMIC);
-
-		if (skb == NULL) {
-			inet_csk_schedule_ack(sk);
-			inet_csk(sk)->icsk_ack.ato = TCP_ATO_MIN;
-			inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-						  TCP_DELACK_MAX,
-						  DCCP_RTO_MAX);
-			return;
-		}
-
-		/* Reserve space for headers */
-		skb_reserve(skb, MAX_DCCP_HEADER);
-		skb->csum = 0;
-		DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_ACK;
-		skb_set_owner_w(skb, sk);
-		dccp_transmit_skb(sk, skb);
-	}
-}
-
-EXPORT_SYMBOL_GPL(dccp_send_ack);
-
-void dccp_send_delayed_ack(struct sock *sk)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	/*
-	 * FIXME: tune this timer. elapsed time fixes the skew, so no problem
-	 * with using 2s, and active senders also piggyback the ACK into a
-	 * DATAACK packet, so this is really for quiescent senders.
-	 */
-	unsigned long timeout = jiffies + 2 * HZ;
-
-	/* Use new timeout only if there wasn't a older one earlier. */
-	if (icsk->icsk_ack.pending & ICSK_ACK_TIMER) {
-		/* If delack timer was blocked or is about to expire,
-		 * send ACK now.
-		 *
-		 * FIXME: check the "about to expire" part
-		 */
-		if (icsk->icsk_ack.blocked) {
-			dccp_send_ack(sk);
-			return;
-		}
-
-		if (!time_before(timeout, icsk->icsk_ack.timeout))
-			timeout = icsk->icsk_ack.timeout;
-	}
-	icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER;
-	icsk->icsk_ack.timeout = timeout;
-	sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
-}
-
-void dccp_send_sync(struct sock *sk, const u64 seq,
-		    const enum dccp_pkt_type pkt_type)
-{
-	/*
-	 * We are not putting this on the write queue, so
-	 * dccp_transmit_skb() will set the ownership to this
-	 * sock.
-	 */
-	struct sk_buff *skb = alloc_skb(MAX_DCCP_HEADER, GFP_ATOMIC);
-
-	if (skb == NULL)
-		/* FIXME: how to make sure the sync is sent? */
-		return;
-
-	/* Reserve space for headers and prepare control bits. */
-	skb_reserve(skb, MAX_DCCP_HEADER);
-	skb->csum = 0;
-	DCCP_SKB_CB(skb)->dccpd_type = pkt_type;
-	DCCP_SKB_CB(skb)->dccpd_seq = seq;
-
-	skb_set_owner_w(skb, sk);
-	dccp_transmit_skb(sk, skb);
-}
-
-/*
- * Send a DCCP_PKT_CLOSE/CLOSEREQ. The caller locks the socket for us. This
- * cannot be allowed to fail queueing a DCCP_PKT_CLOSE/CLOSEREQ frame under
- * any circumstances.
- */
-void dccp_send_close(struct sock *sk, const int active)
-{
-	struct dccp_sock *dp = dccp_sk(sk);
-	struct sk_buff *skb;
-	const unsigned int prio = active ? GFP_KERNEL : GFP_ATOMIC;
-
-	skb = alloc_skb(sk->sk_prot->max_header, prio);
-	if (skb == NULL)
-		return;
-
-	/* Reserve space for headers and prepare control bits. */
-	skb_reserve(skb, sk->sk_prot->max_header);
-	skb->csum = 0;
-	DCCP_SKB_CB(skb)->dccpd_type = dp->dccps_role == DCCP_ROLE_CLIENT ?
-					DCCP_PKT_CLOSE : DCCP_PKT_CLOSEREQ;
-
-	skb_set_owner_w(skb, sk);
-	if (active) {
-		BUG_TRAP(sk->sk_send_head == NULL);
-		sk->sk_send_head = skb;
-		dccp_transmit_skb(sk, skb_clone(skb, prio));
-	} else
-		dccp_transmit_skb(sk, skb);
-
-	ccid_hc_rx_exit(dp->dccps_hc_rx_ccid, sk);
-	ccid_hc_tx_exit(dp->dccps_hc_tx_ccid, sk);
-}
diff --git a/trunk/net/dccp/proto.c b/trunk/net/dccp/proto.c
deleted file mode 100644
index 18a0e69c9dc7..000000000000
--- a/trunk/net/dccp/proto.c
+++ /dev/null
@@ -1,826 +0,0 @@
-/*
- *  net/dccp/proto.c
- *
- *  An implementation of the DCCP protocol
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *	This program is free software; you can redistribute it and/or modify it
- *	under the terms of the GNU General Public License version 2 as
- *	published by the Free Software Foundation.
- */
-
-#include <linux/config.h>
-#include <linux/dccp.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/sched.h>
-#include <linux/kernel.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/in.h>
-#include <linux/if_arp.h>
-#include <linux/init.h>
-#include <linux/random.h>
-#include <net/checksum.h>
-
-#include <net/inet_common.h>
-#include <net/ip.h>
-#include <net/protocol.h>
-#include <net/sock.h>
-#include <net/xfrm.h>
-
-#include <asm/semaphore.h>
-#include <linux/spinlock.h>
-#include <linux/timer.h>
-#include <linux/delay.h>
-#include <linux/poll.h>
-#include <linux/dccp.h>
-
-#include "ccid.h"
-#include "dccp.h"
-
-DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
-
-atomic_t dccp_orphan_count = ATOMIC_INIT(0);
-
-static struct net_protocol dccp_protocol = {
-	.handler	= dccp_v4_rcv,
-	.err_handler	= dccp_v4_err,
-};
-
-const char *dccp_packet_name(const int type)
-{
-	static const char *dccp_packet_names[] = {
-		[DCCP_PKT_REQUEST]  = "REQUEST",
-		[DCCP_PKT_RESPONSE] = "RESPONSE",
-		[DCCP_PKT_DATA]	    = "DATA",
-		[DCCP_PKT_ACK]	    = "ACK",
-		[DCCP_PKT_DATAACK]  = "DATAACK",
-		[DCCP_PKT_CLOSEREQ] = "CLOSEREQ",
-		[DCCP_PKT_CLOSE]    = "CLOSE",
-		[DCCP_PKT_RESET]    = "RESET",
-		[DCCP_PKT_SYNC]	    = "SYNC",
-		[DCCP_PKT_SYNCACK]  = "SYNCACK",
-	};
-
-	if (type >= DCCP_NR_PKT_TYPES)
-		return "INVALID";
-	else
-		return dccp_packet_names[type];
-}
-
-EXPORT_SYMBOL_GPL(dccp_packet_name);
-
-const char *dccp_state_name(const int state)
-{
-	static char *dccp_state_names[] = {
-	[DCCP_OPEN]	  = "OPEN",
-	[DCCP_REQUESTING] = "REQUESTING",
-	[DCCP_PARTOPEN]	  = "PARTOPEN",
-	[DCCP_LISTEN]	  = "LISTEN",
-	[DCCP_RESPOND]	  = "RESPOND",
-	[DCCP_CLOSING]	  = "CLOSING",
-	[DCCP_TIME_WAIT]  = "TIME_WAIT",
-	[DCCP_CLOSED]	  = "CLOSED",
-	};
-
-	if (state >= DCCP_MAX_STATES)
-		return "INVALID STATE!";
-	else
-		return dccp_state_names[state];
-}
-
-EXPORT_SYMBOL_GPL(dccp_state_name);
-
-static inline int dccp_listen_start(struct sock *sk)
-{
-	dccp_sk(sk)->dccps_role = DCCP_ROLE_LISTEN;
-	return inet_csk_listen_start(sk, TCP_SYNQ_HSIZE);
-}
-
-int dccp_disconnect(struct sock *sk, int flags)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	struct inet_sock *inet = inet_sk(sk);
-	int err = 0;
-	const int old_state = sk->sk_state;
-
-	if (old_state != DCCP_CLOSED)
-		dccp_set_state(sk, DCCP_CLOSED);
-
-	/* ABORT function of RFC793 */
-	if (old_state == DCCP_LISTEN) {
-		inet_csk_listen_stop(sk);
-	/* FIXME: do the active reset thing */
-	} else if (old_state == DCCP_REQUESTING)
-		sk->sk_err = ECONNRESET;
-
-	dccp_clear_xmit_timers(sk);
-	__skb_queue_purge(&sk->sk_receive_queue);
-	if (sk->sk_send_head != NULL) {
-		__kfree_skb(sk->sk_send_head);
-		sk->sk_send_head = NULL;
-	}
-
-	inet->dport = 0;
-
-	if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
-		inet_reset_saddr(sk);
-
-	sk->sk_shutdown = 0;
-	sock_reset_flag(sk, SOCK_DONE);
-
-	icsk->icsk_backoff = 0;
-	inet_csk_delack_init(sk);
-	__sk_dst_reset(sk);
-
-	BUG_TRAP(!inet->num || icsk->icsk_bind_hash);
-
-	sk->sk_error_report(sk);
-	return err;
-}
-
-/*
- *	Wait for a DCCP event.
- *
- *	Note that we don't need to lock the socket, as the upper poll layers
- *	take care of normal races (between the test and the event) and we don't
- *	go look at any of the socket buffers directly.
- */
-static unsigned int dccp_poll(struct file *file, struct socket *sock,
-			      poll_table *wait)
-{
-	unsigned int mask;
-	struct sock *sk = sock->sk;
-
-	poll_wait(file, sk->sk_sleep, wait);
-	if (sk->sk_state == DCCP_LISTEN)
-		return inet_csk_listen_poll(sk);
-
-	/* Socket is not locked. We are protected from async events
-	   by poll logic and correct handling of state changes
-	   made by another threads is impossible in any case.
-	 */
-
-	mask = 0;
-	if (sk->sk_err)
-		mask = POLLERR;
-
-	if (sk->sk_shutdown == SHUTDOWN_MASK || sk->sk_state == DCCP_CLOSED)
-		mask |= POLLHUP;
-	if (sk->sk_shutdown & RCV_SHUTDOWN)
-		mask |= POLLIN | POLLRDNORM;
-
-	/* Connected? */
-	if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
-		if (atomic_read(&sk->sk_rmem_alloc) > 0)
-			mask |= POLLIN | POLLRDNORM;
-
-		if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
-			if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk)) {
-				mask |= POLLOUT | POLLWRNORM;
-			} else {  /* send SIGIO later */
-				set_bit(SOCK_ASYNC_NOSPACE,
-					&sk->sk_socket->flags);
-				set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-
-				/* Race breaker. If space is freed after
-				 * wspace test but before the flags are set,
-				 * IO signal will be lost.
-				 */
-				if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
-					mask |= POLLOUT | POLLWRNORM;
-			}
-		}
-	}
-	return mask;
-}
-
-int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
-{
-	dccp_pr_debug("entry\n");
-	return -ENOIOCTLCMD;
-}
-
-int dccp_setsockopt(struct sock *sk, int level, int optname,
-		    char __user *optval, int optlen)
-{
-	struct dccp_sock *dp;
-	int err;
-	int val;
-
-	if (level != SOL_DCCP)
-		return ip_setsockopt(sk, level, optname, optval, optlen);
-
-	if (optlen < sizeof(int))
-		return -EINVAL;
-
-	if (get_user(val, (int __user *)optval))
-		return -EFAULT;
-
-	lock_sock(sk);
-
-	dp = dccp_sk(sk);
-	err = 0;
-
-	switch (optname) {
-	case DCCP_SOCKOPT_PACKET_SIZE:
-		dp->dccps_packet_size = val;
-		break;
-	default:
-		err = -ENOPROTOOPT;
-		break;
-	}
-	
-	release_sock(sk);
-	return err;
-}
-
-int dccp_getsockopt(struct sock *sk, int level, int optname,
-		    char __user *optval, int __user *optlen)
-{
-	struct dccp_sock *dp;
-	int val, len;
-
-	if (level != SOL_DCCP)
-		return ip_getsockopt(sk, level, optname, optval, optlen);
-
-	if (get_user(len, optlen))
-		return -EFAULT;
-
-	len = min_t(unsigned int, len, sizeof(int));
-	if (len < 0)
-		return -EINVAL;
-
-	dp = dccp_sk(sk);
-
-	switch (optname) {
-	case DCCP_SOCKOPT_PACKET_SIZE:
-		val = dp->dccps_packet_size;
-		break;
-	default:
-		return -ENOPROTOOPT;
-	}
-
-	if (put_user(len, optlen) || copy_to_user(optval, &val, len))
-		return -EFAULT;
-
-	return 0;
-}
-
-int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-		 size_t len)
-{
-	const struct dccp_sock *dp = dccp_sk(sk);
-	const int flags = msg->msg_flags;
-	const int noblock = flags & MSG_DONTWAIT;
-	struct sk_buff *skb;
-	int rc, size;
-	long timeo;
-
-	if (len > dp->dccps_mss_cache)
-		return -EMSGSIZE;
-
-	lock_sock(sk);
-	timeo = sock_sndtimeo(sk, noblock);
-
-	/*
-	 * We have to use sk_stream_wait_connect here to set sk_write_pending,
-	 * so that the trick in dccp_rcv_request_sent_state_process.
-	 */
-	/* Wait for a connection to finish. */
-	if ((1 << sk->sk_state) & ~(DCCPF_OPEN | DCCPF_PARTOPEN | DCCPF_CLOSING))
-		if ((rc = sk_stream_wait_connect(sk, &timeo)) != 0)
-			goto out_release;
-
-	size = sk->sk_prot->max_header + len;
-	release_sock(sk);
-	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
-	lock_sock(sk);
-	if (skb == NULL)
-		goto out_release;
-
-	skb_reserve(skb, sk->sk_prot->max_header);
-	rc = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
-	if (rc != 0)
-		goto out_discard;
-
-	rc = dccp_write_xmit(sk, skb, &timeo);
-	/*
-	 * XXX we don't use sk_write_queue, so just discard the packet.
-	 *     Current plan however is to _use_ sk_write_queue with
-	 *     an algorith similar to tcp_sendmsg, where the main difference
-	 *     is that in DCCP we have to respect packet boundaries, so
-	 *     no coalescing of skbs.
-	 *
-	 *     This bug was _quickly_ found & fixed by just looking at an OSTRA
-	 *     generated callgraph 8) -acme
-	 */
-	if (rc != 0)
-		goto out_discard;
-out_release:
-	release_sock(sk);
-	return rc ? : len;
-out_discard:
-	kfree_skb(skb);
-	goto out_release;
-}
-
-int dccp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-		 size_t len, int nonblock, int flags, int *addr_len)
-{
-	const struct dccp_hdr *dh;
-	long timeo;
-
-	lock_sock(sk);
-
-	if (sk->sk_state == DCCP_LISTEN) {
-		len = -ENOTCONN;
-		goto out;
-	}
-
-	timeo = sock_rcvtimeo(sk, nonblock);
-
-	do {
-		struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
-
-		if (skb == NULL)
-			goto verify_sock_status;
-
-		dh = dccp_hdr(skb);
-
-		if (dh->dccph_type == DCCP_PKT_DATA ||
-		    dh->dccph_type == DCCP_PKT_DATAACK)
-			goto found_ok_skb;
-
-		if (dh->dccph_type == DCCP_PKT_RESET ||
-		    dh->dccph_type == DCCP_PKT_CLOSE) {
-			dccp_pr_debug("found fin ok!\n");
-			len = 0;
-			goto found_fin_ok;
-		}
-		dccp_pr_debug("packet_type=%s\n",
-			      dccp_packet_name(dh->dccph_type));
-		sk_eat_skb(sk, skb);
-verify_sock_status:
-		if (sock_flag(sk, SOCK_DONE)) {
-			len = 0;
-			break;
-		}
-
-		if (sk->sk_err) {
-			len = sock_error(sk);
-			break;
-		}
-
-		if (sk->sk_shutdown & RCV_SHUTDOWN) {
-			len = 0;
-			break;
-		}
-
-		if (sk->sk_state == DCCP_CLOSED) {
-			if (!sock_flag(sk, SOCK_DONE)) {
-				/* This occurs when user tries to read
-				 * from never connected socket.
-				 */
-				len = -ENOTCONN;
-				break;
-			}
-			len = 0;
-			break;
-		}
-
-		if (!timeo) {
-			len = -EAGAIN;
-			break;
-		}
-
-		if (signal_pending(current)) {
-			len = sock_intr_errno(timeo);
-			break;
-		}
-
-		sk_wait_data(sk, &timeo);
-		continue;
-	found_ok_skb:
-		if (len > skb->len)
-			len = skb->len;
-		else if (len < skb->len)
-			msg->msg_flags |= MSG_TRUNC;
-
-		if (skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len)) {
-			/* Exception. Bailout! */
-			len = -EFAULT;
-			break;
-		}
-	found_fin_ok:
-		if (!(flags & MSG_PEEK))
-			sk_eat_skb(sk, skb);
-		break;
-	} while (1);
-out:
-	release_sock(sk);
-	return len;
-}
-
-static int inet_dccp_listen(struct socket *sock, int backlog)
-{
-	struct sock *sk = sock->sk;
-	unsigned char old_state;
-	int err;
-
-	lock_sock(sk);
-
-	err = -EINVAL;
-	if (sock->state != SS_UNCONNECTED || sock->type != SOCK_DCCP)
-		goto out;
-
-	old_state = sk->sk_state;
-	if (!((1 << old_state) & (DCCPF_CLOSED | DCCPF_LISTEN)))
-		goto out;
-
-	/* Really, if the socket is already in listen state
-	 * we can only allow the backlog to be adjusted.
-	 */
-	if (old_state != DCCP_LISTEN) {
-		/*
-		 * FIXME: here it probably should be sk->sk_prot->listen_start
-		 * see tcp_listen_start
-		 */
-		err = dccp_listen_start(sk);
-		if (err)
-			goto out;
-	}
-	sk->sk_max_ack_backlog = backlog;
-	err = 0;
-
-out:
-	release_sock(sk);
-	return err;
-}
-
-static const unsigned char dccp_new_state[] = {
-	/* current state:   new state:      action:	*/
-	[0]		  = DCCP_CLOSED,
-	[DCCP_OPEN] 	  = DCCP_CLOSING | DCCP_ACTION_FIN,
-	[DCCP_REQUESTING] = DCCP_CLOSED,
-	[DCCP_PARTOPEN]	  = DCCP_CLOSING | DCCP_ACTION_FIN,
-	[DCCP_LISTEN]	  = DCCP_CLOSED,
-	[DCCP_RESPOND]	  = DCCP_CLOSED,
-	[DCCP_CLOSING]	  = DCCP_CLOSED,
-	[DCCP_TIME_WAIT]  = DCCP_CLOSED,
-	[DCCP_CLOSED]	  = DCCP_CLOSED,
-};
-
-static int dccp_close_state(struct sock *sk)
-{
-	const int next = dccp_new_state[sk->sk_state];
-	const int ns = next & DCCP_STATE_MASK;
-
-	if (ns != sk->sk_state)
-		dccp_set_state(sk, ns);
-
-	return next & DCCP_ACTION_FIN;
-}
-
-void dccp_close(struct sock *sk, long timeout)
-{
-	struct sk_buff *skb;
-
-	lock_sock(sk);
-
-	sk->sk_shutdown = SHUTDOWN_MASK;
-
-	if (sk->sk_state == DCCP_LISTEN) {
-		dccp_set_state(sk, DCCP_CLOSED);
-
-		/* Special case. */
-		inet_csk_listen_stop(sk);
-
-		goto adjudge_to_death;
-	}
-
-	/*
-	 * We need to flush the recv. buffs.  We do this only on the
-	 * descriptor close, not protocol-sourced closes, because the
-	  *reader process may not have drained the data yet!
-	 */
-	/* FIXME: check for unread data */
-	while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-		__kfree_skb(skb);
-	}
-
-	if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
-		/* Check zero linger _after_ checking for unread data. */
-		sk->sk_prot->disconnect(sk, 0);
-	} else if (dccp_close_state(sk)) {
-		dccp_send_close(sk, 1);
-	}
-
-	sk_stream_wait_close(sk, timeout);
-
-adjudge_to_death:
-	/*
-	 * It is the last release_sock in its life. It will remove backlog.
-	 */
-	release_sock(sk);
-	/*
-	 * Now socket is owned by kernel and we acquire BH lock
-	 * to finish close. No need to check for user refs.
-	 */
-	local_bh_disable();
-	bh_lock_sock(sk);
-	BUG_TRAP(!sock_owned_by_user(sk));
-
-	sock_hold(sk);
-	sock_orphan(sk);
-
-	/*
-	 * The last release_sock may have processed the CLOSE or RESET
-	 * packet moving sock to CLOSED state, if not we have to fire
-	 * the CLOSE/CLOSEREQ retransmission timer, see "8.3. Termination"
-	 * in draft-ietf-dccp-spec-11. -acme
-	 */
-	if (sk->sk_state == DCCP_CLOSING) {
-		/* FIXME: should start at 2 * RTT */
-		/* Timer for repeating the CLOSE/CLOSEREQ until an answer. */
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-					  inet_csk(sk)->icsk_rto,
-					  DCCP_RTO_MAX);
-#if 0
-		/* Yeah, we should use sk->sk_prot->orphan_count, etc */
-		dccp_set_state(sk, DCCP_CLOSED);
-#endif
-	}
-
-	atomic_inc(sk->sk_prot->orphan_count);
-	if (sk->sk_state == DCCP_CLOSED)
-		inet_csk_destroy_sock(sk);
-
-	/* Otherwise, socket is reprieved until protocol close. */
-
-	bh_unlock_sock(sk);
-	local_bh_enable();
-	sock_put(sk);
-}
-
-void dccp_shutdown(struct sock *sk, int how)
-{
-	dccp_pr_debug("entry\n");
-}
-
-static struct proto_ops inet_dccp_ops = {
-	.family		= PF_INET,
-	.owner		= THIS_MODULE,
-	.release	= inet_release,
-	.bind		= inet_bind,
-	.connect	= inet_stream_connect,
-	.socketpair	= sock_no_socketpair,
-	.accept		= inet_accept,
-	.getname	= inet_getname,
-	/* FIXME: work on tcp_poll to rename it to inet_csk_poll */
-	.poll		= dccp_poll,
-	.ioctl		= inet_ioctl,
-	/* FIXME: work on inet_listen to rename it to sock_common_listen */
-	.listen		= inet_dccp_listen,
-	.shutdown	= inet_shutdown,
-	.setsockopt	= sock_common_setsockopt,
-	.getsockopt	= sock_common_getsockopt,
-	.sendmsg	= inet_sendmsg,
-	.recvmsg	= sock_common_recvmsg,
-	.mmap		= sock_no_mmap,
-	.sendpage	= sock_no_sendpage,
-};
-
-extern struct net_proto_family inet_family_ops;
-
-static struct inet_protosw dccp_v4_protosw = {
-	.type		= SOCK_DCCP,
-	.protocol	= IPPROTO_DCCP,
-	.prot		= &dccp_v4_prot,
-	.ops		= &inet_dccp_ops,
-	.capability	= -1,
-	.no_check	= 0,
-	.flags		= 0,
-};
-
-/*
- * This is the global socket data structure used for responding to
- * the Out-of-the-blue (OOTB) packets. A control sock will be created
- * for this socket at the initialization time.
- */
-struct socket *dccp_ctl_socket;
-
-static char dccp_ctl_socket_err_msg[] __initdata =
-	KERN_ERR "DCCP: Failed to create the control socket.\n";
-
-static int __init dccp_ctl_sock_init(void)
-{
-	int rc = sock_create_kern(PF_INET, SOCK_DCCP, IPPROTO_DCCP,
-				  &dccp_ctl_socket);
-	if (rc < 0)
-		printk(dccp_ctl_socket_err_msg);
-	else {
-		dccp_ctl_socket->sk->sk_allocation = GFP_ATOMIC;
-		inet_sk(dccp_ctl_socket->sk)->uc_ttl = -1;
-
-		/* Unhash it so that IP input processing does not even
-		 * see it, we do not wish this socket to see incoming
-		 * packets.
-		 */
-		dccp_ctl_socket->sk->sk_prot->unhash(dccp_ctl_socket->sk);
-	}
-
-	return rc;
-}
-
-#ifdef CONFIG_IP_DCCP_UNLOAD_HACK
-void dccp_ctl_sock_exit(void)
-{
-	if (dccp_ctl_socket != NULL) {
-		sock_release(dccp_ctl_socket);
-		dccp_ctl_socket = NULL;
-	}
-}
-
-EXPORT_SYMBOL_GPL(dccp_ctl_sock_exit);
-#endif
-
-static int __init init_dccp_v4_mibs(void)
-{
-	int rc = -ENOMEM;
-
-	dccp_statistics[0] = alloc_percpu(struct dccp_mib);
-	if (dccp_statistics[0] == NULL)
-		goto out;
-
-	dccp_statistics[1] = alloc_percpu(struct dccp_mib);
-	if (dccp_statistics[1] == NULL)
-		goto out_free_one;
-
-	rc = 0;
-out:
-	return rc;
-out_free_one:
-	free_percpu(dccp_statistics[0]);
-	dccp_statistics[0] = NULL;
-	goto out;
-
-}
-
-static int thash_entries;
-module_param(thash_entries, int, 0444);
-MODULE_PARM_DESC(thash_entries, "Number of ehash buckets");
-
-#ifdef CONFIG_IP_DCCP_DEBUG
-int dccp_debug;
-module_param(dccp_debug, int, 0444);
-MODULE_PARM_DESC(dccp_debug, "Enable debug messages");
-#endif
-
-static int __init dccp_init(void)
-{
-	unsigned long goal;
-	int ehash_order, bhash_order, i;
-	int rc = proto_register(&dccp_v4_prot, 1);
-
-	if (rc)
-		goto out;
-
-	dccp_hashinfo.bind_bucket_cachep =
-		kmem_cache_create("dccp_bind_bucket",
-				  sizeof(struct inet_bind_bucket), 0,
-				  SLAB_HWCACHE_ALIGN, NULL, NULL);
-	if (!dccp_hashinfo.bind_bucket_cachep)
-		goto out_proto_unregister;
-
-	/*
-	 * Size and allocate the main established and bind bucket
-	 * hash tables.
-	 *
-	 * The methodology is similar to that of the buffer cache.
-	 */
-	if (num_physpages >= (128 * 1024))
-		goal = num_physpages >> (21 - PAGE_SHIFT);
-	else
-		goal = num_physpages >> (23 - PAGE_SHIFT);
-
-	if (thash_entries)
-		goal = (thash_entries *
-			sizeof(struct inet_ehash_bucket)) >> PAGE_SHIFT;
-	for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
-		;
-	do {
-		dccp_hashinfo.ehash_size = (1UL << ehash_order) * PAGE_SIZE /
-					sizeof(struct inet_ehash_bucket);
-		dccp_hashinfo.ehash_size >>= 1;
-		while (dccp_hashinfo.ehash_size &
-		       (dccp_hashinfo.ehash_size - 1))
-			dccp_hashinfo.ehash_size--;
-		dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
-			__get_free_pages(GFP_ATOMIC, ehash_order);
-	} while (!dccp_hashinfo.ehash && --ehash_order > 0);
-
-	if (!dccp_hashinfo.ehash) {
-		printk(KERN_CRIT "Failed to allocate DCCP "
-				 "established hash table\n");
-		goto out_free_bind_bucket_cachep;
-	}
-
-	for (i = 0; i < (dccp_hashinfo.ehash_size << 1); i++) {
-		rwlock_init(&dccp_hashinfo.ehash[i].lock);
-		INIT_HLIST_HEAD(&dccp_hashinfo.ehash[i].chain);
-	}
-
-	bhash_order = ehash_order;
-
-	do {
-		dccp_hashinfo.bhash_size = (1UL << bhash_order) * PAGE_SIZE /
-					sizeof(struct inet_bind_hashbucket);
-		if ((dccp_hashinfo.bhash_size > (64 * 1024)) &&
-		    bhash_order > 0)
-			continue;
-		dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
-			__get_free_pages(GFP_ATOMIC, bhash_order);
-	} while (!dccp_hashinfo.bhash && --bhash_order >= 0);
-
-	if (!dccp_hashinfo.bhash) {
-		printk(KERN_CRIT "Failed to allocate DCCP bind hash table\n");
-		goto out_free_dccp_ehash;
-	}
-
-	for (i = 0; i < dccp_hashinfo.bhash_size; i++) {
-		spin_lock_init(&dccp_hashinfo.bhash[i].lock);
-		INIT_HLIST_HEAD(&dccp_hashinfo.bhash[i].chain);
-	}
-
-	if (init_dccp_v4_mibs())
-		goto out_free_dccp_bhash;
-
-	rc = -EAGAIN;
-	if (inet_add_protocol(&dccp_protocol, IPPROTO_DCCP))
-		goto out_free_dccp_v4_mibs;
-
-	inet_register_protosw(&dccp_v4_protosw);
-
-	rc = dccp_ctl_sock_init();
-	if (rc)
-		goto out_unregister_protosw;
-out:
-	return rc;
-out_unregister_protosw:
-	inet_unregister_protosw(&dccp_v4_protosw);
-	inet_del_protocol(&dccp_protocol, IPPROTO_DCCP);
-out_free_dccp_v4_mibs:
-	free_percpu(dccp_statistics[0]);
-	free_percpu(dccp_statistics[1]);
-	dccp_statistics[0] = dccp_statistics[1] = NULL;
-out_free_dccp_bhash:
-	free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
-	dccp_hashinfo.bhash = NULL;
-out_free_dccp_ehash:
-	free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
-	dccp_hashinfo.ehash = NULL;
-out_free_bind_bucket_cachep:
-	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
-	dccp_hashinfo.bind_bucket_cachep = NULL;
-out_proto_unregister:
-	proto_unregister(&dccp_v4_prot);
-	goto out;
-}
-
-static const char dccp_del_proto_err_msg[] __exitdata =
-	KERN_ERR "can't remove dccp net_protocol\n";
-
-static void __exit dccp_fini(void)
-{
-	inet_unregister_protosw(&dccp_v4_protosw);
-
-	if (inet_del_protocol(&dccp_protocol, IPPROTO_DCCP) < 0)
-		printk(dccp_del_proto_err_msg);
-
-	free_percpu(dccp_statistics[0]);
-	free_percpu(dccp_statistics[1]);
-	free_pages((unsigned long)dccp_hashinfo.bhash,
-		   get_order(dccp_hashinfo.bhash_size *
-			     sizeof(struct inet_bind_hashbucket)));
-	free_pages((unsigned long)dccp_hashinfo.ehash,
-		   get_order(dccp_hashinfo.ehash_size *
-			     sizeof(struct inet_ehash_bucket)));
-	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
-	proto_unregister(&dccp_v4_prot);
-}
-
-module_init(dccp_init);
-module_exit(dccp_fini);
-
-/*
- * __stringify doesn't likes enums, so use SOCK_DCCP (6) and IPPROTO_DCCP (33)
- * values directly, Also cover the case where the protocol is not specified,
- * i.e. net-pf-PF_INET-proto-0-type-SOCK_DCCP
- */
-MODULE_ALIAS("net-pf-" __stringify(PF_INET) "-proto-33-type-6");
-MODULE_ALIAS("net-pf-" __stringify(PF_INET) "-proto-0-type-6");
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@conectiva.com.br>");
-MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");
diff --git a/trunk/net/dccp/timer.c b/trunk/net/dccp/timer.c
deleted file mode 100644
index aa34b576e228..000000000000
--- a/trunk/net/dccp/timer.c
+++ /dev/null
@@ -1,255 +0,0 @@
-/*
- *  net/dccp/timer.c
- * 
- *  An implementation of the DCCP protocol
- *  Arnaldo Carvalho de Melo <acme@conectiva.com.br>
- *
- *	This program is free software; you can redistribute it and/or
- *	modify it under the terms of the GNU General Public License
- *	as published by the Free Software Foundation; either version
- *	2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/dccp.h>
-#include <linux/skbuff.h>
-
-#include "dccp.h"
-
-static void dccp_write_timer(unsigned long data);
-static void dccp_keepalive_timer(unsigned long data);
-static void dccp_delack_timer(unsigned long data);
-
-void dccp_init_xmit_timers(struct sock *sk)
-{
-	inet_csk_init_xmit_timers(sk, &dccp_write_timer, &dccp_delack_timer,
-				  &dccp_keepalive_timer);
-}
-
-static void dccp_write_err(struct sock *sk)
-{
-	sk->sk_err = sk->sk_err_soft ? : ETIMEDOUT;
-	sk->sk_error_report(sk);
-
-	dccp_v4_send_reset(sk, DCCP_RESET_CODE_ABORTED);
-	dccp_done(sk);
-	DCCP_INC_STATS_BH(DCCP_MIB_ABORTONTIMEOUT);
-}
-
-/* A write timeout has occurred. Process the after effects. */
-static int dccp_write_timeout(struct sock *sk)
-{
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	int retry_until;
-
-	if (sk->sk_state == DCCP_REQUESTING || sk->sk_state == DCCP_PARTOPEN) {
-		if (icsk->icsk_retransmits != 0)
-			dst_negative_advice(&sk->sk_dst_cache);
-		retry_until = icsk->icsk_syn_retries ? :
-			    /* FIXME! */ 3 /* FIXME! sysctl_tcp_syn_retries */;
-	} else {
-		if (icsk->icsk_retransmits >=
-		     /* FIXME! sysctl_tcp_retries1 */ 5 /* FIXME! */) {
-			/* NOTE. draft-ietf-tcpimpl-pmtud-01.txt requires pmtu
-			   black hole detection. :-(
-
-			   It is place to make it. It is not made. I do not want
-			   to make it. It is disguisting. It does not work in any
-			   case. Let me to cite the same draft, which requires for
-			   us to implement this:
-
-   "The one security concern raised by this memo is that ICMP black holes
-   are often caused by over-zealous security administrators who block
-   all ICMP messages.  It is vitally important that those who design and
-   deploy security systems understand the impact of strict filtering on
-   upper-layer protocols.  The safest web site in the world is worthless
-   if most TCP implementations cannot transfer data from it.  It would
-   be far nicer to have all of the black holes fixed rather than fixing
-   all of the TCP implementations."
-
-                           Golden words :-).
-		   */
-
-			dst_negative_advice(&sk->sk_dst_cache);
-		}
-
-		retry_until = /* FIXME! */ 15 /* FIXME! sysctl_tcp_retries2 */;
-		/*
-		 * FIXME: see tcp_write_timout and tcp_out_of_resources
-		 */
-	}
-
-	if (icsk->icsk_retransmits >= retry_until) {
-		/* Has it gone just too far? */
-		dccp_write_err(sk);
-		return 1;
-	}
-	return 0;
-}
-
-/* This is the same as tcp_delack_timer, sans prequeue & mem_reclaim stuff */
-static void dccp_delack_timer(unsigned long data)
-{
-	struct sock *sk = (struct sock *)data;
-	struct inet_connection_sock *icsk = inet_csk(sk);
-
-	bh_lock_sock(sk);
-	if (sock_owned_by_user(sk)) {
-		/* Try again later. */
-		icsk->icsk_ack.blocked = 1;
-		NET_INC_STATS_BH(LINUX_MIB_DELAYEDACKLOCKED);
-		sk_reset_timer(sk, &icsk->icsk_delack_timer,
-			       jiffies + TCP_DELACK_MIN);
-		goto out;
-	}
-
-	if (sk->sk_state == DCCP_CLOSED ||
-	    !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
-		goto out;
-	if (time_after(icsk->icsk_ack.timeout, jiffies)) {
-		sk_reset_timer(sk, &icsk->icsk_delack_timer,
-			       icsk->icsk_ack.timeout);
-		goto out;
-	}
-
-	icsk->icsk_ack.pending &= ~ICSK_ACK_TIMER;
-
-	if (inet_csk_ack_scheduled(sk)) {
-		if (!icsk->icsk_ack.pingpong) {
-			/* Delayed ACK missed: inflate ATO. */
-			icsk->icsk_ack.ato = min(icsk->icsk_ack.ato << 1,
-						 icsk->icsk_rto);
-		} else {
-			/* Delayed ACK missed: leave pingpong mode and
-			 * deflate ATO.
-			 */
-			icsk->icsk_ack.pingpong = 0;
-			icsk->icsk_ack.ato = TCP_ATO_MIN;
-		}
-		dccp_send_ack(sk);
-		NET_INC_STATS_BH(LINUX_MIB_DELAYEDACKS);
-	}
-out:
-	bh_unlock_sock(sk);
-	sock_put(sk);
-}
-
-/*
- *	The DCCP retransmit timer.
- */
-static void dccp_retransmit_timer(struct sock *sk)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-
-	/*
-	 * sk->sk_send_head has to have one skb with
-	 * DCCP_SKB_CB(skb)->dccpd_type set to one of the retransmittable DCCP
-	 * packet types (REQUEST, RESPONSE, the ACK in the 3way handshake
-	 * (PARTOPEN timer), etc).
-	 */
-	BUG_TRAP(sk->sk_send_head != NULL);
-
-	/* 
-	 * More than than 4MSL (8 minutes) has passed, a RESET(aborted) was
-	 * sent, no need to retransmit, this sock is dead.
-	 */
-	if (dccp_write_timeout(sk))
-		goto out;
-
-	/*
-	 * We want to know the number of packets retransmitted, not the
-	 * total number of retransmissions of clones of original packets.
-	 */
-	if (icsk->icsk_retransmits == 0)
-		DCCP_INC_STATS_BH(DCCP_MIB_TIMEOUTS);
-
-	if (dccp_retransmit_skb(sk, sk->sk_send_head) < 0) {
-		/*
-		 * Retransmission failed because of local congestion,
-		 * do not backoff.
-		 */
-		if (icsk->icsk_retransmits == 0)
-			icsk->icsk_retransmits = 1;
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-					  min(icsk->icsk_rto,
-					      TCP_RESOURCE_PROBE_INTERVAL),
-					  DCCP_RTO_MAX);
-		goto out;
-	}
-
-	icsk->icsk_backoff++;
-	icsk->icsk_retransmits++;
-
-	icsk->icsk_rto = min(icsk->icsk_rto << 1, DCCP_RTO_MAX);
-	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto,
-				  DCCP_RTO_MAX);
-	if (icsk->icsk_retransmits > 3 /* FIXME: sysctl_dccp_retries1 */)
-		__sk_dst_reset(sk);
-out:;
-}
-
-static void dccp_write_timer(unsigned long data)
-{
-	struct sock *sk = (struct sock *)data;
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	int event = 0;
-
-	bh_lock_sock(sk);
-	if (sock_owned_by_user(sk)) {
-		/* Try again later */
-		sk_reset_timer(sk, &icsk->icsk_retransmit_timer,
-			       jiffies + (HZ / 20));
-		goto out;
-	}
-
-	if (sk->sk_state == DCCP_CLOSED || !icsk->icsk_pending)
-		goto out;
-
-	if (time_after(icsk->icsk_timeout, jiffies)) {
-		sk_reset_timer(sk, &icsk->icsk_retransmit_timer,
-			       icsk->icsk_timeout);
-		goto out;
-	}
-
-	event = icsk->icsk_pending;
-	icsk->icsk_pending = 0;
-
-	switch (event) {
-	case ICSK_TIME_RETRANS:
-		dccp_retransmit_timer(sk);
-		break;
-	}
-out:
-	bh_unlock_sock(sk);
-	sock_put(sk);
-}
-
-/*
- *	Timer for listening sockets
- */
-static void dccp_response_timer(struct sock *sk)
-{
-	inet_csk_reqsk_queue_prune(sk, TCP_SYNQ_INTERVAL, DCCP_TIMEOUT_INIT,
-				   DCCP_RTO_MAX);
-}
-
-static void dccp_keepalive_timer(unsigned long data)
-{
-	struct sock *sk = (struct sock *)data;
-
-	/* Only process if socket is not in use. */
-	bh_lock_sock(sk);
-	if (sock_owned_by_user(sk)) {
-		/* Try again later. */ 
-		inet_csk_reset_keepalive_timer(sk, HZ / 20);
-		goto out;
-	}
-
-	if (sk->sk_state == DCCP_LISTEN) {
-		dccp_response_timer(sk);
-		goto out;
-	}
-out:
-	bh_unlock_sock(sk);
-	sock_put(sk);
-}
diff --git a/trunk/net/decnet/af_decnet.c b/trunk/net/decnet/af_decnet.c
index 621680f127af..acdd18e6adb2 100644
--- a/trunk/net/decnet/af_decnet.c
+++ b/trunk/net/decnet/af_decnet.c
@@ -118,7 +118,7 @@ Version 0.0.6    2.1.110   07-aug-98   Eduardo Marcelo Serrat
 #include <linux/netfilter.h>
 #include <linux/seq_file.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <net/flow.h>
 #include <asm/system.h>
 #include <asm/ioctls.h>
@@ -1763,7 +1763,7 @@ static int dn_recvmsg(struct kiocb *iocb, struct socket *sock,
 		nskb = skb->next;
 
 		if (skb->len == 0) {
-			skb_unlink(skb, queue);
+			skb_unlink(skb);
 			kfree_skb(skb);
 			/* 
 			 * N.B. Don't refer to skb or cb after this point
@@ -2064,7 +2064,7 @@ static struct notifier_block dn_dev_notifier = {
 	.notifier_call = dn_device_event,
 };
 
-extern int dn_route_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
+extern int dn_route_rcv(struct sk_buff *, struct net_device *, struct packet_type *);
 
 static struct packet_type dn_dix_packet_type = {
 	.type =		__constant_htons(ETH_P_DNA_RT),
diff --git a/trunk/net/decnet/dn_dev.c b/trunk/net/decnet/dn_dev.c
index 5610bb16dbf9..00233ecbc9cb 100644
--- a/trunk/net/decnet/dn_dev.c
+++ b/trunk/net/decnet/dn_dev.c
@@ -752,16 +752,16 @@ static void rtmsg_ifa(int event, struct dn_ifaddr *ifa)
 
 	skb = alloc_skb(size, GFP_KERNEL);
 	if (!skb) {
-		netlink_set_err(rtnl, 0, RTNLGRP_DECnet_IFADDR, ENOBUFS);
+		netlink_set_err(rtnl, 0, RTMGRP_DECnet_IFADDR, ENOBUFS);
 		return;
 	}
 	if (dn_dev_fill_ifaddr(skb, ifa, 0, 0, event, 0) < 0) {
 		kfree_skb(skb);
-		netlink_set_err(rtnl, 0, RTNLGRP_DECnet_IFADDR, EINVAL);
+		netlink_set_err(rtnl, 0, RTMGRP_DECnet_IFADDR, EINVAL);
 		return;
 	}
-	NETLINK_CB(skb).dst_group = RTNLGRP_DECnet_IFADDR;
-	netlink_broadcast(rtnl, skb, 0, RTNLGRP_DECnet_IFADDR, GFP_KERNEL);
+	NETLINK_CB(skb).dst_groups = RTMGRP_DECnet_IFADDR;
+	netlink_broadcast(rtnl, skb, 0, RTMGRP_DECnet_IFADDR, GFP_KERNEL);
 }
 
 static int dn_dev_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/trunk/net/decnet/dn_nsp_in.c b/trunk/net/decnet/dn_nsp_in.c
index 369f25b60f3f..202dbde9850d 100644
--- a/trunk/net/decnet/dn_nsp_in.c
+++ b/trunk/net/decnet/dn_nsp_in.c
@@ -60,7 +60,7 @@
 #include <linux/inet.h>
 #include <linux/route.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
diff --git a/trunk/net/decnet/dn_nsp_out.c b/trunk/net/decnet/dn_nsp_out.c
index e0bebf4bbcad..8cce1fdbda90 100644
--- a/trunk/net/decnet/dn_nsp_out.c
+++ b/trunk/net/decnet/dn_nsp_out.c
@@ -479,7 +479,7 @@ int dn_nsp_check_xmit_queue(struct sock *sk, struct sk_buff *skb, struct sk_buff
 		xmit_count = cb2->xmit_count;
 		segnum = cb2->segnum;
 		/* Remove and drop ack'ed packet */
-		skb_unlink(ack, q);
+		skb_unlink(ack);
 		kfree_skb(ack);
 		ack = NULL;
 
diff --git a/trunk/net/decnet/dn_route.c b/trunk/net/decnet/dn_route.c
index 2c915f305be3..2399fa8a3f86 100644
--- a/trunk/net/decnet/dn_route.c
+++ b/trunk/net/decnet/dn_route.c
@@ -572,7 +572,7 @@ static int dn_route_ptp_hello(struct sk_buff *skb)
 	return NET_RX_SUCCESS;
 }
 
-int dn_route_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+int dn_route_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 {
 	struct dn_skb_cb *cb;
 	unsigned char flags = 0;
diff --git a/trunk/net/decnet/dn_table.c b/trunk/net/decnet/dn_table.c
index eeba56f99323..28ba5777a25a 100644
--- a/trunk/net/decnet/dn_table.c
+++ b/trunk/net/decnet/dn_table.c
@@ -79,7 +79,7 @@ for( ; ((f) = *(fp)) != NULL && dn_key_eq((f)->fn_key, (key)); (fp) = &(f)->fn_n
 static DEFINE_RWLOCK(dn_fib_tables_lock);
 struct dn_fib_table *dn_fib_tables[RT_TABLE_MAX + 1];
 
-static kmem_cache_t *dn_hash_kmem __read_mostly;
+static kmem_cache_t *dn_hash_kmem;
 static int dn_fib_hash_zombies;
 
 static inline dn_fib_idx_t dn_hash(dn_fib_key_t key, struct dn_zone *dz)
@@ -349,10 +349,10 @@ static void dn_rtmsg_fib(int event, struct dn_fib_node *f, int z, int tb_id,
                 kfree_skb(skb);
                 return;
         }
-        NETLINK_CB(skb).dst_group = RTNLGRP_DECnet_ROUTE;
+        NETLINK_CB(skb).dst_groups = RTMGRP_DECnet_ROUTE;
         if (nlh->nlmsg_flags & NLM_F_ECHO)
                 atomic_inc(&skb->users);
-        netlink_broadcast(rtnl, skb, pid, RTNLGRP_DECnet_ROUTE, GFP_KERNEL);
+        netlink_broadcast(rtnl, skb, pid, RTMGRP_DECnet_ROUTE, GFP_KERNEL);
         if (nlh->nlmsg_flags & NLM_F_ECHO)
                 netlink_unicast(rtnl, skb, pid, MSG_DONTWAIT);
 }
diff --git a/trunk/net/decnet/netfilter/dn_rtmsg.c b/trunk/net/decnet/netfilter/dn_rtmsg.c
index 1ab94c6e22ed..284a9998e53d 100644
--- a/trunk/net/decnet/netfilter/dn_rtmsg.c
+++ b/trunk/net/decnet/netfilter/dn_rtmsg.c
@@ -19,7 +19,6 @@
 #include <linux/netfilter.h>
 #include <linux/spinlock.h>
 #include <linux/netlink.h>
-#include <linux/netfilter_decnet.h>
 
 #include <net/sock.h>
 #include <net/flow.h>
@@ -72,10 +71,10 @@ static void dnrmg_send_peer(struct sk_buff *skb)
 
 	switch(flags & DN_RT_CNTL_MSK) {
 		case DN_RT_PKT_L1RT:
-			group = DNRNG_NLGRP_L1;
+			group = DNRMG_L1_GROUP;
 			break;
 		case DN_RT_PKT_L2RT:
-			group = DNRNG_NLGRP_L2;
+			group = DNRMG_L2_GROUP;
 			break;
 		default:
 			return;
@@ -84,7 +83,7 @@ static void dnrmg_send_peer(struct sk_buff *skb)
 	skb2 = dnrmg_build_message(skb, &status);
 	if (skb2 == NULL)
 		return;
-	NETLINK_CB(skb2).dst_group = group;
+	NETLINK_CB(skb2).dst_groups = group;
 	netlink_broadcast(dnrmg, skb2, 0, group, GFP_ATOMIC);
 }
 
@@ -139,8 +138,7 @@ static int __init init(void)
 {
 	int rv = 0;
 
-	dnrmg = netlink_kernel_create(NETLINK_DNRTMSG, DNRNG_NLGRP_MAX,
-	                              dnrmg_receive_user_sk, THIS_MODULE);
+	dnrmg = netlink_kernel_create(NETLINK_DNRTMSG, dnrmg_receive_user_sk);
 	if (dnrmg == NULL) {
 		printk(KERN_ERR "dn_rtmsg: Cannot create netlink socket");
 		return -ENOMEM;
@@ -164,7 +162,6 @@ static void __exit fini(void)
 MODULE_DESCRIPTION("DECnet Routing Message Grabulator");
 MODULE_AUTHOR("Steven Whitehouse <steve@chygwyn.com>");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_DNRTMSG);
 
 module_init(init);
 module_exit(fini);
diff --git a/trunk/net/econet/af_econet.c b/trunk/net/econet/af_econet.c
index 4a62093eb343..de691e119e17 100644
--- a/trunk/net/econet/af_econet.c
+++ b/trunk/net/econet/af_econet.c
@@ -159,7 +159,7 @@ static int econet_recvmsg(struct kiocb *iocb, struct socket *sock,
 	err = memcpy_toiovec(msg->msg_iov, skb->data, copied);
 	if (err)
 		goto out_free;
-	skb_get_timestamp(skb, &sk->sk_stamp);
+	sk->sk_stamp = skb->stamp;
 
 	if (msg->msg_name)
 		memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
@@ -869,7 +869,7 @@ static void aun_tx_ack(unsigned long seq, int result)
 
 foundit:
 	tx_result(skb->sk, eb->cookie, result);
-	skb_unlink(skb, &aun_queue);
+	skb_unlink(skb);
 	spin_unlock_irqrestore(&aun_queue_lock, flags);
 	kfree_skb(skb);
 }
@@ -947,7 +947,7 @@ static void ab_cleanup(unsigned long h)
 		{
 			tx_result(skb->sk, eb->cookie, 
 				  ECTYPE_TRANSMIT_NOT_PRESENT);
-			skb_unlink(skb, &aun_queue);
+			skb_unlink(skb);
 			kfree_skb(skb);
 		}
 		skb = newskb;
@@ -1009,7 +1009,7 @@ static int __init aun_udp_initialise(void)
  *	Receive an Econet frame from a device.
  */
 
-static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int econet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 {
 	struct ec_framehdr *hdr;
 	struct sock *sk;
diff --git a/trunk/net/ethernet/eth.c b/trunk/net/ethernet/eth.c
index 87a052a9a84f..f6dbfb99b14d 100644
--- a/trunk/net/ethernet/eth.c
+++ b/trunk/net/ethernet/eth.c
@@ -62,6 +62,8 @@
 #include <asm/system.h>
 #include <asm/checksum.h>
 
+extern int __init netdev_boot_setup(char *str);
+
 __setup("ether=", netdev_boot_setup);
 
 /*
@@ -161,6 +163,7 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
 	skb->mac.raw=skb->data;
 	skb_pull(skb,ETH_HLEN);
 	eth = eth_hdr(skb);
+	skb->input_dev = dev;
 	
 	if(*eth->h_dest&1)
 	{
diff --git a/trunk/net/ethernet/sysctl_net_ether.c b/trunk/net/ethernet/sysctl_net_ether.c
index 66b39fc342d2..b81a6d532342 100644
--- a/trunk/net/ethernet/sysctl_net_ether.c
+++ b/trunk/net/ethernet/sysctl_net_ether.c
@@ -7,7 +7,6 @@
 
 #include <linux/mm.h>
 #include <linux/sysctl.h>
-#include <linux/if_ether.h>
 
 ctl_table ether_table[] = {
 	{0}
diff --git a/trunk/net/ieee80211/Kconfig b/trunk/net/ieee80211/Kconfig
deleted file mode 100644
index 58ed4319e693..000000000000
--- a/trunk/net/ieee80211/Kconfig
+++ /dev/null
@@ -1,69 +0,0 @@
-config IEEE80211
-	tristate "Generic IEEE 802.11 Networking Stack"
-	select NET_RADIO
-	---help---
-	This option enables the hardware independent IEEE 802.11
-	networking stack.
-
-config IEEE80211_DEBUG
-	bool "Enable full debugging output"
-	depends on IEEE80211
-	---help---
-	  This option will enable debug tracing output for the
-	  ieee80211 network stack.
-
-	  This will result in the kernel module being ~70k larger.  You
-	  can control which debug output is sent to the kernel log by
-	  setting the value in
-
-	  /proc/net/ieee80211/debug_level
-
-	  For example:
-
-	  % echo 0x00000FFO > /proc/net/ieee80211/debug_level
-
-	  For a list of values you can assign to debug_level, you
-	  can look at the bit mask values in <net/ieee80211.h>
-
-	  If you are not trying to debug or develop the ieee80211
-	  subsystem, you most likely want to say N here.
-
-config IEEE80211_CRYPT_WEP
-	tristate "IEEE 802.11 WEP encryption (802.1x)"
-	depends on IEEE80211
-	select CRYPTO
-	select CRYPTO_ARC4
-	select CRC32
-	---help---
-	Include software based cipher suites in support of IEEE
-	802.11's WEP.  This is needed for WEP as well as 802.1x.
-
-	This can be compiled as a modules and it will be called
-	"ieee80211_crypt_wep".
-
-config IEEE80211_CRYPT_CCMP
-	tristate "IEEE 802.11i CCMP support"
-	depends on IEEE80211
-	select CRYPTO
-	select CRYPTO_AES
-	---help---
-	Include software based cipher suites in support of IEEE 802.11i
-	(aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with CCMP enabled
-	networks.
-
-	This can be compiled as a modules and it will be called
-	"ieee80211_crypt_ccmp".
-
-config IEEE80211_CRYPT_TKIP
-	tristate "IEEE 802.11i TKIP encryption"
-	depends on IEEE80211
-	select CRYPTO
-	select CRYPTO_MICHAEL_MIC
-	---help---
-	Include software based cipher suites in support of IEEE 802.11i
-	(aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with TKIP enabled
-	networks.
-
-	This can be compiled as a modules and it will be called
-	"ieee80211_crypt_tkip".
-
diff --git a/trunk/net/ieee80211/Makefile b/trunk/net/ieee80211/Makefile
deleted file mode 100644
index a6ccac5baea8..000000000000
--- a/trunk/net/ieee80211/Makefile
+++ /dev/null
@@ -1,11 +0,0 @@
-obj-$(CONFIG_IEEE80211) += ieee80211.o
-obj-$(CONFIG_IEEE80211) += ieee80211_crypt.o
-obj-$(CONFIG_IEEE80211_CRYPT_WEP) += ieee80211_crypt_wep.o
-obj-$(CONFIG_IEEE80211_CRYPT_CCMP) += ieee80211_crypt_ccmp.o
-obj-$(CONFIG_IEEE80211_CRYPT_TKIP) += ieee80211_crypt_tkip.o
-ieee80211-objs := \
-	ieee80211_module.o \
-	ieee80211_tx.o \
-	ieee80211_rx.o \
-	ieee80211_wx.o
-
diff --git a/trunk/net/ieee80211/ieee80211_crypt.c b/trunk/net/ieee80211/ieee80211_crypt.c
deleted file mode 100644
index 05a6f2f298db..000000000000
--- a/trunk/net/ieee80211/ieee80211_crypt.c
+++ /dev/null
@@ -1,259 +0,0 @@
-/*
- * Host AP crypto routines
- *
- * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
- * Portions Copyright (C) 2004, Intel Corporation <jketreno@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- *
- */
-
-#include <linux/config.h>
-#include <linux/version.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <asm/string.h>
-#include <asm/errno.h>
-
-#include <net/ieee80211.h>
-
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("HostAP crypto");
-MODULE_LICENSE("GPL");
-
-struct ieee80211_crypto_alg {
-	struct list_head list;
-	struct ieee80211_crypto_ops *ops;
-};
-
-
-struct ieee80211_crypto {
-	struct list_head algs;
-	spinlock_t lock;
-};
-
-static struct ieee80211_crypto *hcrypt;
-
-void ieee80211_crypt_deinit_entries(struct ieee80211_device *ieee,
-					   int force)
-{
-	struct list_head *ptr, *n;
-	struct ieee80211_crypt_data *entry;
-
-	for (ptr = ieee->crypt_deinit_list.next, n = ptr->next;
-	     ptr != &ieee->crypt_deinit_list; ptr = n, n = ptr->next) {
-		entry = list_entry(ptr, struct ieee80211_crypt_data, list);
-
-		if (atomic_read(&entry->refcnt) != 0 && !force)
-			continue;
-
-		list_del(ptr);
-
-		if (entry->ops) {
-			entry->ops->deinit(entry->priv);
-			module_put(entry->ops->owner);
-		}
-		kfree(entry);
-	}
-}
-
-void ieee80211_crypt_deinit_handler(unsigned long data)
-{
-	struct ieee80211_device *ieee = (struct ieee80211_device *)data;
-	unsigned long flags;
-
-	spin_lock_irqsave(&ieee->lock, flags);
-	ieee80211_crypt_deinit_entries(ieee, 0);
-	if (!list_empty(&ieee->crypt_deinit_list)) {
-		printk(KERN_DEBUG "%s: entries remaining in delayed crypt "
-		       "deletion list\n", ieee->dev->name);
-		ieee->crypt_deinit_timer.expires = jiffies + HZ;
-		add_timer(&ieee->crypt_deinit_timer);
-	}
-	spin_unlock_irqrestore(&ieee->lock, flags);
-
-}
-
-void ieee80211_crypt_delayed_deinit(struct ieee80211_device *ieee,
-				    struct ieee80211_crypt_data **crypt)
-{
-	struct ieee80211_crypt_data *tmp;
-	unsigned long flags;
-
-	if (*crypt == NULL)
-		return;
-
-	tmp = *crypt;
-	*crypt = NULL;
-
-	/* must not run ops->deinit() while there may be pending encrypt or
-	 * decrypt operations. Use a list of delayed deinits to avoid needing
-	 * locking. */
-
-	spin_lock_irqsave(&ieee->lock, flags);
-	list_add(&tmp->list, &ieee->crypt_deinit_list);
-	if (!timer_pending(&ieee->crypt_deinit_timer)) {
-		ieee->crypt_deinit_timer.expires = jiffies + HZ;
-		add_timer(&ieee->crypt_deinit_timer);
-	}
-	spin_unlock_irqrestore(&ieee->lock, flags);
-}
-
-int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops)
-{
-	unsigned long flags;
-	struct ieee80211_crypto_alg *alg;
-
-	if (hcrypt == NULL)
-		return -1;
-
-	alg = kmalloc(sizeof(*alg), GFP_KERNEL);
-	if (alg == NULL)
-		return -ENOMEM;
-
-	memset(alg, 0, sizeof(*alg));
-	alg->ops = ops;
-
-	spin_lock_irqsave(&hcrypt->lock, flags);
-	list_add(&alg->list, &hcrypt->algs);
-	spin_unlock_irqrestore(&hcrypt->lock, flags);
-
-	printk(KERN_DEBUG "ieee80211_crypt: registered algorithm '%s'\n",
-	       ops->name);
-
-	return 0;
-}
-
-int ieee80211_unregister_crypto_ops(struct ieee80211_crypto_ops *ops)
-{
-	unsigned long flags;
-	struct list_head *ptr;
-	struct ieee80211_crypto_alg *del_alg = NULL;
-
-	if (hcrypt == NULL)
-		return -1;
-
-	spin_lock_irqsave(&hcrypt->lock, flags);
-	for (ptr = hcrypt->algs.next; ptr != &hcrypt->algs; ptr = ptr->next) {
-		struct ieee80211_crypto_alg *alg =
-			(struct ieee80211_crypto_alg *) ptr;
-		if (alg->ops == ops) {
-			list_del(&alg->list);
-			del_alg = alg;
-			break;
-		}
-	}
-	spin_unlock_irqrestore(&hcrypt->lock, flags);
-
-	if (del_alg) {
-		printk(KERN_DEBUG "ieee80211_crypt: unregistered algorithm "
-		       "'%s'\n", ops->name);
-		kfree(del_alg);
-	}
-
-	return del_alg ? 0 : -1;
-}
-
-
-struct ieee80211_crypto_ops * ieee80211_get_crypto_ops(const char *name)
-{
-	unsigned long flags;
-	struct list_head *ptr;
-	struct ieee80211_crypto_alg *found_alg = NULL;
-
-	if (hcrypt == NULL)
-		return NULL;
-
-	spin_lock_irqsave(&hcrypt->lock, flags);
-	for (ptr = hcrypt->algs.next; ptr != &hcrypt->algs; ptr = ptr->next) {
-		struct ieee80211_crypto_alg *alg =
-			(struct ieee80211_crypto_alg *) ptr;
-		if (strcmp(alg->ops->name, name) == 0) {
-			found_alg = alg;
-			break;
-		}
-	}
-	spin_unlock_irqrestore(&hcrypt->lock, flags);
-
-	if (found_alg)
-		return found_alg->ops;
-	else
-		return NULL;
-}
-
-
-static void * ieee80211_crypt_null_init(int keyidx) { return (void *) 1; }
-static void ieee80211_crypt_null_deinit(void *priv) {}
-
-static struct ieee80211_crypto_ops ieee80211_crypt_null = {
-	.name			= "NULL",
-	.init			= ieee80211_crypt_null_init,
-	.deinit			= ieee80211_crypt_null_deinit,
-	.encrypt_mpdu		= NULL,
-	.decrypt_mpdu		= NULL,
-	.encrypt_msdu		= NULL,
-	.decrypt_msdu		= NULL,
-	.set_key		= NULL,
-	.get_key		= NULL,
-	.extra_prefix_len	= 0,
-	.extra_postfix_len	= 0,
-	.owner			= THIS_MODULE,
-};
-
-
-static int __init ieee80211_crypto_init(void)
-{
-	int ret = -ENOMEM;
-
-	hcrypt = kmalloc(sizeof(*hcrypt), GFP_KERNEL);
-	if (!hcrypt)
-		goto out;
-
-	memset(hcrypt, 0, sizeof(*hcrypt));
-	INIT_LIST_HEAD(&hcrypt->algs);
-	spin_lock_init(&hcrypt->lock);
-
-	ret = ieee80211_register_crypto_ops(&ieee80211_crypt_null);
-	if (ret < 0) {
-		kfree(hcrypt);
-		hcrypt = NULL;
-	}
-out:
-	return ret;
-}
-
-
-static void __exit ieee80211_crypto_deinit(void)
-{
-	struct list_head *ptr, *n;
-
-	if (hcrypt == NULL)
-		return;
-
-	for (ptr = hcrypt->algs.next, n = ptr->next; ptr != &hcrypt->algs;
-	     ptr = n, n = ptr->next) {
-		struct ieee80211_crypto_alg *alg =
-			(struct ieee80211_crypto_alg *) ptr;
-		list_del(ptr);
-		printk(KERN_DEBUG "ieee80211_crypt: unregistered algorithm "
-		       "'%s' (deinit)\n", alg->ops->name);
-		kfree(alg);
-	}
-
-	kfree(hcrypt);
-}
-
-EXPORT_SYMBOL(ieee80211_crypt_deinit_entries);
-EXPORT_SYMBOL(ieee80211_crypt_deinit_handler);
-EXPORT_SYMBOL(ieee80211_crypt_delayed_deinit);
-
-EXPORT_SYMBOL(ieee80211_register_crypto_ops);
-EXPORT_SYMBOL(ieee80211_unregister_crypto_ops);
-EXPORT_SYMBOL(ieee80211_get_crypto_ops);
-
-module_init(ieee80211_crypto_init);
-module_exit(ieee80211_crypto_deinit);
diff --git a/trunk/net/ieee80211/ieee80211_crypt_ccmp.c b/trunk/net/ieee80211/ieee80211_crypt_ccmp.c
deleted file mode 100644
index 11d15573b26a..000000000000
--- a/trunk/net/ieee80211/ieee80211_crypt_ccmp.c
+++ /dev/null
@@ -1,470 +0,0 @@
-/*
- * Host AP crypt: host-based CCMP encryption implementation for Host AP driver
- *
- * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-
-#include <linux/config.h>
-#include <linux/version.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/random.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/if_ether.h>
-#include <linux/if_arp.h>
-#include <asm/string.h>
-#include <linux/wireless.h>
-
-#include <net/ieee80211.h>
-
-
-#include <linux/crypto.h>
-#include <asm/scatterlist.h>
-
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Host AP crypt: CCMP");
-MODULE_LICENSE("GPL");
-
-#define AES_BLOCK_LEN 16
-#define CCMP_HDR_LEN 8
-#define CCMP_MIC_LEN 8
-#define CCMP_TK_LEN 16
-#define CCMP_PN_LEN 6
-
-struct ieee80211_ccmp_data {
-	u8 key[CCMP_TK_LEN];
-	int key_set;
-
-	u8 tx_pn[CCMP_PN_LEN];
-	u8 rx_pn[CCMP_PN_LEN];
-
-	u32 dot11RSNAStatsCCMPFormatErrors;
-	u32 dot11RSNAStatsCCMPReplays;
-	u32 dot11RSNAStatsCCMPDecryptErrors;
-
-	int key_idx;
-
-	struct crypto_tfm *tfm;
-
-	/* scratch buffers for virt_to_page() (crypto API) */
-	u8 tx_b0[AES_BLOCK_LEN], tx_b[AES_BLOCK_LEN],
-		tx_e[AES_BLOCK_LEN], tx_s0[AES_BLOCK_LEN];
-	u8 rx_b0[AES_BLOCK_LEN], rx_b[AES_BLOCK_LEN], rx_a[AES_BLOCK_LEN];
-};
-
-static void ieee80211_ccmp_aes_encrypt(struct crypto_tfm *tfm,
-				       const u8 pt[16], u8 ct[16])
-{
-	struct scatterlist src, dst;
-
-	src.page = virt_to_page(pt);
-	src.offset = offset_in_page(pt);
-	src.length = AES_BLOCK_LEN;
-
-	dst.page = virt_to_page(ct);
-	dst.offset = offset_in_page(ct);
-	dst.length = AES_BLOCK_LEN;
-
-	crypto_cipher_encrypt(tfm, &dst, &src, AES_BLOCK_LEN);
-}
-
-static void * ieee80211_ccmp_init(int key_idx)
-{
-	struct ieee80211_ccmp_data *priv;
-
-	priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
-	if (priv == NULL)
-		goto fail;
-	memset(priv, 0, sizeof(*priv));
-	priv->key_idx = key_idx;
-
-	priv->tfm = crypto_alloc_tfm("aes", 0);
-	if (priv->tfm == NULL) {
-		printk(KERN_DEBUG "ieee80211_crypt_ccmp: could not allocate "
-		       "crypto API aes\n");
-		goto fail;
-	}
-
-	return priv;
-
-fail:
-	if (priv) {
-		if (priv->tfm)
-			crypto_free_tfm(priv->tfm);
-		kfree(priv);
-	}
-
-	return NULL;
-}
-
-
-static void ieee80211_ccmp_deinit(void *priv)
-{
-	struct ieee80211_ccmp_data *_priv = priv;
-	if (_priv && _priv->tfm)
-		crypto_free_tfm(_priv->tfm);
-	kfree(priv);
-}
-
-
-static inline void xor_block(u8 *b, u8 *a, size_t len)
-{
-	int i;
-	for (i = 0; i < len; i++)
-		b[i] ^= a[i];
-}
-
-
-static void ccmp_init_blocks(struct crypto_tfm *tfm,
-			     struct ieee80211_hdr *hdr,
-			     u8 *pn, size_t dlen, u8 *b0, u8 *auth,
-			     u8 *s0)
-{
-	u8 *pos, qc = 0;
-	size_t aad_len;
-	u16 fc;
-	int a4_included, qc_included;
-	u8 aad[2 * AES_BLOCK_LEN];
-
-	fc = le16_to_cpu(hdr->frame_ctl);
-	a4_included = ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-		       (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS));
-	qc_included = ((WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) &&
-		       (WLAN_FC_GET_STYPE(fc) & 0x08));
-	aad_len = 22;
-	if (a4_included)
-		aad_len += 6;
-	if (qc_included) {
-		pos = (u8 *) &hdr->addr4;
-		if (a4_included)
-			pos += 6;
-		qc = *pos & 0x0f;
-		aad_len += 2;
-	}
-
-	/* CCM Initial Block:
-	 * Flag (Include authentication header, M=3 (8-octet MIC),
-	 *       L=1 (2-octet Dlen))
-	 * Nonce: 0x00 | A2 | PN
-	 * Dlen */
-	b0[0] = 0x59;
-	b0[1] = qc;
-	memcpy(b0 + 2, hdr->addr2, ETH_ALEN);
-	memcpy(b0 + 8, pn, CCMP_PN_LEN);
-	b0[14] = (dlen >> 8) & 0xff;
-	b0[15] = dlen & 0xff;
-
-	/* AAD:
-	 * FC with bits 4..6 and 11..13 masked to zero; 14 is always one
-	 * A1 | A2 | A3
-	 * SC with bits 4..15 (seq#) masked to zero
-	 * A4 (if present)
-	 * QC (if present)
-	 */
-	pos = (u8 *) hdr;
-	aad[0] = 0; /* aad_len >> 8 */
-	aad[1] = aad_len & 0xff;
-	aad[2] = pos[0] & 0x8f;
-	aad[3] = pos[1] & 0xc7;
-	memcpy(aad + 4, hdr->addr1, 3 * ETH_ALEN);
-	pos = (u8 *) &hdr->seq_ctl;
-	aad[22] = pos[0] & 0x0f;
-	aad[23] = 0; /* all bits masked */
-	memset(aad + 24, 0, 8);
-	if (a4_included)
-		memcpy(aad + 24, hdr->addr4, ETH_ALEN);
-	if (qc_included) {
-		aad[a4_included ? 30 : 24] = qc;
-		/* rest of QC masked */
-	}
-
-	/* Start with the first block and AAD */
-	ieee80211_ccmp_aes_encrypt(tfm, b0, auth);
-	xor_block(auth, aad, AES_BLOCK_LEN);
-	ieee80211_ccmp_aes_encrypt(tfm, auth, auth);
-	xor_block(auth, &aad[AES_BLOCK_LEN], AES_BLOCK_LEN);
-	ieee80211_ccmp_aes_encrypt(tfm, auth, auth);
-	b0[0] &= 0x07;
-	b0[14] = b0[15] = 0;
-	ieee80211_ccmp_aes_encrypt(tfm, b0, s0);
-}
-
-
-static int ieee80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-	struct ieee80211_ccmp_data *key = priv;
-	int data_len, i, blocks, last, len;
-	u8 *pos, *mic;
-	struct ieee80211_hdr *hdr;
-	u8 *b0 = key->tx_b0;
-	u8 *b = key->tx_b;
-	u8 *e = key->tx_e;
-	u8 *s0 = key->tx_s0;
-
-	if (skb_headroom(skb) < CCMP_HDR_LEN ||
-	    skb_tailroom(skb) < CCMP_MIC_LEN ||
-	    skb->len < hdr_len)
-		return -1;
-
-	data_len = skb->len - hdr_len;
-	pos = skb_push(skb, CCMP_HDR_LEN);
-	memmove(pos, pos + CCMP_HDR_LEN, hdr_len);
-	pos += hdr_len;
-	mic = skb_put(skb, CCMP_MIC_LEN);
-
-	i = CCMP_PN_LEN - 1;
-	while (i >= 0) {
-		key->tx_pn[i]++;
-		if (key->tx_pn[i] != 0)
-			break;
-		i--;
-	}
-
-	*pos++ = key->tx_pn[5];
-	*pos++ = key->tx_pn[4];
-	*pos++ = 0;
-	*pos++ = (key->key_idx << 6) | (1 << 5) /* Ext IV included */;
-	*pos++ = key->tx_pn[3];
-	*pos++ = key->tx_pn[2];
-	*pos++ = key->tx_pn[1];
-	*pos++ = key->tx_pn[0];
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	ccmp_init_blocks(key->tfm, hdr, key->tx_pn, data_len, b0, b, s0);
-
-	blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN;
-	last = data_len % AES_BLOCK_LEN;
-
-	for (i = 1; i <= blocks; i++) {
-		len = (i == blocks && last) ? last : AES_BLOCK_LEN;
-		/* Authentication */
-		xor_block(b, pos, len);
-		ieee80211_ccmp_aes_encrypt(key->tfm, b, b);
-		/* Encryption, with counter */
-		b0[14] = (i >> 8) & 0xff;
-		b0[15] = i & 0xff;
-		ieee80211_ccmp_aes_encrypt(key->tfm, b0, e);
-		xor_block(pos, e, len);
-		pos += len;
-	}
-
-	for (i = 0; i < CCMP_MIC_LEN; i++)
-		mic[i] = b[i] ^ s0[i];
-
-	return 0;
-}
-
-
-static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-	struct ieee80211_ccmp_data *key = priv;
-	u8 keyidx, *pos;
-	struct ieee80211_hdr *hdr;
-	u8 *b0 = key->rx_b0;
-	u8 *b = key->rx_b;
-	u8 *a = key->rx_a;
-	u8 pn[6];
-	int i, blocks, last, len;
-	size_t data_len = skb->len - hdr_len - CCMP_HDR_LEN - CCMP_MIC_LEN;
-	u8 *mic = skb->data + skb->len - CCMP_MIC_LEN;
-
-	if (skb->len < hdr_len + CCMP_HDR_LEN + CCMP_MIC_LEN) {
-		key->dot11RSNAStatsCCMPFormatErrors++;
-		return -1;
-	}
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	pos = skb->data + hdr_len;
-	keyidx = pos[3];
-	if (!(keyidx & (1 << 5))) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "CCMP: received packet without ExtIV"
-			       " flag from " MAC_FMT "\n", MAC_ARG(hdr->addr2));
-		}
-		key->dot11RSNAStatsCCMPFormatErrors++;
-		return -2;
-	}
-	keyidx >>= 6;
-	if (key->key_idx != keyidx) {
-		printk(KERN_DEBUG "CCMP: RX tkey->key_idx=%d frame "
-		       "keyidx=%d priv=%p\n", key->key_idx, keyidx, priv);
-		return -6;
-	}
-	if (!key->key_set) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "CCMP: received packet from " MAC_FMT
-			       " with keyid=%d that does not have a configured"
-			       " key\n", MAC_ARG(hdr->addr2), keyidx);
-		}
-		return -3;
-	}
-
-	pn[0] = pos[7];
-	pn[1] = pos[6];
-	pn[2] = pos[5];
-	pn[3] = pos[4];
-	pn[4] = pos[1];
-	pn[5] = pos[0];
-	pos += 8;
-
-	if (memcmp(pn, key->rx_pn, CCMP_PN_LEN) <= 0) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "CCMP: replay detected: STA=" MAC_FMT
-			       " previous PN %02x%02x%02x%02x%02x%02x "
-			       "received PN %02x%02x%02x%02x%02x%02x\n",
-			       MAC_ARG(hdr->addr2), MAC_ARG(key->rx_pn),
-			       MAC_ARG(pn));
-		}
-		key->dot11RSNAStatsCCMPReplays++;
-		return -4;
-	}
-
-	ccmp_init_blocks(key->tfm, hdr, pn, data_len, b0, a, b);
-	xor_block(mic, b, CCMP_MIC_LEN);
-
-	blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN;
-	last = data_len % AES_BLOCK_LEN;
-
-	for (i = 1; i <= blocks; i++) {
-		len = (i == blocks && last) ? last : AES_BLOCK_LEN;
-		/* Decrypt, with counter */
-		b0[14] = (i >> 8) & 0xff;
-		b0[15] = i & 0xff;
-		ieee80211_ccmp_aes_encrypt(key->tfm, b0, b);
-		xor_block(pos, b, len);
-		/* Authentication */
-		xor_block(a, pos, len);
-		ieee80211_ccmp_aes_encrypt(key->tfm, a, a);
-		pos += len;
-	}
-
-	if (memcmp(mic, a, CCMP_MIC_LEN) != 0) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "CCMP: decrypt failed: STA="
-			       MAC_FMT "\n", MAC_ARG(hdr->addr2));
-		}
-		key->dot11RSNAStatsCCMPDecryptErrors++;
-		return -5;
-	}
-
-	memcpy(key->rx_pn, pn, CCMP_PN_LEN);
-
-	/* Remove hdr and MIC */
-	memmove(skb->data + CCMP_HDR_LEN, skb->data, hdr_len);
-	skb_pull(skb, CCMP_HDR_LEN);
-	skb_trim(skb, skb->len - CCMP_MIC_LEN);
-
-	return keyidx;
-}
-
-
-static int ieee80211_ccmp_set_key(void *key, int len, u8 *seq, void *priv)
-{
-	struct ieee80211_ccmp_data *data = priv;
-	int keyidx;
-	struct crypto_tfm *tfm = data->tfm;
-
-	keyidx = data->key_idx;
-	memset(data, 0, sizeof(*data));
-	data->key_idx = keyidx;
-	data->tfm = tfm;
-	if (len == CCMP_TK_LEN) {
-		memcpy(data->key, key, CCMP_TK_LEN);
-		data->key_set = 1;
-		if (seq) {
-			data->rx_pn[0] = seq[5];
-			data->rx_pn[1] = seq[4];
-			data->rx_pn[2] = seq[3];
-			data->rx_pn[3] = seq[2];
-			data->rx_pn[4] = seq[1];
-			data->rx_pn[5] = seq[0];
-		}
-		crypto_cipher_setkey(data->tfm, data->key, CCMP_TK_LEN);
-	} else if (len == 0)
-		data->key_set = 0;
-	else
-		return -1;
-
-	return 0;
-}
-
-
-static int ieee80211_ccmp_get_key(void *key, int len, u8 *seq, void *priv)
-{
-	struct ieee80211_ccmp_data *data = priv;
-
-	if (len < CCMP_TK_LEN)
-		return -1;
-
-	if (!data->key_set)
-		return 0;
-	memcpy(key, data->key, CCMP_TK_LEN);
-
-	if (seq) {
-		seq[0] = data->tx_pn[5];
-		seq[1] = data->tx_pn[4];
-		seq[2] = data->tx_pn[3];
-		seq[3] = data->tx_pn[2];
-		seq[4] = data->tx_pn[1];
-		seq[5] = data->tx_pn[0];
-	}
-
-	return CCMP_TK_LEN;
-}
-
-
-static char * ieee80211_ccmp_print_stats(char *p, void *priv)
-{
-	struct ieee80211_ccmp_data *ccmp = priv;
-	p += sprintf(p, "key[%d] alg=CCMP key_set=%d "
-		     "tx_pn=%02x%02x%02x%02x%02x%02x "
-		     "rx_pn=%02x%02x%02x%02x%02x%02x "
-		     "format_errors=%d replays=%d decrypt_errors=%d\n",
-		     ccmp->key_idx, ccmp->key_set,
-		     MAC_ARG(ccmp->tx_pn), MAC_ARG(ccmp->rx_pn),
-		     ccmp->dot11RSNAStatsCCMPFormatErrors,
-		     ccmp->dot11RSNAStatsCCMPReplays,
-		     ccmp->dot11RSNAStatsCCMPDecryptErrors);
-
-	return p;
-}
-
-
-static struct ieee80211_crypto_ops ieee80211_crypt_ccmp = {
-	.name			= "CCMP",
-	.init			= ieee80211_ccmp_init,
-	.deinit			= ieee80211_ccmp_deinit,
-	.encrypt_mpdu		= ieee80211_ccmp_encrypt,
-	.decrypt_mpdu		= ieee80211_ccmp_decrypt,
-	.encrypt_msdu		= NULL,
-	.decrypt_msdu		= NULL,
-	.set_key		= ieee80211_ccmp_set_key,
-	.get_key		= ieee80211_ccmp_get_key,
-	.print_stats		= ieee80211_ccmp_print_stats,
-	.extra_prefix_len	= CCMP_HDR_LEN,
-	.extra_postfix_len	= CCMP_MIC_LEN,
-	.owner			= THIS_MODULE,
-};
-
-
-static int __init ieee80211_crypto_ccmp_init(void)
-{
-	return ieee80211_register_crypto_ops(&ieee80211_crypt_ccmp);
-}
-
-
-static void __exit ieee80211_crypto_ccmp_exit(void)
-{
-	ieee80211_unregister_crypto_ops(&ieee80211_crypt_ccmp);
-}
-
-
-module_init(ieee80211_crypto_ccmp_init);
-module_exit(ieee80211_crypto_ccmp_exit);
diff --git a/trunk/net/ieee80211/ieee80211_crypt_tkip.c b/trunk/net/ieee80211/ieee80211_crypt_tkip.c
deleted file mode 100644
index f91d92c6df25..000000000000
--- a/trunk/net/ieee80211/ieee80211_crypt_tkip.c
+++ /dev/null
@@ -1,708 +0,0 @@
-/*
- * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
- *
- * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-
-#include <linux/config.h>
-#include <linux/version.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/random.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/if_ether.h>
-#include <linux/if_arp.h>
-#include <asm/string.h>
-
-#include <net/ieee80211.h>
-
-
-#include <linux/crypto.h>
-#include <asm/scatterlist.h>
-#include <linux/crc32.h>
-
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Host AP crypt: TKIP");
-MODULE_LICENSE("GPL");
-
-struct ieee80211_tkip_data {
-#define TKIP_KEY_LEN 32
-	u8 key[TKIP_KEY_LEN];
-	int key_set;
-
-	u32 tx_iv32;
-	u16 tx_iv16;
-	u16 tx_ttak[5];
-	int tx_phase1_done;
-
-	u32 rx_iv32;
-	u16 rx_iv16;
-	u16 rx_ttak[5];
-	int rx_phase1_done;
-	u32 rx_iv32_new;
-	u16 rx_iv16_new;
-
-	u32 dot11RSNAStatsTKIPReplays;
-	u32 dot11RSNAStatsTKIPICVErrors;
-	u32 dot11RSNAStatsTKIPLocalMICFailures;
-
-	int key_idx;
-
-	struct crypto_tfm *tfm_arc4;
-	struct crypto_tfm *tfm_michael;
-
-	/* scratch buffers for virt_to_page() (crypto API) */
-	u8 rx_hdr[16], tx_hdr[16];
-};
-
-static void * ieee80211_tkip_init(int key_idx)
-{
-	struct ieee80211_tkip_data *priv;
-
-	priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
-	if (priv == NULL)
-		goto fail;
-	memset(priv, 0, sizeof(*priv));
-	priv->key_idx = key_idx;
-
-	priv->tfm_arc4 = crypto_alloc_tfm("arc4", 0);
-	if (priv->tfm_arc4 == NULL) {
-		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
-		       "crypto API arc4\n");
-		goto fail;
-	}
-
-	priv->tfm_michael = crypto_alloc_tfm("michael_mic", 0);
-	if (priv->tfm_michael == NULL) {
-		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
-		       "crypto API michael_mic\n");
-		goto fail;
-	}
-
-	return priv;
-
-fail:
-	if (priv) {
-		if (priv->tfm_michael)
-			crypto_free_tfm(priv->tfm_michael);
-		if (priv->tfm_arc4)
-			crypto_free_tfm(priv->tfm_arc4);
-		kfree(priv);
-	}
-
-	return NULL;
-}
-
-
-static void ieee80211_tkip_deinit(void *priv)
-{
-	struct ieee80211_tkip_data *_priv = priv;
-	if (_priv && _priv->tfm_michael)
-		crypto_free_tfm(_priv->tfm_michael);
-	if (_priv && _priv->tfm_arc4)
-		crypto_free_tfm(_priv->tfm_arc4);
-	kfree(priv);
-}
-
-
-static inline u16 RotR1(u16 val)
-{
-	return (val >> 1) | (val << 15);
-}
-
-
-static inline u8 Lo8(u16 val)
-{
-	return val & 0xff;
-}
-
-
-static inline u8 Hi8(u16 val)
-{
-	return val >> 8;
-}
-
-
-static inline u16 Lo16(u32 val)
-{
-	return val & 0xffff;
-}
-
-
-static inline u16 Hi16(u32 val)
-{
-	return val >> 16;
-}
-
-
-static inline u16 Mk16(u8 hi, u8 lo)
-{
-	return lo | (((u16) hi) << 8);
-}
-
-
-static inline u16 Mk16_le(u16 *v)
-{
-	return le16_to_cpu(*v);
-}
-
-
-static const u16 Sbox[256] =
-{
-	0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
-	0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
-	0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
-	0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
-	0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
-	0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
-	0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
-	0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
-	0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
-	0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
-	0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
-	0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
-	0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
-	0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
-	0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
-	0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
-	0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
-	0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
-	0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
-	0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
-	0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
-	0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
-	0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
-	0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
-	0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
-	0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
-	0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
-	0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
-	0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
-	0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
-	0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
-	0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
-};
-
-
-static inline u16 _S_(u16 v)
-{
-	u16 t = Sbox[Hi8(v)];
-	return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
-}
-
-
-#define PHASE1_LOOP_COUNT 8
-
-static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
-{
-	int i, j;
-
-	/* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
-	TTAK[0] = Lo16(IV32);
-	TTAK[1] = Hi16(IV32);
-	TTAK[2] = Mk16(TA[1], TA[0]);
-	TTAK[3] = Mk16(TA[3], TA[2]);
-	TTAK[4] = Mk16(TA[5], TA[4]);
-
-	for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
-		j = 2 * (i & 1);
-		TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
-		TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
-		TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
-		TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
-		TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
-	}
-}
-
-
-static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
-			       u16 IV16)
-{
-	/* Make temporary area overlap WEP seed so that the final copy can be
-	 * avoided on little endian hosts. */
-	u16 *PPK = (u16 *) &WEPSeed[4];
-
-	/* Step 1 - make copy of TTAK and bring in TSC */
-	PPK[0] = TTAK[0];
-	PPK[1] = TTAK[1];
-	PPK[2] = TTAK[2];
-	PPK[3] = TTAK[3];
-	PPK[4] = TTAK[4];
-	PPK[5] = TTAK[4] + IV16;
-
-	/* Step 2 - 96-bit bijective mixing using S-box */
-	PPK[0] += _S_(PPK[5] ^ Mk16_le((u16 *) &TK[0]));
-	PPK[1] += _S_(PPK[0] ^ Mk16_le((u16 *) &TK[2]));
-	PPK[2] += _S_(PPK[1] ^ Mk16_le((u16 *) &TK[4]));
-	PPK[3] += _S_(PPK[2] ^ Mk16_le((u16 *) &TK[6]));
-	PPK[4] += _S_(PPK[3] ^ Mk16_le((u16 *) &TK[8]));
-	PPK[5] += _S_(PPK[4] ^ Mk16_le((u16 *) &TK[10]));
-
-	PPK[0] += RotR1(PPK[5] ^ Mk16_le((u16 *) &TK[12]));
-	PPK[1] += RotR1(PPK[0] ^ Mk16_le((u16 *) &TK[14]));
-	PPK[2] += RotR1(PPK[1]);
-	PPK[3] += RotR1(PPK[2]);
-	PPK[4] += RotR1(PPK[3]);
-	PPK[5] += RotR1(PPK[4]);
-
-	/* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
-	 * WEPSeed[0..2] is transmitted as WEP IV */
-	WEPSeed[0] = Hi8(IV16);
-	WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
-	WEPSeed[2] = Lo8(IV16);
-	WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((u16 *) &TK[0])) >> 1);
-
-#ifdef __BIG_ENDIAN
-	{
-		int i;
-		for (i = 0; i < 6; i++)
-			PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
-	}
-#endif
-}
-
-static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-	struct ieee80211_tkip_data *tkey = priv;
-	int len;
-	u8 rc4key[16], *pos, *icv;
-	struct ieee80211_hdr *hdr;
-	u32 crc;
-	struct scatterlist sg;
-
-	if (skb_headroom(skb) < 8 || skb_tailroom(skb) < 4 ||
-	    skb->len < hdr_len)
-		return -1;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	if (!tkey->tx_phase1_done) {
-		tkip_mixing_phase1(tkey->tx_ttak, tkey->key, hdr->addr2,
-				   tkey->tx_iv32);
-		tkey->tx_phase1_done = 1;
-	}
-	tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16);
-
-	len = skb->len - hdr_len;
-	pos = skb_push(skb, 8);
-	memmove(pos, pos + 8, hdr_len);
-	pos += hdr_len;
-	icv = skb_put(skb, 4);
-
-	*pos++ = rc4key[0];
-	*pos++ = rc4key[1];
-	*pos++ = rc4key[2];
-	*pos++ = (tkey->key_idx << 6) | (1 << 5) /* Ext IV included */;
-	*pos++ = tkey->tx_iv32 & 0xff;
-	*pos++ = (tkey->tx_iv32 >> 8) & 0xff;
-	*pos++ = (tkey->tx_iv32 >> 16) & 0xff;
-	*pos++ = (tkey->tx_iv32 >> 24) & 0xff;
-
-	crc = ~crc32_le(~0, pos, len);
-	icv[0] = crc;
-	icv[1] = crc >> 8;
-	icv[2] = crc >> 16;
-	icv[3] = crc >> 24;
-
-	crypto_cipher_setkey(tkey->tfm_arc4, rc4key, 16);
-	sg.page = virt_to_page(pos);
-	sg.offset = offset_in_page(pos);
-	sg.length = len + 4;
-	crypto_cipher_encrypt(tkey->tfm_arc4, &sg, &sg, len + 4);
-
-	tkey->tx_iv16++;
-	if (tkey->tx_iv16 == 0) {
-		tkey->tx_phase1_done = 0;
-		tkey->tx_iv32++;
-	}
-
-	return 0;
-}
-
-static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-	struct ieee80211_tkip_data *tkey = priv;
-	u8 rc4key[16];
-	u8 keyidx, *pos;
-	u32 iv32;
-	u16 iv16;
-	struct ieee80211_hdr *hdr;
-	u8 icv[4];
-	u32 crc;
-	struct scatterlist sg;
-	int plen;
-
-	if (skb->len < hdr_len + 8 + 4)
-		return -1;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	pos = skb->data + hdr_len;
-	keyidx = pos[3];
-	if (!(keyidx & (1 << 5))) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "TKIP: received packet without ExtIV"
-			       " flag from " MAC_FMT "\n", MAC_ARG(hdr->addr2));
-		}
-		return -2;
-	}
-	keyidx >>= 6;
-	if (tkey->key_idx != keyidx) {
-		printk(KERN_DEBUG "TKIP: RX tkey->key_idx=%d frame "
-		       "keyidx=%d priv=%p\n", tkey->key_idx, keyidx, priv);
-		return -6;
-	}
-	if (!tkey->key_set) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "TKIP: received packet from " MAC_FMT
-			       " with keyid=%d that does not have a configured"
-			       " key\n", MAC_ARG(hdr->addr2), keyidx);
-		}
-		return -3;
-	}
-	iv16 = (pos[0] << 8) | pos[2];
-	iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
-	pos += 8;
-
-	if (iv32 < tkey->rx_iv32 ||
-	    (iv32 == tkey->rx_iv32 && iv16 <= tkey->rx_iv16)) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "TKIP: replay detected: STA=" MAC_FMT
-			       " previous TSC %08x%04x received TSC "
-			       "%08x%04x\n", MAC_ARG(hdr->addr2),
-			       tkey->rx_iv32, tkey->rx_iv16, iv32, iv16);
-		}
-		tkey->dot11RSNAStatsTKIPReplays++;
-		return -4;
-	}
-
-	if (iv32 != tkey->rx_iv32 || !tkey->rx_phase1_done) {
-		tkip_mixing_phase1(tkey->rx_ttak, tkey->key, hdr->addr2, iv32);
-		tkey->rx_phase1_done = 1;
-	}
-	tkip_mixing_phase2(rc4key, tkey->key, tkey->rx_ttak, iv16);
-
-	plen = skb->len - hdr_len - 12;
-
-	crypto_cipher_setkey(tkey->tfm_arc4, rc4key, 16);
-	sg.page = virt_to_page(pos);
-	sg.offset = offset_in_page(pos);
-	sg.length = plen + 4;
-	crypto_cipher_decrypt(tkey->tfm_arc4, &sg, &sg, plen + 4);
-
-	crc = ~crc32_le(~0, pos, plen);
-	icv[0] = crc;
-	icv[1] = crc >> 8;
-	icv[2] = crc >> 16;
-	icv[3] = crc >> 24;
-	if (memcmp(icv, pos + plen, 4) != 0) {
-		if (iv32 != tkey->rx_iv32) {
-			/* Previously cached Phase1 result was already lost, so
-			 * it needs to be recalculated for the next packet. */
-			tkey->rx_phase1_done = 0;
-		}
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "TKIP: ICV error detected: STA="
-			       MAC_FMT "\n", MAC_ARG(hdr->addr2));
-		}
-		tkey->dot11RSNAStatsTKIPICVErrors++;
-		return -5;
-	}
-
-	/* Update real counters only after Michael MIC verification has
-	 * completed */
-	tkey->rx_iv32_new = iv32;
-	tkey->rx_iv16_new = iv16;
-
-	/* Remove IV and ICV */
-	memmove(skb->data + 8, skb->data, hdr_len);
-	skb_pull(skb, 8);
-	skb_trim(skb, skb->len - 4);
-
-	return keyidx;
-}
-
-
-static int michael_mic(struct ieee80211_tkip_data *tkey, u8 *key, u8 *hdr,
-		       u8 *data, size_t data_len, u8 *mic)
-{
-	struct scatterlist sg[2];
-
-	if (tkey->tfm_michael == NULL) {
-		printk(KERN_WARNING "michael_mic: tfm_michael == NULL\n");
-		return -1;
-	}
-	sg[0].page = virt_to_page(hdr);
-	sg[0].offset = offset_in_page(hdr);
-	sg[0].length = 16;
-
-	sg[1].page = virt_to_page(data);
-	sg[1].offset = offset_in_page(data);
-	sg[1].length = data_len;
-
-	crypto_digest_init(tkey->tfm_michael);
-	crypto_digest_setkey(tkey->tfm_michael, key, 8);
-	crypto_digest_update(tkey->tfm_michael, sg, 2);
-	crypto_digest_final(tkey->tfm_michael, mic);
-
-	return 0;
-}
-
-static void michael_mic_hdr(struct sk_buff *skb, u8 *hdr)
-{
-	struct ieee80211_hdr *hdr11;
-
-	hdr11 = (struct ieee80211_hdr *) skb->data;
-	switch (le16_to_cpu(hdr11->frame_ctl) &
-		(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
-	case IEEE80211_FCTL_TODS:
-		memcpy(hdr, hdr11->addr3, ETH_ALEN); /* DA */
-		memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
-		break;
-	case IEEE80211_FCTL_FROMDS:
-		memcpy(hdr, hdr11->addr1, ETH_ALEN); /* DA */
-		memcpy(hdr + ETH_ALEN, hdr11->addr3, ETH_ALEN); /* SA */
-		break;
-	case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
-		memcpy(hdr, hdr11->addr3, ETH_ALEN); /* DA */
-		memcpy(hdr + ETH_ALEN, hdr11->addr4, ETH_ALEN); /* SA */
-		break;
-	case 0:
-		memcpy(hdr, hdr11->addr1, ETH_ALEN); /* DA */
-		memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
-		break;
-	}
-
-	hdr[12] = 0; /* priority */
-	hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
-}
-
-
-static int ieee80211_michael_mic_add(struct sk_buff *skb, int hdr_len, void *priv)
-{
-	struct ieee80211_tkip_data *tkey = priv;
-	u8 *pos;
-
-	if (skb_tailroom(skb) < 8 || skb->len < hdr_len) {
-		printk(KERN_DEBUG "Invalid packet for Michael MIC add "
-		       "(tailroom=%d hdr_len=%d skb->len=%d)\n",
-		       skb_tailroom(skb), hdr_len, skb->len);
-		return -1;
-	}
-
-	michael_mic_hdr(skb, tkey->tx_hdr);
-	pos = skb_put(skb, 8);
-	if (michael_mic(tkey, &tkey->key[16], tkey->tx_hdr,
-			skb->data + hdr_len, skb->len - 8 - hdr_len, pos))
-		return -1;
-
-	return 0;
-}
-
-
-#if WIRELESS_EXT >= 18
-static void ieee80211_michael_mic_failure(struct net_device *dev,
-				       struct ieee80211_hdr *hdr,
-				       int keyidx)
-{
-	union iwreq_data wrqu;
-	struct iw_michaelmicfailure ev;
-
-	/* TODO: needed parameters: count, keyid, key type, TSC */
-	memset(&ev, 0, sizeof(ev));
-	ev.flags = keyidx & IW_MICFAILURE_KEY_ID;
-	if (hdr->addr1[0] & 0x01)
-		ev.flags |= IW_MICFAILURE_GROUP;
-	else
-		ev.flags |= IW_MICFAILURE_PAIRWISE;
-	ev.src_addr.sa_family = ARPHRD_ETHER;
-	memcpy(ev.src_addr.sa_data, hdr->addr2, ETH_ALEN);
-	memset(&wrqu, 0, sizeof(wrqu));
-	wrqu.data.length = sizeof(ev);
-	wireless_send_event(dev, IWEVMICHAELMICFAILURE, &wrqu, (char *) &ev);
-}
-#elif WIRELESS_EXT >= 15
-static void ieee80211_michael_mic_failure(struct net_device *dev,
-				       struct ieee80211_hdr *hdr,
-				       int keyidx)
-{
-	union iwreq_data wrqu;
-	char buf[128];
-
-	/* TODO: needed parameters: count, keyid, key type, TSC */
-	sprintf(buf, "MLME-MICHAELMICFAILURE.indication(keyid=%d %scast addr="
-		MAC_FMT ")", keyidx, hdr->addr1[0] & 0x01 ? "broad" : "uni",
-		MAC_ARG(hdr->addr2));
-	memset(&wrqu, 0, sizeof(wrqu));
-	wrqu.data.length = strlen(buf);
-	wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
-}
-#else /* WIRELESS_EXT >= 15 */
-static inline void ieee80211_michael_mic_failure(struct net_device *dev,
-					      struct ieee80211_hdr *hdr,
-					      int keyidx)
-{
-}
-#endif /* WIRELESS_EXT >= 15 */
-
-
-static int ieee80211_michael_mic_verify(struct sk_buff *skb, int keyidx,
-				     int hdr_len, void *priv)
-{
-	struct ieee80211_tkip_data *tkey = priv;
-	u8 mic[8];
-
-	if (!tkey->key_set)
-		return -1;
-
-	michael_mic_hdr(skb, tkey->rx_hdr);
-	if (michael_mic(tkey, &tkey->key[24], tkey->rx_hdr,
-			skb->data + hdr_len, skb->len - 8 - hdr_len, mic))
-		return -1;
-	if (memcmp(mic, skb->data + skb->len - 8, 8) != 0) {
-		struct ieee80211_hdr *hdr;
-		hdr = (struct ieee80211_hdr *) skb->data;
-		printk(KERN_DEBUG "%s: Michael MIC verification failed for "
-		       "MSDU from " MAC_FMT " keyidx=%d\n",
-		       skb->dev ? skb->dev->name : "N/A", MAC_ARG(hdr->addr2),
-		       keyidx);
-		if (skb->dev)
-			ieee80211_michael_mic_failure(skb->dev, hdr, keyidx);
-		tkey->dot11RSNAStatsTKIPLocalMICFailures++;
-		return -1;
-	}
-
-	/* Update TSC counters for RX now that the packet verification has
-	 * completed. */
-	tkey->rx_iv32 = tkey->rx_iv32_new;
-	tkey->rx_iv16 = tkey->rx_iv16_new;
-
-	skb_trim(skb, skb->len - 8);
-
-	return 0;
-}
-
-
-static int ieee80211_tkip_set_key(void *key, int len, u8 *seq, void *priv)
-{
-	struct ieee80211_tkip_data *tkey = priv;
-	int keyidx;
-	struct crypto_tfm *tfm = tkey->tfm_michael;
-	struct crypto_tfm *tfm2 = tkey->tfm_arc4;
-
-	keyidx = tkey->key_idx;
-	memset(tkey, 0, sizeof(*tkey));
-	tkey->key_idx = keyidx;
-	tkey->tfm_michael = tfm;
-	tkey->tfm_arc4 = tfm2;
-	if (len == TKIP_KEY_LEN) {
-		memcpy(tkey->key, key, TKIP_KEY_LEN);
-		tkey->key_set = 1;
-		tkey->tx_iv16 = 1; /* TSC is initialized to 1 */
-		if (seq) {
-			tkey->rx_iv32 = (seq[5] << 24) | (seq[4] << 16) |
-				(seq[3] << 8) | seq[2];
-			tkey->rx_iv16 = (seq[1] << 8) | seq[0];
-		}
-	} else if (len == 0)
-		tkey->key_set = 0;
-	else
-		return -1;
-
-	return 0;
-}
-
-
-static int ieee80211_tkip_get_key(void *key, int len, u8 *seq, void *priv)
-{
-	struct ieee80211_tkip_data *tkey = priv;
-
-	if (len < TKIP_KEY_LEN)
-		return -1;
-
-	if (!tkey->key_set)
-		return 0;
-	memcpy(key, tkey->key, TKIP_KEY_LEN);
-
-	if (seq) {
-		/* Return the sequence number of the last transmitted frame. */
-		u16 iv16 = tkey->tx_iv16;
-		u32 iv32 = tkey->tx_iv32;
-		if (iv16 == 0)
-			iv32--;
-		iv16--;
-		seq[0] = tkey->tx_iv16;
-		seq[1] = tkey->tx_iv16 >> 8;
-		seq[2] = tkey->tx_iv32;
-		seq[3] = tkey->tx_iv32 >> 8;
-		seq[4] = tkey->tx_iv32 >> 16;
-		seq[5] = tkey->tx_iv32 >> 24;
-	}
-
-	return TKIP_KEY_LEN;
-}
-
-
-static char * ieee80211_tkip_print_stats(char *p, void *priv)
-{
-	struct ieee80211_tkip_data *tkip = priv;
-	p += sprintf(p, "key[%d] alg=TKIP key_set=%d "
-		     "tx_pn=%02x%02x%02x%02x%02x%02x "
-		     "rx_pn=%02x%02x%02x%02x%02x%02x "
-		     "replays=%d icv_errors=%d local_mic_failures=%d\n",
-		     tkip->key_idx, tkip->key_set,
-		     (tkip->tx_iv32 >> 24) & 0xff,
-		     (tkip->tx_iv32 >> 16) & 0xff,
-		     (tkip->tx_iv32 >> 8) & 0xff,
-		     tkip->tx_iv32 & 0xff,
-		     (tkip->tx_iv16 >> 8) & 0xff,
-		     tkip->tx_iv16 & 0xff,
-		     (tkip->rx_iv32 >> 24) & 0xff,
-		     (tkip->rx_iv32 >> 16) & 0xff,
-		     (tkip->rx_iv32 >> 8) & 0xff,
-		     tkip->rx_iv32 & 0xff,
-		     (tkip->rx_iv16 >> 8) & 0xff,
-		     tkip->rx_iv16 & 0xff,
-		     tkip->dot11RSNAStatsTKIPReplays,
-		     tkip->dot11RSNAStatsTKIPICVErrors,
-		     tkip->dot11RSNAStatsTKIPLocalMICFailures);
-	return p;
-}
-
-
-static struct ieee80211_crypto_ops ieee80211_crypt_tkip = {
-	.name			= "TKIP",
-	.init			= ieee80211_tkip_init,
-	.deinit			= ieee80211_tkip_deinit,
-	.encrypt_mpdu		= ieee80211_tkip_encrypt,
-	.decrypt_mpdu		= ieee80211_tkip_decrypt,
-	.encrypt_msdu		= ieee80211_michael_mic_add,
-	.decrypt_msdu		= ieee80211_michael_mic_verify,
-	.set_key		= ieee80211_tkip_set_key,
-	.get_key		= ieee80211_tkip_get_key,
-	.print_stats		= ieee80211_tkip_print_stats,
-	.extra_prefix_len	= 4 + 4, /* IV + ExtIV */
-	.extra_postfix_len	= 8 + 4, /* MIC + ICV */
-	.owner		        = THIS_MODULE,
-};
-
-
-static int __init ieee80211_crypto_tkip_init(void)
-{
-	return ieee80211_register_crypto_ops(&ieee80211_crypt_tkip);
-}
-
-
-static void __exit ieee80211_crypto_tkip_exit(void)
-{
-	ieee80211_unregister_crypto_ops(&ieee80211_crypt_tkip);
-}
-
-
-module_init(ieee80211_crypto_tkip_init);
-module_exit(ieee80211_crypto_tkip_exit);
diff --git a/trunk/net/ieee80211/ieee80211_crypt_wep.c b/trunk/net/ieee80211/ieee80211_crypt_wep.c
deleted file mode 100644
index bec1d3470d39..000000000000
--- a/trunk/net/ieee80211/ieee80211_crypt_wep.c
+++ /dev/null
@@ -1,272 +0,0 @@
-/*
- * Host AP crypt: host-based WEP encryption implementation for Host AP driver
- *
- * Copyright (c) 2002-2004, Jouni Malinen <jkmaline@cc.hut.fi>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-
-#include <linux/config.h>
-#include <linux/version.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/random.h>
-#include <linux/skbuff.h>
-#include <asm/string.h>
-
-#include <net/ieee80211.h>
-
-
-#include <linux/crypto.h>
-#include <asm/scatterlist.h>
-#include <linux/crc32.h>
-
-MODULE_AUTHOR("Jouni Malinen");
-MODULE_DESCRIPTION("Host AP crypt: WEP");
-MODULE_LICENSE("GPL");
-
-
-struct prism2_wep_data {
-	u32 iv;
-#define WEP_KEY_LEN 13
-	u8 key[WEP_KEY_LEN + 1];
-	u8 key_len;
-	u8 key_idx;
-	struct crypto_tfm *tfm;
-};
-
-
-static void * prism2_wep_init(int keyidx)
-{
-	struct prism2_wep_data *priv;
-
-	priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
-	if (priv == NULL)
-		goto fail;
-	memset(priv, 0, sizeof(*priv));
-	priv->key_idx = keyidx;
-
-	priv->tfm = crypto_alloc_tfm("arc4", 0);
-	if (priv->tfm == NULL) {
-		printk(KERN_DEBUG "ieee80211_crypt_wep: could not allocate "
-		       "crypto API arc4\n");
-		goto fail;
-	}
-
-	/* start WEP IV from a random value */
-	get_random_bytes(&priv->iv, 4);
-
-	return priv;
-
-fail:
-	if (priv) {
-		if (priv->tfm)
-			crypto_free_tfm(priv->tfm);
-		kfree(priv);
-	}
-	return NULL;
-}
-
-
-static void prism2_wep_deinit(void *priv)
-{
-	struct prism2_wep_data *_priv = priv;
-	if (_priv && _priv->tfm)
-		crypto_free_tfm(_priv->tfm);
-	kfree(priv);
-}
-
-
-/* Perform WEP encryption on given skb that has at least 4 bytes of headroom
- * for IV and 4 bytes of tailroom for ICV. Both IV and ICV will be transmitted,
- * so the payload length increases with 8 bytes.
- *
- * WEP frame payload: IV + TX key idx, RC4(data), ICV = RC4(CRC32(data))
- */
-static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-	struct prism2_wep_data *wep = priv;
-	u32 crc, klen, len;
-	u8 key[WEP_KEY_LEN + 3];
-	u8 *pos, *icv;
-	struct scatterlist sg;
-
-	if (skb_headroom(skb) < 4 || skb_tailroom(skb) < 4 ||
-	    skb->len < hdr_len)
-		return -1;
-
-	len = skb->len - hdr_len;
-	pos = skb_push(skb, 4);
-	memmove(pos, pos + 4, hdr_len);
-	pos += hdr_len;
-
-	klen = 3 + wep->key_len;
-
-	wep->iv++;
-
-	/* Fluhrer, Mantin, and Shamir have reported weaknesses in the key
-	 * scheduling algorithm of RC4. At least IVs (KeyByte + 3, 0xff, N)
-	 * can be used to speedup attacks, so avoid using them. */
-	if ((wep->iv & 0xff00) == 0xff00) {
-		u8 B = (wep->iv >> 16) & 0xff;
-		if (B >= 3 && B < klen)
-			wep->iv += 0x0100;
-	}
-
-	/* Prepend 24-bit IV to RC4 key and TX frame */
-	*pos++ = key[0] = (wep->iv >> 16) & 0xff;
-	*pos++ = key[1] = (wep->iv >> 8) & 0xff;
-	*pos++ = key[2] = wep->iv & 0xff;
-	*pos++ = wep->key_idx << 6;
-
-	/* Copy rest of the WEP key (the secret part) */
-	memcpy(key + 3, wep->key, wep->key_len);
-
-	/* Append little-endian CRC32 and encrypt it to produce ICV */
-	crc = ~crc32_le(~0, pos, len);
-	icv = skb_put(skb, 4);
-	icv[0] = crc;
-	icv[1] = crc >> 8;
-	icv[2] = crc >> 16;
-	icv[3] = crc >> 24;
-
-	crypto_cipher_setkey(wep->tfm, key, klen);
-	sg.page = virt_to_page(pos);
-	sg.offset = offset_in_page(pos);
-	sg.length = len + 4;
-	crypto_cipher_encrypt(wep->tfm, &sg, &sg, len + 4);
-
-	return 0;
-}
-
-
-/* Perform WEP decryption on given buffer. Buffer includes whole WEP part of
- * the frame: IV (4 bytes), encrypted payload (including SNAP header),
- * ICV (4 bytes). len includes both IV and ICV.
- *
- * Returns 0 if frame was decrypted successfully and ICV was correct and -1 on
- * failure. If frame is OK, IV and ICV will be removed.
- */
-static int prism2_wep_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
-{
-	struct prism2_wep_data *wep = priv;
-	u32 crc, klen, plen;
-	u8 key[WEP_KEY_LEN + 3];
-	u8 keyidx, *pos, icv[4];
-	struct scatterlist sg;
-
-	if (skb->len < hdr_len + 8)
-		return -1;
-
-	pos = skb->data + hdr_len;
-	key[0] = *pos++;
-	key[1] = *pos++;
-	key[2] = *pos++;
-	keyidx = *pos++ >> 6;
-	if (keyidx != wep->key_idx)
-		return -1;
-
-	klen = 3 + wep->key_len;
-
-	/* Copy rest of the WEP key (the secret part) */
-	memcpy(key + 3, wep->key, wep->key_len);
-
-	/* Apply RC4 to data and compute CRC32 over decrypted data */
-	plen = skb->len - hdr_len - 8;
-
-	crypto_cipher_setkey(wep->tfm, key, klen);
-	sg.page = virt_to_page(pos);
-	sg.offset = offset_in_page(pos);
-	sg.length = plen + 4;
-	crypto_cipher_decrypt(wep->tfm, &sg, &sg, plen + 4);
-
-	crc = ~crc32_le(~0, pos, plen);
-	icv[0] = crc;
-	icv[1] = crc >> 8;
-	icv[2] = crc >> 16;
-	icv[3] = crc >> 24;
-	if (memcmp(icv, pos + plen, 4) != 0) {
-		/* ICV mismatch - drop frame */
-		return -2;
-	}
-
-	/* Remove IV and ICV */
-	memmove(skb->data + 4, skb->data, hdr_len);
-	skb_pull(skb, 4);
-	skb_trim(skb, skb->len - 4);
-
-	return 0;
-}
-
-
-static int prism2_wep_set_key(void *key, int len, u8 *seq, void *priv)
-{
-	struct prism2_wep_data *wep = priv;
-
-	if (len < 0 || len > WEP_KEY_LEN)
-		return -1;
-
-	memcpy(wep->key, key, len);
-	wep->key_len = len;
-
-	return 0;
-}
-
-
-static int prism2_wep_get_key(void *key, int len, u8 *seq, void *priv)
-{
-	struct prism2_wep_data *wep = priv;
-
-	if (len < wep->key_len)
-		return -1;
-
-	memcpy(key, wep->key, wep->key_len);
-
-	return wep->key_len;
-}
-
-
-static char * prism2_wep_print_stats(char *p, void *priv)
-{
-	struct prism2_wep_data *wep = priv;
-	p += sprintf(p, "key[%d] alg=WEP len=%d\n",
-		     wep->key_idx, wep->key_len);
-	return p;
-}
-
-
-static struct ieee80211_crypto_ops ieee80211_crypt_wep = {
-	.name			= "WEP",
-	.init			= prism2_wep_init,
-	.deinit			= prism2_wep_deinit,
-	.encrypt_mpdu		= prism2_wep_encrypt,
-	.decrypt_mpdu		= prism2_wep_decrypt,
-	.encrypt_msdu		= NULL,
-	.decrypt_msdu		= NULL,
-	.set_key		= prism2_wep_set_key,
-	.get_key		= prism2_wep_get_key,
-	.print_stats		= prism2_wep_print_stats,
-	.extra_prefix_len	= 4, /* IV */
-	.extra_postfix_len	= 4, /* ICV */
-	.owner			= THIS_MODULE,
-};
-
-
-static int __init ieee80211_crypto_wep_init(void)
-{
-	return ieee80211_register_crypto_ops(&ieee80211_crypt_wep);
-}
-
-
-static void __exit ieee80211_crypto_wep_exit(void)
-{
-	ieee80211_unregister_crypto_ops(&ieee80211_crypt_wep);
-}
-
-
-module_init(ieee80211_crypto_wep_init);
-module_exit(ieee80211_crypto_wep_exit);
diff --git a/trunk/net/ieee80211/ieee80211_module.c b/trunk/net/ieee80211/ieee80211_module.c
deleted file mode 100644
index 553acb2e93d5..000000000000
--- a/trunk/net/ieee80211/ieee80211_module.c
+++ /dev/null
@@ -1,299 +0,0 @@
-/*******************************************************************************
-
-  Copyright(c) 2004 Intel Corporation. All rights reserved.
-
-  Portions of this file are based on the WEP enablement code provided by the
-  Host AP project hostap-drivers v0.1.3
-  Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
-  <jkmaline@cc.hut.fi>
-  Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
-
-#include <linux/compiler.h>
-#include <linux/config.h>
-#include <linux/errno.h>
-#include <linux/if_arp.h>
-#include <linux/in6.h>
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/proc_fs.h>
-#include <linux/skbuff.h>
-#include <linux/slab.h>
-#include <linux/tcp.h>
-#include <linux/types.h>
-#include <linux/version.h>
-#include <linux/wireless.h>
-#include <linux/etherdevice.h>
-#include <asm/uaccess.h>
-#include <net/arp.h>
-
-#include <net/ieee80211.h>
-
-MODULE_DESCRIPTION("802.11 data/management/control stack");
-MODULE_AUTHOR("Copyright (C) 2004 Intel Corporation <jketreno@linux.intel.com>");
-MODULE_LICENSE("GPL");
-
-#define DRV_NAME "ieee80211"
-
-static inline int ieee80211_networks_allocate(struct ieee80211_device *ieee)
-{
-	if (ieee->networks)
-		return 0;
-
-	ieee->networks = kmalloc(
-		MAX_NETWORK_COUNT * sizeof(struct ieee80211_network),
-		GFP_KERNEL);
-	if (!ieee->networks) {
-		printk(KERN_WARNING "%s: Out of memory allocating beacons\n",
-		       ieee->dev->name);
-		return -ENOMEM;
-	}
-
-	memset(ieee->networks, 0,
-	       MAX_NETWORK_COUNT * sizeof(struct ieee80211_network));
-
-	return 0;
-}
-
-static inline void ieee80211_networks_free(struct ieee80211_device *ieee)
-{
-	if (!ieee->networks)
-		return;
-	kfree(ieee->networks);
-	ieee->networks = NULL;
-}
-
-static inline void ieee80211_networks_initialize(struct ieee80211_device *ieee)
-{
-	int i;
-
-	INIT_LIST_HEAD(&ieee->network_free_list);
-	INIT_LIST_HEAD(&ieee->network_list);
-	for (i = 0; i < MAX_NETWORK_COUNT; i++)
-		list_add_tail(&ieee->networks[i].list, &ieee->network_free_list);
-}
-
-
-struct net_device *alloc_ieee80211(int sizeof_priv)
-{
-	struct ieee80211_device *ieee;
-	struct net_device *dev;
-	int err;
-
-	IEEE80211_DEBUG_INFO("Initializing...\n");
-
-	dev = alloc_etherdev(sizeof(struct ieee80211_device) + sizeof_priv);
-	if (!dev) {
-		IEEE80211_ERROR("Unable to network device.\n");
-		goto failed;
-	}
-	ieee = netdev_priv(dev);
-	dev->hard_start_xmit = ieee80211_xmit;
-
-	ieee->dev = dev;
-
-	err = ieee80211_networks_allocate(ieee);
-	if (err) {
-		IEEE80211_ERROR("Unable to allocate beacon storage: %d\n",
-				err);
-		goto failed;
-	}
-	ieee80211_networks_initialize(ieee);
-
-	/* Default fragmentation threshold is maximum payload size */
-	ieee->fts = DEFAULT_FTS;
-	ieee->scan_age = DEFAULT_MAX_SCAN_AGE;
-	ieee->open_wep = 1;
-
-	/* Default to enabling full open WEP with host based encrypt/decrypt */
-	ieee->host_encrypt = 1;
-	ieee->host_decrypt = 1;
-	ieee->ieee802_1x = 1; /* Default to supporting 802.1x */
-
-	INIT_LIST_HEAD(&ieee->crypt_deinit_list);
-	init_timer(&ieee->crypt_deinit_timer);
-	ieee->crypt_deinit_timer.data = (unsigned long)ieee;
-	ieee->crypt_deinit_timer.function = ieee80211_crypt_deinit_handler;
-
-	spin_lock_init(&ieee->lock);
-
- 	ieee->wpa_enabled = 0;
- 	ieee->tkip_countermeasures = 0;
- 	ieee->drop_unencrypted = 0;
- 	ieee->privacy_invoked = 0;
- 	ieee->ieee802_1x = 1;
-
-	return dev;
-
- failed:
-	if (dev)
-		free_netdev(dev);
-	return NULL;
-}
-
-
-void free_ieee80211(struct net_device *dev)
-{
-	struct ieee80211_device *ieee = netdev_priv(dev);
-
-	int i;
-
-	del_timer_sync(&ieee->crypt_deinit_timer);
-	ieee80211_crypt_deinit_entries(ieee, 1);
-
-	for (i = 0; i < WEP_KEYS; i++) {
-		struct ieee80211_crypt_data *crypt = ieee->crypt[i];
-		if (crypt) {
-			if (crypt->ops) {
-				crypt->ops->deinit(crypt->priv);
-				module_put(crypt->ops->owner);
-			}
-			kfree(crypt);
-			ieee->crypt[i] = NULL;
-		}
-	}
-
-	ieee80211_networks_free(ieee);
-	free_netdev(dev);
-}
-
-#ifdef CONFIG_IEEE80211_DEBUG
-
-static int debug = 0;
-u32 ieee80211_debug_level = 0;
-struct proc_dir_entry *ieee80211_proc = NULL;
-
-static int show_debug_level(char *page, char **start, off_t offset,
-			    int count, int *eof, void *data)
-{
-	return snprintf(page, count, "0x%08X\n", ieee80211_debug_level);
-}
-
-static int store_debug_level(struct file *file, const char __user *buffer,
-			     unsigned long count, void *data)
-{
-	char buf[] = "0x00000000";
-	char *p = (char *)buf;
-	unsigned long val;
-
-	if (count > sizeof(buf) - 1)
-		count = sizeof(buf) - 1;
-
-	if (copy_from_user(buf, buffer, count))
-		return count;
-	buf[count] = 0;
-	/*
-	 * what a FPOS...  What, sscanf(buf, "%i", &val) would be too
-	 * scary?
-	 */
-	if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
-		p++;
-		if (p[0] == 'x' || p[0] == 'X')
-			p++;
-		val = simple_strtoul(p, &p, 16);
-	} else
-		val = simple_strtoul(p, &p, 10);
-	if (p == buf)
-		printk(KERN_INFO DRV_NAME
-		       ": %s is not in hex or decimal form.\n", buf);
-	else
-		ieee80211_debug_level = val;
-
-	return strlen(buf);
-}
-
-static int __init ieee80211_init(void)
-{
-	struct proc_dir_entry *e;
-
-	ieee80211_debug_level = debug;
-	ieee80211_proc = create_proc_entry(DRV_NAME, S_IFDIR, proc_net);
-	if (ieee80211_proc == NULL) {
-		IEEE80211_ERROR("Unable to create " DRV_NAME
-				" proc directory\n");
-		return -EIO;
-	}
-	e = create_proc_entry("debug_level", S_IFREG | S_IRUGO | S_IWUSR,
-			      ieee80211_proc);
-	if (!e) {
-		remove_proc_entry(DRV_NAME, proc_net);
-		ieee80211_proc = NULL;
-		return -EIO;
-	}
-	e->read_proc = show_debug_level;
-	e->write_proc = store_debug_level;
-	e->data = NULL;
-
-	return 0;
-}
-
-static void __exit ieee80211_exit(void)
-{
-	if (ieee80211_proc) {
-		remove_proc_entry("debug_level", ieee80211_proc);
-		remove_proc_entry(DRV_NAME, proc_net);
-		ieee80211_proc = NULL;
-	}
-}
-
-#include <linux/moduleparam.h>
-module_param(debug, int, 0444);
-MODULE_PARM_DESC(debug, "debug output mask");
-
-
-module_exit(ieee80211_exit);
-module_init(ieee80211_init);
-#endif
-
-
-const char *escape_essid(const char *essid, u8 essid_len) {
-	static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
-	const char *s = essid;
-	char *d = escaped;
-
-	if (ieee80211_is_empty_essid(essid, essid_len)) {
-		memcpy(escaped, "<hidden>", sizeof("<hidden>"));
-		return escaped;
-	}
-
-	essid_len = min(essid_len, (u8)IW_ESSID_MAX_SIZE);
-	while (essid_len--) {
-		if (*s == '\0') {
-			*d++ = '\\';
-			*d++ = '0';
-			s++;
-		} else {
-			*d++ = *s++;
-		}
-	}
-	*d = '\0';
-	return escaped;
-}
-
-EXPORT_SYMBOL(alloc_ieee80211);
-EXPORT_SYMBOL(free_ieee80211);
-EXPORT_SYMBOL(escape_essid);
diff --git a/trunk/net/ieee80211/ieee80211_rx.c b/trunk/net/ieee80211/ieee80211_rx.c
deleted file mode 100644
index d582faa6447d..000000000000
--- a/trunk/net/ieee80211/ieee80211_rx.c
+++ /dev/null
@@ -1,1189 +0,0 @@
-/*
- * Original code based Host AP (software wireless LAN access point) driver
- * for Intersil Prism2/2.5/3 - hostap.o module, common routines
- *
- * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
- * <jkmaline@cc.hut.fi>
- * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
- * Copyright (c) 2004, Intel Corporation
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation. See README and COPYING for
- * more details.
- */
-
-#include <linux/compiler.h>
-#include <linux/config.h>
-#include <linux/errno.h>
-#include <linux/if_arp.h>
-#include <linux/in6.h>
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/proc_fs.h>
-#include <linux/skbuff.h>
-#include <linux/slab.h>
-#include <linux/tcp.h>
-#include <linux/types.h>
-#include <linux/version.h>
-#include <linux/wireless.h>
-#include <linux/etherdevice.h>
-#include <asm/uaccess.h>
-#include <linux/ctype.h>
-
-#include <net/ieee80211.h>
-
-static inline void ieee80211_monitor_rx(struct ieee80211_device *ieee,
-					struct sk_buff *skb,
-					struct ieee80211_rx_stats *rx_stats)
-{
-	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-	u16 fc = le16_to_cpu(hdr->frame_ctl);
-
-	skb->dev = ieee->dev;
-	skb->mac.raw = skb->data;
-	skb_pull(skb, ieee80211_get_hdrlen(fc));
-	skb->pkt_type = PACKET_OTHERHOST;
-	skb->protocol = __constant_htons(ETH_P_80211_RAW);
-	memset(skb->cb, 0, sizeof(skb->cb));
-	netif_rx(skb);
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static struct ieee80211_frag_entry *
-ieee80211_frag_cache_find(struct ieee80211_device *ieee, unsigned int seq,
-			  unsigned int frag, u8 *src, u8 *dst)
-{
-	struct ieee80211_frag_entry *entry;
-	int i;
-
-	for (i = 0; i < IEEE80211_FRAG_CACHE_LEN; i++) {
-		entry = &ieee->frag_cache[i];
-		if (entry->skb != NULL &&
-		    time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
-			IEEE80211_DEBUG_FRAG(
-				"expiring fragment cache entry "
-				"seq=%u last_frag=%u\n",
-				entry->seq, entry->last_frag);
-			dev_kfree_skb_any(entry->skb);
-			entry->skb = NULL;
-		}
-
-		if (entry->skb != NULL && entry->seq == seq &&
-		    (entry->last_frag + 1 == frag || frag == -1) &&
-		    memcmp(entry->src_addr, src, ETH_ALEN) == 0 &&
-		    memcmp(entry->dst_addr, dst, ETH_ALEN) == 0)
-			return entry;
-	}
-
-	return NULL;
-}
-
-/* Called only as a tasklet (software IRQ) */
-static struct sk_buff *
-ieee80211_frag_cache_get(struct ieee80211_device *ieee,
-			 struct ieee80211_hdr *hdr)
-{
-	struct sk_buff *skb = NULL;
-	u16 sc;
-	unsigned int frag, seq;
-	struct ieee80211_frag_entry *entry;
-
-	sc = le16_to_cpu(hdr->seq_ctl);
-	frag = WLAN_GET_SEQ_FRAG(sc);
-	seq = WLAN_GET_SEQ_SEQ(sc);
-
-	if (frag == 0) {
-		/* Reserve enough space to fit maximum frame length */
-		skb = dev_alloc_skb(ieee->dev->mtu +
-				    sizeof(struct ieee80211_hdr) +
-				    8 /* LLC */ +
-				    2 /* alignment */ +
-				    8 /* WEP */ + ETH_ALEN /* WDS */);
-		if (skb == NULL)
-			return NULL;
-
-		entry = &ieee->frag_cache[ieee->frag_next_idx];
-		ieee->frag_next_idx++;
-		if (ieee->frag_next_idx >= IEEE80211_FRAG_CACHE_LEN)
-			ieee->frag_next_idx = 0;
-
-		if (entry->skb != NULL)
-			dev_kfree_skb_any(entry->skb);
-
-		entry->first_frag_time = jiffies;
-		entry->seq = seq;
-		entry->last_frag = frag;
-		entry->skb = skb;
-		memcpy(entry->src_addr, hdr->addr2, ETH_ALEN);
-		memcpy(entry->dst_addr, hdr->addr1, ETH_ALEN);
-	} else {
-		/* received a fragment of a frame for which the head fragment
-		 * should have already been received */
-		entry = ieee80211_frag_cache_find(ieee, seq, frag, hdr->addr2,
-						  hdr->addr1);
-		if (entry != NULL) {
-			entry->last_frag = frag;
-			skb = entry->skb;
-		}
-	}
-
-	return skb;
-}
-
-
-/* Called only as a tasklet (software IRQ) */
-static int ieee80211_frag_cache_invalidate(struct ieee80211_device *ieee,
-					   struct ieee80211_hdr *hdr)
-{
-	u16 sc;
-	unsigned int seq;
-	struct ieee80211_frag_entry *entry;
-
-	sc = le16_to_cpu(hdr->seq_ctl);
-	seq = WLAN_GET_SEQ_SEQ(sc);
-
-	entry = ieee80211_frag_cache_find(ieee, seq, -1, hdr->addr2,
-					  hdr->addr1);
-
-	if (entry == NULL) {
-		IEEE80211_DEBUG_FRAG(
-			"could not invalidate fragment cache "
-			"entry (seq=%u)\n", seq);
-		return -1;
-	}
-
-	entry->skb = NULL;
-	return 0;
-}
-
-
-#ifdef NOT_YET
-/* ieee80211_rx_frame_mgtmt
- *
- * Responsible for handling management control frames
- *
- * Called by ieee80211_rx */
-static inline int
-ieee80211_rx_frame_mgmt(struct ieee80211_device *ieee, struct sk_buff *skb,
-			struct ieee80211_rx_stats *rx_stats, u16 type,
-			u16 stype)
-{
-	if (ieee->iw_mode == IW_MODE_MASTER) {
-		printk(KERN_DEBUG "%s: Master mode not yet suppported.\n",
-		       ieee->dev->name);
-		return 0;
-/*
-  hostap_update_sta_ps(ieee, (struct hostap_ieee80211_hdr *)
-  skb->data);*/
-	}
-
-	if (ieee->hostapd && type == WLAN_FC_TYPE_MGMT) {
-		if (stype == WLAN_FC_STYPE_BEACON &&
-		    ieee->iw_mode == IW_MODE_MASTER) {
-			struct sk_buff *skb2;
-			/* Process beacon frames also in kernel driver to
-			 * update STA(AP) table statistics */
-			skb2 = skb_clone(skb, GFP_ATOMIC);
-			if (skb2)
-				hostap_rx(skb2->dev, skb2, rx_stats);
-		}
-
-		/* send management frames to the user space daemon for
-		 * processing */
-		ieee->apdevstats.rx_packets++;
-		ieee->apdevstats.rx_bytes += skb->len;
-		prism2_rx_80211(ieee->apdev, skb, rx_stats, PRISM2_RX_MGMT);
-		return 0;
-	}
-
-	    if (ieee->iw_mode == IW_MODE_MASTER) {
-		if (type != WLAN_FC_TYPE_MGMT && type != WLAN_FC_TYPE_CTRL) {
-			printk(KERN_DEBUG "%s: unknown management frame "
-			       "(type=0x%02x, stype=0x%02x) dropped\n",
-			       skb->dev->name, type, stype);
-			return -1;
-		}
-
-		hostap_rx(skb->dev, skb, rx_stats);
-		return 0;
-	}
-
-	printk(KERN_DEBUG "%s: hostap_rx_frame_mgmt: management frame "
-	       "received in non-Host AP mode\n", skb->dev->name);
-	return -1;
-}
-#endif
-
-
-/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
-/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
-static unsigned char rfc1042_header[] =
-{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
-/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
-static unsigned char bridge_tunnel_header[] =
-{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
-/* No encapsulation header if EtherType < 0x600 (=length) */
-
-/* Called by ieee80211_rx_frame_decrypt */
-static int ieee80211_is_eapol_frame(struct ieee80211_device *ieee,
-				    struct sk_buff *skb)
-{
-	struct net_device *dev = ieee->dev;
-	u16 fc, ethertype;
-	struct ieee80211_hdr *hdr;
-	u8 *pos;
-
-	if (skb->len < 24)
-		return 0;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	fc = le16_to_cpu(hdr->frame_ctl);
-
-	/* check that the frame is unicast frame to us */
-	if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-	    IEEE80211_FCTL_TODS &&
-	    memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 &&
-	    memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
-		/* ToDS frame with own addr BSSID and DA */
-	} else if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-		   IEEE80211_FCTL_FROMDS &&
-		   memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
-		/* FromDS frame with own addr as DA */
-	} else
-		return 0;
-
-	if (skb->len < 24 + 8)
-		return 0;
-
-	/* check for port access entity Ethernet type */
-	pos = skb->data + 24;
-	ethertype = (pos[6] << 8) | pos[7];
-	if (ethertype == ETH_P_PAE)
-		return 1;
-
-	return 0;
-}
-
-/* Called only as a tasklet (software IRQ), by ieee80211_rx */
-static inline int
-ieee80211_rx_frame_decrypt(struct ieee80211_device* ieee, struct sk_buff *skb,
-			   struct ieee80211_crypt_data *crypt)
-{
-	struct ieee80211_hdr *hdr;
-	int res, hdrlen;
-
-	if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
-		return 0;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
-
-#ifdef CONFIG_IEEE80211_CRYPT_TKIP
-	if (ieee->tkip_countermeasures &&
-	    strcmp(crypt->ops->name, "TKIP") == 0) {
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
-			       "received packet from " MAC_FMT "\n",
-			       ieee->dev->name, MAC_ARG(hdr->addr2));
-		}
-		return -1;
-	}
-#endif
-
-	atomic_inc(&crypt->refcnt);
-	res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
-	atomic_dec(&crypt->refcnt);
-	if (res < 0) {
-		IEEE80211_DEBUG_DROP(
-			"decryption failed (SA=" MAC_FMT
-			") res=%d\n", MAC_ARG(hdr->addr2), res);
-		if (res == -2)
-			IEEE80211_DEBUG_DROP("Decryption failed ICV "
-					     "mismatch (key %d)\n",
-					     skb->data[hdrlen + 3] >> 6);
-		ieee->ieee_stats.rx_discards_undecryptable++;
-		return -1;
-	}
-
-	return res;
-}
-
-
-/* Called only as a tasklet (software IRQ), by ieee80211_rx */
-static inline int
-ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device* ieee, struct sk_buff *skb,
-			     int keyidx, struct ieee80211_crypt_data *crypt)
-{
-	struct ieee80211_hdr *hdr;
-	int res, hdrlen;
-
-	if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
-		return 0;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
-
-	atomic_inc(&crypt->refcnt);
-	res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv);
-	atomic_dec(&crypt->refcnt);
-	if (res < 0) {
-		printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed"
-		       " (SA=" MAC_FMT " keyidx=%d)\n",
-		       ieee->dev->name, MAC_ARG(hdr->addr2), keyidx);
-		return -1;
-	}
-
-	return 0;
-}
-
-
-/* All received frames are sent to this function. @skb contains the frame in
- * IEEE 802.11 format, i.e., in the format it was sent over air.
- * This function is called only as a tasklet (software IRQ). */
-int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
-		 struct ieee80211_rx_stats *rx_stats)
-{
-	struct net_device *dev = ieee->dev;
-	struct ieee80211_hdr *hdr;
-	size_t hdrlen;
-	u16 fc, type, stype, sc;
-	struct net_device_stats *stats;
-	unsigned int frag;
-	u8 *payload;
-	u16 ethertype;
-#ifdef NOT_YET
-	struct net_device *wds = NULL;
-	struct sk_buff *skb2 = NULL;
-	struct net_device *wds = NULL;
-	int frame_authorized = 0;
-	int from_assoc_ap = 0;
-	void *sta = NULL;
-#endif
-	u8 dst[ETH_ALEN];
-	u8 src[ETH_ALEN];
-	struct ieee80211_crypt_data *crypt = NULL;
-	int keyidx = 0;
-
-	hdr = (struct ieee80211_hdr *)skb->data;
-	stats = &ieee->stats;
-
-	if (skb->len < 10) {
-		printk(KERN_INFO "%s: SKB length < 10\n",
-		       dev->name);
-		goto rx_dropped;
-	}
-
-	fc = le16_to_cpu(hdr->frame_ctl);
-	type = WLAN_FC_GET_TYPE(fc);
-	stype = WLAN_FC_GET_STYPE(fc);
-	sc = le16_to_cpu(hdr->seq_ctl);
-	frag = WLAN_GET_SEQ_FRAG(sc);
-	hdrlen = ieee80211_get_hdrlen(fc);
-
-#ifdef NOT_YET
-#if WIRELESS_EXT > 15
-	/* Put this code here so that we avoid duplicating it in all
-	 * Rx paths. - Jean II */
-#ifdef IW_WIRELESS_SPY		/* defined in iw_handler.h */
-	/* If spy monitoring on */
-	if (iface->spy_data.spy_number > 0) {
-		struct iw_quality wstats;
-		wstats.level = rx_stats->signal;
-		wstats.noise = rx_stats->noise;
-		wstats.updated = 6;	/* No qual value */
-		/* Update spy records */
-		wireless_spy_update(dev, hdr->addr2, &wstats);
-	}
-#endif /* IW_WIRELESS_SPY */
-#endif /* WIRELESS_EXT > 15 */
-	hostap_update_rx_stats(local->ap, hdr, rx_stats);
-#endif
-
-#if WIRELESS_EXT > 15
-	if (ieee->iw_mode == IW_MODE_MONITOR) {
-		ieee80211_monitor_rx(ieee, skb, rx_stats);
-		stats->rx_packets++;
-		stats->rx_bytes += skb->len;
-		return 1;
-	}
-#endif
-
-	if (ieee->host_decrypt) {
-		int idx = 0;
-		if (skb->len >= hdrlen + 3)
-			idx = skb->data[hdrlen + 3] >> 6;
-		crypt = ieee->crypt[idx];
-#ifdef NOT_YET
-		sta = NULL;
-
-		/* Use station specific key to override default keys if the
-		 * receiver address is a unicast address ("individual RA"). If
-		 * bcrx_sta_key parameter is set, station specific key is used
-		 * even with broad/multicast targets (this is against IEEE
-		 * 802.11, but makes it easier to use different keys with
-		 * stations that do not support WEP key mapping). */
-
-		if (!(hdr->addr1[0] & 0x01) || local->bcrx_sta_key)
-			(void) hostap_handle_sta_crypto(local, hdr, &crypt,
-							&sta);
-#endif
-
-		/* allow NULL decrypt to indicate an station specific override
-		 * for default encryption */
-		if (crypt && (crypt->ops == NULL ||
-			      crypt->ops->decrypt_mpdu == NULL))
-			crypt = NULL;
-
-		if (!crypt && (fc & IEEE80211_FCTL_PROTECTED)) {
-			/* This seems to be triggered by some (multicast?)
-			 * frames from other than current BSS, so just drop the
-			 * frames silently instead of filling system log with
-			 * these reports. */
-			IEEE80211_DEBUG_DROP("Decryption failed (not set)"
-					     " (SA=" MAC_FMT ")\n",
-					     MAC_ARG(hdr->addr2));
-			ieee->ieee_stats.rx_discards_undecryptable++;
-			goto rx_dropped;
-		}
-	}
-
-#ifdef NOT_YET
-	if (type != WLAN_FC_TYPE_DATA) {
-		if (type == WLAN_FC_TYPE_MGMT && stype == WLAN_FC_STYPE_AUTH &&
-		    fc & IEEE80211_FCTL_PROTECTED && ieee->host_decrypt &&
-		    (keyidx = hostap_rx_frame_decrypt(ieee, skb, crypt)) < 0)
-		{
-			printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth "
-			       "from " MAC_FMT "\n", dev->name,
-			       MAC_ARG(hdr->addr2));
-			/* TODO: could inform hostapd about this so that it
-			 * could send auth failure report */
-			goto rx_dropped;
-		}
-
-		if (ieee80211_rx_frame_mgmt(ieee, skb, rx_stats, type, stype))
-			goto rx_dropped;
-		else
-			goto rx_exit;
-	}
-#endif
-
-	/* Data frame - extract src/dst addresses */
-	if (skb->len < IEEE80211_3ADDR_LEN)
-		goto rx_dropped;
-
-	switch (fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
-	case IEEE80211_FCTL_FROMDS:
-		memcpy(dst, hdr->addr1, ETH_ALEN);
-		memcpy(src, hdr->addr3, ETH_ALEN);
-		break;
-	case IEEE80211_FCTL_TODS:
-		memcpy(dst, hdr->addr3, ETH_ALEN);
-		memcpy(src, hdr->addr2, ETH_ALEN);
-		break;
-	case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
-		if (skb->len < IEEE80211_4ADDR_LEN)
-			goto rx_dropped;
-		memcpy(dst, hdr->addr3, ETH_ALEN);
-		memcpy(src, hdr->addr4, ETH_ALEN);
-		break;
-	case 0:
-		memcpy(dst, hdr->addr1, ETH_ALEN);
-		memcpy(src, hdr->addr2, ETH_ALEN);
-		break;
-	}
-
-#ifdef NOT_YET
-	if (hostap_rx_frame_wds(ieee, hdr, fc, &wds))
-		goto rx_dropped;
-	if (wds) {
-		skb->dev = dev = wds;
-		stats = hostap_get_stats(dev);
-	}
-
-	if (ieee->iw_mode == IW_MODE_MASTER && !wds &&
-	    (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == IEEE80211_FCTL_FROMDS &&
-	    ieee->stadev &&
-	    memcmp(hdr->addr2, ieee->assoc_ap_addr, ETH_ALEN) == 0) {
-		/* Frame from BSSID of the AP for which we are a client */
-		skb->dev = dev = ieee->stadev;
-		stats = hostap_get_stats(dev);
-		from_assoc_ap = 1;
-	}
-#endif
-
-	dev->last_rx = jiffies;
-
-#ifdef NOT_YET
-	if ((ieee->iw_mode == IW_MODE_MASTER ||
-	     ieee->iw_mode == IW_MODE_REPEAT) &&
-	    !from_assoc_ap) {
-		switch (hostap_handle_sta_rx(ieee, dev, skb, rx_stats,
-					     wds != NULL)) {
-		case AP_RX_CONTINUE_NOT_AUTHORIZED:
-			frame_authorized = 0;
-			break;
-		case AP_RX_CONTINUE:
-			frame_authorized = 1;
-			break;
-		case AP_RX_DROP:
-			goto rx_dropped;
-		case AP_RX_EXIT:
-			goto rx_exit;
-		}
-	}
-#endif
-
-	/* Nullfunc frames may have PS-bit set, so they must be passed to
-	 * hostap_handle_sta_rx() before being dropped here. */
-	if (stype != IEEE80211_STYPE_DATA &&
-	    stype != IEEE80211_STYPE_DATA_CFACK &&
-	    stype != IEEE80211_STYPE_DATA_CFPOLL &&
-	    stype != IEEE80211_STYPE_DATA_CFACKPOLL) {
-		if (stype != IEEE80211_STYPE_NULLFUNC)
-			IEEE80211_DEBUG_DROP(
-				"RX: dropped data frame "
-				"with no data (type=0x%02x, "
-				"subtype=0x%02x, len=%d)\n",
-				type, stype, skb->len);
-		goto rx_dropped;
-	}
-
-	/* skb: hdr + (possibly fragmented, possibly encrypted) payload */
-
-	if (ieee->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) &&
-	    (keyidx = ieee80211_rx_frame_decrypt(ieee, skb, crypt)) < 0)
-		goto rx_dropped;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-
-	/* skb: hdr + (possibly fragmented) plaintext payload */
-	// PR: FIXME: hostap has additional conditions in the "if" below:
-	// ieee->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) &&
-	if ((frag != 0 || (fc & IEEE80211_FCTL_MOREFRAGS))) {
-		int flen;
-		struct sk_buff *frag_skb = ieee80211_frag_cache_get(ieee, hdr);
-		IEEE80211_DEBUG_FRAG("Rx Fragment received (%u)\n", frag);
-
-		if (!frag_skb) {
-			IEEE80211_DEBUG(IEEE80211_DL_RX | IEEE80211_DL_FRAG,
-					"Rx cannot get skb from fragment "
-					"cache (morefrag=%d seq=%u frag=%u)\n",
-					(fc & IEEE80211_FCTL_MOREFRAGS) != 0,
-					WLAN_GET_SEQ_SEQ(sc), frag);
-			goto rx_dropped;
-		}
-
-		flen = skb->len;
-		if (frag != 0)
-			flen -= hdrlen;
-
-		if (frag_skb->tail + flen > frag_skb->end) {
-			printk(KERN_WARNING "%s: host decrypted and "
-			       "reassembled frame did not fit skb\n",
-			       dev->name);
-			ieee80211_frag_cache_invalidate(ieee, hdr);
-			goto rx_dropped;
-		}
-
-		if (frag == 0) {
-			/* copy first fragment (including full headers) into
-			 * beginning of the fragment cache skb */
-			memcpy(skb_put(frag_skb, flen), skb->data, flen);
-		} else {
-			/* append frame payload to the end of the fragment
-			 * cache skb */
-			memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
-			       flen);
-		}
-		dev_kfree_skb_any(skb);
-		skb = NULL;
-
-		if (fc & IEEE80211_FCTL_MOREFRAGS) {
-			/* more fragments expected - leave the skb in fragment
-			 * cache for now; it will be delivered to upper layers
-			 * after all fragments have been received */
-			goto rx_exit;
-		}
-
-		/* this was the last fragment and the frame will be
-		 * delivered, so remove skb from fragment cache */
-		skb = frag_skb;
-		hdr = (struct ieee80211_hdr *) skb->data;
-		ieee80211_frag_cache_invalidate(ieee, hdr);
-	}
-
-	/* skb: hdr + (possible reassembled) full MSDU payload; possibly still
-	 * encrypted/authenticated */
-	if (ieee->host_decrypt && (fc & IEEE80211_FCTL_PROTECTED) &&
-	    ieee80211_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt))
-		goto rx_dropped;
-
-	hdr = (struct ieee80211_hdr *) skb->data;
-	if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !ieee->open_wep) {
-		if (/*ieee->ieee802_1x &&*/
-		    ieee80211_is_eapol_frame(ieee, skb)) {
-			/* pass unencrypted EAPOL frames even if encryption is
-			 * configured */
-		} else {
-			IEEE80211_DEBUG_DROP(
-				"encryption configured, but RX "
-				"frame not encrypted (SA=" MAC_FMT ")\n",
-				MAC_ARG(hdr->addr2));
-			goto rx_dropped;
-		}
-	}
-
-	if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !ieee->open_wep &&
-	    !ieee80211_is_eapol_frame(ieee, skb)) {
-		IEEE80211_DEBUG_DROP(
-			"dropped unencrypted RX data "
-			"frame from " MAC_FMT
-			" (drop_unencrypted=1)\n",
-			MAC_ARG(hdr->addr2));
-		goto rx_dropped;
-	}
-
-	/* skb: hdr + (possible reassembled) full plaintext payload */
-
-	payload = skb->data + hdrlen;
-	ethertype = (payload[6] << 8) | payload[7];
-
-#ifdef NOT_YET
-	/* If IEEE 802.1X is used, check whether the port is authorized to send
-	 * the received frame. */
-	if (ieee->ieee802_1x && ieee->iw_mode == IW_MODE_MASTER) {
-		if (ethertype == ETH_P_PAE) {
-			printk(KERN_DEBUG "%s: RX: IEEE 802.1X frame\n",
-			       dev->name);
-			if (ieee->hostapd && ieee->apdev) {
-				/* Send IEEE 802.1X frames to the user
-				 * space daemon for processing */
-				prism2_rx_80211(ieee->apdev, skb, rx_stats,
-						PRISM2_RX_MGMT);
-				ieee->apdevstats.rx_packets++;
-				ieee->apdevstats.rx_bytes += skb->len;
-				goto rx_exit;
-			}
-		} else if (!frame_authorized) {
-			printk(KERN_DEBUG "%s: dropped frame from "
-			       "unauthorized port (IEEE 802.1X): "
-			       "ethertype=0x%04x\n",
-			       dev->name, ethertype);
-			goto rx_dropped;
-		}
-	}
-#endif
-
-	/* convert hdr + possible LLC headers into Ethernet header */
-	if (skb->len - hdrlen >= 8 &&
-	    ((memcmp(payload, rfc1042_header, SNAP_SIZE) == 0 &&
-	      ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-	     memcmp(payload, bridge_tunnel_header, SNAP_SIZE) == 0)) {
-		/* remove RFC1042 or Bridge-Tunnel encapsulation and
-		 * replace EtherType */
-		skb_pull(skb, hdrlen + SNAP_SIZE);
-		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
-		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
-	} else {
-		u16 len;
-		/* Leave Ethernet header part of hdr and full payload */
-		skb_pull(skb, hdrlen);
-		len = htons(skb->len);
-		memcpy(skb_push(skb, 2), &len, 2);
-		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
-		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
-	}
-
-#ifdef NOT_YET
-	if (wds && ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
-		    IEEE80211_FCTL_TODS) &&
-	    skb->len >= ETH_HLEN + ETH_ALEN) {
-		/* Non-standard frame: get addr4 from its bogus location after
-		 * the payload */
-		memcpy(skb->data + ETH_ALEN,
-		       skb->data + skb->len - ETH_ALEN, ETH_ALEN);
-		skb_trim(skb, skb->len - ETH_ALEN);
-	}
-#endif
-
-	stats->rx_packets++;
-	stats->rx_bytes += skb->len;
-
-#ifdef NOT_YET
-	if (ieee->iw_mode == IW_MODE_MASTER && !wds &&
-	    ieee->ap->bridge_packets) {
-		if (dst[0] & 0x01) {
-			/* copy multicast frame both to the higher layers and
-			 * to the wireless media */
-			ieee->ap->bridged_multicast++;
-			skb2 = skb_clone(skb, GFP_ATOMIC);
-			if (skb2 == NULL)
-				printk(KERN_DEBUG "%s: skb_clone failed for "
-				       "multicast frame\n", dev->name);
-		} else if (hostap_is_sta_assoc(ieee->ap, dst)) {
-			/* send frame directly to the associated STA using
-			 * wireless media and not passing to higher layers */
-			ieee->ap->bridged_unicast++;
-			skb2 = skb;
-			skb = NULL;
-		}
-	}
-
-	if (skb2 != NULL) {
-		/* send to wireless media */
-		skb2->protocol = __constant_htons(ETH_P_802_3);
-		skb2->mac.raw = skb2->nh.raw = skb2->data;
-		/* skb2->nh.raw = skb2->data + ETH_HLEN; */
-		skb2->dev = dev;
-		dev_queue_xmit(skb2);
-	}
-
-#endif
-
-	if (skb) {
-		skb->protocol = eth_type_trans(skb, dev);
-		memset(skb->cb, 0, sizeof(skb->cb));
-		skb->dev = dev;
-		skb->ip_summed = CHECKSUM_NONE; /* 802.11 crc not sufficient */
-		netif_rx(skb);
-	}
-
- rx_exit:
-#ifdef NOT_YET
-	if (sta)
-		hostap_handle_sta_release(sta);
-#endif
-	return 1;
-
- rx_dropped:
-	stats->rx_dropped++;
-
-	/* Returning 0 indicates to caller that we have not handled the SKB--
-	 * so it is still allocated and can be used again by underlying
-	 * hardware as a DMA target */
-	return 0;
-}
-
-#define MGMT_FRAME_FIXED_PART_LENGTH		0x24
-
-static inline int ieee80211_is_ofdm_rate(u8 rate)
-{
-	switch (rate & ~IEEE80211_BASIC_RATE_MASK) {
-	case IEEE80211_OFDM_RATE_6MB:
-	case IEEE80211_OFDM_RATE_9MB:
-	case IEEE80211_OFDM_RATE_12MB:
-	case IEEE80211_OFDM_RATE_18MB:
-	case IEEE80211_OFDM_RATE_24MB:
-	case IEEE80211_OFDM_RATE_36MB:
-	case IEEE80211_OFDM_RATE_48MB:
-	case IEEE80211_OFDM_RATE_54MB:
-		return 1;
-	}
-        return 0;
-}
-
-
-static inline int ieee80211_network_init(
-	struct ieee80211_device *ieee,
-	struct ieee80211_probe_response *beacon,
-	struct ieee80211_network *network,
-	struct ieee80211_rx_stats *stats)
-{
-#ifdef CONFIG_IEEE80211_DEBUG
-	char rates_str[64];
-	char *p;
-#endif
-	struct ieee80211_info_element *info_element;
- 	u16 left;
-	u8 i;
-
-	/* Pull out fixed field data */
-	memcpy(network->bssid, beacon->header.addr3, ETH_ALEN);
-	network->capability = beacon->capability;
-	network->last_scanned = jiffies;
-	network->time_stamp[0] = beacon->time_stamp[0];
-	network->time_stamp[1] = beacon->time_stamp[1];
-	network->beacon_interval = beacon->beacon_interval;
-	/* Where to pull this? beacon->listen_interval;*/
-	network->listen_interval = 0x0A;
-	network->rates_len = network->rates_ex_len = 0;
-	network->last_associate = 0;
-	network->ssid_len = 0;
-	network->flags = 0;
-	network->atim_window = 0;
-
-	if (stats->freq == IEEE80211_52GHZ_BAND) {
-		/* for A band (No DS info) */
-		network->channel = stats->received_channel;
-	} else
-		network->flags |= NETWORK_HAS_CCK;
-
- 	network->wpa_ie_len = 0;
- 	network->rsn_ie_len = 0;
-
- 	info_element = &beacon->info_element;
-	left = stats->len - ((void *)info_element - (void *)beacon);
-	while (left >= sizeof(struct ieee80211_info_element_hdr)) {
-		if (sizeof(struct ieee80211_info_element_hdr) + info_element->len > left) {
-			IEEE80211_DEBUG_SCAN("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%d left=%d.\n",
-					     info_element->len + sizeof(struct ieee80211_info_element),
-					     left);
-			return 1;
-               	}
-
-		switch (info_element->id) {
-		case MFIE_TYPE_SSID:
-			if (ieee80211_is_empty_essid(info_element->data,
-						     info_element->len)) {
-				network->flags |= NETWORK_EMPTY_ESSID;
-				break;
-			}
-
-			network->ssid_len = min(info_element->len,
-						(u8)IW_ESSID_MAX_SIZE);
-			memcpy(network->ssid, info_element->data, network->ssid_len);
-        		if (network->ssid_len < IW_ESSID_MAX_SIZE)
-                		memset(network->ssid + network->ssid_len, 0,
-				       IW_ESSID_MAX_SIZE - network->ssid_len);
-
-			IEEE80211_DEBUG_SCAN("MFIE_TYPE_SSID: '%s' len=%d.\n",
-					     network->ssid, network->ssid_len);
-			break;
-
-		case MFIE_TYPE_RATES:
-#ifdef CONFIG_IEEE80211_DEBUG
-			p = rates_str;
-#endif
-			network->rates_len = min(info_element->len, MAX_RATES_LENGTH);
-			for (i = 0; i < network->rates_len; i++) {
-				network->rates[i] = info_element->data[i];
-#ifdef CONFIG_IEEE80211_DEBUG
-				p += snprintf(p, sizeof(rates_str) - (p - rates_str), "%02X ", network->rates[i]);
-#endif
-				if (ieee80211_is_ofdm_rate(info_element->data[i])) {
-					network->flags |= NETWORK_HAS_OFDM;
-					if (info_element->data[i] &
-					    IEEE80211_BASIC_RATE_MASK)
-						network->flags &=
-							~NETWORK_HAS_CCK;
-				}
-			}
-
-			IEEE80211_DEBUG_SCAN("MFIE_TYPE_RATES: '%s' (%d)\n",
-					     rates_str, network->rates_len);
-			break;
-
-		case MFIE_TYPE_RATES_EX:
-#ifdef CONFIG_IEEE80211_DEBUG
-			p = rates_str;
-#endif
-			network->rates_ex_len = min(info_element->len, MAX_RATES_EX_LENGTH);
-			for (i = 0; i < network->rates_ex_len; i++) {
-				network->rates_ex[i] = info_element->data[i];
-#ifdef CONFIG_IEEE80211_DEBUG
-				p += snprintf(p, sizeof(rates_str) - (p - rates_str), "%02X ", network->rates[i]);
-#endif
-				if (ieee80211_is_ofdm_rate(info_element->data[i])) {
-					network->flags |= NETWORK_HAS_OFDM;
-					if (info_element->data[i] &
-					    IEEE80211_BASIC_RATE_MASK)
-						network->flags &=
-							~NETWORK_HAS_CCK;
-				}
-			}
-
-			IEEE80211_DEBUG_SCAN("MFIE_TYPE_RATES_EX: '%s' (%d)\n",
-					     rates_str, network->rates_ex_len);
-			break;
-
-		case MFIE_TYPE_DS_SET:
-  			IEEE80211_DEBUG_SCAN("MFIE_TYPE_DS_SET: %d\n",
-					     info_element->data[0]);
-			if (stats->freq == IEEE80211_24GHZ_BAND)
-				network->channel = info_element->data[0];
-			break;
-
-	 	case MFIE_TYPE_FH_SET:
-  			IEEE80211_DEBUG_SCAN("MFIE_TYPE_FH_SET: ignored\n");
-			break;
-
-		case MFIE_TYPE_CF_SET:
-			IEEE80211_DEBUG_SCAN("MFIE_TYPE_CF_SET: ignored\n");
-			break;
-
-		case MFIE_TYPE_TIM:
-			IEEE80211_DEBUG_SCAN("MFIE_TYPE_TIM: ignored\n");
-			break;
-
-		case MFIE_TYPE_IBSS_SET:
-			IEEE80211_DEBUG_SCAN("MFIE_TYPE_IBSS_SET: ignored\n");
-			break;
-
-		case MFIE_TYPE_CHALLENGE:
-			IEEE80211_DEBUG_SCAN("MFIE_TYPE_CHALLENGE: ignored\n");
-			break;
-
-		case MFIE_TYPE_GENERIC:
-			IEEE80211_DEBUG_SCAN("MFIE_TYPE_GENERIC: %d bytes\n",
-					     info_element->len);
-			if (info_element->len >= 4  &&
-			    info_element->data[0] == 0x00 &&
-			    info_element->data[1] == 0x50 &&
-			    info_element->data[2] == 0xf2 &&
-			    info_element->data[3] == 0x01) {
-				network->wpa_ie_len = min(info_element->len + 2,
-							 MAX_WPA_IE_LEN);
-				memcpy(network->wpa_ie, info_element,
-				       network->wpa_ie_len);
-			}
-			break;
-
-		case MFIE_TYPE_RSN:
-			IEEE80211_DEBUG_SCAN("MFIE_TYPE_RSN: %d bytes\n",
-					     info_element->len);
-			network->rsn_ie_len = min(info_element->len + 2,
-						 MAX_WPA_IE_LEN);
-			memcpy(network->rsn_ie, info_element,
-			       network->rsn_ie_len);
-			break;
-
-		default:
-			IEEE80211_DEBUG_SCAN("unsupported IE %d\n",
-					     info_element->id);
-                        break;
-  		}
-
-		left -= sizeof(struct ieee80211_info_element_hdr) +
-			info_element->len;
-		info_element = (struct ieee80211_info_element *)
-                	&info_element->data[info_element->len];
-  	}
-
-	network->mode = 0;
-	if (stats->freq == IEEE80211_52GHZ_BAND)
-		network->mode = IEEE_A;
-	else {
-		if (network->flags & NETWORK_HAS_OFDM)
-			network->mode |= IEEE_G;
-		if (network->flags & NETWORK_HAS_CCK)
-			network->mode |= IEEE_B;
-	}
-
-	if (network->mode == 0) {
-		IEEE80211_DEBUG_SCAN("Filtered out '%s (" MAC_FMT ")' "
-				     "network.\n",
-				     escape_essid(network->ssid,
-						  network->ssid_len),
-				     MAC_ARG(network->bssid));
-		return 1;
-	}
-
-	if (ieee80211_is_empty_essid(network->ssid, network->ssid_len))
-		network->flags |= NETWORK_EMPTY_ESSID;
-
-	memcpy(&network->stats, stats, sizeof(network->stats));
-
-	return 0;
-}
-
-static inline int is_same_network(struct ieee80211_network *src,
-				  struct ieee80211_network *dst)
-{
-	/* A network is only a duplicate if the channel, BSSID, and ESSID
-	 * all match.  We treat all <hidden> with the same BSSID and channel
-	 * as one network */
-	return ((src->ssid_len == dst->ssid_len) &&
-		(src->channel == dst->channel) &&
-		!memcmp(src->bssid, dst->bssid, ETH_ALEN) &&
-		!memcmp(src->ssid, dst->ssid, src->ssid_len));
-}
-
-static inline void update_network(struct ieee80211_network *dst,
-				  struct ieee80211_network *src)
-{
-	memcpy(&dst->stats, &src->stats, sizeof(struct ieee80211_rx_stats));
-	dst->capability = src->capability;
-	memcpy(dst->rates, src->rates, src->rates_len);
-	dst->rates_len = src->rates_len;
-	memcpy(dst->rates_ex, src->rates_ex, src->rates_ex_len);
-	dst->rates_ex_len = src->rates_ex_len;
-
-	dst->mode = src->mode;
-	dst->flags = src->flags;
-	dst->time_stamp[0] = src->time_stamp[0];
-	dst->time_stamp[1] = src->time_stamp[1];
-
-	dst->beacon_interval = src->beacon_interval;
-	dst->listen_interval = src->listen_interval;
-	dst->atim_window = src->atim_window;
-
-	memcpy(dst->wpa_ie, src->wpa_ie, src->wpa_ie_len);
-	dst->wpa_ie_len = src->wpa_ie_len;
-	memcpy(dst->rsn_ie, src->rsn_ie, src->rsn_ie_len);
-	dst->rsn_ie_len = src->rsn_ie_len;
-
-	dst->last_scanned = jiffies;
-	/* dst->last_associate is not overwritten */
-}
-
-static inline void ieee80211_process_probe_response(
-	struct ieee80211_device *ieee,
-	struct ieee80211_probe_response *beacon,
-	struct ieee80211_rx_stats *stats)
-{
-	struct ieee80211_network network;
-	struct ieee80211_network *target;
-	struct ieee80211_network *oldest = NULL;
-#ifdef CONFIG_IEEE80211_DEBUG
-	struct ieee80211_info_element *info_element = &beacon->info_element;
-#endif
-	unsigned long flags;
-
-	IEEE80211_DEBUG_SCAN(
-		"'%s' (" MAC_FMT "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
-		escape_essid(info_element->data, info_element->len),
-		MAC_ARG(beacon->header.addr3),
-		(beacon->capability & (1<<0xf)) ? '1' : '0',
-		(beacon->capability & (1<<0xe)) ? '1' : '0',
-		(beacon->capability & (1<<0xd)) ? '1' : '0',
-		(beacon->capability & (1<<0xc)) ? '1' : '0',
-		(beacon->capability & (1<<0xb)) ? '1' : '0',
-		(beacon->capability & (1<<0xa)) ? '1' : '0',
-		(beacon->capability & (1<<0x9)) ? '1' : '0',
-		(beacon->capability & (1<<0x8)) ? '1' : '0',
-		(beacon->capability & (1<<0x7)) ? '1' : '0',
-		(beacon->capability & (1<<0x6)) ? '1' : '0',
-		(beacon->capability & (1<<0x5)) ? '1' : '0',
-		(beacon->capability & (1<<0x4)) ? '1' : '0',
-		(beacon->capability & (1<<0x3)) ? '1' : '0',
-		(beacon->capability & (1<<0x2)) ? '1' : '0',
-		(beacon->capability & (1<<0x1)) ? '1' : '0',
-		(beacon->capability & (1<<0x0)) ? '1' : '0');
-
-	if (ieee80211_network_init(ieee, beacon, &network, stats)) {
-		IEEE80211_DEBUG_SCAN("Dropped '%s' (" MAC_FMT ") via %s.\n",
-				     escape_essid(info_element->data,
-						  info_element->len),
-				     MAC_ARG(beacon->header.addr3),
-				     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
-				     IEEE80211_STYPE_PROBE_RESP ?
-				     "PROBE RESPONSE" : "BEACON");
-		return;
-	}
-
-	/* The network parsed correctly -- so now we scan our known networks
-	 * to see if we can find it in our list.
-	 *
-	 * NOTE:  This search is definitely not optimized.  Once its doing
-	 *        the "right thing" we'll optimize it for efficiency if
-	 *        necessary */
-
-	/* Search for this entry in the list and update it if it is
-	 * already there. */
-
-	spin_lock_irqsave(&ieee->lock, flags);
-
-	list_for_each_entry(target, &ieee->network_list, list) {
-		if (is_same_network(target, &network))
-			break;
-
-		if ((oldest == NULL) ||
-		    (target->last_scanned < oldest->last_scanned))
-			oldest = target;
-	}
-
-	/* If we didn't find a match, then get a new network slot to initialize
-	 * with this beacon's information */
-	if (&target->list == &ieee->network_list) {
-		if (list_empty(&ieee->network_free_list)) {
-			/* If there are no more slots, expire the oldest */
-			list_del(&oldest->list);
-			target = oldest;
-			IEEE80211_DEBUG_SCAN("Expired '%s' (" MAC_FMT ") from "
-					     "network list.\n",
-					     escape_essid(target->ssid,
-							  target->ssid_len),
-					     MAC_ARG(target->bssid));
-		} else {
-			/* Otherwise just pull from the free list */
-			target = list_entry(ieee->network_free_list.next,
-					    struct ieee80211_network, list);
-			list_del(ieee->network_free_list.next);
-		}
-
-
-#ifdef CONFIG_IEEE80211_DEBUG
-		IEEE80211_DEBUG_SCAN("Adding '%s' (" MAC_FMT ") via %s.\n",
-				     escape_essid(network.ssid,
-						  network.ssid_len),
-				     MAC_ARG(network.bssid),
-				     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
-				     IEEE80211_STYPE_PROBE_RESP ?
-				     "PROBE RESPONSE" : "BEACON");
-#endif
-		memcpy(target, &network, sizeof(*target));
-		list_add_tail(&target->list, &ieee->network_list);
-	} else {
-		IEEE80211_DEBUG_SCAN("Updating '%s' (" MAC_FMT ") via %s.\n",
-				     escape_essid(target->ssid,
-						  target->ssid_len),
-				     MAC_ARG(target->bssid),
-				     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
-				     IEEE80211_STYPE_PROBE_RESP ?
-				     "PROBE RESPONSE" : "BEACON");
-		update_network(target, &network);
-	}
-
-	spin_unlock_irqrestore(&ieee->lock, flags);
-}
-
-void ieee80211_rx_mgt(struct ieee80211_device *ieee,
-		      struct ieee80211_hdr *header,
-		      struct ieee80211_rx_stats *stats)
-{
-	switch (WLAN_FC_GET_STYPE(header->frame_ctl)) {
-	case IEEE80211_STYPE_ASSOC_RESP:
-		IEEE80211_DEBUG_MGMT("received ASSOCIATION RESPONSE (%d)\n",
-				     WLAN_FC_GET_STYPE(header->frame_ctl));
-		break;
-
-	case IEEE80211_STYPE_REASSOC_RESP:
-		IEEE80211_DEBUG_MGMT("received REASSOCIATION RESPONSE (%d)\n",
-				     WLAN_FC_GET_STYPE(header->frame_ctl));
-		break;
-
-	case IEEE80211_STYPE_PROBE_RESP:
-		IEEE80211_DEBUG_MGMT("received PROBE RESPONSE (%d)\n",
-				     WLAN_FC_GET_STYPE(header->frame_ctl));
-		IEEE80211_DEBUG_SCAN("Probe response\n");
-		ieee80211_process_probe_response(
-			ieee, (struct ieee80211_probe_response *)header, stats);
-		break;
-
-	case IEEE80211_STYPE_BEACON:
-		IEEE80211_DEBUG_MGMT("received BEACON (%d)\n",
-				     WLAN_FC_GET_STYPE(header->frame_ctl));
-		IEEE80211_DEBUG_SCAN("Beacon\n");
-		ieee80211_process_probe_response(
-			ieee, (struct ieee80211_probe_response *)header, stats);
-		break;
-
-	default:
-		IEEE80211_DEBUG_MGMT("received UNKNOWN (%d)\n",
-				     WLAN_FC_GET_STYPE(header->frame_ctl));
-		IEEE80211_WARNING("%s: Unknown management packet: %d\n",
-				  ieee->dev->name,
-				  WLAN_FC_GET_STYPE(header->frame_ctl));
-		break;
-	}
-}
-
-
-EXPORT_SYMBOL(ieee80211_rx_mgt);
-EXPORT_SYMBOL(ieee80211_rx);
diff --git a/trunk/net/ieee80211/ieee80211_tx.c b/trunk/net/ieee80211/ieee80211_tx.c
deleted file mode 100644
index b7ea3e25e25d..000000000000
--- a/trunk/net/ieee80211/ieee80211_tx.c
+++ /dev/null
@@ -1,438 +0,0 @@
-/******************************************************************************
-
-  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-******************************************************************************/
-#include <linux/compiler.h>
-#include <linux/config.h>
-#include <linux/errno.h>
-#include <linux/if_arp.h>
-#include <linux/in6.h>
-#include <linux/in.h>
-#include <linux/ip.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/proc_fs.h>
-#include <linux/skbuff.h>
-#include <linux/slab.h>
-#include <linux/tcp.h>
-#include <linux/types.h>
-#include <linux/version.h>
-#include <linux/wireless.h>
-#include <linux/etherdevice.h>
-#include <asm/uaccess.h>
-
-#include <net/ieee80211.h>
-
-
-/*
-
-
-802.11 Data Frame
-
-      ,-------------------------------------------------------------------.
-Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
-      |------|------|---------|---------|---------|------|---------|------|
-Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  Frame  |  fcs |
-      |      | tion | (BSSID) |         |         | ence |  data   |      |
-      `--------------------------------------------------|         |------'
-Total: 28 non-data bytes                                 `----.----'
-                                                              |
-       .- 'Frame data' expands to <---------------------------'
-       |
-       V
-      ,---------------------------------------------------.
-Bytes |  1   |  1   |    1    |    3     |  2   |  0-2304 |
-      |------|------|---------|----------|------|---------|
-Desc. | SNAP | SNAP | Control |Eth Tunnel| Type | IP      |
-      | DSAP | SSAP |         |          |      | Packet  |
-      | 0xAA | 0xAA |0x03 (UI)|0x00-00-F8|      |         |
-      `-----------------------------------------|         |
-Total: 8 non-data bytes                         `----.----'
-                                                     |
-       .- 'IP Packet' expands, if WEP enabled, to <--'
-       |
-       V
-      ,-----------------------.
-Bytes |  4  |   0-2296  |  4  |
-      |-----|-----------|-----|
-Desc. | IV  | Encrypted | ICV |
-      |     | IP Packet |     |
-      `-----------------------'
-Total: 8 non-data bytes
-
-
-802.3 Ethernet Data Frame
-
-      ,-----------------------------------------.
-Bytes |   6   |   6   |  2   |  Variable |   4  |
-      |-------|-------|------|-----------|------|
-Desc. | Dest. | Source| Type | IP Packet |  fcs |
-      |  MAC  |  MAC  |      |           |      |
-      `-----------------------------------------'
-Total: 18 non-data bytes
-
-In the event that fragmentation is required, the incoming payload is split into
-N parts of size ieee->fts.  The first fragment contains the SNAP header and the
-remaining packets are just data.
-
-If encryption is enabled, each fragment payload size is reduced by enough space
-to add the prefix and postfix (IV and ICV totalling 8 bytes in the case of WEP)
-So if you have 1500 bytes of payload with ieee->fts set to 500 without
-encryption it will take 3 frames.  With WEP it will take 4 frames as the
-payload of each frame is reduced to 492 bytes.
-
-* SKB visualization
-*
-*  ,- skb->data
-* |
-* |    ETHERNET HEADER        ,-<-- PAYLOAD
-* |                           |     14 bytes from skb->data
-* |  2 bytes for Type --> ,T. |     (sizeof ethhdr)
-* |                       | | |
-* |,-Dest.--. ,--Src.---. | | |
-* |  6 bytes| | 6 bytes | | | |
-* v         | |         | | | |
-* 0         | v       1 | v | v           2
-* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
-*     ^     | ^         | ^ |
-*     |     | |         | | |
-*     |     | |         | `T' <---- 2 bytes for Type
-*     |     | |         |
-*     |     | '---SNAP--' <-------- 6 bytes for SNAP
-*     |     |
-*     `-IV--' <-------------------- 4 bytes for IV (WEP)
-*
-*      SNAP HEADER
-*
-*/
-
-static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
-static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
-
-static inline int ieee80211_put_snap(u8 *data, u16 h_proto)
-{
-	struct ieee80211_snap_hdr *snap;
-	u8 *oui;
-
-	snap = (struct ieee80211_snap_hdr *)data;
-	snap->dsap = 0xaa;
-	snap->ssap = 0xaa;
-	snap->ctrl = 0x03;
-
-	if (h_proto == 0x8137 || h_proto == 0x80f3)
-		oui = P802_1H_OUI;
-	else
-		oui = RFC1042_OUI;
-	snap->oui[0] = oui[0];
-	snap->oui[1] = oui[1];
-	snap->oui[2] = oui[2];
-
-	*(u16 *)(data + SNAP_SIZE) = htons(h_proto);
-
-	return SNAP_SIZE + sizeof(u16);
-}
-
-static inline int ieee80211_encrypt_fragment(
-	struct ieee80211_device *ieee,
-	struct sk_buff *frag,
-	int hdr_len)
-{
-	struct ieee80211_crypt_data* crypt = ieee->crypt[ieee->tx_keyidx];
-	int res;
-
-#ifdef CONFIG_IEEE80211_CRYPT_TKIP
-	struct ieee80211_hdr *header;
-
-	if (ieee->tkip_countermeasures &&
-	    crypt && crypt->ops && strcmp(crypt->ops->name, "TKIP") == 0) {
-		header = (struct ieee80211_hdr *) frag->data;
-		if (net_ratelimit()) {
-			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
-			       "TX packet to " MAC_FMT "\n",
-			       ieee->dev->name, MAC_ARG(header->addr1));
-		}
-		return -1;
-	}
-#endif
-	/* To encrypt, frame format is:
-	 * IV (4 bytes), clear payload (including SNAP), ICV (4 bytes) */
-
-	// PR: FIXME: Copied from hostap. Check fragmentation/MSDU/MPDU encryption.
-	/* Host-based IEEE 802.11 fragmentation for TX is not yet supported, so
-	 * call both MSDU and MPDU encryption functions from here. */
-	atomic_inc(&crypt->refcnt);
-	res = 0;
-	if (crypt->ops->encrypt_msdu)
-		res = crypt->ops->encrypt_msdu(frag, hdr_len, crypt->priv);
-	if (res == 0 && crypt->ops->encrypt_mpdu)
-		res = crypt->ops->encrypt_mpdu(frag, hdr_len, crypt->priv);
-
-	atomic_dec(&crypt->refcnt);
-	if (res < 0) {
-		printk(KERN_INFO "%s: Encryption failed: len=%d.\n",
-		       ieee->dev->name, frag->len);
-		ieee->ieee_stats.tx_discards++;
-		return -1;
-	}
-
-	return 0;
-}
-
-
-void ieee80211_txb_free(struct ieee80211_txb *txb) {
-	int i;
-	if (unlikely(!txb))
-		return;
-	for (i = 0; i < txb->nr_frags; i++)
-		if (txb->fragments[i])
-			dev_kfree_skb_any(txb->fragments[i]);
-	kfree(txb);
-}
-
-static struct ieee80211_txb *ieee80211_alloc_txb(int nr_frags, int txb_size,
-						 int gfp_mask)
-{
-	struct ieee80211_txb *txb;
-	int i;
-	txb = kmalloc(
-		sizeof(struct ieee80211_txb) + (sizeof(u8*) * nr_frags),
-		gfp_mask);
-	if (!txb)
-		return NULL;
-
-	memset(txb, 0, sizeof(struct ieee80211_txb));
-	txb->nr_frags = nr_frags;
-	txb->frag_size = txb_size;
-
-	for (i = 0; i < nr_frags; i++) {
-		txb->fragments[i] = dev_alloc_skb(txb_size);
-		if (unlikely(!txb->fragments[i])) {
-			i--;
-			break;
-		}
-	}
-	if (unlikely(i != nr_frags)) {
-		while (i >= 0)
-			dev_kfree_skb_any(txb->fragments[i--]);
-		kfree(txb);
-		return NULL;
-	}
-	return txb;
-}
-
-/* SKBs are added to the ieee->tx_queue. */
-int ieee80211_xmit(struct sk_buff *skb,
-		   struct net_device *dev)
-{
-	struct ieee80211_device *ieee = netdev_priv(dev);
-	struct ieee80211_txb *txb = NULL;
-	struct ieee80211_hdr *frag_hdr;
-	int i, bytes_per_frag, nr_frags, bytes_last_frag, frag_size;
-	unsigned long flags;
-	struct net_device_stats *stats = &ieee->stats;
-	int ether_type, encrypt;
-	int bytes, fc, hdr_len;
-	struct sk_buff *skb_frag;
-	struct ieee80211_hdr header = { /* Ensure zero initialized */
-		.duration_id = 0,
-		.seq_ctl = 0
-	};
-	u8 dest[ETH_ALEN], src[ETH_ALEN];
-
-	struct ieee80211_crypt_data* crypt;
-
-	spin_lock_irqsave(&ieee->lock, flags);
-
-	/* If there is no driver handler to take the TXB, dont' bother
-	 * creating it... */
-	if (!ieee->hard_start_xmit) {
-		printk(KERN_WARNING "%s: No xmit handler.\n",
-		       ieee->dev->name);
-		goto success;
-	}
-
-	if (unlikely(skb->len < SNAP_SIZE + sizeof(u16))) {
-		printk(KERN_WARNING "%s: skb too small (%d).\n",
-		       ieee->dev->name, skb->len);
-		goto success;
-	}
-
-	ether_type = ntohs(((struct ethhdr *)skb->data)->h_proto);
-
-	crypt = ieee->crypt[ieee->tx_keyidx];
-
-	encrypt = !(ether_type == ETH_P_PAE && ieee->ieee802_1x) &&
-		ieee->host_encrypt && crypt && crypt->ops;
-
-	if (!encrypt && ieee->ieee802_1x &&
-	    ieee->drop_unencrypted && ether_type != ETH_P_PAE) {
-		stats->tx_dropped++;
-		goto success;
-	}
-
-	/* Save source and destination addresses */
-	memcpy(&dest, skb->data, ETH_ALEN);
-	memcpy(&src, skb->data+ETH_ALEN, ETH_ALEN);
-
-	/* Advance the SKB to the start of the payload */
-	skb_pull(skb, sizeof(struct ethhdr));
-
-	/* Determine total amount of storage required for TXB packets */
-	bytes = skb->len + SNAP_SIZE + sizeof(u16);
-
-	if (encrypt)
-		fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
-			IEEE80211_FCTL_PROTECTED;
-	else
-		fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA;
-
-	if (ieee->iw_mode == IW_MODE_INFRA) {
-		fc |= IEEE80211_FCTL_TODS;
-		/* To DS: Addr1 = BSSID, Addr2 = SA,
-		   Addr3 = DA */
-		memcpy(&header.addr1, ieee->bssid, ETH_ALEN);
-		memcpy(&header.addr2, &src, ETH_ALEN);
-		memcpy(&header.addr3, &dest, ETH_ALEN);
-	} else if (ieee->iw_mode == IW_MODE_ADHOC) {
-		/* not From/To DS: Addr1 = DA, Addr2 = SA,
-		   Addr3 = BSSID */
-		memcpy(&header.addr1, dest, ETH_ALEN);
-		memcpy(&header.addr2, src, ETH_ALEN);
-		memcpy(&header.addr3, ieee->bssid, ETH_ALEN);
-	}
-	header.frame_ctl = cpu_to_le16(fc);
-	hdr_len = IEEE80211_3ADDR_LEN;
-
-	/* Determine fragmentation size based on destination (multicast
-	 * and broadcast are not fragmented) */
-	if (is_multicast_ether_addr(dest) ||
-	    is_broadcast_ether_addr(dest))
-		frag_size = MAX_FRAG_THRESHOLD;
-	else
-		frag_size = ieee->fts;
-
-	/* Determine amount of payload per fragment.  Regardless of if
-	 * this stack is providing the full 802.11 header, one will
-	 * eventually be affixed to this fragment -- so we must account for
-	 * it when determining the amount of payload space. */
-	bytes_per_frag = frag_size - IEEE80211_3ADDR_LEN;
-	if (ieee->config &
-	    (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
-		bytes_per_frag -= IEEE80211_FCS_LEN;
-
-	/* Each fragment may need to have room for encryptiong pre/postfix */
-	if (encrypt)
-		bytes_per_frag -= crypt->ops->extra_prefix_len +
-			crypt->ops->extra_postfix_len;
-
-	/* Number of fragments is the total bytes_per_frag /
-	 * payload_per_fragment */
-	nr_frags = bytes / bytes_per_frag;
-	bytes_last_frag = bytes % bytes_per_frag;
-	if (bytes_last_frag)
-		nr_frags++;
-	else
-		bytes_last_frag = bytes_per_frag;
-
-	/* When we allocate the TXB we allocate enough space for the reserve
-	 * and full fragment bytes (bytes_per_frag doesn't include prefix,
-	 * postfix, header, FCS, etc.) */
-	txb = ieee80211_alloc_txb(nr_frags, frag_size, GFP_ATOMIC);
-	if (unlikely(!txb)) {
-		printk(KERN_WARNING "%s: Could not allocate TXB\n",
-		       ieee->dev->name);
-		goto failed;
-	}
-	txb->encrypted = encrypt;
-	txb->payload_size = bytes;
-
-	for (i = 0; i < nr_frags; i++) {
-		skb_frag = txb->fragments[i];
-
-		if (encrypt)
-			skb_reserve(skb_frag, crypt->ops->extra_prefix_len);
-
-		frag_hdr = (struct ieee80211_hdr *)skb_put(skb_frag, hdr_len);
-		memcpy(frag_hdr, &header, hdr_len);
-
-		/* If this is not the last fragment, then add the MOREFRAGS
-		 * bit to the frame control */
-		if (i != nr_frags - 1) {
-			frag_hdr->frame_ctl = cpu_to_le16(
-				fc | IEEE80211_FCTL_MOREFRAGS);
-			bytes = bytes_per_frag;
-		} else {
-			/* The last fragment takes the remaining length */
-			bytes = bytes_last_frag;
-		}
-
-	       	/* Put a SNAP header on the first fragment */
-		if (i == 0) {
-			ieee80211_put_snap(
-				skb_put(skb_frag, SNAP_SIZE + sizeof(u16)),
-				ether_type);
-			bytes -= SNAP_SIZE + sizeof(u16);
-		}
-
-		memcpy(skb_put(skb_frag, bytes), skb->data, bytes);
-
-		/* Advance the SKB... */
-		skb_pull(skb, bytes);
-
-		/* Encryption routine will move the header forward in order
-		 * to insert the IV between the header and the payload */
-		if (encrypt)
-			ieee80211_encrypt_fragment(ieee, skb_frag, hdr_len);
-		if (ieee->config &
-		    (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
-			skb_put(skb_frag, 4);
-	}
-
-
- success:
-	spin_unlock_irqrestore(&ieee->lock, flags);
-
-	dev_kfree_skb_any(skb);
-
-	if (txb) {
-		if ((*ieee->hard_start_xmit)(txb, dev) == 0) {
-			stats->tx_packets++;
-			stats->tx_bytes += txb->payload_size;
-			return 0;
-		}
-		ieee80211_txb_free(txb);
-	}
-
-	return 0;
-
- failed:
-	spin_unlock_irqrestore(&ieee->lock, flags);
-	netif_stop_queue(dev);
-	stats->tx_errors++;
-	return 1;
-
-}
-
-EXPORT_SYMBOL(ieee80211_txb_free);
diff --git a/trunk/net/ieee80211/ieee80211_wx.c b/trunk/net/ieee80211/ieee80211_wx.c
deleted file mode 100644
index 2cd571c525a9..000000000000
--- a/trunk/net/ieee80211/ieee80211_wx.c
+++ /dev/null
@@ -1,471 +0,0 @@
-/******************************************************************************
-
-  Copyright(c) 2004 Intel Corporation. All rights reserved.
-
-  Portions of this file are based on the WEP enablement code provided by the
-  Host AP project hostap-drivers v0.1.3
-  Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
-  <jkmaline@cc.hut.fi>
-  Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms of version 2 of the GNU General Public License as
-  published by the Free Software Foundation.
-
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc., 59
-  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
-
-  The full GNU General Public License is included in this distribution in the
-  file called LICENSE.
-
-  Contact Information:
-  James P. Ketrenos <ipw2100-admin@linux.intel.com>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-******************************************************************************/
-#include <linux/wireless.h>
-#include <linux/version.h>
-#include <linux/kmod.h>
-#include <linux/module.h>
-
-#include <net/ieee80211.h>
-static const char *ieee80211_modes[] = {
-	"?", "a", "b", "ab", "g", "ag", "bg", "abg"
-};
-
-#define MAX_CUSTOM_LEN 64
-static inline char *ipw2100_translate_scan(struct ieee80211_device *ieee,
- 					   char *start, char *stop,
-					   struct ieee80211_network *network)
-{
-	char custom[MAX_CUSTOM_LEN];
-	char *p;
-	struct iw_event iwe;
-	int i, j;
-	u8 max_rate, rate;
-
-	/* First entry *MUST* be the AP MAC address */
-	iwe.cmd = SIOCGIWAP;
-	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-	memcpy(iwe.u.ap_addr.sa_data, network->bssid, ETH_ALEN);
-	start = iwe_stream_add_event(start, stop, &iwe, IW_EV_ADDR_LEN);
-
-	/* Remaining entries will be displayed in the order we provide them */
-
-	/* Add the ESSID */
-	iwe.cmd = SIOCGIWESSID;
-	iwe.u.data.flags = 1;
-	if (network->flags & NETWORK_EMPTY_ESSID) {
-		iwe.u.data.length = sizeof("<hidden>");
-		start = iwe_stream_add_point(start, stop, &iwe, "<hidden>");
-	} else {
-		iwe.u.data.length = min(network->ssid_len, (u8)32);
-		start = iwe_stream_add_point(start, stop, &iwe, network->ssid);
-	}
-
-	/* Add the protocol name */
-	iwe.cmd = SIOCGIWNAME;
-	snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11%s", ieee80211_modes[network->mode]);
-	start = iwe_stream_add_event(start, stop, &iwe, IW_EV_CHAR_LEN);
-
-        /* Add mode */
-        iwe.cmd = SIOCGIWMODE;
-        if (network->capability &
-	    (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)) {
-		if (network->capability & WLAN_CAPABILITY_ESS)
-			iwe.u.mode = IW_MODE_MASTER;
-		else
-			iwe.u.mode = IW_MODE_ADHOC;
-
-		start = iwe_stream_add_event(start, stop, &iwe,
-					     IW_EV_UINT_LEN);
-	}
-
-        /* Add frequency/channel */
-	iwe.cmd = SIOCGIWFREQ;
-/*	iwe.u.freq.m = ieee80211_frequency(network->channel, network->mode);
-	iwe.u.freq.e = 3; */
-	iwe.u.freq.m = network->channel;
-	iwe.u.freq.e = 0;
-	iwe.u.freq.i = 0;
-	start = iwe_stream_add_event(start, stop, &iwe, IW_EV_FREQ_LEN);
-
-	/* Add encryption capability */
-	iwe.cmd = SIOCGIWENCODE;
-	if (network->capability & WLAN_CAPABILITY_PRIVACY)
-		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-	else
-		iwe.u.data.flags = IW_ENCODE_DISABLED;
-	iwe.u.data.length = 0;
-	start = iwe_stream_add_point(start, stop, &iwe, network->ssid);
-
-	/* Add basic and extended rates */
-	max_rate = 0;
-	p = custom;
-	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
-	for (i = 0, j = 0; i < network->rates_len; ) {
-		if (j < network->rates_ex_len &&
-		    ((network->rates_ex[j] & 0x7F) <
-		     (network->rates[i] & 0x7F)))
-			rate = network->rates_ex[j++] & 0x7F;
-		else
-			rate = network->rates[i++] & 0x7F;
-		if (rate > max_rate)
-			max_rate = rate;
-		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
-	}
-	for (; j < network->rates_ex_len; j++) {
-		rate = network->rates_ex[j] & 0x7F;
-		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
-		if (rate > max_rate)
-			max_rate = rate;
-	}
-
-	iwe.cmd = SIOCGIWRATE;
-	iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
-	iwe.u.bitrate.value = max_rate * 500000;
-	start = iwe_stream_add_event(start, stop, &iwe,
-				     IW_EV_PARAM_LEN);
-
-	iwe.cmd = IWEVCUSTOM;
-	iwe.u.data.length = p - custom;
-	if (iwe.u.data.length)
-		start = iwe_stream_add_point(start, stop, &iwe, custom);
-
-	/* Add quality statistics */
-	/* TODO: Fix these values... */
-	iwe.cmd = IWEVQUAL;
-	iwe.u.qual.qual = network->stats.signal;
-	iwe.u.qual.level = network->stats.rssi;
-	iwe.u.qual.noise = network->stats.noise;
-	iwe.u.qual.updated = network->stats.mask & IEEE80211_STATMASK_WEMASK;
-	if (!(network->stats.mask & IEEE80211_STATMASK_RSSI))
-		iwe.u.qual.updated |= IW_QUAL_LEVEL_INVALID;
-	if (!(network->stats.mask & IEEE80211_STATMASK_NOISE))
-		iwe.u.qual.updated |= IW_QUAL_NOISE_INVALID;
-	if (!(network->stats.mask & IEEE80211_STATMASK_SIGNAL))
-		iwe.u.qual.updated |= IW_QUAL_QUAL_INVALID;
-
-	start = iwe_stream_add_event(start, stop, &iwe, IW_EV_QUAL_LEN);
-
-	iwe.cmd = IWEVCUSTOM;
-	p = custom;
-
-	iwe.u.data.length = p - custom;
-	if (iwe.u.data.length)
-		start = iwe_stream_add_point(start, stop, &iwe, custom);
-
-	if (ieee->wpa_enabled && network->wpa_ie_len){
-		char buf[MAX_WPA_IE_LEN * 2 + 30];
-
-		u8 *p = buf;
-		p += sprintf(p, "wpa_ie=");
-		for (i = 0; i < network->wpa_ie_len; i++) {
-			p += sprintf(p, "%02x", network->wpa_ie[i]);
-		}
-
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = IWEVCUSTOM;
-		iwe.u.data.length = strlen(buf);
-		start = iwe_stream_add_point(start, stop, &iwe, buf);
-	}
-
-	if (ieee->wpa_enabled && network->rsn_ie_len){
-		char buf[MAX_WPA_IE_LEN * 2 + 30];
-
-		u8 *p = buf;
-		p += sprintf(p, "rsn_ie=");
-		for (i = 0; i < network->rsn_ie_len; i++) {
-			p += sprintf(p, "%02x", network->rsn_ie[i]);
-		}
-
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = IWEVCUSTOM;
-		iwe.u.data.length = strlen(buf);
-		start = iwe_stream_add_point(start, stop, &iwe, buf);
-	}
-
-	/* Add EXTRA: Age to display seconds since last beacon/probe response
-	 * for given network. */
-	iwe.cmd = IWEVCUSTOM;
-	p = custom;
-	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-		      " Last beacon: %lums ago", (jiffies - network->last_scanned) / (HZ / 100));
-	iwe.u.data.length = p - custom;
-	if (iwe.u.data.length)
-		start = iwe_stream_add_point(start, stop, &iwe, custom);
-
-
-	return start;
-}
-
-int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
-{
-	struct ieee80211_network *network;
-	unsigned long flags;
-
-	char *ev = extra;
-	char *stop = ev + IW_SCAN_MAX_DATA;
-	int i = 0;
-
-	IEEE80211_DEBUG_WX("Getting scan\n");
-
-	spin_lock_irqsave(&ieee->lock, flags);
-
-	list_for_each_entry(network, &ieee->network_list, list) {
-		i++;
-		if (ieee->scan_age == 0 ||
-		    time_after(network->last_scanned + ieee->scan_age, jiffies))
-			ev = ipw2100_translate_scan(ieee, ev, stop, network);
-		else
-			IEEE80211_DEBUG_SCAN(
-				"Not showing network '%s ("
-				MAC_FMT ")' due to age (%lums).\n",
-				escape_essid(network->ssid,
-					     network->ssid_len),
-				MAC_ARG(network->bssid),
-				(jiffies - network->last_scanned) / (HZ / 100));
-	}
-
-	spin_unlock_irqrestore(&ieee->lock, flags);
-
-	wrqu->data.length = ev -  extra;
-	wrqu->data.flags = 0;
-
-	IEEE80211_DEBUG_WX("exit: %d networks returned.\n", i);
-
-	return 0;
-}
-
-int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *keybuf)
-{
-	struct iw_point *erq = &(wrqu->encoding);
-	struct net_device *dev = ieee->dev;
-	struct ieee80211_security sec = {
-		.flags = 0
-	};
-	int i, key, key_provided, len;
-	struct ieee80211_crypt_data **crypt;
-
-	IEEE80211_DEBUG_WX("SET_ENCODE\n");
-
-	key = erq->flags & IW_ENCODE_INDEX;
-	if (key) {
-		if (key > WEP_KEYS)
-			return -EINVAL;
-		key--;
-		key_provided = 1;
-	} else {
-		key_provided = 0;
-		key = ieee->tx_keyidx;
-	}
-
-	IEEE80211_DEBUG_WX("Key: %d [%s]\n", key, key_provided ?
-			   "provided" : "default");
-
-	crypt = &ieee->crypt[key];
-
-	if (erq->flags & IW_ENCODE_DISABLED) {
-		if (key_provided && *crypt) {
-			IEEE80211_DEBUG_WX("Disabling encryption on key %d.\n",
-					   key);
-			ieee80211_crypt_delayed_deinit(ieee, crypt);
-		} else
-			IEEE80211_DEBUG_WX("Disabling encryption.\n");
-
-		/* Check all the keys to see if any are still configured,
-		 * and if no key index was provided, de-init them all */
-		for (i = 0; i < WEP_KEYS; i++) {
-			if (ieee->crypt[i] != NULL) {
-				if (key_provided)
-					break;
-				ieee80211_crypt_delayed_deinit(
-					ieee, &ieee->crypt[i]);
-			}
-		}
-
-		if (i == WEP_KEYS) {
-			sec.enabled = 0;
-			sec.level = SEC_LEVEL_0;
-			sec.flags |= SEC_ENABLED | SEC_LEVEL;
-		}
-
-		goto done;
-	}
-
-
-
-	sec.enabled = 1;
-	sec.flags |= SEC_ENABLED;
-
-	if (*crypt != NULL && (*crypt)->ops != NULL &&
-	    strcmp((*crypt)->ops->name, "WEP") != 0) {
-		/* changing to use WEP; deinit previously used algorithm
-		 * on this key */
-		ieee80211_crypt_delayed_deinit(ieee, crypt);
-	}
-
-	if (*crypt == NULL) {
-		struct ieee80211_crypt_data *new_crypt;
-
-		/* take WEP into use */
-		new_crypt = kmalloc(sizeof(struct ieee80211_crypt_data),
-				    GFP_KERNEL);
-		if (new_crypt == NULL)
-			return -ENOMEM;
-		memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
-		new_crypt->ops = ieee80211_get_crypto_ops("WEP");
-		if (!new_crypt->ops) {
-			request_module("ieee80211_crypt_wep");
-			new_crypt->ops = ieee80211_get_crypto_ops("WEP");
-		}
-
-		if (new_crypt->ops && try_module_get(new_crypt->ops->owner))
-			new_crypt->priv = new_crypt->ops->init(key);
-
-		if (!new_crypt->ops || !new_crypt->priv) {
-			kfree(new_crypt);
-			new_crypt = NULL;
-
-			printk(KERN_WARNING "%s: could not initialize WEP: "
-			       "load module ieee80211_crypt_wep\n",
-			       dev->name);
-			return -EOPNOTSUPP;
-		}
-		*crypt = new_crypt;
-	}
-
-	/* If a new key was provided, set it up */
-	if (erq->length > 0) {
-		len = erq->length <= 5 ? 5 : 13;
-		memcpy(sec.keys[key], keybuf, erq->length);
-		if (len > erq->length)
-			memset(sec.keys[key] + erq->length, 0,
-			       len - erq->length);
-		IEEE80211_DEBUG_WX("Setting key %d to '%s' (%d:%d bytes)\n",
-				   key, escape_essid(sec.keys[key], len),
-				   erq->length, len);
-		sec.key_sizes[key] = len;
- 		(*crypt)->ops->set_key(sec.keys[key], len, NULL,
-				       (*crypt)->priv);
-		sec.flags |= (1 << key);
-		/* This ensures a key will be activated if no key is
-		 * explicitely set */
-		if (key == sec.active_key)
-			sec.flags |= SEC_ACTIVE_KEY;
-	} else {
-		len = (*crypt)->ops->get_key(sec.keys[key], WEP_KEY_LEN,
-					     NULL, (*crypt)->priv);
-		if (len == 0) {
-			/* Set a default key of all 0 */
-			IEEE80211_DEBUG_WX("Setting key %d to all zero.\n",
-					   key);
-			memset(sec.keys[key], 0, 13);
-			(*crypt)->ops->set_key(sec.keys[key], 13, NULL,
-					       (*crypt)->priv);
-			sec.key_sizes[key] = 13;
-			sec.flags |= (1 << key);
-		}
-
-		/* No key data - just set the default TX key index */
-		if (key_provided) {
-			IEEE80211_DEBUG_WX(
-				"Setting key %d to default Tx key.\n", key);
-			ieee->tx_keyidx = key;
-			sec.active_key = key;
-			sec.flags |= SEC_ACTIVE_KEY;
-		}
-	}
-
- done:
-	ieee->open_wep = !(erq->flags & IW_ENCODE_RESTRICTED);
-	sec.auth_mode = ieee->open_wep ? WLAN_AUTH_OPEN : WLAN_AUTH_SHARED_KEY;
-	sec.flags |= SEC_AUTH_MODE;
-	IEEE80211_DEBUG_WX("Auth: %s\n", sec.auth_mode == WLAN_AUTH_OPEN ?
-			   "OPEN" : "SHARED KEY");
-
-	/* For now we just support WEP, so only set that security level...
-	 * TODO: When WPA is added this is one place that needs to change */
-	sec.flags |= SEC_LEVEL;
-	sec.level = SEC_LEVEL_1; /* 40 and 104 bit WEP */
-
-	if (ieee->set_security)
-		ieee->set_security(dev, &sec);
-
-	/* Do not reset port if card is in Managed mode since resetting will
-	 * generate new IEEE 802.11 authentication which may end up in looping
-	 * with IEEE 802.1X.  If your hardware requires a reset after WEP
-	 * configuration (for example... Prism2), implement the reset_port in
-	 * the callbacks structures used to initialize the 802.11 stack. */
-	if (ieee->reset_on_keychange &&
-	    ieee->iw_mode != IW_MODE_INFRA &&
-	    ieee->reset_port && ieee->reset_port(dev)) {
-		printk(KERN_DEBUG "%s: reset_port failed\n", dev->name);
-		return -EINVAL;
-	}
-	return 0;
-}
-
-int ieee80211_wx_get_encode(struct ieee80211_device *ieee,
-			    struct iw_request_info *info,
-			    union iwreq_data *wrqu, char *keybuf)
-{
-	struct iw_point *erq = &(wrqu->encoding);
-	int len, key;
-	struct ieee80211_crypt_data *crypt;
-
-	IEEE80211_DEBUG_WX("GET_ENCODE\n");
-
-	key = erq->flags & IW_ENCODE_INDEX;
-	if (key) {
-		if (key > WEP_KEYS)
-			return -EINVAL;
-		key--;
-	} else
-		key = ieee->tx_keyidx;
-
-	crypt = ieee->crypt[key];
-	erq->flags = key + 1;
-
-	if (crypt == NULL || crypt->ops == NULL) {
-		erq->length = 0;
-		erq->flags |= IW_ENCODE_DISABLED;
-		return 0;
-	}
-
-	if (strcmp(crypt->ops->name, "WEP") != 0) {
-		/* only WEP is supported with wireless extensions, so just
-		 * report that encryption is used */
-		erq->length = 0;
-		erq->flags |= IW_ENCODE_ENABLED;
-		return 0;
-	}
-
-	len = crypt->ops->get_key(keybuf, WEP_KEY_LEN, NULL, crypt->priv);
-	erq->length = (len >= 0 ? len : 0);
-
-	erq->flags |= IW_ENCODE_ENABLED;
-
-	if (ieee->open_wep)
-		erq->flags |= IW_ENCODE_OPEN;
-	else
-		erq->flags |= IW_ENCODE_RESTRICTED;
-
-	return 0;
-}
-
-EXPORT_SYMBOL(ieee80211_wx_get_scan);
-EXPORT_SYMBOL(ieee80211_wx_set_encode);
-EXPORT_SYMBOL(ieee80211_wx_get_encode);
diff --git a/trunk/net/ipv4/Kconfig b/trunk/net/ipv4/Kconfig
index e55136ae09f4..0b3d9f1d8069 100644
--- a/trunk/net/ipv4/Kconfig
+++ b/trunk/net/ipv4/Kconfig
@@ -413,19 +413,20 @@ config INET_TUNNEL
 	  
 	  If unsure, say Y.
 
-config INET_DIAG
-	tristate "INET: socket monitoring interface"
+config IP_TCPDIAG
+	tristate "IP: TCP socket monitoring interface"
 	default y
 	---help---
-	  Support for INET (TCP, DCCP, etc) socket monitoring interface used by
-	  native Linux tools such as ss. ss is included in iproute2, currently
-	  downloadable at <http://developer.osdl.org/dev/iproute2>. 
+	  Support for TCP socket monitoring interface used by native Linux
+	  tools such as ss. ss is included in iproute2, currently downloadable
+	  at <http://developer.osdl.org/dev/iproute2>. If you want IPv6 support
+	  and have selected IPv6 as a module, you need to build this as a
+	  module too.
 	  
 	  If unsure, say Y.
 
-config INET_TCP_DIAG
-	depends on INET_DIAG
-	def_tristate INET_DIAG
+config IP_TCPDIAG_IPV6
+	def_bool (IP_TCPDIAG=y && IPV6=y) || (IP_TCPDIAG=m && IPV6)
 
 config TCP_CONG_ADVANCED
 	bool "TCP: advanced congestion control"
diff --git a/trunk/net/ipv4/Makefile b/trunk/net/ipv4/Makefile
index f0435d00db6b..55dc6cca1e7b 100644
--- a/trunk/net/ipv4/Makefile
+++ b/trunk/net/ipv4/Makefile
@@ -4,12 +4,11 @@
 
 obj-y     := route.o inetpeer.o protocol.o \
 	     ip_input.o ip_fragment.o ip_forward.o ip_options.o \
-	     ip_output.o ip_sockglue.o inet_hashtables.o \
-	     inet_timewait_sock.o inet_connection_sock.o \
+	     ip_output.o ip_sockglue.o \
 	     tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o \
 	     tcp_minisocks.o tcp_cong.o \
 	     datagram.o raw.o udp.o arp.o icmp.o devinet.o af_inet.o igmp.o \
-	     sysctl_net_ipv4.o fib_frontend.o fib_semantics.o netfilter.o
+	     sysctl_net_ipv4.o fib_frontend.o fib_semantics.o
 
 obj-$(CONFIG_IP_FIB_HASH) += fib_hash.o
 obj-$(CONFIG_IP_FIB_TRIE) += fib_trie.o
@@ -30,9 +29,8 @@ obj-$(CONFIG_IP_ROUTE_MULTIPATH_WRANDOM) += multipath_wrandom.o
 obj-$(CONFIG_IP_ROUTE_MULTIPATH_DRR) += multipath_drr.o
 obj-$(CONFIG_NETFILTER)	+= netfilter/
 obj-$(CONFIG_IP_VS) += ipvs/
-obj-$(CONFIG_INET_DIAG) += inet_diag.o 
+obj-$(CONFIG_IP_TCPDIAG) += tcp_diag.o 
 obj-$(CONFIG_IP_ROUTE_MULTIPATH_CACHED) += multipath.o
-obj-$(CONFIG_INET_TCP_DIAG) += tcp_diag.o
 obj-$(CONFIG_TCP_CONG_BIC) += tcp_bic.o
 obj-$(CONFIG_TCP_CONG_WESTWOOD) += tcp_westwood.o
 obj-$(CONFIG_TCP_CONG_HSTCP) += tcp_highspeed.o
diff --git a/trunk/net/ipv4/af_inet.c b/trunk/net/ipv4/af_inet.c
index bf147f8db399..163ae4068b5f 100644
--- a/trunk/net/ipv4/af_inet.c
+++ b/trunk/net/ipv4/af_inet.c
@@ -99,7 +99,6 @@
 #include <net/arp.h>
 #include <net/route.h>
 #include <net/ip_fib.h>
-#include <net/inet_connection_sock.h>
 #include <net/tcp.h>
 #include <net/udp.h>
 #include <linux/skbuff.h>
@@ -113,7 +112,11 @@
 #include <linux/mroute.h>
 #endif
 
-DEFINE_SNMP_STAT(struct linux_mib, net_statistics) __read_mostly;
+DEFINE_SNMP_STAT(struct linux_mib, net_statistics);
+
+#ifdef INET_REFCNT_DEBUG
+atomic_t inet_sock_nr;
+#endif
 
 extern void ip_mc_drop_socket(struct sock *sk);
 
@@ -150,7 +153,11 @@ void inet_sock_destruct(struct sock *sk)
 	if (inet->opt)
 		kfree(inet->opt);
 	dst_release(sk->sk_dst_cache);
-	sk_refcnt_debug_dec(sk);
+#ifdef INET_REFCNT_DEBUG
+	atomic_dec(&inet_sock_nr);
+	printk(KERN_DEBUG "INET socket %p released, %d are still alive\n",
+	       sk, atomic_read(&inet_sock_nr));
+#endif
 }
 
 /*
@@ -203,7 +210,7 @@ int inet_listen(struct socket *sock, int backlog)
 	 * we can only allow the backlog to be adjusted.
 	 */
 	if (old_state != TCP_LISTEN) {
-		err = inet_csk_listen_start(sk, TCP_SYNQ_HSIZE);
+		err = tcp_listen_start(sk);
 		if (err)
 			goto out;
 	}
@@ -228,14 +235,12 @@ static int inet_create(struct socket *sock, int protocol)
 	struct proto *answer_prot;
 	unsigned char answer_flags;
 	char answer_no_check;
-	int try_loading_module = 0;
-	int err = -ESOCKTNOSUPPORT;
+	int err;
 
 	sock->state = SS_UNCONNECTED;
 
 	/* Look for the requested type/protocol pair. */
 	answer = NULL;
-lookup_protocol:
 	rcu_read_lock();
 	list_for_each_rcu(p, &inetsw[sock->type]) {
 		answer = list_entry(p, struct inet_protosw, list);
@@ -256,28 +261,9 @@ static int inet_create(struct socket *sock, int protocol)
 		answer = NULL;
 	}
 
-	if (unlikely(answer == NULL)) {
-		if (try_loading_module < 2) {
-			rcu_read_unlock();
-			/*
-			 * Be more specific, e.g. net-pf-2-proto-132-type-1
-			 * (net-pf-PF_INET-proto-IPPROTO_SCTP-type-SOCK_STREAM)
-			 */
-			if (++try_loading_module == 1)
-				request_module("net-pf-%d-proto-%d-type-%d",
-					       PF_INET, protocol, sock->type);
-			/*
-			 * Fall back to generic, e.g. net-pf-2-proto-132
-			 * (net-pf-PF_INET-proto-IPPROTO_SCTP)
-			 */
-			else
-				request_module("net-pf-%d-proto-%d",
-					       PF_INET, protocol);
-			goto lookup_protocol;
-		} else
-			goto out_rcu_unlock;
-	}
-
+	err = -ESOCKTNOSUPPORT;
+	if (!answer)
+		goto out_rcu_unlock;
 	err = -EPERM;
 	if (answer->capability > 0 && !capable(answer->capability))
 		goto out_rcu_unlock;
@@ -331,7 +317,9 @@ static int inet_create(struct socket *sock, int protocol)
 	inet->mc_index	= 0;
 	inet->mc_list	= NULL;
 
-	sk_refcnt_debug_inc(sk);
+#ifdef INET_REFCNT_DEBUG
+	atomic_inc(&inet_sock_nr);
+#endif
 
 	if (inet->num) {
 		/* It assumes that any protocol which allows
@@ -859,6 +847,10 @@ static struct net_proto_family inet_family_ops = {
 	.owner	= THIS_MODULE,
 };
 
+
+extern void tcp_init(void);
+extern void tcp_v4_init(struct net_proto_family *);
+
 /* Upon startup we insert all the elements in inetsw_array[] into
  * the linked list inetsw.
  */
@@ -969,119 +961,6 @@ void inet_unregister_protosw(struct inet_protosw *p)
 	}
 }
 
-/*
- *      Shall we try to damage output packets if routing dev changes?
- */
-
-int sysctl_ip_dynaddr;
-
-static int inet_sk_reselect_saddr(struct sock *sk)
-{
-	struct inet_sock *inet = inet_sk(sk);
-	int err;
-	struct rtable *rt;
-	__u32 old_saddr = inet->saddr;
-	__u32 new_saddr;
-	__u32 daddr = inet->daddr;
-
-	if (inet->opt && inet->opt->srr)
-		daddr = inet->opt->faddr;
-
-	/* Query new route. */
-	err = ip_route_connect(&rt, daddr, 0,
-			       RT_CONN_FLAGS(sk),
-			       sk->sk_bound_dev_if,
-			       sk->sk_protocol,
-			       inet->sport, inet->dport, sk);
-	if (err)
-		return err;
-
-	sk_setup_caps(sk, &rt->u.dst);
-
-	new_saddr = rt->rt_src;
-
-	if (new_saddr == old_saddr)
-		return 0;
-
-	if (sysctl_ip_dynaddr > 1) {
-		printk(KERN_INFO "%s(): shifting inet->"
-				 "saddr from %d.%d.%d.%d to %d.%d.%d.%d\n",
-		       __FUNCTION__,
-		       NIPQUAD(old_saddr),
-		       NIPQUAD(new_saddr));
-	}
-
-	inet->saddr = inet->rcv_saddr = new_saddr;
-
-	/*
-	 * XXX The only one ugly spot where we need to
-	 * XXX really change the sockets identity after
-	 * XXX it has entered the hashes. -DaveM
-	 *
-	 * Besides that, it does not check for connection
-	 * uniqueness. Wait for troubles.
-	 */
-	__sk_prot_rehash(sk);
-	return 0;
-}
-
-int inet_sk_rebuild_header(struct sock *sk)
-{
-	struct inet_sock *inet = inet_sk(sk);
-	struct rtable *rt = (struct rtable *)__sk_dst_check(sk, 0);
-	u32 daddr;
-	int err;
-
-	/* Route is OK, nothing to do. */
-	if (rt)
-		return 0;
-
-	/* Reroute. */
-	daddr = inet->daddr;
-	if (inet->opt && inet->opt->srr)
-		daddr = inet->opt->faddr;
-{
-	struct flowi fl = {
-		.oif = sk->sk_bound_dev_if,
-		.nl_u = {
-			.ip4_u = {
-				.daddr	= daddr,
-				.saddr	= inet->saddr,
-				.tos	= RT_CONN_FLAGS(sk),
-			},
-		},
-		.proto = sk->sk_protocol,
-		.uli_u = {
-			.ports = {
-				.sport = inet->sport,
-				.dport = inet->dport,
-			},
-		},
-	};
-						
-	err = ip_route_output_flow(&rt, &fl, sk, 0);
-}
-	if (!err)
-		sk_setup_caps(sk, &rt->u.dst);
-	else {
-		/* Routing failed... */
-		sk->sk_route_caps = 0;
-		/*
-		 * Other protocols have to map its equivalent state to TCP_SYN_SENT.
-		 * DCCP maps its DCCP_REQUESTING state to TCP_SYN_SENT. -acme
-		 */
-		if (!sysctl_ip_dynaddr ||
-		    sk->sk_state != TCP_SYN_SENT ||
-		    (sk->sk_userlocks & SOCK_BINDADDR_LOCK) ||
-		    (err = inet_sk_reselect_saddr(sk)) != 0)
-			sk->sk_err_soft = -err;
-	}
-
-	return err;
-}
-
-EXPORT_SYMBOL(inet_sk_rebuild_header);
-
 #ifdef CONFIG_IP_MULTICAST
 static struct net_protocol igmp_protocol = {
 	.handler =	igmp_rcv,
@@ -1128,6 +1007,7 @@ static int __init init_ipv4_mibs(void)
 }
 
 static int ipv4_proc_init(void);
+extern void ipfrag_init(void);
 
 /*
  *	IP protocol layer initialiser
@@ -1248,10 +1128,19 @@ module_init(inet_init);
 /* ------------------------------------------------------------------------ */
 
 #ifdef CONFIG_PROC_FS
+extern int  fib_proc_init(void);
+extern void fib_proc_exit(void);
 #ifdef CONFIG_IP_FIB_TRIE
 extern int  fib_stat_proc_init(void);
 extern void fib_stat_proc_exit(void);
 #endif
+extern int  ip_misc_proc_init(void);
+extern int  raw_proc_init(void);
+extern void raw_proc_exit(void);
+extern int  tcp4_proc_init(void);
+extern void tcp4_proc_exit(void);
+extern int  udp4_proc_init(void);
+extern void udp4_proc_exit(void);
 
 static int __init ipv4_proc_init(void)
 {
@@ -1316,3 +1205,7 @@ EXPORT_SYMBOL(inet_stream_ops);
 EXPORT_SYMBOL(inet_unregister_protosw);
 EXPORT_SYMBOL(net_statistics);
 EXPORT_SYMBOL(sysctl_ip_nonlocal_bind);
+
+#ifdef INET_REFCNT_DEBUG
+EXPORT_SYMBOL(inet_sock_nr);
+#endif
diff --git a/trunk/net/ipv4/arp.c b/trunk/net/ipv4/arp.c
index 8bf312bdea13..a642fd612853 100644
--- a/trunk/net/ipv4/arp.c
+++ b/trunk/net/ipv4/arp.c
@@ -700,7 +700,7 @@ void arp_send(int type, int ptype, u32 dest_ip,
 static void parp_redo(struct sk_buff *skb)
 {
 	nf_reset(skb);
-	arp_rcv(skb, skb->dev, NULL, skb->dev);
+	arp_rcv(skb, skb->dev, NULL);
 }
 
 /*
@@ -865,7 +865,7 @@ static int arp_process(struct sk_buff *skb)
 				if (n)
 					neigh_release(n);
 
-				if (NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED || 
+				if (skb->stamp.tv_sec == LOCALLY_ENQUEUED || 
 				    skb->pkt_type == PACKET_HOST ||
 				    in_dev->arp_parms->proxy_delay == 0) {
 					arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
@@ -927,7 +927,7 @@ static int arp_process(struct sk_buff *skb)
  *	Receive an arp request from the device layer.
  */
 
-int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 {
 	struct arphdr *arp;
 
@@ -948,8 +948,6 @@ int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		goto out_of_mem;
 
-	memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
-
 	return NF_HOOK(NF_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);
 
 freeskb:
diff --git a/trunk/net/ipv4/datagram.c b/trunk/net/ipv4/datagram.c
index c1b42b5257f8..b1db561f2542 100644
--- a/trunk/net/ipv4/datagram.c
+++ b/trunk/net/ipv4/datagram.c
@@ -16,10 +16,9 @@
 #include <linux/module.h>
 #include <linux/ip.h>
 #include <linux/in.h>
-#include <net/ip.h>
 #include <net/sock.h>
+#include <net/tcp.h>
 #include <net/route.h>
-#include <net/tcp_states.h>
 
 int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
diff --git a/trunk/net/ipv4/devinet.c b/trunk/net/ipv4/devinet.c
index ba2895ae8151..d8a10e3dd77d 100644
--- a/trunk/net/ipv4/devinet.c
+++ b/trunk/net/ipv4/devinet.c
@@ -1111,12 +1111,13 @@ static void rtmsg_ifa(int event, struct in_ifaddr* ifa)
 	struct sk_buff *skb = alloc_skb(size, GFP_KERNEL);
 
 	if (!skb)
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV4_IFADDR, ENOBUFS);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV4_IFADDR, ENOBUFS);
 	else if (inet_fill_ifaddr(skb, ifa, current->pid, 0, event, 0) < 0) {
 		kfree_skb(skb);
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV4_IFADDR, EINVAL);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV4_IFADDR, EINVAL);
 	} else {
-		netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV4_IFADDR, GFP_KERNEL);
+		NETLINK_CB(skb).dst_groups = RTMGRP_IPV4_IFADDR;
+		netlink_broadcast(rtnl, skb, 0, RTMGRP_IPV4_IFADDR, GFP_KERNEL);
 	}
 }
 
diff --git a/trunk/net/ipv4/esp4.c b/trunk/net/ipv4/esp4.c
index b31ffc5053d2..ba57446d5d1f 100644
--- a/trunk/net/ipv4/esp4.c
+++ b/trunk/net/ipv4/esp4.c
@@ -331,8 +331,8 @@ static void esp4_err(struct sk_buff *skb, u32 info)
 	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
 	if (!x)
 		return;
-	NETDEBUG(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n",
-		 ntohl(esph->spi), ntohl(iph->daddr));
+	NETDEBUG(printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n",
+			ntohl(esph->spi), ntohl(iph->daddr)));
 	xfrm_state_put(x);
 }
 
@@ -395,10 +395,10 @@ static int esp_init_state(struct xfrm_state *x)
 
 		if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
 		    crypto_tfm_alg_digestsize(esp->auth.tfm)) {
-			NETDEBUG(KERN_INFO "ESP: %s digestsize %u != %hu\n",
-				 x->aalg->alg_name,
-				 crypto_tfm_alg_digestsize(esp->auth.tfm),
-				 aalg_desc->uinfo.auth.icv_fullbits/8);
+			NETDEBUG(printk(KERN_INFO "ESP: %s digestsize %u != %hu\n",
+			       x->aalg->alg_name,
+			       crypto_tfm_alg_digestsize(esp->auth.tfm),
+			       aalg_desc->uinfo.auth.icv_fullbits/8));
 			goto error;
 		}
 
diff --git a/trunk/net/ipv4/fib_frontend.c b/trunk/net/ipv4/fib_frontend.c
index 4e1379f71269..cd8e45ab9580 100644
--- a/trunk/net/ipv4/fib_frontend.c
+++ b/trunk/net/ipv4/fib_frontend.c
@@ -558,15 +558,16 @@ static void nl_fib_input(struct sock *sk, int len)
 	nl_fib_lookup(frn, tb);
 	
 	pid = nlh->nlmsg_pid;           /*pid of sending process */
+	NETLINK_CB(skb).groups = 0;     /* not in mcast group */
 	NETLINK_CB(skb).pid = 0;         /* from kernel */
 	NETLINK_CB(skb).dst_pid = pid;
-	NETLINK_CB(skb).dst_group = 0;  /* unicast */
+	NETLINK_CB(skb).dst_groups = 0;  /* unicast */
 	netlink_unicast(sk, skb, pid, MSG_DONTWAIT);
 }    
 
 static void nl_fib_lookup_init(void)
 {
-      netlink_kernel_create(NETLINK_FIB_LOOKUP, 0, nl_fib_input, THIS_MODULE);
+      netlink_kernel_create(NETLINK_FIB_LOOKUP, nl_fib_input);
 }
 
 static void fib_disable_ip(struct net_device *dev, int force)
@@ -661,4 +662,5 @@ void __init ip_fib_init(void)
 }
 
 EXPORT_SYMBOL(inet_addr_type);
+EXPORT_SYMBOL(ip_dev_find);
 EXPORT_SYMBOL(ip_rt_ioctl);
diff --git a/trunk/net/ipv4/fib_hash.c b/trunk/net/ipv4/fib_hash.c
index 2a8c9afc3695..b10d6bb5ef3d 100644
--- a/trunk/net/ipv4/fib_hash.c
+++ b/trunk/net/ipv4/fib_hash.c
@@ -45,8 +45,8 @@
 
 #include "fib_lookup.h"
 
-static kmem_cache_t *fn_hash_kmem __read_mostly;
-static kmem_cache_t *fn_alias_kmem __read_mostly;
+static kmem_cache_t *fn_hash_kmem;
+static kmem_cache_t *fn_alias_kmem;
 
 struct fib_node {
 	struct hlist_node	fn_hash;
diff --git a/trunk/net/ipv4/fib_lookup.h b/trunk/net/ipv4/fib_lookup.h
index ef6609ea0eb7..b729d97cfa93 100644
--- a/trunk/net/ipv4/fib_lookup.h
+++ b/trunk/net/ipv4/fib_lookup.h
@@ -7,7 +7,6 @@
 
 struct fib_alias {
 	struct list_head	fa_list;
-	struct rcu_head rcu;
 	struct fib_info		*fa_info;
 	u8			fa_tos;
 	u8			fa_type;
diff --git a/trunk/net/ipv4/fib_semantics.c b/trunk/net/ipv4/fib_semantics.c
index d41219e8037c..e278cb9d0075 100644
--- a/trunk/net/ipv4/fib_semantics.c
+++ b/trunk/net/ipv4/fib_semantics.c
@@ -290,10 +290,10 @@ void rtmsg_fib(int event, u32 key, struct fib_alias *fa,
 		kfree_skb(skb);
 		return;
 	}
-	NETLINK_CB(skb).dst_group = RTNLGRP_IPV4_ROUTE;
+	NETLINK_CB(skb).dst_groups = RTMGRP_IPV4_ROUTE;
 	if (n->nlmsg_flags&NLM_F_ECHO)
 		atomic_inc(&skb->users);
-	netlink_broadcast(rtnl, skb, pid, RTNLGRP_IPV4_ROUTE, GFP_KERNEL);
+	netlink_broadcast(rtnl, skb, pid, RTMGRP_IPV4_ROUTE, GFP_KERNEL);
 	if (n->nlmsg_flags&NLM_F_ECHO)
 		netlink_unicast(rtnl, skb, pid, MSG_DONTWAIT);
 }
@@ -854,7 +854,6 @@ fib_create_info(const struct rtmsg *r, struct kern_rta *rta,
 	return NULL;
 }
 
-/* Note! fib_semantic_match intentionally uses  RCU list functions. */
 int fib_semantic_match(struct list_head *head, const struct flowi *flp,
 		       struct fib_result *res, __u32 zone, __u32 mask, 
 			int prefixlen)
@@ -862,7 +861,7 @@ int fib_semantic_match(struct list_head *head, const struct flowi *flp,
 	struct fib_alias *fa;
 	int nh_sel = 0;
 
-	list_for_each_entry_rcu(fa, head, fa_list) {
+	list_for_each_entry(fa, head, fa_list) {
 		int err;
 
 		if (fa->fa_tos &&
diff --git a/trunk/net/ipv4/fib_trie.c b/trunk/net/ipv4/fib_trie.c
index b2dea4e5da77..45efd5f4741b 100644
--- a/trunk/net/ipv4/fib_trie.c
+++ b/trunk/net/ipv4/fib_trie.c
@@ -43,7 +43,7 @@
  *		2 of the License, or (at your option) any later version.
  */
 
-#define VERSION "0.402"
+#define VERSION "0.325"
 
 #include <linux/config.h>
 #include <asm/uaccess.h>
@@ -62,7 +62,6 @@
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/proc_fs.h>
-#include <linux/rcupdate.h>
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
 #include <linux/init.h>
@@ -78,55 +77,56 @@
 #undef CONFIG_IP_FIB_TRIE_STATS
 #define MAX_CHILDS 16384
 
+#define EXTRACT(p, n, str) ((str)<<(p)>>(32-(n)))
 #define KEYLENGTH (8*sizeof(t_key))
 #define MASK_PFX(k, l) (((l)==0)?0:(k >> (KEYLENGTH-l)) << (KEYLENGTH-l))
 #define TKEY_GET_MASK(offset, bits) (((bits)==0)?0:((t_key)(-1) << (KEYLENGTH - bits) >> offset))
 
+static DEFINE_RWLOCK(fib_lock);
+
 typedef unsigned int t_key;
 
 #define T_TNODE 0
 #define T_LEAF  1
 #define NODE_TYPE_MASK	0x1UL
-#define NODE_PARENT(node) \
-	((struct tnode *)rcu_dereference(((node)->parent & ~NODE_TYPE_MASK)))
-
-#define NODE_TYPE(node) ((node)->parent & NODE_TYPE_MASK)
-
-#define NODE_SET_PARENT(node, ptr)		\
-	rcu_assign_pointer((node)->parent,	\
-			   ((unsigned long)(ptr)) | NODE_TYPE(node))
-
-#define IS_TNODE(n) (!(n->parent & T_LEAF))
-#define IS_LEAF(n) (n->parent & T_LEAF)
+#define NODE_PARENT(_node) \
+	((struct tnode *)((_node)->_parent & ~NODE_TYPE_MASK))
+#define NODE_SET_PARENT(_node, _ptr) \
+	((_node)->_parent = (((unsigned long)(_ptr)) | \
+                     ((_node)->_parent & NODE_TYPE_MASK)))
+#define NODE_INIT_PARENT(_node, _type) \
+	((_node)->_parent = (_type))
+#define NODE_TYPE(_node) \
+	((_node)->_parent & NODE_TYPE_MASK)
+
+#define IS_TNODE(n) (!(n->_parent & T_LEAF))
+#define IS_LEAF(n) (n->_parent & T_LEAF)
 
 struct node {
-	t_key key;
-	unsigned long parent;
+        t_key key;
+	unsigned long _parent;
 };
 
 struct leaf {
-	t_key key;
-	unsigned long parent;
+        t_key key;
+	unsigned long _parent;
 	struct hlist_head list;
-	struct rcu_head rcu;
 };
 
 struct leaf_info {
 	struct hlist_node hlist;
-	struct rcu_head rcu;
 	int plen;
 	struct list_head falh;
 };
 
 struct tnode {
-	t_key key;
-	unsigned long parent;
-	unsigned short pos:5;		/* 2log(KEYLENGTH) bits needed */
-	unsigned short bits:5;		/* 2log(KEYLENGTH) bits needed */
-	unsigned short full_children;	/* KEYLENGTH bits needed */
-	unsigned short empty_children;	/* KEYLENGTH bits needed */
-	struct rcu_head rcu;
-	struct node *child[0];
+        t_key key;
+	unsigned long _parent;
+        unsigned short pos:5;        /* 2log(KEYLENGTH) bits needed */
+        unsigned short bits:5;       /* 2log(KEYLENGTH) bits needed */
+        unsigned short full_children;  /* KEYLENGTH bits needed */
+        unsigned short empty_children; /* KEYLENGTH bits needed */
+        struct node *child[0];
 };
 
 #ifdef CONFIG_IP_FIB_TRIE_STATS
@@ -150,45 +150,77 @@ struct trie_stat {
 };
 
 struct trie {
-	struct node *trie;
+        struct node *trie;
 #ifdef CONFIG_IP_FIB_TRIE_STATS
 	struct trie_use_stats stats;
 #endif
-	int size;
+        int size;
 	unsigned int revision;
 };
 
+static int trie_debug = 0;
+
+static int tnode_full(struct tnode *tn, struct node *n);
 static void put_child(struct trie *t, struct tnode *tn, int i, struct node *n);
 static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int wasfull);
+static int tnode_child_length(struct tnode *tn);
 static struct node *resize(struct trie *t, struct tnode *tn);
-static struct tnode *inflate(struct trie *t, struct tnode *tn);
-static struct tnode *halve(struct trie *t, struct tnode *tn);
+static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err);
+static struct tnode *halve(struct trie *t, struct tnode *tn, int *err);
 static void tnode_free(struct tnode *tn);
 static void trie_dump_seq(struct seq_file *seq, struct trie *t);
+extern struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio);
+extern int fib_detect_death(struct fib_info *fi, int order,
+                            struct fib_info **last_resort, int *last_idx, int *dflt);
 
-static kmem_cache_t *fn_alias_kmem __read_mostly;
-static struct trie *trie_local = NULL, *trie_main = NULL;
+extern void rtmsg_fib(int event, u32 key, struct fib_alias *fa, int z, int tb_id,
+               struct nlmsghdr *n, struct netlink_skb_parms *req);
 
+static kmem_cache_t *fn_alias_kmem;
+static struct trie *trie_local = NULL, *trie_main = NULL;
 
-/* rcu_read_lock needs to be hold by caller from readside */
+static void trie_bug(char *err)
+{
+	printk("Trie Bug: %s\n", err);
+	BUG();
+}
 
 static inline struct node *tnode_get_child(struct tnode *tn, int i)
 {
-	BUG_ON(i >= 1 << tn->bits);
+        if (i >= 1<<tn->bits)
+                trie_bug("tnode_get_child");
 
-	return rcu_dereference(tn->child[i]);
+        return tn->child[i];
 }
 
-static inline int tnode_child_length(const struct tnode *tn)
+static inline int tnode_child_length(struct tnode *tn)
 {
-	return 1 << tn->bits;
+        return 1<<tn->bits;
 }
 
+/*
+  _________________________________________________________________
+  | i | i | i | i | i | i | i | N | N | N | S | S | S | S | S | C |
+  ----------------------------------------------------------------
+    0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
+
+  _________________________________________________________________
+  | C | C | C | u | u | u | u | u | u | u | u | u | u | u | u | u |
+  -----------------------------------------------------------------
+   16  17  18  19  20  21  22  23  24  25  26  27  28  29  30  31
+
+  tp->pos = 7
+  tp->bits = 3
+  n->pos = 15
+  n->bits=4
+  KEYLENGTH=32
+*/
+
 static inline t_key tkey_extract_bits(t_key a, int offset, int bits)
 {
-	if (offset < KEYLENGTH)
+        if (offset < KEYLENGTH)
 		return ((t_key)(a << offset)) >> (KEYLENGTH - bits);
-	else
+        else
 		return 0;
 }
 
@@ -201,8 +233,8 @@ static inline int tkey_sub_equals(t_key a, int offset, int bits, t_key b)
 {
 	if (bits == 0 || offset >= KEYLENGTH)
 		return 1;
-	bits = bits > KEYLENGTH ? KEYLENGTH : bits;
-	return ((a ^ b) << offset) >> (KEYLENGTH - bits) == 0;
+        bits = bits > KEYLENGTH ? KEYLENGTH : bits;
+        return ((a ^ b) << offset) >> (KEYLENGTH - bits) == 0;
 }
 
 static inline int tkey_mismatch(t_key a, int offset, t_key b)
@@ -217,6 +249,14 @@ static inline int tkey_mismatch(t_key a, int offset, t_key b)
 	return i;
 }
 
+/* Candiate for fib_semantics */
+
+static void fn_free_alias(struct fib_alias *fa)
+{
+	fib_release_info(fa->fa_info);
+	kmem_cache_free(fn_alias_kmem, fa);
+}
+
 /*
   To understand this stuff, an understanding of keys and all their bits is 
   necessary. Every node in the trie has a key associated with it, but not 
@@ -255,7 +295,7 @@ static inline int tkey_mismatch(t_key a, int offset, t_key b)
   tp->pos = 7
   tp->bits = 3
   n->pos = 15
-  n->bits = 4
+  n->bits=4
 
   First, let's just ignore the bits that come before the parent tp, that is 
   the bits from 0 to (tp->pos-1). They are *known* but at this point we do 
@@ -280,65 +320,60 @@ static inline int tkey_mismatch(t_key a, int offset, t_key b)
 
 */
 
-static inline void check_tnode(const struct tnode *tn)
+static void check_tnode(struct tnode *tn)
 {
-	WARN_ON(tn && tn->pos+tn->bits > 32);
+	if (tn && tn->pos+tn->bits > 32) {
+		printk("TNODE ERROR tn=%p, pos=%d, bits=%d\n", tn, tn->pos, tn->bits);
+	}
 }
 
 static int halve_threshold = 25;
 static int inflate_threshold = 50;
 
-
-static void __alias_free_mem(struct rcu_head *head)
-{
-	struct fib_alias *fa = container_of(head, struct fib_alias, rcu);
-	kmem_cache_free(fn_alias_kmem, fa);
-}
-
-static inline void alias_free_mem_rcu(struct fib_alias *fa)
-{
-	call_rcu(&fa->rcu, __alias_free_mem);
-}
-
-static void __leaf_free_rcu(struct rcu_head *head)
+static struct leaf *leaf_new(void)
 {
-	kfree(container_of(head, struct leaf, rcu));
+	struct leaf *l = kmalloc(sizeof(struct leaf),  GFP_KERNEL);
+	if (l) {
+		NODE_INIT_PARENT(l, T_LEAF);
+		INIT_HLIST_HEAD(&l->list);
+	}
+	return l;
 }
 
-static inline void free_leaf(struct leaf *leaf)
+static struct leaf_info *leaf_info_new(int plen)
 {
-	call_rcu(&leaf->rcu, __leaf_free_rcu);
+	struct leaf_info *li = kmalloc(sizeof(struct leaf_info),  GFP_KERNEL);
+	if (li) {
+		li->plen = plen;
+		INIT_LIST_HEAD(&li->falh);
+	}
+	return li;
 }
 
-static void __leaf_info_free_rcu(struct rcu_head *head)
+static inline void free_leaf(struct leaf *l)
 {
-	kfree(container_of(head, struct leaf_info, rcu));
+	kfree(l);
 }
 
-static inline void free_leaf_info(struct leaf_info *leaf)
+static inline void free_leaf_info(struct leaf_info *li)
 {
-	call_rcu(&leaf->rcu, __leaf_info_free_rcu);
+	kfree(li);
 }
 
 static struct tnode *tnode_alloc(unsigned int size)
 {
-	struct page *pages;
-
-	if (size <= PAGE_SIZE)
-		return kcalloc(size, 1, GFP_KERNEL);
-
-	pages = alloc_pages(GFP_KERNEL|__GFP_ZERO, get_order(size));
-	if (!pages)
-		return NULL;
-
-	return page_address(pages);
+	if (size <= PAGE_SIZE) {
+		return kmalloc(size, GFP_KERNEL);
+	} else {
+		return (struct tnode *)
+			__get_free_pages(GFP_KERNEL, get_order(size));
+	}
 }
 
-static void __tnode_free_rcu(struct rcu_head *head)
+static void __tnode_free(struct tnode *tn)
 {
-	struct tnode *tn = container_of(head, struct tnode, rcu);
 	unsigned int size = sizeof(struct tnode) +
-		(1 << tn->bits) * sizeof(struct node *);
+	                    (1<<tn->bits) * sizeof(struct node *);
 
 	if (size <= PAGE_SIZE)
 		kfree(tn);
@@ -346,40 +381,15 @@ static void __tnode_free_rcu(struct rcu_head *head)
 		free_pages((unsigned long)tn, get_order(size));
 }
 
-static inline void tnode_free(struct tnode *tn)
-{
-	call_rcu(&tn->rcu, __tnode_free_rcu);
-}
-
-static struct leaf *leaf_new(void)
-{
-	struct leaf *l = kmalloc(sizeof(struct leaf),  GFP_KERNEL);
-	if (l) {
-		l->parent = T_LEAF;
-		INIT_HLIST_HEAD(&l->list);
-	}
-	return l;
-}
-
-static struct leaf_info *leaf_info_new(int plen)
-{
-	struct leaf_info *li = kmalloc(sizeof(struct leaf_info),  GFP_KERNEL);
-	if (li) {
-		li->plen = plen;
-		INIT_LIST_HEAD(&li->falh);
-	}
-	return li;
-}
-
 static struct tnode* tnode_new(t_key key, int pos, int bits)
 {
 	int nchildren = 1<<bits;
 	int sz = sizeof(struct tnode) + nchildren * sizeof(struct node *);
 	struct tnode *tn = tnode_alloc(sz);
 
-	if (tn) {
+	if (tn)  {
 		memset(tn, 0, sz);
-		tn->parent = T_TNODE;
+		NODE_INIT_PARENT(tn, T_TNODE);
 		tn->pos = pos;
 		tn->bits = bits;
 		tn->key = key;
@@ -387,17 +397,38 @@ static struct tnode* tnode_new(t_key key, int pos, int bits)
 		tn->empty_children = 1<<bits;
 	}
 
-	pr_debug("AT %p s=%u %u\n", tn, (unsigned int) sizeof(struct tnode),
-		 (unsigned int) (sizeof(struct node) * 1<<bits));
+	if (trie_debug > 0)
+		printk("AT %p s=%u %u\n", tn, (unsigned int) sizeof(struct tnode),
+		       (unsigned int) (sizeof(struct node) * 1<<bits));
 	return tn;
 }
 
+static void tnode_free(struct tnode *tn)
+{
+	if (!tn) {
+		trie_bug("tnode_free\n");
+	}
+	if (IS_LEAF(tn)) {
+		free_leaf((struct leaf *)tn);
+		if (trie_debug > 0 )
+			printk("FL %p \n", tn);
+	}
+	else if (IS_TNODE(tn)) {
+		__tnode_free(tn);
+		if (trie_debug > 0 )
+			printk("FT %p \n", tn);
+	}
+	else {
+		trie_bug("tnode_free\n");
+	}
+}
+
 /*
  * Check whether a tnode 'n' is "full", i.e. it is an internal node
  * and no bits are skipped. See discussion in dyntree paper p. 6
  */
 
-static inline int tnode_full(const struct tnode *tn, const struct node *n)
+static inline int tnode_full(struct tnode *tn, struct node *n)
 {
 	if (n == NULL || IS_LEAF(n))
 		return 0;
@@ -417,11 +448,15 @@ static inline void put_child(struct trie *t, struct tnode *tn, int i, struct nod
 
 static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int wasfull)
 {
-	struct node *chi = tn->child[i];
+	struct node *chi;
 	int isfull;
 
-	BUG_ON(i >= 1<<tn->bits);
-
+	if (i >= 1<<tn->bits) {
+		printk("bits=%d, i=%d\n", tn->bits, i);
+		trie_bug("tnode_put_child_reorg bits");
+	}
+	write_lock_bh(&fib_lock);
+	chi = tn->child[i];
 
 	/* update emptyChildren */
 	if (n == NULL && chi != NULL)
@@ -430,32 +465,33 @@ static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int w
 		tn->empty_children--;
 
 	/* update fullChildren */
-	if (wasfull == -1)
+        if (wasfull == -1)
 		wasfull = tnode_full(tn, chi);
 
 	isfull = tnode_full(tn, n);
 	if (wasfull && !isfull)
 		tn->full_children--;
+
 	else if (!wasfull && isfull)
 		tn->full_children++;
-
 	if (n)
 		NODE_SET_PARENT(n, tn);
 
-	rcu_assign_pointer(tn->child[i], n);
+	tn->child[i] = n;
+	write_unlock_bh(&fib_lock);
 }
 
 static struct node *resize(struct trie *t, struct tnode *tn)
 {
 	int i;
 	int err = 0;
-	struct tnode *old_tn;
 
  	if (!tn)
 		return NULL;
 
-	pr_debug("In tnode_resize %p inflate_threshold=%d threshold=%d\n",
-		 tn, inflate_threshold, halve_threshold);
+	if (trie_debug)
+		printk("In tnode_resize %p inflate_threshold=%d threshold=%d\n",
+		      tn, inflate_threshold, halve_threshold);
 
 	/* No children */
 	if (tn->empty_children == tnode_child_length(tn)) {
@@ -465,16 +501,20 @@ static struct node *resize(struct trie *t, struct tnode *tn)
 	/* One child */
 	if (tn->empty_children == tnode_child_length(tn) - 1)
 		for (i = 0; i < tnode_child_length(tn); i++) {
-			struct node *n;
 
-			n = tn->child[i];
-			if (!n)
-				continue;
+			write_lock_bh(&fib_lock);
+			if (tn->child[i] != NULL) {
 
-			/* compress one level */
-			NODE_SET_PARENT(n, NULL);
-			tnode_free(tn);
-			return n;
+				/* compress one level */
+				struct node *n = tn->child[i];
+				if (n)
+					NODE_INIT_PARENT(n, NODE_TYPE(n));
+
+				write_unlock_bh(&fib_lock);
+				tnode_free(tn);
+				return n;
+			}
+			write_unlock_bh(&fib_lock);
 		}
 	/*
 	 * Double as long as the resulting node has a number of
@@ -526,16 +566,16 @@ static struct node *resize(struct trie *t, struct tnode *tn)
 	 *
 	 * expand not_to_be_doubled and to_be_doubled, and shorten:
 	 * 100 * (tnode_child_length(tn) - tn->empty_children +
-	 *    tn->full_children) >= inflate_threshold * new_child_length
+	 *    tn->full_children ) >= inflate_threshold * new_child_length
 	 *
 	 * expand new_child_length:
 	 * 100 * (tnode_child_length(tn) - tn->empty_children +
-	 *    tn->full_children) >=
+	 *    tn->full_children ) >=
 	 *      inflate_threshold * tnode_child_length(tn) * 2
 	 *
 	 * shorten again:
 	 * 50 * (tn->full_children + tnode_child_length(tn) -
-	 *    tn->empty_children) >= inflate_threshold *
+	 *    tn->empty_children ) >= inflate_threshold *
 	 *    tnode_child_length(tn)
 	 *
 	 */
@@ -547,10 +587,9 @@ static struct node *resize(struct trie *t, struct tnode *tn)
 	       50 * (tn->full_children + tnode_child_length(tn) - tn->empty_children) >=
 				inflate_threshold * tnode_child_length(tn))) {
 
-		old_tn = tn;
-		tn = inflate(t, tn);
-		if (IS_ERR(tn)) {
-			tn = old_tn;
+		tn = inflate(t, tn, &err);
+
+		if (err) {
 #ifdef CONFIG_IP_FIB_TRIE_STATS
 			t->stats.resize_node_skipped++;
 #endif
@@ -570,10 +609,9 @@ static struct node *resize(struct trie *t, struct tnode *tn)
 	       100 * (tnode_child_length(tn) - tn->empty_children) <
 	       halve_threshold * tnode_child_length(tn)) {
 
-		old_tn = tn;
-		tn = halve(t, tn);
-		if (IS_ERR(tn)) {
-			tn = old_tn;
+		tn = halve(t, tn, &err);
+
+		if (err) {
 #ifdef CONFIG_IP_FIB_TRIE_STATS
 			t->stats.resize_node_skipped++;
 #endif
@@ -583,37 +621,44 @@ static struct node *resize(struct trie *t, struct tnode *tn)
 
 
 	/* Only one child remains */
+
 	if (tn->empty_children == tnode_child_length(tn) - 1)
 		for (i = 0; i < tnode_child_length(tn); i++) {
-			struct node *n;
-
-			n = tn->child[i];
-			if (!n)
-				continue;
-
-			/* compress one level */
-
-			NODE_SET_PARENT(n, NULL);
-			tnode_free(tn);
-			return n;
+		
+			write_lock_bh(&fib_lock);
+			if (tn->child[i] != NULL) {
+				/* compress one level */
+				struct node *n = tn->child[i];
+
+				if (n)
+					NODE_INIT_PARENT(n, NODE_TYPE(n));
+
+				write_unlock_bh(&fib_lock);
+				tnode_free(tn);
+				return n;
+			}
+			write_unlock_bh(&fib_lock);
 		}
 
 	return (struct node *) tn;
 }
 
-static struct tnode *inflate(struct trie *t, struct tnode *tn)
+static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err)
 {
 	struct tnode *inode;
 	struct tnode *oldtnode = tn;
 	int olen = tnode_child_length(tn);
 	int i;
 
-	pr_debug("In inflate\n");
+  	if (trie_debug)
+		printk("In inflate\n");
 
 	tn = tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits + 1);
 
-	if (!tn)
-		return ERR_PTR(-ENOMEM);
+	if (!tn) {
+		*err = -ENOMEM;
+		return oldtnode;
+	}
 
 	/*
 	 * Preallocate and store tnodes before the actual work so we
@@ -621,8 +666,8 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn)
 	 * fails. In case of failure we return the oldnode and  inflate
 	 * of tnode is ignored.
 	 */
-
-	for (i = 0; i < olen; i++) {
+		
+	for(i = 0; i < olen; i++) {
 		struct tnode *inode = (struct tnode *) tnode_get_child(oldtnode, i);
 
 		if (inode &&
@@ -630,30 +675,46 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn)
 		    inode->pos == oldtnode->pos + oldtnode->bits &&
 		    inode->bits > 1) {
 			struct tnode *left, *right;
+
 			t_key m = TKEY_GET_MASK(inode->pos, 1);
 
 			left = tnode_new(inode->key&(~m), inode->pos + 1,
 					 inode->bits - 1);
-			if (!left)
-				goto nomem;
 
+			if (!left) {
+				*err = -ENOMEM;
+				break;
+			}
+		
 			right = tnode_new(inode->key|m, inode->pos + 1,
 					  inode->bits - 1);
 
-                        if (!right) {
-				tnode_free(left);
-				goto nomem;
-                        }
+			if (!right) {
+				*err = -ENOMEM;
+				break;
+			}
 
 			put_child(t, tn, 2*i, (struct node *) left);
 			put_child(t, tn, 2*i+1, (struct node *) right);
 		}
 	}
 
-	for (i = 0; i < olen; i++) {
+	if (*err) {
+		int size = tnode_child_length(tn);
+		int j;
+
+		for(j = 0; j < size; j++)
+			if (tn->child[j])
+				tnode_free((struct tnode *)tn->child[j]);
+
+		tnode_free(tn);
+	
+		*err = -ENOMEM;
+		return oldtnode;
+	}
+
+	for(i = 0; i < olen; i++) {
 		struct node *node = tnode_get_child(oldtnode, i);
-		struct tnode *left, *right;
-		int size, j;
 
 		/* An empty child */
 		if (node == NULL)
@@ -679,82 +740,76 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn)
 			put_child(t, tn, 2*i+1, inode->child[1]);
 
 			tnode_free(inode);
-			continue;
 		}
 
-		/* An internal node with more than two children */
-
-		/* We will replace this node 'inode' with two new
-		 * ones, 'left' and 'right', each with half of the
-		 * original children. The two new nodes will have
-		 * a position one bit further down the key and this
-		 * means that the "significant" part of their keys
-		 * (see the discussion near the top of this file)
-		 * will differ by one bit, which will be "0" in
-		 * left's key and "1" in right's key. Since we are
-		 * moving the key position by one step, the bit that
-		 * we are moving away from - the bit at position
-		 * (inode->pos) - is the one that will differ between
-		 * left and right. So... we synthesize that bit in the
-		 * two  new keys.
-		 * The mask 'm' below will be a single "one" bit at
-		 * the position (inode->pos)
-		 */
+			/* An internal node with more than two children */
+		else {
+			struct tnode *left, *right;
+			int size, j;
+
+			/* We will replace this node 'inode' with two new
+			 * ones, 'left' and 'right', each with half of the
+			 * original children. The two new nodes will have
+			 * a position one bit further down the key and this
+			 * means that the "significant" part of their keys
+			 * (see the discussion near the top of this file)
+			 * will differ by one bit, which will be "0" in
+			 * left's key and "1" in right's key. Since we are
+			 * moving the key position by one step, the bit that
+			 * we are moving away from - the bit at position
+			 * (inode->pos) - is the one that will differ between
+			 * left and right. So... we synthesize that bit in the
+			 * two  new keys.
+			 * The mask 'm' below will be a single "one" bit at
+			 * the position (inode->pos)
+			 */
 
-		/* Use the old key, but set the new significant
-		 *   bit to zero.
-		 */
+			/* Use the old key, but set the new significant
+			 *   bit to zero.
+			 */
 
-		left = (struct tnode *) tnode_get_child(tn, 2*i);
-		put_child(t, tn, 2*i, NULL);
+			left = (struct tnode *) tnode_get_child(tn, 2*i);
+			put_child(t, tn, 2*i, NULL);
 
-		BUG_ON(!left);
+			if (!left)
+				BUG();
 
-		right = (struct tnode *) tnode_get_child(tn, 2*i+1);
-		put_child(t, tn, 2*i+1, NULL);
+			right = (struct tnode *) tnode_get_child(tn, 2*i+1);
+			put_child(t, tn, 2*i+1, NULL);
 
-		BUG_ON(!right);
+			if (!right)
+				BUG();
 
-		size = tnode_child_length(left);
-		for (j = 0; j < size; j++) {
-			put_child(t, left, j, inode->child[j]);
-			put_child(t, right, j, inode->child[j + size]);
-		}
-		put_child(t, tn, 2*i, resize(t, left));
-		put_child(t, tn, 2*i+1, resize(t, right));
+			size = tnode_child_length(left);
+			for(j = 0; j < size; j++) {
+				put_child(t, left, j, inode->child[j]);
+				put_child(t, right, j, inode->child[j + size]);
+			}
+			put_child(t, tn, 2*i, resize(t, left));
+			put_child(t, tn, 2*i+1, resize(t, right));
 
-		tnode_free(inode);
+			tnode_free(inode);
+		}
 	}
 	tnode_free(oldtnode);
 	return tn;
-nomem:
-	{
-		int size = tnode_child_length(tn);
-		int j;
-
-		for (j = 0; j < size; j++)
-			if (tn->child[j])
-				tnode_free((struct tnode *)tn->child[j]);
-
-		tnode_free(tn);
-
-		return ERR_PTR(-ENOMEM);
-	}
 }
 
-static struct tnode *halve(struct trie *t, struct tnode *tn)
+static struct tnode *halve(struct trie *t, struct tnode *tn, int *err)
 {
 	struct tnode *oldtnode = tn;
 	struct node *left, *right;
 	int i;
 	int olen = tnode_child_length(tn);
 
-	pr_debug("In halve\n");
+	if (trie_debug) printk("In halve\n");
 
 	tn = tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits - 1);
 
-	if (!tn)
-		return ERR_PTR(-ENOMEM);
+	if (!tn) {
+		*err = -ENOMEM;
+		return oldtnode;
+	}
 
 	/*
 	 * Preallocate and store tnodes before the actual work so we
@@ -763,27 +818,38 @@ static struct tnode *halve(struct trie *t, struct tnode *tn)
 	 * of tnode is ignored.
 	 */
 
-	for (i = 0; i < olen; i += 2) {
+	for(i = 0; i < olen; i += 2) {
 		left = tnode_get_child(oldtnode, i);
 		right = tnode_get_child(oldtnode, i+1);
 
 		/* Two nonempty children */
-		if (left && right) {
-			struct tnode *newn;
+		if (left && right)  {
+			struct tnode *newBinNode =
+				tnode_new(left->key, tn->pos + tn->bits, 1);
 
-			newn = tnode_new(left->key, tn->pos + tn->bits, 1);
+			if (!newBinNode) {
+				*err = -ENOMEM;
+				break;
+			}
+			put_child(t, tn, i/2, (struct node *)newBinNode);
+		}
+	}
 
-			if (!newn)
-				goto nomem;
+	if (*err) {
+		int size = tnode_child_length(tn);
+		int j;
 
-			put_child(t, tn, i/2, (struct node *)newn);
-		}
+		for(j = 0; j < size; j++)
+			if (tn->child[j])
+				tnode_free((struct tnode *)tn->child[j]);
 
+		tnode_free(tn);
+	
+		*err = -ENOMEM;
+		return oldtnode;
 	}
 
-	for (i = 0; i < olen; i += 2) {
-		struct tnode *newBinNode;
-
+	for(i = 0; i < olen; i += 2) {
 		left = tnode_get_child(oldtnode, i);
 		right = tnode_get_child(oldtnode, i+1);
 
@@ -792,98 +858,87 @@ static struct tnode *halve(struct trie *t, struct tnode *tn)
 			if (right == NULL)    /* Both are empty */
 				continue;
 			put_child(t, tn, i/2, right);
-			continue;
-		}
-
-		if (right == NULL) {
+		} else if (right == NULL)
 			put_child(t, tn, i/2, left);
-			continue;
-		}
 
 		/* Two nonempty children */
-		newBinNode = (struct tnode *) tnode_get_child(tn, i/2);
-		put_child(t, tn, i/2, NULL);
-		put_child(t, newBinNode, 0, left);
-		put_child(t, newBinNode, 1, right);
-		put_child(t, tn, i/2, resize(t, newBinNode));
-	}
-	tnode_free(oldtnode);
-	return tn;
-nomem:
-	{
-		int size = tnode_child_length(tn);
-		int j;
-
-		for (j = 0; j < size; j++)
-			if (tn->child[j])
-				tnode_free((struct tnode *)tn->child[j]);
+		else {
+			struct tnode *newBinNode =
+				(struct tnode *) tnode_get_child(tn, i/2);
+			put_child(t, tn, i/2, NULL);
 
-		tnode_free(tn);
+			if (!newBinNode)
+				BUG();
 
-		return ERR_PTR(-ENOMEM);
+			put_child(t, newBinNode, 0, left);
+			put_child(t, newBinNode, 1, right);
+			put_child(t, tn, i/2, resize(t, newBinNode));
+		}
 	}
+	tnode_free(oldtnode);
+	return tn;
 }
 
-static void trie_init(struct trie *t)
+static void *trie_init(struct trie *t)
 {
-	if (!t)
-		return;
-
-	t->size = 0;
-	rcu_assign_pointer(t->trie, NULL);
-	t->revision = 0;
+	if (t) {
+		t->size = 0;
+		t->trie = NULL;
+		t->revision = 0;
 #ifdef CONFIG_IP_FIB_TRIE_STATS
-	memset(&t->stats, 0, sizeof(struct trie_use_stats));
+       		memset(&t->stats, 0, sizeof(struct trie_use_stats));
 #endif
+	}
+	return t;
 }
 
-/* readside most use rcu_read_lock currently dump routines
- via get_fa_head and dump */
-
 static struct leaf_info *find_leaf_info(struct hlist_head *head, int plen)
 {
 	struct hlist_node *node;
 	struct leaf_info *li;
 
-	hlist_for_each_entry_rcu(li, node, head, hlist)
+	hlist_for_each_entry(li, node, head, hlist) {
 		if (li->plen == plen)
 			return li;
-
+	}
 	return NULL;
 }
 
 static inline struct list_head * get_fa_head(struct leaf *l, int plen)
 {
+	struct list_head *fa_head = NULL;
 	struct leaf_info *li = find_leaf_info(&l->list, plen);
 
-	if (!li)
-		return NULL;
+	if (li)
+		fa_head = &li->falh;
 
-	return &li->falh;
+	return fa_head;
 }
 
 static void insert_leaf_info(struct hlist_head *head, struct leaf_info *new)
 {
-        struct leaf_info *li = NULL, *last = NULL;
-        struct hlist_node *node;
-
-        if (hlist_empty(head)) {
-                hlist_add_head_rcu(&new->hlist, head);
-        } else {
-                hlist_for_each_entry(li, node, head, hlist) {
-                        if (new->plen > li->plen)
-                                break;
-
-                        last = li;
-                }
-                if (last)
-                        hlist_add_after_rcu(&last->hlist, &new->hlist);
-                else
-                        hlist_add_before_rcu(&new->hlist, &li->hlist);
-        }
-}
+	struct leaf_info *li = NULL, *last = NULL;
+	struct hlist_node *node, *tmp;
 
-/* rcu_read_lock needs to be hold by caller from readside */
+	write_lock_bh(&fib_lock);
+
+	if (hlist_empty(head))
+		hlist_add_head(&new->hlist, head);
+	else {
+		hlist_for_each_entry_safe(li, node, tmp, head, hlist) {
+		
+			if (new->plen > li->plen)
+				break;
+		
+			last = li;
+		}
+		if (last)
+			hlist_add_after(&last->hlist, &new->hlist);
+		else
+			hlist_add_before(&new->hlist, &li->hlist);
+	}
+	write_unlock_bh(&fib_lock);
+}
 
 static struct leaf *
 fib_find_node(struct trie *t, u32 key)
@@ -893,43 +948,61 @@ fib_find_node(struct trie *t, u32 key)
 	struct node *n;
 
 	pos = 0;
-	n = rcu_dereference(t->trie);
+	n = t->trie;
 
 	while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
 		tn = (struct tnode *) n;
-
+		
 		check_tnode(tn);
-
+		
 		if (tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
-			pos = tn->pos + tn->bits;
+			pos=tn->pos + tn->bits;
 			n = tnode_get_child(tn, tkey_extract_bits(key, tn->pos, tn->bits));
-		} else
+		}
+		else
 			break;
 	}
 	/* Case we have found a leaf. Compare prefixes */
 
-	if (n != NULL && IS_LEAF(n) && tkey_equals(key, n->key))
-		return (struct leaf *)n;
-
+	if (n != NULL && IS_LEAF(n) && tkey_equals(key, n->key)) {
+		struct leaf *l = (struct leaf *) n;
+		return l;
+	}
 	return NULL;
 }
 
 static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
 {
+	int i = 0;
 	int wasfull;
 	t_key cindex, key;
 	struct tnode *tp = NULL;
 
+	if (!tn)
+		BUG();
+
 	key = tn->key;
+	i = 0;
 
 	while (tn != NULL && NODE_PARENT(tn) != NULL) {
 
+		if (i > 10) {
+			printk("Rebalance tn=%p \n", tn);
+			if (tn) 		printk("tn->parent=%p \n", NODE_PARENT(tn));
+		
+			printk("Rebalance tp=%p \n", tp);
+			if (tp) 		printk("tp->parent=%p \n", NODE_PARENT(tp));
+		}
+
+		if (i > 12) BUG();
+		i++;
+
 		tp = NODE_PARENT(tn);
 		cindex = tkey_extract_bits(key, tp->pos, tp->bits);
 		wasfull = tnode_full(tp, tnode_get_child(tp, cindex));
 		tn = (struct tnode *) resize (t, (struct tnode *)tn);
 		tnode_put_child_reorg((struct tnode *)tp, cindex,(struct node*)tn, wasfull);
-
+	
 		if (!NODE_PARENT(tn))
 			break;
 
@@ -942,8 +1015,6 @@ static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
 	return (struct node*) tn;
 }
 
-/* only used from updater-side */
-
 static  struct list_head *
 fib_insert_node(struct trie *t, int *err, u32 key, int plen)
 {
@@ -979,16 +1050,20 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
 
 	while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
 		tn = (struct tnode *) n;
-
+		
 		check_tnode(tn);
-
+	
 		if (tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
 			tp = tn;
-			pos = tn->pos + tn->bits;
+			pos=tn->pos + tn->bits;
 			n = tnode_get_child(tn, tkey_extract_bits(key, tn->pos, tn->bits));
 
-			BUG_ON(n && NODE_PARENT(n) != tn);
-		} else
+			if (n && NODE_PARENT(n) != tn) {
+				printk("BUG tn=%p, n->parent=%p\n", tn, NODE_PARENT(n));
+				BUG();
+			}
+		}
+		else
 			break;
 	}
 
@@ -998,15 +1073,17 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
 	 * tp is n's (parent) ----> NULL or TNODE
 	 */
 
-	BUG_ON(tp && IS_LEAF(tp));
+	if (tp && IS_LEAF(tp))
+		BUG();
+
 
 	/* Case 1: n is a leaf. Compare prefixes */
 
 	if (n != NULL && IS_LEAF(n) && tkey_equals(key, n->key)) {
-		struct leaf *l = (struct leaf *) n;
-
+		struct leaf *l = ( struct leaf *)  n;
+	
 		li = leaf_info_new(plen);
-
+	
 		if (!li) {
 			*err = -ENOMEM;
 			goto err;
@@ -1036,29 +1113,35 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
 	fa_head = &li->falh;
 	insert_leaf_info(&l->list, li);
 
+	/* Case 2: n is NULL, and will just insert a new leaf */
 	if (t->trie && n == NULL) {
-		/* Case 2: n is NULL, and will just insert a new leaf */
 
 		NODE_SET_PARENT(l, tp);
+	
+		if (!tp)
+			BUG();
 
-		cindex = tkey_extract_bits(key, tp->pos, tp->bits);
-		put_child(t, (struct tnode *)tp, cindex, (struct node *)l);
-	} else {
-		/* Case 3: n is a LEAF or a TNODE and the key doesn't match. */
+		else {
+			cindex = tkey_extract_bits(key, tp->pos, tp->bits);
+			put_child(t, (struct tnode *)tp, cindex, (struct node *)l);
+		}
+	}
+	/* Case 3: n is a LEAF or a TNODE and the key doesn't match. */
+	else {
 		/*
 		 *  Add a new tnode here
 		 *  first tnode need some special handling
 		 */
 
 		if (tp)
-			pos = tp->pos+tp->bits;
+			pos=tp->pos+tp->bits;
 		else
-			pos = 0;
-
+			pos=0;
 		if (n) {
 			newpos = tkey_mismatch(key, pos, n->key);
 			tn = tnode_new(n->key, newpos, 1);
-		} else {
+		}
+		else {
 			newpos = 0;
 			tn = tnode_new(key, newpos, 1); /* First tnode */
 		}
@@ -1068,33 +1151,32 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
 			tnode_free((struct tnode *) l);
 			*err = -ENOMEM;
 			goto err;
-		}
-
+		}		
+		
 		NODE_SET_PARENT(tn, tp);
 
-		missbit = tkey_extract_bits(key, newpos, 1);
+		missbit=tkey_extract_bits(key, newpos, 1);
 		put_child(t, tn, missbit, (struct node *)l);
 		put_child(t, tn, 1-missbit, n);
 
 		if (tp) {
 			cindex = tkey_extract_bits(key, tp->pos, tp->bits);
 			put_child(t, (struct tnode *)tp, cindex, (struct node *)tn);
-		} else {
-			rcu_assign_pointer(t->trie, (struct node *)tn); /* First tnode */
+		}
+		else {
+			t->trie = (struct node*) tn; /* First tnode */
 			tp = tn;
 		}
 	}
-
-	if (tp && tp->pos + tp->bits > 32)
+	if (tp && tp->pos+tp->bits > 32) {
 		printk("ERROR tp=%p pos=%d, bits=%d, key=%0x plen=%d\n",
 		       tp, tp->pos, tp->bits, key, plen);
-
+	}
 	/* Rebalance the trie */
-
-	rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
+	t->trie = trie_rebalance(t, tp);
 done:
 	t->revision++;
-err:
+err:;
 	return fa_head;
 }
 
@@ -1122,18 +1204,17 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 
 	key = ntohl(key);
 
-	pr_debug("Insert table=%d %08x/%d\n", tb->tb_id, key, plen);
+	if (trie_debug)
+		printk("Insert table=%d %08x/%d\n", tb->tb_id, key, plen);
 
-	mask = ntohl(inet_make_mask(plen));
+	mask = ntohl( inet_make_mask(plen) );
 
 	if (key & ~mask)
 		return -EINVAL;
 
 	key = key & mask;
 
-	fi = fib_create_info(r, rta, nlhdr, &err);
-
-	if (!fi)
+	if  ((fi = fib_create_info(r, rta, nlhdr, &err)) == NULL)
 		goto err;
 
 	l = fib_find_node(t, key);
@@ -1155,7 +1236,8 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 	 * and we need to allocate a new one of those as well.
 	 */
 
-	if (fa && fa->fa_info->fib_priority == fi->fib_priority) {
+	if (fa &&
+	    fa->fa_info->fib_priority == fi->fib_priority) {
 		struct fib_alias *fa_orig;
 
 		err = -EEXIST;
@@ -1166,27 +1248,22 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 			struct fib_info *fi_drop;
 			u8 state;
 
-			err = -ENOBUFS;
-			new_fa = kmem_cache_alloc(fn_alias_kmem, SLAB_KERNEL);
-			if (new_fa == NULL)
-				goto out;
+			write_lock_bh(&fib_lock);
 
 			fi_drop = fa->fa_info;
-			new_fa->fa_tos = fa->fa_tos;
-			new_fa->fa_info = fi;
-			new_fa->fa_type = type;
-			new_fa->fa_scope = r->rtm_scope;
+			fa->fa_info = fi;
+			fa->fa_type = type;
+			fa->fa_scope = r->rtm_scope;
 			state = fa->fa_state;
-			new_fa->fa_state &= ~FA_S_ACCESSED;
+			fa->fa_state &= ~FA_S_ACCESSED;
 
-			list_replace_rcu(&fa->fa_list, &new_fa->fa_list);
-			alias_free_mem_rcu(fa);
+			write_unlock_bh(&fib_lock);
 
 			fib_release_info(fi_drop);
 			if (state & FA_S_ACCESSED)
-				rt_cache_flush(-1);
+			  rt_cache_flush(-1);
 
-			goto succeeded;
+			    goto succeeded;
 		}
 		/* Error if we find a perfect match which
 		 * uses the same scope, type, and nexthop
@@ -1208,7 +1285,7 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 			fa = fa_orig;
 	}
 	err = -ENOENT;
-	if (!(nlhdr->nlmsg_flags & NLM_F_CREATE))
+	if (!(nlhdr->nlmsg_flags&NLM_F_CREATE))
 		goto out;
 
 	err = -ENOBUFS;
@@ -1221,6 +1298,9 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 	new_fa->fa_type = type;
 	new_fa->fa_scope = r->rtm_scope;
 	new_fa->fa_state = 0;
+#if 0
+	new_fa->dst = NULL;
+#endif
 	/*
 	 * Insert new entry to the list.
 	 */
@@ -1232,8 +1312,12 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 			goto out_free_new_fa;
 	}
 
-	list_add_tail_rcu(&new_fa->fa_list,
-			  (fa ? &fa->fa_list : fa_head));
+	write_lock_bh(&fib_lock);
+
+	list_add_tail(&new_fa->fa_list,
+		 (fa ? &fa->fa_list : fa_head));
+
+	write_unlock_bh(&fib_lock);
 
 	rt_cache_flush(-1);
 	rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen, tb->tb_id, nlhdr, req);
@@ -1244,14 +1328,11 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 	kmem_cache_free(fn_alias_kmem, new_fa);
 out:
 	fib_release_info(fi);
-err:
+err:;
 	return err;
 }
 
-
-/* should be clalled with rcu_read_lock */
-static inline int check_leaf(struct trie *t, struct leaf *l,
-			     t_key key, int *plen, const struct flowi *flp,
+static inline int check_leaf(struct trie *t, struct leaf *l,  t_key key, int *plen, const struct flowi *flp,
 			     struct fib_result *res)
 {
 	int err, i;
@@ -1260,7 +1341,8 @@ static inline int check_leaf(struct trie *t, struct leaf *l,
 	struct hlist_head *hhead = &l->list;
 	struct hlist_node *node;
 
-	hlist_for_each_entry_rcu(li, node, hhead, hlist) {
+	hlist_for_each_entry(li, node, hhead, hlist) {
+
 		i = li->plen;
 		mask = ntohl(inet_make_mask(i));
 		if (l->key != (key & mask))
@@ -1288,17 +1370,13 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
 	struct node *n;
 	struct tnode *pn;
 	int pos, bits;
-	t_key key = ntohl(flp->fl4_dst);
+	t_key key=ntohl(flp->fl4_dst);
 	int chopped_off;
 	t_key cindex = 0;
 	int current_prefix_length = KEYLENGTH;
-	struct tnode *cn;
-	t_key node_prefix, key_prefix, pref_mismatch;
-	int mp;
-
-	rcu_read_lock();
+	n = t->trie;
 
-	n = rcu_dereference(t->trie);
+	read_lock(&fib_lock);
 	if (!n)
 		goto failed;
 
@@ -1315,7 +1393,8 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
 	pn = (struct tnode *) n;
 	chopped_off = 0;
 
-	while (pn) {
+        while (pn) {
+
 		pos = pn->pos;
 		bits = pn->bits;
 
@@ -1331,129 +1410,130 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
 			goto backtrace;
 		}
 
-		if (IS_LEAF(n)) {
-			if ((ret = check_leaf(t, (struct leaf *)n, key, &plen, flp, res)) <= 0)
-				goto found;
-			else
-				goto backtrace;
-		}
-
+		if (IS_TNODE(n)) {
 #define HL_OPTIMIZE
 #ifdef HL_OPTIMIZE
-		cn = (struct tnode *)n;
+			struct tnode *cn = (struct tnode *)n;
+			t_key node_prefix, key_prefix, pref_mismatch;
+			int mp;
 
-		/*
-		 * It's a tnode, and we can do some extra checks here if we
-		 * like, to avoid descending into a dead-end branch.
-		 * This tnode is in the parent's child array at index
-		 * key[p_pos..p_pos+p_bits] but potentially with some bits
-		 * chopped off, so in reality the index may be just a
-		 * subprefix, padded with zero at the end.
-		 * We can also take a look at any skipped bits in this
-		 * tnode - everything up to p_pos is supposed to be ok,
-		 * and the non-chopped bits of the index (se previous
-		 * paragraph) are also guaranteed ok, but the rest is
-		 * considered unknown.
-		 *
-		 * The skipped bits are key[pos+bits..cn->pos].
-		 */
-
-		/* If current_prefix_length < pos+bits, we are already doing
-		 * actual prefix  matching, which means everything from
-		 * pos+(bits-chopped_off) onward must be zero along some
-		 * branch of this subtree - otherwise there is *no* valid
-		 * prefix present. Here we can only check the skipped
-		 * bits. Remember, since we have already indexed into the
-		 * parent's child array, we know that the bits we chopped of
-		 * *are* zero.
-		 */
-
-		/* NOTA BENE: CHECKING ONLY SKIPPED BITS FOR THE NEW NODE HERE */
-
-		if (current_prefix_length < pos+bits) {
-			if (tkey_extract_bits(cn->key, current_prefix_length,
-						cn->pos - current_prefix_length) != 0 ||
-			    !(cn->child[0]))
-				goto backtrace;
-		}
-
-		/*
-		 * If chopped_off=0, the index is fully validated and we
-		 * only need to look at the skipped bits for this, the new,
-		 * tnode. What we actually want to do is to find out if
-		 * these skipped bits match our key perfectly, or if we will
-		 * have to count on finding a matching prefix further down,
-		 * because if we do, we would like to have some way of
-		 * verifying the existence of such a prefix at this point.
-		 */
+			/*
+			 * It's a tnode, and we can do some extra checks here if we
+			 * like, to avoid descending into a dead-end branch.
+			 * This tnode is in the parent's child array at index
+			 * key[p_pos..p_pos+p_bits] but potentially with some bits
+			 * chopped off, so in reality the index may be just a
+			 * subprefix, padded with zero at the end.
+			 * We can also take a look at any skipped bits in this
+			 * tnode - everything up to p_pos is supposed to be ok,
+			 * and the non-chopped bits of the index (se previous
+			 * paragraph) are also guaranteed ok, but the rest is
+			 * considered unknown.
+			 *
+			 * The skipped bits are key[pos+bits..cn->pos].
+			 */
+		
+			/* If current_prefix_length < pos+bits, we are already doing
+			 * actual prefix  matching, which means everything from
+			 * pos+(bits-chopped_off) onward must be zero along some
+			 * branch of this subtree - otherwise there is *no* valid
+			 * prefix present. Here we can only check the skipped
+			 * bits. Remember, since we have already indexed into the
+			 * parent's child array, we know that the bits we chopped of
+			 * *are* zero.
+			 */
 
-		/* The only thing we can do at this point is to verify that
-		 * any such matching prefix can indeed be a prefix to our
-		 * key, and if the bits in the node we are inspecting that
-		 * do not match our key are not ZERO, this cannot be true.
-		 * Thus, find out where there is a mismatch (before cn->pos)
-		 * and verify that all the mismatching bits are zero in the
-		 * new tnode's key.
-		 */
+			/* NOTA BENE: CHECKING ONLY SKIPPED BITS FOR THE NEW NODE HERE */
+		
+			if (current_prefix_length < pos+bits) {
+				if (tkey_extract_bits(cn->key, current_prefix_length,
+						      cn->pos - current_prefix_length) != 0 ||
+				    !(cn->child[0]))
+					goto backtrace;
+			}
 
-		/* Note: We aren't very concerned about the piece of the key
-		 * that precede pn->pos+pn->bits, since these have already been
-		 * checked. The bits after cn->pos aren't checked since these are
-		 * by definition "unknown" at this point. Thus, what we want to
-		 * see is if we are about to enter the "prefix matching" state,
-		 * and in that case verify that the skipped bits that will prevail
-		 * throughout this subtree are zero, as they have to be if we are
-		 * to find a matching prefix.
-		 */
+			/*
+			 * If chopped_off=0, the index is fully validated and we
+			 * only need to look at the skipped bits for this, the new,
+			 * tnode. What we actually want to do is to find out if
+			 * these skipped bits match our key perfectly, or if we will
+			 * have to count on finding a matching prefix further down,
+			 * because if we do, we would like to have some way of
+			 * verifying the existence of such a prefix at this point.
+			 */
 
-		node_prefix = MASK_PFX(cn->key, cn->pos);
-		key_prefix = MASK_PFX(key, cn->pos);
-		pref_mismatch = key_prefix^node_prefix;
-		mp = 0;
+			/* The only thing we can do at this point is to verify that
+			 * any such matching prefix can indeed be a prefix to our
+			 * key, and if the bits in the node we are inspecting that
+			 * do not match our key are not ZERO, this cannot be true.
+			 * Thus, find out where there is a mismatch (before cn->pos)
+			 * and verify that all the mismatching bits are zero in the
+			 * new tnode's key.
+			 */
 
-		/* In short: If skipped bits in this node do not match the search
-		 * key, enter the "prefix matching" state.directly.
-		 */
-		if (pref_mismatch) {
-			while (!(pref_mismatch & (1<<(KEYLENGTH-1)))) {
-				mp++;
-				pref_mismatch = pref_mismatch <<1;
-			}
-			key_prefix = tkey_extract_bits(cn->key, mp, cn->pos-mp);
+			/* Note: We aren't very concerned about the piece of the key
+			 * that precede pn->pos+pn->bits, since these have already been
+			 * checked. The bits after cn->pos aren't checked since these are
+			 * by definition "unknown" at this point. Thus, what we want to
+			 * see is if we are about to enter the "prefix matching" state,
+			 * and in that case verify that the skipped bits that will prevail
+			 * throughout this subtree are zero, as they have to be if we are
+			 * to find a matching prefix.
+			 */
 
-			if (key_prefix != 0)
-				goto backtrace;
+			node_prefix = MASK_PFX(cn->key, cn->pos);
+			key_prefix = MASK_PFX(key, cn->pos);
+			pref_mismatch = key_prefix^node_prefix;
+			mp = 0;
 
-			if (current_prefix_length >= cn->pos)
-				current_prefix_length = mp;
-		}
+			/* In short: If skipped bits in this node do not match the search
+			 * key, enter the "prefix matching" state.directly.
+			 */
+			if (pref_mismatch) {
+				while (!(pref_mismatch & (1<<(KEYLENGTH-1)))) {
+					mp++;
+					pref_mismatch = pref_mismatch <<1;
+				}
+				key_prefix = tkey_extract_bits(cn->key, mp, cn->pos-mp);
+			
+				if (key_prefix != 0)
+					goto backtrace;
+
+				if (current_prefix_length >= cn->pos)
+					current_prefix_length=mp;
+		       }
 #endif
-		pn = (struct tnode *)n; /* Descend */
-		chopped_off = 0;
-		continue;
-
+		       pn = (struct tnode *)n; /* Descend */
+		       chopped_off = 0;
+		       continue;
+		}
+		if (IS_LEAF(n)) {
+			if ((ret = check_leaf(t, (struct leaf *)n, key, &plen, flp, res)) <= 0)
+				goto found;
+	       }
 backtrace:
 		chopped_off++;
 
 		/* As zero don't change the child key (cindex) */
-		while ((chopped_off <= pn->bits) && !(cindex & (1<<(chopped_off-1))))
+		while ((chopped_off <= pn->bits) && !(cindex & (1<<(chopped_off-1)))) {
 			chopped_off++;
+		}
 
 		/* Decrease current_... with bits chopped off */
 		if (current_prefix_length > pn->pos + pn->bits - chopped_off)
 			current_prefix_length = pn->pos + pn->bits - chopped_off;
-
+	
 		/*
 		 * Either we do the actual chop off according or if we have
 		 * chopped off all bits in this tnode walk up to our parent.
 		 */
 
-		if (chopped_off <= pn->bits) {
+		if (chopped_off <= pn->bits)
 			cindex &= ~(1 << (chopped_off-1));
-		} else {
+		else {
 			if (NODE_PARENT(pn) == NULL)
 				goto failed;
-
+		
 			/* Get Child's index */
 			cindex = tkey_extract_bits(pn->key, NODE_PARENT(pn)->pos, NODE_PARENT(pn)->bits);
 			pn = NODE_PARENT(pn);
@@ -1468,11 +1548,10 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
 failed:
 	ret = 1;
 found:
-	rcu_read_unlock();
+	read_unlock(&fib_lock);
 	return ret;
 }
 
-/* only called from updater side */
 static int trie_leaf_remove(struct trie *t, t_key key)
 {
 	t_key cindex;
@@ -1480,20 +1559,24 @@ static int trie_leaf_remove(struct trie *t, t_key key)
 	struct node *n = t->trie;
 	struct leaf *l;
 
-	pr_debug("entering trie_leaf_remove(%p)\n", n);
+	if (trie_debug)
+		printk("entering trie_leaf_remove(%p)\n", n);
 
 	/* Note that in the case skipped bits, those bits are *not* checked!
 	 * When we finish this, we will have NULL or a T_LEAF, and the
 	 * T_LEAF may or may not match our key.
 	 */
 
-	while (n != NULL && IS_TNODE(n)) {
+        while (n != NULL && IS_TNODE(n)) {
 		struct tnode *tn = (struct tnode *) n;
 		check_tnode(tn);
 		n = tnode_get_child(tn ,tkey_extract_bits(key, tn->pos, tn->bits));
 
-		BUG_ON(n && NODE_PARENT(n) != tn);
-	}
+			if (n && NODE_PARENT(n) != tn) {
+				printk("BUG tn=%p, n->parent=%p\n", tn, NODE_PARENT(n));
+				BUG();
+			}
+        }
 	l = (struct leaf *) n;
 
 	if (!n || !tkey_equals(l->key, key))
@@ -1507,24 +1590,23 @@ static int trie_leaf_remove(struct trie *t, t_key key)
 	t->revision++;
 	t->size--;
 
-	preempt_disable();
 	tp = NODE_PARENT(n);
 	tnode_free((struct tnode *) n);
 
 	if (tp) {
 		cindex = tkey_extract_bits(key, tp->pos, tp->bits);
 		put_child(t, (struct tnode *)tp, cindex, NULL);
-		rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
-	} else
-		rcu_assign_pointer(t->trie, NULL);
-	preempt_enable();
+		t->trie = trie_rebalance(t, tp);
+	}
+	else
+		t->trie = NULL;
 
 	return 1;
 }
 
 static int
 fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
-		struct nlmsghdr *nlhdr, struct netlink_skb_parms *req)
+	       struct nlmsghdr *nlhdr, struct netlink_skb_parms *req)
 {
 	struct trie *t = (struct trie *) tb->tb_data;
 	u32 key, mask;
@@ -1533,8 +1615,6 @@ fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 	struct fib_alias *fa, *fa_to_delete;
 	struct list_head *fa_head;
 	struct leaf *l;
-	struct leaf_info *li;
-
 
 	if (plen > 32)
 		return -EINVAL;
@@ -1544,7 +1624,7 @@ fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 		memcpy(&key, rta->rta_dst, 4);
 
 	key = ntohl(key);
-	mask = ntohl(inet_make_mask(plen));
+	mask = ntohl( inet_make_mask(plen) );
 
 	if (key & ~mask)
 		return -EINVAL;
@@ -1561,11 +1641,11 @@ fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 	if (!fa)
 		return -ESRCH;
 
-	pr_debug("Deleting %08x/%d tos=%d t=%p\n", key, plen, tos, t);
+	if (trie_debug)
+		printk("Deleting %08x/%d tos=%d t=%p\n", key, plen, tos, t);
 
 	fa_to_delete = NULL;
 	fa_head = fa->fa_list.prev;
-
 	list_for_each_entry(fa, fa_head, fa_list) {
 		struct fib_info *fi = fa->fa_info;
 
@@ -1584,31 +1664,39 @@ fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 		}
 	}
 
-	if (!fa_to_delete)
-		return -ESRCH;
+	if (fa_to_delete) {
+		int kill_li = 0;
+		struct leaf_info *li;
 
-	fa = fa_to_delete;
-	rtmsg_fib(RTM_DELROUTE, htonl(key), fa, plen, tb->tb_id, nlhdr, req);
+		fa = fa_to_delete;
+		rtmsg_fib(RTM_DELROUTE, htonl(key), fa, plen, tb->tb_id, nlhdr, req);
 
-	l = fib_find_node(t, key);
-	li = find_leaf_info(&l->list, plen);
+		l = fib_find_node(t, key);
+		li = find_leaf_info(&l->list, plen);
 
-	list_del_rcu(&fa->fa_list);
+		write_lock_bh(&fib_lock);
 
-	if (list_empty(fa_head)) {
-		hlist_del_rcu(&li->hlist);
-		free_leaf_info(li);
-	}
+		list_del(&fa->fa_list);
 
-	if (hlist_empty(&l->list))
-		trie_leaf_remove(t, key);
+		if (list_empty(fa_head)) {
+			hlist_del(&li->hlist);
+			kill_li = 1;
+		}
+		write_unlock_bh(&fib_lock);
+	
+		if (kill_li)
+			free_leaf_info(li);
 
-	if (fa->fa_state & FA_S_ACCESSED)
-		rt_cache_flush(-1);
+		if (hlist_empty(&l->list))
+			trie_leaf_remove(t, key);
 
-	fib_release_info(fa->fa_info);
-	alias_free_mem_rcu(fa);
-	return 0;
+		if (fa->fa_state & FA_S_ACCESSED)
+			rt_cache_flush(-1);
+
+		fn_free_alias(fa);
+		return 0;
+	}
+	return -ESRCH;
 }
 
 static int trie_flush_list(struct trie *t, struct list_head *head)
@@ -1618,11 +1706,14 @@ static int trie_flush_list(struct trie *t, struct list_head *head)
 
 	list_for_each_entry_safe(fa, fa_node, head, fa_list) {
 		struct fib_info *fi = fa->fa_info;
+	
+		if (fi && (fi->fib_flags&RTNH_F_DEAD)) {
+
+ 			write_lock_bh(&fib_lock);
+			list_del(&fa->fa_list);
+			write_unlock_bh(&fib_lock);
 
-		if (fi && (fi->fib_flags & RTNH_F_DEAD)) {
-			list_del_rcu(&fa->fa_list);
-			fib_release_info(fa->fa_info);
-			alias_free_mem_rcu(fa);
+			fn_free_alias(fa);
 			found++;
 		}
 	}
@@ -1637,34 +1728,37 @@ static int trie_flush_leaf(struct trie *t, struct leaf *l)
 	struct leaf_info *li = NULL;
 
 	hlist_for_each_entry_safe(li, node, tmp, lih, hlist) {
+		
 		found += trie_flush_list(t, &li->falh);
 
 		if (list_empty(&li->falh)) {
-			hlist_del_rcu(&li->hlist);
+
+ 			write_lock_bh(&fib_lock);
+			hlist_del(&li->hlist);
+			write_unlock_bh(&fib_lock);
+
 			free_leaf_info(li);
 		}
 	}
 	return found;
 }
 
-/* rcu_read_lock needs to be hold by caller from readside */
-
 static struct leaf *nextleaf(struct trie *t, struct leaf *thisleaf)
 {
 	struct node *c = (struct node *) thisleaf;
 	struct tnode *p;
 	int idx;
-	struct node *trie = rcu_dereference(t->trie);
 
 	if (c == NULL) {
-		if (trie == NULL)
+		if (t->trie == NULL)
 			return NULL;
 
-		if (IS_LEAF(trie))          /* trie w. just a leaf */
-			return (struct leaf *) trie;
+		if (IS_LEAF(t->trie))          /* trie w. just a leaf */
+			return (struct leaf *) t->trie;
 
-		p = (struct tnode*) trie;  /* Start */
-	} else
+		p = (struct tnode*) t->trie;  /* Start */
+	}
+	else
 		p = (struct tnode *) NODE_PARENT(c);
 
 	while (p) {
@@ -1677,31 +1771,29 @@ static struct leaf *nextleaf(struct trie *t, struct leaf *thisleaf)
 			pos = 0;
 
 		last = 1 << p->bits;
-		for (idx = pos; idx < last ; idx++) {
-			c = rcu_dereference(p->child[idx]);
-
-			if (!c)
-				continue;
-
-			/* Decend if tnode */
-			while (IS_TNODE(c)) {
-				p = (struct tnode *) c;
-  				idx = 0;
-
-				/* Rightmost non-NULL branch */
-				if (p && IS_TNODE(p))
-					while (!(c = rcu_dereference(p->child[idx]))
-					       && idx < (1<<p->bits)) idx++;
-
-				/* Done with this tnode? */
-				if (idx >= (1 << p->bits) || !c)
-					goto up;
+		for(idx = pos; idx < last ; idx++) {
+			if (p->child[idx]) {
+
+				/* Decend if tnode */
+
+				while (IS_TNODE(p->child[idx])) {
+					p = (struct tnode*) p->child[idx];
+					idx = 0;
+				
+					/* Rightmost non-NULL branch */
+					if (p && IS_TNODE(p))
+						while (p->child[idx] == NULL && idx < (1 << p->bits)) idx++;
+
+					/* Done with this tnode? */
+					if (idx >= (1 << p->bits) || p->child[idx] == NULL )
+						goto up;
+				}
+				return (struct leaf*) p->child[idx];
 			}
-			return (struct leaf *) c;
 		}
 up:
 		/* No more children go up one step  */
-		c = (struct node *) p;
+		c = (struct node*) p;
 		p = (struct tnode *) NODE_PARENT(p);
 	}
 	return NULL; /* Ready. Root of trie */
@@ -1715,24 +1807,23 @@ static int fn_trie_flush(struct fib_table *tb)
 
 	t->revision++;
 
-	rcu_read_lock();
-	for (h = 0; (l = nextleaf(t, l)) != NULL; h++) {
+	for (h=0; (l = nextleaf(t, l)) != NULL; h++) {
 		found += trie_flush_leaf(t, l);
 
 		if (ll && hlist_empty(&ll->list))
 			trie_leaf_remove(t, ll->key);
 		ll = l;
 	}
-	rcu_read_unlock();  
 
 	if (ll && hlist_empty(&ll->list))
 		trie_leaf_remove(t, ll->key);
 
-	pr_debug("trie_flush found=%d\n", found);
+	if (trie_debug)
+		printk("trie_flush found=%d\n", found);
 	return found;
 }
 
-static int trie_last_dflt = -1;
+static int trie_last_dflt=-1;
 
 static void
 fn_trie_select_default(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
@@ -1749,7 +1840,7 @@ fn_trie_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
 	last_resort = NULL;
 	order = -1;
 
-	rcu_read_lock();
+	read_lock(&fib_lock);
 
 	l = fib_find_node(t, 0);
 	if (!l)
@@ -1762,20 +1853,20 @@ fn_trie_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
 	if (list_empty(fa_head))
 		goto out;
 
-	list_for_each_entry_rcu(fa, fa_head, fa_list) {
+	list_for_each_entry(fa, fa_head, fa_list) {
 		struct fib_info *next_fi = fa->fa_info;
-
+	
 		if (fa->fa_scope != res->scope ||
 		    fa->fa_type != RTN_UNICAST)
 			continue;
-
+	
 		if (next_fi->fib_priority > res->fi->fib_priority)
 			break;
 		if (!next_fi->fib_nh[0].nh_gw ||
 		    next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
 			continue;
 		fa->fa_state |= FA_S_ACCESSED;
-
+	
 		if (fi == NULL) {
 			if (next_fi != res->fi)
 				break;
@@ -1813,7 +1904,7 @@ fn_trie_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
 	}
 	trie_last_dflt = last_idx;
  out:;
-	rcu_read_unlock();
+	read_unlock(&fib_lock);
 }
 
 static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fib_table *tb,
@@ -1822,14 +1913,12 @@ static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fi
 	int i, s_i;
 	struct fib_alias *fa;
 
-	u32 xkey = htonl(key);
+	u32 xkey=htonl(key);
 
-	s_i = cb->args[3];
+	s_i=cb->args[3];
 	i = 0;
 
-	/* rcu_read_lock is hold by caller */
-
-	list_for_each_entry_rcu(fa, fah, fa_list) {
+	list_for_each_entry(fa, fah, fa_list) {
 		if (i < s_i) {
 			i++;
 			continue;
@@ -1857,10 +1946,10 @@ static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fi
 				  fa->fa_info, 0) < 0) {
 			cb->args[3] = i;
 			return -1;
-		}
+			}
 		i++;
 	}
-	cb->args[3] = i;
+	cb->args[3]=i;
 	return skb->len;
 }
 
@@ -1870,10 +1959,10 @@ static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, str
 	int h, s_h;
 	struct list_head *fa_head;
 	struct leaf *l = NULL;
+	s_h=cb->args[2];
 
-	s_h = cb->args[2];
+	for (h=0; (l = nextleaf(t, l)) != NULL; h++) {
 
-	for (h = 0; (l = nextleaf(t, l)) != NULL; h++) {
 		if (h < s_h)
 			continue;
 		if (h > s_h)
@@ -1881,7 +1970,7 @@ static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, str
 			       sizeof(cb->args) - 3*sizeof(cb->args[0]));
 
 		fa_head = get_fa_head(l, plen);
-
+	
 		if (!fa_head)
 			continue;
 
@@ -1889,11 +1978,11 @@ static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, str
 			continue;
 
 		if (fn_trie_dump_fa(l->key, plen, fa_head, tb, skb, cb)<0) {
-			cb->args[2] = h;
+			cb->args[2]=h;
 			return -1;
 		}
 	}
-	cb->args[2] = h;
+	cb->args[2]=h;
 	return skb->len;
 }
 
@@ -1904,24 +1993,25 @@ static int fn_trie_dump(struct fib_table *tb, struct sk_buff *skb, struct netlin
 
 	s_m = cb->args[1];
 
-	rcu_read_lock();
-	for (m = 0; m <= 32; m++) {
+	read_lock(&fib_lock);
+	for (m=0; m<=32; m++) {
+
 		if (m < s_m)
 			continue;
 		if (m > s_m)
 			memset(&cb->args[2], 0,
-				sizeof(cb->args) - 2*sizeof(cb->args[0]));
+			       sizeof(cb->args) - 2*sizeof(cb->args[0]));
 
 		if (fn_trie_dump_plen(t, 32-m, tb, skb, cb)<0) {
 			cb->args[1] = m;
 			goto out;
 		}
 	}
-	rcu_read_unlock();
+	read_unlock(&fib_lock);
 	cb->args[1] = m;
 	return skb->len;
-out:
-	rcu_read_unlock();
+ out:
+	read_unlock(&fib_lock);
 	return -1;
 }
 
@@ -1961,9 +2051,9 @@ struct fib_table * __init fib_hash_init(int id)
 	trie_init(t);
 
 	if (id == RT_TABLE_LOCAL)
-		trie_local = t;
+                trie_local = t;
 	else if (id == RT_TABLE_MAIN)
-		trie_main = t;
+                trie_main = t;
 
 	if (id == RT_TABLE_LOCAL)
 		printk("IPv4 FIB: Using LC-trie version %s\n", VERSION);
@@ -1975,8 +2065,7 @@ struct fib_table * __init fib_hash_init(int id)
 
 static void putspace_seq(struct seq_file *seq, int n)
 {
-	while (n--)
-		seq_printf(seq, " ");
+	while (n--) seq_printf(seq, " ");
 }
 
 static void printbin_seq(struct seq_file *seq, unsigned int v, int bits)
@@ -1997,22 +2086,29 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
 		seq_printf(seq, "%d/", cindex);
 		printbin_seq(seq, cindex, bits);
 		seq_printf(seq, ": ");
-	} else
+	}
+	else
 		seq_printf(seq, "<root>: ");
 	seq_printf(seq, "%s:%p ", IS_LEAF(n)?"Leaf":"Internal node", n);
 
+	if (IS_LEAF(n))
+		seq_printf(seq, "key=%d.%d.%d.%d\n",
+			   n->key >> 24, (n->key >> 16) % 256, (n->key >> 8) % 256, n->key % 256);
+	else {
+		int plen = ((struct tnode *)n)->pos;
+		t_key prf=MASK_PFX(n->key, plen);
+		seq_printf(seq, "key=%d.%d.%d.%d/%d\n",
+			   prf >> 24, (prf >> 16) % 256, (prf >> 8) % 256, prf % 256, plen);
+	}
 	if (IS_LEAF(n)) {
-		struct leaf *l = (struct leaf *)n;
+		struct leaf *l=(struct leaf *)n;
 		struct fib_alias *fa;
 		int i;
-
-		seq_printf(seq, "key=%d.%d.%d.%d\n",
-			   n->key >> 24, (n->key >> 16) % 256, (n->key >> 8) % 256, n->key % 256);
-
-		for (i = 32; i >= 0; i--)
-			if (find_leaf_info(&l->list, i)) {
+		for (i=32; i>=0; i--)
+		  if (find_leaf_info(&l->list, i)) {
+		
 				struct list_head *fa_head = get_fa_head(l, i);
-
+			
 				if (!fa_head)
 					continue;
 
@@ -2022,16 +2118,17 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
 				putspace_seq(seq, indent+2);
 				seq_printf(seq, "{/%d...dumping}\n", i);
 
-				list_for_each_entry_rcu(fa, fa_head, fa_list) {
+
+				list_for_each_entry(fa, fa_head, fa_list) {
 					putspace_seq(seq, indent+2);
-					if (fa->fa_info == NULL) {
-						seq_printf(seq, "Error fa_info=NULL\n");
-						continue;
-					}
 					if (fa->fa_info->fib_nh == NULL) {
 						seq_printf(seq, "Error _fib_nh=NULL\n");
 						continue;
 					}
+					if (fa->fa_info == NULL) {
+						seq_printf(seq, "Error fa_info=NULL\n");
+						continue;
+					}
 
 					seq_printf(seq, "{type=%d scope=%d TOS=%d}\n",
 					      fa->fa_type,
@@ -2039,16 +2136,11 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
 					      fa->fa_tos);
 				}
 			}
-	} else {
+	}
+	else if (IS_TNODE(n)) {
 		struct tnode *tn = (struct tnode *)n;
-		int plen = ((struct tnode *)n)->pos;
-		t_key prf = MASK_PFX(n->key, plen);
-
-		seq_printf(seq, "key=%d.%d.%d.%d/%d\n",
-			   prf >> 24, (prf >> 16) % 256, (prf >> 8) % 256, prf % 256, plen);
-
 		putspace_seq(seq, indent); seq_printf(seq, "|    ");
-		seq_printf(seq, "{key prefix=%08x/", tn->key & TKEY_GET_MASK(0, tn->pos));
+		seq_printf(seq, "{key prefix=%08x/", tn->key&TKEY_GET_MASK(0, tn->pos));
 		printbin_seq(seq, tkey_extract_bits(tn->key, 0, tn->pos), tn->pos);
 		seq_printf(seq, "}\n");
 		putspace_seq(seq, indent); seq_printf(seq, "|    ");
@@ -2062,196 +2154,194 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
 
 static void trie_dump_seq(struct seq_file *seq, struct trie *t)
 {
-	struct node *n;
-	int cindex = 0;
-	int indent = 1;
-	int pend = 0;
+	struct node *n = t->trie;
+	int cindex=0;
+	int indent=1;
+	int pend=0;
 	int depth = 0;
-	struct tnode *tn;
 
-	rcu_read_lock();
-	n = rcu_dereference(t->trie);
-	seq_printf(seq, "------ trie_dump of t=%p ------\n", t);
-
-	if (!n) {
-		seq_printf(seq, "------ trie is empty\n");
+  	read_lock(&fib_lock);
 
-		rcu_read_unlock();
-		return;
-	}
-
-	printnode_seq(seq, indent, n, pend, cindex, 0);
-
-	if (!IS_TNODE(n)) {
-		rcu_read_unlock();
-		return;
-	}
-
-	tn = (struct tnode *)n;
-	pend = tn->pos+tn->bits;
-	putspace_seq(seq, indent); seq_printf(seq, "\\--\n");
-	indent += 3;
-	depth++;
-
-	while (tn && cindex < (1 << tn->bits)) {
-		struct node *child = rcu_dereference(tn->child[cindex]);
-		if (!child)
-			cindex++;
-		else {
-			/* Got a child */
-			printnode_seq(seq, indent, child, pend,
-				      cindex, tn->bits);
-
-			if (IS_LEAF(child))
-				cindex++;
+	seq_printf(seq, "------ trie_dump of t=%p ------\n", t);
+	if (n) {
+		printnode_seq(seq, indent, n, pend, cindex, 0);
+		if (IS_TNODE(n)) {
+			struct tnode *tn = (struct tnode *)n;
+			pend = tn->pos+tn->bits;
+			putspace_seq(seq, indent); seq_printf(seq, "\\--\n");
+			indent += 3;
+			depth++;
+
+			while (tn && cindex < (1 << tn->bits)) {
+				if (tn->child[cindex]) {
+				
+					/* Got a child */
+				
+					printnode_seq(seq, indent, tn->child[cindex], pend, cindex, tn->bits);
+					if (IS_LEAF(tn->child[cindex])) {
+						cindex++;
+					
+					}
+					else {
+						/*
+						 * New tnode. Decend one level
+						 */
+					
+						depth++;
+						n = tn->child[cindex];
+						tn = (struct tnode *)n;
+						pend = tn->pos+tn->bits;
+						putspace_seq(seq, indent); seq_printf(seq, "\\--\n");
+						indent+=3;
+						cindex=0;
+					}
+				}
+				else
+					cindex++;
 
-			else {
 				/*
-				 * New tnode. Decend one level
+				 * Test if we are done
 				 */
+			
+				while (cindex >= (1 << tn->bits)) {
 
-				depth++;
-				n = child;
-				tn = (struct tnode *)n;
-				pend = tn->pos+tn->bits;
-				putspace_seq(seq, indent);
-				seq_printf(seq, "\\--\n");
-				indent += 3;
-				cindex = 0;
-			}
-		}
-
-		/*
-		 * Test if we are done
-		 */
-
-		while (cindex >= (1 << tn->bits)) {
-			/*
-			 * Move upwards and test for root
-			 * pop off all traversed  nodes
-			 */
-
-			if (NODE_PARENT(tn) == NULL) {
-				tn = NULL;
-				break;
+					/*
+					 * Move upwards and test for root
+					 * pop off all traversed  nodes
+					 */
+				
+					if (NODE_PARENT(tn) == NULL) {
+						tn = NULL;
+						n = NULL;
+						break;
+					}
+					else {
+						cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
+						tn = NODE_PARENT(tn);
+						cindex++;
+						n = (struct node *)tn;
+						pend = tn->pos+tn->bits;
+						indent-=3;
+						depth--;
+					}
+				}
 			}
-
-			cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
-			cindex++;
-			tn = NODE_PARENT(tn);
-			pend = tn->pos + tn->bits;
-			indent -= 3;
-			depth--;
 		}
+		else n = NULL;
 	}
-	rcu_read_unlock();
+	else seq_printf(seq, "------ trie is empty\n");
+
+  	read_unlock(&fib_lock);
 }
 
 static struct trie_stat *trie_stat_new(void)
 {
-	struct trie_stat *s;
+	struct trie_stat *s = kmalloc(sizeof(struct trie_stat), GFP_KERNEL);
 	int i;
 
-	s = kmalloc(sizeof(struct trie_stat), GFP_KERNEL);
-	if (!s)
-		return NULL;
-
-	s->totdepth = 0;
-	s->maxdepth = 0;
-	s->tnodes = 0;
-	s->leaves = 0;
-	s->nullpointers = 0;
-
-	for (i = 0; i < MAX_CHILDS; i++)
-		s->nodesizes[i] = 0;
-
+	if (s) {
+		s->totdepth = 0;
+		s->maxdepth = 0;
+		s->tnodes = 0;
+		s->leaves = 0;
+		s->nullpointers = 0;
+	
+		for(i=0; i< MAX_CHILDS; i++)
+			s->nodesizes[i] = 0;
+	}
 	return s;
 }
 
 static struct trie_stat *trie_collect_stats(struct trie *t)
 {
-	struct node *n;
+	struct node *n = t->trie;
 	struct trie_stat *s = trie_stat_new();
 	int cindex = 0;
+	int indent = 1;
 	int pend = 0;
 	int depth = 0;
 
-	if (!s)
-		return NULL;
-
-	rcu_read_lock();
-	n = rcu_dereference(t->trie);
+	read_lock(&fib_lock);	
 
-	if (!n)
-		return s;
-
-	if (IS_TNODE(n)) {
-		struct tnode *tn = (struct tnode *)n;
-		pend = tn->pos+tn->bits;
-		s->nodesizes[tn->bits]++;
-		depth++;
-
-		while (tn && cindex < (1 << tn->bits)) {
-			struct node *ch = rcu_dereference(tn->child[cindex]);
-			if (ch) {
-
-				/* Got a child */
+	if (s) {
+		if (n) {
+			if (IS_TNODE(n)) {
+				struct tnode *tn = (struct tnode *)n;
+				pend = tn->pos+tn->bits;
+				indent += 3;
+				s->nodesizes[tn->bits]++;
+				depth++;
 
-				if (IS_LEAF(tn->child[cindex])) {
-					cindex++;
+				while (tn && cindex < (1 << tn->bits)) {
+					if (tn->child[cindex]) {
+						/* Got a child */
+				
+						if (IS_LEAF(tn->child[cindex])) {
+							cindex++;
+					
+							/* stats */
+							if (depth > s->maxdepth)
+								s->maxdepth = depth;
+							s->totdepth += depth;
+							s->leaves++;
+						}
+				
+						else {
+							/*
+							 * New tnode. Decend one level
+							 */
+					
+							s->tnodes++;
+							s->nodesizes[tn->bits]++;
+							depth++;
+					
+							n = tn->child[cindex];
+							tn = (struct tnode *)n;
+							pend = tn->pos+tn->bits;
+
+							indent += 3;
+							cindex = 0;
+						}
+					}
+					else {
+						cindex++;
+						s->nullpointers++;
+					}
 
-					/* stats */
-					if (depth > s->maxdepth)
-						s->maxdepth = depth;
-					s->totdepth += depth;
-					s->leaves++;
-				} else {
 					/*
-					 * New tnode. Decend one level
+					 * Test if we are done
 					 */
-
-					s->tnodes++;
-					s->nodesizes[tn->bits]++;
-					depth++;
-
-					n = ch;
-					tn = (struct tnode *)n;
-					pend = tn->pos+tn->bits;
-
-					cindex = 0;
+			
+					while (cindex >= (1 << tn->bits)) {
+
+						/*
+						 * Move upwards and test for root
+						 * pop off all traversed  nodes
+						 */
+
+					
+						if (NODE_PARENT(tn) == NULL) {
+							tn = NULL;
+							n = NULL;
+							break;
+						}
+						else {
+							cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
+							tn = NODE_PARENT(tn);
+							cindex++;
+							n = (struct node *)tn;
+							pend = tn->pos+tn->bits;
+							indent -= 3;
+							depth--;
+						}
+ 					}
 				}
-			} else {
-				cindex++;
-				s->nullpointers++;
 			}
-
-			/*
-			 * Test if we are done
-			 */
-
-			while (cindex >= (1 << tn->bits)) {
-				/*
-				 * Move upwards and test for root
-				 * pop off all traversed  nodes
-				 */
-
-				if (NODE_PARENT(tn) == NULL) {
-					tn = NULL;
-					n = NULL;
-					break;
-				}
-
-				cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
-				tn = NODE_PARENT(tn);
-				cindex++;
-				n = (struct node *)tn;
-				pend = tn->pos+tn->bits;
-				depth--;
- 			}
+			else n = NULL;
 		}
 	}
 
-	rcu_read_unlock();
+	read_unlock(&fib_lock);	
 	return s;
 }
 
@@ -2269,22 +2359,17 @@ static struct fib_alias *fib_triestat_get_next(struct seq_file *seq)
 
 static void *fib_triestat_seq_start(struct seq_file *seq, loff_t *pos)
 {
-	if (!ip_fib_main_table)
-		return NULL;
+	void *v = NULL;
 
-	if (*pos)
-		return fib_triestat_get_next(seq);
-	else
-		return SEQ_START_TOKEN;
+	if (ip_fib_main_table)
+		v = *pos ? fib_triestat_get_next(seq) : SEQ_START_TOKEN;
+	return v;
 }
 
 static void *fib_triestat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
 	++*pos;
-	if (v == SEQ_START_TOKEN)
-		return fib_triestat_get_first(seq);
-	else
-		return fib_triestat_get_next(seq);
+	return v == SEQ_START_TOKEN ? fib_triestat_get_first(seq) : fib_triestat_get_next(seq);
 }
 
 static void fib_triestat_seq_stop(struct seq_file *seq, void *v)
@@ -2303,22 +2388,22 @@ static void collect_and_show(struct trie *t, struct seq_file *seq)
 {
 	int bytes = 0; /* How many bytes are used, a ref is 4 bytes */
 	int i, max, pointers;
-	struct trie_stat *stat;
+        struct trie_stat *stat;
 	int avdepth;
 
 	stat = trie_collect_stats(t);
 
-	bytes = 0;
+	bytes=0;
 	seq_printf(seq, "trie=%p\n", t);
 
 	if (stat) {
 		if (stat->leaves)
-			avdepth = stat->totdepth*100 / stat->leaves;
+			avdepth=stat->totdepth*100 / stat->leaves;
 		else
-			avdepth = 0;
-		seq_printf(seq, "Aver depth: %d.%02d\n", avdepth / 100, avdepth % 100);
+			avdepth=0;
+		seq_printf(seq, "Aver depth: %d.%02d\n", avdepth / 100, avdepth % 100 );
 		seq_printf(seq, "Max depth: %4d\n", stat->maxdepth);
-
+			
 		seq_printf(seq, "Leaves: %d\n", stat->leaves);
 		bytes += sizeof(struct leaf) * stat->leaves;
 		seq_printf(seq, "Internal nodes: %d\n", stat->tnodes);
@@ -2370,9 +2455,11 @@ static int fib_triestat_seq_show(struct seq_file *seq, void *v)
 
 		if (trie_main)
 			collect_and_show(trie_main, seq);
-	} else {
-		snprintf(bf, sizeof(bf), "*\t%08X\t%08X", 200, 400);
-
+	}
+	else {
+		snprintf(bf, sizeof(bf),
+			 "*\t%08X\t%08X", 200, 400);
+	
 		seq_printf(seq, "%-127s\n", bf);
 	}
 	return 0;
@@ -2433,27 +2520,22 @@ static struct fib_alias *fib_trie_get_next(struct seq_file *seq)
 
 static void *fib_trie_seq_start(struct seq_file *seq, loff_t *pos)
 {
-	if (!ip_fib_main_table)
-		return NULL;
+	void *v = NULL;
 
-	if (*pos)
-		return fib_trie_get_next(seq);
-	else
-		return SEQ_START_TOKEN;
+	if (ip_fib_main_table)
+		v = *pos ? fib_trie_get_next(seq) : SEQ_START_TOKEN;
+	return v;
 }
 
 static void *fib_trie_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
 	++*pos;
-	if (v == SEQ_START_TOKEN)
-		return fib_trie_get_first(seq);
-	else
-		return fib_trie_get_next(seq);
-
+	return v == SEQ_START_TOKEN ? fib_trie_get_first(seq) : fib_trie_get_next(seq);
 }
 
 static void fib_trie_seq_stop(struct seq_file *seq, void *v)
 {
+
 }
 
 /*
@@ -2473,7 +2555,9 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
 
 		if (trie_main)
 			trie_dump_seq(seq, trie_main);
-	} else {
+	}
+
+	else {
 		snprintf(bf, sizeof(bf),
 			 "*\t%08X\t%08X", 200, 400);
 		seq_printf(seq, "%-127s\n", bf);
diff --git a/trunk/net/ipv4/icmp.c b/trunk/net/ipv4/icmp.c
index 24eb56ae1b5a..badfc5849973 100644
--- a/trunk/net/ipv4/icmp.c
+++ b/trunk/net/ipv4/icmp.c
@@ -114,7 +114,7 @@ struct icmp_bxm {
 /*
  *	Statistics
  */
-DEFINE_SNMP_STAT(struct icmp_mib, icmp_statistics) __read_mostly;
+DEFINE_SNMP_STAT(struct icmp_mib, icmp_statistics);
 
 /* An array of errno for error messages from dest unreach. */
 /* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */
@@ -627,10 +627,11 @@ static void icmp_unreach(struct sk_buff *skb)
 			break;
 		case ICMP_FRAG_NEEDED:
 			if (ipv4_config.no_pmtu_disc) {
-				LIMIT_NETDEBUG(KERN_INFO "ICMP: %u.%u.%u.%u: "
+				LIMIT_NETDEBUG(
+					printk(KERN_INFO "ICMP: %u.%u.%u.%u: "
 							 "fragmentation needed "
 							 "and DF set.\n",
-					       NIPQUAD(iph->daddr));
+					       NIPQUAD(iph->daddr)));
 			} else {
 				info = ip_rt_frag_needed(iph,
 						     ntohs(icmph->un.frag.mtu));
@@ -639,9 +640,10 @@ static void icmp_unreach(struct sk_buff *skb)
 			}
 			break;
 		case ICMP_SR_FAILED:
-			LIMIT_NETDEBUG(KERN_INFO "ICMP: %u.%u.%u.%u: Source "
+			LIMIT_NETDEBUG(
+				printk(KERN_INFO "ICMP: %u.%u.%u.%u: Source "
 						 "Route Failed.\n",
-				       NIPQUAD(iph->daddr));
+				       NIPQUAD(iph->daddr)));
 			break;
 		default:
 			break;
@@ -934,7 +936,7 @@ int icmp_rcv(struct sk_buff *skb)
 	case CHECKSUM_HW:
 		if (!(u16)csum_fold(skb->csum))
 			break;
-		LIMIT_NETDEBUG(KERN_DEBUG "icmp v4 hw csum failure\n");
+		LIMIT_NETDEBUG(printk(KERN_DEBUG "icmp v4 hw csum failure\n"));
 	case CHECKSUM_NONE:
 		if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0)))
 			goto error;
diff --git a/trunk/net/ipv4/igmp.c b/trunk/net/ipv4/igmp.c
index 44607f4767b8..5088f90835ae 100644
--- a/trunk/net/ipv4/igmp.c
+++ b/trunk/net/ipv4/igmp.c
@@ -904,7 +904,7 @@ int igmp_rcv(struct sk_buff *skb)
 	case IGMP_MTRACE_RESP:
 		break;
 	default:
-		NETDEBUG(KERN_DEBUG "New IGMP type=%d, why we do not know about it?\n", ih->type);
+		NETDEBUG(printk(KERN_DEBUG "New IGMP type=%d, why we do not know about it?\n", ih->type));
 	}
 	in_dev_put(in_dev);
 	kfree_skb(skb);
diff --git a/trunk/net/ipv4/inet_connection_sock.c b/trunk/net/ipv4/inet_connection_sock.c
deleted file mode 100644
index fe3c6d3d0c91..000000000000
--- a/trunk/net/ipv4/inet_connection_sock.c
+++ /dev/null
@@ -1,641 +0,0 @@
-/*
- * INET		An implementation of the TCP/IP protocol suite for the LINUX
- *		operating system.  INET is implemented using the  BSD Socket
- *		interface as the means of communication with the user level.
- *
- *		Support for INET connection oriented protocols.
- *
- * Authors:	See the TCP sources
- *
- *		This program is free software; you can redistribute it and/or
- *		modify it under the terms of the GNU General Public License
- *		as published by the Free Software Foundation; either version
- *		2 of the License, or(at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/jhash.h>
-
-#include <net/inet_connection_sock.h>
-#include <net/inet_hashtables.h>
-#include <net/inet_timewait_sock.h>
-#include <net/ip.h>
-#include <net/route.h>
-#include <net/tcp_states.h>
-#include <net/xfrm.h>
-
-#ifdef INET_CSK_DEBUG
-const char inet_csk_timer_bug_msg[] = "inet_csk BUG: unknown timer value\n";
-EXPORT_SYMBOL(inet_csk_timer_bug_msg);
-#endif
-
-/*
- * This array holds the first and last local port number.
- * For high-usage systems, use sysctl to change this to
- * 32768-61000
- */
-int sysctl_local_port_range[2] = { 1024, 4999 };
-
-static inline int inet_csk_bind_conflict(struct sock *sk, struct inet_bind_bucket *tb)
-{
-	const u32 sk_rcv_saddr = inet_rcv_saddr(sk);
-	struct sock *sk2;
-	struct hlist_node *node;
-	int reuse = sk->sk_reuse;
-
-	sk_for_each_bound(sk2, node, &tb->owners) {
-		if (sk != sk2 &&
-		    !inet_v6_ipv6only(sk2) &&
-		    (!sk->sk_bound_dev_if ||
-		     !sk2->sk_bound_dev_if ||
-		     sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
-			if (!reuse || !sk2->sk_reuse ||
-			    sk2->sk_state == TCP_LISTEN) {
-				const u32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
-				if (!sk2_rcv_saddr || !sk_rcv_saddr ||
-				    sk2_rcv_saddr == sk_rcv_saddr)
-					break;
-			}
-		}
-	}
-	return node != NULL;
-}
-
-/* Obtain a reference to a local port for the given sock,
- * if snum is zero it means select any available local port.
- */
-int inet_csk_get_port(struct inet_hashinfo *hashinfo,
-		      struct sock *sk, unsigned short snum)
-{
-	struct inet_bind_hashbucket *head;
-	struct hlist_node *node;
-	struct inet_bind_bucket *tb;
-	int ret;
-
-	local_bh_disable();
-	if (!snum) {
-		int low = sysctl_local_port_range[0];
-		int high = sysctl_local_port_range[1];
-		int remaining = (high - low) + 1;
-		int rover;
-
-		spin_lock(&hashinfo->portalloc_lock);
-		if (hashinfo->port_rover < low)
-			rover = low;
-		else
-			rover = hashinfo->port_rover;
-		do {
-			rover++;
-			if (rover > high)
-				rover = low;
-			head = &hashinfo->bhash[inet_bhashfn(rover, hashinfo->bhash_size)];
-			spin_lock(&head->lock);
-			inet_bind_bucket_for_each(tb, node, &head->chain)
-				if (tb->port == rover)
-					goto next;
-			break;
-		next:
-			spin_unlock(&head->lock);
-		} while (--remaining > 0);
-		hashinfo->port_rover = rover;
-		spin_unlock(&hashinfo->portalloc_lock);
-
-		/* Exhausted local port range during search?  It is not
-		 * possible for us to be holding one of the bind hash
-		 * locks if this test triggers, because if 'remaining'
-		 * drops to zero, we broke out of the do/while loop at
-		 * the top level, not from the 'break;' statement.
-		 */
-		ret = 1;
-		if (remaining <= 0)
-			goto fail;
-
-		/* OK, here is the one we will use.  HEAD is
-		 * non-NULL and we hold it's mutex.
-		 */
-		snum = rover;
-	} else {
-		head = &hashinfo->bhash[inet_bhashfn(snum, hashinfo->bhash_size)];
-		spin_lock(&head->lock);
-		inet_bind_bucket_for_each(tb, node, &head->chain)
-			if (tb->port == snum)
-				goto tb_found;
-	}
-	tb = NULL;
-	goto tb_not_found;
-tb_found:
-	if (!hlist_empty(&tb->owners)) {
-		if (sk->sk_reuse > 1)
-			goto success;
-		if (tb->fastreuse > 0 &&
-		    sk->sk_reuse && sk->sk_state != TCP_LISTEN) {
-			goto success;
-		} else {
-			ret = 1;
-			if (inet_csk_bind_conflict(sk, tb))
-				goto fail_unlock;
-		}
-	}
-tb_not_found:
-	ret = 1;
-	if (!tb && (tb = inet_bind_bucket_create(hashinfo->bind_bucket_cachep, head, snum)) == NULL)
-		goto fail_unlock;
-	if (hlist_empty(&tb->owners)) {
-		if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
-			tb->fastreuse = 1;
-		else
-			tb->fastreuse = 0;
-	} else if (tb->fastreuse &&
-		   (!sk->sk_reuse || sk->sk_state == TCP_LISTEN))
-		tb->fastreuse = 0;
-success:
-	if (!inet_csk(sk)->icsk_bind_hash)
-		inet_bind_hash(sk, tb, snum);
-	BUG_TRAP(inet_csk(sk)->icsk_bind_hash == tb);
- 	ret = 0;
-
-fail_unlock:
-	spin_unlock(&head->lock);
-fail:
-	local_bh_enable();
-	return ret;
-}
-
-EXPORT_SYMBOL_GPL(inet_csk_get_port);
-
-/*
- * Wait for an incoming connection, avoid race conditions. This must be called
- * with the socket locked.
- */
-static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	DEFINE_WAIT(wait);
-	int err;
-
-	/*
-	 * True wake-one mechanism for incoming connections: only
-	 * one process gets woken up, not the 'whole herd'.
-	 * Since we do not 'race & poll' for established sockets
-	 * anymore, the common case will execute the loop only once.
-	 *
-	 * Subtle issue: "add_wait_queue_exclusive()" will be added
-	 * after any current non-exclusive waiters, and we know that
-	 * it will always _stay_ after any new non-exclusive waiters
-	 * because all non-exclusive waiters are added at the
-	 * beginning of the wait-queue. As such, it's ok to "drop"
-	 * our exclusiveness temporarily when we get woken up without
-	 * having to remove and re-insert us on the wait queue.
-	 */
-	for (;;) {
-		prepare_to_wait_exclusive(sk->sk_sleep, &wait,
-					  TASK_INTERRUPTIBLE);
-		release_sock(sk);
-		if (reqsk_queue_empty(&icsk->icsk_accept_queue))
-			timeo = schedule_timeout(timeo);
-		lock_sock(sk);
-		err = 0;
-		if (!reqsk_queue_empty(&icsk->icsk_accept_queue))
-			break;
-		err = -EINVAL;
-		if (sk->sk_state != TCP_LISTEN)
-			break;
-		err = sock_intr_errno(timeo);
-		if (signal_pending(current))
-			break;
-		err = -EAGAIN;
-		if (!timeo)
-			break;
-	}
-	finish_wait(sk->sk_sleep, &wait);
-	return err;
-}
-
-/*
- * This will accept the next outstanding connection.
- */
-struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	struct sock *newsk;
-	int error;
-
-	lock_sock(sk);
-
-	/* We need to make sure that this socket is listening,
-	 * and that it has something pending.
-	 */
-	error = -EINVAL;
-	if (sk->sk_state != TCP_LISTEN)
-		goto out_err;
-
-	/* Find already established connection */
-	if (reqsk_queue_empty(&icsk->icsk_accept_queue)) {
-		long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
-
-		/* If this is a non blocking socket don't sleep */
-		error = -EAGAIN;
-		if (!timeo)
-			goto out_err;
-
-		error = inet_csk_wait_for_connect(sk, timeo);
-		if (error)
-			goto out_err;
-	}
-
-	newsk = reqsk_queue_get_child(&icsk->icsk_accept_queue, sk);
-	BUG_TRAP(newsk->sk_state != TCP_SYN_RECV);
-out:
-	release_sock(sk);
-	return newsk;
-out_err:
-	newsk = NULL;
-	*err = error;
-	goto out;
-}
-
-EXPORT_SYMBOL(inet_csk_accept);
-
-/*
- * Using different timers for retransmit, delayed acks and probes
- * We may wish use just one timer maintaining a list of expire jiffies 
- * to optimize.
- */
-void inet_csk_init_xmit_timers(struct sock *sk,
-			       void (*retransmit_handler)(unsigned long),
-			       void (*delack_handler)(unsigned long),
-			       void (*keepalive_handler)(unsigned long))
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-
-	init_timer(&icsk->icsk_retransmit_timer);
-	init_timer(&icsk->icsk_delack_timer);
-	init_timer(&sk->sk_timer);
-
-	icsk->icsk_retransmit_timer.function = retransmit_handler;
-	icsk->icsk_delack_timer.function     = delack_handler;
-	sk->sk_timer.function		     = keepalive_handler;
-
-	icsk->icsk_retransmit_timer.data = 
-		icsk->icsk_delack_timer.data =
-			sk->sk_timer.data  = (unsigned long)sk;
-
-	icsk->icsk_pending = icsk->icsk_ack.pending = 0;
-}
-
-EXPORT_SYMBOL(inet_csk_init_xmit_timers);
-
-void inet_csk_clear_xmit_timers(struct sock *sk)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-
-	icsk->icsk_pending = icsk->icsk_ack.pending = icsk->icsk_ack.blocked = 0;
-
-	sk_stop_timer(sk, &icsk->icsk_retransmit_timer);
-	sk_stop_timer(sk, &icsk->icsk_delack_timer);
-	sk_stop_timer(sk, &sk->sk_timer);
-}
-
-EXPORT_SYMBOL(inet_csk_clear_xmit_timers);
-
-void inet_csk_delete_keepalive_timer(struct sock *sk)
-{
-	sk_stop_timer(sk, &sk->sk_timer);
-}
-
-EXPORT_SYMBOL(inet_csk_delete_keepalive_timer);
-
-void inet_csk_reset_keepalive_timer(struct sock *sk, unsigned long len)
-{
-	sk_reset_timer(sk, &sk->sk_timer, jiffies + len);
-}
-
-EXPORT_SYMBOL(inet_csk_reset_keepalive_timer);
-
-struct dst_entry* inet_csk_route_req(struct sock *sk,
-				     const struct request_sock *req)
-{
-	struct rtable *rt;
-	const struct inet_request_sock *ireq = inet_rsk(req);
-	struct ip_options *opt = inet_rsk(req)->opt;
-	struct flowi fl = { .oif = sk->sk_bound_dev_if,
-			    .nl_u = { .ip4_u =
-				      { .daddr = ((opt && opt->srr) ?
-						  opt->faddr :
-						  ireq->rmt_addr),
-					.saddr = ireq->loc_addr,
-					.tos = RT_CONN_FLAGS(sk) } },
-			    .proto = sk->sk_protocol,
-			    .uli_u = { .ports =
-				       { .sport = inet_sk(sk)->sport,
-					 .dport = ireq->rmt_port } } };
-
-	if (ip_route_output_flow(&rt, &fl, sk, 0)) {
-		IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
-		return NULL;
-	}
-	if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway) {
-		ip_rt_put(rt);
-		IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
-		return NULL;
-	}
-	return &rt->u.dst;
-}
-
-EXPORT_SYMBOL_GPL(inet_csk_route_req);
-
-static inline u32 inet_synq_hash(const u32 raddr, const u16 rport,
-				 const u32 rnd, const u16 synq_hsize)
-{
-	return jhash_2words(raddr, (u32)rport, rnd) & (synq_hsize - 1);
-}
-
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-#define AF_INET_FAMILY(fam) ((fam) == AF_INET)
-#else
-#define AF_INET_FAMILY(fam) 1
-#endif
-
-struct request_sock *inet_csk_search_req(const struct sock *sk,
-					 struct request_sock ***prevp,
-					 const __u16 rport, const __u32 raddr,
-					 const __u32 laddr)
-{
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	struct listen_sock *lopt = icsk->icsk_accept_queue.listen_opt;
-	struct request_sock *req, **prev;
-
-	for (prev = &lopt->syn_table[inet_synq_hash(raddr, rport, lopt->hash_rnd,
-						    lopt->nr_table_entries)];
-	     (req = *prev) != NULL;
-	     prev = &req->dl_next) {
-		const struct inet_request_sock *ireq = inet_rsk(req);
-
-		if (ireq->rmt_port == rport &&
-		    ireq->rmt_addr == raddr &&
-		    ireq->loc_addr == laddr &&
-		    AF_INET_FAMILY(req->rsk_ops->family)) {
-			BUG_TRAP(!req->sk);
-			*prevp = prev;
-			break;
-		}
-	}
-
-	return req;
-}
-
-EXPORT_SYMBOL_GPL(inet_csk_search_req);
-
-void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
-				   const unsigned timeout)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	struct listen_sock *lopt = icsk->icsk_accept_queue.listen_opt;
-	const u32 h = inet_synq_hash(inet_rsk(req)->rmt_addr, inet_rsk(req)->rmt_port,
-				     lopt->hash_rnd, lopt->nr_table_entries);
-
-	reqsk_queue_hash_req(&icsk->icsk_accept_queue, h, req, timeout);
-	inet_csk_reqsk_queue_added(sk, timeout);
-}
-
-/* Only thing we need from tcp.h */
-extern int sysctl_tcp_synack_retries;
-
-EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add);
-
-void inet_csk_reqsk_queue_prune(struct sock *parent,
-				const unsigned long interval,
-				const unsigned long timeout,
-				const unsigned long max_rto)
-{
-	struct inet_connection_sock *icsk = inet_csk(parent);
-	struct request_sock_queue *queue = &icsk->icsk_accept_queue;
-	struct listen_sock *lopt = queue->listen_opt;
-	int max_retries = icsk->icsk_syn_retries ? : sysctl_tcp_synack_retries;
-	int thresh = max_retries;
-	unsigned long now = jiffies;
-	struct request_sock **reqp, *req;
-	int i, budget;
-
-	if (lopt == NULL || lopt->qlen == 0)
-		return;
-
-	/* Normally all the openreqs are young and become mature
-	 * (i.e. converted to established socket) for first timeout.
-	 * If synack was not acknowledged for 3 seconds, it means
-	 * one of the following things: synack was lost, ack was lost,
-	 * rtt is high or nobody planned to ack (i.e. synflood).
-	 * When server is a bit loaded, queue is populated with old
-	 * open requests, reducing effective size of queue.
-	 * When server is well loaded, queue size reduces to zero
-	 * after several minutes of work. It is not synflood,
-	 * it is normal operation. The solution is pruning
-	 * too old entries overriding normal timeout, when
-	 * situation becomes dangerous.
-	 *
-	 * Essentially, we reserve half of room for young
-	 * embrions; and abort old ones without pity, if old
-	 * ones are about to clog our table.
-	 */
-	if (lopt->qlen>>(lopt->max_qlen_log-1)) {
-		int young = (lopt->qlen_young<<1);
-
-		while (thresh > 2) {
-			if (lopt->qlen < young)
-				break;
-			thresh--;
-			young <<= 1;
-		}
-	}
-
-	if (queue->rskq_defer_accept)
-		max_retries = queue->rskq_defer_accept;
-
-	budget = 2 * (lopt->nr_table_entries / (timeout / interval));
-	i = lopt->clock_hand;
-
-	do {
-		reqp=&lopt->syn_table[i];
-		while ((req = *reqp) != NULL) {
-			if (time_after_eq(now, req->expires)) {
-				if ((req->retrans < thresh ||
-				     (inet_rsk(req)->acked && req->retrans < max_retries))
-				    && !req->rsk_ops->rtx_syn_ack(parent, req, NULL)) {
-					unsigned long timeo;
-
-					if (req->retrans++ == 0)
-						lopt->qlen_young--;
-					timeo = min((timeout << req->retrans), max_rto);
-					req->expires = now + timeo;
-					reqp = &req->dl_next;
-					continue;
-				}
-
-				/* Drop this request */
-				inet_csk_reqsk_queue_unlink(parent, req, reqp);
-				reqsk_queue_removed(queue, req);
-				reqsk_free(req);
-				continue;
-			}
-			reqp = &req->dl_next;
-		}
-
-		i = (i + 1) & (lopt->nr_table_entries - 1);
-
-	} while (--budget > 0);
-
-	lopt->clock_hand = i;
-
-	if (lopt->qlen)
-		inet_csk_reset_keepalive_timer(parent, interval);
-}
-
-EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_prune);
-
-struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,
-			    const unsigned int __nocast priority)
-{
-	struct sock *newsk = sk_clone(sk, priority);
-
-	if (newsk != NULL) {
-		struct inet_connection_sock *newicsk = inet_csk(newsk);
-
-		newsk->sk_state = TCP_SYN_RECV;
-		newicsk->icsk_bind_hash = NULL;
-
-		inet_sk(newsk)->dport = inet_rsk(req)->rmt_port;
-		newsk->sk_write_space = sk_stream_write_space;
-
-		newicsk->icsk_retransmits = 0;
-		newicsk->icsk_backoff	  = 0;
-		newicsk->icsk_probes_out  = 0;
-
-		/* Deinitialize accept_queue to trap illegal accesses. */
-		memset(&newicsk->icsk_accept_queue, 0, sizeof(newicsk->icsk_accept_queue));
-	}
-	return newsk;
-}
-
-EXPORT_SYMBOL_GPL(inet_csk_clone);
-
-/*
- * At this point, there should be no process reference to this
- * socket, and thus no user references at all.  Therefore we
- * can assume the socket waitqueue is inactive and nobody will
- * try to jump onto it.
- */
-void inet_csk_destroy_sock(struct sock *sk)
-{
-	BUG_TRAP(sk->sk_state == TCP_CLOSE);
-	BUG_TRAP(sock_flag(sk, SOCK_DEAD));
-
-	/* It cannot be in hash table! */
-	BUG_TRAP(sk_unhashed(sk));
-
-	/* If it has not 0 inet_sk(sk)->num, it must be bound */
-	BUG_TRAP(!inet_sk(sk)->num || inet_csk(sk)->icsk_bind_hash);
-
-	sk->sk_prot->destroy(sk);
-
-	sk_stream_kill_queues(sk);
-
-	xfrm_sk_free_policy(sk);
-
-	sk_refcnt_debug_release(sk);
-
-	atomic_dec(sk->sk_prot->orphan_count);
-	sock_put(sk);
-}
-
-EXPORT_SYMBOL(inet_csk_destroy_sock);
-
-int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
-{
-	struct inet_sock *inet = inet_sk(sk);
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	int rc = reqsk_queue_alloc(&icsk->icsk_accept_queue, nr_table_entries);
-
-	if (rc != 0)
-		return rc;
-
-	sk->sk_max_ack_backlog = 0;
-	sk->sk_ack_backlog = 0;
-	inet_csk_delack_init(sk);
-
-	/* There is race window here: we announce ourselves listening,
-	 * but this transition is still not validated by get_port().
-	 * It is OK, because this socket enters to hash table only
-	 * after validation is complete.
-	 */
-	sk->sk_state = TCP_LISTEN;
-	if (!sk->sk_prot->get_port(sk, inet->num)) {
-		inet->sport = htons(inet->num);
-
-		sk_dst_reset(sk);
-		sk->sk_prot->hash(sk);
-
-		return 0;
-	}
-
-	sk->sk_state = TCP_CLOSE;
-	__reqsk_queue_destroy(&icsk->icsk_accept_queue);
-	return -EADDRINUSE;
-}
-
-EXPORT_SYMBOL_GPL(inet_csk_listen_start);
-
-/*
- *	This routine closes sockets which have been at least partially
- *	opened, but not yet accepted.
- */
-void inet_csk_listen_stop(struct sock *sk)
-{
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	struct request_sock *acc_req;
-	struct request_sock *req;
-
-	inet_csk_delete_keepalive_timer(sk);
-
-	/* make all the listen_opt local to us */
-	acc_req = reqsk_queue_yank_acceptq(&icsk->icsk_accept_queue);
-
-	/* Following specs, it would be better either to send FIN
-	 * (and enter FIN-WAIT-1, it is normal close)
-	 * or to send active reset (abort).
-	 * Certainly, it is pretty dangerous while synflood, but it is
-	 * bad justification for our negligence 8)
-	 * To be honest, we are not able to make either
-	 * of the variants now.			--ANK
-	 */
-	reqsk_queue_destroy(&icsk->icsk_accept_queue);
-
-	while ((req = acc_req) != NULL) {
-		struct sock *child = req->sk;
-
-		acc_req = req->dl_next;
-
-		local_bh_disable();
-		bh_lock_sock(child);
-		BUG_TRAP(!sock_owned_by_user(child));
-		sock_hold(child);
-
-		sk->sk_prot->disconnect(child, O_NONBLOCK);
-
-		sock_orphan(child);
-
-		atomic_inc(sk->sk_prot->orphan_count);
-
-		inet_csk_destroy_sock(child);
-
-		bh_unlock_sock(child);
-		local_bh_enable();
-		sock_put(child);
-
-		sk_acceptq_removed(sk);
-		__reqsk_free(req);
-	}
-	BUG_TRAP(!sk->sk_ack_backlog);
-}
-
-EXPORT_SYMBOL_GPL(inet_csk_listen_stop);
diff --git a/trunk/net/ipv4/inet_diag.c b/trunk/net/ipv4/inet_diag.c
deleted file mode 100644
index 71f3c7350c6e..000000000000
--- a/trunk/net/ipv4/inet_diag.c
+++ /dev/null
@@ -1,868 +0,0 @@
-/*
- * inet_diag.c	Module for monitoring INET transport protocols sockets.
- *
- * Version:	$Id: inet_diag.c,v 1.3 2002/02/01 22:01:04 davem Exp $
- *
- * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
- *
- *	This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/fcntl.h>
-#include <linux/random.h>
-#include <linux/cache.h>
-#include <linux/init.h>
-#include <linux/time.h>
-
-#include <net/icmp.h>
-#include <net/tcp.h>
-#include <net/ipv6.h>
-#include <net/inet_common.h>
-#include <net/inet_connection_sock.h>
-#include <net/inet_hashtables.h>
-#include <net/inet_timewait_sock.h>
-#include <net/inet6_hashtables.h>
-
-#include <linux/inet.h>
-#include <linux/stddef.h>
-
-#include <linux/inet_diag.h>
-
-static const struct inet_diag_handler **inet_diag_table;
-
-struct inet_diag_entry {
-	u32 *saddr;
-	u32 *daddr;
-	u16 sport;
-	u16 dport;
-	u16 family;
-	u16 userlocks;
-};
-
-static struct sock *idiagnl;
-
-#define INET_DIAG_PUT(skb, attrtype, attrlen) \
-	RTA_DATA(__RTA_PUT(skb, attrtype, attrlen))
-
-static int inet_diag_fill(struct sk_buff *skb, struct sock *sk,
-			int ext, u32 pid, u32 seq, u16 nlmsg_flags,
-			const struct nlmsghdr *unlh)
-{
-	const struct inet_sock *inet = inet_sk(sk);
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	struct inet_diag_msg *r;
-	struct nlmsghdr  *nlh;
-	void *info = NULL;
-	struct inet_diag_meminfo  *minfo = NULL;
-	unsigned char	 *b = skb->tail;
-	const struct inet_diag_handler *handler;
-
-	handler = inet_diag_table[unlh->nlmsg_type];
-	BUG_ON(handler == NULL);
-
-	nlh = NLMSG_PUT(skb, pid, seq, unlh->nlmsg_type, sizeof(*r));
-	nlh->nlmsg_flags = nlmsg_flags;
-
-	r = NLMSG_DATA(nlh);
-	if (sk->sk_state != TCP_TIME_WAIT) {
-		if (ext & (1 << (INET_DIAG_MEMINFO - 1)))
-			minfo = INET_DIAG_PUT(skb, INET_DIAG_MEMINFO,
-					      sizeof(*minfo));
-		if (ext & (1 << (INET_DIAG_INFO - 1)))
-			info = INET_DIAG_PUT(skb, INET_DIAG_INFO,
-					   handler->idiag_info_size);
-		
-		if ((ext & (1 << (INET_DIAG_CONG - 1))) && icsk->icsk_ca_ops) {
-			size_t len = strlen(icsk->icsk_ca_ops->name);
-			strcpy(INET_DIAG_PUT(skb, INET_DIAG_CONG, len + 1),
-			       icsk->icsk_ca_ops->name);
-		}
-	}
-	r->idiag_family = sk->sk_family;
-	r->idiag_state = sk->sk_state;
-	r->idiag_timer = 0;
-	r->idiag_retrans = 0;
-
-	r->id.idiag_if = sk->sk_bound_dev_if;
-	r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
-	r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
-
-	if (r->idiag_state == TCP_TIME_WAIT) {
-		const struct inet_timewait_sock *tw = inet_twsk(sk);
-		long tmo = tw->tw_ttd - jiffies;
-		if (tmo < 0)
-			tmo = 0;
-
-		r->id.idiag_sport = tw->tw_sport;
-		r->id.idiag_dport = tw->tw_dport;
-		r->id.idiag_src[0] = tw->tw_rcv_saddr;
-		r->id.idiag_dst[0] = tw->tw_daddr;
-		r->idiag_state = tw->tw_substate;
-		r->idiag_timer = 3;
-		r->idiag_expires = (tmo * 1000 + HZ - 1) / HZ;
-		r->idiag_rqueue = 0;
-		r->idiag_wqueue = 0;
-		r->idiag_uid = 0;
-		r->idiag_inode = 0;
-#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
-		if (r->idiag_family == AF_INET6) {
-			const struct tcp6_timewait_sock *tcp6tw = tcp6_twsk(sk);
-
-			ipv6_addr_copy((struct in6_addr *)r->id.idiag_src,
-				       &tcp6tw->tw_v6_rcv_saddr);
-			ipv6_addr_copy((struct in6_addr *)r->id.idiag_dst,
-				       &tcp6tw->tw_v6_daddr);
-		}
-#endif
-		nlh->nlmsg_len = skb->tail - b;
-		return skb->len;
-	}
-
-	r->id.idiag_sport = inet->sport;
-	r->id.idiag_dport = inet->dport;
-	r->id.idiag_src[0] = inet->rcv_saddr;
-	r->id.idiag_dst[0] = inet->daddr;
-
-#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
-	if (r->idiag_family == AF_INET6) {
-		struct ipv6_pinfo *np = inet6_sk(sk);
-
-		ipv6_addr_copy((struct in6_addr *)r->id.idiag_src,
-			       &np->rcv_saddr);
-		ipv6_addr_copy((struct in6_addr *)r->id.idiag_dst,
-			       &np->daddr);
-	}
-#endif
-
-#define EXPIRES_IN_MS(tmo)  ((tmo - jiffies) * 1000 + HZ - 1) / HZ
-
-	if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
-		r->idiag_timer = 1;
-		r->idiag_retrans = icsk->icsk_retransmits;
-		r->idiag_expires = EXPIRES_IN_MS(icsk->icsk_timeout);
-	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
-		r->idiag_timer = 4;
-		r->idiag_retrans = icsk->icsk_probes_out;
-		r->idiag_expires = EXPIRES_IN_MS(icsk->icsk_timeout);
-	} else if (timer_pending(&sk->sk_timer)) {
-		r->idiag_timer = 2;
-		r->idiag_retrans = icsk->icsk_probes_out;
-		r->idiag_expires = EXPIRES_IN_MS(sk->sk_timer.expires);
-	} else {
-		r->idiag_timer = 0;
-		r->idiag_expires = 0;
-	}
-#undef EXPIRES_IN_MS
-
-	r->idiag_uid = sock_i_uid(sk);
-	r->idiag_inode = sock_i_ino(sk);
-
-	if (minfo) {
-		minfo->idiag_rmem = atomic_read(&sk->sk_rmem_alloc);
-		minfo->idiag_wmem = sk->sk_wmem_queued;
-		minfo->idiag_fmem = sk->sk_forward_alloc;
-		minfo->idiag_tmem = atomic_read(&sk->sk_wmem_alloc);
-	}
-
-	handler->idiag_get_info(sk, r, info);
-
-	if (sk->sk_state < TCP_TIME_WAIT &&
-	    icsk->icsk_ca_ops && icsk->icsk_ca_ops->get_info)
-		icsk->icsk_ca_ops->get_info(sk, ext, skb);
-
-	nlh->nlmsg_len = skb->tail - b;
-	return skb->len;
-
-rtattr_failure:
-nlmsg_failure:
-	skb_trim(skb, b - skb->data);
-	return -1;
-}
-
-static int inet_diag_get_exact(struct sk_buff *in_skb, const struct nlmsghdr *nlh)
-{
-	int err;
-	struct sock *sk;
-	struct inet_diag_req *req = NLMSG_DATA(nlh);
-	struct sk_buff *rep;
-	struct inet_hashinfo *hashinfo;
-	const struct inet_diag_handler *handler;
-
-	handler = inet_diag_table[nlh->nlmsg_type];
-	BUG_ON(handler == NULL);
-	hashinfo = handler->idiag_hashinfo;
-
-	if (req->idiag_family == AF_INET) {
-		sk = inet_lookup(hashinfo, req->id.idiag_dst[0],
-				 req->id.idiag_dport, req->id.idiag_src[0],
-				 req->id.idiag_sport, req->id.idiag_if);
-	}
-#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
-	else if (req->idiag_family == AF_INET6) {
-		sk = inet6_lookup(hashinfo,
-				  (struct in6_addr *)req->id.idiag_dst,
-				  req->id.idiag_dport,
-				  (struct in6_addr *)req->id.idiag_src,
-				  req->id.idiag_sport,
-				  req->id.idiag_if);
-	}
-#endif
-	else {
-		return -EINVAL;
-	}
-
-	if (sk == NULL)
-		return -ENOENT;
-
-	err = -ESTALE;
-	if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
-	     req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
-	    ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
-	     (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
-		goto out;
-
-	err = -ENOMEM;
-	rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
-				     sizeof(struct inet_diag_meminfo) +
-				     handler->idiag_info_size + 64)),
-			GFP_KERNEL);
-	if (!rep)
-		goto out;
-
-	if (inet_diag_fill(rep, sk, req->idiag_ext,
-			 NETLINK_CB(in_skb).pid,
-			 nlh->nlmsg_seq, 0, nlh) <= 0)
-		BUG();
-
-	err = netlink_unicast(idiagnl, rep, NETLINK_CB(in_skb).pid,
-			      MSG_DONTWAIT);
-	if (err > 0)
-		err = 0;
-
-out:
-	if (sk) {
-		if (sk->sk_state == TCP_TIME_WAIT)
-			inet_twsk_put((struct inet_timewait_sock *)sk);
-		else
-			sock_put(sk);
-	}
-	return err;
-}
-
-static int bitstring_match(const u32 *a1, const u32 *a2, int bits)
-{
-	int words = bits >> 5;
-
-	bits &= 0x1f;
-
-	if (words) {
-		if (memcmp(a1, a2, words << 2))
-			return 0;
-	}
-	if (bits) {
-		__u32 w1, w2;
-		__u32 mask;
-
-		w1 = a1[words];
-		w2 = a2[words];
-
-		mask = htonl((0xffffffff) << (32 - bits));
-
-		if ((w1 ^ w2) & mask)
-			return 0;
-	}
-
-	return 1;
-}
-
-
-static int inet_diag_bc_run(const void *bc, int len,
-			  const struct inet_diag_entry *entry)
-{
-	while (len > 0) {
-		int yes = 1;
-		const struct inet_diag_bc_op *op = bc;
-
-		switch (op->code) {
-		case INET_DIAG_BC_NOP:
-			break;
-		case INET_DIAG_BC_JMP:
-			yes = 0;
-			break;
-		case INET_DIAG_BC_S_GE:
-			yes = entry->sport >= op[1].no;
-			break;
-		case INET_DIAG_BC_S_LE:
-			yes = entry->dport <= op[1].no;
-			break;
-		case INET_DIAG_BC_D_GE:
-			yes = entry->dport >= op[1].no;
-			break;
-		case INET_DIAG_BC_D_LE:
-			yes = entry->dport <= op[1].no;
-			break;
-		case INET_DIAG_BC_AUTO:
-			yes = !(entry->userlocks & SOCK_BINDPORT_LOCK);
-			break;
-		case INET_DIAG_BC_S_COND:
-		case INET_DIAG_BC_D_COND: {
-			struct inet_diag_hostcond *cond;
-			u32 *addr;
-
-			cond = (struct inet_diag_hostcond *)(op + 1);
-			if (cond->port != -1 &&
-			    cond->port != (op->code == INET_DIAG_BC_S_COND ?
-					     entry->sport : entry->dport)) {
-				yes = 0;
-				break;
-			}
-			
-			if (cond->prefix_len == 0)
-				break;
-
-			if (op->code == INET_DIAG_BC_S_COND)
-				addr = entry->saddr;
-			else
-				addr = entry->daddr;
-
-			if (bitstring_match(addr, cond->addr, cond->prefix_len))
-				break;
-			if (entry->family == AF_INET6 &&
-			    cond->family == AF_INET) {
-				if (addr[0] == 0 && addr[1] == 0 &&
-				    addr[2] == htonl(0xffff) &&
-				    bitstring_match(addr + 3, cond->addr,
-					    	    cond->prefix_len))
-					break;
-			}
-			yes = 0;
-			break;
-		}
-		}
-
-		if (yes) { 
-			len -= op->yes;
-			bc += op->yes;
-		} else {
-			len -= op->no;
-			bc += op->no;
-		}
-	}
-	return (len == 0);
-}
-
-static int valid_cc(const void *bc, int len, int cc)
-{
-	while (len >= 0) {
-		const struct inet_diag_bc_op *op = bc;
-
-		if (cc > len)
-			return 0;
-		if (cc == len)
-			return 1;
-		if (op->yes < 4)
-			return 0;
-		len -= op->yes;
-		bc  += op->yes;
-	}
-	return 0;
-}
-
-static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
-{
-	const unsigned char *bc = bytecode;
-	int  len = bytecode_len;
-
-	while (len > 0) {
-		struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc;
-
-//printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
-		switch (op->code) {
-		case INET_DIAG_BC_AUTO:
-		case INET_DIAG_BC_S_COND:
-		case INET_DIAG_BC_D_COND:
-		case INET_DIAG_BC_S_GE:
-		case INET_DIAG_BC_S_LE:
-		case INET_DIAG_BC_D_GE:
-		case INET_DIAG_BC_D_LE:
-			if (op->yes < 4 || op->yes > len + 4)
-				return -EINVAL;
-		case INET_DIAG_BC_JMP:
-			if (op->no < 4 || op->no > len + 4)
-				return -EINVAL;
-			if (op->no < len &&
-			    !valid_cc(bytecode, bytecode_len, len - op->no))
-				return -EINVAL;
-			break;
-		case INET_DIAG_BC_NOP:
-			if (op->yes < 4 || op->yes > len + 4)
-				return -EINVAL;
-			break;
-		default:
-			return -EINVAL;
-		}
-		bc += op->yes;
-		len -= op->yes;
-	}
-	return len == 0 ? 0 : -EINVAL;
-}
-
-static int inet_diag_dump_sock(struct sk_buff *skb, struct sock *sk,
-			     struct netlink_callback *cb)
-{
-	struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
-
-	if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
-		struct inet_diag_entry entry;
-		struct rtattr *bc = (struct rtattr *)(r + 1);
-		struct inet_sock *inet = inet_sk(sk);
-
-		entry.family = sk->sk_family;
-#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
-		if (entry.family == AF_INET6) {
-			struct ipv6_pinfo *np = inet6_sk(sk);
-
-			entry.saddr = np->rcv_saddr.s6_addr32;
-			entry.daddr = np->daddr.s6_addr32;
-		} else
-#endif
-		{
-			entry.saddr = &inet->rcv_saddr;
-			entry.daddr = &inet->daddr;
-		}
-		entry.sport = inet->num;
-		entry.dport = ntohs(inet->dport);
-		entry.userlocks = sk->sk_userlocks;
-
-		if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
-			return 0;
-	}
-
-	return inet_diag_fill(skb, sk, r->idiag_ext, NETLINK_CB(cb->skb).pid,
-			    cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
-}
-
-static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
-			    struct request_sock *req,
-			    u32 pid, u32 seq,
-			    const struct nlmsghdr *unlh)
-{
-	const struct inet_request_sock *ireq = inet_rsk(req);
-	struct inet_sock *inet = inet_sk(sk);
-	unsigned char *b = skb->tail;
-	struct inet_diag_msg *r;
-	struct nlmsghdr *nlh;
-	long tmo;
-
-	nlh = NLMSG_PUT(skb, pid, seq, unlh->nlmsg_type, sizeof(*r));
-	nlh->nlmsg_flags = NLM_F_MULTI;
-	r = NLMSG_DATA(nlh);
-
-	r->idiag_family = sk->sk_family;
-	r->idiag_state = TCP_SYN_RECV;
-	r->idiag_timer = 1;
-	r->idiag_retrans = req->retrans;
-
-	r->id.idiag_if = sk->sk_bound_dev_if;
-	r->id.idiag_cookie[0] = (u32)(unsigned long)req;
-	r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
-
-	tmo = req->expires - jiffies;
-	if (tmo < 0)
-		tmo = 0;
-
-	r->id.idiag_sport = inet->sport;
-	r->id.idiag_dport = ireq->rmt_port;
-	r->id.idiag_src[0] = ireq->loc_addr;
-	r->id.idiag_dst[0] = ireq->rmt_addr;
-	r->idiag_expires = jiffies_to_msecs(tmo);
-	r->idiag_rqueue = 0;
-	r->idiag_wqueue = 0;
-	r->idiag_uid = sock_i_uid(sk);
-	r->idiag_inode = 0;
-#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
-	if (r->idiag_family == AF_INET6) {
-		ipv6_addr_copy((struct in6_addr *)r->id.idiag_src,
-			       &tcp6_rsk(req)->loc_addr);
-		ipv6_addr_copy((struct in6_addr *)r->id.idiag_dst,
-			       &tcp6_rsk(req)->rmt_addr);
-	}
-#endif
-	nlh->nlmsg_len = skb->tail - b;
-
-	return skb->len;
-
-nlmsg_failure:
-	skb_trim(skb, b - skb->data);
-	return -1;
-}
-
-static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
-			     struct netlink_callback *cb)
-{
-	struct inet_diag_entry entry;
-	struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	struct listen_sock *lopt;
-	struct rtattr *bc = NULL;
-	struct inet_sock *inet = inet_sk(sk);
-	int j, s_j;
-	int reqnum, s_reqnum;
-	int err = 0;
-
-	s_j = cb->args[3];
-	s_reqnum = cb->args[4];
-
-	if (s_j > 0)
-		s_j--;
-
-	entry.family = sk->sk_family;
-
-	read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
-
-	lopt = icsk->icsk_accept_queue.listen_opt;
-	if (!lopt || !lopt->qlen)
-		goto out;
-
-	if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
-		bc = (struct rtattr *)(r + 1);
-		entry.sport = inet->num;
-		entry.userlocks = sk->sk_userlocks;
-	}
-
-	for (j = s_j; j < lopt->nr_table_entries; j++) {
-		struct request_sock *req, *head = lopt->syn_table[j];
-
-		reqnum = 0;
-		for (req = head; req; reqnum++, req = req->dl_next) {
-			struct inet_request_sock *ireq = inet_rsk(req);
-
-			if (reqnum < s_reqnum)
-				continue;
-			if (r->id.idiag_dport != ireq->rmt_port &&
-			    r->id.idiag_dport)
-				continue;
-
-			if (bc) {
-				entry.saddr =
-#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
-					(entry.family == AF_INET6) ?
-					tcp6_rsk(req)->loc_addr.s6_addr32 :
-#endif
-					&ireq->loc_addr;
-				entry.daddr = 
-#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
-					(entry.family == AF_INET6) ?
-					tcp6_rsk(req)->rmt_addr.s6_addr32 :
-#endif
-					&ireq->rmt_addr;
-				entry.dport = ntohs(ireq->rmt_port);
-
-				if (!inet_diag_bc_run(RTA_DATA(bc),
-						    RTA_PAYLOAD(bc), &entry))
-					continue;
-			}
-
-			err = inet_diag_fill_req(skb, sk, req,
-					       NETLINK_CB(cb->skb).pid,
-					       cb->nlh->nlmsg_seq, cb->nlh);
-			if (err < 0) {
-				cb->args[3] = j + 1;
-				cb->args[4] = reqnum;
-				goto out;
-			}
-		}
-
-		s_reqnum = 0;
-	}
-
-out:
-	read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
-
-	return err;
-}
-
-static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
-{
-	int i, num;
-	int s_i, s_num;
-	struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
-	const struct inet_diag_handler *handler;
-	struct inet_hashinfo *hashinfo;
-
-	handler = inet_diag_table[cb->nlh->nlmsg_type];
-	BUG_ON(handler == NULL);
-	hashinfo = handler->idiag_hashinfo;
-		
-	s_i = cb->args[1];
-	s_num = num = cb->args[2];
-
-	if (cb->args[0] == 0) {
-		if (!(r->idiag_states & (TCPF_LISTEN | TCPF_SYN_RECV)))
-			goto skip_listen_ht;
-
-		inet_listen_lock(hashinfo);
-		for (i = s_i; i < INET_LHTABLE_SIZE; i++) {
-			struct sock *sk;
-			struct hlist_node *node;
-
-			num = 0;
-			sk_for_each(sk, node, &hashinfo->listening_hash[i]) {
-				struct inet_sock *inet = inet_sk(sk);
-
-				if (num < s_num) {
-					num++;
-					continue;
-				}
-
-				if (r->id.idiag_sport != inet->sport &&
-				    r->id.idiag_sport)
-					goto next_listen;
-
-				if (!(r->idiag_states & TCPF_LISTEN) ||
-				    r->id.idiag_dport ||
-				    cb->args[3] > 0)
-					goto syn_recv;
-
-				if (inet_diag_dump_sock(skb, sk, cb) < 0) {
-					inet_listen_unlock(hashinfo);
-					goto done;
-				}
-
-syn_recv:
-				if (!(r->idiag_states & TCPF_SYN_RECV))
-					goto next_listen;
-
-				if (inet_diag_dump_reqs(skb, sk, cb) < 0) {
-					inet_listen_unlock(hashinfo);
-					goto done;
-				}
-
-next_listen:
-				cb->args[3] = 0;
-				cb->args[4] = 0;
-				++num;
-			}
-
-			s_num = 0;
-			cb->args[3] = 0;
-			cb->args[4] = 0;
-		}
-		inet_listen_unlock(hashinfo);
-skip_listen_ht:
-		cb->args[0] = 1;
-		s_i = num = s_num = 0;
-	}
-
-	if (!(r->idiag_states & ~(TCPF_LISTEN | TCPF_SYN_RECV)))
-		return skb->len;
-
-	for (i = s_i; i < hashinfo->ehash_size; i++) {
-		struct inet_ehash_bucket *head = &hashinfo->ehash[i];
-		struct sock *sk;
-		struct hlist_node *node;
-
-		if (i > s_i)
-			s_num = 0;
-
-		read_lock_bh(&head->lock);
-
-		num = 0;
-		sk_for_each(sk, node, &head->chain) {
-			struct inet_sock *inet = inet_sk(sk);
-
-			if (num < s_num)
-				goto next_normal;
-			if (!(r->idiag_states & (1 << sk->sk_state)))
-				goto next_normal;
-			if (r->id.idiag_sport != inet->sport &&
-			    r->id.idiag_sport)
-				goto next_normal;
-			if (r->id.idiag_dport != inet->dport && r->id.idiag_dport)
-				goto next_normal;
-			if (inet_diag_dump_sock(skb, sk, cb) < 0) {
-				read_unlock_bh(&head->lock);
-				goto done;
-			}
-next_normal:
-			++num;
-		}
-
-		if (r->idiag_states & TCPF_TIME_WAIT) {
-			sk_for_each(sk, node,
-				    &hashinfo->ehash[i + hashinfo->ehash_size].chain) {
-				struct inet_sock *inet = inet_sk(sk);
-
-				if (num < s_num)
-					goto next_dying;
-				if (r->id.idiag_sport != inet->sport &&
-				    r->id.idiag_sport)
-					goto next_dying;
-				if (r->id.idiag_dport != inet->dport &&
-				    r->id.idiag_dport)
-					goto next_dying;
-				if (inet_diag_dump_sock(skb, sk, cb) < 0) {
-					read_unlock_bh(&head->lock);
-					goto done;
-				}
-next_dying:
-				++num;
-			}
-		}
-		read_unlock_bh(&head->lock);
-	}
-
-done:
-	cb->args[1] = i;
-	cb->args[2] = num;
-	return skb->len;
-}
-
-static int inet_diag_dump_done(struct netlink_callback *cb)
-{
-	return 0;
-}
-
-
-static __inline__ int
-inet_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
-{
-	if (!(nlh->nlmsg_flags&NLM_F_REQUEST))
-		return 0;
-
-	if (nlh->nlmsg_type >= INET_DIAG_GETSOCK_MAX)
-		goto err_inval;
-
-	if (inet_diag_table[nlh->nlmsg_type] == NULL)
-		return -ENOENT;
-
-	if (NLMSG_LENGTH(sizeof(struct inet_diag_req)) > skb->len)
-		goto err_inval;
-
-	if (nlh->nlmsg_flags&NLM_F_DUMP) {
-		if (nlh->nlmsg_len >
-		    (4 + NLMSG_SPACE(sizeof(struct inet_diag_req)))) {
-			struct rtattr *rta = (void *)(NLMSG_DATA(nlh) +
-						 sizeof(struct inet_diag_req));
-			if (rta->rta_type != INET_DIAG_REQ_BYTECODE ||
-			    rta->rta_len < 8 ||
-			    rta->rta_len >
-			    (nlh->nlmsg_len -
-			     NLMSG_SPACE(sizeof(struct inet_diag_req))))
-				goto err_inval;
-			if (inet_diag_bc_audit(RTA_DATA(rta), RTA_PAYLOAD(rta)))
-				goto err_inval;
-		}
-		return netlink_dump_start(idiagnl, skb, nlh,
-					  inet_diag_dump,
-					  inet_diag_dump_done);
-	} else {
-		return inet_diag_get_exact(skb, nlh);
-	}
-
-err_inval:
-	return -EINVAL;
-}
-
-
-static inline void inet_diag_rcv_skb(struct sk_buff *skb)
-{
-	int err;
-	struct nlmsghdr * nlh;
-
-	if (skb->len >= NLMSG_SPACE(0)) {
-		nlh = (struct nlmsghdr *)skb->data;
-		if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
-			return;
-		err = inet_diag_rcv_msg(skb, nlh);
-		if (err || nlh->nlmsg_flags & NLM_F_ACK) 
-			netlink_ack(skb, nlh, err);
-	}
-}
-
-static void inet_diag_rcv(struct sock *sk, int len)
-{
-	struct sk_buff *skb;
-	unsigned int qlen = skb_queue_len(&sk->sk_receive_queue);
-
-	while (qlen-- && (skb = skb_dequeue(&sk->sk_receive_queue))) {
-		inet_diag_rcv_skb(skb);
-		kfree_skb(skb);
-	}
-}
-
-static DEFINE_SPINLOCK(inet_diag_register_lock);
-
-int inet_diag_register(const struct inet_diag_handler *h)
-{
-	const __u16 type = h->idiag_type;
-	int err = -EINVAL;
-
-	if (type >= INET_DIAG_GETSOCK_MAX)
-		goto out;
-
-	spin_lock(&inet_diag_register_lock);
-	err = -EEXIST;
-	if (inet_diag_table[type] == NULL) {
-		inet_diag_table[type] = h;
-		err = 0;
-	}
-	spin_unlock(&inet_diag_register_lock);
-out:
-	return err;
-}
-EXPORT_SYMBOL_GPL(inet_diag_register);
-
-void inet_diag_unregister(const struct inet_diag_handler *h)
-{
-	const __u16 type = h->idiag_type;
-
-	if (type >= INET_DIAG_GETSOCK_MAX)
-		return;
-
-	spin_lock(&inet_diag_register_lock);
-	inet_diag_table[type] = NULL;
-	spin_unlock(&inet_diag_register_lock);
-
-	synchronize_rcu();
-}
-EXPORT_SYMBOL_GPL(inet_diag_unregister);
-
-static int __init inet_diag_init(void)
-{
-	const int inet_diag_table_size = (INET_DIAG_GETSOCK_MAX *
-					  sizeof(struct inet_diag_handler *));
-	int err = -ENOMEM;
-
-	inet_diag_table = kmalloc(inet_diag_table_size, GFP_KERNEL);
-	if (!inet_diag_table)
-		goto out;
-
-	memset(inet_diag_table, 0, inet_diag_table_size);
-	idiagnl = netlink_kernel_create(NETLINK_INET_DIAG, 0, inet_diag_rcv,
-					THIS_MODULE);
-	if (idiagnl == NULL)
-		goto out_free_table;
-	err = 0;
-out:
-	return err;
-out_free_table:
-	kfree(inet_diag_table);
-	goto out;
-}
-
-static void __exit inet_diag_exit(void)
-{
-	sock_release(idiagnl->sk_socket);
-	kfree(inet_diag_table);
-}
-
-module_init(inet_diag_init);
-module_exit(inet_diag_exit);
-MODULE_LICENSE("GPL");
diff --git a/trunk/net/ipv4/inet_hashtables.c b/trunk/net/ipv4/inet_hashtables.c
deleted file mode 100644
index e8d29fe736d2..000000000000
--- a/trunk/net/ipv4/inet_hashtables.c
+++ /dev/null
@@ -1,165 +0,0 @@
-/*
- * INET		An implementation of the TCP/IP protocol suite for the LINUX
- *		operating system.  INET is implemented using the BSD Socket
- *		interface as the means of communication with the user level.
- *
- *		Generic INET transport hashtables
- *
- * Authors:	Lotsa people, from code originally in tcp
- *
- *	This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/wait.h>
-
-#include <net/inet_connection_sock.h>
-#include <net/inet_hashtables.h>
-
-/*
- * Allocate and initialize a new local port bind bucket.
- * The bindhash mutex for snum's hash chain must be held here.
- */
-struct inet_bind_bucket *inet_bind_bucket_create(kmem_cache_t *cachep,
-						 struct inet_bind_hashbucket *head,
-						 const unsigned short snum)
-{
-	struct inet_bind_bucket *tb = kmem_cache_alloc(cachep, SLAB_ATOMIC);
-
-	if (tb != NULL) {
-		tb->port      = snum;
-		tb->fastreuse = 0;
-		INIT_HLIST_HEAD(&tb->owners);
-		hlist_add_head(&tb->node, &head->chain);
-	}
-	return tb;
-}
-
-EXPORT_SYMBOL(inet_bind_bucket_create);
-
-/*
- * Caller must hold hashbucket lock for this tb with local BH disabled
- */
-void inet_bind_bucket_destroy(kmem_cache_t *cachep, struct inet_bind_bucket *tb)
-{
-	if (hlist_empty(&tb->owners)) {
-		__hlist_del(&tb->node);
-		kmem_cache_free(cachep, tb);
-	}
-}
-
-void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
-		    const unsigned short snum)
-{
-	inet_sk(sk)->num = snum;
-	sk_add_bind_node(sk, &tb->owners);
-	inet_csk(sk)->icsk_bind_hash = tb;
-}
-
-EXPORT_SYMBOL(inet_bind_hash);
-
-/*
- * Get rid of any references to a local port held by the given sock.
- */
-static void __inet_put_port(struct inet_hashinfo *hashinfo, struct sock *sk)
-{
-	const int bhash = inet_bhashfn(inet_sk(sk)->num, hashinfo->bhash_size);
-	struct inet_bind_hashbucket *head = &hashinfo->bhash[bhash];
-	struct inet_bind_bucket *tb;
-
-	spin_lock(&head->lock);
-	tb = inet_csk(sk)->icsk_bind_hash;
-	__sk_del_bind_node(sk);
-	inet_csk(sk)->icsk_bind_hash = NULL;
-	inet_sk(sk)->num = 0;
-	inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
-	spin_unlock(&head->lock);
-}
-
-void inet_put_port(struct inet_hashinfo *hashinfo, struct sock *sk)
-{
-	local_bh_disable();
-	__inet_put_port(hashinfo, sk);
-	local_bh_enable();
-}
-
-EXPORT_SYMBOL(inet_put_port);
-
-/*
- * This lock without WQ_FLAG_EXCLUSIVE is good on UP and it can be very bad on SMP.
- * Look, when several writers sleep and reader wakes them up, all but one
- * immediately hit write lock and grab all the cpus. Exclusive sleep solves
- * this, _but_ remember, it adds useless work on UP machines (wake up each
- * exclusive lock release). It should be ifdefed really.
- */
-void inet_listen_wlock(struct inet_hashinfo *hashinfo)
-{
-	write_lock(&hashinfo->lhash_lock);
-
-	if (atomic_read(&hashinfo->lhash_users)) {
-		DEFINE_WAIT(wait);
-
-		for (;;) {
-			prepare_to_wait_exclusive(&hashinfo->lhash_wait,
-						  &wait, TASK_UNINTERRUPTIBLE);
-			if (!atomic_read(&hashinfo->lhash_users))
-				break;
-			write_unlock_bh(&hashinfo->lhash_lock);
-			schedule();
-			write_lock_bh(&hashinfo->lhash_lock);
-		}
-
-		finish_wait(&hashinfo->lhash_wait, &wait);
-	}
-}
-
-EXPORT_SYMBOL(inet_listen_wlock);
-
-/*
- * Don't inline this cruft. Here are some nice properties to exploit here. The
- * BSD API does not allow a listening sock to specify the remote port nor the
- * remote address for the connection. So always assume those are both
- * wildcarded during the search since they can never be otherwise.
- */
-struct sock *__inet_lookup_listener(const struct hlist_head *head, const u32 daddr,
-				    const unsigned short hnum, const int dif)
-{
-	struct sock *result = NULL, *sk;
-	const struct hlist_node *node;
-	int hiscore = -1;
-
-	sk_for_each(sk, node, head) {
-		const struct inet_sock *inet = inet_sk(sk);
-
-		if (inet->num == hnum && !ipv6_only_sock(sk)) {
-			const __u32 rcv_saddr = inet->rcv_saddr;
-			int score = sk->sk_family == PF_INET ? 1 : 0;
-
-			if (rcv_saddr) {
-				if (rcv_saddr != daddr)
-					continue;
-				score += 2;
-			}
-			if (sk->sk_bound_dev_if) {
-				if (sk->sk_bound_dev_if != dif)
-					continue;
-				score += 2;
-			}
-			if (score == 5)
-				return sk;
-			if (score > hiscore) {
-				hiscore	= score;
-				result	= sk;
-			}
-		}
-	}
-	return result;
-}
-
-EXPORT_SYMBOL_GPL(__inet_lookup_listener);
diff --git a/trunk/net/ipv4/inet_timewait_sock.c b/trunk/net/ipv4/inet_timewait_sock.c
deleted file mode 100644
index 4d1502a49852..000000000000
--- a/trunk/net/ipv4/inet_timewait_sock.c
+++ /dev/null
@@ -1,384 +0,0 @@
-/*
- * INET		An implementation of the TCP/IP protocol suite for the LINUX
- *		operating system.  INET is implemented using the  BSD Socket
- *		interface as the means of communication with the user level.
- *
- *		Generic TIME_WAIT sockets functions
- *
- *		From code orinally in TCP
- */
-
-#include <linux/config.h>
-
-#include <net/inet_hashtables.h>
-#include <net/inet_timewait_sock.h>
-#include <net/ip.h>
-
-/* Must be called with locally disabled BHs. */
-void __inet_twsk_kill(struct inet_timewait_sock *tw, struct inet_hashinfo *hashinfo)
-{
-	struct inet_bind_hashbucket *bhead;
-	struct inet_bind_bucket *tb;
-	/* Unlink from established hashes. */
-	struct inet_ehash_bucket *ehead = &hashinfo->ehash[tw->tw_hashent];
-
-	write_lock(&ehead->lock);
-	if (hlist_unhashed(&tw->tw_node)) {
-		write_unlock(&ehead->lock);
-		return;
-	}
-	__hlist_del(&tw->tw_node);
-	sk_node_init(&tw->tw_node);
-	write_unlock(&ehead->lock);
-
-	/* Disassociate with bind bucket. */
-	bhead = &hashinfo->bhash[inet_bhashfn(tw->tw_num, hashinfo->bhash_size)];
-	spin_lock(&bhead->lock);
-	tb = tw->tw_tb;
-	__hlist_del(&tw->tw_bind_node);
-	tw->tw_tb = NULL;
-	inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
-	spin_unlock(&bhead->lock);
-#ifdef SOCK_REFCNT_DEBUG
-	if (atomic_read(&tw->tw_refcnt) != 1) {
-		printk(KERN_DEBUG "%s timewait_sock %p refcnt=%d\n",
-		       tw->tw_prot->name, tw, atomic_read(&tw->tw_refcnt));
-	}
-#endif
-	inet_twsk_put(tw);
-}
-
-EXPORT_SYMBOL_GPL(__inet_twsk_kill);
-
-/*
- * Enter the time wait state. This is called with locally disabled BH.
- * Essentially we whip up a timewait bucket, copy the relevant info into it
- * from the SK, and mess with hash chains and list linkage.
- */
-void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
-			   struct inet_hashinfo *hashinfo)
-{
-	const struct inet_sock *inet = inet_sk(sk);
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	struct inet_ehash_bucket *ehead = &hashinfo->ehash[sk->sk_hashent];
-	struct inet_bind_hashbucket *bhead;
-	/* Step 1: Put TW into bind hash. Original socket stays there too.
-	   Note, that any socket with inet->num != 0 MUST be bound in
-	   binding cache, even if it is closed.
-	 */
-	bhead = &hashinfo->bhash[inet_bhashfn(inet->num, hashinfo->bhash_size)];
-	spin_lock(&bhead->lock);
-	tw->tw_tb = icsk->icsk_bind_hash;
-	BUG_TRAP(icsk->icsk_bind_hash);
-	inet_twsk_add_bind_node(tw, &tw->tw_tb->owners);
-	spin_unlock(&bhead->lock);
-
-	write_lock(&ehead->lock);
-
-	/* Step 2: Remove SK from established hash. */
-	if (__sk_del_node_init(sk))
-		sock_prot_dec_use(sk->sk_prot);
-
-	/* Step 3: Hash TW into TIMEWAIT half of established hash table. */
-	inet_twsk_add_node(tw, &(ehead + hashinfo->ehash_size)->chain);
-	atomic_inc(&tw->tw_refcnt);
-
-	write_unlock(&ehead->lock);
-}
-
-EXPORT_SYMBOL_GPL(__inet_twsk_hashdance);
-
-struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int state)
-{
-	struct inet_timewait_sock *tw = kmem_cache_alloc(sk->sk_prot_creator->twsk_slab,
-							 SLAB_ATOMIC);
-	if (tw != NULL) {
-		const struct inet_sock *inet = inet_sk(sk);
-
-		/* Give us an identity. */
-		tw->tw_daddr	    = inet->daddr;
-		tw->tw_rcv_saddr    = inet->rcv_saddr;
-		tw->tw_bound_dev_if = sk->sk_bound_dev_if;
-		tw->tw_num	    = inet->num;
-		tw->tw_state	    = TCP_TIME_WAIT;
-		tw->tw_substate	    = state;
-		tw->tw_sport	    = inet->sport;
-		tw->tw_dport	    = inet->dport;
-		tw->tw_family	    = sk->sk_family;
-		tw->tw_reuse	    = sk->sk_reuse;
-		tw->tw_hashent	    = sk->sk_hashent;
-		tw->tw_ipv6only	    = 0;
-		tw->tw_prot	    = sk->sk_prot_creator;
-		atomic_set(&tw->tw_refcnt, 1);
-		inet_twsk_dead_node_init(tw);
-	}
-
-	return tw;
-}
-
-EXPORT_SYMBOL_GPL(inet_twsk_alloc);
-
-/* Returns non-zero if quota exceeded.  */
-static int inet_twdr_do_twkill_work(struct inet_timewait_death_row *twdr,
-				    const int slot)
-{
-	struct inet_timewait_sock *tw;
-	struct hlist_node *node;
-	unsigned int killed;
-	int ret;
-
-	/* NOTE: compare this to previous version where lock
-	 * was released after detaching chain. It was racy,
-	 * because tw buckets are scheduled in not serialized context
-	 * in 2.3 (with netfilter), and with softnet it is common, because
-	 * soft irqs are not sequenced.
-	 */
-	killed = 0;
-	ret = 0;
-rescan:
-	inet_twsk_for_each_inmate(tw, node, &twdr->cells[slot]) {
-		__inet_twsk_del_dead_node(tw);
-		spin_unlock(&twdr->death_lock);
-		__inet_twsk_kill(tw, twdr->hashinfo);
-		inet_twsk_put(tw);
-		killed++;
-		spin_lock(&twdr->death_lock);
-		if (killed > INET_TWDR_TWKILL_QUOTA) {
-			ret = 1;
-			break;
-		}
-
-		/* While we dropped twdr->death_lock, another cpu may have
-		 * killed off the next TW bucket in the list, therefore
-		 * do a fresh re-read of the hlist head node with the
-		 * lock reacquired.  We still use the hlist traversal
-		 * macro in order to get the prefetches.
-		 */
-		goto rescan;
-	}
-
-	twdr->tw_count -= killed;
-	NET_ADD_STATS_BH(LINUX_MIB_TIMEWAITED, killed);
-
-	return ret;
-}
-
-void inet_twdr_hangman(unsigned long data)
-{
-	struct inet_timewait_death_row *twdr;
-	int unsigned need_timer;
-
-	twdr = (struct inet_timewait_death_row *)data;
-	spin_lock(&twdr->death_lock);
-
-	if (twdr->tw_count == 0)
-		goto out;
-
-	need_timer = 0;
-	if (inet_twdr_do_twkill_work(twdr, twdr->slot)) {
-		twdr->thread_slots |= (1 << twdr->slot);
-		mb();
-		schedule_work(&twdr->twkill_work);
-		need_timer = 1;
-	} else {
-		/* We purged the entire slot, anything left?  */
-		if (twdr->tw_count)
-			need_timer = 1;
-	}
-	twdr->slot = ((twdr->slot + 1) & (INET_TWDR_TWKILL_SLOTS - 1));
-	if (need_timer)
-		mod_timer(&twdr->tw_timer, jiffies + twdr->period);
-out:
-	spin_unlock(&twdr->death_lock);
-}
-
-EXPORT_SYMBOL_GPL(inet_twdr_hangman);
-
-extern void twkill_slots_invalid(void);
-
-void inet_twdr_twkill_work(void *data)
-{
-	struct inet_timewait_death_row *twdr = data;
-	int i;
-
-	if ((INET_TWDR_TWKILL_SLOTS - 1) > (sizeof(twdr->thread_slots) * 8))
-		twkill_slots_invalid();
-
-	while (twdr->thread_slots) {
-		spin_lock_bh(&twdr->death_lock);
-		for (i = 0; i < INET_TWDR_TWKILL_SLOTS; i++) {
-			if (!(twdr->thread_slots & (1 << i)))
-				continue;
-
-			while (inet_twdr_do_twkill_work(twdr, i) != 0) {
-				if (need_resched()) {
-					spin_unlock_bh(&twdr->death_lock);
-					schedule();
-					spin_lock_bh(&twdr->death_lock);
-				}
-			}
-
-			twdr->thread_slots &= ~(1 << i);
-		}
-		spin_unlock_bh(&twdr->death_lock);
-	}
-}
-
-EXPORT_SYMBOL_GPL(inet_twdr_twkill_work);
-
-/* These are always called from BH context.  See callers in
- * tcp_input.c to verify this.
- */
-
-/* This is for handling early-kills of TIME_WAIT sockets. */
-void inet_twsk_deschedule(struct inet_timewait_sock *tw,
-			  struct inet_timewait_death_row *twdr)
-{
-	spin_lock(&twdr->death_lock);
-	if (inet_twsk_del_dead_node(tw)) {
-		inet_twsk_put(tw);
-		if (--twdr->tw_count == 0)
-			del_timer(&twdr->tw_timer);
-	}
-	spin_unlock(&twdr->death_lock);
-	__inet_twsk_kill(tw, twdr->hashinfo);
-}
-
-EXPORT_SYMBOL(inet_twsk_deschedule);
-
-void inet_twsk_schedule(struct inet_timewait_sock *tw,
-		       struct inet_timewait_death_row *twdr,
-		       const int timeo, const int timewait_len)
-{
-	struct hlist_head *list;
-	int slot;
-
-	/* timeout := RTO * 3.5
-	 *
-	 * 3.5 = 1+2+0.5 to wait for two retransmits.
-	 *
-	 * RATIONALE: if FIN arrived and we entered TIME-WAIT state,
-	 * our ACK acking that FIN can be lost. If N subsequent retransmitted
-	 * FINs (or previous seqments) are lost (probability of such event
-	 * is p^(N+1), where p is probability to lose single packet and
-	 * time to detect the loss is about RTO*(2^N - 1) with exponential
-	 * backoff). Normal timewait length is calculated so, that we
-	 * waited at least for one retransmitted FIN (maximal RTO is 120sec).
-	 * [ BTW Linux. following BSD, violates this requirement waiting
-	 *   only for 60sec, we should wait at least for 240 secs.
-	 *   Well, 240 consumes too much of resources 8)
-	 * ]
-	 * This interval is not reduced to catch old duplicate and
-	 * responces to our wandering segments living for two MSLs.
-	 * However, if we use PAWS to detect
-	 * old duplicates, we can reduce the interval to bounds required
-	 * by RTO, rather than MSL. So, if peer understands PAWS, we
-	 * kill tw bucket after 3.5*RTO (it is important that this number
-	 * is greater than TS tick!) and detect old duplicates with help
-	 * of PAWS.
-	 */
-	slot = (timeo + (1 << INET_TWDR_RECYCLE_TICK) - 1) >> INET_TWDR_RECYCLE_TICK;
-
-	spin_lock(&twdr->death_lock);
-
-	/* Unlink it, if it was scheduled */
-	if (inet_twsk_del_dead_node(tw))
-		twdr->tw_count--;
-	else
-		atomic_inc(&tw->tw_refcnt);
-
-	if (slot >= INET_TWDR_RECYCLE_SLOTS) {
-		/* Schedule to slow timer */
-		if (timeo >= timewait_len) {
-			slot = INET_TWDR_TWKILL_SLOTS - 1;
-		} else {
-			slot = (timeo + twdr->period - 1) / twdr->period;
-			if (slot >= INET_TWDR_TWKILL_SLOTS)
-				slot = INET_TWDR_TWKILL_SLOTS - 1;
-		}
-		tw->tw_ttd = jiffies + timeo;
-		slot = (twdr->slot + slot) & (INET_TWDR_TWKILL_SLOTS - 1);
-		list = &twdr->cells[slot];
-	} else {
-		tw->tw_ttd = jiffies + (slot << INET_TWDR_RECYCLE_TICK);
-
-		if (twdr->twcal_hand < 0) {
-			twdr->twcal_hand = 0;
-			twdr->twcal_jiffie = jiffies;
-			twdr->twcal_timer.expires = twdr->twcal_jiffie +
-					      (slot << INET_TWDR_RECYCLE_TICK);
-			add_timer(&twdr->twcal_timer);
-		} else {
-			if (time_after(twdr->twcal_timer.expires,
-				       jiffies + (slot << INET_TWDR_RECYCLE_TICK)))
-				mod_timer(&twdr->twcal_timer,
-					  jiffies + (slot << INET_TWDR_RECYCLE_TICK));
-			slot = (twdr->twcal_hand + slot) & (INET_TWDR_RECYCLE_SLOTS - 1);
-		}
-		list = &twdr->twcal_row[slot];
-	}
-
-	hlist_add_head(&tw->tw_death_node, list);
-
-	if (twdr->tw_count++ == 0)
-		mod_timer(&twdr->tw_timer, jiffies + twdr->period);
-	spin_unlock(&twdr->death_lock);
-}
-
-EXPORT_SYMBOL_GPL(inet_twsk_schedule);
-
-void inet_twdr_twcal_tick(unsigned long data)
-{
-	struct inet_timewait_death_row *twdr;
-	int n, slot;
-	unsigned long j;
-	unsigned long now = jiffies;
-	int killed = 0;
-	int adv = 0;
-
-	twdr = (struct inet_timewait_death_row *)data;
-
-	spin_lock(&twdr->death_lock);
-	if (twdr->twcal_hand < 0)
-		goto out;
-
-	slot = twdr->twcal_hand;
-	j = twdr->twcal_jiffie;
-
-	for (n = 0; n < INET_TWDR_RECYCLE_SLOTS; n++) {
-		if (time_before_eq(j, now)) {
-			struct hlist_node *node, *safe;
-			struct inet_timewait_sock *tw;
-
-			inet_twsk_for_each_inmate_safe(tw, node, safe,
-						       &twdr->twcal_row[slot]) {
-				__inet_twsk_del_dead_node(tw);
-				__inet_twsk_kill(tw, twdr->hashinfo);
-				inet_twsk_put(tw);
-				killed++;
-			}
-		} else {
-			if (!adv) {
-				adv = 1;
-				twdr->twcal_jiffie = j;
-				twdr->twcal_hand = slot;
-			}
-
-			if (!hlist_empty(&twdr->twcal_row[slot])) {
-				mod_timer(&twdr->twcal_timer, j);
-				goto out;
-			}
-		}
-		j += 1 << INET_TWDR_RECYCLE_TICK;
-		slot = (slot + 1) & (INET_TWDR_RECYCLE_SLOTS - 1);
-	}
-	twdr->twcal_hand = -1;
-
-out:
-	if ((twdr->tw_count -= killed) == 0)
-		del_timer(&twdr->tw_timer);
-	NET_ADD_STATS_BH(LINUX_MIB_TIMEWAITKILLED, killed);
-	spin_unlock(&twdr->death_lock);
-}
-
-EXPORT_SYMBOL_GPL(inet_twdr_twcal_tick);
diff --git a/trunk/net/ipv4/inetpeer.c b/trunk/net/ipv4/inetpeer.c
index f84ba9c96551..ab18a853d7ce 100644
--- a/trunk/net/ipv4/inetpeer.c
+++ b/trunk/net/ipv4/inetpeer.c
@@ -20,7 +20,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/net.h>
-#include <net/ip.h>
 #include <net/inetpeer.h>
 
 /*
@@ -73,7 +72,7 @@
 /* Exported for inet_getid inline function.  */
 DEFINE_SPINLOCK(inet_peer_idlock);
 
-static kmem_cache_t *peer_cachep __read_mostly;
+static kmem_cache_t *peer_cachep;
 
 #define node_height(x) x->avl_height
 static struct inet_peer peer_fake_node = {
@@ -460,3 +459,5 @@ static void peer_check_expire(unsigned long dummy)
 				peer_total / inet_peer_threshold * HZ;
 	add_timer(&peer_periodic_timer);
 }
+
+EXPORT_SYMBOL(inet_peer_idlock);
diff --git a/trunk/net/ipv4/ip_forward.c b/trunk/net/ipv4/ip_forward.c
index 0923add122b4..77094aac6c28 100644
--- a/trunk/net/ipv4/ip_forward.c
+++ b/trunk/net/ipv4/ip_forward.c
@@ -76,12 +76,16 @@ int ip_forward(struct sk_buff *skb)
 	 *	that reaches zero, we must reply an ICMP control message telling
 	 *	that the packet's lifetime expired.
 	 */
-	if (skb->nh.iph->ttl <= 1)
+
+	iph = skb->nh.iph;
+
+	if (iph->ttl <= 1)
                 goto too_many_hops;
 
 	if (!xfrm4_route_forward(skb))
 		goto drop;
 
+	iph = skb->nh.iph;
 	rt = (struct rtable*)skb->dst;
 
 	if (opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
diff --git a/trunk/net/ipv4/ip_fragment.c b/trunk/net/ipv4/ip_fragment.c
index 9e6e683cc34d..eb377ae15305 100644
--- a/trunk/net/ipv4/ip_fragment.c
+++ b/trunk/net/ipv4/ip_fragment.c
@@ -377,7 +377,7 @@ static struct ipq *ip_frag_create(unsigned hash, struct iphdr *iph, u32 user)
 	return ip_frag_intern(hash, qp);
 
 out_nomem:
-	LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n");
+	LIMIT_NETDEBUG(printk(KERN_ERR "ip_frag_create: no memory left !\n"));
 	return NULL;
 }
 
@@ -533,7 +533,7 @@ static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
  	if (skb->dev)
  		qp->iif = skb->dev->ifindex;
 	skb->dev = NULL;
-	skb_get_timestamp(skb, &qp->stamp);
+	qp->stamp = skb->stamp;
 	qp->meat += skb->len;
 	atomic_add(skb->truesize, &ip_frag_mem);
 	if (offset == 0)
@@ -615,7 +615,7 @@ static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
 
 	head->next = NULL;
 	head->dev = dev;
-	skb_set_timestamp(head, &qp->stamp);
+	head->stamp = qp->stamp;
 
 	iph = head->nh.iph;
 	iph->frag_off = 0;
@@ -625,8 +625,8 @@ static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
 	return head;
 
 out_nomem:
- 	LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing "
-			      "queue %p\n", qp);
+ 	LIMIT_NETDEBUG(printk(KERN_ERR "IP: queue_glue: no memory for gluing "
+			      "queue %p\n", qp));
 	goto out_fail;
 out_oversize:
 	if (net_ratelimit())
diff --git a/trunk/net/ipv4/ip_input.c b/trunk/net/ipv4/ip_input.c
index 473d0f2b2e0d..c703528e0bcd 100644
--- a/trunk/net/ipv4/ip_input.c
+++ b/trunk/net/ipv4/ip_input.c
@@ -150,7 +150,7 @@
  *	SNMP management statistics
  */
 
-DEFINE_SNMP_STAT(struct ipstats_mib, ip_statistics) __read_mostly;
+DEFINE_SNMP_STAT(struct ipstats_mib, ip_statistics);
 
 /*
  *	Process Router Attention IP option
@@ -225,8 +225,8 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb)
 		/* If there maybe a raw socket we must check - if not we
 		 * don't care less
 		 */
-		if (raw_sk && !raw_v4_input(skb, skb->nh.iph, hash))
-			raw_sk = NULL;
+		if (raw_sk)
+			raw_v4_input(skb, skb->nh.iph, hash);
 
 		if ((ipprot = rcu_dereference(inet_protos[hash])) != NULL) {
 			int ret;
@@ -279,70 +279,18 @@ int ip_local_deliver(struct sk_buff *skb)
 		       ip_local_deliver_finish);
 }
 
-static inline int ip_rcv_options(struct sk_buff *skb)
-{
-	struct ip_options *opt;
-	struct iphdr *iph;
-	struct net_device *dev = skb->dev;
-
-	/* It looks as overkill, because not all
-	   IP options require packet mangling.
-	   But it is the easiest for now, especially taking
-	   into account that combination of IP options
-	   and running sniffer is extremely rare condition.
-					      --ANK (980813)
-	*/
-	if (skb_cow(skb, skb_headroom(skb))) {
-		IP_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
-		goto drop;
-	}
-
-	iph = skb->nh.iph;
-
-	if (ip_options_compile(NULL, skb)) {
-		IP_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
-		goto drop;
-	}
-
-	opt = &(IPCB(skb)->opt);
-	if (unlikely(opt->srr)) {
-		struct in_device *in_dev = in_dev_get(dev);
-		if (in_dev) {
-			if (!IN_DEV_SOURCE_ROUTE(in_dev)) {
-				if (IN_DEV_LOG_MARTIANS(in_dev) &&
-				    net_ratelimit())
-					printk(KERN_INFO "source route option "
-					       "%u.%u.%u.%u -> %u.%u.%u.%u\n",
-					       NIPQUAD(iph->saddr),
-					       NIPQUAD(iph->daddr));
-				in_dev_put(in_dev);
-				goto drop;
-			}
-
-			in_dev_put(in_dev);
-		}
-
-		if (ip_options_rcv_srr(skb))
-			goto drop;
-	}
-
-	return 0;
-drop:
-	return -1;
-}
-
 static inline int ip_rcv_finish(struct sk_buff *skb)
 {
+	struct net_device *dev = skb->dev;
 	struct iphdr *iph = skb->nh.iph;
+	int err;
 
 	/*
 	 *	Initialise the virtual path cache for the packet. It describes
 	 *	how the packet travels inside Linux networking.
 	 */ 
-	if (likely(skb->dst == NULL)) {
-		int err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
-					 skb->dev);
-		if (unlikely(err)) {
+	if (skb->dst == NULL) {
+		if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
 			if (err == -EHOSTUNREACH)
 				IP_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
 			goto drop; 
@@ -350,7 +298,7 @@ static inline int ip_rcv_finish(struct sk_buff *skb)
 	}
 
 #ifdef CONFIG_NET_CLS_ROUTE
-	if (unlikely(skb->dst->tclassid)) {
+	if (skb->dst->tclassid) {
 		struct ip_rt_acct *st = ip_rt_acct + 256*smp_processor_id();
 		u32 idx = skb->dst->tclassid;
 		st[idx&0xFF].o_packets++;
@@ -360,11 +308,48 @@ static inline int ip_rcv_finish(struct sk_buff *skb)
 	}
 #endif
 
-	if (iph->ihl > 5 && ip_rcv_options(skb))
-		goto drop;
+	if (iph->ihl > 5) {
+		struct ip_options *opt;
+
+		/* It looks as overkill, because not all
+		   IP options require packet mangling.
+		   But it is the easiest for now, especially taking
+		   into account that combination of IP options
+		   and running sniffer is extremely rare condition.
+		                                      --ANK (980813)
+		*/
+
+		if (skb_cow(skb, skb_headroom(skb))) {
+			IP_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
+			goto drop;
+		}
+		iph = skb->nh.iph;
+
+		if (ip_options_compile(NULL, skb))
+			goto inhdr_error;
+
+		opt = &(IPCB(skb)->opt);
+		if (opt->srr) {
+			struct in_device *in_dev = in_dev_get(dev);
+			if (in_dev) {
+				if (!IN_DEV_SOURCE_ROUTE(in_dev)) {
+					if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit())
+						printk(KERN_INFO "source route option %u.%u.%u.%u -> %u.%u.%u.%u\n",
+						       NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
+					in_dev_put(in_dev);
+					goto drop;
+				}
+				in_dev_put(in_dev);
+			}
+			if (ip_options_rcv_srr(skb))
+				goto drop;
+		}
+	}
 
 	return dst_input(skb);
 
+inhdr_error:
+	IP_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 drop:
         kfree_skb(skb);
         return NET_RX_DROP;
@@ -373,10 +358,9 @@ static inline int ip_rcv_finish(struct sk_buff *skb)
 /*
  * 	Main IP Receive routine.
  */ 
-int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 {
 	struct iphdr *iph;
-	u32 len;
 
 	/* When the interface is in promisc. mode, drop all the crap
 	 * that it receives, do not try to analyse it.
@@ -408,27 +392,29 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
 	 */
 
 	if (iph->ihl < 5 || iph->version != 4)
-		goto inhdr_error;
+		goto inhdr_error; 
 
 	if (!pskb_may_pull(skb, iph->ihl*4))
 		goto inhdr_error;
 
 	iph = skb->nh.iph;
 
-	if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
-		goto inhdr_error;
+	if (ip_fast_csum((u8 *)iph, iph->ihl) != 0)
+		goto inhdr_error; 
 
-	len = ntohs(iph->tot_len);
-	if (skb->len < len || len < (iph->ihl*4))
-		goto inhdr_error;
+	{
+		__u32 len = ntohs(iph->tot_len); 
+		if (skb->len < len || len < (iph->ihl<<2))
+			goto inhdr_error;
 
-	/* Our transport medium may have padded the buffer out. Now we know it
-	 * is IP we can trim to the true length of the frame.
-	 * Note this now means skb->len holds ntohs(iph->tot_len).
-	 */
-	if (pskb_trim_rcsum(skb, len)) {
-		IP_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
-		goto drop;
+		/* Our transport medium may have padded the buffer out. Now we know it
+		 * is IP we can trim to the true length of the frame.
+		 * Note this now means skb->len holds ntohs(iph->tot_len).
+		 */
+		if (pskb_trim_rcsum(skb, len)) {
+			IP_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
+			goto drop;
+		}
 	}
 
 	return NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL,
@@ -442,4 +428,5 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
         return NET_RX_DROP;
 }
 
+EXPORT_SYMBOL(ip_rcv);
 EXPORT_SYMBOL(ip_statistics);
diff --git a/trunk/net/ipv4/ip_options.c b/trunk/net/ipv4/ip_options.c
index bce4e875193b..6d89f3f3e701 100644
--- a/trunk/net/ipv4/ip_options.c
+++ b/trunk/net/ipv4/ip_options.c
@@ -489,18 +489,23 @@ void ip_options_undo(struct ip_options * opt)
 	}
 }
 
-static struct ip_options *ip_options_get_alloc(const int optlen)
+int ip_options_get(struct ip_options **optp, unsigned char *data, int optlen, int user)
 {
-	struct ip_options *opt = kmalloc(sizeof(*opt) + ((optlen + 3) & ~3),
-					 GFP_KERNEL);
-	if (opt)
-		memset(opt, 0, sizeof(*opt));
-	return opt;
-}
+	struct ip_options *opt;
 
-static int ip_options_get_finish(struct ip_options **optp,
-				 struct ip_options *opt, int optlen)
-{
+	opt = kmalloc(sizeof(struct ip_options)+((optlen+3)&~3), GFP_KERNEL);
+	if (!opt)
+		return -ENOMEM;
+	memset(opt, 0, sizeof(struct ip_options));
+	if (optlen) {
+		if (user) {
+			if (copy_from_user(opt->__data, data, optlen)) {
+				kfree(opt);
+				return -EFAULT;
+			}
+		} else
+			memcpy(opt->__data, data, optlen);
+	}
 	while (optlen & 3)
 		opt->__data[optlen++] = IPOPT_END;
 	opt->optlen = optlen;
@@ -516,30 +521,6 @@ static int ip_options_get_finish(struct ip_options **optp,
 	return 0;
 }
 
-int ip_options_get_from_user(struct ip_options **optp, unsigned char __user *data, int optlen)
-{
-	struct ip_options *opt = ip_options_get_alloc(optlen);
-
-	if (!opt)
-		return -ENOMEM;
-	if (optlen && copy_from_user(opt->__data, data, optlen)) {
-		kfree(opt);
-		return -EFAULT;
-	}
-	return ip_options_get_finish(optp, opt, optlen);
-}
-
-int ip_options_get(struct ip_options **optp, unsigned char *data, int optlen)
-{
-	struct ip_options *opt = ip_options_get_alloc(optlen);
-
-	if (!opt)
-		return -ENOMEM;
-	if (optlen)
-		memcpy(opt->__data, data, optlen);
-	return ip_options_get_finish(optp, opt, optlen);
-}
-
 void ip_forward_options(struct sk_buff *skb)
 {
 	struct   ip_options * opt	= &(IPCB(skb)->opt);
@@ -639,3 +620,6 @@ int ip_options_rcv_srr(struct sk_buff *skb)
 	}
 	return 0;
 }
+
+EXPORT_SYMBOL(ip_options_compile);
+EXPORT_SYMBOL(ip_options_undo);
diff --git a/trunk/net/ipv4/ip_output.c b/trunk/net/ipv4/ip_output.c
index 3f1a263e1249..80d13103b2b0 100644
--- a/trunk/net/ipv4/ip_output.c
+++ b/trunk/net/ipv4/ip_output.c
@@ -69,10 +69,13 @@
 #include <net/ip.h>
 #include <net/protocol.h>
 #include <net/route.h>
+#include <net/tcp.h>
+#include <net/udp.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <net/arp.h>
 #include <net/icmp.h>
+#include <net/raw.h>
 #include <net/checksum.h>
 #include <net/inetpeer.h>
 #include <net/checksum.h>
@@ -81,8 +84,12 @@
 #include <linux/netfilter_bridge.h>
 #include <linux/mroute.h>
 #include <linux/netlink.h>
-#include <linux/tcp.h>
 
+/*
+ *      Shall we try to damage output packets if routing dev changes?
+ */
+
+int sysctl_ip_dynaddr;
 int sysctl_ip_default_ttl = IPDEFTTL;
 
 /* Generate a checksum for an outgoing IP datagram. */
@@ -158,8 +165,6 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
 		       dst_output);
 }
 
-EXPORT_SYMBOL_GPL(ip_build_and_send_pkt);
-
 static inline int ip_finish_output2(struct sk_buff *skb)
 {
 	struct dst_entry *dst = skb->dst;
@@ -200,7 +205,7 @@ static inline int ip_finish_output2(struct sk_buff *skb)
 	return -EINVAL;
 }
 
-static inline int ip_finish_output(struct sk_buff *skb)
+int ip_finish_output(struct sk_buff *skb)
 {
 	struct net_device *dev = skb->dst->dev;
 
@@ -324,7 +329,8 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
 			if (ip_route_output_flow(&rt, &fl, sk, 0))
 				goto no_route;
 		}
-		sk_setup_caps(sk, &rt->u.dst);
+		__sk_dst_set(sk, &rt->u.dst);
+		tcp_v4_setup_caps(sk, &rt->u.dst);
 	}
 	skb->dst = dst_clone(&rt->u.dst);
 
@@ -386,6 +392,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
 #endif
 #ifdef CONFIG_NETFILTER
 	to->nfmark = from->nfmark;
+	to->nfcache = from->nfcache;
 	/* Connection association is same as pre-frag packet */
 	nf_conntrack_put(to->nfct);
 	to->nfct = from->nfct;
@@ -573,7 +580,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
 		 */
 
 		if ((skb2 = alloc_skb(len+hlen+ll_rs, GFP_ATOMIC)) == NULL) {
-			NETDEBUG(KERN_INFO "IP: frag: no memory for new fragment!\n");
+			NETDEBUG(printk(KERN_INFO "IP: frag: no memory for new fragment!\n"));
 			err = -ENOMEM;
 			goto fail;
 		}
@@ -1322,7 +1329,12 @@ void __init ip_init(void)
 #endif
 }
 
+EXPORT_SYMBOL(ip_finish_output);
 EXPORT_SYMBOL(ip_fragment);
 EXPORT_SYMBOL(ip_generic_getfrag);
 EXPORT_SYMBOL(ip_queue_xmit);
 EXPORT_SYMBOL(ip_send_check);
+
+#ifdef CONFIG_SYSCTL
+EXPORT_SYMBOL(sysctl_ip_default_ttl);
+#endif
diff --git a/trunk/net/ipv4/ip_sockglue.c b/trunk/net/ipv4/ip_sockglue.c
index 2f0b47da5b37..ff4bd067b397 100644
--- a/trunk/net/ipv4/ip_sockglue.c
+++ b/trunk/net/ipv4/ip_sockglue.c
@@ -153,7 +153,7 @@ int ip_cmsg_send(struct msghdr *msg, struct ipcm_cookie *ipc)
 		switch (cmsg->cmsg_type) {
 		case IP_RETOPTS:
 			err = cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr));
-			err = ip_options_get(&ipc->opt, CMSG_DATA(cmsg), err < 40 ? err : 40);
+			err = ip_options_get(&ipc->opt, CMSG_DATA(cmsg), err < 40 ? err : 40, 0);
 			if (err)
 				return err;
 			break;
@@ -425,7 +425,7 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 			struct ip_options * opt = NULL;
 			if (optlen > 40 || optlen < 0)
 				goto e_inval;
-			err = ip_options_get_from_user(&opt, optval, optlen);
+			err = ip_options_get(&opt, optval, optlen, 1);
 			if (err)
 				break;
 			if (sk->sk_type == SOCK_STREAM) {
@@ -614,6 +614,7 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		}
 		case IP_MSFILTER:
 		{
+			extern int sysctl_optmem_max;
 			extern int sysctl_igmp_max_msf;
 			struct ip_msfilter *msf;
 
@@ -768,6 +769,7 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		}
 		case MCAST_MSFILTER:
 		{
+			extern int sysctl_optmem_max;
 			extern int sysctl_igmp_max_msf;
 			struct sockaddr_in *psin;
 			struct ip_msfilter *msf = NULL;
@@ -1088,5 +1090,7 @@ int ip_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 
 EXPORT_SYMBOL(ip_cmsg_recv);
 
+#ifdef CONFIG_IP_SCTP_MODULE
 EXPORT_SYMBOL(ip_getsockopt);
 EXPORT_SYMBOL(ip_setsockopt);
+#endif
diff --git a/trunk/net/ipv4/ipcomp.c b/trunk/net/ipv4/ipcomp.c
index dcb7ee6c4858..7ded6e60f43a 100644
--- a/trunk/net/ipv4/ipcomp.c
+++ b/trunk/net/ipv4/ipcomp.c
@@ -214,8 +214,8 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
 	                      spi, IPPROTO_COMP, AF_INET);
 	if (!x)
 		return;
-	NETDEBUG(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%u.%u.%u.%u\n",
-		 spi, NIPQUAD(iph->daddr));
+	NETDEBUG(printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%u.%u.%u.%u\n",
+	       spi, NIPQUAD(iph->daddr)));
 	xfrm_state_put(x);
 }
 
diff --git a/trunk/net/ipv4/ipconfig.c b/trunk/net/ipv4/ipconfig.c
index 63e106605f28..d2bf8e1930a3 100644
--- a/trunk/net/ipv4/ipconfig.c
+++ b/trunk/net/ipv4/ipconfig.c
@@ -393,7 +393,7 @@ static int __init ic_defaults(void)
 
 #ifdef IPCONFIG_RARP
 
-static int ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev);
+static int ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt);
 
 static struct packet_type rarp_packet_type __initdata = {
 	.type =	__constant_htons(ETH_P_RARP),
@@ -414,7 +414,7 @@ static inline void ic_rarp_cleanup(void)
  *  Process received RARP packet.
  */
 static int __init
-ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 {
 	struct arphdr *rarp;
 	unsigned char *rarp_ptr;
@@ -555,7 +555,7 @@ struct bootp_pkt {		/* BOOTP packet format */
 #define DHCPRELEASE	7
 #define DHCPINFORM	8
 
-static int ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev);
+static int ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt);
 
 static struct packet_type bootp_packet_type __initdata = {
 	.type =	__constant_htons(ETH_P_IP),
@@ -823,7 +823,7 @@ static void __init ic_do_bootp_ext(u8 *ext)
 /*
  *  Receive BOOTP reply.
  */
-static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 {
 	struct bootp_pkt *b;
 	struct iphdr *h;
diff --git a/trunk/net/ipv4/ipmr.c b/trunk/net/ipv4/ipmr.c
index 9dbf5909f3a6..dc806b578427 100644
--- a/trunk/net/ipv4/ipmr.c
+++ b/trunk/net/ipv4/ipmr.c
@@ -103,7 +103,7 @@ static DEFINE_SPINLOCK(mfc_unres_lock);
    In this case data path is free of exclusive locks at all.
  */
 
-static kmem_cache_t *mrt_cachep __read_mostly;
+static kmem_cache_t *mrt_cachep;
 
 static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local);
 static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert);
diff --git a/trunk/net/ipv4/ipvs/ip_vs_app.c b/trunk/net/ipv4/ipvs/ip_vs_app.c
index 6e092dadb388..d9212addd193 100644
--- a/trunk/net/ipv4/ipvs/ip_vs_app.c
+++ b/trunk/net/ipv4/ipvs/ip_vs_app.c
@@ -26,7 +26,6 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <net/protocol.h>
-#include <net/tcp.h>
 #include <asm/system.h>
 #include <linux/stat.h>
 #include <linux/proc_fs.h>
diff --git a/trunk/net/ipv4/ipvs/ip_vs_conn.c b/trunk/net/ipv4/ipvs/ip_vs_conn.c
index e11952ea17af..d0145a8b1551 100644
--- a/trunk/net/ipv4/ipvs/ip_vs_conn.c
+++ b/trunk/net/ipv4/ipvs/ip_vs_conn.c
@@ -40,7 +40,7 @@
 static struct list_head *ip_vs_conn_tab;
 
 /*  SLAB cache for IPVS connections */
-static kmem_cache_t *ip_vs_conn_cachep __read_mostly;
+static kmem_cache_t *ip_vs_conn_cachep;
 
 /*  counter for current IPVS connections */
 static atomic_t ip_vs_conn_count = ATOMIC_INIT(0);
diff --git a/trunk/net/ipv4/ipvs/ip_vs_core.c b/trunk/net/ipv4/ipvs/ip_vs_core.c
index 3ac7eeca04ac..5fb257dd07cb 100644
--- a/trunk/net/ipv4/ipvs/ip_vs_core.c
+++ b/trunk/net/ipv4/ipvs/ip_vs_core.c
@@ -22,7 +22,6 @@
  *
  * Changes:
  *	Paul `Rusty' Russell		properly handle non-linear skbs
- *	Harald Welte			don't use nfcache
  *
  */
 
@@ -530,7 +529,7 @@ static unsigned int ip_vs_post_routing(unsigned int hooknum,
 				       const struct net_device *out,
 				       int (*okfn)(struct sk_buff *))
 {
-	if (!((*pskb)->ipvs_property))
+	if (!((*pskb)->nfcache & NFC_IPVS_PROPERTY))
 		return NF_ACCEPT;
 
 	/* The packet was sent from IPVS, exit this chain */
@@ -702,7 +701,7 @@ static int ip_vs_out_icmp(struct sk_buff **pskb, int *related)
 	/* do the statistics and put it back */
 	ip_vs_out_stats(cp, skb);
 
-	skb->ipvs_property = 1;
+	skb->nfcache |= NFC_IPVS_PROPERTY;
 	verdict = NF_ACCEPT;
 
   out:
@@ -740,7 +739,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
 
 	EnterFunction(11);
 
-	if (skb->ipvs_property)
+	if (skb->nfcache & NFC_IPVS_PROPERTY)
 		return NF_ACCEPT;
 
 	iph = skb->nh.iph;
@@ -822,7 +821,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
 	ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp);
 	ip_vs_conn_put(cp);
 
-	skb->ipvs_property = 1;
+	skb->nfcache |= NFC_IPVS_PROPERTY;
 
 	LeaveFunction(11);
 	return NF_ACCEPT;
diff --git a/trunk/net/ipv4/ipvs/ip_vs_ctl.c b/trunk/net/ipv4/ipvs/ip_vs_ctl.c
index 2d66848e7aa0..7d99ede2ef79 100644
--- a/trunk/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/trunk/net/ipv4/ipvs/ip_vs_ctl.c
@@ -1598,7 +1598,7 @@ static ctl_table vs_table[] = {
 	{ .ctl_name = 0 }
 };
 
-static ctl_table ipvs_ipv4_table[] = {
+static ctl_table ipv4_table[] = {
 	{
 		.ctl_name	= NET_IPV4,
 		.procname	= "ipv4",
@@ -1613,7 +1613,7 @@ static ctl_table vs_root_table[] = {
 		.ctl_name	= CTL_NET,
 		.procname	= "net",
 		.mode		= 0555,
-		.child		= ipvs_ipv4_table,
+		.child		= ipv4_table,
 	},
 	{ .ctl_name = 0 }
 };
diff --git a/trunk/net/ipv4/ipvs/ip_vs_lblc.c b/trunk/net/ipv4/ipvs/ip_vs_lblc.c
index 561cda326fa8..c035838b780a 100644
--- a/trunk/net/ipv4/ipvs/ip_vs_lblc.c
+++ b/trunk/net/ipv4/ipvs/ip_vs_lblc.c
@@ -131,7 +131,7 @@ static ctl_table vs_table[] = {
 	{ .ctl_name = 0 }
 };
 
-static ctl_table ipvs_ipv4_table[] = {
+static ctl_table ipv4_table[] = {
 	{
 		.ctl_name	= NET_IPV4,
 		.procname	= "ipv4", 
@@ -146,7 +146,7 @@ static ctl_table lblc_root_table[] = {
 		.ctl_name	= CTL_NET,
 		.procname	= "net", 
 		.mode		= 0555, 
-		.child		= ipvs_ipv4_table
+		.child		= ipv4_table
 	},
 	{ .ctl_name = 0 }
 };
diff --git a/trunk/net/ipv4/ipvs/ip_vs_lblcr.c b/trunk/net/ipv4/ipvs/ip_vs_lblcr.c
index ce456dbf09a5..22b5dd55d271 100644
--- a/trunk/net/ipv4/ipvs/ip_vs_lblcr.c
+++ b/trunk/net/ipv4/ipvs/ip_vs_lblcr.c
@@ -320,7 +320,7 @@ static ctl_table vs_table[] = {
 	{ .ctl_name = 0 }
 };
 
-static ctl_table ipvs_ipv4_table[] = {
+static ctl_table ipv4_table[] = {
 	{
 		.ctl_name	= NET_IPV4,
 		.procname	= "ipv4", 
@@ -335,7 +335,7 @@ static ctl_table lblcr_root_table[] = {
 		.ctl_name	= CTL_NET,
 		.procname	= "net", 
 		.mode		= 0555, 
-		.child		= ipvs_ipv4_table
+		.child		= ipv4_table
 	},
 	{ .ctl_name = 0 }
 };
diff --git a/trunk/net/ipv4/ipvs/ip_vs_proto_tcp.c b/trunk/net/ipv4/ipvs/ip_vs_proto_tcp.c
index c19408973c09..e65de675da74 100644
--- a/trunk/net/ipv4/ipvs/ip_vs_proto_tcp.c
+++ b/trunk/net/ipv4/ipvs/ip_vs_proto_tcp.c
@@ -604,14 +604,14 @@ void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp)
 }
 
 
-static void ip_vs_tcp_init(struct ip_vs_protocol *pp)
+static void tcp_init(struct ip_vs_protocol *pp)
 {
 	IP_VS_INIT_HASH_TABLE(tcp_apps);
 	pp->timeout_table = tcp_timeouts;
 }
 
 
-static void ip_vs_tcp_exit(struct ip_vs_protocol *pp)
+static void tcp_exit(struct ip_vs_protocol *pp)
 {
 }
 
@@ -621,8 +621,8 @@ struct ip_vs_protocol ip_vs_protocol_tcp = {
 	.protocol =		IPPROTO_TCP,
 	.dont_defrag =		0,
 	.appcnt =		ATOMIC_INIT(0),
-	.init =			ip_vs_tcp_init,
-	.exit =			ip_vs_tcp_exit,
+	.init =			tcp_init,
+	.exit =			tcp_exit,
 	.register_app =		tcp_register_app,
 	.unregister_app =	tcp_unregister_app,
 	.conn_schedule =	tcp_conn_schedule,
diff --git a/trunk/net/ipv4/ipvs/ip_vs_xmit.c b/trunk/net/ipv4/ipvs/ip_vs_xmit.c
index 3b87482049cf..a8512a3fd08a 100644
--- a/trunk/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/trunk/net/ipv4/ipvs/ip_vs_xmit.c
@@ -127,7 +127,7 @@ ip_vs_dst_reset(struct ip_vs_dest *dest)
 
 #define IP_VS_XMIT(skb, rt)				\
 do {							\
-	(skb)->ipvs_property = 1;			\
+	(skb)->nfcache |= NFC_IPVS_PROPERTY;		\
 	(skb)->ip_summed = CHECKSUM_NONE;		\
 	NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, (skb), NULL,	\
 		(rt)->u.dst.dev, dst_output);		\
diff --git a/trunk/net/ipv4/multipath_drr.c b/trunk/net/ipv4/multipath_drr.c
index db67373f9b34..c9cf8726051d 100644
--- a/trunk/net/ipv4/multipath_drr.c
+++ b/trunk/net/ipv4/multipath_drr.c
@@ -107,7 +107,7 @@ static int drr_dev_event(struct notifier_block *this,
 	return NOTIFY_DONE;
 }
 
-static struct notifier_block drr_dev_notifier = {
+struct notifier_block drr_dev_notifier = {
 	.notifier_call	= drr_dev_event,
 };
 
diff --git a/trunk/net/ipv4/netfilter.c b/trunk/net/ipv4/netfilter.c
deleted file mode 100644
index ae0779d82c5d..000000000000
--- a/trunk/net/ipv4/netfilter.c
+++ /dev/null
@@ -1,139 +0,0 @@
-/* IPv4 specific functions of netfilter core */
-
-#include <linux/config.h>
-#ifdef CONFIG_NETFILTER
-
-#include <linux/kernel.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv4.h>
-
-#include <linux/tcp.h>
-#include <linux/udp.h>
-#include <linux/icmp.h>
-#include <net/route.h>
-#include <linux/ip.h>
-
-/* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
-int ip_route_me_harder(struct sk_buff **pskb)
-{
-	struct iphdr *iph = (*pskb)->nh.iph;
-	struct rtable *rt;
-	struct flowi fl = {};
-	struct dst_entry *odst;
-	unsigned int hh_len;
-
-	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
-	 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
-	 */
-	if (inet_addr_type(iph->saddr) == RTN_LOCAL) {
-		fl.nl_u.ip4_u.daddr = iph->daddr;
-		fl.nl_u.ip4_u.saddr = iph->saddr;
-		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
-		fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
-#ifdef CONFIG_IP_ROUTE_FWMARK
-		fl.nl_u.ip4_u.fwmark = (*pskb)->nfmark;
-#endif
-		fl.proto = iph->protocol;
-		if (ip_route_output_key(&rt, &fl) != 0)
-			return -1;
-
-		/* Drop old route. */
-		dst_release((*pskb)->dst);
-		(*pskb)->dst = &rt->u.dst;
-	} else {
-		/* non-local src, find valid iif to satisfy
-		 * rp-filter when calling ip_route_input. */
-		fl.nl_u.ip4_u.daddr = iph->saddr;
-		if (ip_route_output_key(&rt, &fl) != 0)
-			return -1;
-
-		odst = (*pskb)->dst;
-		if (ip_route_input(*pskb, iph->daddr, iph->saddr,
-				   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
-			dst_release(&rt->u.dst);
-			return -1;
-		}
-		dst_release(&rt->u.dst);
-		dst_release(odst);
-	}
-	
-	if ((*pskb)->dst->error)
-		return -1;
-
-	/* Change in oif may mean change in hh_len. */
-	hh_len = (*pskb)->dst->dev->hard_header_len;
-	if (skb_headroom(*pskb) < hh_len) {
-		struct sk_buff *nskb;
-
-		nskb = skb_realloc_headroom(*pskb, hh_len);
-		if (!nskb) 
-			return -1;
-		if ((*pskb)->sk)
-			skb_set_owner_w(nskb, (*pskb)->sk);
-		kfree_skb(*pskb);
-		*pskb = nskb;
-	}
-
-	return 0;
-}
-EXPORT_SYMBOL(ip_route_me_harder);
-
-/*
- * Extra routing may needed on local out, as the QUEUE target never
- * returns control to the table.
- */
-
-struct ip_rt_info {
-	u_int32_t daddr;
-	u_int32_t saddr;
-	u_int8_t tos;
-};
-
-static void queue_save(const struct sk_buff *skb, struct nf_info *info)
-{
-	struct ip_rt_info *rt_info = nf_info_reroute(info);
-
-	if (info->hook == NF_IP_LOCAL_OUT) {
-		const struct iphdr *iph = skb->nh.iph;
-
-		rt_info->tos = iph->tos;
-		rt_info->daddr = iph->daddr;
-		rt_info->saddr = iph->saddr;
-	}
-}
-
-static int queue_reroute(struct sk_buff **pskb, const struct nf_info *info)
-{
-	const struct ip_rt_info *rt_info = nf_info_reroute(info);
-
-	if (info->hook == NF_IP_LOCAL_OUT) {
-		struct iphdr *iph = (*pskb)->nh.iph;
-
-		if (!(iph->tos == rt_info->tos
-		      && iph->daddr == rt_info->daddr
-		      && iph->saddr == rt_info->saddr))
-			return ip_route_me_harder(pskb);
-	}
-	return 0;
-}
-
-static struct nf_queue_rerouter ip_reroute = {
-	.rer_size	= sizeof(struct ip_rt_info),
-	.save		= queue_save,
-	.reroute	= queue_reroute,
-};
-
-static int init(void)
-{
-	return nf_register_queue_rerouter(PF_INET, &ip_reroute);
-}
-
-static void fini(void)
-{
-	nf_unregister_queue_rerouter(PF_INET);
-}
-
-module_init(init);
-module_exit(fini);
-
-#endif /* CONFIG_NETFILTER */
diff --git a/trunk/net/ipv4/netfilter/Kconfig b/trunk/net/ipv4/netfilter/Kconfig
index e046f5521814..46d4cb1c06f0 100644
--- a/trunk/net/ipv4/netfilter/Kconfig
+++ b/trunk/net/ipv4/netfilter/Kconfig
@@ -40,16 +40,6 @@ config IP_NF_CONNTRACK_MARK
 	  of packets, but this mark value is kept in the conntrack session
 	  instead of the individual packets.
 	
-config IP_NF_CONNTRACK_EVENTS
-	bool "Connection tracking events"
-	depends on IP_NF_CONNTRACK
-	help
-	  If this option is enabled, the connection tracking code will
-	  provide a notifier chain that can be used by other kernel code
-	  to get notified about changes in the connection tracking state.
-	  
-	  IF unsure, say `N'.
-
 config IP_NF_CT_PROTO_SCTP
 	tristate  'SCTP protocol connection tracking support (EXPERIMENTAL)'
 	depends on IP_NF_CONNTRACK && EXPERIMENTAL
@@ -110,15 +100,11 @@ config IP_NF_AMANDA
 	  To compile it as a module, choose M here.  If unsure, say Y.
 
 config IP_NF_QUEUE
-	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
+	tristate "Userspace queueing via NETLINK"
 	help
 	  Netfilter has the ability to queue packets to user space: the
 	  netlink device can be used to access them using this driver.
 
-	  This option enables the old IPv4-only "ip_queue" implementation
-	  which has been obsoleted by the new "nfnetlink_queue" code (see
-	  CONFIG_NETFILTER_NETLINK_QUEUE).
-
 	  To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_IPTABLES
@@ -354,17 +340,6 @@ config IP_NF_MATCH_SCTP
 	  If you want to compile it as a module, say M here and read
 	  <file:Documentation/modules.txt>.  If unsure, say `N'.
 
-config IP_NF_MATCH_DCCP
-	tristate  'DCCP protocol match support'
-	depends on IP_NF_IPTABLES
-	help
-	  With this option enabled, you will be able to use the iptables
-	  `dccp' match in order to match on DCCP source/destination ports
-	  and DCCP flags.
-
-	  If you want to compile it as a module, say M here and read
-	  <file:Documentation/modules.txt>.  If unsure, say `N'.
-
 config IP_NF_MATCH_COMMENT
 	tristate  'comment match support'
 	depends on IP_NF_IPTABLES
@@ -386,16 +361,6 @@ config IP_NF_MATCH_CONNMARK
 	  <file:Documentation/modules.txt>.  The module will be called
 	  ipt_connmark.o.  If unsure, say `N'.
 
-config IP_NF_MATCH_CONNBYTES
-	tristate  'Connection byte/packet counter match support'
-	depends on IP_NF_CT_ACCT && IP_NF_IPTABLES
-	help
-	  This option adds a `connbytes' match, which allows you to match the
-	  number of bytes and/or packets for each direction within a connection.
-
-	  If you want to compile it as a module, say M here and read
-	  <file:Documentation/modules.txt>.  If unsure, say `N'.
-
 config IP_NF_MATCH_HASHLIMIT
 	tristate  'hashlimit match support'
 	depends on IP_NF_IPTABLES
@@ -410,19 +375,6 @@ config IP_NF_MATCH_HASHLIMIT
 	  destination IP' or `500pps from any given source IP'  with a single
 	  IPtables rule.
 
-config IP_NF_MATCH_STRING
-	tristate  'string match support'
-	depends on IP_NF_IPTABLES 
-	select TEXTSEARCH
-	select TEXTSEARCH_KMP
-	select TEXTSEARCH_BM
-	select TEXTSEARCH_FSM
-	help
-	  This option adds a `string' match, which allows you to look for
-	  pattern matchings in packets.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
 # `filter', generic and specific targets
 config IP_NF_FILTER
 	tristate "Packet filtering"
@@ -664,20 +616,6 @@ config IP_NF_TARGET_CLASSIFY
 
 	  To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_TARGET_TTL
-	tristate  'TTL target support'
-	depends on IP_NF_MANGLE
-	help
-	  This option adds a `TTL' target, which enables the user to modify
-	  the TTL value of the IP header.
-
-	  While it is safe to decrement/lower the TTL, this target also enables
-	  functionality to increment and set the TTL value of the IP header to
-	  arbitrary values.  This is EXTREMELY DANGEROUS since you can easily
-	  create immortal packets that loop forever on the network.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
 config IP_NF_TARGET_CONNMARK
 	tristate  'CONNMARK target support'
 	depends on IP_NF_CONNTRACK_MARK && IP_NF_MANGLE
@@ -754,11 +692,5 @@ config IP_NF_ARP_MANGLE
 	  Allows altering the ARP packet payload: source and destination
 	  hardware and network addresses.
 
-config IP_NF_CONNTRACK_NETLINK
-        tristate 'Connection tracking netlink interface'
-        depends on IP_NF_CONNTRACK && NETFILTER_NETLINK
-        help
-          This option enables support for a netlink-based userspace interface
-
 endmenu
 
diff --git a/trunk/net/ipv4/netfilter/Makefile b/trunk/net/ipv4/netfilter/Makefile
index a7bd38f50522..45796d5924dd 100644
--- a/trunk/net/ipv4/netfilter/Makefile
+++ b/trunk/net/ipv4/netfilter/Makefile
@@ -9,10 +9,6 @@ iptable_nat-objs	:= ip_nat_standalone.o ip_nat_rule.o ip_nat_core.o ip_nat_helpe
 # connection tracking
 obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o
 
-# conntrack netlink interface
-obj-$(CONFIG_IP_NF_CONNTRACK_NETLINK) += ip_conntrack_netlink.o
-
-
 # SCTP protocol connection tracking
 obj-$(CONFIG_IP_NF_CT_PROTO_SCTP) += ip_conntrack_proto_sctp.o
 
@@ -42,7 +38,6 @@ obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
 obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
 obj-$(CONFIG_IP_NF_MATCH_HASHLIMIT) += ipt_hashlimit.o
 obj-$(CONFIG_IP_NF_MATCH_SCTP) += ipt_sctp.o
-obj-$(CONFIG_IP_NF_MATCH_DCCP) += ipt_dccp.o
 obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
 obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
@@ -59,13 +54,11 @@ obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
 obj-$(CONFIG_IP_NF_MATCH_CONNMARK) += ipt_connmark.o
 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
-obj-$(CONFIG_IP_NF_MATCH_CONNBYTES) += ipt_connbytes.o
 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
 obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
 obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
 obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
 obj-$(CONFIG_IP_NF_MATCH_COMMENT) += ipt_comment.o
-obj-$(CONFIG_IP_NF_MATCH_STRING) += ipt_string.o
 
 # targets
 obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
@@ -85,7 +78,6 @@ obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
 obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
-obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
 
 # generic ARP tables
 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
@@ -95,4 +87,3 @@ obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o
 obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
 
 obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o
-obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ipt_NFQUEUE.o
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_amanda.c b/trunk/net/ipv4/netfilter/ip_conntrack_amanda.c
index be4c9eb3243f..01e1b58322a9 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -40,7 +40,7 @@ MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
 static char *conns[] = { "DATA ", "MESG ", "INDEX " };
 
 /* This is slow, but it's simple. --RR */
-static char *amanda_buffer;
+static char amanda_buffer[65536];
 static DEFINE_SPINLOCK(amanda_buffer_lock);
 
 unsigned int (*ip_nat_amanda_hook)(struct sk_buff **pskb,
@@ -153,25 +153,11 @@ static struct ip_conntrack_helper amanda_helper = {
 static void __exit fini(void)
 {
 	ip_conntrack_helper_unregister(&amanda_helper);
-	kfree(amanda_buffer);
 }
 
 static int __init init(void)
 {
-	int ret;
-
-	amanda_buffer = kmalloc(65536, GFP_KERNEL);
-	if (!amanda_buffer)
-		return -ENOMEM;
-
-	ret = ip_conntrack_helper_register(&amanda_helper);
-	if (ret < 0) {
-		kfree(amanda_buffer);
-		return ret;
-	}
-	return 0;
-
-
+	return ip_conntrack_helper_register(&amanda_helper);
 }
 
 module_init(init);
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_core.c b/trunk/net/ipv4/netfilter/ip_conntrack_core.c
index a0648600190e..a7f0c821a9b2 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_core.c
@@ -37,7 +37,6 @@
 #include <linux/err.h>
 #include <linux/percpu.h>
 #include <linux/moduleparam.h>
-#include <linux/notifier.h>
 
 /* ip_conntrack_lock protects the main hash table, protocol/helper/expected
    registrations, conntrack timers*/
@@ -50,7 +49,7 @@
 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
 #include <linux/netfilter_ipv4/listhelp.h>
 
-#define IP_CONNTRACK_VERSION	"2.3"
+#define IP_CONNTRACK_VERSION	"2.1"
 
 #if 0
 #define DEBUGP printk
@@ -70,80 +69,21 @@ static LIST_HEAD(helpers);
 unsigned int ip_conntrack_htable_size = 0;
 int ip_conntrack_max;
 struct list_head *ip_conntrack_hash;
-static kmem_cache_t *ip_conntrack_cachep __read_mostly;
-static kmem_cache_t *ip_conntrack_expect_cachep __read_mostly;
+static kmem_cache_t *ip_conntrack_cachep;
+static kmem_cache_t *ip_conntrack_expect_cachep;
 struct ip_conntrack ip_conntrack_untracked;
 unsigned int ip_ct_log_invalid;
 static LIST_HEAD(unconfirmed);
 static int ip_conntrack_vmalloc;
 
-static unsigned int ip_conntrack_next_id = 1;
-static unsigned int ip_conntrack_expect_next_id = 1;
-#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-struct notifier_block *ip_conntrack_chain;
-struct notifier_block *ip_conntrack_expect_chain;
-
-DEFINE_PER_CPU(struct ip_conntrack_ecache, ip_conntrack_ecache);
-
-/* deliver cached events and clear cache entry - must be called with locally
- * disabled softirqs */
-static inline void
-__ip_ct_deliver_cached_events(struct ip_conntrack_ecache *ecache)
-{
-	DEBUGP("ecache: delivering events for %p\n", ecache->ct);
-	if (is_confirmed(ecache->ct) && !is_dying(ecache->ct) && ecache->events)
-		notifier_call_chain(&ip_conntrack_chain, ecache->events,
-				    ecache->ct);
-	ecache->events = 0;
-	ip_conntrack_put(ecache->ct);
-	ecache->ct = NULL;
-}
-
-/* Deliver all cached events for a particular conntrack. This is called
- * by code prior to async packet handling or freeing the skb */
-void ip_ct_deliver_cached_events(const struct ip_conntrack *ct)
-{
-	struct ip_conntrack_ecache *ecache;
-	
-	local_bh_disable();
-	ecache = &__get_cpu_var(ip_conntrack_ecache);
-	if (ecache->ct == ct)
-		__ip_ct_deliver_cached_events(ecache);
-	local_bh_enable();
-}
-
-void __ip_ct_event_cache_init(struct ip_conntrack *ct)
-{
-	struct ip_conntrack_ecache *ecache;
-
-	/* take care of delivering potentially old events */
-	ecache = &__get_cpu_var(ip_conntrack_ecache);
-	BUG_ON(ecache->ct == ct);
-	if (ecache->ct)
-		__ip_ct_deliver_cached_events(ecache);
-	/* initialize for this conntrack/packet */
-	ecache->ct = ct;
-	nf_conntrack_get(&ct->ct_general);
-}
+DEFINE_PER_CPU(struct ip_conntrack_stat, ip_conntrack_stat);
 
-/* flush the event cache - touches other CPU's data and must not be called while
- * packets are still passing through the code */
-static void ip_ct_event_cache_flush(void)
+void 
+ip_conntrack_put(struct ip_conntrack *ct)
 {
-	struct ip_conntrack_ecache *ecache;
-	int cpu;
-
-	for_each_cpu(cpu) {
-		ecache = &per_cpu(ip_conntrack_ecache, cpu);
-		if (ecache->ct)
-			ip_conntrack_put(ecache->ct);
-	}
+	IP_NF_ASSERT(ct);
+	nf_conntrack_put(&ct->ct_general);
 }
-#else
-static inline void ip_ct_event_cache_flush(void) {}
-#endif /* CONFIG_IP_NF_CONNTRACK_EVENTS */
-
-DEFINE_PER_CPU(struct ip_conntrack_stat, ip_conntrack_stat);
 
 static int ip_conntrack_hash_rnd_initted;
 static unsigned int ip_conntrack_hash_rnd;
@@ -204,13 +144,6 @@ static void unlink_expect(struct ip_conntrack_expect *exp)
 	list_del(&exp->list);
 	CONNTRACK_STAT_INC(expect_delete);
 	exp->master->expecting--;
-	ip_conntrack_expect_put(exp);
-}
-
-void __ip_ct_expect_unlink_destroy(struct ip_conntrack_expect *exp)
-{
-	unlink_expect(exp);
-	ip_conntrack_expect_put(exp);
 }
 
 static void expectation_timed_out(unsigned long ul_expect)
@@ -223,33 +156,6 @@ static void expectation_timed_out(unsigned long ul_expect)
 	ip_conntrack_expect_put(exp);
 }
 
-struct ip_conntrack_expect *
-__ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple)
-{
-	struct ip_conntrack_expect *i;
-	
-	list_for_each_entry(i, &ip_conntrack_expect_list, list) {
-		if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
-			atomic_inc(&i->use);
-			return i;
-		}
-	}
-	return NULL;
-}
-
-/* Just find a expectation corresponding to a tuple. */
-struct ip_conntrack_expect *
-ip_conntrack_expect_find_get(const struct ip_conntrack_tuple *tuple)
-{
-	struct ip_conntrack_expect *i;
-	
-	read_lock_bh(&ip_conntrack_lock);
-	i = __ip_conntrack_expect_find(tuple);
-	read_unlock_bh(&ip_conntrack_lock);
-
-	return i;
-}
-
 /* If an expectation for this connection is found, it gets delete from
  * global list then returned. */
 static struct ip_conntrack_expect *
@@ -274,7 +180,7 @@ find_expectation(const struct ip_conntrack_tuple *tuple)
 }
 
 /* delete all expectations for this conntrack */
-void ip_ct_remove_expectations(struct ip_conntrack *ct)
+static void remove_expectations(struct ip_conntrack *ct)
 {
 	struct ip_conntrack_expect *i, *tmp;
 
@@ -304,7 +210,7 @@ clean_from_lists(struct ip_conntrack *ct)
 	LIST_DELETE(&ip_conntrack_hash[hr], &ct->tuplehash[IP_CT_DIR_REPLY]);
 
 	/* Destroy all pending expectations */
-	ip_ct_remove_expectations(ct);
+	remove_expectations(ct);
 }
 
 static void
@@ -317,13 +223,10 @@ destroy_conntrack(struct nf_conntrack *nfct)
 	IP_NF_ASSERT(atomic_read(&nfct->use) == 0);
 	IP_NF_ASSERT(!timer_pending(&ct->timeout));
 
-	ip_conntrack_event(IPCT_DESTROY, ct);
-	set_bit(IPS_DYING_BIT, &ct->status);
-
 	/* To make sure we don't get any weird locking issues here:
 	 * destroy_conntrack() MUST NOT be called with a write lock
 	 * to ip_conntrack_lock!!! -HW */
-	proto = __ip_conntrack_proto_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.protonum);
+	proto = ip_ct_find_proto(ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.protonum);
 	if (proto && proto->destroy)
 		proto->destroy(ct);
 
@@ -335,7 +238,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
 	 * except TFTP can create an expectation on the first packet,
 	 * before connection is in the list, so we need to clean here,
 	 * too. */
-	ip_ct_remove_expectations(ct);
+	remove_expectations(ct);
 
 	/* We overload first tuple to link into unconfirmed list. */
 	if (!is_confirmed(ct)) {
@@ -350,7 +253,8 @@ destroy_conntrack(struct nf_conntrack *nfct)
 		ip_conntrack_put(ct->master);
 
 	DEBUGP("destroy_conntrack: returning ct=%p to slab\n", ct);
-	ip_conntrack_free(ct);
+	kmem_cache_free(ip_conntrack_cachep, ct);
+	atomic_dec(&ip_conntrack_count);
 }
 
 static void death_by_timeout(unsigned long ul_conntrack)
@@ -376,7 +280,7 @@ conntrack_tuple_cmp(const struct ip_conntrack_tuple_hash *i,
 		&& ip_ct_tuple_equal(tuple, &i->tuple);
 }
 
-struct ip_conntrack_tuple_hash *
+static struct ip_conntrack_tuple_hash *
 __ip_conntrack_find(const struct ip_conntrack_tuple *tuple,
 		    const struct ip_conntrack *ignored_conntrack)
 {
@@ -411,29 +315,6 @@ ip_conntrack_find_get(const struct ip_conntrack_tuple *tuple,
 	return h;
 }
 
-static void __ip_conntrack_hash_insert(struct ip_conntrack *ct,
-					unsigned int hash,
-					unsigned int repl_hash) 
-{
-	ct->id = ++ip_conntrack_next_id;
-	list_prepend(&ip_conntrack_hash[hash],
-		     &ct->tuplehash[IP_CT_DIR_ORIGINAL].list);
-	list_prepend(&ip_conntrack_hash[repl_hash],
-		     &ct->tuplehash[IP_CT_DIR_REPLY].list);
-}
-
-void ip_conntrack_hash_insert(struct ip_conntrack *ct)
-{
-	unsigned int hash, repl_hash;
-
-	hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-	repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
-
-	write_lock_bh(&ip_conntrack_lock);
-	__ip_conntrack_hash_insert(ct, hash, repl_hash);
-	write_unlock_bh(&ip_conntrack_lock);
-}
-
 /* Confirm a connection given skb; places it in hash table */
 int
 __ip_conntrack_confirm(struct sk_buff **pskb)
@@ -480,7 +361,10 @@ __ip_conntrack_confirm(struct sk_buff **pskb)
 		/* Remove from unconfirmed list */
 		list_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list);
 
-		__ip_conntrack_hash_insert(ct, hash, repl_hash);
+		list_prepend(&ip_conntrack_hash[hash],
+			     &ct->tuplehash[IP_CT_DIR_ORIGINAL]);
+		list_prepend(&ip_conntrack_hash[repl_hash],
+			     &ct->tuplehash[IP_CT_DIR_REPLY]);
 		/* Timer relative to confirmation time, not original
 		   setting time, otherwise we'd get timer wrap in
 		   weird delay cases. */
@@ -490,16 +374,6 @@ __ip_conntrack_confirm(struct sk_buff **pskb)
 		set_bit(IPS_CONFIRMED_BIT, &ct->status);
 		CONNTRACK_STAT_INC(insert);
 		write_unlock_bh(&ip_conntrack_lock);
-		if (ct->helper)
-			ip_conntrack_event_cache(IPCT_HELPER, *pskb);
-#ifdef CONFIG_IP_NF_NAT_NEEDED
-		if (test_bit(IPS_SRC_NAT_DONE_BIT, &ct->status) ||
-		    test_bit(IPS_DST_NAT_DONE_BIT, &ct->status))
-			ip_conntrack_event_cache(IPCT_NATINFO, *pskb);
-#endif
-		ip_conntrack_event_cache(master_ct(ct) ?
-					 IPCT_RELATED : IPCT_NEW, *pskb);
-
 		return NF_ACCEPT;
 	}
 
@@ -564,84 +438,34 @@ static inline int helper_cmp(const struct ip_conntrack_helper *i,
 	return ip_ct_tuple_mask_cmp(rtuple, &i->tuple, &i->mask);
 }
 
-static struct ip_conntrack_helper *
-__ip_conntrack_helper_find( const struct ip_conntrack_tuple *tuple)
+static struct ip_conntrack_helper *ip_ct_find_helper(const struct ip_conntrack_tuple *tuple)
 {
 	return LIST_FIND(&helpers, helper_cmp,
 			 struct ip_conntrack_helper *,
 			 tuple);
 }
 
-struct ip_conntrack_helper *
-ip_conntrack_helper_find_get( const struct ip_conntrack_tuple *tuple)
-{
-	struct ip_conntrack_helper *helper;
-
-	/* need ip_conntrack_lock to assure that helper exists until
-	 * try_module_get() is called */
-	read_lock_bh(&ip_conntrack_lock);
-
-	helper = __ip_conntrack_helper_find(tuple);
-	if (helper) {
-		/* need to increase module usage count to assure helper will
-		 * not go away while the caller is e.g. busy putting a
-		 * conntrack in the hash that uses the helper */
-		if (!try_module_get(helper->me))
-			helper = NULL;
-	}
-
-	read_unlock_bh(&ip_conntrack_lock);
-
-	return helper;
-}
-
-void ip_conntrack_helper_put(struct ip_conntrack_helper *helper)
-{
-	module_put(helper->me);
-}
-
-struct ip_conntrack_protocol *
-__ip_conntrack_proto_find(u_int8_t protocol)
-{
-	return ip_ct_protos[protocol];
-}
-
-/* this is guaranteed to always return a valid protocol helper, since
- * it falls back to generic_protocol */
-struct ip_conntrack_protocol *
-ip_conntrack_proto_find_get(u_int8_t protocol)
-{
-	struct ip_conntrack_protocol *p;
-
-	preempt_disable();
-	p = __ip_conntrack_proto_find(protocol);
-	if (p) {
-		if (!try_module_get(p->me))
-			p = &ip_conntrack_generic_protocol;
-	}
-	preempt_enable();
-	
-	return p;
-}
-
-void ip_conntrack_proto_put(struct ip_conntrack_protocol *p)
-{
-	module_put(p->me);
-}
-
-struct ip_conntrack *ip_conntrack_alloc(struct ip_conntrack_tuple *orig,
-					struct ip_conntrack_tuple *repl)
+/* Allocate a new conntrack: we return -ENOMEM if classification
+   failed due to stress.  Otherwise it really is unclassifiable. */
+static struct ip_conntrack_tuple_hash *
+init_conntrack(const struct ip_conntrack_tuple *tuple,
+	       struct ip_conntrack_protocol *protocol,
+	       struct sk_buff *skb)
 {
 	struct ip_conntrack *conntrack;
+	struct ip_conntrack_tuple repl_tuple;
+	size_t hash;
+	struct ip_conntrack_expect *exp;
 
 	if (!ip_conntrack_hash_rnd_initted) {
 		get_random_bytes(&ip_conntrack_hash_rnd, 4);
 		ip_conntrack_hash_rnd_initted = 1;
 	}
 
+	hash = hash_conntrack(tuple);
+
 	if (ip_conntrack_max
 	    && atomic_read(&ip_conntrack_count) >= ip_conntrack_max) {
-		unsigned int hash = hash_conntrack(orig);
 		/* Try dropping from this hash chain. */
 		if (!early_drop(&ip_conntrack_hash[hash])) {
 			if (net_ratelimit())
@@ -652,6 +476,11 @@ struct ip_conntrack *ip_conntrack_alloc(struct ip_conntrack_tuple *orig,
 		}
 	}
 
+	if (!ip_ct_invert_tuple(&repl_tuple, tuple, protocol)) {
+		DEBUGP("Can't invert tuple.\n");
+		return NULL;
+	}
+
 	conntrack = kmem_cache_alloc(ip_conntrack_cachep, GFP_ATOMIC);
 	if (!conntrack) {
 		DEBUGP("Can't allocate conntrack.\n");
@@ -661,50 +490,17 @@ struct ip_conntrack *ip_conntrack_alloc(struct ip_conntrack_tuple *orig,
 	memset(conntrack, 0, sizeof(*conntrack));
 	atomic_set(&conntrack->ct_general.use, 1);
 	conntrack->ct_general.destroy = destroy_conntrack;
-	conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
-	conntrack->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
+	conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *tuple;
+	conntrack->tuplehash[IP_CT_DIR_REPLY].tuple = repl_tuple;
+	if (!protocol->new(conntrack, skb)) {
+		kmem_cache_free(ip_conntrack_cachep, conntrack);
+		return NULL;
+	}
 	/* Don't set timer yet: wait for confirmation */
 	init_timer(&conntrack->timeout);
 	conntrack->timeout.data = (unsigned long)conntrack;
 	conntrack->timeout.function = death_by_timeout;
 
-	atomic_inc(&ip_conntrack_count);
-
-	return conntrack;
-}
-
-void
-ip_conntrack_free(struct ip_conntrack *conntrack)
-{
-	atomic_dec(&ip_conntrack_count);
-	kmem_cache_free(ip_conntrack_cachep, conntrack);
-}
-
-/* Allocate a new conntrack: we return -ENOMEM if classification
- * failed due to stress.   Otherwise it really is unclassifiable */
-static struct ip_conntrack_tuple_hash *
-init_conntrack(struct ip_conntrack_tuple *tuple,
-	       struct ip_conntrack_protocol *protocol,
-	       struct sk_buff *skb)
-{
-	struct ip_conntrack *conntrack;
-	struct ip_conntrack_tuple repl_tuple;
-	struct ip_conntrack_expect *exp;
-
-	if (!ip_ct_invert_tuple(&repl_tuple, tuple, protocol)) {
-		DEBUGP("Can't invert tuple.\n");
-		return NULL;
-	}
-
-	conntrack = ip_conntrack_alloc(tuple, &repl_tuple);
-	if (conntrack == NULL || IS_ERR(conntrack))
-		return (struct ip_conntrack_tuple_hash *)conntrack;
-
-	if (!protocol->new(conntrack, skb)) {
-		ip_conntrack_free(conntrack);
-		return NULL;
-	}
-
 	write_lock_bh(&ip_conntrack_lock);
 	exp = find_expectation(tuple);
 
@@ -725,7 +521,7 @@ init_conntrack(struct ip_conntrack_tuple *tuple,
 		nf_conntrack_get(&conntrack->master->ct_general);
 		CONNTRACK_STAT_INC(expect_new);
 	} else {
-		conntrack->helper = __ip_conntrack_helper_find(&repl_tuple);
+		conntrack->helper = ip_ct_find_helper(&repl_tuple);
 
 		CONNTRACK_STAT_INC(new);
 	}
@@ -733,6 +529,7 @@ init_conntrack(struct ip_conntrack_tuple *tuple,
 	/* Overload tuple linked list to put us in unconfirmed list. */
 	list_add(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list, &unconfirmed);
 
+	atomic_inc(&ip_conntrack_count);
 	write_unlock_bh(&ip_conntrack_lock);
 
 	if (exp) {
@@ -810,7 +607,7 @@ unsigned int ip_conntrack_in(unsigned int hooknum,
 	struct ip_conntrack *ct;
 	enum ip_conntrack_info ctinfo;
 	struct ip_conntrack_protocol *proto;
-	int set_reply = 0;
+	int set_reply;
 	int ret;
 
 	/* Previously seen (loopback or untracked)?  Ignore. */
@@ -828,6 +625,9 @@ unsigned int ip_conntrack_in(unsigned int hooknum,
 		return NF_DROP;
 	}
 
+	/* FIXME: Do this right please. --RR */
+	(*pskb)->nfcache |= NFC_UNKNOWN;
+
 /* Doesn't cover locally-generated broadcast, so not worth it. */
 #if 0
 	/* Ignore broadcast: no `connection'. */
@@ -843,7 +643,7 @@ unsigned int ip_conntrack_in(unsigned int hooknum,
 	}
 #endif
 
-	proto = __ip_conntrack_proto_find((*pskb)->nh.iph->protocol);
+	proto = ip_ct_find_proto((*pskb)->nh.iph->protocol);
 
 	/* It may be an special packet, error, unclean...
 	 * inverse of the return code tells to the netfilter
@@ -879,8 +679,8 @@ unsigned int ip_conntrack_in(unsigned int hooknum,
 		return -ret;
 	}
 
-	if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
-		ip_conntrack_event_cache(IPCT_STATUS, *pskb);
+	if (set_reply)
+		set_bit(IPS_SEEN_REPLY_BIT, &ct->status);
 
 	return ret;
 }
@@ -889,7 +689,7 @@ int invert_tuplepr(struct ip_conntrack_tuple *inverse,
 		   const struct ip_conntrack_tuple *orig)
 {
 	return ip_ct_invert_tuple(inverse, orig, 
-				  __ip_conntrack_proto_find(orig->dst.protonum));
+				  ip_ct_find_proto(orig->dst.protonum));
 }
 
 /* Would two expected things clash? */
@@ -969,8 +769,6 @@ static void ip_conntrack_expect_insert(struct ip_conntrack_expect *exp)
 	exp->timeout.expires = jiffies + exp->master->helper->timeout * HZ;
 	add_timer(&exp->timeout);
 
-	exp->id = ++ip_conntrack_expect_next_id;
-	atomic_inc(&exp->use);
 	CONNTRACK_STAT_INC(expect_create);
 }
 
@@ -1029,7 +827,6 @@ int ip_conntrack_expect_related(struct ip_conntrack_expect *expect)
 		evict_oldest_expect(expect->master);
 
 	ip_conntrack_expect_insert(expect);
-	ip_conntrack_expect_event(IPEXP_NEW, expect);
 	ret = 0;
 out:
 	write_unlock_bh(&ip_conntrack_lock);
@@ -1050,7 +847,7 @@ void ip_conntrack_alter_reply(struct ip_conntrack *conntrack,
 
 	conntrack->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
 	if (!conntrack->master && conntrack->expecting == 0)
-		conntrack->helper = __ip_conntrack_helper_find(newreply);
+		conntrack->helper = ip_ct_find_helper(newreply);
 	write_unlock_bh(&ip_conntrack_lock);
 }
 
@@ -1064,26 +861,11 @@ int ip_conntrack_helper_register(struct ip_conntrack_helper *me)
 	return 0;
 }
 
-struct ip_conntrack_helper *
-__ip_conntrack_helper_find_byname(const char *name)
-{
-	struct ip_conntrack_helper *h;
-
-	list_for_each_entry(h, &helpers, list) {
-		if (!strcmp(h->name, name))
-			return h;
-	}
-
-	return NULL;
-}
-
 static inline int unhelp(struct ip_conntrack_tuple_hash *i,
 			 const struct ip_conntrack_helper *me)
 {
-	if (tuplehash_to_ctrack(i)->helper == me) {
- 		ip_conntrack_event(IPCT_HELPER, tuplehash_to_ctrack(i));
+	if (tuplehash_to_ctrack(i)->helper == me)
 		tuplehash_to_ctrack(i)->helper = NULL;
-	}
 	return 0;
 }
 
@@ -1145,46 +927,12 @@ void ip_ct_refresh_acct(struct ip_conntrack *ct,
 		if (del_timer(&ct->timeout)) {
 			ct->timeout.expires = jiffies + extra_jiffies;
 			add_timer(&ct->timeout);
-			ip_conntrack_event_cache(IPCT_REFRESH, skb);
 		}
 		ct_add_counters(ct, ctinfo, skb);
 		write_unlock_bh(&ip_conntrack_lock);
 	}
 }
 
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-/* Generic function for tcp/udp/sctp/dccp and alike. This needs to be
- * in ip_conntrack_core, since we don't want the protocols to autoload
- * or depend on ctnetlink */
-int ip_ct_port_tuple_to_nfattr(struct sk_buff *skb,
-			       const struct ip_conntrack_tuple *tuple)
-{
-	NFA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(u_int16_t),
-		&tuple->src.u.tcp.port);
-	NFA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(u_int16_t),
-		&tuple->dst.u.tcp.port);
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-int ip_ct_port_nfattr_to_tuple(struct nfattr *tb[],
-			       struct ip_conntrack_tuple *t)
-{
-	if (!tb[CTA_PROTO_SRC_PORT-1] || !tb[CTA_PROTO_DST_PORT-1])
-		return -EINVAL;
-
-	t->src.u.tcp.port =
-		*(u_int16_t *)NFA_DATA(tb[CTA_PROTO_SRC_PORT-1]);
-	t->dst.u.tcp.port =
-		*(u_int16_t *)NFA_DATA(tb[CTA_PROTO_DST_PORT-1]);
-
-	return 0;
-}
-#endif
-
 /* Returns new sk_buff, or NULL */
 struct sk_buff *
 ip_ct_gather_frags(struct sk_buff *skb, u_int32_t user)
@@ -1195,8 +943,10 @@ ip_ct_gather_frags(struct sk_buff *skb, u_int32_t user)
 	skb = ip_defrag(skb, user);
 	local_bh_enable();
 
-	if (skb)
+	if (skb) {
 		ip_send_check(skb->nh.iph);
+		skb->nfcache |= NFC_ALTERED;
+	}
 	return skb;
 }
 
@@ -1346,14 +1096,16 @@ static void free_conntrack_hash(void)
 				     * ip_conntrack_htable_size));
 }
 
-void ip_conntrack_flush()
+/* Mishearing the voices in his head, our hero wonders how he's
+   supposed to kill the mall. */
+void ip_conntrack_cleanup(void)
 {
+	ip_ct_attach = NULL;
 	/* This makes sure all current packets have passed through
            netfilter framework.  Roll on, two-stage module
            delete... */
 	synchronize_net();
-
-	ip_ct_event_cache_flush();
+ 
  i_see_dead_people:
 	ip_ct_iterate_cleanup(kill_all, NULL);
 	if (atomic_read(&ip_conntrack_count) != 0) {
@@ -1363,14 +1115,7 @@ void ip_conntrack_flush()
 	/* wait until all references to ip_conntrack_untracked are dropped */
 	while (atomic_read(&ip_conntrack_untracked.ct_general.use) > 1)
 		schedule();
-}
 
-/* Mishearing the voices in his head, our hero wonders how he's
-   supposed to kill the mall. */
-void ip_conntrack_cleanup(void)
-{
-	ip_ct_attach = NULL;
-	ip_conntrack_flush();
 	kmem_cache_destroy(ip_conntrack_cachep);
 	kmem_cache_destroy(ip_conntrack_expect_cachep);
 	free_conntrack_hash();
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_ftp.c b/trunk/net/ipv4/netfilter/ip_conntrack_ftp.c
index 3a2627db1729..7a3b773be3f9 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -25,7 +25,8 @@ MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
 MODULE_DESCRIPTION("ftp connection tracking helper");
 
 /* This is slow, but it's simple. --RR */
-static char *ftp_buffer;
+static char ftp_buffer[65536];
+
 static DEFINE_SPINLOCK(ip_ftp_lock);
 
 #define MAX_PORTS 8
@@ -261,8 +262,7 @@ static int find_nl_seq(u32 seq, const struct ip_ct_ftp_master *info, int dir)
 }
 
 /* We don't update if it's older than what we have. */
-static void update_nl_seq(u32 nl_seq, struct ip_ct_ftp_master *info, int dir,
-			  struct sk_buff *skb)
+static void update_nl_seq(u32 nl_seq, struct ip_ct_ftp_master *info, int dir)
 {
 	unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;
 
@@ -276,13 +276,10 @@ static void update_nl_seq(u32 nl_seq, struct ip_ct_ftp_master *info, int dir,
 			oldest = i;
 	}
 
-	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
+	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER)
 		info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
-		ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
-	} else if (oldest != NUM_SEQ_TO_REMEMBER) {
+	else if (oldest != NUM_SEQ_TO_REMEMBER)
 		info->seq_aft_nl[dir][oldest] = nl_seq;
-		ip_conntrack_event_cache(IPCT_HELPINFO_VOLATILE, skb);
-	}
 }
 
 static int help(struct sk_buff **pskb,
@@ -442,7 +439,7 @@ static int help(struct sk_buff **pskb,
 	/* Now if this ends in \n, update ftp info.  Seq may have been
 	 * adjusted by NAT code. */
 	if (ends_in_nl)
-		update_nl_seq(seq, ct_ftp_info,dir, *pskb);
+		update_nl_seq(seq, ct_ftp_info,dir);
  out:
 	spin_unlock_bh(&ip_ftp_lock);
 	return ret;
@@ -460,8 +457,6 @@ static void fini(void)
 				ports[i]);
 		ip_conntrack_helper_unregister(&ftp[i]);
 	}
-
-	kfree(ftp_buffer);
 }
 
 static int __init init(void)
@@ -469,10 +464,6 @@ static int __init init(void)
 	int i, ret;
 	char *tmpname;
 
-	ftp_buffer = kmalloc(65536, GFP_KERNEL);
-	if (!ftp_buffer)
-		return -ENOMEM;
-
 	if (ports_c == 0)
 		ports[ports_c++] = FTP_PORT;
 
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_irc.c b/trunk/net/ipv4/netfilter/ip_conntrack_irc.c
index 25438eec21a1..4a28f297d502 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_irc.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_irc.c
@@ -39,7 +39,7 @@ static int ports_c;
 static int max_dcc_channels = 8;
 static unsigned int dcc_timeout = 300;
 /* This is slow, but it's simple. --RR */
-static char *irc_buffer;
+static char irc_buffer[65536];
 static DEFINE_SPINLOCK(irc_buffer_lock);
 
 unsigned int (*ip_nat_irc_hook)(struct sk_buff **pskb,
@@ -257,10 +257,6 @@ static int __init init(void)
 		printk("ip_conntrack_irc: dcc_timeout must be a positive integer\n");
 		return -EBUSY;
 	}
-
-	irc_buffer = kmalloc(65536, GFP_KERNEL);
-	if (!irc_buffer)
-		return -ENOMEM;
 	
 	/* If no port given, default to standard irc port */
 	if (ports_c == 0)
@@ -308,7 +304,6 @@ static void fini(void)
 		       ports[i]);
 		ip_conntrack_helper_unregister(&irc_helpers[i]);
 	}
-	kfree(irc_buffer);
 }
 
 module_init(init);
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_netlink.c b/trunk/net/ipv4/netfilter/ip_conntrack_netlink.c
deleted file mode 100644
index a4e9278db4ed..000000000000
--- a/trunk/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ /dev/null
@@ -1,1579 +0,0 @@
-/* Connection tracking via netlink socket. Allows for user space
- * protocol helpers and general trouble making from userspace.
- *
- * (C) 2001 by Jay Schulist <jschlst@samba.org>
- * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
- * (C) 2003 by Patrick Mchardy <kaber@trash.net>
- * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
- *
- * I've reworked this stuff to use attributes instead of conntrack 
- * structures. 5.44 am. I need more tea. --pablo 05/07/11.
- *
- * Initial connection tracking via netlink development funded and 
- * generally made possible by Network Robots, Inc. (www.networkrobots.com)
- *
- * Further development of this code funded by Astaro AG (http://www.astaro.com)
- *
- * This software may be used and distributed according to the terms
- * of the GNU General Public License, incorporated herein by reference.
- */
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/types.h>
-#include <linux/timer.h>
-#include <linux/skbuff.h>
-#include <linux/errno.h>
-#include <linux/netlink.h>
-#include <linux/spinlock.h>
-#include <linux/notifier.h>
-#include <linux/rtnetlink.h>
-
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv4.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv4/ip_conntrack.h>
-#include <linux/netfilter_ipv4/ip_conntrack_core.h>
-#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
-#include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
-#include <linux/netfilter_ipv4/ip_nat_protocol.h>
-
-#include <linux/netfilter/nfnetlink.h>
-#include <linux/netfilter/nfnetlink_conntrack.h>
-
-MODULE_LICENSE("GPL");
-
-static char __initdata version[] = "0.90";
-
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
-
-static inline int
-ctnetlink_dump_tuples_proto(struct sk_buff *skb, 
-			    const struct ip_conntrack_tuple *tuple)
-{
-	struct ip_conntrack_protocol *proto;
-
-	NFA_PUT(skb, CTA_PROTO_NUM, sizeof(u_int8_t), &tuple->dst.protonum);
-
-	proto = ip_conntrack_proto_find_get(tuple->dst.protonum);
-	if (proto && proto->tuple_to_nfattr)
-		return proto->tuple_to_nfattr(skb, tuple);
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-static inline int
-ctnetlink_dump_tuples(struct sk_buff *skb, 
-		      const struct ip_conntrack_tuple *tuple)
-{
-	struct nfattr *nest_parms;
-	
-	nest_parms = NFA_NEST(skb, CTA_TUPLE_IP);
-	NFA_PUT(skb, CTA_IP_V4_SRC, sizeof(u_int32_t), &tuple->src.ip);
-	NFA_PUT(skb, CTA_IP_V4_DST, sizeof(u_int32_t), &tuple->dst.ip);
-	NFA_NEST_END(skb, nest_parms);
-
-	nest_parms = NFA_NEST(skb, CTA_TUPLE_PROTO);
-	ctnetlink_dump_tuples_proto(skb, tuple);
-	NFA_NEST_END(skb, nest_parms);
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-static inline int
-ctnetlink_dump_status(struct sk_buff *skb, const struct ip_conntrack *ct)
-{
-	u_int32_t status = htonl((u_int32_t) ct->status);
-	NFA_PUT(skb, CTA_STATUS, sizeof(status), &status);
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-static inline int
-ctnetlink_dump_timeout(struct sk_buff *skb, const struct ip_conntrack *ct)
-{
-	long timeout_l = ct->timeout.expires - jiffies;
-	u_int32_t timeout;
-
-	if (timeout_l < 0)
-		timeout = 0;
-	else
-		timeout = htonl(timeout_l / HZ);
-	
-	NFA_PUT(skb, CTA_TIMEOUT, sizeof(timeout), &timeout);
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-static inline int
-ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct ip_conntrack *ct)
-{
-	struct ip_conntrack_protocol *proto = ip_conntrack_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
-
-	struct nfattr *nest_proto;
-	int ret;
-	
-	if (!proto || !proto->to_nfattr)
-		return 0;
-	
-	nest_proto = NFA_NEST(skb, CTA_PROTOINFO);
-
-	ret = proto->to_nfattr(skb, nest_proto, ct);
-
-	ip_conntrack_proto_put(proto);
-
-	NFA_NEST_END(skb, nest_proto);
-
-	return ret;
-
-nfattr_failure:
-	return -1;
-}
-
-static inline int
-ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct ip_conntrack *ct)
-{
-	struct nfattr *nest_helper;
-
-	if (!ct->helper)
-		return 0;
-		
-	nest_helper = NFA_NEST(skb, CTA_HELP);
-	NFA_PUT(skb, CTA_HELP_NAME, CTA_HELP_MAXNAMESIZE, &ct->helper->name);
-
-	if (ct->helper->to_nfattr)
-		ct->helper->to_nfattr(skb, ct);
-
-	NFA_NEST_END(skb, nest_helper);
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-#ifdef CONFIG_IP_NF_CT_ACCT
-static inline int
-ctnetlink_dump_counters(struct sk_buff *skb, const struct ip_conntrack *ct,
-			enum ip_conntrack_dir dir)
-{
-	enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
-	struct nfattr *nest_count = NFA_NEST(skb, type);
-	u_int64_t tmp;
-
-	tmp = cpu_to_be64(ct->counters[dir].packets);
-	NFA_PUT(skb, CTA_COUNTERS_PACKETS, sizeof(u_int64_t), &tmp);
-
-	tmp = cpu_to_be64(ct->counters[dir].bytes);
-	NFA_PUT(skb, CTA_COUNTERS_BYTES, sizeof(u_int64_t), &tmp);
-
-	NFA_NEST_END(skb, nest_count);
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-#else
-#define ctnetlink_dump_counters(a, b, c) (0)
-#endif
-
-#ifdef CONFIG_IP_NF_CONNTRACK_MARK
-static inline int
-ctnetlink_dump_mark(struct sk_buff *skb, const struct ip_conntrack *ct)
-{
-	u_int32_t mark = htonl(ct->mark);
-
-	NFA_PUT(skb, CTA_MARK, sizeof(u_int32_t), &mark);
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-#else
-#define ctnetlink_dump_mark(a, b) (0)
-#endif
-
-static inline int
-ctnetlink_dump_id(struct sk_buff *skb, const struct ip_conntrack *ct)
-{
-	u_int32_t id = htonl(ct->id);
-	NFA_PUT(skb, CTA_ID, sizeof(u_int32_t), &id);
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-static inline int
-ctnetlink_dump_use(struct sk_buff *skb, const struct ip_conntrack *ct)
-{
-	unsigned int use = htonl(atomic_read(&ct->ct_general.use));
-	
-	NFA_PUT(skb, CTA_USE, sizeof(u_int32_t), &use);
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-#define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
-
-static int
-ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
-		    int event, int nowait, 
-		    const struct ip_conntrack *ct)
-{
-	struct nlmsghdr *nlh;
-	struct nfgenmsg *nfmsg;
-	struct nfattr *nest_parms;
-	unsigned char *b;
-
-	b = skb->tail;
-
-	event |= NFNL_SUBSYS_CTNETLINK << 8;
-	nlh    = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
-	nfmsg  = NLMSG_DATA(nlh);
-
-	nlh->nlmsg_flags    = (nowait && pid) ? NLM_F_MULTI : 0;
-	nfmsg->nfgen_family = AF_INET;
-	nfmsg->version      = NFNETLINK_V0;
-	nfmsg->res_id	    = 0;
-
-	nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
-	if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
-		goto nfattr_failure;
-	NFA_NEST_END(skb, nest_parms);
-	
-	nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
-	if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
-		goto nfattr_failure;
-	NFA_NEST_END(skb, nest_parms);
-
-	if (ctnetlink_dump_status(skb, ct) < 0 ||
-	    ctnetlink_dump_timeout(skb, ct) < 0 ||
-	    ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
-	    ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
-	    ctnetlink_dump_protoinfo(skb, ct) < 0 ||
-	    ctnetlink_dump_helpinfo(skb, ct) < 0 ||
-	    ctnetlink_dump_mark(skb, ct) < 0 ||
-	    ctnetlink_dump_id(skb, ct) < 0 ||
-	    ctnetlink_dump_use(skb, ct) < 0)
-		goto nfattr_failure;
-
-	nlh->nlmsg_len = skb->tail - b;
-	return skb->len;
-
-nlmsg_failure:
-nfattr_failure:
-	skb_trim(skb, b - skb->data);
-	return -1;
-}
-
-#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-static int ctnetlink_conntrack_event(struct notifier_block *this,
-                                     unsigned long events, void *ptr)
-{
-	struct nlmsghdr *nlh;
-	struct nfgenmsg *nfmsg;
-	struct nfattr *nest_parms;
-	struct ip_conntrack *ct = (struct ip_conntrack *)ptr;
-	struct sk_buff *skb;
-	unsigned int type;
-	unsigned char *b;
-	unsigned int flags = 0, group;
-
-	/* ignore our fake conntrack entry */
-	if (ct == &ip_conntrack_untracked)
-		return NOTIFY_DONE;
-
-	if (events & IPCT_DESTROY) {
-		type = IPCTNL_MSG_CT_DELETE;
-		group = NFNLGRP_CONNTRACK_DESTROY;
-		goto alloc_skb;
-	}
-	if (events & (IPCT_NEW | IPCT_RELATED)) {
-		type = IPCTNL_MSG_CT_NEW;
-		flags = NLM_F_CREATE|NLM_F_EXCL;
-		/* dump everything */
-		events = ~0UL;
-		group = NFNLGRP_CONNTRACK_NEW;
-		goto alloc_skb;
-	}
-	if (events & (IPCT_STATUS |
-		      IPCT_PROTOINFO |
-		      IPCT_HELPER |
-		      IPCT_HELPINFO |
-		      IPCT_NATINFO)) {
-		type = IPCTNL_MSG_CT_NEW;
-		group = NFNLGRP_CONNTRACK_UPDATE;
-		goto alloc_skb;
-	} 
-	
-	return NOTIFY_DONE;
-
-alloc_skb:
-  /* FIXME: Check if there are any listeners before, don't hurt performance */
-	
-	skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
-	if (!skb)
-		return NOTIFY_DONE;
-
-	b = skb->tail;
-
-	type |= NFNL_SUBSYS_CTNETLINK << 8;
-	nlh   = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
-	nfmsg = NLMSG_DATA(nlh);
-
-	nlh->nlmsg_flags    = flags;
-	nfmsg->nfgen_family = AF_INET;
-	nfmsg->version	= NFNETLINK_V0;
-	nfmsg->res_id	= 0;
-
-	nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
-	if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
-		goto nfattr_failure;
-	NFA_NEST_END(skb, nest_parms);
-	
-	nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
-	if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
-		goto nfattr_failure;
-	NFA_NEST_END(skb, nest_parms);
-	
-	/* NAT stuff is now a status flag */
-	if ((events & IPCT_STATUS || events & IPCT_NATINFO)
-	    && ctnetlink_dump_status(skb, ct) < 0)
-		goto nfattr_failure;
-	if (events & IPCT_REFRESH
-	    && ctnetlink_dump_timeout(skb, ct) < 0)
-		goto nfattr_failure;
-	if (events & IPCT_PROTOINFO
-	    && ctnetlink_dump_protoinfo(skb, ct) < 0)
-		goto nfattr_failure;
-	if (events & IPCT_HELPINFO
-	    && ctnetlink_dump_helpinfo(skb, ct) < 0)
-		goto nfattr_failure;
-
-	if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
-	    ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
-		goto nfattr_failure;
-
-	nlh->nlmsg_len = skb->tail - b;
-	nfnetlink_send(skb, 0, group, 0);
-	return NOTIFY_DONE;
-
-nlmsg_failure:
-nfattr_failure:
-	kfree_skb(skb);
-	return NOTIFY_DONE;
-}
-#endif /* CONFIG_IP_NF_CONNTRACK_EVENTS */
-
-static int ctnetlink_done(struct netlink_callback *cb)
-{
-	DEBUGP("entered %s\n", __FUNCTION__);
-	return 0;
-}
-
-static int
-ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
-{
-	struct ip_conntrack *ct = NULL;
-	struct ip_conntrack_tuple_hash *h;
-	struct list_head *i;
-	u_int32_t *id = (u_int32_t *) &cb->args[1];
-
-	DEBUGP("entered %s, last bucket=%lu id=%u\n", __FUNCTION__, 
-			cb->args[0], *id);
-
-	read_lock_bh(&ip_conntrack_lock);
-	for (; cb->args[0] < ip_conntrack_htable_size; cb->args[0]++, *id = 0) {
-		list_for_each_prev(i, &ip_conntrack_hash[cb->args[0]]) {
-			h = (struct ip_conntrack_tuple_hash *) i;
-			if (DIRECTION(h) != IP_CT_DIR_ORIGINAL)
-				continue;
-			ct = tuplehash_to_ctrack(h);
-			if (ct->id <= *id)
-				continue;
-			if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
-		                        	cb->nlh->nlmsg_seq,
-						IPCTNL_MSG_CT_NEW,
-						1, ct) < 0)
-				goto out;
-			*id = ct->id;
-		}
-	}
-out:	
-	read_unlock_bh(&ip_conntrack_lock);
-
-	DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
-
-	return skb->len;
-}
-
-#ifdef CONFIG_IP_NF_CT_ACCT
-static int
-ctnetlink_dump_table_w(struct sk_buff *skb, struct netlink_callback *cb)
-{
-	struct ip_conntrack *ct = NULL;
-	struct ip_conntrack_tuple_hash *h;
-	struct list_head *i;
-	u_int32_t *id = (u_int32_t *) &cb->args[1];
-
-	DEBUGP("entered %s, last bucket=%u id=%u\n", __FUNCTION__, 
-			cb->args[0], *id);
-
-	write_lock_bh(&ip_conntrack_lock);
-	for (; cb->args[0] < ip_conntrack_htable_size; cb->args[0]++, *id = 0) {
-		list_for_each_prev(i, &ip_conntrack_hash[cb->args[0]]) {
-			h = (struct ip_conntrack_tuple_hash *) i;
-			if (DIRECTION(h) != IP_CT_DIR_ORIGINAL)
-				continue;
-			ct = tuplehash_to_ctrack(h);
-			if (ct->id <= *id)
-				continue;
-			if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
-		                        	cb->nlh->nlmsg_seq,
-						IPCTNL_MSG_CT_NEW,
-						1, ct) < 0)
-				goto out;
-			*id = ct->id;
-
-			memset(&ct->counters, 0, sizeof(ct->counters));
-		}
-	}
-out:	
-	write_unlock_bh(&ip_conntrack_lock);
-
-	DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
-
-	return skb->len;
-}
-#endif
-
-static const int cta_min_ip[CTA_IP_MAX] = {
-	[CTA_IP_V4_SRC-1]	= sizeof(u_int32_t),
-	[CTA_IP_V4_DST-1]	= sizeof(u_int32_t),
-};
-
-static inline int
-ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
-{
-	struct nfattr *tb[CTA_IP_MAX];
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	
-	if (nfattr_parse_nested(tb, CTA_IP_MAX, attr) < 0)
-		goto nfattr_failure;
-
-	if (nfattr_bad_size(tb, CTA_IP_MAX, cta_min_ip))
-		return -EINVAL;
-
-	if (!tb[CTA_IP_V4_SRC-1])
-		return -EINVAL;
-	tuple->src.ip = *(u_int32_t *)NFA_DATA(tb[CTA_IP_V4_SRC-1]);
-
-	if (!tb[CTA_IP_V4_DST-1])
-		return -EINVAL;
-	tuple->dst.ip = *(u_int32_t *)NFA_DATA(tb[CTA_IP_V4_DST-1]);
-
-	DEBUGP("leaving\n");
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-static const int cta_min_proto[CTA_PROTO_MAX] = {
-	[CTA_PROTO_NUM-1]	= sizeof(u_int16_t),
-	[CTA_PROTO_SRC_PORT-1]	= sizeof(u_int16_t),
-	[CTA_PROTO_DST_PORT-1]	= sizeof(u_int16_t),
-	[CTA_PROTO_ICMP_TYPE-1]	= sizeof(u_int8_t),
-	[CTA_PROTO_ICMP_CODE-1]	= sizeof(u_int8_t),
-	[CTA_PROTO_ICMP_ID-1]	= sizeof(u_int16_t),
-};
-
-static inline int
-ctnetlink_parse_tuple_proto(struct nfattr *attr, 
-			    struct ip_conntrack_tuple *tuple)
-{
-	struct nfattr *tb[CTA_PROTO_MAX];
-	struct ip_conntrack_protocol *proto;
-	int ret = 0;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	if (nfattr_parse_nested(tb, CTA_PROTO_MAX, attr) < 0)
-		goto nfattr_failure;
-
-	if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
-		return -EINVAL;
-
-	if (!tb[CTA_PROTO_NUM-1])
-		return -EINVAL;
-	tuple->dst.protonum = *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
-
-	proto = ip_conntrack_proto_find_get(tuple->dst.protonum);
-
-	if (likely(proto && proto->nfattr_to_tuple)) {
-		ret = proto->nfattr_to_tuple(tb, tuple);
-		ip_conntrack_proto_put(proto);
-	}
-	
-	return ret;
-
-nfattr_failure:
-	return -1;
-}
-
-static inline int
-ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
-		      enum ctattr_tuple type)
-{
-	struct nfattr *tb[CTA_TUPLE_MAX];
-	int err;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	memset(tuple, 0, sizeof(*tuple));
-
-	if (nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]) < 0)
-		goto nfattr_failure;
-
-	if (!tb[CTA_TUPLE_IP-1])
-		return -EINVAL;
-
-	err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP-1], tuple);
-	if (err < 0)
-		return err;
-
-	if (!tb[CTA_TUPLE_PROTO-1])
-		return -EINVAL;
-
-	err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO-1], tuple);
-	if (err < 0)
-		return err;
-
-	/* orig and expect tuples get DIR_ORIGINAL */
-	if (type == CTA_TUPLE_REPLY)
-		tuple->dst.dir = IP_CT_DIR_REPLY;
-	else
-		tuple->dst.dir = IP_CT_DIR_ORIGINAL;
-
-	DUMP_TUPLE(tuple);
-
-	DEBUGP("leaving\n");
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-#ifdef CONFIG_IP_NF_NAT_NEEDED
-static const int cta_min_protonat[CTA_PROTONAT_MAX] = {
-	[CTA_PROTONAT_PORT_MIN-1]	= sizeof(u_int16_t),
-	[CTA_PROTONAT_PORT_MAX-1]	= sizeof(u_int16_t),
-};
-
-static int ctnetlink_parse_nat_proto(struct nfattr *attr,
-				     const struct ip_conntrack *ct,
-				     struct ip_nat_range *range)
-{
-	struct nfattr *tb[CTA_PROTONAT_MAX];
-	struct ip_nat_protocol *npt;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	if (nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr) < 0)
-		goto nfattr_failure;
-
-	if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
-		goto nfattr_failure;
-
-	npt = ip_nat_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
-	if (!npt)
-		return 0;
-
-	if (!npt->nfattr_to_range) {
-		ip_nat_proto_put(npt);
-		return 0;
-	}
-
-	/* nfattr_to_range returns 1 if it parsed, 0 if not, neg. on error */
-	if (npt->nfattr_to_range(tb, range) > 0)
-		range->flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
-
-	ip_nat_proto_put(npt);
-
-	DEBUGP("leaving\n");
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-static inline int
-ctnetlink_parse_nat(struct nfattr *cda[],
-		    const struct ip_conntrack *ct, struct ip_nat_range *range)
-{
-	struct nfattr *tb[CTA_NAT_MAX];
-	int err;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	memset(range, 0, sizeof(*range));
-	
-	if (nfattr_parse_nested(tb, CTA_NAT_MAX, cda[CTA_NAT-1]) < 0)
-		goto nfattr_failure;
-
-	if (tb[CTA_NAT_MINIP-1])
-		range->min_ip = *(u_int32_t *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
-
-	if (!tb[CTA_NAT_MAXIP-1])
-		range->max_ip = range->min_ip;
-	else
-		range->max_ip = *(u_int32_t *)NFA_DATA(tb[CTA_NAT_MAXIP-1]);
-
-	if (range->min_ip)
-		range->flags |= IP_NAT_RANGE_MAP_IPS;
-
-	if (!tb[CTA_NAT_PROTO-1])
-		return 0;
-
-	err = ctnetlink_parse_nat_proto(tb[CTA_NAT_PROTO-1], ct, range);
-	if (err < 0)
-		return err;
-
-	DEBUGP("leaving\n");
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-#endif
-
-static inline int
-ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
-{
-	struct nfattr *tb[CTA_HELP_MAX];
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	if (nfattr_parse_nested(tb, CTA_HELP_MAX, attr) < 0)
-		goto nfattr_failure;
-
-	if (!tb[CTA_HELP_NAME-1])
-		return -EINVAL;
-
-	*helper_name = NFA_DATA(tb[CTA_HELP_NAME-1]);
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-static int
-ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb, 
-			struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
-{
-	struct ip_conntrack_tuple_hash *h;
-	struct ip_conntrack_tuple tuple;
-	struct ip_conntrack *ct;
-	int err = 0;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	if (cda[CTA_TUPLE_ORIG-1])
-		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG);
-	else if (cda[CTA_TUPLE_REPLY-1])
-		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY);
-	else {
-		/* Flush the whole table */
-		ip_conntrack_flush();
-		return 0;
-	}
-
-	if (err < 0)
-		return err;
-
-	h = ip_conntrack_find_get(&tuple, NULL);
-	if (!h) {
-		DEBUGP("tuple not found in conntrack hash\n");
-		return -ENOENT;
-	}
-
-	ct = tuplehash_to_ctrack(h);
-	
-	if (cda[CTA_ID-1]) {
-		u_int32_t id = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_ID-1]));
-		if (ct->id != id) {
-			ip_conntrack_put(ct);
-			return -ENOENT;
-		}
-	}	
-	if (del_timer(&ct->timeout)) {
-		ip_conntrack_put(ct);
-		ct->timeout.function((unsigned long)ct);
-		return 0;
-	}
-	ip_conntrack_put(ct);
-	DEBUGP("leaving\n");
-
-	return 0;
-}
-
-static int
-ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb, 
-			struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
-{
-	struct ip_conntrack_tuple_hash *h;
-	struct ip_conntrack_tuple tuple;
-	struct ip_conntrack *ct;
-	struct sk_buff *skb2 = NULL;
-	int err = 0;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	if (nlh->nlmsg_flags & NLM_F_DUMP) {
-		struct nfgenmsg *msg = NLMSG_DATA(nlh);
-		u32 rlen;
-
-		if (msg->nfgen_family != AF_INET)
-			return -EAFNOSUPPORT;
-
-		if (NFNL_MSG_TYPE(nlh->nlmsg_type) ==
-					IPCTNL_MSG_CT_GET_CTRZERO) {
-#ifdef CONFIG_IP_NF_CT_ACCT
-			if ((*errp = netlink_dump_start(ctnl, skb, nlh,
-						ctnetlink_dump_table_w,
-						ctnetlink_done)) != 0)
-				return -EINVAL;
-#else
-			return -ENOTSUPP;
-#endif
-		} else {
-			if ((*errp = netlink_dump_start(ctnl, skb, nlh,
-		      		                        ctnetlink_dump_table,
-		                                	ctnetlink_done)) != 0)
-			return -EINVAL;
-		}
-
-		rlen = NLMSG_ALIGN(nlh->nlmsg_len);
-		if (rlen > skb->len)
-			rlen = skb->len;
-		skb_pull(skb, rlen);
-		return 0;
-	}
-
-	if (cda[CTA_TUPLE_ORIG-1])
-		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG);
-	else if (cda[CTA_TUPLE_REPLY-1])
-		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY);
-	else
-		return -EINVAL;
-
-	if (err < 0)
-		return err;
-
-	h = ip_conntrack_find_get(&tuple, NULL);
-	if (!h) {
-		DEBUGP("tuple not found in conntrack hash");
-		return -ENOENT;
-	}
-	DEBUGP("tuple found\n");
-	ct = tuplehash_to_ctrack(h);
-
-	err = -ENOMEM;
-	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
-	if (!skb2) {
-		ip_conntrack_put(ct);
-		return -ENOMEM;
-	}
-	NETLINK_CB(skb2).dst_pid = NETLINK_CB(skb).pid;
-
-	err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 
-				  IPCTNL_MSG_CT_NEW, 1, ct);
-	ip_conntrack_put(ct);
-	if (err <= 0)
-		goto out;
-
-	err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
-	if (err < 0)
-		goto out;
-
-	DEBUGP("leaving\n");
-	return 0;
-
-out:
-	if (skb2)
-		kfree_skb(skb2);
-	return -1;
-}
-
-static inline int
-ctnetlink_change_status(struct ip_conntrack *ct, struct nfattr *cda[])
-{
-	unsigned long d, status = *(u_int32_t *)NFA_DATA(cda[CTA_STATUS-1]);
-	d = ct->status ^ status;
-
-	if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
-		/* unchangeable */
-		return -EINVAL;
-	
-	if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
-		/* SEEN_REPLY bit can only be set */
-		return -EINVAL;
-
-	
-	if (d & IPS_ASSURED && !(status & IPS_ASSURED))
-		/* ASSURED bit can only be set */
-		return -EINVAL;
-
-	if (cda[CTA_NAT-1]) {
-#ifndef CONFIG_IP_NF_NAT_NEEDED
-		return -EINVAL;
-#else
-		unsigned int hooknum;
-		struct ip_nat_range range;
-
-		if (ctnetlink_parse_nat(cda, ct, &range) < 0)
-			return -EINVAL;
-
-		DEBUGP("NAT: %u.%u.%u.%u-%u.%u.%u.%u:%u-%u\n", 
-		       NIPQUAD(range.min_ip), NIPQUAD(range.max_ip),
-		       htons(range.min.all), htons(range.max.all));
-		
-		/* This is tricky but it works. ip_nat_setup_info needs the
-		 * hook number as parameter, so let's do the correct 
-		 * conversion and run away */
-		if (status & IPS_SRC_NAT_DONE)
-			hooknum = NF_IP_POST_ROUTING; /* IP_NAT_MANIP_SRC */
-		else if (status & IPS_DST_NAT_DONE)
-			hooknum = NF_IP_PRE_ROUTING;  /* IP_NAT_MANIP_DST */
-		else 
-			return -EINVAL; /* Missing NAT flags */
-
-		DEBUGP("NAT status: %lu\n", 
-		       status & (IPS_NAT_MASK | IPS_NAT_DONE_MASK));
-		
-		if (ip_nat_initialized(ct, hooknum))
-			return -EEXIST;
-		ip_nat_setup_info(ct, &range, hooknum);
-
-                DEBUGP("NAT status after setup_info: %lu\n",
-                       ct->status & (IPS_NAT_MASK | IPS_NAT_DONE_MASK));
-#endif
-	}
-
-	/* Be careful here, modifying NAT bits can screw up things,
-	 * so don't let users modify them directly if they don't pass
-	 * ip_nat_range. */
-	ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
-	return 0;
-}
-
-
-static inline int
-ctnetlink_change_helper(struct ip_conntrack *ct, struct nfattr *cda[])
-{
-	struct ip_conntrack_helper *helper;
-	char *helpname;
-	int err;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	/* don't change helper of sibling connections */
-	if (ct->master)
-		return -EINVAL;
-
-	err = ctnetlink_parse_help(cda[CTA_HELP-1], &helpname);
-	if (err < 0)
-		return err;
-
-	helper = __ip_conntrack_helper_find_byname(helpname);
-	if (!helper) {
-		if (!strcmp(helpname, ""))
-			helper = NULL;
-		else
-			return -EINVAL;
-	}
-
-	if (ct->helper) {
-		if (!helper) {
-			/* we had a helper before ... */
-			ip_ct_remove_expectations(ct);
-			ct->helper = NULL;
-		} else {
-			/* need to zero data of old helper */
-			memset(&ct->help, 0, sizeof(ct->help));
-		}
-	}
-	
-	ct->helper = helper;
-
-	return 0;
-}
-
-static inline int
-ctnetlink_change_timeout(struct ip_conntrack *ct, struct nfattr *cda[])
-{
-	u_int32_t timeout = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_TIMEOUT-1]));
-	
-	if (!del_timer(&ct->timeout))
-		return -ETIME;
-
-	ct->timeout.expires = jiffies + timeout * HZ;
-	add_timer(&ct->timeout);
-
-	return 0;
-}
-
-static int
-ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
-{
-	int err;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	if (cda[CTA_HELP-1]) {
-		err = ctnetlink_change_helper(ct, cda);
-		if (err < 0)
-			return err;
-	}
-
-	if (cda[CTA_TIMEOUT-1]) {
-		err = ctnetlink_change_timeout(ct, cda);
-		if (err < 0)
-			return err;
-	}
-
-	if (cda[CTA_STATUS-1]) {
-		err = ctnetlink_change_status(ct, cda);
-		if (err < 0)
-			return err;
-	}
-
-	DEBUGP("all done\n");
-	return 0;
-}
-
-static int
-ctnetlink_create_conntrack(struct nfattr *cda[], 
-			   struct ip_conntrack_tuple *otuple,
-			   struct ip_conntrack_tuple *rtuple)
-{
-	struct ip_conntrack *ct;
-	int err = -EINVAL;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	ct = ip_conntrack_alloc(otuple, rtuple);
-	if (ct == NULL || IS_ERR(ct))
-		return -ENOMEM;	
-
-	if (!cda[CTA_TIMEOUT-1])
-		goto err;
-	ct->timeout.expires = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_TIMEOUT-1]));
-
-	ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
-	ct->status |= IPS_CONFIRMED;
-
-	err = ctnetlink_change_status(ct, cda);
-	if (err < 0)
-		goto err;
-
-	ct->helper = ip_conntrack_helper_find_get(rtuple);
-
-	add_timer(&ct->timeout);
-	ip_conntrack_hash_insert(ct);
-
-	if (ct->helper)
-		ip_conntrack_helper_put(ct->helper);
-
-	DEBUGP("conntrack with id %u inserted\n", ct->id);
-	return 0;
-
-err:	
-	ip_conntrack_free(ct);
-	return err;
-}
-
-static int 
-ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, 
-			struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
-{
-	struct ip_conntrack_tuple otuple, rtuple;
-	struct ip_conntrack_tuple_hash *h = NULL;
-	int err = 0;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	if (cda[CTA_TUPLE_ORIG-1]) {
-		err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG);
-		if (err < 0)
-			return err;
-	}
-
-	if (cda[CTA_TUPLE_REPLY-1]) {
-		err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY);
-		if (err < 0)
-			return err;
-	}
-
-	write_lock_bh(&ip_conntrack_lock);
-	if (cda[CTA_TUPLE_ORIG-1])
-		h = __ip_conntrack_find(&otuple, NULL);
-	else if (cda[CTA_TUPLE_REPLY-1])
-		h = __ip_conntrack_find(&rtuple, NULL);
-
-	if (h == NULL) {
-		write_unlock_bh(&ip_conntrack_lock);
-		DEBUGP("no such conntrack, create new\n");
-		err = -ENOENT;
-		if (nlh->nlmsg_flags & NLM_F_CREATE)
-			err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
-		return err;
-	}
-	/* implicit 'else' */
-
-	/* we only allow nat config for new conntracks */
-	if (cda[CTA_NAT-1]) {
-		err = -EINVAL;
-		goto out_unlock;
-	}
-
-	/* We manipulate the conntrack inside the global conntrack table lock,
-	 * so there's no need to increase the refcount */
-	DEBUGP("conntrack found\n");
-	err = -EEXIST;
-	if (!(nlh->nlmsg_flags & NLM_F_EXCL))
-		err = ctnetlink_change_conntrack(tuplehash_to_ctrack(h), cda);
-
-out_unlock:
-	write_unlock_bh(&ip_conntrack_lock);
-	return err;
-}
-
-/*********************************************************************** 
- * EXPECT 
- ***********************************************************************/ 
-
-static inline int
-ctnetlink_exp_dump_tuple(struct sk_buff *skb,
-			 const struct ip_conntrack_tuple *tuple,
-			 enum ctattr_expect type)
-{
-	struct nfattr *nest_parms = NFA_NEST(skb, type);
-	
-	if (ctnetlink_dump_tuples(skb, tuple) < 0)
-		goto nfattr_failure;
-
-	NFA_NEST_END(skb, nest_parms);
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}			
-
-static inline int
-ctnetlink_exp_dump_expect(struct sk_buff *skb,
-                          const struct ip_conntrack_expect *exp)
-{
-	struct ip_conntrack *master = exp->master;
-	u_int32_t timeout = htonl((exp->timeout.expires - jiffies) / HZ);
-	u_int32_t id = htonl(exp->id);
-
-	if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
-		goto nfattr_failure;
-	if (ctnetlink_exp_dump_tuple(skb, &exp->mask, CTA_EXPECT_MASK) < 0)
-		goto nfattr_failure;
-	if (ctnetlink_exp_dump_tuple(skb,
-				 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
-				 CTA_EXPECT_MASTER) < 0)
-		goto nfattr_failure;
-	
-	NFA_PUT(skb, CTA_EXPECT_TIMEOUT, sizeof(timeout), &timeout);
-	NFA_PUT(skb, CTA_EXPECT_ID, sizeof(u_int32_t), &id);
-
-	return 0;
-	
-nfattr_failure:
-	return -1;
-}
-
-static int
-ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
-		    int event, 
-		    int nowait, 
-		    const struct ip_conntrack_expect *exp)
-{
-	struct nlmsghdr *nlh;
-	struct nfgenmsg *nfmsg;
-	unsigned char *b;
-
-	b = skb->tail;
-
-	event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
-	nlh    = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
-	nfmsg  = NLMSG_DATA(nlh);
-
-	nlh->nlmsg_flags    = (nowait && pid) ? NLM_F_MULTI : 0;
-	nfmsg->nfgen_family = AF_INET;
-	nfmsg->version	    = NFNETLINK_V0;
-	nfmsg->res_id	    = 0;
-
-	if (ctnetlink_exp_dump_expect(skb, exp) < 0)
-		goto nfattr_failure;
-
-	nlh->nlmsg_len = skb->tail - b;
-	return skb->len;
-
-nlmsg_failure:
-nfattr_failure:
-	skb_trim(skb, b - skb->data);
-	return -1;
-}
-
-#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-static int ctnetlink_expect_event(struct notifier_block *this,
-				  unsigned long events, void *ptr)
-{
-	struct nlmsghdr *nlh;
-	struct nfgenmsg *nfmsg;
-	struct ip_conntrack_expect *exp = (struct ip_conntrack_expect *)ptr;
-	struct sk_buff *skb;
-	unsigned int type;
-	unsigned char *b;
-	int flags = 0;
-	u16 proto;
-
-	if (events & IPEXP_NEW) {
-		type = IPCTNL_MSG_EXP_NEW;
-		flags = NLM_F_CREATE|NLM_F_EXCL;
-	} else
-		return NOTIFY_DONE;
-
-	skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
-	if (!skb)
-		return NOTIFY_DONE;
-
-	b = skb->tail;
-
-	type |= NFNL_SUBSYS_CTNETLINK << 8;
-	nlh   = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
-	nfmsg = NLMSG_DATA(nlh);
-
-	nlh->nlmsg_flags    = flags;
-	nfmsg->nfgen_family = AF_INET;
-	nfmsg->version	    = NFNETLINK_V0;
-	nfmsg->res_id	    = 0;
-
-	if (ctnetlink_exp_dump_expect(skb, exp) < 0)
-		goto nfattr_failure;
-
-	nlh->nlmsg_len = skb->tail - b;
-	proto = exp->tuple.dst.protonum;
-	nfnetlink_send(skb, 0, NFNLGRP_CONNTRACK_EXP_NEW, 0);
-	return NOTIFY_DONE;
-
-nlmsg_failure:
-nfattr_failure:
-	kfree_skb(skb);
-	return NOTIFY_DONE;
-}
-#endif
-
-static int
-ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
-{
-	struct ip_conntrack_expect *exp = NULL;
-	struct list_head *i;
-	u_int32_t *id = (u_int32_t *) &cb->args[0];
-
-	DEBUGP("entered %s, last id=%llu\n", __FUNCTION__, *id);
-
-	read_lock_bh(&ip_conntrack_lock);
-	list_for_each_prev(i, &ip_conntrack_expect_list) {
-		exp = (struct ip_conntrack_expect *) i;
-		if (exp->id <= *id)
-			continue;
-		if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).pid,
-					    cb->nlh->nlmsg_seq,
-					    IPCTNL_MSG_EXP_NEW,
-					    1, exp) < 0)
-			goto out;
-		*id = exp->id;
-	}
-out:	
-	read_unlock_bh(&ip_conntrack_lock);
-
-	DEBUGP("leaving, last id=%llu\n", *id);
-
-	return skb->len;
-}
-
-static int
-ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb, 
-		     struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
-{
-	struct ip_conntrack_tuple tuple;
-	struct ip_conntrack_expect *exp;
-	struct sk_buff *skb2;
-	int err = 0;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	if (nlh->nlmsg_flags & NLM_F_DUMP) {
-		struct nfgenmsg *msg = NLMSG_DATA(nlh);
-		u32 rlen;
-
-		if (msg->nfgen_family != AF_INET)
-			return -EAFNOSUPPORT;
-
-		if ((*errp = netlink_dump_start(ctnl, skb, nlh,
-		    				ctnetlink_exp_dump_table,
-						ctnetlink_done)) != 0)
-			return -EINVAL;
-		rlen = NLMSG_ALIGN(nlh->nlmsg_len);
-		if (rlen > skb->len)
-			rlen = skb->len;
-		skb_pull(skb, rlen);
-		return 0;
-	}
-
-	if (cda[CTA_EXPECT_MASTER-1])
-		err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER);
-	else
-		return -EINVAL;
-
-	if (err < 0)
-		return err;
-
-	exp = ip_conntrack_expect_find_get(&tuple);
-	if (!exp)
-		return -ENOENT;
-
-	err = -ENOMEM;
-	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
-	if (!skb2)
-		goto out;
-	NETLINK_CB(skb2).dst_pid = NETLINK_CB(skb).pid;
-	
-	err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid, 
-				      nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
-				      1, exp);
-	if (err <= 0)
-		goto out;
-
-	ip_conntrack_expect_put(exp);
-
-	err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
-	if (err < 0)
-		goto free;
-
-	return err;
-
-out:
-	ip_conntrack_expect_put(exp);
-free:
-	if (skb2)
-		kfree_skb(skb2);
-	return err;
-}
-
-static int
-ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb, 
-		     struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
-{
-	struct ip_conntrack_expect *exp, *tmp;
-	struct ip_conntrack_tuple tuple;
-	struct ip_conntrack_helper *h;
-	int err;
-
-	if (cda[CTA_EXPECT_TUPLE-1]) {
-		/* delete a single expect by tuple */
-		err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
-		if (err < 0)
-			return err;
-
-		/* bump usage count to 2 */
-		exp = ip_conntrack_expect_find_get(&tuple);
-		if (!exp)
-			return -ENOENT;
-
-		if (cda[CTA_EXPECT_ID-1]) {
-			u_int32_t id = 
-				*(u_int32_t *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
-			if (exp->id != ntohl(id)) {
-				ip_conntrack_expect_put(exp);
-				return -ENOENT;
-			}
-		}
-
-		/* after list removal, usage count == 1 */
-		ip_conntrack_unexpect_related(exp);
-		/* have to put what we 'get' above. 
-		 * after this line usage count == 0 */
-		ip_conntrack_expect_put(exp);
-	} else if (cda[CTA_EXPECT_HELP_NAME-1]) {
-		char *name = NFA_DATA(cda[CTA_EXPECT_HELP_NAME-1]);
-
-		/* delete all expectations for this helper */
-		write_lock_bh(&ip_conntrack_lock);
-		h = __ip_conntrack_helper_find_byname(name);
-		if (!h) {
-			write_unlock_bh(&ip_conntrack_lock);
-			return -EINVAL;
-		}
-		list_for_each_entry_safe(exp, tmp, &ip_conntrack_expect_list,
-					 list) {
-			if (exp->master->helper == h 
-			    && del_timer(&exp->timeout))
-				__ip_ct_expect_unlink_destroy(exp);
-		}
-		write_unlock(&ip_conntrack_lock);
-	} else {
-		/* This basically means we have to flush everything*/
-		write_lock_bh(&ip_conntrack_lock);
-		list_for_each_entry_safe(exp, tmp, &ip_conntrack_expect_list,
-					 list) {
-			if (del_timer(&exp->timeout))
-				__ip_ct_expect_unlink_destroy(exp);
-		}
-		write_unlock_bh(&ip_conntrack_lock);
-	}
-
-	return 0;
-}
-static int
-ctnetlink_change_expect(struct ip_conntrack_expect *x, struct nfattr *cda[])
-{
-	return -EOPNOTSUPP;
-}
-
-static int
-ctnetlink_create_expect(struct nfattr *cda[])
-{
-	struct ip_conntrack_tuple tuple, mask, master_tuple;
-	struct ip_conntrack_tuple_hash *h = NULL;
-	struct ip_conntrack_expect *exp;
-	struct ip_conntrack *ct;
-	int err = 0;
-
-	DEBUGP("entered %s\n", __FUNCTION__);
-
-	/* caller guarantees that those three CTA_EXPECT_* exist */
-	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
-	if (err < 0)
-		return err;
-	err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK);
-	if (err < 0)
-		return err;
-	err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER);
-	if (err < 0)
-		return err;
-
-	/* Look for master conntrack of this expectation */
-	h = ip_conntrack_find_get(&master_tuple, NULL);
-	if (!h)
-		return -ENOENT;
-	ct = tuplehash_to_ctrack(h);
-
-	if (!ct->helper) {
-		/* such conntrack hasn't got any helper, abort */
-		err = -EINVAL;
-		goto out;
-	}
-
-	exp = ip_conntrack_expect_alloc(ct);
-	if (!exp) {
-		err = -ENOMEM;
-		goto out;
-	}
-	
-	exp->expectfn = NULL;
-	exp->master = ct;
-	memcpy(&exp->tuple, &tuple, sizeof(struct ip_conntrack_tuple));
-	memcpy(&exp->mask, &mask, sizeof(struct ip_conntrack_tuple));
-
-	err = ip_conntrack_expect_related(exp);
-	ip_conntrack_expect_put(exp);
-
-out:	
-	ip_conntrack_put(tuplehash_to_ctrack(h));
-	return err;
-}
-
-static int
-ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
-		     struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
-{
-	struct ip_conntrack_tuple tuple;
-	struct ip_conntrack_expect *exp;
-	int err = 0;
-
-	DEBUGP("entered %s\n", __FUNCTION__);	
-
-	if (!cda[CTA_EXPECT_TUPLE-1]
-	    || !cda[CTA_EXPECT_MASK-1]
-	    || !cda[CTA_EXPECT_MASTER-1])
-		return -EINVAL;
-
-	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
-	if (err < 0)
-		return err;
-
-	write_lock_bh(&ip_conntrack_lock);
-	exp = __ip_conntrack_expect_find(&tuple);
-
-	if (!exp) {
-		write_unlock_bh(&ip_conntrack_lock);
-		err = -ENOENT;
-		if (nlh->nlmsg_flags & NLM_F_CREATE)
-			err = ctnetlink_create_expect(cda);
-		return err;
-	}
-
-	err = -EEXIST;
-	if (!(nlh->nlmsg_flags & NLM_F_EXCL))
-		err = ctnetlink_change_expect(exp, cda);
-	write_unlock_bh(&ip_conntrack_lock);
-
-	DEBUGP("leaving\n");
-	
-	return err;
-}
-
-#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-static struct notifier_block ctnl_notifier = {
-	.notifier_call	= ctnetlink_conntrack_event,
-};
-
-static struct notifier_block ctnl_notifier_exp = {
-	.notifier_call	= ctnetlink_expect_event,
-};
-#endif
-
-static struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
-	[IPCTNL_MSG_CT_NEW]		= { .call = ctnetlink_new_conntrack,
-					    .attr_count = CTA_MAX,
-					    .cap_required = CAP_NET_ADMIN },
-	[IPCTNL_MSG_CT_GET] 		= { .call = ctnetlink_get_conntrack,
-					    .attr_count = CTA_MAX,
-					    .cap_required = CAP_NET_ADMIN },
-	[IPCTNL_MSG_CT_DELETE]  	= { .call = ctnetlink_del_conntrack,
-					    .attr_count = CTA_MAX,
-					    .cap_required = CAP_NET_ADMIN },
-	[IPCTNL_MSG_CT_GET_CTRZERO] 	= { .call = ctnetlink_get_conntrack,
-					    .attr_count = CTA_MAX,
-					    .cap_required = CAP_NET_ADMIN },
-};
-
-static struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
-	[IPCTNL_MSG_EXP_GET]		= { .call = ctnetlink_get_expect,
-					    .attr_count = CTA_EXPECT_MAX,
-					    .cap_required = CAP_NET_ADMIN },
-	[IPCTNL_MSG_EXP_NEW]		= { .call = ctnetlink_new_expect,
-					    .attr_count = CTA_EXPECT_MAX,
-					    .cap_required = CAP_NET_ADMIN },
-	[IPCTNL_MSG_EXP_DELETE]		= { .call = ctnetlink_del_expect,
-					    .attr_count = CTA_EXPECT_MAX,
-					    .cap_required = CAP_NET_ADMIN },
-};
-
-static struct nfnetlink_subsystem ctnl_subsys = {
-	.name				= "conntrack",
-	.subsys_id			= NFNL_SUBSYS_CTNETLINK,
-	.cb_count			= IPCTNL_MSG_MAX,
-	.cb				= ctnl_cb,
-};
-
-static struct nfnetlink_subsystem ctnl_exp_subsys = {
-	.name				= "conntrack_expect",
-	.subsys_id			= NFNL_SUBSYS_CTNETLINK_EXP,
-	.cb_count			= IPCTNL_MSG_EXP_MAX,
-	.cb				= ctnl_exp_cb,
-};
-
-static int __init ctnetlink_init(void)
-{
-	int ret;
-
-	printk("ctnetlink v%s: registering with nfnetlink.\n", version);
-	ret = nfnetlink_subsys_register(&ctnl_subsys);
-	if (ret < 0) {
-		printk("ctnetlink_init: cannot register with nfnetlink.\n");
-		goto err_out;
-	}
-
-	ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
-	if (ret < 0) {
-		printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
-		goto err_unreg_subsys;
-	}
-
-#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-	ret = ip_conntrack_register_notifier(&ctnl_notifier);
-	if (ret < 0) {
-		printk("ctnetlink_init: cannot register notifier.\n");
-		goto err_unreg_exp_subsys;
-	}
-
-	ret = ip_conntrack_expect_register_notifier(&ctnl_notifier_exp);
-	if (ret < 0) {
-		printk("ctnetlink_init: cannot expect register notifier.\n");
-		goto err_unreg_notifier;
-	}
-#endif
-
-	return 0;
-
-#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-err_unreg_notifier:
-	ip_conntrack_unregister_notifier(&ctnl_notifier);
-err_unreg_exp_subsys:
-	nfnetlink_subsys_unregister(&ctnl_exp_subsys);
-#endif
-err_unreg_subsys:
-	nfnetlink_subsys_unregister(&ctnl_subsys);
-err_out:
-	return ret;
-}
-
-static void __exit ctnetlink_exit(void)
-{
-	printk("ctnetlink: unregistering from nfnetlink.\n");
-
-#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-	ip_conntrack_unregister_notifier(&ctnl_notifier_exp);
-	ip_conntrack_unregister_notifier(&ctnl_notifier);
-#endif
-
-	nfnetlink_subsys_unregister(&ctnl_exp_subsys);
-	nfnetlink_subsys_unregister(&ctnl_subsys);
-	return;
-}
-
-module_init(ctnetlink_init);
-module_exit(ctnetlink_exit);
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_proto_icmp.c b/trunk/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
index 838d1d69b36e..602c74db3252 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
@@ -102,24 +102,22 @@ static int icmp_packet(struct ip_conntrack *ct,
 			ct->timeout.function((unsigned long)ct);
 	} else {
 		atomic_inc(&ct->proto.icmp.count);
-		ip_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
 		ip_ct_refresh_acct(ct, ctinfo, skb, ip_ct_icmp_timeout);
 	}
 
 	return NF_ACCEPT;
 }
 
-static u_int8_t valid_new[] = { 
-	[ICMP_ECHO] = 1,
-	[ICMP_TIMESTAMP] = 1,
-	[ICMP_INFO_REQUEST] = 1,
-	[ICMP_ADDRESS] = 1 
-};
-
 /* Called when a new connection for this protocol found. */
 static int icmp_new(struct ip_conntrack *conntrack,
 		    const struct sk_buff *skb)
 {
+	static u_int8_t valid_new[]
+		= { [ICMP_ECHO] = 1,
+		    [ICMP_TIMESTAMP] = 1,
+		    [ICMP_INFO_REQUEST] = 1,
+		    [ICMP_ADDRESS] = 1 };
+
 	if (conntrack->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
 	    || !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type]) {
 		/* Can't create a new ICMP `conn' with this. */
@@ -160,12 +158,11 @@ icmp_error_message(struct sk_buff *skb,
 		return NF_ACCEPT;
 	}
 
-	innerproto = ip_conntrack_proto_find_get(inside->ip.protocol);
+	innerproto = ip_ct_find_proto(inside->ip.protocol);
 	dataoff = skb->nh.iph->ihl*4 + sizeof(inside->icmp) + inside->ip.ihl*4;
 	/* Are they talking about one of our connections? */
 	if (!ip_ct_get_tuple(&inside->ip, skb, dataoff, &origtuple, innerproto)) {
 		DEBUGP("icmp_error: ! get_tuple p=%u", inside->ip.protocol);
-		ip_conntrack_proto_put(innerproto);
 		return NF_ACCEPT;
 	}
 
@@ -173,10 +170,8 @@ icmp_error_message(struct sk_buff *skb,
 	   been preserved inside the ICMP. */
 	if (!ip_ct_invert_tuple(&innertuple, &origtuple, innerproto)) {
 		DEBUGP("icmp_error_track: Can't invert tuple\n");
-		ip_conntrack_proto_put(innerproto);
 		return NF_ACCEPT;
 	}
-	ip_conntrack_proto_put(innerproto);
 
 	*ctinfo = IP_CT_RELATED;
 
@@ -217,7 +212,7 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 	icmph = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_ih), &_ih);
 	if (icmph == NULL) {
 		if (LOG_INVALID(IPPROTO_ICMP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL,
 				      "ip_ct_icmp: short packet ");
 		return -NF_ACCEPT;
 	}
@@ -231,13 +226,13 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 		if (!(u16)csum_fold(skb->csum)) 
 			break;
 		if (LOG_INVALID(IPPROTO_ICMP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				      "ip_ct_icmp: bad HW ICMP checksum ");
 		return -NF_ACCEPT;
 	case CHECKSUM_NONE:
 		if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0))) {
 			if (LOG_INVALID(IPPROTO_ICMP))
-				nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+				nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 					      "ip_ct_icmp: bad ICMP checksum ");
 			return -NF_ACCEPT;
 		}
@@ -254,7 +249,7 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 	 */
 	if (icmph->type > NR_ICMP_TYPES) {
 		if (LOG_INVALID(IPPROTO_ICMP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL,
 				      "ip_ct_icmp: invalid ICMP type ");
 		return -NF_ACCEPT;
 	}
@@ -270,47 +265,6 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 	return icmp_error_message(skb, ctinfo, hooknum);
 }
 
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-static int icmp_tuple_to_nfattr(struct sk_buff *skb,
-				const struct ip_conntrack_tuple *t)
-{
-	NFA_PUT(skb, CTA_PROTO_ICMP_ID, sizeof(u_int16_t),
-		&t->src.u.icmp.id);
-	NFA_PUT(skb, CTA_PROTO_ICMP_TYPE, sizeof(u_int8_t),
-		&t->dst.u.icmp.type);
-	NFA_PUT(skb, CTA_PROTO_ICMP_CODE, sizeof(u_int8_t),
-		&t->dst.u.icmp.code);
-
-	if (t->dst.u.icmp.type >= sizeof(valid_new) 
-	    || !valid_new[t->dst.u.icmp.type])
-		return -EINVAL;
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-static int icmp_nfattr_to_tuple(struct nfattr *tb[],
-				struct ip_conntrack_tuple *tuple)
-{
-	if (!tb[CTA_PROTO_ICMP_TYPE-1]
-	    || !tb[CTA_PROTO_ICMP_CODE-1]
-	    || !tb[CTA_PROTO_ICMP_ID-1])
-		return -1;
-
-	tuple->dst.u.icmp.type = 
-			*(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_TYPE-1]);
-	tuple->dst.u.icmp.code =
-			*(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_CODE-1]);
-	tuple->src.u.icmp.id =
-			*(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
-
-	return 0;
-}
-#endif
-
 struct ip_conntrack_protocol ip_conntrack_protocol_icmp =
 {
 	.proto 			= IPPROTO_ICMP,
@@ -322,9 +276,4 @@ struct ip_conntrack_protocol ip_conntrack_protocol_icmp =
 	.packet			= icmp_packet,
 	.new			= icmp_new,
 	.error			= icmp_error,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-	.tuple_to_nfattr	= icmp_tuple_to_nfattr,
-	.nfattr_to_tuple	= icmp_nfattr_to_tuple,
-#endif
 };
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/trunk/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
index a875f35e576d..31d75390bf12 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
@@ -404,8 +404,6 @@ static int sctp_packet(struct ip_conntrack *conntrack,
 		}
 
 		conntrack->proto.sctp.state = newconntrack;
-		if (oldsctpstate != newconntrack)
-			ip_conntrack_event_cache(IPCT_PROTOINFO, skb);
 		write_unlock_bh(&sctp_lock);
 	}
 
@@ -505,12 +503,7 @@ static struct ip_conntrack_protocol ip_conntrack_protocol_sctp = {
 	.packet 	 = sctp_packet, 
 	.new 		 = sctp_new, 
 	.destroy 	 = NULL, 
-	.me 		 = THIS_MODULE,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-	.tuple_to_nfattr = ip_ct_port_tuple_to_nfattr,
-	.nfattr_to_tuple = ip_ct_port_nfattr_to_tuple,
-#endif
+	.me 		 = THIS_MODULE 
 };
 
 #ifdef CONFIG_SYSCTL
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/trunk/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index f23ef1f88c46..809dfed766d4 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -336,23 +336,6 @@ static int tcp_print_conntrack(struct seq_file *s,
 	return seq_printf(s, "%s ", tcp_conntrack_names[state]);
 }
 
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa,
-			 const struct ip_conntrack *ct)
-{
-	read_lock_bh(&tcp_lock);
-	NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t),
-		&ct->proto.tcp.state);
-	read_unlock_bh(&tcp_lock);
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-#endif
-
 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
 {
 	if (tcph->rst) return TCP_RST_SET;
@@ -716,7 +699,7 @@ static int tcp_in_window(struct ip_ct_tcp *state,
 		res = 1;
 	} else {
 		if (LOG_INVALID(IPPROTO_TCP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL,
 			"ip_ct_tcp: %s ",
 			before(seq, sender->td_maxend + 1) ?
 			after(end, sender->td_end - receiver->td_maxwin - 1) ?
@@ -815,7 +798,7 @@ static int tcp_error(struct sk_buff *skb,
 				sizeof(_tcph), &_tcph);
 	if (th == NULL) {
 		if (LOG_INVALID(IPPROTO_TCP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				"ip_ct_tcp: short packet ");
 		return -NF_ACCEPT;
   	}
@@ -823,7 +806,7 @@ static int tcp_error(struct sk_buff *skb,
 	/* Not whole TCP header or malformed packet */
 	if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
 		if (LOG_INVALID(IPPROTO_TCP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				"ip_ct_tcp: truncated/malformed packet ");
 		return -NF_ACCEPT;
 	}
@@ -840,7 +823,7 @@ static int tcp_error(struct sk_buff *skb,
 			         skb->ip_summed == CHECKSUM_HW ? skb->csum
 			      	 : skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
 		if (LOG_INVALID(IPPROTO_TCP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				  "ip_ct_tcp: bad TCP checksum ");
 		return -NF_ACCEPT;
 	}
@@ -849,7 +832,7 @@ static int tcp_error(struct sk_buff *skb,
 	tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR));
 	if (!tcp_valid_flags[tcpflags]) {
 		if (LOG_INVALID(IPPROTO_TCP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				  "ip_ct_tcp: invalid TCP flag combination ");
 		return -NF_ACCEPT;
 	}
@@ -897,9 +880,8 @@ static int tcp_packet(struct ip_conntrack *conntrack,
 			 */
 		    	write_unlock_bh(&tcp_lock);
 			if (LOG_INVALID(IPPROTO_TCP))
-				nf_log_packet(PF_INET, 0, skb, NULL, NULL,
-					      NULL, "ip_ct_tcp: "
-					      "killing out of sync session ");
+				nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+					  "ip_ct_tcp: killing out of sync session ");
 		    	if (del_timer(&conntrack->timeout))
 		    		conntrack->timeout.function((unsigned long)
 		    					    conntrack);
@@ -913,7 +895,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
 		
 		write_unlock_bh(&tcp_lock);
 		if (LOG_INVALID(IPPROTO_TCP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				  "ip_ct_tcp: invalid packet ignored ");
 		return NF_ACCEPT;
 	case TCP_CONNTRACK_MAX:
@@ -923,7 +905,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
 		       old_state);
 		write_unlock_bh(&tcp_lock);
 		if (LOG_INVALID(IPPROTO_TCP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				  "ip_ct_tcp: invalid state ");
 		return -NF_ACCEPT;
 	case TCP_CONNTRACK_SYN_SENT:
@@ -944,7 +926,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
 			write_unlock_bh(&tcp_lock);
 			if (LOG_INVALID(IPPROTO_TCP))
 				nf_log_packet(PF_INET, 0, skb, NULL, NULL,
-					      NULL, "ip_ct_tcp: invalid SYN");
+				              "ip_ct_tcp: invalid SYN");
 			return -NF_ACCEPT;
 		}
 	case TCP_CONNTRACK_CLOSE:
@@ -991,10 +973,6 @@ static int tcp_packet(struct ip_conntrack *conntrack,
 		  ? ip_ct_tcp_timeout_max_retrans : *tcp_timeouts[new_state];
 	write_unlock_bh(&tcp_lock);
 
-	ip_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
-	if (new_state != old_state)
-		ip_conntrack_event_cache(IPCT_PROTOINFO, skb);
-
 	if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
 		/* If only reply is a RST, we can consider ourselves not to
 		   have an established connection: this is a fairly common
@@ -1118,10 +1096,4 @@ struct ip_conntrack_protocol ip_conntrack_protocol_tcp =
 	.packet 		= tcp_packet,
 	.new 			= tcp_new,
 	.error			= tcp_error,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-	.to_nfattr		= tcp_to_nfattr,
-	.tuple_to_nfattr	= ip_ct_port_tuple_to_nfattr,
-	.nfattr_to_tuple	= ip_ct_port_nfattr_to_tuple,
-#endif
 };
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_proto_udp.c b/trunk/net/ipv4/netfilter/ip_conntrack_proto_udp.c
index f2dcac7c7660..8c1eaba098d4 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_proto_udp.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_proto_udp.c
@@ -73,8 +73,7 @@ static int udp_packet(struct ip_conntrack *conntrack,
 		ip_ct_refresh_acct(conntrack, ctinfo, skb, 
 				   ip_ct_udp_timeout_stream);
 		/* Also, more likely to be important, and not a probe */
-		if (!test_and_set_bit(IPS_ASSURED_BIT, &conntrack->status))
-			ip_conntrack_event_cache(IPCT_STATUS, skb);
+		set_bit(IPS_ASSURED_BIT, &conntrack->status);
 	} else
 		ip_ct_refresh_acct(conntrack, ctinfo, skb, ip_ct_udp_timeout);
 
@@ -98,7 +97,7 @@ static int udp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 	hdr = skb_header_pointer(skb, iph->ihl*4, sizeof(_hdr), &_hdr);
 	if (hdr == NULL) {
 		if (LOG_INVALID(IPPROTO_UDP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				  "ip_ct_udp: short packet ");
 		return -NF_ACCEPT;
 	}
@@ -106,7 +105,7 @@ static int udp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 	/* Truncated/malformed packets */
 	if (ntohs(hdr->len) > udplen || ntohs(hdr->len) < sizeof(*hdr)) {
 		if (LOG_INVALID(IPPROTO_UDP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				  "ip_ct_udp: truncated/malformed packet ");
 		return -NF_ACCEPT;
 	}
@@ -126,7 +125,7 @@ static int udp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 			         skb->ip_summed == CHECKSUM_HW ? skb->csum
 			      	 : skb_checksum(skb, iph->ihl*4, udplen, 0))) {
 		if (LOG_INVALID(IPPROTO_UDP))
-			nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+			nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
 				  "ip_ct_udp: bad UDP checksum ");
 		return -NF_ACCEPT;
 	}
@@ -145,9 +144,4 @@ struct ip_conntrack_protocol ip_conntrack_protocol_udp =
 	.packet			= udp_packet,
 	.new			= udp_new,
 	.error			= udp_error,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-	.tuple_to_nfattr	= ip_ct_port_tuple_to_nfattr,
-	.nfattr_to_tuple	= ip_ct_port_nfattr_to_tuple,
-#endif
 };
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_standalone.c b/trunk/net/ipv4/netfilter/ip_conntrack_standalone.c
index ee5895afd0c3..61798c46e91d 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -5,7 +5,7 @@
 */
 
 /* (C) 1999-2001 Paul `Rusty' Russell
- * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
+ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -147,7 +147,8 @@ static int ct_seq_show(struct seq_file *s, void *v)
 	if (DIRECTION(hash))
 		return 0;
 
-	proto = __ip_conntrack_proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
+	proto = ip_ct_find_proto(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
+			       .tuple.dst.protonum);
 	IP_NF_ASSERT(proto);
 
 	if (seq_printf(s, "%-8s %u %ld ",
@@ -184,7 +185,7 @@ static int ct_seq_show(struct seq_file *s, void *v)
 			return -ENOSPC;
 
 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
-	if (seq_printf(s, "mark=%u ", conntrack->mark))
+	if (seq_printf(s, "mark=%lu ", conntrack->mark))
 		return -ENOSPC;
 #endif
 
@@ -282,7 +283,7 @@ static int exp_seq_show(struct seq_file *s, void *v)
 	seq_printf(s, "proto=%u ", expect->tuple.dst.protonum);
 
 	print_tuple(s, &expect->tuple,
-		    __ip_conntrack_proto_find(expect->tuple.dst.protonum));
+		    ip_ct_find_proto(expect->tuple.dst.protonum));
 	return seq_putc(s, '\n');
 }
 
@@ -888,7 +889,6 @@ static int init_or_cleanup(int init)
 	return ret;
 
  cleanup:
-	synchronize_net();
 #ifdef CONFIG_SYSCTL
  	unregister_sysctl_table(ip_ct_sysctl_header);
  cleanup_localinops:
@@ -971,14 +971,6 @@ void need_ip_conntrack(void)
 {
 }
 
-#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-EXPORT_SYMBOL_GPL(ip_conntrack_chain);
-EXPORT_SYMBOL_GPL(ip_conntrack_expect_chain);
-EXPORT_SYMBOL_GPL(ip_conntrack_register_notifier);
-EXPORT_SYMBOL_GPL(ip_conntrack_unregister_notifier);
-EXPORT_SYMBOL_GPL(__ip_ct_event_cache_init);
-EXPORT_PER_CPU_SYMBOL_GPL(ip_conntrack_ecache);
-#endif
 EXPORT_SYMBOL(ip_conntrack_protocol_register);
 EXPORT_SYMBOL(ip_conntrack_protocol_unregister);
 EXPORT_SYMBOL(ip_ct_get_tuple);
@@ -990,16 +982,12 @@ EXPORT_SYMBOL(ip_conntrack_helper_register);
 EXPORT_SYMBOL(ip_conntrack_helper_unregister);
 EXPORT_SYMBOL(ip_ct_iterate_cleanup);
 EXPORT_SYMBOL(ip_ct_refresh_acct);
-
+EXPORT_SYMBOL(ip_ct_protos);
+EXPORT_SYMBOL(ip_ct_find_proto);
 EXPORT_SYMBOL(ip_conntrack_expect_alloc);
 EXPORT_SYMBOL(ip_conntrack_expect_put);
-EXPORT_SYMBOL_GPL(ip_conntrack_expect_find_get);
 EXPORT_SYMBOL(ip_conntrack_expect_related);
 EXPORT_SYMBOL(ip_conntrack_unexpect_related);
-EXPORT_SYMBOL_GPL(ip_conntrack_expect_list);
-EXPORT_SYMBOL_GPL(__ip_conntrack_expect_find);
-EXPORT_SYMBOL_GPL(__ip_ct_expect_unlink_destroy);
-
 EXPORT_SYMBOL(ip_conntrack_tuple_taken);
 EXPORT_SYMBOL(ip_ct_gather_frags);
 EXPORT_SYMBOL(ip_conntrack_htable_size);
@@ -1007,28 +995,7 @@ EXPORT_SYMBOL(ip_conntrack_lock);
 EXPORT_SYMBOL(ip_conntrack_hash);
 EXPORT_SYMBOL(ip_conntrack_untracked);
 EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
+EXPORT_SYMBOL_GPL(ip_conntrack_put);
 #ifdef CONFIG_IP_NF_NAT_NEEDED
 EXPORT_SYMBOL(ip_conntrack_tcp_update);
 #endif
-
-EXPORT_SYMBOL_GPL(ip_conntrack_flush);
-EXPORT_SYMBOL_GPL(__ip_conntrack_find);
-
-EXPORT_SYMBOL_GPL(ip_conntrack_alloc);
-EXPORT_SYMBOL_GPL(ip_conntrack_free);
-EXPORT_SYMBOL_GPL(ip_conntrack_hash_insert);
-
-EXPORT_SYMBOL_GPL(ip_ct_remove_expectations);
-
-EXPORT_SYMBOL_GPL(ip_conntrack_helper_find_get);
-EXPORT_SYMBOL_GPL(ip_conntrack_helper_put);
-EXPORT_SYMBOL_GPL(__ip_conntrack_helper_find_byname);
-
-EXPORT_SYMBOL_GPL(ip_conntrack_proto_find_get);
-EXPORT_SYMBOL_GPL(ip_conntrack_proto_put);
-EXPORT_SYMBOL_GPL(__ip_conntrack_proto_find);
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-EXPORT_SYMBOL_GPL(ip_ct_port_tuple_to_nfattr);
-EXPORT_SYMBOL_GPL(ip_ct_port_nfattr_to_tuple);
-#endif
diff --git a/trunk/net/ipv4/netfilter/ip_nat_core.c b/trunk/net/ipv4/netfilter/ip_nat_core.c
index 1adedb743f60..739b6dde1c82 100644
--- a/trunk/net/ipv4/netfilter/ip_nat_core.c
+++ b/trunk/net/ipv4/netfilter/ip_nat_core.c
@@ -47,39 +47,8 @@ DEFINE_RWLOCK(ip_nat_lock);
 static unsigned int ip_nat_htable_size;
 
 static struct list_head *bysource;
-
-#define MAX_IP_NAT_PROTO 256
 struct ip_nat_protocol *ip_nat_protos[MAX_IP_NAT_PROTO];
 
-static inline struct ip_nat_protocol *
-__ip_nat_proto_find(u_int8_t protonum)
-{
-	return ip_nat_protos[protonum];
-}
-
-struct ip_nat_protocol *
-ip_nat_proto_find_get(u_int8_t protonum)
-{
-	struct ip_nat_protocol *p;
-
-	/* we need to disable preemption to make sure 'p' doesn't get
-	 * removed until we've grabbed the reference */
-	preempt_disable();
-	p = __ip_nat_proto_find(protonum);
-	if (p) {
-		if (!try_module_get(p->me))
-			p = &ip_nat_unknown_protocol;
-	}
-	preempt_enable();
-
-	return p;
-}
-
-void
-ip_nat_proto_put(struct ip_nat_protocol *p)
-{
-	module_put(p->me);
-}
 
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
@@ -134,8 +103,7 @@ static int
 in_range(const struct ip_conntrack_tuple *tuple,
 	 const struct ip_nat_range *range)
 {
-	struct ip_nat_protocol *proto = 
-				__ip_nat_proto_find(tuple->dst.protonum);
+	struct ip_nat_protocol *proto = ip_nat_find_proto(tuple->dst.protonum);
 
 	/* If we are supposed to map IPs, then we must be in the
 	   range specified, otherwise let this drag us onto a new src IP. */
@@ -248,7 +216,8 @@ get_unique_tuple(struct ip_conntrack_tuple *tuple,
 		 struct ip_conntrack *conntrack,
 		 enum ip_nat_manip_type maniptype)
 {
-	struct ip_nat_protocol *proto;
+	struct ip_nat_protocol *proto
+		= ip_nat_find_proto(orig_tuple->dst.protonum);
 
 	/* 1) If this srcip/proto/src-proto-part is currently mapped,
 	   and that same mapping gives a unique tuple within the given
@@ -273,20 +242,14 @@ get_unique_tuple(struct ip_conntrack_tuple *tuple,
 	/* 3) The per-protocol part of the manip is made to map into
 	   the range to make a unique tuple. */
 
-	proto = ip_nat_proto_find_get(orig_tuple->dst.protonum);
-
 	/* Only bother mapping if it's not already in range and unique */
 	if ((!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)
 	     || proto->in_range(tuple, maniptype, &range->min, &range->max))
-	    && !ip_nat_used_tuple(tuple, conntrack)) {
-		ip_nat_proto_put(proto);
+	    && !ip_nat_used_tuple(tuple, conntrack))
 		return;
-	}
 
 	/* Last change: get protocol to try to obtain unique tuple. */
 	proto->unique_tuple(tuple, range, maniptype, conntrack);
-
-	ip_nat_proto_put(proto);
 }
 
 unsigned int
@@ -357,20 +320,17 @@ manip_pkt(u_int16_t proto,
 	  enum ip_nat_manip_type maniptype)
 {
 	struct iphdr *iph;
-	struct ip_nat_protocol *p;
 
-	if (!skb_make_writable(pskb, iphdroff + sizeof(*iph)))
+	(*pskb)->nfcache |= NFC_ALTERED;
+	if (!skb_ip_make_writable(pskb, iphdroff + sizeof(*iph)))
 		return 0;
 
 	iph = (void *)(*pskb)->data + iphdroff;
 
 	/* Manipulate protcol part. */
-	p = ip_nat_proto_find_get(proto);
-	if (!p->manip_pkt(pskb, iphdroff, target, maniptype)) {
-		ip_nat_proto_put(p);
+	if (!ip_nat_find_proto(proto)->manip_pkt(pskb, iphdroff,
+	                                         target, maniptype))
 		return 0;
-	}
-	ip_nat_proto_put(p);
 
 	iph = (void *)(*pskb)->data + iphdroff;
 
@@ -431,7 +391,7 @@ int icmp_reply_translation(struct sk_buff **pskb,
 	struct ip_conntrack_tuple inner, target;
 	int hdrlen = (*pskb)->nh.iph->ihl * 4;
 
-	if (!skb_make_writable(pskb, hdrlen + sizeof(*inside)))
+	if (!skb_ip_make_writable(pskb, hdrlen + sizeof(*inside)))
 		return 0;
 
 	inside = (void *)(*pskb)->data + (*pskb)->nh.iph->ihl*4;
@@ -466,8 +426,7 @@ int icmp_reply_translation(struct sk_buff **pskb,
 
 	if (!ip_ct_get_tuple(&inside->ip, *pskb, (*pskb)->nh.iph->ihl*4 +
 	                     sizeof(struct icmphdr) + inside->ip.ihl*4,
-	                     &inner,
-			     __ip_conntrack_proto_find(inside->ip.protocol)))
+	                     &inner, ip_ct_find_proto(inside->ip.protocol)))
 		return 0;
 
 	/* Change inner back to look like incoming packet.  We do the
@@ -537,49 +496,6 @@ void ip_nat_protocol_unregister(struct ip_nat_protocol *proto)
 	synchronize_net();
 }
 
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-int
-ip_nat_port_range_to_nfattr(struct sk_buff *skb, 
-			    const struct ip_nat_range *range)
-{
-	NFA_PUT(skb, CTA_PROTONAT_PORT_MIN, sizeof(u_int16_t),
-		&range->min.tcp.port);
-	NFA_PUT(skb, CTA_PROTONAT_PORT_MAX, sizeof(u_int16_t),
-		&range->max.tcp.port);
-
-	return 0;
-
-nfattr_failure:
-	return -1;
-}
-
-int
-ip_nat_port_nfattr_to_range(struct nfattr *tb[], struct ip_nat_range *range)
-{
-	int ret = 0;
-	
-	/* we have to return whether we actually parsed something or not */
-
-	if (tb[CTA_PROTONAT_PORT_MIN-1]) {
-		ret = 1;
-		range->min.tcp.port = 
-			*(u_int16_t *)NFA_DATA(tb[CTA_PROTONAT_PORT_MIN-1]);
-	}
-	
-	if (!tb[CTA_PROTONAT_PORT_MAX-1]) {
-		if (ret) 
-			range->max.tcp.port = range->min.tcp.port;
-	} else {
-		ret = 1;
-		range->max.tcp.port = 
-			*(u_int16_t *)NFA_DATA(tb[CTA_PROTONAT_PORT_MAX-1]);
-	}
-
-	return ret;
-}
-#endif
-
 int __init ip_nat_init(void)
 {
 	size_t i;
diff --git a/trunk/net/ipv4/netfilter/ip_nat_helper.c b/trunk/net/ipv4/netfilter/ip_nat_helper.c
index d2dd5d313556..158f34f32c04 100644
--- a/trunk/net/ipv4/netfilter/ip_nat_helper.c
+++ b/trunk/net/ipv4/netfilter/ip_nat_helper.c
@@ -168,7 +168,7 @@ ip_nat_mangle_tcp_packet(struct sk_buff **pskb,
 	struct tcphdr *tcph;
 	int datalen;
 
-	if (!skb_make_writable(pskb, (*pskb)->len))
+	if (!skb_ip_make_writable(pskb, (*pskb)->len))
 		return 0;
 
 	if (rep_len > match_len
@@ -228,7 +228,7 @@ ip_nat_mangle_udp_packet(struct sk_buff **pskb,
 	                       match_offset + match_len)
 		return 0;
 
-	if (!skb_make_writable(pskb, (*pskb)->len))
+	if (!skb_ip_make_writable(pskb, (*pskb)->len))
 		return 0;
 
 	if (rep_len > match_len
@@ -315,7 +315,7 @@ ip_nat_sack_adjust(struct sk_buff **pskb,
 	optoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct tcphdr);
 	optend = (*pskb)->nh.iph->ihl*4 + tcph->doff*4;
 
-	if (!skb_make_writable(pskb, optend))
+	if (!skb_ip_make_writable(pskb, optend))
 		return 0;
 
 	dir = CTINFO2DIR(ctinfo);
@@ -363,7 +363,7 @@ ip_nat_seq_adjust(struct sk_buff **pskb,
 	this_way = &ct->nat.info.seq[dir];
 	other_way = &ct->nat.info.seq[!dir];
 
-	if (!skb_make_writable(pskb, (*pskb)->nh.iph->ihl*4+sizeof(*tcph)))
+	if (!skb_ip_make_writable(pskb, (*pskb)->nh.iph->ihl*4+sizeof(*tcph)))
 		return 0;
 
 	tcph = (void *)(*pskb)->data + (*pskb)->nh.iph->ihl*4;
diff --git a/trunk/net/ipv4/netfilter/ip_nat_proto_icmp.c b/trunk/net/ipv4/netfilter/ip_nat_proto_icmp.c
index 938719043999..6596c9ee1655 100644
--- a/trunk/net/ipv4/netfilter/ip_nat_proto_icmp.c
+++ b/trunk/net/ipv4/netfilter/ip_nat_proto_icmp.c
@@ -62,7 +62,7 @@ icmp_manip_pkt(struct sk_buff **pskb,
 	struct icmphdr *hdr;
 	unsigned int hdroff = iphdroff + iph->ihl*4;
 
-	if (!skb_make_writable(pskb, hdroff + sizeof(*hdr)))
+	if (!skb_ip_make_writable(pskb, hdroff + sizeof(*hdr)))
 		return 0;
 
 	hdr = (struct icmphdr *)((*pskb)->data + hdroff);
@@ -106,18 +106,11 @@ icmp_print_range(char *buffer, const struct ip_nat_range *range)
 	else return 0;
 }
 
-struct ip_nat_protocol ip_nat_protocol_icmp = {
-	.name			= "ICMP",
-	.protonum		= IPPROTO_ICMP,
-	.me			= THIS_MODULE,
-	.manip_pkt		= icmp_manip_pkt,
-	.in_range		= icmp_in_range,
-	.unique_tuple		= icmp_unique_tuple,
-	.print			= icmp_print,
-	.print_range		= icmp_print_range,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-	.range_to_nfattr	= ip_nat_port_range_to_nfattr,
-	.nfattr_to_range	= ip_nat_port_nfattr_to_range,
-#endif
+struct ip_nat_protocol ip_nat_protocol_icmp
+= { "ICMP", IPPROTO_ICMP,
+    icmp_manip_pkt,
+    icmp_in_range,
+    icmp_unique_tuple,
+    icmp_print,
+    icmp_print_range
 };
diff --git a/trunk/net/ipv4/netfilter/ip_nat_proto_tcp.c b/trunk/net/ipv4/netfilter/ip_nat_proto_tcp.c
index 1d381bf68574..a98e36d2b3c6 100644
--- a/trunk/net/ipv4/netfilter/ip_nat_proto_tcp.c
+++ b/trunk/net/ipv4/netfilter/ip_nat_proto_tcp.c
@@ -12,7 +12,6 @@
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/if.h>
-#include <linux/netfilter/nfnetlink_conntrack.h>
 #include <linux/netfilter_ipv4/ip_nat.h>
 #include <linux/netfilter_ipv4/ip_nat_rule.h>
 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
@@ -103,7 +102,7 @@ tcp_manip_pkt(struct sk_buff **pskb,
 	if ((*pskb)->len >= hdroff + sizeof(struct tcphdr))
 		hdrsize = sizeof(struct tcphdr);
 
-	if (!skb_make_writable(pskb, hdroff + hdrsize))
+	if (!skb_ip_make_writable(pskb, hdroff + hdrsize))
 		return 0;
 
 	iph = (struct iphdr *)((*pskb)->data + iphdroff);
@@ -170,18 +169,11 @@ tcp_print_range(char *buffer, const struct ip_nat_range *range)
 	else return 0;
 }
 
-struct ip_nat_protocol ip_nat_protocol_tcp = {
-	.name			= "TCP",
-	.protonum		= IPPROTO_TCP,
-	.me			= THIS_MODULE,
-	.manip_pkt		= tcp_manip_pkt,
-	.in_range		= tcp_in_range,
-	.unique_tuple		= tcp_unique_tuple,
-	.print			= tcp_print,
-	.print_range		= tcp_print_range,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-	.range_to_nfattr	= ip_nat_port_range_to_nfattr,
-	.nfattr_to_range	= ip_nat_port_nfattr_to_range,
-#endif
+struct ip_nat_protocol ip_nat_protocol_tcp
+= { "TCP", IPPROTO_TCP,
+    tcp_manip_pkt,
+    tcp_in_range,
+    tcp_unique_tuple,
+    tcp_print,
+    tcp_print_range
 };
diff --git a/trunk/net/ipv4/netfilter/ip_nat_proto_udp.c b/trunk/net/ipv4/netfilter/ip_nat_proto_udp.c
index c4906e1aa24a..9f66e5625664 100644
--- a/trunk/net/ipv4/netfilter/ip_nat_proto_udp.c
+++ b/trunk/net/ipv4/netfilter/ip_nat_proto_udp.c
@@ -94,7 +94,7 @@ udp_manip_pkt(struct sk_buff **pskb,
 	u32 oldip, newip;
 	u16 *portptr, newport;
 
-	if (!skb_make_writable(pskb, hdroff + sizeof(*hdr)))
+	if (!skb_ip_make_writable(pskb, hdroff + sizeof(*hdr)))
 		return 0;
 
 	iph = (struct iphdr *)((*pskb)->data + iphdroff);
@@ -156,18 +156,11 @@ udp_print_range(char *buffer, const struct ip_nat_range *range)
 	else return 0;
 }
 
-struct ip_nat_protocol ip_nat_protocol_udp = {
-	.name			= "UDP",
-	.protonum		= IPPROTO_UDP,
-	.me			= THIS_MODULE,
-	.manip_pkt		= udp_manip_pkt,
-	.in_range		= udp_in_range,
-	.unique_tuple		= udp_unique_tuple,
-	.print			= udp_print,
-	.print_range		= udp_print_range,
-#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
-    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
-	.range_to_nfattr	= ip_nat_port_range_to_nfattr,
-	.nfattr_to_range	= ip_nat_port_nfattr_to_range,
-#endif
+struct ip_nat_protocol ip_nat_protocol_udp
+= { "UDP", IPPROTO_UDP,
+    udp_manip_pkt,
+    udp_in_range,
+    udp_unique_tuple,
+    udp_print,
+    udp_print_range
 };
diff --git a/trunk/net/ipv4/netfilter/ip_nat_proto_unknown.c b/trunk/net/ipv4/netfilter/ip_nat_proto_unknown.c
index 99bbef56f84e..f5525bd58d16 100644
--- a/trunk/net/ipv4/netfilter/ip_nat_proto_unknown.c
+++ b/trunk/net/ipv4/netfilter/ip_nat_proto_unknown.c
@@ -61,11 +61,10 @@ unknown_print_range(char *buffer, const struct ip_nat_range *range)
 }
 
 struct ip_nat_protocol ip_nat_unknown_protocol = {
-	.name			= "unknown",
-	.me			= THIS_MODULE,
-	.manip_pkt		= unknown_manip_pkt,
-	.in_range		= unknown_in_range,
-	.unique_tuple		= unknown_unique_tuple,
-	.print			= unknown_print,
-	.print_range		= unknown_print_range
+	"unknown", 0,
+	unknown_manip_pkt,
+	unknown_in_range,
+	unknown_unique_tuple,
+	unknown_print,
+	unknown_print_range
 };
diff --git a/trunk/net/ipv4/netfilter/ip_nat_snmp_basic.c b/trunk/net/ipv4/netfilter/ip_nat_snmp_basic.c
index 93b2c5111bb2..2a48b6e635ae 100644
--- a/trunk/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/trunk/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -1275,7 +1275,7 @@ static int help(struct sk_buff **pskb,
 		 return NF_DROP;
 	}
 
-	if (!skb_make_writable(pskb, (*pskb)->len))
+	if (!skb_ip_make_writable(pskb, (*pskb)->len))
 		return NF_DROP;
 
 	spin_lock_bh(&snmp_lock);
diff --git a/trunk/net/ipv4/netfilter/ip_nat_standalone.c b/trunk/net/ipv4/netfilter/ip_nat_standalone.c
index 89db052add81..91d5ea1dbbc9 100644
--- a/trunk/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/trunk/net/ipv4/netfilter/ip_nat_standalone.c
@@ -73,6 +73,8 @@ ip_nat_fn(unsigned int hooknum,
 	IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off
 		       & htons(IP_MF|IP_OFFSET)));
 
+	(*pskb)->nfcache |= NFC_UNKNOWN;
+
 	/* If we had a hardware checksum before, it's now invalid */
 	if ((*pskb)->ip_summed == CHECKSUM_HW)
 		if (skb_checksum_help(*pskb, (out == NULL)))
@@ -394,8 +396,6 @@ module_exit(fini);
 EXPORT_SYMBOL(ip_nat_setup_info);
 EXPORT_SYMBOL(ip_nat_protocol_register);
 EXPORT_SYMBOL(ip_nat_protocol_unregister);
-EXPORT_SYMBOL_GPL(ip_nat_proto_find_get);
-EXPORT_SYMBOL_GPL(ip_nat_proto_put);
 EXPORT_SYMBOL(ip_nat_cheat_check);
 EXPORT_SYMBOL(ip_nat_mangle_tcp_packet);
 EXPORT_SYMBOL(ip_nat_mangle_udp_packet);
diff --git a/trunk/net/ipv4/netfilter/ip_queue.c b/trunk/net/ipv4/netfilter/ip_queue.c
index d54f14d926f6..c6baa8174389 100644
--- a/trunk/net/ipv4/netfilter/ip_queue.c
+++ b/trunk/net/ipv4/netfilter/ip_queue.c
@@ -43,10 +43,17 @@
 #define NET_IPQ_QMAX 2088
 #define NET_IPQ_QMAX_NAME "ip_queue_maxlen"
 
+struct ipq_rt_info {
+	__u8 tos;
+	__u32 daddr;
+	__u32 saddr;
+};
+
 struct ipq_queue_entry {
 	struct list_head list;
 	struct nf_info *info;
 	struct sk_buff *skb;
+	struct ipq_rt_info rt_info;
 };
 
 typedef int (*ipq_cmpfn)(struct ipq_queue_entry *, unsigned long);
@@ -240,8 +247,8 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 
 	pmsg->packet_id       = (unsigned long )entry;
 	pmsg->data_len        = data_len;
-	pmsg->timestamp_sec   = skb_tv_base.tv_sec + entry->skb->tstamp.off_sec;
-	pmsg->timestamp_usec  = skb_tv_base.tv_usec + entry->skb->tstamp.off_usec;
+	pmsg->timestamp_sec   = entry->skb->stamp.tv_sec;
+	pmsg->timestamp_usec  = entry->skb->stamp.tv_usec;
 	pmsg->mark            = entry->skb->nfmark;
 	pmsg->hook            = entry->info->hook;
 	pmsg->hw_protocol     = entry->skb->protocol;
@@ -280,8 +287,7 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 }
 
 static int
-ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
-		   unsigned int queuenum, void *data)
+ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data)
 {
 	int status = -EINVAL;
 	struct sk_buff *nskb;
@@ -299,6 +305,14 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
 	entry->info = info;
 	entry->skb = skb;
 
+	if (entry->info->hook == NF_IP_LOCAL_OUT) {
+		struct iphdr *iph = skb->nh.iph;
+
+		entry->rt_info.tos = iph->tos;
+		entry->rt_info.daddr = iph->daddr;
+		entry->rt_info.saddr = iph->saddr;
+	}
+
 	nskb = ipq_build_packet_message(entry, &status);
 	if (nskb == NULL)
 		goto err_out_free;
@@ -374,11 +388,24 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
 		}
 		skb_put(e->skb, diff);
 	}
-	if (!skb_make_writable(&e->skb, v->data_len))
+	if (!skb_ip_make_writable(&e->skb, v->data_len))
 		return -ENOMEM;
 	memcpy(e->skb->data, v->payload, v->data_len);
 	e->skb->ip_summed = CHECKSUM_NONE;
-
+	e->skb->nfcache |= NFC_ALTERED;
+
+	/*
+	 * Extra routing may needed on local out, as the QUEUE target never
+	 * returns control to the table.
+	 */
+	if (e->info->hook == NF_IP_LOCAL_OUT) {
+		struct iphdr *iph = e->skb->nh.iph;
+
+		if (!(iph->tos == e->rt_info.tos
+		      && iph->daddr == e->rt_info.daddr
+		      && iph->saddr == e->rt_info.saddr))
+			return ip_route_me_harder(&e->skb);
+	}
 	return 0;
 }
 
@@ -656,11 +683,6 @@ ipq_get_info(char *buffer, char **start, off_t offset, int length)
 }
 #endif /* CONFIG_PROC_FS */
 
-static struct nf_queue_handler nfqh = {
-	.name	= "ip_queue",
-	.outfn	= &ipq_enqueue_packet,
-};
-
 static int
 init_or_cleanup(int init)
 {
@@ -671,8 +693,7 @@ init_or_cleanup(int init)
 		goto cleanup;
 
 	netlink_register_notifier(&ipq_nl_notifier);
-	ipqnl = netlink_kernel_create(NETLINK_FIREWALL, 0, ipq_rcv_sk,
-				      THIS_MODULE);
+	ipqnl = netlink_kernel_create(NETLINK_FIREWALL, ipq_rcv_sk);
 	if (ipqnl == NULL) {
 		printk(KERN_ERR "ip_queue: failed to create netlink socket\n");
 		goto cleanup_netlink_notifier;
@@ -689,7 +710,7 @@ init_or_cleanup(int init)
 	register_netdevice_notifier(&ipq_dev_notifier);
 	ipq_sysctl_header = register_sysctl_table(ipq_root_table, 0);
 	
-	status = nf_register_queue_handler(PF_INET, &nfqh);
+	status = nf_register_queue_handler(PF_INET, ipq_enqueue_packet, NULL);
 	if (status < 0) {
 		printk(KERN_ERR "ip_queue: failed to register queue handler\n");
 		goto cleanup_sysctl;
@@ -697,7 +718,7 @@ init_or_cleanup(int init)
 	return status;
 
 cleanup:
-	nf_unregister_queue_handlers(&nfqh);
+	nf_unregister_queue_handler(PF_INET);
 	synchronize_net();
 	ipq_flush(NF_DROP);
 	
diff --git a/trunk/net/ipv4/netfilter/ip_tables.c b/trunk/net/ipv4/netfilter/ip_tables.c
index eef99a1b5de6..c88dfcd38c56 100644
--- a/trunk/net/ipv4/netfilter/ip_tables.c
+++ b/trunk/net/ipv4/netfilter/ip_tables.c
@@ -312,6 +312,7 @@ ipt_do_table(struct sk_buff **pskb,
 	do {
 		IP_NF_ASSERT(e);
 		IP_NF_ASSERT(back);
+		(*pskb)->nfcache |= e->nfcache;
 		if (ip_packet_match(ip, indev, outdev, &e->ip, offset)) {
 			struct ipt_entry_target *t;
 
@@ -340,8 +341,8 @@ ipt_do_table(struct sk_buff **pskb,
 							 back->comefrom);
 					continue;
 				}
-				if (table_base + v != (void *)e + e->next_offset
-				    && !(e->ip.flags & IPT_F_GOTO)) {
+				if (table_base + v
+				    != (void *)e + e->next_offset) {
 					/* Save old back ptr in next entry */
 					struct ipt_entry *next
 						= (void *)e + e->next_offset;
diff --git a/trunk/net/ipv4/netfilter/ipt_CLASSIFY.c b/trunk/net/ipv4/netfilter/ipt_CLASSIFY.c
index dab78d8bd494..9842e6e23184 100644
--- a/trunk/net/ipv4/netfilter/ipt_CLASSIFY.c
+++ b/trunk/net/ipv4/netfilter/ipt_CLASSIFY.c
@@ -32,8 +32,10 @@ target(struct sk_buff **pskb,
 {
 	const struct ipt_classify_target_info *clinfo = targinfo;
 
-	if((*pskb)->priority != clinfo->priority) 
+	if((*pskb)->priority != clinfo->priority) {
 		(*pskb)->priority = clinfo->priority;
+		(*pskb)->nfcache |= NFC_ALTERED;
+	}
 
 	return IPT_CONTINUE;
 }
diff --git a/trunk/net/ipv4/netfilter/ipt_CLUSTERIP.c b/trunk/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 2d05cafec221..6706d3a1bc4f 100644
--- a/trunk/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/trunk/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -367,7 +367,7 @@ target(struct sk_buff **pskb,
 #ifdef DEBUG_CLUSTERP
 	DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 #endif
-	DEBUGP("hash=%u ct_hash=%u ", hash, ct->mark);
+	DEBUGP("hash=%u ct_hash=%lu ", hash, ct->mark);
 	if (!clusterip_responsible(cipinfo->config, hash)) {
 		DEBUGP("not responsible\n");
 		return NF_DROP;
diff --git a/trunk/net/ipv4/netfilter/ipt_CONNMARK.c b/trunk/net/ipv4/netfilter/ipt_CONNMARK.c
index 134638021339..30ddd3e18eb7 100644
--- a/trunk/net/ipv4/netfilter/ipt_CONNMARK.c
+++ b/trunk/net/ipv4/netfilter/ipt_CONNMARK.c
@@ -40,9 +40,9 @@ target(struct sk_buff **pskb,
        void *userinfo)
 {
 	const struct ipt_connmark_target_info *markinfo = targinfo;
-	u_int32_t diff;
-	u_int32_t nfmark;
-	u_int32_t newmark;
+	unsigned long diff;
+	unsigned long nfmark;
+	unsigned long newmark;
 
 	enum ip_conntrack_info ctinfo;
 	struct ip_conntrack *ct = ip_conntrack_get((*pskb), &ctinfo);
@@ -61,8 +61,10 @@ target(struct sk_buff **pskb,
 	    case IPT_CONNMARK_RESTORE:
 		nfmark = (*pskb)->nfmark;
 		diff = (ct->mark ^ nfmark) & markinfo->mask;
-		if (diff != 0)
+		if (diff != 0) {
 		    (*pskb)->nfmark = nfmark ^ diff;
+		    (*pskb)->nfcache |= NFC_ALTERED;
+		}
 		break;
 	    }
 	}
@@ -92,11 +94,6 @@ checkentry(const char *tablename,
 	    }
 	}
 
-	if (matchinfo->mark > 0xffffffff || matchinfo->mask > 0xffffffff) {
-		printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
-		return 0;
-	}
-
 	return 1;
 }
 
diff --git a/trunk/net/ipv4/netfilter/ipt_DSCP.c b/trunk/net/ipv4/netfilter/ipt_DSCP.c
index 6e319570a28c..3ea4509099f9 100644
--- a/trunk/net/ipv4/netfilter/ipt_DSCP.c
+++ b/trunk/net/ipv4/netfilter/ipt_DSCP.c
@@ -39,7 +39,7 @@ target(struct sk_buff **pskb,
 	if (((*pskb)->nh.iph->tos & IPT_DSCP_MASK) != sh_dscp) {
 		u_int16_t diffs[2];
 
-		if (!skb_make_writable(pskb, sizeof(struct iphdr)))
+		if (!skb_ip_make_writable(pskb, sizeof(struct iphdr)))
 			return NF_DROP;
 
 		diffs[0] = htons((*pskb)->nh.iph->tos) ^ 0xFFFF;
@@ -51,6 +51,7 @@ target(struct sk_buff **pskb,
 						 sizeof(diffs),
 						 (*pskb)->nh.iph->check
 						 ^ 0xFFFF));
+		(*pskb)->nfcache |= NFC_ALTERED;
 	}
 	return IPT_CONTINUE;
 }
diff --git a/trunk/net/ipv4/netfilter/ipt_ECN.c b/trunk/net/ipv4/netfilter/ipt_ECN.c
index a1319693f648..94a0ce1c1c9d 100644
--- a/trunk/net/ipv4/netfilter/ipt_ECN.c
+++ b/trunk/net/ipv4/netfilter/ipt_ECN.c
@@ -31,7 +31,7 @@ set_ect_ip(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
 	    != (einfo->ip_ect & IPT_ECN_IP_MASK)) {
 		u_int16_t diffs[2];
 
-		if (!skb_make_writable(pskb, sizeof(struct iphdr)))
+		if (!skb_ip_make_writable(pskb, sizeof(struct iphdr)))
 			return 0;
 
 		diffs[0] = htons((*pskb)->nh.iph->tos) ^ 0xFFFF;
@@ -43,6 +43,7 @@ set_ect_ip(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
 						 sizeof(diffs),
 						 (*pskb)->nh.iph->check
 						 ^0xFFFF));
+		(*pskb)->nfcache |= NFC_ALTERED;
 	} 
 	return 1;
 }
@@ -66,7 +67,7 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo, int inward)
 	     tcph->cwr == einfo->proto.tcp.cwr)))
 		return 1;
 
-	if (!skb_make_writable(pskb, (*pskb)->nh.iph->ihl*4+sizeof(*tcph)))
+	if (!skb_ip_make_writable(pskb, (*pskb)->nh.iph->ihl*4+sizeof(*tcph)))
 		return 0;
 	tcph = (void *)(*pskb)->nh.iph + (*pskb)->nh.iph->ihl*4;
 
@@ -86,6 +87,7 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo, int inward)
 		tcph->check = csum_fold(csum_partial((char *)diffs,
 						     sizeof(diffs),
 						     tcph->check^0xFFFF));
+	(*pskb)->nfcache |= NFC_ALTERED;
 	return 1;
 }
 
diff --git a/trunk/net/ipv4/netfilter/ipt_LOG.c b/trunk/net/ipv4/netfilter/ipt_LOG.c
index 92ed050fac69..ef08733d26da 100644
--- a/trunk/net/ipv4/netfilter/ipt_LOG.c
+++ b/trunk/net/ipv4/netfilter/ipt_LOG.c
@@ -27,6 +27,10 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("iptables syslog logging module");
 
+static unsigned int nflog = 1;
+module_param(nflog, int, 0400);
+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
+ 
 #if 0
 #define DEBUGP printk
 #else
@@ -37,17 +41,11 @@ MODULE_DESCRIPTION("iptables syslog logging module");
 static DEFINE_SPINLOCK(log_lock);
 
 /* One level of recursion won't kill us */
-static void dump_packet(const struct nf_loginfo *info,
+static void dump_packet(const struct ipt_log_info *info,
 			const struct sk_buff *skb,
 			unsigned int iphoff)
 {
 	struct iphdr _iph, *ih;
-	unsigned int logflags;
-
-	if (info->type == NF_LOG_TYPE_LOG)
-		logflags = info->u.log.logflags;
-	else
-		logflags = NF_LOG_MASK;
 
 	ih = skb_header_pointer(skb, iphoff, sizeof(_iph), &_iph);
 	if (ih == NULL) {
@@ -78,7 +76,7 @@ static void dump_packet(const struct nf_loginfo *info,
 	if (ntohs(ih->frag_off) & IP_OFFSET)
 		printk("FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
 
-	if ((logflags & IPT_LOG_IPOPT)
+	if ((info->logflags & IPT_LOG_IPOPT)
 	    && ih->ihl * 4 > sizeof(struct iphdr)) {
 		unsigned char _opt[4 * 15 - sizeof(struct iphdr)], *op;
 		unsigned int i, optsize;
@@ -121,7 +119,7 @@ static void dump_packet(const struct nf_loginfo *info,
 		printk("SPT=%u DPT=%u ",
 		       ntohs(th->source), ntohs(th->dest));
 		/* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
-		if (logflags & IPT_LOG_TCPSEQ)
+		if (info->logflags & IPT_LOG_TCPSEQ)
 			printk("SEQ=%u ACK=%u ",
 			       ntohl(th->seq), ntohl(th->ack_seq));
 		/* Max length: 13 "WINDOW=65535 " */
@@ -148,7 +146,7 @@ static void dump_packet(const struct nf_loginfo *info,
 		/* Max length: 11 "URGP=65535 " */
 		printk("URGP=%u ", ntohs(th->urg_ptr));
 
-		if ((logflags & IPT_LOG_TCPOPT)
+		if ((info->logflags & IPT_LOG_TCPOPT)
 		    && th->doff * 4 > sizeof(struct tcphdr)) {
 			unsigned char _opt[4 * 15 - sizeof(struct tcphdr)];
 			unsigned char *op;
@@ -330,7 +328,7 @@ static void dump_packet(const struct nf_loginfo *info,
 	}
 
 	/* Max length: 15 "UID=4294967295 " */
- 	if ((logflags & IPT_LOG_UID) && !iphoff && skb->sk) {
+ 	if ((info->logflags & IPT_LOG_UID) && !iphoff && skb->sk) {
 		read_lock_bh(&skb->sk->sk_callback_lock);
 		if (skb->sk->sk_socket && skb->sk->sk_socket->file)
  			printk("UID=%u ", skb->sk->sk_socket->file->f_uid);
@@ -351,31 +349,19 @@ static void dump_packet(const struct nf_loginfo *info,
 	/* maxlen = 230+   91  + 230 + 252 = 803 */
 }
 
-struct nf_loginfo default_loginfo = {
-	.type	= NF_LOG_TYPE_LOG,
-	.u = {
-		.log = {
-			.level    = 0,
-			.logflags = NF_LOG_MASK,
-		},
-	},
-};
-
 static void
-ipt_log_packet(unsigned int pf,
-	       unsigned int hooknum,
+ipt_log_packet(unsigned int hooknum,
 	       const struct sk_buff *skb,
 	       const struct net_device *in,
 	       const struct net_device *out,
-	       const struct nf_loginfo *loginfo,
+	       const struct ipt_log_info *loginfo,
+	       const char *level_string,
 	       const char *prefix)
 {
-	if (!loginfo)
-		loginfo = &default_loginfo;
-
 	spin_lock_bh(&log_lock);
-	printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
-	       prefix,
+	printk(level_string);
+	printk("%sIN=%s OUT=%s ",
+	       prefix == NULL ? loginfo->prefix : prefix,
 	       in ? in->name : "",
 	       out ? out->name : "");
 #ifdef CONFIG_BRIDGE_NETFILTER
@@ -419,17 +405,30 @@ ipt_log_target(struct sk_buff **pskb,
 	       void *userinfo)
 {
 	const struct ipt_log_info *loginfo = targinfo;
-	struct nf_loginfo li;
-
-	li.type = NF_LOG_TYPE_LOG;
-	li.u.log.level = loginfo->level;
-	li.u.log.logflags = loginfo->logflags;
+	char level_string[4] = "< >";
 
-	nf_log_packet(PF_INET, hooknum, *pskb, in, out, &li, loginfo->prefix);
+	level_string[1] = '0' + (loginfo->level % 8);
+	ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
 
 	return IPT_CONTINUE;
 }
 
+static void
+ipt_logfn(unsigned int hooknum,
+	  const struct sk_buff *skb,
+	  const struct net_device *in,
+	  const struct net_device *out,
+	  const char *prefix)
+{
+	struct ipt_log_info loginfo = { 
+		.level = 0, 
+		.logflags = IPT_LOG_MASK, 
+		.prefix = "" 
+	};
+
+	ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
+}
+
 static int ipt_log_checkentry(const char *tablename,
 			      const struct ipt_entry *e,
 			      void *targinfo,
@@ -465,29 +464,20 @@ static struct ipt_target ipt_log_reg = {
 	.me		= THIS_MODULE,
 };
 
-static struct nf_logger ipt_log_logger ={
-	.name		= "ipt_LOG",
-	.logfn		= &ipt_log_packet,
-	.me		= THIS_MODULE,
-};
-
 static int __init init(void)
 {
 	if (ipt_register_target(&ipt_log_reg))
 		return -EINVAL;
-	if (nf_log_register(PF_INET, &ipt_log_logger) < 0) {
-		printk(KERN_WARNING "ipt_LOG: not logging via system console "
-		       "since somebody else already registered for PF_INET\n");
-		/* we cannot make module load fail here, since otherwise
-		 * iptables userspace would abort */
-	}
+	if (nflog)
+		nf_log_register(PF_INET, &ipt_logfn);
 	
 	return 0;
 }
 
 static void __exit fini(void)
 {
-	nf_log_unregister_logger(&ipt_log_logger);
+	if (nflog)
+		nf_log_unregister(PF_INET, &ipt_logfn);
 	ipt_unregister_target(&ipt_log_reg);
 }
 
diff --git a/trunk/net/ipv4/netfilter/ipt_MARK.c b/trunk/net/ipv4/netfilter/ipt_MARK.c
index 52b4f2c296bf..33c6f9b63b8d 100644
--- a/trunk/net/ipv4/netfilter/ipt_MARK.c
+++ b/trunk/net/ipv4/netfilter/ipt_MARK.c
@@ -29,9 +29,10 @@ target_v0(struct sk_buff **pskb,
 {
 	const struct ipt_mark_target_info *markinfo = targinfo;
 
-	if((*pskb)->nfmark != markinfo->mark)
+	if((*pskb)->nfmark != markinfo->mark) {
 		(*pskb)->nfmark = markinfo->mark;
-
+		(*pskb)->nfcache |= NFC_ALTERED;
+	}
 	return IPT_CONTINUE;
 }
 
@@ -60,9 +61,10 @@ target_v1(struct sk_buff **pskb,
 		break;
 	}
 
-	if((*pskb)->nfmark != mark)
+	if((*pskb)->nfmark != mark) {
 		(*pskb)->nfmark = mark;
-
+		(*pskb)->nfcache |= NFC_ALTERED;
+	}
 	return IPT_CONTINUE;
 }
 
@@ -74,8 +76,6 @@ checkentry_v0(const char *tablename,
 	      unsigned int targinfosize,
 	      unsigned int hook_mask)
 {
-	struct ipt_mark_target_info *markinfo = targinfo;
-
 	if (targinfosize != IPT_ALIGN(sizeof(struct ipt_mark_target_info))) {
 		printk(KERN_WARNING "MARK: targinfosize %u != %Zu\n",
 		       targinfosize,
@@ -88,11 +88,6 @@ checkentry_v0(const char *tablename,
 		return 0;
 	}
 
-	if (markinfo->mark > 0xffffffff) {
-		printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n");
-		return 0;
-	}
-
 	return 1;
 }
 
@@ -125,11 +120,6 @@ checkentry_v1(const char *tablename,
 		return 0;
 	}
 
-	if (markinfo->mark > 0xffffffff) {
-		printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n");
-		return 0;
-	}
-
 	return 1;
 }
 
diff --git a/trunk/net/ipv4/netfilter/ipt_MASQUERADE.c b/trunk/net/ipv4/netfilter/ipt_MASQUERADE.c
index 2f3e181c8e97..91e74502c3d3 100644
--- a/trunk/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/trunk/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -86,6 +86,11 @@ masquerade_target(struct sk_buff **pskb,
 
 	IP_NF_ASSERT(hooknum == NF_IP_POST_ROUTING);
 
+	/* FIXME: For the moment, don't do local packets, breaks
+	   testsuite for 2.3.49 --RR */
+	if ((*pskb)->sk)
+		return NF_ACCEPT;
+
 	ct = ip_conntrack_get(*pskb, &ctinfo);
 	IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
 	                    || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
diff --git a/trunk/net/ipv4/netfilter/ipt_NETMAP.c b/trunk/net/ipv4/netfilter/ipt_NETMAP.c
index e6e7b6095363..06254b29d034 100644
--- a/trunk/net/ipv4/netfilter/ipt_NETMAP.c
+++ b/trunk/net/ipv4/netfilter/ipt_NETMAP.c
@@ -46,8 +46,7 @@ check(const char *tablename,
 		DEBUGP(MODULENAME":check: size %u.\n", targinfosize);
 		return 0;
 	}
-	if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_POST_ROUTING) |
-	                  (1 << NF_IP_LOCAL_OUT))) {
+	if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_POST_ROUTING))) {
 		DEBUGP(MODULENAME":check: bad hooks %x.\n", hook_mask);
 		return 0;
 	}
@@ -77,13 +76,12 @@ target(struct sk_buff **pskb,
 	struct ip_nat_range newrange;
 
 	IP_NF_ASSERT(hooknum == NF_IP_PRE_ROUTING
-		     || hooknum == NF_IP_POST_ROUTING
-		     || hooknum == NF_IP_LOCAL_OUT);
+		     || hooknum == NF_IP_POST_ROUTING);
 	ct = ip_conntrack_get(*pskb, &ctinfo);
 
 	netmask = ~(mr->range[0].min_ip ^ mr->range[0].max_ip);
 
-	if (hooknum == NF_IP_PRE_ROUTING || hooknum == NF_IP_LOCAL_OUT)
+	if (hooknum == NF_IP_PRE_ROUTING)
 		new_ip = (*pskb)->nh.iph->daddr & ~netmask;
 	else
 		new_ip = (*pskb)->nh.iph->saddr & ~netmask;
diff --git a/trunk/net/ipv4/netfilter/ipt_NFQUEUE.c b/trunk/net/ipv4/netfilter/ipt_NFQUEUE.c
deleted file mode 100644
index 3cedc9be8807..000000000000
--- a/trunk/net/ipv4/netfilter/ipt_NFQUEUE.c
+++ /dev/null
@@ -1,70 +0,0 @@
-/* iptables module for using new netfilter netlink queue
- *
- * (C) 2005 by Harald Welte <laforge@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as 
- * published by the Free Software Foundation.
- * 
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv4/ipt_NFQUEUE.h>
-
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("iptables NFQUEUE target");
-MODULE_LICENSE("GPL");
-
-static unsigned int
-target(struct sk_buff **pskb,
-       const struct net_device *in,
-       const struct net_device *out,
-       unsigned int hooknum,
-       const void *targinfo,
-       void *userinfo)
-{
-	const struct ipt_NFQ_info *tinfo = targinfo;
-
-	return NF_QUEUE_NR(tinfo->queuenum);
-}
-
-static int
-checkentry(const char *tablename,
-	   const struct ipt_entry *e,
-           void *targinfo,
-           unsigned int targinfosize,
-           unsigned int hook_mask)
-{
-	if (targinfosize != IPT_ALIGN(sizeof(struct ipt_NFQ_info))) {
-		printk(KERN_WARNING "NFQUEUE: targinfosize %u != %Zu\n",
-		       targinfosize,
-		       IPT_ALIGN(sizeof(struct ipt_NFQ_info)));
-		return 0;
-	}
-
-	return 1;
-}
-
-static struct ipt_target ipt_NFQ_reg = {
-	.name		= "NFQUEUE",
-	.target		= target,
-	.checkentry	= checkentry,
-	.me		= THIS_MODULE,
-};
-
-static int __init init(void)
-{
-	return ipt_register_target(&ipt_NFQ_reg);
-}
-
-static void __exit fini(void)
-{
-	ipt_unregister_target(&ipt_NFQ_reg);
-}
-
-module_init(init);
-module_exit(fini);
diff --git a/trunk/net/ipv4/netfilter/ipt_REJECT.c b/trunk/net/ipv4/netfilter/ipt_REJECT.c
index f115a84a4ac6..915696446020 100644
--- a/trunk/net/ipv4/netfilter/ipt_REJECT.c
+++ b/trunk/net/ipv4/netfilter/ipt_REJECT.c
@@ -156,6 +156,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
 
 	/* This packet will not be the same as the other: clear nf fields */
 	nf_reset(nskb);
+	nskb->nfcache = 0;
 	nskb->nfmark = 0;
 #ifdef CONFIG_BRIDGE_NETFILTER
 	nf_bridge_put(nskb->nf_bridge);
diff --git a/trunk/net/ipv4/netfilter/ipt_TCPMSS.c b/trunk/net/ipv4/netfilter/ipt_TCPMSS.c
index 8db70d6908c3..7b84a254440e 100644
--- a/trunk/net/ipv4/netfilter/ipt_TCPMSS.c
+++ b/trunk/net/ipv4/netfilter/ipt_TCPMSS.c
@@ -58,7 +58,7 @@ ipt_tcpmss_target(struct sk_buff **pskb,
 	unsigned int i;
 	u_int8_t *opt;
 
-	if (!skb_make_writable(pskb, (*pskb)->len))
+	if (!skb_ip_make_writable(pskb, (*pskb)->len))
 		return NF_DROP;
 
 	if ((*pskb)->ip_summed == CHECKSUM_HW &&
@@ -190,6 +190,7 @@ ipt_tcpmss_target(struct sk_buff **pskb,
 	       newmss);
 
  retmodified:
+	(*pskb)->nfcache |= NFC_UNKNOWN | NFC_ALTERED;
 	return IPT_CONTINUE;
 }
 
diff --git a/trunk/net/ipv4/netfilter/ipt_TOS.c b/trunk/net/ipv4/netfilter/ipt_TOS.c
index deadb36d4428..85c70d240f8b 100644
--- a/trunk/net/ipv4/netfilter/ipt_TOS.c
+++ b/trunk/net/ipv4/netfilter/ipt_TOS.c
@@ -33,7 +33,7 @@ target(struct sk_buff **pskb,
 	if (((*pskb)->nh.iph->tos & IPTOS_TOS_MASK) != tosinfo->tos) {
 		u_int16_t diffs[2];
 
-		if (!skb_make_writable(pskb, sizeof(struct iphdr)))
+		if (!skb_ip_make_writable(pskb, sizeof(struct iphdr)))
 			return NF_DROP;
 
 		diffs[0] = htons((*pskb)->nh.iph->tos) ^ 0xFFFF;
@@ -46,6 +46,7 @@ target(struct sk_buff **pskb,
 						 sizeof(diffs),
 						 (*pskb)->nh.iph->check
 						 ^0xFFFF));
+		(*pskb)->nfcache |= NFC_ALTERED;
 	}
 	return IPT_CONTINUE;
 }
diff --git a/trunk/net/ipv4/netfilter/ipt_TTL.c b/trunk/net/ipv4/netfilter/ipt_TTL.c
deleted file mode 100644
index b9ae6a9382f3..000000000000
--- a/trunk/net/ipv4/netfilter/ipt_TTL.c
+++ /dev/null
@@ -1,119 +0,0 @@
-/* TTL modification target for IP tables
- * (C) 2000,2005 by Harald Welte <laforge@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ip.h>
-#include <net/checksum.h>
-
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv4/ipt_TTL.h>
-
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("IP tables TTL modification module");
-MODULE_LICENSE("GPL");
-
-static unsigned int 
-ipt_ttl_target(struct sk_buff **pskb, const struct net_device *in, 
-		const struct net_device *out, unsigned int hooknum, 
-		const void *targinfo, void *userinfo)
-{
-	struct iphdr *iph;
-	const struct ipt_TTL_info *info = targinfo;
-	u_int16_t diffs[2];
-	int new_ttl;
-
-	if (!skb_make_writable(pskb, (*pskb)->len))
-		return NF_DROP;
-
-	iph = (*pskb)->nh.iph;
-
-	switch (info->mode) {
-		case IPT_TTL_SET:
-			new_ttl = info->ttl;
-			break;
-		case IPT_TTL_INC:
-			new_ttl = iph->ttl + info->ttl;
-			if (new_ttl > 255)
-				new_ttl = 255;
-			break;
-		case IPT_TTL_DEC:
-			new_ttl = iph->ttl - info->ttl;
-			if (new_ttl < 0)
-				new_ttl = 0;
-			break;
-		default:
-			new_ttl = iph->ttl;
-			break;
-	}
-
-	if (new_ttl != iph->ttl) {
-		diffs[0] = htons(((unsigned)iph->ttl) << 8) ^ 0xFFFF;
-		iph->ttl = new_ttl;
-		diffs[1] = htons(((unsigned)iph->ttl) << 8);
-		iph->check = csum_fold(csum_partial((char *)diffs,
-						    sizeof(diffs),
-						    iph->check^0xFFFF));
-	}
-
-	return IPT_CONTINUE;
-}
-
-static int ipt_ttl_checkentry(const char *tablename,
-		const struct ipt_entry *e,
-		void *targinfo,
-		unsigned int targinfosize,
-		unsigned int hook_mask)
-{
-	struct ipt_TTL_info *info = targinfo;
-
-	if (targinfosize != IPT_ALIGN(sizeof(struct ipt_TTL_info))) {
-		printk(KERN_WARNING "ipt_TTL: targinfosize %u != %Zu\n",
-				targinfosize,
-				IPT_ALIGN(sizeof(struct ipt_TTL_info)));
-		return 0;
-	}
-
-	if (strcmp(tablename, "mangle")) {
-		printk(KERN_WARNING "ipt_TTL: can only be called from "
-			"\"mangle\" table, not \"%s\"\n", tablename);
-		return 0;
-	}
-
-	if (info->mode > IPT_TTL_MAXMODE) {
-		printk(KERN_WARNING "ipt_TTL: invalid or unknown Mode %u\n", 
-			info->mode);
-		return 0;
-	}
-
-	if ((info->mode != IPT_TTL_SET) && (info->ttl == 0))
-		return 0;
-
-	return 1;
-}
-
-static struct ipt_target ipt_TTL = { 
-	.name 		= "TTL",
-	.target 	= ipt_ttl_target, 
-	.checkentry 	= ipt_ttl_checkentry, 
-	.me 		= THIS_MODULE,
-};
-
-static int __init init(void)
-{
-	return ipt_register_target(&ipt_TTL);
-}
-
-static void __exit fini(void)
-{
-	ipt_unregister_target(&ipt_TTL);
-}
-
-module_init(init);
-module_exit(fini);
diff --git a/trunk/net/ipv4/netfilter/ipt_ULOG.c b/trunk/net/ipv4/netfilter/ipt_ULOG.c
index e2c14f3cb2fc..52a0076302a7 100644
--- a/trunk/net/ipv4/netfilter/ipt_ULOG.c
+++ b/trunk/net/ipv4/netfilter/ipt_ULOG.c
@@ -62,7 +62,6 @@
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
 MODULE_DESCRIPTION("iptables userspace logging module");
-MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NFLOG);
 
 #define ULOG_NL_EVENT		111		/* Harald's favorite number */
 #define ULOG_MAXNLGROUPS	32		/* numer of nlgroups */
@@ -116,10 +115,10 @@ static void ulog_send(unsigned int nlgroupnum)
 	if (ub->qlen > 1)
 		ub->lastnlh->nlmsg_type = NLMSG_DONE;
 
-	NETLINK_CB(ub->skb).dst_group = nlgroupnum + 1;
-	DEBUGP("ipt_ULOG: throwing %d packets to netlink group %u\n",
-		ub->qlen, nlgroupnum + 1);
-	netlink_broadcast(nflognl, ub->skb, 0, nlgroupnum + 1, GFP_ATOMIC);
+	NETLINK_CB(ub->skb).dst_groups = (1 << nlgroupnum);
+	DEBUGP("ipt_ULOG: throwing %d packets to netlink mask %u\n",
+		ub->qlen, nlgroupnum);
+	netlink_broadcast(nflognl, ub->skb, 0, (1 << nlgroupnum), GFP_ATOMIC);
 
 	ub->qlen = 0;
 	ub->skb = NULL;
@@ -220,13 +219,13 @@ static void ipt_ulog_packet(unsigned int hooknum,
 	pm = NLMSG_DATA(nlh);
 
 	/* We might not have a timestamp, get one */
-	if (skb->tstamp.off_sec == 0)
-		__net_timestamp((struct sk_buff *)skb);
+	if (skb->stamp.tv_sec == 0)
+		do_gettimeofday((struct timeval *)&skb->stamp);
 
 	/* copy hook, prefix, timestamp, payload, etc. */
 	pm->data_len = copy_len;
-	pm->timestamp_sec = skb_tv_base.tv_sec + skb->tstamp.off_sec;
-	pm->timestamp_usec = skb_tv_base.tv_usec + skb->tstamp.off_usec;
+	pm->timestamp_sec = skb->stamp.tv_sec;
+	pm->timestamp_usec = skb->stamp.tv_usec;
 	pm->mark = skb->nfmark;
 	pm->hook = hooknum;
 	if (prefix != NULL)
@@ -304,27 +303,18 @@ static unsigned int ipt_ulog_target(struct sk_buff **pskb,
  	return IPT_CONTINUE;
 }
  
-static void ipt_logfn(unsigned int pf,
-		      unsigned int hooknum,
+static void ipt_logfn(unsigned int hooknum,
 		      const struct sk_buff *skb,
 		      const struct net_device *in,
 		      const struct net_device *out,
-		      const struct nf_loginfo *li,
 		      const char *prefix)
 {
-	struct ipt_ulog_info loginfo;
-
-	if (!li || li->type != NF_LOG_TYPE_ULOG) {
-		loginfo.nl_group = ULOG_DEFAULT_NLGROUP;
-		loginfo.copy_range = 0;
-		loginfo.qthreshold = ULOG_DEFAULT_QTHRESHOLD;
-		loginfo.prefix[0] = '\0';
-	} else {
-		loginfo.nl_group = li->u.ulog.group;
-		loginfo.copy_range = li->u.ulog.copy_len;
-		loginfo.qthreshold = li->u.ulog.qthreshold;
-		strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
-	}
+	struct ipt_ulog_info loginfo = { 
+		.nl_group = ULOG_DEFAULT_NLGROUP,
+		.copy_range = 0,
+		.qthreshold = ULOG_DEFAULT_QTHRESHOLD,
+		.prefix = ""
+	};
 
 	ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
 }
@@ -364,12 +354,6 @@ static struct ipt_target ipt_ulog_reg = {
 	.me		= THIS_MODULE,
 };
 
-static struct nf_logger ipt_ulog_logger = {
-	.name		= "ipt_ULOG",
-	.logfn		= &ipt_logfn,
-	.me		= THIS_MODULE,
-};
-
 static int __init init(void)
 {
 	int i;
@@ -388,8 +372,7 @@ static int __init init(void)
 		ulog_buffers[i].timer.data = i;
 	}
 
-	nflognl = netlink_kernel_create(NETLINK_NFLOG, ULOG_MAXNLGROUPS, NULL,
-	                                THIS_MODULE);
+	nflognl = netlink_kernel_create(NETLINK_NFLOG, NULL);
 	if (!nflognl)
 		return -ENOMEM;
 
@@ -398,7 +381,7 @@ static int __init init(void)
 		return -EINVAL;
 	}
 	if (nflog)
-		nf_log_register(PF_INET, &ipt_ulog_logger);
+		nf_log_register(PF_INET, &ipt_logfn);
 	
 	return 0;
 }
@@ -411,7 +394,7 @@ static void __exit fini(void)
 	DEBUGP("ipt_ULOG: cleanup_module\n");
 
 	if (nflog)
-		nf_log_unregister_logger(&ipt_ulog_logger);
+		nf_log_unregister(PF_INET, &ipt_logfn);
 	ipt_unregister_target(&ipt_ulog_reg);
 	sock_release(nflognl->sk_socket);
 
diff --git a/trunk/net/ipv4/netfilter/ipt_connbytes.c b/trunk/net/ipv4/netfilter/ipt_connbytes.c
deleted file mode 100644
index df4a42c6da22..000000000000
--- a/trunk/net/ipv4/netfilter/ipt_connbytes.c
+++ /dev/null
@@ -1,162 +0,0 @@
-/* Kernel module to match connection tracking byte counter.
- * GPL (C) 2002 Martin Devera (devik@cdi.cz).
- *
- * 2004-07-20 Harald Welte <laforge@netfilter.org>
- * 	- reimplemented to use per-connection accounting counters
- * 	- add functionality to match number of packets
- * 	- add functionality to match average packet size
- * 	- add support to match directions seperately
- *
- */
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/netfilter_ipv4/ip_conntrack.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv4/ipt_connbytes.h>
-
-#include <asm/div64.h>
-#include <asm/bitops.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("iptables match for matching number of pkts/bytes per connection");
-
-/* 64bit divisor, dividend and result. dynamic precision */
-static u_int64_t div64_64(u_int64_t dividend, u_int64_t divisor)
-{
-	u_int32_t d = divisor;
-
-	if (divisor > 0xffffffffULL) {
-		unsigned int shift = fls(divisor >> 32);
-
-		d = divisor >> shift;
-		dividend >>= shift;
-	}
-
-	do_div(dividend, d);
-	return dividend;
-}
-
-static int
-match(const struct sk_buff *skb,
-      const struct net_device *in,
-      const struct net_device *out,
-      const void *matchinfo,
-      int offset,
-      int *hotdrop)
-{
-	const struct ipt_connbytes_info *sinfo = matchinfo;
-	enum ip_conntrack_info ctinfo;
-	struct ip_conntrack *ct;
-	u_int64_t what = 0;	/* initialize to make gcc happy */
-
-	if (!(ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo)))
-		return 0; /* no match */
-
-	switch (sinfo->what) {
-	case IPT_CONNBYTES_PKTS:
-		switch (sinfo->direction) {
-		case IPT_CONNBYTES_DIR_ORIGINAL:
-			what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
-			break;
-		case IPT_CONNBYTES_DIR_REPLY:
-			what = ct->counters[IP_CT_DIR_REPLY].packets;
-			break;
-		case IPT_CONNBYTES_DIR_BOTH:
-			what = ct->counters[IP_CT_DIR_ORIGINAL].packets;
-			what += ct->counters[IP_CT_DIR_REPLY].packets;
-			break;
-		}
-		break;
-	case IPT_CONNBYTES_BYTES:
-		switch (sinfo->direction) {
-		case IPT_CONNBYTES_DIR_ORIGINAL:
-			what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
-			break;
-		case IPT_CONNBYTES_DIR_REPLY:
-			what = ct->counters[IP_CT_DIR_REPLY].bytes;
-			break;
-		case IPT_CONNBYTES_DIR_BOTH:
-			what = ct->counters[IP_CT_DIR_ORIGINAL].bytes;
-			what += ct->counters[IP_CT_DIR_REPLY].bytes;
-			break;
-		}
-		break;
-	case IPT_CONNBYTES_AVGPKT:
-		switch (sinfo->direction) {
-		case IPT_CONNBYTES_DIR_ORIGINAL:
-			what = div64_64(ct->counters[IP_CT_DIR_ORIGINAL].bytes,
-					ct->counters[IP_CT_DIR_ORIGINAL].packets);
-			break;
-		case IPT_CONNBYTES_DIR_REPLY:
-			what = div64_64(ct->counters[IP_CT_DIR_REPLY].bytes,
-					ct->counters[IP_CT_DIR_REPLY].packets);
-			break;
-		case IPT_CONNBYTES_DIR_BOTH:
-			{
-				u_int64_t bytes;
-				u_int64_t pkts;
-				bytes = ct->counters[IP_CT_DIR_ORIGINAL].bytes +
-					ct->counters[IP_CT_DIR_REPLY].bytes;
-				pkts = ct->counters[IP_CT_DIR_ORIGINAL].packets+
-					ct->counters[IP_CT_DIR_REPLY].packets;
-
-				/* FIXME_THEORETICAL: what to do if sum
-				 * overflows ? */
-
-				what = div64_64(bytes, pkts);
-			}
-			break;
-		}
-		break;
-	}
-
-	if (sinfo->count.to)
-		return (what <= sinfo->count.to && what >= sinfo->count.from);
-	else
-		return (what >= sinfo->count.from);
-}
-
-static int check(const char *tablename,
-		 const struct ipt_ip *ip,
-		 void *matchinfo,
-		 unsigned int matchsize,
-		 unsigned int hook_mask)
-{
-	const struct ipt_connbytes_info *sinfo = matchinfo;
-
-	if (matchsize != IPT_ALIGN(sizeof(struct ipt_connbytes_info)))
-		return 0;
-
-	if (sinfo->what != IPT_CONNBYTES_PKTS &&
-	    sinfo->what != IPT_CONNBYTES_BYTES &&
-	    sinfo->what != IPT_CONNBYTES_AVGPKT)
-		return 0;
-
-	if (sinfo->direction != IPT_CONNBYTES_DIR_ORIGINAL &&
-	    sinfo->direction != IPT_CONNBYTES_DIR_REPLY &&
-	    sinfo->direction != IPT_CONNBYTES_DIR_BOTH)
-		return 0;
-
-	return 1;
-}
-
-static struct ipt_match state_match = {
-	.name		= "connbytes",
-	.match		= &match,
-	.checkentry	= &check,
-	.me		= THIS_MODULE
-};
-
-static int __init init(void)
-{
-	return ipt_register_match(&state_match);
-}
-
-static void __exit fini(void)
-{
-	ipt_unregister_match(&state_match);
-}
-
-module_init(init);
-module_exit(fini);
diff --git a/trunk/net/ipv4/netfilter/ipt_connmark.c b/trunk/net/ipv4/netfilter/ipt_connmark.c
index bf8de47ce004..2706f96cea55 100644
--- a/trunk/net/ipv4/netfilter/ipt_connmark.c
+++ b/trunk/net/ipv4/netfilter/ipt_connmark.c
@@ -54,16 +54,9 @@ checkentry(const char *tablename,
 	   unsigned int matchsize,
 	   unsigned int hook_mask)
 {
-	struct ipt_connmark_info *cm = 
-				(struct ipt_connmark_info *)matchinfo;
 	if (matchsize != IPT_ALIGN(sizeof(struct ipt_connmark_info)))
 		return 0;
 
-	if (cm->mark > 0xffffffff || cm->mask > 0xffffffff) {
-		printk(KERN_WARNING "connmark: only support 32bit mark\n");
-		return 0;
-	}
-
 	return 1;
 }
 
diff --git a/trunk/net/ipv4/netfilter/ipt_dccp.c b/trunk/net/ipv4/netfilter/ipt_dccp.c
deleted file mode 100644
index ad3278bba6c1..000000000000
--- a/trunk/net/ipv4/netfilter/ipt_dccp.c
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
- * iptables module for DCCP protocol header matching
- *
- * (C) 2005 by Harald Welte <laforge@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/spinlock.h>
-#include <net/ip.h>
-#include <linux/dccp.h>
-
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv4/ipt_dccp.h>
-
-#define DCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
-		                  || (!!((invflag) & (option)) ^ (cond)))
-
-static unsigned char *dccp_optbuf;
-static DEFINE_SPINLOCK(dccp_buflock);
-
-static inline int
-dccp_find_option(u_int8_t option,
-		 const struct sk_buff *skb,
-		 const struct dccp_hdr *dh,
-		 int *hotdrop)
-{
-	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
-	unsigned char *op;
-	unsigned int optoff = __dccp_hdr_len(dh);
-	unsigned int optlen = dh->dccph_doff*4 - __dccp_hdr_len(dh);
-	unsigned int i;
-
-	if (dh->dccph_doff * 4 < __dccp_hdr_len(dh)) {
-		*hotdrop = 1;
-		return 0;
-	}
-
-	if (!optlen)
-		return 0;
-
-	spin_lock_bh(&dccp_buflock);
-	op = skb_header_pointer(skb,
-				skb->nh.iph->ihl*4 + optoff,
-				optlen, dccp_optbuf);
-	if (op == NULL) {
-		/* If we don't have the whole header, drop packet. */
-		spin_unlock_bh(&dccp_buflock);
-		*hotdrop = 1;
-		return 0;
-	}
-
-	for (i = 0; i < optlen; ) {
-		if (op[i] == option) {
-			spin_unlock_bh(&dccp_buflock);
-			return 1;
-		}
-
-		if (op[i] < 2) 
-			i++;
-		else 
-			i += op[i+1]?:1;
-	}
-
-	spin_unlock_bh(&dccp_buflock);
-	return 0;
-}
-
-
-static inline int
-match_types(const struct dccp_hdr *dh, u_int16_t typemask)
-{
-	return (typemask & (1 << dh->dccph_type));
-}
-
-static inline int
-match_option(u_int8_t option, const struct sk_buff *skb,
-	     const struct dccp_hdr *dh, int *hotdrop)
-{
-	return dccp_find_option(option, skb, dh, hotdrop);
-}
-
-static int
-match(const struct sk_buff *skb,
-      const struct net_device *in,
-      const struct net_device *out,
-      const void *matchinfo,
-      int offset,
-      int *hotdrop)
-{
-	const struct ipt_dccp_info *info = 
-				(const struct ipt_dccp_info *)matchinfo;
-	struct dccp_hdr _dh, *dh;
-
-	if (offset)
-		return 0;
-	
-	dh = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_dh), &_dh);
-	if (dh == NULL) {
-		*hotdrop = 1;
-		return 0;
-       	}
-
-	return  DCCHECK(((ntohs(dh->dccph_sport) >= info->spts[0]) 
-			&& (ntohs(dh->dccph_sport) <= info->spts[1])), 
-		   	IPT_DCCP_SRC_PORTS, info->flags, info->invflags)
-		&& DCCHECK(((ntohs(dh->dccph_dport) >= info->dpts[0]) 
-			&& (ntohs(dh->dccph_dport) <= info->dpts[1])), 
-			IPT_DCCP_DEST_PORTS, info->flags, info->invflags)
-		&& DCCHECK(match_types(dh, info->typemask),
-			   IPT_DCCP_TYPE, info->flags, info->invflags)
-		&& DCCHECK(match_option(info->option, skb, dh, hotdrop),
-			   IPT_DCCP_OPTION, info->flags, info->invflags);
-}
-
-static int
-checkentry(const char *tablename,
-	   const struct ipt_ip *ip,
-	   void *matchinfo,
-	   unsigned int matchsize,
-	   unsigned int hook_mask)
-{
-	const struct ipt_dccp_info *info;
-
-	info = (const struct ipt_dccp_info *)matchinfo;
-
-	return ip->proto == IPPROTO_DCCP
-		&& !(ip->invflags & IPT_INV_PROTO)
-		&& matchsize == IPT_ALIGN(sizeof(struct ipt_dccp_info))
-		&& !(info->flags & ~IPT_DCCP_VALID_FLAGS)
-		&& !(info->invflags & ~IPT_DCCP_VALID_FLAGS)
-		&& !(info->invflags & ~info->flags);
-}
-
-static struct ipt_match dccp_match = 
-{ 
-	.name 		= "dccp",
-	.match		= &match,
-	.checkentry	= &checkentry,
-	.me 		= THIS_MODULE,
-};
-
-static int __init init(void)
-{
-	int ret;
-
-	/* doff is 8 bits, so the maximum option size is (4*256).  Don't put
-	 * this in BSS since DaveM is worried about locked TLB's for kernel
-	 * BSS. */
-	dccp_optbuf = kmalloc(256 * 4, GFP_KERNEL);
-	if (!dccp_optbuf)
-		return -ENOMEM;
-	ret = ipt_register_match(&dccp_match);
-	if (ret)
-		kfree(dccp_optbuf);
-
-	return ret;
-}
-
-static void __exit fini(void)
-{
-	ipt_unregister_match(&dccp_match);
-	kfree(dccp_optbuf);
-}
-
-module_init(init);
-module_exit(fini);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("Match for DCCP protocol packets");
-
diff --git a/trunk/net/ipv4/netfilter/ipt_hashlimit.c b/trunk/net/ipv4/netfilter/ipt_hashlimit.c
index 2dd1cccbdab9..564b49bfebcf 100644
--- a/trunk/net/ipv4/netfilter/ipt_hashlimit.c
+++ b/trunk/net/ipv4/netfilter/ipt_hashlimit.c
@@ -94,7 +94,7 @@ struct ipt_hashlimit_htable {
 static DEFINE_SPINLOCK(hashlimit_lock);	/* protects htables list */
 static DECLARE_MUTEX(hlimit_mutex);	/* additional checkentry protection */
 static HLIST_HEAD(hashlimit_htables);
-static kmem_cache_t *hashlimit_cachep __read_mostly;
+static kmem_cache_t *hashlimit_cachep;
 
 static inline int dst_cmp(const struct dsthash_ent *ent, struct dsthash_dst *b)
 {
diff --git a/trunk/net/ipv4/netfilter/ipt_mark.c b/trunk/net/ipv4/netfilter/ipt_mark.c
index 00bef6cdd3f8..8955728127b9 100644
--- a/trunk/net/ipv4/netfilter/ipt_mark.c
+++ b/trunk/net/ipv4/netfilter/ipt_mark.c
@@ -37,16 +37,9 @@ checkentry(const char *tablename,
            unsigned int matchsize,
            unsigned int hook_mask)
 {
-	struct ipt_mark_info *minfo = (struct ipt_mark_info *) matchinfo;
-
 	if (matchsize != IPT_ALIGN(sizeof(struct ipt_mark_info)))
 		return 0;
 
-	if (minfo->mark > 0xffffffff || minfo->mask > 0xffffffff) {
-		printk(KERN_WARNING "mark: only supports 32bit mark\n");
-		return 0;
-	}
-
 	return 1;
 }
 
diff --git a/trunk/net/ipv4/netfilter/ipt_owner.c b/trunk/net/ipv4/netfilter/ipt_owner.c
index c1889f88262b..3b9065e06381 100644
--- a/trunk/net/ipv4/netfilter/ipt_owner.c
+++ b/trunk/net/ipv4/netfilter/ipt_owner.c
@@ -20,6 +20,106 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
 MODULE_DESCRIPTION("iptables owner match");
 
+static int
+match_comm(const struct sk_buff *skb, const char *comm)
+{
+	struct task_struct *g, *p;
+	struct files_struct *files;
+	int i;
+
+	read_lock(&tasklist_lock);
+	do_each_thread(g, p) {
+		if(strncmp(p->comm, comm, sizeof(p->comm)))
+			continue;
+
+		task_lock(p);
+		files = p->files;
+		if(files) {
+			spin_lock(&files->file_lock);
+			for (i=0; i < files->max_fds; i++) {
+				if (fcheck_files(files, i) ==
+				    skb->sk->sk_socket->file) {
+					spin_unlock(&files->file_lock);
+					task_unlock(p);
+					read_unlock(&tasklist_lock);
+					return 1;
+				}
+			}
+			spin_unlock(&files->file_lock);
+		}
+		task_unlock(p);
+	} while_each_thread(g, p);
+	read_unlock(&tasklist_lock);
+	return 0;
+}
+
+static int
+match_pid(const struct sk_buff *skb, pid_t pid)
+{
+	struct task_struct *p;
+	struct files_struct *files;
+	int i;
+
+	read_lock(&tasklist_lock);
+	p = find_task_by_pid(pid);
+	if (!p)
+		goto out;
+	task_lock(p);
+	files = p->files;
+	if(files) {
+		spin_lock(&files->file_lock);
+		for (i=0; i < files->max_fds; i++) {
+			if (fcheck_files(files, i) ==
+			    skb->sk->sk_socket->file) {
+				spin_unlock(&files->file_lock);
+				task_unlock(p);
+				read_unlock(&tasklist_lock);
+				return 1;
+			}
+		}
+		spin_unlock(&files->file_lock);
+	}
+	task_unlock(p);
+out:
+	read_unlock(&tasklist_lock);
+	return 0;
+}
+
+static int
+match_sid(const struct sk_buff *skb, pid_t sid)
+{
+	struct task_struct *g, *p;
+	struct file *file = skb->sk->sk_socket->file;
+	int i, found=0;
+
+	read_lock(&tasklist_lock);
+	do_each_thread(g, p) {
+		struct files_struct *files;
+		if (p->signal->session != sid)
+			continue;
+
+		task_lock(p);
+		files = p->files;
+		if (files) {
+			spin_lock(&files->file_lock);
+			for (i=0; i < files->max_fds; i++) {
+				if (fcheck_files(files, i) == file) {
+					found = 1;
+					break;
+				}
+			}
+			spin_unlock(&files->file_lock);
+		}
+		task_unlock(p);
+		if (found)
+			goto out;
+	} while_each_thread(g, p);
+out:
+	read_unlock(&tasklist_lock);
+
+	return found;
+}
+
 static int
 match(const struct sk_buff *skb,
       const struct net_device *in,
@@ -45,6 +145,24 @@ match(const struct sk_buff *skb,
 			return 0;
 	}
 
+	if(info->match & IPT_OWNER_PID) {
+		if (!match_pid(skb, info->pid) ^
+		    !!(info->invert & IPT_OWNER_PID))
+			return 0;
+	}
+
+	if(info->match & IPT_OWNER_SID) {
+		if (!match_sid(skb, info->sid) ^
+		    !!(info->invert & IPT_OWNER_SID))
+			return 0;
+	}
+
+	if(info->match & IPT_OWNER_COMM) {
+		if (!match_comm(skb, info->comm) ^
+		    !!(info->invert & IPT_OWNER_COMM))
+			return 0;
+	}
+
 	return 1;
 }
 
@@ -55,8 +173,6 @@ checkentry(const char *tablename,
            unsigned int matchsize,
            unsigned int hook_mask)
 {
-	const struct ipt_owner_info *info = matchinfo;
-
         if (hook_mask
             & ~((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING))) {
                 printk("ipt_owner: only valid for LOCAL_OUT or POST_ROUTING.\n");
@@ -68,13 +184,15 @@ checkentry(const char *tablename,
 		       IPT_ALIGN(sizeof(struct ipt_owner_info)));
 		return 0;
 	}
-
-	if (info->match & (IPT_OWNER_PID|IPT_OWNER_SID|IPT_OWNER_COMM)) {
-		printk("ipt_owner: pid, sid and command matching "
-		       "not supported anymore\n");
+#ifdef CONFIG_SMP
+	/* files->file_lock can not be used in a BH */
+	if (((struct ipt_owner_info *)matchinfo)->match
+	    & (IPT_OWNER_PID|IPT_OWNER_SID|IPT_OWNER_COMM)) {
+		printk("ipt_owner: pid, sid and command matching is broken "
+		       "on SMP.\n");
 		return 0;
 	}
-
+#endif
 	return 1;
 }
 
diff --git a/trunk/net/ipv4/netfilter/ipt_string.c b/trunk/net/ipv4/netfilter/ipt_string.c
deleted file mode 100644
index b5def204d798..000000000000
--- a/trunk/net/ipv4/netfilter/ipt_string.c
+++ /dev/null
@@ -1,91 +0,0 @@
-/* String matching match for iptables
- * 
- * (C) 2005 Pablo Neira Ayuso <pablo@eurodev.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/skbuff.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv4/ipt_string.h>
-#include <linux/textsearch.h>
-
-MODULE_AUTHOR("Pablo Neira Ayuso <pablo@eurodev.net>");
-MODULE_DESCRIPTION("IP tables string match module");
-MODULE_LICENSE("GPL");
-
-static int match(const struct sk_buff *skb,
-		 const struct net_device *in,
-		 const struct net_device *out,
-		 const void *matchinfo,
-		 int offset,
-		 int *hotdrop)
-{
-	struct ts_state state;
-	struct ipt_string_info *conf = (struct ipt_string_info *) matchinfo;
-
-	memset(&state, 0, sizeof(struct ts_state));
-
-	return (skb_find_text((struct sk_buff *)skb, conf->from_offset, 
-			     conf->to_offset, conf->config, &state) 
-			     != UINT_MAX) && !conf->invert;
-}
-
-#define STRING_TEXT_PRIV(m) ((struct ipt_string_info *) m)
-
-static int checkentry(const char *tablename,
-		      const struct ipt_ip *ip,
-		      void *matchinfo,
-		      unsigned int matchsize,
-		      unsigned int hook_mask)
-{
-	struct ipt_string_info *conf = matchinfo;
-	struct ts_config *ts_conf;
-
-	if (matchsize != IPT_ALIGN(sizeof(struct ipt_string_info)))
-		return 0;
-
-	/* Damn, can't handle this case properly with iptables... */
-	if (conf->from_offset > conf->to_offset)
-		return 0;
-
-	ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen,
-				     GFP_KERNEL, TS_AUTOLOAD);
-	if (IS_ERR(ts_conf))
-		return 0;
-
-	conf->config = ts_conf;
-
-	return 1;
-}
-
-static void destroy(void *matchinfo, unsigned int matchsize)
-{
-	textsearch_destroy(STRING_TEXT_PRIV(matchinfo)->config);
-}
-
-static struct ipt_match string_match = {
-	.name 		= "string",
-	.match 		= match,
-	.checkentry	= checkentry,
-	.destroy 	= destroy,
-	.me 		= THIS_MODULE
-};
-
-static int __init init(void)
-{
-	return ipt_register_match(&string_match);
-}
-
-static void __exit fini(void)
-{
-	ipt_unregister_match(&string_match);
-}
-
-module_init(init);
-module_exit(fini);
diff --git a/trunk/net/ipv4/proc.c b/trunk/net/ipv4/proc.c
index f7943ba1f43c..912bbcc7f415 100644
--- a/trunk/net/ipv4/proc.c
+++ b/trunk/net/ipv4/proc.c
@@ -59,10 +59,13 @@ static int fold_prot_inuse(struct proto *proto)
  */
 static int sockstat_seq_show(struct seq_file *seq, void *v)
 {
+	/* From net/socket.c */
+	extern void socket_seq_show(struct seq_file *seq);
+
 	socket_seq_show(seq);
 	seq_printf(seq, "TCP: inuse %d orphan %d tw %d alloc %d mem %d\n",
 		   fold_prot_inuse(&tcp_prot), atomic_read(&tcp_orphan_count),
-		   tcp_death_row.tw_count, atomic_read(&tcp_sockets_allocated),
+		   tcp_tw_count, atomic_read(&tcp_sockets_allocated),
 		   atomic_read(&tcp_memory_allocated));
 	seq_printf(seq, "UDP: inuse %d\n", fold_prot_inuse(&udp_prot));
 	seq_printf(seq, "RAW: inuse %d\n", fold_prot_inuse(&raw_prot));
diff --git a/trunk/net/ipv4/protocol.c b/trunk/net/ipv4/protocol.c
index 291831e792af..0db405a869f2 100644
--- a/trunk/net/ipv4/protocol.c
+++ b/trunk/net/ipv4/protocol.c
@@ -40,6 +40,7 @@
 #include <linux/timer.h>
 #include <net/ip.h>
 #include <net/protocol.h>
+#include <net/tcp.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <net/icmp.h>
diff --git a/trunk/net/ipv4/raw.c b/trunk/net/ipv4/raw.c
index 304bb0a1d4f0..d1835b1bc8c4 100644
--- a/trunk/net/ipv4/raw.c
+++ b/trunk/net/ipv4/raw.c
@@ -59,6 +59,7 @@
 #include <linux/netdevice.h>
 #include <linux/in_route.h>
 #include <linux/route.h>
+#include <linux/tcp.h>
 #include <linux/skbuff.h>
 #include <net/dst.h>
 #include <net/sock.h>
@@ -70,7 +71,6 @@
 #include <net/udp.h>
 #include <net/raw.h>
 #include <net/snmp.h>
-#include <net/tcp_states.h>
 #include <net/inet_common.h>
 #include <net/checksum.h>
 #include <net/xfrm.h>
@@ -150,11 +150,10 @@ static __inline__ int icmp_filter(struct sock *sk, struct sk_buff *skb)
  * RFC 1122: SHOULD pass TOS value up to the transport layer.
  * -> It does. And not only TOS, but all IP header.
  */
-int raw_v4_input(struct sk_buff *skb, struct iphdr *iph, int hash)
+void raw_v4_input(struct sk_buff *skb, struct iphdr *iph, int hash)
 {
 	struct sock *sk;
 	struct hlist_head *head;
-	int delivered = 0;
 
 	read_lock(&raw_v4_lock);
 	head = &raw_v4_htable[hash];
@@ -165,7 +164,6 @@ int raw_v4_input(struct sk_buff *skb, struct iphdr *iph, int hash)
 			     skb->dev->ifindex);
 
 	while (sk) {
-		delivered = 1;
 		if (iph->protocol != IPPROTO_ICMP || !icmp_filter(sk, skb)) {
 			struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
 
@@ -179,7 +177,6 @@ int raw_v4_input(struct sk_buff *skb, struct iphdr *iph, int hash)
 	}
 out:
 	read_unlock(&raw_v4_lock);
-	return delivered;
 }
 
 void raw_err (struct sock *sk, struct sk_buff *skb, u32 info)
diff --git a/trunk/net/ipv4/route.c b/trunk/net/ipv4/route.c
index 8c0b14e3beec..d675ff80b04d 100644
--- a/trunk/net/ipv4/route.c
+++ b/trunk/net/ipv4/route.c
@@ -240,9 +240,7 @@ static unsigned			rt_hash_mask;
 static int			rt_hash_log;
 static unsigned int		rt_hash_rnd;
 
-static struct rt_cache_stat *rt_cache_stat;
-#define RT_CACHE_STAT_INC(field)					  \
-		(per_cpu_ptr(rt_cache_stat, raw_smp_processor_id())->field++)
+struct rt_cache_stat *rt_cache_stat;
 
 static int rt_intern_hash(unsigned hash, struct rtable *rth,
 				struct rtable **res);
@@ -2602,8 +2600,6 @@ int __ip_route_output_key(struct rtable **rp, const struct flowi *flp)
 	return ip_route_output_slow(rp, flp);
 }
 
-EXPORT_SYMBOL_GPL(__ip_route_output_key);
-
 int ip_route_output_flow(struct rtable **rp, struct flowi *flp, struct sock *sk, int flags)
 {
 	int err;
@@ -2622,8 +2618,6 @@ int ip_route_output_flow(struct rtable **rp, struct flowi *flp, struct sock *sk,
 	return 0;
 }
 
-EXPORT_SYMBOL_GPL(ip_route_output_flow);
-
 int ip_route_output_key(struct rtable **rp, struct flowi *flp)
 {
 	return ip_route_output_flow(rp, flp, NULL, 0);
diff --git a/trunk/net/ipv4/syncookies.c b/trunk/net/ipv4/syncookies.c
index a34e60ea48a1..72d014442185 100644
--- a/trunk/net/ipv4/syncookies.c
+++ b/trunk/net/ipv4/syncookies.c
@@ -169,6 +169,8 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
 	return mssind < NUM_MSS ? msstab[mssind] + 1 : 0;
 }
 
+extern struct request_sock_ops tcp_request_sock_ops;
+
 static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
 					   struct request_sock *req,
 					   struct dst_entry *dst)
@@ -178,7 +180,7 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
 
 	child = tp->af_specific->syn_recv_sock(sk, skb, req, dst);
 	if (child)
-		inet_csk_reqsk_queue_add(sk, req, child);
+		tcp_acceptq_queue(sk, req, child);
 	else
 		reqsk_free(req);
 
diff --git a/trunk/net/ipv4/sysctl_net_ipv4.c b/trunk/net/ipv4/sysctl_net_ipv4.c
index 652685623519..e32894532416 100644
--- a/trunk/net/ipv4/sysctl_net_ipv4.c
+++ b/trunk/net/ipv4/sysctl_net_ipv4.c
@@ -11,9 +11,7 @@
 #include <linux/module.h>
 #include <linux/sysctl.h>
 #include <linux/config.h>
-#include <linux/igmp.h>
 #include <net/snmp.h>
-#include <net/icmp.h>
 #include <net/ip.h>
 #include <net/route.h>
 #include <net/tcp.h>
@@ -21,6 +19,36 @@
 /* From af_inet.c */
 extern int sysctl_ip_nonlocal_bind;
 
+/* From icmp.c */
+extern int sysctl_icmp_echo_ignore_all;
+extern int sysctl_icmp_echo_ignore_broadcasts;
+extern int sysctl_icmp_ignore_bogus_error_responses;
+extern int sysctl_icmp_errors_use_inbound_ifaddr;
+
+/* From ip_fragment.c */
+extern int sysctl_ipfrag_low_thresh;
+extern int sysctl_ipfrag_high_thresh; 
+extern int sysctl_ipfrag_time;
+extern int sysctl_ipfrag_secret_interval;
+
+/* From ip_output.c */
+extern int sysctl_ip_dynaddr;
+
+/* From icmp.c */
+extern int sysctl_icmp_ratelimit;
+extern int sysctl_icmp_ratemask;
+
+/* From igmp.c */
+extern int sysctl_igmp_max_memberships;
+extern int sysctl_igmp_max_msf;
+
+/* From inetpeer.c */
+extern int inet_peer_threshold;
+extern int inet_peer_minttl;
+extern int inet_peer_maxttl;
+extern int inet_peer_gc_mintime;
+extern int inet_peer_gc_maxtime;
+
 #ifdef CONFIG_SYSCTL
 static int tcp_retr1_max = 255; 
 static int ip_local_port_range_min[] = { 1, 1 };
@@ -29,6 +57,8 @@ static int ip_local_port_range_max[] = { 65535, 65535 };
 
 struct ipv4_config ipv4_config;
 
+extern ctl_table ipv4_route_table[];
+
 #ifdef CONFIG_SYSCTL
 
 static
@@ -106,11 +136,10 @@ static int proc_tcp_congestion_control(ctl_table *ctl, int write, struct file *
 	return ret;
 }
 
-static int sysctl_tcp_congestion_control(ctl_table *table, int __user *name,
-					 int nlen, void __user *oldval,
-					 size_t __user *oldlenp,
-					 void __user *newval, size_t newlen,
-					 void **context)
+int sysctl_tcp_congestion_control(ctl_table *table, int __user *name, int nlen,
+				  void __user *oldval, size_t __user *oldlenp,
+				  void __user *newval, size_t newlen,
+				  void **context)
 {
 	char val[TCP_CA_NAME_MAX];
 	ctl_table tbl = {
@@ -230,7 +259,7 @@ ctl_table ipv4_table[] = {
 	{
 		.ctl_name	= NET_TCP_MAX_TW_BUCKETS,
 		.procname	= "tcp_max_tw_buckets",
-		.data		= &tcp_death_row.sysctl_max_tw_buckets,
+		.data		= &sysctl_tcp_max_tw_buckets,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= &proc_dointvec
@@ -334,7 +363,7 @@ ctl_table ipv4_table[] = {
 	{
 		.ctl_name	= NET_TCP_TW_RECYCLE,
 		.procname	= "tcp_tw_recycle",
-		.data		= &tcp_death_row.sysctl_tw_recycle,
+		.data		= &sysctl_tcp_tw_recycle,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= &proc_dointvec
diff --git a/trunk/net/ipv4/tcp.c b/trunk/net/ipv4/tcp.c
index 02fdda68718d..69b1fcf70077 100644
--- a/trunk/net/ipv4/tcp.c
+++ b/trunk/net/ipv4/tcp.c
@@ -269,11 +269,12 @@
 
 int sysctl_tcp_fin_timeout = TCP_FIN_TIMEOUT;
 
-DEFINE_SNMP_STAT(struct tcp_mib, tcp_statistics) __read_mostly;
+DEFINE_SNMP_STAT(struct tcp_mib, tcp_statistics);
 
-atomic_t tcp_orphan_count = ATOMIC_INIT(0);
+kmem_cache_t *tcp_bucket_cachep;
+kmem_cache_t *tcp_timewait_cachep;
 
-EXPORT_SYMBOL_GPL(tcp_orphan_count);
+atomic_t tcp_orphan_count = ATOMIC_INIT(0);
 
 int sysctl_tcp_mem[3];
 int sysctl_tcp_wmem[3] = { 4 * 1024, 16 * 1024, 128 * 1024 };
@@ -309,6 +310,15 @@ void tcp_enter_memory_pressure(void)
 
 EXPORT_SYMBOL(tcp_enter_memory_pressure);
 
+/*
+ * LISTEN is a special case for poll..
+ */
+static __inline__ unsigned int tcp_listen_poll(struct sock *sk,
+					       poll_table *wait)
+{
+	return !reqsk_queue_empty(&tcp_sk(sk)->accept_queue) ? (POLLIN | POLLRDNORM) : 0;
+}
+
 /*
  *	Wait for a TCP event.
  *
@@ -324,7 +334,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
 
 	poll_wait(file, sk->sk_sleep, wait);
 	if (sk->sk_state == TCP_LISTEN)
-		return inet_csk_listen_poll(sk);
+		return tcp_listen_poll(sk, wait);
 
 	/* Socket is not locked. We are protected from async events
 	   by poll logic and correct handling of state changes
@@ -447,6 +457,109 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 	return put_user(answ, (int __user *)arg);
 }
 
+
+int tcp_listen_start(struct sock *sk)
+{
+	struct inet_sock *inet = inet_sk(sk);
+	struct tcp_sock *tp = tcp_sk(sk);
+	int rc = reqsk_queue_alloc(&tp->accept_queue, TCP_SYNQ_HSIZE);
+
+	if (rc != 0)
+		return rc;
+
+	sk->sk_max_ack_backlog = 0;
+	sk->sk_ack_backlog = 0;
+	tcp_delack_init(tp);
+
+	/* There is race window here: we announce ourselves listening,
+	 * but this transition is still not validated by get_port().
+	 * It is OK, because this socket enters to hash table only
+	 * after validation is complete.
+	 */
+	sk->sk_state = TCP_LISTEN;
+	if (!sk->sk_prot->get_port(sk, inet->num)) {
+		inet->sport = htons(inet->num);
+
+		sk_dst_reset(sk);
+		sk->sk_prot->hash(sk);
+
+		return 0;
+	}
+
+	sk->sk_state = TCP_CLOSE;
+	reqsk_queue_destroy(&tp->accept_queue);
+	return -EADDRINUSE;
+}
+
+/*
+ *	This routine closes sockets which have been at least partially
+ *	opened, but not yet accepted.
+ */
+
+static void tcp_listen_stop (struct sock *sk)
+{
+	struct tcp_sock *tp = tcp_sk(sk);
+	struct listen_sock *lopt;
+	struct request_sock *acc_req;
+	struct request_sock *req;
+	int i;
+
+	tcp_delete_keepalive_timer(sk);
+
+	/* make all the listen_opt local to us */
+	lopt = reqsk_queue_yank_listen_sk(&tp->accept_queue);
+	acc_req = reqsk_queue_yank_acceptq(&tp->accept_queue);
+
+	if (lopt->qlen) {
+		for (i = 0; i < TCP_SYNQ_HSIZE; i++) {
+			while ((req = lopt->syn_table[i]) != NULL) {
+				lopt->syn_table[i] = req->dl_next;
+				lopt->qlen--;
+				reqsk_free(req);
+
+		/* Following specs, it would be better either to send FIN
+		 * (and enter FIN-WAIT-1, it is normal close)
+		 * or to send active reset (abort).
+		 * Certainly, it is pretty dangerous while synflood, but it is
+		 * bad justification for our negligence 8)
+		 * To be honest, we are not able to make either
+		 * of the variants now.			--ANK
+		 */
+			}
+		}
+	}
+	BUG_TRAP(!lopt->qlen);
+
+	kfree(lopt);
+
+	while ((req = acc_req) != NULL) {
+		struct sock *child = req->sk;
+
+		acc_req = req->dl_next;
+
+		local_bh_disable();
+		bh_lock_sock(child);
+		BUG_TRAP(!sock_owned_by_user(child));
+		sock_hold(child);
+
+		tcp_disconnect(child, O_NONBLOCK);
+
+		sock_orphan(child);
+
+		atomic_inc(&tcp_orphan_count);
+
+		tcp_destroy_sock(child);
+
+		bh_unlock_sock(child);
+		local_bh_enable();
+		sock_put(child);
+
+		sk_acceptq_removed(sk);
+		__reqsk_free(req);
+	}
+	BUG_TRAP(!sk->sk_ack_backlog);
+}
+
 static inline void tcp_mark_push(struct tcp_sock *tp, struct sk_buff *skb)
 {
 	TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
@@ -862,7 +975,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 	if (!skb->len) {
 		if (sk->sk_send_head == skb)
 			sk->sk_send_head = NULL;
-		__skb_unlink(skb, &sk->sk_write_queue);
+		__skb_unlink(skb, skb->list);
 		sk_stream_free_skb(sk, skb);
 	}
 
@@ -944,21 +1057,20 @@ static void cleanup_rbuf(struct sock *sk, int copied)
 	BUG_TRAP(!skb || before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
 #endif
 
-	if (inet_csk_ack_scheduled(sk)) {
-		const struct inet_connection_sock *icsk = inet_csk(sk);
+	if (tcp_ack_scheduled(tp)) {
 		   /* Delayed ACKs frequently hit locked sockets during bulk
 		    * receive. */
-		if (icsk->icsk_ack.blocked ||
+		if (tp->ack.blocked ||
 		    /* Once-per-two-segments ACK was not sent by tcp_input.c */
-		    tp->rcv_nxt - tp->rcv_wup > icsk->icsk_ack.rcv_mss ||
+		    tp->rcv_nxt - tp->rcv_wup > tp->ack.rcv_mss ||
 		    /*
 		     * If this read emptied read buffer, we send ACK, if
 		     * connection is not bidirectional, user drained
 		     * receive buffer and there was a small segment
 		     * in queue.
 		     */
-		    (copied > 0 && (icsk->icsk_ack.pending & ICSK_ACK_PUSHED) &&
-		     !icsk->icsk_ack.pingpong && !atomic_read(&sk->sk_rmem_alloc)))
+		    (copied > 0 && (tp->ack.pending & TCP_ACK_PUSHED) &&
+		     !tp->ack.pingpong && !atomic_read(&sk->sk_rmem_alloc)))
 			time_to_ack = 1;
 	}
 
@@ -1460,6 +1572,40 @@ void tcp_shutdown(struct sock *sk, int how)
 	}
 }
 
+/*
+ * At this point, there should be no process reference to this
+ * socket, and thus no user references at all.  Therefore we
+ * can assume the socket waitqueue is inactive and nobody will
+ * try to jump onto it.
+ */
+void tcp_destroy_sock(struct sock *sk)
+{
+	BUG_TRAP(sk->sk_state == TCP_CLOSE);
+	BUG_TRAP(sock_flag(sk, SOCK_DEAD));
+
+	/* It cannot be in hash table! */
+	BUG_TRAP(sk_unhashed(sk));
+
+	/* If it has not 0 inet_sk(sk)->num, it must be bound */
+	BUG_TRAP(!inet_sk(sk)->num || tcp_sk(sk)->bind_hash);
+
+	sk->sk_prot->destroy(sk);
+
+	sk_stream_kill_queues(sk);
+
+	xfrm_sk_free_policy(sk);
+
+#ifdef INET_REFCNT_DEBUG
+	if (atomic_read(&sk->sk_refcnt) != 1) {
+		printk(KERN_DEBUG "Destruction TCP %p delayed, c=%d\n",
+		       sk, atomic_read(&sk->sk_refcnt));
+	}
+#endif
+
+	atomic_dec(&tcp_orphan_count);
+	sock_put(sk);
+}
+
 void tcp_close(struct sock *sk, long timeout)
 {
 	struct sk_buff *skb;
@@ -1472,7 +1618,7 @@ void tcp_close(struct sock *sk, long timeout)
 		tcp_set_state(sk, TCP_CLOSE);
 
 		/* Special case. */
-		inet_csk_listen_stop(sk);
+		tcp_listen_stop(sk);
 
 		goto adjudge_to_death;
 	}
@@ -1575,12 +1721,12 @@ void tcp_close(struct sock *sk, long timeout)
 			tcp_send_active_reset(sk, GFP_ATOMIC);
 			NET_INC_STATS_BH(LINUX_MIB_TCPABORTONLINGER);
 		} else {
-			const int tmo = tcp_fin_time(sk);
+			int tmo = tcp_fin_time(tp);
 
 			if (tmo > TCP_TIMEWAIT_LEN) {
-				inet_csk_reset_keepalive_timer(sk, tcp_fin_time(sk));
+				tcp_reset_keepalive_timer(sk, tcp_fin_time(tp));
 			} else {
-				atomic_inc(sk->sk_prot->orphan_count);
+				atomic_inc(&tcp_orphan_count);
 				tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
 				goto out;
 			}
@@ -1588,7 +1734,7 @@ void tcp_close(struct sock *sk, long timeout)
 	}
 	if (sk->sk_state != TCP_CLOSE) {
 		sk_stream_mem_reclaim(sk);
-		if (atomic_read(sk->sk_prot->orphan_count) > sysctl_tcp_max_orphans ||
+		if (atomic_read(&tcp_orphan_count) > sysctl_tcp_max_orphans ||
 		    (sk->sk_wmem_queued > SOCK_MIN_SNDBUF &&
 		     atomic_read(&tcp_memory_allocated) > sysctl_tcp_mem[2])) {
 			if (net_ratelimit())
@@ -1599,10 +1745,10 @@ void tcp_close(struct sock *sk, long timeout)
 			NET_INC_STATS_BH(LINUX_MIB_TCPABORTONMEMORY);
 		}
 	}
-	atomic_inc(sk->sk_prot->orphan_count);
+	atomic_inc(&tcp_orphan_count);
 
 	if (sk->sk_state == TCP_CLOSE)
-		inet_csk_destroy_sock(sk);
+		tcp_destroy_sock(sk);
 	/* Otherwise, socket is reprieved until protocol close. */
 
 out:
@@ -1623,7 +1769,6 @@ static inline int tcp_need_reset(int state)
 int tcp_disconnect(struct sock *sk, int flags)
 {
 	struct inet_sock *inet = inet_sk(sk);
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	int err = 0;
 	int old_state = sk->sk_state;
@@ -1633,7 +1778,7 @@ int tcp_disconnect(struct sock *sk, int flags)
 
 	/* ABORT function of RFC793 */
 	if (old_state == TCP_LISTEN) {
-		inet_csk_listen_stop(sk);
+		tcp_listen_stop(sk);
 	} else if (tcp_need_reset(old_state) ||
 		   (tp->snd_nxt != tp->write_seq &&
 		    (1 << old_state) & (TCPF_CLOSING | TCPF_LAST_ACK))) {
@@ -1660,26 +1805,118 @@ int tcp_disconnect(struct sock *sk, int flags)
 	tp->srtt = 0;
 	if ((tp->write_seq += tp->max_window + 2) == 0)
 		tp->write_seq = 1;
-	icsk->icsk_backoff = 0;
+	tp->backoff = 0;
 	tp->snd_cwnd = 2;
-	icsk->icsk_probes_out = 0;
+	tp->probes_out = 0;
 	tp->packets_out = 0;
 	tp->snd_ssthresh = 0x7fffffff;
 	tp->snd_cwnd_cnt = 0;
-	tcp_set_ca_state(sk, TCP_CA_Open);
+	tcp_set_ca_state(tp, TCP_CA_Open);
 	tcp_clear_retrans(tp);
-	inet_csk_delack_init(sk);
+	tcp_delack_init(tp);
 	sk->sk_send_head = NULL;
 	tp->rx_opt.saw_tstamp = 0;
 	tcp_sack_reset(&tp->rx_opt);
 	__sk_dst_reset(sk);
 
-	BUG_TRAP(!inet->num || icsk->icsk_bind_hash);
+	BUG_TRAP(!inet->num || tp->bind_hash);
 
 	sk->sk_error_report(sk);
 	return err;
 }
 
+/*
+ *	Wait for an incoming connection, avoid race
+ *	conditions. This must be called with the socket locked.
+ */
+static int wait_for_connect(struct sock *sk, long timeo)
+{
+	struct tcp_sock *tp = tcp_sk(sk);
+	DEFINE_WAIT(wait);
+	int err;
+
+	/*
+	 * True wake-one mechanism for incoming connections: only
+	 * one process gets woken up, not the 'whole herd'.
+	 * Since we do not 'race & poll' for established sockets
+	 * anymore, the common case will execute the loop only once.
+	 *
+	 * Subtle issue: "add_wait_queue_exclusive()" will be added
+	 * after any current non-exclusive waiters, and we know that
+	 * it will always _stay_ after any new non-exclusive waiters
+	 * because all non-exclusive waiters are added at the
+	 * beginning of the wait-queue. As such, it's ok to "drop"
+	 * our exclusiveness temporarily when we get woken up without
+	 * having to remove and re-insert us on the wait queue.
+	 */
+	for (;;) {
+		prepare_to_wait_exclusive(sk->sk_sleep, &wait,
+					  TASK_INTERRUPTIBLE);
+		release_sock(sk);
+		if (reqsk_queue_empty(&tp->accept_queue))
+			timeo = schedule_timeout(timeo);
+		lock_sock(sk);
+		err = 0;
+		if (!reqsk_queue_empty(&tp->accept_queue))
+			break;
+		err = -EINVAL;
+		if (sk->sk_state != TCP_LISTEN)
+			break;
+		err = sock_intr_errno(timeo);
+		if (signal_pending(current))
+			break;
+		err = -EAGAIN;
+		if (!timeo)
+			break;
+	}
+	finish_wait(sk->sk_sleep, &wait);
+	return err;
+}
+
+/*
+ *	This will accept the next outstanding connection.
+ */
+
+struct sock *tcp_accept(struct sock *sk, int flags, int *err)
+{
+	struct tcp_sock *tp = tcp_sk(sk);
+	struct sock *newsk;
+	int error;
+
+	lock_sock(sk);
+
+	/* We need to make sure that this socket is listening,
+	 * and that it has something pending.
+	 */
+	error = -EINVAL;
+	if (sk->sk_state != TCP_LISTEN)
+		goto out_err;
+
+	/* Find already established connection */
+	if (reqsk_queue_empty(&tp->accept_queue)) {
+		long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
+
+		/* If this is a non blocking socket don't sleep */
+		error = -EAGAIN;
+		if (!timeo)
+			goto out_err;
+
+		error = wait_for_connect(sk, timeo);
+		if (error)
+			goto out_err;
+	}
+
+	newsk = reqsk_queue_get_child(&tp->accept_queue, sk);
+	BUG_TRAP(newsk->sk_state != TCP_SYN_RECV);
+out:
+	release_sock(sk);
+	return newsk;
+out_err:
+	newsk = NULL;
+	*err = error;
+	goto out;
+}
+
 /*
  *	Socket option code for TCP.
  */
@@ -1687,7 +1924,6 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		   int optlen)
 {
 	struct tcp_sock *tp = tcp_sk(sk);
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	int val;
 	int err = 0;
 
@@ -1709,7 +1945,7 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		name[val] = 0;
 
 		lock_sock(sk);
-		err = tcp_set_congestion_control(sk, name);
+		err = tcp_set_congestion_control(tp, name);
 		release_sock(sk);
 		return err;
 	}
@@ -1786,7 +2022,7 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 					elapsed = tp->keepalive_time - elapsed;
 				else
 					elapsed = 0;
-				inet_csk_reset_keepalive_timer(sk, elapsed);
+				tcp_reset_keepalive_timer(sk, elapsed);
 			}
 		}
 		break;
@@ -1806,7 +2042,7 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		if (val < 1 || val > MAX_TCP_SYNCNT)
 			err = -EINVAL;
 		else
-			icsk->icsk_syn_retries = val;
+			tp->syn_retries = val;
 		break;
 
 	case TCP_LINGER2:
@@ -1819,15 +2055,15 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		break;
 
 	case TCP_DEFER_ACCEPT:
-		icsk->icsk_accept_queue.rskq_defer_accept = 0;
+		tp->defer_accept = 0;
 		if (val > 0) {
 			/* Translate value in seconds to number of
 			 * retransmits */
-			while (icsk->icsk_accept_queue.rskq_defer_accept < 32 &&
+			while (tp->defer_accept < 32 &&
 			       val > ((TCP_TIMEOUT_INIT / HZ) <<
-				       icsk->icsk_accept_queue.rskq_defer_accept))
-				icsk->icsk_accept_queue.rskq_defer_accept++;
-			icsk->icsk_accept_queue.rskq_defer_accept++;
+				       tp->defer_accept))
+				tp->defer_accept++;
+			tp->defer_accept++;
 		}
 		break;
 
@@ -1845,16 +2081,16 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 
 	case TCP_QUICKACK:
 		if (!val) {
-			icsk->icsk_ack.pingpong = 1;
+			tp->ack.pingpong = 1;
 		} else {
-			icsk->icsk_ack.pingpong = 0;
+			tp->ack.pingpong = 0;
 			if ((1 << sk->sk_state) &
 			    (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT) &&
-			    inet_csk_ack_scheduled(sk)) {
-				icsk->icsk_ack.pending |= ICSK_ACK_PUSHED;
+			    tcp_ack_scheduled(tp)) {
+				tp->ack.pending |= TCP_ACK_PUSHED;
 				cleanup_rbuf(sk, 1);
 				if (!(val & 1))
-					icsk->icsk_ack.pingpong = 1;
+					tp->ack.pingpong = 1;
 			}
 		}
 		break;
@@ -1871,16 +2107,15 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
 void tcp_get_info(struct sock *sk, struct tcp_info *info)
 {
 	struct tcp_sock *tp = tcp_sk(sk);
-	const struct inet_connection_sock *icsk = inet_csk(sk);
 	u32 now = tcp_time_stamp;
 
 	memset(info, 0, sizeof(*info));
 
 	info->tcpi_state = sk->sk_state;
-	info->tcpi_ca_state = icsk->icsk_ca_state;
-	info->tcpi_retransmits = icsk->icsk_retransmits;
-	info->tcpi_probes = icsk->icsk_probes_out;
-	info->tcpi_backoff = icsk->icsk_backoff;
+	info->tcpi_ca_state = tp->ca_state;
+	info->tcpi_retransmits = tp->retransmits;
+	info->tcpi_probes = tp->probes_out;
+	info->tcpi_backoff = tp->backoff;
 
 	if (tp->rx_opt.tstamp_ok)
 		info->tcpi_options |= TCPI_OPT_TIMESTAMPS;
@@ -1895,10 +2130,10 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
 	if (tp->ecn_flags&TCP_ECN_OK)
 		info->tcpi_options |= TCPI_OPT_ECN;
 
-	info->tcpi_rto = jiffies_to_usecs(icsk->icsk_rto);
-	info->tcpi_ato = jiffies_to_usecs(icsk->icsk_ack.ato);
+	info->tcpi_rto = jiffies_to_usecs(tp->rto);
+	info->tcpi_ato = jiffies_to_usecs(tp->ack.ato);
 	info->tcpi_snd_mss = tp->mss_cache;
-	info->tcpi_rcv_mss = icsk->icsk_ack.rcv_mss;
+	info->tcpi_rcv_mss = tp->ack.rcv_mss;
 
 	info->tcpi_unacked = tp->packets_out;
 	info->tcpi_sacked = tp->sacked_out;
@@ -1907,7 +2142,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
 	info->tcpi_fackets = tp->fackets_out;
 
 	info->tcpi_last_data_sent = jiffies_to_msecs(now - tp->lsndtime);
-	info->tcpi_last_data_recv = jiffies_to_msecs(now - icsk->icsk_ack.lrcvtime);
+	info->tcpi_last_data_recv = jiffies_to_msecs(now - tp->ack.lrcvtime);
 	info->tcpi_last_ack_recv = jiffies_to_msecs(now - tp->rcv_tstamp);
 
 	info->tcpi_pmtu = tp->pmtu_cookie;
@@ -1930,7 +2165,6 @@ EXPORT_SYMBOL_GPL(tcp_get_info);
 int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		   int __user *optlen)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	int val, len;
 
@@ -1968,7 +2202,7 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		val = tp->keepalive_probes ? : sysctl_tcp_keepalive_probes;
 		break;
 	case TCP_SYNCNT:
-		val = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
+		val = tp->syn_retries ? : sysctl_tcp_syn_retries;
 		break;
 	case TCP_LINGER2:
 		val = tp->linger2;
@@ -1976,8 +2210,8 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 			val = (val ? : sysctl_tcp_fin_timeout) / HZ;
 		break;
 	case TCP_DEFER_ACCEPT:
-		val = !icsk->icsk_accept_queue.rskq_defer_accept ? 0 :
-			((TCP_TIMEOUT_INIT / HZ) << (icsk->icsk_accept_queue.rskq_defer_accept - 1));
+		val = !tp->defer_accept ? 0 : ((TCP_TIMEOUT_INIT / HZ) <<
+					       (tp->defer_accept - 1));
 		break;
 	case TCP_WINDOW_CLAMP:
 		val = tp->window_clamp;
@@ -1998,7 +2232,7 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		return 0;
 	}
 	case TCP_QUICKACK:
-		val = !icsk->icsk_ack.pingpong;
+		val = !tp->ack.pingpong;
 		break;
 
 	case TCP_CONGESTION:
@@ -2007,7 +2241,7 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 		len = min_t(unsigned int, len, TCP_CA_NAME_MAX);
 		if (put_user(len, optlen))
 			return -EFAULT;
-		if (copy_to_user(optval, icsk->icsk_ca_ops->name, len))
+		if (copy_to_user(optval, tp->ca_ops->name, len))
 			return -EFAULT;
 		return 0;
 	default:
@@ -2044,72 +2278,79 @@ void __init tcp_init(void)
 		__skb_cb_too_small_for_tcp(sizeof(struct tcp_skb_cb),
 					   sizeof(skb->cb));
 
-	tcp_hashinfo.bind_bucket_cachep =
-		kmem_cache_create("tcp_bind_bucket",
-				  sizeof(struct inet_bind_bucket), 0,
-				  SLAB_HWCACHE_ALIGN, NULL, NULL);
-	if (!tcp_hashinfo.bind_bucket_cachep)
+	tcp_bucket_cachep = kmem_cache_create("tcp_bind_bucket",
+					      sizeof(struct tcp_bind_bucket),
+					      0, SLAB_HWCACHE_ALIGN,
+					      NULL, NULL);
+	if (!tcp_bucket_cachep)
 		panic("tcp_init: Cannot alloc tcp_bind_bucket cache.");
 
+	tcp_timewait_cachep = kmem_cache_create("tcp_tw_bucket",
+						sizeof(struct tcp_tw_bucket),
+						0, SLAB_HWCACHE_ALIGN,
+						NULL, NULL);
+	if (!tcp_timewait_cachep)
+		panic("tcp_init: Cannot alloc tcp_tw_bucket cache.");
+
 	/* Size and allocate the main established and bind bucket
 	 * hash tables.
 	 *
 	 * The methodology is similar to that of the buffer cache.
 	 */
-	tcp_hashinfo.ehash =
+	tcp_ehash = (struct tcp_ehash_bucket *)
 		alloc_large_system_hash("TCP established",
-					sizeof(struct inet_ehash_bucket),
+					sizeof(struct tcp_ehash_bucket),
 					thash_entries,
 					(num_physpages >= 128 * 1024) ?
 						(25 - PAGE_SHIFT) :
 						(27 - PAGE_SHIFT),
 					HASH_HIGHMEM,
-					&tcp_hashinfo.ehash_size,
+					&tcp_ehash_size,
 					NULL,
 					0);
-	tcp_hashinfo.ehash_size = (1 << tcp_hashinfo.ehash_size) >> 1;
-	for (i = 0; i < (tcp_hashinfo.ehash_size << 1); i++) {
-		rwlock_init(&tcp_hashinfo.ehash[i].lock);
-		INIT_HLIST_HEAD(&tcp_hashinfo.ehash[i].chain);
+	tcp_ehash_size = (1 << tcp_ehash_size) >> 1;
+	for (i = 0; i < (tcp_ehash_size << 1); i++) {
+		rwlock_init(&tcp_ehash[i].lock);
+		INIT_HLIST_HEAD(&tcp_ehash[i].chain);
 	}
 
-	tcp_hashinfo.bhash =
+	tcp_bhash = (struct tcp_bind_hashbucket *)
 		alloc_large_system_hash("TCP bind",
-					sizeof(struct inet_bind_hashbucket),
-					tcp_hashinfo.ehash_size,
+					sizeof(struct tcp_bind_hashbucket),
+					tcp_ehash_size,
 					(num_physpages >= 128 * 1024) ?
 						(25 - PAGE_SHIFT) :
 						(27 - PAGE_SHIFT),
 					HASH_HIGHMEM,
-					&tcp_hashinfo.bhash_size,
+					&tcp_bhash_size,
 					NULL,
 					64 * 1024);
-	tcp_hashinfo.bhash_size = 1 << tcp_hashinfo.bhash_size;
-	for (i = 0; i < tcp_hashinfo.bhash_size; i++) {
-		spin_lock_init(&tcp_hashinfo.bhash[i].lock);
-		INIT_HLIST_HEAD(&tcp_hashinfo.bhash[i].chain);
+	tcp_bhash_size = 1 << tcp_bhash_size;
+	for (i = 0; i < tcp_bhash_size; i++) {
+		spin_lock_init(&tcp_bhash[i].lock);
+		INIT_HLIST_HEAD(&tcp_bhash[i].chain);
 	}
 
 	/* Try to be a bit smarter and adjust defaults depending
 	 * on available memory.
 	 */
 	for (order = 0; ((1 << order) << PAGE_SHIFT) <
-			(tcp_hashinfo.bhash_size * sizeof(struct inet_bind_hashbucket));
+			(tcp_bhash_size * sizeof(struct tcp_bind_hashbucket));
 			order++)
 		;
 	if (order >= 4) {
 		sysctl_local_port_range[0] = 32768;
 		sysctl_local_port_range[1] = 61000;
-		tcp_death_row.sysctl_max_tw_buckets = 180000;
+		sysctl_tcp_max_tw_buckets = 180000;
 		sysctl_tcp_max_orphans = 4096 << (order - 4);
 		sysctl_max_syn_backlog = 1024;
 	} else if (order < 3) {
 		sysctl_local_port_range[0] = 1024 * (3 - order);
-		tcp_death_row.sysctl_max_tw_buckets >>= (3 - order);
+		sysctl_tcp_max_tw_buckets >>= (3 - order);
 		sysctl_tcp_max_orphans >>= (3 - order);
 		sysctl_max_syn_backlog = 128;
 	}
-	tcp_hashinfo.port_rover = sysctl_local_port_range[0] - 1;
+	tcp_port_rover = sysctl_local_port_range[0] - 1;
 
 	sysctl_tcp_mem[0] =  768 << order;
 	sysctl_tcp_mem[1] = 1024 << order;
@@ -2124,12 +2365,14 @@ void __init tcp_init(void)
 
 	printk(KERN_INFO "TCP: Hash tables configured "
 	       "(established %d bind %d)\n",
-	       tcp_hashinfo.ehash_size << 1, tcp_hashinfo.bhash_size);
+	       tcp_ehash_size << 1, tcp_bhash_size);
 
 	tcp_register_congestion_control(&tcp_reno);
 }
 
+EXPORT_SYMBOL(tcp_accept);
 EXPORT_SYMBOL(tcp_close);
+EXPORT_SYMBOL(tcp_destroy_sock);
 EXPORT_SYMBOL(tcp_disconnect);
 EXPORT_SYMBOL(tcp_getsockopt);
 EXPORT_SYMBOL(tcp_ioctl);
@@ -2141,3 +2384,4 @@ EXPORT_SYMBOL(tcp_sendpage);
 EXPORT_SYMBOL(tcp_setsockopt);
 EXPORT_SYMBOL(tcp_shutdown);
 EXPORT_SYMBOL(tcp_statistics);
+EXPORT_SYMBOL(tcp_timewait_cachep);
diff --git a/trunk/net/ipv4/tcp_bic.c b/trunk/net/ipv4/tcp_bic.c
index b940346de4e7..ec38d45d6649 100644
--- a/trunk/net/ipv4/tcp_bic.c
+++ b/trunk/net/ipv4/tcp_bic.c
@@ -86,11 +86,11 @@ static inline void bictcp_reset(struct bictcp *ca)
 	ca->delayed_ack = 2 << ACK_RATIO_SHIFT;
 }
 
-static void bictcp_init(struct sock *sk)
+static void bictcp_init(struct tcp_sock *tp)
 {
-	bictcp_reset(inet_csk_ca(sk));
+	bictcp_reset(tcp_ca(tp));
 	if (initial_ssthresh)
-		tcp_sk(sk)->snd_ssthresh = initial_ssthresh;
+		tp->snd_ssthresh = initial_ssthresh;
 }
 
 /*
@@ -156,10 +156,9 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
 
 
 /* Detect low utilization in congestion avoidance */
-static inline void bictcp_low_utilization(struct sock *sk, int flag)
+static inline void bictcp_low_utilization(struct tcp_sock *tp, int flag)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct bictcp *ca = inet_csk_ca(sk);
+	struct bictcp *ca = tcp_ca(tp);
 	u32 dist, delay;
 
 	/* No time stamp */
@@ -209,13 +208,12 @@ static inline void bictcp_low_utilization(struct sock *sk, int flag)
 
 }
 
-static void bictcp_cong_avoid(struct sock *sk, u32 ack,
+static void bictcp_cong_avoid(struct tcp_sock *tp, u32 ack,
 			      u32 seq_rtt, u32 in_flight, int data_acked)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-	struct bictcp *ca = inet_csk_ca(sk);
+	struct bictcp *ca = tcp_ca(tp);
 
-	bictcp_low_utilization(sk, data_acked);
+	bictcp_low_utilization(tp, data_acked);
 
 	if (in_flight < tp->snd_cwnd)
 		return;
@@ -244,10 +242,9 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack,
  *	behave like Reno until low_window is reached,
  *	then increase congestion window slowly
  */
-static u32 bictcp_recalc_ssthresh(struct sock *sk)
+static u32 bictcp_recalc_ssthresh(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct bictcp *ca = inet_csk_ca(sk);
+	struct bictcp *ca = tcp_ca(tp);
 
 	ca->epoch_start = 0;	/* end of epoch */
 
@@ -272,34 +269,31 @@ static u32 bictcp_recalc_ssthresh(struct sock *sk)
 		return max((tp->snd_cwnd * beta) / BICTCP_BETA_SCALE, 2U);
 }
 
-static u32 bictcp_undo_cwnd(struct sock *sk)
+static u32 bictcp_undo_cwnd(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	const struct bictcp *ca = inet_csk_ca(sk);
+	struct bictcp *ca = tcp_ca(tp);
+
 	return max(tp->snd_cwnd, ca->last_max_cwnd);
 }
 
-static u32 bictcp_min_cwnd(struct sock *sk)
+static u32 bictcp_min_cwnd(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
 	return tp->snd_ssthresh;
 }
 
-static void bictcp_state(struct sock *sk, u8 new_state)
+static void bictcp_state(struct tcp_sock *tp, u8 new_state)
 {
 	if (new_state == TCP_CA_Loss)
-		bictcp_reset(inet_csk_ca(sk));
+		bictcp_reset(tcp_ca(tp));
 }
 
 /* Track delayed acknowledgement ratio using sliding window
  * ratio = (15*ratio + sample) / 16
  */
-static void bictcp_acked(struct sock *sk, u32 cnt)
+static void bictcp_acked(struct tcp_sock *tp, u32 cnt)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-
-	if (cnt > 0 && 	icsk->icsk_ca_state == TCP_CA_Open) {
-		struct bictcp *ca = inet_csk_ca(sk);
+	if (cnt > 0 && 	tp->ca_state == TCP_CA_Open) {
+		struct bictcp *ca = tcp_ca(tp);
 		cnt -= ca->delayed_ack >> ACK_RATIO_SHIFT;
 		ca->delayed_ack += cnt;
 	}
@@ -320,7 +314,7 @@ static struct tcp_congestion_ops bictcp = {
 
 static int __init bictcp_register(void)
 {
-	BUG_ON(sizeof(struct bictcp) > ICSK_CA_PRIV_SIZE);
+	BUG_ON(sizeof(struct bictcp) > TCP_CA_PRIV_SIZE);
 	return tcp_register_congestion_control(&bictcp);
 }
 
diff --git a/trunk/net/ipv4/tcp_cong.c b/trunk/net/ipv4/tcp_cong.c
index bbf2d6624e89..4970d10a7785 100644
--- a/trunk/net/ipv4/tcp_cong.c
+++ b/trunk/net/ipv4/tcp_cong.c
@@ -73,36 +73,33 @@ void tcp_unregister_congestion_control(struct tcp_congestion_ops *ca)
 EXPORT_SYMBOL_GPL(tcp_unregister_congestion_control);
 
 /* Assign choice of congestion control. */
-void tcp_init_congestion_control(struct sock *sk)
+void tcp_init_congestion_control(struct tcp_sock *tp)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_congestion_ops *ca;
 
-	if (icsk->icsk_ca_ops != &tcp_init_congestion_ops)
+	if (tp->ca_ops != &tcp_init_congestion_ops)
 		return;
 
 	rcu_read_lock();
 	list_for_each_entry_rcu(ca, &tcp_cong_list, list) {
 		if (try_module_get(ca->owner)) {
-			icsk->icsk_ca_ops = ca;
+			tp->ca_ops = ca;
 			break;
 		}
 
 	}
 	rcu_read_unlock();
 
-	if (icsk->icsk_ca_ops->init)
-		icsk->icsk_ca_ops->init(sk);
+	if (tp->ca_ops->init)
+		tp->ca_ops->init(tp);
 }
 
 /* Manage refcounts on socket close. */
-void tcp_cleanup_congestion_control(struct sock *sk)
+void tcp_cleanup_congestion_control(struct tcp_sock *tp)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
-
-	if (icsk->icsk_ca_ops->release)
-		icsk->icsk_ca_ops->release(sk);
-	module_put(icsk->icsk_ca_ops->owner);
+	if (tp->ca_ops->release)
+		tp->ca_ops->release(tp);
+	module_put(tp->ca_ops->owner);
 }
 
 /* Used by sysctl to change default congestion control */
@@ -146,15 +143,14 @@ void tcp_get_default_congestion_control(char *name)
 }
 
 /* Change congestion control for socket */
-int tcp_set_congestion_control(struct sock *sk, const char *name)
+int tcp_set_congestion_control(struct tcp_sock *tp, const char *name)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_congestion_ops *ca;
 	int err = 0;
 
 	rcu_read_lock();
 	ca = tcp_ca_find(name);
-	if (ca == icsk->icsk_ca_ops)
+	if (ca == tp->ca_ops)
 		goto out;
 
 	if (!ca)
@@ -164,10 +160,10 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
 		err = -EBUSY;
 
 	else {
-		tcp_cleanup_congestion_control(sk);
-		icsk->icsk_ca_ops = ca;
-		if (icsk->icsk_ca_ops->init)
-			icsk->icsk_ca_ops->init(sk);
+		tcp_cleanup_congestion_control(tp);
+		tp->ca_ops = ca;
+		if (tp->ca_ops->init)
+			tp->ca_ops->init(tp);
 	}
  out:
 	rcu_read_unlock();
@@ -181,11 +177,9 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
 /* This is Jacobson's slow start and congestion avoidance.
  * SIGCOMM '88, p. 328.
  */
-void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 rtt, u32 in_flight,
+void tcp_reno_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt, u32 in_flight,
 			 int flag)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-
 	if (in_flight < tp->snd_cwnd)
 		return;
 
@@ -208,17 +202,15 @@ void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 rtt, u32 in_flight,
 EXPORT_SYMBOL_GPL(tcp_reno_cong_avoid);
 
 /* Slow start threshold is half the congestion window (min 2) */
-u32 tcp_reno_ssthresh(struct sock *sk)
+u32 tcp_reno_ssthresh(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
 	return max(tp->snd_cwnd >> 1U, 2U);
 }
 EXPORT_SYMBOL_GPL(tcp_reno_ssthresh);
 
 /* Lower bound on congestion window. */
-u32 tcp_reno_min_cwnd(struct sock *sk)
+u32 tcp_reno_min_cwnd(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
 	return tp->snd_ssthresh/2;
 }
 EXPORT_SYMBOL_GPL(tcp_reno_min_cwnd);
diff --git a/trunk/net/ipv4/tcp_diag.c b/trunk/net/ipv4/tcp_diag.c
index c148c1081880..f66945cb158f 100644
--- a/trunk/net/ipv4/tcp_diag.c
+++ b/trunk/net/ipv4/tcp_diag.c
@@ -1,5 +1,5 @@
 /*
- * tcp_diag.c	Module for monitoring TCP transport protocols sockets.
+ * tcp_diag.c	Module for monitoring TCP sockets.
  *
  * Version:	$Id: tcp_diag.c,v 1.3 2002/02/01 22:01:04 davem Exp $
  *
@@ -12,43 +12,779 @@
  */
 
 #include <linux/config.h>
-
 #include <linux/module.h>
-#include <linux/inet_diag.h>
-
-#include <linux/tcp.h>
+#include <linux/types.h>
+#include <linux/fcntl.h>
+#include <linux/random.h>
+#include <linux/cache.h>
+#include <linux/init.h>
+#include <linux/time.h>
 
+#include <net/icmp.h>
 #include <net/tcp.h>
+#include <net/ipv6.h>
+#include <net/inet_common.h>
+
+#include <linux/inet.h>
+#include <linux/stddef.h>
+
+#include <linux/tcp_diag.h>
+
+struct tcpdiag_entry
+{
+	u32 *saddr;
+	u32 *daddr;
+	u16 sport;
+	u16 dport;
+	u16 family;
+	u16 userlocks;
+};
+
+static struct sock *tcpnl;
+
+#define TCPDIAG_PUT(skb, attrtype, attrlen) \
+	RTA_DATA(__RTA_PUT(skb, attrtype, attrlen))
 
-static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
-			      void *_info)
+static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
+			int ext, u32 pid, u32 seq, u16 nlmsg_flags)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct tcp_info *info = _info;
+	struct inet_sock *inet = inet_sk(sk);
+	struct tcp_sock *tp = tcp_sk(sk);
+	struct tcpdiagmsg *r;
+	struct nlmsghdr  *nlh;
+	struct tcp_info  *info = NULL;
+	struct tcpdiag_meminfo  *minfo = NULL;
+	unsigned char	 *b = skb->tail;
+
+	nlh = NLMSG_PUT(skb, pid, seq, TCPDIAG_GETSOCK, sizeof(*r));
+	nlh->nlmsg_flags = nlmsg_flags;
+	r = NLMSG_DATA(nlh);
+	if (sk->sk_state != TCP_TIME_WAIT) {
+		if (ext & (1<<(TCPDIAG_MEMINFO-1)))
+			minfo = TCPDIAG_PUT(skb, TCPDIAG_MEMINFO, sizeof(*minfo));
+		if (ext & (1<<(TCPDIAG_INFO-1)))
+			info = TCPDIAG_PUT(skb, TCPDIAG_INFO, sizeof(*info));
+		
+		if (ext & (1<<(TCPDIAG_CONG-1))) {
+			size_t len = strlen(tp->ca_ops->name);
+			strcpy(TCPDIAG_PUT(skb, TCPDIAG_CONG, len+1),
+			       tp->ca_ops->name);
+		}
+	}
+	r->tcpdiag_family = sk->sk_family;
+	r->tcpdiag_state = sk->sk_state;
+	r->tcpdiag_timer = 0;
+	r->tcpdiag_retrans = 0;
+
+	r->id.tcpdiag_if = sk->sk_bound_dev_if;
+	r->id.tcpdiag_cookie[0] = (u32)(unsigned long)sk;
+	r->id.tcpdiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
+
+	if (r->tcpdiag_state == TCP_TIME_WAIT) {
+		struct tcp_tw_bucket *tw = (struct tcp_tw_bucket*)sk;
+		long tmo = tw->tw_ttd - jiffies;
+		if (tmo < 0)
+			tmo = 0;
+
+		r->id.tcpdiag_sport = tw->tw_sport;
+		r->id.tcpdiag_dport = tw->tw_dport;
+		r->id.tcpdiag_src[0] = tw->tw_rcv_saddr;
+		r->id.tcpdiag_dst[0] = tw->tw_daddr;
+		r->tcpdiag_state = tw->tw_substate;
+		r->tcpdiag_timer = 3;
+		r->tcpdiag_expires = (tmo*1000+HZ-1)/HZ;
+		r->tcpdiag_rqueue = 0;
+		r->tcpdiag_wqueue = 0;
+		r->tcpdiag_uid = 0;
+		r->tcpdiag_inode = 0;
+#ifdef CONFIG_IP_TCPDIAG_IPV6
+		if (r->tcpdiag_family == AF_INET6) {
+			ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_src,
+				       &tw->tw_v6_rcv_saddr);
+			ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_dst,
+				       &tw->tw_v6_daddr);
+		}
+#endif
+		nlh->nlmsg_len = skb->tail - b;
+		return skb->len;
+	}
+
+	r->id.tcpdiag_sport = inet->sport;
+	r->id.tcpdiag_dport = inet->dport;
+	r->id.tcpdiag_src[0] = inet->rcv_saddr;
+	r->id.tcpdiag_dst[0] = inet->daddr;
+
+#ifdef CONFIG_IP_TCPDIAG_IPV6
+	if (r->tcpdiag_family == AF_INET6) {
+		struct ipv6_pinfo *np = inet6_sk(sk);
+
+		ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_src,
+			       &np->rcv_saddr);
+		ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_dst,
+			       &np->daddr);
+	}
+#endif
+
+#define EXPIRES_IN_MS(tmo)  ((tmo-jiffies)*1000+HZ-1)/HZ
+
+	if (tp->pending == TCP_TIME_RETRANS) {
+		r->tcpdiag_timer = 1;
+		r->tcpdiag_retrans = tp->retransmits;
+		r->tcpdiag_expires = EXPIRES_IN_MS(tp->timeout);
+	} else if (tp->pending == TCP_TIME_PROBE0) {
+		r->tcpdiag_timer = 4;
+		r->tcpdiag_retrans = tp->probes_out;
+		r->tcpdiag_expires = EXPIRES_IN_MS(tp->timeout);
+	} else if (timer_pending(&sk->sk_timer)) {
+		r->tcpdiag_timer = 2;
+		r->tcpdiag_retrans = tp->probes_out;
+		r->tcpdiag_expires = EXPIRES_IN_MS(sk->sk_timer.expires);
+	} else {
+		r->tcpdiag_timer = 0;
+		r->tcpdiag_expires = 0;
+	}
+#undef EXPIRES_IN_MS
 
-	r->idiag_rqueue = tp->rcv_nxt - tp->copied_seq;
-	r->idiag_wqueue = tp->write_seq - tp->snd_una;
-	if (info != NULL)
+	r->tcpdiag_rqueue = tp->rcv_nxt - tp->copied_seq;
+	r->tcpdiag_wqueue = tp->write_seq - tp->snd_una;
+	r->tcpdiag_uid = sock_i_uid(sk);
+	r->tcpdiag_inode = sock_i_ino(sk);
+
+	if (minfo) {
+		minfo->tcpdiag_rmem = atomic_read(&sk->sk_rmem_alloc);
+		minfo->tcpdiag_wmem = sk->sk_wmem_queued;
+		minfo->tcpdiag_fmem = sk->sk_forward_alloc;
+		minfo->tcpdiag_tmem = atomic_read(&sk->sk_wmem_alloc);
+	}
+
+	if (info) 
 		tcp_get_info(sk, info);
+
+	if (sk->sk_state < TCP_TIME_WAIT && tp->ca_ops->get_info)
+		tp->ca_ops->get_info(tp, ext, skb);
+
+	nlh->nlmsg_len = skb->tail - b;
+	return skb->len;
+
+rtattr_failure:
+nlmsg_failure:
+	skb_trim(skb, b - skb->data);
+	return -1;
 }
 
-static struct inet_diag_handler tcp_diag_handler = {
-	.idiag_hashinfo	 = &tcp_hashinfo,
-	.idiag_get_info	 = tcp_diag_get_info,
-	.idiag_type	 = TCPDIAG_GETSOCK,
-	.idiag_info_size = sizeof(struct tcp_info),
-};
+extern struct sock *tcp_v4_lookup(u32 saddr, u16 sport, u32 daddr, u16 dport,
+				  int dif);
+#ifdef CONFIG_IP_TCPDIAG_IPV6
+extern struct sock *tcp_v6_lookup(struct in6_addr *saddr, u16 sport,
+				  struct in6_addr *daddr, u16 dport,
+				  int dif);
+#else
+static inline struct sock *tcp_v6_lookup(struct in6_addr *saddr, u16 sport,
+					 struct in6_addr *daddr, u16 dport,
+					 int dif)
+{
+	return NULL;
+}
+#endif
+
+static int tcpdiag_get_exact(struct sk_buff *in_skb, const struct nlmsghdr *nlh)
+{
+	int err;
+	struct sock *sk;
+	struct tcpdiagreq *req = NLMSG_DATA(nlh);
+	struct sk_buff *rep;
+
+	if (req->tcpdiag_family == AF_INET) {
+		sk = tcp_v4_lookup(req->id.tcpdiag_dst[0], req->id.tcpdiag_dport,
+				   req->id.tcpdiag_src[0], req->id.tcpdiag_sport,
+				   req->id.tcpdiag_if);
+	}
+#ifdef CONFIG_IP_TCPDIAG_IPV6
+	else if (req->tcpdiag_family == AF_INET6) {
+		sk = tcp_v6_lookup((struct in6_addr*)req->id.tcpdiag_dst, req->id.tcpdiag_dport,
+				   (struct in6_addr*)req->id.tcpdiag_src, req->id.tcpdiag_sport,
+				   req->id.tcpdiag_if);
+	}
+#endif
+	else {
+		return -EINVAL;
+	}
+
+	if (sk == NULL)
+		return -ENOENT;
+
+	err = -ESTALE;
+	if ((req->id.tcpdiag_cookie[0] != TCPDIAG_NOCOOKIE ||
+	     req->id.tcpdiag_cookie[1] != TCPDIAG_NOCOOKIE) &&
+	    ((u32)(unsigned long)sk != req->id.tcpdiag_cookie[0] ||
+	     (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.tcpdiag_cookie[1]))
+		goto out;
+
+	err = -ENOMEM;
+	rep = alloc_skb(NLMSG_SPACE(sizeof(struct tcpdiagmsg)+
+				    sizeof(struct tcpdiag_meminfo)+
+				    sizeof(struct tcp_info)+64), GFP_KERNEL);
+	if (!rep)
+		goto out;
+
+	if (tcpdiag_fill(rep, sk, req->tcpdiag_ext,
+			 NETLINK_CB(in_skb).pid,
+			 nlh->nlmsg_seq, 0) <= 0)
+		BUG();
+
+	err = netlink_unicast(tcpnl, rep, NETLINK_CB(in_skb).pid, MSG_DONTWAIT);
+	if (err > 0)
+		err = 0;
+
+out:
+	if (sk) {
+		if (sk->sk_state == TCP_TIME_WAIT)
+			tcp_tw_put((struct tcp_tw_bucket*)sk);
+		else
+			sock_put(sk);
+	}
+	return err;
+}
+
+static int bitstring_match(const u32 *a1, const u32 *a2, int bits)
+{
+	int words = bits >> 5;
+
+	bits &= 0x1f;
+
+	if (words) {
+		if (memcmp(a1, a2, words << 2))
+			return 0;
+	}
+	if (bits) {
+		__u32 w1, w2;
+		__u32 mask;
+
+		w1 = a1[words];
+		w2 = a2[words];
+
+		mask = htonl((0xffffffff) << (32 - bits));
+
+		if ((w1 ^ w2) & mask)
+			return 0;
+	}
+
+	return 1;
+}
+
+
+static int tcpdiag_bc_run(const void *bc, int len,
+			  const struct tcpdiag_entry *entry)
+{
+	while (len > 0) {
+		int yes = 1;
+		const struct tcpdiag_bc_op *op = bc;
+
+		switch (op->code) {
+		case TCPDIAG_BC_NOP:
+			break;
+		case TCPDIAG_BC_JMP:
+			yes = 0;
+			break;
+		case TCPDIAG_BC_S_GE:
+			yes = entry->sport >= op[1].no;
+			break;
+		case TCPDIAG_BC_S_LE:
+			yes = entry->dport <= op[1].no;
+			break;
+		case TCPDIAG_BC_D_GE:
+			yes = entry->dport >= op[1].no;
+			break;
+		case TCPDIAG_BC_D_LE:
+			yes = entry->dport <= op[1].no;
+			break;
+		case TCPDIAG_BC_AUTO:
+			yes = !(entry->userlocks & SOCK_BINDPORT_LOCK);
+			break;
+		case TCPDIAG_BC_S_COND:
+		case TCPDIAG_BC_D_COND:
+		{
+			struct tcpdiag_hostcond *cond = (struct tcpdiag_hostcond*)(op+1);
+			u32 *addr;
+
+			if (cond->port != -1 &&
+			    cond->port != (op->code == TCPDIAG_BC_S_COND ?
+					     entry->sport : entry->dport)) {
+				yes = 0;
+				break;
+			}
+			
+			if (cond->prefix_len == 0)
+				break;
+
+			if (op->code == TCPDIAG_BC_S_COND)
+				addr = entry->saddr;
+			else
+				addr = entry->daddr;
+
+			if (bitstring_match(addr, cond->addr, cond->prefix_len))
+				break;
+			if (entry->family == AF_INET6 &&
+			    cond->family == AF_INET) {
+				if (addr[0] == 0 && addr[1] == 0 &&
+				    addr[2] == htonl(0xffff) &&
+				    bitstring_match(addr+3, cond->addr, cond->prefix_len))
+					break;
+			}
+			yes = 0;
+			break;
+		}
+		}
+
+		if (yes) { 
+			len -= op->yes;
+			bc += op->yes;
+		} else {
+			len -= op->no;
+			bc += op->no;
+		}
+	}
+	return (len == 0);
+}
+
+static int valid_cc(const void *bc, int len, int cc)
+{
+	while (len >= 0) {
+		const struct tcpdiag_bc_op *op = bc;
+
+		if (cc > len)
+			return 0;
+		if (cc == len)
+			return 1;
+		if (op->yes < 4)
+			return 0;
+		len -= op->yes;
+		bc  += op->yes;
+	}
+	return 0;
+}
+
+static int tcpdiag_bc_audit(const void *bytecode, int bytecode_len)
+{
+	const unsigned char *bc = bytecode;
+	int  len = bytecode_len;
+
+	while (len > 0) {
+		struct tcpdiag_bc_op *op = (struct tcpdiag_bc_op*)bc;
+
+//printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
+		switch (op->code) {
+		case TCPDIAG_BC_AUTO:
+		case TCPDIAG_BC_S_COND:
+		case TCPDIAG_BC_D_COND:
+		case TCPDIAG_BC_S_GE:
+		case TCPDIAG_BC_S_LE:
+		case TCPDIAG_BC_D_GE:
+		case TCPDIAG_BC_D_LE:
+			if (op->yes < 4 || op->yes > len+4)
+				return -EINVAL;
+		case TCPDIAG_BC_JMP:
+			if (op->no < 4 || op->no > len+4)
+				return -EINVAL;
+			if (op->no < len &&
+			    !valid_cc(bytecode, bytecode_len, len-op->no))
+				return -EINVAL;
+			break;
+		case TCPDIAG_BC_NOP:
+			if (op->yes < 4 || op->yes > len+4)
+				return -EINVAL;
+			break;
+		default:
+			return -EINVAL;
+		}
+		bc += op->yes;
+		len -= op->yes;
+	}
+	return len == 0 ? 0 : -EINVAL;
+}
+
+static int tcpdiag_dump_sock(struct sk_buff *skb, struct sock *sk,
+			     struct netlink_callback *cb)
+{
+	struct tcpdiagreq *r = NLMSG_DATA(cb->nlh);
+
+	if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+		struct tcpdiag_entry entry;
+		struct rtattr *bc = (struct rtattr *)(r + 1);
+		struct inet_sock *inet = inet_sk(sk);
+
+		entry.family = sk->sk_family;
+#ifdef CONFIG_IP_TCPDIAG_IPV6
+		if (entry.family == AF_INET6) {
+			struct ipv6_pinfo *np = inet6_sk(sk);
+
+			entry.saddr = np->rcv_saddr.s6_addr32;
+			entry.daddr = np->daddr.s6_addr32;
+		} else
+#endif
+		{
+			entry.saddr = &inet->rcv_saddr;
+			entry.daddr = &inet->daddr;
+		}
+		entry.sport = inet->num;
+		entry.dport = ntohs(inet->dport);
+		entry.userlocks = sk->sk_userlocks;
+
+		if (!tcpdiag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
+			return 0;
+	}
+
+	return tcpdiag_fill(skb, sk, r->tcpdiag_ext, NETLINK_CB(cb->skb).pid,
+			    cb->nlh->nlmsg_seq, NLM_F_MULTI);
+}
+
+static int tcpdiag_fill_req(struct sk_buff *skb, struct sock *sk,
+			    struct request_sock *req,
+			    u32 pid, u32 seq)
+{
+	const struct inet_request_sock *ireq = inet_rsk(req);
+	struct inet_sock *inet = inet_sk(sk);
+	unsigned char *b = skb->tail;
+	struct tcpdiagmsg *r;
+	struct nlmsghdr *nlh;
+	long tmo;
+
+	nlh = NLMSG_PUT(skb, pid, seq, TCPDIAG_GETSOCK, sizeof(*r));
+	nlh->nlmsg_flags = NLM_F_MULTI;
+	r = NLMSG_DATA(nlh);
+
+	r->tcpdiag_family = sk->sk_family;
+	r->tcpdiag_state = TCP_SYN_RECV;
+	r->tcpdiag_timer = 1;
+	r->tcpdiag_retrans = req->retrans;
+
+	r->id.tcpdiag_if = sk->sk_bound_dev_if;
+	r->id.tcpdiag_cookie[0] = (u32)(unsigned long)req;
+	r->id.tcpdiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
+
+	tmo = req->expires - jiffies;
+	if (tmo < 0)
+		tmo = 0;
+
+	r->id.tcpdiag_sport = inet->sport;
+	r->id.tcpdiag_dport = ireq->rmt_port;
+	r->id.tcpdiag_src[0] = ireq->loc_addr;
+	r->id.tcpdiag_dst[0] = ireq->rmt_addr;
+	r->tcpdiag_expires = jiffies_to_msecs(tmo),
+	r->tcpdiag_rqueue = 0;
+	r->tcpdiag_wqueue = 0;
+	r->tcpdiag_uid = sock_i_uid(sk);
+	r->tcpdiag_inode = 0;
+#ifdef CONFIG_IP_TCPDIAG_IPV6
+	if (r->tcpdiag_family == AF_INET6) {
+		ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_src,
+			       &tcp6_rsk(req)->loc_addr);
+		ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_dst,
+			       &tcp6_rsk(req)->rmt_addr);
+	}
+#endif
+	nlh->nlmsg_len = skb->tail - b;
+
+	return skb->len;
+
+nlmsg_failure:
+	skb_trim(skb, b - skb->data);
+	return -1;
+}
+
+static int tcpdiag_dump_reqs(struct sk_buff *skb, struct sock *sk,
+			     struct netlink_callback *cb)
+{
+	struct tcpdiag_entry entry;
+	struct tcpdiagreq *r = NLMSG_DATA(cb->nlh);
+	struct tcp_sock *tp = tcp_sk(sk);
+	struct listen_sock *lopt;
+	struct rtattr *bc = NULL;
+	struct inet_sock *inet = inet_sk(sk);
+	int j, s_j;
+	int reqnum, s_reqnum;
+	int err = 0;
+
+	s_j = cb->args[3];
+	s_reqnum = cb->args[4];
+
+	if (s_j > 0)
+		s_j--;
+
+	entry.family = sk->sk_family;
+
+	read_lock_bh(&tp->accept_queue.syn_wait_lock);
+
+	lopt = tp->accept_queue.listen_opt;
+	if (!lopt || !lopt->qlen)
+		goto out;
+
+	if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+		bc = (struct rtattr *)(r + 1);
+		entry.sport = inet->num;
+		entry.userlocks = sk->sk_userlocks;
+	}
+
+	for (j = s_j; j < TCP_SYNQ_HSIZE; j++) {
+		struct request_sock *req, *head = lopt->syn_table[j];
+
+		reqnum = 0;
+		for (req = head; req; reqnum++, req = req->dl_next) {
+			struct inet_request_sock *ireq = inet_rsk(req);
+
+			if (reqnum < s_reqnum)
+				continue;
+			if (r->id.tcpdiag_dport != ireq->rmt_port &&
+			    r->id.tcpdiag_dport)
+				continue;
+
+			if (bc) {
+				entry.saddr =
+#ifdef CONFIG_IP_TCPDIAG_IPV6
+					(entry.family == AF_INET6) ?
+					tcp6_rsk(req)->loc_addr.s6_addr32 :
+#endif
+					&ireq->loc_addr;
+				entry.daddr = 
+#ifdef CONFIG_IP_TCPDIAG_IPV6
+					(entry.family == AF_INET6) ?
+					tcp6_rsk(req)->rmt_addr.s6_addr32 :
+#endif
+					&ireq->rmt_addr;
+				entry.dport = ntohs(ireq->rmt_port);
+
+				if (!tcpdiag_bc_run(RTA_DATA(bc),
+						    RTA_PAYLOAD(bc), &entry))
+					continue;
+			}
+
+			err = tcpdiag_fill_req(skb, sk, req,
+					       NETLINK_CB(cb->skb).pid,
+					       cb->nlh->nlmsg_seq);
+			if (err < 0) {
+				cb->args[3] = j + 1;
+				cb->args[4] = reqnum;
+				goto out;
+			}
+		}
+
+		s_reqnum = 0;
+	}
+
+out:
+	read_unlock_bh(&tp->accept_queue.syn_wait_lock);
+
+	return err;
+}
+
+static int tcpdiag_dump(struct sk_buff *skb, struct netlink_callback *cb)
+{
+	int i, num;
+	int s_i, s_num;
+	struct tcpdiagreq *r = NLMSG_DATA(cb->nlh);
+
+	s_i = cb->args[1];
+	s_num = num = cb->args[2];
+
+	if (cb->args[0] == 0) {
+		if (!(r->tcpdiag_states&(TCPF_LISTEN|TCPF_SYN_RECV)))
+			goto skip_listen_ht;
+		tcp_listen_lock();
+		for (i = s_i; i < TCP_LHTABLE_SIZE; i++) {
+			struct sock *sk;
+			struct hlist_node *node;
+
+			num = 0;
+			sk_for_each(sk, node, &tcp_listening_hash[i]) {
+				struct inet_sock *inet = inet_sk(sk);
+
+				if (num < s_num) {
+					num++;
+					continue;
+				}
+
+				if (r->id.tcpdiag_sport != inet->sport &&
+				    r->id.tcpdiag_sport)
+					goto next_listen;
+
+				if (!(r->tcpdiag_states&TCPF_LISTEN) ||
+				    r->id.tcpdiag_dport ||
+				    cb->args[3] > 0)
+					goto syn_recv;
+
+				if (tcpdiag_dump_sock(skb, sk, cb) < 0) {
+					tcp_listen_unlock();
+					goto done;
+				}
+
+syn_recv:
+				if (!(r->tcpdiag_states&TCPF_SYN_RECV))
+					goto next_listen;
+
+				if (tcpdiag_dump_reqs(skb, sk, cb) < 0) {
+					tcp_listen_unlock();
+					goto done;
+				}
+
+next_listen:
+				cb->args[3] = 0;
+				cb->args[4] = 0;
+				++num;
+			}
+
+			s_num = 0;
+			cb->args[3] = 0;
+			cb->args[4] = 0;
+		}
+		tcp_listen_unlock();
+skip_listen_ht:
+		cb->args[0] = 1;
+		s_i = num = s_num = 0;
+	}
+
+	if (!(r->tcpdiag_states&~(TCPF_LISTEN|TCPF_SYN_RECV)))
+		return skb->len;
+
+	for (i = s_i; i < tcp_ehash_size; i++) {
+		struct tcp_ehash_bucket *head = &tcp_ehash[i];
+		struct sock *sk;
+		struct hlist_node *node;
+
+		if (i > s_i)
+			s_num = 0;
+
+		read_lock_bh(&head->lock);
+
+		num = 0;
+		sk_for_each(sk, node, &head->chain) {
+			struct inet_sock *inet = inet_sk(sk);
+
+			if (num < s_num)
+				goto next_normal;
+			if (!(r->tcpdiag_states & (1 << sk->sk_state)))
+				goto next_normal;
+			if (r->id.tcpdiag_sport != inet->sport &&
+			    r->id.tcpdiag_sport)
+				goto next_normal;
+			if (r->id.tcpdiag_dport != inet->dport && r->id.tcpdiag_dport)
+				goto next_normal;
+			if (tcpdiag_dump_sock(skb, sk, cb) < 0) {
+				read_unlock_bh(&head->lock);
+				goto done;
+			}
+next_normal:
+			++num;
+		}
+
+		if (r->tcpdiag_states&TCPF_TIME_WAIT) {
+			sk_for_each(sk, node,
+				    &tcp_ehash[i + tcp_ehash_size].chain) {
+				struct inet_sock *inet = inet_sk(sk);
+
+				if (num < s_num)
+					goto next_dying;
+				if (r->id.tcpdiag_sport != inet->sport &&
+				    r->id.tcpdiag_sport)
+					goto next_dying;
+				if (r->id.tcpdiag_dport != inet->dport &&
+				    r->id.tcpdiag_dport)
+					goto next_dying;
+				if (tcpdiag_dump_sock(skb, sk, cb) < 0) {
+					read_unlock_bh(&head->lock);
+					goto done;
+				}
+next_dying:
+				++num;
+			}
+		}
+		read_unlock_bh(&head->lock);
+	}
+
+done:
+	cb->args[1] = i;
+	cb->args[2] = num;
+	return skb->len;
+}
+
+static int tcpdiag_dump_done(struct netlink_callback *cb)
+{
+	return 0;
+}
+
+
+static __inline__ int
+tcpdiag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+{
+	if (!(nlh->nlmsg_flags&NLM_F_REQUEST))
+		return 0;
+
+	if (nlh->nlmsg_type != TCPDIAG_GETSOCK)
+		goto err_inval;
+
+	if (NLMSG_LENGTH(sizeof(struct tcpdiagreq)) > skb->len)
+		goto err_inval;
+
+	if (nlh->nlmsg_flags&NLM_F_DUMP) {
+		if (nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(struct tcpdiagreq))) {
+			struct rtattr *rta = (struct rtattr*)(NLMSG_DATA(nlh) + sizeof(struct tcpdiagreq));
+			if (rta->rta_type != TCPDIAG_REQ_BYTECODE ||
+			    rta->rta_len < 8 ||
+			    rta->rta_len > nlh->nlmsg_len - NLMSG_SPACE(sizeof(struct tcpdiagreq)))
+				goto err_inval;
+			if (tcpdiag_bc_audit(RTA_DATA(rta), RTA_PAYLOAD(rta)))
+				goto err_inval;
+		}
+		return netlink_dump_start(tcpnl, skb, nlh,
+					  tcpdiag_dump,
+					  tcpdiag_dump_done);
+	} else {
+		return tcpdiag_get_exact(skb, nlh);
+	}
+
+err_inval:
+	return -EINVAL;
+}
+
+
+static inline void tcpdiag_rcv_skb(struct sk_buff *skb)
+{
+	int err;
+	struct nlmsghdr * nlh;
+
+	if (skb->len >= NLMSG_SPACE(0)) {
+		nlh = (struct nlmsghdr *)skb->data;
+		if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
+			return;
+		err = tcpdiag_rcv_msg(skb, nlh);
+		if (err || nlh->nlmsg_flags & NLM_F_ACK) 
+			netlink_ack(skb, nlh, err);
+	}
+}
+
+static void tcpdiag_rcv(struct sock *sk, int len)
+{
+	struct sk_buff *skb;
+	unsigned int qlen = skb_queue_len(&sk->sk_receive_queue);
+
+	while (qlen-- && (skb = skb_dequeue(&sk->sk_receive_queue))) {
+		tcpdiag_rcv_skb(skb);
+		kfree_skb(skb);
+	}
+}
 
-static int __init tcp_diag_init(void)
+static int __init tcpdiag_init(void)
 {
-	return inet_diag_register(&tcp_diag_handler);
+	tcpnl = netlink_kernel_create(NETLINK_TCPDIAG, tcpdiag_rcv);
+	if (tcpnl == NULL)
+		return -ENOMEM;
+	return 0;
 }
 
-static void __exit tcp_diag_exit(void)
+static void __exit tcpdiag_exit(void)
 {
-	inet_diag_unregister(&tcp_diag_handler);
+	sock_release(tcpnl->sk_socket);
 }
 
-module_init(tcp_diag_init);
-module_exit(tcp_diag_exit);
+module_init(tcpdiag_init);
+module_exit(tcpdiag_exit);
 MODULE_LICENSE("GPL");
diff --git a/trunk/net/ipv4/tcp_highspeed.c b/trunk/net/ipv4/tcp_highspeed.c
index 6acc04bde080..36c51f8136bf 100644
--- a/trunk/net/ipv4/tcp_highspeed.c
+++ b/trunk/net/ipv4/tcp_highspeed.c
@@ -98,10 +98,9 @@ struct hstcp {
 	u32	ai;
 };
 
-static void hstcp_init(struct sock *sk)
+static void hstcp_init(struct tcp_sock *tp)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-	struct hstcp *ca = inet_csk_ca(sk);
+	struct hstcp *ca = tcp_ca(tp);
 
 	ca->ai = 0;
 
@@ -110,11 +109,10 @@ static void hstcp_init(struct sock *sk)
 	tp->snd_cwnd_clamp = min_t(u32, tp->snd_cwnd_clamp, 0xffffffff/128);
 }
 
-static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
+static void hstcp_cong_avoid(struct tcp_sock *tp, u32 adk, u32 rtt,
 			     u32 in_flight, int good)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-	struct hstcp *ca = inet_csk_ca(sk);
+	struct hstcp *ca = tcp_ca(tp);
 
 	if (in_flight < tp->snd_cwnd)
 		return;
@@ -145,10 +143,9 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
 	}
 }
 
-static u32 hstcp_ssthresh(struct sock *sk)
+static u32 hstcp_ssthresh(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	const struct hstcp *ca = inet_csk_ca(sk);
+	struct hstcp *ca = tcp_ca(tp);
 
 	/* Do multiplicative decrease */
 	return max(tp->snd_cwnd - ((tp->snd_cwnd * hstcp_aimd_vals[ca->ai].md) >> 8), 2U);
@@ -167,7 +164,7 @@ static struct tcp_congestion_ops tcp_highspeed = {
 
 static int __init hstcp_register(void)
 {
-	BUG_ON(sizeof(struct hstcp) > ICSK_CA_PRIV_SIZE);
+	BUG_ON(sizeof(struct hstcp) > TCP_CA_PRIV_SIZE);
 	return tcp_register_congestion_control(&tcp_highspeed);
 }
 
diff --git a/trunk/net/ipv4/tcp_htcp.c b/trunk/net/ipv4/tcp_htcp.c
index e47b37984e95..40168275acf9 100644
--- a/trunk/net/ipv4/tcp_htcp.c
+++ b/trunk/net/ipv4/tcp_htcp.c
@@ -55,21 +55,18 @@ static inline void htcp_reset(struct htcp *ca)
 	ca->snd_cwnd_cnt2 = 0;
 }
 
-static u32 htcp_cwnd_undo(struct sock *sk)
+static u32 htcp_cwnd_undo(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct htcp *ca = inet_csk_ca(sk);
+	struct htcp *ca = tcp_ca(tp);
 	ca->ccount = ca->undo_ccount;
 	ca->maxRTT = ca->undo_maxRTT;
 	ca->old_maxB = ca->undo_old_maxB;
 	return max(tp->snd_cwnd, (tp->snd_ssthresh<<7)/ca->beta);
 }
 
-static inline void measure_rtt(struct sock *sk)
+static inline void measure_rtt(struct tcp_sock *tp)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct htcp *ca = inet_csk_ca(sk);
+	struct htcp *ca = tcp_ca(tp);
 	u32 srtt = tp->srtt>>3;
 
 	/* keep track of minimum RTT seen so far, minRTT is zero at first */
@@ -77,7 +74,7 @@ static inline void measure_rtt(struct sock *sk)
 		ca->minRTT = srtt;
 
 	/* max RTT */
-	if (icsk->icsk_ca_state == TCP_CA_Open && tp->snd_ssthresh < 0xFFFF && ca->ccount > 3) {
+	if (tp->ca_state == TCP_CA_Open && tp->snd_ssthresh < 0xFFFF && ca->ccount > 3) {
 		if (ca->maxRTT < ca->minRTT)
 			ca->maxRTT = ca->minRTT;
 		if (ca->maxRTT < srtt && srtt <= ca->maxRTT+HZ/50)
@@ -85,16 +82,13 @@ static inline void measure_rtt(struct sock *sk)
 	}
 }
 
-static void measure_achieved_throughput(struct sock *sk, u32 pkts_acked)
+static void measure_achieved_throughput(struct tcp_sock *tp, u32 pkts_acked)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct htcp *ca = inet_csk_ca(sk);
+	struct htcp *ca = tcp_ca(tp);
 	u32 now = tcp_time_stamp;
 
 	/* achieved throughput calculations */
-	if (icsk->icsk_ca_state != TCP_CA_Open &&
-	    icsk->icsk_ca_state != TCP_CA_Disorder) {
+	if (tp->ca_state != TCP_CA_Open && tp->ca_state != TCP_CA_Disorder) {
 		ca->packetcount = 0;
 		ca->lasttime = now;
 		return;
@@ -179,9 +173,9 @@ static inline void htcp_alpha_update(struct htcp *ca)
  * that point do we really have a real sense of maxRTT (the queues en route
  * were getting just too full now).
  */
-static void htcp_param_update(struct sock *sk)
+static void htcp_param_update(struct tcp_sock *tp)
 {
-	struct htcp *ca = inet_csk_ca(sk);
+	struct htcp *ca = tcp_ca(tp);
 	u32 minRTT = ca->minRTT;
 	u32 maxRTT = ca->maxRTT;
 
@@ -193,19 +187,17 @@ static void htcp_param_update(struct sock *sk)
 		ca->maxRTT = minRTT + ((maxRTT-minRTT)*95)/100;
 }
 
-static u32 htcp_recalc_ssthresh(struct sock *sk)
+static u32 htcp_recalc_ssthresh(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	const struct htcp *ca = inet_csk_ca(sk);
-	htcp_param_update(sk);
+	struct htcp *ca = tcp_ca(tp);
+	htcp_param_update(tp);
 	return max((tp->snd_cwnd * ca->beta) >> 7, 2U);
 }
 
-static void htcp_cong_avoid(struct sock *sk, u32 ack, u32 rtt,
+static void htcp_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
 			    u32 in_flight, int data_acked)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-	struct htcp *ca = inet_csk_ca(sk);
+	struct htcp *ca = tcp_ca(tp);
 
 	if (in_flight < tp->snd_cwnd)
 		return;
@@ -215,7 +207,7 @@ static void htcp_cong_avoid(struct sock *sk, u32 ack, u32 rtt,
 		if (tp->snd_cwnd < tp->snd_cwnd_clamp)
 			tp->snd_cwnd++;
 	} else {
-		measure_rtt(sk);
+		measure_rtt(tp);
 
 		/* keep track of number of round-trip times since last backoff event */
 		if (ca->snd_cwnd_cnt2++ > tp->snd_cwnd) {
@@ -237,29 +229,28 @@ static void htcp_cong_avoid(struct sock *sk, u32 ack, u32 rtt,
 }
 
 /* Lower bound on congestion window. */
-static u32 htcp_min_cwnd(struct sock *sk)
+static u32 htcp_min_cwnd(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
 	return tp->snd_ssthresh;
 }
 
 
-static void htcp_init(struct sock *sk)
+static void htcp_init(struct tcp_sock *tp)
 {
-	struct htcp *ca = inet_csk_ca(sk);
+	struct htcp *ca = tcp_ca(tp);
 
 	memset(ca, 0, sizeof(struct htcp));
 	ca->alpha = ALPHA_BASE;
 	ca->beta = BETA_MIN;
 }
 
-static void htcp_state(struct sock *sk, u8 new_state)
+static void htcp_state(struct tcp_sock *tp, u8 new_state)
 {
 	switch (new_state) {
 	case TCP_CA_CWR:
 	case TCP_CA_Recovery:
 	case TCP_CA_Loss:
-		htcp_reset(inet_csk_ca(sk));
+		htcp_reset(tcp_ca(tp));
 		break;
 	}
 }
@@ -278,7 +269,7 @@ static struct tcp_congestion_ops htcp = {
 
 static int __init htcp_register(void)
 {
-	BUG_ON(sizeof(struct htcp) > ICSK_CA_PRIV_SIZE);
+	BUG_ON(sizeof(struct htcp) > TCP_CA_PRIV_SIZE);
 	BUILD_BUG_ON(BETA_MIN >= BETA_MAX);
 	if (!use_bandwidth_switch)
 		htcp.pkts_acked = NULL;
diff --git a/trunk/net/ipv4/tcp_hybla.c b/trunk/net/ipv4/tcp_hybla.c
index 77add63623df..13a66342c304 100644
--- a/trunk/net/ipv4/tcp_hybla.c
+++ b/trunk/net/ipv4/tcp_hybla.c
@@ -33,20 +33,19 @@ MODULE_PARM_DESC(rtt0, "reference rout trip time (ms)");
 
 
 /* This is called to refresh values for hybla parameters */
-static inline void hybla_recalc_param (struct sock *sk)
+static inline void hybla_recalc_param (struct tcp_sock *tp)
 {
-	struct hybla *ca = inet_csk_ca(sk);
+	struct hybla *ca = tcp_ca(tp);
 
-	ca->rho_3ls = max_t(u32, tcp_sk(sk)->srtt / msecs_to_jiffies(rtt0), 8);
+	ca->rho_3ls = max_t(u32, tp->srtt / msecs_to_jiffies(rtt0), 8);
 	ca->rho = ca->rho_3ls >> 3;
 	ca->rho2_7ls = (ca->rho_3ls * ca->rho_3ls) << 1;
 	ca->rho2 = ca->rho2_7ls >>7;
 }
 
-static void hybla_init(struct sock *sk)
+static void hybla_init(struct tcp_sock *tp)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-	struct hybla *ca = inet_csk_ca(sk);
+	struct hybla *ca = tcp_ca(tp);
 
 	ca->rho = 0;
 	ca->rho2 = 0;
@@ -58,16 +57,17 @@ static void hybla_init(struct sock *sk)
 	tp->snd_cwnd_clamp = 65535;
 
 	/* 1st Rho measurement based on initial srtt */
-	hybla_recalc_param(sk);
+	hybla_recalc_param(tp);
 
 	/* set minimum rtt as this is the 1st ever seen */
 	ca->minrtt = tp->srtt;
 	tp->snd_cwnd = ca->rho;
 }
 
-static void hybla_state(struct sock *sk, u8 ca_state)
+static void hybla_state(struct tcp_sock *tp, u8 ca_state)
 {
-	struct hybla *ca = inet_csk_ca(sk);
+	struct hybla *ca = tcp_ca(tp);
+
 	ca->hybla_en = (ca_state == TCP_CA_Open);
 }
 
@@ -86,28 +86,27 @@ static inline u32 hybla_fraction(u32 odds)
  *     o Give cwnd a new value based on the model proposed
  *     o remember increments <1
  */
-static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 rtt,
+static void hybla_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
 			    u32 in_flight, int flag)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-	struct hybla *ca = inet_csk_ca(sk);
+	struct hybla *ca = tcp_ca(tp);
 	u32 increment, odd, rho_fractions;
 	int is_slowstart = 0;
 
 	/*  Recalculate rho only if this srtt is the lowest */
 	if (tp->srtt < ca->minrtt){
-		hybla_recalc_param(sk);
+		hybla_recalc_param(tp);
 		ca->minrtt = tp->srtt;
 	}
 
 	if (!ca->hybla_en)
-		return tcp_reno_cong_avoid(sk, ack, rtt, in_flight, flag);
+		return tcp_reno_cong_avoid(tp, ack, rtt, in_flight, flag);
 
 	if (in_flight < tp->snd_cwnd)
 		return;
 
 	if (ca->rho == 0)
-		hybla_recalc_param(sk);
+		hybla_recalc_param(tp);
 
 	rho_fractions = ca->rho_3ls - (ca->rho << 3);
 
@@ -171,7 +170,7 @@ static struct tcp_congestion_ops tcp_hybla = {
 
 static int __init hybla_register(void)
 {
-	BUG_ON(sizeof(struct hybla) > ICSK_CA_PRIV_SIZE);
+	BUG_ON(sizeof(struct hybla) > TCP_CA_PRIV_SIZE);
 	return tcp_register_congestion_control(&tcp_hybla);
 }
 
diff --git a/trunk/net/ipv4/tcp_input.c b/trunk/net/ipv4/tcp_input.c
index 1afb080bdf0c..53a8a5399f1e 100644
--- a/trunk/net/ipv4/tcp_input.c
+++ b/trunk/net/ipv4/tcp_input.c
@@ -114,21 +114,20 @@ int sysctl_tcp_moderate_rcvbuf = 1;
 /* Adapt the MSS value used to make delayed ack decision to the 
  * real world.
  */ 
-static inline void tcp_measure_rcv_mss(struct sock *sk,
-				       const struct sk_buff *skb)
+static inline void tcp_measure_rcv_mss(struct tcp_sock *tp,
+				       struct sk_buff *skb)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	const unsigned int lss = icsk->icsk_ack.last_seg_size; 
-	unsigned int len;
+	unsigned int len, lss;
 
-	icsk->icsk_ack.last_seg_size = 0; 
+	lss = tp->ack.last_seg_size; 
+	tp->ack.last_seg_size = 0; 
 
 	/* skb->len may jitter because of SACKs, even if peer
 	 * sends good full-sized frames.
 	 */
 	len = skb->len;
-	if (len >= icsk->icsk_ack.rcv_mss) {
-		icsk->icsk_ack.rcv_mss = len;
+	if (len >= tp->ack.rcv_mss) {
+		tp->ack.rcv_mss = len;
 	} else {
 		/* Otherwise, we make more careful check taking into account,
 		 * that SACKs block is variable.
@@ -148,44 +147,41 @@ static inline void tcp_measure_rcv_mss(struct sock *sk,
 			 * tcp header plus fixed timestamp option length.
 			 * Resulting "len" is MSS free of SACK jitter.
 			 */
-			len -= tcp_sk(sk)->tcp_header_len;
-			icsk->icsk_ack.last_seg_size = len;
+			len -= tp->tcp_header_len;
+			tp->ack.last_seg_size = len;
 			if (len == lss) {
-				icsk->icsk_ack.rcv_mss = len;
+				tp->ack.rcv_mss = len;
 				return;
 			}
 		}
-		icsk->icsk_ack.pending |= ICSK_ACK_PUSHED;
+		tp->ack.pending |= TCP_ACK_PUSHED;
 	}
 }
 
-static void tcp_incr_quickack(struct sock *sk)
+static void tcp_incr_quickack(struct tcp_sock *tp)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	unsigned quickacks = tcp_sk(sk)->rcv_wnd / (2 * icsk->icsk_ack.rcv_mss);
+	unsigned quickacks = tp->rcv_wnd/(2*tp->ack.rcv_mss);
 
 	if (quickacks==0)
 		quickacks=2;
-	if (quickacks > icsk->icsk_ack.quick)
-		icsk->icsk_ack.quick = min(quickacks, TCP_MAX_QUICKACKS);
+	if (quickacks > tp->ack.quick)
+		tp->ack.quick = min(quickacks, TCP_MAX_QUICKACKS);
 }
 
-void tcp_enter_quickack_mode(struct sock *sk)
+void tcp_enter_quickack_mode(struct tcp_sock *tp)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	tcp_incr_quickack(sk);
-	icsk->icsk_ack.pingpong = 0;
-	icsk->icsk_ack.ato = TCP_ATO_MIN;
+	tcp_incr_quickack(tp);
+	tp->ack.pingpong = 0;
+	tp->ack.ato = TCP_ATO_MIN;
 }
 
 /* Send ACKs quickly, if "quick" count is not exhausted
  * and the session is not interactive.
  */
 
-static inline int tcp_in_quickack_mode(const struct sock *sk)
+static __inline__ int tcp_in_quickack_mode(struct tcp_sock *tp)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	return icsk->icsk_ack.quick && !icsk->icsk_ack.pingpong;
+	return (tp->ack.quick && !tp->ack.pingpong);
 }
 
 /* Buffer size and advertised window tuning.
@@ -228,8 +224,8 @@ static void tcp_fixup_sndbuf(struct sock *sk)
  */
 
 /* Slow part of check#2. */
-static int __tcp_grow_window(const struct sock *sk, struct tcp_sock *tp,
-			     const struct sk_buff *skb)
+static int __tcp_grow_window(struct sock *sk, struct tcp_sock *tp,
+			     struct sk_buff *skb)
 {
 	/* Optimize this! */
 	int truesize = tcp_win_from_space(skb->truesize)/2;
@@ -237,7 +233,7 @@ static int __tcp_grow_window(const struct sock *sk, struct tcp_sock *tp,
 
 	while (tp->rcv_ssthresh <= window) {
 		if (truesize <= skb->len)
-			return 2 * inet_csk(sk)->icsk_ack.rcv_mss;
+			return 2*tp->ack.rcv_mss;
 
 		truesize >>= 1;
 		window >>= 1;
@@ -264,7 +260,7 @@ static inline void tcp_grow_window(struct sock *sk, struct tcp_sock *tp,
 
 		if (incr) {
 			tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr, tp->window_clamp);
-			inet_csk(sk)->icsk_ack.quick |= 1;
+			tp->ack.quick |= 1;
 		}
 	}
 }
@@ -325,12 +321,11 @@ static void tcp_init_buffer_space(struct sock *sk)
 /* 5. Recalculate window clamp after socket hit its memory bounds. */
 static void tcp_clamp_window(struct sock *sk, struct tcp_sock *tp)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct sk_buff *skb;
 	unsigned int app_win = tp->rcv_nxt - tp->copied_seq;
 	int ofo_win = 0;
 
-	icsk->icsk_ack.quick = 0;
+	tp->ack.quick = 0;
 
 	skb_queue_walk(&tp->out_of_order_queue, skb) {
 		ofo_win += skb->len;
@@ -351,8 +346,8 @@ static void tcp_clamp_window(struct sock *sk, struct tcp_sock *tp)
 		app_win += ofo_win;
 		if (atomic_read(&sk->sk_rmem_alloc) >= 2 * sk->sk_rcvbuf)
 			app_win >>= 1;
-		if (app_win > icsk->icsk_ack.rcv_mss)
-			app_win -= icsk->icsk_ack.rcv_mss;
+		if (app_win > tp->ack.rcv_mss)
+			app_win -= tp->ack.rcv_mss;
 		app_win = max(app_win, 2U*tp->advmss);
 
 		if (!ofo_win)
@@ -420,12 +415,11 @@ static inline void tcp_rcv_rtt_measure(struct tcp_sock *tp)
 	tp->rcv_rtt_est.time = tcp_time_stamp;
 }
 
-static inline void tcp_rcv_rtt_measure_ts(struct sock *sk, const struct sk_buff *skb)
+static inline void tcp_rcv_rtt_measure_ts(struct tcp_sock *tp, struct sk_buff *skb)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
 	if (tp->rx_opt.rcv_tsecr &&
 	    (TCP_SKB_CB(skb)->end_seq -
-	     TCP_SKB_CB(skb)->seq >= inet_csk(sk)->icsk_ack.rcv_mss))
+	     TCP_SKB_CB(skb)->seq >= tp->ack.rcv_mss))
 		tcp_rcv_rtt_update(tp, tcp_time_stamp - tp->rx_opt.rcv_tsecr, 0);
 }
 
@@ -498,42 +492,41 @@ void tcp_rcv_space_adjust(struct sock *sk)
  */
 static void tcp_event_data_recv(struct sock *sk, struct tcp_sock *tp, struct sk_buff *skb)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	u32 now;
 
-	inet_csk_schedule_ack(sk);
+	tcp_schedule_ack(tp);
 
-	tcp_measure_rcv_mss(sk, skb);
+	tcp_measure_rcv_mss(tp, skb);
 
 	tcp_rcv_rtt_measure(tp);
 	
 	now = tcp_time_stamp;
 
-	if (!icsk->icsk_ack.ato) {
+	if (!tp->ack.ato) {
 		/* The _first_ data packet received, initialize
 		 * delayed ACK engine.
 		 */
-		tcp_incr_quickack(sk);
-		icsk->icsk_ack.ato = TCP_ATO_MIN;
+		tcp_incr_quickack(tp);
+		tp->ack.ato = TCP_ATO_MIN;
 	} else {
-		int m = now - icsk->icsk_ack.lrcvtime;
+		int m = now - tp->ack.lrcvtime;
 
 		if (m <= TCP_ATO_MIN/2) {
 			/* The fastest case is the first. */
-			icsk->icsk_ack.ato = (icsk->icsk_ack.ato >> 1) + TCP_ATO_MIN / 2;
-		} else if (m < icsk->icsk_ack.ato) {
-			icsk->icsk_ack.ato = (icsk->icsk_ack.ato >> 1) + m;
-			if (icsk->icsk_ack.ato > icsk->icsk_rto)
-				icsk->icsk_ack.ato = icsk->icsk_rto;
-		} else if (m > icsk->icsk_rto) {
+			tp->ack.ato = (tp->ack.ato>>1) + TCP_ATO_MIN/2;
+		} else if (m < tp->ack.ato) {
+			tp->ack.ato = (tp->ack.ato>>1) + m;
+			if (tp->ack.ato > tp->rto)
+				tp->ack.ato = tp->rto;
+		} else if (m > tp->rto) {
 			/* Too long gap. Apparently sender falled to
 			 * restart window, so that we send ACKs quickly.
 			 */
-			tcp_incr_quickack(sk);
+			tcp_incr_quickack(tp);
 			sk_stream_mem_reclaim(sk);
 		}
 	}
-	icsk->icsk_ack.lrcvtime = now;
+	tp->ack.lrcvtime = now;
 
 	TCP_ECN_check_ce(tp, skb);
 
@@ -550,10 +543,8 @@ static void tcp_event_data_recv(struct sock *sk, struct tcp_sock *tp, struct sk_
  * To save cycles in the RFC 1323 implementation it was better to break
  * it up into three procedures. -- erics
  */
-static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt, u32 *usrtt)
+static void tcp_rtt_estimator(struct tcp_sock *tp, __u32 mrtt, u32 *usrtt)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-	const struct inet_connection_sock *icsk = inet_csk(sk);
 	long m = mrtt; /* RTT */
 
 	/*	The following amusing code comes from Jacobson's
@@ -613,16 +604,15 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt, u32 *usrtt)
 		tp->rtt_seq = tp->snd_nxt;
 	}
 
-	if (icsk->icsk_ca_ops->rtt_sample)
-		icsk->icsk_ca_ops->rtt_sample(sk, *usrtt);
+	if (tp->ca_ops->rtt_sample)
+		tp->ca_ops->rtt_sample(tp, *usrtt);
 }
 
 /* Calculate rto without backoff.  This is the second half of Van Jacobson's
  * routine referred to above.
  */
-static inline void tcp_set_rto(struct sock *sk)
+static inline void tcp_set_rto(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
 	/* Old crap is replaced with new one. 8)
 	 *
 	 * More seriously:
@@ -633,7 +623,7 @@ static inline void tcp_set_rto(struct sock *sk)
 	 *    is invisible. Actually, Linux-2.4 also generates erratic
 	 *    ACKs in some curcumstances.
 	 */
-	inet_csk(sk)->icsk_rto = (tp->srtt >> 3) + tp->rttvar;
+	tp->rto = (tp->srtt >> 3) + tp->rttvar;
 
 	/* 2. Fixups made earlier cannot be right.
 	 *    If we do not estimate RTO correctly without them,
@@ -645,10 +635,10 @@ static inline void tcp_set_rto(struct sock *sk)
 /* NOTE: clamping at TCP_RTO_MIN is not required, current algo
  * guarantees that rto is higher.
  */
-static inline void tcp_bound_rto(struct sock *sk)
+static inline void tcp_bound_rto(struct tcp_sock *tp)
 {
-	if (inet_csk(sk)->icsk_rto > TCP_RTO_MAX)
-		inet_csk(sk)->icsk_rto = TCP_RTO_MAX;
+	if (tp->rto > TCP_RTO_MAX)
+		tp->rto = TCP_RTO_MAX;
 }
 
 /* Save metrics learned by this TCP session.
@@ -666,10 +656,9 @@ void tcp_update_metrics(struct sock *sk)
 	dst_confirm(dst);
 
 	if (dst && (dst->flags&DST_HOST)) {
-		const struct inet_connection_sock *icsk = inet_csk(sk);
 		int m;
 
-		if (icsk->icsk_backoff || !tp->srtt) {
+		if (tp->backoff || !tp->srtt) {
 			/* This session failed to estimate rtt. Why?
 			 * Probably, no packets returned in time.
 			 * Reset our results.
@@ -718,7 +707,7 @@ void tcp_update_metrics(struct sock *sk)
 			    tp->snd_cwnd > dst_metric(dst, RTAX_CWND))
 				dst->metrics[RTAX_CWND-1] = tp->snd_cwnd;
 		} else if (tp->snd_cwnd > tp->snd_ssthresh &&
-			   icsk->icsk_ca_state == TCP_CA_Open) {
+			   tp->ca_state == TCP_CA_Open) {
 			/* Cong. avoidance phase, cwnd is reliable. */
 			if (!dst_metric_locked(dst, RTAX_SSTHRESH))
 				dst->metrics[RTAX_SSTHRESH-1] =
@@ -812,9 +801,9 @@ static void tcp_init_metrics(struct sock *sk)
 		tp->mdev = dst_metric(dst, RTAX_RTTVAR);
 		tp->mdev_max = tp->rttvar = max(tp->mdev, TCP_RTO_MIN);
 	}
-	tcp_set_rto(sk);
-	tcp_bound_rto(sk);
-	if (inet_csk(sk)->icsk_rto < TCP_TIMEOUT_INIT && !tp->rx_opt.saw_tstamp)
+	tcp_set_rto(tp);
+	tcp_bound_rto(tp);
+	if (tp->rto < TCP_TIMEOUT_INIT && !tp->rx_opt.saw_tstamp)
 		goto reset;
 	tp->snd_cwnd = tcp_init_cwnd(tp, dst);
 	tp->snd_cwnd_stamp = tcp_time_stamp;
@@ -828,14 +817,12 @@ static void tcp_init_metrics(struct sock *sk)
 	if (!tp->rx_opt.saw_tstamp && tp->srtt) {
 		tp->srtt = 0;
 		tp->mdev = tp->mdev_max = tp->rttvar = TCP_TIMEOUT_INIT;
-		inet_csk(sk)->icsk_rto = TCP_TIMEOUT_INIT;
+		tp->rto = TCP_TIMEOUT_INIT;
 	}
 }
 
-static void tcp_update_reordering(struct sock *sk, const int metric,
-				  const int ts)
+static void tcp_update_reordering(struct tcp_sock *tp, int metric, int ts)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
 	if (metric > tp->reordering) {
 		tp->reordering = min(TCP_MAX_REORDERING, metric);
 
@@ -850,7 +837,7 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
 			NET_INC_STATS_BH(LINUX_MIB_TCPSACKREORDER);
 #if FASTRETRANS_DEBUG > 1
 		printk(KERN_DEBUG "Disorder%d %d %u f%u s%u rr%d\n",
-		       tp->rx_opt.sack_ok, inet_csk(sk)->icsk_ca_state,
+		       tp->rx_opt.sack_ok, tp->ca_state,
 		       tp->reordering,
 		       tp->fackets_out,
 		       tp->sacked_out,
@@ -912,7 +899,6 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
 static int
 tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_una)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	unsigned char *ptr = ack_skb->h.raw + TCP_SKB_CB(ack_skb)->sacked;
 	struct tcp_sack_block *sp = (struct tcp_sack_block *)(ptr+2);
@@ -1078,7 +1064,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
 	 * we have to account for reordering! Ugly,
 	 * but should help.
 	 */
-	if (lost_retrans && icsk->icsk_ca_state == TCP_CA_Recovery) {
+	if (lost_retrans && tp->ca_state == TCP_CA_Recovery) {
 		struct sk_buff *skb;
 
 		sk_stream_for_retrans_queue(skb, sk) {
@@ -1107,8 +1093,8 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
 
 	tp->left_out = tp->sacked_out + tp->lost_out;
 
-	if ((reord < tp->fackets_out) && icsk->icsk_ca_state != TCP_CA_Loss)
-		tcp_update_reordering(sk, ((tp->fackets_out + 1) - reord), 0);
+	if ((reord < tp->fackets_out) && tp->ca_state != TCP_CA_Loss)
+		tcp_update_reordering(tp, ((tp->fackets_out + 1) - reord), 0);
 
 #if FASTRETRANS_DEBUG > 0
 	BUG_TRAP((int)tp->sacked_out >= 0);
@@ -1125,18 +1111,17 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
  */
 void tcp_enter_frto(struct sock *sk)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	struct sk_buff *skb;
 
 	tp->frto_counter = 1;
 
-	if (icsk->icsk_ca_state <= TCP_CA_Disorder ||
+	if (tp->ca_state <= TCP_CA_Disorder ||
             tp->snd_una == tp->high_seq ||
-            (icsk->icsk_ca_state == TCP_CA_Loss && !icsk->icsk_retransmits)) {
-		tp->prior_ssthresh = tcp_current_ssthresh(sk);
-		tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
-		tcp_ca_event(sk, CA_EVENT_FRTO);
+            (tp->ca_state == TCP_CA_Loss && !tp->retransmits)) {
+		tp->prior_ssthresh = tcp_current_ssthresh(tp);
+		tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
+		tcp_ca_event(tp, CA_EVENT_FRTO);
 	}
 
 	/* Have to clear retransmission markers here to keep the bookkeeping
@@ -1153,7 +1138,7 @@ void tcp_enter_frto(struct sock *sk)
 	}
 	tcp_sync_left_out(tp);
 
-	tcp_set_ca_state(sk, TCP_CA_Open);
+	tcp_set_ca_state(tp, TCP_CA_Open);
 	tp->frto_highmark = tp->snd_nxt;
 }
 
@@ -1199,7 +1184,7 @@ static void tcp_enter_frto_loss(struct sock *sk)
 
 	tp->reordering = min_t(unsigned int, tp->reordering,
 					     sysctl_tcp_reordering);
-	tcp_set_ca_state(sk, TCP_CA_Loss);
+	tcp_set_ca_state(tp, TCP_CA_Loss);
 	tp->high_seq = tp->frto_highmark;
 	TCP_ECN_queue_cwr(tp);
 }
@@ -1223,17 +1208,16 @@ void tcp_clear_retrans(struct tcp_sock *tp)
  */
 void tcp_enter_loss(struct sock *sk, int how)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	struct sk_buff *skb;
 	int cnt = 0;
 
 	/* Reduce ssthresh if it has not yet been made inside this window. */
-	if (icsk->icsk_ca_state <= TCP_CA_Disorder || tp->snd_una == tp->high_seq ||
-	    (icsk->icsk_ca_state == TCP_CA_Loss && !icsk->icsk_retransmits)) {
-		tp->prior_ssthresh = tcp_current_ssthresh(sk);
-		tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
-		tcp_ca_event(sk, CA_EVENT_LOSS);
+	if (tp->ca_state <= TCP_CA_Disorder || tp->snd_una == tp->high_seq ||
+	    (tp->ca_state == TCP_CA_Loss && !tp->retransmits)) {
+		tp->prior_ssthresh = tcp_current_ssthresh(tp);
+		tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
+		tcp_ca_event(tp, CA_EVENT_LOSS);
 	}
 	tp->snd_cwnd	   = 1;
 	tp->snd_cwnd_cnt   = 0;
@@ -1264,12 +1248,12 @@ void tcp_enter_loss(struct sock *sk, int how)
 
 	tp->reordering = min_t(unsigned int, tp->reordering,
 					     sysctl_tcp_reordering);
-	tcp_set_ca_state(sk, TCP_CA_Loss);
+	tcp_set_ca_state(tp, TCP_CA_Loss);
 	tp->high_seq = tp->snd_nxt;
 	TCP_ECN_queue_cwr(tp);
 }
 
-static int tcp_check_sack_reneging(struct sock *sk)
+static int tcp_check_sack_reneging(struct sock *sk, struct tcp_sock *tp)
 {
 	struct sk_buff *skb;
 
@@ -1281,14 +1265,12 @@ static int tcp_check_sack_reneging(struct sock *sk)
 	 */
 	if ((skb = skb_peek(&sk->sk_write_queue)) != NULL &&
 	    (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)) {
-		struct inet_connection_sock *icsk = inet_csk(sk);
 		NET_INC_STATS_BH(LINUX_MIB_TCPSACKRENEGING);
 
 		tcp_enter_loss(sk, 1);
-		icsk->icsk_retransmits++;
+		tp->retransmits++;
 		tcp_retransmit_skb(sk, skb_peek(&sk->sk_write_queue));
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-					  icsk->icsk_rto, TCP_RTO_MAX);
+		tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS, tp->rto);
 		return 1;
 	}
 	return 0;
@@ -1299,15 +1281,15 @@ static inline int tcp_fackets_out(struct tcp_sock *tp)
 	return IsReno(tp) ? tp->sacked_out+1 : tp->fackets_out;
 }
 
-static inline int tcp_skb_timedout(struct sock *sk, struct sk_buff *skb)
+static inline int tcp_skb_timedout(struct tcp_sock *tp, struct sk_buff *skb)
 {
-	return (tcp_time_stamp - TCP_SKB_CB(skb)->when > inet_csk(sk)->icsk_rto);
+	return (tcp_time_stamp - TCP_SKB_CB(skb)->when > tp->rto);
 }
 
 static inline int tcp_head_timedout(struct sock *sk, struct tcp_sock *tp)
 {
 	return tp->packets_out &&
-	       tcp_skb_timedout(sk, skb_peek(&sk->sk_write_queue));
+	       tcp_skb_timedout(tp, skb_peek(&sk->sk_write_queue));
 }
 
 /* Linux NewReno/SACK/FACK/ECN state machine.
@@ -1441,9 +1423,8 @@ static int tcp_time_to_recover(struct sock *sk, struct tcp_sock *tp)
  * in assumption of absent reordering, interpret this as reordering.
  * The only another reason could be bug in receiver TCP.
  */
-static void tcp_check_reno_reordering(struct sock *sk, const int addend)
+static void tcp_check_reno_reordering(struct tcp_sock *tp, int addend)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
 	u32 holes;
 
 	holes = max(tp->lost_out, 1U);
@@ -1451,17 +1432,16 @@ static void tcp_check_reno_reordering(struct sock *sk, const int addend)
 
 	if ((tp->sacked_out + holes) > tp->packets_out) {
 		tp->sacked_out = tp->packets_out - holes;
-		tcp_update_reordering(sk, tp->packets_out + addend, 0);
+		tcp_update_reordering(tp, tp->packets_out+addend, 0);
 	}
 }
 
 /* Emulate SACKs for SACKless connection: account for a new dupack. */
 
-static void tcp_add_reno_sack(struct sock *sk)
+static void tcp_add_reno_sack(struct tcp_sock *tp)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
 	tp->sacked_out++;
-	tcp_check_reno_reordering(sk, 0);
+	tcp_check_reno_reordering(tp, 0);
 	tcp_sync_left_out(tp);
 }
 
@@ -1476,7 +1456,7 @@ static void tcp_remove_reno_sacks(struct sock *sk, struct tcp_sock *tp, int acke
 		else
 			tp->sacked_out -= acked-1;
 	}
-	tcp_check_reno_reordering(sk, acked);
+	tcp_check_reno_reordering(tp, acked);
 	tcp_sync_left_out(tp);
 }
 
@@ -1529,7 +1509,7 @@ static void tcp_update_scoreboard(struct sock *sk, struct tcp_sock *tp)
 		struct sk_buff *skb;
 
 		sk_stream_for_retrans_queue(skb, sk) {
-			if (tcp_skb_timedout(sk, skb) &&
+			if (tcp_skb_timedout(tp, skb) &&
 			    !(TCP_SKB_CB(skb)->sacked&TCPCB_TAGBITS)) {
 				TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
 				tp->lost_out += tcp_skb_pcount(skb);
@@ -1550,16 +1530,14 @@ static inline void tcp_moderate_cwnd(struct tcp_sock *tp)
 }
 
 /* Decrease cwnd each second ack. */
-static void tcp_cwnd_down(struct sock *sk)
+static void tcp_cwnd_down(struct tcp_sock *tp)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	struct tcp_sock *tp = tcp_sk(sk);
 	int decr = tp->snd_cwnd_cnt + 1;
 
 	tp->snd_cwnd_cnt = decr&1;
 	decr >>= 1;
 
-	if (decr && tp->snd_cwnd > icsk->icsk_ca_ops->min_cwnd(sk))
+	if (decr && tp->snd_cwnd > tp->ca_ops->min_cwnd(tp))
 		tp->snd_cwnd -= decr;
 
 	tp->snd_cwnd = min(tp->snd_cwnd, tcp_packets_in_flight(tp)+1);
@@ -1593,15 +1571,11 @@ static void DBGUNDO(struct sock *sk, struct tcp_sock *tp, const char *msg)
 #define DBGUNDO(x...) do { } while (0)
 #endif
 
-static void tcp_undo_cwr(struct sock *sk, const int undo)
+static void tcp_undo_cwr(struct tcp_sock *tp, int undo)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-
 	if (tp->prior_ssthresh) {
-		const struct inet_connection_sock *icsk = inet_csk(sk);
-
-		if (icsk->icsk_ca_ops->undo_cwnd)
-			tp->snd_cwnd = icsk->icsk_ca_ops->undo_cwnd(sk);
+		if (tp->ca_ops->undo_cwnd)
+			tp->snd_cwnd = tp->ca_ops->undo_cwnd(tp);
 		else
 			tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh<<1);
 
@@ -1629,9 +1603,9 @@ static int tcp_try_undo_recovery(struct sock *sk, struct tcp_sock *tp)
 		/* Happy end! We did not retransmit anything
 		 * or our original transmission succeeded.
 		 */
-		DBGUNDO(sk, tp, inet_csk(sk)->icsk_ca_state == TCP_CA_Loss ? "loss" : "retrans");
-		tcp_undo_cwr(sk, 1);
-		if (inet_csk(sk)->icsk_ca_state == TCP_CA_Loss)
+		DBGUNDO(sk, tp, tp->ca_state == TCP_CA_Loss ? "loss" : "retrans");
+		tcp_undo_cwr(tp, 1);
+		if (tp->ca_state == TCP_CA_Loss)
 			NET_INC_STATS_BH(LINUX_MIB_TCPLOSSUNDO);
 		else
 			NET_INC_STATS_BH(LINUX_MIB_TCPFULLUNDO);
@@ -1644,7 +1618,7 @@ static int tcp_try_undo_recovery(struct sock *sk, struct tcp_sock *tp)
 		tcp_moderate_cwnd(tp);
 		return 1;
 	}
-	tcp_set_ca_state(sk, TCP_CA_Open);
+	tcp_set_ca_state(tp, TCP_CA_Open);
 	return 0;
 }
 
@@ -1653,7 +1627,7 @@ static void tcp_try_undo_dsack(struct sock *sk, struct tcp_sock *tp)
 {
 	if (tp->undo_marker && !tp->undo_retrans) {
 		DBGUNDO(sk, tp, "D-SACK");
-		tcp_undo_cwr(sk, 1);
+		tcp_undo_cwr(tp, 1);
 		tp->undo_marker = 0;
 		NET_INC_STATS_BH(LINUX_MIB_TCPDSACKUNDO);
 	}
@@ -1674,10 +1648,10 @@ static int tcp_try_undo_partial(struct sock *sk, struct tcp_sock *tp,
 		if (tp->retrans_out == 0)
 			tp->retrans_stamp = 0;
 
-		tcp_update_reordering(sk, tcp_fackets_out(tp) + acked, 1);
+		tcp_update_reordering(tp, tcp_fackets_out(tp)+acked, 1);
 
 		DBGUNDO(sk, tp, "Hoe");
-		tcp_undo_cwr(sk, 0);
+		tcp_undo_cwr(tp, 0);
 		NET_INC_STATS_BH(LINUX_MIB_TCPPARTIALUNDO);
 
 		/* So... Do not make Hoe's retransmit yet.
@@ -1700,23 +1674,22 @@ static int tcp_try_undo_loss(struct sock *sk, struct tcp_sock *tp)
 		DBGUNDO(sk, tp, "partial loss");
 		tp->lost_out = 0;
 		tp->left_out = tp->sacked_out;
-		tcp_undo_cwr(sk, 1);
+		tcp_undo_cwr(tp, 1);
 		NET_INC_STATS_BH(LINUX_MIB_TCPLOSSUNDO);
-		inet_csk(sk)->icsk_retransmits = 0;
+		tp->retransmits = 0;
 		tp->undo_marker = 0;
 		if (!IsReno(tp))
-			tcp_set_ca_state(sk, TCP_CA_Open);
+			tcp_set_ca_state(tp, TCP_CA_Open);
 		return 1;
 	}
 	return 0;
 }
 
-static inline void tcp_complete_cwr(struct sock *sk)
+static inline void tcp_complete_cwr(struct tcp_sock *tp)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
 	tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
 	tp->snd_cwnd_stamp = tcp_time_stamp;
-	tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
+	tcp_ca_event(tp, CA_EVENT_COMPLETE_CWR);
 }
 
 static void tcp_try_to_open(struct sock *sk, struct tcp_sock *tp, int flag)
@@ -1727,21 +1700,21 @@ static void tcp_try_to_open(struct sock *sk, struct tcp_sock *tp, int flag)
 		tp->retrans_stamp = 0;
 
 	if (flag&FLAG_ECE)
-		tcp_enter_cwr(sk);
+		tcp_enter_cwr(tp);
 
-	if (inet_csk(sk)->icsk_ca_state != TCP_CA_CWR) {
+	if (tp->ca_state != TCP_CA_CWR) {
 		int state = TCP_CA_Open;
 
 		if (tp->left_out || tp->retrans_out || tp->undo_marker)
 			state = TCP_CA_Disorder;
 
-		if (inet_csk(sk)->icsk_ca_state != state) {
-			tcp_set_ca_state(sk, state);
+		if (tp->ca_state != state) {
+			tcp_set_ca_state(tp, state);
 			tp->high_seq = tp->snd_nxt;
 		}
 		tcp_moderate_cwnd(tp);
 	} else {
-		tcp_cwnd_down(sk);
+		tcp_cwnd_down(tp);
 	}
 }
 
@@ -1760,7 +1733,6 @@ static void
 tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 		      int prior_packets, int flag)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	int is_dupack = (tp->snd_una == prior_snd_una && !(flag&FLAG_NOT_DUP));
 
@@ -1778,13 +1750,13 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 		tp->prior_ssthresh = 0;
 
 	/* B. In all the states check for reneging SACKs. */
-	if (tp->sacked_out && tcp_check_sack_reneging(sk))
+	if (tp->sacked_out && tcp_check_sack_reneging(sk, tp))
 		return;
 
 	/* C. Process data loss notification, provided it is valid. */
 	if ((flag&FLAG_DATA_LOST) &&
 	    before(tp->snd_una, tp->high_seq) &&
-	    icsk->icsk_ca_state != TCP_CA_Open &&
+	    tp->ca_state != TCP_CA_Open &&
 	    tp->fackets_out > tp->reordering) {
 		tcp_mark_head_lost(sk, tp, tp->fackets_out-tp->reordering, tp->high_seq);
 		NET_INC_STATS_BH(LINUX_MIB_TCPLOSS);
@@ -1795,14 +1767,14 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 
 	/* E. Check state exit conditions. State can be terminated
 	 *    when high_seq is ACKed. */
-	if (icsk->icsk_ca_state == TCP_CA_Open) {
+	if (tp->ca_state == TCP_CA_Open) {
 		if (!sysctl_tcp_frto)
 			BUG_TRAP(tp->retrans_out == 0);
 		tp->retrans_stamp = 0;
 	} else if (!before(tp->snd_una, tp->high_seq)) {
-		switch (icsk->icsk_ca_state) {
+		switch (tp->ca_state) {
 		case TCP_CA_Loss:
-			icsk->icsk_retransmits = 0;
+			tp->retransmits = 0;
 			if (tcp_try_undo_recovery(sk, tp))
 				return;
 			break;
@@ -1811,8 +1783,8 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 			/* CWR is to be held something *above* high_seq
 			 * is ACKed for CWR bit to reach receiver. */
 			if (tp->snd_una != tp->high_seq) {
-				tcp_complete_cwr(sk);
-				tcp_set_ca_state(sk, TCP_CA_Open);
+				tcp_complete_cwr(tp);
+				tcp_set_ca_state(tp, TCP_CA_Open);
 			}
 			break;
 
@@ -1823,7 +1795,7 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 			     * catching for all duplicate ACKs. */
 			    IsReno(tp) || tp->snd_una != tp->high_seq) {
 				tp->undo_marker = 0;
-				tcp_set_ca_state(sk, TCP_CA_Open);
+				tcp_set_ca_state(tp, TCP_CA_Open);
 			}
 			break;
 
@@ -1832,17 +1804,17 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 				tcp_reset_reno_sack(tp);
 			if (tcp_try_undo_recovery(sk, tp))
 				return;
-			tcp_complete_cwr(sk);
+			tcp_complete_cwr(tp);
 			break;
 		}
 	}
 
 	/* F. Process state. */
-	switch (icsk->icsk_ca_state) {
+	switch (tp->ca_state) {
 	case TCP_CA_Recovery:
 		if (prior_snd_una == tp->snd_una) {
 			if (IsReno(tp) && is_dupack)
-				tcp_add_reno_sack(sk);
+				tcp_add_reno_sack(tp);
 		} else {
 			int acked = prior_packets - tp->packets_out;
 			if (IsReno(tp))
@@ -1852,13 +1824,13 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 		break;
 	case TCP_CA_Loss:
 		if (flag&FLAG_DATA_ACKED)
-			icsk->icsk_retransmits = 0;
+			tp->retransmits = 0;
 		if (!tcp_try_undo_loss(sk, tp)) {
 			tcp_moderate_cwnd(tp);
 			tcp_xmit_retransmit_queue(sk);
 			return;
 		}
-		if (icsk->icsk_ca_state != TCP_CA_Open)
+		if (tp->ca_state != TCP_CA_Open)
 			return;
 		/* Loss is undone; fall through to processing in Open state. */
 	default:
@@ -1866,10 +1838,10 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 			if (tp->snd_una != prior_snd_una)
 				tcp_reset_reno_sack(tp);
 			if (is_dupack)
-				tcp_add_reno_sack(sk);
+				tcp_add_reno_sack(tp);
 		}
 
-		if (icsk->icsk_ca_state == TCP_CA_Disorder)
+		if (tp->ca_state == TCP_CA_Disorder)
 			tcp_try_undo_dsack(sk, tp);
 
 		if (!tcp_time_to_recover(sk, tp)) {
@@ -1889,28 +1861,30 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 		tp->undo_marker = tp->snd_una;
 		tp->undo_retrans = tp->retrans_out;
 
-		if (icsk->icsk_ca_state < TCP_CA_CWR) {
+		if (tp->ca_state < TCP_CA_CWR) {
 			if (!(flag&FLAG_ECE))
-				tp->prior_ssthresh = tcp_current_ssthresh(sk);
-			tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
+				tp->prior_ssthresh = tcp_current_ssthresh(tp);
+			tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
 			TCP_ECN_queue_cwr(tp);
 		}
 
 		tp->snd_cwnd_cnt = 0;
-		tcp_set_ca_state(sk, TCP_CA_Recovery);
+		tcp_set_ca_state(tp, TCP_CA_Recovery);
 	}
 
 	if (is_dupack || tcp_head_timedout(sk, tp))
 		tcp_update_scoreboard(sk, tp);
-	tcp_cwnd_down(sk);
+	tcp_cwnd_down(tp);
 	tcp_xmit_retransmit_queue(sk);
 }
 
 /* Read draft-ietf-tcplw-high-performance before mucking
  * with this code. (Superceeds RFC1323)
  */
-static void tcp_ack_saw_tstamp(struct sock *sk, u32 *usrtt, int flag)
+static void tcp_ack_saw_tstamp(struct tcp_sock *tp, u32 *usrtt, int flag)
 {
+	__u32 seq_rtt;
+
 	/* RTTM Rule: A TSecr value received in a segment is used to
 	 * update the averaged RTT measurement only if the segment
 	 * acknowledges some new data, i.e., only if it advances the
@@ -1926,15 +1900,14 @@ static void tcp_ack_saw_tstamp(struct sock *sk, u32 *usrtt, int flag)
 	 * answer arrives rto becomes 120 seconds! If at least one of segments
 	 * in window is lost... Voila.	 			--ANK (010210)
 	 */
-	struct tcp_sock *tp = tcp_sk(sk);
-	const __u32 seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
-	tcp_rtt_estimator(sk, seq_rtt, usrtt);
-	tcp_set_rto(sk);
-	inet_csk(sk)->icsk_backoff = 0;
-	tcp_bound_rto(sk);
+	seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
+	tcp_rtt_estimator(tp, seq_rtt, usrtt);
+	tcp_set_rto(tp);
+	tp->backoff = 0;
+	tcp_bound_rto(tp);
 }
 
-static void tcp_ack_no_tstamp(struct sock *sk, u32 seq_rtt, u32 *usrtt, int flag)
+static void tcp_ack_no_tstamp(struct tcp_sock *tp, u32 seq_rtt, u32 *usrtt, int flag)
 {
 	/* We don't have a timestamp. Can only use
 	 * packets that are not retransmitted to determine
@@ -1948,29 +1921,27 @@ static void tcp_ack_no_tstamp(struct sock *sk, u32 seq_rtt, u32 *usrtt, int flag
 	if (flag & FLAG_RETRANS_DATA_ACKED)
 		return;
 
-	tcp_rtt_estimator(sk, seq_rtt, usrtt);
-	tcp_set_rto(sk);
-	inet_csk(sk)->icsk_backoff = 0;
-	tcp_bound_rto(sk);
+	tcp_rtt_estimator(tp, seq_rtt, usrtt);
+	tcp_set_rto(tp);
+	tp->backoff = 0;
+	tcp_bound_rto(tp);
 }
 
-static inline void tcp_ack_update_rtt(struct sock *sk, const int flag,
-				      const s32 seq_rtt, u32 *usrtt)
+static inline void tcp_ack_update_rtt(struct tcp_sock *tp,
+				      int flag, s32 seq_rtt, u32 *usrtt)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
 	/* Note that peer MAY send zero echo. In this case it is ignored. (rfc1323) */
 	if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
-		tcp_ack_saw_tstamp(sk, usrtt, flag);
+		tcp_ack_saw_tstamp(tp, usrtt, flag);
 	else if (seq_rtt >= 0)
-		tcp_ack_no_tstamp(sk, seq_rtt, usrtt, flag);
+		tcp_ack_no_tstamp(tp, seq_rtt, usrtt, flag);
 }
 
-static inline void tcp_cong_avoid(struct sock *sk, u32 ack, u32 rtt,
+static inline void tcp_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
 				  u32 in_flight, int good)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	icsk->icsk_ca_ops->cong_avoid(sk, ack, rtt, in_flight, good);
-	tcp_sk(sk)->snd_cwnd_stamp = tcp_time_stamp;
+	tp->ca_ops->cong_avoid(tp, ack, rtt, in_flight, good);
+	tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
 /* Restart timer after forward progress on connection.
@@ -1980,9 +1951,9 @@ static inline void tcp_cong_avoid(struct sock *sk, u32 ack, u32 rtt,
 static inline void tcp_ack_packets_out(struct sock *sk, struct tcp_sock *tp)
 {
 	if (!tp->packets_out) {
-		inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
+		tcp_clear_xmit_timer(sk, TCP_TIME_RETRANS);
 	} else {
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
+		tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS, tp->rto);
 	}
 }
 
@@ -2097,13 +2068,9 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p, s32 *seq_usrtt
 				seq_rtt = -1;
 			} else if (seq_rtt < 0)
 				seq_rtt = now - scb->when;
-			if (seq_usrtt) {
-				struct timeval tv;
-			
-				skb_get_timestamp(skb, &tv);
-				*seq_usrtt = (usnow.tv_sec - tv.tv_sec) * 1000000
-					+ (usnow.tv_usec - tv.tv_usec);
-			}
+			if (seq_usrtt)
+				*seq_usrtt = (usnow.tv_sec - skb->stamp.tv_sec) * 1000000
+					+ (usnow.tv_usec - skb->stamp.tv_usec);
 
 			if (sacked & TCPCB_SACKED_ACKED)
 				tp->sacked_out -= tcp_skb_pcount(skb);
@@ -2118,17 +2085,16 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p, s32 *seq_usrtt
 			seq_rtt = now - scb->when;
 		tcp_dec_pcount_approx(&tp->fackets_out, skb);
 		tcp_packets_out_dec(tp, skb);
-		__skb_unlink(skb, &sk->sk_write_queue);
+		__skb_unlink(skb, skb->list);
 		sk_stream_free_skb(sk, skb);
 	}
 
 	if (acked&FLAG_ACKED) {
-		const struct inet_connection_sock *icsk = inet_csk(sk);
-		tcp_ack_update_rtt(sk, acked, seq_rtt, seq_usrtt);
+		tcp_ack_update_rtt(tp, acked, seq_rtt, seq_usrtt);
 		tcp_ack_packets_out(sk, tp);
 
-		if (icsk->icsk_ca_ops->pkts_acked)
-			icsk->icsk_ca_ops->pkts_acked(sk, pkts_acked);
+		if (tp->ca_ops->pkts_acked)
+			tp->ca_ops->pkts_acked(tp, pkts_acked);
 	}
 
 #if FASTRETRANS_DEBUG > 0
@@ -2136,20 +2102,19 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p, s32 *seq_usrtt
 	BUG_TRAP((int)tp->lost_out >= 0);
 	BUG_TRAP((int)tp->retrans_out >= 0);
 	if (!tp->packets_out && tp->rx_opt.sack_ok) {
-		const struct inet_connection_sock *icsk = inet_csk(sk);
 		if (tp->lost_out) {
 			printk(KERN_DEBUG "Leak l=%u %d\n",
-			       tp->lost_out, icsk->icsk_ca_state);
+			       tp->lost_out, tp->ca_state);
 			tp->lost_out = 0;
 		}
 		if (tp->sacked_out) {
 			printk(KERN_DEBUG "Leak s=%u %d\n",
-			       tp->sacked_out, icsk->icsk_ca_state);
+			       tp->sacked_out, tp->ca_state);
 			tp->sacked_out = 0;
 		}
 		if (tp->retrans_out) {
 			printk(KERN_DEBUG "Leak r=%u %d\n",
-			       tp->retrans_out, icsk->icsk_ca_state);
+			       tp->retrans_out, tp->ca_state);
 			tp->retrans_out = 0;
 		}
 	}
@@ -2160,43 +2125,40 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p, s32 *seq_usrtt
 
 static void tcp_ack_probe(struct sock *sk)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct inet_connection_sock *icsk = inet_csk(sk);
+	struct tcp_sock *tp = tcp_sk(sk);
 
 	/* Was it a usable window open? */
 
 	if (!after(TCP_SKB_CB(sk->sk_send_head)->end_seq,
 		   tp->snd_una + tp->snd_wnd)) {
-		icsk->icsk_backoff = 0;
-		inet_csk_clear_xmit_timer(sk, ICSK_TIME_PROBE0);
+		tp->backoff = 0;
+		tcp_clear_xmit_timer(sk, TCP_TIME_PROBE0);
 		/* Socket must be waked up by subsequent tcp_data_snd_check().
 		 * This function is not for random using!
 		 */
 	} else {
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
-					  min(icsk->icsk_rto << icsk->icsk_backoff, TCP_RTO_MAX),
-					  TCP_RTO_MAX);
+		tcp_reset_xmit_timer(sk, TCP_TIME_PROBE0,
+				     min(tp->rto << tp->backoff, TCP_RTO_MAX));
 	}
 }
 
-static inline int tcp_ack_is_dubious(const struct sock *sk, const int flag)
+static inline int tcp_ack_is_dubious(struct tcp_sock *tp, int flag)
 {
 	return (!(flag & FLAG_NOT_DUP) || (flag & FLAG_CA_ALERT) ||
-		inet_csk(sk)->icsk_ca_state != TCP_CA_Open);
+		tp->ca_state != TCP_CA_Open);
 }
 
-static inline int tcp_may_raise_cwnd(const struct sock *sk, const int flag)
+static inline int tcp_may_raise_cwnd(struct tcp_sock *tp, int flag)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
 	return (!(flag & FLAG_ECE) || tp->snd_cwnd < tp->snd_ssthresh) &&
-		!((1 << inet_csk(sk)->icsk_ca_state) & (TCPF_CA_Recovery | TCPF_CA_CWR));
+		!((1<<tp->ca_state)&(TCPF_CA_Recovery|TCPF_CA_CWR));
 }
 
 /* Check that window update is acceptable.
  * The function assumes that snd_una<=ack<=snd_next.
  */
-static inline int tcp_may_update_window(const struct tcp_sock *tp, const u32 ack,
-					const u32 ack_seq, const u32 nwin)
+static inline int tcp_may_update_window(struct tcp_sock *tp, u32 ack,
+					u32 ack_seq, u32 nwin)
 {
 	return (after(ack, tp->snd_una) ||
 		after(ack_seq, tp->snd_wl1) ||
@@ -2279,7 +2241,6 @@ static void tcp_process_frto(struct sock *sk, u32 prior_snd_una)
 /* This routine deals with incoming acks, but not outgoing ones. */
 static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	u32 prior_snd_una = tp->snd_una;
 	u32 ack_seq = TCP_SKB_CB(skb)->seq;
@@ -2307,7 +2268,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
 		tp->snd_una = ack;
 		flag |= FLAG_WIN_UPDATE;
 
-		tcp_ca_event(sk, CA_EVENT_FAST_ACK);
+		tcp_ca_event(tp, CA_EVENT_FAST_ACK);
 
 		NET_INC_STATS_BH(LINUX_MIB_TCPHPACKS);
 	} else {
@@ -2324,7 +2285,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
 		if (TCP_ECN_rcv_ecn_echo(tp, skb->h.th))
 			flag |= FLAG_ECE;
 
-		tcp_ca_event(sk, CA_EVENT_SLOW_ACK);
+		tcp_ca_event(tp, CA_EVENT_SLOW_ACK);
 	}
 
 	/* We passed data and got it acked, remove any soft error
@@ -2340,19 +2301,19 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
 
 	/* See if we can take anything off of the retransmit queue. */
 	flag |= tcp_clean_rtx_queue(sk, &seq_rtt,
-				    icsk->icsk_ca_ops->rtt_sample ? &seq_usrtt : NULL);
+				    tp->ca_ops->rtt_sample ? &seq_usrtt : NULL);
 
 	if (tp->frto_counter)
 		tcp_process_frto(sk, prior_snd_una);
 
-	if (tcp_ack_is_dubious(sk, flag)) {
+	if (tcp_ack_is_dubious(tp, flag)) {
 		/* Advanve CWND, if state allows this. */
-		if ((flag & FLAG_DATA_ACKED) && tcp_may_raise_cwnd(sk, flag))
-			tcp_cong_avoid(sk, ack,  seq_rtt, prior_in_flight, 0);
+		if ((flag & FLAG_DATA_ACKED) && tcp_may_raise_cwnd(tp, flag))
+			tcp_cong_avoid(tp, ack,  seq_rtt, prior_in_flight, 0);
 		tcp_fastretrans_alert(sk, prior_snd_una, prior_packets, flag);
 	} else {
 		if ((flag & FLAG_DATA_ACKED))
-			tcp_cong_avoid(sk, ack, seq_rtt, prior_in_flight, 1);
+			tcp_cong_avoid(tp, ack, seq_rtt, prior_in_flight, 1);
 	}
 
 	if ((flag & FLAG_FORWARD_PROGRESS) || !(flag&FLAG_NOT_DUP))
@@ -2361,7 +2322,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
 	return 1;
 
 no_queue:
-	icsk->icsk_probes_out = 0;
+	tp->probes_out = 0;
 
 	/* If this ack opens up a zero window, clear backoff.  It was
 	 * being used to time the probes, and is probably far higher than
@@ -2539,9 +2500,8 @@ static inline void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq)
  * up to bandwidth of 18Gigabit/sec. 8) ]
  */
 
-static int tcp_disordered_ack(const struct sock *sk, const struct sk_buff *skb)
+static int tcp_disordered_ack(struct tcp_sock *tp, struct sk_buff *skb)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
 	struct tcphdr *th = skb->h.th;
 	u32 seq = TCP_SKB_CB(skb)->seq;
 	u32 ack = TCP_SKB_CB(skb)->ack_seq;
@@ -2556,15 +2516,14 @@ static int tcp_disordered_ack(const struct sock *sk, const struct sk_buff *skb)
 		!tcp_may_update_window(tp, ack, seq, ntohs(th->window) << tp->rx_opt.snd_wscale) &&
 
 		/* 4. ... and sits in replay window. */
-		(s32)(tp->rx_opt.ts_recent - tp->rx_opt.rcv_tsval) <= (inet_csk(sk)->icsk_rto * 1024) / HZ);
+		(s32)(tp->rx_opt.ts_recent - tp->rx_opt.rcv_tsval) <= (tp->rto*1024)/HZ);
 }
 
-static inline int tcp_paws_discard(const struct sock *sk, const struct sk_buff *skb)
+static inline int tcp_paws_discard(struct tcp_sock *tp, struct sk_buff *skb)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
 	return ((s32)(tp->rx_opt.ts_recent - tp->rx_opt.rcv_tsval) > TCP_PAWS_WINDOW &&
 		xtime.tv_sec < tp->rx_opt.ts_recent_stamp + TCP_PAWS_24DAYS &&
-		!tcp_disordered_ack(sk, skb));
+		!tcp_disordered_ack(tp, skb));
 }
 
 /* Check segment sequence number for validity.
@@ -2627,7 +2586,7 @@ static void tcp_fin(struct sk_buff *skb, struct sock *sk, struct tcphdr *th)
 {
 	struct tcp_sock *tp = tcp_sk(sk);
 
-	inet_csk_schedule_ack(sk);
+	tcp_schedule_ack(tp);
 
 	sk->sk_shutdown |= RCV_SHUTDOWN;
 	sock_set_flag(sk, SOCK_DONE);
@@ -2637,7 +2596,7 @@ static void tcp_fin(struct sk_buff *skb, struct sock *sk, struct tcphdr *th)
 		case TCP_ESTABLISHED:
 			/* Move to CLOSE_WAIT */
 			tcp_set_state(sk, TCP_CLOSE_WAIT);
-			inet_csk(sk)->icsk_ack.pingpong = 1;
+			tp->ack.pingpong = 1;
 			break;
 
 		case TCP_CLOSE_WAIT:
@@ -2735,7 +2694,7 @@ static void tcp_send_dupack(struct sock *sk, struct sk_buff *skb)
 	if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
 	    before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
 		NET_INC_STATS_BH(LINUX_MIB_DELAYEDACKLOST);
-		tcp_enter_quickack_mode(sk);
+		tcp_enter_quickack_mode(tp);
 
 		if (tp->rx_opt.sack_ok && sysctl_tcp_dsack) {
 			u32 end_seq = TCP_SKB_CB(skb)->end_seq;
@@ -2894,7 +2853,7 @@ static void tcp_ofo_queue(struct sock *sk)
 
 		if (!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt)) {
 			SOCK_DEBUG(sk, "ofo packet was already received \n");
-			__skb_unlink(skb, &tp->out_of_order_queue);
+			__skb_unlink(skb, skb->list);
 			__kfree_skb(skb);
 			continue;
 		}
@@ -2902,7 +2861,7 @@ static void tcp_ofo_queue(struct sock *sk)
 			   tp->rcv_nxt, TCP_SKB_CB(skb)->seq,
 			   TCP_SKB_CB(skb)->end_seq);
 
-		__skb_unlink(skb, &tp->out_of_order_queue);
+		__skb_unlink(skb, skb->list);
 		__skb_queue_tail(&sk->sk_receive_queue, skb);
 		tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
 		if(skb->h.th->fin)
@@ -2983,7 +2942,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 			 * gap in queue is filled.
 			 */
 			if (skb_queue_empty(&tp->out_of_order_queue))
-				inet_csk(sk)->icsk_ack.pingpong = 0;
+				tp->ack.pingpong = 0;
 		}
 
 		if (tp->rx_opt.num_sacks)
@@ -3004,8 +2963,8 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 		tcp_dsack_set(tp, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq);
 
 out_of_window:
-		tcp_enter_quickack_mode(sk);
-		inet_csk_schedule_ack(sk);
+		tcp_enter_quickack_mode(tp);
+		tcp_schedule_ack(tp);
 drop:
 		__kfree_skb(skb);
 		return;
@@ -3015,7 +2974,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 	if (!before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt + tcp_receive_window(tp)))
 		goto out_of_window;
 
-	tcp_enter_quickack_mode(sk);
+	tcp_enter_quickack_mode(tp);
 
 	if (before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
 		/* Partial packet, seq < rcv_next < end_seq */
@@ -3044,7 +3003,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 
 	/* Disable header prediction. */
 	tp->pred_flags = 0;
-	inet_csk_schedule_ack(sk);
+	tcp_schedule_ack(tp);
 
 	SOCK_DEBUG(sk, "out of order segment: rcv_next %X seq %X - %X\n",
 		   tp->rcv_nxt, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq);
@@ -3068,7 +3027,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 		u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
 		if (seq == TCP_SKB_CB(skb1)->end_seq) {
-			__skb_append(skb1, skb, &tp->out_of_order_queue);
+			__skb_append(skb1, skb);
 
 			if (!tp->rx_opt.num_sacks ||
 			    tp->selective_acks[0].end_seq != seq)
@@ -3112,7 +3071,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 			       tcp_dsack_extend(tp, TCP_SKB_CB(skb1)->seq, end_seq);
 			       break;
 		       }
-		       __skb_unlink(skb1, &tp->out_of_order_queue);
+		       __skb_unlink(skb1, skb1->list);
 		       tcp_dsack_extend(tp, TCP_SKB_CB(skb1)->seq, TCP_SKB_CB(skb1)->end_seq);
 		       __kfree_skb(skb1);
 		}
@@ -3129,9 +3088,8 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
  * simplifies code)
  */
 static void
-tcp_collapse(struct sock *sk, struct sk_buff_head *list,
-	     struct sk_buff *head, struct sk_buff *tail,
-	     u32 start, u32 end)
+tcp_collapse(struct sock *sk, struct sk_buff *head,
+	     struct sk_buff *tail, u32 start, u32 end)
 {
 	struct sk_buff *skb;
 
@@ -3141,7 +3099,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
 		/* No new bits? It is possible on ofo queue. */
 		if (!before(start, TCP_SKB_CB(skb)->end_seq)) {
 			struct sk_buff *next = skb->next;
-			__skb_unlink(skb, list);
+			__skb_unlink(skb, skb->list);
 			__kfree_skb(skb);
 			NET_INC_STATS_BH(LINUX_MIB_TCPRCVCOLLAPSED);
 			skb = next;
@@ -3187,7 +3145,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
 		nskb->mac.raw = nskb->head + (skb->mac.raw-skb->head);
 		memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
 		TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(nskb)->end_seq = start;
-		__skb_insert(nskb, skb->prev, skb, list);
+		__skb_insert(nskb, skb->prev, skb, skb->list);
 		sk_stream_set_owner_r(nskb, sk);
 
 		/* Copy data, releasing collapsed skbs. */
@@ -3206,7 +3164,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
 			}
 			if (!before(start, TCP_SKB_CB(skb)->end_seq)) {
 				struct sk_buff *next = skb->next;
-				__skb_unlink(skb, list);
+				__skb_unlink(skb, skb->list);
 				__kfree_skb(skb);
 				NET_INC_STATS_BH(LINUX_MIB_TCPRCVCOLLAPSED);
 				skb = next;
@@ -3242,8 +3200,7 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
 		if (skb == (struct sk_buff *)&tp->out_of_order_queue ||
 		    after(TCP_SKB_CB(skb)->seq, end) ||
 		    before(TCP_SKB_CB(skb)->end_seq, start)) {
-			tcp_collapse(sk, &tp->out_of_order_queue,
-				     head, skb, start, end);
+			tcp_collapse(sk, head, skb, start, end);
 			head = skb;
 			if (skb == (struct sk_buff *)&tp->out_of_order_queue)
 				break;
@@ -3280,8 +3237,7 @@ static int tcp_prune_queue(struct sock *sk)
 		tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss);
 
 	tcp_collapse_ofo_queue(sk);
-	tcp_collapse(sk, &sk->sk_receive_queue,
-		     sk->sk_receive_queue.next,
+	tcp_collapse(sk, sk->sk_receive_queue.next,
 		     (struct sk_buff*)&sk->sk_receive_queue,
 		     tp->copied_seq, tp->rcv_nxt);
 	sk_stream_mem_reclaim(sk);
@@ -3330,12 +3286,12 @@ void tcp_cwnd_application_limited(struct sock *sk)
 {
 	struct tcp_sock *tp = tcp_sk(sk);
 
-	if (inet_csk(sk)->icsk_ca_state == TCP_CA_Open &&
+	if (tp->ca_state == TCP_CA_Open &&
 	    sk->sk_socket && !test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
 		/* Limited by application or receiver window. */
 		u32 win_used = max(tp->snd_cwnd_used, 2U);
 		if (win_used < tp->snd_cwnd) {
-			tp->snd_ssthresh = tcp_current_ssthresh(sk);
+			tp->snd_ssthresh = tcp_current_ssthresh(tp);
 			tp->snd_cwnd = (tp->snd_cwnd + win_used) >> 1;
 		}
 		tp->snd_cwnd_used = 0;
@@ -3414,13 +3370,13 @@ static void __tcp_ack_snd_check(struct sock *sk, int ofo_possible)
 	struct tcp_sock *tp = tcp_sk(sk);
 
 	    /* More than one full frame received... */
-	if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss
+	if (((tp->rcv_nxt - tp->rcv_wup) > tp->ack.rcv_mss
 	     /* ... and right edge of window advances far enough.
 	      * (tcp_recvmsg() will send ACK otherwise). Or...
 	      */
 	     && __tcp_select_window(sk) >= tp->rcv_wnd) ||
 	    /* We ACK each frame or... */
-	    tcp_in_quickack_mode(sk) ||
+	    tcp_in_quickack_mode(tp) ||
 	    /* We have out of order data. */
 	    (ofo_possible &&
 	     skb_peek(&tp->out_of_order_queue))) {
@@ -3434,7 +3390,8 @@ static void __tcp_ack_snd_check(struct sock *sk, int ofo_possible)
 
 static __inline__ void tcp_ack_snd_check(struct sock *sk)
 {
-	if (!inet_csk_ack_scheduled(sk)) {
+	struct tcp_sock *tp = tcp_sk(sk);
+	if (!tcp_ack_scheduled(tp)) {
 		/* We sent a data segment already. */
 		return;
 	}
@@ -3505,7 +3462,7 @@ static void tcp_check_urg(struct sock * sk, struct tcphdr * th)
 		struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 		tp->copied_seq++;
 		if (skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq)) {
-			__skb_unlink(skb, &sk->sk_receive_queue);
+			__skb_unlink(skb, skb->list);
 			__kfree_skb(skb);
 		}
 	}
@@ -3688,7 +3645,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 				    tp->rcv_nxt == tp->rcv_wup)
 					tcp_store_ts_recent(tp);
 
-				tcp_rcv_rtt_measure_ts(sk, skb);
+				tcp_rcv_rtt_measure_ts(tp, skb);
 
 				/* We know that such packets are checksummed
 				 * on entry.
@@ -3721,7 +3678,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 					    tp->rcv_nxt == tp->rcv_wup)
 						tcp_store_ts_recent(tp);
 
-					tcp_rcv_rtt_measure_ts(sk, skb);
+					tcp_rcv_rtt_measure_ts(tp, skb);
 
 					__skb_pull(skb, tcp_header_len);
 					tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
@@ -3742,7 +3699,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 				    tp->rcv_nxt == tp->rcv_wup)
 					tcp_store_ts_recent(tp);
 
-				tcp_rcv_rtt_measure_ts(sk, skb);
+				tcp_rcv_rtt_measure_ts(tp, skb);
 
 				if ((int)skb->truesize > sk->sk_forward_alloc)
 					goto step5;
@@ -3762,7 +3719,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 				/* Well, only one small jumplet in fast path... */
 				tcp_ack(sk, skb, FLAG_DATA);
 				tcp_data_snd_check(sk, tp);
-				if (!inet_csk_ack_scheduled(sk))
+				if (!tcp_ack_scheduled(tp))
 					goto no_ack;
 			}
 
@@ -3784,7 +3741,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 	 * RFC1323: H1. Apply PAWS check first.
 	 */
 	if (tcp_fast_parse_options(skb, th, tp) && tp->rx_opt.saw_tstamp &&
-	    tcp_paws_discard(sk, skb)) {
+	    tcp_paws_discard(tp, skb)) {
 		if (!th->rst) {
 			NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 			tcp_send_dupack(sk, skb);
@@ -3831,7 +3788,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 	if(th->ack)
 		tcp_ack(sk, skb, FLAG_SLOWPATH);
 
-	tcp_rcv_rtt_measure_ts(sk, skb);
+	tcp_rcv_rtt_measure_ts(tp, skb);
 
 	/* Process urgent data. */
 	tcp_urg(sk, skb, th);
@@ -3860,7 +3817,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 	tcp_parse_options(skb, &tp->rx_opt, 0);
 
 	if (th->ack) {
-		struct inet_connection_sock *icsk;
 		/* rfc793:
 		 * "If the state is SYN-SENT then
 		 *    first check the ACK bit
@@ -3964,7 +3920,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 
 		tcp_init_metrics(sk);
 
-		tcp_init_congestion_control(sk);
+		tcp_init_congestion_control(tp);
 
 		/* Prevent spurious tcp_cwnd_restart() on first data
 		 * packet.
@@ -3974,7 +3930,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 		tcp_init_buffer_space(sk);
 
 		if (sock_flag(sk, SOCK_KEEPOPEN))
-			inet_csk_reset_keepalive_timer(sk, keepalive_time_when(tp));
+			tcp_reset_keepalive_timer(sk, keepalive_time_when(tp));
 
 		if (!tp->rx_opt.snd_wscale)
 			__tcp_fast_path_on(tp, tp->snd_wnd);
@@ -3986,11 +3942,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 			sk_wake_async(sk, 0, POLL_OUT);
 		}
 
-		icsk = inet_csk(sk);
-
-		if (sk->sk_write_pending ||
-		    icsk->icsk_accept_queue.rskq_defer_accept ||
-		    icsk->icsk_ack.pingpong) {
+		if (sk->sk_write_pending || tp->defer_accept || tp->ack.pingpong) {
 			/* Save one ACK. Data will be ready after
 			 * several ticks, if write_pending is set.
 			 *
@@ -3998,13 +3950,12 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 			 * look so _wonderfully_ clever, that I was not able
 			 * to stand against the temptation 8)     --ANK
 			 */
-			inet_csk_schedule_ack(sk);
-			icsk->icsk_ack.lrcvtime = tcp_time_stamp;
-			icsk->icsk_ack.ato	 = TCP_ATO_MIN;
-			tcp_incr_quickack(sk);
-			tcp_enter_quickack_mode(sk);
-			inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-						  TCP_DELACK_MAX, TCP_RTO_MAX);
+			tcp_schedule_ack(tp);
+			tp->ack.lrcvtime = tcp_time_stamp;
+			tp->ack.ato	 = TCP_ATO_MIN;
+			tcp_incr_quickack(tp);
+			tcp_enter_quickack_mode(tp);
+			tcp_reset_xmit_timer(sk, TCP_TIME_DACK, TCP_DELACK_MAX);
 
 discard:
 			__kfree_skb(skb);
@@ -4160,7 +4111,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 	}
 
 	if (tcp_fast_parse_options(skb, th, tp) && tp->rx_opt.saw_tstamp &&
-	    tcp_paws_discard(sk, skb)) {
+	    tcp_paws_discard(tp, skb)) {
 		if (!th->rst) {
 			NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 			tcp_send_dupack(sk, skb);
@@ -4229,7 +4180,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 				 */
 				if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
 				    !tp->srtt)
-					tcp_ack_saw_tstamp(sk, NULL, 0);
+					tcp_ack_saw_tstamp(tp, 0, 0);
 
 				if (tp->rx_opt.tstamp_ok)
 					tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
@@ -4241,7 +4192,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
 				tcp_init_metrics(sk);
 
-				tcp_init_congestion_control(sk);
+				tcp_init_congestion_control(tp);
 
 				/* Prevent spurious tcp_cwnd_restart() on
 				 * first data packet.
@@ -4276,9 +4227,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 						return 1;
 					}
 
-					tmo = tcp_fin_time(sk);
+					tmo = tcp_fin_time(tp);
 					if (tmo > TCP_TIMEWAIT_LEN) {
-						inet_csk_reset_keepalive_timer(sk, tmo - TCP_TIMEWAIT_LEN);
+						tcp_reset_keepalive_timer(sk, tmo - TCP_TIMEWAIT_LEN);
 					} else if (th->fin || sock_owned_by_user(sk)) {
 						/* Bad case. We could lose such FIN otherwise.
 						 * It is not a big problem, but it looks confusing
@@ -4286,7 +4237,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 						 * if it spins in bh_lock_sock(), but it is really
 						 * marginal case.
 						 */
-						inet_csk_reset_keepalive_timer(sk, tmo);
+						tcp_reset_keepalive_timer(sk, tmo);
 					} else {
 						tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
 						goto discard;
diff --git a/trunk/net/ipv4/tcp_ipv4.c b/trunk/net/ipv4/tcp_ipv4.c
index 13dfb391cdf1..67c670886c1f 100644
--- a/trunk/net/ipv4/tcp_ipv4.c
+++ b/trunk/net/ipv4/tcp_ipv4.c
@@ -64,9 +64,7 @@
 #include <linux/times.h>
 
 #include <net/icmp.h>
-#include <net/inet_hashtables.h>
 #include <net/tcp.h>
-#include <net/transp_v6.h>
 #include <net/ipv6.h>
 #include <net/inet_common.h>
 #include <net/xfrm.h>
@@ -77,6 +75,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
+extern int sysctl_ip_dynaddr;
 int sysctl_tcp_tw_reuse;
 int sysctl_tcp_low_latency;
 
@@ -89,29 +88,463 @@ static struct socket *tcp_socket;
 void tcp_v4_send_check(struct sock *sk, struct tcphdr *th, int len,
 		       struct sk_buff *skb);
 
-struct inet_hashinfo __cacheline_aligned tcp_hashinfo = {
-	.lhash_lock	= RW_LOCK_UNLOCKED,
-	.lhash_users	= ATOMIC_INIT(0),
-	.lhash_wait	= __WAIT_QUEUE_HEAD_INITIALIZER(tcp_hashinfo.lhash_wait),
-	.portalloc_lock	= SPIN_LOCK_UNLOCKED,
-	.port_rover	= 1024 - 1,
+struct tcp_hashinfo __cacheline_aligned tcp_hashinfo = {
+	.__tcp_lhash_lock	=	RW_LOCK_UNLOCKED,
+	.__tcp_lhash_users	=	ATOMIC_INIT(0),
+	.__tcp_lhash_wait
+	  = __WAIT_QUEUE_HEAD_INITIALIZER(tcp_hashinfo.__tcp_lhash_wait),
+	.__tcp_portalloc_lock	=	SPIN_LOCK_UNLOCKED
 };
 
+/*
+ * This array holds the first and last local port number.
+ * For high-usage systems, use sysctl to change this to
+ * 32768-61000
+ */
+int sysctl_local_port_range[2] = { 1024, 4999 };
+int tcp_port_rover = 1024 - 1;
+
+static __inline__ int tcp_hashfn(__u32 laddr, __u16 lport,
+				 __u32 faddr, __u16 fport)
+{
+	int h = (laddr ^ lport) ^ (faddr ^ fport);
+	h ^= h >> 16;
+	h ^= h >> 8;
+	return h & (tcp_ehash_size - 1);
+}
+
+static __inline__ int tcp_sk_hashfn(struct sock *sk)
+{
+	struct inet_sock *inet = inet_sk(sk);
+	__u32 laddr = inet->rcv_saddr;
+	__u16 lport = inet->num;
+	__u32 faddr = inet->daddr;
+	__u16 fport = inet->dport;
+
+	return tcp_hashfn(laddr, lport, faddr, fport);
+}
+
+/* Allocate and initialize a new TCP local port bind bucket.
+ * The bindhash mutex for snum's hash chain must be held here.
+ */
+struct tcp_bind_bucket *tcp_bucket_create(struct tcp_bind_hashbucket *head,
+					  unsigned short snum)
+{
+	struct tcp_bind_bucket *tb = kmem_cache_alloc(tcp_bucket_cachep,
+						      SLAB_ATOMIC);
+	if (tb) {
+		tb->port = snum;
+		tb->fastreuse = 0;
+		INIT_HLIST_HEAD(&tb->owners);
+		hlist_add_head(&tb->node, &head->chain);
+	}
+	return tb;
+}
+
+/* Caller must hold hashbucket lock for this tb with local BH disabled */
+void tcp_bucket_destroy(struct tcp_bind_bucket *tb)
+{
+	if (hlist_empty(&tb->owners)) {
+		__hlist_del(&tb->node);
+		kmem_cache_free(tcp_bucket_cachep, tb);
+	}
+}
+
+/* Caller must disable local BH processing. */
+static __inline__ void __tcp_inherit_port(struct sock *sk, struct sock *child)
+{
+	struct tcp_bind_hashbucket *head =
+				&tcp_bhash[tcp_bhashfn(inet_sk(child)->num)];
+	struct tcp_bind_bucket *tb;
+
+	spin_lock(&head->lock);
+	tb = tcp_sk(sk)->bind_hash;
+	sk_add_bind_node(child, &tb->owners);
+	tcp_sk(child)->bind_hash = tb;
+	spin_unlock(&head->lock);
+}
+
+inline void tcp_inherit_port(struct sock *sk, struct sock *child)
+{
+	local_bh_disable();
+	__tcp_inherit_port(sk, child);
+	local_bh_enable();
+}
+
+void tcp_bind_hash(struct sock *sk, struct tcp_bind_bucket *tb,
+		   unsigned short snum)
+{
+	inet_sk(sk)->num = snum;
+	sk_add_bind_node(sk, &tb->owners);
+	tcp_sk(sk)->bind_hash = tb;
+}
+
+static inline int tcp_bind_conflict(struct sock *sk, struct tcp_bind_bucket *tb)
+{
+	const u32 sk_rcv_saddr = tcp_v4_rcv_saddr(sk);
+	struct sock *sk2;
+	struct hlist_node *node;
+	int reuse = sk->sk_reuse;
+
+	sk_for_each_bound(sk2, node, &tb->owners) {
+		if (sk != sk2 &&
+		    !tcp_v6_ipv6only(sk2) &&
+		    (!sk->sk_bound_dev_if ||
+		     !sk2->sk_bound_dev_if ||
+		     sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
+			if (!reuse || !sk2->sk_reuse ||
+			    sk2->sk_state == TCP_LISTEN) {
+				const u32 sk2_rcv_saddr = tcp_v4_rcv_saddr(sk2);
+				if (!sk2_rcv_saddr || !sk_rcv_saddr ||
+				    sk2_rcv_saddr == sk_rcv_saddr)
+					break;
+			}
+		}
+	}
+	return node != NULL;
+}
+
+/* Obtain a reference to a local port for the given sock,
+ * if snum is zero it means select any available local port.
+ */
 static int tcp_v4_get_port(struct sock *sk, unsigned short snum)
 {
-	return inet_csk_get_port(&tcp_hashinfo, sk, snum);
+	struct tcp_bind_hashbucket *head;
+	struct hlist_node *node;
+	struct tcp_bind_bucket *tb;
+	int ret;
+
+	local_bh_disable();
+	if (!snum) {
+		int low = sysctl_local_port_range[0];
+		int high = sysctl_local_port_range[1];
+		int remaining = (high - low) + 1;
+		int rover;
+
+		spin_lock(&tcp_portalloc_lock);
+		if (tcp_port_rover < low)
+			rover = low;
+		else
+			rover = tcp_port_rover;
+		do {
+			rover++;
+			if (rover > high)
+				rover = low;
+			head = &tcp_bhash[tcp_bhashfn(rover)];
+			spin_lock(&head->lock);
+			tb_for_each(tb, node, &head->chain)
+				if (tb->port == rover)
+					goto next;
+			break;
+		next:
+			spin_unlock(&head->lock);
+		} while (--remaining > 0);
+		tcp_port_rover = rover;
+		spin_unlock(&tcp_portalloc_lock);
+
+		/* Exhausted local port range during search?  It is not
+		 * possible for us to be holding one of the bind hash
+		 * locks if this test triggers, because if 'remaining'
+		 * drops to zero, we broke out of the do/while loop at
+		 * the top level, not from the 'break;' statement.
+		 */
+		ret = 1;
+		if (unlikely(remaining <= 0))
+			goto fail;
+
+		/* OK, here is the one we will use.  HEAD is
+		 * non-NULL and we hold it's mutex.
+		 */
+		snum = rover;
+	} else {
+		head = &tcp_bhash[tcp_bhashfn(snum)];
+		spin_lock(&head->lock);
+		tb_for_each(tb, node, &head->chain)
+			if (tb->port == snum)
+				goto tb_found;
+	}
+	tb = NULL;
+	goto tb_not_found;
+tb_found:
+	if (!hlist_empty(&tb->owners)) {
+		if (sk->sk_reuse > 1)
+			goto success;
+		if (tb->fastreuse > 0 &&
+		    sk->sk_reuse && sk->sk_state != TCP_LISTEN) {
+			goto success;
+		} else {
+			ret = 1;
+			if (tcp_bind_conflict(sk, tb))
+				goto fail_unlock;
+		}
+	}
+tb_not_found:
+	ret = 1;
+	if (!tb && (tb = tcp_bucket_create(head, snum)) == NULL)
+		goto fail_unlock;
+	if (hlist_empty(&tb->owners)) {
+		if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
+			tb->fastreuse = 1;
+		else
+			tb->fastreuse = 0;
+	} else if (tb->fastreuse &&
+		   (!sk->sk_reuse || sk->sk_state == TCP_LISTEN))
+		tb->fastreuse = 0;
+success:
+	if (!tcp_sk(sk)->bind_hash)
+		tcp_bind_hash(sk, tb, snum);
+	BUG_TRAP(tcp_sk(sk)->bind_hash == tb);
+ 	ret = 0;
+
+fail_unlock:
+	spin_unlock(&head->lock);
+fail:
+	local_bh_enable();
+	return ret;
+}
+
+/* Get rid of any references to a local port held by the
+ * given sock.
+ */
+static void __tcp_put_port(struct sock *sk)
+{
+	struct inet_sock *inet = inet_sk(sk);
+	struct tcp_bind_hashbucket *head = &tcp_bhash[tcp_bhashfn(inet->num)];
+	struct tcp_bind_bucket *tb;
+
+	spin_lock(&head->lock);
+	tb = tcp_sk(sk)->bind_hash;
+	__sk_del_bind_node(sk);
+	tcp_sk(sk)->bind_hash = NULL;
+	inet->num = 0;
+	tcp_bucket_destroy(tb);
+	spin_unlock(&head->lock);
+}
+
+void tcp_put_port(struct sock *sk)
+{
+	local_bh_disable();
+	__tcp_put_port(sk);
+	local_bh_enable();
+}
+
+/* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it can be very bad on SMP.
+ * Look, when several writers sleep and reader wakes them up, all but one
+ * immediately hit write lock and grab all the cpus. Exclusive sleep solves
+ * this, _but_ remember, it adds useless work on UP machines (wake up each
+ * exclusive lock release). It should be ifdefed really.
+ */
+
+void tcp_listen_wlock(void)
+{
+	write_lock(&tcp_lhash_lock);
+
+	if (atomic_read(&tcp_lhash_users)) {
+		DEFINE_WAIT(wait);
+
+		for (;;) {
+			prepare_to_wait_exclusive(&tcp_lhash_wait,
+						&wait, TASK_UNINTERRUPTIBLE);
+			if (!atomic_read(&tcp_lhash_users))
+				break;
+			write_unlock_bh(&tcp_lhash_lock);
+			schedule();
+			write_lock_bh(&tcp_lhash_lock);
+		}
+
+		finish_wait(&tcp_lhash_wait, &wait);
+	}
+}
+
+static __inline__ void __tcp_v4_hash(struct sock *sk, const int listen_possible)
+{
+	struct hlist_head *list;
+	rwlock_t *lock;
+
+	BUG_TRAP(sk_unhashed(sk));
+	if (listen_possible && sk->sk_state == TCP_LISTEN) {
+		list = &tcp_listening_hash[tcp_sk_listen_hashfn(sk)];
+		lock = &tcp_lhash_lock;
+		tcp_listen_wlock();
+	} else {
+		list = &tcp_ehash[(sk->sk_hashent = tcp_sk_hashfn(sk))].chain;
+		lock = &tcp_ehash[sk->sk_hashent].lock;
+		write_lock(lock);
+	}
+	__sk_add_node(sk, list);
+	sock_prot_inc_use(sk->sk_prot);
+	write_unlock(lock);
+	if (listen_possible && sk->sk_state == TCP_LISTEN)
+		wake_up(&tcp_lhash_wait);
 }
 
 static void tcp_v4_hash(struct sock *sk)
 {
-	inet_hash(&tcp_hashinfo, sk);
+	if (sk->sk_state != TCP_CLOSE) {
+		local_bh_disable();
+		__tcp_v4_hash(sk, 1);
+		local_bh_enable();
+	}
 }
 
 void tcp_unhash(struct sock *sk)
 {
-	inet_unhash(&tcp_hashinfo, sk);
+	rwlock_t *lock;
+
+	if (sk_unhashed(sk))
+		goto ende;
+
+	if (sk->sk_state == TCP_LISTEN) {
+		local_bh_disable();
+		tcp_listen_wlock();
+		lock = &tcp_lhash_lock;
+	} else {
+		struct tcp_ehash_bucket *head = &tcp_ehash[sk->sk_hashent];
+		lock = &head->lock;
+		write_lock_bh(&head->lock);
+	}
+
+	if (__sk_del_node_init(sk))
+		sock_prot_dec_use(sk->sk_prot);
+	write_unlock_bh(lock);
+
+ ende:
+	if (sk->sk_state == TCP_LISTEN)
+		wake_up(&tcp_lhash_wait);
+}
+
+/* Don't inline this cruft.  Here are some nice properties to
+ * exploit here.  The BSD API does not allow a listening TCP
+ * to specify the remote port nor the remote address for the
+ * connection.  So always assume those are both wildcarded
+ * during the search since they can never be otherwise.
+ */
+static struct sock *__tcp_v4_lookup_listener(struct hlist_head *head, u32 daddr,
+					     unsigned short hnum, int dif)
+{
+	struct sock *result = NULL, *sk;
+	struct hlist_node *node;
+	int score, hiscore;
+
+	hiscore=-1;
+	sk_for_each(sk, node, head) {
+		struct inet_sock *inet = inet_sk(sk);
+
+		if (inet->num == hnum && !ipv6_only_sock(sk)) {
+			__u32 rcv_saddr = inet->rcv_saddr;
+
+			score = (sk->sk_family == PF_INET ? 1 : 0);
+			if (rcv_saddr) {
+				if (rcv_saddr != daddr)
+					continue;
+				score+=2;
+			}
+			if (sk->sk_bound_dev_if) {
+				if (sk->sk_bound_dev_if != dif)
+					continue;
+				score+=2;
+			}
+			if (score == 5)
+				return sk;
+			if (score > hiscore) {
+				hiscore = score;
+				result = sk;
+			}
+		}
+	}
+	return result;
+}
+
+/* Optimize the common listener case. */
+static inline struct sock *tcp_v4_lookup_listener(u32 daddr,
+		unsigned short hnum, int dif)
+{
+	struct sock *sk = NULL;
+	struct hlist_head *head;
+
+	read_lock(&tcp_lhash_lock);
+	head = &tcp_listening_hash[tcp_lhashfn(hnum)];
+	if (!hlist_empty(head)) {
+		struct inet_sock *inet = inet_sk((sk = __sk_head(head)));
+
+		if (inet->num == hnum && !sk->sk_node.next &&
+		    (!inet->rcv_saddr || inet->rcv_saddr == daddr) &&
+		    (sk->sk_family == PF_INET || !ipv6_only_sock(sk)) &&
+		    !sk->sk_bound_dev_if)
+			goto sherry_cache;
+		sk = __tcp_v4_lookup_listener(head, daddr, hnum, dif);
+	}
+	if (sk) {
+sherry_cache:
+		sock_hold(sk);
+	}
+	read_unlock(&tcp_lhash_lock);
+	return sk;
 }
 
+/* Sockets in TCP_CLOSE state are _always_ taken out of the hash, so
+ * we need not check it for TCP lookups anymore, thanks Alexey. -DaveM
+ *
+ * Local BH must be disabled here.
+ */
+
+static inline struct sock *__tcp_v4_lookup_established(u32 saddr, u16 sport,
+						       u32 daddr, u16 hnum,
+						       int dif)
+{
+	struct tcp_ehash_bucket *head;
+	TCP_V4_ADDR_COOKIE(acookie, saddr, daddr)
+	__u32 ports = TCP_COMBINED_PORTS(sport, hnum);
+	struct sock *sk;
+	struct hlist_node *node;
+	/* Optimize here for direct hit, only listening connections can
+	 * have wildcards anyways.
+	 */
+	int hash = tcp_hashfn(daddr, hnum, saddr, sport);
+	head = &tcp_ehash[hash];
+	read_lock(&head->lock);
+	sk_for_each(sk, node, &head->chain) {
+		if (TCP_IPV4_MATCH(sk, acookie, saddr, daddr, ports, dif))
+			goto hit; /* You sunk my battleship! */
+	}
+
+	/* Must check for a TIME_WAIT'er before going to listener hash. */
+	sk_for_each(sk, node, &(head + tcp_ehash_size)->chain) {
+		if (TCP_IPV4_TW_MATCH(sk, acookie, saddr, daddr, ports, dif))
+			goto hit;
+	}
+	sk = NULL;
+out:
+	read_unlock(&head->lock);
+	return sk;
+hit:
+	sock_hold(sk);
+	goto out;
+}
+
+static inline struct sock *__tcp_v4_lookup(u32 saddr, u16 sport,
+					   u32 daddr, u16 hnum, int dif)
+{
+	struct sock *sk = __tcp_v4_lookup_established(saddr, sport,
+						      daddr, hnum, dif);
+
+	return sk ? : tcp_v4_lookup_listener(daddr, hnum, dif);
+}
+
+inline struct sock *tcp_v4_lookup(u32 saddr, u16 sport, u32 daddr,
+				  u16 dport, int dif)
+{
+	struct sock *sk;
+
+	local_bh_disable();
+	sk = __tcp_v4_lookup(saddr, sport, daddr, ntohs(dport), dif);
+	local_bh_enable();
+
+	return sk;
+}
+
+EXPORT_SYMBOL_GPL(tcp_v4_lookup);
+
 static inline __u32 tcp_v4_init_sequence(struct sock *sk, struct sk_buff *skb)
 {
 	return secure_tcp_sequence_number(skb->nh.iph->daddr,
@@ -122,28 +555,27 @@ static inline __u32 tcp_v4_init_sequence(struct sock *sk, struct sk_buff *skb)
 
 /* called with local bh disabled */
 static int __tcp_v4_check_established(struct sock *sk, __u16 lport,
-				      struct inet_timewait_sock **twp)
+				      struct tcp_tw_bucket **twp)
 {
 	struct inet_sock *inet = inet_sk(sk);
 	u32 daddr = inet->rcv_saddr;
 	u32 saddr = inet->daddr;
 	int dif = sk->sk_bound_dev_if;
-	INET_ADDR_COOKIE(acookie, saddr, daddr)
-	const __u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
-	const int hash = inet_ehashfn(daddr, lport, saddr, inet->dport, tcp_hashinfo.ehash_size);
-	struct inet_ehash_bucket *head = &tcp_hashinfo.ehash[hash];
+	TCP_V4_ADDR_COOKIE(acookie, saddr, daddr)
+	__u32 ports = TCP_COMBINED_PORTS(inet->dport, lport);
+	int hash = tcp_hashfn(daddr, lport, saddr, inet->dport);
+	struct tcp_ehash_bucket *head = &tcp_ehash[hash];
 	struct sock *sk2;
-	const struct hlist_node *node;
-	struct inet_timewait_sock *tw;
+	struct hlist_node *node;
+	struct tcp_tw_bucket *tw;
 
 	write_lock(&head->lock);
 
 	/* Check TIME-WAIT sockets first. */
-	sk_for_each(sk2, node, &(head + tcp_hashinfo.ehash_size)->chain) {
-		tw = inet_twsk(sk2);
+	sk_for_each(sk2, node, &(head + tcp_ehash_size)->chain) {
+		tw = (struct tcp_tw_bucket *)sk2;
 
-		if (INET_TW_MATCH(sk2, acookie, saddr, daddr, ports, dif)) {
-			const struct tcp_timewait_sock *tcptw = tcp_twsk(sk2);
+		if (TCP_IPV4_TW_MATCH(sk2, acookie, saddr, daddr, ports, dif)) {
 			struct tcp_sock *tp = tcp_sk(sk);
 
 			/* With PAWS, it is safe from the viewpoint
@@ -160,15 +592,15 @@ static int __tcp_v4_check_established(struct sock *sk, __u16 lport,
 			   fall back to VJ's scheme and use initial
 			   timestamp retrieved from peer table.
 			 */
-			if (tcptw->tw_ts_recent_stamp &&
+			if (tw->tw_ts_recent_stamp &&
 			    (!twp || (sysctl_tcp_tw_reuse &&
 				      xtime.tv_sec -
-				      tcptw->tw_ts_recent_stamp > 1))) {
-				tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
-				if (tp->write_seq == 0)
+				      tw->tw_ts_recent_stamp > 1))) {
+				if ((tp->write_seq =
+						tw->tw_snd_nxt + 65535 + 2) == 0)
 					tp->write_seq = 1;
-				tp->rx_opt.ts_recent	   = tcptw->tw_ts_recent;
-				tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
+				tp->rx_opt.ts_recent	   = tw->tw_ts_recent;
+				tp->rx_opt.ts_recent_stamp = tw->tw_ts_recent_stamp;
 				sock_hold(sk2);
 				goto unique;
 			} else
@@ -179,7 +611,7 @@ static int __tcp_v4_check_established(struct sock *sk, __u16 lport,
 
 	/* And established part... */
 	sk_for_each(sk2, node, &head->chain) {
-		if (INET_MATCH(sk2, acookie, saddr, daddr, ports, dif))
+		if (TCP_IPV4_MATCH(sk2, acookie, saddr, daddr, ports, dif))
 			goto not_unique;
 	}
 
@@ -199,10 +631,10 @@ static int __tcp_v4_check_established(struct sock *sk, __u16 lport,
 		NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
 	} else if (tw) {
 		/* Silly. Should hash-dance instead... */
-		inet_twsk_deschedule(tw, &tcp_death_row);
+		tcp_tw_deschedule(tw);
 		NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
 
-		inet_twsk_put(tw);
+		tcp_tw_put(tw);
 	}
 
 	return 0;
@@ -225,9 +657,9 @@ static inline u32 connect_port_offset(const struct sock *sk)
  */
 static inline int tcp_v4_hash_connect(struct sock *sk)
 {
-	const unsigned short snum = inet_sk(sk)->num;
- 	struct inet_bind_hashbucket *head;
- 	struct inet_bind_bucket *tb;
+	unsigned short snum = inet_sk(sk)->num;
+ 	struct tcp_bind_hashbucket *head;
+ 	struct tcp_bind_bucket *tb;
 	int ret;
 
  	if (!snum) {
@@ -239,19 +671,19 @@ static inline int tcp_v4_hash_connect(struct sock *sk)
 		static u32 hint;
 		u32 offset = hint + connect_port_offset(sk);
 		struct hlist_node *node;
- 		struct inet_timewait_sock *tw = NULL;
+ 		struct tcp_tw_bucket *tw = NULL;
 
  		local_bh_disable();
 		for (i = 1; i <= range; i++) {
 			port = low + (i + offset) % range;
- 			head = &tcp_hashinfo.bhash[inet_bhashfn(port, tcp_hashinfo.bhash_size)];
+ 			head = &tcp_bhash[tcp_bhashfn(port)];
  			spin_lock(&head->lock);
 
  			/* Does not bother with rcv_saddr checks,
  			 * because the established check is already
  			 * unique enough.
  			 */
-			inet_bind_bucket_for_each(tb, node, &head->chain) {
+			tb_for_each(tb, node, &head->chain) {
  				if (tb->port == port) {
  					BUG_TRAP(!hlist_empty(&tb->owners));
  					if (tb->fastreuse >= 0)
@@ -264,7 +696,7 @@ static inline int tcp_v4_hash_connect(struct sock *sk)
  				}
  			}
 
- 			tb = inet_bind_bucket_create(tcp_hashinfo.bind_bucket_cachep, head, port);
+ 			tb = tcp_bucket_create(head, port);
  			if (!tb) {
  				spin_unlock(&head->lock);
  				break;
@@ -283,27 +715,27 @@ static inline int tcp_v4_hash_connect(struct sock *sk)
 		hint += i;
 
  		/* Head lock still held and bh's disabled */
- 		inet_bind_hash(sk, tb, port);
+ 		tcp_bind_hash(sk, tb, port);
 		if (sk_unhashed(sk)) {
  			inet_sk(sk)->sport = htons(port);
- 			__inet_hash(&tcp_hashinfo, sk, 0);
+ 			__tcp_v4_hash(sk, 0);
  		}
  		spin_unlock(&head->lock);
 
  		if (tw) {
- 			inet_twsk_deschedule(tw, &tcp_death_row);;
- 			inet_twsk_put(tw);
+ 			tcp_tw_deschedule(tw);
+ 			tcp_tw_put(tw);
  		}
 
 		ret = 0;
 		goto out;
  	}
 
- 	head = &tcp_hashinfo.bhash[inet_bhashfn(snum, tcp_hashinfo.bhash_size)];
- 	tb  = inet_csk(sk)->icsk_bind_hash;
+ 	head  = &tcp_bhash[tcp_bhashfn(snum)];
+ 	tb  = tcp_sk(sk)->bind_hash;
 	spin_lock_bh(&head->lock);
 	if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
-		__inet_hash(&tcp_hashinfo, sk, 0);
+		__tcp_v4_hash(sk, 0);
 		spin_unlock_bh(&head->lock);
 		return 0;
 	} else {
@@ -366,7 +798,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 		tp->write_seq		   = 0;
 	}
 
-	if (tcp_death_row.sysctl_tw_recycle &&
+	if (sysctl_tcp_tw_recycle &&
 	    !tp->rx_opt.ts_recent_stamp && rt->rt_dst == daddr) {
 		struct inet_peer *peer = rt_get_peer(rt);
 
@@ -405,7 +837,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 		goto failure;
 
 	/* OK, now commit destination to socket.  */
-	sk_setup_caps(sk, &rt->u.dst);
+	__sk_dst_set(sk, &rt->u.dst);
+	tcp_v4_setup_caps(sk, &rt->u.dst);
 
 	if (!tp->write_seq)
 		tp->write_seq = secure_tcp_sequence_number(inet->saddr,
@@ -431,6 +864,53 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	return err;
 }
 
+static __inline__ int tcp_v4_iif(struct sk_buff *skb)
+{
+	return ((struct rtable *)skb->dst)->rt_iif;
+}
+
+static __inline__ u32 tcp_v4_synq_hash(u32 raddr, u16 rport, u32 rnd)
+{
+	return (jhash_2words(raddr, (u32) rport, rnd) & (TCP_SYNQ_HSIZE - 1));
+}
+
+static struct request_sock *tcp_v4_search_req(struct tcp_sock *tp,
+					      struct request_sock ***prevp,
+					      __u16 rport,
+					      __u32 raddr, __u32 laddr)
+{
+	struct listen_sock *lopt = tp->accept_queue.listen_opt;
+	struct request_sock *req, **prev;
+
+	for (prev = &lopt->syn_table[tcp_v4_synq_hash(raddr, rport, lopt->hash_rnd)];
+	     (req = *prev) != NULL;
+	     prev = &req->dl_next) {
+		const struct inet_request_sock *ireq = inet_rsk(req);
+
+		if (ireq->rmt_port == rport &&
+		    ireq->rmt_addr == raddr &&
+		    ireq->loc_addr == laddr &&
+		    TCP_INET_FAMILY(req->rsk_ops->family)) {
+			BUG_TRAP(!req->sk);
+			*prevp = prev;
+			break;
+		}
+	}
+
+	return req;
+}
+
+static void tcp_v4_synq_add(struct sock *sk, struct request_sock *req)
+{
+	struct tcp_sock *tp = tcp_sk(sk);
+	struct listen_sock *lopt = tp->accept_queue.listen_opt;
+	u32 h = tcp_v4_synq_hash(inet_rsk(req)->rmt_addr, inet_rsk(req)->rmt_port, lopt->hash_rnd);
+
+	reqsk_queue_hash_req(&tp->accept_queue, h, req, TCP_TIMEOUT_INIT);
+	tcp_synq_added(sk);
+}
+
+
 /*
  * This routine does path mtu discovery as defined in RFC1191.
  */
@@ -513,14 +993,14 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
 		return;
 	}
 
-	sk = inet_lookup(&tcp_hashinfo, iph->daddr, th->dest, iph->saddr,
-			 th->source, inet_iif(skb));
+	sk = tcp_v4_lookup(iph->daddr, th->dest, iph->saddr,
+			   th->source, tcp_v4_iif(skb));
 	if (!sk) {
 		ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 		return;
 	}
 	if (sk->sk_state == TCP_TIME_WAIT) {
-		inet_twsk_put((struct inet_timewait_sock *)sk);
+		tcp_tw_put((struct tcp_tw_bucket *)sk);
 		return;
 	}
 
@@ -574,8 +1054,8 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
 		if (sock_owned_by_user(sk))
 			goto out;
 
-		req = inet_csk_search_req(sk, &prev, th->dest,
-					  iph->daddr, iph->saddr);
+		req = tcp_v4_search_req(tp, &prev, th->dest,
+					iph->daddr, iph->saddr);
 		if (!req)
 			goto out;
 
@@ -595,7 +1075,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
 		 * created socket, and POSIX does not want network
 		 * errors returned from accept().
 		 */
-		inet_csk_reqsk_queue_drop(sk, req, prev);
+		tcp_synq_drop(sk, req, prev);
 		goto out;
 
 	case TCP_SYN_SENT:
@@ -765,13 +1245,12 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 
 static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
 {
-	struct inet_timewait_sock *tw = inet_twsk(sk);
-	const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
+	struct tcp_tw_bucket *tw = (struct tcp_tw_bucket *)sk;
 
-	tcp_v4_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
-			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale, tcptw->tw_ts_recent);
+	tcp_v4_send_ack(skb, tw->tw_snd_nxt, tw->tw_rcv_nxt,
+			tw->tw_rcv_wnd >> tw->tw_rcv_wscale, tw->tw_ts_recent);
 
-	inet_twsk_put(tw);
+	tcp_tw_put(tw);
 }
 
 static void tcp_v4_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
@@ -780,6 +1259,36 @@ static void tcp_v4_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
 			req->ts_recent);
 }
 
+static struct dst_entry* tcp_v4_route_req(struct sock *sk,
+					  struct request_sock *req)
+{
+	struct rtable *rt;
+	const struct inet_request_sock *ireq = inet_rsk(req);
+	struct ip_options *opt = inet_rsk(req)->opt;
+	struct flowi fl = { .oif = sk->sk_bound_dev_if,
+			    .nl_u = { .ip4_u =
+				      { .daddr = ((opt && opt->srr) ?
+						  opt->faddr :
+						  ireq->rmt_addr),
+					.saddr = ireq->loc_addr,
+					.tos = RT_CONN_FLAGS(sk) } },
+			    .proto = IPPROTO_TCP,
+			    .uli_u = { .ports =
+				       { .sport = inet_sk(sk)->sport,
+					 .dport = ireq->rmt_port } } };
+
+	if (ip_route_output_flow(&rt, &fl, sk, 0)) {
+		IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
+		return NULL;
+	}
+	if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway) {
+		ip_rt_put(rt);
+		IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
+		return NULL;
+	}
+	return &rt->u.dst;
+}
+
 /*
  *	Send a SYN-ACK after having received an ACK.
  *	This still operates on a request_sock only, not on a big
@@ -793,7 +1302,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
 	struct sk_buff * skb;
 
 	/* First, grab a route. */
-	if (!dst && (dst = inet_csk_route_req(sk, req)) == NULL)
+	if (!dst && (dst = tcp_v4_route_req(sk, req)) == NULL)
 		goto out;
 
 	skb = tcp_make_synack(sk, dst, req);
@@ -895,7 +1404,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	 * limitations, they conserve resources and peer is
 	 * evidently real one.
 	 */
-	if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
+	if (tcp_synq_is_full(sk) && !isn) {
 #ifdef CONFIG_SYN_COOKIES
 		if (sysctl_tcp_syncookies) {
 			want_cookie = 1;
@@ -909,7 +1418,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	 * clogging syn queue with openreqs with exponentially increasing
 	 * timeout.
 	 */
-	if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
+	if (sk_acceptq_is_full(sk) && tcp_synq_young(sk) > 1)
 		goto drop;
 
 	req = reqsk_alloc(&tcp_request_sock_ops);
@@ -965,8 +1474,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 		 * are made in the function processing timewait state.
 		 */
 		if (tmp_opt.saw_tstamp &&
-		    tcp_death_row.sysctl_tw_recycle &&
-		    (dst = inet_csk_route_req(sk, req)) != NULL &&
+		    sysctl_tcp_tw_recycle &&
+		    (dst = tcp_v4_route_req(sk, req)) != NULL &&
 		    (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
 		    peer->v4daddr == saddr) {
 			if (xtime.tv_sec < peer->tcp_ts_stamp + TCP_PAWS_MSL &&
@@ -979,7 +1488,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 		}
 		/* Kill the following clause, if you dislike this way. */
 		else if (!sysctl_tcp_syncookies &&
-			 (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
+			 (sysctl_max_syn_backlog - tcp_synq_len(sk) <
 			  (sysctl_max_syn_backlog >> 2)) &&
 			 (!peer || !peer->tcp_ts_stamp) &&
 			 (!dst || !dst_metric(dst, RTAX_RTT))) {
@@ -990,10 +1499,11 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 			 * to destinations, already remembered
 			 * to the moment of synflood.
 			 */
-			LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open "
-				       "request from %u.%u.%u.%u/%u\n",
-				       NIPQUAD(saddr),
-				       ntohs(skb->h.th->source));
+			LIMIT_NETDEBUG(printk(KERN_DEBUG "TCP: drop open "
+					      "request from %u.%u."
+					      "%u.%u/%u\n",
+					      NIPQUAD(saddr),
+					      ntohs(skb->h.th->source)));
 			dst_release(dst);
 			goto drop_and_free;
 		}
@@ -1008,7 +1518,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	if (want_cookie) {
 	   	reqsk_free(req);
 	} else {
-		inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
+		tcp_v4_synq_add(sk, req);
 	}
 	return 0;
 
@@ -1036,14 +1546,15 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 	if (sk_acceptq_is_full(sk))
 		goto exit_overflow;
 
-	if (!dst && (dst = inet_csk_route_req(sk, req)) == NULL)
+	if (!dst && (dst = tcp_v4_route_req(sk, req)) == NULL)
 		goto exit;
 
 	newsk = tcp_create_openreq_child(sk, req, skb);
 	if (!newsk)
 		goto exit;
 
-	sk_setup_caps(newsk, dst);
+	newsk->sk_dst_cache = dst;
+	tcp_v4_setup_caps(newsk, dst);
 
 	newtp		      = tcp_sk(newsk);
 	newinet		      = inet_sk(newsk);
@@ -1053,7 +1564,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 	newinet->saddr	      = ireq->loc_addr;
 	newinet->opt	      = ireq->opt;
 	ireq->opt	      = NULL;
-	newinet->mc_index     = inet_iif(skb);
+	newinet->mc_index     = tcp_v4_iif(skb);
 	newinet->mc_ttl	      = skb->nh.iph->ttl;
 	newtp->ext_header_len = 0;
 	if (newinet->opt)
@@ -1064,8 +1575,8 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 	newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
 	tcp_initialize_rcv_mss(newsk);
 
-	__inet_hash(&tcp_hashinfo, newsk, 0);
-	__inet_inherit_port(&tcp_hashinfo, sk, newsk);
+	__tcp_v4_hash(newsk, 0);
+	__tcp_inherit_port(sk, newsk);
 
 	return newsk;
 
@@ -1081,24 +1592,27 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
 {
 	struct tcphdr *th = skb->h.th;
 	struct iphdr *iph = skb->nh.iph;
+	struct tcp_sock *tp = tcp_sk(sk);
 	struct sock *nsk;
 	struct request_sock **prev;
 	/* Find possible connection requests. */
-	struct request_sock *req = inet_csk_search_req(sk, &prev, th->source,
-						       iph->saddr, iph->daddr);
+	struct request_sock *req = tcp_v4_search_req(tp, &prev, th->source,
+						     iph->saddr, iph->daddr);
 	if (req)
 		return tcp_check_req(sk, skb, req, prev);
 
-	nsk = __inet_lookup_established(&tcp_hashinfo, skb->nh.iph->saddr,
-					th->source, skb->nh.iph->daddr,
-					ntohs(th->dest), inet_iif(skb));
+	nsk = __tcp_v4_lookup_established(skb->nh.iph->saddr,
+					  th->source,
+					  skb->nh.iph->daddr,
+					  ntohs(th->dest),
+					  tcp_v4_iif(skb));
 
 	if (nsk) {
 		if (nsk->sk_state != TCP_TIME_WAIT) {
 			bh_lock_sock(nsk);
 			return nsk;
 		}
-		inet_twsk_put((struct inet_timewait_sock *)nsk);
+		tcp_tw_put((struct tcp_tw_bucket *)nsk);
 		return NULL;
 	}
 
@@ -1117,7 +1631,7 @@ static int tcp_v4_checksum_init(struct sk_buff *skb)
 				  skb->nh.iph->daddr, skb->csum))
 			return 0;
 
-		LIMIT_NETDEBUG(KERN_DEBUG "hw tcp v4 csum failed\n");
+		LIMIT_NETDEBUG(printk(KERN_DEBUG "hw tcp v4 csum failed\n"));
 		skb->ip_summed = CHECKSUM_NONE;
 	}
 	if (skb->len <= 76) {
@@ -1233,9 +1747,9 @@ int tcp_v4_rcv(struct sk_buff *skb)
 	TCP_SKB_CB(skb)->flags	 = skb->nh.iph->tos;
 	TCP_SKB_CB(skb)->sacked	 = 0;
 
-	sk = __inet_lookup(&tcp_hashinfo, skb->nh.iph->saddr, th->source,
-			   skb->nh.iph->daddr, ntohs(th->dest),
-			   inet_iif(skb));
+	sk = __tcp_v4_lookup(skb->nh.iph->saddr, th->source,
+			     skb->nh.iph->daddr, ntohs(th->dest),
+			     tcp_v4_iif(skb));
 
 	if (!sk)
 		goto no_tcp_socket;
@@ -1287,26 +1801,24 @@ int tcp_v4_rcv(struct sk_buff *skb)
 
 do_time_wait:
 	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-		inet_twsk_put((struct inet_timewait_sock *) sk);
+		tcp_tw_put((struct tcp_tw_bucket *) sk);
 		goto discard_it;
 	}
 
 	if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
 		TCP_INC_STATS_BH(TCP_MIB_INERRS);
-		inet_twsk_put((struct inet_timewait_sock *) sk);
+		tcp_tw_put((struct tcp_tw_bucket *) sk);
 		goto discard_it;
 	}
-	switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
-					   skb, th)) {
+	switch (tcp_timewait_state_process((struct tcp_tw_bucket *)sk,
+					   skb, th, skb->len)) {
 	case TCP_TW_SYN: {
-		struct sock *sk2 = inet_lookup_listener(&tcp_hashinfo,
-							skb->nh.iph->daddr,
-							ntohs(th->dest),
-							inet_iif(skb));
+		struct sock *sk2 = tcp_v4_lookup_listener(skb->nh.iph->daddr,
+							  ntohs(th->dest),
+							  tcp_v4_iif(skb));
 		if (sk2) {
-			inet_twsk_deschedule((struct inet_timewait_sock *)sk,
-					     &tcp_death_row);
-			inet_twsk_put((struct inet_timewait_sock *)sk);
+			tcp_tw_deschedule((struct tcp_tw_bucket *)sk);
+			tcp_tw_put((struct tcp_tw_bucket *)sk);
 			sk = sk2;
 			goto process;
 		}
@@ -1322,6 +1834,112 @@ int tcp_v4_rcv(struct sk_buff *skb)
 	goto discard_it;
 }
 
+/* With per-bucket locks this operation is not-atomic, so that
+ * this version is not worse.
+ */
+static void __tcp_v4_rehash(struct sock *sk)
+{
+	sk->sk_prot->unhash(sk);
+	sk->sk_prot->hash(sk);
+}
+
+static int tcp_v4_reselect_saddr(struct sock *sk)
+{
+	struct inet_sock *inet = inet_sk(sk);
+	int err;
+	struct rtable *rt;
+	__u32 old_saddr = inet->saddr;
+	__u32 new_saddr;
+	__u32 daddr = inet->daddr;
+
+	if (inet->opt && inet->opt->srr)
+		daddr = inet->opt->faddr;
+
+	/* Query new route. */
+	err = ip_route_connect(&rt, daddr, 0,
+			       RT_CONN_FLAGS(sk),
+			       sk->sk_bound_dev_if,
+			       IPPROTO_TCP,
+			       inet->sport, inet->dport, sk);
+	if (err)
+		return err;
+
+	__sk_dst_set(sk, &rt->u.dst);
+	tcp_v4_setup_caps(sk, &rt->u.dst);
+
+	new_saddr = rt->rt_src;
+
+	if (new_saddr == old_saddr)
+		return 0;
+
+	if (sysctl_ip_dynaddr > 1) {
+		printk(KERN_INFO "tcp_v4_rebuild_header(): shifting inet->"
+				 "saddr from %d.%d.%d.%d to %d.%d.%d.%d\n",
+		       NIPQUAD(old_saddr),
+		       NIPQUAD(new_saddr));
+	}
+
+	inet->saddr = new_saddr;
+	inet->rcv_saddr = new_saddr;
+
+	/* XXX The only one ugly spot where we need to
+	 * XXX really change the sockets identity after
+	 * XXX it has entered the hashes. -DaveM
+	 *
+	 * Besides that, it does not check for connection
+	 * uniqueness. Wait for troubles.
+	 */
+	__tcp_v4_rehash(sk);
+	return 0;
+}
+
+int tcp_v4_rebuild_header(struct sock *sk)
+{
+	struct inet_sock *inet = inet_sk(sk);
+	struct rtable *rt = (struct rtable *)__sk_dst_check(sk, 0);
+	u32 daddr;
+	int err;
+
+	/* Route is OK, nothing to do. */
+	if (rt)
+		return 0;
+
+	/* Reroute. */
+	daddr = inet->daddr;
+	if (inet->opt && inet->opt->srr)
+		daddr = inet->opt->faddr;
+
+	{
+		struct flowi fl = { .oif = sk->sk_bound_dev_if,
+				    .nl_u = { .ip4_u =
+					      { .daddr = daddr,
+						.saddr = inet->saddr,
+						.tos = RT_CONN_FLAGS(sk) } },
+				    .proto = IPPROTO_TCP,
+				    .uli_u = { .ports =
+					       { .sport = inet->sport,
+						 .dport = inet->dport } } };
+						
+		err = ip_route_output_flow(&rt, &fl, sk, 0);
+	}
+	if (!err) {
+		__sk_dst_set(sk, &rt->u.dst);
+		tcp_v4_setup_caps(sk, &rt->u.dst);
+		return 0;
+	}
+
+	/* Routing failed... */
+	sk->sk_route_caps = 0;
+
+	if (!sysctl_ip_dynaddr ||
+	    sk->sk_state != TCP_SYN_SENT ||
+	    (sk->sk_userlocks & SOCK_BINDADDR_LOCK) ||
+	    (err = tcp_v4_reselect_saddr(sk)) != 0)
+		sk->sk_err_soft = -err;
+
+	return err;
+}
+
 static void v4_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
 {
 	struct sockaddr_in *sin = (struct sockaddr_in *) uaddr;
@@ -1370,18 +1988,18 @@ int tcp_v4_remember_stamp(struct sock *sk)
 	return 0;
 }
 
-int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
+int tcp_v4_tw_remember_stamp(struct tcp_tw_bucket *tw)
 {
-	struct inet_peer *peer = inet_getpeer(tw->tw_daddr, 1);
+	struct inet_peer *peer = NULL;
 
-	if (peer) {
-		const struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
+	peer = inet_getpeer(tw->tw_daddr, 1);
 
-		if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
+	if (peer) {
+		if ((s32)(peer->tcp_ts - tw->tw_ts_recent) <= 0 ||
 		    (peer->tcp_ts_stamp + TCP_PAWS_MSL < xtime.tv_sec &&
-		     peer->tcp_ts_stamp <= tcptw->tw_ts_recent_stamp)) {
-			peer->tcp_ts_stamp = tcptw->tw_ts_recent_stamp;
-			peer->tcp_ts	   = tcptw->tw_ts_recent;
+		     peer->tcp_ts_stamp <= tw->tw_ts_recent_stamp)) {
+			peer->tcp_ts_stamp = tw->tw_ts_recent_stamp;
+			peer->tcp_ts = tw->tw_ts_recent;
 		}
 		inet_putpeer(peer);
 		return 1;
@@ -1393,7 +2011,7 @@ int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
 struct tcp_func ipv4_specific = {
 	.queue_xmit	=	ip_queue_xmit,
 	.send_check	=	tcp_v4_send_check,
-	.rebuild_header	=	inet_sk_rebuild_header,
+	.rebuild_header	=	tcp_v4_rebuild_header,
 	.conn_request	=	tcp_v4_conn_request,
 	.syn_recv_sock	=	tcp_v4_syn_recv_sock,
 	.remember_stamp	=	tcp_v4_remember_stamp,
@@ -1409,14 +2027,13 @@ struct tcp_func ipv4_specific = {
  */
 static int tcp_v4_init_sock(struct sock *sk)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 
 	skb_queue_head_init(&tp->out_of_order_queue);
 	tcp_init_xmit_timers(sk);
 	tcp_prequeue_init(tp);
 
-	icsk->icsk_rto = TCP_TIMEOUT_INIT;
+	tp->rto  = TCP_TIMEOUT_INIT;
 	tp->mdev = TCP_TIMEOUT_INIT;
 
 	/* So many TCP implementations out there (incorrectly) count the
@@ -1434,7 +2051,7 @@ static int tcp_v4_init_sock(struct sock *sk)
 	tp->mss_cache = 536;
 
 	tp->reordering = sysctl_tcp_reordering;
-	icsk->icsk_ca_ops = &tcp_init_congestion_ops;
+	tp->ca_ops = &tcp_init_congestion_ops;
 
 	sk->sk_state = TCP_CLOSE;
 
@@ -1457,7 +2074,7 @@ int tcp_v4_destroy_sock(struct sock *sk)
 
 	tcp_clear_xmit_timers(sk);
 
-	tcp_cleanup_congestion_control(sk);
+	tcp_cleanup_congestion_control(tp);
 
 	/* Cleanup up the write buffer. */
   	sk_stream_writequeue_purge(sk);
@@ -1469,8 +2086,8 @@ int tcp_v4_destroy_sock(struct sock *sk)
 	__skb_queue_purge(&tp->ucopy.prequeue);
 
 	/* Clean up a referenced TCP bind bucket. */
-	if (inet_csk(sk)->icsk_bind_hash)
-		inet_put_port(&tcp_hashinfo, sk);
+	if (tp->bind_hash)
+		tcp_put_port(sk);
 
 	/*
 	 * If sendmsg cached page exists, toss it.
@@ -1490,13 +2107,13 @@ EXPORT_SYMBOL(tcp_v4_destroy_sock);
 #ifdef CONFIG_PROC_FS
 /* Proc filesystem TCP sock list dumping. */
 
-static inline struct inet_timewait_sock *tw_head(struct hlist_head *head)
+static inline struct tcp_tw_bucket *tw_head(struct hlist_head *head)
 {
 	return hlist_empty(head) ? NULL :
-		list_entry(head->first, struct inet_timewait_sock, tw_node);
+		list_entry(head->first, struct tcp_tw_bucket, tw_node);
 }
 
-static inline struct inet_timewait_sock *tw_next(struct inet_timewait_sock *tw)
+static inline struct tcp_tw_bucket *tw_next(struct tcp_tw_bucket *tw)
 {
 	return tw->tw_node.next ?
 		hlist_entry(tw->tw_node.next, typeof(*tw), tw_node) : NULL;
@@ -1504,14 +2121,14 @@ static inline struct inet_timewait_sock *tw_next(struct inet_timewait_sock *tw)
 
 static void *listening_get_next(struct seq_file *seq, void *cur)
 {
-	struct inet_connection_sock *icsk;
+	struct tcp_sock *tp;
 	struct hlist_node *node;
 	struct sock *sk = cur;
 	struct tcp_iter_state* st = seq->private;
 
 	if (!sk) {
 		st->bucket = 0;
-		sk = sk_head(&tcp_hashinfo.listening_hash[0]);
+		sk = sk_head(&tcp_listening_hash[0]);
 		goto get_sk;
 	}
 
@@ -1520,7 +2137,7 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
 	if (st->state == TCP_SEQ_STATE_OPENREQ) {
 		struct request_sock *req = cur;
 
-	       	icsk = inet_csk(st->syn_wait_sk);
+	       	tp = tcp_sk(st->syn_wait_sk);
 		req = req->dl_next;
 		while (1) {
 			while (req) {
@@ -1533,17 +2150,17 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
 			if (++st->sbucket >= TCP_SYNQ_HSIZE)
 				break;
 get_req:
-			req = icsk->icsk_accept_queue.listen_opt->syn_table[st->sbucket];
+			req = tp->accept_queue.listen_opt->syn_table[st->sbucket];
 		}
 		sk	  = sk_next(st->syn_wait_sk);
 		st->state = TCP_SEQ_STATE_LISTENING;
-		read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
+		read_unlock_bh(&tp->accept_queue.syn_wait_lock);
 	} else {
-	       	icsk = inet_csk(sk);
-		read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
-		if (reqsk_queue_len(&icsk->icsk_accept_queue))
+	       	tp = tcp_sk(sk);
+		read_lock_bh(&tp->accept_queue.syn_wait_lock);
+		if (reqsk_queue_len(&tp->accept_queue))
 			goto start_req;
-		read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
+		read_unlock_bh(&tp->accept_queue.syn_wait_lock);
 		sk = sk_next(sk);
 	}
 get_sk:
@@ -1552,9 +2169,9 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
 			cur = sk;
 			goto out;
 		}
-	       	icsk = inet_csk(sk);
-		read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
-		if (reqsk_queue_len(&icsk->icsk_accept_queue)) {
+	       	tp = tcp_sk(sk);
+		read_lock_bh(&tp->accept_queue.syn_wait_lock);
+		if (reqsk_queue_len(&tp->accept_queue)) {
 start_req:
 			st->uid		= sock_i_uid(sk);
 			st->syn_wait_sk = sk;
@@ -1562,10 +2179,10 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
 			st->sbucket	= 0;
 			goto get_req;
 		}
-		read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
+		read_unlock_bh(&tp->accept_queue.syn_wait_lock);
 	}
-	if (++st->bucket < INET_LHTABLE_SIZE) {
-		sk = sk_head(&tcp_hashinfo.listening_hash[st->bucket]);
+	if (++st->bucket < TCP_LHTABLE_SIZE) {
+		sk = sk_head(&tcp_listening_hash[st->bucket]);
 		goto get_sk;
 	}
 	cur = NULL;
@@ -1589,16 +2206,16 @@ static void *established_get_first(struct seq_file *seq)
 	struct tcp_iter_state* st = seq->private;
 	void *rc = NULL;
 
-	for (st->bucket = 0; st->bucket < tcp_hashinfo.ehash_size; ++st->bucket) {
+	for (st->bucket = 0; st->bucket < tcp_ehash_size; ++st->bucket) {
 		struct sock *sk;
 		struct hlist_node *node;
-		struct inet_timewait_sock *tw;
+		struct tcp_tw_bucket *tw;
 
 		/* We can reschedule _before_ having picked the target: */
 		cond_resched_softirq();
 
-		read_lock(&tcp_hashinfo.ehash[st->bucket].lock);
-		sk_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) {
+		read_lock(&tcp_ehash[st->bucket].lock);
+		sk_for_each(sk, node, &tcp_ehash[st->bucket].chain) {
 			if (sk->sk_family != st->family) {
 				continue;
 			}
@@ -1606,15 +2223,15 @@ static void *established_get_first(struct seq_file *seq)
 			goto out;
 		}
 		st->state = TCP_SEQ_STATE_TIME_WAIT;
-		inet_twsk_for_each(tw, node,
-				   &tcp_hashinfo.ehash[st->bucket + tcp_hashinfo.ehash_size].chain) {
+		tw_for_each(tw, node,
+			    &tcp_ehash[st->bucket + tcp_ehash_size].chain) {
 			if (tw->tw_family != st->family) {
 				continue;
 			}
 			rc = tw;
 			goto out;
 		}
-		read_unlock(&tcp_hashinfo.ehash[st->bucket].lock);
+		read_unlock(&tcp_ehash[st->bucket].lock);
 		st->state = TCP_SEQ_STATE_ESTABLISHED;
 	}
 out:
@@ -1624,7 +2241,7 @@ static void *established_get_first(struct seq_file *seq)
 static void *established_get_next(struct seq_file *seq, void *cur)
 {
 	struct sock *sk = cur;
-	struct inet_timewait_sock *tw;
+	struct tcp_tw_bucket *tw;
 	struct hlist_node *node;
 	struct tcp_iter_state* st = seq->private;
 
@@ -1641,15 +2258,15 @@ static void *established_get_next(struct seq_file *seq, void *cur)
 			cur = tw;
 			goto out;
 		}
-		read_unlock(&tcp_hashinfo.ehash[st->bucket].lock);
+		read_unlock(&tcp_ehash[st->bucket].lock);
 		st->state = TCP_SEQ_STATE_ESTABLISHED;
 
 		/* We can reschedule between buckets: */
 		cond_resched_softirq();
 
-		if (++st->bucket < tcp_hashinfo.ehash_size) {
-			read_lock(&tcp_hashinfo.ehash[st->bucket].lock);
-			sk = sk_head(&tcp_hashinfo.ehash[st->bucket].chain);
+		if (++st->bucket < tcp_ehash_size) {
+			read_lock(&tcp_ehash[st->bucket].lock);
+			sk = sk_head(&tcp_ehash[st->bucket].chain);
 		} else {
 			cur = NULL;
 			goto out;
@@ -1663,7 +2280,7 @@ static void *established_get_next(struct seq_file *seq, void *cur)
 	}
 
 	st->state = TCP_SEQ_STATE_TIME_WAIT;
-	tw = tw_head(&tcp_hashinfo.ehash[st->bucket + tcp_hashinfo.ehash_size].chain);
+	tw = tw_head(&tcp_ehash[st->bucket + tcp_ehash_size].chain);
 	goto get_tw;
 found:
 	cur = sk;
@@ -1687,12 +2304,12 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
 	void *rc;
 	struct tcp_iter_state* st = seq->private;
 
-	inet_listen_lock(&tcp_hashinfo);
+	tcp_listen_lock();
 	st->state = TCP_SEQ_STATE_LISTENING;
 	rc	  = listening_get_idx(seq, &pos);
 
 	if (!rc) {
-		inet_listen_unlock(&tcp_hashinfo);
+		tcp_listen_unlock();
 		local_bh_disable();
 		st->state = TCP_SEQ_STATE_ESTABLISHED;
 		rc	  = established_get_idx(seq, pos);
@@ -1725,7 +2342,7 @@ static void *tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 	case TCP_SEQ_STATE_LISTENING:
 		rc = listening_get_next(seq, v);
 		if (!rc) {
-			inet_listen_unlock(&tcp_hashinfo);
+			tcp_listen_unlock();
 			local_bh_disable();
 			st->state = TCP_SEQ_STATE_ESTABLISHED;
 			rc	  = established_get_first(seq);
@@ -1748,17 +2365,17 @@ static void tcp_seq_stop(struct seq_file *seq, void *v)
 	switch (st->state) {
 	case TCP_SEQ_STATE_OPENREQ:
 		if (v) {
-			struct inet_connection_sock *icsk = inet_csk(st->syn_wait_sk);
-			read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
+			struct tcp_sock *tp = tcp_sk(st->syn_wait_sk);
+			read_unlock_bh(&tp->accept_queue.syn_wait_lock);
 		}
 	case TCP_SEQ_STATE_LISTENING:
 		if (v != SEQ_START_TOKEN)
-			inet_listen_unlock(&tcp_hashinfo);
+			tcp_listen_unlock();
 		break;
 	case TCP_SEQ_STATE_TIME_WAIT:
 	case TCP_SEQ_STATE_ESTABLISHED:
 		if (v)
-			read_unlock(&tcp_hashinfo.ehash[st->bucket].lock);
+			read_unlock(&tcp_ehash[st->bucket].lock);
 		local_bh_enable();
 		break;
 	}
@@ -1855,19 +2472,18 @@ static void get_tcp4_sock(struct sock *sp, char *tmpbuf, int i)
 	int timer_active;
 	unsigned long timer_expires;
 	struct tcp_sock *tp = tcp_sk(sp);
-	const struct inet_connection_sock *icsk = inet_csk(sp);
 	struct inet_sock *inet = inet_sk(sp);
 	unsigned int dest = inet->daddr;
 	unsigned int src = inet->rcv_saddr;
 	__u16 destp = ntohs(inet->dport);
 	__u16 srcp = ntohs(inet->sport);
 
-	if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
+	if (tp->pending == TCP_TIME_RETRANS) {
 		timer_active	= 1;
-		timer_expires	= icsk->icsk_timeout;
-	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
+		timer_expires	= tp->timeout;
+	} else if (tp->pending == TCP_TIME_PROBE0) {
 		timer_active	= 4;
-		timer_expires	= icsk->icsk_timeout;
+		timer_expires	= tp->timeout;
 	} else if (timer_pending(&sp->sk_timer)) {
 		timer_active	= 2;
 		timer_expires	= sp->sk_timer.expires;
@@ -1882,19 +2498,17 @@ static void get_tcp4_sock(struct sock *sp, char *tmpbuf, int i)
 		tp->write_seq - tp->snd_una, tp->rcv_nxt - tp->copied_seq,
 		timer_active,
 		jiffies_to_clock_t(timer_expires - jiffies),
-		icsk->icsk_retransmits,
+		tp->retransmits,
 		sock_i_uid(sp),
-		icsk->icsk_probes_out,
+		tp->probes_out,
 		sock_i_ino(sp),
 		atomic_read(&sp->sk_refcnt), sp,
-		icsk->icsk_rto,
-		icsk->icsk_ack.ato,
-		(icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
+		tp->rto, tp->ack.ato, (tp->ack.quick << 1) | tp->ack.pingpong,
 		tp->snd_cwnd,
 		tp->snd_ssthresh >= 0xFFFF ? -1 : tp->snd_ssthresh);
 }
 
-static void get_timewait4_sock(struct inet_timewait_sock *tw, char *tmpbuf, int i)
+static void get_timewait4_sock(struct tcp_tw_bucket *tw, char *tmpbuf, int i)
 {
 	unsigned int dest, src;
 	__u16 destp, srcp;
@@ -1974,7 +2588,7 @@ struct proto tcp_prot = {
 	.close			= tcp_close,
 	.connect		= tcp_v4_connect,
 	.disconnect		= tcp_disconnect,
-	.accept			= inet_csk_accept,
+	.accept			= tcp_accept,
 	.ioctl			= tcp_ioctl,
 	.init			= tcp_v4_init_sock,
 	.destroy		= tcp_v4_destroy_sock,
@@ -1989,7 +2603,6 @@ struct proto tcp_prot = {
 	.get_port		= tcp_v4_get_port,
 	.enter_memory_pressure	= tcp_enter_memory_pressure,
 	.sockets_allocated	= &tcp_sockets_allocated,
-	.orphan_count		= &tcp_orphan_count,
 	.memory_allocated	= &tcp_memory_allocated,
 	.memory_pressure	= &tcp_memory_pressure,
 	.sysctl_mem		= sysctl_tcp_mem,
@@ -1997,7 +2610,6 @@ struct proto tcp_prot = {
 	.sysctl_rmem		= sysctl_tcp_rmem,
 	.max_header		= MAX_TCP_HEADER,
 	.obj_size		= sizeof(struct tcp_sock),
-	.twsk_obj_size		= sizeof(struct tcp_timewait_sock),
 	.rsk_prot		= &tcp_request_sock_ops,
 };
 
@@ -2019,13 +2631,19 @@ void __init tcp_v4_init(struct net_proto_family *ops)
 }
 
 EXPORT_SYMBOL(ipv4_specific);
-EXPORT_SYMBOL(inet_bind_bucket_create);
+EXPORT_SYMBOL(tcp_bind_hash);
+EXPORT_SYMBOL(tcp_bucket_create);
 EXPORT_SYMBOL(tcp_hashinfo);
+EXPORT_SYMBOL(tcp_inherit_port);
+EXPORT_SYMBOL(tcp_listen_wlock);
+EXPORT_SYMBOL(tcp_port_rover);
 EXPORT_SYMBOL(tcp_prot);
+EXPORT_SYMBOL(tcp_put_port);
 EXPORT_SYMBOL(tcp_unhash);
 EXPORT_SYMBOL(tcp_v4_conn_request);
 EXPORT_SYMBOL(tcp_v4_connect);
 EXPORT_SYMBOL(tcp_v4_do_rcv);
+EXPORT_SYMBOL(tcp_v4_rebuild_header);
 EXPORT_SYMBOL(tcp_v4_remember_stamp);
 EXPORT_SYMBOL(tcp_v4_send_check);
 EXPORT_SYMBOL(tcp_v4_syn_recv_sock);
diff --git a/trunk/net/ipv4/tcp_minisocks.c b/trunk/net/ipv4/tcp_minisocks.c
index a88db28b0af7..f42a284164b7 100644
--- a/trunk/net/ipv4/tcp_minisocks.c
+++ b/trunk/net/ipv4/tcp_minisocks.c
@@ -35,27 +35,13 @@
 #define SYNC_INIT 1
 #endif
 
+int sysctl_tcp_tw_recycle;
+int sysctl_tcp_max_tw_buckets = NR_FILE*2;
+
 int sysctl_tcp_syncookies = SYNC_INIT; 
 int sysctl_tcp_abort_on_overflow;
 
-struct inet_timewait_death_row tcp_death_row = {
-	.sysctl_max_tw_buckets = NR_FILE * 2,
-	.period		= TCP_TIMEWAIT_LEN / INET_TWDR_TWKILL_SLOTS,
-	.death_lock	= SPIN_LOCK_UNLOCKED,
-	.hashinfo	= &tcp_hashinfo,
-	.tw_timer	= TIMER_INITIALIZER(inet_twdr_hangman, 0,
-					    (unsigned long)&tcp_death_row),
-	.twkill_work	= __WORK_INITIALIZER(tcp_death_row.twkill_work,
-					     inet_twdr_twkill_work,
-					     &tcp_death_row),
-/* Short-time timewait calendar */
-
-	.twcal_hand	= -1,
-	.twcal_timer	= TIMER_INITIALIZER(inet_twdr_twcal_tick, 0,
-					    (unsigned long)&tcp_death_row),
-};
-
-EXPORT_SYMBOL_GPL(tcp_death_row);
+static void tcp_tw_schedule(struct tcp_tw_bucket *tw, int timeo);
 
 static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
 {
@@ -66,6 +52,47 @@ static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
 	return (seq == e_win && seq == end_seq);
 }
 
+/* New-style handling of TIME_WAIT sockets. */
+
+int tcp_tw_count;
+
+
+/* Must be called with locally disabled BHs. */
+static void tcp_timewait_kill(struct tcp_tw_bucket *tw)
+{
+	struct tcp_ehash_bucket *ehead;
+	struct tcp_bind_hashbucket *bhead;
+	struct tcp_bind_bucket *tb;
+
+	/* Unlink from established hashes. */
+	ehead = &tcp_ehash[tw->tw_hashent];
+	write_lock(&ehead->lock);
+	if (hlist_unhashed(&tw->tw_node)) {
+		write_unlock(&ehead->lock);
+		return;
+	}
+	__hlist_del(&tw->tw_node);
+	sk_node_init(&tw->tw_node);
+	write_unlock(&ehead->lock);
+
+	/* Disassociate with bind bucket. */
+	bhead = &tcp_bhash[tcp_bhashfn(tw->tw_num)];
+	spin_lock(&bhead->lock);
+	tb = tw->tw_tb;
+	__hlist_del(&tw->tw_bind_node);
+	tw->tw_tb = NULL;
+	tcp_bucket_destroy(tb);
+	spin_unlock(&bhead->lock);
+
+#ifdef INET_REFCNT_DEBUG
+	if (atomic_read(&tw->tw_refcnt) != 1) {
+		printk(KERN_DEBUG "tw_bucket %p refcnt=%d\n", tw,
+		       atomic_read(&tw->tw_refcnt));
+	}
+#endif
+	tcp_tw_put(tw);
+}
+
 /* 
  * * Main purpose of TIME-WAIT state is to close connection gracefully,
  *   when one of ends sits in LAST-ACK or CLOSING retransmitting FIN
@@ -95,20 +122,19 @@ static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
  * to avoid misread sequence numbers, states etc.  --ANK
  */
 enum tcp_tw_status
-tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
-			   const struct tcphdr *th)
+tcp_timewait_state_process(struct tcp_tw_bucket *tw, struct sk_buff *skb,
+			   struct tcphdr *th, unsigned len)
 {
-	struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
 	struct tcp_options_received tmp_opt;
 	int paws_reject = 0;
 
 	tmp_opt.saw_tstamp = 0;
-	if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
+	if (th->doff > (sizeof(struct tcphdr) >> 2) && tw->tw_ts_recent_stamp) {
 		tcp_parse_options(skb, &tmp_opt, 0);
 
 		if (tmp_opt.saw_tstamp) {
-			tmp_opt.ts_recent	= tcptw->tw_ts_recent;
-			tmp_opt.ts_recent_stamp	= tcptw->tw_ts_recent_stamp;
+			tmp_opt.ts_recent	   = tw->tw_ts_recent;
+			tmp_opt.ts_recent_stamp = tw->tw_ts_recent_stamp;
 			paws_reject = tcp_paws_check(&tmp_opt, th->rst);
 		}
 	}
@@ -119,20 +145,20 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 		/* Out of window, send ACK */
 		if (paws_reject ||
 		    !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
-				   tcptw->tw_rcv_nxt,
-				   tcptw->tw_rcv_nxt + tcptw->tw_rcv_wnd))
+				   tw->tw_rcv_nxt,
+				   tw->tw_rcv_nxt + tw->tw_rcv_wnd))
 			return TCP_TW_ACK;
 
 		if (th->rst)
 			goto kill;
 
-		if (th->syn && !before(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt))
+		if (th->syn && !before(TCP_SKB_CB(skb)->seq, tw->tw_rcv_nxt))
 			goto kill_with_rst;
 
 		/* Dup ACK? */
-		if (!after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
+		if (!after(TCP_SKB_CB(skb)->end_seq, tw->tw_rcv_nxt) ||
 		    TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
-			inet_twsk_put(tw);
+			tcp_tw_put(tw);
 			return TCP_TW_SUCCESS;
 		}
 
@@ -140,19 +166,19 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 		 * reset.
 		 */
 		if (!th->fin ||
-		    TCP_SKB_CB(skb)->end_seq != tcptw->tw_rcv_nxt + 1) {
+		    TCP_SKB_CB(skb)->end_seq != tw->tw_rcv_nxt + 1) {
 kill_with_rst:
-			inet_twsk_deschedule(tw, &tcp_death_row);
-			inet_twsk_put(tw);
+			tcp_tw_deschedule(tw);
+			tcp_tw_put(tw);
 			return TCP_TW_RST;
 		}
 
 		/* FIN arrived, enter true time-wait state. */
-		tw->tw_substate	  = TCP_TIME_WAIT;
-		tcptw->tw_rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+		tw->tw_substate	= TCP_TIME_WAIT;
+		tw->tw_rcv_nxt	= TCP_SKB_CB(skb)->end_seq;
 		if (tmp_opt.saw_tstamp) {
-			tcptw->tw_ts_recent_stamp = xtime.tv_sec;
-			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
+			tw->tw_ts_recent_stamp	= xtime.tv_sec;
+			tw->tw_ts_recent	= tmp_opt.rcv_tsval;
 		}
 
 		/* I am shamed, but failed to make it more elegant.
@@ -161,13 +187,11 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 		 * do not undertsnad recycling in any case, it not
 		 * a big problem in practice. --ANK */
 		if (tw->tw_family == AF_INET &&
-		    tcp_death_row.sysctl_tw_recycle && tcptw->tw_ts_recent_stamp &&
+		    sysctl_tcp_tw_recycle && tw->tw_ts_recent_stamp &&
 		    tcp_v4_tw_remember_stamp(tw))
-			inet_twsk_schedule(tw, &tcp_death_row, tw->tw_timeout,
-					   TCP_TIMEWAIT_LEN);
+			tcp_tw_schedule(tw, tw->tw_timeout);
 		else
-			inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
-					   TCP_TIMEWAIT_LEN);
+			tcp_tw_schedule(tw, TCP_TIMEWAIT_LEN);
 		return TCP_TW_ACK;
 	}
 
@@ -189,7 +213,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 	 */
 
 	if (!paws_reject &&
-	    (TCP_SKB_CB(skb)->seq == tcptw->tw_rcv_nxt &&
+	    (TCP_SKB_CB(skb)->seq == tw->tw_rcv_nxt &&
 	     (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq || th->rst))) {
 		/* In window segment, it may be only reset or bare ack. */
 
@@ -200,20 +224,19 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 			 */
 			if (sysctl_tcp_rfc1337 == 0) {
 kill:
-				inet_twsk_deschedule(tw, &tcp_death_row);
-				inet_twsk_put(tw);
+				tcp_tw_deschedule(tw);
+				tcp_tw_put(tw);
 				return TCP_TW_SUCCESS;
 			}
 		}
-		inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
-				   TCP_TIMEWAIT_LEN);
+		tcp_tw_schedule(tw, TCP_TIMEWAIT_LEN);
 
 		if (tmp_opt.saw_tstamp) {
-			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
-			tcptw->tw_ts_recent_stamp = xtime.tv_sec;
+			tw->tw_ts_recent	= tmp_opt.rcv_tsval;
+			tw->tw_ts_recent_stamp	= xtime.tv_sec;
 		}
 
-		inet_twsk_put(tw);
+		tcp_tw_put(tw);
 		return TCP_TW_SUCCESS;
 	}
 
@@ -235,10 +258,9 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 	 */
 
 	if (th->syn && !th->rst && !th->ack && !paws_reject &&
-	    (after(TCP_SKB_CB(skb)->seq, tcptw->tw_rcv_nxt) ||
-	     (tmp_opt.saw_tstamp &&
-	      (s32)(tcptw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
-		u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
+	    (after(TCP_SKB_CB(skb)->seq, tw->tw_rcv_nxt) ||
+	     (tmp_opt.saw_tstamp && (s32)(tw->tw_ts_recent - tmp_opt.rcv_tsval) < 0))) {
+		u32 isn = tw->tw_snd_nxt + 65535 + 2;
 		if (isn == 0)
 			isn++;
 		TCP_SKB_CB(skb)->when = isn;
@@ -256,57 +278,107 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
 		 * Do not reschedule in the last case.
 		 */
 		if (paws_reject || th->ack)
-			inet_twsk_schedule(tw, &tcp_death_row, TCP_TIMEWAIT_LEN,
-					   TCP_TIMEWAIT_LEN);
+			tcp_tw_schedule(tw, TCP_TIMEWAIT_LEN);
 
 		/* Send ACK. Note, we do not put the bucket,
 		 * it will be released by caller.
 		 */
 		return TCP_TW_ACK;
 	}
-	inet_twsk_put(tw);
+	tcp_tw_put(tw);
 	return TCP_TW_SUCCESS;
 }
 
+/* Enter the time wait state.  This is called with locally disabled BH.
+ * Essentially we whip up a timewait bucket, copy the
+ * relevant info into it from the SK, and mess with hash chains
+ * and list linkage.
+ */
+static void __tcp_tw_hashdance(struct sock *sk, struct tcp_tw_bucket *tw)
+{
+	struct tcp_ehash_bucket *ehead = &tcp_ehash[sk->sk_hashent];
+	struct tcp_bind_hashbucket *bhead;
+
+	/* Step 1: Put TW into bind hash. Original socket stays there too.
+	   Note, that any socket with inet_sk(sk)->num != 0 MUST be bound in
+	   binding cache, even if it is closed.
+	 */
+	bhead = &tcp_bhash[tcp_bhashfn(inet_sk(sk)->num)];
+	spin_lock(&bhead->lock);
+	tw->tw_tb = tcp_sk(sk)->bind_hash;
+	BUG_TRAP(tcp_sk(sk)->bind_hash);
+	tw_add_bind_node(tw, &tw->tw_tb->owners);
+	spin_unlock(&bhead->lock);
+
+	write_lock(&ehead->lock);
+
+	/* Step 2: Remove SK from established hash. */
+	if (__sk_del_node_init(sk))
+		sock_prot_dec_use(sk->sk_prot);
+
+	/* Step 3: Hash TW into TIMEWAIT half of established hash table. */
+	tw_add_node(tw, &(ehead + tcp_ehash_size)->chain);
+	atomic_inc(&tw->tw_refcnt);
+
+	write_unlock(&ehead->lock);
+}
+
 /* 
  * Move a socket to time-wait or dead fin-wait-2 state.
  */ 
 void tcp_time_wait(struct sock *sk, int state, int timeo)
 {
-	struct inet_timewait_sock *tw = NULL;
-	const struct tcp_sock *tp = tcp_sk(sk);
+	struct tcp_tw_bucket *tw = NULL;
+	struct tcp_sock *tp = tcp_sk(sk);
 	int recycle_ok = 0;
 
-	if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp)
+	if (sysctl_tcp_tw_recycle && tp->rx_opt.ts_recent_stamp)
 		recycle_ok = tp->af_specific->remember_stamp(sk);
 
-	if (tcp_death_row.tw_count < tcp_death_row.sysctl_max_tw_buckets)
-		tw = inet_twsk_alloc(sk, state);
-
-	if (tw != NULL) {
-		struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
-		const struct inet_connection_sock *icsk = inet_csk(sk);
-		const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
-
+	if (tcp_tw_count < sysctl_tcp_max_tw_buckets)
+		tw = kmem_cache_alloc(tcp_timewait_cachep, SLAB_ATOMIC);
+
+	if(tw != NULL) {
+		struct inet_sock *inet = inet_sk(sk);
+		int rto = (tp->rto<<2) - (tp->rto>>1);
+
+		/* Give us an identity. */
+		tw->tw_daddr		= inet->daddr;
+		tw->tw_rcv_saddr	= inet->rcv_saddr;
+		tw->tw_bound_dev_if	= sk->sk_bound_dev_if;
+		tw->tw_num		= inet->num;
+		tw->tw_state		= TCP_TIME_WAIT;
+		tw->tw_substate		= state;
+		tw->tw_sport		= inet->sport;
+		tw->tw_dport		= inet->dport;
+		tw->tw_family		= sk->sk_family;
+		tw->tw_reuse		= sk->sk_reuse;
 		tw->tw_rcv_wscale	= tp->rx_opt.rcv_wscale;
-		tcptw->tw_rcv_nxt	= tp->rcv_nxt;
-		tcptw->tw_snd_nxt	= tp->snd_nxt;
-		tcptw->tw_rcv_wnd	= tcp_receive_window(tp);
-		tcptw->tw_ts_recent	= tp->rx_opt.ts_recent;
-		tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
+		atomic_set(&tw->tw_refcnt, 1);
+
+		tw->tw_hashent		= sk->sk_hashent;
+		tw->tw_rcv_nxt		= tp->rcv_nxt;
+		tw->tw_snd_nxt		= tp->snd_nxt;
+		tw->tw_rcv_wnd		= tcp_receive_window(tp);
+		tw->tw_ts_recent	= tp->rx_opt.ts_recent;
+		tw->tw_ts_recent_stamp	= tp->rx_opt.ts_recent_stamp;
+		tw_dead_node_init(tw);
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 		if (tw->tw_family == PF_INET6) {
 			struct ipv6_pinfo *np = inet6_sk(sk);
-			struct tcp6_timewait_sock *tcp6tw = tcp6_twsk((struct sock *)tw);
 
-			ipv6_addr_copy(&tcp6tw->tw_v6_daddr, &np->daddr);
-			ipv6_addr_copy(&tcp6tw->tw_v6_rcv_saddr, &np->rcv_saddr);
-			tw->tw_ipv6only = np->ipv6only;
+			ipv6_addr_copy(&tw->tw_v6_daddr, &np->daddr);
+			ipv6_addr_copy(&tw->tw_v6_rcv_saddr, &np->rcv_saddr);
+			tw->tw_v6_ipv6only = np->ipv6only;
+		} else {
+			memset(&tw->tw_v6_daddr, 0, sizeof(tw->tw_v6_daddr));
+			memset(&tw->tw_v6_rcv_saddr, 0, sizeof(tw->tw_v6_rcv_saddr));
+			tw->tw_v6_ipv6only = 0;
 		}
 #endif
 		/* Linkage updates. */
-		__inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
+		__tcp_tw_hashdance(sk, tw);
 
 		/* Get the TIME_WAIT timeout firing. */
 		if (timeo < rto)
@@ -320,9 +392,8 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
 				timeo = TCP_TIMEWAIT_LEN;
 		}
 
-		inet_twsk_schedule(tw, &tcp_death_row, timeo,
-				   TCP_TIMEWAIT_LEN);
-		inet_twsk_put(tw);
+		tcp_tw_schedule(tw, timeo);
+		tcp_tw_put(tw);
 	} else {
 		/* Sorry, if we're out of memory, just CLOSE this
 		 * socket up.  We've got bigger problems than
@@ -336,6 +407,277 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
 	tcp_done(sk);
 }
 
+/* Kill off TIME_WAIT sockets once their lifetime has expired. */
+static int tcp_tw_death_row_slot;
+
+static void tcp_twkill(unsigned long);
+
+/* TIME_WAIT reaping mechanism. */
+#define TCP_TWKILL_SLOTS	8	/* Please keep this a power of 2. */
+#define TCP_TWKILL_PERIOD	(TCP_TIMEWAIT_LEN/TCP_TWKILL_SLOTS)
+
+#define TCP_TWKILL_QUOTA	100
+
+static struct hlist_head tcp_tw_death_row[TCP_TWKILL_SLOTS];
+static DEFINE_SPINLOCK(tw_death_lock);
+static struct timer_list tcp_tw_timer = TIMER_INITIALIZER(tcp_twkill, 0, 0);
+static void twkill_work(void *);
+static DECLARE_WORK(tcp_twkill_work, twkill_work, NULL);
+static u32 twkill_thread_slots;
+
+/* Returns non-zero if quota exceeded.  */
+static int tcp_do_twkill_work(int slot, unsigned int quota)
+{
+	struct tcp_tw_bucket *tw;
+	struct hlist_node *node;
+	unsigned int killed;
+	int ret;
+
+	/* NOTE: compare this to previous version where lock
+	 * was released after detaching chain. It was racy,
+	 * because tw buckets are scheduled in not serialized context
+	 * in 2.3 (with netfilter), and with softnet it is common, because
+	 * soft irqs are not sequenced.
+	 */
+	killed = 0;
+	ret = 0;
+rescan:
+	tw_for_each_inmate(tw, node, &tcp_tw_death_row[slot]) {
+		__tw_del_dead_node(tw);
+		spin_unlock(&tw_death_lock);
+		tcp_timewait_kill(tw);
+		tcp_tw_put(tw);
+		killed++;
+		spin_lock(&tw_death_lock);
+		if (killed > quota) {
+			ret = 1;
+			break;
+		}
+
+		/* While we dropped tw_death_lock, another cpu may have
+		 * killed off the next TW bucket in the list, therefore
+		 * do a fresh re-read of the hlist head node with the
+		 * lock reacquired.  We still use the hlist traversal
+		 * macro in order to get the prefetches.
+		 */
+		goto rescan;
+	}
+
+	tcp_tw_count -= killed;
+	NET_ADD_STATS_BH(LINUX_MIB_TIMEWAITED, killed);
+
+	return ret;
+}
+
+static void tcp_twkill(unsigned long dummy)
+{
+	int need_timer, ret;
+
+	spin_lock(&tw_death_lock);
+
+	if (tcp_tw_count == 0)
+		goto out;
+
+	need_timer = 0;
+	ret = tcp_do_twkill_work(tcp_tw_death_row_slot, TCP_TWKILL_QUOTA);
+	if (ret) {
+		twkill_thread_slots |= (1 << tcp_tw_death_row_slot);
+		mb();
+		schedule_work(&tcp_twkill_work);
+		need_timer = 1;
+	} else {
+		/* We purged the entire slot, anything left?  */
+		if (tcp_tw_count)
+			need_timer = 1;
+	}
+	tcp_tw_death_row_slot =
+		((tcp_tw_death_row_slot + 1) & (TCP_TWKILL_SLOTS - 1));
+	if (need_timer)
+		mod_timer(&tcp_tw_timer, jiffies + TCP_TWKILL_PERIOD);
+out:
+	spin_unlock(&tw_death_lock);
+}
+
+extern void twkill_slots_invalid(void);
+
+static void twkill_work(void *dummy)
+{
+	int i;
+
+	if ((TCP_TWKILL_SLOTS - 1) > (sizeof(twkill_thread_slots) * 8))
+		twkill_slots_invalid();
+
+	while (twkill_thread_slots) {
+		spin_lock_bh(&tw_death_lock);
+		for (i = 0; i < TCP_TWKILL_SLOTS; i++) {
+			if (!(twkill_thread_slots & (1 << i)))
+				continue;
+
+			while (tcp_do_twkill_work(i, TCP_TWKILL_QUOTA) != 0) {
+				if (need_resched()) {
+					spin_unlock_bh(&tw_death_lock);
+					schedule();
+					spin_lock_bh(&tw_death_lock);
+				}
+			}
+
+			twkill_thread_slots &= ~(1 << i);
+		}
+		spin_unlock_bh(&tw_death_lock);
+	}
+}
+
+/* These are always called from BH context.  See callers in
+ * tcp_input.c to verify this.
+ */
+
+/* This is for handling early-kills of TIME_WAIT sockets. */
+void tcp_tw_deschedule(struct tcp_tw_bucket *tw)
+{
+	spin_lock(&tw_death_lock);
+	if (tw_del_dead_node(tw)) {
+		tcp_tw_put(tw);
+		if (--tcp_tw_count == 0)
+			del_timer(&tcp_tw_timer);
+	}
+	spin_unlock(&tw_death_lock);
+	tcp_timewait_kill(tw);
+}
+
+/* Short-time timewait calendar */
+
+static int tcp_twcal_hand = -1;
+static int tcp_twcal_jiffie;
+static void tcp_twcal_tick(unsigned long);
+static struct timer_list tcp_twcal_timer =
+		TIMER_INITIALIZER(tcp_twcal_tick, 0, 0);
+static struct hlist_head tcp_twcal_row[TCP_TW_RECYCLE_SLOTS];
+
+static void tcp_tw_schedule(struct tcp_tw_bucket *tw, int timeo)
+{
+	struct hlist_head *list;
+	int slot;
+
+	/* timeout := RTO * 3.5
+	 *
+	 * 3.5 = 1+2+0.5 to wait for two retransmits.
+	 *
+	 * RATIONALE: if FIN arrived and we entered TIME-WAIT state,
+	 * our ACK acking that FIN can be lost. If N subsequent retransmitted
+	 * FINs (or previous seqments) are lost (probability of such event
+	 * is p^(N+1), where p is probability to lose single packet and
+	 * time to detect the loss is about RTO*(2^N - 1) with exponential
+	 * backoff). Normal timewait length is calculated so, that we
+	 * waited at least for one retransmitted FIN (maximal RTO is 120sec).
+	 * [ BTW Linux. following BSD, violates this requirement waiting
+	 *   only for 60sec, we should wait at least for 240 secs.
+	 *   Well, 240 consumes too much of resources 8)
+	 * ]
+	 * This interval is not reduced to catch old duplicate and
+	 * responces to our wandering segments living for two MSLs.
+	 * However, if we use PAWS to detect
+	 * old duplicates, we can reduce the interval to bounds required
+	 * by RTO, rather than MSL. So, if peer understands PAWS, we
+	 * kill tw bucket after 3.5*RTO (it is important that this number
+	 * is greater than TS tick!) and detect old duplicates with help
+	 * of PAWS.
+	 */
+	slot = (timeo + (1<<TCP_TW_RECYCLE_TICK) - 1) >> TCP_TW_RECYCLE_TICK;
+
+	spin_lock(&tw_death_lock);
+
+	/* Unlink it, if it was scheduled */
+	if (tw_del_dead_node(tw))
+		tcp_tw_count--;
+	else
+		atomic_inc(&tw->tw_refcnt);
+
+	if (slot >= TCP_TW_RECYCLE_SLOTS) {
+		/* Schedule to slow timer */
+		if (timeo >= TCP_TIMEWAIT_LEN) {
+			slot = TCP_TWKILL_SLOTS-1;
+		} else {
+			slot = (timeo + TCP_TWKILL_PERIOD-1) / TCP_TWKILL_PERIOD;
+			if (slot >= TCP_TWKILL_SLOTS)
+				slot = TCP_TWKILL_SLOTS-1;
+		}
+		tw->tw_ttd = jiffies + timeo;
+		slot = (tcp_tw_death_row_slot + slot) & (TCP_TWKILL_SLOTS - 1);
+		list = &tcp_tw_death_row[slot];
+	} else {
+		tw->tw_ttd = jiffies + (slot << TCP_TW_RECYCLE_TICK);
+
+		if (tcp_twcal_hand < 0) {
+			tcp_twcal_hand = 0;
+			tcp_twcal_jiffie = jiffies;
+			tcp_twcal_timer.expires = tcp_twcal_jiffie + (slot<<TCP_TW_RECYCLE_TICK);
+			add_timer(&tcp_twcal_timer);
+		} else {
+			if (time_after(tcp_twcal_timer.expires, jiffies + (slot<<TCP_TW_RECYCLE_TICK)))
+				mod_timer(&tcp_twcal_timer, jiffies + (slot<<TCP_TW_RECYCLE_TICK));
+			slot = (tcp_twcal_hand + slot)&(TCP_TW_RECYCLE_SLOTS-1);
+		}
+		list = &tcp_twcal_row[slot];
+	}
+
+	hlist_add_head(&tw->tw_death_node, list);
+
+	if (tcp_tw_count++ == 0)
+		mod_timer(&tcp_tw_timer, jiffies+TCP_TWKILL_PERIOD);
+	spin_unlock(&tw_death_lock);
+}
+
+void tcp_twcal_tick(unsigned long dummy)
+{
+	int n, slot;
+	unsigned long j;
+	unsigned long now = jiffies;
+	int killed = 0;
+	int adv = 0;
+
+	spin_lock(&tw_death_lock);
+	if (tcp_twcal_hand < 0)
+		goto out;
+
+	slot = tcp_twcal_hand;
+	j = tcp_twcal_jiffie;
+
+	for (n=0; n<TCP_TW_RECYCLE_SLOTS; n++) {
+		if (time_before_eq(j, now)) {
+			struct hlist_node *node, *safe;
+			struct tcp_tw_bucket *tw;
+
+			tw_for_each_inmate_safe(tw, node, safe,
+					   &tcp_twcal_row[slot]) {
+				__tw_del_dead_node(tw);
+				tcp_timewait_kill(tw);
+				tcp_tw_put(tw);
+				killed++;
+			}
+		} else {
+			if (!adv) {
+				adv = 1;
+				tcp_twcal_jiffie = j;
+				tcp_twcal_hand = slot;
+			}
+
+			if (!hlist_empty(&tcp_twcal_row[slot])) {
+				mod_timer(&tcp_twcal_timer, j);
+				goto out;
+			}
+		}
+		j += (1<<TCP_TW_RECYCLE_TICK);
+		slot = (slot+1)&(TCP_TW_RECYCLE_SLOTS-1);
+	}
+	tcp_twcal_hand = -1;
+
+out:
+	if ((tcp_tw_count -= killed) == 0)
+		del_timer(&tcp_tw_timer);
+	NET_ADD_STATS_BH(LINUX_MIB_TIMEWAITKILLED, killed);
+	spin_unlock(&tw_death_lock);
+}
+
 /* This is not only more efficient than what we used to do, it eliminates
  * a lot of code duplication between IPv4/IPv6 SYN recv processing. -DaveM
  *
@@ -344,27 +686,75 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
  */
 struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)
 {
-	struct sock *newsk = inet_csk_clone(sk, req, GFP_ATOMIC);
+	/* allocate the newsk from the same slab of the master sock,
+	 * if not, at sk_free time we'll try to free it from the wrong
+	 * slabcache (i.e. is it TCPv4 or v6?), this is handled thru sk->sk_prot -acme */
+	struct sock *newsk = sk_alloc(PF_INET, GFP_ATOMIC, sk->sk_prot, 0);
 
-	if (newsk != NULL) {
-		const struct inet_request_sock *ireq = inet_rsk(req);
+	if(newsk != NULL) {
+		struct inet_request_sock *ireq = inet_rsk(req);
 		struct tcp_request_sock *treq = tcp_rsk(req);
-		struct inet_connection_sock *newicsk = inet_csk(sk);
 		struct tcp_sock *newtp;
+		struct sk_filter *filter;
+
+		memcpy(newsk, sk, sizeof(struct tcp_sock));
+		newsk->sk_state = TCP_SYN_RECV;
+
+		/* SANITY */
+		sk_node_init(&newsk->sk_node);
+		tcp_sk(newsk)->bind_hash = NULL;
+
+		/* Clone the TCP header template */
+		inet_sk(newsk)->dport = ireq->rmt_port;
+
+		sock_lock_init(newsk);
+		bh_lock_sock(newsk);
+
+		rwlock_init(&newsk->sk_dst_lock);
+		atomic_set(&newsk->sk_rmem_alloc, 0);
+		skb_queue_head_init(&newsk->sk_receive_queue);
+		atomic_set(&newsk->sk_wmem_alloc, 0);
+		skb_queue_head_init(&newsk->sk_write_queue);
+		atomic_set(&newsk->sk_omem_alloc, 0);
+		newsk->sk_wmem_queued = 0;
+		newsk->sk_forward_alloc = 0;
+
+		sock_reset_flag(newsk, SOCK_DONE);
+		newsk->sk_userlocks = sk->sk_userlocks & ~SOCK_BINDPORT_LOCK;
+		newsk->sk_backlog.head = newsk->sk_backlog.tail = NULL;
+		newsk->sk_send_head = NULL;
+		rwlock_init(&newsk->sk_callback_lock);
+		skb_queue_head_init(&newsk->sk_error_queue);
+		newsk->sk_write_space = sk_stream_write_space;
+
+		if ((filter = newsk->sk_filter) != NULL)
+			sk_filter_charge(newsk, filter);
+
+		if (unlikely(xfrm_sk_clone_policy(newsk))) {
+			/* It is still raw copy of parent, so invalidate
+			 * destructor and make plain sk_free() */
+			newsk->sk_destruct = NULL;
+			sk_free(newsk);
+			return NULL;
+		}
 
 		/* Now setup tcp_sock */
 		newtp = tcp_sk(newsk);
 		newtp->pred_flags = 0;
 		newtp->rcv_nxt = treq->rcv_isn + 1;
-		newtp->snd_nxt = newtp->snd_una = newtp->snd_sml = treq->snt_isn + 1;
+		newtp->snd_nxt = treq->snt_isn + 1;
+		newtp->snd_una = treq->snt_isn + 1;
+		newtp->snd_sml = treq->snt_isn + 1;
 
 		tcp_prequeue_init(newtp);
 
 		tcp_init_wl(newtp, treq->snt_isn, treq->rcv_isn);
 
+		newtp->retransmits = 0;
+		newtp->backoff = 0;
 		newtp->srtt = 0;
 		newtp->mdev = TCP_TIMEOUT_INIT;
-		newicsk->icsk_rto = TCP_TIMEOUT_INIT;
+		newtp->rto = TCP_TIMEOUT_INIT;
 
 		newtp->packets_out = 0;
 		newtp->left_out = 0;
@@ -384,9 +774,9 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
 		newtp->frto_counter = 0;
 		newtp->frto_highmark = 0;
 
-		newicsk->icsk_ca_ops = &tcp_reno;
+		newtp->ca_ops = &tcp_reno;
 
-		tcp_set_ca_state(newsk, TCP_CA_Open);
+		tcp_set_ca_state(newtp, TCP_CA_Open);
 		tcp_init_xmit_timers(newsk);
 		skb_queue_head_init(&newtp->out_of_order_queue);
 		newtp->rcv_wup = treq->rcv_isn + 1;
@@ -399,12 +789,26 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
 		newtp->rx_opt.dsack = 0;
 		newtp->rx_opt.eff_sacks = 0;
 
+		newtp->probes_out = 0;
 		newtp->rx_opt.num_sacks = 0;
 		newtp->urg_data = 0;
+		/* Deinitialize accept_queue to trap illegal accesses. */
+		memset(&newtp->accept_queue, 0, sizeof(newtp->accept_queue));
+
+		/* Back to base struct sock members. */
+		newsk->sk_err = 0;
+		newsk->sk_priority = 0;
+		atomic_set(&newsk->sk_refcnt, 2);
+#ifdef INET_REFCNT_DEBUG
+		atomic_inc(&inet_sock_nr);
+#endif
+		atomic_inc(&tcp_sockets_allocated);
 
 		if (sock_flag(newsk, SOCK_KEEPOPEN))
-			inet_csk_reset_keepalive_timer(newsk,
-						       keepalive_time_when(newtp));
+			tcp_reset_keepalive_timer(newsk,
+						  keepalive_time_when(newtp));
+		newsk->sk_socket = NULL;
+		newsk->sk_sleep = NULL;
 
 		newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
 		if((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
@@ -434,7 +838,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
 			newtp->tcp_header_len = sizeof(struct tcphdr);
 		}
 		if (skb->len >= TCP_MIN_RCVMSS+newtp->tcp_header_len)
-			newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
+			newtp->ack.last_seg_size = skb->len-newtp->tcp_header_len;
 		newtp->rx_opt.mss_clamp = req->mss;
 		TCP_ECN_openreq_child(newtp, req);
 		if (newtp->ecn_flags&TCP_ECN_OK)
@@ -530,10 +934,9 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 	   does sequence test, SYN is truncated, and thus we consider
 	   it a bare ACK.
 
-	   If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
-	   bare ACK.  Otherwise, we create an established connection.  Both
-	   ends (listening sockets) accept the new incoming connection and try
-	   to talk to each other. 8-)
+	   If tp->defer_accept, we silently drop this bare ACK.  Otherwise,
+	   we create an established connection.  Both ends (listening sockets)
+	   accept the new incoming connection and try to talk to each other. 8-)
 
 	   Note: This case is both harmless, and rare.  Possibility is about the
 	   same as us discovering intelligent life on another plant tomorrow.
@@ -600,8 +1003,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 			return NULL;
 
 		/* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
-		if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
-		    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
+		if (tp->defer_accept && TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
 			inet_rsk(req)->acked = 1;
 			return NULL;
 		}
@@ -616,10 +1018,10 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 		if (child == NULL)
 			goto listen_overflow;
 
-		inet_csk_reqsk_queue_unlink(sk, req, prev);
-		inet_csk_reqsk_queue_removed(sk, req);
+		tcp_synq_unlink(tp, req, prev);
+		tcp_synq_removed(sk, req);
 
-		inet_csk_reqsk_queue_add(sk, req, child);
+		tcp_acceptq_queue(sk, req, child);
 		return child;
 
 	listen_overflow:
@@ -633,7 +1035,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 		if (!(flg & TCP_FLAG_RST))
 			req->rsk_ops->send_reset(skb);
 
-		inet_csk_reqsk_queue_drop(sk, req, prev);
+		tcp_synq_drop(sk, req, prev);
 		return NULL;
 }
 
@@ -672,3 +1074,4 @@ EXPORT_SYMBOL(tcp_check_req);
 EXPORT_SYMBOL(tcp_child_process);
 EXPORT_SYMBOL(tcp_create_openreq_child);
 EXPORT_SYMBOL(tcp_timewait_state_process);
+EXPORT_SYMBOL(tcp_tw_deschedule);
diff --git a/trunk/net/ipv4/tcp_output.c b/trunk/net/ipv4/tcp_output.c
index 75b68116682a..dd30dd137b74 100644
--- a/trunk/net/ipv4/tcp_output.c
+++ b/trunk/net/ipv4/tcp_output.c
@@ -105,19 +105,18 @@ static __u16 tcp_advertise_mss(struct sock *sk)
 
 /* RFC2861. Reset CWND after idle period longer RTO to "restart window".
  * This is the first part of cwnd validation mechanism. */
-static void tcp_cwnd_restart(struct sock *sk, struct dst_entry *dst)
+static void tcp_cwnd_restart(struct tcp_sock *tp, struct dst_entry *dst)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
 	s32 delta = tcp_time_stamp - tp->lsndtime;
 	u32 restart_cwnd = tcp_init_cwnd(tp, dst);
 	u32 cwnd = tp->snd_cwnd;
 
-	tcp_ca_event(sk, CA_EVENT_CWND_RESTART);
+	tcp_ca_event(tp, CA_EVENT_CWND_RESTART);
 
-	tp->snd_ssthresh = tcp_current_ssthresh(sk);
+	tp->snd_ssthresh = tcp_current_ssthresh(tp);
 	restart_cwnd = min(restart_cwnd, cwnd);
 
-	while ((delta -= inet_csk(sk)->icsk_rto) > 0 && cwnd > restart_cwnd)
+	while ((delta -= tp->rto) > 0 && cwnd > restart_cwnd)
 		cwnd >>= 1;
 	tp->snd_cwnd = max(cwnd, restart_cwnd);
 	tp->snd_cwnd_stamp = tcp_time_stamp;
@@ -127,25 +126,26 @@ static void tcp_cwnd_restart(struct sock *sk, struct dst_entry *dst)
 static inline void tcp_event_data_sent(struct tcp_sock *tp,
 				       struct sk_buff *skb, struct sock *sk)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	const u32 now = tcp_time_stamp;
+	u32 now = tcp_time_stamp;
 
-	if (!tp->packets_out && (s32)(now - tp->lsndtime) > icsk->icsk_rto)
-		tcp_cwnd_restart(sk, __sk_dst_get(sk));
+	if (!tp->packets_out && (s32)(now - tp->lsndtime) > tp->rto)
+		tcp_cwnd_restart(tp, __sk_dst_get(sk));
 
 	tp->lsndtime = now;
 
 	/* If it is a reply for ato after last received
 	 * packet, enter pingpong mode.
 	 */
-	if ((u32)(now - icsk->icsk_ack.lrcvtime) < icsk->icsk_ack.ato)
-		icsk->icsk_ack.pingpong = 1;
+	if ((u32)(now - tp->ack.lrcvtime) < tp->ack.ato)
+		tp->ack.pingpong = 1;
 }
 
 static __inline__ void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
 {
-	tcp_dec_quickack_mode(sk, pkts);
-	inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
+	struct tcp_sock *tp = tcp_sk(sk);
+
+	tcp_dec_quickack_mode(tp, pkts);
+	tcp_clear_xmit_timer(sk, TCP_TIME_DACK);
 }
 
 /* Determine a window scaling and initial window to offer.
@@ -265,7 +265,6 @@ static __inline__ u16 tcp_select_window(struct sock *sk)
 static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 {
 	if (skb != NULL) {
-		const struct inet_connection_sock *icsk = inet_csk(sk);
 		struct inet_sock *inet = inet_sk(sk);
 		struct tcp_sock *tp = tcp_sk(sk);
 		struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
@@ -281,8 +280,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 #define SYSCTL_FLAG_SACK	0x4
 
 		/* If congestion control is doing timestamping */
-		if (icsk->icsk_ca_ops->rtt_sample)
-			__net_timestamp(skb);
+		if (tp->ca_ops->rtt_sample)
+			do_gettimeofday(&skb->stamp);
 
 		sysctl_flags = 0;
 		if (tcb->flags & TCPCB_FLAG_SYN) {
@@ -309,7 +308,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 		}
 		
 		if (tcp_packets_in_flight(tp) == 0)
-			tcp_ca_event(sk, CA_EVENT_TX_START);
+			tcp_ca_event(tp, CA_EVENT_TX_START);
 
 		th = (struct tcphdr *) skb_push(skb, tcp_header_size);
 		skb->h.th = th;
@@ -367,7 +366,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 		if (err <= 0)
 			return err;
 
-		tcp_enter_cwr(sk);
+		tcp_enter_cwr(tp);
 
 		/* NET_XMIT_CN is special. It does not guarantee,
 		 * that this packet is lost. It tells that device
@@ -483,7 +482,7 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned
 	 * skbs, which it never sent before. --ANK
 	 */
 	TCP_SKB_CB(buff)->when = TCP_SKB_CB(skb)->when;
-	buff->tstamp = skb->tstamp;
+	buff->stamp = skb->stamp;
 
 	if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST) {
 		tp->lost_out -= tcp_skb_pcount(skb);
@@ -506,7 +505,7 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned
 
 	/* Link BUFF into the send queue. */
 	skb_header_release(buff);
-	__skb_append(skb, buff, &sk->sk_write_queue);
+	__skb_append(skb, buff);
 
 	return 0;
 }
@@ -697,7 +696,7 @@ static inline void tcp_cwnd_validate(struct sock *sk, struct tcp_sock *tp)
 		if (tp->packets_out > tp->snd_cwnd_used)
 			tp->snd_cwnd_used = tp->packets_out;
 
-		if ((s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
+		if ((s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= tp->rto)
 			tcp_cwnd_application_limited(sk);
 	}
 }
@@ -894,7 +893,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
 
 	/* Link BUFF into the send queue. */
 	skb_header_release(buff);
-	__skb_append(skb, buff, &sk->sk_write_queue);
+	__skb_append(skb, buff);
 
 	return 0;
 }
@@ -906,13 +905,12 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
  */
 static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_buff *skb)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
 	u32 send_win, cong_win, limit, in_flight;
 
 	if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
 		return 0;
 
-	if (icsk->icsk_ca_state != TCP_CA_Open)
+	if (tp->ca_state != TCP_CA_Open)
 		return 0;
 
 	in_flight = tcp_packets_in_flight(tp);
@@ -1149,7 +1147,6 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
  */
 u32 __tcp_select_window(struct sock *sk)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	/* MSS for the peer's data.  Previous verions used mss_clamp
 	 * here.  I don't know if the value based on our guesses
@@ -1157,7 +1154,7 @@ u32 __tcp_select_window(struct sock *sk)
 	 * but may be worse for the performance because of rcv_mss
 	 * fluctuations.  --SAW  1998/11/1
 	 */
-	int mss = icsk->icsk_ack.rcv_mss;
+	int mss = tp->ack.rcv_mss;
 	int free_space = tcp_space(sk);
 	int full_space = min_t(int, tp->window_clamp, tcp_full_space(sk));
 	int window;
@@ -1166,7 +1163,7 @@ u32 __tcp_select_window(struct sock *sk)
 		mss = full_space; 
 
 	if (free_space < full_space/2) {
-		icsk->icsk_ack.quick = 0;
+		tp->ack.quick = 0;
 
 		if (tcp_memory_pressure)
 			tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U*tp->advmss);
@@ -1241,7 +1238,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *skb, int m
 		       tcp_skb_pcount(next_skb) != 1);
 
 		/* Ok.  We will be able to collapse the packet. */
-		__skb_unlink(next_skb, &sk->sk_write_queue);
+		__skb_unlink(next_skb, next_skb->list);
 
 		memcpy(skb_put(skb, next_skb_size), next_skb->data, next_skb_size);
 
@@ -1289,7 +1286,6 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *skb, int m
  */ 
 void tcp_simple_retransmit(struct sock *sk)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	struct sk_buff *skb;
 	unsigned int mss = tcp_current_mss(sk, 0);
@@ -1320,12 +1316,12 @@ void tcp_simple_retransmit(struct sock *sk)
 	 * in network, but units changed and effective
 	 * cwnd/ssthresh really reduced now.
 	 */
-	if (icsk->icsk_ca_state != TCP_CA_Loss) {
+	if (tp->ca_state != TCP_CA_Loss) {
 		tp->high_seq = tp->snd_nxt;
-		tp->snd_ssthresh = tcp_current_ssthresh(sk);
+		tp->snd_ssthresh = tcp_current_ssthresh(tp);
 		tp->prior_ssthresh = 0;
 		tp->undo_marker = 0;
-		tcp_set_ca_state(sk, TCP_CA_Loss);
+		tcp_set_ca_state(tp, TCP_CA_Loss);
 	}
 	tcp_xmit_retransmit_queue(sk);
 }
@@ -1465,7 +1461,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
  */
 void tcp_xmit_retransmit_queue(struct sock *sk)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	struct sk_buff *skb;
 	int packet_cnt = tp->lost_out;
@@ -1489,16 +1484,14 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
 				if (!(sacked&(TCPCB_SACKED_ACKED|TCPCB_SACKED_RETRANS))) {
 					if (tcp_retransmit_skb(sk, skb))
 						return;
-					if (icsk->icsk_ca_state != TCP_CA_Loss)
+					if (tp->ca_state != TCP_CA_Loss)
 						NET_INC_STATS_BH(LINUX_MIB_TCPFASTRETRANS);
 					else
 						NET_INC_STATS_BH(LINUX_MIB_TCPSLOWSTARTRETRANS);
 
 					if (skb ==
 					    skb_peek(&sk->sk_write_queue))
-						inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-									  inet_csk(sk)->icsk_rto,
-									  TCP_RTO_MAX);
+						tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS, tp->rto);
 				}
 
 				packet_cnt -= tcp_skb_pcount(skb);
@@ -1511,7 +1504,7 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
 	/* OK, demanded retransmission is finished. */
 
 	/* Forward retransmissions are possible only during Recovery. */
-	if (icsk->icsk_ca_state != TCP_CA_Recovery)
+	if (tp->ca_state != TCP_CA_Recovery)
 		return;
 
 	/* No forward retransmissions in Reno are possible. */
@@ -1551,9 +1544,7 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
 			break;
 
 		if (skb == skb_peek(&sk->sk_write_queue))
-			inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-						  inet_csk(sk)->icsk_rto,
-						  TCP_RTO_MAX);
+			tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS, tp->rto);
 
 		NET_INC_STATS_BH(LINUX_MIB_TCPFORWARDRETRANS);
 	}
@@ -1582,7 +1573,7 @@ void tcp_send_fin(struct sock *sk)
 	} else {
 		/* Socket is locked, keep trying until memory is available. */
 		for (;;) {
-			skb = alloc_skb_fclone(MAX_TCP_HEADER, GFP_KERNEL);
+			skb = alloc_skb(MAX_TCP_HEADER, GFP_KERNEL);
 			if (skb)
 				break;
 			yield();
@@ -1789,8 +1780,8 @@ static inline void tcp_connect_init(struct sock *sk)
 	tp->rcv_wup = 0;
 	tp->copied_seq = 0;
 
-	inet_csk(sk)->icsk_rto = TCP_TIMEOUT_INIT;
-	inet_csk(sk)->icsk_retransmits = 0;
+	tp->rto = TCP_TIMEOUT_INIT;
+	tp->retransmits = 0;
 	tcp_clear_retrans(tp);
 }
 
@@ -1804,7 +1795,7 @@ int tcp_connect(struct sock *sk)
 
 	tcp_connect_init(sk);
 
-	buff = alloc_skb_fclone(MAX_TCP_HEADER + 15, sk->sk_allocation);
+	buff = alloc_skb(MAX_TCP_HEADER + 15, sk->sk_allocation);
 	if (unlikely(buff == NULL))
 		return -ENOBUFS;
 
@@ -1833,8 +1824,7 @@ int tcp_connect(struct sock *sk)
 	TCP_INC_STATS(TCP_MIB_ACTIVEOPENS);
 
 	/* Timer for repeating the SYN until an answer. */
-	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-				  inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
+	tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS, tp->rto);
 	return 0;
 }
 
@@ -1844,21 +1834,20 @@ int tcp_connect(struct sock *sk)
  */
 void tcp_send_delayed_ack(struct sock *sk)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	int ato = icsk->icsk_ack.ato;
+	struct tcp_sock *tp = tcp_sk(sk);
+	int ato = tp->ack.ato;
 	unsigned long timeout;
 
 	if (ato > TCP_DELACK_MIN) {
-		const struct tcp_sock *tp = tcp_sk(sk);
 		int max_ato = HZ/2;
 
-		if (icsk->icsk_ack.pingpong || (icsk->icsk_ack.pending & ICSK_ACK_PUSHED))
+		if (tp->ack.pingpong || (tp->ack.pending&TCP_ACK_PUSHED))
 			max_ato = TCP_DELACK_MAX;
 
 		/* Slow path, intersegment interval is "high". */
 
 		/* If some rtt estimate is known, use it to bound delayed ack.
-		 * Do not use inet_csk(sk)->icsk_rto here, use results of rtt measurements
+		 * Do not use tp->rto here, use results of rtt measurements
 		 * directly.
 		 */
 		if (tp->srtt) {
@@ -1875,22 +1864,21 @@ void tcp_send_delayed_ack(struct sock *sk)
 	timeout = jiffies + ato;
 
 	/* Use new timeout only if there wasn't a older one earlier. */
-	if (icsk->icsk_ack.pending & ICSK_ACK_TIMER) {
+	if (tp->ack.pending&TCP_ACK_TIMER) {
 		/* If delack timer was blocked or is about to expire,
 		 * send ACK now.
 		 */
-		if (icsk->icsk_ack.blocked ||
-		    time_before_eq(icsk->icsk_ack.timeout, jiffies + (ato >> 2))) {
+		if (tp->ack.blocked || time_before_eq(tp->ack.timeout, jiffies+(ato>>2))) {
 			tcp_send_ack(sk);
 			return;
 		}
 
-		if (!time_before(timeout, icsk->icsk_ack.timeout))
-			timeout = icsk->icsk_ack.timeout;
+		if (!time_before(timeout, tp->ack.timeout))
+			timeout = tp->ack.timeout;
 	}
-	icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER;
-	icsk->icsk_ack.timeout = timeout;
-	sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
+	tp->ack.pending |= TCP_ACK_SCHED|TCP_ACK_TIMER;
+	tp->ack.timeout = timeout;
+	sk_reset_timer(sk, &tp->delack_timer, timeout);
 }
 
 /* This routine sends an ack and also updates the window. */
@@ -1907,10 +1895,9 @@ void tcp_send_ack(struct sock *sk)
 		 */
 		buff = alloc_skb(MAX_TCP_HEADER, GFP_ATOMIC);
 		if (buff == NULL) {
-			inet_csk_schedule_ack(sk);
-			inet_csk(sk)->icsk_ack.ato = TCP_ATO_MIN;
-			inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-						  TCP_DELACK_MAX, TCP_RTO_MAX);
+			tcp_schedule_ack(tp);
+			tp->ack.ato = TCP_ATO_MIN;
+			tcp_reset_xmit_timer(sk, TCP_TIME_DACK, TCP_DELACK_MAX);
 			return;
 		}
 
@@ -2024,7 +2011,6 @@ int tcp_write_wakeup(struct sock *sk)
  */
 void tcp_send_probe0(struct sock *sk)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	int err;
 
@@ -2032,31 +2018,28 @@ void tcp_send_probe0(struct sock *sk)
 
 	if (tp->packets_out || !sk->sk_send_head) {
 		/* Cancel probe timer, if it is not required. */
-		icsk->icsk_probes_out = 0;
-		icsk->icsk_backoff = 0;
+		tp->probes_out = 0;
+		tp->backoff = 0;
 		return;
 	}
 
 	if (err <= 0) {
-		if (icsk->icsk_backoff < sysctl_tcp_retries2)
-			icsk->icsk_backoff++;
-		icsk->icsk_probes_out++;
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0, 
-					  min(icsk->icsk_rto << icsk->icsk_backoff, TCP_RTO_MAX),
-					  TCP_RTO_MAX);
+		if (tp->backoff < sysctl_tcp_retries2)
+			tp->backoff++;
+		tp->probes_out++;
+		tcp_reset_xmit_timer (sk, TCP_TIME_PROBE0, 
+				      min(tp->rto << tp->backoff, TCP_RTO_MAX));
 	} else {
 		/* If packet was not sent due to local congestion,
-		 * do not backoff and do not remember icsk_probes_out.
+		 * do not backoff and do not remember probes_out.
 		 * Let local senders to fight for local resources.
 		 *
 		 * Use accumulated backoff yet.
 		 */
-		if (!icsk->icsk_probes_out)
-			icsk->icsk_probes_out = 1;
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0, 
-					  min(icsk->icsk_rto << icsk->icsk_backoff,
-					      TCP_RESOURCE_PROBE_INTERVAL),
-					  TCP_RTO_MAX);
+		if (!tp->probes_out)
+			tp->probes_out=1;
+		tcp_reset_xmit_timer (sk, TCP_TIME_PROBE0, 
+				      min(tp->rto << tp->backoff, TCP_RESOURCE_PROBE_INTERVAL));
 	}
 }
 
diff --git a/trunk/net/ipv4/tcp_scalable.c b/trunk/net/ipv4/tcp_scalable.c
index 327770bf5522..70e108e15c71 100644
--- a/trunk/net/ipv4/tcp_scalable.c
+++ b/trunk/net/ipv4/tcp_scalable.c
@@ -16,10 +16,9 @@
 #define TCP_SCALABLE_AI_CNT	50U
 #define TCP_SCALABLE_MD_SCALE	3
 
-static void tcp_scalable_cong_avoid(struct sock *sk, u32 ack, u32 rtt,
+static void tcp_scalable_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
 				    u32 in_flight, int flag)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
 	if (in_flight < tp->snd_cwnd)
 		return;
 
@@ -36,9 +35,8 @@ static void tcp_scalable_cong_avoid(struct sock *sk, u32 ack, u32 rtt,
 	tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
-static u32 tcp_scalable_ssthresh(struct sock *sk)
+static u32 tcp_scalable_ssthresh(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
 	return max(tp->snd_cwnd - (tp->snd_cwnd>>TCP_SCALABLE_MD_SCALE), 2U);
 }
 
diff --git a/trunk/net/ipv4/tcp_timer.c b/trunk/net/ipv4/tcp_timer.c
index 415ee47ac1c5..0084227438c2 100644
--- a/trunk/net/ipv4/tcp_timer.c
+++ b/trunk/net/ipv4/tcp_timer.c
@@ -36,13 +36,49 @@ static void tcp_write_timer(unsigned long);
 static void tcp_delack_timer(unsigned long);
 static void tcp_keepalive_timer (unsigned long data);
 
+#ifdef TCP_DEBUG
+const char tcp_timer_bug_msg[] = KERN_DEBUG "tcpbug: unknown timer value\n";
+EXPORT_SYMBOL(tcp_timer_bug_msg);
+#endif
+
+/*
+ * Using different timers for retransmit, delayed acks and probes
+ * We may wish use just one timer maintaining a list of expire jiffies 
+ * to optimize.
+ */
+
 void tcp_init_xmit_timers(struct sock *sk)
 {
-	inet_csk_init_xmit_timers(sk, &tcp_write_timer, &tcp_delack_timer,
-				  &tcp_keepalive_timer);
+	struct tcp_sock *tp = tcp_sk(sk);
+
+	init_timer(&tp->retransmit_timer);
+	tp->retransmit_timer.function=&tcp_write_timer;
+	tp->retransmit_timer.data = (unsigned long) sk;
+	tp->pending = 0;
+
+	init_timer(&tp->delack_timer);
+	tp->delack_timer.function=&tcp_delack_timer;
+	tp->delack_timer.data = (unsigned long) sk;
+	tp->ack.pending = 0;
+
+	init_timer(&sk->sk_timer);
+	sk->sk_timer.function	= &tcp_keepalive_timer;
+	sk->sk_timer.data	= (unsigned long)sk;
 }
 
-EXPORT_SYMBOL(tcp_init_xmit_timers);
+void tcp_clear_xmit_timers(struct sock *sk)
+{
+	struct tcp_sock *tp = tcp_sk(sk);
+
+	tp->pending = 0;
+	sk_stop_timer(sk, &tp->retransmit_timer);
+
+	tp->ack.pending = 0;
+	tp->ack.blocked = 0;
+	sk_stop_timer(sk, &tp->delack_timer);
+
+	sk_stop_timer(sk, &sk->sk_timer);
+}
 
 static void tcp_write_err(struct sock *sk)
 {
@@ -119,15 +155,15 @@ static int tcp_orphan_retries(struct sock *sk, int alive)
 /* A write timeout has occurred. Process the after effects. */
 static int tcp_write_timeout(struct sock *sk)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
+	struct tcp_sock *tp = tcp_sk(sk);
 	int retry_until;
 
 	if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
-		if (icsk->icsk_retransmits)
+		if (tp->retransmits)
 			dst_negative_advice(&sk->sk_dst_cache);
-		retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
+		retry_until = tp->syn_retries ? : sysctl_tcp_syn_retries;
 	} else {
-		if (icsk->icsk_retransmits >= sysctl_tcp_retries1) {
+		if (tp->retransmits >= sysctl_tcp_retries1) {
 			/* NOTE. draft-ietf-tcpimpl-pmtud-01.txt requires pmtu black
 			   hole detection. :-(
 
@@ -153,16 +189,16 @@ static int tcp_write_timeout(struct sock *sk)
 
 		retry_until = sysctl_tcp_retries2;
 		if (sock_flag(sk, SOCK_DEAD)) {
-			const int alive = (icsk->icsk_rto < TCP_RTO_MAX);
+			int alive = (tp->rto < TCP_RTO_MAX);
  
 			retry_until = tcp_orphan_retries(sk, alive);
 
-			if (tcp_out_of_resources(sk, alive || icsk->icsk_retransmits < retry_until))
+			if (tcp_out_of_resources(sk, alive || tp->retransmits < retry_until))
 				return 1;
 		}
 	}
 
-	if (icsk->icsk_retransmits >= retry_until) {
+	if (tp->retransmits >= retry_until) {
 		/* Has it gone just too far? */
 		tcp_write_err(sk);
 		return 1;
@@ -174,27 +210,26 @@ static void tcp_delack_timer(unsigned long data)
 {
 	struct sock *sk = (struct sock*)data;
 	struct tcp_sock *tp = tcp_sk(sk);
-	struct inet_connection_sock *icsk = inet_csk(sk);
 
 	bh_lock_sock(sk);
 	if (sock_owned_by_user(sk)) {
 		/* Try again later. */
-		icsk->icsk_ack.blocked = 1;
+		tp->ack.blocked = 1;
 		NET_INC_STATS_BH(LINUX_MIB_DELAYEDACKLOCKED);
-		sk_reset_timer(sk, &icsk->icsk_delack_timer, jiffies + TCP_DELACK_MIN);
+		sk_reset_timer(sk, &tp->delack_timer, jiffies + TCP_DELACK_MIN);
 		goto out_unlock;
 	}
 
 	sk_stream_mem_reclaim(sk);
 
-	if (sk->sk_state == TCP_CLOSE || !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
+	if (sk->sk_state == TCP_CLOSE || !(tp->ack.pending & TCP_ACK_TIMER))
 		goto out;
 
-	if (time_after(icsk->icsk_ack.timeout, jiffies)) {
-		sk_reset_timer(sk, &icsk->icsk_delack_timer, icsk->icsk_ack.timeout);
+	if (time_after(tp->ack.timeout, jiffies)) {
+		sk_reset_timer(sk, &tp->delack_timer, tp->ack.timeout);
 		goto out;
 	}
-	icsk->icsk_ack.pending &= ~ICSK_ACK_TIMER;
+	tp->ack.pending &= ~TCP_ACK_TIMER;
 
 	if (!skb_queue_empty(&tp->ucopy.prequeue)) {
 		struct sk_buff *skb;
@@ -207,16 +242,16 @@ static void tcp_delack_timer(unsigned long data)
 		tp->ucopy.memory = 0;
 	}
 
-	if (inet_csk_ack_scheduled(sk)) {
-		if (!icsk->icsk_ack.pingpong) {
+	if (tcp_ack_scheduled(tp)) {
+		if (!tp->ack.pingpong) {
 			/* Delayed ACK missed: inflate ATO. */
-			icsk->icsk_ack.ato = min(icsk->icsk_ack.ato << 1, icsk->icsk_rto);
+			tp->ack.ato = min(tp->ack.ato << 1, tp->rto);
 		} else {
 			/* Delayed ACK missed: leave pingpong mode and
 			 * deflate ATO.
 			 */
-			icsk->icsk_ack.pingpong = 0;
-			icsk->icsk_ack.ato      = TCP_ATO_MIN;
+			tp->ack.pingpong = 0;
+			tp->ack.ato = TCP_ATO_MIN;
 		}
 		tcp_send_ack(sk);
 		NET_INC_STATS_BH(LINUX_MIB_DELAYEDACKS);
@@ -233,12 +268,11 @@ static void tcp_delack_timer(unsigned long data)
 
 static void tcp_probe_timer(struct sock *sk)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	int max_probes;
 
 	if (tp->packets_out || !sk->sk_send_head) {
-		icsk->icsk_probes_out = 0;
+		tp->probes_out = 0;
 		return;
 	}
 
@@ -249,7 +283,7 @@ static void tcp_probe_timer(struct sock *sk)
 	 * FIXME: We ought not to do it, Solaris 2.5 actually has fixing
 	 * this behaviour in Solaris down as a bug fix. [AC]
 	 *
-	 * Let me to explain. icsk_probes_out is zeroed by incoming ACKs
+	 * Let me to explain. probes_out is zeroed by incoming ACKs
 	 * even if they advertise zero window. Hence, connection is killed only
 	 * if we received no ACKs for normal connection timeout. It is not killed
 	 * only because window stays zero for some time, window may be zero
@@ -260,15 +294,15 @@ static void tcp_probe_timer(struct sock *sk)
 	max_probes = sysctl_tcp_retries2;
 
 	if (sock_flag(sk, SOCK_DEAD)) {
-		const int alive = ((icsk->icsk_rto << icsk->icsk_backoff) < TCP_RTO_MAX);
+		int alive = ((tp->rto<<tp->backoff) < TCP_RTO_MAX);
  
 		max_probes = tcp_orphan_retries(sk, alive);
 
-		if (tcp_out_of_resources(sk, alive || icsk->icsk_probes_out <= max_probes))
+		if (tcp_out_of_resources(sk, alive || tp->probes_out <= max_probes))
 			return;
 	}
 
-	if (icsk->icsk_probes_out > max_probes) {
+	if (tp->probes_out > max_probes) {
 		tcp_write_err(sk);
 	} else {
 		/* Only send another probe if we didn't close things up. */
@@ -283,7 +317,6 @@ static void tcp_probe_timer(struct sock *sk)
 static void tcp_retransmit_timer(struct sock *sk)
 {
 	struct tcp_sock *tp = tcp_sk(sk);
-	struct inet_connection_sock *icsk = inet_csk(sk);
 
 	if (!tp->packets_out)
 		goto out;
@@ -318,21 +351,20 @@ static void tcp_retransmit_timer(struct sock *sk)
 	if (tcp_write_timeout(sk))
 		goto out;
 
-	if (icsk->icsk_retransmits == 0) {
-		if (icsk->icsk_ca_state == TCP_CA_Disorder ||
-		    icsk->icsk_ca_state == TCP_CA_Recovery) {
+	if (tp->retransmits == 0) {
+		if (tp->ca_state == TCP_CA_Disorder || tp->ca_state == TCP_CA_Recovery) {
 			if (tp->rx_opt.sack_ok) {
-				if (icsk->icsk_ca_state == TCP_CA_Recovery)
+				if (tp->ca_state == TCP_CA_Recovery)
 					NET_INC_STATS_BH(LINUX_MIB_TCPSACKRECOVERYFAIL);
 				else
 					NET_INC_STATS_BH(LINUX_MIB_TCPSACKFAILURES);
 			} else {
-				if (icsk->icsk_ca_state == TCP_CA_Recovery)
+				if (tp->ca_state == TCP_CA_Recovery)
 					NET_INC_STATS_BH(LINUX_MIB_TCPRENORECOVERYFAIL);
 				else
 					NET_INC_STATS_BH(LINUX_MIB_TCPRENOFAILURES);
 			}
-		} else if (icsk->icsk_ca_state == TCP_CA_Loss) {
+		} else if (tp->ca_state == TCP_CA_Loss) {
 			NET_INC_STATS_BH(LINUX_MIB_TCPLOSSFAILURES);
 		} else {
 			NET_INC_STATS_BH(LINUX_MIB_TCPTIMEOUTS);
@@ -349,11 +381,10 @@ static void tcp_retransmit_timer(struct sock *sk)
 		/* Retransmission failed because of local congestion,
 		 * do not backoff.
 		 */
-		if (!icsk->icsk_retransmits)
-			icsk->icsk_retransmits = 1;
-		inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
-					  min(icsk->icsk_rto, TCP_RESOURCE_PROBE_INTERVAL),
-					  TCP_RTO_MAX);
+		if (!tp->retransmits)
+			tp->retransmits=1;
+		tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS,
+				     min(tp->rto, TCP_RESOURCE_PROBE_INTERVAL));
 		goto out;
 	}
 
@@ -372,13 +403,13 @@ static void tcp_retransmit_timer(struct sock *sk)
 	 * implemented ftp to mars will work nicely. We will have to fix
 	 * the 120 second clamps though!
 	 */
-	icsk->icsk_backoff++;
-	icsk->icsk_retransmits++;
+	tp->backoff++;
+	tp->retransmits++;
 
 out_reset_timer:
-	icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
-	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-	if (icsk->icsk_retransmits > sysctl_tcp_retries1)
+	tp->rto = min(tp->rto << 1, TCP_RTO_MAX);
+	tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS, tp->rto);
+	if (tp->retransmits > sysctl_tcp_retries1)
 		__sk_dst_reset(sk);
 
 out:;
@@ -387,32 +418,32 @@ out:;
 static void tcp_write_timer(unsigned long data)
 {
 	struct sock *sk = (struct sock*)data;
-	struct inet_connection_sock *icsk = inet_csk(sk);
+	struct tcp_sock *tp = tcp_sk(sk);
 	int event;
 
 	bh_lock_sock(sk);
 	if (sock_owned_by_user(sk)) {
 		/* Try again later */
-		sk_reset_timer(sk, &icsk->icsk_retransmit_timer, jiffies + (HZ / 20));
+		sk_reset_timer(sk, &tp->retransmit_timer, jiffies + (HZ / 20));
 		goto out_unlock;
 	}
 
-	if (sk->sk_state == TCP_CLOSE || !icsk->icsk_pending)
+	if (sk->sk_state == TCP_CLOSE || !tp->pending)
 		goto out;
 
-	if (time_after(icsk->icsk_timeout, jiffies)) {
-		sk_reset_timer(sk, &icsk->icsk_retransmit_timer, icsk->icsk_timeout);
+	if (time_after(tp->timeout, jiffies)) {
+		sk_reset_timer(sk, &tp->retransmit_timer, tp->timeout);
 		goto out;
 	}
 
-	event = icsk->icsk_pending;
-	icsk->icsk_pending = 0;
+	event = tp->pending;
+	tp->pending = 0;
 
 	switch (event) {
-	case ICSK_TIME_RETRANS:
+	case TCP_TIME_RETRANS:
 		tcp_retransmit_timer(sk);
 		break;
-	case ICSK_TIME_PROBE0:
+	case TCP_TIME_PROBE0:
 		tcp_probe_timer(sk);
 		break;
 	}
@@ -431,8 +462,96 @@ static void tcp_write_timer(unsigned long data)
 
 static void tcp_synack_timer(struct sock *sk)
 {
-	inet_csk_reqsk_queue_prune(sk, TCP_SYNQ_INTERVAL,
-				   TCP_TIMEOUT_INIT, TCP_RTO_MAX);
+	struct tcp_sock *tp = tcp_sk(sk);
+	struct listen_sock *lopt = tp->accept_queue.listen_opt;
+	int max_retries = tp->syn_retries ? : sysctl_tcp_synack_retries;
+	int thresh = max_retries;
+	unsigned long now = jiffies;
+	struct request_sock **reqp, *req;
+	int i, budget;
+
+	if (lopt == NULL || lopt->qlen == 0)
+		return;
+
+	/* Normally all the openreqs are young and become mature
+	 * (i.e. converted to established socket) for first timeout.
+	 * If synack was not acknowledged for 3 seconds, it means
+	 * one of the following things: synack was lost, ack was lost,
+	 * rtt is high or nobody planned to ack (i.e. synflood).
+	 * When server is a bit loaded, queue is populated with old
+	 * open requests, reducing effective size of queue.
+	 * When server is well loaded, queue size reduces to zero
+	 * after several minutes of work. It is not synflood,
+	 * it is normal operation. The solution is pruning
+	 * too old entries overriding normal timeout, when
+	 * situation becomes dangerous.
+	 *
+	 * Essentially, we reserve half of room for young
+	 * embrions; and abort old ones without pity, if old
+	 * ones are about to clog our table.
+	 */
+	if (lopt->qlen>>(lopt->max_qlen_log-1)) {
+		int young = (lopt->qlen_young<<1);
+
+		while (thresh > 2) {
+			if (lopt->qlen < young)
+				break;
+			thresh--;
+			young <<= 1;
+		}
+	}
+
+	if (tp->defer_accept)
+		max_retries = tp->defer_accept;
+
+	budget = 2*(TCP_SYNQ_HSIZE/(TCP_TIMEOUT_INIT/TCP_SYNQ_INTERVAL));
+	i = lopt->clock_hand;
+
+	do {
+		reqp=&lopt->syn_table[i];
+		while ((req = *reqp) != NULL) {
+			if (time_after_eq(now, req->expires)) {
+				if ((req->retrans < thresh ||
+				     (inet_rsk(req)->acked && req->retrans < max_retries))
+				    && !req->rsk_ops->rtx_syn_ack(sk, req, NULL)) {
+					unsigned long timeo;
+
+					if (req->retrans++ == 0)
+						lopt->qlen_young--;
+					timeo = min((TCP_TIMEOUT_INIT << req->retrans),
+						    TCP_RTO_MAX);
+					req->expires = now + timeo;
+					reqp = &req->dl_next;
+					continue;
+				}
+
+				/* Drop this request */
+				tcp_synq_unlink(tp, req, reqp);
+				reqsk_queue_removed(&tp->accept_queue, req);
+				reqsk_free(req);
+				continue;
+			}
+			reqp = &req->dl_next;
+		}
+
+		i = (i+1)&(TCP_SYNQ_HSIZE-1);
+
+	} while (--budget > 0);
+
+	lopt->clock_hand = i;
+
+	if (lopt->qlen)
+		tcp_reset_keepalive_timer(sk, TCP_SYNQ_INTERVAL);
+}
+
+void tcp_delete_keepalive_timer (struct sock *sk)
+{
+	sk_stop_timer(sk, &sk->sk_timer);
+}
+
+void tcp_reset_keepalive_timer (struct sock *sk, unsigned long len)
+{
+	sk_reset_timer(sk, &sk->sk_timer, jiffies + len);
 }
 
 void tcp_set_keepalive(struct sock *sk, int val)
@@ -441,16 +560,15 @@ void tcp_set_keepalive(struct sock *sk, int val)
 		return;
 
 	if (val && !sock_flag(sk, SOCK_KEEPOPEN))
-		inet_csk_reset_keepalive_timer(sk, keepalive_time_when(tcp_sk(sk)));
+		tcp_reset_keepalive_timer(sk, keepalive_time_when(tcp_sk(sk)));
 	else if (!val)
-		inet_csk_delete_keepalive_timer(sk);
+		tcp_delete_keepalive_timer(sk);
 }
 
 
 static void tcp_keepalive_timer (unsigned long data)
 {
 	struct sock *sk = (struct sock *) data;
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	__u32 elapsed;
 
@@ -458,7 +576,7 @@ static void tcp_keepalive_timer (unsigned long data)
 	bh_lock_sock(sk);
 	if (sock_owned_by_user(sk)) {
 		/* Try again later. */ 
-		inet_csk_reset_keepalive_timer (sk, HZ/20);
+		tcp_reset_keepalive_timer (sk, HZ/20);
 		goto out;
 	}
 
@@ -469,7 +587,7 @@ static void tcp_keepalive_timer (unsigned long data)
 
 	if (sk->sk_state == TCP_FIN_WAIT2 && sock_flag(sk, SOCK_DEAD)) {
 		if (tp->linger2 >= 0) {
-			const int tmo = tcp_fin_time(sk) - TCP_TIMEWAIT_LEN;
+			int tmo = tcp_fin_time(tp) - TCP_TIMEWAIT_LEN;
 
 			if (tmo > 0) {
 				tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
@@ -492,14 +610,14 @@ static void tcp_keepalive_timer (unsigned long data)
 	elapsed = tcp_time_stamp - tp->rcv_tstamp;
 
 	if (elapsed >= keepalive_time_when(tp)) {
-		if ((!tp->keepalive_probes && icsk->icsk_probes_out >= sysctl_tcp_keepalive_probes) ||
-		     (tp->keepalive_probes && icsk->icsk_probes_out >= tp->keepalive_probes)) {
+		if ((!tp->keepalive_probes && tp->probes_out >= sysctl_tcp_keepalive_probes) ||
+		     (tp->keepalive_probes && tp->probes_out >= tp->keepalive_probes)) {
 			tcp_send_active_reset(sk, GFP_ATOMIC);
 			tcp_write_err(sk);
 			goto out;
 		}
 		if (tcp_write_wakeup(sk) <= 0) {
-			icsk->icsk_probes_out++;
+			tp->probes_out++;
 			elapsed = keepalive_intvl_when(tp);
 		} else {
 			/* If keepalive was lost due to local congestion,
@@ -516,7 +634,7 @@ static void tcp_keepalive_timer (unsigned long data)
 	sk_stream_mem_reclaim(sk);
 
 resched:
-	inet_csk_reset_keepalive_timer (sk, elapsed);
+	tcp_reset_keepalive_timer (sk, elapsed);
 	goto out;
 
 death:	
@@ -526,3 +644,8 @@ static void tcp_keepalive_timer (unsigned long data)
 	bh_unlock_sock(sk);
 	sock_put(sk);
 }
+
+EXPORT_SYMBOL(tcp_clear_xmit_timers);
+EXPORT_SYMBOL(tcp_delete_keepalive_timer);
+EXPORT_SYMBOL(tcp_init_xmit_timers);
+EXPORT_SYMBOL(tcp_reset_keepalive_timer);
diff --git a/trunk/net/ipv4/tcp_vegas.c b/trunk/net/ipv4/tcp_vegas.c
index 93c5f92070f9..9bd443db5193 100644
--- a/trunk/net/ipv4/tcp_vegas.c
+++ b/trunk/net/ipv4/tcp_vegas.c
@@ -35,7 +35,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
-#include <linux/inet_diag.h>
+#include <linux/tcp_diag.h>
 
 #include <net/tcp.h>
 
@@ -82,10 +82,9 @@ struct vegas {
  * Instead we must wait until the completion of an RTT during
  * which we actually receive ACKs.
  */
-static inline void vegas_enable(struct sock *sk)
+static inline void vegas_enable(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct vegas *vegas = inet_csk_ca(sk);
+	struct vegas *vegas = tcp_ca(tp);
 
 	/* Begin taking Vegas samples next time we send something. */
 	vegas->doing_vegas_now = 1;
@@ -98,19 +97,19 @@ static inline void vegas_enable(struct sock *sk)
 }
 
 /* Stop taking Vegas samples for now. */
-static inline void vegas_disable(struct sock *sk)
+static inline void vegas_disable(struct tcp_sock *tp)
 {
-	struct vegas *vegas = inet_csk_ca(sk);
+	struct vegas *vegas = tcp_ca(tp);
 
 	vegas->doing_vegas_now = 0;
 }
 
-static void tcp_vegas_init(struct sock *sk)
+static void tcp_vegas_init(struct tcp_sock *tp)
 {
-	struct vegas *vegas = inet_csk_ca(sk);
+	struct vegas *vegas = tcp_ca(tp);
 
 	vegas->baseRTT = 0x7fffffff;
-	vegas_enable(sk);
+	vegas_enable(tp);
 }
 
 /* Do RTT sampling needed for Vegas.
@@ -121,9 +120,9 @@ static void tcp_vegas_init(struct sock *sk)
  *   o min-filter RTT samples from a much longer window (forever for now)
  *     to find the propagation delay (baseRTT)
  */
-static void tcp_vegas_rtt_calc(struct sock *sk, u32 usrtt)
+static void tcp_vegas_rtt_calc(struct tcp_sock *tp, u32 usrtt)
 {
-	struct vegas *vegas = inet_csk_ca(sk);
+	struct vegas *vegas = tcp_ca(tp);
 	u32 vrtt = usrtt + 1; /* Never allow zero rtt or baseRTT */
 
 	/* Filter to find propagation delay: */
@@ -137,13 +136,13 @@ static void tcp_vegas_rtt_calc(struct sock *sk, u32 usrtt)
 	vegas->cntRTT++;
 }
 
-static void tcp_vegas_state(struct sock *sk, u8 ca_state)
+static void tcp_vegas_state(struct tcp_sock *tp, u8 ca_state)
 {
 
 	if (ca_state == TCP_CA_Open)
-		vegas_enable(sk);
+		vegas_enable(tp);
 	else
-		vegas_disable(sk);
+		vegas_disable(tp);
 }
 
 /*
@@ -155,21 +154,20 @@ static void tcp_vegas_state(struct sock *sk, u8 ca_state)
  * packets, _then_ we can make Vegas calculations
  * again.
  */
-static void tcp_vegas_cwnd_event(struct sock *sk, enum tcp_ca_event event)
+static void tcp_vegas_cwnd_event(struct tcp_sock *tp, enum tcp_ca_event event)
 {
 	if (event == CA_EVENT_CWND_RESTART ||
 	    event == CA_EVENT_TX_START)
-		tcp_vegas_init(sk);
+		tcp_vegas_init(tp);
 }
 
-static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack,
+static void tcp_vegas_cong_avoid(struct tcp_sock *tp, u32 ack,
 				 u32 seq_rtt, u32 in_flight, int flag)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-	struct vegas *vegas = inet_csk_ca(sk);
+	struct vegas *vegas = tcp_ca(tp);
 
 	if (!vegas->doing_vegas_now)
-		return tcp_reno_cong_avoid(sk, ack, seq_rtt, in_flight, flag);
+		return tcp_reno_cong_avoid(tp, ack, seq_rtt, in_flight, flag);
 
 	/* The key players are v_beg_snd_una and v_beg_snd_nxt.
 	 *
@@ -221,7 +219,7 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack,
 		 * but that's not too awful, since we're taking the min,
 		 * rather than averaging.
 		 */
-		tcp_vegas_rtt_calc(sk, seq_rtt * 1000);
+		tcp_vegas_rtt_calc(tp, seq_rtt*1000);
 
 		/* We do the Vegas calculations only if we got enough RTT
 		 * samples that we can be reasonably sure that we got
@@ -361,14 +359,14 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack,
 }
 
 /* Extract info for Tcp socket info provided via netlink. */
-static void tcp_vegas_get_info(struct sock *sk, u32 ext,
+static void tcp_vegas_get_info(struct tcp_sock *tp, u32 ext,
 			       struct sk_buff *skb)
 {
-	const struct vegas *ca = inet_csk_ca(sk);
-	if (ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
+	const struct vegas *ca = tcp_ca(tp);
+	if (ext & (1<<(TCPDIAG_VEGASINFO-1))) {
 		struct tcpvegas_info *info;
 
-		info = RTA_DATA(__RTA_PUT(skb, INET_DIAG_VEGASINFO,
+		info = RTA_DATA(__RTA_PUT(skb, TCPDIAG_VEGASINFO,
 					  sizeof(*info)));
 
 		info->tcpv_enabled = ca->doing_vegas_now;
@@ -395,7 +393,7 @@ static struct tcp_congestion_ops tcp_vegas = {
 
 static int __init tcp_vegas_register(void)
 {
-	BUG_ON(sizeof(struct vegas) > ICSK_CA_PRIV_SIZE);
+	BUG_ON(sizeof(struct vegas) > TCP_CA_PRIV_SIZE);
 	tcp_register_congestion_control(&tcp_vegas);
 	return 0;
 }
diff --git a/trunk/net/ipv4/tcp_westwood.c b/trunk/net/ipv4/tcp_westwood.c
index 0c340c3756c2..ef827242c940 100644
--- a/trunk/net/ipv4/tcp_westwood.c
+++ b/trunk/net/ipv4/tcp_westwood.c
@@ -8,7 +8,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
-#include <linux/inet_diag.h>
+#include <linux/tcp_diag.h>
 #include <net/tcp.h>
 
 /* TCP Westwood structure */
@@ -40,9 +40,9 @@ struct westwood {
  * way as soon as possible. It will reasonably happen within the first
  * RTT period of the connection lifetime.
  */
-static void tcp_westwood_init(struct sock *sk)
+static void tcp_westwood_init(struct tcp_sock *tp)
 {
-	struct westwood *w = inet_csk_ca(sk);
+	struct westwood *w = tcp_ca(tp);
 
 	w->bk = 0;
         w->bw_ns_est = 0;
@@ -51,7 +51,7 @@ static void tcp_westwood_init(struct sock *sk)
         w->cumul_ack = 0;
 	w->rtt_min = w->rtt = TCP_WESTWOOD_INIT_RTT;
 	w->rtt_win_sx = tcp_time_stamp;
-	w->snd_una = tcp_sk(sk)->snd_una;
+	w->snd_una = tp->snd_una;
 }
 
 /*
@@ -74,11 +74,11 @@ static inline void westwood_filter(struct westwood *w, u32 delta)
  * Called after processing group of packets.
  * but all westwood needs is the last sample of srtt.
  */
-static void tcp_westwood_pkts_acked(struct sock *sk, u32 cnt)
+static void tcp_westwood_pkts_acked(struct tcp_sock *tp, u32 cnt)
 {
-	struct westwood *w = inet_csk_ca(sk);
+	struct westwood *w = tcp_ca(tp);
 	if (cnt > 0)
-		w->rtt = tcp_sk(sk)->srtt >> 3;
+		w->rtt = tp->srtt >> 3;
 }
 
 /*
@@ -86,9 +86,9 @@ static void tcp_westwood_pkts_acked(struct sock *sk, u32 cnt)
  * It updates RTT evaluation window if it is the right moment to do
  * it. If so it calls filter for evaluating bandwidth.
  */
-static void westwood_update_window(struct sock *sk)
+static void westwood_update_window(struct tcp_sock *tp)
 {
-	struct westwood *w = inet_csk_ca(sk);
+	struct westwood *w = tcp_ca(tp);
 	s32 delta = tcp_time_stamp - w->rtt_win_sx;
 
 	/*
@@ -114,12 +114,11 @@ static void westwood_update_window(struct sock *sk)
  * header prediction is successful. In such case in fact update is
  * straight forward and doesn't need any particular care.
  */
-static inline void westwood_fast_bw(struct sock *sk)
+static inline void westwood_fast_bw(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct westwood *w = inet_csk_ca(sk);
+	struct westwood *w = tcp_ca(tp);
 
-	westwood_update_window(sk);
+	westwood_update_window(tp);
 
 	w->bk += tp->snd_una - w->snd_una;
 	w->snd_una = tp->snd_una;
@@ -131,10 +130,9 @@ static inline void westwood_fast_bw(struct sock *sk)
  * This function evaluates cumul_ack for evaluating bk in case of
  * delayed or partial acks.
  */
-static inline u32 westwood_acked_count(struct sock *sk)
+static inline u32 westwood_acked_count(struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	struct westwood *w = inet_csk_ca(sk);
+	struct westwood *w = tcp_ca(tp);
 
 	w->cumul_ack = tp->snd_una - w->snd_una;
 
@@ -162,10 +160,9 @@ static inline u32 westwood_acked_count(struct sock *sk)
 	return w->cumul_ack;
 }
 
-static inline u32 westwood_bw_rttmin(const struct sock *sk)
+static inline u32 westwood_bw_rttmin(const struct tcp_sock *tp)
 {
-	const struct tcp_sock *tp = tcp_sk(sk);
-	const struct westwood *w = inet_csk_ca(sk);
+	struct westwood *w = tcp_ca(tp);
 	return max_t(u32, (w->bw_est * w->rtt_min) / tp->mss_cache, 2);
 }
 
@@ -175,32 +172,31 @@ static inline u32 westwood_bw_rttmin(const struct sock *sk)
  * in packets we use mss_cache). Rttmin is guaranteed to be >= 2
  * so avoids ever returning 0.
  */
-static u32 tcp_westwood_cwnd_min(struct sock *sk)
+static u32 tcp_westwood_cwnd_min(struct tcp_sock *tp)
 {
-	return westwood_bw_rttmin(sk);
+	return westwood_bw_rttmin(tp);
 }
 
-static void tcp_westwood_event(struct sock *sk, enum tcp_ca_event event)
+static void tcp_westwood_event(struct tcp_sock *tp, enum tcp_ca_event event)
 {
-	struct tcp_sock *tp = tcp_sk(sk);
-	struct westwood *w = inet_csk_ca(sk);
+	struct westwood *w = tcp_ca(tp);
 
 	switch(event) {
 	case CA_EVENT_FAST_ACK:
-		westwood_fast_bw(sk);
+		westwood_fast_bw(tp);
 		break;
 
 	case CA_EVENT_COMPLETE_CWR:
-		tp->snd_cwnd = tp->snd_ssthresh = westwood_bw_rttmin(sk);
+		tp->snd_cwnd = tp->snd_ssthresh = westwood_bw_rttmin(tp);
 		break;
 
 	case CA_EVENT_FRTO:
-		tp->snd_ssthresh = westwood_bw_rttmin(sk);
+		tp->snd_ssthresh = westwood_bw_rttmin(tp);
 		break;
 
 	case CA_EVENT_SLOW_ACK:
-		westwood_update_window(sk);
-		w->bk += westwood_acked_count(sk);
+		westwood_update_window(tp);
+		w->bk += westwood_acked_count(tp);
 		w->rtt_min = min(w->rtt, w->rtt_min);
 		break;
 
@@ -212,15 +208,15 @@ static void tcp_westwood_event(struct sock *sk, enum tcp_ca_event event)
 
 
 /* Extract info for Tcp socket info provided via netlink. */
-static void tcp_westwood_info(struct sock *sk, u32 ext,
+static void tcp_westwood_info(struct tcp_sock *tp, u32 ext,
 			      struct sk_buff *skb)
 {
-	const struct westwood *ca = inet_csk_ca(sk);
-	if (ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
+	const struct westwood *ca = tcp_ca(tp);
+	if (ext & (1<<(TCPDIAG_VEGASINFO-1))) {
 		struct rtattr *rta;
 		struct tcpvegas_info *info;
 
-		rta = __RTA_PUT(skb, INET_DIAG_VEGASINFO, sizeof(*info));
+		rta = __RTA_PUT(skb, TCPDIAG_VEGASINFO, sizeof(*info));
 		info = RTA_DATA(rta);
 		info->tcpv_enabled = 1;
 		info->tcpv_rttcnt = 0;
@@ -246,7 +242,7 @@ static struct tcp_congestion_ops tcp_westwood = {
 
 static int __init tcp_westwood_register(void)
 {
-	BUG_ON(sizeof(struct westwood) > ICSK_CA_PRIV_SIZE);
+	BUG_ON(sizeof(struct westwood) > TCP_CA_PRIV_SIZE);
 	return tcp_register_congestion_control(&tcp_westwood);
 }
 
diff --git a/trunk/net/ipv4/udp.c b/trunk/net/ipv4/udp.c
index e5beca7de86c..dc4d07357e3a 100644
--- a/trunk/net/ipv4/udp.c
+++ b/trunk/net/ipv4/udp.c
@@ -95,8 +95,7 @@
 #include <linux/ipv6.h>
 #include <linux/netdevice.h>
 #include <net/snmp.h>
-#include <net/ip.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <net/protocol.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
@@ -113,7 +112,7 @@
  *	Snmp MIB for the UDP layer
  */
 
-DEFINE_SNMP_STAT(struct udp_mib, udp_statistics) __read_mostly;
+DEFINE_SNMP_STAT(struct udp_mib, udp_statistics);
 
 struct hlist_head udp_hash[UDP_HTABLE_SIZE];
 DEFINE_RWLOCK(udp_hash_lock);
@@ -629,7 +628,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 		/* ... which is an evident application bug. --ANK */
 		release_sock(sk);
 
-		LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 2\n");
+		LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 2\n"));
 		err = -EINVAL;
 		goto out;
 	}
@@ -694,7 +693,7 @@ static int udp_sendpage(struct sock *sk, struct page *page, int offset,
 	if (unlikely(!up->pending)) {
 		release_sock(sk);
 
-		LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 3\n");
+		LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 3\n"));
 		return -EINVAL;
 	}
 
@@ -1103,7 +1102,7 @@ static int udp_checksum_init(struct sk_buff *skb, struct udphdr *uh,
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 		if (!udp_check(uh, ulen, saddr, daddr, skb->csum))
 			return 0;
-		LIMIT_NETDEBUG(KERN_DEBUG "udp v4 hw csum failure.\n");
+		LIMIT_NETDEBUG(printk(KERN_DEBUG "udp v4 hw csum failure.\n"));
 		skb->ip_summed = CHECKSUM_NONE;
 	}
 	if (skb->ip_summed != CHECKSUM_UNNECESSARY)
@@ -1182,13 +1181,13 @@ int udp_rcv(struct sk_buff *skb)
 	return(0);
 
 short_packet:
-	LIMIT_NETDEBUG(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
-		       NIPQUAD(saddr),
-		       ntohs(uh->source),
-		       ulen,
-		       len,
-		       NIPQUAD(daddr),
-		       ntohs(uh->dest));
+	LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
+			      NIPQUAD(saddr),
+			      ntohs(uh->source),
+			      ulen,
+			      len,
+			      NIPQUAD(daddr),
+			      ntohs(uh->dest)));
 no_header:
 	UDP_INC_STATS_BH(UDP_MIB_INERRORS);
 	kfree_skb(skb);
@@ -1199,12 +1198,12 @@ int udp_rcv(struct sk_buff *skb)
 	 * RFC1122: OK.  Discards the bad packet silently (as far as 
 	 * the network is concerned, anyway) as per 4.1.3.4 (MUST). 
 	 */
-	LIMIT_NETDEBUG(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
-		       NIPQUAD(saddr),
-		       ntohs(uh->source),
-		       NIPQUAD(daddr),
-		       ntohs(uh->dest),
-		       ulen);
+	LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
+			      NIPQUAD(saddr),
+			      ntohs(uh->source),
+			      NIPQUAD(daddr),
+			      ntohs(uh->dest),
+			      ulen));
 drop:
 	UDP_INC_STATS_BH(UDP_MIB_INERRORS);
 	kfree_skb(skb);
diff --git a/trunk/net/ipv4/xfrm4_state.c b/trunk/net/ipv4/xfrm4_state.c
index d23e07fc81fa..050611d7a967 100644
--- a/trunk/net/ipv4/xfrm4_state.c
+++ b/trunk/net/ipv4/xfrm4_state.c
@@ -128,10 +128,8 @@ void __init xfrm4_state_init(void)
 	xfrm_state_register_afinfo(&xfrm4_state_afinfo);
 }
 
-#if 0
 void __exit xfrm4_state_fini(void)
 {
 	xfrm_state_unregister_afinfo(&xfrm4_state_afinfo);
 }
-#endif  /*  0  */
 
diff --git a/trunk/net/ipv6/Makefile b/trunk/net/ipv6/Makefile
index 6460eec834b7..b39e04940590 100644
--- a/trunk/net/ipv6/Makefile
+++ b/trunk/net/ipv6/Makefile
@@ -8,7 +8,7 @@ ipv6-objs :=	af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o sit.o \
 		route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o raw.o \
 		protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
 		exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
-		ip6_flowlabel.o ipv6_syms.o netfilter.o
+		ip6_flowlabel.o ipv6_syms.o
 
 ipv6-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o \
 	xfrm6_output.o
@@ -23,5 +23,3 @@ obj-$(CONFIG_NETFILTER)	+= netfilter/
 obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
 
 obj-y += exthdrs_core.o
-
-obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_hashtables.o
diff --git a/trunk/net/ipv6/addrconf.c b/trunk/net/ipv6/addrconf.c
index 937ad32db77c..77004b9456c0 100644
--- a/trunk/net/ipv6/addrconf.c
+++ b/trunk/net/ipv6/addrconf.c
@@ -1041,9 +1041,9 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 	const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
 	const struct in6_addr *sk2_rcv_saddr6 = tcp_v6_rcv_saddr(sk2);
 	u32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
-	u32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
+	u32 sk2_rcv_saddr = tcp_v4_rcv_saddr(sk2);
 	int sk_ipv6only = ipv6_only_sock(sk);
-	int sk2_ipv6only = inet_v6_ipv6only(sk2);
+	int sk2_ipv6only = tcp_v6_ipv6only(sk2);
 	int addr_type = ipv6_addr_type(sk_rcv_saddr6);
 	int addr_type2 = sk2_rcv_saddr6 ? ipv6_addr_type(sk2_rcv_saddr6) : IPV6_ADDR_MAPPED;
 
@@ -1126,7 +1126,7 @@ void addrconf_leave_solict(struct inet6_dev *idev, struct in6_addr *addr)
 	__ipv6_dev_mc_dec(idev, &maddr);
 }
 
-static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
+void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 {
 	struct in6_addr addr;
 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@@ -1135,7 +1135,7 @@ static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 	ipv6_dev_ac_inc(ifp->idev->dev, &addr);
 }
 
-static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
+void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
 {
 	struct in6_addr addr;
 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@@ -2858,16 +2858,16 @@ static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
 
 	skb = alloc_skb(size, GFP_ATOMIC);
 	if (!skb) {
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV6_IFADDR, ENOBUFS);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV6_IFADDR, ENOBUFS);
 		return;
 	}
 	if (inet6_fill_ifaddr(skb, ifa, current->pid, 0, event, 0) < 0) {
 		kfree_skb(skb);
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV6_IFADDR, EINVAL);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV6_IFADDR, EINVAL);
 		return;
 	}
-	NETLINK_CB(skb).dst_group = RTNLGRP_IPV6_IFADDR;
-	netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_IFADDR, GFP_ATOMIC);
+	NETLINK_CB(skb).dst_groups = RTMGRP_IPV6_IFADDR;
+	netlink_broadcast(rtnl, skb, 0, RTMGRP_IPV6_IFADDR, GFP_ATOMIC);
 }
 
 static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
@@ -2994,16 +2994,16 @@ void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
 	
 	skb = alloc_skb(size, GFP_ATOMIC);
 	if (!skb) {
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV6_IFINFO, ENOBUFS);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV6_IFINFO, ENOBUFS);
 		return;
 	}
 	if (inet6_fill_ifinfo(skb, idev, current->pid, 0, event, 0) < 0) {
 		kfree_skb(skb);
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV6_IFINFO, EINVAL);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV6_IFINFO, EINVAL);
 		return;
 	}
-	NETLINK_CB(skb).dst_group = RTNLGRP_IPV6_IFINFO;
-	netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_IFINFO, GFP_ATOMIC);
+	NETLINK_CB(skb).dst_groups = RTMGRP_IPV6_IFINFO;
+	netlink_broadcast(rtnl, skb, 0, RTMGRP_IPV6_IFINFO, GFP_ATOMIC);
 }
 
 static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
@@ -3054,16 +3054,16 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
 
 	skb = alloc_skb(size, GFP_ATOMIC);
 	if (!skb) {
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV6_PREFIX, ENOBUFS);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV6_PREFIX, ENOBUFS);
 		return;
 	}
 	if (inet6_fill_prefix(skb, idev, pinfo, current->pid, 0, event, 0) < 0) {
 		kfree_skb(skb);
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV6_PREFIX, EINVAL);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV6_PREFIX, EINVAL);
 		return;
 	}
-	NETLINK_CB(skb).dst_group = RTNLGRP_IPV6_PREFIX;
-	netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_PREFIX, GFP_ATOMIC);
+	NETLINK_CB(skb).dst_groups = RTMGRP_IPV6_PREFIX;
+	netlink_broadcast(rtnl, skb, 0, RTMGRP_IPV6_PREFIX, GFP_ATOMIC);
 }
 
 static struct rtnetlink_link inet6_rtnetlink_table[RTM_NR_MSGTYPES] = {
diff --git a/trunk/net/ipv6/af_inet6.c b/trunk/net/ipv6/af_inet6.c
index 4f8795af2edb..28d9bcab0970 100644
--- a/trunk/net/ipv6/af_inet6.c
+++ b/trunk/net/ipv6/af_inet6.c
@@ -44,7 +44,6 @@
 #include <linux/netdevice.h>
 #include <linux/icmpv6.h>
 #include <linux/smp_lock.h>
-#include <linux/netfilter_ipv6.h>
 
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -67,14 +66,45 @@ MODULE_AUTHOR("Cast of dozens");
 MODULE_DESCRIPTION("IPv6 protocol stack for Linux");
 MODULE_LICENSE("GPL");
 
+/* IPv6 procfs goodies... */
+
+#ifdef CONFIG_PROC_FS
+extern int raw6_proc_init(void);
+extern void raw6_proc_exit(void);
+extern int tcp6_proc_init(void);
+extern void tcp6_proc_exit(void);
+extern int udp6_proc_init(void);
+extern void udp6_proc_exit(void);
+extern int ipv6_misc_proc_init(void);
+extern void ipv6_misc_proc_exit(void);
+extern int ac6_proc_init(void);
+extern void ac6_proc_exit(void);
+extern int if6_proc_init(void);
+extern void if6_proc_exit(void);
+#endif
+
 int sysctl_ipv6_bindv6only;
 
+#ifdef INET_REFCNT_DEBUG
+atomic_t inet6_sock_nr;
+EXPORT_SYMBOL(inet6_sock_nr);
+#endif
+
 /* The inetsw table contains everything that inet_create needs to
  * build a new socket.
  */
 static struct list_head inetsw6[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw6_lock);
 
+static void inet6_sock_destruct(struct sock *sk)
+{
+	inet_sock_destruct(sk);
+
+#ifdef INET_REFCNT_DEBUG
+	atomic_dec(&inet6_sock_nr);
+#endif
+}
+
 static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
 {
 	const int offset = sk->sk_prot->obj_size - sizeof(struct ipv6_pinfo);
@@ -155,7 +185,7 @@ static int inet6_create(struct socket *sock, int protocol)
 			inet->hdrincl = 1;
 	}
 
-	sk->sk_destruct		= inet_sock_destruct;
+	sk->sk_destruct		= inet6_sock_destruct;
 	sk->sk_family		= PF_INET6;
 	sk->sk_protocol		= protocol;
 
@@ -182,17 +212,12 @@ static int inet6_create(struct socket *sock, int protocol)
 		inet->pmtudisc = IP_PMTUDISC_DONT;
 	else
 		inet->pmtudisc = IP_PMTUDISC_WANT;
-	/* 
-	 * Increment only the relevant sk_prot->socks debug field, this changes
-	 * the previous behaviour of incrementing both the equivalent to
-	 * answer->prot->socks (inet6_sock_nr) and inet_sock_nr.
-	 *
-	 * This allows better debug granularity as we'll know exactly how many
-	 * UDPv6, TCPv6, etc socks were allocated, not the sum of all IPv6
-	 * transport protocol socks. -acme
-	 */
-	sk_refcnt_debug_inc(sk);
 
+
+#ifdef INET_REFCNT_DEBUG
+	atomic_inc(&inet6_sock_nr);
+	atomic_inc(&inet_sock_nr);
+#endif
 	if (inet->num) {
 		/* It assumes that any protocol which allows
 		 * the user to assign a number at socket
@@ -488,6 +513,11 @@ static struct net_proto_family inet6_family_ops = {
 	.owner	= THIS_MODULE,
 };
 
+#ifdef CONFIG_SYSCTL
+extern void ipv6_sysctl_register(void);
+extern void ipv6_sysctl_unregister(void);
+#endif
+
 /* Same as inet6_dgram_ops, sans udp_poll.  */
 static struct proto_ops inet6_sockraw_ops = {
 	.family =	PF_INET6,
@@ -654,6 +684,8 @@ static void cleanup_ipv6_mibs(void)
 	snmp6_mib_free((void **)udp_stats_in6);
 }
 
+extern int ipv6_misc_proc_init(void);
+
 static int __init inet6_init(void)
 {
 	struct sk_buff *dummy_skb;
@@ -725,9 +757,6 @@ static int __init inet6_init(void)
 	err = igmp6_init(&inet6_family_ops);
 	if (err)
 		goto igmp_fail;
-	err = ipv6_netfilter_init();
-	if (err)
-		goto netfilter_fail;
 	/* Create /proc/foo6 entries. */
 #ifdef CONFIG_PROC_FS
 	err = -ENOMEM;
@@ -784,8 +813,6 @@ static int __init inet6_init(void)
 	raw6_proc_exit();
 proc_raw6_fail:
 #endif
-	ipv6_netfilter_fini();
-netfilter_fail:
 	igmp6_cleanup();
 igmp_fail:
 	ndisc_cleanup();
@@ -825,7 +852,6 @@ static void __exit inet6_exit(void)
 	ip6_route_cleanup();
 	ipv6_packet_cleanup();
 	igmp6_cleanup();
-	ipv6_netfilter_fini();
 	ndisc_cleanup();
 	icmpv6_cleanup();
 #ifdef CONFIG_SYSCTL
diff --git a/trunk/net/ipv6/ah6.c b/trunk/net/ipv6/ah6.c
index 0ebfad907a03..986fdfdccbcd 100644
--- a/trunk/net/ipv6/ah6.c
+++ b/trunk/net/ipv6/ah6.c
@@ -131,10 +131,10 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len)
 		case NEXTHDR_HOP:
 		case NEXTHDR_DEST:
 			if (!zero_out_mutable_opts(exthdr.opth)) {
-				LIMIT_NETDEBUG(
+				LIMIT_NETDEBUG(printk(
 					KERN_WARNING "overrun %sopts\n",
 					nexthdr == NEXTHDR_HOP ?
-						"hop" : "dest");
+						"hop" : "dest"));
 				return -EINVAL;
 			}
 			break;
@@ -293,7 +293,8 @@ static int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
 		skb_push(skb, skb->data - skb->nh.raw);
 		ahp->icv(ahp, skb, ah->auth_data);
 		if (memcmp(ah->auth_data, auth_data, ahp->icv_trunc_len)) {
-			LIMIT_NETDEBUG(KERN_WARNING "ipsec ah authentication error\n");
+			LIMIT_NETDEBUG(
+				printk(KERN_WARNING "ipsec ah authentication error\n"));
 			x->stats.integrity_failed++;
 			goto free_out;
 		}
@@ -331,9 +332,9 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	if (!x)
 		return;
 
-	NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/"
-		 "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n",
-		 ntohl(ah->spi), NIP6(iph->daddr));
+	NETDEBUG(printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/"
+			"%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n",
+	       ntohl(ah->spi), NIP6(iph->daddr)));
 
 	xfrm_state_put(x);
 }
diff --git a/trunk/net/ipv6/datagram.c b/trunk/net/ipv6/datagram.c
index 01468fab3d3d..5229365cd8b4 100644
--- a/trunk/net/ipv6/datagram.c
+++ b/trunk/net/ipv6/datagram.c
@@ -29,7 +29,6 @@
 #include <net/addrconf.h>
 #include <net/transp_v6.h>
 #include <net/ip6_route.h>
-#include <net/tcp_states.h>
 
 #include <linux/errqueue.h>
 #include <asm/uaccess.h>
@@ -589,8 +588,8 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
 			break;
 
 		default:
-			LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
-			               cmsg->cmsg_type);
+			LIMIT_NETDEBUG(
+				printk(KERN_DEBUG "invalid cmsg type: %d\n", cmsg->cmsg_type));
 			err = -EINVAL;
 			break;
 		};
diff --git a/trunk/net/ipv6/esp6.c b/trunk/net/ipv6/esp6.c
index e8bff9d3d96c..324db62515a2 100644
--- a/trunk/net/ipv6/esp6.c
+++ b/trunk/net/ipv6/esp6.c
@@ -212,7 +212,8 @@ static int esp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, stru
 
 		padlen = nexthdr[0];
 		if (padlen+2 >= elen) {
-			LIMIT_NETDEBUG(KERN_WARNING "ipsec esp packet is garbage padlen=%d, elen=%d\n", padlen+2, elen);
+			LIMIT_NETDEBUG(
+				printk(KERN_WARNING "ipsec esp packet is garbage padlen=%d, elen=%d\n", padlen+2, elen));
 			ret = -EINVAL;
 			goto out;
 		}
diff --git a/trunk/net/ipv6/exthdrs.c b/trunk/net/ipv6/exthdrs.c
index 5be6da2584ee..e0839eafc3a9 100644
--- a/trunk/net/ipv6/exthdrs.c
+++ b/trunk/net/ipv6/exthdrs.c
@@ -424,8 +424,8 @@ static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
 		IP6CB(skb)->ra = optoff;
 		return 1;
 	}
-	LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
-	               skb->nh.raw[optoff+1]);
+	LIMIT_NETDEBUG(
+		 printk(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n", skb->nh.raw[optoff+1]));
 	kfree_skb(skb);
 	return 0;
 }
@@ -437,8 +437,8 @@ static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 	u32 pkt_len;
 
 	if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
-		LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
-		               skb->nh.raw[optoff+1]);
+		LIMIT_NETDEBUG(
+			 printk(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n", skb->nh.raw[optoff+1]));
 		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		goto drop;
 	}
diff --git a/trunk/net/ipv6/icmp.c b/trunk/net/ipv6/icmp.c
index 5176fc655ea9..ff3ec9822e36 100644
--- a/trunk/net/ipv6/icmp.c
+++ b/trunk/net/ipv6/icmp.c
@@ -67,7 +67,7 @@
 #include <asm/uaccess.h>
 #include <asm/system.h>
 
-DEFINE_SNMP_STAT(struct icmpv6_mib, icmpv6_statistics) __read_mostly;
+DEFINE_SNMP_STAT(struct icmpv6_mib, icmpv6_statistics);
 
 /*
  *	The ICMP socket(s). This is the most convenient way to flow control
@@ -332,7 +332,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
 	 *	for now we don't know that.
 	 */
 	if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
-		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: addr_any/mcast source\n");
+		LIMIT_NETDEBUG(
+			printk(KERN_DEBUG "icmpv6_send: addr_any/mcast source\n"));
 		return;
 	}
 
@@ -340,7 +341,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
 	 *	Never answer to a ICMP packet.
 	 */
 	if (is_ineligible(skb)) {
-		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: no reply to icmp error\n");
+		LIMIT_NETDEBUG(
+			printk(KERN_DEBUG "icmpv6_send: no reply to icmp error\n")); 
 		return;
 	}
 
@@ -391,7 +393,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
 	len = skb->len - msg.offset;
 	len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) -sizeof(struct icmp6hdr));
 	if (len < 0) {
-		LIMIT_NETDEBUG(KERN_DEBUG "icmp: len problem\n");
+		LIMIT_NETDEBUG(
+			printk(KERN_DEBUG "icmp: len problem\n"));
 		goto out_dst_release;
 	}
 
@@ -548,8 +551,7 @@ static void icmpv6_notify(struct sk_buff *skb, int type, int code, u32 info)
 
 	read_lock(&raw_v6_lock);
 	if ((sk = sk_head(&raw_v6_htable[hash])) != NULL) {
-		while((sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr,
-					    skb->dev->ifindex))) {
+		while((sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr))) {
 			rawv6_err(sk, skb, NULL, type, code, inner_offset, info);
 			sk = sk_next(sk);
 		}
@@ -581,15 +583,17 @@ static int icmpv6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 		if (csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_ICMPV6,
 				    skb->csum)) {
-			LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 hw checksum failed\n");
+			LIMIT_NETDEBUG(
+				printk(KERN_DEBUG "ICMPv6 hw checksum failed\n"));
 			skb->ip_summed = CHECKSUM_NONE;
 		}
 	}
 	if (skb->ip_summed == CHECKSUM_NONE) {
 		if (csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_ICMPV6,
 				    skb_checksum(skb, 0, skb->len, 0))) {
-			LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x > %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x]\n",
-				       NIP6(*saddr), NIP6(*daddr));
+			LIMIT_NETDEBUG(
+				printk(KERN_DEBUG "ICMPv6 checksum failed [%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x > %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x]\n",
+				       NIP6(*saddr), NIP6(*daddr)));
 			goto discard_it;
 		}
 	}
@@ -665,7 +669,8 @@ static int icmpv6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
 		break;
 
 	default:
-		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6: msg of unknown type\n");
+		LIMIT_NETDEBUG(
+			printk(KERN_DEBUG "icmpv6: msg of unknown type\n"));
 
 		/* informational */
 		if (type & ICMPV6_INFOMSG_MASK)
diff --git a/trunk/net/ipv6/inet6_hashtables.c b/trunk/net/ipv6/inet6_hashtables.c
deleted file mode 100644
index 01d5f46d4e40..000000000000
--- a/trunk/net/ipv6/inet6_hashtables.c
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * INET		An implementation of the TCP/IP protocol suite for the LINUX
- *		operating system.  INET is implemented using the BSD Socket
- *		interface as the means of communication with the user level.
- *
- *		Generic INET6 transport hashtables
- *
- * Authors:	Lotsa people, from code originally in tcp
- *
- *	This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-
-#include <linux/module.h>
-
-#include <net/inet_connection_sock.h>
-#include <net/inet_hashtables.h>
-#include <net/inet6_hashtables.h>
-
-struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
-				   const struct in6_addr *daddr,
-				   const unsigned short hnum, const int dif)
-{
-	struct sock *sk;
-	const struct hlist_node *node;
-	struct sock *result = NULL;
-	int score, hiscore = 0;
-
-	read_lock(&hashinfo->lhash_lock);
-	sk_for_each(sk, node, &hashinfo->listening_hash[inet_lhashfn(hnum)]) {
-		if (inet_sk(sk)->num == hnum && sk->sk_family == PF_INET6) {
-			const struct ipv6_pinfo *np = inet6_sk(sk);
-			
-			score = 1;
-			if (!ipv6_addr_any(&np->rcv_saddr)) {
-				if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
-					continue;
-				score++;
-			}
-			if (sk->sk_bound_dev_if) {
-				if (sk->sk_bound_dev_if != dif)
-					continue;
-				score++;
-			}
-			if (score == 3) {
-				result = sk;
-				break;
-			}
-			if (score > hiscore) {
-				hiscore = score;
-				result = sk;
-			}
-		}
-	}
-	if (result)
-		sock_hold(result);
-	read_unlock(&hashinfo->lhash_lock);
-	return result;
-}
-
-EXPORT_SYMBOL_GPL(inet6_lookup_listener);
-
-struct sock *inet6_lookup(struct inet_hashinfo *hashinfo,
-			  const struct in6_addr *saddr, const u16 sport,
-			  const struct in6_addr *daddr, const u16 dport,
-			  const int dif)
-{
-	struct sock *sk;
-
-	local_bh_disable();
-	sk = __inet6_lookup(hashinfo, saddr, sport, daddr, ntohs(dport), dif);
-	local_bh_enable();
-
-	return sk;
-}
-
-EXPORT_SYMBOL_GPL(inet6_lookup);
diff --git a/trunk/net/ipv6/ip6_fib.c b/trunk/net/ipv6/ip6_fib.c
index 16af874c9e8f..1b354aa97934 100644
--- a/trunk/net/ipv6/ip6_fib.c
+++ b/trunk/net/ipv6/ip6_fib.c
@@ -49,7 +49,7 @@
 
 struct rt6_statistics	rt6_stats;
 
-static kmem_cache_t * fib6_node_kmem __read_mostly;
+static kmem_cache_t * fib6_node_kmem;
 
 enum fib_walk_state_t
 {
diff --git a/trunk/net/ipv6/ip6_input.c b/trunk/net/ipv6/ip6_input.c
index 6e3480426939..10fbb50daea4 100644
--- a/trunk/net/ipv6/ip6_input.c
+++ b/trunk/net/ipv6/ip6_input.c
@@ -56,7 +56,7 @@ static inline int ip6_rcv_finish( struct sk_buff *skb)
 	return dst_input(skb);
 }
 
-int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 {
 	struct ipv6hdr *hdr;
 	u32 		pkt_len;
@@ -166,8 +166,8 @@ static inline int ip6_input_finish(struct sk_buff *skb)
 	nexthdr = skb->nh.raw[nhoff];
 
 	raw_sk = sk_head(&raw_v6_htable[nexthdr & (MAX_INET_PROTOS - 1)]);
-	if (raw_sk && !ipv6_raw_deliver(skb, nexthdr))
-		raw_sk = NULL;
+	if (raw_sk)
+		ipv6_raw_deliver(skb, nexthdr);
 
 	hash = nexthdr & (MAX_INET_PROTOS - 1);
 	if ((ipprot = rcu_dereference(inet6_protos[hash])) != NULL) {
diff --git a/trunk/net/ipv6/ip6_output.c b/trunk/net/ipv6/ip6_output.c
index 01ef94f7c7f1..ae652ca14bc9 100644
--- a/trunk/net/ipv6/ip6_output.c
+++ b/trunk/net/ipv6/ip6_output.c
@@ -153,6 +153,51 @@ int ip6_output(struct sk_buff *skb)
 		return ip6_output2(skb);
 }
 
+#ifdef CONFIG_NETFILTER
+int ip6_route_me_harder(struct sk_buff *skb)
+{
+	struct ipv6hdr *iph = skb->nh.ipv6h;
+	struct dst_entry *dst;
+	struct flowi fl = {
+		.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
+		.nl_u =
+		{ .ip6_u =
+		  { .daddr = iph->daddr,
+		    .saddr = iph->saddr, } },
+		.proto = iph->nexthdr,
+	};
+
+	dst = ip6_route_output(skb->sk, &fl);
+
+	if (dst->error) {
+		IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
+		LIMIT_NETDEBUG(
+			printk(KERN_DEBUG "ip6_route_me_harder: No more route.\n"));
+		dst_release(dst);
+		return -EINVAL;
+	}
+
+	/* Drop old route. */
+	dst_release(skb->dst);
+
+	skb->dst = dst;
+	return 0;
+}
+#endif
+
+static inline int ip6_maybe_reroute(struct sk_buff *skb)
+{
+#ifdef CONFIG_NETFILTER
+	if (skb->nfcache & NFC_ALTERED){
+		if (ip6_route_me_harder(skb) != 0){
+			kfree_skb(skb);
+			return -EINVAL;
+		}
+	}
+#endif /* CONFIG_NETFILTER */
+	return dst_output(skb);
+}
+
 /*
  *	xmit an sk_buff (used by TCP)
  */
@@ -221,8 +266,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
 	mtu = dst_mtu(dst);
 	if ((skb->len <= mtu) || ipfragok) {
 		IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
-		return NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev,
-				dst_output);
+		return NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, ip6_maybe_reroute);
 	}
 
 	if (net_ratelimit())
@@ -277,9 +321,7 @@ static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
 	read_lock(&ip6_ra_lock);
 	for (ra = ip6_ra_chain; ra; ra = ra->next) {
 		struct sock *sk = ra->sk;
-		if (sk && ra->sel == sel &&
-		    (!sk->sk_bound_dev_if ||
-		     sk->sk_bound_dev_if == skb->dev->ifindex)) {
+		if (sk && ra->sel == sel) {
 			if (last) {
 				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 				if (skb2)
@@ -625,7 +667,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 		 */
 
 		if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_RESERVED_SPACE(rt->u.dst.dev), GFP_ATOMIC)) == NULL) {
-			NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
+			NETDEBUG(printk(KERN_INFO "IPv6: frag: no memory for new fragment!\n"));
 			IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
 			err = -ENOMEM;
 			goto fail;
diff --git a/trunk/net/ipv6/ipv6_sockglue.c b/trunk/net/ipv6/ipv6_sockglue.c
index 76466af8331e..3bc144a79fa5 100644
--- a/trunk/net/ipv6/ipv6_sockglue.c
+++ b/trunk/net/ipv6/ipv6_sockglue.c
@@ -55,7 +55,7 @@
 
 #include <asm/uaccess.h>
 
-DEFINE_SNMP_STAT(struct ipstats_mib, ipv6_statistics) __read_mostly;
+DEFINE_SNMP_STAT(struct ipstats_mib, ipv6_statistics);
 
 static struct packet_type ipv6_packet_type = {
 	.type = __constant_htons(ETH_P_IPV6), 
@@ -109,6 +109,13 @@ int ip6_ra_control(struct sock *sk, int sel, void (*destructor)(struct sock *))
 	return 0;
 }
 
+extern int ip6_mc_source(int add, int omode, struct sock *sk,
+	struct group_source_req *pgsr);
+extern int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf);
+extern int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
+	struct group_filter __user *optval, int __user *optlen);
+
+
 int ipv6_setsockopt(struct sock *sk, int level, int optname,
 		    char __user *optval, int optlen)
 {
@@ -156,13 +163,6 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname,
 			fl6_free_socklist(sk);
 			ipv6_sock_mc_close(sk);
 
-			/*
-			 * Sock is moving from IPv6 to IPv4 (sk_prot), so
-			 * remove it from the refcnt debug socks count in the
-			 * original family...
-			 */
-			sk_refcnt_debug_dec(sk);
-
 			if (sk->sk_protocol == IPPROTO_TCP) {
 				struct tcp_sock *tp = tcp_sk(sk);
 
@@ -192,11 +192,9 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname,
 				kfree_skb(pktopt);
 
 			sk->sk_destruct = inet_sock_destruct;
-			/*
-			 * ... and add it to the refcnt debug socks count
-			 * in the new family. -acme
-			 */
-			sk_refcnt_debug_inc(sk);
+#ifdef INET_REFCNT_DEBUG
+			atomic_dec(&inet6_sock_nr);
+#endif
 			module_put(THIS_MODULE);
 			retv = 0;
 			break;
@@ -439,6 +437,7 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname,
 	}
 	case MCAST_MSFILTER:
 	{
+		extern int sysctl_optmem_max;
 		extern int sysctl_mld_max_msf;
 		struct group_filter *gsf;
 
diff --git a/trunk/net/ipv6/ipv6_syms.c b/trunk/net/ipv6/ipv6_syms.c
index 37a4a99c9fe9..5ade5a5d1990 100644
--- a/trunk/net/ipv6/ipv6_syms.c
+++ b/trunk/net/ipv6/ipv6_syms.c
@@ -15,6 +15,9 @@ EXPORT_SYMBOL(ndisc_mc_map);
 EXPORT_SYMBOL(register_inet6addr_notifier);
 EXPORT_SYMBOL(unregister_inet6addr_notifier);
 EXPORT_SYMBOL(ip6_route_output);
+#ifdef CONFIG_NETFILTER
+EXPORT_SYMBOL(ip6_route_me_harder);
+#endif
 EXPORT_SYMBOL(addrconf_lock);
 EXPORT_SYMBOL(ipv6_setsockopt);
 EXPORT_SYMBOL(ipv6_getsockopt);
diff --git a/trunk/net/ipv6/ndisc.c b/trunk/net/ipv6/ndisc.c
index a7eae30f4554..7ae72d4c9bd2 100644
--- a/trunk/net/ipv6/ndisc.c
+++ b/trunk/net/ipv6/ndisc.c
@@ -812,7 +812,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
 		if (ipv6_chk_acast_addr(dev, &msg->target) ||
 		    (idev->cnf.forwarding && 
 		     pneigh_lookup(&nd_tbl, &msg->target, dev, 0))) {
-			if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
+			if (skb->stamp.tv_sec != LOCALLY_ENQUEUED &&
 			    skb->pkt_type != PACKET_HOST &&
 			    inc != 0 &&
 			    idev->nd_parms->proxy_delay != 0) {
@@ -1487,8 +1487,6 @@ int ndisc_rcv(struct sk_buff *skb)
 		return 0;
 	}
 
-	memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
-
 	switch (msg->icmph.icmp6_type) {
 	case NDISC_NEIGHBOUR_SOLICITATION:
 		ndisc_recv_ns(skb);
diff --git a/trunk/net/ipv6/netfilter.c b/trunk/net/ipv6/netfilter.c
deleted file mode 100644
index f8626ebf90fd..000000000000
--- a/trunk/net/ipv6/netfilter.c
+++ /dev/null
@@ -1,104 +0,0 @@
-#include <linux/config.h>
-#include <linux/init.h>
-
-#ifdef CONFIG_NETFILTER
-
-#include <linux/kernel.h>
-#include <linux/ipv6.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv6.h>
-#include <net/dst.h>
-#include <net/ipv6.h>
-#include <net/ip6_route.h>
-
-int ip6_route_me_harder(struct sk_buff *skb)
-{
-	struct ipv6hdr *iph = skb->nh.ipv6h;
-	struct dst_entry *dst;
-	struct flowi fl = {
-		.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
-		.nl_u =
-		{ .ip6_u =
-		  { .daddr = iph->daddr,
-		    .saddr = iph->saddr, } },
-		.proto = iph->nexthdr,
-	};
-
-	dst = ip6_route_output(skb->sk, &fl);
-
-	if (dst->error) {
-		IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
-		LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
-		dst_release(dst);
-		return -EINVAL;
-	}
-
-	/* Drop old route. */
-	dst_release(skb->dst);
-
-	skb->dst = dst;
-	return 0;
-}
-EXPORT_SYMBOL(ip6_route_me_harder);
-
-/*
- * Extra routing may needed on local out, as the QUEUE target never
- * returns control to the table.
- */
-
-struct ip6_rt_info {
-	struct in6_addr daddr;
-	struct in6_addr saddr;
-};
-
-static void save(const struct sk_buff *skb, struct nf_info *info)
-{
-	struct ip6_rt_info *rt_info = nf_info_reroute(info);
-
-	if (info->hook == NF_IP6_LOCAL_OUT) {
-		struct ipv6hdr *iph = skb->nh.ipv6h;
-
-		rt_info->daddr = iph->daddr;
-		rt_info->saddr = iph->saddr;
-	}
-}
-
-static int reroute(struct sk_buff **pskb, const struct nf_info *info)
-{
-	struct ip6_rt_info *rt_info = nf_info_reroute(info);
-
-	if (info->hook == NF_IP6_LOCAL_OUT) {
-		struct ipv6hdr *iph = (*pskb)->nh.ipv6h;
-		if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
-		    !ipv6_addr_equal(&iph->saddr, &rt_info->saddr))
-			return ip6_route_me_harder(*pskb);
-	}
-	return 0;
-}
-
-static struct nf_queue_rerouter ip6_reroute = {
-	.rer_size	= sizeof(struct ip6_rt_info),
-	.save 		= &save,
-	.reroute	= &reroute,
-};
-
-int __init ipv6_netfilter_init(void)
-{
-	return nf_register_queue_rerouter(PF_INET6, &ip6_reroute);
-}
-
-void ipv6_netfilter_fini(void)
-{
-	nf_unregister_queue_rerouter(PF_INET6);
-}
-
-#else /* CONFIG_NETFILTER */
-int __init ipv6_netfilter_init(void)
-{
-	return 0;
-}
-
-void ipv6_netfilter_fini(void)
-{
-}
-#endif /* CONFIG_NETFILTER */
diff --git a/trunk/net/ipv6/netfilter/Kconfig b/trunk/net/ipv6/netfilter/Kconfig
index 216fbe1ac65c..77ec704c9ee3 100644
--- a/trunk/net/ipv6/netfilter/Kconfig
+++ b/trunk/net/ipv6/netfilter/Kconfig
@@ -10,16 +10,13 @@ menu "IPv6: Netfilter Configuration (EXPERIMENTAL)"
 #  dep_tristate '  FTP protocol support' CONFIG_IP6_NF_FTP $CONFIG_IP6_NF_CONNTRACK
 #fi
 config IP6_NF_QUEUE
-	tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
+	tristate "Userspace queueing via NETLINK"
 	---help---
 
 	  This option adds a queue handler to the kernel for IPv6
-	  packets which enables users to receive the filtered packets
-	  with QUEUE target using libipq.
-
-	  THis option enables the old IPv6-only "ip6_queue" implementation
-	  which has been obsoleted by the new "nfnetlink_queue" code (see
-	  CONFIG_NETFILTER_NETLINK_QUEUE).
+	  packets which lets us to receive the filtered packets
+	  with QUEUE target using libiptc as we can do with
+	  the IPv4 now.
 
 	  (C) Fernando Anton 2001
 	  IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
@@ -199,16 +196,6 @@ config IP6_NF_TARGET_LOG
 
 	  To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_TARGET_REJECT
-	tristate "REJECT target support"
-	depends on IP6_NF_FILTER
-	help
-	  The REJECT target allows a filtering rule to specify that an ICMPv6
-	  error should be issued in response to an incoming packet, rather
-	  than silently being dropped.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
 #  if [ "$CONFIG_IP6_NF_FILTER" != "n" ]; then
 #    dep_tristate '    REJECT target support' CONFIG_IP6_NF_TARGET_REJECT $CONFIG_IP6_NF_FILTER
 #    if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
@@ -239,22 +226,6 @@ config IP6_NF_TARGET_MARK
 
 	  To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_TARGET_HL
-	tristate  'HL (hoplimit) target support'
-	depends on IP6_NF_MANGLE
-	help
-	  This option adds a `HL' target, which enables the user to decrement
-	  the hoplimit value of the IPv6 header or set it to a given (lower)
-	  value.
-	
-	  While it is safe to decrement the hoplimit value, this option also
-	  enables functionality to increment and set the hoplimit value of the
-	  IPv6 header to arbitrary values.  This is EXTREMELY DANGEROUS since
-	  you can easily create immortal packets that loop forever on the
-	  network.  
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
 #dep_tristate '  LOG target support' CONFIG_IP6_NF_TARGET_LOG $CONFIG_IP6_NF_IPTABLES
 config IP6_NF_RAW
 	tristate  'raw table support (required for TRACE)'
diff --git a/trunk/net/ipv6/netfilter/Makefile b/trunk/net/ipv6/netfilter/Makefile
index bd9a16a5cbba..2e51714953b6 100644
--- a/trunk/net/ipv6/netfilter/Makefile
+++ b/trunk/net/ipv6/netfilter/Makefile
@@ -20,10 +20,7 @@ obj-$(CONFIG_IP6_NF_MATCH_PHYSDEV) += ip6t_physdev.o
 obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
 obj-$(CONFIG_IP6_NF_TARGET_MARK) += ip6t_MARK.o
-obj-$(CONFIG_IP6_NF_TARGET_HL) += ip6t_HL.o
 obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
 obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
-obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
-obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ip6t_NFQUEUE.o
diff --git a/trunk/net/ipv6/netfilter/ip6_queue.c b/trunk/net/ipv6/netfilter/ip6_queue.c
index aa11cf366efa..a16df5b27c84 100644
--- a/trunk/net/ipv6/netfilter/ip6_queue.c
+++ b/trunk/net/ipv6/netfilter/ip6_queue.c
@@ -47,10 +47,16 @@
 #define NET_IPQ_QMAX 2088
 #define NET_IPQ_QMAX_NAME "ip6_queue_maxlen"
 
+struct ipq_rt_info {
+	struct in6_addr daddr;
+	struct in6_addr saddr;
+};
+
 struct ipq_queue_entry {
 	struct list_head list;
 	struct nf_info *info;
 	struct sk_buff *skb;
+	struct ipq_rt_info rt_info;
 };
 
 typedef int (*ipq_cmpfn)(struct ipq_queue_entry *, unsigned long);
@@ -238,8 +244,8 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 
 	pmsg->packet_id       = (unsigned long )entry;
 	pmsg->data_len        = data_len;
-	pmsg->timestamp_sec   = skb_tv_base.tv_sec + entry->skb->tstamp.off_sec;
-	pmsg->timestamp_usec  = skb_tv_base.tv_usec + entry->skb->tstamp.off_usec;
+	pmsg->timestamp_sec   = entry->skb->stamp.tv_sec;
+	pmsg->timestamp_usec  = entry->skb->stamp.tv_usec;
 	pmsg->mark            = entry->skb->nfmark;
 	pmsg->hook            = entry->info->hook;
 	pmsg->hw_protocol     = entry->skb->protocol;
@@ -278,8 +284,7 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 }
 
 static int
-ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, 
-		   unsigned int queuenum, void *data)
+ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data)
 {
 	int status = -EINVAL;
 	struct sk_buff *nskb;
@@ -297,6 +302,13 @@ ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
 	entry->info = info;
 	entry->skb = skb;
 
+	if (entry->info->hook == NF_IP_LOCAL_OUT) {
+		struct ipv6hdr *iph = skb->nh.ipv6h;
+
+		entry->rt_info.daddr = iph->daddr;
+		entry->rt_info.saddr = iph->saddr;
+	}
+
 	nskb = ipq_build_packet_message(entry, &status);
 	if (nskb == NULL)
 		goto err_out_free;
@@ -372,11 +384,23 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
 		}
 		skb_put(e->skb, diff);
 	}
-	if (!skb_make_writable(&e->skb, v->data_len))
+	if (!skb_ip_make_writable(&e->skb, v->data_len))
 		return -ENOMEM;
 	memcpy(e->skb->data, v->payload, v->data_len);
 	e->skb->ip_summed = CHECKSUM_NONE;
-
+	e->skb->nfcache |= NFC_ALTERED;
+
+	/*
+	 * Extra routing may needed on local out, as the QUEUE target never
+	 * returns control to the table.
+         * Not a nice way to cmp, but works
+	 */
+	if (e->info->hook == NF_IP_LOCAL_OUT) {
+		struct ipv6hdr *iph = e->skb->nh.ipv6h;
+		if (!ipv6_addr_equal(&iph->daddr, &e->rt_info.daddr) ||
+		    !ipv6_addr_equal(&iph->saddr, &e->rt_info.saddr))
+			return ip6_route_me_harder(e->skb);
+	}
 	return 0;
 }
 
@@ -652,11 +676,6 @@ ipq_get_info(char *buffer, char **start, off_t offset, int length)
 	return len;
 }
 
-static struct nf_queue_handler nfqh = {
-	.name	= "ip6_queue",
-	.outfn	= &ipq_enqueue_packet,
-};
-
 static int
 init_or_cleanup(int init)
 {
@@ -667,8 +686,7 @@ init_or_cleanup(int init)
 		goto cleanup;
 
 	netlink_register_notifier(&ipq_nl_notifier);
-	ipqnl = netlink_kernel_create(NETLINK_IP6_FW, 0, ipq_rcv_sk,
-	                              THIS_MODULE);
+	ipqnl = netlink_kernel_create(NETLINK_IP6_FW, ipq_rcv_sk);
 	if (ipqnl == NULL) {
 		printk(KERN_ERR "ip6_queue: failed to create netlink socket\n");
 		goto cleanup_netlink_notifier;
@@ -685,7 +703,7 @@ init_or_cleanup(int init)
 	register_netdevice_notifier(&ipq_dev_notifier);
 	ipq_sysctl_header = register_sysctl_table(ipq_root_table, 0);
 	
-	status = nf_register_queue_handler(PF_INET6, &nfqh);
+	status = nf_register_queue_handler(PF_INET6, ipq_enqueue_packet, NULL);
 	if (status < 0) {
 		printk(KERN_ERR "ip6_queue: failed to register queue handler\n");
 		goto cleanup_sysctl;
@@ -693,7 +711,7 @@ init_or_cleanup(int init)
 	return status;
 
 cleanup:
-	nf_unregister_queue_handlers(&nfqh);
+	nf_unregister_queue_handler(PF_INET6);
 	synchronize_net();
 	ipq_flush(NF_DROP);
 	
diff --git a/trunk/net/ipv6/netfilter/ip6_tables.c b/trunk/net/ipv6/netfilter/ip6_tables.c
index 1cb8adb2787f..73034511c8db 100644
--- a/trunk/net/ipv6/netfilter/ip6_tables.c
+++ b/trunk/net/ipv6/netfilter/ip6_tables.c
@@ -401,6 +401,7 @@ ip6t_do_table(struct sk_buff **pskb,
 	do {
 		IP_NF_ASSERT(e);
 		IP_NF_ASSERT(back);
+		(*pskb)->nfcache |= e->nfcache;
 		if (ip6_packet_match(*pskb, indev, outdev, &e->ipv6,
 			&protoff, &offset)) {
 			struct ip6t_entry_target *t;
@@ -433,8 +434,8 @@ ip6t_do_table(struct sk_buff **pskb,
 							 back->comefrom);
 					continue;
 				}
-				if (table_base + v != (void *)e + e->next_offset
-				    && !(e->ipv6.flags & IP6T_F_GOTO)) {
+				if (table_base + v
+				    != (void *)e + e->next_offset) {
 					/* Save old back ptr in next entry */
 					struct ip6t_entry *next
 						= (void *)e + e->next_offset;
diff --git a/trunk/net/ipv6/netfilter/ip6t_HL.c b/trunk/net/ipv6/netfilter/ip6t_HL.c
deleted file mode 100644
index 8f5549b72720..000000000000
--- a/trunk/net/ipv6/netfilter/ip6t_HL.c
+++ /dev/null
@@ -1,118 +0,0 @@
-/* 
- * Hop Limit modification target for ip6tables
- * Maciej Soltysiak <solt@dns.toxicfilms.tv>
- * Based on HW's TTL module
- *
- * This software is distributed under the terms of GNU GPL
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ip.h>
-
-#include <linux/netfilter_ipv6/ip6_tables.h>
-#include <linux/netfilter_ipv6/ip6t_HL.h>
-
-MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
-MODULE_DESCRIPTION("IP tables Hop Limit modification module");
-MODULE_LICENSE("GPL");
-
-static unsigned int ip6t_hl_target(struct sk_buff **pskb, 
-				   const struct net_device *in,
-				   const struct net_device *out,
-				   unsigned int hooknum,
-				   const void *targinfo, void *userinfo)
-{
-	struct ipv6hdr *ip6h;
-	const struct ip6t_HL_info *info = targinfo;
-	u_int16_t diffs[2];
-	int new_hl;
-
-	if (!skb_make_writable(pskb, (*pskb)->len))
-		return NF_DROP;
-
-	ip6h = (*pskb)->nh.ipv6h;
-
-	switch (info->mode) {
-		case IP6T_HL_SET:
-			new_hl = info->hop_limit;
-			break;
-		case IP6T_HL_INC:
-			new_hl = ip6h->hop_limit + info->hop_limit;
-			if (new_hl > 255)
-				new_hl = 255;
-			break;
-		case IP6T_HL_DEC:
-			new_hl = ip6h->hop_limit - info->hop_limit;
-			if (new_hl < 0)
-				new_hl = 0;
-			break;
-		default:
-			new_hl = ip6h->hop_limit;
-			break;
-	}
-
-	if (new_hl != ip6h->hop_limit) {
-		diffs[0] = htons(((unsigned)ip6h->hop_limit) << 8) ^ 0xFFFF;
-		ip6h->hop_limit = new_hl;
-		diffs[1] = htons(((unsigned)ip6h->hop_limit) << 8);
-	}
-
-	return IP6T_CONTINUE;
-}
-
-static int ip6t_hl_checkentry(const char *tablename,
-		const struct ip6t_entry *e,
-		void *targinfo,
-		unsigned int targinfosize,
-		unsigned int hook_mask)
-{
-	struct ip6t_HL_info *info = targinfo;
-
-	if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_HL_info))) {
-		printk(KERN_WARNING "ip6t_HL: targinfosize %u != %Zu\n",
-				targinfosize,
-				IP6T_ALIGN(sizeof(struct ip6t_HL_info)));
-		return 0;	
-	}	
-
-	if (strcmp(tablename, "mangle")) {
-		printk(KERN_WARNING "ip6t_HL: can only be called from "
-			"\"mangle\" table, not \"%s\"\n", tablename);
-		return 0;
-	}
-
-	if (info->mode > IP6T_HL_MAXMODE) {
-		printk(KERN_WARNING "ip6t_HL: invalid or unknown Mode %u\n", 
-			info->mode);
-		return 0;
-	}
-
-	if ((info->mode != IP6T_HL_SET) && (info->hop_limit == 0)) {
-		printk(KERN_WARNING "ip6t_HL: increment/decrement doesn't "
-			"make sense with value 0\n");
-		return 0;
-	}
-	
-	return 1;
-}
-
-static struct ip6t_target ip6t_HL = { 
-	.name 		= "HL", 
-	.target		= ip6t_hl_target, 
-	.checkentry	= ip6t_hl_checkentry, 
-	.me		= THIS_MODULE
-};
-
-static int __init init(void)
-{
-	return ip6t_register_target(&ip6t_HL);
-}
-
-static void __exit fini(void)
-{
-	ip6t_unregister_target(&ip6t_HL);
-}
-
-module_init(init);
-module_exit(fini);
diff --git a/trunk/net/ipv6/netfilter/ip6t_LOG.c b/trunk/net/ipv6/netfilter/ip6t_LOG.c
index 0cd1d1bd9033..a692e26a4fa3 100644
--- a/trunk/net/ipv6/netfilter/ip6t_LOG.c
+++ b/trunk/net/ipv6/netfilter/ip6t_LOG.c
@@ -26,6 +26,10 @@ MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
 MODULE_DESCRIPTION("IP6 tables LOG target module");
 MODULE_LICENSE("GPL");
 
+static unsigned int nflog = 1;
+module_param(nflog, int, 0400);
+MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
+ 
 struct in_device;
 #include <net/route.h>
 #include <linux/netfilter_ipv6/ip6t_LOG.h>
@@ -40,7 +44,7 @@ struct in_device;
 static DEFINE_SPINLOCK(log_lock);
 
 /* One level of recursion won't kill us */
-static void dump_packet(const struct nf_loginfo *info,
+static void dump_packet(const struct ip6t_log_info *info,
 			const struct sk_buff *skb, unsigned int ip6hoff,
 			int recurse)
 {
@@ -49,12 +53,6 @@ static void dump_packet(const struct nf_loginfo *info,
 	struct ipv6hdr _ip6h, *ih;
 	unsigned int ptr;
 	unsigned int hdrlen = 0;
-	unsigned int logflags;
-
-	if (info->type == NF_LOG_TYPE_LOG)
-		logflags = info->u.log.logflags;
-	else
-		logflags = NF_LOG_MASK;
 
 	ih = skb_header_pointer(skb, ip6hoff, sizeof(_ip6h), &_ip6h);
 	if (ih == NULL) {
@@ -86,7 +84,7 @@ static void dump_packet(const struct nf_loginfo *info,
 		}
 
 		/* Max length: 48 "OPT (...) " */
-		if (logflags & IP6T_LOG_IPOPT)
+		if (info->logflags & IP6T_LOG_IPOPT)
 			printk("OPT ( ");
 
 		switch (currenthdr) {
@@ -121,7 +119,7 @@ static void dump_packet(const struct nf_loginfo *info,
 		case IPPROTO_ROUTING:
 		case IPPROTO_HOPOPTS:
 			if (fragment) {
-				if (logflags & IP6T_LOG_IPOPT)
+				if (info->logflags & IP6T_LOG_IPOPT)
 					printk(")");
 				return;
 			}
@@ -129,7 +127,7 @@ static void dump_packet(const struct nf_loginfo *info,
 			break;
 		/* Max Length */
 		case IPPROTO_AH:
-			if (logflags & IP6T_LOG_IPOPT) {
+			if (info->logflags & IP6T_LOG_IPOPT) {
 				struct ip_auth_hdr _ahdr, *ah;
 
 				/* Max length: 3 "AH " */
@@ -160,7 +158,7 @@ static void dump_packet(const struct nf_loginfo *info,
 			hdrlen = (hp->hdrlen+2)<<2;
 			break;
 		case IPPROTO_ESP:
-			if (logflags & IP6T_LOG_IPOPT) {
+			if (info->logflags & IP6T_LOG_IPOPT) {
 				struct ip_esp_hdr _esph, *eh;
 
 				/* Max length: 4 "ESP " */
@@ -192,7 +190,7 @@ static void dump_packet(const struct nf_loginfo *info,
 			printk("Unknown Ext Hdr %u", currenthdr);
 			return;
 		}
-		if (logflags & IP6T_LOG_IPOPT)
+		if (info->logflags & IP6T_LOG_IPOPT)
 			printk(") ");
 
 		currenthdr = hp->nexthdr;
@@ -220,7 +218,7 @@ static void dump_packet(const struct nf_loginfo *info,
 		printk("SPT=%u DPT=%u ",
 		       ntohs(th->source), ntohs(th->dest));
 		/* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
-		if (logflags & IP6T_LOG_TCPSEQ)
+		if (info->logflags & IP6T_LOG_TCPSEQ)
 			printk("SEQ=%u ACK=%u ",
 			       ntohl(th->seq), ntohl(th->ack_seq));
 		/* Max length: 13 "WINDOW=65535 " */
@@ -247,7 +245,7 @@ static void dump_packet(const struct nf_loginfo *info,
 		/* Max length: 11 "URGP=65535 " */
 		printk("URGP=%u ", ntohs(th->urg_ptr));
 
-		if ((logflags & IP6T_LOG_TCPOPT)
+		if ((info->logflags & IP6T_LOG_TCPOPT)
 		    && th->doff * 4 > sizeof(struct tcphdr)) {
 			u_int8_t _opt[60 - sizeof(struct tcphdr)], *op;
 			unsigned int i;
@@ -351,7 +349,7 @@ static void dump_packet(const struct nf_loginfo *info,
 	}
 
 	/* Max length: 15 "UID=4294967295 " */
-	if ((logflags & IP6T_LOG_UID) && recurse && skb->sk) {
+	if ((info->logflags & IP6T_LOG_UID) && recurse && skb->sk) {
 		read_lock_bh(&skb->sk->sk_callback_lock);
 		if (skb->sk->sk_socket && skb->sk->sk_socket->file)
 			printk("UID=%u ", skb->sk->sk_socket->file->f_uid);
@@ -359,31 +357,19 @@ static void dump_packet(const struct nf_loginfo *info,
 	}
 }
 
-static struct nf_loginfo default_loginfo = {
-	.type	= NF_LOG_TYPE_LOG,
-	.u = {
-		.log = {
-			.level	  = 0,
-			.logflags = NF_LOG_MASK,
-		},
-	},
-};
-
 static void
-ip6t_log_packet(unsigned int pf,
-		unsigned int hooknum,
+ip6t_log_packet(unsigned int hooknum,
 		const struct sk_buff *skb,
 		const struct net_device *in,
 		const struct net_device *out,
-		const struct nf_loginfo *loginfo,
+		const struct ip6t_log_info *loginfo,
+		const char *level_string,
 		const char *prefix)
 {
-	if (!loginfo)
-		loginfo = &default_loginfo;
-
 	spin_lock_bh(&log_lock);
-	printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level, 
-		prefix,
+	printk(level_string);
+	printk("%sIN=%s OUT=%s ",
+		prefix == NULL ? loginfo->prefix : prefix,
 		in ? in->name : "",
 		out ? out->name : "");
 	if (in && !out) {
@@ -430,17 +416,29 @@ ip6t_log_target(struct sk_buff **pskb,
 		void *userinfo)
 {
 	const struct ip6t_log_info *loginfo = targinfo;
-	struct nf_loginfo li;
-
-	li.type = NF_LOG_TYPE_LOG;
-	li.u.log.level = loginfo->level;
-	li.u.log.logflags = loginfo->logflags;
+	char level_string[4] = "< >";
 
-	nf_log_packet(PF_INET6, hooknum, *pskb, in, out, &li, loginfo->prefix);
+	level_string[1] = '0' + (loginfo->level % 8);
+	ip6t_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
 
 	return IP6T_CONTINUE;
 }
 
+static void
+ip6t_logfn(unsigned int hooknum,
+	   const struct sk_buff *skb,
+	   const struct net_device *in,
+	   const struct net_device *out,
+	   const char *prefix)
+{
+	struct ip6t_log_info loginfo = {
+		.level = 0,
+		.logflags = IP6T_LOG_MASK,
+		.prefix = ""
+	};
+
+	ip6t_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
+}
 
 static int ip6t_log_checkentry(const char *tablename,
 			       const struct ip6t_entry *e,
@@ -477,29 +475,20 @@ static struct ip6t_target ip6t_log_reg = {
 	.me 		= THIS_MODULE,
 };
 
-static struct nf_logger ip6t_logger = {
-	.name		= "ip6t_LOG",
-	.logfn		= &ip6t_log_packet,
-	.me		= THIS_MODULE,
-};
-
 static int __init init(void)
 {
 	if (ip6t_register_target(&ip6t_log_reg))
 		return -EINVAL;
-	if (nf_log_register(PF_INET6, &ip6t_logger) < 0) {
-		printk(KERN_WARNING "ip6t_LOG: not logging via system console "
-		       "since somebody else already registered for PF_INET6\n");
-		/* we cannot make module load fail here, since otherwise
-		 * ip6tables userspace would abort */
-	}
+	if (nflog)
+		nf_log_register(PF_INET6, &ip6t_logfn);
 
 	return 0;
 }
 
 static void __exit fini(void)
 {
-	nf_log_unregister_logger(&ip6t_logger);
+	if (nflog)
+		nf_log_unregister(PF_INET6, &ip6t_logfn);
 	ip6t_unregister_target(&ip6t_log_reg);
 }
 
diff --git a/trunk/net/ipv6/netfilter/ip6t_MARK.c b/trunk/net/ipv6/netfilter/ip6t_MARK.c
index 81924fcc5857..d09ceb05013a 100644
--- a/trunk/net/ipv6/netfilter/ip6t_MARK.c
+++ b/trunk/net/ipv6/netfilter/ip6t_MARK.c
@@ -28,9 +28,10 @@ target(struct sk_buff **pskb,
 {
 	const struct ip6t_mark_target_info *markinfo = targinfo;
 
-	if((*pskb)->nfmark != markinfo->mark)
+	if((*pskb)->nfmark != markinfo->mark) {
 		(*pskb)->nfmark = markinfo->mark;
-
+		(*pskb)->nfcache |= NFC_ALTERED;
+	}
 	return IP6T_CONTINUE;
 }
 
diff --git a/trunk/net/ipv6/netfilter/ip6t_NFQUEUE.c b/trunk/net/ipv6/netfilter/ip6t_NFQUEUE.c
deleted file mode 100644
index c6e3730e7409..000000000000
--- a/trunk/net/ipv6/netfilter/ip6t_NFQUEUE.c
+++ /dev/null
@@ -1,70 +0,0 @@
-/* ip6tables module for using new netfilter netlink queue
- *
- * (C) 2005 by Harald Welte <laforge@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as 
- * published by the Free Software Foundation.
- * 
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
-#include <linux/netfilter_ipv4/ipt_NFQUEUE.h>
-
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("ip6tables NFQUEUE target");
-MODULE_LICENSE("GPL");
-
-static unsigned int
-target(struct sk_buff **pskb,
-       const struct net_device *in,
-       const struct net_device *out,
-       unsigned int hooknum,
-       const void *targinfo,
-       void *userinfo)
-{
-	const struct ipt_NFQ_info *tinfo = targinfo;
-
-	return NF_QUEUE_NR(tinfo->queuenum);
-}
-
-static int
-checkentry(const char *tablename,
-	   const struct ip6t_entry *e,
-           void *targinfo,
-           unsigned int targinfosize,
-           unsigned int hook_mask)
-{
-	if (targinfosize != IP6T_ALIGN(sizeof(struct ipt_NFQ_info))) {
-		printk(KERN_WARNING "NFQUEUE: targinfosize %u != %Zu\n",
-		       targinfosize,
-		       IP6T_ALIGN(sizeof(struct ipt_NFQ_info)));
-		return 0;
-	}
-
-	return 1;
-}
-
-static struct ip6t_target ipt_NFQ_reg = {
-	.name		= "NFQUEUE",
-	.target		= target,
-	.checkentry	= checkentry,
-	.me		= THIS_MODULE,
-};
-
-static int __init init(void)
-{
-	return ip6t_register_target(&ipt_NFQ_reg);
-}
-
-static void __exit fini(void)
-{
-	ip6t_unregister_target(&ipt_NFQ_reg);
-}
-
-module_init(init);
-module_exit(fini);
diff --git a/trunk/net/ipv6/netfilter/ip6t_REJECT.c b/trunk/net/ipv6/netfilter/ip6t_REJECT.c
deleted file mode 100644
index 14316c3ebde4..000000000000
--- a/trunk/net/ipv6/netfilter/ip6t_REJECT.c
+++ /dev/null
@@ -1,284 +0,0 @@
-/*
- * IP6 tables REJECT target module
- * Linux INET6 implementation
- *
- * Copyright (C)2003 USAGI/WIDE Project
- *
- * Authors:
- *	Yasuyuki Kozakai	<yasuyuki.kozakai@toshiba.co.jp>
- *
- * Based on net/ipv4/netfilter/ipt_REJECT.c
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/icmpv6.h>
-#include <linux/netdevice.h>
-#include <net/ipv6.h>
-#include <net/tcp.h>
-#include <net/icmp.h>
-#include <net/ip6_checksum.h>
-#include <net/ip6_fib.h>
-#include <net/ip6_route.h>
-#include <net/flow.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
-#include <linux/netfilter_ipv6/ip6t_REJECT.h>
-
-MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
-MODULE_DESCRIPTION("IP6 tables REJECT target module");
-MODULE_LICENSE("GPL");
-
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
-/* Send RST reply */
-static void send_reset(struct sk_buff *oldskb)
-{
-	struct sk_buff *nskb;
-	struct tcphdr otcph, *tcph;
-	unsigned int otcplen, hh_len;
-	int tcphoff, needs_ack;
-	struct ipv6hdr *oip6h = oldskb->nh.ipv6h, *ip6h;
-	struct dst_entry *dst = NULL;
-	u8 proto;
-	struct flowi fl;
-
-	if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
-	    (!(ipv6_addr_type(&oip6h->daddr) & IPV6_ADDR_UNICAST))) {
-		DEBUGP("ip6t_REJECT: addr is not unicast.\n");
-		return;
-	}
-
-	proto = oip6h->nexthdr;
-	tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), &proto);
-
-	if ((tcphoff < 0) || (tcphoff > oldskb->len)) {
-		DEBUGP("ip6t_REJECT: Can't get TCP header.\n");
-		return;
-	}
-
-	otcplen = oldskb->len - tcphoff;
-
-	/* IP header checks: fragment, too short. */
-	if ((proto != IPPROTO_TCP) || (otcplen < sizeof(struct tcphdr))) {
-		DEBUGP("ip6t_REJECT: proto(%d) != IPPROTO_TCP, or too short. otcplen = %d\n",
-			proto, otcplen);
-		return;
-	}
-
-	if (skb_copy_bits(oldskb, tcphoff, &otcph, sizeof(struct tcphdr)))
-		BUG();
-
-	/* No RST for RST. */
-	if (otcph.rst) {
-		DEBUGP("ip6t_REJECT: RST is set\n");
-		return;
-	}
-
-	/* Check checksum. */
-	if (csum_ipv6_magic(&oip6h->saddr, &oip6h->daddr, otcplen, IPPROTO_TCP,
-			    skb_checksum(oldskb, tcphoff, otcplen, 0))) {
-		DEBUGP("ip6t_REJECT: TCP checksum is invalid\n");
-		return;
-	}
-
-	memset(&fl, 0, sizeof(fl));
-	fl.proto = IPPROTO_TCP;
-	ipv6_addr_copy(&fl.fl6_src, &oip6h->daddr);
-	ipv6_addr_copy(&fl.fl6_dst, &oip6h->saddr);
-	fl.fl_ip_sport = otcph.dest;
-	fl.fl_ip_dport = otcph.source;
-	dst = ip6_route_output(NULL, &fl);
-	if (dst == NULL)
-		return;
-	if (dst->error ||
-	    xfrm_lookup(&dst, &fl, NULL, 0)) {
-		dst_release(dst);
-		return;
-	}
-
-	hh_len = (dst->dev->hard_header_len + 15)&~15;
-	nskb = alloc_skb(hh_len + 15 + dst->header_len + sizeof(struct ipv6hdr)
-			 + sizeof(struct tcphdr) + dst->trailer_len,
-			 GFP_ATOMIC);
-
-	if (!nskb) {
-		if (net_ratelimit())
-			printk("ip6t_REJECT: Can't alloc skb\n");
-		dst_release(dst);
-		return;
-	}
-
-	nskb->dst = dst;
-
-	skb_reserve(nskb, hh_len + dst->header_len);
-
-	ip6h = nskb->nh.ipv6h = (struct ipv6hdr *)
-					skb_put(nskb, sizeof(struct ipv6hdr));
-	ip6h->version = 6;
-	ip6h->hop_limit = dst_metric(dst, RTAX_HOPLIMIT);
-	ip6h->nexthdr = IPPROTO_TCP;
-	ip6h->payload_len = htons(sizeof(struct tcphdr));
-	ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr);
-	ipv6_addr_copy(&ip6h->daddr, &oip6h->saddr);
-
-	tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
-	/* Truncate to length (no data) */
-	tcph->doff = sizeof(struct tcphdr)/4;
-	tcph->source = otcph.dest;
-	tcph->dest = otcph.source;
-
-	if (otcph.ack) {
-		needs_ack = 0;
-		tcph->seq = otcph.ack_seq;
-		tcph->ack_seq = 0;
-	} else {
-		needs_ack = 1;
-		tcph->ack_seq = htonl(ntohl(otcph.seq) + otcph.syn + otcph.fin
-				      + otcplen - (otcph.doff<<2));
-		tcph->seq = 0;
-	}
-
-	/* Reset flags */
-	((u_int8_t *)tcph)[13] = 0;
-	tcph->rst = 1;
-	tcph->ack = needs_ack;
-	tcph->window = 0;
-	tcph->urg_ptr = 0;
-	tcph->check = 0;
-
-	/* Adjust TCP checksum */
-	tcph->check = csum_ipv6_magic(&nskb->nh.ipv6h->saddr,
-				      &nskb->nh.ipv6h->daddr,
-				      sizeof(struct tcphdr), IPPROTO_TCP,
-				      csum_partial((char *)tcph,
-						   sizeof(struct tcphdr), 0));
-
-	NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, nskb, NULL, nskb->dst->dev,
-		dst_output);
-}
-
-static inline void
-send_unreach(struct sk_buff *skb_in, unsigned char code, unsigned int hooknum)
-{
-	if (hooknum == NF_IP6_LOCAL_OUT && skb_in->dev == NULL)
-		skb_in->dev = &loopback_dev;
-
-	icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0, NULL);
-}
-
-static unsigned int reject6_target(struct sk_buff **pskb,
-			   const struct net_device *in,
-			   const struct net_device *out,
-			   unsigned int hooknum,
-			   const void *targinfo,
-			   void *userinfo)
-{
-	const struct ip6t_reject_info *reject = targinfo;
-
-	DEBUGP(KERN_DEBUG "%s: medium point\n", __FUNCTION__);
-	/* WARNING: This code causes reentry within ip6tables.
-	   This means that the ip6tables jump stack is now crap.  We
-	   must return an absolute verdict. --RR */
-    	switch (reject->with) {
-    	case IP6T_ICMP6_NO_ROUTE:
-    		send_unreach(*pskb, ICMPV6_NOROUTE, hooknum);
-    		break;
-    	case IP6T_ICMP6_ADM_PROHIBITED:
-    		send_unreach(*pskb, ICMPV6_ADM_PROHIBITED, hooknum);
-    		break;
-    	case IP6T_ICMP6_NOT_NEIGHBOUR:
-    		send_unreach(*pskb, ICMPV6_NOT_NEIGHBOUR, hooknum);
-    		break;
-    	case IP6T_ICMP6_ADDR_UNREACH:
-    		send_unreach(*pskb, ICMPV6_ADDR_UNREACH, hooknum);
-    		break;
-    	case IP6T_ICMP6_PORT_UNREACH:
-    		send_unreach(*pskb, ICMPV6_PORT_UNREACH, hooknum);
-    		break;
-    	case IP6T_ICMP6_ECHOREPLY:
-		/* Do nothing */
-		break;
-	case IP6T_TCP_RESET:
-		send_reset(*pskb);
-		break;
-	default:
-		if (net_ratelimit())
-			printk(KERN_WARNING "ip6t_REJECT: case %u not handled yet\n", reject->with);
-		break;
-	}
-
-	return NF_DROP;
-}
-
-static int check(const char *tablename,
-		 const struct ip6t_entry *e,
-		 void *targinfo,
-		 unsigned int targinfosize,
-		 unsigned int hook_mask)
-{
- 	const struct ip6t_reject_info *rejinfo = targinfo;
-
- 	if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_reject_info))) {
-  		DEBUGP("ip6t_REJECT: targinfosize %u != 0\n", targinfosize);
-  		return 0;
-  	}
-
-	/* Only allow these for packet filtering. */
-	if (strcmp(tablename, "filter") != 0) {
-		DEBUGP("ip6t_REJECT: bad table `%s'.\n", tablename);
-		return 0;
-	}
-
-	if ((hook_mask & ~((1 << NF_IP6_LOCAL_IN)
-			   | (1 << NF_IP6_FORWARD)
-			   | (1 << NF_IP6_LOCAL_OUT))) != 0) {
-		DEBUGP("ip6t_REJECT: bad hook mask %X\n", hook_mask);
-		return 0;
-	}
-
-	if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
-		printk("ip6t_REJECT: ECHOREPLY is not supported.\n");
-		return 0;
-	} else if (rejinfo->with == IP6T_TCP_RESET) {
-		/* Must specify that it's a TCP packet */
-		if (e->ipv6.proto != IPPROTO_TCP
-		    || (e->ipv6.invflags & IP6T_INV_PROTO)) {
-			DEBUGP("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
-			return 0;
-		}
-	}
-
-	return 1;
-}
-
-static struct ip6t_target ip6t_reject_reg = {
-	.name		= "REJECT",
-	.target		= reject6_target,
-	.checkentry	= check,
-	.me		= THIS_MODULE
-};
-
-static int __init init(void)
-{
-	if (ip6t_register_target(&ip6t_reject_reg))
-		return -EINVAL;
-	return 0;
-}
-
-static void __exit fini(void)
-{
-	ip6t_unregister_target(&ip6t_reject_reg);
-}
-
-module_init(init);
-module_exit(fini);
diff --git a/trunk/net/ipv6/netfilter/ip6t_owner.c b/trunk/net/ipv6/netfilter/ip6t_owner.c
index 9b91decbfddb..ab0e32d3de46 100644
--- a/trunk/net/ipv6/netfilter/ip6t_owner.c
+++ b/trunk/net/ipv6/netfilter/ip6t_owner.c
@@ -20,6 +20,71 @@ MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
 MODULE_DESCRIPTION("IP6 tables owner matching module");
 MODULE_LICENSE("GPL");
 
+static int
+match_pid(const struct sk_buff *skb, pid_t pid)
+{
+	struct task_struct *p;
+	struct files_struct *files;
+	int i;
+
+	read_lock(&tasklist_lock);
+	p = find_task_by_pid(pid);
+	if (!p)
+		goto out;
+	task_lock(p);
+	files = p->files;
+	if(files) {
+		spin_lock(&files->file_lock);
+		for (i=0; i < files->max_fds; i++) {
+			if (fcheck_files(files, i) == skb->sk->sk_socket->file) {
+				spin_unlock(&files->file_lock);
+				task_unlock(p);
+				read_unlock(&tasklist_lock);
+				return 1;
+			}
+		}
+		spin_unlock(&files->file_lock);
+	}
+	task_unlock(p);
+out:
+	read_unlock(&tasklist_lock);
+	return 0;
+}
+
+static int
+match_sid(const struct sk_buff *skb, pid_t sid)
+{
+	struct task_struct *g, *p;
+	struct file *file = skb->sk->sk_socket->file;
+	int i, found=0;
+
+	read_lock(&tasklist_lock);
+	do_each_thread(g, p) {
+		struct files_struct *files;
+		if (p->signal->session != sid)
+			continue;
+
+		task_lock(p);
+		files = p->files;
+		if (files) {
+			spin_lock(&files->file_lock);
+			for (i=0; i < files->max_fds; i++) {
+				if (fcheck_files(files, i) == file) {
+					found = 1;
+					break;
+				}
+			}
+			spin_unlock(&files->file_lock);
+		}
+		task_unlock(p);
+		if (found)
+			goto out;
+	} while_each_thread(g, p);
+out:
+	read_unlock(&tasklist_lock);
+
+	return found;
+}
 
 static int
 match(const struct sk_buff *skb,
@@ -47,6 +112,18 @@ match(const struct sk_buff *skb,
 			return 0;
 	}
 
+	if(info->match & IP6T_OWNER_PID) {
+		if (!match_pid(skb, info->pid) ^
+		    !!(info->invert & IP6T_OWNER_PID))
+			return 0;
+	}
+
+	if(info->match & IP6T_OWNER_SID) {
+		if (!match_sid(skb, info->sid) ^
+		    !!(info->invert & IP6T_OWNER_SID))
+			return 0;
+	}
+
 	return 1;
 }
 
@@ -57,8 +134,6 @@ checkentry(const char *tablename,
            unsigned int matchsize,
            unsigned int hook_mask)
 {
-	const struct ip6t_owner_info *info = matchinfo;
-
         if (hook_mask
             & ~((1 << NF_IP6_LOCAL_OUT) | (1 << NF_IP6_POST_ROUTING))) {
                 printk("ip6t_owner: only valid for LOCAL_OUT or POST_ROUTING.\n");
@@ -67,13 +142,14 @@ checkentry(const char *tablename,
 
 	if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_owner_info)))
 		return 0;
-
-	if (info->match & (IP6T_OWNER_PID|IP6T_OWNER_SID)) {
-		printk("ipt_owner: pid and sid matching "
-		       "not supported anymore\n");
+#ifdef CONFIG_SMP
+	/* files->file_lock can not be used in a BH */
+	if (((struct ip6t_owner_info *)matchinfo)->match
+	    & (IP6T_OWNER_PID|IP6T_OWNER_SID)) {
+		printk("ip6t_owner: pid and sid matching is broken on SMP.\n");
 		return 0;
 	}
-
+#endif
 	return 1;
 }
 
diff --git a/trunk/net/ipv6/raw.c b/trunk/net/ipv6/raw.c
index 7a5863298f3f..1d4d75b34d32 100644
--- a/trunk/net/ipv6/raw.c
+++ b/trunk/net/ipv6/raw.c
@@ -49,7 +49,6 @@
 #include <net/transp_v6.h>
 #include <net/udp.h>
 #include <net/inet_common.h>
-#include <net/tcp_states.h>
 
 #include <net/rawv6.h>
 #include <net/xfrm.h>
@@ -82,8 +81,7 @@ static void raw_v6_unhash(struct sock *sk)
 
 /* Grumble... icmp and ip_input want to get at this... */
 struct sock *__raw_v6_lookup(struct sock *sk, unsigned short num,
-			     struct in6_addr *loc_addr, struct in6_addr *rmt_addr,
-			     int dif)
+			     struct in6_addr *loc_addr, struct in6_addr *rmt_addr)
 {
 	struct hlist_node *node;
 	int is_multicast = ipv6_addr_is_multicast(loc_addr);
@@ -96,9 +94,6 @@ struct sock *__raw_v6_lookup(struct sock *sk, unsigned short num,
 			    !ipv6_addr_equal(&np->daddr, rmt_addr))
 				continue;
 
-			if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
-				continue;
-
 			if (!ipv6_addr_any(&np->rcv_saddr)) {
 				if (ipv6_addr_equal(&np->rcv_saddr, loc_addr))
 					goto found;
@@ -142,12 +137,11 @@ static __inline__ int icmpv6_filter(struct sock *sk, struct sk_buff *skb)
  *
  *	Caller owns SKB so we must make clones.
  */
-int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
+void ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
 {
 	struct in6_addr *saddr;
 	struct in6_addr *daddr;
 	struct sock *sk;
-	int delivered = 0;
 	__u8 hash;
 
 	saddr = &skb->nh.ipv6h->saddr;
@@ -166,10 +160,9 @@ int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
 	if (sk == NULL)
 		goto out;
 
-	sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr, skb->dev->ifindex);
+	sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr);
 
 	while (sk) {
-		delivered = 1;
 		if (nexthdr != IPPROTO_ICMPV6 || !icmpv6_filter(sk, skb)) {
 			struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
 
@@ -177,12 +170,10 @@ int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
 			if (clone)
 				rawv6_rcv(sk, clone);
 		}
-		sk = __raw_v6_lookup(sk_next(sk), nexthdr, daddr, saddr,
-				     skb->dev->ifindex);
+		sk = __raw_v6_lookup(sk_next(sk), nexthdr, daddr, saddr);
 	}
 out:
 	read_unlock(&raw_v6_lock);
-	return delivered;
 }
 
 /* This cleans up af_inet6 a bit. -DaveM */
@@ -343,7 +334,8 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
 			if (csum_ipv6_magic(&skb->nh.ipv6h->saddr,
 					    &skb->nh.ipv6h->daddr,
 					    skb->len, inet->num, skb->csum)) {
-				LIMIT_NETDEBUG(KERN_DEBUG "raw v6 hw csum failure.\n");
+				LIMIT_NETDEBUG(
+			        printk(KERN_DEBUG "raw v6 hw csum failure.\n"));
 				skb->ip_summed = CHECKSUM_NONE;
 			}
 		}
diff --git a/trunk/net/ipv6/reassembly.c b/trunk/net/ipv6/reassembly.c
index 9d9e04344c77..59e7c6317872 100644
--- a/trunk/net/ipv6/reassembly.c
+++ b/trunk/net/ipv6/reassembly.c
@@ -562,7 +562,7 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
 	if (skb->dev)
 		fq->iif = skb->dev->ifindex;
 	skb->dev = NULL;
-	skb_get_timestamp(skb, &fq->stamp);
+	fq->stamp = skb->stamp;
 	fq->meat += skb->len;
 	atomic_add(skb->truesize, &ip6_frag_mem);
 
@@ -664,7 +664,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
 
 	head->next = NULL;
 	head->dev = dev;
-	skb_set_timestamp(head, &fq->stamp);
+	head->stamp = fq->stamp;
 	head->nh.ipv6h->payload_len = htons(payload_len);
 
 	*skb_in = head;
diff --git a/trunk/net/ipv6/route.c b/trunk/net/ipv6/route.c
index 5d5bbb49ec78..878789b3122d 100644
--- a/trunk/net/ipv6/route.c
+++ b/trunk/net/ipv6/route.c
@@ -1372,7 +1372,7 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
  *	Drop the packet on the floor
  */
 
-static int ip6_pkt_discard(struct sk_buff *skb)
+int ip6_pkt_discard(struct sk_buff *skb)
 {
 	IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
 	icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, skb->dev);
@@ -1380,7 +1380,7 @@ static int ip6_pkt_discard(struct sk_buff *skb)
 	return 0;
 }
 
-static int ip6_pkt_discard_out(struct sk_buff *skb)
+int ip6_pkt_discard_out(struct sk_buff *skb)
 {
 	skb->dev = skb->dst->dev;
 	return ip6_pkt_discard(skb);
@@ -1850,16 +1850,16 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nlmsghdr *nlh,
 	
 	skb = alloc_skb(size, gfp_any());
 	if (!skb) {
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV6_ROUTE, ENOBUFS);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV6_ROUTE, ENOBUFS);
 		return;
 	}
 	if (rt6_fill_node(skb, rt, NULL, NULL, 0, event, pid, seq, 0, 0) < 0) {
 		kfree_skb(skb);
-		netlink_set_err(rtnl, 0, RTNLGRP_IPV6_ROUTE, EINVAL);
+		netlink_set_err(rtnl, 0, RTMGRP_IPV6_ROUTE, EINVAL);
 		return;
 	}
-	NETLINK_CB(skb).dst_group = RTNLGRP_IPV6_ROUTE;
-	netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_ROUTE, gfp_any());
+	NETLINK_CB(skb).dst_groups = RTMGRP_IPV6_ROUTE;
+	netlink_broadcast(rtnl, skb, 0, RTMGRP_IPV6_ROUTE, gfp_any());
 }
 
 /*
@@ -1960,6 +1960,8 @@ static int rt6_proc_info(char *buffer, char **start, off_t offset, int length)
 	return arg.len;
 }
 
+extern struct rt6_statistics rt6_stats;
+
 static int rt6_stats_seq_show(struct seq_file *seq, void *v)
 {
 	seq_printf(seq, "%04x %04x %04x %04x %04x %04x %04x\n",
diff --git a/trunk/net/ipv6/sit.c b/trunk/net/ipv6/sit.c
index c3123c9e1a8e..e553e5b80d6e 100644
--- a/trunk/net/ipv6/sit.c
+++ b/trunk/net/ipv6/sit.c
@@ -770,7 +770,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
 	return 0;
 }
 
-static int __init ipip6_fb_tunnel_init(struct net_device *dev)
+int __init ipip6_fb_tunnel_init(struct net_device *dev)
 {
 	struct ip_tunnel *tunnel = dev->priv;
 	struct iphdr *iph = &tunnel->parms.iph;
diff --git a/trunk/net/ipv6/sysctl_net_ipv6.c b/trunk/net/ipv6/sysctl_net_ipv6.c
index 8eff9fa1e983..3a18e0e6ffed 100644
--- a/trunk/net/ipv6/sysctl_net_ipv6.c
+++ b/trunk/net/ipv6/sysctl_net_ipv6.c
@@ -14,6 +14,9 @@
 #include <net/ipv6.h>
 #include <net/addrconf.h>
 
+extern ctl_table ipv6_route_table[];
+extern ctl_table ipv6_icmp_table[];
+
 #ifdef CONFIG_SYSCTL
 
 static ctl_table ipv6_table[] = {
diff --git a/trunk/net/ipv6/tcp_ipv6.c b/trunk/net/ipv6/tcp_ipv6.c
index 794734f1d230..ef29cfd936d3 100644
--- a/trunk/net/ipv6/tcp_ipv6.c
+++ b/trunk/net/ipv6/tcp_ipv6.c
@@ -47,7 +47,6 @@
 
 #include <net/tcp.h>
 #include <net/ndisc.h>
-#include <net/inet6_hashtables.h>
 #include <net/ipv6.h>
 #include <net/transp_v6.h>
 #include <net/addrconf.h>
@@ -76,11 +75,34 @@ static int	tcp_v6_xmit(struct sk_buff *skb, int ipfragok);
 static struct tcp_func ipv6_mapped;
 static struct tcp_func ipv6_specific;
 
-static inline int tcp_v6_bind_conflict(const struct sock *sk,
-				       const struct inet_bind_bucket *tb)
+/* I have no idea if this is a good hash for v6 or not. -DaveM */
+static __inline__ int tcp_v6_hashfn(struct in6_addr *laddr, u16 lport,
+				    struct in6_addr *faddr, u16 fport)
 {
-	const struct sock *sk2;
-	const struct hlist_node *node;
+	int hashent = (lport ^ fport);
+
+	hashent ^= (laddr->s6_addr32[3] ^ faddr->s6_addr32[3]);
+	hashent ^= hashent>>16;
+	hashent ^= hashent>>8;
+	return (hashent & (tcp_ehash_size - 1));
+}
+
+static __inline__ int tcp_v6_sk_hashfn(struct sock *sk)
+{
+	struct inet_sock *inet = inet_sk(sk);
+	struct ipv6_pinfo *np = inet6_sk(sk);
+	struct in6_addr *laddr = &np->rcv_saddr;
+	struct in6_addr *faddr = &np->daddr;
+	__u16 lport = inet->num;
+	__u16 fport = inet->dport;
+	return tcp_v6_hashfn(laddr, lport, faddr, fport);
+}
+
+static inline int tcp_v6_bind_conflict(struct sock *sk,
+				       struct tcp_bind_bucket *tb)
+{
+	struct sock *sk2;
+	struct hlist_node *node;
 
 	/* We must walk the whole port owner list in this case. -DaveM */
 	sk_for_each_bound(sk2, node, &tb->owners) {
@@ -104,8 +126,8 @@ static inline int tcp_v6_bind_conflict(const struct sock *sk,
  */
 static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
 {
-	struct inet_bind_hashbucket *head;
-	struct inet_bind_bucket *tb;
+	struct tcp_bind_hashbucket *head;
+	struct tcp_bind_bucket *tb;
 	struct hlist_node *node;
 	int ret;
 
@@ -116,25 +138,25 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
 		int remaining = (high - low) + 1;
 		int rover;
 
-		spin_lock(&tcp_hashinfo.portalloc_lock);
-		if (tcp_hashinfo.port_rover < low)
+		spin_lock(&tcp_portalloc_lock);
+		if (tcp_port_rover < low)
 			rover = low;
 		else
-			rover = tcp_hashinfo.port_rover;
+			rover = tcp_port_rover;
 		do {	rover++;
 			if (rover > high)
 				rover = low;
-			head = &tcp_hashinfo.bhash[inet_bhashfn(rover, tcp_hashinfo.bhash_size)];
+			head = &tcp_bhash[tcp_bhashfn(rover)];
 			spin_lock(&head->lock);
-			inet_bind_bucket_for_each(tb, node, &head->chain)
+			tb_for_each(tb, node, &head->chain)
 				if (tb->port == rover)
 					goto next;
 			break;
 		next:
 			spin_unlock(&head->lock);
 		} while (--remaining > 0);
-		tcp_hashinfo.port_rover = rover;
-		spin_unlock(&tcp_hashinfo.portalloc_lock);
+		tcp_port_rover = rover;
+		spin_unlock(&tcp_portalloc_lock);
 
 		/* Exhausted local port range during search?  It is not
 		 * possible for us to be holding one of the bind hash
@@ -149,9 +171,9 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
 		/* OK, here is the one we will use. */
 		snum = rover;
 	} else {
-		head = &tcp_hashinfo.bhash[inet_bhashfn(snum, tcp_hashinfo.bhash_size)];
+		head = &tcp_bhash[tcp_bhashfn(snum)];
 		spin_lock(&head->lock);
-		inet_bind_bucket_for_each(tb, node, &head->chain)
+		tb_for_each(tb, node, &head->chain)
 			if (tb->port == snum)
 				goto tb_found;
 	}
@@ -170,11 +192,8 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
 	}
 tb_not_found:
 	ret = 1;
-	if (tb == NULL) {
-	       	tb = inet_bind_bucket_create(tcp_hashinfo.bind_bucket_cachep, head, snum);
-		if (tb == NULL)
-			goto fail_unlock;
-	}
+	if (!tb && (tb = tcp_bucket_create(head, snum)) == NULL)
+		goto fail_unlock;
 	if (hlist_empty(&tb->owners)) {
 		if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
 			tb->fastreuse = 1;
@@ -185,9 +204,9 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
 		tb->fastreuse = 0;
 
 success:
-	if (!inet_csk(sk)->icsk_bind_hash)
-		inet_bind_hash(sk, tb, snum);
-	BUG_TRAP(inet_csk(sk)->icsk_bind_hash == tb);
+	if (!tcp_sk(sk)->bind_hash)
+		tcp_bind_hash(sk, tb, snum);
+	BUG_TRAP(tcp_sk(sk)->bind_hash == tb);
 	ret = 0;
 
 fail_unlock:
@@ -205,13 +224,13 @@ static __inline__ void __tcp_v6_hash(struct sock *sk)
 	BUG_TRAP(sk_unhashed(sk));
 
 	if (sk->sk_state == TCP_LISTEN) {
-		list = &tcp_hashinfo.listening_hash[inet_sk_listen_hashfn(sk)];
-		lock = &tcp_hashinfo.lhash_lock;
-		inet_listen_wlock(&tcp_hashinfo);
+		list = &tcp_listening_hash[tcp_sk_listen_hashfn(sk)];
+		lock = &tcp_lhash_lock;
+		tcp_listen_wlock();
 	} else {
-		sk->sk_hashent = inet6_sk_ehashfn(sk, tcp_hashinfo.ehash_size);
-		list = &tcp_hashinfo.ehash[sk->sk_hashent].chain;
-		lock = &tcp_hashinfo.ehash[sk->sk_hashent].lock;
+		sk->sk_hashent = tcp_v6_sk_hashfn(sk);
+		list = &tcp_ehash[sk->sk_hashent].chain;
+		lock = &tcp_ehash[sk->sk_hashent].lock;
 		write_lock(lock);
 	}
 
@@ -236,11 +255,131 @@ static void tcp_v6_hash(struct sock *sk)
 	}
 }
 
+static struct sock *tcp_v6_lookup_listener(struct in6_addr *daddr, unsigned short hnum, int dif)
+{
+	struct sock *sk;
+	struct hlist_node *node;
+	struct sock *result = NULL;
+	int score, hiscore;
+
+	hiscore=0;
+	read_lock(&tcp_lhash_lock);
+	sk_for_each(sk, node, &tcp_listening_hash[tcp_lhashfn(hnum)]) {
+		if (inet_sk(sk)->num == hnum && sk->sk_family == PF_INET6) {
+			struct ipv6_pinfo *np = inet6_sk(sk);
+			
+			score = 1;
+			if (!ipv6_addr_any(&np->rcv_saddr)) {
+				if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
+					continue;
+				score++;
+			}
+			if (sk->sk_bound_dev_if) {
+				if (sk->sk_bound_dev_if != dif)
+					continue;
+				score++;
+			}
+			if (score == 3) {
+				result = sk;
+				break;
+			}
+			if (score > hiscore) {
+				hiscore = score;
+				result = sk;
+			}
+		}
+	}
+	if (result)
+		sock_hold(result);
+	read_unlock(&tcp_lhash_lock);
+	return result;
+}
+
+/* Sockets in TCP_CLOSE state are _always_ taken out of the hash, so
+ * we need not check it for TCP lookups anymore, thanks Alexey. -DaveM
+ *
+ * The sockhash lock must be held as a reader here.
+ */
+
+static inline struct sock *__tcp_v6_lookup_established(struct in6_addr *saddr, u16 sport,
+						       struct in6_addr *daddr, u16 hnum,
+						       int dif)
+{
+	struct tcp_ehash_bucket *head;
+	struct sock *sk;
+	struct hlist_node *node;
+	__u32 ports = TCP_COMBINED_PORTS(sport, hnum);
+	int hash;
+
+	/* Optimize here for direct hit, only listening connections can
+	 * have wildcards anyways.
+	 */
+	hash = tcp_v6_hashfn(daddr, hnum, saddr, sport);
+	head = &tcp_ehash[hash];
+	read_lock(&head->lock);
+	sk_for_each(sk, node, &head->chain) {
+		/* For IPV6 do the cheaper port and family tests first. */
+		if(TCP_IPV6_MATCH(sk, saddr, daddr, ports, dif))
+			goto hit; /* You sunk my battleship! */
+	}
+	/* Must check for a TIME_WAIT'er before going to listener hash. */
+	sk_for_each(sk, node, &(head + tcp_ehash_size)->chain) {
+		/* FIXME: acme: check this... */
+		struct tcp_tw_bucket *tw = (struct tcp_tw_bucket *)sk;
+
+		if(*((__u32 *)&(tw->tw_dport))	== ports	&&
+		   sk->sk_family		== PF_INET6) {
+			if(ipv6_addr_equal(&tw->tw_v6_daddr, saddr)	&&
+			   ipv6_addr_equal(&tw->tw_v6_rcv_saddr, daddr)	&&
+			   (!sk->sk_bound_dev_if || sk->sk_bound_dev_if == dif))
+				goto hit;
+		}
+	}
+	read_unlock(&head->lock);
+	return NULL;
+
+hit:
+	sock_hold(sk);
+	read_unlock(&head->lock);
+	return sk;
+}
+
+
+static inline struct sock *__tcp_v6_lookup(struct in6_addr *saddr, u16 sport,
+					   struct in6_addr *daddr, u16 hnum,
+					   int dif)
+{
+	struct sock *sk;
+
+	sk = __tcp_v6_lookup_established(saddr, sport, daddr, hnum, dif);
+
+	if (sk)
+		return sk;
+
+	return tcp_v6_lookup_listener(daddr, hnum, dif);
+}
+
+inline struct sock *tcp_v6_lookup(struct in6_addr *saddr, u16 sport,
+				  struct in6_addr *daddr, u16 dport,
+				  int dif)
+{
+	struct sock *sk;
+
+	local_bh_disable();
+	sk = __tcp_v6_lookup(saddr, sport, daddr, ntohs(dport), dif);
+	local_bh_enable();
+
+	return sk;
+}
+
+EXPORT_SYMBOL_GPL(tcp_v6_lookup);
+
+
 /*
  * Open request hash tables.
  */
 
-static u32 tcp_v6_synq_hash(const struct in6_addr *raddr, const u16 rport, const u32 rnd)
+static u32 tcp_v6_synq_hash(struct in6_addr *raddr, u16 rport, u32 rnd)
 {
 	u32 a, b, c;
 
@@ -260,15 +399,14 @@ static u32 tcp_v6_synq_hash(const struct in6_addr *raddr, const u16 rport, const
 	return c & (TCP_SYNQ_HSIZE - 1);
 }
 
-static struct request_sock *tcp_v6_search_req(const struct sock *sk,
+static struct request_sock *tcp_v6_search_req(struct tcp_sock *tp,
 					      struct request_sock ***prevp,
 					      __u16 rport,
 					      struct in6_addr *raddr,
 					      struct in6_addr *laddr,
 					      int iif)
 {
-	const struct inet_connection_sock *icsk = inet_csk(sk);
-	struct listen_sock *lopt = icsk->icsk_accept_queue.listen_opt;
+	struct listen_sock *lopt = tp->accept_queue.listen_opt;
 	struct request_sock *req, **prev;  
 
 	for (prev = &lopt->syn_table[tcp_v6_synq_hash(raddr, rport, lopt->hash_rnd)];
@@ -313,48 +451,44 @@ static __u32 tcp_v6_init_sequence(struct sock *sk, struct sk_buff *skb)
 	}
 }
 
-static int __tcp_v6_check_established(struct sock *sk, const __u16 lport,
-				      struct inet_timewait_sock **twp)
+static int __tcp_v6_check_established(struct sock *sk, __u16 lport,
+				      struct tcp_tw_bucket **twp)
 {
 	struct inet_sock *inet = inet_sk(sk);
-	const struct ipv6_pinfo *np = inet6_sk(sk);
-	const struct in6_addr *daddr = &np->rcv_saddr;
-	const struct in6_addr *saddr = &np->daddr;
-	const int dif = sk->sk_bound_dev_if;
-	const u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
-	const int hash = inet6_ehashfn(daddr, inet->num, saddr, inet->dport,
-				       tcp_hashinfo.ehash_size);
-	struct inet_ehash_bucket *head = &tcp_hashinfo.ehash[hash];
+	struct ipv6_pinfo *np = inet6_sk(sk);
+	struct in6_addr *daddr = &np->rcv_saddr;
+	struct in6_addr *saddr = &np->daddr;
+	int dif = sk->sk_bound_dev_if;
+	u32 ports = TCP_COMBINED_PORTS(inet->dport, lport);
+	int hash = tcp_v6_hashfn(daddr, inet->num, saddr, inet->dport);
+	struct tcp_ehash_bucket *head = &tcp_ehash[hash];
 	struct sock *sk2;
-	const struct hlist_node *node;
-	struct inet_timewait_sock *tw;
+	struct hlist_node *node;
+	struct tcp_tw_bucket *tw;
 
 	write_lock(&head->lock);
 
 	/* Check TIME-WAIT sockets first. */
-	sk_for_each(sk2, node, &(head + tcp_hashinfo.ehash_size)->chain) {
-		const struct tcp6_timewait_sock *tcp6tw = tcp6_twsk(sk2);
-
-		tw = inet_twsk(sk2);
+	sk_for_each(sk2, node, &(head + tcp_ehash_size)->chain) {
+		tw = (struct tcp_tw_bucket*)sk2;
 
 		if(*((__u32 *)&(tw->tw_dport))	== ports	&&
 		   sk2->sk_family		== PF_INET6	&&
-		   ipv6_addr_equal(&tcp6tw->tw_v6_daddr, saddr)	&&
-		   ipv6_addr_equal(&tcp6tw->tw_v6_rcv_saddr, daddr)	&&
+		   ipv6_addr_equal(&tw->tw_v6_daddr, saddr)	&&
+		   ipv6_addr_equal(&tw->tw_v6_rcv_saddr, daddr)	&&
 		   sk2->sk_bound_dev_if == sk->sk_bound_dev_if) {
-			const struct tcp_timewait_sock *tcptw = tcp_twsk(sk2);
 			struct tcp_sock *tp = tcp_sk(sk);
 
-			if (tcptw->tw_ts_recent_stamp &&
-			    (!twp ||
-			     (sysctl_tcp_tw_reuse &&
-			      xtime.tv_sec - tcptw->tw_ts_recent_stamp > 1))) {
+			if (tw->tw_ts_recent_stamp &&
+			    (!twp || (sysctl_tcp_tw_reuse &&
+				      xtime.tv_sec - 
+				      tw->tw_ts_recent_stamp > 1))) {
 				/* See comment in tcp_ipv4.c */
-				tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
+				tp->write_seq = tw->tw_snd_nxt + 65535 + 2;
 				if (!tp->write_seq)
 					tp->write_seq = 1;
-				tp->rx_opt.ts_recent	   = tcptw->tw_ts_recent;
-				tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
+				tp->rx_opt.ts_recent = tw->tw_ts_recent;
+				tp->rx_opt.ts_recent_stamp = tw->tw_ts_recent_stamp;
 				sock_hold(sk2);
 				goto unique;
 			} else
@@ -365,7 +499,7 @@ static int __tcp_v6_check_established(struct sock *sk, const __u16 lport,
 
 	/* And established part... */
 	sk_for_each(sk2, node, &head->chain) {
-		if (INET6_MATCH(sk2, saddr, daddr, ports, dif))
+		if(TCP_IPV6_MATCH(sk2, saddr, daddr, ports, dif))
 			goto not_unique;
 	}
 
@@ -381,10 +515,10 @@ static int __tcp_v6_check_established(struct sock *sk, const __u16 lport,
 		NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
 	} else if (tw) {
 		/* Silly. Should hash-dance instead... */
-		inet_twsk_deschedule(tw, &tcp_death_row);
+		tcp_tw_deschedule(tw);
 		NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
 
-		inet_twsk_put(tw);
+		tcp_tw_put(tw);
 	}
 	return 0;
 
@@ -406,8 +540,8 @@ static inline u32 tcpv6_port_offset(const struct sock *sk)
 static int tcp_v6_hash_connect(struct sock *sk)
 {
 	unsigned short snum = inet_sk(sk)->num;
- 	struct inet_bind_hashbucket *head;
- 	struct inet_bind_bucket *tb;
+ 	struct tcp_bind_hashbucket *head;
+ 	struct tcp_bind_bucket *tb;
 	int ret;
 
  	if (!snum) {
@@ -419,19 +553,19 @@ static int tcp_v6_hash_connect(struct sock *sk)
 		static u32 hint;
 		u32 offset = hint + tcpv6_port_offset(sk);
 		struct hlist_node *node;
- 		struct inet_timewait_sock *tw = NULL;
+ 		struct tcp_tw_bucket *tw = NULL;
 
  		local_bh_disable();
 		for (i = 1; i <= range; i++) {
 			port = low + (i + offset) % range;
- 			head = &tcp_hashinfo.bhash[inet_bhashfn(port, tcp_hashinfo.bhash_size)];
+ 			head = &tcp_bhash[tcp_bhashfn(port)];
  			spin_lock(&head->lock);
 
  			/* Does not bother with rcv_saddr checks,
  			 * because the established check is already
  			 * unique enough.
  			 */
-			inet_bind_bucket_for_each(tb, node, &head->chain) {
+			tb_for_each(tb, node, &head->chain) {
  				if (tb->port == port) {
  					BUG_TRAP(!hlist_empty(&tb->owners));
  					if (tb->fastreuse >= 0)
@@ -444,7 +578,7 @@ static int tcp_v6_hash_connect(struct sock *sk)
  				}
  			}
 
- 			tb = inet_bind_bucket_create(tcp_hashinfo.bind_bucket_cachep, head, port);
+ 			tb = tcp_bucket_create(head, port);
  			if (!tb) {
  				spin_unlock(&head->lock);
  				break;
@@ -463,7 +597,7 @@ static int tcp_v6_hash_connect(struct sock *sk)
 		hint += i;
 
  		/* Head lock still held and bh's disabled */
- 		inet_bind_hash(sk, tb, port);
+ 		tcp_bind_hash(sk, tb, port);
 		if (sk_unhashed(sk)) {
  			inet_sk(sk)->sport = htons(port);
  			__tcp_v6_hash(sk);
@@ -471,16 +605,16 @@ static int tcp_v6_hash_connect(struct sock *sk)
  		spin_unlock(&head->lock);
 
  		if (tw) {
- 			inet_twsk_deschedule(tw, &tcp_death_row);
- 			inet_twsk_put(tw);
+ 			tcp_tw_deschedule(tw);
+ 			tcp_tw_put(tw);
  		}
 
 		ret = 0;
 		goto out;
  	}
 
- 	head = &tcp_hashinfo.bhash[inet_bhashfn(snum, tcp_hashinfo.bhash_size)];
- 	tb   = inet_csk(sk)->icsk_bind_hash;
+ 	head  = &tcp_bhash[tcp_bhashfn(snum)];
+ 	tb  = tcp_sk(sk)->bind_hash;
 	spin_lock_bh(&head->lock);
 
 	if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
@@ -497,6 +631,11 @@ static int tcp_v6_hash_connect(struct sock *sk)
 	}
 }
 
+static __inline__ int tcp_v6_iif(struct sk_buff *skb)
+{
+	return IP6CB(skb)->iif;
+}
+
 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, 
 			  int addr_len)
 {
@@ -688,15 +827,14 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		int type, int code, int offset, __u32 info)
 {
 	struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
-	const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
+	struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 	struct ipv6_pinfo *np;
 	struct sock *sk;
 	int err;
 	struct tcp_sock *tp; 
 	__u32 seq;
 
-	sk = inet6_lookup(&tcp_hashinfo, &hdr->daddr, th->dest, &hdr->saddr,
-			  th->source, skb->dev->ifindex);
+	sk = tcp_v6_lookup(&hdr->daddr, th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 
 	if (sk == NULL) {
 		ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
@@ -704,7 +842,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	}
 
 	if (sk->sk_state == TCP_TIME_WAIT) {
-		inet_twsk_put((struct inet_timewait_sock *)sk);
+		tcp_tw_put((struct tcp_tw_bucket*)sk);
 		return;
 	}
 
@@ -782,8 +920,8 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		if (sock_owned_by_user(sk))
 			goto out;
 
-		req = tcp_v6_search_req(sk, &prev, th->dest, &hdr->daddr,
-					&hdr->saddr, inet6_iif(skb));
+		req = tcp_v6_search_req(tp, &prev, th->dest, &hdr->daddr,
+					&hdr->saddr, tcp_v6_iif(skb));
 		if (!req)
 			goto out;
 
@@ -797,7 +935,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 			goto out;
 		}
 
-		inet_csk_reqsk_queue_drop(sk, req, prev);
+		tcp_synq_drop(sk, req, prev);
 		goto out;
 
 	case TCP_SYN_SENT:
@@ -994,7 +1132,7 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
 				    buff->csum);
 
 	fl.proto = IPPROTO_TCP;
-	fl.oif = inet6_iif(skb);
+	fl.oif = tcp_v6_iif(skb);
 	fl.fl_ip_dport = t1->dest;
 	fl.fl_ip_sport = t1->source;
 
@@ -1063,7 +1201,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
 				    buff->csum);
 
 	fl.proto = IPPROTO_TCP;
-	fl.oif = inet6_iif(skb);
+	fl.oif = tcp_v6_iif(skb);
 	fl.fl_ip_dport = t1->dest;
 	fl.fl_ip_sport = t1->source;
 
@@ -1082,14 +1220,12 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
 
 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 {
-	struct inet_timewait_sock *tw = inet_twsk(sk);
-	const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
+	struct tcp_tw_bucket *tw = (struct tcp_tw_bucket *)sk;
 
-	tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
-			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
-			tcptw->tw_ts_recent);
+	tcp_v6_send_ack(skb, tw->tw_snd_nxt, tw->tw_rcv_nxt,
+			tw->tw_rcv_wnd >> tw->tw_rcv_wscale, tw->tw_ts_recent);
 
-	inet_twsk_put(tw);
+	tcp_tw_put(tw);
 }
 
 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
@@ -1101,25 +1237,28 @@ static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 {
 	struct request_sock *req, **prev;
-	const struct tcphdr *th = skb->h.th;
+	struct tcphdr *th = skb->h.th;
+	struct tcp_sock *tp = tcp_sk(sk);
 	struct sock *nsk;
 
 	/* Find possible connection requests. */
-	req = tcp_v6_search_req(sk, &prev, th->source, &skb->nh.ipv6h->saddr,
-				&skb->nh.ipv6h->daddr, inet6_iif(skb));
+	req = tcp_v6_search_req(tp, &prev, th->source, &skb->nh.ipv6h->saddr,
+				&skb->nh.ipv6h->daddr, tcp_v6_iif(skb));
 	if (req)
 		return tcp_check_req(sk, skb, req, prev);
 
-	nsk = __inet6_lookup_established(&tcp_hashinfo, &skb->nh.ipv6h->saddr,
-					 th->source, &skb->nh.ipv6h->daddr,
-					 ntohs(th->dest), inet6_iif(skb));
+	nsk = __tcp_v6_lookup_established(&skb->nh.ipv6h->saddr,
+					  th->source,
+					  &skb->nh.ipv6h->daddr,
+					  ntohs(th->dest),
+					  tcp_v6_iif(skb));
 
 	if (nsk) {
 		if (nsk->sk_state != TCP_TIME_WAIT) {
 			bh_lock_sock(nsk);
 			return nsk;
 		}
-		inet_twsk_put((struct inet_timewait_sock *)nsk);
+		tcp_tw_put((struct tcp_tw_bucket*)nsk);
 		return NULL;
 	}
 
@@ -1132,12 +1271,12 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 
 static void tcp_v6_synq_add(struct sock *sk, struct request_sock *req)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
-	struct listen_sock *lopt = icsk->icsk_accept_queue.listen_opt;
-	const u32 h = tcp_v6_synq_hash(&tcp6_rsk(req)->rmt_addr, inet_rsk(req)->rmt_port, lopt->hash_rnd);
+	struct tcp_sock *tp = tcp_sk(sk);
+	struct listen_sock *lopt = tp->accept_queue.listen_opt;
+	u32 h = tcp_v6_synq_hash(&tcp6_rsk(req)->rmt_addr, inet_rsk(req)->rmt_port, lopt->hash_rnd);
 
-	reqsk_queue_hash_req(&icsk->icsk_accept_queue, h, req, TCP_TIMEOUT_INIT);
-	inet_csk_reqsk_queue_added(sk, TCP_TIMEOUT_INIT);
+	reqsk_queue_hash_req(&tp->accept_queue, h, req, TCP_TIMEOUT_INIT);
+	tcp_synq_added(sk);
 }
 
 
@@ -1162,13 +1301,13 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 	/*
 	 *	There are no SYN attacks on IPv6, yet...	
 	 */
-	if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
+	if (tcp_synq_is_full(sk) && !isn) {
 		if (net_ratelimit())
 			printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
 		goto drop;		
 	}
 
-	if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
+	if (sk_acceptq_is_full(sk) && tcp_synq_young(sk) > 1)
 		goto drop;
 
 	req = reqsk_alloc(&tcp6_request_sock_ops);
@@ -1200,7 +1339,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 	/* So that link locals have meaning */
 	if (!sk->sk_bound_dev_if &&
 	    ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
-		treq->iif = inet6_iif(skb);
+		treq->iif = tcp_v6_iif(skb);
 
 	if (isn == 0) 
 		isn = tcp_v6_init_sequence(sk,skb);
@@ -1265,14 +1404,15 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 		newsk->sk_backlog_rcv = tcp_v4_do_rcv;
 		newnp->pktoptions  = NULL;
 		newnp->opt	   = NULL;
-		newnp->mcast_oif   = inet6_iif(skb);
+		newnp->mcast_oif   = tcp_v6_iif(skb);
 		newnp->mcast_hops  = skb->nh.ipv6h->hop_limit;
 
-		/*
-		 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
-		 * here, tcp_create_openreq_child now does this for us, see the comment in
-		 * that function for the gory details. -acme
+		/* Charge newly allocated IPv6 socket. Though it is mapped,
+		 * it is IPv6 yet.
 		 */
+#ifdef INET_REFCNT_DEBUG
+		atomic_inc(&inet6_sock_nr);
+#endif
 
 		/* It is tricky place. Until this moment IPv4 tcp
 		   worked with IPv6 af_tcp.af_specific.
@@ -1327,11 +1467,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 	if (newsk == NULL)
 		goto out;
 
-	/*
-	 * No need to charge this sock to the relevant IPv6 refcnt debug socks
-	 * count here, tcp_create_openreq_child now does this for us, see the
-	 * comment in that function for the gory details. -acme
-	 */
+	/* Charge newly allocated IPv6 socket */
+#ifdef INET_REFCNT_DEBUG
+	atomic_inc(&inet6_sock_nr);
+#endif
 
 	ip6_dst_store(newsk, dst, NULL);
 	newsk->sk_route_caps = dst->dev->features &
@@ -1370,7 +1509,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 			skb_set_owner_r(newnp->pktoptions, newsk);
 	}
 	newnp->opt	  = NULL;
-	newnp->mcast_oif  = inet6_iif(skb);
+	newnp->mcast_oif  = tcp_v6_iif(skb);
 	newnp->mcast_hops = skb->nh.ipv6h->hop_limit;
 
 	/* Clone native IPv6 options from listening socket (if any)
@@ -1397,7 +1536,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 	newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
 
 	__tcp_v6_hash(newsk);
-	inet_inherit_port(&tcp_hashinfo, sk, newsk);
+	tcp_inherit_port(sk, newsk);
 
 	return newsk;
 
@@ -1418,7 +1557,7 @@ static int tcp_v6_checksum_init(struct sk_buff *skb)
 		if (!tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
 				  &skb->nh.ipv6h->daddr,skb->csum))
 			return 0;
-		LIMIT_NETDEBUG(KERN_DEBUG "hw tcp v6 csum failed\n");
+		LIMIT_NETDEBUG(printk(KERN_DEBUG "hw tcp v6 csum failed\n"));
 	}
 	if (skb->len <= 76) {
 		if (tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
@@ -1545,7 +1684,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
 	if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
 	    !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
 		if (np->rxopt.bits.rxinfo)
-			np->mcast_oif = inet6_iif(opt_skb);
+			np->mcast_oif = tcp_v6_iif(opt_skb);
 		if (np->rxopt.bits.rxhlim)
 			np->mcast_hops = opt_skb->nh.ipv6h->hop_limit;
 		if (ipv6_opt_accepted(sk, opt_skb)) {
@@ -1600,9 +1739,8 @@ static int tcp_v6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
 	TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(skb->nh.ipv6h);
 	TCP_SKB_CB(skb)->sacked = 0;
 
-	sk = __inet6_lookup(&tcp_hashinfo, &skb->nh.ipv6h->saddr, th->source,
-			    &skb->nh.ipv6h->daddr, ntohs(th->dest),
-			    inet6_iif(skb));
+	sk = __tcp_v6_lookup(&skb->nh.ipv6h->saddr, th->source,
+			     &skb->nh.ipv6h->daddr, ntohs(th->dest), tcp_v6_iif(skb));
 
 	if (!sk)
 		goto no_tcp_socket;
@@ -1657,29 +1795,26 @@ static int tcp_v6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
 
 do_time_wait:
 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-		inet_twsk_put((struct inet_timewait_sock *)sk);
+		tcp_tw_put((struct tcp_tw_bucket *) sk);
 		goto discard_it;
 	}
 
 	if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
 		TCP_INC_STATS_BH(TCP_MIB_INERRS);
-		inet_twsk_put((struct inet_timewait_sock *)sk);
+		tcp_tw_put((struct tcp_tw_bucket *) sk);
 		goto discard_it;
 	}
 
-	switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
-					   skb, th)) {
+	switch(tcp_timewait_state_process((struct tcp_tw_bucket *)sk,
+					  skb, th, skb->len)) {
 	case TCP_TW_SYN:
 	{
 		struct sock *sk2;
 
-		sk2 = inet6_lookup_listener(&tcp_hashinfo,
-					    &skb->nh.ipv6h->daddr,
-					    ntohs(th->dest), inet6_iif(skb));
+		sk2 = tcp_v6_lookup_listener(&skb->nh.ipv6h->daddr, ntohs(th->dest), tcp_v6_iif(skb));
 		if (sk2 != NULL) {
-			struct inet_timewait_sock *tw = inet_twsk(sk);
-			inet_twsk_deschedule(tw, &tcp_death_row);
-			inet_twsk_put(tw);
+			tcp_tw_deschedule((struct tcp_tw_bucket *)sk);
+			tcp_tw_put((struct tcp_tw_bucket *)sk);
 			sk = sk2;
 			goto process;
 		}
@@ -1848,7 +1983,7 @@ static struct tcp_func ipv6_specific = {
 static struct tcp_func ipv6_mapped = {
 	.queue_xmit	=	ip_queue_xmit,
 	.send_check	=	tcp_v4_send_check,
-	.rebuild_header	=	inet_sk_rebuild_header,
+	.rebuild_header	=	tcp_v4_rebuild_header,
 	.conn_request	=	tcp_v6_conn_request,
 	.syn_recv_sock	=	tcp_v6_syn_recv_sock,
 	.remember_stamp	=	tcp_v4_remember_stamp,
@@ -1867,14 +2002,13 @@ static struct tcp_func ipv6_mapped = {
  */
 static int tcp_v6_init_sock(struct sock *sk)
 {
-	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 
 	skb_queue_head_init(&tp->out_of_order_queue);
 	tcp_init_xmit_timers(sk);
 	tcp_prequeue_init(tp);
 
-	icsk->icsk_rto = TCP_TIMEOUT_INIT;
+	tp->rto  = TCP_TIMEOUT_INIT;
 	tp->mdev = TCP_TIMEOUT_INIT;
 
 	/* So many TCP implementations out there (incorrectly) count the
@@ -1896,7 +2030,7 @@ static int tcp_v6_init_sock(struct sock *sk)
 	sk->sk_state = TCP_CLOSE;
 
 	tp->af_specific = &ipv6_specific;
-	icsk->icsk_ca_ops = &tcp_init_congestion_ops;
+	tp->ca_ops = &tcp_init_congestion_ops;
 	sk->sk_write_space = sk_stream_write_space;
 	sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
@@ -1910,6 +2044,8 @@ static int tcp_v6_init_sock(struct sock *sk)
 
 static int tcp_v6_destroy_sock(struct sock *sk)
 {
+	extern int tcp_v4_destroy_sock(struct sock *sk);
+
 	tcp_v4_destroy_sock(sk);
 	return inet6_destroy_sock(sk);
 }
@@ -1955,20 +2091,18 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 	unsigned long timer_expires;
 	struct inet_sock *inet = inet_sk(sp);
 	struct tcp_sock *tp = tcp_sk(sp);
-	const struct inet_connection_sock *icsk = inet_csk(sp);
 	struct ipv6_pinfo *np = inet6_sk(sp);
 
 	dest  = &np->daddr;
 	src   = &np->rcv_saddr;
 	destp = ntohs(inet->dport);
 	srcp  = ntohs(inet->sport);
-
-	if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
+	if (tp->pending == TCP_TIME_RETRANS) {
 		timer_active	= 1;
-		timer_expires	= icsk->icsk_timeout;
-	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
+		timer_expires	= tp->timeout;
+	} else if (tp->pending == TCP_TIME_PROBE0) {
 		timer_active	= 4;
-		timer_expires	= icsk->icsk_timeout;
+		timer_expires	= tp->timeout;
 	} else if (timer_pending(&sp->sk_timer)) {
 		timer_active	= 2;
 		timer_expires	= sp->sk_timer.expires;
@@ -1989,31 +2123,28 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 		   tp->write_seq-tp->snd_una, tp->rcv_nxt-tp->copied_seq,
 		   timer_active,
 		   jiffies_to_clock_t(timer_expires - jiffies),
-		   icsk->icsk_retransmits,
+		   tp->retransmits,
 		   sock_i_uid(sp),
-		   icsk->icsk_probes_out,
+		   tp->probes_out,
 		   sock_i_ino(sp),
 		   atomic_read(&sp->sk_refcnt), sp,
-		   icsk->icsk_rto,
-		   icsk->icsk_ack.ato,
-		   (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
+		   tp->rto, tp->ack.ato, (tp->ack.quick<<1)|tp->ack.pingpong,
 		   tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
 		   );
 }
 
 static void get_timewait6_sock(struct seq_file *seq, 
-			       struct inet_timewait_sock *tw, int i)
+			       struct tcp_tw_bucket *tw, int i)
 {
 	struct in6_addr *dest, *src;
 	__u16 destp, srcp;
-	struct tcp6_timewait_sock *tcp6tw = tcp6_twsk((struct sock *)tw);
 	int ttd = tw->tw_ttd - jiffies;
 
 	if (ttd < 0)
 		ttd = 0;
 
-	dest = &tcp6tw->tw_v6_daddr;
-	src  = &tcp6tw->tw_v6_rcv_saddr;
+	dest  = &tw->tw_v6_daddr;
+	src   = &tw->tw_v6_rcv_saddr;
 	destp = ntohs(tw->tw_dport);
 	srcp  = ntohs(tw->tw_sport);
 
@@ -2088,7 +2219,7 @@ struct proto tcpv6_prot = {
 	.close			= tcp_close,
 	.connect		= tcp_v6_connect,
 	.disconnect		= tcp_disconnect,
-	.accept			= inet_csk_accept,
+	.accept			= tcp_accept,
 	.ioctl			= tcp_ioctl,
 	.init			= tcp_v6_init_sock,
 	.destroy		= tcp_v6_destroy_sock,
@@ -2105,13 +2236,11 @@ struct proto tcpv6_prot = {
 	.sockets_allocated	= &tcp_sockets_allocated,
 	.memory_allocated	= &tcp_memory_allocated,
 	.memory_pressure	= &tcp_memory_pressure,
-	.orphan_count		= &tcp_orphan_count,
 	.sysctl_mem		= sysctl_tcp_mem,
 	.sysctl_wmem		= sysctl_tcp_wmem,
 	.sysctl_rmem		= sysctl_tcp_rmem,
 	.max_header		= MAX_TCP_HEADER,
 	.obj_size		= sizeof(struct tcp6_sock),
-	.twsk_obj_size		= sizeof(struct tcp6_timewait_sock),
 	.rsk_prot		= &tcp6_request_sock_ops,
 };
 
@@ -2121,6 +2250,8 @@ static struct inet6_protocol tcpv6_protocol = {
 	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
 
+extern struct proto_ops inet6_stream_ops;
+
 static struct inet_protosw tcpv6_protosw = {
 	.type		=	SOCK_STREAM,
 	.protocol	=	IPPROTO_TCP,
diff --git a/trunk/net/ipv6/udp.c b/trunk/net/ipv6/udp.c
index 390d750449ce..eff050ac7049 100644
--- a/trunk/net/ipv6/udp.c
+++ b/trunk/net/ipv6/udp.c
@@ -51,7 +51,6 @@
 #include <net/udp.h>
 #include <net/raw.h>
 #include <net/inet_common.h>
-#include <net/tcp_states.h>
 
 #include <net/ip6_checksum.h>
 #include <net/xfrm.h>
@@ -59,7 +58,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
-DEFINE_SNMP_STAT(struct udp_mib, udp_stats_in6) __read_mostly;
+DEFINE_SNMP_STAT(struct udp_mib, udp_stats_in6);
 
 /* Grrr, addr_type already calculated by caller, but I don't want
  * to add some silly "cookie" argument to this method just for that.
@@ -478,7 +477,8 @@ static int udpv6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
 		/* RFC 2460 section 8.1 says that we SHOULD log
 		   this error. Well, it is reasonable.
 		 */
-		LIMIT_NETDEBUG(KERN_INFO "IPv6: udp checksum is 0\n");
+		LIMIT_NETDEBUG(
+			printk(KERN_INFO "IPv6: udp checksum is 0\n"));
 		goto discard;
 	}
 
@@ -493,7 +493,7 @@ static int udpv6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
 	if (skb->ip_summed==CHECKSUM_HW) {
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 		if (csum_ipv6_magic(saddr, daddr, ulen, IPPROTO_UDP, skb->csum)) {
-			LIMIT_NETDEBUG(KERN_DEBUG "udp v6 hw csum failure.\n");
+			LIMIT_NETDEBUG(printk(KERN_DEBUG "udp v6 hw csum failure.\n"));
 			skb->ip_summed = CHECKSUM_NONE;
 		}
 	}
@@ -825,7 +825,7 @@ static int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 		/* ... which is an evident application bug. --ANK */
 		release_sock(sk);
 
-		LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 2\n");
+		LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 2\n"));
 		err = -EINVAL;
 		goto out;
 	}
@@ -1054,6 +1054,8 @@ struct proto udpv6_prot = {
 	.obj_size =	sizeof(struct udp6_sock),
 };
 
+extern struct proto_ops inet6_dgram_ops;
+
 static struct inet_protosw udpv6_protosw = {
 	.type =      SOCK_DGRAM,
 	.protocol =  IPPROTO_UDP,
diff --git a/trunk/net/ipv6/xfrm6_tunnel.c b/trunk/net/ipv6/xfrm6_tunnel.c
index fbef7826a74f..60c26c87277e 100644
--- a/trunk/net/ipv6/xfrm6_tunnel.c
+++ b/trunk/net/ipv6/xfrm6_tunnel.c
@@ -79,7 +79,7 @@ static u32 xfrm6_tunnel_spi;
 #define XFRM6_TUNNEL_SPI_MIN	1
 #define XFRM6_TUNNEL_SPI_MAX	0xffffffff
 
-static kmem_cache_t *xfrm6_tunnel_spi_kmem __read_mostly;
+static kmem_cache_t *xfrm6_tunnel_spi_kmem;
 
 #define XFRM6_TUNNEL_SPI_BYADDR_HSIZE 256
 #define XFRM6_TUNNEL_SPI_BYSPI_HSIZE 256
diff --git a/trunk/net/ipx/af_ipx.c b/trunk/net/ipx/af_ipx.c
index 34b3bb868409..5a27e5df5886 100644
--- a/trunk/net/ipx/af_ipx.c
+++ b/trunk/net/ipx/af_ipx.c
@@ -44,6 +44,7 @@
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/string.h>
+#include <linux/tcp.h>
 #include <linux/types.h>
 #include <linux/termios.h>
 
@@ -51,7 +52,6 @@
 #include <net/p8022.h>
 #include <net/psnap.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
 
 #include <asm/uaccess.h>
 
@@ -1627,7 +1627,7 @@ static int ipx_getname(struct socket *sock, struct sockaddr *uaddr,
 	return rc;
 }
 
-static int ipx_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int ipx_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 {
 	/* NULL here for pt means the packet was looped back */
 	struct ipx_interface *intrfc;
@@ -1796,8 +1796,8 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
 				     copied);
 	if (rc)
 		goto out_free;
-	if (skb->tstamp.off_sec)
-		skb_get_timestamp(skb, &sk->sk_stamp);
+	if (skb->stamp.tv_sec)
+		sk->sk_stamp = skb->stamp;
 
 	msg->msg_namelen = sizeof(*sipx);
 
@@ -1940,7 +1940,9 @@ static struct notifier_block ipx_dev_notifier = {
 };
 
 extern struct datalink_proto *make_EII_client(void);
+extern struct datalink_proto *make_8023_client(void);
 extern void destroy_EII_client(struct datalink_proto *);
+extern void destroy_8023_client(struct datalink_proto *);
 
 static unsigned char ipx_8022_type = 0xE0;
 static unsigned char ipx_snap_id[5] = { 0x0, 0x0, 0x0, 0x81, 0x37 };
diff --git a/trunk/net/ipx/ipx_proc.c b/trunk/net/ipx/ipx_proc.c
index 1f73d9ea434d..b6761913445a 100644
--- a/trunk/net/ipx/ipx_proc.c
+++ b/trunk/net/ipx/ipx_proc.c
@@ -10,7 +10,7 @@
 #include <linux/proc_fs.h>
 #include <linux/spinlock.h>
 #include <linux/seq_file.h>
-#include <net/tcp_states.h>
+#include <linux/tcp.h>
 #include <net/ipx.h>
 
 static __inline__ struct ipx_interface *ipx_get_interface_idx(loff_t pos)
diff --git a/trunk/net/irda/af_irda.c b/trunk/net/irda/af_irda.c
index 6f92f9c62990..92c6e8d4e731 100644
--- a/trunk/net/irda/af_irda.c
+++ b/trunk/net/irda/af_irda.c
@@ -56,7 +56,7 @@
 #include <asm/uaccess.h>
 
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 
 #include <net/irda/af_irda.h>
 
diff --git a/trunk/net/irda/irlap_frame.c b/trunk/net/irda/irlap_frame.c
index 3e9a06abbdd0..6dafbb43b529 100644
--- a/trunk/net/irda/irlap_frame.c
+++ b/trunk/net/irda/irlap_frame.c
@@ -988,6 +988,9 @@ void irlap_resend_rejected_frames(struct irlap_cb *self, int command)
 			IRDA_DEBUG(0, "%s(), unable to copy\n", __FUNCTION__);
 			return;
 		}
+		/* Unlink tx_skb from list */
+		tx_skb->next = tx_skb->prev = NULL;
+		tx_skb->list = NULL;
 
 		/* Clear old Nr field + poll bit */
 		tx_skb->data[1] &= 0x0f;
@@ -1060,6 +1063,9 @@ void irlap_resend_rejected_frame(struct irlap_cb *self, int command)
 			IRDA_DEBUG(0, "%s(), unable to copy\n", __FUNCTION__);
 			return;
 		}
+		/* Unlink tx_skb from list */
+		tx_skb->next = tx_skb->prev = NULL;
+		tx_skb->list = NULL;
 
 		/* Clear old Nr field + poll bit */
 		tx_skb->data[1] &= 0x0f;
@@ -1303,7 +1309,7 @@ static void irlap_recv_test_frame(struct irlap_cb *self, struct sk_buff *skb,
  * Jean II
  */
 int irlap_driver_rcv(struct sk_buff *skb, struct net_device *dev,
-		     struct packet_type *ptype, struct net_device *orig_dev)
+		     struct packet_type *ptype)
 {
 	struct irlap_info info;
 	struct irlap_cb *self;
diff --git a/trunk/net/irda/irlmp.c b/trunk/net/irda/irlmp.c
index c19e9ce05a3a..7a4a4d7fbe66 100644
--- a/trunk/net/irda/irlmp.c
+++ b/trunk/net/irda/irlmp.c
@@ -53,6 +53,7 @@ struct irlmp_cb *irlmp = NULL;
 /* These can be altered by the sysctl interface */
 int  sysctl_discovery         = 0;
 int  sysctl_discovery_timeout = 3; /* 3 seconds by default */
+EXPORT_SYMBOL(sysctl_discovery_timeout);
 int  sysctl_discovery_slots   = 6; /* 6 slots by default */
 int  sysctl_lap_keepalive_time = LM_IDLE_TIMEOUT * 1000 / HZ;
 char sysctl_devname[65];
@@ -66,6 +67,7 @@ const char *irlmp_reasons[] = {
 	"LM_INIT_DISCONNECT",
 	"ERROR, NOT USED",
 };
+EXPORT_SYMBOL(irlmp_reasons);
 
 /*
  * Function irlmp_init (void)
@@ -673,6 +675,7 @@ struct lsap_cb *irlmp_dup(struct lsap_cb *orig, void *instance)
 
 	return new;
 }
+EXPORT_SYMBOL(irlmp_dup);
 
 /*
  * Function irlmp_disconnect_request (handle, userdata)
diff --git a/trunk/net/irda/irmod.c b/trunk/net/irda/irmod.c
index 634901dd156f..6ffaed4544e9 100644
--- a/trunk/net/irda/irmod.c
+++ b/trunk/net/irda/irmod.c
@@ -54,7 +54,7 @@ extern int  irsock_init(void);
 extern void irsock_cleanup(void);
 /* irlap_frame.c */
 extern int  irlap_driver_rcv(struct sk_buff *, struct net_device *, 
-			     struct packet_type *, struct net_device *);
+			     struct packet_type *);
 
 /*
  * Module parameters
diff --git a/trunk/net/irda/irnet/irnet.h b/trunk/net/irda/irnet/irnet.h
index b391cb3893d4..9004f7349a76 100644
--- a/trunk/net/irda/irnet/irnet.h
+++ b/trunk/net/irda/irnet/irnet.h
@@ -517,6 +517,9 @@ extern int
 	irda_irnet_init(void);		/* Initialise IrDA part of IrNET */
 extern void
 	irda_irnet_cleanup(void);	/* Teardown IrDA part of IrNET */
+/* ---------------------------- MODULE ---------------------------- */
+extern int
+	irnet_init(void);		/* Initialise IrNET module */
 
 /**************************** VARIABLES ****************************/
 
diff --git a/trunk/net/irda/irnet/irnet_ppp.c b/trunk/net/irda/irnet/irnet_ppp.c
index e53bf9e0053e..f8f984bb9922 100644
--- a/trunk/net/irda/irnet/irnet_ppp.c
+++ b/trunk/net/irda/irnet/irnet_ppp.c
@@ -1107,7 +1107,7 @@ ppp_irnet_cleanup(void)
 /*
  * Module main entry point
  */
-static int __init
+int __init
 irnet_init(void)
 {
   int err;
diff --git a/trunk/net/irda/irqueue.c b/trunk/net/irda/irqueue.c
index 1ba8c7106639..b0dd3ea35999 100644
--- a/trunk/net/irda/irqueue.c
+++ b/trunk/net/irda/irqueue.c
@@ -822,6 +822,7 @@ void* hashbin_find_next( hashbin_t* hashbin, long hashv, const char* name,
 
 	return entry;
 }
+EXPORT_SYMBOL(hashbin_find_next);
 
 /*
  * Function hashbin_get_first (hashbin)
diff --git a/trunk/net/lapb/lapb_subr.c b/trunk/net/lapb/lapb_subr.c
index 8b5eefd70f03..5de05a0bc0ff 100644
--- a/trunk/net/lapb/lapb_subr.c
+++ b/trunk/net/lapb/lapb_subr.c
@@ -78,7 +78,7 @@ void lapb_requeue_frames(struct lapb_cb *lapb)
 		if (!skb_prev)
 			skb_queue_head(&lapb->write_queue, skb);
 		else
-			skb_append(skb_prev, skb, &lapb->write_queue);
+			skb_append(skb_prev, skb);
 		skb_prev = skb;
 	}
 }
diff --git a/trunk/net/llc/af_llc.c b/trunk/net/llc/af_llc.c
index 66f55e514b56..20b4cfebd74c 100644
--- a/trunk/net/llc/af_llc.c
+++ b/trunk/net/llc/af_llc.c
@@ -23,13 +23,13 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/tcp.h>
 #include <linux/rtnetlink.h>
 #include <linux/init.h>
 #include <net/llc.h>
 #include <net/llc_sap.h>
 #include <net/llc_pdu.h>
 #include <net/llc_conn.h>
-#include <net/tcp_states.h>
 
 /* remember: uninitialized global data is zeroed because its in .bss */
 static u16 llc_ui_sap_last_autoport = LLC_SAP_DYN_START;
@@ -714,7 +714,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
 	if (uaddr)
 		memcpy(uaddr, llc_ui_skb_cb(skb), sizeof(*uaddr));
 	msg->msg_namelen = sizeof(*uaddr);
-	if (!skb->next) {
+	if (!skb->list) {
 dgram_free:
 		kfree_skb(skb);
 	}
diff --git a/trunk/net/llc/llc_conn.c b/trunk/net/llc/llc_conn.c
index 4c644bc70eae..eba812a9c69c 100644
--- a/trunk/net/llc/llc_conn.c
+++ b/trunk/net/llc/llc_conn.c
@@ -16,7 +16,7 @@
 #include <net/llc_sap.h>
 #include <net/llc_conn.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <linux/tcp.h>
 #include <net/llc_c_ev.h>
 #include <net/llc_c_ac.h>
 #include <net/llc_c_st.h>
@@ -71,11 +71,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 
 	if (!ev->ind_prim && !ev->cfm_prim) {
 		/* indicate or confirm not required */
-		/* XXX this is not very pretty, perhaps we should store
-		 * XXX indicate/confirm-needed state in the llc_conn_state_ev
-		 * XXX control block of the SKB instead? -DaveM
-		 */
-		if (!skb->next)
+		if (!skb->list)
 			goto out_kfree_skb;
 		goto out_skb_put;
 	}
diff --git a/trunk/net/llc/llc_core.c b/trunk/net/llc/llc_core.c
index 9727455bf0e7..5ff02c080a0b 100644
--- a/trunk/net/llc/llc_core.c
+++ b/trunk/net/llc/llc_core.c
@@ -103,8 +103,7 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)
 struct llc_sap *llc_sap_open(unsigned char lsap,
 			     int (*func)(struct sk_buff *skb,
 					 struct net_device *dev,
-					 struct packet_type *pt,
-					 struct net_device *orig_dev))
+					 struct packet_type *pt))
 {
 	struct llc_sap *sap = llc_sap_find(lsap);
 
diff --git a/trunk/net/llc/llc_if.c b/trunk/net/llc/llc_if.c
index 0f84f66018e4..0f9fc48aeaf9 100644
--- a/trunk/net/llc/llc_if.c
+++ b/trunk/net/llc/llc_if.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/tcp.h>
 #include <asm/errno.h>
 #include <net/llc_if.h>
 #include <net/llc_sap.h>
@@ -24,7 +25,6 @@
 #include <net/llc_c_ev.h>
 #include <net/llc_c_ac.h>
 #include <net/llc_c_st.h>
-#include <net/tcp_states.h>
 
 u8 llc_mac_null_var[IFHWADDRLEN];
 
diff --git a/trunk/net/llc/llc_input.c b/trunk/net/llc/llc_input.c
index 13b46240b7a1..4da6976efc9c 100644
--- a/trunk/net/llc/llc_input.c
+++ b/trunk/net/llc/llc_input.c
@@ -132,7 +132,7 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
  *	data now), it queues this frame in the connection's backlog.
  */
 int llc_rcv(struct sk_buff *skb, struct net_device *dev,
-	    struct packet_type *pt, struct net_device *orig_dev)
+	    struct packet_type *pt)
 {
 	struct llc_sap *sap;
 	struct llc_pdu_sn *pdu;
@@ -165,7 +165,7 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
 	 * LLC functionality
 	 */
 	if (sap->rcv_func) {
-		sap->rcv_func(skb, dev, pt, orig_dev);
+		sap->rcv_func(skb, dev, pt);
 		goto out;
 	}
 	dest = llc_pdu_type(skb);
diff --git a/trunk/net/llc/llc_sap.c b/trunk/net/llc/llc_sap.c
index 34228ef14985..965c94eb4bbc 100644
--- a/trunk/net/llc/llc_sap.c
+++ b/trunk/net/llc/llc_sap.c
@@ -21,7 +21,7 @@
 #include <net/llc_s_ev.h>
 #include <net/llc_s_st.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <linux/tcp.h>
 #include <linux/llc.h>
 
 /**
diff --git a/trunk/net/netfilter/Kconfig b/trunk/net/netfilter/Kconfig
deleted file mode 100644
index 8296b38bf270..000000000000
--- a/trunk/net/netfilter/Kconfig
+++ /dev/null
@@ -1,24 +0,0 @@
-config NETFILTER_NETLINK
-       tristate "Netfilter netlink interface"
-       help
-         If this option is enabled, the kernel will include support
-         for the new netfilter netlink interface.
-
-config NETFILTER_NETLINK_QUEUE
-	tristate "Netfilter NFQUEUE over NFNETLINK interface"
-	depends on NETFILTER_NETLINK
-	help
-	  If this option isenabled, the kernel will include support
-	  for queueing packets via NFNETLINK.
-	  
-config NETFILTER_NETLINK_LOG
-	tristate "Netfilter LOG over NFNETLINK interface"
-	depends on NETFILTER_NETLINK
-	help
-	  If this option is enabled, the kernel will include support
-	  for logging packets via NFNETLINK.
-
-	  This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
-	  and is also scheduled to replace the old syslog-based ipt_LOG
-	  and ip6t_LOG modules.
-
diff --git a/trunk/net/netfilter/Makefile b/trunk/net/netfilter/Makefile
deleted file mode 100644
index b3b44f8b415a..000000000000
--- a/trunk/net/netfilter/Makefile
+++ /dev/null
@@ -1,7 +0,0 @@
-netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o
-
-obj-$(CONFIG_NETFILTER) = netfilter.o
-
-obj-$(CONFIG_NETFILTER_NETLINK) += nfnetlink.o
-obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += nfnetlink_queue.o
-obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
diff --git a/trunk/net/netfilter/core.c b/trunk/net/netfilter/core.c
deleted file mode 100644
index 1ceb1a6c254b..000000000000
--- a/trunk/net/netfilter/core.c
+++ /dev/null
@@ -1,216 +0,0 @@
-/* netfilter.c: look after the filters for various protocols. 
- * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
- *
- * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
- * way.
- *
- * Rusty Russell (C)2000 -- This code is GPL.
- *
- * February 2000: Modified by James Morris to have 1 queue per protocol.
- * 15-Mar-2000:   Added NF_REPEAT --RR.
- * 08-May-2003:	  Internal logging interface added by Jozsef Kadlecsik.
- */
-#include <linux/config.h>
-#include <linux/kernel.h>
-#include <linux/netfilter.h>
-#include <net/protocol.h>
-#include <linux/init.h>
-#include <linux/skbuff.h>
-#include <linux/wait.h>
-#include <linux/module.h>
-#include <linux/interrupt.h>
-#include <linux/if.h>
-#include <linux/netdevice.h>
-#include <linux/inetdevice.h>
-#include <linux/proc_fs.h>
-#include <net/sock.h>
-
-#include "nf_internals.h"
-
-/* In this code, we can be waiting indefinitely for userspace to
- * service a packet if a hook returns NF_QUEUE.  We could keep a count
- * of skbuffs queued for userspace, and not deregister a hook unless
- * this is zero, but that sucks.  Now, we simply check when the
- * packets come back: if the hook is gone, the packet is discarded. */
-struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
-EXPORT_SYMBOL(nf_hooks);
-static DEFINE_SPINLOCK(nf_hook_lock);
-
-int nf_register_hook(struct nf_hook_ops *reg)
-{
-	struct list_head *i;
-
-	spin_lock_bh(&nf_hook_lock);
-	list_for_each(i, &nf_hooks[reg->pf][reg->hooknum]) {
-		if (reg->priority < ((struct nf_hook_ops *)i)->priority)
-			break;
-	}
-	list_add_rcu(&reg->list, i->prev);
-	spin_unlock_bh(&nf_hook_lock);
-
-	synchronize_net();
-	return 0;
-}
-EXPORT_SYMBOL(nf_register_hook);
-
-void nf_unregister_hook(struct nf_hook_ops *reg)
-{
-	spin_lock_bh(&nf_hook_lock);
-	list_del_rcu(&reg->list);
-	spin_unlock_bh(&nf_hook_lock);
-
-	synchronize_net();
-}
-EXPORT_SYMBOL(nf_unregister_hook);
-
-unsigned int nf_iterate(struct list_head *head,
-			struct sk_buff **skb,
-			int hook,
-			const struct net_device *indev,
-			const struct net_device *outdev,
-			struct list_head **i,
-			int (*okfn)(struct sk_buff *),
-			int hook_thresh)
-{
-	unsigned int verdict;
-
-	/*
-	 * The caller must not block between calls to this
-	 * function because of risk of continuing from deleted element.
-	 */
-	list_for_each_continue_rcu(*i, head) {
-		struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
-
-		if (hook_thresh > elem->priority)
-			continue;
-
-		/* Optimization: we don't need to hold module
-                   reference here, since function can't sleep. --RR */
-		verdict = elem->hook(hook, skb, indev, outdev, okfn);
-		if (verdict != NF_ACCEPT) {
-#ifdef CONFIG_NETFILTER_DEBUG
-			if (unlikely((verdict & NF_VERDICT_MASK)
-							> NF_MAX_VERDICT)) {
-				NFDEBUG("Evil return from %p(%u).\n",
-				        elem->hook, hook);
-				continue;
-			}
-#endif
-			if (verdict != NF_REPEAT)
-				return verdict;
-			*i = (*i)->prev;
-		}
-	}
-	return NF_ACCEPT;
-}
-
-
-/* Returns 1 if okfn() needs to be executed by the caller,
- * -EPERM for NF_DROP, 0 otherwise. */
-int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
-		 struct net_device *indev,
-		 struct net_device *outdev,
-		 int (*okfn)(struct sk_buff *),
-		 int hook_thresh)
-{
-	struct list_head *elem;
-	unsigned int verdict;
-	int ret = 0;
-
-	/* We may already have this, but read-locks nest anyway */
-	rcu_read_lock();
-
-	elem = &nf_hooks[pf][hook];
-next_hook:
-	verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
-			     outdev, &elem, okfn, hook_thresh);
-	if (verdict == NF_ACCEPT || verdict == NF_STOP) {
-		ret = 1;
-		goto unlock;
-	} else if (verdict == NF_DROP) {
-		kfree_skb(*pskb);
-		ret = -EPERM;
-	} else if ((verdict & NF_VERDICT_MASK)  == NF_QUEUE) {
-		NFDEBUG("nf_hook: Verdict = QUEUE.\n");
-		if (!nf_queue(pskb, elem, pf, hook, indev, outdev, okfn,
-			      verdict >> NF_VERDICT_BITS))
-			goto next_hook;
-	}
-unlock:
-	rcu_read_unlock();
-	return ret;
-}
-EXPORT_SYMBOL(nf_hook_slow);
-
-
-int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len)
-{
-	struct sk_buff *nskb;
-
-	if (writable_len > (*pskb)->len)
-		return 0;
-
-	/* Not exclusive use of packet?  Must copy. */
-	if (skb_shared(*pskb) || skb_cloned(*pskb))
-		goto copy_skb;
-
-	return pskb_may_pull(*pskb, writable_len);
-
-copy_skb:
-	nskb = skb_copy(*pskb, GFP_ATOMIC);
-	if (!nskb)
-		return 0;
-	BUG_ON(skb_is_nonlinear(nskb));
-
-	/* Rest of kernel will get very unhappy if we pass it a
-	   suddenly-orphaned skbuff */
-	if ((*pskb)->sk)
-		skb_set_owner_w(nskb, (*pskb)->sk);
-	kfree_skb(*pskb);
-	*pskb = nskb;
-	return 1;
-}
-EXPORT_SYMBOL(skb_make_writable);
-
-
-/* This does not belong here, but locally generated errors need it if connection
-   tracking in use: without this, connection may not be in hash table, and hence
-   manufactured ICMP or RST packets will not be associated with it. */
-void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
-EXPORT_SYMBOL(ip_ct_attach);
-
-void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb)
-{
-	void (*attach)(struct sk_buff *, struct sk_buff *);
-
-	if (skb->nfct && (attach = ip_ct_attach) != NULL) {
-		mb(); /* Just to be sure: must be read before executing this */
-		attach(new, skb);
-	}
-}
-EXPORT_SYMBOL(nf_ct_attach);
-
-#ifdef CONFIG_PROC_FS
-struct proc_dir_entry *proc_net_netfilter;
-EXPORT_SYMBOL(proc_net_netfilter);
-#endif
-
-void __init netfilter_init(void)
-{
-	int i, h;
-	for (i = 0; i < NPROTO; i++) {
-		for (h = 0; h < NF_MAX_HOOKS; h++)
-			INIT_LIST_HEAD(&nf_hooks[i][h]);
-	}
-
-#ifdef CONFIG_PROC_FS
-	proc_net_netfilter = proc_mkdir("netfilter", proc_net);
-	if (!proc_net_netfilter)
-		panic("cannot create netfilter proc entry");
-#endif
-
-	if (netfilter_queue_init() < 0)
-		panic("cannot initialize nf_queue");
-	if (netfilter_log_init() < 0)
-		panic("cannot initialize nf_log");
-}
diff --git a/trunk/net/netfilter/nf_internals.h b/trunk/net/netfilter/nf_internals.h
deleted file mode 100644
index 6bdee2910617..000000000000
--- a/trunk/net/netfilter/nf_internals.h
+++ /dev/null
@@ -1,39 +0,0 @@
-#ifndef _NF_INTERNALS_H
-#define _NF_INTERNALS_H
-
-#include <linux/config.h>
-#include <linux/list.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-
-#ifdef CONFIG_NETFILTER_DEBUG
-#define NFDEBUG(format, args...)  printk(format , ## args)
-#else
-#define NFDEBUG(format, args...)
-#endif
-
-
-/* core.c */
-extern unsigned int nf_iterate(struct list_head *head,
-				struct sk_buff **skb,
-				int hook,
-				const struct net_device *indev,
-				const struct net_device *outdev,
-				struct list_head **i,
-				int (*okfn)(struct sk_buff *),
-				int hook_thresh);
-
-/* nf_queue.c */
-extern int nf_queue(struct sk_buff **skb, 
-		    struct list_head *elem, 
-		    int pf, unsigned int hook,
-		    struct net_device *indev,
-		    struct net_device *outdev,
-		    int (*okfn)(struct sk_buff *),
-		    unsigned int queuenum);
-extern int __init netfilter_queue_init(void);
-
-/* nf_log.c */
-extern int __init netfilter_log_init(void);
-
-#endif
diff --git a/trunk/net/netfilter/nf_log.c b/trunk/net/netfilter/nf_log.c
deleted file mode 100644
index 3e76bd0824a2..000000000000
--- a/trunk/net/netfilter/nf_log.c
+++ /dev/null
@@ -1,178 +0,0 @@
-#include <linux/config.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/proc_fs.h>
-#include <linux/skbuff.h>
-#include <linux/netfilter.h>
-#include <linux/seq_file.h>
-#include <net/protocol.h>
-
-#include "nf_internals.h"
-
-/* Internal logging interface, which relies on the real 
-   LOG target modules */
-
-#define NF_LOG_PREFIXLEN		128
-
-static struct nf_logger *nf_logging[NPROTO]; /* = NULL */
-static DEFINE_SPINLOCK(nf_log_lock);
-
-/* return EBUSY if somebody else is registered, EEXIST if the same logger
- * is registred, 0 on success. */
-int nf_log_register(int pf, struct nf_logger *logger)
-{
-	int ret = -EBUSY;
-
-	if (pf >= NPROTO)
-		return -EINVAL;
-
-	/* Any setup of logging members must be done before
-	 * substituting pointer. */
-	spin_lock(&nf_log_lock);
-	if (!nf_logging[pf]) {
-		rcu_assign_pointer(nf_logging[pf], logger);
-		ret = 0;
-	} else if (nf_logging[pf] == logger)
-		ret = -EEXIST;
-
-	spin_unlock(&nf_log_lock);
-	return ret;
-}		
-EXPORT_SYMBOL(nf_log_register);
-
-int nf_log_unregister_pf(int pf)
-{
-	if (pf >= NPROTO)
-		return -EINVAL;
-
-	spin_lock(&nf_log_lock);
-	nf_logging[pf] = NULL;
-	spin_unlock(&nf_log_lock);
-
-	/* Give time to concurrent readers. */
-	synchronize_net();
-
-	return 0;
-}
-EXPORT_SYMBOL(nf_log_unregister_pf);
-
-void nf_log_unregister_logger(struct nf_logger *logger)
-{
-	int i;
-
-	spin_lock(&nf_log_lock);
-	for (i = 0; i < NPROTO; i++) {
-		if (nf_logging[i] == logger)
-			nf_logging[i] = NULL;
-	}
-	spin_unlock(&nf_log_lock);
-
-	synchronize_net();
-}
-EXPORT_SYMBOL(nf_log_unregister_logger);
-
-void nf_log_packet(int pf,
-		   unsigned int hooknum,
-		   const struct sk_buff *skb,
-		   const struct net_device *in,
-		   const struct net_device *out,
-		   struct nf_loginfo *loginfo,
-		   const char *fmt, ...)
-{
-	va_list args;
-	char prefix[NF_LOG_PREFIXLEN];
-	struct nf_logger *logger;
-	
-	rcu_read_lock();
-	logger = rcu_dereference(nf_logging[pf]);
-	if (logger) {
-		va_start(args, fmt);
-		vsnprintf(prefix, sizeof(prefix), fmt, args);
-		va_end(args);
-		/* We must read logging before nf_logfn[pf] */
-		logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix);
-	} else if (net_ratelimit()) {
-		printk(KERN_WARNING "nf_log_packet: can\'t log since "
-		       "no backend logging module loaded in! Please either "
-		       "load one, or disable logging explicitly\n");
-	}
-	rcu_read_unlock();
-}
-EXPORT_SYMBOL(nf_log_packet);
-
-#ifdef CONFIG_PROC_FS
-static void *seq_start(struct seq_file *seq, loff_t *pos)
-{
-	rcu_read_lock();
-
-	if (*pos >= NPROTO)
-		return NULL;
-
-	return pos;
-}
-
-static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
-{
-	(*pos)++;
-
-	if (*pos >= NPROTO)
-		return NULL;
-
-	return pos;
-}
-
-static void seq_stop(struct seq_file *s, void *v)
-{
-	rcu_read_unlock();
-}
-
-static int seq_show(struct seq_file *s, void *v)
-{
-	loff_t *pos = v;
-	const struct nf_logger *logger;
-
-	logger = rcu_dereference(nf_logging[*pos]);
-
-	if (!logger)
-		return seq_printf(s, "%2lld NONE\n", *pos);
-	
-	return seq_printf(s, "%2lld %s\n", *pos, logger->name);
-}
-
-static struct seq_operations nflog_seq_ops = {
-	.start	= seq_start,
-	.next	= seq_next,
-	.stop	= seq_stop,
-	.show	= seq_show,
-};
-
-static int nflog_open(struct inode *inode, struct file *file)
-{
-	return seq_open(file, &nflog_seq_ops);
-}
-
-static struct file_operations nflog_file_ops = {
-	.owner	 = THIS_MODULE,
-	.open	 = nflog_open,
-	.read	 = seq_read,
-	.llseek	 = seq_lseek,
-	.release = seq_release,
-};
-
-#endif /* PROC_FS */
-
-
-int __init netfilter_log_init(void)
-{
-#ifdef CONFIG_PROC_FS
-	struct proc_dir_entry *pde;
-
-	pde = create_proc_entry("nf_log", S_IRUGO, proc_net_netfilter);
-	if (!pde)
-		return -1;
-
-	pde->proc_fops = &nflog_file_ops;
-#endif
-	return 0;
-}
diff --git a/trunk/net/netfilter/nf_queue.c b/trunk/net/netfilter/nf_queue.c
deleted file mode 100644
index d10d552d9c40..000000000000
--- a/trunk/net/netfilter/nf_queue.c
+++ /dev/null
@@ -1,343 +0,0 @@
-#include <linux/config.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/proc_fs.h>
-#include <linux/skbuff.h>
-#include <linux/netfilter.h>
-#include <linux/seq_file.h>
-#include <net/protocol.h>
-
-#include "nf_internals.h"
-
-/* 
- * A queue handler may be registered for each protocol.  Each is protected by
- * long term mutex.  The handler must provide an an outfn() to accept packets
- * for queueing and must reinject all packets it receives, no matter what.
- */
-static struct nf_queue_handler *queue_handler[NPROTO];
-static struct nf_queue_rerouter *queue_rerouter;
-
-static DEFINE_RWLOCK(queue_handler_lock);
-
-/* return EBUSY when somebody else is registered, return EEXIST if the
- * same handler is registered, return 0 in case of success. */
-int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
-{      
-	int ret;
-
-	if (pf >= NPROTO)
-		return -EINVAL;
-
-	write_lock_bh(&queue_handler_lock);
-	if (queue_handler[pf] == qh)
-		ret = -EEXIST;
-	else if (queue_handler[pf])
-		ret = -EBUSY;
-	else {
-		queue_handler[pf] = qh;
-		ret = 0;
-	}
-	write_unlock_bh(&queue_handler_lock);
-
-	return ret;
-}
-EXPORT_SYMBOL(nf_register_queue_handler);
-
-/* The caller must flush their queue before this */
-int nf_unregister_queue_handler(int pf)
-{
-	if (pf >= NPROTO)
-		return -EINVAL;
-
-	write_lock_bh(&queue_handler_lock);
-	queue_handler[pf] = NULL;
-	write_unlock_bh(&queue_handler_lock);
-	
-	return 0;
-}
-EXPORT_SYMBOL(nf_unregister_queue_handler);
-
-int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer)
-{
-	if (pf >= NPROTO)
-		return -EINVAL;
-
-	write_lock_bh(&queue_handler_lock);
-	memcpy(&queue_rerouter[pf], rer, sizeof(queue_rerouter[pf]));
-	write_unlock_bh(&queue_handler_lock);
-
-	return 0;
-}
-EXPORT_SYMBOL_GPL(nf_register_queue_rerouter);
-
-int nf_unregister_queue_rerouter(int pf)
-{
-	if (pf >= NPROTO)
-		return -EINVAL;
-
-	write_lock_bh(&queue_handler_lock);
-	memset(&queue_rerouter[pf], 0, sizeof(queue_rerouter[pf]));
-	write_unlock_bh(&queue_handler_lock);
-	return 0;
-}
-EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter);
-
-void nf_unregister_queue_handlers(struct nf_queue_handler *qh)
-{
-	int pf;
-
-	write_lock_bh(&queue_handler_lock);
-	for (pf = 0; pf < NPROTO; pf++)  {
-		if (queue_handler[pf] == qh)
-			queue_handler[pf] = NULL;
-	}
-	write_unlock_bh(&queue_handler_lock);
-}
-EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
-
-/* 
- * Any packet that leaves via this function must come back 
- * through nf_reinject().
- */
-int nf_queue(struct sk_buff **skb, 
-	     struct list_head *elem, 
-	     int pf, unsigned int hook,
-	     struct net_device *indev,
-	     struct net_device *outdev,
-	     int (*okfn)(struct sk_buff *),
-	     unsigned int queuenum)
-{
-	int status;
-	struct nf_info *info;
-#ifdef CONFIG_BRIDGE_NETFILTER
-	struct net_device *physindev = NULL;
-	struct net_device *physoutdev = NULL;
-#endif
-
-	/* QUEUE == DROP if noone is waiting, to be safe. */
-	read_lock(&queue_handler_lock);
-	if (!queue_handler[pf]->outfn) {
-		read_unlock(&queue_handler_lock);
-		kfree_skb(*skb);
-		return 1;
-	}
-
-	info = kmalloc(sizeof(*info)+queue_rerouter[pf].rer_size, GFP_ATOMIC);
-	if (!info) {
-		if (net_ratelimit())
-			printk(KERN_ERR "OOM queueing packet %p\n",
-			       *skb);
-		read_unlock(&queue_handler_lock);
-		kfree_skb(*skb);
-		return 1;
-	}
-
-	*info = (struct nf_info) { 
-		(struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
-
-	/* If it's going away, ignore hook. */
-	if (!try_module_get(info->elem->owner)) {
-		read_unlock(&queue_handler_lock);
-		kfree(info);
-		return 0;
-	}
-
-	/* Bump dev refs so they don't vanish while packet is out */
-	if (indev) dev_hold(indev);
-	if (outdev) dev_hold(outdev);
-
-#ifdef CONFIG_BRIDGE_NETFILTER
-	if ((*skb)->nf_bridge) {
-		physindev = (*skb)->nf_bridge->physindev;
-		if (physindev) dev_hold(physindev);
-		physoutdev = (*skb)->nf_bridge->physoutdev;
-		if (physoutdev) dev_hold(physoutdev);
-	}
-#endif
-	if (queue_rerouter[pf].save)
-		queue_rerouter[pf].save(*skb, info);
-
-	status = queue_handler[pf]->outfn(*skb, info, queuenum,
-					  queue_handler[pf]->data);
-
-	if (status >= 0 && queue_rerouter[pf].reroute)
-		status = queue_rerouter[pf].reroute(skb, info);
-
-	read_unlock(&queue_handler_lock);
-
-	if (status < 0) {
-		/* James M doesn't say fuck enough. */
-		if (indev) dev_put(indev);
-		if (outdev) dev_put(outdev);
-#ifdef CONFIG_BRIDGE_NETFILTER
-		if (physindev) dev_put(physindev);
-		if (physoutdev) dev_put(physoutdev);
-#endif
-		module_put(info->elem->owner);
-		kfree(info);
-		kfree_skb(*skb);
-
-		return 1;
-	}
-
-	return 1;
-}
-
-void nf_reinject(struct sk_buff *skb, struct nf_info *info,
-		 unsigned int verdict)
-{
-	struct list_head *elem = &info->elem->list;
-	struct list_head *i;
-
-	rcu_read_lock();
-
-	/* Release those devices we held, or Alexey will kill me. */
-	if (info->indev) dev_put(info->indev);
-	if (info->outdev) dev_put(info->outdev);
-#ifdef CONFIG_BRIDGE_NETFILTER
-	if (skb->nf_bridge) {
-		if (skb->nf_bridge->physindev)
-			dev_put(skb->nf_bridge->physindev);
-		if (skb->nf_bridge->physoutdev)
-			dev_put(skb->nf_bridge->physoutdev);
-	}
-#endif
-
-	/* Drop reference to owner of hook which queued us. */
-	module_put(info->elem->owner);
-
-	list_for_each_rcu(i, &nf_hooks[info->pf][info->hook]) {
-		if (i == elem) 
-  			break;
-  	}
-  
-	if (elem == &nf_hooks[info->pf][info->hook]) {
-		/* The module which sent it to userspace is gone. */
-		NFDEBUG("%s: module disappeared, dropping packet.\n",
-			__FUNCTION__);
-		verdict = NF_DROP;
-	}
-
-	/* Continue traversal iff userspace said ok... */
-	if (verdict == NF_REPEAT) {
-		elem = elem->prev;
-		verdict = NF_ACCEPT;
-	}
-
-	if (verdict == NF_ACCEPT) {
-	next_hook:
-		verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
-				     &skb, info->hook, 
-				     info->indev, info->outdev, &elem,
-				     info->okfn, INT_MIN);
-	}
-
-	switch (verdict & NF_VERDICT_MASK) {
-	case NF_ACCEPT:
-		info->okfn(skb);
-		break;
-
-	case NF_QUEUE:
-		if (!nf_queue(&skb, elem, info->pf, info->hook, 
-			      info->indev, info->outdev, info->okfn,
-			      verdict >> NF_VERDICT_BITS))
-			goto next_hook;
-		break;
-	}
-	rcu_read_unlock();
-
-	if (verdict == NF_DROP)
-		kfree_skb(skb);
-
-	kfree(info);
-	return;
-}
-EXPORT_SYMBOL(nf_reinject);
-
-#ifdef CONFIG_PROC_FS
-static void *seq_start(struct seq_file *seq, loff_t *pos)
-{
-	if (*pos >= NPROTO)
-		return NULL;
-
-	return pos;
-}
-
-static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
-{
-	(*pos)++;
-
-	if (*pos >= NPROTO)
-		return NULL;
-
-	return pos;
-}
-
-static void seq_stop(struct seq_file *s, void *v)
-{
-
-}
-
-static int seq_show(struct seq_file *s, void *v)
-{
-	int ret;
-	loff_t *pos = v;
-	struct nf_queue_handler *qh;
-
-	read_lock_bh(&queue_handler_lock);
-	qh = queue_handler[*pos];
-	if (!qh)
-		ret = seq_printf(s, "%2lld NONE\n", *pos);
-	else
-		ret = seq_printf(s, "%2lld %s\n", *pos, qh->name);
-	read_unlock_bh(&queue_handler_lock);
-
-	return ret;
-}
-
-static struct seq_operations nfqueue_seq_ops = {
-	.start	= seq_start,
-	.next	= seq_next,
-	.stop	= seq_stop,
-	.show	= seq_show,
-};
-
-static int nfqueue_open(struct inode *inode, struct file *file)
-{
-	return seq_open(file, &nfqueue_seq_ops);
-}
-
-static struct file_operations nfqueue_file_ops = {
-	.owner	 = THIS_MODULE,
-	.open	 = nfqueue_open,
-	.read	 = seq_read,
-	.llseek	 = seq_lseek,
-	.release = seq_release,
-};
-#endif /* PROC_FS */
-
-
-int __init netfilter_queue_init(void)
-{
-#ifdef CONFIG_PROC_FS
-	struct proc_dir_entry *pde;
-#endif
-	queue_rerouter = kmalloc(NPROTO * sizeof(struct nf_queue_rerouter),
-				 GFP_KERNEL);
-	if (!queue_rerouter)
-		return -ENOMEM;
-
-#ifdef CONFIG_PROC_FS
-	pde = create_proc_entry("nf_queue", S_IRUGO, proc_net_netfilter);
-	if (!pde) {
-		kfree(queue_rerouter);
-		return -1;
-	}
-	pde->proc_fops = &nfqueue_file_ops;
-#endif
-	memset(queue_rerouter, 0, NPROTO * sizeof(struct nf_queue_rerouter));
-
-	return 0;
-}
-
diff --git a/trunk/net/netfilter/nf_sockopt.c b/trunk/net/netfilter/nf_sockopt.c
deleted file mode 100644
index 61a833a9caa6..000000000000
--- a/trunk/net/netfilter/nf_sockopt.c
+++ /dev/null
@@ -1,132 +0,0 @@
-#include <linux/config.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/netfilter.h>
-#include <net/sock.h>
-
-#include "nf_internals.h"
-
-/* Sockopts only registered and called from user context, so
-   net locking would be overkill.  Also, [gs]etsockopt calls may
-   sleep. */
-static DECLARE_MUTEX(nf_sockopt_mutex);
-static LIST_HEAD(nf_sockopts);
-
-/* Do exclusive ranges overlap? */
-static inline int overlap(int min1, int max1, int min2, int max2)
-{
-	return max1 > min2 && min1 < max2;
-}
-
-/* Functions to register sockopt ranges (exclusive). */
-int nf_register_sockopt(struct nf_sockopt_ops *reg)
-{
-	struct list_head *i;
-	int ret = 0;
-
-	if (down_interruptible(&nf_sockopt_mutex) != 0)
-		return -EINTR;
-
-	list_for_each(i, &nf_sockopts) {
-		struct nf_sockopt_ops *ops = (struct nf_sockopt_ops *)i;
-		if (ops->pf == reg->pf
-		    && (overlap(ops->set_optmin, ops->set_optmax, 
-				reg->set_optmin, reg->set_optmax)
-			|| overlap(ops->get_optmin, ops->get_optmax, 
-				   reg->get_optmin, reg->get_optmax))) {
-			NFDEBUG("nf_sock overlap: %u-%u/%u-%u v %u-%u/%u-%u\n",
-				ops->set_optmin, ops->set_optmax, 
-				ops->get_optmin, ops->get_optmax, 
-				reg->set_optmin, reg->set_optmax,
-				reg->get_optmin, reg->get_optmax);
-			ret = -EBUSY;
-			goto out;
-		}
-	}
-
-	list_add(&reg->list, &nf_sockopts);
-out:
-	up(&nf_sockopt_mutex);
-	return ret;
-}
-EXPORT_SYMBOL(nf_register_sockopt);
-
-void nf_unregister_sockopt(struct nf_sockopt_ops *reg)
-{
-	/* No point being interruptible: we're probably in cleanup_module() */
- restart:
-	down(&nf_sockopt_mutex);
-	if (reg->use != 0) {
-		/* To be woken by nf_sockopt call... */
-		/* FIXME: Stuart Young's name appears gratuitously. */
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		reg->cleanup_task = current;
-		up(&nf_sockopt_mutex);
-		schedule();
-		goto restart;
-	}
-	list_del(&reg->list);
-	up(&nf_sockopt_mutex);
-}
-EXPORT_SYMBOL(nf_unregister_sockopt);
-
-/* Call get/setsockopt() */
-static int nf_sockopt(struct sock *sk, int pf, int val, 
-		      char __user *opt, int *len, int get)
-{
-	struct list_head *i;
-	struct nf_sockopt_ops *ops;
-	int ret;
-
-	if (down_interruptible(&nf_sockopt_mutex) != 0)
-		return -EINTR;
-
-	list_for_each(i, &nf_sockopts) {
-		ops = (struct nf_sockopt_ops *)i;
-		if (ops->pf == pf) {
-			if (get) {
-				if (val >= ops->get_optmin
-				    && val < ops->get_optmax) {
-					ops->use++;
-					up(&nf_sockopt_mutex);
-					ret = ops->get(sk, val, opt, len);
-					goto out;
-				}
-			} else {
-				if (val >= ops->set_optmin
-				    && val < ops->set_optmax) {
-					ops->use++;
-					up(&nf_sockopt_mutex);
-					ret = ops->set(sk, val, opt, *len);
-					goto out;
-				}
-			}
-		}
-	}
-	up(&nf_sockopt_mutex);
-	return -ENOPROTOOPT;
-	
- out:
-	down(&nf_sockopt_mutex);
-	ops->use--;
-	if (ops->cleanup_task)
-		wake_up_process(ops->cleanup_task);
-	up(&nf_sockopt_mutex);
-	return ret;
-}
-
-int nf_setsockopt(struct sock *sk, int pf, int val, char __user *opt,
-		  int len)
-{
-	return nf_sockopt(sk, pf, val, opt, &len, 0);
-}
-EXPORT_SYMBOL(nf_setsockopt);
-
-int nf_getsockopt(struct sock *sk, int pf, int val, char __user *opt, int *len)
-{
-	return nf_sockopt(sk, pf, val, opt, len, 1);
-}
-EXPORT_SYMBOL(nf_getsockopt);
-
diff --git a/trunk/net/netfilter/nfnetlink.c b/trunk/net/netfilter/nfnetlink.c
deleted file mode 100644
index e089f17bb803..000000000000
--- a/trunk/net/netfilter/nfnetlink.c
+++ /dev/null
@@ -1,376 +0,0 @@
-/* Netfilter messages via netlink socket. Allows for user space
- * protocol helpers and general trouble making from userspace.
- *
- * (C) 2001 by Jay Schulist <jschlst@samba.org>,
- * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
- * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
- *
- * Initial netfilter messages via netlink development funded and
- * generally made possible by Network Robots, Inc. (www.networkrobots.com)
- *
- * Further development of this code funded by Astaro AG (http://www.astaro.com)
- *
- * This software may be used and distributed according to the terms
- * of the GNU General Public License, incorporated herein by reference.
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/socket.h>
-#include <linux/kernel.h>
-#include <linux/major.h>
-#include <linux/sched.h>
-#include <linux/timer.h>
-#include <linux/string.h>
-#include <linux/sockios.h>
-#include <linux/net.h>
-#include <linux/fcntl.h>
-#include <linux/skbuff.h>
-#include <asm/uaccess.h>
-#include <asm/system.h>
-#include <net/sock.h>
-#include <linux/init.h>
-#include <linux/spinlock.h>
-
-#include <linux/netfilter.h>
-#include <linux/netlink.h>
-#include <linux/netfilter/nfnetlink.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NETFILTER);
-
-static char __initdata nfversion[] = "0.30";
-
-#if 0
-#define DEBUGP(format, args...)	\
-		printk(KERN_DEBUG "%s(%d):%s(): " format, __FILE__, \
-			__LINE__, __FUNCTION__, ## args)
-#else
-#define DEBUGP(format, args...)
-#endif
-
-static struct sock *nfnl = NULL;
-static struct nfnetlink_subsystem *subsys_table[NFNL_SUBSYS_COUNT];
-DECLARE_MUTEX(nfnl_sem);
-
-void nfnl_lock(void)
-{
-	nfnl_shlock();
-}
-
-void nfnl_unlock(void)
-{
-	nfnl_shunlock();
-}
-
-int nfnetlink_subsys_register(struct nfnetlink_subsystem *n)
-{
-	DEBUGP("registering subsystem ID %u\n", n->subsys_id);
-
-	nfnl_lock();
-	if (subsys_table[n->subsys_id]) {
-		nfnl_unlock();
-		return -EBUSY;
-	}
-	subsys_table[n->subsys_id] = n;
-	nfnl_unlock();
-
-	return 0;
-}
-
-int nfnetlink_subsys_unregister(struct nfnetlink_subsystem *n)
-{
-	DEBUGP("unregistering subsystem ID %u\n", n->subsys_id);
-
-	nfnl_lock();
-	subsys_table[n->subsys_id] = NULL;
-	nfnl_unlock();
-
-	return 0;
-}
-
-static inline struct nfnetlink_subsystem *nfnetlink_get_subsys(u_int16_t type)
-{
-	u_int8_t subsys_id = NFNL_SUBSYS_ID(type);
-
-	if (subsys_id >= NFNL_SUBSYS_COUNT
-	    || subsys_table[subsys_id] == NULL)
-		return NULL;
-
-	return subsys_table[subsys_id];
-}
-
-static inline struct nfnl_callback *
-nfnetlink_find_client(u_int16_t type, struct nfnetlink_subsystem *ss)
-{
-	u_int8_t cb_id = NFNL_MSG_TYPE(type);
-	
-	if (cb_id >= ss->cb_count) {
-		DEBUGP("msgtype %u >= %u, returning\n", type, ss->cb_count);
-		return NULL;
-	}
-
-	return &ss->cb[cb_id];
-}
-
-void __nfa_fill(struct sk_buff *skb, int attrtype, int attrlen,
-		const void *data)
-{
-	struct nfattr *nfa;
-	int size = NFA_LENGTH(attrlen);
-
-	nfa = (struct nfattr *)skb_put(skb, NFA_ALIGN(size));
-	nfa->nfa_type = attrtype;
-	nfa->nfa_len  = size;
-	memcpy(NFA_DATA(nfa), data, attrlen);
-	memset(NFA_DATA(nfa) + attrlen, 0, NFA_ALIGN(size) - size);
-}
-
-int nfattr_parse(struct nfattr *tb[], int maxattr, struct nfattr *nfa, int len)
-{
-	memset(tb, 0, sizeof(struct nfattr *) * maxattr);
-
-	while (NFA_OK(nfa, len)) {
-		unsigned flavor = nfa->nfa_type;
-		if (flavor && flavor <= maxattr)
-			tb[flavor-1] = nfa;
-		nfa = NFA_NEXT(nfa, len);
-	}
-
-	return 0;
-}
-
-/**
- * nfnetlink_check_attributes - check and parse nfnetlink attributes
- *
- * subsys: nfnl subsystem for which this message is to be parsed
- * nlmsghdr: netlink message to be checked/parsed
- * cda: array of pointers, needs to be at least subsys->attr_count big
- *
- */
-static int
-nfnetlink_check_attributes(struct nfnetlink_subsystem *subsys,
-			   struct nlmsghdr *nlh, struct nfattr *cda[])
-{
-	int min_len;
-	u_int16_t attr_count;
-	u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type);
-
-	if (unlikely(cb_id >= subsys->cb_count)) {
-		DEBUGP("msgtype %u >= %u, returning\n",
-			cb_id, subsys->cb_count);
-		return -EINVAL;
-	}
-
-	min_len = NLMSG_ALIGN(sizeof(struct nfgenmsg));
-	if (unlikely(nlh->nlmsg_len < min_len))
-		return -EINVAL;
-
-	attr_count = subsys->cb[cb_id].attr_count;
-	memset(cda, 0, sizeof(struct nfattr *) * attr_count);
-
-	/* check attribute lengths. */
-	if (likely(nlh->nlmsg_len > min_len)) {
-		struct nfattr *attr = NFM_NFA(NLMSG_DATA(nlh));
-		int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);
-
-		while (NFA_OK(attr, attrlen)) {
-			unsigned flavor = attr->nfa_type;
-			if (flavor) {
-				if (flavor > attr_count)
-					return -EINVAL;
-				cda[flavor - 1] = attr;
-			}
-			attr = NFA_NEXT(attr, attrlen);
-		}
-	}
-
-	/* implicit: if nlmsg_len == min_len, we return 0, and an empty
-	 * (zeroed) cda[] array. The message is valid, but empty. */
-
-        return 0;
-}
-
-int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, int echo)
-{
-	int allocation = in_interrupt() ? GFP_ATOMIC : GFP_KERNEL;
-	int err = 0;
-
-	NETLINK_CB(skb).dst_group = group;
-	if (echo)
-		atomic_inc(&skb->users);
-	netlink_broadcast(nfnl, skb, pid, group, allocation);
-	if (echo)
-		err = netlink_unicast(nfnl, skb, pid, MSG_DONTWAIT);
-
-	return err;
-}
-
-int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags)
-{
-	return netlink_unicast(nfnl, skb, pid, flags);
-}
-
-/* Process one complete nfnetlink message. */
-static inline int nfnetlink_rcv_msg(struct sk_buff *skb,
-				    struct nlmsghdr *nlh, int *errp)
-{
-	struct nfnl_callback *nc;
-	struct nfnetlink_subsystem *ss;
-	int type, err = 0;
-
-	DEBUGP("entered; subsys=%u, msgtype=%u\n",
-		 NFNL_SUBSYS_ID(nlh->nlmsg_type),
-		 NFNL_MSG_TYPE(nlh->nlmsg_type));
-
-	/* Only requests are handled by kernel now. */
-	if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) {
-		DEBUGP("received non-request message\n");
-		return 0;
-	}
-
-	/* All the messages must at least contain nfgenmsg */
-	if (nlh->nlmsg_len < 
-			NLMSG_LENGTH(NLMSG_ALIGN(sizeof(struct nfgenmsg)))) {
-		DEBUGP("received message was too short\n");
-		return 0;
-	}
-
-	type = nlh->nlmsg_type;
-	ss = nfnetlink_get_subsys(type);
-	if (!ss) {
-#ifdef CONFIG_KMOD
-		/* don't call nfnl_shunlock, since it would reenter
-		 * with further packet processing */
-		up(&nfnl_sem);
-		request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type));
-		nfnl_shlock();
-		ss = nfnetlink_get_subsys(type);
-		if (!ss)
-#endif
-		goto err_inval;
-	}
-
-	nc = nfnetlink_find_client(type, ss);
-	if (!nc) {
-		DEBUGP("unable to find client for type %d\n", type);
-		goto err_inval;
-	}
-
-	if (nc->cap_required && 
-	    !cap_raised(NETLINK_CB(skb).eff_cap, nc->cap_required)) {
-		DEBUGP("permission denied for type %d\n", type);
-		*errp = -EPERM;
-		return -1;
-	}
-
-	{
-		u_int16_t attr_count = 
-			ss->cb[NFNL_MSG_TYPE(nlh->nlmsg_type)].attr_count;
-		struct nfattr *cda[attr_count];
-
-		memset(cda, 0, sizeof(struct nfattr *) * attr_count);
-		
-		err = nfnetlink_check_attributes(ss, nlh, cda);
-		if (err < 0)
-			goto err_inval;
-
-		DEBUGP("calling handler\n");
-		err = nc->call(nfnl, skb, nlh, cda, errp);
-		*errp = err;
-		return err;
-	}
-
-err_inval:
-	DEBUGP("returning -EINVAL\n");
-	*errp = -EINVAL;
-	return -1;
-}
-
-/* Process one packet of messages. */
-static inline int nfnetlink_rcv_skb(struct sk_buff *skb)
-{
-	int err;
-	struct nlmsghdr *nlh;
-
-	while (skb->len >= NLMSG_SPACE(0)) {
-		u32 rlen;
-
-		nlh = (struct nlmsghdr *)skb->data;
-		if (nlh->nlmsg_len < sizeof(struct nlmsghdr)
-		    || skb->len < nlh->nlmsg_len)
-			return 0;
-		rlen = NLMSG_ALIGN(nlh->nlmsg_len);
-		if (rlen > skb->len)
-			rlen = skb->len;
-		if (nfnetlink_rcv_msg(skb, nlh, &err)) {
-			if (!err)
-				return -1;
-			netlink_ack(skb, nlh, err);
-		} else
-			if (nlh->nlmsg_flags & NLM_F_ACK)
-				netlink_ack(skb, nlh, 0);
-		skb_pull(skb, rlen);
-	}
-
-	return 0;
-}
-
-static void nfnetlink_rcv(struct sock *sk, int len)
-{
-	do {
-		struct sk_buff *skb;
-
-		if (nfnl_shlock_nowait())
-			return;
-
-		while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-			if (nfnetlink_rcv_skb(skb)) {
-				if (skb->len)
-					skb_queue_head(&sk->sk_receive_queue,
-						       skb);
-				else
-					kfree_skb(skb);
-				break;
-			}
-			kfree_skb(skb);
-		}
-
-		/* don't call nfnl_shunlock, since it would reenter
-		 * with further packet processing */
-		up(&nfnl_sem);
-	} while(nfnl && nfnl->sk_receive_queue.qlen);
-}
-
-void __exit nfnetlink_exit(void)
-{
-	printk("Removing netfilter NETLINK layer.\n");
-	sock_release(nfnl->sk_socket);
-	return;
-}
-
-int __init nfnetlink_init(void)
-{
-	printk("Netfilter messages via NETLINK v%s.\n", nfversion);
-
-	nfnl = netlink_kernel_create(NETLINK_NETFILTER, NFNLGRP_MAX,
-	                             nfnetlink_rcv, THIS_MODULE);
-	if (!nfnl) {
-		printk(KERN_ERR "cannot initialize nfnetlink!\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-module_init(nfnetlink_init);
-module_exit(nfnetlink_exit);
-
-EXPORT_SYMBOL_GPL(nfnetlink_subsys_register);
-EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister);
-EXPORT_SYMBOL_GPL(nfnetlink_send);
-EXPORT_SYMBOL_GPL(nfnetlink_unicast);
-EXPORT_SYMBOL_GPL(nfattr_parse);
-EXPORT_SYMBOL_GPL(__nfa_fill);
diff --git a/trunk/net/netfilter/nfnetlink_log.c b/trunk/net/netfilter/nfnetlink_log.c
deleted file mode 100644
index ff5601ceedcb..000000000000
--- a/trunk/net/netfilter/nfnetlink_log.c
+++ /dev/null
@@ -1,1055 +0,0 @@
-/*
- * This is a module which is used for logging packets to userspace via
- * nfetlink.
- *
- * (C) 2005 by Harald Welte <laforge@netfilter.org>
- *
- * Based on the old ipv4-only ipt_ULOG.c:
- * (C) 2000-2004 by Harald Welte <laforge@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/init.h>
-#include <linux/ip.h>
-#include <linux/ipv6.h>
-#include <linux/netdevice.h>
-#include <linux/netfilter.h>
-#include <linux/netlink.h>
-#include <linux/netfilter/nfnetlink.h>
-#include <linux/netfilter/nfnetlink_log.h>
-#include <linux/spinlock.h>
-#include <linux/sysctl.h>
-#include <linux/proc_fs.h>
-#include <linux/security.h>
-#include <linux/list.h>
-#include <linux/jhash.h>
-#include <linux/random.h>
-#include <net/sock.h>
-
-#include <asm/atomic.h>
-
-#ifdef CONFIG_BRIDGE_NETFILTER
-#include "../bridge/br_private.h"
-#endif
-
-#define NFULNL_NLBUFSIZ_DEFAULT	4096
-#define NFULNL_TIMEOUT_DEFAULT 	100	/* every second */
-#define NFULNL_QTHRESH_DEFAULT 	100	/* 100 packets */
-
-#define PRINTR(x, args...)	do { if (net_ratelimit()) \
-				     printk(x, ## args); } while (0);
-
-#if 0
-#define UDEBUG(x, args ...)	printk(KERN_DEBUG "%s(%d):%s():	" x, 	   \
-					__FILE__, __LINE__, __FUNCTION__,  \
-					## args)
-#else
-#define UDEBUG(x, ...)
-#endif
-
-struct nfulnl_instance {
-	struct hlist_node hlist;	/* global list of instances */
-	spinlock_t lock;
-	atomic_t use;			/* use count */
-
-	unsigned int qlen;		/* number of nlmsgs in skb */
-	struct sk_buff *skb;		/* pre-allocatd skb */
-	struct nlmsghdr *lastnlh;	/* netlink header of last msg in skb */
-	struct timer_list timer;
-	int peer_pid;			/* PID of the peer process */
-
-	/* configurable parameters */
-	unsigned int flushtimeout;	/* timeout until queue flush */
-	unsigned int nlbufsiz;		/* netlink buffer allocation size */
-	unsigned int qthreshold;	/* threshold of the queue */
-	u_int32_t copy_range;
-	u_int16_t group_num;		/* number of this queue */
-	u_int8_t copy_mode;	
-};
-
-static DEFINE_RWLOCK(instances_lock);
-
-#define INSTANCE_BUCKETS	16
-static struct hlist_head instance_table[INSTANCE_BUCKETS];
-static unsigned int hash_init;
-
-static inline u_int8_t instance_hashfn(u_int16_t group_num)
-{
-	return ((group_num & 0xff) % INSTANCE_BUCKETS);
-}
-
-static struct nfulnl_instance *
-__instance_lookup(u_int16_t group_num)
-{
-	struct hlist_head *head;
-	struct hlist_node *pos;
-	struct nfulnl_instance *inst;
-
-	UDEBUG("entering (group_num=%u)\n", group_num);
-
-	head = &instance_table[instance_hashfn(group_num)];
-	hlist_for_each_entry(inst, pos, head, hlist) {
-		if (inst->group_num == group_num)
-			return inst;
-	}
-	return NULL;
-}
-
-static inline void
-instance_get(struct nfulnl_instance *inst)
-{
-	atomic_inc(&inst->use);
-}
-
-static struct nfulnl_instance *
-instance_lookup_get(u_int16_t group_num)
-{
-	struct nfulnl_instance *inst;
-
-	read_lock_bh(&instances_lock);
-	inst = __instance_lookup(group_num);
-	if (inst)
-		instance_get(inst);
-	read_unlock_bh(&instances_lock);
-
-	return inst;
-}
-
-static void
-instance_put(struct nfulnl_instance *inst)
-{
-	if (inst && atomic_dec_and_test(&inst->use)) {
-		UDEBUG("kfree(inst=%p)\n", inst);
-		kfree(inst);
-	}
-}
-
-static void nfulnl_timer(unsigned long data);
-
-static struct nfulnl_instance *
-instance_create(u_int16_t group_num, int pid)
-{
-	struct nfulnl_instance *inst;
-
-	UDEBUG("entering (group_num=%u, pid=%d)\n", group_num,
-		pid);
-
-	write_lock_bh(&instances_lock);	
-	if (__instance_lookup(group_num)) {
-		inst = NULL;
-		UDEBUG("aborting, instance already exists\n");
-		goto out_unlock;
-	}
-
-	inst = kmalloc(sizeof(*inst), GFP_ATOMIC);
-	if (!inst)
-		goto out_unlock;
-
-	memset(inst, 0, sizeof(*inst));
-	INIT_HLIST_NODE(&inst->hlist);
-	inst->lock = SPIN_LOCK_UNLOCKED;
-	/* needs to be two, since we _put() after creation */
-	atomic_set(&inst->use, 2);
-
-	init_timer(&inst->timer);
-	inst->timer.function = nfulnl_timer;
-	inst->timer.data = (unsigned long)inst;
-	/* don't start timer yet. (re)start it  with every packet */
-
-	inst->peer_pid = pid;
-	inst->group_num = group_num;
-
-	inst->qthreshold 	= NFULNL_QTHRESH_DEFAULT;
-	inst->flushtimeout 	= NFULNL_TIMEOUT_DEFAULT;
-	inst->nlbufsiz 		= NFULNL_NLBUFSIZ_DEFAULT;
-	inst->copy_mode 	= NFULNL_COPY_PACKET;
-	inst->copy_range 	= 0xffff;
-
-	if (!try_module_get(THIS_MODULE))
-		goto out_free;
-
-	hlist_add_head(&inst->hlist, 
-		       &instance_table[instance_hashfn(group_num)]);
-
-	UDEBUG("newly added node: %p, next=%p\n", &inst->hlist, 
-		inst->hlist.next);
-
-	write_unlock_bh(&instances_lock);
-
-	return inst;
-
-out_free:
-	instance_put(inst);
-out_unlock:
-	write_unlock_bh(&instances_lock);
-	return NULL;
-}
-
-static int __nfulnl_send(struct nfulnl_instance *inst);
-
-static void
-_instance_destroy2(struct nfulnl_instance *inst, int lock)
-{
-	/* first pull it out of the global list */
-	if (lock)
-		write_lock_bh(&instances_lock);
-
-	UDEBUG("removing instance %p (queuenum=%u) from hash\n",
-		inst, inst->group_num);
-
-	hlist_del(&inst->hlist);
-
-	if (lock)
-		write_unlock_bh(&instances_lock);
-
-	/* then flush all pending packets from skb */
-
-	spin_lock_bh(&inst->lock);
-	if (inst->skb) {
-		if (inst->qlen)
-			__nfulnl_send(inst);
-		if (inst->skb) {
-			kfree_skb(inst->skb);
-			inst->skb = NULL;
-		}
-	}
-	spin_unlock_bh(&inst->lock);
-
-	/* and finally put the refcount */
-	instance_put(inst);
-
-	module_put(THIS_MODULE);
-}
-
-static inline void
-__instance_destroy(struct nfulnl_instance *inst)
-{
-	_instance_destroy2(inst, 0);
-}
-
-static inline void
-instance_destroy(struct nfulnl_instance *inst)
-{
-	_instance_destroy2(inst, 1);
-}
-
-static int
-nfulnl_set_mode(struct nfulnl_instance *inst, u_int8_t mode,
-		  unsigned int range)
-{
-	int status = 0;
-
-	spin_lock_bh(&inst->lock);
-	
-	switch (mode) {
-	case NFULNL_COPY_NONE:
-	case NFULNL_COPY_META:
-		inst->copy_mode = mode;
-		inst->copy_range = 0;
-		break;
-		
-	case NFULNL_COPY_PACKET:
-		inst->copy_mode = mode;
-		/* we're using struct nfattr which has 16bit nfa_len */
-		if (range > 0xffff)
-			inst->copy_range = 0xffff;
-		else
-			inst->copy_range = range;
-		break;
-		
-	default:
-		status = -EINVAL;
-		break;
-	}
-
-	spin_unlock_bh(&inst->lock);
-
-	return status;
-}
-
-static int
-nfulnl_set_nlbufsiz(struct nfulnl_instance *inst, u_int32_t nlbufsiz)
-{
-	int status;
-
-	spin_lock_bh(&inst->lock);
-	if (nlbufsiz < NFULNL_NLBUFSIZ_DEFAULT)
-		status = -ERANGE;
-	else if (nlbufsiz > 131072)
-		status = -ERANGE;
-	else {
-		inst->nlbufsiz = nlbufsiz;
-		status = 0;
-	}
-	spin_unlock_bh(&inst->lock);
-
-	return status;
-}
-
-static int
-nfulnl_set_timeout(struct nfulnl_instance *inst, u_int32_t timeout)
-{
-	spin_lock_bh(&inst->lock);
-	inst->flushtimeout = timeout;
-	spin_unlock_bh(&inst->lock);
-
-	return 0;
-}
-
-static int
-nfulnl_set_qthresh(struct nfulnl_instance *inst, u_int32_t qthresh)
-{
-	spin_lock_bh(&inst->lock);
-	inst->qthreshold = qthresh;
-	spin_unlock_bh(&inst->lock);
-
-	return 0;
-}
-
-static struct sk_buff *nfulnl_alloc_skb(unsigned int inst_size, 
-					unsigned int pkt_size)
-{
-	struct sk_buff *skb;
-
-	UDEBUG("entered (%u, %u)\n", inst_size, pkt_size);
-
-	/* alloc skb which should be big enough for a whole multipart
-	 * message.  WARNING: has to be <= 128k due to slab restrictions */
-
-	skb = alloc_skb(inst_size, GFP_ATOMIC);
-	if (!skb) {
-		PRINTR("nfnetlink_log: can't alloc whole buffer (%u bytes)\n",
-			inst_size);
-
-		/* try to allocate only as much as we need for current
-		 * packet */
-
-		skb = alloc_skb(pkt_size, GFP_ATOMIC);
-		if (!skb)
-			PRINTR("nfnetlink_log: can't even alloc %u bytes\n",
-				pkt_size);
-	}
-
-	return skb;
-}
-
-static int
-__nfulnl_send(struct nfulnl_instance *inst)
-{
-	int status;
-
-	if (timer_pending(&inst->timer))
-		del_timer(&inst->timer);
-
-	if (inst->qlen > 1)
-		inst->lastnlh->nlmsg_type = NLMSG_DONE;
-
-	status = nfnetlink_unicast(inst->skb, inst->peer_pid, MSG_DONTWAIT);
-	if (status < 0) {
-		UDEBUG("netlink_unicast() failed\n");
-		/* FIXME: statistics */
-	}
-
-	inst->qlen = 0;
-	inst->skb = NULL;
-	inst->lastnlh = NULL;
-
-	return status;
-}
-
-static void nfulnl_timer(unsigned long data)
-{
-	struct nfulnl_instance *inst = (struct nfulnl_instance *)data; 
-
-	UDEBUG("timer function called, flushing buffer\n");
-
-	spin_lock_bh(&inst->lock);
-	__nfulnl_send(inst);
-	instance_put(inst);
-	spin_unlock_bh(&inst->lock);
-}
-
-static inline int 
-__build_packet_message(struct nfulnl_instance *inst,
-			const struct sk_buff *skb, 
-			unsigned int data_len,
-			unsigned int pf,
-			unsigned int hooknum,
-			const struct net_device *indev,
-			const struct net_device *outdev,
-			const struct nf_loginfo *li,
-			const char *prefix)
-{
-	unsigned char *old_tail;
-	struct nfulnl_msg_packet_hdr pmsg;
-	struct nlmsghdr *nlh;
-	struct nfgenmsg *nfmsg;
-	u_int32_t tmp_uint;
-
-	UDEBUG("entered\n");
-		
-	old_tail = inst->skb->tail;
-	nlh = NLMSG_PUT(inst->skb, 0, 0, 
-			NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
-			sizeof(struct nfgenmsg));
-	nfmsg = NLMSG_DATA(nlh);
-	nfmsg->nfgen_family = pf;
-	nfmsg->version = NFNETLINK_V0;
-	nfmsg->res_id = htons(inst->group_num);
-
-	pmsg.hw_protocol	= htons(skb->protocol);
-	pmsg.hook		= hooknum;
-
-	NFA_PUT(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg);
-
-	if (prefix) {
-		int slen = strlen(prefix);
-		if (slen > NFULNL_PREFIXLEN)
-			slen = NFULNL_PREFIXLEN;
-		NFA_PUT(inst->skb, NFULA_PREFIX, slen, prefix);
-	}
-
-	if (indev) {
-		tmp_uint = htonl(indev->ifindex);
-#ifndef CONFIG_BRIDGE_NETFILTER
-		NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV, sizeof(tmp_uint),
-			&tmp_uint);
-#else
-		if (pf == PF_BRIDGE) {
-			/* Case 1: outdev is physical input device, we need to
-			 * look for bridge group (when called from
-			 * netfilter_bridge) */
-			NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
-				sizeof(tmp_uint), &tmp_uint);
-			/* this is the bridge group "brX" */
-			tmp_uint = htonl(indev->br_port->br->dev->ifindex);
-			NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
-				sizeof(tmp_uint), &tmp_uint);
-		} else {
-			/* Case 2: indev is bridge group, we need to look for
-			 * physical device (when called from ipv4) */
-			NFA_PUT(inst->skb, NFULA_IFINDEX_INDEV,
-				sizeof(tmp_uint), &tmp_uint);
-			if (skb->nf_bridge && skb->nf_bridge->physindev) {
-				tmp_uint = 
-				    htonl(skb->nf_bridge->physindev->ifindex);
-				NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSINDEV,
-					sizeof(tmp_uint), &tmp_uint);
-			}
-		}
-#endif
-	}
-
-	if (outdev) {
-		tmp_uint = htonl(outdev->ifindex);
-#ifndef CONFIG_BRIDGE_NETFILTER
-		NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV, sizeof(tmp_uint),
-			&tmp_uint);
-#else
-		if (pf == PF_BRIDGE) {
-			/* Case 1: outdev is physical output device, we need to
-			 * look for bridge group (when called from
-			 * netfilter_bridge) */
-			NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
-				sizeof(tmp_uint), &tmp_uint);
-			/* this is the bridge group "brX" */
-			tmp_uint = htonl(outdev->br_port->br->dev->ifindex);
-			NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
-				sizeof(tmp_uint), &tmp_uint);
-		} else {
-			/* Case 2: indev is a bridge group, we need to look
-			 * for physical device (when called from ipv4) */
-			NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
-				sizeof(tmp_uint), &tmp_uint);
-			if (skb->nf_bridge) {
-				tmp_uint = 
-				    htonl(skb->nf_bridge->physoutdev->ifindex);
-				NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
-					sizeof(tmp_uint), &tmp_uint);
-			}
-		}
-#endif
-	}
-
-	if (skb->nfmark) {
-		tmp_uint = htonl(skb->nfmark);
-		NFA_PUT(inst->skb, NFULA_MARK, sizeof(tmp_uint), &tmp_uint);
-	}
-
-	if (indev && skb->dev && skb->dev->hard_header_parse) {
-		struct nfulnl_msg_packet_hw phw;
-
-		phw.hw_addrlen = 
-			skb->dev->hard_header_parse((struct sk_buff *)skb, 
-						    phw.hw_addr);
-		phw.hw_addrlen = htons(phw.hw_addrlen);
-		NFA_PUT(inst->skb, NFULA_HWADDR, sizeof(phw), &phw);
-	}
-
-	if (skb->tstamp.off_sec) {
-		struct nfulnl_msg_packet_timestamp ts;
-
-		ts.sec = cpu_to_be64(skb_tv_base.tv_sec + skb->tstamp.off_sec);
-		ts.usec = cpu_to_be64(skb_tv_base.tv_usec + skb->tstamp.off_usec);
-
-		NFA_PUT(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts);
-	}
-
-	/* UID */
-	if (skb->sk) {
-		read_lock_bh(&skb->sk->sk_callback_lock);
-		if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
-			u_int32_t uid = htonl(skb->sk->sk_socket->file->f_uid);
-			/* need to unlock here since NFA_PUT may goto */
-			read_unlock_bh(&skb->sk->sk_callback_lock);
-			NFA_PUT(inst->skb, NFULA_UID, sizeof(uid), &uid);
-		} else
-			read_unlock_bh(&skb->sk->sk_callback_lock);
-	}
-
-	if (data_len) {
-		struct nfattr *nfa;
-		int size = NFA_LENGTH(data_len);
-
-		if (skb_tailroom(inst->skb) < (int)NFA_SPACE(data_len)) {
-			printk(KERN_WARNING "nfnetlink_log: no tailroom!\n");
-			goto nlmsg_failure;
-		}
-
-		nfa = (struct nfattr *)skb_put(inst->skb, NFA_ALIGN(size));
-		nfa->nfa_type = NFULA_PAYLOAD;
-		nfa->nfa_len = size;
-
-		if (skb_copy_bits(skb, 0, NFA_DATA(nfa), data_len))
-			BUG();
-	}
-		
-	nlh->nlmsg_len = inst->skb->tail - old_tail;
-	return 0;
-
-nlmsg_failure:
-	UDEBUG("nlmsg_failure\n");
-nfattr_failure:
-	PRINTR(KERN_ERR "nfnetlink_log: error creating log nlmsg\n");
-	return -1;
-}
-
-#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
-
-static struct nf_loginfo default_loginfo = {
-	.type =		NF_LOG_TYPE_ULOG,
-	.u = {
-		.ulog = {
-			.copy_len	= 0xffff,
-			.group		= 0,
-			.qthreshold	= 1,
-		},
-	},
-};
-
-/* log handler for internal netfilter logging api */
-static void
-nfulnl_log_packet(unsigned int pf,
-		  unsigned int hooknum,
-		  const struct sk_buff *skb,
-		  const struct net_device *in,
-		  const struct net_device *out,
-		  const struct nf_loginfo *li_user,
-		  const char *prefix)
-{
-	unsigned int size, data_len;
-	struct nfulnl_instance *inst;
-	const struct nf_loginfo *li;
-	unsigned int qthreshold;
-	unsigned int nlbufsiz;
-
-	if (li_user && li_user->type == NF_LOG_TYPE_ULOG) 
-		li = li_user;
-	else
-		li = &default_loginfo;
-
-	inst = instance_lookup_get(li->u.ulog.group);
-	if (!inst)
-		inst = instance_lookup_get(0);
-	if (!inst) {
-		PRINTR("nfnetlink_log: trying to log packet, "
-			"but no instance for group %u\n", li->u.ulog.group);
-		return;
-	}
-
-	/* all macros expand to constant values at compile time */
-	/* FIXME: do we want to make the size calculation conditional based on
-	 * what is actually present?  way more branches and checks, but more
-	 * memory efficient... */
-	size =    NLMSG_SPACE(sizeof(struct nfgenmsg))
-		+ NFA_SPACE(sizeof(struct nfulnl_msg_packet_hdr))
-		+ NFA_SPACE(sizeof(u_int32_t))	/* ifindex */
-		+ NFA_SPACE(sizeof(u_int32_t))	/* ifindex */
-#ifdef CONFIG_BRIDGE_NETFILTER
-		+ NFA_SPACE(sizeof(u_int32_t))	/* ifindex */
-		+ NFA_SPACE(sizeof(u_int32_t))	/* ifindex */
-#endif
-		+ NFA_SPACE(sizeof(u_int32_t))	/* mark */
-		+ NFA_SPACE(sizeof(u_int32_t))	/* uid */
-		+ NFA_SPACE(NFULNL_PREFIXLEN)	/* prefix */
-		+ NFA_SPACE(sizeof(struct nfulnl_msg_packet_hw))
-		+ NFA_SPACE(sizeof(struct nfulnl_msg_packet_timestamp));
-
-	UDEBUG("initial size=%u\n", size);
-
-	spin_lock_bh(&inst->lock);
-
-	qthreshold = inst->qthreshold;
-	/* per-rule qthreshold overrides per-instance */
-	if (qthreshold > li->u.ulog.qthreshold)
-		qthreshold = li->u.ulog.qthreshold;
-	
-	switch (inst->copy_mode) {
-	case NFULNL_COPY_META:
-	case NFULNL_COPY_NONE:
-		data_len = 0;
-		break;
-	
-	case NFULNL_COPY_PACKET:
-		if (inst->copy_range == 0 
-		    || inst->copy_range > skb->len)
-			data_len = skb->len;
-		else
-			data_len = inst->copy_range;
-		
-		size += NFA_SPACE(data_len);
-		UDEBUG("copy_packet, therefore size now %u\n", size);
-		break;
-	
-	default:
-		spin_unlock_bh(&inst->lock);
-		instance_put(inst);
-		return;
-	}
-
-	if (size > inst->nlbufsiz)
-		nlbufsiz = size;
-	else
-		nlbufsiz = inst->nlbufsiz;
-
-	if (!inst->skb) {
-		if (!(inst->skb = nfulnl_alloc_skb(nlbufsiz, size))) {
-			UDEBUG("error in nfulnl_alloc_skb(%u, %u)\n",
-				inst->nlbufsiz, size);
-			goto alloc_failure;
-		}
-	} else if (inst->qlen >= qthreshold ||
-		   size > skb_tailroom(inst->skb)) {
-		/* either the queue len is too high or we don't have
-		 * enough room in the skb left. flush to userspace. */
-		UDEBUG("flushing old skb\n");
-
-		__nfulnl_send(inst);
-
-		if (!(inst->skb = nfulnl_alloc_skb(nlbufsiz, size))) {
-			UDEBUG("error in nfulnl_alloc_skb(%u, %u)\n",
-				inst->nlbufsiz, size);
-			goto alloc_failure;
-		}
-	}
-
-	UDEBUG("qlen %d, qthreshold %d\n", inst->qlen, qthreshold);
-	inst->qlen++;
-
-	__build_packet_message(inst, skb, data_len, pf,
-				hooknum, in, out, li, prefix);
-
-	/* timer_pending always called within inst->lock, so there
-	 * is no chance of a race here */
-	if (!timer_pending(&inst->timer)) {
-		instance_get(inst);
-		inst->timer.expires = jiffies + (inst->flushtimeout*HZ/100);
-		add_timer(&inst->timer);
-	}
-	spin_unlock_bh(&inst->lock);
-
-	return;
-
-alloc_failure:
-	spin_unlock_bh(&inst->lock);
-	instance_put(inst);
-	UDEBUG("error allocating skb\n");
-	/* FIXME: statistics */
-}
-
-static int
-nfulnl_rcv_nl_event(struct notifier_block *this,
-		   unsigned long event, void *ptr)
-{
-	struct netlink_notify *n = ptr;
-
-	if (event == NETLINK_URELEASE &&
-	    n->protocol == NETLINK_NETFILTER && n->pid) {
-		int i;
-
-		/* destroy all instances for this pid */
-		write_lock_bh(&instances_lock);
-		for  (i = 0; i < INSTANCE_BUCKETS; i++) {
-			struct hlist_node *tmp, *t2;
-			struct nfulnl_instance *inst;
-			struct hlist_head *head = &instance_table[i];
-
-			hlist_for_each_entry_safe(inst, tmp, t2, head, hlist) {
-				UDEBUG("node = %p\n", inst);
-				if (n->pid == inst->peer_pid)
-					__instance_destroy(inst);
-			}
-		}
-		write_unlock_bh(&instances_lock);
-	}
-	return NOTIFY_DONE;
-}
-
-static struct notifier_block nfulnl_rtnl_notifier = {
-	.notifier_call	= nfulnl_rcv_nl_event,
-};
-
-static int
-nfulnl_recv_unsupp(struct sock *ctnl, struct sk_buff *skb,
-		  struct nlmsghdr *nlh, struct nfattr *nfqa[], int *errp)
-{
-	return -ENOTSUPP;
-}
-
-static struct nf_logger nfulnl_logger = {
-	.name	= "nfnetlink_log",
-	.logfn	= &nfulnl_log_packet,
-	.me	= THIS_MODULE,
-};
-
-static const int nfula_min[NFULA_MAX] = {
-	[NFULA_PACKET_HDR-1]	= sizeof(struct nfulnl_msg_packet_hdr),
-	[NFULA_MARK-1]		= sizeof(u_int32_t),
-	[NFULA_TIMESTAMP-1]	= sizeof(struct nfulnl_msg_packet_timestamp),
-	[NFULA_IFINDEX_INDEV-1]	= sizeof(u_int32_t),
-	[NFULA_IFINDEX_OUTDEV-1]= sizeof(u_int32_t),
-	[NFULA_HWADDR-1]	= sizeof(struct nfulnl_msg_packet_hw),
-	[NFULA_PAYLOAD-1]	= 0,
-	[NFULA_PREFIX-1]	= 0,
-	[NFULA_UID-1]		= sizeof(u_int32_t),
-};
-
-static const int nfula_cfg_min[NFULA_CFG_MAX] = {
-	[NFULA_CFG_CMD-1]	= sizeof(struct nfulnl_msg_config_cmd),
-	[NFULA_CFG_MODE-1]	= sizeof(struct nfulnl_msg_config_mode),
-	[NFULA_CFG_TIMEOUT-1]	= sizeof(u_int32_t),
-	[NFULA_CFG_QTHRESH-1]	= sizeof(u_int32_t),
-	[NFULA_CFG_NLBUFSIZ-1]	= sizeof(u_int32_t),
-};
-
-static int
-nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
-		   struct nlmsghdr *nlh, struct nfattr *nfula[], int *errp)
-{
-	struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
-	u_int16_t group_num = ntohs(nfmsg->res_id);
-	struct nfulnl_instance *inst;
-	int ret = 0;
-
-	UDEBUG("entering for msg %u\n", NFNL_MSG_TYPE(nlh->nlmsg_type));
-
-	if (nfattr_bad_size(nfula, NFULA_CFG_MAX, nfula_cfg_min)) {
-		UDEBUG("bad attribute size\n");
-		return -EINVAL;
-	}
-
-	inst = instance_lookup_get(group_num);
-	if (nfula[NFULA_CFG_CMD-1]) {
-		u_int8_t pf = nfmsg->nfgen_family;
-		struct nfulnl_msg_config_cmd *cmd;
-		cmd = NFA_DATA(nfula[NFULA_CFG_CMD-1]);
-		UDEBUG("found CFG_CMD for\n");
-
-		switch (cmd->command) {
-		case NFULNL_CFG_CMD_BIND:
-			if (inst) {
-				ret = -EBUSY;
-				goto out_put;
-			}
-
-			inst = instance_create(group_num,
-					       NETLINK_CB(skb).pid);
-			if (!inst) {
-				ret = -EINVAL;
-				goto out_put;
-			}
-			break;
-		case NFULNL_CFG_CMD_UNBIND:
-			if (!inst) {
-				ret = -ENODEV;
-				goto out_put;
-			}
-
-			if (inst->peer_pid != NETLINK_CB(skb).pid) {
-				ret = -EPERM;
-				goto out_put;
-			}
-
-			instance_destroy(inst);
-			break;
-		case NFULNL_CFG_CMD_PF_BIND:
-			UDEBUG("registering log handler for pf=%u\n", pf);
-			ret = nf_log_register(pf, &nfulnl_logger);
-			break;
-		case NFULNL_CFG_CMD_PF_UNBIND:
-			UDEBUG("unregistering log handler for pf=%u\n", pf);
-			/* This is a bug and a feature.  We cannot unregister
-			 * other handlers, like nfnetlink_inst can */
-			nf_log_unregister_pf(pf);
-			break;
-		default:
-			ret = -EINVAL;
-			break;
-		}
-	} else {
-		if (!inst) {
-			UDEBUG("no config command, and no instance for "
-				"group=%u pid=%u =>ENOENT\n",
-				group_num, NETLINK_CB(skb).pid);
-			ret = -ENOENT;
-			goto out_put;
-		}
-
-		if (inst->peer_pid != NETLINK_CB(skb).pid) {
-			UDEBUG("no config command, and wrong pid\n");
-			ret = -EPERM;
-			goto out_put;
-		}
-	}
-
-	if (nfula[NFULA_CFG_MODE-1]) {
-		struct nfulnl_msg_config_mode *params;
-		params = NFA_DATA(nfula[NFULA_CFG_MODE-1]);
-
-		nfulnl_set_mode(inst, params->copy_mode,
-				ntohs(params->copy_range));
-	}
-
-	if (nfula[NFULA_CFG_TIMEOUT-1]) {
-		u_int32_t timeout = 
-			*(u_int32_t *)NFA_DATA(nfula[NFULA_CFG_TIMEOUT-1]);
-
-		nfulnl_set_timeout(inst, ntohl(timeout));
-	}
-
-	if (nfula[NFULA_CFG_NLBUFSIZ-1]) {
-		u_int32_t nlbufsiz = 
-			*(u_int32_t *)NFA_DATA(nfula[NFULA_CFG_NLBUFSIZ-1]);
-
-		nfulnl_set_nlbufsiz(inst, ntohl(nlbufsiz));
-	}
-
-	if (nfula[NFULA_CFG_QTHRESH-1]) {
-		u_int32_t qthresh = 
-			*(u_int16_t *)NFA_DATA(nfula[NFULA_CFG_QTHRESH-1]);
-
-		nfulnl_set_qthresh(inst, ntohl(qthresh));
-	}
-
-out_put:
-	instance_put(inst);
-	return ret;
-}
-
-static struct nfnl_callback nfulnl_cb[NFULNL_MSG_MAX] = {
-	[NFULNL_MSG_PACKET]	= { .call = nfulnl_recv_unsupp,
-				    .attr_count = NFULA_MAX,
-				    .cap_required = CAP_NET_ADMIN, },
-	[NFULNL_MSG_CONFIG]	= { .call = nfulnl_recv_config,
-				    .attr_count = NFULA_CFG_MAX,
-				    .cap_required = CAP_NET_ADMIN },
-};
-
-static struct nfnetlink_subsystem nfulnl_subsys = {
-	.name		= "log",
-	.subsys_id	= NFNL_SUBSYS_ULOG,
-	.cb_count	= NFULNL_MSG_MAX,
-	.cb		= nfulnl_cb,
-};
-
-#ifdef CONFIG_PROC_FS
-struct iter_state {
-	unsigned int bucket;
-};
-
-static struct hlist_node *get_first(struct seq_file *seq)
-{
-	struct iter_state *st = seq->private;
-
-	if (!st)
-		return NULL;
-
-	for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) {
-		if (!hlist_empty(&instance_table[st->bucket]))
-			return instance_table[st->bucket].first;
-	}
-	return NULL;
-}
-
-static struct hlist_node *get_next(struct seq_file *seq, struct hlist_node *h)
-{
-	struct iter_state *st = seq->private;
-
-	h = h->next;
-	while (!h) {
-		if (++st->bucket >= INSTANCE_BUCKETS)
-			return NULL;
-
-		h = instance_table[st->bucket].first;
-	}
-	return h;
-}
-
-static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos)
-{
-	struct hlist_node *head;
-	head = get_first(seq);
-
-	if (head)
-		while (pos && (head = get_next(seq, head)))
-			pos--;
-	return pos ? NULL : head;
-}
-
-static void *seq_start(struct seq_file *seq, loff_t *pos)
-{
-	read_lock_bh(&instances_lock);
-	return get_idx(seq, *pos);
-}
-
-static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
-{
-	(*pos)++;
-	return get_next(s, v);
-}
-
-static void seq_stop(struct seq_file *s, void *v)
-{
-	read_unlock_bh(&instances_lock);
-}
-
-static int seq_show(struct seq_file *s, void *v)
-{
-	const struct nfulnl_instance *inst = v;
-
-	return seq_printf(s, "%5d %6d %5d %1d %5d %6d %2d\n", 
-			  inst->group_num,
-			  inst->peer_pid, inst->qlen, 
-			  inst->copy_mode, inst->copy_range,
-			  inst->flushtimeout, atomic_read(&inst->use));
-}
-
-static struct seq_operations nful_seq_ops = {
-	.start	= seq_start,
-	.next	= seq_next,
-	.stop	= seq_stop,
-	.show	= seq_show,
-};
-
-static int nful_open(struct inode *inode, struct file *file)
-{
-	struct seq_file *seq;
-	struct iter_state *is;
-	int ret;
-
-	is = kmalloc(sizeof(*is), GFP_KERNEL);
-	if (!is)
-		return -ENOMEM;
-	memset(is, 0, sizeof(*is));
-	ret = seq_open(file, &nful_seq_ops);
-	if (ret < 0)
-		goto out_free;
-	seq = file->private_data;
-	seq->private = is;
-	return ret;
-out_free:
-	kfree(is);
-	return ret;
-}
-
-static struct file_operations nful_file_ops = {
-	.owner	 = THIS_MODULE,
-	.open	 = nful_open,
-	.read	 = seq_read,
-	.llseek	 = seq_lseek,
-	.release = seq_release_private,
-};
-
-#endif /* PROC_FS */
-
-static int
-init_or_cleanup(int init)
-{
-	int i, status = -ENOMEM;
-#ifdef CONFIG_PROC_FS
-	struct proc_dir_entry *proc_nful;
-#endif
-	
-	if (!init)
-		goto cleanup;
-
-	for (i = 0; i < INSTANCE_BUCKETS; i++)
-		INIT_HLIST_HEAD(&instance_table[i]);
-	
-	/* it's not really all that important to have a random value, so
-	 * we can do this from the init function, even if there hasn't
-	 * been that much entropy yet */
-	get_random_bytes(&hash_init, sizeof(hash_init));
-
-	netlink_register_notifier(&nfulnl_rtnl_notifier);
-	status = nfnetlink_subsys_register(&nfulnl_subsys);
-	if (status < 0) {
-		printk(KERN_ERR "log: failed to create netlink socket\n");
-		goto cleanup_netlink_notifier;
-	}
-
-#ifdef CONFIG_PROC_FS
-	proc_nful = create_proc_entry("nfnetlink_log", 0440,
-				      proc_net_netfilter);
-	if (!proc_nful)
-		goto cleanup_subsys;
-	proc_nful->proc_fops = &nful_file_ops;
-#endif
-
-	return status;
-
-cleanup:
-	nf_log_unregister_logger(&nfulnl_logger);
-#ifdef CONFIG_PROC_FS
-	remove_proc_entry("nfnetlink_log", proc_net_netfilter);
-cleanup_subsys:
-#endif
-	nfnetlink_subsys_unregister(&nfulnl_subsys);
-cleanup_netlink_notifier:
-	netlink_unregister_notifier(&nfulnl_rtnl_notifier);
-	return status;
-}
-
-static int __init init(void)
-{
-	
-	return init_or_cleanup(1);
-}
-
-static void __exit fini(void)
-{
-	init_or_cleanup(0);
-}
-
-MODULE_DESCRIPTION("netfilter userspace logging");
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ULOG);
-
-module_init(init);
-module_exit(fini);
diff --git a/trunk/net/netfilter/nfnetlink_queue.c b/trunk/net/netfilter/nfnetlink_queue.c
deleted file mode 100644
index e3a5285329af..000000000000
--- a/trunk/net/netfilter/nfnetlink_queue.c
+++ /dev/null
@@ -1,1132 +0,0 @@
-/*
- * This is a module which is used for queueing packets and communicating with
- * userspace via nfetlink.
- *
- * (C) 2005 by Harald Welte <laforge@netfilter.org>
- *
- * Based on the old ipv4-only ip_queue.c:
- * (C) 2000-2002 James Morris <jmorris@intercode.com.au>
- * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/init.h>
-#include <linux/spinlock.h>
-#include <linux/notifier.h>
-#include <linux/netdevice.h>
-#include <linux/netfilter.h>
-#include <linux/proc_fs.h>
-#include <linux/netfilter_ipv4.h>
-#include <linux/netfilter_ipv6.h>
-#include <linux/netfilter/nfnetlink.h>
-#include <linux/netfilter/nfnetlink_queue.h>
-#include <linux/list.h>
-#include <net/sock.h>
-
-#include <asm/atomic.h>
-
-#ifdef CONFIG_BRIDGE_NETFILTER
-#include "../bridge/br_private.h"
-#endif
-
-#define NFQNL_QMAX_DEFAULT 1024
-
-#if 0
-#define QDEBUG(x, args ...)	printk(KERN_DEBUG "%s(%d):%s():	" x, 	   \
-					__FILE__, __LINE__, __FUNCTION__,  \
-					## args)
-#else
-#define QDEBUG(x, ...)
-#endif
-
-struct nfqnl_queue_entry {
-	struct list_head list;
-	struct nf_info *info;
-	struct sk_buff *skb;
-	unsigned int id;
-};
-
-struct nfqnl_instance {
-	struct hlist_node hlist;		/* global list of queues */
-	atomic_t use;
-
-	int peer_pid;
-	unsigned int queue_maxlen;
-	unsigned int copy_range;
-	unsigned int queue_total;
-	unsigned int queue_dropped;
-	unsigned int queue_user_dropped;
-
-	atomic_t id_sequence;			/* 'sequence' of pkt ids */
-
-	u_int16_t queue_num;			/* number of this queue */
-	u_int8_t copy_mode;
-
-	spinlock_t lock;
-
-	struct list_head queue_list;		/* packets in queue */
-};
-
-typedef int (*nfqnl_cmpfn)(struct nfqnl_queue_entry *, unsigned long);
-
-static DEFINE_RWLOCK(instances_lock);
-
-u_int64_t htonll(u_int64_t in)
-{
-	u_int64_t out;
-	int i;
-
-	for (i = 0; i < sizeof(u_int64_t); i++)
-		((u_int8_t *)&out)[sizeof(u_int64_t)-1] = ((u_int8_t *)&in)[i];
-
-	return out;
-}
-
-#define INSTANCE_BUCKETS	16
-static struct hlist_head instance_table[INSTANCE_BUCKETS];
-
-static inline u_int8_t instance_hashfn(u_int16_t queue_num)
-{
-	return ((queue_num >> 8) | queue_num) % INSTANCE_BUCKETS;
-}
-
-static struct nfqnl_instance *
-__instance_lookup(u_int16_t queue_num)
-{
-	struct hlist_head *head;
-	struct hlist_node *pos;
-	struct nfqnl_instance *inst;
-
-	head = &instance_table[instance_hashfn(queue_num)];
-	hlist_for_each_entry(inst, pos, head, hlist) {
-		if (inst->queue_num == queue_num)
-			return inst;
-	}
-	return NULL;
-}
-
-static struct nfqnl_instance *
-instance_lookup_get(u_int16_t queue_num)
-{
-	struct nfqnl_instance *inst;
-
-	read_lock_bh(&instances_lock);
-	inst = __instance_lookup(queue_num);
-	if (inst)
-		atomic_inc(&inst->use);
-	read_unlock_bh(&instances_lock);
-
-	return inst;
-}
-
-static void
-instance_put(struct nfqnl_instance *inst)
-{
-	if (inst && atomic_dec_and_test(&inst->use)) {
-		QDEBUG("kfree(inst=%p)\n", inst);
-		kfree(inst);
-	}
-}
-
-static struct nfqnl_instance *
-instance_create(u_int16_t queue_num, int pid)
-{
-	struct nfqnl_instance *inst;
-
-	QDEBUG("entering for queue_num=%u, pid=%d\n", queue_num, pid);
-
-	write_lock_bh(&instances_lock);	
-	if (__instance_lookup(queue_num)) {
-		inst = NULL;
-		QDEBUG("aborting, instance already exists\n");
-		goto out_unlock;
-	}
-
-	inst = kmalloc(sizeof(*inst), GFP_ATOMIC);
-	if (!inst)
-		goto out_unlock;
-
-	memset(inst, 0, sizeof(*inst));
-	inst->queue_num = queue_num;
-	inst->peer_pid = pid;
-	inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
-	inst->copy_range = 0xfffff;
-	inst->copy_mode = NFQNL_COPY_NONE;
-	atomic_set(&inst->id_sequence, 0);
-	/* needs to be two, since we _put() after creation */
-	atomic_set(&inst->use, 2);
-	inst->lock = SPIN_LOCK_UNLOCKED;
-	INIT_LIST_HEAD(&inst->queue_list);
-
-	if (!try_module_get(THIS_MODULE))
-		goto out_free;
-
-	hlist_add_head(&inst->hlist, 
-		       &instance_table[instance_hashfn(queue_num)]);
-
-	write_unlock_bh(&instances_lock);
-
-	QDEBUG("successfully created new instance\n");
-
-	return inst;
-
-out_free:
-	kfree(inst);
-out_unlock:
-	write_unlock_bh(&instances_lock);
-	return NULL;
-}
-
-static void nfqnl_flush(struct nfqnl_instance *queue, int verdict);
-
-static void
-_instance_destroy2(struct nfqnl_instance *inst, int lock)
-{
-	/* first pull it out of the global list */
-	if (lock)
-		write_lock_bh(&instances_lock);
-
-	QDEBUG("removing instance %p (queuenum=%u) from hash\n",
-		inst, inst->queue_num);
-	hlist_del(&inst->hlist);
-
-	if (lock)
-		write_unlock_bh(&instances_lock);
-
-	/* then flush all pending skbs from the queue */
-	nfqnl_flush(inst, NF_DROP);
-
-	/* and finally put the refcount */
-	instance_put(inst);
-
-	module_put(THIS_MODULE);
-}
-
-static inline void
-__instance_destroy(struct nfqnl_instance *inst)
-{
-	_instance_destroy2(inst, 0);
-}
-
-static inline void
-instance_destroy(struct nfqnl_instance *inst)
-{
-	_instance_destroy2(inst, 1);
-}
-
-
-
-static void
-issue_verdict(struct nfqnl_queue_entry *entry, int verdict)
-{
-	QDEBUG("entering for entry %p, verdict %u\n", entry, verdict);
-
-	/* TCP input path (and probably other bits) assume to be called
-	 * from softirq context, not from syscall, like issue_verdict is
-	 * called.  TCP input path deadlocks with locks taken from timer
-	 * softirq, e.g.  We therefore emulate this by local_bh_disable() */
-
-	local_bh_disable();
-	nf_reinject(entry->skb, entry->info, verdict);
-	local_bh_enable();
-
-	kfree(entry);
-}
-
-static inline void
-__enqueue_entry(struct nfqnl_instance *queue,
-		      struct nfqnl_queue_entry *entry)
-{
-       list_add(&entry->list, &queue->queue_list);
-       queue->queue_total++;
-}
-
-/*
- * Find and return a queued entry matched by cmpfn, or return the last
- * entry if cmpfn is NULL.
- */
-static inline struct nfqnl_queue_entry *
-__find_entry(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, 
-		   unsigned long data)
-{
-	struct list_head *p;
-
-	list_for_each_prev(p, &queue->queue_list) {
-		struct nfqnl_queue_entry *entry = (struct nfqnl_queue_entry *)p;
-		
-		if (!cmpfn || cmpfn(entry, data))
-			return entry;
-	}
-	return NULL;
-}
-
-static inline void
-__dequeue_entry(struct nfqnl_instance *q, struct nfqnl_queue_entry *entry)
-{
-	list_del(&entry->list);
-	q->queue_total--;
-}
-
-static inline struct nfqnl_queue_entry *
-__find_dequeue_entry(struct nfqnl_instance *queue,
-		     nfqnl_cmpfn cmpfn, unsigned long data)
-{
-	struct nfqnl_queue_entry *entry;
-
-	entry = __find_entry(queue, cmpfn, data);
-	if (entry == NULL)
-		return NULL;
-
-	__dequeue_entry(queue, entry);
-	return entry;
-}
-
-
-static inline void
-__nfqnl_flush(struct nfqnl_instance *queue, int verdict)
-{
-	struct nfqnl_queue_entry *entry;
-	
-	while ((entry = __find_dequeue_entry(queue, NULL, 0)))
-		issue_verdict(entry, verdict);
-}
-
-static inline int
-__nfqnl_set_mode(struct nfqnl_instance *queue,
-		 unsigned char mode, unsigned int range)
-{
-	int status = 0;
-	
-	switch (mode) {
-	case NFQNL_COPY_NONE:
-	case NFQNL_COPY_META:
-		queue->copy_mode = mode;
-		queue->copy_range = 0;
-		break;
-		
-	case NFQNL_COPY_PACKET:
-		queue->copy_mode = mode;
-		/* we're using struct nfattr which has 16bit nfa_len */
-		if (range > 0xffff)
-			queue->copy_range = 0xffff;
-		else
-			queue->copy_range = range;
-		break;
-		
-	default:
-		status = -EINVAL;
-
-	}
-	return status;
-}
-
-static struct nfqnl_queue_entry *
-find_dequeue_entry(struct nfqnl_instance *queue,
-			 nfqnl_cmpfn cmpfn, unsigned long data)
-{
-	struct nfqnl_queue_entry *entry;
-	
-	spin_lock_bh(&queue->lock);
-	entry = __find_dequeue_entry(queue, cmpfn, data);
-	spin_unlock_bh(&queue->lock);
-
-	return entry;
-}
-
-static void
-nfqnl_flush(struct nfqnl_instance *queue, int verdict)
-{
-	spin_lock_bh(&queue->lock);
-	__nfqnl_flush(queue, verdict);
-	spin_unlock_bh(&queue->lock);
-}
-
-static struct sk_buff *
-nfqnl_build_packet_message(struct nfqnl_instance *queue,
-			   struct nfqnl_queue_entry *entry, int *errp)
-{
-	unsigned char *old_tail;
-	size_t size;
-	size_t data_len = 0;
-	struct sk_buff *skb;
-	struct nfqnl_msg_packet_hdr pmsg;
-	struct nlmsghdr *nlh;
-	struct nfgenmsg *nfmsg;
-	unsigned int tmp_uint;
-
-	QDEBUG("entered\n");
-
-	/* all macros expand to constant values at compile time */
-	size =    NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hdr))
-		+ NLMSG_SPACE(sizeof(u_int32_t))	/* ifindex */
-		+ NLMSG_SPACE(sizeof(u_int32_t))	/* ifindex */
-#ifdef CONFIG_BRIDGE_NETFILTER
-		+ NLMSG_SPACE(sizeof(u_int32_t))	/* ifindex */
-		+ NLMSG_SPACE(sizeof(u_int32_t))	/* ifindex */
-#endif
-		+ NLMSG_SPACE(sizeof(u_int32_t))	/* mark */
-		+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hw))
-		+ NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_timestamp));
-
-	spin_lock_bh(&queue->lock);
-	
-	switch (queue->copy_mode) {
-	case NFQNL_COPY_META:
-	case NFQNL_COPY_NONE:
-		data_len = 0;
-		break;
-	
-	case NFQNL_COPY_PACKET:
-		if (queue->copy_range == 0 
-		    || queue->copy_range > entry->skb->len)
-			data_len = entry->skb->len;
-		else
-			data_len = queue->copy_range;
-		
-		size += NLMSG_SPACE(data_len);
-		break;
-	
-	default:
-		*errp = -EINVAL;
-		spin_unlock_bh(&queue->lock);
-		return NULL;
-	}
-
-	spin_unlock_bh(&queue->lock);
-
-	skb = alloc_skb(size, GFP_ATOMIC);
-	if (!skb)
-		goto nlmsg_failure;
-		
-	old_tail= skb->tail;
-	nlh = NLMSG_PUT(skb, 0, 0, 
-			NFNL_SUBSYS_QUEUE << 8 | NFQNL_MSG_PACKET,
-			sizeof(struct nfgenmsg));
-	nfmsg = NLMSG_DATA(nlh);
-	nfmsg->nfgen_family = entry->info->pf;
-	nfmsg->version = NFNETLINK_V0;
-	nfmsg->res_id = htons(queue->queue_num);
-
-	pmsg.packet_id 		= htonl(entry->id);
-	pmsg.hw_protocol	= htons(entry->skb->protocol);
-	pmsg.hook		= entry->info->hook;
-
-	NFA_PUT(skb, NFQA_PACKET_HDR, sizeof(pmsg), &pmsg);
-
-	if (entry->info->indev) {
-		tmp_uint = htonl(entry->info->indev->ifindex);
-#ifndef CONFIG_BRIDGE_NETFILTER
-		NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint), &tmp_uint);
-#else
-		if (entry->info->pf == PF_BRIDGE) {
-			/* Case 1: indev is physical input device, we need to
-			 * look for bridge group (when called from 
-			 * netfilter_bridge) */
-			NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV, sizeof(tmp_uint), 
-				&tmp_uint);
-			/* this is the bridge group "brX" */
-			tmp_uint = htonl(entry->info->indev->br_port->br->dev->ifindex);
-			NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
-				&tmp_uint);
-		} else {
-			/* Case 2: indev is bridge group, we need to look for
-			 * physical device (when called from ipv4) */
-			NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
-				&tmp_uint);
-			if (entry->skb->nf_bridge
-			    && entry->skb->nf_bridge->physindev) {
-				tmp_uint = htonl(entry->skb->nf_bridge->physindev->ifindex);
-				NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV,
-					sizeof(tmp_uint), &tmp_uint);
-			}
-		}
-#endif
-	}
-
-	if (entry->info->outdev) {
-		tmp_uint = htonl(entry->info->outdev->ifindex);
-#ifndef CONFIG_BRIDGE_NETFILTER
-		NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint);
-#else
-		if (entry->info->pf == PF_BRIDGE) {
-			/* Case 1: outdev is physical output device, we need to
-			 * look for bridge group (when called from 
-			 * netfilter_bridge) */
-			NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV, sizeof(tmp_uint),
-				&tmp_uint);
-			/* this is the bridge group "brX" */
-			tmp_uint = htonl(entry->info->outdev->br_port->br->dev->ifindex);
-			NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
-				&tmp_uint);
-		} else {
-			/* Case 2: outdev is bridge group, we need to look for
-			 * physical output device (when called from ipv4) */
-			NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
-				&tmp_uint);
-			if (entry->skb->nf_bridge
-			    && entry->skb->nf_bridge->physoutdev) {
-				tmp_uint = htonl(entry->skb->nf_bridge->physoutdev->ifindex);
-				NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV,
-					sizeof(tmp_uint), &tmp_uint);
-			}
-		}
-#endif
-	}
-
-	if (entry->skb->nfmark) {
-		tmp_uint = htonl(entry->skb->nfmark);
-		NFA_PUT(skb, NFQA_MARK, sizeof(u_int32_t), &tmp_uint);
-	}
-
-	if (entry->info->indev && entry->skb->dev
-	    && entry->skb->dev->hard_header_parse) {
-		struct nfqnl_msg_packet_hw phw;
-
-		phw.hw_addrlen =
-			entry->skb->dev->hard_header_parse(entry->skb,
-			                                   phw.hw_addr);
-		phw.hw_addrlen = htons(phw.hw_addrlen);
-		NFA_PUT(skb, NFQA_HWADDR, sizeof(phw), &phw);
-	}
-
-	if (entry->skb->tstamp.off_sec) {
-		struct nfqnl_msg_packet_timestamp ts;
-
-		ts.sec = htonll(skb_tv_base.tv_sec + entry->skb->tstamp.off_sec);
-		ts.usec = htonll(skb_tv_base.tv_usec + entry->skb->tstamp.off_usec);
-
-		NFA_PUT(skb, NFQA_TIMESTAMP, sizeof(ts), &ts);
-	}
-
-	if (data_len) {
-		struct nfattr *nfa;
-		int size = NFA_LENGTH(data_len);
-
-		if (skb_tailroom(skb) < (int)NFA_SPACE(data_len)) {
-			printk(KERN_WARNING "nf_queue: no tailroom!\n");
-			goto nlmsg_failure;
-		}
-
-		nfa = (struct nfattr *)skb_put(skb, NFA_ALIGN(size));
-		nfa->nfa_type = NFQA_PAYLOAD;
-		nfa->nfa_len = size;
-
-		if (skb_copy_bits(entry->skb, 0, NFA_DATA(nfa), data_len))
-			BUG();
-	}
-		
-	nlh->nlmsg_len = skb->tail - old_tail;
-	return skb;
-
-nlmsg_failure:
-nfattr_failure:
-	if (skb)
-		kfree_skb(skb);
-	*errp = -EINVAL;
-	if (net_ratelimit())
-		printk(KERN_ERR "nf_queue: error creating packet message\n");
-	return NULL;
-}
-
-static int
-nfqnl_enqueue_packet(struct sk_buff *skb, struct nf_info *info, 
-		     unsigned int queuenum, void *data)
-{
-	int status = -EINVAL;
-	struct sk_buff *nskb;
-	struct nfqnl_instance *queue;
-	struct nfqnl_queue_entry *entry;
-
-	QDEBUG("entered\n");
-
-	queue = instance_lookup_get(queuenum);
-	if (!queue) {
-		QDEBUG("no queue instance matching\n");
-		return -EINVAL;
-	}
-
-	if (queue->copy_mode == NFQNL_COPY_NONE) {
-		QDEBUG("mode COPY_NONE, aborting\n");
-		status = -EAGAIN;
-		goto err_out_put;
-	}
-
-	entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
-	if (entry == NULL) {
-		if (net_ratelimit())
-			printk(KERN_ERR 
-				"nf_queue: OOM in nfqnl_enqueue_packet()\n");
-		status = -ENOMEM;
-		goto err_out_put;
-	}
-
-	entry->info = info;
-	entry->skb = skb;
-	entry->id = atomic_inc_return(&queue->id_sequence);
-
-	nskb = nfqnl_build_packet_message(queue, entry, &status);
-	if (nskb == NULL)
-		goto err_out_free;
-		
-	spin_lock_bh(&queue->lock);
-	
-	if (!queue->peer_pid)
-		goto err_out_free_nskb; 
-
-	if (queue->queue_total >= queue->queue_maxlen) {
-                queue->queue_dropped++;
-		status = -ENOSPC;
-		if (net_ratelimit())
-		          printk(KERN_WARNING "ip_queue: full at %d entries, "
-				 "dropping packets(s). Dropped: %d\n", 
-				 queue->queue_total, queue->queue_dropped);
-		goto err_out_free_nskb;
-	}
-
-	/* nfnetlink_unicast will either free the nskb or add it to a socket */
-	status = nfnetlink_unicast(nskb, queue->peer_pid, MSG_DONTWAIT);
-	if (status < 0) {
-	        queue->queue_user_dropped++;
-		goto err_out_unlock;
-	}
-
-	__enqueue_entry(queue, entry);
-
-	spin_unlock_bh(&queue->lock);
-	instance_put(queue);
-	return status;
-
-err_out_free_nskb:
-	kfree_skb(nskb); 
-	
-err_out_unlock:
-	spin_unlock_bh(&queue->lock);
-
-err_out_free:
-	kfree(entry);
-err_out_put:
-	instance_put(queue);
-	return status;
-}
-
-static int
-nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
-{
-	int diff;
-
-	diff = data_len - e->skb->len;
-	if (diff < 0)
-		skb_trim(e->skb, data_len);
-	else if (diff > 0) {
-		if (data_len > 0xFFFF)
-			return -EINVAL;
-		if (diff > skb_tailroom(e->skb)) {
-			struct sk_buff *newskb;
-			
-			newskb = skb_copy_expand(e->skb,
-			                         skb_headroom(e->skb),
-			                         diff,
-			                         GFP_ATOMIC);
-			if (newskb == NULL) {
-				printk(KERN_WARNING "ip_queue: OOM "
-				      "in mangle, dropping packet\n");
-				return -ENOMEM;
-			}
-			if (e->skb->sk)
-				skb_set_owner_w(newskb, e->skb->sk);
-			kfree_skb(e->skb);
-			e->skb = newskb;
-		}
-		skb_put(e->skb, diff);
-	}
-	if (!skb_make_writable(&e->skb, data_len))
-		return -ENOMEM;
-	memcpy(e->skb->data, data, data_len);
-
-	return 0;
-}
-
-static inline int
-id_cmp(struct nfqnl_queue_entry *e, unsigned long id)
-{
-	return (id == e->id);
-}
-
-static int
-nfqnl_set_mode(struct nfqnl_instance *queue,
-	       unsigned char mode, unsigned int range)
-{
-	int status;
-
-	spin_lock_bh(&queue->lock);
-	status = __nfqnl_set_mode(queue, mode, range);
-	spin_unlock_bh(&queue->lock);
-
-	return status;
-}
-
-static int
-dev_cmp(struct nfqnl_queue_entry *entry, unsigned long ifindex)
-{
-	if (entry->info->indev)
-		if (entry->info->indev->ifindex == ifindex)
-			return 1;
-			
-	if (entry->info->outdev)
-		if (entry->info->outdev->ifindex == ifindex)
-			return 1;
-
-	return 0;
-}
-
-/* drop all packets with either indev or outdev == ifindex from all queue
- * instances */
-static void
-nfqnl_dev_drop(int ifindex)
-{
-	int i;
-	
-	QDEBUG("entering for ifindex %u\n", ifindex);
-
-	/* this only looks like we have to hold the readlock for a way too long
-	 * time, issue_verdict(),  nf_reinject(), ... - but we always only
-	 * issue NF_DROP, which is processed directly in nf_reinject() */
-	read_lock_bh(&instances_lock);
-
-	for  (i = 0; i < INSTANCE_BUCKETS; i++) {
-		struct hlist_node *tmp;
-		struct nfqnl_instance *inst;
-		struct hlist_head *head = &instance_table[i];
-
-		hlist_for_each_entry(inst, tmp, head, hlist) {
-			struct nfqnl_queue_entry *entry;
-			while ((entry = find_dequeue_entry(inst, dev_cmp, 
-							   ifindex)) != NULL)
-				issue_verdict(entry, NF_DROP);
-		}
-	}
-
-	read_unlock_bh(&instances_lock);
-}
-
-#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
-
-static int
-nfqnl_rcv_dev_event(struct notifier_block *this,
-		    unsigned long event, void *ptr)
-{
-	struct net_device *dev = ptr;
-
-	/* Drop any packets associated with the downed device */
-	if (event == NETDEV_DOWN)
-		nfqnl_dev_drop(dev->ifindex);
-	return NOTIFY_DONE;
-}
-
-static struct notifier_block nfqnl_dev_notifier = {
-	.notifier_call	= nfqnl_rcv_dev_event,
-};
-
-static int
-nfqnl_rcv_nl_event(struct notifier_block *this,
-		   unsigned long event, void *ptr)
-{
-	struct netlink_notify *n = ptr;
-
-	if (event == NETLINK_URELEASE &&
-	    n->protocol == NETLINK_NETFILTER && n->pid) {
-		int i;
-
-		/* destroy all instances for this pid */
-		write_lock_bh(&instances_lock);
-		for  (i = 0; i < INSTANCE_BUCKETS; i++) {
-			struct hlist_node *tmp, *t2;
-			struct nfqnl_instance *inst;
-			struct hlist_head *head = &instance_table[i];
-
-			hlist_for_each_entry_safe(inst, tmp, t2, head, hlist) {
-				if (n->pid == inst->peer_pid)
-					__instance_destroy(inst);
-			}
-		}
-		write_unlock_bh(&instances_lock);
-	}
-	return NOTIFY_DONE;
-}
-
-static struct notifier_block nfqnl_rtnl_notifier = {
-	.notifier_call	= nfqnl_rcv_nl_event,
-};
-
-static const int nfqa_verdict_min[NFQA_MAX] = {
-	[NFQA_VERDICT_HDR-1]	= sizeof(struct nfqnl_msg_verdict_hdr),
-	[NFQA_MARK-1]		= sizeof(u_int32_t),
-	[NFQA_PAYLOAD-1]	= 0,
-};
-
-static int
-nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
-		   struct nlmsghdr *nlh, struct nfattr *nfqa[], int *errp)
-{
-	struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
-	u_int16_t queue_num = ntohs(nfmsg->res_id);
-
-	struct nfqnl_msg_verdict_hdr *vhdr;
-	struct nfqnl_instance *queue;
-	unsigned int verdict;
-	struct nfqnl_queue_entry *entry;
-	int err;
-
-	if (nfattr_bad_size(nfqa, NFQA_MAX, nfqa_verdict_min)) {
-		QDEBUG("bad attribute size\n");
-		return -EINVAL;
-	}
-
-	queue = instance_lookup_get(queue_num);
-	if (!queue)
-		return -ENODEV;
-
-	if (queue->peer_pid != NETLINK_CB(skb).pid) {
-		err = -EPERM;
-		goto err_out_put;
-	}
-
-	if (!nfqa[NFQA_VERDICT_HDR-1]) {
-		err = -EINVAL;
-		goto err_out_put;
-	}
-
-	vhdr = NFA_DATA(nfqa[NFQA_VERDICT_HDR-1]);
-	verdict = ntohl(vhdr->verdict);
-
-	if ((verdict & NF_VERDICT_MASK) > NF_MAX_VERDICT) {
-		err = -EINVAL;
-		goto err_out_put;
-	}
-
-	entry = find_dequeue_entry(queue, id_cmp, ntohl(vhdr->id));
-	if (entry == NULL) {
-		err = -ENOENT;
-		goto err_out_put;
-	}
-
-	if (nfqa[NFQA_PAYLOAD-1]) {
-		if (nfqnl_mangle(NFA_DATA(nfqa[NFQA_PAYLOAD-1]),
-				 NFA_PAYLOAD(nfqa[NFQA_PAYLOAD-1]), entry) < 0)
-			verdict = NF_DROP;
-	}
-
-	if (nfqa[NFQA_MARK-1])
-		skb->nfmark = ntohl(*(u_int32_t *)NFA_DATA(nfqa[NFQA_MARK-1]));
-		
-	issue_verdict(entry, verdict);
-	instance_put(queue);
-	return 0;
-
-err_out_put:
-	instance_put(queue);
-	return err;
-}
-
-static int
-nfqnl_recv_unsupp(struct sock *ctnl, struct sk_buff *skb,
-		  struct nlmsghdr *nlh, struct nfattr *nfqa[], int *errp)
-{
-	return -ENOTSUPP;
-}
-
-static const int nfqa_cfg_min[NFQA_CFG_MAX] = {
-	[NFQA_CFG_CMD-1]	= sizeof(struct nfqnl_msg_config_cmd),
-	[NFQA_CFG_PARAMS-1]	= sizeof(struct nfqnl_msg_config_params),
-};
-
-static struct nf_queue_handler nfqh = {
-	.name 	= "nf_queue",
-	.outfn	= &nfqnl_enqueue_packet,
-};
-
-static int
-nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
-		  struct nlmsghdr *nlh, struct nfattr *nfqa[], int *errp)
-{
-	struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
-	u_int16_t queue_num = ntohs(nfmsg->res_id);
-	struct nfqnl_instance *queue;
-	int ret = 0;
-
-	QDEBUG("entering for msg %u\n", NFNL_MSG_TYPE(nlh->nlmsg_type));
-
-	if (nfattr_bad_size(nfqa, NFQA_CFG_MAX, nfqa_cfg_min)) {
-		QDEBUG("bad attribute size\n");
-		return -EINVAL;
-	}
-
-	queue = instance_lookup_get(queue_num);
-	if (nfqa[NFQA_CFG_CMD-1]) {
-		struct nfqnl_msg_config_cmd *cmd;
-		cmd = NFA_DATA(nfqa[NFQA_CFG_CMD-1]);
-		QDEBUG("found CFG_CMD\n");
-
-		switch (cmd->command) {
-		case NFQNL_CFG_CMD_BIND:
-			if (queue)
-				return -EBUSY;
-
-			queue = instance_create(queue_num, NETLINK_CB(skb).pid);
-			if (!queue)
-				return -EINVAL;
-			break;
-		case NFQNL_CFG_CMD_UNBIND:
-			if (!queue)
-				return -ENODEV;
-
-			if (queue->peer_pid != NETLINK_CB(skb).pid) {
-				ret = -EPERM;
-				goto out_put;
-			}
-
-			instance_destroy(queue);
-			break;
-		case NFQNL_CFG_CMD_PF_BIND:
-			QDEBUG("registering queue handler for pf=%u\n",
-				ntohs(cmd->pf));
-			ret = nf_register_queue_handler(ntohs(cmd->pf), &nfqh);
-			break;
-		case NFQNL_CFG_CMD_PF_UNBIND:
-			QDEBUG("unregistering queue handler for pf=%u\n",
-				ntohs(cmd->pf));
-			/* This is a bug and a feature.  We can unregister
-			 * other handlers(!) */
-			ret = nf_unregister_queue_handler(ntohs(cmd->pf));
-			break;
-		default:
-			ret = -EINVAL;
-			break;
-		}
-	} else {
-		if (!queue) {
-			QDEBUG("no config command, and no instance ENOENT\n");
-			ret = -ENOENT;
-			goto out_put;
-		}
-
-		if (queue->peer_pid != NETLINK_CB(skb).pid) {
-			QDEBUG("no config command, and wrong pid\n");
-			ret = -EPERM;
-			goto out_put;
-		}
-	}
-
-	if (nfqa[NFQA_CFG_PARAMS-1]) {
-		struct nfqnl_msg_config_params *params;
-		params = NFA_DATA(nfqa[NFQA_CFG_PARAMS-1]);
-
-		nfqnl_set_mode(queue, params->copy_mode,
-				ntohl(params->copy_range));
-	}
-
-out_put:
-	instance_put(queue);
-	return ret;
-}
-
-static struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX] = {
-	[NFQNL_MSG_PACKET]	= { .call = nfqnl_recv_unsupp,
-				    .attr_count = NFQA_MAX,
-				    .cap_required = CAP_NET_ADMIN },
-	[NFQNL_MSG_VERDICT]	= { .call = nfqnl_recv_verdict,
-				    .attr_count = NFQA_MAX,
-				    .cap_required = CAP_NET_ADMIN },
-	[NFQNL_MSG_CONFIG]	= { .call = nfqnl_recv_config,
-				    .attr_count = NFQA_CFG_MAX,
-				    .cap_required = CAP_NET_ADMIN },
-};
-
-static struct nfnetlink_subsystem nfqnl_subsys = {
-	.name		= "nf_queue",
-	.subsys_id	= NFNL_SUBSYS_QUEUE,
-	.cb_count	= NFQNL_MSG_MAX,
-	.cb		= nfqnl_cb,
-};
-
-#ifdef CONFIG_PROC_FS
-struct iter_state {
-	unsigned int bucket;
-};
-
-static struct hlist_node *get_first(struct seq_file *seq)
-{
-	struct iter_state *st = seq->private;
-
-	if (!st)
-		return NULL;
-
-	for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) {
-		if (!hlist_empty(&instance_table[st->bucket]))
-			return instance_table[st->bucket].first;
-	}
-	return NULL;
-}
-
-static struct hlist_node *get_next(struct seq_file *seq, struct hlist_node *h)
-{
-	struct iter_state *st = seq->private;
-
-	h = h->next;
-	while (!h) {
-		if (++st->bucket >= INSTANCE_BUCKETS)
-			return NULL;
-
-		h = instance_table[st->bucket].first;
-	}
-	return h;
-}
-
-static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos)
-{
-	struct hlist_node *head;
-	head = get_first(seq);
-
-	if (head)
-		while (pos && (head = get_next(seq, head)))
-			pos--;
-	return pos ? NULL : head;
-}
-
-static void *seq_start(struct seq_file *seq, loff_t *pos)
-{
-	read_lock_bh(&instances_lock);
-	return get_idx(seq, *pos);
-}
-
-static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
-{
-	(*pos)++;
-	return get_next(s, v);
-}
-
-static void seq_stop(struct seq_file *s, void *v)
-{
-	read_unlock_bh(&instances_lock);
-}
-
-static int seq_show(struct seq_file *s, void *v)
-{
-	const struct nfqnl_instance *inst = v;
-
-	return seq_printf(s, "%5d %6d %5d %1d %5d %5d %5d %8d %2d\n",
-			  inst->queue_num,
-			  inst->peer_pid, inst->queue_total,
-			  inst->copy_mode, inst->copy_range,
-			  inst->queue_dropped, inst->queue_user_dropped,
-			  atomic_read(&inst->id_sequence),
-			  atomic_read(&inst->use));
-}
-
-static struct seq_operations nfqnl_seq_ops = {
-	.start	= seq_start,
-	.next	= seq_next,
-	.stop	= seq_stop,
-	.show	= seq_show,
-};
-
-static int nfqnl_open(struct inode *inode, struct file *file)
-{
-	struct seq_file *seq;
-	struct iter_state *is;
-	int ret;
-
-	is = kmalloc(sizeof(*is), GFP_KERNEL);
-	if (!is)
-		return -ENOMEM;
-	memset(is, 0, sizeof(*is));
-	ret = seq_open(file, &nfqnl_seq_ops);
-	if (ret < 0)
-		goto out_free;
-	seq = file->private_data;
-	seq->private = is;
-	return ret;
-out_free:
-	kfree(is);
-	return ret;
-}
-
-static struct file_operations nfqnl_file_ops = {
-	.owner	 = THIS_MODULE,
-	.open	 = nfqnl_open,
-	.read	 = seq_read,
-	.llseek	 = seq_lseek,
-	.release = seq_release_private,
-};
-
-#endif /* PROC_FS */
-
-static int
-init_or_cleanup(int init)
-{
-	int i, status = -ENOMEM;
-#ifdef CONFIG_PROC_FS
-	struct proc_dir_entry *proc_nfqueue;
-#endif
-	
-	if (!init)
-		goto cleanup;
-
-	for (i = 0; i < INSTANCE_BUCKETS; i++)
-		INIT_HLIST_HEAD(&instance_table[i]);
-
-	netlink_register_notifier(&nfqnl_rtnl_notifier);
-	status = nfnetlink_subsys_register(&nfqnl_subsys);
-	if (status < 0) {
-		printk(KERN_ERR "nf_queue: failed to create netlink socket\n");
-		goto cleanup_netlink_notifier;
-	}
-
-#ifdef CONFIG_PROC_FS
-	proc_nfqueue = create_proc_entry("nfnetlink_queue", 0440,
-					 proc_net_netfilter);
-	if (!proc_nfqueue)
-		goto cleanup_subsys;
-	proc_nfqueue->proc_fops = &nfqnl_file_ops;
-#endif
-
-	register_netdevice_notifier(&nfqnl_dev_notifier);
-
-	return status;
-
-cleanup:
-	nf_unregister_queue_handlers(&nfqh);
-	unregister_netdevice_notifier(&nfqnl_dev_notifier);
-#ifdef CONFIG_PROC_FS
-	remove_proc_entry("nfnetlink_queue", proc_net_netfilter);
-cleanup_subsys:
-#endif	
-	nfnetlink_subsys_unregister(&nfqnl_subsys);
-cleanup_netlink_notifier:
-	netlink_unregister_notifier(&nfqnl_rtnl_notifier);
-	return status;
-}
-
-static int __init init(void)
-{
-	
-	return init_or_cleanup(1);
-}
-
-static void __exit fini(void)
-{
-	init_or_cleanup(0);
-}
-
-MODULE_DESCRIPTION("netfilter packet queue handler");
-MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_QUEUE);
-
-module_init(init);
-module_exit(fini);
diff --git a/trunk/net/netlink/af_netlink.c b/trunk/net/netlink/af_netlink.c
index 62435ffc6184..ff774a06c89d 100644
--- a/trunk/net/netlink/af_netlink.c
+++ b/trunk/net/netlink/af_netlink.c
@@ -13,12 +13,7 @@
  *                               added netlink_proto_exit
  * Tue Jan 22 18:32:44 BRST 2002 Arnaldo C. de Melo <acme@conectiva.com.br>
  * 				 use nlk_sk, as sk->protinfo is on a diet 8)
- * Fri Jul 22 19:51:12 MEST 2005 Harald Welte <laforge@gnumonks.org>
- * 				 - inc module use count of module that owns
- * 				   the kernel socket in case userspace opens
- * 				   socket of same protocol
- * 				 - remove all module support, since netlink is
- * 				   mandatory if CONFIG_NET=y these days
+ *
  */
 
 #include <linux/config.h>
@@ -60,29 +55,21 @@
 #include <net/scm.h>
 
 #define Nprintk(a...)
-#define NLGRPSZ(x)	(ALIGN(x, sizeof(unsigned long) * 8) / 8)
 
 struct netlink_sock {
 	/* struct sock has to be the first member of netlink_sock */
 	struct sock		sk;
 	u32			pid;
+	unsigned int		groups;
 	u32			dst_pid;
-	u32			dst_group;
-	u32			flags;
-	u32			subscriptions;
-	u32			ngroups;
-	unsigned long		*groups;
+	unsigned int		dst_groups;
 	unsigned long		state;
 	wait_queue_head_t	wait;
 	struct netlink_callback	*cb;
 	spinlock_t		cb_lock;
 	void			(*data_ready)(struct sock *sk, int bytes);
-	struct module		*module;
 };
 
-#define NETLINK_KERNEL_SOCKET	0x1
-#define NETLINK_RECV_PKTINFO	0x2
-
 static inline struct netlink_sock *nlk_sk(struct sock *sk)
 {
 	return (struct netlink_sock *)sk;
@@ -105,9 +92,6 @@ struct netlink_table {
 	struct nl_pid_hash hash;
 	struct hlist_head mc_list;
 	unsigned int nl_nonroot;
-	unsigned int groups;
-	struct module *module;
-	int registered;
 };
 
 static struct netlink_table *nl_table;
@@ -122,11 +106,6 @@ static atomic_t nl_table_users = ATOMIC_INIT(0);
 
 static struct notifier_block *netlink_chain;
 
-static u32 netlink_group_mask(u32 group)
-{
-	return group ? 1 << (group - 1) : 0;
-}
-
 static struct hlist_head *nl_pid_hashfn(struct nl_pid_hash *hash, u32 pid)
 {
 	return &hash->table[jhash_1word(pid, hash->rnd) & hash->mask];
@@ -143,7 +122,6 @@ static void netlink_sock_destruct(struct sock *sk)
 	BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
 	BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
 	BUG_TRAP(!nlk_sk(sk)->cb);
-	BUG_TRAP(!nlk_sk(sk)->groups);
 }
 
 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on SMP.
@@ -339,7 +317,7 @@ static void netlink_remove(struct sock *sk)
 	netlink_table_grab();
 	if (sk_del_node_init(sk))
 		nl_table[sk->sk_protocol].hash.entries--;
-	if (nlk_sk(sk)->subscriptions)
+	if (nlk_sk(sk)->groups)
 		__sk_del_bind_node(sk);
 	netlink_table_ungrab();
 }
@@ -350,11 +328,19 @@ static struct proto netlink_proto = {
 	.obj_size = sizeof(struct netlink_sock),
 };
 
-static int __netlink_create(struct socket *sock, int protocol)
+static int netlink_create(struct socket *sock, int protocol)
 {
 	struct sock *sk;
 	struct netlink_sock *nlk;
 
+	sock->state = SS_UNCONNECTED;
+
+	if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
+		return -ESOCKTNOSUPPORT;
+
+	if (protocol<0 || protocol >= MAX_LINKS)
+		return -EPROTONOSUPPORT;
+
 	sock->ops = &netlink_ops;
 
 	sk = sk_alloc(PF_NETLINK, GFP_KERNEL, &netlink_proto, 1);
@@ -364,67 +350,15 @@ static int __netlink_create(struct socket *sock, int protocol)
 	sock_init_data(sock, sk);
 
 	nlk = nlk_sk(sk);
+
 	spin_lock_init(&nlk->cb_lock);
 	init_waitqueue_head(&nlk->wait);
-
 	sk->sk_destruct = netlink_sock_destruct;
+
 	sk->sk_protocol = protocol;
 	return 0;
 }
 
-static int netlink_create(struct socket *sock, int protocol)
-{
-	struct module *module = NULL;
-	struct netlink_sock *nlk;
-	unsigned int groups;
-	int err = 0;
-
-	sock->state = SS_UNCONNECTED;
-
-	if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
-		return -ESOCKTNOSUPPORT;
-
-	if (protocol<0 || protocol >= MAX_LINKS)
-		return -EPROTONOSUPPORT;
-
-	netlink_lock_table();
-#ifdef CONFIG_KMOD
-	if (!nl_table[protocol].registered) {
-		netlink_unlock_table();
-		request_module("net-pf-%d-proto-%d", PF_NETLINK, protocol);
-		netlink_lock_table();
-	}
-#endif
-	if (nl_table[protocol].registered &&
-	    try_module_get(nl_table[protocol].module))
-		module = nl_table[protocol].module;
-	else
-		err = -EPROTONOSUPPORT;
-	groups = nl_table[protocol].groups;
-	netlink_unlock_table();
-
-	if (err || (err = __netlink_create(sock, protocol) < 0))
-		goto out_module;
-
-	nlk = nlk_sk(sock->sk);
-
-	nlk->groups = kmalloc(NLGRPSZ(groups), GFP_KERNEL);
-	if (nlk->groups == NULL) {
-		err = -ENOMEM;
-		goto out_module;
-	}
-	memset(nlk->groups, 0, NLGRPSZ(groups));
-	nlk->ngroups = groups;
-
-	nlk->module = module;
-out:
-	return err;
-
-out_module:
-	module_put(module);
-	goto out;
-}
-
 static int netlink_release(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
@@ -453,27 +387,14 @@ static int netlink_release(struct socket *sock)
 
 	skb_queue_purge(&sk->sk_write_queue);
 
-	if (nlk->pid && !nlk->subscriptions) {
+	if (nlk->pid && !nlk->groups) {
 		struct netlink_notify n = {
 						.protocol = sk->sk_protocol,
 						.pid = nlk->pid,
 					  };
 		notifier_call_chain(&netlink_chain, NETLINK_URELEASE, &n);
 	}	
-
-	if (nlk->module)
-		module_put(nlk->module);
-
-	if (nlk->flags & NETLINK_KERNEL_SOCKET) {
-		netlink_table_grab();
-		nl_table[sk->sk_protocol].module = NULL;
-		nl_table[sk->sk_protocol].registered = 0;
-		netlink_table_ungrab();
-	}
-
-	kfree(nlk->groups);
-	nlk->groups = NULL;
-
+	
 	sock_put(sk);
 	return 0;
 }
@@ -522,18 +443,6 @@ static inline int netlink_capable(struct socket *sock, unsigned int flag)
 	       capable(CAP_NET_ADMIN);
 } 
 
-static void
-netlink_update_subscriptions(struct sock *sk, unsigned int subscriptions)
-{
-	struct netlink_sock *nlk = nlk_sk(sk);
-
-	if (nlk->subscriptions && !subscriptions)
-		__sk_del_bind_node(sk);
-	else if (!nlk->subscriptions && subscriptions)
-		sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
-	nlk->subscriptions = subscriptions;
-}
-
 static int netlink_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 {
 	struct sock *sk = sock->sk;
@@ -559,14 +468,15 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, int addr_len
 			return err;
 	}
 
-	if (!nladdr->nl_groups && !(u32)nlk->groups[0])
+	if (!nladdr->nl_groups && !nlk->groups)
 		return 0;
 
 	netlink_table_grab();
-	netlink_update_subscriptions(sk, nlk->subscriptions +
-	                                 hweight32(nladdr->nl_groups) -
-	                                 hweight32(nlk->groups[0]));
-	nlk->groups[0] = (nlk->groups[0] & ~0xffffffffUL) | nladdr->nl_groups; 
+	if (nlk->groups && !nladdr->nl_groups)
+		__sk_del_bind_node(sk);
+	else if (!nlk->groups && nladdr->nl_groups)
+		sk_add_bind_node(sk, &nl_table[sk->sk_protocol].mc_list);
+	nlk->groups = nladdr->nl_groups;
 	netlink_table_ungrab();
 
 	return 0;
@@ -583,7 +493,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
 	if (addr->sa_family == AF_UNSPEC) {
 		sk->sk_state	= NETLINK_UNCONNECTED;
 		nlk->dst_pid	= 0;
-		nlk->dst_group  = 0;
+		nlk->dst_groups = 0;
 		return 0;
 	}
 	if (addr->sa_family != AF_NETLINK)
@@ -599,7 +509,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
 	if (err == 0) {
 		sk->sk_state	= NETLINK_CONNECTED;
 		nlk->dst_pid 	= nladdr->nl_pid;
-		nlk->dst_group  = ffs(nladdr->nl_groups);
+		nlk->dst_groups = nladdr->nl_groups;
 	}
 
 	return err;
@@ -617,10 +527,10 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr, int *addr
 
 	if (peer) {
 		nladdr->nl_pid = nlk->dst_pid;
-		nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
+		nladdr->nl_groups = nlk->dst_groups;
 	} else {
 		nladdr->nl_pid = nlk->pid;
-		nladdr->nl_groups = nlk->groups[0];
+		nladdr->nl_groups = nlk->groups;
 	}
 	return 0;
 }
@@ -821,8 +731,7 @@ static inline int do_one_broadcast(struct sock *sk,
 	if (p->exclude_sk == sk)
 		goto out;
 
-	if (nlk->pid == p->pid || p->group - 1 >= nlk->ngroups ||
-	    !test_bit(p->group - 1, nlk->groups))
+	if (nlk->pid == p->pid || !(nlk->groups & p->group))
 		goto out;
 
 	if (p->failure) {
@@ -861,7 +770,7 @@ static inline int do_one_broadcast(struct sock *sk,
 }
 
 int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 pid,
-		      u32 group, unsigned int __nocast allocation)
+		      u32 group, int allocation)
 {
 	struct netlink_broadcast_data info;
 	struct hlist_node *node;
@@ -918,8 +827,7 @@ static inline int do_one_set_err(struct sock *sk,
 	if (sk == p->exclude_sk)
 		goto out;
 
-	if (nlk->pid == p->pid || p->group - 1 >= nlk->ngroups ||
-	    !test_bit(p->group - 1, nlk->groups))
+	if (nlk->pid == p->pid || !(nlk->groups & p->group))
 		goto out;
 
 	sk->sk_err = p->code;
@@ -947,94 +855,6 @@ void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
 	read_unlock(&nl_table_lock);
 }
 
-static int netlink_setsockopt(struct socket *sock, int level, int optname,
-                              char __user *optval, int optlen)
-{
-	struct sock *sk = sock->sk;
-	struct netlink_sock *nlk = nlk_sk(sk);
-	int val = 0, err;
-
-	if (level != SOL_NETLINK)
-		return -ENOPROTOOPT;
-
-	if (optlen >= sizeof(int) &&
-	    get_user(val, (int __user *)optval))
-		return -EFAULT;
-
-	switch (optname) {
-	case NETLINK_PKTINFO:
-		if (val)
-			nlk->flags |= NETLINK_RECV_PKTINFO;
-		else
-			nlk->flags &= ~NETLINK_RECV_PKTINFO;
-		err = 0;
-		break;
-	case NETLINK_ADD_MEMBERSHIP:
-	case NETLINK_DROP_MEMBERSHIP: {
-		unsigned int subscriptions;
-		int old, new = optname == NETLINK_ADD_MEMBERSHIP ? 1 : 0;
-
-		if (!netlink_capable(sock, NL_NONROOT_RECV))
-			return -EPERM;
-		if (!val || val - 1 >= nlk->ngroups)
-			return -EINVAL;
-		netlink_table_grab();
-		old = test_bit(val - 1, nlk->groups);
-		subscriptions = nlk->subscriptions - old + new;
-		if (new)
-			__set_bit(val - 1, nlk->groups);
-		else
-			__clear_bit(val - 1, nlk->groups);
-		netlink_update_subscriptions(sk, subscriptions);
-		netlink_table_ungrab();
-		err = 0;
-		break;
-	}
-	default:
-		err = -ENOPROTOOPT;
-	}
-	return err;
-}
-
-static int netlink_getsockopt(struct socket *sock, int level, int optname,
-                              char __user *optval, int __user *optlen)
-{
-	struct sock *sk = sock->sk;
-	struct netlink_sock *nlk = nlk_sk(sk);
-	int len, val, err;
-
-	if (level != SOL_NETLINK)
-		return -ENOPROTOOPT;
-
-	if (get_user(len, optlen))
-		return -EFAULT;
-	if (len < 0)
-		return -EINVAL;
-
-	switch (optname) {
-	case NETLINK_PKTINFO:
-		if (len < sizeof(int))
-			return -EINVAL;
-		len = sizeof(int);
-		val = nlk->flags & NETLINK_RECV_PKTINFO ? 1 : 0;
-		put_user(len, optlen);
-		put_user(val, optval);
-		err = 0;
-		break;
-	default:
-		err = -ENOPROTOOPT;
-	}
-	return err;
-}
-
-static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
-{
-	struct nl_pktinfo info;
-
-	info.group = NETLINK_CB(skb).dst_group;
-	put_cmsg(msg, SOL_NETLINK, NETLINK_PKTINFO, sizeof(info), &info);
-}
-
 static inline void netlink_rcv_wake(struct sock *sk)
 {
 	struct netlink_sock *nlk = nlk_sk(sk);
@@ -1053,7 +873,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
 	struct netlink_sock *nlk = nlk_sk(sk);
 	struct sockaddr_nl *addr=msg->msg_name;
 	u32 dst_pid;
-	u32 dst_group;
+	u32 dst_groups;
 	struct sk_buff *skb;
 	int err;
 	struct scm_cookie scm;
@@ -1071,12 +891,12 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
 		if (addr->nl_family != AF_NETLINK)
 			return -EINVAL;
 		dst_pid = addr->nl_pid;
-		dst_group = ffs(addr->nl_groups);
-		if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
+		dst_groups = addr->nl_groups;
+		if (dst_groups && !netlink_capable(sock, NL_NONROOT_SEND))
 			return -EPERM;
 	} else {
 		dst_pid = nlk->dst_pid;
-		dst_group = nlk->dst_group;
+		dst_groups = nlk->dst_groups;
 	}
 
 	if (!nlk->pid) {
@@ -1094,8 +914,9 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
 		goto out;
 
 	NETLINK_CB(skb).pid	= nlk->pid;
+	NETLINK_CB(skb).groups	= nlk->groups;
 	NETLINK_CB(skb).dst_pid = dst_pid;
-	NETLINK_CB(skb).dst_group = dst_group;
+	NETLINK_CB(skb).dst_groups = dst_groups;
 	NETLINK_CB(skb).loginuid = audit_get_loginuid(current->audit_context);
 	memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
 
@@ -1117,9 +938,9 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
 		goto out;
 	}
 
-	if (dst_group) {
+	if (dst_groups) {
 		atomic_inc(&skb->users);
-		netlink_broadcast(sk, skb, dst_pid, dst_group, GFP_KERNEL);
+		netlink_broadcast(sk, skb, dst_pid, dst_groups, GFP_KERNEL);
 	}
 	err = netlink_unicast(sk, skb, dst_pid, msg->msg_flags&MSG_DONTWAIT);
 
@@ -1165,7 +986,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
 		addr->nl_family = AF_NETLINK;
 		addr->nl_pad    = 0;
 		addr->nl_pid	= NETLINK_CB(skb).pid;
-		addr->nl_groups	= netlink_group_mask(NETLINK_CB(skb).dst_group);
+		addr->nl_groups	= NETLINK_CB(skb).dst_groups;
 		msg->msg_namelen = sizeof(*addr);
 	}
 
@@ -1180,8 +1001,6 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
 		netlink_dump(sk);
 
 	scm_recv(sock, msg, siocb->scm, flags);
-	if (nlk->flags & NETLINK_RECV_PKTINFO)
-		netlink_cmsg_recv_pktinfo(msg, skb);
 
 out:
 	netlink_rcv_wake(sk);
@@ -1204,13 +1023,10 @@ static void netlink_data_ready(struct sock *sk, int len)
  */
 
 struct sock *
-netlink_kernel_create(int unit, unsigned int groups,
-                      void (*input)(struct sock *sk, int len),
-                      struct module *module)
+netlink_kernel_create(int unit, void (*input)(struct sock *sk, int len))
 {
 	struct socket *sock;
 	struct sock *sk;
-	struct netlink_sock *nlk;
 
 	if (!nl_table)
 		return NULL;
@@ -1221,31 +1037,20 @@ netlink_kernel_create(int unit, unsigned int groups,
 	if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
 		return NULL;
 
-	if (__netlink_create(sock, unit) < 0)
-		goto out_sock_release;
-
+	if (netlink_create(sock, unit) < 0) {
+		sock_release(sock);
+		return NULL;
+	}
 	sk = sock->sk;
 	sk->sk_data_ready = netlink_data_ready;
 	if (input)
 		nlk_sk(sk)->data_ready = input;
 
-	if (netlink_insert(sk, 0))
-		goto out_sock_release;
-
-	nlk = nlk_sk(sk);
-	nlk->flags |= NETLINK_KERNEL_SOCKET;
-
-	netlink_table_grab();
-	nl_table[unit].groups = groups < 32 ? 32 : groups;
-	nl_table[unit].module = module;
-	nl_table[unit].registered = 1;
-	netlink_table_ungrab();
-
+	if (netlink_insert(sk, 0)) {
+		sock_release(sock);
+		return NULL;
+	}
 	return sk;
-
-out_sock_release:
-	sock_release(sock);
-	return NULL;
 }
 
 void netlink_set_nonroot(int protocol, unsigned int flags)
@@ -1483,8 +1288,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
 			   s,
 			   s->sk_protocol,
 			   nlk->pid,
-			   nlk->flags & NETLINK_KERNEL_SOCKET ?
-				0 : (unsigned int)nlk->groups[0],
+			   nlk->groups,
 			   atomic_read(&s->sk_rmem_alloc),
 			   atomic_read(&s->sk_wmem_alloc),
 			   nlk->cb,
@@ -1558,8 +1362,8 @@ static struct proto_ops netlink_ops = {
 	.ioctl =	sock_no_ioctl,
 	.listen =	sock_no_listen,
 	.shutdown =	sock_no_shutdown,
-	.setsockopt =	netlink_setsockopt,
-	.getsockopt =	netlink_getsockopt,
+	.setsockopt =	sock_no_setsockopt,
+	.getsockopt =	sock_no_getsockopt,
 	.sendmsg =	netlink_sendmsg,
 	.recvmsg =	netlink_recvmsg,
 	.mmap =		sock_no_mmap,
@@ -1634,7 +1438,21 @@ static int __init netlink_proto_init(void)
 	return err;
 }
 
+static void __exit netlink_proto_exit(void)
+{
+	sock_unregister(PF_NETLINK);
+	proc_net_remove("netlink");
+	kfree(nl_table);
+	nl_table = NULL;
+	proto_unregister(&netlink_proto);
+}
+
 core_initcall(netlink_proto_init);
+module_exit(netlink_proto_exit);
+
+MODULE_LICENSE("GPL");
+
+MODULE_ALIAS_NETPROTO(PF_NETLINK);
 
 EXPORT_SYMBOL(netlink_ack);
 EXPORT_SYMBOL(netlink_broadcast);
diff --git a/trunk/net/netrom/af_netrom.c b/trunk/net/netrom/af_netrom.c
index 4b53de982114..162a85fed150 100644
--- a/trunk/net/netrom/af_netrom.c
+++ b/trunk/net/netrom/af_netrom.c
@@ -39,7 +39,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <net/ip.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <net/arp.h>
 #include <linux/init.h>
 
@@ -858,16 +858,17 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
 	frametype          = skb->data[19] & 0x0F;
 	flags              = skb->data[19] & 0xF0;
 
+#ifdef CONFIG_INET
 	/*
 	 * Check for an incoming IP over NET/ROM frame.
 	 */
-	if (frametype == NR_PROTOEXT &&
-	    circuit_index == NR_PROTO_IP && circuit_id == NR_PROTO_IP) {
+	if (frametype == NR_PROTOEXT && circuit_index == NR_PROTO_IP && circuit_id == NR_PROTO_IP) {
 		skb_pull(skb, NR_NETWORK_LEN + NR_TRANSPORT_LEN);
 		skb->h.raw = skb->data;
 
 		return nr_rx_ip(skb, dev);
 	}
+#endif
 
 	/*
 	 * Find an existing socket connection, based on circuit ID, if it's
diff --git a/trunk/net/netrom/nr_dev.c b/trunk/net/netrom/nr_dev.c
index 263da4c26494..220bf7494f71 100644
--- a/trunk/net/netrom/nr_dev.c
+++ b/trunk/net/netrom/nr_dev.c
@@ -38,6 +38,8 @@
 #include <net/ax25.h>
 #include <net/netrom.h>
 
+#ifdef CONFIG_INET
+
 /*
  *	Only allow IP over NET/ROM frames through if the netrom device is up.
  */
@@ -62,12 +64,11 @@ int nr_rx_ip(struct sk_buff *skb, struct net_device *dev)
 	skb->nh.raw   = skb->data;
 	skb->pkt_type = PACKET_HOST;
 
-	netif_rx(skb);
+	ip_rcv(skb, skb->dev, NULL);
 
 	return 1;
 }
 
-#ifdef CONFIG_INET
 
 static int nr_rebuild_header(struct sk_buff *skb)
 {
diff --git a/trunk/net/netrom/nr_in.c b/trunk/net/netrom/nr_in.c
index 64b81a796907..9c44b3794126 100644
--- a/trunk/net/netrom/nr_in.c
+++ b/trunk/net/netrom/nr_in.c
@@ -22,7 +22,8 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
+#include <net/ip.h>			/* For ip_rcv */
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
diff --git a/trunk/net/netrom/nr_subr.c b/trunk/net/netrom/nr_subr.c
index 587bed2674bf..0627347b14b8 100644
--- a/trunk/net/netrom/nr_subr.c
+++ b/trunk/net/netrom/nr_subr.c
@@ -21,7 +21,7 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
@@ -77,7 +77,7 @@ void nr_requeue_frames(struct sock *sk)
 		if (skb_prev == NULL)
 			skb_queue_head(&sk->sk_write_queue, skb);
 		else
-			skb_append(skb_prev, skb, &sk->sk_write_queue);
+			skb_append(skb_prev, skb);
 		skb_prev = skb;
 	}
 }
diff --git a/trunk/net/netrom/nr_timer.c b/trunk/net/netrom/nr_timer.c
index 75b72d389ba9..faabda8088be 100644
--- a/trunk/net/netrom/nr_timer.c
+++ b/trunk/net/netrom/nr_timer.c
@@ -22,7 +22,7 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
diff --git a/trunk/net/packet/af_packet.c b/trunk/net/packet/af_packet.c
index ba997095f08f..c9d5980aa4de 100644
--- a/trunk/net/packet/af_packet.c
+++ b/trunk/net/packet/af_packet.c
@@ -241,7 +241,7 @@ static struct proto_ops packet_ops;
 #ifdef CONFIG_SOCK_PACKET
 static struct proto_ops packet_ops_spkt;
 
-static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
+static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt)
 {
 	struct sock *sk;
 	struct sockaddr_pkt *spkt;
@@ -441,7 +441,7 @@ static inline unsigned run_filter(struct sk_buff *skb, struct sock *sk, unsigned
    we will not harm anyone.
  */
 
-static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int packet_rcv(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt)
 {
 	struct sock *sk;
 	struct sockaddr_ll *sll;
@@ -546,7 +546,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
 }
 
 #ifdef CONFIG_PACKET_MMAP
-static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt)
 {
 	struct sock *sk;
 	struct packet_sock *po;
@@ -635,12 +635,12 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
 	h->tp_snaplen = snaplen;
 	h->tp_mac = macoff;
 	h->tp_net = netoff;
-	if (skb->tstamp.off_sec == 0) { 
-		__net_timestamp(skb);
+	if (skb->stamp.tv_sec == 0) { 
+		do_gettimeofday(&skb->stamp);
 		sock_enable_timestamp(sk);
 	}
-	h->tp_sec = skb_tv_base.tv_sec + skb->tstamp.off_sec;
-	h->tp_usec = skb_tv_base.tv_usec + skb->tstamp.off_usec;
+	h->tp_sec = skb->stamp.tv_sec;
+	h->tp_usec = skb->stamp.tv_usec;
 
 	sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
 	sll->sll_halen = 0;
diff --git a/trunk/net/rose/af_rose.c b/trunk/net/rose/af_rose.c
index c6e59f84c3ae..5480caf8ccc2 100644
--- a/trunk/net/rose/af_rose.c
+++ b/trunk/net/rose/af_rose.c
@@ -41,7 +41,7 @@
 #include <net/rose.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <net/ip.h>
 #include <net/arp.h>
 
diff --git a/trunk/net/rose/rose_in.c b/trunk/net/rose/rose_in.c
index 8348d33f1efe..ef475a1bb1ba 100644
--- a/trunk/net/rose/rose_in.c
+++ b/trunk/net/rose/rose_in.c
@@ -26,7 +26,8 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/ip.h>			/* For ip_rcv */
+#include <net/tcp.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
diff --git a/trunk/net/rose/rose_route.c b/trunk/net/rose/rose_route.c
index 4510cd7613ec..25da6f699fd0 100644
--- a/trunk/net/rose/rose_route.c
+++ b/trunk/net/rose/rose_route.c
@@ -24,7 +24,7 @@
 #include <linux/if_arp.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
 #include <linux/fcntl.h>
diff --git a/trunk/net/rose/rose_subr.c b/trunk/net/rose/rose_subr.c
index a29a3a960fd6..7db7e1cedc3a 100644
--- a/trunk/net/rose/rose_subr.c
+++ b/trunk/net/rose/rose_subr.c
@@ -21,7 +21,7 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
@@ -74,7 +74,7 @@ void rose_requeue_frames(struct sock *sk)
 		if (skb_prev == NULL)
 			skb_queue_head(&sk->sk_write_queue, skb);
 		else
-			skb_append(skb_prev, skb, &sk->sk_write_queue);
+			skb_append(skb_prev, skb);
 		skb_prev = skb;
 	}
 }
diff --git a/trunk/net/rose/rose_timer.c b/trunk/net/rose/rose_timer.c
index 50ae0371dab8..84dd4403f792 100644
--- a/trunk/net/rose/rose_timer.c
+++ b/trunk/net/rose/rose_timer.c
@@ -22,7 +22,7 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/system.h>
 #include <linux/fcntl.h>
 #include <linux/mm.h>
diff --git a/trunk/net/rxrpc/transport.c b/trunk/net/rxrpc/transport.c
index 122c086ee2db..9bce7794130a 100644
--- a/trunk/net/rxrpc/transport.c
+++ b/trunk/net/rxrpc/transport.c
@@ -330,7 +330,7 @@ static int rxrpc_incoming_msg(struct rxrpc_transport *trans,
 
 	msg->trans = trans;
 	msg->state = RXRPC_MSG_RECEIVED;
-	skb_get_timestamp(pkt, &msg->stamp);
+	msg->stamp = pkt->stamp;
 	if (msg->stamp.tv_sec == 0) {
 		do_gettimeofday(&msg->stamp); 
 		if (pkt->sk) 
diff --git a/trunk/net/sched/Kconfig b/trunk/net/sched/Kconfig
index 45d3bc0812c8..59d3e71f8b85 100644
--- a/trunk/net/sched/Kconfig
+++ b/trunk/net/sched/Kconfig
@@ -491,7 +491,6 @@ config NET_EMATCH_TEXT
 	depends on NET_EMATCH
 	select TEXTSEARCH
 	select TEXTSEARCH_KMP
-	select TEXTSEARCH_BM
 	select TEXTSEARCH_FSM
 	---help---
 	  Say Y here if you want to be ablt to classify packets based on
diff --git a/trunk/net/sched/act_api.c b/trunk/net/sched/act_api.c
index 8aebe8f6d271..249c61936ea0 100644
--- a/trunk/net/sched/act_api.c
+++ b/trunk/net/sched/act_api.c
@@ -165,7 +165,7 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action *act,
 	while ((a = act) != NULL) {
 repeat:
 		if (a->ops && a->ops->act) {
-			ret = a->ops->act(&skb, a, res);
+			ret = a->ops->act(&skb, a);
 			if (TC_MUNGED & skb->tc_verd) {
 				/* copied already, allow trampling */
 				skb->tc_verd = SET_TC_OK2MUNGE(skb->tc_verd);
@@ -179,6 +179,11 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action *act,
 		act = a->next;
 	}
 exec_done:
+	if (skb->tc_classid > 0) {
+		res->classid = skb->tc_classid;
+		res->class = 0;
+		skb->tc_classid = 0;
+	}
 	return ret;
 }
 
@@ -593,7 +598,7 @@ static int tca_action_flush(struct rtattr *rta, struct nlmsghdr *n, u32 pid)
 	nlh->nlmsg_flags |= NLM_F_ROOT;
 	module_put(a->ops->owner);
 	kfree(a);
-	err = rtnetlink_send(skb, pid, RTNLGRP_TC, n->nlmsg_flags&NLM_F_ECHO);
+	err = rtnetlink_send(skb, pid, RTMGRP_TC, n->nlmsg_flags&NLM_F_ECHO);
 	if (err > 0)
 		return 0;
 
@@ -656,7 +661,7 @@ tca_action_gd(struct rtattr *rta, struct nlmsghdr *n, u32 pid, int event)
 
 		/* now do the delete */
 		tcf_action_destroy(head, 0);
-		ret = rtnetlink_send(skb, pid, RTNLGRP_TC,
+		ret = rtnetlink_send(skb, pid, RTMGRP_TC,
 		                     n->nlmsg_flags&NLM_F_ECHO);
 		if (ret > 0)
 			return 0;
@@ -698,9 +703,9 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
 	x->rta_len = skb->tail - (u8*)x;
 	
 	nlh->nlmsg_len = skb->tail - b;
-	NETLINK_CB(skb).dst_group = RTNLGRP_TC;
+	NETLINK_CB(skb).dst_groups = RTMGRP_TC;
 	
-	err = rtnetlink_send(skb, pid, RTNLGRP_TC, flags&NLM_F_ECHO);
+	err = rtnetlink_send(skb, pid, RTMGRP_TC, flags&NLM_F_ECHO);
 	if (err > 0)
 		err = 0;
 	return err;
diff --git a/trunk/net/sched/cls_api.c b/trunk/net/sched/cls_api.c
index b4d89fbb3782..3b5714ef4d1a 100644
--- a/trunk/net/sched/cls_api.c
+++ b/trunk/net/sched/cls_api.c
@@ -367,7 +367,7 @@ static int tfilter_notify(struct sk_buff *oskb, struct nlmsghdr *n,
 		return -EINVAL;
 	}
 
-	return rtnetlink_send(skb, pid, RTNLGRP_TC, n->nlmsg_flags&NLM_F_ECHO);
+	return rtnetlink_send(skb, pid, RTMGRP_TC, n->nlmsg_flags&NLM_F_ECHO);
 }
 
 struct tcf_dump_args
diff --git a/trunk/net/sched/gact.c b/trunk/net/sched/gact.c
index d1c6d542912a..a811c89fef7f 100644
--- a/trunk/net/sched/gact.c
+++ b/trunk/net/sched/gact.c
@@ -135,7 +135,7 @@ tcf_gact_cleanup(struct tc_action *a, int bind)
 }
 
 static int
-tcf_gact(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+tcf_gact(struct sk_buff **pskb, struct tc_action *a)
 {
 	struct tcf_gact *p = PRIV(a, gact);
 	struct sk_buff *skb = *pskb;
diff --git a/trunk/net/sched/ipt.c b/trunk/net/sched/ipt.c
index f50136eed211..b114d994d523 100644
--- a/trunk/net/sched/ipt.c
+++ b/trunk/net/sched/ipt.c
@@ -201,7 +201,7 @@ tcf_ipt_cleanup(struct tc_action *a, int bind)
 }
 
 static int
-tcf_ipt(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+tcf_ipt(struct sk_buff **pskb, struct tc_action *a)
 {
 	int ret = 0, result = 0;
 	struct tcf_ipt *p = PRIV(a, ipt);
diff --git a/trunk/net/sched/mirred.c b/trunk/net/sched/mirred.c
index 20d06916dc0b..f309ce336803 100644
--- a/trunk/net/sched/mirred.c
+++ b/trunk/net/sched/mirred.c
@@ -158,7 +158,7 @@ tcf_mirred_cleanup(struct tc_action *a, int bind)
 }
 
 static int
-tcf_mirred(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+tcf_mirred(struct sk_buff **pskb, struct tc_action *a)
 {
 	struct tcf_mirred *p = PRIV(a, mirred);
 	struct net_device *dev;
diff --git a/trunk/net/sched/pedit.c b/trunk/net/sched/pedit.c
index 767d24f4610e..678be6a645fb 100644
--- a/trunk/net/sched/pedit.c
+++ b/trunk/net/sched/pedit.c
@@ -130,7 +130,7 @@ tcf_pedit_cleanup(struct tc_action *a, int bind)
 }
 
 static int
-tcf_pedit(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+tcf_pedit(struct sk_buff **pskb, struct tc_action *a)
 {
 	struct tcf_pedit *p = PRIV(a, pedit);
 	struct sk_buff *skb = *pskb;
diff --git a/trunk/net/sched/police.c b/trunk/net/sched/police.c
index eb39fb2f39b6..c03545faf523 100644
--- a/trunk/net/sched/police.c
+++ b/trunk/net/sched/police.c
@@ -284,8 +284,7 @@ static int tcf_act_police_cleanup(struct tc_action *a, int bind)
 	return 0;
 }
 
-static int tcf_act_police(struct sk_buff **pskb, struct tc_action *a,
-                          struct tcf_result *res)
+static int tcf_act_police(struct sk_buff **pskb, struct tc_action *a)
 {
 	psched_time_t now;
 	struct sk_buff *skb = *pskb;
diff --git a/trunk/net/sched/sch_api.c b/trunk/net/sched/sch_api.c
index 737681cb9a92..b9a069af4a02 100644
--- a/trunk/net/sched/sch_api.c
+++ b/trunk/net/sched/sch_api.c
@@ -816,7 +816,7 @@ static int qdisc_notify(struct sk_buff *oskb, struct nlmsghdr *n,
 	}
 
 	if (skb->len)
-		return rtnetlink_send(skb, pid, RTNLGRP_TC, n->nlmsg_flags&NLM_F_ECHO);
+		return rtnetlink_send(skb, pid, RTMGRP_TC, n->nlmsg_flags&NLM_F_ECHO);
 
 err_out:
 	kfree_skb(skb);
@@ -1040,7 +1040,7 @@ static int tclass_notify(struct sk_buff *oskb, struct nlmsghdr *n,
 		return -EINVAL;
 	}
 
-	return rtnetlink_send(skb, pid, RTNLGRP_TC, n->nlmsg_flags&NLM_F_ECHO);
+	return rtnetlink_send(skb, pid, RTMGRP_TC, n->nlmsg_flags&NLM_F_ECHO);
 }
 
 struct qdisc_dump_args
diff --git a/trunk/net/sched/sch_generic.c b/trunk/net/sched/sch_generic.c
index 99ceb91f0150..0d066c965342 100644
--- a/trunk/net/sched/sch_generic.c
+++ b/trunk/net/sched/sch_generic.c
@@ -238,20 +238,6 @@ static void dev_watchdog_down(struct net_device *dev)
 	spin_unlock_bh(&dev->xmit_lock);
 }
 
-void netif_carrier_on(struct net_device *dev)
-{
-	if (test_and_clear_bit(__LINK_STATE_NOCARRIER, &dev->state))
-		linkwatch_fire_event(dev);
-	if (netif_running(dev))
-		__netdev_watchdog_up(dev);
-}
-
-void netif_carrier_off(struct net_device *dev)
-{
-	if (!test_and_set_bit(__LINK_STATE_NOCARRIER, &dev->state))
-		linkwatch_fire_event(dev);
-}
-
 /* "NOOP" scheduler: the best scheduler, recommended for all interfaces
    under all circumstances. It is difficult to invent anything faster or
    cheaper.
@@ -614,8 +600,6 @@ void dev_shutdown(struct net_device *dev)
 }
 
 EXPORT_SYMBOL(__netdev_watchdog_up);
-EXPORT_SYMBOL(netif_carrier_on);
-EXPORT_SYMBOL(netif_carrier_off);
 EXPORT_SYMBOL(noop_qdisc);
 EXPORT_SYMBOL(noop_qdisc_ops);
 EXPORT_SYMBOL(qdisc_create_dflt);
diff --git a/trunk/net/sched/simple.c b/trunk/net/sched/simple.c
index 8a6ae4f491e8..3ab4c675ab5d 100644
--- a/trunk/net/sched/simple.c
+++ b/trunk/net/sched/simple.c
@@ -44,7 +44,7 @@ static DEFINE_RWLOCK(simp_lock);
 #include <net/pkt_act.h>
 #include <net/act_generic.h>
 
-static int tcf_simp(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+static int tcf_simp(struct sk_buff **pskb, struct tc_action *a)
 {
 	struct sk_buff *skb = *pskb;
 	struct tcf_defact *p = PRIV(a, defact);
diff --git a/trunk/net/sctp/input.c b/trunk/net/sctp/input.c
index 28f32243397f..742be9171b7d 100644
--- a/trunk/net/sctp/input.c
+++ b/trunk/net/sctp/input.c
@@ -236,8 +236,8 @@ int sctp_rcv(struct sk_buff *skb)
 	}
 
 	/* SCTP seems to always need a timestamp right now (FIXME) */
-	if (skb->tstamp.off_sec == 0) {
-		__net_timestamp(skb);
+	if (skb->stamp.tv_sec == 0) {
+		do_gettimeofday(&skb->stamp);
 		sock_enable_timestamp(sk); 
 	}
 
diff --git a/trunk/net/sctp/ipv6.c b/trunk/net/sctp/ipv6.c
index fa3be2b8fb5f..e9b2fd480d61 100644
--- a/trunk/net/sctp/ipv6.c
+++ b/trunk/net/sctp/ipv6.c
@@ -66,8 +66,8 @@
 #include <linux/seq_file.h>
 
 #include <net/protocol.h>
+#include <net/tcp.h>
 #include <net/ndisc.h>
-#include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/transp_v6.h>
 #include <net/addrconf.h>
@@ -641,7 +641,10 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
 	else
 		newinet->pmtudisc = IP_PMTUDISC_WANT;
 
-	sk_refcnt_debug_inc(newsk);
+#ifdef INET_REFCNT_DEBUG
+	atomic_inc(&inet6_sock_nr);
+	atomic_inc(&inet_sock_nr);
+#endif
 
 	if (newsk->sk_prot->init(newsk)) {
 		sk_common_release(newsk);
diff --git a/trunk/net/sctp/protocol.c b/trunk/net/sctp/protocol.c
index e7025be77691..ce9245e71fca 100644
--- a/trunk/net/sctp/protocol.c
+++ b/trunk/net/sctp/protocol.c
@@ -62,7 +62,7 @@
 /* Global data structures. */
 struct sctp_globals sctp_globals;
 struct proc_dir_entry	*proc_net_sctp;
-DEFINE_SNMP_STAT(struct sctp_mib, sctp_statistics) __read_mostly;
+DEFINE_SNMP_STAT(struct sctp_mib, sctp_statistics);
 
 struct idr sctp_assocs_id;
 DEFINE_SPINLOCK(sctp_assocs_id_lock);
@@ -78,8 +78,8 @@ static struct sctp_pf *sctp_pf_inet_specific;
 static struct sctp_af *sctp_af_v4_specific;
 static struct sctp_af *sctp_af_v6_specific;
 
-kmem_cache_t *sctp_chunk_cachep __read_mostly;
-kmem_cache_t *sctp_bucket_cachep __read_mostly;
+kmem_cache_t *sctp_chunk_cachep;
+kmem_cache_t *sctp_bucket_cachep;
 
 extern int sctp_snmp_proc_init(void);
 extern int sctp_snmp_proc_exit(void);
@@ -593,7 +593,9 @@ static struct sock *sctp_v4_create_accept_sk(struct sock *sk,
 	newinet->mc_index = 0;
 	newinet->mc_list = NULL;
 
-	sk_refcnt_debug_inc(newsk);
+#ifdef INET_REFCNT_DEBUG
+	atomic_inc(&inet_sock_nr);
+#endif
 
 	if (newsk->sk_prot->init(newsk)) {
 		sk_common_release(newsk);
@@ -1242,10 +1244,6 @@ SCTP_STATIC __exit void sctp_exit(void)
 module_init(sctp_init);
 module_exit(sctp_exit);
 
-/*
- * __stringify doesn't likes enums, so use IPPROTO_SCTP value (132) directly.
- */
-MODULE_ALIAS("net-pf-" __stringify(PF_INET) "-proto-132");
 MODULE_AUTHOR("Linux Kernel SCTP developers <lksctp-developers@lists.sourceforge.net>");
 MODULE_DESCRIPTION("Support for the SCTP protocol (RFC2960)");
 MODULE_LICENSE("GPL");
diff --git a/trunk/net/sctp/sm_make_chunk.c b/trunk/net/sctp/sm_make_chunk.c
index 3868a8d70cc0..00d32b7c8266 100644
--- a/trunk/net/sctp/sm_make_chunk.c
+++ b/trunk/net/sctp/sm_make_chunk.c
@@ -1362,7 +1362,6 @@ struct sctp_association *sctp_unpack_cookie(
 	char *key;
 	sctp_scope_t scope;
 	struct sk_buff *skb = chunk->skb;
-	struct timeval tv;
 
 	headersize = sizeof(sctp_chunkhdr_t) + SCTP_SECRET_SIZE;
 	bodysize = ntohs(chunk->chunk_hdr->length) - headersize;
@@ -1435,8 +1434,7 @@ struct sctp_association *sctp_unpack_cookie(
 	 * an association, there is no need to check cookie's expiration
 	 * for init collision case of lost COOKIE ACK.
 	 */
-	skb_get_timestamp(skb, &tv);
-	if (!asoc && tv_lt(bear_cookie->expiration, tv)) {
+	if (!asoc && tv_lt(bear_cookie->expiration, skb->stamp)) {
 		__u16 len;
 		/*
 		 * Section 3.3.10.3 Stale Cookie Error (3)
@@ -1449,9 +1447,10 @@ struct sctp_association *sctp_unpack_cookie(
 		len = ntohs(chunk->chunk_hdr->length);
 		*errp = sctp_make_op_error_space(asoc, chunk, len);
 		if (*errp) {
-			suseconds_t usecs = (tv.tv_sec -
+			suseconds_t usecs = (skb->stamp.tv_sec -
 				bear_cookie->expiration.tv_sec) * 1000000L +
-				tv.tv_usec - bear_cookie->expiration.tv_usec;
+				skb->stamp.tv_usec -
+				bear_cookie->expiration.tv_usec;
 
 			usecs = htonl(usecs);
 			sctp_init_cause(*errp, SCTP_ERROR_STALE_COOKIE,
diff --git a/trunk/net/sctp/socket.c b/trunk/net/sctp/socket.c
index 4454afe4727e..091a66f06a35 100644
--- a/trunk/net/sctp/socket.c
+++ b/trunk/net/sctp/socket.c
@@ -4892,7 +4892,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 	sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
 		event = sctp_skb2event(skb);
 		if (event->asoc == assoc) {
-			__skb_unlink(skb, &oldsk->sk_receive_queue);
+			__skb_unlink(skb, skb->list);
 			__skb_queue_tail(&newsk->sk_receive_queue, skb);
 		}
 	}
@@ -4921,7 +4921,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 		sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
 			event = sctp_skb2event(skb);
 			if (event->asoc == assoc) {
-				__skb_unlink(skb, &oldsp->pd_lobby);
+				__skb_unlink(skb, skb->list);
 				__skb_queue_tail(queue, skb);
 			}
 		}
diff --git a/trunk/net/sctp/ulpqueue.c b/trunk/net/sctp/ulpqueue.c
index ec2c857eae7f..8bbc279d6c99 100644
--- a/trunk/net/sctp/ulpqueue.c
+++ b/trunk/net/sctp/ulpqueue.c
@@ -50,9 +50,9 @@
 
 /* Forward declarations for internal helpers.  */
 static struct sctp_ulpevent * sctp_ulpq_reasm(struct sctp_ulpq *ulpq,
-					      struct sctp_ulpevent *);
+						struct sctp_ulpevent *);
 static struct sctp_ulpevent * sctp_ulpq_order(struct sctp_ulpq *,
-					      struct sctp_ulpevent *);
+						struct sctp_ulpevent *);
 
 /* 1st Level Abstractions */
 
@@ -125,9 +125,7 @@ int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
 		event = sctp_ulpq_order(ulpq, event);
 	}
 
-	/* Send event to the ULP.  'event' is the sctp_ulpevent for
-	 * very first SKB on the 'temp' list.
-	 */
+	/* Send event to the ULP.  */
 	if (event)
 		sctp_ulpq_tail_event(ulpq, event);
 
@@ -160,18 +158,14 @@ static int sctp_ulpq_clear_pd(struct sctp_ulpq *ulpq)
 	return sctp_clear_pd(ulpq->asoc->base.sk);
 }
 
-/* If the SKB of 'event' is on a list, it is the first such member
- * of that list.
- */
+
+
 int sctp_ulpq_tail_event(struct sctp_ulpq *ulpq, struct sctp_ulpevent *event)
 {
 	struct sock *sk = ulpq->asoc->base.sk;
-	struct sk_buff_head *queue, *skb_list;
-	struct sk_buff *skb = sctp_event2skb(event);
+	struct sk_buff_head *queue;
 	int clear_pd = 0;
 
-	skb_list = (struct sk_buff_head *) skb->prev;
-
 	/* If the socket is just going to throw this away, do not
 	 * even try to deliver it.
 	 */
@@ -203,10 +197,10 @@ int sctp_ulpq_tail_event(struct sctp_ulpq *ulpq, struct sctp_ulpevent *event)
 	/* If we are harvesting multiple skbs they will be
 	 * collected on a list.
 	 */
-	if (skb_list)
-		sctp_skb_list_tail(skb_list, queue);
+	if (sctp_event2skb(event)->list)
+		sctp_skb_list_tail(sctp_event2skb(event)->list, queue);
 	else
-		__skb_queue_tail(queue, skb);
+		__skb_queue_tail(queue, sctp_event2skb(event));
 
 	/* Did we just complete partial delivery and need to get
 	 * rolling again?  Move pending data to the receive
@@ -220,11 +214,10 @@ int sctp_ulpq_tail_event(struct sctp_ulpq *ulpq, struct sctp_ulpevent *event)
 	return 1;
 
 out_free:
-	if (skb_list)
-		sctp_queue_purge_ulpevents(skb_list);
+	if (sctp_event2skb(event)->list)
+		sctp_queue_purge_ulpevents(sctp_event2skb(event)->list);
 	else
 		sctp_ulpevent_free(event);
-
 	return 0;
 }
 
@@ -276,7 +269,7 @@ static inline void sctp_ulpq_store_reasm(struct sctp_ulpq *ulpq,
  * payload was fragmented on the way and ip had to reassemble them.
  * We add the rest of skb's to the first skb's fraglist.
  */
-static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *queue, struct sk_buff *f_frag, struct sk_buff *l_frag)
+static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff *f_frag, struct sk_buff *l_frag)
 {
 	struct sk_buff *pos;
 	struct sctp_ulpevent *event;
@@ -301,7 +294,7 @@ static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *qu
 		skb_shinfo(f_frag)->frag_list = pos;
 
 	/* Remove the first fragment from the reassembly queue.  */
-	__skb_unlink(f_frag, queue);
+	__skb_unlink(f_frag, f_frag->list);
 	while (pos) {
 
 		pnext = pos->next;
@@ -311,7 +304,7 @@ static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *qu
 		f_frag->data_len += pos->len;
 
 		/* Remove the fragment from the reassembly queue.  */
-		__skb_unlink(pos, queue);
+		__skb_unlink(pos, pos->list);
 	
 		/* Break if we have reached the last fragment.  */
 		if (pos == l_frag)
@@ -382,7 +375,7 @@ static inline struct sctp_ulpevent *sctp_ulpq_retrieve_reassembled(struct sctp_u
 done:
 	return retval;
 found:
-	retval = sctp_make_reassembled_event(&ulpq->reasm, first_frag, pos);
+	retval = sctp_make_reassembled_event(first_frag, pos);
 	if (retval)
 		retval->msg_flags |= MSG_EOR;
 	goto done;
@@ -442,7 +435,7 @@ static inline struct sctp_ulpevent *sctp_ulpq_retrieve_partial(struct sctp_ulpq
 	 * further.
 	 */
 done:
-	retval = sctp_make_reassembled_event(&ulpq->reasm, first_frag, last_frag);
+	retval = sctp_make_reassembled_event(first_frag, last_frag);
 	if (retval && is_last)
 		retval->msg_flags |= MSG_EOR;
 
@@ -534,7 +527,7 @@ static inline struct sctp_ulpevent *sctp_ulpq_retrieve_first(struct sctp_ulpq *u
 	 * further.
 	 */
 done:
-	retval = sctp_make_reassembled_event(&ulpq->reasm, first_frag, last_frag);
+	retval = sctp_make_reassembled_event(first_frag, last_frag);
 	return retval;
 }
 
@@ -544,7 +537,6 @@ static inline struct sctp_ulpevent *sctp_ulpq_retrieve_first(struct sctp_ulpq *u
 static inline void sctp_ulpq_retrieve_ordered(struct sctp_ulpq *ulpq,
 					      struct sctp_ulpevent *event)
 {
-	struct sk_buff_head *event_list;
 	struct sk_buff *pos, *tmp;
 	struct sctp_ulpevent *cevent;
 	struct sctp_stream *in;
@@ -555,8 +547,6 @@ static inline void sctp_ulpq_retrieve_ordered(struct sctp_ulpq *ulpq,
 	ssn = event->ssn;
 	in  = &ulpq->asoc->ssnmap->in;
 
-	event_list = (struct sk_buff_head *) sctp_event2skb(event)->prev;
-
 	/* We are holding the chunks by stream, by SSN.  */
 	sctp_skb_for_each(pos, &ulpq->lobby, tmp) {
 		cevent = (struct sctp_ulpevent *) pos->cb;
@@ -577,10 +567,10 @@ static inline void sctp_ulpq_retrieve_ordered(struct sctp_ulpq *ulpq,
 		/* Found it, so mark in the ssnmap. */
 		sctp_ssn_next(in, sid);
 
-		__skb_unlink(pos, &ulpq->lobby);
+		__skb_unlink(pos, pos->list);
 
 		/* Attach all gathered skbs to the event.  */
-		__skb_queue_tail(event_list, pos);
+		__skb_queue_tail(sctp_event2skb(event)->list, pos);
 	}
 }
 
@@ -636,7 +626,7 @@ static inline void sctp_ulpq_store_ordered(struct sctp_ulpq *ulpq,
 }
 
 static struct sctp_ulpevent *sctp_ulpq_order(struct sctp_ulpq *ulpq,
-					     struct sctp_ulpevent *event)
+						struct sctp_ulpevent *event)
 {
 	__u16 sid, ssn;
 	struct sctp_stream *in;
@@ -677,7 +667,7 @@ static inline void sctp_ulpq_reap_ordered(struct sctp_ulpq *ulpq)
 {
 	struct sk_buff *pos, *tmp;
 	struct sctp_ulpevent *cevent;
-	struct sctp_ulpevent *event;
+	struct sctp_ulpevent *event = NULL;
 	struct sctp_stream *in;
 	struct sk_buff_head temp;
 	__u16 csid, cssn;
@@ -685,8 +675,6 @@ static inline void sctp_ulpq_reap_ordered(struct sctp_ulpq *ulpq)
 	in  = &ulpq->asoc->ssnmap->in;
 
 	/* We are holding the chunks by stream, by SSN.  */
-	skb_queue_head_init(&temp);
-	event = NULL;
 	sctp_skb_for_each(pos, &ulpq->lobby, tmp) {
 		cevent = (struct sctp_ulpevent *) pos->cb;
 		csid = cevent->stream;
@@ -698,20 +686,19 @@ static inline void sctp_ulpq_reap_ordered(struct sctp_ulpq *ulpq)
 		/* Found it, so mark in the ssnmap. */	       
 		sctp_ssn_next(in, csid);
 
-		__skb_unlink(pos, &ulpq->lobby);
+		__skb_unlink(pos, pos->list);
 		if (!event) {						
 			/* Create a temporary list to collect chunks on.  */
 			event = sctp_skb2event(pos);
+			skb_queue_head_init(&temp);
 			__skb_queue_tail(&temp, sctp_event2skb(event));
 		} else {
 			/* Attach all gathered skbs to the event.  */
-			__skb_queue_tail(&temp, pos);
+			__skb_queue_tail(sctp_event2skb(event)->list, pos);
 		}
 	}
 
-	/* Send event to the ULP.  'event' is the sctp_ulpevent for
-	 * very first SKB on the 'temp' list.
-	 */
+	/* Send event to the ULP.  */
 	if (event)
 		sctp_ulpq_tail_event(ulpq, event);
 }
diff --git a/trunk/net/socket.c b/trunk/net/socket.c
index 94fe638b4d72..6f2a17881972 100644
--- a/trunk/net/socket.c
+++ b/trunk/net/socket.c
@@ -70,8 +70,6 @@
 #include <linux/seq_file.h>
 #include <linux/wanrouter.h>
 #include <linux/if_bridge.h>
-#include <linux/if_frad.h>
-#include <linux/if_vlan.h>
 #include <linux/init.h>
 #include <linux/poll.h>
 #include <linux/cache.h>
@@ -274,7 +272,7 @@ int move_addr_to_user(void *kaddr, int klen, void __user *uaddr, int __user *ule
 
 #define SOCKFS_MAGIC 0x534F434B
 
-static kmem_cache_t * sock_inode_cachep __read_mostly;
+static kmem_cache_t * sock_inode_cachep;
 
 static struct inode *sock_alloc_inode(struct super_block *sb)
 {
@@ -333,7 +331,7 @@ static struct super_block *sockfs_get_sb(struct file_system_type *fs_type,
 	return get_sb_pseudo(fs_type, "socket:", &sockfs_ops, SOCKFS_MAGIC);
 }
 
-static struct vfsmount *sock_mnt __read_mostly;
+static struct vfsmount *sock_mnt;
 
 static struct file_system_type sock_fs_type = {
 	.name =		"sockfs",
@@ -406,7 +404,6 @@ int sock_map_fd(struct socket *sock)
 		file->f_mode = FMODE_READ | FMODE_WRITE;
 		file->f_flags = O_RDWR;
 		file->f_pos = 0;
-		file->private_data = sock;
 		fd_install(fd, file);
 	}
 
@@ -439,9 +436,6 @@ struct socket *sockfd_lookup(int fd, int *err)
 		return NULL;
 	}
 
-	if (file->f_op == &socket_file_ops)
-		return file->private_data;	/* set in sock_map_fd */
-
 	inode = file->f_dentry->d_inode;
 	if (!S_ISSOCK(inode->i_mode)) {
 		*err = -ENOTSOCK;
@@ -726,8 +720,8 @@ static ssize_t sock_aio_write(struct kiocb *iocb, const char __user *ubuf,
 	return __sock_sendmsg(iocb, sock, &x->async_msg, size);
 }
 
-static ssize_t sock_sendpage(struct file *file, struct page *page,
-			     int offset, size_t size, loff_t *ppos, int more)
+ssize_t sock_sendpage(struct file *file, struct page *page,
+		      int offset, size_t size, loff_t *ppos, int more)
 {
 	struct socket *sock;
 	int flags;
@@ -950,7 +944,7 @@ static int sock_mmap(struct file * file, struct vm_area_struct * vma)
 	return sock->ops->mmap(file, sock, vma);
 }
 
-static int sock_close(struct inode *inode, struct file *filp)
+int sock_close(struct inode *inode, struct file *filp)
 {
 	/*
 	 *	It was possible the inode is NULL we were 
@@ -2029,6 +2023,9 @@ int sock_unregister(int family)
 	return 0;
 }
 
+
+extern void sk_init(void);
+
 void __init sock_init(void)
 {
 	/*
diff --git a/trunk/net/sunrpc/rpc_pipe.c b/trunk/net/sunrpc/rpc_pipe.c
index fe1a73ce6cff..554f224c0445 100644
--- a/trunk/net/sunrpc/rpc_pipe.c
+++ b/trunk/net/sunrpc/rpc_pipe.c
@@ -28,13 +28,13 @@
 #include <linux/workqueue.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
 
-static struct vfsmount *rpc_mount __read_mostly;
+static struct vfsmount *rpc_mount;
 static int rpc_mount_count;
 
 static struct file_system_type rpc_pipe_fs_type;
 
 
-static kmem_cache_t *rpc_inode_cachep __read_mostly;
+static kmem_cache_t *rpc_inode_cachep;
 
 #define RPC_UPCALL_TIMEOUT (30*HZ)
 
diff --git a/trunk/net/sunrpc/sched.c b/trunk/net/sunrpc/sched.c
index f3104035e35d..2d9eb7fbd521 100644
--- a/trunk/net/sunrpc/sched.c
+++ b/trunk/net/sunrpc/sched.c
@@ -34,10 +34,10 @@ static int			rpc_task_id;
 #define RPC_BUFFER_MAXSIZE	(2048)
 #define RPC_BUFFER_POOLSIZE	(8)
 #define RPC_TASK_POOLSIZE	(8)
-static kmem_cache_t	*rpc_task_slabp __read_mostly;
-static kmem_cache_t	*rpc_buffer_slabp __read_mostly;
-static mempool_t	*rpc_task_mempool __read_mostly;
-static mempool_t	*rpc_buffer_mempool __read_mostly;
+static kmem_cache_t	*rpc_task_slabp;
+static kmem_cache_t	*rpc_buffer_slabp;
+static mempool_t	*rpc_task_mempool;
+static mempool_t	*rpc_buffer_mempool;
 
 static void			__rpc_default_timer(struct rpc_task *task);
 static void			rpciod_killall(void);
diff --git a/trunk/net/sunrpc/svcsock.c b/trunk/net/sunrpc/svcsock.c
index 05fe2e735538..d0c3120d0233 100644
--- a/trunk/net/sunrpc/svcsock.c
+++ b/trunk/net/sunrpc/svcsock.c
@@ -34,7 +34,7 @@
 #include <net/sock.h>
 #include <net/checksum.h>
 #include <net/ip.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
 
@@ -584,16 +584,13 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
 		/* possibly an icmp error */
 		dprintk("svc: recvfrom returned error %d\n", -err);
 	}
-	if (skb->tstamp.off_sec == 0) {
-		struct timeval tv;
-
-		tv.tv_sec = xtime.tv_sec;
-		tv.tv_usec = xtime.tv_nsec * 1000;
-		skb_set_timestamp(skb, &tv);
+	if (skb->stamp.tv_sec == 0) {
+		skb->stamp.tv_sec = xtime.tv_sec; 
+		skb->stamp.tv_usec = xtime.tv_nsec / NSEC_PER_USEC; 
 		/* Don't enable netstamp, sunrpc doesn't 
 		   need that much accuracy */
 	}
-	skb_get_timestamp(skb, &svsk->sk_sk->sk_stamp);
+	svsk->sk_sk->sk_stamp = skb->stamp;
 	set_bit(SK_DATA, &svsk->sk_flags); /* there may be more data... */
 
 	/*
diff --git a/trunk/net/sysctl_net.c b/trunk/net/sysctl_net.c
index c5241fcbb966..3f6e31069c54 100644
--- a/trunk/net/sysctl_net.c
+++ b/trunk/net/sysctl_net.c
@@ -17,15 +17,17 @@
 #include <linux/sysctl.h>
 
 #ifdef CONFIG_INET
-#include <net/ip.h>
+extern struct ctl_table ipv4_table[];
 #endif
 
+extern struct ctl_table core_table[];
+
 #ifdef CONFIG_NET
-#include <linux/if_ether.h>
+extern struct ctl_table ether_table[];
 #endif
 
 #ifdef CONFIG_TR
-#include <linux/if_tr.h>
+extern struct ctl_table tr_table[];
 #endif
 
 struct ctl_table net_table[] = {
diff --git a/trunk/net/unix/af_unix.c b/trunk/net/unix/af_unix.c
index 41feca3bef86..d403e34088ad 100644
--- a/trunk/net/unix/af_unix.c
+++ b/trunk/net/unix/af_unix.c
@@ -105,7 +105,7 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <linux/tcp.h>
 #include <net/af_unix.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -2026,6 +2026,14 @@ static struct net_proto_family unix_family_ops = {
 	.owner	= THIS_MODULE,
 };
 
+#ifdef CONFIG_SYSCTL
+extern void unix_sysctl_register(void);
+extern void unix_sysctl_unregister(void);
+#else
+static inline void unix_sysctl_register(void) {}
+static inline void unix_sysctl_unregister(void) {}
+#endif
+
 static int __init af_unix_init(void)
 {
 	int rc = -1;
diff --git a/trunk/net/unix/garbage.c b/trunk/net/unix/garbage.c
index 6ffc64e1712d..4bd95c8f5934 100644
--- a/trunk/net/unix/garbage.c
+++ b/trunk/net/unix/garbage.c
@@ -76,11 +76,11 @@
 #include <linux/netdevice.h>
 #include <linux/file.h>
 #include <linux/proc_fs.h>
+#include <linux/tcp.h>
 
 #include <net/sock.h>
 #include <net/af_unix.h>
 #include <net/scm.h>
-#include <net/tcp_states.h>
 
 /* Internal data structures and random procedures: */
 
@@ -286,16 +286,16 @@ void unix_gc(void)
 			skb = skb_peek(&s->sk_receive_queue);
 			while (skb &&
 			       skb != (struct sk_buff *)&s->sk_receive_queue) {
-				nextsk = skb->next;
+				nextsk=skb->next;
 				/*
 				 *	Do we have file descriptors ?
 				 */
-				if (UNIXCB(skb).fp) {
-					__skb_unlink(skb,
-						     &s->sk_receive_queue);
-					__skb_queue_tail(&hitlist, skb);
+				if(UNIXCB(skb).fp)
+				{
+					__skb_unlink(skb, skb->list);
+					__skb_queue_tail(&hitlist,skb);
 				}
-				skb = nextsk;
+				skb=nextsk;
 			}
 			spin_unlock(&s->sk_receive_queue.lock);
 		}
diff --git a/trunk/net/unix/sysctl_net_unix.c b/trunk/net/unix/sysctl_net_unix.c
index 690ffa5d5bfb..c974dac4580a 100644
--- a/trunk/net/unix/sysctl_net_unix.c
+++ b/trunk/net/unix/sysctl_net_unix.c
@@ -12,7 +12,7 @@
 #include <linux/mm.h>
 #include <linux/sysctl.h>
 
-#include <net/af_unix.h>
+extern int sysctl_unix_max_dgram_qlen;
 
 static ctl_table unix_table[] = {
 	{
diff --git a/trunk/net/wanrouter/af_wanpipe.c b/trunk/net/wanrouter/af_wanpipe.c
index 596cb96e5f47..d93b19faaab7 100644
--- a/trunk/net/wanrouter/af_wanpipe.c
+++ b/trunk/net/wanrouter/af_wanpipe.c
@@ -57,7 +57,7 @@
 #include <linux/wanpipe.h>
 #include <linux/if_wanpipe.h>
 #include <linux/pkt_sched.h>
-#include <linux/tcp_states.h>
+#include <linux/tcp.h>
 #include <linux/if_wanpipe_common.h>
 #include <linux/sdla_x25.h>
 
diff --git a/trunk/net/x25/af_x25.c b/trunk/net/x25/af_x25.c
index 020d73cc8414..04bec047fa9a 100644
--- a/trunk/net/x25/af_x25.c
+++ b/trunk/net/x25/af_x25.c
@@ -47,7 +47,7 @@
 #include <linux/if_arp.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <asm/uaccess.h>
 #include <linux/fcntl.h>
 #include <linux/termios.h>	/* For TIOCINQ/OUTQ */
diff --git a/trunk/net/x25/x25_dev.c b/trunk/net/x25/x25_dev.c
index adfe7b8df355..36fc3bf6d882 100644
--- a/trunk/net/x25/x25_dev.c
+++ b/trunk/net/x25/x25_dev.c
@@ -81,7 +81,7 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
 }
 
 int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
-			   struct packet_type *ptype, struct net_device *orig_dev)
+			   struct packet_type *ptype)
 {
 	struct sk_buff *nskb;
 	struct x25_neigh *nb;
diff --git a/trunk/net/x25/x25_in.c b/trunk/net/x25/x25_in.c
index 26146874b839..b0197c70a9fc 100644
--- a/trunk/net/x25/x25_in.c
+++ b/trunk/net/x25/x25_in.c
@@ -28,7 +28,7 @@
 #include <linux/string.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <net/x25.h>
 
 static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
diff --git a/trunk/net/x25/x25_subr.c b/trunk/net/x25/x25_subr.c
index 8be9b8fbc24d..7fd872ad0c20 100644
--- a/trunk/net/x25/x25_subr.c
+++ b/trunk/net/x25/x25_subr.c
@@ -27,7 +27,7 @@
 #include <linux/string.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <net/x25.h>
 
 /*
@@ -80,7 +80,7 @@ void x25_requeue_frames(struct sock *sk)
 		if (!skb_prev)
 			skb_queue_head(&sk->sk_write_queue, skb);
 		else
-			skb_append(skb_prev, skb, &sk->sk_write_queue);
+			skb_append(skb_prev, skb);
 		skb_prev = skb;
 	}
 }
diff --git a/trunk/net/x25/x25_timer.c b/trunk/net/x25/x25_timer.c
index 0a92e1da3922..d6a21a3ad80e 100644
--- a/trunk/net/x25/x25_timer.c
+++ b/trunk/net/x25/x25_timer.c
@@ -23,7 +23,7 @@
 #include <linux/jiffies.h>
 #include <linux/timer.h>
 #include <net/sock.h>
-#include <net/tcp_states.h>
+#include <net/tcp.h>
 #include <net/x25.h>
 
 static void x25_heartbeat_expiry(unsigned long);
diff --git a/trunk/net/xfrm/xfrm_input.c b/trunk/net/xfrm/xfrm_input.c
index 2407a7072327..c58a6f05a0b6 100644
--- a/trunk/net/xfrm/xfrm_input.c
+++ b/trunk/net/xfrm/xfrm_input.c
@@ -12,7 +12,7 @@
 #include <net/ip.h>
 #include <net/xfrm.h>
 
-static kmem_cache_t *secpath_cachep __read_mostly;
+static kmem_cache_t *secpath_cachep;
 
 void __secpath_destroy(struct sec_path *sp)
 {
diff --git a/trunk/net/xfrm/xfrm_policy.c b/trunk/net/xfrm/xfrm_policy.c
index 83c8135e1764..d65ed8684fc1 100644
--- a/trunk/net/xfrm/xfrm_policy.c
+++ b/trunk/net/xfrm/xfrm_policy.c
@@ -37,7 +37,7 @@ EXPORT_SYMBOL(xfrm_policy_list);
 static DEFINE_RWLOCK(xfrm_policy_afinfo_lock);
 static struct xfrm_policy_afinfo *xfrm_policy_afinfo[NPROTO];
 
-static kmem_cache_t *xfrm_dst_cache __read_mostly;
+static kmem_cache_t *xfrm_dst_cache;
 
 static struct work_struct xfrm_policy_gc_work;
 static struct list_head xfrm_policy_gc_list =
diff --git a/trunk/net/xfrm/xfrm_user.c b/trunk/net/xfrm/xfrm_user.c
index c35336a0f71b..8da3e25b2c4c 100644
--- a/trunk/net/xfrm/xfrm_user.c
+++ b/trunk/net/xfrm/xfrm_user.c
@@ -1125,8 +1125,9 @@ static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
 	if (build_expire(skb, x, c->data.hard) < 0)
 		BUG();
 
-	NETLINK_CB(skb).dst_group = XFRMNLGRP_EXPIRE;
-	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
+	NETLINK_CB(skb).dst_groups = XFRMGRP_EXPIRE;
+
+	return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_EXPIRE, GFP_ATOMIC);
 }
 
 static int xfrm_notify_sa_flush(struct km_event *c)
@@ -1151,8 +1152,7 @@ static int xfrm_notify_sa_flush(struct km_event *c)
 
 	nlh->nlmsg_len = skb->tail - b;
 
-	NETLINK_CB(skb).dst_group = XFRMNLGRP_SA;
-	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
+	return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_SA, GFP_ATOMIC);
 
 nlmsg_failure:
 	kfree_skb(skb);
@@ -1226,8 +1226,7 @@ static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
 
 	nlh->nlmsg_len = skb->tail - b;
 
-	NETLINK_CB(skb).dst_group = XFRMNLGRP_SA;
-	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_SA, GFP_ATOMIC);
+	return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_SA, GFP_ATOMIC);
 
 nlmsg_failure:
 rtattr_failure:
@@ -1305,8 +1304,9 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
 	if (build_acquire(skb, x, xt, xp, dir) < 0)
 		BUG();
 
-	NETLINK_CB(skb).dst_group = XFRMNLGRP_ACQUIRE;
-	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_ACQUIRE, GFP_ATOMIC);
+	NETLINK_CB(skb).dst_groups = XFRMGRP_ACQUIRE;
+
+	return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_ACQUIRE, GFP_ATOMIC);
 }
 
 /* User gives us xfrm_user_policy_info followed by an array of 0
@@ -1405,8 +1405,9 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_eve
 	if (build_polexpire(skb, xp, dir, c->data.hard) < 0)
 		BUG();
 
-	NETLINK_CB(skb).dst_group = XFRMNLGRP_EXPIRE;
-	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_EXPIRE, GFP_ATOMIC);
+	NETLINK_CB(skb).dst_groups = XFRMGRP_EXPIRE;
+
+	return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_EXPIRE, GFP_ATOMIC);
 }
 
 static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
@@ -1454,8 +1455,7 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
 
 	nlh->nlmsg_len = skb->tail - b;
 
-	NETLINK_CB(skb).dst_group = XFRMNLGRP_POLICY;
-	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
+	return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_POLICY, GFP_ATOMIC);
 
 nlmsg_failure:
 rtattr_failure:
@@ -1480,8 +1480,7 @@ static int xfrm_notify_policy_flush(struct km_event *c)
 
 	nlh->nlmsg_len = skb->tail - b;
 
-	NETLINK_CB(skb).dst_group = XFRMNLGRP_POLICY;
-	return netlink_broadcast(xfrm_nl, skb, 0, XFRMNLGRP_POLICY, GFP_ATOMIC);
+	return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_POLICY, GFP_ATOMIC);
 
 nlmsg_failure:
 	kfree_skb(skb);
@@ -1520,8 +1519,7 @@ static int __init xfrm_user_init(void)
 {
 	printk(KERN_INFO "Initializing IPsec netlink socket\n");
 
-	xfrm_nl = netlink_kernel_create(NETLINK_XFRM, XFRMNLGRP_MAX,
-	                                xfrm_netlink_rcv, THIS_MODULE);
+	xfrm_nl = netlink_kernel_create(NETLINK_XFRM, xfrm_netlink_rcv);
 	if (xfrm_nl == NULL)
 		return -ENOMEM;
 
@@ -1539,4 +1537,3 @@ static void __exit xfrm_user_exit(void)
 module_init(xfrm_user_init);
 module_exit(xfrm_user_exit);
 MODULE_LICENSE("GPL");
-MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_XFRM);
diff --git a/trunk/scripts/mod/file2alias.c b/trunk/scripts/mod/file2alias.c
index d8ee38aede26..5180405c1a84 100644
--- a/trunk/scripts/mod/file2alias.c
+++ b/trunk/scripts/mod/file2alias.c
@@ -341,22 +341,6 @@ static int do_of_entry (const char *filename, struct of_device_id *of, char *ali
     return 1;
 }
 
-static int do_vio_entry(const char *filename, struct vio_device_id *vio,
-		char *alias)
-{
-	char *tmp;
-
-	sprintf(alias, "vio:T%sS%s", vio->type[0] ? vio->type : "*",
-			vio->compat[0] ? vio->compat : "*");
-
-	/* Replace all whitespace with underscores */
-	for (tmp = alias; tmp && *tmp; tmp++)
-		if (isspace (*tmp))
-			*tmp = '_';
-
-	return 1;
-}
-
 /* Ignore any prefix, eg. v850 prepends _ */
 static inline int sym_is(const char *symbol, const char *name)
 {
@@ -438,9 +422,6 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
         else if (sym_is(symname, "__mod_of_device_table"))
 		do_table(symval, sym->st_size, sizeof(struct of_device_id),
 			 do_of_entry, mod);
-        else if (sym_is(symname, "__mod_vio_device_table"))
-		do_table(symval, sym->st_size, sizeof(struct vio_device_id),
-			 do_vio_entry, mod);
 
 }
 
diff --git a/trunk/security/selinux/hooks.c b/trunk/security/selinux/hooks.c
index 8641f8894b4c..2253f388234f 100644
--- a/trunk/security/selinux/hooks.c
+++ b/trunk/security/selinux/hooks.c
@@ -659,7 +659,7 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
 			return SECCLASS_NETLINK_ROUTE_SOCKET;
 		case NETLINK_FIREWALL:
 			return SECCLASS_NETLINK_FIREWALL_SOCKET;
-		case NETLINK_INET_DIAG:
+		case NETLINK_TCPDIAG:
 			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 		case NETLINK_NFLOG:
 			return SECCLASS_NETLINK_NFLOG_SOCKET;
diff --git a/trunk/security/selinux/netlink.c b/trunk/security/selinux/netlink.c
index e203883406dd..18d08acafa78 100644
--- a/trunk/security/selinux/netlink.c
+++ b/trunk/security/selinux/netlink.c
@@ -80,8 +80,7 @@ static void selnl_notify(int msgtype, void *data)
 	nlh = NLMSG_PUT(skb, 0, 0, msgtype, len);
 	selnl_add_payload(nlh, len, msgtype, data);
 	nlh->nlmsg_len = skb->tail - tmp;
-	NETLINK_CB(skb).dst_group = SELNLGRP_AVC;
-	netlink_broadcast(selnl, skb, 0, SELNLGRP_AVC, GFP_USER);
+	netlink_broadcast(selnl, skb, 0, SELNL_GRP_AVC, GFP_USER);
 out:
 	return;
 	
@@ -104,8 +103,7 @@ void selnl_notify_policyload(u32 seqno)
 
 static int __init selnl_init(void)
 {
-	selnl = netlink_kernel_create(NETLINK_SELINUX, SELNLGRP_MAX, NULL,
-	                              THIS_MODULE);
+	selnl = netlink_kernel_create(NETLINK_SELINUX, NULL);
 	if (selnl == NULL)
 		panic("SELinux:  Cannot create netlink socket.");
 	netlink_set_nonroot(NETLINK_SELINUX, NL_NONROOT_RECV);	
diff --git a/trunk/security/selinux/nlmsgtab.c b/trunk/security/selinux/nlmsgtab.c
index 69b9329b2054..92b057becb4b 100644
--- a/trunk/security/selinux/nlmsgtab.c
+++ b/trunk/security/selinux/nlmsgtab.c
@@ -16,7 +16,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/if.h>
 #include <linux/netfilter_ipv4/ip_queue.h>
-#include <linux/inet_diag.h>
+#include <linux/tcp_diag.h>
 #include <linux/xfrm.h>
 #include <linux/audit.h>
 
@@ -76,7 +76,6 @@ static struct nlmsg_perm nlmsg_firewall_perms[] =
 static struct nlmsg_perm nlmsg_tcpdiag_perms[] =
 {
 	{ TCPDIAG_GETSOCK,	NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
-	{ DCCPDIAG_GETSOCK,	NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
 };
 
 static struct nlmsg_perm nlmsg_xfrm_perms[] =
diff --git a/trunk/sound/arm/pxa2xx-ac97.c b/trunk/sound/arm/pxa2xx-ac97.c
index 29450befb5da..46052304e230 100644
--- a/trunk/sound/arm/pxa2xx-ac97.c
+++ b/trunk/sound/arm/pxa2xx-ac97.c
@@ -132,9 +132,9 @@ static void pxa2xx_ac97_reset(ac97_t *ac97)
 		udelay(10);
 		GCR |= GCR_WARM_RST;
 		pxa_gpio_mode(113 | GPIO_ALT_FN_2_OUT);
-		udelay(500);
+		udelay(50);
 #else
-		GCR |= GCR_WARM_RST|GCR_PRIRDY_IEN|GCR_SECRDY_IEN;
+		GCR |= GCR_WARM_RST|GCR_PRIRDY_IEN|GCR_SECRDY_IEN;;
 		wait_event_timeout(gsr_wq, gsr_bits & (GSR_PCR | GSR_SCR), 1);
 #endif			
 
@@ -261,7 +261,7 @@ static int pxa2xx_ac97_do_suspend(snd_card_t *card, unsigned int state)
 	return 0;
 }
 
-static int pxa2xx_ac97_do_resume(snd_card_t *card)
+static int pxa2xx_ac97_do_resume(snd_card_t *card, unsigned int state)
 {
 	if (card->power_state != SNDRV_CTL_POWER_D0) {
 		pxa2xx_audio_ops_t *platform_ops = card->dev->platform_data;
@@ -275,13 +275,13 @@ static int pxa2xx_ac97_do_resume(snd_card_t *card)
 	return 0;
 }
 
-static int pxa2xx_ac97_suspend(struct device *_dev, pm_message_t state, u32 level)
+static int pxa2xx_ac97_suspend(struct device *_dev, u32 state, u32 level)
 {
 	snd_card_t *card = dev_get_drvdata(_dev);
 	int ret = 0;
 
 	if (card && level == SUSPEND_DISABLE)
-		ret = pxa2xx_ac97_do_suspend(card, PMSG_SUSPEND);
+		ret = pxa2xx_ac97_do_suspend(card, SNDRV_CTL_POWER_D3cold);
 
 	return ret;
 }
@@ -292,7 +292,7 @@ static int pxa2xx_ac97_resume(struct device *_dev, u32 level)
 	int ret = 0;
 
 	if (card && level == RESUME_ENABLE)
-		ret = pxa2xx_ac97_do_resume(card);
+		ret = pxa2xx_ac97_do_resume(card, SNDRV_CTL_POWER_D0);
 
 	return ret;
 }
diff --git a/trunk/sound/core/memalloc.c b/trunk/sound/core/memalloc.c
index 39a54a415528..02132561c3f8 100644
--- a/trunk/sound/core/memalloc.c
+++ b/trunk/sound/core/memalloc.c
@@ -512,7 +512,7 @@ static void free_all_reserved_pages(void)
  * proc file interface
  */
 #define SND_MEM_PROC_FILE	"driver/snd-page-alloc"
-static struct proc_dir_entry *snd_mem_proc;
+struct proc_dir_entry *snd_mem_proc;
 
 static int snd_mem_proc_read(char *page, char **start, off_t off,
 			     int count, int *eof, void *data)
@@ -655,7 +655,8 @@ static int __init snd_mem_init(void)
 
 static void __exit snd_mem_exit(void)
 {
-	remove_proc_entry(SND_MEM_PROC_FILE, NULL);
+	if (snd_mem_proc)
+		remove_proc_entry(SND_MEM_PROC_FILE, NULL);
 	free_all_reserved_pages();
 	if (snd_allocated_pages > 0)
 		printk(KERN_ERR "snd-malloc: Memory leak?  pages not freed = %li\n", snd_allocated_pages);
diff --git a/trunk/sound/core/memory.c b/trunk/sound/core/memory.c
index 1622893d00a2..f6895577bf86 100644
--- a/trunk/sound/core/memory.c
+++ b/trunk/sound/core/memory.c
@@ -56,7 +56,7 @@ static DEFINE_SPINLOCK(snd_alloc_vmalloc_lock);
 #define VMALLOC_MAGIC 0x87654320
 static snd_info_entry_t *snd_memory_info_entry;
 
-void __init snd_memory_init(void)
+void snd_memory_init(void)
 {
 	snd_alloc_kmalloc = 0;
 	snd_alloc_vmalloc = 0;
diff --git a/trunk/sound/core/oss/pcm_oss.c b/trunk/sound/core/oss/pcm_oss.c
index a13bd7bb4c9f..de7444c586f9 100644
--- a/trunk/sound/core/oss/pcm_oss.c
+++ b/trunk/sound/core/oss/pcm_oss.c
@@ -1705,12 +1705,13 @@ static int snd_pcm_oss_release_file(snd_pcm_oss_file_t *pcm_oss_file)
 		if (snd_pcm_running(substream))
 			snd_pcm_stop(substream, SNDRV_PCM_STATE_SETUP);
 		snd_pcm_stream_unlock_irq(substream);
-		if (substream->ffile != NULL) {
+		if (substream->open_flag) {
 			if (substream->ops->hw_free != NULL)
 				substream->ops->hw_free(substream);
 			substream->ops->close(substream);
-			substream->ffile = NULL;
+			substream->open_flag = 0;
 		}
+		substream->ffile = NULL;
 		snd_pcm_oss_release_substream(substream);
 		snd_pcm_release_substream(substream);
 	}
@@ -1777,13 +1778,14 @@ static int snd_pcm_oss_open_file(struct file *file,
 			snd_pcm_oss_release_file(pcm_oss_file);
 			return err;
 		}
-		psubstream->ffile = file;
+		psubstream->open_flag = 1;
 		err = snd_pcm_hw_constraints_complete(psubstream);
 		if (err < 0) {
 			snd_printd("snd_pcm_hw_constraint_complete failed\n");
 			snd_pcm_oss_release_file(pcm_oss_file);
 			return err;
 		}
+		psubstream->ffile = file;
 		snd_pcm_oss_init_substream(psubstream, psetup, minor);
 	}
 	if (csubstream != NULL) {
@@ -1798,13 +1800,14 @@ static int snd_pcm_oss_open_file(struct file *file,
 			snd_pcm_oss_release_file(pcm_oss_file);
 			return err;
 		}
-		csubstream->ffile = file;
+		csubstream->open_flag = 1;
 		err = snd_pcm_hw_constraints_complete(csubstream);
 		if (err < 0) {
 			snd_printd("snd_pcm_hw_constraint_complete failed\n");
 			snd_pcm_oss_release_file(pcm_oss_file);
 			return err;
 		}
+		csubstream->ffile = file;
 		snd_pcm_oss_init_substream(csubstream, csetup, minor);
 	}
 
diff --git a/trunk/sound/core/pcm_compat.c b/trunk/sound/core/pcm_compat.c
index 4b6307df846d..3920bf0eebbf 100644
--- a/trunk/sound/core/pcm_compat.c
+++ b/trunk/sound/core/pcm_compat.c
@@ -103,24 +103,10 @@ struct sndrv_pcm_sw_params32 {
 	unsigned char reserved[64];
 };
 
-/* recalcuate the boundary within 32bit */
-static snd_pcm_uframes_t recalculate_boundary(snd_pcm_runtime_t *runtime)
-{
-	snd_pcm_uframes_t boundary;
-
-	if (! runtime->buffer_size)
-		return 0;
-	boundary = runtime->buffer_size;
-	while (boundary * 2 <= 0x7fffffffUL - runtime->buffer_size)
-		boundary *= 2;
-	return boundary;
-}
-
 static int snd_pcm_ioctl_sw_params_compat(snd_pcm_substream_t *substream,
 					  struct sndrv_pcm_sw_params32 __user *src)
 {
 	snd_pcm_sw_params_t params;
-	snd_pcm_uframes_t boundary;
 	int err;
 
 	memset(&params, 0, sizeof(params));
@@ -134,17 +120,10 @@ static int snd_pcm_ioctl_sw_params_compat(snd_pcm_substream_t *substream,
 	    get_user(params.silence_threshold, &src->silence_threshold) ||
 	    get_user(params.silence_size, &src->silence_size))
 		return -EFAULT;
-	/*
-	 * Check silent_size parameter.  Since we have 64bit boundary,
-	 * silence_size must be compared with the 32bit boundary.
-	 */
-	boundary = recalculate_boundary(substream->runtime);
-	if (boundary && params.silence_size >= boundary)
-		params.silence_size = substream->runtime->boundary;
 	err = snd_pcm_sw_params(substream, &params);
 	if (err < 0)
 		return err;
-	if (boundary && put_user(boundary, &src->boundary))
+	if (put_user(params.boundary, &src->boundary))
 		return -EFAULT;
 	return err;
 }
@@ -220,6 +199,16 @@ static int snd_pcm_status_user_compat(snd_pcm_substream_t *substream,
 	return err;
 }
 
+/* recalcuate the boundary within 32bit */
+static void recalculate_boundary(snd_pcm_runtime_t *runtime)
+{
+	if (! runtime->buffer_size)
+		return;
+	runtime->boundary = runtime->buffer_size;
+	while (runtime->boundary * 2 <= 0x7fffffffUL - runtime->buffer_size)
+		runtime->boundary *= 2;
+}
+
 /* both for HW_PARAMS and HW_REFINE */
 static int snd_pcm_ioctl_hw_params_compat(snd_pcm_substream_t *substream,
 					  int refine, 
@@ -252,11 +241,8 @@ static int snd_pcm_ioctl_hw_params_compat(snd_pcm_substream_t *substream,
 		goto error;
 	}
 
-	if (! refine) {
-		unsigned int new_boundary = recalculate_boundary(runtime);
-		if (new_boundary)
-			runtime->boundary = new_boundary;
-	}
+	if (! refine)
+		recalculate_boundary(runtime);
  error:
 	kfree(data);
 	return err;
@@ -394,7 +380,6 @@ static int snd_pcm_ioctl_sync_ptr_compat(snd_pcm_substream_t *substream,
 	u32 sflags;
 	struct sndrv_pcm_mmap_control scontrol;
 	struct sndrv_pcm_mmap_status sstatus;
-	snd_pcm_uframes_t boundary;
 	int err;
 
 	snd_assert(runtime, return -EINVAL);
@@ -410,21 +395,17 @@ static int snd_pcm_ioctl_sync_ptr_compat(snd_pcm_substream_t *substream,
 	}
 	status = runtime->status;
 	control = runtime->control;
-	boundary = recalculate_boundary(runtime);
-	if (! boundary)
-		boundary = 0x7fffffff;
 	snd_pcm_stream_lock_irq(substream);
-	/* FIXME: we should consider the boundary for the sync from app */
 	if (!(sflags & SNDRV_PCM_SYNC_PTR_APPL))
 		control->appl_ptr = scontrol.appl_ptr;
 	else
-		scontrol.appl_ptr = control->appl_ptr % boundary;
+		scontrol.appl_ptr = control->appl_ptr;
 	if (!(sflags & SNDRV_PCM_SYNC_PTR_AVAIL_MIN))
 		control->avail_min = scontrol.avail_min;
 	else
 		scontrol.avail_min = control->avail_min;
 	sstatus.state = status->state;
-	sstatus.hw_ptr = status->hw_ptr % boundary;
+	sstatus.hw_ptr = status->hw_ptr;
 	sstatus.tstamp = status->tstamp;
 	sstatus.suspended_state = status->suspended_state;
 	snd_pcm_stream_unlock_irq(substream);
diff --git a/trunk/sound/core/pcm_lib.c b/trunk/sound/core/pcm_lib.c
index 0082914a7e33..c5bfd0918cff 100644
--- a/trunk/sound/core/pcm_lib.c
+++ b/trunk/sound/core/pcm_lib.c
@@ -1584,8 +1584,8 @@ int snd_pcm_hw_param_set(snd_pcm_t *pcm, snd_pcm_hw_params_t *params,
 	return snd_pcm_hw_param_value(params, var, NULL);
 }
 
-static int _snd_pcm_hw_param_mask(snd_pcm_hw_params_t *params,
-				  snd_pcm_hw_param_t var, const snd_mask_t *val)
+int _snd_pcm_hw_param_mask(snd_pcm_hw_params_t *params,
+			   snd_pcm_hw_param_t var, const snd_mask_t *val)
 {
 	int changed;
 	assert(hw_is_mask(var));
@@ -2063,7 +2063,7 @@ static snd_pcm_sframes_t snd_pcm_lib_write1(snd_pcm_substream_t *substream,
 		if (((avail < runtime->control->avail_min && size > avail) ||
 		   (size >= runtime->xfer_align && avail < runtime->xfer_align))) {
 			wait_queue_t wait;
-			enum { READY, SIGNALED, ERROR, SUSPENDED, EXPIRED, DROPPED } state;
+			enum { READY, SIGNALED, ERROR, SUSPENDED, EXPIRED } state;
 			long tout;
 
 			if (nonblock) {
@@ -2097,9 +2097,6 @@ static snd_pcm_sframes_t snd_pcm_lib_write1(snd_pcm_substream_t *substream,
 				case SNDRV_PCM_STATE_SUSPENDED:
 					state = SUSPENDED;
 					goto _end_loop;
-				case SNDRV_PCM_STATE_SETUP:
-					state = DROPPED;
-					goto _end_loop;
 				default:
 					break;
 				}
@@ -2126,9 +2123,6 @@ static snd_pcm_sframes_t snd_pcm_lib_write1(snd_pcm_substream_t *substream,
 				snd_printd("playback write error (DMA or IRQ trouble?)\n");
 				err = -EIO;
 				goto _end_unlock;
-			case DROPPED:
-				err = -EBADFD;
-				goto _end_unlock;
 			default:
 				break;
 			}
@@ -2365,7 +2359,7 @@ static snd_pcm_sframes_t snd_pcm_lib_read1(snd_pcm_substream_t *substream,
 		} else if ((avail < runtime->control->avail_min && size > avail) ||
 			   (size >= runtime->xfer_align && avail < runtime->xfer_align)) {
 			wait_queue_t wait;
-			enum { READY, SIGNALED, ERROR, SUSPENDED, EXPIRED, DROPPED } state;
+			enum { READY, SIGNALED, ERROR, SUSPENDED, EXPIRED } state;
 			long tout;
 
 			if (nonblock) {
@@ -2400,9 +2394,6 @@ static snd_pcm_sframes_t snd_pcm_lib_read1(snd_pcm_substream_t *substream,
 					goto _end_loop;
 				case SNDRV_PCM_STATE_DRAINING:
 					goto __draining;
-				case SNDRV_PCM_STATE_SETUP:
-					state = DROPPED;
-					goto _end_loop;
 				default:
 					break;
 				}
@@ -2429,9 +2420,6 @@ static snd_pcm_sframes_t snd_pcm_lib_read1(snd_pcm_substream_t *substream,
 				snd_printd("capture read error (DMA or IRQ trouble?)\n");
 				err = -EIO;
 				goto _end_unlock;
-			case DROPPED:
-				err = -EBADFD;
-				goto _end_unlock;
 			default:
 				break;
 			}
diff --git a/trunk/sound/core/pcm_native.c b/trunk/sound/core/pcm_native.c
index 03c17159dd8e..10c2c9832649 100644
--- a/trunk/sound/core/pcm_native.c
+++ b/trunk/sound/core/pcm_native.c
@@ -1025,7 +1025,7 @@ static void snd_pcm_post_suspend(snd_pcm_substream_t *substream, int state)
 	snd_pcm_runtime_t *runtime = substream->runtime;
 	snd_pcm_trigger_tstamp(substream);
 	if (substream->timer)
-		snd_timer_notify(substream->timer, SNDRV_TIMER_EVENT_MSUSPEND, &runtime->trigger_tstamp);
+		snd_timer_notify(substream->timer, SNDRV_TIMER_EVENT_MPAUSE, &runtime->trigger_tstamp);
 	runtime->status->suspended_state = runtime->status->state;
 	runtime->status->state = SNDRV_PCM_STATE_SUSPENDED;
 	snd_pcm_tick_set(substream, 0);
@@ -1115,7 +1115,7 @@ static void snd_pcm_post_resume(snd_pcm_substream_t *substream, int state)
 	snd_pcm_runtime_t *runtime = substream->runtime;
 	snd_pcm_trigger_tstamp(substream);
 	if (substream->timer)
-		snd_timer_notify(substream->timer, SNDRV_TIMER_EVENT_MRESUME, &runtime->trigger_tstamp);
+		snd_timer_notify(substream->timer, SNDRV_TIMER_EVENT_MCONTINUE, &runtime->trigger_tstamp);
 	runtime->status->state = runtime->status->suspended_state;
 	if (runtime->sleep_min)
 		snd_pcm_tick_prepare(substream);
@@ -1967,12 +1967,13 @@ static int snd_pcm_release_file(snd_pcm_file_t * pcm_file)
 	runtime = substream->runtime;
 	str = substream->pstr;
 	snd_pcm_unlink(substream);
-	if (substream->ffile != NULL) {
+	if (substream->open_flag) {
 		if (substream->ops->hw_free != NULL)
 			substream->ops->hw_free(substream);
 		substream->ops->close(substream);
-		substream->ffile = NULL;
+		substream->open_flag = 0;
 	}
+	substream->ffile = NULL;
 	snd_pcm_remove_file(str, pcm_file);
 	snd_pcm_release_substream(substream);
 	kfree(pcm_file);
@@ -2021,15 +2022,18 @@ static int snd_pcm_open_file(struct file *file,
 		snd_pcm_release_file(pcm_file);
 		return err;
 	}
-	substream->ffile = file;
+	substream->open_flag = 1;
 
 	err = snd_pcm_hw_constraints_complete(substream);
 	if (err < 0) {
 		snd_printd("snd_pcm_hw_constraints_complete failed\n");
+		substream->ops->close(substream);
 		snd_pcm_release_file(pcm_file);
 		return err;
 	}
 
+	substream->ffile = file;
+
 	file->private_data = pcm_file;
 	*rpcm_file = pcm_file;
 	return 0;
diff --git a/trunk/sound/core/sound_oss.c b/trunk/sound/core/sound_oss.c
index e401c6703297..de39d212bc15 100644
--- a/trunk/sound/core/sound_oss.c
+++ b/trunk/sound/core/sound_oss.c
@@ -98,7 +98,6 @@ int snd_register_oss_device(int type, snd_card_t * card, int dev, snd_minor_t *
 	int cidx = SNDRV_MINOR_OSS_CARD(minor);
 	int track2 = -1;
 	int register1 = -1, register2 = -1;
-	struct device *carddev = NULL;
 
 	if (minor < 0)
 		return minor;
@@ -122,13 +121,11 @@ int snd_register_oss_device(int type, snd_card_t * card, int dev, snd_minor_t *
 		track2 = SNDRV_MINOR_OSS(cidx, SNDRV_MINOR_OSS_DMMIDI1);
 		break;
 	}
-	if (card)
-		carddev = card->dev;
-	register1 = register_sound_special_device(reg->f_ops, minor, carddev);
+	register1 = register_sound_special(reg->f_ops, minor);
 	if (register1 != minor)
 		goto __end;
 	if (track2 >= 0) {
-		register2 = register_sound_special_device(reg->f_ops, track2, carddev);
+		register2 = register_sound_special(reg->f_ops, track2);
 		if (register2 != track2)
 			goto __end;
 	}
diff --git a/trunk/sound/core/timer.c b/trunk/sound/core/timer.c
index 4104f6e292e9..cfaccd415b3b 100644
--- a/trunk/sound/core/timer.c
+++ b/trunk/sound/core/timer.c
@@ -799,13 +799,13 @@ static int snd_timer_free(snd_timer_t *timer)
 	return 0;
 }
 
-static int snd_timer_dev_free(snd_device_t *device)
+int snd_timer_dev_free(snd_device_t *device)
 {
 	snd_timer_t *timer = device->device_data;
 	return snd_timer_free(timer);
 }
 
-static int snd_timer_dev_register(snd_device_t *dev)
+int snd_timer_dev_register(snd_device_t *dev)
 {
 	snd_timer_t *timer = dev->device_data;
 	snd_timer_t *timer1;
@@ -880,11 +880,9 @@ void snd_timer_notify(snd_timer_t *timer, enum sndrv_timer_event event, struct t
 	struct list_head *p, *n;
 
 	snd_runtime_check(timer->hw.flags & SNDRV_TIMER_HW_SLAVE, return);	
-	snd_assert(event >= SNDRV_TIMER_EVENT_MSTART && event <= SNDRV_TIMER_EVENT_MRESUME, return);
+	snd_assert(event >= SNDRV_TIMER_EVENT_MSTART && event <= SNDRV_TIMER_EVENT_MPAUSE, return);
 	spin_lock_irqsave(&timer->lock, flags);
-	if (event == SNDRV_TIMER_EVENT_MSTART ||
-	    event == SNDRV_TIMER_EVENT_MCONTINUE ||
-	    event == SNDRV_TIMER_EVENT_MRESUME) {
+	if (event == SNDRV_TIMER_EVENT_MSTART || event == SNDRV_TIMER_EVENT_MCONTINUE) {
 		if (timer->hw.c_resolution)
 			resolution = timer->hw.c_resolution(timer);
 		else
@@ -1557,14 +1555,10 @@ static int snd_timer_user_params(struct file *file, snd_timer_params_t __user *_
 			      (1<<SNDRV_TIMER_EVENT_STOP)|
 			      (1<<SNDRV_TIMER_EVENT_CONTINUE)|
 			      (1<<SNDRV_TIMER_EVENT_PAUSE)|
-			      (1<<SNDRV_TIMER_EVENT_SUSPEND)|
-			      (1<<SNDRV_TIMER_EVENT_RESUME)|
 			      (1<<SNDRV_TIMER_EVENT_MSTART)|
 			      (1<<SNDRV_TIMER_EVENT_MSTOP)|
 			      (1<<SNDRV_TIMER_EVENT_MCONTINUE)|
-			      (1<<SNDRV_TIMER_EVENT_MPAUSE)|
-			      (1<<SNDRV_TIMER_EVENT_MSUSPEND)|
-			      (1<<SNDRV_TIMER_EVENT_MRESUME))) {
+			      (1<<SNDRV_TIMER_EVENT_MPAUSE))) {
 		err = -EINVAL;
 		goto _end;
 	}
diff --git a/trunk/sound/drivers/vx/vx_mixer.c b/trunk/sound/drivers/vx/vx_mixer.c
index 19fc68c23378..f00c88886460 100644
--- a/trunk/sound/drivers/vx/vx_mixer.c
+++ b/trunk/sound/drivers/vx/vx_mixer.c
@@ -796,14 +796,14 @@ static int vx_iec958_put(snd_kcontrol_t *kcontrol, snd_ctl_elem_value_t *ucontro
 
 static snd_kcontrol_new_t vx_control_iec958_mask = {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =		SNDRV_CTL_NAME_IEC958("",PLAYBACK,MASK),
 	.info =		vx_iec958_info,	/* shared */
 	.get =		vx_iec958_mask_get,
 };
 
 static snd_kcontrol_new_t vx_control_iec958 = {
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,DEFAULT),
 	.info =         vx_iec958_info,
 	.get =          vx_iec958_get,
diff --git a/trunk/sound/drivers/vx/vx_pcm.c b/trunk/sound/drivers/vx/vx_pcm.c
index d4becf44e247..af381b15fe5c 100644
--- a/trunk/sound/drivers/vx/vx_pcm.c
+++ b/trunk/sound/drivers/vx/vx_pcm.c
@@ -549,8 +549,8 @@ static int vx_stop_stream(vx_core_t *chip, vx_pipe_t *pipe)
 
 static snd_pcm_hardware_t vx_pcm_playback_hw = {
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
-				 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_MMAP_VALID /*|*/
-				 /*SNDRV_PCM_INFO_RESUME*/),
+				 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_MMAP_VALID |
+				 SNDRV_PCM_INFO_RESUME),
 	.formats =		/*SNDRV_PCM_FMTBIT_U8 |*/ SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_3LE,
 	.rates =		SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
 	.rate_min =		5000,
@@ -949,8 +949,8 @@ static snd_pcm_ops_t vx_pcm_playback_ops = {
 
 static snd_pcm_hardware_t vx_pcm_capture_hw = {
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
-				 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_MMAP_VALID /*|*/
-				 /*SNDRV_PCM_INFO_RESUME*/),
+				 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_MMAP_VALID |
+				 SNDRV_PCM_INFO_RESUME),
 	.formats =		/*SNDRV_PCM_FMTBIT_U8 |*/ SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_3LE,
 	.rates =		SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
 	.rate_min =		5000,
diff --git a/trunk/sound/isa/ad1816a/ad1816a.c b/trunk/sound/isa/ad1816a/ad1816a.c
index 0eb442ca23d6..563296d02894 100644
--- a/trunk/sound/isa/ad1816a/ad1816a.c
+++ b/trunk/sound/isa/ad1816a/ad1816a.c
@@ -53,7 +53,6 @@ static int irq[SNDRV_CARDS] = SNDRV_DEFAULT_IRQ;	/* Pnp setup */
 static int mpu_irq[SNDRV_CARDS] = SNDRV_DEFAULT_IRQ;	/* Pnp setup */
 static int dma1[SNDRV_CARDS] = SNDRV_DEFAULT_DMA;	/* PnP setup */
 static int dma2[SNDRV_CARDS] = SNDRV_DEFAULT_DMA;	/* PnP setup */
-static int clockfreq[SNDRV_CARDS];
 
 module_param_array(index, int, NULL, 0444);
 MODULE_PARM_DESC(index, "Index value for ad1816a based soundcard.");
@@ -75,8 +74,6 @@ module_param_array(dma1, int, NULL, 0444);
 MODULE_PARM_DESC(dma1, "1st DMA # for ad1816a driver.");
 module_param_array(dma2, int, NULL, 0444);
 MODULE_PARM_DESC(dma2, "2nd DMA # for ad1816a driver.");
-module_param_array(clockfreq, int, NULL, 0444);
-MODULE_PARM_DESC(clockfreq, "Clock frequency for ad1816a driver (default = 0).");
 
 struct snd_card_ad1816a {
 	struct pnp_dev *dev;
@@ -212,8 +209,6 @@ static int __devinit snd_card_ad1816a_probe(int dev, struct pnp_card_link *pcard
 		snd_card_free(card);
 		return error;
 	}
-	if (clockfreq[dev] >= 5000 && clockfreq[dev] <= 100000)
-		chip->clock_freq = clockfreq[dev];
 
 	strcpy(card->driver, "AD1816A");
 	strcpy(card->shortname, "ADI SoundPort AD1816A");
diff --git a/trunk/sound/isa/ad1816a/ad1816a_lib.c b/trunk/sound/isa/ad1816a/ad1816a_lib.c
index ae860360ecf9..625b2eff14a1 100644
--- a/trunk/sound/isa/ad1816a/ad1816a_lib.c
+++ b/trunk/sound/isa/ad1816a/ad1816a_lib.c
@@ -234,7 +234,7 @@ static int snd_ad1816a_playback_prepare(snd_pcm_substream_t *substream)
 	ad1816a_t *chip = snd_pcm_substream_chip(substream);
 	unsigned long flags;
 	snd_pcm_runtime_t *runtime = substream->runtime;
-	unsigned int size, rate;
+	unsigned int size;
 
 	spin_lock_irqsave(&chip->lock, flags);
 
@@ -245,10 +245,7 @@ static int snd_ad1816a_playback_prepare(snd_pcm_substream_t *substream)
 	snd_dma_program(chip->dma1, runtime->dma_addr, size,
 			DMA_MODE_WRITE | DMA_AUTOINIT);
 
-	rate = runtime->rate;
-	if (chip->clock_freq)
-		rate = (rate * 33000) / chip->clock_freq;
-	snd_ad1816a_write(chip, AD1816A_PLAYBACK_SAMPLE_RATE, rate);
+	snd_ad1816a_write(chip, AD1816A_PLAYBACK_SAMPLE_RATE, runtime->rate);
 	snd_ad1816a_out_mask(chip, AD1816A_PLAYBACK_CONFIG,
 		AD1816A_FMT_ALL | AD1816A_FMT_STEREO,
 		snd_ad1816a_get_format(chip, runtime->format,
@@ -266,7 +263,7 @@ static int snd_ad1816a_capture_prepare(snd_pcm_substream_t *substream)
 	ad1816a_t *chip = snd_pcm_substream_chip(substream);
 	unsigned long flags;
 	snd_pcm_runtime_t *runtime = substream->runtime;
-	unsigned int size, rate;
+	unsigned int size;
 
 	spin_lock_irqsave(&chip->lock, flags);
 
@@ -277,10 +274,7 @@ static int snd_ad1816a_capture_prepare(snd_pcm_substream_t *substream)
 	snd_dma_program(chip->dma2, runtime->dma_addr, size,
 			DMA_MODE_READ | DMA_AUTOINIT);
 
-	rate = runtime->rate;
-	if (chip->clock_freq)
-		rate = (rate * 33000) / chip->clock_freq;
-	snd_ad1816a_write(chip, AD1816A_CAPTURE_SAMPLE_RATE, rate);
+	snd_ad1816a_write(chip, AD1816A_CAPTURE_SAMPLE_RATE, runtime->rate);
 	snd_ad1816a_out_mask(chip, AD1816A_CAPTURE_CONFIG,
 		AD1816A_FMT_ALL | AD1816A_FMT_STEREO,
 		snd_ad1816a_get_format(chip, runtime->format,
diff --git a/trunk/sound/isa/ad1848/ad1848_lib.c b/trunk/sound/isa/ad1848/ad1848_lib.c
index bc642dc94547..8fb3db103e48 100644
--- a/trunk/sound/isa/ad1848/ad1848_lib.c
+++ b/trunk/sound/isa/ad1848/ad1848_lib.c
@@ -1196,7 +1196,6 @@ int snd_ad1848_add_ctl(ad1848_t *chip, const char *name, int index, int type, un
 			.put = snd_ad1848_put_double,
 		},
 		[AD1848_MIX_CAPTURE] = {
-			.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 			.info = snd_ad1848_info_mux,
 			.get = snd_ad1848_get_mux,
 			.put = snd_ad1848_put_mux,
diff --git a/trunk/sound/isa/cmi8330.c b/trunk/sound/isa/cmi8330.c
index 1fce8b9f37cf..46776cc0c157 100644
--- a/trunk/sound/isa/cmi8330.c
+++ b/trunk/sound/isa/cmi8330.c
@@ -194,8 +194,8 @@ AD1848_DOUBLE("Wavetable Capture Volume", 0, CMI8330_WAVGAIN, CMI8330_WAVGAIN, 4
 AD1848_SINGLE("3D Control - Switch", 0, CMI8330_RMUX3D, 5, 1, 1),
 AD1848_SINGLE("PC Speaker Playback Volume", 0, CMI8330_OUTPUTVOL, 3, 3, 0),
 AD1848_SINGLE("FM Playback Switch", 0, CMI8330_RECMUX, 3, 1, 1),
-AD1848_SINGLE(SNDRV_CTL_NAME_IEC958("Input ",CAPTURE,SWITCH), 0, CMI8330_RMUX3D, 7, 1, 1),
-AD1848_SINGLE(SNDRV_CTL_NAME_IEC958("Input ",PLAYBACK,SWITCH), 0, CMI8330_MUTEMUX, 7, 1, 1),
+AD1848_SINGLE("IEC958 Input Capture Switch", 0, CMI8330_RMUX3D, 7, 1, 1),
+AD1848_SINGLE("IEC958 Input Playback Switch", 0, CMI8330_MUTEMUX, 7, 1, 1),
 };
 
 #ifdef ENABLE_SB_MIXER
diff --git a/trunk/sound/isa/cs423x/cs4231_lib.c b/trunk/sound/isa/cs423x/cs4231_lib.c
index 3199941edd9b..3e7a2a33a5ca 100644
--- a/trunk/sound/isa/cs423x/cs4231_lib.c
+++ b/trunk/sound/isa/cs423x/cs4231_lib.c
@@ -1346,8 +1346,6 @@ static void snd_cs4231_suspend(cs4231_t *chip)
 	int reg;
 	unsigned long flags;
 	
-	if (chip->pcm)
-		snd_pcm_suspend_all(chip->pcm);
 	spin_lock_irqsave(&chip->reg_lock, flags);
 	for (reg = 0; reg < 32; reg++)
 		chip->image[reg] = snd_cs4231_in(chip, reg);
diff --git a/trunk/sound/isa/gus/gus_io.c b/trunk/sound/isa/gus/gus_io.c
index 23e1b5f19e1a..337b0e2a8a36 100644
--- a/trunk/sound/isa/gus/gus_io.c
+++ b/trunk/sound/isa/gus/gus_io.c
@@ -269,9 +269,8 @@ void snd_gf1_i_write_addr(snd_gus_card_t * gus, unsigned char reg,
 
 #endif  /*  0  */
 
-#ifdef CONFIG_SND_DEBUG
-static unsigned int snd_gf1_i_read_addr(snd_gus_card_t * gus,
-					unsigned char reg, short w_16bit)
+unsigned int snd_gf1_i_read_addr(snd_gus_card_t * gus,
+				 unsigned char reg, short w_16bit)
 {
 	unsigned int res;
 	unsigned long flags;
@@ -281,7 +280,6 @@ static unsigned int snd_gf1_i_read_addr(snd_gus_card_t * gus,
 	spin_unlock_irqrestore(&gus->reg_lock, flags);
 	return res;
 }
-#endif
 
 /*
 
diff --git a/trunk/sound/isa/opl3sa2.c b/trunk/sound/isa/opl3sa2.c
index 75bd6eca63e7..95c7b3e53407 100644
--- a/trunk/sound/isa/opl3sa2.c
+++ b/trunk/sound/isa/opl3sa2.c
@@ -145,14 +145,6 @@ static snd_card_t *snd_opl3sa2_legacy[SNDRV_CARDS] = SNDRV_DEFAULT_PTR;
 
 #ifdef CONFIG_PNP
 
-static struct pnp_device_id snd_opl3sa2_pnpbiosids[] = {
-	{ .id = "YMH0021" },
-	{ .id = "NMX2210" },	/* Gateway Solo 2500 */
-	{ .id = "" }		/* end */
-};
-
-MODULE_DEVICE_TABLE(pnp, snd_opl3sa2_pnpbiosids);
-
 static struct pnp_card_device_id snd_opl3sa2_pnpids[] = {
 	/* Yamaha YMF719E-S (Genius Sound Maker 3DX) */
 	{ .id = "YMH0020", .devs = { { "YMH0021" } } },
@@ -576,18 +568,20 @@ static int snd_opl3sa2_resume(snd_card_t *card)
 
 #ifdef CONFIG_PNP
 static int __init snd_opl3sa2_pnp(int dev, opl3sa2_t *chip,
-				  struct pnp_dev *pdev,
-				  int isapnp)
+				  struct pnp_card_link *card,
+				  const struct pnp_card_device_id *id)
 {
-	struct pnp_resource_table * cfg;
+	struct pnp_dev *pdev;
+	struct pnp_resource_table * cfg = kmalloc(sizeof(struct pnp_resource_table), GFP_KERNEL);
 	int err;
 
-	if (!isapnp && pnp_device_is_isapnp(pdev))
-		return -ENOENT;	/* we have another procedure - card */
-
-	cfg = kmalloc(sizeof(struct pnp_resource_table), GFP_KERNEL);
 	if (!cfg)
 		return -ENOMEM;
+	pdev = chip->dev = pnp_request_card_device(card, id->devs[0].id, NULL);
+	if (chip->dev == NULL) {
+		kfree(cfg);
+		return -EBUSY;
+	}
 	/* PnP initialization */
 	pnp_init_resource_table(cfg);
 	if (sb_port[dev] != SNDRV_AUTO_PORT)
@@ -607,7 +601,7 @@ static int __init snd_opl3sa2_pnp(int dev, opl3sa2_t *chip,
 	if (irq[dev] != SNDRV_AUTO_IRQ)
 		pnp_resource_change(&cfg->irq_resource[0], irq[dev], 1);
 	err = pnp_manual_config_dev(pdev, cfg, 0);
-	if (err < 0 && isapnp)
+	if (err < 0)
 		snd_printk(KERN_ERR "PnP manual resources are invalid, using auto config\n");
 	err = pnp_activate_dev(pdev);
 	if (err < 0) {
@@ -623,31 +617,13 @@ static int __init snd_opl3sa2_pnp(int dev, opl3sa2_t *chip,
 	dma1[dev] = pnp_dma(pdev, 0);
 	dma2[dev] = pnp_dma(pdev, 1);
 	irq[dev] = pnp_irq(pdev, 0);
-	snd_printdd("%sPnP OPL3-SA: sb port=0x%lx, wss port=0x%lx, fm port=0x%lx, midi port=0x%lx\n",
-		pnp_device_is_pnpbios(pdev) ? "BIOS" : "ISA", sb_port[dev], wss_port[dev], fm_port[dev], midi_port[dev]);
-	snd_printdd("%sPnP OPL3-SA: control port=0x%lx, dma1=%i, dma2=%i, irq=%i\n",
-		pnp_device_is_pnpbios(pdev) ? "BIOS" : "ISA", port[dev], dma1[dev], dma2[dev], irq[dev]);
+	snd_printdd("PnP OPL3-SA: sb port=0x%lx, wss port=0x%lx, fm port=0x%lx, midi port=0x%lx\n",
+		sb_port[dev], wss_port[dev], fm_port[dev], midi_port[dev]);
+	snd_printdd("PnP OPL3-SA: control port=0x%lx, dma1=%i, dma2=%i, irq=%i\n",
+		port[dev], dma1[dev], dma2[dev], irq[dev]);
 	kfree(cfg);
-	chip->dev = pdev;
 	return 0;
 }
-
-static int __init snd_opl3sa2_cpnp(int dev, opl3sa2_t *chip,
-				   struct pnp_card_link *card,
-				   const struct pnp_card_device_id *id)
-{
-	struct pnp_dev *pdev;
-	struct pnp_resource_table * cfg = kmalloc(sizeof(struct pnp_resource_table), GFP_KERNEL);
-
-	if (!cfg)
-		return -ENOMEM;
-	pdev = pnp_request_card_device(card, id->devs[0].id, NULL);
-	if (pdev == NULL) {
-		kfree(cfg);
-		return -EBUSY;
-	}
-	return snd_opl3sa2_pnp(dev, chip, pdev, 1);
-}
 #endif /* CONFIG_PNP */
 
 static int snd_opl3sa2_free(opl3sa2_t *chip)
@@ -669,7 +645,6 @@ static int snd_opl3sa2_dev_free(snd_device_t *device)
 }
 
 static int __devinit snd_opl3sa2_probe(int dev,
-				       struct pnp_dev *pdev,
 				       struct pnp_card_link *pcard,
 				       const struct pnp_card_device_id *pid)
 {
@@ -720,13 +695,8 @@ static int __devinit snd_opl3sa2_probe(int dev,
 	if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0)
 		goto __error;
 #ifdef CONFIG_PNP
-	if (pdev) {
-		if ((err = snd_opl3sa2_pnp(dev, chip, pdev, 0)) < 0)
-			goto __error;
-		snd_card_set_dev(card, &pdev->dev);
-	}
-	if (pcard) {
-		if ((err = snd_opl3sa2_cpnp(dev, chip, pcard, pid)) < 0)
+	if (isapnp[dev]) {
+		if ((err = snd_opl3sa2_pnp(dev, chip, pcard, pid)) < 0)
 			goto __error;
 		snd_card_set_dev(card, &pcard->card->dev);
 	}
@@ -798,9 +768,7 @@ static int __devinit snd_opl3sa2_probe(int dev,
 	if ((err = snd_card_register(card)) < 0)
 		goto __error;
 
-	if (pdev)
-		pnp_set_drvdata(pdev, card);
-	else if (pcard)
+	if (pcard)
 		pnp_set_card_drvdata(pcard, card);
 	else
 		snd_opl3sa2_legacy[dev] = card;
@@ -812,8 +780,8 @@ static int __devinit snd_opl3sa2_probe(int dev,
 }
 
 #ifdef CONFIG_PNP
-static int __devinit snd_opl3sa2_pnp_detect(struct pnp_dev *pdev,
-					    const struct pnp_device_id *id)
+static int __devinit snd_opl3sa2_pnp_detect(struct pnp_card_link *card,
+					    const struct pnp_card_device_id *id)
 {
         static int dev;
         int res;
@@ -821,7 +789,7 @@ static int __devinit snd_opl3sa2_pnp_detect(struct pnp_dev *pdev,
         for ( ; dev < SNDRV_CARDS; dev++) {
                 if (!enable[dev] || !isapnp[dev])
                         continue;
-                res = snd_opl3sa2_probe(dev, pdev, NULL, NULL);
+                res = snd_opl3sa2_probe(dev, card, id);
                 if (res < 0)
                         return res;
                 dev++;
@@ -830,40 +798,7 @@ static int __devinit snd_opl3sa2_pnp_detect(struct pnp_dev *pdev,
         return -ENODEV;
 }
 
-static void __devexit snd_opl3sa2_pnp_remove(struct pnp_dev * pdev)
-{
-	snd_card_t *card = (snd_card_t *) pnp_get_drvdata(pdev);
-        
-	snd_card_disconnect(card);
-	snd_card_free_in_thread(card);
-}
-
-static struct pnp_driver opl3sa2_pnp_driver = {
-	.name = "opl3sa2-pnpbios",
-	.id_table = snd_opl3sa2_pnpbiosids,
-	.probe = snd_opl3sa2_pnp_detect,
-	.remove = __devexit_p(snd_opl3sa2_pnp_remove),
-};
-
-static int __devinit snd_opl3sa2_pnp_cdetect(struct pnp_card_link *card,
-					     const struct pnp_card_device_id *id)
-{
-        static int dev;
-        int res;
-
-        for ( ; dev < SNDRV_CARDS; dev++) {
-                if (!enable[dev] || !isapnp[dev])
-                        continue;
-                res = snd_opl3sa2_probe(dev, NULL, card, id);
-                if (res < 0)
-                        return res;
-                dev++;
-                return 0;
-        }
-        return -ENODEV;
-}
-
-static void __devexit snd_opl3sa2_pnp_cremove(struct pnp_card_link * pcard)
+static void __devexit snd_opl3sa2_pnp_remove(struct pnp_card_link * pcard)
 {
 	snd_card_t *card = (snd_card_t *) pnp_get_card_drvdata(pcard);
         
@@ -875,8 +810,8 @@ static struct pnp_card_driver opl3sa2_pnpc_driver = {
 	.flags = PNP_DRIVER_RES_DISABLE,
 	.name = "opl3sa2",
 	.id_table = snd_opl3sa2_pnpids,
-	.probe = snd_opl3sa2_pnp_cdetect,
-	.remove = __devexit_p(snd_opl3sa2_pnp_cremove),
+	.probe = snd_opl3sa2_pnp_detect,
+	.remove = __devexit_p(snd_opl3sa2_pnp_remove),
 };
 #endif /* CONFIG_PNP */
 
@@ -891,11 +826,10 @@ static int __init alsa_card_opl3sa2_init(void)
 		if (isapnp[dev])
 			continue;
 #endif
-		if (snd_opl3sa2_probe(dev, NULL, NULL, NULL) >= 0)
+		if (snd_opl3sa2_probe(dev, NULL, NULL) >= 0)
 			cards++;
 	}
 #ifdef CONFIG_PNP
-	cards += pnp_register_driver(&opl3sa2_pnp_driver);
 	cards += pnp_register_card_driver(&opl3sa2_pnpc_driver);
 #endif
 	if (!cards) {
diff --git a/trunk/sound/isa/sb/sb16_main.c b/trunk/sound/isa/sb/sb16_main.c
index a99e642a68b5..a6a0fa516268 100644
--- a/trunk/sound/isa/sb/sb16_main.c
+++ b/trunk/sound/isa/sb/sb16_main.c
@@ -729,7 +729,7 @@ static int snd_sb16_dma_control_put(snd_kcontrol_t * kcontrol, snd_ctl_elem_valu
 }
 
 static snd_kcontrol_new_t snd_sb16_dma_control = {
-	.iface = SNDRV_CTL_ELEM_IFACE_CARD,
+	.iface = SNDRV_CTL_ELEM_IFACE_PCM,
 	.name = "16-bit DMA Allocation",
 	.info = snd_sb16_dma_control_info,
 	.get = snd_sb16_dma_control_get,
diff --git a/trunk/sound/pci/Kconfig b/trunk/sound/pci/Kconfig
index 1e458919cce6..26b42bb20a0a 100644
--- a/trunk/sound/pci/Kconfig
+++ b/trunk/sound/pci/Kconfig
@@ -1,15 +1,11 @@
 # ALSA PCI drivers
 
+menu "PCI devices"
+	depends on SND!=n && PCI
+
 config SND_AC97_CODEC
 	tristate
 	select SND_PCM
-	select SND_AC97_BUS
-
-config SND_AC97_BUS
-	tristate
-
-menu "PCI devices"
-	depends on SND!=n && PCI
 
 config SND_ALI5451
 	tristate "ALi M5451 PCI Audio Controller"
diff --git a/trunk/sound/pci/ac97/Makefile b/trunk/sound/pci/ac97/Makefile
index 77b3482cb133..3c3222122d8b 100644
--- a/trunk/sound/pci/ac97/Makefile
+++ b/trunk/sound/pci/ac97/Makefile
@@ -10,11 +10,9 @@ snd-ac97-codec-objs += ac97_proc.o
 endif
 
 snd-ak4531-codec-objs := ak4531_codec.o
-snd-ac97-bus-objs := ac97_bus.o
 
 # Toplevel Module Dependency
 obj-$(CONFIG_SND_AC97_CODEC) += snd-ac97-codec.o
 obj-$(CONFIG_SND_ENS1370) += snd-ak4531-codec.o
-obj-$(CONFIG_SND_AC97_BUS) += snd-ac97-bus.o
 
 obj-m := $(sort $(obj-m))
diff --git a/trunk/sound/pci/ac97/ac97_bus.c b/trunk/sound/pci/ac97/ac97_bus.c
deleted file mode 100644
index 227f8b9f67ce..000000000000
--- a/trunk/sound/pci/ac97/ac97_bus.c
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Linux driver model AC97 bus interface
- *
- * Author:	Nicolas Pitre
- * Created:	Jan 14, 2005
- * Copyright:	(C) MontaVista Software Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
-
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/device.h>
-#include <linux/string.h>
-
-/*
- * Codec families have names seperated by commas, so we search for an
- * individual codec name within the family string. 
- */
-static int ac97_bus_match(struct device *dev, struct device_driver *drv)
-{
-	return (strstr(dev->bus_id, drv->name) != NULL);
-}
-
-static int ac97_bus_suspend(struct device *dev, pm_message_t state)
-{
-	int ret = 0;
-
-	if (dev->driver && dev->driver->suspend) {
-		ret = dev->driver->suspend(dev, state, SUSPEND_DISABLE);
-		if (ret == 0)
-			ret = dev->driver->suspend(dev, state, SUSPEND_SAVE_STATE);
-		if (ret == 0)
-			ret = dev->driver->suspend(dev, state, SUSPEND_POWER_DOWN);
-	}
-	return ret;
-}
-
-static int ac97_bus_resume(struct device *dev)
-{
-	int ret = 0;
-
-	if (dev->driver && dev->driver->resume) {
-		ret = dev->driver->resume(dev, RESUME_POWER_ON);
-		if (ret == 0)
-			ret = dev->driver->resume(dev, RESUME_RESTORE_STATE);
-		if (ret == 0)
-			ret = dev->driver->resume(dev, RESUME_ENABLE);
-	}
-	return ret;
-}
-
-struct bus_type ac97_bus_type = {
-	.name		= "ac97",
-	.match		= ac97_bus_match,
-	.suspend	= ac97_bus_suspend,
-	.resume		= ac97_bus_resume,
-};
-
-static int __init ac97_bus_init(void)
-{
-	return bus_register(&ac97_bus_type);
-}
-
-subsys_initcall(ac97_bus_init);
-
-static void __exit ac97_bus_exit(void)
-{
-	bus_unregister(&ac97_bus_type);
-}
-
-module_exit(ac97_bus_exit);
-
-EXPORT_SYMBOL(ac97_bus_type);
-
-MODULE_LICENSE("GPL");
diff --git a/trunk/sound/pci/ac97/ac97_codec.c b/trunk/sound/pci/ac97/ac97_codec.c
index 5501f4440c92..6983eea226da 100644
--- a/trunk/sound/pci/ac97/ac97_codec.c
+++ b/trunk/sound/pci/ac97/ac97_codec.c
@@ -157,7 +157,6 @@ static const ac97_codec_id_t snd_ac97_codec_ids[] = {
 { 0x54524123, 0xffffffff, "TR28602",		NULL,		NULL }, // only guess --jk [TR28023 = eMicro EM28023 (new CT1297)]
 { 0x54584e20, 0xffffffff, "TLC320AD9xC",	NULL,		NULL },
 { 0x56494161, 0xffffffff, "VIA1612A",		NULL,		NULL }, // modified ICE1232 with S/PDIF
-{ 0x56494170, 0xffffffff, "VIA1617A",		patch_vt1617a,	NULL }, // modified VT1616 with S/PDIF
 { 0x57454301, 0xffffffff, "W83971D",		NULL,		NULL },
 { 0x574d4c00, 0xffffffff, "WM9701A",		NULL,		NULL },
 { 0x574d4C03, 0xffffffff, "WM9703,WM9707,WM9708,WM9717", patch_wolfson03, NULL},
@@ -1308,18 +1307,16 @@ static int snd_ac97_mixer_build(ac97_t * ac97)
 	}
 	
 	/* build master tone controls */
-	if (!(ac97->flags & AC97_HAS_NO_TONE)) {
-		if (snd_ac97_try_volume_mix(ac97, AC97_MASTER_TONE)) {
-			for (idx = 0; idx < 2; idx++) {
-				if ((err = snd_ctl_add(card, kctl = snd_ac97_cnew(&snd_ac97_controls_tone[idx], ac97))) < 0)
-					return err;
-				if (ac97->id == AC97_ID_YMF753) {
-					kctl->private_value &= ~(0xff << 16);
-					kctl->private_value |= 7 << 16;
-				}
+	if (snd_ac97_try_volume_mix(ac97, AC97_MASTER_TONE)) {
+		for (idx = 0; idx < 2; idx++) {
+			if ((err = snd_ctl_add(card, kctl = snd_ac97_cnew(&snd_ac97_controls_tone[idx], ac97))) < 0)
+				return err;
+			if (ac97->id == AC97_ID_YMF753) {
+				kctl->private_value &= ~(0xff << 16);
+				kctl->private_value |= 7 << 16;
 			}
-			snd_ac97_write_cache(ac97, AC97_MASTER_TONE, 0x0f0f);
 		}
+		snd_ac97_write_cache(ac97, AC97_MASTER_TONE, 0x0f0f);
 	}
 	
 	/* build PC Speaker controls */
@@ -1342,13 +1339,11 @@ static int snd_ac97_mixer_build(ac97_t * ac97)
 	}
 	
 	/* build MIC controls */
-	if (!(ac97->flags & AC97_HAS_NO_MIC)) {
-		if (snd_ac97_try_volume_mix(ac97, AC97_MIC)) {
-			if ((err = snd_ac97_cmix_new(card, "Mic Playback", AC97_MIC, ac97)) < 0)
-				return err;
-			if ((err = snd_ctl_add(card, snd_ac97_cnew(&snd_ac97_controls_mic_boost, ac97))) < 0)
-				return err;
-		}
+	if (snd_ac97_try_volume_mix(ac97, AC97_MIC)) {
+		if ((err = snd_ac97_cmix_new(card, "Mic Playback", AC97_MIC, ac97)) < 0)
+			return err;
+		if ((err = snd_ctl_add(card, snd_ac97_cnew(&snd_ac97_controls_mic_boost, ac97))) < 0)
+			return err;
 	}
 
 	/* build Line controls */
@@ -1407,14 +1402,12 @@ static int snd_ac97_mixer_build(ac97_t * ac97)
 		}
 		snd_ac97_write_cache(ac97, AC97_PCM, init_val);
 	} else {
-		if (!(ac97->flags & AC97_HAS_NO_STD_PCM)) {
-			if (ac97->flags & AC97_HAS_NO_PCM_VOL)
-				err = snd_ac97_cmute_new(card, "PCM Playback Switch", AC97_PCM, ac97);
-			else
-				err = snd_ac97_cmix_new(card, "PCM Playback", AC97_PCM, ac97);
-			if (err < 0)
-				return err;
-		}
+		if (ac97->flags & AC97_HAS_NO_PCM_VOL)
+			err = snd_ac97_cmute_new(card, "PCM Playback Switch", AC97_PCM, ac97);
+		else
+			err = snd_ac97_cmix_new(card, "PCM Playback", AC97_PCM, ac97);
+		if (err < 0)
+			return err;
 	}
 
 	/* build Capture controls */
@@ -1814,39 +1807,6 @@ int snd_ac97_bus(snd_card_t *card, int num, ac97_bus_ops_t *ops,
 	return 0;
 }
 
-/* stop no dev release warning */
-static void ac97_device_release(struct device * dev)
-{
-}
-
-/* register ac97 codec to bus */
-static int snd_ac97_dev_register(snd_device_t *device)
-{
-	ac97_t *ac97 = device->device_data;
-	int err;
-
-	ac97->dev.bus = &ac97_bus_type;
-	ac97->dev.parent = ac97->bus->card->dev;
-	ac97->dev.platform_data = ac97;
-	ac97->dev.release = ac97_device_release;
-	snprintf(ac97->dev.bus_id, BUS_ID_SIZE, "card%d-%d", ac97->bus->card->number, ac97->num);
-	if ((err = device_register(&ac97->dev)) < 0) {
-		snd_printk(KERN_ERR "Can't register ac97 bus\n");
-		ac97->dev.bus = NULL;
-		return err;
-	}
-	return 0;
-}
-
-/* unregister ac97 codec */
-static int snd_ac97_dev_unregister(snd_device_t *device)
-{
-	ac97_t *ac97 = device->device_data;
-	if (ac97->dev.bus)
-		device_unregister(&ac97->dev);
-	return snd_ac97_free(ac97);
-}
-
 /* build_ops to do nothing */
 static struct snd_ac97_build_ops null_build_ops;
 
@@ -1880,8 +1840,6 @@ int snd_ac97_mixer(ac97_bus_t *bus, ac97_template_t *template, ac97_t **rac97)
 	const ac97_codec_id_t *pid;
 	static snd_device_ops_t ops = {
 		.dev_free =	snd_ac97_dev_free,
-		.dev_register =	snd_ac97_dev_register,
-		.dev_unregister =	snd_ac97_dev_unregister,
 	};
 
 	snd_assert(rac97 != NULL, return -EINVAL);
@@ -2581,6 +2539,8 @@ int snd_ac97_tune_hardware(ac97_t *ac97, struct ac97_quirk *quirk, const char *o
 {
 	int result;
 
+	snd_assert(quirk, return -EINVAL);
+
 	/* quirk overriden? */
 	if (override && strcmp(override, "-1") && strcmp(override, "default")) {
 		result = apply_quirk_str(ac97, override);
@@ -2589,9 +2549,6 @@ int snd_ac97_tune_hardware(ac97_t *ac97, struct ac97_quirk *quirk, const char *o
 		return result;
 	}
 
-	if (! quirk)
-		return -EINVAL;
-
 	for (; quirk->subvendor; quirk++) {
 		if (quirk->subvendor != ac97->subsystem_vendor)
 			continue;
diff --git a/trunk/sound/pci/ac97/ac97_patch.c b/trunk/sound/pci/ac97/ac97_patch.c
index b584172c1104..66edc857d3e6 100644
--- a/trunk/sound/pci/ac97/ac97_patch.c
+++ b/trunk/sound/pci/ac97/ac97_patch.c
@@ -370,387 +370,141 @@ int patch_yamaha_ymf753(ac97_t * ac97)
  *  added support for WM9705,WM9708,WM9709,WM9710,WM9711,WM9712 and WM9717.
  */
 
-static const snd_kcontrol_new_t wm97xx_snd_ac97_controls[] = {
-AC97_DOUBLE("Front Playback Volume", AC97_WM97XX_FMIXER_VOL, 8, 0, 31, 1),
-AC97_SINGLE("Front Playback Switch", AC97_WM97XX_FMIXER_VOL, 15, 1, 1),
-};
-
-static int patch_wolfson_wm9703_specific(ac97_t * ac97)
+int patch_wolfson03(ac97_t * ac97)
 {
 	/* This is known to work for the ViewSonic ViewPad 1000
-	 * Randolph Bentson <bentson@holmsjoen.com>
-	 * WM9703/9707/9708/9717 
-	 */
-	int err, i;
-	
-	for (i = 0; i < ARRAY_SIZE(wm97xx_snd_ac97_controls); i++) {
-		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm97xx_snd_ac97_controls[i], ac97))) < 0)
-			return err;
-	}
-	snd_ac97_write_cache(ac97,  AC97_WM97XX_FMIXER_VOL, 0x0808);
-	return 0;
-}
-
-static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
-	.build_specific = patch_wolfson_wm9703_specific,
-};
+	   Randolph Bentson <bentson@holmsjoen.com> */
 
-int patch_wolfson03(ac97_t * ac97)
-{
-	ac97->build_ops = &patch_wolfson_wm9703_ops;
+	// WM9703/9707/9708/9717
+	snd_ac97_write_cache(ac97, AC97_WM97XX_FMIXER_VOL, 0x0808);
+	snd_ac97_write_cache(ac97, AC97_GENERAL_PURPOSE, 0x8000);
 	return 0;
 }
-
-static const snd_kcontrol_new_t wm9704_snd_ac97_controls[] = {
-AC97_DOUBLE("Front Playback Volume", AC97_WM97XX_FMIXER_VOL, 8, 0, 31, 1),
-AC97_SINGLE("Front Playback Switch", AC97_WM97XX_FMIXER_VOL, 15, 1, 1),
-AC97_DOUBLE("Rear Playback Volume", AC97_WM9704_RMIXER_VOL, 8, 0, 31, 1),
-AC97_SINGLE("Rear Playback Switch", AC97_WM9704_RMIXER_VOL, 15, 1, 1),
-AC97_DOUBLE("Rear DAC Volume", AC97_WM9704_RPCM_VOL, 8, 0, 31, 1),
-AC97_DOUBLE("Surround Volume", AC97_SURROUND_MASTER, 8, 0, 31, 1),
-};
-
-static int patch_wolfson_wm9704_specific(ac97_t * ac97)
-{
-	int err, i;
-	for (i = 0; i < ARRAY_SIZE(wm9704_snd_ac97_controls); i++) {
-		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm9704_snd_ac97_controls[i], ac97))) < 0)
-			return err;
-	}
-	/* patch for DVD noise */
-	snd_ac97_write_cache(ac97, AC97_WM9704_TEST, 0x0200);
-	return 0;
-}
-
-static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
-	.build_specific = patch_wolfson_wm9704_specific,
-};
-
+  
 int patch_wolfson04(ac97_t * ac97)
 {
-	/* WM9704M/9704Q */
-	ac97->build_ops = &patch_wolfson_wm9704_ops;
-	return 0;
-}
-
-static int patch_wolfson_wm9705_specific(ac97_t * ac97)
-{
-	int err, i;
-	for (i = 0; i < ARRAY_SIZE(wm97xx_snd_ac97_controls); i++) {
-		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm97xx_snd_ac97_controls[i], ac97))) < 0)
-			return err;
-	}
-	snd_ac97_write_cache(ac97,  0x72, 0x0808);
+	// WM9704M/9704Q
+	// set front and rear mixer volume
+	snd_ac97_write_cache(ac97, AC97_WM97XX_FMIXER_VOL, 0x0808);
+	snd_ac97_write_cache(ac97, AC97_WM9704_RMIXER_VOL, 0x0808);
+	
+	// patch for DVD noise
+	snd_ac97_write_cache(ac97, AC97_WM9704_TEST, 0x0200);
+ 
+	// init vol
+	snd_ac97_write_cache(ac97, AC97_WM9704_RPCM_VOL, 0x0808);
+ 
+	// set rear surround volume
+	snd_ac97_write_cache(ac97, AC97_SURROUND_MASTER, 0x0000);
 	return 0;
 }
-
-static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
-	.build_specific = patch_wolfson_wm9705_specific,
-};
-
+  
 int patch_wolfson05(ac97_t * ac97)
 {
-	/* WM9705, WM9710 */
-	ac97->build_ops = &patch_wolfson_wm9705_ops;
-	return 0;
-}
-
-static const char* wm9711_alc_select[] = {"None", "Left", "Right", "Stereo"};
-static const char* wm9711_alc_mix[] = {"Stereo", "Right", "Left", "None"};
-static const char* wm9711_out3_src[] = {"Left", "VREF", "Left + Right", "Mono"};
-static const char* wm9711_out3_lrsrc[] = {"Master Mix", "Headphone Mix"};
-static const char* wm9711_rec_adc[] = {"Stereo", "Left", "Right", "Mute"};
-static const char* wm9711_base[] = {"Linear Control", "Adaptive Boost"};
-static const char* wm9711_rec_gain[] = {"+1.5dB Steps", "+0.75dB Steps"};
-static const char* wm9711_mic[] = {"Mic 1", "Differential", "Mic 2", "Stereo"};
-static const char* wm9711_rec_sel[] = 
-	{"Mic 1", "NC", "NC", "Master Mix", "Line", "Headphone Mix", "Phone Mix", "Phone"};
-static const char* wm9711_ng_type[] = {"Constant Gain", "Mute"};
-
-static const struct ac97_enum wm9711_enum[] = {
-AC97_ENUM_SINGLE(AC97_PCI_SVID, 14, 4, wm9711_alc_select),
-AC97_ENUM_SINGLE(AC97_VIDEO, 10, 4, wm9711_alc_mix),
-AC97_ENUM_SINGLE(AC97_AUX, 9, 4, wm9711_out3_src),
-AC97_ENUM_SINGLE(AC97_AUX, 8, 2, wm9711_out3_lrsrc),
-AC97_ENUM_SINGLE(AC97_REC_SEL, 12, 4, wm9711_rec_adc),
-AC97_ENUM_SINGLE(AC97_MASTER_TONE, 15, 2, wm9711_base),
-AC97_ENUM_DOUBLE(AC97_REC_GAIN, 14, 6, 2, wm9711_rec_gain),
-AC97_ENUM_SINGLE(AC97_MIC, 5, 4, wm9711_mic),
-AC97_ENUM_DOUBLE(AC97_REC_SEL, 8, 0, 8, wm9711_rec_sel),
-AC97_ENUM_SINGLE(AC97_PCI_SVID, 5, 2, wm9711_ng_type),
-};
-
-static const snd_kcontrol_new_t wm9711_snd_ac97_controls[] = {
-AC97_SINGLE("ALC Target Volume", AC97_CODEC_CLASS_REV, 12, 15, 0),
-AC97_SINGLE("ALC Hold Time", AC97_CODEC_CLASS_REV, 8, 15, 0),
-AC97_SINGLE("ALC Decay Time", AC97_CODEC_CLASS_REV, 4, 15, 0),
-AC97_SINGLE("ALC Attack Time", AC97_CODEC_CLASS_REV, 0, 15, 0),
-AC97_ENUM("ALC Function", wm9711_enum[0]),
-AC97_SINGLE("ALC Max Volume", AC97_PCI_SVID, 11, 7, 1),
-AC97_SINGLE("ALC ZC Timeout", AC97_PCI_SVID, 9, 3, 1),
-AC97_SINGLE("ALC ZC Switch", AC97_PCI_SVID, 8, 1, 0),
-AC97_SINGLE("ALC NG Switch", AC97_PCI_SVID, 7, 1, 0),
-AC97_ENUM("ALC NG Type", wm9711_enum[9]),
-AC97_SINGLE("ALC NG Threshold", AC97_PCI_SVID, 0, 31, 1),
-
-AC97_SINGLE("Side Tone Switch", AC97_VIDEO, 15, 1, 1),
-AC97_SINGLE("Side Tone Volume", AC97_VIDEO, 12, 7, 1),
-AC97_ENUM("ALC Headphone Mux", wm9711_enum[1]),
-AC97_SINGLE("ALC Headphone Volume", AC97_VIDEO, 7, 7, 1),
-
-AC97_SINGLE("Out3 Switch", AC97_AUX, 15, 1, 1),
-AC97_SINGLE("Out3 ZC Switch", AC97_AUX, 7, 1, 1),
-AC97_ENUM("Out3 Mux", wm9711_enum[2]),
-AC97_ENUM("Out3 LR Mux", wm9711_enum[3]),
-AC97_SINGLE("Out3 Volume", AC97_AUX, 0, 31, 1),
-
-AC97_SINGLE("Beep to Headphone Switch", AC97_PC_BEEP, 15, 1, 1),
-AC97_SINGLE("Beep to Headphone Volume", AC97_PC_BEEP, 12, 7, 1),
-AC97_SINGLE("Beep to Side Tone Switch", AC97_PC_BEEP, 11, 1, 1),
-AC97_SINGLE("Beep to Side Tone Volume", AC97_PC_BEEP, 8, 7, 1),
-AC97_SINGLE("Beep to Phone Switch", AC97_PC_BEEP, 7, 1, 1),
-AC97_SINGLE("Beep to Phone Volume", AC97_PC_BEEP, 4, 7, 1),
-
-AC97_SINGLE("Aux to Headphone Switch", AC97_CD, 15, 1, 1),
-AC97_SINGLE("Aux to Headphone Volume", AC97_CD, 12, 7, 1),
-AC97_SINGLE("Aux to Side Tone Switch", AC97_CD, 11, 1, 1),
-AC97_SINGLE("Aux to Side Tone Volume", AC97_CD, 8, 7, 1),
-AC97_SINGLE("Aux to Phone Switch", AC97_CD, 7, 1, 1),
-AC97_SINGLE("Aux to Phone Volume", AC97_CD, 4, 7, 1),
-
-AC97_SINGLE("Phone to Headphone Switch", AC97_PHONE, 15, 1, 1),
-AC97_SINGLE("Phone to Master Switch", AC97_PHONE, 14, 1, 1),
-
-AC97_SINGLE("Line to Headphone Switch", AC97_LINE, 15, 1, 1),
-AC97_SINGLE("Line to Master Switch", AC97_LINE, 14, 1, 1),
-AC97_SINGLE("Line to Phone Switch", AC97_LINE, 13, 1, 1),
-
-AC97_SINGLE("PCM Playback to Headphone Switch", AC97_PCM, 15, 1, 1),
-AC97_SINGLE("PCM Playback to Master Switch", AC97_PCM, 14, 1, 1),
-AC97_SINGLE("PCM Playback to Phone Switch", AC97_PCM, 13, 1, 1),
-
-AC97_SINGLE("Capture 20dB Boost Switch", AC97_REC_SEL, 14, 1, 0),
-AC97_ENUM("Capture to Phone Mux", wm9711_enum[4]),
-AC97_SINGLE("Capture to Phone 20dB Boost Switch", AC97_REC_SEL, 11, 1, 1),
-AC97_ENUM("Capture Select", wm9711_enum[8]),
-
-AC97_SINGLE("3D Upper Cut-off Switch", AC97_3D_CONTROL, 5, 1, 1),
-AC97_SINGLE("3D Lower Cut-off Switch", AC97_3D_CONTROL, 4, 1, 1),
-
-AC97_ENUM("Bass Control", wm9711_enum[5]),
-AC97_SINGLE("Bass Cut-off Switch", AC97_MASTER_TONE, 12, 1, 1),
-AC97_SINGLE("Tone Cut-off Switch", AC97_MASTER_TONE, 4, 1, 1),
-AC97_SINGLE("Playback Attenuate (-6dB) Switch", AC97_MASTER_TONE, 6, 1, 0),
-
-AC97_SINGLE("ADC Switch", AC97_REC_GAIN, 15, 1, 1),
-AC97_ENUM("Capture Volume Steps", wm9711_enum[6]),
-AC97_DOUBLE("Capture Volume", AC97_REC_GAIN, 8, 0, 15, 1),
-AC97_SINGLE("Capture ZC Switch", AC97_REC_GAIN, 7, 1, 0),
-
-AC97_SINGLE("Mic 1 to Phone Switch", AC97_MIC, 14, 1, 1),
-AC97_SINGLE("Mic 2 to Phone Switch", AC97_MIC, 13, 1, 1),
-AC97_ENUM("Mic Select Source", wm9711_enum[7]),
-AC97_SINGLE("Mic 1 Volume", AC97_MIC, 8, 32, 1),
-AC97_SINGLE("Mic 20dB Boost Switch", AC97_MIC, 7, 1, 0),
-
-AC97_SINGLE("Master ZC Switch", AC97_MASTER, 7, 1, 0),
-AC97_SINGLE("Headphone ZC Switch", AC97_HEADPHONE, 7, 1, 0),
-AC97_SINGLE("Mono ZC Switch", AC97_MASTER_MONO, 7, 1, 0),
-};
-
-static int patch_wolfson_wm9711_specific(ac97_t * ac97)
-{
-	int err, i;
-	
-	for (i = 0; i < ARRAY_SIZE(wm9711_snd_ac97_controls); i++) {
-		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm9711_snd_ac97_controls[i], ac97))) < 0)
-			return err;
-	}
-	snd_ac97_write_cache(ac97,  AC97_CODEC_CLASS_REV, 0x0808);
-	snd_ac97_write_cache(ac97,  AC97_PCI_SVID, 0x0808);
-	snd_ac97_write_cache(ac97,  AC97_VIDEO, 0x0808);
-	snd_ac97_write_cache(ac97,  AC97_AUX, 0x0808);
-	snd_ac97_write_cache(ac97,  AC97_PC_BEEP, 0x0808);
-	snd_ac97_write_cache(ac97,  AC97_CD, 0x0000);
+	// WM9705, WM9710
+	// set front mixer volume
+	snd_ac97_write_cache(ac97, AC97_WM97XX_FMIXER_VOL, 0x0808);
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
-	.build_specific = patch_wolfson_wm9711_specific,
-};
-
 int patch_wolfson11(ac97_t * ac97)
 {
-	/* WM9711, WM9712 */
-	ac97->build_ops = &patch_wolfson_wm9711_ops;
-
-	ac97->flags |= AC97_HAS_NO_REC_GAIN | AC97_STEREO_MUTES | AC97_HAS_NO_MIC |
-		AC97_HAS_NO_PC_BEEP | AC97_HAS_NO_VIDEO | AC97_HAS_NO_CD;
-	
+	// WM9711, WM9712
+	// set out3 volume
+	snd_ac97_write_cache(ac97, AC97_WM9711_OUT3VOL, 0x0808);
 	return 0;
 }
 
-static const char* wm9713_mic_mixer[] = {"Stereo", "Mic 1", "Mic 2", "Mute"};
+static const char* wm9713_mic_mixer[] = {"Stereo", "Mic1", "Mic2", "Mute"};
 static const char* wm9713_rec_mux[] = {"Stereo", "Left", "Right", "Mute"};
-static const char* wm9713_rec_src[] = 
-	{"Mic 1", "Mic 2", "Line", "Mono In", "Headphone Mix", "Master Mix", 
-	"Mono Mix", "Zh"};
-static const char* wm9713_rec_gain[] = {"+1.5dB Steps", "+0.75dB Steps"};
-static const char* wm9713_alc_select[] = {"None", "Left", "Right", "Stereo"};
-static const char* wm9713_mono_pga[] = {"Vmid", "Zh", "Mono Mix", "Inv 1"};
-static const char* wm9713_spk_pga[] = 
-	{"Vmid", "Zh", "Headphone Mix", "Master Mix", "Inv", "NC", "NC", "NC"};
-static const char* wm9713_hp_pga[] = {"Vmid", "Zh", "Headphone Mix", "NC"};
-static const char* wm9713_out3_pga[] = {"Vmid", "Zh", "Inv 1", "NC"};
-static const char* wm9713_out4_pga[] = {"Vmid", "Zh", "Inv 2", "NC"};
-static const char* wm9713_dac_inv[] = 
-	{"Off", "Mono Mix", "Master Mix", "Headphone Mix L", "Headphone Mix R", 
-	"Headphone Mix Mono", "NC", "Vmid"};
-static const char* wm9713_base[] = {"Linear Control", "Adaptive Boost"};
-static const char* wm9713_ng_type[] = {"Constant Gain", "Mute"};
+static const char* wm9713_rec_src_l[] = {"Mic1", "Mic2", "Line L", "Mono In", "HP Mix L", "Spk Mix", "Mono Mix", "Zh"};
+static const char* wm9713_rec_src_r[] = {"Mic1", "Mic2", "Line R", "Mono In", "HP Mix R", "Spk Mix", "Mono Mix", "Zh"};
 
 static const struct ac97_enum wm9713_enum[] = {
 AC97_ENUM_SINGLE(AC97_LINE, 3, 4, wm9713_mic_mixer),
 AC97_ENUM_SINGLE(AC97_VIDEO, 14, 4, wm9713_rec_mux),
 AC97_ENUM_SINGLE(AC97_VIDEO, 9, 4, wm9713_rec_mux),
-AC97_ENUM_DOUBLE(AC97_VIDEO, 3, 0, 8, wm9713_rec_src),
-AC97_ENUM_DOUBLE(AC97_CD, 14, 6, 2, wm9713_rec_gain),
-AC97_ENUM_SINGLE(AC97_PCI_SVID, 14, 4, wm9713_alc_select),
-AC97_ENUM_SINGLE(AC97_REC_GAIN, 14, 4, wm9713_mono_pga),
-AC97_ENUM_DOUBLE(AC97_REC_GAIN, 11, 8, 8, wm9713_spk_pga),
-AC97_ENUM_DOUBLE(AC97_REC_GAIN, 6, 4, 4, wm9713_hp_pga),
-AC97_ENUM_SINGLE(AC97_REC_GAIN, 2, 4, wm9713_out3_pga),
-AC97_ENUM_SINGLE(AC97_REC_GAIN, 0, 4, wm9713_out4_pga),
-AC97_ENUM_DOUBLE(AC97_REC_GAIN_MIC, 13, 10, 8, wm9713_dac_inv),
-AC97_ENUM_SINGLE(AC97_GENERAL_PURPOSE, 15, 2, wm9713_base),
-AC97_ENUM_SINGLE(AC97_PCI_SVID, 5, 2, wm9713_ng_type),
+AC97_ENUM_SINGLE(AC97_VIDEO, 3, 8, wm9713_rec_src_l),
+AC97_ENUM_SINGLE(AC97_VIDEO, 0, 8, wm9713_rec_src_r),
 };
 
-static const snd_kcontrol_new_t wm13_snd_ac97_controls[] = {
+static const snd_kcontrol_new_t wm13_snd_ac97_controls_line_in[] = {
 AC97_DOUBLE("Line In Volume", AC97_PC_BEEP, 8, 0, 31, 1),
-AC97_SINGLE("Line In to Headphone Switch", AC97_PC_BEEP, 15, 1, 1),
-AC97_SINGLE("Line In to Master Switch", AC97_PC_BEEP, 14, 1, 1),
-AC97_SINGLE("Line In to Mono Switch", AC97_PC_BEEP, 13, 1, 1),
-
-AC97_DOUBLE("PCM Playback Volume", AC97_PHONE, 8, 0, 31, 1),
-AC97_SINGLE("PCM Playback to Headphone Switch", AC97_PHONE, 15, 1, 1),
-AC97_SINGLE("PCM Playback to Master Switch", AC97_PHONE, 14, 1, 1),
-AC97_SINGLE("PCM Playback to Mono Switch", AC97_PHONE, 13, 1, 1),
-
-AC97_SINGLE("Mic 1 Volume", AC97_MIC, 8, 31, 1),
-AC97_SINGLE("Mic 2 Volume", AC97_MIC, 0, 31, 1),
-AC97_SINGLE("Mic 1 to Mono Switch", AC97_LINE, 7, 1, 1),
-AC97_SINGLE("Mic 2 to Mono Switch", AC97_LINE, 6, 1, 1),
-AC97_SINGLE("Mic Boost (+20dB) Switch", AC97_LINE, 5, 1, 0),
-AC97_ENUM("Mic to Headphone Mux", wm9713_enum[0]),
-AC97_SINGLE("Mic Headphone Mixer Volume", AC97_LINE, 0, 7, 1),
-
-AC97_SINGLE("Capture Switch", AC97_CD, 15, 1, 1),
-AC97_ENUM("Capture Volume Steps", wm9713_enum[4]),
-AC97_DOUBLE("Capture Volume", AC97_CD, 8, 0, 15, 0),
-AC97_SINGLE("Capture ZC Switch", AC97_CD, 7, 1, 0),
-
-AC97_ENUM("Capture to Headphone Mux", wm9713_enum[1]),
-AC97_SINGLE("Capture to Headphone Volume", AC97_VIDEO, 11, 7, 1),
-AC97_ENUM("Capture to Mono Mux", wm9713_enum[2]),
-AC97_SINGLE("Capture to Mono Boost (+20dB) Switch", AC97_VIDEO, 8, 1, 0),
-AC97_SINGLE("Capture ADC Boost (+20dB) Switch", AC97_VIDEO, 6, 1, 0),
-AC97_ENUM("Capture Select", wm9713_enum[3]),
-
-AC97_SINGLE("ALC Target Volume", AC97_CODEC_CLASS_REV, 12, 15, 0),
-AC97_SINGLE("ALC Hold Time", AC97_CODEC_CLASS_REV, 8, 15, 0),
-AC97_SINGLE("ALC Decay Time ", AC97_CODEC_CLASS_REV, 4, 15, 0),
-AC97_SINGLE("ALC Attack Time", AC97_CODEC_CLASS_REV, 0, 15, 0),
-AC97_ENUM("ALC Function", wm9713_enum[5]),
-AC97_SINGLE("ALC Max Volume", AC97_PCI_SVID, 11, 7, 0),
-AC97_SINGLE("ALC ZC Timeout", AC97_PCI_SVID, 9, 3, 0),
-AC97_SINGLE("ALC ZC Switch", AC97_PCI_SVID, 8, 1, 0),
-AC97_SINGLE("ALC NG Switch", AC97_PCI_SVID, 7, 1, 0),
-AC97_ENUM("ALC NG Type", wm9713_enum[13]),
-AC97_SINGLE("ALC NG Threshold", AC97_PCI_SVID, 0, 31, 0),
-
-AC97_DOUBLE("Master ZC Switch", AC97_MASTER, 14, 6, 1, 0),
-AC97_DOUBLE("Headphone ZC Switch", AC97_HEADPHONE, 14, 6, 1, 0),
-AC97_DOUBLE("Out3/4 ZC Switch", AC97_MASTER_MONO, 14, 6, 1, 0),
-AC97_SINGLE("Master Right Switch", AC97_MASTER, 7, 1, 1),
-AC97_SINGLE("Headphone Right Switch", AC97_HEADPHONE, 7, 1, 1),
-AC97_SINGLE("Out3/4 Right Switch", AC97_MASTER_MONO, 7, 1, 1),
-
-AC97_SINGLE("Mono In to Headphone Switch", AC97_MASTER_TONE, 15, 1, 1),
-AC97_SINGLE("Mono In to Master Switch", AC97_MASTER_TONE, 14, 1, 1),
-AC97_SINGLE("Mono In Volume", AC97_MASTER_TONE, 8, 31, 1),
-AC97_SINGLE("Mono Switch", AC97_MASTER_TONE, 7, 1, 1),
-AC97_SINGLE("Mono ZC Switch", AC97_MASTER_TONE, 6, 1, 0),
-AC97_SINGLE("Mono Volume", AC97_MASTER_TONE, 0, 31, 1),
-
-AC97_SINGLE("PC Beep to Headphone Switch", AC97_AUX, 15, 1, 1),
-AC97_SINGLE("PC Beep to Headphone Volume", AC97_AUX, 12, 7, 1),
-AC97_SINGLE("PC Beep to Master Switch", AC97_AUX, 11, 1, 1),
-AC97_SINGLE("PC Beep to Master Volume", AC97_AUX, 8, 7, 1),
-AC97_SINGLE("PC Beep to Mono Switch", AC97_AUX, 7, 1, 1),
-AC97_SINGLE("PC Beep to Mono Volume", AC97_AUX, 4, 7, 1),
-
-AC97_SINGLE("Voice to Headphone Switch", AC97_PCM, 15, 1, 1),
-AC97_SINGLE("Voice to Headphone Volume", AC97_PCM, 12, 7, 1),
-AC97_SINGLE("Voice to Master Switch", AC97_PCM, 11, 1, 1),
-AC97_SINGLE("Voice to Master Volume", AC97_PCM, 8, 7, 1),
-AC97_SINGLE("Voice to Mono Switch", AC97_PCM, 7, 1, 1),
-AC97_SINGLE("Voice to Mono Volume", AC97_PCM, 4, 7, 1),
-
-AC97_SINGLE("Aux to Headphone Switch", AC97_REC_SEL, 15, 1, 1),
-AC97_SINGLE("Aux to Headphone Volume", AC97_REC_SEL, 12, 7, 1),
-AC97_SINGLE("Aux to Master Switch", AC97_REC_SEL, 11, 1, 1),
-AC97_SINGLE("Aux to Master Volume", AC97_REC_SEL, 8, 7, 1),
-AC97_SINGLE("Aux to Mono Switch", AC97_REC_SEL, 7, 1, 1),
-AC97_SINGLE("Aux to Mono Volume", AC97_REC_SEL, 4, 7, 1),
-
-AC97_ENUM("Mono Input Mux", wm9713_enum[6]),
-AC97_ENUM("Master Input Mux", wm9713_enum[7]),
-AC97_ENUM("Headphone Input Mux", wm9713_enum[8]),
-AC97_ENUM("Out 3 Input Mux", wm9713_enum[9]),
-AC97_ENUM("Out 4 Input Mux", wm9713_enum[10]),
-
-AC97_ENUM("Bass Control", wm9713_enum[12]),
-AC97_SINGLE("Bass Cut-off Switch", AC97_GENERAL_PURPOSE, 12, 1, 1),
-AC97_SINGLE("Tone Cut-off Switch", AC97_GENERAL_PURPOSE, 4, 1, 1),
-AC97_SINGLE("Playback Attenuate (-6dB) Switch", AC97_GENERAL_PURPOSE, 6, 1, 0),
-AC97_SINGLE("Bass Volume", AC97_GENERAL_PURPOSE, 8, 15, 1),
-AC97_SINGLE("Tone Volume", AC97_GENERAL_PURPOSE, 0, 15, 1),
+AC97_SINGLE("Line In to Headphone Mute", AC97_PC_BEEP, 15, 1, 1),
+AC97_SINGLE("Line In to Speaker Mute", AC97_PC_BEEP, 14, 1, 1),
+AC97_SINGLE("Line In to Mono Mute", AC97_PC_BEEP, 13, 1, 1),
 };
 
-static const snd_kcontrol_new_t wm13_snd_ac97_controls_3d[] = {
-AC97_ENUM("Inv Input Mux", wm9713_enum[11]),
-AC97_SINGLE("3D Upper Cut-off Switch", AC97_REC_GAIN_MIC, 5, 1, 0),
-AC97_SINGLE("3D Lower Cut-off Switch", AC97_REC_GAIN_MIC, 4, 1, 0),
-AC97_SINGLE("3D Depth", AC97_REC_GAIN_MIC, 0, 15, 1),
+static const snd_kcontrol_new_t wm13_snd_ac97_controls_dac[] = {
+AC97_DOUBLE("DAC Volume", AC97_PHONE, 8, 0, 31, 1),
+AC97_SINGLE("DAC to Headphone Mute", AC97_PHONE, 15, 1, 1),
+AC97_SINGLE("DAC to Speaker Mute", AC97_PHONE, 14, 1, 1),
+AC97_SINGLE("DAC to Mono Mute", AC97_PHONE, 13, 1, 1),
 };
 
-static int patch_wolfson_wm9713_3d (ac97_t * ac97)
-{
-	int err, i;
-    
-	for (i = 0; i < ARRAY_SIZE(wm13_snd_ac97_controls_3d); i++) {
-		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm13_snd_ac97_controls_3d[i], ac97))) < 0)
-			return err;
-	}
-	return 0;
-}
+static const snd_kcontrol_new_t wm13_snd_ac97_controls_mic[] = {
+AC97_SINGLE("MICA Volume", AC97_MIC, 8, 31, 1),
+AC97_SINGLE("MICB Volume", AC97_MIC, 0, 31, 1),
+AC97_SINGLE("MICA to Mono Mute", AC97_LINE, 7, 1, 1),
+AC97_SINGLE("MICB to Mono Mute", AC97_LINE, 6, 1, 1),
+AC97_SINGLE("MIC Boost (+20dB)", AC97_LINE, 5, 1, 1),
+AC97_ENUM("MIC Headphone Routing", wm9713_enum[0]),
+AC97_SINGLE("MIC Headphone Mixer Volume", AC97_LINE, 0, 7, 1)
+};
+
+static const snd_kcontrol_new_t wm13_snd_ac97_controls_adc[] = {
+AC97_SINGLE("ADC Mute", AC97_CD, 15, 1, 1),
+AC97_DOUBLE("Gain Step Size (1.5dB/0.75dB)", AC97_CD, 14, 6, 1, 1),
+AC97_DOUBLE("ADC Volume",AC97_CD, 8, 0, 15, 0),
+AC97_SINGLE("ADC Zero Cross", AC97_CD, 7, 1, 1),
+};
+
+static const snd_kcontrol_new_t wm13_snd_ac97_controls_recsel[] = {
+AC97_ENUM("Record to Headphone Path", wm9713_enum[1]),
+AC97_SINGLE("Record to Headphone Volume", AC97_VIDEO, 11, 7, 0),
+AC97_ENUM("Record to Mono Path", wm9713_enum[2]),
+AC97_SINGLE("Record to Mono Boost (+20dB)", AC97_VIDEO, 8, 1, 0),
+AC97_SINGLE("Record ADC Boost (+20dB)", AC97_VIDEO, 6, 1, 0),
+AC97_ENUM("Record Select Left", wm9713_enum[3]),
+AC97_ENUM("Record Select Right", wm9713_enum[4]),
+};
 
 static int patch_wolfson_wm9713_specific(ac97_t * ac97)
 {
 	int err, i;
 	
-	for (i = 0; i < ARRAY_SIZE(wm13_snd_ac97_controls); i++) {
-		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm13_snd_ac97_controls[i], ac97))) < 0)
+	for (i = 0; i < ARRAY_SIZE(wm13_snd_ac97_controls_line_in); i++) {
+		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm13_snd_ac97_controls_line_in[i], ac97))) < 0)
 			return err;
 	}
 	snd_ac97_write_cache(ac97, AC97_PC_BEEP, 0x0808);
+	
+	for (i = 0; i < ARRAY_SIZE(wm13_snd_ac97_controls_dac); i++) {
+		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm13_snd_ac97_controls_dac[i], ac97))) < 0)
+			return err;
+	}
 	snd_ac97_write_cache(ac97, AC97_PHONE, 0x0808);
+	
+	for (i = 0; i < ARRAY_SIZE(wm13_snd_ac97_controls_mic); i++) {
+		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm13_snd_ac97_controls_mic[i], ac97))) < 0)
+			return err;
+	}
 	snd_ac97_write_cache(ac97, AC97_MIC, 0x0808);
 	snd_ac97_write_cache(ac97, AC97_LINE, 0x00da);
+	
+	for (i = 0; i < ARRAY_SIZE(wm13_snd_ac97_controls_adc); i++) {
+		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm13_snd_ac97_controls_adc[i], ac97))) < 0)
+			return err;
+	}
 	snd_ac97_write_cache(ac97, AC97_CD, 0x0808);
+	
+	for (i = 0; i < ARRAY_SIZE(wm13_snd_ac97_controls_recsel); i++) {
+		if ((err = snd_ctl_add(ac97->bus->card, snd_ac97_cnew(&wm13_snd_ac97_controls_recsel[i], ac97))) < 0)
+			return err;
+	}
 	snd_ac97_write_cache(ac97, AC97_VIDEO, 0xd612);
 	snd_ac97_write_cache(ac97, AC97_REC_GAIN, 0x1ba0);
+	
 	return 0;
 }
 
@@ -771,7 +525,6 @@ static void patch_wolfson_wm9713_resume (ac97_t * ac97)
 
 static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
 	.build_specific = patch_wolfson_wm9713_specific,
-	.build_3d = patch_wolfson_wm9713_3d,
 #ifdef CONFIG_PM	
 	.suspend = patch_wolfson_wm9713_suspend,
 	.resume = patch_wolfson_wm9713_resume
@@ -780,13 +533,10 @@ static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
 
 int patch_wolfson13(ac97_t * ac97)
 {
-	/* WM9713, WM9714 */
 	ac97->build_ops = &patch_wolfson_wm9713_ops;
 
 	ac97->flags |= AC97_HAS_NO_REC_GAIN | AC97_STEREO_MUTES | AC97_HAS_NO_PHONE |
-		AC97_HAS_NO_PC_BEEP | AC97_HAS_NO_VIDEO | AC97_HAS_NO_CD | AC97_HAS_NO_TONE |
-		AC97_HAS_NO_STD_PCM;
-    	ac97->scaps &= ~AC97_SCAP_MODEM;
+		AC97_HAS_NO_PC_BEEP | AC97_HAS_NO_VIDEO | AC97_HAS_NO_CD;
 
 	snd_ac97_write_cache(ac97, AC97_EXTENDED_MID, 0xda00);
 	snd_ac97_write_cache(ac97, AC97_EXTENDED_MSTATUS, 0x3810);
@@ -1629,7 +1379,6 @@ static void check_ad1981_hp_jack_sense(ac97_t *ac97)
 	u32 subid = ((u32)ac97->subsystem_vendor << 16) | ac97->subsystem_device;
 	switch (subid) {
 	case 0x103c0890: /* HP nc6000 */
-	case 0x103c099c: /* HP nx6110 */
 	case 0x103c006d: /* HP nx9105 */
 	case 0x17340088: /* FSC Scenic-W */
 		/* enable headphone jack sense */
@@ -1957,7 +1706,7 @@ static const snd_kcontrol_new_t snd_ac97_controls_alc650[] = {
 };
 
 static const snd_kcontrol_new_t snd_ac97_spdif_controls_alc650[] = {
-        AC97_SINGLE(SNDRV_CTL_NAME_IEC958("",CAPTURE,SWITCH), AC97_ALC650_MULTICH, 11, 1, 0),
+        AC97_SINGLE("IEC958 Capture Switch", AC97_ALC650_MULTICH, 11, 1, 0),
         AC97_SINGLE("Analog to IEC958 Output", AC97_ALC650_MULTICH, 12, 1, 0),
 	/* disable this controls since it doesn't work as expected */
 	/* AC97_SINGLE("IEC958 Input Monitor", AC97_ALC650_MULTICH, 13, 1, 0), */
@@ -2100,12 +1849,12 @@ static int alc655_iec958_route_put(snd_kcontrol_t *kcontrol, snd_ctl_elem_value_
 }
 
 static const snd_kcontrol_new_t snd_ac97_spdif_controls_alc655[] = {
-        AC97_PAGE_SINGLE(SNDRV_CTL_NAME_IEC958("",CAPTURE,SWITCH), AC97_ALC650_MULTICH, 11, 1, 0, 0),
+        AC97_PAGE_SINGLE("IEC958 Capture Switch", AC97_ALC650_MULTICH, 11, 1, 0, 0),
 	/* disable this controls since it doesn't work as expected */
         /* AC97_PAGE_SINGLE("IEC958 Input Monitor", AC97_ALC650_MULTICH, 14, 1, 0, 0), */
 	{
 		.iface  = SNDRV_CTL_ELEM_IFACE_MIXER,
-		.name   = SNDRV_CTL_NAME_IEC958("",PLAYBACK,NONE) "Route",
+		.name   = "IEC958 Playback Route",
 		.info   = alc655_iec958_route_info,
 		.get    = alc655_iec958_route_get,
 		.put    = alc655_iec958_route_put,
@@ -2666,16 +2415,6 @@ int patch_vt1616(ac97_t * ac97)
 	return 0;
 }
 
-/*
- * VT1617A codec
- */
-int patch_vt1617a(ac97_t * ac97)
-{
-	ac97->ext_id |= AC97_EI_SPDIF;	/* force the detection of spdif */
-	ac97->rates[AC97_RATES_SPDIF] = SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000;
-	return 0;
-}
-
 /*
  */
 static void it2646_update_jacks(ac97_t *ac97)
@@ -2694,7 +2433,7 @@ static const snd_kcontrol_new_t snd_ac97_controls_it2646[] = {
 };
 
 static const snd_kcontrol_new_t snd_ac97_spdif_controls_it2646[] = {
-	AC97_SINGLE(SNDRV_CTL_NAME_IEC958("",CAPTURE,SWITCH), 0x76, 11, 1, 0),
+	AC97_SINGLE("IEC958 Capture Switch", 0x76, 11, 1, 0),
 	AC97_SINGLE("Analog to IEC958 Output", 0x76, 12, 1, 0),
 	AC97_SINGLE("IEC958 Input Monitor", 0x76, 13, 1, 0),
 };
diff --git a/trunk/sound/pci/ac97/ac97_patch.h b/trunk/sound/pci/ac97/ac97_patch.h
index ec1811320106..7b7377d0f2ae 100644
--- a/trunk/sound/pci/ac97/ac97_patch.h
+++ b/trunk/sound/pci/ac97/ac97_patch.h
@@ -56,6 +56,5 @@ int patch_cm9739(ac97_t * ac97);
 int patch_cm9761(ac97_t * ac97);
 int patch_cm9780(ac97_t * ac97);
 int patch_vt1616(ac97_t * ac97);
-int patch_vt1617a(ac97_t * ac97);
 int patch_it2646(ac97_t * ac97);
 int mpatch_si3036(ac97_t * ac97);
diff --git a/trunk/sound/pci/ali5451/ali5451.c b/trunk/sound/pci/ali5451/ali5451.c
index ce6c9fadb594..f08ae71f902d 100644
--- a/trunk/sound/pci/ali5451/ali5451.c
+++ b/trunk/sound/pci/ali5451/ali5451.c
@@ -1842,7 +1842,7 @@ static int __devinit snd_ali_pcm(ali_t * codec, int device, struct ali_pcm_descr
 	return 0;
 }
 
-static struct ali_pcm_description ali_pcms[] = {
+struct ali_pcm_description ali_pcms[] = {
 	{ "ALI 5451", ALI_CHANNELS, 1, &snd_ali_playback_ops, &snd_ali_capture_ops },
 	{ "ALI 5451 modem", 1, 1, &snd_ali_modem_playback_ops, &snd_ali_modem_capture_ops }
 };
@@ -1959,9 +1959,9 @@ static int snd_ali5451_spdif_put(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
 static snd_kcontrol_new_t snd_ali5451_mixer_spdif[] __devinitdata = {
 	/* spdif aplayback switch */
 	/* FIXME: "IEC958 Playback Switch" may conflict with one on ac97_codec */
-	ALI5451_SPDIF(SNDRV_CTL_NAME_IEC958("Output ",NONE,SWITCH), 0, 0),
+	ALI5451_SPDIF("IEC958 Output switch", 0, 0),
 	/* spdif out to spdif channel */
-	ALI5451_SPDIF(SNDRV_CTL_NAME_IEC958("Channel Output ",NONE,SWITCH), 0, 1),
+	ALI5451_SPDIF("IEC958 Channel Output Switch", 0, 1),
 	/* spdif in from spdif channel */
 	ALI5451_SPDIF(SNDRV_CTL_NAME_IEC958("",CAPTURE,SWITCH), 0, 2)
 };
diff --git a/trunk/sound/pci/atiixp.c b/trunk/sound/pci/atiixp.c
index 904d17394e1c..cafab4af5c57 100644
--- a/trunk/sound/pci/atiixp.c
+++ b/trunk/sound/pci/atiixp.c
@@ -248,7 +248,6 @@ struct snd_atiixp_dma {
 	unsigned int period_bytes, periods;
 	int opened;
 	int running;
-	int suspended;
 	int pcm_open_flag;
 	int ac97_pcm_type;	/* index # of ac97_pcm to access, -1 = not used */
 	unsigned int saved_curptr;
@@ -700,18 +699,12 @@ static int snd_atiixp_pcm_trigger(snd_pcm_substream_t *substream, int cmd)
 	spin_lock(&chip->reg_lock);
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
-	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-	case SNDRV_PCM_TRIGGER_RESUME:
 		dma->ops->enable_transfer(chip, 1);
 		dma->running = 1;
-		dma->suspended = 0;
 		break;
 	case SNDRV_PCM_TRIGGER_STOP:
-	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-	case SNDRV_PCM_TRIGGER_SUSPEND:
 		dma->ops->enable_transfer(chip, 0);
 		dma->running = 0;
-		dma->suspended = cmd == SNDRV_PCM_TRIGGER_SUSPEND;
 		break;
 	default:
 		err = -EINVAL;
@@ -982,7 +975,6 @@ static snd_pcm_hardware_t snd_atiixp_pcm_hw =
 {
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
-				 SNDRV_PCM_INFO_PAUSE |
 				 SNDRV_PCM_INFO_RESUME |
 				 SNDRV_PCM_INFO_MMAP_VALID),
 	.formats =		SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
@@ -1451,7 +1443,7 @@ static int snd_atiixp_resume(snd_card_t *card)
 	for (i = 0; i < NUM_ATI_PCMDEVS; i++)
 		if (chip->pcmdevs[i]) {
 			atiixp_dma_t *dma = &chip->dmas[i];
-			if (dma->substream && dma->suspended) {
+			if (dma->substream && dma->running) {
 				dma->ops->enable_dma(chip, 1);
 				writel((u32)dma->desc_buf.addr | ATI_REG_LINKPTR_EN,
 				       chip->remap_addr + dma->ops->llp_offset);
diff --git a/trunk/sound/pci/au88x0/au88x0_pcm.c b/trunk/sound/pci/au88x0/au88x0_pcm.c
index 38bd2b5dd434..04dcefd8b8ff 100644
--- a/trunk/sound/pci/au88x0/au88x0_pcm.c
+++ b/trunk/sound/pci/au88x0/au88x0_pcm.c
@@ -33,7 +33,7 @@
 /* hardware definition */
 static snd_pcm_hardware_t snd_vortex_playback_hw_adb = {
 	.info =
-	    (SNDRV_PCM_INFO_MMAP | /* SNDRV_PCM_INFO_RESUME | */
+	    (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_RESUME |
 	     SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_INTERLEAVED |
 	     SNDRV_PCM_INFO_MMAP_VALID),
 	.formats =
@@ -58,7 +58,7 @@ static snd_pcm_hardware_t snd_vortex_playback_hw_adb = {
 #ifndef CHIP_AU8820
 static snd_pcm_hardware_t snd_vortex_playback_hw_a3d = {
 	.info =
-	    (SNDRV_PCM_INFO_MMAP | /* SNDRV_PCM_INFO_RESUME | */
+	    (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_RESUME |
 	     SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_INTERLEAVED |
 	     SNDRV_PCM_INFO_MMAP_VALID),
 	.formats =
@@ -78,7 +78,7 @@ static snd_pcm_hardware_t snd_vortex_playback_hw_a3d = {
 #endif
 static snd_pcm_hardware_t snd_vortex_playback_hw_spdif = {
 	.info =
-	    (SNDRV_PCM_INFO_MMAP | /* SNDRV_PCM_INFO_RESUME | */
+	    (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_RESUME |
 	     SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_INTERLEAVED |
 	     SNDRV_PCM_INFO_MMAP_VALID),
 	.formats =
@@ -220,10 +220,8 @@ snd_vortex_pcm_hw_params(snd_pcm_substream_t * substream,
 		    vortex_adb_allocroute(chip, -1,
 					  params_channels(hw_params),
 					  substream->stream, type);
-		if (dma < 0) {
-			spin_unlock_irq(&chip->lock);
+		if (dma < 0)
 			return dma;
-		}
 		stream = substream->runtime->private_data = &chip->dma_adb[dma];
 		stream->substream = substream;
 		/* Setup Buffers. */
diff --git a/trunk/sound/pci/ca0106/ca0106_main.c b/trunk/sound/pci/ca0106/ca0106_main.c
index 7e27bfc37439..95c289284267 100644
--- a/trunk/sound/pci/ca0106/ca0106_main.c
+++ b/trunk/sound/pci/ca0106/ca0106_main.c
@@ -188,14 +188,6 @@ static ca0106_details_t ca0106_chip_details[] = {
 	   .name   = "MSI K8N Diamond MB [SB0438]",
 	   .gpio_type = 1,
 	   .i2c_adc = 1 } ,
-	 /* Shuttle XPC SD31P which has an onboard Creative Labs Sound Blaster Live! 24-bit EAX
-	  * high-definition 7.1 audio processor".
-	  * Added using info from andrewvegan in alsa bug #1298
-	  */
-	 { .serial = 0x30381297,
-	   .name   = "Shuttle XPC SD31P [SD31P]",
-	   .gpio_type = 1,
-	   .i2c_adc = 1 } ,
 	 { .serial = 0,
 	   .name   = "AudigyLS [Unknown]" }
 };
diff --git a/trunk/sound/pci/ca0106/ca0106_mixer.c b/trunk/sound/pci/ca0106/ca0106_mixer.c
index b6b8882ce704..0e5e9ce0ff28 100644
--- a/trunk/sound/pci/ca0106/ca0106_mixer.c
+++ b/trunk/sound/pci/ca0106/ca0106_mixer.c
@@ -297,7 +297,7 @@ static int snd_ca0106_spdif_put(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_ca0106_spdif_mask_control =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-        .iface =        SNDRV_CTL_ELEM_IFACE_PCM,
+        .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
         .name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,MASK),
 	.count =	4,
         .info =         snd_ca0106_spdif_info,
@@ -306,7 +306,7 @@ static snd_kcontrol_new_t snd_ca0106_spdif_mask_control =
 
 static snd_kcontrol_new_t snd_ca0106_spdif_control =
 {
-        .iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+        .iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
         .name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,DEFAULT),
 	.count =	4,
         .info =         snd_ca0106_spdif_info,
diff --git a/trunk/sound/pci/cmipci.c b/trunk/sound/pci/cmipci.c
index b098b51099c2..f5a4ac1ceef9 100644
--- a/trunk/sound/pci/cmipci.c
+++ b/trunk/sound/pci/cmipci.c
@@ -1029,7 +1029,7 @@ static int snd_cmipci_spdif_mask_get(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_cmipci_spdif_mask __devinitdata =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =		SNDRV_CTL_NAME_IEC958("",PLAYBACK,CON_MASK),
 	.info =		snd_cmipci_spdif_mask_info,
 	.get =		snd_cmipci_spdif_mask_get,
diff --git a/trunk/sound/pci/cs46xx/cs46xx.c b/trunk/sound/pci/cs46xx/cs46xx.c
index b9fff4ee6f9d..db212ecd792a 100644
--- a/trunk/sound/pci/cs46xx/cs46xx.c
+++ b/trunk/sound/pci/cs46xx/cs46xx.c
@@ -113,7 +113,7 @@ static int __devinit snd_card_cs46xx_probe(struct pci_dev *pci,
 		return err;
 	}
 #endif
-	if ((err = snd_cs46xx_mixer(chip, 2)) < 0) {
+	if ((err = snd_cs46xx_mixer(chip)) < 0) {
 		snd_card_free(card);
 		return err;
 	}
diff --git a/trunk/sound/pci/cs46xx/cs46xx_lib.c b/trunk/sound/pci/cs46xx/cs46xx_lib.c
index 4b052158ee33..ff28af1f658e 100644
--- a/trunk/sound/pci/cs46xx/cs46xx_lib.c
+++ b/trunk/sound/pci/cs46xx/cs46xx_lib.c
@@ -1243,8 +1243,8 @@ static snd_pcm_hardware_t snd_cs46xx_playback =
 {
 	.info =			(SNDRV_PCM_INFO_MMAP |
 				 SNDRV_PCM_INFO_INTERLEAVED | 
-				 SNDRV_PCM_INFO_BLOCK_TRANSFER /*|*/
-				 /*SNDRV_PCM_INFO_RESUME*/),
+				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
+				 SNDRV_PCM_INFO_RESUME),
 	.formats =		(SNDRV_PCM_FMTBIT_S8 | SNDRV_PCM_FMTBIT_U8 |
 				 SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S16_BE |
 				 SNDRV_PCM_FMTBIT_U16_LE | SNDRV_PCM_FMTBIT_U16_BE),
@@ -1265,8 +1265,8 @@ static snd_pcm_hardware_t snd_cs46xx_capture =
 {
 	.info =			(SNDRV_PCM_INFO_MMAP |
 				 SNDRV_PCM_INFO_INTERLEAVED |
-				 SNDRV_PCM_INFO_BLOCK_TRANSFER /*|*/
-				 /*SNDRV_PCM_INFO_RESUME*/),
+				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
+				 SNDRV_PCM_INFO_RESUME),
 	.formats =		SNDRV_PCM_FMTBIT_S16_LE,
 	.rates =		SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
 	.rate_min =		5500,
@@ -2231,7 +2231,7 @@ static snd_kcontrol_new_t snd_cs46xx_controls[] __devinitdata = {
 },
 {
 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-	.name = SNDRV_CTL_NAME_IEC958("Output ",NONE,SWITCH),
+	.name = "IEC958 Output Switch",
 	.info = snd_mixer_boolean_info,
 	.get = snd_cs46xx_iec958_get,
 	.put = snd_cs46xx_iec958_put,
@@ -2239,7 +2239,7 @@ static snd_kcontrol_new_t snd_cs46xx_controls[] __devinitdata = {
 },
 {
 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-	.name = SNDRV_CTL_NAME_IEC958("Input ",NONE,SWITCH),
+	.name = "IEC958 Input Switch",
 	.info = snd_mixer_boolean_info,
 	.get = snd_cs46xx_iec958_get,
 	.put = snd_cs46xx_iec958_put,
@@ -2249,7 +2249,7 @@ static snd_kcontrol_new_t snd_cs46xx_controls[] __devinitdata = {
 /* Input IEC958 volume does not work for the moment. (Benny) */
 {
 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-	.name = SNDRV_CTL_NAME_IEC958("Input ",NONE,VOLUME),
+	.name = "IEC958 Input Volume",
 	.info = snd_cs46xx_vol_info,
 	.get = snd_cs46xx_vol_iec958_get,
 	.put = snd_cs46xx_vol_iec958_put,
@@ -2440,7 +2440,7 @@ static int __devinit cs46xx_detect_codec(cs46xx_t *chip, int codec)
 	return -ENXIO;
 }
 
-int __devinit snd_cs46xx_mixer(cs46xx_t *chip, int spdif_device)
+int __devinit snd_cs46xx_mixer(cs46xx_t *chip)
 {
 	snd_card_t *card = chip->card;
 	snd_ctl_elem_id_t id;
@@ -2476,8 +2476,6 @@ int __devinit snd_cs46xx_mixer(cs46xx_t *chip, int spdif_device)
 	for (idx = 0; idx < ARRAY_SIZE(snd_cs46xx_controls); idx++) {
 		snd_kcontrol_t *kctl;
 		kctl = snd_ctl_new1(&snd_cs46xx_controls[idx], chip);
-		if (kctl && kctl->id.iface == SNDRV_CTL_ELEM_IFACE_PCM)
-			kctl->id.device = spdif_device;
 		if ((err = snd_ctl_add(card, kctl)) < 0)
 			return err;
 	}
diff --git a/trunk/sound/pci/emu10k1/emu10k1.c b/trunk/sound/pci/emu10k1/emu10k1.c
index fc377c4b666c..b17142cabead 100644
--- a/trunk/sound/pci/emu10k1/emu10k1.c
+++ b/trunk/sound/pci/emu10k1/emu10k1.c
@@ -149,7 +149,7 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci,
 		}
 	}
 
-	if ((err = snd_emu10k1_mixer(emu, 0, 3)) < 0) {
+	if ((err = snd_emu10k1_mixer(emu)) < 0) {
 		snd_card_free(card);
 		return err;
 	}
diff --git a/trunk/sound/pci/emu10k1/emu10k1_main.c b/trunk/sound/pci/emu10k1/emu10k1_main.c
index e69d5b739e80..746b51ef3966 100644
--- a/trunk/sound/pci/emu10k1/emu10k1_main.c
+++ b/trunk/sound/pci/emu10k1/emu10k1_main.c
@@ -741,20 +741,12 @@ static emu_chip_details_t emu_chip_details[] = {
 	 .emu10k1_chip = 1,
 	 .ac97_chip = 1,
 	 .sblive51 = 1} ,
-	/* Tested by Thomas Zehetbauer 27th Aug 2005 */
-	{.vendor = 0x1102, .device = 0x0002, .subsystem = 0x80651102,
-	 .driver = "EMU10K1", .name = "SB Live 5.1 [SB0220]", 
-	 .id = "Live",
-	 .emu10k1_chip = 1,
-	 .ac97_chip = 1,
-	 .sblive51 = 1} ,
 	{.vendor = 0x1102, .device = 0x0002, .subsystem = 0x80641102,
 	 .driver = "EMU10K1", .name = "SB Live 5.1", 
 	 .id = "Live",
 	 .emu10k1_chip = 1,
 	 .ac97_chip = 1,
 	 .sblive51 = 1} ,
-	/* Tested by alsa bugtrack user "hus" 12th Sept 2005 */
 	{.vendor = 0x1102, .device = 0x0002, .subsystem = 0x80611102,
 	 .driver = "EMU10K1", .name = "SBLive! Player 5.1 [SB0060]", 
 	 .id = "Live",
diff --git a/trunk/sound/pci/emu10k1/emu10k1x.c b/trunk/sound/pci/emu10k1/emu10k1x.c
index 52c7826df440..e90c5ddd1d17 100644
--- a/trunk/sound/pci/emu10k1/emu10k1x.c
+++ b/trunk/sound/pci/emu10k1/emu10k1x.c
@@ -1183,7 +1183,7 @@ static int snd_emu10k1x_spdif_put(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_emu10k1x_spdif_mask_control =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =        SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,MASK),
 	.count =	3,
 	.info =         snd_emu10k1x_spdif_info,
@@ -1192,7 +1192,7 @@ static snd_kcontrol_new_t snd_emu10k1x_spdif_mask_control =
 
 static snd_kcontrol_new_t snd_emu10k1x_spdif_control =
 {
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,DEFAULT),
 	.count =	3,
 	.info =         snd_emu10k1x_spdif_info,
diff --git a/trunk/sound/pci/emu10k1/emufx.c b/trunk/sound/pci/emu10k1/emufx.c
index 637c555cfdb1..0529fb281125 100644
--- a/trunk/sound/pci/emu10k1/emufx.c
+++ b/trunk/sound/pci/emu10k1/emufx.c
@@ -1159,12 +1159,12 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input))
  	/* Optical SPDIF Playback Volume */
 	A_ADD_VOLUME_IN(stereo_mix, gpr, A_EXTIN_OPT_SPDIF_L);
 	A_ADD_VOLUME_IN(stereo_mix+1, gpr+1, A_EXTIN_OPT_SPDIF_R);
-	snd_emu10k1_init_stereo_control(&controls[nctl++], SNDRV_CTL_NAME_IEC958("Optical ",PLAYBACK,VOLUME), gpr, 0);
+	snd_emu10k1_init_stereo_control(&controls[nctl++], "IEC958 Optical Playback Volume", gpr, 0);
 	gpr += 2;
 	/* Optical SPDIF Capture Volume */
 	A_ADD_VOLUME_IN(capture, gpr, A_EXTIN_OPT_SPDIF_L);
 	A_ADD_VOLUME_IN(capture+1, gpr+1, A_EXTIN_OPT_SPDIF_R);
-	snd_emu10k1_init_stereo_control(&controls[nctl++], SNDRV_CTL_NAME_IEC958("Optical ",CAPTURE,VOLUME), gpr, 0);
+	snd_emu10k1_init_stereo_control(&controls[nctl++], "IEC958 Optical Capture Volume", gpr, 0);
 	gpr += 2;
 
 	/* Line2 Playback Volume */
@@ -1389,7 +1389,7 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input))
 			A_OP(icode, &ptr, iACC3, A_EXTOUT(A_EXTOUT_FRONT_L + z), A_GPR(tmp + 0), A_GPR(tmp + 1), A_C_00000000);
 		}
 	}
-	snd_emu10k1_init_stereo_onoff_control(controls + nctl++, SNDRV_CTL_NAME_IEC958("Optical Raw ",PLAYBACK,SWITCH), gpr, 0);
+	snd_emu10k1_init_stereo_onoff_control(controls + nctl++, "IEC958 Optical Raw Playback Switch", gpr, 0);
 	gpr += 2;
 	
 	A_PUT_STEREO_OUTPUT(A_EXTOUT_REAR_L, A_EXTOUT_REAR_R, playback+2 + SND_EMU10K1_PLAYBACK_CHANNELS);
@@ -1716,7 +1716,7 @@ static int __devinit _snd_emu10k1_init_efx(emu10k1_t *emu)
 		/* IEC958 TTL Playback Volume */
 		for (z = 0; z < 2; z++)
 			VOLUME_ADDIN(icode, &ptr, playback + z, EXTIN_SPDIF_CD_L + z, gpr + z);
-		snd_emu10k1_init_stereo_control(controls + i++, SNDRV_CTL_NAME_IEC958("TTL ",PLAYBACK,VOLUME), gpr, 0);
+		snd_emu10k1_init_stereo_control(controls + i++, "IEC958 TTL Playback Volume", gpr, 0);
 		gpr += 2;
 	
 		/* IEC958 TTL Capture Volume + Switch */
@@ -1724,8 +1724,8 @@ static int __devinit _snd_emu10k1_init_efx(emu10k1_t *emu)
 			SWITCH_IN(icode, &ptr, tmp + 0, EXTIN_SPDIF_CD_L + z, gpr + 2 + z);
 			VOLUME_ADD(icode, &ptr, capture + z, tmp + 0, gpr + z);
 		}
-		snd_emu10k1_init_stereo_control(controls + i++, SNDRV_CTL_NAME_IEC958("TTL ",CAPTURE,VOLUME), gpr, 0);
-		snd_emu10k1_init_stereo_onoff_control(controls + i++, SNDRV_CTL_NAME_IEC958("TTL ",CAPTURE,SWITCH), gpr + 2, 0);
+		snd_emu10k1_init_stereo_control(controls + i++, "IEC958 TTL Capture Volume", gpr, 0);
+		snd_emu10k1_init_stereo_onoff_control(controls + i++, "IEC958 TTL Capture Switch", gpr + 2, 0);
 		gpr += 4;
 	}
 	
@@ -1750,7 +1750,7 @@ static int __devinit _snd_emu10k1_init_efx(emu10k1_t *emu)
 		/* IEC958 Optical Playback Volume */
 		for (z = 0; z < 2; z++)
 			VOLUME_ADDIN(icode, &ptr, playback + z, EXTIN_TOSLINK_L + z, gpr + z);
-		snd_emu10k1_init_stereo_control(controls + i++, SNDRV_CTL_NAME_IEC958("LiveDrive ",PLAYBACK,VOLUME), gpr, 0);
+		snd_emu10k1_init_stereo_control(controls + i++, "IEC958 LiveDrive Playback Volume", gpr, 0);
 		gpr += 2;
 	
 		/* IEC958 Optical Capture Volume */
@@ -1758,8 +1758,8 @@ static int __devinit _snd_emu10k1_init_efx(emu10k1_t *emu)
 			SWITCH_IN(icode, &ptr, tmp + 0, EXTIN_TOSLINK_L + z, gpr + 2 + z);
 			VOLUME_ADD(icode, &ptr, capture + z, tmp + 0, gpr + z);
 		}
-		snd_emu10k1_init_stereo_control(controls + i++, SNDRV_CTL_NAME_IEC958("LiveDrive ",CAPTURE,VOLUME), gpr, 0);
-		snd_emu10k1_init_stereo_onoff_control(controls + i++, SNDRV_CTL_NAME_IEC958("LiveDrive ",CAPTURE,SWITCH), gpr + 2, 0);
+		snd_emu10k1_init_stereo_control(controls + i++, "IEC958 LiveDrive Capture Volume", gpr, 0);
+		snd_emu10k1_init_stereo_onoff_control(controls + i++, "IEC958 LiveDrive Capture Switch", gpr + 2, 0);
 		gpr += 4;
 	}
 	
@@ -1784,7 +1784,7 @@ static int __devinit _snd_emu10k1_init_efx(emu10k1_t *emu)
 		/* IEC958 Coax Playback Volume */
 		for (z = 0; z < 2; z++)
 			VOLUME_ADDIN(icode, &ptr, playback + z, EXTIN_COAX_SPDIF_L + z, gpr + z);
-		snd_emu10k1_init_stereo_control(controls + i++, SNDRV_CTL_NAME_IEC958("Coaxial ",PLAYBACK,VOLUME), gpr, 0);
+		snd_emu10k1_init_stereo_control(controls + i++, "IEC958 Coaxial Playback Volume", gpr, 0);
 		gpr += 2;
 	
 		/* IEC958 Coax Capture Volume + Switch */
@@ -1792,8 +1792,8 @@ static int __devinit _snd_emu10k1_init_efx(emu10k1_t *emu)
 			SWITCH_IN(icode, &ptr, tmp + 0, EXTIN_COAX_SPDIF_L + z, gpr + 2 + z);
 			VOLUME_ADD(icode, &ptr, capture + z, tmp + 0, gpr + z);
 		}
-		snd_emu10k1_init_stereo_control(controls + i++, SNDRV_CTL_NAME_IEC958("Coaxial ",CAPTURE,VOLUME), gpr, 0);
-		snd_emu10k1_init_stereo_onoff_control(controls + i++, SNDRV_CTL_NAME_IEC958("Coaxial ",CAPTURE,SWITCH), gpr + 2, 0);
+		snd_emu10k1_init_stereo_control(controls + i++, "IEC958 Coaxial Capture Volume", gpr, 0);
+		snd_emu10k1_init_stereo_onoff_control(controls + i++, "IEC958 Coaxial Capture Switch", gpr + 2, 0);
 		gpr += 4;
 	}
 	
@@ -1920,7 +1920,7 @@ static int __devinit _snd_emu10k1_init_efx(emu10k1_t *emu)
 #endif
 		}
 
-		snd_emu10k1_init_stereo_onoff_control(controls + i++, SNDRV_CTL_NAME_IEC958("Optical Raw ",PLAYBACK,SWITCH), gpr, 0);
+		snd_emu10k1_init_stereo_onoff_control(controls + i++, "IEC958 Optical Raw Playback Switch", gpr, 0);
 		gpr += 2;
 	}
 
diff --git a/trunk/sound/pci/emu10k1/emumixer.c b/trunk/sound/pci/emu10k1/emumixer.c
index d71a72e84bcc..6be82c5fe138 100644
--- a/trunk/sound/pci/emu10k1/emumixer.c
+++ b/trunk/sound/pci/emu10k1/emumixer.c
@@ -181,7 +181,7 @@ static int snd_emu10k1_spdif_put(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_emu10k1_spdif_mask_control =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =        SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,MASK),
 	.count =	4,
 	.info =         snd_emu10k1_spdif_info,
@@ -190,7 +190,7 @@ static snd_kcontrol_new_t snd_emu10k1_spdif_mask_control =
 
 static snd_kcontrol_new_t snd_emu10k1_spdif_control =
 {
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,DEFAULT),
 	.count =	4,
 	.info =         snd_emu10k1_spdif_info,
@@ -295,7 +295,7 @@ static int snd_emu10k1_send_routing_put(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_emu10k1_send_routing_control =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READWRITE | SNDRV_CTL_ELEM_ACCESS_INACTIVE,
-	.iface =        SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         "EMU10K1 PCM Send Routing",
 	.count =	32,
 	.info =         snd_emu10k1_send_routing_info,
@@ -364,7 +364,7 @@ static int snd_emu10k1_send_volume_put(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_emu10k1_send_volume_control =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READWRITE | SNDRV_CTL_ELEM_ACCESS_INACTIVE,
-	.iface =        SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         "EMU10K1 PCM Send Volume",
 	.count =	32,
 	.info =         snd_emu10k1_send_volume_info,
@@ -427,7 +427,7 @@ static int snd_emu10k1_attn_put(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_emu10k1_attn_control =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READWRITE | SNDRV_CTL_ELEM_ACCESS_INACTIVE,
-	.iface =        SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         "EMU10K1 PCM Volume",
 	.count =	32,
 	.info =         snd_emu10k1_attn_info,
@@ -737,8 +737,7 @@ static int rename_ctl(snd_card_t *card, const char *src, const char *dst)
 	return -ENOENT;
 }
 
-int __devinit snd_emu10k1_mixer(emu10k1_t *emu,
-				int pcm_device, int multi_device)
+int __devinit snd_emu10k1_mixer(emu10k1_t *emu)
 {
 	int err, pcm;
 	snd_kcontrol_t *kctl;
@@ -853,35 +852,29 @@ int __devinit snd_emu10k1_mixer(emu10k1_t *emu,
 
 	if ((kctl = emu->ctl_send_routing = snd_ctl_new1(&snd_emu10k1_send_routing_control, emu)) == NULL)
 		return -ENOMEM;
-	kctl->id.device = pcm_device;
 	if ((err = snd_ctl_add(card, kctl)))
 		return err;
 	if ((kctl = emu->ctl_send_volume = snd_ctl_new1(&snd_emu10k1_send_volume_control, emu)) == NULL)
 		return -ENOMEM;
-	kctl->id.device = pcm_device;
 	if ((err = snd_ctl_add(card, kctl)))
 		return err;
 	if ((kctl = emu->ctl_attn = snd_ctl_new1(&snd_emu10k1_attn_control, emu)) == NULL)
 		return -ENOMEM;
-	kctl->id.device = pcm_device;
 	if ((err = snd_ctl_add(card, kctl)))
 		return err;
 
 	if ((kctl = emu->ctl_efx_send_routing = snd_ctl_new1(&snd_emu10k1_efx_send_routing_control, emu)) == NULL)
 		return -ENOMEM;
-	kctl->id.device = multi_device;
 	if ((err = snd_ctl_add(card, kctl)))
 		return err;
 	
 	if ((kctl = emu->ctl_efx_send_volume = snd_ctl_new1(&snd_emu10k1_efx_send_volume_control, emu)) == NULL)
 		return -ENOMEM;
-	kctl->id.device = multi_device;
 	if ((err = snd_ctl_add(card, kctl)))
 		return err;
 	
 	if ((kctl = emu->ctl_efx_attn = snd_ctl_new1(&snd_emu10k1_efx_attn_control, emu)) == NULL)
 		return -ENOMEM;
-	kctl->id.device = multi_device;
 	if ((err = snd_ctl_add(card, kctl)))
 		return err;
 
@@ -931,14 +924,10 @@ int __devinit snd_emu10k1_mixer(emu10k1_t *emu,
 		/* sb live! and audigy */
 		if ((kctl = snd_ctl_new1(&snd_emu10k1_spdif_mask_control, emu)) == NULL)
 			return -ENOMEM;
-		if (!emu->audigy)
-			kctl->id.device = emu->pcm_efx->device;
 		if ((err = snd_ctl_add(card, kctl)))
 			return err;
 		if ((kctl = snd_ctl_new1(&snd_emu10k1_spdif_control, emu)) == NULL)
 			return -ENOMEM;
-		if (!emu->audigy)
-			kctl->id.device = emu->pcm_efx->device;
 		if ((err = snd_ctl_add(card, kctl)))
 			return err;
 	}
diff --git a/trunk/sound/pci/emu10k1/emupcm.c b/trunk/sound/pci/emu10k1/emupcm.c
index 9c35f6dde1b5..520b99af5f55 100644
--- a/trunk/sound/pci/emu10k1/emupcm.c
+++ b/trunk/sound/pci/emu10k1/emupcm.c
@@ -1682,7 +1682,6 @@ static void snd_emu10k1_pcm_efx_free(snd_pcm_t *pcm)
 int __devinit snd_emu10k1_pcm_efx(emu10k1_t * emu, int device, snd_pcm_t ** rpcm)
 {
 	snd_pcm_t *pcm;
-	snd_kcontrol_t *kctl;
 	int err;
 
 	if (rpcm)
@@ -1715,11 +1714,7 @@ int __devinit snd_emu10k1_pcm_efx(emu10k1_t * emu, int device, snd_pcm_t ** rpcm
 		emu->efx_voices_mask[0] = 0xffff0000;
 		emu->efx_voices_mask[1] = 0;
 	}
-	kctl = snd_ctl_new1(&snd_emu10k1_pcm_efx_voices_mask, emu);
-	if (!kctl)
-		return -ENOMEM;
-	kctl->id.device = device;
-	snd_ctl_add(emu->card, kctl);
+	snd_ctl_add(emu->card, snd_ctl_new1(&snd_emu10k1_pcm_efx_voices_mask, emu));
 
 	snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), 64*1024, 64*1024);
 
diff --git a/trunk/sound/pci/ens1370.c b/trunk/sound/pci/ens1370.c
index f06b95f41a1d..78a81f3912a1 100644
--- a/trunk/sound/pci/ens1370.c
+++ b/trunk/sound/pci/ens1370.c
@@ -1444,7 +1444,7 @@ static int snd_es1371_spdif_put(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
 
 /* spdif controls */
 static snd_kcontrol_new_t snd_es1371_mixer_spdif[] __devinitdata = {
-	ES1371_SPDIF(SNDRV_CTL_NAME_IEC958("",PLAYBACK,SWITCH)),
+	ES1371_SPDIF("IEC958 Playback Switch"),
 	{
 		.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
 		.name =		SNDRV_CTL_NAME_IEC958("",PLAYBACK,DEFAULT),
diff --git a/trunk/sound/pci/fm801.c b/trunk/sound/pci/fm801.c
index 36b2f62e8573..ff10e637a95e 100644
--- a/trunk/sound/pci/fm801.c
+++ b/trunk/sound/pci/fm801.c
@@ -1155,10 +1155,10 @@ FM801_SINGLE("FM Playback Switch", FM801_FM_VOL, 15, 1, 1),
 static snd_kcontrol_new_t snd_fm801_controls_multi[] __devinitdata = {
 FM801_SINGLE("AC97 2ch->4ch Copy Switch", FM801_CODEC_CTRL, 7, 1, 0),
 FM801_SINGLE("AC97 18-bit Switch", FM801_CODEC_CTRL, 10, 1, 0),
-FM801_SINGLE(SNDRV_CTL_NAME_IEC958("",CAPTURE,SWITCH), FM801_I2S_MODE, 8, 1, 0),
-FM801_SINGLE(SNDRV_CTL_NAME_IEC958("Raw Data ",PLAYBACK,SWITCH), FM801_I2S_MODE, 9, 1, 0),
-FM801_SINGLE(SNDRV_CTL_NAME_IEC958("Raw Data ",CAPTURE,SWITCH), FM801_I2S_MODE, 10, 1, 0),
-FM801_SINGLE(SNDRV_CTL_NAME_IEC958("",PLAYBACK,SWITCH), FM801_GEN_CTRL, 2, 1, 0),
+FM801_SINGLE("IEC958 Capture Switch", FM801_I2S_MODE, 8, 1, 0),
+FM801_SINGLE("IEC958 Raw Data Playback Switch", FM801_I2S_MODE, 9, 1, 0),
+FM801_SINGLE("IEC958 Raw Data Capture Switch", FM801_I2S_MODE, 10, 1, 0),
+FM801_SINGLE("IEC958 Playback Switch", FM801_GEN_CTRL, 2, 1, 0),
 };
 
 static void snd_fm801_mixer_free_ac97_bus(ac97_bus_t *bus)
diff --git a/trunk/sound/pci/hda/Makefile b/trunk/sound/pci/hda/Makefile
index ddfb5ff7fb8f..bd8cb33c4fb4 100644
--- a/trunk/sound/pci/hda/Makefile
+++ b/trunk/sound/pci/hda/Makefile
@@ -1,5 +1,5 @@
 snd-hda-intel-objs := hda_intel.o
-snd-hda-codec-objs := hda_codec.o hda_generic.o patch_realtek.o patch_cmedia.o patch_analog.o patch_sigmatel.o patch_si3054.o
+snd-hda-codec-objs := hda_codec.o hda_generic.o patch_realtek.o patch_cmedia.o patch_analog.o patch_sigmatel.o
 ifdef CONFIG_PROC_FS
 snd-hda-codec-objs += hda_proc.o
 endif
diff --git a/trunk/sound/pci/hda/hda_codec.c b/trunk/sound/pci/hda/hda_codec.c
index 20f7762f7144..e2cf02387289 100644
--- a/trunk/sound/pci/hda/hda_codec.c
+++ b/trunk/sound/pci/hda/hda_codec.c
@@ -432,26 +432,22 @@ void snd_hda_get_codec_name(struct hda_codec *codec,
 }
 
 /*
- * look for an AFG and MFG nodes
+ * look for an AFG node
+ *
+ * return 0 if not found
  */
-static void setup_fg_nodes(struct hda_codec *codec)
+static int look_for_afg_node(struct hda_codec *codec)
 {
 	int i, total_nodes;
 	hda_nid_t nid;
 
 	total_nodes = snd_hda_get_sub_nodes(codec, AC_NODE_ROOT, &nid);
 	for (i = 0; i < total_nodes; i++, nid++) {
-		switch((snd_hda_param_read(codec, nid, AC_PAR_FUNCTION_TYPE) & 0xff)) {
-		case AC_GRP_AUDIO_FUNCTION:
-			codec->afg = nid;
-			break;
-		case AC_GRP_MODEM_FUNCTION:
-			codec->mfg = nid;
-			break;
-		default:
-			break;
-		}
+		if ((snd_hda_param_read(codec, nid, AC_PAR_FUNCTION_TYPE) & 0xff) ==
+		    AC_GRP_AUDIO_FUNCTION)
+			return nid;
 	}
+	return 0;
 }
 
 /*
@@ -511,9 +507,10 @@ int snd_hda_codec_new(struct hda_bus *bus, unsigned int codec_addr,
 	codec->subsystem_id = snd_hda_param_read(codec, AC_NODE_ROOT, AC_PAR_SUBSYSTEM_ID);
 	codec->revision_id = snd_hda_param_read(codec, AC_NODE_ROOT, AC_PAR_REV_ID);
 
-	setup_fg_nodes(codec);
-	if (! codec->afg && ! codec->mfg) {
-		snd_printdd("hda_codec: no AFG or MFG node found\n");
+	/* FIXME: support for multiple AFGs? */
+	codec->afg = look_for_afg_node(codec);
+	if (! codec->afg) {
+		snd_printdd("hda_codec: no AFG node found\n");
 		snd_hda_codec_free(codec);
 		return -ENODEV;
 	}
@@ -752,14 +749,12 @@ int snd_hda_mixer_amp_volume_put(snd_kcontrol_t *kcontrol, snd_ctl_elem_value_t
 	long *valp = ucontrol->value.integer.value;
 	int change = 0;
 
-	if (chs & 1) {
+	if (chs & 1)
 		change = snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
 						  0x7f, *valp);
-		valp++;
-	}
 	if (chs & 2)
 		change |= snd_hda_codec_amp_update(codec, nid, 1, dir, idx,
-						   0x7f, *valp);
+						   0x7f, valp[1]);
 	return change;
 }
 
@@ -801,15 +796,12 @@ int snd_hda_mixer_amp_switch_put(snd_kcontrol_t *kcontrol, snd_ctl_elem_value_t
 	long *valp = ucontrol->value.integer.value;
 	int change = 0;
 
-	if (chs & 1) {
+	if (chs & 1)
 		change = snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
 						  0x80, *valp ? 0 : 0x80);
-		valp++;
-	}
 	if (chs & 2)
 		change |= snd_hda_codec_amp_update(codec, nid, 1, dir, idx,
-						   0x80, *valp ? 0 : 0x80);
-	
+						   0x80, valp[1] ? 0 : 0x80);
 	return change;
 }
 
@@ -1163,16 +1155,8 @@ int snd_hda_build_controls(struct hda_bus *bus)
 /*
  * stream formats
  */
-struct hda_rate_tbl {
-	unsigned int hz;
-	unsigned int alsa_bits;
-	unsigned int hda_fmt;
-};
-
-static struct hda_rate_tbl rate_bits[] = {
+static unsigned int rate_bits[][3] = {
 	/* rate in Hz, ALSA rate bitmask, HDA format value */
-
-	/* autodetected value used in snd_hda_query_supported_pcm */
 	{ 8000, SNDRV_PCM_RATE_8000, 0x0500 }, /* 1/6 x 48 */
 	{ 11025, SNDRV_PCM_RATE_11025, 0x4300 }, /* 1/4 x 44 */
 	{ 16000, SNDRV_PCM_RATE_16000, 0x0200 }, /* 1/3 x 48 */
@@ -1184,11 +1168,7 @@ static struct hda_rate_tbl rate_bits[] = {
 	{ 96000, SNDRV_PCM_RATE_96000, 0x0800 }, /* 2 x 48 */
 	{ 176400, SNDRV_PCM_RATE_176400, 0x5800 },/* 4 x 44 */
 	{ 192000, SNDRV_PCM_RATE_192000, 0x1800 }, /* 4 x 48 */
-
-	/* not autodetected value */
-	{ 9600, SNDRV_PCM_RATE_KNOT, 0x0400 }, /* 1/5 x 48 */
-
-	{ 0 } /* terminator */
+	{ 0 }
 };
 
 /**
@@ -1210,12 +1190,12 @@ unsigned int snd_hda_calc_stream_format(unsigned int rate,
 	int i;
 	unsigned int val = 0;
 
-	for (i = 0; rate_bits[i].hz; i++)
-		if (rate_bits[i].hz == rate) {
-			val = rate_bits[i].hda_fmt;
+	for (i = 0; rate_bits[i][0]; i++)
+		if (rate_bits[i][0] == rate) {
+			val = rate_bits[i][2];
 			break;
 		}
-	if (! rate_bits[i].hz) {
+	if (! rate_bits[i][0]) {
 		snd_printdd("invalid rate %d\n", rate);
 		return 0;
 	}
@@ -1278,9 +1258,9 @@ int snd_hda_query_supported_pcm(struct hda_codec *codec, hda_nid_t nid,
 
 	if (ratesp) {
 		u32 rates = 0;
-		for (i = 0; rate_bits[i].hz; i++) {
+		for (i = 0; rate_bits[i][0]; i++) {
 			if (val & (1 << i))
-				rates |= rate_bits[i].alsa_bits;
+				rates |= rate_bits[i][1];
 		}
 		*ratesp = rates;
 	}
@@ -1372,13 +1352,13 @@ int snd_hda_is_supported_format(struct hda_codec *codec, hda_nid_t nid,
 	}
 
 	rate = format & 0xff00;
-	for (i = 0; rate_bits[i].hz; i++)
-		if (rate_bits[i].hda_fmt == rate) {
+	for (i = 0; rate_bits[i][0]; i++)
+		if (rate_bits[i][2] == rate) {
 			if (val & (1 << i))
 				break;
 			return 0;
 		}
-	if (! rate_bits[i].hz)
+	if (! rate_bits[i][0])
 		return 0;
 
 	stream = snd_hda_param_read(codec, nid, AC_PAR_STREAM);
@@ -1561,11 +1541,8 @@ int snd_hda_check_board_config(struct hda_codec *codec, const struct hda_board_c
 		for (c = tbl; c->modelname || c->pci_subvendor; c++) {
 			if (c->pci_subvendor == subsystem_vendor &&
 			    (! c->pci_subdevice /* all match */||
-			     (c->pci_subdevice == subsystem_device))) {
-				snd_printdd(KERN_INFO "hda_codec: PCI %x:%x, codec config %d is selected\n",
-					    subsystem_vendor, subsystem_device, c->config);
+			     (c->pci_subdevice == subsystem_device)))
 				return c->config;
-			}
 		}
 	}
 	return -1;
@@ -1826,25 +1803,11 @@ int snd_hda_parse_pin_def_config(struct hda_codec *codec, struct auto_pin_cfg *c
 				cfg->line_out_pins[j] = nid;
 			}
 
-	/* Reorder the surround channels
-	 * ALSA sequence is front/surr/clfe/side
-	 * HDA sequence is:
-	 *    4-ch: front/surr  =>  OK as it is
-	 *    6-ch: front/clfe/surr
-	 *    8-ch: front/clfe/side/surr
-	 */
-	switch (cfg->line_outs) {
-	case 3:
+	/* Swap surround and CLFE: the association order is front/CLFE/surr/back */
+	if (cfg->line_outs >= 3) {
 		nid = cfg->line_out_pins[1];
 		cfg->line_out_pins[1] = cfg->line_out_pins[2];
 		cfg->line_out_pins[2] = nid;
-		break;
-	case 4:
-		nid = cfg->line_out_pins[1];
-		cfg->line_out_pins[1] = cfg->line_out_pins[3];
-		cfg->line_out_pins[3] = cfg->line_out_pins[2];
-		cfg->line_out_pins[2] = nid;
-		break;
 	}
 
 	return 0;
diff --git a/trunk/sound/pci/hda/hda_codec.h b/trunk/sound/pci/hda/hda_codec.h
index 63a29a8a2860..dd0d99d2ad27 100644
--- a/trunk/sound/pci/hda/hda_codec.h
+++ b/trunk/sound/pci/hda/hda_codec.h
@@ -514,7 +514,6 @@ struct hda_codec {
 	struct list_head list;	/* list point */
 
 	hda_nid_t afg;	/* AFG node id */
-	hda_nid_t mfg;	/* MFG node id */
 
 	/* ids */
 	u32 vendor_id;
diff --git a/trunk/sound/pci/hda/hda_generic.c b/trunk/sound/pci/hda/hda_generic.c
index 1229227af5b5..2d046abb5911 100644
--- a/trunk/sound/pci/hda/hda_generic.c
+++ b/trunk/sound/pci/hda/hda_generic.c
@@ -881,11 +881,6 @@ int snd_hda_parse_generic_codec(struct hda_codec *codec)
 	struct hda_gspec *spec;
 	int err;
 
-	if(!codec->afg) {
-		snd_printdd("hda_generic: no generic modem yet\n");
-		return -ENODEV;
-	}
-
 	spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
 	if (spec == NULL) {
 		printk(KERN_ERR "hda_generic: can't allocate spec\n");
diff --git a/trunk/sound/pci/hda/hda_intel.c b/trunk/sound/pci/hda/hda_intel.c
index 15107df1f490..288ab0764830 100644
--- a/trunk/sound/pci/hda/hda_intel.c
+++ b/trunk/sound/pci/hda/hda_intel.c
@@ -71,9 +71,7 @@ MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
 			 "{Intel, ESB2},"
 			 "{ATI, SB450},"
 			 "{VIA, VT8251},"
-			 "{VIA, VT8237A},"
-			 "{SiS, SIS966},"
-			 "{ULI, M5461}}");
+			 "{VIA, VT8237A}}");
 MODULE_DESCRIPTION("Intel HDA driver");
 
 #define SFX	"hda-intel: "
@@ -143,24 +141,9 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
  */
 
 /* max number of SDs */
-/* ICH, ATI and VIA have 4 playback and 4 capture */
-#define ICH6_CAPTURE_INDEX	0
-#define ICH6_NUM_CAPTURE	4
-#define ICH6_PLAYBACK_INDEX	4
-#define ICH6_NUM_PLAYBACK	4
-
-/* ULI has 6 playback and 5 capture */
-#define ULI_CAPTURE_INDEX	0
-#define ULI_NUM_CAPTURE		5
-#define ULI_PLAYBACK_INDEX	5
-#define ULI_NUM_PLAYBACK	6
-
-/* this number is statically defined for simplicity */
-#define MAX_AZX_DEV		16
-
+#define MAX_ICH6_DEV		8
 /* max number of fragments - we may use more if allocating more pages for BDL */
-#define BDL_SIZE		PAGE_ALIGN(8192)
-#define AZX_MAX_FRAG		(BDL_SIZE / (MAX_AZX_DEV * 16))
+#define AZX_MAX_FRAG		(PAGE_SIZE / (MAX_ICH6_DEV * 16))
 /* max buffer size - no h/w limit, you can increase as you like */
 #define AZX_MAX_BUF_SIZE	(1024*1024*1024)
 /* max number of PCM devics per card */
@@ -217,6 +200,7 @@ enum {
 };
 
 /* Defines for ATI HD Audio support in SB450 south bridge */
+#define ATI_SB450_HDAUDIO_PCI_DEVICE_ID     0x437b
 #define ATI_SB450_HDAUDIO_MISC_CNTR2_ADDR   0x42
 #define ATI_SB450_HDAUDIO_ENABLE_SNOOP      0x02
 
@@ -274,14 +258,6 @@ struct snd_azx {
 	snd_card_t *card;
 	struct pci_dev *pci;
 
-	/* chip type specific */
-	int driver_type;
-	int playback_streams;
-	int playback_index_offset;
-	int capture_streams;
-	int capture_index_offset;
-	int num_streams;
-
 	/* pci resources */
 	unsigned long addr;
 	void __iomem *remap_addr;
@@ -291,8 +267,8 @@ struct snd_azx {
 	spinlock_t reg_lock;
 	struct semaphore open_mutex;
 
-	/* streams (x num_streams) */
-	azx_dev_t *azx_dev;
+	/* streams */
+	azx_dev_t azx_dev[MAX_ICH6_DEV];
 
 	/* PCM */
 	unsigned int pcm_devs;
@@ -316,23 +292,6 @@ struct snd_azx {
 	unsigned int initialized: 1;
 };
 
-/* driver types */
-enum {
-	AZX_DRIVER_ICH,
-	AZX_DRIVER_ATI,
-	AZX_DRIVER_VIA,
-	AZX_DRIVER_SIS,
-	AZX_DRIVER_ULI,
-};
-
-static char *driver_short_names[] __devinitdata = {
-	[AZX_DRIVER_ICH] = "HDA Intel",
-	[AZX_DRIVER_ATI] = "HDA ATI SB",
-	[AZX_DRIVER_VIA] = "HDA VIA VT82xx",
-	[AZX_DRIVER_SIS] = "HDA SIS966",
-	[AZX_DRIVER_ULI] = "HDA ULI M5461"
-};
-
 /*
  * macros for easy use
  */
@@ -401,8 +360,6 @@ static void azx_init_cmd_io(azx_t *chip)
 	azx_writel(chip, CORBLBASE, (u32)chip->corb.addr);
 	azx_writel(chip, CORBUBASE, upper_32bit(chip->corb.addr));
 
-	/* set the corb size to 256 entries (ULI requires explicitly) */
-	azx_writeb(chip, CORBSIZE, 0x02);
 	/* set the corb write pointer to 0 */
 	azx_writew(chip, CORBWP, 0);
 	/* reset the corb hw read pointer */
@@ -416,8 +373,6 @@ static void azx_init_cmd_io(azx_t *chip)
 	azx_writel(chip, RIRBLBASE, (u32)chip->rirb.addr);
 	azx_writel(chip, RIRBUBASE, upper_32bit(chip->rirb.addr));
 
-	/* set the rirb size to 256 entries (ULI requires explicitly) */
-	azx_writeb(chip, RIRBSIZE, 0x02);
 	/* reset the rirb hw write pointer */
 	azx_writew(chip, RIRBWP, ICH6_RBRWP_CLR);
 	/* set N=1, get RIRB response interrupt for new entry */
@@ -641,7 +596,7 @@ static void azx_int_disable(azx_t *chip)
 	int i;
 
 	/* disable interrupts in stream descriptor */
-	for (i = 0; i < chip->num_streams; i++) {
+	for (i = 0; i < MAX_ICH6_DEV; i++) {
 		azx_dev_t *azx_dev = &chip->azx_dev[i];
 		azx_sd_writeb(azx_dev, SD_CTL,
 			      azx_sd_readb(azx_dev, SD_CTL) & ~SD_INT_MASK);
@@ -661,7 +616,7 @@ static void azx_int_clear(azx_t *chip)
 	int i;
 
 	/* clear stream status */
-	for (i = 0; i < chip->num_streams; i++) {
+	for (i = 0; i < MAX_ICH6_DEV; i++) {
 		azx_dev_t *azx_dev = &chip->azx_dev[i];
 		azx_sd_writeb(azx_dev, SD_STS, SD_INT_MASK);
 	}
@@ -731,7 +686,8 @@ static void azx_init_chip(azx_t *chip)
 	}
 
 	/* For ATI SB450 azalia HD audio, we need to enable snoop */
-	if (chip->driver_type == AZX_DRIVER_ATI) {
+	if (chip->pci->vendor == PCI_VENDOR_ID_ATI && 
+	    chip->pci->device == ATI_SB450_HDAUDIO_PCI_DEVICE_ID) {
 		pci_read_config_byte(chip->pci, ATI_SB450_HDAUDIO_MISC_CNTR2_ADDR, 
 				     &ati_misc_cntl2);
 		pci_write_config_byte(chip->pci, ATI_SB450_HDAUDIO_MISC_CNTR2_ADDR, 
@@ -758,7 +714,7 @@ static irqreturn_t azx_interrupt(int irq, void* dev_id, struct pt_regs *regs)
 		return IRQ_NONE;
 	}
 	
-	for (i = 0; i < chip->num_streams; i++) {
+	for (i = 0; i < MAX_ICH6_DEV; i++) {
 		azx_dev = &chip->azx_dev[i];
 		if (status & azx_dev->sd_int_sta_mask) {
 			azx_sd_writeb(azx_dev, SD_STS, SD_INT_MASK);
@@ -923,15 +879,9 @@ static int __devinit azx_codec_create(azx_t *chip, const char *model)
 /* assign a stream for the PCM */
 static inline azx_dev_t *azx_assign_device(azx_t *chip, int stream)
 {
-	int dev, i, nums;
-	if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
-		dev = chip->playback_index_offset;
-		nums = chip->playback_streams;
-	} else {
-		dev = chip->capture_index_offset;
-		nums = chip->capture_streams;
-	}
-	for (i = 0; i < nums; i++, dev++)
+	int dev, i;
+	dev = stream == SNDRV_PCM_STREAM_PLAYBACK ? 4 : 0;
+	for (i = 0; i < 4; i++, dev++)
 		if (! chip->azx_dev[dev].opened) {
 			chip->azx_dev[dev].opened = 1;
 			return &chip->azx_dev[dev];
@@ -949,8 +899,8 @@ static snd_pcm_hardware_t azx_pcm_hw = {
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID |
-				 SNDRV_PCM_INFO_PAUSE /*|*/
-				 /*SNDRV_PCM_INFO_RESUME*/),
+				 SNDRV_PCM_INFO_PAUSE |
+				 SNDRV_PCM_INFO_RESUME),
 	.formats =		SNDRV_PCM_FMTBIT_S16_LE,
 	.rates =		SNDRV_PCM_RATE_48000,
 	.rate_min =		48000,
@@ -1099,7 +1049,6 @@ static int azx_pcm_trigger(snd_pcm_substream_t *substream, int cmd)
 		azx_dev->running = 1;
 		break;
 	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-	case SNDRV_PCM_TRIGGER_SUSPEND:
 	case SNDRV_PCM_TRIGGER_STOP:
 		azx_stream_stop(chip, azx_dev);
 		azx_dev->running = 0;
@@ -1109,7 +1058,6 @@ static int azx_pcm_trigger(snd_pcm_substream_t *substream, int cmd)
 	}
 	spin_unlock(&chip->reg_lock);
 	if (cmd == SNDRV_PCM_TRIGGER_PAUSE_PUSH ||
-	    cmd == SNDRV_PCM_TRIGGER_SUSPEND ||
 	    cmd == SNDRV_PCM_TRIGGER_STOP) {
 		int timeout = 5000;
 		while (azx_sd_readb(azx_dev, SD_CTL) & SD_CTL_DMA_START && --timeout)
@@ -1188,7 +1136,6 @@ static int __devinit create_codec_pcm(azx_t *chip, struct hda_codec *codec,
 					      snd_dma_pci_data(chip->pci),
 					      1024 * 64, 1024 * 128);
 	chip->pcm[pcm_dev] = pcm;
-	chip->pcm_devs = pcm_dev + 1;
 
 	return 0;
 }
@@ -1239,7 +1186,7 @@ static int __devinit azx_init_stream(azx_t *chip)
 	/* initialize each stream (aka device)
 	 * assign the starting bdl address to each stream (device) and initialize
 	 */
-	for (i = 0; i < chip->num_streams; i++) {
+	for (i = 0; i < MAX_ICH6_DEV; i++) {
 		unsigned int off = sizeof(u32) * (i * AZX_MAX_FRAG * 4);
 		azx_dev_t *azx_dev = &chip->azx_dev[i];
 		azx_dev->bdl = (u32 *)(chip->bdl.area + off);
@@ -1298,7 +1245,7 @@ static int azx_free(azx_t *chip)
 	if (chip->initialized) {
 		int i;
 
-		for (i = 0; i < chip->num_streams; i++)
+		for (i = 0; i < MAX_ICH6_DEV; i++)
 			azx_stream_stop(chip, &chip->azx_dev[i]);
 
 		/* disable interrupts */
@@ -1314,10 +1261,10 @@ static int azx_free(azx_t *chip)
 
 		/* wait a little for interrupts to finish */
 		msleep(1);
-	}
 
-	if (chip->remap_addr)
 		iounmap(chip->remap_addr);
+	}
+
 	if (chip->irq >= 0)
 		free_irq(chip->irq, (void*)chip);
 
@@ -1329,7 +1276,6 @@ static int azx_free(azx_t *chip)
 		snd_dma_free_pages(&chip->posbuf);
 	pci_release_regions(chip->pci);
 	pci_disable_device(chip->pci);
-	kfree(chip->azx_dev);
 	kfree(chip);
 
 	return 0;
@@ -1344,8 +1290,7 @@ static int azx_dev_free(snd_device_t *device)
  * constructor
  */
 static int __devinit azx_create(snd_card_t *card, struct pci_dev *pci,
-				int posfix, int driver_type,
-				azx_t **rchip)
+				int posfix, azx_t **rchip)
 {
 	azx_t *chip;
 	int err = 0;
@@ -1371,20 +1316,9 @@ static int __devinit azx_create(snd_card_t *card, struct pci_dev *pci,
 	chip->card = card;
 	chip->pci = pci;
 	chip->irq = -1;
-	chip->driver_type = driver_type;
 
 	chip->position_fix = posfix;
 
-#if BITS_PER_LONG != 64
-	/* Fix up base address on ULI M5461 */
-	if (chip->driver_type == AZX_DRIVER_ULI) {
-		u16 tmp3;
-		pci_read_config_word(pci, 0x40, &tmp3);
-		pci_write_config_word(pci, 0x40, tmp3 | 0x10);
-		pci_write_config_dword(pci, PCI_BASE_ADDRESS_1, 0);
-	}
-#endif
-
 	if ((err = pci_request_regions(pci, "ICH HD audio")) < 0) {
 		kfree(chip);
 		pci_disable_device(pci);
@@ -1410,37 +1344,16 @@ static int __devinit azx_create(snd_card_t *card, struct pci_dev *pci,
 	pci_set_master(pci);
 	synchronize_irq(chip->irq);
 
-	switch (chip->driver_type) {
-	case AZX_DRIVER_ULI:
-		chip->playback_streams = ULI_NUM_PLAYBACK;
-		chip->capture_streams = ULI_NUM_CAPTURE;
-		chip->playback_index_offset = ULI_PLAYBACK_INDEX;
-		chip->capture_index_offset = ULI_CAPTURE_INDEX;
-		break;
-	default:
-		chip->playback_streams = ICH6_NUM_PLAYBACK;
-		chip->capture_streams = ICH6_NUM_CAPTURE;
-		chip->playback_index_offset = ICH6_PLAYBACK_INDEX;
-		chip->capture_index_offset = ICH6_CAPTURE_INDEX;
-		break;
-	}
-	chip->num_streams = chip->playback_streams + chip->capture_streams;
-	chip->azx_dev = kcalloc(chip->num_streams, sizeof(*chip->azx_dev), GFP_KERNEL);
-	if (! chip->azx_dev) {
-		snd_printk(KERN_ERR "cannot malloc azx_dev\n");
-		goto errout;
-	}
-
 	/* allocate memory for the BDL for each stream */
 	if ((err = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(chip->pci),
-				       BDL_SIZE, &chip->bdl)) < 0) {
+				       PAGE_SIZE, &chip->bdl)) < 0) {
 		snd_printk(KERN_ERR SFX "cannot allocate BDL\n");
 		goto errout;
 	}
 	if (chip->position_fix == POS_FIX_POSBUF) {
 		/* allocate memory for the position buffer */
 		if ((err = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(chip->pci),
-					       chip->num_streams * 8, &chip->posbuf)) < 0) {
+					       MAX_ICH6_DEV * 8, &chip->posbuf)) < 0) {
 			snd_printk(KERN_ERR SFX "cannot allocate posbuf\n");
 			goto errout;
 		}
@@ -1469,10 +1382,6 @@ static int __devinit azx_create(snd_card_t *card, struct pci_dev *pci,
 		goto errout;
 	}
 
-	strcpy(card->driver, "HDA-Intel");
-	strcpy(card->shortname, driver_short_names[chip->driver_type]);
-	sprintf(card->longname, "%s at 0x%lx irq %i", card->shortname, chip->addr, chip->irq);
-
 	*rchip = chip;
 	return 0;
 
@@ -1501,12 +1410,15 @@ static int __devinit azx_probe(struct pci_dev *pci, const struct pci_device_id *
 		return -ENOMEM;
 	}
 
-	if ((err = azx_create(card, pci, position_fix[dev], pci_id->driver_data,
-			      &chip)) < 0) {
+	if ((err = azx_create(card, pci, position_fix[dev], &chip)) < 0) {
 		snd_card_free(card);
 		return err;
 	}
 
+	strcpy(card->driver, "HDA-Intel");
+	strcpy(card->shortname, "HDA Intel");
+	sprintf(card->longname, "%s at 0x%lx irq %i", card->shortname, chip->addr, chip->irq);
+
 	/* create codec instances */
 	if ((err = azx_codec_create(chip, model[dev])) < 0) {
 		snd_card_free(card);
@@ -1547,13 +1459,12 @@ static void __devexit azx_remove(struct pci_dev *pci)
 
 /* PCI IDs */
 static struct pci_device_id azx_ids[] = {
-	{ 0x8086, 0x2668, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH6 */
-	{ 0x8086, 0x27d8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH7 */
-	{ 0x8086, 0x269a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ESB2 */
-	{ 0x1002, 0x437b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATI }, /* ATI SB450 */
-	{ 0x1106, 0x3288, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_VIA }, /* VIA VT8251/VT8237A */
-	{ 0x1039, 0x7502, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_SIS }, /* SIS966 */
-	{ 0x10b9, 0x5461, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ULI }, /* ULI M5461 */
+	{ 0x8086, 0x2668, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 }, /* ICH6 */
+	{ 0x8086, 0x27d8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 }, /* ICH7 */
+	{ 0x8086, 0x269a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 }, /* ESB2 */
+	{ 0x1002, 0x437b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 }, /* ATI SB450 */
+	{ 0x1106, 0x3288, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 }, /* VIA VT8251/VT8237A */
+	{ 0x10b9, 0x5461, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 }, /* ALI 5461? */
 	{ 0, }
 };
 MODULE_DEVICE_TABLE(pci, azx_ids);
diff --git a/trunk/sound/pci/hda/hda_patch.h b/trunk/sound/pci/hda/hda_patch.h
index acaef3c811b8..a5de684b6944 100644
--- a/trunk/sound/pci/hda/hda_patch.h
+++ b/trunk/sound/pci/hda/hda_patch.h
@@ -10,14 +10,11 @@ extern struct hda_codec_preset snd_hda_preset_cmedia[];
 extern struct hda_codec_preset snd_hda_preset_analog[];
 /* SigmaTel codecs */
 extern struct hda_codec_preset snd_hda_preset_sigmatel[];
-/* SiLabs 3054/3055 modem codecs */
-extern struct hda_codec_preset snd_hda_preset_si3054[];
 
 static const struct hda_codec_preset *hda_preset_tables[] = {
 	snd_hda_preset_realtek,
 	snd_hda_preset_cmedia,
 	snd_hda_preset_analog,
 	snd_hda_preset_sigmatel,
-	snd_hda_preset_si3054,
 	NULL
 };
diff --git a/trunk/sound/pci/hda/patch_analog.c b/trunk/sound/pci/hda/patch_analog.c
index bceb83a42a38..2fd05bb84136 100644
--- a/trunk/sound/pci/hda/patch_analog.c
+++ b/trunk/sound/pci/hda/patch_analog.c
@@ -572,7 +572,7 @@ static snd_kcontrol_new_t ad1983_mixers[] = {
 	},
 	{
 		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-		.name = SNDRV_CTL_NAME_IEC958("",PLAYBACK,NONE) "Route",
+		.name = "IEC958 Playback Route",
 		.info = ad1983_spdif_route_info,
 		.get = ad1983_spdif_route_get,
 		.put = ad1983_spdif_route_put,
@@ -705,7 +705,7 @@ static snd_kcontrol_new_t ad1981_mixers[] = {
 	/* identical with AD1983 */
 	{
 		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-		.name = SNDRV_CTL_NAME_IEC958("",PLAYBACK,NONE) "Route",
+		.name = "IEC958 Playback Route",
 		.info = ad1983_spdif_route_info,
 		.get = ad1983_spdif_route_get,
 		.put = ad1983_spdif_route_put,
diff --git a/trunk/sound/pci/hda/patch_cmedia.c b/trunk/sound/pci/hda/patch_cmedia.c
index 07fb4f5a54b3..86f195f19eef 100644
--- a/trunk/sound/pci/hda/patch_cmedia.c
+++ b/trunk/sound/pci/hda/patch_cmedia.c
@@ -647,7 +647,6 @@ static struct hda_board_config cmi9880_cfg_tbl[] = {
 	{ .modelname = "min_fp", .config = CMI_MIN_FP },
 	{ .modelname = "full", .config = CMI_FULL },
 	{ .modelname = "full_dig", .config = CMI_FULL_DIG },
-	{ .pci_subvendor = 0x1043, .pci_subdevice = 0x813d, .config = CMI_FULL_DIG }, /* ASUS P5AD2 */
 	{ .modelname = "allout", .config = CMI_ALLOUT },
 	{ .modelname = "auto", .config = CMI_AUTO },
 	{} /* terminator */
diff --git a/trunk/sound/pci/hda/patch_realtek.c b/trunk/sound/pci/hda/patch_realtek.c
index eeb900ab79af..9b8569900787 100644
--- a/trunk/sound/pci/hda/patch_realtek.c
+++ b/trunk/sound/pci/hda/patch_realtek.c
@@ -687,12 +687,6 @@ static snd_kcontrol_new_t alc880_asus_w1v_mixer[] = {
 	{ } /* end */
 };
 
-/* additional mixers to alc880_asus_mixer */
-static snd_kcontrol_new_t alc880_pcbeep_mixer[] = {
-	HDA_CODEC_VOLUME("PC Speaker Playback Volume", 0x0b, 0x05, HDA_INPUT),
-	HDA_CODEC_MUTE("PC Speaker Playback Switch", 0x0b, 0x05, HDA_INPUT),
-	{ } /* end */
-};
 
 /*
  * build control elements
@@ -1530,7 +1524,6 @@ static struct hda_board_config alc880_cfg_tbl[] = {
 	/* Back 3 jack plus 1 SPDIF out jack, front 2 jack */
 	{ .modelname = "3stack-digout", .config = ALC880_3ST_DIG },
 	{ .pci_subvendor = 0x8086, .pci_subdevice = 0xe308, .config = ALC880_3ST_DIG },
-	{ .pci_subvendor = 0x1025, .pci_subdevice = 0x0070, .config = ALC880_3ST_DIG },
 
 	/* Back 3 jack plus 1 SPDIF out jack, front 2 jack (Internal add Aux-In)*/
 	{ .pci_subvendor = 0x8086, .pci_subdevice = 0xe305, .config = ALC880_3ST_DIG },
@@ -1741,7 +1734,7 @@ static struct alc_config_preset alc880_presets[] = {
 		.input_mux = &alc880_capture_source,
 	},
 	[ALC880_UNIWILL_DIG] = {
-		.mixers = { alc880_asus_mixer, alc880_pcbeep_mixer },
+		.mixers = { alc880_asus_mixer },
 		.init_verbs = { alc880_volume_init_verbs, alc880_pin_asus_init_verbs },
 		.num_dacs = ARRAY_SIZE(alc880_asus_dac_nids),
 		.dac_nids = alc880_asus_dac_nids,
diff --git a/trunk/sound/pci/hda/patch_si3054.c b/trunk/sound/pci/hda/patch_si3054.c
deleted file mode 100644
index b0270d1b64ce..000000000000
--- a/trunk/sound/pci/hda/patch_si3054.c
+++ /dev/null
@@ -1,300 +0,0 @@
-/*
- * Universal Interface for Intel High Definition Audio Codec
- *
- * HD audio interface patch for Silicon Labs 3054/5 modem codec
- *
- * Copyright (c) 2005 Sasha Khapyorsky <sashak@smlink.com>
- *                    Takashi Iwai <tiwai@suse.de>
- *
- *
- *  This driver is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This driver is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
- */
-
-#include <sound/driver.h>
-#include <linux/init.h>
-#include <linux/delay.h>
-#include <linux/slab.h>
-#include <linux/pci.h>
-#include <sound/core.h>
-#include "hda_codec.h"
-#include "hda_local.h"
-
-
-/* si3054 verbs */
-#define SI3054_VERB_READ_NODE  0x900
-#define SI3054_VERB_WRITE_NODE 0x100
-
-/* si3054 nodes (registers) */
-#define SI3054_EXTENDED_MID    2
-#define SI3054_LINE_RATE       3
-#define SI3054_LINE_LEVEL      4
-#define SI3054_GPIO_CFG        5
-#define SI3054_GPIO_POLARITY   6
-#define SI3054_GPIO_STICKY     7
-#define SI3054_GPIO_WAKEUP     8
-#define SI3054_GPIO_STATUS     9
-#define SI3054_GPIO_CONTROL   10
-#define SI3054_MISC_AFE       11
-#define SI3054_CHIPID         12
-#define SI3054_LINE_CFG1      13
-#define SI3054_LINE_STATUS    14
-#define SI3054_DC_TERMINATION 15
-#define SI3054_LINE_CONFIG    16
-#define SI3054_CALLPROG_ATT   17
-#define SI3054_SQ_CONTROL     18
-#define SI3054_MISC_CONTROL   19
-#define SI3054_RING_CTRL1     20
-#define SI3054_RING_CTRL2     21
-
-/* extended MID */
-#define SI3054_MEI_READY 0xf
-
-/* line level */
-#define SI3054_ATAG_MASK 0x00f0
-#define SI3054_DTAG_MASK 0xf000
-
-/* GPIO bits */
-#define SI3054_GPIO_OH    0x0001
-#define SI3054_GPIO_CID   0x0002
-
-/* chipid and revisions */
-#define SI3054_CHIPID_CODEC_REV_MASK 0x000f
-#define SI3054_CHIPID_DAA_REV_MASK   0x00f0
-#define SI3054_CHIPID_INTERNATIONAL  0x0100
-#define SI3054_CHIPID_DAA_ID         0x0f00
-#define SI3054_CHIPID_CODEC_ID      (1<<12)
-
-/* si3054 codec registers (nodes) access macros */
-#define GET_REG(codec,reg) (snd_hda_codec_read(codec,reg,0,SI3054_VERB_READ_NODE,0))
-#define SET_REG(codec,reg,val) (snd_hda_codec_write(codec,reg,0,SI3054_VERB_WRITE_NODE,val))
-
-
-struct si3054_spec {
-	unsigned international;
-	struct hda_pcm pcm;
-};
-
-
-/*
- * Modem mixer
- */
-
-#define PRIVATE_VALUE(reg,mask) ((reg<<16)|(mask&0xffff))
-#define PRIVATE_REG(val) ((val>>16)&0xffff)
-#define PRIVATE_MASK(val) (val&0xffff)
-
-static int si3054_switch_info(snd_kcontrol_t *kcontrol,
-		               snd_ctl_elem_info_t *uinfo)
-{
-	uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
-	uinfo->count = 1;
-	uinfo->value.integer.min = 0;
-	uinfo->value.integer.max = 1;
-	return 0;
-}
-
-static int si3054_switch_get(snd_kcontrol_t *kcontrol,
-		               snd_ctl_elem_value_t *uvalue)
-{
-	struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
-	u16 reg  = PRIVATE_REG(kcontrol->private_value);
-	u16 mask = PRIVATE_MASK(kcontrol->private_value);
-	uvalue->value.integer.value[0] = (GET_REG(codec, reg)) & mask ? 1 : 0 ;
-	return 0;
-}
-
-static int si3054_switch_put(snd_kcontrol_t *kcontrol,
-		               snd_ctl_elem_value_t *uvalue)
-{
-	struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
-	u16 reg  = PRIVATE_REG(kcontrol->private_value);
-	u16 mask = PRIVATE_MASK(kcontrol->private_value);
-	if (uvalue->value.integer.value[0])
-		SET_REG(codec, reg, (GET_REG(codec, reg)) | mask);
-	else
-		SET_REG(codec, reg, (GET_REG(codec, reg)) & ~mask);
-	return 0;
-}
-
-#define SI3054_KCONTROL(kname,reg,mask) { \
-	.iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
-	.name = kname, \
-	.info = si3054_switch_info, \
-	.get  = si3054_switch_get, \
-	.put  = si3054_switch_put, \
-	.private_value = PRIVATE_VALUE(reg,mask), \
-}
-		
-
-static snd_kcontrol_new_t si3054_modem_mixer[] = {
-	SI3054_KCONTROL("Off-hook Switch", SI3054_GPIO_CONTROL, SI3054_GPIO_OH),
-	SI3054_KCONTROL("Caller ID Switch", SI3054_GPIO_CONTROL, SI3054_GPIO_CID),
-	{}
-};
-
-static int si3054_build_controls(struct hda_codec *codec)
-{
-	return snd_hda_add_new_ctls(codec, si3054_modem_mixer);
-}
-
-
-/*
- * PCM callbacks
- */
-
-static int si3054_pcm_prepare(struct hda_pcm_stream *hinfo,
-			      struct hda_codec *codec,
-			      unsigned int stream_tag,
-			      unsigned int format,
-			      snd_pcm_substream_t *substream)
-{
-	u16 val;
-
-	SET_REG(codec, SI3054_LINE_RATE, substream->runtime->rate);
-	val = GET_REG(codec, SI3054_LINE_LEVEL);
-	val &= 0xff << (8 * (substream->stream != SNDRV_PCM_STREAM_PLAYBACK));
-	val |= ((stream_tag & 0xf) << 4) << (8 * (substream->stream == SNDRV_PCM_STREAM_PLAYBACK));
-	SET_REG(codec, SI3054_LINE_LEVEL, val);
-
-	snd_hda_codec_setup_stream(codec, hinfo->nid,
-				   stream_tag, 0, format);
-	return 0;
-}
-
-static int si3054_pcm_open(struct hda_pcm_stream *hinfo,
-			   struct hda_codec *codec,
-			    snd_pcm_substream_t *substream)
-{
-	static unsigned int rates[] = { 8000, 9600, 16000 };
-	static snd_pcm_hw_constraint_list_t hw_constraints_rates = {
-		.count = ARRAY_SIZE(rates),
-		.list = rates,
-		.mask = 0,
-	};
-	substream->runtime->hw.period_bytes_min = 80;
-	return snd_pcm_hw_constraint_list(substream->runtime, 0,
-			SNDRV_PCM_HW_PARAM_RATE, &hw_constraints_rates);
-}
-
-
-static struct hda_pcm_stream si3054_pcm = {
-	.substreams = 1,
-	.channels_min = 1,
-	.channels_max = 1,
-	.nid = 0x1,
-	.rates = SNDRV_PCM_RATE_8000|SNDRV_PCM_RATE_16000|SNDRV_PCM_RATE_KNOT,
-	.formats = SNDRV_PCM_FMTBIT_S16_LE,
-	.maxbps = 16,
-	.ops = {
-		.open = si3054_pcm_open,
-		.prepare = si3054_pcm_prepare,
-	},
-};
-
-
-static int si3054_build_pcms(struct hda_codec *codec)
-{
-	struct si3054_spec *spec = codec->spec;
-	struct hda_pcm *info = &spec->pcm;
-	si3054_pcm.nid = codec->mfg;
-	codec->num_pcms = 1;
-	codec->pcm_info = info;
-	info->name = "Si3054 Modem";
-	info->stream[SNDRV_PCM_STREAM_PLAYBACK] = si3054_pcm;
-	info->stream[SNDRV_PCM_STREAM_CAPTURE]  = si3054_pcm;
-	return 0;
-}
-
-
-/*
- * Init part
- */
-
-static int si3054_init(struct hda_codec *codec)
-{
-	struct si3054_spec *spec = codec->spec;
-	unsigned wait_count;
-	u16 val;
-
-	snd_hda_codec_write(codec, AC_NODE_ROOT, 0, AC_VERB_SET_CODEC_RESET, 0);
-	snd_hda_codec_write(codec, codec->mfg, 0, AC_VERB_SET_STREAM_FORMAT, 0);
-	SET_REG(codec, SI3054_LINE_RATE, 9600);
-	SET_REG(codec, SI3054_LINE_LEVEL, SI3054_DTAG_MASK|SI3054_ATAG_MASK);
-	SET_REG(codec, SI3054_EXTENDED_MID, 0);
-
-	wait_count = 10;
-	do {
-		msleep(2);
-		val = GET_REG(codec, SI3054_EXTENDED_MID);
-	} while ((val & SI3054_MEI_READY) != SI3054_MEI_READY && wait_count--);
-
-	if((val&SI3054_MEI_READY) != SI3054_MEI_READY) {
-		snd_printk(KERN_ERR "si3054: cannot initialize. EXT MID = %04x\n", val);
-		return -EACCES;
-	}
-
-	SET_REG(codec, SI3054_GPIO_POLARITY, 0xffff);
-	SET_REG(codec, SI3054_GPIO_CFG, 0x0);
-	SET_REG(codec, SI3054_MISC_AFE, 0);
-	SET_REG(codec, SI3054_LINE_CFG1,0x200);
-
-	if((GET_REG(codec,SI3054_LINE_STATUS) & (1<<6)) == 0) {
-		snd_printd("Link Frame Detect(FDT) is not ready (line status: %04x)\n",
-				GET_REG(codec,SI3054_LINE_STATUS));
-	}
-
-	spec->international = GET_REG(codec, SI3054_CHIPID) & SI3054_CHIPID_INTERNATIONAL;
-
-	return 0;
-}
-
-static void si3054_free(struct hda_codec *codec)
-{
-	kfree(codec->spec);
-}
-
-
-/*
- */
-
-static struct hda_codec_ops si3054_patch_ops = {
-	.build_controls = si3054_build_controls,
-	.build_pcms = si3054_build_pcms,
-	.init = si3054_init,
-	.free = si3054_free,
-#ifdef CONFIG_PM
-	//.suspend = si3054_suspend,
-	.resume = si3054_init,
-#endif
-};
-
-static int patch_si3054(struct hda_codec *codec)
-{
-	struct si3054_spec *spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
-	if (spec == NULL)
-		return -ENOMEM;
-	codec->spec = spec;
-	codec->patch_ops = si3054_patch_ops;
-	return 0;
-}
-
-/*
- * patch entries
- */
-struct hda_codec_preset snd_hda_preset_si3054[] = {
- 	{ .id = 0x163c3155, .name = "Si3054", .patch = patch_si3054 },
-	{}
-};
-
diff --git a/trunk/sound/pci/ice1712/delta.c b/trunk/sound/pci/ice1712/delta.c
index 39fbe662965d..eb20f73be61a 100644
--- a/trunk/sound/pci/ice1712/delta.c
+++ b/trunk/sound/pci/ice1712/delta.c
@@ -618,15 +618,15 @@ static int __devinit snd_ice1712_delta_init(ice1712_t *ice)
  */
 
 static snd_kcontrol_new_t snd_ice1712_delta1010_wordclock_select __devinitdata =
-ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_MIXER, "Word Clock Sync", 0, ICE1712_DELTA_WORD_CLOCK_SELECT, 1, 0);
+ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_PCM, "Word Clock Sync", 0, ICE1712_DELTA_WORD_CLOCK_SELECT, 1, 0);
 static snd_kcontrol_new_t snd_ice1712_delta1010lt_wordclock_select __devinitdata =
-ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_MIXER, "Word Clock Sync", 0, ICE1712_DELTA_1010LT_WORDCLOCK, 1, 0);
+ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_PCM, "Word Clock Sync", 0, ICE1712_DELTA_1010LT_WORDCLOCK, 1, 0);
 static snd_kcontrol_new_t snd_ice1712_delta1010_wordclock_status __devinitdata =
-ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_MIXER, "Word Clock Status", 0, ICE1712_DELTA_WORD_CLOCK_STATUS, 1, SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE);
+ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_PCM, "Word Clock Status", 0, ICE1712_DELTA_WORD_CLOCK_STATUS, 1, SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE);
 static snd_kcontrol_new_t snd_ice1712_deltadio2496_spdif_in_select __devinitdata =
-ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_MIXER, "IEC958 Input Optical", 0, ICE1712_DELTA_SPDIF_INPUT_SELECT, 0, 0);
+ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_PCM, "IEC958 Input Optical", 0, ICE1712_DELTA_SPDIF_INPUT_SELECT, 0, 0);
 static snd_kcontrol_new_t snd_ice1712_delta_spdif_in_status __devinitdata =
-ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_MIXER, "Delta IEC958 Input Status", 0, ICE1712_DELTA_SPDIF_IN_STAT, 1, SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE);
+ICE1712_GPIO(SNDRV_CTL_ELEM_IFACE_PCM, "Delta IEC958 Input Status", 0, ICE1712_DELTA_SPDIF_IN_STAT, 1, SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE);
 
 
 static int __devinit snd_ice1712_delta_add_controls(ice1712_t *ice)
diff --git a/trunk/sound/pci/ice1712/ice1712.c b/trunk/sound/pci/ice1712/ice1712.c
index b97f50d10ba3..a2545a5b26c4 100644
--- a/trunk/sound/pci/ice1712/ice1712.c
+++ b/trunk/sound/pci/ice1712/ice1712.c
@@ -1422,7 +1422,7 @@ static snd_kcontrol_new_t snd_ice1712_multi_capture_analog_switch __devinitdata
 
 static snd_kcontrol_new_t snd_ice1712_multi_capture_spdif_switch __devinitdata = {
 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-	.name = SNDRV_CTL_NAME_IEC958("Multi ",CAPTURE,SWITCH),
+	.name = "IEC958 Multi Capture Switch",
 	.info = snd_ice1712_pro_mixer_switch_info,
 	.get = snd_ice1712_pro_mixer_switch_get,
 	.put = snd_ice1712_pro_mixer_switch_put,
@@ -1441,7 +1441,7 @@ static snd_kcontrol_new_t snd_ice1712_multi_capture_analog_volume __devinitdata
 
 static snd_kcontrol_new_t snd_ice1712_multi_capture_spdif_volume __devinitdata = {
 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-	.name = SNDRV_CTL_NAME_IEC958("Multi ",CAPTURE,VOLUME),
+	.name = "IEC958 Multi Capture Volume",
 	.info = snd_ice1712_pro_mixer_volume_info,
 	.get = snd_ice1712_pro_mixer_volume_get,
 	.put = snd_ice1712_pro_mixer_volume_put,
@@ -1715,7 +1715,7 @@ static int snd_ice1712_spdif_maskp_get(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_ice1712_spdif_maskc __devinitdata =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,CON_MASK),
 	.info =		snd_ice1712_spdif_info,
 	.get =		snd_ice1712_spdif_maskc_get,
@@ -1724,7 +1724,7 @@ static snd_kcontrol_new_t snd_ice1712_spdif_maskc __devinitdata =
 static snd_kcontrol_new_t snd_ice1712_spdif_maskp __devinitdata =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,PRO_MASK),
 	.info =		snd_ice1712_spdif_info,
 	.get =		snd_ice1712_spdif_maskp_get,
@@ -2203,7 +2203,7 @@ static snd_kcontrol_new_t snd_ice1712_mixer_pro_analog_route __devinitdata = {
 
 static snd_kcontrol_new_t snd_ice1712_mixer_pro_spdif_route __devinitdata = {
 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-	.name = SNDRV_CTL_NAME_IEC958("",PLAYBACK,NONE) "Route",
+	.name = "IEC958 Playback Route",
 	.info = snd_ice1712_pro_route_info,
 	.get = snd_ice1712_pro_route_spdif_get,
 	.put = snd_ice1712_pro_route_spdif_put,
diff --git a/trunk/sound/pci/ice1712/ice1724.c b/trunk/sound/pci/ice1712/ice1724.c
index c7af5e5fee13..79b5f12e06fc 100644
--- a/trunk/sound/pci/ice1712/ice1724.c
+++ b/trunk/sound/pci/ice1712/ice1724.c
@@ -1414,7 +1414,7 @@ static int snd_vt1724_spdif_maskp_get(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_vt1724_spdif_maskc __devinitdata =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,CON_MASK),
 	.info =		snd_vt1724_spdif_info,
 	.get =		snd_vt1724_spdif_maskc_get,
@@ -1423,7 +1423,7 @@ static snd_kcontrol_new_t snd_vt1724_spdif_maskc __devinitdata =
 static snd_kcontrol_new_t snd_vt1724_spdif_maskp __devinitdata =
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,PRO_MASK),
 	.info =		snd_vt1724_spdif_info,
 	.get =		snd_vt1724_spdif_maskp_get,
@@ -1466,7 +1466,7 @@ static snd_kcontrol_new_t snd_vt1724_spdif_switch __devinitdata =
 	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	/* FIXME: the following conflict with IEC958 Playback Route */
 	// .name =         SNDRV_CTL_NAME_IEC958("",PLAYBACK,SWITCH),
-	.name =         SNDRV_CTL_NAME_IEC958("Output ",NONE,SWITCH),
+	.name =         "IEC958 Output Switch",
 	.info =		snd_vt1724_spdif_sw_info,
 	.get =		snd_vt1724_spdif_sw_get,
 	.put =		snd_vt1724_spdif_sw_put
diff --git a/trunk/sound/pci/intel8x0.c b/trunk/sound/pci/intel8x0.c
index 7b548416dcef..d7af3e474432 100644
--- a/trunk/sound/pci/intel8x0.c
+++ b/trunk/sound/pci/intel8x0.c
@@ -389,7 +389,6 @@ typedef struct {
 	struct ac97_pcm *pcm;
 	int pcm_open_flag;
 	unsigned int page_attr_changed: 1;
-	unsigned int suspended: 1;
 } ichdev_t;
 
 typedef struct _snd_intel8x0 intel8x0_t;
@@ -863,16 +862,12 @@ static int snd_intel8x0_pcm_trigger(snd_pcm_substream_t *substream, int cmd)
 	unsigned long port = ichdev->reg_offset;
 
 	switch (cmd) {
-	case SNDRV_PCM_TRIGGER_RESUME:
-		ichdev->suspended = 0;
-		/* fallthru */
 	case SNDRV_PCM_TRIGGER_START:
+	case SNDRV_PCM_TRIGGER_RESUME:
 		val = ICH_IOCE | ICH_STARTBM;
 		break;
-	case SNDRV_PCM_TRIGGER_SUSPEND:
-		ichdev->suspended = 1;
-		/* fallthru */
 	case SNDRV_PCM_TRIGGER_STOP:
+	case SNDRV_PCM_TRIGGER_SUSPEND:
 		val = 0;
 		break;
 	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
@@ -904,11 +899,9 @@ static int snd_intel8x0_ali_trigger(snd_pcm_substream_t *substream, int cmd)
 
 	val = igetdword(chip, ICHREG(ALI_DMACR));
 	switch (cmd) {
-	case SNDRV_PCM_TRIGGER_RESUME:
-		ichdev->suspended = 0;
-		/* fallthru */
 	case SNDRV_PCM_TRIGGER_START:
 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+	case SNDRV_PCM_TRIGGER_RESUME:
 		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
 			/* clear FIFO for synchronization of channels */
 			fifo = igetdword(chip, fiforeg[ichdev->ali_slot / 4]);
@@ -920,11 +913,9 @@ static int snd_intel8x0_ali_trigger(snd_pcm_substream_t *substream, int cmd)
 		val &= ~(1 << (ichdev->ali_slot + 16)); /* clear PAUSE flag */
 		iputdword(chip, ICHREG(ALI_DMACR), val | (1 << ichdev->ali_slot)); /* start DMA */
 		break;
-	case SNDRV_PCM_TRIGGER_SUSPEND:
-		ichdev->suspended = 1;
-		/* fallthru */
 	case SNDRV_PCM_TRIGGER_STOP:
 	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+	case SNDRV_PCM_TRIGGER_SUSPEND:
 		iputdword(chip, ICHREG(ALI_DMACR), val | (1 << (ichdev->ali_slot + 16))); /* pause */
 		iputbyte(chip, port + ICH_REG_OFF_CR, 0);
 		while (igetbyte(chip, port + ICH_REG_OFF_CR))
@@ -1003,8 +994,6 @@ static void snd_intel8x0_setup_pcm_out(intel8x0_t *chip,
 {
 	unsigned int cnt;
 	int dbl = runtime->rate > 48000;
-
-	spin_lock_irq(&chip->reg_lock);
 	switch (chip->device_type) {
 	case DEVICE_ALI:
 		cnt = igetdword(chip, ICHREG(ALI_SCR));
@@ -1048,7 +1037,6 @@ static void snd_intel8x0_setup_pcm_out(intel8x0_t *chip,
 		iputdword(chip, ICHREG(GLOB_CNT), cnt);
 		break;
 	}
-	spin_unlock_irq(&chip->reg_lock);
 }
 
 static int snd_intel8x0_pcm_prepare(snd_pcm_substream_t * substream)
@@ -1060,12 +1048,15 @@ static int snd_intel8x0_pcm_prepare(snd_pcm_substream_t * substream)
 	ichdev->physbuf = runtime->dma_addr;
 	ichdev->size = snd_pcm_lib_buffer_bytes(substream);
 	ichdev->fragsize = snd_pcm_lib_period_bytes(substream);
+	spin_lock_irq(&chip->reg_lock);
 	if (ichdev->ichd == ICHD_PCMOUT) {
 		snd_intel8x0_setup_pcm_out(chip, runtime);
-		if (chip->device_type == DEVICE_INTEL_ICH4)
+		if (chip->device_type == DEVICE_INTEL_ICH4) {
 			ichdev->pos_shift = (runtime->sample_bits > 16) ? 2 : 1;
+		}
 	}
 	snd_intel8x0_setup_periods(chip, ichdev);
+	spin_unlock_irq(&chip->reg_lock);
 	return 0;
 }
 
@@ -1824,18 +1815,6 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
 		.name = "HP nc6000",
 		.type = AC97_TUNE_MUTE_LED
 	},
-	{
-		.subvendor = 0x103c,
-		.subdevice = 0x0934,
-		.name = "HP nx8220",
-		.type = AC97_TUNE_MUTE_LED
-	},
-	{
-		.subvendor = 0x103c,
-		.subdevice = 0x099c,
-		.name = "HP nx6110",	/* AD1981B */
-		.type = AC97_TUNE_HP_ONLY
-	},
 	{
 		.subvendor = 0x103c,
 		.subdevice = 0x129d,
@@ -1890,12 +1869,6 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
 		.name = "Fujitsu S6210",	/* STAC9750/51 */
 		.type = AC97_TUNE_HP_ONLY
 	},
-	{
-		.subvendor = 0x10cf,
-		.subdevice = 0x12ec,
-		.name = "Fujitsu-Siemens 4010",
-		.type = AC97_TUNE_HP_ONLY
-	},
 	{
 		.subvendor = 0x10f1,
 		.subdevice = 0x2665,
@@ -2451,20 +2424,6 @@ static int intel8x0_resume(snd_card_t *card)
 		}
 	}
 
-	/* resume status */
-	for (i = 0; i < chip->bdbars_count; i++) {
-		ichdev_t *ichdev = &chip->ichd[i];
-		unsigned long port = ichdev->reg_offset;
-		if (! ichdev->substream || ! ichdev->suspended)
-			continue;
-		if (ichdev->ichd == ICHD_PCMOUT)
-			snd_intel8x0_setup_pcm_out(chip, ichdev->substream->runtime);
-		iputdword(chip, port + ICH_REG_OFF_BDBAR, ichdev->bdbar_addr);
-		iputbyte(chip, port + ICH_REG_OFF_LVI, ichdev->lvi);
-		iputbyte(chip, port + ICH_REG_OFF_CIV, ichdev->civ);
-		iputbyte(chip, port + ichdev->roff_sr, ICH_FIFOE | ICH_BCIS | ICH_LVBCI);
-	}
-
 	return 0;
 }
 #endif /* CONFIG_PM */
diff --git a/trunk/sound/pci/korg1212/korg1212.c b/trunk/sound/pci/korg1212/korg1212.c
index d2aa9c82d41e..79d8eda54f0d 100644
--- a/trunk/sound/pci/korg1212/korg1212.c
+++ b/trunk/sound/pci/korg1212/korg1212.c
@@ -2067,7 +2067,7 @@ static int snd_korg1212_control_sync_put(snd_kcontrol_t * kcontrol, snd_ctl_elem
         },                                                                                      \
         {											\
                 .access =	SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_WRITE,	\
-                .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,					\
+                .iface =        SNDRV_CTL_ELEM_IFACE_PCM,					\
                 .name =		c_name " Monitor Phase Invert",					\
                 .info =		snd_korg1212_control_phase_info,				\
                 .get =		snd_korg1212_control_phase_get,					\
@@ -2082,7 +2082,7 @@ static snd_kcontrol_new_t snd_korg1212_controls[] = {
         MON_MIXER(4, "ADAT-5"), MON_MIXER(5, "ADAT-6"), MON_MIXER(6, "ADAT-7"), MON_MIXER(7, "ADAT-8"),
 	{
                 .access =	SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_WRITE,
-                .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
+                .iface =        SNDRV_CTL_ELEM_IFACE_PCM,
                 .name =		"Sync Source",
                 .info =		snd_korg1212_control_sync_info,
                 .get =		snd_korg1212_control_sync_get,
diff --git a/trunk/sound/pci/nm256/nm256.c b/trunk/sound/pci/nm256/nm256.c
index 2bbeb10ff7c4..7eb20b8f89f6 100644
--- a/trunk/sound/pci/nm256/nm256.c
+++ b/trunk/sound/pci/nm256/nm256.c
@@ -189,7 +189,6 @@ struct snd_nm256_stream {
 	nm256_t *chip;
 	snd_pcm_substream_t *substream;
 	int running;
-	int suspended;
 	
 	u32 buf;	/* offset from chip->buffer */
 	int bufsize;	/* buffer size in bytes */
@@ -232,10 +231,8 @@ struct snd_nm256 {
 	int mixer_status_mask;		/* bit mask to test the mixer status */
 
 	int irq;
-	int irq_acks;
 	irqreturn_t (*interrupt)(int, void *, struct pt_regs *);
 	int badintrcount;		/* counter to check bogus interrupts */
-	struct semaphore irq_mutex;
 
 	nm256_stream_t streams[2];
 
@@ -467,37 +464,6 @@ snd_nm256_set_format(nm256_t *chip, nm256_stream_t *s, snd_pcm_substream_t *subs
 	}
 }
 
-/* acquire interrupt */
-static int snd_nm256_acquire_irq(nm256_t *chip)
-{
-	down(&chip->irq_mutex);
-	if (chip->irq < 0) {
-		if (request_irq(chip->pci->irq, chip->interrupt, SA_INTERRUPT|SA_SHIRQ,
-				chip->card->driver, (void*)chip)) {
-			snd_printk("unable to grab IRQ %d\n", chip->pci->irq);
-			up(&chip->irq_mutex);
-			return -EBUSY;
-		}
-		chip->irq = chip->pci->irq;
-	}
-	chip->irq_acks++;
-	up(&chip->irq_mutex);
-	return 0;
-}
-
-/* release interrupt */
-static void snd_nm256_release_irq(nm256_t *chip)
-{
-	down(&chip->irq_mutex);
-	if (chip->irq_acks > 0)
-		chip->irq_acks--;
-	if (chip->irq_acks == 0 && chip->irq >= 0) {
-		free_irq(chip->irq, (void*)chip);
-		chip->irq = -1;
-	}
-	up(&chip->irq_mutex);
-}
-
 /*
  * start / stop
  */
@@ -572,19 +538,15 @@ snd_nm256_playback_trigger(snd_pcm_substream_t *substream, int cmd)
 
 	spin_lock(&chip->reg_lock);
 	switch (cmd) {
-	case SNDRV_PCM_TRIGGER_RESUME:
-		s->suspended = 0;
-		/* fallthru */
 	case SNDRV_PCM_TRIGGER_START:
+	case SNDRV_PCM_TRIGGER_RESUME:
 		if (! s->running) {
 			snd_nm256_playback_start(chip, s, substream);
 			s->running = 1;
 		}
 		break;
-	case SNDRV_PCM_TRIGGER_SUSPEND:
-		s->suspended = 1;
-		/* fallthru */
 	case SNDRV_PCM_TRIGGER_STOP:
+	case SNDRV_PCM_TRIGGER_SUSPEND:
 		if (s->running) {
 			snd_nm256_playback_stop(chip);
 			s->running = 0;
@@ -856,8 +818,6 @@ snd_nm256_playback_open(snd_pcm_substream_t *substream)
 {
 	nm256_t *chip = snd_pcm_substream_chip(substream);
 
-	if (snd_nm256_acquire_irq(chip) < 0)
-		return -EBUSY;
 	snd_nm256_setup_stream(chip, &chip->streams[SNDRV_PCM_STREAM_PLAYBACK],
 			       substream, &snd_nm256_playback);
 	return 0;
@@ -868,8 +828,6 @@ snd_nm256_capture_open(snd_pcm_substream_t *substream)
 {
 	nm256_t *chip = snd_pcm_substream_chip(substream);
 
-	if (snd_nm256_acquire_irq(chip) < 0)
-		return -EBUSY;
 	snd_nm256_setup_stream(chip, &chip->streams[SNDRV_PCM_STREAM_CAPTURE],
 			       substream, &snd_nm256_capture);
 	return 0;
@@ -881,9 +839,6 @@ snd_nm256_capture_open(snd_pcm_substream_t *substream)
 static int
 snd_nm256_playback_close(snd_pcm_substream_t *substream)
 {
-	nm256_t *chip = snd_pcm_substream_chip(substream);
-
-	snd_nm256_release_irq(chip);
 	return 0;
 }
 
@@ -891,9 +846,6 @@ snd_nm256_playback_close(snd_pcm_substream_t *substream)
 static int
 snd_nm256_capture_close(snd_pcm_substream_t *substream)
 {
-	nm256_t *chip = snd_pcm_substream_chip(substream);
-
-	snd_nm256_release_irq(chip);
 	return 0;
 }
 
@@ -963,16 +915,18 @@ snd_nm256_pcm(nm256_t *chip, int device)
 static void
 snd_nm256_init_chip(nm256_t *chip)
 {
+	spin_lock_irq(&chip->reg_lock);
 	/* Reset everything. */
 	snd_nm256_writeb(chip, 0x0, 0x11);
 	snd_nm256_writew(chip, 0x214, 0);
 	/* stop sounds.. */
 	//snd_nm256_playback_stop(chip);
 	//snd_nm256_capture_stop(chip);
+	spin_unlock_irq(&chip->reg_lock);
 }
 
 
-static irqreturn_t
+static inline void
 snd_nm256_intr_check(nm256_t *chip)
 {
 	if (chip->badintrcount++ > 1000) {
@@ -993,9 +947,7 @@ snd_nm256_intr_check(nm256_t *chip)
 		if (chip->streams[SNDRV_PCM_STREAM_CAPTURE].running)
 			snd_nm256_capture_stop(chip);
 		chip->badintrcount = 0;
-		return IRQ_HANDLED;
 	}
-	return IRQ_NONE;
 }
 
 /* 
@@ -1017,8 +969,10 @@ snd_nm256_interrupt(int irq, void *dev_id, struct pt_regs *dummy)
 	status = snd_nm256_readw(chip, NM_INT_REG);
 
 	/* Not ours. */
-	if (status == 0)
-		return snd_nm256_intr_check(chip);
+	if (status == 0) {
+		snd_nm256_intr_check(chip);
+		return IRQ_NONE;
+	}
 
 	chip->badintrcount = 0;
 
@@ -1082,8 +1036,10 @@ snd_nm256_interrupt_zx(int irq, void *dev_id, struct pt_regs *dummy)
 	status = snd_nm256_readl(chip, NM_INT_REG);
 
 	/* Not ours. */
-	if (status == 0)
-		return snd_nm256_intr_check(chip);
+	if (status == 0) {
+		snd_nm256_intr_check(chip);
+		return IRQ_NONE;
+	}
 
 	chip->badintrcount = 0;
 
@@ -1236,7 +1192,7 @@ snd_nm256_mixer(nm256_t *chip)
 		AC97_PC_BEEP, AC97_PHONE, AC97_MIC, AC97_LINE, AC97_CD,
 		AC97_VIDEO, AC97_AUX, AC97_PCM, AC97_REC_SEL,
 		AC97_REC_GAIN, AC97_GENERAL_PURPOSE, AC97_3D_CONTROL,
-		/*AC97_EXTENDED_ID,*/
+		AC97_EXTENDED_ID,
 		AC97_VENDOR_ID1, AC97_VENDOR_ID2,
 		-1
 	};
@@ -1250,7 +1206,6 @@ snd_nm256_mixer(nm256_t *chip)
 	for (i = 0; mixer_regs[i] >= 0; i++)
 		set_bit(mixer_regs[i], ac97.reg_accessed);
 	ac97.private_data = chip;
-	pbus->no_vra = 1;
 	err = snd_ac97_mixer(pbus, &ac97, &chip->ac97);
 	if (err < 0)
 		return err;
@@ -1326,7 +1281,6 @@ static int nm256_suspend(snd_card_t *card, pm_message_t state)
 static int nm256_resume(snd_card_t *card)
 {
 	nm256_t *chip = card->pm_private_data;
-	int i;
 
 	/* Perform a full reset on the hardware */
 	pci_enable_device(chip->pci);
@@ -1335,15 +1289,6 @@ static int nm256_resume(snd_card_t *card)
 	/* restore ac97 */
 	snd_ac97_resume(chip->ac97);
 
-	for (i = 0; i < 2; i++) {
-		nm256_stream_t *s = &chip->streams[i];
-		if (s->substream && s->suspended) {
-			spin_lock_irq(&chip->reg_lock);
-			snd_nm256_set_format(chip, s, s->substream);
-			spin_unlock_irq(&chip->reg_lock);
-		}
-	}
-
 	return 0;
 }
 #endif /* CONFIG_PM */
@@ -1415,7 +1360,6 @@ snd_nm256_create(snd_card_t *card, struct pci_dev *pci,
 	chip->use_cache = usecache;
 	spin_lock_init(&chip->reg_lock);
 	chip->irq = -1;
-	init_MUTEX(&chip->irq_mutex);
 
 	chip->streams[SNDRV_PCM_STREAM_PLAYBACK].bufsize = play_bufsize;
 	chip->streams[SNDRV_PCM_STREAM_CAPTURE].bufsize = capt_bufsize;
@@ -1526,6 +1470,15 @@ snd_nm256_create(snd_card_t *card, struct pci_dev *pci,
 		chip->coeff_buf[SNDRV_PCM_STREAM_CAPTURE] = addr;
 	}
 
+	/* acquire interrupt */
+	if (request_irq(pci->irq, chip->interrupt, SA_INTERRUPT|SA_SHIRQ,
+			card->driver, (void*)chip)) {
+		err = -EBUSY;
+		snd_printk("unable to grab IRQ %d\n", pci->irq);
+		goto __error;
+	}
+	chip->irq = pci->irq;
+
 	/* Fixed setting. */
 	chip->mixer_base = NM_MIXER_OFFSET;
 
diff --git a/trunk/sound/pci/rme32.c b/trunk/sound/pci/rme32.c
index 456be39e8e4a..b7b554df6705 100644
--- a/trunk/sound/pci/rme32.c
+++ b/trunk/sound/pci/rme32.c
@@ -1900,7 +1900,7 @@ static snd_kcontrol_new_t snd_rme32_controls[] = {
 	},
 	{
 		.access = SNDRV_CTL_ELEM_ACCESS_READ,
-		.iface = SNDRV_CTL_ELEM_IFACE_PCM,
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 		.name =	SNDRV_CTL_NAME_IEC958("", PLAYBACK, CON_MASK),
 		.info =	snd_rme32_control_spdif_mask_info,
 		.get =	snd_rme32_control_spdif_mask_get,
@@ -1908,7 +1908,7 @@ static snd_kcontrol_new_t snd_rme32_controls[] = {
 	},
 	{
 		.access = SNDRV_CTL_ELEM_ACCESS_READ,
-		.iface = SNDRV_CTL_ELEM_IFACE_PCM,
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 		.name =	SNDRV_CTL_NAME_IEC958("", PLAYBACK, PRO_MASK),
 		.info =	snd_rme32_control_spdif_mask_info,
 		.get =	snd_rme32_control_spdif_mask_get,
diff --git a/trunk/sound/pci/rme96.c b/trunk/sound/pci/rme96.c
index 9645e9004a48..10c4f45a913c 100644
--- a/trunk/sound/pci/rme96.c
+++ b/trunk/sound/pci/rme96.c
@@ -2266,7 +2266,7 @@ static snd_kcontrol_new_t snd_rme96_controls[] = {
 },
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =		SNDRV_CTL_NAME_IEC958("",PLAYBACK,CON_MASK),
 	.info =		snd_rme96_control_spdif_mask_info,
 	.get =		snd_rme96_control_spdif_mask_get,
@@ -2276,7 +2276,7 @@ static snd_kcontrol_new_t snd_rme96_controls[] = {
 },
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =		SNDRV_CTL_NAME_IEC958("",PLAYBACK,PRO_MASK),
 	.info =		snd_rme96_control_spdif_mask_info,
 	.get =		snd_rme96_control_spdif_mask_get,
diff --git a/trunk/sound/pci/rme9652/hdsp.c b/trunk/sound/pci/rme9652/hdsp.c
index 6694866089b5..796621de5009 100644
--- a/trunk/sound/pci/rme9652/hdsp.c
+++ b/trunk/sound/pci/rme9652/hdsp.c
@@ -1524,7 +1524,7 @@ static int snd_hdsp_control_spdif_mask_get(snd_kcontrol_t * kcontrol, snd_ctl_el
 }
 
 #define HDSP_SPDIF_IN(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM,  \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_spdif_in, \
@@ -1584,7 +1584,7 @@ static int snd_hdsp_put_spdif_in(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
 }
 
 #define HDSP_SPDIF_OUT(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, .name = xname, .index = xindex, \
   .info = snd_hdsp_info_spdif_bits, \
   .get = snd_hdsp_get_spdif_out, .put = snd_hdsp_put_spdif_out }
 
@@ -1638,7 +1638,7 @@ static int snd_hdsp_put_spdif_out(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_
 }
 
 #define HDSP_SPDIF_PROFESSIONAL(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, .name = xname, .index = xindex, \
   .info = snd_hdsp_info_spdif_bits, \
   .get = snd_hdsp_get_spdif_professional, .put = snd_hdsp_put_spdif_professional }
 
@@ -1683,7 +1683,7 @@ static int snd_hdsp_put_spdif_professional(snd_kcontrol_t * kcontrol, snd_ctl_el
 }
 
 #define HDSP_SPDIF_EMPHASIS(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, .name = xname, .index = xindex, \
   .info = snd_hdsp_info_spdif_bits, \
   .get = snd_hdsp_get_spdif_emphasis, .put = snd_hdsp_put_spdif_emphasis }
 
@@ -1728,7 +1728,7 @@ static int snd_hdsp_put_spdif_emphasis(snd_kcontrol_t * kcontrol, snd_ctl_elem_v
 }
 
 #define HDSP_SPDIF_NON_AUDIO(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, .name = xname, .index = xindex, \
   .info = snd_hdsp_info_spdif_bits, \
   .get = snd_hdsp_get_spdif_nonaudio, .put = snd_hdsp_put_spdif_nonaudio }
 
@@ -1773,7 +1773,7 @@ static int snd_hdsp_put_spdif_nonaudio(snd_kcontrol_t * kcontrol, snd_ctl_elem_v
 }
 
 #define HDSP_SPDIF_SAMPLE_RATE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ, \
@@ -1834,7 +1834,7 @@ static int snd_hdsp_get_spdif_sample_rate(snd_kcontrol_t * kcontrol, snd_ctl_ele
 }
 
 #define HDSP_SYSTEM_SAMPLE_RATE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ, \
@@ -1858,7 +1858,7 @@ static int snd_hdsp_get_system_sample_rate(snd_kcontrol_t * kcontrol, snd_ctl_el
 }
 
 #define HDSP_AUTOSYNC_SAMPLE_RATE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ, \
@@ -1918,7 +1918,7 @@ static int snd_hdsp_get_autosync_sample_rate(snd_kcontrol_t * kcontrol, snd_ctl_
 }
 
 #define HDSP_SYSTEM_CLOCK_MODE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ, \
@@ -1958,7 +1958,7 @@ static int snd_hdsp_get_system_clock_mode(snd_kcontrol_t * kcontrol, snd_ctl_ele
 }
 
 #define HDSP_CLOCK_SOURCE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_clock_source, \
@@ -2124,7 +2124,7 @@ static int snd_hdsp_put_clock_source_lock(snd_kcontrol_t * kcontrol, snd_ctl_ele
 }
 
 #define HDSP_DA_GAIN(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_da_gain, \
@@ -2210,7 +2210,7 @@ static int snd_hdsp_put_da_gain(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
 }
 
 #define HDSP_AD_GAIN(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_ad_gain, \
@@ -2296,7 +2296,7 @@ static int snd_hdsp_put_ad_gain(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
 }
 
 #define HDSP_PHONE_GAIN(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_phone_gain, \
@@ -2382,7 +2382,7 @@ static int snd_hdsp_put_phone_gain(snd_kcontrol_t * kcontrol, snd_ctl_elem_value
 }
 
 #define HDSP_XLR_BREAKOUT_CABLE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_xlr_breakout_cable, \
@@ -2447,7 +2447,7 @@ static int snd_hdsp_put_xlr_breakout_cable(snd_kcontrol_t * kcontrol, snd_ctl_el
    Switching this on desactivates external ADAT
 */
 #define HDSP_AEB(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_aeb, \
@@ -2508,7 +2508,7 @@ static int snd_hdsp_put_aeb(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t * uc
 }
 
 #define HDSP_PREF_SYNC_REF(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_pref_sync_ref, \
@@ -2641,7 +2641,7 @@ static int snd_hdsp_put_pref_sync_ref(snd_kcontrol_t * kcontrol, snd_ctl_elem_va
 }
 
 #define HDSP_AUTOSYNC_REF(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ, \
@@ -2697,7 +2697,7 @@ static int snd_hdsp_get_autosync_ref(snd_kcontrol_t * kcontrol, snd_ctl_elem_val
 }
 
 #define HDSP_LINE_OUT(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_line_out, \
@@ -2757,7 +2757,7 @@ static int snd_hdsp_put_line_out(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
 }
 
 #define HDSP_PRECISE_POINTER(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_CARD, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_precise_pointer, \
@@ -2811,7 +2811,7 @@ static int snd_hdsp_put_precise_pointer(snd_kcontrol_t * kcontrol, snd_ctl_elem_
 }
 
 #define HDSP_USE_MIDI_TASKLET(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_CARD, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdsp_info_use_midi_tasklet, \
@@ -2868,7 +2868,6 @@ static int snd_hdsp_put_use_midi_tasklet(snd_kcontrol_t * kcontrol, snd_ctl_elem
 { .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
-  .device = 0, \
   .access = SNDRV_CTL_ELEM_ACCESS_READWRITE | \
 		 SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
   .info = snd_hdsp_info_mixer, \
@@ -2940,7 +2939,7 @@ static int snd_hdsp_put_mixer(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t *
 }
 
 #define HDSP_WC_SYNC_CHECK(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
@@ -2984,7 +2983,7 @@ static int snd_hdsp_get_wc_sync_check(snd_kcontrol_t * kcontrol, snd_ctl_elem_va
 }
 
 #define HDSP_SPDIF_SYNC_CHECK(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
@@ -3016,7 +3015,7 @@ static int snd_hdsp_get_spdif_sync_check(snd_kcontrol_t * kcontrol, snd_ctl_elem
 }
 
 #define HDSP_ADATSYNC_SYNC_CHECK(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
@@ -3047,7 +3046,7 @@ static int snd_hdsp_get_adatsync_sync_check(snd_kcontrol_t * kcontrol, snd_ctl_e
 }
 
 #define HDSP_ADAT_SYNC_CHECK \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
   .info = snd_hdsp_info_sync_check, \
   .get = snd_hdsp_get_adat_sync_check \
@@ -3120,7 +3119,7 @@ static snd_kcontrol_new_t snd_hdsp_controls[] = {
 },
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =		SNDRV_CTL_NAME_IEC958("",PLAYBACK,CON_MASK),
 	.info =		snd_hdsp_control_spdif_mask_info,
 	.get =		snd_hdsp_control_spdif_mask_get,
@@ -3130,7 +3129,7 @@ static snd_kcontrol_new_t snd_hdsp_controls[] = {
 },
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =		SNDRV_CTL_NAME_IEC958("",PLAYBACK,PRO_MASK),
 	.info =		snd_hdsp_control_spdif_mask_info,
 	.get =		snd_hdsp_control_spdif_mask_get,
@@ -3147,6 +3146,8 @@ HDSP_SPDIF_NON_AUDIO("IEC958 Non-audio Bit", 0),
 /* 'Sample Clock Source' complies with the alsa control naming scheme */ 
 HDSP_CLOCK_SOURCE("Sample Clock Source", 0),
 {
+	/* FIXME: should be PCM or MIXER? */
+	/* .iface = SNDRV_CTL_ELEM_IFACE_PCM, */
 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name = "Sample Clock Source Locking",
 	.info = snd_hdsp_info_clock_source_lock,
diff --git a/trunk/sound/pci/rme9652/hdspm.c b/trunk/sound/pci/rme9652/hdspm.c
index 5d786d113b25..9e86d0eb41ce 100644
--- a/trunk/sound/pci/rme9652/hdspm.c
+++ b/trunk/sound/pci/rme9652/hdspm.c
@@ -65,7 +65,7 @@ module_param_array(enable, bool, NULL, 0444);
 MODULE_PARM_DESC(enable, "Enable/disable specific HDSPM soundcards.");
 
 module_param_array(precise_ptr, bool, NULL, 0444);
-MODULE_PARM_DESC(precise_ptr, "Enable or disable precise pointer.");
+MODULE_PARM_DESC(precise_ptr, "Enable precise pointer, or disable.");
 
 module_param_array(line_outs_monitor, bool, NULL, 0444);
 MODULE_PARM_DESC(line_outs_monitor,
@@ -1104,14 +1104,14 @@ static int snd_hdspm_midi_output_close(snd_rawmidi_substream_t * substream)
 	return 0;
 }
 
-static snd_rawmidi_ops_t snd_hdspm_midi_output =
+snd_rawmidi_ops_t snd_hdspm_midi_output =
 {
 	.open =		snd_hdspm_midi_output_open,
 	.close =	snd_hdspm_midi_output_close,
 	.trigger =	snd_hdspm_midi_output_trigger,
 };
 
-static snd_rawmidi_ops_t snd_hdspm_midi_input =
+snd_rawmidi_ops_t snd_hdspm_midi_input =
 {
 	.open =		snd_hdspm_midi_input_open,
 	.close =	snd_hdspm_midi_input_close,
@@ -1168,7 +1168,7 @@ static void hdspm_midi_tasklet(unsigned long arg)
 /* get the system sample rate which is set */
 
 #define HDSPM_SYSTEM_SAMPLE_RATE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ, \
@@ -1195,7 +1195,7 @@ static int snd_hdspm_get_system_sample_rate(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_AUTOSYNC_SAMPLE_RATE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ, \
@@ -1264,7 +1264,7 @@ static int snd_hdspm_get_autosync_sample_rate(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_SYSTEM_CLOCK_MODE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ, \
@@ -1310,7 +1310,7 @@ static int snd_hdspm_get_system_clock_mode(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_CLOCK_SOURCE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdspm_info_clock_source, \
@@ -1457,7 +1457,7 @@ static int snd_hdspm_put_clock_source(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_PREF_SYNC_REF(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdspm_info_pref_sync_ref, \
@@ -1547,7 +1547,7 @@ static int snd_hdspm_put_pref_sync_ref(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_AUTOSYNC_REF(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ, \
@@ -1604,7 +1604,7 @@ static int snd_hdspm_get_autosync_ref(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_LINE_OUT(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdspm_info_line_out, \
@@ -1668,7 +1668,7 @@ static int snd_hdspm_put_line_out(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_TX_64(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdspm_info_tx_64, \
@@ -1731,7 +1731,7 @@ static int snd_hdspm_put_tx_64(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_C_TMS(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdspm_info_c_tms, \
@@ -1794,7 +1794,7 @@ static int snd_hdspm_put_c_tms(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_SAFE_MODE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdspm_info_safe_mode, \
@@ -1857,7 +1857,7 @@ static int snd_hdspm_put_safe_mode(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_INPUT_SELECT(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .info = snd_hdspm_info_input_select, \
@@ -1941,7 +1941,6 @@ static int snd_hdspm_put_input_select(snd_kcontrol_t * kcontrol,
 { .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
-  .device = 0, \
   .access = SNDRV_CTL_ELEM_ACCESS_READWRITE | \
 		 SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
   .info = snd_hdspm_info_mixer, \
@@ -2125,7 +2124,7 @@ static int snd_hdspm_put_playback_mixer(snd_kcontrol_t * kcontrol,
 }
 
 #define HDSPM_WC_SYNC_CHECK(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
@@ -2171,7 +2170,7 @@ static int snd_hdspm_get_wc_sync_check(snd_kcontrol_t * kcontrol,
 
 
 #define HDSPM_MADI_SYNC_CHECK(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_HWDEP, \
   .name = xname, \
   .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
diff --git a/trunk/sound/pci/rme9652/rme9652.c b/trunk/sound/pci/rme9652/rme9652.c
index 8ee4d6fd6ea7..1bc9d0df8516 100644
--- a/trunk/sound/pci/rme9652/rme9652.c
+++ b/trunk/sound/pci/rme9652/rme9652.c
@@ -893,7 +893,7 @@ static int snd_rme9652_control_spdif_mask_get(snd_kcontrol_t * kcontrol, snd_ctl
 }
 
 #define RME9652_ADAT1_IN(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = xname, .index = xindex, \
   .info = snd_rme9652_info_adat1_in, \
   .get = snd_rme9652_get_adat1_in, \
   .put = snd_rme9652_put_adat1_in }
@@ -971,7 +971,7 @@ static int snd_rme9652_put_adat1_in(snd_kcontrol_t * kcontrol, snd_ctl_elem_valu
 }
 
 #define RME9652_SPDIF_IN(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = xname, .index = xindex, \
   .info = snd_rme9652_info_spdif_in, \
   .get = snd_rme9652_get_spdif_in, .put = snd_rme9652_put_spdif_in }
 
@@ -1042,7 +1042,7 @@ static int snd_rme9652_put_spdif_in(snd_kcontrol_t * kcontrol, snd_ctl_elem_valu
 }
 
 #define RME9652_SPDIF_OUT(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = xname, .index = xindex, \
   .info = snd_rme9652_info_spdif_out, \
   .get = snd_rme9652_get_spdif_out, .put = snd_rme9652_put_spdif_out }
 
@@ -1110,7 +1110,7 @@ static int snd_rme9652_put_spdif_out(snd_kcontrol_t * kcontrol, snd_ctl_elem_val
 }
 
 #define RME9652_SYNC_MODE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = xname, .index = xindex, \
   .info = snd_rme9652_info_sync_mode, \
   .get = snd_rme9652_get_sync_mode, .put = snd_rme9652_put_sync_mode }
 
@@ -1195,7 +1195,7 @@ static int snd_rme9652_put_sync_mode(snd_kcontrol_t * kcontrol, snd_ctl_elem_val
 }
 
 #define RME9652_SYNC_PREF(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = xname, .index = xindex, \
   .info = snd_rme9652_info_sync_pref, \
   .get = snd_rme9652_get_sync_pref, .put = snd_rme9652_put_sync_pref }
 
@@ -1340,7 +1340,7 @@ static int snd_rme9652_put_thru(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
 }
 
 #define RME9652_PASSTHRU(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = xname, .index = xindex, \
   .info = snd_rme9652_info_passthru, \
   .put = snd_rme9652_put_passthru, \
   .get = snd_rme9652_get_passthru }
@@ -1386,7 +1386,7 @@ static int snd_rme9652_put_passthru(snd_kcontrol_t * kcontrol, snd_ctl_elem_valu
 /* Read-only switches */
 
 #define RME9652_SPDIF_RATE(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = xname, .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
   .info = snd_rme9652_info_spdif_rate, \
   .get = snd_rme9652_get_spdif_rate }
@@ -1411,7 +1411,7 @@ static int snd_rme9652_get_spdif_rate(snd_kcontrol_t * kcontrol, snd_ctl_elem_va
 }
 
 #define RME9652_ADAT_SYNC(xname, xindex, xidx) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = xname, .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
   .info = snd_rme9652_info_adat_sync, \
   .get = snd_rme9652_get_adat_sync, .private_value = xidx }
@@ -1447,7 +1447,7 @@ static int snd_rme9652_get_adat_sync(snd_kcontrol_t * kcontrol, snd_ctl_elem_val
 }
 
 #define RME9652_TC_VALID(xname, xindex) \
-{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, .index = xindex, \
+{ .iface = SNDRV_CTL_ELEM_IFACE_PCM, .name = xname, .index = xindex, \
   .access = SNDRV_CTL_ELEM_ACCESS_READ | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
   .info = snd_rme9652_info_tc_valid, \
   .get = snd_rme9652_get_tc_valid }
@@ -1545,7 +1545,7 @@ static snd_kcontrol_new_t snd_rme9652_controls[] = {
 },
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =		SNDRV_CTL_NAME_IEC958("",PLAYBACK,CON_MASK),
 	.info =		snd_rme9652_control_spdif_mask_info,
 	.get =		snd_rme9652_control_spdif_mask_get,
@@ -1555,7 +1555,7 @@ static snd_kcontrol_new_t snd_rme9652_controls[] = {
 },
 {
 	.access =	SNDRV_CTL_ELEM_ACCESS_READ,
-	.iface =	SNDRV_CTL_ELEM_IFACE_PCM,
+	.iface =	SNDRV_CTL_ELEM_IFACE_MIXER,
 	.name =		SNDRV_CTL_NAME_IEC958("",PLAYBACK,PRO_MASK),
 	.info =		snd_rme9652_control_spdif_mask_info,
 	.get =		snd_rme9652_control_spdif_mask_get,
@@ -1568,7 +1568,7 @@ RME9652_SPDIF_OUT("IEC958 Output also on ADAT1", 0),
 RME9652_SYNC_MODE("Sync Mode", 0),
 RME9652_SYNC_PREF("Preferred Sync Source", 0),
 {
-	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+	.iface = SNDRV_CTL_ELEM_IFACE_PCM,
 	.name = "Channels Thru",
 	.index = 0,
 	.info = snd_rme9652_info_thru,
diff --git a/trunk/sound/pci/trident/trident_main.c b/trunk/sound/pci/trident/trident_main.c
index f30d9d947862..29d89bfba0a4 100644
--- a/trunk/sound/pci/trident/trident_main.c
+++ b/trunk/sound/pci/trident/trident_main.c
@@ -1689,7 +1689,7 @@ static snd_pcm_hardware_t snd_trident_playback =
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_SYNC_START |
-				 SNDRV_PCM_INFO_PAUSE /* | SNDRV_PCM_INFO_RESUME */),
+				 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME),
 	.formats =		(SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE |
 				 SNDRV_PCM_FMTBIT_S8 | SNDRV_PCM_FMTBIT_U16_LE),
 	.rates =		SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
@@ -1714,7 +1714,7 @@ static snd_pcm_hardware_t snd_trident_capture =
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_SYNC_START |
-				 SNDRV_PCM_INFO_PAUSE /* | SNDRV_PCM_INFO_RESUME */),
+				 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME),
 	.formats =		(SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE |
 				 SNDRV_PCM_FMTBIT_S8 | SNDRV_PCM_FMTBIT_U16_LE),
 	.rates =		SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
@@ -1739,7 +1739,7 @@ static snd_pcm_hardware_t snd_trident_foldback =
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_SYNC_START |
-				 SNDRV_PCM_INFO_PAUSE /* | SNDRV_PCM_INFO_RESUME */),
+				 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME),
 	.formats =		SNDRV_PCM_FMTBIT_S16_LE,
 	.rates =		SNDRV_PCM_RATE_48000,
 	.rate_min =		48000,
@@ -1763,7 +1763,7 @@ static snd_pcm_hardware_t snd_trident_spdif =
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_SYNC_START |
-				 SNDRV_PCM_INFO_PAUSE /* | SNDRV_PCM_INFO_RESUME */),
+				 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME),
 	.formats =		SNDRV_PCM_FMTBIT_S16_LE,
 	.rates =		(SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_44100 |
 				 SNDRV_PCM_RATE_48000),
@@ -1784,7 +1784,7 @@ static snd_pcm_hardware_t snd_trident_spdif_7018 =
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_SYNC_START |
-				 SNDRV_PCM_INFO_PAUSE /* | SNDRV_PCM_INFO_RESUME */),
+				 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME),
 	.formats =		SNDRV_PCM_FMTBIT_S16_LE,
 	.rates =		SNDRV_PCM_RATE_48000,
 	.rate_min =		48000,
diff --git a/trunk/sound/pci/via82xx.c b/trunk/sound/pci/via82xx.c
index 56c6e52d7264..4889600387c8 100644
--- a/trunk/sound/pci/via82xx.c
+++ b/trunk/sound/pci/via82xx.c
@@ -663,12 +663,10 @@ static int snd_via82xx_pcm_trigger(snd_pcm_substream_t * substream, int cmd)
 		val = 0;
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
-	case SNDRV_PCM_TRIGGER_RESUME:
 		val |= VIA_REG_CTRL_START;
 		viadev->running = 1;
 		break;
 	case SNDRV_PCM_TRIGGER_STOP:
-	case SNDRV_PCM_TRIGGER_SUSPEND:
 		val = VIA_REG_CTRL_TERMINATE;
 		viadev->running = 0;
 		break;
@@ -931,12 +929,12 @@ static int snd_via8233_playback_prepare(snd_pcm_substream_t *substream)
 
 	if ((rate_changed = via_lock_rate(&chip->rates[0], ac97_rate)) < 0)
 		return rate_changed;
-	if (rate_changed)
+	if (rate_changed) {
 		snd_ac97_set_rate(chip->ac97, AC97_PCM_FRONT_DAC_RATE,
 				  chip->no_vra ? 48000 : runtime->rate);
-	if (chip->spdif_on && viadev->reg_offset == 0x30)
-		snd_ac97_set_rate(chip->ac97, AC97_SPDIF, runtime->rate);
-
+		snd_ac97_set_rate(chip->ac97, AC97_SPDIF,
+				  chip->no_vra ? 48000 : runtime->rate);
+	}
 	if (runtime->rate == 48000)
 		rbits = 0xfffff;
 	else
@@ -1037,7 +1035,7 @@ static snd_pcm_hardware_t snd_via82xx_hw =
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID |
-				 /* SNDRV_PCM_INFO_RESUME | */
+				 SNDRV_PCM_INFO_RESUME |
 				 SNDRV_PCM_INFO_PAUSE),
 	.formats =		SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
 	.rates =		SNDRV_PCM_RATE_48000,
@@ -1486,7 +1484,7 @@ static int snd_via8233_dxs3_spdif_put(snd_kcontrol_t *kcontrol, snd_ctl_elem_val
 }
 
 static snd_kcontrol_new_t snd_via8233_dxs3_spdif_control __devinitdata = {
-	.name = SNDRV_CTL_NAME_IEC958("Output ",NONE,SWITCH),
+	.name = "IEC958 Output Switch",
 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
 	.info = snd_via8233_dxs3_spdif_info,
 	.get = snd_via8233_dxs3_spdif_get,
@@ -2155,7 +2153,6 @@ static int __devinit check_dxs_list(struct pci_dev *pci)
 		{ .subvendor = 0x1019, .subdevice = 0x0a81, .action = VIA_DXS_NO_VRA }, /* ECS K7VTA3 v8.0 */
 		{ .subvendor = 0x1019, .subdevice = 0x0a85, .action = VIA_DXS_NO_VRA }, /* ECS L7VMM2 */
 		{ .subvendor = 0x1025, .subdevice = 0x0033, .action = VIA_DXS_NO_VRA }, /* Acer Inspire 1353LM */
-		{ .subvendor = 0x1025, .subdevice = 0x0046, .action = VIA_DXS_SRC }, /* Acer Aspire 1524 WLMi */
 		{ .subvendor = 0x1043, .subdevice = 0x8095, .action = VIA_DXS_NO_VRA }, /* ASUS A7V8X (FIXME: possibly VIA_DXS_ENABLE?)*/
 		{ .subvendor = 0x1043, .subdevice = 0x80a1, .action = VIA_DXS_NO_VRA }, /* ASUS A7V8-X */
 		{ .subvendor = 0x1043, .subdevice = 0x80b0, .action = VIA_DXS_NO_VRA }, /* ASUS A7V600 & K8V*/ 
@@ -2171,12 +2168,10 @@ static int __devinit check_dxs_list(struct pci_dev *pci)
 		{ .subvendor = 0x1297, .subdevice = 0xc160, .action = VIA_DXS_ENABLE }, /* Shuttle SK41G */
 		{ .subvendor = 0x1458, .subdevice = 0xa002, .action = VIA_DXS_ENABLE }, /* Gigabyte GA-7VAXP */
 		{ .subvendor = 0x1462, .subdevice = 0x0080, .action = VIA_DXS_SRC }, /* MSI K8T Neo-FIS2R */
-		{ .subvendor = 0x1462, .subdevice = 0x0430, .action = VIA_DXS_SRC }, /* MSI 7142 (K8MM-V) */
 		{ .subvendor = 0x1462, .subdevice = 0x3800, .action = VIA_DXS_ENABLE }, /* MSI KT266 */
 		{ .subvendor = 0x1462, .subdevice = 0x5901, .action = VIA_DXS_NO_VRA }, /* MSI KT6 Delta-SR */
 		{ .subvendor = 0x1462, .subdevice = 0x7023, .action = VIA_DXS_NO_VRA }, /* MSI K8T Neo2-FI */
 		{ .subvendor = 0x1462, .subdevice = 0x7120, .action = VIA_DXS_ENABLE }, /* MSI KT4V */
-		{ .subvendor = 0x1462, .subdevice = 0x7142, .action = VIA_DXS_ENABLE }, /* MSI K8MM-V */
 		{ .subvendor = 0x147b, .subdevice = 0x1401, .action = VIA_DXS_ENABLE }, /* ABIT KD7(-RAID) */
 		{ .subvendor = 0x147b, .subdevice = 0x1411, .action = VIA_DXS_ENABLE }, /* ABIT VA-20 */
 		{ .subvendor = 0x147b, .subdevice = 0x1413, .action = VIA_DXS_ENABLE }, /* ABIT KV8 Pro */
diff --git a/trunk/sound/pci/via82xx_modem.c b/trunk/sound/pci/via82xx_modem.c
index 5872d438a04a..4a9779cc9733 100644
--- a/trunk/sound/pci/via82xx_modem.c
+++ b/trunk/sound/pci/via82xx_modem.c
@@ -521,7 +521,6 @@ static int snd_via82xx_pcm_trigger(snd_pcm_substream_t * substream, int cmd)
 
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
-	case SNDRV_PCM_TRIGGER_SUSPEND:
 		val |= VIA_REG_CTRL_START;
 		viadev->running = 1;
 		break;
@@ -698,7 +697,7 @@ static snd_pcm_hardware_t snd_via82xx_hw =
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID |
-				 /* SNDRV_PCM_INFO_RESUME | */
+				 SNDRV_PCM_INFO_RESUME |
 				 SNDRV_PCM_INFO_PAUSE),
 	.formats =		SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE,
 	.rates =		SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 | SNDRV_PCM_RATE_KNOT,
diff --git a/trunk/sound/pci/ymfpci/ymfpci_main.c b/trunk/sound/pci/ymfpci/ymfpci_main.c
index 054836412dc4..d54f88a1b525 100644
--- a/trunk/sound/pci/ymfpci/ymfpci_main.c
+++ b/trunk/sound/pci/ymfpci/ymfpci_main.c
@@ -321,26 +321,6 @@ static void snd_ymfpci_pcm_interrupt(ymfpci_t *chip, ymfpci_voice_t *voice)
 			snd_pcm_period_elapsed(ypcm->substream);
 			spin_lock(&chip->reg_lock);
 		}
-
-		if (unlikely(ypcm->update_pcm_vol)) {
-			unsigned int subs = ypcm->substream->number;
-			unsigned int next_bank = 1 - chip->active_bank;
-			snd_ymfpci_playback_bank_t *bank;
-			u32 volume;
-			
-			bank = &voice->bank[next_bank];
-			volume = cpu_to_le32(chip->pcm_mixer[subs].left << 15);
-			bank->left_gain_end = volume;
-			if (ypcm->output_rear)
-				bank->eff2_gain_end = volume;
-			if (ypcm->voices[1])
-				bank = &ypcm->voices[1]->bank[next_bank];
-			volume = cpu_to_le32(chip->pcm_mixer[subs].right << 15);
-			bank->right_gain_end = volume;
-			if (ypcm->output_rear)
-				bank->eff3_gain_end = volume;
-			ypcm->update_pcm_vol--;
-		}
 	}
 	spin_unlock(&chip->reg_lock);
 }
@@ -471,74 +451,87 @@ static int snd_ymfpci_pcm_voice_alloc(ymfpci_pcm_t *ypcm, int voices)
 	return 0;
 }
 
-static void snd_ymfpci_pcm_init_voice(ymfpci_pcm_t *ypcm, unsigned int voiceidx,
-				      snd_pcm_runtime_t *runtime,
-				      int has_pcm_volume)
+static void snd_ymfpci_pcm_init_voice(ymfpci_voice_t *voice, int stereo,
+				      int rate, int w_16, unsigned long addr,
+				      unsigned int end,
+				      int output_front, int output_rear)
 {
-	ymfpci_voice_t *voice = ypcm->voices[voiceidx];
 	u32 format;
-	u32 delta = snd_ymfpci_calc_delta(runtime->rate);
-	u32 lpfQ = snd_ymfpci_calc_lpfQ(runtime->rate);
-	u32 lpfK = snd_ymfpci_calc_lpfK(runtime->rate);
+	u32 delta = snd_ymfpci_calc_delta(rate);
+	u32 lpfQ = snd_ymfpci_calc_lpfQ(rate);
+	u32 lpfK = snd_ymfpci_calc_lpfK(rate);
 	snd_ymfpci_playback_bank_t *bank;
 	unsigned int nbank;
-	u32 vol_left, vol_right;
-	u8 use_left, use_right;
 
 	snd_assert(voice != NULL, return);
-	if (runtime->channels == 1) {
-		use_left = 1;
-		use_right = 1;
-	} else {
-		use_left = (voiceidx & 1) == 0;
-		use_right = !use_left;
-	}
-	if (has_pcm_volume) {
-		vol_left = cpu_to_le32(ypcm->chip->pcm_mixer
-				       [ypcm->substream->number].left << 15);
-		vol_right = cpu_to_le32(ypcm->chip->pcm_mixer
-					[ypcm->substream->number].right << 15);
-	} else {
-		vol_left = cpu_to_le32(0x40000000);
-		vol_right = cpu_to_le32(0x40000000);
-	}
-	format = runtime->channels == 2 ? 0x00010000 : 0;
-	if (snd_pcm_format_width(runtime->format) == 8)
-		format |= 0x80000000;
-	if (runtime->channels == 2 && (voiceidx & 1) != 0)
-		format |= 1;
+	format = (stereo ? 0x00010000 : 0) | (w_16 ? 0 : 0x80000000);
 	for (nbank = 0; nbank < 2; nbank++) {
 		bank = &voice->bank[nbank];
-		memset(bank, 0, sizeof(*bank));
 		bank->format = cpu_to_le32(format);
-		bank->base = cpu_to_le32(runtime->dma_addr);
-		bank->loop_end = cpu_to_le32(ypcm->buffer_size);
+		bank->loop_default = 0;
+		bank->base = cpu_to_le32(addr);
+		bank->loop_start = 0;
+		bank->loop_end = cpu_to_le32(end);
+		bank->loop_frac = 0;
+		bank->eg_gain_end = cpu_to_le32(0x40000000);
 		bank->lpfQ = cpu_to_le32(lpfQ);
+		bank->status = 0;
+		bank->num_of_frames = 0;
+		bank->loop_count = 0;
+		bank->start = 0;
+		bank->start_frac = 0;
 		bank->delta =
 		bank->delta_end = cpu_to_le32(delta);
 		bank->lpfK =
 		bank->lpfK_end = cpu_to_le32(lpfK);
-		bank->eg_gain =
-		bank->eg_gain_end = cpu_to_le32(0x40000000);
-
-		if (ypcm->output_front) {
-			if (use_left) {
-				bank->left_gain =
-				bank->left_gain_end = vol_left;
-			}
-			if (use_right) {
+		bank->eg_gain = cpu_to_le32(0x40000000);
+		bank->lpfD1 =
+		bank->lpfD2 = 0;
+
+		bank->left_gain = 
+		bank->right_gain =
+		bank->left_gain_end =
+		bank->right_gain_end =
+		bank->eff1_gain =
+		bank->eff2_gain =
+		bank->eff3_gain =
+		bank->eff1_gain_end =
+		bank->eff2_gain_end =
+		bank->eff3_gain_end = 0;
+
+		if (!stereo) {
+			if (output_front) {
+				bank->left_gain = 
 				bank->right_gain =
-				bank->right_gain_end = vol_right;
+				bank->left_gain_end =
+				bank->right_gain_end = cpu_to_le32(0x40000000);
 			}
-		}
-		if (ypcm->output_rear) {
-			if (use_left) {
+			if (output_rear) {
 				bank->eff2_gain =
-				bank->eff2_gain_end = vol_left;
-			}
-			if (use_right) {
+				bank->eff2_gain_end =
 				bank->eff3_gain =
-				bank->eff3_gain_end = vol_right;
+				bank->eff3_gain_end = cpu_to_le32(0x40000000);
+			}
+		} else {
+			if (output_front) {
+				if ((voice->number & 1) == 0) {
+					bank->left_gain =
+					bank->left_gain_end = cpu_to_le32(0x40000000);
+				} else {
+					bank->format |= cpu_to_le32(1);
+					bank->right_gain =
+					bank->right_gain_end = cpu_to_le32(0x40000000);
+				}
+			}
+			if (output_rear) {
+				if ((voice->number & 1) == 0) {
+					bank->eff3_gain =
+					bank->eff3_gain_end = cpu_to_le32(0x40000000);
+				} else {
+					bank->format |= cpu_to_le32(1);
+					bank->eff2_gain =
+					bank->eff2_gain_end = cpu_to_le32(0x40000000);
+				}
 			}
 		}
 	}
@@ -620,7 +613,7 @@ static int snd_ymfpci_playback_hw_free(snd_pcm_substream_t * substream)
 
 static int snd_ymfpci_playback_prepare(snd_pcm_substream_t * substream)
 {
-	ymfpci_t *chip = snd_pcm_substream_chip(substream);
+	// ymfpci_t *chip = snd_pcm_substream_chip(substream);
 	snd_pcm_runtime_t *runtime = substream->runtime;
 	ymfpci_pcm_t *ypcm = runtime->private_data;
 	unsigned int nvoice;
@@ -630,8 +623,14 @@ static int snd_ymfpci_playback_prepare(snd_pcm_substream_t * substream)
 	ypcm->period_pos = 0;
 	ypcm->last_pos = 0;
 	for (nvoice = 0; nvoice < runtime->channels; nvoice++)
-		snd_ymfpci_pcm_init_voice(ypcm, nvoice, runtime,
-					  substream->pcm == chip->pcm);
+		snd_ymfpci_pcm_init_voice(ypcm->voices[nvoice],
+					  runtime->channels == 2,
+					  runtime->rate,
+					  snd_pcm_format_width(runtime->format) == 16,
+					  runtime->dma_addr,
+					  ypcm->buffer_size,
+					  ypcm->output_front,
+					  ypcm->output_rear);
 	return 0;
 }
 
@@ -883,7 +882,6 @@ static int snd_ymfpci_playback_open(snd_pcm_substream_t * substream)
 	ymfpci_t *chip = snd_pcm_substream_chip(substream);
 	snd_pcm_runtime_t *runtime = substream->runtime;
 	ymfpci_pcm_t *ypcm;
-	snd_kcontrol_t *kctl;
 	int err;
 	
 	if ((err = snd_ymfpci_playback_open_1(substream)) < 0)
@@ -897,10 +895,6 @@ static int snd_ymfpci_playback_open(snd_pcm_substream_t * substream)
 		chip->rear_opened++;
 	}
 	spin_unlock_irq(&chip->reg_lock);
-
-	kctl = chip->pcm_mixer[substream->number].ctl;
-	kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
-	snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_INFO, &kctl->id);
 	return 0;
 }
 
@@ -993,7 +987,6 @@ static int snd_ymfpci_playback_close(snd_pcm_substream_t * substream)
 {
 	ymfpci_t *chip = snd_pcm_substream_chip(substream);
 	ymfpci_pcm_t *ypcm = substream->runtime->private_data;
-	snd_kcontrol_t *kctl;
 
 	spin_lock_irq(&chip->reg_lock);
 	if (ypcm->output_rear && chip->rear_opened > 0) {
@@ -1001,9 +994,6 @@ static int snd_ymfpci_playback_close(snd_pcm_substream_t * substream)
 		ymfpci_close_extension(chip);
 	}
 	spin_unlock_irq(&chip->reg_lock);
-	kctl = chip->pcm_mixer[substream->number].ctl;
-	kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
-	snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_INFO, &kctl->id);
 	return snd_ymfpci_playback_close_1(substream);
 }
 
@@ -1675,66 +1665,6 @@ static snd_kcontrol_new_t snd_ymfpci_rear_shared __devinitdata = {
 	.private_value = 2,
 };
 
-/*
- * PCM voice volume
- */
-
-static int snd_ymfpci_pcm_vol_info(snd_kcontrol_t *kcontrol,
-				   snd_ctl_elem_info_t *uinfo)
-{
-	uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
-	uinfo->count = 2;
-	uinfo->value.integer.min = 0;
-	uinfo->value.integer.max = 0x8000;
-	return 0;
-}
-
-static int snd_ymfpci_pcm_vol_get(snd_kcontrol_t *kcontrol,
-				  snd_ctl_elem_value_t *ucontrol)
-{
-	ymfpci_t *chip = snd_kcontrol_chip(kcontrol);
-	unsigned int subs = kcontrol->id.subdevice;
-
-	ucontrol->value.integer.value[0] = chip->pcm_mixer[subs].left;
-	ucontrol->value.integer.value[1] = chip->pcm_mixer[subs].right;
-	return 0;
-}
-
-static int snd_ymfpci_pcm_vol_put(snd_kcontrol_t *kcontrol,
-				  snd_ctl_elem_value_t *ucontrol)
-{
-	ymfpci_t *chip = snd_kcontrol_chip(kcontrol);
-	unsigned int subs = kcontrol->id.subdevice;
-	snd_pcm_substream_t *substream;
-	unsigned long flags;
-
-	if (ucontrol->value.integer.value[0] != chip->pcm_mixer[subs].left ||
-	    ucontrol->value.integer.value[1] != chip->pcm_mixer[subs].right) {
-		chip->pcm_mixer[subs].left = ucontrol->value.integer.value[0];
-		chip->pcm_mixer[subs].right = ucontrol->value.integer.value[1];
-
-		substream = (snd_pcm_substream_t *)kcontrol->private_value;
-		spin_lock_irqsave(&chip->voice_lock, flags);
-		if (substream->runtime && substream->runtime->private_data) {
-			ymfpci_pcm_t *ypcm = substream->runtime->private_data;
-			ypcm->update_pcm_vol = 2;
-		}
-		spin_unlock_irqrestore(&chip->voice_lock, flags);
-		return 1;
-	}
-	return 0;
-}
-
-static snd_kcontrol_new_t snd_ymfpci_pcm_volume __devinitdata = {
-	.iface = SNDRV_CTL_ELEM_IFACE_PCM,
-	.name = "PCM Playback Volume",
-	.access = SNDRV_CTL_ELEM_ACCESS_READWRITE |
-		SNDRV_CTL_ELEM_ACCESS_INACTIVE,
-	.info = snd_ymfpci_pcm_vol_info,
-	.get = snd_ymfpci_pcm_vol_get,
-	.put = snd_ymfpci_pcm_vol_put,
-};
-
 
 /*
  *  Mixer routines
@@ -1756,7 +1686,6 @@ int __devinit snd_ymfpci_mixer(ymfpci_t *chip, int rear_switch)
 {
 	ac97_template_t ac97;
 	snd_kcontrol_t *kctl;
-	snd_pcm_substream_t *substream;
 	unsigned int idx;
 	int err;
 	static ac97_bus_ops_t ops = {
@@ -1810,23 +1739,6 @@ int __devinit snd_ymfpci_mixer(ymfpci_t *chip, int rear_switch)
 			return err;
 	}
 
-	/* per-voice volume */
-	substream = chip->pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream;
-	for (idx = 0; idx < 32; ++idx) {
-		kctl = snd_ctl_new1(&snd_ymfpci_pcm_volume, chip);
-		if (!kctl)
-			return -ENOMEM;
-		kctl->id.device = chip->pcm->device;
-		kctl->id.subdevice = idx;
-		kctl->private_value = (unsigned long)substream;
-		if ((err = snd_ctl_add(chip->card, kctl)) < 0)
-			return err;
-		chip->pcm_mixer[idx].left = 0x8000;
-		chip->pcm_mixer[idx].right = 0x8000;
-		chip->pcm_mixer[idx].ctl = kctl;
-		substream = substream->next;
-	}
-
 	return 0;
 }
 
diff --git a/trunk/sound/pcmcia/vx/vxpocket.c b/trunk/sound/pcmcia/vx/vxpocket.c
index 1e8f16b4c073..3a82161d3b24 100644
--- a/trunk/sound/pcmcia/vx/vxpocket.c
+++ b/trunk/sound/pcmcia/vx/vxpocket.c
@@ -297,7 +297,6 @@ static void vxpocket_config(dev_link_t *link)
 	CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
 
 	chip->dev = &handle_to_dev(link->handle);
-	snd_card_set_dev(chip->card, chip->dev);
 
 	if (snd_vxpocket_assign_resources(chip, link->io.BasePort1, link->irq.AssignedIRQ) < 0)
 		goto failed;
@@ -377,7 +376,7 @@ static int vxpocket_event(event_t event, int priority, event_callback_args_t *ar
 
 /*
  */
-static dev_link_t *vxpocket_attach(void)
+static dev_link_t *vxp_attach(void)
 {
 	snd_card_t *card;
 	struct snd_vxpocket *vxp;
@@ -408,7 +407,7 @@ static dev_link_t *vxpocket_attach(void)
 		return NULL;
 	}
 
-	vxp->index = i;
+	vxp->index = index[i];
 	card_alloc |= 1 << i;
 
 	/* Chain drivers */
@@ -418,7 +417,7 @@ static dev_link_t *vxpocket_attach(void)
 	return &vxp->link;
 }
 
-static void vxpocket_detach(dev_link_t *link)
+static void vxp_detach(dev_link_t *link)
 {
 	struct snd_vxpocket *vxp;
 	vx_core_t *chip;
@@ -459,9 +458,8 @@ static struct pcmcia_driver vxp_cs_driver = {
 	.drv		= {
 		.name	= "snd-vxpocket",
 	},
-	.attach		= vxpocket_attach,
-	.detach		= vxpocket_detach,
-	.event		= vxpocket_event,
+	.attach		= vxp_attach,
+	.detach		= vxp_detach,
 	.id_table	= vxp_ids,
 };
 
diff --git a/trunk/sound/sound_core.c b/trunk/sound/sound_core.c
index 954f994592ab..21a69e096225 100644
--- a/trunk/sound/sound_core.c
+++ b/trunk/sound/sound_core.c
@@ -153,7 +153,7 @@ static DEFINE_SPINLOCK(sound_loader_lock);
  *	list. Acquires locks as needed
  */
 
-static int sound_insert_unit(struct sound_unit **list, struct file_operations *fops, int index, int low, int top, const char *name, umode_t mode, struct device *dev)
+static int sound_insert_unit(struct sound_unit **list, struct file_operations *fops, int index, int low, int top, const char *name, umode_t mode)
 {
 	struct sound_unit *s = kmalloc(sizeof(*s), GFP_KERNEL);
 	int r;
@@ -175,7 +175,7 @@ static int sound_insert_unit(struct sound_unit **list, struct file_operations *f
 	devfs_mk_cdev(MKDEV(SOUND_MAJOR, s->unit_minor),
 			S_IFCHR | mode, s->name);
 	class_device_create(sound_class, MKDEV(SOUND_MAJOR, s->unit_minor),
-			    dev, s->name+6);
+				NULL, s->name+6);
 	return r;
 
  fail:
@@ -227,18 +227,16 @@ static void sound_remove_unit(struct sound_unit **list, int unit)
 static struct sound_unit *chains[SOUND_STEP];
 
 /**
- *	register_sound_special_device - register a special sound node
+ *	register_sound_special - register a special sound node
  *	@fops: File operations for the driver
  *	@unit: Unit number to allocate
- *      @dev: device pointer
  *
  *	Allocate a special sound device by minor number from the sound
  *	subsystem. The allocated number is returned on succes. On failure
  *	a negative error code is returned.
  */
  
-int register_sound_special_device(struct file_operations *fops, int unit,
-				  struct device *dev)
+int register_sound_special(struct file_operations *fops, int unit)
 {
 	const int chain = unit % SOUND_STEP;
 	int max_unit = 128 + chain;
@@ -296,16 +294,9 @@ int register_sound_special_device(struct file_operations *fops, int unit,
 		break;
 	}
 	return sound_insert_unit(&chains[chain], fops, -1, unit, max_unit,
-				 name, S_IRUSR | S_IWUSR, dev);
+				 name, S_IRUSR | S_IWUSR);
 }
  
-EXPORT_SYMBOL(register_sound_special_device);
-
-int register_sound_special(struct file_operations *fops, int unit)
-{
-	return register_sound_special_device(fops, unit, NULL);
-}
-
 EXPORT_SYMBOL(register_sound_special);
 
 /**
@@ -321,7 +312,7 @@ EXPORT_SYMBOL(register_sound_special);
 int register_sound_mixer(struct file_operations *fops, int dev)
 {
 	return sound_insert_unit(&chains[0], fops, dev, 0, 128,
-				 "mixer", S_IRUSR | S_IWUSR, NULL);
+				 "mixer", S_IRUSR | S_IWUSR);
 }
 
 EXPORT_SYMBOL(register_sound_mixer);
@@ -339,7 +330,7 @@ EXPORT_SYMBOL(register_sound_mixer);
 int register_sound_midi(struct file_operations *fops, int dev)
 {
 	return sound_insert_unit(&chains[2], fops, dev, 2, 130,
-				 "midi", S_IRUSR | S_IWUSR, NULL);
+				 "midi", S_IRUSR | S_IWUSR);
 }
 
 EXPORT_SYMBOL(register_sound_midi);
@@ -365,7 +356,7 @@ EXPORT_SYMBOL(register_sound_midi);
 int register_sound_dsp(struct file_operations *fops, int dev)
 {
 	return sound_insert_unit(&chains[3], fops, dev, 3, 131,
-				 "dsp", S_IWUSR | S_IRUSR, NULL);
+				 "dsp", S_IWUSR | S_IRUSR);
 }
 
 EXPORT_SYMBOL(register_sound_dsp);
@@ -384,7 +375,7 @@ EXPORT_SYMBOL(register_sound_dsp);
 int register_sound_synth(struct file_operations *fops, int dev)
 {
 	return sound_insert_unit(&chains[9], fops, dev, 9, 137,
-				 "synth", S_IRUSR | S_IWUSR, NULL);
+				 "synth", S_IRUSR | S_IWUSR);
 }
 
 EXPORT_SYMBOL(register_sound_synth);
diff --git a/trunk/sound/synth/emux/emux_synth.c b/trunk/sound/synth/emux/emux_synth.c
index 751bf1272af3..f13b038329eb 100644
--- a/trunk/sound/synth/emux/emux_synth.c
+++ b/trunk/sound/synth/emux/emux_synth.c
@@ -98,6 +98,7 @@ snd_emux_note_on(void *p, int note, int vel, snd_midi_channel_t *chan)
 		vp = emu->ops.get_voice(emu, port);
 		if (vp == NULL || vp->ch < 0)
 			continue;
+		snd_assert(vp->emu != NULL && vp->hw != NULL, return);
 		if (STATE_IS_PLAYING(vp->state))
 			emu->ops.terminate(vp);
 
diff --git a/trunk/sound/usb/usbaudio.c b/trunk/sound/usb/usbaudio.c
index 5aa5fe651a8a..8298c462c291 100644
--- a/trunk/sound/usb/usbaudio.c
+++ b/trunk/sound/usb/usbaudio.c
@@ -41,12 +41,10 @@
 #include <sound/driver.h>
 #include <linux/bitops.h>
 #include <linux/init.h>
-#include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/usb.h>
-#include <linux/vmalloc.h>
 #include <linux/moduleparam.h>
 #include <sound/core.h>
 #include <sound/info.h>
@@ -81,7 +79,7 @@ module_param_array(vid, int, NULL, 0444);
 MODULE_PARM_DESC(vid, "Vendor ID for the USB audio device.");
 module_param_array(pid, int, NULL, 0444);
 MODULE_PARM_DESC(pid, "Product ID for the USB audio device.");
-module_param(nrpacks, int, 0644);
+module_param(nrpacks, int, 0444);
 MODULE_PARM_DESC(nrpacks, "Max. number of packets per URB.");
 module_param(async_unlink, bool, 0444);
 MODULE_PARM_DESC(async_unlink, "Use async unlink mode.");
@@ -99,7 +97,7 @@ MODULE_PARM_DESC(async_unlink, "Use async unlink mode.");
 
 #define MAX_PACKS	10
 #define MAX_PACKS_HS	(MAX_PACKS * 8)	/* in high speed mode */
-#define MAX_URBS	8
+#define MAX_URBS	5	/* max. 20ms long packets */
 #define SYNC_URBS	4	/* always four urbs for sync */
 #define MIN_PACKS_URB	1	/* minimum 1 packet per urb */
 
@@ -128,10 +126,11 @@ struct audioformat {
 
 struct snd_urb_ctx {
 	struct urb *urb;
-	unsigned int buffer_size;	/* size of data buffer, if data URB */
 	snd_usb_substream_t *subs;
 	int index;	/* index for urb array */
 	int packets;	/* number of packets per urb */
+	int transfer;	/* transferred size */
+	char *buf;	/* buffer for capture */
 };
 
 struct snd_urb_ops {
@@ -166,11 +165,12 @@ struct snd_usb_substream {
 	unsigned int curframesize;	/* current packet size in frames (for capture) */
 	unsigned int fill_max: 1;	/* fill max packet size always */
 	unsigned int fmt_type;		/* USB audio format type (1-3) */
-	unsigned int packs_per_ms;	/* packets per millisecond (for playback) */
 
 	unsigned int running: 1;	/* running status */
 
+	unsigned int hwptr;			/* free frame position in the buffer (only for playback) */
 	unsigned int hwptr_done;			/* processed frame position in the buffer */
+	unsigned int transfer_sched;		/* scheduled frames since last period (for playback) */
 	unsigned int transfer_done;		/* processed frames since last period update */
 	unsigned long active_mask;	/* bitmask of active urbs */
 	unsigned long unlink_mask;	/* bitmask of unlinked urbs */
@@ -178,14 +178,13 @@ struct snd_usb_substream {
 	unsigned int nurbs;			/* # urbs */
 	snd_urb_ctx_t dataurb[MAX_URBS];	/* data urb table */
 	snd_urb_ctx_t syncurb[SYNC_URBS];	/* sync urb table */
-	char *syncbuf;				/* sync buffer for all sync URBs */
-	dma_addr_t sync_dma;			/* DMA address of syncbuf */
+	char syncbuf[SYNC_URBS * 4];	/* sync buffer; it's so small - let's get static */
+	char *tmpbuf;			/* temporary buffer for playback */
 
 	u64 formats;			/* format bitmasks (all or'ed) */
 	unsigned int num_formats;		/* number of supported audio formats (list) */
 	struct list_head fmt_list;	/* format list */
 	spinlock_t lock;
-	struct tasklet_struct start_period_elapsed;	/* for start trigger */
 
 	struct snd_urb_ops ops;		/* callbacks (must be filled at init) */
 };
@@ -312,17 +311,27 @@ static int prepare_capture_urb(snd_usb_substream_t *subs,
 			       struct urb *urb)
 {
 	int i, offs;
+	unsigned long flags;
 	snd_urb_ctx_t *ctx = (snd_urb_ctx_t *)urb->context;
 
 	offs = 0;
 	urb->dev = ctx->subs->dev; /* we need to set this at each time */
+	urb->number_of_packets = 0;
+	spin_lock_irqsave(&subs->lock, flags);
 	for (i = 0; i < ctx->packets; i++) {
 		urb->iso_frame_desc[i].offset = offs;
 		urb->iso_frame_desc[i].length = subs->curpacksize;
 		offs += subs->curpacksize;
+		urb->number_of_packets++;
+		subs->transfer_sched += subs->curframesize;
+		if (subs->transfer_sched >= runtime->period_size) {
+			subs->transfer_sched -= runtime->period_size;
+			break;
+		}
 	}
+	spin_unlock_irqrestore(&subs->lock, flags);
+	urb->transfer_buffer = ctx->buf;
 	urb->transfer_buffer_length = offs;
-	urb->number_of_packets = ctx->packets;
 #if 0 // for check
 	if (! urb->bandwidth) {
 		int bustime;
@@ -350,7 +359,6 @@ static int retire_capture_urb(snd_usb_substream_t *subs,
 	unsigned char *cp;
 	int i;
 	unsigned int stride, len, oldptr;
-	int period_elapsed = 0;
 
 	stride = runtime->frame_bits >> 3;
 
@@ -370,10 +378,6 @@ static int retire_capture_urb(snd_usb_substream_t *subs,
 		if (subs->hwptr_done >= runtime->buffer_size)
 			subs->hwptr_done -= runtime->buffer_size;
 		subs->transfer_done += len;
-		if (subs->transfer_done >= runtime->period_size) {
-			subs->transfer_done -= runtime->period_size;
-			period_elapsed = 1;
-		}
 		spin_unlock_irqrestore(&subs->lock, flags);
 		/* copy a data chunk */
 		if (oldptr + len > runtime->buffer_size) {
@@ -384,9 +388,15 @@ static int retire_capture_urb(snd_usb_substream_t *subs,
 		} else {
 			memcpy(runtime->dma_area + oldptr * stride, cp, len * stride);
 		}
+		/* update the pointer, call callback if necessary */
+		spin_lock_irqsave(&subs->lock, flags);
+		if (subs->transfer_done >= runtime->period_size) {
+			subs->transfer_done -= runtime->period_size;
+			spin_unlock_irqrestore(&subs->lock, flags);
+			snd_pcm_period_elapsed(subs->pcm_substream);
+		} else
+			spin_unlock_irqrestore(&subs->lock, flags);
 	}
-	if (period_elapsed)
-		snd_pcm_period_elapsed(subs->pcm_substream);
 	return 0;
 }
 
@@ -482,10 +492,12 @@ static int retire_playback_sync_urb_hs(snd_usb_substream_t *subs,
 /*
  * prepare urb for playback data pipe
  *
- * Since a URB can handle only a single linear buffer, we must use double
- * buffering when the data to be transferred overflows the buffer boundary.
- * To avoid inconsistencies when updating hwptr_done, we use double buffering
- * for all URBs.
+ * we copy the data directly from the pcm buffer.
+ * the current position to be copied is held in hwptr field.
+ * since a urb can handle only a single linear buffer, if the total
+ * transferred area overflows the buffer boundary, we cannot send
+ * it directly from the buffer.  thus the data is once copied to
+ * a temporary buffer and urb points to that.
  */
 static int prepare_playback_urb(snd_usb_substream_t *subs,
 				snd_pcm_runtime_t *runtime,
@@ -494,7 +506,6 @@ static int prepare_playback_urb(snd_usb_substream_t *subs,
 	int i, stride, offs;
 	unsigned int counts;
 	unsigned long flags;
-	int period_elapsed = 0;
 	snd_urb_ctx_t *ctx = (snd_urb_ctx_t *)urb->context;
 
 	stride = runtime->frame_bits >> 3;
@@ -519,83 +530,78 @@ static int prepare_playback_urb(snd_usb_substream_t *subs,
 		urb->iso_frame_desc[i].length = counts * stride;
 		offs += counts;
 		urb->number_of_packets++;
-		subs->transfer_done += counts;
-		if (subs->transfer_done >= runtime->period_size) {
-			subs->transfer_done -= runtime->period_size;
-			period_elapsed = 1;
+		subs->transfer_sched += counts;
+		if (subs->transfer_sched >= runtime->period_size) {
+			subs->transfer_sched -= runtime->period_size;
 			if (subs->fmt_type == USB_FORMAT_TYPE_II) {
-				if (subs->transfer_done > 0) {
-					/* FIXME: fill-max mode is not
-					 * supported yet */
-					offs -= subs->transfer_done;
-					counts -= subs->transfer_done;
-					urb->iso_frame_desc[i].length =
-						counts * stride;
-					subs->transfer_done = 0;
+				if (subs->transfer_sched > 0) {
+					/* FIXME: fill-max mode is not supported yet */
+					offs -= subs->transfer_sched;
+					counts -= subs->transfer_sched;
+					urb->iso_frame_desc[i].length = counts * stride;
+					subs->transfer_sched = 0;
 				}
 				i++;
 				if (i < ctx->packets) {
 					/* add a transfer delimiter */
-					urb->iso_frame_desc[i].offset =
-						offs * stride;
+					urb->iso_frame_desc[i].offset = offs * stride;
 					urb->iso_frame_desc[i].length = 0;
 					urb->number_of_packets++;
 				}
-				break;
 			}
- 		}
-		/* finish at the frame boundary at/after the period boundary */
-		if (period_elapsed &&
-		    (i & (subs->packs_per_ms - 1)) == subs->packs_per_ms - 1)
 			break;
+ 		}
 	}
-	if (subs->hwptr_done + offs > runtime->buffer_size) {
-		/* err, the transferred area goes over buffer boundary. */
-		unsigned int len = runtime->buffer_size - subs->hwptr_done;
-		memcpy(urb->transfer_buffer,
-		       runtime->dma_area + subs->hwptr_done * stride,
-		       len * stride);
-		memcpy(urb->transfer_buffer + len * stride,
-		       runtime->dma_area,
-		       (offs - len) * stride);
+	if (subs->hwptr + offs > runtime->buffer_size) {
+		/* err, the transferred area goes over buffer boundary.
+		 * copy the data to the temp buffer.
+		 */
+		int len;
+		len = runtime->buffer_size - subs->hwptr;
+		urb->transfer_buffer = subs->tmpbuf;
+		memcpy(subs->tmpbuf, runtime->dma_area + subs->hwptr * stride, len * stride);
+		memcpy(subs->tmpbuf + len * stride, runtime->dma_area, (offs - len) * stride);
+		subs->hwptr += offs;
+		subs->hwptr -= runtime->buffer_size;
 	} else {
-		memcpy(urb->transfer_buffer,
-		       runtime->dma_area + subs->hwptr_done * stride,
-		       offs * stride);
+		/* set the buffer pointer */
+		urb->transfer_buffer = runtime->dma_area + subs->hwptr * stride;
+		subs->hwptr += offs;
+		if (subs->hwptr == runtime->buffer_size)
+			subs->hwptr = 0;
 	}
-	subs->hwptr_done += offs;
-	if (subs->hwptr_done >= runtime->buffer_size)
-		subs->hwptr_done -= runtime->buffer_size;
 	spin_unlock_irqrestore(&subs->lock, flags);
 	urb->transfer_buffer_length = offs * stride;
-	if (period_elapsed) {
-		if (likely(subs->running))
-			snd_pcm_period_elapsed(subs->pcm_substream);
-		else
-			tasklet_hi_schedule(&subs->start_period_elapsed);
-	}
+	ctx->transfer = offs;
+
 	return 0;
 }
 
 /*
  * process after playback data complete
- * - nothing to do
+ *
+ * update the current position and call callback if a period is processed.
  */
 static int retire_playback_urb(snd_usb_substream_t *subs,
 			       snd_pcm_runtime_t *runtime,
 			       struct urb *urb)
 {
-	return 0;
-}
+	unsigned long flags;
+	snd_urb_ctx_t *ctx = (snd_urb_ctx_t *)urb->context;
 
-/*
- * Delay the snd_pcm_period_elapsed() call until after the start trigger
- * callback so that we're not longer in the substream's lock.
- */
-static void start_period_elapsed(unsigned long data)
-{
-	snd_usb_substream_t *subs = (snd_usb_substream_t *)data;
-	snd_pcm_period_elapsed(subs->pcm_substream);
+	spin_lock_irqsave(&subs->lock, flags);
+	subs->transfer_done += ctx->transfer;
+	subs->hwptr_done += ctx->transfer;
+	ctx->transfer = 0;
+	if (subs->hwptr_done >= runtime->buffer_size)
+		subs->hwptr_done -= runtime->buffer_size;
+	if (subs->transfer_done >= runtime->period_size) {
+		subs->transfer_done -= runtime->period_size;
+		spin_unlock_irqrestore(&subs->lock, flags);
+		snd_pcm_period_elapsed(subs->pcm_substream);
+	} else
+		spin_unlock_irqrestore(&subs->lock, flags);
+	return 0;
 }
 
 
@@ -677,42 +683,6 @@ static void snd_complete_sync_urb(struct urb *urb, struct pt_regs *regs)
 }
 
 
-/* get the physical page pointer at the given offset */
-static struct page *snd_pcm_get_vmalloc_page(snd_pcm_substream_t *subs,
-					     unsigned long offset)
-{
-	void *pageptr = subs->runtime->dma_area + offset;
-	return vmalloc_to_page(pageptr);
-}
-
-/* allocate virtual buffer; may be called more than once */
-static int snd_pcm_alloc_vmalloc_buffer(snd_pcm_substream_t *subs, size_t size)
-{
-	snd_pcm_runtime_t *runtime = subs->runtime;
-	if (runtime->dma_area) {
-		if (runtime->dma_bytes >= size)
-			return 0; /* already large enough */
-		vfree_nocheck(runtime->dma_area);
-	}
-	runtime->dma_area = vmalloc_nocheck(size);
-	if (! runtime->dma_area)
-		return -ENOMEM;
-	runtime->dma_bytes = size;
-	return 0;
-}
-
-/* free virtual buffer; may be called more than once */
-static int snd_pcm_free_vmalloc_buffer(snd_pcm_substream_t *subs)
-{
-	snd_pcm_runtime_t *runtime = subs->runtime;
-	if (runtime->dma_area) {
-		vfree_nocheck(runtime->dma_area);
-		runtime->dma_area = NULL;
-	}
-	return 0;
-}
-
-
 /*
  * unlink active urbs.
  */
@@ -854,14 +824,8 @@ static int wait_clear_urbs(snd_usb_substream_t *subs)
  */
 static snd_pcm_uframes_t snd_usb_pcm_pointer(snd_pcm_substream_t *substream)
 {
-	snd_usb_substream_t *subs;
-	snd_pcm_uframes_t hwptr_done;
-	
-	subs = (snd_usb_substream_t *)substream->runtime->private_data;
-	spin_lock(&subs->lock);
-	hwptr_done = subs->hwptr_done;
-	spin_unlock(&subs->lock);
-	return hwptr_done;
+	snd_usb_substream_t *subs = (snd_usb_substream_t *)substream->runtime->private_data;
+	return subs->hwptr_done;
 }
 
 
@@ -894,13 +858,11 @@ static int snd_usb_pcm_trigger(snd_pcm_substream_t *substream, int cmd)
 static void release_urb_ctx(snd_urb_ctx_t *u)
 {
 	if (u->urb) {
-		if (u->buffer_size)
-			usb_buffer_free(u->subs->dev, u->buffer_size,
-					u->urb->transfer_buffer,
-					u->urb->transfer_dma);
 		usb_free_urb(u->urb);
 		u->urb = NULL;
 	}
+	kfree(u->buf);
+	u->buf = NULL;
 }
 
 /*
@@ -918,9 +880,8 @@ static void release_substream_urbs(snd_usb_substream_t *subs, int force)
 		release_urb_ctx(&subs->dataurb[i]);
 	for (i = 0; i < SYNC_URBS; i++)
 		release_urb_ctx(&subs->syncurb[i]);
-	usb_buffer_free(subs->dev, SYNC_URBS * 4,
-			subs->syncbuf, subs->sync_dma);
-	subs->syncbuf = NULL;
+	kfree(subs->tmpbuf);
+	subs->tmpbuf = NULL;
 	subs->nurbs = 0;
 }
 
@@ -932,7 +893,7 @@ static int init_substream_urbs(snd_usb_substream_t *subs, unsigned int period_by
 {
 	unsigned int maxsize, n, i;
 	int is_playback = subs->direction == SNDRV_PCM_STREAM_PLAYBACK;
-	unsigned int npacks[MAX_URBS], urb_packs, total_packs, packs_per_ms;
+	unsigned int npacks[MAX_URBS], urb_packs, total_packs;
 
 	/* calculate the frequency in 16.16 format */
 	if (snd_usb_get_speed(subs->dev) == USB_SPEED_FULL)
@@ -959,40 +920,24 @@ static int init_substream_urbs(snd_usb_substream_t *subs, unsigned int period_by
 	else
 		subs->curpacksize = maxsize;
 
-	if (snd_usb_get_speed(subs->dev) == USB_SPEED_HIGH)
-		packs_per_ms = 8 >> subs->datainterval;
+	if (snd_usb_get_speed(subs->dev) == USB_SPEED_FULL)
+		urb_packs = nrpacks;
 	else
-		packs_per_ms = 1;
-	subs->packs_per_ms = packs_per_ms;
+		urb_packs = (nrpacks * 8) >> subs->datainterval;
 
+	/* allocate a temporary buffer for playback */
 	if (is_playback) {
-		urb_packs = nrpacks;
-		urb_packs = max(urb_packs, (unsigned int)MIN_PACKS_URB);
-		urb_packs = min(urb_packs, (unsigned int)MAX_PACKS);
-	} else
-		urb_packs = 1;
-	urb_packs *= packs_per_ms;
+		subs->tmpbuf = kmalloc(maxsize * urb_packs, GFP_KERNEL);
+		if (! subs->tmpbuf) {
+			snd_printk(KERN_ERR "cannot malloc tmpbuf\n");
+			return -ENOMEM;
+		}
+	}
 
 	/* decide how many packets to be used */
-	if (is_playback) {
-		unsigned int minsize;
-		/* determine how small a packet can be */
-		minsize = (subs->freqn >> (16 - subs->datainterval))
-			  * (frame_bits >> 3);
-		/* with sync from device, assume it can be 12% lower */
-		if (subs->syncpipe)
-			minsize -= minsize >> 3;
-		minsize = max(minsize, 1u);
-		total_packs = (period_bytes + minsize - 1) / minsize;
-		/* round up to multiple of packs_per_ms */
-		total_packs = (total_packs + packs_per_ms - 1)
-				& ~(packs_per_ms - 1);
-		/* we need at least two URBs for queueing */
-		if (total_packs < 2 * MIN_PACKS_URB * packs_per_ms)
-			total_packs = 2 * MIN_PACKS_URB * packs_per_ms;
-	} else {
-		total_packs = MAX_URBS * urb_packs;
-	}
+	total_packs = (period_bytes + maxsize - 1) / maxsize;
+	if (total_packs < 2 * MIN_PACKS_URB)
+		total_packs = 2 * MIN_PACKS_URB;
 	subs->nurbs = (total_packs + urb_packs - 1) / urb_packs;
 	if (subs->nurbs > MAX_URBS) {
 		/* too much... */
@@ -1011,7 +956,7 @@ static int init_substream_urbs(snd_usb_substream_t *subs, unsigned int period_by
 		subs->nurbs = 2;
 		npacks[0] = (total_packs + 1) / 2;
 		npacks[1] = total_packs - npacks[0];
-	} else if (npacks[subs->nurbs-1] < MIN_PACKS_URB * packs_per_ms) {
+	} else if (npacks[subs->nurbs-1] < MIN_PACKS_URB) {
 		/* the last packet is too small.. */
 		if (subs->nurbs > 2) {
 			/* merge to the first one */
@@ -1030,20 +975,27 @@ static int init_substream_urbs(snd_usb_substream_t *subs, unsigned int period_by
 		snd_urb_ctx_t *u = &subs->dataurb[i];
 		u->index = i;
 		u->subs = subs;
+		u->transfer = 0;
 		u->packets = npacks[i];
-		u->buffer_size = maxsize * u->packets;
 		if (subs->fmt_type == USB_FORMAT_TYPE_II)
 			u->packets++; /* for transfer delimiter */
+		if (! is_playback) {
+			/* allocate a capture buffer per urb */
+			u->buf = kmalloc(maxsize * u->packets, GFP_KERNEL);
+			if (! u->buf) {
+				release_substream_urbs(subs, 0);
+				return -ENOMEM;
+			}
+		}
 		u->urb = usb_alloc_urb(u->packets, GFP_KERNEL);
-		if (! u->urb)
-			goto out_of_memory;
-		u->urb->transfer_buffer =
-			usb_buffer_alloc(subs->dev, u->buffer_size, GFP_KERNEL,
-					 &u->urb->transfer_dma);
-		if (! u->urb->transfer_buffer)
-			goto out_of_memory;
+		if (! u->urb) {
+			release_substream_urbs(subs, 0);
+			return -ENOMEM;
+		}
+		u->urb->dev = subs->dev;
 		u->urb->pipe = subs->datapipe;
-		u->urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
+		u->urb->transfer_flags = URB_ISO_ASAP;
+		u->urb->number_of_packets = u->packets;
 		u->urb->interval = 1 << subs->datainterval;
 		u->urb->context = u;
 		u->urb->complete = snd_usb_complete_callback(snd_complete_urb);
@@ -1051,24 +1003,21 @@ static int init_substream_urbs(snd_usb_substream_t *subs, unsigned int period_by
 
 	if (subs->syncpipe) {
 		/* allocate and initialize sync urbs */
-		subs->syncbuf = usb_buffer_alloc(subs->dev, SYNC_URBS * 4,
-						 GFP_KERNEL, &subs->sync_dma);
-		if (! subs->syncbuf)
-			goto out_of_memory;
 		for (i = 0; i < SYNC_URBS; i++) {
 			snd_urb_ctx_t *u = &subs->syncurb[i];
 			u->index = i;
 			u->subs = subs;
 			u->packets = 1;
 			u->urb = usb_alloc_urb(1, GFP_KERNEL);
-			if (! u->urb)
-				goto out_of_memory;
+			if (! u->urb) {
+				release_substream_urbs(subs, 0);
+				return -ENOMEM;
+			}
 			u->urb->transfer_buffer = subs->syncbuf + i * 4;
-			u->urb->transfer_dma = subs->sync_dma + i * 4;
 			u->urb->transfer_buffer_length = 4;
+			u->urb->dev = subs->dev;
 			u->urb->pipe = subs->syncpipe;
-			u->urb->transfer_flags = URB_ISO_ASAP |
-						 URB_NO_TRANSFER_DMA_MAP;
+			u->urb->transfer_flags = URB_ISO_ASAP;
 			u->urb->number_of_packets = 1;
 			u->urb->interval = 1 << subs->syncinterval;
 			u->urb->context = u;
@@ -1076,10 +1025,6 @@ static int init_substream_urbs(snd_usb_substream_t *subs, unsigned int period_by
 		}
 	}
 	return 0;
-
-out_of_memory:
-	release_substream_urbs(subs, 0);
-	return -ENOMEM;
 }
 
 
@@ -1348,8 +1293,7 @@ static int snd_usb_hw_params(snd_pcm_substream_t *substream,
 	unsigned int channels, rate, format;
 	int ret, changed;
 
-	ret = snd_pcm_alloc_vmalloc_buffer(substream,
-					   params_buffer_bytes(hw_params));
+	ret = snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(hw_params));
 	if (ret < 0)
 		return ret;
 
@@ -1405,7 +1349,7 @@ static int snd_usb_hw_free(snd_pcm_substream_t *substream)
 	subs->cur_rate = 0;
 	subs->period_bytes = 0;
 	release_substream_urbs(subs, 0);
-	return snd_pcm_free_vmalloc_buffer(substream);
+	return snd_pcm_lib_free_pages(substream);
 }
 
 /*
@@ -1428,7 +1372,9 @@ static int snd_usb_pcm_prepare(snd_pcm_substream_t *substream)
 	subs->curframesize = bytes_to_frames(runtime, subs->curpacksize);
 
 	/* reset the pointer */
+	subs->hwptr = 0;
 	subs->hwptr_done = 0;
+	subs->transfer_sched = 0;
 	subs->transfer_done = 0;
 	subs->phase = 0;
 
@@ -1444,7 +1390,7 @@ static snd_pcm_hardware_t snd_usb_playback =
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID),
-	.buffer_bytes_max =	(256*1024),
+	.buffer_bytes_max =	(128*1024),
 	.period_bytes_min =	64,
 	.period_bytes_max =	(128*1024),
 	.periods_min =		2,
@@ -1456,7 +1402,7 @@ static snd_pcm_hardware_t snd_usb_capture =
 	.info =			(SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
 				 SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				 SNDRV_PCM_INFO_MMAP_VALID),
-	.buffer_bytes_max =	(256*1024),
+	.buffer_bytes_max =	(128*1024),
 	.period_bytes_min =	64,
 	.period_bytes_max =	(128*1024),
 	.periods_min =		2,
@@ -1848,7 +1794,6 @@ static snd_pcm_ops_t snd_usb_playback_ops = {
 	.prepare =	snd_usb_pcm_prepare,
 	.trigger =	snd_usb_pcm_trigger,
 	.pointer =	snd_usb_pcm_pointer,
-	.page =		snd_pcm_get_vmalloc_page,
 };
 
 static snd_pcm_ops_t snd_usb_capture_ops = {
@@ -1860,7 +1805,6 @@ static snd_pcm_ops_t snd_usb_capture_ops = {
 	.prepare =	snd_usb_pcm_prepare,
 	.trigger =	snd_usb_pcm_trigger,
 	.pointer =	snd_usb_pcm_pointer,
-	.page =		snd_pcm_get_vmalloc_page,
 };
 
 
@@ -2077,9 +2021,6 @@ static void init_substream(snd_usb_stream_t *as, int stream, struct audioformat
 
 	INIT_LIST_HEAD(&subs->fmt_list);
 	spin_lock_init(&subs->lock);
-	if (stream == SNDRV_PCM_STREAM_PLAYBACK)
-		tasklet_init(&subs->start_period_elapsed, start_period_elapsed,
-			     (unsigned long)subs);
 
 	subs->stream = as;
 	subs->direction = stream;
@@ -2088,6 +2029,10 @@ static void init_substream(snd_usb_stream_t *as, int stream, struct audioformat
 		subs->ops = audio_urb_ops[stream];
 	else
 		subs->ops = audio_urb_ops_high_speed[stream];
+	snd_pcm_lib_preallocate_pages(as->pcm->streams[stream].substream,
+				      SNDRV_DMA_TYPE_CONTINUOUS,
+				      snd_dma_continuous_data(GFP_KERNEL),
+				      64 * 1024, 128 * 1024);
 	snd_pcm_set_ops(as->pcm, stream,
 			stream == SNDRV_PCM_STREAM_PLAYBACK ?
 			&snd_usb_playback_ops : &snd_usb_capture_ops);
@@ -2133,6 +2078,7 @@ static void snd_usb_audio_pcm_free(snd_pcm_t *pcm)
 	snd_usb_stream_t *stream = pcm->private_data;
 	if (stream) {
 		stream->pcm = NULL;
+		snd_pcm_lib_preallocate_free_for_all(pcm);
 		snd_usb_audio_stream_free(stream);
 	}
 }
diff --git a/trunk/sound/usb/usbmidi.c b/trunk/sound/usb/usbmidi.c
index 93dedde3c428..5778a9b725ec 100644
--- a/trunk/sound/usb/usbmidi.c
+++ b/trunk/sound/usb/usbmidi.c
@@ -44,7 +44,6 @@
 #include <linux/string.h>
 #include <linux/init.h>
 #include <linux/slab.h>
-#include <linux/timer.h>
 #include <linux/usb.h>
 #include <sound/core.h>
 #include <sound/minors.h>
@@ -57,12 +56,6 @@
  */
 /* #define DUMP_PACKETS */
 
-/*
- * how long to wait after some USB errors, so that khubd can disconnect() us
- * without too many spurious errors
- */
-#define ERROR_DELAY_JIFFIES (HZ / 10)
-
 
 MODULE_AUTHOR("Clemens Ladisch <clemens@ladisch.de>");
 MODULE_DESCRIPTION("USB Audio/MIDI helper module");
@@ -107,7 +100,6 @@ struct snd_usb_midi {
 	snd_rawmidi_t* rmidi;
 	struct usb_protocol_ops* usb_protocol_ops;
 	struct list_head list;
-	struct timer_list error_timer;
 
 	struct snd_usb_midi_endpoint {
 		snd_usb_midi_out_endpoint_t *out;
@@ -149,8 +141,7 @@ struct snd_usb_midi_in_endpoint {
 	struct usbmidi_in_port {
 		snd_rawmidi_substream_t* substream;
 	} ports[0x10];
-	u8 seen_f5;
-	u8 error_resubmit;
+	int seen_f5;
 	int current_port;
 };
 
@@ -176,22 +167,14 @@ static int snd_usbmidi_submit_urb(struct urb* urb, int flags)
  */
 static int snd_usbmidi_urb_error(int status)
 {
-	switch (status) {
-	/* manually unlinked, or device gone */
-	case -ENOENT:
-	case -ECONNRESET:
-	case -ESHUTDOWN:
-	case -ENODEV:
-		return -ENODEV;
-	/* errors that might occur during unplugging */
-	case -EPROTO:    /* EHCI */
-	case -ETIMEDOUT: /* OHCI */
-	case -EILSEQ:    /* UHCI */
-		return -EIO;
-	default:
-		snd_printk(KERN_ERR "urb status %d\n", status);
-		return 0; /* continue */
-	}
+	if (status == -ENOENT)
+		return status; /* killed */
+	if (status == -EILSEQ ||
+	    status == -ECONNRESET ||
+	    status == -ETIMEDOUT)
+		return -ENODEV; /* device removed/shutdown */
+	snd_printk(KERN_ERR "urb status %d\n", status);
+	return 0; /* continue */
 }
 
 /*
@@ -235,15 +218,8 @@ static void snd_usbmidi_in_urb_complete(struct urb* urb, struct pt_regs *regs)
 		ep->umidi->usb_protocol_ops->input(ep, urb->transfer_buffer,
 						   urb->actual_length);
 	} else {
-		int err = snd_usbmidi_urb_error(urb->status);
-		if (err < 0) {
-			if (err != -ENODEV) {
-				ep->error_resubmit = 1;
-				mod_timer(&ep->umidi->error_timer,
-					  jiffies + ERROR_DELAY_JIFFIES);
-			}
+		if (snd_usbmidi_urb_error(urb->status) < 0)
 			return;
-		}
 	}
 
 	if (usb_pipe_needs_resubmit(urb->pipe)) {
@@ -260,13 +236,8 @@ static void snd_usbmidi_out_urb_complete(struct urb* urb, struct pt_regs *regs)
 	ep->urb_active = 0;
 	spin_unlock(&ep->buffer_lock);
 	if (urb->status < 0) {
-		int err = snd_usbmidi_urb_error(urb->status);
-		if (err < 0) {
-			if (err != -ENODEV)
-				mod_timer(&ep->umidi->error_timer,
-					  jiffies + ERROR_DELAY_JIFFIES);
+		if (snd_usbmidi_urb_error(urb->status) < 0)
 			return;
-		}
 	}
 	snd_usbmidi_do_output(ep);
 }
@@ -305,24 +276,6 @@ static void snd_usbmidi_out_tasklet(unsigned long data)
 	snd_usbmidi_do_output(ep);
 }
 
-/* called after transfers had been interrupted due to some USB error */
-static void snd_usbmidi_error_timer(unsigned long data)
-{
-	snd_usb_midi_t *umidi = (snd_usb_midi_t *)data;
-	int i;
-
-	for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
-		snd_usb_midi_in_endpoint_t *in = umidi->endpoints[i].in;
-		if (in && in->error_resubmit) {
-			in->error_resubmit = 0;
-			in->urb->dev = umidi->chip->dev;
-			snd_usbmidi_submit_urb(in->urb, GFP_ATOMIC);
-		}
-		if (umidi->endpoints[i].out)
-			snd_usbmidi_do_output(umidi->endpoints[i].out);
-	}
-}
-
 /* helper function to send static data that may not DMA-able */
 static int send_bulk_static_data(snd_usb_midi_out_endpoint_t* ep,
 				 const void *data, int len)
@@ -641,20 +594,17 @@ static void snd_usbmidi_emagic_finish_out(snd_usb_midi_out_endpoint_t* ep)
 static void snd_usbmidi_emagic_input(snd_usb_midi_in_endpoint_t* ep,
 				     uint8_t* buffer, int buffer_length)
 {
-	int i;
-
-	/* FF indicates end of valid data */
-	for (i = 0; i < buffer_length; ++i)
-		if (buffer[i] == 0xff) {
-			buffer_length = i;
-			break;
-		}
+	/* ignore padding bytes at end of buffer */
+	while (buffer_length > 0 && buffer[buffer_length - 1] == 0xff)
+		--buffer_length;
 
 	/* handle F5 at end of last buffer */
 	if (ep->seen_f5)
 		goto switch_port;
 
 	while (buffer_length > 0) {
+		int i;
+
 		/* determine size of data until next F5 */
 		for (i = 0; i < buffer_length; ++i)
 			if (buffer[i] == 0xf5)
@@ -721,10 +671,6 @@ static void snd_usbmidi_emagic_output(snd_usb_midi_out_endpoint_t* ep)
 				break;
 		}
 	}
-	if (buf_free < ep->max_transfer && buf_free > 0) {
-		*buf = 0xff;
-		--buf_free;
-	}
 	ep->urb->transfer_buffer_length = ep->max_transfer - buf_free;
 }
 
@@ -819,10 +765,7 @@ static snd_rawmidi_ops_t snd_usbmidi_input_ops = {
 static void snd_usbmidi_in_endpoint_delete(snd_usb_midi_in_endpoint_t* ep)
 {
 	if (ep->urb) {
-		usb_buffer_free(ep->umidi->chip->dev,
-				ep->urb->transfer_buffer_length,
-				ep->urb->transfer_buffer,
-				ep->urb->transfer_dma);
+		kfree(ep->urb->transfer_buffer);
 		usb_free_urb(ep->urb);
 	}
 	kfree(ep);
@@ -856,8 +799,7 @@ static int snd_usbmidi_in_endpoint_create(snd_usb_midi_t* umidi,
 	else
 		pipe = usb_rcvbulkpipe(umidi->chip->dev, ep_info->in_ep);
 	length = usb_maxpacket(umidi->chip->dev, pipe, 0);
-	buffer = usb_buffer_alloc(umidi->chip->dev, length, GFP_KERNEL,
-				  &ep->urb->transfer_dma);
+	buffer = kmalloc(length, GFP_KERNEL);
 	if (!buffer) {
 		snd_usbmidi_in_endpoint_delete(ep);
 		return -ENOMEM;
@@ -870,7 +812,6 @@ static int snd_usbmidi_in_endpoint_create(snd_usb_midi_t* umidi,
 		usb_fill_bulk_urb(ep->urb, umidi->chip->dev, pipe, buffer, length,
 				  snd_usb_complete_callback(snd_usbmidi_in_urb_complete),
 				  ep);
-	ep->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
 
 	rep->in = ep;
 	return 0;
@@ -891,10 +832,10 @@ static unsigned int snd_usbmidi_count_bits(unsigned int x)
  */
 static void snd_usbmidi_out_endpoint_delete(snd_usb_midi_out_endpoint_t* ep)
 {
+	if (ep->tasklet.func)
+		tasklet_kill(&ep->tasklet);
 	if (ep->urb) {
-		usb_buffer_free(ep->umidi->chip->dev, ep->max_transfer,
-				ep->urb->transfer_buffer,
-				ep->urb->transfer_dma);
+		kfree(ep->urb->transfer_buffer);
 		usb_free_urb(ep->urb);
 	}
 	kfree(ep);
@@ -926,8 +867,7 @@ static int snd_usbmidi_out_endpoint_create(snd_usb_midi_t* umidi,
 	/* we never use interrupt output pipes */
 	pipe = usb_sndbulkpipe(umidi->chip->dev, ep_info->out_ep);
 	ep->max_transfer = usb_maxpacket(umidi->chip->dev, pipe, 1);
-	buffer = usb_buffer_alloc(umidi->chip->dev, ep->max_transfer,
-				  GFP_KERNEL, &ep->urb->transfer_dma);
+	buffer = kmalloc(ep->max_transfer, GFP_KERNEL);
 	if (!buffer) {
 		snd_usbmidi_out_endpoint_delete(ep);
 		return -ENOMEM;
@@ -935,7 +875,6 @@ static int snd_usbmidi_out_endpoint_create(snd_usb_midi_t* umidi,
 	usb_fill_bulk_urb(ep->urb, umidi->chip->dev, pipe, buffer,
 			  ep->max_transfer,
 			  snd_usb_complete_callback(snd_usbmidi_out_urb_complete), ep);
-	ep->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
 
 	spin_lock_init(&ep->buffer_lock);
 	tasklet_init(&ep->tasklet, snd_usbmidi_out_tasklet, (unsigned long)ep);
@@ -979,11 +918,8 @@ void snd_usbmidi_disconnect(struct list_head* p)
 	int i;
 
 	umidi = list_entry(p, snd_usb_midi_t, list);
-	del_timer_sync(&umidi->error_timer);
 	for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
 		snd_usb_midi_endpoint_t* ep = &umidi->endpoints[i];
-		if (ep->out)
-			tasklet_kill(&ep->out->tasklet);
 		if (ep->out && ep->out->urb) {
 			usb_kill_urb(ep->out->urb);
 			if (umidi->usb_protocol_ops->finish_out_endpoint)
@@ -1544,9 +1480,6 @@ int snd_usb_create_midi_interface(snd_usb_audio_t* chip,
 	umidi->iface = iface;
 	umidi->quirk = quirk;
 	umidi->usb_protocol_ops = &snd_usbmidi_standard_ops;
-	init_timer(&umidi->error_timer);
-	umidi->error_timer.function = snd_usbmidi_error_timer;
-	umidi->error_timer.data = (unsigned long)umidi;
 
 	/* detect the endpoint(s) to use */
 	memset(endpoints, 0, sizeof(endpoints));
diff --git a/trunk/sound/usb/usx2y/usx2yhwdeppcm.c b/trunk/sound/usb/usx2y/usx2yhwdeppcm.c
index d0199c4e5551..ef28061287f2 100644
--- a/trunk/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/trunk/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -624,7 +624,7 @@ static int usX2Y_pcms_lock_check(snd_card_t *card)
 		for (s = 0; s < 2; ++s) {
 			snd_pcm_substream_t *substream;
 			substream = pcm->streams[s].substream;
-			if (substream && substream->ffile != NULL)
+			if (substream && substream->open_flag)
 				err = -EBUSY;
 		}
 	}