fishHEADmaster

365 files changed, 85438 insertions, 0 deletions

diff --git a/target/linux/generic/patches-3.3/.svn/entries b/target/linux/generic/patches-3.3/.svn/entries
new file mode 100644
index 0000000..85369b6
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/entries
@@ -0,0 +1,6216 @@
+10
+
+dir
+36060
+svn://svn.openwrt.org/openwrt/trunk/target/linux/generic/patches-3.3
+svn://svn.openwrt.org/openwrt
+
+
+
+2013-02-07T15:18:24.611561Z
+35510
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+3c298f89-4303-0410-b956-a3cf2f4a3e73
+
+950-vm_exports.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f536de24e062a34745be4448c58b95ea
+2012-05-07T20:11:43.407770Z
+31645
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+3171
+
+970-remove-unsane-filenames-from-deps_initramfs-list.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+02c52bda742035a6f4aa6fdaa205239f
+2012-11-09T09:07:29.139830Z
+34125
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1209
+
+811-pci_disable_usb_common_quirks.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+d03c2e0565485eccd719eb7d8c084a5d
+2012-08-15T13:26:51.260638Z
+33193
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1203
+
+270-regmap_dynamic.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+ec5c2c5102afd459bd276aa9b8749a99
+2013-01-06T10:01:53.581634Z
+35018
+blogic
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+982
+
+600-netfilter_layer7_2.22.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+945f1e015ea57cfc4e0be440645161f9
+2012-05-03T09:43:10.450009Z
+31566
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+58384
+
+330-mips-add-crash-and-kdump-support.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+1fe083bdc73ef95934b30ddcf682971a
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+15864
+
+880-gateworks_system_controller.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+326b96261a2d29ccba938e53b2ded3af
+2012-10-11T07:59:06.118096Z
+33720
+kaloz
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+10779
+
+110-fix_mtd_include.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+acc317717bcbf6b68397eaf37e3bd1a9
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+232
+
+653-disable_netlink_trim.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+dc7a30a9663e5be408915534e6b13518
+2012-06-05T13:40:38.567802Z
+32059
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+572
+
+210-darwin_scripts_include.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f7e08918f3ffc9901a829d5108824c1f
+2012-12-02T15:26:19.609271Z
+34449
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+136107
+
+864-gpiommc_configfs_locking.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+2d3b76ce7ecaa45908d446b47874c885
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1388
+
+750-hostap_txpower.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+2e810bd5dc717b79c241938028a4364b
+2012-05-07T20:11:43.407770Z
+31645
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+5257
+
+862-gpio_spi_driver.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+c079e36e0e5a756f5ca954d31132bfa8
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+10159
+
+334-mips-fix-compiling-failure-of-relocate_kernel.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+34bd07c103a097fcda8fe5331a220edf
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2624
+
+921-use_preinit_as_init.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+2584fa167a76fd2652f10a5588c99d6a
+2012-06-05T13:40:38.567802Z
+32059
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+489
+
+253-ssb_b43_default_on.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+4ac05649904639dbbcdbb13549051124
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+524
+
+331-mips-kexec-enhanche-the-support.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+665b92f8456c4f88f4d7c7f891e34fdd
+2013-01-29T09:44:58.278782Z
+35366
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+5271
+
+304-mips_disable_fpu.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+2e8ae81ac5d0869c938264a91bf2efdc
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4180
+
+220-module_exports.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+cf93592f8cafce23256804fb559bf11c
+2012-12-02T17:42:17.357328Z
+34458
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2813
+
+930-crashlog.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+4fab7d15363342a7b656e5f92bcd1ca6
+2013-02-01T17:28:44.275573Z
+35435
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+7344
+
+870-hifn795x_byteswap.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+723f63b588c4efe08438f3abad2f90e0
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+539
+
+840-rtc7301.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+8ef52ba502dd09bf2580b5ffa71c79d1
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+6403
+
+309-mips_fuse_workaround.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+41aacd84f222bec757aca531a61f045e
+2012-06-16T21:06:33.498535Z
+32395
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+924
+
+601-netfilter_layer7_pktmatch.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+2858e248f8cf8c296fcfe1d414d8a038
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+3865
+
+084-x86_fix_perf_uclibc_build.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+d4c4e6965eb3fdb3319ed525807af7a9
+2012-12-14T08:47:39.399786Z
+34676
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+762
+
+070-gpio-add-flags-to-export-GPIOs-when-requesting.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+c122439b4849976459389ab8222d31fe
+2012-11-05T11:04:43.565620Z
+34081
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2212
+
+726-phy_rtl8366.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+773a67f8d52044b2104450c66e7a2583
+2012-05-27T17:09:43.228414Z
+31915
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1266
+
+630-packet_socket_type.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f67baf8ab9e98b76dd196eefefb4931f
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+3640
+
+430-mtd_myloader_partition_parser.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+c8fee1357de5d38d12a06797c768dbfe
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1351
+
+651-wireless_mesh_header.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+543bed5d83d9d5e2846d3a1fc0d40997
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+327
+
+308-mips-show-correct-cpu-name-for-24KEc.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+b73b91b310ca66f6c89cb556af8e6a7e
+2012-03-11T16:39:30.064896Z
+30881
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+463
+
+861-04_spi_gpio_implement_spi_delay.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+57f7d34bbcad54af1302329540da6a2d
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1754
+
+250-netfilter_depends.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+82ba8812d3c495fcaa2d867b4f620d57
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+582
+
+865-gpiopwm.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+129eb7b0179972db9dd1921b2c8ede15
+2012-07-29T11:53:06.572245Z
+32905
+blogic
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+527
+
+604-netfilter_conntrack_flush.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+17ee5344d840c99679a9deaf64a47750
+2013-01-27T19:02:38.582079Z
+35330
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1121
+
+603-netfilter_layer7_2.6.36_fix.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+50ebe16a4c5de327af80e78f2540e23f
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2029
+
+710-phy-add-mdio_register_board_info.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+198a1e8b6aeade2af8f5174502bb9f1d
+2013-02-07T15:18:24.611561Z
+35510
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4999
+
+831-ledtrig_netdev.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+b4b25597854be6abb27c6d2986b8b4d2
+2012-05-07T20:11:43.407770Z
+31645
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1664
+
+440-block2mtd_init.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+4ad0c8e223b217ae44f20edcbc5688a4
+2012-04-17T12:51:02.656858Z
+31336
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+3570
+
+611-netfilter_match_bypass_default_table.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+0855b6aadaf5e63cfde824eddf62a846
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2446
+
+420-redboot_space.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+4bd2d480c28f4c4a8d6ba84d316795a8
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+968
+
+503-yaffs-Replace-yaffs_dir_llseek-with-Linux-generic-ll.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+796470ad9b54d6606c71fac73c5bbf9d
+2012-10-31T15:12:45.706176Z
+34032
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1864
+
+940-ocf_kbuild_integration.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+1781273b8ad700db2c25acf80d9ff43d
+2012-03-03T14:10:27.322588Z
+30800
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+480
+
+994-mpcore_wdt_fix_timer_mode_setup.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+04a80e88bb3c6cc214ee38cefc4b0ab6
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1892
+
+045-codel-use-u16-field-instead-of-31bits-for-rec_inv_sq.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+93238fbf20faecb8bd6bdb98f95823bf
+2012-09-26T14:17:17.327410Z
+33560
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2997
+
+900-slab_maxsize.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+6274eb0489d4dcb6b2c4bb4e6550cbfc
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+562
+
+400-rootfs_split.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+fe4a128d5010d6af3d2eed3094bc29ca
+2012-02-11T17:43:06.055983Z
+30456
+kaloz
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+9207
+
+641-bridge_always_accept_eap.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+e6b77e129bd030bab92dc6555c21f8ec
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+337
+
+476-mtd-m25p80-allow-to-disable-small-sector-erase.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+189bc433816a8d11105efaa513a7e15a
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1242
+
+473-mtd_m25p80_add_w25q128.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+68cca8812d4e3e6652d232302c58af55
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+469
+
+301-mips_image_cmdline_hack.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+b26f848b9d9bb0552657d6cdb7b2b684
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+575
+
+212-x86_reloc_portability.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+5e306ff30d3802e832ecdb5c34f87383
+2012-07-20T12:28:50.121061Z
+32783
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+463
+
+801-usb-ehci-multiple-platform-driver-fix.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+a989a4c8300f72754b1797794b61a04c
+2013-01-17T13:54:14.763730Z
+35194
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1342
+
+470-mtd_m25p80_add_pm25lv_flash_support.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+c876c9e72910efd4c4a56e008709b969
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1588
+
+060-hso_devices.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+0fca54a9f06da78f19fecb4231001288
+2012-10-13T06:58:42.064352Z
+33743
+kaloz
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1134
+
+508-yaffs-3.3-use-mtd_-helpers.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f575626a37beded8b52cc7c22ec437b9
+2012-10-31T21:17:30.050143Z
+34046
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4840
+
+006-arm_kernel_xz_support.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+31f7f12151c5d04464673ca2e94726d6
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+3120
+
+602-netfilter_layer7_match.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+e5a53063930b359add808c2d97efd067
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1587
+
+541-ubifs-xz-decompression-support.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+44a66492824c4de233582c913b37f4d6
+2013-01-02T08:53:07.682684Z
+34959
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2323
+
+303-mips_fix_kexec.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+55d5cf2907f164470ef5c5f27544dfd8
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+409
+
+130-pppoatm-queue-depth.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+ba9de7de521d9d2e0a3184550375e252
+2012-04-17T12:51:02.656858Z
+31336
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+7649
+
+800-usb-ohci-multiple-platform-driver-fix.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+bef276ac21c4cc4114baa0262218d815
+2013-01-17T13:54:14.763730Z
+35194
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1356
+
+863-gpiommc.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+630ba876cd2a11840f86d5130cfc3056
+2012-03-20T15:55:07.684186Z
+31047
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+23004
+
+612-netfilter_match_reduce_memory_access.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+292b1b9ab4c810851556e28d1af7cf09
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+607
+
+910-kobject_uevent.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+82d4deec9faad2e87a089d1286d9fe80
+2012-04-09T14:48:56.243549Z
+31223
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+427
+
+920-unable_to_open_console.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+5541517d27efe82b84f1bbfe36f75ea8
+2012-06-05T13:40:38.567802Z
+32059
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+425
+
+460-cfi_cmdset_0002_no_erase_suspend.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+244d98776610c50607647af6b528affd
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+432
+
+046-fq_codel-qdisc-backlog.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+ba0072feeecacebc44d9b0050a24b170
+2012-09-26T14:17:17.327410Z
+33560
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4599
+
+255-lib80211_kconfig_hacks.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+bb112d6dde4bf04abc4a02b3d4aaf013
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+416
+
+256-crypto_add_kconfig_prompts.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+98a633c9139d26cbabe610fafdd1b565
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+889
+
+650-pppoe_header_pad.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+d217f07d638a7b7af5c35cd9df9610aa
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+590
+
+020-ssb_update.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+03e80cf3e396ed0b1b0a538510ac44be
+2013-01-10T14:05:18.584555Z
+35080
+hauke
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+61351
+
+502-yaffs-Switch-from-semaphores-to-mutexes.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+972e7cadfcdbc6846557ae093f83a2c5
+2012-10-30T21:16:24.235389Z
+34021
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4459
+
+980-arm_openwrt_machtypes.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+34269240e565b5bae09190c34a7c7a74
+2012-11-11T21:04:30.981243Z
+34165
+kaloz
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1321
+
+507-yaffs-3.3_fix.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+376cfdfa1a6bc49b7370ec87bda8d3b6
+2012-10-31T19:33:12.973442Z
+34041
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2709
+
+642-bridge_port_isolate.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+08d5b9dc5daaa8849e3d68fee0f36a46
+2012-04-30T08:38:11.893723Z
+31541
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+3261
+
+655-increase_skb_pad.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+aeb7931e8cb3d6821c526a37a6bd7129
+2012-05-27T14:43:58.196509Z
+31886
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+384
+
+820-usb_add_usb_find_device_by_name.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+d5b9095d622734b7c9f7959de5bcc65e
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2549
+
+061-fq_codel-dont-reinit-flow-state.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+46596f83b2d38d6db46270249b011def
+2012-10-21T21:30:30.926950Z
+33887
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1192
+
+060-tcp-ecn-dont-delay-ACKS-after-CE.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+241654e33bc983d72fdfadccc048c4bc
+2012-10-21T21:30:30.926950Z
+33887
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2077
+
+251-sound_kconfig.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+98bb580342da5b3106494678c77ef752
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+200
+
+051-rng_git_backport-remove_irqf_sample_random.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+07fca8ca7fd2fa63540afdd5c6a661e0
+2012-09-26T12:54:01.573339Z
+33559
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+17643
+
+530-jffs2_make_lzma_available.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f4a0b8e79c003336bc2be554a16c466e
+2012-11-01T11:07:16.389251Z
+34053
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+143944
+
+941-ocf_20120127.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+5650b04619d426f858cec331e5866172
+2012-09-26T12:54:01.573339Z
+33559
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+5224
+
+477-mtd-m25p80-add-support-for-the-EON-EN25Q64-chip.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+7e753f3e914840f16e366e6f6310c748
+2012-08-26T09:27:56.787917Z
+33275
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+449
+
+500-yaffs-Kbuild-integration.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+7055363c4fc0c070c7647db68f477cf4
+2012-10-30T21:16:21.553350Z
+34019
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+447
+
+505-yaffs-3.2-use-MTD_OPS_AUTO_OOB.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+05e2f052e8aacff38404f4d9d6a6af83
+2012-10-31T19:33:12.973442Z
+34041
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1722
+
+083-USB-EHCI-platform-remove-update.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f5527eadc6e3acb26a16091ee0123156
+2012-12-05T14:18:05.433250Z
+34501
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+336
+
+644-bridge_optimize_netfilter_hooks.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+42df20bb3cbd543a1b06e776cff5d681
+2012-04-30T08:38:11.893723Z
+31541
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4481
+
+202-reduce_module_size.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+5797ebedd17d1371fe5774b794d71ffc
+2012-05-27T21:02:36.461167Z
+31924
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+487
+
+540-crypto-xz-decompression-support.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+ee3f1c870e51ffe7ac80f1fc8b1e8c09
+2012-03-03T14:10:27.322588Z
+30800
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+3554
+
+102-ehci_hcd_ignore_oc.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+0ace33328f6e86c7d01e435f0fe125ce
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1529
+
+257-wireless_ext_kconfig_hack.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+27dba7a60b5bb2bf5e534802bb92937c
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+380
+
+050-rng_git_backport.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+1b0f2f8821358ac8eb8705f9947e534f
+2012-09-26T12:54:01.573339Z
+33559
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+23589
+
+a03-swconfig-revert-UAPI-disintegration.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+3b8752e54d0892fb44adbd65389a239f
+2012-12-14T12:11:41.962184Z
+34677
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1985
+
+702-phy_add_aneg_done_function.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f91d852680335f2618321b057cd49a2c
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1184
+
+258-netfilter_netlink_kconfig_hack.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+31f797c3286306ad971009f3e74b1cc4
+2012-03-12T00:09:23.724835Z
+30894
+jow
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+315
+
+252-mv_cesa_depends.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+43d7479f3fda39c8ae2492ce0c926fd6
+2012-05-23T21:05:32.389936Z
+31848
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+248
+
+306-mips_mem_functions_performance.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+341ca2bf85450fe738e6d8e9533e1e40
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2238
+
+a01-swconfig_leds-define-leds_set_brightness.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+e4ad50aa3da95eb2e0ae7e42789b495c
+2012-10-26T18:58:18.388458Z
+33946
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+346
+
+643-bridge_remove_ipv6_dependency.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+5a636ab1a1fc5409e8f9a0d4594f752f
+2012-03-12T17:32:38.404634Z
+30908
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+3263
+
+450-mtd_plat_nand_chip_fixup.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+81af90db45f0285b4fcfd47b4c1c35b1
+2012-04-25T12:57:29.264138Z
+31473
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+925
+
+340-module_alloc_size_check.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+05218411b9eac84997fbfbcfd6d45063
+2012-03-05T13:29:54.823459Z
+30819
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+449
+
+475-mtd_cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+dc98b1dc5fdc965fd43d5c3c7575d525
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+556
+
+321-powerpc_crtsavres_prereq.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+07eb0ea195dea68d0873c0014694912c
+2012-03-05T13:29:54.823459Z
+30819
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+231
+
+230-openwrt_lzma_options.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+6b79bd428f3810162bee03f8ae3e13a2
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2055
+
+613-netfilter_optional_tcp_window_check.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+5edeaede8f67e5f1b634b415f7211dba
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1163
+
+410-mtd_info_move_forward_decl.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f0857e6b2997263b789abe929843117f
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+403
+
+401-partial_eraseblock_write.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f2d295b1652a21bcd32b65b1316aef2e
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4416
+
+048-spi-Dont-call-prepare-unprepare-transfer-if-not-popu.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+39364902d89e8e955b0a0e33a72152ec
+2012-07-03T21:42:03.728501Z
+32590
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1600
+
+830-ledtrig_morse.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+0abbeb308c308a3e733f2f10d7a200c1
+2012-05-07T20:11:43.407770Z
+31645
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+922
+
+620-sched_esfq.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+83d141cdc177c3bb765924fdb5cf7401
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+21049
+
+810-pci_disable_common_quirks.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+eb231891ccb8a6d0187a7f6691ea8de4
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1563
+
+047-spi_message_queue.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+f5aa00ea3ef84013900c591dccbb4a92
+2012-06-06T13:31:30.908753Z
+32077
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+19369
+
+041-codel-use-Newton-method-instead-of-sqrt-and-divides.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+fbe97b1bed1f03c98c5b74751236c3ff
+2012-09-26T14:17:17.327410Z
+33560
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+5943
+
+725-phy_rtl8306.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+4032b658b88915025e63718ed922b4f9
+2012-05-06T21:19:14.517590Z
+31637
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+755
+
+960-decompress_unlzo_fix.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+402f499ae030406a76ba48b0d7817f0b
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+423
+
+442-block2mtd_probe.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+4cfe05bfe69993f0de13e04de0977ed8
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+376
+
+610-netfilter_match_bypass_default_checks.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+bb88bcd4faefce4faefff868d384e50e
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2555
+
+721-phy_packets.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+7c3b2fd012a61a8cafb0176ba555dc73
+2012-09-30T11:45:53.797929Z
+33602
+hauke
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4902
+
+700-swconfig.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+eb9adff1604ed7b14f114ab74755d6b6
+2012-12-14T12:11:48.415191Z
+34678
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1035
+
+307-mips_oprofile_fix.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+d55462a87148ed01823ec5b6a6f4f70e
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+900
+
+720-phy_adm6996.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+fd23646fb4e4139021f1901e4b183956
+2012-03-15T09:25:49.935976Z
+30945
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+862
+
+654-avoid_skb_cow_realloc.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+e0538aef516c94ffaee3a6e4fe7d5240
+2012-05-27T15:16:37.537359Z
+31906
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+679
+
+728-phy-micrel.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+339f4635d375f7f015f468dd0c7a276e
+2012-05-06T21:19:14.517590Z
+31637
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+812
+
+300-mips_expose_boot_raw.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+8e307f545ce2884a12e9cdbe769a2952
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+884
+
+310-arm_module_unresolved_weak_sym.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+db64b575845041d2bf68fb876246de0c
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+354
+
+335-mips-kexec-cleanup-kexec-tools-parameter-handling.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+a2bd142706dffd3dc3f5d49b11ffd52d
+2013-01-29T09:44:58.278782Z
+35366
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4967
+
+320-ppc4xx_optimization.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+7105b9a52931686891f448f244a5cd9c
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1183
+
+049-codel-refine-one-condition-to-avoid-a-nul-rec_inv_sqrt.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+c05d4da822fb197e3a459e6ca0124ffd
+2012-09-26T14:17:17.327410Z
+33560
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1875
+
+531-debloat_lzma.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+db19a5cd0cfaf331b09fc045fa161fd4
+2012-11-01T11:07:16.389251Z
+34053
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+16924
+
+850-glamo_headers.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+7f4583bc1ada309ef95163f1ec8b4ea2
+2012-11-06T15:21:46.466031Z
+34103
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+837
+
+727-phy-rtl8367.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+33d339de55e6ae1a6f87e19847dd8498
+2012-05-27T17:09:43.228414Z
+31915
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+726
+
+992-mpcore_wdt_fix_watchdog_counter_loading.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+dfe2dd5b5471eb4ec792633c96d0531e
+2012-05-07T20:11:43.407770Z
+31645
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2363
+
+506-yaffs-3.2-dont-use-i_nlink-directly.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+66b78b07541989a0c4a8b1591d8327db
+2012-10-31T19:33:12.973442Z
+34041
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2236
+
+993-mpcore_wdt_fix_wdioc_setoptions_handling.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+8ebe8b1409de5b9764d3fe31ce2f2cd2
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1090
+
+832-ledtrig_usbdev.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+18e9c2afeeba0233839b0cedc36c0544
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1036
+
+550-ubifs-symlink-xattr-support.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+2f070674a175bd9250ab0c9af4c10290
+2012-03-03T14:10:27.322588Z
+30800
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2098
+
+841-rtc_pt7c4338.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+900238b6a6e9223e9c970359c5635158
+2012-04-29T16:56:03.295411Z
+31531
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+7095
+
+332-mips-kexec-init-the-arguments-for-the-new-kernel-image.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+6768011956fec869ccc72a98551ade71
+2013-01-29T09:44:58.278782Z
+35366
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1574
+
+302-mips_use_generic_thread_info_allocator.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+ea6c274c071243e08c1356e34072bb66
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+423
+
+080-prot-release-cb.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+054e6603c42e27f1839c9a2faf83c570
+2012-12-06T22:39:43.120900Z
+34548
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+822
+
+254-textsearch_kconfig_hacks.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+783989a1d6dc901ce811cff8a6437326
+2012-02-11T17:43:06.055983Z
+30456
+kaloz
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+401
+
+025-bcma_backport.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+5d5936d2944b2484561a18e5f0b10b1b
+2013-01-10T14:05:18.584555Z
+35080
+hauke
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+162975
+
+652-atm_header_changes.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+254d0d09a625c63ce9bdfa891daa10e6
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+562
+
+082-USB-EHCI-Add-a-generic-platform-device-driver.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+df5286816e40b1f5e8b9f3ccc89d3b83
+2012-12-05T14:18:05.433250Z
+34501
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+7826
+
+100-overlayfs_v12.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+756a63aeaa4170fffa2fd10bda7aa06a
+2012-04-30T08:38:11.893723Z
+31541
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+82189
+
+132-solos-dma.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+43804f6e44d62c47b36d6e4f0eb34bb7
+2012-12-21T10:38:33.156421Z
+34813
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+14750
+
+723-phy_ip175c.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+a60350d35bd82d5c606c02aec6151dfc
+2012-05-06T21:19:14.517590Z
+31637
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+775
+
+333-mips-kexec-get-kernel-parameters-from-kexec-tools.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+1b1ffe4c693b3e742d09d62226804918
+2013-01-29T09:44:58.278782Z
+35366
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2674
+
+081-USB-OHCI-Add-a-generic-platform-device-driver.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+3d2c863640fcd91ca84e3e69160ff276
+2012-12-05T14:18:05.433250Z
+34501
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+7041
+
+520-squashfs_update_xz_comp_opts.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+13a7284ba20aefeaa92b207416b8ee4e
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+697
+
+a02-swconfig-revert-portid-snd_portid-usage.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+5148d237feb32282850b5316983d5388
+2012-11-21T17:38:11.702804Z
+34288
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1002
+
+501-yaffs-Fix-directory-unlinking-in-yaffs1-mode.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+e8d47f7243cc81cec5d87cc7daef4d8e
+2012-10-30T21:16:23.177937Z
+34020
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1040
+
+044-net-codel-fix-build-errors.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+c6d642299e83971f7a11ae88fb927754
+2012-09-26T14:17:17.327410Z
+33560
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2349
+
+043-net-codel-Add-missing-include-linux-prefetch.h.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+571d6511be8b056f40c2ade079b18def
+2012-09-26T14:17:17.327410Z
+33560
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1033
+
+724-phy_ar8216.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+a88eefd95128704fccbaceaef8de4066
+2012-05-06T21:19:14.517590Z
+31637
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+796
+
+040-Controlled-Delay-AQM.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+aae1236ea103422f504173fd1437a0dc
+2012-09-26T14:17:17.327410Z
+33560
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+23022
+
+322-ppc4xx-crypto-compile-fix.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+d0789a636be99fb3112af8e67c2515fe
+2012-04-21T10:47:04.541249Z
+31394
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+257
+
+729-phy-tantos.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+1b7ab89096912873499af4e8eabad810
+2012-10-21T21:30:30.926950Z
+33887
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+741
+
+504-yaffs-Mods-for-Linux-3.0-and-fix-a-typo.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+e434636d5a075567f14598a4dd30d864
+2012-10-31T15:12:45.706176Z
+34032
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4104
+
+703-phy-add-detach-callback-to-struct-phy_driver.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+58dd65220911613a3dae67530ff717dc
+2013-02-07T15:18:24.611561Z
+35510
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+682
+
+201-extra_optimization.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+e34938f7d4cf9fe8bc185a9b0f0bee7f
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+675
+
+443-block2mtd-avoid-recursive-call-of-mtd_writev.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+48efecee4b32560ef97cf96c6cdf9d6f
+2012-05-23T21:05:19.527349Z
+31841
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+364
+
+722-phy_mvswitch.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+9690fa52b5bc7c1ed8b4136309bbd463
+2012-05-06T21:19:14.517590Z
+31637
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+814
+
+131-atm-fixes.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+08c8ea50bb1a863c2e4cbb44c61008f0
+2012-12-02T13:04:04.975253Z
+34443
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+31874
+
+701-phy_extension.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+93edfa3eab9298987537dfb33b5e15a8
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1999
+
+140-ixp4xx_hss_module_h_include.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+94b8fa5ee9c1c2e0fb5638e546ad696e
+2012-09-21T05:38:16.850652Z
+33501
+kaloz
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+1366
+
+532-jffs2_eofdetect.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+d0ec0674d9c829c2f9ed05d569a21efe
+2012-11-01T11:07:16.389251Z
+34053
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4543
+
+478-mtd-partial_eraseblock_unlock.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+344d3e02e589f851a4393123693b8523
+2012-10-10T11:38:44.760785Z
+33681
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+652
+
+451-mtd_fix_nand_correct_data_return_code.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+184b800ec2c872aece60cc30aba97d7c
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+371
+
+200-fix_localversion.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+c5c81212f603eb9a4c3738d5ae48cfa6
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+397
+
+441-block2mtd_refresh.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+9329a9abb517edfd5a029c60e8db0eca
+2012-04-17T12:51:02.656858Z
+31336
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+6749
+
+305-mips_module_reloc.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+1507713ed2e2a8d2bfabc303e3c65ede
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+9529
+
+640-bridge_no_eap_forward.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+19beeb438df57bfa53158549cee38604
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+420
+
+729-phy-rtl8367b.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+7287b3b82f88ebb422cd0b134182bcdd
+2012-10-18T07:22:56.249621Z
+33839
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+719
+
+911-kobject_add_broadcast_uevent.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+8f79617de71025f164042fb533f7a04b
+2012-04-09T14:48:56.243549Z
+31223
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+2106
+
+260-move_bcm963xx_tag.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+fd2e25c0162cb4b37b85acc6a8a0da73
+2012-11-06T15:21:46.466031Z
+34103
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+7989
+
+065-8139cp-fixes.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+4bb08fa403f7ed3488217ebcb14d038c
+2012-12-06T22:39:43.120900Z
+34548
+florian
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+6336
+
+621-sched_act_connmark.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+ba6d002a8254f06172bf683bc0548a3f
+2012-05-24T18:25:08.550225Z
+31856
+nbd
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+4765
+
+211-stddef_include.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+5054a6b5255e7c5739882c8222211a08
+2012-02-02T08:23:54.955046Z
+29986
+jogo
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+322
+
+042-fq_codel-Fair-Queue-Codel-AQM.patch
+file
+
+
+
+
+2013-03-17T12:12:51.000000Z
+86e5a145ed47a5435ed49fc2285f945c
+2012-09-26T14:17:17.327410Z
+33560
+juhosg
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+23790
+
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/006-arm_kernel_xz_support.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/006-arm_kernel_xz_support.patch.svn-base
new file mode 100644
index 0000000..bfb1757
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/006-arm_kernel_xz_support.patch.svn-base
@@ -0,0 +1,96 @@
+From 2d303b4683145f7dbc918bd14d04e1396581b2ce Mon Sep 17 00:00:00 2001
+From: Imre Kaloz <kaloz@openwrt.org>
+Date: Thu, 7 Jul 2011 12:05:21 +0200
+Subject: [PATCH] ARM: support XZ compressed kernels
+
+Wire up support for the XZ decompressor
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ arch/arm/Kconfig                        |    1 +
+ arch/arm/boot/compressed/Makefile       |   11 +++++++++--
+ arch/arm/boot/compressed/decompress.c   |    4 ++++
+ arch/arm/boot/compressed/piggy.xzkern.S |    6 ++++++
+ lib/xz/xz_dec_stream.c                  |    1 +
+ 5 files changed, 21 insertions(+), 2 deletions(-)
+ create mode 100644 arch/arm/boot/compressed/piggy.xzkern.S
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -21,6 +21,7 @@ config ARM
+ 	select HAVE_KERNEL_GZIP
+ 	select HAVE_KERNEL_LZO
+ 	select HAVE_KERNEL_LZMA
++	select HAVE_KERNEL_XZ
+ 	select HAVE_IRQ_WORK
+ 	select HAVE_PERF_EVENTS
+ 	select PERF_USE_VMALLOC
+--- a/arch/arm/boot/compressed/Makefile
++++ b/arch/arm/boot/compressed/Makefile
+@@ -92,6 +92,7 @@ SEDFLAGS	= s/TEXT_START/$(ZTEXTADDR)/;s/
+ suffix_$(CONFIG_KERNEL_GZIP) = gzip
+ suffix_$(CONFIG_KERNEL_LZO)  = lzo
+ suffix_$(CONFIG_KERNEL_LZMA) = lzma
++suffix_$(CONFIG_KERNEL_XZ)   = xzkern
+ 
+ # Borrowed libfdt files for the ATAG compatibility mode
+ 
+@@ -115,7 +116,7 @@ targets       := vmlinux vmlinux.lds \
+ 		 lib1funcs.o lib1funcs.S font.o font.c head.o misc.o $(OBJS)
+ 
+ # Make sure files are removed during clean
+-extra-y       += piggy.gzip piggy.lzo piggy.lzma lib1funcs.S $(libfdt) $(libfdt_hdrs)
++extra-y       += piggy.gzip piggy.lzo piggy.lzma piggy.xzkern lib1funcs.S ashldi3.S $(libfdt) $(libfdt_hdrs)
+ 
+ ifeq ($(CONFIG_FUNCTION_TRACER),y)
+ ORIG_CFLAGS := $(KBUILD_CFLAGS)
+@@ -171,8 +172,14 @@ if [ $(words $(ZRELADDR)) -gt 1 -a "$(CO
+ 	false; \
+ fi
+ 
++# For __aeabi_llsl
++ashldi3 = $(obj)/ashldi3.o
++
++$(obj)/ashldi3.S: $(srctree)/arch/$(SRCARCH)/lib/ashldi3.S FORCE
++	$(call cmd,shipped)
++
+ $(obj)/vmlinux: $(obj)/vmlinux.lds $(obj)/$(HEAD) $(obj)/piggy.$(suffix_y).o \
+-	 	$(addprefix $(obj)/, $(OBJS)) $(lib1funcs) FORCE
++	 	$(addprefix $(obj)/, $(OBJS)) $(lib1funcs) $(ashldi3) FORCE
+ 	@$(check_for_multiple_zreladdr)
+ 	$(call if_changed,ld)
+ 	@$(check_for_bad_syms)
+--- a/arch/arm/boot/compressed/decompress.c
++++ b/arch/arm/boot/compressed/decompress.c
+@@ -44,6 +44,12 @@ extern void error(char *);
+ #include "../../../../lib/decompress_unlzma.c"
+ #endif
+ 
++#ifdef CONFIG_KERNEL_XZ
++#define memmove memmove
++#define memcpy memcpy
++#include "../../../../lib/decompress_unxz.c"
++#endif
++
+ int do_decompress(u8 *input, int len, u8 *output, void (*error)(char *x))
+ {
+ 	return decompress(input, len, NULL, NULL, output, NULL, error);
+--- /dev/null
++++ b/arch/arm/boot/compressed/piggy.xzkern.S
+@@ -0,0 +1,6 @@
++	.section .piggydata,#alloc
++	.globl	input_data
++input_data:
++	.incbin	"arch/arm/boot/compressed/piggy.xzkern"
++	.globl	input_data_end
++input_data_end:
+--- a/lib/xz/xz_dec_stream.c
++++ b/lib/xz/xz_dec_stream.c
+@@ -9,6 +9,7 @@
+ 
+ #include "xz_private.h"
+ #include "xz_stream.h"
++#include <linux/kernel.h>
+ 
+ /* Hash used to validate the Index field */
+ struct xz_dec_hash {
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/020-ssb_update.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/020-ssb_update.patch.svn-base
new file mode 100644
index 0000000..3a3afd0
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/020-ssb_update.patch.svn-base
@@ -0,0 +1,1947 @@
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -43,8 +43,8 @@ static void early_nvram_init(void)
+ #ifdef CONFIG_BCM47XX_SSB
+ 	case BCM47XX_BUS_TYPE_SSB:
+ 		mcore_ssb = &bcm47xx_bus.ssb.mipscore;
+-		base = mcore_ssb->flash_window;
+-		lim = mcore_ssb->flash_window_size;
++		base = mcore_ssb->pflash.window;
++		lim = mcore_ssb->pflash.window_size;
+ 		break;
+ #endif
+ #ifdef CONFIG_BCM47XX_BCMA
+--- a/arch/mips/bcm47xx/wgt634u.c
++++ b/arch/mips/bcm47xx/wgt634u.c
+@@ -156,10 +156,10 @@ static int __init wgt634u_init(void)
+ 					    SSB_CHIPCO_IRQ_GPIO);
+ 		}
+ 
+-		wgt634u_flash_data.width = mcore->flash_buswidth;
+-		wgt634u_flash_resource.start = mcore->flash_window;
+-		wgt634u_flash_resource.end = mcore->flash_window
+-					   + mcore->flash_window_size
++		wgt634u_flash_data.width = mcore->pflash.buswidth;
++		wgt634u_flash_resource.start = mcore->pflash.window;
++		wgt634u_flash_resource.end = mcore->pflash.window
++					   + mcore->pflash.window_size
+ 					   - 1;
+ 		return platform_add_devices(wgt634u_devices,
+ 					    ARRAY_SIZE(wgt634u_devices));
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -136,6 +136,11 @@ config SSB_DRIVER_MIPS
+ 
+ 	  If unsure, say N
+ 
++config SSB_SFLASH
++	bool "SSB serial flash support"
++	depends on SSB_DRIVER_MIPS && BROKEN
++	default y
++
+ # Assumption: We are on embedded, if we compile the MIPS core.
+ config SSB_EMBEDDED
+ 	bool
+@@ -160,4 +165,12 @@ config SSB_DRIVER_GIGE
+ 
+ 	  If unsure, say N
+ 
++config SSB_DRIVER_GPIO
++	bool "SSB GPIO driver"
++	depends on SSB && GPIOLIB
++	help
++	  Driver to provide access to the GPIO pins on the bus.
++
++	  If unsure, say N
++
+ endmenu
+--- a/drivers/ssb/Makefile
++++ b/drivers/ssb/Makefile
+@@ -11,10 +11,12 @@ ssb-$(CONFIG_SSB_SDIOHOST)		+= sdio.o
+ # built-in drivers
+ ssb-y					+= driver_chipcommon.o
+ ssb-y					+= driver_chipcommon_pmu.o
++ssb-$(CONFIG_SSB_SFLASH)		+= driver_chipcommon_sflash.o
+ ssb-$(CONFIG_SSB_DRIVER_MIPS)		+= driver_mipscore.o
+ ssb-$(CONFIG_SSB_DRIVER_EXTIF)		+= driver_extif.o
+ ssb-$(CONFIG_SSB_DRIVER_PCICORE)	+= driver_pcicore.o
+ ssb-$(CONFIG_SSB_DRIVER_GIGE)		+= driver_gige.o
++ssb-$(CONFIG_SSB_DRIVER_GPIO)		+= driver_gpio.o
+ 
+ # b43 pci-ssb-bridge driver
+ # Not strictly a part of SSB, but kept here for convenience
+--- a/drivers/ssb/b43_pci_bridge.c
++++ b/drivers/ssb/b43_pci_bridge.c
+@@ -29,11 +29,15 @@ static const struct pci_device_id b43_pc
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4322) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43222) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4324) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4325) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4328) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4329) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x432b) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x432c) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4350) },
+ 	{ 0, },
+ };
+ MODULE_DEVICE_TABLE(pci, b43_pci_bridge_tbl);
+--- a/drivers/ssb/driver_chipcommon.c
++++ b/drivers/ssb/driver_chipcommon.c
+@@ -4,6 +4,7 @@
+  *
+  * Copyright 2005, Broadcom Corporation
+  * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+@@ -12,6 +13,7 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/export.h>
+ #include <linux/pci.h>
++#include <linux/bcm47xx_wdt.h>
+ 
+ #include "ssb_private.h"
+ 
+@@ -280,10 +282,76 @@ static void calc_fast_powerup_delay(stru
+ 	cc->fast_pwrup_delay = tmp;
+ }
+ 
++static u32 ssb_chipco_alp_clock(struct ssb_chipcommon *cc)
++{
++	if (cc->capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_alp_clock(cc);
++
++	return 20000000;
++}
++
++static u32 ssb_chipco_watchdog_get_max_timer(struct ssb_chipcommon *cc)
++{
++	u32 nb;
++
++	if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
++		if (cc->dev->id.revision < 26)
++			nb = 16;
++		else
++			nb = (cc->dev->id.revision >= 37) ? 32 : 24;
++	} else {
++		nb = 28;
++	}
++	if (nb == 32)
++		return 0xffffffff;
++	else
++		return (1 << nb) - 1;
++}
++
++u32 ssb_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks)
++{
++	struct ssb_chipcommon *cc = bcm47xx_wdt_get_drvdata(wdt);
++
++	if (cc->dev->bus->bustype != SSB_BUSTYPE_SSB)
++		return 0;
++
++	return ssb_chipco_watchdog_timer_set(cc, ticks);
++}
++
++u32 ssb_chipco_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms)
++{
++	struct ssb_chipcommon *cc = bcm47xx_wdt_get_drvdata(wdt);
++	u32 ticks;
++
++	if (cc->dev->bus->bustype != SSB_BUSTYPE_SSB)
++		return 0;
++
++	ticks = ssb_chipco_watchdog_timer_set(cc, cc->ticks_per_ms * ms);
++	return ticks / cc->ticks_per_ms;
++}
++
++static int ssb_chipco_watchdog_ticks_per_ms(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
++			/* based on 32KHz ILP clock */
++			return 32;
++	} else {
++		if (cc->dev->id.revision < 18)
++			return ssb_clockspeed(bus) / 1000;
++		else
++			return ssb_chipco_alp_clock(cc) / 1000;
++	}
++}
++
+ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
+ {
+ 	if (!cc->dev)
+ 		return; /* We don't have a ChipCommon */
++
++	spin_lock_init(&cc->gpio_lock);
++
+ 	if (cc->dev->id.revision >= 11)
+ 		cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
+ 	ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
+@@ -297,6 +365,11 @@ void ssb_chipcommon_init(struct ssb_chip
+ 	chipco_powercontrol_init(cc);
+ 	ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
+ 	calc_fast_powerup_delay(cc);
++
++	if (cc->dev->bus->bustype == SSB_BUSTYPE_SSB) {
++		cc->ticks_per_ms = ssb_chipco_watchdog_ticks_per_ms(cc);
++		cc->max_timer_ms = ssb_chipco_watchdog_get_max_timer(cc) / cc->ticks_per_ms;
++	}
+ }
+ 
+ void ssb_chipco_suspend(struct ssb_chipcommon *cc)
+@@ -395,10 +468,27 @@ void ssb_chipco_timing_init(struct ssb_c
+ }
+ 
+ /* Set chip watchdog reset timer to fire in 'ticks' backplane cycles */
+-void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks)
++u32 ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks)
+ {
+-	/* instant NMI */
+-	chipco_write32(cc, SSB_CHIPCO_WATCHDOG, ticks);
++	u32 maxt;
++	enum ssb_clkmode clkmode;
++
++	maxt = ssb_chipco_watchdog_get_max_timer(cc);
++	if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
++		if (ticks == 1)
++			ticks = 2;
++		else if (ticks > maxt)
++			ticks = maxt;
++		chipco_write32(cc, SSB_CHIPCO_PMU_WATCHDOG, ticks);
++	} else {
++		clkmode = ticks ? SSB_CLKMODE_FAST : SSB_CLKMODE_DYNAMIC;
++		ssb_chipco_set_clockmode(cc, clkmode);
++		if (ticks > maxt)
++			ticks = maxt;
++		/* instant NMI */
++		chipco_write32(cc, SSB_CHIPCO_WATCHDOG, ticks);
++	}
++	return ticks;
+ }
+ 
+ void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value)
+@@ -418,28 +508,93 @@ u32 ssb_chipco_gpio_in(struct ssb_chipco
+ 
+ u32 ssb_chipco_gpio_out(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOOUT, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOOUT, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_chipco_gpio_outen(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOOUTEN, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOOUTEN, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_chipco_gpio_control(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOCTL, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOCTL, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ EXPORT_SYMBOL(ssb_chipco_gpio_control);
+ 
+ u32 ssb_chipco_gpio_intmask(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOIRQ, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOIRQ, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_chipco_gpio_polarity(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOPOL, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOPOL, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
++}
++
++u32 ssb_chipco_gpio_pullup(struct ssb_chipcommon *cc, u32 mask, u32 value)
++{
++	unsigned long flags;
++	u32 res = 0;
++
++	if (cc->dev->id.revision < 20)
++		return 0xffffffff;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOPULLUP, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
++}
++
++u32 ssb_chipco_gpio_pulldown(struct ssb_chipcommon *cc, u32 mask, u32 value)
++{
++	unsigned long flags;
++	u32 res = 0;
++
++	if (cc->dev->id.revision < 20)
++		return 0xffffffff;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOPULLDOWN, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ #ifdef CONFIG_SSB_SERIAL
+@@ -473,12 +628,7 @@ int ssb_chipco_serial_init(struct ssb_ch
+ 				       chipco_read32(cc, SSB_CHIPCO_CORECTL)
+ 				       | SSB_CHIPCO_CORECTL_UARTCLK0);
+ 		} else if ((ccrev >= 11) && (ccrev != 15)) {
+-			/* Fixed ALP clock */
+-			baud_base = 20000000;
+-			if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
+-				/* FIXME: baud_base is different for devices with a PMU */
+-				SSB_WARN_ON(1);
+-			}
++			baud_base = ssb_chipco_alp_clock(cc);
+ 			div = 1;
+ 			if (ccrev >= 21) {
+ 				/* Turn off UART clock before switching clocksource. */
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -13,6 +13,9 @@
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
+ #include <linux/export.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -92,10 +95,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -321,7 +320,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -330,7 +333,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -339,6 +346,8 @@ static void ssb_pmu_pll_init(struct ssb_
+ 			chipco_write32(cc, SSB_CHIPCO_PLLCTL_DATA, 0x380005C0);
+ 		}
+ 		break;
++	case 43222:
++		break;
+ 	default:
+ 		ssb_printk(KERN_ERR PFX
+ 			   "ERROR: PLL init unknown for device %04X\n",
+@@ -427,6 +436,7 @@ static void ssb_pmu_resources_init(struc
+ 		 min_msk = 0xCBB;
+ 		 break;
+ 	case 0x4322:
++	case 43222:
+ 		/* We keep the default settings:
+ 		 * min_msk = 0xCBB
+ 		 * max_msk = 0x7FFFF
+@@ -607,3 +617,61 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++static u32 ssb_pmu_get_alp_clock_clk0(struct ssb_chipcommon *cc)
++{
++	u32 crystalfreq;
++	const struct pmu0_plltab_entry *e = NULL;
++
++	crystalfreq = chipco_read32(cc, SSB_CHIPCO_PMU_CTL) &
++		      SSB_CHIPCO_PMU_CTL_XTALFREQ >> SSB_CHIPCO_PMU_CTL_XTALFREQ_SHIFT;
++	e = pmu0_plltab_find_entry(crystalfreq);
++	BUG_ON(!e);
++	return e->freq * 1000;
++}
++
++u32 ssb_pmu_get_alp_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		ssb_pmu_get_alp_clock_clk0(cc);
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU alp clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
+--- /dev/null
++++ b/drivers/ssb/driver_chipcommon_sflash.c
+@@ -0,0 +1,18 @@
++/*
++ * Sonics Silicon Backplane
++ * ChipCommon serial flash interface
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/ssb/ssb.h>
++
++#include "ssb_private.h"
++
++/* Initialize serial flash access */
++int ssb_sflash_init(struct ssb_chipcommon *cc)
++{
++	pr_err("Serial flash support is not implemented yet!\n");
++
++	return -ENOTSUPP;
++}
+--- a/drivers/ssb/driver_extif.c
++++ b/drivers/ssb/driver_extif.c
+@@ -112,10 +112,37 @@ void ssb_extif_get_clockcontrol(struct s
+ 	*m = extif_read32(extif, SSB_EXTIF_CLOCK_SB);
+ }
+ 
+-void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
+-				  u32 ticks)
++u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks)
+ {
++	struct ssb_extif *extif = bcm47xx_wdt_get_drvdata(wdt);
++
++	return ssb_extif_watchdog_timer_set(extif, ticks);
++}
++
++u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms)
++{
++	struct ssb_extif *extif = bcm47xx_wdt_get_drvdata(wdt);
++	u32 ticks = (SSB_EXTIF_WATCHDOG_CLK / 1000) * ms;
++
++	ticks = ssb_extif_watchdog_timer_set(extif, ticks);
++
++	return (ticks * 1000) / SSB_EXTIF_WATCHDOG_CLK;
++}
++
++u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks)
++{
++	if (ticks > SSB_EXTIF_WATCHDOG_MAX_TIMER)
++		ticks = SSB_EXTIF_WATCHDOG_MAX_TIMER;
+ 	extif_write32(extif, SSB_EXTIF_WATCHDOG, ticks);
++
++	return ticks;
++}
++
++void ssb_extif_init(struct ssb_extif *extif)
++{
++	if (!extif->dev)
++		return; /* We don't have a Extif core */
++	spin_lock_init(&extif->gpio_lock);
+ }
+ 
+ u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask)
+@@ -125,22 +152,50 @@ u32 ssb_extif_gpio_in(struct ssb_extif *
+ 
+ u32 ssb_extif_gpio_out(struct ssb_extif *extif, u32 mask, u32 value)
+ {
+-	return extif_write32_masked(extif, SSB_EXTIF_GPIO_OUT(0),
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&extif->gpio_lock, flags);
++	res = extif_write32_masked(extif, SSB_EXTIF_GPIO_OUT(0),
+ 				   mask, value);
++	spin_unlock_irqrestore(&extif->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_extif_gpio_outen(struct ssb_extif *extif, u32 mask, u32 value)
+ {
+-	return extif_write32_masked(extif, SSB_EXTIF_GPIO_OUTEN(0),
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&extif->gpio_lock, flags);
++	res = extif_write32_masked(extif, SSB_EXTIF_GPIO_OUTEN(0),
+ 				   mask, value);
++	spin_unlock_irqrestore(&extif->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_extif_gpio_polarity(struct ssb_extif *extif, u32 mask, u32 value)
+ {
+-	return extif_write32_masked(extif, SSB_EXTIF_GPIO_INTPOL, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&extif->gpio_lock, flags);
++	res = extif_write32_masked(extif, SSB_EXTIF_GPIO_INTPOL, mask, value);
++	spin_unlock_irqrestore(&extif->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_extif_gpio_intmask(struct ssb_extif *extif, u32 mask, u32 value)
+ {
+-	return extif_write32_masked(extif, SSB_EXTIF_GPIO_INTMASK, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&extif->gpio_lock, flags);
++	res = extif_write32_masked(extif, SSB_EXTIF_GPIO_INTMASK, mask, value);
++	spin_unlock_irqrestore(&extif->gpio_lock, flags);
++
++	return res;
+ }
+--- /dev/null
++++ b/drivers/ssb/driver_gpio.c
+@@ -0,0 +1,176 @@
++/*
++ * Sonics Silicon Backplane
++ * GPIO driver
++ *
++ * Copyright 2011, Broadcom Corporation
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/gpio.h>
++#include <linux/export.h>
++#include <linux/ssb/ssb.h>
++
++#include "ssb_private.h"
++
++static struct ssb_bus *ssb_gpio_get_bus(struct gpio_chip *chip)
++{
++	return container_of(chip, struct ssb_bus, gpio);
++}
++
++static int ssb_gpio_chipco_get_value(struct gpio_chip *chip, unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	return !!ssb_chipco_gpio_in(&bus->chipco, 1 << gpio);
++}
++
++static void ssb_gpio_chipco_set_value(struct gpio_chip *chip, unsigned gpio,
++				      int value)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_chipco_gpio_out(&bus->chipco, 1 << gpio, value ? 1 << gpio : 0);
++}
++
++static int ssb_gpio_chipco_direction_input(struct gpio_chip *chip,
++					   unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_chipco_gpio_outen(&bus->chipco, 1 << gpio, 0);
++	return 0;
++}
++
++static int ssb_gpio_chipco_direction_output(struct gpio_chip *chip,
++					    unsigned gpio, int value)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_chipco_gpio_outen(&bus->chipco, 1 << gpio, 1 << gpio);
++	ssb_chipco_gpio_out(&bus->chipco, 1 << gpio, value ? 1 << gpio : 0);
++	return 0;
++}
++
++static int ssb_gpio_chipco_request(struct gpio_chip *chip, unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_chipco_gpio_control(&bus->chipco, 1 << gpio, 0);
++	/* clear pulldown */
++	ssb_chipco_gpio_pulldown(&bus->chipco, 1 << gpio, 0);
++	/* Set pullup */
++	ssb_chipco_gpio_pullup(&bus->chipco, 1 << gpio, 1 << gpio);
++
++	return 0;
++}
++
++static void ssb_gpio_chipco_free(struct gpio_chip *chip, unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	/* clear pullup */
++	ssb_chipco_gpio_pullup(&bus->chipco, 1 << gpio, 0);
++}
++
++static int ssb_gpio_chipco_init(struct ssb_bus *bus)
++{
++	struct gpio_chip *chip = &bus->gpio;
++
++	chip->label		= "ssb_chipco_gpio";
++	chip->owner		= THIS_MODULE;
++	chip->request		= ssb_gpio_chipco_request;
++	chip->free		= ssb_gpio_chipco_free;
++	chip->get		= ssb_gpio_chipco_get_value;
++	chip->set		= ssb_gpio_chipco_set_value;
++	chip->direction_input	= ssb_gpio_chipco_direction_input;
++	chip->direction_output	= ssb_gpio_chipco_direction_output;
++	chip->ngpio		= 16;
++	/* There is just one SoC in one device and its GPIO addresses should be
++	 * deterministic to address them more easily. The other buses could get
++	 * a random base number. */
++	if (bus->bustype == SSB_BUSTYPE_SSB)
++		chip->base		= 0;
++	else
++		chip->base		= -1;
++
++	return gpiochip_add(chip);
++}
++
++#ifdef CONFIG_SSB_DRIVER_EXTIF
++
++static int ssb_gpio_extif_get_value(struct gpio_chip *chip, unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	return !!ssb_extif_gpio_in(&bus->extif, 1 << gpio);
++}
++
++static void ssb_gpio_extif_set_value(struct gpio_chip *chip, unsigned gpio,
++				     int value)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_extif_gpio_out(&bus->extif, 1 << gpio, value ? 1 << gpio : 0);
++}
++
++static int ssb_gpio_extif_direction_input(struct gpio_chip *chip,
++					  unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_extif_gpio_outen(&bus->extif, 1 << gpio, 0);
++	return 0;
++}
++
++static int ssb_gpio_extif_direction_output(struct gpio_chip *chip,
++					   unsigned gpio, int value)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_extif_gpio_outen(&bus->extif, 1 << gpio, 1 << gpio);
++	ssb_extif_gpio_out(&bus->extif, 1 << gpio, value ? 1 << gpio : 0);
++	return 0;
++}
++
++static int ssb_gpio_extif_init(struct ssb_bus *bus)
++{
++	struct gpio_chip *chip = &bus->gpio;
++
++	chip->label		= "ssb_extif_gpio";
++	chip->owner		= THIS_MODULE;
++	chip->get		= ssb_gpio_extif_get_value;
++	chip->set		= ssb_gpio_extif_set_value;
++	chip->direction_input	= ssb_gpio_extif_direction_input;
++	chip->direction_output	= ssb_gpio_extif_direction_output;
++	chip->ngpio		= 5;
++	/* There is just one SoC in one device and its GPIO addresses should be
++	 * deterministic to address them more easily. The other buses could get
++	 * a random base number. */
++	if (bus->bustype == SSB_BUSTYPE_SSB)
++		chip->base		= 0;
++	else
++		chip->base		= -1;
++
++	return gpiochip_add(chip);
++}
++
++#else
++static int ssb_gpio_extif_init(struct ssb_bus *bus)
++{
++	return -ENOTSUPP;
++}
++#endif
++
++int ssb_gpio_init(struct ssb_bus *bus)
++{
++	if (ssb_chipco_available(&bus->chipco))
++		return ssb_gpio_chipco_init(bus);
++	else if (ssb_extif_available(&bus->extif))
++		return ssb_gpio_extif_init(bus);
++	else
++		SSB_WARN_ON(1);
++
++	return -1;
++}
+--- a/drivers/ssb/driver_mipscore.c
++++ b/drivers/ssb/driver_mipscore.c
+@@ -178,9 +178,9 @@ static void ssb_mips_serial_init(struct
+ {
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 
+-	if (bus->extif.dev)
++	if (ssb_extif_available(&bus->extif))
+ 		mcore->nr_serial_ports = ssb_extif_serial_init(&bus->extif, mcore->serial_ports);
+-	else if (bus->chipco.dev)
++	else if (ssb_chipco_available(&bus->chipco))
+ 		mcore->nr_serial_ports = ssb_chipco_serial_init(&bus->chipco, mcore->serial_ports);
+ 	else
+ 		mcore->nr_serial_ports = 0;
+@@ -190,16 +190,33 @@ static void ssb_mips_flash_detect(struct
+ {
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 
+-	mcore->flash_buswidth = 2;
+-	if (bus->chipco.dev) {
+-		mcore->flash_window = 0x1c000000;
+-		mcore->flash_window_size = 0x02000000;
++	/* When there is no chipcommon on the bus there is 4MB flash */
++	if (!ssb_chipco_available(&bus->chipco)) {
++		mcore->pflash.present = true;
++		mcore->pflash.buswidth = 2;
++		mcore->pflash.window = SSB_FLASH1;
++		mcore->pflash.window_size = SSB_FLASH1_SZ;
++		return;
++	}
++
++	/* There is ChipCommon, so use it to read info about flash */
++	switch (bus->chipco.capabilities & SSB_CHIPCO_CAP_FLASHT) {
++	case SSB_CHIPCO_FLASHT_STSER:
++	case SSB_CHIPCO_FLASHT_ATSER:
++		pr_debug("Found serial flash\n");
++		ssb_sflash_init(&bus->chipco);
++		break;
++	case SSB_CHIPCO_FLASHT_PARA:
++		pr_debug("Found parallel flash\n");
++		mcore->pflash.present = true;
++		mcore->pflash.window = SSB_FLASH2;
++		mcore->pflash.window_size = SSB_FLASH2_SZ;
+ 		if ((ssb_read32(bus->chipco.dev, SSB_CHIPCO_FLASH_CFG)
+ 		               & SSB_CHIPCO_CFG_DS16) == 0)
+-			mcore->flash_buswidth = 1;
+-	} else {
+-		mcore->flash_window = 0x1fc00000;
+-		mcore->flash_window_size = 0x00400000;
++			mcore->pflash.buswidth = 1;
++		else
++			mcore->pflash.buswidth = 2;
++		break;
+ 	}
+ }
+ 
+@@ -208,9 +225,12 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
+-	if (bus->extif.dev) {
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
++	if (ssb_extif_available(&bus->extif)) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+-	} else if (bus->chipco.dev) {
++	} else if (ssb_chipco_available(&bus->chipco)) {
+ 		ssb_chipco_get_clockcpu(&bus->chipco, &pll_type, &n, &m);
+ 	} else
+ 		return 0;
+@@ -246,9 +266,9 @@ void ssb_mipscore_init(struct ssb_mipsco
+ 		hz = 100000000;
+ 	ns = 1000000000 / hz;
+ 
+-	if (bus->extif.dev)
++	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_timing_init(&bus->extif, ns);
+-	else if (bus->chipco.dev)
++	else if (ssb_chipco_available(&bus->chipco))
+ 		ssb_chipco_timing_init(&bus->chipco, ns);
+ 
+ 	/* Assign IRQs to all cores on the bus, start with irq line 2, because serial usually takes 1 */
+--- a/drivers/ssb/embedded.c
++++ b/drivers/ssb/embedded.c
+@@ -4,11 +4,13 @@
+  *
+  * Copyright 2005-2008, Broadcom Corporation
+  * Copyright 2006-2008, Michael Buesch <m@bues.ch>
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+ #include <linux/export.h>
++#include <linux/platform_device.h>
+ #include <linux/ssb/ssb.h>
+ #include <linux/ssb/ssb_embedded.h>
+ #include <linux/ssb/ssb_driver_pci.h>
+@@ -32,6 +34,39 @@ int ssb_watchdog_timer_set(struct ssb_bu
+ }
+ EXPORT_SYMBOL(ssb_watchdog_timer_set);
+ 
++int ssb_watchdog_register(struct ssb_bus *bus)
++{
++	struct bcm47xx_wdt wdt = {};
++	struct platform_device *pdev;
++
++	if (ssb_chipco_available(&bus->chipco)) {
++		wdt.driver_data = &bus->chipco;
++		wdt.timer_set = ssb_chipco_watchdog_timer_set_wdt;
++		wdt.timer_set_ms = ssb_chipco_watchdog_timer_set_ms;
++		wdt.max_timer_ms = bus->chipco.max_timer_ms;
++	} else if (ssb_extif_available(&bus->extif)) {
++		wdt.driver_data = &bus->extif;
++		wdt.timer_set = ssb_extif_watchdog_timer_set_wdt;
++		wdt.timer_set_ms = ssb_extif_watchdog_timer_set_ms;
++		wdt.max_timer_ms = SSB_EXTIF_WATCHDOG_MAX_TIMER_MS;
++	} else {
++		return -ENODEV;
++	}
++
++	pdev = platform_device_register_data(NULL, "bcm47xx-wdt",
++					     bus->busnumber, &wdt,
++					     sizeof(wdt));
++	if (IS_ERR(pdev)) {
++		ssb_dprintk(KERN_INFO PFX
++			    "can not register watchdog device, err: %li\n",
++			    PTR_ERR(pdev));
++		return PTR_ERR(pdev);
++	}
++
++	bus->watchdog = pdev;
++	return 0;
++}
++
+ u32 ssb_gpio_in(struct ssb_bus *bus, u32 mask)
+ {
+ 	unsigned long flags;
+--- a/drivers/ssb/main.c
++++ b/drivers/ssb/main.c
+@@ -13,6 +13,7 @@
+ #include <linux/delay.h>
+ #include <linux/io.h>
+ #include <linux/module.h>
++#include <linux/platform_device.h>
+ #include <linux/ssb/ssb.h>
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_gige.h>
+@@ -140,19 +141,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -250,11 +238,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -293,7 +279,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -449,6 +434,11 @@ static void ssb_devices_unregister(struc
+ 		if (sdev->dev)
+ 			device_unregister(sdev->dev);
+ 	}
++
++#ifdef CONFIG_SSB_EMBEDDED
++	if (bus->bustype == SSB_BUSTYPE_SSB)
++		platform_device_unregister(bus->watchdog);
++#endif
+ }
+ 
+ void ssb_bus_unregister(struct ssb_bus *bus)
+@@ -577,6 +567,8 @@ static int __devinit ssb_attach_queued_b
+ 		if (err)
+ 			goto error;
+ 		ssb_pcicore_init(&bus->pcicore);
++		if (bus->bustype == SSB_BUSTYPE_SSB)
++			ssb_watchdog_register(bus);
+ 		ssb_bus_may_powerdown(bus);
+ 
+ 		err = ssb_devices_register(bus);
+@@ -812,7 +804,14 @@ static int __devinit ssb_bus_register(st
+ 	if (err)
+ 		goto err_pcmcia_exit;
+ 	ssb_chipcommon_init(&bus->chipco);
++	ssb_extif_init(&bus->extif);
+ 	ssb_mipscore_init(&bus->mipscore);
++	err = ssb_gpio_init(bus);
++	if (err == -ENOTSUPP)
++		ssb_dprintk(KERN_DEBUG PFX "GPIO driver not activated\n");
++	else if (err)
++		ssb_dprintk(KERN_ERR PFX
++			   "Error registering GPIO driver: %i\n", err);
+ 	err = ssb_fetch_invariants(bus, get_invariants);
+ 	if (err) {
+ 		ssb_bus_may_powerdown(bus);
+@@ -1094,6 +1093,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1131,8 +1133,7 @@ static u32 ssb_tmslow_reject_bitmask(str
+ 	case SSB_IDLOW_SSBREV_27:     /* same here */
+ 		return SSB_TMSLOW_REJECT;	/* this is a guess */
+ 	default:
+-		printk(KERN_INFO "ssb: Backplane Revision 0x%.8X\n", rev);
+-		WARN_ON(1);
++		WARN(1, KERN_INFO "ssb: Backplane Revision 0x%.8X\n", rev);
+ 	}
+ 	return (SSB_TMSLOW_REJECT | SSB_TMSLOW_REJECT_23);
+ }
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -178,6 +178,18 @@ err_pci:
+ #define SPEX(_outvar, _offset, _mask, _shift) \
+ 	SPEX16(_outvar, _offset, _mask, _shift)
+ 
++#define SPEX_ARRAY8(_field, _offset, _mask, _shift)	\
++	do {	\
++		SPEX(_field[0], _offset +  0, _mask, _shift);	\
++		SPEX(_field[1], _offset +  2, _mask, _shift);	\
++		SPEX(_field[2], _offset +  4, _mask, _shift);	\
++		SPEX(_field[3], _offset +  6, _mask, _shift);	\
++		SPEX(_field[4], _offset +  8, _mask, _shift);	\
++		SPEX(_field[5], _offset + 10, _mask, _shift);	\
++		SPEX(_field[6], _offset + 12, _mask, _shift);	\
++		SPEX(_field[7], _offset + 14, _mask, _shift);	\
++	} while (0)
++
+ 
+ static inline u8 ssb_crc8(u8 crc, u8 data)
+ {
+@@ -331,7 +343,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -361,8 +372,9 @@ static void sprom_extract_r123(struct ss
+ 	SPEX(et0mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0M, 14);
+ 	SPEX(et1mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1M, 15);
+ 	SPEX(board_rev, SSB_SPROM1_BINF, SSB_SPROM1_BINF_BREV, 0);
+-	SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
+-	     SSB_SPROM1_BINF_CCODE_SHIFT);
++	if (out->revision == 1)
++		SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
++		     SSB_SPROM1_BINF_CCODE_SHIFT);
+ 	SPEX(ant_available_a, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTA,
+ 	     SSB_SPROM1_BINF_ANTA_SHIFT);
+ 	SPEX(ant_available_bg, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTBG,
+@@ -388,22 +400,16 @@ static void sprom_extract_r123(struct ss
+ 	SPEX(boardflags_lo, SSB_SPROM1_BFLLO, 0xFFFF, 0);
+ 	if (out->revision >= 2)
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
++	SPEX(alpha2[0], SSB_SPROM1_CCODE, 0xff00, 8);
++	SPEX(alpha2[1], SSB_SPROM1_CCODE, 0x00ff, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
+ }
+ 
+ /* Revs 4 5 and 8 have partially shared layout */
+@@ -464,14 +470,17 @@ static void sprom_extract_r45(struct ssb
+ 	SPEX(et0phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET0A, 0);
+ 	SPEX(et1phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET1A,
+ 	     SSB_SPROM4_ETHPHY_ET1A_SHIFT);
++	SPEX(board_rev, SSB_SPROM4_BOARDREV, 0xFFFF, 0);
+ 	if (out->revision == 4) {
+-		SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
++		SPEX(alpha2[0], SSB_SPROM4_CCODE, 0xff00, 8);
++		SPEX(alpha2[1], SSB_SPROM4_CCODE, 0x00ff, 0);
+ 		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
+ 		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
+ 		SPEX(boardflags2_lo, SSB_SPROM4_BFL2LO, 0xFFFF, 0);
+ 		SPEX(boardflags2_hi, SSB_SPROM4_BFL2HI, 0xFFFF, 0);
+ 	} else {
+-		SPEX(country_code, SSB_SPROM5_CCODE, 0xFFFF, 0);
++		SPEX(alpha2[0], SSB_SPROM5_CCODE, 0xff00, 8);
++		SPEX(alpha2[1], SSB_SPROM5_CCODE, 0x00ff, 0);
+ 		SPEX(boardflags_lo, SSB_SPROM5_BFLLO, 0xFFFF, 0);
+ 		SPEX(boardflags_hi, SSB_SPROM5_BFLHI, 0xFFFF, 0);
+ 		SPEX(boardflags2_lo, SSB_SPROM5_BFL2LO, 0xFFFF, 0);
+@@ -504,16 +513,14 @@ static void sprom_extract_r45(struct ssb
+ 	}
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
+ 
+ 	sprom_extract_r458(out, in);
+ 
+@@ -523,14 +530,22 @@ static void sprom_extract_r45(struct ssb
+ static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
+ {
+ 	int i;
+-	u16 v;
++	u16 v, o;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(out->core_pwr_info));
+ 
+ 	/* extract the MAC address */
+ 	for (i = 0; i < 3; i++) {
+ 		v = in[SPOFF(SSB_SPROM8_IL0MAC) + i];
+ 		*(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
+ 	}
+-	SPEX(country_code, SSB_SPROM8_CCODE, 0xFFFF, 0);
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, 0xFFFF, 0);
++	SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
++	SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
+ 	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, 0xFFFF, 0);
+ 	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, 0xFFFF, 0);
+ 	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, 0xFFFF, 0);
+@@ -596,16 +611,46 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
+ 
+ 	/* Extract FEM info */
+ 	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G,
+@@ -630,6 +675,63 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
+ 		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+ 
++	SPEX(leddc_on_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_ON,
++	     SSB_SPROM8_LEDDC_ON_SHIFT);
++	SPEX(leddc_off_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_OFF,
++	     SSB_SPROM8_LEDDC_OFF_SHIFT);
++
++	SPEX(txchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN,
++	     SSB_SPROM8_TXRXC_TXCHAIN_SHIFT);
++	SPEX(rxchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN,
++	     SSB_SPROM8_TXRXC_RXCHAIN_SHIFT);
++	SPEX(antswitch, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_SWITCH,
++	     SSB_SPROM8_TXRXC_SWITCH_SHIFT);
++
++	SPEX(opo, SSB_SPROM8_OFDM2GPO, 0x00ff, 0);
++
++	SPEX_ARRAY8(mcs2gpo, SSB_SPROM8_2G_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5gpo, SSB_SPROM8_5G_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5glpo, SSB_SPROM8_5GL_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5ghpo, SSB_SPROM8_5GH_MCSPO, ~0, 0);
++
++	SPEX(rawtempsense, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP,
++	     SSB_SPROM8_RAWTS_RAWTEMP_SHIFT);
++	SPEX(measpower, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER,
++	     SSB_SPROM8_RAWTS_MEASPOWER_SHIFT);
++	SPEX(tempsense_slope, SSB_SPROM8_OPT_CORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE,
++	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT);
++	SPEX(tempcorrx, SSB_SPROM8_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT);
++	SPEX(tempsense_option, SSB_SPROM8_OPT_CORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION,
++	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT);
++	SPEX(freqoffset_corr, SSB_SPROM8_HWIQ_IQSWP,
++	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR,
++	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT);
++	SPEX(iqcal_swp_dis, SSB_SPROM8_HWIQ_IQSWP,
++	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP,
++	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT);
++	SPEX(hw_iqcal_en, SSB_SPROM8_HWIQ_IQSWP, SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL,
++	     SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT);
++
++	SPEX(bw40po, SSB_SPROM8_BW40PO, ~0, 0);
++	SPEX(cddpo, SSB_SPROM8_CDDPO, ~0, 0);
++	SPEX(stbcpo, SSB_SPROM8_STBCPO, ~0, 0);
++	SPEX(bwduppo, SSB_SPROM8_BWDUPPO, ~0, 0);
++
++	SPEX(tempthresh, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_TRESH,
++	     SSB_SPROM8_THERMAL_TRESH_SHIFT);
++	SPEX(tempoffset, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_OFFSET,
++	     SSB_SPROM8_THERMAL_OFFSET_SHIFT);
++	SPEX(phycal_tempdelta, SSB_SPROM8_TEMPDELTA,
++	     SSB_SPROM8_TEMPDELTA_PHYCAL,
++	     SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT);
++	SPEX(temps_period, SSB_SPROM8_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD,
++	     SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT);
++	SPEX(temps_hysteresis, SSB_SPROM8_TEMPDELTA,
++	     SSB_SPROM8_TEMPDELTA_HYSTERESIS,
++	     SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);
+ 	sprom_extract_r458(out, in);
+ 
+ 	/* TODO - get remaining rev 8 stuff needed */
+@@ -759,7 +861,6 @@ static void ssb_pci_get_boardinfo(struct
+ {
+ 	bi->vendor = bus->host_pci->subsystem_vendor;
+ 	bi->type = bus->host_pci->subsystem_device;
+-	bi->rev = bus->host_pci->revision;
+ }
+ 
+ int ssb_pci_get_invariants(struct ssb_bus *bus,
+--- a/drivers/ssb/pcmcia.c
++++ b/drivers/ssb/pcmcia.c
+@@ -676,14 +676,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
+--- a/drivers/ssb/scan.c
++++ b/drivers/ssb/scan.c
+@@ -90,6 +90,8 @@ const char *ssb_core_name(u16 coreid)
+ 		return "ARM 1176";
+ 	case SSB_DEV_ARM_7TDMI:
+ 		return "ARM 7TDMI";
++	case SSB_DEV_ARM_CM3:
++		return "ARM Cortex M3";
+ 	}
+ 	return "UNKNOWN";
+ }
+@@ -318,6 +320,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+--- a/drivers/ssb/sdio.c
++++ b/drivers/ssb/sdio.c
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
+--- a/drivers/ssb/ssb_private.h
++++ b/drivers/ssb/ssb_private.h
+@@ -3,6 +3,7 @@
+ 
+ #include <linux/ssb/ssb.h>
+ #include <linux/types.h>
++#include <linux/bcm47xx_wdt.h>
+ 
+ 
+ #define PFX	"ssb: "
+@@ -207,4 +208,66 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_alp_clock(struct ssb_chipcommon *cc);
++
++extern u32 ssb_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
++					     u32 ticks);
++extern u32 ssb_chipco_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms);
++
++/* driver_chipcommon_sflash.c */
++#ifdef CONFIG_SSB_SFLASH
++int ssb_sflash_init(struct ssb_chipcommon *cc);
++#else
++static inline int ssb_sflash_init(struct ssb_chipcommon *cc)
++{
++	pr_err("Serial flash not supported\n");
++	return 0;
++}
++#endif /* CONFIG_SSB_SFLASH */
++
++#ifdef CONFIG_SSB_DRIVER_EXTIF
++extern u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks);
++extern u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms);
++#else
++static inline u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
++						   u32 ticks)
++{
++	return 0;
++}
++static inline u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt,
++						  u32 ms)
++{
++	return 0;
++}
++#endif
++
++#ifdef CONFIG_SSB_EMBEDDED
++extern int ssb_watchdog_register(struct ssb_bus *bus);
++#else /* CONFIG_SSB_EMBEDDED */
++static inline int ssb_watchdog_register(struct ssb_bus *bus)
++{
++	return 0;
++}
++#endif /* CONFIG_SSB_EMBEDDED */
++
++#ifdef CONFIG_SSB_DRIVER_EXTIF
++extern void ssb_extif_init(struct ssb_extif *extif);
++#else
++static inline void ssb_extif_init(struct ssb_extif *extif)
++{
++}
++#endif
++
++#ifdef CONFIG_SSB_DRIVER_GPIO
++extern int ssb_gpio_init(struct ssb_bus *bus);
++#else /* CONFIG_SSB_DRIVER_GPIO */
++static inline int ssb_gpio_init(struct ssb_bus *bus)
++{
++	return -ENOTSUPP;
++}
++#endif /* CONFIG_SSB_DRIVER_GPIO */
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
+--- a/include/linux/ssb/ssb.h
++++ b/include/linux/ssb/ssb.h
+@@ -6,8 +6,10 @@
+ #include <linux/types.h>
+ #include <linux/spinlock.h>
+ #include <linux/pci.h>
++#include <linux/gpio.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/dma-mapping.h>
++#include <linux/platform_device.h>
+ 
+ #include <linux/ssb/ssb_regs.h>
+ 
+@@ -16,6 +18,12 @@ struct pcmcia_device;
+ struct ssb_bus;
+ struct ssb_driver;
+ 
++struct ssb_sprom_core_pwr_info {
++	u8 itssi_2g, itssi_5g;
++	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
++};
++
+ struct ssb_sprom {
+ 	u8 revision;
+ 	u8 il0mac[6];		/* MAC address for 802.11b/g */
+@@ -26,9 +34,12 @@ struct ssb_sprom {
+ 	u8 et0mdcport;		/* MDIO for enet0 */
+ 	u8 et1mdcport;		/* MDIO for enet1 */
+ 	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
+ 	u8 country_code;	/* Country Code */
+-	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
+-	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
+ 	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
+ 	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
+ 	u16 pa0b0;
+@@ -47,10 +58,10 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
+@@ -61,8 +72,8 @@ struct ssb_sprom {
+ 	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
+ 	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
+ 	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
+ 	u8 rssisav2g;		/* 2GHz RSSI params */
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -82,16 +93,13 @@ struct ssb_sprom {
+ 	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
+ 	/* TODO store board flags in a single u64 */
+ 
++	struct ssb_sprom_core_pwr_info core_pwr_info[4];
++
+ 	/* Antenna gain values for up to 4 antennas
+ 	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
+ 	 * loss in the connectors is bigger than the gain. */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
+ 	} antenna_gain;
+ 
+ 	struct {
+@@ -103,14 +111,85 @@ struct ssb_sprom {
+ 		} ghz5;
+ 	} fem;
+ 
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
+ };
+ 
+ /* Information about the PCB the circuitry is soldered on. */
+ struct ssb_boardinfo {
+ 	u16 vendor;
+ 	u16 type;
+-	u8  rev;
+ };
+ 
+ 
+@@ -166,6 +245,7 @@ struct ssb_bus_ops {
+ #define SSB_DEV_MINI_MACPHY	0x823
+ #define SSB_DEV_ARM_1176	0x824
+ #define SSB_DEV_ARM_7TDMI	0x825
++#define SSB_DEV_ARM_CM3		0x82A
+ 
+ /* Vendor-ID values */
+ #define SSB_VENDOR_BROADCOM	0x4243
+@@ -354,7 +434,11 @@ struct ssb_bus {
+ #ifdef CONFIG_SSB_EMBEDDED
+ 	/* Lock for GPIO register access. */
+ 	spinlock_t gpio_lock;
++	struct platform_device *watchdog;
+ #endif /* EMBEDDED */
++#ifdef CONFIG_SSB_DRIVER_GPIO
++	struct gpio_chip gpio;
++#endif /* DRIVER_GPIO */
+ 
+ 	/* Internal-only stuff follows. Do not touch. */
+ 	struct list_head list;
+--- a/include/linux/ssb/ssb_driver_chipcommon.h
++++ b/include/linux/ssb/ssb_driver_chipcommon.h
+@@ -504,7 +504,9 @@
+ #define SSB_CHIPCO_FLASHCTL_ST_SE	0x02D8		/* Sector Erase */
+ #define SSB_CHIPCO_FLASHCTL_ST_BE	0x00C7		/* Bulk Erase */
+ #define SSB_CHIPCO_FLASHCTL_ST_DP	0x00B9		/* Deep Power-down */
+-#define SSB_CHIPCO_FLASHCTL_ST_RSIG	0x03AB		/* Read Electronic Signature */
++#define SSB_CHIPCO_FLASHCTL_ST_RES	0x03AB		/* Read Electronic Signature */
++#define SSB_CHIPCO_FLASHCTL_ST_CSA	0x1000		/* Keep chip select asserted */
++#define SSB_CHIPCO_FLASHCTL_ST_SSE	0x0220		/* Sub-sector Erase */
+ 
+ /* Status register bits for ST flashes */
+ #define SSB_CHIPCO_FLASHSTA_ST_WIP	0x01		/* Write In Progress */
+@@ -588,7 +590,10 @@ struct ssb_chipcommon {
+ 	u32 status;
+ 	/* Fast Powerup Delay constant */
+ 	u16 fast_pwrup_delay;
++	spinlock_t gpio_lock;
+ 	struct ssb_chipcommon_pmu pmu;
++	u32 ticks_per_ms;
++	u32 max_timer_ms;
+ };
+ 
+ static inline bool ssb_chipco_available(struct ssb_chipcommon *cc)
+@@ -628,8 +633,7 @@ enum ssb_clkmode {
+ extern void ssb_chipco_set_clockmode(struct ssb_chipcommon *cc,
+ 				     enum ssb_clkmode mode);
+ 
+-extern void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc,
+-					  u32 ticks);
++extern u32 ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks);
+ 
+ void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value);
+ 
+@@ -642,6 +646,8 @@ u32 ssb_chipco_gpio_outen(struct ssb_chi
+ u32 ssb_chipco_gpio_control(struct ssb_chipcommon *cc, u32 mask, u32 value);
+ u32 ssb_chipco_gpio_intmask(struct ssb_chipcommon *cc, u32 mask, u32 value);
+ u32 ssb_chipco_gpio_polarity(struct ssb_chipcommon *cc, u32 mask, u32 value);
++u32 ssb_chipco_gpio_pullup(struct ssb_chipcommon *cc, u32 mask, u32 value);
++u32 ssb_chipco_gpio_pulldown(struct ssb_chipcommon *cc, u32 mask, u32 value);
+ 
+ #ifdef CONFIG_SSB_SERIAL
+ extern int ssb_chipco_serial_init(struct ssb_chipcommon *cc,
+--- a/include/linux/ssb/ssb_driver_extif.h
++++ b/include/linux/ssb/ssb_driver_extif.h
+@@ -152,12 +152,16 @@
+ /* watchdog */
+ #define SSB_EXTIF_WATCHDOG_CLK		48000000	/* Hz */
+ 
++#define SSB_EXTIF_WATCHDOG_MAX_TIMER	((1 << 28) - 1)
++#define SSB_EXTIF_WATCHDOG_MAX_TIMER_MS	(SSB_EXTIF_WATCHDOG_MAX_TIMER \
++					 / (SSB_EXTIF_WATCHDOG_CLK / 1000))
+ 
+ 
+ #ifdef CONFIG_SSB_DRIVER_EXTIF
+ 
+ struct ssb_extif {
+ 	struct ssb_device *dev;
++	spinlock_t gpio_lock;
+ };
+ 
+ static inline bool ssb_extif_available(struct ssb_extif *extif)
+@@ -171,8 +175,7 @@ extern void ssb_extif_get_clockcontrol(s
+ extern void ssb_extif_timing_init(struct ssb_extif *extif,
+ 				  unsigned long ns);
+ 
+-extern void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
+-					 u32 ticks);
++extern u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks);
+ 
+ /* Extif GPIO pin access */
+ u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask);
+@@ -205,10 +208,52 @@ void ssb_extif_get_clockcontrol(struct s
+ }
+ 
+ static inline
+-void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
+-				  u32 ticks)
++void ssb_extif_timing_init(struct ssb_extif *extif, unsigned long ns)
+ {
+ }
+ 
++static inline
++u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_out(struct ssb_extif *extif, u32 mask,
++				     u32 value)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_outen(struct ssb_extif *extif, u32 mask,
++				       u32 value)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_polarity(struct ssb_extif *extif, u32 mask,
++					  u32 value)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_intmask(struct ssb_extif *extif, u32 mask,
++					 u32 value)
++{
++	return 0;
++}
++
++#ifdef CONFIG_SSB_SERIAL
++static inline int ssb_extif_serial_init(struct ssb_extif *extif,
++					struct ssb_serial_port *ports)
++{
++	return 0;
++}
++#endif /* CONFIG_SSB_SERIAL */
++
+ #endif /* CONFIG_SSB_DRIVER_EXTIF */
+ #endif /* LINUX_SSB_EXTIFCORE_H_ */
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
+--- a/include/linux/ssb/ssb_driver_mips.h
++++ b/include/linux/ssb/ssb_driver_mips.h
+@@ -13,6 +13,12 @@ struct ssb_serial_port {
+ 	unsigned int reg_shift;
+ };
+ 
++struct ssb_pflash {
++	bool present;
++	u8 buswidth;
++	u32 window;
++	u32 window_size;
++};
+ 
+ struct ssb_mipscore {
+ 	struct ssb_device *dev;
+@@ -20,9 +26,7 @@ struct ssb_mipscore {
+ 	int nr_serial_ports;
+ 	struct ssb_serial_port serial_ports[4];
+ 
+-	u8 flash_buswidth;
+-	u32 flash_window;
+-	u32 flash_window_size;
++	struct ssb_pflash pflash;
+ };
+ 
+ extern void ssb_mipscore_init(struct ssb_mipscore *mcore);
+--- a/include/linux/ssb/ssb_regs.h
++++ b/include/linux/ssb/ssb_regs.h
+@@ -228,6 +228,7 @@
+ #define  SSB_SPROM1_AGAIN_BG_SHIFT	0
+ #define  SSB_SPROM1_AGAIN_A		0xFF00	/* A-PHY */
+ #define  SSB_SPROM1_AGAIN_A_SHIFT	8
++#define SSB_SPROM1_CCODE		0x0076
+ 
+ /* SPROM Revision 2 (inherits from rev 1) */
+ #define SSB_SPROM2_BFLHI		0x0038	/* Boardflags (high 16 bits) */
+@@ -267,6 +268,7 @@
+ #define  SSB_SPROM3_OFDMGPO		0x107A	/* G-PHY OFDM Power Offset (4 bytes, BigEndian) */
+ 
+ /* SPROM Revision 4 */
++#define SSB_SPROM4_BOARDREV		0x0042	/* Board revision */
+ #define SSB_SPROM4_BFLLO		0x0044	/* Boardflags (low 16 bits) */
+ #define SSB_SPROM4_BFLHI		0x0046  /* Board Flags Hi */
+ #define SSB_SPROM4_BFL2LO		0x0048	/* Board flags 2 (low 16 bits) */
+@@ -389,6 +391,11 @@
+ #define  SSB_SPROM8_GPIOB_P2		0x00FF	/* Pin 2 */
+ #define  SSB_SPROM8_GPIOB_P3		0xFF00	/* Pin 3 */
+ #define  SSB_SPROM8_GPIOB_P3_SHIFT	8
++#define SSB_SPROM8_LEDDC		0x009A
++#define  SSB_SPROM8_LEDDC_ON		0xFF00	/* oncount */
++#define  SSB_SPROM8_LEDDC_ON_SHIFT	8
++#define  SSB_SPROM8_LEDDC_OFF		0x00FF	/* offcount */
++#define  SSB_SPROM8_LEDDC_OFF_SHIFT	0
+ #define SSB_SPROM8_ANTAVAIL		0x009C  /* Antenna available bitfields*/
+ #define  SSB_SPROM8_ANTAVAIL_A		0xFF00	/* A-PHY bitfield */
+ #define  SSB_SPROM8_ANTAVAIL_A_SHIFT	8
+@@ -404,6 +411,13 @@
+ #define  SSB_SPROM8_AGAIN2_SHIFT	0
+ #define  SSB_SPROM8_AGAIN3		0xFF00	/* Antenna 3 */
+ #define  SSB_SPROM8_AGAIN3_SHIFT	8
++#define SSB_SPROM8_TXRXC		0x00A2
++#define  SSB_SPROM8_TXRXC_TXCHAIN	0x000f
++#define  SSB_SPROM8_TXRXC_TXCHAIN_SHIFT	0
++#define  SSB_SPROM8_TXRXC_RXCHAIN	0x00f0
++#define  SSB_SPROM8_TXRXC_RXCHAIN_SHIFT	4
++#define  SSB_SPROM8_TXRXC_SWITCH	0xff00
++#define  SSB_SPROM8_TXRXC_SWITCH_SHIFT	8
+ #define SSB_SPROM8_RSSIPARM2G		0x00A4	/* RSSI params for 2GHz */
+ #define  SSB_SPROM8_RSSISMF2G		0x000F
+ #define  SSB_SPROM8_RSSISMC2G		0x00F0
+@@ -430,6 +444,7 @@
+ #define  SSB_SPROM8_TRI5GH_SHIFT	8
+ #define SSB_SPROM8_RXPO			0x00AC  /* RX power offsets */
+ #define  SSB_SPROM8_RXPO2G		0x00FF	/* 2GHz RX power offset */
++#define  SSB_SPROM8_RXPO2G_SHIFT	0
+ #define  SSB_SPROM8_RXPO5G		0xFF00	/* 5GHz RX power offset */
+ #define  SSB_SPROM8_RXPO5G_SHIFT	8
+ #define SSB_SPROM8_FEM2G		0x00AE
+@@ -445,10 +460,71 @@
+ #define  SSB_SROM8_FEM_ANTSWLUT		0xF800
+ #define  SSB_SROM8_FEM_ANTSWLUT_SHIFT	11
+ #define SSB_SPROM8_THERMAL		0x00B2
+-#define SSB_SPROM8_MPWR_RAWTS		0x00B4
+-#define SSB_SPROM8_TS_SLP_OPT_CORRX	0x00B6
+-#define SSB_SPROM8_FOC_HWIQ_IQSWP	0x00B8
+-#define SSB_SPROM8_PHYCAL_TEMPDELTA	0x00BA
++#define  SSB_SPROM8_THERMAL_OFFSET	0x00ff
++#define  SSB_SPROM8_THERMAL_OFFSET_SHIFT	0
++#define  SSB_SPROM8_THERMAL_TRESH	0xff00
++#define  SSB_SPROM8_THERMAL_TRESH_SHIFT	8
++/* Temp sense related entries */
++#define SSB_SPROM8_RAWTS		0x00B4
++#define  SSB_SPROM8_RAWTS_RAWTEMP	0x01ff
++#define  SSB_SPROM8_RAWTS_RAWTEMP_SHIFT	0
++#define  SSB_SPROM8_RAWTS_MEASPOWER	0xfe00
++#define  SSB_SPROM8_RAWTS_MEASPOWER_SHIFT	9
++#define SSB_SPROM8_OPT_CORRX		0x00B6
++#define  SSB_SPROM8_OPT_CORRX_TEMP_SLOPE	0x00ff
++#define  SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT	0
++#define  SSB_SPROM8_OPT_CORRX_TEMPCORRX	0xfc00
++#define  SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT	10
++#define  SSB_SPROM8_OPT_CORRX_TEMP_OPTION	0x0300
++#define  SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT	8
++/* FOC: freiquency offset correction, HWIQ: H/W IOCAL enable, IQSWP: IQ CAL swap disable */
++#define SSB_SPROM8_HWIQ_IQSWP		0x00B8
++#define  SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR	0x000f
++#define  SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT	0
++#define  SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP	0x0010
++#define  SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT	4
++#define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL	0x0020
++#define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT	5
++#define SSB_SPROM8_TEMPDELTA		0x00BC
++#define  SSB_SPROM8_TEMPDELTA_PHYCAL	0x00ff
++#define  SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT	0
++#define  SSB_SPROM8_TEMPDELTA_PERIOD	0x0f00
++#define  SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT	8
++#define  SSB_SPROM8_TEMPDELTA_HYSTERESIS	0xf000
++#define  SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT	12
++
++/* There are 4 blocks with power info sharing the same layout */
++#define SSB_SROM8_PWR_INFO_CORE0	0x00C0
++#define SSB_SROM8_PWR_INFO_CORE1	0x00E0
++#define SSB_SROM8_PWR_INFO_CORE2	0x0100
++#define SSB_SROM8_PWR_INFO_CORE3	0x0120
++
++#define SSB_SROM8_2G_MAXP_ITSSI		0x00
++#define  SSB_SPROM8_2G_MAXP		0x00FF
++#define  SSB_SPROM8_2G_ITSSI		0xFF00
++#define  SSB_SPROM8_2G_ITSSI_SHIFT	8
++#define SSB_SROM8_2G_PA_0		0x02	/* 2GHz power amp settings */
++#define SSB_SROM8_2G_PA_1		0x04
++#define SSB_SROM8_2G_PA_2		0x06
++#define SSB_SROM8_5G_MAXP_ITSSI		0x08	/* 5GHz ITSSI and 5.3GHz Max Power */
++#define  SSB_SPROM8_5G_MAXP		0x00FF
++#define  SSB_SPROM8_5G_ITSSI		0xFF00
++#define  SSB_SPROM8_5G_ITSSI_SHIFT	8
++#define SSB_SPROM8_5GHL_MAXP		0x0A	/* 5.2GHz and 5.8GHz Max Power */
++#define  SSB_SPROM8_5GH_MAXP		0x00FF
++#define  SSB_SPROM8_5GL_MAXP		0xFF00
++#define  SSB_SPROM8_5GL_MAXP_SHIFT	8
++#define SSB_SROM8_5G_PA_0		0x0C	/* 5.3GHz power amp settings */
++#define SSB_SROM8_5G_PA_1		0x0E
++#define SSB_SROM8_5G_PA_2		0x10
++#define SSB_SROM8_5GL_PA_0		0x12	/* 5.2GHz power amp settings */
++#define SSB_SROM8_5GL_PA_1		0x14
++#define SSB_SROM8_5GL_PA_2		0x16
++#define SSB_SROM8_5GH_PA_0		0x18	/* 5.8GHz power amp settings */
++#define SSB_SROM8_5GH_PA_1		0x1A
++#define SSB_SROM8_5GH_PA_2		0x1C
++
++/* TODO: Make it deprecated */
+ #define SSB_SPROM8_MAXP_BG		0x00C0  /* Max Power 2GHz in path 1 */
+ #define  SSB_SPROM8_MAXP_BG_MASK	0x00FF  /* Mask for Max Power 2GHz */
+ #define  SSB_SPROM8_ITSSI_BG		0xFF00	/* Mask for path 1 itssi_bg */
+@@ -473,12 +549,23 @@
+ #define SSB_SPROM8_PA1HIB0		0x00D8	/* 5.8GHz power amp settings */
+ #define SSB_SPROM8_PA1HIB1		0x00DA
+ #define SSB_SPROM8_PA1HIB2		0x00DC
++
+ #define SSB_SPROM8_CCK2GPO		0x0140	/* CCK power offset */
+ #define SSB_SPROM8_OFDM2GPO		0x0142	/* 2.4GHz OFDM power offset */
+ #define SSB_SPROM8_OFDM5GPO		0x0146	/* 5.3GHz OFDM power offset */
+ #define SSB_SPROM8_OFDM5GLPO		0x014A	/* 5.2GHz OFDM power offset */
+ #define SSB_SPROM8_OFDM5GHPO		0x014E	/* 5.8GHz OFDM power offset */
+ 
++#define SSB_SPROM8_2G_MCSPO		0x0152
++#define SSB_SPROM8_5G_MCSPO		0x0162
++#define SSB_SPROM8_5GL_MCSPO		0x0172
++#define SSB_SPROM8_5GH_MCSPO		0x0182
++
++#define SSB_SPROM8_CDDPO		0x0192
++#define SSB_SPROM8_STBCPO		0x0194
++#define SSB_SPROM8_BW40PO		0x0196
++#define SSB_SPROM8_BWDUPPO		0x0198
++
+ /* Values for boardflags_lo read from SPROM */
+ #define SSB_BFL_BTCOEXIST		0x0001	/* implements Bluetooth coexistance */
+ #define SSB_BFL_PACTRL			0x0002	/* GPIO 9 controlling the PA */
+--- /dev/null
++++ b/include/linux/bcm47xx_wdt.h
+@@ -0,0 +1,19 @@
++#ifndef LINUX_BCM47XX_WDT_H_
++#define LINUX_BCM47XX_WDT_H_
++
++#include <linux/types.h>
++
++
++struct bcm47xx_wdt {
++	u32 (*timer_set)(struct bcm47xx_wdt *, u32);
++	u32 (*timer_set_ms)(struct bcm47xx_wdt *, u32);
++	u32 max_timer_ms;
++
++	void *driver_data;
++};
++
++static inline void *bcm47xx_wdt_get_drvdata(struct bcm47xx_wdt *wdt)
++{
++	return wdt->driver_data;
++}
++#endif /* LINUX_BCM47XX_WDT_H_ */
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/025-bcma_backport.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/025-bcma_backport.patch.svn-base
new file mode 100644
index 0000000..a00bec3
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/025-bcma_backport.patch.svn-base
@@ -0,0 +1,4901 @@
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -29,7 +29,7 @@ config BCMA_HOST_PCI
+ 
+ config BCMA_DRIVER_PCI_HOSTMODE
+ 	bool "Driver for PCI core working in hostmode"
+-	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
+ 	help
+ 	  PCI core hostmode operation (external PCI bus).
+ 
+@@ -46,6 +46,33 @@ config BCMA_DRIVER_MIPS
+ 
+ 	  If unsure, say N
+ 
++config BCMA_SFLASH
++	bool
++	depends on BCMA_DRIVER_MIPS
++	default y
++
++config BCMA_NFLASH
++	bool
++	depends on BCMA_DRIVER_MIPS
++	default y
++
++config BCMA_DRIVER_GMAC_CMN
++	bool "BCMA Broadcom GBIT MAC COMMON core driver"
++	depends on BCMA
++	help
++	  Driver for the Broadcom GBIT MAC COMMON core attached to Broadcom
++	  specific Advanced Microcontroller Bus.
++
++	  If unsure, say N
++
++config BCMA_DRIVER_GPIO
++	bool "BCMA GPIO driver"
++	depends on BCMA && GPIOLIB
++	help
++	  Driver to provide access to the GPIO pins of the bcma bus.
++
++	  If unsure, say N
++
+ config BCMA_DEBUG
+ 	bool "BCMA debugging"
+ 	depends on BCMA
+--- a/drivers/bcma/Makefile
++++ b/drivers/bcma/Makefile
+@@ -1,8 +1,12 @@
+ bcma-y					+= main.o scan.o core.o sprom.o
+ bcma-y					+= driver_chipcommon.o driver_chipcommon_pmu.o
++bcma-$(CONFIG_BCMA_SFLASH)		+= driver_chipcommon_sflash.o
++bcma-$(CONFIG_BCMA_NFLASH)		+= driver_chipcommon_nflash.o
+ bcma-y					+= driver_pci.o
+ bcma-$(CONFIG_BCMA_DRIVER_PCI_HOSTMODE)	+= driver_pci_host.o
+ bcma-$(CONFIG_BCMA_DRIVER_MIPS)		+= driver_mips.o
++bcma-$(CONFIG_BCMA_DRIVER_GMAC_CMN)	+= driver_gmac_cmn.o
++bcma-$(CONFIG_BCMA_DRIVER_GPIO)		+= driver_gpio.o
+ bcma-$(CONFIG_BCMA_HOST_PCI)		+= host_pci.o
+ bcma-$(CONFIG_BCMA_HOST_SOC)		+= host_soc.o
+ obj-$(CONFIG_BCMA)			+= bcma.o
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -10,10 +10,19 @@
+ 
+ #define BCMA_CORE_SIZE		0x1000
+ 
++#define bcma_err(bus, fmt, ...) \
++	pr_err("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
++#define bcma_warn(bus, fmt, ...) \
++	pr_warn("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
++#define bcma_info(bus, fmt, ...) \
++	pr_info("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
++#define bcma_debug(bus, fmt, ...) \
++	pr_debug("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
++
+ struct bcma_bus;
+ 
+ /* main.c */
+-int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
+ void bcma_bus_unregister(struct bcma_bus *bus);
+ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ 				   struct bcma_device *core_cc,
+@@ -22,6 +31,8 @@ int __init bcma_bus_early_register(struc
+ int bcma_bus_suspend(struct bcma_bus *bus);
+ int bcma_bus_resume(struct bcma_bus *bus);
+ #endif
++struct bcma_device *bcma_find_core_unit(struct bcma_bus *bus, u16 coreid,
++					u8 unit);
+ 
+ /* scan.c */
+ int bcma_bus_scan(struct bcma_bus *bus);
+@@ -39,8 +50,32 @@ void bcma_chipco_serial_init(struct bcma
+ #endif /* CONFIG_BCMA_DRIVER_MIPS */
+ 
+ /* driver_chipcommon_pmu.c */
+-u32 bcma_pmu_alp_clock(struct bcma_drv_cc *cc);
+-u32 bcma_pmu_get_clockcpu(struct bcma_drv_cc *cc);
++u32 bcma_pmu_get_alp_clock(struct bcma_drv_cc *cc);
++u32 bcma_pmu_get_cpu_clock(struct bcma_drv_cc *cc);
++
++#ifdef CONFIG_BCMA_SFLASH
++/* driver_chipcommon_sflash.c */
++int bcma_sflash_init(struct bcma_drv_cc *cc);
++extern struct platform_device bcma_sflash_dev;
++#else
++static inline int bcma_sflash_init(struct bcma_drv_cc *cc)
++{
++	bcma_err(cc->core->bus, "Serial flash not supported\n");
++	return 0;
++}
++#endif /* CONFIG_BCMA_SFLASH */
++
++#ifdef CONFIG_BCMA_NFLASH
++/* driver_chipcommon_nflash.c */
++int bcma_nflash_init(struct bcma_drv_cc *cc);
++extern struct platform_device bcma_nflash_dev;
++#else
++static inline int bcma_nflash_init(struct bcma_drv_cc *cc)
++{
++	bcma_err(cc->core->bus, "NAND flash not supported\n");
++	return 0;
++}
++#endif /* CONFIG_BCMA_NFLASH */
+ 
+ #ifdef CONFIG_BCMA_HOST_PCI
+ /* host_pci.c */
+@@ -48,8 +83,24 @@ extern int __init bcma_host_pci_init(voi
+ extern void __exit bcma_host_pci_exit(void);
+ #endif /* CONFIG_BCMA_HOST_PCI */
+ 
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
++extern int bcma_chipco_watchdog_register(struct bcma_drv_cc *cc);
++
+ #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+ 
++#ifdef CONFIG_BCMA_DRIVER_GPIO
++/* driver_gpio.c */
++int bcma_gpio_init(struct bcma_drv_cc *cc);
++#else
++static inline int bcma_gpio_init(struct bcma_drv_cc *cc)
++{
++	return -ENOTSUPP;
++}
++#endif /* CONFIG_BCMA_DRIVER_GPIO */
++
+ #endif
+--- a/drivers/bcma/core.c
++++ b/drivers/bcma/core.c
+@@ -30,6 +30,7 @@ void bcma_core_disable(struct bcma_devic
+ 	udelay(10);
+ 
+ 	bcma_awrite32(core, BCMA_RESET_CTL, BCMA_RESET_CTL_RESET);
++	bcma_aread32(core, BCMA_RESET_CTL);
+ 	udelay(1);
+ }
+ EXPORT_SYMBOL_GPL(bcma_core_disable);
+@@ -64,7 +65,7 @@ void bcma_core_set_clockmode(struct bcma
+ 	switch (clkmode) {
+ 	case BCMA_CLKMODE_FAST:
+ 		bcma_set32(core, BCMA_CLKCTLST, BCMA_CLKCTLST_FORCEHT);
+-		udelay(64);
++		usleep_range(64, 300);
+ 		for (i = 0; i < 1500; i++) {
+ 			if (bcma_read32(core, BCMA_CLKCTLST) &
+ 			    BCMA_CLKCTLST_HAVEHT) {
+@@ -74,10 +75,10 @@ void bcma_core_set_clockmode(struct bcma
+ 			udelay(10);
+ 		}
+ 		if (i)
+-			pr_err("HT force timeout\n");
++			bcma_err(core->bus, "HT force timeout\n");
+ 		break;
+ 	case BCMA_CLKMODE_DYNAMIC:
+-		pr_warn("Dynamic clockmode not supported yet!\n");
++		bcma_set32(core, BCMA_CLKCTLST, ~BCMA_CLKCTLST_FORCEHT);
+ 		break;
+ 	}
+ }
+@@ -101,9 +102,9 @@ void bcma_core_pll_ctl(struct bcma_devic
+ 			udelay(10);
+ 		}
+ 		if (i)
+-			pr_err("PLL enable timeout\n");
++			bcma_err(core->bus, "PLL enable timeout\n");
+ 	} else {
+-		pr_warn("Disabling PLL not supported yet!\n");
++		bcma_warn(core->bus, "Disabling PLL not supported yet!\n");
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(bcma_core_pll_ctl);
+@@ -119,8 +120,8 @@ u32 bcma_core_dma_translation(struct bcm
+ 		else
+ 			return BCMA_DMA_TRANSLATION_DMA32_CMT;
+ 	default:
+-		pr_err("DMA translation unknown for host %d\n",
+-		       core->bus->hosttype);
++		bcma_err(core->bus, "DMA translation unknown for host %d\n",
++			 core->bus->hosttype);
+ 	}
+ 	return BCMA_DMA_TRANSLATION_NONE;
+ }
+--- a/drivers/bcma/driver_chipcommon.c
++++ b/drivers/bcma/driver_chipcommon.c
+@@ -4,12 +4,15 @@
+  *
+  * Copyright 2005, Broadcom Corporation
+  * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+ #include "bcma_private.h"
++#include <linux/bcm47xx_wdt.h>
+ #include <linux/export.h>
++#include <linux/platform_device.h>
+ #include <linux/bcma/bcma.h>
+ 
+ static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
+@@ -22,20 +25,119 @@ static inline u32 bcma_cc_write32_masked
+ 	return value;
+ }
+ 
+-void bcma_core_chipcommon_init(struct bcma_drv_cc *cc)
++static u32 bcma_chipco_get_alp_clock(struct bcma_drv_cc *cc)
+ {
+-	u32 leddc_on = 10;
+-	u32 leddc_off = 90;
++	if (cc->capabilities & BCMA_CC_CAP_PMU)
++		return bcma_pmu_get_alp_clock(cc);
+ 
+-	if (cc->setup_done)
++	return 20000000;
++}
++
++static u32 bcma_chipco_watchdog_get_max_timer(struct bcma_drv_cc *cc)
++{
++	struct bcma_bus *bus = cc->core->bus;
++	u32 nb;
++
++	if (cc->capabilities & BCMA_CC_CAP_PMU) {
++		if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706)
++			nb = 32;
++		else if (cc->core->id.rev < 26)
++			nb = 16;
++		else
++			nb = (cc->core->id.rev >= 37) ? 32 : 24;
++	} else {
++		nb = 28;
++	}
++	if (nb == 32)
++		return 0xffffffff;
++	else
++		return (1 << nb) - 1;
++}
++
++static u32 bcma_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
++					      u32 ticks)
++{
++	struct bcma_drv_cc *cc = bcm47xx_wdt_get_drvdata(wdt);
++
++	return bcma_chipco_watchdog_timer_set(cc, ticks);
++}
++
++static u32 bcma_chipco_watchdog_timer_set_ms_wdt(struct bcm47xx_wdt *wdt,
++						 u32 ms)
++{
++	struct bcma_drv_cc *cc = bcm47xx_wdt_get_drvdata(wdt);
++	u32 ticks;
++
++	ticks = bcma_chipco_watchdog_timer_set(cc, cc->ticks_per_ms * ms);
++	return ticks / cc->ticks_per_ms;
++}
++
++static int bcma_chipco_watchdog_ticks_per_ms(struct bcma_drv_cc *cc)
++{
++	struct bcma_bus *bus = cc->core->bus;
++
++	if (cc->capabilities & BCMA_CC_CAP_PMU) {
++		if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706)
++			/* 4706 CC and PMU watchdogs are clocked at 1/4 of ALP clock */
++			return bcma_chipco_get_alp_clock(cc) / 4000;
++		else
++			/* based on 32KHz ILP clock */
++			return 32;
++	} else {
++		return bcma_chipco_get_alp_clock(cc) / 1000;
++	}
++}
++
++int bcma_chipco_watchdog_register(struct bcma_drv_cc *cc)
++{
++	struct bcm47xx_wdt wdt = {};
++	struct platform_device *pdev;
++
++	wdt.driver_data = cc;
++	wdt.timer_set = bcma_chipco_watchdog_timer_set_wdt;
++	wdt.timer_set_ms = bcma_chipco_watchdog_timer_set_ms_wdt;
++	wdt.max_timer_ms = bcma_chipco_watchdog_get_max_timer(cc) / cc->ticks_per_ms;
++
++	pdev = platform_device_register_data(NULL, "bcm47xx-wdt",
++					     cc->core->bus->num, &wdt,
++					     sizeof(wdt));
++	if (IS_ERR(pdev))
++		return PTR_ERR(pdev);
++
++	cc->watchdog = pdev;
++
++	return 0;
++}
++
++void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
++{
++	if (cc->early_setup_done)
+ 		return;
+ 
++	spin_lock_init(&cc->gpio_lock);
++
+ 	if (cc->core->id.rev >= 11)
+ 		cc->status = bcma_cc_read32(cc, BCMA_CC_CHIPSTAT);
+ 	cc->capabilities = bcma_cc_read32(cc, BCMA_CC_CAP);
+ 	if (cc->core->id.rev >= 35)
+ 		cc->capabilities_ext = bcma_cc_read32(cc, BCMA_CC_CAP_EXT);
+ 
++	if (cc->capabilities & BCMA_CC_CAP_PMU)
++		bcma_pmu_early_init(cc);
++
++	cc->early_setup_done = true;
++}
++
++void bcma_core_chipcommon_init(struct bcma_drv_cc *cc)
++{
++	u32 leddc_on = 10;
++	u32 leddc_off = 90;
++
++	if (cc->setup_done)
++		return;
++
++	bcma_core_chipcommon_early_init(cc);
++
+ 	if (cc->core->id.rev >= 20) {
+ 		bcma_cc_write32(cc, BCMA_CC_GPIOPULLUP, 0);
+ 		bcma_cc_write32(cc, BCMA_CC_GPIOPULLDOWN, 0);
+@@ -44,7 +146,7 @@ void bcma_core_chipcommon_init(struct bc
+ 	if (cc->capabilities & BCMA_CC_CAP_PMU)
+ 		bcma_pmu_init(cc);
+ 	if (cc->capabilities & BCMA_CC_CAP_PCTL)
+-		pr_err("Power control not implemented!\n");
++		bcma_err(cc->core->bus, "Power control not implemented!\n");
+ 
+ 	if (cc->core->id.rev >= 16) {
+ 		if (cc->core->bus->sprom.leddc_on_time &&
+@@ -56,15 +158,33 @@ void bcma_core_chipcommon_init(struct bc
+ 			((leddc_on << BCMA_CC_GPIOTIMER_ONTIME_SHIFT) |
+ 			 (leddc_off << BCMA_CC_GPIOTIMER_OFFTIME_SHIFT)));
+ 	}
++	cc->ticks_per_ms = bcma_chipco_watchdog_ticks_per_ms(cc);
+ 
+ 	cc->setup_done = true;
+ }
+ 
+ /* Set chip watchdog reset timer to fire in 'ticks' backplane cycles */
+-void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks)
++u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks)
+ {
+-	/* instant NMI */
+-	bcma_cc_write32(cc, BCMA_CC_WATCHDOG, ticks);
++	u32 maxt;
++	enum bcma_clkmode clkmode;
++
++	maxt = bcma_chipco_watchdog_get_max_timer(cc);
++	if (cc->capabilities & BCMA_CC_CAP_PMU) {
++		if (ticks == 1)
++			ticks = 2;
++		else if (ticks > maxt)
++			ticks = maxt;
++		bcma_cc_write32(cc, BCMA_CC_PMU_WATCHDOG, ticks);
++	} else {
++		clkmode = ticks ? BCMA_CLKMODE_FAST : BCMA_CLKMODE_DYNAMIC;
++		bcma_core_set_clockmode(cc->core, clkmode);
++		if (ticks > maxt)
++			ticks = maxt;
++		/* instant NMI */
++		bcma_cc_write32(cc, BCMA_CC_WATCHDOG, ticks);
++	}
++	return ticks;
+ }
+ 
+ void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value)
+@@ -84,28 +204,97 @@ u32 bcma_chipco_gpio_in(struct bcma_drv_
+ 
+ u32 bcma_chipco_gpio_out(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOOUT, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOOUT, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 bcma_chipco_gpio_outen(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOOUTEN, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOOUTEN, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
++/*
++ * If the bit is set to 0, chipcommon controlls this GPIO,
++ * if the bit is set to 1, it is used by some part of the chip and not our code.
++ */
+ u32 bcma_chipco_gpio_control(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOCTL, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOCTL, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ EXPORT_SYMBOL_GPL(bcma_chipco_gpio_control);
+ 
+ u32 bcma_chipco_gpio_intmask(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOIRQ, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOIRQ, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 bcma_chipco_gpio_polarity(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOPOL, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOPOL, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
++}
++
++u32 bcma_chipco_gpio_pullup(struct bcma_drv_cc *cc, u32 mask, u32 value)
++{
++	unsigned long flags;
++	u32 res;
++
++	if (cc->core->id.rev < 20)
++		return 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOPULLUP, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
++}
++
++u32 bcma_chipco_gpio_pulldown(struct bcma_drv_cc *cc, u32 mask, u32 value)
++{
++	unsigned long flags;
++	u32 res;
++
++	if (cc->core->id.rev < 20)
++		return 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOPULLDOWN, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ #ifdef CONFIG_BCMA_DRIVER_MIPS
+@@ -118,8 +307,7 @@ void bcma_chipco_serial_init(struct bcma
+ 	struct bcma_serial_port *ports = cc->serial_ports;
+ 
+ 	if (ccrev >= 11 && ccrev != 15) {
+-		/* Fixed ALP clock */
+-		baud_base = bcma_pmu_alp_clock(cc);
++		baud_base = bcma_chipco_get_alp_clock(cc);
+ 		if (ccrev >= 21) {
+ 			/* Turn off UART clock before switching clocksource. */
+ 			bcma_cc_write32(cc, BCMA_CC_CORECTL,
+@@ -137,8 +325,7 @@ void bcma_chipco_serial_init(struct bcma
+ 				       | BCMA_CC_CORECTL_UARTCLKEN);
+ 		}
+ 	} else {
+-		pr_err("serial not supported on this device ccrev: 0x%x\n",
+-		       ccrev);
++		bcma_err(cc->core->bus, "serial not supported on this device ccrev: 0x%x\n", ccrev);
+ 		return;
+ 	}
+ 
+--- /dev/null
++++ b/drivers/bcma/driver_chipcommon_nflash.c
+@@ -0,0 +1,44 @@
++/*
++ * Broadcom specific AMBA
++ * ChipCommon NAND flash interface
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/platform_device.h>
++#include <linux/bcma/bcma.h>
++
++#include "bcma_private.h"
++
++struct platform_device bcma_nflash_dev = {
++	.name		= "bcma_nflash",
++	.num_resources	= 0,
++};
++
++/* Initialize NAND flash access */
++int bcma_nflash_init(struct bcma_drv_cc *cc)
++{
++	struct bcma_bus *bus = cc->core->bus;
++
++	if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&
++	    cc->core->id.rev != 0x38) {
++		bcma_err(bus, "NAND flash on unsupported board!\n");
++		return -ENOTSUPP;
++	}
++
++	if (!(cc->capabilities & BCMA_CC_CAP_NFLASH)) {
++		bcma_err(bus, "NAND flash not present according to ChipCommon\n");
++		return -ENODEV;
++	}
++
++	cc->nflash.present = true;
++	if (cc->core->id.rev == 38 &&
++	    (cc->status & BCMA_CC_CHIPST_5357_NAND_BOOT))
++		cc->nflash.boot = true;
++
++	/* Prepare platform device, but don't register it yet. It's too early,
++	 * malloc (required by device_private_init) is not available yet. */
++	bcma_nflash_dev.dev.platform_data = &cc->nflash;
++
++	return 0;
++}
+--- a/drivers/bcma/driver_chipcommon_pmu.c
++++ b/drivers/bcma/driver_chipcommon_pmu.c
+@@ -3,7 +3,8 @@
+  * ChipCommon Power Management Unit driver
+  *
+  * Copyright 2009, Michael Buesch <m@bues.ch>
+- * Copyright 2007, Broadcom Corporation
++ * Copyright 2007, 2011, Broadcom Corporation
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+@@ -12,12 +13,13 @@
+ #include <linux/export.h>
+ #include <linux/bcma/bcma.h>
+ 
+-static u32 bcma_chipco_pll_read(struct bcma_drv_cc *cc, u32 offset)
++u32 bcma_chipco_pll_read(struct bcma_drv_cc *cc, u32 offset)
+ {
+ 	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
+ 	bcma_cc_read32(cc, BCMA_CC_PLLCTL_ADDR);
+ 	return bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
+ }
++EXPORT_SYMBOL_GPL(bcma_chipco_pll_read);
+ 
+ void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset, u32 value)
+ {
+@@ -54,38 +56,19 @@ void bcma_chipco_regctl_maskset(struct b
+ }
+ EXPORT_SYMBOL_GPL(bcma_chipco_regctl_maskset);
+ 
+-static void bcma_pmu_pll_init(struct bcma_drv_cc *cc)
+-{
+-	struct bcma_bus *bus = cc->core->bus;
+-
+-	switch (bus->chipinfo.id) {
+-	case 0x4313:
+-	case 0x4331:
+-	case 43224:
+-	case 43225:
+-		break;
+-	default:
+-		pr_err("PLL init unknown for device 0x%04X\n",
+-			bus->chipinfo.id);
+-	}
+-}
+-
+ static void bcma_pmu_resources_init(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 	u32 min_msk = 0, max_msk = 0;
+ 
+ 	switch (bus->chipinfo.id) {
+-	case 0x4313:
++	case BCMA_CHIP_ID_BCM4313:
+ 		min_msk = 0x200D;
+ 		max_msk = 0xFFFF;
+ 		break;
+-	case 43224:
+-	case 43225:
+-		break;
+ 	default:
+-		pr_err("PMU resource config unknown for device 0x%04X\n",
+-			bus->chipinfo.id);
++		bcma_debug(bus, "PMU resource config unknown or not needed for device 0x%04X\n",
++			   bus->chipinfo.id);
+ 	}
+ 
+ 	/* Set the resource masks. */
+@@ -93,22 +76,12 @@ static void bcma_pmu_resources_init(stru
+ 		bcma_cc_write32(cc, BCMA_CC_PMU_MINRES_MSK, min_msk);
+ 	if (max_msk)
+ 		bcma_cc_write32(cc, BCMA_CC_PMU_MAXRES_MSK, max_msk);
+-}
+-
+-void bcma_pmu_swreg_init(struct bcma_drv_cc *cc)
+-{
+-	struct bcma_bus *bus = cc->core->bus;
+ 
+-	switch (bus->chipinfo.id) {
+-	case 0x4313:
+-	case 0x4331:
+-	case 43224:
+-	case 43225:
+-		break;
+-	default:
+-		pr_err("PMU switch/regulators init unknown for device "
+-			"0x%04X\n", bus->chipinfo.id);
+-	}
++	/*
++	 * Add some delay; allow resources to come up and settle.
++	 * Delay is required for SoC (early init).
++	 */
++	mdelay(2);
+ }
+ 
+ /* Disable to allow reading SPROM. Don't know the adventages of enabling it. */
+@@ -122,51 +95,69 @@ void bcma_chipco_bcm4331_ext_pa_lines_ct
+ 		val |= BCMA_CHIPCTL_4331_EXTPA_EN;
+ 		if (bus->chipinfo.pkg == 9 || bus->chipinfo.pkg == 11)
+ 			val |= BCMA_CHIPCTL_4331_EXTPA_ON_GPIO2_5;
++		else if (bus->chipinfo.rev > 0)
++			val |= BCMA_CHIPCTL_4331_EXTPA_EN2;
+ 	} else {
+ 		val &= ~BCMA_CHIPCTL_4331_EXTPA_EN;
++		val &= ~BCMA_CHIPCTL_4331_EXTPA_EN2;
+ 		val &= ~BCMA_CHIPCTL_4331_EXTPA_ON_GPIO2_5;
+ 	}
+ 	bcma_cc_write32(cc, BCMA_CC_CHIPCTL, val);
+ }
+ 
+-void bcma_pmu_workarounds(struct bcma_drv_cc *cc)
++static void bcma_pmu_workarounds(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 
+ 	switch (bus->chipinfo.id) {
+-	case 0x4313:
+-		bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x7);
++	case BCMA_CHIP_ID_BCM4313:
++		/* enable 12 mA drive strenth for 4313 and set chipControl
++		   register bit 1 */
++		bcma_chipco_chipctl_maskset(cc, 0,
++					    ~BCMA_CCTRL_4313_12MA_LED_DRIVE,
++					    BCMA_CCTRL_4313_12MA_LED_DRIVE);
+ 		break;
+-	case 0x4331:
+-		/* BCM4331 workaround is SPROM-related, we put it in sprom.c */
++	case BCMA_CHIP_ID_BCM4331:
++	case BCMA_CHIP_ID_BCM43431:
++		/* Ext PA lines must be enabled for tx on BCM4331 */
++		bcma_chipco_bcm4331_ext_pa_lines_ctl(cc, true);
+ 		break;
+-	case 43224:
++	case BCMA_CHIP_ID_BCM43224:
++	case BCMA_CHIP_ID_BCM43421:
++		/* enable 12 mA drive strenth for 43224 and set chipControl
++		   register bit 15 */
+ 		if (bus->chipinfo.rev == 0) {
+-			pr_err("Workarounds for 43224 rev 0 not fully "
+-				"implemented\n");
+-			bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x00F000F0);
++			bcma_cc_maskset32(cc, BCMA_CC_CHIPCTL,
++					  ~BCMA_CCTRL_43224_GPIO_TOGGLE,
++					  BCMA_CCTRL_43224_GPIO_TOGGLE);
++			bcma_chipco_chipctl_maskset(cc, 0,
++						    ~BCMA_CCTRL_43224A0_12MA_LED_DRIVE,
++						    BCMA_CCTRL_43224A0_12MA_LED_DRIVE);
+ 		} else {
+-			bcma_chipco_chipctl_maskset(cc, 0, ~0, 0xF0);
++			bcma_chipco_chipctl_maskset(cc, 0,
++						    ~BCMA_CCTRL_43224B0_12MA_LED_DRIVE,
++						    BCMA_CCTRL_43224B0_12MA_LED_DRIVE);
+ 		}
+ 		break;
+-	case 43225:
+-		break;
+ 	default:
+-		pr_err("Workarounds unknown for device 0x%04X\n",
+-			bus->chipinfo.id);
++		bcma_debug(bus, "Workarounds unknown or not needed for device 0x%04X\n",
++			   bus->chipinfo.id);
+ 	}
+ }
+ 
+-void bcma_pmu_init(struct bcma_drv_cc *cc)
++void bcma_pmu_early_init(struct bcma_drv_cc *cc)
+ {
+ 	u32 pmucap;
+ 
+ 	pmucap = bcma_cc_read32(cc, BCMA_CC_PMU_CAP);
+ 	cc->pmu.rev = (pmucap & BCMA_CC_PMU_CAP_REVISION);
+ 
+-	pr_debug("Found rev %u PMU (capabilities 0x%08X)\n", cc->pmu.rev,
+-		 pmucap);
++	bcma_debug(cc->core->bus, "Found rev %u PMU (capabilities 0x%08X)\n",
++		   cc->pmu.rev, pmucap);
++}
+ 
++void bcma_pmu_init(struct bcma_drv_cc *cc)
++{
+ 	if (cc->pmu.rev == 1)
+ 		bcma_cc_mask32(cc, BCMA_CC_PMU_CTL,
+ 			      ~BCMA_CC_PMU_CTL_NOILPONW);
+@@ -174,37 +165,31 @@ void bcma_pmu_init(struct bcma_drv_cc *c
+ 		bcma_cc_set32(cc, BCMA_CC_PMU_CTL,
+ 			     BCMA_CC_PMU_CTL_NOILPONW);
+ 
+-	if (cc->core->id.id == 0x4329 && cc->core->id.rev == 2)
+-		pr_err("Fix for 4329b0 bad LPOM state not implemented!\n");
+-
+-	bcma_pmu_pll_init(cc);
+ 	bcma_pmu_resources_init(cc);
+-	bcma_pmu_swreg_init(cc);
+ 	bcma_pmu_workarounds(cc);
+ }
+ 
+-u32 bcma_pmu_alp_clock(struct bcma_drv_cc *cc)
++u32 bcma_pmu_get_alp_clock(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 
+ 	switch (bus->chipinfo.id) {
+-	case 0x4716:
+-	case 0x4748:
+-	case 47162:
+-	case 0x4313:
+-	case 0x5357:
+-	case 0x4749:
+-	case 53572:
++	case BCMA_CHIP_ID_BCM4716:
++	case BCMA_CHIP_ID_BCM4748:
++	case BCMA_CHIP_ID_BCM47162:
++	case BCMA_CHIP_ID_BCM4313:
++	case BCMA_CHIP_ID_BCM5357:
++	case BCMA_CHIP_ID_BCM4749:
++	case BCMA_CHIP_ID_BCM53572:
+ 		/* always 20Mhz */
+ 		return 20000 * 1000;
+-	case 0x5356:
+-	case 0x5300:
++	case BCMA_CHIP_ID_BCM5356:
++	case BCMA_CHIP_ID_BCM4706:
+ 		/* always 25Mhz */
+ 		return 25000 * 1000;
+ 	default:
+-		pr_warn("No ALP clock specified for %04X device, "
+-			"pmu rev. %d, using default %d Hz\n",
+-			bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_ALP_CLOCK);
++		bcma_warn(bus, "No ALP clock specified for %04X device, pmu rev. %d, using default %d Hz\n",
++			  bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_ALP_CLOCK);
+ 	}
+ 	return BCMA_CC_PMU_ALP_CLOCK;
+ }
+@@ -212,7 +197,7 @@ u32 bcma_pmu_alp_clock(struct bcma_drv_c
+ /* Find the output of the "m" pll divider given pll controls that start with
+  * pllreg "pll0" i.e. 12 for main 6 for phy, 0 for misc.
+  */
+-static u32 bcma_pmu_clock(struct bcma_drv_cc *cc, u32 pll0, u32 m)
++static u32 bcma_pmu_pll_clock(struct bcma_drv_cc *cc, u32 pll0, u32 m)
+ {
+ 	u32 tmp, div, ndiv, p1, p2, fc;
+ 	struct bcma_bus *bus = cc->core->bus;
+@@ -221,7 +206,8 @@ static u32 bcma_pmu_clock(struct bcma_dr
+ 
+ 	BUG_ON(!m || m > 4);
+ 
+-	if (bus->chipinfo.id == 0x5357 || bus->chipinfo.id == 0x4749) {
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM5357 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM4749) {
+ 		/* Detect failure in clock setting */
+ 		tmp = bcma_cc_read32(cc, BCMA_CC_CHIPSTAT);
+ 		if (tmp & 0x40000)
+@@ -240,60 +226,95 @@ static u32 bcma_pmu_clock(struct bcma_dr
+ 	ndiv = (tmp & BCMA_CC_PPL_NDIV_MASK) >> BCMA_CC_PPL_NDIV_SHIFT;
+ 
+ 	/* Do calculation in Mhz */
+-	fc = bcma_pmu_alp_clock(cc) / 1000000;
++	fc = bcma_pmu_get_alp_clock(cc) / 1000000;
+ 	fc = (p1 * ndiv * fc) / p2;
+ 
+ 	/* Return clock in Hertz */
+ 	return (fc / div) * 1000000;
+ }
+ 
++static u32 bcma_pmu_pll_clock_bcm4706(struct bcma_drv_cc *cc, u32 pll0, u32 m)
++{
++	u32 tmp, ndiv, p1div, p2div;
++	u32 clock;
++
++	BUG_ON(!m || m > 4);
++
++	/* Get N, P1 and P2 dividers to determine CPU clock */
++	tmp = bcma_chipco_pll_read(cc, pll0 + BCMA_CC_PMU6_4706_PROCPLL_OFF);
++	ndiv = (tmp & BCMA_CC_PMU6_4706_PROC_NDIV_INT_MASK)
++		>> BCMA_CC_PMU6_4706_PROC_NDIV_INT_SHIFT;
++	p1div = (tmp & BCMA_CC_PMU6_4706_PROC_P1DIV_MASK)
++		>> BCMA_CC_PMU6_4706_PROC_P1DIV_SHIFT;
++	p2div = (tmp & BCMA_CC_PMU6_4706_PROC_P2DIV_MASK)
++		>> BCMA_CC_PMU6_4706_PROC_P2DIV_SHIFT;
++
++	tmp = bcma_cc_read32(cc, BCMA_CC_CHIPSTAT);
++	if (tmp & BCMA_CC_CHIPST_4706_PKG_OPTION)
++		/* Low cost bonding: Fixed reference clock 25MHz and m = 4 */
++		clock = (25000000 / 4) * ndiv * p2div / p1div;
++	else
++		/* Fixed reference clock 25MHz and m = 2 */
++		clock = (25000000 / 2) * ndiv * p2div / p1div;
++
++	if (m == BCMA_CC_PMU5_MAINPLL_SSB)
++		clock = clock / 4;
++
++	return clock;
++}
++
+ /* query bus clock frequency for PMU-enabled chipcommon */
+-u32 bcma_pmu_get_clockcontrol(struct bcma_drv_cc *cc)
++static u32 bcma_pmu_get_bus_clock(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 
+ 	switch (bus->chipinfo.id) {
+-	case 0x4716:
+-	case 0x4748:
+-	case 47162:
+-		return bcma_pmu_clock(cc, BCMA_CC_PMU4716_MAINPLL_PLL0,
+-				      BCMA_CC_PMU5_MAINPLL_SSB);
+-	case 0x5356:
+-		return bcma_pmu_clock(cc, BCMA_CC_PMU5356_MAINPLL_PLL0,
+-				      BCMA_CC_PMU5_MAINPLL_SSB);
+-	case 0x5357:
+-	case 0x4749:
+-		return bcma_pmu_clock(cc, BCMA_CC_PMU5357_MAINPLL_PLL0,
+-				      BCMA_CC_PMU5_MAINPLL_SSB);
+-	case 0x5300:
+-		return bcma_pmu_clock(cc, BCMA_CC_PMU4706_MAINPLL_PLL0,
+-				      BCMA_CC_PMU5_MAINPLL_SSB);
+-	case 53572:
++	case BCMA_CHIP_ID_BCM4716:
++	case BCMA_CHIP_ID_BCM4748:
++	case BCMA_CHIP_ID_BCM47162:
++		return bcma_pmu_pll_clock(cc, BCMA_CC_PMU4716_MAINPLL_PLL0,
++					  BCMA_CC_PMU5_MAINPLL_SSB);
++	case BCMA_CHIP_ID_BCM5356:
++		return bcma_pmu_pll_clock(cc, BCMA_CC_PMU5356_MAINPLL_PLL0,
++					  BCMA_CC_PMU5_MAINPLL_SSB);
++	case BCMA_CHIP_ID_BCM5357:
++	case BCMA_CHIP_ID_BCM4749:
++		return bcma_pmu_pll_clock(cc, BCMA_CC_PMU5357_MAINPLL_PLL0,
++					  BCMA_CC_PMU5_MAINPLL_SSB);
++	case BCMA_CHIP_ID_BCM4706:
++		return bcma_pmu_pll_clock_bcm4706(cc,
++						  BCMA_CC_PMU4706_MAINPLL_PLL0,
++						  BCMA_CC_PMU5_MAINPLL_SSB);
++	case BCMA_CHIP_ID_BCM53572:
+ 		return 75000000;
+ 	default:
+-		pr_warn("No backplane clock specified for %04X device, "
+-			"pmu rev. %d, using default %d Hz\n",
+-			bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_HT_CLOCK);
++		bcma_warn(bus, "No bus clock specified for %04X device, pmu rev. %d, using default %d Hz\n",
++			  bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_HT_CLOCK);
+ 	}
+ 	return BCMA_CC_PMU_HT_CLOCK;
+ }
+ 
+ /* query cpu clock frequency for PMU-enabled chipcommon */
+-u32 bcma_pmu_get_clockcpu(struct bcma_drv_cc *cc)
++u32 bcma_pmu_get_cpu_clock(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 
+-	if (bus->chipinfo.id == 53572)
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM53572)
+ 		return 300000000;
+ 
++	/* New PMUs can have different clock for bus and CPU */
+ 	if (cc->pmu.rev >= 5) {
+ 		u32 pll;
+ 		switch (bus->chipinfo.id) {
+-		case 0x5356:
++		case BCMA_CHIP_ID_BCM4706:
++			return bcma_pmu_pll_clock_bcm4706(cc,
++						BCMA_CC_PMU4706_MAINPLL_PLL0,
++						BCMA_CC_PMU5_MAINPLL_CPU);
++		case BCMA_CHIP_ID_BCM5356:
+ 			pll = BCMA_CC_PMU5356_MAINPLL_PLL0;
+ 			break;
+-		case 0x5357:
+-		case 0x4749:
++		case BCMA_CHIP_ID_BCM5357:
++		case BCMA_CHIP_ID_BCM4749:
+ 			pll = BCMA_CC_PMU5357_MAINPLL_PLL0;
+ 			break;
+ 		default:
+@@ -301,10 +322,189 @@ u32 bcma_pmu_get_clockcpu(struct bcma_dr
+ 			break;
+ 		}
+ 
+-		/* TODO: if (bus->chipinfo.id == 0x5300)
+-		  return si_4706_pmu_clock(sih, osh, cc, PMU4706_MAINPLL_PLL0, PMU5_MAINPLL_CPU); */
+-		return bcma_pmu_clock(cc, pll, BCMA_CC_PMU5_MAINPLL_CPU);
++		return bcma_pmu_pll_clock(cc, pll, BCMA_CC_PMU5_MAINPLL_CPU);
++	}
++
++	/* On old PMUs CPU has the same clock as the bus */
++	return bcma_pmu_get_bus_clock(cc);
++}
++
++static void bcma_pmu_spuravoid_pll_write(struct bcma_drv_cc *cc, u32 offset,
++					 u32 value)
++{
++	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
++	bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, value);
++}
++
++void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
++{
++	u32 tmp = 0;
++	u8 phypll_offset = 0;
++	u8 bcm5357_bcm43236_p1div[] = {0x1, 0x5, 0x5};
++	u8 bcm5357_bcm43236_ndiv[] = {0x30, 0xf6, 0xfc};
++	struct bcma_bus *bus = cc->core->bus;
++
++	switch (bus->chipinfo.id) {
++	case BCMA_CHIP_ID_BCM5357:
++	case BCMA_CHIP_ID_BCM4749:
++	case BCMA_CHIP_ID_BCM53572:
++		/* 5357[ab]0, 43236[ab]0, and 6362b0 */
++
++		/* BCM5357 needs to touch PLL1_PLLCTL[02],
++		   so offset PLL0_PLLCTL[02] by 6 */
++		phypll_offset = (bus->chipinfo.id == BCMA_CHIP_ID_BCM5357 ||
++		       bus->chipinfo.id == BCMA_CHIP_ID_BCM4749 ||
++		       bus->chipinfo.id == BCMA_CHIP_ID_BCM53572) ? 6 : 0;
++
++		/* RMW only the P1 divider */
++		bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
++				BCMA_CC_PMU_PLL_CTL0 + phypll_offset);
++		tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
++		tmp &= (~(BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK));
++		tmp |= (bcm5357_bcm43236_p1div[spuravoid] << BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT);
++		bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
++
++		/* RMW only the int feedback divider */
++		bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
++				BCMA_CC_PMU_PLL_CTL2 + phypll_offset);
++		tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
++		tmp &= ~(BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK);
++		tmp |= (bcm5357_bcm43236_ndiv[spuravoid]) << BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT;
++		bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
++
++		tmp = 1 << 10;
++		break;
++
++	case BCMA_CHIP_ID_BCM4331:
++	case BCMA_CHIP_ID_BCM43431:
++		if (spuravoid == 2) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11500014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x0FC00a08);
++		} else if (spuravoid == 1) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11500014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x0F600a08);
++		} else {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11100014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03000a08);
++		}
++		tmp = 1 << 10;
++		break;
++
++	case BCMA_CHIP_ID_BCM43224:
++	case BCMA_CHIP_ID_BCM43225:
++	case BCMA_CHIP_ID_BCM43421:
++		if (spuravoid == 1) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11500010);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x000C0C06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x0F600a08);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x2001E920);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		} else {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11100010);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x000c0c06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03000a08);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x200005c0);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		}
++		tmp = 1 << 10;
++		break;
++
++	case BCMA_CHIP_ID_BCM4716:
++	case BCMA_CHIP_ID_BCM4748:
++	case BCMA_CHIP_ID_BCM47162:
++		if (spuravoid == 1) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11500060);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x080C0C06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x0F600000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x2001E924);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		} else {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11100060);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x080c0c06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x200005c0);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		}
++
++		tmp = 3 << 9;
++		break;
++
++	case BCMA_CHIP_ID_BCM43227:
++	case BCMA_CHIP_ID_BCM43228:
++	case BCMA_CHIP_ID_BCM43428:
++		/* LCNXN */
++		/* PLL Settings for spur avoidance on/off mode,
++		   no on2 support for 43228A0 */
++		if (spuravoid == 1) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x01100014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x040C0C06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03140A08);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00333333);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x202C2820);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		} else {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11100014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x040c0c06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03000a08);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x200005c0);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		}
++		tmp = 1 << 10;
++		break;
++	default:
++		bcma_err(bus, "Unknown spuravoidance settings for chip 0x%04X, not changing PLL\n",
++			 bus->chipinfo.id);
++		break;
+ 	}
+ 
+-	return bcma_pmu_get_clockcontrol(cc);
++	tmp |= bcma_cc_read32(cc, BCMA_CC_PMU_CTL);
++	bcma_cc_write32(cc, BCMA_CC_PMU_CTL, tmp);
+ }
++EXPORT_SYMBOL_GPL(bcma_pmu_spuravoid_pllupdate);
+--- /dev/null
++++ b/drivers/bcma/driver_chipcommon_sflash.c
+@@ -0,0 +1,165 @@
++/*
++ * Broadcom specific AMBA
++ * ChipCommon serial flash interface
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/platform_device.h>
++#include <linux/bcma/bcma.h>
++
++#include "bcma_private.h"
++
++static struct resource bcma_sflash_resource = {
++	.name	= "bcma_sflash",
++	.start	= BCMA_SOC_FLASH2,
++	.end	= 0,
++	.flags  = IORESOURCE_MEM | IORESOURCE_READONLY,
++};
++
++struct platform_device bcma_sflash_dev = {
++	.name		= "bcma_sflash",
++	.resource	= &bcma_sflash_resource,
++	.num_resources	= 1,
++};
++
++struct bcma_sflash_tbl_e {
++	char *name;
++	u32 id;
++	u32 blocksize;
++	u16 numblocks;
++};
++
++static struct bcma_sflash_tbl_e bcma_sflash_st_tbl[] = {
++	{ "M25P20", 0x11, 0x10000, 4, },
++	{ "M25P40", 0x12, 0x10000, 8, },
++
++	{ "M25P16", 0x14, 0x10000, 32, },
++	{ "M25P32", 0x15, 0x10000, 64, },
++	{ "M25P64", 0x16, 0x10000, 128, },
++	{ "M25FL128", 0x17, 0x10000, 256, },
++	{ 0 },
++};
++
++static struct bcma_sflash_tbl_e bcma_sflash_sst_tbl[] = {
++	{ "SST25WF512", 1, 0x1000, 16, },
++	{ "SST25VF512", 0x48, 0x1000, 16, },
++	{ "SST25WF010", 2, 0x1000, 32, },
++	{ "SST25VF010", 0x49, 0x1000, 32, },
++	{ "SST25WF020", 3, 0x1000, 64, },
++	{ "SST25VF020", 0x43, 0x1000, 64, },
++	{ "SST25WF040", 4, 0x1000, 128, },
++	{ "SST25VF040", 0x44, 0x1000, 128, },
++	{ "SST25VF040B", 0x8d, 0x1000, 128, },
++	{ "SST25WF080", 5, 0x1000, 256, },
++	{ "SST25VF080B", 0x8e, 0x1000, 256, },
++	{ "SST25VF016", 0x41, 0x1000, 512, },
++	{ "SST25VF032", 0x4a, 0x1000, 1024, },
++	{ "SST25VF064", 0x4b, 0x1000, 2048, },
++	{ 0 },
++};
++
++static struct bcma_sflash_tbl_e bcma_sflash_at_tbl[] = {
++	{ "AT45DB011", 0xc, 256, 512, },
++	{ "AT45DB021", 0x14, 256, 1024, },
++	{ "AT45DB041", 0x1c, 256, 2048, },
++	{ "AT45DB081", 0x24, 256, 4096, },
++	{ "AT45DB161", 0x2c, 512, 4096, },
++	{ "AT45DB321", 0x34, 512, 8192, },
++	{ "AT45DB642", 0x3c, 1024, 8192, },
++	{ 0 },
++};
++
++static void bcma_sflash_cmd(struct bcma_drv_cc *cc, u32 opcode)
++{
++	int i;
++	bcma_cc_write32(cc, BCMA_CC_FLASHCTL,
++			BCMA_CC_FLASHCTL_START | opcode);
++	for (i = 0; i < 1000; i++) {
++		if (!(bcma_cc_read32(cc, BCMA_CC_FLASHCTL) &
++		      BCMA_CC_FLASHCTL_BUSY))
++			return;
++		cpu_relax();
++	}
++	bcma_err(cc->core->bus, "SFLASH control command failed (timeout)!\n");
++}
++
++/* Initialize serial flash access */
++int bcma_sflash_init(struct bcma_drv_cc *cc)
++{
++	struct bcma_bus *bus = cc->core->bus;
++	struct bcma_sflash *sflash = &cc->sflash;
++	struct bcma_sflash_tbl_e *e;
++	u32 id, id2;
++
++	switch (cc->capabilities & BCMA_CC_CAP_FLASHT) {
++	case BCMA_CC_FLASHT_STSER:
++		bcma_sflash_cmd(cc, BCMA_CC_FLASHCTL_ST_DP);
++
++		bcma_cc_write32(cc, BCMA_CC_FLASHADDR, 0);
++		bcma_sflash_cmd(cc, BCMA_CC_FLASHCTL_ST_RES);
++		id = bcma_cc_read32(cc, BCMA_CC_FLASHDATA);
++
++		bcma_cc_write32(cc, BCMA_CC_FLASHADDR, 1);
++		bcma_sflash_cmd(cc, BCMA_CC_FLASHCTL_ST_RES);
++		id2 = bcma_cc_read32(cc, BCMA_CC_FLASHDATA);
++
++		switch (id) {
++		case 0xbf:
++			for (e = bcma_sflash_sst_tbl; e->name; e++) {
++				if (e->id == id2)
++					break;
++			}
++			break;
++		case 0x13:
++			return -ENOTSUPP;
++		default:
++			for (e = bcma_sflash_st_tbl; e->name; e++) {
++				if (e->id == id)
++					break;
++			}
++			break;
++		}
++		if (!e->name) {
++			bcma_err(bus, "Unsupported ST serial flash (id: 0x%X, id2: 0x%X)\n", id, id2);
++			return -ENOTSUPP;
++		}
++
++		break;
++	case BCMA_CC_FLASHT_ATSER:
++		bcma_sflash_cmd(cc, BCMA_CC_FLASHCTL_AT_STATUS);
++		id = bcma_cc_read32(cc, BCMA_CC_FLASHDATA) & 0x3c;
++
++		for (e = bcma_sflash_at_tbl; e->name; e++) {
++			if (e->id == id)
++				break;
++		}
++		if (!e->name) {
++			bcma_err(bus, "Unsupported Atmel serial flash (id: 0x%X)\n", id);
++			return -ENOTSUPP;
++		}
++
++		break;
++	default:
++		bcma_err(bus, "Unsupported flash type\n");
++		return -ENOTSUPP;
++	}
++
++	sflash->window = BCMA_SOC_FLASH2;
++	sflash->blocksize = e->blocksize;
++	sflash->numblocks = e->numblocks;
++	sflash->size = sflash->blocksize * sflash->numblocks;
++	sflash->present = true;
++
++	bcma_info(bus, "Found %s serial flash (size: %dKiB, blocksize: 0x%X, blocks: %d)\n",
++		  e->name, sflash->size / 1024, sflash->blocksize,
++		  sflash->numblocks);
++
++	/* Prepare platform device, but don't register it yet. It's too early,
++	 * malloc (required by device_private_init) is not available yet. */
++	bcma_sflash_dev.resource[0].end = bcma_sflash_dev.resource[0].start +
++					  sflash->size;
++	bcma_sflash_dev.dev.platform_data = sflash;
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/bcma/driver_gmac_cmn.c
+@@ -0,0 +1,14 @@
++/*
++ * Broadcom specific AMBA
++ * GBIT MAC COMMON Core
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include "bcma_private.h"
++#include <linux/bcma/bcma.h>
++
++void __devinit bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc)
++{
++	mutex_init(&gc->phy_mutex);
++}
+--- /dev/null
++++ b/drivers/bcma/driver_gpio.c
+@@ -0,0 +1,98 @@
++/*
++ * Broadcom specific AMBA
++ * GPIO driver
++ *
++ * Copyright 2011, Broadcom Corporation
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/gpio.h>
++#include <linux/export.h>
++#include <linux/bcma/bcma.h>
++
++#include "bcma_private.h"
++
++static inline struct bcma_drv_cc *bcma_gpio_get_cc(struct gpio_chip *chip)
++{
++	return container_of(chip, struct bcma_drv_cc, gpio);
++}
++
++static int bcma_gpio_get_value(struct gpio_chip *chip, unsigned gpio)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	return !!bcma_chipco_gpio_in(cc, 1 << gpio);
++}
++
++static void bcma_gpio_set_value(struct gpio_chip *chip, unsigned gpio,
++				int value)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	bcma_chipco_gpio_out(cc, 1 << gpio, value ? 1 << gpio : 0);
++}
++
++static int bcma_gpio_direction_input(struct gpio_chip *chip, unsigned gpio)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	bcma_chipco_gpio_outen(cc, 1 << gpio, 0);
++	return 0;
++}
++
++static int bcma_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
++				      int value)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	bcma_chipco_gpio_outen(cc, 1 << gpio, 1 << gpio);
++	bcma_chipco_gpio_out(cc, 1 << gpio, value ? 1 << gpio : 0);
++	return 0;
++}
++
++static int bcma_gpio_request(struct gpio_chip *chip, unsigned gpio)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	bcma_chipco_gpio_control(cc, 1 << gpio, 0);
++	/* clear pulldown */
++	bcma_chipco_gpio_pulldown(cc, 1 << gpio, 0);
++	/* Set pullup */
++	bcma_chipco_gpio_pullup(cc, 1 << gpio, 1 << gpio);
++
++	return 0;
++}
++
++static void bcma_gpio_free(struct gpio_chip *chip, unsigned gpio)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	/* clear pullup */
++	bcma_chipco_gpio_pullup(cc, 1 << gpio, 0);
++}
++
++int bcma_gpio_init(struct bcma_drv_cc *cc)
++{
++	struct gpio_chip *chip = &cc->gpio;
++
++	chip->label		= "bcma_gpio";
++	chip->owner		= THIS_MODULE;
++	chip->request		= bcma_gpio_request;
++	chip->free		= bcma_gpio_free;
++	chip->get		= bcma_gpio_get_value;
++	chip->set		= bcma_gpio_set_value;
++	chip->direction_input	= bcma_gpio_direction_input;
++	chip->direction_output	= bcma_gpio_direction_output;
++	chip->ngpio		= 16;
++	/* There is just one SoC in one device and its GPIO addresses should be
++	 * deterministic to address them more easily. The other buses could get
++	 * a random base number. */
++	if (cc->core->bus->hosttype == BCMA_HOSTTYPE_SOC)
++		chip->base		= 0;
++	else
++		chip->base		= -1;
++
++	return gpiochip_add(chip);
++}
+--- a/drivers/bcma/driver_mips.c
++++ b/drivers/bcma/driver_mips.c
+@@ -22,15 +22,15 @@
+ /* The 47162a0 hangs when reading MIPS DMP registers registers */
+ static inline bool bcma_core_mips_bcm47162a0_quirk(struct bcma_device *dev)
+ {
+-	return dev->bus->chipinfo.id == 47162 && dev->bus->chipinfo.rev == 0 &&
+-	       dev->id.id == BCMA_CORE_MIPS_74K;
++	return dev->bus->chipinfo.id == BCMA_CHIP_ID_BCM47162 &&
++	       dev->bus->chipinfo.rev == 0 && dev->id.id == BCMA_CORE_MIPS_74K;
+ }
+ 
+ /* The 5357b0 hangs when reading USB20H DMP registers */
+ static inline bool bcma_core_mips_bcm5357b0_quirk(struct bcma_device *dev)
+ {
+-	return (dev->bus->chipinfo.id == 0x5357 ||
+-		dev->bus->chipinfo.id == 0x4749) &&
++	return (dev->bus->chipinfo.id == BCMA_CHIP_ID_BCM5357 ||
++		dev->bus->chipinfo.id == BCMA_CHIP_ID_BCM4749) &&
+ 	       dev->bus->chipinfo.pkg == 11 &&
+ 	       dev->id.id == BCMA_CORE_USB20_HOST;
+ }
+@@ -74,11 +74,16 @@ static u32 bcma_core_mips_irqflag(struct
+ 		return dev->core_index;
+ 	flag = bcma_aread32(dev, BCMA_MIPS_OOBSELOUTA30);
+ 
+-	return flag & 0x1F;
++	if (flag)
++		return flag & 0x1F;
++	else
++		return 0x3f;
+ }
+ 
+ /* Get the MIPS IRQ assignment for a specified device.
+  * If unassigned, 0 is returned.
++ * If disabled, 5 is returned.
++ * If not supported, 6 is returned.
+  */
+ unsigned int bcma_core_mips_irq(struct bcma_device *dev)
+ {
+@@ -87,13 +92,15 @@ unsigned int bcma_core_mips_irq(struct b
+ 	unsigned int irq;
+ 
+ 	irqflag = bcma_core_mips_irqflag(dev);
++	if (irqflag == 0x3f)
++		return 6;
+ 
+-	for (irq = 1; irq <= 4; irq++)
++	for (irq = 0; irq <= 4; irq++)
+ 		if (bcma_read32(mdev, BCMA_MIPS_MIPS74K_INTMASK(irq)) &
+ 		    (1 << irqflag))
+ 			return irq;
+ 
+-	return 0;
++	return 5;
+ }
+ EXPORT_SYMBOL(bcma_core_mips_irq);
+ 
+@@ -114,8 +121,8 @@ static void bcma_core_mips_set_irq(struc
+ 		bcma_write32(mdev, BCMA_MIPS_MIPS74K_INTMASK(0),
+ 			    bcma_read32(mdev, BCMA_MIPS_MIPS74K_INTMASK(0)) &
+ 			    ~(1 << irqflag));
+-	else
+-		bcma_write32(mdev, BCMA_MIPS_MIPS74K_INTMASK(irq), 0);
++	else if (oldirq != 5)
++		bcma_write32(mdev, BCMA_MIPS_MIPS74K_INTMASK(oldirq), 0);
+ 
+ 	/* assign the new one */
+ 	if (irq == 0) {
+@@ -123,17 +130,17 @@ static void bcma_core_mips_set_irq(struc
+ 			    bcma_read32(mdev, BCMA_MIPS_MIPS74K_INTMASK(0)) |
+ 			    (1 << irqflag));
+ 	} else {
+-		u32 oldirqflag = bcma_read32(mdev,
+-					     BCMA_MIPS_MIPS74K_INTMASK(irq));
+-		if (oldirqflag) {
++		u32 irqinitmask = bcma_read32(mdev,
++					      BCMA_MIPS_MIPS74K_INTMASK(irq));
++		if (irqinitmask) {
+ 			struct bcma_device *core;
+ 
+ 			/* backplane irq line is in use, find out who uses
+ 			 * it and set user to irq 0
+ 			 */
+-			list_for_each_entry_reverse(core, &bus->cores, list) {
++			list_for_each_entry(core, &bus->cores, list) {
+ 				if ((1 << bcma_core_mips_irqflag(core)) ==
+-				    oldirqflag) {
++				    irqinitmask) {
+ 					bcma_core_mips_set_irq(core, 0);
+ 					break;
+ 				}
+@@ -143,15 +150,31 @@ static void bcma_core_mips_set_irq(struc
+ 			     1 << irqflag);
+ 	}
+ 
+-	pr_info("set_irq: core 0x%04x, irq %d => %d\n",
+-		dev->id.id, oldirq + 2, irq + 2);
++	bcma_debug(bus, "set_irq: core 0x%04x, irq %d => %d\n",
++		   dev->id.id, oldirq <= 4 ? oldirq + 2 : 0, irq + 2);
++}
++
++static void bcma_core_mips_set_irq_name(struct bcma_bus *bus, unsigned int irq,
++					u16 coreid, u8 unit)
++{
++	struct bcma_device *core;
++
++	core = bcma_find_core_unit(bus, coreid, unit);
++	if (!core) {
++		bcma_warn(bus,
++			  "Can not find core (id: 0x%x, unit %i) for IRQ configuration.\n",
++			  coreid, unit);
++		return;
++	}
++
++	bcma_core_mips_set_irq(core, irq);
+ }
+ 
+ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq)
+ {
+ 	int i;
+ 	static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"};
+-	printk(KERN_INFO KBUILD_MODNAME ": core 0x%04x, irq :", dev->id.id);
++	printk(KERN_DEBUG KBUILD_MODNAME ": core 0x%04x, irq :", dev->id.id);
+ 	for (i = 0; i <= 6; i++)
+ 		printk(" %s%s", irq_name[i], i == irq ? "*" : " ");
+ 	printk("\n");
+@@ -161,7 +184,7 @@ static void bcma_core_mips_dump_irq(stru
+ {
+ 	struct bcma_device *core;
+ 
+-	list_for_each_entry_reverse(core, &bus->cores, list) {
++	list_for_each_entry(core, &bus->cores, list) {
+ 		bcma_core_mips_print_irq(core, bcma_core_mips_irq(core));
+ 	}
+ }
+@@ -171,9 +194,9 @@ u32 bcma_cpu_clock(struct bcma_drv_mips
+ 	struct bcma_bus *bus = mcore->core->bus;
+ 
+ 	if (bus->drv_cc.capabilities & BCMA_CC_CAP_PMU)
+-		return bcma_pmu_get_clockcpu(&bus->drv_cc);
++		return bcma_pmu_get_cpu_clock(&bus->drv_cc);
+ 
+-	pr_err("No PMU available, need this to get the cpu clock\n");
++	bcma_err(bus, "No PMU available, need this to get the cpu clock\n");
+ 	return 0;
+ }
+ EXPORT_SYMBOL(bcma_cpu_clock);
+@@ -181,76 +204,109 @@ EXPORT_SYMBOL(bcma_cpu_clock);
+ static void bcma_core_mips_flash_detect(struct bcma_drv_mips *mcore)
+ {
+ 	struct bcma_bus *bus = mcore->core->bus;
++	struct bcma_drv_cc *cc = &bus->drv_cc;
+ 
+-	switch (bus->drv_cc.capabilities & BCMA_CC_CAP_FLASHT) {
++	switch (cc->capabilities & BCMA_CC_CAP_FLASHT) {
+ 	case BCMA_CC_FLASHT_STSER:
+ 	case BCMA_CC_FLASHT_ATSER:
+-		pr_err("Serial flash not supported.\n");
++		bcma_debug(bus, "Found serial flash\n");
++		bcma_sflash_init(cc);
+ 		break;
+ 	case BCMA_CC_FLASHT_PARA:
+-		pr_info("found parallel flash.\n");
+-		bus->drv_cc.pflash.window = 0x1c000000;
+-		bus->drv_cc.pflash.window_size = 0x02000000;
++		bcma_debug(bus, "Found parallel flash\n");
++		cc->pflash.present = true;
++		cc->pflash.window = BCMA_SOC_FLASH2;
++		cc->pflash.window_size = BCMA_SOC_FLASH2_SZ;
+ 
+-		if ((bcma_read32(bus->drv_cc.core, BCMA_CC_FLASH_CFG) &
++		if ((bcma_read32(cc->core, BCMA_CC_FLASH_CFG) &
+ 		     BCMA_CC_FLASH_CFG_DS) == 0)
+-			bus->drv_cc.pflash.buswidth = 1;
++			cc->pflash.buswidth = 1;
+ 		else
+-			bus->drv_cc.pflash.buswidth = 2;
++			cc->pflash.buswidth = 2;
+ 		break;
+ 	default:
+-		pr_err("flash not supported.\n");
++		bcma_err(bus, "Flash type not supported\n");
++	}
++
++	if (cc->core->id.rev == 38 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM4706) {
++		if (cc->capabilities & BCMA_CC_CAP_NFLASH) {
++			bcma_debug(bus, "Found NAND flash\n");
++			bcma_nflash_init(cc);
++		}
+ 	}
+ }
+ 
++void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
++{
++	struct bcma_bus *bus = mcore->core->bus;
++
++	if (mcore->early_setup_done)
++		return;
++
++	bcma_chipco_serial_init(&bus->drv_cc);
++	bcma_core_mips_flash_detect(mcore);
++
++	mcore->early_setup_done = true;
++}
++
+ void bcma_core_mips_init(struct bcma_drv_mips *mcore)
+ {
+ 	struct bcma_bus *bus;
+ 	struct bcma_device *core;
+ 	bus = mcore->core->bus;
+ 
+-	pr_info("Initializing MIPS core...\n");
++	if (mcore->setup_done)
++		return;
++
++	bcma_debug(bus, "Initializing MIPS core...\n");
+ 
+-	if (!mcore->setup_done)
+-		mcore->assigned_irqs = 1;
++	bcma_core_mips_early_init(mcore);
+ 
+-	/* Assign IRQs to all cores on the bus */
+-	list_for_each_entry_reverse(core, &bus->cores, list) {
+-		int mips_irq;
+-		if (core->irq)
+-			continue;
+-
+-		mips_irq = bcma_core_mips_irq(core);
+-		if (mips_irq > 4)
+-			core->irq = 0;
+-		else
+-			core->irq = mips_irq + 2;
+-		if (core->irq > 5)
+-			continue;
+-		switch (core->id.id) {
+-		case BCMA_CORE_PCI:
+-		case BCMA_CORE_PCIE:
+-		case BCMA_CORE_ETHERNET:
+-		case BCMA_CORE_ETHERNET_GBIT:
+-		case BCMA_CORE_MAC_GBIT:
+-		case BCMA_CORE_80211:
+-		case BCMA_CORE_USB20_HOST:
+-			/* These devices get their own IRQ line if available,
+-			 * the rest goes on IRQ0
+-			 */
+-			if (mcore->assigned_irqs <= 4)
+-				bcma_core_mips_set_irq(core,
+-						       mcore->assigned_irqs++);
+-			break;
++	switch (bus->chipinfo.id) {
++	case BCMA_CHIP_ID_BCM4716:
++	case BCMA_CHIP_ID_BCM4748:
++		bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_80211, 0);
++		bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_MAC_GBIT, 0);
++		bcma_core_mips_set_irq_name(bus, 3, BCMA_CORE_USB20_HOST, 0);
++		bcma_core_mips_set_irq_name(bus, 4, BCMA_CORE_PCIE, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_CHIPCOMMON, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_I2S, 0);
++		break;
++	case BCMA_CHIP_ID_BCM5356:
++	case BCMA_CHIP_ID_BCM47162:
++	case BCMA_CHIP_ID_BCM53572:
++		bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_80211, 0);
++		bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_MAC_GBIT, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_CHIPCOMMON, 0);
++		break;
++	case BCMA_CHIP_ID_BCM5357:
++	case BCMA_CHIP_ID_BCM4749:
++		bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_80211, 0);
++		bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_MAC_GBIT, 0);
++		bcma_core_mips_set_irq_name(bus, 3, BCMA_CORE_USB20_HOST, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_CHIPCOMMON, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_I2S, 0);
++		break;
++	case BCMA_CHIP_ID_BCM4706:
++		bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_PCIE, 0);
++		bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_4706_MAC_GBIT,
++					    0);
++		bcma_core_mips_set_irq_name(bus, 3, BCMA_CORE_PCIE, 1);
++		bcma_core_mips_set_irq_name(bus, 4, BCMA_CORE_USB20_HOST, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_4706_CHIPCOMMON,
++					    0);
++		break;
++	default:
++		list_for_each_entry(core, &bus->cores, list) {
++			core->irq = bcma_core_mips_irq(core) + 2;
+ 		}
++		bcma_err(bus,
++			 "Unknown device (0x%x) found, can not configure IRQs\n",
++			 bus->chipinfo.id);
+ 	}
+-	pr_info("IRQ reconfiguration done\n");
++	bcma_debug(bus, "IRQ reconfiguration done\n");
+ 	bcma_core_mips_dump_irq(bus);
+ 
+-	if (mcore->setup_done)
+-		return;
+-
+-	bcma_chipco_serial_init(&bus->drv_cc);
+-	bcma_core_mips_flash_detect(mcore);
+ 	mcore->setup_done = true;
+ }
+--- a/drivers/bcma/driver_pci.c
++++ b/drivers/bcma/driver_pci.c
+@@ -2,8 +2,9 @@
+  * Broadcom specific AMBA
+  * PCI Core
+  *
+- * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
+  * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+@@ -16,120 +17,124 @@
+  * R/W ops.
+  **************************************************/
+ 
+-static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
+ }
+ 
+-#if 0
+ static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
+ }
+-#endif
+ 
+ static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	u32 v;
+ 	int i;
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= (phy << 4);
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 
+ 	udelay(10);
+ 	for (i = 0; i < 200; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+-		msleep(1);
++		usleep_range(1000, 2000);
+ 	}
+ }
+ 
+ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u16 ret = 0;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 29); /* Read Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
+-	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
+ 			udelay(10);
+-			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
+ 			break;
+ 		}
+-		msleep(1);
++		usleep_range(1000, 2000);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ 	return ret;
+ }
+ 
+ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
+ 				u8 address, u16 data)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= data;
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+-		msleep(1);
++		usleep_range(1000, 2000);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ }
+ 
+ /**************************************************
+@@ -138,88 +143,108 @@ static void bcma_pcie_mdio_write(struct
+ 
+ static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
+ {
+-	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
+ }
+ 
+ static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
+ {
+-	const u8 serdes_pll_device = 0x1D;
+-	const u8 serdes_rx_device = 0x1F;
+ 	u16 tmp;
+ 
+-	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
+-			      bcma_pcicore_polarity_workaround(pc));
+-	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
+-	if (tmp & 0x4000)
+-		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
++}
++
++static void bcma_core_pci_fixcfg(struct bcma_drv_pci *pc)
++{
++	struct bcma_device *core = pc->core;
++	u16 val16, core_index;
++	uint regoff;
++
++	regoff = BCMA_CORE_PCI_SPROM(BCMA_CORE_PCI_SPROM_PI_OFFSET);
++	core_index = (u16)core->core_index;
++
++	val16 = pcicore_read16(pc, regoff);
++	if (((val16 & BCMA_CORE_PCI_SPROM_PI_MASK) >> BCMA_CORE_PCI_SPROM_PI_SHIFT)
++	     != core_index) {
++		val16 = (core_index << BCMA_CORE_PCI_SPROM_PI_SHIFT) |
++			(val16 & ~BCMA_CORE_PCI_SPROM_PI_MASK);
++		pcicore_write16(pc, regoff, val16);
++	}
++}
++
++/* Fix MISC config to allow coming out of L2/L3-Ready state w/o PRST */
++/* Needs to happen when coming out of 'standby'/'hibernate' */
++static void bcma_core_pci_config_fixup(struct bcma_drv_pci *pc)
++{
++	u16 val16;
++	uint regoff;
++
++	regoff = BCMA_CORE_PCI_SPROM(BCMA_CORE_PCI_SPROM_MISC_CONFIG);
++
++	val16 = pcicore_read16(pc, regoff);
++
++	if (!(val16 & BCMA_CORE_PCI_SPROM_L23READY_EXIT_NOPERST)) {
++		val16 |= BCMA_CORE_PCI_SPROM_L23READY_EXIT_NOPERST;
++		pcicore_write16(pc, regoff, val16);
++	}
+ }
+ 
+ /**************************************************
+  * Init.
+  **************************************************/
+ 
+-static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
+ {
++	bcma_core_pci_fixcfg(pc);
+ 	bcma_pcicore_serdes_workaround(pc);
++	bcma_core_pci_config_fixup(pc);
+ }
+ 
+-static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
+-{
+-	struct bcma_bus *bus = pc->core->bus;
+-	u16 chipid_top;
+-
+-	chipid_top = (bus->chipinfo.id & 0xFF00);
+-	if (chipid_top != 0x4700 &&
+-	    chipid_top != 0x5300)
+-		return false;
+-
+-#ifdef CONFIG_SSB_DRIVER_PCICORE
+-	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
+-		return false;
+-#endif /* CONFIG_SSB_DRIVER_PCICORE */
+-
+-#if 0
+-	/* TODO: on BCMA we use address from EROM instead of magic formula */
+-	u32 tmp;
+-	return !mips_busprobe32(tmp, (bus->mmio +
+-		(pc->core->core_index * BCMA_CORE_SIZE)));
+-#endif
+-
+-	return true;
+-}
+-
+-void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
+ {
+ 	if (pc->setup_done)
+ 		return;
+ 
+-	if (bcma_core_pci_is_in_hostmode(pc)) {
+ #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
+ 		bcma_core_pci_hostmode_init(pc);
+-#else
+-		pr_err("Driver compiled without support for hostmode PCI\n");
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+-	} else {
+-		bcma_core_pci_clientmode_init(pc);
+-	}
+ 
+-	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
+ }
+ 
+ int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
+ 			  bool enable)
+ {
+-	struct pci_dev *pdev = pc->core->bus->host_pci;
++	struct pci_dev *pdev;
+ 	u32 coremask, tmp;
+ 	int err = 0;
+ 
+-	if (core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
++	if (!pc || core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
+ 		/* This bcma device is not on a PCI host-bus. So the IRQs are
+ 		 * not routed through the PCI core.
+ 		 * So we must not enable routing through the PCI core. */
+ 		goto out;
+ 	}
+ 
++	pdev = pc->core->bus->host_pci;
++
+ 	err = pci_read_config_dword(pdev, BCMA_PCI_IRQMASK, &tmp);
+ 	if (err)
+ 		goto out;
+@@ -236,3 +261,17 @@ out:
+ 	return err;
+ }
+ EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
++
++void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend)
++{
++	u32 w;
++
++	w = bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_PMTHRESHREG);
++	if (extend)
++		w |= BCMA_CORE_PCI_ASPMTIMER_EXTEND;
++	else
++		w &= ~BCMA_CORE_PCI_ASPMTIMER_EXTEND;
++	bcma_pcie_write(pc, BCMA_CORE_PCI_DLLP_PMTHRESHREG, w);
++	bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_PMTHRESHREG);
++}
++EXPORT_SYMBOL_GPL(bcma_core_pci_extend_L1timer);
+--- a/drivers/bcma/driver_pci_host.c
++++ b/drivers/bcma/driver_pci_host.c
+@@ -2,13 +2,600 @@
+  * Broadcom specific AMBA
+  * PCI Core in hostmode
+  *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+ #include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
+ #include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
+ 
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
+ {
+-	pr_err("No support for PCI core in hostmode yet\n");
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, sizeof(val));
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, sizeof(val));
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, sizeof(val));
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == BCMA_CHIP_ID_BCM4716 ||
++		    chipid == BCMA_CHIP_ID_BCM4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				bcma_err(bus, "PCI: Broken device in slot %d\n",
++					 dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	bcma_info(bus, "PCIEcore in host mode found\n");
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		bcma_info(bus, "This PCIE core is disabled and not working\n");
++		return;
++	}
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		bcma_err(bus, "can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	usleep_range(3000, 5000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	usleep_range(1000, 2000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4716 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pc_host->io_resource.start = 0x100;
++			pc_host->io_resource.end = 0x47F;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pc_host->io_resource.start = 0x480;
++			pc_host->io_resource.end = 0x7FF;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	msleep(100);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(pc_host->mem_resource.start,
++						     resource_size(&pc_host->mem_resource));
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	usleep_range(10000, 15000);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos, err;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM)) {
++			err = pci_assign_resource(dev, pos);
++			if (err)
++				pr_err("PCI: Problem fixing up the addresses on %s\n",
++				       pci_name(dev));
++		}
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
+ }
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
+--- a/drivers/bcma/host_pci.c
++++ b/drivers/bcma/host_pci.c
+@@ -18,7 +18,7 @@ static void bcma_host_pci_switch_core(st
+ 	pci_write_config_dword(core->bus->host_pci, BCMA_PCI_BAR0_WIN2,
+ 			       core->wrap);
+ 	core->bus->mapped_core = core;
+-	pr_debug("Switched to core: 0x%X\n", core->id.id);
++	bcma_debug(core->bus, "Switched to core: 0x%X\n", core->id.id);
+ }
+ 
+ /* Provides access to the requested core. Returns base offset that has to be
+@@ -77,8 +77,8 @@ static void bcma_host_pci_write32(struct
+ }
+ 
+ #ifdef CONFIG_BCMA_BLOCKIO
+-void bcma_host_pci_block_read(struct bcma_device *core, void *buffer,
+-			      size_t count, u16 offset, u8 reg_width)
++static void bcma_host_pci_block_read(struct bcma_device *core, void *buffer,
++				     size_t count, u16 offset, u8 reg_width)
+ {
+ 	void __iomem *addr = core->bus->mmio + offset;
+ 	if (core->bus->mapped_core != core)
+@@ -100,8 +100,9 @@ void bcma_host_pci_block_read(struct bcm
+ 	}
+ }
+ 
+-void bcma_host_pci_block_write(struct bcma_device *core, const void *buffer,
+-			       size_t count, u16 offset, u8 reg_width)
++static void bcma_host_pci_block_write(struct bcma_device *core,
++				      const void *buffer, size_t count,
++				      u16 offset, u8 reg_width)
+ {
+ 	void __iomem *addr = core->bus->mmio + offset;
+ 	if (core->bus->mapped_core != core)
+@@ -139,7 +140,7 @@ static void bcma_host_pci_awrite32(struc
+ 	iowrite32(value, core->bus->mmio + (1 * BCMA_CORE_SIZE) + offset);
+ }
+ 
+-const struct bcma_host_ops bcma_host_pci_ops = {
++static const struct bcma_host_ops bcma_host_pci_ops = {
+ 	.read8		= bcma_host_pci_read8,
+ 	.read16		= bcma_host_pci_read16,
+ 	.read32		= bcma_host_pci_read32,
+@@ -154,8 +155,8 @@ const struct bcma_host_ops bcma_host_pci
+ 	.awrite32	= bcma_host_pci_awrite32,
+ };
+ 
+-static int bcma_host_pci_probe(struct pci_dev *dev,
+-			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
+ {
+ 	struct bcma_bus *bus;
+ 	int err = -ENOMEM;
+@@ -188,7 +189,7 @@ static int bcma_host_pci_probe(struct pc
+ 
+ 	/* SSB needed additional powering up, do we have any AMBA PCI cards? */
+ 	if (!pci_is_pcie(dev))
+-		pr_err("PCI card detected, report problems.\n");
++		bcma_err(bus, "PCI card detected, report problems.\n");
+ 
+ 	/* Map MMIO */
+ 	err = -ENOMEM;
+@@ -201,6 +202,9 @@ static int bcma_host_pci_probe(struct pc
+ 	bus->hosttype = BCMA_HOSTTYPE_PCI;
+ 	bus->ops = &bcma_host_pci_ops;
+ 
++	bus->boardinfo.vendor = bus->host_pci->subsystem_vendor;
++	bus->boardinfo.type = bus->host_pci->subsystem_device;
++
+ 	/* Register */
+ 	err = bcma_bus_register(bus);
+ 	if (err)
+@@ -222,7 +226,7 @@ err_kfree_bus:
+ 	return err;
+ }
+ 
+-static void bcma_host_pci_remove(struct pci_dev *dev)
++static void __devexit bcma_host_pci_remove(struct pci_dev *dev)
+ {
+ 	struct bcma_bus *bus = pci_get_drvdata(dev);
+ 
+@@ -234,7 +238,7 @@ static void bcma_host_pci_remove(struct
+ 	pci_set_drvdata(dev, NULL);
+ }
+ 
+-#ifdef CONFIG_PM
++#ifdef CONFIG_PM_SLEEP
+ static int bcma_host_pci_suspend(struct device *dev)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+@@ -257,17 +261,20 @@ static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bc
+ 			 bcma_host_pci_resume);
+ #define BCMA_PM_OPS	(&bcma_pm_ops)
+ 
+-#else /* CONFIG_PM */
++#else /* CONFIG_PM_SLEEP */
+ 
+ #define BCMA_PM_OPS     NULL
+ 
+-#endif /* CONFIG_PM */
++#endif /* CONFIG_PM_SLEEP */
+ 
+ static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4357) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4358) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },
+ 	{ 0, },
+ };
+@@ -277,7 +284,7 @@ static struct pci_driver bcma_pci_bridge
+ 	.name = "bcma-pci-bridge",
+ 	.id_table = bcma_pci_bridge_tbl,
+ 	.probe = bcma_host_pci_probe,
+-	.remove = bcma_host_pci_remove,
++	.remove = __devexit_p(bcma_host_pci_remove),
+ 	.driver.pm = BCMA_PM_OPS,
+ };
+ 
+--- a/drivers/bcma/host_soc.c
++++ b/drivers/bcma/host_soc.c
+@@ -143,7 +143,7 @@ static void bcma_host_soc_awrite32(struc
+ 	writel(value, core->io_wrap + offset);
+ }
+ 
+-const struct bcma_host_ops bcma_host_soc_ops = {
++static const struct bcma_host_ops bcma_host_soc_ops = {
+ 	.read8		= bcma_host_soc_read8,
+ 	.read16		= bcma_host_soc_read16,
+ 	.read32		= bcma_host_soc_read32,
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -7,12 +7,19 @@
+ 
+ #include "bcma_private.h"
+ #include <linux/module.h>
++#include <linux/platform_device.h>
+ #include <linux/bcma/bcma.h>
+ #include <linux/slab.h>
+ 
+ MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
+ MODULE_LICENSE("GPL");
+ 
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
+ static int bcma_bus_match(struct device *dev, struct device_driver *drv);
+ static int bcma_device_probe(struct device *dev);
+ static int bcma_device_remove(struct device *dev);
+@@ -55,7 +62,14 @@ static struct bus_type bcma_bus_type = {
+ 	.dev_attrs	= bcma_device_attrs,
+ };
+ 
+-static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++static u16 bcma_cc_core_id(struct bcma_bus *bus)
++{
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706)
++		return BCMA_CORE_4706_CHIPCOMMON;
++	return BCMA_CORE_CHIPCOMMON;
++}
++
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
+ {
+ 	struct bcma_device *core;
+ 
+@@ -65,6 +79,19 @@ static struct bcma_device *bcma_find_cor
+ 	}
+ 	return NULL;
+ }
++EXPORT_SYMBOL_GPL(bcma_find_core);
++
++struct bcma_device *bcma_find_core_unit(struct bcma_bus *bus, u16 coreid,
++					u8 unit)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		if (core->id.id == coreid && core->core_unit == unit)
++			return core;
++	}
++	return NULL;
++}
+ 
+ static void bcma_release_core_dev(struct device *dev)
+ {
+@@ -84,16 +111,18 @@ static int bcma_register_cores(struct bc
+ 	list_for_each_entry(core, &bus->cores, list) {
+ 		/* We support that cores ourself */
+ 		switch (core->id.id) {
++		case BCMA_CORE_4706_CHIPCOMMON:
+ 		case BCMA_CORE_CHIPCOMMON:
+ 		case BCMA_CORE_PCI:
+ 		case BCMA_CORE_PCIE:
+ 		case BCMA_CORE_MIPS_74K:
++		case BCMA_CORE_4706_MAC_GBIT_COMMON:
+ 			continue;
+ 		}
+ 
+ 		core->dev.release = bcma_release_core_dev;
+ 		core->dev.bus = &bcma_bus_type;
+-		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
+ 
+ 		switch (bus->hosttype) {
+ 		case BCMA_HOSTTYPE_PCI:
+@@ -111,41 +140,90 @@ static int bcma_register_cores(struct bc
+ 
+ 		err = device_register(&core->dev);
+ 		if (err) {
+-			pr_err("Could not register dev for core 0x%03X\n",
+-			       core->id.id);
++			bcma_err(bus,
++				 "Could not register dev for core 0x%03X\n",
++				 core->id.id);
+ 			continue;
+ 		}
+ 		core->dev_registered = true;
+ 		dev_id++;
+ 	}
+ 
++#ifdef CONFIG_BCMA_SFLASH
++	if (bus->drv_cc.sflash.present) {
++		err = platform_device_register(&bcma_sflash_dev);
++		if (err)
++			bcma_err(bus, "Error registering serial flash\n");
++	}
++#endif
++
++#ifdef CONFIG_BCMA_NFLASH
++	if (bus->drv_cc.nflash.present) {
++		err = platform_device_register(&bcma_nflash_dev);
++		if (err)
++			bcma_err(bus, "Error registering NAND flash\n");
++	}
++#endif
++	err = bcma_gpio_init(&bus->drv_cc);
++	if (err == -ENOTSUPP)
++		bcma_debug(bus, "GPIO driver not activated\n");
++	else if (err)
++		bcma_err(bus, "Error registering GPIO driver: %i\n", err);
++
++	if (bus->hosttype == BCMA_HOSTTYPE_SOC) {
++		err = bcma_chipco_watchdog_register(&bus->drv_cc);
++		if (err)
++			bcma_err(bus, "Error registering watchdog driver\n");
++	}
++
+ 	return 0;
+ }
+ 
+ static void bcma_unregister_cores(struct bcma_bus *bus)
+ {
+-	struct bcma_device *core;
++	struct bcma_device *core, *tmp;
+ 
+-	list_for_each_entry(core, &bus->cores, list) {
++	list_for_each_entry_safe(core, tmp, &bus->cores, list) {
++		list_del(&core->list);
+ 		if (core->dev_registered)
+ 			device_unregister(&core->dev);
+ 	}
++	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
++		platform_device_unregister(bus->drv_cc.watchdog);
+ }
+ 
+-int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
+ {
+ 	int err;
+ 	struct bcma_device *core;
+ 
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
+ 	/* Scan for devices (cores) */
+ 	err = bcma_bus_scan(bus);
+ 	if (err) {
+-		pr_err("Failed to scan: %d\n", err);
++		bcma_err(bus, "Failed to scan: %d\n", err);
+ 		return -1;
+ 	}
+ 
++	/* Early init CC core */
++	core = bcma_find_core(bus, bcma_cc_core_id(bus));
++	if (core) {
++		bus->drv_cc.core = core;
++		bcma_core_chipcommon_early_init(&bus->drv_cc);
++	}
++
++	/* Try to get SPROM */
++	err = bcma_sprom_get(bus);
++	if (err == -ENOENT) {
++		bcma_err(bus, "No SPROM available\n");
++	} else if (err)
++		bcma_err(bus, "Failed to get SPROM: %d\n", err);
++
+ 	/* Init CC core */
+-	core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
++	core = bcma_find_core(bus, bcma_cc_core_id(bus));
+ 	if (core) {
+ 		bus->drv_cc.core = core;
+ 		bcma_core_chipcommon_init(&bus->drv_cc);
+@@ -159,30 +237,47 @@ int bcma_bus_register(struct bcma_bus *b
+ 	}
+ 
+ 	/* Init PCIE core */
+-	core = bcma_find_core(bus, BCMA_CORE_PCIE);
++	core = bcma_find_core_unit(bus, BCMA_CORE_PCIE, 0);
+ 	if (core) {
+-		bus->drv_pci.core = core;
+-		bcma_core_pci_init(&bus->drv_pci);
++		bus->drv_pci[0].core = core;
++		bcma_core_pci_init(&bus->drv_pci[0]);
+ 	}
+ 
+-	/* Try to get SPROM */
+-	err = bcma_sprom_get(bus);
+-	if (err == -ENOENT) {
+-		pr_err("No SPROM available\n");
+-	} else if (err)
+-		pr_err("Failed to get SPROM: %d\n", err);
++	/* Init PCIE core */
++	core = bcma_find_core_unit(bus, BCMA_CORE_PCIE, 1);
++	if (core) {
++		bus->drv_pci[1].core = core;
++		bcma_core_pci_init(&bus->drv_pci[1]);
++	}
++
++	/* Init GBIT MAC COMMON core */
++	core = bcma_find_core(bus, BCMA_CORE_4706_MAC_GBIT_COMMON);
++	if (core) {
++		bus->drv_gmac_cmn.core = core;
++		bcma_core_gmac_cmn_init(&bus->drv_gmac_cmn);
++	}
+ 
+ 	/* Register found cores */
+ 	bcma_register_cores(bus);
+ 
+-	pr_info("Bus registered\n");
++	bcma_info(bus, "Bus registered\n");
+ 
+ 	return 0;
+ }
+ 
+ void bcma_bus_unregister(struct bcma_bus *bus)
+ {
++	struct bcma_device *cores[3];
++
++	cores[0] = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
++	cores[1] = bcma_find_core(bus, BCMA_CORE_PCIE);
++	cores[2] = bcma_find_core(bus, BCMA_CORE_4706_MAC_GBIT_COMMON);
++
+ 	bcma_unregister_cores(bus);
++
++	kfree(cores[2]);
++	kfree(cores[1]);
++	kfree(cores[0]);
+ }
+ 
+ int __init bcma_bus_early_register(struct bcma_bus *bus,
+@@ -196,14 +291,14 @@ int __init bcma_bus_early_register(struc
+ 	bcma_init_bus(bus);
+ 
+ 	match.manuf = BCMA_MANUF_BCM;
+-	match.id = BCMA_CORE_CHIPCOMMON;
++	match.id = bcma_cc_core_id(bus);
+ 	match.class = BCMA_CL_SIM;
+ 	match.rev = BCMA_ANY_REV;
+ 
+ 	/* Scan for chip common core */
+ 	err = bcma_bus_scan_early(bus, &match, core_cc);
+ 	if (err) {
+-		pr_err("Failed to scan for common core: %d\n", err);
++		bcma_err(bus, "Failed to scan for common core: %d\n", err);
+ 		return -1;
+ 	}
+ 
+@@ -215,25 +310,25 @@ int __init bcma_bus_early_register(struc
+ 	/* Scan for mips core */
+ 	err = bcma_bus_scan_early(bus, &match, core_mips);
+ 	if (err) {
+-		pr_err("Failed to scan for mips core: %d\n", err);
++		bcma_err(bus, "Failed to scan for mips core: %d\n", err);
+ 		return -1;
+ 	}
+ 
+-	/* Init CC core */
+-	core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
++	/* Early init CC core */
++	core = bcma_find_core(bus, bcma_cc_core_id(bus));
+ 	if (core) {
+ 		bus->drv_cc.core = core;
+-		bcma_core_chipcommon_init(&bus->drv_cc);
++		bcma_core_chipcommon_early_init(&bus->drv_cc);
+ 	}
+ 
+-	/* Init MIPS core */
++	/* Early init MIPS core */
+ 	core = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
+ 	if (core) {
+ 		bus->drv_mips.core = core;
+-		bcma_core_mips_init(&bus->drv_mips);
++		bcma_core_mips_early_init(&bus->drv_mips);
+ 	}
+ 
+-	pr_info("Early bus registered\n");
++	bcma_info(bus, "Early bus registered\n");
+ 
+ 	return 0;
+ }
+@@ -259,8 +354,7 @@ int bcma_bus_resume(struct bcma_bus *bus
+ 	struct bcma_device *core;
+ 
+ 	/* Init CC core */
+-	core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
+-	if (core) {
++	if (bus->drv_cc.core) {
+ 		bus->drv_cc.setup_done = false;
+ 		bcma_core_chipcommon_init(&bus->drv_cc);
+ 	}
+--- a/drivers/bcma/scan.c
++++ b/drivers/bcma/scan.c
+@@ -19,15 +19,27 @@ struct bcma_device_id_name {
+ 	u16 id;
+ 	const char *name;
+ };
+-struct bcma_device_id_name bcma_device_names[] = {
++
++static const struct bcma_device_id_name bcma_arm_device_names[] = {
++	{ BCMA_CORE_4706_MAC_GBIT_COMMON, "BCM4706 GBit MAC Common" },
++	{ BCMA_CORE_ARM_1176, "ARM 1176" },
++	{ BCMA_CORE_ARM_7TDMI, "ARM 7TDMI" },
++	{ BCMA_CORE_ARM_CM3, "ARM CM3" },
++};
++
++static const struct bcma_device_id_name bcma_bcm_device_names[] = {
+ 	{ BCMA_CORE_OOB_ROUTER, "OOB Router" },
++	{ BCMA_CORE_4706_CHIPCOMMON, "BCM4706 ChipCommon" },
++	{ BCMA_CORE_4706_SOC_RAM, "BCM4706 SOC RAM" },
++	{ BCMA_CORE_4706_MAC_GBIT, "BCM4706 GBit MAC" },
++	{ BCMA_CORE_AMEMC, "AMEMC (DDR)" },
++	{ BCMA_CORE_ALTA, "ALTA (I2S)" },
+ 	{ BCMA_CORE_INVALID, "Invalid" },
+ 	{ BCMA_CORE_CHIPCOMMON, "ChipCommon" },
+ 	{ BCMA_CORE_ILINE20, "ILine 20" },
+ 	{ BCMA_CORE_SRAM, "SRAM" },
+ 	{ BCMA_CORE_SDRAM, "SDRAM" },
+ 	{ BCMA_CORE_PCI, "PCI" },
+-	{ BCMA_CORE_MIPS, "MIPS" },
+ 	{ BCMA_CORE_ETHERNET, "Fast Ethernet" },
+ 	{ BCMA_CORE_V90, "V90" },
+ 	{ BCMA_CORE_USB11_HOSTDEV, "USB 1.1 Hostdev" },
+@@ -44,7 +56,6 @@ struct bcma_device_id_name bcma_device_n
+ 	{ BCMA_CORE_PHY_A, "PHY A" },
+ 	{ BCMA_CORE_PHY_B, "PHY B" },
+ 	{ BCMA_CORE_PHY_G, "PHY G" },
+-	{ BCMA_CORE_MIPS_3302, "MIPS 3302" },
+ 	{ BCMA_CORE_USB11_HOST, "USB 1.1 Host" },
+ 	{ BCMA_CORE_USB11_DEV, "USB 1.1 Device" },
+ 	{ BCMA_CORE_USB20_HOST, "USB 2.0 Host" },
+@@ -58,15 +69,11 @@ struct bcma_device_id_name bcma_device_n
+ 	{ BCMA_CORE_PHY_N, "PHY N" },
+ 	{ BCMA_CORE_SRAM_CTL, "SRAM Controller" },
+ 	{ BCMA_CORE_MINI_MACPHY, "Mini MACPHY" },
+-	{ BCMA_CORE_ARM_1176, "ARM 1176" },
+-	{ BCMA_CORE_ARM_7TDMI, "ARM 7TDMI" },
+ 	{ BCMA_CORE_PHY_LP, "PHY LP" },
+ 	{ BCMA_CORE_PMU, "PMU" },
+ 	{ BCMA_CORE_PHY_SSN, "PHY SSN" },
+ 	{ BCMA_CORE_SDIO_DEV, "SDIO Device" },
+-	{ BCMA_CORE_ARM_CM3, "ARM CM3" },
+ 	{ BCMA_CORE_PHY_HT, "PHY HT" },
+-	{ BCMA_CORE_MIPS_74K, "MIPS 74K" },
+ 	{ BCMA_CORE_MAC_GBIT, "GBit MAC" },
+ 	{ BCMA_CORE_DDR12_MEM_CTL, "DDR1/DDR2 Memory Controller" },
+ 	{ BCMA_CORE_PCIE_RC, "PCIe Root Complex" },
+@@ -79,16 +86,41 @@ struct bcma_device_id_name bcma_device_n
+ 	{ BCMA_CORE_SHIM, "SHIM" },
+ 	{ BCMA_CORE_DEFAULT, "Default" },
+ };
+-const char *bcma_device_name(struct bcma_device_id *id)
++
++static const struct bcma_device_id_name bcma_mips_device_names[] = {
++	{ BCMA_CORE_MIPS, "MIPS" },
++	{ BCMA_CORE_MIPS_3302, "MIPS 3302" },
++	{ BCMA_CORE_MIPS_74K, "MIPS 74K" },
++};
++
++static const char *bcma_device_name(const struct bcma_device_id *id)
+ {
+-	int i;
++	const struct bcma_device_id_name *names;
++	int size, i;
+ 
+-	if (id->manuf == BCMA_MANUF_BCM) {
+-		for (i = 0; i < ARRAY_SIZE(bcma_device_names); i++) {
+-			if (bcma_device_names[i].id == id->id)
+-				return bcma_device_names[i].name;
+-		}
++	/* search manufacturer specific names */
++	switch (id->manuf) {
++	case BCMA_MANUF_ARM:
++		names = bcma_arm_device_names;
++		size = ARRAY_SIZE(bcma_arm_device_names);
++		break;
++	case BCMA_MANUF_BCM:
++		names = bcma_bcm_device_names;
++		size = ARRAY_SIZE(bcma_bcm_device_names);
++		break;
++	case BCMA_MANUF_MIPS:
++		names = bcma_mips_device_names;
++		size = ARRAY_SIZE(bcma_mips_device_names);
++		break;
++	default:
++		return "UNKNOWN";
+ 	}
++
++	for (i = 0; i < size; i++) {
++		if (names[i].id == id->id)
++			return names[i].name;
++	}
++
+ 	return "UNKNOWN";
+ }
+ 
+@@ -212,6 +244,17 @@ static struct bcma_device *bcma_find_cor
+ 	return NULL;
+ }
+ 
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
+ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
+ 			      struct bcma_device_id *match, int core_num,
+ 			      struct bcma_device *core)
+@@ -252,11 +295,15 @@ static int bcma_get_next_core(struct bcm
+ 
+ 	/* check if component is a core at all */
+ 	if (wrappers[0] + wrappers[1] == 0) {
+-		/* we could save addrl of the router
+-		if (cid == BCMA_CORE_OOB_ROUTER)
+-		 */
+-		bcma_erom_skip_component(bus, eromptr);
+-		return -ENXIO;
++		/* Some specific cores don't need wrappers */
++		switch (core->id.id) {
++		case BCMA_CORE_4706_MAC_GBIT_COMMON:
++		/* Not used yet: case BCMA_CORE_OOB_ROUTER: */
++			break;
++		default:
++			bcma_erom_skip_component(bus, eromptr);
++			return -ENXIO;
++		}
+ 	}
+ 
+ 	if (bcma_erom_is_bridge(bus, eromptr)) {
+@@ -286,6 +333,23 @@ static int bcma_get_next_core(struct bcm
+ 			return -EILSEQ;
+ 	}
+ 
++	/* First Slave Address Descriptor should be port 0:
++	 * the main register space for the core
++	 */
++	tmp = bcma_erom_get_addr_desc(bus, eromptr, SCAN_ADDR_TYPE_SLAVE, 0);
++	if (tmp <= 0) {
++		/* Try again to see if it is a bridge */
++		tmp = bcma_erom_get_addr_desc(bus, eromptr,
++					      SCAN_ADDR_TYPE_BRIDGE, 0);
++		if (tmp <= 0) {
++			return -EILSEQ;
++		} else {
++			bcma_info(bus, "Bridge found\n");
++			return -ENXIO;
++		}
++	}
++	core->addr = tmp;
++
+ 	/* get & parse slave ports */
+ 	for (i = 0; i < ports[1]; i++) {
+ 		for (j = 0; ; j++) {
+@@ -298,7 +362,7 @@ static int bcma_get_next_core(struct bcm
+ 				break;
+ 			} else {
+ 				if (i == 0 && j == 0)
+-					core->addr = tmp;
++					core->addr1 = tmp;
+ 			}
+ 		}
+ 	}
+@@ -353,6 +417,7 @@ static int bcma_get_next_core(struct bcm
+ void bcma_init_bus(struct bcma_bus *bus)
+ {
+ 	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
+ 
+ 	if (bus->init_done)
+ 		return;
+@@ -363,9 +428,12 @@ void bcma_init_bus(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
+ 
+ 	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
+-	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
+-	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
+-	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	bcma_info(bus, "Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		  chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
+ 	bus->init_done = true;
+ }
+ 
+@@ -392,9 +460,12 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, erombase);
+ 
+ 	while (eromptr < eromend) {
++		struct bcma_device *other_core;
+ 		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
+-		if (!core)
+-			return -ENOMEM;
++		if (!core) {
++			err = -ENOMEM;
++			goto out;
++		}
+ 		INIT_LIST_HEAD(&core->list);
+ 		core->bus = bus;
+ 
+@@ -409,25 +480,28 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 			} else if (err == -ESPIPE) {
+ 				break;
+ 			}
+-			return err;
++			goto out;
+ 		}
+ 
+ 		core->core_index = core_num++;
+ 		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
+ 
+-		pr_info("Core %d found: %s "
+-			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
+-			core->core_index, bcma_device_name(&core->id),
+-			core->id.manuf, core->id.id, core->id.rev,
+-			core->id.class);
++		bcma_info(bus, "Core %d found: %s (manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
++			  core->core_index, bcma_device_name(&core->id),
++			  core->id.manuf, core->id.id, core->id.rev,
++			  core->id.class);
+ 
+-		list_add(&core->list, &bus->cores);
++		list_add_tail(&core->list, &bus->cores);
+ 	}
+ 
++	err = 0;
++out:
+ 	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
+ 		iounmap(eromptr);
+ 
+-	return 0;
++	return err;
+ }
+ 
+ int __init bcma_bus_scan_early(struct bcma_bus *bus,
+@@ -467,21 +541,21 @@ int __init bcma_bus_scan_early(struct bc
+ 		else if (err == -ESPIPE)
+ 			break;
+ 		else if (err < 0)
+-			return err;
++			goto out;
+ 
+ 		core->core_index = core_num++;
+ 		bus->nr_cores++;
+-		pr_info("Core %d found: %s "
+-			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
+-			core->core_index, bcma_device_name(&core->id),
+-			core->id.manuf, core->id.id, core->id.rev,
+-			core->id.class);
++		bcma_info(bus, "Core %d found: %s (manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
++			  core->core_index, bcma_device_name(&core->id),
++			  core->id.manuf, core->id.id, core->id.rev,
++			  core->id.class);
+ 
+-		list_add(&core->list, &bus->cores);
++		list_add_tail(&core->list, &bus->cores);
+ 		err = 0;
+ 		break;
+ 	}
+ 
++out:
+ 	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
+ 		iounmap(eromptr);
+ 
+--- a/drivers/bcma/scan.h
++++ b/drivers/bcma/scan.h
+@@ -27,7 +27,7 @@
+ #define SCAN_CIB_NMW		0x0007C000
+ #define SCAN_CIB_NMW_SHIFT	14
+ #define SCAN_CIB_NSW		0x00F80000
+-#define SCAN_CIB_NSW_SHIFT	17
++#define SCAN_CIB_NSW_SHIFT	19
+ #define SCAN_CIB_REV		0xFF000000
+ #define SCAN_CIB_REV_SHIFT	24
+ 
+--- a/drivers/bcma/sprom.c
++++ b/drivers/bcma/sprom.c
+@@ -2,6 +2,8 @@
+  * Broadcom specific AMBA
+  * SPROM reading
+  *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+@@ -14,7 +16,57 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
+ 
+-#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	bcma_debug(bus, "Using SPROM revision %d provided by platform.\n",
++		   bus->sprom.revision);
++	return 0;
++fail:
++	bcma_warn(bus, "Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
+ 
+ /**************************************************
+  * R/W ops.
+@@ -124,10 +176,37 @@ static int bcma_sprom_valid(const u16 *s
+  * SPROM extraction.
+  **************************************************/
+ 
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
++#define SPEX32(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((((u32)sprom[SPOFF((_offset)+2)] << 16 | \
++				sprom[SPOFF(_offset)]) & (_mask)) >> (_shift))
++
++#define SPEX_ARRAY8(_field, _offset, _mask, _shift)	\
++	do {	\
++		SPEX(_field[0], _offset +  0, _mask, _shift);	\
++		SPEX(_field[1], _offset +  2, _mask, _shift);	\
++		SPEX(_field[2], _offset +  4, _mask, _shift);	\
++		SPEX(_field[3], _offset +  6, _mask, _shift);	\
++		SPEX(_field[4], _offset +  8, _mask, _shift);	\
++		SPEX(_field[5], _offset + 10, _mask, _shift);	\
++		SPEX(_field[6], _offset + 12, _mask, _shift);	\
++		SPEX(_field[7], _offset + 14, _mask, _shift);	\
++	} while (0)
++
+ static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
+ {
+-	u16 v;
++	u16 v, o;
+ 	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
+ 
+ 	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
+ 		SSB_SPROM_REVISION_REV;
+@@ -137,107 +216,390 @@ static void bcma_sprom_extract_r8(struct
+ 		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
+ 	}
+ 
+-	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
++	SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
+ 
+-	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
+-	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
+-	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
+-	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
+-	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
+-	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
+-	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
+-	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
+-
+-	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
+-	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
+-	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
+-	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
+-	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
+-	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
+-	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
+-	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
+-
+-	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
+-	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
+-	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
+-	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
+-	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
+-	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
+-	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
+-	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
+-
+-	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
+-	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
+-	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
+-	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
+-	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
+-	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
+-	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
+-	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
+-
+-	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
+-	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
+-	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
+-	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
+-
+-	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
+-
+-	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
+-	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
+-	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
+-	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
+-	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
+-
+-	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
+-	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
+-	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
+-	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
+-	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
++	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
++	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
++	     SSB_SPROM8_ANTAVAIL_BG_SHIFT);
++	SPEX(maxpwr_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_MAXP_BG_MASK, 0);
++	SPEX(itssi_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_ITSSI_BG,
++	     SSB_SPROM8_ITSSI_BG_SHIFT);
++	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
++	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
++	     SSB_SPROM8_ITSSI_A_SHIFT);
++	SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
++	SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
++	     SSB_SPROM8_MAXP_AL_SHIFT);
++	SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
++	SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
++	     SSB_SPROM8_GPIOA_P1_SHIFT);
++	SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
++	SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
++	     SSB_SPROM8_GPIOB_P3_SHIFT);
++	SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
++	SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
++	     SSB_SPROM8_TRI5G_SHIFT);
++	SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
++	SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
++	     SSB_SPROM8_TRI5GH_SHIFT);
++	SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G,
++	     SSB_SPROM8_RXPO2G_SHIFT);
++	SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
++	     SSB_SPROM8_RXPO5G_SHIFT);
++	SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
++	SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
++	     SSB_SPROM8_RSSISMC2G_SHIFT);
++	SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
++	     SSB_SPROM8_RSSISAV2G_SHIFT);
++	SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
++	     SSB_SPROM8_BXA2G_SHIFT);
++	SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
++	SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
++	     SSB_SPROM8_RSSISMC5G_SHIFT);
++	SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
++	     SSB_SPROM8_RSSISAV5G_SHIFT);
++	SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
++	     SSB_SPROM8_BXA5G_SHIFT);
++
++	SPEX(pa0b0, SSB_SPROM8_PA0B0, ~0, 0);
++	SPEX(pa0b1, SSB_SPROM8_PA0B1, ~0, 0);
++	SPEX(pa0b2, SSB_SPROM8_PA0B2, ~0, 0);
++	SPEX(pa1b0, SSB_SPROM8_PA1B0, ~0, 0);
++	SPEX(pa1b1, SSB_SPROM8_PA1B1, ~0, 0);
++	SPEX(pa1b2, SSB_SPROM8_PA1B2, ~0, 0);
++	SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, ~0, 0);
++	SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, ~0, 0);
++	SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, ~0, 0);
++	SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, ~0, 0);
++	SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, ~0, 0);
++	SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, ~0, 0);
++	SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, ~0, 0);
++	SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, ~0, 0);
++	SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, ~0, 0);
++	SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, ~0, 0);
++	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, ~0, 0);
++
++	/* Extract the antenna gain values. */
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
++	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
++	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
++	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
++	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
++
++	SPEX(leddc_on_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_ON,
++	     SSB_SPROM8_LEDDC_ON_SHIFT);
++	SPEX(leddc_off_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_OFF,
++	     SSB_SPROM8_LEDDC_OFF_SHIFT);
++
++	SPEX(txchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN,
++	     SSB_SPROM8_TXRXC_TXCHAIN_SHIFT);
++	SPEX(rxchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN,
++	     SSB_SPROM8_TXRXC_RXCHAIN_SHIFT);
++	SPEX(antswitch, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_SWITCH,
++	     SSB_SPROM8_TXRXC_SWITCH_SHIFT);
++
++	SPEX(opo, SSB_SPROM8_OFDM2GPO, 0x00ff, 0);
++
++	SPEX_ARRAY8(mcs2gpo, SSB_SPROM8_2G_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5gpo, SSB_SPROM8_5G_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5glpo, SSB_SPROM8_5GL_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5ghpo, SSB_SPROM8_5GH_MCSPO, ~0, 0);
++
++	SPEX(rawtempsense, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP,
++	     SSB_SPROM8_RAWTS_RAWTEMP_SHIFT);
++	SPEX(measpower, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER,
++	     SSB_SPROM8_RAWTS_MEASPOWER_SHIFT);
++	SPEX(tempsense_slope, SSB_SPROM8_OPT_CORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE,
++	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT);
++	SPEX(tempcorrx, SSB_SPROM8_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT);
++	SPEX(tempsense_option, SSB_SPROM8_OPT_CORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION,
++	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT);
++	SPEX(freqoffset_corr, SSB_SPROM8_HWIQ_IQSWP,
++	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR,
++	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT);
++	SPEX(iqcal_swp_dis, SSB_SPROM8_HWIQ_IQSWP,
++	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP,
++	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT);
++	SPEX(hw_iqcal_en, SSB_SPROM8_HWIQ_IQSWP, SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL,
++	     SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT);
++
++	SPEX(bw40po, SSB_SPROM8_BW40PO, ~0, 0);
++	SPEX(cddpo, SSB_SPROM8_CDDPO, ~0, 0);
++	SPEX(stbcpo, SSB_SPROM8_STBCPO, ~0, 0);
++	SPEX(bwduppo, SSB_SPROM8_BWDUPPO, ~0, 0);
++
++	SPEX(tempthresh, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_TRESH,
++	     SSB_SPROM8_THERMAL_TRESH_SHIFT);
++	SPEX(tempoffset, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_OFFSET,
++	     SSB_SPROM8_THERMAL_OFFSET_SHIFT);
++	SPEX(phycal_tempdelta, SSB_SPROM8_TEMPDELTA,
++	     SSB_SPROM8_TEMPDELTA_PHYCAL,
++	     SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT);
++	SPEX(temps_period, SSB_SPROM8_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD,
++	     SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT);
++	SPEX(temps_hysteresis, SSB_SPROM8_TEMPDELTA,
++	     SSB_SPROM8_TEMPDELTA_HYSTERESIS,
++	     SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case BCMA_CHIP_ID_BCM4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case BCMA_CHIP_ID_BCM4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case BCMA_CHIP_ID_BCM4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case BCMA_CHIP_ID_BCM4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case BCMA_CHIP_ID_BCM43224:
++	case BCMA_CHIP_ID_BCM43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++	case BCMA_CHIP_ID_BCM43227:
++	case BCMA_CHIP_ID_BCM43228:
++	case BCMA_CHIP_ID_BCM43428:
++		present = chip_status & BCMA_CC_CHIPST_43228_OTP_PRESENT;
++		break;
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
+ }
+ 
+ int bcma_sprom_get(struct bcma_bus *bus)
+ {
+-	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
+ 	u16 *sprom;
+ 	int err = 0;
+ 
+ 	if (!bus->drv_cc.core)
+ 		return -EOPNOTSUPP;
+ 
+-	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
+-		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		bool sprom_onchip;
++
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		sprom_onchip = bcma_sprom_onchip_available(bus);
++		if (sprom_onchip) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset || !sprom_onchip) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
+ 
+ 	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+ 			GFP_KERNEL);
+ 	if (!sprom)
+ 		return -ENOMEM;
+ 
+-	if (bus->chipinfo.id == 0x4331)
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4331 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM43431)
+ 		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
+ 
+-	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
+-	 * According to brcm80211 this applies to cards with PCIe rev >= 6
+-	 * TODO: understand this condition and use it */
+-	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
+-		BCMA_CC_SPROM_PCIE6;
++	bcma_debug(bus, "SPROM offset 0x%x\n", offset);
+ 	bcma_sprom_read(bus, offset, sprom);
+ 
+-	if (bus->chipinfo.id == 0x4331)
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4331 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM43431)
+ 		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, true);
+ 
+ 	err = bcma_sprom_valid(sprom);
+-	if (err)
++	if (err) {
++		bcma_warn(bus, "invalid sprom read from the PCIe card, try to use fallback sprom\n");
++		err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
+ 		goto out;
++	}
+ 
+ 	bcma_sprom_extract_r8(bus, sprom);
+ 
+--- a/include/linux/bcma/bcma.h
++++ b/include/linux/bcma/bcma.h
+@@ -7,9 +7,10 @@
+ #include <linux/bcma/bcma_driver_chipcommon.h>
+ #include <linux/bcma/bcma_driver_pci.h>
+ #include <linux/bcma/bcma_driver_mips.h>
++#include <linux/bcma/bcma_driver_gmac_cmn.h>
+ #include <linux/ssb/ssb.h> /* SPROM sharing */
+ 
+-#include "bcma_regs.h"
++#include <linux/bcma/bcma_regs.h>
+ 
+ struct bcma_device;
+ struct bcma_bus;
+@@ -26,6 +27,11 @@ struct bcma_chipinfo {
+ 	u8 pkg;
+ };
+ 
++struct bcma_boardinfo {
++	u16 vendor;
++	u16 type;
++};
++
+ enum bcma_clkmode {
+ 	BCMA_CLKMODE_FAST,
+ 	BCMA_CLKMODE_DYNAMIC,
+@@ -65,6 +71,13 @@ struct bcma_host_ops {
+ 
+ /* Core-ID values. */
+ #define BCMA_CORE_OOB_ROUTER		0x367	/* Out of band */
++#define BCMA_CORE_4706_CHIPCOMMON	0x500
++#define BCMA_CORE_4706_SOC_RAM		0x50E
++#define BCMA_CORE_4706_MAC_GBIT		0x52D
++#define BCMA_CORE_AMEMC			0x52E	/* DDR1/2 memory controller core */
++#define BCMA_CORE_ALTA			0x534	/* I2S core */
++#define BCMA_CORE_4706_MAC_GBIT_COMMON	0x5DC
++#define BCMA_CORE_DDR23_PHY		0x5DD
+ #define BCMA_CORE_INVALID		0x700
+ #define BCMA_CORE_CHIPCOMMON		0x800
+ #define BCMA_CORE_ILINE20		0x801
+@@ -125,6 +138,41 @@ struct bcma_host_ops {
+ 
+ #define BCMA_MAX_NR_CORES		16
+ 
++/* Chip IDs of PCIe devices */
++#define BCMA_CHIP_ID_BCM4313	0x4313
++#define BCMA_CHIP_ID_BCM43224	43224
++#define  BCMA_PKG_ID_BCM43224_FAB_CSM	0x8
++#define  BCMA_PKG_ID_BCM43224_FAB_SMIC	0xa
++#define BCMA_CHIP_ID_BCM43225	43225
++#define BCMA_CHIP_ID_BCM43227	43227
++#define BCMA_CHIP_ID_BCM43228	43228
++#define BCMA_CHIP_ID_BCM43421	43421
++#define BCMA_CHIP_ID_BCM43428	43428
++#define BCMA_CHIP_ID_BCM43431	43431
++#define BCMA_CHIP_ID_BCM43460	43460
++#define BCMA_CHIP_ID_BCM4331	0x4331
++#define BCMA_CHIP_ID_BCM6362	0x6362
++#define BCMA_CHIP_ID_BCM4360	0x4360
++#define BCMA_CHIP_ID_BCM4352	0x4352
++
++/* Chip IDs of SoCs */
++#define BCMA_CHIP_ID_BCM4706	0x5300
++#define  BCMA_PKG_ID_BCM4706L	1
++#define BCMA_CHIP_ID_BCM4716	0x4716
++#define  BCMA_PKG_ID_BCM4716	8
++#define  BCMA_PKG_ID_BCM4717	9
++#define  BCMA_PKG_ID_BCM4718	10
++#define BCMA_CHIP_ID_BCM47162	47162
++#define BCMA_CHIP_ID_BCM4748	0x4748
++#define BCMA_CHIP_ID_BCM4749	0x4749
++#define BCMA_CHIP_ID_BCM5356	0x5356
++#define BCMA_CHIP_ID_BCM5357	0x5357
++#define  BCMA_PKG_ID_BCM5358	9
++#define  BCMA_PKG_ID_BCM47186	10
++#define  BCMA_PKG_ID_BCM5357	11
++#define BCMA_CHIP_ID_BCM53572	53572
++#define  BCMA_PKG_ID_BCM47188	9
++
+ struct bcma_device {
+ 	struct bcma_bus *bus;
+ 	struct bcma_device_id id;
+@@ -136,8 +184,10 @@ struct bcma_device {
+ 	bool dev_registered;
+ 
+ 	u8 core_index;
++	u8 core_unit;
+ 
+ 	u32 addr;
++	u32 addr1;
+ 	u32 wrap;
+ 
+ 	void __iomem *io_addr;
+@@ -175,6 +225,12 @@ int __bcma_driver_register(struct bcma_d
+ 
+ extern void bcma_driver_unregister(struct bcma_driver *drv);
+ 
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
+ struct bcma_bus {
+ 	/* The MMIO area. */
+ 	void __iomem *mmio;
+@@ -191,14 +247,18 @@ struct bcma_bus {
+ 
+ 	struct bcma_chipinfo chipinfo;
+ 
++	struct bcma_boardinfo boardinfo;
++
+ 	struct bcma_device *mapped_core;
+ 	struct list_head cores;
+ 	u8 nr_cores;
+ 	u8 init_done:1;
++	u8 num;
+ 
+ 	struct bcma_drv_cc drv_cc;
+-	struct bcma_drv_pci drv_pci;
++	struct bcma_drv_pci drv_pci[2];
+ 	struct bcma_drv_mips drv_mips;
++	struct bcma_drv_gmac_cmn drv_gmac_cmn;
+ 
+ 	/* We decided to share SPROM struct with SSB as long as we do not need
+ 	 * any hacks for BCMA. This simplifies drivers code. */
+@@ -282,6 +342,7 @@ static inline void bcma_maskset16(struct
+ 	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
+ }
+ 
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
+ extern bool bcma_core_is_enabled(struct bcma_device *core);
+ extern void bcma_core_disable(struct bcma_device *core, u32 flags);
+ extern int bcma_core_enable(struct bcma_device *core, u32 flags);
+@@ -289,6 +350,7 @@ extern void bcma_core_set_clockmode(stru
+ 				    enum bcma_clkmode clkmode);
+ extern void bcma_core_pll_ctl(struct bcma_device *core, u32 req, u32 status,
+ 			      bool on);
++extern u32 bcma_chipco_pll_read(struct bcma_drv_cc *cc, u32 offset);
+ #define BCMA_DMA_TRANSLATION_MASK	0xC0000000
+ #define  BCMA_DMA_TRANSLATION_NONE	0x00000000
+ #define  BCMA_DMA_TRANSLATION_DMA32_CMT	0x40000000 /* Client Mode Translation for 32-bit DMA */
+--- a/include/linux/bcma/bcma_driver_chipcommon.h
++++ b/include/linux/bcma/bcma_driver_chipcommon.h
+@@ -1,6 +1,9 @@
+ #ifndef LINUX_BCMA_DRIVER_CC_H_
+ #define LINUX_BCMA_DRIVER_CC_H_
+ 
++#include <linux/platform_device.h>
++#include <linux/gpio.h>
++
+ /** ChipCommon core registers. **/
+ #define BCMA_CC_ID			0x0000
+ #define  BCMA_CC_ID_ID			0x0000FFFF
+@@ -24,7 +27,7 @@
+ #define   BCMA_CC_FLASHT_NONE		0x00000000	/* No flash */
+ #define   BCMA_CC_FLASHT_STSER		0x00000100	/* ST serial flash */
+ #define   BCMA_CC_FLASHT_ATSER		0x00000200	/* Atmel serial flash */
+-#define   BCMA_CC_FLASHT_NFLASH		0x00000200
++#define   BCMA_CC_FLASHT_NFLASH		0x00000200	/* NAND flash */
+ #define	  BCMA_CC_FLASHT_PARA		0x00000700	/* Parallel flash */
+ #define  BCMA_CC_CAP_PLLT		0x00038000	/* PLL Type */
+ #define   BCMA_PLLTYPE_NONE		0x00000000
+@@ -45,6 +48,7 @@
+ #define  BCMA_CC_CAP_PMU		0x10000000	/* PMU available (rev >= 20) */
+ #define  BCMA_CC_CAP_ECI		0x20000000	/* ECI available (rev >= 20) */
+ #define  BCMA_CC_CAP_SPROM		0x40000000	/* SPROM present */
++#define  BCMA_CC_CAP_NFLASH		0x80000000	/* NAND flash present (rev >= 35 or BCM4706?) */
+ #define BCMA_CC_CORECTL			0x0008
+ #define  BCMA_CC_CORECTL_UARTCLK0	0x00000001	/* Drive UART with internal clock */
+ #define	 BCMA_CC_CORECTL_SE		0x00000002	/* sync clk out enable (corerev >= 3) */
+@@ -56,6 +60,9 @@
+ #define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
+ #define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
+ #define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
+ #define BCMA_CC_OTPC			0x0014		/* OTP control */
+ #define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
+ #define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
+@@ -72,6 +79,8 @@
+ #define	 BCMA_CC_OTPP_READ		0x40000000
+ #define	 BCMA_CC_OTPP_START		0x80000000
+ #define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
+ #define BCMA_CC_IRQSTAT			0x0020
+ #define BCMA_CC_IRQMASK			0x0024
+ #define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
+@@ -79,6 +88,22 @@
+ #define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
+ #define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
+ #define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
++#define  BCMA_CC_CHIPST_43228_ILP_DIV_EN	0x00000001
++#define  BCMA_CC_CHIPST_43228_OTP_PRESENT	0x00000002
++#define  BCMA_CC_CHIPST_43228_SERDES_REFCLK_PADSEL	0x00000004
++#define  BCMA_CC_CHIPST_43228_SDIO_MODE		0x00000008
++#define  BCMA_CC_CHIPST_43228_SDIO_OTP_PRESENT	0x00000010
++#define  BCMA_CC_CHIPST_43228_SDIO_RESET	0x00000020
++#define  BCMA_CC_CHIPST_4706_PKG_OPTION		BIT(0) /* 0: full-featured package 1: low-cost package */
++#define  BCMA_CC_CHIPST_4706_SFLASH_PRESENT	BIT(1) /* 0: parallel, 1: serial flash is present */
++#define  BCMA_CC_CHIPST_4706_SFLASH_TYPE	BIT(2) /* 0: 8b-p/ST-s flash, 1: 16b-p/Atmal-s flash */
++#define  BCMA_CC_CHIPST_4706_MIPS_BENDIAN	BIT(3) /* 0: little, 1: big endian */
++#define  BCMA_CC_CHIPST_4706_PCIE1_DISABLE	BIT(5) /* PCIE1 enable strap pin */
++#define  BCMA_CC_CHIPST_5357_NAND_BOOT		BIT(4) /* NAND boot, valid for CC rev 38 and/or BCM5357 */
+ #define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
+ #define  BCMA_CC_JCMD_START		0x80000000
+ #define  BCMA_CC_JCMD_BUSY		0x80000000
+@@ -108,10 +133,58 @@
+ #define  BCMA_CC_JCTL_EXT_EN		2		/* Enable external targets */
+ #define  BCMA_CC_JCTL_EN		1		/* Enable Jtag master */
+ #define BCMA_CC_FLASHCTL		0x0040
++/* Start/busy bit in flashcontrol */
++#define  BCMA_CC_FLASHCTL_OPCODE	0x000000ff
++#define  BCMA_CC_FLASHCTL_ACTION	0x00000700
++#define  BCMA_CC_FLASHCTL_CS_ACTIVE	0x00001000	/* Chip Select Active, rev >= 20 */
+ #define  BCMA_CC_FLASHCTL_START		0x80000000
+ #define  BCMA_CC_FLASHCTL_BUSY		BCMA_CC_FLASHCTL_START
++/* Flashcontrol action + opcodes for ST flashes */
++#define  BCMA_CC_FLASHCTL_ST_WREN	0x0006		/* Write Enable */
++#define  BCMA_CC_FLASHCTL_ST_WRDIS	0x0004		/* Write Disable */
++#define  BCMA_CC_FLASHCTL_ST_RDSR	0x0105		/* Read Status Register */
++#define  BCMA_CC_FLASHCTL_ST_WRSR	0x0101		/* Write Status Register */
++#define  BCMA_CC_FLASHCTL_ST_READ	0x0303		/* Read Data Bytes */
++#define  BCMA_CC_FLASHCTL_ST_PP		0x0302		/* Page Program */
++#define  BCMA_CC_FLASHCTL_ST_SE		0x02d8		/* Sector Erase */
++#define  BCMA_CC_FLASHCTL_ST_BE		0x00c7		/* Bulk Erase */
++#define  BCMA_CC_FLASHCTL_ST_DP		0x00b9		/* Deep Power-down */
++#define  BCMA_CC_FLASHCTL_ST_RES	0x03ab		/* Read Electronic Signature */
++#define  BCMA_CC_FLASHCTL_ST_CSA	0x1000		/* Keep chip select asserted */
++#define  BCMA_CC_FLASHCTL_ST_SSE	0x0220		/* Sub-sector Erase */
++/* Flashcontrol action + opcodes for Atmel flashes */
++#define  BCMA_CC_FLASHCTL_AT_READ			0x07e8
++#define  BCMA_CC_FLASHCTL_AT_PAGE_READ			0x07d2
++#define  BCMA_CC_FLASHCTL_AT_STATUS			0x01d7
++#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE			0x0384
++#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE			0x0387
++#define  BCMA_CC_FLASHCTL_AT_BUF1_ERASE_PROGRAM		0x0283
++#define  BCMA_CC_FLASHCTL_AT_BUF2_ERASE_PROGRAM		0x0286
++#define  BCMA_CC_FLASHCTL_AT_BUF1_PROGRAM		0x0288
++#define  BCMA_CC_FLASHCTL_AT_BUF2_PROGRAM		0x0289
++#define  BCMA_CC_FLASHCTL_AT_PAGE_ERASE			0x0281
++#define  BCMA_CC_FLASHCTL_AT_BLOCK_ERASE		0x0250
++#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE_ERASE_PROGRAM	0x0382
++#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE_ERASE_PROGRAM	0x0385
++#define  BCMA_CC_FLASHCTL_AT_BUF1_LOAD			0x0253
++#define  BCMA_CC_FLASHCTL_AT_BUF2_LOAD			0x0255
++#define  BCMA_CC_FLASHCTL_AT_BUF1_COMPARE		0x0260
++#define  BCMA_CC_FLASHCTL_AT_BUF2_COMPARE		0x0261
++#define  BCMA_CC_FLASHCTL_AT_BUF1_REPROGRAM		0x0258
++#define  BCMA_CC_FLASHCTL_AT_BUF2_REPROGRAM		0x0259
+ #define BCMA_CC_FLASHADDR		0x0044
+ #define BCMA_CC_FLASHDATA		0x0048
++/* Status register bits for ST flashes */
++#define  BCMA_CC_FLASHDATA_ST_WIP	0x01		/* Write In Progress */
++#define  BCMA_CC_FLASHDATA_ST_WEL	0x02		/* Write Enable Latch */
++#define  BCMA_CC_FLASHDATA_ST_BP_MASK	0x1c		/* Block Protect */
++#define  BCMA_CC_FLASHDATA_ST_BP_SHIFT	2
++#define  BCMA_CC_FLASHDATA_ST_SRWD	0x80		/* Status Register Write Disable */
++/* Status register bits for Atmel flashes */
++#define  BCMA_CC_FLASHDATA_AT_READY	0x80
++#define  BCMA_CC_FLASHDATA_AT_MISMATCH	0x40
++#define  BCMA_CC_FLASHDATA_AT_ID_MASK	0x38
++#define  BCMA_CC_FLASHDATA_AT_ID_SHIFT	3
+ #define BCMA_CC_BCAST_ADDR		0x0050
+ #define BCMA_CC_BCAST_DATA		0x0054
+ #define BCMA_CC_GPIOPULLUP		0x0058		/* Rev >= 20 only */
+@@ -181,6 +254,45 @@
+ #define BCMA_CC_FLASH_CFG		0x0128
+ #define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
+ #define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
++/* Block 0x140 - 0x190 registers are chipset specific */
++#define BCMA_CC_4706_FLASHSCFG		0x18C		/* Flash struct configuration */
++#define  BCMA_CC_4706_FLASHSCFG_MASK	0x000000ff
++#define  BCMA_CC_4706_FLASHSCFG_SF1	0x00000001	/* 2nd serial flash present */
++#define  BCMA_CC_4706_FLASHSCFG_PF1	0x00000002	/* 2nd parallel flash present */
++#define  BCMA_CC_4706_FLASHSCFG_SF1_TYPE	0x00000004	/* 2nd serial flash type : 0 : ST, 1 : Atmel */
++#define  BCMA_CC_4706_FLASHSCFG_NF1	0x00000008	/* 2nd NAND flash present */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_MASK	0x000000f0
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_4MB	0x00000010	/* 4MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_8MB	0x00000020	/* 8MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_16MB	0x00000030	/* 16MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_32MB	0x00000040	/* 32MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_64MB	0x00000050	/* 64MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_128MB	0x00000060	/* 128MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_256MB	0x00000070	/* 256MB */
++/* NAND flash registers for BCM4706 (corerev = 31) */
++#define BCMA_CC_NFLASH_CTL		0x01A0
++#define  BCMA_CC_NFLASH_CTL_ERR		0x08000000
++#define BCMA_CC_NFLASH_CONF		0x01A4
++#define BCMA_CC_NFLASH_COL_ADDR		0x01A8
++#define BCMA_CC_NFLASH_ROW_ADDR		0x01AC
++#define BCMA_CC_NFLASH_DATA		0x01B0
++#define BCMA_CC_NFLASH_WAITCNT0		0x01B4
+ /* 0x1E0 is defined as shared BCMA_CLKCTLST */
+ #define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
+ #define BCMA_CC_UART0_DATA		0x0300
+@@ -240,7 +352,60 @@
+ #define BCMA_CC_PLLCTL_ADDR		0x0660
+ #define BCMA_CC_PLLCTL_DATA		0x0664
+ #define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
+-#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
++/* NAND flash MLC controller registers (corerev >= 38) */
++#define BCMA_CC_NAND_REVISION		0x0C00
++#define BCMA_CC_NAND_CMD_START		0x0C04
++#define BCMA_CC_NAND_CMD_ADDR_X		0x0C08
++#define BCMA_CC_NAND_CMD_ADDR		0x0C0C
++#define BCMA_CC_NAND_CMD_END_ADDR	0x0C10
++#define BCMA_CC_NAND_CS_NAND_SELECT	0x0C14
++#define BCMA_CC_NAND_CS_NAND_XOR	0x0C18
++#define BCMA_CC_NAND_SPARE_RD0		0x0C20
++#define BCMA_CC_NAND_SPARE_RD4		0x0C24
++#define BCMA_CC_NAND_SPARE_RD8		0x0C28
++#define BCMA_CC_NAND_SPARE_RD12		0x0C2C
++#define BCMA_CC_NAND_SPARE_WR0		0x0C30
++#define BCMA_CC_NAND_SPARE_WR4		0x0C34
++#define BCMA_CC_NAND_SPARE_WR8		0x0C38
++#define BCMA_CC_NAND_SPARE_WR12		0x0C3C
++#define BCMA_CC_NAND_ACC_CONTROL	0x0C40
++#define BCMA_CC_NAND_CONFIG		0x0C48
++#define BCMA_CC_NAND_TIMING_1		0x0C50
++#define BCMA_CC_NAND_TIMING_2		0x0C54
++#define BCMA_CC_NAND_SEMAPHORE		0x0C58
++#define BCMA_CC_NAND_DEVID		0x0C60
++#define BCMA_CC_NAND_DEVID_X		0x0C64
++#define BCMA_CC_NAND_BLOCK_LOCK_STATUS	0x0C68
++#define BCMA_CC_NAND_INTFC_STATUS	0x0C6C
++#define BCMA_CC_NAND_ECC_CORR_ADDR_X	0x0C70
++#define BCMA_CC_NAND_ECC_CORR_ADDR	0x0C74
++#define BCMA_CC_NAND_ECC_UNC_ADDR_X	0x0C78
++#define BCMA_CC_NAND_ECC_UNC_ADDR	0x0C7C
++#define BCMA_CC_NAND_READ_ERROR_COUNT	0x0C80
++#define BCMA_CC_NAND_CORR_STAT_THRESHOLD	0x0C84
++#define BCMA_CC_NAND_READ_ADDR_X	0x0C90
++#define BCMA_CC_NAND_READ_ADDR		0x0C94
++#define BCMA_CC_NAND_PAGE_PROGRAM_ADDR_X	0x0C98
++#define BCMA_CC_NAND_PAGE_PROGRAM_ADDR	0x0C9C
++#define BCMA_CC_NAND_COPY_BACK_ADDR_X	0x0CA0
++#define BCMA_CC_NAND_COPY_BACK_ADDR	0x0CA4
++#define BCMA_CC_NAND_BLOCK_ERASE_ADDR_X	0x0CA8
++#define BCMA_CC_NAND_BLOCK_ERASE_ADDR	0x0CAC
++#define BCMA_CC_NAND_INV_READ_ADDR_X	0x0CB0
++#define BCMA_CC_NAND_INV_READ_ADDR	0x0CB4
++#define BCMA_CC_NAND_BLK_WR_PROTECT	0x0CC0
++#define BCMA_CC_NAND_ACC_CONTROL_CS1	0x0CD0
++#define BCMA_CC_NAND_CONFIG_CS1		0x0CD4
++#define BCMA_CC_NAND_TIMING_1_CS1	0x0CD8
++#define BCMA_CC_NAND_TIMING_2_CS1	0x0CDC
++#define BCMA_CC_NAND_SPARE_RD16		0x0D30
++#define BCMA_CC_NAND_SPARE_RD20		0x0D34
++#define BCMA_CC_NAND_SPARE_RD24		0x0D38
++#define BCMA_CC_NAND_SPARE_RD28		0x0D3C
++#define BCMA_CC_NAND_CACHE_ADDR		0x0D40
++#define BCMA_CC_NAND_CACHE_DATA		0x0D44
++#define BCMA_CC_NAND_CTRL_CONFIG	0x0D48
++#define BCMA_CC_NAND_CTRL_STATUS	0x0D4C
+ 
+ /* Divider allocation in 4716/47162/5356 */
+ #define BCMA_CC_PMU5_MAINPLL_CPU	1
+@@ -256,6 +421,15 @@
+ 
+ /* 4706 PMU */
+ #define BCMA_CC_PMU4706_MAINPLL_PLL0	0
++#define BCMA_CC_PMU6_4706_PROCPLL_OFF	4	/* The CPU PLL */
++#define  BCMA_CC_PMU6_4706_PROC_P2DIV_MASK	0x000f0000
++#define  BCMA_CC_PMU6_4706_PROC_P2DIV_SHIFT	16
++#define  BCMA_CC_PMU6_4706_PROC_P1DIV_MASK	0x0000f000
++#define  BCMA_CC_PMU6_4706_PROC_P1DIV_SHIFT	12
++#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_MASK	0x00000ff8
++#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_SHIFT	3
++#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_MASK	0x00000007
++#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_SHIFT	0
+ 
+ /* ALP clock on pre-PMU chips */
+ #define BCMA_CC_PMU_ALP_CLOCK		20000000
+@@ -284,6 +458,19 @@
+ #define BCMA_CC_PPL_PCHI_OFF		5
+ #define BCMA_CC_PPL_PCHI_MASK		0x0000003f
+ 
++#define BCMA_CC_PMU_PLL_CTL0		0
++#define BCMA_CC_PMU_PLL_CTL1		1
++#define BCMA_CC_PMU_PLL_CTL2		2
++#define BCMA_CC_PMU_PLL_CTL3		3
++#define BCMA_CC_PMU_PLL_CTL4		4
++#define BCMA_CC_PMU_PLL_CTL5		5
++
++#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK	0x00f00000
++#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT	20
++
++#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK	0x1ff00000
++#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT	20
++
+ /* BCM4331 ChipControl numbers. */
+ #define BCMA_CHIPCTL_4331_BT_COEXIST		BIT(0)	/* 0 disable */
+ #define BCMA_CHIPCTL_4331_SECI			BIT(1)	/* 0 SECI is disabled (JATG functional) */
+@@ -297,9 +484,25 @@
+ #define BCMA_CHIPCTL_4331_OVR_PIPEAUXPWRDOWN	BIT(9)	/* override core control on pipe_AuxPowerDown */
+ #define BCMA_CHIPCTL_4331_PCIE_AUXCLKEN		BIT(10)	/* pcie_auxclkenable */
+ #define BCMA_CHIPCTL_4331_PCIE_PIPE_PLLDOWN	BIT(11)	/* pcie_pipe_pllpowerdown */
++#define BCMA_CHIPCTL_4331_EXTPA_EN2		BIT(12)	/* 0 ext pa disable, 1 ext pa enabled */
+ #define BCMA_CHIPCTL_4331_BT_SHD0_ON_GPIO4	BIT(16)	/* enable bt_shd0 at gpio4 */
+ #define BCMA_CHIPCTL_4331_BT_SHD1_ON_GPIO5	BIT(17)	/* enable bt_shd1 at gpio5 */
+ 
++/* 43224 chip-specific ChipControl register bits */
++#define BCMA_CCTRL_43224_GPIO_TOGGLE		0x8000		/* gpio[3:0] pins as btcoex or s/w gpio */
++#define BCMA_CCTRL_43224A0_12MA_LED_DRIVE	0x00F000F0	/* 12 mA drive strength */
++#define BCMA_CCTRL_43224B0_12MA_LED_DRIVE	0xF0		/* 12 mA drive strength for later 43224s */
++
++/* 4313 Chip specific ChipControl register bits */
++#define BCMA_CCTRL_4313_12MA_LED_DRIVE		0x00000007	/* 12 mA drive strengh for later 4313 */
++
++/* BCM5357 ChipControl register bits */
++#define BCMA_CHIPCTL_5357_EXTPA			BIT(14)
++#define BCMA_CHIPCTL_5357_ANT_MUX_2O3		BIT(15)
++#define BCMA_CHIPCTL_5357_NFLASH		BIT(16)
++#define BCMA_CHIPCTL_5357_I2S_PINS_ENABLE	BIT(18)
++#define BCMA_CHIPCTL_5357_I2CSPI_PINS_ENABLE	BIT(19)
++
+ /* Data for the PMU, if available.
+  * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
+  */
+@@ -310,11 +513,35 @@ struct bcma_chipcommon_pmu {
+ 
+ #ifdef CONFIG_BCMA_DRIVER_MIPS
+ struct bcma_pflash {
++	bool present;
+ 	u8 buswidth;
+ 	u32 window;
+ 	u32 window_size;
+ };
+ 
++#ifdef CONFIG_BCMA_SFLASH
++struct bcma_sflash {
++	bool present;
++	u32 window;
++	u32 blocksize;
++	u16 numblocks;
++	u32 size;
++
++	struct mtd_info *mtd;
++};
++#endif
++
++#ifdef CONFIG_BCMA_NFLASH
++struct mtd_info;
++
++struct bcma_nflash {
++	bool present;
++	bool boot;		/* This is the flash the SoC boots from */
++
++	struct mtd_info *mtd;
++};
++#endif
++
+ struct bcma_serial_port {
+ 	void *regs;
+ 	unsigned long clockspeed;
+@@ -330,15 +557,30 @@ struct bcma_drv_cc {
+ 	u32 capabilities;
+ 	u32 capabilities_ext;
+ 	u8 setup_done:1;
++	u8 early_setup_done:1;
+ 	/* Fast Powerup Delay constant */
+ 	u16 fast_pwrup_delay;
+ 	struct bcma_chipcommon_pmu pmu;
+ #ifdef CONFIG_BCMA_DRIVER_MIPS
+ 	struct bcma_pflash pflash;
++#ifdef CONFIG_BCMA_SFLASH
++	struct bcma_sflash sflash;
++#endif
++#ifdef CONFIG_BCMA_NFLASH
++	struct bcma_nflash nflash;
++#endif
+ 
+ 	int nr_serial_ports;
+ 	struct bcma_serial_port serial_ports[4];
+ #endif /* CONFIG_BCMA_DRIVER_MIPS */
++	u32 ticks_per_ms;
++	struct platform_device *watchdog;
++
++	/* Lock for GPIO register access. */
++	spinlock_t gpio_lock;
++#ifdef CONFIG_BCMA_DRIVER_GPIO
++	struct gpio_chip gpio;
++#endif
+ };
+ 
+ /* Register access */
+@@ -355,14 +597,14 @@ struct bcma_drv_cc {
+ 	bcma_cc_write32(cc, offset, (bcma_cc_read32(cc, offset) & (mask)) | (set))
+ 
+ extern void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
++extern void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
+ 
+ extern void bcma_chipco_suspend(struct bcma_drv_cc *cc);
+ extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
+ 
+ void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
+ 
+-extern void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc,
+-					  u32 ticks);
++extern u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks);
+ 
+ void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value);
+ 
+@@ -375,9 +617,12 @@ u32 bcma_chipco_gpio_outen(struct bcma_d
+ u32 bcma_chipco_gpio_control(struct bcma_drv_cc *cc, u32 mask, u32 value);
+ u32 bcma_chipco_gpio_intmask(struct bcma_drv_cc *cc, u32 mask, u32 value);
+ u32 bcma_chipco_gpio_polarity(struct bcma_drv_cc *cc, u32 mask, u32 value);
++u32 bcma_chipco_gpio_pullup(struct bcma_drv_cc *cc, u32 mask, u32 value);
++u32 bcma_chipco_gpio_pulldown(struct bcma_drv_cc *cc, u32 mask, u32 value);
+ 
+ /* PMU support */
+ extern void bcma_pmu_init(struct bcma_drv_cc *cc);
++extern void bcma_pmu_early_init(struct bcma_drv_cc *cc);
+ 
+ extern void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset,
+ 				  u32 value);
+@@ -387,5 +632,6 @@ extern void bcma_chipco_chipctl_maskset(
+ 					u32 offset, u32 mask, u32 set);
+ extern void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc,
+ 				       u32 offset, u32 mask, u32 set);
++extern void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid);
+ 
+ #endif /* LINUX_BCMA_DRIVER_CC_H_ */
+--- /dev/null
++++ b/include/linux/bcma/bcma_driver_gmac_cmn.h
+@@ -0,0 +1,100 @@
++#ifndef LINUX_BCMA_DRIVER_GMAC_CMN_H_
++#define LINUX_BCMA_DRIVER_GMAC_CMN_H_
++
++#include <linux/types.h>
++
++#define BCMA_GMAC_CMN_STAG0		0x000
++#define BCMA_GMAC_CMN_STAG1		0x004
++#define BCMA_GMAC_CMN_STAG2		0x008
++#define BCMA_GMAC_CMN_STAG3		0x00C
++#define BCMA_GMAC_CMN_PARSER_CTL	0x020
++#define BCMA_GMAC_CMN_MIB_MAX_LEN	0x024
++#define BCMA_GMAC_CMN_PHY_ACCESS	0x100
++#define  BCMA_GMAC_CMN_PA_DATA_MASK	0x0000ffff
++#define  BCMA_GMAC_CMN_PA_ADDR_MASK	0x001f0000
++#define  BCMA_GMAC_CMN_PA_ADDR_SHIFT	16
++#define  BCMA_GMAC_CMN_PA_REG_MASK	0x1f000000
++#define  BCMA_GMAC_CMN_PA_REG_SHIFT	24
++#define  BCMA_GMAC_CMN_PA_WRITE		0x20000000
++#define  BCMA_GMAC_CMN_PA_START		0x40000000
++#define BCMA_GMAC_CMN_PHY_CTL		0x104
++#define  BCMA_GMAC_CMN_PC_EPA_MASK	0x0000001f
++#define  BCMA_GMAC_CMN_PC_MCT_MASK	0x007f0000
++#define  BCMA_GMAC_CMN_PC_MCT_SHIFT	16
++#define  BCMA_GMAC_CMN_PC_MTE		0x00800000
++#define BCMA_GMAC_CMN_GMAC0_RGMII_CTL	0x110
++#define BCMA_GMAC_CMN_CFP_ACCESS	0x200
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA0	0x210
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA1	0x214
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA2	0x218
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA3	0x21C
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA4	0x220
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA5	0x224
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA6	0x228
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA7	0x22C
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK0	0x230
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK1	0x234
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK2	0x238
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK3	0x23C
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK4	0x240
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK5	0x244
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK6	0x248
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK7	0x24C
++#define BCMA_GMAC_CMN_CFP_ACTION_DATA	0x250
++#define BCMA_GMAC_CMN_TCAM_BIST_CTL	0x2A0
++#define BCMA_GMAC_CMN_TCAM_BIST_STATUS	0x2A4
++#define BCMA_GMAC_CMN_TCAM_CMP_STATUS	0x2A8
++#define BCMA_GMAC_CMN_TCAM_DISABLE	0x2AC
++#define BCMA_GMAC_CMN_TCAM_TEST_CTL	0x2F0
++#define BCMA_GMAC_CMN_UDF_0_A3_A0	0x300
++#define BCMA_GMAC_CMN_UDF_0_A7_A4	0x304
++#define BCMA_GMAC_CMN_UDF_0_A8		0x308
++#define BCMA_GMAC_CMN_UDF_1_A3_A0	0x310
++#define BCMA_GMAC_CMN_UDF_1_A7_A4	0x314
++#define BCMA_GMAC_CMN_UDF_1_A8		0x318
++#define BCMA_GMAC_CMN_UDF_2_A3_A0	0x320
++#define BCMA_GMAC_CMN_UDF_2_A7_A4	0x324
++#define BCMA_GMAC_CMN_UDF_2_A8		0x328
++#define BCMA_GMAC_CMN_UDF_0_B3_B0	0x330
++#define BCMA_GMAC_CMN_UDF_0_B7_B4	0x334
++#define BCMA_GMAC_CMN_UDF_0_B8		0x338
++#define BCMA_GMAC_CMN_UDF_1_B3_B0	0x340
++#define BCMA_GMAC_CMN_UDF_1_B7_B4	0x344
++#define BCMA_GMAC_CMN_UDF_1_B8		0x348
++#define BCMA_GMAC_CMN_UDF_2_B3_B0	0x350
++#define BCMA_GMAC_CMN_UDF_2_B7_B4	0x354
++#define BCMA_GMAC_CMN_UDF_2_B8		0x358
++#define BCMA_GMAC_CMN_UDF_0_C3_C0	0x360
++#define BCMA_GMAC_CMN_UDF_0_C7_C4	0x364
++#define BCMA_GMAC_CMN_UDF_0_C8		0x368
++#define BCMA_GMAC_CMN_UDF_1_C3_C0	0x370
++#define BCMA_GMAC_CMN_UDF_1_C7_C4	0x374
++#define BCMA_GMAC_CMN_UDF_1_C8		0x378
++#define BCMA_GMAC_CMN_UDF_2_C3_C0	0x380
++#define BCMA_GMAC_CMN_UDF_2_C7_C4	0x384
++#define BCMA_GMAC_CMN_UDF_2_C8		0x388
++#define BCMA_GMAC_CMN_UDF_0_D3_D0	0x390
++#define BCMA_GMAC_CMN_UDF_0_D7_D4	0x394
++#define BCMA_GMAC_CMN_UDF_0_D11_D8	0x394
++
++struct bcma_drv_gmac_cmn {
++	struct bcma_device *core;
++
++	/* Drivers accessing BCMA_GMAC_CMN_PHY_ACCESS and
++	 * BCMA_GMAC_CMN_PHY_CTL need to take that mutex first. */
++	struct mutex phy_mutex;
++};
++
++/* Register access */
++#define gmac_cmn_read16(gc, offset)		bcma_read16((gc)->core, offset)
++#define gmac_cmn_read32(gc, offset)		bcma_read32((gc)->core, offset)
++#define gmac_cmn_write16(gc, offset, val)	bcma_write16((gc)->core, offset, val)
++#define gmac_cmn_write32(gc, offset, val)	bcma_write32((gc)->core, offset, val)
++
++#ifdef CONFIG_BCMA_DRIVER_GMAC_CMN
++extern void __devinit bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc);
++#else
++static inline void bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc) { }
++#endif
++
++#endif /* LINUX_BCMA_DRIVER_GMAC_CMN_H_ */
+--- a/include/linux/bcma/bcma_driver_mips.h
++++ b/include/linux/bcma/bcma_driver_mips.h
+@@ -35,13 +35,15 @@ struct bcma_device;
+ struct bcma_drv_mips {
+ 	struct bcma_device *core;
+ 	u8 setup_done:1;
+-	unsigned int assigned_irqs;
++	u8 early_setup_done:1;
+ };
+ 
+ #ifdef CONFIG_BCMA_DRIVER_MIPS
+ extern void bcma_core_mips_init(struct bcma_drv_mips *mcore);
++extern void bcma_core_mips_early_init(struct bcma_drv_mips *mcore);
+ #else
+ static inline void bcma_core_mips_init(struct bcma_drv_mips *mcore) { }
++static inline void bcma_core_mips_early_init(struct bcma_drv_mips *mcore) { }
+ #endif
+ 
+ extern u32 bcma_cpu_clock(struct bcma_drv_mips *mcore);
+--- a/include/linux/bcma/bcma_driver_pci.h
++++ b/include/linux/bcma/bcma_driver_pci.h
+@@ -53,11 +53,47 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
+ #define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
+ #define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
+ #define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG3			0x0700	/* PCI config space 3 (rev >= 8) */
+ #define BCMA_CORE_PCI_SPROM(wordoffset)		(0x0800 + ((wordoffset) * 2)) /* SPROM shadow area (72 bytes) */
++#define  BCMA_CORE_PCI_SPROM_PI_OFFSET		0	/* first word */
++#define   BCMA_CORE_PCI_SPROM_PI_MASK		0xf000	/* bit 15:12 */
++#define   BCMA_CORE_PCI_SPROM_PI_SHIFT		12	/* bit 15:12 */
++#define  BCMA_CORE_PCI_SPROM_MISC_CONFIG	5	/* word 5 */
++#define   BCMA_CORE_PCI_SPROM_L23READY_EXIT_NOPERST	0x8000	/* bit 15 */
++#define   BCMA_CORE_PCI_SPROM_CLKREQ_OFFSET_REV5	20	/* word 20 for srom rev <= 5 */
++#define   BCMA_CORE_PCI_SPROM_CLKREQ_ENB	0x0800	/* bit 11 */
+ 
+ /* SBtoPCIx */
+ #define BCMA_CORE_PCI_SBTOPCI_MEM		0x00000000
+@@ -72,20 +108,118 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
+ 
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define  BCMA_CORE_PCI_ASPMTIMER_EXTEND		0x01000000 /* > rev7: enable extend ASPM timer */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
+ /* PCIcore specific boardflags */
+ #define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
+ 
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
+ struct bcma_drv_pci {
+ 	struct bcma_device *core;
+ 	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
+ };
+ 
+ /* Register access */
++#define pcicore_read16(pc, offset)		bcma_read16((pc)->core, offset)
+ #define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
++#define pcicore_write16(pc, offset, val)	bcma_write16((pc)->core, offset, val)
+ #define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
+ 
+-extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
+ extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
+ 				 struct bcma_device *core, bool enable);
++extern void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend);
++
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
+ 
+ #endif /* LINUX_BCMA_DRIVER_PCI_H_ */
+--- a/include/linux/bcma/bcma_regs.h
++++ b/include/linux/bcma/bcma_regs.h
+@@ -11,11 +11,13 @@
+ #define  BCMA_CLKCTLST_HAVEHTREQ	0x00000010 /* HT available request */
+ #define  BCMA_CLKCTLST_HWCROFF		0x00000020 /* Force HW clock request off */
+ #define  BCMA_CLKCTLST_EXTRESREQ	0x00000700 /* Mask of external resource requests */
++#define  BCMA_CLKCTLST_EXTRESREQ_SHIFT	8
+ #define  BCMA_CLKCTLST_HAVEALP		0x00010000 /* ALP available */
+ #define  BCMA_CLKCTLST_HAVEHT		0x00020000 /* HT available */
+ #define  BCMA_CLKCTLST_BP_ON_ALP	0x00040000 /* RO: running on ALP clock */
+ #define  BCMA_CLKCTLST_BP_ON_HT		0x00080000 /* RO: running on HT clock */
+ #define  BCMA_CLKCTLST_EXTRESST		0x07000000 /* Mask of external resource status */
++#define  BCMA_CLKCTLST_EXTRESST_SHIFT	24
+ /* Is there any BCM4328 on BCMA bus? */
+ #define  BCMA_CLKCTLST_4328A0_HAVEHT	0x00010000 /* 4328a0 has reversed bits */
+ #define  BCMA_CLKCTLST_4328A0_HAVEALP	0x00020000 /* 4328a0 has reversed bits */
+@@ -56,4 +58,36 @@
+ #define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
+ #define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
+ 
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_FLASH1			0x1fc00000	/* MIPS Flash Region 1 */
++#define BCMA_SOC_FLASH1_SZ		0x00400000	/* MIPS Size of Flash Region 1 */
++#define BCMA_SOC_FLASH2			0x1c000000	/* Flash Region 2 (region 1 shadowed here) */
++#define BCMA_SOC_FLASH2_SZ		0x02000000	/* Size of Flash Region 2 */
++
+ #endif /* LINUX_BCMA_REGS_H_ */
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -4618,7 +4618,7 @@ static int b43_wireless_core_init(struct
+ 	switch (dev->dev->bus_type) {
+ #ifdef CONFIG_B43_BCMA
+ 	case B43_BUS_BCMA:
+-		bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci,
++		bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci[0],
+ 				      dev->dev->bdev, true);
+ 		break;
+ #endif
+--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
+@@ -533,7 +533,7 @@ ai_buscore_setup(struct si_info *sii, st
+ 
+ 	/* fixup necessary chip/core configurations */
+ 	if (!sii->pch) {
+-		sii->pch = pcicore_init(&sii->pub, sii->icbus->drv_pci.core);
++		sii->pch = pcicore_init(&sii->pub, sii->icbus->drv_pci[0].core);
+ 		if (sii->pch == NULL)
+ 			return false;
+ 	}
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/040-Controlled-Delay-AQM.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/040-Controlled-Delay-AQM.patch.svn-base
new file mode 100644
index 0000000..85f563b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/040-Controlled-Delay-AQM.patch.svn-base
@@ -0,0 +1,757 @@
+From a93fd80d261f1dc2788442dba8dd5701363d3d6e Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 10 May 2012 07:51:25 +0000
+Subject: [PATCH] codel: Controlled Delay AQM
+
+commit 76e3cc126bb223013a6b9a0e2a51238d1ef2e409 upstream.
+
+An implementation of CoDel AQM, from Kathleen Nichols and Van Jacobson.
+
+http://queue.acm.org/detail.cfm?id=2209336
+
+This AQM main input is no longer queue size in bytes or packets, but the
+delay packets stay in (FIFO) queue.
+
+As we don't have infinite memory, we still can drop packets in enqueue()
+in case of massive load, but mean of CoDel is to drop packets in
+dequeue(), using a control law based on two simple parameters :
+
+target : target sojourn time (default 5ms)
+interval : width of moving time window (default 100ms)
+
+Based on initial work from Dave Taht.
+
+Refactored to help future codel inclusion as a plugin for other linux
+qdisc (FQ_CODEL, ...), like RED.
+
+include/net/codel.h contains codel algorithm as close as possible than
+Kathleen reference.
+
+net/sched/sch_codel.c contains the linux qdisc specific glue.
+
+Separate structures permit a memory efficient implementation of fq_codel
+(to be sent as a separate work) : Each flow has its own struct
+codel_vars.
+
+timestamps are taken at enqueue() time with 1024 ns precision, allowing
+a range of 2199 seconds in queue, and 100Gb links support. iproute2 uses
+usec as base unit.
+
+Selected packets are dropped, unless ECN is enabled and packets can get
+ECN mark instead.
+
+Tested from 2Mb to 10Gb speeds with no particular problems, on ixgbe and
+tg3 drivers (BQL enabled).
+
+Usage: tc qdisc ... codel [ limit PACKETS ] [ target TIME ]
+                          [ interval TIME ] [ ecn ]
+
+qdisc codel 10: parent 1:1 limit 2000p target 3.0ms interval 60.0ms ecn
+ Sent 13347099587 bytes 8815805 pkt (dropped 0, overlimits 0 requeues 0)
+ rate 202365Kbit 16708pps backlog 113550b 75p requeues 0
+  count 116 lastcount 98 ldelay 4.3ms dropping drop_next 816us
+  maxpacket 1514 ecn_mark 84399 drop_overlimit 0
+
+CoDel must be seen as a base module, and should be used keeping in mind
+there is still a FIFO queue. So a typical setup will probably need a
+hierarchy of several qdiscs and packet classifiers to be able to meet
+whatever constraints a user might have.
+
+One possible example would be to use fq_codel, which combines Fair
+Queueing and CoDel, in replacement of sfq / sfq_red.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Dave Taht <dave.taht@bufferbloat.net>
+Cc: Kathleen Nichols <nichols@pollere.com>
+Cc: Van Jacobson <van@pollere.net>
+Cc: Tom Herbert <therbert@google.com>
+Cc: Matt Mathis <mattmathis@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/pkt_sched.h |   26 ++++
+ include/net/codel.h       |  332 +++++++++++++++++++++++++++++++++++++++++++++
+ net/sched/Kconfig         |   11 ++
+ net/sched/Makefile        |    1 +
+ net/sched/sch_codel.c     |  275 +++++++++++++++++++++++++++++++++++++
+ 5 files changed, 645 insertions(+)
+ create mode 100644 include/net/codel.h
+ create mode 100644 net/sched/sch_codel.c
+
+--- a/include/linux/pkt_sched.h
++++ b/include/linux/pkt_sched.h
+@@ -633,4 +633,30 @@ struct tc_qfq_stats {
+ 	__u32 lmax;
+ };
+ 
++/* CODEL */
++
++enum {
++	TCA_CODEL_UNSPEC,
++	TCA_CODEL_TARGET,
++	TCA_CODEL_LIMIT,
++	TCA_CODEL_INTERVAL,
++	TCA_CODEL_ECN,
++	__TCA_CODEL_MAX
++};
++
++#define TCA_CODEL_MAX	(__TCA_CODEL_MAX - 1)
++
++struct tc_codel_xstats {
++	__u32	maxpacket; /* largest packet we've seen so far */
++	__u32	count;	   /* how many drops we've done since the last time we
++			    * entered dropping state
++			    */
++	__u32	lastcount; /* count at entry to dropping state */
++	__u32	ldelay;    /* in-queue delay seen by most recently dequeued packet */
++	__s32	drop_next; /* time to drop next packet */
++	__u32	drop_overlimit; /* number of time max qdisc packet limit was hit */
++	__u32	ecn_mark;  /* number of packets we ECN marked instead of dropped */
++	__u32	dropping;  /* are we in dropping state ? */
++};
++
+ #endif
+--- /dev/null
++++ b/include/net/codel.h
+@@ -0,0 +1,332 @@
++#ifndef __NET_SCHED_CODEL_H
++#define __NET_SCHED_CODEL_H
++
++/*
++ * Codel - The Controlled-Delay Active Queue Management algorithm
++ *
++ *  Copyright (C) 2011-2012 Kathleen Nichols <nichols@pollere.com>
++ *  Copyright (C) 2011-2012 Van Jacobson <van@pollere.net>
++ *  Copyright (C) 2012 Michael D. Taht <dave.taht@bufferbloat.net>
++ *  Copyright (C) 2012 Eric Dumazet <edumazet@google.com>
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the authors may not be used to endorse or promote products
++ *    derived from this software without specific prior written permission.
++ *
++ * Alternatively, provided that this notice is retained in full, this
++ * software may be distributed under the terms of the GNU General
++ * Public License ("GPL") version 2, in which case the provisions of the
++ * GPL apply INSTEAD OF those given above.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ *
++ */
++
++#include <linux/types.h>
++#include <linux/ktime.h>
++#include <linux/skbuff.h>
++#include <net/pkt_sched.h>
++#include <net/inet_ecn.h>
++
++/* Controlling Queue Delay (CoDel) algorithm
++ * =========================================
++ * Source : Kathleen Nichols and Van Jacobson
++ * http://queue.acm.org/detail.cfm?id=2209336
++ *
++ * Implemented on linux by Dave Taht and Eric Dumazet
++ */
++
++
++/* CoDel uses a 1024 nsec clock, encoded in u32
++ * This gives a range of 2199 seconds, because of signed compares
++ */
++typedef u32 codel_time_t;
++typedef s32 codel_tdiff_t;
++#define CODEL_SHIFT 10
++#define MS2TIME(a) ((a * NSEC_PER_MSEC) >> CODEL_SHIFT)
++
++static inline codel_time_t codel_get_time(void)
++{
++	u64 ns = ktime_to_ns(ktime_get());
++
++	return ns >> CODEL_SHIFT;
++}
++
++#define codel_time_after(a, b)		((s32)(a) - (s32)(b) > 0)
++#define codel_time_after_eq(a, b)	((s32)(a) - (s32)(b) >= 0)
++#define codel_time_before(a, b)		((s32)(a) - (s32)(b) < 0)
++#define codel_time_before_eq(a, b)	((s32)(a) - (s32)(b) <= 0)
++
++/* Qdiscs using codel plugin must use codel_skb_cb in their own cb[] */
++struct codel_skb_cb {
++	codel_time_t enqueue_time;
++};
++
++static struct codel_skb_cb *get_codel_cb(const struct sk_buff *skb)
++{
++	qdisc_cb_private_validate(skb, sizeof(struct codel_skb_cb));
++	return (struct codel_skb_cb *)qdisc_skb_cb(skb)->data;
++}
++
++static codel_time_t codel_get_enqueue_time(const struct sk_buff *skb)
++{
++	return get_codel_cb(skb)->enqueue_time;
++}
++
++static void codel_set_enqueue_time(struct sk_buff *skb)
++{
++	get_codel_cb(skb)->enqueue_time = codel_get_time();
++}
++
++static inline u32 codel_time_to_us(codel_time_t val)
++{
++	u64 valns = ((u64)val << CODEL_SHIFT);
++
++	do_div(valns, NSEC_PER_USEC);
++	return (u32)valns;
++}
++
++/**
++ * struct codel_params - contains codel parameters
++ * @target:	target queue size (in time units)
++ * @interval:	width of moving time window
++ * @ecn:	is Explicit Congestion Notification enabled
++ */
++struct codel_params {
++	codel_time_t	target;
++	codel_time_t	interval;
++	bool		ecn;
++};
++
++/**
++ * struct codel_vars - contains codel variables
++ * @count:		how many drops we've done since the last time we
++ *			entered dropping state
++ * @lastcount:		count at entry to dropping state
++ * @dropping:		set to true if in dropping state
++ * @first_above_time:	when we went (or will go) continuously above target
++ *			for interval
++ * @drop_next:		time to drop next packet, or when we dropped last
++ * @ldelay:		sojourn time of last dequeued packet
++ */
++struct codel_vars {
++	u32		count;
++	u32		lastcount;
++	bool		dropping;
++	codel_time_t	first_above_time;
++	codel_time_t	drop_next;
++	codel_time_t	ldelay;
++};
++
++/**
++ * struct codel_stats - contains codel shared variables and stats
++ * @maxpacket:	largest packet we've seen so far
++ * @drop_count:	temp count of dropped packets in dequeue()
++ * ecn_mark:	number of packets we ECN marked instead of dropping
++ */
++struct codel_stats {
++	u32		maxpacket;
++	u32		drop_count;
++	u32		ecn_mark;
++};
++
++static void codel_params_init(struct codel_params *params)
++{
++	params->interval = MS2TIME(100);
++	params->target = MS2TIME(5);
++	params->ecn = false;
++}
++
++static void codel_vars_init(struct codel_vars *vars)
++{
++	vars->drop_next = 0;
++	vars->first_above_time = 0;
++	vars->dropping = false; /* exit dropping state */
++	vars->count = 0;
++	vars->lastcount = 0;
++}
++
++static void codel_stats_init(struct codel_stats *stats)
++{
++	stats->maxpacket = 256;
++}
++
++/* return interval/sqrt(x) with good precision
++ * relies on int_sqrt(unsigned long x) kernel implementation
++ */
++static u32 codel_inv_sqrt(u32 _interval, u32 _x)
++{
++	u64 interval = _interval;
++	unsigned long x = _x;
++
++	/* Scale operands for max precision */
++
++#if BITS_PER_LONG == 64
++	x <<= 32; /* On 64bit arches, we can prescale x by 32bits */
++	interval <<= 16;
++#endif
++
++	while (x < (1UL << (BITS_PER_LONG - 2))) {
++		x <<= 2;
++		interval <<= 1;
++	}
++	do_div(interval, int_sqrt(x));
++	return (u32)interval;
++}
++
++static codel_time_t codel_control_law(codel_time_t t,
++				      codel_time_t interval,
++				      u32 count)
++{
++	return t + codel_inv_sqrt(interval, count);
++}
++
++
++static bool codel_should_drop(struct sk_buff *skb,
++			      unsigned int *backlog,
++			      struct codel_vars *vars,
++			      struct codel_params *params,
++			      struct codel_stats *stats,
++			      codel_time_t now)
++{
++	bool ok_to_drop;
++
++	if (!skb) {
++		vars->first_above_time = 0;
++		return false;
++	}
++
++	vars->ldelay = now - codel_get_enqueue_time(skb);
++	*backlog -= qdisc_pkt_len(skb);
++
++	if (unlikely(qdisc_pkt_len(skb) > stats->maxpacket))
++		stats->maxpacket = qdisc_pkt_len(skb);
++
++	if (codel_time_before(vars->ldelay, params->target) ||
++	    *backlog <= stats->maxpacket) {
++		/* went below - stay below for at least interval */
++		vars->first_above_time = 0;
++		return false;
++	}
++	ok_to_drop = false;
++	if (vars->first_above_time == 0) {
++		/* just went above from below. If we stay above
++		 * for at least interval we'll say it's ok to drop
++		 */
++		vars->first_above_time = now + params->interval;
++	} else if (codel_time_after(now, vars->first_above_time)) {
++		ok_to_drop = true;
++	}
++	return ok_to_drop;
++}
++
++typedef struct sk_buff * (*codel_skb_dequeue_t)(struct codel_vars *vars,
++						struct Qdisc *sch);
++
++static struct sk_buff *codel_dequeue(struct Qdisc *sch,
++				     struct codel_params *params,
++				     struct codel_vars *vars,
++				     struct codel_stats *stats,
++				     codel_skb_dequeue_t dequeue_func,
++				     u32 *backlog)
++{
++	struct sk_buff *skb = dequeue_func(vars, sch);
++	codel_time_t now;
++	bool drop;
++
++	if (!skb) {
++		vars->dropping = false;
++		return skb;
++	}
++	now = codel_get_time();
++	drop = codel_should_drop(skb, backlog, vars, params, stats, now);
++	if (vars->dropping) {
++		if (!drop) {
++			/* sojourn time below target - leave dropping state */
++			vars->dropping = false;
++		} else if (codel_time_after_eq(now, vars->drop_next)) {
++			/* It's time for the next drop. Drop the current
++			 * packet and dequeue the next. The dequeue might
++			 * take us out of dropping state.
++			 * If not, schedule the next drop.
++			 * A large backlog might result in drop rates so high
++			 * that the next drop should happen now,
++			 * hence the while loop.
++			 */
++			while (vars->dropping &&
++			       codel_time_after_eq(now, vars->drop_next)) {
++				if (++vars->count == 0) /* avoid zero divides */
++					vars->count = ~0U;
++				if (params->ecn && INET_ECN_set_ce(skb)) {
++					stats->ecn_mark++;
++					vars->drop_next =
++						codel_control_law(vars->drop_next,
++								  params->interval,
++								  vars->count);
++					goto end;
++				}
++				qdisc_drop(skb, sch);
++				stats->drop_count++;
++				skb = dequeue_func(vars, sch);
++				if (!codel_should_drop(skb, backlog,
++						       vars, params, stats, now)) {
++					/* leave dropping state */
++					vars->dropping = false;
++				} else {
++					/* and schedule the next drop */
++					vars->drop_next =
++						codel_control_law(vars->drop_next,
++								  params->interval,
++								  vars->count);
++				}
++			}
++		}
++	} else if (drop) {
++		if (params->ecn && INET_ECN_set_ce(skb)) {
++			stats->ecn_mark++;
++		} else {
++			qdisc_drop(skb, sch);
++			stats->drop_count++;
++
++			skb = dequeue_func(vars, sch);
++			drop = codel_should_drop(skb, backlog, vars, params,
++						 stats, now);
++		}
++		vars->dropping = true;
++		/* if min went above target close to when we last went below it
++		 * assume that the drop rate that controlled the queue on the
++		 * last cycle is a good starting point to control it now.
++		 */
++		if (codel_time_before(now - vars->drop_next,
++				      16 * params->interval)) {
++			vars->count = (vars->count - vars->lastcount) | 1;
++		} else {
++			vars->count = 1;
++		}
++		vars->lastcount = vars->count;
++		vars->drop_next = codel_control_law(now, params->interval,
++						    vars->count);
++	}
++end:
++	return skb;
++}
++#endif
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -250,6 +250,17 @@ config NET_SCH_QFQ
+ 
+ 	  If unsure, say N.
+ 
++config NET_SCH_CODEL
++	tristate "Controlled Delay AQM (CODEL)"
++	help
++	  Say Y here if you want to use the Controlled Delay (CODEL)
++	  packet scheduling algorithm.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called sch_codel.
++
++	  If unsure, say N.
++
+ config NET_SCH_INGRESS
+ 	tristate "Ingress Qdisc"
+ 	depends on NET_CLS_ACT
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -36,6 +36,7 @@ obj-$(CONFIG_NET_SCH_DRR)	+= sch_drr.o
+ obj-$(CONFIG_NET_SCH_MQPRIO)	+= sch_mqprio.o
+ obj-$(CONFIG_NET_SCH_CHOKE)	+= sch_choke.o
+ obj-$(CONFIG_NET_SCH_QFQ)	+= sch_qfq.o
++obj-$(CONFIG_NET_SCH_CODEL)	+= sch_codel.o
+ 
+ obj-$(CONFIG_NET_CLS_U32)	+= cls_u32.o
+ obj-$(CONFIG_NET_CLS_ROUTE4)	+= cls_route.o
+--- /dev/null
++++ b/net/sched/sch_codel.c
+@@ -0,0 +1,275 @@
++/*
++ * Codel - The Controlled-Delay Active Queue Management algorithm
++ *
++ *  Copyright (C) 2011-2012 Kathleen Nichols <nichols@pollere.com>
++ *  Copyright (C) 2011-2012 Van Jacobson <van@pollere.net>
++ *
++ *  Implemented on linux by :
++ *  Copyright (C) 2012 Michael D. Taht <dave.taht@bufferbloat.net>
++ *  Copyright (C) 2012 Eric Dumazet <edumazet@google.com>
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the authors may not be used to endorse or promote products
++ *    derived from this software without specific prior written permission.
++ *
++ * Alternatively, provided that this notice is retained in full, this
++ * software may be distributed under the terms of the GNU General
++ * Public License ("GPL") version 2, in which case the provisions of the
++ * GPL apply INSTEAD OF those given above.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/skbuff.h>
++#include <net/pkt_sched.h>
++#include <net/codel.h>
++
++
++#define DEFAULT_CODEL_LIMIT 1000
++
++struct codel_sched_data {
++	struct codel_params	params;
++	struct codel_vars	vars;
++	struct codel_stats	stats;
++	u32			drop_overlimit;
++};
++
++/* This is the specific function called from codel_dequeue()
++ * to dequeue a packet from queue. Note: backlog is handled in
++ * codel, we dont need to reduce it here.
++ */
++static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch)
++{
++	struct sk_buff *skb = __skb_dequeue(&sch->q);
++
++	prefetch(&skb->end); /* we'll need skb_shinfo() */
++	return skb;
++}
++
++static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++	struct sk_buff *skb;
++
++	skb = codel_dequeue(sch, &q->params, &q->vars, &q->stats,
++			    dequeue, &sch->qstats.backlog);
++	/* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
++	 * or HTB crashes. Defer it for next round.
++	 */
++	if (q->stats.drop_count && sch->q.qlen) {
++		qdisc_tree_decrease_qlen(sch, q->stats.drop_count);
++		q->stats.drop_count = 0;
++	}
++	if (skb)
++		qdisc_bstats_update(sch, skb);
++	return skb;
++}
++
++static int codel_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
++{
++	struct codel_sched_data *q;
++
++	if (likely(qdisc_qlen(sch) < sch->limit)) {
++		codel_set_enqueue_time(skb);
++		return qdisc_enqueue_tail(skb, sch);
++	}
++	q = qdisc_priv(sch);
++	q->drop_overlimit++;
++	return qdisc_drop(skb, sch);
++}
++
++static const struct nla_policy codel_policy[TCA_CODEL_MAX + 1] = {
++	[TCA_CODEL_TARGET]	= { .type = NLA_U32 },
++	[TCA_CODEL_LIMIT]	= { .type = NLA_U32 },
++	[TCA_CODEL_INTERVAL]	= { .type = NLA_U32 },
++	[TCA_CODEL_ECN]		= { .type = NLA_U32 },
++};
++
++static int codel_change(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++	struct nlattr *tb[TCA_CODEL_MAX + 1];
++	unsigned int qlen;
++	int err;
++
++	if (!opt)
++		return -EINVAL;
++
++	err = nla_parse_nested(tb, TCA_CODEL_MAX, opt, codel_policy);
++	if (err < 0)
++		return err;
++
++	sch_tree_lock(sch);
++
++	if (tb[TCA_CODEL_TARGET]) {
++		u32 target = nla_get_u32(tb[TCA_CODEL_TARGET]);
++
++		q->params.target = ((u64)target * NSEC_PER_USEC) >> CODEL_SHIFT;
++	}
++
++	if (tb[TCA_CODEL_INTERVAL]) {
++		u32 interval = nla_get_u32(tb[TCA_CODEL_INTERVAL]);
++
++		q->params.interval = ((u64)interval * NSEC_PER_USEC) >> CODEL_SHIFT;
++	}
++
++	if (tb[TCA_CODEL_LIMIT])
++		sch->limit = nla_get_u32(tb[TCA_CODEL_LIMIT]);
++
++	if (tb[TCA_CODEL_ECN])
++		q->params.ecn = !!nla_get_u32(tb[TCA_CODEL_ECN]);
++
++	qlen = sch->q.qlen;
++	while (sch->q.qlen > sch->limit) {
++		struct sk_buff *skb = __skb_dequeue(&sch->q);
++
++		sch->qstats.backlog -= qdisc_pkt_len(skb);
++		qdisc_drop(skb, sch);
++	}
++	qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);
++
++	sch_tree_unlock(sch);
++	return 0;
++}
++
++static int codel_init(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++
++	sch->limit = DEFAULT_CODEL_LIMIT;
++
++	codel_params_init(&q->params);
++	codel_vars_init(&q->vars);
++	codel_stats_init(&q->stats);
++
++	if (opt) {
++		int err = codel_change(sch, opt);
++
++		if (err)
++			return err;
++	}
++
++	if (sch->limit >= 1)
++		sch->flags |= TCQ_F_CAN_BYPASS;
++	else
++		sch->flags &= ~TCQ_F_CAN_BYPASS;
++
++	return 0;
++}
++
++static int codel_dump(struct Qdisc *sch, struct sk_buff *skb)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++	struct nlattr *opts;
++
++	opts = nla_nest_start(skb, TCA_OPTIONS);
++	if (opts == NULL)
++		goto nla_put_failure;
++
++	if (nla_put_u32(skb, TCA_CODEL_TARGET,
++			codel_time_to_us(q->params.target)) ||
++	    nla_put_u32(skb, TCA_CODEL_LIMIT,
++			sch->limit) ||
++	    nla_put_u32(skb, TCA_CODEL_INTERVAL,
++			codel_time_to_us(q->params.interval)) ||
++	    nla_put_u32(skb, TCA_CODEL_ECN,
++			q->params.ecn))
++		goto nla_put_failure;
++
++	return nla_nest_end(skb, opts);
++
++nla_put_failure:
++	nla_nest_cancel(skb, opts);
++	return -1;
++}
++
++static int codel_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
++{
++	const struct codel_sched_data *q = qdisc_priv(sch);
++	struct tc_codel_xstats st = {
++		.maxpacket	= q->stats.maxpacket,
++		.count		= q->vars.count,
++		.lastcount	= q->vars.lastcount,
++		.drop_overlimit = q->drop_overlimit,
++		.ldelay		= codel_time_to_us(q->vars.ldelay),
++		.dropping	= q->vars.dropping,
++		.ecn_mark	= q->stats.ecn_mark,
++	};
++
++	if (q->vars.dropping) {
++		codel_tdiff_t delta = q->vars.drop_next - codel_get_time();
++
++		if (delta >= 0)
++			st.drop_next = codel_time_to_us(delta);
++		else
++			st.drop_next = -codel_time_to_us(-delta);
++	}
++
++	return gnet_stats_copy_app(d, &st, sizeof(st));
++}
++
++static void codel_reset(struct Qdisc *sch)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++
++	qdisc_reset_queue(sch);
++	codel_vars_init(&q->vars);
++}
++
++static struct Qdisc_ops codel_qdisc_ops __read_mostly = {
++	.id		=	"codel",
++	.priv_size	=	sizeof(struct codel_sched_data),
++
++	.enqueue	=	codel_qdisc_enqueue,
++	.dequeue	=	codel_qdisc_dequeue,
++	.peek		=	qdisc_peek_dequeued,
++	.init		=	codel_init,
++	.reset		=	codel_reset,
++	.change 	=	codel_change,
++	.dump		=	codel_dump,
++	.dump_stats	=	codel_dump_stats,
++	.owner		=	THIS_MODULE,
++};
++
++static int __init codel_module_init(void)
++{
++	return register_qdisc(&codel_qdisc_ops);
++}
++
++static void __exit codel_module_exit(void)
++{
++	unregister_qdisc(&codel_qdisc_ops);
++}
++
++module_init(codel_module_init)
++module_exit(codel_module_exit)
++
++MODULE_DESCRIPTION("Controlled Delay queue discipline");
++MODULE_AUTHOR("Dave Taht");
++MODULE_AUTHOR("Eric Dumazet");
++MODULE_LICENSE("Dual BSD/GPL");
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/041-codel-use-Newton-method-instead-of-sqrt-and-divides.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/041-codel-use-Newton-method-instead-of-sqrt-and-divides.patch.svn-base
new file mode 100644
index 0000000..f91b42e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/041-codel-use-Newton-method-instead-of-sqrt-and-divides.patch.svn-base
@@ -0,0 +1,185 @@
+From 4a8056dfeef49b306ad6af24a5563d7d6867aae0 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 12 May 2012 03:32:13 +0000
+Subject: [PATCH] codel: use Newton method instead of sqrt() and divides
+
+commit 536edd67109df5e0cdb2c4ee759e9bade7976367 upstream.
+
+As Van pointed out, interval/sqrt(count) can be implemented using
+multiplies only.
+
+http://en.wikipedia.org/wiki/Methods_of_computing_square_roots#Iterative_methods_for_reciprocal_square_roots
+
+This patch implements the Newton method and reciprocal divide.
+
+Total cost is 15 cycles instead of 120 on my Corei5 machine (64bit
+kernel).
+
+There is a small 'error' for count values < 5, but we don't really care.
+
+I reuse a hole in struct codel_vars :
+ - pack the dropping boolean into one bit
+ - use 31bit to store the reciprocal value of sqrt(count).
+
+Suggested-by: Van Jacobson <van@pollere.net>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Dave Taht <dave.taht@bufferbloat.net>
+Cc: Kathleen Nichols <nichols@pollere.com>
+Cc: Tom Herbert <therbert@google.com>
+Cc: Matt Mathis <mattmathis@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: Nandita Dukkipati <nanditad@google.com>
+Cc: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/codel.h |   68 ++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 37 insertions(+), 31 deletions(-)
+
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -46,6 +46,7 @@
+ #include <linux/skbuff.h>
+ #include <net/pkt_sched.h>
+ #include <net/inet_ecn.h>
++#include <linux/reciprocal_div.h>
+ 
+ /* Controlling Queue Delay (CoDel) algorithm
+  * =========================================
+@@ -123,6 +124,7 @@ struct codel_params {
+  *			entered dropping state
+  * @lastcount:		count at entry to dropping state
+  * @dropping:		set to true if in dropping state
++ * @rec_inv_sqrt:	reciprocal value of sqrt(count) >> 1
+  * @first_above_time:	when we went (or will go) continuously above target
+  *			for interval
+  * @drop_next:		time to drop next packet, or when we dropped last
+@@ -131,7 +133,8 @@ struct codel_params {
+ struct codel_vars {
+ 	u32		count;
+ 	u32		lastcount;
+-	bool		dropping;
++	bool		dropping:1;
++	u32		rec_inv_sqrt:31;
+ 	codel_time_t	first_above_time;
+ 	codel_time_t	drop_next;
+ 	codel_time_t	ldelay;
+@@ -158,11 +161,7 @@ static void codel_params_init(struct cod
+ 
+ static void codel_vars_init(struct codel_vars *vars)
+ {
+-	vars->drop_next = 0;
+-	vars->first_above_time = 0;
+-	vars->dropping = false; /* exit dropping state */
+-	vars->count = 0;
+-	vars->lastcount = 0;
++	memset(vars, 0, sizeof(*vars));
+ }
+ 
+ static void codel_stats_init(struct codel_stats *stats)
+@@ -170,38 +169,37 @@ static void codel_stats_init(struct code
+ 	stats->maxpacket = 256;
+ }
+ 
+-/* return interval/sqrt(x) with good precision
+- * relies on int_sqrt(unsigned long x) kernel implementation
++/*
++ * http://en.wikipedia.org/wiki/Methods_of_computing_square_roots#Iterative_methods_for_reciprocal_square_roots
++ * new_invsqrt = (invsqrt / 2) * (3 - count * invsqrt^2)
++ *
++ * Here, invsqrt is a fixed point number (< 1.0), 31bit mantissa)
+  */
+-static u32 codel_inv_sqrt(u32 _interval, u32 _x)
++static void codel_Newton_step(struct codel_vars *vars)
+ {
+-	u64 interval = _interval;
+-	unsigned long x = _x;
+-
+-	/* Scale operands for max precision */
++	u32 invsqrt = vars->rec_inv_sqrt;
++	u32 invsqrt2 = ((u64)invsqrt * invsqrt) >> 31;
++	u64 val = (3LL << 31) - ((u64)vars->count * invsqrt2);
+ 
+-#if BITS_PER_LONG == 64
+-	x <<= 32; /* On 64bit arches, we can prescale x by 32bits */
+-	interval <<= 16;
+-#endif
++	val = (val * invsqrt) >> 32;
+ 
+-	while (x < (1UL << (BITS_PER_LONG - 2))) {
+-		x <<= 2;
+-		interval <<= 1;
+-	}
+-	do_div(interval, int_sqrt(x));
+-	return (u32)interval;
++	vars->rec_inv_sqrt = val;
+ }
+ 
++/*
++ * CoDel control_law is t + interval/sqrt(count)
++ * We maintain in rec_inv_sqrt the reciprocal value of sqrt(count) to avoid
++ * both sqrt() and divide operation.
++ */
+ static codel_time_t codel_control_law(codel_time_t t,
+ 				      codel_time_t interval,
+-				      u32 count)
++				      u32 rec_inv_sqrt)
+ {
+-	return t + codel_inv_sqrt(interval, count);
++	return t + reciprocal_divide(interval, rec_inv_sqrt << 1);
+ }
+ 
+ 
+-static bool codel_should_drop(struct sk_buff *skb,
++static bool codel_should_drop(const struct sk_buff *skb,
+ 			      unsigned int *backlog,
+ 			      struct codel_vars *vars,
+ 			      struct codel_params *params,
+@@ -274,14 +272,16 @@ static struct sk_buff *codel_dequeue(str
+ 			 */
+ 			while (vars->dropping &&
+ 			       codel_time_after_eq(now, vars->drop_next)) {
+-				if (++vars->count == 0) /* avoid zero divides */
+-					vars->count = ~0U;
++				vars->count++; /* dont care of possible wrap
++						* since there is no more divide
++						*/
++				codel_Newton_step(vars);
+ 				if (params->ecn && INET_ECN_set_ce(skb)) {
+ 					stats->ecn_mark++;
+ 					vars->drop_next =
+ 						codel_control_law(vars->drop_next,
+ 								  params->interval,
+-								  vars->count);
++								  vars->rec_inv_sqrt);
+ 					goto end;
+ 				}
+ 				qdisc_drop(skb, sch);
+@@ -296,7 +296,7 @@ static struct sk_buff *codel_dequeue(str
+ 					vars->drop_next =
+ 						codel_control_law(vars->drop_next,
+ 								  params->interval,
+-								  vars->count);
++								  vars->rec_inv_sqrt);
+ 				}
+ 			}
+ 		}
+@@ -319,12 +319,18 @@ static struct sk_buff *codel_dequeue(str
+ 		if (codel_time_before(now - vars->drop_next,
+ 				      16 * params->interval)) {
+ 			vars->count = (vars->count - vars->lastcount) | 1;
++			/* we dont care if rec_inv_sqrt approximation
++			 * is not very precise :
++			 * Next Newton steps will correct it quadratically.
++			 */
++			codel_Newton_step(vars);
+ 		} else {
+ 			vars->count = 1;
++			vars->rec_inv_sqrt = 0x7fffffff;
+ 		}
+ 		vars->lastcount = vars->count;
+ 		vars->drop_next = codel_control_law(now, params->interval,
+-						    vars->count);
++						    vars->rec_inv_sqrt);
+ 	}
+ end:
+ 	return skb;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/042-fq_codel-Fair-Queue-Codel-AQM.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/042-fq_codel-Fair-Queue-Codel-AQM.patch.svn-base
new file mode 100644
index 0000000..26bbbcb
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/042-fq_codel-Fair-Queue-Codel-AQM.patch.svn-base
@@ -0,0 +1,839 @@
+From f8cf19c19528a468cc0b9846c0328a94cccdc605 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 11 May 2012 09:30:50 +0000
+Subject: [PATCH] fq_codel: Fair Queue Codel AQM
+
+commit 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe upstream.
+
+Fair Queue Codel packet scheduler
+
+Principles :
+
+- Packets are classified (internal classifier or external) on flows.
+- This is a Stochastic model (as we use a hash, several flows might
+                              be hashed on same slot)
+- Each flow has a CoDel managed queue.
+- Flows are linked onto two (Round Robin) lists,
+  so that new flows have priority on old ones.
+
+- For a given flow, packets are not reordered (CoDel uses a FIFO)
+- head drops only.
+- ECN capability is on by default.
+- Very low memory footprint (64 bytes per flow)
+
+tc qdisc ... fq_codel [ limit PACKETS ] [ flows number ]
+                      [ target TIME ] [ interval TIME ] [ noecn ]
+                      [ quantum BYTES ]
+
+defaults : 1024 flows, 10240 packets limit, quantum : device MTU
+           target : 5ms (CoDel default)
+           interval : 100ms (CoDel default)
+
+Impressive results on load :
+
+class htb 1:1 root leaf 10: prio 0 quantum 1514 rate 200000Kbit ceil 200000Kbit burst 1475b/8 mpu 0b overhead 0b cburst 1475b/8 mpu 0b overhead 0b level 0
+ Sent 43304920109 bytes 33063109 pkt (dropped 0, overlimits 0 requeues 0)
+ rate 201691Kbit 28595pps backlog 0b 312p requeues 0
+ lended: 33063109 borrowed: 0 giants: 0
+ tokens: -912 ctokens: -912
+
+class fq_codel 10:1735 parent 10:
+ (dropped 1292, overlimits 0 requeues 0)
+ backlog 15140b 10p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+class fq_codel 10:4524 parent 10:
+ (dropped 1291, overlimits 0 requeues 0)
+ backlog 16654b 11p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+class fq_codel 10:4e74 parent 10:
+ (dropped 1290, overlimits 0 requeues 0)
+ backlog 6056b 4p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 6.4ms dropping drop_next 92.0ms
+class fq_codel 10:628a parent 10:
+ (dropped 1289, overlimits 0 requeues 0)
+ backlog 7570b 5p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 5.4ms dropping drop_next 90.9ms
+class fq_codel 10:a4b3 parent 10:
+ (dropped 302, overlimits 0 requeues 0)
+ backlog 16654b 11p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+class fq_codel 10:c3c2 parent 10:
+ (dropped 1284, overlimits 0 requeues 0)
+ backlog 13626b 9p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 5.9ms
+class fq_codel 10:d331 parent 10:
+ (dropped 299, overlimits 0 requeues 0)
+ backlog 15140b 10p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.0ms
+class fq_codel 10:d526 parent 10:
+ (dropped 12160, overlimits 0 requeues 0)
+ backlog 35870b 211p requeues 0
+  deficit 1508 count 12160 lastcount 1 ldelay 15.3ms dropping drop_next 247us
+class fq_codel 10:e2c6 parent 10:
+ (dropped 1288, overlimits 0 requeues 0)
+ backlog 15140b 10p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+class fq_codel 10:eab5 parent 10:
+ (dropped 1285, overlimits 0 requeues 0)
+ backlog 16654b 11p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 5.9ms
+class fq_codel 10:f220 parent 10:
+ (dropped 1289, overlimits 0 requeues 0)
+ backlog 15140b 10p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+
+qdisc htb 1: root refcnt 6 r2q 10 default 1 direct_packets_stat 0 ver 3.17
+ Sent 43331086547 bytes 33092812 pkt (dropped 0, overlimits 66063544 requeues 71)
+ rate 201697Kbit 28602pps backlog 0b 260p requeues 71
+qdisc fq_codel 10: parent 1:1 limit 10240p flows 65536 target 5.0ms interval 100.0ms ecn
+ Sent 43331086547 bytes 33092812 pkt (dropped 949359, overlimits 0 requeues 0)
+ rate 201697Kbit 28602pps backlog 189352b 260p requeues 0
+  maxpacket 1514 drop_overlimit 0 new_flow_count 5582 ecn_mark 125593
+  new_flows_len 0 old_flows_len 11
+
+PING 172.30.42.18 (172.30.42.18) 56(84) bytes of data.
+64 bytes from 172.30.42.18: icmp_req=1 ttl=64 time=0.227 ms
+64 bytes from 172.30.42.18: icmp_req=2 ttl=64 time=0.165 ms
+64 bytes from 172.30.42.18: icmp_req=3 ttl=64 time=0.166 ms
+64 bytes from 172.30.42.18: icmp_req=4 ttl=64 time=0.151 ms
+64 bytes from 172.30.42.18: icmp_req=5 ttl=64 time=0.164 ms
+64 bytes from 172.30.42.18: icmp_req=6 ttl=64 time=0.172 ms
+64 bytes from 172.30.42.18: icmp_req=7 ttl=64 time=0.175 ms
+64 bytes from 172.30.42.18: icmp_req=8 ttl=64 time=0.183 ms
+64 bytes from 172.30.42.18: icmp_req=9 ttl=64 time=0.158 ms
+64 bytes from 172.30.42.18: icmp_req=10 ttl=64 time=0.200 ms
+
+10 packets transmitted, 10 received, 0% packet loss, time 8999ms
+rtt min/avg/max/mdev = 0.151/0.176/0.227/0.022 ms
+
+Much better than SFQ because of priority given to new flows, and fast
+path dirtying less cache lines.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/pkt_sched.h |   54 ++++
+ net/sched/Kconfig         |   11 +
+ net/sched/Makefile        |    1 +
+ net/sched/sch_fq_codel.c  |  624 +++++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 690 insertions(+)
+ create mode 100644 net/sched/sch_fq_codel.c
+
+--- a/include/linux/pkt_sched.h
++++ b/include/linux/pkt_sched.h
+@@ -659,4 +659,58 @@ struct tc_codel_xstats {
+ 	__u32	dropping;  /* are we in dropping state ? */
+ };
+ 
++/* FQ_CODEL */
++
++enum {
++	TCA_FQ_CODEL_UNSPEC,
++	TCA_FQ_CODEL_TARGET,
++	TCA_FQ_CODEL_LIMIT,
++	TCA_FQ_CODEL_INTERVAL,
++	TCA_FQ_CODEL_ECN,
++	TCA_FQ_CODEL_FLOWS,
++	TCA_FQ_CODEL_QUANTUM,
++	__TCA_FQ_CODEL_MAX
++};
++
++#define TCA_FQ_CODEL_MAX	(__TCA_FQ_CODEL_MAX - 1)
++
++enum {
++	TCA_FQ_CODEL_XSTATS_QDISC,
++	TCA_FQ_CODEL_XSTATS_CLASS,
++};
++
++struct tc_fq_codel_qd_stats {
++	__u32	maxpacket;	/* largest packet we've seen so far */
++	__u32	drop_overlimit; /* number of time max qdisc
++				 * packet limit was hit
++				 */
++	__u32	ecn_mark;	/* number of packets we ECN marked
++				 * instead of being dropped
++				 */
++	__u32	new_flow_count; /* number of time packets
++				 * created a 'new flow'
++				 */
++	__u32	new_flows_len;	/* count of flows in new list */
++	__u32	old_flows_len;	/* count of flows in old list */
++};
++
++struct tc_fq_codel_cl_stats {
++	__s32	deficit;
++	__u32	ldelay;		/* in-queue delay seen by most recently
++				 * dequeued packet
++				 */
++	__u32	count;
++	__u32	lastcount;
++	__u32	dropping;
++	__s32	drop_next;
++};
++
++struct tc_fq_codel_xstats {
++	__u32	type;
++	union {
++		struct tc_fq_codel_qd_stats qdisc_stats;
++		struct tc_fq_codel_cl_stats class_stats;
++	};
++};
++
+ #endif
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -261,6 +261,17 @@ config NET_SCH_CODEL
+ 
+ 	  If unsure, say N.
+ 
++config NET_SCH_FQ_CODEL
++	tristate "Fair Queue Controlled Delay AQM (FQ_CODEL)"
++	help
++	  Say Y here if you want to use the FQ Controlled Delay (FQ_CODEL)
++	  packet scheduling algorithm.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called sch_fq_codel.
++
++	  If unsure, say N.
++
+ config NET_SCH_INGRESS
+ 	tristate "Ingress Qdisc"
+ 	depends on NET_CLS_ACT
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -37,6 +37,7 @@ obj-$(CONFIG_NET_SCH_MQPRIO)	+= sch_mqpr
+ obj-$(CONFIG_NET_SCH_CHOKE)	+= sch_choke.o
+ obj-$(CONFIG_NET_SCH_QFQ)	+= sch_qfq.o
+ obj-$(CONFIG_NET_SCH_CODEL)	+= sch_codel.o
++obj-$(CONFIG_NET_SCH_FQ_CODEL)	+= sch_fq_codel.o
+ 
+ obj-$(CONFIG_NET_CLS_U32)	+= cls_u32.o
+ obj-$(CONFIG_NET_CLS_ROUTE4)	+= cls_route.o
+--- /dev/null
++++ b/net/sched/sch_fq_codel.c
+@@ -0,0 +1,624 @@
++/*
++ * Fair Queue CoDel discipline
++ *
++ *	This program is free software; you can redistribute it and/or
++ *	modify it under the terms of the GNU General Public License
++ *	as published by the Free Software Foundation; either version
++ *	2 of the License, or (at your option) any later version.
++ *
++ *  Copyright (C) 2012 Eric Dumazet <edumazet@google.com>
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/jiffies.h>
++#include <linux/string.h>
++#include <linux/in.h>
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/skbuff.h>
++#include <linux/jhash.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <net/netlink.h>
++#include <net/pkt_sched.h>
++#include <net/flow_keys.h>
++#include <net/codel.h>
++
++/*	Fair Queue CoDel.
++ *
++ * Principles :
++ * Packets are classified (internal classifier or external) on flows.
++ * This is a Stochastic model (as we use a hash, several flows
++ *			       might be hashed on same slot)
++ * Each flow has a CoDel managed queue.
++ * Flows are linked onto two (Round Robin) lists,
++ * so that new flows have priority on old ones.
++ *
++ * For a given flow, packets are not reordered (CoDel uses a FIFO)
++ * head drops only.
++ * ECN capability is on by default.
++ * Low memory footprint (64 bytes per flow)
++ */
++
++struct fq_codel_flow {
++	struct sk_buff	  *head;
++	struct sk_buff	  *tail;
++	struct list_head  flowchain;
++	int		  deficit;
++	u32		  dropped; /* number of drops (or ECN marks) on this flow */
++	struct codel_vars cvars;
++}; /* please try to keep this structure <= 64 bytes */
++
++struct fq_codel_sched_data {
++	struct tcf_proto *filter_list;	/* optional external classifier */
++	struct fq_codel_flow *flows;	/* Flows table [flows_cnt] */
++	u32		*backlogs;	/* backlog table [flows_cnt] */
++	u32		flows_cnt;	/* number of flows */
++	u32		perturbation;	/* hash perturbation */
++	u32		quantum;	/* psched_mtu(qdisc_dev(sch)); */
++	struct codel_params cparams;
++	struct codel_stats cstats;
++	u32		drop_overlimit;
++	u32		new_flow_count;
++
++	struct list_head new_flows;	/* list of new flows */
++	struct list_head old_flows;	/* list of old flows */
++};
++
++static unsigned int fq_codel_hash(const struct fq_codel_sched_data *q,
++				  const struct sk_buff *skb)
++{
++	struct flow_keys keys;
++	unsigned int hash;
++
++	skb_flow_dissect(skb, &keys);
++	hash = jhash_3words((__force u32)keys.dst,
++			    (__force u32)keys.src ^ keys.ip_proto,
++			    (__force u32)keys.ports, q->perturbation);
++	return ((u64)hash * q->flows_cnt) >> 32;
++}
++
++static unsigned int fq_codel_classify(struct sk_buff *skb, struct Qdisc *sch,
++				      int *qerr)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct tcf_result res;
++	int result;
++
++	if (TC_H_MAJ(skb->priority) == sch->handle &&
++	    TC_H_MIN(skb->priority) > 0 &&
++	    TC_H_MIN(skb->priority) <= q->flows_cnt)
++		return TC_H_MIN(skb->priority);
++
++	if (!q->filter_list)
++		return fq_codel_hash(q, skb) + 1;
++
++	*qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
++	result = tc_classify(skb, q->filter_list, &res);
++	if (result >= 0) {
++#ifdef CONFIG_NET_CLS_ACT
++		switch (result) {
++		case TC_ACT_STOLEN:
++		case TC_ACT_QUEUED:
++			*qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
++		case TC_ACT_SHOT:
++			return 0;
++		}
++#endif
++		if (TC_H_MIN(res.classid) <= q->flows_cnt)
++			return TC_H_MIN(res.classid);
++	}
++	return 0;
++}
++
++/* helper functions : might be changed when/if skb use a standard list_head */
++
++/* remove one skb from head of slot queue */
++static inline struct sk_buff *dequeue_head(struct fq_codel_flow *flow)
++{
++	struct sk_buff *skb = flow->head;
++
++	flow->head = skb->next;
++	skb->next = NULL;
++	return skb;
++}
++
++/* add skb to flow queue (tail add) */
++static inline void flow_queue_add(struct fq_codel_flow *flow,
++				  struct sk_buff *skb)
++{
++	if (flow->head == NULL)
++		flow->head = skb;
++	else
++		flow->tail->next = skb;
++	flow->tail = skb;
++	skb->next = NULL;
++}
++
++static unsigned int fq_codel_drop(struct Qdisc *sch)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct sk_buff *skb;
++	unsigned int maxbacklog = 0, idx = 0, i, len;
++	struct fq_codel_flow *flow;
++
++	/* Queue is full! Find the fat flow and drop packet from it.
++	 * This might sound expensive, but with 1024 flows, we scan
++	 * 4KB of memory, and we dont need to handle a complex tree
++	 * in fast path (packet queue/enqueue) with many cache misses.
++	 */
++	for (i = 0; i < q->flows_cnt; i++) {
++		if (q->backlogs[i] > maxbacklog) {
++			maxbacklog = q->backlogs[i];
++			idx = i;
++		}
++	}
++	flow = &q->flows[idx];
++	skb = dequeue_head(flow);
++	len = qdisc_pkt_len(skb);
++	q->backlogs[idx] -= len;
++	kfree_skb(skb);
++	sch->q.qlen--;
++	sch->qstats.drops++;
++	sch->qstats.backlog -= len;
++	flow->dropped++;
++	return idx;
++}
++
++static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	unsigned int idx;
++	struct fq_codel_flow *flow;
++	int uninitialized_var(ret);
++
++	idx = fq_codel_classify(skb, sch, &ret);
++	if (idx == 0) {
++		if (ret & __NET_XMIT_BYPASS)
++			sch->qstats.drops++;
++		kfree_skb(skb);
++		return ret;
++	}
++	idx--;
++
++	codel_set_enqueue_time(skb);
++	flow = &q->flows[idx];
++	flow_queue_add(flow, skb);
++	q->backlogs[idx] += qdisc_pkt_len(skb);
++	sch->qstats.backlog += qdisc_pkt_len(skb);
++
++	if (list_empty(&flow->flowchain)) {
++		list_add_tail(&flow->flowchain, &q->new_flows);
++		codel_vars_init(&flow->cvars);
++		q->new_flow_count++;
++		flow->deficit = q->quantum;
++		flow->dropped = 0;
++	}
++	if (++sch->q.qlen < sch->limit)
++		return NET_XMIT_SUCCESS;
++
++	q->drop_overlimit++;
++	/* Return Congestion Notification only if we dropped a packet
++	 * from this flow.
++	 */
++	if (fq_codel_drop(sch) == idx)
++		return NET_XMIT_CN;
++
++	/* As we dropped a packet, better let upper stack know this */
++	qdisc_tree_decrease_qlen(sch, 1);
++	return NET_XMIT_SUCCESS;
++}
++
++/* This is the specific function called from codel_dequeue()
++ * to dequeue a packet from queue. Note: backlog is handled in
++ * codel, we dont need to reduce it here.
++ */
++static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch)
++{
++	struct fq_codel_flow *flow;
++	struct sk_buff *skb = NULL;
++
++	flow = container_of(vars, struct fq_codel_flow, cvars);
++	if (flow->head) {
++		skb = dequeue_head(flow);
++		sch->qstats.backlog -= qdisc_pkt_len(skb);
++		sch->q.qlen--;
++	}
++	return skb;
++}
++
++static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct sk_buff *skb;
++	struct fq_codel_flow *flow;
++	struct list_head *head;
++	u32 prev_drop_count, prev_ecn_mark;
++
++begin:
++	head = &q->new_flows;
++	if (list_empty(head)) {
++		head = &q->old_flows;
++		if (list_empty(head))
++			return NULL;
++	}
++	flow = list_first_entry(head, struct fq_codel_flow, flowchain);
++
++	if (flow->deficit <= 0) {
++		flow->deficit += q->quantum;
++		list_move_tail(&flow->flowchain, &q->old_flows);
++		goto begin;
++	}
++
++	prev_drop_count = q->cstats.drop_count;
++	prev_ecn_mark = q->cstats.ecn_mark;
++
++	skb = codel_dequeue(sch, &q->cparams, &flow->cvars, &q->cstats,
++			    dequeue, &q->backlogs[flow - q->flows]);
++
++	flow->dropped += q->cstats.drop_count - prev_drop_count;
++	flow->dropped += q->cstats.ecn_mark - prev_ecn_mark;
++
++	if (!skb) {
++		/* force a pass through old_flows to prevent starvation */
++		if ((head == &q->new_flows) && !list_empty(&q->old_flows))
++			list_move_tail(&flow->flowchain, &q->old_flows);
++		else
++			list_del_init(&flow->flowchain);
++		goto begin;
++	}
++	qdisc_bstats_update(sch, skb);
++	flow->deficit -= qdisc_pkt_len(skb);
++	/* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
++	 * or HTB crashes. Defer it for next round.
++	 */
++	if (q->cstats.drop_count && sch->q.qlen) {
++		qdisc_tree_decrease_qlen(sch, q->cstats.drop_count);
++		q->cstats.drop_count = 0;
++	}
++	return skb;
++}
++
++static void fq_codel_reset(struct Qdisc *sch)
++{
++	struct sk_buff *skb;
++
++	while ((skb = fq_codel_dequeue(sch)) != NULL)
++		kfree_skb(skb);
++}
++
++static const struct nla_policy fq_codel_policy[TCA_FQ_CODEL_MAX + 1] = {
++	[TCA_FQ_CODEL_TARGET]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_LIMIT]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_INTERVAL]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_ECN]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_FLOWS]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_QUANTUM]	= { .type = NLA_U32 },
++};
++
++static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct nlattr *tb[TCA_FQ_CODEL_MAX + 1];
++	int err;
++
++	if (!opt)
++		return -EINVAL;
++
++	err = nla_parse_nested(tb, TCA_FQ_CODEL_MAX, opt, fq_codel_policy);
++	if (err < 0)
++		return err;
++	if (tb[TCA_FQ_CODEL_FLOWS]) {
++		if (q->flows)
++			return -EINVAL;
++		q->flows_cnt = nla_get_u32(tb[TCA_FQ_CODEL_FLOWS]);
++		if (!q->flows_cnt ||
++		    q->flows_cnt > 65536)
++			return -EINVAL;
++	}
++	sch_tree_lock(sch);
++
++	if (tb[TCA_FQ_CODEL_TARGET]) {
++		u64 target = nla_get_u32(tb[TCA_FQ_CODEL_TARGET]);
++
++		q->cparams.target = (target * NSEC_PER_USEC) >> CODEL_SHIFT;
++	}
++
++	if (tb[TCA_FQ_CODEL_INTERVAL]) {
++		u64 interval = nla_get_u32(tb[TCA_FQ_CODEL_INTERVAL]);
++
++		q->cparams.interval = (interval * NSEC_PER_USEC) >> CODEL_SHIFT;
++	}
++
++	if (tb[TCA_FQ_CODEL_LIMIT])
++		sch->limit = nla_get_u32(tb[TCA_FQ_CODEL_LIMIT]);
++
++	if (tb[TCA_FQ_CODEL_ECN])
++		q->cparams.ecn = !!nla_get_u32(tb[TCA_FQ_CODEL_ECN]);
++
++	if (tb[TCA_FQ_CODEL_QUANTUM])
++		q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
++
++	while (sch->q.qlen > sch->limit) {
++		struct sk_buff *skb = fq_codel_dequeue(sch);
++
++		kfree_skb(skb);
++		q->cstats.drop_count++;
++	}
++	qdisc_tree_decrease_qlen(sch, q->cstats.drop_count);
++	q->cstats.drop_count = 0;
++
++	sch_tree_unlock(sch);
++	return 0;
++}
++
++static void *fq_codel_zalloc(size_t sz)
++{
++	void *ptr = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN);
++
++	if (!ptr)
++		ptr = vzalloc(sz);
++	return ptr;
++}
++
++static void fq_codel_free(void *addr)
++{
++	if (addr) {
++		if (is_vmalloc_addr(addr))
++			vfree(addr);
++		else
++			kfree(addr);
++	}
++}
++
++static void fq_codel_destroy(struct Qdisc *sch)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++
++	tcf_destroy_chain(&q->filter_list);
++	fq_codel_free(q->backlogs);
++	fq_codel_free(q->flows);
++}
++
++static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	int i;
++
++	sch->limit = 10*1024;
++	q->flows_cnt = 1024;
++	q->quantum = psched_mtu(qdisc_dev(sch));
++	q->perturbation = net_random();
++	INIT_LIST_HEAD(&q->new_flows);
++	INIT_LIST_HEAD(&q->old_flows);
++	codel_params_init(&q->cparams);
++	codel_stats_init(&q->cstats);
++	q->cparams.ecn = true;
++
++	if (opt) {
++		int err = fq_codel_change(sch, opt);
++		if (err)
++			return err;
++	}
++
++	if (!q->flows) {
++		q->flows = fq_codel_zalloc(q->flows_cnt *
++					   sizeof(struct fq_codel_flow));
++		if (!q->flows)
++			return -ENOMEM;
++		q->backlogs = fq_codel_zalloc(q->flows_cnt * sizeof(u32));
++		if (!q->backlogs) {
++			fq_codel_free(q->flows);
++			return -ENOMEM;
++		}
++		for (i = 0; i < q->flows_cnt; i++) {
++			struct fq_codel_flow *flow = q->flows + i;
++
++			INIT_LIST_HEAD(&flow->flowchain);
++		}
++	}
++	if (sch->limit >= 1)
++		sch->flags |= TCQ_F_CAN_BYPASS;
++	else
++		sch->flags &= ~TCQ_F_CAN_BYPASS;
++	return 0;
++}
++
++static int fq_codel_dump(struct Qdisc *sch, struct sk_buff *skb)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct nlattr *opts;
++
++	opts = nla_nest_start(skb, TCA_OPTIONS);
++	if (opts == NULL)
++		goto nla_put_failure;
++
++	if (nla_put_u32(skb, TCA_FQ_CODEL_TARGET,
++			codel_time_to_us(q->cparams.target)) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_LIMIT,
++			sch->limit) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_INTERVAL,
++			codel_time_to_us(q->cparams.interval)) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_ECN,
++			q->cparams.ecn) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_QUANTUM,
++			q->quantum) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_FLOWS,
++			q->flows_cnt))
++		goto nla_put_failure;
++
++	nla_nest_end(skb, opts);
++	return skb->len;
++
++nla_put_failure:
++	return -1;
++}
++
++static int fq_codel_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct tc_fq_codel_xstats st = {
++		.type				= TCA_FQ_CODEL_XSTATS_QDISC,
++		.qdisc_stats.maxpacket		= q->cstats.maxpacket,
++		.qdisc_stats.drop_overlimit	= q->drop_overlimit,
++		.qdisc_stats.ecn_mark		= q->cstats.ecn_mark,
++		.qdisc_stats.new_flow_count	= q->new_flow_count,
++	};
++	struct list_head *pos;
++
++	list_for_each(pos, &q->new_flows)
++		st.qdisc_stats.new_flows_len++;
++
++	list_for_each(pos, &q->old_flows)
++		st.qdisc_stats.old_flows_len++;
++
++	return gnet_stats_copy_app(d, &st, sizeof(st));
++}
++
++static struct Qdisc *fq_codel_leaf(struct Qdisc *sch, unsigned long arg)
++{
++	return NULL;
++}
++
++static unsigned long fq_codel_get(struct Qdisc *sch, u32 classid)
++{
++	return 0;
++}
++
++static unsigned long fq_codel_bind(struct Qdisc *sch, unsigned long parent,
++			      u32 classid)
++{
++	/* we cannot bypass queue discipline anymore */
++	sch->flags &= ~TCQ_F_CAN_BYPASS;
++	return 0;
++}
++
++static void fq_codel_put(struct Qdisc *q, unsigned long cl)
++{
++}
++
++static struct tcf_proto **fq_codel_find_tcf(struct Qdisc *sch, unsigned long cl)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++
++	if (cl)
++		return NULL;
++	return &q->filter_list;
++}
++
++static int fq_codel_dump_class(struct Qdisc *sch, unsigned long cl,
++			  struct sk_buff *skb, struct tcmsg *tcm)
++{
++	tcm->tcm_handle |= TC_H_MIN(cl);
++	return 0;
++}
++
++static int fq_codel_dump_class_stats(struct Qdisc *sch, unsigned long cl,
++				     struct gnet_dump *d)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	u32 idx = cl - 1;
++	struct gnet_stats_queue qs = { 0 };
++	struct tc_fq_codel_xstats xstats;
++
++	if (idx < q->flows_cnt) {
++		const struct fq_codel_flow *flow = &q->flows[idx];
++		const struct sk_buff *skb = flow->head;
++
++		memset(&xstats, 0, sizeof(xstats));
++		xstats.type = TCA_FQ_CODEL_XSTATS_CLASS;
++		xstats.class_stats.deficit = flow->deficit;
++		xstats.class_stats.ldelay =
++			codel_time_to_us(flow->cvars.ldelay);
++		xstats.class_stats.count = flow->cvars.count;
++		xstats.class_stats.lastcount = flow->cvars.lastcount;
++		xstats.class_stats.dropping = flow->cvars.dropping;
++		if (flow->cvars.dropping) {
++			codel_tdiff_t delta = flow->cvars.drop_next -
++					      codel_get_time();
++
++			xstats.class_stats.drop_next = (delta >= 0) ?
++				codel_time_to_us(delta) :
++				-codel_time_to_us(-delta);
++		}
++		while (skb) {
++			qs.qlen++;
++			skb = skb->next;
++		}
++		qs.backlog = q->backlogs[idx];
++		qs.drops = flow->dropped;
++	}
++	if (gnet_stats_copy_queue(d, &qs) < 0)
++		return -1;
++	if (idx < q->flows_cnt)
++		return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
++	return 0;
++}
++
++static void fq_codel_walk(struct Qdisc *sch, struct qdisc_walker *arg)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	unsigned int i;
++
++	if (arg->stop)
++		return;
++
++	for (i = 0; i < q->flows_cnt; i++) {
++		if (list_empty(&q->flows[i].flowchain) ||
++		    arg->count < arg->skip) {
++			arg->count++;
++			continue;
++		}
++		if (arg->fn(sch, i + 1, arg) < 0) {
++			arg->stop = 1;
++			break;
++		}
++		arg->count++;
++	}
++}
++
++static const struct Qdisc_class_ops fq_codel_class_ops = {
++	.leaf		=	fq_codel_leaf,
++	.get		=	fq_codel_get,
++	.put		=	fq_codel_put,
++	.tcf_chain	=	fq_codel_find_tcf,
++	.bind_tcf	=	fq_codel_bind,
++	.unbind_tcf	=	fq_codel_put,
++	.dump		=	fq_codel_dump_class,
++	.dump_stats	=	fq_codel_dump_class_stats,
++	.walk		=	fq_codel_walk,
++};
++
++static struct Qdisc_ops fq_codel_qdisc_ops __read_mostly = {
++	.cl_ops		=	&fq_codel_class_ops,
++	.id		=	"fq_codel",
++	.priv_size	=	sizeof(struct fq_codel_sched_data),
++	.enqueue	=	fq_codel_enqueue,
++	.dequeue	=	fq_codel_dequeue,
++	.peek		=	qdisc_peek_dequeued,
++	.drop		=	fq_codel_drop,
++	.init		=	fq_codel_init,
++	.reset		=	fq_codel_reset,
++	.destroy	=	fq_codel_destroy,
++	.change		=	fq_codel_change,
++	.dump		=	fq_codel_dump,
++	.dump_stats =	fq_codel_dump_stats,
++	.owner		=	THIS_MODULE,
++};
++
++static int __init fq_codel_module_init(void)
++{
++	return register_qdisc(&fq_codel_qdisc_ops);
++}
++
++static void __exit fq_codel_module_exit(void)
++{
++	unregister_qdisc(&fq_codel_qdisc_ops);
++}
++
++module_init(fq_codel_module_init)
++module_exit(fq_codel_module_exit)
++MODULE_AUTHOR("Eric Dumazet");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/043-net-codel-Add-missing-include-linux-prefetch.h.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/043-net-codel-Add-missing-include-linux-prefetch.h.patch.svn-base
new file mode 100644
index 0000000..3510ee0
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/043-net-codel-Add-missing-include-linux-prefetch.h.patch.svn-base
@@ -0,0 +1,33 @@
+From 18c12e496ead3306de00a82d0bc73d71b34d7c24 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Mon, 14 May 2012 09:47:05 +0000
+Subject: [PATCH] net/codel: Add missing #include <linux/prefetch.h>
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit ce5b4b977127ee20c3f9c3fd3637cd3796f649f5 upstream.
+
+m68k allmodconfig:
+
+net/sched/sch_codel.c: In function ‘dequeue’:
+net/sched/sch_codel.c:70: error: implicit declaration of function ‘prefetch’
+make[1]: *** [net/sched/sch_codel.o] Error 1
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/sched/sch_codel.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -46,6 +46,7 @@
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/skbuff.h>
++#include <linux/prefetch.h>
+ #include <net/pkt_sched.h>
+ #include <net/codel.h>
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/044-net-codel-fix-build-errors.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/044-net-codel-fix-build-errors.patch.svn-base
new file mode 100644
index 0000000..219285d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/044-net-codel-fix-build-errors.patch.svn-base
@@ -0,0 +1,51 @@
+From b49ab5f6bb7e609190065cb9a605de809e50ab60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Mon, 14 May 2012 11:57:06 +0000
+Subject: [PATCH] net: codel: fix build errors
+
+commit 669d67bf777def468970f2dcba1537edf3b2d329 upstream.
+
+Fix the following build error:
+
+net/sched/sch_fq_codel.c: In function 'fq_codel_dump_stats':
+net/sched/sch_fq_codel.c:464:3: error: unknown field 'qdisc_stats' specified in initializer
+net/sched/sch_fq_codel.c:464:3: warning: missing braces around initializer
+net/sched/sch_fq_codel.c:464:3: warning: (near initialization for 'st.<anonymous>')
+net/sched/sch_fq_codel.c:465:3: error: unknown field 'qdisc_stats' specified in initializer
+net/sched/sch_fq_codel.c:465:3: warning: excess elements in struct initializer
+net/sched/sch_fq_codel.c:465:3: warning: (near initialization for 'st')
+net/sched/sch_fq_codel.c:466:3: error: unknown field 'qdisc_stats' specified in initializer
+net/sched/sch_fq_codel.c:466:3: warning: excess elements in struct initializer
+net/sched/sch_fq_codel.c:466:3: warning: (near initialization for 'st')
+net/sched/sch_fq_codel.c:467:3: error: unknown field 'qdisc_stats' specified in initializer
+net/sched/sch_fq_codel.c:467:3: warning: excess elements in struct initializer
+net/sched/sch_fq_codel.c:467:3: warning: (near initialization for 'st')
+make[1]: *** [net/sched/sch_fq_codel.o] Error 1
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/sched/sch_fq_codel.c |    9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -461,13 +461,14 @@ static int fq_codel_dump_stats(struct Qd
+ 	struct fq_codel_sched_data *q = qdisc_priv(sch);
+ 	struct tc_fq_codel_xstats st = {
+ 		.type				= TCA_FQ_CODEL_XSTATS_QDISC,
+-		.qdisc_stats.maxpacket		= q->cstats.maxpacket,
+-		.qdisc_stats.drop_overlimit	= q->drop_overlimit,
+-		.qdisc_stats.ecn_mark		= q->cstats.ecn_mark,
+-		.qdisc_stats.new_flow_count	= q->new_flow_count,
+ 	};
+ 	struct list_head *pos;
+ 
++	st.qdisc_stats.maxpacket = q->cstats.maxpacket;
++	st.qdisc_stats.drop_overlimit = q->drop_overlimit;
++	st.qdisc_stats.ecn_mark = q->cstats.ecn_mark;
++	st.qdisc_stats.new_flow_count = q->new_flow_count;
++
+ 	list_for_each(pos, &q->new_flows)
+ 		st.qdisc_stats.new_flows_len++;
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/045-codel-use-u16-field-instead-of-31bits-for-rec_inv_sq.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/045-codel-use-u16-field-instead-of-31bits-for-rec_inv_sq.patch.svn-base
new file mode 100644
index 0000000..933a3dc
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/045-codel-use-u16-field-instead-of-31bits-for-rec_inv_sq.patch.svn-base
@@ -0,0 +1,86 @@
+From 03333931c17d9c62ba4063d4e4fec1578c0729a7 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sat, 12 May 2012 21:23:23 +0000
+Subject: [PATCH] codel: use u16 field instead of 31bits for rec_inv_sqrt
+
+commit 6ff272c9ad65eda219cd975b9da2dbc31cc812ee upstream.
+
+David pointed out gcc might generate poor code with 31bit fields.
+
+Using u16 is more than enough and permits a better code output.
+
+Also make the code intent more readable using constants, fixed point arithmetic
+not being trivial for everybody.
+
+Suggested-by: David Miller <davem@davemloft.net>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/codel.h |   25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -133,13 +133,17 @@ struct codel_params {
+ struct codel_vars {
+ 	u32		count;
+ 	u32		lastcount;
+-	bool		dropping:1;
+-	u32		rec_inv_sqrt:31;
++	bool		dropping;
++	u16		rec_inv_sqrt;
+ 	codel_time_t	first_above_time;
+ 	codel_time_t	drop_next;
+ 	codel_time_t	ldelay;
+ };
+ 
++#define REC_INV_SQRT_BITS (8 * sizeof(u16)) /* or sizeof_in_bits(rec_inv_sqrt) */
++/* needed shift to get a Q0.32 number from rec_inv_sqrt */
++#define REC_INV_SQRT_SHIFT (32 - REC_INV_SQRT_BITS)
++
+ /**
+  * struct codel_stats - contains codel shared variables and stats
+  * @maxpacket:	largest packet we've seen so far
+@@ -173,17 +177,18 @@ static void codel_stats_init(struct code
+  * http://en.wikipedia.org/wiki/Methods_of_computing_square_roots#Iterative_methods_for_reciprocal_square_roots
+  * new_invsqrt = (invsqrt / 2) * (3 - count * invsqrt^2)
+  *
+- * Here, invsqrt is a fixed point number (< 1.0), 31bit mantissa)
++ * Here, invsqrt is a fixed point number (< 1.0), 32bit mantissa, aka Q0.32
+  */
+ static void codel_Newton_step(struct codel_vars *vars)
+ {
+-	u32 invsqrt = vars->rec_inv_sqrt;
+-	u32 invsqrt2 = ((u64)invsqrt * invsqrt) >> 31;
+-	u64 val = (3LL << 31) - ((u64)vars->count * invsqrt2);
++	u32 invsqrt = ((u32)vars->rec_inv_sqrt) << REC_INV_SQRT_SHIFT;
++	u32 invsqrt2 = ((u64)invsqrt * invsqrt) >> 32;
++	u64 val = (3LL << 32) - ((u64)vars->count * invsqrt2);
+ 
+-	val = (val * invsqrt) >> 32;
++	val >>= 2; /* avoid overflow in following multiply */
++	val = (val * invsqrt) >> (32 - 2 + 1);
+ 
+-	vars->rec_inv_sqrt = val;
++	vars->rec_inv_sqrt = val >> REC_INV_SQRT_SHIFT;
+ }
+ 
+ /*
+@@ -195,7 +200,7 @@ static codel_time_t codel_control_law(co
+ 				      codel_time_t interval,
+ 				      u32 rec_inv_sqrt)
+ {
+-	return t + reciprocal_divide(interval, rec_inv_sqrt << 1);
++	return t + reciprocal_divide(interval, rec_inv_sqrt << REC_INV_SQRT_SHIFT);
+ }
+ 
+ 
+@@ -326,7 +331,7 @@ static struct sk_buff *codel_dequeue(str
+ 			codel_Newton_step(vars);
+ 		} else {
+ 			vars->count = 1;
+-			vars->rec_inv_sqrt = 0x7fffffff;
++			vars->rec_inv_sqrt = ~0U >> REC_INV_SQRT_SHIFT;
+ 		}
+ 		vars->lastcount = vars->count;
+ 		vars->drop_next = codel_control_law(now, params->interval,
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/046-fq_codel-qdisc-backlog.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/046-fq_codel-qdisc-backlog.patch.svn-base
new file mode 100644
index 0000000..f9bcbbd
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/046-fq_codel-qdisc-backlog.patch.svn-base
@@ -0,0 +1,132 @@
+From 7bd90773f89001ea4960ed47676b550137f3facb Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 16 May 2012 04:39:09 +0000
+Subject: [PATCH] fq_codel: should use qdisc backlog as threshold
+
+commit 865ec5523dadbedefbc5710a68969f686a28d928 upstream.
+
+codel_should_drop() logic allows a packet being not dropped if queue
+size is under max packet size.
+
+In fq_codel, we have two possible backlogs : The qdisc global one, and
+the flow local one.
+
+The meaningful one for codel_should_drop() should be the global backlog,
+not the per flow one, so that thin flows can have a non zero drop/mark
+probability.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Dave Taht <dave.taht@bufferbloat.net>
+Cc: Kathleen Nichols <nichols@pollere.com>
+Cc: Van Jacobson <van@pollere.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/codel.h      |   15 +++++++--------
+ net/sched/sch_codel.c    |    4 ++--
+ net/sched/sch_fq_codel.c |    5 +++--
+ 3 files changed, 12 insertions(+), 12 deletions(-)
+
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -205,7 +205,7 @@ static codel_time_t codel_control_law(co
+ 
+ 
+ static bool codel_should_drop(const struct sk_buff *skb,
+-			      unsigned int *backlog,
++			      struct Qdisc *sch,
+ 			      struct codel_vars *vars,
+ 			      struct codel_params *params,
+ 			      struct codel_stats *stats,
+@@ -219,13 +219,13 @@ static bool codel_should_drop(const stru
+ 	}
+ 
+ 	vars->ldelay = now - codel_get_enqueue_time(skb);
+-	*backlog -= qdisc_pkt_len(skb);
++	sch->qstats.backlog -= qdisc_pkt_len(skb);
+ 
+ 	if (unlikely(qdisc_pkt_len(skb) > stats->maxpacket))
+ 		stats->maxpacket = qdisc_pkt_len(skb);
+ 
+ 	if (codel_time_before(vars->ldelay, params->target) ||
+-	    *backlog <= stats->maxpacket) {
++	    sch->qstats.backlog <= stats->maxpacket) {
+ 		/* went below - stay below for at least interval */
+ 		vars->first_above_time = 0;
+ 		return false;
+@@ -249,8 +249,7 @@ static struct sk_buff *codel_dequeue(str
+ 				     struct codel_params *params,
+ 				     struct codel_vars *vars,
+ 				     struct codel_stats *stats,
+-				     codel_skb_dequeue_t dequeue_func,
+-				     u32 *backlog)
++				     codel_skb_dequeue_t dequeue_func)
+ {
+ 	struct sk_buff *skb = dequeue_func(vars, sch);
+ 	codel_time_t now;
+@@ -261,7 +260,7 @@ static struct sk_buff *codel_dequeue(str
+ 		return skb;
+ 	}
+ 	now = codel_get_time();
+-	drop = codel_should_drop(skb, backlog, vars, params, stats, now);
++	drop = codel_should_drop(skb, sch, vars, params, stats, now);
+ 	if (vars->dropping) {
+ 		if (!drop) {
+ 			/* sojourn time below target - leave dropping state */
+@@ -292,7 +291,7 @@ static struct sk_buff *codel_dequeue(str
+ 				qdisc_drop(skb, sch);
+ 				stats->drop_count++;
+ 				skb = dequeue_func(vars, sch);
+-				if (!codel_should_drop(skb, backlog,
++				if (!codel_should_drop(skb, sch,
+ 						       vars, params, stats, now)) {
+ 					/* leave dropping state */
+ 					vars->dropping = false;
+@@ -313,7 +312,7 @@ static struct sk_buff *codel_dequeue(str
+ 			stats->drop_count++;
+ 
+ 			skb = dequeue_func(vars, sch);
+-			drop = codel_should_drop(skb, backlog, vars, params,
++			drop = codel_should_drop(skb, sch, vars, params,
+ 						 stats, now);
+ 		}
+ 		vars->dropping = true;
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -77,8 +77,8 @@ static struct sk_buff *codel_qdisc_deque
+ 	struct codel_sched_data *q = qdisc_priv(sch);
+ 	struct sk_buff *skb;
+ 
+-	skb = codel_dequeue(sch, &q->params, &q->vars, &q->stats,
+-			    dequeue, &sch->qstats.backlog);
++	skb = codel_dequeue(sch, &q->params, &q->vars, &q->stats, dequeue);
++
+ 	/* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
+ 	 * or HTB crashes. Defer it for next round.
+ 	 */
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -217,13 +217,14 @@ static int fq_codel_enqueue(struct sk_bu
+  */
+ static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch)
+ {
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
+ 	struct fq_codel_flow *flow;
+ 	struct sk_buff *skb = NULL;
+ 
+ 	flow = container_of(vars, struct fq_codel_flow, cvars);
+ 	if (flow->head) {
+ 		skb = dequeue_head(flow);
+-		sch->qstats.backlog -= qdisc_pkt_len(skb);
++		q->backlogs[flow - q->flows] -= qdisc_pkt_len(skb);
+ 		sch->q.qlen--;
+ 	}
+ 	return skb;
+@@ -256,7 +257,7 @@ begin:
+ 	prev_ecn_mark = q->cstats.ecn_mark;
+ 
+ 	skb = codel_dequeue(sch, &q->cparams, &flow->cvars, &q->cstats,
+-			    dequeue, &q->backlogs[flow - q->flows]);
++			    dequeue);
+ 
+ 	flow->dropped += q->cstats.drop_count - prev_drop_count;
+ 	flow->dropped += q->cstats.ecn_mark - prev_ecn_mark;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/047-spi_message_queue.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/047-spi_message_queue.patch.svn-base
new file mode 100644
index 0000000..9aff0be
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/047-spi_message_queue.patch.svn-base
@@ -0,0 +1,603 @@
+commit ffbbdd21329f3e15eeca6df2d4bc11c04d9d91c0
+Author: Linus Walleij <linus.walleij@linaro.org>
+Date:   Wed Feb 22 10:05:38 2012 +0100
+
+    spi: create a message queueing infrastructure
+    
+    This rips the message queue in the PL022 driver out and pushes
+    it into (optional) common infrastructure. Drivers that want to
+    use the message pumping thread will need to define the new
+    per-messags transfer methods and leave the deprecated transfer()
+    method as NULL.
+    
+    Most of the design is described in the documentation changes that
+    are included in this patch.
+    
+    Since there is a queue that need to be stopped when the system
+    is suspending/resuming, two new calls are implemented for the
+    device drivers to call in their suspend()/resume() functions:
+    spi_master_suspend() and spi_master_resume().
+    
+    ChangeLog v1->v2:
+    - Remove Kconfig entry and do not make the queue support optional
+      at all, instead be more agressive and have it as part of the
+      compulsory infrastructure.
+    - If the .transfer() method is implemented, delete print a small
+      deprecation notice and do not start the transfer pump.
+    - Fix a bitrotted comment.
+    ChangeLog v2->v3:
+    - Fix up a problematic sequence courtesy of Chris Blair.
+    - Stop rather than destroy the queue on suspend() courtesy of
+      Chris Blair.
+    
+    Signed-off-by: Chris Blair <chris.blair@stericsson.com>
+    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+    Tested-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+    Reviewed-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+    Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+
+[Florian: dropped the changes on drivers/spi/spi-pl022.c, removed
+the dev_info() about unqueued drivers still using the master function]
+
+--- a/Documentation/spi/spi-summary
++++ b/Documentation/spi/spi-summary
+@@ -1,7 +1,7 @@
+ Overview of Linux kernel SPI support
+ ====================================
+ 
+-21-May-2007
++02-Feb-2012
+ 
+ What is SPI?
+ ------------
+@@ -483,9 +483,9 @@ also initialize its own internal state.
+ and those methods.)
+ 
+ After you initialize the spi_master, then use spi_register_master() to
+-publish it to the rest of the system.  At that time, device nodes for
+-the controller and any predeclared spi devices will be made available,
+-and the driver model core will take care of binding them to drivers.
++publish it to the rest of the system. At that time, device nodes for the
++controller and any predeclared spi devices will be made available, and
++the driver model core will take care of binding them to drivers.
+ 
+ If you need to remove your SPI controller driver, spi_unregister_master()
+ will reverse the effect of spi_register_master().
+@@ -521,21 +521,53 @@ SPI MASTER METHODS
+ 		** When you code setup(), ASSUME that the controller
+ 		** is actively processing transfers for another device.
+ 
+-    master->transfer(struct spi_device *spi, struct spi_message *message)
+-    	This must not sleep.  Its responsibility is arrange that the
+-	transfer happens and its complete() callback is issued.  The two
+-	will normally happen later, after other transfers complete, and
+-	if the controller is idle it will need to be kickstarted.
+-
+     master->cleanup(struct spi_device *spi)
+ 	Your controller driver may use spi_device.controller_state to hold
+ 	state it dynamically associates with that device.  If you do that,
+ 	be sure to provide the cleanup() method to free that state.
+ 
++    master->prepare_transfer_hardware(struct spi_master *master)
++	This will be called by the queue mechanism to signal to the driver
++	that a message is coming in soon, so the subsystem requests the
++	driver to prepare the transfer hardware by issuing this call.
++	This may sleep.
++
++    master->unprepare_transfer_hardware(struct spi_master *master)
++	This will be called by the queue mechanism to signal to the driver
++	that there are no more messages pending in the queue and it may
++	relax the hardware (e.g. by power management calls). This may sleep.
++
++    master->transfer_one_message(struct spi_master *master,
++				 struct spi_message *mesg)
++	The subsystem calls the driver to transfer a single message while
++	queuing transfers that arrive in the meantime. When the driver is
++	finished with this message, it must call
++	spi_finalize_current_message() so the subsystem can issue the next
++	transfer. This may sleep.
++
++    DEPRECATED METHODS
++
++    master->transfer(struct spi_device *spi, struct spi_message *message)
++	This must not sleep. Its responsibility is arrange that the
++	transfer happens and its complete() callback is issued. The two
++	will normally happen later, after other transfers complete, and
++	if the controller is idle it will need to be kickstarted. This
++	method is not used on queued controllers and must be NULL if
++	transfer_one_message() and (un)prepare_transfer_hardware() are
++	implemented.
++
+ 
+ SPI MESSAGE QUEUE
+ 
+-The bulk of the driver will be managing the I/O queue fed by transfer().
++If you are happy with the standard queueing mechanism provided by the
++SPI subsystem, just implement the queued methods specified above. Using
++the message queue has the upside of centralizing a lot of code and
++providing pure process-context execution of methods. The message queue
++can also be elevated to realtime priority on high-priority SPI traffic.
++
++Unless the queueing mechanism in the SPI subsystem is selected, the bulk
++of the driver will be managing the I/O queue fed by the now deprecated
++function transfer().
+ 
+ That queue could be purely conceptual.  For example, a driver used only
+ for low-frequency sensor access might be fine using synchronous PIO.
+@@ -561,4 +593,6 @@ Stephen Street
+ Mark Underwood
+ Andrew Victor
+ Vitaly Wool
+-
++Grant Likely
++Mark Brown
++Linus Walleij
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -30,6 +30,9 @@
+ #include <linux/of_spi.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/export.h>
++#include <linux/sched.h>
++#include <linux/delay.h>
++#include <linux/kthread.h>
+ 
+ static void spidev_release(struct device *dev)
+ {
+@@ -507,6 +510,293 @@ spi_register_board_info(struct spi_board
+ 
+ /*-------------------------------------------------------------------------*/
+ 
++/**
++ * spi_pump_messages - kthread work function which processes spi message queue
++ * @work: pointer to kthread work struct contained in the master struct
++ *
++ * This function checks if there is any spi message in the queue that
++ * needs processing and if so call out to the driver to initialize hardware
++ * and transfer each message.
++ *
++ */
++static void spi_pump_messages(struct kthread_work *work)
++{
++	struct spi_master *master =
++		container_of(work, struct spi_master, pump_messages);
++	unsigned long flags;
++	bool was_busy = false;
++	int ret;
++
++	/* Lock queue and check for queue work */
++	spin_lock_irqsave(&master->queue_lock, flags);
++	if (list_empty(&master->queue) || !master->running) {
++		if (master->busy) {
++			ret = master->unprepare_transfer_hardware(master);
++			if (ret) {
++				dev_err(&master->dev,
++					"failed to unprepare transfer hardware\n");
++				return;
++			}
++		}
++		master->busy = false;
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		return;
++	}
++
++	/* Make sure we are not already running a message */
++	if (master->cur_msg) {
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		return;
++	}
++	/* Extract head of queue */
++	master->cur_msg =
++	    list_entry(master->queue.next, struct spi_message, queue);
++
++	list_del_init(&master->cur_msg->queue);
++	if (master->busy)
++		was_busy = true;
++	else
++		master->busy = true;
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	if (!was_busy) {
++		ret = master->prepare_transfer_hardware(master);
++		if (ret) {
++			dev_err(&master->dev,
++				"failed to prepare transfer hardware\n");
++			return;
++		}
++	}
++
++	ret = master->transfer_one_message(master, master->cur_msg);
++	if (ret) {
++		dev_err(&master->dev,
++			"failed to transfer one message from queue\n");
++		return;
++	}
++}
++
++static int spi_init_queue(struct spi_master *master)
++{
++	struct sched_param param = { .sched_priority = MAX_RT_PRIO - 1 };
++
++	INIT_LIST_HEAD(&master->queue);
++	spin_lock_init(&master->queue_lock);
++
++	master->running = false;
++	master->busy = false;
++
++	init_kthread_worker(&master->kworker);
++	master->kworker_task = kthread_run(kthread_worker_fn,
++					   &master->kworker,
++					   dev_name(&master->dev));
++	if (IS_ERR(master->kworker_task)) {
++		dev_err(&master->dev, "failed to create message pump task\n");
++		return -ENOMEM;
++	}
++	init_kthread_work(&master->pump_messages, spi_pump_messages);
++
++	/*
++	 * Master config will indicate if this controller should run the
++	 * message pump with high (realtime) priority to reduce the transfer
++	 * latency on the bus by minimising the delay between a transfer
++	 * request and the scheduling of the message pump thread. Without this
++	 * setting the message pump thread will remain at default priority.
++	 */
++	if (master->rt) {
++		dev_info(&master->dev,
++			"will run message pump with realtime priority\n");
++		sched_setscheduler(master->kworker_task, SCHED_FIFO, &param);
++	}
++
++	return 0;
++}
++
++/**
++ * spi_get_next_queued_message() - called by driver to check for queued
++ * messages
++ * @master: the master to check for queued messages
++ *
++ * If there are more messages in the queue, the next message is returned from
++ * this call.
++ */
++struct spi_message *spi_get_next_queued_message(struct spi_master *master)
++{
++	struct spi_message *next;
++	unsigned long flags;
++
++	/* get a pointer to the next message, if any */
++	spin_lock_irqsave(&master->queue_lock, flags);
++	if (list_empty(&master->queue))
++		next = NULL;
++	else
++		next = list_entry(master->queue.next,
++				  struct spi_message, queue);
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	return next;
++}
++EXPORT_SYMBOL_GPL(spi_get_next_queued_message);
++
++/**
++ * spi_finalize_current_message() - the current message is complete
++ * @master: the master to return the message to
++ *
++ * Called by the driver to notify the core that the message in the front of the
++ * queue is complete and can be removed from the queue.
++ */
++void spi_finalize_current_message(struct spi_master *master)
++{
++	struct spi_message *mesg;
++	unsigned long flags;
++
++	spin_lock_irqsave(&master->queue_lock, flags);
++	mesg = master->cur_msg;
++	master->cur_msg = NULL;
++
++	queue_kthread_work(&master->kworker, &master->pump_messages);
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	mesg->state = NULL;
++	if (mesg->complete)
++		mesg->complete(mesg->context);
++}
++EXPORT_SYMBOL_GPL(spi_finalize_current_message);
++
++static int spi_start_queue(struct spi_master *master)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&master->queue_lock, flags);
++
++	if (master->running || master->busy) {
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		return -EBUSY;
++	}
++
++	master->running = true;
++	master->cur_msg = NULL;
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	queue_kthread_work(&master->kworker, &master->pump_messages);
++
++	return 0;
++}
++
++static int spi_stop_queue(struct spi_master *master)
++{
++	unsigned long flags;
++	unsigned limit = 500;
++	int ret = 0;
++
++	spin_lock_irqsave(&master->queue_lock, flags);
++
++	/*
++	 * This is a bit lame, but is optimized for the common execution path.
++	 * A wait_queue on the master->busy could be used, but then the common
++	 * execution path (pump_messages) would be required to call wake_up or
++	 * friends on every SPI message. Do this instead.
++	 */
++	while ((!list_empty(&master->queue) || master->busy) && limit--) {
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		msleep(10);
++		spin_lock_irqsave(&master->queue_lock, flags);
++	}
++
++	if (!list_empty(&master->queue) || master->busy)
++		ret = -EBUSY;
++	else
++		master->running = false;
++
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	if (ret) {
++		dev_warn(&master->dev,
++			 "could not stop message queue\n");
++		return ret;
++	}
++	return ret;
++}
++
++static int spi_destroy_queue(struct spi_master *master)
++{
++	int ret;
++
++	ret = spi_stop_queue(master);
++
++	/*
++	 * flush_kthread_worker will block until all work is done.
++	 * If the reason that stop_queue timed out is that the work will never
++	 * finish, then it does no good to call flush/stop thread, so
++	 * return anyway.
++	 */
++	if (ret) {
++		dev_err(&master->dev, "problem destroying queue\n");
++		return ret;
++	}
++
++	flush_kthread_worker(&master->kworker);
++	kthread_stop(master->kworker_task);
++
++	return 0;
++}
++
++/**
++ * spi_queued_transfer - transfer function for queued transfers
++ * @spi: spi device which is requesting transfer
++ * @msg: spi message which is to handled is queued to driver queue
++ */
++static int spi_queued_transfer(struct spi_device *spi, struct spi_message *msg)
++{
++	struct spi_master *master = spi->master;
++	unsigned long flags;
++
++	spin_lock_irqsave(&master->queue_lock, flags);
++
++	if (!master->running) {
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		return -ESHUTDOWN;
++	}
++	msg->actual_length = 0;
++	msg->status = -EINPROGRESS;
++
++	list_add_tail(&msg->queue, &master->queue);
++	if (master->running && !master->busy)
++		queue_kthread_work(&master->kworker, &master->pump_messages);
++
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++	return 0;
++}
++
++static int spi_master_initialize_queue(struct spi_master *master)
++{
++	int ret;
++
++	master->queued = true;
++	master->transfer = spi_queued_transfer;
++
++	/* Initialize and start queue */
++	ret = spi_init_queue(master);
++	if (ret) {
++		dev_err(&master->dev, "problem initializing queue\n");
++		goto err_init_queue;
++	}
++	ret = spi_start_queue(master);
++	if (ret) {
++		dev_err(&master->dev, "problem starting queue\n");
++		goto err_start_queue;
++	}
++
++	return 0;
++
++err_start_queue:
++err_init_queue:
++	spi_destroy_queue(master);
++	return ret;
++}
++
++/*-------------------------------------------------------------------------*/
++
+ static void spi_master_release(struct device *dev)
+ {
+ 	struct spi_master *master;
+@@ -522,6 +812,7 @@ static struct class spi_master_class = {
+ };
+ 
+ 
++
+ /**
+  * spi_alloc_master - allocate SPI master controller
+  * @dev: the controller, possibly using the platform_bus
+@@ -621,6 +912,15 @@ int spi_register_master(struct spi_maste
+ 	dev_dbg(dev, "registered master %s%s\n", dev_name(&master->dev),
+ 			dynamic ? " (dynamic)" : "");
+ 
++	/* If we're using a queued driver, start the queue */
++	if (!master->transfer) {
++		status = spi_master_initialize_queue(master);
++		if (status) {
++			device_unregister(&master->dev);
++			goto done;
++		}
++	}
++
+ 	mutex_lock(&board_lock);
+ 	list_add_tail(&master->list, &spi_master_list);
+ 	list_for_each_entry(bi, &board_list, list)
+@@ -636,7 +936,6 @@ done:
+ }
+ EXPORT_SYMBOL_GPL(spi_register_master);
+ 
+-
+ static int __unregister(struct device *dev, void *null)
+ {
+ 	spi_unregister_device(to_spi_device(dev));
+@@ -657,6 +956,11 @@ void spi_unregister_master(struct spi_ma
+ {
+ 	int dummy;
+ 
++	if (master->queued) {
++		if (spi_destroy_queue(master))
++			dev_err(&master->dev, "queue remove failed\n");
++	}
++
+ 	mutex_lock(&board_lock);
+ 	list_del(&master->list);
+ 	mutex_unlock(&board_lock);
+@@ -666,6 +970,37 @@ void spi_unregister_master(struct spi_ma
+ }
+ EXPORT_SYMBOL_GPL(spi_unregister_master);
+ 
++int spi_master_suspend(struct spi_master *master)
++{
++	int ret;
++
++	/* Basically no-ops for non-queued masters */
++	if (!master->queued)
++		return 0;
++
++	ret = spi_stop_queue(master);
++	if (ret)
++		dev_err(&master->dev, "queue stop failed\n");
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(spi_master_suspend);
++
++int spi_master_resume(struct spi_master *master)
++{
++	int ret;
++
++	if (!master->queued)
++		return 0;
++
++	ret = spi_start_queue(master);
++	if (ret)
++		dev_err(&master->dev, "queue restart failed\n");
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(spi_master_resume);
++
+ static int __spi_master_match(struct device *dev, void *data)
+ {
+ 	struct spi_master *m;
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -22,6 +22,7 @@
+ #include <linux/device.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/slab.h>
++#include <linux/kthread.h>
+ 
+ /*
+  * INTERFACES between SPI master-side drivers and SPI infrastructure.
+@@ -235,6 +236,27 @@ static inline void spi_unregister_driver
+  *	the device whose settings are being modified.
+  * @transfer: adds a message to the controller's transfer queue.
+  * @cleanup: frees controller-specific state
++ * @queued: whether this master is providing an internal message queue
++ * @kworker: thread struct for message pump
++ * @kworker_task: pointer to task for message pump kworker thread
++ * @pump_messages: work struct for scheduling work to the message pump
++ * @queue_lock: spinlock to syncronise access to message queue
++ * @queue: message queue
++ * @cur_msg: the currently in-flight message
++ * @busy: message pump is busy
++ * @running: message pump is running
++ * @rt: whether this queue is set to run as a realtime task
++ * @prepare_transfer_hardware: a message will soon arrive from the queue
++ *	so the subsystem requests the driver to prepare the transfer hardware
++ *	by issuing this call
++ * @transfer_one_message: the subsystem calls the driver to transfer a single
++ *	message while queuing transfers that arrive in the meantime. When the
++ *	driver is finished with this message, it must call
++ *	spi_finalize_current_message() so the subsystem can issue the next
++ *	transfer
++ * @prepare_transfer_hardware: there are currently no more messages on the
++ *	queue so the subsystem notifies the driver that it may relax the
++ *	hardware by issuing this call
+  *
+  * Each SPI master controller can communicate with one or more @spi_device
+  * children.  These make a small bus, sharing MOSI, MISO and SCK signals
+@@ -318,6 +340,28 @@ struct spi_master {
+ 
+ 	/* called on release() to free memory provided by spi_master */
+ 	void			(*cleanup)(struct spi_device *spi);
++
++	/*
++	 * These hooks are for drivers that want to use the generic
++	 * master transfer queueing mechanism. If these are used, the
++	 * transfer() function above must NOT be specified by the driver.
++	 * Over time we expect SPI drivers to be phased over to this API.
++	 */
++	bool				queued;
++	struct kthread_worker		kworker;
++	struct task_struct		*kworker_task;
++	struct kthread_work		pump_messages;
++	spinlock_t			queue_lock;
++	struct list_head		queue;
++	struct spi_message		*cur_msg;
++	bool				busy;
++	bool				running;
++	bool				rt;
++
++	int (*prepare_transfer_hardware)(struct spi_master *master);
++	int (*transfer_one_message)(struct spi_master *master,
++				    struct spi_message *mesg);
++	int (*unprepare_transfer_hardware)(struct spi_master *master);
+ };
+ 
+ static inline void *spi_master_get_devdata(struct spi_master *master)
+@@ -343,6 +387,13 @@ static inline void spi_master_put(struct
+ 		put_device(&master->dev);
+ }
+ 
++/* PM calls that need to be issued by the driver */
++extern int spi_master_suspend(struct spi_master *master);
++extern int spi_master_resume(struct spi_master *master);
++
++/* Calls the driver make to interact with the message queue */
++extern struct spi_message *spi_get_next_queued_message(struct spi_master *master);
++extern void spi_finalize_current_message(struct spi_master *master);
+ 
+ /* the spi driver core manages memory for the spi_master classdev */
+ extern struct spi_master *
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/048-spi-Dont-call-prepare-unprepare-transfer-if-not-popu.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/048-spi-Dont-call-prepare-unprepare-transfer-if-not-popu.patch.svn-base
new file mode 100644
index 0000000..deef32e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/048-spi-Dont-call-prepare-unprepare-transfer-if-not-popu.patch.svn-base
@@ -0,0 +1,39 @@
+From 7dfd2bd70228d1f8d468d58cb3d12ecd618479ed Mon Sep 17 00:00:00 2001
+From: Shubhrajyoti D <shubhrajyoti@ti.com>
+Date: Thu, 10 May 2012 19:20:41 +0530
+Subject: [PATCH] spi: Dont call prepare/unprepare transfer if not populated
+
+Currently the prepare/unprepare transfer are called unconditionally.
+The assumption is that every driver using the spi core queue infrastructure
+has to populate the prepare and unprepare functions. This encourages
+drivers to populate empty functions to prevent crashing.
+This patch prevents the call to prepare/unprepare if not populated.
+
+Signed-off-by: Shubhrajyoti D <shubhrajyoti@ti.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+[grant.likely: fix whitespace defect]
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+---
+ drivers/spi/spi.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -530,7 +530,7 @@ static void spi_pump_messages(struct kth
+ 	/* Lock queue and check for queue work */
+ 	spin_lock_irqsave(&master->queue_lock, flags);
+ 	if (list_empty(&master->queue) || !master->running) {
+-		if (master->busy) {
++		if (master->busy && master->unprepare_transfer_hardware) {
+ 			ret = master->unprepare_transfer_hardware(master);
+ 			if (ret) {
+ 				dev_err(&master->dev,
+@@ -559,7 +559,7 @@ static void spi_pump_messages(struct kth
+ 		master->busy = true;
+ 	spin_unlock_irqrestore(&master->queue_lock, flags);
+ 
+-	if (!was_busy) {
++	if (!was_busy && master->prepare_transfer_hardware) {
+ 		ret = master->prepare_transfer_hardware(master);
+ 		if (ret) {
+ 			dev_err(&master->dev,
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/049-codel-refine-one-condition-to-avoid-a-nul-rec_inv_sqrt.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/049-codel-refine-one-condition-to-avoid-a-nul-rec_inv_sqrt.patch.svn-base
new file mode 100644
index 0000000..bfb6ae2
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/049-codel-refine-one-condition-to-avoid-a-nul-rec_inv_sqrt.patch.svn-base
@@ -0,0 +1,52 @@
+From b8fc328668a74e1314a19266755a54abd875e5a6 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sun, 29 Jul 2012 20:52:21 +0000
+Subject: [PATCH] codel: refine one condition to avoid a nul rec_inv_sqrt
+
+commit 2359a47671fc4fb0fe5e9945f76c2cb10792c0f8 upstream.
+
+One condition before codel_Newton_step() was not good if
+we never left the dropping state for a flow. As a result
+rec_inv_sqrt was 0, instead of the ~0 initial value.
+
+codel control law was then set to a very aggressive mode, dropping
+many packets before reaching 'target' and recovering from this problem.
+
+To keep codel_vars_init() as efficient as possible, refine
+the condition to make sure rec_inv_sqrt initial value is correct
+
+Many thanks to Anton Mich for discovering the issue and suggesting
+a fix.
+
+Reported-by: Anton Mich <lp2s1h@gmail.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/codel.h |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -305,6 +305,8 @@ static struct sk_buff *codel_dequeue(str
+ 			}
+ 		}
+ 	} else if (drop) {
++		u32 delta;
++
+ 		if (params->ecn && INET_ECN_set_ce(skb)) {
+ 			stats->ecn_mark++;
+ 		} else {
+@@ -320,9 +322,11 @@ static struct sk_buff *codel_dequeue(str
+ 		 * assume that the drop rate that controlled the queue on the
+ 		 * last cycle is a good starting point to control it now.
+ 		 */
+-		if (codel_time_before(now - vars->drop_next,
++		delta = vars->count - vars->lastcount;
++		if (delta > 1 &&
++		    codel_time_before(now - vars->drop_next,
+ 				      16 * params->interval)) {
+-			vars->count = (vars->count - vars->lastcount) | 1;
++			vars->count = delta;
+ 			/* we dont care if rec_inv_sqrt approximation
+ 			 * is not very precise :
+ 			 * Next Newton steps will correct it quadratically.
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/050-rng_git_backport.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/050-rng_git_backport.patch.svn-base
new file mode 100644
index 0000000..825eb73
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/050-rng_git_backport.patch.svn-base
@@ -0,0 +1,783 @@
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -125,21 +125,26 @@
+  * The current exported interfaces for gathering environmental noise
+  * from the devices are:
+  *
++ *	void add_device_randomness(const void *buf, unsigned int size);
+  * 	void add_input_randomness(unsigned int type, unsigned int code,
+  *                                unsigned int value);
+- * 	void add_interrupt_randomness(int irq);
++ *	void add_interrupt_randomness(int irq, int irq_flags);
+  * 	void add_disk_randomness(struct gendisk *disk);
+  *
+  * add_input_randomness() uses the input layer interrupt timing, as well as
+  * the event type information from the hardware.
+  *
+- * add_interrupt_randomness() uses the inter-interrupt timing as random
+- * inputs to the entropy pool.  Note that not all interrupts are good
+- * sources of randomness!  For example, the timer interrupts is not a
+- * good choice, because the periodicity of the interrupts is too
+- * regular, and hence predictable to an attacker.  Network Interface
+- * Controller interrupts are a better measure, since the timing of the
+- * NIC interrupts are more unpredictable.
++ * add_interrupt_randomness() uses the interrupt timing as random
++ * inputs to the entropy pool. Using the cycle counters and the irq source
++ * as inputs, it feeds the randomness roughly once a second.
++ *
++ * add_device_randomness() is for adding data to the random pool that
++ * is likely to differ between two devices (or possibly even per boot).
++ * This would be things like MAC addresses or serial numbers, or the
++ * read-out of the RTC. This does *not* add any actual entropy to the
++ * pool, but it initializes the pool to different values for devices
++ * that might otherwise be identical and have very little entropy
++ * available to them (particularly common in the embedded world).
+  *
+  * add_disk_randomness() uses what amounts to the seek time of block
+  * layer request events, on a per-disk_devt basis, as input to the
+@@ -248,6 +253,7 @@
+ #include <linux/percpu.h>
+ #include <linux/cryptohash.h>
+ #include <linux/fips.h>
++#include <linux/ptrace.h>
+ 
+ #ifdef CONFIG_GENERIC_HARDIRQS
+ # include <linux/irq.h>
+@@ -256,8 +262,12 @@
+ #include <asm/processor.h>
+ #include <asm/uaccess.h>
+ #include <asm/irq.h>
++#include <asm/irq_regs.h>
+ #include <asm/io.h>
+ 
++#define CREATE_TRACE_POINTS
++#include <trace/events/random.h>
++
+ /*
+  * Configuration information
+  */
+@@ -420,8 +430,10 @@ struct entropy_store {
+ 	/* read-write data: */
+ 	spinlock_t lock;
+ 	unsigned add_ptr;
++	unsigned input_rotate;
+ 	int entropy_count;
+-	int input_rotate;
++	int entropy_total;
++	unsigned int initialized:1;
+ 	__u8 last_data[EXTRACT_SIZE];
+ };
+ 
+@@ -454,6 +466,10 @@ static struct entropy_store nonblocking_
+ 	.pool = nonblocking_pool_data
+ };
+ 
++static __u32 const twist_table[8] = {
++	0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
++	0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
++
+ /*
+  * This function adds bytes into the entropy "pool".  It does not
+  * update the entropy estimate.  The caller should call
+@@ -464,29 +480,24 @@ static struct entropy_store nonblocking_
+  * it's cheap to do so and helps slightly in the expected case where
+  * the entropy is concentrated in the low-order bits.
+  */
+-static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
+-				   int nbytes, __u8 out[64])
++static void _mix_pool_bytes(struct entropy_store *r, const void *in,
++			    int nbytes, __u8 out[64])
+ {
+-	static __u32 const twist_table[8] = {
+-		0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
+-		0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
+ 	unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
+ 	int input_rotate;
+ 	int wordmask = r->poolinfo->poolwords - 1;
+ 	const char *bytes = in;
+ 	__u32 w;
+-	unsigned long flags;
+ 
+-	/* Taps are constant, so we can load them without holding r->lock.  */
+ 	tap1 = r->poolinfo->tap1;
+ 	tap2 = r->poolinfo->tap2;
+ 	tap3 = r->poolinfo->tap3;
+ 	tap4 = r->poolinfo->tap4;
+ 	tap5 = r->poolinfo->tap5;
+ 
+-	spin_lock_irqsave(&r->lock, flags);
+-	input_rotate = r->input_rotate;
+-	i = r->add_ptr;
++	smp_rmb();
++	input_rotate = ACCESS_ONCE(r->input_rotate);
++	i = ACCESS_ONCE(r->add_ptr);
+ 
+ 	/* mix one byte at a time to simplify size handling and churn faster */
+ 	while (nbytes--) {
+@@ -513,19 +524,61 @@ static void mix_pool_bytes_extract(struc
+ 		input_rotate += i ? 7 : 14;
+ 	}
+ 
+-	r->input_rotate = input_rotate;
+-	r->add_ptr = i;
++	ACCESS_ONCE(r->input_rotate) = input_rotate;
++	ACCESS_ONCE(r->add_ptr) = i;
++	smp_wmb();
+ 
+ 	if (out)
+ 		for (j = 0; j < 16; j++)
+ 			((__u32 *)out)[j] = r->pool[(i - j) & wordmask];
++}
++
++static void __mix_pool_bytes(struct entropy_store *r, const void *in,
++			     int nbytes, __u8 out[64])
++{
++	trace_mix_pool_bytes_nolock(r->name, nbytes, _RET_IP_);
++	_mix_pool_bytes(r, in, nbytes, out);
++}
+ 
++static void mix_pool_bytes(struct entropy_store *r, const void *in,
++			   int nbytes, __u8 out[64])
++{
++	unsigned long flags;
++
++	trace_mix_pool_bytes(r->name, nbytes, _RET_IP_);
++	spin_lock_irqsave(&r->lock, flags);
++	_mix_pool_bytes(r, in, nbytes, out);
+ 	spin_unlock_irqrestore(&r->lock, flags);
+ }
+ 
+-static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
++struct fast_pool {
++	__u32		pool[4];
++	unsigned long	last;
++	unsigned short	count;
++	unsigned char	rotate;
++	unsigned char	last_timer_intr;
++};
++
++/*
++ * This is a fast mixing routine used by the interrupt randomness
++ * collector.  It's hardcoded for an 128 bit pool and assumes that any
++ * locks that might be needed are taken by the caller.
++ */
++static void fast_mix(struct fast_pool *f, const void *in, int nbytes)
+ {
+-       mix_pool_bytes_extract(r, in, bytes, NULL);
++	const char	*bytes = in;
++	__u32		w;
++	unsigned	i = f->count;
++	unsigned	input_rotate = f->rotate;
++
++	while (nbytes--) {
++		w = rol32(*bytes++, input_rotate & 31) ^ f->pool[i & 3] ^
++			f->pool[(i + 1) & 3];
++		f->pool[i & 3] = (w >> 3) ^ twist_table[w & 7];
++		input_rotate += (i++ & 3) ? 7 : 14;
++	}
++	f->count = i;
++	f->rotate = input_rotate;
+ }
+ 
+ /*
+@@ -533,30 +586,38 @@ static void mix_pool_bytes(struct entrop
+  */
+ static void credit_entropy_bits(struct entropy_store *r, int nbits)
+ {
+-	unsigned long flags;
+-	int entropy_count;
++	int entropy_count, orig;
+ 
+ 	if (!nbits)
+ 		return;
+ 
+-	spin_lock_irqsave(&r->lock, flags);
+-
+ 	DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
+-	entropy_count = r->entropy_count;
++retry:
++	entropy_count = orig = ACCESS_ONCE(r->entropy_count);
+ 	entropy_count += nbits;
++
+ 	if (entropy_count < 0) {
+ 		DEBUG_ENT("negative entropy/overflow\n");
+ 		entropy_count = 0;
+ 	} else if (entropy_count > r->poolinfo->POOLBITS)
+ 		entropy_count = r->poolinfo->POOLBITS;
+-	r->entropy_count = entropy_count;
++	if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
++		goto retry;
++
++	if (!r->initialized && nbits > 0) {
++		r->entropy_total += nbits;
++		if (r->entropy_total > 128)
++			r->initialized = 1;
++	}
++
++	trace_credit_entropy_bits(r->name, nbits, entropy_count,
++				  r->entropy_total, _RET_IP_);
+ 
+ 	/* should we wake readers? */
+ 	if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
+ 		wake_up_interruptible(&random_read_wait);
+ 		kill_fasync(&fasync, SIGIO, POLL_IN);
+ 	}
+-	spin_unlock_irqrestore(&r->lock, flags);
+ }
+ 
+ /*********************************************************************
+@@ -609,6 +670,25 @@ static void set_timer_rand_state(unsigne
+ }
+ #endif
+ 
++/*
++ * Add device- or boot-specific data to the input and nonblocking
++ * pools to help initialize them to unique values.
++ *
++ * None of this adds any entropy, it is meant to avoid the
++ * problem of the nonblocking pool having similar initial state
++ * across largely identical devices.
++ */
++void add_device_randomness(const void *buf, unsigned int size)
++{
++	unsigned long time = get_cycles() ^ jiffies;
++
++	mix_pool_bytes(&input_pool, buf, size, NULL);
++	mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
++	mix_pool_bytes(&nonblocking_pool, buf, size, NULL);
++	mix_pool_bytes(&nonblocking_pool, &time, sizeof(time), NULL);
++}
++EXPORT_SYMBOL(add_device_randomness);
++
+ static struct timer_rand_state input_timer_state;
+ 
+ /*
+@@ -637,13 +717,9 @@ static void add_timer_randomness(struct
+ 		goto out;
+ 
+ 	sample.jiffies = jiffies;
+-
+-	/* Use arch random value, fall back to cycles */
+-	if (!arch_get_random_int(&sample.cycles))
+-		sample.cycles = get_cycles();
+-
++	sample.cycles = get_cycles();
+ 	sample.num = num;
+-	mix_pool_bytes(&input_pool, &sample, sizeof(sample));
++	mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
+ 
+ 	/*
+ 	 * Calculate number of bits of randomness we probably added.
+@@ -700,17 +776,48 @@ void add_input_randomness(unsigned int t
+ }
+ EXPORT_SYMBOL_GPL(add_input_randomness);
+ 
+-void add_interrupt_randomness(int irq)
++static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
++
++void add_interrupt_randomness(int irq, int irq_flags)
+ {
+-	struct timer_rand_state *state;
++	struct entropy_store	*r;
++	struct fast_pool	*fast_pool = &__get_cpu_var(irq_randomness);
++	struct pt_regs		*regs = get_irq_regs();
++	unsigned long		now = jiffies;
++	__u32			input[4], cycles = get_cycles();
++
++	input[0] = cycles ^ jiffies;
++	input[1] = irq;
++	if (regs) {
++		__u64 ip = instruction_pointer(regs);
++		input[2] = ip;
++		input[3] = ip >> 32;
++	}
+ 
+-	state = get_timer_rand_state(irq);
++	fast_mix(fast_pool, input, sizeof(input));
+ 
+-	if (state == NULL)
++	if ((fast_pool->count & 1023) &&
++	    !time_after(now, fast_pool->last + HZ))
+ 		return;
+ 
+-	DEBUG_ENT("irq event %d\n", irq);
+-	add_timer_randomness(state, 0x100 + irq);
++	fast_pool->last = now;
++
++	r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
++	__mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool), NULL);
++	/*
++	 * If we don't have a valid cycle counter, and we see
++	 * back-to-back timer interrupts, then skip giving credit for
++	 * any entropy.
++	 */
++	if (cycles == 0) {
++		if (irq_flags & __IRQF_TIMER) {
++			if (fast_pool->last_timer_intr)
++				return;
++			fast_pool->last_timer_intr = 1;
++		} else
++			fast_pool->last_timer_intr = 0;
++	}
++	credit_entropy_bits(r, 1);
+ }
+ 
+ #ifdef CONFIG_BLOCK
+@@ -742,7 +849,11 @@ static ssize_t extract_entropy(struct en
+  */
+ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
+ {
+-	__u32 tmp[OUTPUT_POOL_WORDS];
++	union {
++		__u32	tmp[OUTPUT_POOL_WORDS];
++		long	hwrand[4];
++	} u;
++	int	i;
+ 
+ 	if (r->pull && r->entropy_count < nbytes * 8 &&
+ 	    r->entropy_count < r->poolinfo->POOLBITS) {
+@@ -753,17 +864,22 @@ static void xfer_secondary_pool(struct e
+ 		/* pull at least as many as BYTES as wakeup BITS */
+ 		bytes = max_t(int, bytes, random_read_wakeup_thresh / 8);
+ 		/* but never more than the buffer size */
+-		bytes = min_t(int, bytes, sizeof(tmp));
++		bytes = min_t(int, bytes, sizeof(u.tmp));
+ 
+ 		DEBUG_ENT("going to reseed %s with %d bits "
+ 			  "(%d of %d requested)\n",
+ 			  r->name, bytes * 8, nbytes * 8, r->entropy_count);
+ 
+-		bytes = extract_entropy(r->pull, tmp, bytes,
++		bytes = extract_entropy(r->pull, u.tmp, bytes,
+ 					random_read_wakeup_thresh / 8, rsvd);
+-		mix_pool_bytes(r, tmp, bytes);
++		mix_pool_bytes(r, u.tmp, bytes, NULL);
+ 		credit_entropy_bits(r, bytes*8);
+ 	}
++	for (i = 0; i < 4; i++)
++		if (arch_get_random_long(&u.hwrand[i]))
++			break;
++	if (i)
++		mix_pool_bytes(r, &u.hwrand, i * sizeof(u.hwrand[0]), 0);
+ }
+ 
+ /*
+@@ -822,9 +938,11 @@ static void extract_buf(struct entropy_s
+ 	int i;
+ 	__u32 hash[5], workspace[SHA_WORKSPACE_WORDS];
+ 	__u8 extract[64];
++	unsigned long flags;
+ 
+ 	/* Generate a hash across the pool, 16 words (512 bits) at a time */
+ 	sha_init(hash);
++	spin_lock_irqsave(&r->lock, flags);
+ 	for (i = 0; i < r->poolinfo->poolwords; i += 16)
+ 		sha_transform(hash, (__u8 *)(r->pool + i), workspace);
+ 
+@@ -837,7 +955,8 @@ static void extract_buf(struct entropy_s
+ 	 * brute-forcing the feedback as hard as brute-forcing the
+ 	 * hash.
+ 	 */
+-	mix_pool_bytes_extract(r, hash, sizeof(hash), extract);
++	__mix_pool_bytes(r, hash, sizeof(hash), extract);
++	spin_unlock_irqrestore(&r->lock, flags);
+ 
+ 	/*
+ 	 * To avoid duplicates, we atomically extract a portion of the
+@@ -860,12 +979,12 @@ static void extract_buf(struct entropy_s
+ }
+ 
+ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+-			       size_t nbytes, int min, int reserved)
++				 size_t nbytes, int min, int reserved)
+ {
+ 	ssize_t ret = 0, i;
+ 	__u8 tmp[EXTRACT_SIZE];
+-	unsigned long flags;
+ 
++	trace_extract_entropy(r->name, nbytes, r->entropy_count, _RET_IP_);
+ 	xfer_secondary_pool(r, nbytes);
+ 	nbytes = account(r, nbytes, min, reserved);
+ 
+@@ -873,6 +992,8 @@ static ssize_t extract_entropy(struct en
+ 		extract_buf(r, tmp);
+ 
+ 		if (fips_enabled) {
++			unsigned long flags;
++
+ 			spin_lock_irqsave(&r->lock, flags);
+ 			if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
+ 				panic("Hardware RNG duplicated output!\n");
+@@ -898,6 +1019,7 @@ static ssize_t extract_entropy_user(stru
+ 	ssize_t ret = 0, i;
+ 	__u8 tmp[EXTRACT_SIZE];
+ 
++	trace_extract_entropy_user(r->name, nbytes, r->entropy_count, _RET_IP_);
+ 	xfer_secondary_pool(r, nbytes);
+ 	nbytes = account(r, nbytes, 0, 0);
+ 
+@@ -931,17 +1053,35 @@ static ssize_t extract_entropy_user(stru
+ 
+ /*
+  * This function is the exported kernel interface.  It returns some
+- * number of good random numbers, suitable for seeding TCP sequence
+- * numbers, etc.
++ * number of good random numbers, suitable for key generation, seeding
++ * TCP sequence numbers, etc.  It does not use the hw random number
++ * generator, if available; use get_random_bytes_arch() for that.
+  */
+ void get_random_bytes(void *buf, int nbytes)
+ {
++	extract_entropy(&nonblocking_pool, buf, nbytes, 0, 0);
++}
++EXPORT_SYMBOL(get_random_bytes);
++
++/*
++ * This function will use the architecture-specific hardware random
++ * number generator if it is available.  The arch-specific hw RNG will
++ * almost certainly be faster than what we can do in software, but it
++ * is impossible to verify that it is implemented securely (as
++ * opposed, to, say, the AES encryption of a sequence number using a
++ * key known by the NSA).  So it's useful if we need the speed, but
++ * only if we're willing to trust the hardware manufacturer not to
++ * have put in a back door.
++ */
++void get_random_bytes_arch(void *buf, int nbytes)
++{
+ 	char *p = buf;
+ 
++	trace_get_random_bytes(nbytes, _RET_IP_);
+ 	while (nbytes) {
+ 		unsigned long v;
+ 		int chunk = min(nbytes, (int)sizeof(unsigned long));
+-		
++
+ 		if (!arch_get_random_long(&v))
+ 			break;
+ 		
+@@ -950,9 +1090,11 @@ void get_random_bytes(void *buf, int nby
+ 		nbytes -= chunk;
+ 	}
+ 
+-	extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
++	if (nbytes)
++		extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
+ }
+-EXPORT_SYMBOL(get_random_bytes);
++EXPORT_SYMBOL(get_random_bytes_arch);
++
+ 
+ /*
+  * init_std_data - initialize pool with system data
+@@ -966,21 +1108,18 @@ EXPORT_SYMBOL(get_random_bytes);
+ static void init_std_data(struct entropy_store *r)
+ {
+ 	int i;
+-	ktime_t now;
+-	unsigned long flags;
++	ktime_t now = ktime_get_real();
++	unsigned long rv;
+ 
+-	spin_lock_irqsave(&r->lock, flags);
+ 	r->entropy_count = 0;
+-	spin_unlock_irqrestore(&r->lock, flags);
+-
+-	now = ktime_get_real();
+-	mix_pool_bytes(r, &now, sizeof(now));
+-	for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof flags) {
+-		if (!arch_get_random_long(&flags))
++	r->entropy_total = 0;
++	mix_pool_bytes(r, &now, sizeof(now), NULL);
++	for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
++		if (!arch_get_random_long(&rv))
+ 			break;
+-		mix_pool_bytes(r, &flags, sizeof(flags));
++		mix_pool_bytes(r, &rv, sizeof(rv), NULL);
+ 	}
+-	mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
++	mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
+ }
+ 
+ static int rand_initialize(void)
+@@ -1117,7 +1256,7 @@ write_pool(struct entropy_store *r, cons
+ 		count -= bytes;
+ 		p += bytes;
+ 
+-		mix_pool_bytes(r, buf, bytes);
++		mix_pool_bytes(r, buf, bytes, NULL);
+ 		cond_resched();
+ 	}
+ 
+@@ -1274,6 +1413,7 @@ static int proc_do_uuid(ctl_table *table
+ }
+ 
+ static int sysctl_poolsize = INPUT_POOL_WORDS * 32;
++extern ctl_table random_table[];
+ ctl_table random_table[] = {
+ 	{
+ 		.procname	= "poolsize",
+@@ -1339,7 +1479,7 @@ late_initcall(random_int_secret_init);
+  * value is not cryptographically secure but for several uses the cost of
+  * depleting entropy is too high
+  */
+-DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
++static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
+ unsigned int get_random_int(void)
+ {
+ 	__u32 *hash;
+--- a/drivers/mfd/ab3100-core.c
++++ b/drivers/mfd/ab3100-core.c
+@@ -409,8 +409,6 @@ static irqreturn_t ab3100_irq_handler(in
+ 	u32 fatevent;
+ 	int err;
+ 
+-	add_interrupt_randomness(irq);
+-
+ 	err = ab3100_get_register_page_interruptible(ab3100, AB3100_EVENTA1,
+ 				       event_regs, 3);
+ 	if (err)
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -24,6 +24,7 @@
+ #include <linux/kthread.h>
+ #include <linux/mutex.h>
+ #include <linux/freezer.h>
++#include <linux/random.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/byteorder.h>
+@@ -1896,6 +1897,14 @@ int usb_new_device(struct usb_device *ud
+ 	/* Tell the world! */
+ 	announce_device(udev);
+ 
++	if (udev->serial)
++		add_device_randomness(udev->serial, strlen(udev->serial));
++	if (udev->product)
++		add_device_randomness(udev->product, strlen(udev->product));
++	if (udev->manufacturer)
++		add_device_randomness(udev->manufacturer,
++				      strlen(udev->manufacturer));
++
+ 	device_enable_async_suspend(&udev->dev);
+ 	/* Register the device.  The device driver is responsible
+ 	 * for configuring the device and invoking the add-device
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -50,11 +50,13 @@ struct rnd_state {
+ 
+ extern void rand_initialize_irq(int irq);
+ 
++extern void add_device_randomness(const void *, unsigned int);
+ extern void add_input_randomness(unsigned int type, unsigned int code,
+ 				 unsigned int value);
+-extern void add_interrupt_randomness(int irq);
++extern void add_interrupt_randomness(int irq, int irq_flags);
+ 
+ extern void get_random_bytes(void *buf, int nbytes);
++extern void get_random_bytes_arch(void *buf, int nbytes);
+ void generate_random_uuid(unsigned char uuid_out[16]);
+ 
+ #ifndef MODULE
+--- /dev/null
++++ b/include/trace/events/random.h
+@@ -0,0 +1,134 @@
++#undef TRACE_SYSTEM
++#define TRACE_SYSTEM random
++
++#if !defined(_TRACE_RANDOM_H) || defined(TRACE_HEADER_MULTI_READ)
++#define _TRACE_RANDOM_H
++
++#include <linux/writeback.h>
++#include <linux/tracepoint.h>
++
++DECLARE_EVENT_CLASS(random__mix_pool_bytes,
++	TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
++
++	TP_ARGS(pool_name, bytes, IP),
++
++	TP_STRUCT__entry(
++		__field( const char *,	pool_name		)
++		__field(	  int,	bytes			)
++		__field(unsigned long,	IP			)
++	),
++
++	TP_fast_assign(
++		__entry->pool_name	= pool_name;
++		__entry->bytes		= bytes;
++		__entry->IP		= IP;
++	),
++
++	TP_printk("%s pool: bytes %d caller %pF",
++		  __entry->pool_name, __entry->bytes, (void *)__entry->IP)
++);
++
++DEFINE_EVENT(random__mix_pool_bytes, mix_pool_bytes,
++	TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
++
++	TP_ARGS(pool_name, bytes, IP)
++);
++
++DEFINE_EVENT(random__mix_pool_bytes, mix_pool_bytes_nolock,
++	TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
++
++	TP_ARGS(pool_name, bytes, IP)
++);
++
++TRACE_EVENT(credit_entropy_bits,
++	TP_PROTO(const char *pool_name, int bits, int entropy_count,
++		 int entropy_total, unsigned long IP),
++
++	TP_ARGS(pool_name, bits, entropy_count, entropy_total, IP),
++
++	TP_STRUCT__entry(
++		__field( const char *,	pool_name		)
++		__field(	  int,	bits			)
++		__field(	  int,	entropy_count		)
++		__field(	  int,	entropy_total		)
++		__field(unsigned long,	IP			)
++	),
++
++	TP_fast_assign(
++		__entry->pool_name	= pool_name;
++		__entry->bits		= bits;
++		__entry->entropy_count	= entropy_count;
++		__entry->entropy_total	= entropy_total;
++		__entry->IP		= IP;
++	),
++
++	TP_printk("%s pool: bits %d entropy_count %d entropy_total %d "
++		  "caller %pF", __entry->pool_name, __entry->bits,
++		  __entry->entropy_count, __entry->entropy_total,
++		  (void *)__entry->IP)
++);
++
++TRACE_EVENT(get_random_bytes,
++	TP_PROTO(int nbytes, unsigned long IP),
++
++	TP_ARGS(nbytes, IP),
++
++	TP_STRUCT__entry(
++		__field(	  int,	nbytes			)
++		__field(unsigned long,	IP			)
++	),
++
++	TP_fast_assign(
++		__entry->nbytes		= nbytes;
++		__entry->IP		= IP;
++	),
++
++	TP_printk("nbytes %d caller %pF", __entry->nbytes, (void *)__entry->IP)
++);
++
++DECLARE_EVENT_CLASS(random__extract_entropy,
++	TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
++		 unsigned long IP),
++
++	TP_ARGS(pool_name, nbytes, entropy_count, IP),
++
++	TP_STRUCT__entry(
++		__field( const char *,	pool_name		)
++		__field(	  int,	nbytes			)
++		__field(	  int,	entropy_count		)
++		__field(unsigned long,	IP			)
++	),
++
++	TP_fast_assign(
++		__entry->pool_name	= pool_name;
++		__entry->nbytes		= nbytes;
++		__entry->entropy_count	= entropy_count;
++		__entry->IP		= IP;
++	),
++
++	TP_printk("%s pool: nbytes %d entropy_count %d caller %pF",
++		  __entry->pool_name, __entry->nbytes, __entry->entropy_count,
++		  (void *)__entry->IP)
++);
++
++
++DEFINE_EVENT(random__extract_entropy, extract_entropy,
++	TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
++		 unsigned long IP),
++
++	TP_ARGS(pool_name, nbytes, entropy_count, IP)
++);
++
++DEFINE_EVENT(random__extract_entropy, extract_entropy_user,
++	TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
++		 unsigned long IP),
++
++	TP_ARGS(pool_name, nbytes, entropy_count, IP)
++);
++
++
++
++#endif /* _TRACE_RANDOM_H */
++
++/* This part must be outside protection */
++#include <trace/define_trace.h>
+--- a/kernel/irq/handle.c
++++ b/kernel/irq/handle.c
+@@ -117,7 +117,7 @@ irqreturn_t
+ handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action)
+ {
+ 	irqreturn_t retval = IRQ_NONE;
+-	unsigned int random = 0, irq = desc->irq_data.irq;
++	unsigned int flags = 0, irq = desc->irq_data.irq;
+ 
+ 	do {
+ 		irqreturn_t res;
+@@ -145,7 +145,7 @@ handle_irq_event_percpu(struct irq_desc
+ 
+ 			/* Fall through to add to randomness */
+ 		case IRQ_HANDLED:
+-			random |= action->flags;
++			flags |= action->flags;
+ 			break;
+ 
+ 		default:
+@@ -156,8 +156,7 @@ handle_irq_event_percpu(struct irq_desc
+ 		action = action->next;
+ 	} while (action);
+ 
+-	if (random & IRQF_SAMPLE_RANDOM)
+-		add_interrupt_randomness(irq);
++	add_interrupt_randomness(irq, flags);
+ 
+ 	if (!noirqdebug)
+ 		note_interrupt(irq, desc, retval);
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1176,6 +1176,7 @@ static int __dev_open(struct net_device
+ 		net_dmaengine_get();
+ 		dev_set_rx_mode(dev);
+ 		dev_activate(dev);
++		add_device_randomness(dev->dev_addr, dev->addr_len);
+ 	}
+ 
+ 	return ret;
+@@ -4823,6 +4824,7 @@ int dev_set_mac_address(struct net_devic
+ 	err = ops->ndo_set_mac_address(dev, sa);
+ 	if (!err)
+ 		call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
++	add_device_randomness(dev->dev_addr, dev->addr_len);
+ 	return err;
+ }
+ EXPORT_SYMBOL(dev_set_mac_address);
+@@ -5602,6 +5604,7 @@ int register_netdevice(struct net_device
+ 	dev_init_scheduler(dev);
+ 	dev_hold(dev);
+ 	list_netdevice(dev);
++	add_device_randomness(dev->dev_addr, dev->addr_len);
+ 
+ 	/* Notify protocols, that a new device appeared. */
+ 	ret = call_netdevice_notifiers(NETDEV_REGISTER, dev);
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1371,6 +1371,7 @@ static int do_setlink(struct net_device
+ 			goto errout;
+ 		send_addr_notify = 1;
+ 		modified = 1;
++		add_device_randomness(dev->dev_addr, dev->addr_len);
+ 	}
+ 
+ 	if (tb[IFLA_MTU]) {
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/051-rng_git_backport-remove_irqf_sample_random.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/051-rng_git_backport-remove_irqf_sample_random.patch.svn-base
new file mode 100644
index 0000000..93706ed
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/051-rng_git_backport-remove_irqf_sample_random.patch.svn-base
@@ -0,0 +1,543 @@
+--- a/arch/arm/mach-omap1/board-palmz71.c
++++ b/arch/arm/mach-omap1/board-palmz71.c
+@@ -291,8 +291,7 @@ palmz71_gpio_setup(int early)
+ 		}
+ 		gpio_direction_input(PALMZ71_USBDETECT_GPIO);
+ 		if (request_irq(gpio_to_irq(PALMZ71_USBDETECT_GPIO),
+-				palmz71_powercable, IRQF_SAMPLE_RANDOM,
+-				"palmz71-cable", 0))
++				palmz71_powercable, 0, "palmz71-cable", 0))
+ 			printk(KERN_ERR
+ 					"IRQ request for power cable failed!\n");
+ 		palmz71_powercable(gpio_to_irq(PALMZ71_USBDETECT_GPIO), 0);
+--- a/arch/arm/mach-pxa/lubbock.c
++++ b/arch/arm/mach-pxa/lubbock.c
+@@ -455,7 +455,7 @@ static int lubbock_mci_init(struct devic
+ 	init_timer(&mmc_timer);
+ 	mmc_timer.data = (unsigned long) data;
+ 	return request_irq(LUBBOCK_SD_IRQ, lubbock_detect_int,
+-			IRQF_SAMPLE_RANDOM, "lubbock-sd-detect", data);
++			   0, "lubbock-sd-detect", data);
+ }
+ 
+ static int lubbock_mci_get_ro(struct device *dev)
+--- a/arch/arm/mach-pxa/magician.c
++++ b/arch/arm/mach-pxa/magician.c
+@@ -617,9 +617,8 @@ static struct platform_device bq24022 =
+ static int magician_mci_init(struct device *dev,
+ 				irq_handler_t detect_irq, void *data)
+ {
+-	return request_irq(IRQ_MAGICIAN_SD, detect_irq,
+-				IRQF_DISABLED | IRQF_SAMPLE_RANDOM,
+-				"mmc card detect", data);
++	return request_irq(IRQ_MAGICIAN_SD, detect_irq, IRQF_DISABLED,
++			   "mmc card detect", data);
+ }
+ 
+ static void magician_mci_exit(struct device *dev, void *data)
+--- a/arch/arm/mach-pxa/trizeps4.c
++++ b/arch/arm/mach-pxa/trizeps4.c
+@@ -332,8 +332,8 @@ static int trizeps4_mci_init(struct devi
+ 	int err;
+ 
+ 	err = request_irq(TRIZEPS4_MMC_IRQ, mci_detect_int,
+-		IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_SAMPLE_RANDOM,
+-		"MMC card detect", data);
++			  IRQF_DISABLED | IRQF_TRIGGER_RISING,
++			  "MMC card detect", data);
+ 	if (err) {
+ 		printk(KERN_ERR "trizeps4_mci_init: MMC/SD: can't request"
+ 						"MMC card detect IRQ\n");
+--- a/arch/ia64/kernel/irq_ia64.c
++++ b/arch/ia64/kernel/irq_ia64.c
+@@ -23,7 +23,6 @@
+ #include <linux/ioport.h>
+ #include <linux/kernel_stat.h>
+ #include <linux/ptrace.h>
+-#include <linux/random.h>	/* for rand_initialize_irq() */
+ #include <linux/signal.h>
+ #include <linux/smp.h>
+ #include <linux/threads.h>
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1250,14 +1250,12 @@ int ldc_bind(struct ldc_channel *lp, con
+ 	snprintf(lp->rx_irq_name, LDC_IRQ_NAME_MAX, "%s RX", name);
+ 	snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
+ 
+-	err = request_irq(lp->cfg.rx_irq, ldc_rx,
+-			  IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
++	err = request_irq(lp->cfg.rx_irq, ldc_rx, IRQF_DISABLED,
+ 			  lp->rx_irq_name, lp);
+ 	if (err)
+ 		return err;
+ 
+-	err = request_irq(lp->cfg.tx_irq, ldc_tx,
+-			  IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
++	err = request_irq(lp->cfg.tx_irq, ldc_tx, IRQF_DISABLED,
+ 			  lp->tx_irq_name, lp);
+ 	if (err) {
+ 		free_irq(lp->cfg.rx_irq, lp);
+--- a/arch/um/drivers/line.c
++++ b/arch/um/drivers/line.c
+@@ -371,7 +371,7 @@ static irqreturn_t line_write_interrupt(
+ int line_setup_irq(int fd, int input, int output, struct line *line, void *data)
+ {
+ 	const struct line_driver *driver = line->driver;
+-	int err = 0, flags = IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM;
++	int err = 0, flags = IRQF_DISABLED | IRQF_SHARED;
+ 
+ 	if (input)
+ 		err = um_request_irq(driver->read_irq, fd, IRQ_READ,
+@@ -807,7 +807,7 @@ void register_winch_irq(int fd, int tty_
+ 				   .stack	= stack });
+ 
+ 	if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
+-			   IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
++			   IRQF_DISABLED | IRQF_SHARED,
+ 			   "winch", winch) < 0) {
+ 		printk(KERN_ERR "register_winch_irq - failed to register "
+ 		       "IRQ\n");
+--- a/arch/um/drivers/mconsole_kern.c
++++ b/arch/um/drivers/mconsole_kern.c
+@@ -773,7 +773,7 @@ static int __init mconsole_init(void)
+ 	register_reboot_notifier(&reboot_notifier);
+ 
+ 	err = um_request_irq(MCONSOLE_IRQ, sock, IRQ_READ, mconsole_interrupt,
+-			     IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
++			     IRQF_DISABLED | IRQF_SHARED,
+ 			     "mconsole", (void *)sock);
+ 	if (err) {
+ 		printk(KERN_ERR "Failed to get IRQ for management console\n");
+--- a/arch/um/drivers/port_kern.c
++++ b/arch/um/drivers/port_kern.c
+@@ -100,7 +100,7 @@ static int port_accept(struct port_list
+ 		  .port 	= port });
+ 
+ 	if (um_request_irq(TELNETD_IRQ, socket[0], IRQ_READ, pipe_interrupt,
+-			  IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
++			  IRQF_DISABLED | IRQF_SHARED,
+ 			  "telnetd", conn)) {
+ 		printk(KERN_ERR "port_accept : failed to get IRQ for "
+ 		       "telnetd\n");
+@@ -184,7 +184,7 @@ void *port_data(int port_num)
+ 	}
+ 
+ 	if (um_request_irq(ACCEPT_IRQ, fd, IRQ_READ, port_interrupt,
+-			  IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
++			  IRQF_DISABLED | IRQF_SHARED,
+ 			  "port", port)) {
+ 		printk(KERN_ERR "Failed to get IRQ for port %d\n", port_num);
+ 		goto out_close;
+--- a/arch/um/drivers/random.c
++++ b/arch/um/drivers/random.c
+@@ -131,8 +131,7 @@ static int __init rng_init (void)
+ 	random_fd = err;
+ 
+ 	err = um_request_irq(RANDOM_IRQ, random_fd, IRQ_READ, random_interrupt,
+-			     IRQF_DISABLED | IRQF_SAMPLE_RANDOM, "random",
+-			     NULL);
++			     IRQF_DISABLED, "random", NULL);
+ 	if (err)
+ 		goto err_out_cleanup_hw;
+ 
+--- a/arch/um/drivers/xterm_kern.c
++++ b/arch/um/drivers/xterm_kern.c
+@@ -50,8 +50,7 @@ int xterm_fd(int socket, int *pid_out)
+ 	init_completion(&data->ready);
+ 
+ 	err = um_request_irq(XTERM_IRQ, socket, IRQ_READ, xterm_interrupt,
+-			     IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
+-			     "xterm", data);
++			     IRQF_DISABLED | IRQF_SHARED, "xterm", data);
+ 	if (err) {
+ 		printk(KERN_ERR "xterm_fd : failed to get IRQ for xterm, "
+ 		       "err = %d\n",  err);
+--- a/arch/um/kernel/sigio.c
++++ b/arch/um/kernel/sigio.c
+@@ -25,8 +25,7 @@ int write_sigio_irq(int fd)
+ 	int err;
+ 
+ 	err = um_request_irq(SIGIO_WRITE_IRQ, fd, IRQ_READ, sigio_interrupt,
+-			     IRQF_DISABLED|IRQF_SAMPLE_RANDOM, "write sigio",
+-			     NULL);
++			     IRQF_DISABLED, "write sigio", NULL);
+ 	if (err) {
+ 		printk(KERN_ERR "write_sigio_irq : um_request_irq failed, "
+ 		       "err = %d\n", err);
+--- a/Documentation/feature-removal-schedule.txt
++++ b/Documentation/feature-removal-schedule.txt
+@@ -71,20 +71,6 @@ Who:	Luis R. Rodriguez <lrodriguez@ather
+ 
+ ---------------------------
+ 
+-What:	IRQF_SAMPLE_RANDOM
+-Check:	IRQF_SAMPLE_RANDOM
+-When:	July 2009
+-
+-Why:	Many of IRQF_SAMPLE_RANDOM users are technically bogus as entropy
+-	sources in the kernel's current entropy model. To resolve this, every
+-	input point to the kernel's entropy pool needs to better document the
+-	type of entropy source it actually is. This will be replaced with
+-	additional add_*_randomness functions in drivers/char/random.c
+-
+-Who:	Robin Getz <rgetz@blackfin.uclinux.org> & Matt Mackall <mpm@selenic.com>
+-
+----------------------------
+-
+ What:	The ieee80211_regdom module parameter
+ When:	March 2010 / desktop catchup
+ 
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -852,9 +852,8 @@ static int setup_blkring(struct xenbus_d
+ 	if (err)
+ 		goto fail;
+ 
+-	err = bind_evtchn_to_irqhandler(info->evtchn,
+-					blkif_interrupt,
+-					IRQF_SAMPLE_RANDOM, "blkif", info);
++	err = bind_evtchn_to_irqhandler(info->evtchn, blkif_interrupt, 0,
++					"blkif", info);
+ 	if (err <= 0) {
+ 		xenbus_dev_fatal(dev, err,
+ 				 "bind_evtchn_to_irqhandler failed");
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -633,43 +633,6 @@ struct timer_rand_state {
+ 	unsigned dont_count_entropy:1;
+ };
+ 
+-#ifndef CONFIG_GENERIC_HARDIRQS
+-
+-static struct timer_rand_state *irq_timer_state[NR_IRQS];
+-
+-static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
+-{
+-	return irq_timer_state[irq];
+-}
+-
+-static void set_timer_rand_state(unsigned int irq,
+-				 struct timer_rand_state *state)
+-{
+-	irq_timer_state[irq] = state;
+-}
+-
+-#else
+-
+-static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
+-{
+-	struct irq_desc *desc;
+-
+-	desc = irq_to_desc(irq);
+-
+-	return desc->timer_rand_state;
+-}
+-
+-static void set_timer_rand_state(unsigned int irq,
+-				 struct timer_rand_state *state)
+-{
+-	struct irq_desc *desc;
+-
+-	desc = irq_to_desc(irq);
+-
+-	desc->timer_rand_state = state;
+-}
+-#endif
+-
+ /*
+  * Add device- or boot-specific data to the input and nonblocking
+  * pools to help initialize them to unique values.
+@@ -1131,24 +1094,6 @@ static int rand_initialize(void)
+ }
+ module_init(rand_initialize);
+ 
+-void rand_initialize_irq(int irq)
+-{
+-	struct timer_rand_state *state;
+-
+-	state = get_timer_rand_state(irq);
+-
+-	if (state)
+-		return;
+-
+-	/*
+-	 * If kzalloc returns null, we just won't use that entropy
+-	 * source.
+-	 */
+-	state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
+-	if (state)
+-		set_timer_rand_state(irq, state);
+-}
+-
+ #ifdef CONFIG_BLOCK
+ void rand_initialize_disk(struct gendisk *disk)
+ {
+--- a/drivers/crypto/n2_core.c
++++ b/drivers/crypto/n2_core.c
+@@ -1607,8 +1607,7 @@ static int spu_map_ino(struct platform_d
+ 
+ 	sprintf(p->irq_name, "%s-%d", irq_name, index);
+ 
+-	return request_irq(p->irq, handler, IRQF_SAMPLE_RANDOM,
+-			   p->irq_name, p);
++	return request_irq(p->irq, handler, 0, p->irq_name, p);
+ }
+ 
+ static struct kmem_cache *queue_cache[2];
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -545,8 +545,7 @@ static int vmbus_bus_init(int irq)
+ 	if (ret)
+ 		goto err_cleanup;
+ 
+-	ret = request_irq(irq, vmbus_isr, IRQF_SAMPLE_RANDOM,
+-			driver_name, hv_acpi_dev);
++	ret = request_irq(irq, vmbus_isr, 0, driver_name, hv_acpi_dev);
+ 
+ 	if (ret != 0) {
+ 		pr_err("Unable to request IRQ %d\n",
+--- a/drivers/i2c/busses/i2c-pmcmsp.c
++++ b/drivers/i2c/busses/i2c-pmcmsp.c
+@@ -306,8 +306,7 @@ static int __devinit pmcmsptwi_probe(str
+ 	pmcmsptwi_data.irq = platform_get_irq(pldev, 0);
+ 	if (pmcmsptwi_data.irq) {
+ 		rc = request_irq(pmcmsptwi_data.irq, &pmcmsptwi_interrupt,
+-			IRQF_SHARED | IRQF_SAMPLE_RANDOM,
+-			pldev->name, &pmcmsptwi_data);
++				 IRQF_SHARED, pldev->name, &pmcmsptwi_data);
+ 		if (rc == 0) {
+ 			/*
+ 			 * Enable 'DONE' interrupt only.
+--- a/drivers/input/serio/hp_sdc.c
++++ b/drivers/input/serio/hp_sdc.c
+@@ -879,7 +879,7 @@ static int __init hp_sdc_init(void)
+ #endif
+ 
+ 	errstr = "IRQ not available for";
+-	if (request_irq(hp_sdc.irq, &hp_sdc_isr, IRQF_SHARED|IRQF_SAMPLE_RANDOM,
++	if (request_irq(hp_sdc.irq, &hp_sdc_isr, IRQF_SHARED,
+ 			"HP SDC", &hp_sdc))
+ 		goto err1;
+ 
+--- a/drivers/mfd/ab3100-core.c
++++ b/drivers/mfd/ab3100-core.c
+@@ -937,9 +937,6 @@ static int __devinit ab3100_probe(struct
+ 
+ 	err = request_threaded_irq(client->irq, NULL, ab3100_irq_handler,
+ 				IRQF_ONESHOT, "ab3100-core", ab3100);
+-	/* This real unpredictable IRQ is of course sampled for entropy */
+-	rand_initialize_irq(client->irq);
+-
+ 	if (err)
+ 		goto exit_no_irq;
+ 
+--- a/drivers/mfd/tps65010.c
++++ b/drivers/mfd/tps65010.c
+@@ -563,8 +563,7 @@ static int tps65010_probe(struct i2c_cli
+ 	 */
+ 	if (client->irq > 0) {
+ 		status = request_irq(client->irq, tps65010_irq,
+-			IRQF_SAMPLE_RANDOM | IRQF_TRIGGER_FALLING,
+-			DRIVER_NAME, tps);
++			IRQF_TRIGGER_FALLING, DRIVER_NAME, tps);
+ 		if (status < 0) {
+ 			dev_dbg(&client->dev, "can't get IRQ %d, err %d\n",
+ 					client->irq, status);
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -9415,7 +9415,7 @@ static int tg3_test_interrupt(struct tg3
+ 	}
+ 
+ 	err = request_irq(tnapi->irq_vec, tg3_test_isr,
+-			  IRQF_SHARED | IRQF_SAMPLE_RANDOM, dev->name, tnapi);
++			  IRQF_SHARED, dev->name, tnapi);
+ 	if (err)
+ 		return err;
+ 
+--- a/drivers/power/pda_power.c
++++ b/drivers/power/pda_power.c
+@@ -24,11 +24,7 @@
+ 
+ static inline unsigned int get_irq_flags(struct resource *res)
+ {
+-	unsigned int flags = IRQF_SAMPLE_RANDOM | IRQF_SHARED;
+-
+-	flags |= res->flags & IRQF_TRIGGER_MASK;
+-
+-	return flags;
++	return IRQF_SHARED | (res->flags & IRQF_TRIGGER_MASK);
+ }
+ 
+ static struct device *dev;
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -216,8 +216,7 @@ static int ulite_startup(struct uart_por
+ {
+ 	int ret;
+ 
+-	ret = request_irq(port->irq, ulite_isr,
+-			  IRQF_SHARED | IRQF_SAMPLE_RANDOM, "uartlite", port);
++	ret = request_irq(port->irq, ulite_isr, IRQF_SHARED, "uartlite", port);
+ 	if (ret)
+ 		return ret;
+ 
+--- a/drivers/usb/gadget/goku_udc.c
++++ b/drivers/usb/gadget/goku_udc.c
+@@ -1839,7 +1839,7 @@ static int goku_probe(struct pci_dev *pd
+ 	/* init to known state, then setup irqs */
+ 	udc_reset(dev);
+ 	udc_reinit (dev);
+-	if (request_irq(pdev->irq, goku_irq, IRQF_SHARED/*|IRQF_SAMPLE_RANDOM*/,
++	if (request_irq(pdev->irq, goku_irq, IRQF_SHARED,
+ 			driver_name, dev) != 0) {
+ 		DBG(dev, "request interrupt %d failed\n", pdev->irq);
+ 		retval = -EBUSY;
+--- a/drivers/usb/gadget/omap_udc.c
++++ b/drivers/usb/gadget/omap_udc.c
+@@ -2943,7 +2943,7 @@ known:
+ 
+ 	/* USB general purpose IRQ:  ep0, state changes, dma, etc */
+ 	status = request_irq(pdev->resource[1].start, omap_udc_irq,
+-			IRQF_SAMPLE_RANDOM, driver_name, udc);
++			     0, driver_name, udc);
+ 	if (status != 0) {
+ 		ERR("can't get irq %d, err %d\n",
+ 			(int) pdev->resource[1].start, status);
+@@ -2952,7 +2952,7 @@ known:
+ 
+ 	/* USB "non-iso" IRQ (PIO for all but ep0) */
+ 	status = request_irq(pdev->resource[2].start, omap_udc_pio_irq,
+-			IRQF_SAMPLE_RANDOM, "omap_udc pio", udc);
++			     0, "omap_udc pio", udc);
+ 	if (status != 0) {
+ 		ERR("can't get irq %d, err %d\n",
+ 			(int) pdev->resource[2].start, status);
+--- a/drivers/usb/gadget/pxa25x_udc.c
++++ b/drivers/usb/gadget/pxa25x_udc.c
+@@ -2202,19 +2202,15 @@ static int __init pxa25x_udc_probe(struc
+ 
+ #ifdef CONFIG_ARCH_LUBBOCK
+ 	if (machine_is_lubbock()) {
+-		retval = request_irq(LUBBOCK_USB_DISC_IRQ,
+-				lubbock_vbus_irq,
+-				IRQF_SAMPLE_RANDOM,
+-				driver_name, dev);
++		retval = request_irq(LUBBOCK_USB_DISC_IRQ, lubbock_vbus_irq,
++				     0, driver_name, dev);
+ 		if (retval != 0) {
+ 			pr_err("%s: can't get irq %i, err %d\n",
+ 				driver_name, LUBBOCK_USB_DISC_IRQ, retval);
+ 			goto err_irq_lub;
+ 		}
+-		retval = request_irq(LUBBOCK_USB_IRQ,
+-				lubbock_vbus_irq,
+-				IRQF_SAMPLE_RANDOM,
+-				driver_name, dev);
++		retval = request_irq(LUBBOCK_USB_IRQ, lubbock_vbus_irq,
++				     0, driver_name, dev);
+ 		if (retval != 0) {
+ 			pr_err("%s: can't get irq %i, err %d\n",
+ 				driver_name, LUBBOCK_USB_IRQ, retval);
+--- a/drivers/usb/otg/gpio_vbus.c
++++ b/drivers/usb/otg/gpio_vbus.c
+@@ -51,8 +51,7 @@ struct gpio_vbus_data {
+  * edges might be workable.
+  */
+ #define VBUS_IRQ_FLAGS \
+-	( IRQF_SAMPLE_RANDOM | IRQF_SHARED \
+-	| IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING )
++	( IRQF_SHARED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING )
+ 
+ 
+ /* interface to regulator framework */
+@@ -253,7 +252,7 @@ static int __init gpio_vbus_probe(struct
+ 	if (res) {
+ 		irq = res->start;
+ 		res->flags &= IRQF_TRIGGER_MASK;
+-		res->flags |= IRQF_SAMPLE_RANDOM | IRQF_SHARED;
++		res->flags |= IRQF_SHARED;
+ 	} else
+ 		irq = gpio_to_irq(gpio);
+ 
+--- a/drivers/usb/otg/isp1301_omap.c
++++ b/drivers/usb/otg/isp1301_omap.c
+@@ -1567,7 +1567,6 @@ isp1301_probe(struct i2c_client *i2c, co
+ 		isp->irq_type = IRQF_TRIGGER_FALLING;
+ 	}
+ 
+-	isp->irq_type |= IRQF_SAMPLE_RANDOM;
+ 	status = request_irq(i2c->irq, isp1301_irq,
+ 			isp->irq_type, DRIVER_NAME, isp);
+ 	if (status < 0) {
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -44,7 +44,6 @@
+  *
+  * IRQF_DISABLED - keep irqs disabled when calling the action handler.
+  *                 DEPRECATED. This flag is a NOOP and scheduled to be removed
+- * IRQF_SAMPLE_RANDOM - irq is used to feed the random generator
+  * IRQF_SHARED - allow sharing the irq among several devices
+  * IRQF_PROBE_SHARED - set by callers when they expect sharing mismatches to occur
+  * IRQF_TIMER - Flag to mark this interrupt as timer interrupt
+@@ -63,7 +62,6 @@
+  *                resume time.
+  */
+ #define IRQF_DISABLED		0x00000020
+-#define IRQF_SAMPLE_RANDOM	0x00000040
+ #define IRQF_SHARED		0x00000080
+ #define IRQF_PROBE_SHARED	0x00000100
+ #define __IRQF_TIMER		0x00000200
+--- a/include/linux/irqdesc.h
++++ b/include/linux/irqdesc.h
+@@ -39,7 +39,6 @@ struct module;
+  */
+ struct irq_desc {
+ 	struct irq_data		irq_data;
+-	struct timer_rand_state *timer_rand_state;
+ 	unsigned int __percpu	*kstat_irqs;
+ 	irq_flow_handler_t	handle_irq;
+ #ifdef CONFIG_IRQ_PREFLOW_FASTEOI
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -48,8 +48,6 @@ struct rnd_state {
+ 
+ #ifdef __KERNEL__
+ 
+-extern void rand_initialize_irq(int irq);
+-
+ extern void add_device_randomness(const void *, unsigned int);
+ extern void add_input_randomness(unsigned int type, unsigned int code,
+ 				 unsigned int value);
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -891,22 +891,6 @@ __setup_irq(unsigned int irq, struct irq
+ 		return -ENOSYS;
+ 	if (!try_module_get(desc->owner))
+ 		return -ENODEV;
+-	/*
+-	 * Some drivers like serial.c use request_irq() heavily,
+-	 * so we have to be careful not to interfere with a
+-	 * running system.
+-	 */
+-	if (new->flags & IRQF_SAMPLE_RANDOM) {
+-		/*
+-		 * This function might sleep, we want to call it first,
+-		 * outside of the atomic block.
+-		 * Yes, this might clear the entropy pool if the wrong
+-		 * driver is attempted to be loaded, without actually
+-		 * installing a new handler, but is this really a problem,
+-		 * only the sysadmin is able to do this.
+-		 */
+-		rand_initialize_irq(irq);
+-	}
+ 
+ 	/*
+ 	 * Check whether the interrupt nests into another interrupt
+@@ -1342,7 +1326,6 @@ EXPORT_SYMBOL(free_irq);
+  *	Flags:
+  *
+  *	IRQF_SHARED		Interrupt is shared
+- *	IRQF_SAMPLE_RANDOM	The interrupt can be used for entropy
+  *	IRQF_TRIGGER_*		Specify active edge(s) or level
+  *
+  */
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/060-hso_devices.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/060-hso_devices.patch.svn-base
new file mode 100644
index 0000000..9b15c75
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/060-hso_devices.patch.svn-base
@@ -0,0 +1,36 @@
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -476,8 +476,10 @@ static const struct usb_device_id hso_id
+ 	{USB_DEVICE(0x0af0, 0x8400)},
+ 	{USB_DEVICE(0x0af0, 0x8600)},
+ 	{USB_DEVICE(0x0af0, 0x8800)},
+-	{USB_DEVICE(0x0af0, 0x8900)},
+-	{USB_DEVICE(0x0af0, 0x9000)},
++	{USB_DEVICE(0x0af0, 0x8900)},  /* GTM 67xx */
++	{USB_DEVICE(0x0af0, 0x9000)},  /* GTM 66xx */
++	{USB_DEVICE(0x0af0, 0x9200)},  /* GTM 67xxWFS */
++	{USB_DEVICE(0x0af0, 0x9300)},  /* GTM 66xxWFS */
+ 	{USB_DEVICE(0x0af0, 0xd035)},
+ 	{USB_DEVICE(0x0af0, 0xd055)},
+ 	{USB_DEVICE(0x0af0, 0xd155)},
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1231,6 +1231,18 @@ UNUSUAL_DEV( 0x0af0, 0x8304, 0x0000, 0x0
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		0 ),
+ 
++UNUSUAL_DEV( 0x0af0, 0x9200, 0x0000, 0x0000,
++		"Option",
++		"Globetrotter 67xxWFS SD-Card",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		0 ),
++
++UNUSUAL_DEV( 0x0af0, 0x9300, 0x0000, 0x0000,
++		"Option",
++		"Globetrotter 66xxWFS SD-Card",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		0 ),
++
+ UNUSUAL_DEV( 0x0af0, 0xc100, 0x0000, 0x0000,
+ 		"Option",
+ 		"GI 070x SD-Card",
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/060-tcp-ecn-dont-delay-ACKS-after-CE.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/060-tcp-ecn-dont-delay-ACKS-after-CE.patch.svn-base
new file mode 100644
index 0000000..6f1cd12
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/060-tcp-ecn-dont-delay-ACKS-after-CE.patch.svn-base
@@ -0,0 +1,61 @@
+From patchwork Mon Aug  6 21:04:43 2012
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [net-next] tcp: ecn: dont delay ACKS after CE
+Date: Mon, 06 Aug 2012 11:04:43 -0000
+From: Eric Dumazet <eric.dumazet@gmail.com>
+X-Patchwork-Id: 175453
+Message-Id: <1344287083.26674.83.camel@edumazet-glaptop>
+To: David Miller <davem@davemloft.net>
+Cc: netdev <netdev@vger.kernel.org>,
+	Neal Cardwell <ncardwell@google.com>
+
+From: Eric Dumazet <edumazet@google.com>
+
+While playing with CoDel and ECN marking, I discovered a
+non optimal behavior of receiver of CE (Congestion Encountered)
+segments.
+
+In pathological cases, sender has reduced its cwnd to low values,
+and receiver delays its ACK (by 40 ms).
+
+While RFC 3168 6.1.3 (The TCP Receiver) doesn't explicitly recommend
+to send immediate ACKS, we believe its better to not delay ACKS, because
+a CE segment should give same signal than a dropped segment, and its
+quite important to reduce RTT to give ECE/CWR signals as fast as
+possible.
+
+Note we already call tcp_enter_quickack_mode() from TCP_ECN_check_ce()
+if we receive a retransmit, for the same reason.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+
+---
+net/ipv4/tcp_input.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+
+
+--
+To unsubscribe from this list: send the line "unsubscribe netdev" in
+the body of a message to majordomo@vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -231,7 +231,11 @@ static inline void TCP_ECN_check_ce(stru
+ 			tcp_enter_quickack_mode((struct sock *)tp);
+ 		break;
+ 	case INET_ECN_CE:
+-		tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
++		if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
++			/* Better not delay acks, sender can have a very low cwnd */
++			tcp_enter_quickack_mode((struct sock *)tp);
++			tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
++		}
+ 		/* fallinto */
+ 	default:
+ 		tp->ecn_flags |= TCP_ECN_SEEN;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/061-fq_codel-dont-reinit-flow-state.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/061-fq_codel-dont-reinit-flow-state.patch.svn-base
new file mode 100644
index 0000000..6699e98
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/061-fq_codel-dont-reinit-flow-state.patch.svn-base
@@ -0,0 +1,36 @@
+From b379135c40163ae79ba7a54e6928b53983e74ee8 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sat, 1 Sep 2012 03:19:57 +0000
+Subject: [PATCH 307/558] fq_codel: dont reinit flow state
+
+When fq_codel builds a new flow, it should not reset codel state.
+
+Codel algo needs to get previous values (lastcount, drop_next) to get
+proper behavior.
+
+Signed-off-by: Dave Taht <dave.taht@gmail.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Dave Taht <dave.taht@bufferbloat.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/sched/sch_fq_codel.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -191,7 +191,6 @@ static int fq_codel_enqueue(struct sk_bu
+ 
+ 	if (list_empty(&flow->flowchain)) {
+ 		list_add_tail(&flow->flowchain, &q->new_flows);
+-		codel_vars_init(&flow->cvars);
+ 		q->new_flow_count++;
+ 		flow->deficit = q->quantum;
+ 		flow->dropped = 0;
+@@ -418,6 +417,7 @@ static int fq_codel_init(struct Qdisc *s
+ 			struct fq_codel_flow *flow = q->flows + i;
+ 
+ 			INIT_LIST_HEAD(&flow->flowchain);
++			codel_vars_init(&flow->cvars);
+ 		}
+ 	}
+ 	if (sch->limit >= 1)
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/065-8139cp-fixes.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/065-8139cp-fixes.patch.svn-base
new file mode 100644
index 0000000..77c903c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/065-8139cp-fixes.patch.svn-base
@@ -0,0 +1,187 @@
+commit 01ffc0a7f1c1801a2354719dedbc32aff45b987d
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Sat Nov 24 12:11:21 2012 +0000
+
+    8139cp: re-enable interrupts after tx timeout
+    
+    Recovery doesn't work too well if we leave interrupts disabled...
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Francois Romieu <romieu@fr.zoreil.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 871f0d4c153e1258d4becf306eca6761bf38b629
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Thu Nov 22 03:16:58 2012 +0000
+
+    8139cp: enable bql
+    
+    This adds support for byte queue limits on RTL8139C+
+    
+    Tested on real hardware.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-By: Dave Täht <dave.taht@bufferbloat.net>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit a9dbe40fc10cea2efe6e1ff9e03c62dd7579c5ba
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Wed Nov 21 10:27:19 2012 +0000
+
+    8139cp: set ring address after enabling C+ mode
+    
+    This fixes (for me) a regression introduced by commit b01af457 ("8139cp:
+    set ring address before enabling receiver"). That commit configured the
+    descriptor ring addresses earlier in the initialisation sequence, in
+    order to avoid the possibility of triggering stray DMA before the
+    correct address had been set up.
+    
+    Unfortunately, it seems that the hardware will scribble garbage into the
+    TxRingAddr registers when we enable "plus mode" Tx in the CpCmd
+    register. Observed on a Traverse Geos router board.
+    
+    To deal with this, while not reintroducing the problem which led to the
+    original commit, we augment cp_start_hw() to write to the CpCmd register
+    *first*, then set the descriptor ring addresses, and then finally to
+    enable Rx and Tx in the original 8139 Cmd register. The datasheet
+    actually indicates that we should enable Tx/Rx in the Cmd register
+    *before* configuring the descriptor addresses, but that would appear to
+    re-introduce the problem that the offending commit b01af457 was trying
+    to solve. And this variant appears to work fine on real hardware.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Cc: stable@kernel.org [3.5+]
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 071e3ef4a94a021b16a2912f3885c86f4ff36b49
+Author: David S. Miller <davem@davemloft.net>
+Date:   Sun Nov 25 15:52:09 2012 -0500
+
+    Revert "8139cp: revert "set ring address before enabling receiver""
+    
+    This reverts commit b26623dab7eeb1e9f5898c7a49458789dd492f20.
+    
+    This reverts the revert, in net-next we'll try another scheme
+    to fix this bug using patches from David Woodhouse.
+    
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -645,6 +645,7 @@ static void cp_tx (struct cp_private *cp
+ {
+ 	unsigned tx_head = cp->tx_head;
+ 	unsigned tx_tail = cp->tx_tail;
++	unsigned bytes_compl = 0, pkts_compl = 0;
+ 
+ 	while (tx_tail != tx_head) {
+ 		struct cp_desc *txd = cp->tx_ring + tx_tail;
+@@ -663,6 +664,9 @@ static void cp_tx (struct cp_private *cp
+ 				 le32_to_cpu(txd->opts1) & 0xffff,
+ 				 PCI_DMA_TODEVICE);
+ 
++		bytes_compl += skb->len;
++		pkts_compl++;
++
+ 		if (status & LastFrag) {
+ 			if (status & (TxError | TxFIFOUnder)) {
+ 				netif_dbg(cp, tx_err, cp->dev,
+@@ -694,6 +698,7 @@ static void cp_tx (struct cp_private *cp
+ 
+ 	cp->tx_tail = tx_tail;
+ 
++	netdev_completed_queue(cp->dev, pkts_compl, bytes_compl);
+ 	if (TX_BUFFS_AVAIL(cp) > (MAX_SKB_FRAGS + 1))
+ 		netif_wake_queue(cp->dev);
+ }
+@@ -840,6 +845,8 @@ static netdev_tx_t cp_start_xmit (struct
+ 		wmb();
+ 	}
+ 	cp->tx_head = entry;
++
++	netdev_sent_queue(dev, skb->len);
+ 	netif_dbg(cp, tx_queued, cp->dev, "tx queued, slot %d, skblen %d\n",
+ 		  entry, skb->len);
+ 	if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
+@@ -934,6 +941,8 @@ static void cp_stop_hw (struct cp_privat
+ 
+ 	cp->rx_tail = 0;
+ 	cp->tx_head = cp->tx_tail = 0;
++
++	netdev_reset_queue(cp->dev);
+ }
+ 
+ static void cp_reset_hw (struct cp_private *cp)
+@@ -954,8 +963,38 @@ static void cp_reset_hw (struct cp_priva
+ 
+ static inline void cp_start_hw (struct cp_private *cp)
+ {
++	dma_addr_t ring_dma;
++
+ 	cpw16(CpCmd, cp->cpcmd);
++
++	/*
++	 * These (at least TxRingAddr) need to be configured after the
++	 * corresponding bits in CpCmd are enabled. Datasheet v1.6 §6.33
++	 * (C+ Command Register) recommends that these and more be configured
++	 * *after* the [RT]xEnable bits in CpCmd are set. And on some hardware
++	 * it's been observed that the TxRingAddr is actually reset to garbage
++	 * when C+ mode Tx is enabled in CpCmd.
++	 */
++	cpw32_f(HiTxRingAddr, 0);
++	cpw32_f(HiTxRingAddr + 4, 0);
++
++	ring_dma = cp->ring_dma;
++	cpw32_f(RxRingAddr, ring_dma & 0xffffffff);
++	cpw32_f(RxRingAddr + 4, (ring_dma >> 16) >> 16);
++
++	ring_dma += sizeof(struct cp_desc) * CP_RX_RING_SIZE;
++	cpw32_f(TxRingAddr, ring_dma & 0xffffffff);
++	cpw32_f(TxRingAddr + 4, (ring_dma >> 16) >> 16);
++
++	/*
++	 * Strictly speaking, the datasheet says this should be enabled
++	 * *before* setting the descriptor addresses. But what, then, would
++	 * prevent it from doing DMA to random unconfigured addresses?
++	 * This variant appears to work fine.
++	 */
+ 	cpw8(Cmd, RxOn | TxOn);
++
++	netdev_reset_queue(cp->dev);
+ }
+ 
+ static void cp_enable_irq(struct cp_private *cp)
+@@ -966,7 +1005,6 @@ static void cp_enable_irq(struct cp_priv
+ static void cp_init_hw (struct cp_private *cp)
+ {
+ 	struct net_device *dev = cp->dev;
+-	dma_addr_t ring_dma;
+ 
+ 	cp_reset_hw(cp);
+ 
+@@ -989,17 +1027,6 @@ static void cp_init_hw (struct cp_privat
+ 
+ 	cpw8(Config5, cpr8(Config5) & PMEStatus);
+ 
+-	cpw32_f(HiTxRingAddr, 0);
+-	cpw32_f(HiTxRingAddr + 4, 0);
+-
+-	ring_dma = cp->ring_dma;
+-	cpw32_f(RxRingAddr, ring_dma & 0xffffffff);
+-	cpw32_f(RxRingAddr + 4, (ring_dma >> 16) >> 16);
+-
+-	ring_dma += sizeof(struct cp_desc) * CP_RX_RING_SIZE;
+-	cpw32_f(TxRingAddr, ring_dma & 0xffffffff);
+-	cpw32_f(TxRingAddr + 4, (ring_dma >> 16) >> 16);
+-
+ 	cpw16(MultiIntr, 0);
+ 
+ 	cpw8_f(Cfg9346, Cfg9346_Lock);
+@@ -1188,6 +1215,7 @@ static void cp_tx_timeout(struct net_dev
+ 	cp_clean_rings(cp);
+ 	rc = cp_init_rings(cp);
+ 	cp_start_hw(cp);
++	cp_enable_irq(cp);
+ 
+ 	netif_wake_queue(dev);
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/070-gpio-add-flags-to-export-GPIOs-when-requesting.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/070-gpio-add-flags-to-export-GPIOs-when-requesting.patch.svn-base
new file mode 100644
index 0000000..fb4387e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/070-gpio-add-flags-to-export-GPIOs-when-requesting.patch.svn-base
@@ -0,0 +1,68 @@
+From fc3a1f04f5040255cbc086c419e4237f29f89f88 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Tue, 13 Dec 2011 18:34:01 +0100
+Subject: [PATCH] gpio: add flags to export GPIOs when requesting
+
+commit fc3a1f04f5040255cbc086c419e4237f29f89f88 upstream.
+
+Introduce new flags to automatically export GPIOs when using the convenience
+functions gpio_request_one() or gpio_request_array(). This eases support for
+custom boards where lots of GPIOs need to be exported for customer
+applications.
+
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+---
+ Documentation/gpio.txt |    3 +++
+ drivers/gpio/gpiolib.c |   12 +++++++++++-
+ include/linux/gpio.h   |    5 +++++
+ 3 files changed, 19 insertions(+), 1 deletion(-)
+
+--- a/Documentation/gpio.txt
++++ b/Documentation/gpio.txt
+@@ -303,6 +303,9 @@ where 'flags' is currently defined to sp
+ 	* GPIOF_INIT_LOW	- as output, set initial level to LOW
+ 	* GPIOF_INIT_HIGH	- as output, set initial level to HIGH
+ 
++	* GPIOF_EXPORT_DIR_FIXED	- export gpio to sysfs, keep direction
++	* GPIOF_EXPORT_DIR_CHANGEABLE	- also export, allow changing direction
++
+ since GPIOF_INIT_* are only valid when configured as output, so group valid
+ combinations as:
+ 
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1289,8 +1289,18 @@ int gpio_request_one(unsigned gpio, unsi
+ 				(flags & GPIOF_INIT_HIGH) ? 1 : 0);
+ 
+ 	if (err)
+-		gpio_free(gpio);
++		goto free_gpio;
+ 
++	if (flags & GPIOF_EXPORT) {
++		err = gpio_export(gpio, flags & GPIOF_EXPORT_CHANGEABLE);
++		if (err)
++			goto free_gpio;
++	}
++
++	return 0;
++
++ free_gpio:
++	gpio_free(gpio);
+ 	return err;
+ }
+ EXPORT_SYMBOL_GPL(gpio_request_one);
+--- a/include/linux/gpio.h
++++ b/include/linux/gpio.h
+@@ -14,6 +14,11 @@
+ #define GPIOF_OUT_INIT_LOW	(GPIOF_DIR_OUT | GPIOF_INIT_LOW)
+ #define GPIOF_OUT_INIT_HIGH	(GPIOF_DIR_OUT | GPIOF_INIT_HIGH)
+ 
++#define GPIOF_EXPORT		(1 << 2)
++#define GPIOF_EXPORT_CHANGEABLE	(1 << 3)
++#define GPIOF_EXPORT_DIR_FIXED	(GPIOF_EXPORT)
++#define GPIOF_EXPORT_DIR_CHANGEABLE (GPIOF_EXPORT | GPIOF_EXPORT_CHANGEABLE)
++
+ /**
+  * struct gpio - a structure describing a GPIO with configuration
+  * @gpio:	the GPIO number
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/080-prot-release-cb.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/080-prot-release-cb.patch.svn-base
new file mode 100644
index 0000000..56cda6b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/080-prot-release-cb.patch.svn-base
@@ -0,0 +1,27 @@
+This was added in commit 46d3ceabd8d98ed0ad10f20c595ca784e34786c5 (tcp: 
+TCP Small Queues) but we need it for pppoatm too.
+
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -810,6 +810,8 @@ struct proto {
+ 	int			(*backlog_rcv) (struct sock *sk, 
+ 						struct sk_buff *skb);
+ 
++	void		(*release_cb)(struct sock *sk);
++
+ 	/* Keeping track of sk's, looking them up, and port selection methods. */
+ 	void			(*hash)(struct sock *sk);
+ 	void			(*unhash)(struct sock *sk);
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2138,6 +2138,10 @@ void release_sock(struct sock *sk)
+ 	spin_lock_bh(&sk->sk_lock.slock);
+ 	if (sk->sk_backlog.tail)
+ 		__release_sock(sk);
++
++	if (sk->sk_prot->release_cb)
++		sk->sk_prot->release_cb(sk);
++
+ 	sk->sk_lock.owned = 0;
+ 	if (waitqueue_active(&sk->sk_lock.wq))
+ 		wake_up(&sk->sk_lock.wq);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/081-USB-OHCI-Add-a-generic-platform-device-driver.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/081-USB-OHCI-Add-a-generic-platform-device-driver.patch.svn-base
new file mode 100644
index 0000000..8ea102f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/081-USB-OHCI-Add-a-generic-platform-device-driver.patch.svn-base
@@ -0,0 +1,271 @@
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -393,6 +393,16 @@ config USB_CNS3XXX_OHCI
+ 	  Enable support for the CNS3XXX SOC's on-chip OHCI controller.
+ 	  It is needed for low-speed USB 1.0 device support.
+ 
++config USB_OHCI_HCD_PLATFORM
++	bool "Generic OHCI driver for a platform device"
++	depends on USB_OHCI_HCD && EXPERIMENTAL
++	default n
++	---help---
++	  Adds an OHCI host driver for a generic platform device, which
++	  provieds a memory space and an irq.
++
++	  If unsure, say N.
++
+ config USB_OHCI_BIG_ENDIAN_DESC
+ 	bool
+ 	depends on USB_OHCI_HCD
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -1121,6 +1121,11 @@ MODULE_LICENSE ("GPL");
+ #define PLATFORM_DRIVER		ohci_xls_driver
+ #endif
+ 
++#ifdef CONFIG_USB_OHCI_HCD_PLATFORM
++#include "ohci-platform.c"
++#define PLATFORM_DRIVER		ohci_platform_driver
++#endif
++
+ #if	!defined(PCI_DRIVER) &&		\
+ 	!defined(PLATFORM_DRIVER) &&	\
+ 	!defined(OMAP1_PLATFORM_DRIVER) &&	\
+--- /dev/null
++++ b/drivers/usb/host/ohci-platform.c
+@@ -0,0 +1,194 @@
++/*
++ * Generic platform ohci driver
++ *
++ * Copyright 2007 Michael Buesch <m@bues.ch>
++ * Copyright 2011-2012 Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * Derived from the OCHI-SSB driver
++ * Derived from the OHCI-PCI driver
++ * Copyright 1999 Roman Weissgaerber
++ * Copyright 2000-2002 David Brownell
++ * Copyright 1999 Linus Torvalds
++ * Copyright 1999 Gregory P. Smith
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++#include <linux/platform_device.h>
++#include <linux/usb/ohci_pdriver.h>
++
++static int ohci_platform_reset(struct usb_hcd *hcd)
++{
++	struct platform_device *pdev = to_platform_device(hcd->self.controller);
++	struct usb_ohci_pdata *pdata = pdev->dev.platform_data;
++	struct ohci_hcd *ohci = hcd_to_ohci(hcd);
++	int err;
++
++	if (pdata->big_endian_desc)
++		ohci->flags |= OHCI_QUIRK_BE_DESC;
++	if (pdata->big_endian_mmio)
++		ohci->flags |= OHCI_QUIRK_BE_MMIO;
++	if (pdata->no_big_frame_no)
++		ohci->flags |= OHCI_QUIRK_FRAME_NO;
++
++	ohci_hcd_init(ohci);
++	err = ohci_init(ohci);
++
++	return err;
++}
++
++static int ohci_platform_start(struct usb_hcd *hcd)
++{
++	struct ohci_hcd *ohci = hcd_to_ohci(hcd);
++	int err;
++
++	err = ohci_run(ohci);
++	if (err < 0) {
++		ohci_err(ohci, "can't start\n");
++		ohci_stop(hcd);
++	}
++
++	return err;
++}
++
++static const struct hc_driver ohci_platform_hc_driver = {
++	.description		= hcd_name,
++	.product_desc		= "Generic Platform OHCI Controller",
++	.hcd_priv_size		= sizeof(struct ohci_hcd),
++
++	.irq			= ohci_irq,
++	.flags			= HCD_MEMORY | HCD_USB11,
++
++	.reset			= ohci_platform_reset,
++	.start			= ohci_platform_start,
++	.stop			= ohci_stop,
++	.shutdown		= ohci_shutdown,
++
++	.urb_enqueue		= ohci_urb_enqueue,
++	.urb_dequeue		= ohci_urb_dequeue,
++	.endpoint_disable	= ohci_endpoint_disable,
++
++	.get_frame_number	= ohci_get_frame,
++
++	.hub_status_data	= ohci_hub_status_data,
++	.hub_control		= ohci_hub_control,
++#ifdef	CONFIG_PM
++	.bus_suspend		= ohci_bus_suspend,
++	.bus_resume		= ohci_bus_resume,
++#endif
++
++	.start_port_reset	= ohci_start_port_reset,
++};
++
++static int __devinit ohci_platform_probe(struct platform_device *dev)
++{
++	struct usb_hcd *hcd;
++	struct resource *res_mem;
++	int irq;
++	int err = -ENOMEM;
++
++	BUG_ON(!dev->dev.platform_data);
++
++	if (usb_disabled())
++		return -ENODEV;
++
++	irq = platform_get_irq(dev, 0);
++	if (irq < 0) {
++		pr_err("no irq provieded");
++		return irq;
++	}
++
++	res_mem = platform_get_resource(dev, IORESOURCE_MEM, 0);
++	if (!res_mem) {
++		pr_err("no memory recourse provieded");
++		return -ENXIO;
++	}
++
++	hcd = usb_create_hcd(&ohci_platform_hc_driver, &dev->dev,
++			dev_name(&dev->dev));
++	if (!hcd)
++		return -ENOMEM;
++
++	hcd->rsrc_start = res_mem->start;
++	hcd->rsrc_len = resource_size(res_mem);
++
++	if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
++		pr_err("controller already in use");
++		err = -EBUSY;
++		goto err_put_hcd;
++	}
++
++	hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
++	if (!hcd->regs)
++		goto err_release_region;
++	err = usb_add_hcd(hcd, irq, IRQF_SHARED);
++	if (err)
++		goto err_iounmap;
++
++	platform_set_drvdata(dev, hcd);
++
++	return err;
++
++err_iounmap:
++	iounmap(hcd->regs);
++err_release_region:
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
++err_put_hcd:
++	usb_put_hcd(hcd);
++	return err;
++}
++
++static int __devexit ohci_platform_remove(struct platform_device *dev)
++{
++	struct usb_hcd *hcd = platform_get_drvdata(dev);
++
++	usb_remove_hcd(hcd);
++	iounmap(hcd->regs);
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
++	usb_put_hcd(hcd);
++	platform_set_drvdata(dev, NULL);
++
++	return 0;
++}
++
++#ifdef CONFIG_PM
++
++static int ohci_platform_suspend(struct device *dev)
++{
++	return 0;
++}
++
++static int ohci_platform_resume(struct device *dev)
++{
++	struct usb_hcd *hcd = dev_get_drvdata(dev);
++
++	ohci_finish_controller_resume(hcd);
++	return 0;
++}
++
++#else /* !CONFIG_PM */
++#define ohci_platform_suspend	NULL
++#define ohci_platform_resume	NULL
++#endif /* CONFIG_PM */
++
++static const struct platform_device_id ohci_platform_table[] = {
++	{ "ohci-platform", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(platform, ohci_platform_table);
++
++static const struct dev_pm_ops ohci_platform_pm_ops = {
++	.suspend	= ohci_platform_suspend,
++	.resume		= ohci_platform_resume,
++};
++
++static struct platform_driver ohci_platform_driver = {
++	.id_table	= ohci_platform_table,
++	.probe		= ohci_platform_probe,
++	.remove		= __devexit_p(ohci_platform_remove),
++	.shutdown	= usb_hcd_platform_shutdown,
++	.driver		= {
++		.owner	= THIS_MODULE,
++		.name	= "ohci-platform",
++		.pm	= &ohci_platform_pm_ops,
++	}
++};
+--- /dev/null
++++ b/include/linux/usb/ohci_pdriver.h
+@@ -0,0 +1,38 @@
++/*
++ * Copyright (C) 2012 Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
++ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
++ * for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software Foundation,
++ * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ */
++
++#ifndef __USB_CORE_OHCI_PDRIVER_H
++#define __USB_CORE_OHCI_PDRIVER_H
++
++/**
++ * struct usb_ohci_pdata - platform_data for generic ohci driver
++ *
++ * @big_endian_desc:	BE descriptors
++ * @big_endian_mmio:	BE registers
++ * @no_big_frame_no:	no big endian frame_no shift
++ *
++ * These are general configuration options for the OHCI controller. All of
++ * these options are activating more or less workarounds for some hardware.
++ */
++struct usb_ohci_pdata {
++	unsigned	big_endian_desc:1;
++	unsigned	big_endian_mmio:1;
++	unsigned	no_big_frame_no:1;
++};
++
++#endif /* __USB_CORE_OHCI_PDRIVER_H */
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/082-USB-EHCI-Add-a-generic-platform-device-driver.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/082-USB-EHCI-Add-a-generic-platform-device-driver.patch.svn-base
new file mode 100644
index 0000000..62eb87a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/082-USB-EHCI-Add-a-generic-platform-device-driver.patch.svn-base
@@ -0,0 +1,283 @@
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -403,6 +403,16 @@ config USB_OHCI_HCD_PLATFORM
+ 
+ 	  If unsure, say N.
+ 
++config USB_EHCI_HCD_PLATFORM
++	bool "Generic EHCI driver for a platform device"
++	depends on USB_EHCI_HCD && EXPERIMENTAL
++	default n
++	---help---
++	  Adds an EHCI host driver for a generic platform device, which
++	  provieds a memory space and an irq.
++
++	  If unsure, say N.
++
+ config USB_OHCI_BIG_ENDIAN_DESC
+ 	bool
+ 	depends on USB_OHCI_HCD
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -1381,6 +1381,11 @@ MODULE_LICENSE ("GPL");
+ #define        PLATFORM_DRIVER         ehci_mv_driver
+ #endif
+ 
++#ifdef CONFIG_USB_EHCI_HCD_PLATFORM
++#include "ehci-platform.c"
++#define PLATFORM_DRIVER		ehci_platform_driver
++#endif
++
+ #if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER) && \
+     !defined(PS3_SYSTEM_BUS_DRIVER) && !defined(OF_PLATFORM_DRIVER) && \
+     !defined(XILINX_OF_PLATFORM_DRIVER)
+--- /dev/null
++++ b/drivers/usb/host/ehci-platform.c
+@@ -0,0 +1,198 @@
++/*
++ * Generic platform ehci driver
++ *
++ * Copyright 2007 Steven Brown <sbrown@cortland.com>
++ * Copyright 2010-2012 Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * Derived from the ohci-ssb driver
++ * Copyright 2007 Michael Buesch <m@bues.ch>
++ *
++ * Derived from the EHCI-PCI driver
++ * Copyright (c) 2000-2004 by David Brownell
++ *
++ * Derived from the ohci-pci driver
++ * Copyright 1999 Roman Weissgaerber
++ * Copyright 2000-2002 David Brownell
++ * Copyright 1999 Linus Torvalds
++ * Copyright 1999 Gregory P. Smith
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++#include <linux/platform_device.h>
++#include <linux/usb/ehci_pdriver.h>
++
++static int ehci_platform_reset(struct usb_hcd *hcd)
++{
++	struct platform_device *pdev = to_platform_device(hcd->self.controller);
++	struct usb_ehci_pdata *pdata = pdev->dev.platform_data;
++	struct ehci_hcd *ehci = hcd_to_ehci(hcd);
++	int retval;
++
++	hcd->has_tt = pdata->has_tt;
++	ehci->has_synopsys_hc_bug = pdata->has_synopsys_hc_bug;
++	ehci->big_endian_desc = pdata->big_endian_desc;
++	ehci->big_endian_mmio = pdata->big_endian_mmio;
++
++	ehci->caps = hcd->regs + pdata->caps_offset;
++	retval = ehci_setup(hcd);
++	if (retval)
++		return retval;
++
++	if (pdata->port_power_on)
++		ehci_port_power(ehci, 1);
++	if (pdata->port_power_off)
++		ehci_port_power(ehci, 0);
++
++	return 0;
++}
++
++static const struct hc_driver ehci_platform_hc_driver = {
++	.description		= hcd_name,
++	.product_desc		= "Generic Platform EHCI Controller",
++	.hcd_priv_size		= sizeof(struct ehci_hcd),
++
++	.irq			= ehci_irq,
++	.flags			= HCD_MEMORY | HCD_USB2,
++
++	.reset			= ehci_platform_reset,
++	.start			= ehci_run,
++	.stop			= ehci_stop,
++	.shutdown		= ehci_shutdown,
++
++	.urb_enqueue		= ehci_urb_enqueue,
++	.urb_dequeue		= ehci_urb_dequeue,
++	.endpoint_disable	= ehci_endpoint_disable,
++	.endpoint_reset		= ehci_endpoint_reset,
++
++	.get_frame_number	= ehci_get_frame,
++
++	.hub_status_data	= ehci_hub_status_data,
++	.hub_control		= ehci_hub_control,
++#if defined(CONFIG_PM)
++	.bus_suspend		= ehci_bus_suspend,
++	.bus_resume		= ehci_bus_resume,
++#endif
++	.relinquish_port	= ehci_relinquish_port,
++	.port_handed_over	= ehci_port_handed_over,
++
++	.update_device		= ehci_update_device,
++
++	.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
++};
++
++static int __devinit ehci_platform_probe(struct platform_device *dev)
++{
++	struct usb_hcd *hcd;
++	struct resource *res_mem;
++	int irq;
++	int err = -ENOMEM;
++
++	BUG_ON(!dev->dev.platform_data);
++
++	if (usb_disabled())
++		return -ENODEV;
++
++	irq = platform_get_irq(dev, 0);
++	if (irq < 0) {
++		pr_err("no irq provieded");
++		return irq;
++	}
++	res_mem = platform_get_resource(dev, IORESOURCE_MEM, 0);
++	if (!res_mem) {
++		pr_err("no memory recourse provieded");
++		return -ENXIO;
++	}
++
++	hcd = usb_create_hcd(&ehci_platform_hc_driver, &dev->dev,
++			     dev_name(&dev->dev));
++	if (!hcd)
++		return -ENOMEM;
++
++	hcd->rsrc_start = res_mem->start;
++	hcd->rsrc_len = resource_size(res_mem);
++
++	if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
++		pr_err("controller already in use");
++		err = -EBUSY;
++		goto err_put_hcd;
++	}
++
++	hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
++	if (!hcd->regs)
++		goto err_release_region;
++	err = usb_add_hcd(hcd, irq, IRQF_SHARED);
++	if (err)
++		goto err_iounmap;
++
++	platform_set_drvdata(dev, hcd);
++
++	return err;
++
++err_iounmap:
++	iounmap(hcd->regs);
++err_release_region:
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
++err_put_hcd:
++	usb_put_hcd(hcd);
++	return err;
++}
++
++static int __devexit ehci_platform_remove(struct platform_device *dev)
++{
++	struct usb_hcd *hcd = platform_get_drvdata(dev);
++
++	usb_remove_hcd(hcd);
++	iounmap(hcd->regs);
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
++	usb_put_hcd(hcd);
++	platform_set_drvdata(dev, NULL);
++
++	return 0;
++}
++
++#ifdef CONFIG_PM
++
++static int ehci_platform_suspend(struct device *dev)
++{
++	struct usb_hcd *hcd = dev_get_drvdata(dev);
++	bool wakeup = device_may_wakeup(dev);
++
++	ehci_prepare_ports_for_controller_suspend(hcd_to_ehci(hcd), wakeup);
++	return 0;
++}
++
++static int ehci_platform_resume(struct device *dev)
++{
++	struct usb_hcd *hcd = dev_get_drvdata(dev);
++
++	ehci_prepare_ports_for_controller_resume(hcd_to_ehci(hcd));
++	return 0;
++}
++
++#else /* !CONFIG_PM */
++#define ehci_platform_suspend	NULL
++#define ehci_platform_resume	NULL
++#endif /* CONFIG_PM */
++
++static const struct platform_device_id ehci_platform_table[] = {
++	{ "ehci-platform", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(platform, ehci_platform_table);
++
++static const struct dev_pm_ops ehci_platform_pm_ops = {
++	.suspend	= ehci_platform_suspend,
++	.resume		= ehci_platform_resume,
++};
++
++static struct platform_driver ehci_platform_driver = {
++	.id_table	= ehci_platform_table,
++	.probe		= ehci_platform_probe,
++	.remove		= __devexit_p(ehci_platform_remove),
++	.shutdown	= usb_hcd_platform_shutdown,
++	.driver		= {
++		.owner	= THIS_MODULE,
++		.name	= "ehci-platform",
++		.pm	= &ehci_platform_pm_ops,
++	}
++};
+--- /dev/null
++++ b/include/linux/usb/ehci_pdriver.h
+@@ -0,0 +1,46 @@
++/*
++ * Copyright (C) 2012 Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
++ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
++ * for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software Foundation,
++ * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ */
++
++#ifndef __USB_CORE_EHCI_PDRIVER_H
++#define __USB_CORE_EHCI_PDRIVER_H
++
++/**
++ * struct usb_ehci_pdata - platform_data for generic ehci driver
++ *
++ * @caps_offset:	offset of the EHCI Capability Registers to the start of
++ *			the io memory region provided to the driver.
++ * @has_tt:		set to 1 if TT is integrated in root hub.
++ * @port_power_on:	set to 1 if the controller needs a power up after
++ *			initialization.
++ * @port_power_off:	set to 1 if the controller needs to be powered down
++ *			after initialization.
++ *
++ * These are general configuration options for the EHCI controller. All of
++ * these options are activating more or less workarounds for some hardware.
++ */
++struct usb_ehci_pdata {
++	int		caps_offset;
++	unsigned	has_tt:1;
++	unsigned	has_synopsys_hc_bug:1;
++	unsigned	big_endian_desc:1;
++	unsigned	big_endian_mmio:1;
++	unsigned	port_power_on:1;
++	unsigned	port_power_off:1;
++};
++
++#endif /* __USB_CORE_EHCI_PDRIVER_H */
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/083-USB-EHCI-platform-remove-update.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/083-USB-EHCI-platform-remove-update.patch.svn-base
new file mode 100644
index 0000000..e9a5b70
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/083-USB-EHCI-platform-remove-update.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/drivers/usb/host/ehci-platform.c
++++ b/drivers/usb/host/ehci-platform.c
+@@ -75,8 +75,6 @@ static const struct hc_driver ehci_platf
+ 	.relinquish_port	= ehci_relinquish_port,
+ 	.port_handed_over	= ehci_port_handed_over,
+ 
+-	.update_device		= ehci_update_device,
+-
+ 	.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/084-x86_fix_perf_uclibc_build.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/084-x86_fix_perf_uclibc_build.patch.svn-base
new file mode 100644
index 0000000..95163a4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/084-x86_fix_perf_uclibc_build.patch.svn-base
@@ -0,0 +1,27 @@
+From 031d8ad2c3cee85c515e551fc8c0054bdedb7b8b Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Thu, 13 Dec 2012 18:02:11 +0100
+Subject: [PATCH] x86: fix perf build with uclibc toolchains
+
+libio.h is not provided by uClibc, in order to be able to test the
+definition of __UCLIBC__ we need to include stdlib.h, which also
+includes stddef.h, providing the definition of 'NULL'
+
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+---
+ tools/perf/arch/x86/util/dwarf-regs.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/tools/perf/arch/x86/util/dwarf-regs.c
++++ b/tools/perf/arch/x86/util/dwarf-regs.c
+@@ -20,7 +20,10 @@
+  *
+  */
+ 
++#include <stdlib.h>
++#ifndef __UCLIBC__
+ #include <libio.h>
++#endif
+ #include <dwarf-regs.h>
+ 
+ /*
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/100-overlayfs_v12.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/100-overlayfs_v12.patch.svn-base
new file mode 100644
index 0000000..14e6558
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/100-overlayfs_v12.patch.svn-base
@@ -0,0 +1,3232 @@
+--- a/Documentation/filesystems/Locking
++++ b/Documentation/filesystems/Locking
+@@ -62,6 +62,7 @@ ata *);
+ 	int (*removexattr) (struct dentry *, const char *);
+ 	void (*truncate_range)(struct inode *, loff_t, loff_t);
+ 	int (*fiemap)(struct inode *, struct fiemap_extent_info *, u64 start, u64 len);
++	struct file *(*open)(struct dentry *,struct file *,const struct cred *);
+ 
+ locking rules:
+ 	all may block
+@@ -89,6 +90,7 @@ listxattr:	no
+ removexattr:	yes
+ truncate_range:	yes
+ fiemap:		no
++open:		no
+ 	Additionally, ->rmdir(), ->unlink() and ->rename() have ->i_mutex on
+ victim.
+ 	cross-directory ->rename() has (per-superblock) ->s_vfs_rename_sem.
+--- /dev/null
++++ b/Documentation/filesystems/overlayfs.txt
+@@ -0,0 +1,199 @@
++Written by: Neil Brown <neilb@suse.de>
++
++Overlay Filesystem
++==================
++
++This document describes a prototype for a new approach to providing
++overlay-filesystem functionality in Linux (sometimes referred to as
++union-filesystems).  An overlay-filesystem tries to present a
++filesystem which is the result over overlaying one filesystem on top
++of the other.
++
++The result will inevitably fail to look exactly like a normal
++filesystem for various technical reasons.  The expectation is that
++many use cases will be able to ignore these differences.
++
++This approach is 'hybrid' because the objects that appear in the
++filesystem do not all appear to belong to that filesystem.  In many
++cases an object accessed in the union will be indistinguishable
++from accessing the corresponding object from the original filesystem.
++This is most obvious from the 'st_dev' field returned by stat(2).
++
++While directories will report an st_dev from the overlay-filesystem,
++all non-directory objects will report an st_dev from the lower or
++upper filesystem that is providing the object.  Similarly st_ino will
++only be unique when combined with st_dev, and both of these can change
++over the lifetime of a non-directory object.  Many applications and
++tools ignore these values and will not be affected.
++
++Upper and Lower
++---------------
++
++An overlay filesystem combines two filesystems - an 'upper' filesystem
++and a 'lower' filesystem.  When a name exists in both filesystems, the
++object in the 'upper' filesystem is visible while the object in the
++'lower' filesystem is either hidden or, in the case of directories,
++merged with the 'upper' object.
++
++It would be more correct to refer to an upper and lower 'directory
++tree' rather than 'filesystem' as it is quite possible for both
++directory trees to be in the same filesystem and there is no
++requirement that the root of a filesystem be given for either upper or
++lower.
++
++The lower filesystem can be any filesystem supported by Linux and does
++not need to be writable.  The lower filesystem can even be another
++overlayfs.  The upper filesystem will normally be writable and if it
++is it must support the creation of trusted.* extended attributes, and
++must provide valid d_type in readdir responses, at least for symbolic
++links - so NFS is not suitable.
++
++A read-only overlay of two read-only filesystems may use any
++filesystem type.
++
++Directories
++-----------
++
++Overlaying mainly involved directories.  If a given name appears in both
++upper and lower filesystems and refers to a non-directory in either,
++then the lower object is hidden - the name refers only to the upper
++object.
++
++Where both upper and lower objects are directories, a merged directory
++is formed.
++
++At mount time, the two directories given as mount options are combined
++into a merged directory:
++
++  mount -t overlayfs overlayfs -olowerdir=/lower,upperdir=/upper /overlay
++
++Then whenever a lookup is requested in such a merged directory, the
++lookup is performed in each actual directory and the combined result
++is cached in the dentry belonging to the overlay filesystem.  If both
++actual lookups find directories, both are stored and a merged
++directory is created, otherwise only one is stored: the upper if it
++exists, else the lower.
++
++Only the lists of names from directories are merged.  Other content
++such as metadata and extended attributes are reported for the upper
++directory only.  These attributes of the lower directory are hidden.
++
++whiteouts and opaque directories
++--------------------------------
++
++In order to support rm and rmdir without changing the lower
++filesystem, an overlay filesystem needs to record in the upper filesystem
++that files have been removed.  This is done using whiteouts and opaque
++directories (non-directories are always opaque).
++
++The overlay filesystem uses extended attributes with a
++"trusted.overlay."  prefix to record these details.
++
++A whiteout is created as a symbolic link with target
++"(overlay-whiteout)" and with xattr "trusted.overlay.whiteout" set to "y".
++When a whiteout is found in the upper level of a merged directory, any
++matching name in the lower level is ignored, and the whiteout itself
++is also hidden.
++
++A directory is made opaque by setting the xattr "trusted.overlay.opaque"
++to "y".  Where the upper filesystem contains an opaque directory, any
++directory in the lower filesystem with the same name is ignored.
++
++readdir
++-------
++
++When a 'readdir' request is made on a merged directory, the upper and
++lower directories are each read and the name lists merged in the
++obvious way (upper is read first, then lower - entries that already
++exist are not re-added).  This merged name list is cached in the
++'struct file' and so remains as long as the file is kept open.  If the
++directory is opened and read by two processes at the same time, they
++will each have separate caches.  A seekdir to the start of the
++directory (offset 0) followed by a readdir will cause the cache to be
++discarded and rebuilt.
++
++This means that changes to the merged directory do not appear while a
++directory is being read.  This is unlikely to be noticed by many
++programs.
++
++seek offsets are assigned sequentially when the directories are read.
++Thus if
++  - read part of a directory
++  - remember an offset, and close the directory
++  - re-open the directory some time later
++  - seek to the remembered offset
++
++there may be little correlation between the old and new locations in
++the list of filenames, particularly if anything has changed in the
++directory.
++
++Readdir on directories that are not merged is simply handled by the
++underlying directory (upper or lower).
++
++
++Non-directories
++---------------
++
++Objects that are not directories (files, symlinks, device-special
++files etc.) are presented either from the upper or lower filesystem as
++appropriate.  When a file in the lower filesystem is accessed in a way
++the requires write-access, such as opening for write access, changing
++some metadata etc., the file is first copied from the lower filesystem
++to the upper filesystem (copy_up).  Note that creating a hard-link
++also requires copy_up, though of course creation of a symlink does
++not.
++
++The copy_up may turn out to be unnecessary, for example if the file is
++opened for read-write but the data is not modified.
++
++The copy_up process first makes sure that the containing directory
++exists in the upper filesystem - creating it and any parents as
++necessary.  It then creates the object with the same metadata (owner,
++mode, mtime, symlink-target etc.) and then if the object is a file, the
++data is copied from the lower to the upper filesystem.  Finally any
++extended attributes are copied up.
++
++Once the copy_up is complete, the overlay filesystem simply
++provides direct access to the newly created file in the upper
++filesystem - future operations on the file are barely noticed by the
++overlay filesystem (though an operation on the name of the file such as
++rename or unlink will of course be noticed and handled).
++
++
++Non-standard behavior
++---------------------
++
++The copy_up operation essentially creates a new, identical file and
++moves it over to the old name.  The new file may be on a different
++filesystem, so both st_dev and st_ino of the file may change.
++
++Any open files referring to this inode will access the old data and
++metadata.  Similarly any file locks obtained before copy_up will not
++apply to the copied up file.
++
++On a file is opened with O_RDONLY fchmod(2), fchown(2), futimesat(2)
++and fsetxattr(2) will fail with EROFS.
++
++If a file with multiple hard links is copied up, then this will
++"break" the link.  Changes will not be propagated to other names
++referring to the same inode.
++
++Symlinks in /proc/PID/ and /proc/PID/fd which point to a non-directory
++object in overlayfs will not contain vaid absolute paths, only
++relative paths leading up to the filesystem's root.  This will be
++fixed in the future.
++
++Some operations are not atomic, for example a crash during copy_up or
++rename will leave the filesystem in an inconsitent state.  This will
++be addressed in the future.
++
++Changes to underlying filesystems
++---------------------------------
++
++Offline changes, when the overlay is not mounted, are allowed to either
++the upper or the lower trees.
++
++Changes to the underlying filesystems while part of a mounted overlay
++filesystem are not allowed.  If the underlying filesystem is changed,
++the behavior of the overlay is undefined, though it will not result in
++a crash or deadlock.
+--- a/Documentation/filesystems/vfs.txt
++++ b/Documentation/filesystems/vfs.txt
+@@ -364,6 +364,8 @@ struct inode_operations {
+ 	ssize_t (*listxattr) (struct dentry *, char *, size_t);
+ 	int (*removexattr) (struct dentry *, const char *);
+ 	void (*truncate_range)(struct inode *, loff_t, loff_t);
++	struct file *(*open) (struct dentry *, struct file *,
++			      const struct cred *);
+ };
+ 
+ Again, all methods are called without any locks being held, unless
+@@ -475,6 +477,12 @@ otherwise noted.
+   truncate_range: a method provided by the underlying filesystem to truncate a
+   	range of blocks , i.e. punch a hole somewhere in a file.
+ 
++  open: this is an alternative to f_op->open(), the difference is that this
++	method may return any open file, not necessarily originating from the
++	same filesystem as the one i_op->open() was called on.  It may be useful
++	for stacking filesystems which want to allow native I/O directly on
++	underlying files.
++
+ 
+ The Address Space Object
+ ========================
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4955,6 +4955,13 @@ F:	drivers/scsi/osd/
+ F:	include/scsi/osd_*
+ F:	fs/exofs/
+ 
++OVERLAYFS FILESYSTEM
++M:	Miklos Szeredi <miklos@szeredi.hu>
++L:	linux-fsdevel@vger.kernel.org
++S:	Supported
++F:	fs/overlayfs/*
++F:	Documentation/filesystems/overlayfs.txt
++
+ P54 WIRELESS DRIVER
+ M:	Christian Lamparter <chunkeey@googlemail.com>
+ L:	linux-wireless@vger.kernel.org
+--- a/fs/Kconfig
++++ b/fs/Kconfig
+@@ -63,6 +63,7 @@ source "fs/quota/Kconfig"
+ 
+ source "fs/autofs4/Kconfig"
+ source "fs/fuse/Kconfig"
++source "fs/overlayfs/Kconfig"
+ 
+ config CUSE
+ 	tristate "Character device in Userspace support"
+--- a/fs/Makefile
++++ b/fs/Makefile
+@@ -105,6 +105,7 @@ obj-$(CONFIG_QNX4FS_FS)		+= qnx4/
+ obj-$(CONFIG_AUTOFS4_FS)	+= autofs4/
+ obj-$(CONFIG_ADFS_FS)		+= adfs/
+ obj-$(CONFIG_FUSE_FS)		+= fuse/
++obj-$(CONFIG_OVERLAYFS_FS)	+= overlayfs/
+ obj-$(CONFIG_UDF_FS)		+= udf/
+ obj-$(CONFIG_SUN_OPENPROMFS)	+= openpromfs/
+ obj-$(CONFIG_OMFS_FS)		+= omfs/
+--- a/fs/ecryptfs/main.c
++++ b/fs/ecryptfs/main.c
+@@ -544,6 +544,13 @@ static struct dentry *ecryptfs_mount(str
+ 	s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
+ 	s->s_blocksize = path.dentry->d_sb->s_blocksize;
+ 	s->s_magic = ECRYPTFS_SUPER_MAGIC;
++	s->s_stack_depth = path.dentry->d_sb->s_stack_depth + 1;
++
++	rc = -EINVAL;
++	if (s->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
++		printk(KERN_ERR "eCryptfs: maximum fs stacking depth exceeded\n");
++		goto out_free;
++	}
+ 
+ 	inode = ecryptfs_get_inode(path.dentry->d_inode, s);
+ 	rc = PTR_ERR(inode);
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1325,6 +1325,24 @@ void drop_collected_mounts(struct vfsmou
+ 	release_mounts(&umount_list);
+ }
+ 
++struct vfsmount *clone_private_mount(struct path *path)
++{
++	struct mount *old_mnt = real_mount(path->mnt);
++	struct mount *new_mnt;
++
++	if (IS_MNT_UNBINDABLE(old_mnt))
++		return ERR_PTR(-EINVAL);
++
++	down_read(&namespace_sem);
++	new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
++	up_read(&namespace_sem);
++	if (!new_mnt)
++		return ERR_PTR(-ENOMEM);
++
++	return &new_mnt->mnt;
++}
++EXPORT_SYMBOL_GPL(clone_private_mount);
++
+ int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
+ 		   struct vfsmount *root)
+ {
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -644,24 +644,24 @@ static inline int __get_file_write_acces
+ 	return error;
+ }
+ 
+-static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
+-					struct file *f,
+-					int (*open)(struct inode *, struct file *),
+-					const struct cred *cred)
++static struct file *__dentry_open(struct path *path, struct file *f,
++				  int (*open)(struct inode *, struct file *),
++				  const struct cred *cred)
+ {
+ 	static const struct file_operations empty_fops = {};
+ 	struct inode *inode;
+ 	int error;
+ 
++	path_get(path);
+ 	f->f_mode = OPEN_FMODE(f->f_flags) | FMODE_LSEEK |
+ 				FMODE_PREAD | FMODE_PWRITE;
+ 
+ 	if (unlikely(f->f_flags & O_PATH))
+ 		f->f_mode = FMODE_PATH;
+ 
+-	inode = dentry->d_inode;
++	inode = path->dentry->d_inode;
+ 	if (f->f_mode & FMODE_WRITE) {
+-		error = __get_file_write_access(inode, mnt);
++		error = __get_file_write_access(inode, path->mnt);
+ 		if (error)
+ 			goto cleanup_file;
+ 		if (!special_file(inode->i_mode))
+@@ -669,8 +669,7 @@ static struct file *__dentry_open(struct
+ 	}
+ 
+ 	f->f_mapping = inode->i_mapping;
+-	f->f_path.dentry = dentry;
+-	f->f_path.mnt = mnt;
++	f->f_path = *path;
+ 	f->f_pos = 0;
+ 	file_sb_list_add(f, inode->i_sb);
+ 
+@@ -727,7 +726,7 @@ cleanup_all:
+ 			 * here, so just reset the state.
+ 			 */
+ 			file_reset_write(f);
+-			mnt_drop_write(mnt);
++			mnt_drop_write(path->mnt);
+ 		}
+ 	}
+ 	file_sb_list_del(f);
+@@ -735,8 +734,7 @@ cleanup_all:
+ 	f->f_path.mnt = NULL;
+ cleanup_file:
+ 	put_filp(f);
+-	dput(dentry);
+-	mntput(mnt);
++	path_put(path);
+ 	return ERR_PTR(error);
+ }
+ 
+@@ -762,14 +760,14 @@ cleanup_file:
+ struct file *lookup_instantiate_filp(struct nameidata *nd, struct dentry *dentry,
+ 		int (*open)(struct inode *, struct file *))
+ {
++	struct path path = { .dentry = dentry, .mnt = nd->path.mnt };
+ 	const struct cred *cred = current_cred();
+ 
+ 	if (IS_ERR(nd->intent.open.file))
+ 		goto out;
+ 	if (IS_ERR(dentry))
+ 		goto out_err;
+-	nd->intent.open.file = __dentry_open(dget(dentry), mntget(nd->path.mnt),
+-					     nd->intent.open.file,
++	nd->intent.open.file = __dentry_open(&path, nd->intent.open.file,
+ 					     open, cred);
+ out:
+ 	return nd->intent.open.file;
+@@ -797,11 +795,9 @@ struct file *nameidata_to_filp(struct na
+ 	nd->intent.open.file = NULL;
+ 
+ 	/* Has the filesystem initialised the file for us? */
+-	if (filp->f_path.dentry == NULL) {
+-		path_get(&nd->path);
+-		filp = __dentry_open(nd->path.dentry, nd->path.mnt, filp,
+-				     NULL, cred);
+-	}
++	if (filp->f_path.dentry == NULL)
++		filp = vfs_open(&nd->path, filp, cred);
++
+ 	return filp;
+ }
+ 
+@@ -812,27 +808,48 @@ struct file *nameidata_to_filp(struct na
+ struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags,
+ 			 const struct cred *cred)
+ {
+-	int error;
+ 	struct file *f;
++	struct file *ret;
++	struct path path = { .dentry = dentry, .mnt = mnt };
+ 
+ 	validate_creds(cred);
+ 
+ 	/* We must always pass in a valid mount pointer. */
+ 	BUG_ON(!mnt);
+ 
+-	error = -ENFILE;
++	ret = ERR_PTR(-ENFILE);
+ 	f = get_empty_filp();
+-	if (f == NULL) {
+-		dput(dentry);
+-		mntput(mnt);
+-		return ERR_PTR(error);
++	if (f != NULL) {
++		f->f_flags = flags;
++		ret = vfs_open(&path, f, cred);
+ 	}
++	path_put(&path);
+ 
+-	f->f_flags = flags;
+-	return __dentry_open(dentry, mnt, f, NULL, cred);
++	return ret;
+ }
+ EXPORT_SYMBOL(dentry_open);
+ 
++/**
++ * vfs_open - open the file at the given path
++ * @path: path to open
++ * @filp: newly allocated file with f_flag initialized
++ * @cred: credentials to use
++ *
++ * Open the file.  If successful, the returned file will have acquired
++ * an additional reference for path.
++ */
++struct file *vfs_open(struct path *path, struct file *filp,
++		      const struct cred *cred)
++{
++	struct inode *inode = path->dentry->d_inode;
++
++	if (inode->i_op->open)
++		return inode->i_op->open(path->dentry, filp, cred);
++	else
++		return __dentry_open(path, filp, NULL, cred);
++}
++EXPORT_SYMBOL(vfs_open);
++
+ static void __put_unused_fd(struct files_struct *files, unsigned int fd)
+ {
+ 	struct fdtable *fdt = files_fdtable(files);
+--- /dev/null
++++ b/fs/overlayfs/Kconfig
+@@ -0,0 +1,4 @@
++config OVERLAYFS_FS
++	tristate "Overlay filesystem support"
++	help
++	  Add support for overlay filesystem.
+--- /dev/null
++++ b/fs/overlayfs/Makefile
+@@ -0,0 +1,7 @@
++#
++# Makefile for the overlay filesystem.
++#
++
++obj-$(CONFIG_OVERLAYFS_FS) += overlayfs.o
++
++overlayfs-objs := super.o inode.o dir.o readdir.o copy_up.o
+--- /dev/null
++++ b/fs/overlayfs/copy_up.c
+@@ -0,0 +1,384 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/slab.h>
++#include <linux/file.h>
++#include <linux/splice.h>
++#include <linux/xattr.h>
++#include <linux/security.h>
++#include <linux/uaccess.h>
++#include "overlayfs.h"
++
++#define OVL_COPY_UP_CHUNK_SIZE (1 << 20)
++
++static int ovl_copy_up_xattr(struct dentry *old, struct dentry *new)
++{
++	ssize_t list_size, size;
++	char *buf, *name, *value;
++	int error;
++
++	if (!old->d_inode->i_op->getxattr ||
++	    !new->d_inode->i_op->getxattr)
++		return 0;
++
++	list_size = vfs_listxattr(old, NULL, 0);
++	if (list_size <= 0) {
++		if (list_size == -EOPNOTSUPP)
++			return 0;
++		return list_size;
++	}
++
++	buf = kzalloc(list_size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	error = -ENOMEM;
++	value = kmalloc(XATTR_SIZE_MAX, GFP_KERNEL);
++	if (!value)
++		goto out;
++
++	list_size = vfs_listxattr(old, buf, list_size);
++	if (list_size <= 0) {
++		error = list_size;
++		goto out_free_value;
++	}
++
++	for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
++		size = vfs_getxattr(old, name, value, XATTR_SIZE_MAX);
++		if (size <= 0) {
++			error = size;
++			goto out_free_value;
++		}
++		error = vfs_setxattr(new, name, value, size, 0);
++		if (error)
++			goto out_free_value;
++	}
++
++out_free_value:
++	kfree(value);
++out:
++	kfree(buf);
++	return error;
++}
++
++static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len)
++{
++	struct file *old_file;
++	struct file *new_file;
++	int error = 0;
++
++	if (len == 0)
++		return 0;
++
++	old_file = ovl_path_open(old, O_RDONLY);
++	if (IS_ERR(old_file))
++		return PTR_ERR(old_file);
++
++	new_file = ovl_path_open(new, O_WRONLY);
++	if (IS_ERR(new_file)) {
++		error = PTR_ERR(new_file);
++		goto out_fput;
++	}
++
++	/* FIXME: copy up sparse files efficiently */
++	while (len) {
++		loff_t offset = new_file->f_pos;
++		size_t this_len = OVL_COPY_UP_CHUNK_SIZE;
++		long bytes;
++
++		if (len < this_len)
++			this_len = len;
++
++		if (signal_pending_state(TASK_KILLABLE, current)) {
++			error = -EINTR;
++			break;
++		}
++
++		bytes = do_splice_direct(old_file, &offset, new_file, this_len,
++				 SPLICE_F_MOVE);
++		if (bytes <= 0) {
++			error = bytes;
++			break;
++		}
++
++		len -= bytes;
++	}
++
++	fput(new_file);
++out_fput:
++	fput(old_file);
++	return error;
++}
++
++static char *ovl_read_symlink(struct dentry *realdentry)
++{
++	int res;
++	char *buf;
++	struct inode *inode = realdentry->d_inode;
++	mm_segment_t old_fs;
++
++	res = -EINVAL;
++	if (!inode->i_op->readlink)
++		goto err;
++
++	res = -ENOMEM;
++	buf = (char *) __get_free_page(GFP_KERNEL);
++	if (!buf)
++		goto err;
++
++	old_fs = get_fs();
++	set_fs(get_ds());
++	/* The cast to a user pointer is valid due to the set_fs() */
++	res = inode->i_op->readlink(realdentry,
++				    (char __user *)buf, PAGE_SIZE - 1);
++	set_fs(old_fs);
++	if (res < 0) {
++		free_page((unsigned long) buf);
++		goto err;
++	}
++	buf[res] = '\0';
++
++	return buf;
++
++err:
++	return ERR_PTR(res);
++}
++
++static int ovl_set_timestamps(struct dentry *upperdentry, struct kstat *stat)
++{
++	struct iattr attr = {
++		.ia_valid =
++		     ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET,
++		.ia_atime = stat->atime,
++		.ia_mtime = stat->mtime,
++	};
++
++	return notify_change(upperdentry, &attr);
++}
++
++static int ovl_set_mode(struct dentry *upperdentry, umode_t mode)
++{
++	struct iattr attr = {
++		.ia_valid = ATTR_MODE,
++		.ia_mode = mode,
++	};
++
++	return notify_change(upperdentry, &attr);
++}
++
++static int ovl_copy_up_locked(struct dentry *upperdir, struct dentry *dentry,
++			      struct path *lowerpath, struct kstat *stat,
++			      const char *link)
++{
++	int err;
++	struct path newpath;
++	umode_t mode = stat->mode;
++
++	/* Can't properly set mode on creation because of the umask */
++	stat->mode &= S_IFMT;
++
++	ovl_path_upper(dentry, &newpath);
++	WARN_ON(newpath.dentry);
++	newpath.dentry = ovl_upper_create(upperdir, dentry, stat, link);
++	if (IS_ERR(newpath.dentry))
++		return PTR_ERR(newpath.dentry);
++
++	if (S_ISREG(stat->mode)) {
++		err = ovl_copy_up_data(lowerpath, &newpath, stat->size);
++		if (err)
++			goto err_remove;
++	}
++
++	err = ovl_copy_up_xattr(lowerpath->dentry, newpath.dentry);
++	if (err)
++		goto err_remove;
++
++	mutex_lock(&newpath.dentry->d_inode->i_mutex);
++	if (!S_ISLNK(stat->mode))
++		err = ovl_set_mode(newpath.dentry, mode);
++	if (!err)
++		err = ovl_set_timestamps(newpath.dentry, stat);
++	mutex_unlock(&newpath.dentry->d_inode->i_mutex);
++	if (err)
++		goto err_remove;
++
++	ovl_dentry_update(dentry, newpath.dentry);
++
++	/*
++	 * Easiest way to get rid of the lower dentry reference is to
++	 * drop this dentry.  This is neither needed nor possible for
++	 * directories.
++	 */
++	if (!S_ISDIR(stat->mode))
++		d_drop(dentry);
++
++	return 0;
++
++err_remove:
++	if (S_ISDIR(stat->mode))
++		vfs_rmdir(upperdir->d_inode, newpath.dentry);
++	else
++		vfs_unlink(upperdir->d_inode, newpath.dentry);
++
++	dput(newpath.dentry);
++
++	return err;
++}
++
++/*
++ * Copy up a single dentry
++ *
++ * Directory renames only allowed on "pure upper" (already created on
++ * upper filesystem, never copied up).  Directories which are on lower or
++ * are merged may not be renamed.  For these -EXDEV is returned and
++ * userspace has to deal with it.  This means, when copying up a
++ * directory we can rely on it and ancestors being stable.
++ *
++ * Non-directory renames start with copy up of source if necessary.  The
++ * actual rename will only proceed once the copy up was successful.  Copy
++ * up uses upper parent i_mutex for exclusion.  Since rename can change
++ * d_parent it is possible that the copy up will lock the old parent.  At
++ * that point the file will have already been copied up anyway.
++ */
++static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
++			   struct path *lowerpath, struct kstat *stat)
++{
++	int err;
++	struct kstat pstat;
++	struct path parentpath;
++	struct dentry *upperdir;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++	char *link = NULL;
++
++	ovl_path_upper(parent, &parentpath);
++	upperdir = parentpath.dentry;
++
++	err = vfs_getattr(parentpath.mnt, parentpath.dentry, &pstat);
++	if (err)
++		return err;
++
++	if (S_ISLNK(stat->mode)) {
++		link = ovl_read_symlink(lowerpath->dentry);
++		if (IS_ERR(link))
++			return PTR_ERR(link);
++	}
++
++	err = -ENOMEM;
++	override_cred = prepare_creds();
++	if (!override_cred)
++		goto out_free_link;
++
++	override_cred->fsuid = stat->uid;
++	override_cred->fsgid = stat->gid;
++	/*
++	 * CAP_SYS_ADMIN for copying up extended attributes
++	 * CAP_DAC_OVERRIDE for create
++	 * CAP_FOWNER for chmod, timestamp update
++	 * CAP_FSETID for chmod
++	 * CAP_MKNOD for mknod
++	 */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
++	cap_raise(override_cred->cap_effective, CAP_FOWNER);
++	cap_raise(override_cred->cap_effective, CAP_FSETID);
++	cap_raise(override_cred->cap_effective, CAP_MKNOD);
++	old_cred = override_creds(override_cred);
++
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++	if (ovl_path_type(dentry) != OVL_PATH_LOWER) {
++		err = 0;
++	} else {
++		err = ovl_copy_up_locked(upperdir, dentry, lowerpath,
++					 stat, link);
++		if (!err) {
++			/* Restore timestamps on parent (best effort) */
++			ovl_set_timestamps(upperdir, &pstat);
++		}
++	}
++
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++out_free_link:
++	if (link)
++		free_page((unsigned long) link);
++
++	return err;
++}
++
++int ovl_copy_up(struct dentry *dentry)
++{
++	int err;
++
++	err = 0;
++	while (!err) {
++		struct dentry *next;
++		struct dentry *parent;
++		struct path lowerpath;
++		struct kstat stat;
++		enum ovl_path_type type = ovl_path_type(dentry);
++
++		if (type != OVL_PATH_LOWER)
++			break;
++
++		next = dget(dentry);
++		/* find the topmost dentry not yet copied up */
++		for (;;) {
++			parent = dget_parent(next);
++
++			type = ovl_path_type(parent);
++			if (type != OVL_PATH_LOWER)
++				break;
++
++			dput(next);
++			next = parent;
++		}
++
++		ovl_path_lower(next, &lowerpath);
++		err = vfs_getattr(lowerpath.mnt, lowerpath.dentry, &stat);
++		if (!err)
++			err = ovl_copy_up_one(parent, next, &lowerpath, &stat);
++
++		dput(parent);
++		dput(next);
++	}
++
++	return err;
++}
++
++/* Optimize by not copying up the file first and truncating later */
++int ovl_copy_up_truncate(struct dentry *dentry, loff_t size)
++{
++	int err;
++	struct kstat stat;
++	struct path lowerpath;
++	struct dentry *parent = dget_parent(dentry);
++
++	err = ovl_copy_up(parent);
++	if (err)
++		goto out_dput_parent;
++
++	ovl_path_lower(dentry, &lowerpath);
++	err = vfs_getattr(lowerpath.mnt, lowerpath.dentry, &stat);
++	if (err)
++		goto out_dput_parent;
++
++	if (size < stat.size)
++		stat.size = size;
++
++	err = ovl_copy_up_one(parent, dentry, &lowerpath, &stat);
++
++out_dput_parent:
++	dput(parent);
++	return err;
++}
+--- /dev/null
++++ b/fs/overlayfs/dir.c
+@@ -0,0 +1,596 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/namei.h>
++#include <linux/xattr.h>
++#include <linux/security.h>
++#include "overlayfs.h"
++
++static const char *ovl_whiteout_symlink = "(overlay-whiteout)";
++
++static int ovl_whiteout(struct dentry *upperdir, struct dentry *dentry)
++{
++	int err;
++	struct dentry *newdentry;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++
++	/* FIXME: recheck lower dentry to see if whiteout is really needed */
++
++	err = -ENOMEM;
++	override_cred = prepare_creds();
++	if (!override_cred)
++		goto out;
++
++	/*
++	 * CAP_SYS_ADMIN for setxattr
++	 * CAP_DAC_OVERRIDE for symlink creation
++	 * CAP_FOWNER for unlink in sticky directory
++	 */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
++	cap_raise(override_cred->cap_effective, CAP_FOWNER);
++	override_cred->fsuid = 0;
++	override_cred->fsgid = 0;
++	old_cred = override_creds(override_cred);
++
++	newdentry = lookup_one_len(dentry->d_name.name, upperdir,
++				   dentry->d_name.len);
++	err = PTR_ERR(newdentry);
++	if (IS_ERR(newdentry))
++		goto out_put_cred;
++
++	/* Just been removed within the same locked region */
++	WARN_ON(newdentry->d_inode);
++
++	err = vfs_symlink(upperdir->d_inode, newdentry, ovl_whiteout_symlink);
++	if (err)
++		goto out_dput;
++
++	ovl_dentry_version_inc(dentry->d_parent);
++
++	err = vfs_setxattr(newdentry, ovl_whiteout_xattr, "y", 1, 0);
++	if (err)
++		vfs_unlink(upperdir->d_inode, newdentry);
++
++out_dput:
++	dput(newdentry);
++out_put_cred:
++	revert_creds(old_cred);
++	put_cred(override_cred);
++out:
++	if (err) {
++		/*
++		 * There's no way to recover from failure to whiteout.
++		 * What should we do?  Log a big fat error and... ?
++		 */
++		printk(KERN_ERR "overlayfs: ERROR - failed to whiteout '%s'\n",
++		       dentry->d_name.name);
++	}
++
++	return err;
++}
++
++static struct dentry *ovl_lookup_create(struct dentry *upperdir,
++					struct dentry *template)
++{
++	int err;
++	struct dentry *newdentry;
++	struct qstr *name = &template->d_name;
++
++	newdentry = lookup_one_len(name->name, upperdir, name->len);
++	if (IS_ERR(newdentry))
++		return newdentry;
++
++	if (newdentry->d_inode) {
++		const struct cred *old_cred;
++		struct cred *override_cred;
++
++		/* No need to check whiteout if lower parent is non-existent */
++		err = -EEXIST;
++		if (!ovl_dentry_lower(template->d_parent))
++			goto out_dput;
++
++		if (!S_ISLNK(newdentry->d_inode->i_mode))
++			goto out_dput;
++
++		err = -ENOMEM;
++		override_cred = prepare_creds();
++		if (!override_cred)
++			goto out_dput;
++
++		/*
++		 * CAP_SYS_ADMIN for getxattr
++		 * CAP_FOWNER for unlink in sticky directory
++		 */
++		cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++		cap_raise(override_cred->cap_effective, CAP_FOWNER);
++		old_cred = override_creds(override_cred);
++
++		err = -EEXIST;
++		if (ovl_is_whiteout(newdentry))
++			err = vfs_unlink(upperdir->d_inode, newdentry);
++
++		revert_creds(old_cred);
++		put_cred(override_cred);
++		if (err)
++			goto out_dput;
++
++		dput(newdentry);
++		newdentry = lookup_one_len(name->name, upperdir, name->len);
++		if (IS_ERR(newdentry)) {
++			ovl_whiteout(upperdir, template);
++			return newdentry;
++		}
++
++		/*
++		 * Whiteout just been successfully removed, parent
++		 * i_mutex is still held, there's no way the lookup
++		 * could return positive.
++		 */
++		WARN_ON(newdentry->d_inode);
++	}
++
++	return newdentry;
++
++out_dput:
++	dput(newdentry);
++	return ERR_PTR(err);
++}
++
++struct dentry *ovl_upper_create(struct dentry *upperdir, struct dentry *dentry,
++				struct kstat *stat, const char *link)
++{
++	int err;
++	struct dentry *newdentry;
++	struct inode *dir = upperdir->d_inode;
++
++	newdentry = ovl_lookup_create(upperdir, dentry);
++	if (IS_ERR(newdentry))
++		goto out;
++
++	switch (stat->mode & S_IFMT) {
++	case S_IFREG:
++		err = vfs_create(dir, newdentry, stat->mode, NULL);
++		break;
++
++	case S_IFDIR:
++		err = vfs_mkdir(dir, newdentry, stat->mode);
++		break;
++
++	case S_IFCHR:
++	case S_IFBLK:
++	case S_IFIFO:
++	case S_IFSOCK:
++		err = vfs_mknod(dir, newdentry, stat->mode, stat->rdev);
++		break;
++
++	case S_IFLNK:
++		err = vfs_symlink(dir, newdentry, link);
++		break;
++
++	default:
++		err = -EPERM;
++	}
++	if (err) {
++		if (ovl_dentry_is_opaque(dentry))
++			ovl_whiteout(upperdir, dentry);
++		dput(newdentry);
++		newdentry = ERR_PTR(err);
++	} else if (WARN_ON(!newdentry->d_inode)) {
++		/*
++		 * Not quite sure if non-instantiated dentry is legal or not.
++		 * VFS doesn't seem to care so check and warn here.
++		 */
++		dput(newdentry);
++		newdentry = ERR_PTR(-ENOENT);
++	}
++
++out:
++	return newdentry;
++
++}
++
++static int ovl_set_opaque(struct dentry *upperdentry)
++{
++	int err;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++
++	override_cred = prepare_creds();
++	if (!override_cred)
++		return -ENOMEM;
++
++	/* CAP_SYS_ADMIN for setxattr of "trusted" namespace */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	old_cred = override_creds(override_cred);
++	err = vfs_setxattr(upperdentry, ovl_opaque_xattr, "y", 1, 0);
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++	return err;
++}
++
++static int ovl_remove_opaque(struct dentry *upperdentry)
++{
++	int err;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++
++	override_cred = prepare_creds();
++	if (!override_cred)
++		return -ENOMEM;
++
++	/* CAP_SYS_ADMIN for removexattr of "trusted" namespace */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	old_cred = override_creds(override_cred);
++	err = vfs_removexattr(upperdentry, ovl_opaque_xattr);
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++	return err;
++}
++
++static int ovl_dir_getattr(struct vfsmount *mnt, struct dentry *dentry,
++			 struct kstat *stat)
++{
++	int err;
++	enum ovl_path_type type;
++	struct path realpath;
++
++	type = ovl_path_real(dentry, &realpath);
++	err = vfs_getattr(realpath.mnt, realpath.dentry, stat);
++	if (err)
++		return err;
++
++	stat->dev = dentry->d_sb->s_dev;
++	stat->ino = dentry->d_inode->i_ino;
++
++	/*
++	 * It's probably not worth it to count subdirs to get the
++	 * correct link count.  nlink=1 seems to pacify 'find' and
++	 * other utilities.
++	 */
++	if (type == OVL_PATH_MERGE)
++		stat->nlink = 1;
++
++	return 0;
++}
++
++static int ovl_create_object(struct dentry *dentry, int mode, dev_t rdev,
++			     const char *link)
++{
++	int err;
++	struct dentry *newdentry;
++	struct dentry *upperdir;
++	struct inode *inode;
++	struct kstat stat = {
++		.mode = mode,
++		.rdev = rdev,
++	};
++
++	err = -ENOMEM;
++	inode = ovl_new_inode(dentry->d_sb, mode, dentry->d_fsdata);
++	if (!inode)
++		goto out;
++
++	err = ovl_copy_up(dentry->d_parent);
++	if (err)
++		goto out_iput;
++
++	upperdir = ovl_dentry_upper(dentry->d_parent);
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++
++	newdentry = ovl_upper_create(upperdir, dentry, &stat, link);
++	err = PTR_ERR(newdentry);
++	if (IS_ERR(newdentry))
++		goto out_unlock;
++
++	ovl_dentry_version_inc(dentry->d_parent);
++	if (ovl_dentry_is_opaque(dentry) && S_ISDIR(mode)) {
++		err = ovl_set_opaque(newdentry);
++		if (err) {
++			vfs_rmdir(upperdir->d_inode, newdentry);
++			ovl_whiteout(upperdir, dentry);
++			goto out_dput;
++		}
++	}
++	ovl_dentry_update(dentry, newdentry);
++	d_instantiate(dentry, inode);
++	inode = NULL;
++	newdentry = NULL;
++	err = 0;
++
++out_dput:
++	dput(newdentry);
++out_unlock:
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++out_iput:
++	iput(inode);
++out:
++	return err;
++}
++
++static int ovl_create(struct inode *dir, struct dentry *dentry, umode_t mode,
++			struct nameidata *nd)
++{
++	return ovl_create_object(dentry, (mode & 07777) | S_IFREG, 0, NULL);
++}
++
++static int ovl_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
++{
++	return ovl_create_object(dentry, (mode & 07777) | S_IFDIR, 0, NULL);
++}
++
++static int ovl_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
++		     dev_t rdev)
++{
++	return ovl_create_object(dentry, mode, rdev, NULL);
++}
++
++static int ovl_symlink(struct inode *dir, struct dentry *dentry,
++			 const char *link)
++{
++	return ovl_create_object(dentry, S_IFLNK, 0, link);
++}
++
++static int ovl_do_remove(struct dentry *dentry, bool is_dir)
++{
++	int err;
++	enum ovl_path_type type;
++	struct path realpath;
++	struct dentry *upperdir;
++
++	err = ovl_copy_up(dentry->d_parent);
++	if (err)
++		return err;
++
++	upperdir = ovl_dentry_upper(dentry->d_parent);
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++	type = ovl_path_real(dentry, &realpath);
++	if (type != OVL_PATH_LOWER) {
++		err = -ESTALE;
++		if (realpath.dentry->d_parent != upperdir)
++			goto out_d_drop;
++
++		/* FIXME: create whiteout up front and rename to target */
++
++		if (is_dir)
++			err = vfs_rmdir(upperdir->d_inode, realpath.dentry);
++		else
++			err = vfs_unlink(upperdir->d_inode, realpath.dentry);
++		if (err)
++			goto out_d_drop;
++
++		ovl_dentry_version_inc(dentry->d_parent);
++	}
++
++	if (type != OVL_PATH_UPPER || ovl_dentry_is_opaque(dentry))
++		err = ovl_whiteout(upperdir, dentry);
++
++	/*
++	 * Keeping this dentry hashed would mean having to release
++	 * upperpath/lowerpath, which could only be done if we are the
++	 * sole user of this dentry.  Too tricky...  Just unhash for
++	 * now.
++	 */
++out_d_drop:
++	d_drop(dentry);
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++
++	return err;
++}
++
++static int ovl_unlink(struct inode *dir, struct dentry *dentry)
++{
++	return ovl_do_remove(dentry, false);
++}
++
++
++static int ovl_rmdir(struct inode *dir, struct dentry *dentry)
++{
++	int err;
++	enum ovl_path_type type;
++
++	type = ovl_path_type(dentry);
++	if (type != OVL_PATH_UPPER) {
++		err = ovl_check_empty_and_clear(dentry, type);
++		if (err)
++			return err;
++	}
++
++	return ovl_do_remove(dentry, true);
++}
++
++static int ovl_link(struct dentry *old, struct inode *newdir,
++		    struct dentry *new)
++{
++	int err;
++	struct dentry *olddentry;
++	struct dentry *newdentry;
++	struct dentry *upperdir;
++
++	err = ovl_copy_up(old);
++	if (err)
++		goto out;
++
++	err = ovl_copy_up(new->d_parent);
++	if (err)
++		goto out;
++
++	upperdir = ovl_dentry_upper(new->d_parent);
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++	newdentry = ovl_lookup_create(upperdir, new);
++	err = PTR_ERR(newdentry);
++	if (IS_ERR(newdentry))
++		goto out_unlock;
++
++	olddentry = ovl_dentry_upper(old);
++	err = vfs_link(olddentry, upperdir->d_inode, newdentry);
++	if (!err) {
++		if (WARN_ON(!newdentry->d_inode)) {
++			dput(newdentry);
++			err = -ENOENT;
++			goto out_unlock;
++		}
++
++		ovl_dentry_version_inc(new->d_parent);
++		ovl_dentry_update(new, newdentry);
++
++		ihold(old->d_inode);
++		d_instantiate(new, old->d_inode);
++	} else {
++		if (ovl_dentry_is_opaque(new))
++			ovl_whiteout(upperdir, new);
++		dput(newdentry);
++	}
++out_unlock:
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++out:
++	return err;
++
++}
++
++static int ovl_rename(struct inode *olddir, struct dentry *old,
++			struct inode *newdir, struct dentry *new)
++{
++	int err;
++	enum ovl_path_type old_type;
++	enum ovl_path_type new_type;
++	struct dentry *old_upperdir;
++	struct dentry *new_upperdir;
++	struct dentry *olddentry;
++	struct dentry *newdentry;
++	struct dentry *trap;
++	bool old_opaque;
++	bool new_opaque;
++	bool new_create = false;
++	bool is_dir = S_ISDIR(old->d_inode->i_mode);
++
++	/* Don't copy up directory trees */
++	old_type = ovl_path_type(old);
++	if (old_type != OVL_PATH_UPPER && is_dir)
++		return -EXDEV;
++
++	if (new->d_inode) {
++		new_type = ovl_path_type(new);
++
++		if (new_type == OVL_PATH_LOWER && old_type == OVL_PATH_LOWER) {
++			if (ovl_dentry_lower(old)->d_inode ==
++			    ovl_dentry_lower(new)->d_inode)
++				return 0;
++		}
++		if (new_type != OVL_PATH_LOWER && old_type != OVL_PATH_LOWER) {
++			if (ovl_dentry_upper(old)->d_inode ==
++			    ovl_dentry_upper(new)->d_inode)
++				return 0;
++		}
++
++		if (new_type != OVL_PATH_UPPER &&
++		    S_ISDIR(new->d_inode->i_mode)) {
++			err = ovl_check_empty_and_clear(new, new_type);
++			if (err)
++				return err;
++		}
++	} else {
++		new_type = OVL_PATH_UPPER;
++	}
++
++	err = ovl_copy_up(old);
++	if (err)
++		return err;
++
++	err = ovl_copy_up(new->d_parent);
++	if (err)
++		return err;
++
++	old_upperdir = ovl_dentry_upper(old->d_parent);
++	new_upperdir = ovl_dentry_upper(new->d_parent);
++
++	trap = lock_rename(new_upperdir, old_upperdir);
++
++	olddentry = ovl_dentry_upper(old);
++	newdentry = ovl_dentry_upper(new);
++	if (newdentry) {
++		dget(newdentry);
++	} else {
++		new_create = true;
++		newdentry = ovl_lookup_create(new_upperdir, new);
++		err = PTR_ERR(newdentry);
++		if (IS_ERR(newdentry))
++			goto out_unlock;
++	}
++
++	err = -ESTALE;
++	if (olddentry->d_parent != old_upperdir)
++		goto out_dput;
++	if (newdentry->d_parent != new_upperdir)
++		goto out_dput;
++	if (olddentry == trap)
++		goto out_dput;
++	if (newdentry == trap)
++		goto out_dput;
++
++	old_opaque = ovl_dentry_is_opaque(old);
++	new_opaque = ovl_dentry_is_opaque(new) || new_type != OVL_PATH_UPPER;
++
++	if (is_dir && !old_opaque && new_opaque) {
++		err = ovl_set_opaque(olddentry);
++		if (err)
++			goto out_dput;
++	}
++
++	err = vfs_rename(old_upperdir->d_inode, olddentry,
++			 new_upperdir->d_inode, newdentry);
++
++	if (err) {
++		if (new_create && ovl_dentry_is_opaque(new))
++			ovl_whiteout(new_upperdir, new);
++		if (is_dir && !old_opaque && new_opaque)
++			ovl_remove_opaque(olddentry);
++		goto out_dput;
++	}
++
++	if (old_type != OVL_PATH_UPPER || old_opaque)
++		err = ovl_whiteout(old_upperdir, old);
++	if (is_dir && old_opaque && !new_opaque)
++		ovl_remove_opaque(olddentry);
++
++	if (old_opaque != new_opaque)
++		ovl_dentry_set_opaque(old, new_opaque);
++
++	ovl_dentry_version_inc(old->d_parent);
++	ovl_dentry_version_inc(new->d_parent);
++
++out_dput:
++	dput(newdentry);
++out_unlock:
++	unlock_rename(new_upperdir, old_upperdir);
++	return err;
++}
++
++const struct inode_operations ovl_dir_inode_operations = {
++	.lookup		= ovl_lookup,
++	.mkdir		= ovl_mkdir,
++	.symlink	= ovl_symlink,
++	.unlink		= ovl_unlink,
++	.rmdir		= ovl_rmdir,
++	.rename		= ovl_rename,
++	.link		= ovl_link,
++	.setattr	= ovl_setattr,
++	.create		= ovl_create,
++	.mknod		= ovl_mknod,
++	.permission	= ovl_permission,
++	.getattr	= ovl_dir_getattr,
++	.setxattr	= ovl_setxattr,
++	.getxattr	= ovl_getxattr,
++	.listxattr	= ovl_listxattr,
++	.removexattr	= ovl_removexattr,
++};
+--- /dev/null
++++ b/fs/overlayfs/inode.c
+@@ -0,0 +1,384 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/slab.h>
++#include <linux/xattr.h>
++#include "overlayfs.h"
++
++int ovl_setattr(struct dentry *dentry, struct iattr *attr)
++{
++	struct dentry *upperdentry;
++	int err;
++
++	if ((attr->ia_valid & ATTR_SIZE) && !ovl_dentry_upper(dentry))
++		err = ovl_copy_up_truncate(dentry, attr->ia_size);
++	else
++		err = ovl_copy_up(dentry);
++	if (err)
++		return err;
++
++	upperdentry = ovl_dentry_upper(dentry);
++
++	if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
++		attr->ia_valid &= ~ATTR_MODE;
++
++	mutex_lock(&upperdentry->d_inode->i_mutex);
++	err = notify_change(upperdentry, attr);
++	mutex_unlock(&upperdentry->d_inode->i_mutex);
++
++	return err;
++}
++
++static int ovl_getattr(struct vfsmount *mnt, struct dentry *dentry,
++			 struct kstat *stat)
++{
++	struct path realpath;
++
++	ovl_path_real(dentry, &realpath);
++	return vfs_getattr(realpath.mnt, realpath.dentry, stat);
++}
++
++int ovl_permission(struct inode *inode, int mask)
++{
++	struct ovl_entry *oe;
++	struct dentry *alias = NULL;
++	struct inode *realinode;
++	struct dentry *realdentry;
++	bool is_upper;
++	int err;
++
++	if (S_ISDIR(inode->i_mode)) {
++		oe = inode->i_private;
++	} else if (mask & MAY_NOT_BLOCK) {
++		return -ECHILD;
++	} else {
++		/*
++		 * For non-directories find an alias and get the info
++		 * from there.
++		 */
++		spin_lock(&inode->i_lock);
++		if (WARN_ON(list_empty(&inode->i_dentry))) {
++			spin_unlock(&inode->i_lock);
++			return -ENOENT;
++		}
++		alias = list_entry(inode->i_dentry.next,
++				   struct dentry, d_alias);
++		dget(alias);
++		spin_unlock(&inode->i_lock);
++		oe = alias->d_fsdata;
++	}
++
++	realdentry = ovl_entry_real(oe, &is_upper);
++
++	/* Careful in RCU walk mode */
++	realinode = ACCESS_ONCE(realdentry->d_inode);
++	if (!realinode) {
++		WARN_ON(!(mask & MAY_NOT_BLOCK));
++		err = -ENOENT;
++		goto out_dput;
++	}
++
++	if (mask & MAY_WRITE) {
++		umode_t mode = realinode->i_mode;
++
++		/*
++		 * Writes will always be redirected to upper layer, so
++		 * ignore lower layer being read-only.
++		 *
++		 * If the overlay itself is read-only then proceed
++		 * with the permission check, don't return EROFS.
++		 * This will only happen if this is the lower layer of
++		 * another overlayfs.
++		 *
++		 * If upper fs becomes read-only after the overlay was
++		 * constructed return EROFS to prevent modification of
++		 * upper layer.
++		 */
++		err = -EROFS;
++		if (is_upper && !IS_RDONLY(inode) && IS_RDONLY(realinode) &&
++		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
++			goto out_dput;
++
++		/*
++		 * Nobody gets write access to an immutable file.
++		 */
++		err = -EACCES;
++		if (IS_IMMUTABLE(realinode))
++			goto out_dput;
++	}
++
++	if (realinode->i_op->permission)
++		err = realinode->i_op->permission(realinode, mask);
++	else
++		err = generic_permission(realinode, mask);
++out_dput:
++	dput(alias);
++	return err;
++}
++
++
++struct ovl_link_data {
++	struct dentry *realdentry;
++	void *cookie;
++};
++
++static void *ovl_follow_link(struct dentry *dentry, struct nameidata *nd)
++{
++	void *ret;
++	struct dentry *realdentry;
++	struct inode *realinode;
++
++	realdentry = ovl_dentry_real(dentry);
++	realinode = realdentry->d_inode;
++
++	if (WARN_ON(!realinode->i_op->follow_link))
++		return ERR_PTR(-EPERM);
++
++	ret = realinode->i_op->follow_link(realdentry, nd);
++	if (IS_ERR(ret))
++		return ret;
++
++	if (realinode->i_op->put_link) {
++		struct ovl_link_data *data;
++
++		data = kmalloc(sizeof(struct ovl_link_data), GFP_KERNEL);
++		if (!data) {
++			realinode->i_op->put_link(realdentry, nd, ret);
++			return ERR_PTR(-ENOMEM);
++		}
++		data->realdentry = realdentry;
++		data->cookie = ret;
++
++		return data;
++	} else {
++		return NULL;
++	}
++}
++
++static void ovl_put_link(struct dentry *dentry, struct nameidata *nd, void *c)
++{
++	struct inode *realinode;
++	struct ovl_link_data *data = c;
++
++	if (!data)
++		return;
++
++	realinode = data->realdentry->d_inode;
++	realinode->i_op->put_link(data->realdentry, nd, data->cookie);
++	kfree(data);
++}
++
++static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
++{
++	struct path realpath;
++	struct inode *realinode;
++
++	ovl_path_real(dentry, &realpath);
++	realinode = realpath.dentry->d_inode;
++
++	if (!realinode->i_op->readlink)
++		return -EINVAL;
++
++	touch_atime(realpath.mnt, realpath.dentry);
++
++	return realinode->i_op->readlink(realpath.dentry, buf, bufsiz);
++}
++
++
++static bool ovl_is_private_xattr(const char *name)
++{
++	return strncmp(name, "trusted.overlay.", 14) == 0;
++}
++
++int ovl_setxattr(struct dentry *dentry, const char *name,
++		 const void *value, size_t size, int flags)
++{
++	int err;
++	struct dentry *upperdentry;
++
++	if (ovl_is_private_xattr(name))
++		return -EPERM;
++
++	err = ovl_copy_up(dentry);
++	if (err)
++		return err;
++
++	upperdentry = ovl_dentry_upper(dentry);
++	return  vfs_setxattr(upperdentry, name, value, size, flags);
++}
++
++ssize_t ovl_getxattr(struct dentry *dentry, const char *name,
++		     void *value, size_t size)
++{
++	if (ovl_path_type(dentry->d_parent) == OVL_PATH_MERGE &&
++	    ovl_is_private_xattr(name))
++		return -ENODATA;
++
++	return vfs_getxattr(ovl_dentry_real(dentry), name, value, size);
++}
++
++ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
++{
++	ssize_t res;
++	int off;
++
++	res = vfs_listxattr(ovl_dentry_real(dentry), list, size);
++	if (res <= 0 || size == 0)
++		return res;
++
++	if (ovl_path_type(dentry->d_parent) != OVL_PATH_MERGE)
++		return res;
++
++	/* filter out private xattrs */
++	for (off = 0; off < res;) {
++		char *s = list + off;
++		size_t slen = strlen(s) + 1;
++
++		BUG_ON(off + slen > res);
++
++		if (ovl_is_private_xattr(s)) {
++			res -= slen;
++			memmove(s, s + slen, res - off);
++		} else {
++			off += slen;
++		}
++	}
++
++	return res;
++}
++
++int ovl_removexattr(struct dentry *dentry, const char *name)
++{
++	int err;
++	struct path realpath;
++	enum ovl_path_type type;
++
++	if (ovl_path_type(dentry->d_parent) == OVL_PATH_MERGE &&
++	    ovl_is_private_xattr(name))
++		return -ENODATA;
++
++	type = ovl_path_real(dentry, &realpath);
++	if (type == OVL_PATH_LOWER) {
++		err = vfs_getxattr(realpath.dentry, name, NULL, 0);
++		if (err < 0)
++			return err;
++
++		err = ovl_copy_up(dentry);
++		if (err)
++			return err;
++
++		ovl_path_upper(dentry, &realpath);
++	}
++
++	return vfs_removexattr(realpath.dentry, name);
++}
++
++static bool ovl_open_need_copy_up(int flags, enum ovl_path_type type,
++				  struct dentry *realdentry)
++{
++	if (type != OVL_PATH_LOWER)
++		return false;
++
++	if (special_file(realdentry->d_inode->i_mode))
++		return false;
++
++	if (!(OPEN_FMODE(flags) & FMODE_WRITE) && !(flags & O_TRUNC))
++		return false;
++
++	return true;
++}
++
++static struct file *ovl_open(struct dentry *dentry, struct file *file,
++			     const struct cred *cred)
++{
++	int err;
++	struct path realpath;
++	enum ovl_path_type type;
++
++	type = ovl_path_real(dentry, &realpath);
++	if (ovl_open_need_copy_up(file->f_flags, type, realpath.dentry)) {
++		if (file->f_flags & O_TRUNC)
++			err = ovl_copy_up_truncate(dentry, 0);
++		else
++			err = ovl_copy_up(dentry);
++		if (err)
++			return ERR_PTR(err);
++
++		ovl_path_upper(dentry, &realpath);
++	}
++
++	return vfs_open(&realpath, file, cred);
++}
++
++static const struct inode_operations ovl_file_inode_operations = {
++	.setattr	= ovl_setattr,
++	.permission	= ovl_permission,
++	.getattr	= ovl_getattr,
++	.setxattr	= ovl_setxattr,
++	.getxattr	= ovl_getxattr,
++	.listxattr	= ovl_listxattr,
++	.removexattr	= ovl_removexattr,
++	.open		= ovl_open,
++};
++
++static const struct inode_operations ovl_symlink_inode_operations = {
++	.setattr	= ovl_setattr,
++	.follow_link	= ovl_follow_link,
++	.put_link	= ovl_put_link,
++	.readlink	= ovl_readlink,
++	.getattr	= ovl_getattr,
++	.setxattr	= ovl_setxattr,
++	.getxattr	= ovl_getxattr,
++	.listxattr	= ovl_listxattr,
++	.removexattr	= ovl_removexattr,
++};
++
++struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
++			    struct ovl_entry *oe)
++{
++	struct inode *inode;
++
++	inode = new_inode(sb);
++	if (!inode)
++		return NULL;
++
++	mode &= S_IFMT;
++
++	inode->i_ino = get_next_ino();
++	inode->i_mode = mode;
++	inode->i_flags |= S_NOATIME | S_NOCMTIME;
++
++	switch (mode) {
++	case S_IFDIR:
++		inode->i_private = oe;
++		inode->i_op = &ovl_dir_inode_operations;
++		inode->i_fop = &ovl_dir_operations;
++		break;
++
++	case S_IFLNK:
++		inode->i_op = &ovl_symlink_inode_operations;
++		break;
++
++	case S_IFREG:
++	case S_IFSOCK:
++	case S_IFBLK:
++	case S_IFCHR:
++	case S_IFIFO:
++		inode->i_op = &ovl_file_inode_operations;
++		break;
++
++	default:
++		WARN(1, "illegal file type: %i\n", mode);
++		inode = NULL;
++	}
++
++	return inode;
++
++}
+--- /dev/null
++++ b/fs/overlayfs/overlayfs.h
+@@ -0,0 +1,64 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++struct ovl_entry;
++
++enum ovl_path_type {
++	OVL_PATH_UPPER,
++	OVL_PATH_MERGE,
++	OVL_PATH_LOWER,
++};
++
++extern const char *ovl_opaque_xattr;
++extern const char *ovl_whiteout_xattr;
++extern const struct dentry_operations ovl_dentry_operations;
++
++enum ovl_path_type ovl_path_type(struct dentry *dentry);
++u64 ovl_dentry_version_get(struct dentry *dentry);
++void ovl_dentry_version_inc(struct dentry *dentry);
++void ovl_path_upper(struct dentry *dentry, struct path *path);
++void ovl_path_lower(struct dentry *dentry, struct path *path);
++enum ovl_path_type ovl_path_real(struct dentry *dentry, struct path *path);
++struct dentry *ovl_dentry_upper(struct dentry *dentry);
++struct dentry *ovl_dentry_lower(struct dentry *dentry);
++struct dentry *ovl_dentry_real(struct dentry *dentry);
++struct dentry *ovl_entry_real(struct ovl_entry *oe, bool *is_upper);
++bool ovl_dentry_is_opaque(struct dentry *dentry);
++void ovl_dentry_set_opaque(struct dentry *dentry, bool opaque);
++bool ovl_is_whiteout(struct dentry *dentry);
++void ovl_dentry_update(struct dentry *dentry, struct dentry *upperdentry);
++struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
++			  struct nameidata *nd);
++struct file *ovl_path_open(struct path *path, int flags);
++
++struct dentry *ovl_upper_create(struct dentry *upperdir, struct dentry *dentry,
++				struct kstat *stat, const char *link);
++
++/* readdir.c */
++extern const struct file_operations ovl_dir_operations;
++int ovl_check_empty_and_clear(struct dentry *dentry, enum ovl_path_type type);
++
++/* inode.c */
++int ovl_setattr(struct dentry *dentry, struct iattr *attr);
++int ovl_permission(struct inode *inode, int mask);
++int ovl_setxattr(struct dentry *dentry, const char *name,
++		 const void *value, size_t size, int flags);
++ssize_t ovl_getxattr(struct dentry *dentry, const char *name,
++		     void *value, size_t size);
++ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
++int ovl_removexattr(struct dentry *dentry, const char *name);
++
++struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
++			    struct ovl_entry *oe);
++/* dir.c */
++extern const struct inode_operations ovl_dir_inode_operations;
++
++/* copy_up.c */
++int ovl_copy_up(struct dentry *dentry);
++int ovl_copy_up_truncate(struct dentry *dentry, loff_t size);
+--- /dev/null
++++ b/fs/overlayfs/readdir.c
+@@ -0,0 +1,565 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/slab.h>
++#include <linux/namei.h>
++#include <linux/file.h>
++#include <linux/xattr.h>
++#include <linux/rbtree.h>
++#include <linux/security.h>
++#include "overlayfs.h"
++
++struct ovl_cache_entry {
++	const char *name;
++	unsigned int len;
++	unsigned int type;
++	u64 ino;
++	bool is_whiteout;
++	struct list_head l_node;
++	struct rb_node node;
++};
++
++struct ovl_readdir_data {
++	struct rb_root *root;
++	struct list_head *list;
++	struct list_head *middle;
++	struct dentry *dir;
++	int count;
++	int err;
++};
++
++struct ovl_dir_file {
++	bool is_real;
++	bool is_cached;
++	struct list_head cursor;
++	u64 cache_version;
++	struct list_head cache;
++	struct file *realfile;
++};
++
++static struct ovl_cache_entry *ovl_cache_entry_from_node(struct rb_node *n)
++{
++	return container_of(n, struct ovl_cache_entry, node);
++}
++
++static struct ovl_cache_entry *ovl_cache_entry_find(struct rb_root *root,
++						    const char *name, int len)
++{
++	struct rb_node *node = root->rb_node;
++	int cmp;
++
++	while (node) {
++		struct ovl_cache_entry *p = ovl_cache_entry_from_node(node);
++
++		cmp = strncmp(name, p->name, len);
++		if (cmp > 0)
++			node = p->node.rb_right;
++		else if (cmp < 0 || len < p->len)
++			node = p->node.rb_left;
++		else
++			return p;
++	}
++
++	return NULL;
++}
++
++static struct ovl_cache_entry *ovl_cache_entry_new(const char *name, int len,
++						   u64 ino, unsigned int d_type)
++{
++	struct ovl_cache_entry *p;
++
++	p = kmalloc(sizeof(*p) + len + 1, GFP_KERNEL);
++	if (p) {
++		char *name_copy = (char *) (p + 1);
++		memcpy(name_copy, name, len);
++		name_copy[len] = '\0';
++		p->name = name_copy;
++		p->len = len;
++		p->type = d_type;
++		p->ino = ino;
++		p->is_whiteout = false;
++	}
++
++	return p;
++}
++
++static int ovl_cache_entry_add_rb(struct ovl_readdir_data *rdd,
++				  const char *name, int len, u64 ino,
++				  unsigned int d_type)
++{
++	struct rb_node **newp = &rdd->root->rb_node;
++	struct rb_node *parent = NULL;
++	struct ovl_cache_entry *p;
++
++	while (*newp) {
++		int cmp;
++		struct ovl_cache_entry *tmp;
++
++		parent = *newp;
++		tmp = ovl_cache_entry_from_node(*newp);
++		cmp = strncmp(name, tmp->name, len);
++		if (cmp > 0)
++			newp = &tmp->node.rb_right;
++		else if (cmp < 0 || len < tmp->len)
++			newp = &tmp->node.rb_left;
++		else
++			return 0;
++	}
++
++	p = ovl_cache_entry_new(name, len, ino, d_type);
++	if (p == NULL)
++		return -ENOMEM;
++
++	list_add_tail(&p->l_node, rdd->list);
++	rb_link_node(&p->node, parent, newp);
++	rb_insert_color(&p->node, rdd->root);
++
++	return 0;
++}
++
++static int ovl_fill_lower(void *buf, const char *name, int namelen,
++			    loff_t offset, u64 ino, unsigned int d_type)
++{
++	struct ovl_readdir_data *rdd = buf;
++	struct ovl_cache_entry *p;
++
++	rdd->count++;
++	p = ovl_cache_entry_find(rdd->root, name, namelen);
++	if (p) {
++		list_move_tail(&p->l_node, rdd->middle);
++	} else {
++		p = ovl_cache_entry_new(name, namelen, ino, d_type);
++		if (p == NULL)
++			rdd->err = -ENOMEM;
++		else
++			list_add_tail(&p->l_node, rdd->middle);
++	}
++
++	return rdd->err;
++}
++
++static void ovl_cache_free(struct list_head *list)
++{
++	struct ovl_cache_entry *p;
++	struct ovl_cache_entry *n;
++
++	list_for_each_entry_safe(p, n, list, l_node)
++		kfree(p);
++
++	INIT_LIST_HEAD(list);
++}
++
++static int ovl_fill_upper(void *buf, const char *name, int namelen,
++			  loff_t offset, u64 ino, unsigned int d_type)
++{
++	struct ovl_readdir_data *rdd = buf;
++
++	rdd->count++;
++	return ovl_cache_entry_add_rb(rdd, name, namelen, ino, d_type);
++}
++
++static inline int ovl_dir_read(struct path *realpath,
++			       struct ovl_readdir_data *rdd, filldir_t filler)
++{
++	struct file *realfile;
++	int err;
++
++	realfile = ovl_path_open(realpath, O_RDONLY | O_DIRECTORY);
++	if (IS_ERR(realfile))
++		return PTR_ERR(realfile);
++
++	do {
++		rdd->count = 0;
++		rdd->err = 0;
++		err = vfs_readdir(realfile, filler, rdd);
++		if (err >= 0)
++			err = rdd->err;
++	} while (!err && rdd->count);
++	fput(realfile);
++
++	return 0;
++}
++
++static void ovl_dir_reset(struct file *file)
++{
++	struct ovl_dir_file *od = file->private_data;
++	enum ovl_path_type type = ovl_path_type(file->f_path.dentry);
++
++	if (ovl_dentry_version_get(file->f_path.dentry) != od->cache_version) {
++		list_del_init(&od->cursor);
++		ovl_cache_free(&od->cache);
++		od->is_cached = false;
++	}
++	WARN_ON(!od->is_real && type != OVL_PATH_MERGE);
++	if (od->is_real && type == OVL_PATH_MERGE) {
++		fput(od->realfile);
++		od->realfile = NULL;
++		od->is_real = false;
++	}
++}
++
++static int ovl_dir_mark_whiteouts(struct ovl_readdir_data *rdd)
++{
++	struct ovl_cache_entry *p;
++	struct dentry *dentry;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++
++	override_cred = prepare_creds();
++	if (!override_cred) {
++		ovl_cache_free(rdd->list);
++		return -ENOMEM;
++	}
++
++	/*
++	 * CAP_SYS_ADMIN for getxattr
++	 * CAP_DAC_OVERRIDE for lookup
++	 */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
++	old_cred = override_creds(override_cred);
++
++	mutex_lock(&rdd->dir->d_inode->i_mutex);
++	list_for_each_entry(p, rdd->list, l_node) {
++		if (p->type != DT_LNK)
++			continue;
++
++		dentry = lookup_one_len(p->name, rdd->dir, p->len);
++		if (IS_ERR(dentry))
++			continue;
++
++		p->is_whiteout = ovl_is_whiteout(dentry);
++		dput(dentry);
++	}
++	mutex_unlock(&rdd->dir->d_inode->i_mutex);
++
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++	return 0;
++}
++
++static inline int ovl_dir_read_merged(struct path *upperpath,
++				      struct path *lowerpath,
++				      struct ovl_readdir_data *rdd)
++{
++	int err;
++	struct rb_root root = RB_ROOT;
++	struct list_head middle;
++
++	rdd->root = &root;
++	if (upperpath->dentry) {
++		rdd->dir = upperpath->dentry;
++		err = ovl_dir_read(upperpath, rdd, ovl_fill_upper);
++		if (err)
++			goto out;
++
++		err = ovl_dir_mark_whiteouts(rdd);
++		if (err)
++			goto out;
++	}
++	/*
++	 * Insert lowerpath entries before upperpath ones, this allows
++	 * offsets to be reasonably constant
++	 */
++	list_add(&middle, rdd->list);
++	rdd->middle = &middle;
++	err = ovl_dir_read(lowerpath, rdd, ovl_fill_lower);
++	list_del(&middle);
++out:
++	rdd->root = NULL;
++
++	return err;
++}
++
++static void ovl_seek_cursor(struct ovl_dir_file *od, loff_t pos)
++{
++	struct list_head *l;
++	loff_t off;
++
++	l = od->cache.next;
++	for (off = 0; off < pos; off++) {
++		if (l == &od->cache)
++			break;
++		l = l->next;
++	}
++	list_move_tail(&od->cursor, l);
++}
++
++static int ovl_readdir(struct file *file, void *buf, filldir_t filler)
++{
++	struct ovl_dir_file *od = file->private_data;
++	int res;
++
++	if (!file->f_pos)
++		ovl_dir_reset(file);
++
++	if (od->is_real) {
++		res = vfs_readdir(od->realfile, filler, buf);
++		file->f_pos = od->realfile->f_pos;
++
++		return res;
++	}
++
++	if (!od->is_cached) {
++		struct path lowerpath;
++		struct path upperpath;
++		struct ovl_readdir_data rdd = { .list = &od->cache };
++
++		ovl_path_lower(file->f_path.dentry, &lowerpath);
++		ovl_path_upper(file->f_path.dentry, &upperpath);
++
++		res = ovl_dir_read_merged(&upperpath, &lowerpath, &rdd);
++		if (res) {
++			ovl_cache_free(rdd.list);
++			return res;
++		}
++
++		od->cache_version = ovl_dentry_version_get(file->f_path.dentry);
++		od->is_cached = true;
++
++		ovl_seek_cursor(od, file->f_pos);
++	}
++
++	while (od->cursor.next != &od->cache) {
++		int over;
++		loff_t off;
++		struct ovl_cache_entry *p;
++
++		p = list_entry(od->cursor.next, struct ovl_cache_entry, l_node);
++		off = file->f_pos;
++		if (!p->is_whiteout) {
++			over = filler(buf, p->name, p->len, off, p->ino,
++				      p->type);
++			if (over)
++				break;
++		}
++		file->f_pos++;
++		list_move(&od->cursor, &p->l_node);
++	}
++
++	return 0;
++}
++
++static loff_t ovl_dir_llseek(struct file *file, loff_t offset, int origin)
++{
++	loff_t res;
++	struct ovl_dir_file *od = file->private_data;
++
++	mutex_lock(&file->f_dentry->d_inode->i_mutex);
++	if (!file->f_pos)
++		ovl_dir_reset(file);
++
++	if (od->is_real) {
++		res = vfs_llseek(od->realfile, offset, origin);
++		file->f_pos = od->realfile->f_pos;
++	} else {
++		res = -EINVAL;
++
++		switch (origin) {
++		case SEEK_CUR:
++			offset += file->f_pos;
++			break;
++		case SEEK_SET:
++			break;
++		default:
++			goto out_unlock;
++		}
++		if (offset < 0)
++			goto out_unlock;
++
++		if (offset != file->f_pos) {
++			file->f_pos = offset;
++			if (od->is_cached)
++				ovl_seek_cursor(od, offset);
++		}
++		res = offset;
++	}
++out_unlock:
++	mutex_unlock(&file->f_dentry->d_inode->i_mutex);
++
++	return res;
++}
++
++static int ovl_dir_fsync(struct file *file, loff_t start, loff_t end,
++			 int datasync)
++{
++	struct ovl_dir_file *od = file->private_data;
++
++	/* May need to reopen directory if it got copied up */
++	if (!od->realfile) {
++		struct path upperpath;
++
++		ovl_path_upper(file->f_path.dentry, &upperpath);
++		od->realfile = ovl_path_open(&upperpath, O_RDONLY);
++		if (IS_ERR(od->realfile))
++			return PTR_ERR(od->realfile);
++	}
++
++	return vfs_fsync_range(od->realfile, start, end, datasync);
++}
++
++static int ovl_dir_release(struct inode *inode, struct file *file)
++{
++	struct ovl_dir_file *od = file->private_data;
++
++	list_del(&od->cursor);
++	ovl_cache_free(&od->cache);
++	if (od->realfile)
++		fput(od->realfile);
++	kfree(od);
++
++	return 0;
++}
++
++static int ovl_dir_open(struct inode *inode, struct file *file)
++{
++	struct path realpath;
++	struct file *realfile;
++	struct ovl_dir_file *od;
++	enum ovl_path_type type;
++
++	od = kzalloc(sizeof(struct ovl_dir_file), GFP_KERNEL);
++	if (!od)
++		return -ENOMEM;
++
++	type = ovl_path_real(file->f_path.dentry, &realpath);
++	realfile = ovl_path_open(&realpath, file->f_flags);
++	if (IS_ERR(realfile)) {
++		kfree(od);
++		return PTR_ERR(realfile);
++	}
++	INIT_LIST_HEAD(&od->cache);
++	INIT_LIST_HEAD(&od->cursor);
++	od->is_cached = false;
++	od->realfile = realfile;
++	od->is_real = (type != OVL_PATH_MERGE);
++	file->private_data = od;
++
++	return 0;
++}
++
++const struct file_operations ovl_dir_operations = {
++	.read		= generic_read_dir,
++	.open		= ovl_dir_open,
++	.readdir	= ovl_readdir,
++	.llseek		= ovl_dir_llseek,
++	.fsync		= ovl_dir_fsync,
++	.release	= ovl_dir_release,
++};
++
++static int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list)
++{
++	int err;
++	struct path lowerpath;
++	struct path upperpath;
++	struct ovl_cache_entry *p;
++	struct ovl_readdir_data rdd = { .list = list };
++
++	ovl_path_upper(dentry, &upperpath);
++	ovl_path_lower(dentry, &lowerpath);
++
++	err = ovl_dir_read_merged(&upperpath, &lowerpath, &rdd);
++	if (err)
++		return err;
++
++	err = 0;
++
++	list_for_each_entry(p, list, l_node) {
++		if (p->is_whiteout)
++			continue;
++
++		if (p->name[0] == '.') {
++			if (p->len == 1)
++				continue;
++			if (p->len == 2 && p->name[1] == '.')
++				continue;
++		}
++		err = -ENOTEMPTY;
++		break;
++	}
++
++	return err;
++}
++
++static int ovl_remove_whiteouts(struct dentry *dir, struct list_head *list)
++{
++	struct path upperpath;
++	struct dentry *upperdir;
++	struct ovl_cache_entry *p;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++	int err;
++
++	ovl_path_upper(dir, &upperpath);
++	upperdir = upperpath.dentry;
++
++	override_cred = prepare_creds();
++	if (!override_cred)
++		return -ENOMEM;
++
++	/*
++	 * CAP_DAC_OVERRIDE for lookup and unlink
++	 * CAP_SYS_ADMIN for setxattr of "trusted" namespace
++	 * CAP_FOWNER for unlink in sticky directory
++	 */
++	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	cap_raise(override_cred->cap_effective, CAP_FOWNER);
++	old_cred = override_creds(override_cred);
++
++	err = vfs_setxattr(upperdir, ovl_opaque_xattr, "y", 1, 0);
++	if (err)
++		goto out_revert_creds;
++
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++	list_for_each_entry(p, list, l_node) {
++		struct dentry *dentry;
++		int ret;
++
++		if (!p->is_whiteout)
++			continue;
++
++		dentry = lookup_one_len(p->name, upperdir, p->len);
++		if (IS_ERR(dentry)) {
++			printk(KERN_WARNING
++			    "overlayfs: failed to lookup whiteout %.*s: %li\n",
++			    p->len, p->name, PTR_ERR(dentry));
++			continue;
++		}
++		ret = vfs_unlink(upperdir->d_inode, dentry);
++		dput(dentry);
++		if (ret)
++			printk(KERN_WARNING
++			    "overlayfs: failed to unlink whiteout %.*s: %i\n",
++			    p->len, p->name, ret);
++	}
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++
++out_revert_creds:
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++	return err;
++}
++
++int ovl_check_empty_and_clear(struct dentry *dentry, enum ovl_path_type type)
++{
++	int err;
++	LIST_HEAD(list);
++
++	err = ovl_check_empty_dir(dentry, &list);
++	if (!err && type == OVL_PATH_MERGE)
++		err = ovl_remove_whiteouts(dentry, &list);
++
++	ovl_cache_free(&list);
++
++	return err;
++}
+--- /dev/null
++++ b/fs/overlayfs/super.c
+@@ -0,0 +1,664 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/namei.h>
++#include <linux/xattr.h>
++#include <linux/security.h>
++#include <linux/mount.h>
++#include <linux/slab.h>
++#include <linux/parser.h>
++#include <linux/module.h>
++#include <linux/seq_file.h>
++#include "overlayfs.h"
++
++MODULE_AUTHOR("Miklos Szeredi <miklos@szeredi.hu>");
++MODULE_DESCRIPTION("Overlay filesystem");
++MODULE_LICENSE("GPL");
++
++struct ovl_config {
++	char *lowerdir;
++	char *upperdir;
++};
++
++/* private information held for overlayfs's superblock */
++struct ovl_fs {
++	struct vfsmount *upper_mnt;
++	struct vfsmount *lower_mnt;
++	/* pathnames of lower and upper dirs, for show_options */
++	struct ovl_config config;
++};
++
++/* private information held for every overlayfs dentry */
++struct ovl_entry {
++	/*
++	 * Keep "double reference" on upper dentries, so that
++	 * d_delete() doesn't think it's OK to reset d_inode to NULL.
++	 */
++	struct dentry *__upperdentry;
++	struct dentry *lowerdentry;
++	union {
++		struct {
++			u64 version;
++			bool opaque;
++		};
++		struct rcu_head rcu;
++	};
++};
++
++const char *ovl_whiteout_xattr = "trusted.overlay.whiteout";
++const char *ovl_opaque_xattr = "trusted.overlay.opaque";
++
++
++enum ovl_path_type ovl_path_type(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	if (oe->__upperdentry) {
++		if (oe->lowerdentry && S_ISDIR(dentry->d_inode->i_mode))
++			return OVL_PATH_MERGE;
++		else
++			return OVL_PATH_UPPER;
++	} else {
++		return OVL_PATH_LOWER;
++	}
++}
++
++static struct dentry *ovl_upperdentry_dereference(struct ovl_entry *oe)
++{
++	struct dentry *upperdentry = ACCESS_ONCE(oe->__upperdentry);
++	smp_read_barrier_depends();
++	return upperdentry;
++}
++
++void ovl_path_upper(struct dentry *dentry, struct path *path)
++{
++	struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	path->mnt = ofs->upper_mnt;
++	path->dentry = ovl_upperdentry_dereference(oe);
++}
++
++void ovl_path_lower(struct dentry *dentry, struct path *path)
++{
++	struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	path->mnt = ofs->lower_mnt;
++	path->dentry = oe->lowerdentry;
++}
++
++enum ovl_path_type ovl_path_real(struct dentry *dentry, struct path *path)
++{
++
++	enum ovl_path_type type = ovl_path_type(dentry);
++
++	if (type == OVL_PATH_LOWER)
++		ovl_path_lower(dentry, path);
++	else
++		ovl_path_upper(dentry, path);
++
++	return type;
++}
++
++struct dentry *ovl_dentry_upper(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	return ovl_upperdentry_dereference(oe);
++}
++
++struct dentry *ovl_dentry_lower(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	return oe->lowerdentry;
++}
++
++struct dentry *ovl_dentry_real(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++	struct dentry *realdentry;
++
++	realdentry = ovl_upperdentry_dereference(oe);
++	if (!realdentry)
++		realdentry = oe->lowerdentry;
++
++	return realdentry;
++}
++
++struct dentry *ovl_entry_real(struct ovl_entry *oe, bool *is_upper)
++{
++	struct dentry *realdentry;
++
++	realdentry = ovl_upperdentry_dereference(oe);
++	if (realdentry) {
++		*is_upper = true;
++	} else {
++		realdentry = oe->lowerdentry;
++		*is_upper = false;
++	}
++	return realdentry;
++}
++
++bool ovl_dentry_is_opaque(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++	return oe->opaque;
++}
++
++void ovl_dentry_set_opaque(struct dentry *dentry, bool opaque)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++	oe->opaque = opaque;
++}
++
++void ovl_dentry_update(struct dentry *dentry, struct dentry *upperdentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	WARN_ON(!mutex_is_locked(&upperdentry->d_parent->d_inode->i_mutex));
++	WARN_ON(oe->__upperdentry);
++	BUG_ON(!upperdentry->d_inode);
++	smp_wmb();
++	oe->__upperdentry = dget(upperdentry);
++}
++
++void ovl_dentry_version_inc(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	WARN_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
++	oe->version++;
++}
++
++u64 ovl_dentry_version_get(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	WARN_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
++	return oe->version;
++}
++
++bool ovl_is_whiteout(struct dentry *dentry)
++{
++	int res;
++	char val;
++
++	if (!dentry)
++		return false;
++	if (!dentry->d_inode)
++		return false;
++	if (!S_ISLNK(dentry->d_inode->i_mode))
++		return false;
++
++	res = vfs_getxattr(dentry, ovl_whiteout_xattr, &val, 1);
++	if (res == 1 && val == 'y')
++		return true;
++
++	return false;
++}
++
++static bool ovl_is_opaquedir(struct dentry *dentry)
++{
++	int res;
++	char val;
++
++	if (!S_ISDIR(dentry->d_inode->i_mode))
++		return false;
++
++	res = vfs_getxattr(dentry, ovl_opaque_xattr, &val, 1);
++	if (res == 1 && val == 'y')
++		return true;
++
++	return false;
++}
++
++static void ovl_entry_free(struct rcu_head *head)
++{
++	struct ovl_entry *oe = container_of(head, struct ovl_entry, rcu);
++	kfree(oe);
++}
++
++static void ovl_dentry_release(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	if (oe) {
++		dput(oe->__upperdentry);
++		dput(oe->__upperdentry);
++		dput(oe->lowerdentry);
++		call_rcu(&oe->rcu, ovl_entry_free);
++	}
++}
++
++const struct dentry_operations ovl_dentry_operations = {
++	.d_release = ovl_dentry_release,
++};
++
++static struct ovl_entry *ovl_alloc_entry(void)
++{
++	return kzalloc(sizeof(struct ovl_entry), GFP_KERNEL);
++}
++
++static inline struct dentry *ovl_lookup_real(struct dentry *dir,
++					     struct qstr *name)
++{
++	struct dentry *dentry;
++
++	mutex_lock(&dir->d_inode->i_mutex);
++	dentry = lookup_one_len(name->name, dir, name->len);
++	mutex_unlock(&dir->d_inode->i_mutex);
++
++	if (IS_ERR(dentry)) {
++		if (PTR_ERR(dentry) == -ENOENT)
++			dentry = NULL;
++	} else if (!dentry->d_inode) {
++		dput(dentry);
++		dentry = NULL;
++	}
++	return dentry;
++}
++
++static int ovl_do_lookup(struct dentry *dentry)
++{
++	struct ovl_entry *oe;
++	struct dentry *upperdir;
++	struct dentry *lowerdir;
++	struct dentry *upperdentry = NULL;
++	struct dentry *lowerdentry = NULL;
++	struct inode *inode = NULL;
++	int err;
++
++	err = -ENOMEM;
++	oe = ovl_alloc_entry();
++	if (!oe)
++		goto out;
++
++	upperdir = ovl_dentry_upper(dentry->d_parent);
++	lowerdir = ovl_dentry_lower(dentry->d_parent);
++
++	if (upperdir) {
++		upperdentry = ovl_lookup_real(upperdir, &dentry->d_name);
++		err = PTR_ERR(upperdentry);
++		if (IS_ERR(upperdentry))
++			goto out_put_dir;
++
++		if (lowerdir && upperdentry &&
++		    (S_ISLNK(upperdentry->d_inode->i_mode) ||
++		     S_ISDIR(upperdentry->d_inode->i_mode))) {
++			const struct cred *old_cred;
++			struct cred *override_cred;
++
++			err = -ENOMEM;
++			override_cred = prepare_creds();
++			if (!override_cred)
++				goto out_dput_upper;
++
++			/* CAP_SYS_ADMIN needed for getxattr */
++			cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++			old_cred = override_creds(override_cred);
++
++			if (ovl_is_opaquedir(upperdentry)) {
++				oe->opaque = true;
++			} else if (ovl_is_whiteout(upperdentry)) {
++				dput(upperdentry);
++				upperdentry = NULL;
++				oe->opaque = true;
++			}
++			revert_creds(old_cred);
++			put_cred(override_cred);
++		}
++	}
++	if (lowerdir && !oe->opaque) {
++		lowerdentry = ovl_lookup_real(lowerdir, &dentry->d_name);
++		err = PTR_ERR(lowerdentry);
++		if (IS_ERR(lowerdentry))
++			goto out_dput_upper;
++	}
++
++	if (lowerdentry && upperdentry &&
++	    (!S_ISDIR(upperdentry->d_inode->i_mode) ||
++	     !S_ISDIR(lowerdentry->d_inode->i_mode))) {
++		dput(lowerdentry);
++		lowerdentry = NULL;
++		oe->opaque = true;
++	}
++
++	if (lowerdentry || upperdentry) {
++		struct dentry *realdentry;
++
++		realdentry = upperdentry ? upperdentry : lowerdentry;
++		err = -ENOMEM;
++		inode = ovl_new_inode(dentry->d_sb, realdentry->d_inode->i_mode,
++				      oe);
++		if (!inode)
++			goto out_dput;
++	}
++
++	if (upperdentry)
++		oe->__upperdentry = dget(upperdentry);
++
++	if (lowerdentry)
++		oe->lowerdentry = lowerdentry;
++
++	dentry->d_fsdata = oe;
++	dentry->d_op = &ovl_dentry_operations;
++	d_add(dentry, inode);
++
++	return 0;
++
++out_dput:
++	dput(lowerdentry);
++out_dput_upper:
++	dput(upperdentry);
++out_put_dir:
++	kfree(oe);
++out:
++	return err;
++}
++
++struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
++			  struct nameidata *nd)
++{
++	int err = ovl_do_lookup(dentry);
++
++	if (err)
++		return ERR_PTR(err);
++
++	return NULL;
++}
++
++struct file *ovl_path_open(struct path *path, int flags)
++{
++	path_get(path);
++	return dentry_open(path->dentry, path->mnt, flags, current_cred());
++}
++
++static void ovl_put_super(struct super_block *sb)
++{
++	struct ovl_fs *ufs = sb->s_fs_info;
++
++	if (!(sb->s_flags & MS_RDONLY))
++		mnt_drop_write(ufs->upper_mnt);
++
++	mntput(ufs->upper_mnt);
++	mntput(ufs->lower_mnt);
++
++	kfree(ufs->config.lowerdir);
++	kfree(ufs->config.upperdir);
++	kfree(ufs);
++}
++
++static int ovl_remount_fs(struct super_block *sb, int *flagsp, char *data)
++{
++	int flags = *flagsp;
++	struct ovl_fs *ufs = sb->s_fs_info;
++
++	/* When remounting rw or ro, we need to adjust the write access to the
++	 * upper fs.
++	 */
++	if (((flags ^ sb->s_flags) & MS_RDONLY) == 0)
++		/* No change to readonly status */
++		return 0;
++
++	if (flags & MS_RDONLY) {
++		mnt_drop_write(ufs->upper_mnt);
++		return 0;
++	} else
++		return mnt_want_write(ufs->upper_mnt);
++}
++
++/**
++ * ovl_statfs
++ * @sb: The overlayfs super block
++ * @buf: The struct kstatfs to fill in with stats
++ *
++ * Get the filesystem statistics.  As writes always target the upper layer
++ * filesystem pass the statfs to the same filesystem.
++ */
++static int ovl_statfs(struct dentry *dentry, struct kstatfs *buf)
++{
++	struct dentry *root_dentry = dentry->d_sb->s_root;
++	struct path path;
++	ovl_path_upper(root_dentry, &path);
++
++	if (!path.dentry->d_sb->s_op->statfs)
++		return -ENOSYS;
++	return path.dentry->d_sb->s_op->statfs(path.dentry, buf);
++}
++
++/**
++ * ovl_show_options
++ *
++ * Prints the mount options for a given superblock.
++ * Returns zero; does not fail.
++ */
++static int ovl_show_options(struct seq_file *m, struct dentry *dentry)
++{
++	struct super_block *sb = dentry->d_sb;
++	struct ovl_fs *ufs = sb->s_fs_info;
++
++	seq_printf(m, ",lowerdir=%s", ufs->config.lowerdir);
++	seq_printf(m, ",upperdir=%s", ufs->config.upperdir);
++	return 0;
++}
++
++static const struct super_operations ovl_super_operations = {
++	.put_super	= ovl_put_super,
++	.remount_fs	= ovl_remount_fs,
++	.statfs		= ovl_statfs,
++	.show_options	= ovl_show_options,
++};
++
++enum {
++	Opt_lowerdir,
++	Opt_upperdir,
++	Opt_err,
++};
++
++static const match_table_t ovl_tokens = {
++	{Opt_lowerdir,			"lowerdir=%s"},
++	{Opt_upperdir,			"upperdir=%s"},
++	{Opt_err,			NULL}
++};
++
++static int ovl_parse_opt(char *opt, struct ovl_config *config)
++{
++	char *p;
++
++	config->upperdir = NULL;
++	config->lowerdir = NULL;
++
++	while ((p = strsep(&opt, ",")) != NULL) {
++		int token;
++		substring_t args[MAX_OPT_ARGS];
++
++		if (!*p)
++			continue;
++
++		token = match_token(p, ovl_tokens, args);
++		switch (token) {
++		case Opt_upperdir:
++			kfree(config->upperdir);
++			config->upperdir = match_strdup(&args[0]);
++			if (!config->upperdir)
++				return -ENOMEM;
++			break;
++
++		case Opt_lowerdir:
++			kfree(config->lowerdir);
++			config->lowerdir = match_strdup(&args[0]);
++			if (!config->lowerdir)
++				return -ENOMEM;
++			break;
++
++		default:
++			return -EINVAL;
++		}
++	}
++	return 0;
++}
++
++static int ovl_fill_super(struct super_block *sb, void *data, int silent)
++{
++	struct path lowerpath;
++	struct path upperpath;
++	struct inode *root_inode;
++	struct dentry *root_dentry;
++	struct ovl_entry *oe;
++	struct ovl_fs *ufs;
++	int err;
++
++	err = -ENOMEM;
++	ufs = kmalloc(sizeof(struct ovl_fs), GFP_KERNEL);
++	if (!ufs)
++		goto out;
++
++	err = ovl_parse_opt((char *) data, &ufs->config);
++	if (err)
++		goto out_free_ufs;
++
++	err = -EINVAL;
++	if (!ufs->config.upperdir || !ufs->config.lowerdir) {
++		printk(KERN_ERR "overlayfs: missing upperdir or lowerdir\n");
++		goto out_free_config;
++	}
++
++	oe = ovl_alloc_entry();
++	if (oe == NULL)
++		goto out_free_config;
++
++	root_inode = ovl_new_inode(sb, S_IFDIR, oe);
++	if (!root_inode)
++		goto out_free_oe;
++
++	err = kern_path(ufs->config.upperdir, LOOKUP_FOLLOW, &upperpath);
++	if (err)
++		goto out_put_root;
++
++	err = kern_path(ufs->config.lowerdir, LOOKUP_FOLLOW, &lowerpath);
++	if (err)
++		goto out_put_upperpath;
++
++	err = -ENOTDIR;
++	if (!S_ISDIR(upperpath.dentry->d_inode->i_mode) ||
++	    !S_ISDIR(lowerpath.dentry->d_inode->i_mode))
++		goto out_put_lowerpath;
++
++	sb->s_stack_depth = max(upperpath.mnt->mnt_sb->s_stack_depth,
++				lowerpath.mnt->mnt_sb->s_stack_depth) + 1;
++
++	err = -EINVAL;
++	if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
++		printk(KERN_ERR "overlayfs: maximum fs stacking depth exceeded\n");
++		goto out_put_lowerpath;
++	}
++
++
++	ufs->upper_mnt = clone_private_mount(&upperpath);
++	err = PTR_ERR(ufs->upper_mnt);
++	if (IS_ERR(ufs->upper_mnt)) {
++		printk(KERN_ERR "overlayfs: failed to clone upperpath\n");
++		goto out_put_lowerpath;
++	}
++
++	ufs->lower_mnt = clone_private_mount(&lowerpath);
++	err = PTR_ERR(ufs->lower_mnt);
++	if (IS_ERR(ufs->lower_mnt)) {
++		printk(KERN_ERR "overlayfs: failed to clone lowerpath\n");
++		goto out_put_upper_mnt;
++	}
++
++	/*
++	 * Make lower_mnt R/O.  That way fchmod/fchown on lower file
++	 * will fail instead of modifying lower fs.
++	 */
++	ufs->lower_mnt->mnt_flags |= MNT_READONLY;
++
++	/* If the upper fs is r/o, we mark overlayfs r/o too */
++	if (ufs->upper_mnt->mnt_sb->s_flags & MS_RDONLY)
++		sb->s_flags |= MS_RDONLY;
++
++	if (!(sb->s_flags & MS_RDONLY)) {
++		err = mnt_want_write(ufs->upper_mnt);
++		if (err)
++			goto out_put_lower_mnt;
++	}
++
++	err = -ENOMEM;
++	root_dentry = d_alloc_root(root_inode);
++	if (!root_dentry)
++		goto out_drop_write;
++
++	mntput(upperpath.mnt);
++	mntput(lowerpath.mnt);
++
++	oe->__upperdentry = dget(upperpath.dentry);
++	oe->lowerdentry = lowerpath.dentry;
++
++	root_dentry->d_fsdata = oe;
++	root_dentry->d_op = &ovl_dentry_operations;
++
++	sb->s_op = &ovl_super_operations;
++	sb->s_root = root_dentry;
++	sb->s_fs_info = ufs;
++
++	return 0;
++
++out_drop_write:
++	if (!(sb->s_flags & MS_RDONLY))
++		mnt_drop_write(ufs->upper_mnt);
++out_put_lower_mnt:
++	mntput(ufs->lower_mnt);
++out_put_upper_mnt:
++	mntput(ufs->upper_mnt);
++out_put_lowerpath:
++	path_put(&lowerpath);
++out_put_upperpath:
++	path_put(&upperpath);
++out_put_root:
++	iput(root_inode);
++out_free_oe:
++	kfree(oe);
++out_free_config:
++	kfree(ufs->config.lowerdir);
++	kfree(ufs->config.upperdir);
++out_free_ufs:
++	kfree(ufs);
++out:
++	return err;
++}
++
++static struct dentry *ovl_mount(struct file_system_type *fs_type, int flags,
++				const char *dev_name, void *raw_data)
++{
++	return mount_nodev(fs_type, flags, raw_data, ovl_fill_super);
++}
++
++static struct file_system_type ovl_fs_type = {
++	.owner		= THIS_MODULE,
++	.name		= "overlayfs",
++	.mount		= ovl_mount,
++	.kill_sb	= kill_anon_super,
++};
++
++static int __init ovl_init(void)
++{
++	return register_filesystem(&ovl_fs_type);
++}
++
++static void __exit ovl_exit(void)
++{
++	unregister_filesystem(&ovl_fs_type);
++}
++
++module_init(ovl_init);
++module_exit(ovl_exit);
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1302,6 +1302,7 @@ long do_splice_direct(struct file *in, l
+ 
+ 	return ret;
+ }
++EXPORT_SYMBOL(do_splice_direct);
+ 
+ static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
+ 			       struct pipe_inode_info *opipe,
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -484,6 +484,12 @@ struct iattr {
+  */
+ #include <linux/quota.h>
+ 
++/*
++ * Maximum number of layers of fs stack.  Needs to be limited to
++ * prevent kernel stack overflow
++ */
++#define FILESYSTEM_MAX_STACK_DEPTH 2
++
+ /** 
+  * enum positive_aop_returns - aop return codes with specific semantics
+  *
+@@ -1501,6 +1507,11 @@ struct super_block {
+ 
+ 	/* Being remounted read-only */
+ 	int s_readonly_remount;
++
++	/*
++	 * Indicates how deep in a filesystem stack this SB is
++	 */
++	int s_stack_depth;
+ };
+ 
+ /* superblock cache pruning functions */
+@@ -1658,6 +1669,8 @@ struct inode_operations {
+ 	void (*truncate_range)(struct inode *, loff_t, loff_t);
+ 	int (*fiemap)(struct inode *, struct fiemap_extent_info *, u64 start,
+ 		      u64 len);
++	struct file *(*open) (struct dentry *, struct file *,
++			      const struct cred *);
+ } ____cacheline_aligned;
+ 
+ struct seq_file;
+@@ -2028,6 +2041,7 @@ extern long do_sys_open(int dfd, const c
+ extern struct file *filp_open(const char *, int, umode_t);
+ extern struct file *file_open_root(struct dentry *, struct vfsmount *,
+ 				   const char *, int);
++extern struct file *vfs_open(struct path *, struct file *, const struct cred *);
+ extern struct file * dentry_open(struct dentry *, struct vfsmount *, int,
+ 				 const struct cred *);
+ extern int filp_close(struct file *, fl_owner_t id);
+--- a/include/linux/mount.h
++++ b/include/linux/mount.h
+@@ -66,6 +66,9 @@ extern void mnt_pin(struct vfsmount *mnt
+ extern void mnt_unpin(struct vfsmount *mnt);
+ extern int __mnt_is_readonly(struct vfsmount *mnt);
+ 
++struct path;
++extern struct vfsmount *clone_private_mount(struct path *path);
++
+ struct file_system_type;
+ extern struct vfsmount *vfs_kern_mount(struct file_system_type *type,
+ 				      int flags, const char *name,
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/102-ehci_hcd_ignore_oc.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/102-ehci_hcd_ignore_oc.patch.svn-base
new file mode 100644
index 0000000..400d2ed
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/102-ehci_hcd_ignore_oc.patch.svn-base
@@ -0,0 +1,41 @@
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -795,7 +795,7 @@ static int ehci_run (struct usb_hcd *hcd
+ 		"USB %x.%x started, EHCI %x.%02x%s\n",
+ 		((ehci->sbrn & 0xf0)>>4), (ehci->sbrn & 0x0f),
+ 		temp >> 8, temp & 0xff,
+-		ignore_oc ? ", overcurrent ignored" : "");
++		(ignore_oc || ehci->ignore_oc) ? ", overcurrent ignored" : "");
+ 
+ 	ehci_writel(ehci, INTR_MASK,
+ 		    &ehci->regs->intr_enable); /* Turn On Interrupts */
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -578,7 +578,7 @@ ehci_hub_status_data (struct usb_hcd *hc
+ 	 * always set, seem to clear PORT_OCC and PORT_CSC when writing to
+ 	 * PORT_POWER; that's surprising, but maybe within-spec.
+ 	 */
+-	if (!ignore_oc)
++	if (!ignore_oc && !ehci->ignore_oc)
+ 		mask = PORT_CSC | PORT_PEC | PORT_OCC;
+ 	else
+ 		mask = PORT_CSC | PORT_PEC;
+@@ -803,7 +803,7 @@ static int ehci_hub_control (
+ 		if (temp & PORT_PEC)
+ 			status |= USB_PORT_STAT_C_ENABLE << 16;
+ 
+-		if ((temp & PORT_OCC) && !ignore_oc){
++		if ((temp & PORT_OCC) && (!ignore_oc && !ehci->ignore_oc)){
+ 			status |= USB_PORT_STAT_C_OVERCURRENT << 16;
+ 
+ 			/*
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -147,6 +147,7 @@ struct ehci_hcd {			/* one per controlle
+ 	unsigned		use_dummy_qh:1;	/* AMD Frame List table quirk*/
+ 	unsigned		has_synopsys_hc_bug:1; /* Synopsys HC */
+ 	unsigned		frame_index_bug:1; /* MosChip (AKA NetMos) */
++	unsigned		ignore_oc:1;
+ 
+ 	/* required for usb32 quirk */
+ 	#define OHCI_CTRL_HCFS          (3 << 6)
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/110-fix_mtd_include.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/110-fix_mtd_include.patch.svn-base
new file mode 100644
index 0000000..c63dbc0
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/110-fix_mtd_include.patch.svn-base
@@ -0,0 +1,10 @@
+--- a/include/linux/mtd/physmap.h
++++ b/include/linux/mtd/physmap.h
+@@ -17,6 +17,7 @@
+ 
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/platform_device.h>
+ 
+ struct map_info;
+ struct platform_device;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/130-pppoatm-queue-depth.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/130-pppoatm-queue-depth.patch.svn-base
new file mode 100644
index 0000000..247a312
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/130-pppoatm-queue-depth.patch.svn-base
@@ -0,0 +1,188 @@
+From 9d02daf754238adac48fa075ee79e7edd3d79ed3 Mon Sep 17 00:00:00 2001
+From: David Woodhouse <dwmw2@infradead.org>
+Date: Sun, 8 Apr 2012 09:55:43 +0000
+Subject: [PATCH] pppoatm: Fix excessive queue bloat
+
+We discovered that PPPoATM has an excessively deep transmit queue. A
+queue the size of the default socket send buffer (wmem_default) is
+maintained between the PPP generic core and the ATM device.
+
+Fix it to queue a maximum of *two* packets. The one the ATM device is
+currently working on, and one more for the ATM driver to process
+immediately in its TX done interrupt handler. The PPP core is designed
+to feed packets to the channel with minimal latency, so that really
+ought to be enough to keep the ATM device busy.
+
+While we're at it, fix the fact that we were triggering the wakeup
+tasklet on *every* pppoatm_pop() call. The comment saying "this is
+inefficient, but doing it right is too hard" turns out to be overly
+pessimistic... I think :)
+
+On machines like the Traverse Geos, with a slow Geode CPU and two
+high-speed ADSL2+ interfaces, there were reports of extremely high CPU
+usage which could partly be attributed to the extra wakeups.
+
+(The wakeup handling could actually be made a whole lot easier if we
+ stop checking sk->sk_sndbuf altogether. Given that we now only queue
+ *two* packets ever, one wonders what the point is. As it is, you could
+ already deadlock the thing by setting the sk_sndbuf to a value lower
+ than the MTU of the device, and it'd just block for ever.)
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/atm/pppoatm.c |   95 +++++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 files changed, 85 insertions(+), 10 deletions(-)
+
+--- a/net/atm/pppoatm.c
++++ b/net/atm/pppoatm.c
+@@ -62,12 +62,25 @@ struct pppoatm_vcc {
+ 	void (*old_pop)(struct atm_vcc *, struct sk_buff *);
+ 					/* keep old push/pop for detaching */
+ 	enum pppoatm_encaps encaps;
++	atomic_t inflight;
++	unsigned long blocked;
+ 	int flags;			/* SC_COMP_PROT - compress protocol */
+ 	struct ppp_channel chan;	/* interface to generic ppp layer */
+ 	struct tasklet_struct wakeup_tasklet;
+ };
+ 
+ /*
++ * We want to allow two packets in the queue. The one that's currently in
++ * flight, and *one* queued up ready for the ATM device to send immediately
++ * from its TX done IRQ. We want to be able to use atomic_inc_not_zero(), so
++ * inflight == -2 represents an empty queue, -1 one packet, and zero means
++ * there are two packets in the queue.
++ */
++#define NONE_INFLIGHT -2
++
++#define BLOCKED 0
++
++/*
+  * Header used for LLC Encapsulated PPP (4 bytes) followed by the LCP protocol
+  * ID (0xC021) used in autodetection
+  */
+@@ -102,16 +115,30 @@ static void pppoatm_wakeup_sender(unsign
+ static void pppoatm_pop(struct atm_vcc *atmvcc, struct sk_buff *skb)
+ {
+ 	struct pppoatm_vcc *pvcc = atmvcc_to_pvcc(atmvcc);
++
+ 	pvcc->old_pop(atmvcc, skb);
++	atomic_dec(&pvcc->inflight);
++
+ 	/*
+-	 * We don't really always want to do this since it's
+-	 * really inefficient - it would be much better if we could
+-	 * test if we had actually throttled the generic layer.
+-	 * Unfortunately then there would be a nasty SMP race where
+-	 * we could clear that flag just as we refuse another packet.
+-	 * For now we do the safe thing.
++	 * We always used to run the wakeup tasklet unconditionally here, for
++	 * fear of race conditions where we clear the BLOCKED flag just as we
++	 * refuse another packet in pppoatm_send(). This was quite inefficient.
++	 *
++	 * In fact it's OK. The PPP core will only ever call pppoatm_send()
++	 * while holding the channel->downl lock. And ppp_output_wakeup() as
++	 * called by the tasklet will *also* grab that lock. So even if another
++	 * CPU is in pppoatm_send() right now, the tasklet isn't going to race
++	 * with it. The wakeup *will* happen after the other CPU is safely out
++	 * of pppoatm_send() again.
++	 *
++	 * So if the CPU in pppoatm_send() has already set the BLOCKED bit and
++	 * it about to return, that's fine. We trigger a wakeup which will
++	 * happen later. And if the CPU in pppoatm_send() *hasn't* set the
++	 * BLOCKED bit yet, that's fine too because of the double check in
++	 * pppoatm_may_send() which is commented there.
+ 	 */
+-	tasklet_schedule(&pvcc->wakeup_tasklet);
++	if (test_and_clear_bit(BLOCKED, &pvcc->blocked))
++		tasklet_schedule(&pvcc->wakeup_tasklet);
+ }
+ 
+ /*
+@@ -184,6 +211,51 @@ error:
+ 	ppp_input_error(&pvcc->chan, 0);
+ }
+ 
++static inline int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
++{
++	/*
++	 * It's not clear that we need to bother with using atm_may_send()
++	 * to check we don't exceed sk->sk_sndbuf. If userspace sets a
++	 * value of sk_sndbuf which is lower than the MTU, we're going to
++	 * block for ever. But the code always did that before we introduced
++	 * the packet count limit, so...
++	 */
++	if (atm_may_send(pvcc->atmvcc, size) &&
++	    atomic_inc_not_zero_hint(&pvcc->inflight, NONE_INFLIGHT))
++		return 1;
++
++	/*
++	 * We use test_and_set_bit() rather than set_bit() here because
++	 * we need to ensure there's a memory barrier after it. The bit
++	 * *must* be set before we do the atomic_inc() on pvcc->inflight.
++	 * There's no smp_mb__after_set_bit(), so it's this or abuse
++	 * smp_mb__after_clear_bit().
++	 */
++	test_and_set_bit(BLOCKED, &pvcc->blocked);
++
++	/*
++	 * We may have raced with pppoatm_pop(). If it ran for the
++	 * last packet in the queue, *just* before we set the BLOCKED
++	 * bit, then it might never run again and the channel could
++	 * remain permanently blocked. Cope with that race by checking
++	 * *again*. If it did run in that window, we'll have space on
++	 * the queue now and can return success. It's harmless to leave
++	 * the BLOCKED flag set, since it's only used as a trigger to
++	 * run the wakeup tasklet. Another wakeup will never hurt.
++	 * If pppoatm_pop() is running but hasn't got as far as making
++	 * space on the queue yet, then it hasn't checked the BLOCKED
++	 * flag yet either, so we're safe in that case too. It'll issue
++	 * an "immediate" wakeup... where "immediate" actually involves
++	 * taking the PPP channel's ->downl lock, which is held by the
++	 * code path that calls pppoatm_send(), and is thus going to
++	 * wait for us to finish.
++	 */
++	if (atm_may_send(pvcc->atmvcc, size) &&
++	    atomic_inc_not_zero(&pvcc->inflight))
++		return 1;
++
++	return 0;
++}
+ /*
+  * Called by the ppp_generic.c to send a packet - returns true if packet
+  * was accepted.  If we return false, then it's our job to call
+@@ -207,7 +279,7 @@ static int pppoatm_send(struct ppp_chann
+ 			struct sk_buff *n;
+ 			n = skb_realloc_headroom(skb, LLC_LEN);
+ 			if (n != NULL &&
+-			    !atm_may_send(pvcc->atmvcc, n->truesize)) {
++			    !pppoatm_may_send(pvcc, n->truesize)) {
+ 				kfree_skb(n);
+ 				goto nospace;
+ 			}
+@@ -215,12 +287,12 @@ static int pppoatm_send(struct ppp_chann
+ 			skb = n;
+ 			if (skb == NULL)
+ 				return DROP_PACKET;
+-		} else if (!atm_may_send(pvcc->atmvcc, skb->truesize))
++		} else if (!pppoatm_may_send(pvcc, skb->truesize))
+ 			goto nospace;
+ 		memcpy(skb_push(skb, LLC_LEN), pppllc, LLC_LEN);
+ 		break;
+ 	case e_vc:
+-		if (!atm_may_send(pvcc->atmvcc, skb->truesize))
++		if (!pppoatm_may_send(pvcc, skb->truesize))
+ 			goto nospace;
+ 		break;
+ 	case e_autodetect:
+@@ -285,6 +357,9 @@ static int pppoatm_assign_vcc(struct atm
+ 	if (pvcc == NULL)
+ 		return -ENOMEM;
+ 	pvcc->atmvcc = atmvcc;
++
++	/* Maximum is zero, so that we can use atomic_inc_not_zero() */
++	atomic_set(&pvcc->inflight, NONE_INFLIGHT);
+ 	pvcc->old_push = atmvcc->push;
+ 	pvcc->old_pop = atmvcc->pop;
+ 	pvcc->encaps = (enum pppoatm_encaps) be.encaps;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/131-atm-fixes.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/131-atm-fixes.patch.svn-base
new file mode 100644
index 0000000..4d3bd4f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/131-atm-fixes.patch.svn-base
@@ -0,0 +1,900 @@
+commit d7d3d8f1ee4435e32bc6c93187798b7e2e3170a9
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Thu Nov 29 23:28:30 2012 +0000
+
+    solos-pci: remove list_vccs() debugging function
+    
+    No idea why we've gone so long dumping a list of VCCs with vci==0 on
+    every ->open() call...
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit c93967bfd3a3dffa759a3f28370167bf3cdbc3d0
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Thu Nov 29 23:27:20 2012 +0000
+
+    solos-pci: use GFP_KERNEL where possible, not GFP_ATOMIC
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit ad6999e17ae4f7b99f6d28f425ae970acb115347
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Thu Nov 29 23:15:30 2012 +0000
+
+    solos-pci: clean up pclose() function
+    
+     - Flush pending TX skbs from the queue rather than waiting for them all to
+       complete (suggested by Krzysztof Mazur <krzysiek@podlesie.net>).
+     - Clear ATM_VF_ADDR only when the PKT_PCLOSE packet has been submitted.
+     - Don't clear ATM_VF_READY at all — vcc_destroy_socket() does that for us.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 2547e97f29d6d69d567947d5ef90b6b4fbcaf565
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Nov 28 10:15:05 2012 +0000
+
+    pppoatm: optimise PPP channel wakeups after sock_owned_by_user()
+    
+    We don't need to schedule the wakeup tasklet on *every* unlock; only if we
+    actually blocked the channel in the first place.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit 990b0884a2e9668c08e9daa4d70a54d65329cb6f
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Wed Nov 28 09:08:04 2012 +0100
+
+    br2684: allow assign only on a connected socket
+    
+    The br2684 does not check if used vcc is in connected state,
+    causing potential Oops in pppoatm_send() when vcc->send() is called
+    on not fully connected socket.
+    
+    Now br2684 can be assigned only on connected sockets; otherwise
+    -EINVAL error is returned.
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit f49b6da01f0abebb17f6241473d53018d923f6b0
+Author: Nathan Williams <nathan@traverse.com.au>
+Date:   Tue Nov 27 17:34:09 2012 +1100
+
+    solos-pci: Fix leak of skb received for unknown vcc
+    
+    ... and ensure that the next skb is set up for RX in the DMA case.
+    
+    Signed-off-by: Nathan Williams <nathan@traverse.com.au>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit a61d37ff4a555886c4ebe31d2c6d893afb6f4d3c
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Nov 28 00:46:45 2012 +0000
+
+    br2684: fix module_put() race
+    
+    The br2684 code used module_put() during unassignment from vcc with
+    hope that we have BKL. This assumption is no longer true.
+    
+    Now owner field in atmvcc is used to move this module_put()
+    to vcc_destroy_socket().
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit c52f40629884ddc62c7af445fd5d620fdb466fb2
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Nov 28 00:05:52 2012 +0000
+
+    pppoatm: fix missing wakeup in pppoatm_send()
+    
+    Now that we can return zero from pppoatm_send() for reasons *other* than
+    the queue being full, that means we can't depend on a subsequent call to
+    pppoatm_pop() waking the queue, and we might leave it stalled
+    indefinitely.
+    
+    Use the ->release_cb() callback to wake the queue after the sock is
+    unlocked.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit 35826e7372fe39b7db7930eda0267c82d68d1a4c
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Tue Nov 27 23:28:36 2012 +0000
+
+    br2684: don't send frames on not-ready vcc
+    
+    Avoid submitting packets to a vcc which is being closed. Things go badly
+    wrong when the ->pop method gets later called after everything's been
+    torn down.
+    
+    Use the ATM socket lock for synchronisation with vcc_destroy_socket(),
+    which clears the ATM_VF_READY bit under the same lock. Otherwise, we
+    could end up submitting a packet to the device driver even after its
+    ->ops->close method has been called. And it could call the vcc's ->pop
+    method after the protocol has been shut down. Which leads to a panic.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit 7f940dde65de4a707f3dd723bb6ce9de90ca1eab
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Nov 28 00:03:11 2012 +0000
+
+    atm: add release_cb() callback to vcc
+    
+    The immediate use case for this is that it will allow us to ensure that a
+    pppoatm queue is woken after it has to drop a packet due to the sock being
+    locked.
+    
+    Note that 'release_cb' is called when the socket is *unlocked*. This is
+    not to be confused with vcc_release() — which probably ought to be called
+    vcc_close().
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit def1b2f9083f84d0a77730e537c76429914d17c1
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Tue Nov 27 23:49:24 2012 +0000
+
+    solos-pci: wait for pending TX to complete when releasing vcc
+    
+    We should no longer be calling the old pop routine for the vcc, after
+    vcc_release() has completed. Make sure we wait for any pending TX skbs
+    to complete, by waiting for our own PKT_PCLOSE control skb to be sent.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 397ff16dce53888ec693b3718640be2560204751
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:17:02 2012 +0100
+
+    pppoatm: do not inline pppoatm_may_send()
+    
+    The pppoatm_may_send() is quite heavy and it's called three times
+    in pppoatm_send() and inlining costs more than 200 bytes of code
+    (more than 10% of total pppoatm driver code size).
+    
+    add/remove: 1/0 grow/shrink: 0/1 up/down: 132/-367 (-235)
+    function                                     old     new   delta
+    pppoatm_may_send                               -     132    +132
+    pppoatm_send                                 900     533    -367
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 071d93931a75dc1f82f0baa9959613af81c5a032
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Sat Nov 10 23:33:19 2012 +0100
+
+    pppoatm: drop frames to not-ready vcc
+    
+    The vcc_destroy_socket() closes vcc before the protocol is detached
+    from vcc by calling vcc->push() with NULL skb. This leaves some time
+    window, where the protocol may call vcc->send() on closed vcc
+    and crash.
+    
+    Now pppoatm_send(), like vcc_sendmsg(), checks for vcc flags that
+    indicate that vcc is not ready. If the vcc is not ready we just
+    drop frame. Queueing frames is much more complicated because we
+    don't have callbacks that inform us about vcc flags changes.
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 3ac108006fd7f20cb8fc8ea2287f1497bcda00a1
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:17:00 2012 +0100
+
+    pppoatm: take ATM socket lock in pppoatm_send()
+    
+    The pppoatm_send() does not take any lock that will prevent concurrent
+    vcc_sendmsg(). This causes two problems:
+    
+    	- there is no locking between checking the send queue size
+    	  with atm_may_send() and incrementing sk_wmem_alloc,
+    	  and the real queue size can be a little higher than sk_sndbuf
+    
+    	- the vcc->sendmsg() can be called concurrently. I'm not sure
+    	  if it's allowed. Some drivers (eni, nicstar, ...) seem
+    	  to assume it will never happen.
+    
+    Now pppoatm_send() takes ATM socket lock, the same that is used
+    in vcc_sendmsg() and other ATM socket functions. The pppoatm_send()
+    is called with BH disabled, so bh_lock_sock() is used instead
+    of lock_sock().
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Cc: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit e41faed9cde1acce657f75a0b19a1787e9850d3f
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:16:59 2012 +0100
+
+    pppoatm: fix module_put() race
+    
+    The pppoatm used module_put() during unassignment from vcc with
+    hope that we have BKL. This assumption is no longer true.
+    
+    Now owner field in atmvcc is used to move this module_put()
+    to vcc_destroy_socket().
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 3b1a914595f3f9beb9e38ff3ddc7bdafa092ba22
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:16:58 2012 +0100
+
+    pppoatm: allow assign only on a connected socket
+    
+    The pppoatm does not check if used vcc is in connected state,
+    causing an Oops in pppoatm_send() when vcc->send() is called
+    on not fully connected socket.
+    
+    Now pppoatm can be assigned only on connected sockets; otherwise
+    -EINVAL error is returned.
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Cc: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit ec809bd817dfa1905283468e4c813684ed4efe78
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:16:57 2012 +0100
+
+    atm: add owner of push() callback to atmvcc
+    
+    The atm is using atmvcc->push(vcc, NULL) callback to notify protocol
+    that vcc will be closed and protocol must detach from it. This callback
+    is usually used by protocol to decrement module usage count by module_put(),
+    but it leaves small window then module is still used after module_put().
+    
+    Now the owner of push() callback is kept in atmvcc and
+    module_put(atmvcc->owner) is called after the protocol is detached from vcc.
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Chas Williams <chas@cmf.nrl.navy.mil>
+
+commit ae088d663beebb3cad0e7abaac67ee61a7c578d5
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Sun Nov 25 12:06:52 2012 +0000
+
+    atm: br2684: Fix excessive queue bloat
+    
+    There's really no excuse for an additional wmem_default of buffering
+    between the netdev queue and the ATM device. Two packets (one in-flight,
+    and one ready to send) ought to be fine. It's not as if it should take
+    long to get another from the netdev queue when we need it.
+    
+    If necessary we can make the queue space configurable later, but I don't
+    think it's likely to be necessary.
+    
+    cf. commit 9d02daf754238adac48fa075ee79e7edd3d79ed3 (pppoatm: Fix
+    excessive queue bloat) which did something very similar for PPPoATM.
+    
+    Note that there is a tremendously unlikely race condition which may
+    result in qspace temporarily going negative. If a CPU running the
+    br2684_pop() function goes off into the weeds for a long period of time
+    after incrementing qspace to 1, but before calling netdev_wake_queue()...
+    and another CPU ends up calling br2684_start_xmit() and *stopping* the
+    queue again before the first CPU comes back, the netdev queue could
+    end up being woken when qspace has already reached zero.
+    
+    An alternative approach to coping with this race would be to check in
+    br2684_start_xmit() for qspace==0 and return NETDEV_TX_BUSY, but just
+    using '> 0' and '< 1' for comparison instead of '== 0' and '!= 0' is
+    simpler. It just warranted a mention of *why* we do it that way...
+    
+    Move the call to atmvcc->send() to happen *after* the accounting and
+    potentially stopping the netdev queue, in br2684_xmit_vcc(). This matters
+    if the ->send() call suffers an immediate failure, because it'll call
+    br2684_pop() with the offending skb before returning. We want that to
+    happen *after* we've done the initial accounting for the packet in
+    question. Also make it return an appropriate success/failure indication
+    while we're at it.
+    
+    Tested by running 'ping -l 1000 bottomless.aaisp.net.uk' from within my
+    network, with only a single PPPoE-over-BR2684 link running. And after
+    setting txqueuelen on the nas0 interface to something low (5, in fact).
+    Before the patch, we'd see about 15 packets being queued and a resulting
+    latency of ~56ms being reached. After the patch, we see only about 8,
+    which is fairly much what we expect. And a max latency of ~36ms. On this
+    OpenWRT box, wmem_default is 163840.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Reviewed-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+--- a/drivers/atm/solos-pci.c
++++ b/drivers/atm/solos-pci.c
+@@ -92,6 +92,7 @@ struct pkt_hdr {
+ };
+ 
+ struct solos_skb_cb {
++	struct completion c;
+ 	struct atm_vcc *vcc;
+ 	uint32_t dma_addr;
+ };
+@@ -164,7 +165,6 @@ static void fpga_queue(struct solos_card
+ static uint32_t fpga_tx(struct solos_card *);
+ static irqreturn_t solos_irq(int irq, void *dev_id);
+ static struct atm_vcc* find_vcc(struct atm_dev *dev, short vpi, int vci);
+-static int list_vccs(int vci);
+ static int atm_init(struct solos_card *, struct device *);
+ static void atm_remove(struct solos_card *);
+ static int send_command(struct solos_card *card, int dev, const char *buf, size_t size);
+@@ -710,7 +710,8 @@ void solos_bh(unsigned long card_arg)
+ 						dev_warn(&card->dev->dev, "Received packet for unknown VPI.VCI %d.%d on port %d\n",
+ 							 le16_to_cpu(header->vpi), le16_to_cpu(header->vci),
+ 							 port);
+-					continue;
++					dev_kfree_skb_any(skb);
++					break;
+ 				}
+ 				atm_charge(vcc, skb->truesize);
+ 				vcc->push(vcc, skb);
+@@ -790,44 +791,6 @@ static struct atm_vcc *find_vcc(struct a
+ 	return vcc;
+ }
+ 
+-static int list_vccs(int vci)
+-{
+-	struct hlist_head *head;
+-	struct atm_vcc *vcc;
+-	struct hlist_node *node;
+-	struct sock *s;
+-	int num_found = 0;
+-	int i;
+-
+-	read_lock(&vcc_sklist_lock);
+-	if (vci != 0){
+-		head = &vcc_hash[vci & (VCC_HTABLE_SIZE -1)];
+-		sk_for_each(s, node, head) {
+-			num_found ++;
+-			vcc = atm_sk(s);
+-			printk(KERN_DEBUG "Device: %d Vpi: %d Vci: %d\n",
+-			       vcc->dev->number,
+-			       vcc->vpi,
+-			       vcc->vci);
+-		}
+-	} else {
+-		for(i = 0; i < VCC_HTABLE_SIZE; i++){
+-			head = &vcc_hash[i];
+-			sk_for_each(s, node, head) {
+-				num_found ++;
+-				vcc = atm_sk(s);
+-				printk(KERN_DEBUG "Device: %d Vpi: %d Vci: %d\n",
+-				       vcc->dev->number,
+-				       vcc->vpi,
+-				       vcc->vci);
+-			}
+-		}
+-	}
+-	read_unlock(&vcc_sklist_lock);
+-	return num_found;
+-}
+-
+-
+ static int popen(struct atm_vcc *vcc)
+ {
+ 	struct solos_card *card = vcc->dev->dev_data;
+@@ -840,7 +803,7 @@ static int popen(struct atm_vcc *vcc)
+ 		return -EINVAL;
+ 	}
+ 
+-	skb = alloc_skb(sizeof(*header), GFP_ATOMIC);
++	skb = alloc_skb(sizeof(*header), GFP_KERNEL);
+ 	if (!skb) {
+ 		if (net_ratelimit())
+ 			dev_warn(&card->dev->dev, "Failed to allocate sk_buff in popen()\n");
+@@ -857,8 +820,6 @@ static int popen(struct atm_vcc *vcc)
+ 
+ 	set_bit(ATM_VF_ADDR, &vcc->flags);
+ 	set_bit(ATM_VF_READY, &vcc->flags);
+-	list_vccs(0);
+-
+ 
+ 	return 0;
+ }
+@@ -866,10 +827,21 @@ static int popen(struct atm_vcc *vcc)
+ static void pclose(struct atm_vcc *vcc)
+ {
+ 	struct solos_card *card = vcc->dev->dev_data;
+-	struct sk_buff *skb;
++	unsigned char port = SOLOS_CHAN(vcc->dev);
++	struct sk_buff *skb, *tmpskb;
+ 	struct pkt_hdr *header;
+ 
+-	skb = alloc_skb(sizeof(*header), GFP_ATOMIC);
++	/* Remove any yet-to-be-transmitted packets from the pending queue */
++	spin_lock(&card->tx_queue_lock);
++	skb_queue_walk_safe(&card->tx_queue[port], skb, tmpskb) {
++		if (SKB_CB(skb)->vcc == vcc) {
++			skb_unlink(skb, &card->tx_queue[port]);
++			solos_pop(vcc, skb);
++		}
++	}
++	spin_unlock(&card->tx_queue_lock);
++
++	skb = alloc_skb(sizeof(*header), GFP_KERNEL);
+ 	if (!skb) {
+ 		dev_warn(&card->dev->dev, "Failed to allocate sk_buff in pclose()\n");
+ 		return;
+@@ -881,15 +853,21 @@ static void pclose(struct atm_vcc *vcc)
+ 	header->vci = cpu_to_le16(vcc->vci);
+ 	header->type = cpu_to_le16(PKT_PCLOSE);
+ 
+-	fpga_queue(card, SOLOS_CHAN(vcc->dev), skb, NULL);
++	init_completion(&SKB_CB(skb)->c);
+ 
+-	clear_bit(ATM_VF_ADDR, &vcc->flags);
+-	clear_bit(ATM_VF_READY, &vcc->flags);
++	fpga_queue(card, port, skb, NULL);
++
++	if (!wait_for_completion_timeout(&SKB_CB(skb)->c, 5 * HZ))
++		dev_warn(&card->dev->dev, "Timeout waiting for VCC close on port %d\n",
++			 port);
+ 
+ 	/* Hold up vcc_destroy_socket() (our caller) until solos_bh() in the
+ 	   tasklet has finished processing any incoming packets (and, more to
+ 	   the point, using the vcc pointer). */
+ 	tasklet_unlock_wait(&card->tlet);
++
++	clear_bit(ATM_VF_ADDR, &vcc->flags);
++
+ 	return;
+ }
+ 
+@@ -1010,9 +988,12 @@ static uint32_t fpga_tx(struct solos_car
+ 			if (vcc) {
+ 				atomic_inc(&vcc->stats->tx);
+ 				solos_pop(vcc, oldskb);
+-			} else
++			} else {
++				struct pkt_hdr *header = (void *)oldskb->data;
++				if (le16_to_cpu(header->type) == PKT_PCLOSE)
++					complete(&SKB_CB(oldskb)->c);
+ 				dev_kfree_skb_irq(oldskb);
+-
++			}
+ 		}
+ 	}
+ 	/* For non-DMA TX, write the 'TX start' bit for all four ports simultaneously */
+@@ -1246,7 +1227,7 @@ static int atm_init(struct solos_card *c
+ 		card->atmdev[i]->phy_data = (void *)(unsigned long)i;
+ 		atm_dev_signal_change(card->atmdev[i], ATM_PHY_SIG_FOUND);
+ 
+-		skb = alloc_skb(sizeof(*header), GFP_ATOMIC);
++		skb = alloc_skb(sizeof(*header), GFP_KERNEL);
+ 		if (!skb) {
+ 			dev_warn(&card->dev->dev, "Failed to allocate sk_buff in atm_init()\n");
+ 			continue;
+@@ -1343,6 +1324,8 @@ static struct pci_driver fpga_driver = {
+ 
+ static int __init solos_pci_init(void)
+ {
++	BUILD_BUG_ON(sizeof(struct solos_skb_cb) > sizeof(((struct sk_buff *)0)->cb));
++
+ 	printk(KERN_INFO "Solos PCI Driver Version %s\n", VERSION);
+ 	return pci_register_driver(&fpga_driver);
+ }
+--- a/include/linux/atmdev.h
++++ b/include/linux/atmdev.h
+@@ -307,6 +307,7 @@ struct atm_vcc {
+ 	struct atm_dev	*dev;		/* device back pointer */
+ 	struct atm_qos	qos;		/* QOS */
+ 	struct atm_sap	sap;		/* SAP */
++	void (*release_cb)(struct atm_vcc *vcc); /* release_sock callback */
+ 	void (*push)(struct atm_vcc *vcc,struct sk_buff *skb);
+ 	void (*pop)(struct atm_vcc *vcc,struct sk_buff *skb); /* optional */
+ 	int (*push_oam)(struct atm_vcc *vcc,void *cell);
+@@ -314,6 +315,7 @@ struct atm_vcc {
+ 	void		*dev_data;	/* per-device data */
+ 	void		*proto_data;	/* per-protocol data */
+ 	struct k_atm_aal_stats *stats;	/* pointer to AAL stats group */
++	struct module *owner;		/* owner of ->push function */
+ 	/* SVC part --- may move later ------------------------------------- */
+ 	short		itf;		/* interface number */
+ 	struct sockaddr_atmsvc local;
+--- a/net/atm/br2684.c
++++ b/net/atm/br2684.c
+@@ -68,12 +68,15 @@ struct br2684_vcc {
+ 	/* keep old push, pop functions for chaining */
+ 	void (*old_push)(struct atm_vcc *vcc, struct sk_buff *skb);
+ 	void (*old_pop)(struct atm_vcc *vcc, struct sk_buff *skb);
++	void (*old_release_cb)(struct atm_vcc *vcc);
++	struct module *old_owner;
+ 	enum br2684_encaps encaps;
+ 	struct list_head brvccs;
+ #ifdef CONFIG_ATM_BR2684_IPFILTER
+ 	struct br2684_filter filter;
+ #endif /* CONFIG_ATM_BR2684_IPFILTER */
+ 	unsigned copies_needed, copies_failed;
++	atomic_t qspace;
+ };
+ 
+ struct br2684_dev {
+@@ -181,18 +184,15 @@ static struct notifier_block atm_dev_not
+ static void br2684_pop(struct atm_vcc *vcc, struct sk_buff *skb)
+ {
+ 	struct br2684_vcc *brvcc = BR2684_VCC(vcc);
+-	struct net_device *net_dev = skb->dev;
+ 
+-	pr_debug("(vcc %p ; net_dev %p )\n", vcc, net_dev);
++	pr_debug("(vcc %p ; net_dev %p )\n", vcc, brvcc->device);
+ 	brvcc->old_pop(vcc, skb);
+ 
+-	if (!net_dev)
+-		return;
+-
+-	if (atm_may_send(vcc, 0))
+-		netif_wake_queue(net_dev);
+-
++	/* If the queue space just went up from zero, wake */
++	if (atomic_inc_return(&brvcc->qspace) == 1)
++		netif_wake_queue(brvcc->device);
+ }
++
+ /*
+  * Send a packet out a particular vcc.  Not to useful right now, but paves
+  * the way for multiple vcc's per itf.  Returns true if we can send,
+@@ -256,16 +256,30 @@ static int br2684_xmit_vcc(struct sk_buf
+ 	ATM_SKB(skb)->atm_options = atmvcc->atm_options;
+ 	dev->stats.tx_packets++;
+ 	dev->stats.tx_bytes += skb->len;
+-	atmvcc->send(atmvcc, skb);
+ 
+-	if (!atm_may_send(atmvcc, 0)) {
++	if (atomic_dec_return(&brvcc->qspace) < 1) {
++		/* No more please! */
+ 		netif_stop_queue(brvcc->device);
+-		/*check for race with br2684_pop*/
+-		if (atm_may_send(atmvcc, 0))
+-			netif_start_queue(brvcc->device);
++		/* We might have raced with br2684_pop() */
++		if (unlikely(atomic_read(&brvcc->qspace) > 0))
++			netif_wake_queue(brvcc->device);
+ 	}
+ 
+-	return 1;
++	/* If this fails immediately, the skb will be freed and br2684_pop()
++	   will wake the queue if appropriate. Just return an error so that
++	   the stats are updated correctly */
++	return !atmvcc->send(atmvcc, skb);
++}
++
++static void br2684_release_cb(struct atm_vcc *atmvcc)
++{
++	struct br2684_vcc *brvcc = BR2684_VCC(atmvcc);
++
++	if (atomic_read(&brvcc->qspace) > 0)
++		netif_wake_queue(brvcc->device);
++
++	if (brvcc->old_release_cb)
++		brvcc->old_release_cb(atmvcc);
+ }
+ 
+ static inline struct br2684_vcc *pick_outgoing_vcc(const struct sk_buff *skb,
+@@ -279,6 +293,8 @@ static netdev_tx_t br2684_start_xmit(str
+ {
+ 	struct br2684_dev *brdev = BRPRIV(dev);
+ 	struct br2684_vcc *brvcc;
++	struct atm_vcc *atmvcc;
++	netdev_tx_t ret = NETDEV_TX_OK;
+ 
+ 	pr_debug("skb_dst(skb)=%p\n", skb_dst(skb));
+ 	read_lock(&devs_lock);
+@@ -289,9 +305,26 @@ static netdev_tx_t br2684_start_xmit(str
+ 		dev->stats.tx_carrier_errors++;
+ 		/* netif_stop_queue(dev); */
+ 		dev_kfree_skb(skb);
+-		read_unlock(&devs_lock);
+-		return NETDEV_TX_OK;
++		goto out_devs;
+ 	}
++	atmvcc = brvcc->atmvcc;
++
++	bh_lock_sock(sk_atm(atmvcc));
++
++	if (test_bit(ATM_VF_RELEASED, &atmvcc->flags) ||
++	    test_bit(ATM_VF_CLOSE, &atmvcc->flags) ||
++	    !test_bit(ATM_VF_READY, &atmvcc->flags)) {
++		dev->stats.tx_dropped++;
++		dev_kfree_skb(skb);
++		goto out;
++	}
++
++	if (sock_owned_by_user(sk_atm(atmvcc))) {
++		netif_stop_queue(brvcc->device);
++		ret = NETDEV_TX_BUSY;
++		goto out;
++	}
++
+ 	if (!br2684_xmit_vcc(skb, dev, brvcc)) {
+ 		/*
+ 		 * We should probably use netif_*_queue() here, but that
+@@ -303,8 +336,11 @@ static netdev_tx_t br2684_start_xmit(str
+ 		dev->stats.tx_errors++;
+ 		dev->stats.tx_fifo_errors++;
+ 	}
++ out:
++	bh_unlock_sock(sk_atm(atmvcc));
++ out_devs:
+ 	read_unlock(&devs_lock);
+-	return NETDEV_TX_OK;
++	return ret;
+ }
+ 
+ /*
+@@ -377,9 +413,10 @@ static void br2684_close_vcc(struct br26
+ 	list_del(&brvcc->brvccs);
+ 	write_unlock_irq(&devs_lock);
+ 	brvcc->atmvcc->user_back = NULL;	/* what about vcc->recvq ??? */
++	brvcc->atmvcc->release_cb = brvcc->old_release_cb;
+ 	brvcc->old_push(brvcc->atmvcc, NULL);	/* pass on the bad news */
++	module_put(brvcc->old_owner);
+ 	kfree(brvcc);
+-	module_put(THIS_MODULE);
+ }
+ 
+ /* when AAL5 PDU comes in: */
+@@ -504,6 +541,13 @@ static int br2684_regvcc(struct atm_vcc
+ 	brvcc = kzalloc(sizeof(struct br2684_vcc), GFP_KERNEL);
+ 	if (!brvcc)
+ 		return -ENOMEM;
++	/*
++	 * Allow two packets in the ATM queue. One actually being sent, and one
++	 * for the ATM 'TX done' handler to send. It shouldn't take long to get
++	 * the next one from the netdev queue, when we need it. More than that
++	 * would be bufferbloat.
++	 */
++	atomic_set(&brvcc->qspace, 2);
+ 	write_lock_irq(&devs_lock);
+ 	net_dev = br2684_find_dev(&be.ifspec);
+ 	if (net_dev == NULL) {
+@@ -546,9 +590,13 @@ static int br2684_regvcc(struct atm_vcc
+ 	brvcc->encaps = (enum br2684_encaps)be.encaps;
+ 	brvcc->old_push = atmvcc->push;
+ 	brvcc->old_pop = atmvcc->pop;
++	brvcc->old_release_cb = atmvcc->release_cb;
++	brvcc->old_owner = atmvcc->owner;
+ 	barrier();
+ 	atmvcc->push = br2684_push;
+ 	atmvcc->pop = br2684_pop;
++	atmvcc->release_cb = br2684_release_cb;
++	atmvcc->owner = THIS_MODULE;
+ 
+ 	/* initialize netdev carrier state */
+ 	if (atmvcc->dev->signal == ATM_PHY_SIG_LOST)
+@@ -687,10 +735,13 @@ static int br2684_ioctl(struct socket *s
+ 			return -ENOIOCTLCMD;
+ 		if (!capable(CAP_NET_ADMIN))
+ 			return -EPERM;
+-		if (cmd == ATM_SETBACKEND)
++		if (cmd == ATM_SETBACKEND) {
++			if (sock->state != SS_CONNECTED)
++				return -EINVAL;
+ 			return br2684_regvcc(atmvcc, argp);
+-		else
++		} else {
+ 			return br2684_create(argp);
++		}
+ #ifdef CONFIG_ATM_BR2684_IPFILTER
+ 	case BR2684_SETFILT:
+ 		if (atmvcc->push != br2684_push)
+--- a/net/atm/common.c
++++ b/net/atm/common.c
+@@ -126,10 +126,19 @@ static void vcc_write_space(struct sock
+ 	rcu_read_unlock();
+ }
+ 
++static void vcc_release_cb(struct sock *sk)
++{
++	struct atm_vcc *vcc = atm_sk(sk);
++
++	if (vcc->release_cb)
++		vcc->release_cb(vcc);
++}
++
+ static struct proto vcc_proto = {
+ 	.name	  = "VCC",
+ 	.owner	  = THIS_MODULE,
+ 	.obj_size = sizeof(struct atm_vcc),
++	.release_cb = vcc_release_cb,
+ };
+ 
+ int vcc_create(struct net *net, struct socket *sock, int protocol, int family)
+@@ -156,7 +165,9 @@ int vcc_create(struct net *net, struct s
+ 	atomic_set(&sk->sk_rmem_alloc, 0);
+ 	vcc->push = NULL;
+ 	vcc->pop = NULL;
++	vcc->owner = NULL;
+ 	vcc->push_oam = NULL;
++	vcc->release_cb = NULL;
+ 	vcc->vpi = vcc->vci = 0; /* no VCI/VPI yet */
+ 	vcc->atm_options = vcc->aal_options = 0;
+ 	sk->sk_destruct = vcc_sock_destruct;
+@@ -175,6 +186,7 @@ static void vcc_destroy_socket(struct so
+ 			vcc->dev->ops->close(vcc);
+ 		if (vcc->push)
+ 			vcc->push(vcc, NULL); /* atmarpd has no push */
++		module_put(vcc->owner);
+ 
+ 		while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+ 			atm_return(vcc, skb->truesize);
+--- a/net/atm/pppoatm.c
++++ b/net/atm/pppoatm.c
+@@ -60,6 +60,8 @@ struct pppoatm_vcc {
+ 	struct atm_vcc	*atmvcc;	/* VCC descriptor */
+ 	void (*old_push)(struct atm_vcc *, struct sk_buff *);
+ 	void (*old_pop)(struct atm_vcc *, struct sk_buff *);
++	void (*old_release_cb)(struct atm_vcc *);
++	struct module *old_owner;
+ 					/* keep old push/pop for detaching */
+ 	enum pppoatm_encaps encaps;
+ 	atomic_t inflight;
+@@ -107,6 +109,24 @@ static void pppoatm_wakeup_sender(unsign
+ 	ppp_output_wakeup((struct ppp_channel *) arg);
+ }
+ 
++static void pppoatm_release_cb(struct atm_vcc *atmvcc)
++{
++	struct pppoatm_vcc *pvcc = atmvcc_to_pvcc(atmvcc);
++
++	/*
++	 * As in pppoatm_pop(), it's safe to clear the BLOCKED bit here because
++	 * the wakeup *can't* race with pppoatm_send(). They both hold the PPP
++	 * channel's ->downl lock. And the potential race with *setting* it,
++	 * which leads to the double-check dance in pppoatm_may_send(), doesn't
++	 * exist here. In the sock_owned_by_user() case in pppoatm_send(), we
++	 * set the BLOCKED bit while the socket is still locked. We know that
++	 * ->release_cb() can't be called until that's done.
++	 */
++	if (test_and_clear_bit(BLOCKED, &pvcc->blocked))
++		tasklet_schedule(&pvcc->wakeup_tasklet);
++	if (pvcc->old_release_cb)
++		pvcc->old_release_cb(atmvcc);
++}
+ /*
+  * This gets called every time the ATM card has finished sending our
+  * skb.  The ->old_pop will take care up normal atm flow control,
+@@ -151,12 +171,11 @@ static void pppoatm_unassign_vcc(struct
+ 	pvcc = atmvcc_to_pvcc(atmvcc);
+ 	atmvcc->push = pvcc->old_push;
+ 	atmvcc->pop = pvcc->old_pop;
++	atmvcc->release_cb = pvcc->old_release_cb;
+ 	tasklet_kill(&pvcc->wakeup_tasklet);
+ 	ppp_unregister_channel(&pvcc->chan);
+ 	atmvcc->user_back = NULL;
+ 	kfree(pvcc);
+-	/* Gee, I hope we have the big kernel lock here... */
+-	module_put(THIS_MODULE);
+ }
+ 
+ /* Called when an AAL5 PDU comes in */
+@@ -165,9 +184,13 @@ static void pppoatm_push(struct atm_vcc
+ 	struct pppoatm_vcc *pvcc = atmvcc_to_pvcc(atmvcc);
+ 	pr_debug("\n");
+ 	if (skb == NULL) {			/* VCC was closed */
++		struct module *module;
++
+ 		pr_debug("removing ATMPPP VCC %p\n", pvcc);
++		module = pvcc->old_owner;
+ 		pppoatm_unassign_vcc(atmvcc);
+ 		atmvcc->push(atmvcc, NULL);	/* Pass along bad news */
++		module_put(module);
+ 		return;
+ 	}
+ 	atm_return(atmvcc, skb->truesize);
+@@ -211,7 +234,7 @@ error:
+ 	ppp_input_error(&pvcc->chan, 0);
+ }
+ 
+-static inline int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
++static int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
+ {
+ 	/*
+ 	 * It's not clear that we need to bother with using atm_may_send()
+@@ -269,10 +292,33 @@ static inline int pppoatm_may_send(struc
+ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
+ {
+ 	struct pppoatm_vcc *pvcc = chan_to_pvcc(chan);
++	struct atm_vcc *vcc;
++	int ret;
++
+ 	ATM_SKB(skb)->vcc = pvcc->atmvcc;
+ 	pr_debug("(skb=0x%p, vcc=0x%p)\n", skb, pvcc->atmvcc);
+ 	if (skb->data[0] == '\0' && (pvcc->flags & SC_COMP_PROT))
+ 		(void) skb_pull(skb, 1);
++
++	vcc = ATM_SKB(skb)->vcc;
++	bh_lock_sock(sk_atm(vcc));
++	if (sock_owned_by_user(sk_atm(vcc))) {
++		/*
++		 * Needs to happen (and be flushed, hence test_and_) before we unlock
++		 * the socket. It needs to be seen by the time our ->release_cb gets
++		 * called.
++		 */
++		test_and_set_bit(BLOCKED, &pvcc->blocked);
++		goto nospace;
++	}
++	if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
++	    test_bit(ATM_VF_CLOSE, &vcc->flags) ||
++	    !test_bit(ATM_VF_READY, &vcc->flags)) {
++		bh_unlock_sock(sk_atm(vcc));
++		kfree_skb(skb);
++		return DROP_PACKET;
++	}
++
+ 	switch (pvcc->encaps) {		/* LLC encapsulation needed */
+ 	case e_llc:
+ 		if (skb_headroom(skb) < LLC_LEN) {
+@@ -285,8 +331,10 @@ static int pppoatm_send(struct ppp_chann
+ 			}
+ 			kfree_skb(skb);
+ 			skb = n;
+-			if (skb == NULL)
++			if (skb == NULL) {
++				bh_unlock_sock(sk_atm(vcc));
+ 				return DROP_PACKET;
++			}
+ 		} else if (!pppoatm_may_send(pvcc, skb->truesize))
+ 			goto nospace;
+ 		memcpy(skb_push(skb, LLC_LEN), pppllc, LLC_LEN);
+@@ -296,6 +344,7 @@ static int pppoatm_send(struct ppp_chann
+ 			goto nospace;
+ 		break;
+ 	case e_autodetect:
++		bh_unlock_sock(sk_atm(vcc));
+ 		pr_debug("Trying to send without setting encaps!\n");
+ 		kfree_skb(skb);
+ 		return 1;
+@@ -305,9 +354,12 @@ static int pppoatm_send(struct ppp_chann
+ 	ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options;
+ 	pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n",
+ 		 skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev);
+-	return ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
++	ret = ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
+ 	    ? DROP_PACKET : 1;
++	bh_unlock_sock(sk_atm(vcc));
++	return ret;
+ nospace:
++	bh_unlock_sock(sk_atm(vcc));
+ 	/*
+ 	 * We don't have space to send this SKB now, but we might have
+ 	 * already applied SC_COMP_PROT compression, so may need to undo
+@@ -362,6 +414,8 @@ static int pppoatm_assign_vcc(struct atm
+ 	atomic_set(&pvcc->inflight, NONE_INFLIGHT);
+ 	pvcc->old_push = atmvcc->push;
+ 	pvcc->old_pop = atmvcc->pop;
++	pvcc->old_owner = atmvcc->owner;
++	pvcc->old_release_cb = atmvcc->release_cb;
+ 	pvcc->encaps = (enum pppoatm_encaps) be.encaps;
+ 	pvcc->chan.private = pvcc;
+ 	pvcc->chan.ops = &pppoatm_ops;
+@@ -377,7 +431,9 @@ static int pppoatm_assign_vcc(struct atm
+ 	atmvcc->user_back = pvcc;
+ 	atmvcc->push = pppoatm_push;
+ 	atmvcc->pop = pppoatm_pop;
++	atmvcc->release_cb = pppoatm_release_cb;
+ 	__module_get(THIS_MODULE);
++	atmvcc->owner = THIS_MODULE;
+ 
+ 	/* re-process everything received between connection setup and
+ 	   backend setup */
+@@ -406,6 +462,8 @@ static int pppoatm_ioctl(struct socket *
+ 			return -ENOIOCTLCMD;
+ 		if (!capable(CAP_NET_ADMIN))
+ 			return -EPERM;
++		if (sock->state != SS_CONNECTED)
++			return -EINVAL;
+ 		return pppoatm_assign_vcc(atmvcc, argp);
+ 		}
+ 	case PPPIOCGCHAN:
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/132-solos-dma.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/132-solos-dma.patch.svn-base
new file mode 100644
index 0000000..beba891
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/132-solos-dma.patch.svn-base
@@ -0,0 +1,442 @@
+commit b4bd8ad9bb311e8536f726f7a633620ccd358cde
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Thu May 24 04:58:27 2012 +0000
+
+    solos-pci: Fix DMA support
+    
+    DMA support has finally made its way to the top of the TODO list, having
+    realised that a Geode using MMIO can't keep up with two ADSL2+ lines
+    each running at 21Mb/s.
+    
+    This patch fixes a couple of bugs in the DMA support in the driver, so
+    once the corresponding FPGA update is complete and tested everything
+    should work properly.
+    
+    We weren't storing the currently-transmitting skb, so we were never
+    unmapping it and never freeing/popping it when the TX was done.
+    And the addition of pci_set_master() is fairly self-explanatory.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Cc: stable@kernel.org
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 152a2a8b5e1d4cbe91a7c66f1028db15164a3766
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Dec 19 11:01:21 2012 +0000
+
+    solos-pci: ensure all TX packets are aligned to 4 bytes
+    
+    The FPGA can't handled unaligned DMA (yet). So copy into an aligned buffer,
+    if skb->data isn't suitably aligned.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 13af816469db3449c072afbae6c4c1bd9ccecccb
+Author: Nathan Williams <nathan@traverse.com.au>
+Date:   Wed Dec 19 11:01:20 2012 +0000
+
+    solos-pci: add firmware upgrade support for new models
+    
+    Signed-off-by: Nathan Williams <nathan@traverse.com.au>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 7fbdadb5e951e4f0c0fc991ff5f50295568786e6
+Author: Nathan Williams <nathan@traverse.com.au>
+Date:   Wed Dec 19 11:01:19 2012 +0000
+
+    solos-pci: remove superfluous debug output
+    
+    Signed-off-by: Nathan Williams <nathan@traverse.com.au>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit f9baad02e7411d9f38d5ebe1a1cdcde4ceec100d
+Author: Nathan Williams <nathan@traverse.com.au>
+Date:   Wed Dec 19 11:01:18 2012 +0000
+
+    solos-pci: add GPIO support for newer versions on Geos board
+    
+    dwmw2: Tidy up a little, simpler matching on which GPIO is being accessed,
+           only register on newer boards, register under PCI device instead of
+           duplicating them under each ATM device.
+    
+    Signed-off-by: Nathan Williams <nathan@traverse.com.au>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit cae49ede00ec3d0cda290b03fee55b72b49efc11
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Tue Dec 11 14:57:14 2012 +0000
+
+    solos-pci: fix double-free of TX skb in DMA mode
+    
+    We weren't clearing card->tx_skb[port] when processing the TX done interrupt.
+    If there wasn't another skb ready to transmit immediately, this led to a
+    double-free because we'd free it *again* next time we did have a packet to
+    send.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Cc: stable@kernel.org
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+==
+There is a typo here so we do a double lock instead of an unlock.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+---
+Only needed in linux-next.  Introduced in f9baad02e7411d9 [14/17]
+solos-pci: add GPIO support for newer versions on Geos board
+
+
+--- a/drivers/atm/solos-pci.c
++++ b/drivers/atm/solos-pci.c
+@@ -42,7 +42,8 @@
+ #include <linux/swab.h>
+ #include <linux/slab.h>
+ 
+-#define VERSION "0.07"
++#define VERSION "1.04"
++#define DRIVER_VERSION 0x01
+ #define PTAG "solos-pci"
+ 
+ #define CONFIG_RAM_SIZE	128
+@@ -56,16 +57,21 @@
+ #define FLASH_BUSY	0x60
+ #define FPGA_MODE	0x5C
+ #define FLASH_MODE	0x58
++#define GPIO_STATUS	0x54
++#define DRIVER_VER	0x50
+ #define TX_DMA_ADDR(port)	(0x40 + (4 * (port)))
+ #define RX_DMA_ADDR(port)	(0x30 + (4 * (port)))
+ 
+ #define DATA_RAM_SIZE	32768
+ #define BUF_SIZE	2048
+ #define OLD_BUF_SIZE	4096 /* For FPGA versions <= 2*/
+-#define FPGA_PAGE	528 /* FPGA flash page size*/
+-#define SOLOS_PAGE	512 /* Solos flash page size*/
+-#define FPGA_BLOCK	(FPGA_PAGE * 8) /* FPGA flash block size*/
+-#define SOLOS_BLOCK	(SOLOS_PAGE * 8) /* Solos flash block size*/
++/* Old boards use ATMEL AD45DB161D flash */
++#define ATMEL_FPGA_PAGE	528 /* FPGA flash page size*/
++#define ATMEL_SOLOS_PAGE	512 /* Solos flash page size*/
++#define ATMEL_FPGA_BLOCK	(ATMEL_FPGA_PAGE * 8) /* FPGA block size*/
++#define ATMEL_SOLOS_BLOCK	(ATMEL_SOLOS_PAGE * 8) /* Solos block size*/
++/* Current boards use M25P/M25PE SPI flash */
++#define SPI_FLASH_BLOCK	(256 * 64)
+ 
+ #define RX_BUF(card, nr) ((card->buffers) + (nr)*(card->buffer_size)*2)
+ #define TX_BUF(card, nr) ((card->buffers) + (nr)*(card->buffer_size)*2 + (card->buffer_size))
+@@ -123,11 +129,14 @@ struct solos_card {
+ 	struct sk_buff_head cli_queue[4];
+ 	struct sk_buff *tx_skb[4];
+ 	struct sk_buff *rx_skb[4];
++	unsigned char *dma_bounce;
+ 	wait_queue_head_t param_wq;
+ 	wait_queue_head_t fw_wq;
+ 	int using_dma;
++	int dma_alignment;
+ 	int fpga_version;
+ 	int buffer_size;
++	int atmel_flash;
+ };
+ 
+ 
+@@ -452,7 +461,6 @@ static ssize_t console_show(struct devic
+ 
+ 	len = skb->len;
+ 	memcpy(buf, skb->data, len);
+-	dev_dbg(&card->dev->dev, "len: %d\n", len);
+ 
+ 	kfree_skb(skb);
+ 	return len;
+@@ -499,6 +507,78 @@ static ssize_t console_store(struct devi
+ 	return err?:count;
+ }
+ 
++struct geos_gpio_attr {
++	struct device_attribute attr;
++	int offset;
++};
++
++#define SOLOS_GPIO_ATTR(_name, _mode, _show, _store, _offset)	\
++	struct geos_gpio_attr gpio_attr_##_name = {		\
++		.attr = __ATTR(_name, _mode, _show, _store),	\
++		.offset = _offset }
++
++static ssize_t geos_gpio_store(struct device *dev, struct device_attribute *attr,
++			       const char *buf, size_t count)
++{
++	struct pci_dev *pdev = container_of(dev, struct pci_dev, dev);
++	struct geos_gpio_attr *gattr = container_of(attr, struct geos_gpio_attr, attr);
++	struct solos_card *card = pci_get_drvdata(pdev);
++	uint32_t data32;
++
++	if (count != 1 && (count != 2 || buf[1] != '\n'))
++		return -EINVAL;
++
++	spin_lock_irq(&card->param_queue_lock);
++	data32 = ioread32(card->config_regs + GPIO_STATUS);
++	if (buf[0] == '1') {
++		data32 |= 1 << gattr->offset;
++		iowrite32(data32, card->config_regs + GPIO_STATUS);
++	} else if (buf[0] == '0') {
++		data32 &= ~(1 << gattr->offset);
++		iowrite32(data32, card->config_regs + GPIO_STATUS);
++	} else {
++		count = -EINVAL;
++	}
++	spin_unlock_irq(&card->param_queue_lock);
++	return count;
++}
++
++static ssize_t geos_gpio_show(struct device *dev, struct device_attribute *attr,
++			      char *buf)
++{
++	struct pci_dev *pdev = container_of(dev, struct pci_dev, dev);
++	struct geos_gpio_attr *gattr = container_of(attr, struct geos_gpio_attr, attr);
++	struct solos_card *card = pci_get_drvdata(pdev);
++	uint32_t data32;
++
++	data32 = ioread32(card->config_regs + GPIO_STATUS);
++	data32 = (data32 >> gattr->offset) & 1;
++
++	return sprintf(buf, "%d\n", data32);
++}
++
++static ssize_t hardware_show(struct device *dev, struct device_attribute *attr,
++			     char *buf)
++{
++	struct pci_dev *pdev = container_of(dev, struct pci_dev, dev);
++	struct geos_gpio_attr *gattr = container_of(attr, struct geos_gpio_attr, attr);
++	struct solos_card *card = pci_get_drvdata(pdev);
++	uint32_t data32;
++
++	data32 = ioread32(card->config_regs + GPIO_STATUS);
++	switch (gattr->offset) {
++	case 0:
++		/* HardwareVersion */
++		data32 = data32 & 0x1F;
++		break;
++	case 1:
++		/* HardwareVariant */
++		data32 = (data32 >> 5) & 0x0F;
++		break;
++	}
++	return sprintf(buf, "%d\n", data32);
++}
++
+ static DEVICE_ATTR(console, 0644, console_show, console_store);
+ 
+ 
+@@ -507,6 +587,14 @@ static DEVICE_ATTR(console, 0644, consol
+ 
+ #include "solos-attrlist.c"
+ 
++static SOLOS_GPIO_ATTR(GPIO1, 0644, geos_gpio_show, geos_gpio_store, 9);
++static SOLOS_GPIO_ATTR(GPIO2, 0644, geos_gpio_show, geos_gpio_store, 10);
++static SOLOS_GPIO_ATTR(GPIO3, 0644, geos_gpio_show, geos_gpio_store, 11);
++static SOLOS_GPIO_ATTR(GPIO4, 0644, geos_gpio_show, geos_gpio_store, 12);
++static SOLOS_GPIO_ATTR(GPIO5, 0644, geos_gpio_show, geos_gpio_store, 13);
++static SOLOS_GPIO_ATTR(PushButton, 0444, geos_gpio_show, NULL, 14);
++static SOLOS_GPIO_ATTR(HardwareVersion, 0444, hardware_show, NULL, 0);
++static SOLOS_GPIO_ATTR(HardwareVariant, 0444, hardware_show, NULL, 1);
+ #undef SOLOS_ATTR_RO
+ #undef SOLOS_ATTR_RW
+ 
+@@ -523,6 +611,23 @@ static struct attribute_group solos_attr
+ 	.name = "parameters",
+ };
+ 
++static struct attribute *gpio_attrs[] = {
++	&gpio_attr_GPIO1.attr.attr,
++	&gpio_attr_GPIO2.attr.attr,
++	&gpio_attr_GPIO3.attr.attr,
++	&gpio_attr_GPIO4.attr.attr,
++	&gpio_attr_GPIO5.attr.attr,
++	&gpio_attr_PushButton.attr.attr,
++	&gpio_attr_HardwareVersion.attr.attr,
++	&gpio_attr_HardwareVariant.attr.attr,
++	NULL
++};
++
++static struct attribute_group gpio_attr_group = {
++	.attrs = gpio_attrs,
++	.name = "gpio",
++};
++
+ static int flash_upgrade(struct solos_card *card, int chip)
+ {
+ 	const struct firmware *fw;
+@@ -534,16 +639,25 @@ static int flash_upgrade(struct solos_ca
+ 	switch (chip) {
+ 	case 0:
+ 		fw_name = "solos-FPGA.bin";
+-		blocksize = FPGA_BLOCK;
++		if (card->atmel_flash)
++			blocksize = ATMEL_FPGA_BLOCK;
++		else
++			blocksize = SPI_FLASH_BLOCK;
+ 		break;
+ 	case 1:
+ 		fw_name = "solos-Firmware.bin";
+-		blocksize = SOLOS_BLOCK;
++		if (card->atmel_flash)
++			blocksize = ATMEL_SOLOS_BLOCK;
++		else
++			blocksize = SPI_FLASH_BLOCK;
+ 		break;
+ 	case 2:
+ 		if (card->fpga_version > LEGACY_BUFFERS){
+ 			fw_name = "solos-db-FPGA.bin";
+-			blocksize = FPGA_BLOCK;
++			if (card->atmel_flash)
++				blocksize = ATMEL_FPGA_BLOCK;
++			else
++				blocksize = SPI_FLASH_BLOCK;
+ 		} else {
+ 			dev_info(&card->dev->dev, "FPGA version doesn't support"
+ 					" daughter board upgrades\n");
+@@ -553,7 +667,10 @@ static int flash_upgrade(struct solos_ca
+ 	case 3:
+ 		if (card->fpga_version > LEGACY_BUFFERS){
+ 			fw_name = "solos-Firmware.bin";
+-			blocksize = SOLOS_BLOCK;
++			if (card->atmel_flash)
++				blocksize = ATMEL_SOLOS_BLOCK;
++			else
++				blocksize = SPI_FLASH_BLOCK;
+ 		} else {
+ 			dev_info(&card->dev->dev, "FPGA version doesn't support"
+ 					" daughter board upgrades\n");
+@@ -569,6 +686,9 @@ static int flash_upgrade(struct solos_ca
+ 
+ 	dev_info(&card->dev->dev, "Flash upgrade starting\n");
+ 
++	/* New FPGAs require driver version before permitting flash upgrades */
++	iowrite32(DRIVER_VERSION, card->config_regs + DRIVER_VER);
++
+ 	numblocks = fw->size / blocksize;
+ 	dev_info(&card->dev->dev, "Firmware size: %zd\n", fw->size);
+ 	dev_info(&card->dev->dev, "Number of blocks: %d\n", numblocks);
+@@ -598,9 +718,13 @@ static int flash_upgrade(struct solos_ca
+ 		/* dev_info(&card->dev->dev, "Set FPGA Flash mode to Block Write\n"); */
+ 		iowrite32(((chip * 2) + 1), card->config_regs + FLASH_MODE);
+ 
+-		/* Copy block to buffer, swapping each 16 bits */
++		/* Copy block to buffer, swapping each 16 bits for Atmel flash */
+ 		for(i = 0; i < blocksize; i += 4) {
+-			uint32_t word = swahb32p((uint32_t *)(fw->data + offset + i));
++			uint32_t word;
++			if (card->atmel_flash)
++				word = swahb32p((uint32_t *)(fw->data + offset + i));
++			else
++				word = *(uint32_t *)(fw->data + offset + i);
+ 			if(card->fpga_version > LEGACY_BUFFERS)
+ 				iowrite32(word, FLASH_BUF + i);
+ 			else
+@@ -945,10 +1069,11 @@ static uint32_t fpga_tx(struct solos_car
+ 	for (port = 0; tx_pending; tx_pending >>= 1, port++) {
+ 		if (tx_pending & 1) {
+ 			struct sk_buff *oldskb = card->tx_skb[port];
+-			if (oldskb)
++			if (oldskb) {
+ 				pci_unmap_single(card->dev, SKB_CB(oldskb)->dma_addr,
+ 						 oldskb->len, PCI_DMA_TODEVICE);
+-
++				card->tx_skb[port] = NULL;
++			}
+ 			spin_lock(&card->tx_queue_lock);
+ 			skb = skb_dequeue(&card->tx_queue[port]);
+ 			if (!skb)
+@@ -960,8 +1085,14 @@ static uint32_t fpga_tx(struct solos_car
+ 				tx_started |= 1 << port;
+ 				oldskb = skb; /* We're done with this skb already */
+ 			} else if (skb && card->using_dma) {
+-				SKB_CB(skb)->dma_addr = pci_map_single(card->dev, skb->data,
++				unsigned char *data = skb->data;
++				if ((unsigned long)data & card->dma_alignment) {
++					data = card->dma_bounce + (BUF_SIZE * port);
++					memcpy(data, skb->data, skb->len);
++				}
++				SKB_CB(skb)->dma_addr = pci_map_single(card->dev, data,
+ 								       skb->len, PCI_DMA_TODEVICE);
++				card->tx_skb[port] = skb;
+ 				iowrite32(SKB_CB(skb)->dma_addr,
+ 					  card->config_regs + TX_DMA_ADDR(port));
+ 			}
+@@ -1133,17 +1264,33 @@ static int fpga_probe(struct pci_dev *de
+ 		db_fpga_upgrade = db_firmware_upgrade = 0;
+ 	}
+ 
+-	if (card->fpga_version >= DMA_SUPPORTED){
++	/* Stopped using Atmel flash after 0.03-38 */
++	if (fpga_ver < 39)
++		card->atmel_flash = 1;
++	else
++		card->atmel_flash = 0;
++
++	data32 = ioread32(card->config_regs + PORTS);
++	card->nr_ports = (data32 & 0x000000FF);
++
++	if (card->fpga_version >= DMA_SUPPORTED) {
++		pci_set_master(dev);
+ 		card->using_dma = 1;
++		if (1) { /* All known FPGA versions so far */
++			card->dma_alignment = 3;
++			card->dma_bounce = kmalloc(card->nr_ports * BUF_SIZE, GFP_KERNEL);
++			if (!card->dma_bounce) {
++				dev_warn(&card->dev->dev, "Failed to allocate DMA bounce buffers\n");
++				/* Fallback to MMIO doesn't work */
++				goto out_unmap_both;
++			}
++		}
+ 	} else {
+ 		card->using_dma = 0;
+ 		/* Set RX empty flag for all ports */
+ 		iowrite32(0xF0, card->config_regs + FLAGS_ADDR);
+ 	}
+ 
+-	data32 = ioread32(card->config_regs + PORTS);
+-	card->nr_ports = (data32 & 0x000000FF);
+-
+ 	pci_set_drvdata(dev, card);
+ 
+ 	tasklet_init(&card->tlet, solos_bh, (unsigned long)card);
+@@ -1178,6 +1325,10 @@ static int fpga_probe(struct pci_dev *de
+ 	if (err)
+ 		goto out_free_irq;
+ 
++	if (card->fpga_version >= DMA_SUPPORTED &&
++	    sysfs_create_group(&card->dev->dev.kobj, &gpio_attr_group))
++		dev_err(&card->dev->dev, "Could not register parameter group for GPIOs\n");
++
+ 	return 0;
+ 
+  out_free_irq:
+@@ -1186,6 +1337,7 @@ static int fpga_probe(struct pci_dev *de
+ 	tasklet_kill(&card->tlet);
+ 	
+  out_unmap_both:
++	kfree(card->dma_bounce);
+ 	pci_set_drvdata(dev, NULL);
+ 	pci_iounmap(dev, card->buffers);
+  out_unmap_config:
+@@ -1288,11 +1440,16 @@ static void fpga_remove(struct pci_dev *
+ 	iowrite32(1, card->config_regs + FPGA_MODE);
+ 	(void)ioread32(card->config_regs + FPGA_MODE); 
+ 
++	if (card->fpga_version >= DMA_SUPPORTED)
++		sysfs_remove_group(&card->dev->dev.kobj, &gpio_attr_group);
++
+ 	atm_remove(card);
+ 
+ 	free_irq(dev->irq, card);
+ 	tasklet_kill(&card->tlet);
+ 
++	kfree(card->dma_bounce);
++
+ 	/* Release device from reset */
+ 	iowrite32(0, card->config_regs + FPGA_MODE);
+ 	(void)ioread32(card->config_regs + FPGA_MODE); 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/140-ixp4xx_hss_module_h_include.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/140-ixp4xx_hss_module_h_include.patch.svn-base
new file mode 100644
index 0000000..94acf37
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/140-ixp4xx_hss_module_h_include.patch.svn-base
@@ -0,0 +1,39 @@
+From 32e857cd1fbb006f56a99a2eab998173b1576533 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Mon, 10 Sep 2012 10:18:57 +0200
+Subject: [PATCH net] ixp4xx_hss: fix build failure after logging conversion
+
+Commit c75bb2c6f0cf455c23e60f14d780e841dd47f801 (ixp4xx_hss: Update to
+current logging forms) converted the ixp4xx_hss module to use the current
+logging macros, but forgot to include linux/module.h, leading to the
+following build failures:
+
+  CC [M]  drivers/net/wan/ixp4xx_hss.o
+ drivers/net/wan/ixp4xx_hss.c:1412:20: error: expected ';', ',' or ')'
+ before string constant
+ drivers/net/wan/ixp4xx_hss.c:1413:25: error: expected ';', ',' or ')'
+ before string constant
+ drivers/net/wan/ixp4xx_hss.c:1414:21: error: expected ';', ',' or ')'
+ before string constant
+ drivers/net/wan/ixp4xx_hss.c:1415:19: error: expected ';', ',' or ')'
+ before string constant
+ make[8]: *** [drivers/net/wan/ixp4xx_hss.o] Error 1
+
+CC: stable@vger.kernel.org
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+---
+[stable: 3.1+]
+
+ drivers/net/wan/ixp4xx_hss.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wan/ixp4xx_hss.c
++++ b/drivers/net/wan/ixp4xx_hss.c
+@@ -10,6 +10,7 @@
+ 
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+ 
++#include <linux/module.h>
+ #include <linux/bitops.h>
+ #include <linux/cdev.h>
+ #include <linux/dma-mapping.h>
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/200-fix_localversion.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/200-fix_localversion.patch.svn-base
new file mode 100644
index 0000000..0d1bae8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/200-fix_localversion.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/scripts/setlocalversion
++++ b/scripts/setlocalversion
+@@ -168,7 +168,7 @@ else
+ 	# annotated or signed tagged state (as git describe only
+ 	# looks at signed or annotated tags - git tag -a/-s) and
+ 	# LOCALVERSION= is not specified
+-	if test "${LOCALVERSION+set}" != "set"; then
++	if test "${CONFIG_LOCALVERSION+set}" != "set"; then
+ 		scm=$(scm_version --short)
+ 		res="$res${scm:++}"
+ 	fi
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/201-extra_optimization.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/201-extra_optimization.patch.svn-base
new file mode 100644
index 0000000..6fe8b09
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/201-extra_optimization.patch.svn-base
@@ -0,0 +1,24 @@
+--- a/Makefile
++++ b/Makefile
+@@ -559,9 +559,9 @@ endif # $(dot-config)
+ all: vmlinux
+ 
+ ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+-KBUILD_CFLAGS	+= -Os
++KBUILD_CFLAGS	+= -Os -fno-caller-saves
+ else
+-KBUILD_CFLAGS	+= -O2
++KBUILD_CFLAGS	+= -O2 -fno-reorder-blocks -fno-tree-ch -fno-caller-saves
+ endif
+ 
+ include $(srctree)/arch/$(SRCARCH)/Makefile
+@@ -620,6 +620,9 @@ endif
+ NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)
+ CHECKFLAGS     += $(NOSTDINC_FLAGS)
+ 
++# improve gcc optimization
++CFLAGS += $(call cc-option,-funit-at-a-time,)
++
+ # warn about C99 declaration after statement
+ KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/202-reduce_module_size.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/202-reduce_module_size.patch.svn-base
new file mode 100644
index 0000000..bca1e35
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/202-reduce_module_size.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -374,7 +374,7 @@ KBUILD_CFLAGS_KERNEL :=
+ KBUILD_AFLAGS   := -D__ASSEMBLY__
+ KBUILD_AFLAGS_MODULE  := -DMODULE
+ KBUILD_CFLAGS_MODULE  := -DMODULE
+-KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds
++KBUILD_LDFLAGS_MODULE = -T $(srctree)/scripts/module-common.lds $(if $(CONFIG_PROFILING),,-s)
+ 
+ # Read KERNELRELEASE from include/config/kernel.release (if it exists)
+ KERNELRELEASE = $(shell cat include/config/kernel.release 2> /dev/null)
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/210-darwin_scripts_include.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/210-darwin_scripts_include.patch.svn-base
new file mode 100644
index 0000000..ccaf142
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/210-darwin_scripts_include.patch.svn-base
@@ -0,0 +1,3088 @@
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -22,6 +22,35 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <ctype.h>
++#ifdef __APPLE__
++/* Darwin has no memmem implementation, this one is ripped of the uClibc-0.9.28 source */
++void *memmem (const void *haystack, size_t haystack_len,
++                          const void *needle,  size_t needle_len)
++{
++  const char *begin;
++  const char *const last_possible
++    = (const char *) haystack + haystack_len - needle_len;
++
++  if (needle_len == 0)
++    /* The first occurrence of the empty string is deemed to occur at
++       the beginning of the string.  */
++    return (void *) haystack;
++
++  /* Sanity check, otherwise the loop might search through the whole
++     memory.  */
++  if (__builtin_expect (haystack_len < needle_len, 0))
++    return NULL;
++
++  for (begin = (const char *) haystack; begin <= last_possible; ++begin)
++    if (begin[0] == ((const char *) needle)[0] &&
++        !memcmp ((const void *) &begin[1],
++                 (const void *) ((const char *) needle + 1),
++                 needle_len - 1))
++      return (void *) begin;
++
++  return NULL;
++}
++#endif
+ 
+ #ifndef ARRAY_SIZE
+ #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof(arr[0]))
+--- a/scripts/kconfig/Makefile
++++ b/scripts/kconfig/Makefile
+@@ -123,6 +123,9 @@ check-lxdialog  := $(srctree)/$(src)/lxd
+ # we really need to do so. (Do not call gcc as part of make mrproper)
+ HOST_EXTRACFLAGS += $(shell $(CONFIG_SHELL) $(check-lxdialog) -ccflags) \
+                     -DLOCALE
++ifeq ($(shell uname -s),Darwin)
++HOST_LOADLIBES  += -lncurses
++endif
+ 
+ # ===========================================================================
+ # Shared Makefile for the various kconfig executables:
+--- a/scripts/mod/mk_elfconfig.c
++++ b/scripts/mod/mk_elfconfig.c
+@@ -1,7 +1,11 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#ifndef __APPLE__
+ #include <elf.h>
++#else
++#include "elf.h"
++#endif
+ 
+ int
+ main(int argc, char **argv)
+--- a/scripts/mod/modpost.h
++++ b/scripts/mod/modpost.h
+@@ -7,7 +7,11 @@
+ #include <sys/mman.h>
+ #include <fcntl.h>
+ #include <unistd.h>
++#if !(defined(__APPLE__) || defined(__CYGWIN__))
+ #include <elf.h>
++#else
++#include "elf.h"
++#endif
+ 
+ #include "elfconfig.h"
+ 
+--- /dev/null
++++ b/scripts/mod/elf.h
+@@ -0,0 +1,3007 @@
++/* This file defines standard ELF types, structures, and macros.
++   Copyright (C) 1995-2012 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#ifndef _ELF_H
++#define	_ELF_H 1
++
++/* Standard ELF types.  */
++
++#include <stdint.h>
++
++/* Type for a 16-bit quantity.  */
++typedef uint16_t Elf32_Half;
++typedef uint16_t Elf64_Half;
++
++/* Types for signed and unsigned 32-bit quantities.  */
++typedef uint32_t Elf32_Word;
++typedef	int32_t  Elf32_Sword;
++typedef uint32_t Elf64_Word;
++typedef	int32_t  Elf64_Sword;
++
++/* Types for signed and unsigned 64-bit quantities.  */
++typedef uint64_t Elf32_Xword;
++typedef	int64_t  Elf32_Sxword;
++typedef uint64_t Elf64_Xword;
++typedef	int64_t  Elf64_Sxword;
++
++/* Type of addresses.  */
++typedef uint32_t Elf32_Addr;
++typedef uint64_t Elf64_Addr;
++
++/* Type of file offsets.  */
++typedef uint32_t Elf32_Off;
++typedef uint64_t Elf64_Off;
++
++/* Type for section indices, which are 16-bit quantities.  */
++typedef uint16_t Elf32_Section;
++typedef uint16_t Elf64_Section;
++
++/* Type for version symbol information.  */
++typedef Elf32_Half Elf32_Versym;
++typedef Elf64_Half Elf64_Versym;
++
++
++/* The ELF file header.  This appears at the start of every ELF file.  */
++
++#define EI_NIDENT (16)
++
++typedef struct
++{
++  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
++  Elf32_Half	e_type;			/* Object file type */
++  Elf32_Half	e_machine;		/* Architecture */
++  Elf32_Word	e_version;		/* Object file version */
++  Elf32_Addr	e_entry;		/* Entry point virtual address */
++  Elf32_Off	e_phoff;		/* Program header table file offset */
++  Elf32_Off	e_shoff;		/* Section header table file offset */
++  Elf32_Word	e_flags;		/* Processor-specific flags */
++  Elf32_Half	e_ehsize;		/* ELF header size in bytes */
++  Elf32_Half	e_phentsize;		/* Program header table entry size */
++  Elf32_Half	e_phnum;		/* Program header table entry count */
++  Elf32_Half	e_shentsize;		/* Section header table entry size */
++  Elf32_Half	e_shnum;		/* Section header table entry count */
++  Elf32_Half	e_shstrndx;		/* Section header string table index */
++} Elf32_Ehdr;
++
++typedef struct
++{
++  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
++  Elf64_Half	e_type;			/* Object file type */
++  Elf64_Half	e_machine;		/* Architecture */
++  Elf64_Word	e_version;		/* Object file version */
++  Elf64_Addr	e_entry;		/* Entry point virtual address */
++  Elf64_Off	e_phoff;		/* Program header table file offset */
++  Elf64_Off	e_shoff;		/* Section header table file offset */
++  Elf64_Word	e_flags;		/* Processor-specific flags */
++  Elf64_Half	e_ehsize;		/* ELF header size in bytes */
++  Elf64_Half	e_phentsize;		/* Program header table entry size */
++  Elf64_Half	e_phnum;		/* Program header table entry count */
++  Elf64_Half	e_shentsize;		/* Section header table entry size */
++  Elf64_Half	e_shnum;		/* Section header table entry count */
++  Elf64_Half	e_shstrndx;		/* Section header string table index */
++} Elf64_Ehdr;
++
++/* Fields in the e_ident array.  The EI_* macros are indices into the
++   array.  The macros under each EI_* macro are the values the byte
++   may have.  */
++
++#define EI_MAG0		0		/* File identification byte 0 index */
++#define ELFMAG0		0x7f		/* Magic number byte 0 */
++
++#define EI_MAG1		1		/* File identification byte 1 index */
++#define ELFMAG1		'E'		/* Magic number byte 1 */
++
++#define EI_MAG2		2		/* File identification byte 2 index */
++#define ELFMAG2		'L'		/* Magic number byte 2 */
++
++#define EI_MAG3		3		/* File identification byte 3 index */
++#define ELFMAG3		'F'		/* Magic number byte 3 */
++
++/* Conglomeration of the identification bytes, for easy testing as a word.  */
++#define	ELFMAG		"\177ELF"
++#define	SELFMAG		4
++
++#define EI_CLASS	4		/* File class byte index */
++#define ELFCLASSNONE	0		/* Invalid class */
++#define ELFCLASS32	1		/* 32-bit objects */
++#define ELFCLASS64	2		/* 64-bit objects */
++#define ELFCLASSNUM	3
++
++#define EI_DATA		5		/* Data encoding byte index */
++#define ELFDATANONE	0		/* Invalid data encoding */
++#define ELFDATA2LSB	1		/* 2's complement, little endian */
++#define ELFDATA2MSB	2		/* 2's complement, big endian */
++#define ELFDATANUM	3
++
++#define EI_VERSION	6		/* File version byte index */
++					/* Value must be EV_CURRENT */
++
++#define EI_OSABI	7		/* OS ABI identification */
++#define ELFOSABI_NONE		0	/* UNIX System V ABI */
++#define ELFOSABI_SYSV		0	/* Alias.  */
++#define ELFOSABI_HPUX		1	/* HP-UX */
++#define ELFOSABI_NETBSD		2	/* NetBSD.  */
++#define ELFOSABI_GNU		3	/* Object uses GNU ELF extensions.  */
++#define ELFOSABI_LINUX		ELFOSABI_GNU /* Compatibility alias.  */
++#define ELFOSABI_SOLARIS	6	/* Sun Solaris.  */
++#define ELFOSABI_AIX		7	/* IBM AIX.  */
++#define ELFOSABI_IRIX		8	/* SGI Irix.  */
++#define ELFOSABI_FREEBSD	9	/* FreeBSD.  */
++#define ELFOSABI_TRU64		10	/* Compaq TRU64 UNIX.  */
++#define ELFOSABI_MODESTO	11	/* Novell Modesto.  */
++#define ELFOSABI_OPENBSD	12	/* OpenBSD.  */
++#define ELFOSABI_ARM_AEABI	64	/* ARM EABI */
++#define ELFOSABI_ARM		97	/* ARM */
++#define ELFOSABI_STANDALONE	255	/* Standalone (embedded) application */
++
++#define EI_ABIVERSION	8		/* ABI version */
++
++#define EI_PAD		9		/* Byte index of padding bytes */
++
++/* Legal values for e_type (object file type).  */
++
++#define ET_NONE		0		/* No file type */
++#define ET_REL		1		/* Relocatable file */
++#define ET_EXEC		2		/* Executable file */
++#define ET_DYN		3		/* Shared object file */
++#define ET_CORE		4		/* Core file */
++#define	ET_NUM		5		/* Number of defined types */
++#define ET_LOOS		0xfe00		/* OS-specific range start */
++#define ET_HIOS		0xfeff		/* OS-specific range end */
++#define ET_LOPROC	0xff00		/* Processor-specific range start */
++#define ET_HIPROC	0xffff		/* Processor-specific range end */
++
++/* Legal values for e_machine (architecture).  */
++
++#define EM_NONE		 0		/* No machine */
++#define EM_M32		 1		/* AT&T WE 32100 */
++#define EM_SPARC	 2		/* SUN SPARC */
++#define EM_386		 3		/* Intel 80386 */
++#define EM_68K		 4		/* Motorola m68k family */
++#define EM_88K		 5		/* Motorola m88k family */
++#define EM_860		 7		/* Intel 80860 */
++#define EM_MIPS		 8		/* MIPS R3000 big-endian */
++#define EM_S370		 9		/* IBM System/370 */
++#define EM_MIPS_RS3_LE	10		/* MIPS R3000 little-endian */
++
++#define EM_PARISC	15		/* HPPA */
++#define EM_VPP500	17		/* Fujitsu VPP500 */
++#define EM_SPARC32PLUS	18		/* Sun's "v8plus" */
++#define EM_960		19		/* Intel 80960 */
++#define EM_PPC		20		/* PowerPC */
++#define EM_PPC64	21		/* PowerPC 64-bit */
++#define EM_S390		22		/* IBM S390 */
++
++#define EM_V800		36		/* NEC V800 series */
++#define EM_FR20		37		/* Fujitsu FR20 */
++#define EM_RH32		38		/* TRW RH-32 */
++#define EM_RCE		39		/* Motorola RCE */
++#define EM_ARM		40		/* ARM */
++#define EM_FAKE_ALPHA	41		/* Digital Alpha */
++#define EM_SH		42		/* Hitachi SH */
++#define EM_SPARCV9	43		/* SPARC v9 64-bit */
++#define EM_TRICORE	44		/* Siemens Tricore */
++#define EM_ARC		45		/* Argonaut RISC Core */
++#define EM_H8_300	46		/* Hitachi H8/300 */
++#define EM_H8_300H	47		/* Hitachi H8/300H */
++#define EM_H8S		48		/* Hitachi H8S */
++#define EM_H8_500	49		/* Hitachi H8/500 */
++#define EM_IA_64	50		/* Intel Merced */
++#define EM_MIPS_X	51		/* Stanford MIPS-X */
++#define EM_COLDFIRE	52		/* Motorola Coldfire */
++#define EM_68HC12	53		/* Motorola M68HC12 */
++#define EM_MMA		54		/* Fujitsu MMA Multimedia Accelerator*/
++#define EM_PCP		55		/* Siemens PCP */
++#define EM_NCPU		56		/* Sony nCPU embeeded RISC */
++#define EM_NDR1		57		/* Denso NDR1 microprocessor */
++#define EM_STARCORE	58		/* Motorola Start*Core processor */
++#define EM_ME16		59		/* Toyota ME16 processor */
++#define EM_ST100	60		/* STMicroelectronic ST100 processor */
++#define EM_TINYJ	61		/* Advanced Logic Corp. Tinyj emb.fam*/
++#define EM_X86_64	62		/* AMD x86-64 architecture */
++#define EM_PDSP		63		/* Sony DSP Processor */
++
++#define EM_FX66		66		/* Siemens FX66 microcontroller */
++#define EM_ST9PLUS	67		/* STMicroelectronics ST9+ 8/16 mc */
++#define EM_ST7		68		/* STmicroelectronics ST7 8 bit mc */
++#define EM_68HC16	69		/* Motorola MC68HC16 microcontroller */
++#define EM_68HC11	70		/* Motorola MC68HC11 microcontroller */
++#define EM_68HC08	71		/* Motorola MC68HC08 microcontroller */
++#define EM_68HC05	72		/* Motorola MC68HC05 microcontroller */
++#define EM_SVX		73		/* Silicon Graphics SVx */
++#define EM_ST19		74		/* STMicroelectronics ST19 8 bit mc */
++#define EM_VAX		75		/* Digital VAX */
++#define EM_CRIS		76		/* Axis Communications 32-bit embedded processor */
++#define EM_JAVELIN	77		/* Infineon Technologies 32-bit embedded processor */
++#define EM_FIREPATH	78		/* Element 14 64-bit DSP Processor */
++#define EM_ZSP		79		/* LSI Logic 16-bit DSP Processor */
++#define EM_MMIX		80		/* Donald Knuth's educational 64-bit processor */
++#define EM_HUANY	81		/* Harvard University machine-independent object files */
++#define EM_PRISM	82		/* SiTera Prism */
++#define EM_AVR		83		/* Atmel AVR 8-bit microcontroller */
++#define EM_FR30		84		/* Fujitsu FR30 */
++#define EM_D10V		85		/* Mitsubishi D10V */
++#define EM_D30V		86		/* Mitsubishi D30V */
++#define EM_V850		87		/* NEC v850 */
++#define EM_M32R		88		/* Mitsubishi M32R */
++#define EM_MN10300	89		/* Matsushita MN10300 */
++#define EM_MN10200	90		/* Matsushita MN10200 */
++#define EM_PJ		91		/* picoJava */
++#define EM_OPENRISC	92		/* OpenRISC 32-bit embedded processor */
++#define EM_ARC_A5	93		/* ARC Cores Tangent-A5 */
++#define EM_XTENSA	94		/* Tensilica Xtensa Architecture */
++#define EM_TILEPRO	188		/* Tilera TILEPro */
++#define EM_TILEGX	191		/* Tilera TILE-Gx */
++#define EM_NUM		192
++
++/* If it is necessary to assign new unofficial EM_* values, please
++   pick large random numbers (0x8523, 0xa7f2, etc.) to minimize the
++   chances of collision with official or non-GNU unofficial values.  */
++
++#define EM_ALPHA	0x9026
++
++/* Legal values for e_version (version).  */
++
++#define EV_NONE		0		/* Invalid ELF version */
++#define EV_CURRENT	1		/* Current version */
++#define EV_NUM		2
++
++/* Section header.  */
++
++typedef struct
++{
++  Elf32_Word	sh_name;		/* Section name (string tbl index) */
++  Elf32_Word	sh_type;		/* Section type */
++  Elf32_Word	sh_flags;		/* Section flags */
++  Elf32_Addr	sh_addr;		/* Section virtual addr at execution */
++  Elf32_Off	sh_offset;		/* Section file offset */
++  Elf32_Word	sh_size;		/* Section size in bytes */
++  Elf32_Word	sh_link;		/* Link to another section */
++  Elf32_Word	sh_info;		/* Additional section information */
++  Elf32_Word	sh_addralign;		/* Section alignment */
++  Elf32_Word	sh_entsize;		/* Entry size if section holds table */
++} Elf32_Shdr;
++
++typedef struct
++{
++  Elf64_Word	sh_name;		/* Section name (string tbl index) */
++  Elf64_Word	sh_type;		/* Section type */
++  Elf64_Xword	sh_flags;		/* Section flags */
++  Elf64_Addr	sh_addr;		/* Section virtual addr at execution */
++  Elf64_Off	sh_offset;		/* Section file offset */
++  Elf64_Xword	sh_size;		/* Section size in bytes */
++  Elf64_Word	sh_link;		/* Link to another section */
++  Elf64_Word	sh_info;		/* Additional section information */
++  Elf64_Xword	sh_addralign;		/* Section alignment */
++  Elf64_Xword	sh_entsize;		/* Entry size if section holds table */
++} Elf64_Shdr;
++
++/* Special section indices.  */
++
++#define SHN_UNDEF	0		/* Undefined section */
++#define SHN_LORESERVE	0xff00		/* Start of reserved indices */
++#define SHN_LOPROC	0xff00		/* Start of processor-specific */
++#define SHN_BEFORE	0xff00		/* Order section before all others
++					   (Solaris).  */
++#define SHN_AFTER	0xff01		/* Order section after all others
++					   (Solaris).  */
++#define SHN_HIPROC	0xff1f		/* End of processor-specific */
++#define SHN_LOOS	0xff20		/* Start of OS-specific */
++#define SHN_HIOS	0xff3f		/* End of OS-specific */
++#define SHN_ABS		0xfff1		/* Associated symbol is absolute */
++#define SHN_COMMON	0xfff2		/* Associated symbol is common */
++#define SHN_XINDEX	0xffff		/* Index is in extra table.  */
++#define SHN_HIRESERVE	0xffff		/* End of reserved indices */
++
++/* Legal values for sh_type (section type).  */
++
++#define SHT_NULL	  0		/* Section header table entry unused */
++#define SHT_PROGBITS	  1		/* Program data */
++#define SHT_SYMTAB	  2		/* Symbol table */
++#define SHT_STRTAB	  3		/* String table */
++#define SHT_RELA	  4		/* Relocation entries with addends */
++#define SHT_HASH	  5		/* Symbol hash table */
++#define SHT_DYNAMIC	  6		/* Dynamic linking information */
++#define SHT_NOTE	  7		/* Notes */
++#define SHT_NOBITS	  8		/* Program space with no data (bss) */
++#define SHT_REL		  9		/* Relocation entries, no addends */
++#define SHT_SHLIB	  10		/* Reserved */
++#define SHT_DYNSYM	  11		/* Dynamic linker symbol table */
++#define SHT_INIT_ARRAY	  14		/* Array of constructors */
++#define SHT_FINI_ARRAY	  15		/* Array of destructors */
++#define SHT_PREINIT_ARRAY 16		/* Array of pre-constructors */
++#define SHT_GROUP	  17		/* Section group */
++#define SHT_SYMTAB_SHNDX  18		/* Extended section indeces */
++#define	SHT_NUM		  19		/* Number of defined types.  */
++#define SHT_LOOS	  0x60000000	/* Start OS-specific.  */
++#define SHT_GNU_ATTRIBUTES 0x6ffffff5	/* Object attributes.  */
++#define SHT_GNU_HASH	  0x6ffffff6	/* GNU-style hash table.  */
++#define SHT_GNU_LIBLIST	  0x6ffffff7	/* Prelink library list */
++#define SHT_CHECKSUM	  0x6ffffff8	/* Checksum for DSO content.  */
++#define SHT_LOSUNW	  0x6ffffffa	/* Sun-specific low bound.  */
++#define SHT_SUNW_move	  0x6ffffffa
++#define SHT_SUNW_COMDAT   0x6ffffffb
++#define SHT_SUNW_syminfo  0x6ffffffc
++#define SHT_GNU_verdef	  0x6ffffffd	/* Version definition section.  */
++#define SHT_GNU_verneed	  0x6ffffffe	/* Version needs section.  */
++#define SHT_GNU_versym	  0x6fffffff	/* Version symbol table.  */
++#define SHT_HISUNW	  0x6fffffff	/* Sun-specific high bound.  */
++#define SHT_HIOS	  0x6fffffff	/* End OS-specific type */
++#define SHT_LOPROC	  0x70000000	/* Start of processor-specific */
++#define SHT_HIPROC	  0x7fffffff	/* End of processor-specific */
++#define SHT_LOUSER	  0x80000000	/* Start of application-specific */
++#define SHT_HIUSER	  0x8fffffff	/* End of application-specific */
++
++/* Legal values for sh_flags (section flags).  */
++
++#define SHF_WRITE	     (1 << 0)	/* Writable */
++#define SHF_ALLOC	     (1 << 1)	/* Occupies memory during execution */
++#define SHF_EXECINSTR	     (1 << 2)	/* Executable */
++#define SHF_MERGE	     (1 << 4)	/* Might be merged */
++#define SHF_STRINGS	     (1 << 5)	/* Contains nul-terminated strings */
++#define SHF_INFO_LINK	     (1 << 6)	/* `sh_info' contains SHT index */
++#define SHF_LINK_ORDER	     (1 << 7)	/* Preserve order after combining */
++#define SHF_OS_NONCONFORMING (1 << 8)	/* Non-standard OS specific handling
++					   required */
++#define SHF_GROUP	     (1 << 9)	/* Section is member of a group.  */
++#define SHF_TLS		     (1 << 10)	/* Section hold thread-local data.  */
++#define SHF_MASKOS	     0x0ff00000	/* OS-specific.  */
++#define SHF_MASKPROC	     0xf0000000	/* Processor-specific */
++#define SHF_ORDERED	     (1 << 30)	/* Special ordering requirement
++					   (Solaris).  */
++#define SHF_EXCLUDE	     (1 << 31)	/* Section is excluded unless
++					   referenced or allocated (Solaris).*/
++
++/* Section group handling.  */
++#define GRP_COMDAT	0x1		/* Mark group as COMDAT.  */
++
++/* Symbol table entry.  */
++
++typedef struct
++{
++  Elf32_Word	st_name;		/* Symbol name (string tbl index) */
++  Elf32_Addr	st_value;		/* Symbol value */
++  Elf32_Word	st_size;		/* Symbol size */
++  unsigned char	st_info;		/* Symbol type and binding */
++  unsigned char	st_other;		/* Symbol visibility */
++  Elf32_Section	st_shndx;		/* Section index */
++} Elf32_Sym;
++
++typedef struct
++{
++  Elf64_Word	st_name;		/* Symbol name (string tbl index) */
++  unsigned char	st_info;		/* Symbol type and binding */
++  unsigned char st_other;		/* Symbol visibility */
++  Elf64_Section	st_shndx;		/* Section index */
++  Elf64_Addr	st_value;		/* Symbol value */
++  Elf64_Xword	st_size;		/* Symbol size */
++} Elf64_Sym;
++
++/* The syminfo section if available contains additional information about
++   every dynamic symbol.  */
++
++typedef struct
++{
++  Elf32_Half si_boundto;		/* Direct bindings, symbol bound to */
++  Elf32_Half si_flags;			/* Per symbol flags */
++} Elf32_Syminfo;
++
++typedef struct
++{
++  Elf64_Half si_boundto;		/* Direct bindings, symbol bound to */
++  Elf64_Half si_flags;			/* Per symbol flags */
++} Elf64_Syminfo;
++
++/* Possible values for si_boundto.  */
++#define SYMINFO_BT_SELF		0xffff	/* Symbol bound to self */
++#define SYMINFO_BT_PARENT	0xfffe	/* Symbol bound to parent */
++#define SYMINFO_BT_LOWRESERVE	0xff00	/* Beginning of reserved entries */
++
++/* Possible bitmasks for si_flags.  */
++#define SYMINFO_FLG_DIRECT	0x0001	/* Direct bound symbol */
++#define SYMINFO_FLG_PASSTHRU	0x0002	/* Pass-thru symbol for translator */
++#define SYMINFO_FLG_COPY	0x0004	/* Symbol is a copy-reloc */
++#define SYMINFO_FLG_LAZYLOAD	0x0008	/* Symbol bound to object to be lazy
++					   loaded */
++/* Syminfo version values.  */
++#define SYMINFO_NONE		0
++#define SYMINFO_CURRENT		1
++#define SYMINFO_NUM		2
++
++
++/* How to extract and insert information held in the st_info field.  */
++
++#define ELF32_ST_BIND(val)		(((unsigned char) (val)) >> 4)
++#define ELF32_ST_TYPE(val)		((val) & 0xf)
++#define ELF32_ST_INFO(bind, type)	(((bind) << 4) + ((type) & 0xf))
++
++/* Both Elf32_Sym and Elf64_Sym use the same one-byte st_info field.  */
++#define ELF64_ST_BIND(val)		ELF32_ST_BIND (val)
++#define ELF64_ST_TYPE(val)		ELF32_ST_TYPE (val)
++#define ELF64_ST_INFO(bind, type)	ELF32_ST_INFO ((bind), (type))
++
++/* Legal values for ST_BIND subfield of st_info (symbol binding).  */
++
++#define STB_LOCAL	0		/* Local symbol */
++#define STB_GLOBAL	1		/* Global symbol */
++#define STB_WEAK	2		/* Weak symbol */
++#define	STB_NUM		3		/* Number of defined types.  */
++#define STB_LOOS	10		/* Start of OS-specific */
++#define STB_GNU_UNIQUE	10		/* Unique symbol.  */
++#define STB_HIOS	12		/* End of OS-specific */
++#define STB_LOPROC	13		/* Start of processor-specific */
++#define STB_HIPROC	15		/* End of processor-specific */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_NOTYPE	0		/* Symbol type is unspecified */
++#define STT_OBJECT	1		/* Symbol is a data object */
++#define STT_FUNC	2		/* Symbol is a code object */
++#define STT_SECTION	3		/* Symbol associated with a section */
++#define STT_FILE	4		/* Symbol's name is file name */
++#define STT_COMMON	5		/* Symbol is a common data object */
++#define STT_TLS		6		/* Symbol is thread-local data object*/
++#define	STT_NUM		7		/* Number of defined types.  */
++#define STT_LOOS	10		/* Start of OS-specific */
++#define STT_GNU_IFUNC	10		/* Symbol is indirect code object */
++#define STT_HIOS	12		/* End of OS-specific */
++#define STT_LOPROC	13		/* Start of processor-specific */
++#define STT_HIPROC	15		/* End of processor-specific */
++
++
++/* Symbol table indices are found in the hash buckets and chain table
++   of a symbol hash table section.  This special index value indicates
++   the end of a chain, meaning no further symbols are found in that bucket.  */
++
++#define STN_UNDEF	0		/* End of a chain.  */
++
++
++/* How to extract and insert information held in the st_other field.  */
++
++#define ELF32_ST_VISIBILITY(o)	((o) & 0x03)
++
++/* For ELF64 the definitions are the same.  */
++#define ELF64_ST_VISIBILITY(o)	ELF32_ST_VISIBILITY (o)
++
++/* Symbol visibility specification encoded in the st_other field.  */
++#define STV_DEFAULT	0		/* Default symbol visibility rules */
++#define STV_INTERNAL	1		/* Processor specific hidden class */
++#define STV_HIDDEN	2		/* Sym unavailable in other modules */
++#define STV_PROTECTED	3		/* Not preemptible, not exported */
++
++
++/* Relocation table entry without addend (in section of type SHT_REL).  */
++
++typedef struct
++{
++  Elf32_Addr	r_offset;		/* Address */
++  Elf32_Word	r_info;			/* Relocation type and symbol index */
++} Elf32_Rel;
++
++/* I have seen two different definitions of the Elf64_Rel and
++   Elf64_Rela structures, so we'll leave them out until Novell (or
++   whoever) gets their act together.  */
++/* The following, at least, is used on Sparc v9, MIPS, and Alpha.  */
++
++typedef struct
++{
++  Elf64_Addr	r_offset;		/* Address */
++  Elf64_Xword	r_info;			/* Relocation type and symbol index */
++} Elf64_Rel;
++
++/* Relocation table entry with addend (in section of type SHT_RELA).  */
++
++typedef struct
++{
++  Elf32_Addr	r_offset;		/* Address */
++  Elf32_Word	r_info;			/* Relocation type and symbol index */
++  Elf32_Sword	r_addend;		/* Addend */
++} Elf32_Rela;
++
++typedef struct
++{
++  Elf64_Addr	r_offset;		/* Address */
++  Elf64_Xword	r_info;			/* Relocation type and symbol index */
++  Elf64_Sxword	r_addend;		/* Addend */
++} Elf64_Rela;
++
++/* How to extract and insert information held in the r_info field.  */
++
++#define ELF32_R_SYM(val)		((val) >> 8)
++#define ELF32_R_TYPE(val)		((val) & 0xff)
++#define ELF32_R_INFO(sym, type)		(((sym) << 8) + ((type) & 0xff))
++
++#define ELF64_R_SYM(i)			((i) >> 32)
++#define ELF64_R_TYPE(i)			((i) & 0xffffffff)
++#define ELF64_R_INFO(sym,type)		((((Elf64_Xword) (sym)) << 32) + (type))
++
++/* Program segment header.  */
++
++typedef struct
++{
++  Elf32_Word	p_type;			/* Segment type */
++  Elf32_Off	p_offset;		/* Segment file offset */
++  Elf32_Addr	p_vaddr;		/* Segment virtual address */
++  Elf32_Addr	p_paddr;		/* Segment physical address */
++  Elf32_Word	p_filesz;		/* Segment size in file */
++  Elf32_Word	p_memsz;		/* Segment size in memory */
++  Elf32_Word	p_flags;		/* Segment flags */
++  Elf32_Word	p_align;		/* Segment alignment */
++} Elf32_Phdr;
++
++typedef struct
++{
++  Elf64_Word	p_type;			/* Segment type */
++  Elf64_Word	p_flags;		/* Segment flags */
++  Elf64_Off	p_offset;		/* Segment file offset */
++  Elf64_Addr	p_vaddr;		/* Segment virtual address */
++  Elf64_Addr	p_paddr;		/* Segment physical address */
++  Elf64_Xword	p_filesz;		/* Segment size in file */
++  Elf64_Xword	p_memsz;		/* Segment size in memory */
++  Elf64_Xword	p_align;		/* Segment alignment */
++} Elf64_Phdr;
++
++/* Special value for e_phnum.  This indicates that the real number of
++   program headers is too large to fit into e_phnum.  Instead the real
++   value is in the field sh_info of section 0.  */
++
++#define PN_XNUM		0xffff
++
++/* Legal values for p_type (segment type).  */
++
++#define	PT_NULL		0		/* Program header table entry unused */
++#define PT_LOAD		1		/* Loadable program segment */
++#define PT_DYNAMIC	2		/* Dynamic linking information */
++#define PT_INTERP	3		/* Program interpreter */
++#define PT_NOTE		4		/* Auxiliary information */
++#define PT_SHLIB	5		/* Reserved */
++#define PT_PHDR		6		/* Entry for header table itself */
++#define PT_TLS		7		/* Thread-local storage segment */
++#define	PT_NUM		8		/* Number of defined types */
++#define PT_LOOS		0x60000000	/* Start of OS-specific */
++#define PT_GNU_EH_FRAME	0x6474e550	/* GCC .eh_frame_hdr segment */
++#define PT_GNU_STACK	0x6474e551	/* Indicates stack executability */
++#define PT_GNU_RELRO	0x6474e552	/* Read-only after relocation */
++#define PT_LOSUNW	0x6ffffffa
++#define PT_SUNWBSS	0x6ffffffa	/* Sun Specific segment */
++#define PT_SUNWSTACK	0x6ffffffb	/* Stack segment */
++#define PT_HISUNW	0x6fffffff
++#define PT_HIOS		0x6fffffff	/* End of OS-specific */
++#define PT_LOPROC	0x70000000	/* Start of processor-specific */
++#define PT_HIPROC	0x7fffffff	/* End of processor-specific */
++
++/* Legal values for p_flags (segment flags).  */
++
++#define PF_X		(1 << 0)	/* Segment is executable */
++#define PF_W		(1 << 1)	/* Segment is writable */
++#define PF_R		(1 << 2)	/* Segment is readable */
++#define PF_MASKOS	0x0ff00000	/* OS-specific */
++#define PF_MASKPROC	0xf0000000	/* Processor-specific */
++
++/* Legal values for note segment descriptor types for core files. */
++
++#define NT_PRSTATUS	1		/* Contains copy of prstatus struct */
++#define NT_FPREGSET	2		/* Contains copy of fpregset struct */
++#define NT_PRPSINFO	3		/* Contains copy of prpsinfo struct */
++#define NT_PRXREG	4		/* Contains copy of prxregset struct */
++#define NT_TASKSTRUCT	4		/* Contains copy of task structure */
++#define NT_PLATFORM	5		/* String from sysinfo(SI_PLATFORM) */
++#define NT_AUXV		6		/* Contains copy of auxv array */
++#define NT_GWINDOWS	7		/* Contains copy of gwindows struct */
++#define NT_ASRS		8		/* Contains copy of asrset struct */
++#define NT_PSTATUS	10		/* Contains copy of pstatus struct */
++#define NT_PSINFO	13		/* Contains copy of psinfo struct */
++#define NT_PRCRED	14		/* Contains copy of prcred struct */
++#define NT_UTSNAME	15		/* Contains copy of utsname struct */
++#define NT_LWPSTATUS	16		/* Contains copy of lwpstatus struct */
++#define NT_LWPSINFO	17		/* Contains copy of lwpinfo struct */
++#define NT_PRFPXREG	20		/* Contains copy of fprxregset struct */
++#define NT_PRXFPREG	0x46e62b7f	/* Contains copy of user_fxsr_struct */
++#define NT_PPC_VMX	0x100		/* PowerPC Altivec/VMX registers */
++#define NT_PPC_SPE	0x101		/* PowerPC SPE/EVR registers */
++#define NT_PPC_VSX	0x102		/* PowerPC VSX registers */
++#define NT_386_TLS	0x200		/* i386 TLS slots (struct user_desc) */
++#define NT_386_IOPERM	0x201		/* x86 io permission bitmap (1=deny) */
++#define NT_X86_XSTATE	0x202		/* x86 extended state using xsave */
++
++/* Legal values for the note segment descriptor types for object files.  */
++
++#define NT_VERSION	1		/* Contains a version string.  */
++
++
++/* Dynamic section entry.  */
++
++typedef struct
++{
++  Elf32_Sword	d_tag;			/* Dynamic entry type */
++  union
++    {
++      Elf32_Word d_val;			/* Integer value */
++      Elf32_Addr d_ptr;			/* Address value */
++    } d_un;
++} Elf32_Dyn;
++
++typedef struct
++{
++  Elf64_Sxword	d_tag;			/* Dynamic entry type */
++  union
++    {
++      Elf64_Xword d_val;		/* Integer value */
++      Elf64_Addr d_ptr;			/* Address value */
++    } d_un;
++} Elf64_Dyn;
++
++/* Legal values for d_tag (dynamic entry type).  */
++
++#define DT_NULL		0		/* Marks end of dynamic section */
++#define DT_NEEDED	1		/* Name of needed library */
++#define DT_PLTRELSZ	2		/* Size in bytes of PLT relocs */
++#define DT_PLTGOT	3		/* Processor defined value */
++#define DT_HASH		4		/* Address of symbol hash table */
++#define DT_STRTAB	5		/* Address of string table */
++#define DT_SYMTAB	6		/* Address of symbol table */
++#define DT_RELA		7		/* Address of Rela relocs */
++#define DT_RELASZ	8		/* Total size of Rela relocs */
++#define DT_RELAENT	9		/* Size of one Rela reloc */
++#define DT_STRSZ	10		/* Size of string table */
++#define DT_SYMENT	11		/* Size of one symbol table entry */
++#define DT_INIT		12		/* Address of init function */
++#define DT_FINI		13		/* Address of termination function */
++#define DT_SONAME	14		/* Name of shared object */
++#define DT_RPATH	15		/* Library search path (deprecated) */
++#define DT_SYMBOLIC	16		/* Start symbol search here */
++#define DT_REL		17		/* Address of Rel relocs */
++#define DT_RELSZ	18		/* Total size of Rel relocs */
++#define DT_RELENT	19		/* Size of one Rel reloc */
++#define DT_PLTREL	20		/* Type of reloc in PLT */
++#define DT_DEBUG	21		/* For debugging; unspecified */
++#define DT_TEXTREL	22		/* Reloc might modify .text */
++#define DT_JMPREL	23		/* Address of PLT relocs */
++#define	DT_BIND_NOW	24		/* Process relocations of object */
++#define	DT_INIT_ARRAY	25		/* Array with addresses of init fct */
++#define	DT_FINI_ARRAY	26		/* Array with addresses of fini fct */
++#define	DT_INIT_ARRAYSZ	27		/* Size in bytes of DT_INIT_ARRAY */
++#define	DT_FINI_ARRAYSZ	28		/* Size in bytes of DT_FINI_ARRAY */
++#define DT_RUNPATH	29		/* Library search path */
++#define DT_FLAGS	30		/* Flags for the object being loaded */
++#define DT_ENCODING	32		/* Start of encoded range */
++#define DT_PREINIT_ARRAY 32		/* Array with addresses of preinit fct*/
++#define DT_PREINIT_ARRAYSZ 33		/* size in bytes of DT_PREINIT_ARRAY */
++#define	DT_NUM		34		/* Number used */
++#define DT_LOOS		0x6000000d	/* Start of OS-specific */
++#define DT_HIOS		0x6ffff000	/* End of OS-specific */
++#define DT_LOPROC	0x70000000	/* Start of processor-specific */
++#define DT_HIPROC	0x7fffffff	/* End of processor-specific */
++#define	DT_PROCNUM	DT_MIPS_NUM	/* Most used by any processor */
++
++/* DT_* entries which fall between DT_VALRNGHI & DT_VALRNGLO use the
++   Dyn.d_un.d_val field of the Elf*_Dyn structure.  This follows Sun's
++   approach.  */
++#define DT_VALRNGLO	0x6ffffd00
++#define DT_GNU_PRELINKED 0x6ffffdf5	/* Prelinking timestamp */
++#define DT_GNU_CONFLICTSZ 0x6ffffdf6	/* Size of conflict section */
++#define DT_GNU_LIBLISTSZ 0x6ffffdf7	/* Size of library list */
++#define DT_CHECKSUM	0x6ffffdf8
++#define DT_PLTPADSZ	0x6ffffdf9
++#define DT_MOVEENT	0x6ffffdfa
++#define DT_MOVESZ	0x6ffffdfb
++#define DT_FEATURE_1	0x6ffffdfc	/* Feature selection (DTF_*).  */
++#define DT_POSFLAG_1	0x6ffffdfd	/* Flags for DT_* entries, effecting
++					   the following DT_* entry.  */
++#define DT_SYMINSZ	0x6ffffdfe	/* Size of syminfo table (in bytes) */
++#define DT_SYMINENT	0x6ffffdff	/* Entry size of syminfo */
++#define DT_VALRNGHI	0x6ffffdff
++#define DT_VALTAGIDX(tag)	(DT_VALRNGHI - (tag))	/* Reverse order! */
++#define DT_VALNUM 12
++
++/* DT_* entries which fall between DT_ADDRRNGHI & DT_ADDRRNGLO use the
++   Dyn.d_un.d_ptr field of the Elf*_Dyn structure.
++
++   If any adjustment is made to the ELF object after it has been
++   built these entries will need to be adjusted.  */
++#define DT_ADDRRNGLO	0x6ffffe00
++#define DT_GNU_HASH	0x6ffffef5	/* GNU-style hash table.  */
++#define DT_TLSDESC_PLT	0x6ffffef6
++#define DT_TLSDESC_GOT	0x6ffffef7
++#define DT_GNU_CONFLICT	0x6ffffef8	/* Start of conflict section */
++#define DT_GNU_LIBLIST	0x6ffffef9	/* Library list */
++#define DT_CONFIG	0x6ffffefa	/* Configuration information.  */
++#define DT_DEPAUDIT	0x6ffffefb	/* Dependency auditing.  */
++#define DT_AUDIT	0x6ffffefc	/* Object auditing.  */
++#define	DT_PLTPAD	0x6ffffefd	/* PLT padding.  */
++#define	DT_MOVETAB	0x6ffffefe	/* Move table.  */
++#define DT_SYMINFO	0x6ffffeff	/* Syminfo table.  */
++#define DT_ADDRRNGHI	0x6ffffeff
++#define DT_ADDRTAGIDX(tag)	(DT_ADDRRNGHI - (tag))	/* Reverse order! */
++#define DT_ADDRNUM 11
++
++/* The versioning entry types.  The next are defined as part of the
++   GNU extension.  */
++#define DT_VERSYM	0x6ffffff0
++
++#define DT_RELACOUNT	0x6ffffff9
++#define DT_RELCOUNT	0x6ffffffa
++
++/* These were chosen by Sun.  */
++#define DT_FLAGS_1	0x6ffffffb	/* State flags, see DF_1_* below.  */
++#define	DT_VERDEF	0x6ffffffc	/* Address of version definition
++					   table */
++#define	DT_VERDEFNUM	0x6ffffffd	/* Number of version definitions */
++#define	DT_VERNEED	0x6ffffffe	/* Address of table with needed
++					   versions */
++#define	DT_VERNEEDNUM	0x6fffffff	/* Number of needed versions */
++#define DT_VERSIONTAGIDX(tag)	(DT_VERNEEDNUM - (tag))	/* Reverse order! */
++#define DT_VERSIONTAGNUM 16
++
++/* Sun added these machine-independent extensions in the "processor-specific"
++   range.  Be compatible.  */
++#define DT_AUXILIARY    0x7ffffffd      /* Shared object to load before self */
++#define DT_FILTER       0x7fffffff      /* Shared object to get values from */
++#define DT_EXTRATAGIDX(tag)	((Elf32_Word)-((Elf32_Sword) (tag) <<1>>1)-1)
++#define DT_EXTRANUM	3
++
++/* Values of `d_un.d_val' in the DT_FLAGS entry.  */
++#define DF_ORIGIN	0x00000001	/* Object may use DF_ORIGIN */
++#define DF_SYMBOLIC	0x00000002	/* Symbol resolutions starts here */
++#define DF_TEXTREL	0x00000004	/* Object contains text relocations */
++#define DF_BIND_NOW	0x00000008	/* No lazy binding for this object */
++#define DF_STATIC_TLS	0x00000010	/* Module uses the static TLS model */
++
++/* State flags selectable in the `d_un.d_val' element of the DT_FLAGS_1
++   entry in the dynamic section.  */
++#define DF_1_NOW	0x00000001	/* Set RTLD_NOW for this object.  */
++#define DF_1_GLOBAL	0x00000002	/* Set RTLD_GLOBAL for this object.  */
++#define DF_1_GROUP	0x00000004	/* Set RTLD_GROUP for this object.  */
++#define DF_1_NODELETE	0x00000008	/* Set RTLD_NODELETE for this object.*/
++#define DF_1_LOADFLTR	0x00000010	/* Trigger filtee loading at runtime.*/
++#define DF_1_INITFIRST	0x00000020	/* Set RTLD_INITFIRST for this object*/
++#define DF_1_NOOPEN	0x00000040	/* Set RTLD_NOOPEN for this object.  */
++#define DF_1_ORIGIN	0x00000080	/* $ORIGIN must be handled.  */
++#define DF_1_DIRECT	0x00000100	/* Direct binding enabled.  */
++#define DF_1_TRANS	0x00000200
++#define DF_1_INTERPOSE	0x00000400	/* Object is used to interpose.  */
++#define DF_1_NODEFLIB	0x00000800	/* Ignore default lib search path.  */
++#define DF_1_NODUMP	0x00001000	/* Object can't be dldump'ed.  */
++#define DF_1_CONFALT	0x00002000	/* Configuration alternative created.*/
++#define DF_1_ENDFILTEE	0x00004000	/* Filtee terminates filters search. */
++#define	DF_1_DISPRELDNE	0x00008000	/* Disp reloc applied at build time. */
++#define	DF_1_DISPRELPND	0x00010000	/* Disp reloc applied at run-time.  */
++
++/* Flags for the feature selection in DT_FEATURE_1.  */
++#define DTF_1_PARINIT	0x00000001
++#define DTF_1_CONFEXP	0x00000002
++
++/* Flags in the DT_POSFLAG_1 entry effecting only the next DT_* entry.  */
++#define DF_P1_LAZYLOAD	0x00000001	/* Lazyload following object.  */
++#define DF_P1_GROUPPERM	0x00000002	/* Symbols from next object are not
++					   generally available.  */
++
++/* Version definition sections.  */
++
++typedef struct
++{
++  Elf32_Half	vd_version;		/* Version revision */
++  Elf32_Half	vd_flags;		/* Version information */
++  Elf32_Half	vd_ndx;			/* Version Index */
++  Elf32_Half	vd_cnt;			/* Number of associated aux entries */
++  Elf32_Word	vd_hash;		/* Version name hash value */
++  Elf32_Word	vd_aux;			/* Offset in bytes to verdaux array */
++  Elf32_Word	vd_next;		/* Offset in bytes to next verdef
++					   entry */
++} Elf32_Verdef;
++
++typedef struct
++{
++  Elf64_Half	vd_version;		/* Version revision */
++  Elf64_Half	vd_flags;		/* Version information */
++  Elf64_Half	vd_ndx;			/* Version Index */
++  Elf64_Half	vd_cnt;			/* Number of associated aux entries */
++  Elf64_Word	vd_hash;		/* Version name hash value */
++  Elf64_Word	vd_aux;			/* Offset in bytes to verdaux array */
++  Elf64_Word	vd_next;		/* Offset in bytes to next verdef
++					   entry */
++} Elf64_Verdef;
++
++
++/* Legal values for vd_version (version revision).  */
++#define VER_DEF_NONE	0		/* No version */
++#define VER_DEF_CURRENT	1		/* Current version */
++#define VER_DEF_NUM	2		/* Given version number */
++
++/* Legal values for vd_flags (version information flags).  */
++#define VER_FLG_BASE	0x1		/* Version definition of file itself */
++#define VER_FLG_WEAK	0x2		/* Weak version identifier */
++
++/* Versym symbol index values.  */
++#define	VER_NDX_LOCAL		0	/* Symbol is local.  */
++#define	VER_NDX_GLOBAL		1	/* Symbol is global.  */
++#define	VER_NDX_LORESERVE	0xff00	/* Beginning of reserved entries.  */
++#define	VER_NDX_ELIMINATE	0xff01	/* Symbol is to be eliminated.  */
++
++/* Auxialiary version information.  */
++
++typedef struct
++{
++  Elf32_Word	vda_name;		/* Version or dependency names */
++  Elf32_Word	vda_next;		/* Offset in bytes to next verdaux
++					   entry */
++} Elf32_Verdaux;
++
++typedef struct
++{
++  Elf64_Word	vda_name;		/* Version or dependency names */
++  Elf64_Word	vda_next;		/* Offset in bytes to next verdaux
++					   entry */
++} Elf64_Verdaux;
++
++
++/* Version dependency section.  */
++
++typedef struct
++{
++  Elf32_Half	vn_version;		/* Version of structure */
++  Elf32_Half	vn_cnt;			/* Number of associated aux entries */
++  Elf32_Word	vn_file;		/* Offset of filename for this
++					   dependency */
++  Elf32_Word	vn_aux;			/* Offset in bytes to vernaux array */
++  Elf32_Word	vn_next;		/* Offset in bytes to next verneed
++					   entry */
++} Elf32_Verneed;
++
++typedef struct
++{
++  Elf64_Half	vn_version;		/* Version of structure */
++  Elf64_Half	vn_cnt;			/* Number of associated aux entries */
++  Elf64_Word	vn_file;		/* Offset of filename for this
++					   dependency */
++  Elf64_Word	vn_aux;			/* Offset in bytes to vernaux array */
++  Elf64_Word	vn_next;		/* Offset in bytes to next verneed
++					   entry */
++} Elf64_Verneed;
++
++
++/* Legal values for vn_version (version revision).  */
++#define VER_NEED_NONE	 0		/* No version */
++#define VER_NEED_CURRENT 1		/* Current version */
++#define VER_NEED_NUM	 2		/* Given version number */
++
++/* Auxiliary needed version information.  */
++
++typedef struct
++{
++  Elf32_Word	vna_hash;		/* Hash value of dependency name */
++  Elf32_Half	vna_flags;		/* Dependency specific information */
++  Elf32_Half	vna_other;		/* Unused */
++  Elf32_Word	vna_name;		/* Dependency name string offset */
++  Elf32_Word	vna_next;		/* Offset in bytes to next vernaux
++					   entry */
++} Elf32_Vernaux;
++
++typedef struct
++{
++  Elf64_Word	vna_hash;		/* Hash value of dependency name */
++  Elf64_Half	vna_flags;		/* Dependency specific information */
++  Elf64_Half	vna_other;		/* Unused */
++  Elf64_Word	vna_name;		/* Dependency name string offset */
++  Elf64_Word	vna_next;		/* Offset in bytes to next vernaux
++					   entry */
++} Elf64_Vernaux;
++
++
++/* Legal values for vna_flags.  */
++#define VER_FLG_WEAK	0x2		/* Weak version identifier */
++
++
++/* Auxiliary vector.  */
++
++/* This vector is normally only used by the program interpreter.  The
++   usual definition in an ABI supplement uses the name auxv_t.  The
++   vector is not usually defined in a standard <elf.h> file, but it
++   can't hurt.  We rename it to avoid conflicts.  The sizes of these
++   types are an arrangement between the exec server and the program
++   interpreter, so we don't fully specify them here.  */
++
++typedef struct
++{
++  uint32_t a_type;		/* Entry type */
++  union
++    {
++      uint32_t a_val;		/* Integer value */
++      /* We use to have pointer elements added here.  We cannot do that,
++	 though, since it does not work when using 32-bit definitions
++	 on 64-bit platforms and vice versa.  */
++    } a_un;
++} Elf32_auxv_t;
++
++typedef struct
++{
++  uint64_t a_type;		/* Entry type */
++  union
++    {
++      uint64_t a_val;		/* Integer value */
++      /* We use to have pointer elements added here.  We cannot do that,
++	 though, since it does not work when using 32-bit definitions
++	 on 64-bit platforms and vice versa.  */
++    } a_un;
++} Elf64_auxv_t;
++
++/* Legal values for a_type (entry type).  */
++
++#define AT_NULL		0		/* End of vector */
++#define AT_IGNORE	1		/* Entry should be ignored */
++#define AT_EXECFD	2		/* File descriptor of program */
++#define AT_PHDR		3		/* Program headers for program */
++#define AT_PHENT	4		/* Size of program header entry */
++#define AT_PHNUM	5		/* Number of program headers */
++#define AT_PAGESZ	6		/* System page size */
++#define AT_BASE		7		/* Base address of interpreter */
++#define AT_FLAGS	8		/* Flags */
++#define AT_ENTRY	9		/* Entry point of program */
++#define AT_NOTELF	10		/* Program is not ELF */
++#define AT_UID		11		/* Real uid */
++#define AT_EUID		12		/* Effective uid */
++#define AT_GID		13		/* Real gid */
++#define AT_EGID		14		/* Effective gid */
++#define AT_CLKTCK	17		/* Frequency of times() */
++
++/* Some more special a_type values describing the hardware.  */
++#define AT_PLATFORM	15		/* String identifying platform.  */
++#define AT_HWCAP	16		/* Machine dependent hints about
++					   processor capabilities.  */
++
++/* This entry gives some information about the FPU initialization
++   performed by the kernel.  */
++#define AT_FPUCW	18		/* Used FPU control word.  */
++
++/* Cache block sizes.  */
++#define AT_DCACHEBSIZE	19		/* Data cache block size.  */
++#define AT_ICACHEBSIZE	20		/* Instruction cache block size.  */
++#define AT_UCACHEBSIZE	21		/* Unified cache block size.  */
++
++/* A special ignored value for PPC, used by the kernel to control the
++   interpretation of the AUXV. Must be > 16.  */
++#define AT_IGNOREPPC	22		/* Entry should be ignored.  */
++
++#define	AT_SECURE	23		/* Boolean, was exec setuid-like?  */
++
++#define AT_BASE_PLATFORM 24		/* String identifying real platforms.*/
++
++#define AT_RANDOM	25		/* Address of 16 random bytes.  */
++
++#define AT_EXECFN	31		/* Filename of executable.  */
++
++/* Pointer to the global system page used for system calls and other
++   nice things.  */
++#define AT_SYSINFO	32
++#define AT_SYSINFO_EHDR	33
++
++/* Shapes of the caches.  Bits 0-3 contains associativity; bits 4-7 contains
++   log2 of line size; mask those to get cache size.  */
++#define AT_L1I_CACHESHAPE	34
++#define AT_L1D_CACHESHAPE	35
++#define AT_L2_CACHESHAPE	36
++#define AT_L3_CACHESHAPE	37
++
++/* Note section contents.  Each entry in the note section begins with
++   a header of a fixed form.  */
++
++typedef struct
++{
++  Elf32_Word n_namesz;			/* Length of the note's name.  */
++  Elf32_Word n_descsz;			/* Length of the note's descriptor.  */
++  Elf32_Word n_type;			/* Type of the note.  */
++} Elf32_Nhdr;
++
++typedef struct
++{
++  Elf64_Word n_namesz;			/* Length of the note's name.  */
++  Elf64_Word n_descsz;			/* Length of the note's descriptor.  */
++  Elf64_Word n_type;			/* Type of the note.  */
++} Elf64_Nhdr;
++
++/* Known names of notes.  */
++
++/* Solaris entries in the note section have this name.  */
++#define ELF_NOTE_SOLARIS	"SUNW Solaris"
++
++/* Note entries for GNU systems have this name.  */
++#define ELF_NOTE_GNU		"GNU"
++
++
++/* Defined types of notes for Solaris.  */
++
++/* Value of descriptor (one word) is desired pagesize for the binary.  */
++#define ELF_NOTE_PAGESIZE_HINT	1
++
++
++/* Defined note types for GNU systems.  */
++
++/* ABI information.  The descriptor consists of words:
++   word 0: OS descriptor
++   word 1: major version of the ABI
++   word 2: minor version of the ABI
++   word 3: subminor version of the ABI
++*/
++#define NT_GNU_ABI_TAG	1
++#define ELF_NOTE_ABI	NT_GNU_ABI_TAG /* Old name.  */
++
++/* Known OSes.  These values can appear in word 0 of an
++   NT_GNU_ABI_TAG note section entry.  */
++#define ELF_NOTE_OS_LINUX	0
++#define ELF_NOTE_OS_GNU		1
++#define ELF_NOTE_OS_SOLARIS2	2
++#define ELF_NOTE_OS_FREEBSD	3
++
++/* Synthetic hwcap information.  The descriptor begins with two words:
++   word 0: number of entries
++   word 1: bitmask of enabled entries
++   Then follow variable-length entries, one byte followed by a
++   '\0'-terminated hwcap name string.  The byte gives the bit
++   number to test if enabled, (1U << bit) & bitmask.  */
++#define NT_GNU_HWCAP	2
++
++/* Build ID bits as generated by ld --build-id.
++   The descriptor consists of any nonzero number of bytes.  */
++#define NT_GNU_BUILD_ID	3
++
++/* Version note generated by GNU gold containing a version string.  */
++#define NT_GNU_GOLD_VERSION	4
++
++
++/* Move records.  */
++typedef struct
++{
++  Elf32_Xword m_value;		/* Symbol value.  */
++  Elf32_Word m_info;		/* Size and index.  */
++  Elf32_Word m_poffset;		/* Symbol offset.  */
++  Elf32_Half m_repeat;		/* Repeat count.  */
++  Elf32_Half m_stride;		/* Stride info.  */
++} Elf32_Move;
++
++typedef struct
++{
++  Elf64_Xword m_value;		/* Symbol value.  */
++  Elf64_Xword m_info;		/* Size and index.  */
++  Elf64_Xword m_poffset;	/* Symbol offset.  */
++  Elf64_Half m_repeat;		/* Repeat count.  */
++  Elf64_Half m_stride;		/* Stride info.  */
++} Elf64_Move;
++
++/* Macro to construct move records.  */
++#define ELF32_M_SYM(info)	((info) >> 8)
++#define ELF32_M_SIZE(info)	((unsigned char) (info))
++#define ELF32_M_INFO(sym, size)	(((sym) << 8) + (unsigned char) (size))
++
++#define ELF64_M_SYM(info)	ELF32_M_SYM (info)
++#define ELF64_M_SIZE(info)	ELF32_M_SIZE (info)
++#define ELF64_M_INFO(sym, size)	ELF32_M_INFO (sym, size)
++
++
++/* Motorola 68k specific definitions.  */
++
++/* Values for Elf32_Ehdr.e_flags.  */
++#define EF_CPU32	0x00810000
++
++/* m68k relocs.  */
++
++#define R_68K_NONE	0		/* No reloc */
++#define R_68K_32	1		/* Direct 32 bit  */
++#define R_68K_16	2		/* Direct 16 bit  */
++#define R_68K_8		3		/* Direct 8 bit  */
++#define R_68K_PC32	4		/* PC relative 32 bit */
++#define R_68K_PC16	5		/* PC relative 16 bit */
++#define R_68K_PC8	6		/* PC relative 8 bit */
++#define R_68K_GOT32	7		/* 32 bit PC relative GOT entry */
++#define R_68K_GOT16	8		/* 16 bit PC relative GOT entry */
++#define R_68K_GOT8	9		/* 8 bit PC relative GOT entry */
++#define R_68K_GOT32O	10		/* 32 bit GOT offset */
++#define R_68K_GOT16O	11		/* 16 bit GOT offset */
++#define R_68K_GOT8O	12		/* 8 bit GOT offset */
++#define R_68K_PLT32	13		/* 32 bit PC relative PLT address */
++#define R_68K_PLT16	14		/* 16 bit PC relative PLT address */
++#define R_68K_PLT8	15		/* 8 bit PC relative PLT address */
++#define R_68K_PLT32O	16		/* 32 bit PLT offset */
++#define R_68K_PLT16O	17		/* 16 bit PLT offset */
++#define R_68K_PLT8O	18		/* 8 bit PLT offset */
++#define R_68K_COPY	19		/* Copy symbol at runtime */
++#define R_68K_GLOB_DAT	20		/* Create GOT entry */
++#define R_68K_JMP_SLOT	21		/* Create PLT entry */
++#define R_68K_RELATIVE	22		/* Adjust by program base */
++#define R_68K_TLS_GD32      25          /* 32 bit GOT offset for GD */
++#define R_68K_TLS_GD16      26          /* 16 bit GOT offset for GD */
++#define R_68K_TLS_GD8       27          /* 8 bit GOT offset for GD */
++#define R_68K_TLS_LDM32     28          /* 32 bit GOT offset for LDM */
++#define R_68K_TLS_LDM16     29          /* 16 bit GOT offset for LDM */
++#define R_68K_TLS_LDM8      30          /* 8 bit GOT offset for LDM */
++#define R_68K_TLS_LDO32     31          /* 32 bit module-relative offset */
++#define R_68K_TLS_LDO16     32          /* 16 bit module-relative offset */
++#define R_68K_TLS_LDO8      33          /* 8 bit module-relative offset */
++#define R_68K_TLS_IE32      34          /* 32 bit GOT offset for IE */
++#define R_68K_TLS_IE16      35          /* 16 bit GOT offset for IE */
++#define R_68K_TLS_IE8       36          /* 8 bit GOT offset for IE */
++#define R_68K_TLS_LE32      37          /* 32 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_LE16      38          /* 16 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_LE8       39          /* 8 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_DTPMOD32  40          /* 32 bit module number */
++#define R_68K_TLS_DTPREL32  41          /* 32 bit module-relative offset */
++#define R_68K_TLS_TPREL32   42          /* 32 bit TP-relative offset */
++/* Keep this the last entry.  */
++#define R_68K_NUM	43
++
++/* Intel 80386 specific definitions.  */
++
++/* i386 relocs.  */
++
++#define R_386_NONE	   0		/* No reloc */
++#define R_386_32	   1		/* Direct 32 bit  */
++#define R_386_PC32	   2		/* PC relative 32 bit */
++#define R_386_GOT32	   3		/* 32 bit GOT entry */
++#define R_386_PLT32	   4		/* 32 bit PLT address */
++#define R_386_COPY	   5		/* Copy symbol at runtime */
++#define R_386_GLOB_DAT	   6		/* Create GOT entry */
++#define R_386_JMP_SLOT	   7		/* Create PLT entry */
++#define R_386_RELATIVE	   8		/* Adjust by program base */
++#define R_386_GOTOFF	   9		/* 32 bit offset to GOT */
++#define R_386_GOTPC	   10		/* 32 bit PC relative offset to GOT */
++#define R_386_32PLT	   11
++#define R_386_TLS_TPOFF	   14		/* Offset in static TLS block */
++#define R_386_TLS_IE	   15		/* Address of GOT entry for static TLS
++					   block offset */
++#define R_386_TLS_GOTIE	   16		/* GOT entry for static TLS block
++					   offset */
++#define R_386_TLS_LE	   17		/* Offset relative to static TLS
++					   block */
++#define R_386_TLS_GD	   18		/* Direct 32 bit for GNU version of
++					   general dynamic thread local data */
++#define R_386_TLS_LDM	   19		/* Direct 32 bit for GNU version of
++					   local dynamic thread local data
++					   in LE code */
++#define R_386_16	   20
++#define R_386_PC16	   21
++#define R_386_8		   22
++#define R_386_PC8	   23
++#define R_386_TLS_GD_32	   24		/* Direct 32 bit for general dynamic
++					   thread local data */
++#define R_386_TLS_GD_PUSH  25		/* Tag for pushl in GD TLS code */
++#define R_386_TLS_GD_CALL  26		/* Relocation for call to
++					   __tls_get_addr() */
++#define R_386_TLS_GD_POP   27		/* Tag for popl in GD TLS code */
++#define R_386_TLS_LDM_32   28		/* Direct 32 bit for local dynamic
++					   thread local data in LE code */
++#define R_386_TLS_LDM_PUSH 29		/* Tag for pushl in LDM TLS code */
++#define R_386_TLS_LDM_CALL 30		/* Relocation for call to
++					   __tls_get_addr() in LDM code */
++#define R_386_TLS_LDM_POP  31		/* Tag for popl in LDM TLS code */
++#define R_386_TLS_LDO_32   32		/* Offset relative to TLS block */
++#define R_386_TLS_IE_32	   33		/* GOT entry for negated static TLS
++					   block offset */
++#define R_386_TLS_LE_32	   34		/* Negated offset relative to static
++					   TLS block */
++#define R_386_TLS_DTPMOD32 35		/* ID of module containing symbol */
++#define R_386_TLS_DTPOFF32 36		/* Offset in TLS block */
++#define R_386_TLS_TPOFF32  37		/* Negated offset in static TLS block */
++/* 38? */
++#define R_386_TLS_GOTDESC  39		/* GOT offset for TLS descriptor.  */
++#define R_386_TLS_DESC_CALL 40		/* Marker of call through TLS
++					   descriptor for
++					   relaxation.  */
++#define R_386_TLS_DESC     41		/* TLS descriptor containing
++					   pointer to code and to
++					   argument, returning the TLS
++					   offset for the symbol.  */
++#define R_386_IRELATIVE	   42		/* Adjust indirectly by program base */
++/* Keep this the last entry.  */
++#define R_386_NUM	   43
++
++/* SUN SPARC specific definitions.  */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_SPARC_REGISTER	13	/* Global register reserved to app. */
++
++/* Values for Elf64_Ehdr.e_flags.  */
++
++#define EF_SPARCV9_MM		3
++#define EF_SPARCV9_TSO		0
++#define EF_SPARCV9_PSO		1
++#define EF_SPARCV9_RMO		2
++#define EF_SPARC_LEDATA		0x800000 /* little endian data */
++#define EF_SPARC_EXT_MASK	0xFFFF00
++#define EF_SPARC_32PLUS		0x000100 /* generic V8+ features */
++#define EF_SPARC_SUN_US1	0x000200 /* Sun UltraSPARC1 extensions */
++#define EF_SPARC_HAL_R1		0x000400 /* HAL R1 extensions */
++#define EF_SPARC_SUN_US3	0x000800 /* Sun UltraSPARCIII extensions */
++
++/* SPARC relocs.  */
++
++#define R_SPARC_NONE		0	/* No reloc */
++#define R_SPARC_8		1	/* Direct 8 bit */
++#define R_SPARC_16		2	/* Direct 16 bit */
++#define R_SPARC_32		3	/* Direct 32 bit */
++#define R_SPARC_DISP8		4	/* PC relative 8 bit */
++#define R_SPARC_DISP16		5	/* PC relative 16 bit */
++#define R_SPARC_DISP32		6	/* PC relative 32 bit */
++#define R_SPARC_WDISP30		7	/* PC relative 30 bit shifted */
++#define R_SPARC_WDISP22		8	/* PC relative 22 bit shifted */
++#define R_SPARC_HI22		9	/* High 22 bit */
++#define R_SPARC_22		10	/* Direct 22 bit */
++#define R_SPARC_13		11	/* Direct 13 bit */
++#define R_SPARC_LO10		12	/* Truncated 10 bit */
++#define R_SPARC_GOT10		13	/* Truncated 10 bit GOT entry */
++#define R_SPARC_GOT13		14	/* 13 bit GOT entry */
++#define R_SPARC_GOT22		15	/* 22 bit GOT entry shifted */
++#define R_SPARC_PC10		16	/* PC relative 10 bit truncated */
++#define R_SPARC_PC22		17	/* PC relative 22 bit shifted */
++#define R_SPARC_WPLT30		18	/* 30 bit PC relative PLT address */
++#define R_SPARC_COPY		19	/* Copy symbol at runtime */
++#define R_SPARC_GLOB_DAT	20	/* Create GOT entry */
++#define R_SPARC_JMP_SLOT	21	/* Create PLT entry */
++#define R_SPARC_RELATIVE	22	/* Adjust by program base */
++#define R_SPARC_UA32		23	/* Direct 32 bit unaligned */
++
++/* Additional Sparc64 relocs.  */
++
++#define R_SPARC_PLT32		24	/* Direct 32 bit ref to PLT entry */
++#define R_SPARC_HIPLT22		25	/* High 22 bit PLT entry */
++#define R_SPARC_LOPLT10		26	/* Truncated 10 bit PLT entry */
++#define R_SPARC_PCPLT32		27	/* PC rel 32 bit ref to PLT entry */
++#define R_SPARC_PCPLT22		28	/* PC rel high 22 bit PLT entry */
++#define R_SPARC_PCPLT10		29	/* PC rel trunc 10 bit PLT entry */
++#define R_SPARC_10		30	/* Direct 10 bit */
++#define R_SPARC_11		31	/* Direct 11 bit */
++#define R_SPARC_64		32	/* Direct 64 bit */
++#define R_SPARC_OLO10		33	/* 10bit with secondary 13bit addend */
++#define R_SPARC_HH22		34	/* Top 22 bits of direct 64 bit */
++#define R_SPARC_HM10		35	/* High middle 10 bits of ... */
++#define R_SPARC_LM22		36	/* Low middle 22 bits of ... */
++#define R_SPARC_PC_HH22		37	/* Top 22 bits of pc rel 64 bit */
++#define R_SPARC_PC_HM10		38	/* High middle 10 bit of ... */
++#define R_SPARC_PC_LM22		39	/* Low miggle 22 bits of ... */
++#define R_SPARC_WDISP16		40	/* PC relative 16 bit shifted */
++#define R_SPARC_WDISP19		41	/* PC relative 19 bit shifted */
++#define R_SPARC_GLOB_JMP	42	/* was part of v9 ABI but was removed */
++#define R_SPARC_7		43	/* Direct 7 bit */
++#define R_SPARC_5		44	/* Direct 5 bit */
++#define R_SPARC_6		45	/* Direct 6 bit */
++#define R_SPARC_DISP64		46	/* PC relative 64 bit */
++#define R_SPARC_PLT64		47	/* Direct 64 bit ref to PLT entry */
++#define R_SPARC_HIX22		48	/* High 22 bit complemented */
++#define R_SPARC_LOX10		49	/* Truncated 11 bit complemented */
++#define R_SPARC_H44		50	/* Direct high 12 of 44 bit */
++#define R_SPARC_M44		51	/* Direct mid 22 of 44 bit */
++#define R_SPARC_L44		52	/* Direct low 10 of 44 bit */
++#define R_SPARC_REGISTER	53	/* Global register usage */
++#define R_SPARC_UA64		54	/* Direct 64 bit unaligned */
++#define R_SPARC_UA16		55	/* Direct 16 bit unaligned */
++#define R_SPARC_TLS_GD_HI22	56
++#define R_SPARC_TLS_GD_LO10	57
++#define R_SPARC_TLS_GD_ADD	58
++#define R_SPARC_TLS_GD_CALL	59
++#define R_SPARC_TLS_LDM_HI22	60
++#define R_SPARC_TLS_LDM_LO10	61
++#define R_SPARC_TLS_LDM_ADD	62
++#define R_SPARC_TLS_LDM_CALL	63
++#define R_SPARC_TLS_LDO_HIX22	64
++#define R_SPARC_TLS_LDO_LOX10	65
++#define R_SPARC_TLS_LDO_ADD	66
++#define R_SPARC_TLS_IE_HI22	67
++#define R_SPARC_TLS_IE_LO10	68
++#define R_SPARC_TLS_IE_LD	69
++#define R_SPARC_TLS_IE_LDX	70
++#define R_SPARC_TLS_IE_ADD	71
++#define R_SPARC_TLS_LE_HIX22	72
++#define R_SPARC_TLS_LE_LOX10	73
++#define R_SPARC_TLS_DTPMOD32	74
++#define R_SPARC_TLS_DTPMOD64	75
++#define R_SPARC_TLS_DTPOFF32	76
++#define R_SPARC_TLS_DTPOFF64	77
++#define R_SPARC_TLS_TPOFF32	78
++#define R_SPARC_TLS_TPOFF64	79
++#define R_SPARC_GOTDATA_HIX22	80
++#define R_SPARC_GOTDATA_LOX10	81
++#define R_SPARC_GOTDATA_OP_HIX22	82
++#define R_SPARC_GOTDATA_OP_LOX10	83
++#define R_SPARC_GOTDATA_OP	84
++#define R_SPARC_H34		85
++#define R_SPARC_SIZE32		86
++#define R_SPARC_SIZE64		87
++#define R_SPARC_WDISP10		88
++#define R_SPARC_JMP_IREL	248
++#define R_SPARC_IRELATIVE	249
++#define R_SPARC_GNU_VTINHERIT	250
++#define R_SPARC_GNU_VTENTRY	251
++#define R_SPARC_REV32		252
++/* Keep this the last entry.  */
++#define R_SPARC_NUM		253
++
++/* For Sparc64, legal values for d_tag of Elf64_Dyn.  */
++
++#define DT_SPARC_REGISTER 0x70000001
++#define DT_SPARC_NUM	2
++
++/* MIPS R3000 specific definitions.  */
++
++/* Legal values for e_flags field of Elf32_Ehdr.  */
++
++#define EF_MIPS_NOREORDER   1		/* A .noreorder directive was used */
++#define EF_MIPS_PIC	    2		/* Contains PIC code */
++#define EF_MIPS_CPIC	    4		/* Uses PIC calling sequence */
++#define EF_MIPS_XGOT	    8
++#define EF_MIPS_64BIT_WHIRL 16
++#define EF_MIPS_ABI2	    32
++#define EF_MIPS_ABI_ON32    64
++#define EF_MIPS_ARCH	    0xf0000000	/* MIPS architecture level */
++
++/* Legal values for MIPS architecture level.  */
++
++#define EF_MIPS_ARCH_1	    0x00000000	/* -mips1 code.  */
++#define EF_MIPS_ARCH_2	    0x10000000	/* -mips2 code.  */
++#define EF_MIPS_ARCH_3	    0x20000000	/* -mips3 code.  */
++#define EF_MIPS_ARCH_4	    0x30000000	/* -mips4 code.  */
++#define EF_MIPS_ARCH_5	    0x40000000	/* -mips5 code.  */
++#define EF_MIPS_ARCH_32	    0x60000000	/* MIPS32 code.  */
++#define EF_MIPS_ARCH_64	    0x70000000	/* MIPS64 code.  */
++
++/* The following are non-official names and should not be used.  */
++
++#define E_MIPS_ARCH_1	  0x00000000	/* -mips1 code.  */
++#define E_MIPS_ARCH_2	  0x10000000	/* -mips2 code.  */
++#define E_MIPS_ARCH_3	  0x20000000	/* -mips3 code.  */
++#define E_MIPS_ARCH_4	  0x30000000	/* -mips4 code.  */
++#define E_MIPS_ARCH_5	  0x40000000	/* -mips5 code.  */
++#define E_MIPS_ARCH_32	  0x60000000	/* MIPS32 code.  */
++#define E_MIPS_ARCH_64	  0x70000000	/* MIPS64 code.  */
++
++/* Special section indices.  */
++
++#define SHN_MIPS_ACOMMON    0xff00	/* Allocated common symbols */
++#define SHN_MIPS_TEXT	    0xff01	/* Allocated test symbols.  */
++#define SHN_MIPS_DATA	    0xff02	/* Allocated data symbols.  */
++#define SHN_MIPS_SCOMMON    0xff03	/* Small common symbols */
++#define SHN_MIPS_SUNDEFINED 0xff04	/* Small undefined symbols */
++
++/* Legal values for sh_type field of Elf32_Shdr.  */
++
++#define SHT_MIPS_LIBLIST       0x70000000 /* Shared objects used in link */
++#define SHT_MIPS_MSYM	       0x70000001
++#define SHT_MIPS_CONFLICT      0x70000002 /* Conflicting symbols */
++#define SHT_MIPS_GPTAB	       0x70000003 /* Global data area sizes */
++#define SHT_MIPS_UCODE	       0x70000004 /* Reserved for SGI/MIPS compilers */
++#define SHT_MIPS_DEBUG	       0x70000005 /* MIPS ECOFF debugging information*/
++#define SHT_MIPS_REGINFO       0x70000006 /* Register usage information */
++#define SHT_MIPS_PACKAGE       0x70000007
++#define SHT_MIPS_PACKSYM       0x70000008
++#define SHT_MIPS_RELD	       0x70000009
++#define SHT_MIPS_IFACE         0x7000000b
++#define SHT_MIPS_CONTENT       0x7000000c
++#define SHT_MIPS_OPTIONS       0x7000000d /* Miscellaneous options.  */
++#define SHT_MIPS_SHDR	       0x70000010
++#define SHT_MIPS_FDESC	       0x70000011
++#define SHT_MIPS_EXTSYM	       0x70000012
++#define SHT_MIPS_DENSE	       0x70000013
++#define SHT_MIPS_PDESC	       0x70000014
++#define SHT_MIPS_LOCSYM	       0x70000015
++#define SHT_MIPS_AUXSYM	       0x70000016
++#define SHT_MIPS_OPTSYM	       0x70000017
++#define SHT_MIPS_LOCSTR	       0x70000018
++#define SHT_MIPS_LINE	       0x70000019
++#define SHT_MIPS_RFDESC	       0x7000001a
++#define SHT_MIPS_DELTASYM      0x7000001b
++#define SHT_MIPS_DELTAINST     0x7000001c
++#define SHT_MIPS_DELTACLASS    0x7000001d
++#define SHT_MIPS_DWARF         0x7000001e /* DWARF debugging information.  */
++#define SHT_MIPS_DELTADECL     0x7000001f
++#define SHT_MIPS_SYMBOL_LIB    0x70000020
++#define SHT_MIPS_EVENTS	       0x70000021 /* Event section.  */
++#define SHT_MIPS_TRANSLATE     0x70000022
++#define SHT_MIPS_PIXIE	       0x70000023
++#define SHT_MIPS_XLATE	       0x70000024
++#define SHT_MIPS_XLATE_DEBUG   0x70000025
++#define SHT_MIPS_WHIRL	       0x70000026
++#define SHT_MIPS_EH_REGION     0x70000027
++#define SHT_MIPS_XLATE_OLD     0x70000028
++#define SHT_MIPS_PDR_EXCEPTION 0x70000029
++
++/* Legal values for sh_flags field of Elf32_Shdr.  */
++
++#define SHF_MIPS_GPREL	 0x10000000	/* Must be part of global data area */
++#define SHF_MIPS_MERGE	 0x20000000
++#define SHF_MIPS_ADDR	 0x40000000
++#define SHF_MIPS_STRINGS 0x80000000
++#define SHF_MIPS_NOSTRIP 0x08000000
++#define SHF_MIPS_LOCAL	 0x04000000
++#define SHF_MIPS_NAMES	 0x02000000
++#define SHF_MIPS_NODUPE	 0x01000000
++
++
++/* Symbol tables.  */
++
++/* MIPS specific values for `st_other'.  */
++#define STO_MIPS_DEFAULT		0x0
++#define STO_MIPS_INTERNAL		0x1
++#define STO_MIPS_HIDDEN			0x2
++#define STO_MIPS_PROTECTED		0x3
++#define STO_MIPS_PLT			0x8
++#define STO_MIPS_SC_ALIGN_UNUSED	0xff
++
++/* MIPS specific values for `st_info'.  */
++#define STB_MIPS_SPLIT_COMMON		13
++
++/* Entries found in sections of type SHT_MIPS_GPTAB.  */
++
++typedef union
++{
++  struct
++    {
++      Elf32_Word gt_current_g_value;	/* -G value used for compilation */
++      Elf32_Word gt_unused;		/* Not used */
++    } gt_header;			/* First entry in section */
++  struct
++    {
++      Elf32_Word gt_g_value;		/* If this value were used for -G */
++      Elf32_Word gt_bytes;		/* This many bytes would be used */
++    } gt_entry;				/* Subsequent entries in section */
++} Elf32_gptab;
++
++/* Entry found in sections of type SHT_MIPS_REGINFO.  */
++
++typedef struct
++{
++  Elf32_Word	ri_gprmask;		/* General registers used */
++  Elf32_Word	ri_cprmask[4];		/* Coprocessor registers used */
++  Elf32_Sword	ri_gp_value;		/* $gp register value */
++} Elf32_RegInfo;
++
++/* Entries found in sections of type SHT_MIPS_OPTIONS.  */
++
++typedef struct
++{
++  unsigned char kind;		/* Determines interpretation of the
++				   variable part of descriptor.  */
++  unsigned char size;		/* Size of descriptor, including header.  */
++  Elf32_Section section;	/* Section header index of section affected,
++				   0 for global options.  */
++  Elf32_Word info;		/* Kind-specific information.  */
++} Elf_Options;
++
++/* Values for `kind' field in Elf_Options.  */
++
++#define ODK_NULL	0	/* Undefined.  */
++#define ODK_REGINFO	1	/* Register usage information.  */
++#define ODK_EXCEPTIONS	2	/* Exception processing options.  */
++#define ODK_PAD		3	/* Section padding options.  */
++#define ODK_HWPATCH	4	/* Hardware workarounds performed */
++#define ODK_FILL	5	/* record the fill value used by the linker. */
++#define ODK_TAGS	6	/* reserve space for desktop tools to write. */
++#define ODK_HWAND	7	/* HW workarounds.  'AND' bits when merging. */
++#define ODK_HWOR	8	/* HW workarounds.  'OR' bits when merging.  */
++
++/* Values for `info' in Elf_Options for ODK_EXCEPTIONS entries.  */
++
++#define OEX_FPU_MIN	0x1f	/* FPE's which MUST be enabled.  */
++#define OEX_FPU_MAX	0x1f00	/* FPE's which MAY be enabled.  */
++#define OEX_PAGE0	0x10000	/* page zero must be mapped.  */
++#define OEX_SMM		0x20000	/* Force sequential memory mode?  */
++#define OEX_FPDBUG	0x40000	/* Force floating point debug mode?  */
++#define OEX_PRECISEFP	OEX_FPDBUG
++#define OEX_DISMISS	0x80000	/* Dismiss invalid address faults?  */
++
++#define OEX_FPU_INVAL	0x10
++#define OEX_FPU_DIV0	0x08
++#define OEX_FPU_OFLO	0x04
++#define OEX_FPU_UFLO	0x02
++#define OEX_FPU_INEX	0x01
++
++/* Masks for `info' in Elf_Options for an ODK_HWPATCH entry.  */
++
++#define OHW_R4KEOP	0x1	/* R4000 end-of-page patch.  */
++#define OHW_R8KPFETCH	0x2	/* may need R8000 prefetch patch.  */
++#define OHW_R5KEOP	0x4	/* R5000 end-of-page patch.  */
++#define OHW_R5KCVTL	0x8	/* R5000 cvt.[ds].l bug.  clean=1.  */
++
++#define OPAD_PREFIX	0x1
++#define OPAD_POSTFIX	0x2
++#define OPAD_SYMBOL	0x4
++
++/* Entry found in `.options' section.  */
++
++typedef struct
++{
++  Elf32_Word hwp_flags1;	/* Extra flags.  */
++  Elf32_Word hwp_flags2;	/* Extra flags.  */
++} Elf_Options_Hw;
++
++/* Masks for `info' in ElfOptions for ODK_HWAND and ODK_HWOR entries.  */
++
++#define OHWA0_R4KEOP_CHECKED	0x00000001
++#define OHWA1_R4KEOP_CLEAN	0x00000002
++
++/* MIPS relocs.  */
++
++#define R_MIPS_NONE		0	/* No reloc */
++#define R_MIPS_16		1	/* Direct 16 bit */
++#define R_MIPS_32		2	/* Direct 32 bit */
++#define R_MIPS_REL32		3	/* PC relative 32 bit */
++#define R_MIPS_26		4	/* Direct 26 bit shifted */
++#define R_MIPS_HI16		5	/* High 16 bit */
++#define R_MIPS_LO16		6	/* Low 16 bit */
++#define R_MIPS_GPREL16		7	/* GP relative 16 bit */
++#define R_MIPS_LITERAL		8	/* 16 bit literal entry */
++#define R_MIPS_GOT16		9	/* 16 bit GOT entry */
++#define R_MIPS_PC16		10	/* PC relative 16 bit */
++#define R_MIPS_CALL16		11	/* 16 bit GOT entry for function */
++#define R_MIPS_GPREL32		12	/* GP relative 32 bit */
++
++#define R_MIPS_SHIFT5		16
++#define R_MIPS_SHIFT6		17
++#define R_MIPS_64		18
++#define R_MIPS_GOT_DISP		19
++#define R_MIPS_GOT_PAGE		20
++#define R_MIPS_GOT_OFST		21
++#define R_MIPS_GOT_HI16		22
++#define R_MIPS_GOT_LO16		23
++#define R_MIPS_SUB		24
++#define R_MIPS_INSERT_A		25
++#define R_MIPS_INSERT_B		26
++#define R_MIPS_DELETE		27
++#define R_MIPS_HIGHER		28
++#define R_MIPS_HIGHEST		29
++#define R_MIPS_CALL_HI16	30
++#define R_MIPS_CALL_LO16	31
++#define R_MIPS_SCN_DISP		32
++#define R_MIPS_REL16		33
++#define R_MIPS_ADD_IMMEDIATE	34
++#define R_MIPS_PJUMP		35
++#define R_MIPS_RELGOT		36
++#define R_MIPS_JALR		37
++#define R_MIPS_TLS_DTPMOD32	38	/* Module number 32 bit */
++#define R_MIPS_TLS_DTPREL32	39	/* Module-relative offset 32 bit */
++#define R_MIPS_TLS_DTPMOD64	40	/* Module number 64 bit */
++#define R_MIPS_TLS_DTPREL64	41	/* Module-relative offset 64 bit */
++#define R_MIPS_TLS_GD		42	/* 16 bit GOT offset for GD */
++#define R_MIPS_TLS_LDM		43	/* 16 bit GOT offset for LDM */
++#define R_MIPS_TLS_DTPREL_HI16	44	/* Module-relative offset, high 16 bits */
++#define R_MIPS_TLS_DTPREL_LO16	45	/* Module-relative offset, low 16 bits */
++#define R_MIPS_TLS_GOTTPREL	46	/* 16 bit GOT offset for IE */
++#define R_MIPS_TLS_TPREL32	47	/* TP-relative offset, 32 bit */
++#define R_MIPS_TLS_TPREL64	48	/* TP-relative offset, 64 bit */
++#define R_MIPS_TLS_TPREL_HI16	49	/* TP-relative offset, high 16 bits */
++#define R_MIPS_TLS_TPREL_LO16	50	/* TP-relative offset, low 16 bits */
++#define R_MIPS_GLOB_DAT		51
++#define R_MIPS_COPY		126
++#define R_MIPS_JUMP_SLOT        127
++/* Keep this the last entry.  */
++#define R_MIPS_NUM		128
++
++/* Legal values for p_type field of Elf32_Phdr.  */
++
++#define PT_MIPS_REGINFO	0x70000000	/* Register usage information */
++#define PT_MIPS_RTPROC  0x70000001	/* Runtime procedure table. */
++#define PT_MIPS_OPTIONS 0x70000002
++
++/* Special program header types.  */
++
++#define PF_MIPS_LOCAL	0x10000000
++
++/* Legal values for d_tag field of Elf32_Dyn.  */
++
++#define DT_MIPS_RLD_VERSION  0x70000001	/* Runtime linker interface version */
++#define DT_MIPS_TIME_STAMP   0x70000002	/* Timestamp */
++#define DT_MIPS_ICHECKSUM    0x70000003	/* Checksum */
++#define DT_MIPS_IVERSION     0x70000004	/* Version string (string tbl index) */
++#define DT_MIPS_FLAGS	     0x70000005	/* Flags */
++#define DT_MIPS_BASE_ADDRESS 0x70000006	/* Base address */
++#define DT_MIPS_MSYM	     0x70000007
++#define DT_MIPS_CONFLICT     0x70000008	/* Address of CONFLICT section */
++#define DT_MIPS_LIBLIST	     0x70000009	/* Address of LIBLIST section */
++#define DT_MIPS_LOCAL_GOTNO  0x7000000a	/* Number of local GOT entries */
++#define DT_MIPS_CONFLICTNO   0x7000000b	/* Number of CONFLICT entries */
++#define DT_MIPS_LIBLISTNO    0x70000010	/* Number of LIBLIST entries */
++#define DT_MIPS_SYMTABNO     0x70000011	/* Number of DYNSYM entries */
++#define DT_MIPS_UNREFEXTNO   0x70000012	/* First external DYNSYM */
++#define DT_MIPS_GOTSYM	     0x70000013	/* First GOT entry in DYNSYM */
++#define DT_MIPS_HIPAGENO     0x70000014	/* Number of GOT page table entries */
++#define DT_MIPS_RLD_MAP	     0x70000016	/* Address of run time loader map.  */
++#define DT_MIPS_DELTA_CLASS  0x70000017	/* Delta C++ class definition.  */
++#define DT_MIPS_DELTA_CLASS_NO    0x70000018 /* Number of entries in
++						DT_MIPS_DELTA_CLASS.  */
++#define DT_MIPS_DELTA_INSTANCE    0x70000019 /* Delta C++ class instances.  */
++#define DT_MIPS_DELTA_INSTANCE_NO 0x7000001a /* Number of entries in
++						DT_MIPS_DELTA_INSTANCE.  */
++#define DT_MIPS_DELTA_RELOC  0x7000001b /* Delta relocations.  */
++#define DT_MIPS_DELTA_RELOC_NO 0x7000001c /* Number of entries in
++					     DT_MIPS_DELTA_RELOC.  */
++#define DT_MIPS_DELTA_SYM    0x7000001d /* Delta symbols that Delta
++					   relocations refer to.  */
++#define DT_MIPS_DELTA_SYM_NO 0x7000001e /* Number of entries in
++					   DT_MIPS_DELTA_SYM.  */
++#define DT_MIPS_DELTA_CLASSSYM 0x70000020 /* Delta symbols that hold the
++					     class declaration.  */
++#define DT_MIPS_DELTA_CLASSSYM_NO 0x70000021 /* Number of entries in
++						DT_MIPS_DELTA_CLASSSYM.  */
++#define DT_MIPS_CXX_FLAGS    0x70000022 /* Flags indicating for C++ flavor.  */
++#define DT_MIPS_PIXIE_INIT   0x70000023
++#define DT_MIPS_SYMBOL_LIB   0x70000024
++#define DT_MIPS_LOCALPAGE_GOTIDX 0x70000025
++#define DT_MIPS_LOCAL_GOTIDX 0x70000026
++#define DT_MIPS_HIDDEN_GOTIDX 0x70000027
++#define DT_MIPS_PROTECTED_GOTIDX 0x70000028
++#define DT_MIPS_OPTIONS	     0x70000029 /* Address of .options.  */
++#define DT_MIPS_INTERFACE    0x7000002a /* Address of .interface.  */
++#define DT_MIPS_DYNSTR_ALIGN 0x7000002b
++#define DT_MIPS_INTERFACE_SIZE 0x7000002c /* Size of the .interface section. */
++#define DT_MIPS_RLD_TEXT_RESOLVE_ADDR 0x7000002d /* Address of rld_text_rsolve
++						    function stored in GOT.  */
++#define DT_MIPS_PERF_SUFFIX  0x7000002e /* Default suffix of dso to be added
++					   by rld on dlopen() calls.  */
++#define DT_MIPS_COMPACT_SIZE 0x7000002f /* (O32)Size of compact rel section. */
++#define DT_MIPS_GP_VALUE     0x70000030 /* GP value for aux GOTs.  */
++#define DT_MIPS_AUX_DYNAMIC  0x70000031 /* Address of aux .dynamic.  */
++/* The address of .got.plt in an executable using the new non-PIC ABI.  */
++#define DT_MIPS_PLTGOT	     0x70000032
++/* The base of the PLT in an executable using the new non-PIC ABI if that
++   PLT is writable.  For a non-writable PLT, this is omitted or has a zero
++   value.  */
++#define DT_MIPS_RWPLT        0x70000034
++#define DT_MIPS_NUM	     0x35
++
++/* Legal values for DT_MIPS_FLAGS Elf32_Dyn entry.  */
++
++#define RHF_NONE		   0		/* No flags */
++#define RHF_QUICKSTART		   (1 << 0)	/* Use quickstart */
++#define RHF_NOTPOT		   (1 << 1)	/* Hash size not power of 2 */
++#define RHF_NO_LIBRARY_REPLACEMENT (1 << 2)	/* Ignore LD_LIBRARY_PATH */
++#define RHF_NO_MOVE		   (1 << 3)
++#define RHF_SGI_ONLY		   (1 << 4)
++#define RHF_GUARANTEE_INIT	   (1 << 5)
++#define RHF_DELTA_C_PLUS_PLUS	   (1 << 6)
++#define RHF_GUARANTEE_START_INIT   (1 << 7)
++#define RHF_PIXIE		   (1 << 8)
++#define RHF_DEFAULT_DELAY_LOAD	   (1 << 9)
++#define RHF_REQUICKSTART	   (1 << 10)
++#define RHF_REQUICKSTARTED	   (1 << 11)
++#define RHF_CORD		   (1 << 12)
++#define RHF_NO_UNRES_UNDEF	   (1 << 13)
++#define RHF_RLD_ORDER_SAFE	   (1 << 14)
++
++/* Entries found in sections of type SHT_MIPS_LIBLIST.  */
++
++typedef struct
++{
++  Elf32_Word l_name;		/* Name (string table index) */
++  Elf32_Word l_time_stamp;	/* Timestamp */
++  Elf32_Word l_checksum;	/* Checksum */
++  Elf32_Word l_version;		/* Interface version */
++  Elf32_Word l_flags;		/* Flags */
++} Elf32_Lib;
++
++typedef struct
++{
++  Elf64_Word l_name;		/* Name (string table index) */
++  Elf64_Word l_time_stamp;	/* Timestamp */
++  Elf64_Word l_checksum;	/* Checksum */
++  Elf64_Word l_version;		/* Interface version */
++  Elf64_Word l_flags;		/* Flags */
++} Elf64_Lib;
++
++
++/* Legal values for l_flags.  */
++
++#define LL_NONE		  0
++#define LL_EXACT_MATCH	  (1 << 0)	/* Require exact match */
++#define LL_IGNORE_INT_VER (1 << 1)	/* Ignore interface version */
++#define LL_REQUIRE_MINOR  (1 << 2)
++#define LL_EXPORTS	  (1 << 3)
++#define LL_DELAY_LOAD	  (1 << 4)
++#define LL_DELTA	  (1 << 5)
++
++/* Entries found in sections of type SHT_MIPS_CONFLICT.  */
++
++typedef Elf32_Addr Elf32_Conflict;
++
++
++/* HPPA specific definitions.  */
++
++/* Legal values for e_flags field of Elf32_Ehdr.  */
++
++#define EF_PARISC_TRAPNIL	0x00010000 /* Trap nil pointer dereference.  */
++#define EF_PARISC_EXT		0x00020000 /* Program uses arch. extensions. */
++#define EF_PARISC_LSB		0x00040000 /* Program expects little endian. */
++#define EF_PARISC_WIDE		0x00080000 /* Program expects wide mode.  */
++#define EF_PARISC_NO_KABP	0x00100000 /* No kernel assisted branch
++					      prediction.  */
++#define EF_PARISC_LAZYSWAP	0x00400000 /* Allow lazy swapping.  */
++#define EF_PARISC_ARCH		0x0000ffff /* Architecture version.  */
++
++/* Defined values for `e_flags & EF_PARISC_ARCH' are:  */
++
++#define EFA_PARISC_1_0		    0x020b /* PA-RISC 1.0 big-endian.  */
++#define EFA_PARISC_1_1		    0x0210 /* PA-RISC 1.1 big-endian.  */
++#define EFA_PARISC_2_0		    0x0214 /* PA-RISC 2.0 big-endian.  */
++
++/* Additional section indeces.  */
++
++#define SHN_PARISC_ANSI_COMMON	0xff00	   /* Section for tenatively declared
++					      symbols in ANSI C.  */
++#define SHN_PARISC_HUGE_COMMON	0xff01	   /* Common blocks in huge model.  */
++
++/* Legal values for sh_type field of Elf32_Shdr.  */
++
++#define SHT_PARISC_EXT		0x70000000 /* Contains product specific ext. */
++#define SHT_PARISC_UNWIND	0x70000001 /* Unwind information.  */
++#define SHT_PARISC_DOC		0x70000002 /* Debug info for optimized code. */
++
++/* Legal values for sh_flags field of Elf32_Shdr.  */
++
++#define SHF_PARISC_SHORT	0x20000000 /* Section with short addressing. */
++#define SHF_PARISC_HUGE		0x40000000 /* Section far from gp.  */
++#define SHF_PARISC_SBP		0x80000000 /* Static branch prediction code. */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_PARISC_MILLICODE	13	/* Millicode function entry point.  */
++
++#define STT_HP_OPAQUE		(STT_LOOS + 0x1)
++#define STT_HP_STUB		(STT_LOOS + 0x2)
++
++/* HPPA relocs.  */
++
++#define R_PARISC_NONE		0	/* No reloc.  */
++#define R_PARISC_DIR32		1	/* Direct 32-bit reference.  */
++#define R_PARISC_DIR21L		2	/* Left 21 bits of eff. address.  */
++#define R_PARISC_DIR17R		3	/* Right 17 bits of eff. address.  */
++#define R_PARISC_DIR17F		4	/* 17 bits of eff. address.  */
++#define R_PARISC_DIR14R		6	/* Right 14 bits of eff. address.  */
++#define R_PARISC_PCREL32	9	/* 32-bit rel. address.  */
++#define R_PARISC_PCREL21L	10	/* Left 21 bits of rel. address.  */
++#define R_PARISC_PCREL17R	11	/* Right 17 bits of rel. address.  */
++#define R_PARISC_PCREL17F	12	/* 17 bits of rel. address.  */
++#define R_PARISC_PCREL14R	14	/* Right 14 bits of rel. address.  */
++#define R_PARISC_DPREL21L	18	/* Left 21 bits of rel. address.  */
++#define R_PARISC_DPREL14R	22	/* Right 14 bits of rel. address.  */
++#define R_PARISC_GPREL21L	26	/* GP-relative, left 21 bits.  */
++#define R_PARISC_GPREL14R	30	/* GP-relative, right 14 bits.  */
++#define R_PARISC_LTOFF21L	34	/* LT-relative, left 21 bits.  */
++#define R_PARISC_LTOFF14R	38	/* LT-relative, right 14 bits.  */
++#define R_PARISC_SECREL32	41	/* 32 bits section rel. address.  */
++#define R_PARISC_SEGBASE	48	/* No relocation, set segment base.  */
++#define R_PARISC_SEGREL32	49	/* 32 bits segment rel. address.  */
++#define R_PARISC_PLTOFF21L	50	/* PLT rel. address, left 21 bits.  */
++#define R_PARISC_PLTOFF14R	54	/* PLT rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF_FPTR32	57	/* 32 bits LT-rel. function pointer. */
++#define R_PARISC_LTOFF_FPTR21L	58	/* LT-rel. fct ptr, left 21 bits. */
++#define R_PARISC_LTOFF_FPTR14R	62	/* LT-rel. fct ptr, right 14 bits. */
++#define R_PARISC_FPTR64		64	/* 64 bits function address.  */
++#define R_PARISC_PLABEL32	65	/* 32 bits function address.  */
++#define R_PARISC_PLABEL21L	66	/* Left 21 bits of fdesc address.  */
++#define R_PARISC_PLABEL14R	70	/* Right 14 bits of fdesc address.  */
++#define R_PARISC_PCREL64	72	/* 64 bits PC-rel. address.  */
++#define R_PARISC_PCREL22F	74	/* 22 bits PC-rel. address.  */
++#define R_PARISC_PCREL14WR	75	/* PC-rel. address, right 14 bits.  */
++#define R_PARISC_PCREL14DR	76	/* PC rel. address, right 14 bits.  */
++#define R_PARISC_PCREL16F	77	/* 16 bits PC-rel. address.  */
++#define R_PARISC_PCREL16WF	78	/* 16 bits PC-rel. address.  */
++#define R_PARISC_PCREL16DF	79	/* 16 bits PC-rel. address.  */
++#define R_PARISC_DIR64		80	/* 64 bits of eff. address.  */
++#define R_PARISC_DIR14WR	83	/* 14 bits of eff. address.  */
++#define R_PARISC_DIR14DR	84	/* 14 bits of eff. address.  */
++#define R_PARISC_DIR16F		85	/* 16 bits of eff. address.  */
++#define R_PARISC_DIR16WF	86	/* 16 bits of eff. address.  */
++#define R_PARISC_DIR16DF	87	/* 16 bits of eff. address.  */
++#define R_PARISC_GPREL64	88	/* 64 bits of GP-rel. address.  */
++#define R_PARISC_GPREL14WR	91	/* GP-rel. address, right 14 bits.  */
++#define R_PARISC_GPREL14DR	92	/* GP-rel. address, right 14 bits.  */
++#define R_PARISC_GPREL16F	93	/* 16 bits GP-rel. address.  */
++#define R_PARISC_GPREL16WF	94	/* 16 bits GP-rel. address.  */
++#define R_PARISC_GPREL16DF	95	/* 16 bits GP-rel. address.  */
++#define R_PARISC_LTOFF64	96	/* 64 bits LT-rel. address.  */
++#define R_PARISC_LTOFF14WR	99	/* LT-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF14DR	100	/* LT-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF16F	101	/* 16 bits LT-rel. address.  */
++#define R_PARISC_LTOFF16WF	102	/* 16 bits LT-rel. address.  */
++#define R_PARISC_LTOFF16DF	103	/* 16 bits LT-rel. address.  */
++#define R_PARISC_SECREL64	104	/* 64 bits section rel. address.  */
++#define R_PARISC_SEGREL64	112	/* 64 bits segment rel. address.  */
++#define R_PARISC_PLTOFF14WR	115	/* PLT-rel. address, right 14 bits.  */
++#define R_PARISC_PLTOFF14DR	116	/* PLT-rel. address, right 14 bits.  */
++#define R_PARISC_PLTOFF16F	117	/* 16 bits LT-rel. address.  */
++#define R_PARISC_PLTOFF16WF	118	/* 16 bits PLT-rel. address.  */
++#define R_PARISC_PLTOFF16DF	119	/* 16 bits PLT-rel. address.  */
++#define R_PARISC_LTOFF_FPTR64	120	/* 64 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR14WR	123	/* LT-rel. fct. ptr., right 14 bits. */
++#define R_PARISC_LTOFF_FPTR14DR	124	/* LT-rel. fct. ptr., right 14 bits. */
++#define R_PARISC_LTOFF_FPTR16F	125	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR16WF	126	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR16DF	127	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LORESERVE	128
++#define R_PARISC_COPY		128	/* Copy relocation.  */
++#define R_PARISC_IPLT		129	/* Dynamic reloc, imported PLT */
++#define R_PARISC_EPLT		130	/* Dynamic reloc, exported PLT */
++#define R_PARISC_TPREL32	153	/* 32 bits TP-rel. address.  */
++#define R_PARISC_TPREL21L	154	/* TP-rel. address, left 21 bits.  */
++#define R_PARISC_TPREL14R	158	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF_TP21L	162	/* LT-TP-rel. address, left 21 bits. */
++#define R_PARISC_LTOFF_TP14R	166	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP14F	167	/* 14 bits LT-TP-rel. address.  */
++#define R_PARISC_TPREL64	216	/* 64 bits TP-rel. address.  */
++#define R_PARISC_TPREL14WR	219	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_TPREL14DR	220	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_TPREL16F	221	/* 16 bits TP-rel. address.  */
++#define R_PARISC_TPREL16WF	222	/* 16 bits TP-rel. address.  */
++#define R_PARISC_TPREL16DF	223	/* 16 bits TP-rel. address.  */
++#define R_PARISC_LTOFF_TP64	224	/* 64 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP14WR	227	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP14DR	228	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP16F	229	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP16WF	230	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP16DF	231	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_GNU_VTENTRY	232
++#define R_PARISC_GNU_VTINHERIT	233
++#define R_PARISC_TLS_GD21L	234	/* GD 21-bit left.  */
++#define R_PARISC_TLS_GD14R	235	/* GD 14-bit right.  */
++#define R_PARISC_TLS_GDCALL	236	/* GD call to __t_g_a.  */
++#define R_PARISC_TLS_LDM21L	237	/* LD module 21-bit left.  */
++#define R_PARISC_TLS_LDM14R	238	/* LD module 14-bit right.  */
++#define R_PARISC_TLS_LDMCALL	239	/* LD module call to __t_g_a.  */
++#define R_PARISC_TLS_LDO21L	240	/* LD offset 21-bit left.  */
++#define R_PARISC_TLS_LDO14R	241	/* LD offset 14-bit right.  */
++#define R_PARISC_TLS_DTPMOD32	242	/* DTP module 32-bit.  */
++#define R_PARISC_TLS_DTPMOD64	243	/* DTP module 64-bit.  */
++#define R_PARISC_TLS_DTPOFF32	244	/* DTP offset 32-bit.  */
++#define R_PARISC_TLS_DTPOFF64	245	/* DTP offset 32-bit.  */
++#define R_PARISC_TLS_LE21L	R_PARISC_TPREL21L
++#define R_PARISC_TLS_LE14R	R_PARISC_TPREL14R
++#define R_PARISC_TLS_IE21L	R_PARISC_LTOFF_TP21L
++#define R_PARISC_TLS_IE14R	R_PARISC_LTOFF_TP14R
++#define R_PARISC_TLS_TPREL32	R_PARISC_TPREL32
++#define R_PARISC_TLS_TPREL64	R_PARISC_TPREL64
++#define R_PARISC_HIRESERVE	255
++
++/* Legal values for p_type field of Elf32_Phdr/Elf64_Phdr.  */
++
++#define PT_HP_TLS		(PT_LOOS + 0x0)
++#define PT_HP_CORE_NONE		(PT_LOOS + 0x1)
++#define PT_HP_CORE_VERSION	(PT_LOOS + 0x2)
++#define PT_HP_CORE_KERNEL	(PT_LOOS + 0x3)
++#define PT_HP_CORE_COMM		(PT_LOOS + 0x4)
++#define PT_HP_CORE_PROC		(PT_LOOS + 0x5)
++#define PT_HP_CORE_LOADABLE	(PT_LOOS + 0x6)
++#define PT_HP_CORE_STACK	(PT_LOOS + 0x7)
++#define PT_HP_CORE_SHM		(PT_LOOS + 0x8)
++#define PT_HP_CORE_MMF		(PT_LOOS + 0x9)
++#define PT_HP_PARALLEL		(PT_LOOS + 0x10)
++#define PT_HP_FASTBIND		(PT_LOOS + 0x11)
++#define PT_HP_OPT_ANNOT		(PT_LOOS + 0x12)
++#define PT_HP_HSL_ANNOT		(PT_LOOS + 0x13)
++#define PT_HP_STACK		(PT_LOOS + 0x14)
++
++#define PT_PARISC_ARCHEXT	0x70000000
++#define PT_PARISC_UNWIND	0x70000001
++
++/* Legal values for p_flags field of Elf32_Phdr/Elf64_Phdr.  */
++
++#define PF_PARISC_SBP		0x08000000
++
++#define PF_HP_PAGE_SIZE		0x00100000
++#define PF_HP_FAR_SHARED	0x00200000
++#define PF_HP_NEAR_SHARED	0x00400000
++#define PF_HP_CODE		0x01000000
++#define PF_HP_MODIFY		0x02000000
++#define PF_HP_LAZYSWAP		0x04000000
++#define PF_HP_SBP		0x08000000
++
++
++/* Alpha specific definitions.  */
++
++/* Legal values for e_flags field of Elf64_Ehdr.  */
++
++#define EF_ALPHA_32BIT		1	/* All addresses must be < 2GB.  */
++#define EF_ALPHA_CANRELAX	2	/* Relocations for relaxing exist.  */
++
++/* Legal values for sh_type field of Elf64_Shdr.  */
++
++/* These two are primerily concerned with ECOFF debugging info.  */
++#define SHT_ALPHA_DEBUG		0x70000001
++#define SHT_ALPHA_REGINFO	0x70000002
++
++/* Legal values for sh_flags field of Elf64_Shdr.  */
++
++#define SHF_ALPHA_GPREL		0x10000000
++
++/* Legal values for st_other field of Elf64_Sym.  */
++#define STO_ALPHA_NOPV		0x80	/* No PV required.  */
++#define STO_ALPHA_STD_GPLOAD	0x88	/* PV only used for initial ldgp.  */
++
++/* Alpha relocs.  */
++
++#define R_ALPHA_NONE		0	/* No reloc */
++#define R_ALPHA_REFLONG		1	/* Direct 32 bit */
++#define R_ALPHA_REFQUAD		2	/* Direct 64 bit */
++#define R_ALPHA_GPREL32		3	/* GP relative 32 bit */
++#define R_ALPHA_LITERAL		4	/* GP relative 16 bit w/optimization */
++#define R_ALPHA_LITUSE		5	/* Optimization hint for LITERAL */
++#define R_ALPHA_GPDISP		6	/* Add displacement to GP */
++#define R_ALPHA_BRADDR		7	/* PC+4 relative 23 bit shifted */
++#define R_ALPHA_HINT		8	/* PC+4 relative 16 bit shifted */
++#define R_ALPHA_SREL16		9	/* PC relative 16 bit */
++#define R_ALPHA_SREL32		10	/* PC relative 32 bit */
++#define R_ALPHA_SREL64		11	/* PC relative 64 bit */
++#define R_ALPHA_GPRELHIGH	17	/* GP relative 32 bit, high 16 bits */
++#define R_ALPHA_GPRELLOW	18	/* GP relative 32 bit, low 16 bits */
++#define R_ALPHA_GPREL16		19	/* GP relative 16 bit */
++#define R_ALPHA_COPY		24	/* Copy symbol at runtime */
++#define R_ALPHA_GLOB_DAT	25	/* Create GOT entry */
++#define R_ALPHA_JMP_SLOT	26	/* Create PLT entry */
++#define R_ALPHA_RELATIVE	27	/* Adjust by program base */
++#define R_ALPHA_TLS_GD_HI	28
++#define R_ALPHA_TLSGD		29
++#define R_ALPHA_TLS_LDM		30
++#define R_ALPHA_DTPMOD64	31
++#define R_ALPHA_GOTDTPREL	32
++#define R_ALPHA_DTPREL64	33
++#define R_ALPHA_DTPRELHI	34
++#define R_ALPHA_DTPRELLO	35
++#define R_ALPHA_DTPREL16	36
++#define R_ALPHA_GOTTPREL	37
++#define R_ALPHA_TPREL64		38
++#define R_ALPHA_TPRELHI		39
++#define R_ALPHA_TPRELLO		40
++#define R_ALPHA_TPREL16		41
++/* Keep this the last entry.  */
++#define R_ALPHA_NUM		46
++
++/* Magic values of the LITUSE relocation addend.  */
++#define LITUSE_ALPHA_ADDR	0
++#define LITUSE_ALPHA_BASE	1
++#define LITUSE_ALPHA_BYTOFF	2
++#define LITUSE_ALPHA_JSR	3
++#define LITUSE_ALPHA_TLS_GD	4
++#define LITUSE_ALPHA_TLS_LDM	5
++
++/* Legal values for d_tag of Elf64_Dyn.  */
++#define DT_ALPHA_PLTRO		(DT_LOPROC + 0)
++#define DT_ALPHA_NUM		1
++
++/* PowerPC specific declarations */
++
++/* Values for Elf32/64_Ehdr.e_flags.  */
++#define EF_PPC_EMB		0x80000000	/* PowerPC embedded flag */
++
++/* Cygnus local bits below */
++#define EF_PPC_RELOCATABLE	0x00010000	/* PowerPC -mrelocatable flag*/
++#define EF_PPC_RELOCATABLE_LIB	0x00008000	/* PowerPC -mrelocatable-lib
++						   flag */
++
++/* PowerPC relocations defined by the ABIs */
++#define R_PPC_NONE		0
++#define R_PPC_ADDR32		1	/* 32bit absolute address */
++#define R_PPC_ADDR24		2	/* 26bit address, 2 bits ignored.  */
++#define R_PPC_ADDR16		3	/* 16bit absolute address */
++#define R_PPC_ADDR16_LO		4	/* lower 16bit of absolute address */
++#define R_PPC_ADDR16_HI		5	/* high 16bit of absolute address */
++#define R_PPC_ADDR16_HA		6	/* adjusted high 16bit */
++#define R_PPC_ADDR14		7	/* 16bit address, 2 bits ignored */
++#define R_PPC_ADDR14_BRTAKEN	8
++#define R_PPC_ADDR14_BRNTAKEN	9
++#define R_PPC_REL24		10	/* PC relative 26 bit */
++#define R_PPC_REL14		11	/* PC relative 16 bit */
++#define R_PPC_REL14_BRTAKEN	12
++#define R_PPC_REL14_BRNTAKEN	13
++#define R_PPC_GOT16		14
++#define R_PPC_GOT16_LO		15
++#define R_PPC_GOT16_HI		16
++#define R_PPC_GOT16_HA		17
++#define R_PPC_PLTREL24		18
++#define R_PPC_COPY		19
++#define R_PPC_GLOB_DAT		20
++#define R_PPC_JMP_SLOT		21
++#define R_PPC_RELATIVE		22
++#define R_PPC_LOCAL24PC		23
++#define R_PPC_UADDR32		24
++#define R_PPC_UADDR16		25
++#define R_PPC_REL32		26
++#define R_PPC_PLT32		27
++#define R_PPC_PLTREL32		28
++#define R_PPC_PLT16_LO		29
++#define R_PPC_PLT16_HI		30
++#define R_PPC_PLT16_HA		31
++#define R_PPC_SDAREL16		32
++#define R_PPC_SECTOFF		33
++#define R_PPC_SECTOFF_LO	34
++#define R_PPC_SECTOFF_HI	35
++#define R_PPC_SECTOFF_HA	36
++
++/* PowerPC relocations defined for the TLS access ABI.  */
++#define R_PPC_TLS		67 /* none	(sym+add)@tls */
++#define R_PPC_DTPMOD32		68 /* word32	(sym+add)@dtpmod */
++#define R_PPC_TPREL16		69 /* half16*	(sym+add)@tprel */
++#define R_PPC_TPREL16_LO	70 /* half16	(sym+add)@tprel@l */
++#define R_PPC_TPREL16_HI	71 /* half16	(sym+add)@tprel@h */
++#define R_PPC_TPREL16_HA	72 /* half16	(sym+add)@tprel@ha */
++#define R_PPC_TPREL32		73 /* word32	(sym+add)@tprel */
++#define R_PPC_DTPREL16		74 /* half16*	(sym+add)@dtprel */
++#define R_PPC_DTPREL16_LO	75 /* half16	(sym+add)@dtprel@l */
++#define R_PPC_DTPREL16_HI	76 /* half16	(sym+add)@dtprel@h */
++#define R_PPC_DTPREL16_HA	77 /* half16	(sym+add)@dtprel@ha */
++#define R_PPC_DTPREL32		78 /* word32	(sym+add)@dtprel */
++#define R_PPC_GOT_TLSGD16	79 /* half16*	(sym+add)@got@tlsgd */
++#define R_PPC_GOT_TLSGD16_LO	80 /* half16	(sym+add)@got@tlsgd@l */
++#define R_PPC_GOT_TLSGD16_HI	81 /* half16	(sym+add)@got@tlsgd@h */
++#define R_PPC_GOT_TLSGD16_HA	82 /* half16	(sym+add)@got@tlsgd@ha */
++#define R_PPC_GOT_TLSLD16	83 /* half16*	(sym+add)@got@tlsld */
++#define R_PPC_GOT_TLSLD16_LO	84 /* half16	(sym+add)@got@tlsld@l */
++#define R_PPC_GOT_TLSLD16_HI	85 /* half16	(sym+add)@got@tlsld@h */
++#define R_PPC_GOT_TLSLD16_HA	86 /* half16	(sym+add)@got@tlsld@ha */
++#define R_PPC_GOT_TPREL16	87 /* half16*	(sym+add)@got@tprel */
++#define R_PPC_GOT_TPREL16_LO	88 /* half16	(sym+add)@got@tprel@l */
++#define R_PPC_GOT_TPREL16_HI	89 /* half16	(sym+add)@got@tprel@h */
++#define R_PPC_GOT_TPREL16_HA	90 /* half16	(sym+add)@got@tprel@ha */
++#define R_PPC_GOT_DTPREL16	91 /* half16*	(sym+add)@got@dtprel */
++#define R_PPC_GOT_DTPREL16_LO	92 /* half16*	(sym+add)@got@dtprel@l */
++#define R_PPC_GOT_DTPREL16_HI	93 /* half16*	(sym+add)@got@dtprel@h */
++#define R_PPC_GOT_DTPREL16_HA	94 /* half16*	(sym+add)@got@dtprel@ha */
++
++/* The remaining relocs are from the Embedded ELF ABI, and are not
++   in the SVR4 ELF ABI.  */
++#define R_PPC_EMB_NADDR32	101
++#define R_PPC_EMB_NADDR16	102
++#define R_PPC_EMB_NADDR16_LO	103
++#define R_PPC_EMB_NADDR16_HI	104
++#define R_PPC_EMB_NADDR16_HA	105
++#define R_PPC_EMB_SDAI16	106
++#define R_PPC_EMB_SDA2I16	107
++#define R_PPC_EMB_SDA2REL	108
++#define R_PPC_EMB_SDA21		109	/* 16 bit offset in SDA */
++#define R_PPC_EMB_MRKREF	110
++#define R_PPC_EMB_RELSEC16	111
++#define R_PPC_EMB_RELST_LO	112
++#define R_PPC_EMB_RELST_HI	113
++#define R_PPC_EMB_RELST_HA	114
++#define R_PPC_EMB_BIT_FLD	115
++#define R_PPC_EMB_RELSDA	116	/* 16 bit relative offset in SDA */
++
++/* Diab tool relocations.  */
++#define R_PPC_DIAB_SDA21_LO	180	/* like EMB_SDA21, but lower 16 bit */
++#define R_PPC_DIAB_SDA21_HI	181	/* like EMB_SDA21, but high 16 bit */
++#define R_PPC_DIAB_SDA21_HA	182	/* like EMB_SDA21, adjusted high 16 */
++#define R_PPC_DIAB_RELSDA_LO	183	/* like EMB_RELSDA, but lower 16 bit */
++#define R_PPC_DIAB_RELSDA_HI	184	/* like EMB_RELSDA, but high 16 bit */
++#define R_PPC_DIAB_RELSDA_HA	185	/* like EMB_RELSDA, adjusted high 16 */
++
++/* GNU extension to support local ifunc.  */
++#define R_PPC_IRELATIVE		248
++
++/* GNU relocs used in PIC code sequences.  */
++#define R_PPC_REL16		249	/* half16   (sym+add-.) */
++#define R_PPC_REL16_LO		250	/* half16   (sym+add-.)@l */
++#define R_PPC_REL16_HI		251	/* half16   (sym+add-.)@h */
++#define R_PPC_REL16_HA		252	/* half16   (sym+add-.)@ha */
++
++/* This is a phony reloc to handle any old fashioned TOC16 references
++   that may still be in object files.  */
++#define R_PPC_TOC16		255
++
++/* PowerPC specific values for the Dyn d_tag field.  */
++#define DT_PPC_GOT		(DT_LOPROC + 0)
++#define DT_PPC_NUM		1
++
++/* PowerPC64 relocations defined by the ABIs */
++#define R_PPC64_NONE		R_PPC_NONE
++#define R_PPC64_ADDR32		R_PPC_ADDR32 /* 32bit absolute address */
++#define R_PPC64_ADDR24		R_PPC_ADDR24 /* 26bit address, word aligned */
++#define R_PPC64_ADDR16		R_PPC_ADDR16 /* 16bit absolute address */
++#define R_PPC64_ADDR16_LO	R_PPC_ADDR16_LO	/* lower 16bits of address */
++#define R_PPC64_ADDR16_HI	R_PPC_ADDR16_HI	/* high 16bits of address. */
++#define R_PPC64_ADDR16_HA	R_PPC_ADDR16_HA /* adjusted high 16bits.  */
++#define R_PPC64_ADDR14		R_PPC_ADDR14 /* 16bit address, word aligned */
++#define R_PPC64_ADDR14_BRTAKEN	R_PPC_ADDR14_BRTAKEN
++#define R_PPC64_ADDR14_BRNTAKEN	R_PPC_ADDR14_BRNTAKEN
++#define R_PPC64_REL24		R_PPC_REL24 /* PC-rel. 26 bit, word aligned */
++#define R_PPC64_REL14		R_PPC_REL14 /* PC relative 16 bit */
++#define R_PPC64_REL14_BRTAKEN	R_PPC_REL14_BRTAKEN
++#define R_PPC64_REL14_BRNTAKEN	R_PPC_REL14_BRNTAKEN
++#define R_PPC64_GOT16		R_PPC_GOT16
++#define R_PPC64_GOT16_LO	R_PPC_GOT16_LO
++#define R_PPC64_GOT16_HI	R_PPC_GOT16_HI
++#define R_PPC64_GOT16_HA	R_PPC_GOT16_HA
++
++#define R_PPC64_COPY		R_PPC_COPY
++#define R_PPC64_GLOB_DAT	R_PPC_GLOB_DAT
++#define R_PPC64_JMP_SLOT	R_PPC_JMP_SLOT
++#define R_PPC64_RELATIVE	R_PPC_RELATIVE
++
++#define R_PPC64_UADDR32		R_PPC_UADDR32
++#define R_PPC64_UADDR16		R_PPC_UADDR16
++#define R_PPC64_REL32		R_PPC_REL32
++#define R_PPC64_PLT32		R_PPC_PLT32
++#define R_PPC64_PLTREL32	R_PPC_PLTREL32
++#define R_PPC64_PLT16_LO	R_PPC_PLT16_LO
++#define R_PPC64_PLT16_HI	R_PPC_PLT16_HI
++#define R_PPC64_PLT16_HA	R_PPC_PLT16_HA
++
++#define R_PPC64_SECTOFF		R_PPC_SECTOFF
++#define R_PPC64_SECTOFF_LO	R_PPC_SECTOFF_LO
++#define R_PPC64_SECTOFF_HI	R_PPC_SECTOFF_HI
++#define R_PPC64_SECTOFF_HA	R_PPC_SECTOFF_HA
++#define R_PPC64_ADDR30		37 /* word30 (S + A - P) >> 2 */
++#define R_PPC64_ADDR64		38 /* doubleword64 S + A */
++#define R_PPC64_ADDR16_HIGHER	39 /* half16 #higher(S + A) */
++#define R_PPC64_ADDR16_HIGHERA	40 /* half16 #highera(S + A) */
++#define R_PPC64_ADDR16_HIGHEST	41 /* half16 #highest(S + A) */
++#define R_PPC64_ADDR16_HIGHESTA	42 /* half16 #highesta(S + A) */
++#define R_PPC64_UADDR64		43 /* doubleword64 S + A */
++#define R_PPC64_REL64		44 /* doubleword64 S + A - P */
++#define R_PPC64_PLT64		45 /* doubleword64 L + A */
++#define R_PPC64_PLTREL64	46 /* doubleword64 L + A - P */
++#define R_PPC64_TOC16		47 /* half16* S + A - .TOC */
++#define R_PPC64_TOC16_LO	48 /* half16 #lo(S + A - .TOC.) */
++#define R_PPC64_TOC16_HI	49 /* half16 #hi(S + A - .TOC.) */
++#define R_PPC64_TOC16_HA	50 /* half16 #ha(S + A - .TOC.) */
++#define R_PPC64_TOC		51 /* doubleword64 .TOC */
++#define R_PPC64_PLTGOT16	52 /* half16* M + A */
++#define R_PPC64_PLTGOT16_LO	53 /* half16 #lo(M + A) */
++#define R_PPC64_PLTGOT16_HI	54 /* half16 #hi(M + A) */
++#define R_PPC64_PLTGOT16_HA	55 /* half16 #ha(M + A) */
++
++#define R_PPC64_ADDR16_DS	56 /* half16ds* (S + A) >> 2 */
++#define R_PPC64_ADDR16_LO_DS	57 /* half16ds  #lo(S + A) >> 2 */
++#define R_PPC64_GOT16_DS	58 /* half16ds* (G + A) >> 2 */
++#define R_PPC64_GOT16_LO_DS	59 /* half16ds  #lo(G + A) >> 2 */
++#define R_PPC64_PLT16_LO_DS	60 /* half16ds  #lo(L + A) >> 2 */
++#define R_PPC64_SECTOFF_DS	61 /* half16ds* (R + A) >> 2 */
++#define R_PPC64_SECTOFF_LO_DS	62 /* half16ds  #lo(R + A) >> 2 */
++#define R_PPC64_TOC16_DS	63 /* half16ds* (S + A - .TOC.) >> 2 */
++#define R_PPC64_TOC16_LO_DS	64 /* half16ds  #lo(S + A - .TOC.) >> 2 */
++#define R_PPC64_PLTGOT16_DS	65 /* half16ds* (M + A) >> 2 */
++#define R_PPC64_PLTGOT16_LO_DS	66 /* half16ds  #lo(M + A) >> 2 */
++
++/* PowerPC64 relocations defined for the TLS access ABI.  */
++#define R_PPC64_TLS		67 /* none	(sym+add)@tls */
++#define R_PPC64_DTPMOD64	68 /* doubleword64 (sym+add)@dtpmod */
++#define R_PPC64_TPREL16		69 /* half16*	(sym+add)@tprel */
++#define R_PPC64_TPREL16_LO	70 /* half16	(sym+add)@tprel@l */
++#define R_PPC64_TPREL16_HI	71 /* half16	(sym+add)@tprel@h */
++#define R_PPC64_TPREL16_HA	72 /* half16	(sym+add)@tprel@ha */
++#define R_PPC64_TPREL64		73 /* doubleword64 (sym+add)@tprel */
++#define R_PPC64_DTPREL16	74 /* half16*	(sym+add)@dtprel */
++#define R_PPC64_DTPREL16_LO	75 /* half16	(sym+add)@dtprel@l */
++#define R_PPC64_DTPREL16_HI	76 /* half16	(sym+add)@dtprel@h */
++#define R_PPC64_DTPREL16_HA	77 /* half16	(sym+add)@dtprel@ha */
++#define R_PPC64_DTPREL64	78 /* doubleword64 (sym+add)@dtprel */
++#define R_PPC64_GOT_TLSGD16	79 /* half16*	(sym+add)@got@tlsgd */
++#define R_PPC64_GOT_TLSGD16_LO	80 /* half16	(sym+add)@got@tlsgd@l */
++#define R_PPC64_GOT_TLSGD16_HI	81 /* half16	(sym+add)@got@tlsgd@h */
++#define R_PPC64_GOT_TLSGD16_HA	82 /* half16	(sym+add)@got@tlsgd@ha */
++#define R_PPC64_GOT_TLSLD16	83 /* half16*	(sym+add)@got@tlsld */
++#define R_PPC64_GOT_TLSLD16_LO	84 /* half16	(sym+add)@got@tlsld@l */
++#define R_PPC64_GOT_TLSLD16_HI	85 /* half16	(sym+add)@got@tlsld@h */
++#define R_PPC64_GOT_TLSLD16_HA	86 /* half16	(sym+add)@got@tlsld@ha */
++#define R_PPC64_GOT_TPREL16_DS	87 /* half16ds*	(sym+add)@got@tprel */
++#define R_PPC64_GOT_TPREL16_LO_DS 88 /* half16ds (sym+add)@got@tprel@l */
++#define R_PPC64_GOT_TPREL16_HI	89 /* half16	(sym+add)@got@tprel@h */
++#define R_PPC64_GOT_TPREL16_HA	90 /* half16	(sym+add)@got@tprel@ha */
++#define R_PPC64_GOT_DTPREL16_DS	91 /* half16ds*	(sym+add)@got@dtprel */
++#define R_PPC64_GOT_DTPREL16_LO_DS 92 /* half16ds (sym+add)@got@dtprel@l */
++#define R_PPC64_GOT_DTPREL16_HI	93 /* half16	(sym+add)@got@dtprel@h */
++#define R_PPC64_GOT_DTPREL16_HA	94 /* half16	(sym+add)@got@dtprel@ha */
++#define R_PPC64_TPREL16_DS	95 /* half16ds*	(sym+add)@tprel */
++#define R_PPC64_TPREL16_LO_DS	96 /* half16ds	(sym+add)@tprel@l */
++#define R_PPC64_TPREL16_HIGHER	97 /* half16	(sym+add)@tprel@higher */
++#define R_PPC64_TPREL16_HIGHERA	98 /* half16	(sym+add)@tprel@highera */
++#define R_PPC64_TPREL16_HIGHEST	99 /* half16	(sym+add)@tprel@highest */
++#define R_PPC64_TPREL16_HIGHESTA 100 /* half16	(sym+add)@tprel@highesta */
++#define R_PPC64_DTPREL16_DS	101 /* half16ds* (sym+add)@dtprel */
++#define R_PPC64_DTPREL16_LO_DS	102 /* half16ds	(sym+add)@dtprel@l */
++#define R_PPC64_DTPREL16_HIGHER	103 /* half16	(sym+add)@dtprel@higher */
++#define R_PPC64_DTPREL16_HIGHERA 104 /* half16	(sym+add)@dtprel@highera */
++#define R_PPC64_DTPREL16_HIGHEST 105 /* half16	(sym+add)@dtprel@highest */
++#define R_PPC64_DTPREL16_HIGHESTA 106 /* half16	(sym+add)@dtprel@highesta */
++
++/* GNU extension to support local ifunc.  */
++#define R_PPC64_JMP_IREL	247
++#define R_PPC64_IRELATIVE	248
++#define R_PPC64_REL16		249	/* half16   (sym+add-.) */
++#define R_PPC64_REL16_LO	250	/* half16   (sym+add-.)@l */
++#define R_PPC64_REL16_HI	251	/* half16   (sym+add-.)@h */
++#define R_PPC64_REL16_HA	252	/* half16   (sym+add-.)@ha */
++
++/* PowerPC64 specific values for the Dyn d_tag field.  */
++#define DT_PPC64_GLINK  (DT_LOPROC + 0)
++#define DT_PPC64_OPD	(DT_LOPROC + 1)
++#define DT_PPC64_OPDSZ	(DT_LOPROC + 2)
++#define DT_PPC64_NUM    3
++
++
++/* ARM specific declarations */
++
++/* Processor specific flags for the ELF header e_flags field.  */
++#define EF_ARM_RELEXEC		0x01
++#define EF_ARM_HASENTRY		0x02
++#define EF_ARM_INTERWORK	0x04
++#define EF_ARM_APCS_26		0x08
++#define EF_ARM_APCS_FLOAT	0x10
++#define EF_ARM_PIC		0x20
++#define EF_ARM_ALIGN8		0x40 /* 8-bit structure alignment is in use */
++#define EF_ARM_NEW_ABI		0x80
++#define EF_ARM_OLD_ABI		0x100
++#define EF_ARM_SOFT_FLOAT	0x200
++#define EF_ARM_VFP_FLOAT	0x400
++#define EF_ARM_MAVERICK_FLOAT	0x800
++
++
++/* Other constants defined in the ARM ELF spec. version B-01.  */
++/* NB. These conflict with values defined above.  */
++#define EF_ARM_SYMSARESORTED	0x04
++#define EF_ARM_DYNSYMSUSESEGIDX	0x08
++#define EF_ARM_MAPSYMSFIRST	0x10
++#define EF_ARM_EABIMASK		0XFF000000
++
++/* Constants defined in AAELF.  */
++#define EF_ARM_BE8	    0x00800000
++#define EF_ARM_LE8	    0x00400000
++
++#define EF_ARM_EABI_VERSION(flags)	((flags) & EF_ARM_EABIMASK)
++#define EF_ARM_EABI_UNKNOWN	0x00000000
++#define EF_ARM_EABI_VER1	0x01000000
++#define EF_ARM_EABI_VER2	0x02000000
++#define EF_ARM_EABI_VER3	0x03000000
++#define EF_ARM_EABI_VER4	0x04000000
++#define EF_ARM_EABI_VER5	0x05000000
++
++/* Additional symbol types for Thumb.  */
++#define STT_ARM_TFUNC		STT_LOPROC /* A Thumb function.  */
++#define STT_ARM_16BIT		STT_HIPROC /* A Thumb label.  */
++
++/* ARM-specific values for sh_flags */
++#define SHF_ARM_ENTRYSECT	0x10000000 /* Section contains an entry point */
++#define SHF_ARM_COMDEF		0x80000000 /* Section may be multiply defined
++					      in the input to a link step.  */
++
++/* ARM-specific program header flags */
++#define PF_ARM_SB		0x10000000 /* Segment contains the location
++					      addressed by the static base. */
++#define PF_ARM_PI		0x20000000 /* Position-independent segment.  */
++#define PF_ARM_ABS		0x40000000 /* Absolute segment.  */
++
++/* Processor specific values for the Phdr p_type field.  */
++#define PT_ARM_EXIDX		(PT_LOPROC + 1)	/* ARM unwind segment.  */
++
++/* Processor specific values for the Shdr sh_type field.  */
++#define SHT_ARM_EXIDX		(SHT_LOPROC + 1) /* ARM unwind section.  */
++#define SHT_ARM_PREEMPTMAP	(SHT_LOPROC + 2) /* Preemption details.  */
++#define SHT_ARM_ATTRIBUTES	(SHT_LOPROC + 3) /* ARM attributes section.  */
++
++
++/* ARM relocs.  */
++
++#define R_ARM_NONE		0	/* No reloc */
++#define R_ARM_PC24		1	/* PC relative 26 bit branch */
++#define R_ARM_ABS32		2	/* Direct 32 bit  */
++#define R_ARM_REL32		3	/* PC relative 32 bit */
++#define R_ARM_PC13		4
++#define R_ARM_ABS16		5	/* Direct 16 bit */
++#define R_ARM_ABS12		6	/* Direct 12 bit */
++#define R_ARM_THM_ABS5		7
++#define R_ARM_ABS8		8	/* Direct 8 bit */
++#define R_ARM_SBREL32		9
++#define R_ARM_THM_PC22		10
++#define R_ARM_THM_PC8		11
++#define R_ARM_AMP_VCALL9	12
++#define R_ARM_SWI24		13	/* Obsolete static relocation.  */
++#define R_ARM_TLS_DESC		13      /* Dynamic relocation.  */
++#define R_ARM_THM_SWI8		14
++#define R_ARM_XPC25		15
++#define R_ARM_THM_XPC22		16
++#define R_ARM_TLS_DTPMOD32	17	/* ID of module containing symbol */
++#define R_ARM_TLS_DTPOFF32	18	/* Offset in TLS block */
++#define R_ARM_TLS_TPOFF32	19	/* Offset in static TLS block */
++#define R_ARM_COPY		20	/* Copy symbol at runtime */
++#define R_ARM_GLOB_DAT		21	/* Create GOT entry */
++#define R_ARM_JUMP_SLOT		22	/* Create PLT entry */
++#define R_ARM_RELATIVE		23	/* Adjust by program base */
++#define R_ARM_GOTOFF		24	/* 32 bit offset to GOT */
++#define R_ARM_GOTPC		25	/* 32 bit PC relative offset to GOT */
++#define R_ARM_GOT32		26	/* 32 bit GOT entry */
++#define R_ARM_PLT32		27	/* 32 bit PLT address */
++#define R_ARM_ALU_PCREL_7_0	32
++#define R_ARM_ALU_PCREL_15_8	33
++#define R_ARM_ALU_PCREL_23_15	34
++#define R_ARM_LDR_SBREL_11_0	35
++#define R_ARM_ALU_SBREL_19_12	36
++#define R_ARM_ALU_SBREL_27_20	37
++#define R_ARM_TLS_GOTDESC	90
++#define R_ARM_TLS_CALL		91
++#define R_ARM_TLS_DESCSEQ	92
++#define R_ARM_THM_TLS_CALL	93
++#define R_ARM_GNU_VTENTRY	100
++#define R_ARM_GNU_VTINHERIT	101
++#define R_ARM_THM_PC11		102	/* thumb unconditional branch */
++#define R_ARM_THM_PC9		103	/* thumb conditional branch */
++#define R_ARM_TLS_GD32		104	/* PC-rel 32 bit for global dynamic
++					   thread local data */
++#define R_ARM_TLS_LDM32		105	/* PC-rel 32 bit for local dynamic
++					   thread local data */
++#define R_ARM_TLS_LDO32		106	/* 32 bit offset relative to TLS
++					   block */
++#define R_ARM_TLS_IE32		107	/* PC-rel 32 bit for GOT entry of
++					   static TLS block offset */
++#define R_ARM_TLS_LE32		108	/* 32 bit offset relative to static
++					   TLS block */
++#define	R_ARM_THM_TLS_DESCSEQ	129
++#define R_ARM_IRELATIVE		160
++#define R_ARM_RXPC25		249
++#define R_ARM_RSBREL32		250
++#define R_ARM_THM_RPC22		251
++#define R_ARM_RREL32		252
++#define R_ARM_RABS22		253
++#define R_ARM_RPC24		254
++#define R_ARM_RBASE		255
++/* Keep this the last entry.  */
++#define R_ARM_NUM		256
++
++/* IA-64 specific declarations.  */
++
++/* Processor specific flags for the Ehdr e_flags field.  */
++#define EF_IA_64_MASKOS		0x0000000f	/* os-specific flags */
++#define EF_IA_64_ABI64		0x00000010	/* 64-bit ABI */
++#define EF_IA_64_ARCH		0xff000000	/* arch. version mask */
++
++/* Processor specific values for the Phdr p_type field.  */
++#define PT_IA_64_ARCHEXT	(PT_LOPROC + 0)	/* arch extension bits */
++#define PT_IA_64_UNWIND		(PT_LOPROC + 1)	/* ia64 unwind bits */
++#define PT_IA_64_HP_OPT_ANOT	(PT_LOOS + 0x12)
++#define PT_IA_64_HP_HSL_ANOT	(PT_LOOS + 0x13)
++#define PT_IA_64_HP_STACK	(PT_LOOS + 0x14)
++
++/* Processor specific flags for the Phdr p_flags field.  */
++#define PF_IA_64_NORECOV	0x80000000	/* spec insns w/o recovery */
++
++/* Processor specific values for the Shdr sh_type field.  */
++#define SHT_IA_64_EXT		(SHT_LOPROC + 0) /* extension bits */
++#define SHT_IA_64_UNWIND	(SHT_LOPROC + 1) /* unwind bits */
++
++/* Processor specific flags for the Shdr sh_flags field.  */
++#define SHF_IA_64_SHORT		0x10000000	/* section near gp */
++#define SHF_IA_64_NORECOV	0x20000000	/* spec insns w/o recovery */
++
++/* Processor specific values for the Dyn d_tag field.  */
++#define DT_IA_64_PLT_RESERVE	(DT_LOPROC + 0)
++#define DT_IA_64_NUM		1
++
++/* IA-64 relocations.  */
++#define R_IA64_NONE		0x00	/* none */
++#define R_IA64_IMM14		0x21	/* symbol + addend, add imm14 */
++#define R_IA64_IMM22		0x22	/* symbol + addend, add imm22 */
++#define R_IA64_IMM64		0x23	/* symbol + addend, mov imm64 */
++#define R_IA64_DIR32MSB		0x24	/* symbol + addend, data4 MSB */
++#define R_IA64_DIR32LSB		0x25	/* symbol + addend, data4 LSB */
++#define R_IA64_DIR64MSB		0x26	/* symbol + addend, data8 MSB */
++#define R_IA64_DIR64LSB		0x27	/* symbol + addend, data8 LSB */
++#define R_IA64_GPREL22		0x2a	/* @gprel(sym + add), add imm22 */
++#define R_IA64_GPREL64I		0x2b	/* @gprel(sym + add), mov imm64 */
++#define R_IA64_GPREL32MSB	0x2c	/* @gprel(sym + add), data4 MSB */
++#define R_IA64_GPREL32LSB	0x2d	/* @gprel(sym + add), data4 LSB */
++#define R_IA64_GPREL64MSB	0x2e	/* @gprel(sym + add), data8 MSB */
++#define R_IA64_GPREL64LSB	0x2f	/* @gprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF22		0x32	/* @ltoff(sym + add), add imm22 */
++#define R_IA64_LTOFF64I		0x33	/* @ltoff(sym + add), mov imm64 */
++#define R_IA64_PLTOFF22		0x3a	/* @pltoff(sym + add), add imm22 */
++#define R_IA64_PLTOFF64I	0x3b	/* @pltoff(sym + add), mov imm64 */
++#define R_IA64_PLTOFF64MSB	0x3e	/* @pltoff(sym + add), data8 MSB */
++#define R_IA64_PLTOFF64LSB	0x3f	/* @pltoff(sym + add), data8 LSB */
++#define R_IA64_FPTR64I		0x43	/* @fptr(sym + add), mov imm64 */
++#define R_IA64_FPTR32MSB	0x44	/* @fptr(sym + add), data4 MSB */
++#define R_IA64_FPTR32LSB	0x45	/* @fptr(sym + add), data4 LSB */
++#define R_IA64_FPTR64MSB	0x46	/* @fptr(sym + add), data8 MSB */
++#define R_IA64_FPTR64LSB	0x47	/* @fptr(sym + add), data8 LSB */
++#define R_IA64_PCREL60B		0x48	/* @pcrel(sym + add), brl */
++#define R_IA64_PCREL21B		0x49	/* @pcrel(sym + add), ptb, call */
++#define R_IA64_PCREL21M		0x4a	/* @pcrel(sym + add), chk.s */
++#define R_IA64_PCREL21F		0x4b	/* @pcrel(sym + add), fchkf */
++#define R_IA64_PCREL32MSB	0x4c	/* @pcrel(sym + add), data4 MSB */
++#define R_IA64_PCREL32LSB	0x4d	/* @pcrel(sym + add), data4 LSB */
++#define R_IA64_PCREL64MSB	0x4e	/* @pcrel(sym + add), data8 MSB */
++#define R_IA64_PCREL64LSB	0x4f	/* @pcrel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_FPTR22	0x52	/* @ltoff(@fptr(s+a)), imm22 */
++#define R_IA64_LTOFF_FPTR64I	0x53	/* @ltoff(@fptr(s+a)), imm64 */
++#define R_IA64_LTOFF_FPTR32MSB	0x54	/* @ltoff(@fptr(s+a)), data4 MSB */
++#define R_IA64_LTOFF_FPTR32LSB	0x55	/* @ltoff(@fptr(s+a)), data4 LSB */
++#define R_IA64_LTOFF_FPTR64MSB	0x56	/* @ltoff(@fptr(s+a)), data8 MSB */
++#define R_IA64_LTOFF_FPTR64LSB	0x57	/* @ltoff(@fptr(s+a)), data8 LSB */
++#define R_IA64_SEGREL32MSB	0x5c	/* @segrel(sym + add), data4 MSB */
++#define R_IA64_SEGREL32LSB	0x5d	/* @segrel(sym + add), data4 LSB */
++#define R_IA64_SEGREL64MSB	0x5e	/* @segrel(sym + add), data8 MSB */
++#define R_IA64_SEGREL64LSB	0x5f	/* @segrel(sym + add), data8 LSB */
++#define R_IA64_SECREL32MSB	0x64	/* @secrel(sym + add), data4 MSB */
++#define R_IA64_SECREL32LSB	0x65	/* @secrel(sym + add), data4 LSB */
++#define R_IA64_SECREL64MSB	0x66	/* @secrel(sym + add), data8 MSB */
++#define R_IA64_SECREL64LSB	0x67	/* @secrel(sym + add), data8 LSB */
++#define R_IA64_REL32MSB		0x6c	/* data 4 + REL */
++#define R_IA64_REL32LSB		0x6d	/* data 4 + REL */
++#define R_IA64_REL64MSB		0x6e	/* data 8 + REL */
++#define R_IA64_REL64LSB		0x6f	/* data 8 + REL */
++#define R_IA64_LTV32MSB		0x74	/* symbol + addend, data4 MSB */
++#define R_IA64_LTV32LSB		0x75	/* symbol + addend, data4 LSB */
++#define R_IA64_LTV64MSB		0x76	/* symbol + addend, data8 MSB */
++#define R_IA64_LTV64LSB		0x77	/* symbol + addend, data8 LSB */
++#define R_IA64_PCREL21BI	0x79	/* @pcrel(sym + add), 21bit inst */
++#define R_IA64_PCREL22		0x7a	/* @pcrel(sym + add), 22bit inst */
++#define R_IA64_PCREL64I		0x7b	/* @pcrel(sym + add), 64bit inst */
++#define R_IA64_IPLTMSB		0x80	/* dynamic reloc, imported PLT, MSB */
++#define R_IA64_IPLTLSB		0x81	/* dynamic reloc, imported PLT, LSB */
++#define R_IA64_COPY		0x84	/* copy relocation */
++#define R_IA64_SUB		0x85	/* Addend and symbol difference */
++#define R_IA64_LTOFF22X		0x86	/* LTOFF22, relaxable.  */
++#define R_IA64_LDXMOV		0x87	/* Use of LTOFF22X.  */
++#define R_IA64_TPREL14		0x91	/* @tprel(sym + add), imm14 */
++#define R_IA64_TPREL22		0x92	/* @tprel(sym + add), imm22 */
++#define R_IA64_TPREL64I		0x93	/* @tprel(sym + add), imm64 */
++#define R_IA64_TPREL64MSB	0x96	/* @tprel(sym + add), data8 MSB */
++#define R_IA64_TPREL64LSB	0x97	/* @tprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_TPREL22	0x9a	/* @ltoff(@tprel(s+a)), imm2 */
++#define R_IA64_DTPMOD64MSB	0xa6	/* @dtpmod(sym + add), data8 MSB */
++#define R_IA64_DTPMOD64LSB	0xa7	/* @dtpmod(sym + add), data8 LSB */
++#define R_IA64_LTOFF_DTPMOD22	0xaa	/* @ltoff(@dtpmod(sym + add)), imm22 */
++#define R_IA64_DTPREL14		0xb1	/* @dtprel(sym + add), imm14 */
++#define R_IA64_DTPREL22		0xb2	/* @dtprel(sym + add), imm22 */
++#define R_IA64_DTPREL64I	0xb3	/* @dtprel(sym + add), imm64 */
++#define R_IA64_DTPREL32MSB	0xb4	/* @dtprel(sym + add), data4 MSB */
++#define R_IA64_DTPREL32LSB	0xb5	/* @dtprel(sym + add), data4 LSB */
++#define R_IA64_DTPREL64MSB	0xb6	/* @dtprel(sym + add), data8 MSB */
++#define R_IA64_DTPREL64LSB	0xb7	/* @dtprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_DTPREL22	0xba	/* @ltoff(@dtprel(s+a)), imm22 */
++
++/* SH specific declarations */
++
++/* Processor specific flags for the ELF header e_flags field.  */
++#define EF_SH_MACH_MASK		0x1f
++#define EF_SH_UNKNOWN		0x0
++#define EF_SH1			0x1
++#define EF_SH2			0x2
++#define EF_SH3			0x3
++#define EF_SH_DSP		0x4
++#define EF_SH3_DSP		0x5
++#define EF_SH4AL_DSP		0x6
++#define EF_SH3E			0x8
++#define EF_SH4			0x9
++#define EF_SH2E			0xb
++#define EF_SH4A			0xc
++#define EF_SH2A			0xd
++#define EF_SH4_NOFPU		0x10
++#define EF_SH4A_NOFPU		0x11
++#define EF_SH4_NOMMU_NOFPU	0x12
++#define EF_SH2A_NOFPU		0x13
++#define EF_SH3_NOMMU		0x14
++#define EF_SH2A_SH4_NOFPU	0x15
++#define EF_SH2A_SH3_NOFPU	0x16
++#define EF_SH2A_SH4		0x17
++#define EF_SH2A_SH3E		0x18
++
++/* SH relocs.  */
++#define	R_SH_NONE		0
++#define	R_SH_DIR32		1
++#define	R_SH_REL32		2
++#define	R_SH_DIR8WPN		3
++#define	R_SH_IND12W		4
++#define	R_SH_DIR8WPL		5
++#define	R_SH_DIR8WPZ		6
++#define	R_SH_DIR8BP		7
++#define	R_SH_DIR8W		8
++#define	R_SH_DIR8L		9
++#define	R_SH_SWITCH16		25
++#define	R_SH_SWITCH32		26
++#define	R_SH_USES		27
++#define	R_SH_COUNT		28
++#define	R_SH_ALIGN		29
++#define	R_SH_CODE		30
++#define	R_SH_DATA		31
++#define	R_SH_LABEL		32
++#define	R_SH_SWITCH8		33
++#define	R_SH_GNU_VTINHERIT	34
++#define	R_SH_GNU_VTENTRY	35
++#define	R_SH_TLS_GD_32		144
++#define	R_SH_TLS_LD_32		145
++#define	R_SH_TLS_LDO_32		146
++#define	R_SH_TLS_IE_32		147
++#define	R_SH_TLS_LE_32		148
++#define	R_SH_TLS_DTPMOD32	149
++#define	R_SH_TLS_DTPOFF32	150
++#define	R_SH_TLS_TPOFF32	151
++#define	R_SH_GOT32		160
++#define	R_SH_PLT32		161
++#define	R_SH_COPY		162
++#define	R_SH_GLOB_DAT		163
++#define	R_SH_JMP_SLOT		164
++#define	R_SH_RELATIVE		165
++#define	R_SH_GOTOFF		166
++#define	R_SH_GOTPC		167
++/* Keep this the last entry.  */
++#define	R_SH_NUM		256
++
++/* S/390 specific definitions.  */
++
++/* Valid values for the e_flags field.  */
++
++#define EF_S390_HIGH_GPRS    0x00000001  /* High GPRs kernel facility needed.  */
++
++/* Additional s390 relocs */
++
++#define R_390_NONE		0	/* No reloc.  */
++#define R_390_8			1	/* Direct 8 bit.  */
++#define R_390_12		2	/* Direct 12 bit.  */
++#define R_390_16		3	/* Direct 16 bit.  */
++#define R_390_32		4	/* Direct 32 bit.  */
++#define R_390_PC32		5	/* PC relative 32 bit.	*/
++#define R_390_GOT12		6	/* 12 bit GOT offset.  */
++#define R_390_GOT32		7	/* 32 bit GOT offset.  */
++#define R_390_PLT32		8	/* 32 bit PC relative PLT address.  */
++#define R_390_COPY		9	/* Copy symbol at runtime.  */
++#define R_390_GLOB_DAT		10	/* Create GOT entry.  */
++#define R_390_JMP_SLOT		11	/* Create PLT entry.  */
++#define R_390_RELATIVE		12	/* Adjust by program base.  */
++#define R_390_GOTOFF32		13	/* 32 bit offset to GOT.	 */
++#define R_390_GOTPC		14	/* 32 bit PC relative offset to GOT.  */
++#define R_390_GOT16		15	/* 16 bit GOT offset.  */
++#define R_390_PC16		16	/* PC relative 16 bit.	*/
++#define R_390_PC16DBL		17	/* PC relative 16 bit shifted by 1.  */
++#define R_390_PLT16DBL		18	/* 16 bit PC rel. PLT shifted by 1.  */
++#define R_390_PC32DBL		19	/* PC relative 32 bit shifted by 1.  */
++#define R_390_PLT32DBL		20	/* 32 bit PC rel. PLT shifted by 1.  */
++#define R_390_GOTPCDBL		21	/* 32 bit PC rel. GOT shifted by 1.  */
++#define R_390_64		22	/* Direct 64 bit.  */
++#define R_390_PC64		23	/* PC relative 64 bit.	*/
++#define R_390_GOT64		24	/* 64 bit GOT offset.  */
++#define R_390_PLT64		25	/* 64 bit PC relative PLT address.  */
++#define R_390_GOTENT		26	/* 32 bit PC rel. to GOT entry >> 1. */
++#define R_390_GOTOFF16		27	/* 16 bit offset to GOT. */
++#define R_390_GOTOFF64		28	/* 64 bit offset to GOT. */
++#define R_390_GOTPLT12		29	/* 12 bit offset to jump slot.	*/
++#define R_390_GOTPLT16		30	/* 16 bit offset to jump slot.	*/
++#define R_390_GOTPLT32		31	/* 32 bit offset to jump slot.	*/
++#define R_390_GOTPLT64		32	/* 64 bit offset to jump slot.	*/
++#define R_390_GOTPLTENT		33	/* 32 bit rel. offset to jump slot.  */
++#define R_390_PLTOFF16		34	/* 16 bit offset from GOT to PLT. */
++#define R_390_PLTOFF32		35	/* 32 bit offset from GOT to PLT. */
++#define R_390_PLTOFF64		36	/* 16 bit offset from GOT to PLT. */
++#define R_390_TLS_LOAD		37	/* Tag for load insn in TLS code.  */
++#define R_390_TLS_GDCALL	38	/* Tag for function call in general
++					   dynamic TLS code. */
++#define R_390_TLS_LDCALL	39	/* Tag for function call in local
++					   dynamic TLS code. */
++#define R_390_TLS_GD32		40	/* Direct 32 bit for general dynamic
++					   thread local data.  */
++#define R_390_TLS_GD64		41	/* Direct 64 bit for general dynamic
++					  thread local data.  */
++#define R_390_TLS_GOTIE12	42	/* 12 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_TLS_GOTIE32	43	/* 32 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_TLS_GOTIE64	44	/* 64 bit GOT offset for static TLS
++					   block offset. */
++#define R_390_TLS_LDM32		45	/* Direct 32 bit for local dynamic
++					   thread local data in LE code.  */
++#define R_390_TLS_LDM64		46	/* Direct 64 bit for local dynamic
++					   thread local data in LE code.  */
++#define R_390_TLS_IE32		47	/* 32 bit address of GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_IE64		48	/* 64 bit address of GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_IEENT		49	/* 32 bit rel. offset to GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_LE32		50	/* 32 bit negated offset relative to
++					   static TLS block.  */
++#define R_390_TLS_LE64		51	/* 64 bit negated offset relative to
++					   static TLS block.  */
++#define R_390_TLS_LDO32		52	/* 32 bit offset relative to TLS
++					   block.  */
++#define R_390_TLS_LDO64		53	/* 64 bit offset relative to TLS
++					   block.  */
++#define R_390_TLS_DTPMOD	54	/* ID of module containing symbol.  */
++#define R_390_TLS_DTPOFF	55	/* Offset in TLS block.	 */
++#define R_390_TLS_TPOFF		56	/* Negated offset in static TLS
++					   block.  */
++#define R_390_20		57	/* Direct 20 bit.  */
++#define R_390_GOT20		58	/* 20 bit GOT offset.  */
++#define R_390_GOTPLT20		59	/* 20 bit offset to jump slot.  */
++#define R_390_TLS_GOTIE20	60	/* 20 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_IRELATIVE         61      /* STT_GNU_IFUNC relocation.  */
++/* Keep this the last entry.  */
++#define R_390_NUM		62
++
++
++/* CRIS relocations.  */
++#define R_CRIS_NONE		0
++#define R_CRIS_8		1
++#define R_CRIS_16		2
++#define R_CRIS_32		3
++#define R_CRIS_8_PCREL		4
++#define R_CRIS_16_PCREL		5
++#define R_CRIS_32_PCREL		6
++#define R_CRIS_GNU_VTINHERIT	7
++#define R_CRIS_GNU_VTENTRY	8
++#define R_CRIS_COPY		9
++#define R_CRIS_GLOB_DAT		10
++#define R_CRIS_JUMP_SLOT	11
++#define R_CRIS_RELATIVE		12
++#define R_CRIS_16_GOT		13
++#define R_CRIS_32_GOT		14
++#define R_CRIS_16_GOTPLT	15
++#define R_CRIS_32_GOTPLT	16
++#define R_CRIS_32_GOTREL	17
++#define R_CRIS_32_PLT_GOTREL	18
++#define R_CRIS_32_PLT_PCREL	19
++
++#define R_CRIS_NUM		20
++
++
++/* AMD x86-64 relocations.  */
++#define R_X86_64_NONE		0	/* No reloc */
++#define R_X86_64_64		1	/* Direct 64 bit  */
++#define R_X86_64_PC32		2	/* PC relative 32 bit signed */
++#define R_X86_64_GOT32		3	/* 32 bit GOT entry */
++#define R_X86_64_PLT32		4	/* 32 bit PLT address */
++#define R_X86_64_COPY		5	/* Copy symbol at runtime */
++#define R_X86_64_GLOB_DAT	6	/* Create GOT entry */
++#define R_X86_64_JUMP_SLOT	7	/* Create PLT entry */
++#define R_X86_64_RELATIVE	8	/* Adjust by program base */
++#define R_X86_64_GOTPCREL	9	/* 32 bit signed PC relative
++					   offset to GOT */
++#define R_X86_64_32		10	/* Direct 32 bit zero extended */
++#define R_X86_64_32S		11	/* Direct 32 bit sign extended */
++#define R_X86_64_16		12	/* Direct 16 bit zero extended */
++#define R_X86_64_PC16		13	/* 16 bit sign extended pc relative */
++#define R_X86_64_8		14	/* Direct 8 bit sign extended  */
++#define R_X86_64_PC8		15	/* 8 bit sign extended pc relative */
++#define R_X86_64_DTPMOD64	16	/* ID of module containing symbol */
++#define R_X86_64_DTPOFF64	17	/* Offset in module's TLS block */
++#define R_X86_64_TPOFF64	18	/* Offset in initial TLS block */
++#define R_X86_64_TLSGD		19	/* 32 bit signed PC relative offset
++					   to two GOT entries for GD symbol */
++#define R_X86_64_TLSLD		20	/* 32 bit signed PC relative offset
++					   to two GOT entries for LD symbol */
++#define R_X86_64_DTPOFF32	21	/* Offset in TLS block */
++#define R_X86_64_GOTTPOFF	22	/* 32 bit signed PC relative offset
++					   to GOT entry for IE symbol */
++#define R_X86_64_TPOFF32	23	/* Offset in initial TLS block */
++#define R_X86_64_PC64		24	/* PC relative 64 bit */
++#define R_X86_64_GOTOFF64	25	/* 64 bit offset to GOT */
++#define R_X86_64_GOTPC32	26	/* 32 bit signed pc relative
++					   offset to GOT */
++#define R_X86_64_GOT64		27	/* 64-bit GOT entry offset */
++#define R_X86_64_GOTPCREL64	28	/* 64-bit PC relative offset
++					   to GOT entry */
++#define R_X86_64_GOTPC64	29	/* 64-bit PC relative offset to GOT */
++#define R_X86_64_GOTPLT64	30 	/* like GOT64, says PLT entry needed */
++#define R_X86_64_PLTOFF64	31	/* 64-bit GOT relative offset
++					   to PLT entry */
++#define R_X86_64_SIZE32		32	/* Size of symbol plus 32-bit addend */
++#define R_X86_64_SIZE64		33	/* Size of symbol plus 64-bit addend */
++#define R_X86_64_GOTPC32_TLSDESC 34	/* GOT offset for TLS descriptor.  */
++#define R_X86_64_TLSDESC_CALL   35	/* Marker for call through TLS
++					   descriptor.  */
++#define R_X86_64_TLSDESC        36	/* TLS descriptor.  */
++#define R_X86_64_IRELATIVE	37	/* Adjust indirectly by program base */
++#define R_X86_64_RELATIVE64	38	/* 64-bit adjust by program base */
++
++#define R_X86_64_NUM		39
++
++
++/* AM33 relocations.  */
++#define R_MN10300_NONE		0	/* No reloc.  */
++#define R_MN10300_32		1	/* Direct 32 bit.  */
++#define R_MN10300_16		2	/* Direct 16 bit.  */
++#define R_MN10300_8		3	/* Direct 8 bit.  */
++#define R_MN10300_PCREL32	4	/* PC-relative 32-bit.  */
++#define R_MN10300_PCREL16	5	/* PC-relative 16-bit signed.  */
++#define R_MN10300_PCREL8	6	/* PC-relative 8-bit signed.  */
++#define R_MN10300_GNU_VTINHERIT	7	/* Ancient C++ vtable garbage... */
++#define R_MN10300_GNU_VTENTRY	8	/* ... collection annotation.  */
++#define R_MN10300_24		9	/* Direct 24 bit.  */
++#define R_MN10300_GOTPC32	10	/* 32-bit PCrel offset to GOT.  */
++#define R_MN10300_GOTPC16	11	/* 16-bit PCrel offset to GOT.  */
++#define R_MN10300_GOTOFF32	12	/* 32-bit offset from GOT.  */
++#define R_MN10300_GOTOFF24	13	/* 24-bit offset from GOT.  */
++#define R_MN10300_GOTOFF16	14	/* 16-bit offset from GOT.  */
++#define R_MN10300_PLT32		15	/* 32-bit PCrel to PLT entry.  */
++#define R_MN10300_PLT16		16	/* 16-bit PCrel to PLT entry.  */
++#define R_MN10300_GOT32		17	/* 32-bit offset to GOT entry.  */
++#define R_MN10300_GOT24		18	/* 24-bit offset to GOT entry.  */
++#define R_MN10300_GOT16		19	/* 16-bit offset to GOT entry.  */
++#define R_MN10300_COPY		20	/* Copy symbol at runtime.  */
++#define R_MN10300_GLOB_DAT	21	/* Create GOT entry.  */
++#define R_MN10300_JMP_SLOT	22	/* Create PLT entry.  */
++#define R_MN10300_RELATIVE	23	/* Adjust by program base.  */
++
++#define R_MN10300_NUM		24
++
++
++/* M32R relocs.  */
++#define R_M32R_NONE		0	/* No reloc. */
++#define R_M32R_16		1	/* Direct 16 bit. */
++#define R_M32R_32		2	/* Direct 32 bit. */
++#define R_M32R_24		3	/* Direct 24 bit. */
++#define R_M32R_10_PCREL		4	/* PC relative 10 bit shifted. */
++#define R_M32R_18_PCREL		5	/* PC relative 18 bit shifted. */
++#define R_M32R_26_PCREL		6	/* PC relative 26 bit shifted. */
++#define R_M32R_HI16_ULO		7	/* High 16 bit with unsigned low. */
++#define R_M32R_HI16_SLO		8	/* High 16 bit with signed low. */
++#define R_M32R_LO16		9	/* Low 16 bit. */
++#define R_M32R_SDA16		10	/* 16 bit offset in SDA. */
++#define R_M32R_GNU_VTINHERIT	11
++#define R_M32R_GNU_VTENTRY	12
++/* M32R relocs use SHT_RELA.  */
++#define R_M32R_16_RELA		33	/* Direct 16 bit. */
++#define R_M32R_32_RELA		34	/* Direct 32 bit. */
++#define R_M32R_24_RELA		35	/* Direct 24 bit. */
++#define R_M32R_10_PCREL_RELA	36	/* PC relative 10 bit shifted. */
++#define R_M32R_18_PCREL_RELA	37	/* PC relative 18 bit shifted. */
++#define R_M32R_26_PCREL_RELA	38	/* PC relative 26 bit shifted. */
++#define R_M32R_HI16_ULO_RELA	39	/* High 16 bit with unsigned low */
++#define R_M32R_HI16_SLO_RELA	40	/* High 16 bit with signed low */
++#define R_M32R_LO16_RELA	41	/* Low 16 bit */
++#define R_M32R_SDA16_RELA	42	/* 16 bit offset in SDA */
++#define R_M32R_RELA_GNU_VTINHERIT	43
++#define R_M32R_RELA_GNU_VTENTRY	44
++#define R_M32R_REL32		45	/* PC relative 32 bit.  */
++
++#define R_M32R_GOT24		48	/* 24 bit GOT entry */
++#define R_M32R_26_PLTREL	49	/* 26 bit PC relative to PLT shifted */
++#define R_M32R_COPY		50	/* Copy symbol at runtime */
++#define R_M32R_GLOB_DAT		51	/* Create GOT entry */
++#define R_M32R_JMP_SLOT		52	/* Create PLT entry */
++#define R_M32R_RELATIVE		53	/* Adjust by program base */
++#define R_M32R_GOTOFF		54	/* 24 bit offset to GOT */
++#define R_M32R_GOTPC24		55	/* 24 bit PC relative offset to GOT */
++#define R_M32R_GOT16_HI_ULO	56	/* High 16 bit GOT entry with unsigned
++					   low */
++#define R_M32R_GOT16_HI_SLO	57	/* High 16 bit GOT entry with signed
++					   low */
++#define R_M32R_GOT16_LO		58	/* Low 16 bit GOT entry */
++#define R_M32R_GOTPC_HI_ULO	59	/* High 16 bit PC relative offset to
++					   GOT with unsigned low */
++#define R_M32R_GOTPC_HI_SLO	60	/* High 16 bit PC relative offset to
++					   GOT with signed low */
++#define R_M32R_GOTPC_LO		61	/* Low 16 bit PC relative offset to
++					   GOT */
++#define R_M32R_GOTOFF_HI_ULO	62	/* High 16 bit offset to GOT
++					   with unsigned low */
++#define R_M32R_GOTOFF_HI_SLO	63	/* High 16 bit offset to GOT
++					   with signed low */
++#define R_M32R_GOTOFF_LO	64	/* Low 16 bit offset to GOT */
++#define R_M32R_NUM		256	/* Keep this the last entry. */
++
++
++/* TILEPro relocations.  */
++#define R_TILEPRO_NONE		0	/* No reloc */
++#define R_TILEPRO_32		1	/* Direct 32 bit */
++#define R_TILEPRO_16		2	/* Direct 16 bit */
++#define R_TILEPRO_8		3	/* Direct 8 bit */
++#define R_TILEPRO_32_PCREL	4	/* PC relative 32 bit */
++#define R_TILEPRO_16_PCREL	5	/* PC relative 16 bit */
++#define R_TILEPRO_8_PCREL	6	/* PC relative 8 bit */
++#define R_TILEPRO_LO16		7	/* Low 16 bit */
++#define R_TILEPRO_HI16		8	/* High 16 bit */
++#define R_TILEPRO_HA16		9	/* High 16 bit, adjusted */
++#define R_TILEPRO_COPY		10	/* Copy relocation */
++#define R_TILEPRO_GLOB_DAT	11	/* Create GOT entry */
++#define R_TILEPRO_JMP_SLOT	12	/* Create PLT entry */
++#define R_TILEPRO_RELATIVE	13	/* Adjust by program base */
++#define R_TILEPRO_BROFF_X1	14	/* X1 pipe branch offset */
++#define R_TILEPRO_JOFFLONG_X1	15	/* X1 pipe jump offset */
++#define R_TILEPRO_JOFFLONG_X1_PLT 16	/* X1 pipe jump offset to PLT */
++#define R_TILEPRO_IMM8_X0	17	/* X0 pipe 8-bit */
++#define R_TILEPRO_IMM8_Y0	18	/* Y0 pipe 8-bit */
++#define R_TILEPRO_IMM8_X1	19	/* X1 pipe 8-bit */
++#define R_TILEPRO_IMM8_Y1	20	/* Y1 pipe 8-bit */
++#define R_TILEPRO_MT_IMM15_X1	21	/* X1 pipe mtspr */
++#define R_TILEPRO_MF_IMM15_X1	22	/* X1 pipe mfspr */
++#define R_TILEPRO_IMM16_X0	23	/* X0 pipe 16-bit */
++#define R_TILEPRO_IMM16_X1	24	/* X1 pipe 16-bit */
++#define R_TILEPRO_IMM16_X0_LO	25	/* X0 pipe low 16-bit */
++#define R_TILEPRO_IMM16_X1_LO	26	/* X1 pipe low 16-bit */
++#define R_TILEPRO_IMM16_X0_HI	27	/* X0 pipe high 16-bit */
++#define R_TILEPRO_IMM16_X1_HI	28	/* X1 pipe high 16-bit */
++#define R_TILEPRO_IMM16_X0_HA	29	/* X0 pipe high 16-bit, adjusted */
++#define R_TILEPRO_IMM16_X1_HA	30	/* X1 pipe high 16-bit, adjusted */
++#define R_TILEPRO_IMM16_X0_PCREL 31	/* X0 pipe PC relative 16 bit */
++#define R_TILEPRO_IMM16_X1_PCREL 32	/* X1 pipe PC relative 16 bit */
++#define R_TILEPRO_IMM16_X0_LO_PCREL 33	/* X0 pipe PC relative low 16 bit */
++#define R_TILEPRO_IMM16_X1_LO_PCREL 34	/* X1 pipe PC relative low 16 bit */
++#define R_TILEPRO_IMM16_X0_HI_PCREL 35	/* X0 pipe PC relative high 16 bit */
++#define R_TILEPRO_IMM16_X1_HI_PCREL 36	/* X1 pipe PC relative high 16 bit */
++#define R_TILEPRO_IMM16_X0_HA_PCREL 37	/* X0 pipe PC relative ha() 16 bit */
++#define R_TILEPRO_IMM16_X1_HA_PCREL 38	/* X1 pipe PC relative ha() 16 bit */
++#define R_TILEPRO_IMM16_X0_GOT	39	/* X0 pipe 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT	40	/* X1 pipe 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_LO 41	/* X0 pipe low 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_LO 42	/* X1 pipe low 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_HI 43	/* X0 pipe high 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_HI 44	/* X1 pipe high 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_HA 45	/* X0 pipe ha() 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_HA 46	/* X1 pipe ha() 16-bit GOT offset */
++#define R_TILEPRO_MMSTART_X0	47	/* X0 pipe mm "start" */
++#define R_TILEPRO_MMEND_X0	48	/* X0 pipe mm "end" */
++#define R_TILEPRO_MMSTART_X1	49	/* X1 pipe mm "start" */
++#define R_TILEPRO_MMEND_X1	50	/* X1 pipe mm "end" */
++#define R_TILEPRO_SHAMT_X0	51	/* X0 pipe shift amount */
++#define R_TILEPRO_SHAMT_X1	52	/* X1 pipe shift amount */
++#define R_TILEPRO_SHAMT_Y0	53	/* Y0 pipe shift amount */
++#define R_TILEPRO_SHAMT_Y1	54	/* Y1 pipe shift amount */
++#define R_TILEPRO_DEST_IMM8_X1	55	/* X1 pipe destination 8-bit */
++/* Relocs 56-59 are currently not defined.  */
++#define R_TILEPRO_TLS_GD_CALL	60	/* "jal" for TLS GD */
++#define R_TILEPRO_IMM8_X0_TLS_GD_ADD 61	/* X0 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_X1_TLS_GD_ADD 62	/* X1 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_Y0_TLS_GD_ADD 63	/* Y0 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_Y1_TLS_GD_ADD 64	/* Y1 pipe "addi" for TLS GD */
++#define R_TILEPRO_TLS_IE_LOAD	65	/* "lw_tls" for TLS IE */
++#define R_TILEPRO_IMM16_X0_TLS_GD 66	/* X0 pipe 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD 67	/* X1 pipe 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_LO 68	/* X0 pipe low 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_LO 69	/* X1 pipe low 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_HI 70	/* X0 pipe high 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_HI 71	/* X1 pipe high 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_HA 72	/* X0 pipe ha() 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_HA 73	/* X1 pipe ha() 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE 74	/* X0 pipe 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE 75	/* X1 pipe 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_LO 76	/* X0 pipe low 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_LO 77	/* X1 pipe low 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_HI 78	/* X0 pipe high 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_HI 79	/* X1 pipe high 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_HA 80	/* X0 pipe ha() 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_HA 81	/* X1 pipe ha() 16-bit TLS IE offset */
++#define R_TILEPRO_TLS_DTPMOD32	82	/* ID of module containing symbol */
++#define R_TILEPRO_TLS_DTPOFF32	83	/* Offset in TLS block */
++#define R_TILEPRO_TLS_TPOFF32	84	/* Offset in static TLS block */
++#define R_TILEPRO_IMM16_X0_TLS_LE 85	/* X0 pipe 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE 86	/* X1 pipe 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_LO 87	/* X0 pipe low 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_LO 88	/* X1 pipe low 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_HI 89	/* X0 pipe high 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_HI 90	/* X1 pipe high 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_HA 91	/* X0 pipe ha() 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_HA 92	/* X1 pipe ha() 16-bit TLS LE offset */
++
++#define R_TILEPRO_GNU_VTINHERIT	128	/* GNU C++ vtable hierarchy */
++#define R_TILEPRO_GNU_VTENTRY	129	/* GNU C++ vtable member usage */
++
++#define R_TILEPRO_NUM		130
++
++
++/* TILE-Gx relocations.  */
++#define R_TILEGX_NONE		0	/* No reloc */
++#define R_TILEGX_64		1	/* Direct 64 bit */
++#define R_TILEGX_32		2	/* Direct 32 bit */
++#define R_TILEGX_16		3	/* Direct 16 bit */
++#define R_TILEGX_8		4	/* Direct 8 bit */
++#define R_TILEGX_64_PCREL	5	/* PC relative 64 bit */
++#define R_TILEGX_32_PCREL	6	/* PC relative 32 bit */
++#define R_TILEGX_16_PCREL	7	/* PC relative 16 bit */
++#define R_TILEGX_8_PCREL	8	/* PC relative 8 bit */
++#define R_TILEGX_HW0		9	/* hword 0 16-bit */
++#define R_TILEGX_HW1		10	/* hword 1 16-bit */
++#define R_TILEGX_HW2		11	/* hword 2 16-bit */
++#define R_TILEGX_HW3		12	/* hword 3 16-bit */
++#define R_TILEGX_HW0_LAST	13	/* last hword 0 16-bit */
++#define R_TILEGX_HW1_LAST	14	/* last hword 1 16-bit */
++#define R_TILEGX_HW2_LAST	15	/* last hword 2 16-bit */
++#define R_TILEGX_COPY		16	/* Copy relocation */
++#define R_TILEGX_GLOB_DAT	17	/* Create GOT entry */
++#define R_TILEGX_JMP_SLOT	18	/* Create PLT entry */
++#define R_TILEGX_RELATIVE	19	/* Adjust by program base */
++#define R_TILEGX_BROFF_X1	20	/* X1 pipe branch offset */
++#define R_TILEGX_JUMPOFF_X1	21	/* X1 pipe jump offset */
++#define R_TILEGX_JUMPOFF_X1_PLT	22	/* X1 pipe jump offset to PLT */
++#define R_TILEGX_IMM8_X0	23	/* X0 pipe 8-bit */
++#define R_TILEGX_IMM8_Y0	24	/* Y0 pipe 8-bit */
++#define R_TILEGX_IMM8_X1	25	/* X1 pipe 8-bit */
++#define R_TILEGX_IMM8_Y1	26	/* Y1 pipe 8-bit */
++#define R_TILEGX_DEST_IMM8_X1	27	/* X1 pipe destination 8-bit */
++#define R_TILEGX_MT_IMM14_X1	28	/* X1 pipe mtspr */
++#define R_TILEGX_MF_IMM14_X1	29	/* X1 pipe mfspr */
++#define R_TILEGX_MMSTART_X0	30	/* X0 pipe mm "start" */
++#define R_TILEGX_MMEND_X0	31	/* X0 pipe mm "end" */
++#define R_TILEGX_SHAMT_X0	32	/* X0 pipe shift amount */
++#define R_TILEGX_SHAMT_X1	33	/* X1 pipe shift amount */
++#define R_TILEGX_SHAMT_Y0	34	/* Y0 pipe shift amount */
++#define R_TILEGX_SHAMT_Y1	35	/* Y1 pipe shift amount */
++#define R_TILEGX_IMM16_X0_HW0	36	/* X0 pipe hword 0 */
++#define R_TILEGX_IMM16_X1_HW0	37	/* X1 pipe hword 0 */
++#define R_TILEGX_IMM16_X0_HW1	38	/* X0 pipe hword 1 */
++#define R_TILEGX_IMM16_X1_HW1	39	/* X1 pipe hword 1 */
++#define R_TILEGX_IMM16_X0_HW2	40	/* X0 pipe hword 2 */
++#define R_TILEGX_IMM16_X1_HW2	41	/* X1 pipe hword 2 */
++#define R_TILEGX_IMM16_X0_HW3	42	/* X0 pipe hword 3 */
++#define R_TILEGX_IMM16_X1_HW3	43	/* X1 pipe hword 3 */
++#define R_TILEGX_IMM16_X0_HW0_LAST 44	/* X0 pipe last hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_LAST 45	/* X1 pipe last hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_LAST 46	/* X0 pipe last hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_LAST 47	/* X1 pipe last hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_LAST 48	/* X0 pipe last hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_LAST 49	/* X1 pipe last hword 2 */
++#define R_TILEGX_IMM16_X0_HW0_PCREL 50	/* X0 pipe PC relative hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_PCREL 51	/* X1 pipe PC relative hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_PCREL 52	/* X0 pipe PC relative hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_PCREL 53	/* X1 pipe PC relative hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_PCREL 54	/* X0 pipe PC relative hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_PCREL 55	/* X1 pipe PC relative hword 2 */
++#define R_TILEGX_IMM16_X0_HW3_PCREL 56	/* X0 pipe PC relative hword 3 */
++#define R_TILEGX_IMM16_X1_HW3_PCREL 57	/* X1 pipe PC relative hword 3 */
++#define R_TILEGX_IMM16_X0_HW0_LAST_PCREL 58 /* X0 pipe PC-rel last hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_LAST_PCREL 59 /* X1 pipe PC-rel last hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_LAST_PCREL 60 /* X0 pipe PC-rel last hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_LAST_PCREL 61 /* X1 pipe PC-rel last hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_LAST_PCREL 62 /* X0 pipe PC-rel last hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_LAST_PCREL 63 /* X1 pipe PC-rel last hword 2 */
++#define R_TILEGX_IMM16_X0_HW0_GOT 64	/* X0 pipe hword 0 GOT offset */
++#define R_TILEGX_IMM16_X1_HW0_GOT 65	/* X1 pipe hword 0 GOT offset */
++/* Relocs 66-71 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_LAST_GOT 72 /* X0 pipe last hword 0 GOT offset */
++#define R_TILEGX_IMM16_X1_HW0_LAST_GOT 73 /* X1 pipe last hword 0 GOT offset */
++#define R_TILEGX_IMM16_X0_HW1_LAST_GOT 74 /* X0 pipe last hword 1 GOT offset */
++#define R_TILEGX_IMM16_X1_HW1_LAST_GOT 75 /* X1 pipe last hword 1 GOT offset */
++/* Relocs 76-77 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_TLS_GD 78	/* X0 pipe hword 0 TLS GD offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_GD 79	/* X1 pipe hword 0 TLS GD offset */
++#define R_TILEGX_IMM16_X0_HW0_TLS_LE 80	/* X0 pipe hword 0 TLS LE offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_LE 81	/* X1 pipe hword 0 TLS LE offset */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_LE 82 /* X0 pipe last hword 0 LE off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_LE 83 /* X1 pipe last hword 0 LE off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_LE 84 /* X0 pipe last hword 1 LE off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_LE 85 /* X1 pipe last hword 1 LE off */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_GD 86 /* X0 pipe last hword 0 GD off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_GD 87 /* X1 pipe last hword 0 GD off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_GD 88 /* X0 pipe last hword 1 GD off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_GD 89 /* X1 pipe last hword 1 GD off */
++/* Relocs 90-91 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_TLS_IE 92	/* X0 pipe hword 0 TLS IE offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_IE 93	/* X1 pipe hword 0 TLS IE offset */
++/* Relocs 94-99 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_IE 100 /* X0 pipe last hword 0 IE off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_IE 101 /* X1 pipe last hword 0 IE off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_IE 102 /* X0 pipe last hword 1 IE off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_IE 103 /* X1 pipe last hword 1 IE off */
++/* Relocs 104-105 are currently not defined.  */
++#define R_TILEGX_TLS_DTPMOD64	106	/* 64-bit ID of symbol's module */
++#define R_TILEGX_TLS_DTPOFF64	107	/* 64-bit offset in TLS block */
++#define R_TILEGX_TLS_TPOFF64	108	/* 64-bit offset in static TLS block */
++#define R_TILEGX_TLS_DTPMOD32	109	/* 32-bit ID of symbol's module */
++#define R_TILEGX_TLS_DTPOFF32	110	/* 32-bit offset in TLS block */
++#define R_TILEGX_TLS_TPOFF32	111	/* 32-bit offset in static TLS block */
++#define R_TILEGX_TLS_GD_CALL	112	/* "jal" for TLS GD */
++#define R_TILEGX_IMM8_X0_TLS_GD_ADD 113	/* X0 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_X1_TLS_GD_ADD 114	/* X1 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_Y0_TLS_GD_ADD 115	/* Y0 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_Y1_TLS_GD_ADD 116	/* Y1 pipe "addi" for TLS GD */
++#define R_TILEGX_TLS_IE_LOAD	117	/* "ld_tls" for TLS IE */
++#define R_TILEGX_IMM8_X0_TLS_ADD 118	/* X0 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_X1_TLS_ADD 119	/* X1 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_Y0_TLS_ADD 120	/* Y0 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_Y1_TLS_ADD 121	/* Y1 pipe "addi" for TLS GD/IE */
++
++#define R_TILEGX_GNU_VTINHERIT	128	/* GNU C++ vtable hierarchy */
++#define R_TILEGX_GNU_VTENTRY	129	/* GNU C++ vtable member usage */
++
++#define R_TILEGX_NUM		130
++
++#endif	/* elf.h */
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/211-stddef_include.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/211-stddef_include.patch.svn-base
new file mode 100644
index 0000000..7fe248d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/211-stddef_include.patch.svn-base
@@ -0,0 +1,17 @@
+--- a/include/linux/stddef.h
++++ b/include/linux/stddef.h
+@@ -16,6 +16,7 @@ enum {
+ 	false	= 0,
+ 	true	= 1
+ };
++#endif /* __KERNEL__ */
+ 
+ #undef offsetof
+ #ifdef __compiler_offsetof
+@@ -23,6 +24,5 @@ enum {
+ #else
+ #define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+ #endif
+-#endif /* __KERNEL__ */
+ 
+ #endif
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/212-x86_reloc_portability.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/212-x86_reloc_portability.patch.svn-base
new file mode 100644
index 0000000..d0c8106
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/212-x86_reloc_portability.patch.svn-base
@@ -0,0 +1,22 @@
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -10,7 +10,18 @@
+ #define USE_BSD
+ #include <endian.h>
+ #include <regex.h>
+-#include <tools/le_byteshift.h>
++
++static inline void __put_unaligned_le16(uint16_t val, uint8_t *p)
++{
++	*p++ = val;
++	*p++ = val >> 8;
++}
++
++static inline void put_unaligned_le32(uint32_t val, uint8_t *p)
++{
++	__put_unaligned_le16(val >> 16, p + 2);
++	__put_unaligned_le16(val, p);
++}
+ 
+ static void die(char *fmt, ...);
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/220-module_exports.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/220-module_exports.patch.svn-base
new file mode 100644
index 0000000..5b87c1a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/220-module_exports.patch.svn-base
@@ -0,0 +1,91 @@
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -52,6 +52,18 @@
+ #define LOAD_OFFSET 0
+ #endif
+ 
++#ifndef SYMTAB_KEEP_STR
++#define SYMTAB_KEEP *(SORT(___ksymtab+*))
++#define SYMTAB_KEEP_GPL *(SORT(___ksymtab_gpl+*))
++#define SYMTAB_KEEP_STR *(__ksymtab_strings+*)
++#endif
++
++#ifndef SYMTAB_DISCARD
++#define SYMTAB_DISCARD
++#define SYMTAB_DISCARD_GPL
++#define SYMTAB_DISCARD_STR
++#endif
++
+ #ifndef SYMBOL_PREFIX
+ #define VMLINUX_SYMBOL(sym) sym
+ #else
+@@ -275,14 +287,14 @@
+ 	/* Kernel symbol table: Normal symbols */			\
+ 	__ksymtab         : AT(ADDR(__ksymtab) - LOAD_OFFSET) {		\
+ 		VMLINUX_SYMBOL(__start___ksymtab) = .;			\
+-		*(SORT(___ksymtab+*))					\
++		SYMTAB_KEEP						\
+ 		VMLINUX_SYMBOL(__stop___ksymtab) = .;			\
+ 	}								\
+ 									\
+ 	/* Kernel symbol table: GPL-only symbols */			\
+ 	__ksymtab_gpl     : AT(ADDR(__ksymtab_gpl) - LOAD_OFFSET) {	\
+ 		VMLINUX_SYMBOL(__start___ksymtab_gpl) = .;		\
+-		*(SORT(___ksymtab_gpl+*))				\
++		SYMTAB_KEEP_GPL						\
+ 		VMLINUX_SYMBOL(__stop___ksymtab_gpl) = .;		\
+ 	}								\
+ 									\
+@@ -344,7 +356,7 @@
+ 									\
+ 	/* Kernel symbol table: strings */				\
+         __ksymtab_strings : AT(ADDR(__ksymtab_strings) - LOAD_OFFSET) {	\
+-		*(__ksymtab_strings)					\
++		SYMTAB_KEEP_STR						\
+ 	}								\
+ 									\
+ 	/* __*init sections */						\
+@@ -676,6 +688,9 @@
+ 	EXIT_TEXT							\
+ 	EXIT_DATA							\
+ 	EXIT_CALL							\
++	SYMTAB_DISCARD							\
++	SYMTAB_DISCARD_GPL						\
++	SYMTAB_DISCARD_STR						\
+ 	*(.discard)							\
+ 	*(.discard.*)							\
+ 	}
+--- a/include/linux/export.h
++++ b/include/linux/export.h
+@@ -45,12 +45,19 @@ extern struct module __this_module;
+ #define __CRC_SYMBOL(sym, sec)
+ #endif
+ 
++#ifdef MODULE
++#define __EXPORT_SUFFIX(sym)
++#else
++#define __EXPORT_SUFFIX(sym) "+" #sym
++#endif
++
+ /* For every exported symbol, place a struct in the __ksymtab section */
+ #define __EXPORT_SYMBOL(sym, sec)				\
+ 	extern typeof(sym) sym;					\
+ 	__CRC_SYMBOL(sym, sec)					\
+ 	static const char __kstrtab_##sym[]			\
+-	__attribute__((section("__ksymtab_strings"), aligned(1))) \
++	__attribute__((section("__ksymtab_strings"		\
++	  __EXPORT_SUFFIX(sym)), aligned(1)))			\
+ 	= MODULE_SYMBOL_PREFIX #sym;				\
+ 	static const struct kernel_symbol __ksymtab_##sym	\
+ 	__used							\
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -346,7 +346,7 @@ targets += $(extra-y) $(MAKECMDGOALS) $(
+ # Linker scripts preprocessor (.lds.S -> .lds)
+ # ---------------------------------------------------------------------------
+ quiet_cmd_cpp_lds_S = LDS     $@
+-      cmd_cpp_lds_S = $(CPP) $(cpp_flags) -P -C -U$(ARCH) \
++      cmd_cpp_lds_S = $(CPP) $(EXTRA_LDSFLAGS) $(cpp_flags) -P -C -U$(ARCH) \
+ 	                     -D__ASSEMBLY__ -DLINKER_SCRIPT -o $@ $<
+ 
+ $(obj)/%.lds: $(src)/%.lds.S FORCE
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/230-openwrt_lzma_options.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/230-openwrt_lzma_options.patch.svn-base
new file mode 100644
index 0000000..f17f40a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/230-openwrt_lzma_options.patch.svn-base
@@ -0,0 +1,54 @@
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -296,7 +296,7 @@ cmd_bzip2 = (cat $(filter-out FORCE,$^)
+ 
+ quiet_cmd_lzma = LZMA    $@
+ cmd_lzma = (cat $(filter-out FORCE,$^) | \
+-	lzma -9 && $(call size_append, $(filter-out FORCE,$^))) > $@ || \
++	lzma e -d20 -lc1 -lp2 -pb2 -eos -si -so && $(call size_append, $(filter-out FORCE,$^))) > $@ || \
+ 	(rm -f $@ ; false)
+ 
+ quiet_cmd_lzo = LZO     $@
+--- a/scripts/gen_initramfs_list.sh
++++ b/scripts/gen_initramfs_list.sh
+@@ -226,7 +226,7 @@ cpio_list=
+ output="/dev/stdout"
+ output_file=""
+ is_cpio_compressed=
+-compr="gzip -n -9 -f"
++compr="gzip -n -9 -f -"
+ 
+ arg="$1"
+ case "$arg" in
+@@ -240,9 +240,9 @@ case "$arg" in
+ 		output_file="$1"
+ 		cpio_list="$(mktemp ${TMPDIR:-/tmp}/cpiolist.XXXXXX)"
+ 		output=${cpio_list}
+-		echo "$output_file" | grep -q "\.gz$" && compr="gzip -n -9 -f"
+-		echo "$output_file" | grep -q "\.bz2$" && compr="bzip2 -9 -f"
+-		echo "$output_file" | grep -q "\.lzma$" && compr="lzma -9 -f"
++		echo "$output_file" | grep -q "\.gz$" && compr="gzip -n -9 -f -"
++		echo "$output_file" | grep -q "\.bz2$" && compr="bzip2 -9 -f -"
++		echo "$output_file" | grep -q "\.lzma$" && compr="lzma e -d20 -lc1 -lp2 -pb2 -eos -si -so"
+ 		echo "$output_file" | grep -q "\.xz$" && \
+ 				compr="xz --check=crc32 --lzma2=dict=1MiB"
+ 		echo "$output_file" | grep -q "\.lzo$" && compr="lzop -9 -f"
+@@ -303,7 +303,7 @@ if [ ! -z ${output_file} ]; then
+ 	if [ "${is_cpio_compressed}" = "compressed" ]; then
+ 		cat ${cpio_tfile} > ${output_file}
+ 	else
+-		(cat ${cpio_tfile} | ${compr}  - > ${output_file}) \
++		(cat ${cpio_tfile} | ${compr} > ${output_file}) \
+ 		|| (rm -f ${output_file} ; false)
+ 	fi
+ 	[ -z ${cpio_file} ] && rm ${cpio_tfile}
+--- a/lib/decompress.c
++++ b/lib/decompress.c
+@@ -40,6 +40,7 @@ static const struct compress_format {
+ 	{ {037, 0236}, "gzip", gunzip },
+ 	{ {0x42, 0x5a}, "bzip2", bunzip2 },
+ 	{ {0x5d, 0x00}, "lzma", unlzma },
++	{ {0x6d, 0x00}, "lzma-openwrt", unlzma },
+ 	{ {0xfd, 0x37}, "xz", unxz },
+ 	{ {0x89, 0x4c}, "lzo", unlzo },
+ 	{ {0, 0}, NULL, NULL }
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/250-netfilter_depends.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/250-netfilter_depends.patch.svn-base
new file mode 100644
index 0000000..cbe3892
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/250-netfilter_depends.patch.svn-base
@@ -0,0 +1,18 @@
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -181,7 +181,6 @@ config NF_CONNTRACK_FTP
+ 
+ config NF_CONNTRACK_H323
+ 	tristate "H.323 protocol support"
+-	depends on (IPV6 || IPV6=n)
+ 	depends on NETFILTER_ADVANCED
+ 	help
+ 	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
+@@ -627,7 +626,6 @@ config NETFILTER_XT_TARGET_SECMARK
+ 
+ config NETFILTER_XT_TARGET_TCPMSS
+ 	tristate '"TCPMSS" target support'
+-	depends on (IPV6 || IPV6=n)
+ 	default m if NETFILTER_ADVANCED=n
+ 	---help---
+ 	  This option adds a `TCPMSS' target, which allows you to alter the
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/251-sound_kconfig.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/251-sound_kconfig.patch.svn-base
new file mode 100644
index 0000000..f374009
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/251-sound_kconfig.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/sound/core/Kconfig
++++ b/sound/core/Kconfig
+@@ -7,7 +7,7 @@ config SND_PCM
+ 	select SND_TIMER
+ 
+ config SND_HWDEP
+-	tristate
++	tristate "Sound hardware support"
+ 
+ config SND_RAWMIDI
+ 	tristate
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/252-mv_cesa_depends.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/252-mv_cesa_depends.patch.svn-base
new file mode 100644
index 0000000..5370145
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/252-mv_cesa_depends.patch.svn-base
@@ -0,0 +1,10 @@
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -172,6 +172,7 @@ config CRYPTO_DEV_MV_CESA
+ 	depends on PLAT_ORION
+ 	select CRYPTO_ALGAPI
+ 	select CRYPTO_AES
++	select CRYPTO_HASH2
+ 	select CRYPTO_BLKCIPHER2
+ 	select CRYPTO_HASH
+ 	help
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/253-ssb_b43_default_on.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/253-ssb_b43_default_on.patch.svn-base
new file mode 100644
index 0000000..29d2a41
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/253-ssb_b43_default_on.patch.svn-base
@@ -0,0 +1,29 @@
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -29,6 +29,7 @@ config SSB_SPROM
+ config SSB_BLOCKIO
+ 	bool
+ 	depends on SSB
++	default y
+ 
+ config SSB_PCIHOST_POSSIBLE
+ 	bool
+@@ -49,7 +50,7 @@ config SSB_PCIHOST
+ config SSB_B43_PCI_BRIDGE
+ 	bool
+ 	depends on SSB_PCIHOST
+-	default n
++	default y
+ 
+ config SSB_PCMCIAHOST_POSSIBLE
+ 	bool
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -17,6 +17,7 @@ config BCMA
+ config BCMA_BLOCKIO
+ 	bool
+ 	depends on BCMA
++	default y
+ 
+ config BCMA_HOST_PCI_POSSIBLE
+ 	bool
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/254-textsearch_kconfig_hacks.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/254-textsearch_kconfig_hacks.patch.svn-base
new file mode 100644
index 0000000..1659fda
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/254-textsearch_kconfig_hacks.patch.svn-base
@@ -0,0 +1,23 @@
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -207,16 +207,16 @@ config BCH_CONST_T
+ # Textsearch support is select'ed if needed
+ #
+ config TEXTSEARCH
+-	boolean
++	boolean	"Textsearch support"
+ 
+ config TEXTSEARCH_KMP
+-	tristate
++	tristate "Textsearch KMP"
+ 
+ config TEXTSEARCH_BM
+-	tristate
++	tristate "Textsearch BM"
+ 
+ config TEXTSEARCH_FSM
+-	tristate
++	tristate "Textsearch FSM"
+ 
+ config BTREE
+ 	boolean
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/255-lib80211_kconfig_hacks.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/255-lib80211_kconfig_hacks.patch.svn-base
new file mode 100644
index 0000000..8dde331
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/255-lib80211_kconfig_hacks.patch.svn-base
@@ -0,0 +1,19 @@
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -143,13 +143,13 @@ config LIB80211
+ 	  you want this built into your kernel.
+ 
+ config LIB80211_CRYPT_WEP
+-	tristate
++	tristate "LIB80211_CRYPT_WEP"
+ 
+ config LIB80211_CRYPT_CCMP
+-	tristate
++	tristate "LIB80211_CRYPT_CCMP"
+ 
+ config LIB80211_CRYPT_TKIP
+-	tristate
++	tristate "LIB80211_CRYPT_TKIP"
+ 
+ config LIB80211_DEBUG
+ 	bool "lib80211 debugging messages"
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/256-crypto_add_kconfig_prompts.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/256-crypto_add_kconfig_prompts.patch.svn-base
new file mode 100644
index 0000000..8462c71
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/256-crypto_add_kconfig_prompts.patch.svn-base
@@ -0,0 +1,47 @@
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -31,7 +31,7 @@ config CRYPTO_FIPS
+ 	  this is.
+ 
+ config CRYPTO_ALGAPI
+-	tristate
++	tristate "ALGAPI"
+ 	select CRYPTO_ALGAPI2
+ 	help
+ 	  This option provides the API for cryptographic algorithms.
+@@ -40,7 +40,7 @@ config CRYPTO_ALGAPI2
+ 	tristate
+ 
+ config CRYPTO_AEAD
+-	tristate
++	tristate "AEAD"
+ 	select CRYPTO_AEAD2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -49,7 +49,7 @@ config CRYPTO_AEAD2
+ 	select CRYPTO_ALGAPI2
+ 
+ config CRYPTO_BLKCIPHER
+-	tristate
++	tristate "BLKCIPHER"
+ 	select CRYPTO_BLKCIPHER2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -60,7 +60,7 @@ config CRYPTO_BLKCIPHER2
+ 	select CRYPTO_WORKQUEUE
+ 
+ config CRYPTO_HASH
+-	tristate
++	tristate "HASH"
+ 	select CRYPTO_HASH2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -69,7 +69,7 @@ config CRYPTO_HASH2
+ 	select CRYPTO_ALGAPI2
+ 
+ config CRYPTO_RNG
+-	tristate
++	tristate "RNG"
+ 	select CRYPTO_RNG2
+ 	select CRYPTO_ALGAPI
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/257-wireless_ext_kconfig_hack.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/257-wireless_ext_kconfig_hack.patch.svn-base
new file mode 100644
index 0000000..daac589
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/257-wireless_ext_kconfig_hack.patch.svn-base
@@ -0,0 +1,22 @@
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -1,5 +1,5 @@
+ config WIRELESS_EXT
+-	bool
++	bool "Wireless extensions"
+ 
+ config WEXT_CORE
+ 	def_bool y
+@@ -11,10 +11,10 @@ config WEXT_PROC
+ 	depends on WEXT_CORE
+ 
+ config WEXT_SPY
+-	bool
++	bool "WEXT_SPY"
+ 
+ config WEXT_PRIV
+-	bool
++	bool "WEXT_PRIV"
+ 
+ config CFG80211
+ 	tristate "cfg80211 - wireless configuration API"
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/258-netfilter_netlink_kconfig_hack.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/258-netfilter_netlink_kconfig_hack.patch.svn-base
new file mode 100644
index 0000000..9d827c2
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/258-netfilter_netlink_kconfig_hack.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -2,7 +2,7 @@ menu "Core Netfilter Configuration"
+ 	depends on NET && INET && NETFILTER
+ 
+ config NETFILTER_NETLINK
+-	tristate
++	tristate "Netfilter NFNETLINK interface"
+ 
+ config NETFILTER_NETLINK_ACCT
+ tristate "Netfilter NFACCT over NFNETLINK interface"
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/260-move_bcm963xx_tag.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/260-move_bcm963xx_tag.patch.svn-base
new file mode 100644
index 0000000..b281326
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/260-move_bcm963xx_tag.patch.svn-base
@@ -0,0 +1,219 @@
+--- a/arch/mips/include/asm/mach-bcm63xx/bcm963xx_tag.h
++++ /dev/null
+@@ -1,96 +0,0 @@
+-#ifndef __BCM963XX_TAG_H
+-#define __BCM963XX_TAG_H
+-
+-#define TAGVER_LEN		4	/* Length of Tag Version */
+-#define TAGLAYOUT_LEN		4	/* Length of FlashLayoutVer */
+-#define SIG1_LEN		20	/* Company Signature 1 Length */
+-#define SIG2_LEN		14	/* Company Signature 2 Length */
+-#define BOARDID_LEN		16	/* Length of BoardId */
+-#define ENDIANFLAG_LEN		2	/* Endian Flag Length */
+-#define CHIPID_LEN		6	/* Chip Id Length */
+-#define IMAGE_LEN		10	/* Length of Length Field */
+-#define ADDRESS_LEN		12	/* Length of Address field */
+-#define DUALFLAG_LEN		2	/* Dual Image flag Length */
+-#define INACTIVEFLAG_LEN	2	/* Inactie Flag Length */
+-#define RSASIG_LEN		20	/* Length of RSA Signature in tag */
+-#define TAGINFO1_LEN		30	/* Length of vendor information field1 in tag */
+-#define FLASHLAYOUTVER_LEN	4	/* Length of Flash Layout Version String tag */
+-#define TAGINFO2_LEN		16	/* Length of vendor information field2 in tag */
+-#define ALTTAGINFO_LEN		54	/* Alternate length for vendor information; Pirelli */
+-
+-#define NUM_PIRELLI		2
+-#define IMAGETAG_CRC_START	0xFFFFFFFF
+-
+-#define PIRELLI_BOARDS { \
+-	"AGPF-S0", \
+-	"DWV-S0", \
+-}
+-
+-/*
+- * The broadcom firmware assumes the rootfs starts the image,
+- * therefore uses the rootfs start (flash_image_address)
+- * to determine where to flash the image.  Since we have the kernel first
+- * we have to give it the kernel address, but the crc uses the length
+- * associated with this address (root_length), which is added to the kernel
+- * length (kernel_length) to determine the length of image to flash and thus
+- * needs to be rootfs + deadcode (jffs2 EOF marker)
+-*/
+-
+-struct bcm_tag {
+-	/* 0-3: Version of the image tag */
+-	char tag_version[TAGVER_LEN];
+-	/* 4-23: Company Line 1 */
+-	char sig_1[SIG1_LEN];
+-	/*  24-37: Company Line 2 */
+-	char sig_2[SIG2_LEN];
+-	/* 38-43: Chip this image is for */
+-	char chip_id[CHIPID_LEN];
+-	/* 44-59: Board name */
+-	char board_id[BOARDID_LEN];
+-	/* 60-61: Map endianness -- 1 BE 0 LE */
+-	char big_endian[ENDIANFLAG_LEN];
+-	/* 62-71: Total length of image */
+-	char total_length[IMAGE_LEN];
+-	/* 72-83: Address in memory of CFE */
+-	char cfe__address[ADDRESS_LEN];
+-	/* 84-93: Size of CFE */
+-	char cfe_length[IMAGE_LEN];
+-	/* 94-105: Address in memory of image start
+-	 * (kernel for OpenWRT, rootfs for stock firmware)
+-	 */
+-	char flash_image_start[ADDRESS_LEN];
+-	/* 106-115: Size of rootfs */
+-	char root_length[IMAGE_LEN];
+-	/* 116-127: Address in memory of kernel */
+-	char kernel_address[ADDRESS_LEN];
+-	/* 128-137: Size of kernel */
+-	char kernel_length[IMAGE_LEN];
+-	/* 138-139: Unused at the moment */
+-	char dual_image[DUALFLAG_LEN];
+-	/* 140-141: Unused at the moment */
+-	char inactive_flag[INACTIVEFLAG_LEN];
+-	/* 142-161: RSA Signature (not used; some vendors may use this) */
+-	char rsa_signature[RSASIG_LEN];
+-	/* 162-191: Compilation and related information (not used in OpenWrt) */
+-	char information1[TAGINFO1_LEN];
+-	/* 192-195: Version flash layout */
+-	char flash_layout_ver[FLASHLAYOUTVER_LEN];
+-	/* 196-199: kernel+rootfs CRC32 */
+-	__u32 fskernel_crc;
+-	/* 200-215: Unused except on Alice Gate where is is information */
+-	char information2[TAGINFO2_LEN];
+-	/* 216-219: CRC32 of image less imagetag (kernel for Alice Gate) */
+-	__u32 image_crc;
+-	/* 220-223: CRC32 of rootfs partition */
+-	__u32 rootfs_crc;
+-	/* 224-227: CRC32 of kernel partition */
+-	__u32 kernel_crc;
+-	/* 228-235: Unused at present */
+-	char reserved1[8];
+-	/* 236-239: CRC32 of header excluding last 20 bytes */
+-	__u32 header_crc;
+-	/* 240-255: Unused at present */
+-	char reserved2[16];
+-};
+-
+-#endif /* __BCM63XX_TAG_H */
+--- a/drivers/mtd/bcm63xxpart.c
++++ b/drivers/mtd/bcm63xxpart.c
+@@ -32,7 +32,7 @@
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
+ 
+-#include <asm/mach-bcm63xx/bcm963xx_tag.h>
++#include <linux/bcm963xx_tag.h>
+ #include <asm/mach-bcm63xx/board_bcm963xx.h>
+ 
+ #define BCM63XX_EXTENDED_SIZE	0xBFC00000	/* Extended flash address */
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -77,6 +77,7 @@ header-y += blk_types.h
+ header-y += blkpg.h
+ header-y += blktrace_api.h
+ header-y += bpqether.h
++header-y += bcm963xx_tag.h
+ header-y += bsg.h
+ header-y += can.h
+ header-y += capability.h
+--- /dev/null
++++ b/include/linux/bcm963xx_tag.h
+@@ -0,0 +1,96 @@
++#ifndef __BCM963XX_TAG_H
++#define __BCM963XX_TAG_H
++
++#define TAGVER_LEN		4	/* Length of Tag Version */
++#define TAGLAYOUT_LEN		4	/* Length of FlashLayoutVer */
++#define SIG1_LEN		20	/* Company Signature 1 Length */
++#define SIG2_LEN		14	/* Company Signature 2 Length */
++#define BOARDID_LEN		16	/* Length of BoardId */
++#define ENDIANFLAG_LEN		2	/* Endian Flag Length */
++#define CHIPID_LEN		6	/* Chip Id Length */
++#define IMAGE_LEN		10	/* Length of Length Field */
++#define ADDRESS_LEN		12	/* Length of Address field */
++#define DUALFLAG_LEN		2	/* Dual Image flag Length */
++#define INACTIVEFLAG_LEN	2	/* Inactie Flag Length */
++#define RSASIG_LEN		20	/* Length of RSA Signature in tag */
++#define TAGINFO1_LEN		30	/* Length of vendor information field1 in tag */
++#define FLASHLAYOUTVER_LEN	4	/* Length of Flash Layout Version String tag */
++#define TAGINFO2_LEN		16	/* Length of vendor information field2 in tag */
++#define ALTTAGINFO_LEN		54	/* Alternate length for vendor information; Pirelli */
++
++#define NUM_PIRELLI		2
++#define IMAGETAG_CRC_START	0xFFFFFFFF
++
++#define PIRELLI_BOARDS { \
++	"AGPF-S0", \
++	"DWV-S0", \
++}
++
++/*
++ * The broadcom firmware assumes the rootfs starts the image,
++ * therefore uses the rootfs start (flash_image_address)
++ * to determine where to flash the image.  Since we have the kernel first
++ * we have to give it the kernel address, but the crc uses the length
++ * associated with this address (root_length), which is added to the kernel
++ * length (kernel_length) to determine the length of image to flash and thus
++ * needs to be rootfs + deadcode (jffs2 EOF marker)
++*/
++
++struct bcm_tag {
++	/* 0-3: Version of the image tag */
++	char tag_version[TAGVER_LEN];
++	/* 4-23: Company Line 1 */
++	char sig_1[SIG1_LEN];
++	/*  24-37: Company Line 2 */
++	char sig_2[SIG2_LEN];
++	/* 38-43: Chip this image is for */
++	char chip_id[CHIPID_LEN];
++	/* 44-59: Board name */
++	char board_id[BOARDID_LEN];
++	/* 60-61: Map endianness -- 1 BE 0 LE */
++	char big_endian[ENDIANFLAG_LEN];
++	/* 62-71: Total length of image */
++	char total_length[IMAGE_LEN];
++	/* 72-83: Address in memory of CFE */
++	char cfe__address[ADDRESS_LEN];
++	/* 84-93: Size of CFE */
++	char cfe_length[IMAGE_LEN];
++	/* 94-105: Address in memory of image start
++	 * (kernel for OpenWRT, rootfs for stock firmware)
++	 */
++	char flash_image_start[ADDRESS_LEN];
++	/* 106-115: Size of rootfs */
++	char root_length[IMAGE_LEN];
++	/* 116-127: Address in memory of kernel */
++	char kernel_address[ADDRESS_LEN];
++	/* 128-137: Size of kernel */
++	char kernel_length[IMAGE_LEN];
++	/* 138-139: Unused at the moment */
++	char dual_image[DUALFLAG_LEN];
++	/* 140-141: Unused at the moment */
++	char inactive_flag[INACTIVEFLAG_LEN];
++	/* 142-161: RSA Signature (not used; some vendors may use this) */
++	char rsa_signature[RSASIG_LEN];
++	/* 162-191: Compilation and related information (not used in OpenWrt) */
++	char information1[TAGINFO1_LEN];
++	/* 192-195: Version flash layout */
++	char flash_layout_ver[FLASHLAYOUTVER_LEN];
++	/* 196-199: kernel+rootfs CRC32 */
++	__u32 fskernel_crc;
++	/* 200-215: Unused except on Alice Gate where is is information */
++	char information2[TAGINFO2_LEN];
++	/* 216-219: CRC32 of image less imagetag (kernel for Alice Gate) */
++	__u32 image_crc;
++	/* 220-223: CRC32 of rootfs partition */
++	__u32 rootfs_crc;
++	/* 224-227: CRC32 of kernel partition */
++	__u32 kernel_crc;
++	/* 228-235: Unused at present */
++	char reserved1[8];
++	/* 236-239: CRC32 of header excluding last 20 bytes */
++	__u32 header_crc;
++	/* 240-255: Unused at present */
++	char reserved2[16];
++};
++
++#endif /* __BCM63XX_TAG_H */
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/270-regmap_dynamic.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/270-regmap_dynamic.patch.svn-base
new file mode 100644
index 0000000..d6c32b4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/270-regmap_dynamic.patch.svn-base
@@ -0,0 +1,38 @@
+--- a/drivers/base/regmap/Kconfig
++++ b/drivers/base/regmap/Kconfig
+@@ -3,16 +3,17 @@
+ # subsystems should select the appropriate symbols.
+ 
+ config REGMAP
+-	default y if (REGMAP_I2C || REGMAP_SPI)
+ 	select LZO_COMPRESS
+ 	select LZO_DECOMPRESS
+-	bool
++	tristate "Regmap"
+ 
+ config REGMAP_I2C
+-	tristate
++	select REGMAP
++	tristate "Regmap I2C"
+ 
+ config REGMAP_SPI
+-	tristate
++	select REGMAP
++	tristate "Regmap SPI"
+ 
+ config REGMAP_IRQ
+ 	bool
+--- a/drivers/base/regmap/Makefile
++++ b/drivers/base/regmap/Makefile
+@@ -1,6 +1,8 @@
+-obj-$(CONFIG_REGMAP) += regmap.o regcache.o
+-obj-$(CONFIG_REGMAP) += regcache-rbtree.o regcache-lzo.o
+-obj-$(CONFIG_DEBUG_FS) += regmap-debugfs.o
++regmap-core-objs = regmap.o regcache.o regcache-rbtree.o regcache-lzo.o
++ifdef CONFIG_DEBUG_FS
++regmap-core-objs += regmap-debugfs.o
++endif
++obj-$(CONFIG_REGMAP) += regmap-core.o
+ obj-$(CONFIG_REGMAP_I2C) += regmap-i2c.o
+ obj-$(CONFIG_REGMAP_SPI) += regmap-spi.o
+ obj-$(CONFIG_REGMAP_IRQ) += regmap-irq.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/300-mips_expose_boot_raw.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/300-mips_expose_boot_raw.patch.svn-base
new file mode 100644
index 0000000..b114ef4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/300-mips_expose_boot_raw.patch.svn-base
@@ -0,0 +1,39 @@
+From: Mark Miller <mark@mirell.org>
+
+This exposes the CONFIG_BOOT_RAW symbol in Kconfig. This is needed on
+certain Broadcom chipsets running CFE in order to load the kernel.
+
+Signed-off-by: Mark Miller <mark@mirell.org>
+Acked-by: Rob Landley <rob@landley.net>
+---
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -877,9 +877,6 @@ config ARC
+ config ARCH_MAY_HAVE_PC_FDC
+ 	bool
+ 
+-config BOOT_RAW
+-	bool
+-
+ config CEVT_BCM1480
+ 	bool
+ 
+@@ -2330,6 +2327,18 @@ config USE_OF
+ 	help
+ 	  Include support for flattened device tree machine descriptions.
+ 
++config BOOT_RAW
++	bool "Enable the kernel to be executed from the load address"
++	default n
++	help
++	 Allow the kernel to be executed from the load address for
++	 bootloaders which cannot read the ELF format. This places
++	 a jump to start_kernel at the load address.
++
++	 If unsure, say N.
++
++
++
+ endmenu
+ 
+ config LOCKDEP_SUPPORT
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/301-mips_image_cmdline_hack.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/301-mips_image_cmdline_hack.patch.svn-base
new file mode 100644
index 0000000..9193c68
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/301-mips_image_cmdline_hack.patch.svn-base
@@ -0,0 +1,28 @@
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -976,6 +976,10 @@ config SYNC_R4K
+ config MIPS_MACHINE
+ 	def_bool n
+ 
++config IMAGE_CMDLINE_HACK
++	bool "OpenWrt specific image command line hack"
++	default n
++
+ config NO_IOPORT
+ 	def_bool n
+ 
+--- a/arch/mips/kernel/head.S
++++ b/arch/mips/kernel/head.S
+@@ -141,6 +141,12 @@ FEXPORT(__kernel_entry)
+ 	j	kernel_entry
+ #endif
+ 
++#ifdef CONFIG_IMAGE_CMDLINE_HACK
++	.ascii	"CMDLINE:"
++EXPORT(__image_cmdline)
++	.fill	0x400
++#endif /* CONFIG_IMAGE_CMDLINE_HACK */
++
+ 	__REF
+ 
+ NESTED(kernel_entry, 16, sp)			# kernel entry point
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/302-mips_use_generic_thread_info_allocator.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/302-mips_use_generic_thread_info_allocator.patch.svn-base
new file mode 100644
index 0000000..1bcc74b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/302-mips_use_generic_thread_info_allocator.patch.svn-base
@@ -0,0 +1,18 @@
+--- a/arch/mips/include/asm/thread_info.h
++++ b/arch/mips/include/asm/thread_info.h
+@@ -85,6 +85,7 @@ register struct thread_info *__current_t
+ 
+ #define STACK_WARN	(THREAD_SIZE / 8)
+ 
++#if 0
+ #define __HAVE_ARCH_THREAD_INFO_ALLOCATOR
+ 
+ #ifdef CONFIG_DEBUG_STACK_USAGE
+@@ -96,6 +97,7 @@ register struct thread_info *__current_t
+ #endif
+ 
+ #define free_thread_info(info) kfree(info)
++#endif
+ 
+ #endif /* !__ASSEMBLY__ */
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/303-mips_fix_kexec.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/303-mips_fix_kexec.patch.svn-base
new file mode 100644
index 0000000..e6928dd
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/303-mips_fix_kexec.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -52,7 +52,7 @@ machine_kexec(struct kimage *image)
+ 	reboot_code_buffer =
+ 	  (unsigned long)page_address(image->control_code_page);
+ 
+-	kexec_start_address = image->start;
++	kexec_start_address = (unsigned long) phys_to_virt(image->start);
+ 	kexec_indirection_page =
+ 		(unsigned long) phys_to_virt(image->head & PAGE_MASK);
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/304-mips_disable_fpu.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/304-mips_disable_fpu.patch.svn-base
new file mode 100644
index 0000000..e747fea
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/304-mips_disable_fpu.patch.svn-base
@@ -0,0 +1,160 @@
+MIPS: allow disabling the kernel FPU emulator
+
+This patch allows turning off the in-kernel Algorithmics
+FPU emulator support, which allows one to save a couple of
+precious blocks on an embedded system.
+
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+--
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -961,6 +961,17 @@ config I8259
+ config MIPS_BONITO64
+ 	bool
+ 
++config MIPS_FPU_EMU
++	bool "Enable FPU emulation"
++	default y
++	help
++	   This option allows building a kernel with or without the Algorithmics
++	   FPU emulator enabled. Turning off this option results in a kernel which
++	   does not catch floating operations exceptions. Make sure that your toolchain
++	   is configured to enable software floating point emulation in that case.
++		
++	   If unsure say Y here.
++
+ config MIPS_MSC
+ 	bool
+ 
+--- a/arch/mips/math-emu/Makefile
++++ b/arch/mips/math-emu/Makefile
+@@ -2,11 +2,13 @@
+ # Makefile for the Linux/MIPS kernel FPU emulation.
+ #
+ 
+-obj-y	:= cp1emu.o ieee754m.o ieee754d.o ieee754dp.o ieee754sp.o ieee754.o \
++obj-y	:=	kernel_linkage.o dsemul.o cp1emu.o
++
++obj-$(CONFIG_MIPS_FPU_EMU)	+= ieee754m.o ieee754d.o ieee754dp.o ieee754sp.o ieee754.o \
+ 	   ieee754xcpt.o dp_frexp.o dp_modf.o dp_div.o dp_mul.o dp_sub.o \
+ 	   dp_add.o dp_fsp.o dp_cmp.o dp_logb.o dp_scalb.o dp_simple.o \
+ 	   dp_tint.o dp_fint.o dp_tlong.o dp_flong.o sp_frexp.o sp_modf.o \
+ 	   sp_div.o sp_mul.o sp_sub.o sp_add.o sp_fdp.o sp_cmp.o sp_logb.o \
+ 	   sp_scalb.o sp_simple.o sp_tint.o sp_fint.o sp_tlong.o sp_flong.o \
+-	   dp_sqrt.o sp_sqrt.o kernel_linkage.o dsemul.o
++	   dp_sqrt.o sp_sqrt.o
+ 
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -58,7 +58,11 @@
+ #define __mips 4
+ 
+ /* Function which emulates a floating point instruction. */
++#ifdef CONFIG_DEBUG_FS
++DEFINE_PER_CPU(struct mips_fpu_emulator_stats, fpuemustats);
++#endif
+ 
++#ifdef CONFIG_MIPS_FPU_EMU
+ static int fpu_emu(struct pt_regs *, struct mips_fpu_struct *,
+ 	mips_instruction);
+ 
+@@ -69,10 +73,6 @@ static int fpux_emu(struct pt_regs *,
+ 
+ /* Further private data for which no space exists in mips_fpu_struct */
+ 
+-#ifdef CONFIG_DEBUG_FS
+-DEFINE_PER_CPU(struct mips_fpu_emulator_stats, fpuemustats);
+-#endif
+-
+ /* Control registers */
+ 
+ #define FPCREG_RID	0	/* $0  = revision id */
+@@ -1360,7 +1360,6 @@ int fpu_emulator_cop1Handler(struct pt_r
+ 
+ 	return sig;
+ }
+-
+ #ifdef CONFIG_DEBUG_FS
+ 
+ static int fpuemu_stat_get(void *data, u64 *val)
+@@ -1409,4 +1408,11 @@ static int __init debugfs_fpuemu(void)
+ 	return 0;
+ }
+ __initcall(debugfs_fpuemu);
+-#endif
++#endif /* CONFIG_DEBUGFS */
++#else
++int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
++        int has_fpu)
++{
++	return 0;
++}
++#endif /* CONFIG_MIPS_FPU_EMU */
+--- a/arch/mips/math-emu/dsemul.c
++++ b/arch/mips/math-emu/dsemul.c
+@@ -109,6 +109,7 @@ int mips_dsemul(struct pt_regs *regs, mi
+ 	return SIGILL;		/* force out of emulation loop */
+ }
+ 
++#ifdef CONFIG_MIPS_FPU_EMU
+ int do_dsemulret(struct pt_regs *xcp)
+ {
+ 	struct emuframe __user *fr;
+@@ -165,3 +166,9 @@ int do_dsemulret(struct pt_regs *xcp)
+ 
+ 	return 1;
+ }
++#else
++int do_dsemulret(struct pt_regs *xcp)
++{
++	return 0;
++}
++#endif /* CONFIG_MIPS_FPU_EMU */
+--- a/arch/mips/math-emu/kernel_linkage.c
++++ b/arch/mips/math-emu/kernel_linkage.c
+@@ -29,6 +29,7 @@
+ 
+ #define SIGNALLING_NAN 0x7ff800007ff80000LL
+ 
++#ifdef CONFIG_MIPS_FPU_EMU
+ void fpu_emulator_init_fpu(void)
+ {
+ 	static int first = 1;
+@@ -112,4 +113,36 @@ int fpu_emulator_restore_context32(struc
+ 
+ 	return err;
+ }
+-#endif
++#endif	/* CONFIG_64BIT */
++#else
++
++void fpu_emulator_init_fpu(void)
++{
++	printk(KERN_INFO "FPU emulator disabled, make sure your toolchain"
++		"was compiled with software floating point support (soft-float)\n");
++	return;
++}
++
++int fpu_emulator_save_context(struct sigcontext __user *sc)
++{
++	return 0;
++}
++
++int fpu_emulator_restore_context(struct sigcontext __user *sc)
++{
++	return 0;
++}
++
++int fpu_emulator_save_context32(struct sigcontext32 __user *sc)
++{
++	return 0;
++}
++
++int fpu_emulator_restore_context32(struct sigcontext32 __user *sc)
++{
++	return 0;
++}
++
++#ifdef CONFIG_64BIT
++#endif	/* CONFIG_64BIT */
++#endif /* CONFIG_MIPS_FPU_EMU */
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/305-mips_module_reloc.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/305-mips_module_reloc.patch.svn-base
new file mode 100644
index 0000000..b4b142c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/305-mips_module_reloc.patch.svn-base
@@ -0,0 +1,371 @@
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -90,8 +90,8 @@ all-$(CONFIG_SYS_SUPPORTS_ZBOOT)+= vmlin
+ cflags-y			+= -G 0 -mno-abicalls -fno-pic -pipe
+ cflags-y			+= -msoft-float
+ LDFLAGS_vmlinux			+= -G 0 -static -n -nostdlib
+-KBUILD_AFLAGS_MODULE		+= -mlong-calls
+-KBUILD_CFLAGS_MODULE		+= -mlong-calls
++KBUILD_AFLAGS_MODULE		+= -mno-long-calls
++KBUILD_CFLAGS_MODULE		+= -mno-long-calls
+ 
+ cflags-y += -ffreestanding
+ 
+--- a/arch/mips/include/asm/module.h
++++ b/arch/mips/include/asm/module.h
+@@ -9,6 +9,11 @@ struct mod_arch_specific {
+ 	struct list_head dbe_list;
+ 	const struct exception_table_entry *dbe_start;
+ 	const struct exception_table_entry *dbe_end;
++
++	void *phys_plt_tbl;
++	void *virt_plt_tbl;
++	unsigned int phys_plt_offset;
++	unsigned int virt_plt_offset;
+ };
+ 
+ typedef uint8_t Elf64_Byte;		/* Type for a 8-bit quantity.  */
+--- a/arch/mips/kernel/module.c
++++ b/arch/mips/kernel/module.c
+@@ -44,14 +44,219 @@ static struct mips_hi16 *mips_hi16_list;
+ static LIST_HEAD(dbe_list);
+ static DEFINE_SPINLOCK(dbe_lock);
+ 
+-#ifdef MODULE_START
++/*
++ * Get the potential max trampolines size required of the init and
++ * non-init sections. Only used if we cannot find enough contiguous
++ * physically mapped memory to put the module into.
++ */
++static unsigned int
++get_plt_size(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
++             const char *secstrings, unsigned int symindex, bool is_init)
++{
++	unsigned long ret = 0;
++	unsigned int i, j;
++	Elf_Sym *syms;
++
++	/* Everything marked ALLOC (this includes the exported symbols) */
++	for (i = 1; i < hdr->e_shnum; ++i) {
++		unsigned int info = sechdrs[i].sh_info;
++
++		if (sechdrs[i].sh_type != SHT_REL
++		    && sechdrs[i].sh_type != SHT_RELA)
++			continue;
++
++		/* Not a valid relocation section? */
++		if (info >= hdr->e_shnum)
++			continue;
++
++		/* Don't bother with non-allocated sections */
++		if (!(sechdrs[info].sh_flags & SHF_ALLOC))
++			continue;
++
++		/* If it's called *.init*, and we're not init, we're
++                   not interested */
++		if ((strstr(secstrings + sechdrs[i].sh_name, ".init") != 0)
++		    != is_init)
++			continue;
++
++		syms = (Elf_Sym *) sechdrs[symindex].sh_addr;
++		if (sechdrs[i].sh_type == SHT_REL) {
++			Elf_Mips_Rel *rel = (void *) sechdrs[i].sh_addr;
++			unsigned int size = sechdrs[i].sh_size / sizeof(*rel);
++
++			for (j = 0; j < size; ++j) {
++				Elf_Sym *sym;
++
++				if (ELF_MIPS_R_TYPE(rel[j]) != R_MIPS_26)
++					continue;
++
++				sym = syms + ELF_MIPS_R_SYM(rel[j]);
++				if (!is_init && sym->st_shndx != SHN_UNDEF)
++					continue;
++
++				ret += 4 * sizeof(int);
++			}
++		} else {
++			Elf_Mips_Rela *rela = (void *) sechdrs[i].sh_addr;
++			unsigned int size = sechdrs[i].sh_size / sizeof(*rela);
++
++			for (j = 0; j < size; ++j) {
++				Elf_Sym *sym;
++
++				if (ELF_MIPS_R_TYPE(rela[j]) != R_MIPS_26)
++					continue;
++
++				sym = syms + ELF_MIPS_R_SYM(rela[j]);
++				if (!is_init && sym->st_shndx != SHN_UNDEF)
++					continue;
++
++				ret += 4 * sizeof(int);
++			}
++		}
++	}
++
++	return ret;
++}
++
++#ifndef MODULE_START
++static void *alloc_phys(unsigned long size)
++{
++	unsigned order;
++	struct page *page;
++	struct page *p;
++
++	size = PAGE_ALIGN(size);
++	order = get_order(size);
++
++	page = alloc_pages(GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN |
++			__GFP_THISNODE, order);
++	if (!page)
++		return NULL;
++
++	split_page(page, order);
++
++	for (p = page + (size >> PAGE_SHIFT); p < page + (1 << order); ++p)
++		__free_page(p);
++
++	return page_address(page);
++}
++#endif
++
++static void free_phys(void *ptr, unsigned long size)
++{
++	struct page *page;
++	struct page *end;
++
++	page = virt_to_page(ptr);
++	end = page + (PAGE_ALIGN(size) >> PAGE_SHIFT);
++
++	for (; page < end; ++page)
++		__free_page(page);
++}
++
++
+ void *module_alloc(unsigned long size)
+ {
++#ifdef MODULE_START
+ 	return __vmalloc_node_range(size, 1, MODULE_START, MODULE_END,
+ 				GFP_KERNEL, PAGE_KERNEL, -1,
+ 				__builtin_return_address(0));
++#else
++	void *ptr;
++
++	if (size == 0)
++		return NULL;
++
++	ptr = alloc_phys(size);
++
++	/* If we failed to allocate physically contiguous memory,
++	 * fall back to regular vmalloc. The module loader code will
++	 * create jump tables to handle long jumps */
++	if (!ptr)
++		return vmalloc(size);
++
++	return ptr;
++#endif
+ }
++
++static inline bool is_phys_addr(void *ptr)
++{
++#ifdef CONFIG_64BIT
++	return (KSEGX((unsigned long)ptr) == CKSEG0);
++#else
++	return (KSEGX(ptr) == KSEG0);
+ #endif
++}
++
++/* Free memory returned from module_alloc */
++void module_free(struct module *mod, void *module_region)
++{
++	if (is_phys_addr(module_region)) {
++		if (mod->module_init == module_region)
++			free_phys(module_region, mod->init_size);
++		else if (mod->module_core == module_region)
++			free_phys(module_region, mod->core_size);
++		else
++			BUG();
++	} else {
++		vfree(module_region);
++	}
++}
++
++static void *__module_alloc(int size, bool phys)
++{
++	void *ptr;
++
++	if (phys)
++		ptr = kmalloc(size, GFP_KERNEL);
++	else
++		ptr = vmalloc(size);
++	return ptr;
++}
++
++static void __module_free(void *ptr)
++{
++	if (is_phys_addr(ptr))
++		kfree(ptr);
++	else
++		vfree(ptr);
++}
++
++int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
++			      char *secstrings, struct module *mod)
++{
++	unsigned int symindex = 0;
++	unsigned int core_size, init_size;
++	int i;
++
++	for (i = 1; i < hdr->e_shnum; i++)
++		if (sechdrs[i].sh_type == SHT_SYMTAB)
++			symindex = i;
++
++	core_size = get_plt_size(hdr, sechdrs, secstrings, symindex, false);
++	init_size = get_plt_size(hdr, sechdrs, secstrings, symindex, true);
++
++	mod->arch.phys_plt_offset = 0;
++	mod->arch.virt_plt_offset = 0;
++	mod->arch.phys_plt_tbl = NULL;
++	mod->arch.virt_plt_tbl = NULL;
++
++	if ((core_size + init_size) == 0)
++		return 0;
++
++	mod->arch.phys_plt_tbl = __module_alloc(core_size + init_size, 1);
++	if (!mod->arch.phys_plt_tbl)
++		return -ENOMEM;
++
++	mod->arch.virt_plt_tbl = __module_alloc(core_size + init_size, 0);
++	if (!mod->arch.virt_plt_tbl) {
++		__module_free(mod->arch.phys_plt_tbl);
++		mod->arch.phys_plt_tbl = NULL;
++		return -ENOMEM;
++	}
++
++	return 0;
++}
+ 
+ static int apply_r_mips_none(struct module *me, u32 *location, Elf_Addr v)
+ {
+@@ -72,28 +277,36 @@ static int apply_r_mips_32_rela(struct m
+ 	return 0;
+ }
+ 
+-static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
++static Elf_Addr add_plt_entry_to(unsigned *plt_offset,
++				 void *start, Elf_Addr v)
+ {
+-	if (v % 4) {
+-		pr_err("module %s: dangerous R_MIPS_26 REL relocation\n",
+-		       me->name);
+-		return -ENOEXEC;
+-	}
++	unsigned *tramp = start + *plt_offset;
++	*plt_offset += 4 * sizeof(int);
+ 
+-	if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
+-		printk(KERN_ERR
+-		       "module %s: relocation overflow\n",
+-		       me->name);
+-		return -ENOEXEC;
+-	}
++	/* adjust carry for addiu */
++	if (v & 0x00008000)
++		v += 0x10000;
+ 
+-	*location = (*location & ~0x03ffffff) |
+-	            ((*location + (v >> 2)) & 0x03ffffff);
++	tramp[0] = 0x3c190000 | (v >> 16);      /* lui t9, hi16 */
++	tramp[1] = 0x27390000 | (v & 0xffff);   /* addiu t9, t9, lo16 */
++	tramp[2] = 0x03200008;                  /* jr t9 */
++	tramp[3] = 0x00000000;                  /* nop */
+ 
+-	return 0;
++	return (Elf_Addr) tramp;
+ }
+ 
+-static int apply_r_mips_26_rela(struct module *me, u32 *location, Elf_Addr v)
++static Elf_Addr add_plt_entry(struct module *me, void *location, Elf_Addr v)
++{
++	if (is_phys_addr(location))
++		return add_plt_entry_to(&me->arch.phys_plt_offset,
++				me->arch.phys_plt_tbl, v);
++	else
++		return add_plt_entry_to(&me->arch.virt_plt_offset,
++				me->arch.virt_plt_tbl, v);
++
++}
++
++static int set_r_mips_26(struct module *me, u32 *location, u32 ofs, Elf_Addr v)
+ {
+ 	if (v % 4) {
+ 		pr_err("module %s: dangerous R_MIPS_26 RELArelocation\n",
+@@ -102,17 +315,31 @@ static int apply_r_mips_26_rela(struct m
+ 	}
+ 
+ 	if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
+-		printk(KERN_ERR
++	    v = add_plt_entry(me, location, v + (ofs << 2));
++		if (!v) {
++			printk(KERN_ERR
+ 		       "module %s: relocation overflow\n",
+ 		       me->name);
+-		return -ENOEXEC;
++			return -ENOEXEC;
++		}
++		ofs = 0;
+ 	}
+ 
+-	*location = (*location & ~0x03ffffff) | ((v >> 2) & 0x03ffffff);
++	*location = (*location & ~0x03ffffff) | ((ofs + (v >> 2)) & 0x03ffffff);
+ 
+ 	return 0;
+ }
+ 
++static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
++{
++	return set_r_mips_26(me, location, *location & 0x03ffffff, v);
++}
++
++static int apply_r_mips_26_rela(struct module *me, u32 *location, Elf_Addr v)
++{
++	return set_r_mips_26(me, location, 0, v);
++}
++
+ static int apply_r_mips_hi16_rel(struct module *me, u32 *location, Elf_Addr v)
+ {
+ 	struct mips_hi16 *n;
+@@ -380,11 +607,32 @@ int module_finalize(const Elf_Ehdr *hdr,
+ 		list_add(&me->arch.dbe_list, &dbe_list);
+ 		spin_unlock_irq(&dbe_lock);
+ 	}
++
++	/* Get rid of the fixup trampoline if we're running the module
++	 * from physically mapped address space */
++	if (me->arch.phys_plt_offset == 0) {
++		__module_free(me->arch.phys_plt_tbl);
++		me->arch.phys_plt_tbl = NULL;
++	}
++	if (me->arch.virt_plt_offset == 0) {
++		__module_free(me->arch.virt_plt_tbl);
++		me->arch.virt_plt_tbl = NULL;
++	}
++
+ 	return 0;
+ }
+ 
+ void module_arch_cleanup(struct module *mod)
+ {
++	if (mod->arch.phys_plt_tbl) {
++		__module_free(mod->arch.phys_plt_tbl);
++		mod->arch.phys_plt_tbl = NULL;
++	}
++	if (mod->arch.virt_plt_tbl) {
++		__module_free(mod->arch.virt_plt_tbl);
++		mod->arch.virt_plt_tbl = NULL;
++	}
++
+ 	spin_lock_irq(&dbe_lock);
+ 	list_del(&mod->arch.dbe_list);
+ 	spin_unlock_irq(&dbe_lock);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/306-mips_mem_functions_performance.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/306-mips_mem_functions_performance.patch.svn-base
new file mode 100644
index 0000000..e432471
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/306-mips_mem_functions_performance.patch.svn-base
@@ -0,0 +1,83 @@
+--- a/arch/mips/include/asm/string.h
++++ b/arch/mips/include/asm/string.h
+@@ -133,11 +133,44 @@ strncmp(__const__ char *__cs, __const__
+ 
+ #define __HAVE_ARCH_MEMSET
+ extern void *memset(void *__s, int __c, size_t __count);
++#define memset(__s, __c, len)					\
++({								\
++	size_t __len = (len);					\
++	void *__ret;						\
++	if (__builtin_constant_p(len) && __len >= 64)		\
++		__ret = memset((__s), (__c), __len);		\
++	else							\
++		__ret = __builtin_memset((__s), (__c), __len);	\
++	__ret;							\
++})
+ 
+ #define __HAVE_ARCH_MEMCPY
+ extern void *memcpy(void *__to, __const__ void *__from, size_t __n);
++#define memcpy(dst, src, len)					\
++({								\
++	size_t __len = (len);					\
++	void *__ret;						\
++	if (__builtin_constant_p(len) && __len >= 64)		\
++		__ret = memcpy((dst), (src), __len);		\
++	else							\
++		__ret = __builtin_memcpy((dst), (src), __len);	\
++	__ret;							\
++})
+ 
+ #define __HAVE_ARCH_MEMMOVE
+ extern void *memmove(void *__dest, __const__ void *__src, size_t __n);
++#define memmove(dst, src, len)					\
++({								\
++	size_t __len = (len);					\
++	void *__ret;						\
++	if (__builtin_constant_p(len) && __len >= 64)		\
++		__ret = memmove((dst), (src), __len);		\
++	else							\
++		__ret = __builtin_memmove((dst), (src), __len);	\
++	__ret;							\
++})
++
++#define __HAVE_ARCH_MEMCMP
++#define memcmp(src1, src2, len) __builtin_memcmp((src1), (src2), (len))
+ 
+ #endif /* _ASM_STRING_H */
+--- a/arch/mips/lib/Makefile
++++ b/arch/mips/lib/Makefile
+@@ -3,7 +3,7 @@
+ #
+ 
+ lib-y	+= csum_partial.o delay.o memcpy.o memcpy-inatomic.o memset.o \
+-	   strlen_user.o strncpy_user.o strnlen_user.o uncached.o
++	   strlen_user.o strncpy_user.o strnlen_user.o uncached.o memcmp.o
+ 
+ obj-y			+= iomap.o
+ obj-$(CONFIG_PCI)	+= iomap-pci.o
+--- /dev/null
++++ b/arch/mips/lib/memcmp.c
+@@ -0,0 +1,22 @@
++/*
++ *  copied from linux/lib/string.c
++ *
++ *  Copyright (C) 1991, 1992  Linus Torvalds
++ */
++
++#include <linux/module.h>
++#include <linux/string.h>
++
++#undef memcmp
++int memcmp(const void *cs, const void *ct, size_t count)
++{
++	const unsigned char *su1, *su2;
++	int res = 0;
++
++	for (su1 = cs, su2 = ct; 0 < count; ++su1, ++su2, count--)
++		if ((res = *su1 - *su2) != 0)
++			break;
++	return res;
++}
++EXPORT_SYMBOL(memcmp);
++
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/307-mips_oprofile_fix.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/307-mips_oprofile_fix.patch.svn-base
new file mode 100644
index 0000000..f83c96b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/307-mips_oprofile_fix.patch.svn-base
@@ -0,0 +1,35 @@
+--- a/arch/mips/oprofile/op_model_mipsxx.c
++++ b/arch/mips/oprofile/op_model_mipsxx.c
+@@ -298,6 +298,11 @@ static void reset_counters(void *arg)
+ 	}
+ }
+ 
++static irqreturn_t mipsxx_perfcount_int(int irq, void *dev_id)
++{
++	return mipsxx_perfcount_handler();
++}
++
+ static int __init mipsxx_init(void)
+ {
+ 	int counters;
+@@ -374,6 +379,10 @@ static int __init mipsxx_init(void)
+ 	save_perf_irq = perf_irq;
+ 	perf_irq = mipsxx_perfcount_handler;
+ 
++	if (cp0_perfcount_irq >= 0)
++		return request_irq(cp0_perfcount_irq, mipsxx_perfcount_int,
++			IRQF_SHARED, "Perfcounter", save_perf_irq);
++
+ 	return 0;
+ }
+ 
+@@ -381,6 +390,9 @@ static void mipsxx_exit(void)
+ {
+ 	int counters = op_model_mipsxx_ops.num_counters;
+ 
++	if (cp0_perfcount_irq >= 0)
++		free_irq(cp0_perfcount_irq, save_perf_irq);
++
+ 	counters = counters_per_cpu_to_total(counters);
+ 	on_each_cpu(reset_counters, (void *)(long)counters, 1);
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/308-mips-show-correct-cpu-name-for-24KEc.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/308-mips-show-correct-cpu-name-for-24KEc.patch.svn-base
new file mode 100644
index 0000000..ac6304a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/308-mips-show-correct-cpu-name-for-24KEc.patch.svn-base
@@ -0,0 +1,17 @@
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -816,10 +816,13 @@ static inline void cpu_probe_mips(struct
+ 		__cpu_name[cpu] = "MIPS 20Kc";
+ 		break;
+ 	case PRID_IMP_24K:
+-	case PRID_IMP_24KE:
+ 		c->cputype = CPU_24K;
+ 		__cpu_name[cpu] = "MIPS 24Kc";
+ 		break;
++	case PRID_IMP_24KE:
++		c->cputype = CPU_24K;
++		__cpu_name[cpu] = "MIPS 24KEc";
++		break;
+ 	case PRID_IMP_25KF:
+ 		c->cputype = CPU_25KF;
+ 		__cpu_name[cpu] = "MIPS 25Kc";
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/309-mips_fuse_workaround.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/309-mips_fuse_workaround.patch.svn-base
new file mode 100644
index 0000000..78ab64f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/309-mips_fuse_workaround.patch.svn-base
@@ -0,0 +1,32 @@
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -39,6 +39,7 @@ void (*__flush_kernel_vmap_range)(unsign
+ void (*__invalidate_kernel_vmap_range)(unsigned long vaddr, int size);
+ 
+ EXPORT_SYMBOL_GPL(__flush_kernel_vmap_range);
++EXPORT_SYMBOL(__flush_cache_all);
+ 
+ /* MIPS specific cache operations */
+ void (*flush_cache_sigtramp)(unsigned long addr);
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -19,6 +19,9 @@
+ #include <linux/pipe_fs_i.h>
+ #include <linux/swap.h>
+ #include <linux/splice.h>
++#ifdef CONFIG_MIPS
++#include <asm/cacheflush.h>
++#endif
+ 
+ MODULE_ALIAS_MISCDEV(FUSE_MINOR);
+ MODULE_ALIAS("devname:fuse");
+@@ -655,6 +658,9 @@ static int fuse_copy_fill(struct fuse_co
+ static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
+ {
+ 	unsigned ncpy = min(*size, cs->len);
++#ifdef CONFIG_MIPS
++	__flush_cache_all();
++#endif
+ 	if (val) {
+ 		if (cs->write)
+ 			memcpy(cs->buf, *val, ncpy);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/310-arm_module_unresolved_weak_sym.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/310-arm_module_unresolved_weak_sym.patch.svn-base
new file mode 100644
index 0000000..d1eba55
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/310-arm_module_unresolved_weak_sym.patch.svn-base
@@ -0,0 +1,13 @@
+--- a/arch/arm/kernel/module.c
++++ b/arch/arm/kernel/module.c
+@@ -81,6 +81,10 @@ apply_relocate(Elf32_Shdr *sechdrs, cons
+ 			return -ENOEXEC;
+ 		}
+ 
++		if ((IS_ERR_VALUE(sym->st_value) || !sym->st_value) &&
++		    ELF_ST_BIND(sym->st_info) == STB_WEAK)
++			continue;
++
+ 		loc = dstsec->sh_addr + rel->r_offset;
+ 
+ 		switch (ELF32_R_TYPE(rel->r_info)) {
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/320-ppc4xx_optimization.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/320-ppc4xx_optimization.patch.svn-base
new file mode 100644
index 0000000..3f67f1b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/320-ppc4xx_optimization.patch.svn-base
@@ -0,0 +1,31 @@
+Upstream doesn't optimize the kernel and bootwrappers for ppc44x because
+they still want to support gcc 3.3 -- well, we don't.
+
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -130,7 +130,8 @@ ifeq ($(CONFIG_FUNCTION_TRACER),y)
+ KBUILD_CFLAGS		+= -mno-sched-epilog
+ endif
+ 
+-cpu-as-$(CONFIG_4xx)		+= -Wa,-m405
++cpu-as-$(CONFIG_40x)		+= -Wa,-m405
++cpu-as-$(CONFIG_44x)		+= -Wa,-m440
+ cpu-as-$(CONFIG_ALTIVEC)	+= -Wa,-maltivec
+ cpu-as-$(CONFIG_E500)		+= -Wa,-me500
+ cpu-as-$(CONFIG_E200)		+= -Wa,-me200
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -38,10 +38,10 @@ BOOTCFLAGS	+= -I$(obj) -I$(srctree)/$(ob
+ DTC_FLAGS	?= -p 1024
+ 
+ $(obj)/4xx.o: BOOTCFLAGS += -mcpu=405
+-$(obj)/ebony.o: BOOTCFLAGS += -mcpu=405
++$(obj)/ebony.o: BOOTCFLAGS += -mcpu=440
+ $(obj)/cuboot-hotfoot.o: BOOTCFLAGS += -mcpu=405
+-$(obj)/cuboot-taishan.o: BOOTCFLAGS += -mcpu=405
+-$(obj)/cuboot-katmai.o: BOOTCFLAGS += -mcpu=405
++$(obj)/cuboot-taishan.o: BOOTCFLAGS += -mcpu=440
++$(obj)/cuboot-katmai.o: BOOTCFLAGS += -mcpu=440
+ $(obj)/cuboot-acadia.o: BOOTCFLAGS += -mcpu=405
+ $(obj)/treeboot-walnut.o: BOOTCFLAGS += -mcpu=405
+ $(obj)/treeboot-iss4xx.o: BOOTCFLAGS += -mcpu=405
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/321-powerpc_crtsavres_prereq.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/321-powerpc_crtsavres_prereq.patch.svn-base
new file mode 100644
index 0000000..941aa90
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/321-powerpc_crtsavres_prereq.patch.svn-base
@@ -0,0 +1,10 @@
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -94,7 +94,6 @@ else
+ endif
+ endif
+ 
+-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
+ 
+ ifeq ($(CONFIG_TUNE_CELL),y)
+ 	KBUILD_CFLAGS += $(call cc-option,-mtune=cell)
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/322-ppc4xx-crypto-compile-fix.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/322-ppc4xx-crypto-compile-fix.patch.svn-base
new file mode 100644
index 0000000..226e411
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/322-ppc4xx-crypto-compile-fix.patch.svn-base
@@ -0,0 +1,10 @@
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -19,6 +19,7 @@
+  */
+ 
+ #include <linux/kernel.h>
++#include <linux/module.h>
+ #include <linux/interrupt.h>
+ #include <linux/spinlock_types.h>
+ #include <linux/random.h>
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/330-mips-add-crash-and-kdump-support.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/330-mips-add-crash-and-kdump-support.patch.svn-base
new file mode 100644
index 0000000..7a79c41
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/330-mips-add-crash-and-kdump-support.patch.svn-base
@@ -0,0 +1,616 @@
+From eee16330c9de9adf7880cce9f1d32e13f89706bb Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Tue, 11 Jan 2011 13:16:47 +0000
+Subject: MIPS: Add crash and kdump support
+
+From: http://patchwork.linux-mips.org/patch/1025/
+
+Hello folks,
+
+Please find here MIPS crash and kdump patches.
+This is patch set of 3 patches:
+1. generic MIPS changes (kernel);
+2. MIPS Cavium Octeon board kexec/kdump code (kernel);
+3. Kexec user space MIPS changes.
+
+Patches were tested on the latest linux-mips@ git kernel and the latest
+kexec-tools git on Cavium Octeon 50xx board.
+
+I also made the same code working on RMI XLR/XLS boards for both
+mips32 and mips64 kernels.
+
+Best regards,
+Maxim Uvarov.
+
+------
+[ Zhangjin: Several trivial building failure has been fixed.
+
+Note: the 2nd patch can not be cleanly applied, but may be a good
+reference for the other board development:
+
+	+ MIPS Cavium Octeon board kexec,kdump support
+	http://patchwork.linux-mips.org/patch/1026/
+
+And the 3rd patch has already been merged into the mainline kexec-tools:
+
+	+ some kexec MIPS improvements
+	http://patchwork.linux-mips.org/patch/1027/
+
+kexec-tools is available here:
+
+	+ http://horms.net/projects/kexec/
+	git://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git
+]
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+(limited to 'arch/mips/kernel')
+
+--- a/arch/mips/kernel/Makefile
++++ b/arch/mips/kernel/Makefile
+@@ -97,7 +97,8 @@ obj-$(CONFIG_I8253)		+= i8253.o
+ 
+ obj-$(CONFIG_GPIO_TXX9)		+= gpio_txx9.o
+ 
+-obj-$(CONFIG_KEXEC)		+= machine_kexec.o relocate_kernel.o
++obj-$(CONFIG_KEXEC)		+= machine_kexec.o relocate_kernel.o crash.o
++obj-$(CONFIG_CRASH_DUMP)	+= crash_dump.o
+ obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
+ obj-$(CONFIG_SPINLOCK_TEST)	+= spinlock_test.o
+ obj-$(CONFIG_MIPS_MACHINE)	+= mips_machine.o
+--- /dev/null
++++ b/arch/mips/kernel/crash.c
+@@ -0,0 +1,75 @@
++#include <linux/kernel.h>
++#include <linux/smp.h>
++#include <linux/reboot.h>
++#include <linux/kexec.h>
++#include <linux/bootmem.h>
++#include <linux/crash_dump.h>
++#include <linux/delay.h>
++#include <linux/init.h>
++#include <linux/irq.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++
++#ifdef CONFIG_CRASH_DUMP
++unsigned long long elfcorehdr_addr = ELFCORE_ADDR_MAX;
++#endif
++
++/* This keeps a track of which one is crashing cpu. */
++int crashing_cpu = -1;
++static cpumask_t cpus_in_crash = CPU_MASK_NONE;
++
++#ifdef CONFIG_SMP
++void crash_shutdown_secondary(void *ignore)
++{
++	struct pt_regs *regs;
++	int cpu = smp_processor_id();
++
++	regs = task_pt_regs(current);
++
++	if (!cpu_online(cpu))
++		return;
++
++	local_irq_disable();
++	if (!cpu_isset(cpu, cpus_in_crash))
++		crash_save_cpu(regs, cpu);
++	cpu_set(cpu, cpus_in_crash);
++
++	while (!atomic_read(&kexec_ready_to_reboot))
++		cpu_relax();
++	relocated_kexec_smp_wait(NULL);
++	/* NOTREACHED */
++}
++
++static void crash_kexec_prepare_cpus(void)
++{
++	unsigned int msecs;
++
++	unsigned int ncpus = num_online_cpus() - 1;/* Excluding the panic cpu */
++
++	dump_send_ipi(crash_shutdown_secondary);
++	smp_wmb();
++
++	/*
++	 * The crash CPU sends an IPI and wait for other CPUs to
++	 * respond. Delay of at least 10 seconds.
++	 */
++	printk(KERN_EMERG "Sending IPI to other cpus...\n");
++	msecs = 10000;
++	while ((cpus_weight(cpus_in_crash) < ncpus) && (--msecs > 0)) {
++		cpu_relax();
++		mdelay(1);
++	}
++}
++
++#else
++static void crash_kexec_prepare_cpus(void) {}
++#endif
++
++void default_machine_crash_shutdown(struct pt_regs *regs)
++{
++	local_irq_disable();
++	crashing_cpu = smp_processor_id();
++	crash_save_cpu(regs, crashing_cpu);
++	crash_kexec_prepare_cpus();
++	cpu_set(crashing_cpu, cpus_in_crash);
++}
+--- /dev/null
++++ b/arch/mips/kernel/crash_dump.c
+@@ -0,0 +1,86 @@
++#include <linux/highmem.h>
++#include <linux/bootmem.h>
++#include <linux/crash_dump.h>
++#include <asm/uaccess.h>
++
++#ifdef CONFIG_PROC_VMCORE
++static int __init parse_elfcorehdr(char *p)
++{
++	if (p)
++		elfcorehdr_addr = memparse(p, &p);
++	return 1;
++}
++__setup("elfcorehdr=", parse_elfcorehdr);
++#endif
++
++static int __init parse_savemaxmem(char *p)
++{
++	if (p)
++		saved_max_pfn = (memparse(p, &p) >> PAGE_SHIFT) - 1;
++
++	return 1;
++}
++__setup("savemaxmem=", parse_savemaxmem);
++
++
++static void *kdump_buf_page;
++
++/**
++ * copy_oldmem_page - copy one page from "oldmem"
++ * @pfn: page frame number to be copied
++ * @buf: target memory address for the copy; this can be in kernel address
++ *	space or user address space (see @userbuf)
++ * @csize: number of bytes to copy
++ * @offset: offset in bytes into the page (based on pfn) to begin the copy
++ * @userbuf: if set, @buf is in user address space, use copy_to_user(),
++ *	otherwise @buf is in kernel address space, use memcpy().
++ *
++ * Copy a page from "oldmem". For this page, there is no pte mapped
++ * in the current kernel.
++ *
++ * Calling copy_to_user() in atomic context is not desirable. Hence first
++ * copying the data to a pre-allocated kernel page and then copying to user
++ * space in non-atomic context.
++ */
++ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
++		size_t csize, unsigned long offset, int userbuf)
++{
++	void  *vaddr;
++
++	if (!csize)
++		return 0;
++
++	vaddr = kmap_atomic_pfn(pfn, KM_PTE0);
++
++	if (!userbuf) {
++		memcpy(buf, (vaddr + offset), csize);
++		kunmap_atomic(vaddr, KM_PTE0);
++	} else {
++		if (!kdump_buf_page) {
++			printk(KERN_WARNING "Kdump: Kdump buffer page not"
++				" allocated\n");
++			return -EFAULT;
++		}
++		copy_page(kdump_buf_page, vaddr);
++		kunmap_atomic(vaddr, KM_PTE0);
++		if (copy_to_user(buf, (kdump_buf_page + offset), csize))
++			return -EFAULT;
++	}
++
++	return csize;
++}
++
++static int __init kdump_buf_page_init(void)
++{
++	int ret = 0;
++
++	kdump_buf_page = kmalloc(PAGE_SIZE, GFP_KERNEL);
++	if (!kdump_buf_page) {
++		printk(KERN_WARNING "Kdump: Failed to allocate kdump buffer"
++			 " page\n");
++		ret = -ENOMEM;
++	}
++
++	return ret;
++}
++arch_initcall(kdump_buf_page_init);
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -19,9 +19,19 @@ extern const size_t relocate_new_kernel_
+ extern unsigned long kexec_start_address;
+ extern unsigned long kexec_indirection_page;
+ 
++int (*_machine_kexec_prepare)(struct kimage *) = NULL;
++void (*_machine_kexec_shutdown)(void) = NULL;
++void (*_machine_crash_shutdown)(struct pt_regs *regs) = NULL;
++#ifdef CONFIG_SMP
++void (*relocated_kexec_smp_wait) (void *);
++atomic_t kexec_ready_to_reboot = ATOMIC_INIT(0);
++#endif
++
+ int
+ machine_kexec_prepare(struct kimage *kimage)
+ {
++	if (_machine_kexec_prepare)
++		return _machine_kexec_prepare(kimage);
+ 	return 0;
+ }
+ 
+@@ -33,11 +43,17 @@ machine_kexec_cleanup(struct kimage *kim
+ void
+ machine_shutdown(void)
+ {
++	if (_machine_kexec_shutdown)
++		_machine_kexec_shutdown();
+ }
+ 
+ void
+ machine_crash_shutdown(struct pt_regs *regs)
+ {
++	if (_machine_crash_shutdown)
++		_machine_crash_shutdown(regs);
++	else
++		default_machine_crash_shutdown(regs);
+ }
+ 
+ typedef void (*noretfun_t)(void) __attribute__((noreturn));
+@@ -52,7 +68,9 @@ machine_kexec(struct kimage *image)
+ 	reboot_code_buffer =
+ 	  (unsigned long)page_address(image->control_code_page);
+ 
+-	kexec_start_address = (unsigned long) phys_to_virt(image->start);
++	kexec_start_address =
++	  (unsigned long) phys_to_virt(image->start);
++
+ 	kexec_indirection_page =
+ 		(unsigned long) phys_to_virt(image->head & PAGE_MASK);
+ 
+@@ -63,7 +81,7 @@ machine_kexec(struct kimage *image)
+ 	 * The generic kexec code builds a page list with physical
+ 	 * addresses. they are directly accessible through KSEG0 (or
+ 	 * CKSEG0 or XPHYS if on 64bit system), hence the
+-	 * pys_to_virt() call.
++	 * phys_to_virt() call.
+ 	 */
+ 	for (ptr = &image->head; (entry = *ptr) && !(entry &IND_DONE);
+ 	     ptr = (entry & IND_INDIRECTION) ?
+@@ -81,5 +99,13 @@ machine_kexec(struct kimage *image)
+ 	printk("Will call new kernel at %08lx\n", image->start);
+ 	printk("Bye ...\n");
+ 	__flush_cache_all();
++#ifdef CONFIG_SMP
++	/* All secondary cpus now may jump to kexec_wait cycle */
++	relocated_kexec_smp_wait = reboot_code_buffer +
++		(void *)(kexec_smp_wait - relocate_new_kernel);
++	smp_wmb();
++	atomic_set(&kexec_ready_to_reboot, 1);
++#endif
+ 	((noretfun_t) reboot_code_buffer)();
+ }
++
+--- a/arch/mips/kernel/relocate_kernel.S
++++ b/arch/mips/kernel/relocate_kernel.S
+@@ -15,6 +15,11 @@
+ #include <asm/addrspace.h>
+ 
+ LEAF(relocate_new_kernel)
++	PTR_L a0,	arg0
++	PTR_L a1,	arg1
++	PTR_L a2,	arg2
++	PTR_L a3,	arg3
++
+ 	PTR_L		s0, kexec_indirection_page
+ 	PTR_L		s1, kexec_start_address
+ 
+@@ -26,7 +31,6 @@ process_entry:
+ 	and		s3, s2, 0x1
+ 	beq		s3, zero, 1f
+ 	and		s4, s2, ~0x1	/* store destination addr in s4 */
+-	move		a0, s4
+ 	b		process_entry
+ 
+ 1:
+@@ -60,23 +64,100 @@ copy_word:
+ 	b		process_entry
+ 
+ done:
++#ifdef CONFIG_SMP
++	/* kexec_flag reset is signal to other CPUs what kernel
++ 	   was moved to it's location. Note - we need relocated address
++ 	   of kexec_flag.  */
++
++ 	bal		1f
++ 1: 	move		t1,ra;
++ 	PTR_LA		t2,1b
++ 	PTR_LA		t0,kexec_flag
++ 	PTR_SUB		t0,t0,t2;
++ 	PTR_ADD		t0,t1,t0;
++ 	LONG_S		zero,(t0)
++#endif
++
++	sync
+ 	/* jump to kexec_start_address */
+ 	j		s1
+ 	END(relocate_new_kernel)
+ 
+-kexec_start_address:
+-	EXPORT(kexec_start_address)
++#ifdef CONFIG_SMP
++/*
++ * Other CPUs should wait until code is relocated and
++ * then start at entry (?) point.
++ */
++LEAF(kexec_smp_wait)
++	PTR_L		a0, s_arg0
++	PTR_L		a1, s_arg1
++	PTR_L		a2, s_arg2
++	PTR_L		a3, s_arg3
++	PTR_L		s1, kexec_start_address
++
++	/* Non-relocated address works for args and kexec_start_address ( old
++	 * kernel is not overwritten). But we need relocated address of
++	 * kexec_flag.
++	 */
++
++	bal		1f
++1:	move		t1,ra;
++	PTR_LA		t2,1b
++	PTR_LA		t0,kexec_flag
++	PTR_SUB		t0,t0,t2;
++	PTR_ADD		t0,t1,t0;
++
++1:	LONG_L		s0, (t0)
++	bne		s0, zero,1b
++
++	sync
++	j		s1
++	END(kexec_smp_wait)
++#endif
++
++#ifdef __mips64
++       /* all PTR's must be aligned to 8 byte in 64-bit mode */
++       .align  3
++#endif
++
++/* All parameters to new kernel are passed in registers a0-a3.
++ * kexec_args[0..3] are uses to prepare register values.
++ */
++
++EXPORT(kexec_args)
++arg0:	PTR		0x0
++arg1:	PTR		0x0
++arg2:	PTR		0x0
++arg3:	PTR		0x0
++	.size	kexec_args,PTRSIZE*4
++
++#ifdef CONFIG_SMP
++/*
++ * Secondary CPUs may have different kernel parameters in
++ * their registers a0-a3. secondary_kexec_args[0..3] are used
++ * to prepare register values.
++ */
++EXPORT(secondary_kexec_args)
++s_arg0:	PTR		0x0
++s_arg1:	PTR		0x0
++s_arg2:	PTR		0x0
++s_arg3:	PTR		0x0
++	.size	secondary_kexec_args,PTRSIZE*4
++kexec_flag:
++	LONG		0x1
++
++#endif
++
++EXPORT(kexec_start_address)
+ 	PTR		0x0
+ 	.size		kexec_start_address, PTRSIZE
+ 
+-kexec_indirection_page:
+-	EXPORT(kexec_indirection_page)
++EXPORT(kexec_indirection_page)
+ 	PTR		0
+ 	.size		kexec_indirection_page, PTRSIZE
+ 
+ relocate_new_kernel_end:
+ 
+-relocate_new_kernel_size:
+-	EXPORT(relocate_new_kernel_size)
++EXPORT(relocate_new_kernel_size)
+ 	PTR		relocate_new_kernel_end - relocate_new_kernel
+ 	.size		relocate_new_kernel_size, PTRSIZE
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -22,6 +22,7 @@
+ #include <linux/console.h>
+ #include <linux/pfn.h>
+ #include <linux/debugfs.h>
++#include <linux/kexec.h>
+ 
+ #include <asm/addrspace.h>
+ #include <asm/bootinfo.h>
+@@ -523,12 +524,62 @@ static void __init arch_mem_init(char **
+ 	}
+ 
+ 	bootmem_init();
++#ifdef CONFIG_KEXEC
++	if (crashk_res.start != crashk_res.end)
++		reserve_bootmem(crashk_res.start,
++			crashk_res.end - crashk_res.start + 1,
++			BOOTMEM_DEFAULT);
++#endif
+ 	device_tree_init();
+ 	sparse_init();
+ 	plat_swiotlb_setup();
+ 	paging_init();
+ }
+ 
++#ifdef CONFIG_KEXEC
++static inline unsigned long long get_total_mem(void)
++{
++	unsigned long long total;
++	total = max_pfn - min_low_pfn;
++	return total << PAGE_SHIFT;
++}
++
++static void __init mips_parse_crashkernel(void)
++{
++	unsigned long long total_mem;
++	unsigned long long crash_size, crash_base;
++	int ret;
++
++	total_mem = get_total_mem();
++	ret = parse_crashkernel(boot_command_line, total_mem,
++			&crash_size, &crash_base);
++	if (ret != 0 || crash_size <= 0)
++		return;
++
++	crashk_res.start = crash_base;
++	crashk_res.end   = crash_base + crash_size - 1;
++}
++static void __init request_crashkernel(struct resource *res)
++{
++	int ret;
++
++	ret = request_resource(res, &crashk_res);
++	if (!ret)
++		printk(KERN_INFO "Reserving %ldMB of memory at %ldMB "
++			"for crashkernel\n",
++			(unsigned long)((crashk_res.end -
++				crashk_res.start + 1) >> 20),
++			(unsigned long)(crashk_res.start  >> 20));
++}
++#else
++static void __init mips_parse_crashkernel(void)
++{
++}
++static void __init request_crashkernel(struct resource *res)
++{
++}
++#endif
++
+ static void __init resource_init(void)
+ {
+ 	int i;
+@@ -544,6 +595,8 @@ static void __init resource_init(void)
+ 	/*
+ 	 * Request address space for all standard RAM.
+ 	 */
++	mips_parse_crashkernel();
++
+ 	for (i = 0; i < boot_mem_map.nr_map; i++) {
+ 		struct resource *res;
+ 		unsigned long start, end;
+@@ -580,6 +633,7 @@ static void __init resource_init(void)
+ 		 */
+ 		request_resource(res, &code_resource);
+ 		request_resource(res, &data_resource);
++		request_crashkernel(res);
+ 	}
+ }
+ 
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -433,3 +433,21 @@ void flush_tlb_one(unsigned long vaddr)
+ 
+ EXPORT_SYMBOL(flush_tlb_page);
+ EXPORT_SYMBOL(flush_tlb_one);
++
++#if defined(CONFIG_KEXEC)
++void (*dump_ipi_function_ptr)(void *) = NULL;
++void dump_send_ipi(void (*dump_ipi_callback)(void *))
++{
++	int i;
++	int cpu = smp_processor_id();
++
++	dump_ipi_function_ptr = dump_ipi_callback;
++	smp_mb();
++	for_each_online_cpu(i)
++		if (i != cpu)
++			core_send_ipi(i, SMP_DUMP);
++
++}
++EXPORT_SYMBOL(dump_send_ipi);
++#endif
++
+--- a/arch/mips/include/asm/kexec.h
++++ b/arch/mips/include/asm/kexec.h
+@@ -9,22 +9,45 @@
+ #ifndef _MIPS_KEXEC
+ # define _MIPS_KEXEC
+ 
++#include <asm/stacktrace.h>
++
++extern unsigned long long elfcorehdr_addr;
++
+ /* Maximum physical address we can use pages from */
+ #define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000)
+ /* Maximum address we can reach in physical address mode */
+ #define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000)
+  /* Maximum address we can use for the control code buffer */
+ #define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000)
+-
+-#define KEXEC_CONTROL_PAGE_SIZE 4096
++/* Reserve 3*4096 bytes for board-specific info */
++#define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096)
+ 
+ /* The native architecture */
+ #define KEXEC_ARCH KEXEC_ARCH_MIPS
++#define MAX_NOTE_BYTES 1024
+ 
+ static inline void crash_setup_regs(struct pt_regs *newregs,
+-				    struct pt_regs *oldregs)
++					struct pt_regs *oldregs)
+ {
+-	/* Dummy implementation for now */
++	if (oldregs)
++		memcpy(newregs, oldregs, sizeof(*newregs));
++	else
++		prepare_frametrace(newregs);
+ }
+ 
++#ifdef CONFIG_KEXEC
++struct kimage;
++extern unsigned long kexec_args[4];
++extern int (*_machine_kexec_prepare)(struct kimage *);
++extern void (*_machine_kexec_shutdown)(void);
++extern void (*_machine_crash_shutdown)(struct pt_regs *regs);
++extern void default_machine_crash_shutdown(struct pt_regs *regs);
++#ifdef CONFIG_SMP
++extern const unsigned char kexec_smp_wait[];
++extern unsigned long secondary_kexec_args[4];
++extern void (*relocated_kexec_smp_wait) (void *);
++extern atomic_t kexec_ready_to_reboot;
++#endif
++#endif
++
+ #endif /* !_MIPS_KEXEC */
+--- a/arch/mips/include/asm/smp.h
++++ b/arch/mips/include/asm/smp.h
+@@ -40,6 +40,8 @@ extern int __cpu_logical_map[NR_CPUS];
+ #define SMP_CALL_FUNCTION	0x2
+ /* Octeon - Tell another core to flush its icache */
+ #define SMP_ICACHE_FLUSH	0x4
++/* Used by kexec crashdump to save all cpu's state */
++#define SMP_DUMP		0x8
+ 
+ extern volatile cpumask_t cpu_callin_map;
+ 
+@@ -91,4 +93,9 @@ static inline void arch_send_call_functi
+ 	mp_ops->send_ipi_mask(mask, SMP_CALL_FUNCTION);
+ }
+ 
++extern void core_send_ipi(int cpu, unsigned int action);
++#if defined(CONFIG_KEXEC)
++extern void (*dump_ipi_function_ptr)(void *);
++void dump_send_ipi(void (*dump_ipi_callback)(void *));
++#endif
+ #endif /* __ASM_SMP_H */
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/331-mips-kexec-enhanche-the-support.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/331-mips-kexec-enhanche-the-support.patch.svn-base
new file mode 100644
index 0000000..21bbeed
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/331-mips-kexec-enhanche-the-support.patch.svn-base
@@ -0,0 +1,157 @@
+From 03cd81fbca6b91317ec1a7b3b3c09fb8d08f83a6 Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Tue, 11 Jan 2011 18:42:08 +0000
+Subject: MIPS: Kexec: Enhance the support
+
+Changes:
+  o Print more information in machine_kexec() for debugging
+    E.g. with this information, the kexec_start_address has been found
+    it was wrong with 64bit kernel / o32 kexec-tools. Which must be
+    fixed later.
+  o Link relocate_kernel.S to a section for future extension
+    This allows more functions can be added for the kexec relocation
+    part even written in C. to add code into that section, you just need
+    to mark your function or data with __kexec or
+    __attribute__((__section__(".__kexec.relocate")))
+
+TODO:
+
+1. Make 64bit kernel / o32|n32|64 kexec-tools works
+
+Fix the user-space kexec-tools, seems the tool only work for 32bit
+machine. So, we need to add 64bit support for it. The address of the
+entry point(kexec_start_address) is wrong and make the "kexec -e" fail.
+the real entry point must be read from the new kernel image by the
+user-space kexec-tools, otherwise, it will not work.  The above 64bit
+support tested is 64bit kernel with o32 user-space kexec-tools. The root
+cause may be the different definition of virt_to_phys() and
+phys_to_virt() in the kexec-tools and kernel space for 64bit system /
+o32 kernel.
+
+Ref: http://www.linux-mips.org/archives/linux-mips/2009-08/msg00149.html
+
+2. Pass the arguments from kexec-tools to the new kernel image
+
+Please refer to: "MIPS: Loongson: Kexec: Pass parameters to new kernel"
+
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+--- a/arch/mips/include/asm/kexec.h
++++ b/arch/mips/include/asm/kexec.h
+@@ -36,6 +36,16 @@ static inline void crash_setup_regs(stru
+ }
+ 
+ #ifdef CONFIG_KEXEC
++
++#define __kexec __attribute__((__section__(".__kexec.relocate")))
++
++/* The linker tells us where the relocate_new_kernel part is. */
++extern const unsigned char __start___kexec_relocate;
++extern const unsigned char __end___kexec_relocate;
++
++extern unsigned long kexec_start_address;
++extern unsigned long kexec_indirection_page;
++
+ struct kimage;
+ extern unsigned long kexec_args[4];
+ extern int (*_machine_kexec_prepare)(struct kimage *);
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -14,10 +14,6 @@
+ #include <asm/page.h>
+ 
+ extern const unsigned char relocate_new_kernel[];
+-extern const size_t relocate_new_kernel_size;
+-
+-extern unsigned long kexec_start_address;
+-extern unsigned long kexec_indirection_page;
+ 
+ int (*_machine_kexec_prepare)(struct kimage *) = NULL;
+ void (*_machine_kexec_shutdown)(void) = NULL;
+@@ -61,21 +57,34 @@ typedef void (*noretfun_t)(void) __attri
+ void
+ machine_kexec(struct kimage *image)
+ {
++	unsigned long kexec_relocate_size;
+ 	unsigned long reboot_code_buffer;
+ 	unsigned long entry;
+ 	unsigned long *ptr;
+ 
++	kexec_relocate_size = (unsigned long)(&__end___kexec_relocate) -
++		(unsigned long)(&__start___kexec_relocate);
++	pr_info("kexec_relocate_size = %lu\n", kexec_relocate_size);
++
+ 	reboot_code_buffer =
+ 	  (unsigned long)page_address(image->control_code_page);
++	pr_info("reboot_code_buffer = %p\n", (void *)reboot_code_buffer);
+ 
+ 	kexec_start_address =
+ 	  (unsigned long) phys_to_virt(image->start);
++	pr_info("kexec_start_address(entry point of new kernel) = %p\n",
++			(void *)kexec_start_address);
+ 
+ 	kexec_indirection_page =
+ 		(unsigned long) phys_to_virt(image->head & PAGE_MASK);
++	pr_info("kexec_indirection_page = %p\n",
++			(void *)kexec_indirection_page);
+ 
+-	memcpy((void*)reboot_code_buffer, relocate_new_kernel,
+-	       relocate_new_kernel_size);
++	memcpy((void *)reboot_code_buffer, &__start___kexec_relocate,
++	       kexec_relocate_size);
++
++	pr_info("Copy kexec_relocate section from %p to reboot_code_buffer: %p\n",
++			&__start___kexec_relocate, (void *)reboot_code_buffer);
+ 
+ 	/*
+ 	 * The generic kexec code builds a page list with physical
+@@ -96,8 +105,8 @@ machine_kexec(struct kimage *image)
+ 	 */
+ 	local_irq_disable();
+ 
+-	printk("Will call new kernel at %08lx\n", image->start);
+-	printk("Bye ...\n");
++	pr_info("Will call new kernel at %p\n", (void *)kexec_start_address);
++	pr_info("Bye ...\n");
+ 	__flush_cache_all();
+ #ifdef CONFIG_SMP
+ 	/* All secondary cpus now may jump to kexec_wait cycle */
+@@ -108,4 +117,3 @@ machine_kexec(struct kimage *image)
+ #endif
+ 	((noretfun_t) reboot_code_buffer)();
+ }
+-
+--- a/arch/mips/kernel/relocate_kernel.S
++++ b/arch/mips/kernel/relocate_kernel.S
+@@ -14,6 +14,8 @@
+ #include <asm/stackframe.h>
+ #include <asm/addrspace.h>
+ 
++	.section	.kexec.relocate, "ax"
++
+ LEAF(relocate_new_kernel)
+ 	PTR_L a0,	arg0
+ 	PTR_L a1,	arg1
+@@ -155,9 +157,3 @@ EXPORT(kexec_start_address)
+ EXPORT(kexec_indirection_page)
+ 	PTR		0
+ 	.size		kexec_indirection_page, PTRSIZE
+-
+-relocate_new_kernel_end:
+-
+-EXPORT(relocate_new_kernel_size)
+-	PTR		relocate_new_kernel_end - relocate_new_kernel
+-	.size		relocate_new_kernel_size, PTRSIZE
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -50,6 +50,10 @@ SECTIONS
+ 		*(.text.*)
+ 		*(.fixup)
+ 		*(.gnu.warning)
++		__start___kexec_relocate = .;
++		KEEP(*(.kexec.relocate))
++		KEEP(*(.__kexec.relocate))
++		__end___kexec_relocate = .;
+ 	} :text = 0
+ 	_etext = .;	/* End of text section */
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/332-mips-kexec-init-the-arguments-for-the-new-kernel-image.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/332-mips-kexec-init-the-arguments-for-the-new-kernel-image.patch.svn-base
new file mode 100644
index 0000000..07d0af9
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/332-mips-kexec-init-the-arguments-for-the-new-kernel-image.patch.svn-base
@@ -0,0 +1,52 @@
+From 49d07a29653b1f2c6ae273b3d8fe93d981f43004 Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Wed, 12 Jan 2011 20:59:32 +0000
+Subject: MIPS: Kexec: Init the arguments for the new kernel image
+
+Whenever the kexec-tools pass the command lines to the new kernel image,
+init the arguments as the ones for the 1st kernel image. This fixed the
+booting failure of Kexec on YeeLoong.
+
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -10,6 +10,7 @@
+ #include <linux/mm.h>
+ #include <linux/delay.h>
+ 
++#include <asm/bootinfo.h>
+ #include <asm/cacheflush.h>
+ #include <asm/page.h>
+ 
+@@ -23,9 +24,30 @@ void (*relocated_kexec_smp_wait) (void *
+ atomic_t kexec_ready_to_reboot = ATOMIC_INIT(0);
+ #endif
+ 
++static void machine_kexec_init_args(void)
++{
++	kexec_args[0] = fw_arg0;
++	kexec_args[1] = fw_arg1;
++	kexec_args[2] = fw_arg2;
++	kexec_args[3] = fw_arg3;
++
++	pr_info("kexec_args[0] (argc): %lu\n", kexec_args[0]);
++	pr_info("kexec_args[1] (argv): %p\n", (void *)kexec_args[1]);
++	pr_info("kexec_args[2] (env ): %p\n", (void *)kexec_args[2]);
++	pr_info("kexec_args[3] (desc): %p\n", (void *)kexec_args[3]);
++}
++
+ int
+ machine_kexec_prepare(struct kimage *kimage)
+ {
++	/*
++	 * Whenever arguments passed from kexec-tools, Init the arguments as
++	 * the original ones to avoid booting failure.
++	 *
++	 * This can be overrided by _machine_kexec_prepare().
++	 */
++	machine_kexec_init_args();
++
+ 	if (_machine_kexec_prepare)
+ 		return _machine_kexec_prepare(kimage);
+ 	return 0;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/333-mips-kexec-get-kernel-parameters-from-kexec-tools.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/333-mips-kexec-get-kernel-parameters-from-kexec-tools.patch.svn-base
new file mode 100644
index 0000000..44380da
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/333-mips-kexec-get-kernel-parameters-from-kexec-tools.patch.svn-base
@@ -0,0 +1,88 @@
+From 240c76841b26f1b09aaced33414ee1d08b6454cf Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Sat, 15 Jan 2011 12:46:03 +0000
+Subject: MIPS: Get kernel parameters from kexec-tools
+
+Before, we simply use the command lines from the original bootloader,
+but it is not convenient. Now, we accept the kernel parameters from the
+--command-line or --append option of the kexec-tools.  But If not
+--command-line or --apend option indicated, will fall back to use the
+ones from the original bootloader.
+
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -13,6 +13,7 @@
+ #include <asm/bootinfo.h>
+ #include <asm/cacheflush.h>
+ #include <asm/page.h>
++#include <asm/uaccess.h>
+ 
+ extern const unsigned char relocate_new_kernel[];
+ 
+@@ -37,6 +38,56 @@ static void machine_kexec_init_args(void
+ 	pr_info("kexec_args[3] (desc): %p\n", (void *)kexec_args[3]);
+ }
+ 
++#define ARGV_MAX_ARGS (COMMAND_LINE_SIZE / 15)
++
++int machine_kexec_pass_args(struct kimage *image)
++{
++	int i, argc = 0;
++	char *bootloader = "kexec";
++	int *kexec_argv = (int *)kexec_args[1];
++
++	for (i = 0; i < image->nr_segments; i++) {
++		if (!strncmp(bootloader, (char *)image->segment[i].buf,
++				strlen(bootloader))) {
++			/*
++			 * convert command line string to array
++			 * of parameters (as bootloader does).
++			 */
++			/*
++			 * Note: we do treat the 1st string "kexec" as an
++			 * argument ;-) so, argc here is 1.
++			 */
++			char *str = (char *)image->segment[i].buf;
++			char *ptr = strchr(str, ' ');
++			char *kbuf = (char *)kexec_argv[0];
++			/* Whenever --command-line or --append used, "kexec" is copied */
++			argc = 1;
++			/* Parse the offset */
++			while (ptr && (ARGV_MAX_ARGS > argc)) {
++				*ptr = '\0';
++				if (ptr[1] != ' ' && ptr[1] != '\0') {
++					int offt = (int)(ptr - str + 1);
++					kexec_argv[argc] = (int)kbuf + offt;
++					argc++;
++				}
++				ptr = strchr(ptr + 1, ' ');
++			}
++			if (argc > 1) {
++				/* Copy to kernel space */
++				copy_from_user(kbuf, (char *)image->segment[i].buf, image->segment[i].bufsz);
++				fw_arg0 = kexec_args[0] = argc;
++			}
++			break;
++		}
++	}
++
++	pr_info("argc = %lu\n", kexec_args[0]);
++	for (i = 0; i < kexec_args[0]; i++)
++		pr_info("argv[%d] = %p, %s\n", i, (char *)kexec_argv[i], (char *)kexec_argv[i]);
++
++	return 0;
++}
++
+ int
+ machine_kexec_prepare(struct kimage *kimage)
+ {
+@@ -47,6 +98,7 @@ machine_kexec_prepare(struct kimage *kim
+ 	 * This can be overrided by _machine_kexec_prepare().
+ 	 */
+ 	machine_kexec_init_args();
++	machine_kexec_pass_args(kimage);
+ 
+ 	if (_machine_kexec_prepare)
+ 		return _machine_kexec_prepare(kimage);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/334-mips-fix-compiling-failure-of-relocate_kernel.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/334-mips-fix-compiling-failure-of-relocate_kernel.patch.svn-base
new file mode 100644
index 0000000..46a7395
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/334-mips-fix-compiling-failure-of-relocate_kernel.patch.svn-base
@@ -0,0 +1,83 @@
+From 4aded085fa0057a9a1e1dcec631f950307360c1f Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Tue, 11 Jan 2011 13:46:19 +0000
+Subject: MIPS: Fix compiling failure of relocate_kernel.S
+
+The following errors is fixed with the help of <asm/asm_nosec.h>. for
+this file need to put different symbols in the same section, the
+original LEAF, NESTED and EXPORT (without explicit section indication)
+must be used, <asm/asm_nosec.h> does it.
+
+arch/mips/kernel/relocate_kernel.S: Assembler messages:
+arch/mips/kernel/relocate_kernel.S:162: Error: operation combines symbols in different segments
+
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+(limited to 'arch/mips/kernel')
+
+--- a/arch/mips/kernel/relocate_kernel.S
++++ b/arch/mips/kernel/relocate_kernel.S
+@@ -7,6 +7,7 @@
+  */
+ 
+ #include <asm/asm.h>
++#include <asm/asm_nosec.h>
+ #include <asm/asmmacro.h>
+ #include <asm/regdef.h>
+ #include <asm/page.h>
+--- /dev/null
++++ b/arch/mips/include/asm/asm_nosec.h
+@@ -0,0 +1,53 @@
++/*
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License.  See the file "COPYING" in the main directory of this archive
++ * for more details.
++ *
++ * Copyright (C) 1995, 1996, 1997, 1999, 2001 by Ralf Baechle
++ * Copyright (C) 1999 by Silicon Graphics, Inc.
++ * Copyright (C) 2001 MIPS Technologies, Inc.
++ * Copyright (C) 2002  Maciej W. Rozycki
++ * Copyright (C) 2010  Wu Zhangjin <wuzhangjin@gmail.com>
++ *
++ * Derive from <asm/asm.h>
++ *
++ * Override the macros without -ffunction-sections and -fdata-sections support.
++ * If several functions or data must be put in the same section, please include
++ * this header file after the <asm/asm.h> to override the generic definition.
++ */
++
++#ifndef __ASM_ASM_NOSEC_H
++#define __ASM_ASM_NOSEC_H
++
++#undef LEAF
++#undef NESTED
++#undef EXPORT
++
++/*
++ * LEAF - declare leaf routine
++ */
++#define	LEAF(symbol)                                    \
++		.globl	symbol;                         \
++		.align	2;                              \
++		.type	symbol, @function;              \
++		.ent	symbol, 0;                      \
++symbol:		.frame	sp, 0, ra
++
++/*
++ * NESTED - declare nested routine entry point
++ */
++#define	NESTED(symbol, framesize, rpc)                  \
++		.globl	symbol;                         \
++		.align	2;                              \
++		.type	symbol, @function;              \
++		.ent	symbol, 0;                       \
++symbol:		.frame	sp, framesize, rpc
++
++/*
++ * EXPORT - export definition of symbol
++ */
++#define EXPORT(symbol)					\
++		.globl	symbol;                         \
++symbol:
++
++#endif /* __ASM_ASM_NOSEC_H */
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/335-mips-kexec-cleanup-kexec-tools-parameter-handling.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/335-mips-kexec-cleanup-kexec-tools-parameter-handling.patch.svn-base
new file mode 100644
index 0000000..e0a1103
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/335-mips-kexec-cleanup-kexec-tools-parameter-handling.patch.svn-base
@@ -0,0 +1,186 @@
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -25,67 +25,104 @@ void (*relocated_kexec_smp_wait) (void *
+ atomic_t kexec_ready_to_reboot = ATOMIC_INIT(0);
+ #endif
+ 
+-static void machine_kexec_init_args(void)
++#define KEXEC_MIPS_ARGV_BUF_SIZE	COMMAND_LINE_SIZE
++#define KEXEC_MIPS_ARGV_MAX_ARGS	(COMMAND_LINE_SIZE / 15)
++
++char kexec_argv_buf[KEXEC_MIPS_ARGV_BUF_SIZE] __kexec;
++char *kexec_argv[KEXEC_MIPS_ARGV_MAX_ARGS] __kexec;
++
++static void
++machine_kexec_print_args(void)
+ {
+-	kexec_args[0] = fw_arg0;
+-	kexec_args[1] = fw_arg1;
+-	kexec_args[2] = fw_arg2;
+-	kexec_args[3] = fw_arg3;
++	int i;
+ 
+ 	pr_info("kexec_args[0] (argc): %lu\n", kexec_args[0]);
+ 	pr_info("kexec_args[1] (argv): %p\n", (void *)kexec_args[1]);
+ 	pr_info("kexec_args[2] (env ): %p\n", (void *)kexec_args[2]);
+ 	pr_info("kexec_args[3] (desc): %p\n", (void *)kexec_args[3]);
+-}
+ 
+-#define ARGV_MAX_ARGS (COMMAND_LINE_SIZE / 15)
++	for (i = 0; i < kexec_args[0]; i++)
++		pr_info("kexec_argv[%d] = %p, %s\n", i,
++			(char *)kexec_argv[i], (char *)kexec_argv[i]);
++}
+ 
+-int machine_kexec_pass_args(struct kimage *image)
++static void
++machine_kexec_init_argv(struct kimage *image)
+ {
+-	int i, argc = 0;
+-	char *bootloader = "kexec";
+-	int *kexec_argv = (int *)kexec_args[1];
++	void __user *buf = NULL;
++	size_t bufsz;
++	size_t size;
++	int i;
+ 
++	bufsz = 0;
+ 	for (i = 0; i < image->nr_segments; i++) {
+-		if (!strncmp(bootloader, (char *)image->segment[i].buf,
+-				strlen(bootloader))) {
+-			/*
+-			 * convert command line string to array
+-			 * of parameters (as bootloader does).
+-			 */
+-			/*
+-			 * Note: we do treat the 1st string "kexec" as an
+-			 * argument ;-) so, argc here is 1.
+-			 */
+-			char *str = (char *)image->segment[i].buf;
+-			char *ptr = strchr(str, ' ');
+-			char *kbuf = (char *)kexec_argv[0];
+-			/* Whenever --command-line or --append used, "kexec" is copied */
+-			argc = 1;
+-			/* Parse the offset */
+-			while (ptr && (ARGV_MAX_ARGS > argc)) {
+-				*ptr = '\0';
+-				if (ptr[1] != ' ' && ptr[1] != '\0') {
+-					int offt = (int)(ptr - str + 1);
+-					kexec_argv[argc] = (int)kbuf + offt;
+-					argc++;
+-				}
+-				ptr = strchr(ptr + 1, ' ');
+-			}
+-			if (argc > 1) {
+-				/* Copy to kernel space */
+-				copy_from_user(kbuf, (char *)image->segment[i].buf, image->segment[i].bufsz);
+-				fw_arg0 = kexec_args[0] = argc;
+-			}
+-			break;
++		struct kexec_segment *seg;
++
++		seg = &image->segment[i];
++		if (seg->bufsz < 6)
++			continue;
++
++		if (strncmp((char *) seg->buf, "kexec", 5))
++			continue;
++
++		/* don't copy "kexec" */
++		buf = seg->buf + 5;
++		bufsz = seg->bufsz - 5;
++		break;
++	}
++
++	if (!buf)
++		return;
++
++	size = KEXEC_MIPS_ARGV_BUF_SIZE - 1;
++	size = min(size, bufsz);
++	if (size < bufsz)
++		pr_warn("kexec command line truncated to %zd bytes\n", size);
++
++	/* Copy to kernel space */
++	copy_from_user(kexec_argv_buf, buf, size);
++}
++
++static void
++machine_kexec_parse_argv(struct kimage *image)
++{
++	char *reboot_code_buffer;
++	int reloc_delta;
++	char *ptr;
++	int argc;
++	int i;
++
++	ptr = kexec_argv_buf;
++	argc = 0;
++
++	/*
++	 * convert command line string to array of parameters
++	 * (as bootloader does).
++	 */
++	while (ptr && *ptr && (KEXEC_MIPS_ARGV_MAX_ARGS > argc)) {
++		if (*ptr == ' ') {
++			*ptr++ = '\0';
++			continue;
+ 		}
++
++		kexec_argv[argc++] = ptr;
++		ptr = strchr(ptr, ' ');
+ 	}
+ 
+-	pr_info("argc = %lu\n", kexec_args[0]);
+-	for (i = 0; i < kexec_args[0]; i++)
+-		pr_info("argv[%d] = %p, %s\n", i, (char *)kexec_argv[i], (char *)kexec_argv[i]);
++	if (!argc)
++		return;
+ 
+-	return 0;
++	kexec_args[0] = argc;
++	kexec_args[1] = (unsigned long)kexec_argv;
++	kexec_args[2] = 0;
++	kexec_args[3] = 0;
++
++	reboot_code_buffer = page_address(image->control_code_page);
++	reloc_delta = reboot_code_buffer - (char *) &__start___kexec_relocate;
++
++	kexec_args[1] += reloc_delta;
++	for (i = 0; i < argc; i++)
++		kexec_argv[i] += reloc_delta;
+ }
+ 
+ int
+@@ -97,8 +134,14 @@ machine_kexec_prepare(struct kimage *kim
+ 	 *
+ 	 * This can be overrided by _machine_kexec_prepare().
+ 	 */
+-	machine_kexec_init_args();
+-	machine_kexec_pass_args(kimage);
++
++	kexec_args[0] = fw_arg0;
++	kexec_args[1] = fw_arg1;
++	kexec_args[2] = fw_arg2;
++	kexec_args[3] = fw_arg3;
++
++	machine_kexec_init_argv(kimage);
++	machine_kexec_parse_argv(kimage);
+ 
+ 	if (_machine_kexec_prepare)
+ 		return _machine_kexec_prepare(kimage);
+@@ -154,11 +197,13 @@ machine_kexec(struct kimage *image)
+ 	pr_info("kexec_indirection_page = %p\n",
+ 			(void *)kexec_indirection_page);
+ 
++	pr_info("Copy kexec_relocate section from %p to reboot_code_buffer: %p\n",
++			&__start___kexec_relocate, (void *)reboot_code_buffer);
++
+ 	memcpy((void *)reboot_code_buffer, &__start___kexec_relocate,
+ 	       kexec_relocate_size);
+ 
+-	pr_info("Copy kexec_relocate section from %p to reboot_code_buffer: %p\n",
+-			&__start___kexec_relocate, (void *)reboot_code_buffer);
++	machine_kexec_print_args();
+ 
+ 	/*
+ 	 * The generic kexec code builds a page list with physical
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/340-module_alloc_size_check.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/340-module_alloc_size_check.patch.svn-base
new file mode 100644
index 0000000..549df5a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/340-module_alloc_size_check.patch.svn-base
@@ -0,0 +1,20 @@
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2322,12 +2322,15 @@ static void dynamic_debug_remove(struct
+ 
+ void * __weak module_alloc(unsigned long size)
+ {
+-	return size == 0 ? NULL : vmalloc_exec(size);
++	return vmalloc_exec(size);
+ }
+ 
+ static void *module_alloc_update_bounds(unsigned long size)
+ {
+-	void *ret = module_alloc(size);
++	void *ret = NULL;
++
++	if (size)
++		ret = module_alloc(size);
+ 
+ 	if (ret) {
+ 		mutex_lock(&module_mutex);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/400-rootfs_split.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/400-rootfs_split.patch.svn-base
new file mode 100644
index 0000000..349185a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/400-rootfs_split.patch.svn-base
@@ -0,0 +1,327 @@
+--- a/drivers/mtd/Kconfig
++++ b/drivers/mtd/Kconfig
+@@ -23,6 +23,14 @@ config MTD_TESTS
+ 	  WARNING: some of the tests will ERASE entire MTD device which they
+ 	  test. Do not use these tests unless you really know what you do.
+ 
++config MTD_ROOTFS_ROOT_DEV
++	bool "Automatically set 'rootfs' partition to be root filesystem"
++	default y
++
++config MTD_ROOTFS_SPLIT
++	bool "Automatically split 'rootfs' partition for squashfs"
++	default y
++
+ config MTD_REDBOOT_PARTS
+ 	tristate "RedBoot partition table parsing"
+ 	---help---
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -29,6 +29,8 @@
+ #include <linux/kmod.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/root_dev.h>
++#include <linux/magic.h>
+ #include <linux/err.h>
+ 
+ #include "mtdcore.h"
+@@ -50,7 +52,7 @@ struct mtd_part {
+  * the pointer to that structure with this macro.
+  */
+ #define PART(x)  ((struct mtd_part *)(x))
+-
++#define IS_PART(mtd) (mtd->read == part_read)
+ 
+ /*
+  * MTD methods which simply translate the effective address and pass through
+@@ -643,6 +645,155 @@ int mtd_del_partition(struct mtd_info *m
+ }
+ EXPORT_SYMBOL_GPL(mtd_del_partition);
+ 
++#ifdef CONFIG_MTD_ROOTFS_SPLIT
++#define ROOTFS_SPLIT_NAME "rootfs_data"
++#define ROOTFS_REMOVED_NAME "<removed>"
++
++struct squashfs_super_block {
++	__le32 s_magic;
++	__le32 pad0[9];
++	__le64 bytes_used;
++};
++
++
++static int split_squashfs(struct mtd_info *master, int offset, int *split_offset)
++{
++	struct squashfs_super_block sb;
++	int len, ret;
++
++	ret = master->read(master, offset, sizeof(sb), &len, (void *) &sb);
++	if (ret || (len != sizeof(sb))) {
++		printk(KERN_ALERT "split_squashfs: error occured while reading "
++			"from \"%s\"\n", master->name);
++		return -EINVAL;
++	}
++
++	if (SQUASHFS_MAGIC != le32_to_cpu(sb.s_magic) ) {
++		printk(KERN_ALERT "split_squashfs: no squashfs found in \"%s\"\n",
++			master->name);
++		*split_offset = 0;
++		return 0;
++	}
++
++	if (le64_to_cpu((sb.bytes_used)) <= 0) {
++		printk(KERN_ALERT "split_squashfs: squashfs is empty in \"%s\"\n",
++			master->name);
++		*split_offset = 0;
++		return 0;
++	}
++
++	len = (u32) le64_to_cpu(sb.bytes_used);
++	len += (offset & 0x000fffff);
++	len +=  (master->erasesize - 1);
++	len &= ~(master->erasesize - 1);
++	len -= (offset & 0x000fffff);
++	*split_offset = offset + len;
++
++	return 0;
++}
++
++static int split_rootfs_data(struct mtd_info *master, struct mtd_info *rpart, const struct mtd_partition *part)
++{
++	struct mtd_partition *dpart;
++	struct mtd_part *slave = NULL;
++	struct mtd_part *spart;
++	int ret, split_offset = 0;
++
++	spart = PART(rpart);
++	ret = split_squashfs(master, spart->offset, &split_offset);
++	if (ret)
++		return ret;
++
++	if (split_offset <= 0)
++		return 0;
++
++	dpart = kmalloc(sizeof(*part)+sizeof(ROOTFS_SPLIT_NAME)+1, GFP_KERNEL);
++	if (dpart == NULL) {
++		printk(KERN_INFO "split_squashfs: no memory for partition \"%s\"\n",
++			ROOTFS_SPLIT_NAME);
++		return -ENOMEM;
++	}
++
++	memcpy(dpart, part, sizeof(*part));
++	dpart->name = (unsigned char *)&dpart[1];
++	strcpy(dpart->name, ROOTFS_SPLIT_NAME);
++
++	dpart->size = rpart->size - (split_offset - spart->offset);
++	dpart->offset = split_offset;
++
++	if (dpart == NULL)
++		return 1;
++
++	printk(KERN_INFO "mtd: partition \"%s\" created automatically, ofs=%llX, len=%llX \n",
++		ROOTFS_SPLIT_NAME, dpart->offset, dpart->size);
++
++	slave = allocate_partition(master, dpart, 0, split_offset);
++	if (IS_ERR(slave))
++		return PTR_ERR(slave);
++	mutex_lock(&mtd_partitions_mutex);
++	list_add(&slave->list, &mtd_partitions);
++	mutex_unlock(&mtd_partitions_mutex);
++
++	add_mtd_device(&slave->mtd);
++
++	rpart->split = &slave->mtd;
++
++	return 0;
++}
++
++static int refresh_rootfs_split(struct mtd_info *mtd)
++{
++	struct mtd_partition tpart;
++	struct mtd_part *part;
++	char *name;
++	//int index = 0;
++	int offset, size;
++	int ret;
++
++	part = PART(mtd);
++
++	/* check for the new squashfs offset first */
++	ret = split_squashfs(part->master, part->offset, &offset);
++	if (ret)
++		return ret;
++
++	if ((offset > 0) && !mtd->split) {
++		printk(KERN_INFO "%s: creating new split partition for \"%s\"\n", __func__, mtd->name);
++		/* if we don't have a rootfs split partition, create a new one */
++		tpart.name = (char *) mtd->name;
++		tpart.size = mtd->size;
++		tpart.offset = part->offset;
++
++		return split_rootfs_data(part->master, &part->mtd, &tpart);
++	} else if ((offset > 0) && mtd->split) {
++		/* update the offsets of the existing partition */
++		size = mtd->size + part->offset - offset;
++
++		part = PART(mtd->split);
++		part->offset = offset;
++		part->mtd.size = size;
++		printk(KERN_INFO "%s: %s partition \"" ROOTFS_SPLIT_NAME "\", offset: 0x%06x (0x%06x)\n",
++			__func__, (!strcmp(part->mtd.name, ROOTFS_SPLIT_NAME) ? "updating" : "creating"),
++			(u32) part->offset, (u32) part->mtd.size);
++		name = kmalloc(sizeof(ROOTFS_SPLIT_NAME) + 1, GFP_KERNEL);
++		strcpy(name, ROOTFS_SPLIT_NAME);
++		part->mtd.name = name;
++	} else if ((offset <= 0) && mtd->split) {
++		printk(KERN_INFO "%s: removing partition \"%s\"\n", __func__, mtd->split->name);
++
++		/* mark existing partition as removed */
++		part = PART(mtd->split);
++		name = kmalloc(sizeof(ROOTFS_SPLIT_NAME) + 1, GFP_KERNEL);
++		strcpy(name, ROOTFS_REMOVED_NAME);
++		part->mtd.name = name;
++		part->offset = 0;
++		part->mtd.size = 0;
++	}
++
++	return 0;
++}
++#endif /* CONFIG_MTD_ROOTFS_SPLIT */
++
+ /*
+  * This function, given a master MTD object and a partition table, creates
+  * and registers slave MTD objects which are bound to the master according to
+@@ -659,6 +810,9 @@ int add_mtd_partitions(struct mtd_info *
+ 	struct mtd_part *slave;
+ 	uint64_t cur_offset = 0;
+ 	int i;
++#ifdef CONFIG_MTD_ROOTFS_SPLIT
++	int ret;
++#endif
+ 
+ 	printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name);
+ 
+@@ -673,12 +827,53 @@ int add_mtd_partitions(struct mtd_info *
+ 
+ 		add_mtd_device(&slave->mtd);
+ 
++		if (!strcmp(parts[i].name, "rootfs")) {
++#ifdef CONFIG_MTD_ROOTFS_ROOT_DEV
++			if (ROOT_DEV == 0) {
++				printk(KERN_NOTICE "mtd: partition \"rootfs\" "
++					"set to be root filesystem\n");
++				ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, slave->mtd.index);
++			}
++#endif
++#ifdef CONFIG_MTD_ROOTFS_SPLIT
++			ret = split_rootfs_data(master, &slave->mtd, &parts[i]);
++			/* if (ret == 0)
++			 * 	j++; */
++#endif
++		}
++
+ 		cur_offset = slave->offset + slave->mtd.size;
+ 	}
+ 
+ 	return 0;
+ }
+ 
++int mtd_device_refresh(struct mtd_info *mtd)
++{
++	int ret = 0;
++
++	if (IS_PART(mtd)) {
++		struct mtd_part *part;
++		struct mtd_info *master;
++
++		part = PART(mtd);
++		master = part->master;
++		if (master->refresh_device)
++			ret = master->refresh_device(master);
++	}
++
++	if (!ret && mtd->refresh_device)
++		ret = mtd->refresh_device(mtd);
++
++#ifdef CONFIG_MTD_ROOTFS_SPLIT
++	if (!ret && IS_PART(mtd) && !strcmp(mtd->name, "rootfs"))
++		refresh_rootfs_split(mtd);
++#endif
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(mtd_device_refresh);
++
+ static DEFINE_SPINLOCK(part_parser_lock);
+ static LIST_HEAD(part_parsers);
+ 
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -1005,6 +1005,12 @@ static int mtdchar_ioctl(struct file *fi
+ 		break;
+ 	}
+ 
++	case MTDREFRESH:
++	{
++		ret = mtd_device_refresh(mtd);
++		break;
++	}
++
+ 	default:
+ 		ret = -ENOTTY;
+ 	}
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -114,6 +114,7 @@ struct nand_ecclayout {
+ 
+ struct module;	/* only needed for owner field in mtd_info */
+ 
++struct mtd_info;
+ struct mtd_info {
+ 	u_char type;
+ 	uint32_t flags;
+@@ -214,6 +215,9 @@ struct mtd_info {
+ 	int (*block_markbad) (struct mtd_info *mtd, loff_t ofs);
+ 	int (*suspend) (struct mtd_info *mtd);
+ 	void (*resume) (struct mtd_info *mtd);
++	int (*refresh_device)(struct mtd_info *mtd);
++	struct mtd_info *split;
++
+ 	/*
+ 	 * If the driver is something smart, like UBI, it may need to maintain
+ 	 * its own reference counting. The below functions are only for driver.
+@@ -502,6 +506,7 @@ extern int mtd_device_parse_register(str
+ 			      int defnr_parts);
+ #define mtd_device_register(master, parts, nr_parts)	\
+ 	mtd_device_parse_register(master, NULL, NULL, parts, nr_parts)
++extern int mtd_device_refresh(struct mtd_info *master);
+ extern int mtd_device_unregister(struct mtd_info *master);
+ extern struct mtd_info *get_mtd_device(struct mtd_info *mtd, int num);
+ extern int __get_mtd_device(struct mtd_info *mtd);
+--- a/include/linux/mtd/partitions.h
++++ b/include/linux/mtd/partitions.h
+@@ -36,12 +36,14 @@
+  * erasesize aligned (e.g. use MTDPART_OFS_NEXTBLK).
+  */
+ 
++struct mtd_partition;
+ struct mtd_partition {
+ 	char *name;			/* identifier string */
+ 	uint64_t size;			/* partition size */
+ 	uint64_t offset;		/* offset within the master MTD space */
+ 	uint32_t mask_flags;		/* master MTD flags to mask out for this partition */
+ 	struct nand_ecclayout *ecclayout;	/* out of band layout for this partition (NAND only) */
++	int (*refresh_partition)(struct mtd_info *);
+ };
+ 
+ #define MTDPART_OFS_RETAIN	(-3)
+--- a/include/mtd/mtd-abi.h
++++ b/include/mtd/mtd-abi.h
+@@ -202,6 +202,7 @@ struct otp_info {
+  * without OOB, e.g., NOR flash.
+  */
+ #define MEMWRITE		_IOWR('M', 24, struct mtd_write_req)
++#define MTDREFRESH		_IO('M', 50)
+ 
+ /*
+  * Obsolete legacy interface. Keep it in order not to break userspace
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/401-partial_eraseblock_write.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/401-partial_eraseblock_write.patch.svn-base
new file mode 100644
index 0000000..3b22cfc
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/401-partial_eraseblock_write.patch.svn-base
@@ -0,0 +1,145 @@
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -35,6 +35,8 @@
+ 
+ #include "mtdcore.h"
+ 
++#define MTD_ERASE_PARTIAL	0x8000 /* partition only covers parts of an erase block */
++
+ /* Our partition linked list */
+ static LIST_HEAD(mtd_partitions);
+ static DEFINE_MUTEX(mtd_partitions_mutex);
+@@ -252,13 +254,60 @@ static int part_erase(struct mtd_info *m
+ 		return -EROFS;
+ 	if (instr->addr >= mtd->size)
+ 		return -EINVAL;
++
++	instr->partial_start = false;
++	if (mtd->flags & MTD_ERASE_PARTIAL) {
++		size_t readlen = 0;
++		u64 mtd_ofs;
++
++		instr->erase_buf = kmalloc(part->master->erasesize, GFP_ATOMIC);
++		if (!instr->erase_buf)
++			return -ENOMEM;
++
++		mtd_ofs = part->offset + instr->addr;
++		instr->erase_buf_ofs = do_div(mtd_ofs, part->master->erasesize);
++
++		if (instr->erase_buf_ofs > 0) {
++			instr->addr -= instr->erase_buf_ofs;
++			ret = mtd_read(part->master,
++				instr->addr + part->offset,
++				part->master->erasesize,
++				&readlen, instr->erase_buf);
++
++			instr->partial_start = true;
++		} else {
++			mtd_ofs = part->offset + part->mtd.size;
++			instr->erase_buf_ofs = part->master->erasesize -
++				do_div(mtd_ofs, part->master->erasesize);
++
++			if (instr->erase_buf_ofs > 0) {
++				instr->len += instr->erase_buf_ofs;
++				ret = mtd_read(part->master,
++					part->offset + instr->addr +
++					instr->len - part->master->erasesize,
++					part->master->erasesize, &readlen,
++					instr->erase_buf);
++			} else {
++				ret = 0;
++			}
++		}
++		if (ret < 0) {
++			kfree(instr->erase_buf);
++			return ret;
++		}
++
++	}
++
+ 	instr->addr += part->offset;
+ 	ret = mtd_erase(part->master, instr);
+ 	if (ret) {
+ 		if (instr->fail_addr != MTD_FAIL_ADDR_UNKNOWN)
+ 			instr->fail_addr -= part->offset;
+ 		instr->addr -= part->offset;
++		if (mtd->flags & MTD_ERASE_PARTIAL)
++			kfree(instr->erase_buf);
+ 	}
++
+ 	return ret;
+ }
+ 
+@@ -266,7 +315,25 @@ void mtd_erase_callback(struct erase_inf
+ {
+ 	if (instr->mtd->erase == part_erase) {
+ 		struct mtd_part *part = PART(instr->mtd);
++		size_t wrlen = 0;
+ 
++		if (instr->mtd->flags & MTD_ERASE_PARTIAL) {
++			if (instr->partial_start) {
++				part->master->write(part->master,
++					instr->addr, instr->erase_buf_ofs,
++					&wrlen, instr->erase_buf);
++				instr->addr += instr->erase_buf_ofs;
++			} else {
++				instr->len -= instr->erase_buf_ofs;
++				part->master->write(part->master,
++					instr->addr + instr->len,
++					instr->erase_buf_ofs, &wrlen,
++					instr->erase_buf +
++					part->master->erasesize -
++					instr->erase_buf_ofs);
++			}
++			kfree(instr->erase_buf);
++		}
+ 		if (instr->fail_addr != MTD_FAIL_ADDR_UNKNOWN)
+ 			instr->fail_addr -= part->offset;
+ 		instr->addr -= part->offset;
+@@ -537,18 +604,24 @@ static struct mtd_part *allocate_partiti
+ 	if ((slave->mtd.flags & MTD_WRITEABLE) &&
+ 	    mtd_mod_by_eb(slave->offset, &slave->mtd)) {
+ 		/* Doesn't start on a boundary of major erase size */
+-		/* FIXME: Let it be writable if it is on a boundary of
+-		 * _minor_ erase size though */
+-		slave->mtd.flags &= ~MTD_WRITEABLE;
+-		printk(KERN_WARNING"mtd: partition \"%s\" doesn't start on an erase block boundary -- force read-only\n",
+-			part->name);
++		slave->mtd.flags |= MTD_ERASE_PARTIAL;
++		if (((u32) slave->mtd.size) > master->erasesize)
++			slave->mtd.flags &= ~MTD_WRITEABLE;
++		else
++			slave->mtd.erasesize = slave->mtd.size;
+ 	}
+ 	if ((slave->mtd.flags & MTD_WRITEABLE) &&
+-	    mtd_mod_by_eb(slave->mtd.size, &slave->mtd)) {
+-		slave->mtd.flags &= ~MTD_WRITEABLE;
+-		printk(KERN_WARNING"mtd: partition \"%s\" doesn't end on an erase block -- force read-only\n",
+-			part->name);
++	    mtd_mod_by_eb(slave->offset + slave->mtd.size, &slave->mtd)) {
++		slave->mtd.flags |= MTD_ERASE_PARTIAL;
++
++		if ((u32) slave->mtd.size > master->erasesize)
++			slave->mtd.flags &= ~MTD_WRITEABLE;
++		else
++			slave->mtd.erasesize = slave->mtd.size;
+ 	}
++	if ((slave->mtd.flags & (MTD_ERASE_PARTIAL|MTD_WRITEABLE)) == MTD_ERASE_PARTIAL)
++		printk(KERN_WARNING"mtd: partition \"%s\" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only\n",
++				part->name);
+ 
+ 	slave->mtd.ecclayout = master->ecclayout;
+ 	if (master->block_isbad) {
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -58,6 +58,10 @@ struct erase_info {
+ 	u_long priv;
+ 	u_char state;
+ 	struct erase_info *next;
++
++	u8 *erase_buf;
++	u32 erase_buf_ofs;
++	bool partial_start;
+ };
+ 
+ struct mtd_erase_region_info {
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/410-mtd_info_move_forward_decl.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/410-mtd_info_move_forward_decl.patch.svn-base
new file mode 100644
index 0000000..251f522
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/410-mtd_info_move_forward_decl.patch.svn-base
@@ -0,0 +1,18 @@
+--- a/include/linux/mtd/partitions.h
++++ b/include/linux/mtd/partitions.h
+@@ -35,6 +35,7 @@
+  * Note: writeable partitions require their size and offset be
+  * erasesize aligned (e.g. use MTDPART_OFS_NEXTBLK).
+  */
++struct mtd_info;
+ 
+ struct mtd_partition;
+ struct mtd_partition {
+@@ -52,7 +53,6 @@ struct mtd_partition {
+ #define MTDPART_SIZ_FULL	(0)
+ 
+ 
+-struct mtd_info;
+ struct device_node;
+ 
+ /**
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/420-redboot_space.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/420-redboot_space.patch.svn-base
new file mode 100644
index 0000000..fb6700b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/420-redboot_space.patch.svn-base
@@ -0,0 +1,30 @@
+--- a/drivers/mtd/redboot.c
++++ b/drivers/mtd/redboot.c
+@@ -267,14 +267,21 @@ static int parse_redboot_partitions(stru
+ #endif
+ 		names += strlen(names)+1;
+ 
+-#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
+ 		if(fl->next && fl->img->flash_base + fl->img->size + master->erasesize <= fl->next->img->flash_base) {
+-			i++;
+-			parts[i].offset = parts[i-1].size + parts[i-1].offset;
+-			parts[i].size = fl->next->img->flash_base - parts[i].offset;
+-			parts[i].name = nullname;
+-		}
++			if (!strcmp(parts[i].name, "rootfs")) {
++				parts[i].size = fl->next->img->flash_base;
++				parts[i].size &= ~(master->erasesize - 1);
++				parts[i].size -= parts[i].offset;
++#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
++				nrparts--;
++			} else {
++				i++;
++				parts[i].offset = parts[i-1].size + parts[i-1].offset;
++				parts[i].size = fl->next->img->flash_base - parts[i].offset;
++				parts[i].name = nullname;
+ #endif
++			}
++		}
+ 		tmp_fl = fl;
+ 		fl = fl->next;
+ 		kfree(tmp_fl);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/430-mtd_myloader_partition_parser.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/430-mtd_myloader_partition_parser.patch.svn-base
new file mode 100644
index 0000000..d60126d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/430-mtd_myloader_partition_parser.patch.svn-base
@@ -0,0 +1,35 @@
+--- a/drivers/mtd/Kconfig
++++ b/drivers/mtd/Kconfig
+@@ -156,6 +156,22 @@ config MTD_BCM63XX_PARTS
+ 	  This provides partions parsing for BCM63xx devices with CFE
+ 	  bootloaders.
+ 
++config MTD_MYLOADER_PARTS
++	tristate "MyLoader partition parsing"
++	depends on ADM5120 || ATHEROS_AR231X || ATHEROS_AR71XX || ATH79
++	---help---
++	  MyLoader is a bootloader which allows the user to define partitions
++	  in flash devices, by putting a table in the second erase block
++	  on the device, similar to a partition table. This table gives the 
++	  offsets and lengths of the user defined partitions.
++
++	  If you need code which can detect and parse these tables, and
++	  register MTD 'partitions' corresponding to each image detected,
++	  enable this option.
++
++	  You will still need the parsing functions to be called by the driver
++	  for your particular device. It won't happen automatically.
++
+ comment "User Modules And Translation Layers"
+ 
+ config MTD_CHAR
+--- a/drivers/mtd/Makefile
++++ b/drivers/mtd/Makefile
+@@ -12,6 +12,7 @@ obj-$(CONFIG_MTD_CMDLINE_PARTS) += cmdli
+ obj-$(CONFIG_MTD_AFS_PARTS)	+= afs.o
+ obj-$(CONFIG_MTD_AR7_PARTS)	+= ar7part.o
+ obj-$(CONFIG_MTD_BCM63XX_PARTS)	+= bcm63xxpart.o
++obj-$(CONFIG_MTD_MYLOADER_PARTS) += myloader.o
+ 
+ # 'Users' - code which presents functionality to userspace.
+ obj-$(CONFIG_MTD_CHAR)		+= mtdchar.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/440-block2mtd_init.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/440-block2mtd_init.patch.svn-base
new file mode 100644
index 0000000..00208c8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/440-block2mtd_init.patch.svn-base
@@ -0,0 +1,116 @@
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -14,6 +14,7 @@
+ #include <linux/list.h>
+ #include <linux/init.h>
+ #include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
+ #include <linux/mutex.h>
+ #include <linux/mount.h>
+ #include <linux/slab.h>
+@@ -231,11 +232,12 @@ static void block2mtd_free_device(struct
+ 
+ 
+ /* FIXME: ensure that mtd->size % erase_size == 0 */
+-static struct block2mtd_dev *add_device(char *devname, int erase_size)
++static struct block2mtd_dev *add_device(char *devname, int erase_size, const char *mtdname)
+ {
+ 	const fmode_t mode = FMODE_READ | FMODE_WRITE | FMODE_EXCL;
+ 	struct block_device *bdev;
+ 	struct block2mtd_dev *dev;
++	struct mtd_partition *part;
+ 	char *name;
+ 
+ 	if (!devname)
+@@ -274,13 +276,16 @@ static struct block2mtd_dev *add_device(
+ 
+ 	/* Setup the MTD structure */
+ 	/* make the name contain the block device in */
+-	name = kasprintf(GFP_KERNEL, "block2mtd: %s", devname);
++	if (!mtdname)
++		mtdname = devname;
++	name = kmalloc(strlen(mtdname) + 1, GFP_KERNEL);
+ 	if (!name)
+ 		goto devinit_err;
+ 
++	strcpy(name, mtdname);
+ 	dev->mtd.name = name;
+ 
+-	dev->mtd.size = dev->blkdev->bd_inode->i_size & PAGE_MASK;
++	dev->mtd.size = dev->blkdev->bd_inode->i_size & PAGE_MASK & ~(erase_size - 1);
+ 	dev->mtd.erasesize = erase_size;
+ 	dev->mtd.writesize = 1;
+ 	dev->mtd.writebufsize = PAGE_SIZE;
+@@ -294,14 +299,17 @@ static struct block2mtd_dev *add_device(
+ 	dev->mtd.priv = dev;
+ 	dev->mtd.owner = THIS_MODULE;
+ 
+-	if (mtd_device_register(&dev->mtd, NULL, 0)) {
++	part = kzalloc(sizeof(struct mtd_partition), GFP_KERNEL);
++	part->name = name;
++	part->offset = 0;
++	part->size = dev->mtd.size;
++	if (mtd_device_register(&dev->mtd, part, 1)) {
+ 		/* Device didn't get added, so free the entry */
+ 		goto devinit_err;
+ 	}
+ 	list_add(&dev->list, &blkmtd_device_list);
+ 	INFO("mtd%d: [%s] erase_size = %dKiB [%d]", dev->mtd.index,
+-			dev->mtd.name + strlen("block2mtd: "),
+-			dev->mtd.erasesize >> 10, dev->mtd.erasesize);
++			mtdname, dev->mtd.erasesize >> 10, dev->mtd.erasesize);
+ 	return dev;
+ 
+ devinit_err:
+@@ -374,9 +382,9 @@ static char block2mtd_paramline[80 + 12]
+ 
+ static int block2mtd_setup2(const char *val)
+ {
+-	char buf[80 + 12]; /* 80 for device, 12 for erase size */
++	char buf[80 + 12 + 80]; /* 80 for device, 12 for erase size, 80 for name */
+ 	char *str = buf;
+-	char *token[2];
++	char *token[3];
+ 	char *name;
+ 	size_t erase_size = PAGE_SIZE;
+ 	int i, ret;
+@@ -387,7 +395,7 @@ static int block2mtd_setup2(const char *
+ 	strcpy(str, val);
+ 	kill_final_newline(str);
+ 
+-	for (i = 0; i < 2; i++)
++	for (i = 0; i < 3; i++)
+ 		token[i] = strsep(&str, ",");
+ 
+ 	if (str)
+@@ -406,8 +414,10 @@ static int block2mtd_setup2(const char *
+ 			parse_err("illegal erase size");
+ 		}
+ 	}
++	if (token[2] && (strlen(token[2]) + 1 > 80))
++		parse_err("mtd device name too long");
+ 
+-	add_device(name, erase_size);
++	add_device(name, erase_size, token[2]);
+ 
+ 	return 0;
+ }
+@@ -441,7 +451,7 @@ static int block2mtd_setup(const char *v
+ 
+ 
+ module_param_call(block2mtd, block2mtd_setup, NULL, NULL, 0200);
+-MODULE_PARM_DESC(block2mtd, "Device to use. \"block2mtd=<dev>[,<erasesize>]\"");
++MODULE_PARM_DESC(block2mtd, "Device to use. \"block2mtd=<dev>[,<erasesize>[,<name>]]\"");
+ 
+ static int __init block2mtd_init(void)
+ {
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -546,6 +546,7 @@ int invalidate_partitions(struct gendisk
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL(rescan_partitions);
+ 
+ unsigned char *read_dev_sector(struct block_device *bdev, sector_t n, Sector *p)
+ {
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/441-block2mtd_refresh.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/441-block2mtd_refresh.patch.svn-base
new file mode 100644
index 0000000..979b43b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/441-block2mtd_refresh.patch.svn-base
@@ -0,0 +1,291 @@
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -29,6 +29,8 @@ struct block2mtd_dev {
+ 	struct block_device *blkdev;
+ 	struct mtd_info mtd;
+ 	struct mutex write_mutex;
++	rwlock_t bdev_mutex;
++	char devname[0];
+ };
+ 
+ 
+@@ -81,6 +83,12 @@ static int block2mtd_erase(struct mtd_in
+ 	size_t len = instr->len;
+ 	int err;
+ 
++	read_lock(&dev->bdev_mutex);
++	if (!dev->blkdev) {
++		err = -EINVAL;
++		goto done;
++	}
++
+ 	instr->state = MTD_ERASING;
+ 	mutex_lock(&dev->write_mutex);
+ 	err = _block2mtd_erase(dev, from, len);
+@@ -92,6 +100,10 @@ static int block2mtd_erase(struct mtd_in
+ 		instr->state = MTD_ERASE_DONE;
+ 
+ 	mtd_erase_callback(instr);
++
++done:
++	read_unlock(&dev->bdev_mutex);
++
+ 	return err;
+ }
+ 
+@@ -103,10 +115,14 @@ static int block2mtd_read(struct mtd_inf
+ 	struct page *page;
+ 	int index = from >> PAGE_SHIFT;
+ 	int offset = from & (PAGE_SIZE-1);
+-	int cpylen;
++	int cpylen, err = 0;
++
++	read_lock(&dev->bdev_mutex);
++	if (!dev->blkdev || (from > mtd->size)) {
++		err = -EINVAL;
++		goto done;
++	}
+ 
+-	if (from > mtd->size)
+-		return -EINVAL;
+ 	if (from + len > mtd->size)
+ 		len = mtd->size - from;
+ 
+@@ -121,10 +137,14 @@ static int block2mtd_read(struct mtd_inf
+ 		len = len - cpylen;
+ 
+ 		page = page_read(dev->blkdev->bd_inode->i_mapping, index);
+-		if (!page)
+-			return -ENOMEM;
+-		if (IS_ERR(page))
+-			return PTR_ERR(page);
++		if (!page) {
++			err = -ENOMEM;
++			goto done;
++		}
++		if (IS_ERR(page)) {
++			err = PTR_ERR(page);
++			goto done;
++		}
+ 
+ 		memcpy(buf, page_address(page) + offset, cpylen);
+ 		page_cache_release(page);
+@@ -135,7 +155,10 @@ static int block2mtd_read(struct mtd_inf
+ 		offset = 0;
+ 		index++;
+ 	}
+-	return 0;
++
++done:
++	read_unlock(&dev->bdev_mutex);
++	return err;
+ }
+ 
+ 
+@@ -187,12 +210,22 @@ static int block2mtd_write(struct mtd_in
+ 		size_t *retlen, const u_char *buf)
+ {
+ 	struct block2mtd_dev *dev = mtd->priv;
+-	int err;
++	int err = 0;
++
++	read_lock(&dev->bdev_mutex);
++	if (!dev->blkdev) {
++		err = -EINVAL;
++		goto done;
++	}
+ 
+ 	if (!len)
+-		return 0;
+-	if (to >= mtd->size)
+-		return -ENOSPC;
++		goto done;
++
++	if (to >= mtd->size) {
++		err = -ENOSPC;
++		goto done;
++	}
++
+ 	if (to + len > mtd->size)
+ 		len = mtd->size - to;
+ 
+@@ -201,6 +234,9 @@ static int block2mtd_write(struct mtd_in
+ 	mutex_unlock(&dev->write_mutex);
+ 	if (err > 0)
+ 		err = 0;
++
++done:
++	read_unlock(&dev->bdev_mutex);
+ 	return err;
+ }
+ 
+@@ -209,33 +245,110 @@ static int block2mtd_write(struct mtd_in
+ static void block2mtd_sync(struct mtd_info *mtd)
+ {
+ 	struct block2mtd_dev *dev = mtd->priv;
++	read_lock(&dev->bdev_mutex);
++	if (dev->blkdev)
+ 	sync_blockdev(dev->blkdev);
++	read_unlock(&dev->bdev_mutex);
++
+ 	return;
+ }
+ 
+ 
++static int _open_bdev(struct block2mtd_dev *dev)
++{
++	const fmode_t mode = FMODE_READ | FMODE_WRITE | FMODE_EXCL;
++	struct block_device *bdev;
++
++	/* Get a handle on the device */
++	bdev = blkdev_get_by_path(dev->devname, mode, dev);
++#ifndef MODULE
++	if (IS_ERR(bdev)) {
++		dev_t devt;
++
++		/* We might not have rootfs mounted at this point. Try
++		   to resolve the device name by other means. */
++
++		devt = name_to_dev_t(dev->devname);
++		if (devt)
++			bdev = blkdev_get_by_dev(devt, mode, dev);
++	}
++#endif
++
++	if (IS_ERR(bdev)) {
++		ERROR("error: cannot open device %s", dev->devname);
++		return 1;
++	}
++	dev->blkdev = bdev;
++
++	if (MAJOR(bdev->bd_dev) == MTD_BLOCK_MAJOR) {
++		ERROR("attempting to use an MTD device as a block device");
++		return 1;
++	}
++
++	return 0;
++}
++
++static void _close_bdev(struct block2mtd_dev *dev)
++{
++	struct block_device *bdev;
++
++	if (!dev->blkdev)
++		return;
++
++	bdev = dev->blkdev;
++	invalidate_mapping_pages(dev->blkdev->bd_inode->i_mapping, 0, -1);
++	blkdev_put(dev->blkdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
++	dev->blkdev = NULL;
++}
++
+ static void block2mtd_free_device(struct block2mtd_dev *dev)
+ {
+ 	if (!dev)
+ 		return;
+ 
+ 	kfree(dev->mtd.name);
+-
+-	if (dev->blkdev) {
+-		invalidate_mapping_pages(dev->blkdev->bd_inode->i_mapping,
+-					0, -1);
+-		blkdev_put(dev->blkdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+-	}
+-
++	_close_bdev(dev);
+ 	kfree(dev);
+ }
+ 
+ 
+-/* FIXME: ensure that mtd->size % erase_size == 0 */
+-static struct block2mtd_dev *add_device(char *devname, int erase_size, const char *mtdname)
++static int block2mtd_refresh(struct mtd_info *mtd)
+ {
+-	const fmode_t mode = FMODE_READ | FMODE_WRITE | FMODE_EXCL;
++	struct block2mtd_dev *dev = mtd->priv;
+ 	struct block_device *bdev;
++	dev_t devt;
++	int err = 0;
++
++	/* no other mtd function can run at this point */
++	write_lock(&dev->bdev_mutex);
++
++	/* get the device number for the whole disk */
++	devt = MKDEV(MAJOR(dev->blkdev->bd_dev), 0);
++
++	/* close the old block device */
++	_close_bdev(dev);
++
++	/* open the whole disk, issue a partition rescan, then */
++	bdev = blkdev_get_by_dev(devt, FMODE_WRITE | FMODE_READ, mtd);
++	if (!bdev || !bdev->bd_disk)
++		err = -EINVAL;
++#ifndef CONFIG_MTD_BLOCK2MTD_MODULE
++	else
++		err = rescan_partitions(bdev->bd_disk, bdev);
++#endif
++	if (bdev)
++		blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
++
++	/* try to open the partition block device again */
++	_open_bdev(dev);
++	write_unlock(&dev->bdev_mutex);
++
++	return err;
++}
++
++/* FIXME: ensure that mtd->size % erase_size == 0 */
++static struct block2mtd_dev *add_device(char *devname, int erase_size, char *mtdname)
++{
+ 	struct block2mtd_dev *dev;
+ 	struct mtd_partition *part;
+ 	char *name;
+@@ -243,36 +356,17 @@ static struct block2mtd_dev *add_device(
+ 	if (!devname)
+ 		return NULL;
+ 
+-	dev = kzalloc(sizeof(struct block2mtd_dev), GFP_KERNEL);
++	dev = kzalloc(sizeof(struct block2mtd_dev) + strlen(devname) + 1, GFP_KERNEL);
+ 	if (!dev)
+ 		return NULL;
+ 
+-	/* Get a handle on the device */
+-	bdev = blkdev_get_by_path(devname, mode, dev);
+-#ifndef MODULE
+-	if (IS_ERR(bdev)) {
+-
+-		/* We might not have rootfs mounted at this point. Try
+-		   to resolve the device name by other means. */
++	strcpy(dev->devname, devname);
+ 
+-		dev_t devt = name_to_dev_t(devname);
+-		if (devt)
+-			bdev = blkdev_get_by_dev(devt, mode, dev);
+-	}
+-#endif
+-
+-	if (IS_ERR(bdev)) {
+-		ERROR("error: cannot open device %s", devname);
++	if (_open_bdev(dev))
+ 		goto devinit_err;
+-	}
+-	dev->blkdev = bdev;
+-
+-	if (MAJOR(bdev->bd_dev) == MTD_BLOCK_MAJOR) {
+-		ERROR("attempting to use an MTD device as a block device");
+-		goto devinit_err;
+-	}
+ 
+ 	mutex_init(&dev->write_mutex);
++	rwlock_init(&dev->bdev_mutex);
+ 
+ 	/* Setup the MTD structure */
+ 	/* make the name contain the block device in */
+@@ -298,6 +392,7 @@ static struct block2mtd_dev *add_device(
+ 	dev->mtd.read = block2mtd_read;
+ 	dev->mtd.priv = dev;
+ 	dev->mtd.owner = THIS_MODULE;
++	dev->mtd.refresh_device = block2mtd_refresh;
+ 
+ 	part = kzalloc(sizeof(struct mtd_partition), GFP_KERNEL);
+ 	part->name = name;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/442-block2mtd_probe.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/442-block2mtd_probe.patch.svn-base
new file mode 100644
index 0000000..c427e9f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/442-block2mtd_probe.patch.svn-base
@@ -0,0 +1,10 @@
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -268,6 +268,7 @@ static int _open_bdev(struct block2mtd_d
+ 		/* We might not have rootfs mounted at this point. Try
+ 		   to resolve the device name by other means. */
+ 
++		wait_for_device_probe();
+ 		devt = name_to_dev_t(dev->devname);
+ 		if (devt)
+ 			bdev = blkdev_get_by_dev(devt, mode, dev);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/443-block2mtd-avoid-recursive-call-of-mtd_writev.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/443-block2mtd-avoid-recursive-call-of-mtd_writev.patch.svn-base
new file mode 100644
index 0000000..0ce9368
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/443-block2mtd-avoid-recursive-call-of-mtd_writev.patch.svn-base
@@ -0,0 +1,10 @@
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -388,7 +388,6 @@ static struct block2mtd_dev *add_device(
+ 	dev->mtd.flags = MTD_CAP_RAM;
+ 	dev->mtd.erase = block2mtd_erase;
+ 	dev->mtd.write = block2mtd_write;
+-	dev->mtd.writev = mtd_writev;
+ 	dev->mtd.sync = block2mtd_sync;
+ 	dev->mtd.read = block2mtd_read;
+ 	dev->mtd.priv = dev;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/450-mtd_plat_nand_chip_fixup.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/450-mtd_plat_nand_chip_fixup.patch.svn-base
new file mode 100644
index 0000000..fd2b9b5
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/450-mtd_plat_nand_chip_fixup.patch.svn-base
@@ -0,0 +1,37 @@
+---
+ drivers/mtd/nand/plat_nand.c |   13 ++++++++++++-
+ include/linux/mtd/nand.h     |    1 +
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -622,6 +622,7 @@ struct platform_nand_chip {
+ 	unsigned int options;
+ 	unsigned int bbt_options;
+ 	const char **part_probe_types;
++	int (*chip_fixup)(struct mtd_info *mtd);
+ };
+ 
+ /* Keep gcc happy */
+--- a/drivers/mtd/nand/plat_nand.c
++++ b/drivers/mtd/nand/plat_nand.c
+@@ -93,7 +93,18 @@ static int __devinit plat_nand_probe(str
+ 	}
+ 
+ 	/* Scan to find existence of the device */
+-	if (nand_scan(&data->mtd, pdata->chip.nr_chips)) {
++	if (nand_scan_ident(&data->mtd, pdata->chip.nr_chips, NULL)) {
++		err = -ENXIO;
++		goto out;
++	}
++
++	if (pdata->chip.chip_fixup) {
++		err = pdata->chip.chip_fixup(&data->mtd);
++		if (err)
++			goto out;
++	}
++
++	if (nand_scan_tail(&data->mtd)) {
+ 		err = -ENXIO;
+ 		goto out;
+ 	}
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/451-mtd_fix_nand_correct_data_return_code.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/451-mtd_fix_nand_correct_data_return_code.patch.svn-base
new file mode 100644
index 0000000..2f72d85
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/451-mtd_fix_nand_correct_data_return_code.patch.svn-base
@@ -0,0 +1,12 @@
+--- a/drivers/mtd/nand/nand_ecc.c
++++ b/drivers/mtd/nand/nand_ecc.c
+@@ -507,8 +507,7 @@ int __nand_correct_data(unsigned char *b
+ 	if ((bitsperbyte[b0] + bitsperbyte[b1] + bitsperbyte[b2]) == 1)
+ 		return 1;	/* error in ECC data; no action needed */
+ 
+-	printk(KERN_ERR "uncorrectable error : ");
+-	return -1;
++	return -EBADMSG;
+ }
+ EXPORT_SYMBOL(__nand_correct_data);
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/460-cfi_cmdset_0002_no_erase_suspend.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/460-cfi_cmdset_0002_no_erase_suspend.patch.svn-base
new file mode 100644
index 0000000..0c4b9be
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/460-cfi_cmdset_0002_no_erase_suspend.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -682,7 +682,7 @@ static int get_chip(struct map_info *map
+ 		return 0;
+ 
+ 	case FL_ERASING:
+-		if (!cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
++		if (1 /* no suspend */ || !cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
+ 		    !(mode == FL_READY || mode == FL_POINT ||
+ 		    (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
+ 			goto sleep;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/470-mtd_m25p80_add_pm25lv_flash_support.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/470-mtd_m25p80_add_pm25lv_flash_support.patch.svn-base
new file mode 100644
index 0000000..ff27d04
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/470-mtd_m25p80_add_pm25lv_flash_support.patch.svn-base
@@ -0,0 +1,39 @@
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -45,6 +45,7 @@
+ #define	OPCODE_BE_4K		0x20	/* Erase 4KiB block */
+ #define	OPCODE_BE_32K		0x52	/* Erase 32KiB block */
+ #define	OPCODE_CHIP_ERASE	0xc7	/* Erase whole flash chip */
++#define	OPCODE_BE_4K_PMC	0xd7	/* Erase 4KiB block on PMC chips*/
+ #define	OPCODE_SE		0xd8	/* Sector erase (usually 64KiB) */
+ #define	OPCODE_RDID		0x9f	/* Read JEDEC ID */
+ 
+@@ -625,6 +626,7 @@ struct flash_info {
+ 	u16		flags;
+ #define	SECT_4K		0x01		/* OPCODE_BE_4K works uniformly */
+ #define	M25P_NO_ERASE	0x02		/* No erase command needed */
++#define	SECT_4K_PMC	0x04		/* OPCODE_BE_4K_PMC works uniformly */
+ };
+ 
+ #define INFO(_jedec_id, _ext_id, _sector_size, _n_sectors, _flags)	\
+@@ -686,6 +688,10 @@ static const struct spi_device_id m25p_i
+ 	{ "mx25l25635e", INFO(0xc22019, 0, 64 * 1024, 512, 0) },
+ 	{ "mx25l25655e", INFO(0xc22619, 0, 64 * 1024, 512, 0) },
+ 
++	/* PMC -- pm25x "blocks" are 32K, sectors are 4K */
++	{ "pm25lv512", INFO(0, 0, 32 * 1024, 2, SECT_4K_PMC) },
++	{ "pm25lv010", INFO(0, 0, 32 * 1024, 4, SECT_4K_PMC) },
++
+ 	/* Spansion -- single (large) sector size only, at least
+ 	 * for the chips listed here (without boot sectors).
+ 	 */
+@@ -921,6 +927,9 @@ static int __devinit m25p_probe(struct s
+ 	if (info->flags & SECT_4K) {
+ 		flash->erase_opcode = OPCODE_BE_4K;
+ 		flash->mtd.erasesize = 4096;
++	} else if (info->flags & SECT_4K_PMC) {
++		flash->erase_opcode = OPCODE_BE_4K_PMC;
++		flash->mtd.erasesize = 4096;
+ 	} else {
+ 		flash->erase_opcode = OPCODE_SE;
+ 		flash->mtd.erasesize = info->sector_size;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/473-mtd_m25p80_add_w25q128.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/473-mtd_m25p80_add_w25q128.patch.svn-base
new file mode 100644
index 0000000..b00c9fa
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/473-mtd_m25p80_add_w25q128.patch.svn-base
@@ -0,0 +1,10 @@
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -765,6 +765,7 @@ static const struct spi_device_id m25p_i
+ 	{ "w25q32", INFO(0xef4016, 0, 64 * 1024,  64, SECT_4K) },
+ 	{ "w25x64", INFO(0xef3017, 0, 64 * 1024, 128, SECT_4K) },
+ 	{ "w25q64", INFO(0xef4017, 0, 64 * 1024, 128, SECT_4K) },
++	{ "w25q128", INFO(0xef4018, 0, 64 * 1024, 256, SECT_4K) },
+ 
+ 	/* Catalyst / On Semiconductor -- non-JEDEC */
+ 	{ "cat25c11", CAT25_INFO(  16, 8, 16, 1) },
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/475-mtd_cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/475-mtd_cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch.svn-base
new file mode 100644
index 0000000..3b43535
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/475-mtd_cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch.svn-base
@@ -0,0 +1,18 @@
+From: George Kashperko <george@znau.edu.ua>
+
+Issue map read after Write Buffer Load command to ensure chip is ready
+to receive data.
+Signed-off-by: George Kashperko <george@znau.edu.ua>
+---
+ drivers/mtd/chips/cfi_cmdset_0002.c |    1 +
+ 1 file changed, 1 insertion(+)
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -1409,6 +1409,7 @@ static int __xipram do_write_buffer(stru
+ 
+ 	/* Write Buffer Load */
+ 	map_write(map, CMD(0x25), cmd_adr);
++	(void) map_read(map, cmd_adr);
+ 
+ 	chip->state = FL_WRITING_TO_BUFFER;
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/476-mtd-m25p80-allow-to-disable-small-sector-erase.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/476-mtd-m25p80-allow-to-disable-small-sector-erase.patch.svn-base
new file mode 100644
index 0000000..231d454
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/476-mtd-m25p80-allow-to-disable-small-sector-erase.patch.svn-base
@@ -0,0 +1,41 @@
+--- a/drivers/mtd/devices/Kconfig
++++ b/drivers/mtd/devices/Kconfig
+@@ -102,6 +102,14 @@ config M25PXX_USE_FAST_READ
+ 	help
+ 	  This option enables FAST_READ access supported by ST M25Pxx.
+ 
++config M25PXX_PREFER_SMALL_SECTOR_ERASE
++	bool "Prefer small sector erase"
++	depends on MTD_M25P80
++	default y
++	help
++	  This option enables use of the small erase sectors if that is
++	  supported by the flash chip.
++
+ config MTD_SST25L
+ 	tristate "Support SST25L (non JEDEC) SPI Flash chips"
+ 	depends on SPI_MASTER
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -84,6 +84,12 @@
+ 
+ #define JEDEC_MFR(_jedec_id)	((_jedec_id) >> 16)
+ 
++#ifdef CONFIG_M25PXX_PREFER_SMALL_SECTOR_ERASE
++#define PREFER_SMALL_SECTOR_ERASE 1
++#else
++#define PREFER_SMALL_SECTOR_ERASE 0
++#endif
++
+ /****************************************************************************/
+ 
+ struct m25p {
+@@ -925,7 +931,7 @@ static int __devinit m25p_probe(struct s
+ 		flash->mtd.write = m25p80_write;
+ 
+ 	/* prefer "small sector" erase if possible */
+-	if (info->flags & SECT_4K) {
++	if (PREFER_SMALL_SECTOR_ERASE && (info->flags & SECT_4K)) {
+ 		flash->erase_opcode = OPCODE_BE_4K;
+ 		flash->mtd.erasesize = 4096;
+ 	} else if (info->flags & SECT_4K_PMC) {
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/477-mtd-m25p80-add-support-for-the-EON-EN25Q64-chip.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/477-mtd-m25p80-add-support-for-the-EON-EN25Q64-chip.patch.svn-base
new file mode 100644
index 0000000..439cbde
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/477-mtd-m25p80-add-support-for-the-EON-EN25Q64-chip.patch.svn-base
@@ -0,0 +1,10 @@
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -677,6 +677,7 @@ static const struct spi_device_id m25p_i
+ 	{ "en25p32", INFO(0x1c2016, 0, 64 * 1024,  64, 0) },
+ 	{ "en25q32b", INFO(0x1c3016, 0, 64 * 1024,  64, 0) },
+ 	{ "en25p64", INFO(0x1c2017, 0, 64 * 1024, 128, 0) },
++	{ "en25q64", INFO(0x1c3017, 0, 64 * 1024, 128, SECT_4K) },
+ 
+ 	/* Intel/Numonyx -- xxxs33b */
+ 	{ "160s33b",  INFO(0x898911, 0, 64 * 1024,  32, 0) },
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/478-mtd-partial_eraseblock_unlock.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/478-mtd-partial_eraseblock_unlock.patch.svn-base
new file mode 100644
index 0000000..de4481a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/478-mtd-partial_eraseblock_unlock.patch.svn-base
@@ -0,0 +1,18 @@
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -356,7 +356,14 @@ static int part_unlock(struct mtd_info *
+ 	struct mtd_part *part = PART(mtd);
+ 	if ((len + ofs) > mtd->size)
+ 		return -EINVAL;
+-	return mtd_unlock(part->master, ofs + part->offset, len);
++
++	ofs += part->offset;
++	if (mtd->flags & MTD_ERASE_PARTIAL) {
++		/* round up len to next erasesize and round down offset to prev block */
++		len = (mtd_div_by_eb(len, part->master) + 1) * part->master->erasesize;
++		ofs &= ~(part->master->erasesize - 1);
++	}
++	return mtd_unlock(part->master, ofs, len);
+ }
+ 
+ static int part_is_locked(struct mtd_info *mtd, loff_t ofs, uint64_t len)
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/500-yaffs-Kbuild-integration.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/500-yaffs-Kbuild-integration.patch.svn-base
new file mode 100644
index 0000000..7776dcf
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/500-yaffs-Kbuild-integration.patch.svn-base
@@ -0,0 +1,18 @@
+--- a/fs/Kconfig
++++ b/fs/Kconfig
+@@ -35,6 +35,7 @@ source "fs/gfs2/Kconfig"
+ source "fs/ocfs2/Kconfig"
+ source "fs/btrfs/Kconfig"
+ source "fs/nilfs2/Kconfig"
++source "fs/yaffs2/Kconfig"
+ 
+ endif # BLOCK
+ 
+--- a/fs/Makefile
++++ b/fs/Makefile
+@@ -125,3 +125,5 @@ obj-$(CONFIG_GFS2_FS)           += gfs2/
+ obj-y				+= exofs/ # Multiple modules
+ obj-$(CONFIG_CEPH_FS)		+= ceph/
+ obj-$(CONFIG_PSTORE)		+= pstore/
++obj-$(CONFIG_YAFFS_FS)		+= yaffs2/
++
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/501-yaffs-Fix-directory-unlinking-in-yaffs1-mode.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/501-yaffs-Fix-directory-unlinking-in-yaffs1-mode.patch.svn-base
new file mode 100644
index 0000000..d2bad01
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/501-yaffs-Fix-directory-unlinking-in-yaffs1-mode.patch.svn-base
@@ -0,0 +1,31 @@
+From 2505e8b0a13d3d5c5bbeaaae4eb889864f44c9df Mon Sep 17 00:00:00 2001
+From: Charles Manning <cdhmanning@gmail.com>
+Date: Thu, 3 Feb 2011 05:55:30 +1300
+Subject: [PATCH] yaffs: Fix directory unlinking in yaffs1 mode
+
+commit 964b3425a71890e6701c830e38b04d8557c04f49 upstream.
+
+Treat both yaffs2 and yaffs1 paths the same.
+
+Signed-off-by: Charles Manning <cdhmanning@gmail.com>
+---
+ yaffs_guts.c |    8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/fs/yaffs2/yaffs_guts.c
++++ b/fs/yaffs2/yaffs_guts.c
+@@ -1708,13 +1708,7 @@ static int yaffs_change_obj_name(yaffs_o
+ 		YBUG();
+ 	}
+ 
+-	/* TODO: Do we need this different handling for YAFFS2 and YAFFS1?? */
+-	if (obj->my_dev->param.is_yaffs2)
+-		unlinkOp = (new_dir == obj->my_dev->unlinked_dir);
+-	else
+-		unlinkOp = (new_dir == obj->my_dev->unlinked_dir
+-			    && obj->variant_type == YAFFS_OBJECT_TYPE_FILE);
+-
++	unlinkOp = (new_dir == obj->my_dev->unlinked_dir);
+ 	deleteOp = (new_dir == obj->my_dev->del_dir);
+ 
+ 	existingTarget = yaffs_find_by_name(new_dir, new_name);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/502-yaffs-Switch-from-semaphores-to-mutexes.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/502-yaffs-Switch-from-semaphores-to-mutexes.patch.svn-base
new file mode 100644
index 0000000..8d1872e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/502-yaffs-Switch-from-semaphores-to-mutexes.patch.svn-base
@@ -0,0 +1,138 @@
+From c0c289363e84c53b5872f7c0c5069045096dca07 Mon Sep 17 00:00:00 2001
+From: Charles Manning <cdhmanning@gmail.com>
+Date: Wed, 3 Nov 2010 16:01:12 +1300
+Subject: [PATCH] yaffs: Switch from semaphores to mutexes
+
+commit 73c54aa8c1de3f61a4c211cd47431293a6092f18 upstream.
+
+Mutex is faster and init_MUTEX has been deprecated, so we'll just switch
+to mutexes.
+
+Signed-off-by: Charles Manning <cdhmanning@gmail.com>
+---
+ yaffs_linux.h     |    2 +-
+ yaffs_vfs.c       |   24 ++++++++++++------------
+ yaffs_vfs_multi.c |   26 +++++++++++++-------------
+ 3 files changed, 26 insertions(+), 26 deletions(-)
+
+--- a/fs/yaffs2/yaffs_linux.h
++++ b/fs/yaffs2/yaffs_linux.h
+@@ -25,7 +25,7 @@ struct yaffs_LinuxContext {
+ 	struct super_block * superBlock;
+ 	struct task_struct *bgThread; /* Background thread for this device */
+ 	int bgRunning;
+-        struct semaphore grossLock;     /* Gross locking semaphore */
++	struct mutex grossLock;	/* Gross locking mutex*/
+ 	__u8 *spareBuffer;      /* For mtdif2 use. Don't know the size of the buffer
+ 				 * at compile time so we have to allocate it.
+ 				 */
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -515,14 +515,14 @@ static unsigned yaffs_gc_control_callbac
+ static void yaffs_gross_lock(yaffs_dev_t *dev)
+ {
+ 	T(YAFFS_TRACE_LOCK, (TSTR("yaffs locking %p\n"), current));
+-	down(&(yaffs_dev_to_lc(dev)->grossLock));
++	mutex_lock(&(yaffs_dev_to_lc(dev)->grossLock));
+ 	T(YAFFS_TRACE_LOCK, (TSTR("yaffs locked %p\n"), current));
+ }
+ 
+ static void yaffs_gross_unlock(yaffs_dev_t *dev)
+ {
+ 	T(YAFFS_TRACE_LOCK, (TSTR("yaffs unlocking %p\n"), current));
+-	up(&(yaffs_dev_to_lc(dev)->grossLock));
++	mutex_unlock(&(yaffs_dev_to_lc(dev)->grossLock));
+ }
+ 
+ #ifdef YAFFS_COMPILE_EXPORTFS
+@@ -2542,7 +2542,7 @@ static void yaffs_read_inode(struct inod
+ #endif
+ 
+ static YLIST_HEAD(yaffs_context_list);
+-struct semaphore yaffs_context_lock;
++struct mutex yaffs_context_lock;
+ 
+ static void yaffs_put_super(struct super_block *sb)
+ {
+@@ -2568,9 +2568,9 @@ static void yaffs_put_super(struct super
+ 
+ 	yaffs_gross_unlock(dev);
+ 
+-	down(&yaffs_context_lock);
++	mutex_lock(&yaffs_context_lock);
+ 	ylist_del_init(&(yaffs_dev_to_lc(dev)->contextList));
+-	up(&yaffs_context_lock);
++	mutex_unlock(&yaffs_context_lock);
+ 
+ 	if (yaffs_dev_to_lc(dev)->spareBuffer) {
+ 		YFREE(yaffs_dev_to_lc(dev)->spareBuffer);
+@@ -3016,7 +3016,7 @@ static struct super_block *yaffs_interna
+ 	param->skip_checkpt_rd = options.skip_checkpoint_read;
+ 	param->skip_checkpt_wr = options.skip_checkpoint_write;
+ 
+-	down(&yaffs_context_lock);
++	mutex_lock(&yaffs_context_lock);
+ 	/* Get a mount id */
+ 	found = 0;
+ 	for(mount_id=0; ! found; mount_id++){
+@@ -3030,13 +3030,13 @@ static struct super_block *yaffs_interna
+ 	context->mount_id = mount_id;
+ 
+ 	ylist_add_tail(&(yaffs_dev_to_lc(dev)->contextList), &yaffs_context_list);
+-	up(&yaffs_context_lock);
++	mutex_unlock(&yaffs_context_lock);
+ 
+         /* Directory search handling...*/
+         YINIT_LIST_HEAD(&(yaffs_dev_to_lc(dev)->searchContexts));
+         param->remove_obj_fn = yaffs_remove_obj_callback;
+ 
+-	init_MUTEX(&(yaffs_dev_to_lc(dev)->grossLock));
++	mutex_init(&(yaffs_dev_to_lc(dev)->grossLock));
+ 
+ 	yaffs_gross_lock(dev);
+ 
+@@ -3268,7 +3268,7 @@ static int yaffs_proc_read(char *page,
+ 	else {
+ 		step-=2;
+ 		
+-		down(&yaffs_context_lock);
++		mutex_lock(&yaffs_context_lock);
+ 
+ 		/* Locate and print the Nth entry.  Order N-squared but N is small. */
+ 		ylist_for_each(item, &yaffs_context_list) {
+@@ -3287,7 +3287,7 @@ static int yaffs_proc_read(char *page,
+ 			
+ 			break;
+ 		}
+-		up(&yaffs_context_lock);
++		mutex_unlock(&yaffs_context_lock);
+ 	}
+ 
+ 	return buf - page < count ? buf - page : count;
+@@ -3301,7 +3301,7 @@ static int yaffs_stats_proc_read(char *p
+ 	char *buf = page;
+ 	int n = 0;
+ 
+-	down(&yaffs_context_lock);
++	mutex_lock(&yaffs_context_lock);
+ 
+ 	/* Locate and print the Nth entry.  Order N-squared but N is small. */
+ 	ylist_for_each(item, &yaffs_context_list) {
+@@ -3317,7 +3317,7 @@ static int yaffs_stats_proc_read(char *p
+ 				dev->bg_gcs, dev->oldest_dirty_gc_count,
+ 				dev->n_obj, dev->n_tnodes);
+ 	}
+-	up(&yaffs_context_lock);
++	mutex_unlock(&yaffs_context_lock);
+ 
+ 
+ 	return buf - page < count ? buf - page : count;
+@@ -3494,7 +3494,7 @@ static int __init init_yaffs_fs(void)
+ 
+ 
+ 
+-	init_MUTEX(&yaffs_context_lock);
++	mutex_init(&yaffs_context_lock);
+ 
+ 	/* Install the proc_fs entries */
+ 	my_proc_entry = create_proc_entry("yaffs",
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/503-yaffs-Replace-yaffs_dir_llseek-with-Linux-generic-ll.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/503-yaffs-Replace-yaffs_dir_llseek-with-Linux-generic-ll.patch.svn-base
new file mode 100644
index 0000000..d283e85
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/503-yaffs-Replace-yaffs_dir_llseek-with-Linux-generic-ll.patch.svn-base
@@ -0,0 +1,72 @@
+From cd6657c4bde20886b0805ea9f2cbac7ec25ac2e5 Mon Sep 17 00:00:00 2001
+From: Charles Manning <cdhmanning@gmail.com>
+Date: Tue, 30 Nov 2010 16:01:28 +1300
+Subject: [PATCH 1/2] yaffs: Replace yaffs_dir_llseek with Linux generic
+ llseek
+
+commit ed8188fb7659cfb65b5adbe154d143190ade0324 upstream.
+
+There was not much point in having the yaffs version as it is
+functionally equivalent to the kernel one.
+
+This also gets rid of using BKL in yaffs2.
+
+Signed-off-by: Charles Manning <cdhmanning@gmail.com>
+---
+ yaffs_vfs.c       |   30 +-----------------------------
+ yaffs_vfs_multi.c |   30 +-----------------------------
+ 2 files changed, 2 insertions(+), 58 deletions(-)
+
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -342,8 +342,6 @@ static int yaffs_follow_link(struct dent
+ 
+ static void yaffs_touch_super(yaffs_dev_t *dev);
+ 
+-static loff_t yaffs_dir_llseek(struct file *file, loff_t offset, int origin);
+-
+ static int yaffs_vfs_setattr(struct inode *, struct iattr *);
+ 
+ 
+@@ -460,7 +458,7 @@ static const struct file_operations yaff
+ 	.read = generic_read_dir,
+ 	.readdir = yaffs_readdir,
+ 	.fsync = yaffs_sync_object,
+-	.llseek = yaffs_dir_llseek,
++	.llseek = generic_file_llseek,
+ };
+ 
+ static const struct super_operations yaffs_super_ops = {
+@@ -1534,32 +1532,6 @@ static void yaffs_release_space(struct f
+ }
+ 
+ 
+-static loff_t yaffs_dir_llseek(struct file *file, loff_t offset, int origin)
+-{
+-	long long retval;
+-
+-	lock_kernel();
+-
+-	switch (origin){
+-	case 2:
+-		offset += i_size_read(file->f_path.dentry->d_inode);
+-		break;
+-	case 1:
+-		offset += file->f_pos;
+-	}
+-	retval = -EINVAL;
+-
+-	if (offset >= 0){
+-		if (offset != file->f_pos)
+-			file->f_pos = offset;
+-
+-		retval = offset;
+-	}
+-	unlock_kernel();
+-	return retval;
+-}
+-
+-
+ static int yaffs_readdir(struct file *f, void *dirent, filldir_t filldir)
+ {
+ 	yaffs_obj_t *obj;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/504-yaffs-Mods-for-Linux-3.0-and-fix-a-typo.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/504-yaffs-Mods-for-Linux-3.0-and-fix-a-typo.patch.svn-base
new file mode 100644
index 0000000..1b814e9
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/504-yaffs-Mods-for-Linux-3.0-and-fix-a-typo.patch.svn-base
@@ -0,0 +1,110 @@
+From e1537a700c2e750c5eacc5ad93f30821f1e94424 Mon Sep 17 00:00:00 2001
+From: Charles Manning <cdhmanning@gmail.com>
+Date: Mon, 15 Aug 2011 11:40:30 +1200
+Subject: [PATCH 2/2] Mods for Linux 3.0 and fix a typo
+
+commit a7b5dcf904ba6f7890e4b77ce1f56388b855d0f6 upstream.
+
+Roll in NCB's patch and some other changes for Linux 3.0.
+Also fix a dumb type retired_writes->retried_writes
+
+Signed-off-by: Charles Manning <cdhmanning@gmail.com>
+---
+ patch-ker.sh      |    2 +-
+ yaffs_vfs_glue.c |   42 ++++++++++++++++++++++++++++++++++--------
+ 2 files changed, 35 insertions(+), 9 deletions(-)
+
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -72,7 +72,9 @@
+ #include <linux/init.h>
+ #include <linux/fs.h>
+ #include <linux/proc_fs.h>
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 39))
+ #include <linux/smp_lock.h>
++#endif
+ #include <linux/pagemap.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/interrupt.h>
+@@ -236,7 +238,9 @@ static int yaffs_file_flush(struct file
+ static int yaffs_file_flush(struct file *file);
+ #endif
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 34))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++static int yaffs_sync_object(struct file *file, loff_t start, loff_t end, int datasync);
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 34))
+ static int yaffs_sync_object(struct file *file, int datasync);
+ #else
+ static int yaffs_sync_object(struct file *file, struct dentry *dentry,
+@@ -1864,7 +1868,9 @@ static int yaffs_symlink(struct inode *d
+ 	return -ENOMEM;
+ }
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 34))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++static int yaffs_sync_object(struct file *file, loff_t start, loff_t end, int datasync)
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 34))
+ static int yaffs_sync_object(struct file *file, int datasync)
+ #else
+ static int yaffs_sync_object(struct file *file, struct dentry *dentry,
+@@ -3067,7 +3073,13 @@ static int yaffs_internal_read_super_mtd
+ 	return yaffs_internal_read_super(1, sb, data, silent) ? 0 : -EINVAL;
+ }
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++static struct dentry *yaffs_mount(struct file_system_type *fs_type, int flags,
++        const char *dev_name, void *data)
++{
++    return mount_bdev(fs_type, flags, dev_name, data, yaffs_internal_read_super_mtd);
++}
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
+ static int yaffs_read_super(struct file_system_type *fs,
+ 			    int flags, const char *dev_name,
+ 			    void *data, struct vfsmount *mnt)
+@@ -3090,8 +3102,12 @@ static struct super_block *yaffs_read_su
+ static struct file_system_type yaffs_fs_type = {
+ 	.owner = THIS_MODULE,
+ 	.name = "yaffs",
+-	.get_sb = yaffs_read_super,
+-	.kill_sb = kill_block_super,
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++        .mount = yaffs_mount,
++#else
++        .get_sb = yaffs_read_super,
++#endif
++     	.kill_sb = kill_block_super,
+ 	.fs_flags = FS_REQUIRES_DEV,
+ };
+ #else
+@@ -3115,7 +3131,13 @@ static int yaffs2_internal_read_super_mt
+ 	return yaffs_internal_read_super(2, sb, data, silent) ? 0 : -EINVAL;
+ }
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++static struct dentry *yaffs2_mount(struct file_system_type *fs_type, int flags,
++        const char *dev_name, void *data)
++{
++        return mount_bdev(fs_type, flags, dev_name, data, yaffs2_internal_read_super_mtd);
++}
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
+ static int yaffs2_read_super(struct file_system_type *fs,
+ 			int flags, const char *dev_name, void *data,
+ 			struct vfsmount *mnt)
+@@ -3137,8 +3159,12 @@ static struct super_block *yaffs2_read_s
+ static struct file_system_type yaffs2_fs_type = {
+ 	.owner = THIS_MODULE,
+ 	.name = "yaffs2",
+-	.get_sb = yaffs2_read_super,
+-	.kill_sb = kill_block_super,
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++        .mount = yaffs2_mount,
++#else
++        .get_sb = yaffs2_read_super,
++#endif
++     	.kill_sb = kill_block_super,
+ 	.fs_flags = FS_REQUIRES_DEV,
+ };
+ #else
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/505-yaffs-3.2-use-MTD_OPS_AUTO_OOB.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/505-yaffs-3.2-use-MTD_OPS_AUTO_OOB.patch.svn-base
new file mode 100644
index 0000000..463f4a2
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/505-yaffs-3.2-use-MTD_OPS_AUTO_OOB.patch.svn-base
@@ -0,0 +1,54 @@
+--- a/fs/yaffs2/yaffs_mtdif1.c
++++ b/fs/yaffs2/yaffs_mtdif1.c
+@@ -127,7 +127,7 @@ int nandmtd1_WriteChunkWithTagsToNAND(ya
+ #endif
+ 
+ 	memset(&ops, 0, sizeof(ops));
+-	ops.mode = MTD_OOB_AUTO;
++	ops.mode = MTD_OPS_AUTO_OOB;
+ 	ops.len = (data) ? chunkBytes : 0;
+ 	ops.ooblen = YTAG1_SIZE;
+ 	ops.datbuf = (__u8 *)data;
+@@ -179,7 +179,7 @@ int nandmtd1_ReadChunkWithTagsFromNAND(y
+ 	int deleted;
+ 
+ 	memset(&ops, 0, sizeof(ops));
+-	ops.mode = MTD_OOB_AUTO;
++	ops.mode = MTD_OPS_AUTO_OOB;
+ 	ops.len = (data) ? chunkBytes : 0;
+ 	ops.ooblen = YTAG1_SIZE;
+ 	ops.datbuf = data;
+--- a/fs/yaffs2/yaffs_mtdif2.c
++++ b/fs/yaffs2/yaffs_mtdif2.c
+@@ -71,7 +71,7 @@ int nandmtd2_WriteChunkWithTagsToNAND(ya
+ 		yaffs_PackTags2(&pt, tags, !dev->param.no_tags_ecc);
+ 
+ #if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
+-	ops.mode = MTD_OOB_AUTO;
++	ops.mode = MTD_OPS_AUTO_OOB;
+ 	ops.ooblen = (dev->param.inband_tags) ? 0 : packed_tags_size;
+ 	ops.len = dev->param.total_bytes_per_chunk;
+ 	ops.ooboffs = 0;
+@@ -136,7 +136,7 @@ int nandmtd2_ReadChunkWithTagsFromNAND(y
+ 		retval = mtd->read(mtd, addr, dev->param.total_bytes_per_chunk,
+ 				&dummy, data);
+ 	else if (tags) {
+-		ops.mode = MTD_OOB_AUTO;
++		ops.mode = MTD_OPS_AUTO_OOB;
+ 		ops.ooblen = packed_tags_size;
+ 		ops.len = data ? dev->data_bytes_per_chunk : packed_tags_size;
+ 		ops.ooboffs = 0;
+--- a/fs/yaffs2/yaffs_mtdif.h
++++ b/fs/yaffs2/yaffs_mtdif.h
+@@ -24,4 +24,11 @@ extern struct nand_oobinfo yaffs_noeccin
+ #endif
+ int nandmtd_EraseBlockInNAND(yaffs_dev_t *dev, int blockNumber);
+ int nandmtd_InitialiseNAND(yaffs_dev_t *dev);
++
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
++#include <mtd/mtd-abi.h>
++#else
++#define MTD_OPS_AUTO_OOB 	MTD_OOB_AUTO
++#endif
++
+ #endif
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/506-yaffs-3.2-dont-use-i_nlink-directly.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/506-yaffs-3.2-dont-use-i_nlink-directly.patch.svn-base
new file mode 100644
index 0000000..91e8281
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/506-yaffs-3.2-dont-use-i_nlink-directly.patch.svn-base
@@ -0,0 +1,78 @@
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -220,6 +220,29 @@ static struct inode *yaffs_iget(struct s
+ #define yaffs_SuperToDevice(sb)	((yaffs_dev_t *)sb->u.generic_sbp)
+ #endif
+ 
++#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0))
++static inline void yaffs_set_nlink(struct inode *inode, unsigned int nlink)
++{
++	set_nlink(inode, nlink);
++}
++
++static inline void yaffs_dec_link_count(struct inode *inode)
++{
++	inode_dec_link_count(inode);
++}
++#else
++static inline void yaffs_set_nlink(struct inode *inode, unsigned int nlink)
++{
++	inode->i_nlink = nlink;
++}
++
++static inline void yaffs_dec_link_count(struct inode *inode)
++{
++	inode->i_nlink--;
++	mark_inode_dirty(inode)
++}
++#endif
++
+ 
+ #define update_dir_time(dir) do {\
+ 			(dir)->i_ctime = (dir)->i_mtime = CURRENT_TIME; \
+@@ -1362,7 +1385,7 @@ static void yaffs_fill_inode_from_obj(st
+ 		inode->i_size = yaffs_get_obj_length(obj);
+ 		inode->i_blocks = (inode->i_size + 511) >> 9;
+ 
+-		inode->i_nlink = yaffs_get_obj_link_count(obj);
++		yaffs_set_nlink(inode, yaffs_get_obj_link_count(obj));
+ 
+ 		T(YAFFS_TRACE_OS,
+ 			(TSTR("yaffs_fill_inode mode %x uid %d gid %d size %d count %d\n"),
+@@ -1784,10 +1807,9 @@ static int yaffs_unlink(struct inode *di
+ 	retVal = yaffs_unlinker(obj, dentry->d_name.name);
+ 
+ 	if (retVal == YAFFS_OK) {
+-		dentry->d_inode->i_nlink--;
++		yaffs_dec_link_count(dentry->d_inode);
+ 		dir->i_version++;
+ 		yaffs_gross_unlock(dev);
+-		mark_inode_dirty(dentry->d_inode);
+ 		update_dir_time(dir);
+ 		return 0;
+ 	}
+@@ -1818,7 +1840,8 @@ static int yaffs_link(struct dentry *old
+ 			obj);
+ 
+ 	if (link) {
+-		old_dentry->d_inode->i_nlink = yaffs_get_obj_link_count(obj);
++		yaffs_set_nlink(old_dentry->d_inode,
++				yaffs_get_obj_link_count(obj));
+ 		d_instantiate(dentry, old_dentry->d_inode);
+ 		atomic_inc(&old_dentry->d_inode->i_count);
+ 		T(YAFFS_TRACE_OS,
+@@ -1937,11 +1960,9 @@ static int yaffs_rename(struct inode *ol
+ 	yaffs_gross_unlock(dev);
+ 
+ 	if (retVal == YAFFS_OK) {
+-		if (target) {
+-			new_dentry->d_inode->i_nlink--;
+-			mark_inode_dirty(new_dentry->d_inode);
+-		}
+-		
++		if (target)
++			yaffs_dec_link_count(new_dentry->d_inode);
++
+ 		update_dir_time(old_dir);
+ 		if(old_dir != new_dir)
+ 			update_dir_time(new_dir);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/507-yaffs-3.3_fix.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/507-yaffs-3.3_fix.patch.svn-base
new file mode 100644
index 0000000..d823fc4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/507-yaffs-3.3_fix.patch.svn-base
@@ -0,0 +1,71 @@
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -273,8 +273,13 @@ static int yaffs_sync_object(struct file
+ static int yaffs_readdir(struct file *f, void *dirent, filldir_t filldir);
+ 
+ #if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
++			struct nameidata *n);
++#else
+ static int yaffs_create(struct inode *dir, struct dentry *dentry, int mode,
+ 			struct nameidata *n);
++#endif
+ static struct dentry *yaffs_lookup(struct inode *dir, struct dentry *dentry,
+ 					struct nameidata *n);
+ #else
+@@ -286,9 +291,17 @@ static int yaffs_link(struct dentry *old
+ static int yaffs_unlink(struct inode *dir, struct dentry *dentry);
+ static int yaffs_symlink(struct inode *dir, struct dentry *dentry,
+ 			const char *symname);
++
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
++#else
+ static int yaffs_mkdir(struct inode *dir, struct dentry *dentry, int mode);
++#endif
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
++			dev_t dev);
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
+ static int yaffs_mknod(struct inode *dir, struct dentry *dentry, int mode,
+ 			dev_t dev);
+ #else
+@@ -1679,7 +1692,10 @@ out:
+ #define YCRED(x) (x->cred)
+ #endif
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
++			dev_t rdev)
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
+ static int yaffs_mknod(struct inode *dir, struct dentry *dentry, int mode,
+ 			dev_t rdev)
+ #else
+@@ -1769,7 +1785,11 @@ static int yaffs_mknod(struct inode *dir
+ 	return error;
+ }
+ 
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
++#else
+ static int yaffs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
++#endif
+ {
+ 	int retVal;
+ 	T(YAFFS_TRACE_OS, (TSTR("yaffs_mkdir\n")));
+@@ -1777,7 +1797,10 @@ static int yaffs_mkdir(struct inode *dir
+ 	return retVal;
+ }
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
++			struct nameidata *n)
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
+ static int yaffs_create(struct inode *dir, struct dentry *dentry, int mode,
+ 			struct nameidata *n)
+ #else
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/508-yaffs-3.3-use-mtd_-helpers.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/508-yaffs-3.3-use-mtd_-helpers.patch.svn-base
new file mode 100644
index 0000000..65d45a0
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/508-yaffs-3.3-use-mtd_-helpers.patch.svn-base
@@ -0,0 +1,160 @@
+--- a/fs/yaffs2/yaffs_mtdif1.c
++++ b/fs/yaffs2/yaffs_mtdif1.c
+@@ -133,7 +133,7 @@ int nandmtd1_WriteChunkWithTagsToNAND(ya
+ 	ops.datbuf = (__u8 *)data;
+ 	ops.oobbuf = (__u8 *)&pt1;
+ 
+-	retval = mtd->write_oob(mtd, addr, &ops);
++	retval = mtd_write_oob(mtd, addr, &ops);
+ 	if (retval) {
+ 		T(YAFFS_TRACE_MTD,
+ 			(TSTR("write_oob failed, chunk %d, mtd error %d"TENDSTR),
+@@ -194,7 +194,7 @@ int nandmtd1_ReadChunkWithTagsFromNAND(y
+ 	/* Read page and oob using MTD.
+ 	 * Check status and determine ECC result.
+ 	 */
+-	retval = mtd->read_oob(mtd, addr, &ops);
++	retval = mtd_read_oob(mtd, addr, &ops);
+ 	if (retval) {
+ 		T(YAFFS_TRACE_MTD,
+ 			(TSTR("read_oob failed, chunk %d, mtd error %d"TENDSTR),
+@@ -218,7 +218,7 @@ int nandmtd1_ReadChunkWithTagsFromNAND(y
+ 		/* fall into... */
+ 	default:
+ 		rettags(etags, YAFFS_ECC_RESULT_UNFIXED, 0);
+-		etags->block_bad = (mtd->block_isbad)(mtd, addr);
++		etags->block_bad = mtd_block_isbad(mtd, addr);
+ 		return YAFFS_FAIL;
+ 	}
+ 
+@@ -286,7 +286,7 @@ int nandmtd1_MarkNANDBlockBad(struct yaf
+ 
+ 	T(YAFFS_TRACE_BAD_BLOCKS,(TSTR("marking block %d bad"TENDSTR), block_no));
+ 
+-	retval = mtd->block_markbad(mtd, (loff_t)blocksize * block_no);
++	retval = mtd_block_markbad(mtd, (loff_t)blocksize * block_no);
+ 	return (retval) ? YAFFS_FAIL : YAFFS_OK;
+ }
+ 
+@@ -336,7 +336,7 @@ int nandmtd1_QueryNANDBlock(struct yaffs
+ 		return YAFFS_FAIL;
+ 
+ 	retval = nandmtd1_ReadChunkWithTagsFromNAND(dev, chunkNo, NULL, &etags);
+-	etags.block_bad = (mtd->block_isbad)(mtd, addr);
++	etags.block_bad = mtd_block_isbad(mtd, addr);
+ 	if (etags.block_bad) {
+ 		T(YAFFS_TRACE_BAD_BLOCKS,
+ 			(TSTR("block %d is marked bad"TENDSTR), block_no));
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -2607,8 +2607,8 @@ static void yaffs_MTDPutSuper(struct sup
+ {
+ 	struct mtd_info *mtd = yaffs_dev_to_mtd(yaffs_SuperToDevice(sb));
+ 
+-	if (mtd->sync)
+-		mtd->sync(mtd);
++	if (mtd)
++		mtd_sync(mtd);
+ 
+ 	put_mtd_device(mtd);
+ }
+--- a/fs/yaffs2/yaffs_mtdif2.c
++++ b/fs/yaffs2/yaffs_mtdif2.c
+@@ -77,7 +77,7 @@ int nandmtd2_WriteChunkWithTagsToNAND(ya
+ 	ops.ooboffs = 0;
+ 	ops.datbuf = (__u8 *)data;
+ 	ops.oobbuf = (dev->param.inband_tags) ? NULL : packed_tags_ptr;
+-	retval = mtd->write_oob(mtd, addr, &ops);
++	retval = mtd_write_oob(mtd, addr, &ops);
+ 
+ #else
+ 	if (!dev->param.inband_tags) {
+@@ -133,7 +133,7 @@ int nandmtd2_ReadChunkWithTagsFromNAND(y
+ 
+ #if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
+ 	if (dev->param.inband_tags || (data && !tags))
+-		retval = mtd->read(mtd, addr, dev->param.total_bytes_per_chunk,
++		retval = mtd_read(mtd, addr, dev->param.total_bytes_per_chunk,
+ 				&dummy, data);
+ 	else if (tags) {
+ 		ops.mode = MTD_OPS_AUTO_OOB;
+@@ -142,7 +142,7 @@ int nandmtd2_ReadChunkWithTagsFromNAND(y
+ 		ops.ooboffs = 0;
+ 		ops.datbuf = data;
+ 		ops.oobbuf = yaffs_dev_to_lc(dev)->spareBuffer;
+-		retval = mtd->read_oob(mtd, addr, &ops);
++		retval = mtd_read_oob(mtd, addr, &ops);
+ 	}
+ #else
+ 	if (!dev->param.inband_tags && data && tags) {
+@@ -201,7 +201,7 @@ int nandmtd2_MarkNANDBlockBad(struct yaf
+ 	  (TSTR("nandmtd2_MarkNANDBlockBad %d" TENDSTR), block_no));
+ 
+ 	retval =
+-	    mtd->block_markbad(mtd,
++	    mtd_block_markbad(mtd,
+ 			       block_no * dev->param.chunks_per_block *
+ 			       dev->param.total_bytes_per_chunk);
+ 
+@@ -221,7 +221,7 @@ int nandmtd2_QueryNANDBlock(struct yaffs
+ 	T(YAFFS_TRACE_MTD,
+ 	  (TSTR("nandmtd2_QueryNANDBlock %d" TENDSTR), block_no));
+ 	retval =
+-	    mtd->block_isbad(mtd,
++	    mtd_block_isbad(mtd,
+ 			     block_no * dev->param.chunks_per_block *
+ 			     dev->param.total_bytes_per_chunk);
+ 
+--- a/fs/yaffs2/yaffs_mtdif.h
++++ b/fs/yaffs2/yaffs_mtdif.h
+@@ -31,4 +31,39 @@ int nandmtd_InitialiseNAND(yaffs_dev_t *
+ #define MTD_OPS_AUTO_OOB 	MTD_OOB_AUTO
+ #endif
+ 
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 3, 0))
++static inline int mtd_erase(struct mdt_info *mtd, struct erase_info *ei)
++{
++	return mtd->erase(mtd, ei);
++}
++
++static inline int mtd_block_markbad(struct mtd_info *mtd, loff_t ofs)
++{
++	return mtd->block_mark_bad(mtd, ofs);
++}
++
++static inline int mtd_block_isbad(struct mtd_info *mtd, loff_t ofs)
++{
++	return mtd->block_is_bad(mtd, ofs);
++}
++
++static inline int mtd_read_oob(struct mtd_info *mtd, loff_t from,
++			       struct mtd_oob_ops *ops)
++{
++	return mtd->read_oob(mtd, from, ops);
++}
++
++static inline int mtd_write_oob(struct mtd_info *mtd, loff_t to,
++				struct mtd_oob_ops *ops)
++{
++	return mtd->write_oob(mtd, to, ops);
++}
++
++static inline void mtd_sync(struct mtd_info *mtd)
++{
++	if (mtd->sync)
++		mtd->sync(mtd);
++}
++#endif
++
+ #endif
+--- a/fs/yaffs2/yaffs_mtdif.c
++++ b/fs/yaffs2/yaffs_mtdif.c
+@@ -41,7 +41,7 @@ int nandmtd_EraseBlockInNAND(yaffs_dev_t
+ 	ei.callback = NULL;
+ 	ei.priv = (u_long) dev;
+ 
+-	retval = mtd->erase(mtd, &ei);
++	retval = mtd_erase(mtd, &ei);
+ 
+ 	if (retval == 0)
+ 		return YAFFS_OK;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/520-squashfs_update_xz_comp_opts.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/520-squashfs_update_xz_comp_opts.patch.svn-base
new file mode 100644
index 0000000..523b89f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/520-squashfs_update_xz_comp_opts.patch.svn-base
@@ -0,0 +1,25 @@
+From f31b7c0efa255dd17a5f584022a319387f09b0d8 Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jonas.gorski@gmail.com>
+Date: Tue, 12 Apr 2011 19:55:41 +0200
+Subject: [PATCH] squashfs: update xz compressor options struct.
+
+Update the xz compressor options struct to match the squashfs userspace
+one.
+---
+ fs/squashfs/xz_wrapper.c |    4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+--- a/fs/squashfs/xz_wrapper.c
++++ b/fs/squashfs/xz_wrapper.c
+@@ -39,8 +39,10 @@ struct squashfs_xz {
+ };
+ 
+ struct comp_opts {
+-	__le32 dictionary_size;
+ 	__le32 flags;
++	__le16 bit_opts;
++	__le16 fb;
++	__le32 dictionary_size;
+ };
+ 
+ static void *squashfs_xz_init(struct squashfs_sb_info *msblk, void *buff,
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/530-jffs2_make_lzma_available.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/530-jffs2_make_lzma_available.patch.svn-base
new file mode 100644
index 0000000..fa79ba3
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/530-jffs2_make_lzma_available.patch.svn-base
@@ -0,0 +1,5142 @@
+--- a/fs/jffs2/Kconfig
++++ b/fs/jffs2/Kconfig
+@@ -139,6 +139,15 @@ config JFFS2_LZO
+ 	  This feature was added in July, 2007. Say 'N' if you need
+ 	  compatibility with older bootloaders or kernels.
+ 
++config JFFS2_LZMA
++	bool "JFFS2 LZMA compression support" if JFFS2_COMPRESSION_OPTIONS
++	select LZMA_COMPRESS
++	select LZMA_DECOMPRESS
++	depends on JFFS2_FS
++	default n
++	help
++	  JFFS2 wrapper to the LZMA C SDK
++
+ config JFFS2_RTIME
+ 	bool "JFFS2 RTIME compression support" if JFFS2_COMPRESSION_OPTIONS
+ 	depends on JFFS2_FS
+--- a/fs/jffs2/Makefile
++++ b/fs/jffs2/Makefile
+@@ -18,4 +18,7 @@ jffs2-$(CONFIG_JFFS2_RUBIN)	+= compr_rub
+ jffs2-$(CONFIG_JFFS2_RTIME)	+= compr_rtime.o
+ jffs2-$(CONFIG_JFFS2_ZLIB)	+= compr_zlib.o
+ jffs2-$(CONFIG_JFFS2_LZO)	+= compr_lzo.o
++jffs2-$(CONFIG_JFFS2_LZMA)      += compr_lzma.o
+ jffs2-$(CONFIG_JFFS2_SUMMARY)   += summary.o
++
++CFLAGS_compr_lzma.o += -Iinclude/linux -Ilib/lzma
+--- a/fs/jffs2/compr.c
++++ b/fs/jffs2/compr.c
+@@ -374,6 +374,9 @@ int __init jffs2_compressors_init(void)
+ #ifdef CONFIG_JFFS2_LZO
+ 	jffs2_lzo_init();
+ #endif
++#ifdef CONFIG_JFFS2_LZMA
++        jffs2_lzma_init();
++#endif
+ /* Setting default compression mode */
+ #ifdef CONFIG_JFFS2_CMODE_NONE
+ 	jffs2_compression_mode = JFFS2_COMPR_MODE_NONE;
+@@ -397,6 +400,9 @@ int __init jffs2_compressors_init(void)
+ int jffs2_compressors_exit(void)
+ {
+ /* Unregistering compressors */
++#ifdef CONFIG_JFFS2_LZMA
++        jffs2_lzma_exit();
++#endif
+ #ifdef CONFIG_JFFS2_LZO
+ 	jffs2_lzo_exit();
+ #endif
+--- a/fs/jffs2/compr.h
++++ b/fs/jffs2/compr.h
+@@ -29,9 +29,9 @@
+ #define JFFS2_DYNRUBIN_PRIORITY  20
+ #define JFFS2_LZARI_PRIORITY     30
+ #define JFFS2_RTIME_PRIORITY     50
+-#define JFFS2_ZLIB_PRIORITY      60
+-#define JFFS2_LZO_PRIORITY       80
+-
++#define JFFS2_LZMA_PRIORITY      70
++#define JFFS2_ZLIB_PRIORITY      80
++#define JFFS2_LZO_PRIORITY       90
+ 
+ #define JFFS2_RUBINMIPS_DISABLED /* RUBINs will be used only */
+ #define JFFS2_DYNRUBIN_DISABLED  /*	   for decompression */
+@@ -101,5 +101,9 @@ void jffs2_zlib_exit(void);
+ int jffs2_lzo_init(void);
+ void jffs2_lzo_exit(void);
+ #endif
++#ifdef CONFIG_JFFS2_LZMA
++int jffs2_lzma_init(void);
++void jffs2_lzma_exit(void);
++#endif
+ 
+ #endif /* __JFFS2_COMPR_H__ */
+--- /dev/null
++++ b/fs/jffs2/compr_lzma.c
+@@ -0,0 +1,128 @@
++/*
++ * JFFS2 -- Journalling Flash File System, Version 2.
++ *
++ * For licensing information, see the file 'LICENCE' in this directory.
++ *
++ * JFFS2 wrapper to the LZMA C SDK
++ *
++ */
++
++#include <linux/lzma.h>
++#include "compr.h"
++
++#ifdef __KERNEL__
++	static DEFINE_MUTEX(deflate_mutex);
++#endif
++
++CLzmaEncHandle *p;
++Byte propsEncoded[LZMA_PROPS_SIZE];
++SizeT propsSize = sizeof(propsEncoded);
++
++STATIC void lzma_free_workspace(void)
++{
++	LzmaEnc_Destroy(p, &lzma_alloc, &lzma_alloc);
++}
++
++STATIC int INIT lzma_alloc_workspace(CLzmaEncProps *props)
++{
++	if ((p = (CLzmaEncHandle *)LzmaEnc_Create(&lzma_alloc)) == NULL)
++	{
++		PRINT_ERROR("Failed to allocate lzma deflate workspace\n");
++		return -ENOMEM;
++	}
++
++	if (LzmaEnc_SetProps(p, props) != SZ_OK)
++	{
++		lzma_free_workspace();
++		return -1;
++	}
++	
++	if (LzmaEnc_WriteProperties(p, propsEncoded, &propsSize) != SZ_OK)
++	{
++		lzma_free_workspace();
++		return -1;
++	}
++
++        return 0;
++}
++
++STATIC int jffs2_lzma_compress(unsigned char *data_in, unsigned char *cpage_out,
++			      uint32_t *sourcelen, uint32_t *dstlen)
++{
++	SizeT compress_size = (SizeT)(*dstlen);
++	int ret;
++
++	#ifdef __KERNEL__
++		mutex_lock(&deflate_mutex);
++	#endif
++
++	ret = LzmaEnc_MemEncode(p, cpage_out, &compress_size, data_in, *sourcelen,
++		0, NULL, &lzma_alloc, &lzma_alloc);
++
++	#ifdef __KERNEL__
++		mutex_unlock(&deflate_mutex);
++	#endif
++
++	if (ret != SZ_OK)
++		return -1;
++
++	*dstlen = (uint32_t)compress_size;
++
++	return 0;
++}
++
++STATIC int jffs2_lzma_decompress(unsigned char *data_in, unsigned char *cpage_out,
++				 uint32_t srclen, uint32_t destlen)
++{
++	int ret;
++	SizeT dl = (SizeT)destlen;
++	SizeT sl = (SizeT)srclen;
++	ELzmaStatus status;
++	
++	ret = LzmaDecode(cpage_out, &dl, data_in, &sl, propsEncoded,
++		propsSize, LZMA_FINISH_ANY, &status, &lzma_alloc);
++
++	if (ret != SZ_OK || status == LZMA_STATUS_NOT_FINISHED || dl != (SizeT)destlen)
++		return -1;
++
++	return 0;
++}
++
++static struct jffs2_compressor jffs2_lzma_comp = {
++	.priority = JFFS2_LZMA_PRIORITY,
++	.name = "lzma",
++	.compr = JFFS2_COMPR_LZMA,
++	.compress = &jffs2_lzma_compress,
++	.decompress = &jffs2_lzma_decompress,
++	.disabled = 0,
++};
++
++int INIT jffs2_lzma_init(void)
++{
++        int ret;
++	CLzmaEncProps props;
++	LzmaEncProps_Init(&props);
++
++        props.dictSize = LZMA_BEST_DICT(0x2000);
++        props.level = LZMA_BEST_LEVEL;
++        props.lc = LZMA_BEST_LC;
++        props.lp = LZMA_BEST_LP;
++        props.pb = LZMA_BEST_PB;
++        props.fb = LZMA_BEST_FB;
++
++	ret = lzma_alloc_workspace(&props);
++        if (ret < 0)
++                return ret;
++
++	ret = jffs2_register_compressor(&jffs2_lzma_comp);
++	if (ret)
++		lzma_free_workspace();
++	
++        return ret;
++}
++
++void jffs2_lzma_exit(void)
++{
++	jffs2_unregister_compressor(&jffs2_lzma_comp);
++	lzma_free_workspace();
++}
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -371,14 +371,41 @@ static int __init init_jffs2_fs(void)
+ 	BUILD_BUG_ON(sizeof(struct jffs2_raw_inode) != 68);
+ 	BUILD_BUG_ON(sizeof(struct jffs2_raw_summary) != 32);
+ 
+-	printk(KERN_INFO "JFFS2 version 2.2."
++	printk(KERN_INFO "JFFS2 version 2.2"
+ #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
+ 	       " (NAND)"
+ #endif
+ #ifdef CONFIG_JFFS2_SUMMARY
+-	       " (SUMMARY) "
++	       " (SUMMARY)"
+ #endif
+-	       " © 2001-2006 Red Hat, Inc.\n");
++#ifdef CONFIG_JFFS2_ZLIB
++	       " (ZLIB)"
++#endif
++#ifdef CONFIG_JFFS2_LZO
++	       " (LZO)"
++#endif
++#ifdef CONFIG_JFFS2_LZMA
++	       " (LZMA)"
++#endif
++#ifdef CONFIG_JFFS2_RTIME
++	       " (RTIME)"
++#endif
++#ifdef CONFIG_JFFS2_RUBIN
++	       " (RUBIN)"
++#endif
++#ifdef  CONFIG_JFFS2_CMODE_NONE
++	       " (CMODE_NONE)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_PRIORITY
++	       " (CMODE_PRIORITY)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_SIZE
++	       " (CMODE_SIZE)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_FAVOURLZO
++	       " (CMODE_FAVOURLZO)"
++#endif
++	       " (c) 2001-2006 Red Hat, Inc.\n");
+ 
+ 	jffs2_inode_cachep = kmem_cache_create("jffs2_i",
+ 					     sizeof(struct jffs2_inode_info),
+--- a/include/linux/jffs2.h
++++ b/include/linux/jffs2.h
+@@ -46,6 +46,7 @@
+ #define JFFS2_COMPR_DYNRUBIN	0x05
+ #define JFFS2_COMPR_ZLIB	0x06
+ #define JFFS2_COMPR_LZO		0x07
++#define JFFS2_COMPR_LZMA	0x08
+ /* Compatibility flags. */
+ #define JFFS2_COMPAT_MASK 0xc000      /* What do to if an unknown nodetype is found */
+ #define JFFS2_NODE_ACCURATE 0x2000
+--- /dev/null
++++ b/include/linux/lzma.h
+@@ -0,0 +1,62 @@
++#ifndef __LZMA_H__
++#define __LZMA_H__
++
++#ifdef __KERNEL__
++	#include <linux/kernel.h>
++	#include <linux/sched.h>
++	#include <linux/slab.h>
++	#include <linux/vmalloc.h>
++	#include <linux/init.h>
++	#define LZMA_MALLOC vmalloc
++	#define LZMA_FREE vfree
++	#define PRINT_ERROR(msg) printk(KERN_WARNING #msg)
++	#define INIT __init
++	#define STATIC static
++#else
++	#include <stdint.h>
++	#include <stdlib.h>
++	#include <stdio.h>
++	#include <unistd.h>
++	#include <string.h>
++	#include <asm/types.h>
++	#include <errno.h>
++	#include <linux/jffs2.h>
++	#ifndef PAGE_SIZE
++		extern int page_size;
++		#define PAGE_SIZE page_size
++	#endif
++	#define LZMA_MALLOC malloc
++	#define LZMA_FREE free
++	#define PRINT_ERROR(msg) fprintf(stderr, msg)
++	#define INIT
++	#define STATIC
++#endif
++
++#include "lzma/LzmaDec.h"
++#include "lzma/LzmaEnc.h"
++
++#define LZMA_BEST_LEVEL (9)
++#define LZMA_BEST_LC    (0)
++#define LZMA_BEST_LP    (0)
++#define LZMA_BEST_PB    (0)
++#define LZMA_BEST_FB  (273)
++
++#define LZMA_BEST_DICT(n) (((int)((n) / 2)) * 2)
++
++static void *p_lzma_malloc(void *p, size_t size)
++{
++        if (size == 0)
++                return NULL;
++
++        return LZMA_MALLOC(size);
++}
++
++static void p_lzma_free(void *p, void *address)
++{
++        if (address != NULL)
++                LZMA_FREE(address);
++}
++
++static ISzAlloc lzma_alloc = {p_lzma_malloc, p_lzma_free};
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzFind.h
+@@ -0,0 +1,115 @@
++/* LzFind.h -- Match finder for LZ algorithms
++2009-04-22 : Igor Pavlov : Public domain */
++
++#ifndef __LZ_FIND_H
++#define __LZ_FIND_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++typedef UInt32 CLzRef;
++
++typedef struct _CMatchFinder
++{
++  Byte *buffer;
++  UInt32 pos;
++  UInt32 posLimit;
++  UInt32 streamPos;
++  UInt32 lenLimit;
++
++  UInt32 cyclicBufferPos;
++  UInt32 cyclicBufferSize; /* it must be = (historySize + 1) */
++
++  UInt32 matchMaxLen;
++  CLzRef *hash;
++  CLzRef *son;
++  UInt32 hashMask;
++  UInt32 cutValue;
++
++  Byte *bufferBase;
++  ISeqInStream *stream;
++  int streamEndWasReached;
++
++  UInt32 blockSize;
++  UInt32 keepSizeBefore;
++  UInt32 keepSizeAfter;
++
++  UInt32 numHashBytes;
++  int directInput;
++  size_t directInputRem;
++  int btMode;
++  int bigHash;
++  UInt32 historySize;
++  UInt32 fixedHashSize;
++  UInt32 hashSizeSum;
++  UInt32 numSons;
++  SRes result;
++  UInt32 crc[256];
++} CMatchFinder;
++
++#define Inline_MatchFinder_GetPointerToCurrentPos(p) ((p)->buffer)
++#define Inline_MatchFinder_GetIndexByte(p, index) ((p)->buffer[(Int32)(index)])
++
++#define Inline_MatchFinder_GetNumAvailableBytes(p) ((p)->streamPos - (p)->pos)
++
++int MatchFinder_NeedMove(CMatchFinder *p);
++Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p);
++void MatchFinder_MoveBlock(CMatchFinder *p);
++void MatchFinder_ReadIfRequired(CMatchFinder *p);
++
++void MatchFinder_Construct(CMatchFinder *p);
++
++/* Conditions:
++     historySize <= 3 GB
++     keepAddBufferBefore + matchMaxLen + keepAddBufferAfter < 511MB
++*/
++int MatchFinder_Create(CMatchFinder *p, UInt32 historySize,
++    UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
++    ISzAlloc *alloc);
++void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc);
++void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems);
++void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue);
++
++UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *buffer, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 _cutValue,
++    UInt32 *distances, UInt32 maxLen);
++
++/*
++Conditions:
++  Mf_GetNumAvailableBytes_Func must be called before each Mf_GetMatchLen_Func.
++  Mf_GetPointerToCurrentPos_Func's result must be used only before any other function
++*/
++
++typedef void (*Mf_Init_Func)(void *object);
++typedef Byte (*Mf_GetIndexByte_Func)(void *object, Int32 index);
++typedef UInt32 (*Mf_GetNumAvailableBytes_Func)(void *object);
++typedef const Byte * (*Mf_GetPointerToCurrentPos_Func)(void *object);
++typedef UInt32 (*Mf_GetMatches_Func)(void *object, UInt32 *distances);
++typedef void (*Mf_Skip_Func)(void *object, UInt32);
++
++typedef struct _IMatchFinder
++{
++  Mf_Init_Func Init;
++  Mf_GetIndexByte_Func GetIndexByte;
++  Mf_GetNumAvailableBytes_Func GetNumAvailableBytes;
++  Mf_GetPointerToCurrentPos_Func GetPointerToCurrentPos;
++  Mf_GetMatches_Func GetMatches;
++  Mf_Skip_Func Skip;
++} IMatchFinder;
++
++void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable);
++
++void MatchFinder_Init(CMatchFinder *p);
++UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
++UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
++void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
++void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzHash.h
+@@ -0,0 +1,54 @@
++/* LzHash.h -- HASH functions for LZ algorithms
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZ_HASH_H
++#define __LZ_HASH_H
++
++#define kHash2Size (1 << 10)
++#define kHash3Size (1 << 16)
++#define kHash4Size (1 << 20)
++
++#define kFix3HashSize (kHash2Size)
++#define kFix4HashSize (kHash2Size + kHash3Size)
++#define kFix5HashSize (kHash2Size + kHash3Size + kHash4Size)
++
++#define HASH2_CALC hashValue = cur[0] | ((UInt32)cur[1] << 8);
++
++#define HASH3_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hashValue = (temp ^ ((UInt32)cur[2] << 8)) & p->hashMask; }
++
++#define HASH4_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hashValue = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)) & p->hashMask; }
++
++#define HASH5_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hash4Value = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)); \
++  hashValue = (hash4Value ^ (p->crc[cur[4]] << 3)) & p->hashMask; \
++  hash4Value &= (kHash4Size - 1); }
++
++/* #define HASH_ZIP_CALC hashValue = ((cur[0] | ((UInt32)cur[1] << 8)) ^ p->crc[cur[2]]) & 0xFFFF; */
++#define HASH_ZIP_CALC hashValue = ((cur[2] | ((UInt32)cur[0] << 8)) ^ p->crc[cur[1]]) & 0xFFFF;
++
++
++#define MT_HASH2_CALC \
++  hash2Value = (p->crc[cur[0]] ^ cur[1]) & (kHash2Size - 1);
++
++#define MT_HASH3_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); }
++
++#define MT_HASH4_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hash4Value = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)) & (kHash4Size - 1); }
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzmaDec.h
+@@ -0,0 +1,231 @@
++/* LzmaDec.h -- LZMA Decoder
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZMA_DEC_H
++#define __LZMA_DEC_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/* #define _LZMA_PROB32 */
++/* _LZMA_PROB32 can increase the speed on some CPUs,
++   but memory usage for CLzmaDec::probs will be doubled in that case */
++
++#ifdef _LZMA_PROB32
++#define CLzmaProb UInt32
++#else
++#define CLzmaProb UInt16
++#endif
++
++
++/* ---------- LZMA Properties ---------- */
++
++#define LZMA_PROPS_SIZE 5
++
++typedef struct _CLzmaProps
++{
++  unsigned lc, lp, pb;
++  UInt32 dicSize;
++} CLzmaProps;
++
++/* LzmaProps_Decode - decodes properties
++Returns:
++  SZ_OK
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++*/
++
++SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size);
++
++
++/* ---------- LZMA Decoder state ---------- */
++
++/* LZMA_REQUIRED_INPUT_MAX = number of required input bytes for worst case.
++   Num bits = log2((2^11 / 31) ^ 22) + 26 < 134 + 26 = 160; */
++
++#define LZMA_REQUIRED_INPUT_MAX 20
++
++typedef struct
++{
++  CLzmaProps prop;
++  CLzmaProb *probs;
++  Byte *dic;
++  const Byte *buf;
++  UInt32 range, code;
++  SizeT dicPos;
++  SizeT dicBufSize;
++  UInt32 processedPos;
++  UInt32 checkDicSize;
++  unsigned state;
++  UInt32 reps[4];
++  unsigned remainLen;
++  int needFlush;
++  int needInitState;
++  UInt32 numProbs;
++  unsigned tempBufSize;
++  Byte tempBuf[LZMA_REQUIRED_INPUT_MAX];
++} CLzmaDec;
++
++#define LzmaDec_Construct(p) { (p)->dic = 0; (p)->probs = 0; }
++
++void LzmaDec_Init(CLzmaDec *p);
++
++/* There are two types of LZMA streams:
++     0) Stream with end mark. That end mark adds about 6 bytes to compressed size.
++     1) Stream without end mark. You must know exact uncompressed size to decompress such stream. */
++
++typedef enum
++{
++  LZMA_FINISH_ANY,   /* finish at any point */
++  LZMA_FINISH_END    /* block must be finished at the end */
++} ELzmaFinishMode;
++
++/* ELzmaFinishMode has meaning only if the decoding reaches output limit !!!
++
++   You must use LZMA_FINISH_END, when you know that current output buffer
++   covers last bytes of block. In other cases you must use LZMA_FINISH_ANY.
++
++   If LZMA decoder sees end marker before reaching output limit, it returns SZ_OK,
++   and output value of destLen will be less than output buffer size limit.
++   You can check status result also.
++
++   You can use multiple checks to test data integrity after full decompression:
++     1) Check Result and "status" variable.
++     2) Check that output(destLen) = uncompressedSize, if you know real uncompressedSize.
++     3) Check that output(srcLen) = compressedSize, if you know real compressedSize.
++        You must use correct finish mode in that case. */
++
++typedef enum
++{
++  LZMA_STATUS_NOT_SPECIFIED,               /* use main error code instead */
++  LZMA_STATUS_FINISHED_WITH_MARK,          /* stream was finished with end mark. */
++  LZMA_STATUS_NOT_FINISHED,                /* stream was not finished */
++  LZMA_STATUS_NEEDS_MORE_INPUT,            /* you must provide more input bytes */
++  LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK  /* there is probability that stream was finished without end mark */
++} ELzmaStatus;
++
++/* ELzmaStatus is used only as output value for function call */
++
++
++/* ---------- Interfaces ---------- */
++
++/* There are 3 levels of interfaces:
++     1) Dictionary Interface
++     2) Buffer Interface
++     3) One Call Interface
++   You can select any of these interfaces, but don't mix functions from different
++   groups for same object. */
++
++
++/* There are two variants to allocate state for Dictionary Interface:
++     1) LzmaDec_Allocate / LzmaDec_Free
++     2) LzmaDec_AllocateProbs / LzmaDec_FreeProbs
++   You can use variant 2, if you set dictionary buffer manually.
++   For Buffer Interface you must always use variant 1.
++
++LzmaDec_Allocate* can return:
++  SZ_OK
++  SZ_ERROR_MEM         - Memory allocation error
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++*/
++   
++SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc);
++void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc);
++
++SRes LzmaDec_Allocate(CLzmaDec *state, const Byte *prop, unsigned propsSize, ISzAlloc *alloc);
++void LzmaDec_Free(CLzmaDec *state, ISzAlloc *alloc);
++
++/* ---------- Dictionary Interface ---------- */
++
++/* You can use it, if you want to eliminate the overhead for data copying from
++   dictionary to some other external buffer.
++   You must work with CLzmaDec variables directly in this interface.
++
++   STEPS:
++     LzmaDec_Constr()
++     LzmaDec_Allocate()
++     for (each new stream)
++     {
++       LzmaDec_Init()
++       while (it needs more decompression)
++       {
++         LzmaDec_DecodeToDic()
++         use data from CLzmaDec::dic and update CLzmaDec::dicPos
++       }
++     }
++     LzmaDec_Free()
++*/
++
++/* LzmaDec_DecodeToDic
++   
++   The decoding to internal dictionary buffer (CLzmaDec::dic).
++   You must manually update CLzmaDec::dicPos, if it reaches CLzmaDec::dicBufSize !!!
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (dicLimit).
++  LZMA_FINISH_ANY - Decode just dicLimit bytes.
++  LZMA_FINISH_END - Stream must be finished after dicLimit.
++
++Returns:
++  SZ_OK
++    status:
++      LZMA_STATUS_FINISHED_WITH_MARK
++      LZMA_STATUS_NOT_FINISHED
++      LZMA_STATUS_NEEDS_MORE_INPUT
++      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
++  SZ_ERROR_DATA - Data error
++*/
++
++SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit,
++    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
++
++
++/* ---------- Buffer Interface ---------- */
++
++/* It's zlib-like interface.
++   See LzmaDec_DecodeToDic description for information about STEPS and return results,
++   but you must use LzmaDec_DecodeToBuf instead of LzmaDec_DecodeToDic and you don't need
++   to work with CLzmaDec variables manually.
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (*destLen).
++  LZMA_FINISH_ANY - Decode just destLen bytes.
++  LZMA_FINISH_END - Stream must be finished after (*destLen).
++*/
++
++SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen,
++    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
++
++
++/* ---------- One Call Interface ---------- */
++
++/* LzmaDecode
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (*destLen).
++  LZMA_FINISH_ANY - Decode just destLen bytes.
++  LZMA_FINISH_END - Stream must be finished after (*destLen).
++
++Returns:
++  SZ_OK
++    status:
++      LZMA_STATUS_FINISHED_WITH_MARK
++      LZMA_STATUS_NOT_FINISHED
++      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
++  SZ_ERROR_DATA - Data error
++  SZ_ERROR_MEM  - Memory allocation error
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++  SZ_ERROR_INPUT_EOF - It needs more bytes in input buffer (src).
++*/
++
++SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
++    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
++    ELzmaStatus *status, ISzAlloc *alloc);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzmaEnc.h
+@@ -0,0 +1,80 @@
++/*  LzmaEnc.h -- LZMA Encoder
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZMA_ENC_H
++#define __LZMA_ENC_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#define LZMA_PROPS_SIZE 5
++
++typedef struct _CLzmaEncProps
++{
++  int level;       /*  0 <= level <= 9 */
++  UInt32 dictSize; /* (1 << 12) <= dictSize <= (1 << 27) for 32-bit version
++                      (1 << 12) <= dictSize <= (1 << 30) for 64-bit version
++                       default = (1 << 24) */
++  int lc;          /* 0 <= lc <= 8, default = 3 */
++  int lp;          /* 0 <= lp <= 4, default = 0 */
++  int pb;          /* 0 <= pb <= 4, default = 2 */
++  int algo;        /* 0 - fast, 1 - normal, default = 1 */
++  int fb;          /* 5 <= fb <= 273, default = 32 */
++  int btMode;      /* 0 - hashChain Mode, 1 - binTree mode - normal, default = 1 */
++  int numHashBytes; /* 2, 3 or 4, default = 4 */
++  UInt32 mc;        /* 1 <= mc <= (1 << 30), default = 32 */
++  unsigned writeEndMark;  /* 0 - do not write EOPM, 1 - write EOPM, default = 0 */
++  int numThreads;  /* 1 or 2, default = 2 */
++} CLzmaEncProps;
++
++void LzmaEncProps_Init(CLzmaEncProps *p);
++void LzmaEncProps_Normalize(CLzmaEncProps *p);
++UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2);
++
++
++/* ---------- CLzmaEncHandle Interface ---------- */
++
++/* LzmaEnc_* functions can return the following exit codes:
++Returns:
++  SZ_OK           - OK
++  SZ_ERROR_MEM    - Memory allocation error
++  SZ_ERROR_PARAM  - Incorrect paramater in props
++  SZ_ERROR_WRITE  - Write callback error.
++  SZ_ERROR_PROGRESS - some break from progress callback
++  SZ_ERROR_THREAD - errors in multithreading functions (only for Mt version)
++*/
++
++typedef void * CLzmaEncHandle;
++
++CLzmaEncHandle LzmaEnc_Create(ISzAlloc *alloc);
++void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig);
++SRes LzmaEnc_SetProps(CLzmaEncHandle p, const CLzmaEncProps *props);
++SRes LzmaEnc_WriteProperties(CLzmaEncHandle p, Byte *properties, SizeT *size);
++SRes LzmaEnc_Encode(CLzmaEncHandle p, ISeqOutStream *outStream, ISeqInStream *inStream,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++SRes LzmaEnc_MemEncode(CLzmaEncHandle p, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++
++/* ---------- One Call Interface ---------- */
++
++/* LzmaEncode
++Return code:
++  SZ_OK               - OK
++  SZ_ERROR_MEM        - Memory allocation error
++  SZ_ERROR_PARAM      - Incorrect paramater
++  SZ_ERROR_OUTPUT_EOF - output buffer overflow
++  SZ_ERROR_THREAD     - errors in multithreading functions (only for Mt version)
++*/
++
++SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/Types.h
+@@ -0,0 +1,226 @@
++/* Types.h -- Basic types
++2009-11-23 : Igor Pavlov : Public domain */
++
++#ifndef __7Z_TYPES_H
++#define __7Z_TYPES_H
++
++#include <stddef.h>
++
++#ifdef _WIN32
++#include <windows.h>
++#endif
++
++#ifndef EXTERN_C_BEGIN
++#ifdef __cplusplus
++#define EXTERN_C_BEGIN extern "C" {
++#define EXTERN_C_END }
++#else
++#define EXTERN_C_BEGIN
++#define EXTERN_C_END
++#endif
++#endif
++
++EXTERN_C_BEGIN
++
++#define SZ_OK 0
++
++#define SZ_ERROR_DATA 1
++#define SZ_ERROR_MEM 2
++#define SZ_ERROR_CRC 3
++#define SZ_ERROR_UNSUPPORTED 4
++#define SZ_ERROR_PARAM 5
++#define SZ_ERROR_INPUT_EOF 6
++#define SZ_ERROR_OUTPUT_EOF 7
++#define SZ_ERROR_READ 8
++#define SZ_ERROR_WRITE 9
++#define SZ_ERROR_PROGRESS 10
++#define SZ_ERROR_FAIL 11
++#define SZ_ERROR_THREAD 12
++
++#define SZ_ERROR_ARCHIVE 16
++#define SZ_ERROR_NO_ARCHIVE 17
++
++typedef int SRes;
++
++#ifdef _WIN32
++typedef DWORD WRes;
++#else
++typedef int WRes;
++#endif
++
++#ifndef RINOK
++#define RINOK(x) { int __result__ = (x); if (__result__ != 0) return __result__; }
++#endif
++
++typedef unsigned char Byte;
++typedef short Int16;
++typedef unsigned short UInt16;
++
++#ifdef _LZMA_UINT32_IS_ULONG
++typedef long Int32;
++typedef unsigned long UInt32;
++#else
++typedef int Int32;
++typedef unsigned int UInt32;
++#endif
++
++#ifdef _SZ_NO_INT_64
++
++/* define _SZ_NO_INT_64, if your compiler doesn't support 64-bit integers.
++   NOTES: Some code will work incorrectly in that case! */
++
++typedef long Int64;
++typedef unsigned long UInt64;
++
++#else
++
++#if defined(_MSC_VER) || defined(__BORLANDC__)
++typedef __int64 Int64;
++typedef unsigned __int64 UInt64;
++#else
++typedef long long int Int64;
++typedef unsigned long long int UInt64;
++#endif
++
++#endif
++
++#ifdef _LZMA_NO_SYSTEM_SIZE_T
++typedef UInt32 SizeT;
++#else
++typedef size_t SizeT;
++#endif
++
++typedef int Bool;
++#define True 1
++#define False 0
++
++
++#ifdef _WIN32
++#define MY_STD_CALL __stdcall
++#else
++#define MY_STD_CALL
++#endif
++
++#ifdef _MSC_VER
++
++#if _MSC_VER >= 1300
++#define MY_NO_INLINE __declspec(noinline)
++#else
++#define MY_NO_INLINE
++#endif
++
++#define MY_CDECL __cdecl
++#define MY_FAST_CALL __fastcall
++
++#else
++
++#define MY_CDECL
++#define MY_FAST_CALL
++
++#endif
++
++
++/* The following interfaces use first parameter as pointer to structure */
++
++typedef struct
++{
++  SRes (*Read)(void *p, void *buf, size_t *size);
++    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
++       (output(*size) < input(*size)) is allowed */
++} ISeqInStream;
++
++/* it can return SZ_ERROR_INPUT_EOF */
++SRes SeqInStream_Read(ISeqInStream *stream, void *buf, size_t size);
++SRes SeqInStream_Read2(ISeqInStream *stream, void *buf, size_t size, SRes errorType);
++SRes SeqInStream_ReadByte(ISeqInStream *stream, Byte *buf);
++
++typedef struct
++{
++  size_t (*Write)(void *p, const void *buf, size_t size);
++    /* Returns: result - the number of actually written bytes.
++       (result < size) means error */
++} ISeqOutStream;
++
++typedef enum
++{
++  SZ_SEEK_SET = 0,
++  SZ_SEEK_CUR = 1,
++  SZ_SEEK_END = 2
++} ESzSeek;
++
++typedef struct
++{
++  SRes (*Read)(void *p, void *buf, size_t *size);  /* same as ISeqInStream::Read */
++  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
++} ISeekInStream;
++
++typedef struct
++{
++  SRes (*Look)(void *p, void **buf, size_t *size);
++    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
++       (output(*size) > input(*size)) is not allowed
++       (output(*size) < input(*size)) is allowed */
++  SRes (*Skip)(void *p, size_t offset);
++    /* offset must be <= output(*size) of Look */
++
++  SRes (*Read)(void *p, void *buf, size_t *size);
++    /* reads directly (without buffer). It's same as ISeqInStream::Read */
++  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
++} ILookInStream;
++
++SRes LookInStream_LookRead(ILookInStream *stream, void *buf, size_t *size);
++SRes LookInStream_SeekTo(ILookInStream *stream, UInt64 offset);
++
++/* reads via ILookInStream::Read */
++SRes LookInStream_Read2(ILookInStream *stream, void *buf, size_t size, SRes errorType);
++SRes LookInStream_Read(ILookInStream *stream, void *buf, size_t size);
++
++#define LookToRead_BUF_SIZE (1 << 14)
++
++typedef struct
++{
++  ILookInStream s;
++  ISeekInStream *realStream;
++  size_t pos;
++  size_t size;
++  Byte buf[LookToRead_BUF_SIZE];
++} CLookToRead;
++
++void LookToRead_CreateVTable(CLookToRead *p, int lookahead);
++void LookToRead_Init(CLookToRead *p);
++
++typedef struct
++{
++  ISeqInStream s;
++  ILookInStream *realStream;
++} CSecToLook;
++
++void SecToLook_CreateVTable(CSecToLook *p);
++
++typedef struct
++{
++  ISeqInStream s;
++  ILookInStream *realStream;
++} CSecToRead;
++
++void SecToRead_CreateVTable(CSecToRead *p);
++
++typedef struct
++{
++  SRes (*Progress)(void *p, UInt64 inSize, UInt64 outSize);
++    /* Returns: result. (result != SZ_OK) means break.
++       Value (UInt64)(Int64)-1 for size means unknown value. */
++} ICompressProgress;
++
++typedef struct
++{
++  void *(*Alloc)(void *p, size_t size);
++  void (*Free)(void *p, void *address); /* address can be 0 */
++} ISzAlloc;
++
++#define IAlloc_Alloc(p, size) (p)->Alloc((p), size)
++#define IAlloc_Free(p, a) (p)->Free((p), a)
++
++EXTERN_C_END
++
++#endif
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -118,6 +118,12 @@ config LZO_DECOMPRESS
+ 
+ source "lib/xz/Kconfig"
+ 
++config LZMA_COMPRESS
++    tristate
++
++config LZMA_DECOMPRESS
++    tristate
++
+ #
+ # These all provide a common interface (hence the apparent duplication with
+ # ZLIB_INFLATE; DECOMPRESS_GZIP is just a wrapper.)
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -2,6 +2,16 @@
+ # Makefile for some libs needed in the kernel.
+ #
+ 
++ifdef CONFIG_JFFS2_ZLIB
++	CONFIG_ZLIB_INFLATE:=y
++	CONFIG_ZLIB_DEFLATE:=y
++endif
++
++ifdef CONFIG_JFFS2_LZMA
++	CONFIG_LZMA_DECOMPRESS:=y
++	CONFIG_LZMA_COMPRESS:=y
++endif
++
+ ifdef CONFIG_FUNCTION_TRACER
+ ORIG_CFLAGS := $(KBUILD_CFLAGS)
+ KBUILD_CFLAGS = $(subst -pg,,$(ORIG_CFLAGS))
+@@ -73,6 +83,8 @@ obj-$(CONFIG_LZO_COMPRESS) += lzo/
+ obj-$(CONFIG_LZO_DECOMPRESS) += lzo/
+ obj-$(CONFIG_XZ_DEC) += xz/
+ obj-$(CONFIG_RAID6_PQ) += raid6/
++obj-$(CONFIG_LZMA_COMPRESS) += lzma/
++obj-$(CONFIG_LZMA_DECOMPRESS) += lzma/
+ 
+ lib-$(CONFIG_DECOMPRESS_GZIP) += decompress_inflate.o
+ lib-$(CONFIG_DECOMPRESS_BZIP2) += decompress_bunzip2.o
+--- /dev/null
++++ b/lib/lzma/LzFind.c
+@@ -0,0 +1,761 @@
++/* LzFind.c -- Match finder for LZ algorithms
++2009-04-22 : Igor Pavlov : Public domain */
++
++#include <string.h>
++
++#include "LzFind.h"
++#include "LzHash.h"
++
++#define kEmptyHashValue 0
++#define kMaxValForNormalize ((UInt32)0xFFFFFFFF)
++#define kNormalizeStepMin (1 << 10) /* it must be power of 2 */
++#define kNormalizeMask (~(kNormalizeStepMin - 1))
++#define kMaxHistorySize ((UInt32)3 << 30)
++
++#define kStartMaxLen 3
++
++static void LzInWindow_Free(CMatchFinder *p, ISzAlloc *alloc)
++{
++  if (!p->directInput)
++  {
++    alloc->Free(alloc, p->bufferBase);
++    p->bufferBase = 0;
++  }
++}
++
++/* keepSizeBefore + keepSizeAfter + keepSizeReserv must be < 4G) */
++
++static int LzInWindow_Create(CMatchFinder *p, UInt32 keepSizeReserv, ISzAlloc *alloc)
++{
++  UInt32 blockSize = p->keepSizeBefore + p->keepSizeAfter + keepSizeReserv;
++  if (p->directInput)
++  {
++    p->blockSize = blockSize;
++    return 1;
++  }
++  if (p->bufferBase == 0 || p->blockSize != blockSize)
++  {
++    LzInWindow_Free(p, alloc);
++    p->blockSize = blockSize;
++    p->bufferBase = (Byte *)alloc->Alloc(alloc, (size_t)blockSize);
++  }
++  return (p->bufferBase != 0);
++}
++
++Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
++Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
++
++UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
++
++void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
++{
++  p->posLimit -= subValue;
++  p->pos -= subValue;
++  p->streamPos -= subValue;
++}
++
++static void MatchFinder_ReadBlock(CMatchFinder *p)
++{
++  if (p->streamEndWasReached || p->result != SZ_OK)
++    return;
++  if (p->directInput)
++  {
++    UInt32 curSize = 0xFFFFFFFF - p->streamPos;
++    if (curSize > p->directInputRem)
++      curSize = (UInt32)p->directInputRem;
++    p->directInputRem -= curSize;
++    p->streamPos += curSize;
++    if (p->directInputRem == 0)
++      p->streamEndWasReached = 1;
++    return;
++  }
++  for (;;)
++  {
++    Byte *dest = p->buffer + (p->streamPos - p->pos);
++    size_t size = (p->bufferBase + p->blockSize - dest);
++    if (size == 0)
++      return;
++    p->result = p->stream->Read(p->stream, dest, &size);
++    if (p->result != SZ_OK)
++      return;
++    if (size == 0)
++    {
++      p->streamEndWasReached = 1;
++      return;
++    }
++    p->streamPos += (UInt32)size;
++    if (p->streamPos - p->pos > p->keepSizeAfter)
++      return;
++  }
++}
++
++void MatchFinder_MoveBlock(CMatchFinder *p)
++{
++  memmove(p->bufferBase,
++    p->buffer - p->keepSizeBefore,
++    (size_t)(p->streamPos - p->pos + p->keepSizeBefore));
++  p->buffer = p->bufferBase + p->keepSizeBefore;
++}
++
++int MatchFinder_NeedMove(CMatchFinder *p)
++{
++  if (p->directInput)
++    return 0;
++  /* if (p->streamEndWasReached) return 0; */
++  return ((size_t)(p->bufferBase + p->blockSize - p->buffer) <= p->keepSizeAfter);
++}
++
++void MatchFinder_ReadIfRequired(CMatchFinder *p)
++{
++  if (p->streamEndWasReached)
++    return;
++  if (p->keepSizeAfter >= p->streamPos - p->pos)
++    MatchFinder_ReadBlock(p);
++}
++
++static void MatchFinder_CheckAndMoveAndRead(CMatchFinder *p)
++{
++  if (MatchFinder_NeedMove(p))
++    MatchFinder_MoveBlock(p);
++  MatchFinder_ReadBlock(p);
++}
++
++static void MatchFinder_SetDefaultSettings(CMatchFinder *p)
++{
++  p->cutValue = 32;
++  p->btMode = 1;
++  p->numHashBytes = 4;
++  p->bigHash = 0;
++}
++
++#define kCrcPoly 0xEDB88320
++
++void MatchFinder_Construct(CMatchFinder *p)
++{
++  UInt32 i;
++  p->bufferBase = 0;
++  p->directInput = 0;
++  p->hash = 0;
++  MatchFinder_SetDefaultSettings(p);
++
++  for (i = 0; i < 256; i++)
++  {
++    UInt32 r = i;
++    int j;
++    for (j = 0; j < 8; j++)
++      r = (r >> 1) ^ (kCrcPoly & ~((r & 1) - 1));
++    p->crc[i] = r;
++  }
++}
++
++static void MatchFinder_FreeThisClassMemory(CMatchFinder *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->hash);
++  p->hash = 0;
++}
++
++void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc)
++{
++  MatchFinder_FreeThisClassMemory(p, alloc);
++  LzInWindow_Free(p, alloc);
++}
++
++static CLzRef* AllocRefs(UInt32 num, ISzAlloc *alloc)
++{
++  size_t sizeInBytes = (size_t)num * sizeof(CLzRef);
++  if (sizeInBytes / sizeof(CLzRef) != num)
++    return 0;
++  return (CLzRef *)alloc->Alloc(alloc, sizeInBytes);
++}
++
++int MatchFinder_Create(CMatchFinder *p, UInt32 historySize,
++    UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
++    ISzAlloc *alloc)
++{
++  UInt32 sizeReserv;
++  if (historySize > kMaxHistorySize)
++  {
++    MatchFinder_Free(p, alloc);
++    return 0;
++  }
++  sizeReserv = historySize >> 1;
++  if (historySize > ((UInt32)2 << 30))
++    sizeReserv = historySize >> 2;
++  sizeReserv += (keepAddBufferBefore + matchMaxLen + keepAddBufferAfter) / 2 + (1 << 19);
++
++  p->keepSizeBefore = historySize + keepAddBufferBefore + 1;
++  p->keepSizeAfter = matchMaxLen + keepAddBufferAfter;
++  /* we need one additional byte, since we use MoveBlock after pos++ and before dictionary using */
++  if (LzInWindow_Create(p, sizeReserv, alloc))
++  {
++    UInt32 newCyclicBufferSize = historySize + 1;
++    UInt32 hs;
++    p->matchMaxLen = matchMaxLen;
++    {
++      p->fixedHashSize = 0;
++      if (p->numHashBytes == 2)
++        hs = (1 << 16) - 1;
++      else
++      {
++        hs = historySize - 1;
++        hs |= (hs >> 1);
++        hs |= (hs >> 2);
++        hs |= (hs >> 4);
++        hs |= (hs >> 8);
++        hs >>= 1;
++        hs |= 0xFFFF; /* don't change it! It's required for Deflate */
++        if (hs > (1 << 24))
++        {
++          if (p->numHashBytes == 3)
++            hs = (1 << 24) - 1;
++          else
++            hs >>= 1;
++        }
++      }
++      p->hashMask = hs;
++      hs++;
++      if (p->numHashBytes > 2) p->fixedHashSize += kHash2Size;
++      if (p->numHashBytes > 3) p->fixedHashSize += kHash3Size;
++      if (p->numHashBytes > 4) p->fixedHashSize += kHash4Size;
++      hs += p->fixedHashSize;
++    }
++
++    {
++      UInt32 prevSize = p->hashSizeSum + p->numSons;
++      UInt32 newSize;
++      p->historySize = historySize;
++      p->hashSizeSum = hs;
++      p->cyclicBufferSize = newCyclicBufferSize;
++      p->numSons = (p->btMode ? newCyclicBufferSize * 2 : newCyclicBufferSize);
++      newSize = p->hashSizeSum + p->numSons;
++      if (p->hash != 0 && prevSize == newSize)
++        return 1;
++      MatchFinder_FreeThisClassMemory(p, alloc);
++      p->hash = AllocRefs(newSize, alloc);
++      if (p->hash != 0)
++      {
++        p->son = p->hash + p->hashSizeSum;
++        return 1;
++      }
++    }
++  }
++  MatchFinder_Free(p, alloc);
++  return 0;
++}
++
++static void MatchFinder_SetLimits(CMatchFinder *p)
++{
++  UInt32 limit = kMaxValForNormalize - p->pos;
++  UInt32 limit2 = p->cyclicBufferSize - p->cyclicBufferPos;
++  if (limit2 < limit)
++    limit = limit2;
++  limit2 = p->streamPos - p->pos;
++  if (limit2 <= p->keepSizeAfter)
++  {
++    if (limit2 > 0)
++      limit2 = 1;
++  }
++  else
++    limit2 -= p->keepSizeAfter;
++  if (limit2 < limit)
++    limit = limit2;
++  {
++    UInt32 lenLimit = p->streamPos - p->pos;
++    if (lenLimit > p->matchMaxLen)
++      lenLimit = p->matchMaxLen;
++    p->lenLimit = lenLimit;
++  }
++  p->posLimit = p->pos + limit;
++}
++
++void MatchFinder_Init(CMatchFinder *p)
++{
++  UInt32 i;
++  for (i = 0; i < p->hashSizeSum; i++)
++    p->hash[i] = kEmptyHashValue;
++  p->cyclicBufferPos = 0;
++  p->buffer = p->bufferBase;
++  p->pos = p->streamPos = p->cyclicBufferSize;
++  p->result = SZ_OK;
++  p->streamEndWasReached = 0;
++  MatchFinder_ReadBlock(p);
++  MatchFinder_SetLimits(p);
++}
++
++static UInt32 MatchFinder_GetSubValue(CMatchFinder *p)
++{
++  return (p->pos - p->historySize - 1) & kNormalizeMask;
++}
++
++void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
++{
++  UInt32 i;
++  for (i = 0; i < numItems; i++)
++  {
++    UInt32 value = items[i];
++    if (value <= subValue)
++      value = kEmptyHashValue;
++    else
++      value -= subValue;
++    items[i] = value;
++  }
++}
++
++static void MatchFinder_Normalize(CMatchFinder *p)
++{
++  UInt32 subValue = MatchFinder_GetSubValue(p);
++  MatchFinder_Normalize3(subValue, p->hash, p->hashSizeSum + p->numSons);
++  MatchFinder_ReduceOffsets(p, subValue);
++}
++
++static void MatchFinder_CheckLimits(CMatchFinder *p)
++{
++  if (p->pos == kMaxValForNormalize)
++    MatchFinder_Normalize(p);
++  if (!p->streamEndWasReached && p->keepSizeAfter == p->streamPos - p->pos)
++    MatchFinder_CheckAndMoveAndRead(p);
++  if (p->cyclicBufferPos == p->cyclicBufferSize)
++    p->cyclicBufferPos = 0;
++  MatchFinder_SetLimits(p);
++}
++
++static UInt32 * Hc_GetMatchesSpec(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
++    UInt32 *distances, UInt32 maxLen)
++{
++  son[_cyclicBufferPos] = curMatch;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++      return distances;
++    {
++      const Byte *pb = cur - delta;
++      curMatch = son[_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)];
++      if (pb[maxLen] == cur[maxLen] && *pb == *cur)
++      {
++        UInt32 len = 0;
++        while (++len != lenLimit)
++          if (pb[len] != cur[len])
++            break;
++        if (maxLen < len)
++        {
++          *distances++ = maxLen = len;
++          *distances++ = delta - 1;
++          if (len == lenLimit)
++            return distances;
++        }
++      }
++    }
++  }
++}
++
++UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
++    UInt32 *distances, UInt32 maxLen)
++{
++  CLzRef *ptr0 = son + (_cyclicBufferPos << 1) + 1;
++  CLzRef *ptr1 = son + (_cyclicBufferPos << 1);
++  UInt32 len0 = 0, len1 = 0;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++    {
++      *ptr0 = *ptr1 = kEmptyHashValue;
++      return distances;
++    }
++    {
++      CLzRef *pair = son + ((_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)) << 1);
++      const Byte *pb = cur - delta;
++      UInt32 len = (len0 < len1 ? len0 : len1);
++      if (pb[len] == cur[len])
++      {
++        if (++len != lenLimit && pb[len] == cur[len])
++          while (++len != lenLimit)
++            if (pb[len] != cur[len])
++              break;
++        if (maxLen < len)
++        {
++          *distances++ = maxLen = len;
++          *distances++ = delta - 1;
++          if (len == lenLimit)
++          {
++            *ptr1 = pair[0];
++            *ptr0 = pair[1];
++            return distances;
++          }
++        }
++      }
++      if (pb[len] < cur[len])
++      {
++        *ptr1 = curMatch;
++        ptr1 = pair + 1;
++        curMatch = *ptr1;
++        len1 = len;
++      }
++      else
++      {
++        *ptr0 = curMatch;
++        ptr0 = pair;
++        curMatch = *ptr0;
++        len0 = len;
++      }
++    }
++  }
++}
++
++static void SkipMatchesSpec(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue)
++{
++  CLzRef *ptr0 = son + (_cyclicBufferPos << 1) + 1;
++  CLzRef *ptr1 = son + (_cyclicBufferPos << 1);
++  UInt32 len0 = 0, len1 = 0;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++    {
++      *ptr0 = *ptr1 = kEmptyHashValue;
++      return;
++    }
++    {
++      CLzRef *pair = son + ((_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)) << 1);
++      const Byte *pb = cur - delta;
++      UInt32 len = (len0 < len1 ? len0 : len1);
++      if (pb[len] == cur[len])
++      {
++        while (++len != lenLimit)
++          if (pb[len] != cur[len])
++            break;
++        {
++          if (len == lenLimit)
++          {
++            *ptr1 = pair[0];
++            *ptr0 = pair[1];
++            return;
++          }
++        }
++      }
++      if (pb[len] < cur[len])
++      {
++        *ptr1 = curMatch;
++        ptr1 = pair + 1;
++        curMatch = *ptr1;
++        len1 = len;
++      }
++      else
++      {
++        *ptr0 = curMatch;
++        ptr0 = pair;
++        curMatch = *ptr0;
++        len0 = len;
++      }
++    }
++  }
++}
++
++#define MOVE_POS \
++  ++p->cyclicBufferPos; \
++  p->buffer++; \
++  if (++p->pos == p->posLimit) MatchFinder_CheckLimits(p);
++
++#define MOVE_POS_RET MOVE_POS return offset;
++
++static void MatchFinder_MovePos(CMatchFinder *p) { MOVE_POS; }
++
++#define GET_MATCHES_HEADER2(minLen, ret_op) \
++  UInt32 lenLimit; UInt32 hashValue; const Byte *cur; UInt32 curMatch; \
++  lenLimit = p->lenLimit; { if (lenLimit < minLen) { MatchFinder_MovePos(p); ret_op; }} \
++  cur = p->buffer;
++
++#define GET_MATCHES_HEADER(minLen) GET_MATCHES_HEADER2(minLen, return 0)
++#define SKIP_HEADER(minLen)        GET_MATCHES_HEADER2(minLen, continue)
++
++#define MF_PARAMS(p) p->pos, p->buffer, p->son, p->cyclicBufferPos, p->cyclicBufferSize, p->cutValue
++
++#define GET_MATCHES_FOOTER(offset, maxLen) \
++  offset = (UInt32)(GetMatchesSpec1(lenLimit, curMatch, MF_PARAMS(p), \
++  distances + offset, maxLen) - distances); MOVE_POS_RET;
++
++#define SKIP_FOOTER \
++  SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p)); MOVE_POS;
++
++static UInt32 Bt2_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(2)
++  HASH2_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = 0;
++  GET_MATCHES_FOOTER(offset, 1)
++}
++
++UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(3)
++  HASH_ZIP_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = 0;
++  GET_MATCHES_FOOTER(offset, 2)
++}
++
++static UInt32 Bt3_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, delta2, maxLen, offset;
++  GET_MATCHES_HEADER(3)
++
++  HASH3_CALC;
++
++  delta2 = p->pos - p->hash[hash2Value];
++  curMatch = p->hash[kFix3HashSize + hashValue];
++  
++  p->hash[hash2Value] =
++  p->hash[kFix3HashSize + hashValue] = p->pos;
++
++
++  maxLen = 2;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[0] = maxLen;
++    distances[1] = delta2 - 1;
++    offset = 2;
++    if (maxLen == lenLimit)
++    {
++      SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p));
++      MOVE_POS_RET;
++    }
++  }
++  GET_MATCHES_FOOTER(offset, maxLen)
++}
++
++static UInt32 Bt4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, hash3Value, delta2, delta3, maxLen, offset;
++  GET_MATCHES_HEADER(4)
++
++  HASH4_CALC;
++
++  delta2 = p->pos - p->hash[                hash2Value];
++  delta3 = p->pos - p->hash[kFix3HashSize + hash3Value];
++  curMatch = p->hash[kFix4HashSize + hashValue];
++  
++  p->hash[                hash2Value] =
++  p->hash[kFix3HashSize + hash3Value] =
++  p->hash[kFix4HashSize + hashValue] = p->pos;
++
++  maxLen = 1;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    distances[0] = maxLen = 2;
++    distances[1] = delta2 - 1;
++    offset = 2;
++  }
++  if (delta2 != delta3 && delta3 < p->cyclicBufferSize && *(cur - delta3) == *cur)
++  {
++    maxLen = 3;
++    distances[offset + 1] = delta3 - 1;
++    offset += 2;
++    delta2 = delta3;
++  }
++  if (offset != 0)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[offset - 2] = maxLen;
++    if (maxLen == lenLimit)
++    {
++      SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p));
++      MOVE_POS_RET;
++    }
++  }
++  if (maxLen < 3)
++    maxLen = 3;
++  GET_MATCHES_FOOTER(offset, maxLen)
++}
++
++static UInt32 Hc4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, hash3Value, delta2, delta3, maxLen, offset;
++  GET_MATCHES_HEADER(4)
++
++  HASH4_CALC;
++
++  delta2 = p->pos - p->hash[                hash2Value];
++  delta3 = p->pos - p->hash[kFix3HashSize + hash3Value];
++  curMatch = p->hash[kFix4HashSize + hashValue];
++
++  p->hash[                hash2Value] =
++  p->hash[kFix3HashSize + hash3Value] =
++  p->hash[kFix4HashSize + hashValue] = p->pos;
++
++  maxLen = 1;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    distances[0] = maxLen = 2;
++    distances[1] = delta2 - 1;
++    offset = 2;
++  }
++  if (delta2 != delta3 && delta3 < p->cyclicBufferSize && *(cur - delta3) == *cur)
++  {
++    maxLen = 3;
++    distances[offset + 1] = delta3 - 1;
++    offset += 2;
++    delta2 = delta3;
++  }
++  if (offset != 0)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[offset - 2] = maxLen;
++    if (maxLen == lenLimit)
++    {
++      p->son[p->cyclicBufferPos] = curMatch;
++      MOVE_POS_RET;
++    }
++  }
++  if (maxLen < 3)
++    maxLen = 3;
++  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
++    distances + offset, maxLen) - (distances));
++  MOVE_POS_RET
++}
++
++UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(3)
++  HASH_ZIP_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
++    distances, 2) - (distances));
++  MOVE_POS_RET
++}
++
++static void Bt2_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(2)
++    HASH2_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(3)
++    HASH_ZIP_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Bt3_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value;
++    SKIP_HEADER(3)
++    HASH3_CALC;
++    curMatch = p->hash[kFix3HashSize + hashValue];
++    p->hash[hash2Value] =
++    p->hash[kFix3HashSize + hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Bt4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value, hash3Value;
++    SKIP_HEADER(4)
++    HASH4_CALC;
++    curMatch = p->hash[kFix4HashSize + hashValue];
++    p->hash[                hash2Value] =
++    p->hash[kFix3HashSize + hash3Value] = p->pos;
++    p->hash[kFix4HashSize + hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Hc4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value, hash3Value;
++    SKIP_HEADER(4)
++    HASH4_CALC;
++    curMatch = p->hash[kFix4HashSize + hashValue];
++    p->hash[                hash2Value] =
++    p->hash[kFix3HashSize + hash3Value] =
++    p->hash[kFix4HashSize + hashValue] = p->pos;
++    p->son[p->cyclicBufferPos] = curMatch;
++    MOVE_POS
++  }
++  while (--num != 0);
++}
++
++void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(3)
++    HASH_ZIP_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    p->son[p->cyclicBufferPos] = curMatch;
++    MOVE_POS
++  }
++  while (--num != 0);
++}
++
++void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable)
++{
++  vTable->Init = (Mf_Init_Func)MatchFinder_Init;
++  vTable->GetIndexByte = (Mf_GetIndexByte_Func)MatchFinder_GetIndexByte;
++  vTable->GetNumAvailableBytes = (Mf_GetNumAvailableBytes_Func)MatchFinder_GetNumAvailableBytes;
++  vTable->GetPointerToCurrentPos = (Mf_GetPointerToCurrentPos_Func)MatchFinder_GetPointerToCurrentPos;
++  if (!p->btMode)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Hc4_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Hc4_MatchFinder_Skip;
++  }
++  else if (p->numHashBytes == 2)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt2_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt2_MatchFinder_Skip;
++  }
++  else if (p->numHashBytes == 3)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt3_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt3_MatchFinder_Skip;
++  }
++  else
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt4_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt4_MatchFinder_Skip;
++  }
++}
+--- /dev/null
++++ b/lib/lzma/LzmaDec.c
+@@ -0,0 +1,999 @@
++/* LzmaDec.c -- LZMA Decoder
++2009-09-20 : Igor Pavlov : Public domain */
++
++#include "LzmaDec.h"
++
++#include <string.h>
++
++#define kNumTopBits 24
++#define kTopValue ((UInt32)1 << kNumTopBits)
++
++#define kNumBitModelTotalBits 11
++#define kBitModelTotal (1 << kNumBitModelTotalBits)
++#define kNumMoveBits 5
++
++#define RC_INIT_SIZE 5
++
++#define NORMALIZE if (range < kTopValue) { range <<= 8; code = (code << 8) | (*buf++); }
++
++#define IF_BIT_0(p) ttt = *(p); NORMALIZE; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
++#define UPDATE_0(p) range = bound; *(p) = (CLzmaProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits));
++#define UPDATE_1(p) range -= bound; code -= bound; *(p) = (CLzmaProb)(ttt - (ttt >> kNumMoveBits));
++#define GET_BIT2(p, i, A0, A1) IF_BIT_0(p) \
++  { UPDATE_0(p); i = (i + i); A0; } else \
++  { UPDATE_1(p); i = (i + i) + 1; A1; }
++#define GET_BIT(p, i) GET_BIT2(p, i, ; , ;)
++
++#define TREE_GET_BIT(probs, i) { GET_BIT((probs + i), i); }
++#define TREE_DECODE(probs, limit, i) \
++  { i = 1; do { TREE_GET_BIT(probs, i); } while (i < limit); i -= limit; }
++
++/* #define _LZMA_SIZE_OPT */
++
++#ifdef _LZMA_SIZE_OPT
++#define TREE_6_DECODE(probs, i) TREE_DECODE(probs, (1 << 6), i)
++#else
++#define TREE_6_DECODE(probs, i) \
++  { i = 1; \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  i -= 0x40; }
++#endif
++
++#define NORMALIZE_CHECK if (range < kTopValue) { if (buf >= bufLimit) return DUMMY_ERROR; range <<= 8; code = (code << 8) | (*buf++); }
++
++#define IF_BIT_0_CHECK(p) ttt = *(p); NORMALIZE_CHECK; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
++#define UPDATE_0_CHECK range = bound;
++#define UPDATE_1_CHECK range -= bound; code -= bound;
++#define GET_BIT2_CHECK(p, i, A0, A1) IF_BIT_0_CHECK(p) \
++  { UPDATE_0_CHECK; i = (i + i); A0; } else \
++  { UPDATE_1_CHECK; i = (i + i) + 1; A1; }
++#define GET_BIT_CHECK(p, i) GET_BIT2_CHECK(p, i, ; , ;)
++#define TREE_DECODE_CHECK(probs, limit, i) \
++  { i = 1; do { GET_BIT_CHECK(probs + i, i) } while (i < limit); i -= limit; }
++
++
++#define kNumPosBitsMax 4
++#define kNumPosStatesMax (1 << kNumPosBitsMax)
++
++#define kLenNumLowBits 3
++#define kLenNumLowSymbols (1 << kLenNumLowBits)
++#define kLenNumMidBits 3
++#define kLenNumMidSymbols (1 << kLenNumMidBits)
++#define kLenNumHighBits 8
++#define kLenNumHighSymbols (1 << kLenNumHighBits)
++
++#define LenChoice 0
++#define LenChoice2 (LenChoice + 1)
++#define LenLow (LenChoice2 + 1)
++#define LenMid (LenLow + (kNumPosStatesMax << kLenNumLowBits))
++#define LenHigh (LenMid + (kNumPosStatesMax << kLenNumMidBits))
++#define kNumLenProbs (LenHigh + kLenNumHighSymbols)
++
++
++#define kNumStates 12
++#define kNumLitStates 7
++
++#define kStartPosModelIndex 4
++#define kEndPosModelIndex 14
++#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
++
++#define kNumPosSlotBits 6
++#define kNumLenToPosStates 4
++
++#define kNumAlignBits 4
++#define kAlignTableSize (1 << kNumAlignBits)
++
++#define kMatchMinLen 2
++#define kMatchSpecLenStart (kMatchMinLen + kLenNumLowSymbols + kLenNumMidSymbols + kLenNumHighSymbols)
++
++#define IsMatch 0
++#define IsRep (IsMatch + (kNumStates << kNumPosBitsMax))
++#define IsRepG0 (IsRep + kNumStates)
++#define IsRepG1 (IsRepG0 + kNumStates)
++#define IsRepG2 (IsRepG1 + kNumStates)
++#define IsRep0Long (IsRepG2 + kNumStates)
++#define PosSlot (IsRep0Long + (kNumStates << kNumPosBitsMax))
++#define SpecPos (PosSlot + (kNumLenToPosStates << kNumPosSlotBits))
++#define Align (SpecPos + kNumFullDistances - kEndPosModelIndex)
++#define LenCoder (Align + kAlignTableSize)
++#define RepLenCoder (LenCoder + kNumLenProbs)
++#define Literal (RepLenCoder + kNumLenProbs)
++
++#define LZMA_BASE_SIZE 1846
++#define LZMA_LIT_SIZE 768
++
++#define LzmaProps_GetNumProbs(p) ((UInt32)LZMA_BASE_SIZE + (LZMA_LIT_SIZE << ((p)->lc + (p)->lp)))
++
++#if Literal != LZMA_BASE_SIZE
++StopCompilingDueBUG
++#endif
++
++#define LZMA_DIC_MIN (1 << 12)
++
++/* First LZMA-symbol is always decoded.
++And it decodes new LZMA-symbols while (buf < bufLimit), but "buf" is without last normalization
++Out:
++  Result:
++    SZ_OK - OK
++    SZ_ERROR_DATA - Error
++  p->remainLen:
++    < kMatchSpecLenStart : normal remain
++    = kMatchSpecLenStart : finished
++    = kMatchSpecLenStart + 1 : Flush marker
++    = kMatchSpecLenStart + 2 : State Init Marker
++*/
++
++static int MY_FAST_CALL LzmaDec_DecodeReal(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
++{
++  CLzmaProb *probs = p->probs;
++
++  unsigned state = p->state;
++  UInt32 rep0 = p->reps[0], rep1 = p->reps[1], rep2 = p->reps[2], rep3 = p->reps[3];
++  unsigned pbMask = ((unsigned)1 << (p->prop.pb)) - 1;
++  unsigned lpMask = ((unsigned)1 << (p->prop.lp)) - 1;
++  unsigned lc = p->prop.lc;
++
++  Byte *dic = p->dic;
++  SizeT dicBufSize = p->dicBufSize;
++  SizeT dicPos = p->dicPos;
++  
++  UInt32 processedPos = p->processedPos;
++  UInt32 checkDicSize = p->checkDicSize;
++  unsigned len = 0;
++
++  const Byte *buf = p->buf;
++  UInt32 range = p->range;
++  UInt32 code = p->code;
++
++  do
++  {
++    CLzmaProb *prob;
++    UInt32 bound;
++    unsigned ttt;
++    unsigned posState = processedPos & pbMask;
++
++    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
++    IF_BIT_0(prob)
++    {
++      unsigned symbol;
++      UPDATE_0(prob);
++      prob = probs + Literal;
++      if (checkDicSize != 0 || processedPos != 0)
++        prob += (LZMA_LIT_SIZE * (((processedPos & lpMask) << lc) +
++        (dic[(dicPos == 0 ? dicBufSize : dicPos) - 1] >> (8 - lc))));
++
++      if (state < kNumLitStates)
++      {
++        state -= (state < 4) ? state : 3;
++        symbol = 1;
++        do { GET_BIT(prob + symbol, symbol) } while (symbol < 0x100);
++      }
++      else
++      {
++        unsigned matchByte = p->dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++        unsigned offs = 0x100;
++        state -= (state < 10) ? 3 : 6;
++        symbol = 1;
++        do
++        {
++          unsigned bit;
++          CLzmaProb *probLit;
++          matchByte <<= 1;
++          bit = (matchByte & offs);
++          probLit = prob + offs + bit + symbol;
++          GET_BIT2(probLit, symbol, offs &= ~bit, offs &= bit)
++        }
++        while (symbol < 0x100);
++      }
++      dic[dicPos++] = (Byte)symbol;
++      processedPos++;
++      continue;
++    }
++    else
++    {
++      UPDATE_1(prob);
++      prob = probs + IsRep + state;
++      IF_BIT_0(prob)
++      {
++        UPDATE_0(prob);
++        state += kNumStates;
++        prob = probs + LenCoder;
++      }
++      else
++      {
++        UPDATE_1(prob);
++        if (checkDicSize == 0 && processedPos == 0)
++          return SZ_ERROR_DATA;
++        prob = probs + IsRepG0 + state;
++        IF_BIT_0(prob)
++        {
++          UPDATE_0(prob);
++          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
++          IF_BIT_0(prob)
++          {
++            UPDATE_0(prob);
++            dic[dicPos] = dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++            dicPos++;
++            processedPos++;
++            state = state < kNumLitStates ? 9 : 11;
++            continue;
++          }
++          UPDATE_1(prob);
++        }
++        else
++        {
++          UInt32 distance;
++          UPDATE_1(prob);
++          prob = probs + IsRepG1 + state;
++          IF_BIT_0(prob)
++          {
++            UPDATE_0(prob);
++            distance = rep1;
++          }
++          else
++          {
++            UPDATE_1(prob);
++            prob = probs + IsRepG2 + state;
++            IF_BIT_0(prob)
++            {
++              UPDATE_0(prob);
++              distance = rep2;
++            }
++            else
++            {
++              UPDATE_1(prob);
++              distance = rep3;
++              rep3 = rep2;
++            }
++            rep2 = rep1;
++          }
++          rep1 = rep0;
++          rep0 = distance;
++        }
++        state = state < kNumLitStates ? 8 : 11;
++        prob = probs + RepLenCoder;
++      }
++      {
++        unsigned limit, offset;
++        CLzmaProb *probLen = prob + LenChoice;
++        IF_BIT_0(probLen)
++        {
++          UPDATE_0(probLen);
++          probLen = prob + LenLow + (posState << kLenNumLowBits);
++          offset = 0;
++          limit = (1 << kLenNumLowBits);
++        }
++        else
++        {
++          UPDATE_1(probLen);
++          probLen = prob + LenChoice2;
++          IF_BIT_0(probLen)
++          {
++            UPDATE_0(probLen);
++            probLen = prob + LenMid + (posState << kLenNumMidBits);
++            offset = kLenNumLowSymbols;
++            limit = (1 << kLenNumMidBits);
++          }
++          else
++          {
++            UPDATE_1(probLen);
++            probLen = prob + LenHigh;
++            offset = kLenNumLowSymbols + kLenNumMidSymbols;
++            limit = (1 << kLenNumHighBits);
++          }
++        }
++        TREE_DECODE(probLen, limit, len);
++        len += offset;
++      }
++
++      if (state >= kNumStates)
++      {
++        UInt32 distance;
++        prob = probs + PosSlot +
++            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) << kNumPosSlotBits);
++        TREE_6_DECODE(prob, distance);
++        if (distance >= kStartPosModelIndex)
++        {
++          unsigned posSlot = (unsigned)distance;
++          int numDirectBits = (int)(((distance >> 1) - 1));
++          distance = (2 | (distance & 1));
++          if (posSlot < kEndPosModelIndex)
++          {
++            distance <<= numDirectBits;
++            prob = probs + SpecPos + distance - posSlot - 1;
++            {
++              UInt32 mask = 1;
++              unsigned i = 1;
++              do
++              {
++                GET_BIT2(prob + i, i, ; , distance |= mask);
++                mask <<= 1;
++              }
++              while (--numDirectBits != 0);
++            }
++          }
++          else
++          {
++            numDirectBits -= kNumAlignBits;
++            do
++            {
++              NORMALIZE
++              range >>= 1;
++              
++              {
++                UInt32 t;
++                code -= range;
++                t = (0 - ((UInt32)code >> 31)); /* (UInt32)((Int32)code >> 31) */
++                distance = (distance << 1) + (t + 1);
++                code += range & t;
++              }
++              /*
++              distance <<= 1;
++              if (code >= range)
++              {
++                code -= range;
++                distance |= 1;
++              }
++              */
++            }
++            while (--numDirectBits != 0);
++            prob = probs + Align;
++            distance <<= kNumAlignBits;
++            {
++              unsigned i = 1;
++              GET_BIT2(prob + i, i, ; , distance |= 1);
++              GET_BIT2(prob + i, i, ; , distance |= 2);
++              GET_BIT2(prob + i, i, ; , distance |= 4);
++              GET_BIT2(prob + i, i, ; , distance |= 8);
++            }
++            if (distance == (UInt32)0xFFFFFFFF)
++            {
++              len += kMatchSpecLenStart;
++              state -= kNumStates;
++              break;
++            }
++          }
++        }
++        rep3 = rep2;
++        rep2 = rep1;
++        rep1 = rep0;
++        rep0 = distance + 1;
++        if (checkDicSize == 0)
++        {
++          if (distance >= processedPos)
++            return SZ_ERROR_DATA;
++        }
++        else if (distance >= checkDicSize)
++          return SZ_ERROR_DATA;
++        state = (state < kNumStates + kNumLitStates) ? kNumLitStates : kNumLitStates + 3;
++      }
++
++      len += kMatchMinLen;
++
++      if (limit == dicPos)
++        return SZ_ERROR_DATA;
++      {
++        SizeT rem = limit - dicPos;
++        unsigned curLen = ((rem < len) ? (unsigned)rem : len);
++        SizeT pos = (dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0);
++
++        processedPos += curLen;
++
++        len -= curLen;
++        if (pos + curLen <= dicBufSize)
++        {
++          Byte *dest = dic + dicPos;
++          ptrdiff_t src = (ptrdiff_t)pos - (ptrdiff_t)dicPos;
++          const Byte *lim = dest + curLen;
++          dicPos += curLen;
++          do
++            *(dest) = (Byte)*(dest + src);
++          while (++dest != lim);
++        }
++        else
++        {
++          do
++          {
++            dic[dicPos++] = dic[pos];
++            if (++pos == dicBufSize)
++              pos = 0;
++          }
++          while (--curLen != 0);
++        }
++      }
++    }
++  }
++  while (dicPos < limit && buf < bufLimit);
++  NORMALIZE;
++  p->buf = buf;
++  p->range = range;
++  p->code = code;
++  p->remainLen = len;
++  p->dicPos = dicPos;
++  p->processedPos = processedPos;
++  p->reps[0] = rep0;
++  p->reps[1] = rep1;
++  p->reps[2] = rep2;
++  p->reps[3] = rep3;
++  p->state = state;
++
++  return SZ_OK;
++}
++
++static void MY_FAST_CALL LzmaDec_WriteRem(CLzmaDec *p, SizeT limit)
++{
++  if (p->remainLen != 0 && p->remainLen < kMatchSpecLenStart)
++  {
++    Byte *dic = p->dic;
++    SizeT dicPos = p->dicPos;
++    SizeT dicBufSize = p->dicBufSize;
++    unsigned len = p->remainLen;
++    UInt32 rep0 = p->reps[0];
++    if (limit - dicPos < len)
++      len = (unsigned)(limit - dicPos);
++
++    if (p->checkDicSize == 0 && p->prop.dicSize - p->processedPos <= len)
++      p->checkDicSize = p->prop.dicSize;
++
++    p->processedPos += len;
++    p->remainLen -= len;
++    while (len-- != 0)
++    {
++      dic[dicPos] = dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++      dicPos++;
++    }
++    p->dicPos = dicPos;
++  }
++}
++
++static int MY_FAST_CALL LzmaDec_DecodeReal2(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
++{
++  do
++  {
++    SizeT limit2 = limit;
++    if (p->checkDicSize == 0)
++    {
++      UInt32 rem = p->prop.dicSize - p->processedPos;
++      if (limit - p->dicPos > rem)
++        limit2 = p->dicPos + rem;
++    }
++    RINOK(LzmaDec_DecodeReal(p, limit2, bufLimit));
++    if (p->processedPos >= p->prop.dicSize)
++      p->checkDicSize = p->prop.dicSize;
++    LzmaDec_WriteRem(p, limit);
++  }
++  while (p->dicPos < limit && p->buf < bufLimit && p->remainLen < kMatchSpecLenStart);
++
++  if (p->remainLen > kMatchSpecLenStart)
++  {
++    p->remainLen = kMatchSpecLenStart;
++  }
++  return 0;
++}
++
++typedef enum
++{
++  DUMMY_ERROR, /* unexpected end of input stream */
++  DUMMY_LIT,
++  DUMMY_MATCH,
++  DUMMY_REP
++} ELzmaDummy;
++
++static ELzmaDummy LzmaDec_TryDummy(const CLzmaDec *p, const Byte *buf, SizeT inSize)
++{
++  UInt32 range = p->range;
++  UInt32 code = p->code;
++  const Byte *bufLimit = buf + inSize;
++  CLzmaProb *probs = p->probs;
++  unsigned state = p->state;
++  ELzmaDummy res;
++
++  {
++    CLzmaProb *prob;
++    UInt32 bound;
++    unsigned ttt;
++    unsigned posState = (p->processedPos) & ((1 << p->prop.pb) - 1);
++
++    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
++    IF_BIT_0_CHECK(prob)
++    {
++      UPDATE_0_CHECK
++
++      /* if (bufLimit - buf >= 7) return DUMMY_LIT; */
++
++      prob = probs + Literal;
++      if (p->checkDicSize != 0 || p->processedPos != 0)
++        prob += (LZMA_LIT_SIZE *
++          ((((p->processedPos) & ((1 << (p->prop.lp)) - 1)) << p->prop.lc) +
++          (p->dic[(p->dicPos == 0 ? p->dicBufSize : p->dicPos) - 1] >> (8 - p->prop.lc))));
++
++      if (state < kNumLitStates)
++      {
++        unsigned symbol = 1;
++        do { GET_BIT_CHECK(prob + symbol, symbol) } while (symbol < 0x100);
++      }
++      else
++      {
++        unsigned matchByte = p->dic[p->dicPos - p->reps[0] +
++            ((p->dicPos < p->reps[0]) ? p->dicBufSize : 0)];
++        unsigned offs = 0x100;
++        unsigned symbol = 1;
++        do
++        {
++          unsigned bit;
++          CLzmaProb *probLit;
++          matchByte <<= 1;
++          bit = (matchByte & offs);
++          probLit = prob + offs + bit + symbol;
++          GET_BIT2_CHECK(probLit, symbol, offs &= ~bit, offs &= bit)
++        }
++        while (symbol < 0x100);
++      }
++      res = DUMMY_LIT;
++    }
++    else
++    {
++      unsigned len;
++      UPDATE_1_CHECK;
++
++      prob = probs + IsRep + state;
++      IF_BIT_0_CHECK(prob)
++      {
++        UPDATE_0_CHECK;
++        state = 0;
++        prob = probs + LenCoder;
++        res = DUMMY_MATCH;
++      }
++      else
++      {
++        UPDATE_1_CHECK;
++        res = DUMMY_REP;
++        prob = probs + IsRepG0 + state;
++        IF_BIT_0_CHECK(prob)
++        {
++          UPDATE_0_CHECK;
++          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
++          IF_BIT_0_CHECK(prob)
++          {
++            UPDATE_0_CHECK;
++            NORMALIZE_CHECK;
++            return DUMMY_REP;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++          }
++        }
++        else
++        {
++          UPDATE_1_CHECK;
++          prob = probs + IsRepG1 + state;
++          IF_BIT_0_CHECK(prob)
++          {
++            UPDATE_0_CHECK;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++            prob = probs + IsRepG2 + state;
++            IF_BIT_0_CHECK(prob)
++            {
++              UPDATE_0_CHECK;
++            }
++            else
++            {
++              UPDATE_1_CHECK;
++            }
++          }
++        }
++        state = kNumStates;
++        prob = probs + RepLenCoder;
++      }
++      {
++        unsigned limit, offset;
++        CLzmaProb *probLen = prob + LenChoice;
++        IF_BIT_0_CHECK(probLen)
++        {
++          UPDATE_0_CHECK;
++          probLen = prob + LenLow + (posState << kLenNumLowBits);
++          offset = 0;
++          limit = 1 << kLenNumLowBits;
++        }
++        else
++        {
++          UPDATE_1_CHECK;
++          probLen = prob + LenChoice2;
++          IF_BIT_0_CHECK(probLen)
++          {
++            UPDATE_0_CHECK;
++            probLen = prob + LenMid + (posState << kLenNumMidBits);
++            offset = kLenNumLowSymbols;
++            limit = 1 << kLenNumMidBits;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++            probLen = prob + LenHigh;
++            offset = kLenNumLowSymbols + kLenNumMidSymbols;
++            limit = 1 << kLenNumHighBits;
++          }
++        }
++        TREE_DECODE_CHECK(probLen, limit, len);
++        len += offset;
++      }
++
++      if (state < 4)
++      {
++        unsigned posSlot;
++        prob = probs + PosSlot +
++            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) <<
++            kNumPosSlotBits);
++        TREE_DECODE_CHECK(prob, 1 << kNumPosSlotBits, posSlot);
++        if (posSlot >= kStartPosModelIndex)
++        {
++          int numDirectBits = ((posSlot >> 1) - 1);
++
++          /* if (bufLimit - buf >= 8) return DUMMY_MATCH; */
++
++          if (posSlot < kEndPosModelIndex)
++          {
++            prob = probs + SpecPos + ((2 | (posSlot & 1)) << numDirectBits) - posSlot - 1;
++          }
++          else
++          {
++            numDirectBits -= kNumAlignBits;
++            do
++            {
++              NORMALIZE_CHECK
++              range >>= 1;
++              code -= range & (((code - range) >> 31) - 1);
++              /* if (code >= range) code -= range; */
++            }
++            while (--numDirectBits != 0);
++            prob = probs + Align;
++            numDirectBits = kNumAlignBits;
++          }
++          {
++            unsigned i = 1;
++            do
++            {
++              GET_BIT_CHECK(prob + i, i);
++            }
++            while (--numDirectBits != 0);
++          }
++        }
++      }
++    }
++  }
++  NORMALIZE_CHECK;
++  return res;
++}
++
++
++static void LzmaDec_InitRc(CLzmaDec *p, const Byte *data)
++{
++  p->code = ((UInt32)data[1] << 24) | ((UInt32)data[2] << 16) | ((UInt32)data[3] << 8) | ((UInt32)data[4]);
++  p->range = 0xFFFFFFFF;
++  p->needFlush = 0;
++}
++
++void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
++{
++  p->needFlush = 1;
++  p->remainLen = 0;
++  p->tempBufSize = 0;
++
++  if (initDic)
++  {
++    p->processedPos = 0;
++    p->checkDicSize = 0;
++    p->needInitState = 1;
++  }
++  if (initState)
++    p->needInitState = 1;
++}
++
++void LzmaDec_Init(CLzmaDec *p)
++{
++  p->dicPos = 0;
++  LzmaDec_InitDicAndState(p, True, True);
++}
++
++static void LzmaDec_InitStateReal(CLzmaDec *p)
++{
++  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (p->prop.lc + p->prop.lp));
++  UInt32 i;
++  CLzmaProb *probs = p->probs;
++  for (i = 0; i < numProbs; i++)
++    probs[i] = kBitModelTotal >> 1;
++  p->reps[0] = p->reps[1] = p->reps[2] = p->reps[3] = 1;
++  p->state = 0;
++  p->needInitState = 0;
++}
++
++SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
++    ELzmaFinishMode finishMode, ELzmaStatus *status)
++{
++  SizeT inSize = *srcLen;
++  (*srcLen) = 0;
++  LzmaDec_WriteRem(p, dicLimit);
++  
++  *status = LZMA_STATUS_NOT_SPECIFIED;
++
++  while (p->remainLen != kMatchSpecLenStart)
++  {
++      int checkEndMarkNow;
++
++      if (p->needFlush != 0)
++      {
++        for (; inSize > 0 && p->tempBufSize < RC_INIT_SIZE; (*srcLen)++, inSize--)
++          p->tempBuf[p->tempBufSize++] = *src++;
++        if (p->tempBufSize < RC_INIT_SIZE)
++        {
++          *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++          return SZ_OK;
++        }
++        if (p->tempBuf[0] != 0)
++          return SZ_ERROR_DATA;
++
++        LzmaDec_InitRc(p, p->tempBuf);
++        p->tempBufSize = 0;
++      }
++
++      checkEndMarkNow = 0;
++      if (p->dicPos >= dicLimit)
++      {
++        if (p->remainLen == 0 && p->code == 0)
++        {
++          *status = LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK;
++          return SZ_OK;
++        }
++        if (finishMode == LZMA_FINISH_ANY)
++        {
++          *status = LZMA_STATUS_NOT_FINISHED;
++          return SZ_OK;
++        }
++        if (p->remainLen != 0)
++        {
++          *status = LZMA_STATUS_NOT_FINISHED;
++          return SZ_ERROR_DATA;
++        }
++        checkEndMarkNow = 1;
++      }
++
++      if (p->needInitState)
++        LzmaDec_InitStateReal(p);
++  
++      if (p->tempBufSize == 0)
++      {
++        SizeT processed;
++        const Byte *bufLimit;
++        if (inSize < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
++        {
++          int dummyRes = LzmaDec_TryDummy(p, src, inSize);
++          if (dummyRes == DUMMY_ERROR)
++          {
++            memcpy(p->tempBuf, src, inSize);
++            p->tempBufSize = (unsigned)inSize;
++            (*srcLen) += inSize;
++            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++            return SZ_OK;
++          }
++          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
++          {
++            *status = LZMA_STATUS_NOT_FINISHED;
++            return SZ_ERROR_DATA;
++          }
++          bufLimit = src;
++        }
++        else
++          bufLimit = src + inSize - LZMA_REQUIRED_INPUT_MAX;
++        p->buf = src;
++        if (LzmaDec_DecodeReal2(p, dicLimit, bufLimit) != 0)
++          return SZ_ERROR_DATA;
++        processed = (SizeT)(p->buf - src);
++        (*srcLen) += processed;
++        src += processed;
++        inSize -= processed;
++      }
++      else
++      {
++        unsigned rem = p->tempBufSize, lookAhead = 0;
++        while (rem < LZMA_REQUIRED_INPUT_MAX && lookAhead < inSize)
++          p->tempBuf[rem++] = src[lookAhead++];
++        p->tempBufSize = rem;
++        if (rem < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
++        {
++          int dummyRes = LzmaDec_TryDummy(p, p->tempBuf, rem);
++          if (dummyRes == DUMMY_ERROR)
++          {
++            (*srcLen) += lookAhead;
++            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++            return SZ_OK;
++          }
++          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
++          {
++            *status = LZMA_STATUS_NOT_FINISHED;
++            return SZ_ERROR_DATA;
++          }
++        }
++        p->buf = p->tempBuf;
++        if (LzmaDec_DecodeReal2(p, dicLimit, p->buf) != 0)
++          return SZ_ERROR_DATA;
++        lookAhead -= (rem - (unsigned)(p->buf - p->tempBuf));
++        (*srcLen) += lookAhead;
++        src += lookAhead;
++        inSize -= lookAhead;
++        p->tempBufSize = 0;
++      }
++  }
++  if (p->code == 0)
++    *status = LZMA_STATUS_FINISHED_WITH_MARK;
++  return (p->code == 0) ? SZ_OK : SZ_ERROR_DATA;
++}
++
++SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
++{
++  SizeT outSize = *destLen;
++  SizeT inSize = *srcLen;
++  *srcLen = *destLen = 0;
++  for (;;)
++  {
++    SizeT inSizeCur = inSize, outSizeCur, dicPos;
++    ELzmaFinishMode curFinishMode;
++    SRes res;
++    if (p->dicPos == p->dicBufSize)
++      p->dicPos = 0;
++    dicPos = p->dicPos;
++    if (outSize > p->dicBufSize - dicPos)
++    {
++      outSizeCur = p->dicBufSize;
++      curFinishMode = LZMA_FINISH_ANY;
++    }
++    else
++    {
++      outSizeCur = dicPos + outSize;
++      curFinishMode = finishMode;
++    }
++
++    res = LzmaDec_DecodeToDic(p, outSizeCur, src, &inSizeCur, curFinishMode, status);
++    src += inSizeCur;
++    inSize -= inSizeCur;
++    *srcLen += inSizeCur;
++    outSizeCur = p->dicPos - dicPos;
++    memcpy(dest, p->dic + dicPos, outSizeCur);
++    dest += outSizeCur;
++    outSize -= outSizeCur;
++    *destLen += outSizeCur;
++    if (res != 0)
++      return res;
++    if (outSizeCur == 0 || outSize == 0)
++      return SZ_OK;
++  }
++}
++
++void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->probs);
++  p->probs = 0;
++}
++
++static void LzmaDec_FreeDict(CLzmaDec *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->dic);
++  p->dic = 0;
++}
++
++void LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
++{
++  LzmaDec_FreeProbs(p, alloc);
++  LzmaDec_FreeDict(p, alloc);
++}
++
++SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
++{
++  UInt32 dicSize;
++  Byte d;
++  
++  if (size < LZMA_PROPS_SIZE)
++    return SZ_ERROR_UNSUPPORTED;
++  else
++    dicSize = data[1] | ((UInt32)data[2] << 8) | ((UInt32)data[3] << 16) | ((UInt32)data[4] << 24);
++ 
++  if (dicSize < LZMA_DIC_MIN)
++    dicSize = LZMA_DIC_MIN;
++  p->dicSize = dicSize;
++
++  d = data[0];
++  if (d >= (9 * 5 * 5))
++    return SZ_ERROR_UNSUPPORTED;
++
++  p->lc = d % 9;
++  d /= 9;
++  p->pb = d / 5;
++  p->lp = d % 5;
++
++  return SZ_OK;
++}
++
++static SRes LzmaDec_AllocateProbs2(CLzmaDec *p, const CLzmaProps *propNew, ISzAlloc *alloc)
++{
++  UInt32 numProbs = LzmaProps_GetNumProbs(propNew);
++  if (p->probs == 0 || numProbs != p->numProbs)
++  {
++    LzmaDec_FreeProbs(p, alloc);
++    p->probs = (CLzmaProb *)alloc->Alloc(alloc, numProbs * sizeof(CLzmaProb));
++    p->numProbs = numProbs;
++    if (p->probs == 0)
++      return SZ_ERROR_MEM;
++  }
++  return SZ_OK;
++}
++
++SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++{
++  CLzmaProps propNew;
++  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
++  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
++  p->prop = propNew;
++  return SZ_OK;
++}
++
++SRes LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++{
++  CLzmaProps propNew;
++  SizeT dicBufSize;
++  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
++  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
++  dicBufSize = propNew.dicSize;
++  if (p->dic == 0 || dicBufSize != p->dicBufSize)
++  {
++    LzmaDec_FreeDict(p, alloc);
++    p->dic = (Byte *)alloc->Alloc(alloc, dicBufSize);
++    if (p->dic == 0)
++    {
++      LzmaDec_FreeProbs(p, alloc);
++      return SZ_ERROR_MEM;
++    }
++  }
++  p->dicBufSize = dicBufSize;
++  p->prop = propNew;
++  return SZ_OK;
++}
++
++SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
++    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
++    ELzmaStatus *status, ISzAlloc *alloc)
++{
++  CLzmaDec p;
++  SRes res;
++  SizeT inSize = *srcLen;
++  SizeT outSize = *destLen;
++  *srcLen = *destLen = 0;
++  if (inSize < RC_INIT_SIZE)
++    return SZ_ERROR_INPUT_EOF;
++
++  LzmaDec_Construct(&p);
++  res = LzmaDec_AllocateProbs(&p, propData, propSize, alloc);
++  if (res != 0)
++    return res;
++  p.dic = dest;
++  p.dicBufSize = outSize;
++
++  LzmaDec_Init(&p);
++  
++  *srcLen = inSize;
++  res = LzmaDec_DecodeToDic(&p, outSize, src, srcLen, finishMode, status);
++
++  if (res == SZ_OK && *status == LZMA_STATUS_NEEDS_MORE_INPUT)
++    res = SZ_ERROR_INPUT_EOF;
++
++  (*destLen) = p.dicPos;
++  LzmaDec_FreeProbs(&p, alloc);
++  return res;
++}
+--- /dev/null
++++ b/lib/lzma/LzmaEnc.c
+@@ -0,0 +1,2271 @@
++/* LzmaEnc.c -- LZMA Encoder
++2009-11-24 : Igor Pavlov : Public domain */
++
++#include <string.h>
++
++/* #define SHOW_STAT */
++/* #define SHOW_STAT2 */
++
++#if defined(SHOW_STAT) || defined(SHOW_STAT2)
++#include <stdio.h>
++#endif
++
++#include "LzmaEnc.h"
++
++/* disable MT */
++#define _7ZIP_ST
++
++#include "LzFind.h"
++#ifndef _7ZIP_ST
++#include "LzFindMt.h"
++#endif
++
++#ifdef SHOW_STAT
++static int ttt = 0;
++#endif
++
++#define kBlockSizeMax ((1 << LZMA_NUM_BLOCK_SIZE_BITS) - 1)
++
++#define kBlockSize (9 << 10)
++#define kUnpackBlockSize (1 << 18)
++#define kMatchArraySize (1 << 21)
++#define kMatchRecordMaxSize ((LZMA_MATCH_LEN_MAX * 2 + 3) * LZMA_MATCH_LEN_MAX)
++
++#define kNumMaxDirectBits (31)
++
++#define kNumTopBits 24
++#define kTopValue ((UInt32)1 << kNumTopBits)
++
++#define kNumBitModelTotalBits 11
++#define kBitModelTotal (1 << kNumBitModelTotalBits)
++#define kNumMoveBits 5
++#define kProbInitValue (kBitModelTotal >> 1)
++
++#define kNumMoveReducingBits 4
++#define kNumBitPriceShiftBits 4
++#define kBitPrice (1 << kNumBitPriceShiftBits)
++
++void LzmaEncProps_Init(CLzmaEncProps *p)
++{
++  p->level = 5;
++  p->dictSize = p->mc = 0;
++  p->lc = p->lp = p->pb = p->algo = p->fb = p->btMode = p->numHashBytes = p->numThreads = -1;
++  p->writeEndMark = 0;
++}
++
++void LzmaEncProps_Normalize(CLzmaEncProps *p)
++{
++  int level = p->level;
++  if (level < 0) level = 5;
++  p->level = level;
++  if (p->dictSize == 0) p->dictSize = (level <= 5 ? (1 << (level * 2 + 14)) : (level == 6 ? (1 << 25) : (1 << 26)));
++  if (p->lc < 0) p->lc = 3;
++  if (p->lp < 0) p->lp = 0;
++  if (p->pb < 0) p->pb = 2;
++  if (p->algo < 0) p->algo = (level < 5 ? 0 : 1);
++  if (p->fb < 0) p->fb = (level < 7 ? 32 : 64);
++  if (p->btMode < 0) p->btMode = (p->algo == 0 ? 0 : 1);
++  if (p->numHashBytes < 0) p->numHashBytes = 4;
++  if (p->mc == 0)  p->mc = (16 + (p->fb >> 1)) >> (p->btMode ? 0 : 1);
++  if (p->numThreads < 0)
++    p->numThreads =
++      #ifndef _7ZIP_ST
++      ((p->btMode && p->algo) ? 2 : 1);
++      #else
++      1;
++      #endif
++}
++
++UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
++{
++  CLzmaEncProps props = *props2;
++  LzmaEncProps_Normalize(&props);
++  return props.dictSize;
++}
++
++/* #define LZMA_LOG_BSR */
++/* Define it for Intel's CPU */
++
++
++#ifdef LZMA_LOG_BSR
++
++#define kDicLogSizeMaxCompress 30
++
++#define BSR2_RET(pos, res) { unsigned long i; _BitScanReverse(&i, (pos)); res = (i + i) + ((pos >> (i - 1)) & 1); }
++
++UInt32 GetPosSlot1(UInt32 pos)
++{
++  UInt32 res;
++  BSR2_RET(pos, res);
++  return res;
++}
++#define GetPosSlot2(pos, res) { BSR2_RET(pos, res); }
++#define GetPosSlot(pos, res) { if (pos < 2) res = pos; else BSR2_RET(pos, res); }
++
++#else
++
++#define kNumLogBits (9 + (int)sizeof(size_t) / 2)
++#define kDicLogSizeMaxCompress ((kNumLogBits - 1) * 2 + 7)
++
++void LzmaEnc_FastPosInit(Byte *g_FastPos)
++{
++  int c = 2, slotFast;
++  g_FastPos[0] = 0;
++  g_FastPos[1] = 1;
++  
++  for (slotFast = 2; slotFast < kNumLogBits * 2; slotFast++)
++  {
++    UInt32 k = (1 << ((slotFast >> 1) - 1));
++    UInt32 j;
++    for (j = 0; j < k; j++, c++)
++      g_FastPos[c] = (Byte)slotFast;
++  }
++}
++
++#define BSR2_RET(pos, res) { UInt32 i = 6 + ((kNumLogBits - 1) & \
++  (0 - (((((UInt32)1 << (kNumLogBits + 6)) - 1) - pos) >> 31))); \
++  res = p->g_FastPos[pos >> i] + (i * 2); }
++/*
++#define BSR2_RET(pos, res) { res = (pos < (1 << (kNumLogBits + 6))) ? \
++  p->g_FastPos[pos >> 6] + 12 : \
++  p->g_FastPos[pos >> (6 + kNumLogBits - 1)] + (6 + (kNumLogBits - 1)) * 2; }
++*/
++
++#define GetPosSlot1(pos) p->g_FastPos[pos]
++#define GetPosSlot2(pos, res) { BSR2_RET(pos, res); }
++#define GetPosSlot(pos, res) { if (pos < kNumFullDistances) res = p->g_FastPos[pos]; else BSR2_RET(pos, res); }
++
++#endif
++
++
++#define LZMA_NUM_REPS 4
++
++typedef unsigned CState;
++
++typedef struct
++{
++  UInt32 price;
++
++  CState state;
++  int prev1IsChar;
++  int prev2;
++
++  UInt32 posPrev2;
++  UInt32 backPrev2;
++
++  UInt32 posPrev;
++  UInt32 backPrev;
++  UInt32 backs[LZMA_NUM_REPS];
++} COptimal;
++
++#define kNumOpts (1 << 12)
++
++#define kNumLenToPosStates 4
++#define kNumPosSlotBits 6
++#define kDicLogSizeMin 0
++#define kDicLogSizeMax 32
++#define kDistTableSizeMax (kDicLogSizeMax * 2)
++
++
++#define kNumAlignBits 4
++#define kAlignTableSize (1 << kNumAlignBits)
++#define kAlignMask (kAlignTableSize - 1)
++
++#define kStartPosModelIndex 4
++#define kEndPosModelIndex 14
++#define kNumPosModels (kEndPosModelIndex - kStartPosModelIndex)
++
++#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
++
++#ifdef _LZMA_PROB32
++#define CLzmaProb UInt32
++#else
++#define CLzmaProb UInt16
++#endif
++
++#define LZMA_PB_MAX 4
++#define LZMA_LC_MAX 8
++#define LZMA_LP_MAX 4
++
++#define LZMA_NUM_PB_STATES_MAX (1 << LZMA_PB_MAX)
++
++
++#define kLenNumLowBits 3
++#define kLenNumLowSymbols (1 << kLenNumLowBits)
++#define kLenNumMidBits 3
++#define kLenNumMidSymbols (1 << kLenNumMidBits)
++#define kLenNumHighBits 8
++#define kLenNumHighSymbols (1 << kLenNumHighBits)
++
++#define kLenNumSymbolsTotal (kLenNumLowSymbols + kLenNumMidSymbols + kLenNumHighSymbols)
++
++#define LZMA_MATCH_LEN_MIN 2
++#define LZMA_MATCH_LEN_MAX (LZMA_MATCH_LEN_MIN + kLenNumSymbolsTotal - 1)
++
++#define kNumStates 12
++
++typedef struct
++{
++  CLzmaProb choice;
++  CLzmaProb choice2;
++  CLzmaProb low[LZMA_NUM_PB_STATES_MAX << kLenNumLowBits];
++  CLzmaProb mid[LZMA_NUM_PB_STATES_MAX << kLenNumMidBits];
++  CLzmaProb high[kLenNumHighSymbols];
++} CLenEnc;
++
++typedef struct
++{
++  CLenEnc p;
++  UInt32 prices[LZMA_NUM_PB_STATES_MAX][kLenNumSymbolsTotal];
++  UInt32 tableSize;
++  UInt32 counters[LZMA_NUM_PB_STATES_MAX];
++} CLenPriceEnc;
++
++typedef struct
++{
++  UInt32 range;
++  Byte cache;
++  UInt64 low;
++  UInt64 cacheSize;
++  Byte *buf;
++  Byte *bufLim;
++  Byte *bufBase;
++  ISeqOutStream *outStream;
++  UInt64 processed;
++  SRes res;
++} CRangeEnc;
++
++typedef struct
++{
++  CLzmaProb *litProbs;
++
++  CLzmaProb isMatch[kNumStates][LZMA_NUM_PB_STATES_MAX];
++  CLzmaProb isRep[kNumStates];
++  CLzmaProb isRepG0[kNumStates];
++  CLzmaProb isRepG1[kNumStates];
++  CLzmaProb isRepG2[kNumStates];
++  CLzmaProb isRep0Long[kNumStates][LZMA_NUM_PB_STATES_MAX];
++
++  CLzmaProb posSlotEncoder[kNumLenToPosStates][1 << kNumPosSlotBits];
++  CLzmaProb posEncoders[kNumFullDistances - kEndPosModelIndex];
++  CLzmaProb posAlignEncoder[1 << kNumAlignBits];
++  
++  CLenPriceEnc lenEnc;
++  CLenPriceEnc repLenEnc;
++
++  UInt32 reps[LZMA_NUM_REPS];
++  UInt32 state;
++} CSaveState;
++
++typedef struct
++{
++  IMatchFinder matchFinder;
++  void *matchFinderObj;
++
++  #ifndef _7ZIP_ST
++  Bool mtMode;
++  CMatchFinderMt matchFinderMt;
++  #endif
++
++  CMatchFinder matchFinderBase;
++
++  #ifndef _7ZIP_ST
++  Byte pad[128];
++  #endif
++  
++  UInt32 optimumEndIndex;
++  UInt32 optimumCurrentIndex;
++
++  UInt32 longestMatchLength;
++  UInt32 numPairs;
++  UInt32 numAvail;
++  COptimal opt[kNumOpts];
++  
++  #ifndef LZMA_LOG_BSR
++  Byte g_FastPos[1 << kNumLogBits];
++  #endif
++
++  UInt32 ProbPrices[kBitModelTotal >> kNumMoveReducingBits];
++  UInt32 matches[LZMA_MATCH_LEN_MAX * 2 + 2 + 1];
++  UInt32 numFastBytes;
++  UInt32 additionalOffset;
++  UInt32 reps[LZMA_NUM_REPS];
++  UInt32 state;
++
++  UInt32 posSlotPrices[kNumLenToPosStates][kDistTableSizeMax];
++  UInt32 distancesPrices[kNumLenToPosStates][kNumFullDistances];
++  UInt32 alignPrices[kAlignTableSize];
++  UInt32 alignPriceCount;
++
++  UInt32 distTableSize;
++
++  unsigned lc, lp, pb;
++  unsigned lpMask, pbMask;
++
++  CLzmaProb *litProbs;
++
++  CLzmaProb isMatch[kNumStates][LZMA_NUM_PB_STATES_MAX];
++  CLzmaProb isRep[kNumStates];
++  CLzmaProb isRepG0[kNumStates];
++  CLzmaProb isRepG1[kNumStates];
++  CLzmaProb isRepG2[kNumStates];
++  CLzmaProb isRep0Long[kNumStates][LZMA_NUM_PB_STATES_MAX];
++
++  CLzmaProb posSlotEncoder[kNumLenToPosStates][1 << kNumPosSlotBits];
++  CLzmaProb posEncoders[kNumFullDistances - kEndPosModelIndex];
++  CLzmaProb posAlignEncoder[1 << kNumAlignBits];
++  
++  CLenPriceEnc lenEnc;
++  CLenPriceEnc repLenEnc;
++
++  unsigned lclp;
++
++  Bool fastMode;
++  
++  CRangeEnc rc;
++
++  Bool writeEndMark;
++  UInt64 nowPos64;
++  UInt32 matchPriceCount;
++  Bool finished;
++  Bool multiThread;
++
++  SRes result;
++  UInt32 dictSize;
++  UInt32 matchFinderCycles;
++
++  int needInit;
++
++  CSaveState saveState;
++} CLzmaEnc;
++
++void LzmaEnc_SaveState(CLzmaEncHandle pp)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  CSaveState *dest = &p->saveState;
++  int i;
++  dest->lenEnc = p->lenEnc;
++  dest->repLenEnc = p->repLenEnc;
++  dest->state = p->state;
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
++    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
++  }
++  for (i = 0; i < kNumLenToPosStates; i++)
++    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
++  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
++  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
++  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
++  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
++  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
++  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
++  memcpy(dest->reps, p->reps, sizeof(p->reps));
++  memcpy(dest->litProbs, p->litProbs, (0x300 << p->lclp) * sizeof(CLzmaProb));
++}
++
++void LzmaEnc_RestoreState(CLzmaEncHandle pp)
++{
++  CLzmaEnc *dest = (CLzmaEnc *)pp;
++  const CSaveState *p = &dest->saveState;
++  int i;
++  dest->lenEnc = p->lenEnc;
++  dest->repLenEnc = p->repLenEnc;
++  dest->state = p->state;
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
++    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
++  }
++  for (i = 0; i < kNumLenToPosStates; i++)
++    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
++  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
++  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
++  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
++  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
++  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
++  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
++  memcpy(dest->reps, p->reps, sizeof(p->reps));
++  memcpy(dest->litProbs, p->litProbs, (0x300 << dest->lclp) * sizeof(CLzmaProb));
++}
++
++SRes LzmaEnc_SetProps(CLzmaEncHandle pp, const CLzmaEncProps *props2)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  CLzmaEncProps props = *props2;
++  LzmaEncProps_Normalize(&props);
++
++  if (props.lc > LZMA_LC_MAX || props.lp > LZMA_LP_MAX || props.pb > LZMA_PB_MAX ||
++      props.dictSize > (1 << kDicLogSizeMaxCompress) || props.dictSize > (1 << 30))
++    return SZ_ERROR_PARAM;
++  p->dictSize = props.dictSize;
++  p->matchFinderCycles = props.mc;
++  {
++    unsigned fb = props.fb;
++    if (fb < 5)
++      fb = 5;
++    if (fb > LZMA_MATCH_LEN_MAX)
++      fb = LZMA_MATCH_LEN_MAX;
++    p->numFastBytes = fb;
++  }
++  p->lc = props.lc;
++  p->lp = props.lp;
++  p->pb = props.pb;
++  p->fastMode = (props.algo == 0);
++  p->matchFinderBase.btMode = props.btMode;
++  {
++    UInt32 numHashBytes = 4;
++    if (props.btMode)
++    {
++      if (props.numHashBytes < 2)
++        numHashBytes = 2;
++      else if (props.numHashBytes < 4)
++        numHashBytes = props.numHashBytes;
++    }
++    p->matchFinderBase.numHashBytes = numHashBytes;
++  }
++
++  p->matchFinderBase.cutValue = props.mc;
++
++  p->writeEndMark = props.writeEndMark;
++
++  #ifndef _7ZIP_ST
++  /*
++  if (newMultiThread != _multiThread)
++  {
++    ReleaseMatchFinder();
++    _multiThread = newMultiThread;
++  }
++  */
++  p->multiThread = (props.numThreads > 1);
++  #endif
++
++  return SZ_OK;
++}
++
++static const int kLiteralNextStates[kNumStates] = {0, 0, 0, 0, 1, 2, 3, 4,  5,  6,   4, 5};
++static const int kMatchNextStates[kNumStates]   = {7, 7, 7, 7, 7, 7, 7, 10, 10, 10, 10, 10};
++static const int kRepNextStates[kNumStates]     = {8, 8, 8, 8, 8, 8, 8, 11, 11, 11, 11, 11};
++static const int kShortRepNextStates[kNumStates]= {9, 9, 9, 9, 9, 9, 9, 11, 11, 11, 11, 11};
++
++#define IsCharState(s) ((s) < 7)
++
++#define GetLenToPosState(len) (((len) < kNumLenToPosStates + 1) ? (len) - 2 : kNumLenToPosStates - 1)
++
++#define kInfinityPrice (1 << 30)
++
++static void RangeEnc_Construct(CRangeEnc *p)
++{
++  p->outStream = 0;
++  p->bufBase = 0;
++}
++
++#define RangeEnc_GetProcessed(p) ((p)->processed + ((p)->buf - (p)->bufBase) + (p)->cacheSize)
++
++#define RC_BUF_SIZE (1 << 16)
++static int RangeEnc_Alloc(CRangeEnc *p, ISzAlloc *alloc)
++{
++  if (p->bufBase == 0)
++  {
++    p->bufBase = (Byte *)alloc->Alloc(alloc, RC_BUF_SIZE);
++    if (p->bufBase == 0)
++      return 0;
++    p->bufLim = p->bufBase + RC_BUF_SIZE;
++  }
++  return 1;
++}
++
++static void RangeEnc_Free(CRangeEnc *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->bufBase);
++  p->bufBase = 0;
++}
++
++static void RangeEnc_Init(CRangeEnc *p)
++{
++  /* Stream.Init(); */
++  p->low = 0;
++  p->range = 0xFFFFFFFF;
++  p->cacheSize = 1;
++  p->cache = 0;
++
++  p->buf = p->bufBase;
++
++  p->processed = 0;
++  p->res = SZ_OK;
++}
++
++static void RangeEnc_FlushStream(CRangeEnc *p)
++{
++  size_t num;
++  if (p->res != SZ_OK)
++    return;
++  num = p->buf - p->bufBase;
++  if (num != p->outStream->Write(p->outStream, p->bufBase, num))
++    p->res = SZ_ERROR_WRITE;
++  p->processed += num;
++  p->buf = p->bufBase;
++}
++
++static void MY_FAST_CALL RangeEnc_ShiftLow(CRangeEnc *p)
++{
++  if ((UInt32)p->low < (UInt32)0xFF000000 || (int)(p->low >> 32) != 0)
++  {
++    Byte temp = p->cache;
++    do
++    {
++      Byte *buf = p->buf;
++      *buf++ = (Byte)(temp + (Byte)(p->low >> 32));
++      p->buf = buf;
++      if (buf == p->bufLim)
++        RangeEnc_FlushStream(p);
++      temp = 0xFF;
++    }
++    while (--p->cacheSize != 0);
++    p->cache = (Byte)((UInt32)p->low >> 24);
++  }
++  p->cacheSize++;
++  p->low = (UInt32)p->low << 8;
++}
++
++static void RangeEnc_FlushData(CRangeEnc *p)
++{
++  int i;
++  for (i = 0; i < 5; i++)
++    RangeEnc_ShiftLow(p);
++}
++
++static void RangeEnc_EncodeDirectBits(CRangeEnc *p, UInt32 value, int numBits)
++{
++  do
++  {
++    p->range >>= 1;
++    p->low += p->range & (0 - ((value >> --numBits) & 1));
++    if (p->range < kTopValue)
++    {
++      p->range <<= 8;
++      RangeEnc_ShiftLow(p);
++    }
++  }
++  while (numBits != 0);
++}
++
++static void RangeEnc_EncodeBit(CRangeEnc *p, CLzmaProb *prob, UInt32 symbol)
++{
++  UInt32 ttt = *prob;
++  UInt32 newBound = (p->range >> kNumBitModelTotalBits) * ttt;
++  if (symbol == 0)
++  {
++    p->range = newBound;
++    ttt += (kBitModelTotal - ttt) >> kNumMoveBits;
++  }
++  else
++  {
++    p->low += newBound;
++    p->range -= newBound;
++    ttt -= ttt >> kNumMoveBits;
++  }
++  *prob = (CLzmaProb)ttt;
++  if (p->range < kTopValue)
++  {
++    p->range <<= 8;
++    RangeEnc_ShiftLow(p);
++  }
++}
++
++static void LitEnc_Encode(CRangeEnc *p, CLzmaProb *probs, UInt32 symbol)
++{
++  symbol |= 0x100;
++  do
++  {
++    RangeEnc_EncodeBit(p, probs + (symbol >> 8), (symbol >> 7) & 1);
++    symbol <<= 1;
++  }
++  while (symbol < 0x10000);
++}
++
++static void LitEnc_EncodeMatched(CRangeEnc *p, CLzmaProb *probs, UInt32 symbol, UInt32 matchByte)
++{
++  UInt32 offs = 0x100;
++  symbol |= 0x100;
++  do
++  {
++    matchByte <<= 1;
++    RangeEnc_EncodeBit(p, probs + (offs + (matchByte & offs) + (symbol >> 8)), (symbol >> 7) & 1);
++    symbol <<= 1;
++    offs &= ~(matchByte ^ symbol);
++  }
++  while (symbol < 0x10000);
++}
++
++void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
++{
++  UInt32 i;
++  for (i = (1 << kNumMoveReducingBits) / 2; i < kBitModelTotal; i += (1 << kNumMoveReducingBits))
++  {
++    const int kCyclesBits = kNumBitPriceShiftBits;
++    UInt32 w = i;
++    UInt32 bitCount = 0;
++    int j;
++    for (j = 0; j < kCyclesBits; j++)
++    {
++      w = w * w;
++      bitCount <<= 1;
++      while (w >= ((UInt32)1 << 16))
++      {
++        w >>= 1;
++        bitCount++;
++      }
++    }
++    ProbPrices[i >> kNumMoveReducingBits] = ((kNumBitModelTotalBits << kCyclesBits) - 15 - bitCount);
++  }
++}
++
++
++#define GET_PRICE(prob, symbol) \
++  p->ProbPrices[((prob) ^ (((-(int)(symbol))) & (kBitModelTotal - 1))) >> kNumMoveReducingBits];
++
++#define GET_PRICEa(prob, symbol) \
++  ProbPrices[((prob) ^ ((-((int)(symbol))) & (kBitModelTotal - 1))) >> kNumMoveReducingBits];
++
++#define GET_PRICE_0(prob) p->ProbPrices[(prob) >> kNumMoveReducingBits]
++#define GET_PRICE_1(prob) p->ProbPrices[((prob) ^ (kBitModelTotal - 1)) >> kNumMoveReducingBits]
++
++#define GET_PRICE_0a(prob) ProbPrices[(prob) >> kNumMoveReducingBits]
++#define GET_PRICE_1a(prob) ProbPrices[((prob) ^ (kBitModelTotal - 1)) >> kNumMoveReducingBits]
++
++static UInt32 LitEnc_GetPrice(const CLzmaProb *probs, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  symbol |= 0x100;
++  do
++  {
++    price += GET_PRICEa(probs[symbol >> 8], (symbol >> 7) & 1);
++    symbol <<= 1;
++  }
++  while (symbol < 0x10000);
++  return price;
++}
++
++static UInt32 LitEnc_GetPriceMatched(const CLzmaProb *probs, UInt32 symbol, UInt32 matchByte, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  UInt32 offs = 0x100;
++  symbol |= 0x100;
++  do
++  {
++    matchByte <<= 1;
++    price += GET_PRICEa(probs[offs + (matchByte & offs) + (symbol >> 8)], (symbol >> 7) & 1);
++    symbol <<= 1;
++    offs &= ~(matchByte ^ symbol);
++  }
++  while (symbol < 0x10000);
++  return price;
++}
++
++
++static void RcTree_Encode(CRangeEnc *rc, CLzmaProb *probs, int numBitLevels, UInt32 symbol)
++{
++  UInt32 m = 1;
++  int i;
++  for (i = numBitLevels; i != 0;)
++  {
++    UInt32 bit;
++    i--;
++    bit = (symbol >> i) & 1;
++    RangeEnc_EncodeBit(rc, probs + m, bit);
++    m = (m << 1) | bit;
++  }
++}
++
++static void RcTree_ReverseEncode(CRangeEnc *rc, CLzmaProb *probs, int numBitLevels, UInt32 symbol)
++{
++  UInt32 m = 1;
++  int i;
++  for (i = 0; i < numBitLevels; i++)
++  {
++    UInt32 bit = symbol & 1;
++    RangeEnc_EncodeBit(rc, probs + m, bit);
++    m = (m << 1) | bit;
++    symbol >>= 1;
++  }
++}
++
++static UInt32 RcTree_GetPrice(const CLzmaProb *probs, int numBitLevels, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  symbol |= (1 << numBitLevels);
++  while (symbol != 1)
++  {
++    price += GET_PRICEa(probs[symbol >> 1], symbol & 1);
++    symbol >>= 1;
++  }
++  return price;
++}
++
++static UInt32 RcTree_ReverseGetPrice(const CLzmaProb *probs, int numBitLevels, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  UInt32 m = 1;
++  int i;
++  for (i = numBitLevels; i != 0; i--)
++  {
++    UInt32 bit = symbol & 1;
++    symbol >>= 1;
++    price += GET_PRICEa(probs[m], bit);
++    m = (m << 1) | bit;
++  }
++  return price;
++}
++
++
++static void LenEnc_Init(CLenEnc *p)
++{
++  unsigned i;
++  p->choice = p->choice2 = kProbInitValue;
++  for (i = 0; i < (LZMA_NUM_PB_STATES_MAX << kLenNumLowBits); i++)
++    p->low[i] = kProbInitValue;
++  for (i = 0; i < (LZMA_NUM_PB_STATES_MAX << kLenNumMidBits); i++)
++    p->mid[i] = kProbInitValue;
++  for (i = 0; i < kLenNumHighSymbols; i++)
++    p->high[i] = kProbInitValue;
++}
++
++static void LenEnc_Encode(CLenEnc *p, CRangeEnc *rc, UInt32 symbol, UInt32 posState)
++{
++  if (symbol < kLenNumLowSymbols)
++  {
++    RangeEnc_EncodeBit(rc, &p->choice, 0);
++    RcTree_Encode(rc, p->low + (posState << kLenNumLowBits), kLenNumLowBits, symbol);
++  }
++  else
++  {
++    RangeEnc_EncodeBit(rc, &p->choice, 1);
++    if (symbol < kLenNumLowSymbols + kLenNumMidSymbols)
++    {
++      RangeEnc_EncodeBit(rc, &p->choice2, 0);
++      RcTree_Encode(rc, p->mid + (posState << kLenNumMidBits), kLenNumMidBits, symbol - kLenNumLowSymbols);
++    }
++    else
++    {
++      RangeEnc_EncodeBit(rc, &p->choice2, 1);
++      RcTree_Encode(rc, p->high, kLenNumHighBits, symbol - kLenNumLowSymbols - kLenNumMidSymbols);
++    }
++  }
++}
++
++static void LenEnc_SetPrices(CLenEnc *p, UInt32 posState, UInt32 numSymbols, UInt32 *prices, UInt32 *ProbPrices)
++{
++  UInt32 a0 = GET_PRICE_0a(p->choice);
++  UInt32 a1 = GET_PRICE_1a(p->choice);
++  UInt32 b0 = a1 + GET_PRICE_0a(p->choice2);
++  UInt32 b1 = a1 + GET_PRICE_1a(p->choice2);
++  UInt32 i = 0;
++  for (i = 0; i < kLenNumLowSymbols; i++)
++  {
++    if (i >= numSymbols)
++      return;
++    prices[i] = a0 + RcTree_GetPrice(p->low + (posState << kLenNumLowBits), kLenNumLowBits, i, ProbPrices);
++  }
++  for (; i < kLenNumLowSymbols + kLenNumMidSymbols; i++)
++  {
++    if (i >= numSymbols)
++      return;
++    prices[i] = b0 + RcTree_GetPrice(p->mid + (posState << kLenNumMidBits), kLenNumMidBits, i - kLenNumLowSymbols, ProbPrices);
++  }
++  for (; i < numSymbols; i++)
++    prices[i] = b1 + RcTree_GetPrice(p->high, kLenNumHighBits, i - kLenNumLowSymbols - kLenNumMidSymbols, ProbPrices);
++}
++
++static void MY_FAST_CALL LenPriceEnc_UpdateTable(CLenPriceEnc *p, UInt32 posState, UInt32 *ProbPrices)
++{
++  LenEnc_SetPrices(&p->p, posState, p->tableSize, p->prices[posState], ProbPrices);
++  p->counters[posState] = p->tableSize;
++}
++
++static void LenPriceEnc_UpdateTables(CLenPriceEnc *p, UInt32 numPosStates, UInt32 *ProbPrices)
++{
++  UInt32 posState;
++  for (posState = 0; posState < numPosStates; posState++)
++    LenPriceEnc_UpdateTable(p, posState, ProbPrices);
++}
++
++static void LenEnc_Encode2(CLenPriceEnc *p, CRangeEnc *rc, UInt32 symbol, UInt32 posState, Bool updatePrice, UInt32 *ProbPrices)
++{
++  LenEnc_Encode(&p->p, rc, symbol, posState);
++  if (updatePrice)
++    if (--p->counters[posState] == 0)
++      LenPriceEnc_UpdateTable(p, posState, ProbPrices);
++}
++
++
++
++
++static void MovePos(CLzmaEnc *p, UInt32 num)
++{
++  #ifdef SHOW_STAT
++  ttt += num;
++  printf("\n MovePos %d", num);
++  #endif
++  if (num != 0)
++  {
++    p->additionalOffset += num;
++    p->matchFinder.Skip(p->matchFinderObj, num);
++  }
++}
++
++static UInt32 ReadMatchDistances(CLzmaEnc *p, UInt32 *numDistancePairsRes)
++{
++  UInt32 lenRes = 0, numPairs;
++  p->numAvail = p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
++  numPairs = p->matchFinder.GetMatches(p->matchFinderObj, p->matches);
++  #ifdef SHOW_STAT
++  printf("\n i = %d numPairs = %d    ", ttt, numPairs / 2);
++  ttt++;
++  {
++    UInt32 i;
++    for (i = 0; i < numPairs; i += 2)
++      printf("%2d %6d   | ", p->matches[i], p->matches[i + 1]);
++  }
++  #endif
++  if (numPairs > 0)
++  {
++    lenRes = p->matches[numPairs - 2];
++    if (lenRes == p->numFastBytes)
++    {
++      const Byte *pby = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++      UInt32 distance = p->matches[numPairs - 1] + 1;
++      UInt32 numAvail = p->numAvail;
++      if (numAvail > LZMA_MATCH_LEN_MAX)
++        numAvail = LZMA_MATCH_LEN_MAX;
++      {
++        const Byte *pby2 = pby - distance;
++        for (; lenRes < numAvail && pby[lenRes] == pby2[lenRes]; lenRes++);
++      }
++    }
++  }
++  p->additionalOffset++;
++  *numDistancePairsRes = numPairs;
++  return lenRes;
++}
++
++
++#define MakeAsChar(p) (p)->backPrev = (UInt32)(-1); (p)->prev1IsChar = False;
++#define MakeAsShortRep(p) (p)->backPrev = 0; (p)->prev1IsChar = False;
++#define IsShortRep(p) ((p)->backPrev == 0)
++
++static UInt32 GetRepLen1Price(CLzmaEnc *p, UInt32 state, UInt32 posState)
++{
++  return
++    GET_PRICE_0(p->isRepG0[state]) +
++    GET_PRICE_0(p->isRep0Long[state][posState]);
++}
++
++static UInt32 GetPureRepPrice(CLzmaEnc *p, UInt32 repIndex, UInt32 state, UInt32 posState)
++{
++  UInt32 price;
++  if (repIndex == 0)
++  {
++    price = GET_PRICE_0(p->isRepG0[state]);
++    price += GET_PRICE_1(p->isRep0Long[state][posState]);
++  }
++  else
++  {
++    price = GET_PRICE_1(p->isRepG0[state]);
++    if (repIndex == 1)
++      price += GET_PRICE_0(p->isRepG1[state]);
++    else
++    {
++      price += GET_PRICE_1(p->isRepG1[state]);
++      price += GET_PRICE(p->isRepG2[state], repIndex - 2);
++    }
++  }
++  return price;
++}
++
++static UInt32 GetRepPrice(CLzmaEnc *p, UInt32 repIndex, UInt32 len, UInt32 state, UInt32 posState)
++{
++  return p->repLenEnc.prices[posState][len - LZMA_MATCH_LEN_MIN] +
++    GetPureRepPrice(p, repIndex, state, posState);
++}
++
++static UInt32 Backward(CLzmaEnc *p, UInt32 *backRes, UInt32 cur)
++{
++  UInt32 posMem = p->opt[cur].posPrev;
++  UInt32 backMem = p->opt[cur].backPrev;
++  p->optimumEndIndex = cur;
++  do
++  {
++    if (p->opt[cur].prev1IsChar)
++    {
++      MakeAsChar(&p->opt[posMem])
++      p->opt[posMem].posPrev = posMem - 1;
++      if (p->opt[cur].prev2)
++      {
++        p->opt[posMem - 1].prev1IsChar = False;
++        p->opt[posMem - 1].posPrev = p->opt[cur].posPrev2;
++        p->opt[posMem - 1].backPrev = p->opt[cur].backPrev2;
++      }
++    }
++    {
++      UInt32 posPrev = posMem;
++      UInt32 backCur = backMem;
++      
++      backMem = p->opt[posPrev].backPrev;
++      posMem = p->opt[posPrev].posPrev;
++      
++      p->opt[posPrev].backPrev = backCur;
++      p->opt[posPrev].posPrev = cur;
++      cur = posPrev;
++    }
++  }
++  while (cur != 0);
++  *backRes = p->opt[0].backPrev;
++  p->optimumCurrentIndex  = p->opt[0].posPrev;
++  return p->optimumCurrentIndex;
++}
++
++#define LIT_PROBS(pos, prevByte) (p->litProbs + ((((pos) & p->lpMask) << p->lc) + ((prevByte) >> (8 - p->lc))) * 0x300)
++
++static UInt32 GetOptimum(CLzmaEnc *p, UInt32 position, UInt32 *backRes)
++{
++  UInt32 numAvail, mainLen, numPairs, repMaxIndex, i, posState, lenEnd, len, cur;
++  UInt32 matchPrice, repMatchPrice, normalMatchPrice;
++  UInt32 reps[LZMA_NUM_REPS], repLens[LZMA_NUM_REPS];
++  UInt32 *matches;
++  const Byte *data;
++  Byte curByte, matchByte;
++  if (p->optimumEndIndex != p->optimumCurrentIndex)
++  {
++    const COptimal *opt = &p->opt[p->optimumCurrentIndex];
++    UInt32 lenRes = opt->posPrev - p->optimumCurrentIndex;
++    *backRes = opt->backPrev;
++    p->optimumCurrentIndex = opt->posPrev;
++    return lenRes;
++  }
++  p->optimumCurrentIndex = p->optimumEndIndex = 0;
++  
++  if (p->additionalOffset == 0)
++    mainLen = ReadMatchDistances(p, &numPairs);
++  else
++  {
++    mainLen = p->longestMatchLength;
++    numPairs = p->numPairs;
++  }
++
++  numAvail = p->numAvail;
++  if (numAvail < 2)
++  {
++    *backRes = (UInt32)(-1);
++    return 1;
++  }
++  if (numAvail > LZMA_MATCH_LEN_MAX)
++    numAvail = LZMA_MATCH_LEN_MAX;
++
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++  repMaxIndex = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 lenTest;
++    const Byte *data2;
++    reps[i] = p->reps[i];
++    data2 = data - (reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++    {
++      repLens[i] = 0;
++      continue;
++    }
++    for (lenTest = 2; lenTest < numAvail && data[lenTest] == data2[lenTest]; lenTest++);
++    repLens[i] = lenTest;
++    if (lenTest > repLens[repMaxIndex])
++      repMaxIndex = i;
++  }
++  if (repLens[repMaxIndex] >= p->numFastBytes)
++  {
++    UInt32 lenRes;
++    *backRes = repMaxIndex;
++    lenRes = repLens[repMaxIndex];
++    MovePos(p, lenRes - 1);
++    return lenRes;
++  }
++
++  matches = p->matches;
++  if (mainLen >= p->numFastBytes)
++  {
++    *backRes = matches[numPairs - 1] + LZMA_NUM_REPS;
++    MovePos(p, mainLen - 1);
++    return mainLen;
++  }
++  curByte = *data;
++  matchByte = *(data - (reps[0] + 1));
++
++  if (mainLen < 2 && curByte != matchByte && repLens[repMaxIndex] < 2)
++  {
++    *backRes = (UInt32)-1;
++    return 1;
++  }
++
++  p->opt[0].state = (CState)p->state;
++
++  posState = (position & p->pbMask);
++
++  {
++    const CLzmaProb *probs = LIT_PROBS(position, *(data - 1));
++    p->opt[1].price = GET_PRICE_0(p->isMatch[p->state][posState]) +
++        (!IsCharState(p->state) ?
++          LitEnc_GetPriceMatched(probs, curByte, matchByte, p->ProbPrices) :
++          LitEnc_GetPrice(probs, curByte, p->ProbPrices));
++  }
++
++  MakeAsChar(&p->opt[1]);
++
++  matchPrice = GET_PRICE_1(p->isMatch[p->state][posState]);
++  repMatchPrice = matchPrice + GET_PRICE_1(p->isRep[p->state]);
++
++  if (matchByte == curByte)
++  {
++    UInt32 shortRepPrice = repMatchPrice + GetRepLen1Price(p, p->state, posState);
++    if (shortRepPrice < p->opt[1].price)
++    {
++      p->opt[1].price = shortRepPrice;
++      MakeAsShortRep(&p->opt[1]);
++    }
++  }
++  lenEnd = ((mainLen >= repLens[repMaxIndex]) ? mainLen : repLens[repMaxIndex]);
++
++  if (lenEnd < 2)
++  {
++    *backRes = p->opt[1].backPrev;
++    return 1;
++  }
++
++  p->opt[1].posPrev = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++    p->opt[0].backs[i] = reps[i];
++
++  len = lenEnd;
++  do
++    p->opt[len--].price = kInfinityPrice;
++  while (len >= 2);
++
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 repLen = repLens[i];
++    UInt32 price;
++    if (repLen < 2)
++      continue;
++    price = repMatchPrice + GetPureRepPrice(p, i, p->state, posState);
++    do
++    {
++      UInt32 curAndLenPrice = price + p->repLenEnc.prices[posState][repLen - 2];
++      COptimal *opt = &p->opt[repLen];
++      if (curAndLenPrice < opt->price)
++      {
++        opt->price = curAndLenPrice;
++        opt->posPrev = 0;
++        opt->backPrev = i;
++        opt->prev1IsChar = False;
++      }
++    }
++    while (--repLen >= 2);
++  }
++
++  normalMatchPrice = matchPrice + GET_PRICE_0(p->isRep[p->state]);
++
++  len = ((repLens[0] >= 2) ? repLens[0] + 1 : 2);
++  if (len <= mainLen)
++  {
++    UInt32 offs = 0;
++    while (len > matches[offs])
++      offs += 2;
++    for (; ; len++)
++    {
++      COptimal *opt;
++      UInt32 distance = matches[offs + 1];
++
++      UInt32 curAndLenPrice = normalMatchPrice + p->lenEnc.prices[posState][len - LZMA_MATCH_LEN_MIN];
++      UInt32 lenToPosState = GetLenToPosState(len);
++      if (distance < kNumFullDistances)
++        curAndLenPrice += p->distancesPrices[lenToPosState][distance];
++      else
++      {
++        UInt32 slot;
++        GetPosSlot2(distance, slot);
++        curAndLenPrice += p->alignPrices[distance & kAlignMask] + p->posSlotPrices[lenToPosState][slot];
++      }
++      opt = &p->opt[len];
++      if (curAndLenPrice < opt->price)
++      {
++        opt->price = curAndLenPrice;
++        opt->posPrev = 0;
++        opt->backPrev = distance + LZMA_NUM_REPS;
++        opt->prev1IsChar = False;
++      }
++      if (len == matches[offs])
++      {
++        offs += 2;
++        if (offs == numPairs)
++          break;
++      }
++    }
++  }
++
++  cur = 0;
++
++    #ifdef SHOW_STAT2
++    if (position >= 0)
++    {
++      unsigned i;
++      printf("\n pos = %4X", position);
++      for (i = cur; i <= lenEnd; i++)
++      printf("\nprice[%4X] = %d", position - cur + i, p->opt[i].price);
++    }
++    #endif
++
++  for (;;)
++  {
++    UInt32 numAvailFull, newLen, numPairs, posPrev, state, posState, startLen;
++    UInt32 curPrice, curAnd1Price, matchPrice, repMatchPrice;
++    Bool nextIsChar;
++    Byte curByte, matchByte;
++    const Byte *data;
++    COptimal *curOpt;
++    COptimal *nextOpt;
++
++    cur++;
++    if (cur == lenEnd)
++      return Backward(p, backRes, cur);
++
++    newLen = ReadMatchDistances(p, &numPairs);
++    if (newLen >= p->numFastBytes)
++    {
++      p->numPairs = numPairs;
++      p->longestMatchLength = newLen;
++      return Backward(p, backRes, cur);
++    }
++    position++;
++    curOpt = &p->opt[cur];
++    posPrev = curOpt->posPrev;
++    if (curOpt->prev1IsChar)
++    {
++      posPrev--;
++      if (curOpt->prev2)
++      {
++        state = p->opt[curOpt->posPrev2].state;
++        if (curOpt->backPrev2 < LZMA_NUM_REPS)
++          state = kRepNextStates[state];
++        else
++          state = kMatchNextStates[state];
++      }
++      else
++        state = p->opt[posPrev].state;
++      state = kLiteralNextStates[state];
++    }
++    else
++      state = p->opt[posPrev].state;
++    if (posPrev == cur - 1)
++    {
++      if (IsShortRep(curOpt))
++        state = kShortRepNextStates[state];
++      else
++        state = kLiteralNextStates[state];
++    }
++    else
++    {
++      UInt32 pos;
++      const COptimal *prevOpt;
++      if (curOpt->prev1IsChar && curOpt->prev2)
++      {
++        posPrev = curOpt->posPrev2;
++        pos = curOpt->backPrev2;
++        state = kRepNextStates[state];
++      }
++      else
++      {
++        pos = curOpt->backPrev;
++        if (pos < LZMA_NUM_REPS)
++          state = kRepNextStates[state];
++        else
++          state = kMatchNextStates[state];
++      }
++      prevOpt = &p->opt[posPrev];
++      if (pos < LZMA_NUM_REPS)
++      {
++        UInt32 i;
++        reps[0] = prevOpt->backs[pos];
++        for (i = 1; i <= pos; i++)
++          reps[i] = prevOpt->backs[i - 1];
++        for (; i < LZMA_NUM_REPS; i++)
++          reps[i] = prevOpt->backs[i];
++      }
++      else
++      {
++        UInt32 i;
++        reps[0] = (pos - LZMA_NUM_REPS);
++        for (i = 1; i < LZMA_NUM_REPS; i++)
++          reps[i] = prevOpt->backs[i - 1];
++      }
++    }
++    curOpt->state = (CState)state;
++
++    curOpt->backs[0] = reps[0];
++    curOpt->backs[1] = reps[1];
++    curOpt->backs[2] = reps[2];
++    curOpt->backs[3] = reps[3];
++
++    curPrice = curOpt->price;
++    nextIsChar = False;
++    data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++    curByte = *data;
++    matchByte = *(data - (reps[0] + 1));
++
++    posState = (position & p->pbMask);
++
++    curAnd1Price = curPrice + GET_PRICE_0(p->isMatch[state][posState]);
++    {
++      const CLzmaProb *probs = LIT_PROBS(position, *(data - 1));
++      curAnd1Price +=
++        (!IsCharState(state) ?
++          LitEnc_GetPriceMatched(probs, curByte, matchByte, p->ProbPrices) :
++          LitEnc_GetPrice(probs, curByte, p->ProbPrices));
++    }
++
++    nextOpt = &p->opt[cur + 1];
++
++    if (curAnd1Price < nextOpt->price)
++    {
++      nextOpt->price = curAnd1Price;
++      nextOpt->posPrev = cur;
++      MakeAsChar(nextOpt);
++      nextIsChar = True;
++    }
++
++    matchPrice = curPrice + GET_PRICE_1(p->isMatch[state][posState]);
++    repMatchPrice = matchPrice + GET_PRICE_1(p->isRep[state]);
++    
++    if (matchByte == curByte && !(nextOpt->posPrev < cur && nextOpt->backPrev == 0))
++    {
++      UInt32 shortRepPrice = repMatchPrice + GetRepLen1Price(p, state, posState);
++      if (shortRepPrice <= nextOpt->price)
++      {
++        nextOpt->price = shortRepPrice;
++        nextOpt->posPrev = cur;
++        MakeAsShortRep(nextOpt);
++        nextIsChar = True;
++      }
++    }
++    numAvailFull = p->numAvail;
++    {
++      UInt32 temp = kNumOpts - 1 - cur;
++      if (temp < numAvailFull)
++        numAvailFull = temp;
++    }
++
++    if (numAvailFull < 2)
++      continue;
++    numAvail = (numAvailFull <= p->numFastBytes ? numAvailFull : p->numFastBytes);
++
++    if (!nextIsChar && matchByte != curByte) /* speed optimization */
++    {
++      /* try Literal + rep0 */
++      UInt32 temp;
++      UInt32 lenTest2;
++      const Byte *data2 = data - (reps[0] + 1);
++      UInt32 limit = p->numFastBytes + 1;
++      if (limit > numAvailFull)
++        limit = numAvailFull;
++
++      for (temp = 1; temp < limit && data[temp] == data2[temp]; temp++);
++      lenTest2 = temp - 1;
++      if (lenTest2 >= 2)
++      {
++        UInt32 state2 = kLiteralNextStates[state];
++        UInt32 posStateNext = (position + 1) & p->pbMask;
++        UInt32 nextRepMatchPrice = curAnd1Price +
++            GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++            GET_PRICE_1(p->isRep[state2]);
++        /* for (; lenTest2 >= 2; lenTest2--) */
++        {
++          UInt32 curAndLenPrice;
++          COptimal *opt;
++          UInt32 offset = cur + 1 + lenTest2;
++          while (lenEnd < offset)
++            p->opt[++lenEnd].price = kInfinityPrice;
++          curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++          opt = &p->opt[offset];
++          if (curAndLenPrice < opt->price)
++          {
++            opt->price = curAndLenPrice;
++            opt->posPrev = cur + 1;
++            opt->backPrev = 0;
++            opt->prev1IsChar = True;
++            opt->prev2 = False;
++          }
++        }
++      }
++    }
++    
++    startLen = 2; /* speed optimization */
++    {
++    UInt32 repIndex;
++    for (repIndex = 0; repIndex < LZMA_NUM_REPS; repIndex++)
++    {
++      UInt32 lenTest;
++      UInt32 lenTestTemp;
++      UInt32 price;
++      const Byte *data2 = data - (reps[repIndex] + 1);
++      if (data[0] != data2[0] || data[1] != data2[1])
++        continue;
++      for (lenTest = 2; lenTest < numAvail && data[lenTest] == data2[lenTest]; lenTest++);
++      while (lenEnd < cur + lenTest)
++        p->opt[++lenEnd].price = kInfinityPrice;
++      lenTestTemp = lenTest;
++      price = repMatchPrice + GetPureRepPrice(p, repIndex, state, posState);
++      do
++      {
++        UInt32 curAndLenPrice = price + p->repLenEnc.prices[posState][lenTest - 2];
++        COptimal *opt = &p->opt[cur + lenTest];
++        if (curAndLenPrice < opt->price)
++        {
++          opt->price = curAndLenPrice;
++          opt->posPrev = cur;
++          opt->backPrev = repIndex;
++          opt->prev1IsChar = False;
++        }
++      }
++      while (--lenTest >= 2);
++      lenTest = lenTestTemp;
++      
++      if (repIndex == 0)
++        startLen = lenTest + 1;
++        
++      /* if (_maxMode) */
++        {
++          UInt32 lenTest2 = lenTest + 1;
++          UInt32 limit = lenTest2 + p->numFastBytes;
++          UInt32 nextRepMatchPrice;
++          if (limit > numAvailFull)
++            limit = numAvailFull;
++          for (; lenTest2 < limit && data[lenTest2] == data2[lenTest2]; lenTest2++);
++          lenTest2 -= lenTest + 1;
++          if (lenTest2 >= 2)
++          {
++            UInt32 state2 = kRepNextStates[state];
++            UInt32 posStateNext = (position + lenTest) & p->pbMask;
++            UInt32 curAndLenCharPrice =
++                price + p->repLenEnc.prices[posState][lenTest - 2] +
++                GET_PRICE_0(p->isMatch[state2][posStateNext]) +
++                LitEnc_GetPriceMatched(LIT_PROBS(position + lenTest, data[lenTest - 1]),
++                    data[lenTest], data2[lenTest], p->ProbPrices);
++            state2 = kLiteralNextStates[state2];
++            posStateNext = (position + lenTest + 1) & p->pbMask;
++            nextRepMatchPrice = curAndLenCharPrice +
++                GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++                GET_PRICE_1(p->isRep[state2]);
++            
++            /* for (; lenTest2 >= 2; lenTest2--) */
++            {
++              UInt32 curAndLenPrice;
++              COptimal *opt;
++              UInt32 offset = cur + lenTest + 1 + lenTest2;
++              while (lenEnd < offset)
++                p->opt[++lenEnd].price = kInfinityPrice;
++              curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++              opt = &p->opt[offset];
++              if (curAndLenPrice < opt->price)
++              {
++                opt->price = curAndLenPrice;
++                opt->posPrev = cur + lenTest + 1;
++                opt->backPrev = 0;
++                opt->prev1IsChar = True;
++                opt->prev2 = True;
++                opt->posPrev2 = cur;
++                opt->backPrev2 = repIndex;
++              }
++            }
++          }
++        }
++    }
++    }
++    /* for (UInt32 lenTest = 2; lenTest <= newLen; lenTest++) */
++    if (newLen > numAvail)
++    {
++      newLen = numAvail;
++      for (numPairs = 0; newLen > matches[numPairs]; numPairs += 2);
++      matches[numPairs] = newLen;
++      numPairs += 2;
++    }
++    if (newLen >= startLen)
++    {
++      UInt32 normalMatchPrice = matchPrice + GET_PRICE_0(p->isRep[state]);
++      UInt32 offs, curBack, posSlot;
++      UInt32 lenTest;
++      while (lenEnd < cur + newLen)
++        p->opt[++lenEnd].price = kInfinityPrice;
++
++      offs = 0;
++      while (startLen > matches[offs])
++        offs += 2;
++      curBack = matches[offs + 1];
++      GetPosSlot2(curBack, posSlot);
++      for (lenTest = /*2*/ startLen; ; lenTest++)
++      {
++        UInt32 curAndLenPrice = normalMatchPrice + p->lenEnc.prices[posState][lenTest - LZMA_MATCH_LEN_MIN];
++        UInt32 lenToPosState = GetLenToPosState(lenTest);
++        COptimal *opt;
++        if (curBack < kNumFullDistances)
++          curAndLenPrice += p->distancesPrices[lenToPosState][curBack];
++        else
++          curAndLenPrice += p->posSlotPrices[lenToPosState][posSlot] + p->alignPrices[curBack & kAlignMask];
++        
++        opt = &p->opt[cur + lenTest];
++        if (curAndLenPrice < opt->price)
++        {
++          opt->price = curAndLenPrice;
++          opt->posPrev = cur;
++          opt->backPrev = curBack + LZMA_NUM_REPS;
++          opt->prev1IsChar = False;
++        }
++
++        if (/*_maxMode && */lenTest == matches[offs])
++        {
++          /* Try Match + Literal + Rep0 */
++          const Byte *data2 = data - (curBack + 1);
++          UInt32 lenTest2 = lenTest + 1;
++          UInt32 limit = lenTest2 + p->numFastBytes;
++          UInt32 nextRepMatchPrice;
++          if (limit > numAvailFull)
++            limit = numAvailFull;
++          for (; lenTest2 < limit && data[lenTest2] == data2[lenTest2]; lenTest2++);
++          lenTest2 -= lenTest + 1;
++          if (lenTest2 >= 2)
++          {
++            UInt32 state2 = kMatchNextStates[state];
++            UInt32 posStateNext = (position + lenTest) & p->pbMask;
++            UInt32 curAndLenCharPrice = curAndLenPrice +
++                GET_PRICE_0(p->isMatch[state2][posStateNext]) +
++                LitEnc_GetPriceMatched(LIT_PROBS(position + lenTest, data[lenTest - 1]),
++                    data[lenTest], data2[lenTest], p->ProbPrices);
++            state2 = kLiteralNextStates[state2];
++            posStateNext = (posStateNext + 1) & p->pbMask;
++            nextRepMatchPrice = curAndLenCharPrice +
++                GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++                GET_PRICE_1(p->isRep[state2]);
++            
++            /* for (; lenTest2 >= 2; lenTest2--) */
++            {
++              UInt32 offset = cur + lenTest + 1 + lenTest2;
++              UInt32 curAndLenPrice;
++              COptimal *opt;
++              while (lenEnd < offset)
++                p->opt[++lenEnd].price = kInfinityPrice;
++              curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++              opt = &p->opt[offset];
++              if (curAndLenPrice < opt->price)
++              {
++                opt->price = curAndLenPrice;
++                opt->posPrev = cur + lenTest + 1;
++                opt->backPrev = 0;
++                opt->prev1IsChar = True;
++                opt->prev2 = True;
++                opt->posPrev2 = cur;
++                opt->backPrev2 = curBack + LZMA_NUM_REPS;
++              }
++            }
++          }
++          offs += 2;
++          if (offs == numPairs)
++            break;
++          curBack = matches[offs + 1];
++          if (curBack >= kNumFullDistances)
++            GetPosSlot2(curBack, posSlot);
++        }
++      }
++    }
++  }
++}
++
++#define ChangePair(smallDist, bigDist) (((bigDist) >> 7) > (smallDist))
++
++static UInt32 GetOptimumFast(CLzmaEnc *p, UInt32 *backRes)
++{
++  UInt32 numAvail, mainLen, mainDist, numPairs, repIndex, repLen, i;
++  const Byte *data;
++  const UInt32 *matches;
++
++  if (p->additionalOffset == 0)
++    mainLen = ReadMatchDistances(p, &numPairs);
++  else
++  {
++    mainLen = p->longestMatchLength;
++    numPairs = p->numPairs;
++  }
++
++  numAvail = p->numAvail;
++  *backRes = (UInt32)-1;
++  if (numAvail < 2)
++    return 1;
++  if (numAvail > LZMA_MATCH_LEN_MAX)
++    numAvail = LZMA_MATCH_LEN_MAX;
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++
++  repLen = repIndex = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 len;
++    const Byte *data2 = data - (p->reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++      continue;
++    for (len = 2; len < numAvail && data[len] == data2[len]; len++);
++    if (len >= p->numFastBytes)
++    {
++      *backRes = i;
++      MovePos(p, len - 1);
++      return len;
++    }
++    if (len > repLen)
++    {
++      repIndex = i;
++      repLen = len;
++    }
++  }
++
++  matches = p->matches;
++  if (mainLen >= p->numFastBytes)
++  {
++    *backRes = matches[numPairs - 1] + LZMA_NUM_REPS;
++    MovePos(p, mainLen - 1);
++    return mainLen;
++  }
++
++  mainDist = 0; /* for GCC */
++  if (mainLen >= 2)
++  {
++    mainDist = matches[numPairs - 1];
++    while (numPairs > 2 && mainLen == matches[numPairs - 4] + 1)
++    {
++      if (!ChangePair(matches[numPairs - 3], mainDist))
++        break;
++      numPairs -= 2;
++      mainLen = matches[numPairs - 2];
++      mainDist = matches[numPairs - 1];
++    }
++    if (mainLen == 2 && mainDist >= 0x80)
++      mainLen = 1;
++  }
++
++  if (repLen >= 2 && (
++        (repLen + 1 >= mainLen) ||
++        (repLen + 2 >= mainLen && mainDist >= (1 << 9)) ||
++        (repLen + 3 >= mainLen && mainDist >= (1 << 15))))
++  {
++    *backRes = repIndex;
++    MovePos(p, repLen - 1);
++    return repLen;
++  }
++  
++  if (mainLen < 2 || numAvail <= 2)
++    return 1;
++
++  p->longestMatchLength = ReadMatchDistances(p, &p->numPairs);
++  if (p->longestMatchLength >= 2)
++  {
++    UInt32 newDistance = matches[p->numPairs - 1];
++    if ((p->longestMatchLength >= mainLen && newDistance < mainDist) ||
++        (p->longestMatchLength == mainLen + 1 && !ChangePair(mainDist, newDistance)) ||
++        (p->longestMatchLength > mainLen + 1) ||
++        (p->longestMatchLength + 1 >= mainLen && mainLen >= 3 && ChangePair(newDistance, mainDist)))
++      return 1;
++  }
++  
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 len, limit;
++    const Byte *data2 = data - (p->reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++      continue;
++    limit = mainLen - 1;
++    for (len = 2; len < limit && data[len] == data2[len]; len++);
++    if (len >= limit)
++      return 1;
++  }
++  *backRes = mainDist + LZMA_NUM_REPS;
++  MovePos(p, mainLen - 2);
++  return mainLen;
++}
++
++static void WriteEndMarker(CLzmaEnc *p, UInt32 posState)
++{
++  UInt32 len;
++  RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 1);
++  RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
++  p->state = kMatchNextStates[p->state];
++  len = LZMA_MATCH_LEN_MIN;
++  LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++  RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, (1 << kNumPosSlotBits) - 1);
++  RangeEnc_EncodeDirectBits(&p->rc, (((UInt32)1 << 30) - 1) >> kNumAlignBits, 30 - kNumAlignBits);
++  RcTree_ReverseEncode(&p->rc, p->posAlignEncoder, kNumAlignBits, kAlignMask);
++}
++
++static SRes CheckErrors(CLzmaEnc *p)
++{
++  if (p->result != SZ_OK)
++    return p->result;
++  if (p->rc.res != SZ_OK)
++    p->result = SZ_ERROR_WRITE;
++  if (p->matchFinderBase.result != SZ_OK)
++    p->result = SZ_ERROR_READ;
++  if (p->result != SZ_OK)
++    p->finished = True;
++  return p->result;
++}
++
++static SRes Flush(CLzmaEnc *p, UInt32 nowPos)
++{
++  /* ReleaseMFStream(); */
++  p->finished = True;
++  if (p->writeEndMark)
++    WriteEndMarker(p, nowPos & p->pbMask);
++  RangeEnc_FlushData(&p->rc);
++  RangeEnc_FlushStream(&p->rc);
++  return CheckErrors(p);
++}
++
++static void FillAlignPrices(CLzmaEnc *p)
++{
++  UInt32 i;
++  for (i = 0; i < kAlignTableSize; i++)
++    p->alignPrices[i] = RcTree_ReverseGetPrice(p->posAlignEncoder, kNumAlignBits, i, p->ProbPrices);
++  p->alignPriceCount = 0;
++}
++
++static void FillDistancesPrices(CLzmaEnc *p)
++{
++  UInt32 tempPrices[kNumFullDistances];
++  UInt32 i, lenToPosState;
++  for (i = kStartPosModelIndex; i < kNumFullDistances; i++)
++  {
++    UInt32 posSlot = GetPosSlot1(i);
++    UInt32 footerBits = ((posSlot >> 1) - 1);
++    UInt32 base = ((2 | (posSlot & 1)) << footerBits);
++    tempPrices[i] = RcTree_ReverseGetPrice(p->posEncoders + base - posSlot - 1, footerBits, i - base, p->ProbPrices);
++  }
++
++  for (lenToPosState = 0; lenToPosState < kNumLenToPosStates; lenToPosState++)
++  {
++    UInt32 posSlot;
++    const CLzmaProb *encoder = p->posSlotEncoder[lenToPosState];
++    UInt32 *posSlotPrices = p->posSlotPrices[lenToPosState];
++    for (posSlot = 0; posSlot < p->distTableSize; posSlot++)
++      posSlotPrices[posSlot] = RcTree_GetPrice(encoder, kNumPosSlotBits, posSlot, p->ProbPrices);
++    for (posSlot = kEndPosModelIndex; posSlot < p->distTableSize; posSlot++)
++      posSlotPrices[posSlot] += ((((posSlot >> 1) - 1) - kNumAlignBits) << kNumBitPriceShiftBits);
++
++    {
++      UInt32 *distancesPrices = p->distancesPrices[lenToPosState];
++      UInt32 i;
++      for (i = 0; i < kStartPosModelIndex; i++)
++        distancesPrices[i] = posSlotPrices[i];
++      for (; i < kNumFullDistances; i++)
++        distancesPrices[i] = posSlotPrices[GetPosSlot1(i)] + tempPrices[i];
++    }
++  }
++  p->matchPriceCount = 0;
++}
++
++void LzmaEnc_Construct(CLzmaEnc *p)
++{
++  RangeEnc_Construct(&p->rc);
++  MatchFinder_Construct(&p->matchFinderBase);
++  #ifndef _7ZIP_ST
++  MatchFinderMt_Construct(&p->matchFinderMt);
++  p->matchFinderMt.MatchFinder = &p->matchFinderBase;
++  #endif
++
++  {
++    CLzmaEncProps props;
++    LzmaEncProps_Init(&props);
++    LzmaEnc_SetProps(p, &props);
++  }
++
++  #ifndef LZMA_LOG_BSR
++  LzmaEnc_FastPosInit(p->g_FastPos);
++  #endif
++
++  LzmaEnc_InitPriceTables(p->ProbPrices);
++  p->litProbs = 0;
++  p->saveState.litProbs = 0;
++}
++
++CLzmaEncHandle LzmaEnc_Create(ISzAlloc *alloc)
++{
++  void *p;
++  p = alloc->Alloc(alloc, sizeof(CLzmaEnc));
++  if (p != 0)
++    LzmaEnc_Construct((CLzmaEnc *)p);
++  return p;
++}
++
++void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->litProbs);
++  alloc->Free(alloc, p->saveState.litProbs);
++  p->litProbs = 0;
++  p->saveState.litProbs = 0;
++}
++
++void LzmaEnc_Destruct(CLzmaEnc *p, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  #ifndef _7ZIP_ST
++  MatchFinderMt_Destruct(&p->matchFinderMt, allocBig);
++  #endif
++  MatchFinder_Free(&p->matchFinderBase, allocBig);
++  LzmaEnc_FreeLits(p, alloc);
++  RangeEnc_Free(&p->rc, alloc);
++}
++
++void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  LzmaEnc_Destruct((CLzmaEnc *)p, alloc, allocBig);
++  alloc->Free(alloc, p);
++}
++
++static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize, UInt32 maxUnpackSize)
++{
++  UInt32 nowPos32, startPos32;
++  if (p->needInit)
++  {
++    p->matchFinder.Init(p->matchFinderObj);
++    p->needInit = 0;
++  }
++
++  if (p->finished)
++    return p->result;
++  RINOK(CheckErrors(p));
++
++  nowPos32 = (UInt32)p->nowPos64;
++  startPos32 = nowPos32;
++
++  if (p->nowPos64 == 0)
++  {
++    UInt32 numPairs;
++    Byte curByte;
++    if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) == 0)
++      return Flush(p, nowPos32);
++    ReadMatchDistances(p, &numPairs);
++    RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][0], 0);
++    p->state = kLiteralNextStates[p->state];
++    curByte = p->matchFinder.GetIndexByte(p->matchFinderObj, 0 - p->additionalOffset);
++    LitEnc_Encode(&p->rc, p->litProbs, curByte);
++    p->additionalOffset--;
++    nowPos32++;
++  }
++
++  if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) != 0)
++  for (;;)
++  {
++    UInt32 pos, len, posState;
++
++    if (p->fastMode)
++      len = GetOptimumFast(p, &pos);
++    else
++      len = GetOptimum(p, nowPos32, &pos);
++
++    #ifdef SHOW_STAT2
++    printf("\n pos = %4X,   len = %d   pos = %d", nowPos32, len, pos);
++    #endif
++
++    posState = nowPos32 & p->pbMask;
++    if (len == 1 && pos == (UInt32)-1)
++    {
++      Byte curByte;
++      CLzmaProb *probs;
++      const Byte *data;
++
++      RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 0);
++      data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
++      curByte = *data;
++      probs = LIT_PROBS(nowPos32, *(data - 1));
++      if (IsCharState(p->state))
++        LitEnc_Encode(&p->rc, probs, curByte);
++      else
++        LitEnc_EncodeMatched(&p->rc, probs, curByte, *(data - p->reps[0] - 1));
++      p->state = kLiteralNextStates[p->state];
++    }
++    else
++    {
++      RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 1);
++      if (pos < LZMA_NUM_REPS)
++      {
++        RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 1);
++        if (pos == 0)
++        {
++          RangeEnc_EncodeBit(&p->rc, &p->isRepG0[p->state], 0);
++          RangeEnc_EncodeBit(&p->rc, &p->isRep0Long[p->state][posState], ((len == 1) ? 0 : 1));
++        }
++        else
++        {
++          UInt32 distance = p->reps[pos];
++          RangeEnc_EncodeBit(&p->rc, &p->isRepG0[p->state], 1);
++          if (pos == 1)
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG1[p->state], 0);
++          else
++          {
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG1[p->state], 1);
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG2[p->state], pos - 2);
++            if (pos == 3)
++              p->reps[3] = p->reps[2];
++            p->reps[2] = p->reps[1];
++          }
++          p->reps[1] = p->reps[0];
++          p->reps[0] = distance;
++        }
++        if (len == 1)
++          p->state = kShortRepNextStates[p->state];
++        else
++        {
++          LenEnc_Encode2(&p->repLenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++          p->state = kRepNextStates[p->state];
++        }
++      }
++      else
++      {
++        UInt32 posSlot;
++        RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
++        p->state = kMatchNextStates[p->state];
++        LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++        pos -= LZMA_NUM_REPS;
++        GetPosSlot(pos, posSlot);
++        RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, posSlot);
++        
++        if (posSlot >= kStartPosModelIndex)
++        {
++          UInt32 footerBits = ((posSlot >> 1) - 1);
++          UInt32 base = ((2 | (posSlot & 1)) << footerBits);
++          UInt32 posReduced = pos - base;
++
++          if (posSlot < kEndPosModelIndex)
++            RcTree_ReverseEncode(&p->rc, p->posEncoders + base - posSlot - 1, footerBits, posReduced);
++          else
++          {
++            RangeEnc_EncodeDirectBits(&p->rc, posReduced >> kNumAlignBits, footerBits - kNumAlignBits);
++            RcTree_ReverseEncode(&p->rc, p->posAlignEncoder, kNumAlignBits, posReduced & kAlignMask);
++            p->alignPriceCount++;
++          }
++        }
++        p->reps[3] = p->reps[2];
++        p->reps[2] = p->reps[1];
++        p->reps[1] = p->reps[0];
++        p->reps[0] = pos;
++        p->matchPriceCount++;
++      }
++    }
++    p->additionalOffset -= len;
++    nowPos32 += len;
++    if (p->additionalOffset == 0)
++    {
++      UInt32 processed;
++      if (!p->fastMode)
++      {
++        if (p->matchPriceCount >= (1 << 7))
++          FillDistancesPrices(p);
++        if (p->alignPriceCount >= kAlignTableSize)
++          FillAlignPrices(p);
++      }
++      if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) == 0)
++        break;
++      processed = nowPos32 - startPos32;
++      if (useLimits)
++      {
++        if (processed + kNumOpts + 300 >= maxUnpackSize ||
++            RangeEnc_GetProcessed(&p->rc) + kNumOpts * 2 >= maxPackSize)
++          break;
++      }
++      else if (processed >= (1 << 15))
++      {
++        p->nowPos64 += nowPos32 - startPos32;
++        return CheckErrors(p);
++      }
++    }
++  }
++  p->nowPos64 += nowPos32 - startPos32;
++  return Flush(p, nowPos32);
++}
++
++#define kBigHashDicLimit ((UInt32)1 << 24)
++
++static SRes LzmaEnc_Alloc(CLzmaEnc *p, UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  UInt32 beforeSize = kNumOpts;
++  Bool btMode;
++  if (!RangeEnc_Alloc(&p->rc, alloc))
++    return SZ_ERROR_MEM;
++  btMode = (p->matchFinderBase.btMode != 0);
++  #ifndef _7ZIP_ST
++  p->mtMode = (p->multiThread && !p->fastMode && btMode);
++  #endif
++
++  {
++    unsigned lclp = p->lc + p->lp;
++    if (p->litProbs == 0 || p->saveState.litProbs == 0 || p->lclp != lclp)
++    {
++      LzmaEnc_FreeLits(p, alloc);
++      p->litProbs = (CLzmaProb *)alloc->Alloc(alloc, (0x300 << lclp) * sizeof(CLzmaProb));
++      p->saveState.litProbs = (CLzmaProb *)alloc->Alloc(alloc, (0x300 << lclp) * sizeof(CLzmaProb));
++      if (p->litProbs == 0 || p->saveState.litProbs == 0)
++      {
++        LzmaEnc_FreeLits(p, alloc);
++        return SZ_ERROR_MEM;
++      }
++      p->lclp = lclp;
++    }
++  }
++
++  p->matchFinderBase.bigHash = (p->dictSize > kBigHashDicLimit);
++
++  if (beforeSize + p->dictSize < keepWindowSize)
++    beforeSize = keepWindowSize - p->dictSize;
++
++  #ifndef _7ZIP_ST
++  if (p->mtMode)
++  {
++    RINOK(MatchFinderMt_Create(&p->matchFinderMt, p->dictSize, beforeSize, p->numFastBytes, LZMA_MATCH_LEN_MAX, allocBig));
++    p->matchFinderObj = &p->matchFinderMt;
++    MatchFinderMt_CreateVTable(&p->matchFinderMt, &p->matchFinder);
++  }
++  else
++  #endif
++  {
++    if (!MatchFinder_Create(&p->matchFinderBase, p->dictSize, beforeSize, p->numFastBytes, LZMA_MATCH_LEN_MAX, allocBig))
++      return SZ_ERROR_MEM;
++    p->matchFinderObj = &p->matchFinderBase;
++    MatchFinder_CreateVTable(&p->matchFinderBase, &p->matchFinder);
++  }
++  return SZ_OK;
++}
++
++void LzmaEnc_Init(CLzmaEnc *p)
++{
++  UInt32 i;
++  p->state = 0;
++  for (i = 0 ; i < LZMA_NUM_REPS; i++)
++    p->reps[i] = 0;
++
++  RangeEnc_Init(&p->rc);
++
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    UInt32 j;
++    for (j = 0; j < LZMA_NUM_PB_STATES_MAX; j++)
++    {
++      p->isMatch[i][j] = kProbInitValue;
++      p->isRep0Long[i][j] = kProbInitValue;
++    }
++    p->isRep[i] = kProbInitValue;
++    p->isRepG0[i] = kProbInitValue;
++    p->isRepG1[i] = kProbInitValue;
++    p->isRepG2[i] = kProbInitValue;
++  }
++
++  {
++    UInt32 num = 0x300 << (p->lp + p->lc);
++    for (i = 0; i < num; i++)
++      p->litProbs[i] = kProbInitValue;
++  }
++
++  {
++    for (i = 0; i < kNumLenToPosStates; i++)
++    {
++      CLzmaProb *probs = p->posSlotEncoder[i];
++      UInt32 j;
++      for (j = 0; j < (1 << kNumPosSlotBits); j++)
++        probs[j] = kProbInitValue;
++    }
++  }
++  {
++    for (i = 0; i < kNumFullDistances - kEndPosModelIndex; i++)
++      p->posEncoders[i] = kProbInitValue;
++  }
++
++  LenEnc_Init(&p->lenEnc.p);
++  LenEnc_Init(&p->repLenEnc.p);
++
++  for (i = 0; i < (1 << kNumAlignBits); i++)
++    p->posAlignEncoder[i] = kProbInitValue;
++
++  p->optimumEndIndex = 0;
++  p->optimumCurrentIndex = 0;
++  p->additionalOffset = 0;
++
++  p->pbMask = (1 << p->pb) - 1;
++  p->lpMask = (1 << p->lp) - 1;
++}
++
++void LzmaEnc_InitPrices(CLzmaEnc *p)
++{
++  if (!p->fastMode)
++  {
++    FillDistancesPrices(p);
++    FillAlignPrices(p);
++  }
++
++  p->lenEnc.tableSize =
++  p->repLenEnc.tableSize =
++      p->numFastBytes + 1 - LZMA_MATCH_LEN_MIN;
++  LenPriceEnc_UpdateTables(&p->lenEnc, 1 << p->pb, p->ProbPrices);
++  LenPriceEnc_UpdateTables(&p->repLenEnc, 1 << p->pb, p->ProbPrices);
++}
++
++static SRes LzmaEnc_AllocAndInit(CLzmaEnc *p, UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  UInt32 i;
++  for (i = 0; i < (UInt32)kDicLogSizeMaxCompress; i++)
++    if (p->dictSize <= ((UInt32)1 << i))
++      break;
++  p->distTableSize = i * 2;
++
++  p->finished = False;
++  p->result = SZ_OK;
++  RINOK(LzmaEnc_Alloc(p, keepWindowSize, alloc, allocBig));
++  LzmaEnc_Init(p);
++  LzmaEnc_InitPrices(p);
++  p->nowPos64 = 0;
++  return SZ_OK;
++}
++
++static SRes LzmaEnc_Prepare(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  p->matchFinderBase.stream = inStream;
++  p->needInit = 1;
++  p->rc.outStream = outStream;
++  return LzmaEnc_AllocAndInit(p, 0, alloc, allocBig);
++}
++
++SRes LzmaEnc_PrepareForLzma2(CLzmaEncHandle pp,
++    ISeqInStream *inStream, UInt32 keepWindowSize,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  p->matchFinderBase.stream = inStream;
++  p->needInit = 1;
++  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
++}
++
++static void LzmaEnc_SetInputBuf(CLzmaEnc *p, const Byte *src, SizeT srcLen)
++{
++  p->matchFinderBase.directInput = 1;
++  p->matchFinderBase.bufferBase = (Byte *)src;
++  p->matchFinderBase.directInputRem = srcLen;
++}
++
++SRes LzmaEnc_MemPrepare(CLzmaEncHandle pp, const Byte *src, SizeT srcLen,
++    UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  LzmaEnc_SetInputBuf(p, src, srcLen);
++  p->needInit = 1;
++
++  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
++}
++
++void LzmaEnc_Finish(CLzmaEncHandle pp)
++{
++  #ifndef _7ZIP_ST
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  if (p->mtMode)
++    MatchFinderMt_ReleaseStream(&p->matchFinderMt);
++  #else
++  pp = pp;
++  #endif
++}
++
++typedef struct
++{
++  ISeqOutStream funcTable;
++  Byte *data;
++  SizeT rem;
++  Bool overflow;
++} CSeqOutStreamBuf;
++
++static size_t MyWrite(void *pp, const void *data, size_t size)
++{
++  CSeqOutStreamBuf *p = (CSeqOutStreamBuf *)pp;
++  if (p->rem < size)
++  {
++    size = p->rem;
++    p->overflow = True;
++  }
++  memcpy(p->data, data, size);
++  p->rem -= size;
++  p->data += size;
++  return size;
++}
++
++
++UInt32 LzmaEnc_GetNumAvailableBytes(CLzmaEncHandle pp)
++{
++  const CLzmaEnc *p = (CLzmaEnc *)pp;
++  return p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
++}
++
++const Byte *LzmaEnc_GetCurBuf(CLzmaEncHandle pp)
++{
++  const CLzmaEnc *p = (CLzmaEnc *)pp;
++  return p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
++}
++
++SRes LzmaEnc_CodeOneMemBlock(CLzmaEncHandle pp, Bool reInit,
++    Byte *dest, size_t *destLen, UInt32 desiredPackSize, UInt32 *unpackSize)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  UInt64 nowPos64;
++  SRes res;
++  CSeqOutStreamBuf outStream;
++
++  outStream.funcTable.Write = MyWrite;
++  outStream.data = dest;
++  outStream.rem = *destLen;
++  outStream.overflow = False;
++
++  p->writeEndMark = False;
++  p->finished = False;
++  p->result = SZ_OK;
++
++  if (reInit)
++    LzmaEnc_Init(p);
++  LzmaEnc_InitPrices(p);
++  nowPos64 = p->nowPos64;
++  RangeEnc_Init(&p->rc);
++  p->rc.outStream = &outStream.funcTable;
++
++  res = LzmaEnc_CodeOneBlock(p, True, desiredPackSize, *unpackSize);
++  
++  *unpackSize = (UInt32)(p->nowPos64 - nowPos64);
++  *destLen -= outStream.rem;
++  if (outStream.overflow)
++    return SZ_ERROR_OUTPUT_EOF;
++
++  return res;
++}
++
++static SRes LzmaEnc_Encode2(CLzmaEnc *p, ICompressProgress *progress)
++{
++  SRes res = SZ_OK;
++
++  #ifndef _7ZIP_ST
++  Byte allocaDummy[0x300];
++  int i = 0;
++  for (i = 0; i < 16; i++)
++    allocaDummy[i] = (Byte)i;
++  #endif
++
++  for (;;)
++  {
++    res = LzmaEnc_CodeOneBlock(p, False, 0, 0);
++    if (res != SZ_OK || p->finished != 0)
++      break;
++    if (progress != 0)
++    {
++      res = progress->Progress(progress, p->nowPos64, RangeEnc_GetProcessed(&p->rc));
++      if (res != SZ_OK)
++      {
++        res = SZ_ERROR_PROGRESS;
++        break;
++      }
++    }
++  }
++  LzmaEnc_Finish(p);
++  return res;
++}
++
++SRes LzmaEnc_Encode(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream, ICompressProgress *progress,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  RINOK(LzmaEnc_Prepare(pp, outStream, inStream, alloc, allocBig));
++  return LzmaEnc_Encode2((CLzmaEnc *)pp, progress);
++}
++
++SRes LzmaEnc_WriteProperties(CLzmaEncHandle pp, Byte *props, SizeT *size)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  int i;
++  UInt32 dictSize = p->dictSize;
++  if (*size < LZMA_PROPS_SIZE)
++    return SZ_ERROR_PARAM;
++  *size = LZMA_PROPS_SIZE;
++  props[0] = (Byte)((p->pb * 5 + p->lp) * 9 + p->lc);
++
++  for (i = 11; i <= 30; i++)
++  {
++    if (dictSize <= ((UInt32)2 << i))
++    {
++      dictSize = (2 << i);
++      break;
++    }
++    if (dictSize <= ((UInt32)3 << i))
++    {
++      dictSize = (3 << i);
++      break;
++    }
++  }
++
++  for (i = 0; i < 4; i++)
++    props[1 + i] = (Byte)(dictSize >> (8 * i));
++  return SZ_OK;
++}
++
++SRes LzmaEnc_MemEncode(CLzmaEncHandle pp, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  SRes res;
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++
++  CSeqOutStreamBuf outStream;
++
++  LzmaEnc_SetInputBuf(p, src, srcLen);
++
++  outStream.funcTable.Write = MyWrite;
++  outStream.data = dest;
++  outStream.rem = *destLen;
++  outStream.overflow = False;
++
++  p->writeEndMark = writeEndMark;
++
++  p->rc.outStream = &outStream.funcTable;
++  res = LzmaEnc_MemPrepare(pp, src, srcLen, 0, alloc, allocBig);
++  if (res == SZ_OK)
++    res = LzmaEnc_Encode2(p, progress);
++
++  *destLen -= outStream.rem;
++  if (outStream.overflow)
++    return SZ_ERROR_OUTPUT_EOF;
++  return res;
++}
++
++SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)LzmaEnc_Create(alloc);
++  SRes res;
++  if (p == 0)
++    return SZ_ERROR_MEM;
++
++  res = LzmaEnc_SetProps(p, props);
++  if (res == SZ_OK)
++  {
++    res = LzmaEnc_WriteProperties(p, propsEncoded, propsSize);
++    if (res == SZ_OK)
++      res = LzmaEnc_MemEncode(p, dest, destLen, src, srcLen,
++          writeEndMark, progress, alloc, allocBig);
++  }
++
++  LzmaEnc_Destroy(p, alloc, allocBig);
++  return res;
++}
+--- /dev/null
++++ b/lib/lzma/Makefile
+@@ -0,0 +1,7 @@
++lzma_compress-objs := LzFind.o LzmaEnc.o
++lzma_decompress-objs := LzmaDec.o
++
++obj-$(CONFIG_LZMA_COMPRESS) += lzma_compress.o
++obj-$(CONFIG_LZMA_DECOMPRESS) += lzma_decompress.o
++
++EXTRA_CFLAGS += -Iinclude/linux -Iinclude/linux/lzma -include types.h
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/531-debloat_lzma.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/531-debloat_lzma.patch.svn-base
new file mode 100644
index 0000000..1e41661
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/531-debloat_lzma.patch.svn-base
@@ -0,0 +1,485 @@
+--- a/include/linux/lzma/LzmaDec.h
++++ b/include/linux/lzma/LzmaDec.h
+@@ -31,14 +31,6 @@ typedef struct _CLzmaProps
+   UInt32 dicSize;
+ } CLzmaProps;
+ 
+-/* LzmaProps_Decode - decodes properties
+-Returns:
+-  SZ_OK
+-  SZ_ERROR_UNSUPPORTED - Unsupported properties
+-*/
+-
+-SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size);
+-
+ 
+ /* ---------- LZMA Decoder state ---------- */
+ 
+@@ -70,8 +62,6 @@ typedef struct
+ 
+ #define LzmaDec_Construct(p) { (p)->dic = 0; (p)->probs = 0; }
+ 
+-void LzmaDec_Init(CLzmaDec *p);
+-
+ /* There are two types of LZMA streams:
+      0) Stream with end mark. That end mark adds about 6 bytes to compressed size.
+      1) Stream without end mark. You must know exact uncompressed size to decompress such stream. */
+@@ -108,97 +98,6 @@ typedef enum
+ 
+ /* ELzmaStatus is used only as output value for function call */
+ 
+-
+-/* ---------- Interfaces ---------- */
+-
+-/* There are 3 levels of interfaces:
+-     1) Dictionary Interface
+-     2) Buffer Interface
+-     3) One Call Interface
+-   You can select any of these interfaces, but don't mix functions from different
+-   groups for same object. */
+-
+-
+-/* There are two variants to allocate state for Dictionary Interface:
+-     1) LzmaDec_Allocate / LzmaDec_Free
+-     2) LzmaDec_AllocateProbs / LzmaDec_FreeProbs
+-   You can use variant 2, if you set dictionary buffer manually.
+-   For Buffer Interface you must always use variant 1.
+-
+-LzmaDec_Allocate* can return:
+-  SZ_OK
+-  SZ_ERROR_MEM         - Memory allocation error
+-  SZ_ERROR_UNSUPPORTED - Unsupported properties
+-*/
+-   
+-SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc);
+-void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc);
+-
+-SRes LzmaDec_Allocate(CLzmaDec *state, const Byte *prop, unsigned propsSize, ISzAlloc *alloc);
+-void LzmaDec_Free(CLzmaDec *state, ISzAlloc *alloc);
+-
+-/* ---------- Dictionary Interface ---------- */
+-
+-/* You can use it, if you want to eliminate the overhead for data copying from
+-   dictionary to some other external buffer.
+-   You must work with CLzmaDec variables directly in this interface.
+-
+-   STEPS:
+-     LzmaDec_Constr()
+-     LzmaDec_Allocate()
+-     for (each new stream)
+-     {
+-       LzmaDec_Init()
+-       while (it needs more decompression)
+-       {
+-         LzmaDec_DecodeToDic()
+-         use data from CLzmaDec::dic and update CLzmaDec::dicPos
+-       }
+-     }
+-     LzmaDec_Free()
+-*/
+-
+-/* LzmaDec_DecodeToDic
+-   
+-   The decoding to internal dictionary buffer (CLzmaDec::dic).
+-   You must manually update CLzmaDec::dicPos, if it reaches CLzmaDec::dicBufSize !!!
+-
+-finishMode:
+-  It has meaning only if the decoding reaches output limit (dicLimit).
+-  LZMA_FINISH_ANY - Decode just dicLimit bytes.
+-  LZMA_FINISH_END - Stream must be finished after dicLimit.
+-
+-Returns:
+-  SZ_OK
+-    status:
+-      LZMA_STATUS_FINISHED_WITH_MARK
+-      LZMA_STATUS_NOT_FINISHED
+-      LZMA_STATUS_NEEDS_MORE_INPUT
+-      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
+-  SZ_ERROR_DATA - Data error
+-*/
+-
+-SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit,
+-    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
+-
+-
+-/* ---------- Buffer Interface ---------- */
+-
+-/* It's zlib-like interface.
+-   See LzmaDec_DecodeToDic description for information about STEPS and return results,
+-   but you must use LzmaDec_DecodeToBuf instead of LzmaDec_DecodeToDic and you don't need
+-   to work with CLzmaDec variables manually.
+-
+-finishMode:
+-  It has meaning only if the decoding reaches output limit (*destLen).
+-  LZMA_FINISH_ANY - Decode just destLen bytes.
+-  LZMA_FINISH_END - Stream must be finished after (*destLen).
+-*/
+-
+-SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen,
+-    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
+-
+-
+ /* ---------- One Call Interface ---------- */
+ 
+ /* LzmaDecode
+--- a/lib/lzma/LzmaDec.c
++++ b/lib/lzma/LzmaDec.c
+@@ -682,7 +682,7 @@ static void LzmaDec_InitRc(CLzmaDec *p,
+   p->needFlush = 0;
+ }
+ 
+-void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
++static void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
+ {
+   p->needFlush = 1;
+   p->remainLen = 0;
+@@ -698,7 +698,7 @@ void LzmaDec_InitDicAndState(CLzmaDec *p
+     p->needInitState = 1;
+ }
+ 
+-void LzmaDec_Init(CLzmaDec *p)
++static void LzmaDec_Init(CLzmaDec *p)
+ {
+   p->dicPos = 0;
+   LzmaDec_InitDicAndState(p, True, True);
+@@ -716,7 +716,7 @@ static void LzmaDec_InitStateReal(CLzmaD
+   p->needInitState = 0;
+ }
+ 
+-SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
++static SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
+     ELzmaFinishMode finishMode, ELzmaStatus *status)
+ {
+   SizeT inSize = *srcLen;
+@@ -837,7 +837,7 @@ SRes LzmaDec_DecodeToDic(CLzmaDec *p, Si
+   return (p->code == 0) ? SZ_OK : SZ_ERROR_DATA;
+ }
+ 
+-SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
++static __maybe_unused SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
+ {
+   SizeT outSize = *destLen;
+   SizeT inSize = *srcLen;
+@@ -877,7 +877,7 @@ SRes LzmaDec_DecodeToBuf(CLzmaDec *p, By
+   }
+ }
+ 
+-void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
++static void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
+ {
+   alloc->Free(alloc, p->probs);
+   p->probs = 0;
+@@ -889,13 +889,13 @@ static void LzmaDec_FreeDict(CLzmaDec *p
+   p->dic = 0;
+ }
+ 
+-void LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
++static void __maybe_unused LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
+ {
+   LzmaDec_FreeProbs(p, alloc);
+   LzmaDec_FreeDict(p, alloc);
+ }
+ 
+-SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
++static SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
+ {
+   UInt32 dicSize;
+   Byte d;
+@@ -935,7 +935,7 @@ static SRes LzmaDec_AllocateProbs2(CLzma
+   return SZ_OK;
+ }
+ 
+-SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++static SRes __maybe_unused LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
+ {
+   CLzmaProps propNew;
+   RINOK(LzmaProps_Decode(&propNew, props, propsSize));
+@@ -944,7 +944,7 @@ SRes LzmaDec_AllocateProbs(CLzmaDec *p,
+   return SZ_OK;
+ }
+ 
+-SRes LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++static SRes __maybe_unused LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
+ {
+   CLzmaProps propNew;
+   SizeT dicBufSize;
+--- a/include/linux/lzma/LzmaEnc.h
++++ b/include/linux/lzma/LzmaEnc.h
+@@ -31,9 +31,6 @@ typedef struct _CLzmaEncProps
+ } CLzmaEncProps;
+ 
+ void LzmaEncProps_Init(CLzmaEncProps *p);
+-void LzmaEncProps_Normalize(CLzmaEncProps *p);
+-UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2);
+-
+ 
+ /* ---------- CLzmaEncHandle Interface ---------- */
+ 
+@@ -53,26 +50,9 @@ CLzmaEncHandle LzmaEnc_Create(ISzAlloc *
+ void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig);
+ SRes LzmaEnc_SetProps(CLzmaEncHandle p, const CLzmaEncProps *props);
+ SRes LzmaEnc_WriteProperties(CLzmaEncHandle p, Byte *properties, SizeT *size);
+-SRes LzmaEnc_Encode(CLzmaEncHandle p, ISeqOutStream *outStream, ISeqInStream *inStream,
+-    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
+ SRes LzmaEnc_MemEncode(CLzmaEncHandle p, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
+     int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
+ 
+-/* ---------- One Call Interface ---------- */
+-
+-/* LzmaEncode
+-Return code:
+-  SZ_OK               - OK
+-  SZ_ERROR_MEM        - Memory allocation error
+-  SZ_ERROR_PARAM      - Incorrect paramater
+-  SZ_ERROR_OUTPUT_EOF - output buffer overflow
+-  SZ_ERROR_THREAD     - errors in multithreading functions (only for Mt version)
+-*/
+-
+-SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
+-    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
+-    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
+-
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/lib/lzma/LzmaEnc.c
++++ b/lib/lzma/LzmaEnc.c
+@@ -53,7 +53,7 @@ void LzmaEncProps_Init(CLzmaEncProps *p)
+   p->writeEndMark = 0;
+ }
+ 
+-void LzmaEncProps_Normalize(CLzmaEncProps *p)
++static void LzmaEncProps_Normalize(CLzmaEncProps *p)
+ {
+   int level = p->level;
+   if (level < 0) level = 5;
+@@ -76,7 +76,7 @@ void LzmaEncProps_Normalize(CLzmaEncProp
+       #endif
+ }
+ 
+-UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
++static UInt32 __maybe_unused LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
+ {
+   CLzmaEncProps props = *props2;
+   LzmaEncProps_Normalize(&props);
+@@ -93,7 +93,7 @@ UInt32 LzmaEncProps_GetDictSize(const CL
+ 
+ #define BSR2_RET(pos, res) { unsigned long i; _BitScanReverse(&i, (pos)); res = (i + i) + ((pos >> (i - 1)) & 1); }
+ 
+-UInt32 GetPosSlot1(UInt32 pos)
++static UInt32 GetPosSlot1(UInt32 pos)
+ {
+   UInt32 res;
+   BSR2_RET(pos, res);
+@@ -107,7 +107,7 @@ UInt32 GetPosSlot1(UInt32 pos)
+ #define kNumLogBits (9 + (int)sizeof(size_t) / 2)
+ #define kDicLogSizeMaxCompress ((kNumLogBits - 1) * 2 + 7)
+ 
+-void LzmaEnc_FastPosInit(Byte *g_FastPos)
++static void LzmaEnc_FastPosInit(Byte *g_FastPos)
+ {
+   int c = 2, slotFast;
+   g_FastPos[0] = 0;
+@@ -339,7 +339,7 @@ typedef struct
+   CSaveState saveState;
+ } CLzmaEnc;
+ 
+-void LzmaEnc_SaveState(CLzmaEncHandle pp)
++static void __maybe_unused LzmaEnc_SaveState(CLzmaEncHandle pp)
+ {
+   CLzmaEnc *p = (CLzmaEnc *)pp;
+   CSaveState *dest = &p->saveState;
+@@ -365,7 +365,7 @@ void LzmaEnc_SaveState(CLzmaEncHandle pp
+   memcpy(dest->litProbs, p->litProbs, (0x300 << p->lclp) * sizeof(CLzmaProb));
+ }
+ 
+-void LzmaEnc_RestoreState(CLzmaEncHandle pp)
++static void __maybe_unused LzmaEnc_RestoreState(CLzmaEncHandle pp)
+ {
+   CLzmaEnc *dest = (CLzmaEnc *)pp;
+   const CSaveState *p = &dest->saveState;
+@@ -600,7 +600,7 @@ static void LitEnc_EncodeMatched(CRangeE
+   while (symbol < 0x10000);
+ }
+ 
+-void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
++static void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
+ {
+   UInt32 i;
+   for (i = (1 << kNumMoveReducingBits) / 2; i < kBitModelTotal; i += (1 << kNumMoveReducingBits))
+@@ -1676,7 +1676,7 @@ static void FillDistancesPrices(CLzmaEnc
+   p->matchPriceCount = 0;
+ }
+ 
+-void LzmaEnc_Construct(CLzmaEnc *p)
++static void LzmaEnc_Construct(CLzmaEnc *p)
+ {
+   RangeEnc_Construct(&p->rc);
+   MatchFinder_Construct(&p->matchFinderBase);
+@@ -1709,7 +1709,7 @@ CLzmaEncHandle LzmaEnc_Create(ISzAlloc *
+   return p;
+ }
+ 
+-void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
++static void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
+ {
+   alloc->Free(alloc, p->litProbs);
+   alloc->Free(alloc, p->saveState.litProbs);
+@@ -2074,7 +2074,7 @@ SRes LzmaEnc_MemPrepare(CLzmaEncHandle p
+   return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
+ }
+ 
+-void LzmaEnc_Finish(CLzmaEncHandle pp)
++static void LzmaEnc_Finish(CLzmaEncHandle pp)
+ {
+   #ifndef _7ZIP_ST
+   CLzmaEnc *p = (CLzmaEnc *)pp;
+@@ -2108,7 +2108,7 @@ static size_t MyWrite(void *pp, const vo
+ }
+ 
+ 
+-UInt32 LzmaEnc_GetNumAvailableBytes(CLzmaEncHandle pp)
++static UInt32 __maybe_unused LzmaEnc_GetNumAvailableBytes(CLzmaEncHandle pp)
+ {
+   const CLzmaEnc *p = (CLzmaEnc *)pp;
+   return p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
+@@ -2120,7 +2120,7 @@ const Byte *LzmaEnc_GetCurBuf(CLzmaEncHa
+   return p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
+ }
+ 
+-SRes LzmaEnc_CodeOneMemBlock(CLzmaEncHandle pp, Bool reInit,
++static SRes __maybe_unused LzmaEnc_CodeOneMemBlock(CLzmaEncHandle pp, Bool reInit,
+     Byte *dest, size_t *destLen, UInt32 desiredPackSize, UInt32 *unpackSize)
+ {
+   CLzmaEnc *p = (CLzmaEnc *)pp;
+@@ -2248,7 +2248,7 @@ SRes LzmaEnc_MemEncode(CLzmaEncHandle pp
+   return res;
+ }
+ 
+-SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++static __maybe_unused SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
+     const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
+     ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
+ {
+--- a/include/linux/lzma/LzFind.h
++++ b/include/linux/lzma/LzFind.h
+@@ -55,11 +55,6 @@ typedef struct _CMatchFinder
+ 
+ #define Inline_MatchFinder_GetNumAvailableBytes(p) ((p)->streamPos - (p)->pos)
+ 
+-int MatchFinder_NeedMove(CMatchFinder *p);
+-Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p);
+-void MatchFinder_MoveBlock(CMatchFinder *p);
+-void MatchFinder_ReadIfRequired(CMatchFinder *p);
+-
+ void MatchFinder_Construct(CMatchFinder *p);
+ 
+ /* Conditions:
+@@ -70,12 +65,6 @@ int MatchFinder_Create(CMatchFinder *p,
+     UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
+     ISzAlloc *alloc);
+ void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc);
+-void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems);
+-void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue);
+-
+-UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *buffer, CLzRef *son,
+-    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 _cutValue,
+-    UInt32 *distances, UInt32 maxLen);
+ 
+ /*
+ Conditions:
+@@ -102,12 +91,6 @@ typedef struct _IMatchFinder
+ 
+ void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable);
+ 
+-void MatchFinder_Init(CMatchFinder *p);
+-UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
+-UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
+-void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
+-void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
+-
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/lib/lzma/LzFind.c
++++ b/lib/lzma/LzFind.c
+@@ -42,12 +42,12 @@ static int LzInWindow_Create(CMatchFinde
+   return (p->bufferBase != 0);
+ }
+ 
+-Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
+-Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
++static Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
++static Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
+ 
+-UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
++static UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
+ 
+-void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
++static void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
+ {
+   p->posLimit -= subValue;
+   p->pos -= subValue;
+@@ -268,7 +268,7 @@ static void MatchFinder_SetLimits(CMatch
+   p->posLimit = p->pos + limit;
+ }
+ 
+-void MatchFinder_Init(CMatchFinder *p)
++static void MatchFinder_Init(CMatchFinder *p)
+ {
+   UInt32 i;
+   for (i = 0; i < p->hashSizeSum; i++)
+@@ -287,7 +287,7 @@ static UInt32 MatchFinder_GetSubValue(CM
+   return (p->pos - p->historySize - 1) & kNormalizeMask;
+ }
+ 
+-void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
++static void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
+ {
+   UInt32 i;
+   for (i = 0; i < numItems; i++)
+@@ -350,7 +350,7 @@ static UInt32 * Hc_GetMatchesSpec(UInt32
+   }
+ }
+ 
+-UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++static UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
+     UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
+     UInt32 *distances, UInt32 maxLen)
+ {
+@@ -492,7 +492,7 @@ static UInt32 Bt2_MatchFinder_GetMatches
+   GET_MATCHES_FOOTER(offset, 1)
+ }
+ 
+-UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++static __maybe_unused UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
+ {
+   UInt32 offset;
+   GET_MATCHES_HEADER(3)
+@@ -632,7 +632,7 @@ static UInt32 Hc4_MatchFinder_GetMatches
+   MOVE_POS_RET
+ }
+ 
+-UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++static __maybe_unused UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
+ {
+   UInt32 offset;
+   GET_MATCHES_HEADER(3)
+@@ -657,7 +657,7 @@ static void Bt2_MatchFinder_Skip(CMatchF
+   while (--num != 0);
+ }
+ 
+-void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++static __maybe_unused void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
+ {
+   do
+   {
+@@ -718,7 +718,7 @@ static void Hc4_MatchFinder_Skip(CMatchF
+   while (--num != 0);
+ }
+ 
+-void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++static __maybe_unused void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
+ {
+   do
+   {
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/532-jffs2_eofdetect.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/532-jffs2_eofdetect.patch.svn-base
new file mode 100644
index 0000000..1fac6d1
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/532-jffs2_eofdetect.patch.svn-base
@@ -0,0 +1,132 @@
+--- a/fs/jffs2/build.c
++++ b/fs/jffs2/build.c
+@@ -112,6 +112,17 @@ static int jffs2_build_filesystem(struct
+ 	dbg_fsbuild("scanned flash completely\n");
+ 	jffs2_dbg_dump_block_lists_nolock(c);
+ 
++	if (c->flags & (1 << 7)) {
++		printk("%s(): unlocking the mtd device... ", __func__);
++		if (c->mtd->unlock)
++			c->mtd->unlock(c->mtd, 0, c->mtd->size);
++		printk("done.\n");
++
++		printk("%s(): erasing all blocks after the end marker... ", __func__);
++		jffs2_erase_pending_blocks(c, -1);
++		printk("done.\n");
++	}
++
+ 	dbg_fsbuild("pass 1 starting\n");
+ 	c->flags |= JFFS2_SB_FLAG_BUILDING;
+ 	/* Now scan the directory tree, increasing nlink according to every dirent found. */
+--- a/fs/jffs2/scan.c
++++ b/fs/jffs2/scan.c
+@@ -72,7 +72,7 @@ static int file_dirty(struct jffs2_sb_in
+ 		return ret;
+ 	if ((ret = jffs2_scan_dirty_space(c, jeb, jeb->free_size)))
+ 		return ret;
+-	/* Turned wasted size into dirty, since we apparently 
++	/* Turned wasted size into dirty, since we apparently
+ 	   think it's recoverable now. */
+ 	jeb->dirty_size += jeb->wasted_size;
+ 	c->dirty_size += jeb->wasted_size;
+@@ -147,8 +147,11 @@ int jffs2_scan_medium(struct jffs2_sb_in
+ 		/* reset summary info for next eraseblock scan */
+ 		jffs2_sum_reset_collected(s);
+ 
+-		ret = jffs2_scan_eraseblock(c, jeb, buf_size?flashbuf:(flashbuf+jeb->offset),
+-						buf_size, s);
++		if (c->flags & (1 << 7))
++			ret = BLK_STATE_ALLFF;
++		else
++			ret = jffs2_scan_eraseblock(c, jeb, buf_size?flashbuf:(flashbuf+jeb->offset),
++							buf_size, s);
+ 
+ 		if (ret < 0)
+ 			goto out;
+@@ -403,7 +406,7 @@ static int jffs2_scan_xref_node(struct j
+ 	if (!ref)
+ 		return -ENOMEM;
+ 
+-	/* BEFORE jffs2_build_xattr_subsystem() called, 
++	/* BEFORE jffs2_build_xattr_subsystem() called,
+ 	 * and AFTER xattr_ref is marked as a dead xref,
+ 	 * ref->xid is used to store 32bit xid, xd is not used
+ 	 * ref->ino is used to store 32bit inode-number, ic is not used
+@@ -476,7 +479,7 @@ static int jffs2_scan_eraseblock (struct
+ 		struct jffs2_sum_marker *sm;
+ 		void *sumptr = NULL;
+ 		uint32_t sumlen;
+-	      
++
+ 		if (!buf_size) {
+ 			/* XIP case. Just look, point at the summary if it's there */
+ 			sm = (void *)buf + c->sector_size - sizeof(*sm);
+@@ -492,9 +495,9 @@ static int jffs2_scan_eraseblock (struct
+ 				buf_len = sizeof(*sm);
+ 
+ 			/* Read as much as we want into the _end_ of the preallocated buffer */
+-			err = jffs2_fill_scan_buf(c, buf + buf_size - buf_len, 
++			err = jffs2_fill_scan_buf(c, buf + buf_size - buf_len,
+ 						  jeb->offset + c->sector_size - buf_len,
+-						  buf_len);				
++						  buf_len);
+ 			if (err)
+ 				return err;
+ 
+@@ -513,9 +516,9 @@ static int jffs2_scan_eraseblock (struct
+ 				}
+ 				if (buf_len < sumlen) {
+ 					/* Need to read more so that the entire summary node is present */
+-					err = jffs2_fill_scan_buf(c, sumptr, 
++					err = jffs2_fill_scan_buf(c, sumptr,
+ 								  jeb->offset + c->sector_size - sumlen,
+-								  sumlen - buf_len);				
++								  sumlen - buf_len);
+ 					if (err)
+ 						return err;
+ 				}
+@@ -528,7 +531,7 @@ static int jffs2_scan_eraseblock (struct
+ 
+ 			if (buf_size && sumlen > buf_size)
+ 				kfree(sumptr);
+-			/* If it returns with a real error, bail. 
++			/* If it returns with a real error, bail.
+ 			   If it returns positive, that's a block classification
+ 			   (i.e. BLK_STATE_xxx) so return that too.
+ 			   If it returns zero, fall through to full scan. */
+@@ -549,6 +552,17 @@ static int jffs2_scan_eraseblock (struct
+ 			return err;
+ 	}
+ 
++	if ((buf[0] == 0xde) &&
++		(buf[1] == 0xad) &&
++		(buf[2] == 0xc0) &&
++		(buf[3] == 0xde)) {
++		/* end of filesystem. erase everything after this point */
++		printk("%s(): End of filesystem marker found at 0x%x\n", __func__, jeb->offset);
++		c->flags |= (1 << 7);
++
++		return BLK_STATE_ALLFF;
++	}
++
+ 	/* We temporarily use 'ofs' as a pointer into the buffer/jeb */
+ 	ofs = 0;
+ 	max_ofs = EMPTY_SCAN_SIZE(c->sector_size);
+@@ -674,7 +688,7 @@ scan_more:
+ 				scan_end = buf_len;
+ 				goto more_empty;
+ 			}
+-			
++
+ 			/* See how much more there is to read in this eraseblock... */
+ 			buf_len = min_t(uint32_t, buf_size, jeb->offset + c->sector_size - ofs);
+ 			if (!buf_len) {
+@@ -910,7 +924,7 @@ scan_more:
+ 
+ 	D1(printk(KERN_DEBUG "Block at 0x%08x: free 0x%08x, dirty 0x%08x, unchecked 0x%08x, used 0x%08x, wasted 0x%08x\n",
+ 		  jeb->offset,jeb->free_size, jeb->dirty_size, jeb->unchecked_size, jeb->used_size, jeb->wasted_size));
+-	
++
+ 	/* mark_node_obsolete can add to wasted !! */
+ 	if (jeb->wasted_size) {
+ 		jeb->dirty_size += jeb->wasted_size;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/540-crypto-xz-decompression-support.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/540-crypto-xz-decompression-support.patch.svn-base
new file mode 100644
index 0000000..3b37007
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/540-crypto-xz-decompression-support.patch.svn-base
@@ -0,0 +1,146 @@
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -924,6 +924,13 @@ config CRYPTO_LZO
+ 	help
+ 	  This is the LZO algorithm.
+ 
++config CRYPTO_XZ
++	tristate "XZ compression algorithm"
++	select CRYPTO_ALGAPI
++	select XZ_DEC
++	help
++	  This is the XZ algorithm. Only decompression is supported for now.
++
+ comment "Random Number Generation"
+ 
+ config CRYPTO_ANSI_CPRNG
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -82,6 +82,7 @@ obj-$(CONFIG_CRYPTO_MICHAEL_MIC) += mich
+ obj-$(CONFIG_CRYPTO_CRC32C) += crc32c.o
+ obj-$(CONFIG_CRYPTO_AUTHENC) += authenc.o authencesn.o
+ obj-$(CONFIG_CRYPTO_LZO) += lzo.o
++obj-$(CONFIG_CRYPTO_XZ) += xz.o
+ obj-$(CONFIG_CRYPTO_RNG2) += rng.o
+ obj-$(CONFIG_CRYPTO_RNG2) += krng.o
+ obj-$(CONFIG_CRYPTO_ANSI_CPRNG) += ansi_cprng.o
+--- /dev/null
++++ b/crypto/xz.c
+@@ -0,0 +1,117 @@
++/*
++ * Cryptographic API.
++ *
++ * XZ decompression support.
++ *
++ * Copyright (c) 2012 Gabor Juhos <juhosg@openwrt.org>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ *
++ */
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/crypto.h>
++#include <linux/xz.h>
++#include <linux/interrupt.h>
++#include <linux/mm.h>
++#include <linux/net.h>
++
++struct xz_comp_ctx {
++	struct xz_dec	*decomp_state;
++	struct xz_buf	decomp_buf;
++};
++
++static int crypto_xz_decomp_init(struct xz_comp_ctx *ctx)
++{
++	ctx->decomp_state = xz_dec_init(XZ_SINGLE, 0);
++	if (!ctx->decomp_state)
++		return -ENOMEM;
++
++	return 0;
++}
++
++static void crypto_xz_decomp_exit(struct xz_comp_ctx *ctx)
++{
++	xz_dec_end(ctx->decomp_state);
++}
++
++static int crypto_xz_init(struct crypto_tfm *tfm)
++{
++	struct xz_comp_ctx *ctx = crypto_tfm_ctx(tfm);
++
++	return crypto_xz_decomp_init(ctx);
++}
++
++static void crypto_xz_exit(struct crypto_tfm *tfm)
++{
++	struct xz_comp_ctx *ctx = crypto_tfm_ctx(tfm);
++
++	crypto_xz_decomp_exit(ctx);
++}
++
++static int crypto_xz_compress(struct crypto_tfm *tfm, const u8 *src,
++			      unsigned int slen, u8 *dst, unsigned int *dlen)
++{
++	return -EOPNOTSUPP;
++}
++
++static int crypto_xz_decompress(struct crypto_tfm *tfm, const u8 *src,
++				unsigned int slen, u8 *dst, unsigned int *dlen)
++{
++	struct xz_comp_ctx *dctx = crypto_tfm_ctx(tfm);
++	struct xz_buf *xz_buf = &dctx->decomp_buf;
++	int ret;
++
++	memset(xz_buf, '\0', sizeof(struct xz_buf));
++
++	xz_buf->in = (u8 *) src;
++	xz_buf->in_pos = 0;
++	xz_buf->in_size = slen;
++	xz_buf->out = (u8 *) dst;
++	xz_buf->out_pos = 0;
++	xz_buf->out_size = *dlen;
++
++	ret = xz_dec_run(dctx->decomp_state, xz_buf);
++	if (ret != XZ_STREAM_END) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	*dlen = xz_buf->out_pos;
++	ret = 0;
++
++out:
++	return ret;
++}
++
++static struct crypto_alg crypto_xz_alg = {
++	.cra_name		= "xz",
++	.cra_flags		= CRYPTO_ALG_TYPE_COMPRESS,
++	.cra_ctxsize		= sizeof(struct xz_comp_ctx),
++	.cra_module		= THIS_MODULE,
++	.cra_list		= LIST_HEAD_INIT(crypto_xz_alg.cra_list),
++	.cra_init		= crypto_xz_init,
++	.cra_exit		= crypto_xz_exit,
++	.cra_u			= { .compress = {
++	.coa_compress 		= crypto_xz_compress,
++	.coa_decompress  	= crypto_xz_decompress } }
++};
++
++static int __init crypto_xz_mod_init(void)
++{
++	return crypto_register_alg(&crypto_xz_alg);
++}
++
++static void __exit crypto_xz_mod_exit(void)
++{
++	crypto_unregister_alg(&crypto_xz_alg);
++}
++
++module_init(crypto_xz_mod_init);
++module_exit(crypto_xz_mod_exit);
++
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("Crypto XZ decompression support");
++MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/541-ubifs-xz-decompression-support.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/541-ubifs-xz-decompression-support.patch.svn-base
new file mode 100644
index 0000000..3442d90
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/541-ubifs-xz-decompression-support.patch.svn-base
@@ -0,0 +1,94 @@
+--- a/fs/ubifs/Kconfig
++++ b/fs/ubifs/Kconfig
+@@ -5,8 +5,10 @@ config UBIFS_FS
+ 	select CRYPTO if UBIFS_FS_ADVANCED_COMPR
+ 	select CRYPTO if UBIFS_FS_LZO
+ 	select CRYPTO if UBIFS_FS_ZLIB
++	select CRYPTO if UBIFS_FS_XZ
+ 	select CRYPTO_LZO if UBIFS_FS_LZO
+ 	select CRYPTO_DEFLATE if UBIFS_FS_ZLIB
++	select CRYPTO_XZ if UBIFS_FS_XZ
+ 	depends on MTD_UBI
+ 	help
+ 	  UBIFS is a file system for flash devices which works on top of UBI.
+@@ -42,6 +44,14 @@ config UBIFS_FS_ZLIB
+ 	help
+ 	  Zlib compresses better than LZO but it is slower. Say 'Y' if unsure.
+ 
++config UBIFS_FS_XZ
++	bool "XZ decompression support" if UBIFS_FS_ADVANCED_COMPR
++	depends on UBIFS_FS
++	default y
++	help
++	  XZ compresses better the ZLIB but it is slower. 
++	  Say 'Y' if unsure.
++
+ # Debugging-related stuff
+ config UBIFS_FS_DEBUG
+ 	bool "Enable debugging support"
+--- a/fs/ubifs/compress.c
++++ b/fs/ubifs/compress.c
+@@ -71,6 +71,24 @@ static struct ubifs_compressor zlib_comp
+ };
+ #endif
+ 
++#ifdef CONFIG_UBIFS_FS_XZ
++static DEFINE_MUTEX(xz_enc_mutex);
++static DEFINE_MUTEX(xz_dec_mutex);
++
++static struct ubifs_compressor xz_compr = {
++	.compr_type = UBIFS_COMPR_XZ,
++	.comp_mutex = &xz_enc_mutex,
++	.decomp_mutex = &xz_dec_mutex,
++	.name = "xz",
++	.capi_name = "xz",
++};
++#else
++static struct ubifs_compressor xz_compr = {
++	.compr_type = UBIFS_COMPR_XZ,
++	.name = "xz",
++};
++#endif
++
+ /* All UBIFS compressors */
+ struct ubifs_compressor *ubifs_compressors[UBIFS_COMPR_TYPES_CNT];
+ 
+@@ -233,9 +251,15 @@ int __init ubifs_compressors_init(void)
+ 	if (err)
+ 		goto out_lzo;
+ 
++	err = compr_init(&xz_compr);
++	if (err)
++		goto out_zlib;
++
+ 	ubifs_compressors[UBIFS_COMPR_NONE] = &none_compr;
+ 	return 0;
+ 
++out_zlib:
++	compr_exit(&zlib_compr);
+ out_lzo:
+ 	compr_exit(&lzo_compr);
+ 	return err;
+@@ -248,4 +272,5 @@ void ubifs_compressors_exit(void)
+ {
+ 	compr_exit(&lzo_compr);
+ 	compr_exit(&zlib_compr);
++	compr_exit(&xz_compr);
+ }
+--- a/fs/ubifs/ubifs-media.h
++++ b/fs/ubifs/ubifs-media.h
+@@ -332,12 +332,14 @@ enum {
+  * UBIFS_COMPR_NONE: no compression
+  * UBIFS_COMPR_LZO: LZO compression
+  * UBIFS_COMPR_ZLIB: ZLIB compression
++ * UBIFS_COMPR_XZ: XZ compression
+  * UBIFS_COMPR_TYPES_CNT: count of supported compression types
+  */
+ enum {
+ 	UBIFS_COMPR_NONE,
+ 	UBIFS_COMPR_LZO,
+ 	UBIFS_COMPR_ZLIB,
++	UBIFS_COMPR_XZ,
+ 	UBIFS_COMPR_TYPES_CNT,
+ };
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/550-ubifs-symlink-xattr-support.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/550-ubifs-symlink-xattr-support.patch.svn-base
new file mode 100644
index 0000000..b0d818e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/550-ubifs-symlink-xattr-support.patch.svn-base
@@ -0,0 +1,67 @@
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -1575,6 +1575,12 @@ const struct inode_operations ubifs_syml
+ 	.follow_link = ubifs_follow_link,
+ 	.setattr     = ubifs_setattr,
+ 	.getattr     = ubifs_getattr,
++#ifdef CONFIG_UBIFS_FS_XATTR
++	.setxattr    = ubifs_setxattr,
++	.getxattr    = ubifs_getxattr,
++	.listxattr   = ubifs_listxattr,
++	.removexattr = ubifs_removexattr,
++#endif
+ };
+ 
+ const struct file_operations ubifs_file_operations = {
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -553,7 +553,8 @@ int ubifs_jnl_update(struct ubifs_info *
+ 
+ 	dbg_jnl("ino %lu, dent '%.*s', data len %d in dir ino %lu",
+ 		inode->i_ino, nm->len, nm->name, ui->data_len, dir->i_ino);
+-	ubifs_assert(dir_ui->data_len == 0);
++	if (!xent)
++		ubifs_assert(dir_ui->data_len == 0);
+ 	ubifs_assert(mutex_is_locked(&dir_ui->ui_mutex));
+ 
+ 	dlen = UBIFS_DENT_NODE_SZ + nm->len + 1;
+@@ -573,6 +574,13 @@ int ubifs_jnl_update(struct ubifs_info *
+ 	aligned_dlen = ALIGN(dlen, 8);
+ 	aligned_ilen = ALIGN(ilen, 8);
+ 	len = aligned_dlen + aligned_ilen + UBIFS_INO_NODE_SZ;
++	if (xent) {
++		/*
++		 * Make sure to account for dir_ui->data_len in
++		 * length calculation in case there is extended attribute.
++		 */
++		len += dir_ui->data_len;
++	}
+ 	dent = kmalloc(len, GFP_NOFS);
+ 	if (!dent)
+ 		return -ENOMEM;
+@@ -649,7 +657,8 @@ int ubifs_jnl_update(struct ubifs_info *
+ 
+ 	ino_key_init(c, &ino_key, dir->i_ino);
+ 	ino_offs += aligned_ilen;
+-	err = ubifs_tnc_add(c, &ino_key, lnum, ino_offs, UBIFS_INO_NODE_SZ);
++	err = ubifs_tnc_add(c, &ino_key, lnum, ino_offs,
++			    UBIFS_INO_NODE_SZ + dir_ui->data_len);
+ 	if (err)
+ 		goto out_ro;
+ 
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -209,12 +209,12 @@ static int change_xattr(struct ubifs_inf
+ 		goto out_free;
+ 	}
+ 	inode->i_size = ui->ui_size = size;
+-	ui->data_len = size;
+ 
+ 	mutex_lock(&host_ui->ui_mutex);
+ 	host->i_ctime = ubifs_current_time(host);
+ 	host_ui->xattr_size -= CALC_XATTR_BYTES(ui->data_len);
+ 	host_ui->xattr_size += CALC_XATTR_BYTES(size);
++	ui->data_len = size;
+ 
+ 	/*
+ 	 * It is important to write the host inode after the xattr inode
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/600-netfilter_layer7_2.22.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/600-netfilter_layer7_2.22.patch.svn-base
new file mode 100644
index 0000000..f305559
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/600-netfilter_layer7_2.22.patch.svn-base
@@ -0,0 +1,2142 @@
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -1053,6 +1053,27 @@ config NETFILTER_XT_MATCH_STATE
+ 
+ 	  To compile it as a module, choose M here.  If unsure, say N.
+ 
++config NETFILTER_XT_MATCH_LAYER7
++	tristate '"layer7" match support'
++	depends on NETFILTER_XTABLES
++	depends on EXPERIMENTAL && (IP_NF_CONNTRACK || NF_CONNTRACK)
++       depends on NETFILTER_ADVANCED
++	help
++	  Say Y if you want to be able to classify connections (and their
++	  packets) based on regular expression matching of their application
++	  layer data.   This is one way to classify applications such as
++	  peer-to-peer filesharing systems that do not always use the same
++	  port.
++
++	  To compile it as a module, choose M here.  If unsure, say N.
++
++config NETFILTER_XT_MATCH_LAYER7_DEBUG
++        bool 'Layer 7 debugging output'
++        depends on NETFILTER_XT_MATCH_LAYER7
++        help
++          Say Y to get lots of debugging output.
++
++
+ config NETFILTER_XT_MATCH_STATISTIC
+ 	tristate '"statistic" match support'
+ 	depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -105,6 +105,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_RECENT)
+ obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_SOCKET) += xt_socket.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o
++obj-$(CONFIG_NETFILTER_XT_MATCH_LAYER7) += xt_layer7.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) += xt_tcpmss.o
+--- /dev/null
++++ b/net/netfilter/xt_layer7.c
+@@ -0,0 +1,666 @@
++/*
++  Kernel module to match application layer (OSI layer 7) data in connections.
++
++  http://l7-filter.sf.net
++
++  (C) 2003-2009 Matthew Strait and Ethan Sommer.
++
++  This program is free software; you can redistribute it and/or
++  modify it under the terms of the GNU General Public License
++  as published by the Free Software Foundation; either version
++  2 of the License, or (at your option) any later version.
++  http://www.gnu.org/licenses/gpl.txt
++
++  Based on ipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>,
++  xt_helper.c (C) 2002 Harald Welte and cls_layer7.c (C) 2003 Matthew Strait,
++  Ethan Sommer, Justin Levandoski.
++*/
++
++#include <linux/spinlock.h>
++#include <linux/version.h>
++#include <net/ip.h>
++#include <net/tcp.h>
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter.h>
++#include <net/netfilter/nf_conntrack.h>
++#include <net/netfilter/nf_conntrack_core.h>
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
++#include <net/netfilter/nf_conntrack_extend.h>
++#include <net/netfilter/nf_conntrack_acct.h>
++#endif
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_layer7.h>
++#include <linux/ctype.h>
++#include <linux/proc_fs.h>
++
++#include "regexp/regexp.c"
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Matthew Strait <quadong@users.sf.net>, Ethan Sommer <sommere@users.sf.net>");
++MODULE_DESCRIPTION("iptables application layer match module");
++MODULE_ALIAS("ipt_layer7");
++MODULE_VERSION("2.21");
++
++static int maxdatalen = 2048; // this is the default
++module_param(maxdatalen, int, 0444);
++MODULE_PARM_DESC(maxdatalen, "maximum bytes of data looked at by l7-filter");
++#ifdef CONFIG_NETFILTER_XT_MATCH_LAYER7_DEBUG
++	#define DPRINTK(format,args...) printk(format,##args)
++#else
++	#define DPRINTK(format,args...)
++#endif
++
++/* Number of packets whose data we look at.
++This can be modified through /proc/net/layer7_numpackets */
++static int num_packets = 10;
++
++static struct pattern_cache {
++	char * regex_string;
++	regexp * pattern;
++	struct pattern_cache * next;
++} * first_pattern_cache = NULL;
++
++DEFINE_SPINLOCK(l7_lock);
++
++static int total_acct_packets(struct nf_conn *ct)
++{
++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 26)
++	BUG_ON(ct == NULL);
++	return (ct->counters[IP_CT_DIR_ORIGINAL].packets + ct->counters[IP_CT_DIR_REPLY].packets);
++#else
++	struct nf_conn_counter *acct;
++
++	BUG_ON(ct == NULL);
++	acct = nf_conn_acct_find(ct);
++	if (!acct)
++		return 0;
++	return (atomic64_read(&acct[IP_CT_DIR_ORIGINAL].packets) + atomic64_read(&acct[IP_CT_DIR_REPLY].packets));
++#endif
++}
++
++#ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG
++/* Converts an unfriendly string into a friendly one by
++replacing unprintables with periods and all whitespace with " ". */
++static char * friendly_print(unsigned char * s)
++{
++	char * f = kmalloc(strlen(s) + 1, GFP_ATOMIC);
++	int i;
++
++	if(!f) {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory in "
++					"friendly_print, bailing.\n");
++		return NULL;
++	}
++
++	for(i = 0; i < strlen(s); i++){
++		if(isprint(s[i]) && s[i] < 128)	f[i] = s[i];
++		else if(isspace(s[i]))		f[i] = ' ';
++		else 				f[i] = '.';
++	}
++	f[i] = '\0';
++	return f;
++}
++
++static char dec2hex(int i)
++{
++	switch (i) {
++		case 0 ... 9:
++			return (i + '0');
++			break;
++		case 10 ... 15:
++			return (i - 10 + 'a');
++			break;
++		default:
++			if (net_ratelimit())
++				printk("layer7: Problem in dec2hex\n");
++			return '\0';
++	}
++}
++
++static char * hex_print(unsigned char * s)
++{
++	char * g = kmalloc(strlen(s)*3 + 1, GFP_ATOMIC);
++	int i;
++
++	if(!g) {
++	       if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory in hex_print, "
++					"bailing.\n");
++	       return NULL;
++	}
++
++	for(i = 0; i < strlen(s); i++) {
++		g[i*3    ] = dec2hex(s[i]/16);
++		g[i*3 + 1] = dec2hex(s[i]%16);
++		g[i*3 + 2] = ' ';
++	}
++	g[i*3] = '\0';
++
++	return g;
++}
++#endif // DEBUG
++
++/* Use instead of regcomp.  As we expect to be seeing the same regexps over and
++over again, it make sense to cache the results. */
++static regexp * compile_and_cache(const char * regex_string, 
++                                  const char * protocol)
++{
++	struct pattern_cache * node               = first_pattern_cache;
++	struct pattern_cache * last_pattern_cache = first_pattern_cache;
++	struct pattern_cache * tmp;
++	unsigned int len;
++
++	while (node != NULL) {
++		if (!strcmp(node->regex_string, regex_string))
++		return node->pattern;
++
++		last_pattern_cache = node;/* points at the last non-NULL node */
++		node = node->next;
++	}
++
++	/* If we reach the end of the list, then we have not yet cached
++	   the pattern for this regex. Let's do that now.
++	   Be paranoid about running out of memory to avoid list corruption. */
++	tmp = kmalloc(sizeof(struct pattern_cache), GFP_ATOMIC);
++
++	if(!tmp) {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory in "
++					"compile_and_cache, bailing.\n");
++		return NULL;
++	}
++
++	tmp->regex_string  = kmalloc(strlen(regex_string) + 1, GFP_ATOMIC);
++	tmp->pattern       = kmalloc(sizeof(struct regexp),    GFP_ATOMIC);
++	tmp->next = NULL;
++
++	if(!tmp->regex_string || !tmp->pattern) {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory in "
++					"compile_and_cache, bailing.\n");
++		kfree(tmp->regex_string);
++		kfree(tmp->pattern);
++		kfree(tmp);
++		return NULL;
++	}
++
++	/* Ok.  The new node is all ready now. */
++	node = tmp;
++
++	if(first_pattern_cache == NULL) /* list is empty */
++		first_pattern_cache = node; /* make node the beginning */
++	else
++		last_pattern_cache->next = node; /* attach node to the end */
++
++	/* copy the string and compile the regex */
++	len = strlen(regex_string);
++	DPRINTK("About to compile this: \"%s\"\n", regex_string);
++	node->pattern = regcomp((char *)regex_string, &len);
++	if ( !node->pattern ) {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: Error compiling regexp "
++					"\"%s\" (%s)\n", 
++					regex_string, protocol);
++		/* pattern is now cached as NULL, so we won't try again. */
++	}
++
++	strcpy(node->regex_string, regex_string);
++	return node->pattern;
++}
++
++static int can_handle(const struct sk_buff *skb)
++{
++	if(!ip_hdr(skb)) /* not IP */
++		return 0;
++	if(ip_hdr(skb)->protocol != IPPROTO_TCP &&
++	   ip_hdr(skb)->protocol != IPPROTO_UDP &&
++	   ip_hdr(skb)->protocol != IPPROTO_ICMP)
++		return 0;
++	return 1;
++}
++
++/* Returns offset the into the skb->data that the application data starts */
++static int app_data_offset(const struct sk_buff *skb)
++{
++	/* In case we are ported somewhere (ebtables?) where ip_hdr(skb)
++	isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */
++	int ip_hl = 4*ip_hdr(skb)->ihl;
++
++	if( ip_hdr(skb)->protocol == IPPROTO_TCP ) {
++		/* 12 == offset into TCP header for the header length field.
++		Can't get this with skb->h.th->doff because the tcphdr
++		struct doesn't get set when routing (this is confirmed to be
++		true in Netfilter as well as QoS.) */
++		int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4);
++
++		return ip_hl + tcp_hl;
++	} else if( ip_hdr(skb)->protocol == IPPROTO_UDP  ) {
++		return ip_hl + 8; /* UDP header is always 8 bytes */
++	} else if( ip_hdr(skb)->protocol == IPPROTO_ICMP ) {
++		return ip_hl + 8; /* ICMP header is 8 bytes */
++	} else {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: tried to handle unknown "
++					"protocol!\n");
++		return ip_hl + 8; /* something reasonable */
++	}
++}
++
++/* handles whether there's a match when we aren't appending data anymore */
++static int match_no_append(struct nf_conn * conntrack, 
++                           struct nf_conn * master_conntrack, 
++                           enum ip_conntrack_info ctinfo,
++                           enum ip_conntrack_info master_ctinfo,
++                           const struct xt_layer7_info * info)
++{
++	/* If we're in here, throw the app data away */
++	if(master_conntrack->layer7.app_data != NULL) {
++
++	#ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG
++		if(!master_conntrack->layer7.app_proto) {
++			char * f = 
++			  friendly_print(master_conntrack->layer7.app_data);
++			char * g = 
++			  hex_print(master_conntrack->layer7.app_data);
++			DPRINTK("\nl7-filter gave up after %d bytes "
++				"(%d packets):\n%s\n",
++				strlen(f), total_acct_packets(master_conntrack), f);
++			kfree(f);
++			DPRINTK("In hex: %s\n", g);
++			kfree(g);
++		}
++	#endif
++
++		kfree(master_conntrack->layer7.app_data);
++		master_conntrack->layer7.app_data = NULL; /* don't free again */
++	}
++
++	if(master_conntrack->layer7.app_proto){
++		/* Here child connections set their .app_proto (for /proc) */
++		if(!conntrack->layer7.app_proto) {
++			conntrack->layer7.app_proto = 
++			  kmalloc(strlen(master_conntrack->layer7.app_proto)+1, 
++			    GFP_ATOMIC);
++			if(!conntrack->layer7.app_proto){
++				if (net_ratelimit())
++					printk(KERN_ERR "layer7: out of memory "
++							"in match_no_append, "
++							"bailing.\n");
++				return 1;
++			}
++			strcpy(conntrack->layer7.app_proto, 
++				master_conntrack->layer7.app_proto);
++		}
++
++		return (!strcmp(master_conntrack->layer7.app_proto, 
++				info->protocol));
++	}
++	else {
++		/* If not classified, set to "unknown" to distinguish from
++		connections that are still being tested. */
++		master_conntrack->layer7.app_proto = 
++			kmalloc(strlen("unknown")+1, GFP_ATOMIC);
++		if(!master_conntrack->layer7.app_proto){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: out of memory in "
++						"match_no_append, bailing.\n");
++			return 1;
++		}
++		strcpy(master_conntrack->layer7.app_proto, "unknown");
++		return 0;
++	}
++}
++
++/* add the new app data to the conntrack.  Return number of bytes added. */
++static int add_data(struct nf_conn * master_conntrack,
++                    char * app_data, int appdatalen)
++{
++	int length = 0, i;
++	int oldlength = master_conntrack->layer7.app_data_len;
++
++	/* This is a fix for a race condition by Deti Fliegl. However, I'm not 
++	   clear on whether the race condition exists or whether this really 
++	   fixes it.  I might just be being dense... Anyway, if it's not really 
++	   a fix, all it does is waste a very small amount of time. */
++	if(!master_conntrack->layer7.app_data) return 0;
++
++	/* Strip nulls. Make everything lower case (our regex lib doesn't
++	do case insensitivity).  Add it to the end of the current data. */
++	for(i = 0; i < maxdatalen-oldlength-1 &&
++		   i < appdatalen; i++) {
++		if(app_data[i] != '\0') {
++			/* the kernel version of tolower mungs 'upper ascii' */
++			master_conntrack->layer7.app_data[length+oldlength] =
++				isascii(app_data[i])? 
++					tolower(app_data[i]) : app_data[i];
++			length++;
++		}
++	}
++
++	master_conntrack->layer7.app_data[length+oldlength] = '\0';
++	master_conntrack->layer7.app_data_len = length + oldlength;
++
++	return length;
++}
++
++/* taken from drivers/video/modedb.c */
++static int my_atoi(const char *s)
++{
++	int val = 0;
++
++	for (;; s++) {
++		switch (*s) {
++			case '0'...'9':
++			val = 10*val+(*s-'0');
++			break;
++		default:
++			return val;
++		}
++	}
++}
++
++/* write out num_packets to userland. */
++static int layer7_read_proc(char* page, char ** start, off_t off, int count,
++                            int* eof, void * data)
++{
++	if(num_packets > 99 && net_ratelimit())
++		printk(KERN_ERR "layer7: NOT REACHED. num_packets too big\n");
++
++	page[0] = num_packets/10 + '0';
++	page[1] = num_packets%10 + '0';
++	page[2] = '\n';
++	page[3] = '\0';
++
++	*eof=1;
++
++	return 3;
++}
++
++/* Read in num_packets from userland */
++static int layer7_write_proc(struct file* file, const char* buffer,
++                             unsigned long count, void *data)
++{
++	char * foo = kmalloc(count, GFP_ATOMIC);
++
++	if(!foo){
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory, bailing. "
++					"num_packets unchanged.\n");
++		return count;
++	}
++
++	if(copy_from_user(foo, buffer, count)) {
++		return -EFAULT;
++	}
++
++
++	num_packets = my_atoi(foo);
++	kfree (foo);
++
++	/* This has an arbitrary limit to make the math easier. I'm lazy.
++	But anyway, 99 is a LOT! If you want more, you're doing it wrong! */
++	if(num_packets > 99) {
++		printk(KERN_WARNING "layer7: num_packets can't be > 99.\n");
++		num_packets = 99;
++	} else if(num_packets < 1) {
++		printk(KERN_WARNING "layer7: num_packets can't be < 1.\n");
++		num_packets = 1;
++	}
++
++	return count;
++}
++
++static bool
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++match(const struct sk_buff *skbin, const struct xt_match_param *par)
++#else
++match(const struct sk_buff *skbin,
++      const struct net_device *in,
++      const struct net_device *out,
++      const struct xt_match *match,
++      const void *matchinfo,
++      int offset,
++      unsigned int protoff,
++      bool *hotdrop)
++#endif
++{
++	/* sidestep const without getting a compiler warning... */
++	struct sk_buff * skb = (struct sk_buff *)skbin; 
++
++	const struct xt_layer7_info * info = 
++	#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++		par->matchinfo;
++	#else
++		matchinfo;
++	#endif
++
++	enum ip_conntrack_info master_ctinfo, ctinfo;
++	struct nf_conn *master_conntrack, *conntrack;
++	unsigned char * app_data;
++	unsigned int pattern_result, appdatalen;
++	regexp * comppattern;
++
++	/* Be paranoid/incompetent - lock the entire match function. */
++	spin_lock_bh(&l7_lock);
++
++	if(!can_handle(skb)){
++		DPRINTK("layer7: This is some protocol I can't handle.\n");
++		spin_unlock_bh(&l7_lock);
++		return info->invert;
++	}
++
++	/* Treat parent & all its children together as one connection, except
++	for the purpose of setting conntrack->layer7.app_proto in the actual
++	connection. This makes /proc/net/ip_conntrack more satisfying. */
++	if(!(conntrack = nf_ct_get(skb, &ctinfo)) ||
++	   !(master_conntrack=nf_ct_get(skb,&master_ctinfo))){
++		DPRINTK("layer7: couldn't get conntrack.\n");
++		spin_unlock_bh(&l7_lock);
++		return info->invert;
++	}
++
++	/* Try to get a master conntrack (and its master etc) for FTP, etc. */
++	while (master_ct(master_conntrack) != NULL)
++		master_conntrack = master_ct(master_conntrack);
++
++	/* if we've classified it or seen too many packets */
++	if(total_acct_packets(master_conntrack) > num_packets ||
++	   master_conntrack->layer7.app_proto) {
++
++		pattern_result = match_no_append(conntrack, master_conntrack, 
++						 ctinfo, master_ctinfo, info);
++
++		/* skb->cb[0] == seen. Don't do things twice if there are 
++		multiple l7 rules. I'm not sure that using cb for this purpose 
++		is correct, even though it says "put your private variables 
++		there". But it doesn't look like it is being used for anything
++		else in the skbs that make it here. */
++		skb->cb[0] = 1; /* marking it seen here's probably irrelevant */
++
++		spin_unlock_bh(&l7_lock);
++		return (pattern_result ^ info->invert);
++	}
++
++	if(skb_is_nonlinear(skb)){
++		if(skb_linearize(skb) != 0){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: failed to linearize "
++						"packet, bailing.\n");
++			spin_unlock_bh(&l7_lock);
++			return info->invert;
++		}
++	}
++
++	/* now that the skb is linearized, it's safe to set these. */
++	app_data = skb->data + app_data_offset(skb);
++	appdatalen = skb_tail_pointer(skb) - app_data;
++
++	/* the return value gets checked later, when we're ready to use it */
++	comppattern = compile_and_cache(info->pattern, info->protocol);
++
++	/* On the first packet of a connection, allocate space for app data */
++	if(total_acct_packets(master_conntrack) == 1 && !skb->cb[0] && 
++	   !master_conntrack->layer7.app_data){
++		master_conntrack->layer7.app_data = 
++			kmalloc(maxdatalen, GFP_ATOMIC);
++		if(!master_conntrack->layer7.app_data){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: out of memory in "
++						"match, bailing.\n");
++			spin_unlock_bh(&l7_lock);
++			return info->invert;
++		}
++
++		master_conntrack->layer7.app_data[0] = '\0';
++	}
++
++	/* Can be here, but unallocated, if numpackets is increased near
++	the beginning of a connection */
++	if(master_conntrack->layer7.app_data == NULL){
++		spin_unlock_bh(&l7_lock);
++		return info->invert; /* unmatched */
++	}
++
++	if(!skb->cb[0]){
++		int newbytes;
++		newbytes = add_data(master_conntrack, app_data, appdatalen);
++
++		if(newbytes == 0) { /* didn't add any data */
++			skb->cb[0] = 1;
++			/* Didn't match before, not going to match now */
++			spin_unlock_bh(&l7_lock);
++			return info->invert;
++		}
++	}
++
++	/* If looking for "unknown", then never match.  "Unknown" means that
++	we've given up; we're still trying with these packets. */
++	if(!strcmp(info->protocol, "unknown")) {
++		pattern_result = 0;
++	/* If looking for "unset", then always match. "Unset" means that we
++	haven't yet classified the connection. */
++	} else if(!strcmp(info->protocol, "unset")) {
++		pattern_result = 2;
++		DPRINTK("layer7: matched unset: not yet classified "
++			"(%d/%d packets)\n",
++                        total_acct_packets(master_conntrack), num_packets);
++	/* If the regexp failed to compile, don't bother running it */
++	} else if(comppattern && 
++		  regexec(comppattern, master_conntrack->layer7.app_data)){
++		DPRINTK("layer7: matched %s\n", info->protocol);
++		pattern_result = 1;
++	} else pattern_result = 0;
++
++	if(pattern_result == 1) {
++		master_conntrack->layer7.app_proto = 
++			kmalloc(strlen(info->protocol)+1, GFP_ATOMIC);
++		if(!master_conntrack->layer7.app_proto){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: out of memory in "
++						"match, bailing.\n");
++			spin_unlock_bh(&l7_lock);
++			return (pattern_result ^ info->invert);
++		}
++		strcpy(master_conntrack->layer7.app_proto, info->protocol);
++	} else if(pattern_result > 1) { /* cleanup from "unset" */
++		pattern_result = 1;
++	}
++
++	/* mark the packet seen */
++	skb->cb[0] = 1;
++
++	spin_unlock_bh(&l7_lock);
++	return (pattern_result ^ info->invert);
++}
++
++// load nf_conntrack_ipv4
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++static bool check(const struct xt_mtchk_param *par)
++{
++        if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
++                printk(KERN_WARNING "can't load conntrack support for "
++                                    "proto=%d\n", par->match->family);
++#else
++static bool check(const char *tablename, const void *inf,
++		 const struct xt_match *match, void *matchinfo,
++		 unsigned int hook_mask)
++{
++        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
++                printk(KERN_WARNING "can't load conntrack support for "
++                                    "proto=%d\n", match->family);
++#endif
++                return 0;
++        }
++	return 1;
++}
++
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++	static void destroy(const struct xt_mtdtor_param *par)
++	{
++		nf_ct_l3proto_module_put(par->match->family);
++	}
++#else
++	static void destroy(const struct xt_match *match, void *matchinfo)
++	{
++		nf_ct_l3proto_module_put(match->family);
++	}
++#endif
++
++static struct xt_match xt_layer7_match[] __read_mostly = {
++{
++	.name		= "layer7",
++	.family		= AF_INET,
++	.checkentry	= check,
++	.match		= match,
++	.destroy	= destroy,
++	.matchsize	= sizeof(struct xt_layer7_info),
++	.me		= THIS_MODULE
++}
++};
++
++static void layer7_cleanup_proc(void)
++{
++	remove_proc_entry("layer7_numpackets", init_net.proc_net);
++}
++
++/* register the proc file */
++static void layer7_init_proc(void)
++{
++	struct proc_dir_entry* entry;
++	entry = create_proc_entry("layer7_numpackets", 0644, init_net.proc_net);
++	entry->read_proc = layer7_read_proc;
++	entry->write_proc = layer7_write_proc;
++}
++
++static int __init xt_layer7_init(void)
++{
++	need_conntrack();
++
++	layer7_init_proc();
++	if(maxdatalen < 1) {
++		printk(KERN_WARNING "layer7: maxdatalen can't be < 1, "
++			"using 1\n");
++		maxdatalen = 1;
++	}
++	/* This is not a hard limit.  It's just here to prevent people from
++	bringing their slow machines to a grinding halt. */
++	else if(maxdatalen > 65536) {
++		printk(KERN_WARNING "layer7: maxdatalen can't be > 65536, "
++			"using 65536\n");
++		maxdatalen = 65536;
++	}
++	return xt_register_matches(xt_layer7_match,
++				   ARRAY_SIZE(xt_layer7_match));
++}
++
++static void __exit xt_layer7_fini(void)
++{
++	layer7_cleanup_proc();
++	xt_unregister_matches(xt_layer7_match, ARRAY_SIZE(xt_layer7_match));
++}
++
++module_init(xt_layer7_init);
++module_exit(xt_layer7_fini);
+--- /dev/null
++++ b/net/netfilter/regexp/regexp.c
+@@ -0,0 +1,1197 @@
++/*
++ * regcomp and regexec -- regsub and regerror are elsewhere
++ * @(#)regexp.c	1.3 of 18 April 87
++ *
++ *	Copyright (c) 1986 by University of Toronto.
++ *	Written by Henry Spencer.  Not derived from licensed software.
++ *
++ *	Permission is granted to anyone to use this software for any
++ *	purpose on any computer system, and to redistribute it freely,
++ *	subject to the following restrictions:
++ *
++ *	1. The author is not responsible for the consequences of use of
++ *		this software, no matter how awful, even if they arise
++ *		from defects in it.
++ *
++ *	2. The origin of this software must not be misrepresented, either
++ *		by explicit claim or by omission.
++ *
++ *	3. Altered versions must be plainly marked as such, and must not
++ *		be misrepresented as being the original software.
++ *
++ * Beware that some of this code is subtly aware of the way operator
++ * precedence is structured in regular expressions.  Serious changes in
++ * regular-expression syntax might require a total rethink.
++ *
++ * This code was modified by Ethan Sommer to work within the kernel
++ * (it now uses kmalloc etc..)
++ *
++ * Modified slightly by Matthew Strait to use more modern C.
++ */
++
++#include "regexp.h"
++#include "regmagic.h"
++
++/* added by ethan and matt.  Lets it work in both kernel and user space.
++(So iptables can use it, for instance.)  Yea, it goes both ways... */
++#if __KERNEL__
++  #define malloc(foo) kmalloc(foo,GFP_ATOMIC)
++#else
++  #define printk(format,args...) printf(format,##args)
++#endif
++
++void regerror(char * s)
++{
++        printk("<3>Regexp: %s\n", s);
++        /* NOTREACHED */
++}
++
++/*
++ * The "internal use only" fields in regexp.h are present to pass info from
++ * compile to execute that permits the execute phase to run lots faster on
++ * simple cases.  They are:
++ *
++ * regstart	char that must begin a match; '\0' if none obvious
++ * reganch	is the match anchored (at beginning-of-line only)?
++ * regmust	string (pointer into program) that match must include, or NULL
++ * regmlen	length of regmust string
++ *
++ * Regstart and reganch permit very fast decisions on suitable starting points
++ * for a match, cutting down the work a lot.  Regmust permits fast rejection
++ * of lines that cannot possibly match.  The regmust tests are costly enough
++ * that regcomp() supplies a regmust only if the r.e. contains something
++ * potentially expensive (at present, the only such thing detected is * or +
++ * at the start of the r.e., which can involve a lot of backup).  Regmlen is
++ * supplied because the test in regexec() needs it and regcomp() is computing
++ * it anyway.
++ */
++
++/*
++ * Structure for regexp "program".  This is essentially a linear encoding
++ * of a nondeterministic finite-state machine (aka syntax charts or
++ * "railroad normal form" in parsing technology).  Each node is an opcode
++ * plus a "next" pointer, possibly plus an operand.  "Next" pointers of
++ * all nodes except BRANCH implement concatenation; a "next" pointer with
++ * a BRANCH on both ends of it is connecting two alternatives.  (Here we
++ * have one of the subtle syntax dependencies:  an individual BRANCH (as
++ * opposed to a collection of them) is never concatenated with anything
++ * because of operator precedence.)  The operand of some types of node is
++ * a literal string; for others, it is a node leading into a sub-FSM.  In
++ * particular, the operand of a BRANCH node is the first node of the branch.
++ * (NB this is *not* a tree structure:  the tail of the branch connects
++ * to the thing following the set of BRANCHes.)  The opcodes are:
++ */
++
++/* definition	number	opnd?	meaning */
++#define	END	0	/* no	End of program. */
++#define	BOL	1	/* no	Match "" at beginning of line. */
++#define	EOL	2	/* no	Match "" at end of line. */
++#define	ANY	3	/* no	Match any one character. */
++#define	ANYOF	4	/* str	Match any character in this string. */
++#define	ANYBUT	5	/* str	Match any character not in this string. */
++#define	BRANCH	6	/* node	Match this alternative, or the next... */
++#define	BACK	7	/* no	Match "", "next" ptr points backward. */
++#define	EXACTLY	8	/* str	Match this string. */
++#define	NOTHING	9	/* no	Match empty string. */
++#define	STAR	10	/* node	Match this (simple) thing 0 or more times. */
++#define	PLUS	11	/* node	Match this (simple) thing 1 or more times. */
++#define	OPEN	20	/* no	Mark this point in input as start of #n. */
++			/*	OPEN+1 is number 1, etc. */
++#define	CLOSE	30	/* no	Analogous to OPEN. */
++
++/*
++ * Opcode notes:
++ *
++ * BRANCH	The set of branches constituting a single choice are hooked
++ *		together with their "next" pointers, since precedence prevents
++ *		anything being concatenated to any individual branch.  The
++ *		"next" pointer of the last BRANCH in a choice points to the
++ *		thing following the whole choice.  This is also where the
++ *		final "next" pointer of each individual branch points; each
++ *		branch starts with the operand node of a BRANCH node.
++ *
++ * BACK		Normal "next" pointers all implicitly point forward; BACK
++ *		exists to make loop structures possible.
++ *
++ * STAR,PLUS	'?', and complex '*' and '+', are implemented as circular
++ *		BRANCH structures using BACK.  Simple cases (one character
++ *		per match) are implemented with STAR and PLUS for speed
++ *		and to minimize recursive plunges.
++ *
++ * OPEN,CLOSE	...are numbered at compile time.
++ */
++
++/*
++ * A node is one char of opcode followed by two chars of "next" pointer.
++ * "Next" pointers are stored as two 8-bit pieces, high order first.  The
++ * value is a positive offset from the opcode of the node containing it.
++ * An operand, if any, simply follows the node.  (Note that much of the
++ * code generation knows about this implicit relationship.)
++ *
++ * Using two bytes for the "next" pointer is vast overkill for most things,
++ * but allows patterns to get big without disasters.
++ */
++#define	OP(p)	(*(p))
++#define	NEXT(p)	(((*((p)+1)&0377)<<8) + (*((p)+2)&0377))
++#define	OPERAND(p)	((p) + 3)
++
++/*
++ * See regmagic.h for one further detail of program structure.
++ */
++
++
++/*
++ * Utility definitions.
++ */
++#ifndef CHARBITS
++#define	UCHARAT(p)	((int)*(unsigned char *)(p))
++#else
++#define	UCHARAT(p)	((int)*(p)&CHARBITS)
++#endif
++
++#define	FAIL(m)	{ regerror(m); return(NULL); }
++#define	ISMULT(c)	((c) == '*' || (c) == '+' || (c) == '?')
++#define	META	"^$.[()|?+*\\"
++
++/*
++ * Flags to be passed up and down.
++ */
++#define	HASWIDTH	01	/* Known never to match null string. */
++#define	SIMPLE		02	/* Simple enough to be STAR/PLUS operand. */
++#define	SPSTART		04	/* Starts with * or +. */
++#define	WORST		0	/* Worst case. */
++
++/*
++ * Global work variables for regcomp().
++ */
++struct match_globals {
++char *reginput;		/* String-input pointer. */
++char *regbol;		/* Beginning of input, for ^ check. */
++char **regstartp;	/* Pointer to startp array. */
++char **regendp;		/* Ditto for endp. */
++char *regparse;		/* Input-scan pointer. */
++int regnpar;		/* () count. */
++char regdummy;
++char *regcode;		/* Code-emit pointer; &regdummy = don't. */
++long regsize;		/* Code size. */
++};
++
++/*
++ * Forward declarations for regcomp()'s friends.
++ */
++#ifndef STATIC
++#define	STATIC	static
++#endif
++STATIC char *reg(struct match_globals *g, int paren,int *flagp);
++STATIC char *regbranch(struct match_globals *g, int *flagp);
++STATIC char *regpiece(struct match_globals *g, int *flagp);
++STATIC char *regatom(struct match_globals *g, int *flagp);
++STATIC char *regnode(struct match_globals *g, char op);
++STATIC char *regnext(struct match_globals *g, char *p);
++STATIC void regc(struct match_globals *g, char b);
++STATIC void reginsert(struct match_globals *g, char op, char *opnd);
++STATIC void regtail(struct match_globals *g, char *p, char *val);
++STATIC void regoptail(struct match_globals *g, char *p, char *val);
++
++
++__kernel_size_t my_strcspn(const char *s1,const char *s2)
++{
++        char *scan1;
++        char *scan2;
++        int count;
++
++        count = 0;
++        for (scan1 = (char *)s1; *scan1 != '\0'; scan1++) {
++                for (scan2 = (char *)s2; *scan2 != '\0';)       /* ++ moved down. */
++                        if (*scan1 == *scan2++)
++                                return(count);
++                count++;
++        }
++        return(count);
++}
++
++/*
++ - regcomp - compile a regular expression into internal code
++ *
++ * We can't allocate space until we know how big the compiled form will be,
++ * but we can't compile it (and thus know how big it is) until we've got a
++ * place to put the code.  So we cheat:  we compile it twice, once with code
++ * generation turned off and size counting turned on, and once "for real".
++ * This also means that we don't allocate space until we are sure that the
++ * thing really will compile successfully, and we never have to move the
++ * code and thus invalidate pointers into it.  (Note that it has to be in
++ * one piece because free() must be able to free it all.)
++ *
++ * Beware that the optimization-preparation code in here knows about some
++ * of the structure of the compiled regexp.
++ */
++regexp *
++regcomp(char *exp,int *patternsize)
++{
++	register regexp *r;
++	register char *scan;
++	register char *longest;
++	register int len;
++	int flags;
++	struct match_globals g;
++	
++	/* commented out by ethan
++	   extern char *malloc();
++	*/
++
++	if (exp == NULL)
++		FAIL("NULL argument");
++
++	/* First pass: determine size, legality. */
++	g.regparse = exp;
++	g.regnpar = 1;
++	g.regsize = 0L;
++	g.regcode = &g.regdummy;
++	regc(&g, MAGIC);
++	if (reg(&g, 0, &flags) == NULL)
++		return(NULL);
++
++	/* Small enough for pointer-storage convention? */
++	if (g.regsize >= 32767L)		/* Probably could be 65535L. */
++		FAIL("regexp too big");
++
++	/* Allocate space. */
++	*patternsize=sizeof(regexp) + (unsigned)g.regsize;
++	r = (regexp *)malloc(sizeof(regexp) + (unsigned)g.regsize);
++	if (r == NULL)
++		FAIL("out of space");
++
++	/* Second pass: emit code. */
++	g.regparse = exp;
++	g.regnpar = 1;
++	g.regcode = r->program;
++	regc(&g, MAGIC);
++	if (reg(&g, 0, &flags) == NULL)
++		return(NULL);
++
++	/* Dig out information for optimizations. */
++	r->regstart = '\0';	/* Worst-case defaults. */
++	r->reganch = 0;
++	r->regmust = NULL;
++	r->regmlen = 0;
++	scan = r->program+1;			/* First BRANCH. */
++	if (OP(regnext(&g, scan)) == END) {		/* Only one top-level choice. */
++		scan = OPERAND(scan);
++
++		/* Starting-point info. */
++		if (OP(scan) == EXACTLY)
++			r->regstart = *OPERAND(scan);
++		else if (OP(scan) == BOL)
++			r->reganch++;
++
++		/*
++		 * If there's something expensive in the r.e., find the
++		 * longest literal string that must appear and make it the
++		 * regmust.  Resolve ties in favor of later strings, since
++		 * the regstart check works with the beginning of the r.e.
++		 * and avoiding duplication strengthens checking.  Not a
++		 * strong reason, but sufficient in the absence of others.
++		 */
++		if (flags&SPSTART) {
++			longest = NULL;
++			len = 0;
++			for (; scan != NULL; scan = regnext(&g, scan))
++				if (OP(scan) == EXACTLY && strlen(OPERAND(scan)) >= len) {
++					longest = OPERAND(scan);
++					len = strlen(OPERAND(scan));
++				}
++			r->regmust = longest;
++			r->regmlen = len;
++		}
++	}
++
++	return(r);
++}
++
++/*
++ - reg - regular expression, i.e. main body or parenthesized thing
++ *
++ * Caller must absorb opening parenthesis.
++ *
++ * Combining parenthesis handling with the base level of regular expression
++ * is a trifle forced, but the need to tie the tails of the branches to what
++ * follows makes it hard to avoid.
++ */
++static char *
++reg(struct match_globals *g, int paren, int *flagp /* Parenthesized? */ )
++{
++	register char *ret;
++	register char *br;
++	register char *ender;
++	register int parno = 0; /* 0 makes gcc happy */
++	int flags;
++
++	*flagp = HASWIDTH;	/* Tentatively. */
++
++	/* Make an OPEN node, if parenthesized. */
++	if (paren) {
++		if (g->regnpar >= NSUBEXP)
++			FAIL("too many ()");
++		parno = g->regnpar;
++		g->regnpar++;
++		ret = regnode(g, OPEN+parno);
++	} else
++		ret = NULL;
++
++	/* Pick up the branches, linking them together. */
++	br = regbranch(g, &flags);
++	if (br == NULL)
++		return(NULL);
++	if (ret != NULL)
++		regtail(g, ret, br);	/* OPEN -> first. */
++	else
++		ret = br;
++	if (!(flags&HASWIDTH))
++		*flagp &= ~HASWIDTH;
++	*flagp |= flags&SPSTART;
++	while (*g->regparse == '|') {
++		g->regparse++;
++		br = regbranch(g, &flags);
++		if (br == NULL)
++			return(NULL);
++		regtail(g, ret, br);	/* BRANCH -> BRANCH. */
++		if (!(flags&HASWIDTH))
++			*flagp &= ~HASWIDTH;
++		*flagp |= flags&SPSTART;
++	}
++
++	/* Make a closing node, and hook it on the end. */
++	ender = regnode(g, (paren) ? CLOSE+parno : END);	
++	regtail(g, ret, ender);
++
++	/* Hook the tails of the branches to the closing node. */
++	for (br = ret; br != NULL; br = regnext(g, br))
++		regoptail(g, br, ender);
++
++	/* Check for proper termination. */
++	if (paren && *g->regparse++ != ')') {
++		FAIL("unmatched ()");
++	} else if (!paren && *g->regparse != '\0') {
++		if (*g->regparse == ')') {
++			FAIL("unmatched ()");
++		} else
++			FAIL("junk on end");	/* "Can't happen". */
++		/* NOTREACHED */
++	}
++
++	return(ret);
++}
++
++/*
++ - regbranch - one alternative of an | operator
++ *
++ * Implements the concatenation operator.
++ */
++static char *
++regbranch(struct match_globals *g, int *flagp)
++{
++	register char *ret;
++	register char *chain;
++	register char *latest;
++	int flags;
++
++	*flagp = WORST;		/* Tentatively. */
++
++	ret = regnode(g, BRANCH);
++	chain = NULL;
++	while (*g->regparse != '\0' && *g->regparse != '|' && *g->regparse != ')') {
++		latest = regpiece(g, &flags);
++		if (latest == NULL)
++			return(NULL);
++		*flagp |= flags&HASWIDTH;
++		if (chain == NULL)	/* First piece. */
++			*flagp |= flags&SPSTART;
++		else
++			regtail(g, chain, latest);
++		chain = latest;
++	}
++	if (chain == NULL)	/* Loop ran zero times. */
++		(void) regnode(g, NOTHING);
++
++	return(ret);
++}
++
++/*
++ - regpiece - something followed by possible [*+?]
++ *
++ * Note that the branching code sequences used for ? and the general cases
++ * of * and + are somewhat optimized:  they use the same NOTHING node as
++ * both the endmarker for their branch list and the body of the last branch.
++ * It might seem that this node could be dispensed with entirely, but the
++ * endmarker role is not redundant.
++ */
++static char *
++regpiece(struct match_globals *g, int *flagp)
++{
++	register char *ret;
++	register char op;
++	register char *next;
++	int flags;
++
++	ret = regatom(g, &flags);
++	if (ret == NULL)
++		return(NULL);
++
++	op = *g->regparse;
++	if (!ISMULT(op)) {
++		*flagp = flags;
++		return(ret);
++	}
++
++	if (!(flags&HASWIDTH) && op != '?')
++		FAIL("*+ operand could be empty");
++	*flagp = (op != '+') ? (WORST|SPSTART) : (WORST|HASWIDTH);
++
++	if (op == '*' && (flags&SIMPLE))
++		reginsert(g, STAR, ret);
++	else if (op == '*') {
++		/* Emit x* as (x&|), where & means "self". */
++		reginsert(g, BRANCH, ret);			/* Either x */
++		regoptail(g, ret, regnode(g, BACK));		/* and loop */
++		regoptail(g, ret, ret);			/* back */
++		regtail(g, ret, regnode(g, BRANCH));		/* or */
++		regtail(g, ret, regnode(g, NOTHING));		/* null. */
++	} else if (op == '+' && (flags&SIMPLE))
++		reginsert(g, PLUS, ret);
++	else if (op == '+') {
++		/* Emit x+ as x(&|), where & means "self". */
++		next = regnode(g, BRANCH);			/* Either */
++		regtail(g, ret, next);
++		regtail(g, regnode(g, BACK), ret);		/* loop back */
++		regtail(g, next, regnode(g, BRANCH));		/* or */
++		regtail(g, ret, regnode(g, NOTHING));		/* null. */
++	} else if (op == '?') {
++		/* Emit x? as (x|) */
++		reginsert(g, BRANCH, ret);			/* Either x */
++		regtail(g, ret, regnode(g, BRANCH));		/* or */
++		next = regnode(g, NOTHING);		/* null. */
++		regtail(g, ret, next);
++		regoptail(g, ret, next);
++	}
++	g->regparse++;
++	if (ISMULT(*g->regparse))
++		FAIL("nested *?+");
++
++	return(ret);
++}
++
++/*
++ - regatom - the lowest level
++ *
++ * Optimization:  gobbles an entire sequence of ordinary characters so that
++ * it can turn them into a single node, which is smaller to store and
++ * faster to run.  Backslashed characters are exceptions, each becoming a
++ * separate node; the code is simpler that way and it's not worth fixing.
++ */
++static char *
++regatom(struct match_globals *g, int *flagp)
++{
++	register char *ret;
++	int flags;
++
++	*flagp = WORST;		/* Tentatively. */
++
++	switch (*g->regparse++) {
++	case '^':
++		ret = regnode(g, BOL);
++		break;
++	case '$':
++		ret = regnode(g, EOL);
++		break;
++	case '.':
++		ret = regnode(g, ANY);
++		*flagp |= HASWIDTH|SIMPLE;
++		break;
++	case '[': {
++			register int class;
++			register int classend;
++
++			if (*g->regparse == '^') {	/* Complement of range. */
++				ret = regnode(g, ANYBUT);
++				g->regparse++;
++			} else
++				ret = regnode(g, ANYOF);
++			if (*g->regparse == ']' || *g->regparse == '-')
++				regc(g, *g->regparse++);
++			while (*g->regparse != '\0' && *g->regparse != ']') {
++				if (*g->regparse == '-') {
++					g->regparse++;
++					if (*g->regparse == ']' || *g->regparse == '\0')
++						regc(g, '-');
++					else {
++						class = UCHARAT(g->regparse-2)+1;
++						classend = UCHARAT(g->regparse);
++						if (class > classend+1)
++							FAIL("invalid [] range");
++						for (; class <= classend; class++)
++							regc(g, class);
++						g->regparse++;
++					}
++				} else
++					regc(g, *g->regparse++);
++			}
++			regc(g, '\0');
++			if (*g->regparse != ']')
++				FAIL("unmatched []");
++			g->regparse++;
++			*flagp |= HASWIDTH|SIMPLE;
++		}
++		break;
++	case '(':
++		ret = reg(g, 1, &flags);
++		if (ret == NULL)
++			return(NULL);
++		*flagp |= flags&(HASWIDTH|SPSTART);
++		break;
++	case '\0':
++	case '|':
++	case ')':
++		FAIL("internal urp");	/* Supposed to be caught earlier. */
++		break;
++	case '?':
++	case '+':
++	case '*':
++		FAIL("?+* follows nothing");
++		break;
++	case '\\':
++		if (*g->regparse == '\0')
++			FAIL("trailing \\");
++		ret = regnode(g, EXACTLY);
++		regc(g, *g->regparse++);
++		regc(g, '\0');
++		*flagp |= HASWIDTH|SIMPLE;
++		break;
++	default: {
++			register int len;
++			register char ender;
++
++			g->regparse--;
++			len = my_strcspn((const char *)g->regparse, (const char *)META);
++			if (len <= 0)
++				FAIL("internal disaster");
++			ender = *(g->regparse+len);
++			if (len > 1 && ISMULT(ender))
++				len--;		/* Back off clear of ?+* operand. */
++			*flagp |= HASWIDTH;
++			if (len == 1)
++				*flagp |= SIMPLE;
++			ret = regnode(g, EXACTLY);
++			while (len > 0) {
++				regc(g, *g->regparse++);
++				len--;
++			}
++			regc(g, '\0');
++		}
++		break;
++	}
++
++	return(ret);
++}
++
++/*
++ - regnode - emit a node
++ */
++static char *			/* Location. */
++regnode(struct match_globals *g, char op)
++{
++	register char *ret;
++	register char *ptr;
++
++	ret = g->regcode;
++	if (ret == &g->regdummy) {
++		g->regsize += 3;
++		return(ret);
++	}
++
++	ptr = ret;
++	*ptr++ = op;
++	*ptr++ = '\0';		/* Null "next" pointer. */
++	*ptr++ = '\0';
++	g->regcode = ptr;
++
++	return(ret);
++}
++
++/*
++ - regc - emit (if appropriate) a byte of code
++ */
++static void
++regc(struct match_globals *g, char b)
++{
++	if (g->regcode != &g->regdummy)
++		*g->regcode++ = b;
++	else
++		g->regsize++;
++}
++
++/*
++ - reginsert - insert an operator in front of already-emitted operand
++ *
++ * Means relocating the operand.
++ */
++static void
++reginsert(struct match_globals *g, char op, char* opnd)
++{
++	register char *src;
++	register char *dst;
++	register char *place;
++
++	if (g->regcode == &g->regdummy) {
++		g->regsize += 3;
++		return;
++	}
++
++	src = g->regcode;
++	g->regcode += 3;
++	dst = g->regcode;
++	while (src > opnd)
++		*--dst = *--src;
++
++	place = opnd;		/* Op node, where operand used to be. */
++	*place++ = op;
++	*place++ = '\0';
++	*place++ = '\0';
++}
++
++/*
++ - regtail - set the next-pointer at the end of a node chain
++ */
++static void
++regtail(struct match_globals *g, char *p, char *val)
++{
++	register char *scan;
++	register char *temp;
++	register int offset;
++
++	if (p == &g->regdummy)
++		return;
++
++	/* Find last node. */
++	scan = p;
++	for (;;) {
++		temp = regnext(g, scan);
++		if (temp == NULL)
++			break;
++		scan = temp;
++	}
++
++	if (OP(scan) == BACK)
++		offset = scan - val;
++	else
++		offset = val - scan;
++	*(scan+1) = (offset>>8)&0377;
++	*(scan+2) = offset&0377;
++}
++
++/*
++ - regoptail - regtail on operand of first argument; nop if operandless
++ */
++static void
++regoptail(struct match_globals *g, char *p, char *val)
++{
++	/* "Operandless" and "op != BRANCH" are synonymous in practice. */
++	if (p == NULL || p == &g->regdummy || OP(p) != BRANCH)
++		return;
++	regtail(g, OPERAND(p), val);
++}
++
++/*
++ * regexec and friends
++ */
++
++
++/*
++ * Forwards.
++ */
++STATIC int regtry(struct match_globals *g, regexp *prog, char *string);
++STATIC int regmatch(struct match_globals *g, char *prog);
++STATIC int regrepeat(struct match_globals *g, char *p);
++
++#ifdef DEBUG
++int regnarrate = 0;
++void regdump();
++STATIC char *regprop(char *op);
++#endif
++
++/*
++ - regexec - match a regexp against a string
++ */
++int
++regexec(regexp *prog, char *string)
++{
++	register char *s;
++	struct match_globals g;
++
++	/* Be paranoid... */
++	if (prog == NULL || string == NULL) {
++		printk("<3>Regexp: NULL parameter\n");
++		return(0);
++	}
++
++	/* Check validity of program. */
++	if (UCHARAT(prog->program) != MAGIC) {
++		printk("<3>Regexp: corrupted program\n");
++		return(0);
++	}
++
++	/* If there is a "must appear" string, look for it. */
++	if (prog->regmust != NULL) {
++		s = string;
++		while ((s = strchr(s, prog->regmust[0])) != NULL) {
++			if (strncmp(s, prog->regmust, prog->regmlen) == 0)
++				break;	/* Found it. */
++			s++;
++		}
++		if (s == NULL)	/* Not present. */
++			return(0);
++	}
++
++	/* Mark beginning of line for ^ . */
++	g.regbol = string;
++
++	/* Simplest case:  anchored match need be tried only once. */
++	if (prog->reganch)
++		return(regtry(&g, prog, string));
++
++	/* Messy cases:  unanchored match. */
++	s = string;
++	if (prog->regstart != '\0')
++		/* We know what char it must start with. */
++		while ((s = strchr(s, prog->regstart)) != NULL) {
++			if (regtry(&g, prog, s))
++				return(1);
++			s++;
++		}
++	else
++		/* We don't -- general case. */
++		do {
++			if (regtry(&g, prog, s))
++				return(1);
++		} while (*s++ != '\0');
++
++	/* Failure. */
++	return(0);
++}
++
++/*
++ - regtry - try match at specific point
++ */
++static int			/* 0 failure, 1 success */
++regtry(struct match_globals *g, regexp *prog, char *string)
++{
++	register int i;
++	register char **sp;
++	register char **ep;
++
++	g->reginput = string;
++	g->regstartp = prog->startp;
++	g->regendp = prog->endp;
++
++	sp = prog->startp;
++	ep = prog->endp;
++	for (i = NSUBEXP; i > 0; i--) {
++		*sp++ = NULL;
++		*ep++ = NULL;
++	}
++	if (regmatch(g, prog->program + 1)) {
++		prog->startp[0] = string;
++		prog->endp[0] = g->reginput;
++		return(1);
++	} else
++		return(0);
++}
++
++/*
++ - regmatch - main matching routine
++ *
++ * Conceptually the strategy is simple:  check to see whether the current
++ * node matches, call self recursively to see whether the rest matches,
++ * and then act accordingly.  In practice we make some effort to avoid
++ * recursion, in particular by going through "ordinary" nodes (that don't
++ * need to know whether the rest of the match failed) by a loop instead of
++ * by recursion.
++ */
++static int			/* 0 failure, 1 success */
++regmatch(struct match_globals *g, char *prog)
++{
++	register char *scan = prog; /* Current node. */
++	char *next;		    /* Next node. */
++
++#ifdef DEBUG
++	if (scan != NULL && regnarrate)
++		fprintf(stderr, "%s(\n", regprop(scan));
++#endif
++	while (scan != NULL) {
++#ifdef DEBUG
++		if (regnarrate)
++			fprintf(stderr, "%s...\n", regprop(scan));
++#endif
++		next = regnext(g, scan);
++
++		switch (OP(scan)) {
++		case BOL:
++			if (g->reginput != g->regbol)
++				return(0);
++			break;
++		case EOL:
++			if (*g->reginput != '\0')
++				return(0);
++			break;
++		case ANY:
++			if (*g->reginput == '\0')
++				return(0);
++			g->reginput++;
++			break;
++		case EXACTLY: {
++				register int len;
++				register char *opnd;
++
++				opnd = OPERAND(scan);
++				/* Inline the first character, for speed. */
++				if (*opnd != *g->reginput)
++					return(0);
++				len = strlen(opnd);
++				if (len > 1 && strncmp(opnd, g->reginput, len) != 0)
++					return(0);
++				g->reginput += len;
++			}
++			break;
++		case ANYOF:
++			if (*g->reginput == '\0' || strchr(OPERAND(scan), *g->reginput) == NULL)
++				return(0);
++			g->reginput++;
++			break;
++		case ANYBUT:
++			if (*g->reginput == '\0' || strchr(OPERAND(scan), *g->reginput) != NULL)
++				return(0);
++			g->reginput++;
++			break;
++		case NOTHING:
++		case BACK:
++			break;
++		case OPEN+1:
++		case OPEN+2:
++		case OPEN+3:
++		case OPEN+4:
++		case OPEN+5:
++		case OPEN+6:
++		case OPEN+7:
++		case OPEN+8:
++		case OPEN+9: {
++				register int no;
++				register char *save;
++
++				no = OP(scan) - OPEN;
++				save = g->reginput;
++
++				if (regmatch(g, next)) {
++					/*
++					 * Don't set startp if some later
++					 * invocation of the same parentheses
++					 * already has.
++					 */
++					if (g->regstartp[no] == NULL)
++						g->regstartp[no] = save;
++					return(1);
++				} else
++					return(0);
++			}
++			break;
++		case CLOSE+1:
++		case CLOSE+2:
++		case CLOSE+3:
++		case CLOSE+4:
++		case CLOSE+5:
++		case CLOSE+6:
++		case CLOSE+7:
++		case CLOSE+8:
++		case CLOSE+9:
++			{
++				register int no;
++				register char *save;
++
++				no = OP(scan) - CLOSE;
++				save = g->reginput;
++
++				if (regmatch(g, next)) {
++					/*
++					 * Don't set endp if some later
++					 * invocation of the same parentheses
++					 * already has.
++					 */
++					if (g->regendp[no] == NULL)
++						g->regendp[no] = save;
++					return(1);
++				} else
++					return(0);
++			}
++			break;
++		case BRANCH: {
++				register char *save;
++
++				if (OP(next) != BRANCH)		/* No choice. */
++					next = OPERAND(scan);	/* Avoid recursion. */
++				else {
++					do {
++						save = g->reginput;
++						if (regmatch(g, OPERAND(scan)))
++							return(1);
++						g->reginput = save;
++						scan = regnext(g, scan);
++					} while (scan != NULL && OP(scan) == BRANCH);
++					return(0);
++					/* NOTREACHED */
++				}
++			}
++			break;
++		case STAR:
++		case PLUS: {
++				register char nextch;
++				register int no;
++				register char *save;
++				register int min;
++
++				/*
++				 * Lookahead to avoid useless match attempts
++				 * when we know what character comes next.
++				 */
++				nextch = '\0';
++				if (OP(next) == EXACTLY)
++					nextch = *OPERAND(next);
++				min = (OP(scan) == STAR) ? 0 : 1;
++				save = g->reginput;
++				no = regrepeat(g, OPERAND(scan));
++				while (no >= min) {
++					/* If it could work, try it. */
++					if (nextch == '\0' || *g->reginput == nextch)
++						if (regmatch(g, next))
++							return(1);
++					/* Couldn't or didn't -- back up. */
++					no--;
++					g->reginput = save + no;
++				}
++				return(0);
++			}
++			break;
++		case END:
++			return(1);	/* Success! */
++			break;
++		default:
++			printk("<3>Regexp: memory corruption\n");
++			return(0);
++			break;
++		}
++
++		scan = next;
++	}
++
++	/*
++	 * We get here only if there's trouble -- normally "case END" is
++	 * the terminating point.
++	 */
++	printk("<3>Regexp: corrupted pointers\n");
++	return(0);
++}
++
++/*
++ - regrepeat - repeatedly match something simple, report how many
++ */
++static int
++regrepeat(struct match_globals *g, char *p)
++{
++	register int count = 0;
++	register char *scan;
++	register char *opnd;
++
++	scan = g->reginput;
++	opnd = OPERAND(p);
++	switch (OP(p)) {
++	case ANY:
++		count = strlen(scan);
++		scan += count;
++		break;
++	case EXACTLY:
++		while (*opnd == *scan) {
++			count++;
++			scan++;
++		}
++		break;
++	case ANYOF:
++		while (*scan != '\0' && strchr(opnd, *scan) != NULL) {
++			count++;
++			scan++;
++		}
++		break;
++	case ANYBUT:
++		while (*scan != '\0' && strchr(opnd, *scan) == NULL) {
++			count++;
++			scan++;
++		}
++		break;
++	default:		/* Oh dear.  Called inappropriately. */
++		printk("<3>Regexp: internal foulup\n");
++		count = 0;	/* Best compromise. */
++		break;
++	}
++	g->reginput = scan;
++
++	return(count);
++}
++
++/*
++ - regnext - dig the "next" pointer out of a node
++ */
++static char*
++regnext(struct match_globals *g, char *p)
++{
++	register int offset;
++
++	if (p == &g->regdummy)
++		return(NULL);
++
++	offset = NEXT(p);
++	if (offset == 0)
++		return(NULL);
++
++	if (OP(p) == BACK)
++		return(p-offset);
++	else
++		return(p+offset);
++}
++
++#ifdef DEBUG
++
++STATIC char *regprop();
++
++/*
++ - regdump - dump a regexp onto stdout in vaguely comprehensible form
++ */
++void
++regdump(regexp *r)
++{
++	register char *s;
++	register char op = EXACTLY;	/* Arbitrary non-END op. */
++	register char *next;
++	/* extern char *strchr(); */
++
++
++	s = r->program + 1;
++	while (op != END) {	/* While that wasn't END last time... */
++		op = OP(s);
++		printf("%2d%s", s-r->program, regprop(s));	/* Where, what. */
++		next = regnext(s);
++		if (next == NULL)		/* Next ptr. */
++			printf("(0)");
++		else
++			printf("(%d)", (s-r->program)+(next-s));
++		s += 3;
++		if (op == ANYOF || op == ANYBUT || op == EXACTLY) {
++			/* Literal string, where present. */
++			while (*s != '\0') {
++				putchar(*s);
++				s++;
++			}
++			s++;
++		}
++		putchar('\n');
++	}
++
++	/* Header fields of interest. */
++	if (r->regstart != '\0')
++		printf("start `%c' ", r->regstart);
++	if (r->reganch)
++		printf("anchored ");
++	if (r->regmust != NULL)
++		printf("must have \"%s\"", r->regmust);
++	printf("\n");
++}
++
++/*
++ - regprop - printable representation of opcode
++ */
++static char *
++regprop(char *op)
++{
++#define BUFLEN 50
++	register char *p;
++	static char buf[BUFLEN];
++
++	strcpy(buf, ":");
++
++	switch (OP(op)) {
++	case BOL:
++		p = "BOL";
++		break;
++	case EOL:
++		p = "EOL";
++		break;
++	case ANY:
++		p = "ANY";
++		break;
++	case ANYOF:
++		p = "ANYOF";
++		break;
++	case ANYBUT:
++		p = "ANYBUT";
++		break;
++	case BRANCH:
++		p = "BRANCH";
++		break;
++	case EXACTLY:
++		p = "EXACTLY";
++		break;
++	case NOTHING:
++		p = "NOTHING";
++		break;
++	case BACK:
++		p = "BACK";
++		break;
++	case END:
++		p = "END";
++		break;
++	case OPEN+1:
++	case OPEN+2:
++	case OPEN+3:
++	case OPEN+4:
++	case OPEN+5:
++	case OPEN+6:
++	case OPEN+7:
++	case OPEN+8:
++	case OPEN+9:
++		snprintf(buf+strlen(buf),BUFLEN-strlen(buf), "OPEN%d", OP(op)-OPEN);
++		p = NULL;
++		break;
++	case CLOSE+1:
++	case CLOSE+2:
++	case CLOSE+3:
++	case CLOSE+4:
++	case CLOSE+5:
++	case CLOSE+6:
++	case CLOSE+7:
++	case CLOSE+8:
++	case CLOSE+9:
++		snprintf(buf+strlen(buf),BUFLEN-strlen(buf), "CLOSE%d", OP(op)-CLOSE);
++		p = NULL;
++		break;
++	case STAR:
++		p = "STAR";
++		break;
++	case PLUS:
++		p = "PLUS";
++		break;
++	default:
++		printk("<3>Regexp: corrupted opcode\n");
++		break;
++	}
++	if (p != NULL)
++		strncat(buf, p, BUFLEN-strlen(buf));
++	return(buf);
++}
++#endif
++
++
+--- /dev/null
++++ b/net/netfilter/regexp/regexp.h
+@@ -0,0 +1,41 @@
++/*
++ * Definitions etc. for regexp(3) routines.
++ *
++ * Caveat:  this is V8 regexp(3) [actually, a reimplementation thereof],
++ * not the System V one.
++ */
++
++#ifndef REGEXP_H
++#define REGEXP_H
++
++
++/*
++http://www.opensource.apple.com/darwinsource/10.3/expect-1/expect/expect.h ,
++which contains a version of this library, says:
++
++ *
++ * NSUBEXP must be at least 10, and no greater than 117 or the parser
++ * will not work properly.
++ *
++
++However, it looks rather like this library is limited to 10.  If you think
++otherwise, let us know.
++*/
++
++#define NSUBEXP  10
++typedef struct regexp {
++	char *startp[NSUBEXP];
++	char *endp[NSUBEXP];
++	char regstart;		/* Internal use only. */
++	char reganch;		/* Internal use only. */
++	char *regmust;		/* Internal use only. */
++	int regmlen;		/* Internal use only. */
++	char program[1];	/* Unwarranted chumminess with compiler. */
++} regexp;
++
++regexp * regcomp(char *exp, int *patternsize);
++int regexec(regexp *prog, char *string);
++void regsub(regexp *prog, char *source, char *dest);
++void regerror(char *s);
++
++#endif
+--- /dev/null
++++ b/net/netfilter/regexp/regmagic.h
+@@ -0,0 +1,5 @@
++/*
++ * The first byte of the regexp internal "program" is actually this magic
++ * number; the start node begins in the second byte.
++ */
++#define	MAGIC	0234
+--- /dev/null
++++ b/net/netfilter/regexp/regsub.c
+@@ -0,0 +1,95 @@
++/*
++ * regsub
++ * @(#)regsub.c	1.3 of 2 April 86
++ *
++ *	Copyright (c) 1986 by University of Toronto.
++ *	Written by Henry Spencer.  Not derived from licensed software.
++ *
++ *	Permission is granted to anyone to use this software for any
++ *	purpose on any computer system, and to redistribute it freely,
++ *	subject to the following restrictions:
++ *
++ *	1. The author is not responsible for the consequences of use of
++ *		this software, no matter how awful, even if they arise
++ *		from defects in it.
++ *
++ *	2. The origin of this software must not be misrepresented, either
++ *		by explicit claim or by omission.
++ *
++ *	3. Altered versions must be plainly marked as such, and must not
++ *		be misrepresented as being the original software.
++ *
++ *
++ * This code was modified by Ethan Sommer to work within the kernel
++ * (it now uses kmalloc etc..)
++ *
++ */
++#include "regexp.h"
++#include "regmagic.h"
++#include <linux/string.h>
++
++
++#ifndef CHARBITS
++#define	UCHARAT(p)	((int)*(unsigned char *)(p))
++#else
++#define	UCHARAT(p)	((int)*(p)&CHARBITS)
++#endif
++
++#if 0
++//void regerror(char * s)
++//{
++//        printk("regexp(3): %s", s);
++//        /* NOTREACHED */
++//}
++#endif
++
++/*
++ - regsub - perform substitutions after a regexp match
++ */
++void
++regsub(regexp * prog, char * source, char * dest)
++{
++	register char *src;
++	register char *dst;
++	register char c;
++	register int no;
++	register int len;
++	
++	/* Not necessary and gcc doesn't like it -MLS */
++	/*extern char *strncpy();*/
++
++	if (prog == NULL || source == NULL || dest == NULL) {
++		regerror("NULL parm to regsub");
++		return;
++	}
++	if (UCHARAT(prog->program) != MAGIC) {
++		regerror("damaged regexp fed to regsub");
++		return;
++	}
++
++	src = source;
++	dst = dest;
++	while ((c = *src++) != '\0') {
++		if (c == '&')
++			no = 0;
++		else if (c == '\\' && '0' <= *src && *src <= '9')
++			no = *src++ - '0';
++		else
++			no = -1;
++
++		if (no < 0) {	/* Ordinary character. */
++			if (c == '\\' && (*src == '\\' || *src == '&'))
++				c = *src++;
++			*dst++ = c;
++		} else if (prog->startp[no] != NULL && prog->endp[no] != NULL) {
++			len = prog->endp[no] - prog->startp[no];
++			(void) strncpy(dst, prog->startp[no], len);
++			dst += len;
++			if (len != 0 && *(dst-1) == '\0') {	/* strncpy hit NUL. */
++				regerror("damaged match string");
++				return;
++			}
++		}
++	}
++	*dst++ = '\0';
++}
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -214,6 +214,14 @@ destroy_conntrack(struct nf_conntrack *n
+ 	 * too. */
+ 	nf_ct_remove_expectations(ct);
+ 
++	#if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE)
++	if(ct->layer7.app_proto)
++		kfree(ct->layer7.app_proto);
++	if(ct->layer7.app_data)
++	kfree(ct->layer7.app_data);
++	#endif
++
++
+ 	/* We overload first tuple to link into unconfirmed list. */
+ 	if (!nf_ct_is_confirmed(ct)) {
+ 		BUG_ON(hlist_nulls_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode));
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -239,6 +239,12 @@ static int ct_seq_show(struct seq_file *
+ 	if (ct_show_delta_time(s, ct))
+ 		goto release;
+ 
++#if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE)
++	if(ct->layer7.app_proto &&
++           seq_printf(s, "l7proto=%s ", ct->layer7.app_proto))
++		return -ENOSPC;
++#endif
++
+ 	if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
+ 		goto release;
+ 
+--- a/include/net/netfilter/nf_conntrack.h
++++ b/include/net/netfilter/nf_conntrack.h
+@@ -134,6 +134,22 @@ struct nf_conn {
+ 	struct net *ct_net;
+ #endif
+ 
++#if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || \
++    defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE)
++	struct {
++		/*
++		 * e.g. "http". NULL before decision. "unknown" after decision
++		 * if no match.
++		 */
++		char *app_proto;
++		/*
++		 * application layer data so far. NULL after match decision.
++		 */
++		char *app_data;
++		unsigned int app_data_len;
++	} layer7;
++#endif
++
+ 	/* Storage reserved for other modules, must be the last member */
+ 	union nf_conntrack_proto proto;
+ };
+--- /dev/null
++++ b/include/linux/netfilter/xt_layer7.h
+@@ -0,0 +1,13 @@
++#ifndef _XT_LAYER7_H
++#define _XT_LAYER7_H
++
++#define MAX_PATTERN_LEN 8192
++#define MAX_PROTOCOL_LEN 256
++
++struct xt_layer7_info {
++    char protocol[MAX_PROTOCOL_LEN];
++    char pattern[MAX_PATTERN_LEN];
++    u_int8_t invert;
++};
++
++#endif /* _XT_LAYER7_H */
+--- a/include/linux/netfilter/Kbuild
++++ b/include/linux/netfilter/Kbuild
+@@ -49,6 +49,7 @@ header-y += xt_hashlimit.h
+ header-y += xt_helper.h
+ header-y += xt_iprange.h
+ header-y += xt_ipvs.h
++header-y += xt_layer7.h
+ header-y += xt_length.h
+ header-y += xt_limit.h
+ header-y += xt_mac.h
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/601-netfilter_layer7_pktmatch.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/601-netfilter_layer7_pktmatch.patch.svn-base
new file mode 100644
index 0000000..f65e301
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/601-netfilter_layer7_pktmatch.patch.svn-base
@@ -0,0 +1,108 @@
+--- a/include/linux/netfilter/xt_layer7.h
++++ b/include/linux/netfilter/xt_layer7.h
+@@ -8,6 +8,7 @@ struct xt_layer7_info {
+     char protocol[MAX_PROTOCOL_LEN];
+     char pattern[MAX_PATTERN_LEN];
+     u_int8_t invert;
++    u_int8_t pkt;
+ };
+ 
+ #endif /* _XT_LAYER7_H */
+--- a/net/netfilter/xt_layer7.c
++++ b/net/netfilter/xt_layer7.c
+@@ -314,33 +314,35 @@ static int match_no_append(struct nf_con
+ }
+ 
+ /* add the new app data to the conntrack.  Return number of bytes added. */
+-static int add_data(struct nf_conn * master_conntrack,
+-                    char * app_data, int appdatalen)
++static int add_datastr(char *target, int offset, char *app_data, int len)
+ {
+ 	int length = 0, i;
+-	int oldlength = master_conntrack->layer7.app_data_len;
+-
+-	/* This is a fix for a race condition by Deti Fliegl. However, I'm not 
+-	   clear on whether the race condition exists or whether this really 
+-	   fixes it.  I might just be being dense... Anyway, if it's not really 
+-	   a fix, all it does is waste a very small amount of time. */
+-	if(!master_conntrack->layer7.app_data) return 0;
++	if (!target) return 0;
+ 
+ 	/* Strip nulls. Make everything lower case (our regex lib doesn't
+ 	do case insensitivity).  Add it to the end of the current data. */
+-	for(i = 0; i < maxdatalen-oldlength-1 &&
+-		   i < appdatalen; i++) {
++ 	for(i = 0; i < maxdatalen-offset-1 && i < len; i++) {
+ 		if(app_data[i] != '\0') {
+ 			/* the kernel version of tolower mungs 'upper ascii' */
+-			master_conntrack->layer7.app_data[length+oldlength] =
++			target[length+offset] =
+ 				isascii(app_data[i])? 
+ 					tolower(app_data[i]) : app_data[i];
+ 			length++;
+ 		}
+ 	}
++	target[length+offset] = '\0';
++
++	return length;
++}
++
++/* add the new app data to the conntrack.  Return number of bytes added. */
++static int add_data(struct nf_conn * master_conntrack,
++                    char * app_data, int appdatalen)
++{
++	int length;
+ 
+-	master_conntrack->layer7.app_data[length+oldlength] = '\0';
+-	master_conntrack->layer7.app_data_len = length + oldlength;
++	length = add_datastr(master_conntrack->layer7.app_data, master_conntrack->layer7.app_data_len, app_data, appdatalen);
++	master_conntrack->layer7.app_data_len += length;
+ 
+ 	return length;
+ }
+@@ -438,7 +440,7 @@ match(const struct sk_buff *skbin,
+ 
+ 	enum ip_conntrack_info master_ctinfo, ctinfo;
+ 	struct nf_conn *master_conntrack, *conntrack;
+-	unsigned char * app_data;
++	unsigned char *app_data, *tmp_data;
+ 	unsigned int pattern_result, appdatalen;
+ 	regexp * comppattern;
+ 
+@@ -466,8 +468,8 @@ match(const struct sk_buff *skbin,
+ 		master_conntrack = master_ct(master_conntrack);
+ 
+ 	/* if we've classified it or seen too many packets */
+-	if(total_acct_packets(master_conntrack) > num_packets ||
+-	   master_conntrack->layer7.app_proto) {
++	if(!info->pkt && (total_acct_packets(master_conntrack) > num_packets ||
++	   master_conntrack->layer7.app_proto)) {
+ 
+ 		pattern_result = match_no_append(conntrack, master_conntrack, 
+ 						 ctinfo, master_ctinfo, info);
+@@ -500,6 +502,25 @@ match(const struct sk_buff *skbin,
+ 	/* the return value gets checked later, when we're ready to use it */
+ 	comppattern = compile_and_cache(info->pattern, info->protocol);
+ 
++	if (info->pkt) {
++		tmp_data = kmalloc(maxdatalen, GFP_ATOMIC);
++		if(!tmp_data){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
++			return info->invert;
++		}
++
++		tmp_data[0] = '\0';
++		add_datastr(tmp_data, 0, app_data, appdatalen);
++		pattern_result = ((comppattern && regexec(comppattern, tmp_data)) ? 1 : 0);
++
++		kfree(tmp_data);
++		tmp_data = NULL;
++		spin_unlock_bh(&l7_lock);
++
++		return (pattern_result ^ info->invert);
++	}
++
+ 	/* On the first packet of a connection, allocate space for app data */
+ 	if(total_acct_packets(master_conntrack) == 1 && !skb->cb[0] && 
+ 	   !master_conntrack->layer7.app_data){
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/602-netfilter_layer7_match.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/602-netfilter_layer7_match.patch.svn-base
new file mode 100644
index 0000000..b2e48c8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/602-netfilter_layer7_match.patch.svn-base
@@ -0,0 +1,51 @@
+--- a/net/netfilter/xt_layer7.c
++++ b/net/netfilter/xt_layer7.c
+@@ -415,7 +415,9 @@ static int layer7_write_proc(struct file
+ }
+ 
+ static bool
+-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
++match(const struct sk_buff *skbin, struct xt_action_param *par)
++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
+ match(const struct sk_buff *skbin, const struct xt_match_param *par)
+ #else
+ match(const struct sk_buff *skbin,
+@@ -597,14 +599,19 @@ match(const struct sk_buff *skbin,
+ }
+ 
+ // load nf_conntrack_ipv4
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
++static int
++#else
++static bool
++#endif
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
+-static bool check(const struct xt_mtchk_param *par)
++check(const struct xt_mtchk_param *par)
+ {
+         if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
+                 printk(KERN_WARNING "can't load conntrack support for "
+                                     "proto=%d\n", par->match->family);
+ #else
+-static bool check(const char *tablename, const void *inf,
++check(const char *tablename, const void *inf,
+ 		 const struct xt_match *match, void *matchinfo,
+ 		 unsigned int hook_mask)
+ {
+@@ -612,9 +619,15 @@ static bool check(const char *tablename,
+                 printk(KERN_WARNING "can't load conntrack support for "
+                                     "proto=%d\n", match->family);
+ #endif
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
++		return -EINVAL;
++	}
++	return 0;
++#else
+                 return 0;
+         }
+ 	return 1;
++#endif
+ }
+ 
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/603-netfilter_layer7_2.6.36_fix.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/603-netfilter_layer7_2.6.36_fix.patch.svn-base
new file mode 100644
index 0000000..92a7200
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/603-netfilter_layer7_2.6.36_fix.patch.svn-base
@@ -0,0 +1,61 @@
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -857,6 +857,27 @@ config NETFILTER_XT_MATCH_IPVS
+ 
+ 	  If unsure, say N.
+ 
++config NETFILTER_XT_MATCH_LAYER7
++	tristate '"layer7" match support'
++	depends on EXPERIMENTAL
++	depends on NETFILTER_XTABLES
++	depends on NETFILTER_ADVANCED
++	depends on NF_CONNTRACK
++	help
++	  Say Y if you want to be able to classify connections (and their
++	  packets) based on regular expression matching of their application
++	  layer data.   This is one way to classify applications such as
++	  peer-to-peer filesharing systems that do not always use the same
++	  port.
++
++	  To compile it as a module, choose M here.  If unsure, say N.
++
++config NETFILTER_XT_MATCH_LAYER7_DEBUG
++	bool 'Layer 7 debugging output'
++	depends on NETFILTER_XT_MATCH_LAYER7
++	help
++	  Say Y to get lots of debugging output.
++
+ config NETFILTER_XT_MATCH_LENGTH
+ 	tristate '"length" match support'
+ 	depends on NETFILTER_ADVANCED
+@@ -1053,26 +1074,11 @@ config NETFILTER_XT_MATCH_STATE
+ 
+ 	  To compile it as a module, choose M here.  If unsure, say N.
+ 
+-config NETFILTER_XT_MATCH_LAYER7
+-	tristate '"layer7" match support'
+-	depends on NETFILTER_XTABLES
+-	depends on EXPERIMENTAL && (IP_NF_CONNTRACK || NF_CONNTRACK)
+-       depends on NETFILTER_ADVANCED
+-	help
+-	  Say Y if you want to be able to classify connections (and their
+-	  packets) based on regular expression matching of their application
+-	  layer data.   This is one way to classify applications such as
+-	  peer-to-peer filesharing systems that do not always use the same
+-	  port.
+-
+-	  To compile it as a module, choose M here.  If unsure, say N.
+-
+ config NETFILTER_XT_MATCH_LAYER7_DEBUG
+-        bool 'Layer 7 debugging output'
+-        depends on NETFILTER_XT_MATCH_LAYER7
+-        help
+-          Say Y to get lots of debugging output.
+-
++	bool 'Layer 7 debugging output'
++	depends on NETFILTER_XT_MATCH_LAYER7
++	help
++	  Say Y to get lots of debugging output.
+ 
+ config NETFILTER_XT_MATCH_STATISTIC
+ 	tristate '"statistic" match support'
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/604-netfilter_conntrack_flush.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/604-netfilter_conntrack_flush.patch.svn-base
new file mode 100644
index 0000000..cbcd29a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/604-netfilter_conntrack_flush.patch.svn-base
@@ -0,0 +1,46 @@
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -267,10 +267,34 @@ static int ct_open(struct inode *inode, 
+ 			sizeof(struct ct_iter_state));
+ }
+ 
++static int kill_all(struct nf_conn *i, void *data)
++{
++    return 1;
++}
++
++static ssize_t ct_file_write(struct file *file, const char __user *buf,
++			     size_t count, loff_t *ppos)
++{
++	struct seq_file *seq = file->private_data;
++	struct net *net = seq_file_net(seq);
++
++	if (count) {
++		char c;
++
++		if (get_user(c, buf))
++			return -EFAULT;
++
++		if (c == 'f')
++			nf_ct_iterate_cleanup(net, kill_all, NULL);
++	}
++	return count;
++}
++
+ static const struct file_operations ct_file_ops = {
+ 	.owner   = THIS_MODULE,
+ 	.open    = ct_open,
+ 	.read    = seq_read,
++	.write	 = ct_file_write,
+ 	.llseek  = seq_lseek,
+ 	.release = seq_release_net,
+ };
+@@ -372,7 +396,7 @@ static int nf_conntrack_standalone_init_
+ {
+ 	struct proc_dir_entry *pde;
+ 
+-	pde = proc_net_fops_create(net, "nf_conntrack", 0440, &ct_file_ops);
++	pde = proc_net_fops_create(net, "nf_conntrack", 0660, &ct_file_ops);
+ 	if (!pde)
+ 		goto out_nf_conntrack;
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/610-netfilter_match_bypass_default_checks.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/610-netfilter_match_bypass_default_checks.patch.svn-base
new file mode 100644
index 0000000..51c9e09
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/610-netfilter_match_bypass_default_checks.patch.svn-base
@@ -0,0 +1,93 @@
+--- a/include/linux/netfilter_ipv4/ip_tables.h
++++ b/include/linux/netfilter_ipv4/ip_tables.h
+@@ -93,6 +93,7 @@ struct ipt_ip {
+ #define IPT_F_FRAG		0x01	/* Set if rule is a fragment rule */
+ #define IPT_F_GOTO		0x02	/* Set if jump is a goto */
+ #define IPT_F_MASK		0x03	/* All possible flag bits mask. */
++#define IPT_F_NO_DEF_MATCH	0x80	/* Internal: no default match rules present */
+ 
+ /* Values for "inv" field in struct ipt_ip. */
+ #define IPT_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -81,6 +81,9 @@ ip_packet_match(const struct iphdr *ip,
+ 
+ #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
+ 
++	if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
++		return true;
++
+ 	if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
+ 		  IPT_INV_SRCIP) ||
+ 	    FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+@@ -134,6 +137,29 @@ ip_packet_match(const struct iphdr *ip,
+ 	return true;
+ }
+ 
++static void
++ip_checkdefault(struct ipt_ip *ip)
++{
++	static const char iface_mask[IFNAMSIZ] = {};
++
++	if (ip->invflags || ip->flags & IPT_F_FRAG)
++		return;
++
++	if (memcmp(ip->iniface_mask, iface_mask, IFNAMSIZ) != 0)
++		return;
++
++	if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
++		return;
++
++	if (ip->smsk.s_addr || ip->dmsk.s_addr)
++		return;
++
++	if (ip->proto)
++		return;
++
++	ip->flags |= IPT_F_NO_DEF_MATCH;
++}
++
+ static bool
+ ip_checkentry(const struct ipt_ip *ip)
+ {
+@@ -561,7 +587,7 @@ static void cleanup_match(struct xt_entr
+ }
+ 
+ static int
+-check_entry(const struct ipt_entry *e, const char *name)
++check_entry(struct ipt_entry *e, const char *name)
+ {
+ 	const struct xt_entry_target *t;
+ 
+@@ -570,6 +596,8 @@ check_entry(const struct ipt_entry *e, c
+ 		return -EINVAL;
+ 	}
+ 
++	ip_checkdefault(&e->ip);
++
+ 	if (e->target_offset + sizeof(struct xt_entry_target) >
+ 	    e->next_offset)
+ 		return -EINVAL;
+@@ -931,6 +959,7 @@ copy_entries_to_user(unsigned int total_
+ 	const struct xt_table_info *private = table->private;
+ 	int ret = 0;
+ 	const void *loc_cpu_entry;
++	u8 flags;
+ 
+ 	counters = alloc_counters(table);
+ 	if (IS_ERR(counters))
+@@ -961,6 +990,14 @@ copy_entries_to_user(unsigned int total_
+ 			ret = -EFAULT;
+ 			goto free_counters;
+ 		}
++
++		flags = e->ip.flags & IPT_F_MASK;
++		if (copy_to_user(userptr + off
++				 + offsetof(struct ipt_entry, ip.flags),
++				 &flags, sizeof(flags)) != 0) {
++			ret = -EFAULT;
++			goto free_counters;
++		}
+ 
+ 		for (i = sizeof(struct ipt_entry);
+ 		     i < e->target_offset;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/611-netfilter_match_bypass_default_table.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/611-netfilter_match_bypass_default_table.patch.svn-base
new file mode 100644
index 0000000..3cf0e5a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/611-netfilter_match_bypass_default_table.patch.svn-base
@@ -0,0 +1,81 @@
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -310,6 +310,33 @@ struct ipt_entry *ipt_next_entry(const s
+ 	return (void *)entry + entry->next_offset;
+ }
+ 
++static bool
++ipt_handle_default_rule(struct ipt_entry *e, unsigned int *verdict)
++{
++	struct xt_entry_target *t;
++	struct xt_standard_target *st;
++
++	if (e->target_offset != sizeof(struct ipt_entry))
++		return false;
++
++	if (!(e->ip.flags & IPT_F_NO_DEF_MATCH))
++		return false;
++
++	t = ipt_get_target(e);
++	if (t->u.kernel.target->target)
++		return false;
++
++	st = (struct xt_standard_target *) t;
++	if (st->verdict == XT_RETURN)
++		return false;
++
++	if (st->verdict >= 0)
++		return false;
++
++	*verdict = (unsigned)(-st->verdict) - 1;
++	return true;
++}
++
+ /* Returns one of the generic firewall policies, like NF_ACCEPT. */
+ unsigned int
+ ipt_do_table(struct sk_buff *skb,
+@@ -334,6 +361,25 @@ ipt_do_table(struct sk_buff *skb,
+ 	ip = ip_hdr(skb);
+ 	indev = in ? in->name : nulldevname;
+ 	outdev = out ? out->name : nulldevname;
++
++	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
++	local_bh_disable();
++	addend = xt_write_recseq_begin();
++	private = table->private;
++	cpu        = smp_processor_id();
++	table_base = private->entries[cpu];
++	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
++	stackptr   = per_cpu_ptr(private->stackptr, cpu);
++	origptr    = *stackptr;
++
++	e = get_entry(table_base, private->hook_entry[hook]);
++	if (ipt_handle_default_rule(e, &verdict)) {
++		ADD_COUNTER(e->counters, skb->len, 1);
++		xt_write_recseq_end(addend);
++		local_bh_enable();
++		return verdict;
++	}
++
+ 	/* We handle fragments by dealing with the first fragment as
+ 	 * if it was a normal packet.  All other fragments are treated
+ 	 * normally, except that they will NEVER match rules that ask
+@@ -348,18 +394,6 @@ ipt_do_table(struct sk_buff *skb,
+ 	acpar.family  = NFPROTO_IPV4;
+ 	acpar.hooknum = hook;
+ 
+-	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
+-	local_bh_disable();
+-	addend = xt_write_recseq_begin();
+-	private = table->private;
+-	cpu        = smp_processor_id();
+-	table_base = private->entries[cpu];
+-	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
+-	stackptr   = per_cpu_ptr(private->stackptr, cpu);
+-	origptr    = *stackptr;
+-
+-	e = get_entry(table_base, private->hook_entry[hook]);
+-
+ 	pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n",
+ 		 table->name, hook, origptr,
+ 		 get_entry(table_base, private->underflow[hook]));
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/612-netfilter_match_reduce_memory_access.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/612-netfilter_match_reduce_memory_access.patch.svn-base
new file mode 100644
index 0000000..f506165
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/612-netfilter_match_reduce_memory_access.patch.svn-base
@@ -0,0 +1,16 @@
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -84,9 +84,11 @@ ip_packet_match(const struct iphdr *ip,
+ 	if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
+ 		return true;
+ 
+-	if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
++	if (FWINV(ipinfo->smsk.s_addr &&
++		  (ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
+ 		  IPT_INV_SRCIP) ||
+-	    FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
++	    FWINV(ipinfo->dmsk.s_addr &&
++		  (ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+ 		  IPT_INV_DSTIP)) {
+ 		dprintf("Source or dest mismatch.\n");
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/613-netfilter_optional_tcp_window_check.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/613-netfilter_optional_tcp_window_check.patch.svn-base
new file mode 100644
index 0000000..1c259d4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/613-netfilter_optional_tcp_window_check.patch.svn-base
@@ -0,0 +1,36 @@
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -29,6 +29,9 @@
+ #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
+ #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+ 
++/* Do not check the TCP window for incoming packets  */
++static int nf_ct_tcp_no_window_check __read_mostly = 1;
++
+ /* "Be conservative in what you do,
+     be liberal in what you accept from others."
+     If it's non-zero, we mark only out of window RST segments as INVALID. */
+@@ -524,6 +527,9 @@ static bool tcp_in_window(const struct n
+ 	s16 receiver_offset;
+ 	bool res;
+ 
++	if (nf_ct_tcp_no_window_check)
++		return true;
++
+ 	/*
+ 	 * Get the required data from the packet.
+ 	 */
+@@ -1321,6 +1327,13 @@ static struct ctl_table tcp_sysctl_table
+ 		.proc_handler	= proc_dointvec,
+ 	},
+ 	{
++		.procname       = "nf_conntrack_tcp_no_window_check",
++		.data           = &nf_ct_tcp_no_window_check,
++		.maxlen         = sizeof(unsigned int),
++		.mode           = 0644,
++		.proc_handler   = proc_dointvec,
++	},
++	{
+ 		.procname       = "nf_conntrack_tcp_be_liberal",
+ 		.data           = &nf_ct_tcp_be_liberal,
+ 		.maxlen         = sizeof(unsigned int),
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/620-sched_esfq.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/620-sched_esfq.patch.svn-base
new file mode 100644
index 0000000..1fdf09d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/620-sched_esfq.patch.svn-base
@@ -0,0 +1,791 @@
+--- a/include/linux/pkt_sched.h
++++ b/include/linux/pkt_sched.h
+@@ -193,6 +193,33 @@ struct tc_sfq_xstats {
+ 	__s32		allot;
+ };
+ 
++/* ESFQ section */
++
++enum
++{
++        /* traditional */
++	TCA_SFQ_HASH_CLASSIC,
++	TCA_SFQ_HASH_DST,
++	TCA_SFQ_HASH_SRC,
++	TCA_SFQ_HASH_FWMARK,
++	/* conntrack */
++	TCA_SFQ_HASH_CTORIGDST,
++	TCA_SFQ_HASH_CTORIGSRC,
++	TCA_SFQ_HASH_CTREPLDST,
++	TCA_SFQ_HASH_CTREPLSRC,
++	TCA_SFQ_HASH_CTNATCHG,
++};
++
++struct tc_esfq_qopt
++{
++	unsigned	quantum;	/* Bytes per round allocated to flow */
++	int		perturb_period;	/* Period of hash perturbation */
++	__u32		limit;		/* Maximal packets in queue */
++	unsigned	divisor;	/* Hash divisor  */
++	unsigned	flows;		/* Maximal number of flows  */
++	unsigned	hash_kind;	/* Hash function to use for flow identification */
++};
++
+ /* RED section */
+ 
+ enum {
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -148,6 +148,37 @@ config NET_SCH_SFQ
+ 	  To compile this code as a module, choose M here: the
+ 	  module will be called sch_sfq.
+ 
++config NET_SCH_ESFQ
++	tristate "Enhanced Stochastic Fairness Queueing (ESFQ)"
++	---help---
++	  Say Y here if you want to use the Enhanced Stochastic Fairness
++	  Queueing (ESFQ) packet scheduling algorithm for some of your network
++	  devices or as a leaf discipline for a classful qdisc such as HTB or
++	  CBQ (see the top of <file:net/sched/sch_esfq.c> for details and
++	  references to the SFQ algorithm).
++
++	  This is an enchanced SFQ version which allows you to control some
++	  hardcoded values in the SFQ scheduler.
++
++	  ESFQ also adds control of the hash function used to identify packet
++	  flows. The original SFQ discipline hashes by connection; ESFQ add
++	  several other hashing methods, such as by src IP or by dst IP, which
++	  can be more fair to users in some networking situations.
++
++	  To compile this code as a module, choose M here: the
++	  module will be called sch_esfq.
++
++config NET_SCH_ESFQ_NFCT
++	bool "Connection Tracking Hash Types"
++	depends on NET_SCH_ESFQ && NF_CONNTRACK
++	---help---
++	  Say Y here to enable support for hashing based on netfilter connection
++	  tracking information. This is useful for a router that is also using
++	  NAT to connect privately-addressed hosts to the Internet. If you want
++	  to provide fair distribution of upstream bandwidth, ESFQ must use
++	  connection tracking information, since all outgoing packets will share
++	  the same source address.
++
+ config NET_SCH_TEQL
+ 	tristate "True Link Equalizer (TEQL)"
+ 	---help---
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -26,6 +26,7 @@ obj-$(CONFIG_NET_SCH_INGRESS)	+= sch_ing
+ obj-$(CONFIG_NET_SCH_DSMARK)	+= sch_dsmark.o
+ obj-$(CONFIG_NET_SCH_SFB)	+= sch_sfb.o
+ obj-$(CONFIG_NET_SCH_SFQ)	+= sch_sfq.o
++obj-$(CONFIG_NET_SCH_ESFQ)	+= sch_esfq.o
+ obj-$(CONFIG_NET_SCH_TBF)	+= sch_tbf.o
+ obj-$(CONFIG_NET_SCH_TEQL)	+= sch_teql.o
+ obj-$(CONFIG_NET_SCH_PRIO)	+= sch_prio.o
+--- /dev/null
++++ b/net/sched/sch_esfq.c
+@@ -0,0 +1,702 @@
++/*
++ * net/sched/sch_esfq.c	Extended Stochastic Fairness Queueing discipline.
++ *
++ *		This program is free software; you can redistribute it and/or
++ *		modify it under the terms of the GNU General Public License
++ *		as published by the Free Software Foundation; either version
++ *		2 of the License, or (at your option) any later version.
++ *
++ * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
++ *
++ * Changes:	Alexander Atanasov, <alex@ssi.bg>
++ *		Added dynamic depth,limit,divisor,hash_kind options.
++ *		Added dst and src hashes.
++ *
++ * 		Alexander Clouter, <alex@digriz.org.uk>
++ *		Ported ESFQ to Linux 2.6.
++ *
++ * 		Corey Hickey, <bugfood-c@fatooh.org>
++ *		Maintenance of the Linux 2.6 port.
++ *		Added fwmark hash (thanks to Robert Kurjata).
++ *		Added usage of jhash.
++ *		Added conntrack support.
++ *		Added ctnatchg hash (thanks to Ben Pfountz).
++ */
++
++#include <linux/module.h>
++#include <asm/uaccess.h>
++#include <asm/system.h>
++#include <linux/bitops.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/jiffies.h>
++#include <linux/string.h>
++#include <linux/mm.h>
++#include <linux/socket.h>
++#include <linux/sockios.h>
++#include <linux/in.h>
++#include <linux/errno.h>
++#include <linux/interrupt.h>
++#include <linux/if_ether.h>
++#include <linux/inet.h>
++#include <linux/netdevice.h>
++#include <linux/etherdevice.h>
++#include <linux/notifier.h>
++#include <linux/init.h>
++#include <net/ip.h>
++#include <net/netlink.h>
++#include <linux/ipv6.h>
++#include <net/route.h>
++#include <linux/skbuff.h>
++#include <net/sock.h>
++#include <net/pkt_sched.h>
++#include <linux/jhash.h>
++#ifdef CONFIG_NET_SCH_ESFQ_NFCT
++#include <net/netfilter/nf_conntrack.h>
++#endif
++
++/*	Stochastic Fairness Queuing algorithm.
++	For more comments look at sch_sfq.c.
++	The difference is that you can change limit, depth,
++	hash table size and choose alternate hash types.
++
++	classic:	same as in sch_sfq.c
++	dst:		destination IP address
++	src:		source IP address
++	fwmark:		netfilter mark value
++	ctorigdst:	original destination IP address
++	ctorigsrc:	original source IP address
++	ctrepldst:	reply destination IP address
++	ctreplsrc:	reply source IP
++
++*/
++
++#define ESFQ_HEAD 0
++#define ESFQ_TAIL 1
++
++/* This type should contain at least SFQ_DEPTH*2 values */
++typedef unsigned int esfq_index;
++
++struct esfq_head
++{
++	esfq_index	next;
++	esfq_index	prev;
++};
++
++struct esfq_sched_data
++{
++/* Parameters */
++	int		perturb_period;
++	unsigned	quantum;	/* Allotment per round: MUST BE >= MTU */
++	int		limit;
++	unsigned	depth;
++	unsigned	hash_divisor;
++	unsigned	hash_kind;
++/* Variables */
++	struct timer_list perturb_timer;
++	int		perturbation;
++	esfq_index	tail;		/* Index of current slot in round */
++	esfq_index	max_depth;	/* Maximal depth */
++
++	esfq_index	*ht;			/* Hash table */
++	esfq_index	*next;			/* Active slots link */
++	short		*allot;			/* Current allotment per slot */
++	unsigned short	*hash;			/* Hash value indexed by slots */
++	struct sk_buff_head	*qs;		/* Slot queue */
++	struct esfq_head	*dep;		/* Linked list of slots, indexed by depth */
++};
++
++/* This contains the info we will hash. */
++struct esfq_packet_info
++{
++	u32	proto;		/* protocol or port */
++	u32	src;		/* source from packet header */
++	u32	dst;		/* destination from packet header */
++	u32	ctorigsrc;	/* original source from conntrack */
++	u32	ctorigdst;	/* original destination from conntrack */
++	u32	ctreplsrc;	/* reply source from conntrack */
++	u32	ctrepldst;	/* reply destination from conntrack */
++	u32	mark;		/* netfilter mark (fwmark) */
++};
++
++static __inline__ unsigned esfq_jhash_1word(struct esfq_sched_data *q,u32 a)
++{
++	return jhash_1word(a, q->perturbation) & (q->hash_divisor-1);
++}
++
++static __inline__ unsigned esfq_jhash_2words(struct esfq_sched_data *q, u32 a, u32 b)
++{
++	return jhash_2words(a, b, q->perturbation) & (q->hash_divisor-1);
++}
++
++static __inline__ unsigned esfq_jhash_3words(struct esfq_sched_data *q, u32 a, u32 b, u32 c)
++{
++	return jhash_3words(a, b, c, q->perturbation) & (q->hash_divisor-1);
++}
++
++static unsigned esfq_hash(struct esfq_sched_data *q, struct sk_buff *skb)
++{
++	struct esfq_packet_info info;
++#ifdef CONFIG_NET_SCH_ESFQ_NFCT
++	enum ip_conntrack_info ctinfo;
++	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
++#endif
++
++	switch (skb->protocol) {
++	case __constant_htons(ETH_P_IP):
++	{
++		struct iphdr *iph = ip_hdr(skb);
++		info.dst = iph->daddr;
++		info.src = iph->saddr;
++		if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
++		    (iph->protocol == IPPROTO_TCP ||
++		     iph->protocol == IPPROTO_UDP ||
++		     iph->protocol == IPPROTO_SCTP ||
++		     iph->protocol == IPPROTO_DCCP ||
++		     iph->protocol == IPPROTO_ESP))
++			info.proto = *(((u32*)iph) + iph->ihl);
++		else
++			info.proto = iph->protocol;
++		break;
++	}
++	case __constant_htons(ETH_P_IPV6):
++	{
++		struct ipv6hdr *iph = ipv6_hdr(skb);
++		/* Hash ipv6 addresses into a u32. This isn't ideal,
++		 * but the code is simple. */
++		info.dst = jhash2(iph->daddr.s6_addr32, 4, q->perturbation);
++		info.src = jhash2(iph->saddr.s6_addr32, 4, q->perturbation);
++		if (iph->nexthdr == IPPROTO_TCP ||
++		    iph->nexthdr == IPPROTO_UDP ||
++		    iph->nexthdr == IPPROTO_SCTP ||
++		    iph->nexthdr == IPPROTO_DCCP ||
++		    iph->nexthdr == IPPROTO_ESP)
++			info.proto = *(u32*)&iph[1];
++		else
++			info.proto = iph->nexthdr;
++		break;
++	}
++	default:
++		info.dst   = (u32)(unsigned long)skb_dst(skb);
++		info.src   = (u32)(unsigned long)skb->sk;
++		info.proto = skb->protocol;
++	}
++
++	info.mark = skb->mark;
++
++#ifdef CONFIG_NET_SCH_ESFQ_NFCT
++	/* defaults if there is no conntrack info */
++	info.ctorigsrc = info.src;
++	info.ctorigdst = info.dst;
++	info.ctreplsrc = info.dst;
++	info.ctrepldst = info.src;
++	/* collect conntrack info */
++	if (ct && ct != &nf_conntrack_untracked) {
++		if (skb->protocol == __constant_htons(ETH_P_IP)) {
++			info.ctorigsrc = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip;
++			info.ctorigdst = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.ip;
++			info.ctreplsrc = ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip;
++			info.ctrepldst = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip;
++		}
++		else if (skb->protocol == __constant_htons(ETH_P_IPV6)) {
++			/* Again, hash ipv6 addresses into a single u32. */
++			info.ctorigsrc = jhash2(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip6, 4, q->perturbation);
++			info.ctorigdst = jhash2(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.ip6, 4, q->perturbation);
++			info.ctreplsrc = jhash2(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip6, 4, q->perturbation);
++			info.ctrepldst = jhash2(ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip6, 4, q->perturbation);
++		}
++
++	}
++#endif
++
++	switch(q->hash_kind) {
++	case TCA_SFQ_HASH_CLASSIC:
++		return esfq_jhash_3words(q, info.dst, info.src, info.proto);
++	case TCA_SFQ_HASH_DST:
++		return esfq_jhash_1word(q, info.dst);
++	case TCA_SFQ_HASH_SRC:
++		return esfq_jhash_1word(q, info.src);
++	case TCA_SFQ_HASH_FWMARK:
++		return esfq_jhash_1word(q, info.mark);
++#ifdef CONFIG_NET_SCH_ESFQ_NFCT
++	case TCA_SFQ_HASH_CTORIGDST:
++		return esfq_jhash_1word(q, info.ctorigdst);
++	case TCA_SFQ_HASH_CTORIGSRC:
++		return esfq_jhash_1word(q, info.ctorigsrc);
++	case TCA_SFQ_HASH_CTREPLDST:
++		return esfq_jhash_1word(q, info.ctrepldst);
++	case TCA_SFQ_HASH_CTREPLSRC:
++		return esfq_jhash_1word(q, info.ctreplsrc);
++	case TCA_SFQ_HASH_CTNATCHG:
++	{
++		if (info.ctorigdst == info.ctreplsrc)
++			return esfq_jhash_1word(q, info.ctorigsrc);
++		return esfq_jhash_1word(q, info.ctreplsrc);
++	}
++#endif
++	default:
++		if (net_ratelimit())
++			printk(KERN_WARNING "ESFQ: Unknown hash method. Falling back to classic.\n");
++	}
++	return esfq_jhash_3words(q, info.dst, info.src, info.proto);
++}
++
++static inline void esfq_link(struct esfq_sched_data *q, esfq_index x)
++{
++	esfq_index p, n;
++	int d = q->qs[x].qlen + q->depth;
++
++	p = d;
++	n = q->dep[d].next;
++	q->dep[x].next = n;
++	q->dep[x].prev = p;
++	q->dep[p].next = q->dep[n].prev = x;
++}
++
++static inline void esfq_dec(struct esfq_sched_data *q, esfq_index x)
++{
++	esfq_index p, n;
++
++	n = q->dep[x].next;
++	p = q->dep[x].prev;
++	q->dep[p].next = n;
++	q->dep[n].prev = p;
++
++	if (n == p && q->max_depth == q->qs[x].qlen + 1)
++		q->max_depth--;
++
++	esfq_link(q, x);
++}
++
++static inline void esfq_inc(struct esfq_sched_data *q, esfq_index x)
++{
++	esfq_index p, n;
++	int d;
++
++	n = q->dep[x].next;
++	p = q->dep[x].prev;
++	q->dep[p].next = n;
++	q->dep[n].prev = p;
++	d = q->qs[x].qlen;
++	if (q->max_depth < d)
++		q->max_depth = d;
++
++	esfq_link(q, x);
++}
++
++static unsigned int esfq_drop(struct Qdisc *sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	esfq_index d = q->max_depth;
++	struct sk_buff *skb;
++	unsigned int len;
++
++	/* Queue is full! Find the longest slot and
++	   drop a packet from it */
++
++	if (d > 1) {
++		esfq_index x = q->dep[d+q->depth].next;
++		skb = q->qs[x].prev;
++		len = skb->len;
++		__skb_unlink(skb, &q->qs[x]);
++		kfree_skb(skb);
++		esfq_dec(q, x);
++		sch->q.qlen--;
++		sch->qstats.drops++;
++		sch->qstats.backlog -= len;
++		return len;
++	}
++
++	if (d == 1) {
++		/* It is difficult to believe, but ALL THE SLOTS HAVE LENGTH 1. */
++		d = q->next[q->tail];
++		q->next[q->tail] = q->next[d];
++		q->allot[q->next[d]] += q->quantum;
++		skb = q->qs[d].prev;
++		len = skb->len;
++		__skb_unlink(skb, &q->qs[d]);
++		kfree_skb(skb);
++		esfq_dec(q, d);
++		sch->q.qlen--;
++		q->ht[q->hash[d]] = q->depth;
++		sch->qstats.drops++;
++		sch->qstats.backlog -= len;
++		return len;
++	}
++
++	return 0;
++}
++
++static void esfq_q_enqueue(struct sk_buff *skb, struct esfq_sched_data *q, unsigned int end)
++{
++	unsigned hash = esfq_hash(q, skb);
++	unsigned depth = q->depth;
++	esfq_index x;
++
++	x = q->ht[hash];
++	if (x == depth) {
++		q->ht[hash] = x = q->dep[depth].next;
++		q->hash[x] = hash;
++	}
++
++	if (end == ESFQ_TAIL)
++		__skb_queue_tail(&q->qs[x], skb);
++	else
++		__skb_queue_head(&q->qs[x], skb);
++
++	esfq_inc(q, x);
++	if (q->qs[x].qlen == 1) {		/* The flow is new */
++		if (q->tail == depth) {	/* It is the first flow */
++			q->tail = x;
++			q->next[x] = x;
++			q->allot[x] = q->quantum;
++		} else {
++			q->next[x] = q->next[q->tail];
++			q->next[q->tail] = x;
++			q->tail = x;
++		}
++	}
++}
++
++static int esfq_enqueue(struct sk_buff *skb, struct Qdisc* sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	esfq_q_enqueue(skb, q, ESFQ_TAIL);
++	sch->qstats.backlog += skb->len;
++	if (++sch->q.qlen < q->limit-1) {
++		sch->bstats.bytes += skb->len;
++		sch->bstats.packets++;
++		return 0;
++	}
++
++	sch->qstats.drops++;
++	esfq_drop(sch);
++	return NET_XMIT_CN;
++}
++
++static struct sk_buff *esfq_peek(struct Qdisc* sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	esfq_index a;
++
++	/* No active slots */
++	if (q->tail == q->depth)
++		return NULL;
++
++	a = q->next[q->tail];
++	return skb_peek(&q->qs[a]);
++}
++
++static struct sk_buff *esfq_q_dequeue(struct esfq_sched_data *q)
++{
++	struct sk_buff *skb;
++	unsigned depth = q->depth;
++	esfq_index a, old_a;
++
++	/* No active slots */
++	if (q->tail == depth)
++		return NULL;
++
++	a = old_a = q->next[q->tail];
++
++	/* Grab packet */
++	skb = __skb_dequeue(&q->qs[a]);
++	esfq_dec(q, a);
++
++	/* Is the slot empty? */
++	if (q->qs[a].qlen == 0) {
++		q->ht[q->hash[a]] = depth;
++		a = q->next[a];
++		if (a == old_a) {
++			q->tail = depth;
++			return skb;
++		}
++		q->next[q->tail] = a;
++		q->allot[a] += q->quantum;
++	} else if ((q->allot[a] -= skb->len) <= 0) {
++		q->tail = a;
++		a = q->next[a];
++		q->allot[a] += q->quantum;
++	}
++
++	return skb;
++}
++
++static struct sk_buff *esfq_dequeue(struct Qdisc* sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	struct sk_buff *skb;
++
++	skb = esfq_q_dequeue(q);
++	if (skb == NULL)
++		return NULL;
++	sch->q.qlen--;
++	sch->qstats.backlog -= skb->len;
++	return skb;
++}
++
++static void esfq_q_destroy(struct esfq_sched_data *q)
++{
++	del_timer(&q->perturb_timer);
++	if(q->ht)
++		kfree(q->ht);
++	if(q->dep)
++		kfree(q->dep);
++	if(q->next)
++		kfree(q->next);
++	if(q->allot)
++		kfree(q->allot);
++	if(q->hash)
++		kfree(q->hash);
++	if(q->qs)
++		kfree(q->qs);
++}
++
++static void esfq_destroy(struct Qdisc *sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	esfq_q_destroy(q);
++}
++
++
++static void esfq_reset(struct Qdisc* sch)
++{
++	struct sk_buff *skb;
++
++	while ((skb = esfq_dequeue(sch)) != NULL)
++		kfree_skb(skb);
++}
++
++static void esfq_perturbation(unsigned long arg)
++{
++	struct Qdisc *sch = (struct Qdisc*)arg;
++	struct esfq_sched_data *q = qdisc_priv(sch);
++
++	q->perturbation = net_random()&0x1F;
++
++	if (q->perturb_period) {
++		q->perturb_timer.expires = jiffies + q->perturb_period;
++		add_timer(&q->perturb_timer);
++	}
++}
++
++static unsigned int esfq_check_hash(unsigned int kind)
++{
++	switch (kind) {
++	case TCA_SFQ_HASH_CTORIGDST:
++	case TCA_SFQ_HASH_CTORIGSRC:
++	case TCA_SFQ_HASH_CTREPLDST:
++	case TCA_SFQ_HASH_CTREPLSRC:
++	case TCA_SFQ_HASH_CTNATCHG:
++#ifndef CONFIG_NET_SCH_ESFQ_NFCT
++	{
++		if (net_ratelimit())
++			printk(KERN_WARNING "ESFQ: Conntrack hash types disabled in kernel config. Falling back to classic.\n");
++		return TCA_SFQ_HASH_CLASSIC;
++	}
++#endif
++	case TCA_SFQ_HASH_CLASSIC:
++	case TCA_SFQ_HASH_DST:
++	case TCA_SFQ_HASH_SRC:
++	case TCA_SFQ_HASH_FWMARK:
++		return kind;
++	default:
++	{
++		if (net_ratelimit())
++			printk(KERN_WARNING "ESFQ: Unknown hash type. Falling back to classic.\n");
++		return TCA_SFQ_HASH_CLASSIC;
++	}
++	}
++}
++
++static int esfq_q_init(struct esfq_sched_data *q, struct nlattr *opt)
++{
++	struct tc_esfq_qopt *ctl = nla_data(opt);
++	esfq_index p = ~0U/2;
++	int i;
++
++	if (opt && opt->nla_len < nla_attr_size(sizeof(*ctl)))
++		return -EINVAL;
++
++	q->perturbation = 0;
++	q->hash_kind = TCA_SFQ_HASH_CLASSIC;
++	q->max_depth = 0;
++	if (opt == NULL) {
++		q->perturb_period = 0;
++		q->hash_divisor = 1024;
++		q->tail = q->limit = q->depth = 128;
++
++	} else {
++		struct tc_esfq_qopt *ctl = nla_data(opt);
++		if (ctl->quantum)
++			q->quantum = ctl->quantum;
++		q->perturb_period = ctl->perturb_period*HZ;
++		q->hash_divisor = ctl->divisor ? : 1024;
++		q->tail = q->limit = q->depth = ctl->flows ? : 128;
++
++		if ( q->depth > p - 1 )
++			return -EINVAL;
++
++		if (ctl->limit)
++			q->limit = min_t(u32, ctl->limit, q->depth);
++
++		if (ctl->hash_kind) {
++			q->hash_kind = esfq_check_hash(ctl->hash_kind);
++		}
++	}
++
++	q->ht = kmalloc(q->hash_divisor*sizeof(esfq_index), GFP_KERNEL);
++	if (!q->ht)
++		goto err_case;
++	q->dep = kmalloc((1+q->depth*2)*sizeof(struct esfq_head), GFP_KERNEL);
++	if (!q->dep)
++		goto err_case;
++	q->next = kmalloc(q->depth*sizeof(esfq_index), GFP_KERNEL);
++	if (!q->next)
++		goto err_case;
++	q->allot = kmalloc(q->depth*sizeof(short), GFP_KERNEL);
++	if (!q->allot)
++		goto err_case;
++	q->hash = kmalloc(q->depth*sizeof(unsigned short), GFP_KERNEL);
++	if (!q->hash)
++		goto err_case;
++	q->qs = kmalloc(q->depth*sizeof(struct sk_buff_head), GFP_KERNEL);
++	if (!q->qs)
++		goto err_case;
++
++	for (i=0; i< q->hash_divisor; i++)
++		q->ht[i] = q->depth;
++	for (i=0; i<q->depth; i++) {
++		skb_queue_head_init(&q->qs[i]);
++		q->dep[i+q->depth].next = i+q->depth;
++		q->dep[i+q->depth].prev = i+q->depth;
++	}
++
++	for (i=0; i<q->depth; i++)
++		esfq_link(q, i);
++	return 0;
++err_case:
++	esfq_q_destroy(q);
++	return -ENOBUFS;
++}
++
++static int esfq_init(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	int err;
++
++	q->quantum = psched_mtu(qdisc_dev(sch)); /* default */
++	if ((err = esfq_q_init(q, opt)))
++		return err;
++
++	init_timer(&q->perturb_timer);
++	q->perturb_timer.data = (unsigned long)sch;
++	q->perturb_timer.function = esfq_perturbation;
++	if (q->perturb_period) {
++		q->perturb_timer.expires = jiffies + q->perturb_period;
++		add_timer(&q->perturb_timer);
++	}
++
++	return 0;
++}
++
++static int esfq_change(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	struct esfq_sched_data new;
++	struct sk_buff *skb;
++	int err;
++
++	/* set up new queue */
++	memset(&new, 0, sizeof(struct esfq_sched_data));
++	new.quantum = psched_mtu(qdisc_dev(sch)); /* default */
++	if ((err = esfq_q_init(&new, opt)))
++		return err;
++
++	/* copy all packets from the old queue to the new queue */
++	sch_tree_lock(sch);
++	while ((skb = esfq_q_dequeue(q)) != NULL)
++		esfq_q_enqueue(skb, &new, ESFQ_TAIL);
++
++	/* clean up the old queue */
++	esfq_q_destroy(q);
++
++	/* copy elements of the new queue into the old queue */
++	q->perturb_period = new.perturb_period;
++	q->quantum        = new.quantum;
++	q->limit          = new.limit;
++	q->depth          = new.depth;
++	q->hash_divisor   = new.hash_divisor;
++	q->hash_kind      = new.hash_kind;
++	q->tail           = new.tail;
++	q->max_depth      = new.max_depth;
++	q->ht    = new.ht;
++	q->dep   = new.dep;
++	q->next  = new.next;
++	q->allot = new.allot;
++	q->hash  = new.hash;
++	q->qs    = new.qs;
++
++	/* finish up */
++	if (q->perturb_period) {
++		q->perturb_timer.expires = jiffies + q->perturb_period;
++		add_timer(&q->perturb_timer);
++	} else {
++		q->perturbation = 0;
++	}
++	sch_tree_unlock(sch);
++	return 0;
++}
++
++static int esfq_dump(struct Qdisc *sch, struct sk_buff *skb)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	unsigned char *b = skb_tail_pointer(skb);
++	struct tc_esfq_qopt opt;
++
++	opt.quantum = q->quantum;
++	opt.perturb_period = q->perturb_period/HZ;
++
++	opt.limit = q->limit;
++	opt.divisor = q->hash_divisor;
++	opt.flows = q->depth;
++	opt.hash_kind = q->hash_kind;
++
++	NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
++
++	return skb->len;
++
++nla_put_failure:
++	nlmsg_trim(skb, b);
++	return -1;
++}
++
++static struct Qdisc_ops esfq_qdisc_ops =
++{
++	.next		=	NULL,
++	.cl_ops		=	NULL,
++	.id		=	"esfq",
++	.priv_size	=	sizeof(struct esfq_sched_data),
++	.enqueue	=	esfq_enqueue,
++	.dequeue	=	esfq_dequeue,
++	.peek		=	esfq_peek,
++	.drop		=	esfq_drop,
++	.init		=	esfq_init,
++	.reset		=	esfq_reset,
++	.destroy	=	esfq_destroy,
++	.change		=	esfq_change,
++	.dump		=	esfq_dump,
++	.owner		=	THIS_MODULE,
++};
++
++static int __init esfq_module_init(void)
++{
++	return register_qdisc(&esfq_qdisc_ops);
++}
++static void __exit esfq_module_exit(void)
++{
++	unregister_qdisc(&esfq_qdisc_ops);
++}
++module_init(esfq_module_init)
++module_exit(esfq_module_exit)
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/621-sched_act_connmark.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/621-sched_act_connmark.patch.svn-base
new file mode 100644
index 0000000..b6adce1
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/621-sched_act_connmark.patch.svn-base
@@ -0,0 +1,172 @@
+--- /dev/null
++++ b/net/sched/act_connmark.c
+@@ -0,0 +1,137 @@
++/*
++ * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
++ * Place - Suite 330, Boston, MA 02111-1307 USA.
++ */
++
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/skbuff.h>
++#include <linux/rtnetlink.h>
++#include <linux/pkt_cls.h>
++#include <linux/ip.h>
++#include <linux/ipv6.h>
++#include <net/netlink.h>
++#include <net/pkt_sched.h>
++#include <net/act_api.h>
++
++#include <net/netfilter/nf_conntrack.h>
++#include <net/netfilter/nf_conntrack_core.h>
++
++#define TCA_ACT_CONNMARK	20
++
++#define CONNMARK_TAB_MASK     3
++static struct tcf_common *tcf_connmark_ht[CONNMARK_TAB_MASK + 1];
++static u32 connmark_idx_gen;
++static DEFINE_RWLOCK(connmark_lock);
++
++static struct tcf_hashinfo connmark_hash_info = {
++	.htab	=	tcf_connmark_ht,
++	.hmask	=	CONNMARK_TAB_MASK,
++	.lock	=	&connmark_lock,
++};
++
++static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a,
++		       struct tcf_result *res)
++{
++	struct nf_conn *c;
++	enum ip_conntrack_info ctinfo;
++	int proto;
++	int r;
++
++	if (skb->protocol == htons(ETH_P_IP)) {
++		if (skb->len < sizeof(struct iphdr))
++			goto out;
++		proto = PF_INET;
++	} else if (skb->protocol == htons(ETH_P_IPV6)) {
++		if (skb->len < sizeof(struct ipv6hdr))
++			goto out;
++		proto = PF_INET6;
++	} else
++		goto out;
++
++	r = nf_conntrack_in(dev_net(skb->dev), proto, NF_INET_PRE_ROUTING, skb);
++	if (r != NF_ACCEPT)
++		goto out;
++
++	c = nf_ct_get(skb, &ctinfo);
++	if (!c)
++		goto out;
++
++	skb->mark = c->mark;
++	nf_conntrack_put(skb->nfct);
++	skb->nfct = NULL;
++
++out:
++	return TC_ACT_PIPE;
++}
++
++static int tcf_connmark_init(struct nlattr *nla, struct nlattr *est,
++			 struct tc_action *a, int ovr, int bind)
++{
++	struct tcf_common *pc;
++
++	pc = tcf_hash_create(0, est, a, sizeof(*pc), bind,
++			     &connmark_idx_gen, &connmark_hash_info);
++	if (IS_ERR(pc))
++	    return PTR_ERR(pc);
++
++	tcf_hash_insert(pc, &connmark_hash_info);
++
++	return ACT_P_CREATED;
++}
++
++static inline int tcf_connmark_cleanup(struct tc_action *a, int bind)
++{
++	if (a->priv)
++		return tcf_hash_release(a->priv, bind, &connmark_hash_info);
++	return 0;
++}
++
++static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
++				int bind, int ref)
++{
++	return skb->len;
++}
++
++static struct tc_action_ops act_connmark_ops = {
++	.kind		=	"connmark",
++	.hinfo		=	&connmark_hash_info,
++	.type		=	TCA_ACT_CONNMARK,
++	.capab		=	TCA_CAP_NONE,
++	.owner		=	THIS_MODULE,
++	.act		=	tcf_connmark,
++	.dump		=	tcf_connmark_dump,
++	.cleanup	=	tcf_connmark_cleanup,
++	.init		=	tcf_connmark_init,
++	.walk		=	tcf_generic_walker,
++};
++
++MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
++MODULE_DESCRIPTION("Connection tracking mark restoring");
++MODULE_LICENSE("GPL");
++
++static int __init connmark_init_module(void)
++{
++	return tcf_register_action(&act_connmark_ops);
++}
++
++static void __exit connmark_cleanup_module(void)
++{
++	tcf_unregister_action(&act_connmark_ops);
++}
++
++module_init(connmark_init_module);
++module_exit(connmark_cleanup_module);
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -624,6 +624,19 @@ config NET_ACT_CSUM
+ 	  To compile this code as a module, choose M here: the
+ 	  module will be called act_csum.
+ 
++config NET_ACT_CONNMARK
++        tristate "Connection Tracking Marking"
++        depends on NET_CLS_ACT
++        depends on NF_CONNTRACK
++	 depends on NF_CONNTRACK_MARK
++        ---help---
++	  Say Y here to restore the connmark from a scheduler action
++
++	  If unsure, say N.
++
++	  To compile this code as a module, choose M here: the
++	  module will be called act_connmark.
++
+ config NET_CLS_IND
+ 	bool "Incoming device classification"
+ 	depends on NET_CLS_U32 || NET_CLS_FW
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -16,6 +16,7 @@ obj-$(CONFIG_NET_ACT_PEDIT)	+= act_pedit
+ obj-$(CONFIG_NET_ACT_SIMP)	+= act_simple.o
+ obj-$(CONFIG_NET_ACT_SKBEDIT)	+= act_skbedit.o
+ obj-$(CONFIG_NET_ACT_CSUM)	+= act_csum.o
++obj-$(CONFIG_NET_ACT_CONNMARK)	+= act_connmark.o
+ obj-$(CONFIG_NET_SCH_FIFO)	+= sch_fifo.o
+ obj-$(CONFIG_NET_SCH_CBQ)	+= sch_cbq.o
+ obj-$(CONFIG_NET_SCH_HTB)	+= sch_htb.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/630-packet_socket_type.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/630-packet_socket_type.patch.svn-base
new file mode 100644
index 0000000..231b745
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/630-packet_socket_type.patch.svn-base
@@ -0,0 +1,132 @@
+This patch allows the user to specify desired packet types (outgoing,
+broadcast, unicast, etc.) on packet sockets via setsockopt.
+This can reduce the load in situations where only a limited number
+of packet types are necessary
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+--- a/include/linux/if_packet.h
++++ b/include/linux/if_packet.h
+@@ -29,6 +29,8 @@ struct sockaddr_ll {
+ /* These ones are invisible by user level */
+ #define PACKET_LOOPBACK		5		/* MC/BRD frame looped back */
+ #define PACKET_FASTROUTE	6		/* Fastrouted frame	*/
++#define PACKET_MASK_ANY		0xffffffff	/* mask for packet type bits */
++
+ 
+ /* Packet socket options */
+ 
+@@ -50,6 +52,7 @@ struct sockaddr_ll {
+ #define PACKET_TX_TIMESTAMP		16
+ #define PACKET_TIMESTAMP		17
+ #define PACKET_FANOUT			18
++#define PACKET_RECV_TYPE		19
+ 
+ #define PACKET_FANOUT_HASH		0
+ #define PACKET_FANOUT_LB		1
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -296,6 +296,7 @@ struct packet_sock {
+ 	unsigned int		tp_loss:1;
+ 	unsigned int		tp_tstamp;
+ 	struct packet_type	prot_hook ____cacheline_aligned_in_smp;
++	unsigned int		pkt_type;
+ };
+ 
+ #define PACKET_FANOUT_MAX	256
+@@ -1383,6 +1384,7 @@ static int packet_rcv_spkt(struct sk_buf
+ {
+ 	struct sock *sk;
+ 	struct sockaddr_pkt *spkt;
++	struct packet_sock *po;
+ 
+ 	/*
+ 	 *	When we registered the protocol we saved the socket in the data
+@@ -1390,6 +1392,7 @@ static int packet_rcv_spkt(struct sk_buf
+ 	 */
+ 
+ 	sk = pt->af_packet_priv;
++	po = pkt_sk(sk);
+ 
+ 	/*
+ 	 *	Yank back the headers [hope the device set this
+@@ -1402,7 +1405,7 @@ static int packet_rcv_spkt(struct sk_buf
+ 	 *	so that this procedure is noop.
+ 	 */
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
+ 		goto out;
+ 
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+@@ -1596,12 +1599,12 @@ static int packet_rcv(struct sk_buff *sk
+ 	int skb_len = skb->len;
+ 	unsigned int snaplen, res;
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
+-		goto drop;
+-
+ 	sk = pt->af_packet_priv;
+ 	po = pkt_sk(sk);
+ 
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
++		goto drop;
++
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+ 		goto drop;
+ 
+@@ -1720,12 +1723,12 @@ static int tpacket_rcv(struct sk_buff *s
+ 	struct timespec ts;
+ 	struct skb_shared_hwtstamps *shhwtstamps = skb_hwtstamps(skb);
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
+-		goto drop;
+-
+ 	sk = pt->af_packet_priv;
+ 	po = pkt_sk(sk);
+ 
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
++		goto drop;
++
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+ 		goto drop;
+ 
+@@ -2595,6 +2598,7 @@ static int packet_create(struct net *net
+ 	spin_lock_init(&po->bind_lock);
+ 	mutex_init(&po->pg_vec_lock);
+ 	po->prot_hook.func = packet_rcv;
++	po->pkt_type = PACKET_MASK_ANY & ~(1 << PACKET_LOOPBACK);
+ 
+ 	if (sock->type == SOCK_PACKET)
+ 		po->prot_hook.func = packet_rcv_spkt;
+@@ -3192,6 +3196,16 @@ packet_setsockopt(struct socket *sock, i
+ 
+ 		return fanout_add(sk, val & 0xffff, val >> 16);
+ 	}
++        case PACKET_RECV_TYPE:
++        {
++                unsigned int val;
++                if (optlen != sizeof(val))
++                        return -EINVAL;
++                if (copy_from_user(&val, optval, sizeof(val)))
++                        return -EFAULT;
++                po->pkt_type = val & ~PACKET_LOOPBACK;
++                return 0;
++        }
+ 	default:
+ 		return -ENOPROTOOPT;
+ 	}
+@@ -3262,6 +3276,13 @@ static int packet_getsockopt(struct sock
+ 
+ 		data = &val;
+ 		break;
++	case PACKET_RECV_TYPE:
++		if (len > sizeof(unsigned int))
++			len = sizeof(unsigned int);
++		val = po->pkt_type;
++
++		data = &val;
++		break;
+ 	case PACKET_VERSION:
+ 		if (len > sizeof(int))
+ 			len = sizeof(int);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/640-bridge_no_eap_forward.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/640-bridge_no_eap_forward.patch.svn-base
new file mode 100644
index 0000000..bbdb3bf
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/640-bridge_no_eap_forward.patch.svn-base
@@ -0,0 +1,15 @@
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -78,7 +78,11 @@ int br_handle_frame_finish(struct sk_buf
+ 
+ 	dst = NULL;
+ 
+-	if (is_broadcast_ether_addr(dest))
++	if (skb->protocol == htons(ETH_P_PAE)) {
++		skb2 = skb;
++		/* Do not forward 802.1x/EAP frames */
++		skb = NULL;
++	} else if (is_broadcast_ether_addr(dest))
+ 		skb2 = skb;
+ 	else if (is_multicast_ether_addr(dest)) {
+ 		mdst = br_mdb_get(br, skb);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/641-bridge_always_accept_eap.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/641-bridge_always_accept_eap.patch.svn-base
new file mode 100644
index 0000000..e04199b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/641-bridge_always_accept_eap.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -65,7 +65,7 @@ int br_handle_frame_finish(struct sk_buf
+ 	    br_multicast_rcv(br, p, skb))
+ 		goto drop;
+ 
+-	if (p->state == BR_STATE_LEARNING)
++	if ((p->state == BR_STATE_LEARNING) && skb->protocol != htons(ETH_P_PAE))
+ 		goto drop;
+ 
+ 	BR_INPUT_SKB_CB(skb)->brdev = br->dev;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/642-bridge_port_isolate.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/642-bridge_port_isolate.patch.svn-base
new file mode 100644
index 0000000..68434bf
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/642-bridge_port_isolate.patch.svn-base
@@ -0,0 +1,103 @@
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -135,6 +135,7 @@ struct net_bridge_port
+ 
+ 	unsigned long 			flags;
+ #define BR_HAIRPIN_MODE		0x00000001
++#define BR_ISOLATE_MODE		0x00000002
+ 
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+ 	u32				multicast_startup_queries_sent;
+--- a/net/bridge/br_sysfs_if.c
++++ b/net/bridge/br_sysfs_if.c
+@@ -149,6 +149,22 @@ static int store_hairpin_mode(struct net
+ static BRPORT_ATTR(hairpin_mode, S_IRUGO | S_IWUSR,
+ 		   show_hairpin_mode, store_hairpin_mode);
+ 
++static ssize_t show_isolate_mode(struct net_bridge_port *p, char *buf)
++{
++	int isolate_mode = (p->flags & BR_ISOLATE_MODE) ? 1 : 0;
++	return sprintf(buf, "%d\n", isolate_mode);
++}
++static ssize_t store_isolate_mode(struct net_bridge_port *p, unsigned long v)
++{
++	if (v)
++		p->flags |= BR_ISOLATE_MODE;
++	else
++		p->flags &= ~BR_ISOLATE_MODE;
++	return 0;
++}
++static BRPORT_ATTR(isolate_mode, S_IRUGO | S_IWUSR,
++		   show_isolate_mode, store_isolate_mode);
++
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+ static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
+ {
+@@ -181,6 +197,7 @@ static struct brport_attribute *brport_a
+ 	&brport_attr_hold_timer,
+ 	&brport_attr_flush,
+ 	&brport_attr_hairpin_mode,
++	&brport_attr_isolate_mode,
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+ 	&brport_attr_multicast_router,
+ #endif
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -98,7 +98,8 @@ int br_handle_frame_finish(struct sk_buf
+ 			skb2 = skb;
+ 
+ 		br->dev->stats.multicast++;
+-	} else if ((dst = __br_fdb_get(br, dest)) && dst->is_local) {
++	} else if ((p->flags & BR_ISOLATE_MODE) ||
++		   ((dst = __br_fdb_get(br, dest)) && dst->is_local)) {
+ 		skb2 = skb;
+ 		/* Do not forward the packet since it's local. */
+ 		skb = NULL;
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -109,7 +109,7 @@ void br_deliver(const struct net_bridge_
+ /* called with rcu_read_lock */
+ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, struct sk_buff *skb0)
+ {
+-	if (should_deliver(to, skb)) {
++	if (should_deliver(to, skb) && !(to->flags & BR_ISOLATE_MODE)) {
+ 		if (skb0)
+ 			deliver_clone(to, skb, __br_forward);
+ 		else
+@@ -164,7 +164,8 @@ out:
+ static void br_flood(struct net_bridge *br, struct sk_buff *skb,
+ 		     struct sk_buff *skb0,
+ 		     void (*__packet_hook)(const struct net_bridge_port *p,
+-					   struct sk_buff *skb))
++					   struct sk_buff *skb),
++		     bool forward)
+ {
+ 	struct net_bridge_port *p;
+ 	struct net_bridge_port *prev;
+@@ -172,6 +173,9 @@ static void br_flood(struct net_bridge *
+ 	prev = NULL;
+ 
+ 	list_for_each_entry_rcu(p, &br->port_list, list) {
++		if (forward && (p->flags & BR_ISOLATE_MODE))
++			continue;
++
+ 		prev = maybe_deliver(prev, p, skb, __packet_hook);
+ 		if (IS_ERR(prev))
+ 			goto out;
+@@ -195,14 +199,14 @@ out:
+ /* called with rcu_read_lock */
+ void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb)
+ {
+-	br_flood(br, skb, NULL, __br_deliver);
++	br_flood(br, skb, NULL, __br_deliver, false);
+ }
+ 
+ /* called under bridge lock */
+ void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
+ 		      struct sk_buff *skb2)
+ {
+-	br_flood(br, skb, skb2, __br_forward);
++	br_flood(br, skb, skb2, __br_forward, true);
+ }
+ 
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/643-bridge_remove_ipv6_dependency.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/643-bridge_remove_ipv6_dependency.patch.svn-base
new file mode 100644
index 0000000..301b6be
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/643-bridge_remove_ipv6_dependency.patch.svn-base
@@ -0,0 +1,107 @@
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -91,6 +91,12 @@ extern void			addrconf_join_solict(struc
+ extern void			addrconf_leave_solict(struct inet6_dev *idev,
+ 					const struct in6_addr *addr);
+ 
++extern int			(*ipv6_dev_get_saddr_hook)(struct net *net,
++						struct net_device *dev,
++						const struct in6_addr *daddr,
++						unsigned int srcprefs,
++						struct in6_addr *saddr);
++
+ static inline unsigned long addrconf_timeout_fixup(u32 timeout,
+ 						    unsigned unit)
+ {
+--- a/net/bridge/Kconfig
++++ b/net/bridge/Kconfig
+@@ -6,7 +6,6 @@ config BRIDGE
+ 	tristate "802.1d Ethernet Bridging"
+ 	select LLC
+ 	select STP
+-	depends on IPV6 || IPV6=n
+ 	---help---
+ 	  If you say Y here, then your Linux box will be able to act as an
+ 	  Ethernet bridge, which means that the different Ethernet segments it
+--- a/net/ipv6/Makefile
++++ b/net/ipv6/Makefile
+@@ -40,3 +40,4 @@ obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.
+ obj-y += addrconf_core.o exthdrs_core.o
+ 
+ obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_hashtables.o
++obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_stubs.o
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1103,7 +1103,7 @@ out:
+ 	return ret;
+ }
+ 
+-int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
++static int __ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
+ 		       const struct in6_addr *daddr, unsigned int prefs,
+ 		       struct in6_addr *saddr)
+ {
+@@ -1228,7 +1228,6 @@ try_nextdev:
+ 	in6_ifa_put(hiscore->ifa);
+ 	return 0;
+ }
+-EXPORT_SYMBOL(ipv6_dev_get_saddr);
+ 
+ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
+ 		    unsigned char banned_flags)
+@@ -4840,6 +4839,9 @@ int __init addrconf_init(void)
+ 
+ 	ipv6_addr_label_rtnl_register();
+ 
++	BUG_ON(ipv6_dev_get_saddr_hook != NULL);
++	rcu_assign_pointer(ipv6_dev_get_saddr_hook, __ipv6_dev_get_saddr);
++
+ 	return 0;
+ errout:
+ 	rtnl_af_unregister(&inet6_ops);
+@@ -4858,6 +4860,9 @@ void addrconf_cleanup(void)
+ 	struct net_device *dev;
+ 	int i;
+ 
++	rcu_assign_pointer(ipv6_dev_get_saddr_hook, NULL);
++	synchronize_rcu();
++
+ 	unregister_netdevice_notifier(&ipv6_dev_notf);
+ 	unregister_pernet_subsys(&addrconf_ops);
+ 	ipv6_addr_label_cleanup();
+--- /dev/null
++++ b/net/ipv6/inet6_stubs.c
+@@ -0,0 +1,33 @@
++/*
++ *      This program is free software; you can redistribute it and/or
++ *      modify it under the terms of the GNU General Public License
++ *      as published by the Free Software Foundation; either version
++ *      2 of the License, or (at your option) any later version.
++ */
++#include <linux/export.h>
++#include <net/ipv6.h>
++
++int (*ipv6_dev_get_saddr_hook)(struct net *net, struct net_device *dev,
++			const struct in6_addr *daddr, unsigned int srcprefs,
++			struct in6_addr *saddr);
++
++EXPORT_SYMBOL(ipv6_dev_get_saddr_hook);
++
++int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
++			const struct in6_addr *daddr, unsigned int prefs,
++			struct in6_addr *saddr)
++{
++	int ret = -EADDRNOTAVAIL;
++	typeof(ipv6_dev_get_saddr_hook) dev_get_saddr;
++
++	rcu_read_lock();
++	dev_get_saddr = rcu_dereference(ipv6_dev_get_saddr_hook);
++
++	if (dev_get_saddr)
++		ret = dev_get_saddr(net, dst_dev, daddr, prefs, saddr);
++
++	rcu_read_unlock();
++	return ret;
++}
++EXPORT_SYMBOL(ipv6_dev_get_saddr);
++
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/644-bridge_optimize_netfilter_hooks.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/644-bridge_optimize_netfilter_hooks.patch.svn-base
new file mode 100644
index 0000000..dafe420
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/644-bridge_optimize_netfilter_hooks.patch.svn-base
@@ -0,0 +1,146 @@
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -55,7 +55,7 @@ int br_dev_queue_push_xmit(struct sk_buf
+ 
+ int br_forward_finish(struct sk_buff *skb)
+ {
+-	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
++	return BR_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
+ 		       br_dev_queue_push_xmit);
+ 
+ }
+@@ -74,7 +74,7 @@ static void __br_deliver(const struct ne
+ 		return;
+ 	}
+ 
+-	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
++	BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+ 		br_forward_finish);
+ }
+ 
+@@ -91,7 +91,7 @@ static void __br_forward(const struct ne
+ 	skb->dev = to->dev;
+ 	skb_forward_csum(skb);
+ 
+-	NF_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
++	BR_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
+ 		br_forward_finish);
+ }
+ 
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -40,7 +40,7 @@ static int br_pass_frame_up(struct sk_bu
+ 	indev = skb->dev;
+ 	skb->dev = brdev;
+ 
+-	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, indev, NULL,
++	return BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, indev, NULL,
+ 		       netif_receive_skb);
+ }
+ 
+@@ -199,7 +199,7 @@ rx_handler_result_t br_handle_frame(stru
+ 		}
+ 
+ 		/* Deliver packet to local host only */
+-		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
++		if (BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
+ 			    NULL, br_handle_local_finish)) {
+ 			return RX_HANDLER_CONSUMED; /* consumed by filter */
+ 		} else {
+@@ -224,7 +224,7 @@ forward:
+ 		if (!compare_ether_addr(p->br->dev->dev_addr, dest))
+ 			skb->pkt_type = PACKET_HOST;
+ 
+-		NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
++		BR_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
+ 			br_handle_frame_finish);
+ 		break;
+ 	default:
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -753,7 +753,7 @@ static void __br_multicast_send_query(st
+ 	if (port) {
+ 		__skb_push(skb, sizeof(struct ethhdr));
+ 		skb->dev = port->dev;
+-		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
++		BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+ 			dev_queue_xmit);
+ 	} else
+ 		netif_rx(skb);
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -71,6 +71,15 @@ static int brnf_filter_pppoe_tagged __re
+ #define IS_ARP(skb) \
+ 	(!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
+ 
++int brnf_call_ebtables __read_mostly = 0;
++EXPORT_SYMBOL_GPL(brnf_call_ebtables);
++
++bool br_netfilter_run_hooks(void)
++{
++	return brnf_call_iptables | brnf_call_ip6tables | brnf_call_arptables |
++	       brnf_call_ebtables;
++}
++
+ static inline __be16 vlan_proto(const struct sk_buff *skb)
+ {
+ 	if (vlan_tx_tag_present(skb))
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -486,15 +486,29 @@ static inline bool br_multicast_is_route
+ 
+ /* br_netfilter.c */
+ #ifdef CONFIG_BRIDGE_NETFILTER
++extern int brnf_call_ebtables;
+ extern int br_netfilter_init(void);
+ extern void br_netfilter_fini(void);
+ extern void br_netfilter_rtable_init(struct net_bridge *);
++extern bool br_netfilter_run_hooks(void);
+ #else
+ #define br_netfilter_init()	(0)
+ #define br_netfilter_fini()	do { } while(0)
+ #define br_netfilter_rtable_init(x)
++#define br_netfilter_run_hooks()	false
+ #endif
+ 
++static inline int
++BR_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb,
++	struct net_device *in, struct net_device *out,
++	int (*okfn)(struct sk_buff *))
++{
++	if (!br_netfilter_run_hooks())
++		return okfn(skb);
++
++	return NF_HOOK(pf, hook, skb, in, out, okfn);
++}
++
+ /* br_stp.c */
+ extern void br_log_state(const struct net_bridge_port *p);
+ extern struct net_bridge_port *br_get_port(struct net_bridge *br,
+--- a/net/bridge/br_stp_bpdu.c
++++ b/net/bridge/br_stp_bpdu.c
+@@ -52,7 +52,7 @@ static void br_send_bpdu(struct net_brid
+ 
+ 	skb_reset_mac_header(skb);
+ 
+-	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
++	BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+ 		dev_queue_xmit);
+ }
+ 
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2403,11 +2403,13 @@ static int __init ebtables_init(void)
+ 	}
+ 
+ 	printk(KERN_INFO "Ebtables v2.0 registered\n");
++	brnf_call_ebtables = 1;
+ 	return 0;
+ }
+ 
+ static void __exit ebtables_fini(void)
+ {
++	brnf_call_ebtables = 0;
+ 	nf_unregister_sockopt(&ebt_sockopts);
+ 	xt_unregister_target(&ebt_standard_target);
+ 	printk(KERN_INFO "Ebtables v2.0 unregistered\n");
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/650-pppoe_header_pad.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/650-pppoe_header_pad.patch.svn-base
new file mode 100644
index 0000000..5862dc1
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/650-pppoe_header_pad.patch.svn-base
@@ -0,0 +1,20 @@
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -856,7 +856,7 @@ static int pppoe_sendmsg(struct kiocb *i
+ 		goto end;
+ 
+ 
+-	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32,
++	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32 + NET_SKB_PAD,
+ 			   0, GFP_KERNEL);
+ 	if (!skb) {
+ 		error = -ENOMEM;
+@@ -864,7 +864,7 @@ static int pppoe_sendmsg(struct kiocb *i
+ 	}
+ 
+ 	/* Reserve space for headers. */
+-	skb_reserve(skb, dev->hard_header_len);
++	skb_reserve(skb, dev->hard_header_len + NET_SKB_PAD);
+ 	skb_reset_network_header(skb);
+ 
+ 	skb->dev = dev;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/651-wireless_mesh_header.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/651-wireless_mesh_header.patch.svn-base
new file mode 100644
index 0000000..5c83d19
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/651-wireless_mesh_header.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -145,7 +145,7 @@ static inline bool dev_xmit_complete(int
+  */
+ 
+ #if defined(CONFIG_WLAN) || IS_ENABLED(CONFIG_AX25)
+-# if defined(CONFIG_MAC80211_MESH)
++# if 1 || defined(CONFIG_MAC80211_MESH)
+ #  define LL_MAX_HEADER 128
+ # else
+ #  define LL_MAX_HEADER 96
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/652-atm_header_changes.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/652-atm_header_changes.patch.svn-base
new file mode 100644
index 0000000..238d6f8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/652-atm_header_changes.patch.svn-base
@@ -0,0 +1,12 @@
+--- a/include/linux/atm.h
++++ b/include/linux/atm.h
+@@ -139,6 +139,9 @@ struct atm_trafprm {
+ 	int		min_pcr;	/* minimum PCR in cells per second */
+ 	int		max_cdv;	/* maximum CDV in microseconds */
+ 	int		max_sdu;	/* maximum SDU in bytes */
++	int		scr;		/* sustained rate in cells per second */
++	int		mbs;		/* maximum burst size (MBS) in cells */
++	int		cdv;		/* Cell delay varition */
+         /* extra params for ABR */
+         unsigned int 	icr;         	/* Initial Cell Rate (24-bit) */
+         unsigned int	tbe;		/* Transient Buffer Exposure (24-bit) */ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/653-disable_netlink_trim.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/653-disable_netlink_trim.patch.svn-base
new file mode 100644
index 0000000..ffa6502
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/653-disable_netlink_trim.patch.svn-base
@@ -0,0 +1,28 @@
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -854,25 +854,7 @@ void netlink_detachskb(struct sock *sk,
+ 
+ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
+ {
+-	int delta;
+-
+ 	skb_orphan(skb);
+-
+-	delta = skb->end - skb->tail;
+-	if (delta * 2 < skb->truesize)
+-		return skb;
+-
+-	if (skb_shared(skb)) {
+-		struct sk_buff *nskb = skb_clone(skb, allocation);
+-		if (!nskb)
+-			return skb;
+-		kfree_skb(skb);
+-		skb = nskb;
+-	}
+-
+-	if (!pskb_expand_head(skb, 0, -delta, allocation))
+-		skb->truesize -= delta;
+-
+ 	return skb;
+ }
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/654-avoid_skb_cow_realloc.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/654-avoid_skb_cow_realloc.patch.svn-base
new file mode 100644
index 0000000..5b25371
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/654-avoid_skb_cow_realloc.patch.svn-base
@@ -0,0 +1,21 @@
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1850,12 +1850,15 @@ static inline int skb_clone_writable(con
+ static inline int __skb_cow(struct sk_buff *skb, unsigned int headroom,
+ 			    int cloned)
+ {
++	unsigned int alloc_headroom = headroom;
+ 	int delta = 0;
+ 
+ 	if (headroom < NET_SKB_PAD)
+-		headroom = NET_SKB_PAD;
+-	if (headroom > skb_headroom(skb))
+-		delta = headroom - skb_headroom(skb);
++		alloc_headroom = NET_SKB_PAD;
++	if (headroom > skb_headroom(skb) ||
++	    (cloned && alloc_headroom > skb_headroom(skb))) {
++		delta = alloc_headroom - skb_headroom(skb);
++	}
+ 
+ 	if (delta || cloned)
+ 		return pskb_expand_head(skb, ALIGN(delta, NET_SKB_PAD), 0,
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/655-increase_skb_pad.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/655-increase_skb_pad.patch.svn-base
new file mode 100644
index 0000000..5d14daa
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/655-increase_skb_pad.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1558,7 +1558,7 @@ static inline int pskb_network_may_pull(
+  * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
+  */
+ #ifndef NET_SKB_PAD
+-#define NET_SKB_PAD	max(32, L1_CACHE_BYTES)
++#define NET_SKB_PAD	max(48, L1_CACHE_BYTES)
+ #endif
+ 
+ extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/700-swconfig.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/700-swconfig.patch.svn-base
new file mode 100644
index 0000000..a200943
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/700-swconfig.patch.svn-base
@@ -0,0 +1,39 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -13,6 +13,16 @@ menuconfig PHYLIB
+ 
+ if PHYLIB
+ 
++config SWCONFIG
++	tristate "Switch configuration API"
++	---help---
++	  Switch configuration API using netlink. This allows
++	  you to configure the VLAN features of certain switches.
++
++config SWCONFIG_LEDS
++	bool "Switch LED trigger support"
++	depends on (SWCONFIG && LEDS_TRIGGERS)
++
+ comment "MII PHY device drivers"
+ 
+ config MARVELL_PHY
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -3,6 +3,7 @@
+ libphy-objs			:= phy.o phy_device.o mdio_bus.o
+ 
+ obj-$(CONFIG_PHYLIB)		+= libphy.o
++obj-$(CONFIG_SWCONFIG)		+= swconfig.o
+ obj-$(CONFIG_MARVELL_PHY)	+= marvell.o
+ obj-$(CONFIG_DAVICOM_PHY)	+= davicom.o
+ obj-$(CONFIG_CICADA_PHY)	+= cicada.o
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -354,6 +354,7 @@ header-y += stddef.h
+ header-y += string.h
+ header-y += suspend_ioctls.h
+ header-y += swab.h
++header-y += switch.h
+ header-y += synclink.h
+ header-y += sysctl.h
+ header-y += taskstats.h
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/701-phy_extension.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/701-phy_extension.patch.svn-base
new file mode 100644
index 0000000..201c857
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/701-phy_extension.patch.svn-base
@@ -0,0 +1,72 @@
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -299,6 +299,50 @@ int phy_ethtool_gset(struct phy_device *
+ }
+ EXPORT_SYMBOL(phy_ethtool_gset);
+ 
++int phy_ethtool_ioctl(struct phy_device *phydev, void *useraddr)
++{
++	u32 cmd;
++	int tmp;
++	struct ethtool_cmd ecmd = { ETHTOOL_GSET };
++	struct ethtool_value edata = { ETHTOOL_GLINK };
++
++	if (get_user(cmd, (u32 *) useraddr))
++		return -EFAULT;
++
++	switch (cmd) {
++	case ETHTOOL_GSET:
++		phy_ethtool_gset(phydev, &ecmd);
++		if (copy_to_user(useraddr, &ecmd, sizeof(ecmd)))
++			return -EFAULT;
++		return 0;
++
++	case ETHTOOL_SSET:
++		if (copy_from_user(&ecmd, useraddr, sizeof(ecmd)))
++			return -EFAULT;
++		return phy_ethtool_sset(phydev, &ecmd);
++
++	case ETHTOOL_NWAY_RST:
++		/* if autoneg is off, it's an error */
++		tmp = phy_read(phydev, MII_BMCR);
++		if (tmp & BMCR_ANENABLE) {
++			tmp |= (BMCR_ANRESTART);
++			phy_write(phydev, MII_BMCR, tmp);
++			return 0;
++		}
++		return -EINVAL;
++
++	case ETHTOOL_GLINK:
++		edata.data = (phy_read(phydev,
++				MII_BMSR) & BMSR_LSTATUS) ? 1 : 0;
++		if (copy_to_user(useraddr, &edata, sizeof(edata)))
++			return -EFAULT;
++		return 0;
++	}
++
++	return -EOPNOTSUPP;
++}
++EXPORT_SYMBOL(phy_ethtool_ioctl);
++
+ /**
+  * phy_mii_ioctl - generic PHY MII ioctl interface
+  * @phydev: the phy_device struct
+@@ -474,7 +518,7 @@ static void phy_force_reduction(struct p
+ 	int idx;
+ 
+ 	idx = phy_find_setting(phydev->speed, phydev->duplex);
+-	
++
+ 	idx++;
+ 
+ 	idx = phy_find_valid(idx, phydev->supported);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -515,6 +515,7 @@ void phy_start_machine(struct phy_device
+ void phy_stop_machine(struct phy_device *phydev);
+ int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd);
+ int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd);
++int phy_ethtool_ioctl(struct phy_device *phydev, void *useraddr);
+ int phy_mii_ioctl(struct phy_device *phydev,
+ 		struct ifreq *ifr, int cmd);
+ int phy_start_interrupts(struct phy_device *phydev);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/702-phy_add_aneg_done_function.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/702-phy_add_aneg_done_function.patch.svn-base
new file mode 100644
index 0000000..0649afb
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/702-phy_add_aneg_done_function.patch.svn-base
@@ -0,0 +1,45 @@
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -393,9 +393,18 @@ struct phy_driver {
+ 	 */
+ 	int (*config_aneg)(struct phy_device *phydev);
+ 
++	/* Determine if autonegotiation is done */
++	int (*aneg_done)(struct phy_device *phydev);
++
+ 	/* Determines the negotiated speed and duplex */
+ 	int (*read_status)(struct phy_device *phydev);
+ 
++	/* 
++	 * Update the value in phydev->link to reflect the 
++	 * current link value
++	 */
++	int (*update_link)(struct phy_device *phydev);
++
+ 	/* Clears any pending interrupts */
+ 	int (*ack_interrupt)(struct phy_device *phydev);
+ 
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -705,6 +705,9 @@ int genphy_update_link(struct phy_device
+ {
+ 	int status;
+ 
++	if (phydev->drv->update_link)
++		return phydev->drv->update_link(phydev);
++
+ 	/* Do a fake read */
+ 	status = phy_read(phydev, MII_BMSR);
+ 
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -106,6 +106,9 @@ static inline int phy_aneg_done(struct p
+ {
+ 	int retval;
+ 
++	if (phydev->drv->aneg_done)
++		return phydev->drv->aneg_done(phydev);
++
+ 	retval = phy_read(phydev, MII_BMSR);
+ 
+ 	return (retval < 0) ? retval : (retval & BMSR_ANEGCOMPLETE);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/703-phy-add-detach-callback-to-struct-phy_driver.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/703-phy-add-detach-callback-to-struct-phy_driver.patch.svn-base
new file mode 100644
index 0000000..8af9a19
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/703-phy-add-detach-callback-to-struct-phy_driver.patch.svn-base
@@ -0,0 +1,27 @@
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -522,6 +522,9 @@ EXPORT_SYMBOL(phy_attach);
+  */
+ void phy_detach(struct phy_device *phydev)
+ {
++	if (phydev->drv && phydev->drv->detach)
++		phydev->drv->detach(phydev);
++
+ 	phydev->attached_dev->phydev = NULL;
+ 	phydev->attached_dev = NULL;
+ 
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -417,6 +417,12 @@ struct phy_driver {
+ 	 */
+ 	int (*did_interrupt)(struct phy_device *phydev);
+ 
++	/*
++	 * Called before an ethernet device is detached
++	 * from the PHY.
++	 */
++	void (*detach)(struct phy_device *phydev);
++
+ 	/* Clears up any memory if needed */
+ 	void (*remove)(struct phy_device *phydev);
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/710-phy-add-mdio_register_board_info.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/710-phy-add-mdio_register_board_info.patch.svn-base
new file mode 100644
index 0000000..5e40394
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/710-phy-add-mdio_register_board_info.patch.svn-base
@@ -0,0 +1,191 @@
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -36,6 +36,8 @@
+ #include <asm/irq.h>
+ #include <asm/uaccess.h>
+ 
++#include "mdio-boardinfo.h"
++
+ /**
+  * mdiobus_alloc_size - allocate a mii_bus structure
+  * @size: extra amount of memory to allocate for private storage.
+@@ -192,15 +194,33 @@ void mdiobus_free(struct mii_bus *bus)
+ }
+ EXPORT_SYMBOL(mdiobus_free);
+ 
++static void mdiobus_setup_phydev_from_boardinfo(struct mii_bus *bus,
++						struct phy_device *phydev,
++						struct mdio_board_info *bi)
++{
++	if (strcmp(bus->id, bi->bus_id) ||
++	    bi->phy_addr != phydev->addr)
++		return;
++
++	phydev->dev.platform_data = (void *) bi->platform_data;
++}
++
+ struct phy_device *mdiobus_scan(struct mii_bus *bus, int addr)
+ {
+ 	struct phy_device *phydev;
++	struct mdio_board_entry *be;
+ 	int err;
+ 
+ 	phydev = get_phy_device(bus, addr);
+ 	if (IS_ERR(phydev) || phydev == NULL)
+ 		return phydev;
+ 
++	mutex_lock(&__mdio_board_lock);
++	list_for_each_entry(be, &__mdio_board_list, list)
++		mdiobus_setup_phydev_from_boardinfo(bus, phydev,
++						    &be->board_info);
++	mutex_unlock(&__mdio_board_lock);
++
+ 	err = phy_device_register(phydev);
+ 	if (err) {
+ 		phy_device_free(phydev);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -549,4 +549,22 @@ int __init mdio_bus_init(void);
+ void mdio_bus_exit(void);
+ 
+ extern struct bus_type mdio_bus_type;
++
++struct mdio_board_info {
++	const char	*bus_id;
++	int		phy_addr;
++
++	const void	*platform_data;
++};
++
++#ifdef CONFIG_MDIO_BOARDINFO
++int mdiobus_register_board_info(const struct mdio_board_info *info, unsigned n);
++#else
++static inline int
++mdiobus_register_board_info(const struct mdio_board_info *info, unsigned n)
++{
++	return 0;
++}
++#endif
++
+ #endif /* __PHY_H */
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -13,6 +13,10 @@ menuconfig PHYLIB
+ 
+ if PHYLIB
+ 
++config MDIO_BOARDINFO
++	bool
++	default y
++
+ config SWCONFIG
+ 	tristate "Switch configuration API"
+ 	---help---
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -2,6 +2,8 @@
+ 
+ libphy-objs			:= phy.o phy_device.o mdio_bus.o
+ 
++obj-$(CONFIG_MDIO_BOARDINFO)	+= mdio-boardinfo.o
++
+ obj-$(CONFIG_PHYLIB)		+= libphy.o
+ obj-$(CONFIG_SWCONFIG)		+= swconfig.o
+ obj-$(CONFIG_MARVELL_PHY)	+= marvell.o
+--- /dev/null
++++ b/drivers/net/phy/mdio-boardinfo.c
+@@ -0,0 +1,58 @@
++/*
++ * mdio-boardinfo.c - collect pre-declarations of PHY devices
++ *
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/phy.h>
++#include <linux/slab.h>
++#include <linux/export.h>
++#include <linux/mutex.h>
++#include <linux/phy.h>
++
++#include "mdio-boardinfo.h"
++
++/*
++ * These symbols are exported ONLY FOR the mdio_bus component.
++ * No other users will be supported.
++ */
++
++LIST_HEAD(__mdio_board_list);
++EXPORT_SYMBOL_GPL(__mdio_board_list);
++
++DEFINE_MUTEX(__mdio_board_lock);
++EXPORT_SYMBOL_GPL(__mdio_board_lock);
++
++/**
++ * mdio_register_board_info - register PHY devices for a given board
++ * @info: array of chip descriptors
++ * @n: how many descriptors are provided
++ * Context: can sleep
++ *
++ * The board info passed can safely be __initdata ... but be careful of
++ * any embedded pointers (platform_data, etc), they're copied as-is.
++ */
++int __init
++mdiobus_register_board_info(struct mdio_board_info const *info, unsigned n)
++{
++	struct mdio_board_entry *be;
++	int i;
++
++	be = kzalloc(n * sizeof(*be), GFP_KERNEL);
++	if (!be)
++		return -ENOMEM;
++
++	for (i = 0; i < n; i++, be++, info++) {
++		memcpy(&be->board_info, info, sizeof(*info));
++		mutex_lock(&__mdio_board_lock);
++		list_add_tail(&be->list, &__mdio_board_list);
++		mutex_unlock(&__mdio_board_lock);
++	}
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/net/phy/mdio-boardinfo.h
+@@ -0,0 +1,22 @@
++/*
++ * mdio-boardinfo.h - boardinfo interface internal to the mdio_bus component
++ *
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ *
++ */
++
++#include <linux/mutex.h>
++
++struct mdio_board_entry {
++	struct list_head	list;
++	struct mdio_board_info	board_info;
++};
++
++/* __mdio_board_lock protects __mdio_board_list
++ * only mdio_bus components are allowed to use these symbols.
++ */
++extern struct mutex __mdio_board_lock;
++extern struct list_head __mdio_board_list;
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -15,7 +15,7 @@ obj-$(CONFIG_MII) += mii.o
+ obj-$(CONFIG_MDIO) += mdio.o
+ obj-$(CONFIG_NET) += Space.o loopback.o
+ obj-$(CONFIG_NETCONSOLE) += netconsole.o
+-obj-$(CONFIG_PHYLIB) += phy/
++obj-y += phy/
+ obj-$(CONFIG_RIONET) += rionet.o
+ obj-$(CONFIG_NET_TEAM) += team/
+ obj-$(CONFIG_TUN) += tun.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/720-phy_adm6996.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/720-phy_adm6996.patch.svn-base
new file mode 100644
index 0000000..c99824a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/720-phy_adm6996.patch.svn-base
@@ -0,0 +1,26 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -106,6 +106,13 @@ config MICREL_PHY
+ 	---help---
+ 	  Supports the KSZ9021, VSC8201, KS8001 PHYs.
+ 
++config ADM6996_PHY
++	tristate "Driver for ADM6996 switches"
++	select SWCONFIG
++	---help---
++	  Currently supports the ADM6996FC and ADM6996M switches.
++	  Support for FC is very limited.
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -16,6 +16,7 @@ obj-$(CONFIG_VITESSE_PHY)	+= vitesse.o
+ obj-$(CONFIG_BROADCOM_PHY)	+= broadcom.o
+ obj-$(CONFIG_BCM63XX_PHY)	+= bcm63xx.o
+ obj-$(CONFIG_ICPLUS_PHY)	+= icplus.o
++obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/721-phy_packets.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/721-phy_packets.patch.svn-base
new file mode 100644
index 0000000..575fbae
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/721-phy_packets.patch.svn-base
@@ -0,0 +1,175 @@
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1078,6 +1078,11 @@ struct net_device {
+ 	const struct net_device_ops *netdev_ops;
+ 	const struct ethtool_ops *ethtool_ops;
+ 
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	void (*eth_mangle_rx)(struct net_device *dev, struct sk_buff *skb);
++	struct sk_buff *(*eth_mangle_tx)(struct net_device *dev, struct sk_buff *skb);
++#endif
++
+ 	/* Hardware header description */
+ 	const struct header_ops *header_ops;
+ 
+@@ -1134,6 +1139,9 @@ struct net_device {
+ 	void			*ax25_ptr;	/* AX.25 specific data */
+ 	struct wireless_dev	*ieee80211_ptr;	/* IEEE 802.11 specific data,
+ 						   assign before registering */
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	void			*phy_ptr; /* PHY device specific data */
++#endif
+ 
+ /*
+  * Cache lines mostly used on receive path (including eth_type_trans())
+--- a/include/linux/if.h
++++ b/include/linux/if.h
+@@ -80,6 +80,7 @@
+ 					 * skbs on transmit */
+ #define IFF_UNICAST_FLT	0x20000		/* Supports unicast filtering	*/
+ #define IFF_TEAM_PORT	0x40000		/* device used as team port */
++#define IFF_NO_IP_ALIGN	0x80000		/* do not ip-align allocated rx pkts */
+ 
+ #define IF_GET_IFACE	0x0001		/* for querying only */
+ #define IF_GET_PROTO	0x0002
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1661,6 +1661,10 @@ extern struct sk_buff *dev_alloc_skb(uns
+ extern struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
+ 		unsigned int length, gfp_t gfp_mask);
+ 
++extern struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
++		unsigned int length, gfp_t gfp);
++
++
+ /**
+  *	netdev_alloc_skb - allocate an skbuff for rx on a specific device
+  *	@dev: network device to receive on
+@@ -1680,16 +1684,6 @@ static inline struct sk_buff *netdev_all
+ 	return __netdev_alloc_skb(dev, length, GFP_ATOMIC);
+ }
+ 
+-static inline struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
+-		unsigned int length, gfp_t gfp)
+-{
+-	struct sk_buff *skb = __netdev_alloc_skb(dev, length + NET_IP_ALIGN, gfp);
+-
+-	if (NET_IP_ALIGN && skb)
+-		skb_reserve(skb, NET_IP_ALIGN);
+-	return skb;
+-}
+-
+ static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
+ 		unsigned int length)
+ {
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -23,6 +23,12 @@ menuconfig NET
+ 
+ if NET
+ 
++config ETHERNET_PACKET_MANGLE
++	bool
++	help
++	  This option can be selected by phy drivers that need to mangle
++	  packets going in or out of an ethernet device.
++
+ config WANT_COMPAT_NETLINK_MESSAGES
+ 	bool
+ 	help
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2267,9 +2267,19 @@ int dev_hard_start_xmit(struct sk_buff *
+ 			}
+ 		}
+ 
+-		skb_len = skb->len;
+-		rc = ops->ndo_start_xmit(skb, dev);
+-		trace_net_dev_xmit(skb, rc, dev, skb_len);
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++		if (!dev->eth_mangle_tx ||
++		    (skb = dev->eth_mangle_tx(dev, skb)) != NULL)
++#else
++		if (1)
++#endif
++		{
++			skb_len = skb->len;
++			rc = ops->ndo_start_xmit(skb, dev);
++			trace_net_dev_xmit(skb, rc, dev, skb_len);
++		} else {
++			rc = NETDEV_TX_OK;
++		}
+ 		if (rc == NETDEV_TX_OK)
+ 			txq_trans_update(txq);
+ 		return rc;
+@@ -2289,9 +2299,19 @@ gso:
+ 		if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
+ 			skb_dst_drop(nskb);
+ 
+-		skb_len = nskb->len;
+-		rc = ops->ndo_start_xmit(nskb, dev);
+-		trace_net_dev_xmit(nskb, rc, dev, skb_len);
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++		if (!dev->eth_mangle_tx ||
++		    (nskb = dev->eth_mangle_tx(dev, nskb)) != NULL)
++#else
++		if (1)
++#endif
++		{
++			skb_len = nskb->len;
++			rc = ops->ndo_start_xmit(nskb, dev);
++			trace_net_dev_xmit(nskb, rc, dev, skb_len);
++		} else {
++			rc = NETDEV_TX_OK;
++		}
+ 		if (unlikely(rc != NETDEV_TX_OK)) {
+ 			if (rc & ~NETDEV_TX_MASK)
+ 				goto out_kfree_gso_skb;
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -58,6 +58,7 @@
+ #include <linux/scatterlist.h>
+ #include <linux/errqueue.h>
+ #include <linux/prefetch.h>
++#include <linux/if.h>
+ 
+ #include <net/protocol.h>
+ #include <net/dst.h>
+@@ -320,6 +321,22 @@ struct sk_buff *__netdev_alloc_skb(struc
+ }
+ EXPORT_SYMBOL(__netdev_alloc_skb);
+ 
++struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
++		unsigned int length, gfp_t gfp)
++{
++	struct sk_buff *skb = __netdev_alloc_skb(dev, length + NET_IP_ALIGN, gfp);
++
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	if (dev->priv_flags & IFF_NO_IP_ALIGN)
++		return skb;
++#endif
++
++	if (NET_IP_ALIGN && skb)
++		skb_reserve(skb, NET_IP_ALIGN);
++	return skb;
++}
++EXPORT_SYMBOL(__netdev_alloc_skb_ip_align);
++
+ void skb_add_rx_frag(struct sk_buff *skb, int i, struct page *page, int off,
+ 		int size)
+ {
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -160,6 +160,12 @@ __be16 eth_type_trans(struct sk_buff *sk
+ 	struct ethhdr *eth;
+ 
+ 	skb->dev = dev;
++
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	if (dev->eth_mangle_rx)
++		dev->eth_mangle_rx(dev, skb);
++#endif
++
+ 	skb_reset_mac_header(skb);
+ 	skb_pull_inline(skb, ETH_HLEN);
+ 	eth = eth_hdr(skb);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/722-phy_mvswitch.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/722-phy_mvswitch.patch.svn-base
new file mode 100644
index 0000000..8a45611
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/722-phy_mvswitch.patch.svn-base
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -113,6 +113,10 @@ config ADM6996_PHY
+ 	  Currently supports the ADM6996FC and ADM6996M switches.
+ 	  Support for FC is very limited.
+ 
++config MVSWITCH_PHY
++	tristate "Driver for Marvell 88E6060 switches"
++	select ETHERNET_PACKET_MANGLE
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -17,6 +17,7 @@ obj-$(CONFIG_BROADCOM_PHY)	+= broadcom.o
+ obj-$(CONFIG_BCM63XX_PHY)	+= bcm63xx.o
+ obj-$(CONFIG_ICPLUS_PHY)	+= icplus.o
+ obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
++obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/723-phy_ip175c.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/723-phy_ip175c.patch.svn-base
new file mode 100644
index 0000000..8eff10c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/723-phy_ip175c.patch.svn-base
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -117,6 +117,10 @@ config MVSWITCH_PHY
+ 	tristate "Driver for Marvell 88E6060 switches"
+ 	select ETHERNET_PACKET_MANGLE
+ 
++config IP17XX_PHY
++	tristate "Driver for IC+ IP17xx switches"
++	select SWCONFIG
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -18,6 +18,7 @@ obj-$(CONFIG_BCM63XX_PHY)	+= bcm63xx.o
+ obj-$(CONFIG_ICPLUS_PHY)	+= icplus.o
+ obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
+ obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
++obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/724-phy_ar8216.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/724-phy_ar8216.patch.svn-base
new file mode 100644
index 0000000..eed6e2b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/724-phy_ar8216.patch.svn-base
@@ -0,0 +1,24 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -121,6 +121,11 @@ config IP17XX_PHY
+ 	tristate "Driver for IC+ IP17xx switches"
+ 	select SWCONFIG
+ 
++config AR8216_PHY
++	tristate "Driver for Atheros AR8216 switches"
++	select ETHERNET_PACKET_MANGLE
++	select SWCONFIG
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -20,6 +20,7 @@ obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
+ obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
+ obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
++obj-$(CONFIG_AR8216_PHY)	+= ar8216.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/725-phy_rtl8306.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/725-phy_rtl8306.patch.svn-base
new file mode 100644
index 0000000..db0ee65
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/725-phy_rtl8306.patch.svn-base
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -126,6 +126,10 @@ config AR8216_PHY
+ 	select ETHERNET_PACKET_MANGLE
+ 	select SWCONFIG
+ 
++config RTL8306_PHY
++	tristate "Driver for Realtek RTL8306S switches"
++	select SWCONFIG
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -21,6 +21,7 @@ obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
+ obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_AR8216_PHY)	+= ar8216.o
++obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/726-phy_rtl8366.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/726-phy_rtl8366.patch.svn-base
new file mode 100644
index 0000000..d258e4b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/726-phy_rtl8366.patch.svn-base
@@ -0,0 +1,45 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -168,6 +168,30 @@ config MDIO_OCTEON
+ 
+ 	  If in doubt, say Y.
+ 
++config RTL8366_SMI
++	tristate "Driver for the RTL8366 SMI interface"
++	depends on GENERIC_GPIO
++	---help---
++	  This module implements the SMI interface protocol which is used
++	  by some RTL8366 ethernet switch devices via the generic GPIO API.
++
++if RTL8366_SMI
++
++config RTL8366_SMI_DEBUG_FS
++	bool "RTL8366 SMI interface debugfs support"
++        depends on DEBUG_FS
++        default n
++
++config RTL8366S_PHY
++	tristate "Driver for the Realtek RTL8366S switch"
++	select SWCONFIG
++
++config RTL8366RB_PHY
++	tristate "Driver for the Realtek RTL8366RB switch"
++	select SWCONFIG
++
++endif # RTL8366_SMI
++
+ endif # PHYLIB
+ 
+ config MICREL_KS8995MA
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -22,6 +22,9 @@ obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_AR8216_PHY)	+= ar8216.o
+ obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
++obj-$(CONFIG_RTL8366_SMI)	+= rtl8366_smi.o
++obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
++obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/727-phy-rtl8367.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/727-phy-rtl8367.patch.svn-base
new file mode 100644
index 0000000..a24f497
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/727-phy-rtl8367.patch.svn-base
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -190,6 +190,10 @@ config RTL8366RB_PHY
+ 	tristate "Driver for the Realtek RTL8366RB switch"
+ 	select SWCONFIG
+ 
++config RTL8367_PHY
++	tristate "Driver for the Realtek RTL8367R/M switches"
++	select SWCONFIG
++
+ endif # RTL8366_SMI
+ 
+ endif # PHYLIB
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -25,6 +25,7 @@ obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
+ obj-$(CONFIG_RTL8366_SMI)	+= rtl8366_smi.o
+ obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
+ obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
++obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/728-phy-micrel.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/728-phy-micrel.patch.svn-base
new file mode 100644
index 0000000..c41d030
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/728-phy-micrel.patch.svn-base
@@ -0,0 +1,24 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -130,6 +130,11 @@ config RTL8306_PHY
+ 	tristate "Driver for Realtek RTL8306S switches"
+ 	select SWCONFIG
+ 
++config MICREL_PHY
++	tristate "Drivers for Micrel/Kendin PHYs"
++	---help---
++	  Currently has a driver for the KSZ8041
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -27,6 +27,7 @@ obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
+ obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
+ obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
++obj-$(CONFIG_MICREL_PHY)	+= micrel.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
+ obj-$(CONFIG_MDIO_GPIO)		+= mdio-gpio.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/729-phy-rtl8367b.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/729-phy-rtl8367b.patch.svn-base
new file mode 100644
index 0000000..82a7386
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/729-phy-rtl8367b.patch.svn-base
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -199,6 +199,10 @@ config RTL8367_PHY
+ 	tristate "Driver for the Realtek RTL8367R/M switches"
+ 	select SWCONFIG
+ 
++config RTL8367B_PHY
++	tristate "Driver fot the Realtek RTL8367R-VB switch"
++	select SWCONFIG
++
+ endif # RTL8366_SMI
+ 
+ endif # PHYLIB
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -26,6 +26,7 @@ obj-$(CONFIG_RTL8366_SMI)	+= rtl8366_smi
+ obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
+ obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
+ obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
++obj-$(CONFIG_RTL8367B_PHY)	+= rtl8367b.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_MICREL_PHY)	+= micrel.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/729-phy-tantos.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/729-phy-tantos.patch.svn-base
new file mode 100644
index 0000000..99a4e71
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/729-phy-tantos.patch.svn-base
@@ -0,0 +1,21 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -210,3 +210,8 @@ endif # PHYLIB
+ config MICREL_KS8995MA
+ 	tristate "Micrel KS8995MA 5-ports 10/100 managed Ethernet switch"
+ 	depends on SPI
++
++config PSB6970_PHY
++	tristate "Lantiq XWAY Tantos (PSB6970) Ethernet switch"
++	select SWCONFIG
++	select ETHERNET_PACKET_MANGLE
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -29,6 +29,7 @@ obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
+ obj-$(CONFIG_RTL8367B_PHY)	+= rtl8367b.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_MICREL_PHY)	+= micrel.o
++obj-$(CONFIG_PSB6970_PHY)	+= psb6970.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
+ obj-$(CONFIG_MDIO_GPIO)		+= mdio-gpio.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/750-hostap_txpower.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/750-hostap_txpower.patch.svn-base
new file mode 100644
index 0000000..8e2ec9a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/750-hostap_txpower.patch.svn-base
@@ -0,0 +1,154 @@
+--- a/drivers/net/wireless/hostap/hostap_ap.c
++++ b/drivers/net/wireless/hostap/hostap_ap.c
+@@ -2340,13 +2340,13 @@ int prism2_ap_get_sta_qual(local_info_t
+ 		addr[count].sa_family = ARPHRD_ETHER;
+ 		memcpy(addr[count].sa_data, sta->addr, ETH_ALEN);
+ 		if (sta->last_rx_silence == 0)
+-			qual[count].qual = sta->last_rx_signal < 27 ?
+-				0 : (sta->last_rx_signal - 27) * 92 / 127;
++                        qual[count].qual = (sta->last_rx_signal - 156) == 0 ?
++                                0 : (sta->last_rx_signal - 156) * 92 / 64;
+ 		else
+-			qual[count].qual = sta->last_rx_signal -
+-				sta->last_rx_silence - 35;
+-		qual[count].level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
+-		qual[count].noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
++                        qual[count].qual = (sta->last_rx_signal -
++                                sta->last_rx_silence) * 92 / 64;
++                qual[count].level = sta->last_rx_signal;
++                qual[count].noise = sta->last_rx_silence;
+ 		qual[count].updated = sta->last_rx_updated;
+ 
+ 		sta->last_rx_updated = IW_QUAL_DBM;
+@@ -2412,13 +2412,13 @@ int prism2_ap_translate_scan(struct net_
+ 		memset(&iwe, 0, sizeof(iwe));
+ 		iwe.cmd = IWEVQUAL;
+ 		if (sta->last_rx_silence == 0)
+-			iwe.u.qual.qual = sta->last_rx_signal < 27 ?
+-				0 : (sta->last_rx_signal - 27) * 92 / 127;
++	                iwe.u.qual.qual = (sta->last_rx_signal -156) == 0 ?
++	                        0 : (sta->last_rx_signal - 156) * 92 / 64;
+ 		else
+-			iwe.u.qual.qual = sta->last_rx_signal -
+-				sta->last_rx_silence - 35;
+-		iwe.u.qual.level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
+-		iwe.u.qual.noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
++                        iwe.u.qual.qual = (sta->last_rx_signal -
++                                sta->last_rx_silence) * 92 / 64;
++                iwe.u.qual.level = sta->last_rx_signal;
++                iwe.u.qual.noise = sta->last_rx_silence;
+ 		iwe.u.qual.updated = sta->last_rx_updated;
+ 		iwe.len = IW_EV_QUAL_LEN;
+ 		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
+--- a/drivers/net/wireless/hostap/hostap_config.h
++++ b/drivers/net/wireless/hostap/hostap_config.h
+@@ -45,4 +45,9 @@
+  */
+ /* #define PRISM2_NO_STATION_MODES */
+ 
++/* Enable TX power Setting functions
++ * (min att = -128 , max att =  127)
++ */
++#define RAW_TXPOWER_SETTING
++
+ #endif /* HOSTAP_CONFIG_H */
+--- a/drivers/net/wireless/hostap/hostap.h
++++ b/drivers/net/wireless/hostap/hostap.h
+@@ -90,6 +90,7 @@ extern const struct iw_handler_def hosta
+ extern const struct ethtool_ops prism2_ethtool_ops;
+ 
+ int hostap_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
++int hostap_restore_power(struct net_device *dev);
+ 
+ 
+ #endif /* HOSTAP_H */
+--- a/drivers/net/wireless/hostap/hostap_hw.c
++++ b/drivers/net/wireless/hostap/hostap_hw.c
+@@ -932,6 +932,7 @@ static int hfa384x_set_rid(struct net_de
+ 			prism2_hw_reset(dev);
+ 	}
+ 
++	hostap_restore_power(dev);
+ 	return res;
+ }
+ 
+--- a/drivers/net/wireless/hostap/hostap_info.c
++++ b/drivers/net/wireless/hostap/hostap_info.c
+@@ -434,6 +434,11 @@ static void handle_info_queue_linkstatus
+ 	}
+ 
+ 	/* Get BSSID if we have a valid AP address */
++
++	if ( val == HFA384X_LINKSTATUS_CONNECTED ||
++	     val == HFA384X_LINKSTATUS_DISCONNECTED )
++			hostap_restore_power(local->dev);
++
+ 	if (connected) {
+ 		netif_carrier_on(local->dev);
+ 		netif_carrier_on(local->ddev);
+--- a/drivers/net/wireless/hostap/hostap_ioctl.c
++++ b/drivers/net/wireless/hostap/hostap_ioctl.c
+@@ -1478,23 +1478,20 @@ static int prism2_txpower_hfa386x_to_dBm
+ 		val = 255;
+ 
+ 	tmp = val;
+-	tmp >>= 2;
+ 
+-	return -12 - tmp;
++	return tmp;
+ }
+ 
+ static u16 prism2_txpower_dBm_to_hfa386x(int val)
+ {
+ 	signed char tmp;
+ 
+-	if (val > 20)
+-		return 128;
+-	else if (val < -43)
++	if (val > 127)
+ 		return 127;
++	else if (val < -128)
++		return 128;
+ 
+ 	tmp = val;
+-	tmp = -12 - tmp;
+-	tmp <<= 2;
+ 
+ 	return (unsigned char) tmp;
+ }
+@@ -4057,3 +4054,35 @@ int hostap_ioctl(struct net_device *dev,
+ 
+ 	return ret;
+ }
++
++/* BUG FIX: Restore power setting value when lost due to F/W bug */
++
++int hostap_restore_power(struct net_device *dev)
++{
++        struct hostap_interface *iface = netdev_priv(dev);
++       local_info_t *local = iface->local;
++
++       u16 val;
++       int ret = 0;
++
++       if (local->txpower_type == PRISM2_TXPOWER_OFF) {
++                       val = 0xff; /* use all standby and sleep modes */
++                       ret = local->func->cmd(dev, HFA384X_CMDCODE_WRITEMIF,
++                                              HFA386X_CR_A_D_TEST_MODES2,
++                                              &val, NULL);
++       }
++
++#ifdef RAW_TXPOWER_SETTING
++       if (local->txpower_type == PRISM2_TXPOWER_FIXED) {
++               val = HFA384X_TEST_CFG_BIT_ALC;
++               local->func->cmd(dev, HFA384X_CMDCODE_TEST |
++                                (HFA384X_TEST_CFG_BITS << 8), 0, &val, NULL);
++               val = prism2_txpower_dBm_to_hfa386x(local->txpower);
++               ret = (local->func->cmd(dev, HFA384X_CMDCODE_WRITEMIF,
++                            HFA386X_CR_MANUAL_TX_POWER, &val, NULL));
++       }
++#endif /* RAW_TXPOWER_SETTING */
++       return (ret ? -EOPNOTSUPP : 0);
++}
++
++EXPORT_SYMBOL(hostap_restore_power);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/800-usb-ohci-multiple-platform-driver-fix.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/800-usb-ohci-multiple-platform-driver-fix.patch.svn-base
new file mode 100644
index 0000000..a2a213b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/800-usb-ohci-multiple-platform-driver-fix.patch.svn-base
@@ -0,0 +1,51 @@
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -1123,7 +1123,7 @@ MODULE_LICENSE ("GPL");
+ 
+ #ifdef CONFIG_USB_OHCI_HCD_PLATFORM
+ #include "ohci-platform.c"
+-#define PLATFORM_DRIVER		ohci_platform_driver
++#define OHCI_PLATFORM_DRIVER		ohci_platform_driver
+ #endif
+ 
+ #if	!defined(PCI_DRIVER) &&		\
+@@ -1135,7 +1135,8 @@ MODULE_LICENSE ("GPL");
+ 	!defined(PS3_SYSTEM_BUS_DRIVER) && \
+ 	!defined(SM501_OHCI_DRIVER) && \
+ 	!defined(TMIO_OHCI_DRIVER) && \
+-	!defined(SSB_OHCI_DRIVER)
++	!defined(SSB_OHCI_DRIVER) && \
++	!defined(OHCI_PLATFORM_DRIVER)
+ #error "missing bus glue for ohci-hcd"
+ #endif
+ 
+@@ -1219,9 +1220,19 @@ static int __init ohci_hcd_mod_init(void
+ 		goto error_tmio;
+ #endif
+ 
++#ifdef OHCI_PLATFORM_DRIVER
++	retval = platform_driver_register(&OHCI_PLATFORM_DRIVER);
++	if (retval < 0)
++		goto error_ohci;
++#endif
++
+ 	return retval;
+ 
+ 	/* Error path */
++#ifdef OHCI_PLATFORM_DRIVER
++	platform_driver_unregister(&OHCI_PLATFORM_DRIVER);
++ error_ohci:
++#endif
+ #ifdef TMIO_OHCI_DRIVER
+ 	platform_driver_unregister(&TMIO_OHCI_DRIVER);
+  error_tmio:
+@@ -1275,6 +1286,9 @@ module_init(ohci_hcd_mod_init);
+ 
+ static void __exit ohci_hcd_mod_exit(void)
+ {
++#ifdef OHCI_PLATFORM_DRIVER
++	platform_driver_unregister(&OHCI_PLATFORM_DRIVER);
++#endif
+ #ifdef TMIO_OHCI_DRIVER
+ 	platform_driver_unregister(&TMIO_OHCI_DRIVER);
+ #endif
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/801-usb-ehci-multiple-platform-driver-fix.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/801-usb-ehci-multiple-platform-driver-fix.patch.svn-base
new file mode 100644
index 0000000..9bf5097
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/801-usb-ehci-multiple-platform-driver-fix.patch.svn-base
@@ -0,0 +1,47 @@
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -1383,12 +1383,12 @@ MODULE_LICENSE ("GPL");
+ 
+ #ifdef CONFIG_USB_EHCI_HCD_PLATFORM
+ #include "ehci-platform.c"
+-#define PLATFORM_DRIVER		ehci_platform_driver
++#define EHCI_PLATFORM_DRIVER	ehci_platform_driver
+ #endif
+ 
+ #if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER) && \
+     !defined(PS3_SYSTEM_BUS_DRIVER) && !defined(OF_PLATFORM_DRIVER) && \
+-    !defined(XILINX_OF_PLATFORM_DRIVER)
++    !defined(XILINX_OF_PLATFORM_DRIVER) && !defined(EHCI_PLATFORM_DRIVER)
+ #error "missing bus glue for ehci-hcd"
+ #endif
+ 
+@@ -1448,8 +1448,19 @@ static int __init ehci_hcd_init(void)
+ 	if (retval < 0)
+ 		goto clean4;
+ #endif
++
++#ifdef EHCI_PLATFORM_DRIVER
++	retval = platform_driver_register(&EHCI_PLATFORM_DRIVER);
++	if (retval < 0)
++		goto clean5;
++#endif
++
+ 	return retval;
+ 
++#ifdef EHCI_PLATFORM_DRIVER
++	platform_driver_unregister(&EHCI_PLATFORM_DRIVER);
++clean5:
++#endif
+ #ifdef XILINX_OF_PLATFORM_DRIVER
+ 	/* platform_driver_unregister(&XILINX_OF_PLATFORM_DRIVER); */
+ clean4:
+@@ -1482,6 +1493,9 @@ module_init(ehci_hcd_init);
+ 
+ static void __exit ehci_hcd_cleanup(void)
+ {
++#ifdef EHCI_PLATFORM_DRIVER
++	platform_driver_unregister(&EHCI_PLATFORM_DRIVER);
++#endif
+ #ifdef XILINX_OF_PLATFORM_DRIVER
+ 	platform_driver_unregister(&XILINX_OF_PLATFORM_DRIVER);
+ #endif
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/810-pci_disable_common_quirks.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/810-pci_disable_common_quirks.patch.svn-base
new file mode 100644
index 0000000..4802157
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/810-pci_disable_common_quirks.patch.svn-base
@@ -0,0 +1,43 @@
+--- a/drivers/pci/Kconfig
++++ b/drivers/pci/Kconfig
+@@ -51,6 +51,12 @@ config XEN_PCIDEV_FRONTEND
+           The PCI device frontend driver allows the kernel to import arbitrary
+           PCI devices from a PCI backend to support PCI driver domains.
+ 
++config PCI_DISABLE_COMMON_QUIRKS
++	bool "PCI disable common quirks"
++	depends on PCI
++	help
++	  If you don't know what to do here, say N.
++
+ config HT_IRQ
+ 	bool "Interrupts on hypertransport devices"
+ 	default y
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -105,6 +105,7 @@ static void __devinit quirk_mmio_always_
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, quirk_mmio_always_on);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
+ /* The Mellanox Tavor device gives false positive parity errors
+  * Mark this device with a broken_parity_status, to allow
+  * PCI scanning code to "skip" this now blacklisted device.
+@@ -1990,7 +1991,9 @@ static void __devinit fixup_rev1_53c810(
+ 	}
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NCR, PCI_DEVICE_ID_NCR_53C810, fixup_rev1_53c810);
++#endif /* !CONFIG_PCI_DISABLE_COMMON_QUIRKS */
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
+ /* Enable 1k I/O space granularity on the Intel P64H2 */
+ static void __devinit quirk_p64h2_1k_io(struct pci_dev *dev)
+ {
+@@ -2666,6 +2669,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AT
+ 			quirk_msi_intx_disable_bug);
+ 
+ #endif /* CONFIG_PCI_MSI */
++#endif /* !CONFIG_PCI_DISABLE_COMMON_QUIRKS */
+ 
+ /* Allow manual resource allocation for PCI hotplug bridges
+  * via pci=hpmemsize=nnM and pci=hpiosize=nnM parameters. For
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/811-pci_disable_usb_common_quirks.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/811-pci_disable_usb_common_quirks.patch.svn-base
new file mode 100644
index 0000000..7bf8eaf
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/811-pci_disable_usb_common_quirks.patch.svn-base
@@ -0,0 +1,38 @@
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -432,6 +432,8 @@ reset_needed:
+ }
+ EXPORT_SYMBOL_GPL(uhci_check_and_reset_hc);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
++
+ static inline int io_type_enabled(struct pci_dev *pdev, unsigned int mask)
+ {
+ 	u16 cmd;
+@@ -928,3 +930,5 @@ static void __devinit quirk_usb_early_ha
+ 	pci_disable_device(pdev);
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, quirk_usb_early_handoff);
++
++#endif
+--- a/drivers/usb/host/pci-quirks.h
++++ b/drivers/usb/host/pci-quirks.h
+@@ -8,9 +8,17 @@ int usb_amd_find_chipset_info(void);
+ void usb_amd_dev_put(void);
+ void usb_amd_quirk_pll_disable(void);
+ void usb_amd_quirk_pll_enable(void);
++#if !defined(CONFIG_PCI_DISABLE_COMMON_QUIRKS)
+ bool usb_is_intel_switchable_xhci(struct pci_dev *pdev);
+ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev);
+ #else
++static inline bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
++{
++	return false;
++}
++static inline void usb_enable_xhci_ports(struct pci_dev *xhci_pdev) {}
++#endif
++#else
+ static inline void usb_amd_quirk_pll_disable(void) {}
+ static inline void usb_amd_quirk_pll_enable(void) {}
+ static inline void usb_amd_dev_put(void) {}
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/820-usb_add_usb_find_device_by_name.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/820-usb_add_usb_find_device_by_name.patch.svn-base
new file mode 100644
index 0000000..ee50ff9
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/820-usb_add_usb_find_device_by_name.patch.svn-base
@@ -0,0 +1,84 @@
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -652,6 +652,71 @@ int __usb_get_extra_descriptor(char *buf
+ }
+ EXPORT_SYMBOL_GPL(__usb_get_extra_descriptor);
+ 
++static struct usb_device *match_device_name(struct usb_device *dev,
++					    const char *name)
++{
++	struct usb_device *ret_dev = NULL;
++	int child;
++
++	dev_dbg(&dev->dev, "check for name %s ...\n", name);
++
++	/* see if this device matches */
++	if (strcmp(dev_name(&dev->dev), name) == 0 ) {
++		dev_dbg(&dev->dev, "matched this device!\n");
++		ret_dev = usb_get_dev(dev);
++		goto exit;
++	}
++
++	/* look through all of the children of this device */
++	for (child = 0; child < dev->maxchild; ++child) {
++		if (dev->children[child]) {
++			usb_lock_device(dev->children[child]);
++			ret_dev = match_device_name(dev->children[child], name);
++			usb_unlock_device(dev->children[child]);
++			if (ret_dev)
++				goto exit;
++		}
++	}
++exit:
++	return ret_dev;
++}
++
++/**
++ * usb_find_device_by_name - find a specific usb device in the system
++ * @name: the name of the device to find
++ *
++ * Returns a pointer to a struct usb_device if such a specified usb
++ * device is present in the system currently.  The usage count of the
++ * device will be incremented if a device is found.  Make sure to call
++ * usb_put_dev() when the caller is finished with the device.
++ *
++ * If a device with the specified bus id is not found, NULL is returned.
++ */
++struct usb_device *usb_find_device_by_name(const char *name)
++{
++	struct list_head *buslist;
++	struct usb_bus *bus;
++	struct usb_device *dev = NULL;
++
++	mutex_lock(&usb_bus_list_lock);
++	for (buslist = usb_bus_list.next;
++	     buslist != &usb_bus_list;
++	     buslist = buslist->next) {
++		bus = container_of(buslist, struct usb_bus, bus_list);
++		if (!bus->root_hub)
++			continue;
++		usb_lock_device(bus->root_hub);
++		dev = match_device_name(bus->root_hub, name);
++		usb_unlock_device(bus->root_hub);
++		if (dev)
++			goto exit;
++	}
++exit:
++	mutex_unlock(&usb_bus_list_lock);
++	return dev;
++}
++EXPORT_SYMBOL_GPL(usb_find_device_by_name);
++
+ /**
+  * usb_alloc_coherent - allocate dma-consistent buffer for URB_NO_xxx_DMA_MAP
+  * @dev: device the buffer will be used with
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -531,6 +531,7 @@ extern int usb_lock_device_for_reset(str
+ extern int usb_reset_device(struct usb_device *dev);
+ extern void usb_queue_reset_device(struct usb_interface *dev);
+ 
++extern struct usb_device *usb_find_device_by_name(const char *name);
+ 
+ /* USB autosuspend and autoresume */
+ #ifdef CONFIG_USB_SUSPEND
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/830-ledtrig_morse.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/830-ledtrig_morse.patch.svn-base
new file mode 100644
index 0000000..3283807
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/830-ledtrig_morse.patch.svn-base
@@ -0,0 +1,28 @@
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -480,4 +480,8 @@ config LEDS_TRIGGER_DEFAULT_ON
+ comment "iptables trigger is under Netfilter config (LED target)"
+ 	depends on LEDS_TRIGGERS
+ 
++config LEDS_TRIGGER_MORSE
++	tristate "LED Morse Trigger"
++	depends on LEDS_TRIGGERS
++
+ endif # NEW_LEDS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -57,3 +57,4 @@ obj-$(CONFIG_LEDS_TRIGGER_HEARTBEAT)	+=
+ obj-$(CONFIG_LEDS_TRIGGER_BACKLIGHT)	+= ledtrig-backlight.o
+ obj-$(CONFIG_LEDS_TRIGGER_GPIO)		+= ledtrig-gpio.o
+ obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
++obj-$(CONFIG_LEDS_TRIGGER_MORSE)	+= ledtrig-morse.o
+--- a/drivers/leds/ledtrig-morse.c
++++ b/drivers/leds/ledtrig-morse.c
+@@ -26,7 +26,6 @@
+ #include <linux/list.h>
+ #include <linux/spinlock.h>
+ #include <linux/device.h>
+-#include <linux/sysdev.h>
+ #include <linux/timer.h>
+ #include <linux/ctype.h>
+ #include <linux/leds.h>
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/831-ledtrig_netdev.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/831-ledtrig_netdev.patch.svn-base
new file mode 100644
index 0000000..7f94b1c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/831-ledtrig_netdev.patch.svn-base
@@ -0,0 +1,51 @@
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -484,4 +484,11 @@ config LEDS_TRIGGER_MORSE
+ 	tristate "LED Morse Trigger"
+ 	depends on LEDS_TRIGGERS
+ 
++config LEDS_TRIGGER_NETDEV
++	tristate "LED Netdev Trigger"
++	depends on NET && LEDS_TRIGGERS
++	help
++	  This allows LEDs to be controlled by network device activity.
++	  If unsure, say Y.
++
+ endif # NEW_LEDS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -58,3 +58,4 @@ obj-$(CONFIG_LEDS_TRIGGER_BACKLIGHT)	+=
+ obj-$(CONFIG_LEDS_TRIGGER_GPIO)		+= ledtrig-gpio.o
+ obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
+ obj-$(CONFIG_LEDS_TRIGGER_MORSE)	+= ledtrig-morse.o
++obj-$(CONFIG_LEDS_TRIGGER_NETDEV)	+= ledtrig-netdev.o
+--- a/drivers/leds/ledtrig-netdev.c
++++ b/drivers/leds/ledtrig-netdev.c
+@@ -22,7 +22,6 @@
+ #include <linux/list.h>
+ #include <linux/spinlock.h>
+ #include <linux/device.h>
+-#include <linux/sysdev.h>
+ #include <linux/netdevice.h>
+ #include <linux/timer.h>
+ #include <linux/ctype.h>
+@@ -307,8 +306,9 @@ done:
+ static void netdev_trig_timer(unsigned long arg)
+ {
+ 	struct led_netdev_data *trigger_data = (struct led_netdev_data *)arg;
+-	const struct net_device_stats *dev_stats;
++	struct rtnl_link_stats64 *dev_stats;
+ 	unsigned new_activity;
++	struct rtnl_link_stats64 temp;
+ 
+ 	write_lock(&trigger_data->lock);
+ 
+@@ -318,7 +318,7 @@ static void netdev_trig_timer(unsigned l
+ 		goto no_restart;
+ 	}
+ 
+-	dev_stats = dev_get_stats(trigger_data->net_dev);
++	dev_stats = dev_get_stats(trigger_data->net_dev, &temp);
+ 	new_activity =
+ 		((trigger_data->mode & MODE_TX) ? dev_stats->tx_packets : 0) +
+ 		((trigger_data->mode & MODE_RX) ? dev_stats->rx_packets : 0);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/832-ledtrig_usbdev.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/832-ledtrig_usbdev.patch.svn-base
new file mode 100644
index 0000000..8933497
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/832-ledtrig_usbdev.patch.svn-base
@@ -0,0 +1,31 @@
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -491,4 +491,11 @@ config LEDS_TRIGGER_NETDEV
+ 	  This allows LEDs to be controlled by network device activity.
+ 	  If unsure, say Y.
+ 
++config LEDS_TRIGGER_USBDEV
++	tristate "LED USB device Trigger"
++	depends on USB && LEDS_TRIGGERS
++	help
++	  This allows LEDs to be controlled by the presence/activity of
++	  an USB device. If unsure, say N.
++
+ endif # NEW_LEDS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -59,3 +59,4 @@ obj-$(CONFIG_LEDS_TRIGGER_GPIO)		+= ledt
+ obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
+ obj-$(CONFIG_LEDS_TRIGGER_MORSE)	+= ledtrig-morse.o
+ obj-$(CONFIG_LEDS_TRIGGER_NETDEV)	+= ledtrig-netdev.o
++obj-$(CONFIG_LEDS_TRIGGER_USBDEV)	+= ledtrig-usbdev.o
+--- a/drivers/leds/ledtrig-usbdev.c
++++ b/drivers/leds/ledtrig-usbdev.c
+@@ -24,7 +24,6 @@
+ #include <linux/list.h>
+ #include <linux/spinlock.h>
+ #include <linux/device.h>
+-#include <linux/sysdev.h>
+ #include <linux/timer.h>
+ #include <linux/ctype.h>
+ #include <linux/slab.h>
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/840-rtc7301.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/840-rtc7301.patch.svn-base
new file mode 100644
index 0000000..35dd3b8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/840-rtc7301.patch.svn-base
@@ -0,0 +1,250 @@
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -719,6 +719,15 @@ config RTC_DRV_NUC900
+ 	  If you say yes here you get support for the RTC subsystem of the
+ 	  NUC910/NUC920 used in embedded systems.
+ 
++config RTC_DRV_RTC7301
++	tristate "Epson RTC-7301 SF/DG"
++	help
++	  If you say Y here you will get support for the
++	  Epson RTC-7301 SF/DG RTC chips.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called rtc-7301.
++
+ comment "on-CPU RTC drivers"
+ 
+ config RTC_DRV_DAVINCI
+--- a/drivers/rtc/Makefile
++++ b/drivers/rtc/Makefile
+@@ -86,6 +86,7 @@ obj-$(CONFIG_RTC_DRV_RP5C01)	+= rtc-rp5c
+ obj-$(CONFIG_RTC_DRV_RS5C313)	+= rtc-rs5c313.o
+ obj-$(CONFIG_RTC_DRV_RS5C348)	+= rtc-rs5c348.o
+ obj-$(CONFIG_RTC_DRV_RS5C372)	+= rtc-rs5c372.o
++obj-$(CONFIG_RTC_DRV_RTC7301)	+= rtc-rtc7301.o
+ obj-$(CONFIG_RTC_DRV_RV3029C2)	+= rtc-rv3029c2.o
+ obj-$(CONFIG_RTC_DRV_RX8025)	+= rtc-rx8025.o
+ obj-$(CONFIG_RTC_DRV_RX8581)	+= rtc-rx8581.o
+--- /dev/null
++++ b/drivers/rtc/rtc-rtc7301.c
+@@ -0,0 +1,219 @@
++/*
++ * Driver for Epson RTC-7301SF/DG
++ *
++ * Copyright (C) 2009 Jose Vasconcellos
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/module.h>
++#include <linux/rtc.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++#include <linux/delay.h>
++#include <linux/bcd.h>
++
++#define RTC_NAME "rtc7301"
++#define RTC_VERSION "0.1"
++
++/* Epson RTC-7301 register addresses */
++#define RTC7301_SEC		0x00
++#define RTC7301_SEC10		0x01
++#define RTC7301_MIN		0x02
++#define RTC7301_MIN10		0x03
++#define RTC7301_HOUR		0x04
++#define RTC7301_HOUR10		0x05
++#define RTC7301_WEEKDAY		0x06
++#define RTC7301_DAY		0x07
++#define RTC7301_DAY10		0x08
++#define RTC7301_MON		0x09
++#define RTC7301_MON10		0x0A
++#define RTC7301_YEAR		0x0B
++#define RTC7301_YEAR10		0x0C
++#define RTC7301_YEAR100		0x0D
++#define RTC7301_YEAR1000	0x0E
++#define RTC7301_CTRLREG		0x0F
++
++static uint8_t __iomem *rtc7301_base;
++
++#define read_reg(offset) (readb(rtc7301_base + offset) & 0xf)
++#define write_reg(offset, data) writeb(data, rtc7301_base + (offset))
++
++#define rtc7301_isbusy() (read_reg(RTC7301_CTRLREG) & 1)
++
++static void rtc7301_init_settings(void)
++{
++	int i;
++
++	write_reg(RTC7301_CTRLREG, 2);
++	write_reg(RTC7301_YEAR1000, 2);
++	udelay(122);
++
++	/* bank 1 */
++	write_reg(RTC7301_CTRLREG, 6);
++	for (i=0; i<15; i++)
++		write_reg(i, 0);
++
++	/* bank 2 */
++	write_reg(RTC7301_CTRLREG, 14);
++	for (i=0; i<15; i++)
++		write_reg(i, 0);
++	write_reg(RTC7301_CTRLREG, 0);
++}
++
++static int rtc7301_get_datetime(struct device *dev, struct rtc_time *dt)
++{
++	int cnt;
++	uint8_t buf[16];
++
++	cnt = 0;
++	while (rtc7301_isbusy()) {
++		udelay(244);
++		if (cnt++ > 100) {
++			dev_err(dev, "%s: timeout error %x\n", __func__, rtc7301_base[RTC7301_CTRLREG]);
++			return -EIO;
++		}
++	}
++
++	for (cnt=0; cnt<16; cnt++)
++		buf[cnt] = read_reg(cnt);
++
++	if (buf[RTC7301_SEC10] & 8) {
++		dev_err(dev, "%s: RTC not set\n", __func__);
++		return -EINVAL;
++	}
++
++	memset(dt, 0, sizeof(*dt));
++
++	dt->tm_sec =  buf[RTC7301_SEC] + buf[RTC7301_SEC10]*10;
++	dt->tm_min =  buf[RTC7301_MIN] + buf[RTC7301_MIN10]*10;
++	dt->tm_hour = buf[RTC7301_HOUR] + buf[RTC7301_HOUR10]*10;
++
++	dt->tm_mday = buf[RTC7301_DAY] + buf[RTC7301_DAY10]*10;
++	dt->tm_mon =  buf[RTC7301_MON] + buf[RTC7301_MON10]*10 - 1;
++	dt->tm_year = buf[RTC7301_YEAR] + buf[RTC7301_YEAR10]*10 +
++		      buf[RTC7301_YEAR100]*100 +
++		      ((buf[RTC7301_YEAR1000] & 3)*1000) - 1900;
++
++	/* the rtc device may contain illegal values on power up
++	 * according to the data sheet. make sure they are valid.
++	 */
++
++	return rtc_valid_tm(dt);
++}
++
++static int rtc7301_set_datetime(struct device *dev, struct rtc_time *dt)
++{
++	int data;
++
++	data = dt->tm_year + 1900;
++	if (data >= 2100 || data < 1900)
++		return -EINVAL;
++
++	write_reg(RTC7301_CTRLREG, 2);
++       	udelay(122);
++
++	data = bin2bcd(dt->tm_sec);
++	write_reg(RTC7301_SEC, data);
++	write_reg(RTC7301_SEC10, (data >> 4));
++
++	data = bin2bcd(dt->tm_min);
++	write_reg(RTC7301_MIN, data );
++	write_reg(RTC7301_MIN10, (data >> 4));
++
++	data = bin2bcd(dt->tm_hour);
++	write_reg(RTC7301_HOUR, data);
++	write_reg(RTC7301_HOUR10, (data >> 4));
++
++	data = bin2bcd(dt->tm_mday);
++	write_reg(RTC7301_DAY, data);
++	write_reg(RTC7301_DAY10, (data>> 4));
++
++	data = bin2bcd(dt->tm_mon + 1);
++	write_reg(RTC7301_MON, data);
++	write_reg(RTC7301_MON10, (data >> 4));
++
++	data = bin2bcd(dt->tm_year % 100);
++	write_reg(RTC7301_YEAR, data);
++	write_reg(RTC7301_YEAR10, (data >> 4));
++	data = bin2bcd((1900 + dt->tm_year) / 100);
++	write_reg(RTC7301_YEAR100, data);
++
++	data = bin2bcd(dt->tm_wday);
++	write_reg(RTC7301_WEEKDAY, data);
++
++	write_reg(RTC7301_CTRLREG, 0);
++
++	return 0;
++}
++
++static const struct rtc_class_ops rtc7301_rtc_ops = {
++	.read_time	= rtc7301_get_datetime,
++	.set_time	= rtc7301_set_datetime,
++};
++
++static int __devinit rtc7301_probe(struct platform_device *pdev)
++{
++	struct rtc_device *rtc;
++	struct resource *res;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!res)
++		return -ENOENT;
++
++	rtc7301_base = ioremap_nocache(res->start, 0x1000 /*res->end - res->start + 1*/);
++	if (!rtc7301_base)
++		return -EINVAL;
++
++	rtc = rtc_device_register(RTC_NAME, &pdev->dev,
++				&rtc7301_rtc_ops, THIS_MODULE);
++	if (IS_ERR(rtc)) {
++		iounmap(rtc7301_base);
++		return PTR_ERR(rtc);
++	}
++
++	platform_set_drvdata(pdev, rtc);
++
++	rtc7301_init_settings();
++	return 0;
++}
++
++static int __devexit rtc7301_remove(struct platform_device *pdev)
++{
++	struct rtc_device *rtc = platform_get_drvdata(pdev);
++
++	if (rtc)
++		rtc_device_unregister(rtc);
++	if (rtc7301_base)
++		iounmap(rtc7301_base);
++	return 0;
++}
++
++static struct platform_driver rtc7301_driver = {
++	.driver = {
++		.name	= RTC_NAME,
++		.owner	= THIS_MODULE,
++	},
++	.probe	= rtc7301_probe,
++	.remove = __devexit_p(rtc7301_remove),
++};
++
++static __init int rtc7301_init(void)
++{
++	return platform_driver_register(&rtc7301_driver);
++}
++module_init(rtc7301_init);
++
++static __exit void rtc7301_exit(void)
++{
++	platform_driver_unregister(&rtc7301_driver);
++}
++module_exit(rtc7301_exit);
++
++MODULE_DESCRIPTION("Epson 7301 RTC driver");
++MODULE_AUTHOR("Jose Vasconcellos <jvasco@verizon.net>");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:" RTC_NAME);
++MODULE_VERSION(RTC_VERSION);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/841-rtc_pt7c4338.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/841-rtc_pt7c4338.patch.svn-base
new file mode 100644
index 0000000..2c9e603
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/841-rtc_pt7c4338.patch.svn-base
@@ -0,0 +1,247 @@
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -379,6 +379,15 @@ config RTC_DRV_RV3029C2
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called rtc-rv3029c2.
+ 
++config RTC_DRV_PT7C4338
++	tristate "Pericom Technology Inc. PT7C4338 RTC"
++	help
++	  If you say yes here you get support for the Pericom Technology
++	  Inc. PT7C4338 RTC chip.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called rtc-pt7c4338.
++
+ endif # I2C
+ 
+ comment "SPI RTC drivers"
+--- a/drivers/rtc/Makefile
++++ b/drivers/rtc/Makefile
+@@ -79,6 +79,7 @@ obj-$(CONFIG_RTC_DRV_PL030)	+= rtc-pl030
+ obj-$(CONFIG_RTC_DRV_PL031)	+= rtc-pl031.o
+ obj-$(CONFIG_RTC_DRV_PM8XXX)	+= rtc-pm8xxx.o
+ obj-$(CONFIG_RTC_DRV_PS3)	+= rtc-ps3.o
++obj-$(CONFIG_RTC_DRV_PT7C4338)	+= rtc-pt7c4338.o
+ obj-$(CONFIG_RTC_DRV_PUV3)	+= rtc-puv3.o
+ obj-$(CONFIG_RTC_DRV_PXA)	+= rtc-pxa.o
+ obj-$(CONFIG_RTC_DRV_R9701)	+= rtc-r9701.o
+--- /dev/null
++++ b/drivers/rtc/rtc-pt7c4338.c
+@@ -0,0 +1,216 @@
++/*
++ * Copyright 2010 Freescale Semiconductor, Inc.
++ *
++ * Author:	Priyanka Jain <Priyanka.Jain@freescale.com>
++ *
++ * See file CREDITS for list of people who contributed to this
++ * project.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of
++ * the License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
++ * MA 02111-1307 USA
++ */
++
++/*
++ * This file provides Date & Time support (no alarms) for PT7C4338 chip.
++ *
++ * This file is based on drivers/rtc/rtc-ds1307.c
++ *
++ * PT7C4338 chip is manufactured by Pericom Technology Inc.
++ * It is a serial real-time clock which provides
++ * 1)Low-power clock/calendar.
++ * 2)Programmable square-wave output.
++ * It has 56 bytes of nonvolatile RAM.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/i2c.h>
++#include <linux/rtc.h>
++#include <linux/bcd.h>
++
++/* RTC register addresses */
++#define PT7C4338_REG_SECONDS          0x00
++#define PT7C4338_REG_MINUTES          0x01
++#define PT7C4338_REG_HOURS            0x02
++#define PT7C4338_REG_AMPM             0x02
++#define PT7C4338_REG_DAY              0x03
++#define PT7C4338_REG_DATE             0x04
++#define PT7C4338_REG_MONTH            0x05
++#define PT7C4338_REG_YEAR             0x06
++#define PT7C4338_REG_CTRL_STAT        0x07
++
++/* RTC second register address bit */
++#define PT7C4338_SEC_BIT_CH           0x80	/*Clock Halt (in Register 0)*/
++
++/* RTC control and status register bits */
++#define PT7C4338_CTRL_STAT_BIT_RS0    0x1	/*Rate select 0*/
++#define PT7C4338_CTRL_STAT_BIT_RS1    0x2	/*Rate select 1*/
++#define PT7C4338_CTRL_STAT_BIT_SQWE   0x10	/*Square Wave Enable*/
++#define PT7C4338_CTRL_STAT_BIT_OSF    0x20	/*Oscillator Stop Flag*/
++#define PT7C4338_CTRL_STAT_BIT_OUT    0x80	/*Output Level Control*/
++
++static const struct i2c_device_id pt7c4338_id[] = {
++	{ "pt7c4338", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, pt7c4338_id);
++
++struct pt7c4338{
++	struct i2c_client *client;
++	struct rtc_device *rtc;
++};
++
++static int pt7c4338_read_time(struct device *dev, struct rtc_time *time)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	int ret;
++	u8 buf[7];
++	u8 year, month, day, hour, minute, second;
++	u8 week, twelve_hr, am_pm;
++
++	ret = i2c_smbus_read_i2c_block_data(client,
++			PT7C4338_REG_SECONDS, 7, buf);
++	if (ret < 0)
++		return ret;
++	if (ret < 7)
++		return -EIO;
++
++	second = buf[0];
++	minute = buf[1];
++	hour = buf[2];
++	week = buf[3];
++	day = buf[4];
++	month = buf[5];
++	year = buf[6];
++
++	/* Extract additional information for AM/PM */
++	twelve_hr = hour & 0x40;
++	am_pm = hour & 0x20;
++
++	/* Write to rtc_time structure */
++	time->tm_sec = bcd2bin(second & 0x7f);
++	time->tm_min = bcd2bin(minute & 0x7f);
++	if (twelve_hr) {
++		/* Convert to 24 hr */
++		if (am_pm)
++			time->tm_hour = bcd2bin(hour & 0x10) + 12;
++		else
++			time->tm_hour = bcd2bin(hour & 0xBF);
++	} else {
++		time->tm_hour = bcd2bin(hour);
++	}
++
++	time->tm_wday = bcd2bin(week & 0x07) - 1;
++	time->tm_mday = bcd2bin(day & 0x3f);
++	time->tm_mon = bcd2bin(month & 0x1F) - 1;
++	/* assume 20YY not 19YY */
++	time->tm_year = bcd2bin(year) + 100;
++
++	return 0;
++}
++
++static int pt7c4338_set_time(struct device *dev, struct rtc_time *time)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	u8 buf[7];
++
++	/* Extract time from rtc_time and load into pt7c4338*/
++	buf[0] = bin2bcd(time->tm_sec);
++	buf[1] = bin2bcd(time->tm_min);
++	buf[2] = bin2bcd(time->tm_hour);
++	buf[3] = bin2bcd(time->tm_wday + 1); /* Day of the week */
++	buf[4] = bin2bcd(time->tm_mday); /* Date */
++	buf[5] = bin2bcd(time->tm_mon + 1);
++
++	/* assume 20YY not 19YY */
++	if (time->tm_year >= 100)
++		buf[6] = bin2bcd(time->tm_year - 100);
++	else
++		buf[6] = bin2bcd(time->tm_year);
++
++	return i2c_smbus_write_i2c_block_data(client,
++					PT7C4338_REG_SECONDS, 7, buf);
++}
++
++static const struct rtc_class_ops pt7c4338_rtc_ops = {
++	.read_time = pt7c4338_read_time,
++	.set_time = pt7c4338_set_time,
++};
++
++static int pt7c4338_probe(struct i2c_client *client,
++		const struct i2c_device_id *id)
++{
++	struct pt7c4338 *pt7c4338;
++	struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
++	int ret;
++
++	pt7c4338 = kzalloc(sizeof(struct pt7c4338), GFP_KERNEL);
++	if (!pt7c4338)
++		return -ENOMEM;
++
++	pt7c4338->client = client;
++	i2c_set_clientdata(client, pt7c4338);
++	pt7c4338->rtc = rtc_device_register(client->name, &client->dev,
++					&pt7c4338_rtc_ops, THIS_MODULE);
++	if (IS_ERR(pt7c4338->rtc)) {
++		ret = PTR_ERR(pt7c4338->rtc);
++		dev_err(&client->dev, "unable to register the class device\n");
++		goto out_free;
++	}
++
++	return 0;
++out_free:
++	i2c_set_clientdata(client, NULL);
++	kfree(pt7c4338);
++	return ret;
++}
++
++static int __devexit pt7c4338_remove(struct i2c_client *client)
++{
++	struct pt7c4338 *pt7c4338 = i2c_get_clientdata(client);
++
++	rtc_device_unregister(pt7c4338->rtc);
++	i2c_set_clientdata(client, NULL);
++	kfree(pt7c4338);
++	return 0;
++}
++
++static struct i2c_driver pt7c4338_driver = {
++	.driver = {
++		.name = "rtc-pt7c4338",
++		.owner = THIS_MODULE,
++	},
++	.probe = pt7c4338_probe,
++	.remove = __devexit_p(pt7c4338_remove),
++	.id_table = pt7c4338_id,
++};
++
++static int __init pt7c4338_init(void)
++{
++	return i2c_add_driver(&pt7c4338_driver);
++}
++
++static void __exit pt7c4338_exit(void)
++{
++	i2c_del_driver(&pt7c4338_driver);
++}
++
++module_init(pt7c4338_init);
++module_exit(pt7c4338_exit);
++
++MODULE_AUTHOR("Priyanka Jain <Priyanka.Jain@freescale.com>");
++MODULE_DESCRIPTION("pericom Technology Inc. PT7C4338 RTC Driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/850-glamo_headers.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/850-glamo_headers.patch.svn-base
new file mode 100644
index 0000000..d6d49fd
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/850-glamo_headers.patch.svn-base
@@ -0,0 +1,21 @@
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -127,6 +127,7 @@
+ #define FB_ACCEL_TRIDENT_BLADE3D 52	/* Trident Blade3D		*/
+ #define FB_ACCEL_TRIDENT_BLADEXP 53	/* Trident BladeXP		*/
+ #define FB_ACCEL_CIRRUS_ALPINE   53	/* Cirrus Logic 543x/544x/5480	*/
++#define FB_ACCEL_GLAMO		50	/* SMedia Glamo                 */
+ #define FB_ACCEL_NEOMAGIC_NM2070 90	/* NeoMagic NM2070              */
+ #define FB_ACCEL_NEOMAGIC_NM2090 91	/* NeoMagic NM2090              */
+ #define FB_ACCEL_NEOMAGIC_NM2093 92	/* NeoMagic NM2093              */
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -145,6 +145,8 @@ header-y += generic_serial.h
+ header-y += genetlink.h
+ header-y += gfs2_ondisk.h
+ header-y += gigaset_dev.h
++header-y += glamofb.h
++header-y += glamo-engine.h
+ header-y += hdlc.h
+ header-y += hdlcdrv.h
+ header-y += hdreg.h
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/861-04_spi_gpio_implement_spi_delay.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/861-04_spi_gpio_implement_spi_delay.patch.svn-base
new file mode 100644
index 0000000..7828869
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/861-04_spi_gpio_implement_spi_delay.patch.svn-base
@@ -0,0 +1,58 @@
+Implement the SPI-GPIO delay function for busses that need speed limitation.
+
+--mb
+
+
+
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -22,6 +22,7 @@
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
+ #include <linux/gpio.h>
++#include <linux/delay.h>
+ 
+ #include <linux/spi/spi.h>
+ #include <linux/spi/spi_bitbang.h>
+@@ -70,6 +71,7 @@ struct spi_gpio {
+  *		#define	SPI_MOSI_GPIO	120
+  *		#define	SPI_SCK_GPIO	121
+  *		#define	SPI_N_CHIPSEL	4
++ *		#undef NEED_SPIDELAY
+  *		#include "spi-gpio.c"
+  */
+ 
+@@ -77,6 +79,7 @@ struct spi_gpio {
+ #define DRIVER_NAME	"spi_gpio"
+ 
+ #define GENERIC_BITBANG	/* vs tight inlines */
++#define NEED_SPIDELAY	1
+ 
+ /* all functions referencing these symbols must define pdata */
+ #define SPI_MISO_GPIO	((pdata)->miso)
+@@ -121,12 +124,20 @@ static inline int getmiso(const struct s
+ #undef pdata
+ 
+ /*
+- * NOTE:  this clocks "as fast as we can".  It "should" be a function of the
+- * requested device clock.  Software overhead means we usually have trouble
+- * reaching even one Mbit/sec (except when we can inline bitops), so for now
+- * we'll just assume we never need additional per-bit slowdowns.
++ * NOTE:  to clock "as fast as we can", set spi_device.max_speed_hz
++ * and spi_transfer.speed_hz to 0.
++ * Otherwise this is a function of the requested device clock.
++ * Software overhead means we usually have trouble
++ * reaching even one Mbit/sec (except when we can inline bitops). So on small
++ * embedded devices with fast SPI slaves you usually don't need a delay.
+  */
+-#define spidelay(nsecs)	do {} while (0)
++static inline void spidelay(unsigned nsecs)
++{
++#ifdef NEED_SPIDELAY
++	if (unlikely(nsecs))
++		ndelay(nsecs);
++#endif /* NEED_SPIDELAY */
++}
+ 
+ #include "spi-bitbang-txrx.h"
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/862-gpio_spi_driver.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/862-gpio_spi_driver.patch.svn-base
new file mode 100644
index 0000000..6cbea32
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/862-gpio_spi_driver.patch.svn-base
@@ -0,0 +1,373 @@
+THIS CODE IS DEPRECATED.
+
+Please use the new mainline SPI-GPIO driver, as of 2.6.29.
+
+--mb
+
+
+
+---
+ drivers/spi/Kconfig              |    9 +
+ drivers/spi/Makefile             |    1 
+ drivers/spi/spi_gpio_old.c       |  251 +++++++++++++++++++++++++++++++++++++++
+ include/linux/spi/spi_gpio_old.h |   73 +++++++++++
+ 4 files changed, 334 insertions(+)
+
+--- /dev/null
++++ b/include/linux/spi/spi_gpio_old.h
+@@ -0,0 +1,73 @@
++/*
++ * spi_gpio interface to platform code
++ *
++ * Copyright (c) 2008 Piotr Skamruk
++ * Copyright (c) 2008 Michael Buesch
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++#ifndef _LINUX_SPI_SPI_GPIO
++#define _LINUX_SPI_SPI_GPIO
++
++#include <linux/types.h>
++#include <linux/spi/spi.h>
++
++
++/**
++ * struct spi_gpio_platform_data - Data definitions for a SPI-GPIO device.
++ *
++ * This structure holds information about a GPIO-based SPI device.
++ *
++ * @pin_clk: The GPIO pin number of the CLOCK pin.
++ *
++ * @pin_miso: The GPIO pin number of the MISO pin.
++ *
++ * @pin_mosi: The GPIO pin number of the MOSI pin.
++ *
++ * @pin_cs: The GPIO pin number of the CHIPSELECT pin.
++ *
++ * @cs_activelow: If true, the chip is selected when the CS line is low.
++ *
++ * @no_spi_delay: If true, no delay is done in the lowlevel bitbanging.
++ *                Note that doing no delay is not standards compliant,
++ *                but it might be needed to speed up transfers on some
++ *                slow embedded machines.
++ *
++ * @boardinfo_setup: This callback is called after the
++ *                   SPI master device was registered, but before the
++ *                   device is registered.
++ * @boardinfo_setup_data: Data argument passed to boardinfo_setup().
++ */
++struct spi_gpio_platform_data {
++	unsigned int pin_clk;
++	unsigned int pin_miso;
++	unsigned int pin_mosi;
++	unsigned int pin_cs;
++	bool cs_activelow;
++	bool no_spi_delay;
++	int (*boardinfo_setup)(struct spi_board_info *bi,
++			       struct spi_master *master,
++			       void *data);
++	void *boardinfo_setup_data;
++};
++
++/**
++ * SPI_GPIO_PLATDEV_NAME - The platform device name string.
++ *
++ * The name string that has to be used for platform_device_alloc
++ * when allocating a spi-gpio device.
++ */
++#define SPI_GPIO_PLATDEV_NAME	"spi-gpio"
++
++/**
++ * spi_gpio_next_id - Get another platform device ID number.
++ *
++ * This returns the next platform device ID number that has to be used
++ * for platform_device_alloc. The ID is opaque and should not be used for
++ * anything else.
++ */
++int spi_gpio_next_id(void);
++
++#endif /* _LINUX_SPI_SPI_GPIO */
+--- /dev/null
++++ b/drivers/spi/spi_gpio_old.c
+@@ -0,0 +1,251 @@
++/*
++ * Bitbanging SPI bus driver using GPIO API
++ *
++ * Copyright (c) 2008 Piotr Skamruk
++ * Copyright (c) 2008 Michael Buesch
++ *
++ * based on spi_s3c2410_gpio.c
++ *   Copyright (c) 2006 Ben Dooks
++ *   Copyright (c) 2006 Simtec Electronics
++ * and on i2c-gpio.c
++ *   Copyright (C) 2007 Atmel Corporation
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/spinlock.h>
++#include <linux/workqueue.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/spi/spi.h>
++#include <linux/spi/spi_bitbang.h>
++#include <linux/spi/spi_gpio_old.h>
++#include <linux/gpio.h>
++#include <asm/atomic.h>
++
++
++struct spi_gpio {
++	struct spi_bitbang bitbang;
++	struct spi_gpio_platform_data *info;
++	struct platform_device *pdev;
++	struct spi_board_info bi;
++};
++
++
++static inline struct spi_gpio *spidev_to_sg(struct spi_device *dev)
++{
++	return dev->controller_data;
++}
++
++static inline void setsck(struct spi_device *dev, int val)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++	gpio_set_value(sp->info->pin_clk, val ? 1 : 0);
++}
++
++static inline void setmosi(struct spi_device *dev, int val)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++	gpio_set_value(sp->info->pin_mosi, val ? 1 : 0);
++}
++
++static inline u32 getmiso(struct spi_device *dev)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++	return gpio_get_value(sp->info->pin_miso) ? 1 : 0;
++}
++
++static inline void do_spidelay(struct spi_device *dev, unsigned nsecs)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++
++	if (!sp->info->no_spi_delay)
++		ndelay(nsecs);
++}
++
++#define spidelay(nsecs) do {					\
++	/* Steal the spi_device pointer from our caller.	\
++	 * The bitbang-API should probably get fixed here... */	\
++	do_spidelay(spi, nsecs);				\
++  } while (0)
++
++#define EXPAND_BITBANG_TXRX
++#include "spi-bitbang-txrx.h"
++
++static u32 spi_gpio_txrx_mode0(struct spi_device *spi,
++			       unsigned nsecs, u32 word, u8 bits)
++{
++	return bitbang_txrx_be_cpha0(spi, nsecs, 0, 0, word, bits);
++}
++
++static u32 spi_gpio_txrx_mode1(struct spi_device *spi,
++			       unsigned nsecs, u32 word, u8 bits)
++{
++	return bitbang_txrx_be_cpha1(spi, nsecs, 0, 0, word, bits);
++}
++
++static u32 spi_gpio_txrx_mode2(struct spi_device *spi,
++			       unsigned nsecs, u32 word, u8 bits)
++{
++	return bitbang_txrx_be_cpha0(spi, nsecs, 1, 0, word, bits);
++}
++
++static u32 spi_gpio_txrx_mode3(struct spi_device *spi,
++			       unsigned nsecs, u32 word, u8 bits)
++{
++	return bitbang_txrx_be_cpha1(spi, nsecs, 1, 0, word, bits);
++}
++
++static void spi_gpio_chipselect(struct spi_device *dev, int on)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++
++	if (sp->info->cs_activelow)
++		on = !on;
++	gpio_set_value(sp->info->pin_cs, on ? 1 : 0);
++}
++
++static int spi_gpio_probe(struct platform_device *pdev)
++{
++	struct spi_master *master;
++	struct spi_gpio_platform_data *pdata;
++	struct spi_gpio *sp;
++	struct spi_device *spidev;
++	int err;
++
++	pdata = pdev->dev.platform_data;
++	if (!pdata)
++		return -ENXIO;
++
++	err = -ENOMEM;
++	master = spi_alloc_master(&pdev->dev, sizeof(struct spi_gpio));
++	if (!master)
++		goto err_alloc_master;
++
++	sp = spi_master_get_devdata(master);
++	platform_set_drvdata(pdev, sp);
++	sp->info = pdata;
++
++	err = gpio_request(pdata->pin_clk, "spi_clock");
++	if (err)
++		goto err_request_clk;
++	err = gpio_request(pdata->pin_mosi, "spi_mosi");
++	if (err)
++		goto err_request_mosi;
++	err = gpio_request(pdata->pin_miso, "spi_miso");
++	if (err)
++		goto err_request_miso;
++	err = gpio_request(pdata->pin_cs, "spi_cs");
++	if (err)
++		goto err_request_cs;
++
++	sp->bitbang.master = spi_master_get(master);
++	sp->bitbang.master->bus_num = -1;
++	sp->bitbang.master->num_chipselect = 1;
++	sp->bitbang.chipselect = spi_gpio_chipselect;
++	sp->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_mode0;
++	sp->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_mode1;
++	sp->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_mode2;
++	sp->bitbang.txrx_word[SPI_MODE_3] = spi_gpio_txrx_mode3;
++
++	gpio_direction_output(pdata->pin_clk, 0);
++	gpio_direction_output(pdata->pin_mosi, 0);
++	gpio_direction_output(pdata->pin_cs,
++			      pdata->cs_activelow ? 1 : 0);
++	gpio_direction_input(pdata->pin_miso);
++
++	err = spi_bitbang_start(&sp->bitbang);
++	if (err)
++		goto err_no_bitbang;
++	err = pdata->boardinfo_setup(&sp->bi, master,
++				     pdata->boardinfo_setup_data);
++	if (err)
++		goto err_bi_setup;
++	sp->bi.controller_data = sp;
++	spidev = spi_new_device(master, &sp->bi);
++	if (!spidev)
++		goto err_new_dev;
++
++	return 0;
++
++err_new_dev:
++err_bi_setup:
++	spi_bitbang_stop(&sp->bitbang);
++err_no_bitbang:
++	spi_master_put(sp->bitbang.master);
++	gpio_free(pdata->pin_cs);
++err_request_cs:
++	gpio_free(pdata->pin_miso);
++err_request_miso:
++	gpio_free(pdata->pin_mosi);
++err_request_mosi:
++	gpio_free(pdata->pin_clk);
++err_request_clk:
++	kfree(master);
++
++err_alloc_master:
++	return err;
++}
++
++static int __devexit spi_gpio_remove(struct platform_device *pdev)
++{
++	struct spi_gpio *sp;
++	struct spi_gpio_platform_data *pdata;
++
++	pdata = pdev->dev.platform_data;
++	sp = platform_get_drvdata(pdev);
++
++	gpio_free(pdata->pin_clk);
++	gpio_free(pdata->pin_mosi);
++	gpio_free(pdata->pin_miso);
++	gpio_free(pdata->pin_cs);
++	spi_bitbang_stop(&sp->bitbang);
++	spi_master_put(sp->bitbang.master);
++
++	return 0;
++}
++
++static struct platform_driver spi_gpio_driver = {
++	.driver		= {
++		.name	= SPI_GPIO_PLATDEV_NAME,
++		.owner	= THIS_MODULE,
++	},
++	.probe		= spi_gpio_probe,
++	.remove		= __devexit_p(spi_gpio_remove),
++};
++
++int spi_gpio_next_id(void)
++{
++	static atomic_t counter = ATOMIC_INIT(-1);
++
++	return atomic_inc_return(&counter);
++}
++EXPORT_SYMBOL(spi_gpio_next_id);
++
++static int __init spi_gpio_init(void)
++{
++	int err;
++
++	err = platform_driver_register(&spi_gpio_driver);
++	if (err)
++		printk(KERN_ERR "spi-gpio: register failed: %d\n", err);
++
++	return err;
++}
++module_init(spi_gpio_init);
++
++static void __exit spi_gpio_exit(void)
++{
++	platform_driver_unregister(&spi_gpio_driver);
++}
++module_exit(spi_gpio_exit);
++
++MODULE_AUTHOR("Piot Skamruk <piotr.skamruk at gmail.com>");
++MODULE_AUTHOR("Michael Buesch");
++MODULE_DESCRIPTION("Platform independent GPIO bitbanging SPI driver");
++MODULE_LICENSE("GPL v2");
+--- a/drivers/spi/Kconfig
++++ b/drivers/spi/Kconfig
+@@ -154,6 +154,15 @@ config SPI_GPIO
+ 	  GPIO operations, you should be able to leverage that for better
+ 	  speed with a custom version of this driver; see the source code.
+ 
++config SPI_GPIO_OLD
++	tristate "Old GPIO API based bitbanging SPI controller (DEPRECATED)"
++	depends on SPI_MASTER && GENERIC_GPIO
++	select SPI_BITBANG
++	help
++	  This code is deprecated. Please use the new mainline SPI-GPIO driver.
++
++	  If unsure, say N.
++
+ config SPI_IMX
+ 	tristate "Freescale i.MX SPI controllers"
+ 	depends on ARCH_MXC
+--- a/drivers/spi/Makefile
++++ b/drivers/spi/Makefile
+@@ -29,6 +29,7 @@ obj-$(CONFIG_SPI_FSL_LIB)		+= spi-fsl-li
+ obj-$(CONFIG_SPI_FSL_ESPI)		+= spi-fsl-espi.o
+ obj-$(CONFIG_SPI_FSL_SPI)		+= spi-fsl-spi.o
+ obj-$(CONFIG_SPI_GPIO)			+= spi-gpio.o
++obj-$(CONFIG_SPI_GPIO_OLD)		+= spi_gpio_old.o
+ obj-$(CONFIG_SPI_IMX)			+= spi-imx.o
+ obj-$(CONFIG_SPI_LM70_LLP)		+= spi-lm70llp.o
+ obj-$(CONFIG_SPI_MPC512x_PSC)		+= spi-mpc512x-psc.o
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/863-gpiommc.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/863-gpiommc.patch.svn-base
new file mode 100644
index 0000000..3260671
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/863-gpiommc.patch.svn-base
@@ -0,0 +1,844 @@
+--- /dev/null
++++ b/drivers/mmc/host/gpiommc.c
+@@ -0,0 +1,609 @@
++/*
++ * Driver an MMC/SD card on a bitbanging GPIO SPI bus.
++ * This module hooks up the mmc_spi and spi_gpio modules and also
++ * provides a configfs interface.
++ *
++ * Copyright 2008 Michael Buesch <mb@bu3sch.de>
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/module.h>
++#include <linux/mmc/gpiommc.h>
++#include <linux/platform_device.h>
++#include <linux/list.h>
++#include <linux/mutex.h>
++#include <linux/spi/spi_gpio_old.h>
++#include <linux/configfs.h>
++#include <linux/gpio.h>
++#include <asm/atomic.h>
++
++
++#define PFX				"gpio-mmc: "
++
++
++struct gpiommc_device {
++	struct platform_device *pdev;
++	struct platform_device *spi_pdev;
++	struct spi_board_info boardinfo;
++};
++
++
++MODULE_DESCRIPTION("GPIO based MMC driver");
++MODULE_AUTHOR("Michael Buesch");
++MODULE_LICENSE("GPL");
++
++
++static int gpiommc_boardinfo_setup(struct spi_board_info *bi,
++				   struct spi_master *master,
++				   void *data)
++{
++	struct gpiommc_device *d = data;
++	struct gpiommc_platform_data *pdata = d->pdev->dev.platform_data;
++
++	/* Bind the SPI master to the MMC-SPI host driver. */
++	strlcpy(bi->modalias, "mmc_spi", sizeof(bi->modalias));
++
++	bi->max_speed_hz = pdata->max_bus_speed;
++	bi->bus_num = master->bus_num;
++	bi->mode = pdata->mode;
++
++	return 0;
++}
++
++static int gpiommc_probe(struct platform_device *pdev)
++{
++	struct gpiommc_platform_data *mmc_pdata = pdev->dev.platform_data;
++	struct spi_gpio_platform_data spi_pdata;
++	struct gpiommc_device *d;
++	int err;
++
++	err = -ENXIO;
++	if (!mmc_pdata)
++		goto error;
++
++#ifdef CONFIG_MMC_SPI_MODULE
++	err = request_module("mmc_spi");
++	if (err) {
++		printk(KERN_WARNING PFX
++		       "Failed to request mmc_spi module.\n");
++	}
++#endif /* CONFIG_MMC_SPI_MODULE */
++
++	/* Allocate the GPIO-MMC device */
++	err = -ENOMEM;
++	d = kzalloc(sizeof(*d), GFP_KERNEL);
++	if (!d)
++		goto error;
++	d->pdev = pdev;
++
++	/* Create the SPI-GPIO device */
++	d->spi_pdev = platform_device_alloc(SPI_GPIO_PLATDEV_NAME,
++					    spi_gpio_next_id());
++	if (!d->spi_pdev)
++		goto err_free_d;
++
++	memset(&spi_pdata, 0, sizeof(spi_pdata));
++	spi_pdata.pin_clk = mmc_pdata->pins.gpio_clk;
++	spi_pdata.pin_miso = mmc_pdata->pins.gpio_do;
++	spi_pdata.pin_mosi = mmc_pdata->pins.gpio_di;
++	spi_pdata.pin_cs = mmc_pdata->pins.gpio_cs;
++	spi_pdata.cs_activelow = mmc_pdata->pins.cs_activelow;
++	spi_pdata.no_spi_delay = mmc_pdata->no_spi_delay;
++	spi_pdata.boardinfo_setup = gpiommc_boardinfo_setup;
++	spi_pdata.boardinfo_setup_data = d;
++
++	err = platform_device_add_data(d->spi_pdev, &spi_pdata,
++				       sizeof(spi_pdata));
++	if (err)
++		goto err_free_pdev;
++	err = platform_device_add(d->spi_pdev);
++	if (err)
++		goto err_free_pdata;
++	platform_set_drvdata(pdev, d);
++
++	printk(KERN_INFO PFX "MMC-Card \"%s\" "
++	       "attached to GPIO pins di=%u, do=%u, clk=%u, cs=%u\n",
++	       mmc_pdata->name, mmc_pdata->pins.gpio_di,
++	       mmc_pdata->pins.gpio_do,
++	       mmc_pdata->pins.gpio_clk,
++	       mmc_pdata->pins.gpio_cs);
++
++	return 0;
++
++err_free_pdata:
++	kfree(d->spi_pdev->dev.platform_data);
++	d->spi_pdev->dev.platform_data = NULL;
++err_free_pdev:
++	platform_device_put(d->spi_pdev);
++err_free_d:
++	kfree(d);
++error:
++	return err;
++}
++
++static int gpiommc_remove(struct platform_device *pdev)
++{
++	struct gpiommc_device *d = platform_get_drvdata(pdev);
++	struct gpiommc_platform_data *pdata = d->pdev->dev.platform_data;
++
++	platform_device_unregister(d->spi_pdev);
++	printk(KERN_INFO PFX "GPIO based MMC-Card \"%s\" removed\n",
++	       pdata->name);
++	platform_device_put(d->spi_pdev);
++
++	return 0;
++}
++
++#ifdef CONFIG_GPIOMMC_CONFIGFS
++
++/* A device that was created through configfs */
++struct gpiommc_configfs_device {
++	struct config_item item;
++	/* The platform device, after registration. */
++	struct platform_device *pdev;
++	/* The configuration */
++	struct gpiommc_platform_data pdata;
++};
++
++#define GPIO_INVALID	-1
++
++static inline bool gpiommc_is_registered(struct gpiommc_configfs_device *dev)
++{
++	return (dev->pdev != NULL);
++}
++
++static inline struct gpiommc_configfs_device *ci_to_gpiommc(struct config_item *item)
++{
++	return item ? container_of(item, struct gpiommc_configfs_device, item) : NULL;
++}
++
++static struct configfs_attribute gpiommc_attr_DI = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_data_in",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_DO = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_data_out",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_CLK = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_clock",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_CS = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_chipselect",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_CS_activelow = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_chipselect_activelow",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_spimode = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "spi_mode",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_spidelay = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "spi_delay",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_max_bus_speed = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "max_bus_speed",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_register = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "register",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute *gpiommc_config_attrs[] = {
++	&gpiommc_attr_DI,
++	&gpiommc_attr_DO,
++	&gpiommc_attr_CLK,
++	&gpiommc_attr_CS,
++	&gpiommc_attr_CS_activelow,
++	&gpiommc_attr_spimode,
++	&gpiommc_attr_spidelay,
++	&gpiommc_attr_max_bus_speed,
++	&gpiommc_attr_register,
++	NULL,
++};
++
++static ssize_t gpiommc_config_attr_show(struct config_item *item,
++					struct configfs_attribute *attr,
++					char *page)
++{
++	struct gpiommc_configfs_device *dev = ci_to_gpiommc(item);
++	ssize_t count = 0;
++	unsigned int gpio;
++	int err = 0;
++
++	if (attr == &gpiommc_attr_DI) {
++		gpio = dev->pdata.pins.gpio_di;
++		if (gpio == GPIO_INVALID)
++			count = snprintf(page, PAGE_SIZE, "not configured\n");
++		else
++			count = snprintf(page, PAGE_SIZE, "%u\n", gpio);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_DO) {
++		gpio = dev->pdata.pins.gpio_do;
++		if (gpio == GPIO_INVALID)
++			count = snprintf(page, PAGE_SIZE, "not configured\n");
++		else
++			count = snprintf(page, PAGE_SIZE, "%u\n", gpio);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CLK) {
++		gpio = dev->pdata.pins.gpio_clk;
++		if (gpio == GPIO_INVALID)
++			count = snprintf(page, PAGE_SIZE, "not configured\n");
++		else
++			count = snprintf(page, PAGE_SIZE, "%u\n", gpio);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CS) {
++		gpio = dev->pdata.pins.gpio_cs;
++		if (gpio == GPIO_INVALID)
++			count = snprintf(page, PAGE_SIZE, "not configured\n");
++		else
++			count = snprintf(page, PAGE_SIZE, "%u\n", gpio);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CS_activelow) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 dev->pdata.pins.cs_activelow);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_spimode) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 dev->pdata.mode);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_spidelay) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 !dev->pdata.no_spi_delay);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_max_bus_speed) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 dev->pdata.max_bus_speed);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_register) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 gpiommc_is_registered(dev));
++		goto out;
++	}
++	WARN_ON(1);
++	err = -ENOSYS;
++out:
++	return err ? err : count;
++}
++
++static int gpiommc_do_register(struct gpiommc_configfs_device *dev,
++			       const char *name)
++{
++	int err;
++
++	if (gpiommc_is_registered(dev))
++		return 0;
++
++	if (!gpio_is_valid(dev->pdata.pins.gpio_di) ||
++	    !gpio_is_valid(dev->pdata.pins.gpio_do) ||
++	    !gpio_is_valid(dev->pdata.pins.gpio_clk) ||
++	    !gpio_is_valid(dev->pdata.pins.gpio_cs)) {
++		printk(KERN_ERR PFX
++		       "configfs: Invalid GPIO pin number(s)\n");
++		return -EINVAL;
++	}
++
++	strlcpy(dev->pdata.name, name,
++		sizeof(dev->pdata.name));
++
++	dev->pdev = platform_device_alloc(GPIOMMC_PLATDEV_NAME,
++					  gpiommc_next_id());
++	if (!dev->pdev)
++		return -ENOMEM;
++	err = platform_device_add_data(dev->pdev, &dev->pdata,
++				       sizeof(dev->pdata));
++	if (err) {
++		platform_device_put(dev->pdev);
++		return err;
++	}
++	err = platform_device_add(dev->pdev);
++	if (err) {
++		platform_device_put(dev->pdev);
++		return err;
++	}
++
++	return 0;
++}
++
++static void gpiommc_do_unregister(struct gpiommc_configfs_device *dev)
++{
++	if (!gpiommc_is_registered(dev))
++		return;
++
++	platform_device_unregister(dev->pdev);
++	dev->pdev = NULL;
++}
++
++static ssize_t gpiommc_config_attr_store(struct config_item *item,
++					 struct configfs_attribute *attr,
++					 const char *page, size_t count)
++{
++	struct gpiommc_configfs_device *dev = ci_to_gpiommc(item);
++	int err = -EINVAL;
++	unsigned long data;
++
++	if (attr == &gpiommc_attr_register) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (data == 1)
++			err = gpiommc_do_register(dev, item->ci_name);
++		if (data == 0) {
++			gpiommc_do_unregister(dev);
++			err = 0;
++		}
++		goto out;
++	}
++
++	if (gpiommc_is_registered(dev)) {
++		/* The rest of the config parameters can only be set
++		 * as long as the device is not registered, yet. */
++		err = -EBUSY;
++		goto out;
++	}
++
++	if (attr == &gpiommc_attr_DI) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (!gpio_is_valid(data))
++			goto out;
++		dev->pdata.pins.gpio_di = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_DO) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (!gpio_is_valid(data))
++			goto out;
++		dev->pdata.pins.gpio_do = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CLK) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (!gpio_is_valid(data))
++			goto out;
++		dev->pdata.pins.gpio_clk = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CS) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (!gpio_is_valid(data))
++			goto out;
++		dev->pdata.pins.gpio_cs = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CS_activelow) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (data != 0 && data != 1)
++			goto out;
++		dev->pdata.pins.cs_activelow = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_spimode) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		switch (data) {
++		case 0:
++			dev->pdata.mode = SPI_MODE_0;
++			break;
++		case 1:
++			dev->pdata.mode = SPI_MODE_1;
++			break;
++		case 2:
++			dev->pdata.mode = SPI_MODE_2;
++			break;
++		case 3:
++			dev->pdata.mode = SPI_MODE_3;
++			break;
++		default:
++			goto out;
++		}
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_spidelay) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (data != 0 && data != 1)
++			goto out;
++		dev->pdata.no_spi_delay = !data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_max_bus_speed) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (data > UINT_MAX)
++			goto out;
++		dev->pdata.max_bus_speed = data;
++		err = 0;
++		goto out;
++	}
++	WARN_ON(1);
++	err = -ENOSYS;
++out:
++	return err ? err : count;
++}
++
++static void gpiommc_config_item_release(struct config_item *item)
++{
++	struct gpiommc_configfs_device *dev = ci_to_gpiommc(item);
++
++	kfree(dev);
++}
++
++static struct configfs_item_operations gpiommc_config_item_ops = {
++	.release		= gpiommc_config_item_release,
++	.show_attribute		= gpiommc_config_attr_show,
++	.store_attribute	= gpiommc_config_attr_store,
++};
++
++static struct config_item_type gpiommc_dev_ci_type = {
++	.ct_item_ops	= &gpiommc_config_item_ops,
++	.ct_attrs	= gpiommc_config_attrs,
++	.ct_owner	= THIS_MODULE,
++};
++
++static struct config_item *gpiommc_make_item(struct config_group *group,
++					     const char *name)
++{
++	struct gpiommc_configfs_device *dev;
++
++	if (strlen(name) > GPIOMMC_MAX_NAMELEN) {
++		printk(KERN_ERR PFX "configfs: device name too long\n");
++		return NULL;
++	}
++
++	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return NULL;
++
++	config_item_init_type_name(&dev->item, name,
++				   &gpiommc_dev_ci_type);
++
++	/* Assign default configuration */
++	dev->pdata.pins.gpio_di = GPIO_INVALID;
++	dev->pdata.pins.gpio_do = GPIO_INVALID;
++	dev->pdata.pins.gpio_clk = GPIO_INVALID;
++	dev->pdata.pins.gpio_cs = GPIO_INVALID;
++	dev->pdata.pins.cs_activelow = 1;
++	dev->pdata.mode = SPI_MODE_0;
++	dev->pdata.no_spi_delay = 0;
++	dev->pdata.max_bus_speed = 5000000; /* 5 MHz */
++
++	return &(dev->item);
++}
++
++static void gpiommc_drop_item(struct config_group *group,
++			      struct config_item *item)
++{
++	struct gpiommc_configfs_device *dev = ci_to_gpiommc(item);
++
++	gpiommc_do_unregister(dev);
++	kfree(dev);
++}
++
++static struct configfs_group_operations gpiommc_ct_group_ops = {
++	.make_item	= gpiommc_make_item,
++	.drop_item	= gpiommc_drop_item,
++};
++
++static struct config_item_type gpiommc_ci_type = {
++	.ct_group_ops	= &gpiommc_ct_group_ops,
++	.ct_owner	= THIS_MODULE,
++};
++
++static struct configfs_subsystem gpiommc_subsys = {
++	.su_group = {
++		.cg_item = {
++			.ci_namebuf = GPIOMMC_PLATDEV_NAME,
++			.ci_type = &gpiommc_ci_type,
++		},
++	},
++	.su_mutex = __MUTEX_INITIALIZER(gpiommc_subsys.su_mutex),
++};
++
++#endif /* CONFIG_GPIOMMC_CONFIGFS */
++
++static struct platform_driver gpiommc_plat_driver = {
++	.probe	= gpiommc_probe,
++	.remove	= gpiommc_remove,
++	.driver	= {
++		.name	= GPIOMMC_PLATDEV_NAME,
++		.owner	= THIS_MODULE,
++	},
++};
++
++int gpiommc_next_id(void)
++{
++	static atomic_t counter = ATOMIC_INIT(-1);
++
++	return atomic_inc_return(&counter);
++}
++EXPORT_SYMBOL(gpiommc_next_id);
++
++static int __init gpiommc_modinit(void)
++{
++	int err;
++
++	err = platform_driver_register(&gpiommc_plat_driver);
++	if (err)
++		return err;
++
++#ifdef CONFIG_GPIOMMC_CONFIGFS
++	config_group_init(&gpiommc_subsys.su_group);
++	err = configfs_register_subsystem(&gpiommc_subsys);
++	if (err) {
++		platform_driver_unregister(&gpiommc_plat_driver);
++		return err;
++	}
++#endif /* CONFIG_GPIOMMC_CONFIGFS */
++
++	return 0;
++}
++module_init(gpiommc_modinit);
++
++static void __exit gpiommc_modexit(void)
++{
++#ifdef CONFIG_GPIOMMC_CONFIGFS
++	configfs_unregister_subsystem(&gpiommc_subsys);
++#endif
++	platform_driver_unregister(&gpiommc_plat_driver);
++}
++module_exit(gpiommc_modexit);
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -474,6 +474,31 @@ config MMC_SDHI
+ 	  This provides support for the SDHI SD/SDIO controller found in
+ 	  SuperH and ARM SH-Mobile SoCs
+ 
++config GPIOMMC
++	tristate "MMC/SD over GPIO-based SPI"
++	depends on MMC && MMC_SPI && SPI_GPIO_OLD
++	help
++	  This driver hooks up the mmc_spi and spi_gpio modules so that
++	  MMC/SD cards can be used on a GPIO based bus by bitbanging
++	  the SPI protocol in software.
++
++	  This driver provides a configfs interface to dynamically create
++	  and destroy GPIO-based MMC/SD card devices. It also provides
++	  a platform device interface API.
++	  See Documentation/gpiommc.txt for details.
++
++	  The module will be called gpiommc.
++
++	  If unsure, say N.
++
++config GPIOMMC_CONFIGFS
++	bool
++	depends on GPIOMMC && CONFIGFS_FS
++	default y
++	help
++	  This option automatically enables configfs support for gpiommc
++	  if configfs is available.
++
+ config MMC_CB710
+ 	tristate "ENE CB710 MMC/SD Interface support"
+ 	depends on PCI
+--- a/drivers/mmc/host/Makefile
++++ b/drivers/mmc/host/Makefile
+@@ -37,6 +37,7 @@ tmio_mmc_core-$(subst m,y,$(CONFIG_MMC_S
+ obj-$(CONFIG_MMC_SDHI)		+= sh_mobile_sdhi.o
+ obj-$(CONFIG_MMC_CB710)		+= cb710-mmc.o
+ obj-$(CONFIG_MMC_VIA_SDMMC)	+= via-sdmmc.o
++obj-$(CONFIG_GPIOMMC)		+= gpiommc.o
+ obj-$(CONFIG_SDH_BFIN)		+= bfin_sdh.o
+ obj-$(CONFIG_MMC_DW)		+= dw_mmc.o
+ obj-$(CONFIG_MMC_SH_MMCIF)	+= sh_mmcif.o
+--- /dev/null
++++ b/include/linux/mmc/gpiommc.h
+@@ -0,0 +1,71 @@
++/*
++ * Device driver for MMC/SD cards driven over a GPIO bus.
++ *
++ * Copyright (c) 2008 Michael Buesch
++ *
++ * Licensed under the GNU/GPL version 2.
++ */
++#ifndef LINUX_GPIOMMC_H_
++#define LINUX_GPIOMMC_H_
++
++#include <linux/types.h>
++
++
++#define GPIOMMC_MAX_NAMELEN		15
++#define GPIOMMC_MAX_NAMELEN_STR		__stringify(GPIOMMC_MAX_NAMELEN)
++
++/**
++ * struct gpiommc_pins - Hardware pin assignments
++ *
++ * @gpio_di: The GPIO number of the DATA IN pin
++ * @gpio_do: The GPIO number of the DATA OUT pin
++ * @gpio_clk: The GPIO number of the CLOCK pin
++ * @gpio_cs: The GPIO number of the CHIPSELECT pin
++ * @cs_activelow: If true, the chip is considered selected if @gpio_cs is low.
++ */
++struct gpiommc_pins {
++	unsigned int gpio_di;
++	unsigned int gpio_do;
++	unsigned int gpio_clk;
++	unsigned int gpio_cs;
++	bool cs_activelow;
++};
++
++/**
++ * struct gpiommc_platform_data - Platform data for a MMC-over-SPI-GPIO device.
++ *
++ * @name: The unique name string of the device.
++ * @pins: The hardware pin assignments.
++ * @mode: The hardware mode. This is either SPI_MODE_0,
++ *        SPI_MODE_1, SPI_MODE_2 or SPI_MODE_3. See the SPI documentation.
++ * @no_spi_delay: Do not use delays in the lowlevel SPI bitbanging code.
++ *                This is not standards compliant, but may be required for some
++ *                embedded machines to gain reasonable speed.
++ * @max_bus_speed: The maximum speed of the SPI bus, in Hertz.
++ */
++struct gpiommc_platform_data {
++	char name[GPIOMMC_MAX_NAMELEN + 1];
++	struct gpiommc_pins pins;
++	u8 mode;
++	bool no_spi_delay;
++	unsigned int max_bus_speed;
++};
++
++/**
++ * GPIOMMC_PLATDEV_NAME - The platform device name string.
++ *
++ * The name string that has to be used for platform_device_alloc
++ * when allocating a gpiommc device.
++ */
++#define GPIOMMC_PLATDEV_NAME	"gpiommc"
++
++/**
++ * gpiommc_next_id - Get another platform device ID number.
++ *
++ * This returns the next platform device ID number that has to be used
++ * for platform_device_alloc. The ID is opaque and should not be used for
++ * anything else.
++ */
++int gpiommc_next_id(void);
++
++#endif /* LINUX_GPIOMMC_H_ */
+--- /dev/null
++++ b/Documentation/gpiommc.txt
+@@ -0,0 +1,97 @@
++GPIOMMC - Driver for an MMC/SD card on a bitbanging GPIO SPI bus
++================================================================
++
++The gpiommc module hooks up the mmc_spi and spi_gpio modules for running an
++MMC or SD card on GPIO pins.
++
++Two interfaces for registering a new MMC/SD card device are provided:
++A static platform-device based mechanism and a dynamic configfs based interface.
++
++
++Registering devices via platform-device
++=======================================
++
++The platform-device interface is used for registering MMC/SD devices that are
++part of the hardware platform. This is most useful only for embedded machines
++with MMC/SD devices statically connected to the platform GPIO bus.
++
++The data structures are declared in <linux/mmc/gpiommc.h>.
++
++To register a new device, define an instance of struct gpiommc_platform_data.
++This structure holds any information about how the device is hooked up to the
++GPIO pins and what hardware modes the device supports. See the docbook-style
++documentation in the header file for more information on the struct fields.
++
++Then allocate a new instance of a platform device by doing:
++
++	pdev = platform_device_alloc(GPIOMMC_PLATDEV_NAME, gpiommc_next_id());
++
++This will allocate the platform device data structures and hook it up to the
++gpiommc driver.
++Then add the gpiommc_platform_data to the platform device.
++
++	err = platform_device_add_data(pdev, pdata, sizeof(struct gpiommc_platform_data));
++
++You may free the local instance of struct gpiommc_platform_data now. (So the
++struct may be allocated on the stack, too).
++Now simply register the platform device.
++
++	err = platform_device_add(pdev);
++
++Done. The gpiommc probe routine will be invoked now and you should see a kernel
++log message for the added device.
++
++
++Registering devices via configfs
++================================
++
++MMC/SD cards connected via GPIO often are a pretty dynamic thing, as for example
++selfmade hacks for soldering an MMC/SD card to standard GPIO pins on embedded
++hardware are a common situation.
++So we provide a dynamic interface to conveniently handle adding and removing
++devices from userspace, without the need to recompile the kernel.
++
++The "gpiommc" subdirectory at the configfs mountpoint is used for handling
++the dynamic configuration.
++
++To create a new device, it must first be allocated with mkdir.
++The following command will allocate a device named "my_mmc":
++	mkdir /config/gpiommc/my_mmc
++
++There are several configuration files available in the new
++/config/gpiommc/my_mmc/ directory:
++
++gpio_data_in			= The SPI data-IN GPIO pin number.
++gpio_data_out			= The SPI data-OUT GPIO pin number.
++gpio_clock			= The SPI Clock GPIO pin number.
++gpio_chipselect			= The SPI Chipselect GPIO pin number.
++gpio_chipselect_activelow	= Boolean. If 0, Chipselect is active-HIGH.
++				  If 1, Chipselect is active-LOW.
++spi_mode			= The SPI data mode. Can be 0-3.
++spi_delay			= Enable all delays in the lowlevel bitbanging.
++max_bus_speed			= The maximum SPI bus speed. In Hertz.
++
++register			= Not a configuration parameter.
++				  Used to register the configured card
++				  with the kernel.
++
++The device must first get configured and then registered by writing "1" to
++the "register" file.
++The configuration parameters "gpio_data_in", "gpio_data_out", "gpio_clock"
++and "gpio_chipselect" are essential and _must_ be configured before writing
++"1" to the "register" file. The registration will fail, otherwise.
++
++The default values for the other parameters are:
++gpio_chipselect_activelow	= 1		(CS active-LOW)
++spi_mode			= 0		(SPI_MODE_0)
++spi_delay			= 1		(enabled)
++max_bus_speed			= 5000000	(5 Mhz)
++
++Configuration values can not be changed after registration. To unregister
++the device, write a "0" to the "register" file. The configuration can be
++changed again after unregistering.
++
++To completely remove the device, simply rmdir the directory
++(/config/gpiommc/my_mmc in this example).
++There's no need to first unregister the device before removing it. That will
++be done automatically.
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -3045,6 +3045,11 @@ L:	linuxppc-dev@lists.ozlabs.org
+ S:	Odd Fixes
+ F:	drivers/tty/hvc/
+ 
++GPIOMMC DRIVER
++P:	Michael Buesch
++M:	mb@bu3sch.de
++S:	Maintained
++
+ HARDWARE MONITORING
+ M:	Jean Delvare <khali@linux-fr.org>
+ M:	Guenter Roeck <guenter.roeck@ericsson.com>
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/864-gpiommc_configfs_locking.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/864-gpiommc_configfs_locking.patch.svn-base
new file mode 100644
index 0000000..d4201eb
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/864-gpiommc_configfs_locking.patch.svn-base
@@ -0,0 +1,58 @@
+The gpiommc configfs context structure needs locking, as configfs
+does not lock access between files.
+
+--- a/drivers/mmc/host/gpiommc.c
++++ b/drivers/mmc/host/gpiommc.c
+@@ -144,6 +144,8 @@ struct gpiommc_configfs_device {
+ 	struct platform_device *pdev;
+ 	/* The configuration */
+ 	struct gpiommc_platform_data pdata;
++	/* Mutex to protect this structure */
++	struct mutex mutex;
+ };
+ 
+ #define GPIO_INVALID	-1
+@@ -234,6 +236,8 @@ static ssize_t gpiommc_config_attr_show(
+ 	unsigned int gpio;
+ 	int err = 0;
+ 
++	mutex_lock(&dev->mutex);
++
+ 	if (attr == &gpiommc_attr_DI) {
+ 		gpio = dev->pdata.pins.gpio_di;
+ 		if (gpio == GPIO_INVALID)
+@@ -294,6 +298,8 @@ static ssize_t gpiommc_config_attr_show(
+ 	WARN_ON(1);
+ 	err = -ENOSYS;
+ out:
++	mutex_unlock(&dev->mutex);
++
+ 	return err ? err : count;
+ }
+ 
+@@ -353,6 +359,8 @@ static ssize_t gpiommc_config_attr_store
+ 	int err = -EINVAL;
+ 	unsigned long data;
+ 
++	mutex_lock(&dev->mutex);
++
+ 	if (attr == &gpiommc_attr_register) {
+ 		err = strict_strtoul(page, 10, &data);
+ 		if (err)
+@@ -478,6 +486,8 @@ static ssize_t gpiommc_config_attr_store
+ 	WARN_ON(1);
+ 	err = -ENOSYS;
+ out:
++	mutex_unlock(&dev->mutex);
++
+ 	return err ? err : count;
+ }
+ 
+@@ -514,6 +524,7 @@ static struct config_item *gpiommc_make_
+ 	if (!dev)
+ 		return NULL;
+ 
++	mutex_init(&dev->mutex);
+ 	config_item_init_type_name(&dev->item, name,
+ 				   &gpiommc_dev_ci_type);
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/865-gpiopwm.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/865-gpiopwm.patch.svn-base
new file mode 100644
index 0000000..015f14a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/865-gpiopwm.patch.svn-base
@@ -0,0 +1,21 @@
+--- a/drivers/Kconfig
++++ b/drivers/Kconfig
+@@ -60,6 +60,8 @@ source "drivers/pinctrl/Kconfig"
+ 
+ source "drivers/gpio/Kconfig"
+ 
++source "drivers/pwm/Kconfig"
++
+ source "drivers/w1/Kconfig"
+ 
+ source "drivers/power/Kconfig"
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -8,6 +8,7 @@
+ # GPIO must come after pinctrl as gpios may need to mux pins etc
+ obj-y				+= pinctrl/
+ obj-y				+= gpio/
++obj-$(CONFIG_GENERIC_PWM)	+= pwm/
+ obj-$(CONFIG_PCI)		+= pci/
+ obj-$(CONFIG_PARISC)		+= parisc/
+ obj-$(CONFIG_RAPIDIO)		+= rapidio/
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/870-hifn795x_byteswap.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/870-hifn795x_byteswap.patch.svn-base
new file mode 100644
index 0000000..3a37c95
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/870-hifn795x_byteswap.patch.svn-base
@@ -0,0 +1,17 @@
+--- a/drivers/crypto/hifn_795x.c
++++ b/drivers/crypto/hifn_795x.c
+@@ -682,12 +682,12 @@ static inline u32 hifn_read_1(struct hif
+ 
+ static inline void hifn_write_0(struct hifn_device *dev, u32 reg, u32 val)
+ {
+-	writel((__force u32)cpu_to_le32(val), dev->bar[0] + reg);
++	writel(val, dev->bar[0] + reg);
+ }
+ 
+ static inline void hifn_write_1(struct hifn_device *dev, u32 reg, u32 val)
+ {
+-	writel((__force u32)cpu_to_le32(val), dev->bar[1] + reg);
++	writel(val, dev->bar[1] + reg);
+ }
+ 
+ static void hifn_wait_puc(struct hifn_device *dev)
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/880-gateworks_system_controller.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/880-gateworks_system_controller.patch.svn-base
new file mode 100644
index 0000000..981610d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/880-gateworks_system_controller.patch.svn-base
@@ -0,0 +1,339 @@
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -423,6 +423,15 @@ config SENSORS_GL520SM
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called gl520sm.
+ 
++config SENSORS_GSC
++	tristate "Gateworks System Controller"
++	depends on I2C && (ARCH_DAVINCI || ARCH_CNS3XXX || ARCH_IXP4XX)
++	help
++	  If you say yes here you get support for the Gateworks System Controller.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called gsc.
++
+ config SENSORS_GPIO_FAN
+ 	tristate "GPIO fan"
+ 	depends on GENERIC_GPIO
+--- a/drivers/hwmon/Makefile
++++ b/drivers/hwmon/Makefile
+@@ -125,6 +125,7 @@ obj-$(CONFIG_SENSORS_W83L785TS)	+= w83l7
+ obj-$(CONFIG_SENSORS_W83L786NG)	+= w83l786ng.o
+ obj-$(CONFIG_SENSORS_WM831X)	+= wm831x-hwmon.o
+ obj-$(CONFIG_SENSORS_WM8350)	+= wm8350-hwmon.o
++obj-$(CONFIG_SENSORS_GSC)	+= gsc.o
+ 
+ obj-$(CONFIG_PMBUS)		+= pmbus/
+ 
+--- /dev/null
++++ b/drivers/hwmon/gsc.c
+@@ -0,0 +1,308 @@
++/*
++ * A hwmon driver for the Gateworks System Controller 
++ * Copyright (C) 2009 Gateworks Corporation
++ *
++ * Author: Chris Lang <clang@gateworks.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License,
++ * as published by the Free Software Foundation - version 2.
++ */
++
++#include <linux/module.h>
++#include <linux/i2c.h>
++#include <linux/hwmon.h>
++#include <linux/hwmon-sysfs.h>
++#include <linux/err.h>
++#include <linux/slab.h>
++
++#define DRV_VERSION "0.2"
++
++enum chips { gsp };
++
++/* AD7418 registers */
++#define GSP_REG_TEMP_IN		0x00
++#define GSP_REG_VIN		0x02
++#define GSP_REG_3P3		0x05
++#define GSP_REG_BAT		0x08
++#define GSP_REG_5P0		0x0b
++#define GSP_REG_CORE		0x0e
++#define GSP_REG_CPU1		0x11
++#define GSP_REG_CPU2		0x14
++#define GSP_REG_DRAM		0x17
++#define GSP_REG_EXT_BAT		0x1a
++#define GSP_REG_IO1		0x1d
++#define GSP_REG_IO2 		0x20
++#define GSP_REG_PCIE		0x23
++#define GSP_REG_CURRENT		0x26
++#define GSP_FAN_0		0x2C
++#define GSP_FAN_1		0x2E
++#define GSP_FAN_2		0x30
++#define GSP_FAN_3		0x32
++#define GSP_FAN_4		0x34
++#define GSP_FAN_5		0x36
++
++struct gsp_sensor_info {
++	const char* name;
++	int reg;
++};
++
++static const struct gsp_sensor_info gsp_sensors[] = {
++	{"temp", GSP_REG_TEMP_IN},
++	{"vin", GSP_REG_VIN},
++	{"3p3", GSP_REG_3P3},
++	{"bat", GSP_REG_BAT},
++	{"5p0", GSP_REG_5P0},
++	{"core", GSP_REG_CORE},
++	{"cpu1", GSP_REG_CPU1},
++	{"cpu2", GSP_REG_CPU2},
++	{"dram", GSP_REG_DRAM},
++	{"ext_bat", GSP_REG_EXT_BAT},
++	{"io1", GSP_REG_IO1},
++	{"io2", GSP_REG_IO2},
++	{"pci2", GSP_REG_PCIE},
++	{"current", GSP_REG_CURRENT},
++	{"fan_point0", GSP_FAN_0},
++	{"fan_point1", GSP_FAN_1},
++	{"fan_point2", GSP_FAN_2},
++	{"fan_point3", GSP_FAN_3},
++	{"fan_point4", GSP_FAN_4},
++	{"fan_point5", GSP_FAN_5},
++};
++
++struct gsp_data {
++	struct device		*hwmon_dev;
++	struct attribute_group	attrs;
++	enum chips		type;
++};
++
++static int gsp_probe(struct i2c_client *client,
++			const struct i2c_device_id *id);
++static int gsp_remove(struct i2c_client *client);
++
++static const struct i2c_device_id gsp_id[] = {
++	{ "gsp", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, gsp_id);
++
++static struct i2c_driver gsp_driver = {
++	.driver = {
++		.name	= "gsp",
++	},
++	.probe		= gsp_probe,
++	.remove		= gsp_remove,
++	.id_table	= gsp_id,
++};
++
++/* All registers are word-sized, except for the configuration registers.
++ * AD7418 uses a high-byte first convention. Do NOT use those functions to
++ * access the configuration registers CONF and CONF2, as they are byte-sized.
++ */
++static inline int gsp_read(struct i2c_client *client, u8 reg)
++{
++	unsigned int adc = 0;
++	if (reg == GSP_REG_TEMP_IN || reg > GSP_REG_CURRENT)
++	{
++		adc |= i2c_smbus_read_byte_data(client, reg);
++		adc |= i2c_smbus_read_byte_data(client, reg + 1) << 8;
++		return adc;
++	}
++	else
++	{
++		adc |= i2c_smbus_read_byte_data(client, reg);
++		adc |= i2c_smbus_read_byte_data(client, reg + 1) << 8;
++		adc |= i2c_smbus_read_byte_data(client, reg + 2) << 16;
++		return adc;
++	}
++}
++
++static inline int gsp_write(struct i2c_client *client, u8 reg, u16 value)
++{
++	i2c_smbus_write_byte_data(client, reg, value & 0xff);
++	i2c_smbus_write_byte_data(client, reg + 1, ((value >> 8) & 0xff));
++	return 1;
++}
++
++static ssize_t show_adc(struct device *dev, struct device_attribute *devattr,
++			char *buf)
++{
++	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
++	struct i2c_client *client = to_i2c_client(dev);
++	return sprintf(buf, "%d\n", gsp_read(client, gsp_sensors[attr->index].reg));
++}
++
++static ssize_t show_label(struct device *dev,
++			struct device_attribute *devattr, char *buf)
++{
++	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
++
++	return sprintf(buf, "%s\n", gsp_sensors[attr->index].name);
++}
++
++static ssize_t store_fan(struct device *dev,
++			struct device_attribute *devattr, const char *buf, size_t count)
++{
++	u16 val;
++	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
++	struct i2c_client *client = to_i2c_client(dev);
++	val = simple_strtoul(buf, NULL, 10);
++	gsp_write(client, gsp_sensors[attr->index].reg, val);
++	return count;
++}
++
++static SENSOR_DEVICE_ATTR(temp0_input, S_IRUGO, show_adc, NULL, 0);
++static SENSOR_DEVICE_ATTR(temp0_label, S_IRUGO, show_label, NULL, 0);
++
++static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_adc, NULL, 1);
++static SENSOR_DEVICE_ATTR(in0_label, S_IRUGO, show_label, NULL, 1);
++static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_adc, NULL, 2);
++static SENSOR_DEVICE_ATTR(in1_label, S_IRUGO, show_label, NULL, 2);
++static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_adc, NULL, 3);
++static SENSOR_DEVICE_ATTR(in2_label, S_IRUGO, show_label, NULL, 3);
++static SENSOR_DEVICE_ATTR(in3_input, S_IRUGO, show_adc, NULL, 4);
++static SENSOR_DEVICE_ATTR(in3_label, S_IRUGO, show_label, NULL, 4);
++static SENSOR_DEVICE_ATTR(in4_input, S_IRUGO, show_adc, NULL, 5);
++static SENSOR_DEVICE_ATTR(in4_label, S_IRUGO, show_label, NULL, 5);
++static SENSOR_DEVICE_ATTR(in5_input, S_IRUGO, show_adc, NULL, 6);
++static SENSOR_DEVICE_ATTR(in5_label, S_IRUGO, show_label, NULL, 6);
++static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_adc, NULL, 7);
++static SENSOR_DEVICE_ATTR(in6_label, S_IRUGO, show_label, NULL, 7);
++static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_adc, NULL, 8);
++static SENSOR_DEVICE_ATTR(in7_label, S_IRUGO, show_label, NULL, 8);
++static SENSOR_DEVICE_ATTR(in8_input, S_IRUGO, show_adc, NULL, 9);
++static SENSOR_DEVICE_ATTR(in8_label, S_IRUGO, show_label, NULL, 9);
++static SENSOR_DEVICE_ATTR(in9_input, S_IRUGO, show_adc, NULL, 10);
++static SENSOR_DEVICE_ATTR(in9_label, S_IRUGO, show_label, NULL, 10);
++static SENSOR_DEVICE_ATTR(in10_input, S_IRUGO, show_adc, NULL, 11);
++static SENSOR_DEVICE_ATTR(in10_label, S_IRUGO, show_label, NULL, 11);
++static SENSOR_DEVICE_ATTR(in11_input, S_IRUGO, show_adc, NULL, 12);
++static SENSOR_DEVICE_ATTR(in11_label, S_IRUGO, show_label, NULL, 12);
++static SENSOR_DEVICE_ATTR(in12_input, S_IRUGO, show_adc, NULL, 13);
++static SENSOR_DEVICE_ATTR(in12_label, S_IRUGO, show_label, NULL, 13);
++
++static SENSOR_DEVICE_ATTR(fan0_point0, S_IRUGO | S_IWUSR, show_adc, store_fan, 14);
++static SENSOR_DEVICE_ATTR(fan0_point1, S_IRUGO | S_IWUSR, show_adc, store_fan, 15);
++static SENSOR_DEVICE_ATTR(fan0_point2, S_IRUGO | S_IWUSR, show_adc, store_fan, 16);
++static SENSOR_DEVICE_ATTR(fan0_point3, S_IRUGO | S_IWUSR, show_adc, store_fan, 17);
++static SENSOR_DEVICE_ATTR(fan0_point4, S_IRUGO | S_IWUSR, show_adc, store_fan, 18);
++static SENSOR_DEVICE_ATTR(fan0_point5, S_IRUGO | S_IWUSR, show_adc, store_fan, 19);
++
++static struct attribute *gsp_attributes[] = {
++	&sensor_dev_attr_temp0_input.dev_attr.attr,
++	&sensor_dev_attr_in0_input.dev_attr.attr,
++	&sensor_dev_attr_in1_input.dev_attr.attr,
++	&sensor_dev_attr_in2_input.dev_attr.attr,
++	&sensor_dev_attr_in3_input.dev_attr.attr,
++	&sensor_dev_attr_in4_input.dev_attr.attr,
++	&sensor_dev_attr_in5_input.dev_attr.attr,
++	&sensor_dev_attr_in6_input.dev_attr.attr,
++	&sensor_dev_attr_in7_input.dev_attr.attr,
++	&sensor_dev_attr_in8_input.dev_attr.attr,
++	&sensor_dev_attr_in9_input.dev_attr.attr,
++	&sensor_dev_attr_in10_input.dev_attr.attr,
++	&sensor_dev_attr_in11_input.dev_attr.attr,
++	&sensor_dev_attr_in12_input.dev_attr.attr,
++
++	&sensor_dev_attr_temp0_label.dev_attr.attr,
++	&sensor_dev_attr_in0_label.dev_attr.attr,
++	&sensor_dev_attr_in1_label.dev_attr.attr,
++	&sensor_dev_attr_in2_label.dev_attr.attr,
++	&sensor_dev_attr_in3_label.dev_attr.attr,
++	&sensor_dev_attr_in4_label.dev_attr.attr,
++	&sensor_dev_attr_in5_label.dev_attr.attr,
++	&sensor_dev_attr_in6_label.dev_attr.attr,
++	&sensor_dev_attr_in7_label.dev_attr.attr,
++	&sensor_dev_attr_in8_label.dev_attr.attr,
++	&sensor_dev_attr_in9_label.dev_attr.attr,
++	&sensor_dev_attr_in10_label.dev_attr.attr,
++	&sensor_dev_attr_in11_label.dev_attr.attr,
++	&sensor_dev_attr_in12_label.dev_attr.attr,
++
++	&sensor_dev_attr_fan0_point0.dev_attr.attr,
++	&sensor_dev_attr_fan0_point1.dev_attr.attr,
++	&sensor_dev_attr_fan0_point2.dev_attr.attr,
++	&sensor_dev_attr_fan0_point3.dev_attr.attr,
++	&sensor_dev_attr_fan0_point4.dev_attr.attr,
++	&sensor_dev_attr_fan0_point5.dev_attr.attr,
++	NULL
++};
++
++
++static int gsp_probe(struct i2c_client *client,
++			 const struct i2c_device_id *id)
++{
++	struct i2c_adapter *adapter = client->adapter;
++	struct gsp_data *data;
++	int err;
++
++	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA |
++					I2C_FUNC_SMBUS_WORD_DATA)) {
++		err = -EOPNOTSUPP;
++		goto exit;
++	}
++
++	if (!(data = kzalloc(sizeof(struct gsp_data), GFP_KERNEL))) {
++		err = -ENOMEM;
++		goto exit;
++	}
++
++	i2c_set_clientdata(client, data);
++
++	data->type = id->driver_data;
++
++	switch (data->type) {
++	case 0:
++		data->attrs.attrs = gsp_attributes;
++		break;
++	}
++
++	dev_info(&client->dev, "%s chip found\n", client->name);
++
++	/* Register sysfs hooks */
++	if ((err = sysfs_create_group(&client->dev.kobj, &data->attrs)))
++		goto exit_free;
++
++	data->hwmon_dev = hwmon_device_register(&client->dev);
++	if (IS_ERR(data->hwmon_dev)) {
++		err = PTR_ERR(data->hwmon_dev);
++		goto exit_remove;
++	}
++
++	return 0;
++
++exit_remove:
++	sysfs_remove_group(&client->dev.kobj, &data->attrs);
++exit_free:
++	kfree(data);
++exit:
++	return err;
++}
++
++static int gsp_remove(struct i2c_client *client)
++{
++	struct gsp_data *data = i2c_get_clientdata(client);
++	hwmon_device_unregister(data->hwmon_dev);
++	sysfs_remove_group(&client->dev.kobj, &data->attrs);
++	kfree(data);
++	return 0;
++}
++
++static int __init gsp_init(void)
++{
++	return i2c_add_driver(&gsp_driver);
++}
++
++static void __exit gsp_exit(void)
++{
++	i2c_del_driver(&gsp_driver);
++}
++
++module_init(gsp_init);
++module_exit(gsp_exit);
++
++MODULE_AUTHOR("Chris Lang <clang@gateworks.com>");
++MODULE_DESCRIPTION("GSC HWMON driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION(DRV_VERSION);
++
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/900-slab_maxsize.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/900-slab_maxsize.patch.svn-base
new file mode 100644
index 0000000..1c95694
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/900-slab_maxsize.patch.svn-base
@@ -0,0 +1,13 @@
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -127,8 +127,8 @@ unsigned int kmem_cache_size(struct kmem
+  * to do various tricks to work around compiler limitations in order to
+  * ensure proper constant folding.
+  */
+-#define KMALLOC_SHIFT_HIGH	((MAX_ORDER + PAGE_SHIFT - 1) <= 25 ? \
+-				(MAX_ORDER + PAGE_SHIFT - 1) : 25)
++#define KMALLOC_SHIFT_HIGH	((MAX_ORDER + PAGE_SHIFT - 1) <= 17 ? \
++				(MAX_ORDER + PAGE_SHIFT - 1) : 17)
+ 
+ #define KMALLOC_MAX_SIZE	(1UL << KMALLOC_SHIFT_HIGH)
+ #define KMALLOC_MAX_ORDER	(KMALLOC_SHIFT_HIGH - PAGE_SHIFT)
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/910-kobject_uevent.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/910-kobject_uevent.patch.svn-base
new file mode 100644
index 0000000..aa9a40f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/910-kobject_uevent.patch.svn-base
@@ -0,0 +1,21 @@
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -50,6 +50,18 @@ static const char *kobject_actions[] = {
+ 	[KOBJ_OFFLINE] =	"offline",
+ };
+ 
++u64 uevent_next_seqnum(void)
++{
++	u64 seq;
++
++	mutex_lock(&uevent_sock_mutex);
++	seq = ++uevent_seqnum;
++	mutex_unlock(&uevent_sock_mutex);
++
++	return seq;
++}
++EXPORT_SYMBOL_GPL(uevent_next_seqnum);
++
+ /**
+  * kobject_action_type - translate action string to numeric type
+  *
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/911-kobject_add_broadcast_uevent.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/911-kobject_add_broadcast_uevent.patch.svn-base
new file mode 100644
index 0000000..104df13
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/911-kobject_add_broadcast_uevent.patch.svn-base
@@ -0,0 +1,85 @@
+--- a/include/linux/kobject.h
++++ b/include/linux/kobject.h
+@@ -31,6 +31,8 @@
+ #define UEVENT_NUM_ENVP			32	/* number of env pointers */
+ #define UEVENT_BUFFER_SIZE		2048	/* buffer for the variables */
+ 
++struct sk_buff;
++
+ /* path to the userspace helper executed on an event */
+ extern char uevent_helper[];
+ 
+@@ -213,6 +215,10 @@ int add_uevent_var(struct kobj_uevent_en
+ 
+ int kobject_action_type(const char *buf, size_t count,
+ 			enum kobject_action *type);
++
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation);
++
+ #else
+ static inline int kobject_uevent(struct kobject *kobj,
+ 				 enum kobject_action action)
+@@ -229,6 +235,16 @@ int add_uevent_var(struct kobj_uevent_en
+ static inline int kobject_action_type(const char *buf, size_t count,
+ 				      enum kobject_action *type)
+ { return -EINVAL; }
++
++void kfree_skb(struct sk_buff *);
++
++static inline int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++				   gfp_t allocation)
++{
++	kfree_skb(skb);
++	return 0;
++}
++
+ #endif
+ 
+ #endif /* _KOBJECT_H_ */
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -381,6 +381,43 @@ int add_uevent_var(struct kobj_uevent_en
+ EXPORT_SYMBOL_GPL(add_uevent_var);
+ 
+ #if defined(CONFIG_NET)
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation)
++{
++	struct uevent_sock *ue_sk;
++	int err = 0;
++
++	/* send netlink message */
++	mutex_lock(&uevent_sock_mutex);
++	list_for_each_entry(ue_sk, &uevent_sock_list, list) {
++		struct sock *uevent_sock = ue_sk->sk;
++		struct sk_buff *skb2;
++
++		skb2 = skb_clone(skb, allocation);
++		if (!skb2)
++			break;
++
++		err = netlink_broadcast(uevent_sock, skb2, pid, group,
++					allocation);
++		if (err)
++			break;
++	}
++	mutex_unlock(&uevent_sock_mutex);
++
++	kfree_skb(skb);
++	return err;
++}
++#else
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation)
++{
++	kfree_skb(skb);
++	return 0;
++}
++#endif
++EXPORT_SYMBOL_GPL(broadcast_uevent);
++
++#if defined(CONFIG_NET)
+ static int uevent_net_init(struct net *net)
+ {
+ 	struct uevent_sock *ue_sk;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/920-unable_to_open_console.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/920-unable_to_open_console.patch.svn-base
new file mode 100644
index 0000000..11f67dc
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/920-unable_to_open_console.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/init/main.c
++++ b/init/main.c
+@@ -816,7 +816,7 @@ static int __init kernel_init(void * unu
+ 
+ 	/* Open the /dev/console on the rootfs, this should never fail */
+ 	if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
+-		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
++		printk(KERN_WARNING "Please be patient, while OpenWrt loads ...\n");
+ 
+ 	(void) sys_dup(0);
+ 	(void) sys_dup(0);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/921-use_preinit_as_init.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/921-use_preinit_as_init.patch.svn-base
new file mode 100644
index 0000000..a71251d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/921-use_preinit_as_init.patch.svn-base
@@ -0,0 +1,14 @@
+--- a/init/main.c
++++ b/init/main.c
+@@ -774,10 +774,7 @@ static noinline int init_post(void)
+ 		printk(KERN_WARNING "Failed to execute %s.  Attempting "
+ 					"defaults...\n", execute_command);
+ 	}
+-	run_init_process("/sbin/init");
+-	run_init_process("/etc/init");
+-	run_init_process("/bin/init");
+-	run_init_process("/bin/sh");
++	run_init_process("/etc/preinit");
+ 
+ 	panic("No init found.  Try passing init= option to kernel. "
+ 	      "See Linux Documentation/init.txt for guidance.");
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/930-crashlog.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/930-crashlog.patch.svn-base
new file mode 100644
index 0000000..f6a52f3
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/930-crashlog.patch.svn-base
@@ -0,0 +1,285 @@
+--- /dev/null
++++ b/include/linux/crashlog.h
+@@ -0,0 +1,17 @@
++#ifndef __CRASHLOG_H
++#define __CRASHLOG_H
++
++#ifdef CONFIG_CRASHLOG
++void crashlog_init_bootmem(struct bootmem_data *bdata);
++void crashlog_init_memblock(phys_addr_t addr, phys_addr_t size);
++#else
++static inline void crashlog_init_bootmem(struct bootmem_data *bdata)
++{
++}
++
++static inline void crashlog_init_memblock(phys_addr_t addr, phys_addr_t size)
++{
++}
++#endif
++
++#endif
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -926,6 +926,10 @@ config RELAY
+ 
+ 	  If unsure, say N.
+ 
++config CRASHLOG
++	bool "Crash logging"
++	depends on (!NO_BOOTMEM || HAVE_MEMBLOCK) && !(ARM || SPARC || PPC)
++
+ config BLK_DEV_INITRD
+ 	bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
+ 	depends on BROKEN || !FRV
+--- a/kernel/Makefile
++++ b/kernel/Makefile
+@@ -107,6 +107,7 @@ obj-$(CONFIG_USER_RETURN_NOTIFIER) += us
+ obj-$(CONFIG_PADATA) += padata.o
+ obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
+ obj-$(CONFIG_JUMP_LABEL) += jump_label.o
++obj-$(CONFIG_CRASHLOG) += crashlog.o
+ 
+ $(obj)/configs.o: $(obj)/config_data.h
+ 
+--- /dev/null
++++ b/kernel/crashlog.c
+@@ -0,0 +1,190 @@
++/*
++ * Crash information logger
++ * Copyright (C) 2010 Felix Fietkau <nbd@openwrt.org>
++ *
++ * Based on ramoops.c
++ *   Copyright (C) 2010 Marco Stornelli <marco.stornelli@gmail.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
++ * 02110-1301 USA
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/bootmem.h>
++#include <linux/memblock.h>
++#include <linux/debugfs.h>
++#include <linux/crashlog.h>
++#include <linux/kmsg_dump.h>
++#include <linux/module.h>
++#include <linux/pfn.h>
++#include <asm/io.h>
++
++#define CRASHLOG_PAGES	4
++#define CRASHLOG_SIZE	(CRASHLOG_PAGES * PAGE_SIZE)
++#define CRASHLOG_MAGIC	0xa1eedead
++
++/*
++ * Start the log at 1M before the end of RAM, as some boot loaders like
++ * to use the end of the RAM for stack usage and other things
++ * If this fails, fall back to using the last part.
++ */
++#define CRASHLOG_OFFSET	(1024 * 1024)
++
++struct crashlog_data {
++	u32 magic;
++	u32 len;
++	u8 data[];
++};
++
++static struct debugfs_blob_wrapper crashlog_blob;
++static unsigned long crashlog_addr = 0;
++static struct crashlog_data *crashlog_buf;
++static struct kmsg_dumper dump;
++static bool first = true;
++
++extern struct list_head *crashlog_modules;
++
++#ifndef CONFIG_NO_BOOTMEM
++void __init crashlog_init_bootmem(bootmem_data_t *bdata)
++{
++	unsigned long addr;
++
++	if (crashlog_addr)
++		return;
++
++	addr = PFN_PHYS(bdata->node_low_pfn) - CRASHLOG_OFFSET;
++	if (reserve_bootmem(addr, CRASHLOG_SIZE, BOOTMEM_EXCLUSIVE) < 0) {
++		printk("Crashlog failed to allocate RAM at address 0x%lx\n", addr);
++		bdata->node_low_pfn -= CRASHLOG_PAGES;
++		addr = PFN_PHYS(bdata->node_low_pfn);
++	}
++	crashlog_addr = addr;
++}
++#endif
++
++#ifdef CONFIG_HAVE_MEMBLOCK
++void __meminit crashlog_init_memblock(phys_addr_t addr, phys_addr_t size)
++{
++	if (crashlog_addr)
++		return;
++
++	addr += size - CRASHLOG_OFFSET;
++	if (memblock_reserve(addr, CRASHLOG_SIZE)) {
++		printk("Crashlog failed to allocate RAM at address 0x%lx\n", (unsigned long) addr);
++		return;
++	}
++
++	crashlog_addr = addr;
++}
++#endif
++
++static void __init crashlog_copy(void)
++{
++	if (crashlog_buf->magic != CRASHLOG_MAGIC)
++		return;
++
++	if (!crashlog_buf->len || crashlog_buf->len >
++	    CRASHLOG_SIZE - sizeof(*crashlog_buf))
++		return;
++
++	crashlog_blob.size = crashlog_buf->len;
++	crashlog_blob.data = kmemdup(crashlog_buf->data,
++		crashlog_buf->len, GFP_KERNEL);
++
++	debugfs_create_blob("crashlog", 0700, NULL, &crashlog_blob);
++}
++
++static int get_maxlen(void)
++{
++	return CRASHLOG_SIZE - sizeof(*crashlog_buf) - crashlog_buf->len;
++}
++
++static void crashlog_printf(const char *fmt, ...)
++{
++	va_list args;
++	int len = get_maxlen();
++
++	if (!len)
++		return;
++
++	va_start(args, fmt);
++	crashlog_buf->len += vsnprintf(
++		&crashlog_buf->data[crashlog_buf->len],
++		len, fmt, args);
++	va_end(args);
++}
++
++static void crashlog_do_dump(struct kmsg_dumper *dumper,
++		enum kmsg_dump_reason reason, const char *s1, unsigned long l1,
++		const char *s2, unsigned long l2)
++{
++	unsigned long s1_start, s2_start;
++	unsigned long l1_cpy, l2_cpy;
++	struct timeval tv;
++	struct module *m;
++	char *buf;
++	int len;
++
++	if (!first)
++		crashlog_printf("\n===================================\n");
++
++	do_gettimeofday(&tv);
++	crashlog_printf("Time: %lu.%lu\n",
++		(long)tv.tv_sec, (long)tv.tv_usec);
++
++	if (first) {
++		crashlog_printf("Modules:");
++		list_for_each_entry(m, crashlog_modules, list) {
++			crashlog_printf("\t%s@%p+%x", m->name,
++			m->module_core, m->core_size,
++			m->module_init, m->init_size);
++		}
++		crashlog_printf("\n");
++		first = false;
++	}
++
++	buf = (char *)&crashlog_buf->data[crashlog_buf->len];
++	len = get_maxlen();
++
++	l2_cpy = min(l2, (unsigned long)len);
++	l1_cpy = min(l1, (unsigned long)len - l2_cpy);
++
++	s2_start = l2 - l2_cpy;
++	s1_start = l1 - l1_cpy;
++
++	memcpy(buf, s1 + s1_start, l1_cpy);
++	memcpy(buf + l1_cpy, s2 + s2_start, l2_cpy);
++	crashlog_buf->len += l1_cpy + l2_cpy;
++}
++
++
++int __init crashlog_init_fs(void)
++{
++	if (!crashlog_addr)
++		return -ENOMEM;
++
++	crashlog_buf = ioremap(crashlog_addr, CRASHLOG_SIZE);
++
++	crashlog_copy();
++
++	crashlog_buf->magic = CRASHLOG_MAGIC;
++	crashlog_buf->len = 0;
++
++	dump.dump = crashlog_do_dump;
++	kmsg_dump_register(&dump);
++
++	return 0;
++}
++module_init(crashlog_init_fs);
+--- a/mm/bootmem.c
++++ b/mm/bootmem.c
+@@ -15,6 +15,7 @@
+ #include <linux/export.h>
+ #include <linux/kmemleak.h>
+ #include <linux/range.h>
++#include <linux/crashlog.h>
+ #include <linux/memblock.h>
+ 
+ #include <asm/bug.h>
+@@ -177,6 +178,7 @@ static unsigned long __init free_all_boo
+ 	if (!bdata->node_bootmem_map)
+ 		return 0;
+ 
++	crashlog_init_bootmem(bdata);
+ 	start = bdata->node_min_pfn;
+ 	end = bdata->node_low_pfn;
+ 
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -101,6 +101,9 @@ static LIST_HEAD(modules);
+ #ifdef CONFIG_KGDB_KDB
+ struct list_head *kdb_modules = &modules; /* kdb needs the list of modules */
+ #endif /* CONFIG_KGDB_KDB */
++#ifdef CONFIG_CRASHLOG
++struct list_head *crashlog_modules = &modules;
++#endif
+ 
+ 
+ /* Block module loading/unloading? */
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -19,6 +19,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/seq_file.h>
+ #include <linux/memblock.h>
++#include <linux/crashlog.h>
+ 
+ static struct memblock_region memblock_memory_init_regions[INIT_MEMBLOCK_REGIONS] __initdata_memblock;
+ static struct memblock_region memblock_reserved_init_regions[INIT_MEMBLOCK_REGIONS] __initdata_memblock;
+@@ -305,6 +306,8 @@ static void __init_memblock memblock_ins
+ 	memblock_set_region_node(rgn, nid);
+ 	type->cnt++;
+ 	type->total_size += size;
++	if (type == &memblock.memory && idx == 0)
++		crashlog_init_memblock(base, size);
+ }
+ 
+ /**
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/940-ocf_kbuild_integration.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/940-ocf_kbuild_integration.patch.svn-base
new file mode 100644
index 0000000..b5cce90
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/940-ocf_kbuild_integration.patch.svn-base
@@ -0,0 +1,20 @@
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -968,3 +968,6 @@ config CRYPTO_USER_API_SKCIPHER
+ source "drivers/crypto/Kconfig"
+ 
+ endif	# if CRYPTO
++
++source "crypto/ocf/Kconfig"
++
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -92,6 +92,8 @@ obj-$(CONFIG_CRYPTO_USER_API) += af_alg.
+ obj-$(CONFIG_CRYPTO_USER_API_HASH) += algif_hash.o
+ obj-$(CONFIG_CRYPTO_USER_API_SKCIPHER) += algif_skcipher.o
+ 
++obj-$(CONFIG_OCF_OCF) += ocf/
++
+ #
+ # generic algorithms and the async_tx api
+ #
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/941-ocf_20120127.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/941-ocf_20120127.patch.svn-base
new file mode 100644
index 0000000..794627a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/941-ocf_20120127.patch.svn-base
@@ -0,0 +1,164 @@
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -131,6 +131,9 @@
+  *	void add_interrupt_randomness(int irq, int irq_flags);
+  * 	void add_disk_randomness(struct gendisk *disk);
+  *
++ *      void random_input_words(__u32 *buf, size_t wordcount, int ent_count)
++ *      int random_input_wait(void);
++ *
+  * add_input_randomness() uses the input layer interrupt timing, as well as
+  * the event type information from the hardware.
+  *
+@@ -152,6 +155,13 @@
+  * seek times do not make for good sources of entropy, as their seek
+  * times are usually fairly consistent.
+  *
++ * random_input_words() just provides a raw block of entropy to the input
++ * pool, such as from a hardware entropy generator.
++ *
++ * random_input_wait() suspends the caller until such time as the
++ * entropy pool falls below the write threshold, and returns a count of how
++ * much entropy (in bits) is needed to sustain the pool.
++ *
+  * All of these routines try to estimate how many bits of randomness a
+  * particular randomness source.  They do this by keeping track of the
+  * first and second order deltas of the event timings.
+@@ -796,6 +806,63 @@ void add_disk_randomness(struct gendisk
+ }
+ #endif
+ 
++/*
++ * random_input_words - add bulk entropy to pool
++ *
++ * @buf: buffer to add
++ * @wordcount: number of __u32 words to add
++ * @ent_count: total amount of entropy (in bits) to credit
++ *
++ * this provides bulk input of entropy to the input pool
++ *
++ */
++void random_input_words(__u32 *buf, size_t wordcount, int ent_count)
++{
++	mix_pool_bytes(&input_pool, buf, wordcount*4, NULL);
++
++	credit_entropy_bits(&input_pool, ent_count);
++
++	DEBUG_ENT("crediting %d bits => %d\n",
++		  ent_count, input_pool.entropy_count);
++	/*
++	 * Wake up waiting processes if we have enough
++	 * entropy.
++	 */
++	if (input_pool.entropy_count >= random_read_wakeup_thresh)
++		wake_up_interruptible(&random_read_wait);
++}
++EXPORT_SYMBOL(random_input_words);
++
++/*
++ * random_input_wait - wait until random needs entropy
++ *
++ * this function sleeps until the /dev/random subsystem actually
++ * needs more entropy, and then return the amount of entropy
++ * that it would be nice to have added to the system.
++ */
++int random_input_wait(void)
++{
++	int count;
++
++	wait_event_interruptible(random_write_wait, 
++			 input_pool.entropy_count < random_write_wakeup_thresh);
++
++	count = random_write_wakeup_thresh - input_pool.entropy_count;
++
++        /* likely we got woken up due to a signal */
++	if (count <= 0) count = random_read_wakeup_thresh; 
++
++	DEBUG_ENT("requesting %d bits from input_wait()er %d<%d\n",
++		  count,
++		  input_pool.entropy_count, random_write_wakeup_thresh);
++
++	return count;
++}
++EXPORT_SYMBOL(random_input_wait);
++
++
++#define EXTRACT_SIZE 10
++
+ /*********************************************************************
+  *
+  * Entropy extraction routines
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -142,6 +142,7 @@ SYSCALL_DEFINE1(dup, unsigned int, filde
+ 	}
+ 	return ret;
+ }
++EXPORT_SYMBOL(sys_dup);
+ 
+ #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
+ 
+--- a/include/linux/miscdevice.h
++++ b/include/linux/miscdevice.h
+@@ -19,6 +19,7 @@
+ #define APOLLO_MOUSE_MINOR	7
+ #define PC110PAD_MINOR		9
+ /*#define ADB_MOUSE_MINOR	10	FIXME OBSOLETE */
++#define CRYPTODEV_MINOR		70	/* /dev/crypto */
+ #define WATCHDOG_MINOR		130	/* Watchdog timer     */
+ #define TEMP_MINOR		131	/* Temperature Sensor */
+ #define RTC_MINOR		135
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -34,6 +34,30 @@
+ /* Clear the entropy pool and associated counters.  (Superuser only.) */
+ #define RNDCLEARPOOL	_IO( 'R', 0x06 )
+ 
++#ifdef CONFIG_FIPS_RNG
++
++/* Size of seed value - equal to AES blocksize */
++#define AES_BLOCK_SIZE_BYTES	16
++#define SEED_SIZE_BYTES			AES_BLOCK_SIZE_BYTES
++/* Size of AES key */
++#define KEY_SIZE_BYTES		16
++
++/* ioctl() structure used by FIPS 140-2 Tests */
++struct rand_fips_test {
++	unsigned char key[KEY_SIZE_BYTES];			/* Input */
++	unsigned char datetime[SEED_SIZE_BYTES];	/* Input */
++	unsigned char seed[SEED_SIZE_BYTES];		/* Input */
++	unsigned char result[SEED_SIZE_BYTES];		/* Output */
++};
++
++/* FIPS 140-2 RNG Variable Seed Test. (Superuser only.) */
++#define RNDFIPSVST	_IOWR('R', 0x10, struct rand_fips_test)
++
++/* FIPS 140-2 RNG Monte Carlo Test. (Superuser only.) */
++#define RNDFIPSMCT	_IOWR('R', 0x11, struct rand_fips_test)
++
++#endif /* #ifdef CONFIG_FIPS_RNG */
++
+ struct rand_pool_info {
+ 	int	entropy_count;
+ 	int	buf_size;
+@@ -53,6 +77,10 @@ extern void add_input_randomness(unsigne
+ 				 unsigned int value);
+ extern void add_interrupt_randomness(int irq, int irq_flags);
+ 
++extern void random_input_words(__u32 *buf, size_t wordcount, int ent_count);
++extern int random_input_wait(void);
++#define HAS_RANDOM_INPUT_WAIT 1
++
+ extern void get_random_bytes(void *buf, int nbytes);
+ extern void get_random_bytes_arch(void *buf, int nbytes);
+ void generate_random_uuid(unsigned char uuid_out[16]);
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -430,6 +430,7 @@ struct task_struct *find_task_by_vpid(pi
+ {
+ 	return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
+ }
++EXPORT_SYMBOL(find_task_by_vpid);
+ 
+ struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
+ {
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/950-vm_exports.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/950-vm_exports.patch.svn-base
new file mode 100644
index 0000000..1cd970c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/950-vm_exports.patch.svn-base
@@ -0,0 +1,117 @@
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2490,6 +2490,16 @@ EXPORT_SYMBOL_GPL(shmem_truncate_range);
+ 
+ /* common code */
+ 
++void shmem_set_file(struct vm_area_struct *vma, struct file *file)
++{
++	if (vma->vm_file)
++		fput(vma->vm_file);
++	vma->vm_file = file;
++	vma->vm_ops = &shmem_vm_ops;
++	vma->vm_flags |= VM_CAN_NONLINEAR;
++}
++EXPORT_SYMBOL_GPL(shmem_set_file);
++
+ /**
+  * shmem_file_setup - get an unlinked file living in tmpfs
+  * @name: name for dentry (to be seen in /proc/<pid>/maps
+@@ -2567,11 +2577,8 @@ int shmem_zero_setup(struct vm_area_stru
+ 	if (IS_ERR(file))
+ 		return PTR_ERR(file);
+ 
+-	if (vma->vm_file)
+-		fput(vma->vm_file);
+-	vma->vm_file = file;
+-	vma->vm_ops = &shmem_vm_ops;
+-	vma->vm_flags |= VM_CAN_NONLINEAR;
++	shmem_set_file(vma, file);
++
+ 	return 0;
+ }
+ 
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -268,6 +268,7 @@ int expand_files(struct files_struct *fi
+ 	/* All good, so we try */
+ 	return expand_fdtable(files, nr);
+ }
++EXPORT_SYMBOL_GPL(expand_files);
+ 
+ static int count_open_files(struct fdtable *fdt)
+ {
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -500,6 +500,7 @@ struct files_struct *get_files_struct(st
+ 
+ 	return files;
+ }
++EXPORT_SYMBOL_GPL(get_files_struct);
+ 
+ void put_files_struct(struct files_struct *files)
+ {
+@@ -521,6 +522,7 @@ void put_files_struct(struct files_struc
+ 		rcu_read_unlock();
+ 	}
+ }
++EXPORT_SYMBOL_GPL(put_files_struct);
+ 
+ void reset_files_struct(struct files_struct *files)
+ {
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3854,6 +3854,7 @@ int can_nice(const struct task_struct *p
+ 	return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
+ 		capable(CAP_SYS_NICE));
+ }
++EXPORT_SYMBOL_GPL(can_nice);
+ 
+ #ifdef __ARCH_WANT_SYS_NICE
+ 
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1412,6 +1412,7 @@ unsigned long zap_page_range(struct vm_a
+ 	tlb_finish_mmu(&tlb, address, end);
+ 	return end;
+ }
++EXPORT_SYMBOL_GPL(zap_page_range);
+ 
+ /**
+  * zap_vma_ptes - remove ptes mapping the vma
+@@ -3087,6 +3088,7 @@ static inline int check_stack_guard_page
+ 	}
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(vmtruncate_range);
+ 
+ /*
+  * We enter with non-exclusive mmap_sem (to exclude vma changes,
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1257,6 +1257,7 @@ void unmap_kernel_range(unsigned long ad
+ 	vunmap_page_range(addr, end);
+ 	flush_tlb_kernel_range(addr, end);
+ }
++EXPORT_SYMBOL_GPL(unmap_kernel_range);
+ 
+ int map_vm_area(struct vm_struct *area, pgprot_t prot, struct page ***pages)
+ {
+@@ -1394,6 +1395,7 @@ struct vm_struct *get_vm_area(unsigned l
+ 	return __get_vm_area_node(size, 1, flags, VMALLOC_START, VMALLOC_END,
+ 				-1, GFP_KERNEL, __builtin_return_address(0));
+ }
++EXPORT_SYMBOL_GPL(get_vm_area);
+ 
+ struct vm_struct *get_vm_area_caller(unsigned long size, unsigned long flags,
+ 				void *caller)
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -872,6 +872,7 @@ extern bool skip_free_areas_node(unsigne
+ 
+ int shmem_lock(struct file *file, int lock, struct user_struct *user);
+ struct file *shmem_file_setup(const char *name, loff_t size, unsigned long flags);
++void shmem_set_file(struct vm_area_struct *vma, struct file *file);
+ int shmem_zero_setup(struct vm_area_struct *);
+ 
+ extern int can_do_mlock(void);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/960-decompress_unlzo_fix.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/960-decompress_unlzo_fix.patch.svn-base
new file mode 100644
index 0000000..ee7c118
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/960-decompress_unlzo_fix.patch.svn-base
@@ -0,0 +1,23 @@
+--- /dev/null
++++ b/include/linux/decompress/unlzo_mm.h
+@@ -0,0 +1,10 @@
++#ifndef UNLZO_MM_H
++#define UNLZO_MM_H
++
++#ifdef STATIC
++#define INIT
++#else
++#define INIT __init
++#endif
++
++#endif
+--- a/lib/decompress_unlzo.c
++++ b/lib/decompress_unlzo.c
+@@ -38,6 +38,7 @@
+ 
+ #include <linux/types.h>
+ #include <linux/lzo.h>
++#include <linux/decompress/unlzo_mm.h>
+ #include <linux/decompress/mm.h>
+ 
+ #include <linux/compiler.h>
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/970-remove-unsane-filenames-from-deps_initramfs-list.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/970-remove-unsane-filenames-from-deps_initramfs-list.patch.svn-base
new file mode 100644
index 0000000..65c6ef7
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/970-remove-unsane-filenames-from-deps_initramfs-list.patch.svn-base
@@ -0,0 +1,28 @@
+--- a/usr/Makefile
++++ b/usr/Makefile
+@@ -50,20 +50,22 @@ ifneq ($(wildcard $(obj)/.initramfs_data
+ 	include $(obj)/.initramfs_data.cpio.d
+ endif
+ 
++deps_initramfs_sane := $(foreach v,$(deps_initramfs),$(if $(findstring :,$(v)),,$(v)))
++
+ quiet_cmd_initfs = GEN     $@
+       cmd_initfs = $(initramfs) -o $@ $(ramfs-args) $(ramfs-input)
+ 
+ targets := initramfs_data.cpio.gz initramfs_data.cpio.bz2 initramfs_data.cpio.lzma initramfs_data.cpio.xz initramfs_data.cpio.lzo initramfs_data.cpio
+ # do not try to update files included in initramfs
+-$(deps_initramfs): ;
++$(deps_initramfs_sane): ;
+ 
+-$(deps_initramfs): klibcdirs
++$(deps_initramfs_sane): klibcdirs
+ # We rebuild initramfs_data.cpio if:
+ # 1) Any included file is newer then initramfs_data.cpio
+ # 2) There are changes in which files are included (added or deleted)
+ # 3) If gen_init_cpio are newer than initramfs_data.cpio
+ # 4) arguments to gen_initramfs.sh changes
+-$(obj)/initramfs_data.cpio$(suffix_y): $(obj)/gen_init_cpio $(deps_initramfs) klibcdirs
++$(obj)/initramfs_data.cpio$(suffix_y): $(obj)/gen_init_cpio $(deps_initramfs_sane) klibcdirs
+ 	$(Q)$(initramfs) -l $(ramfs-input) > $(obj)/.initramfs_data.cpio.d
+ 	$(call if_changed,initfs)
+ 
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/980-arm_openwrt_machtypes.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/980-arm_openwrt_machtypes.patch.svn-base
new file mode 100644
index 0000000..8204318
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/980-arm_openwrt_machtypes.patch.svn-base
@@ -0,0 +1,34 @@
+--- a/arch/arm/tools/mach-types
++++ b/arch/arm/tools/mach-types
+@@ -1169,3 +1169,31 @@ elite_ulk		MACH_ELITE_ULK		ELITE_ULK		38
+ pov2			MACH_POV2		POV2			3889
+ ipod_touch_2g		MACH_IPOD_TOUCH_2G	IPOD_TOUCH_2G		3890
+ da850_pqab		MACH_DA850_PQAB		DA850_PQAB		3891
++#
++# Additional mach-types supported by OpenWrt
++#
++wg302v1			MACH_WG302V1		WG302V1			889
++pronghorn		MACH_PRONGHORN		PRONGHORN		928
++pronghorn_metro		MACH_PRONGHORNMETRO	PRONGHORNMETRO		1040
++sidewinder		MACH_SIDEWINDER		SIDEWINDER		1041
++wrt300nv2		MACH_WRT300NV2		WRT300NV2		1077
++compex42x		MACH_COMPEXWP18		COMPEXWP18		1273
++goldfish		MACH_GOLDFISH		GOLDFISH		1441
++cambria			MACH_CAMBRIA		CAMBRIA			1468
++dt2			MACH_DT2		DT2			1514
++ap1000			MACH_AP1000		AP1000			1543
++tw2662			MACH_TW2662		TW2662			1658
++tw5334			MACH_TW5334		TW5334			1664
++usr8200			MACH_USR8200		USR8200			1762
++mi424wr			MACH_MI424WR		MI424WR			1778
++gw2388			MACH_GW2388		GW2388			2635
++iconnect		MACH_ICONNECT		ICONNECT		2870
++nsb3ast			MACH_NSB3AST		NSB3AST			2917
++goflexnet		MACH_GOFLEXNET		GOFLEXNET		3089
++nas6210			MACH_NAS6210		NAS6210			3104
++ns_k330			MACH_NS_K330		NS_K330			3108
++bcm2708			MACH_BCM2708		BCM2708			3138
++wn802t			MACH_WN802T		WN802T			3306
++nsa310			MACH_NSA310		NSA310			4022
++wnr3500			MACH_WNR3500		WNR3500			4407
++ap42x			MACH_AP42X		AP42X			4418
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/992-mpcore_wdt_fix_watchdog_counter_loading.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/992-mpcore_wdt_fix_watchdog_counter_loading.patch.svn-base
new file mode 100644
index 0000000..fb16e2a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/992-mpcore_wdt_fix_watchdog_counter_loading.patch.svn-base
@@ -0,0 +1,64 @@
+Although the commit "98af057092f8f0dabe63c5df08adc2bbfbddb1d2
+ ARM: 6126/1: ARM mpcore_wdt: fix build failure and other fixes"
+resolved long standing mpcore_wdt driver build problems, it
+introduced an error in the relationship between the MPcore watchdog
+timer clock rate and mpcore_margin, "MPcore timer margin in seconds",
+such that watchdog timeouts are now arbitrary rather than the number
+of seconds specified by mpcore_margin.
+
+This change restores mpcore_wdt_keepalive() to its equivalent
+implementation prior to commit 98af057 such that watchdog timeouts now
+occur as specified by mpcore_margin.
+
+The variable 'mpcore_timer_rate' which caused that build failure was
+replaced by 'twd_timer_rate'. Adding exported function to obtain
+'twd_timer_rate' value in mpcore_wdt driver.
+
+MPCORE_WATCHDOG needed to build 'mpcore_wdt' already depends on
+HAVE_ARM_TWD needed to build 'smp_twd', so from the point of view of
+'mpcore_wdt' driver the exported function will always exist.
+
+Signed-off-by: Valentine Barshak <vbarshak@mvista.com>
+Signed-off-by: Vitaly Kuzmichev <vkuzmichev@mvista.com>
+---
+
+ arch/arm/include/asm/smp_twd.h |    1 +
+ arch/arm/kernel/smp_twd.c      |    7 +++++++
+ drivers/watchdog/mpcore_wdt.c  |    4 +---
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/include/asm/smp_twd.h
++++ b/arch/arm/include/asm/smp_twd.h
+@@ -24,5 +24,6 @@ extern void __iomem *twd_base;
+ 
+ void twd_timer_setup(struct clock_event_device *);
+ void twd_timer_stop(struct clock_event_device *);
++unsigned long twd_timer_get_rate(void);
+ 
+ #endif
+--- a/arch/arm/kernel/smp_twd.c
++++ b/arch/arm/kernel/smp_twd.c
+@@ -268,3 +268,10 @@ void __cpuinit twd_timer_setup(struct cl
+ 					0xf, 0xffffffff);
+ 	enable_percpu_irq(clk->irq, 0);
+ }
++
++/* Needed by mpcore_wdt */
++unsigned long twd_timer_get_rate(void)
++{
++	return twd_timer_rate;
++}
++EXPORT_SYMBOL_GPL(twd_timer_get_rate);
+--- a/drivers/watchdog/mpcore_wdt.c
++++ b/drivers/watchdog/mpcore_wdt.c
+@@ -99,9 +99,7 @@ static void mpcore_wdt_keepalive(struct
+ 
+ 	spin_lock(&wdt_lock);
+ 	/* Assume prescale is set to 256 */
+-	count =  __raw_readl(wdt->base + TWD_WDOG_COUNTER);
+-	count = (0xFFFFFFFFU - count) * (HZ / 5);
+-	count = (count / 256) * mpcore_margin;
++	count = (twd_timer_get_rate() / 256) * mpcore_margin;
+ 
+ 	/* Reload the counter */
+ 	writel(count + wdt->perturb, wdt->base + TWD_WDOG_LOAD);
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/993-mpcore_wdt_fix_wdioc_setoptions_handling.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/993-mpcore_wdt_fix_wdioc_setoptions_handling.patch.svn-base
new file mode 100644
index 0000000..fa261ce
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/993-mpcore_wdt_fix_wdioc_setoptions_handling.patch.svn-base
@@ -0,0 +1,29 @@
+According to the include/linux/watchdog.h WDIOC_SETOPTIONS is
+classified as 'read from device' ioctl call:
+  #define WDIOC_SETOPTIONS        _IOR(WATCHDOG_IOCTL_BASE, 4, int)
+
+However, the driver 'mpcore_wdt' performs 'copy_from_user' only if
+_IOC_WRITE is set, thus the local variable 'uarg' which is used in
+WDIOC_SETOPTIONS handling remains uninitialized.
+
+The proper way to fix this is to bind WDIOC_SETOPTIONS to _IOW,
+but this will break compatibility.
+So adding additional condition for performing 'copy_from_user'.
+
+Signed-off-by: Vitaly Kuzmichev <vkuzmichev@mvista.com>
+---
+ drivers/watchdog/mpcore_wdt.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+--- a/drivers/watchdog/mpcore_wdt.c
++++ b/drivers/watchdog/mpcore_wdt.c
+@@ -233,7 +233,8 @@ static long mpcore_wdt_ioctl(struct file
+ 	if (_IOC_DIR(cmd) && _IOC_SIZE(cmd) > sizeof(uarg))
+ 		return -ENOTTY;
+ 
+-	if (_IOC_DIR(cmd) & _IOC_WRITE) {
++	if ((_IOC_DIR(cmd) & _IOC_WRITE)
++			|| cmd == WDIOC_SETOPTIONS) {
+ 		ret = copy_from_user(&uarg, (void __user *)arg, _IOC_SIZE(cmd));
+ 		if (ret)
+ 			return -EFAULT;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/994-mpcore_wdt_fix_timer_mode_setup.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/994-mpcore_wdt_fix_timer_mode_setup.patch.svn-base
new file mode 100644
index 0000000..0090923
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/994-mpcore_wdt_fix_timer_mode_setup.patch.svn-base
@@ -0,0 +1,57 @@
+Allow watchdog to set its iterrupt as pending when it is configured
+for timer mode (in other words, allow emitting interrupt).
+Also add macros for all Watchdog Control Register flags.
+
+Signed-off-by: Vitaly Kuzmichev <vkuzmichev@mvista.com>
+---
+ arch/arm/include/asm/smp_twd.h |    6 ++++++
+ drivers/watchdog/mpcore_wdt.c  |   15 +++++++++++----
+ 2 files changed, 17 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/include/asm/smp_twd.h
++++ b/arch/arm/include/asm/smp_twd.h
+@@ -18,6 +18,12 @@
+ #define TWD_TIMER_CONTROL_PERIODIC	(1 << 1)
+ #define TWD_TIMER_CONTROL_IT_ENABLE	(1 << 2)
+ 
++#define TWD_WDOG_CONTROL_ENABLE		(1 << 0)
++#define TWD_WDOG_CONTROL_PERIODIC	(1 << 1)
++#define TWD_WDOG_CONTROL_IT_ENABLE	(1 << 2)
++#define TWD_WDOG_CONTROL_TIMER_MODE	(0 << 3)
++#define TWD_WDOG_CONTROL_WATCHDOG_MODE	(1 << 3)
++
+ struct clock_event_device;
+ 
+ extern void __iomem *twd_base;
+--- a/drivers/watchdog/mpcore_wdt.c
++++ b/drivers/watchdog/mpcore_wdt.c
+@@ -118,18 +118,25 @@ static void mpcore_wdt_stop(struct mpcor
+ 
+ static void mpcore_wdt_start(struct mpcore_wdt *wdt)
+ {
++	u32 mode;
++
+ 	dev_printk(KERN_INFO, wdt->dev, "enabling watchdog.\n");
+ 
+ 	/* This loads the count register but does NOT start the count yet */
+ 	mpcore_wdt_keepalive(wdt);
+ 
++	/* Setup watchdog - prescale=256, enable=1 */
++	mode = (255 << 8) | TWD_WDOG_CONTROL_ENABLE;
++
+ 	if (mpcore_noboot) {
+-		/* Enable watchdog - prescale=256, watchdog mode=0, enable=1 */
+-		writel(0x0000FF01, wdt->base + TWD_WDOG_CONTROL);
++		/* timer mode, send interrupt */
++		mode |=	TWD_WDOG_CONTROL_TIMER_MODE |
++				TWD_WDOG_CONTROL_IT_ENABLE;
+ 	} else {
+-		/* Enable watchdog - prescale=256, watchdog mode=1, enable=1 */
+-		writel(0x0000FF09, wdt->base + TWD_WDOG_CONTROL);
++		/* watchdog mode */
++		mode |=	TWD_WDOG_CONTROL_WATCHDOG_MODE;
+ 	}
++	writel(mode, wdt->base + TWD_WDOG_CONTROL);
+ }
+ 
+ static int mpcore_wdt_set_heartbeat(int t)
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/a01-swconfig_leds-define-leds_set_brightness.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/a01-swconfig_leds-define-leds_set_brightness.patch.svn-base
new file mode 100644
index 0000000..e9362e4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/a01-swconfig_leds-define-leds_set_brightness.patch.svn-base
@@ -0,0 +1,11 @@
+--- a/drivers/net/phy/swconfig_leds.c
++++ b/drivers/net/phy/swconfig_leds.c
+@@ -20,6 +20,8 @@
+ #define SWCONFIG_LED_TIMER_INTERVAL	(HZ / 10)
+ #define SWCONFIG_LED_NUM_PORTS		32
+ 
++#define led_set_brightness(_led, _switch)	led_brightness_set((_led), (_switch))
++
+ struct switch_led_trigger {
+ 	struct led_trigger trig;
+ 	struct switch_dev *swdev;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/a02-swconfig-revert-portid-snd_portid-usage.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/a02-swconfig-revert-portid-snd_portid-usage.patch.svn-base
new file mode 100644
index 0000000..e465f90
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/a02-swconfig-revert-portid-snd_portid-usage.patch.svn-base
@@ -0,0 +1,30 @@
+reverted:
+--- a/drivers/net/phy/swconfig.c
++++ b/drivers/net/phy/swconfig.c
+@@ -376,7 +376,7 @@ swconfig_dump_attr(struct swconfig_callb
+ 	int id = cb->args[0];
+ 	void *hdr;
+ 
+-	hdr = genlmsg_put(msg, info->snd_portid, info->snd_seq, &switch_fam,
++	hdr = genlmsg_put(msg, info->snd_pid, info->snd_seq, &switch_fam,
+ 			NLM_F_MULTI, SWITCH_CMD_NEW_ATTR);
+ 	if (IS_ERR(hdr))
+ 		return -1;
+@@ -798,7 +798,7 @@ swconfig_get_attr(struct sk_buff *skb, s
+ 	if (!msg)
+ 		goto error;
+ 
+-	hdr = genlmsg_put(msg, info->snd_portid, info->snd_seq, &switch_fam,
++	hdr = genlmsg_put(msg, info->snd_pid, info->snd_seq, &switch_fam,
+ 			0, cmd);
+ 	if (IS_ERR(hdr))
+ 		goto nla_put_failure;
+@@ -883,7 +883,7 @@ static int swconfig_dump_switches(struct
+ 	list_for_each_entry(dev, &swdevs, dev_list) {
+ 		if (++idx <= start)
+ 			continue;
+-		if (swconfig_send_switch(skb, NETLINK_CB(cb->skb).portid,
++		if (swconfig_send_switch(skb, NETLINK_CB(cb->skb).pid,
+ 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
+ 				dev) < 0)
+ 			break;
diff --git a/target/linux/generic/patches-3.3/.svn/text-base/a03-swconfig-revert-UAPI-disintegration.patch.svn-base b/target/linux/generic/patches-3.3/.svn/text-base/a03-swconfig-revert-UAPI-disintegration.patch.svn-base
new file mode 100644
index 0000000..569fd0c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/.svn/text-base/a03-swconfig-revert-UAPI-disintegration.patch.svn-base
@@ -0,0 +1,100 @@
+--- a/include/linux/switch.h
++++ b/include/linux/switch.h
+@@ -13,11 +13,86 @@
+  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  * GNU General Public License for more details.
+  */
+-#ifndef _LINUX_SWITCH_H
+-#define _LINUX_SWITCH_H
+ 
++#ifndef __LINUX_SWITCH_H
++#define __LINUX_SWITCH_H
++
++#include <linux/types.h>
++#include <linux/netdevice.h>
++#include <linux/netlink.h>
++#include <linux/genetlink.h>
++#ifndef __KERNEL__
++#include <netlink/netlink.h>
++#include <netlink/genl/genl.h>
++#include <netlink/genl/ctrl.h>
++#else
+ #include <net/genetlink.h>
+-#include <uapi/linux/switch.h>
++#endif
++
++/* main attributes */
++enum {
++	SWITCH_ATTR_UNSPEC,
++	/* global */
++	SWITCH_ATTR_TYPE,
++	/* device */
++	SWITCH_ATTR_ID,
++	SWITCH_ATTR_DEV_NAME,
++	SWITCH_ATTR_ALIAS,
++	SWITCH_ATTR_NAME,
++	SWITCH_ATTR_VLANS,
++	SWITCH_ATTR_PORTS,
++	SWITCH_ATTR_CPU_PORT,
++	/* attributes */
++	SWITCH_ATTR_OP_ID,
++	SWITCH_ATTR_OP_TYPE,
++	SWITCH_ATTR_OP_NAME,
++	SWITCH_ATTR_OP_PORT,
++	SWITCH_ATTR_OP_VLAN,
++	SWITCH_ATTR_OP_VALUE_INT,
++	SWITCH_ATTR_OP_VALUE_STR,
++	SWITCH_ATTR_OP_VALUE_PORTS,
++	SWITCH_ATTR_OP_DESCRIPTION,
++	/* port lists */
++	SWITCH_ATTR_PORT,
++	SWITCH_ATTR_MAX
++};
++
++/* commands */
++enum {
++	SWITCH_CMD_UNSPEC,
++	SWITCH_CMD_GET_SWITCH,
++	SWITCH_CMD_NEW_ATTR,
++	SWITCH_CMD_LIST_GLOBAL,
++	SWITCH_CMD_GET_GLOBAL,
++	SWITCH_CMD_SET_GLOBAL,
++	SWITCH_CMD_LIST_PORT,
++	SWITCH_CMD_GET_PORT,
++	SWITCH_CMD_SET_PORT,
++	SWITCH_CMD_LIST_VLAN,
++	SWITCH_CMD_GET_VLAN,
++	SWITCH_CMD_SET_VLAN
++};
++
++/* data types */
++enum switch_val_type {
++	SWITCH_TYPE_UNSPEC,
++	SWITCH_TYPE_INT,
++	SWITCH_TYPE_STRING,
++	SWITCH_TYPE_PORTS,
++	SWITCH_TYPE_NOVAL,
++};
++
++/* port nested attributes */
++enum {
++	SWITCH_PORT_UNSPEC,
++	SWITCH_PORT_ID,
++	SWITCH_PORT_FLAG_TAGGED,
++	SWITCH_PORT_ATTR_MAX
++};
++
++#define SWITCH_ATTR_DEFAULTS_OFFSET	0x1000
++
++#ifdef __KERNEL__
+ 
+ struct switch_dev;
+ struct switch_op;
+@@ -157,4 +232,6 @@ struct switch_attr {
+ 	int max;
+ };
+ 
+-#endif /* _LINUX_SWITCH_H */
++#endif
++
++#endif
diff --git a/target/linux/generic/patches-3.3/006-arm_kernel_xz_support.patch b/target/linux/generic/patches-3.3/006-arm_kernel_xz_support.patch
new file mode 100644
index 0000000..bfb1757
--- /dev/null
+++ b/target/linux/generic/patches-3.3/006-arm_kernel_xz_support.patch
@@ -0,0 +1,96 @@
+From 2d303b4683145f7dbc918bd14d04e1396581b2ce Mon Sep 17 00:00:00 2001
+From: Imre Kaloz <kaloz@openwrt.org>
+Date: Thu, 7 Jul 2011 12:05:21 +0200
+Subject: [PATCH] ARM: support XZ compressed kernels
+
+Wire up support for the XZ decompressor
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ arch/arm/Kconfig                        |    1 +
+ arch/arm/boot/compressed/Makefile       |   11 +++++++++--
+ arch/arm/boot/compressed/decompress.c   |    4 ++++
+ arch/arm/boot/compressed/piggy.xzkern.S |    6 ++++++
+ lib/xz/xz_dec_stream.c                  |    1 +
+ 5 files changed, 21 insertions(+), 2 deletions(-)
+ create mode 100644 arch/arm/boot/compressed/piggy.xzkern.S
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -21,6 +21,7 @@ config ARM
+ 	select HAVE_KERNEL_GZIP
+ 	select HAVE_KERNEL_LZO
+ 	select HAVE_KERNEL_LZMA
++	select HAVE_KERNEL_XZ
+ 	select HAVE_IRQ_WORK
+ 	select HAVE_PERF_EVENTS
+ 	select PERF_USE_VMALLOC
+--- a/arch/arm/boot/compressed/Makefile
++++ b/arch/arm/boot/compressed/Makefile
+@@ -92,6 +92,7 @@ SEDFLAGS	= s/TEXT_START/$(ZTEXTADDR)/;s/
+ suffix_$(CONFIG_KERNEL_GZIP) = gzip
+ suffix_$(CONFIG_KERNEL_LZO)  = lzo
+ suffix_$(CONFIG_KERNEL_LZMA) = lzma
++suffix_$(CONFIG_KERNEL_XZ)   = xzkern
+ 
+ # Borrowed libfdt files for the ATAG compatibility mode
+ 
+@@ -115,7 +116,7 @@ targets       := vmlinux vmlinux.lds \
+ 		 lib1funcs.o lib1funcs.S font.o font.c head.o misc.o $(OBJS)
+ 
+ # Make sure files are removed during clean
+-extra-y       += piggy.gzip piggy.lzo piggy.lzma lib1funcs.S $(libfdt) $(libfdt_hdrs)
++extra-y       += piggy.gzip piggy.lzo piggy.lzma piggy.xzkern lib1funcs.S ashldi3.S $(libfdt) $(libfdt_hdrs)
+ 
+ ifeq ($(CONFIG_FUNCTION_TRACER),y)
+ ORIG_CFLAGS := $(KBUILD_CFLAGS)
+@@ -171,8 +172,14 @@ if [ $(words $(ZRELADDR)) -gt 1 -a "$(CO
+ 	false; \
+ fi
+ 
++# For __aeabi_llsl
++ashldi3 = $(obj)/ashldi3.o
++
++$(obj)/ashldi3.S: $(srctree)/arch/$(SRCARCH)/lib/ashldi3.S FORCE
++	$(call cmd,shipped)
++
+ $(obj)/vmlinux: $(obj)/vmlinux.lds $(obj)/$(HEAD) $(obj)/piggy.$(suffix_y).o \
+-	 	$(addprefix $(obj)/, $(OBJS)) $(lib1funcs) FORCE
++	 	$(addprefix $(obj)/, $(OBJS)) $(lib1funcs) $(ashldi3) FORCE
+ 	@$(check_for_multiple_zreladdr)
+ 	$(call if_changed,ld)
+ 	@$(check_for_bad_syms)
+--- a/arch/arm/boot/compressed/decompress.c
++++ b/arch/arm/boot/compressed/decompress.c
+@@ -44,6 +44,12 @@ extern void error(char *);
+ #include "../../../../lib/decompress_unlzma.c"
+ #endif
+ 
++#ifdef CONFIG_KERNEL_XZ
++#define memmove memmove
++#define memcpy memcpy
++#include "../../../../lib/decompress_unxz.c"
++#endif
++
+ int do_decompress(u8 *input, int len, u8 *output, void (*error)(char *x))
+ {
+ 	return decompress(input, len, NULL, NULL, output, NULL, error);
+--- /dev/null
++++ b/arch/arm/boot/compressed/piggy.xzkern.S
+@@ -0,0 +1,6 @@
++	.section .piggydata,#alloc
++	.globl	input_data
++input_data:
++	.incbin	"arch/arm/boot/compressed/piggy.xzkern"
++	.globl	input_data_end
++input_data_end:
+--- a/lib/xz/xz_dec_stream.c
++++ b/lib/xz/xz_dec_stream.c
+@@ -9,6 +9,7 @@
+ 
+ #include "xz_private.h"
+ #include "xz_stream.h"
++#include <linux/kernel.h>
+ 
+ /* Hash used to validate the Index field */
+ struct xz_dec_hash {
diff --git a/target/linux/generic/patches-3.3/020-ssb_update.patch b/target/linux/generic/patches-3.3/020-ssb_update.patch
new file mode 100644
index 0000000..3a3afd0
--- /dev/null
+++ b/target/linux/generic/patches-3.3/020-ssb_update.patch
@@ -0,0 +1,1947 @@
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -43,8 +43,8 @@ static void early_nvram_init(void)
+ #ifdef CONFIG_BCM47XX_SSB
+ 	case BCM47XX_BUS_TYPE_SSB:
+ 		mcore_ssb = &bcm47xx_bus.ssb.mipscore;
+-		base = mcore_ssb->flash_window;
+-		lim = mcore_ssb->flash_window_size;
++		base = mcore_ssb->pflash.window;
++		lim = mcore_ssb->pflash.window_size;
+ 		break;
+ #endif
+ #ifdef CONFIG_BCM47XX_BCMA
+--- a/arch/mips/bcm47xx/wgt634u.c
++++ b/arch/mips/bcm47xx/wgt634u.c
+@@ -156,10 +156,10 @@ static int __init wgt634u_init(void)
+ 					    SSB_CHIPCO_IRQ_GPIO);
+ 		}
+ 
+-		wgt634u_flash_data.width = mcore->flash_buswidth;
+-		wgt634u_flash_resource.start = mcore->flash_window;
+-		wgt634u_flash_resource.end = mcore->flash_window
+-					   + mcore->flash_window_size
++		wgt634u_flash_data.width = mcore->pflash.buswidth;
++		wgt634u_flash_resource.start = mcore->pflash.window;
++		wgt634u_flash_resource.end = mcore->pflash.window
++					   + mcore->pflash.window_size
+ 					   - 1;
+ 		return platform_add_devices(wgt634u_devices,
+ 					    ARRAY_SIZE(wgt634u_devices));
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -136,6 +136,11 @@ config SSB_DRIVER_MIPS
+ 
+ 	  If unsure, say N
+ 
++config SSB_SFLASH
++	bool "SSB serial flash support"
++	depends on SSB_DRIVER_MIPS && BROKEN
++	default y
++
+ # Assumption: We are on embedded, if we compile the MIPS core.
+ config SSB_EMBEDDED
+ 	bool
+@@ -160,4 +165,12 @@ config SSB_DRIVER_GIGE
+ 
+ 	  If unsure, say N
+ 
++config SSB_DRIVER_GPIO
++	bool "SSB GPIO driver"
++	depends on SSB && GPIOLIB
++	help
++	  Driver to provide access to the GPIO pins on the bus.
++
++	  If unsure, say N
++
+ endmenu
+--- a/drivers/ssb/Makefile
++++ b/drivers/ssb/Makefile
+@@ -11,10 +11,12 @@ ssb-$(CONFIG_SSB_SDIOHOST)		+= sdio.o
+ # built-in drivers
+ ssb-y					+= driver_chipcommon.o
+ ssb-y					+= driver_chipcommon_pmu.o
++ssb-$(CONFIG_SSB_SFLASH)		+= driver_chipcommon_sflash.o
+ ssb-$(CONFIG_SSB_DRIVER_MIPS)		+= driver_mipscore.o
+ ssb-$(CONFIG_SSB_DRIVER_EXTIF)		+= driver_extif.o
+ ssb-$(CONFIG_SSB_DRIVER_PCICORE)	+= driver_pcicore.o
+ ssb-$(CONFIG_SSB_DRIVER_GIGE)		+= driver_gige.o
++ssb-$(CONFIG_SSB_DRIVER_GPIO)		+= driver_gpio.o
+ 
+ # b43 pci-ssb-bridge driver
+ # Not strictly a part of SSB, but kept here for convenience
+--- a/drivers/ssb/b43_pci_bridge.c
++++ b/drivers/ssb/b43_pci_bridge.c
+@@ -29,11 +29,15 @@ static const struct pci_device_id b43_pc
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4322) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43222) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4324) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4325) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4328) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4329) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x432b) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x432c) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4350) },
+ 	{ 0, },
+ };
+ MODULE_DEVICE_TABLE(pci, b43_pci_bridge_tbl);
+--- a/drivers/ssb/driver_chipcommon.c
++++ b/drivers/ssb/driver_chipcommon.c
+@@ -4,6 +4,7 @@
+  *
+  * Copyright 2005, Broadcom Corporation
+  * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+@@ -12,6 +13,7 @@
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/export.h>
+ #include <linux/pci.h>
++#include <linux/bcm47xx_wdt.h>
+ 
+ #include "ssb_private.h"
+ 
+@@ -280,10 +282,76 @@ static void calc_fast_powerup_delay(stru
+ 	cc->fast_pwrup_delay = tmp;
+ }
+ 
++static u32 ssb_chipco_alp_clock(struct ssb_chipcommon *cc)
++{
++	if (cc->capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_alp_clock(cc);
++
++	return 20000000;
++}
++
++static u32 ssb_chipco_watchdog_get_max_timer(struct ssb_chipcommon *cc)
++{
++	u32 nb;
++
++	if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
++		if (cc->dev->id.revision < 26)
++			nb = 16;
++		else
++			nb = (cc->dev->id.revision >= 37) ? 32 : 24;
++	} else {
++		nb = 28;
++	}
++	if (nb == 32)
++		return 0xffffffff;
++	else
++		return (1 << nb) - 1;
++}
++
++u32 ssb_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks)
++{
++	struct ssb_chipcommon *cc = bcm47xx_wdt_get_drvdata(wdt);
++
++	if (cc->dev->bus->bustype != SSB_BUSTYPE_SSB)
++		return 0;
++
++	return ssb_chipco_watchdog_timer_set(cc, ticks);
++}
++
++u32 ssb_chipco_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms)
++{
++	struct ssb_chipcommon *cc = bcm47xx_wdt_get_drvdata(wdt);
++	u32 ticks;
++
++	if (cc->dev->bus->bustype != SSB_BUSTYPE_SSB)
++		return 0;
++
++	ticks = ssb_chipco_watchdog_timer_set(cc, cc->ticks_per_ms * ms);
++	return ticks / cc->ticks_per_ms;
++}
++
++static int ssb_chipco_watchdog_ticks_per_ms(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
++			/* based on 32KHz ILP clock */
++			return 32;
++	} else {
++		if (cc->dev->id.revision < 18)
++			return ssb_clockspeed(bus) / 1000;
++		else
++			return ssb_chipco_alp_clock(cc) / 1000;
++	}
++}
++
+ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
+ {
+ 	if (!cc->dev)
+ 		return; /* We don't have a ChipCommon */
++
++	spin_lock_init(&cc->gpio_lock);
++
+ 	if (cc->dev->id.revision >= 11)
+ 		cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
+ 	ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
+@@ -297,6 +365,11 @@ void ssb_chipcommon_init(struct ssb_chip
+ 	chipco_powercontrol_init(cc);
+ 	ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
+ 	calc_fast_powerup_delay(cc);
++
++	if (cc->dev->bus->bustype == SSB_BUSTYPE_SSB) {
++		cc->ticks_per_ms = ssb_chipco_watchdog_ticks_per_ms(cc);
++		cc->max_timer_ms = ssb_chipco_watchdog_get_max_timer(cc) / cc->ticks_per_ms;
++	}
+ }
+ 
+ void ssb_chipco_suspend(struct ssb_chipcommon *cc)
+@@ -395,10 +468,27 @@ void ssb_chipco_timing_init(struct ssb_c
+ }
+ 
+ /* Set chip watchdog reset timer to fire in 'ticks' backplane cycles */
+-void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks)
++u32 ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks)
+ {
+-	/* instant NMI */
+-	chipco_write32(cc, SSB_CHIPCO_WATCHDOG, ticks);
++	u32 maxt;
++	enum ssb_clkmode clkmode;
++
++	maxt = ssb_chipco_watchdog_get_max_timer(cc);
++	if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
++		if (ticks == 1)
++			ticks = 2;
++		else if (ticks > maxt)
++			ticks = maxt;
++		chipco_write32(cc, SSB_CHIPCO_PMU_WATCHDOG, ticks);
++	} else {
++		clkmode = ticks ? SSB_CLKMODE_FAST : SSB_CLKMODE_DYNAMIC;
++		ssb_chipco_set_clockmode(cc, clkmode);
++		if (ticks > maxt)
++			ticks = maxt;
++		/* instant NMI */
++		chipco_write32(cc, SSB_CHIPCO_WATCHDOG, ticks);
++	}
++	return ticks;
+ }
+ 
+ void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value)
+@@ -418,28 +508,93 @@ u32 ssb_chipco_gpio_in(struct ssb_chipco
+ 
+ u32 ssb_chipco_gpio_out(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOOUT, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOOUT, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_chipco_gpio_outen(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOOUTEN, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOOUTEN, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_chipco_gpio_control(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOCTL, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOCTL, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ EXPORT_SYMBOL(ssb_chipco_gpio_control);
+ 
+ u32 ssb_chipco_gpio_intmask(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOIRQ, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOIRQ, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_chipco_gpio_polarity(struct ssb_chipcommon *cc, u32 mask, u32 value)
+ {
+-	return chipco_write32_masked(cc, SSB_CHIPCO_GPIOPOL, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOPOL, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
++}
++
++u32 ssb_chipco_gpio_pullup(struct ssb_chipcommon *cc, u32 mask, u32 value)
++{
++	unsigned long flags;
++	u32 res = 0;
++
++	if (cc->dev->id.revision < 20)
++		return 0xffffffff;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOPULLUP, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
++}
++
++u32 ssb_chipco_gpio_pulldown(struct ssb_chipcommon *cc, u32 mask, u32 value)
++{
++	unsigned long flags;
++	u32 res = 0;
++
++	if (cc->dev->id.revision < 20)
++		return 0xffffffff;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = chipco_write32_masked(cc, SSB_CHIPCO_GPIOPULLDOWN, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ #ifdef CONFIG_SSB_SERIAL
+@@ -473,12 +628,7 @@ int ssb_chipco_serial_init(struct ssb_ch
+ 				       chipco_read32(cc, SSB_CHIPCO_CORECTL)
+ 				       | SSB_CHIPCO_CORECTL_UARTCLK0);
+ 		} else if ((ccrev >= 11) && (ccrev != 15)) {
+-			/* Fixed ALP clock */
+-			baud_base = 20000000;
+-			if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
+-				/* FIXME: baud_base is different for devices with a PMU */
+-				SSB_WARN_ON(1);
+-			}
++			baud_base = ssb_chipco_alp_clock(cc);
+ 			div = 1;
+ 			if (ccrev >= 21) {
+ 				/* Turn off UART clock before switching clocksource. */
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -13,6 +13,9 @@
+ #include <linux/ssb/ssb_driver_chipcommon.h>
+ #include <linux/delay.h>
+ #include <linux/export.h>
++#ifdef CONFIG_BCM47XX
++#include <asm/mach-bcm47xx/nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -92,10 +95,6 @@ static void ssb_pmu0_pllinit_r0(struct s
+ 	u32 pmuctl, tmp, pllctl;
+ 	unsigned int i;
+ 
+-	if ((bus->chip_id == 0x5354) && !crystalfreq) {
+-		/* The 5354 crystal freq is 25MHz */
+-		crystalfreq = 25000;
+-	}
+ 	if (crystalfreq)
+ 		e = pmu0_plltab_find_entry(crystalfreq);
+ 	if (!e)
+@@ -321,7 +320,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 	u32 crystalfreq = 0; /* in kHz. 0 = keep default freq. */
+ 
+ 	if (bus->bustype == SSB_BUSTYPE_SSB) {
+-		/* TODO: The user may override the crystal frequency. */
++#ifdef CONFIG_BCM47XX
++		char buf[20];
++		if (nvram_getenv("xtalfreq", buf, sizeof(buf)) >= 0)
++			crystalfreq = simple_strtoul(buf, NULL, 0);
++#endif
+ 	}
+ 
+ 	switch (bus->chip_id) {
+@@ -330,7 +333,11 @@ static void ssb_pmu_pll_init(struct ssb_
+ 		ssb_pmu1_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4328:
++		ssb_pmu0_pllinit_r0(cc, crystalfreq);
++		break;
+ 	case 0x5354:
++		if (crystalfreq == 0)
++			crystalfreq = 25000;
+ 		ssb_pmu0_pllinit_r0(cc, crystalfreq);
+ 		break;
+ 	case 0x4322:
+@@ -339,6 +346,8 @@ static void ssb_pmu_pll_init(struct ssb_
+ 			chipco_write32(cc, SSB_CHIPCO_PLLCTL_DATA, 0x380005C0);
+ 		}
+ 		break;
++	case 43222:
++		break;
+ 	default:
+ 		ssb_printk(KERN_ERR PFX
+ 			   "ERROR: PLL init unknown for device %04X\n",
+@@ -427,6 +436,7 @@ static void ssb_pmu_resources_init(struc
+ 		 min_msk = 0xCBB;
+ 		 break;
+ 	case 0x4322:
++	case 43222:
+ 		/* We keep the default settings:
+ 		 * min_msk = 0xCBB
+ 		 * max_msk = 0x7FFFF
+@@ -607,3 +617,61 @@ void ssb_pmu_set_ldo_paref(struct ssb_ch
+ 
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
+ EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
++
++static u32 ssb_pmu_get_alp_clock_clk0(struct ssb_chipcommon *cc)
++{
++	u32 crystalfreq;
++	const struct pmu0_plltab_entry *e = NULL;
++
++	crystalfreq = chipco_read32(cc, SSB_CHIPCO_PMU_CTL) &
++		      SSB_CHIPCO_PMU_CTL_XTALFREQ >> SSB_CHIPCO_PMU_CTL_XTALFREQ_SHIFT;
++	e = pmu0_plltab_find_entry(crystalfreq);
++	BUG_ON(!e);
++	return e->freq * 1000;
++}
++
++u32 ssb_pmu_get_alp_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		ssb_pmu_get_alp_clock_clk0(cc);
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU alp clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		/* 5354 chip uses a non programmable PLL of frequency 240MHz */
++		return 240000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU cpu clock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
++
++u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
++{
++	struct ssb_bus *bus = cc->dev->bus;
++
++	switch (bus->chip_id) {
++	case 0x5354:
++		return 120000000;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "ERROR: PMU controlclock unknown for device %04X\n",
++			   bus->chip_id);
++		return 0;
++	}
++}
+--- /dev/null
++++ b/drivers/ssb/driver_chipcommon_sflash.c
+@@ -0,0 +1,18 @@
++/*
++ * Sonics Silicon Backplane
++ * ChipCommon serial flash interface
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/ssb/ssb.h>
++
++#include "ssb_private.h"
++
++/* Initialize serial flash access */
++int ssb_sflash_init(struct ssb_chipcommon *cc)
++{
++	pr_err("Serial flash support is not implemented yet!\n");
++
++	return -ENOTSUPP;
++}
+--- a/drivers/ssb/driver_extif.c
++++ b/drivers/ssb/driver_extif.c
+@@ -112,10 +112,37 @@ void ssb_extif_get_clockcontrol(struct s
+ 	*m = extif_read32(extif, SSB_EXTIF_CLOCK_SB);
+ }
+ 
+-void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
+-				  u32 ticks)
++u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks)
+ {
++	struct ssb_extif *extif = bcm47xx_wdt_get_drvdata(wdt);
++
++	return ssb_extif_watchdog_timer_set(extif, ticks);
++}
++
++u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms)
++{
++	struct ssb_extif *extif = bcm47xx_wdt_get_drvdata(wdt);
++	u32 ticks = (SSB_EXTIF_WATCHDOG_CLK / 1000) * ms;
++
++	ticks = ssb_extif_watchdog_timer_set(extif, ticks);
++
++	return (ticks * 1000) / SSB_EXTIF_WATCHDOG_CLK;
++}
++
++u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks)
++{
++	if (ticks > SSB_EXTIF_WATCHDOG_MAX_TIMER)
++		ticks = SSB_EXTIF_WATCHDOG_MAX_TIMER;
+ 	extif_write32(extif, SSB_EXTIF_WATCHDOG, ticks);
++
++	return ticks;
++}
++
++void ssb_extif_init(struct ssb_extif *extif)
++{
++	if (!extif->dev)
++		return; /* We don't have a Extif core */
++	spin_lock_init(&extif->gpio_lock);
+ }
+ 
+ u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask)
+@@ -125,22 +152,50 @@ u32 ssb_extif_gpio_in(struct ssb_extif *
+ 
+ u32 ssb_extif_gpio_out(struct ssb_extif *extif, u32 mask, u32 value)
+ {
+-	return extif_write32_masked(extif, SSB_EXTIF_GPIO_OUT(0),
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&extif->gpio_lock, flags);
++	res = extif_write32_masked(extif, SSB_EXTIF_GPIO_OUT(0),
+ 				   mask, value);
++	spin_unlock_irqrestore(&extif->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_extif_gpio_outen(struct ssb_extif *extif, u32 mask, u32 value)
+ {
+-	return extif_write32_masked(extif, SSB_EXTIF_GPIO_OUTEN(0),
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&extif->gpio_lock, flags);
++	res = extif_write32_masked(extif, SSB_EXTIF_GPIO_OUTEN(0),
+ 				   mask, value);
++	spin_unlock_irqrestore(&extif->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_extif_gpio_polarity(struct ssb_extif *extif, u32 mask, u32 value)
+ {
+-	return extif_write32_masked(extif, SSB_EXTIF_GPIO_INTPOL, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&extif->gpio_lock, flags);
++	res = extif_write32_masked(extif, SSB_EXTIF_GPIO_INTPOL, mask, value);
++	spin_unlock_irqrestore(&extif->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 ssb_extif_gpio_intmask(struct ssb_extif *extif, u32 mask, u32 value)
+ {
+-	return extif_write32_masked(extif, SSB_EXTIF_GPIO_INTMASK, mask, value);
++	unsigned long flags;
++	u32 res = 0;
++
++	spin_lock_irqsave(&extif->gpio_lock, flags);
++	res = extif_write32_masked(extif, SSB_EXTIF_GPIO_INTMASK, mask, value);
++	spin_unlock_irqrestore(&extif->gpio_lock, flags);
++
++	return res;
+ }
+--- /dev/null
++++ b/drivers/ssb/driver_gpio.c
+@@ -0,0 +1,176 @@
++/*
++ * Sonics Silicon Backplane
++ * GPIO driver
++ *
++ * Copyright 2011, Broadcom Corporation
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/gpio.h>
++#include <linux/export.h>
++#include <linux/ssb/ssb.h>
++
++#include "ssb_private.h"
++
++static struct ssb_bus *ssb_gpio_get_bus(struct gpio_chip *chip)
++{
++	return container_of(chip, struct ssb_bus, gpio);
++}
++
++static int ssb_gpio_chipco_get_value(struct gpio_chip *chip, unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	return !!ssb_chipco_gpio_in(&bus->chipco, 1 << gpio);
++}
++
++static void ssb_gpio_chipco_set_value(struct gpio_chip *chip, unsigned gpio,
++				      int value)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_chipco_gpio_out(&bus->chipco, 1 << gpio, value ? 1 << gpio : 0);
++}
++
++static int ssb_gpio_chipco_direction_input(struct gpio_chip *chip,
++					   unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_chipco_gpio_outen(&bus->chipco, 1 << gpio, 0);
++	return 0;
++}
++
++static int ssb_gpio_chipco_direction_output(struct gpio_chip *chip,
++					    unsigned gpio, int value)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_chipco_gpio_outen(&bus->chipco, 1 << gpio, 1 << gpio);
++	ssb_chipco_gpio_out(&bus->chipco, 1 << gpio, value ? 1 << gpio : 0);
++	return 0;
++}
++
++static int ssb_gpio_chipco_request(struct gpio_chip *chip, unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_chipco_gpio_control(&bus->chipco, 1 << gpio, 0);
++	/* clear pulldown */
++	ssb_chipco_gpio_pulldown(&bus->chipco, 1 << gpio, 0);
++	/* Set pullup */
++	ssb_chipco_gpio_pullup(&bus->chipco, 1 << gpio, 1 << gpio);
++
++	return 0;
++}
++
++static void ssb_gpio_chipco_free(struct gpio_chip *chip, unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	/* clear pullup */
++	ssb_chipco_gpio_pullup(&bus->chipco, 1 << gpio, 0);
++}
++
++static int ssb_gpio_chipco_init(struct ssb_bus *bus)
++{
++	struct gpio_chip *chip = &bus->gpio;
++
++	chip->label		= "ssb_chipco_gpio";
++	chip->owner		= THIS_MODULE;
++	chip->request		= ssb_gpio_chipco_request;
++	chip->free		= ssb_gpio_chipco_free;
++	chip->get		= ssb_gpio_chipco_get_value;
++	chip->set		= ssb_gpio_chipco_set_value;
++	chip->direction_input	= ssb_gpio_chipco_direction_input;
++	chip->direction_output	= ssb_gpio_chipco_direction_output;
++	chip->ngpio		= 16;
++	/* There is just one SoC in one device and its GPIO addresses should be
++	 * deterministic to address them more easily. The other buses could get
++	 * a random base number. */
++	if (bus->bustype == SSB_BUSTYPE_SSB)
++		chip->base		= 0;
++	else
++		chip->base		= -1;
++
++	return gpiochip_add(chip);
++}
++
++#ifdef CONFIG_SSB_DRIVER_EXTIF
++
++static int ssb_gpio_extif_get_value(struct gpio_chip *chip, unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	return !!ssb_extif_gpio_in(&bus->extif, 1 << gpio);
++}
++
++static void ssb_gpio_extif_set_value(struct gpio_chip *chip, unsigned gpio,
++				     int value)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_extif_gpio_out(&bus->extif, 1 << gpio, value ? 1 << gpio : 0);
++}
++
++static int ssb_gpio_extif_direction_input(struct gpio_chip *chip,
++					  unsigned gpio)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_extif_gpio_outen(&bus->extif, 1 << gpio, 0);
++	return 0;
++}
++
++static int ssb_gpio_extif_direction_output(struct gpio_chip *chip,
++					   unsigned gpio, int value)
++{
++	struct ssb_bus *bus = ssb_gpio_get_bus(chip);
++
++	ssb_extif_gpio_outen(&bus->extif, 1 << gpio, 1 << gpio);
++	ssb_extif_gpio_out(&bus->extif, 1 << gpio, value ? 1 << gpio : 0);
++	return 0;
++}
++
++static int ssb_gpio_extif_init(struct ssb_bus *bus)
++{
++	struct gpio_chip *chip = &bus->gpio;
++
++	chip->label		= "ssb_extif_gpio";
++	chip->owner		= THIS_MODULE;
++	chip->get		= ssb_gpio_extif_get_value;
++	chip->set		= ssb_gpio_extif_set_value;
++	chip->direction_input	= ssb_gpio_extif_direction_input;
++	chip->direction_output	= ssb_gpio_extif_direction_output;
++	chip->ngpio		= 5;
++	/* There is just one SoC in one device and its GPIO addresses should be
++	 * deterministic to address them more easily. The other buses could get
++	 * a random base number. */
++	if (bus->bustype == SSB_BUSTYPE_SSB)
++		chip->base		= 0;
++	else
++		chip->base		= -1;
++
++	return gpiochip_add(chip);
++}
++
++#else
++static int ssb_gpio_extif_init(struct ssb_bus *bus)
++{
++	return -ENOTSUPP;
++}
++#endif
++
++int ssb_gpio_init(struct ssb_bus *bus)
++{
++	if (ssb_chipco_available(&bus->chipco))
++		return ssb_gpio_chipco_init(bus);
++	else if (ssb_extif_available(&bus->extif))
++		return ssb_gpio_extif_init(bus);
++	else
++		SSB_WARN_ON(1);
++
++	return -1;
++}
+--- a/drivers/ssb/driver_mipscore.c
++++ b/drivers/ssb/driver_mipscore.c
+@@ -178,9 +178,9 @@ static void ssb_mips_serial_init(struct
+ {
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 
+-	if (bus->extif.dev)
++	if (ssb_extif_available(&bus->extif))
+ 		mcore->nr_serial_ports = ssb_extif_serial_init(&bus->extif, mcore->serial_ports);
+-	else if (bus->chipco.dev)
++	else if (ssb_chipco_available(&bus->chipco))
+ 		mcore->nr_serial_ports = ssb_chipco_serial_init(&bus->chipco, mcore->serial_ports);
+ 	else
+ 		mcore->nr_serial_ports = 0;
+@@ -190,16 +190,33 @@ static void ssb_mips_flash_detect(struct
+ {
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 
+-	mcore->flash_buswidth = 2;
+-	if (bus->chipco.dev) {
+-		mcore->flash_window = 0x1c000000;
+-		mcore->flash_window_size = 0x02000000;
++	/* When there is no chipcommon on the bus there is 4MB flash */
++	if (!ssb_chipco_available(&bus->chipco)) {
++		mcore->pflash.present = true;
++		mcore->pflash.buswidth = 2;
++		mcore->pflash.window = SSB_FLASH1;
++		mcore->pflash.window_size = SSB_FLASH1_SZ;
++		return;
++	}
++
++	/* There is ChipCommon, so use it to read info about flash */
++	switch (bus->chipco.capabilities & SSB_CHIPCO_CAP_FLASHT) {
++	case SSB_CHIPCO_FLASHT_STSER:
++	case SSB_CHIPCO_FLASHT_ATSER:
++		pr_debug("Found serial flash\n");
++		ssb_sflash_init(&bus->chipco);
++		break;
++	case SSB_CHIPCO_FLASHT_PARA:
++		pr_debug("Found parallel flash\n");
++		mcore->pflash.present = true;
++		mcore->pflash.window = SSB_FLASH2;
++		mcore->pflash.window_size = SSB_FLASH2_SZ;
+ 		if ((ssb_read32(bus->chipco.dev, SSB_CHIPCO_FLASH_CFG)
+ 		               & SSB_CHIPCO_CFG_DS16) == 0)
+-			mcore->flash_buswidth = 1;
+-	} else {
+-		mcore->flash_window = 0x1fc00000;
+-		mcore->flash_window_size = 0x00400000;
++			mcore->pflash.buswidth = 1;
++		else
++			mcore->pflash.buswidth = 2;
++		break;
+ 	}
+ }
+ 
+@@ -208,9 +225,12 @@ u32 ssb_cpu_clock(struct ssb_mipscore *m
+ 	struct ssb_bus *bus = mcore->dev->bus;
+ 	u32 pll_type, n, m, rate = 0;
+ 
+-	if (bus->extif.dev) {
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_cpu_clock(&bus->chipco);
++
++	if (ssb_extif_available(&bus->extif)) {
+ 		ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
+-	} else if (bus->chipco.dev) {
++	} else if (ssb_chipco_available(&bus->chipco)) {
+ 		ssb_chipco_get_clockcpu(&bus->chipco, &pll_type, &n, &m);
+ 	} else
+ 		return 0;
+@@ -246,9 +266,9 @@ void ssb_mipscore_init(struct ssb_mipsco
+ 		hz = 100000000;
+ 	ns = 1000000000 / hz;
+ 
+-	if (bus->extif.dev)
++	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_timing_init(&bus->extif, ns);
+-	else if (bus->chipco.dev)
++	else if (ssb_chipco_available(&bus->chipco))
+ 		ssb_chipco_timing_init(&bus->chipco, ns);
+ 
+ 	/* Assign IRQs to all cores on the bus, start with irq line 2, because serial usually takes 1 */
+--- a/drivers/ssb/embedded.c
++++ b/drivers/ssb/embedded.c
+@@ -4,11 +4,13 @@
+  *
+  * Copyright 2005-2008, Broadcom Corporation
+  * Copyright 2006-2008, Michael Buesch <m@bues.ch>
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+ #include <linux/export.h>
++#include <linux/platform_device.h>
+ #include <linux/ssb/ssb.h>
+ #include <linux/ssb/ssb_embedded.h>
+ #include <linux/ssb/ssb_driver_pci.h>
+@@ -32,6 +34,39 @@ int ssb_watchdog_timer_set(struct ssb_bu
+ }
+ EXPORT_SYMBOL(ssb_watchdog_timer_set);
+ 
++int ssb_watchdog_register(struct ssb_bus *bus)
++{
++	struct bcm47xx_wdt wdt = {};
++	struct platform_device *pdev;
++
++	if (ssb_chipco_available(&bus->chipco)) {
++		wdt.driver_data = &bus->chipco;
++		wdt.timer_set = ssb_chipco_watchdog_timer_set_wdt;
++		wdt.timer_set_ms = ssb_chipco_watchdog_timer_set_ms;
++		wdt.max_timer_ms = bus->chipco.max_timer_ms;
++	} else if (ssb_extif_available(&bus->extif)) {
++		wdt.driver_data = &bus->extif;
++		wdt.timer_set = ssb_extif_watchdog_timer_set_wdt;
++		wdt.timer_set_ms = ssb_extif_watchdog_timer_set_ms;
++		wdt.max_timer_ms = SSB_EXTIF_WATCHDOG_MAX_TIMER_MS;
++	} else {
++		return -ENODEV;
++	}
++
++	pdev = platform_device_register_data(NULL, "bcm47xx-wdt",
++					     bus->busnumber, &wdt,
++					     sizeof(wdt));
++	if (IS_ERR(pdev)) {
++		ssb_dprintk(KERN_INFO PFX
++			    "can not register watchdog device, err: %li\n",
++			    PTR_ERR(pdev));
++		return PTR_ERR(pdev);
++	}
++
++	bus->watchdog = pdev;
++	return 0;
++}
++
+ u32 ssb_gpio_in(struct ssb_bus *bus, u32 mask)
+ {
+ 	unsigned long flags;
+--- a/drivers/ssb/main.c
++++ b/drivers/ssb/main.c
+@@ -13,6 +13,7 @@
+ #include <linux/delay.h>
+ #include <linux/io.h>
+ #include <linux/module.h>
++#include <linux/platform_device.h>
+ #include <linux/ssb/ssb.h>
+ #include <linux/ssb/ssb_regs.h>
+ #include <linux/ssb/ssb_driver_gige.h>
+@@ -140,19 +141,6 @@ static void ssb_device_put(struct ssb_de
+ 		put_device(dev->dev);
+ }
+ 
+-static inline struct ssb_driver *ssb_driver_get(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		get_driver(&drv->drv);
+-	return drv;
+-}
+-
+-static inline void ssb_driver_put(struct ssb_driver *drv)
+-{
+-	if (drv)
+-		put_driver(&drv->drv);
+-}
+-
+ static int ssb_device_resume(struct device *dev)
+ {
+ 	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
+@@ -250,11 +238,9 @@ int ssb_devices_freeze(struct ssb_bus *b
+ 			ssb_device_put(sdev);
+ 			continue;
+ 		}
+-		sdrv = ssb_driver_get(drv_to_ssb_drv(sdev->dev->driver));
+-		if (!sdrv || SSB_WARN_ON(!sdrv->remove)) {
+-			ssb_device_put(sdev);
++		sdrv = drv_to_ssb_drv(sdev->dev->driver);
++		if (SSB_WARN_ON(!sdrv->remove))
+ 			continue;
+-		}
+ 		sdrv->remove(sdev);
+ 		ctx->device_frozen[i] = 1;
+ 	}
+@@ -293,7 +279,6 @@ int ssb_devices_thaw(struct ssb_freeze_c
+ 				   dev_name(sdev->dev));
+ 			result = err;
+ 		}
+-		ssb_driver_put(sdrv);
+ 		ssb_device_put(sdev);
+ 	}
+ 
+@@ -449,6 +434,11 @@ static void ssb_devices_unregister(struc
+ 		if (sdev->dev)
+ 			device_unregister(sdev->dev);
+ 	}
++
++#ifdef CONFIG_SSB_EMBEDDED
++	if (bus->bustype == SSB_BUSTYPE_SSB)
++		platform_device_unregister(bus->watchdog);
++#endif
+ }
+ 
+ void ssb_bus_unregister(struct ssb_bus *bus)
+@@ -577,6 +567,8 @@ static int __devinit ssb_attach_queued_b
+ 		if (err)
+ 			goto error;
+ 		ssb_pcicore_init(&bus->pcicore);
++		if (bus->bustype == SSB_BUSTYPE_SSB)
++			ssb_watchdog_register(bus);
+ 		ssb_bus_may_powerdown(bus);
+ 
+ 		err = ssb_devices_register(bus);
+@@ -812,7 +804,14 @@ static int __devinit ssb_bus_register(st
+ 	if (err)
+ 		goto err_pcmcia_exit;
+ 	ssb_chipcommon_init(&bus->chipco);
++	ssb_extif_init(&bus->extif);
+ 	ssb_mipscore_init(&bus->mipscore);
++	err = ssb_gpio_init(bus);
++	if (err == -ENOTSUPP)
++		ssb_dprintk(KERN_DEBUG PFX "GPIO driver not activated\n");
++	else if (err)
++		ssb_dprintk(KERN_ERR PFX
++			   "Error registering GPIO driver: %i\n", err);
+ 	err = ssb_fetch_invariants(bus, get_invariants);
+ 	if (err) {
+ 		ssb_bus_may_powerdown(bus);
+@@ -1094,6 +1093,9 @@ u32 ssb_clockspeed(struct ssb_bus *bus)
+ 	u32 plltype;
+ 	u32 clkctl_n, clkctl_m;
+ 
++	if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
++		return ssb_pmu_get_controlclock(&bus->chipco);
++
+ 	if (ssb_extif_available(&bus->extif))
+ 		ssb_extif_get_clockcontrol(&bus->extif, &plltype,
+ 					   &clkctl_n, &clkctl_m);
+@@ -1131,8 +1133,7 @@ static u32 ssb_tmslow_reject_bitmask(str
+ 	case SSB_IDLOW_SSBREV_27:     /* same here */
+ 		return SSB_TMSLOW_REJECT;	/* this is a guess */
+ 	default:
+-		printk(KERN_INFO "ssb: Backplane Revision 0x%.8X\n", rev);
+-		WARN_ON(1);
++		WARN(1, KERN_INFO "ssb: Backplane Revision 0x%.8X\n", rev);
+ 	}
+ 	return (SSB_TMSLOW_REJECT | SSB_TMSLOW_REJECT_23);
+ }
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -178,6 +178,18 @@ err_pci:
+ #define SPEX(_outvar, _offset, _mask, _shift) \
+ 	SPEX16(_outvar, _offset, _mask, _shift)
+ 
++#define SPEX_ARRAY8(_field, _offset, _mask, _shift)	\
++	do {	\
++		SPEX(_field[0], _offset +  0, _mask, _shift);	\
++		SPEX(_field[1], _offset +  2, _mask, _shift);	\
++		SPEX(_field[2], _offset +  4, _mask, _shift);	\
++		SPEX(_field[3], _offset +  6, _mask, _shift);	\
++		SPEX(_field[4], _offset +  8, _mask, _shift);	\
++		SPEX(_field[5], _offset + 10, _mask, _shift);	\
++		SPEX(_field[6], _offset + 12, _mask, _shift);	\
++		SPEX(_field[7], _offset + 14, _mask, _shift);	\
++	} while (0)
++
+ 
+ static inline u8 ssb_crc8(u8 crc, u8 data)
+ {
+@@ -331,7 +343,6 @@ static void sprom_extract_r123(struct ss
+ {
+ 	int i;
+ 	u16 v;
+-	s8 gain;
+ 	u16 loc[3];
+ 
+ 	if (out->revision == 3)			/* rev 3 moved MAC */
+@@ -361,8 +372,9 @@ static void sprom_extract_r123(struct ss
+ 	SPEX(et0mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0M, 14);
+ 	SPEX(et1mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1M, 15);
+ 	SPEX(board_rev, SSB_SPROM1_BINF, SSB_SPROM1_BINF_BREV, 0);
+-	SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
+-	     SSB_SPROM1_BINF_CCODE_SHIFT);
++	if (out->revision == 1)
++		SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
++		     SSB_SPROM1_BINF_CCODE_SHIFT);
+ 	SPEX(ant_available_a, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTA,
+ 	     SSB_SPROM1_BINF_ANTA_SHIFT);
+ 	SPEX(ant_available_bg, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTBG,
+@@ -388,22 +400,16 @@ static void sprom_extract_r123(struct ss
+ 	SPEX(boardflags_lo, SSB_SPROM1_BFLLO, 0xFFFF, 0);
+ 	if (out->revision >= 2)
+ 		SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
++	SPEX(alpha2[0], SSB_SPROM1_CCODE, 0xff00, 8);
++	SPEX(alpha2[1], SSB_SPROM1_CCODE, 0x00ff, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_BG,
+-				    SSB_SPROM1_AGAIN_BG_SHIFT);
+-	out->antenna_gain.ghz24.a0 = gain;
+-	out->antenna_gain.ghz24.a1 = gain;
+-	out->antenna_gain.ghz24.a2 = gain;
+-	out->antenna_gain.ghz24.a3 = gain;
+-	gain = r123_extract_antgain(out->revision, in,
+-				    SSB_SPROM1_AGAIN_A,
+-				    SSB_SPROM1_AGAIN_A_SHIFT);
+-	out->antenna_gain.ghz5.a0 = gain;
+-	out->antenna_gain.ghz5.a1 = gain;
+-	out->antenna_gain.ghz5.a2 = gain;
+-	out->antenna_gain.ghz5.a3 = gain;
++	out->antenna_gain.a0 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_BG,
++						    SSB_SPROM1_AGAIN_BG_SHIFT);
++	out->antenna_gain.a1 = r123_extract_antgain(out->revision, in,
++						    SSB_SPROM1_AGAIN_A,
++						    SSB_SPROM1_AGAIN_A_SHIFT);
+ }
+ 
+ /* Revs 4 5 and 8 have partially shared layout */
+@@ -464,14 +470,17 @@ static void sprom_extract_r45(struct ssb
+ 	SPEX(et0phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET0A, 0);
+ 	SPEX(et1phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET1A,
+ 	     SSB_SPROM4_ETHPHY_ET1A_SHIFT);
++	SPEX(board_rev, SSB_SPROM4_BOARDREV, 0xFFFF, 0);
+ 	if (out->revision == 4) {
+-		SPEX(country_code, SSB_SPROM4_CCODE, 0xFFFF, 0);
++		SPEX(alpha2[0], SSB_SPROM4_CCODE, 0xff00, 8);
++		SPEX(alpha2[1], SSB_SPROM4_CCODE, 0x00ff, 0);
+ 		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
+ 		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
+ 		SPEX(boardflags2_lo, SSB_SPROM4_BFL2LO, 0xFFFF, 0);
+ 		SPEX(boardflags2_hi, SSB_SPROM4_BFL2HI, 0xFFFF, 0);
+ 	} else {
+-		SPEX(country_code, SSB_SPROM5_CCODE, 0xFFFF, 0);
++		SPEX(alpha2[0], SSB_SPROM5_CCODE, 0xff00, 8);
++		SPEX(alpha2[1], SSB_SPROM5_CCODE, 0x00ff, 0);
+ 		SPEX(boardflags_lo, SSB_SPROM5_BFLLO, 0xFFFF, 0);
+ 		SPEX(boardflags_hi, SSB_SPROM5_BFLHI, 0xFFFF, 0);
+ 		SPEX(boardflags2_lo, SSB_SPROM5_BFL2LO, 0xFFFF, 0);
+@@ -504,16 +513,14 @@ static void sprom_extract_r45(struct ssb
+ 	}
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN0, SSB_SPROM4_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM4_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM4_AGAIN01,
+ 	     SSB_SPROM4_AGAIN1, SSB_SPROM4_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN2, SSB_SPROM4_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM4_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM4_AGAIN23,
+ 	     SSB_SPROM4_AGAIN3, SSB_SPROM4_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
+ 
+ 	sprom_extract_r458(out, in);
+ 
+@@ -523,14 +530,22 @@ static void sprom_extract_r45(struct ssb
+ static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
+ {
+ 	int i;
+-	u16 v;
++	u16 v, o;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(out->core_pwr_info));
+ 
+ 	/* extract the MAC address */
+ 	for (i = 0; i < 3; i++) {
+ 		v = in[SPOFF(SSB_SPROM8_IL0MAC) + i];
+ 		*(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
+ 	}
+-	SPEX(country_code, SSB_SPROM8_CCODE, 0xFFFF, 0);
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, 0xFFFF, 0);
++	SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
++	SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
+ 	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, 0xFFFF, 0);
+ 	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, 0xFFFF, 0);
+ 	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, 0xFFFF, 0);
+@@ -596,16 +611,46 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
+ 
+ 	/* Extract the antenna gain values. */
+-	SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
+-	SPEX(antenna_gain.ghz24.a1, SSB_SPROM8_AGAIN01,
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
+ 	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
+-	SPEX(antenna_gain.ghz24.a2, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
+-	SPEX(antenna_gain.ghz24.a3, SSB_SPROM8_AGAIN23,
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
+ 	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
+-	memcpy(&out->antenna_gain.ghz5, &out->antenna_gain.ghz24,
+-	       sizeof(out->antenna_gain.ghz5));
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
+ 
+ 	/* Extract FEM info */
+ 	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G,
+@@ -630,6 +675,63 @@ static void sprom_extract_r8(struct ssb_
+ 	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
+ 		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+ 
++	SPEX(leddc_on_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_ON,
++	     SSB_SPROM8_LEDDC_ON_SHIFT);
++	SPEX(leddc_off_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_OFF,
++	     SSB_SPROM8_LEDDC_OFF_SHIFT);
++
++	SPEX(txchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN,
++	     SSB_SPROM8_TXRXC_TXCHAIN_SHIFT);
++	SPEX(rxchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN,
++	     SSB_SPROM8_TXRXC_RXCHAIN_SHIFT);
++	SPEX(antswitch, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_SWITCH,
++	     SSB_SPROM8_TXRXC_SWITCH_SHIFT);
++
++	SPEX(opo, SSB_SPROM8_OFDM2GPO, 0x00ff, 0);
++
++	SPEX_ARRAY8(mcs2gpo, SSB_SPROM8_2G_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5gpo, SSB_SPROM8_5G_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5glpo, SSB_SPROM8_5GL_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5ghpo, SSB_SPROM8_5GH_MCSPO, ~0, 0);
++
++	SPEX(rawtempsense, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP,
++	     SSB_SPROM8_RAWTS_RAWTEMP_SHIFT);
++	SPEX(measpower, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER,
++	     SSB_SPROM8_RAWTS_MEASPOWER_SHIFT);
++	SPEX(tempsense_slope, SSB_SPROM8_OPT_CORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE,
++	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT);
++	SPEX(tempcorrx, SSB_SPROM8_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT);
++	SPEX(tempsense_option, SSB_SPROM8_OPT_CORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION,
++	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT);
++	SPEX(freqoffset_corr, SSB_SPROM8_HWIQ_IQSWP,
++	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR,
++	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT);
++	SPEX(iqcal_swp_dis, SSB_SPROM8_HWIQ_IQSWP,
++	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP,
++	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT);
++	SPEX(hw_iqcal_en, SSB_SPROM8_HWIQ_IQSWP, SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL,
++	     SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT);
++
++	SPEX(bw40po, SSB_SPROM8_BW40PO, ~0, 0);
++	SPEX(cddpo, SSB_SPROM8_CDDPO, ~0, 0);
++	SPEX(stbcpo, SSB_SPROM8_STBCPO, ~0, 0);
++	SPEX(bwduppo, SSB_SPROM8_BWDUPPO, ~0, 0);
++
++	SPEX(tempthresh, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_TRESH,
++	     SSB_SPROM8_THERMAL_TRESH_SHIFT);
++	SPEX(tempoffset, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_OFFSET,
++	     SSB_SPROM8_THERMAL_OFFSET_SHIFT);
++	SPEX(phycal_tempdelta, SSB_SPROM8_TEMPDELTA,
++	     SSB_SPROM8_TEMPDELTA_PHYCAL,
++	     SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT);
++	SPEX(temps_period, SSB_SPROM8_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD,
++	     SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT);
++	SPEX(temps_hysteresis, SSB_SPROM8_TEMPDELTA,
++	     SSB_SPROM8_TEMPDELTA_HYSTERESIS,
++	     SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);
+ 	sprom_extract_r458(out, in);
+ 
+ 	/* TODO - get remaining rev 8 stuff needed */
+@@ -759,7 +861,6 @@ static void ssb_pci_get_boardinfo(struct
+ {
+ 	bi->vendor = bus->host_pci->subsystem_vendor;
+ 	bi->type = bus->host_pci->subsystem_device;
+-	bi->rev = bus->host_pci->revision;
+ }
+ 
+ int ssb_pci_get_invariants(struct ssb_bus *bus,
+--- a/drivers/ssb/pcmcia.c
++++ b/drivers/ssb/pcmcia.c
+@@ -676,14 +676,10 @@ static int ssb_pcmcia_do_get_invariants(
+ 	case SSB_PCMCIA_CIS_ANTGAIN:
+ 		GOTO_ERROR_ON(tuple->TupleDataLen != 2,
+ 			"antg tpl size");
+-		sprom->antenna_gain.ghz24.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz24.a3 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a0 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a1 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a2 = tuple->TupleData[1];
+-		sprom->antenna_gain.ghz5.a3 = tuple->TupleData[1];
++		sprom->antenna_gain.a0 = tuple->TupleData[1];
++		sprom->antenna_gain.a1 = tuple->TupleData[1];
++		sprom->antenna_gain.a2 = tuple->TupleData[1];
++		sprom->antenna_gain.a3 = tuple->TupleData[1];
+ 		break;
+ 	case SSB_PCMCIA_CIS_BFLAGS:
+ 		GOTO_ERROR_ON((tuple->TupleDataLen != 3) &&
+--- a/drivers/ssb/scan.c
++++ b/drivers/ssb/scan.c
+@@ -90,6 +90,8 @@ const char *ssb_core_name(u16 coreid)
+ 		return "ARM 1176";
+ 	case SSB_DEV_ARM_7TDMI:
+ 		return "ARM 7TDMI";
++	case SSB_DEV_ARM_CM3:
++		return "ARM Cortex M3";
+ 	}
+ 	return "UNKNOWN";
+ }
+@@ -318,6 +320,9 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ 			bus->chip_package = 0;
+ 		}
+ 	}
++	ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
++		   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
++		   bus->chip_package);
+ 	if (!bus->nr_devices)
+ 		bus->nr_devices = chipid_to_nrcores(bus->chip_id);
+ 	if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+--- a/drivers/ssb/sdio.c
++++ b/drivers/ssb/sdio.c
+@@ -551,14 +551,10 @@ int ssb_sdio_get_invariants(struct ssb_b
+ 			case SSB_SDIO_CIS_ANTGAIN:
+ 				GOTO_ERROR_ON(tuple->size != 2,
+ 					      "antg tpl size");
+-				sprom->antenna_gain.ghz24.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz24.a3 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a0 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a1 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a2 = tuple->data[1];
+-				sprom->antenna_gain.ghz5.a3 = tuple->data[1];
++				sprom->antenna_gain.a0 = tuple->data[1];
++				sprom->antenna_gain.a1 = tuple->data[1];
++				sprom->antenna_gain.a2 = tuple->data[1];
++				sprom->antenna_gain.a3 = tuple->data[1];
+ 				break;
+ 			case SSB_SDIO_CIS_BFLAGS:
+ 				GOTO_ERROR_ON((tuple->size != 3) &&
+--- a/drivers/ssb/ssb_private.h
++++ b/drivers/ssb/ssb_private.h
+@@ -3,6 +3,7 @@
+ 
+ #include <linux/ssb/ssb.h>
+ #include <linux/types.h>
++#include <linux/bcm47xx_wdt.h>
+ 
+ 
+ #define PFX	"ssb: "
+@@ -207,4 +208,66 @@ static inline void b43_pci_ssb_bridge_ex
+ }
+ #endif /* CONFIG_SSB_B43_PCI_BRIDGE */
+ 
++/* driver_chipcommon_pmu.c */
++extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
++extern u32 ssb_pmu_get_alp_clock(struct ssb_chipcommon *cc);
++
++extern u32 ssb_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
++					     u32 ticks);
++extern u32 ssb_chipco_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms);
++
++/* driver_chipcommon_sflash.c */
++#ifdef CONFIG_SSB_SFLASH
++int ssb_sflash_init(struct ssb_chipcommon *cc);
++#else
++static inline int ssb_sflash_init(struct ssb_chipcommon *cc)
++{
++	pr_err("Serial flash not supported\n");
++	return 0;
++}
++#endif /* CONFIG_SSB_SFLASH */
++
++#ifdef CONFIG_SSB_DRIVER_EXTIF
++extern u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks);
++extern u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms);
++#else
++static inline u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
++						   u32 ticks)
++{
++	return 0;
++}
++static inline u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt,
++						  u32 ms)
++{
++	return 0;
++}
++#endif
++
++#ifdef CONFIG_SSB_EMBEDDED
++extern int ssb_watchdog_register(struct ssb_bus *bus);
++#else /* CONFIG_SSB_EMBEDDED */
++static inline int ssb_watchdog_register(struct ssb_bus *bus)
++{
++	return 0;
++}
++#endif /* CONFIG_SSB_EMBEDDED */
++
++#ifdef CONFIG_SSB_DRIVER_EXTIF
++extern void ssb_extif_init(struct ssb_extif *extif);
++#else
++static inline void ssb_extif_init(struct ssb_extif *extif)
++{
++}
++#endif
++
++#ifdef CONFIG_SSB_DRIVER_GPIO
++extern int ssb_gpio_init(struct ssb_bus *bus);
++#else /* CONFIG_SSB_DRIVER_GPIO */
++static inline int ssb_gpio_init(struct ssb_bus *bus)
++{
++	return -ENOTSUPP;
++}
++#endif /* CONFIG_SSB_DRIVER_GPIO */
++
+ #endif /* LINUX_SSB_PRIVATE_H_ */
+--- a/include/linux/ssb/ssb.h
++++ b/include/linux/ssb/ssb.h
+@@ -6,8 +6,10 @@
+ #include <linux/types.h>
+ #include <linux/spinlock.h>
+ #include <linux/pci.h>
++#include <linux/gpio.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/dma-mapping.h>
++#include <linux/platform_device.h>
+ 
+ #include <linux/ssb/ssb_regs.h>
+ 
+@@ -16,6 +18,12 @@ struct pcmcia_device;
+ struct ssb_bus;
+ struct ssb_driver;
+ 
++struct ssb_sprom_core_pwr_info {
++	u8 itssi_2g, itssi_5g;
++	u8 maxpwr_2g, maxpwr_5gl, maxpwr_5g, maxpwr_5gh;
++	u16 pa_2g[4], pa_5gl[4], pa_5g[4], pa_5gh[4];
++};
++
+ struct ssb_sprom {
+ 	u8 revision;
+ 	u8 il0mac[6];		/* MAC address for 802.11b/g */
+@@ -26,9 +34,12 @@ struct ssb_sprom {
+ 	u8 et0mdcport;		/* MDIO for enet0 */
+ 	u8 et1mdcport;		/* MDIO for enet1 */
+ 	u16 board_rev;		/* Board revision number from SPROM. */
++	u16 board_num;		/* Board number from SPROM. */
++	u16 board_type;		/* Board type from SPROM. */
+ 	u8 country_code;	/* Country Code */
+-	u16 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
+-	u16 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
++	char alpha2[2];		/* Country Code as two chars like EU or US */
++	u8 leddc_on_time;	/* LED Powersave Duty Cycle On Count */
++	u8 leddc_off_time;	/* LED Powersave Duty Cycle Off Count */
+ 	u8 ant_available_a;	/* 2GHz antenna available bits (up to 4) */
+ 	u8 ant_available_bg;	/* 5GHz antenna available bits (up to 4) */
+ 	u16 pa0b0;
+@@ -47,10 +58,10 @@ struct ssb_sprom {
+ 	u8 gpio1;		/* GPIO pin 1 */
+ 	u8 gpio2;		/* GPIO pin 2 */
+ 	u8 gpio3;		/* GPIO pin 3 */
+-	u16 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+-	u16 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_bg;		/* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_al;		/* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_a;		/* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
++	u8 maxpwr_ah;		/* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
+ 	u8 itssi_a;		/* Idle TSSI Target for A-PHY */
+ 	u8 itssi_bg;		/* Idle TSSI Target for B/G-PHY */
+ 	u8 tri2g;		/* 2.4GHz TX isolation */
+@@ -61,8 +72,8 @@ struct ssb_sprom {
+ 	u8 txpid5gl[4];		/* 4.9 - 5.1GHz TX power index */
+ 	u8 txpid5g[4];		/* 5.1 - 5.5GHz TX power index */
+ 	u8 txpid5gh[4];		/* 5.5 - ...GHz TX power index */
+-	u8 rxpo2g;		/* 2GHz RX power offset */
+-	u8 rxpo5g;		/* 5GHz RX power offset */
++	s8 rxpo2g;		/* 2GHz RX power offset */
++	s8 rxpo5g;		/* 5GHz RX power offset */
+ 	u8 rssisav2g;		/* 2GHz RSSI params */
+ 	u8 rssismc2g;
+ 	u8 rssismf2g;
+@@ -82,16 +93,13 @@ struct ssb_sprom {
+ 	u16 boardflags2_hi;	/* Board flags (bits 48-63) */
+ 	/* TODO store board flags in a single u64 */
+ 
++	struct ssb_sprom_core_pwr_info core_pwr_info[4];
++
+ 	/* Antenna gain values for up to 4 antennas
+ 	 * on each band. Values in dBm/4 (Q5.2). Negative gain means the
+ 	 * loss in the connectors is bigger than the gain. */
+ 	struct {
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz24;	/* 2.4GHz band */
+-		struct {
+-			s8 a0, a1, a2, a3;
+-		} ghz5;		/* 5GHz band */
++		s8 a0, a1, a2, a3;
+ 	} antenna_gain;
+ 
+ 	struct {
+@@ -103,14 +111,85 @@ struct ssb_sprom {
+ 		} ghz5;
+ 	} fem;
+ 
+-	/* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
++	u16 mcs2gpo[8];
++	u16 mcs5gpo[8];
++	u16 mcs5glpo[8];
++	u16 mcs5ghpo[8];
++	u8 opo;
++
++	u8 rxgainerr2ga[3];
++	u8 rxgainerr5gla[3];
++	u8 rxgainerr5gma[3];
++	u8 rxgainerr5gha[3];
++	u8 rxgainerr5gua[3];
++
++	u8 noiselvl2ga[3];
++	u8 noiselvl5gla[3];
++	u8 noiselvl5gma[3];
++	u8 noiselvl5gha[3];
++	u8 noiselvl5gua[3];
++
++	u8 regrev;
++	u8 txchain;
++	u8 rxchain;
++	u8 antswitch;
++	u16 cddpo;
++	u16 stbcpo;
++	u16 bw40po;
++	u16 bwduppo;
++
++	u8 tempthresh;
++	u8 tempoffset;
++	u16 rawtempsense;
++	u8 measpower;
++	u8 tempsense_slope;
++	u8 tempcorrx;
++	u8 tempsense_option;
++	u8 freqoffset_corr;
++	u8 iqcal_swp_dis;
++	u8 hw_iqcal_en;
++	u8 elna2g;
++	u8 elna5g;
++	u8 phycal_tempdelta;
++	u8 temps_period;
++	u8 temps_hysteresis;
++	u8 measpower1;
++	u8 measpower2;
++	u8 pcieingress_war;
++
++	/* power per rate from sromrev 9 */
++	u16 cckbw202gpo;
++	u16 cckbw20ul2gpo;
++	u32 legofdmbw202gpo;
++	u32 legofdmbw20ul2gpo;
++	u32 legofdmbw205glpo;
++	u32 legofdmbw20ul5glpo;
++	u32 legofdmbw205gmpo;
++	u32 legofdmbw20ul5gmpo;
++	u32 legofdmbw205ghpo;
++	u32 legofdmbw20ul5ghpo;
++	u32 mcsbw202gpo;
++	u32 mcsbw20ul2gpo;
++	u32 mcsbw402gpo;
++	u32 mcsbw205glpo;
++	u32 mcsbw20ul5glpo;
++	u32 mcsbw405glpo;
++	u32 mcsbw205gmpo;
++	u32 mcsbw20ul5gmpo;
++	u32 mcsbw405gmpo;
++	u32 mcsbw205ghpo;
++	u32 mcsbw20ul5ghpo;
++	u32 mcsbw405ghpo;
++	u16 mcs32po;
++	u16 legofdm40duppo;
++	u8 sar2g;
++	u8 sar5g;
+ };
+ 
+ /* Information about the PCB the circuitry is soldered on. */
+ struct ssb_boardinfo {
+ 	u16 vendor;
+ 	u16 type;
+-	u8  rev;
+ };
+ 
+ 
+@@ -166,6 +245,7 @@ struct ssb_bus_ops {
+ #define SSB_DEV_MINI_MACPHY	0x823
+ #define SSB_DEV_ARM_1176	0x824
+ #define SSB_DEV_ARM_7TDMI	0x825
++#define SSB_DEV_ARM_CM3		0x82A
+ 
+ /* Vendor-ID values */
+ #define SSB_VENDOR_BROADCOM	0x4243
+@@ -354,7 +434,11 @@ struct ssb_bus {
+ #ifdef CONFIG_SSB_EMBEDDED
+ 	/* Lock for GPIO register access. */
+ 	spinlock_t gpio_lock;
++	struct platform_device *watchdog;
+ #endif /* EMBEDDED */
++#ifdef CONFIG_SSB_DRIVER_GPIO
++	struct gpio_chip gpio;
++#endif /* DRIVER_GPIO */
+ 
+ 	/* Internal-only stuff follows. Do not touch. */
+ 	struct list_head list;
+--- a/include/linux/ssb/ssb_driver_chipcommon.h
++++ b/include/linux/ssb/ssb_driver_chipcommon.h
+@@ -504,7 +504,9 @@
+ #define SSB_CHIPCO_FLASHCTL_ST_SE	0x02D8		/* Sector Erase */
+ #define SSB_CHIPCO_FLASHCTL_ST_BE	0x00C7		/* Bulk Erase */
+ #define SSB_CHIPCO_FLASHCTL_ST_DP	0x00B9		/* Deep Power-down */
+-#define SSB_CHIPCO_FLASHCTL_ST_RSIG	0x03AB		/* Read Electronic Signature */
++#define SSB_CHIPCO_FLASHCTL_ST_RES	0x03AB		/* Read Electronic Signature */
++#define SSB_CHIPCO_FLASHCTL_ST_CSA	0x1000		/* Keep chip select asserted */
++#define SSB_CHIPCO_FLASHCTL_ST_SSE	0x0220		/* Sub-sector Erase */
+ 
+ /* Status register bits for ST flashes */
+ #define SSB_CHIPCO_FLASHSTA_ST_WIP	0x01		/* Write In Progress */
+@@ -588,7 +590,10 @@ struct ssb_chipcommon {
+ 	u32 status;
+ 	/* Fast Powerup Delay constant */
+ 	u16 fast_pwrup_delay;
++	spinlock_t gpio_lock;
+ 	struct ssb_chipcommon_pmu pmu;
++	u32 ticks_per_ms;
++	u32 max_timer_ms;
+ };
+ 
+ static inline bool ssb_chipco_available(struct ssb_chipcommon *cc)
+@@ -628,8 +633,7 @@ enum ssb_clkmode {
+ extern void ssb_chipco_set_clockmode(struct ssb_chipcommon *cc,
+ 				     enum ssb_clkmode mode);
+ 
+-extern void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc,
+-					  u32 ticks);
++extern u32 ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks);
+ 
+ void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value);
+ 
+@@ -642,6 +646,8 @@ u32 ssb_chipco_gpio_outen(struct ssb_chi
+ u32 ssb_chipco_gpio_control(struct ssb_chipcommon *cc, u32 mask, u32 value);
+ u32 ssb_chipco_gpio_intmask(struct ssb_chipcommon *cc, u32 mask, u32 value);
+ u32 ssb_chipco_gpio_polarity(struct ssb_chipcommon *cc, u32 mask, u32 value);
++u32 ssb_chipco_gpio_pullup(struct ssb_chipcommon *cc, u32 mask, u32 value);
++u32 ssb_chipco_gpio_pulldown(struct ssb_chipcommon *cc, u32 mask, u32 value);
+ 
+ #ifdef CONFIG_SSB_SERIAL
+ extern int ssb_chipco_serial_init(struct ssb_chipcommon *cc,
+--- a/include/linux/ssb/ssb_driver_extif.h
++++ b/include/linux/ssb/ssb_driver_extif.h
+@@ -152,12 +152,16 @@
+ /* watchdog */
+ #define SSB_EXTIF_WATCHDOG_CLK		48000000	/* Hz */
+ 
++#define SSB_EXTIF_WATCHDOG_MAX_TIMER	((1 << 28) - 1)
++#define SSB_EXTIF_WATCHDOG_MAX_TIMER_MS	(SSB_EXTIF_WATCHDOG_MAX_TIMER \
++					 / (SSB_EXTIF_WATCHDOG_CLK / 1000))
+ 
+ 
+ #ifdef CONFIG_SSB_DRIVER_EXTIF
+ 
+ struct ssb_extif {
+ 	struct ssb_device *dev;
++	spinlock_t gpio_lock;
+ };
+ 
+ static inline bool ssb_extif_available(struct ssb_extif *extif)
+@@ -171,8 +175,7 @@ extern void ssb_extif_get_clockcontrol(s
+ extern void ssb_extif_timing_init(struct ssb_extif *extif,
+ 				  unsigned long ns);
+ 
+-extern void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
+-					 u32 ticks);
++extern u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks);
+ 
+ /* Extif GPIO pin access */
+ u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask);
+@@ -205,10 +208,52 @@ void ssb_extif_get_clockcontrol(struct s
+ }
+ 
+ static inline
+-void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
+-				  u32 ticks)
++void ssb_extif_timing_init(struct ssb_extif *extif, unsigned long ns)
+ {
+ }
+ 
++static inline
++u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_out(struct ssb_extif *extif, u32 mask,
++				     u32 value)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_outen(struct ssb_extif *extif, u32 mask,
++				       u32 value)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_polarity(struct ssb_extif *extif, u32 mask,
++					  u32 value)
++{
++	return 0;
++}
++
++static inline u32 ssb_extif_gpio_intmask(struct ssb_extif *extif, u32 mask,
++					 u32 value)
++{
++	return 0;
++}
++
++#ifdef CONFIG_SSB_SERIAL
++static inline int ssb_extif_serial_init(struct ssb_extif *extif,
++					struct ssb_serial_port *ports)
++{
++	return 0;
++}
++#endif /* CONFIG_SSB_SERIAL */
++
+ #endif /* CONFIG_SSB_DRIVER_EXTIF */
+ #endif /* LINUX_SSB_EXTIFCORE_H_ */
+--- a/include/linux/ssb/ssb_driver_gige.h
++++ b/include/linux/ssb/ssb_driver_gige.h
+@@ -2,6 +2,7 @@
+ #define LINUX_SSB_DRIVER_GIGE_H_
+ 
+ #include <linux/ssb/ssb.h>
++#include <linux/bug.h>
+ #include <linux/pci.h>
+ #include <linux/spinlock.h>
+ 
+--- a/include/linux/ssb/ssb_driver_mips.h
++++ b/include/linux/ssb/ssb_driver_mips.h
+@@ -13,6 +13,12 @@ struct ssb_serial_port {
+ 	unsigned int reg_shift;
+ };
+ 
++struct ssb_pflash {
++	bool present;
++	u8 buswidth;
++	u32 window;
++	u32 window_size;
++};
+ 
+ struct ssb_mipscore {
+ 	struct ssb_device *dev;
+@@ -20,9 +26,7 @@ struct ssb_mipscore {
+ 	int nr_serial_ports;
+ 	struct ssb_serial_port serial_ports[4];
+ 
+-	u8 flash_buswidth;
+-	u32 flash_window;
+-	u32 flash_window_size;
++	struct ssb_pflash pflash;
+ };
+ 
+ extern void ssb_mipscore_init(struct ssb_mipscore *mcore);
+--- a/include/linux/ssb/ssb_regs.h
++++ b/include/linux/ssb/ssb_regs.h
+@@ -228,6 +228,7 @@
+ #define  SSB_SPROM1_AGAIN_BG_SHIFT	0
+ #define  SSB_SPROM1_AGAIN_A		0xFF00	/* A-PHY */
+ #define  SSB_SPROM1_AGAIN_A_SHIFT	8
++#define SSB_SPROM1_CCODE		0x0076
+ 
+ /* SPROM Revision 2 (inherits from rev 1) */
+ #define SSB_SPROM2_BFLHI		0x0038	/* Boardflags (high 16 bits) */
+@@ -267,6 +268,7 @@
+ #define  SSB_SPROM3_OFDMGPO		0x107A	/* G-PHY OFDM Power Offset (4 bytes, BigEndian) */
+ 
+ /* SPROM Revision 4 */
++#define SSB_SPROM4_BOARDREV		0x0042	/* Board revision */
+ #define SSB_SPROM4_BFLLO		0x0044	/* Boardflags (low 16 bits) */
+ #define SSB_SPROM4_BFLHI		0x0046  /* Board Flags Hi */
+ #define SSB_SPROM4_BFL2LO		0x0048	/* Board flags 2 (low 16 bits) */
+@@ -389,6 +391,11 @@
+ #define  SSB_SPROM8_GPIOB_P2		0x00FF	/* Pin 2 */
+ #define  SSB_SPROM8_GPIOB_P3		0xFF00	/* Pin 3 */
+ #define  SSB_SPROM8_GPIOB_P3_SHIFT	8
++#define SSB_SPROM8_LEDDC		0x009A
++#define  SSB_SPROM8_LEDDC_ON		0xFF00	/* oncount */
++#define  SSB_SPROM8_LEDDC_ON_SHIFT	8
++#define  SSB_SPROM8_LEDDC_OFF		0x00FF	/* offcount */
++#define  SSB_SPROM8_LEDDC_OFF_SHIFT	0
+ #define SSB_SPROM8_ANTAVAIL		0x009C  /* Antenna available bitfields*/
+ #define  SSB_SPROM8_ANTAVAIL_A		0xFF00	/* A-PHY bitfield */
+ #define  SSB_SPROM8_ANTAVAIL_A_SHIFT	8
+@@ -404,6 +411,13 @@
+ #define  SSB_SPROM8_AGAIN2_SHIFT	0
+ #define  SSB_SPROM8_AGAIN3		0xFF00	/* Antenna 3 */
+ #define  SSB_SPROM8_AGAIN3_SHIFT	8
++#define SSB_SPROM8_TXRXC		0x00A2
++#define  SSB_SPROM8_TXRXC_TXCHAIN	0x000f
++#define  SSB_SPROM8_TXRXC_TXCHAIN_SHIFT	0
++#define  SSB_SPROM8_TXRXC_RXCHAIN	0x00f0
++#define  SSB_SPROM8_TXRXC_RXCHAIN_SHIFT	4
++#define  SSB_SPROM8_TXRXC_SWITCH	0xff00
++#define  SSB_SPROM8_TXRXC_SWITCH_SHIFT	8
+ #define SSB_SPROM8_RSSIPARM2G		0x00A4	/* RSSI params for 2GHz */
+ #define  SSB_SPROM8_RSSISMF2G		0x000F
+ #define  SSB_SPROM8_RSSISMC2G		0x00F0
+@@ -430,6 +444,7 @@
+ #define  SSB_SPROM8_TRI5GH_SHIFT	8
+ #define SSB_SPROM8_RXPO			0x00AC  /* RX power offsets */
+ #define  SSB_SPROM8_RXPO2G		0x00FF	/* 2GHz RX power offset */
++#define  SSB_SPROM8_RXPO2G_SHIFT	0
+ #define  SSB_SPROM8_RXPO5G		0xFF00	/* 5GHz RX power offset */
+ #define  SSB_SPROM8_RXPO5G_SHIFT	8
+ #define SSB_SPROM8_FEM2G		0x00AE
+@@ -445,10 +460,71 @@
+ #define  SSB_SROM8_FEM_ANTSWLUT		0xF800
+ #define  SSB_SROM8_FEM_ANTSWLUT_SHIFT	11
+ #define SSB_SPROM8_THERMAL		0x00B2
+-#define SSB_SPROM8_MPWR_RAWTS		0x00B4
+-#define SSB_SPROM8_TS_SLP_OPT_CORRX	0x00B6
+-#define SSB_SPROM8_FOC_HWIQ_IQSWP	0x00B8
+-#define SSB_SPROM8_PHYCAL_TEMPDELTA	0x00BA
++#define  SSB_SPROM8_THERMAL_OFFSET	0x00ff
++#define  SSB_SPROM8_THERMAL_OFFSET_SHIFT	0
++#define  SSB_SPROM8_THERMAL_TRESH	0xff00
++#define  SSB_SPROM8_THERMAL_TRESH_SHIFT	8
++/* Temp sense related entries */
++#define SSB_SPROM8_RAWTS		0x00B4
++#define  SSB_SPROM8_RAWTS_RAWTEMP	0x01ff
++#define  SSB_SPROM8_RAWTS_RAWTEMP_SHIFT	0
++#define  SSB_SPROM8_RAWTS_MEASPOWER	0xfe00
++#define  SSB_SPROM8_RAWTS_MEASPOWER_SHIFT	9
++#define SSB_SPROM8_OPT_CORRX		0x00B6
++#define  SSB_SPROM8_OPT_CORRX_TEMP_SLOPE	0x00ff
++#define  SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT	0
++#define  SSB_SPROM8_OPT_CORRX_TEMPCORRX	0xfc00
++#define  SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT	10
++#define  SSB_SPROM8_OPT_CORRX_TEMP_OPTION	0x0300
++#define  SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT	8
++/* FOC: freiquency offset correction, HWIQ: H/W IOCAL enable, IQSWP: IQ CAL swap disable */
++#define SSB_SPROM8_HWIQ_IQSWP		0x00B8
++#define  SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR	0x000f
++#define  SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT	0
++#define  SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP	0x0010
++#define  SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT	4
++#define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL	0x0020
++#define  SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT	5
++#define SSB_SPROM8_TEMPDELTA		0x00BC
++#define  SSB_SPROM8_TEMPDELTA_PHYCAL	0x00ff
++#define  SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT	0
++#define  SSB_SPROM8_TEMPDELTA_PERIOD	0x0f00
++#define  SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT	8
++#define  SSB_SPROM8_TEMPDELTA_HYSTERESIS	0xf000
++#define  SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT	12
++
++/* There are 4 blocks with power info sharing the same layout */
++#define SSB_SROM8_PWR_INFO_CORE0	0x00C0
++#define SSB_SROM8_PWR_INFO_CORE1	0x00E0
++#define SSB_SROM8_PWR_INFO_CORE2	0x0100
++#define SSB_SROM8_PWR_INFO_CORE3	0x0120
++
++#define SSB_SROM8_2G_MAXP_ITSSI		0x00
++#define  SSB_SPROM8_2G_MAXP		0x00FF
++#define  SSB_SPROM8_2G_ITSSI		0xFF00
++#define  SSB_SPROM8_2G_ITSSI_SHIFT	8
++#define SSB_SROM8_2G_PA_0		0x02	/* 2GHz power amp settings */
++#define SSB_SROM8_2G_PA_1		0x04
++#define SSB_SROM8_2G_PA_2		0x06
++#define SSB_SROM8_5G_MAXP_ITSSI		0x08	/* 5GHz ITSSI and 5.3GHz Max Power */
++#define  SSB_SPROM8_5G_MAXP		0x00FF
++#define  SSB_SPROM8_5G_ITSSI		0xFF00
++#define  SSB_SPROM8_5G_ITSSI_SHIFT	8
++#define SSB_SPROM8_5GHL_MAXP		0x0A	/* 5.2GHz and 5.8GHz Max Power */
++#define  SSB_SPROM8_5GH_MAXP		0x00FF
++#define  SSB_SPROM8_5GL_MAXP		0xFF00
++#define  SSB_SPROM8_5GL_MAXP_SHIFT	8
++#define SSB_SROM8_5G_PA_0		0x0C	/* 5.3GHz power amp settings */
++#define SSB_SROM8_5G_PA_1		0x0E
++#define SSB_SROM8_5G_PA_2		0x10
++#define SSB_SROM8_5GL_PA_0		0x12	/* 5.2GHz power amp settings */
++#define SSB_SROM8_5GL_PA_1		0x14
++#define SSB_SROM8_5GL_PA_2		0x16
++#define SSB_SROM8_5GH_PA_0		0x18	/* 5.8GHz power amp settings */
++#define SSB_SROM8_5GH_PA_1		0x1A
++#define SSB_SROM8_5GH_PA_2		0x1C
++
++/* TODO: Make it deprecated */
+ #define SSB_SPROM8_MAXP_BG		0x00C0  /* Max Power 2GHz in path 1 */
+ #define  SSB_SPROM8_MAXP_BG_MASK	0x00FF  /* Mask for Max Power 2GHz */
+ #define  SSB_SPROM8_ITSSI_BG		0xFF00	/* Mask for path 1 itssi_bg */
+@@ -473,12 +549,23 @@
+ #define SSB_SPROM8_PA1HIB0		0x00D8	/* 5.8GHz power amp settings */
+ #define SSB_SPROM8_PA1HIB1		0x00DA
+ #define SSB_SPROM8_PA1HIB2		0x00DC
++
+ #define SSB_SPROM8_CCK2GPO		0x0140	/* CCK power offset */
+ #define SSB_SPROM8_OFDM2GPO		0x0142	/* 2.4GHz OFDM power offset */
+ #define SSB_SPROM8_OFDM5GPO		0x0146	/* 5.3GHz OFDM power offset */
+ #define SSB_SPROM8_OFDM5GLPO		0x014A	/* 5.2GHz OFDM power offset */
+ #define SSB_SPROM8_OFDM5GHPO		0x014E	/* 5.8GHz OFDM power offset */
+ 
++#define SSB_SPROM8_2G_MCSPO		0x0152
++#define SSB_SPROM8_5G_MCSPO		0x0162
++#define SSB_SPROM8_5GL_MCSPO		0x0172
++#define SSB_SPROM8_5GH_MCSPO		0x0182
++
++#define SSB_SPROM8_CDDPO		0x0192
++#define SSB_SPROM8_STBCPO		0x0194
++#define SSB_SPROM8_BW40PO		0x0196
++#define SSB_SPROM8_BWDUPPO		0x0198
++
+ /* Values for boardflags_lo read from SPROM */
+ #define SSB_BFL_BTCOEXIST		0x0001	/* implements Bluetooth coexistance */
+ #define SSB_BFL_PACTRL			0x0002	/* GPIO 9 controlling the PA */
+--- /dev/null
++++ b/include/linux/bcm47xx_wdt.h
+@@ -0,0 +1,19 @@
++#ifndef LINUX_BCM47XX_WDT_H_
++#define LINUX_BCM47XX_WDT_H_
++
++#include <linux/types.h>
++
++
++struct bcm47xx_wdt {
++	u32 (*timer_set)(struct bcm47xx_wdt *, u32);
++	u32 (*timer_set_ms)(struct bcm47xx_wdt *, u32);
++	u32 max_timer_ms;
++
++	void *driver_data;
++};
++
++static inline void *bcm47xx_wdt_get_drvdata(struct bcm47xx_wdt *wdt)
++{
++	return wdt->driver_data;
++}
++#endif /* LINUX_BCM47XX_WDT_H_ */
diff --git a/target/linux/generic/patches-3.3/025-bcma_backport.patch b/target/linux/generic/patches-3.3/025-bcma_backport.patch
new file mode 100644
index 0000000..a00bec3
--- /dev/null
+++ b/target/linux/generic/patches-3.3/025-bcma_backport.patch
@@ -0,0 +1,4901 @@
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -29,7 +29,7 @@ config BCMA_HOST_PCI
+ 
+ config BCMA_DRIVER_PCI_HOSTMODE
+ 	bool "Driver for PCI core working in hostmode"
+-	depends on BCMA && MIPS
++	depends on BCMA && MIPS && BCMA_HOST_PCI
+ 	help
+ 	  PCI core hostmode operation (external PCI bus).
+ 
+@@ -46,6 +46,33 @@ config BCMA_DRIVER_MIPS
+ 
+ 	  If unsure, say N
+ 
++config BCMA_SFLASH
++	bool
++	depends on BCMA_DRIVER_MIPS
++	default y
++
++config BCMA_NFLASH
++	bool
++	depends on BCMA_DRIVER_MIPS
++	default y
++
++config BCMA_DRIVER_GMAC_CMN
++	bool "BCMA Broadcom GBIT MAC COMMON core driver"
++	depends on BCMA
++	help
++	  Driver for the Broadcom GBIT MAC COMMON core attached to Broadcom
++	  specific Advanced Microcontroller Bus.
++
++	  If unsure, say N
++
++config BCMA_DRIVER_GPIO
++	bool "BCMA GPIO driver"
++	depends on BCMA && GPIOLIB
++	help
++	  Driver to provide access to the GPIO pins of the bcma bus.
++
++	  If unsure, say N
++
+ config BCMA_DEBUG
+ 	bool "BCMA debugging"
+ 	depends on BCMA
+--- a/drivers/bcma/Makefile
++++ b/drivers/bcma/Makefile
+@@ -1,8 +1,12 @@
+ bcma-y					+= main.o scan.o core.o sprom.o
+ bcma-y					+= driver_chipcommon.o driver_chipcommon_pmu.o
++bcma-$(CONFIG_BCMA_SFLASH)		+= driver_chipcommon_sflash.o
++bcma-$(CONFIG_BCMA_NFLASH)		+= driver_chipcommon_nflash.o
+ bcma-y					+= driver_pci.o
+ bcma-$(CONFIG_BCMA_DRIVER_PCI_HOSTMODE)	+= driver_pci_host.o
+ bcma-$(CONFIG_BCMA_DRIVER_MIPS)		+= driver_mips.o
++bcma-$(CONFIG_BCMA_DRIVER_GMAC_CMN)	+= driver_gmac_cmn.o
++bcma-$(CONFIG_BCMA_DRIVER_GPIO)		+= driver_gpio.o
+ bcma-$(CONFIG_BCMA_HOST_PCI)		+= host_pci.o
+ bcma-$(CONFIG_BCMA_HOST_SOC)		+= host_soc.o
+ obj-$(CONFIG_BCMA)			+= bcma.o
+--- a/drivers/bcma/bcma_private.h
++++ b/drivers/bcma/bcma_private.h
+@@ -10,10 +10,19 @@
+ 
+ #define BCMA_CORE_SIZE		0x1000
+ 
++#define bcma_err(bus, fmt, ...) \
++	pr_err("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
++#define bcma_warn(bus, fmt, ...) \
++	pr_warn("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
++#define bcma_info(bus, fmt, ...) \
++	pr_info("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
++#define bcma_debug(bus, fmt, ...) \
++	pr_debug("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
++
+ struct bcma_bus;
+ 
+ /* main.c */
+-int bcma_bus_register(struct bcma_bus *bus);
++int __devinit bcma_bus_register(struct bcma_bus *bus);
+ void bcma_bus_unregister(struct bcma_bus *bus);
+ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ 				   struct bcma_device *core_cc,
+@@ -22,6 +31,8 @@ int __init bcma_bus_early_register(struc
+ int bcma_bus_suspend(struct bcma_bus *bus);
+ int bcma_bus_resume(struct bcma_bus *bus);
+ #endif
++struct bcma_device *bcma_find_core_unit(struct bcma_bus *bus, u16 coreid,
++					u8 unit);
+ 
+ /* scan.c */
+ int bcma_bus_scan(struct bcma_bus *bus);
+@@ -39,8 +50,32 @@ void bcma_chipco_serial_init(struct bcma
+ #endif /* CONFIG_BCMA_DRIVER_MIPS */
+ 
+ /* driver_chipcommon_pmu.c */
+-u32 bcma_pmu_alp_clock(struct bcma_drv_cc *cc);
+-u32 bcma_pmu_get_clockcpu(struct bcma_drv_cc *cc);
++u32 bcma_pmu_get_alp_clock(struct bcma_drv_cc *cc);
++u32 bcma_pmu_get_cpu_clock(struct bcma_drv_cc *cc);
++
++#ifdef CONFIG_BCMA_SFLASH
++/* driver_chipcommon_sflash.c */
++int bcma_sflash_init(struct bcma_drv_cc *cc);
++extern struct platform_device bcma_sflash_dev;
++#else
++static inline int bcma_sflash_init(struct bcma_drv_cc *cc)
++{
++	bcma_err(cc->core->bus, "Serial flash not supported\n");
++	return 0;
++}
++#endif /* CONFIG_BCMA_SFLASH */
++
++#ifdef CONFIG_BCMA_NFLASH
++/* driver_chipcommon_nflash.c */
++int bcma_nflash_init(struct bcma_drv_cc *cc);
++extern struct platform_device bcma_nflash_dev;
++#else
++static inline int bcma_nflash_init(struct bcma_drv_cc *cc)
++{
++	bcma_err(cc->core->bus, "NAND flash not supported\n");
++	return 0;
++}
++#endif /* CONFIG_BCMA_NFLASH */
+ 
+ #ifdef CONFIG_BCMA_HOST_PCI
+ /* host_pci.c */
+@@ -48,8 +83,24 @@ extern int __init bcma_host_pci_init(voi
+ extern void __exit bcma_host_pci_exit(void);
+ #endif /* CONFIG_BCMA_HOST_PCI */
+ 
++/* driver_pci.c */
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
++
++extern int bcma_chipco_watchdog_register(struct bcma_drv_cc *cc);
++
+ #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+ 
++#ifdef CONFIG_BCMA_DRIVER_GPIO
++/* driver_gpio.c */
++int bcma_gpio_init(struct bcma_drv_cc *cc);
++#else
++static inline int bcma_gpio_init(struct bcma_drv_cc *cc)
++{
++	return -ENOTSUPP;
++}
++#endif /* CONFIG_BCMA_DRIVER_GPIO */
++
+ #endif
+--- a/drivers/bcma/core.c
++++ b/drivers/bcma/core.c
+@@ -30,6 +30,7 @@ void bcma_core_disable(struct bcma_devic
+ 	udelay(10);
+ 
+ 	bcma_awrite32(core, BCMA_RESET_CTL, BCMA_RESET_CTL_RESET);
++	bcma_aread32(core, BCMA_RESET_CTL);
+ 	udelay(1);
+ }
+ EXPORT_SYMBOL_GPL(bcma_core_disable);
+@@ -64,7 +65,7 @@ void bcma_core_set_clockmode(struct bcma
+ 	switch (clkmode) {
+ 	case BCMA_CLKMODE_FAST:
+ 		bcma_set32(core, BCMA_CLKCTLST, BCMA_CLKCTLST_FORCEHT);
+-		udelay(64);
++		usleep_range(64, 300);
+ 		for (i = 0; i < 1500; i++) {
+ 			if (bcma_read32(core, BCMA_CLKCTLST) &
+ 			    BCMA_CLKCTLST_HAVEHT) {
+@@ -74,10 +75,10 @@ void bcma_core_set_clockmode(struct bcma
+ 			udelay(10);
+ 		}
+ 		if (i)
+-			pr_err("HT force timeout\n");
++			bcma_err(core->bus, "HT force timeout\n");
+ 		break;
+ 	case BCMA_CLKMODE_DYNAMIC:
+-		pr_warn("Dynamic clockmode not supported yet!\n");
++		bcma_set32(core, BCMA_CLKCTLST, ~BCMA_CLKCTLST_FORCEHT);
+ 		break;
+ 	}
+ }
+@@ -101,9 +102,9 @@ void bcma_core_pll_ctl(struct bcma_devic
+ 			udelay(10);
+ 		}
+ 		if (i)
+-			pr_err("PLL enable timeout\n");
++			bcma_err(core->bus, "PLL enable timeout\n");
+ 	} else {
+-		pr_warn("Disabling PLL not supported yet!\n");
++		bcma_warn(core->bus, "Disabling PLL not supported yet!\n");
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(bcma_core_pll_ctl);
+@@ -119,8 +120,8 @@ u32 bcma_core_dma_translation(struct bcm
+ 		else
+ 			return BCMA_DMA_TRANSLATION_DMA32_CMT;
+ 	default:
+-		pr_err("DMA translation unknown for host %d\n",
+-		       core->bus->hosttype);
++		bcma_err(core->bus, "DMA translation unknown for host %d\n",
++			 core->bus->hosttype);
+ 	}
+ 	return BCMA_DMA_TRANSLATION_NONE;
+ }
+--- a/drivers/bcma/driver_chipcommon.c
++++ b/drivers/bcma/driver_chipcommon.c
+@@ -4,12 +4,15 @@
+  *
+  * Copyright 2005, Broadcom Corporation
+  * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+ #include "bcma_private.h"
++#include <linux/bcm47xx_wdt.h>
+ #include <linux/export.h>
++#include <linux/platform_device.h>
+ #include <linux/bcma/bcma.h>
+ 
+ static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
+@@ -22,20 +25,119 @@ static inline u32 bcma_cc_write32_masked
+ 	return value;
+ }
+ 
+-void bcma_core_chipcommon_init(struct bcma_drv_cc *cc)
++static u32 bcma_chipco_get_alp_clock(struct bcma_drv_cc *cc)
+ {
+-	u32 leddc_on = 10;
+-	u32 leddc_off = 90;
++	if (cc->capabilities & BCMA_CC_CAP_PMU)
++		return bcma_pmu_get_alp_clock(cc);
+ 
+-	if (cc->setup_done)
++	return 20000000;
++}
++
++static u32 bcma_chipco_watchdog_get_max_timer(struct bcma_drv_cc *cc)
++{
++	struct bcma_bus *bus = cc->core->bus;
++	u32 nb;
++
++	if (cc->capabilities & BCMA_CC_CAP_PMU) {
++		if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706)
++			nb = 32;
++		else if (cc->core->id.rev < 26)
++			nb = 16;
++		else
++			nb = (cc->core->id.rev >= 37) ? 32 : 24;
++	} else {
++		nb = 28;
++	}
++	if (nb == 32)
++		return 0xffffffff;
++	else
++		return (1 << nb) - 1;
++}
++
++static u32 bcma_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
++					      u32 ticks)
++{
++	struct bcma_drv_cc *cc = bcm47xx_wdt_get_drvdata(wdt);
++
++	return bcma_chipco_watchdog_timer_set(cc, ticks);
++}
++
++static u32 bcma_chipco_watchdog_timer_set_ms_wdt(struct bcm47xx_wdt *wdt,
++						 u32 ms)
++{
++	struct bcma_drv_cc *cc = bcm47xx_wdt_get_drvdata(wdt);
++	u32 ticks;
++
++	ticks = bcma_chipco_watchdog_timer_set(cc, cc->ticks_per_ms * ms);
++	return ticks / cc->ticks_per_ms;
++}
++
++static int bcma_chipco_watchdog_ticks_per_ms(struct bcma_drv_cc *cc)
++{
++	struct bcma_bus *bus = cc->core->bus;
++
++	if (cc->capabilities & BCMA_CC_CAP_PMU) {
++		if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706)
++			/* 4706 CC and PMU watchdogs are clocked at 1/4 of ALP clock */
++			return bcma_chipco_get_alp_clock(cc) / 4000;
++		else
++			/* based on 32KHz ILP clock */
++			return 32;
++	} else {
++		return bcma_chipco_get_alp_clock(cc) / 1000;
++	}
++}
++
++int bcma_chipco_watchdog_register(struct bcma_drv_cc *cc)
++{
++	struct bcm47xx_wdt wdt = {};
++	struct platform_device *pdev;
++
++	wdt.driver_data = cc;
++	wdt.timer_set = bcma_chipco_watchdog_timer_set_wdt;
++	wdt.timer_set_ms = bcma_chipco_watchdog_timer_set_ms_wdt;
++	wdt.max_timer_ms = bcma_chipco_watchdog_get_max_timer(cc) / cc->ticks_per_ms;
++
++	pdev = platform_device_register_data(NULL, "bcm47xx-wdt",
++					     cc->core->bus->num, &wdt,
++					     sizeof(wdt));
++	if (IS_ERR(pdev))
++		return PTR_ERR(pdev);
++
++	cc->watchdog = pdev;
++
++	return 0;
++}
++
++void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
++{
++	if (cc->early_setup_done)
+ 		return;
+ 
++	spin_lock_init(&cc->gpio_lock);
++
+ 	if (cc->core->id.rev >= 11)
+ 		cc->status = bcma_cc_read32(cc, BCMA_CC_CHIPSTAT);
+ 	cc->capabilities = bcma_cc_read32(cc, BCMA_CC_CAP);
+ 	if (cc->core->id.rev >= 35)
+ 		cc->capabilities_ext = bcma_cc_read32(cc, BCMA_CC_CAP_EXT);
+ 
++	if (cc->capabilities & BCMA_CC_CAP_PMU)
++		bcma_pmu_early_init(cc);
++
++	cc->early_setup_done = true;
++}
++
++void bcma_core_chipcommon_init(struct bcma_drv_cc *cc)
++{
++	u32 leddc_on = 10;
++	u32 leddc_off = 90;
++
++	if (cc->setup_done)
++		return;
++
++	bcma_core_chipcommon_early_init(cc);
++
+ 	if (cc->core->id.rev >= 20) {
+ 		bcma_cc_write32(cc, BCMA_CC_GPIOPULLUP, 0);
+ 		bcma_cc_write32(cc, BCMA_CC_GPIOPULLDOWN, 0);
+@@ -44,7 +146,7 @@ void bcma_core_chipcommon_init(struct bc
+ 	if (cc->capabilities & BCMA_CC_CAP_PMU)
+ 		bcma_pmu_init(cc);
+ 	if (cc->capabilities & BCMA_CC_CAP_PCTL)
+-		pr_err("Power control not implemented!\n");
++		bcma_err(cc->core->bus, "Power control not implemented!\n");
+ 
+ 	if (cc->core->id.rev >= 16) {
+ 		if (cc->core->bus->sprom.leddc_on_time &&
+@@ -56,15 +158,33 @@ void bcma_core_chipcommon_init(struct bc
+ 			((leddc_on << BCMA_CC_GPIOTIMER_ONTIME_SHIFT) |
+ 			 (leddc_off << BCMA_CC_GPIOTIMER_OFFTIME_SHIFT)));
+ 	}
++	cc->ticks_per_ms = bcma_chipco_watchdog_ticks_per_ms(cc);
+ 
+ 	cc->setup_done = true;
+ }
+ 
+ /* Set chip watchdog reset timer to fire in 'ticks' backplane cycles */
+-void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks)
++u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks)
+ {
+-	/* instant NMI */
+-	bcma_cc_write32(cc, BCMA_CC_WATCHDOG, ticks);
++	u32 maxt;
++	enum bcma_clkmode clkmode;
++
++	maxt = bcma_chipco_watchdog_get_max_timer(cc);
++	if (cc->capabilities & BCMA_CC_CAP_PMU) {
++		if (ticks == 1)
++			ticks = 2;
++		else if (ticks > maxt)
++			ticks = maxt;
++		bcma_cc_write32(cc, BCMA_CC_PMU_WATCHDOG, ticks);
++	} else {
++		clkmode = ticks ? BCMA_CLKMODE_FAST : BCMA_CLKMODE_DYNAMIC;
++		bcma_core_set_clockmode(cc->core, clkmode);
++		if (ticks > maxt)
++			ticks = maxt;
++		/* instant NMI */
++		bcma_cc_write32(cc, BCMA_CC_WATCHDOG, ticks);
++	}
++	return ticks;
+ }
+ 
+ void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value)
+@@ -84,28 +204,97 @@ u32 bcma_chipco_gpio_in(struct bcma_drv_
+ 
+ u32 bcma_chipco_gpio_out(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOOUT, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOOUT, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 bcma_chipco_gpio_outen(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOOUTEN, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOOUTEN, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
++/*
++ * If the bit is set to 0, chipcommon controlls this GPIO,
++ * if the bit is set to 1, it is used by some part of the chip and not our code.
++ */
+ u32 bcma_chipco_gpio_control(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOCTL, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOCTL, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ EXPORT_SYMBOL_GPL(bcma_chipco_gpio_control);
+ 
+ u32 bcma_chipco_gpio_intmask(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOIRQ, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOIRQ, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ u32 bcma_chipco_gpio_polarity(struct bcma_drv_cc *cc, u32 mask, u32 value)
+ {
+-	return bcma_cc_write32_masked(cc, BCMA_CC_GPIOPOL, mask, value);
++	unsigned long flags;
++	u32 res;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOPOL, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
++}
++
++u32 bcma_chipco_gpio_pullup(struct bcma_drv_cc *cc, u32 mask, u32 value)
++{
++	unsigned long flags;
++	u32 res;
++
++	if (cc->core->id.rev < 20)
++		return 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOPULLUP, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
++}
++
++u32 bcma_chipco_gpio_pulldown(struct bcma_drv_cc *cc, u32 mask, u32 value)
++{
++	unsigned long flags;
++	u32 res;
++
++	if (cc->core->id.rev < 20)
++		return 0;
++
++	spin_lock_irqsave(&cc->gpio_lock, flags);
++	res = bcma_cc_write32_masked(cc, BCMA_CC_GPIOPULLDOWN, mask, value);
++	spin_unlock_irqrestore(&cc->gpio_lock, flags);
++
++	return res;
+ }
+ 
+ #ifdef CONFIG_BCMA_DRIVER_MIPS
+@@ -118,8 +307,7 @@ void bcma_chipco_serial_init(struct bcma
+ 	struct bcma_serial_port *ports = cc->serial_ports;
+ 
+ 	if (ccrev >= 11 && ccrev != 15) {
+-		/* Fixed ALP clock */
+-		baud_base = bcma_pmu_alp_clock(cc);
++		baud_base = bcma_chipco_get_alp_clock(cc);
+ 		if (ccrev >= 21) {
+ 			/* Turn off UART clock before switching clocksource. */
+ 			bcma_cc_write32(cc, BCMA_CC_CORECTL,
+@@ -137,8 +325,7 @@ void bcma_chipco_serial_init(struct bcma
+ 				       | BCMA_CC_CORECTL_UARTCLKEN);
+ 		}
+ 	} else {
+-		pr_err("serial not supported on this device ccrev: 0x%x\n",
+-		       ccrev);
++		bcma_err(cc->core->bus, "serial not supported on this device ccrev: 0x%x\n", ccrev);
+ 		return;
+ 	}
+ 
+--- /dev/null
++++ b/drivers/bcma/driver_chipcommon_nflash.c
+@@ -0,0 +1,44 @@
++/*
++ * Broadcom specific AMBA
++ * ChipCommon NAND flash interface
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/platform_device.h>
++#include <linux/bcma/bcma.h>
++
++#include "bcma_private.h"
++
++struct platform_device bcma_nflash_dev = {
++	.name		= "bcma_nflash",
++	.num_resources	= 0,
++};
++
++/* Initialize NAND flash access */
++int bcma_nflash_init(struct bcma_drv_cc *cc)
++{
++	struct bcma_bus *bus = cc->core->bus;
++
++	if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&
++	    cc->core->id.rev != 0x38) {
++		bcma_err(bus, "NAND flash on unsupported board!\n");
++		return -ENOTSUPP;
++	}
++
++	if (!(cc->capabilities & BCMA_CC_CAP_NFLASH)) {
++		bcma_err(bus, "NAND flash not present according to ChipCommon\n");
++		return -ENODEV;
++	}
++
++	cc->nflash.present = true;
++	if (cc->core->id.rev == 38 &&
++	    (cc->status & BCMA_CC_CHIPST_5357_NAND_BOOT))
++		cc->nflash.boot = true;
++
++	/* Prepare platform device, but don't register it yet. It's too early,
++	 * malloc (required by device_private_init) is not available yet. */
++	bcma_nflash_dev.dev.platform_data = &cc->nflash;
++
++	return 0;
++}
+--- a/drivers/bcma/driver_chipcommon_pmu.c
++++ b/drivers/bcma/driver_chipcommon_pmu.c
+@@ -3,7 +3,8 @@
+  * ChipCommon Power Management Unit driver
+  *
+  * Copyright 2009, Michael Buesch <m@bues.ch>
+- * Copyright 2007, Broadcom Corporation
++ * Copyright 2007, 2011, Broadcom Corporation
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+@@ -12,12 +13,13 @@
+ #include <linux/export.h>
+ #include <linux/bcma/bcma.h>
+ 
+-static u32 bcma_chipco_pll_read(struct bcma_drv_cc *cc, u32 offset)
++u32 bcma_chipco_pll_read(struct bcma_drv_cc *cc, u32 offset)
+ {
+ 	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
+ 	bcma_cc_read32(cc, BCMA_CC_PLLCTL_ADDR);
+ 	return bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
+ }
++EXPORT_SYMBOL_GPL(bcma_chipco_pll_read);
+ 
+ void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset, u32 value)
+ {
+@@ -54,38 +56,19 @@ void bcma_chipco_regctl_maskset(struct b
+ }
+ EXPORT_SYMBOL_GPL(bcma_chipco_regctl_maskset);
+ 
+-static void bcma_pmu_pll_init(struct bcma_drv_cc *cc)
+-{
+-	struct bcma_bus *bus = cc->core->bus;
+-
+-	switch (bus->chipinfo.id) {
+-	case 0x4313:
+-	case 0x4331:
+-	case 43224:
+-	case 43225:
+-		break;
+-	default:
+-		pr_err("PLL init unknown for device 0x%04X\n",
+-			bus->chipinfo.id);
+-	}
+-}
+-
+ static void bcma_pmu_resources_init(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 	u32 min_msk = 0, max_msk = 0;
+ 
+ 	switch (bus->chipinfo.id) {
+-	case 0x4313:
++	case BCMA_CHIP_ID_BCM4313:
+ 		min_msk = 0x200D;
+ 		max_msk = 0xFFFF;
+ 		break;
+-	case 43224:
+-	case 43225:
+-		break;
+ 	default:
+-		pr_err("PMU resource config unknown for device 0x%04X\n",
+-			bus->chipinfo.id);
++		bcma_debug(bus, "PMU resource config unknown or not needed for device 0x%04X\n",
++			   bus->chipinfo.id);
+ 	}
+ 
+ 	/* Set the resource masks. */
+@@ -93,22 +76,12 @@ static void bcma_pmu_resources_init(stru
+ 		bcma_cc_write32(cc, BCMA_CC_PMU_MINRES_MSK, min_msk);
+ 	if (max_msk)
+ 		bcma_cc_write32(cc, BCMA_CC_PMU_MAXRES_MSK, max_msk);
+-}
+-
+-void bcma_pmu_swreg_init(struct bcma_drv_cc *cc)
+-{
+-	struct bcma_bus *bus = cc->core->bus;
+ 
+-	switch (bus->chipinfo.id) {
+-	case 0x4313:
+-	case 0x4331:
+-	case 43224:
+-	case 43225:
+-		break;
+-	default:
+-		pr_err("PMU switch/regulators init unknown for device "
+-			"0x%04X\n", bus->chipinfo.id);
+-	}
++	/*
++	 * Add some delay; allow resources to come up and settle.
++	 * Delay is required for SoC (early init).
++	 */
++	mdelay(2);
+ }
+ 
+ /* Disable to allow reading SPROM. Don't know the adventages of enabling it. */
+@@ -122,51 +95,69 @@ void bcma_chipco_bcm4331_ext_pa_lines_ct
+ 		val |= BCMA_CHIPCTL_4331_EXTPA_EN;
+ 		if (bus->chipinfo.pkg == 9 || bus->chipinfo.pkg == 11)
+ 			val |= BCMA_CHIPCTL_4331_EXTPA_ON_GPIO2_5;
++		else if (bus->chipinfo.rev > 0)
++			val |= BCMA_CHIPCTL_4331_EXTPA_EN2;
+ 	} else {
+ 		val &= ~BCMA_CHIPCTL_4331_EXTPA_EN;
++		val &= ~BCMA_CHIPCTL_4331_EXTPA_EN2;
+ 		val &= ~BCMA_CHIPCTL_4331_EXTPA_ON_GPIO2_5;
+ 	}
+ 	bcma_cc_write32(cc, BCMA_CC_CHIPCTL, val);
+ }
+ 
+-void bcma_pmu_workarounds(struct bcma_drv_cc *cc)
++static void bcma_pmu_workarounds(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 
+ 	switch (bus->chipinfo.id) {
+-	case 0x4313:
+-		bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x7);
++	case BCMA_CHIP_ID_BCM4313:
++		/* enable 12 mA drive strenth for 4313 and set chipControl
++		   register bit 1 */
++		bcma_chipco_chipctl_maskset(cc, 0,
++					    ~BCMA_CCTRL_4313_12MA_LED_DRIVE,
++					    BCMA_CCTRL_4313_12MA_LED_DRIVE);
+ 		break;
+-	case 0x4331:
+-		/* BCM4331 workaround is SPROM-related, we put it in sprom.c */
++	case BCMA_CHIP_ID_BCM4331:
++	case BCMA_CHIP_ID_BCM43431:
++		/* Ext PA lines must be enabled for tx on BCM4331 */
++		bcma_chipco_bcm4331_ext_pa_lines_ctl(cc, true);
+ 		break;
+-	case 43224:
++	case BCMA_CHIP_ID_BCM43224:
++	case BCMA_CHIP_ID_BCM43421:
++		/* enable 12 mA drive strenth for 43224 and set chipControl
++		   register bit 15 */
+ 		if (bus->chipinfo.rev == 0) {
+-			pr_err("Workarounds for 43224 rev 0 not fully "
+-				"implemented\n");
+-			bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x00F000F0);
++			bcma_cc_maskset32(cc, BCMA_CC_CHIPCTL,
++					  ~BCMA_CCTRL_43224_GPIO_TOGGLE,
++					  BCMA_CCTRL_43224_GPIO_TOGGLE);
++			bcma_chipco_chipctl_maskset(cc, 0,
++						    ~BCMA_CCTRL_43224A0_12MA_LED_DRIVE,
++						    BCMA_CCTRL_43224A0_12MA_LED_DRIVE);
+ 		} else {
+-			bcma_chipco_chipctl_maskset(cc, 0, ~0, 0xF0);
++			bcma_chipco_chipctl_maskset(cc, 0,
++						    ~BCMA_CCTRL_43224B0_12MA_LED_DRIVE,
++						    BCMA_CCTRL_43224B0_12MA_LED_DRIVE);
+ 		}
+ 		break;
+-	case 43225:
+-		break;
+ 	default:
+-		pr_err("Workarounds unknown for device 0x%04X\n",
+-			bus->chipinfo.id);
++		bcma_debug(bus, "Workarounds unknown or not needed for device 0x%04X\n",
++			   bus->chipinfo.id);
+ 	}
+ }
+ 
+-void bcma_pmu_init(struct bcma_drv_cc *cc)
++void bcma_pmu_early_init(struct bcma_drv_cc *cc)
+ {
+ 	u32 pmucap;
+ 
+ 	pmucap = bcma_cc_read32(cc, BCMA_CC_PMU_CAP);
+ 	cc->pmu.rev = (pmucap & BCMA_CC_PMU_CAP_REVISION);
+ 
+-	pr_debug("Found rev %u PMU (capabilities 0x%08X)\n", cc->pmu.rev,
+-		 pmucap);
++	bcma_debug(cc->core->bus, "Found rev %u PMU (capabilities 0x%08X)\n",
++		   cc->pmu.rev, pmucap);
++}
+ 
++void bcma_pmu_init(struct bcma_drv_cc *cc)
++{
+ 	if (cc->pmu.rev == 1)
+ 		bcma_cc_mask32(cc, BCMA_CC_PMU_CTL,
+ 			      ~BCMA_CC_PMU_CTL_NOILPONW);
+@@ -174,37 +165,31 @@ void bcma_pmu_init(struct bcma_drv_cc *c
+ 		bcma_cc_set32(cc, BCMA_CC_PMU_CTL,
+ 			     BCMA_CC_PMU_CTL_NOILPONW);
+ 
+-	if (cc->core->id.id == 0x4329 && cc->core->id.rev == 2)
+-		pr_err("Fix for 4329b0 bad LPOM state not implemented!\n");
+-
+-	bcma_pmu_pll_init(cc);
+ 	bcma_pmu_resources_init(cc);
+-	bcma_pmu_swreg_init(cc);
+ 	bcma_pmu_workarounds(cc);
+ }
+ 
+-u32 bcma_pmu_alp_clock(struct bcma_drv_cc *cc)
++u32 bcma_pmu_get_alp_clock(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 
+ 	switch (bus->chipinfo.id) {
+-	case 0x4716:
+-	case 0x4748:
+-	case 47162:
+-	case 0x4313:
+-	case 0x5357:
+-	case 0x4749:
+-	case 53572:
++	case BCMA_CHIP_ID_BCM4716:
++	case BCMA_CHIP_ID_BCM4748:
++	case BCMA_CHIP_ID_BCM47162:
++	case BCMA_CHIP_ID_BCM4313:
++	case BCMA_CHIP_ID_BCM5357:
++	case BCMA_CHIP_ID_BCM4749:
++	case BCMA_CHIP_ID_BCM53572:
+ 		/* always 20Mhz */
+ 		return 20000 * 1000;
+-	case 0x5356:
+-	case 0x5300:
++	case BCMA_CHIP_ID_BCM5356:
++	case BCMA_CHIP_ID_BCM4706:
+ 		/* always 25Mhz */
+ 		return 25000 * 1000;
+ 	default:
+-		pr_warn("No ALP clock specified for %04X device, "
+-			"pmu rev. %d, using default %d Hz\n",
+-			bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_ALP_CLOCK);
++		bcma_warn(bus, "No ALP clock specified for %04X device, pmu rev. %d, using default %d Hz\n",
++			  bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_ALP_CLOCK);
+ 	}
+ 	return BCMA_CC_PMU_ALP_CLOCK;
+ }
+@@ -212,7 +197,7 @@ u32 bcma_pmu_alp_clock(struct bcma_drv_c
+ /* Find the output of the "m" pll divider given pll controls that start with
+  * pllreg "pll0" i.e. 12 for main 6 for phy, 0 for misc.
+  */
+-static u32 bcma_pmu_clock(struct bcma_drv_cc *cc, u32 pll0, u32 m)
++static u32 bcma_pmu_pll_clock(struct bcma_drv_cc *cc, u32 pll0, u32 m)
+ {
+ 	u32 tmp, div, ndiv, p1, p2, fc;
+ 	struct bcma_bus *bus = cc->core->bus;
+@@ -221,7 +206,8 @@ static u32 bcma_pmu_clock(struct bcma_dr
+ 
+ 	BUG_ON(!m || m > 4);
+ 
+-	if (bus->chipinfo.id == 0x5357 || bus->chipinfo.id == 0x4749) {
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM5357 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM4749) {
+ 		/* Detect failure in clock setting */
+ 		tmp = bcma_cc_read32(cc, BCMA_CC_CHIPSTAT);
+ 		if (tmp & 0x40000)
+@@ -240,60 +226,95 @@ static u32 bcma_pmu_clock(struct bcma_dr
+ 	ndiv = (tmp & BCMA_CC_PPL_NDIV_MASK) >> BCMA_CC_PPL_NDIV_SHIFT;
+ 
+ 	/* Do calculation in Mhz */
+-	fc = bcma_pmu_alp_clock(cc) / 1000000;
++	fc = bcma_pmu_get_alp_clock(cc) / 1000000;
+ 	fc = (p1 * ndiv * fc) / p2;
+ 
+ 	/* Return clock in Hertz */
+ 	return (fc / div) * 1000000;
+ }
+ 
++static u32 bcma_pmu_pll_clock_bcm4706(struct bcma_drv_cc *cc, u32 pll0, u32 m)
++{
++	u32 tmp, ndiv, p1div, p2div;
++	u32 clock;
++
++	BUG_ON(!m || m > 4);
++
++	/* Get N, P1 and P2 dividers to determine CPU clock */
++	tmp = bcma_chipco_pll_read(cc, pll0 + BCMA_CC_PMU6_4706_PROCPLL_OFF);
++	ndiv = (tmp & BCMA_CC_PMU6_4706_PROC_NDIV_INT_MASK)
++		>> BCMA_CC_PMU6_4706_PROC_NDIV_INT_SHIFT;
++	p1div = (tmp & BCMA_CC_PMU6_4706_PROC_P1DIV_MASK)
++		>> BCMA_CC_PMU6_4706_PROC_P1DIV_SHIFT;
++	p2div = (tmp & BCMA_CC_PMU6_4706_PROC_P2DIV_MASK)
++		>> BCMA_CC_PMU6_4706_PROC_P2DIV_SHIFT;
++
++	tmp = bcma_cc_read32(cc, BCMA_CC_CHIPSTAT);
++	if (tmp & BCMA_CC_CHIPST_4706_PKG_OPTION)
++		/* Low cost bonding: Fixed reference clock 25MHz and m = 4 */
++		clock = (25000000 / 4) * ndiv * p2div / p1div;
++	else
++		/* Fixed reference clock 25MHz and m = 2 */
++		clock = (25000000 / 2) * ndiv * p2div / p1div;
++
++	if (m == BCMA_CC_PMU5_MAINPLL_SSB)
++		clock = clock / 4;
++
++	return clock;
++}
++
+ /* query bus clock frequency for PMU-enabled chipcommon */
+-u32 bcma_pmu_get_clockcontrol(struct bcma_drv_cc *cc)
++static u32 bcma_pmu_get_bus_clock(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 
+ 	switch (bus->chipinfo.id) {
+-	case 0x4716:
+-	case 0x4748:
+-	case 47162:
+-		return bcma_pmu_clock(cc, BCMA_CC_PMU4716_MAINPLL_PLL0,
+-				      BCMA_CC_PMU5_MAINPLL_SSB);
+-	case 0x5356:
+-		return bcma_pmu_clock(cc, BCMA_CC_PMU5356_MAINPLL_PLL0,
+-				      BCMA_CC_PMU5_MAINPLL_SSB);
+-	case 0x5357:
+-	case 0x4749:
+-		return bcma_pmu_clock(cc, BCMA_CC_PMU5357_MAINPLL_PLL0,
+-				      BCMA_CC_PMU5_MAINPLL_SSB);
+-	case 0x5300:
+-		return bcma_pmu_clock(cc, BCMA_CC_PMU4706_MAINPLL_PLL0,
+-				      BCMA_CC_PMU5_MAINPLL_SSB);
+-	case 53572:
++	case BCMA_CHIP_ID_BCM4716:
++	case BCMA_CHIP_ID_BCM4748:
++	case BCMA_CHIP_ID_BCM47162:
++		return bcma_pmu_pll_clock(cc, BCMA_CC_PMU4716_MAINPLL_PLL0,
++					  BCMA_CC_PMU5_MAINPLL_SSB);
++	case BCMA_CHIP_ID_BCM5356:
++		return bcma_pmu_pll_clock(cc, BCMA_CC_PMU5356_MAINPLL_PLL0,
++					  BCMA_CC_PMU5_MAINPLL_SSB);
++	case BCMA_CHIP_ID_BCM5357:
++	case BCMA_CHIP_ID_BCM4749:
++		return bcma_pmu_pll_clock(cc, BCMA_CC_PMU5357_MAINPLL_PLL0,
++					  BCMA_CC_PMU5_MAINPLL_SSB);
++	case BCMA_CHIP_ID_BCM4706:
++		return bcma_pmu_pll_clock_bcm4706(cc,
++						  BCMA_CC_PMU4706_MAINPLL_PLL0,
++						  BCMA_CC_PMU5_MAINPLL_SSB);
++	case BCMA_CHIP_ID_BCM53572:
+ 		return 75000000;
+ 	default:
+-		pr_warn("No backplane clock specified for %04X device, "
+-			"pmu rev. %d, using default %d Hz\n",
+-			bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_HT_CLOCK);
++		bcma_warn(bus, "No bus clock specified for %04X device, pmu rev. %d, using default %d Hz\n",
++			  bus->chipinfo.id, cc->pmu.rev, BCMA_CC_PMU_HT_CLOCK);
+ 	}
+ 	return BCMA_CC_PMU_HT_CLOCK;
+ }
+ 
+ /* query cpu clock frequency for PMU-enabled chipcommon */
+-u32 bcma_pmu_get_clockcpu(struct bcma_drv_cc *cc)
++u32 bcma_pmu_get_cpu_clock(struct bcma_drv_cc *cc)
+ {
+ 	struct bcma_bus *bus = cc->core->bus;
+ 
+-	if (bus->chipinfo.id == 53572)
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM53572)
+ 		return 300000000;
+ 
++	/* New PMUs can have different clock for bus and CPU */
+ 	if (cc->pmu.rev >= 5) {
+ 		u32 pll;
+ 		switch (bus->chipinfo.id) {
+-		case 0x5356:
++		case BCMA_CHIP_ID_BCM4706:
++			return bcma_pmu_pll_clock_bcm4706(cc,
++						BCMA_CC_PMU4706_MAINPLL_PLL0,
++						BCMA_CC_PMU5_MAINPLL_CPU);
++		case BCMA_CHIP_ID_BCM5356:
+ 			pll = BCMA_CC_PMU5356_MAINPLL_PLL0;
+ 			break;
+-		case 0x5357:
+-		case 0x4749:
++		case BCMA_CHIP_ID_BCM5357:
++		case BCMA_CHIP_ID_BCM4749:
+ 			pll = BCMA_CC_PMU5357_MAINPLL_PLL0;
+ 			break;
+ 		default:
+@@ -301,10 +322,189 @@ u32 bcma_pmu_get_clockcpu(struct bcma_dr
+ 			break;
+ 		}
+ 
+-		/* TODO: if (bus->chipinfo.id == 0x5300)
+-		  return si_4706_pmu_clock(sih, osh, cc, PMU4706_MAINPLL_PLL0, PMU5_MAINPLL_CPU); */
+-		return bcma_pmu_clock(cc, pll, BCMA_CC_PMU5_MAINPLL_CPU);
++		return bcma_pmu_pll_clock(cc, pll, BCMA_CC_PMU5_MAINPLL_CPU);
++	}
++
++	/* On old PMUs CPU has the same clock as the bus */
++	return bcma_pmu_get_bus_clock(cc);
++}
++
++static void bcma_pmu_spuravoid_pll_write(struct bcma_drv_cc *cc, u32 offset,
++					 u32 value)
++{
++	bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR, offset);
++	bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, value);
++}
++
++void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid)
++{
++	u32 tmp = 0;
++	u8 phypll_offset = 0;
++	u8 bcm5357_bcm43236_p1div[] = {0x1, 0x5, 0x5};
++	u8 bcm5357_bcm43236_ndiv[] = {0x30, 0xf6, 0xfc};
++	struct bcma_bus *bus = cc->core->bus;
++
++	switch (bus->chipinfo.id) {
++	case BCMA_CHIP_ID_BCM5357:
++	case BCMA_CHIP_ID_BCM4749:
++	case BCMA_CHIP_ID_BCM53572:
++		/* 5357[ab]0, 43236[ab]0, and 6362b0 */
++
++		/* BCM5357 needs to touch PLL1_PLLCTL[02],
++		   so offset PLL0_PLLCTL[02] by 6 */
++		phypll_offset = (bus->chipinfo.id == BCMA_CHIP_ID_BCM5357 ||
++		       bus->chipinfo.id == BCMA_CHIP_ID_BCM4749 ||
++		       bus->chipinfo.id == BCMA_CHIP_ID_BCM53572) ? 6 : 0;
++
++		/* RMW only the P1 divider */
++		bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
++				BCMA_CC_PMU_PLL_CTL0 + phypll_offset);
++		tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
++		tmp &= (~(BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK));
++		tmp |= (bcm5357_bcm43236_p1div[spuravoid] << BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT);
++		bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
++
++		/* RMW only the int feedback divider */
++		bcma_cc_write32(cc, BCMA_CC_PLLCTL_ADDR,
++				BCMA_CC_PMU_PLL_CTL2 + phypll_offset);
++		tmp = bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA);
++		tmp &= ~(BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK);
++		tmp |= (bcm5357_bcm43236_ndiv[spuravoid]) << BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT;
++		bcma_cc_write32(cc, BCMA_CC_PLLCTL_DATA, tmp);
++
++		tmp = 1 << 10;
++		break;
++
++	case BCMA_CHIP_ID_BCM4331:
++	case BCMA_CHIP_ID_BCM43431:
++		if (spuravoid == 2) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11500014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x0FC00a08);
++		} else if (spuravoid == 1) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11500014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x0F600a08);
++		} else {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11100014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03000a08);
++		}
++		tmp = 1 << 10;
++		break;
++
++	case BCMA_CHIP_ID_BCM43224:
++	case BCMA_CHIP_ID_BCM43225:
++	case BCMA_CHIP_ID_BCM43421:
++		if (spuravoid == 1) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11500010);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x000C0C06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x0F600a08);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x2001E920);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		} else {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11100010);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x000c0c06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03000a08);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x200005c0);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		}
++		tmp = 1 << 10;
++		break;
++
++	case BCMA_CHIP_ID_BCM4716:
++	case BCMA_CHIP_ID_BCM4748:
++	case BCMA_CHIP_ID_BCM47162:
++		if (spuravoid == 1) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11500060);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x080C0C06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x0F600000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x2001E924);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		} else {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11100060);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x080c0c06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x200005c0);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		}
++
++		tmp = 3 << 9;
++		break;
++
++	case BCMA_CHIP_ID_BCM43227:
++	case BCMA_CHIP_ID_BCM43228:
++	case BCMA_CHIP_ID_BCM43428:
++		/* LCNXN */
++		/* PLL Settings for spur avoidance on/off mode,
++		   no on2 support for 43228A0 */
++		if (spuravoid == 1) {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x01100014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x040C0C06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03140A08);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00333333);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x202C2820);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		} else {
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL0,
++						     0x11100014);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL1,
++						     0x040c0c06);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL2,
++						     0x03000a08);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL3,
++						     0x00000000);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL4,
++						     0x200005c0);
++			bcma_pmu_spuravoid_pll_write(cc, BCMA_CC_PMU_PLL_CTL5,
++						     0x88888815);
++		}
++		tmp = 1 << 10;
++		break;
++	default:
++		bcma_err(bus, "Unknown spuravoidance settings for chip 0x%04X, not changing PLL\n",
++			 bus->chipinfo.id);
++		break;
+ 	}
+ 
+-	return bcma_pmu_get_clockcontrol(cc);
++	tmp |= bcma_cc_read32(cc, BCMA_CC_PMU_CTL);
++	bcma_cc_write32(cc, BCMA_CC_PMU_CTL, tmp);
+ }
++EXPORT_SYMBOL_GPL(bcma_pmu_spuravoid_pllupdate);
+--- /dev/null
++++ b/drivers/bcma/driver_chipcommon_sflash.c
+@@ -0,0 +1,165 @@
++/*
++ * Broadcom specific AMBA
++ * ChipCommon serial flash interface
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/platform_device.h>
++#include <linux/bcma/bcma.h>
++
++#include "bcma_private.h"
++
++static struct resource bcma_sflash_resource = {
++	.name	= "bcma_sflash",
++	.start	= BCMA_SOC_FLASH2,
++	.end	= 0,
++	.flags  = IORESOURCE_MEM | IORESOURCE_READONLY,
++};
++
++struct platform_device bcma_sflash_dev = {
++	.name		= "bcma_sflash",
++	.resource	= &bcma_sflash_resource,
++	.num_resources	= 1,
++};
++
++struct bcma_sflash_tbl_e {
++	char *name;
++	u32 id;
++	u32 blocksize;
++	u16 numblocks;
++};
++
++static struct bcma_sflash_tbl_e bcma_sflash_st_tbl[] = {
++	{ "M25P20", 0x11, 0x10000, 4, },
++	{ "M25P40", 0x12, 0x10000, 8, },
++
++	{ "M25P16", 0x14, 0x10000, 32, },
++	{ "M25P32", 0x15, 0x10000, 64, },
++	{ "M25P64", 0x16, 0x10000, 128, },
++	{ "M25FL128", 0x17, 0x10000, 256, },
++	{ 0 },
++};
++
++static struct bcma_sflash_tbl_e bcma_sflash_sst_tbl[] = {
++	{ "SST25WF512", 1, 0x1000, 16, },
++	{ "SST25VF512", 0x48, 0x1000, 16, },
++	{ "SST25WF010", 2, 0x1000, 32, },
++	{ "SST25VF010", 0x49, 0x1000, 32, },
++	{ "SST25WF020", 3, 0x1000, 64, },
++	{ "SST25VF020", 0x43, 0x1000, 64, },
++	{ "SST25WF040", 4, 0x1000, 128, },
++	{ "SST25VF040", 0x44, 0x1000, 128, },
++	{ "SST25VF040B", 0x8d, 0x1000, 128, },
++	{ "SST25WF080", 5, 0x1000, 256, },
++	{ "SST25VF080B", 0x8e, 0x1000, 256, },
++	{ "SST25VF016", 0x41, 0x1000, 512, },
++	{ "SST25VF032", 0x4a, 0x1000, 1024, },
++	{ "SST25VF064", 0x4b, 0x1000, 2048, },
++	{ 0 },
++};
++
++static struct bcma_sflash_tbl_e bcma_sflash_at_tbl[] = {
++	{ "AT45DB011", 0xc, 256, 512, },
++	{ "AT45DB021", 0x14, 256, 1024, },
++	{ "AT45DB041", 0x1c, 256, 2048, },
++	{ "AT45DB081", 0x24, 256, 4096, },
++	{ "AT45DB161", 0x2c, 512, 4096, },
++	{ "AT45DB321", 0x34, 512, 8192, },
++	{ "AT45DB642", 0x3c, 1024, 8192, },
++	{ 0 },
++};
++
++static void bcma_sflash_cmd(struct bcma_drv_cc *cc, u32 opcode)
++{
++	int i;
++	bcma_cc_write32(cc, BCMA_CC_FLASHCTL,
++			BCMA_CC_FLASHCTL_START | opcode);
++	for (i = 0; i < 1000; i++) {
++		if (!(bcma_cc_read32(cc, BCMA_CC_FLASHCTL) &
++		      BCMA_CC_FLASHCTL_BUSY))
++			return;
++		cpu_relax();
++	}
++	bcma_err(cc->core->bus, "SFLASH control command failed (timeout)!\n");
++}
++
++/* Initialize serial flash access */
++int bcma_sflash_init(struct bcma_drv_cc *cc)
++{
++	struct bcma_bus *bus = cc->core->bus;
++	struct bcma_sflash *sflash = &cc->sflash;
++	struct bcma_sflash_tbl_e *e;
++	u32 id, id2;
++
++	switch (cc->capabilities & BCMA_CC_CAP_FLASHT) {
++	case BCMA_CC_FLASHT_STSER:
++		bcma_sflash_cmd(cc, BCMA_CC_FLASHCTL_ST_DP);
++
++		bcma_cc_write32(cc, BCMA_CC_FLASHADDR, 0);
++		bcma_sflash_cmd(cc, BCMA_CC_FLASHCTL_ST_RES);
++		id = bcma_cc_read32(cc, BCMA_CC_FLASHDATA);
++
++		bcma_cc_write32(cc, BCMA_CC_FLASHADDR, 1);
++		bcma_sflash_cmd(cc, BCMA_CC_FLASHCTL_ST_RES);
++		id2 = bcma_cc_read32(cc, BCMA_CC_FLASHDATA);
++
++		switch (id) {
++		case 0xbf:
++			for (e = bcma_sflash_sst_tbl; e->name; e++) {
++				if (e->id == id2)
++					break;
++			}
++			break;
++		case 0x13:
++			return -ENOTSUPP;
++		default:
++			for (e = bcma_sflash_st_tbl; e->name; e++) {
++				if (e->id == id)
++					break;
++			}
++			break;
++		}
++		if (!e->name) {
++			bcma_err(bus, "Unsupported ST serial flash (id: 0x%X, id2: 0x%X)\n", id, id2);
++			return -ENOTSUPP;
++		}
++
++		break;
++	case BCMA_CC_FLASHT_ATSER:
++		bcma_sflash_cmd(cc, BCMA_CC_FLASHCTL_AT_STATUS);
++		id = bcma_cc_read32(cc, BCMA_CC_FLASHDATA) & 0x3c;
++
++		for (e = bcma_sflash_at_tbl; e->name; e++) {
++			if (e->id == id)
++				break;
++		}
++		if (!e->name) {
++			bcma_err(bus, "Unsupported Atmel serial flash (id: 0x%X)\n", id);
++			return -ENOTSUPP;
++		}
++
++		break;
++	default:
++		bcma_err(bus, "Unsupported flash type\n");
++		return -ENOTSUPP;
++	}
++
++	sflash->window = BCMA_SOC_FLASH2;
++	sflash->blocksize = e->blocksize;
++	sflash->numblocks = e->numblocks;
++	sflash->size = sflash->blocksize * sflash->numblocks;
++	sflash->present = true;
++
++	bcma_info(bus, "Found %s serial flash (size: %dKiB, blocksize: 0x%X, blocks: %d)\n",
++		  e->name, sflash->size / 1024, sflash->blocksize,
++		  sflash->numblocks);
++
++	/* Prepare platform device, but don't register it yet. It's too early,
++	 * malloc (required by device_private_init) is not available yet. */
++	bcma_sflash_dev.resource[0].end = bcma_sflash_dev.resource[0].start +
++					  sflash->size;
++	bcma_sflash_dev.dev.platform_data = sflash;
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/bcma/driver_gmac_cmn.c
+@@ -0,0 +1,14 @@
++/*
++ * Broadcom specific AMBA
++ * GBIT MAC COMMON Core
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include "bcma_private.h"
++#include <linux/bcma/bcma.h>
++
++void __devinit bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc)
++{
++	mutex_init(&gc->phy_mutex);
++}
+--- /dev/null
++++ b/drivers/bcma/driver_gpio.c
+@@ -0,0 +1,98 @@
++/*
++ * Broadcom specific AMBA
++ * GPIO driver
++ *
++ * Copyright 2011, Broadcom Corporation
++ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/gpio.h>
++#include <linux/export.h>
++#include <linux/bcma/bcma.h>
++
++#include "bcma_private.h"
++
++static inline struct bcma_drv_cc *bcma_gpio_get_cc(struct gpio_chip *chip)
++{
++	return container_of(chip, struct bcma_drv_cc, gpio);
++}
++
++static int bcma_gpio_get_value(struct gpio_chip *chip, unsigned gpio)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	return !!bcma_chipco_gpio_in(cc, 1 << gpio);
++}
++
++static void bcma_gpio_set_value(struct gpio_chip *chip, unsigned gpio,
++				int value)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	bcma_chipco_gpio_out(cc, 1 << gpio, value ? 1 << gpio : 0);
++}
++
++static int bcma_gpio_direction_input(struct gpio_chip *chip, unsigned gpio)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	bcma_chipco_gpio_outen(cc, 1 << gpio, 0);
++	return 0;
++}
++
++static int bcma_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
++				      int value)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	bcma_chipco_gpio_outen(cc, 1 << gpio, 1 << gpio);
++	bcma_chipco_gpio_out(cc, 1 << gpio, value ? 1 << gpio : 0);
++	return 0;
++}
++
++static int bcma_gpio_request(struct gpio_chip *chip, unsigned gpio)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	bcma_chipco_gpio_control(cc, 1 << gpio, 0);
++	/* clear pulldown */
++	bcma_chipco_gpio_pulldown(cc, 1 << gpio, 0);
++	/* Set pullup */
++	bcma_chipco_gpio_pullup(cc, 1 << gpio, 1 << gpio);
++
++	return 0;
++}
++
++static void bcma_gpio_free(struct gpio_chip *chip, unsigned gpio)
++{
++	struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
++
++	/* clear pullup */
++	bcma_chipco_gpio_pullup(cc, 1 << gpio, 0);
++}
++
++int bcma_gpio_init(struct bcma_drv_cc *cc)
++{
++	struct gpio_chip *chip = &cc->gpio;
++
++	chip->label		= "bcma_gpio";
++	chip->owner		= THIS_MODULE;
++	chip->request		= bcma_gpio_request;
++	chip->free		= bcma_gpio_free;
++	chip->get		= bcma_gpio_get_value;
++	chip->set		= bcma_gpio_set_value;
++	chip->direction_input	= bcma_gpio_direction_input;
++	chip->direction_output	= bcma_gpio_direction_output;
++	chip->ngpio		= 16;
++	/* There is just one SoC in one device and its GPIO addresses should be
++	 * deterministic to address them more easily. The other buses could get
++	 * a random base number. */
++	if (cc->core->bus->hosttype == BCMA_HOSTTYPE_SOC)
++		chip->base		= 0;
++	else
++		chip->base		= -1;
++
++	return gpiochip_add(chip);
++}
+--- a/drivers/bcma/driver_mips.c
++++ b/drivers/bcma/driver_mips.c
+@@ -22,15 +22,15 @@
+ /* The 47162a0 hangs when reading MIPS DMP registers registers */
+ static inline bool bcma_core_mips_bcm47162a0_quirk(struct bcma_device *dev)
+ {
+-	return dev->bus->chipinfo.id == 47162 && dev->bus->chipinfo.rev == 0 &&
+-	       dev->id.id == BCMA_CORE_MIPS_74K;
++	return dev->bus->chipinfo.id == BCMA_CHIP_ID_BCM47162 &&
++	       dev->bus->chipinfo.rev == 0 && dev->id.id == BCMA_CORE_MIPS_74K;
+ }
+ 
+ /* The 5357b0 hangs when reading USB20H DMP registers */
+ static inline bool bcma_core_mips_bcm5357b0_quirk(struct bcma_device *dev)
+ {
+-	return (dev->bus->chipinfo.id == 0x5357 ||
+-		dev->bus->chipinfo.id == 0x4749) &&
++	return (dev->bus->chipinfo.id == BCMA_CHIP_ID_BCM5357 ||
++		dev->bus->chipinfo.id == BCMA_CHIP_ID_BCM4749) &&
+ 	       dev->bus->chipinfo.pkg == 11 &&
+ 	       dev->id.id == BCMA_CORE_USB20_HOST;
+ }
+@@ -74,11 +74,16 @@ static u32 bcma_core_mips_irqflag(struct
+ 		return dev->core_index;
+ 	flag = bcma_aread32(dev, BCMA_MIPS_OOBSELOUTA30);
+ 
+-	return flag & 0x1F;
++	if (flag)
++		return flag & 0x1F;
++	else
++		return 0x3f;
+ }
+ 
+ /* Get the MIPS IRQ assignment for a specified device.
+  * If unassigned, 0 is returned.
++ * If disabled, 5 is returned.
++ * If not supported, 6 is returned.
+  */
+ unsigned int bcma_core_mips_irq(struct bcma_device *dev)
+ {
+@@ -87,13 +92,15 @@ unsigned int bcma_core_mips_irq(struct b
+ 	unsigned int irq;
+ 
+ 	irqflag = bcma_core_mips_irqflag(dev);
++	if (irqflag == 0x3f)
++		return 6;
+ 
+-	for (irq = 1; irq <= 4; irq++)
++	for (irq = 0; irq <= 4; irq++)
+ 		if (bcma_read32(mdev, BCMA_MIPS_MIPS74K_INTMASK(irq)) &
+ 		    (1 << irqflag))
+ 			return irq;
+ 
+-	return 0;
++	return 5;
+ }
+ EXPORT_SYMBOL(bcma_core_mips_irq);
+ 
+@@ -114,8 +121,8 @@ static void bcma_core_mips_set_irq(struc
+ 		bcma_write32(mdev, BCMA_MIPS_MIPS74K_INTMASK(0),
+ 			    bcma_read32(mdev, BCMA_MIPS_MIPS74K_INTMASK(0)) &
+ 			    ~(1 << irqflag));
+-	else
+-		bcma_write32(mdev, BCMA_MIPS_MIPS74K_INTMASK(irq), 0);
++	else if (oldirq != 5)
++		bcma_write32(mdev, BCMA_MIPS_MIPS74K_INTMASK(oldirq), 0);
+ 
+ 	/* assign the new one */
+ 	if (irq == 0) {
+@@ -123,17 +130,17 @@ static void bcma_core_mips_set_irq(struc
+ 			    bcma_read32(mdev, BCMA_MIPS_MIPS74K_INTMASK(0)) |
+ 			    (1 << irqflag));
+ 	} else {
+-		u32 oldirqflag = bcma_read32(mdev,
+-					     BCMA_MIPS_MIPS74K_INTMASK(irq));
+-		if (oldirqflag) {
++		u32 irqinitmask = bcma_read32(mdev,
++					      BCMA_MIPS_MIPS74K_INTMASK(irq));
++		if (irqinitmask) {
+ 			struct bcma_device *core;
+ 
+ 			/* backplane irq line is in use, find out who uses
+ 			 * it and set user to irq 0
+ 			 */
+-			list_for_each_entry_reverse(core, &bus->cores, list) {
++			list_for_each_entry(core, &bus->cores, list) {
+ 				if ((1 << bcma_core_mips_irqflag(core)) ==
+-				    oldirqflag) {
++				    irqinitmask) {
+ 					bcma_core_mips_set_irq(core, 0);
+ 					break;
+ 				}
+@@ -143,15 +150,31 @@ static void bcma_core_mips_set_irq(struc
+ 			     1 << irqflag);
+ 	}
+ 
+-	pr_info("set_irq: core 0x%04x, irq %d => %d\n",
+-		dev->id.id, oldirq + 2, irq + 2);
++	bcma_debug(bus, "set_irq: core 0x%04x, irq %d => %d\n",
++		   dev->id.id, oldirq <= 4 ? oldirq + 2 : 0, irq + 2);
++}
++
++static void bcma_core_mips_set_irq_name(struct bcma_bus *bus, unsigned int irq,
++					u16 coreid, u8 unit)
++{
++	struct bcma_device *core;
++
++	core = bcma_find_core_unit(bus, coreid, unit);
++	if (!core) {
++		bcma_warn(bus,
++			  "Can not find core (id: 0x%x, unit %i) for IRQ configuration.\n",
++			  coreid, unit);
++		return;
++	}
++
++	bcma_core_mips_set_irq(core, irq);
+ }
+ 
+ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq)
+ {
+ 	int i;
+ 	static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"};
+-	printk(KERN_INFO KBUILD_MODNAME ": core 0x%04x, irq :", dev->id.id);
++	printk(KERN_DEBUG KBUILD_MODNAME ": core 0x%04x, irq :", dev->id.id);
+ 	for (i = 0; i <= 6; i++)
+ 		printk(" %s%s", irq_name[i], i == irq ? "*" : " ");
+ 	printk("\n");
+@@ -161,7 +184,7 @@ static void bcma_core_mips_dump_irq(stru
+ {
+ 	struct bcma_device *core;
+ 
+-	list_for_each_entry_reverse(core, &bus->cores, list) {
++	list_for_each_entry(core, &bus->cores, list) {
+ 		bcma_core_mips_print_irq(core, bcma_core_mips_irq(core));
+ 	}
+ }
+@@ -171,9 +194,9 @@ u32 bcma_cpu_clock(struct bcma_drv_mips
+ 	struct bcma_bus *bus = mcore->core->bus;
+ 
+ 	if (bus->drv_cc.capabilities & BCMA_CC_CAP_PMU)
+-		return bcma_pmu_get_clockcpu(&bus->drv_cc);
++		return bcma_pmu_get_cpu_clock(&bus->drv_cc);
+ 
+-	pr_err("No PMU available, need this to get the cpu clock\n");
++	bcma_err(bus, "No PMU available, need this to get the cpu clock\n");
+ 	return 0;
+ }
+ EXPORT_SYMBOL(bcma_cpu_clock);
+@@ -181,76 +204,109 @@ EXPORT_SYMBOL(bcma_cpu_clock);
+ static void bcma_core_mips_flash_detect(struct bcma_drv_mips *mcore)
+ {
+ 	struct bcma_bus *bus = mcore->core->bus;
++	struct bcma_drv_cc *cc = &bus->drv_cc;
+ 
+-	switch (bus->drv_cc.capabilities & BCMA_CC_CAP_FLASHT) {
++	switch (cc->capabilities & BCMA_CC_CAP_FLASHT) {
+ 	case BCMA_CC_FLASHT_STSER:
+ 	case BCMA_CC_FLASHT_ATSER:
+-		pr_err("Serial flash not supported.\n");
++		bcma_debug(bus, "Found serial flash\n");
++		bcma_sflash_init(cc);
+ 		break;
+ 	case BCMA_CC_FLASHT_PARA:
+-		pr_info("found parallel flash.\n");
+-		bus->drv_cc.pflash.window = 0x1c000000;
+-		bus->drv_cc.pflash.window_size = 0x02000000;
++		bcma_debug(bus, "Found parallel flash\n");
++		cc->pflash.present = true;
++		cc->pflash.window = BCMA_SOC_FLASH2;
++		cc->pflash.window_size = BCMA_SOC_FLASH2_SZ;
+ 
+-		if ((bcma_read32(bus->drv_cc.core, BCMA_CC_FLASH_CFG) &
++		if ((bcma_read32(cc->core, BCMA_CC_FLASH_CFG) &
+ 		     BCMA_CC_FLASH_CFG_DS) == 0)
+-			bus->drv_cc.pflash.buswidth = 1;
++			cc->pflash.buswidth = 1;
+ 		else
+-			bus->drv_cc.pflash.buswidth = 2;
++			cc->pflash.buswidth = 2;
+ 		break;
+ 	default:
+-		pr_err("flash not supported.\n");
++		bcma_err(bus, "Flash type not supported\n");
++	}
++
++	if (cc->core->id.rev == 38 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM4706) {
++		if (cc->capabilities & BCMA_CC_CAP_NFLASH) {
++			bcma_debug(bus, "Found NAND flash\n");
++			bcma_nflash_init(cc);
++		}
+ 	}
+ }
+ 
++void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
++{
++	struct bcma_bus *bus = mcore->core->bus;
++
++	if (mcore->early_setup_done)
++		return;
++
++	bcma_chipco_serial_init(&bus->drv_cc);
++	bcma_core_mips_flash_detect(mcore);
++
++	mcore->early_setup_done = true;
++}
++
+ void bcma_core_mips_init(struct bcma_drv_mips *mcore)
+ {
+ 	struct bcma_bus *bus;
+ 	struct bcma_device *core;
+ 	bus = mcore->core->bus;
+ 
+-	pr_info("Initializing MIPS core...\n");
++	if (mcore->setup_done)
++		return;
++
++	bcma_debug(bus, "Initializing MIPS core...\n");
+ 
+-	if (!mcore->setup_done)
+-		mcore->assigned_irqs = 1;
++	bcma_core_mips_early_init(mcore);
+ 
+-	/* Assign IRQs to all cores on the bus */
+-	list_for_each_entry_reverse(core, &bus->cores, list) {
+-		int mips_irq;
+-		if (core->irq)
+-			continue;
+-
+-		mips_irq = bcma_core_mips_irq(core);
+-		if (mips_irq > 4)
+-			core->irq = 0;
+-		else
+-			core->irq = mips_irq + 2;
+-		if (core->irq > 5)
+-			continue;
+-		switch (core->id.id) {
+-		case BCMA_CORE_PCI:
+-		case BCMA_CORE_PCIE:
+-		case BCMA_CORE_ETHERNET:
+-		case BCMA_CORE_ETHERNET_GBIT:
+-		case BCMA_CORE_MAC_GBIT:
+-		case BCMA_CORE_80211:
+-		case BCMA_CORE_USB20_HOST:
+-			/* These devices get their own IRQ line if available,
+-			 * the rest goes on IRQ0
+-			 */
+-			if (mcore->assigned_irqs <= 4)
+-				bcma_core_mips_set_irq(core,
+-						       mcore->assigned_irqs++);
+-			break;
++	switch (bus->chipinfo.id) {
++	case BCMA_CHIP_ID_BCM4716:
++	case BCMA_CHIP_ID_BCM4748:
++		bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_80211, 0);
++		bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_MAC_GBIT, 0);
++		bcma_core_mips_set_irq_name(bus, 3, BCMA_CORE_USB20_HOST, 0);
++		bcma_core_mips_set_irq_name(bus, 4, BCMA_CORE_PCIE, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_CHIPCOMMON, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_I2S, 0);
++		break;
++	case BCMA_CHIP_ID_BCM5356:
++	case BCMA_CHIP_ID_BCM47162:
++	case BCMA_CHIP_ID_BCM53572:
++		bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_80211, 0);
++		bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_MAC_GBIT, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_CHIPCOMMON, 0);
++		break;
++	case BCMA_CHIP_ID_BCM5357:
++	case BCMA_CHIP_ID_BCM4749:
++		bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_80211, 0);
++		bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_MAC_GBIT, 0);
++		bcma_core_mips_set_irq_name(bus, 3, BCMA_CORE_USB20_HOST, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_CHIPCOMMON, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_I2S, 0);
++		break;
++	case BCMA_CHIP_ID_BCM4706:
++		bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_PCIE, 0);
++		bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_4706_MAC_GBIT,
++					    0);
++		bcma_core_mips_set_irq_name(bus, 3, BCMA_CORE_PCIE, 1);
++		bcma_core_mips_set_irq_name(bus, 4, BCMA_CORE_USB20_HOST, 0);
++		bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_4706_CHIPCOMMON,
++					    0);
++		break;
++	default:
++		list_for_each_entry(core, &bus->cores, list) {
++			core->irq = bcma_core_mips_irq(core) + 2;
+ 		}
++		bcma_err(bus,
++			 "Unknown device (0x%x) found, can not configure IRQs\n",
++			 bus->chipinfo.id);
+ 	}
+-	pr_info("IRQ reconfiguration done\n");
++	bcma_debug(bus, "IRQ reconfiguration done\n");
+ 	bcma_core_mips_dump_irq(bus);
+ 
+-	if (mcore->setup_done)
+-		return;
+-
+-	bcma_chipco_serial_init(&bus->drv_cc);
+-	bcma_core_mips_flash_detect(mcore);
+ 	mcore->setup_done = true;
+ }
+--- a/drivers/bcma/driver_pci.c
++++ b/drivers/bcma/driver_pci.c
+@@ -2,8 +2,9 @@
+  * Broadcom specific AMBA
+  * PCI Core
+  *
+- * Copyright 2005, Broadcom Corporation
++ * Copyright 2005, 2011, Broadcom Corporation
+  * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
+  *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+@@ -16,120 +17,124 @@
+  * R/W ops.
+  **************************************************/
+ 
+-static u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
++u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	return pcicore_read32(pc, 0x134);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_DATA);
+ }
+ 
+-#if 0
+ static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
+ {
+-	pcicore_write32(pc, 0x130, address);
+-	pcicore_read32(pc, 0x130);
+-	pcicore_write32(pc, 0x134, data);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_PCIEIND_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
+ }
+-#endif
+ 
+ static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	u32 v;
+ 	int i;
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	v |= (0x1F << 18);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++	v |= (BCMA_CORE_PCI_MDIODATA_BLK_ADDR <<
++	      BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= (phy << 4);
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 
+ 	udelay(10);
+ 	for (i = 0; i < 200; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+-		msleep(1);
++		usleep_range(1000, 2000);
+ 	}
+ }
+ 
+ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u16 ret = 0;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 29); /* Read Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
+-	pcicore_write32(pc, mdio_data, v);
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_READ;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
++
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */) {
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE) {
+ 			udelay(10);
+-			ret = pcicore_read32(pc, mdio_data);
++			ret = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_DATA);
+ 			break;
+ 		}
+-		msleep(1);
++		usleep_range(1000, 2000);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ 	return ret;
+ }
+ 
+ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
+ 				u8 address, u16 data)
+ {
+-	const u16 mdio_control = 0x128;
+-	const u16 mdio_data = 0x12C;
+ 	int max_retries = 10;
+ 	u32 v;
+ 	int i;
+ 
+-	v = 0x80; /* Enable Preamble Sequence */
+-	v |= 0x2; /* MDIO Clock Divisor */
+-	pcicore_write32(pc, mdio_control, v);
++	/* enable mdio access to SERDES */
++	v = BCMA_CORE_PCI_MDIOCTL_PREAM_EN;
++	v |= BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL;
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, v);
+ 
+ 	if (pc->core->id.rev >= 10) {
+ 		max_retries = 200;
+ 		bcma_pcie_mdio_set_phy(pc, device);
++		v = (BCMA_CORE_PCI_MDIODATA_DEV_ADDR <<
++		     BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF);
++	} else {
++		v = (device << BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD);
++		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = (1 << 30); /* Start of Transaction */
+-	v |= (1 << 28); /* Write Transaction */
+-	v |= (1 << 17); /* Turnaround */
+-	if (pc->core->id.rev < 10)
+-		v |= (u32)device << 22;
+-	v |= (u32)address << 18;
++	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
++	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= data;
+-	pcicore_write32(pc, mdio_data, v);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_DATA, v);
+ 	/* Wait for the device to complete the transaction */
+ 	udelay(10);
+ 	for (i = 0; i < max_retries; i++) {
+-		v = pcicore_read32(pc, mdio_control);
+-		if (v & 0x100 /* Trans complete */)
++		v = pcicore_read32(pc, BCMA_CORE_PCI_MDIO_CONTROL);
++		if (v & BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE)
+ 			break;
+-		msleep(1);
++		usleep_range(1000, 2000);
+ 	}
+-	pcicore_write32(pc, mdio_control, 0);
++	pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
+ }
+ 
+ /**************************************************
+@@ -138,88 +143,108 @@ static void bcma_pcie_mdio_write(struct
+ 
+ static u8 bcma_pcicore_polarity_workaround(struct bcma_drv_pci *pc)
+ {
+-	return (bcma_pcie_read(pc, 0x204) & 0x10) ? 0xC0 : 0x80;
++	u32 tmp;
++
++	tmp = bcma_pcie_read(pc, BCMA_CORE_PCI_PLP_STATUSREG);
++	if (tmp & BCMA_CORE_PCI_PLP_POLARITYINV_STAT)
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE |
++		       BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY;
++	else
++		return BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE;
+ }
+ 
+ static void bcma_pcicore_serdes_workaround(struct bcma_drv_pci *pc)
+ {
+-	const u8 serdes_pll_device = 0x1D;
+-	const u8 serdes_rx_device = 0x1F;
+ 	u16 tmp;
+ 
+-	bcma_pcie_mdio_write(pc, serdes_rx_device, 1 /* Control */,
+-			      bcma_pcicore_polarity_workaround(pc));
+-	tmp = bcma_pcie_mdio_read(pc, serdes_pll_device, 1 /* Control */);
+-	if (tmp & 0x4000)
+-		bcma_pcie_mdio_write(pc, serdes_pll_device, 1, tmp & ~0x4000);
++	bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_RX,
++	                     BCMA_CORE_PCI_SERDES_RX_CTRL,
++			     bcma_pcicore_polarity_workaround(pc));
++	tmp = bcma_pcie_mdio_read(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++	                          BCMA_CORE_PCI_SERDES_PLL_CTRL);
++	if (tmp & BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN)
++		bcma_pcie_mdio_write(pc, BCMA_CORE_PCI_MDIODATA_DEV_PLL,
++		                     BCMA_CORE_PCI_SERDES_PLL_CTRL,
++		                     tmp & ~BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN);
++}
++
++static void bcma_core_pci_fixcfg(struct bcma_drv_pci *pc)
++{
++	struct bcma_device *core = pc->core;
++	u16 val16, core_index;
++	uint regoff;
++
++	regoff = BCMA_CORE_PCI_SPROM(BCMA_CORE_PCI_SPROM_PI_OFFSET);
++	core_index = (u16)core->core_index;
++
++	val16 = pcicore_read16(pc, regoff);
++	if (((val16 & BCMA_CORE_PCI_SPROM_PI_MASK) >> BCMA_CORE_PCI_SPROM_PI_SHIFT)
++	     != core_index) {
++		val16 = (core_index << BCMA_CORE_PCI_SPROM_PI_SHIFT) |
++			(val16 & ~BCMA_CORE_PCI_SPROM_PI_MASK);
++		pcicore_write16(pc, regoff, val16);
++	}
++}
++
++/* Fix MISC config to allow coming out of L2/L3-Ready state w/o PRST */
++/* Needs to happen when coming out of 'standby'/'hibernate' */
++static void bcma_core_pci_config_fixup(struct bcma_drv_pci *pc)
++{
++	u16 val16;
++	uint regoff;
++
++	regoff = BCMA_CORE_PCI_SPROM(BCMA_CORE_PCI_SPROM_MISC_CONFIG);
++
++	val16 = pcicore_read16(pc, regoff);
++
++	if (!(val16 & BCMA_CORE_PCI_SPROM_L23READY_EXIT_NOPERST)) {
++		val16 |= BCMA_CORE_PCI_SPROM_L23READY_EXIT_NOPERST;
++		pcicore_write16(pc, regoff, val16);
++	}
+ }
+ 
+ /**************************************************
+  * Init.
+  **************************************************/
+ 
+-static void bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
++static void __devinit bcma_core_pci_clientmode_init(struct bcma_drv_pci *pc)
+ {
++	bcma_core_pci_fixcfg(pc);
+ 	bcma_pcicore_serdes_workaround(pc);
++	bcma_core_pci_config_fixup(pc);
+ }
+ 
+-static bool bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
+-{
+-	struct bcma_bus *bus = pc->core->bus;
+-	u16 chipid_top;
+-
+-	chipid_top = (bus->chipinfo.id & 0xFF00);
+-	if (chipid_top != 0x4700 &&
+-	    chipid_top != 0x5300)
+-		return false;
+-
+-#ifdef CONFIG_SSB_DRIVER_PCICORE
+-	if (bus->sprom.boardflags_lo & SSB_BFL_NOPCI)
+-		return false;
+-#endif /* CONFIG_SSB_DRIVER_PCICORE */
+-
+-#if 0
+-	/* TODO: on BCMA we use address from EROM instead of magic formula */
+-	u32 tmp;
+-	return !mips_busprobe32(tmp, (bus->mmio +
+-		(pc->core->core_index * BCMA_CORE_SIZE)));
+-#endif
+-
+-	return true;
+-}
+-
+-void bcma_core_pci_init(struct bcma_drv_pci *pc)
++void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
+ {
+ 	if (pc->setup_done)
+ 		return;
+ 
+-	if (bcma_core_pci_is_in_hostmode(pc)) {
+ #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	pc->hostmode = bcma_core_pci_is_in_hostmode(pc);
++	if (pc->hostmode)
+ 		bcma_core_pci_hostmode_init(pc);
+-#else
+-		pr_err("Driver compiled without support for hostmode PCI\n");
+ #endif /* CONFIG_BCMA_DRIVER_PCI_HOSTMODE */
+-	} else {
+-		bcma_core_pci_clientmode_init(pc);
+-	}
+ 
+-	pc->setup_done = true;
++	if (!pc->hostmode)
++		bcma_core_pci_clientmode_init(pc);
+ }
+ 
+ int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
+ 			  bool enable)
+ {
+-	struct pci_dev *pdev = pc->core->bus->host_pci;
++	struct pci_dev *pdev;
+ 	u32 coremask, tmp;
+ 	int err = 0;
+ 
+-	if (core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
++	if (!pc || core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
+ 		/* This bcma device is not on a PCI host-bus. So the IRQs are
+ 		 * not routed through the PCI core.
+ 		 * So we must not enable routing through the PCI core. */
+ 		goto out;
+ 	}
+ 
++	pdev = pc->core->bus->host_pci;
++
+ 	err = pci_read_config_dword(pdev, BCMA_PCI_IRQMASK, &tmp);
+ 	if (err)
+ 		goto out;
+@@ -236,3 +261,17 @@ out:
+ 	return err;
+ }
+ EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
++
++void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend)
++{
++	u32 w;
++
++	w = bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_PMTHRESHREG);
++	if (extend)
++		w |= BCMA_CORE_PCI_ASPMTIMER_EXTEND;
++	else
++		w &= ~BCMA_CORE_PCI_ASPMTIMER_EXTEND;
++	bcma_pcie_write(pc, BCMA_CORE_PCI_DLLP_PMTHRESHREG, w);
++	bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_PMTHRESHREG);
++}
++EXPORT_SYMBOL_GPL(bcma_core_pci_extend_L1timer);
+--- a/drivers/bcma/driver_pci_host.c
++++ b/drivers/bcma/driver_pci_host.c
+@@ -2,13 +2,600 @@
+  * Broadcom specific AMBA
+  * PCI Core in hostmode
+  *
++ * Copyright 2005 - 2011, Broadcom Corporation
++ * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+ #include "bcma_private.h"
++#include <linux/pci.h>
++#include <linux/export.h>
+ #include <linux/bcma/bcma.h>
++#include <asm/paccess.h>
++
++/* Probe a 32bit value on the bus and catch bus exceptions.
++ * Returns nonzero on a bus exception.
++ * This is MIPS specific */
++#define mips_busprobe32(val, addr)	get_dbe((val), ((u32 *)(addr)))
++
++/* Assume one-hot slot wiring */
++#define BCMA_PCI_SLOT_MAX	16
++#define	PCI_CONFIG_SPACE_SIZE	256
++
++bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u16 chipid_top;
++	u32 tmp;
++
++	chipid_top = (bus->chipinfo.id & 0xFF00);
++	if (chipid_top != 0x4700 &&
++	    chipid_top != 0x5300)
++		return false;
++
++	bcma_core_enable(pc->core, 0);
++
++	return !mips_busprobe32(tmp, pc->core->io_addr);
++}
++
++static u32 bcma_pcie_read_config(struct bcma_drv_pci *pc, u32 address)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	return pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_DATA);
++}
++
++static void bcma_pcie_write_config(struct bcma_drv_pci *pc, u32 address,
++				   u32 data)
++{
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_ADDR, address);
++	pcicore_read32(pc, BCMA_CORE_PCI_CONFIG_ADDR);
++	pcicore_write32(pc, BCMA_CORE_PCI_CONFIG_DATA, data);
++}
++
++static u32 bcma_get_cfgspace_addr(struct bcma_drv_pci *pc, unsigned int dev,
++			     unsigned int func, unsigned int off)
++{
++	u32 addr = 0;
++
++	/* Issue config commands only when the data link is up (atleast
++	 * one external pcie device is present).
++	 */
++	if (dev >= 2 || !(bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_LSREG)
++			  & BCMA_CORE_PCI_DLLP_LSREG_LINKUP))
++		goto out;
++
++	/* Type 0 transaction */
++	/* Slide the PCI window to the appropriate slot */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++	/* Calculate the address */
++	addr = pc->host_controller->host_cfg_addr;
++	addr |= (dev << BCMA_CORE_PCI_CFG_SLOT_SHIFT);
++	addr |= (func << BCMA_CORE_PCI_CFG_FUN_SHIFT);
++	addr |= (off & ~3);
++
++out:
++	return addr;
++}
+ 
+-void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
++				  unsigned int func, unsigned int off,
++				  void *buf, int len)
+ {
+-	pr_err("No support for PCI core in hostmode yet\n");
++	int err = -EINVAL;
++	u32 addr, val;
++	void __iomem *mmio = 0;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* we support only two functions on device 0 */
++		if (func > 1)
++			return -EINVAL;
++
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off >= PCI_CONFIG_SPACE_SIZE) {
++			addr = (func << 12);
++			addr |= (off & 0x0FFF);
++			val = bcma_pcie_read_config(pc, addr);
++		} else {
++			addr = BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			val = pcicore_read32(pc, addr);
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, sizeof(val));
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++
++		val = readl(mmio);
++	}
++	val >>= (8 * (off & 3));
++
++	switch (len) {
++	case 1:
++		*((u8 *)buf) = (u8)val;
++		break;
++	case 2:
++		*((u16 *)buf) = (u16)val;
++		break;
++	case 4:
++		*((u32 *)buf) = (u32)val;
++		break;
++	}
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
++				   unsigned int func, unsigned int off,
++				   const void *buf, int len)
++{
++	int err = -EINVAL;
++	u32 addr = 0, val = 0;
++	void __iomem *mmio = 0;
++	u16 chipid = pc->core->bus->chipinfo.id;
++
++	WARN_ON(!pc->hostmode);
++	if (unlikely(len != 1 && len != 2 && len != 4))
++		goto out;
++	if (dev == 0) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		if (off < PCI_CONFIG_SPACE_SIZE) {
++			addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
++			addr |= (func << 8);
++			addr |= (off & 0xfc);
++			mmio = ioremap_nocache(addr, sizeof(val));
++			if (!mmio)
++				goto out;
++		}
++	} else {
++		addr = bcma_get_cfgspace_addr(pc, dev, func, off);
++		if (unlikely(!addr))
++			goto out;
++		err = -ENOMEM;
++		mmio = ioremap_nocache(addr, sizeof(val));
++		if (!mmio)
++			goto out;
++
++		if (mips_busprobe32(val, mmio)) {
++			val = 0xffffffff;
++			goto unmap;
++		}
++	}
++
++	switch (len) {
++	case 1:
++		val = readl(mmio);
++		val &= ~(0xFF << (8 * (off & 3)));
++		val |= *((const u8 *)buf) << (8 * (off & 3));
++		break;
++	case 2:
++		val = readl(mmio);
++		val &= ~(0xFFFF << (8 * (off & 3)));
++		val |= *((const u16 *)buf) << (8 * (off & 3));
++		break;
++	case 4:
++		val = *((const u32 *)buf);
++		break;
++	}
++	if (dev == 0 && !addr) {
++		/* accesses to config registers with offsets >= 256
++		 * requires indirect access.
++		 */
++		addr = (func << 12);
++		addr |= (off & 0x0FFF);
++		bcma_pcie_write_config(pc, addr, val);
++	} else {
++		writel(val, mmio);
++
++		if (chipid == BCMA_CHIP_ID_BCM4716 ||
++		    chipid == BCMA_CHIP_ID_BCM4748)
++			readl(mmio);
++	}
++
++	err = 0;
++unmap:
++	if (mmio)
++		iounmap(mmio);
++out:
++	return err;
++}
++
++static int bcma_core_pci_hostmode_read_config(struct pci_bus *bus,
++					      unsigned int devfn,
++					      int reg, int size, u32 *val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_read_config(pc, PCI_SLOT(devfn),
++				     PCI_FUNC(devfn), reg, val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++static int bcma_core_pci_hostmode_write_config(struct pci_bus *bus,
++					       unsigned int devfn,
++					       int reg, int size, u32 val)
++{
++	unsigned long flags;
++	int err;
++	struct bcma_drv_pci *pc;
++	struct bcma_drv_pci_host *pc_host;
++
++	pc_host = container_of(bus->ops, struct bcma_drv_pci_host, pci_ops);
++	pc = pc_host->pdev;
++
++	spin_lock_irqsave(&pc_host->cfgspace_lock, flags);
++	err = bcma_extpci_write_config(pc, PCI_SLOT(devfn),
++				      PCI_FUNC(devfn), reg, &val, size);
++	spin_unlock_irqrestore(&pc_host->cfgspace_lock, flags);
++
++	return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
++}
++
++/* return cap_offset if requested capability exists in the PCI config space */
++static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
++					     unsigned int dev,
++					     unsigned int func, u8 req_cap_id,
++					     unsigned char *buf, u32 *buflen)
++{
++	u8 cap_id;
++	u8 cap_ptr = 0;
++	u32 bufsize;
++	u8 byte_val;
++
++	/* check for Header type 0 */
++	bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
++				sizeof(u8));
++	if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
++		return cap_ptr;
++
++	/* check if the capability pointer field exists */
++	bcma_extpci_read_config(pc, dev, func, PCI_STATUS, &byte_val,
++				sizeof(u8));
++	if (!(byte_val & PCI_STATUS_CAP_LIST))
++		return cap_ptr;
++
++	/* check if the capability pointer is 0x00 */
++	bcma_extpci_read_config(pc, dev, func, PCI_CAPABILITY_LIST, &cap_ptr,
++				sizeof(u8));
++	if (cap_ptr == 0x00)
++		return cap_ptr;
++
++	/* loop thr'u the capability list and see if the requested capabilty
++	 * exists */
++	bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id, sizeof(u8));
++	while (cap_id != req_cap_id) {
++		bcma_extpci_read_config(pc, dev, func, cap_ptr + 1, &cap_ptr,
++					sizeof(u8));
++		if (cap_ptr == 0x00)
++			return cap_ptr;
++		bcma_extpci_read_config(pc, dev, func, cap_ptr, &cap_id,
++					sizeof(u8));
++	}
++
++	/* found the caller requested capability */
++	if ((buf != NULL) && (buflen != NULL)) {
++		u8 cap_data;
++
++		bufsize = *buflen;
++		if (!bufsize)
++			return cap_ptr;
++
++		*buflen = 0;
++
++		/* copy the cpability data excluding cap ID and next ptr */
++		cap_data = cap_ptr + 2;
++		if ((bufsize + cap_data)  > PCI_CONFIG_SPACE_SIZE)
++			bufsize = PCI_CONFIG_SPACE_SIZE - cap_data;
++		*buflen = bufsize;
++		while (bufsize--) {
++			bcma_extpci_read_config(pc, dev, func, cap_data, buf,
++						sizeof(u8));
++			cap_data++;
++			buf++;
++		}
++	}
++
++	return cap_ptr;
++}
++
++/* If the root port is capable of returning Config Request
++ * Retry Status (CRS) Completion Status to software then
++ * enable the feature.
++ */
++static void __devinit bcma_core_pci_enable_crs(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	u8 cap_ptr, root_ctrl, root_cap, dev;
++	u16 val16;
++	int i;
++
++	cap_ptr = bcma_find_pci_capability(pc, 0, 0, PCI_CAP_ID_EXP, NULL,
++					   NULL);
++	root_cap = cap_ptr + PCI_EXP_RTCAP;
++	bcma_extpci_read_config(pc, 0, 0, root_cap, &val16, sizeof(u16));
++	if (val16 & BCMA_CORE_PCI_RC_CRS_VISIBILITY) {
++		/* Enable CRS software visibility */
++		root_ctrl = cap_ptr + PCI_EXP_RTCTL;
++		val16 = PCI_EXP_RTCTL_CRSSVE;
++		bcma_extpci_read_config(pc, 0, 0, root_ctrl, &val16,
++					sizeof(u16));
++
++		/* Initiate a configuration request to read the vendor id
++		 * field of the device function's config space header after
++		 * 100 ms wait time from the end of Reset. If the device is
++		 * not done with its internal initialization, it must at
++		 * least return a completion TLP, with a completion status
++		 * of "Configuration Request Retry Status (CRS)". The root
++		 * complex must complete the request to the host by returning
++		 * a read-data value of 0001h for the Vendor ID field and
++		 * all 1s for any additional bytes included in the request.
++		 * Poll using the config reads for max wait time of 1 sec or
++		 * until we receive the successful completion status. Repeat
++		 * the procedure for all the devices.
++		 */
++		for (dev = 1; dev < BCMA_PCI_SLOT_MAX; dev++) {
++			for (i = 0; i < 100000; i++) {
++				bcma_extpci_read_config(pc, dev, 0,
++							PCI_VENDOR_ID, &val16,
++							sizeof(val16));
++				if (val16 != 0x1)
++					break;
++				udelay(10);
++			}
++			if (val16 == 0x1)
++				bcma_err(bus, "PCI: Broken device in slot %d\n",
++					 dev);
++		}
++	}
++}
++
++void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
++{
++	struct bcma_bus *bus = pc->core->bus;
++	struct bcma_drv_pci_host *pc_host;
++	u32 tmp;
++	u32 pci_membase_1G;
++	unsigned long io_map_base;
++
++	bcma_info(bus, "PCIEcore in host mode found\n");
++
++	if (bus->sprom.boardflags_lo & BCMA_CORE_PCI_BFL_NOPCI) {
++		bcma_info(bus, "This PCIE core is disabled and not working\n");
++		return;
++	}
++
++	pc_host = kzalloc(sizeof(*pc_host), GFP_KERNEL);
++	if (!pc_host)  {
++		bcma_err(bus, "can not allocate memory");
++		return;
++	}
++
++	pc->host_controller = pc_host;
++	pc_host->pci_controller.io_resource = &pc_host->io_resource;
++	pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
++	pc_host->pci_controller.pci_ops = &pc_host->pci_ops;
++	pc_host->pdev = pc;
++
++	pci_membase_1G = BCMA_SOC_PCI_DMA;
++	pc_host->host_cfg_addr = BCMA_SOC_PCI_CFG;
++
++	pc_host->pci_ops.read = bcma_core_pci_hostmode_read_config;
++	pc_host->pci_ops.write = bcma_core_pci_hostmode_write_config;
++
++	pc_host->mem_resource.name = "BCMA PCIcore external memory",
++	pc_host->mem_resource.start = BCMA_SOC_PCI_DMA;
++	pc_host->mem_resource.end = BCMA_SOC_PCI_DMA + BCMA_SOC_PCI_DMA_SZ - 1;
++	pc_host->mem_resource.flags = IORESOURCE_MEM | IORESOURCE_PCI_FIXED;
++
++	pc_host->io_resource.name = "BCMA PCIcore external I/O",
++	pc_host->io_resource.start = 0x100;
++	pc_host->io_resource.end = 0x7FF;
++	pc_host->io_resource.flags = IORESOURCE_IO | IORESOURCE_PCI_FIXED;
++
++	/* Reset RC */
++	usleep_range(3000, 5000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
++	usleep_range(1000, 2000);
++	pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
++			BCMA_CORE_PCI_CTL_RST_OE);
++
++	/* 64 MB I/O access window. On 4716, use
++	 * sbtopcie0 to access the device registers. We
++	 * can't use address match 2 (1 GB window) region
++	 * as mips can't generate 64-bit address on the
++	 * backplane.
++	 */
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4716 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM4748) {
++		pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++		pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++					    BCMA_SOC_PCI_MEM_SZ - 1;
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_MEM | BCMA_SOC_PCI_MEM);
++	} else if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706) {
++		tmp = BCMA_CORE_PCI_SBTOPCI_MEM;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_PREF;
++		tmp |= BCMA_CORE_PCI_SBTOPCI_BURST;
++		if (pc->core->core_unit == 0) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pc_host->io_resource.start = 0x100;
++			pc_host->io_resource.end = 0x47F;
++			pci_membase_1G = BCMA_SOC_PCIE_DMA_H32;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI_MEM);
++		} else if (pc->core->core_unit == 1) {
++			pc_host->mem_resource.start = BCMA_SOC_PCI1_MEM;
++			pc_host->mem_resource.end = BCMA_SOC_PCI1_MEM +
++						    BCMA_SOC_PCI_MEM_SZ - 1;
++			pc_host->io_resource.start = 0x480;
++			pc_host->io_resource.end = 0x7FF;
++			pci_membase_1G = BCMA_SOC_PCIE1_DMA_H32;
++			pc_host->host_cfg_addr = BCMA_SOC_PCI1_CFG;
++			pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++					tmp | BCMA_SOC_PCI1_MEM);
++		}
++	} else
++		pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI0,
++				BCMA_CORE_PCI_SBTOPCI_IO);
++
++	/* 64 MB configuration access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI1, BCMA_CORE_PCI_SBTOPCI_CFG0);
++
++	/* 1 GB memory access window */
++	pcicore_write32(pc, BCMA_CORE_PCI_SBTOPCI2,
++			BCMA_CORE_PCI_SBTOPCI_MEM | pci_membase_1G);
++
++
++	/* As per PCI Express Base Spec 1.1 we need to wait for
++	 * at least 100 ms from the end of a reset (cold/warm/hot)
++	 * before issuing configuration requests to PCI Express
++	 * devices.
++	 */
++	msleep(100);
++
++	bcma_core_pci_enable_crs(pc);
++
++	/* Enable PCI bridge BAR0 memory & master access */
++	tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
++	bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
++
++	/* Enable PCI interrupts */
++	pcicore_write32(pc, BCMA_CORE_PCI_IMASK, BCMA_CORE_PCI_IMASK_INTA);
++
++	/* Ok, ready to run, register it to the system.
++	 * The following needs change, if we want to port hostmode
++	 * to non-MIPS platform. */
++	io_map_base = (unsigned long)ioremap_nocache(pc_host->mem_resource.start,
++						     resource_size(&pc_host->mem_resource));
++	pc_host->pci_controller.io_map_base = io_map_base;
++	set_io_port_base(pc_host->pci_controller.io_map_base);
++	/* Give some time to the PCI controller to configure itself with the new
++	 * values. Not waiting at this point causes crashes of the machine. */
++	usleep_range(10000, 15000);
++	register_pci_controller(&pc_host->pci_controller);
++	return;
++}
++
++/* Early PCI fixup for a device on the PCI-core bridge. */
++static void bcma_core_pci_fixup_pcibridge(struct pci_dev *dev)
++{
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) != 0)
++		return;
++
++	pr_info("PCI: Fixing up bridge %s\n", pci_name(dev));
++
++	/* Enable PCI bridge bus mastering and memory space */
++	pci_set_master(dev);
++	if (pcibios_enable_device(dev, ~0) < 0) {
++		pr_err("PCI: BCMA bridge enable failed\n");
++		return;
++	}
++
++	/* Enable PCI bridge BAR1 prefetch and burst */
++	pci_write_config_dword(dev, BCMA_PCI_BAR1_CONTROL, 3);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
++
++/* Early PCI fixup for all PCI-cores to set the correct memory address. */
++static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
++{
++	struct resource *res;
++	int pos, err;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return;
++	}
++	if (PCI_SLOT(dev->devfn) == 0)
++		return;
++
++	pr_info("PCI: Fixing up addresses %s\n", pci_name(dev));
++
++	for (pos = 0; pos < 6; pos++) {
++		res = &dev->resource[pos];
++		if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM)) {
++			err = pci_assign_resource(dev, pos);
++			if (err)
++				pr_err("PCI: Problem fixing up the addresses on %s\n",
++				       pci_name(dev));
++		}
++	}
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
++
++/* This function is called when doing a pci_enable_device().
++ * We must first check if the device is a device on the PCI-core bridge. */
++int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++
++	pr_info("PCI: Fixing up device %s\n", pci_name(dev));
++
++	/* Fix up interrupt lines */
++	dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
++	pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
++
++	return 0;
++}
++EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
++
++/* PCI device IRQ mapping. */
++int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
++{
++	struct bcma_drv_pci_host *pc_host;
++
++	if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
++		/* This is not a device on the PCI-core bridge. */
++		return -ENODEV;
++	}
++
++	pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
++			       pci_ops);
++	return bcma_core_mips_irq(pc_host->pdev->core) + 2;
+ }
++EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
+--- a/drivers/bcma/host_pci.c
++++ b/drivers/bcma/host_pci.c
+@@ -18,7 +18,7 @@ static void bcma_host_pci_switch_core(st
+ 	pci_write_config_dword(core->bus->host_pci, BCMA_PCI_BAR0_WIN2,
+ 			       core->wrap);
+ 	core->bus->mapped_core = core;
+-	pr_debug("Switched to core: 0x%X\n", core->id.id);
++	bcma_debug(core->bus, "Switched to core: 0x%X\n", core->id.id);
+ }
+ 
+ /* Provides access to the requested core. Returns base offset that has to be
+@@ -77,8 +77,8 @@ static void bcma_host_pci_write32(struct
+ }
+ 
+ #ifdef CONFIG_BCMA_BLOCKIO
+-void bcma_host_pci_block_read(struct bcma_device *core, void *buffer,
+-			      size_t count, u16 offset, u8 reg_width)
++static void bcma_host_pci_block_read(struct bcma_device *core, void *buffer,
++				     size_t count, u16 offset, u8 reg_width)
+ {
+ 	void __iomem *addr = core->bus->mmio + offset;
+ 	if (core->bus->mapped_core != core)
+@@ -100,8 +100,9 @@ void bcma_host_pci_block_read(struct bcm
+ 	}
+ }
+ 
+-void bcma_host_pci_block_write(struct bcma_device *core, const void *buffer,
+-			       size_t count, u16 offset, u8 reg_width)
++static void bcma_host_pci_block_write(struct bcma_device *core,
++				      const void *buffer, size_t count,
++				      u16 offset, u8 reg_width)
+ {
+ 	void __iomem *addr = core->bus->mmio + offset;
+ 	if (core->bus->mapped_core != core)
+@@ -139,7 +140,7 @@ static void bcma_host_pci_awrite32(struc
+ 	iowrite32(value, core->bus->mmio + (1 * BCMA_CORE_SIZE) + offset);
+ }
+ 
+-const struct bcma_host_ops bcma_host_pci_ops = {
++static const struct bcma_host_ops bcma_host_pci_ops = {
+ 	.read8		= bcma_host_pci_read8,
+ 	.read16		= bcma_host_pci_read16,
+ 	.read32		= bcma_host_pci_read32,
+@@ -154,8 +155,8 @@ const struct bcma_host_ops bcma_host_pci
+ 	.awrite32	= bcma_host_pci_awrite32,
+ };
+ 
+-static int bcma_host_pci_probe(struct pci_dev *dev,
+-			     const struct pci_device_id *id)
++static int __devinit bcma_host_pci_probe(struct pci_dev *dev,
++					 const struct pci_device_id *id)
+ {
+ 	struct bcma_bus *bus;
+ 	int err = -ENOMEM;
+@@ -188,7 +189,7 @@ static int bcma_host_pci_probe(struct pc
+ 
+ 	/* SSB needed additional powering up, do we have any AMBA PCI cards? */
+ 	if (!pci_is_pcie(dev))
+-		pr_err("PCI card detected, report problems.\n");
++		bcma_err(bus, "PCI card detected, report problems.\n");
+ 
+ 	/* Map MMIO */
+ 	err = -ENOMEM;
+@@ -201,6 +202,9 @@ static int bcma_host_pci_probe(struct pc
+ 	bus->hosttype = BCMA_HOSTTYPE_PCI;
+ 	bus->ops = &bcma_host_pci_ops;
+ 
++	bus->boardinfo.vendor = bus->host_pci->subsystem_vendor;
++	bus->boardinfo.type = bus->host_pci->subsystem_device;
++
+ 	/* Register */
+ 	err = bcma_bus_register(bus);
+ 	if (err)
+@@ -222,7 +226,7 @@ err_kfree_bus:
+ 	return err;
+ }
+ 
+-static void bcma_host_pci_remove(struct pci_dev *dev)
++static void __devexit bcma_host_pci_remove(struct pci_dev *dev)
+ {
+ 	struct bcma_bus *bus = pci_get_drvdata(dev);
+ 
+@@ -234,7 +238,7 @@ static void bcma_host_pci_remove(struct
+ 	pci_set_drvdata(dev, NULL);
+ }
+ 
+-#ifdef CONFIG_PM
++#ifdef CONFIG_PM_SLEEP
+ static int bcma_host_pci_suspend(struct device *dev)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+@@ -257,17 +261,20 @@ static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bc
+ 			 bcma_host_pci_resume);
+ #define BCMA_PM_OPS	(&bcma_pm_ops)
+ 
+-#else /* CONFIG_PM */
++#else /* CONFIG_PM_SLEEP */
+ 
+ #define BCMA_PM_OPS     NULL
+ 
+-#endif /* CONFIG_PM */
++#endif /* CONFIG_PM_SLEEP */
+ 
+ static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4357) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4358) },
++	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },
+ 	{ 0, },
+ };
+@@ -277,7 +284,7 @@ static struct pci_driver bcma_pci_bridge
+ 	.name = "bcma-pci-bridge",
+ 	.id_table = bcma_pci_bridge_tbl,
+ 	.probe = bcma_host_pci_probe,
+-	.remove = bcma_host_pci_remove,
++	.remove = __devexit_p(bcma_host_pci_remove),
+ 	.driver.pm = BCMA_PM_OPS,
+ };
+ 
+--- a/drivers/bcma/host_soc.c
++++ b/drivers/bcma/host_soc.c
+@@ -143,7 +143,7 @@ static void bcma_host_soc_awrite32(struc
+ 	writel(value, core->io_wrap + offset);
+ }
+ 
+-const struct bcma_host_ops bcma_host_soc_ops = {
++static const struct bcma_host_ops bcma_host_soc_ops = {
+ 	.read8		= bcma_host_soc_read8,
+ 	.read16		= bcma_host_soc_read16,
+ 	.read32		= bcma_host_soc_read32,
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -7,12 +7,19 @@
+ 
+ #include "bcma_private.h"
+ #include <linux/module.h>
++#include <linux/platform_device.h>
+ #include <linux/bcma/bcma.h>
+ #include <linux/slab.h>
+ 
+ MODULE_DESCRIPTION("Broadcom's specific AMBA driver");
+ MODULE_LICENSE("GPL");
+ 
++/* contains the number the next bus should get. */
++static unsigned int bcma_bus_next_num = 0;
++
++/* bcma_buses_mutex locks the bcma_bus_next_num */
++static DEFINE_MUTEX(bcma_buses_mutex);
++
+ static int bcma_bus_match(struct device *dev, struct device_driver *drv);
+ static int bcma_device_probe(struct device *dev);
+ static int bcma_device_remove(struct device *dev);
+@@ -55,7 +62,14 @@ static struct bus_type bcma_bus_type = {
+ 	.dev_attrs	= bcma_device_attrs,
+ };
+ 
+-static struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
++static u16 bcma_cc_core_id(struct bcma_bus *bus)
++{
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706)
++		return BCMA_CORE_4706_CHIPCOMMON;
++	return BCMA_CORE_CHIPCOMMON;
++}
++
++struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
+ {
+ 	struct bcma_device *core;
+ 
+@@ -65,6 +79,19 @@ static struct bcma_device *bcma_find_cor
+ 	}
+ 	return NULL;
+ }
++EXPORT_SYMBOL_GPL(bcma_find_core);
++
++struct bcma_device *bcma_find_core_unit(struct bcma_bus *bus, u16 coreid,
++					u8 unit)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry(core, &bus->cores, list) {
++		if (core->id.id == coreid && core->core_unit == unit)
++			return core;
++	}
++	return NULL;
++}
+ 
+ static void bcma_release_core_dev(struct device *dev)
+ {
+@@ -84,16 +111,18 @@ static int bcma_register_cores(struct bc
+ 	list_for_each_entry(core, &bus->cores, list) {
+ 		/* We support that cores ourself */
+ 		switch (core->id.id) {
++		case BCMA_CORE_4706_CHIPCOMMON:
+ 		case BCMA_CORE_CHIPCOMMON:
+ 		case BCMA_CORE_PCI:
+ 		case BCMA_CORE_PCIE:
+ 		case BCMA_CORE_MIPS_74K:
++		case BCMA_CORE_4706_MAC_GBIT_COMMON:
+ 			continue;
+ 		}
+ 
+ 		core->dev.release = bcma_release_core_dev;
+ 		core->dev.bus = &bcma_bus_type;
+-		dev_set_name(&core->dev, "bcma%d:%d", 0/*bus->num*/, dev_id);
++		dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
+ 
+ 		switch (bus->hosttype) {
+ 		case BCMA_HOSTTYPE_PCI:
+@@ -111,41 +140,90 @@ static int bcma_register_cores(struct bc
+ 
+ 		err = device_register(&core->dev);
+ 		if (err) {
+-			pr_err("Could not register dev for core 0x%03X\n",
+-			       core->id.id);
++			bcma_err(bus,
++				 "Could not register dev for core 0x%03X\n",
++				 core->id.id);
+ 			continue;
+ 		}
+ 		core->dev_registered = true;
+ 		dev_id++;
+ 	}
+ 
++#ifdef CONFIG_BCMA_SFLASH
++	if (bus->drv_cc.sflash.present) {
++		err = platform_device_register(&bcma_sflash_dev);
++		if (err)
++			bcma_err(bus, "Error registering serial flash\n");
++	}
++#endif
++
++#ifdef CONFIG_BCMA_NFLASH
++	if (bus->drv_cc.nflash.present) {
++		err = platform_device_register(&bcma_nflash_dev);
++		if (err)
++			bcma_err(bus, "Error registering NAND flash\n");
++	}
++#endif
++	err = bcma_gpio_init(&bus->drv_cc);
++	if (err == -ENOTSUPP)
++		bcma_debug(bus, "GPIO driver not activated\n");
++	else if (err)
++		bcma_err(bus, "Error registering GPIO driver: %i\n", err);
++
++	if (bus->hosttype == BCMA_HOSTTYPE_SOC) {
++		err = bcma_chipco_watchdog_register(&bus->drv_cc);
++		if (err)
++			bcma_err(bus, "Error registering watchdog driver\n");
++	}
++
+ 	return 0;
+ }
+ 
+ static void bcma_unregister_cores(struct bcma_bus *bus)
+ {
+-	struct bcma_device *core;
++	struct bcma_device *core, *tmp;
+ 
+-	list_for_each_entry(core, &bus->cores, list) {
++	list_for_each_entry_safe(core, tmp, &bus->cores, list) {
++		list_del(&core->list);
+ 		if (core->dev_registered)
+ 			device_unregister(&core->dev);
+ 	}
++	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
++		platform_device_unregister(bus->drv_cc.watchdog);
+ }
+ 
+-int bcma_bus_register(struct bcma_bus *bus)
++int __devinit bcma_bus_register(struct bcma_bus *bus)
+ {
+ 	int err;
+ 	struct bcma_device *core;
+ 
++	mutex_lock(&bcma_buses_mutex);
++	bus->num = bcma_bus_next_num++;
++	mutex_unlock(&bcma_buses_mutex);
++
+ 	/* Scan for devices (cores) */
+ 	err = bcma_bus_scan(bus);
+ 	if (err) {
+-		pr_err("Failed to scan: %d\n", err);
++		bcma_err(bus, "Failed to scan: %d\n", err);
+ 		return -1;
+ 	}
+ 
++	/* Early init CC core */
++	core = bcma_find_core(bus, bcma_cc_core_id(bus));
++	if (core) {
++		bus->drv_cc.core = core;
++		bcma_core_chipcommon_early_init(&bus->drv_cc);
++	}
++
++	/* Try to get SPROM */
++	err = bcma_sprom_get(bus);
++	if (err == -ENOENT) {
++		bcma_err(bus, "No SPROM available\n");
++	} else if (err)
++		bcma_err(bus, "Failed to get SPROM: %d\n", err);
++
+ 	/* Init CC core */
+-	core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
++	core = bcma_find_core(bus, bcma_cc_core_id(bus));
+ 	if (core) {
+ 		bus->drv_cc.core = core;
+ 		bcma_core_chipcommon_init(&bus->drv_cc);
+@@ -159,30 +237,47 @@ int bcma_bus_register(struct bcma_bus *b
+ 	}
+ 
+ 	/* Init PCIE core */
+-	core = bcma_find_core(bus, BCMA_CORE_PCIE);
++	core = bcma_find_core_unit(bus, BCMA_CORE_PCIE, 0);
+ 	if (core) {
+-		bus->drv_pci.core = core;
+-		bcma_core_pci_init(&bus->drv_pci);
++		bus->drv_pci[0].core = core;
++		bcma_core_pci_init(&bus->drv_pci[0]);
+ 	}
+ 
+-	/* Try to get SPROM */
+-	err = bcma_sprom_get(bus);
+-	if (err == -ENOENT) {
+-		pr_err("No SPROM available\n");
+-	} else if (err)
+-		pr_err("Failed to get SPROM: %d\n", err);
++	/* Init PCIE core */
++	core = bcma_find_core_unit(bus, BCMA_CORE_PCIE, 1);
++	if (core) {
++		bus->drv_pci[1].core = core;
++		bcma_core_pci_init(&bus->drv_pci[1]);
++	}
++
++	/* Init GBIT MAC COMMON core */
++	core = bcma_find_core(bus, BCMA_CORE_4706_MAC_GBIT_COMMON);
++	if (core) {
++		bus->drv_gmac_cmn.core = core;
++		bcma_core_gmac_cmn_init(&bus->drv_gmac_cmn);
++	}
+ 
+ 	/* Register found cores */
+ 	bcma_register_cores(bus);
+ 
+-	pr_info("Bus registered\n");
++	bcma_info(bus, "Bus registered\n");
+ 
+ 	return 0;
+ }
+ 
+ void bcma_bus_unregister(struct bcma_bus *bus)
+ {
++	struct bcma_device *cores[3];
++
++	cores[0] = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
++	cores[1] = bcma_find_core(bus, BCMA_CORE_PCIE);
++	cores[2] = bcma_find_core(bus, BCMA_CORE_4706_MAC_GBIT_COMMON);
++
+ 	bcma_unregister_cores(bus);
++
++	kfree(cores[2]);
++	kfree(cores[1]);
++	kfree(cores[0]);
+ }
+ 
+ int __init bcma_bus_early_register(struct bcma_bus *bus,
+@@ -196,14 +291,14 @@ int __init bcma_bus_early_register(struc
+ 	bcma_init_bus(bus);
+ 
+ 	match.manuf = BCMA_MANUF_BCM;
+-	match.id = BCMA_CORE_CHIPCOMMON;
++	match.id = bcma_cc_core_id(bus);
+ 	match.class = BCMA_CL_SIM;
+ 	match.rev = BCMA_ANY_REV;
+ 
+ 	/* Scan for chip common core */
+ 	err = bcma_bus_scan_early(bus, &match, core_cc);
+ 	if (err) {
+-		pr_err("Failed to scan for common core: %d\n", err);
++		bcma_err(bus, "Failed to scan for common core: %d\n", err);
+ 		return -1;
+ 	}
+ 
+@@ -215,25 +310,25 @@ int __init bcma_bus_early_register(struc
+ 	/* Scan for mips core */
+ 	err = bcma_bus_scan_early(bus, &match, core_mips);
+ 	if (err) {
+-		pr_err("Failed to scan for mips core: %d\n", err);
++		bcma_err(bus, "Failed to scan for mips core: %d\n", err);
+ 		return -1;
+ 	}
+ 
+-	/* Init CC core */
+-	core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
++	/* Early init CC core */
++	core = bcma_find_core(bus, bcma_cc_core_id(bus));
+ 	if (core) {
+ 		bus->drv_cc.core = core;
+-		bcma_core_chipcommon_init(&bus->drv_cc);
++		bcma_core_chipcommon_early_init(&bus->drv_cc);
+ 	}
+ 
+-	/* Init MIPS core */
++	/* Early init MIPS core */
+ 	core = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
+ 	if (core) {
+ 		bus->drv_mips.core = core;
+-		bcma_core_mips_init(&bus->drv_mips);
++		bcma_core_mips_early_init(&bus->drv_mips);
+ 	}
+ 
+-	pr_info("Early bus registered\n");
++	bcma_info(bus, "Early bus registered\n");
+ 
+ 	return 0;
+ }
+@@ -259,8 +354,7 @@ int bcma_bus_resume(struct bcma_bus *bus
+ 	struct bcma_device *core;
+ 
+ 	/* Init CC core */
+-	core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
+-	if (core) {
++	if (bus->drv_cc.core) {
+ 		bus->drv_cc.setup_done = false;
+ 		bcma_core_chipcommon_init(&bus->drv_cc);
+ 	}
+--- a/drivers/bcma/scan.c
++++ b/drivers/bcma/scan.c
+@@ -19,15 +19,27 @@ struct bcma_device_id_name {
+ 	u16 id;
+ 	const char *name;
+ };
+-struct bcma_device_id_name bcma_device_names[] = {
++
++static const struct bcma_device_id_name bcma_arm_device_names[] = {
++	{ BCMA_CORE_4706_MAC_GBIT_COMMON, "BCM4706 GBit MAC Common" },
++	{ BCMA_CORE_ARM_1176, "ARM 1176" },
++	{ BCMA_CORE_ARM_7TDMI, "ARM 7TDMI" },
++	{ BCMA_CORE_ARM_CM3, "ARM CM3" },
++};
++
++static const struct bcma_device_id_name bcma_bcm_device_names[] = {
+ 	{ BCMA_CORE_OOB_ROUTER, "OOB Router" },
++	{ BCMA_CORE_4706_CHIPCOMMON, "BCM4706 ChipCommon" },
++	{ BCMA_CORE_4706_SOC_RAM, "BCM4706 SOC RAM" },
++	{ BCMA_CORE_4706_MAC_GBIT, "BCM4706 GBit MAC" },
++	{ BCMA_CORE_AMEMC, "AMEMC (DDR)" },
++	{ BCMA_CORE_ALTA, "ALTA (I2S)" },
+ 	{ BCMA_CORE_INVALID, "Invalid" },
+ 	{ BCMA_CORE_CHIPCOMMON, "ChipCommon" },
+ 	{ BCMA_CORE_ILINE20, "ILine 20" },
+ 	{ BCMA_CORE_SRAM, "SRAM" },
+ 	{ BCMA_CORE_SDRAM, "SDRAM" },
+ 	{ BCMA_CORE_PCI, "PCI" },
+-	{ BCMA_CORE_MIPS, "MIPS" },
+ 	{ BCMA_CORE_ETHERNET, "Fast Ethernet" },
+ 	{ BCMA_CORE_V90, "V90" },
+ 	{ BCMA_CORE_USB11_HOSTDEV, "USB 1.1 Hostdev" },
+@@ -44,7 +56,6 @@ struct bcma_device_id_name bcma_device_n
+ 	{ BCMA_CORE_PHY_A, "PHY A" },
+ 	{ BCMA_CORE_PHY_B, "PHY B" },
+ 	{ BCMA_CORE_PHY_G, "PHY G" },
+-	{ BCMA_CORE_MIPS_3302, "MIPS 3302" },
+ 	{ BCMA_CORE_USB11_HOST, "USB 1.1 Host" },
+ 	{ BCMA_CORE_USB11_DEV, "USB 1.1 Device" },
+ 	{ BCMA_CORE_USB20_HOST, "USB 2.0 Host" },
+@@ -58,15 +69,11 @@ struct bcma_device_id_name bcma_device_n
+ 	{ BCMA_CORE_PHY_N, "PHY N" },
+ 	{ BCMA_CORE_SRAM_CTL, "SRAM Controller" },
+ 	{ BCMA_CORE_MINI_MACPHY, "Mini MACPHY" },
+-	{ BCMA_CORE_ARM_1176, "ARM 1176" },
+-	{ BCMA_CORE_ARM_7TDMI, "ARM 7TDMI" },
+ 	{ BCMA_CORE_PHY_LP, "PHY LP" },
+ 	{ BCMA_CORE_PMU, "PMU" },
+ 	{ BCMA_CORE_PHY_SSN, "PHY SSN" },
+ 	{ BCMA_CORE_SDIO_DEV, "SDIO Device" },
+-	{ BCMA_CORE_ARM_CM3, "ARM CM3" },
+ 	{ BCMA_CORE_PHY_HT, "PHY HT" },
+-	{ BCMA_CORE_MIPS_74K, "MIPS 74K" },
+ 	{ BCMA_CORE_MAC_GBIT, "GBit MAC" },
+ 	{ BCMA_CORE_DDR12_MEM_CTL, "DDR1/DDR2 Memory Controller" },
+ 	{ BCMA_CORE_PCIE_RC, "PCIe Root Complex" },
+@@ -79,16 +86,41 @@ struct bcma_device_id_name bcma_device_n
+ 	{ BCMA_CORE_SHIM, "SHIM" },
+ 	{ BCMA_CORE_DEFAULT, "Default" },
+ };
+-const char *bcma_device_name(struct bcma_device_id *id)
++
++static const struct bcma_device_id_name bcma_mips_device_names[] = {
++	{ BCMA_CORE_MIPS, "MIPS" },
++	{ BCMA_CORE_MIPS_3302, "MIPS 3302" },
++	{ BCMA_CORE_MIPS_74K, "MIPS 74K" },
++};
++
++static const char *bcma_device_name(const struct bcma_device_id *id)
+ {
+-	int i;
++	const struct bcma_device_id_name *names;
++	int size, i;
+ 
+-	if (id->manuf == BCMA_MANUF_BCM) {
+-		for (i = 0; i < ARRAY_SIZE(bcma_device_names); i++) {
+-			if (bcma_device_names[i].id == id->id)
+-				return bcma_device_names[i].name;
+-		}
++	/* search manufacturer specific names */
++	switch (id->manuf) {
++	case BCMA_MANUF_ARM:
++		names = bcma_arm_device_names;
++		size = ARRAY_SIZE(bcma_arm_device_names);
++		break;
++	case BCMA_MANUF_BCM:
++		names = bcma_bcm_device_names;
++		size = ARRAY_SIZE(bcma_bcm_device_names);
++		break;
++	case BCMA_MANUF_MIPS:
++		names = bcma_mips_device_names;
++		size = ARRAY_SIZE(bcma_mips_device_names);
++		break;
++	default:
++		return "UNKNOWN";
+ 	}
++
++	for (i = 0; i < size; i++) {
++		if (names[i].id == id->id)
++			return names[i].name;
++	}
++
+ 	return "UNKNOWN";
+ }
+ 
+@@ -212,6 +244,17 @@ static struct bcma_device *bcma_find_cor
+ 	return NULL;
+ }
+ 
++static struct bcma_device *bcma_find_core_reverse(struct bcma_bus *bus, u16 coreid)
++{
++	struct bcma_device *core;
++
++	list_for_each_entry_reverse(core, &bus->cores, list) {
++		if (core->id.id == coreid)
++			return core;
++	}
++	return NULL;
++}
++
+ static int bcma_get_next_core(struct bcma_bus *bus, u32 __iomem **eromptr,
+ 			      struct bcma_device_id *match, int core_num,
+ 			      struct bcma_device *core)
+@@ -252,11 +295,15 @@ static int bcma_get_next_core(struct bcm
+ 
+ 	/* check if component is a core at all */
+ 	if (wrappers[0] + wrappers[1] == 0) {
+-		/* we could save addrl of the router
+-		if (cid == BCMA_CORE_OOB_ROUTER)
+-		 */
+-		bcma_erom_skip_component(bus, eromptr);
+-		return -ENXIO;
++		/* Some specific cores don't need wrappers */
++		switch (core->id.id) {
++		case BCMA_CORE_4706_MAC_GBIT_COMMON:
++		/* Not used yet: case BCMA_CORE_OOB_ROUTER: */
++			break;
++		default:
++			bcma_erom_skip_component(bus, eromptr);
++			return -ENXIO;
++		}
+ 	}
+ 
+ 	if (bcma_erom_is_bridge(bus, eromptr)) {
+@@ -286,6 +333,23 @@ static int bcma_get_next_core(struct bcm
+ 			return -EILSEQ;
+ 	}
+ 
++	/* First Slave Address Descriptor should be port 0:
++	 * the main register space for the core
++	 */
++	tmp = bcma_erom_get_addr_desc(bus, eromptr, SCAN_ADDR_TYPE_SLAVE, 0);
++	if (tmp <= 0) {
++		/* Try again to see if it is a bridge */
++		tmp = bcma_erom_get_addr_desc(bus, eromptr,
++					      SCAN_ADDR_TYPE_BRIDGE, 0);
++		if (tmp <= 0) {
++			return -EILSEQ;
++		} else {
++			bcma_info(bus, "Bridge found\n");
++			return -ENXIO;
++		}
++	}
++	core->addr = tmp;
++
+ 	/* get & parse slave ports */
+ 	for (i = 0; i < ports[1]; i++) {
+ 		for (j = 0; ; j++) {
+@@ -298,7 +362,7 @@ static int bcma_get_next_core(struct bcm
+ 				break;
+ 			} else {
+ 				if (i == 0 && j == 0)
+-					core->addr = tmp;
++					core->addr1 = tmp;
+ 			}
+ 		}
+ 	}
+@@ -353,6 +417,7 @@ static int bcma_get_next_core(struct bcm
+ void bcma_init_bus(struct bcma_bus *bus)
+ {
+ 	s32 tmp;
++	struct bcma_chipinfo *chipinfo = &(bus->chipinfo);
+ 
+ 	if (bus->init_done)
+ 		return;
+@@ -363,9 +428,12 @@ void bcma_init_bus(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, BCMA_ADDR_BASE);
+ 
+ 	tmp = bcma_scan_read32(bus, 0, BCMA_CC_ID);
+-	bus->chipinfo.id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
+-	bus->chipinfo.rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
+-	bus->chipinfo.pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	chipinfo->id = (tmp & BCMA_CC_ID_ID) >> BCMA_CC_ID_ID_SHIFT;
++	chipinfo->rev = (tmp & BCMA_CC_ID_REV) >> BCMA_CC_ID_REV_SHIFT;
++	chipinfo->pkg = (tmp & BCMA_CC_ID_PKG) >> BCMA_CC_ID_PKG_SHIFT;
++	bcma_info(bus, "Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
++		  chipinfo->id, chipinfo->rev, chipinfo->pkg);
++
+ 	bus->init_done = true;
+ }
+ 
+@@ -392,9 +460,12 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 	bcma_scan_switch_core(bus, erombase);
+ 
+ 	while (eromptr < eromend) {
++		struct bcma_device *other_core;
+ 		struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
+-		if (!core)
+-			return -ENOMEM;
++		if (!core) {
++			err = -ENOMEM;
++			goto out;
++		}
+ 		INIT_LIST_HEAD(&core->list);
+ 		core->bus = bus;
+ 
+@@ -409,25 +480,28 @@ int bcma_bus_scan(struct bcma_bus *bus)
+ 			} else if (err == -ESPIPE) {
+ 				break;
+ 			}
+-			return err;
++			goto out;
+ 		}
+ 
+ 		core->core_index = core_num++;
+ 		bus->nr_cores++;
++		other_core = bcma_find_core_reverse(bus, core->id.id);
++		core->core_unit = (other_core == NULL) ? 0 : other_core->core_unit + 1;
+ 
+-		pr_info("Core %d found: %s "
+-			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
+-			core->core_index, bcma_device_name(&core->id),
+-			core->id.manuf, core->id.id, core->id.rev,
+-			core->id.class);
++		bcma_info(bus, "Core %d found: %s (manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
++			  core->core_index, bcma_device_name(&core->id),
++			  core->id.manuf, core->id.id, core->id.rev,
++			  core->id.class);
+ 
+-		list_add(&core->list, &bus->cores);
++		list_add_tail(&core->list, &bus->cores);
+ 	}
+ 
++	err = 0;
++out:
+ 	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
+ 		iounmap(eromptr);
+ 
+-	return 0;
++	return err;
+ }
+ 
+ int __init bcma_bus_scan_early(struct bcma_bus *bus,
+@@ -467,21 +541,21 @@ int __init bcma_bus_scan_early(struct bc
+ 		else if (err == -ESPIPE)
+ 			break;
+ 		else if (err < 0)
+-			return err;
++			goto out;
+ 
+ 		core->core_index = core_num++;
+ 		bus->nr_cores++;
+-		pr_info("Core %d found: %s "
+-			"(manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
+-			core->core_index, bcma_device_name(&core->id),
+-			core->id.manuf, core->id.id, core->id.rev,
+-			core->id.class);
++		bcma_info(bus, "Core %d found: %s (manuf 0x%03X, id 0x%03X, rev 0x%02X, class 0x%X)\n",
++			  core->core_index, bcma_device_name(&core->id),
++			  core->id.manuf, core->id.id, core->id.rev,
++			  core->id.class);
+ 
+-		list_add(&core->list, &bus->cores);
++		list_add_tail(&core->list, &bus->cores);
+ 		err = 0;
+ 		break;
+ 	}
+ 
++out:
+ 	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
+ 		iounmap(eromptr);
+ 
+--- a/drivers/bcma/scan.h
++++ b/drivers/bcma/scan.h
+@@ -27,7 +27,7 @@
+ #define SCAN_CIB_NMW		0x0007C000
+ #define SCAN_CIB_NMW_SHIFT	14
+ #define SCAN_CIB_NSW		0x00F80000
+-#define SCAN_CIB_NSW_SHIFT	17
++#define SCAN_CIB_NSW_SHIFT	19
+ #define SCAN_CIB_REV		0xFF000000
+ #define SCAN_CIB_REV_SHIFT	24
+ 
+--- a/drivers/bcma/sprom.c
++++ b/drivers/bcma/sprom.c
+@@ -2,6 +2,8 @@
+  * Broadcom specific AMBA
+  * SPROM reading
+  *
++ * Copyright 2011, 2012, Hauke Mehrtens <hauke@hauke-m.de>
++ *
+  * Licensed under the GNU/GPL. See COPYING for details.
+  */
+ 
+@@ -14,7 +16,57 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
+ 
+-#define SPOFF(offset)	((offset) / sizeof(u16))
++static int(*get_fallback_sprom)(struct bcma_bus *dev, struct ssb_sprom *out);
++
++/**
++ * bcma_arch_register_fallback_sprom - Registers a method providing a
++ * fallback SPROM if no SPROM is found.
++ *
++ * @sprom_callback: The callback function.
++ *
++ * With this function the architecture implementation may register a
++ * callback handler which fills the SPROM data structure. The fallback is
++ * used for PCI based BCMA devices, where no valid SPROM can be found
++ * in the shadow registers and to provide the SPROM for SoCs where BCMA is
++ * to controll the system bus.
++ *
++ * This function is useful for weird architectures that have a half-assed
++ * BCMA device hardwired to their PCI bus.
++ *
++ * This function is available for architecture code, only. So it is not
++ * exported.
++ */
++int bcma_arch_register_fallback_sprom(int (*sprom_callback)(struct bcma_bus *bus,
++				     struct ssb_sprom *out))
++{
++	if (get_fallback_sprom)
++		return -EEXIST;
++	get_fallback_sprom = sprom_callback;
++
++	return 0;
++}
++
++static int bcma_fill_sprom_with_fallback(struct bcma_bus *bus,
++					 struct ssb_sprom *out)
++{
++	int err;
++
++	if (!get_fallback_sprom) {
++		err = -ENOENT;
++		goto fail;
++	}
++
++	err = get_fallback_sprom(bus, out);
++	if (err)
++		goto fail;
++
++	bcma_debug(bus, "Using SPROM revision %d provided by platform.\n",
++		   bus->sprom.revision);
++	return 0;
++fail:
++	bcma_warn(bus, "Using fallback SPROM failed (err %d)\n", err);
++	return err;
++}
+ 
+ /**************************************************
+  * R/W ops.
+@@ -124,10 +176,37 @@ static int bcma_sprom_valid(const u16 *s
+  * SPROM extraction.
+  **************************************************/
+ 
++#define SPOFF(offset)	((offset) / sizeof(u16))
++
++#define SPEX(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((sprom[SPOFF(_offset)] & (_mask)) >> (_shift))
++
++#define SPEX32(_field, _offset, _mask, _shift)	\
++	bus->sprom._field = ((((u32)sprom[SPOFF((_offset)+2)] << 16 | \
++				sprom[SPOFF(_offset)]) & (_mask)) >> (_shift))
++
++#define SPEX_ARRAY8(_field, _offset, _mask, _shift)	\
++	do {	\
++		SPEX(_field[0], _offset +  0, _mask, _shift);	\
++		SPEX(_field[1], _offset +  2, _mask, _shift);	\
++		SPEX(_field[2], _offset +  4, _mask, _shift);	\
++		SPEX(_field[3], _offset +  6, _mask, _shift);	\
++		SPEX(_field[4], _offset +  8, _mask, _shift);	\
++		SPEX(_field[5], _offset + 10, _mask, _shift);	\
++		SPEX(_field[6], _offset + 12, _mask, _shift);	\
++		SPEX(_field[7], _offset + 14, _mask, _shift);	\
++	} while (0)
++
+ static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
+ {
+-	u16 v;
++	u16 v, o;
+ 	int i;
++	u16 pwr_info_offset[] = {
++		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
++		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
++	};
++	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
++			ARRAY_SIZE(bus->sprom.core_pwr_info));
+ 
+ 	bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
+ 		SSB_SPROM_REVISION_REV;
+@@ -137,107 +216,390 @@ static void bcma_sprom_extract_r8(struct
+ 		*(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
+ 	}
+ 
+-	bus->sprom.board_rev = sprom[SPOFF(SSB_SPROM8_BOARDREV)];
++	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
++
++	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
++	     SSB_SPROM4_TXPID2G0_SHIFT);
++	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
++	     SSB_SPROM4_TXPID2G1_SHIFT);
++	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
++	     SSB_SPROM4_TXPID2G2_SHIFT);
++	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
++	     SSB_SPROM4_TXPID2G3_SHIFT);
++
++	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
++	     SSB_SPROM4_TXPID5GL0_SHIFT);
++	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
++	     SSB_SPROM4_TXPID5GL1_SHIFT);
++	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
++	     SSB_SPROM4_TXPID5GL2_SHIFT);
++	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
++	     SSB_SPROM4_TXPID5GL3_SHIFT);
++
++	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
++	     SSB_SPROM4_TXPID5G0_SHIFT);
++	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
++	     SSB_SPROM4_TXPID5G1_SHIFT);
++	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
++	     SSB_SPROM4_TXPID5G2_SHIFT);
++	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
++	     SSB_SPROM4_TXPID5G3_SHIFT);
++
++	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
++	     SSB_SPROM4_TXPID5GH0_SHIFT);
++	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
++	     SSB_SPROM4_TXPID5GH1_SHIFT);
++	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
++	     SSB_SPROM4_TXPID5GH2_SHIFT);
++	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
++	     SSB_SPROM4_TXPID5GH3_SHIFT);
++
++	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
++	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
++	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
++	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
++
++	SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
++	SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
++
++	/* Extract cores power info info */
++	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
++		o = pwr_info_offset[i];
++		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_ITSSI, SSB_SPROM8_2G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
++			SSB_SPROM8_2G_MAXP, 0);
++
++		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SROM8_2G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SROM8_2G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SROM8_2G_PA_2, ~0, 0);
++
++		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_ITSSI, SSB_SPROM8_5G_ITSSI_SHIFT);
++		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SROM8_5G_MAXP_ITSSI,
++			SSB_SPROM8_5G_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GH_MAXP, 0);
++		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM8_5GHL_MAXP,
++			SSB_SPROM8_5GL_MAXP, SSB_SPROM8_5GL_MAXP_SHIFT);
++
++		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SROM8_5GL_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SROM8_5GL_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SROM8_5GL_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SROM8_5G_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SROM8_5G_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SROM8_5G_PA_2, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SROM8_5GH_PA_0, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SROM8_5GH_PA_1, ~0, 0);
++		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
++	}
+ 
+-	bus->sprom.txpid2g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
+-	     SSB_SPROM4_TXPID2G0) >> SSB_SPROM4_TXPID2G0_SHIFT;
+-	bus->sprom.txpid2g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID2G01)] &
+-	     SSB_SPROM4_TXPID2G1) >> SSB_SPROM4_TXPID2G1_SHIFT;
+-	bus->sprom.txpid2g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
+-	     SSB_SPROM4_TXPID2G2) >> SSB_SPROM4_TXPID2G2_SHIFT;
+-	bus->sprom.txpid2g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID2G23)] &
+-	     SSB_SPROM4_TXPID2G3) >> SSB_SPROM4_TXPID2G3_SHIFT;
+-
+-	bus->sprom.txpid5gl[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
+-	     SSB_SPROM4_TXPID5GL0) >> SSB_SPROM4_TXPID5GL0_SHIFT;
+-	bus->sprom.txpid5gl[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL01)] &
+-	     SSB_SPROM4_TXPID5GL1) >> SSB_SPROM4_TXPID5GL1_SHIFT;
+-	bus->sprom.txpid5gl[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
+-	     SSB_SPROM4_TXPID5GL2) >> SSB_SPROM4_TXPID5GL2_SHIFT;
+-	bus->sprom.txpid5gl[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GL23)] &
+-	     SSB_SPROM4_TXPID5GL3) >> SSB_SPROM4_TXPID5GL3_SHIFT;
+-
+-	bus->sprom.txpid5g[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
+-	     SSB_SPROM4_TXPID5G0) >> SSB_SPROM4_TXPID5G0_SHIFT;
+-	bus->sprom.txpid5g[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5G01)] &
+-	     SSB_SPROM4_TXPID5G1) >> SSB_SPROM4_TXPID5G1_SHIFT;
+-	bus->sprom.txpid5g[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
+-	     SSB_SPROM4_TXPID5G2) >> SSB_SPROM4_TXPID5G2_SHIFT;
+-	bus->sprom.txpid5g[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5G23)] &
+-	     SSB_SPROM4_TXPID5G3) >> SSB_SPROM4_TXPID5G3_SHIFT;
+-
+-	bus->sprom.txpid5gh[0] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
+-	     SSB_SPROM4_TXPID5GH0) >> SSB_SPROM4_TXPID5GH0_SHIFT;
+-	bus->sprom.txpid5gh[1] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH01)] &
+-	     SSB_SPROM4_TXPID5GH1) >> SSB_SPROM4_TXPID5GH1_SHIFT;
+-	bus->sprom.txpid5gh[2] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
+-	     SSB_SPROM4_TXPID5GH2) >> SSB_SPROM4_TXPID5GH2_SHIFT;
+-	bus->sprom.txpid5gh[3] = (sprom[SPOFF(SSB_SPROM4_TXPID5GH23)] &
+-	     SSB_SPROM4_TXPID5GH3) >> SSB_SPROM4_TXPID5GH3_SHIFT;
+-
+-	bus->sprom.boardflags_lo = sprom[SPOFF(SSB_SPROM8_BFLLO)];
+-	bus->sprom.boardflags_hi = sprom[SPOFF(SSB_SPROM8_BFLHI)];
+-	bus->sprom.boardflags2_lo = sprom[SPOFF(SSB_SPROM8_BFL2LO)];
+-	bus->sprom.boardflags2_hi = sprom[SPOFF(SSB_SPROM8_BFL2HI)];
+-
+-	bus->sprom.country_code = sprom[SPOFF(SSB_SPROM8_CCODE)];
+-
+-	bus->sprom.fem.ghz2.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
+-	bus->sprom.fem.ghz2.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
+-	bus->sprom.fem.ghz2.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
+-	bus->sprom.fem.ghz2.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
+-	bus->sprom.fem.ghz2.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM2G)] &
+-		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
+-
+-	bus->sprom.fem.ghz5.tssipos = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_TSSIPOS) >> SSB_SROM8_FEM_TSSIPOS_SHIFT;
+-	bus->sprom.fem.ghz5.extpa_gain = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_EXTPA_GAIN) >> SSB_SROM8_FEM_EXTPA_GAIN_SHIFT;
+-	bus->sprom.fem.ghz5.pdet_range = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_PDET_RANGE) >> SSB_SROM8_FEM_PDET_RANGE_SHIFT;
+-	bus->sprom.fem.ghz5.tr_iso = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_TR_ISO) >> SSB_SROM8_FEM_TR_ISO_SHIFT;
+-	bus->sprom.fem.ghz5.antswlut = (sprom[SPOFF(SSB_SPROM8_FEM5G)] &
+-		SSB_SROM8_FEM_ANTSWLUT) >> SSB_SROM8_FEM_ANTSWLUT_SHIFT;
++	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
++	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
++	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
++	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
++	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
++	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
++	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
++	     SSB_SROM8_FEM_TR_ISO_SHIFT);
++	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
++	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
++
++	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
++	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
++	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
++	     SSB_SPROM8_ANTAVAIL_BG_SHIFT);
++	SPEX(maxpwr_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_MAXP_BG_MASK, 0);
++	SPEX(itssi_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_ITSSI_BG,
++	     SSB_SPROM8_ITSSI_BG_SHIFT);
++	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
++	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
++	     SSB_SPROM8_ITSSI_A_SHIFT);
++	SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
++	SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
++	     SSB_SPROM8_MAXP_AL_SHIFT);
++	SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
++	SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
++	     SSB_SPROM8_GPIOA_P1_SHIFT);
++	SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
++	SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
++	     SSB_SPROM8_GPIOB_P3_SHIFT);
++	SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
++	SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
++	     SSB_SPROM8_TRI5G_SHIFT);
++	SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
++	SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
++	     SSB_SPROM8_TRI5GH_SHIFT);
++	SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G,
++	     SSB_SPROM8_RXPO2G_SHIFT);
++	SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
++	     SSB_SPROM8_RXPO5G_SHIFT);
++	SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
++	SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
++	     SSB_SPROM8_RSSISMC2G_SHIFT);
++	SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
++	     SSB_SPROM8_RSSISAV2G_SHIFT);
++	SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
++	     SSB_SPROM8_BXA2G_SHIFT);
++	SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
++	SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
++	     SSB_SPROM8_RSSISMC5G_SHIFT);
++	SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
++	     SSB_SPROM8_RSSISAV5G_SHIFT);
++	SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
++	     SSB_SPROM8_BXA5G_SHIFT);
++
++	SPEX(pa0b0, SSB_SPROM8_PA0B0, ~0, 0);
++	SPEX(pa0b1, SSB_SPROM8_PA0B1, ~0, 0);
++	SPEX(pa0b2, SSB_SPROM8_PA0B2, ~0, 0);
++	SPEX(pa1b0, SSB_SPROM8_PA1B0, ~0, 0);
++	SPEX(pa1b1, SSB_SPROM8_PA1B1, ~0, 0);
++	SPEX(pa1b2, SSB_SPROM8_PA1B2, ~0, 0);
++	SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, ~0, 0);
++	SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, ~0, 0);
++	SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, ~0, 0);
++	SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, ~0, 0);
++	SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, ~0, 0);
++	SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, ~0, 0);
++	SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, ~0, 0);
++	SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, ~0, 0);
++	SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, ~0, 0);
++	SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, ~0, 0);
++	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, ~0, 0);
++
++	/* Extract the antenna gain values. */
++	SPEX(antenna_gain.a0, SSB_SPROM8_AGAIN01,
++	     SSB_SPROM8_AGAIN0, SSB_SPROM8_AGAIN0_SHIFT);
++	SPEX(antenna_gain.a1, SSB_SPROM8_AGAIN01,
++	     SSB_SPROM8_AGAIN1, SSB_SPROM8_AGAIN1_SHIFT);
++	SPEX(antenna_gain.a2, SSB_SPROM8_AGAIN23,
++	     SSB_SPROM8_AGAIN2, SSB_SPROM8_AGAIN2_SHIFT);
++	SPEX(antenna_gain.a3, SSB_SPROM8_AGAIN23,
++	     SSB_SPROM8_AGAIN3, SSB_SPROM8_AGAIN3_SHIFT);
++
++	SPEX(leddc_on_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_ON,
++	     SSB_SPROM8_LEDDC_ON_SHIFT);
++	SPEX(leddc_off_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_OFF,
++	     SSB_SPROM8_LEDDC_OFF_SHIFT);
++
++	SPEX(txchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_TXCHAIN,
++	     SSB_SPROM8_TXRXC_TXCHAIN_SHIFT);
++	SPEX(rxchain, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_RXCHAIN,
++	     SSB_SPROM8_TXRXC_RXCHAIN_SHIFT);
++	SPEX(antswitch, SSB_SPROM8_TXRXC, SSB_SPROM8_TXRXC_SWITCH,
++	     SSB_SPROM8_TXRXC_SWITCH_SHIFT);
++
++	SPEX(opo, SSB_SPROM8_OFDM2GPO, 0x00ff, 0);
++
++	SPEX_ARRAY8(mcs2gpo, SSB_SPROM8_2G_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5gpo, SSB_SPROM8_5G_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5glpo, SSB_SPROM8_5GL_MCSPO, ~0, 0);
++	SPEX_ARRAY8(mcs5ghpo, SSB_SPROM8_5GH_MCSPO, ~0, 0);
++
++	SPEX(rawtempsense, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_RAWTEMP,
++	     SSB_SPROM8_RAWTS_RAWTEMP_SHIFT);
++	SPEX(measpower, SSB_SPROM8_RAWTS, SSB_SPROM8_RAWTS_MEASPOWER,
++	     SSB_SPROM8_RAWTS_MEASPOWER_SHIFT);
++	SPEX(tempsense_slope, SSB_SPROM8_OPT_CORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE,
++	     SSB_SPROM8_OPT_CORRX_TEMP_SLOPE_SHIFT);
++	SPEX(tempcorrx, SSB_SPROM8_OPT_CORRX, SSB_SPROM8_OPT_CORRX_TEMPCORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMPCORRX_SHIFT);
++	SPEX(tempsense_option, SSB_SPROM8_OPT_CORRX,
++	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION,
++	     SSB_SPROM8_OPT_CORRX_TEMP_OPTION_SHIFT);
++	SPEX(freqoffset_corr, SSB_SPROM8_HWIQ_IQSWP,
++	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR,
++	     SSB_SPROM8_HWIQ_IQSWP_FREQ_CORR_SHIFT);
++	SPEX(iqcal_swp_dis, SSB_SPROM8_HWIQ_IQSWP,
++	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP,
++	     SSB_SPROM8_HWIQ_IQSWP_IQCAL_SWP_SHIFT);
++	SPEX(hw_iqcal_en, SSB_SPROM8_HWIQ_IQSWP, SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL,
++	     SSB_SPROM8_HWIQ_IQSWP_HW_IQCAL_SHIFT);
++
++	SPEX(bw40po, SSB_SPROM8_BW40PO, ~0, 0);
++	SPEX(cddpo, SSB_SPROM8_CDDPO, ~0, 0);
++	SPEX(stbcpo, SSB_SPROM8_STBCPO, ~0, 0);
++	SPEX(bwduppo, SSB_SPROM8_BWDUPPO, ~0, 0);
++
++	SPEX(tempthresh, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_TRESH,
++	     SSB_SPROM8_THERMAL_TRESH_SHIFT);
++	SPEX(tempoffset, SSB_SPROM8_THERMAL, SSB_SPROM8_THERMAL_OFFSET,
++	     SSB_SPROM8_THERMAL_OFFSET_SHIFT);
++	SPEX(phycal_tempdelta, SSB_SPROM8_TEMPDELTA,
++	     SSB_SPROM8_TEMPDELTA_PHYCAL,
++	     SSB_SPROM8_TEMPDELTA_PHYCAL_SHIFT);
++	SPEX(temps_period, SSB_SPROM8_TEMPDELTA, SSB_SPROM8_TEMPDELTA_PERIOD,
++	     SSB_SPROM8_TEMPDELTA_PERIOD_SHIFT);
++	SPEX(temps_hysteresis, SSB_SPROM8_TEMPDELTA,
++	     SSB_SPROM8_TEMPDELTA_HYSTERESIS,
++	     SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);
++}
++
++/*
++ * Indicates the presence of external SPROM.
++ */
++static bool bcma_sprom_ext_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 srom_control;
++	u32 present_mask;
++
++	if (bus->drv_cc.core->id.rev >= 31) {
++		if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
++			return false;
++
++		srom_control = bcma_read32(bus->drv_cc.core,
++					   BCMA_CC_SROM_CONTROL);
++		return srom_control & BCMA_CC_SROM_CONTROL_PRESENT;
++	}
++
++	/* older chipcommon revisions use chip status register */
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case BCMA_CHIP_ID_BCM4313:
++		present_mask = BCMA_CC_CHIPST_4313_SPROM_PRESENT;
++		break;
++
++	case BCMA_CHIP_ID_BCM4331:
++		present_mask = BCMA_CC_CHIPST_4331_SPROM_PRESENT;
++		break;
++
++	default:
++		return true;
++	}
++
++	return chip_status & present_mask;
++}
++
++/*
++ * Indicates that on-chip OTP memory is present and enabled.
++ */
++static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
++{
++	u32 chip_status;
++	u32 otpsize = 0;
++	bool present;
++
++	chip_status = bcma_read32(bus->drv_cc.core, BCMA_CC_CHIPSTAT);
++	switch (bus->chipinfo.id) {
++	case BCMA_CHIP_ID_BCM4313:
++		present = chip_status & BCMA_CC_CHIPST_4313_OTP_PRESENT;
++		break;
++
++	case BCMA_CHIP_ID_BCM4331:
++		present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
++		break;
++
++	case BCMA_CHIP_ID_BCM43224:
++	case BCMA_CHIP_ID_BCM43225:
++		/* for these chips OTP is always available */
++		present = true;
++		break;
++	case BCMA_CHIP_ID_BCM43227:
++	case BCMA_CHIP_ID_BCM43228:
++	case BCMA_CHIP_ID_BCM43428:
++		present = chip_status & BCMA_CC_CHIPST_43228_OTP_PRESENT;
++		break;
++	default:
++		present = false;
++		break;
++	}
++
++	if (present) {
++		otpsize = bus->drv_cc.capabilities & BCMA_CC_CAP_OTPS;
++		otpsize >>= BCMA_CC_CAP_OTPS_SHIFT;
++	}
++
++	return otpsize != 0;
++}
++
++/*
++ * Verify OTP is filled and determine the byte
++ * offset where SPROM data is located.
++ *
++ * On error, returns 0; byte offset otherwise.
++ */
++static int bcma_sprom_onchip_offset(struct bcma_bus *bus)
++{
++	struct bcma_device *cc = bus->drv_cc.core;
++	u32 offset;
++
++	/* verify OTP status */
++	if ((bcma_read32(cc, BCMA_CC_OTPS) & BCMA_CC_OTPS_GU_PROG_HW) == 0)
++		return 0;
++
++	/* obtain bit offset from otplayout register */
++	offset = (bcma_read32(cc, BCMA_CC_OTPL) & BCMA_CC_OTPL_GURGN_OFFSET);
++	return BCMA_CC_SPROM + (offset >> 3);
+ }
+ 
+ int bcma_sprom_get(struct bcma_bus *bus)
+ {
+-	u16 offset;
++	u16 offset = BCMA_CC_SPROM;
+ 	u16 *sprom;
+ 	int err = 0;
+ 
+ 	if (!bus->drv_cc.core)
+ 		return -EOPNOTSUPP;
+ 
+-	if (!(bus->drv_cc.capabilities & BCMA_CC_CAP_SPROM))
+-		return -ENOENT;
++	if (!bcma_sprom_ext_available(bus)) {
++		bool sprom_onchip;
++
++		/*
++		 * External SPROM takes precedence so check
++		 * on-chip OTP only when no external SPROM
++		 * is present.
++		 */
++		sprom_onchip = bcma_sprom_onchip_available(bus);
++		if (sprom_onchip) {
++			/* determine offset */
++			offset = bcma_sprom_onchip_offset(bus);
++		}
++		if (!offset || !sprom_onchip) {
++			/*
++			 * Maybe there is no SPROM on the device?
++			 * Now we ask the arch code if there is some sprom
++			 * available for this device in some other storage.
++			 */
++			err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
++			return err;
++		}
++	}
+ 
+ 	sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
+ 			GFP_KERNEL);
+ 	if (!sprom)
+ 		return -ENOMEM;
+ 
+-	if (bus->chipinfo.id == 0x4331)
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4331 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM43431)
+ 		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
+ 
+-	/* Most cards have SPROM moved by additional offset 0x30 (48 dwords).
+-	 * According to brcm80211 this applies to cards with PCIe rev >= 6
+-	 * TODO: understand this condition and use it */
+-	offset = (bus->chipinfo.id == 0x4331) ? BCMA_CC_SPROM :
+-		BCMA_CC_SPROM_PCIE6;
++	bcma_debug(bus, "SPROM offset 0x%x\n", offset);
+ 	bcma_sprom_read(bus, offset, sprom);
+ 
+-	if (bus->chipinfo.id == 0x4331)
++	if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4331 ||
++	    bus->chipinfo.id == BCMA_CHIP_ID_BCM43431)
+ 		bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, true);
+ 
+ 	err = bcma_sprom_valid(sprom);
+-	if (err)
++	if (err) {
++		bcma_warn(bus, "invalid sprom read from the PCIe card, try to use fallback sprom\n");
++		err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
+ 		goto out;
++	}
+ 
+ 	bcma_sprom_extract_r8(bus, sprom);
+ 
+--- a/include/linux/bcma/bcma.h
++++ b/include/linux/bcma/bcma.h
+@@ -7,9 +7,10 @@
+ #include <linux/bcma/bcma_driver_chipcommon.h>
+ #include <linux/bcma/bcma_driver_pci.h>
+ #include <linux/bcma/bcma_driver_mips.h>
++#include <linux/bcma/bcma_driver_gmac_cmn.h>
+ #include <linux/ssb/ssb.h> /* SPROM sharing */
+ 
+-#include "bcma_regs.h"
++#include <linux/bcma/bcma_regs.h>
+ 
+ struct bcma_device;
+ struct bcma_bus;
+@@ -26,6 +27,11 @@ struct bcma_chipinfo {
+ 	u8 pkg;
+ };
+ 
++struct bcma_boardinfo {
++	u16 vendor;
++	u16 type;
++};
++
+ enum bcma_clkmode {
+ 	BCMA_CLKMODE_FAST,
+ 	BCMA_CLKMODE_DYNAMIC,
+@@ -65,6 +71,13 @@ struct bcma_host_ops {
+ 
+ /* Core-ID values. */
+ #define BCMA_CORE_OOB_ROUTER		0x367	/* Out of band */
++#define BCMA_CORE_4706_CHIPCOMMON	0x500
++#define BCMA_CORE_4706_SOC_RAM		0x50E
++#define BCMA_CORE_4706_MAC_GBIT		0x52D
++#define BCMA_CORE_AMEMC			0x52E	/* DDR1/2 memory controller core */
++#define BCMA_CORE_ALTA			0x534	/* I2S core */
++#define BCMA_CORE_4706_MAC_GBIT_COMMON	0x5DC
++#define BCMA_CORE_DDR23_PHY		0x5DD
+ #define BCMA_CORE_INVALID		0x700
+ #define BCMA_CORE_CHIPCOMMON		0x800
+ #define BCMA_CORE_ILINE20		0x801
+@@ -125,6 +138,41 @@ struct bcma_host_ops {
+ 
+ #define BCMA_MAX_NR_CORES		16
+ 
++/* Chip IDs of PCIe devices */
++#define BCMA_CHIP_ID_BCM4313	0x4313
++#define BCMA_CHIP_ID_BCM43224	43224
++#define  BCMA_PKG_ID_BCM43224_FAB_CSM	0x8
++#define  BCMA_PKG_ID_BCM43224_FAB_SMIC	0xa
++#define BCMA_CHIP_ID_BCM43225	43225
++#define BCMA_CHIP_ID_BCM43227	43227
++#define BCMA_CHIP_ID_BCM43228	43228
++#define BCMA_CHIP_ID_BCM43421	43421
++#define BCMA_CHIP_ID_BCM43428	43428
++#define BCMA_CHIP_ID_BCM43431	43431
++#define BCMA_CHIP_ID_BCM43460	43460
++#define BCMA_CHIP_ID_BCM4331	0x4331
++#define BCMA_CHIP_ID_BCM6362	0x6362
++#define BCMA_CHIP_ID_BCM4360	0x4360
++#define BCMA_CHIP_ID_BCM4352	0x4352
++
++/* Chip IDs of SoCs */
++#define BCMA_CHIP_ID_BCM4706	0x5300
++#define  BCMA_PKG_ID_BCM4706L	1
++#define BCMA_CHIP_ID_BCM4716	0x4716
++#define  BCMA_PKG_ID_BCM4716	8
++#define  BCMA_PKG_ID_BCM4717	9
++#define  BCMA_PKG_ID_BCM4718	10
++#define BCMA_CHIP_ID_BCM47162	47162
++#define BCMA_CHIP_ID_BCM4748	0x4748
++#define BCMA_CHIP_ID_BCM4749	0x4749
++#define BCMA_CHIP_ID_BCM5356	0x5356
++#define BCMA_CHIP_ID_BCM5357	0x5357
++#define  BCMA_PKG_ID_BCM5358	9
++#define  BCMA_PKG_ID_BCM47186	10
++#define  BCMA_PKG_ID_BCM5357	11
++#define BCMA_CHIP_ID_BCM53572	53572
++#define  BCMA_PKG_ID_BCM47188	9
++
+ struct bcma_device {
+ 	struct bcma_bus *bus;
+ 	struct bcma_device_id id;
+@@ -136,8 +184,10 @@ struct bcma_device {
+ 	bool dev_registered;
+ 
+ 	u8 core_index;
++	u8 core_unit;
+ 
+ 	u32 addr;
++	u32 addr1;
+ 	u32 wrap;
+ 
+ 	void __iomem *io_addr;
+@@ -175,6 +225,12 @@ int __bcma_driver_register(struct bcma_d
+ 
+ extern void bcma_driver_unregister(struct bcma_driver *drv);
+ 
++/* Set a fallback SPROM.
++ * See kdoc at the function definition for complete documentation. */
++extern int bcma_arch_register_fallback_sprom(
++		int (*sprom_callback)(struct bcma_bus *bus,
++		struct ssb_sprom *out));
++
+ struct bcma_bus {
+ 	/* The MMIO area. */
+ 	void __iomem *mmio;
+@@ -191,14 +247,18 @@ struct bcma_bus {
+ 
+ 	struct bcma_chipinfo chipinfo;
+ 
++	struct bcma_boardinfo boardinfo;
++
+ 	struct bcma_device *mapped_core;
+ 	struct list_head cores;
+ 	u8 nr_cores;
+ 	u8 init_done:1;
++	u8 num;
+ 
+ 	struct bcma_drv_cc drv_cc;
+-	struct bcma_drv_pci drv_pci;
++	struct bcma_drv_pci drv_pci[2];
+ 	struct bcma_drv_mips drv_mips;
++	struct bcma_drv_gmac_cmn drv_gmac_cmn;
+ 
+ 	/* We decided to share SPROM struct with SSB as long as we do not need
+ 	 * any hacks for BCMA. This simplifies drivers code. */
+@@ -282,6 +342,7 @@ static inline void bcma_maskset16(struct
+ 	bcma_write16(cc, offset, (bcma_read16(cc, offset) & mask) | set);
+ }
+ 
++extern struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid);
+ extern bool bcma_core_is_enabled(struct bcma_device *core);
+ extern void bcma_core_disable(struct bcma_device *core, u32 flags);
+ extern int bcma_core_enable(struct bcma_device *core, u32 flags);
+@@ -289,6 +350,7 @@ extern void bcma_core_set_clockmode(stru
+ 				    enum bcma_clkmode clkmode);
+ extern void bcma_core_pll_ctl(struct bcma_device *core, u32 req, u32 status,
+ 			      bool on);
++extern u32 bcma_chipco_pll_read(struct bcma_drv_cc *cc, u32 offset);
+ #define BCMA_DMA_TRANSLATION_MASK	0xC0000000
+ #define  BCMA_DMA_TRANSLATION_NONE	0x00000000
+ #define  BCMA_DMA_TRANSLATION_DMA32_CMT	0x40000000 /* Client Mode Translation for 32-bit DMA */
+--- a/include/linux/bcma/bcma_driver_chipcommon.h
++++ b/include/linux/bcma/bcma_driver_chipcommon.h
+@@ -1,6 +1,9 @@
+ #ifndef LINUX_BCMA_DRIVER_CC_H_
+ #define LINUX_BCMA_DRIVER_CC_H_
+ 
++#include <linux/platform_device.h>
++#include <linux/gpio.h>
++
+ /** ChipCommon core registers. **/
+ #define BCMA_CC_ID			0x0000
+ #define  BCMA_CC_ID_ID			0x0000FFFF
+@@ -24,7 +27,7 @@
+ #define   BCMA_CC_FLASHT_NONE		0x00000000	/* No flash */
+ #define   BCMA_CC_FLASHT_STSER		0x00000100	/* ST serial flash */
+ #define   BCMA_CC_FLASHT_ATSER		0x00000200	/* Atmel serial flash */
+-#define   BCMA_CC_FLASHT_NFLASH		0x00000200
++#define   BCMA_CC_FLASHT_NFLASH		0x00000200	/* NAND flash */
+ #define	  BCMA_CC_FLASHT_PARA		0x00000700	/* Parallel flash */
+ #define  BCMA_CC_CAP_PLLT		0x00038000	/* PLL Type */
+ #define   BCMA_PLLTYPE_NONE		0x00000000
+@@ -45,6 +48,7 @@
+ #define  BCMA_CC_CAP_PMU		0x10000000	/* PMU available (rev >= 20) */
+ #define  BCMA_CC_CAP_ECI		0x20000000	/* ECI available (rev >= 20) */
+ #define  BCMA_CC_CAP_SPROM		0x40000000	/* SPROM present */
++#define  BCMA_CC_CAP_NFLASH		0x80000000	/* NAND flash present (rev >= 35 or BCM4706?) */
+ #define BCMA_CC_CORECTL			0x0008
+ #define  BCMA_CC_CORECTL_UARTCLK0	0x00000001	/* Drive UART with internal clock */
+ #define	 BCMA_CC_CORECTL_SE		0x00000002	/* sync clk out enable (corerev >= 3) */
+@@ -56,6 +60,9 @@
+ #define	 BCMA_CC_OTPS_HW_PROTECT	0x00000001
+ #define	 BCMA_CC_OTPS_SW_PROTECT	0x00000002
+ #define	 BCMA_CC_OTPS_CID_PROTECT	0x00000004
++#define  BCMA_CC_OTPS_GU_PROG_IND	0x00000F00	/* General Use programmed indication */
++#define  BCMA_CC_OTPS_GU_PROG_IND_SHIFT	8
++#define  BCMA_CC_OTPS_GU_PROG_HW	0x00000100	/* HW region programmed */
+ #define BCMA_CC_OTPC			0x0014		/* OTP control */
+ #define	 BCMA_CC_OTPC_RECWAIT		0xFF000000
+ #define	 BCMA_CC_OTPC_PROGWAIT		0x00FFFF00
+@@ -72,6 +79,8 @@
+ #define	 BCMA_CC_OTPP_READ		0x40000000
+ #define	 BCMA_CC_OTPP_START		0x80000000
+ #define	 BCMA_CC_OTPP_BUSY		0x80000000
++#define BCMA_CC_OTPL			0x001C		/* OTP layout */
++#define  BCMA_CC_OTPL_GURGN_OFFSET	0x00000FFF	/* offset of general use region */
+ #define BCMA_CC_IRQSTAT			0x0020
+ #define BCMA_CC_IRQMASK			0x0024
+ #define	 BCMA_CC_IRQ_GPIO		0x00000001	/* gpio intr */
+@@ -79,6 +88,22 @@
+ #define	 BCMA_CC_IRQ_WDRESET		0x80000000	/* watchdog reset occurred */
+ #define BCMA_CC_CHIPCTL			0x0028		/* Rev >= 11 only */
+ #define BCMA_CC_CHIPSTAT		0x002C		/* Rev >= 11 only */
++#define  BCMA_CC_CHIPST_4313_SPROM_PRESENT	1
++#define  BCMA_CC_CHIPST_4313_OTP_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_SPROM_PRESENT	2
++#define  BCMA_CC_CHIPST_4331_OTP_PRESENT	4
++#define  BCMA_CC_CHIPST_43228_ILP_DIV_EN	0x00000001
++#define  BCMA_CC_CHIPST_43228_OTP_PRESENT	0x00000002
++#define  BCMA_CC_CHIPST_43228_SERDES_REFCLK_PADSEL	0x00000004
++#define  BCMA_CC_CHIPST_43228_SDIO_MODE		0x00000008
++#define  BCMA_CC_CHIPST_43228_SDIO_OTP_PRESENT	0x00000010
++#define  BCMA_CC_CHIPST_43228_SDIO_RESET	0x00000020
++#define  BCMA_CC_CHIPST_4706_PKG_OPTION		BIT(0) /* 0: full-featured package 1: low-cost package */
++#define  BCMA_CC_CHIPST_4706_SFLASH_PRESENT	BIT(1) /* 0: parallel, 1: serial flash is present */
++#define  BCMA_CC_CHIPST_4706_SFLASH_TYPE	BIT(2) /* 0: 8b-p/ST-s flash, 1: 16b-p/Atmal-s flash */
++#define  BCMA_CC_CHIPST_4706_MIPS_BENDIAN	BIT(3) /* 0: little, 1: big endian */
++#define  BCMA_CC_CHIPST_4706_PCIE1_DISABLE	BIT(5) /* PCIE1 enable strap pin */
++#define  BCMA_CC_CHIPST_5357_NAND_BOOT		BIT(4) /* NAND boot, valid for CC rev 38 and/or BCM5357 */
+ #define BCMA_CC_JCMD			0x0030		/* Rev >= 10 only */
+ #define  BCMA_CC_JCMD_START		0x80000000
+ #define  BCMA_CC_JCMD_BUSY		0x80000000
+@@ -108,10 +133,58 @@
+ #define  BCMA_CC_JCTL_EXT_EN		2		/* Enable external targets */
+ #define  BCMA_CC_JCTL_EN		1		/* Enable Jtag master */
+ #define BCMA_CC_FLASHCTL		0x0040
++/* Start/busy bit in flashcontrol */
++#define  BCMA_CC_FLASHCTL_OPCODE	0x000000ff
++#define  BCMA_CC_FLASHCTL_ACTION	0x00000700
++#define  BCMA_CC_FLASHCTL_CS_ACTIVE	0x00001000	/* Chip Select Active, rev >= 20 */
+ #define  BCMA_CC_FLASHCTL_START		0x80000000
+ #define  BCMA_CC_FLASHCTL_BUSY		BCMA_CC_FLASHCTL_START
++/* Flashcontrol action + opcodes for ST flashes */
++#define  BCMA_CC_FLASHCTL_ST_WREN	0x0006		/* Write Enable */
++#define  BCMA_CC_FLASHCTL_ST_WRDIS	0x0004		/* Write Disable */
++#define  BCMA_CC_FLASHCTL_ST_RDSR	0x0105		/* Read Status Register */
++#define  BCMA_CC_FLASHCTL_ST_WRSR	0x0101		/* Write Status Register */
++#define  BCMA_CC_FLASHCTL_ST_READ	0x0303		/* Read Data Bytes */
++#define  BCMA_CC_FLASHCTL_ST_PP		0x0302		/* Page Program */
++#define  BCMA_CC_FLASHCTL_ST_SE		0x02d8		/* Sector Erase */
++#define  BCMA_CC_FLASHCTL_ST_BE		0x00c7		/* Bulk Erase */
++#define  BCMA_CC_FLASHCTL_ST_DP		0x00b9		/* Deep Power-down */
++#define  BCMA_CC_FLASHCTL_ST_RES	0x03ab		/* Read Electronic Signature */
++#define  BCMA_CC_FLASHCTL_ST_CSA	0x1000		/* Keep chip select asserted */
++#define  BCMA_CC_FLASHCTL_ST_SSE	0x0220		/* Sub-sector Erase */
++/* Flashcontrol action + opcodes for Atmel flashes */
++#define  BCMA_CC_FLASHCTL_AT_READ			0x07e8
++#define  BCMA_CC_FLASHCTL_AT_PAGE_READ			0x07d2
++#define  BCMA_CC_FLASHCTL_AT_STATUS			0x01d7
++#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE			0x0384
++#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE			0x0387
++#define  BCMA_CC_FLASHCTL_AT_BUF1_ERASE_PROGRAM		0x0283
++#define  BCMA_CC_FLASHCTL_AT_BUF2_ERASE_PROGRAM		0x0286
++#define  BCMA_CC_FLASHCTL_AT_BUF1_PROGRAM		0x0288
++#define  BCMA_CC_FLASHCTL_AT_BUF2_PROGRAM		0x0289
++#define  BCMA_CC_FLASHCTL_AT_PAGE_ERASE			0x0281
++#define  BCMA_CC_FLASHCTL_AT_BLOCK_ERASE		0x0250
++#define  BCMA_CC_FLASHCTL_AT_BUF1_WRITE_ERASE_PROGRAM	0x0382
++#define  BCMA_CC_FLASHCTL_AT_BUF2_WRITE_ERASE_PROGRAM	0x0385
++#define  BCMA_CC_FLASHCTL_AT_BUF1_LOAD			0x0253
++#define  BCMA_CC_FLASHCTL_AT_BUF2_LOAD			0x0255
++#define  BCMA_CC_FLASHCTL_AT_BUF1_COMPARE		0x0260
++#define  BCMA_CC_FLASHCTL_AT_BUF2_COMPARE		0x0261
++#define  BCMA_CC_FLASHCTL_AT_BUF1_REPROGRAM		0x0258
++#define  BCMA_CC_FLASHCTL_AT_BUF2_REPROGRAM		0x0259
+ #define BCMA_CC_FLASHADDR		0x0044
+ #define BCMA_CC_FLASHDATA		0x0048
++/* Status register bits for ST flashes */
++#define  BCMA_CC_FLASHDATA_ST_WIP	0x01		/* Write In Progress */
++#define  BCMA_CC_FLASHDATA_ST_WEL	0x02		/* Write Enable Latch */
++#define  BCMA_CC_FLASHDATA_ST_BP_MASK	0x1c		/* Block Protect */
++#define  BCMA_CC_FLASHDATA_ST_BP_SHIFT	2
++#define  BCMA_CC_FLASHDATA_ST_SRWD	0x80		/* Status Register Write Disable */
++/* Status register bits for Atmel flashes */
++#define  BCMA_CC_FLASHDATA_AT_READY	0x80
++#define  BCMA_CC_FLASHDATA_AT_MISMATCH	0x40
++#define  BCMA_CC_FLASHDATA_AT_ID_MASK	0x38
++#define  BCMA_CC_FLASHDATA_AT_ID_SHIFT	3
+ #define BCMA_CC_BCAST_ADDR		0x0050
+ #define BCMA_CC_BCAST_DATA		0x0054
+ #define BCMA_CC_GPIOPULLUP		0x0058		/* Rev >= 20 only */
+@@ -181,6 +254,45 @@
+ #define BCMA_CC_FLASH_CFG		0x0128
+ #define  BCMA_CC_FLASH_CFG_DS		0x0010	/* Data size, 0=8bit, 1=16bit */
+ #define BCMA_CC_FLASH_WAITCNT		0x012C
++#define BCMA_CC_SROM_CONTROL		0x0190
++#define  BCMA_CC_SROM_CONTROL_START	0x80000000
++#define  BCMA_CC_SROM_CONTROL_BUSY	0x80000000
++#define  BCMA_CC_SROM_CONTROL_OPCODE	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OP_READ	0x00000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRITE	0x20000000
++#define  BCMA_CC_SROM_CONTROL_OP_WRDIS	0x40000000
++#define  BCMA_CC_SROM_CONTROL_OP_WREN	0x60000000
++#define  BCMA_CC_SROM_CONTROL_OTPSEL	0x00000010
++#define  BCMA_CC_SROM_CONTROL_LOCK	0x00000008
++#define  BCMA_CC_SROM_CONTROL_SIZE_MASK	0x00000006
++#define  BCMA_CC_SROM_CONTROL_SIZE_1K	0x00000000
++#define  BCMA_CC_SROM_CONTROL_SIZE_4K	0x00000002
++#define  BCMA_CC_SROM_CONTROL_SIZE_16K	0x00000004
++#define  BCMA_CC_SROM_CONTROL_SIZE_SHIFT	1
++#define  BCMA_CC_SROM_CONTROL_PRESENT	0x00000001
++/* Block 0x140 - 0x190 registers are chipset specific */
++#define BCMA_CC_4706_FLASHSCFG		0x18C		/* Flash struct configuration */
++#define  BCMA_CC_4706_FLASHSCFG_MASK	0x000000ff
++#define  BCMA_CC_4706_FLASHSCFG_SF1	0x00000001	/* 2nd serial flash present */
++#define  BCMA_CC_4706_FLASHSCFG_PF1	0x00000002	/* 2nd parallel flash present */
++#define  BCMA_CC_4706_FLASHSCFG_SF1_TYPE	0x00000004	/* 2nd serial flash type : 0 : ST, 1 : Atmel */
++#define  BCMA_CC_4706_FLASHSCFG_NF1	0x00000008	/* 2nd NAND flash present */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_MASK	0x000000f0
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_4MB	0x00000010	/* 4MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_8MB	0x00000020	/* 8MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_16MB	0x00000030	/* 16MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_32MB	0x00000040	/* 32MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_64MB	0x00000050	/* 64MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_128MB	0x00000060	/* 128MB */
++#define  BCMA_CC_4706_FLASHSCFG_1ST_MADDR_SEG_256MB	0x00000070	/* 256MB */
++/* NAND flash registers for BCM4706 (corerev = 31) */
++#define BCMA_CC_NFLASH_CTL		0x01A0
++#define  BCMA_CC_NFLASH_CTL_ERR		0x08000000
++#define BCMA_CC_NFLASH_CONF		0x01A4
++#define BCMA_CC_NFLASH_COL_ADDR		0x01A8
++#define BCMA_CC_NFLASH_ROW_ADDR		0x01AC
++#define BCMA_CC_NFLASH_DATA		0x01B0
++#define BCMA_CC_NFLASH_WAITCNT0		0x01B4
+ /* 0x1E0 is defined as shared BCMA_CLKCTLST */
+ #define BCMA_CC_HW_WORKAROUND		0x01E4 /* Hardware workaround (rev >= 20) */
+ #define BCMA_CC_UART0_DATA		0x0300
+@@ -240,7 +352,60 @@
+ #define BCMA_CC_PLLCTL_ADDR		0x0660
+ #define BCMA_CC_PLLCTL_DATA		0x0664
+ #define BCMA_CC_SPROM			0x0800 /* SPROM beginning */
+-#define BCMA_CC_SPROM_PCIE6		0x0830 /* SPROM beginning on PCIe rev >= 6 */
++/* NAND flash MLC controller registers (corerev >= 38) */
++#define BCMA_CC_NAND_REVISION		0x0C00
++#define BCMA_CC_NAND_CMD_START		0x0C04
++#define BCMA_CC_NAND_CMD_ADDR_X		0x0C08
++#define BCMA_CC_NAND_CMD_ADDR		0x0C0C
++#define BCMA_CC_NAND_CMD_END_ADDR	0x0C10
++#define BCMA_CC_NAND_CS_NAND_SELECT	0x0C14
++#define BCMA_CC_NAND_CS_NAND_XOR	0x0C18
++#define BCMA_CC_NAND_SPARE_RD0		0x0C20
++#define BCMA_CC_NAND_SPARE_RD4		0x0C24
++#define BCMA_CC_NAND_SPARE_RD8		0x0C28
++#define BCMA_CC_NAND_SPARE_RD12		0x0C2C
++#define BCMA_CC_NAND_SPARE_WR0		0x0C30
++#define BCMA_CC_NAND_SPARE_WR4		0x0C34
++#define BCMA_CC_NAND_SPARE_WR8		0x0C38
++#define BCMA_CC_NAND_SPARE_WR12		0x0C3C
++#define BCMA_CC_NAND_ACC_CONTROL	0x0C40
++#define BCMA_CC_NAND_CONFIG		0x0C48
++#define BCMA_CC_NAND_TIMING_1		0x0C50
++#define BCMA_CC_NAND_TIMING_2		0x0C54
++#define BCMA_CC_NAND_SEMAPHORE		0x0C58
++#define BCMA_CC_NAND_DEVID		0x0C60
++#define BCMA_CC_NAND_DEVID_X		0x0C64
++#define BCMA_CC_NAND_BLOCK_LOCK_STATUS	0x0C68
++#define BCMA_CC_NAND_INTFC_STATUS	0x0C6C
++#define BCMA_CC_NAND_ECC_CORR_ADDR_X	0x0C70
++#define BCMA_CC_NAND_ECC_CORR_ADDR	0x0C74
++#define BCMA_CC_NAND_ECC_UNC_ADDR_X	0x0C78
++#define BCMA_CC_NAND_ECC_UNC_ADDR	0x0C7C
++#define BCMA_CC_NAND_READ_ERROR_COUNT	0x0C80
++#define BCMA_CC_NAND_CORR_STAT_THRESHOLD	0x0C84
++#define BCMA_CC_NAND_READ_ADDR_X	0x0C90
++#define BCMA_CC_NAND_READ_ADDR		0x0C94
++#define BCMA_CC_NAND_PAGE_PROGRAM_ADDR_X	0x0C98
++#define BCMA_CC_NAND_PAGE_PROGRAM_ADDR	0x0C9C
++#define BCMA_CC_NAND_COPY_BACK_ADDR_X	0x0CA0
++#define BCMA_CC_NAND_COPY_BACK_ADDR	0x0CA4
++#define BCMA_CC_NAND_BLOCK_ERASE_ADDR_X	0x0CA8
++#define BCMA_CC_NAND_BLOCK_ERASE_ADDR	0x0CAC
++#define BCMA_CC_NAND_INV_READ_ADDR_X	0x0CB0
++#define BCMA_CC_NAND_INV_READ_ADDR	0x0CB4
++#define BCMA_CC_NAND_BLK_WR_PROTECT	0x0CC0
++#define BCMA_CC_NAND_ACC_CONTROL_CS1	0x0CD0
++#define BCMA_CC_NAND_CONFIG_CS1		0x0CD4
++#define BCMA_CC_NAND_TIMING_1_CS1	0x0CD8
++#define BCMA_CC_NAND_TIMING_2_CS1	0x0CDC
++#define BCMA_CC_NAND_SPARE_RD16		0x0D30
++#define BCMA_CC_NAND_SPARE_RD20		0x0D34
++#define BCMA_CC_NAND_SPARE_RD24		0x0D38
++#define BCMA_CC_NAND_SPARE_RD28		0x0D3C
++#define BCMA_CC_NAND_CACHE_ADDR		0x0D40
++#define BCMA_CC_NAND_CACHE_DATA		0x0D44
++#define BCMA_CC_NAND_CTRL_CONFIG	0x0D48
++#define BCMA_CC_NAND_CTRL_STATUS	0x0D4C
+ 
+ /* Divider allocation in 4716/47162/5356 */
+ #define BCMA_CC_PMU5_MAINPLL_CPU	1
+@@ -256,6 +421,15 @@
+ 
+ /* 4706 PMU */
+ #define BCMA_CC_PMU4706_MAINPLL_PLL0	0
++#define BCMA_CC_PMU6_4706_PROCPLL_OFF	4	/* The CPU PLL */
++#define  BCMA_CC_PMU6_4706_PROC_P2DIV_MASK	0x000f0000
++#define  BCMA_CC_PMU6_4706_PROC_P2DIV_SHIFT	16
++#define  BCMA_CC_PMU6_4706_PROC_P1DIV_MASK	0x0000f000
++#define  BCMA_CC_PMU6_4706_PROC_P1DIV_SHIFT	12
++#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_MASK	0x00000ff8
++#define  BCMA_CC_PMU6_4706_PROC_NDIV_INT_SHIFT	3
++#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_MASK	0x00000007
++#define  BCMA_CC_PMU6_4706_PROC_NDIV_MODE_SHIFT	0
+ 
+ /* ALP clock on pre-PMU chips */
+ #define BCMA_CC_PMU_ALP_CLOCK		20000000
+@@ -284,6 +458,19 @@
+ #define BCMA_CC_PPL_PCHI_OFF		5
+ #define BCMA_CC_PPL_PCHI_MASK		0x0000003f
+ 
++#define BCMA_CC_PMU_PLL_CTL0		0
++#define BCMA_CC_PMU_PLL_CTL1		1
++#define BCMA_CC_PMU_PLL_CTL2		2
++#define BCMA_CC_PMU_PLL_CTL3		3
++#define BCMA_CC_PMU_PLL_CTL4		4
++#define BCMA_CC_PMU_PLL_CTL5		5
++
++#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_MASK	0x00f00000
++#define BCMA_CC_PMU1_PLL0_PC0_P1DIV_SHIFT	20
++
++#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_MASK	0x1ff00000
++#define BCMA_CC_PMU1_PLL0_PC2_NDIV_INT_SHIFT	20
++
+ /* BCM4331 ChipControl numbers. */
+ #define BCMA_CHIPCTL_4331_BT_COEXIST		BIT(0)	/* 0 disable */
+ #define BCMA_CHIPCTL_4331_SECI			BIT(1)	/* 0 SECI is disabled (JATG functional) */
+@@ -297,9 +484,25 @@
+ #define BCMA_CHIPCTL_4331_OVR_PIPEAUXPWRDOWN	BIT(9)	/* override core control on pipe_AuxPowerDown */
+ #define BCMA_CHIPCTL_4331_PCIE_AUXCLKEN		BIT(10)	/* pcie_auxclkenable */
+ #define BCMA_CHIPCTL_4331_PCIE_PIPE_PLLDOWN	BIT(11)	/* pcie_pipe_pllpowerdown */
++#define BCMA_CHIPCTL_4331_EXTPA_EN2		BIT(12)	/* 0 ext pa disable, 1 ext pa enabled */
+ #define BCMA_CHIPCTL_4331_BT_SHD0_ON_GPIO4	BIT(16)	/* enable bt_shd0 at gpio4 */
+ #define BCMA_CHIPCTL_4331_BT_SHD1_ON_GPIO5	BIT(17)	/* enable bt_shd1 at gpio5 */
+ 
++/* 43224 chip-specific ChipControl register bits */
++#define BCMA_CCTRL_43224_GPIO_TOGGLE		0x8000		/* gpio[3:0] pins as btcoex or s/w gpio */
++#define BCMA_CCTRL_43224A0_12MA_LED_DRIVE	0x00F000F0	/* 12 mA drive strength */
++#define BCMA_CCTRL_43224B0_12MA_LED_DRIVE	0xF0		/* 12 mA drive strength for later 43224s */
++
++/* 4313 Chip specific ChipControl register bits */
++#define BCMA_CCTRL_4313_12MA_LED_DRIVE		0x00000007	/* 12 mA drive strengh for later 4313 */
++
++/* BCM5357 ChipControl register bits */
++#define BCMA_CHIPCTL_5357_EXTPA			BIT(14)
++#define BCMA_CHIPCTL_5357_ANT_MUX_2O3		BIT(15)
++#define BCMA_CHIPCTL_5357_NFLASH		BIT(16)
++#define BCMA_CHIPCTL_5357_I2S_PINS_ENABLE	BIT(18)
++#define BCMA_CHIPCTL_5357_I2CSPI_PINS_ENABLE	BIT(19)
++
+ /* Data for the PMU, if available.
+  * Check availability with ((struct bcma_chipcommon)->capabilities & BCMA_CC_CAP_PMU)
+  */
+@@ -310,11 +513,35 @@ struct bcma_chipcommon_pmu {
+ 
+ #ifdef CONFIG_BCMA_DRIVER_MIPS
+ struct bcma_pflash {
++	bool present;
+ 	u8 buswidth;
+ 	u32 window;
+ 	u32 window_size;
+ };
+ 
++#ifdef CONFIG_BCMA_SFLASH
++struct bcma_sflash {
++	bool present;
++	u32 window;
++	u32 blocksize;
++	u16 numblocks;
++	u32 size;
++
++	struct mtd_info *mtd;
++};
++#endif
++
++#ifdef CONFIG_BCMA_NFLASH
++struct mtd_info;
++
++struct bcma_nflash {
++	bool present;
++	bool boot;		/* This is the flash the SoC boots from */
++
++	struct mtd_info *mtd;
++};
++#endif
++
+ struct bcma_serial_port {
+ 	void *regs;
+ 	unsigned long clockspeed;
+@@ -330,15 +557,30 @@ struct bcma_drv_cc {
+ 	u32 capabilities;
+ 	u32 capabilities_ext;
+ 	u8 setup_done:1;
++	u8 early_setup_done:1;
+ 	/* Fast Powerup Delay constant */
+ 	u16 fast_pwrup_delay;
+ 	struct bcma_chipcommon_pmu pmu;
+ #ifdef CONFIG_BCMA_DRIVER_MIPS
+ 	struct bcma_pflash pflash;
++#ifdef CONFIG_BCMA_SFLASH
++	struct bcma_sflash sflash;
++#endif
++#ifdef CONFIG_BCMA_NFLASH
++	struct bcma_nflash nflash;
++#endif
+ 
+ 	int nr_serial_ports;
+ 	struct bcma_serial_port serial_ports[4];
+ #endif /* CONFIG_BCMA_DRIVER_MIPS */
++	u32 ticks_per_ms;
++	struct platform_device *watchdog;
++
++	/* Lock for GPIO register access. */
++	spinlock_t gpio_lock;
++#ifdef CONFIG_BCMA_DRIVER_GPIO
++	struct gpio_chip gpio;
++#endif
+ };
+ 
+ /* Register access */
+@@ -355,14 +597,14 @@ struct bcma_drv_cc {
+ 	bcma_cc_write32(cc, offset, (bcma_cc_read32(cc, offset) & (mask)) | (set))
+ 
+ extern void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
++extern void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
+ 
+ extern void bcma_chipco_suspend(struct bcma_drv_cc *cc);
+ extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
+ 
+ void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
+ 
+-extern void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc,
+-					  u32 ticks);
++extern u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks);
+ 
+ void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value);
+ 
+@@ -375,9 +617,12 @@ u32 bcma_chipco_gpio_outen(struct bcma_d
+ u32 bcma_chipco_gpio_control(struct bcma_drv_cc *cc, u32 mask, u32 value);
+ u32 bcma_chipco_gpio_intmask(struct bcma_drv_cc *cc, u32 mask, u32 value);
+ u32 bcma_chipco_gpio_polarity(struct bcma_drv_cc *cc, u32 mask, u32 value);
++u32 bcma_chipco_gpio_pullup(struct bcma_drv_cc *cc, u32 mask, u32 value);
++u32 bcma_chipco_gpio_pulldown(struct bcma_drv_cc *cc, u32 mask, u32 value);
+ 
+ /* PMU support */
+ extern void bcma_pmu_init(struct bcma_drv_cc *cc);
++extern void bcma_pmu_early_init(struct bcma_drv_cc *cc);
+ 
+ extern void bcma_chipco_pll_write(struct bcma_drv_cc *cc, u32 offset,
+ 				  u32 value);
+@@ -387,5 +632,6 @@ extern void bcma_chipco_chipctl_maskset(
+ 					u32 offset, u32 mask, u32 set);
+ extern void bcma_chipco_regctl_maskset(struct bcma_drv_cc *cc,
+ 				       u32 offset, u32 mask, u32 set);
++extern void bcma_pmu_spuravoid_pllupdate(struct bcma_drv_cc *cc, int spuravoid);
+ 
+ #endif /* LINUX_BCMA_DRIVER_CC_H_ */
+--- /dev/null
++++ b/include/linux/bcma/bcma_driver_gmac_cmn.h
+@@ -0,0 +1,100 @@
++#ifndef LINUX_BCMA_DRIVER_GMAC_CMN_H_
++#define LINUX_BCMA_DRIVER_GMAC_CMN_H_
++
++#include <linux/types.h>
++
++#define BCMA_GMAC_CMN_STAG0		0x000
++#define BCMA_GMAC_CMN_STAG1		0x004
++#define BCMA_GMAC_CMN_STAG2		0x008
++#define BCMA_GMAC_CMN_STAG3		0x00C
++#define BCMA_GMAC_CMN_PARSER_CTL	0x020
++#define BCMA_GMAC_CMN_MIB_MAX_LEN	0x024
++#define BCMA_GMAC_CMN_PHY_ACCESS	0x100
++#define  BCMA_GMAC_CMN_PA_DATA_MASK	0x0000ffff
++#define  BCMA_GMAC_CMN_PA_ADDR_MASK	0x001f0000
++#define  BCMA_GMAC_CMN_PA_ADDR_SHIFT	16
++#define  BCMA_GMAC_CMN_PA_REG_MASK	0x1f000000
++#define  BCMA_GMAC_CMN_PA_REG_SHIFT	24
++#define  BCMA_GMAC_CMN_PA_WRITE		0x20000000
++#define  BCMA_GMAC_CMN_PA_START		0x40000000
++#define BCMA_GMAC_CMN_PHY_CTL		0x104
++#define  BCMA_GMAC_CMN_PC_EPA_MASK	0x0000001f
++#define  BCMA_GMAC_CMN_PC_MCT_MASK	0x007f0000
++#define  BCMA_GMAC_CMN_PC_MCT_SHIFT	16
++#define  BCMA_GMAC_CMN_PC_MTE		0x00800000
++#define BCMA_GMAC_CMN_GMAC0_RGMII_CTL	0x110
++#define BCMA_GMAC_CMN_CFP_ACCESS	0x200
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA0	0x210
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA1	0x214
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA2	0x218
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA3	0x21C
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA4	0x220
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA5	0x224
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA6	0x228
++#define BCMA_GMAC_CMN_CFP_TCAM_DATA7	0x22C
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK0	0x230
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK1	0x234
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK2	0x238
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK3	0x23C
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK4	0x240
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK5	0x244
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK6	0x248
++#define BCMA_GMAC_CMN_CFP_TCAM_MASK7	0x24C
++#define BCMA_GMAC_CMN_CFP_ACTION_DATA	0x250
++#define BCMA_GMAC_CMN_TCAM_BIST_CTL	0x2A0
++#define BCMA_GMAC_CMN_TCAM_BIST_STATUS	0x2A4
++#define BCMA_GMAC_CMN_TCAM_CMP_STATUS	0x2A8
++#define BCMA_GMAC_CMN_TCAM_DISABLE	0x2AC
++#define BCMA_GMAC_CMN_TCAM_TEST_CTL	0x2F0
++#define BCMA_GMAC_CMN_UDF_0_A3_A0	0x300
++#define BCMA_GMAC_CMN_UDF_0_A7_A4	0x304
++#define BCMA_GMAC_CMN_UDF_0_A8		0x308
++#define BCMA_GMAC_CMN_UDF_1_A3_A0	0x310
++#define BCMA_GMAC_CMN_UDF_1_A7_A4	0x314
++#define BCMA_GMAC_CMN_UDF_1_A8		0x318
++#define BCMA_GMAC_CMN_UDF_2_A3_A0	0x320
++#define BCMA_GMAC_CMN_UDF_2_A7_A4	0x324
++#define BCMA_GMAC_CMN_UDF_2_A8		0x328
++#define BCMA_GMAC_CMN_UDF_0_B3_B0	0x330
++#define BCMA_GMAC_CMN_UDF_0_B7_B4	0x334
++#define BCMA_GMAC_CMN_UDF_0_B8		0x338
++#define BCMA_GMAC_CMN_UDF_1_B3_B0	0x340
++#define BCMA_GMAC_CMN_UDF_1_B7_B4	0x344
++#define BCMA_GMAC_CMN_UDF_1_B8		0x348
++#define BCMA_GMAC_CMN_UDF_2_B3_B0	0x350
++#define BCMA_GMAC_CMN_UDF_2_B7_B4	0x354
++#define BCMA_GMAC_CMN_UDF_2_B8		0x358
++#define BCMA_GMAC_CMN_UDF_0_C3_C0	0x360
++#define BCMA_GMAC_CMN_UDF_0_C7_C4	0x364
++#define BCMA_GMAC_CMN_UDF_0_C8		0x368
++#define BCMA_GMAC_CMN_UDF_1_C3_C0	0x370
++#define BCMA_GMAC_CMN_UDF_1_C7_C4	0x374
++#define BCMA_GMAC_CMN_UDF_1_C8		0x378
++#define BCMA_GMAC_CMN_UDF_2_C3_C0	0x380
++#define BCMA_GMAC_CMN_UDF_2_C7_C4	0x384
++#define BCMA_GMAC_CMN_UDF_2_C8		0x388
++#define BCMA_GMAC_CMN_UDF_0_D3_D0	0x390
++#define BCMA_GMAC_CMN_UDF_0_D7_D4	0x394
++#define BCMA_GMAC_CMN_UDF_0_D11_D8	0x394
++
++struct bcma_drv_gmac_cmn {
++	struct bcma_device *core;
++
++	/* Drivers accessing BCMA_GMAC_CMN_PHY_ACCESS and
++	 * BCMA_GMAC_CMN_PHY_CTL need to take that mutex first. */
++	struct mutex phy_mutex;
++};
++
++/* Register access */
++#define gmac_cmn_read16(gc, offset)		bcma_read16((gc)->core, offset)
++#define gmac_cmn_read32(gc, offset)		bcma_read32((gc)->core, offset)
++#define gmac_cmn_write16(gc, offset, val)	bcma_write16((gc)->core, offset, val)
++#define gmac_cmn_write32(gc, offset, val)	bcma_write32((gc)->core, offset, val)
++
++#ifdef CONFIG_BCMA_DRIVER_GMAC_CMN
++extern void __devinit bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc);
++#else
++static inline void bcma_core_gmac_cmn_init(struct bcma_drv_gmac_cmn *gc) { }
++#endif
++
++#endif /* LINUX_BCMA_DRIVER_GMAC_CMN_H_ */
+--- a/include/linux/bcma/bcma_driver_mips.h
++++ b/include/linux/bcma/bcma_driver_mips.h
+@@ -35,13 +35,15 @@ struct bcma_device;
+ struct bcma_drv_mips {
+ 	struct bcma_device *core;
+ 	u8 setup_done:1;
+-	unsigned int assigned_irqs;
++	u8 early_setup_done:1;
+ };
+ 
+ #ifdef CONFIG_BCMA_DRIVER_MIPS
+ extern void bcma_core_mips_init(struct bcma_drv_mips *mcore);
++extern void bcma_core_mips_early_init(struct bcma_drv_mips *mcore);
+ #else
+ static inline void bcma_core_mips_init(struct bcma_drv_mips *mcore) { }
++static inline void bcma_core_mips_early_init(struct bcma_drv_mips *mcore) { }
+ #endif
+ 
+ extern u32 bcma_cpu_clock(struct bcma_drv_mips *mcore);
+--- a/include/linux/bcma/bcma_driver_pci.h
++++ b/include/linux/bcma/bcma_driver_pci.h
+@@ -53,11 +53,47 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI1_MASK		0xFC000000
+ #define BCMA_CORE_PCI_SBTOPCI2			0x0108	/* Backplane to PCI translation 2 (sbtopci2) */
+ #define  BCMA_CORE_PCI_SBTOPCI2_MASK		0xC0000000
++#define BCMA_CORE_PCI_CONFIG_ADDR		0x0120	/* pcie config space access */
++#define BCMA_CORE_PCI_CONFIG_DATA		0x0124	/* pcie config space access */
++#define BCMA_CORE_PCI_MDIO_CONTROL		0x0128	/* controls the mdio access */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_MASK	0x7f	/* clock to be used on MDIO */
++#define  BCMA_CORE_PCI_MDIOCTL_DIVISOR_VAL	0x2
++#define  BCMA_CORE_PCI_MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
++#define  BCMA_CORE_PCI_MDIOCTL_ACCESS_DONE	0x100	/* Tranaction complete */
++#define BCMA_CORE_PCI_MDIO_DATA			0x012c	/* Data to the mdio access */
++#define  BCMA_CORE_PCI_MDIODATA_MASK		0x0000ffff /* data 2 bytes */
++#define  BCMA_CORE_PCI_MDIODATA_TA		0x00020000 /* Turnaround */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD	18	/* Regaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK_OLD	0x003c0000 /* Regaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF_OLD	22	/* Physmedia devaddr shift (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK_OLD	0x0fc00000 /* Physmedia devaddr Mask (rev < 10) */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_SHF	18	/* Regaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_REGADDR_MASK	0x007c0000 /* Regaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_SHF	23	/* Physmedia devaddr shift */
++#define  BCMA_CORE_PCI_MDIODATA_DEVADDR_MASK	0x0f800000 /* Physmedia devaddr Mask */
++#define  BCMA_CORE_PCI_MDIODATA_WRITE		0x10000000 /* write Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_READ		0x20000000 /* Read Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_START		0x40000000 /* start of Transaction */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_ADDR	0x0	/* dev address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_BLK_ADDR	0x1F	/* blk address for serdes */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_PLL		0x1d	/* SERDES PLL Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_TX		0x1e	/* SERDES TX Dev */
++#define  BCMA_CORE_PCI_MDIODATA_DEV_RX		0x1f	/* SERDES RX Dev */
++#define BCMA_CORE_PCI_PCIEIND_ADDR		0x0130	/* indirect access to the internal register */
++#define BCMA_CORE_PCI_PCIEIND_DATA		0x0134	/* Data to/from the internal regsiter */
++#define BCMA_CORE_PCI_CLKREQENCTRL		0x0138	/*  >= rev 6, Clkreq rdma control */
+ #define BCMA_CORE_PCI_PCICFG0			0x0400	/* PCI config space 0 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG1			0x0500	/* PCI config space 1 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG2			0x0600	/* PCI config space 2 (rev >= 8) */
+ #define BCMA_CORE_PCI_PCICFG3			0x0700	/* PCI config space 3 (rev >= 8) */
+ #define BCMA_CORE_PCI_SPROM(wordoffset)		(0x0800 + ((wordoffset) * 2)) /* SPROM shadow area (72 bytes) */
++#define  BCMA_CORE_PCI_SPROM_PI_OFFSET		0	/* first word */
++#define   BCMA_CORE_PCI_SPROM_PI_MASK		0xf000	/* bit 15:12 */
++#define   BCMA_CORE_PCI_SPROM_PI_SHIFT		12	/* bit 15:12 */
++#define  BCMA_CORE_PCI_SPROM_MISC_CONFIG	5	/* word 5 */
++#define   BCMA_CORE_PCI_SPROM_L23READY_EXIT_NOPERST	0x8000	/* bit 15 */
++#define   BCMA_CORE_PCI_SPROM_CLKREQ_OFFSET_REV5	20	/* word 20 for srom rev <= 5 */
++#define   BCMA_CORE_PCI_SPROM_CLKREQ_ENB	0x0800	/* bit 11 */
+ 
+ /* SBtoPCIx */
+ #define BCMA_CORE_PCI_SBTOPCI_MEM		0x00000000
+@@ -72,20 +108,118 @@ struct pci_dev;
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READL		0x00000010 /* Memory read line */
+ #define  BCMA_CORE_PCI_SBTOPCI_RC_READM		0x00000020 /* Memory read multiple */
+ 
++/* PCIE protocol PHY diagnostic registers */
++#define BCMA_CORE_PCI_PLP_MODEREG		0x200	/* Mode */
++#define BCMA_CORE_PCI_PLP_STATUSREG		0x204	/* Status */
++#define  BCMA_CORE_PCI_PLP_POLARITYINV_STAT	0x10	/* Status reg PCIE_PLP_STATUSREG */
++#define BCMA_CORE_PCI_PLP_LTSSMCTRLREG		0x208	/* LTSSM control */
++#define BCMA_CORE_PCI_PLP_LTLINKNUMREG		0x20c	/* Link Training Link number */
++#define BCMA_CORE_PCI_PLP_LTLANENUMREG		0x210	/* Link Training Lane number */
++#define BCMA_CORE_PCI_PLP_LTNFTSREG		0x214	/* Link Training N_FTS */
++#define BCMA_CORE_PCI_PLP_ATTNREG		0x218	/* Attention */
++#define BCMA_CORE_PCI_PLP_ATTNMASKREG		0x21C	/* Attention Mask */
++#define BCMA_CORE_PCI_PLP_RXERRCTR		0x220	/* Rx Error */
++#define BCMA_CORE_PCI_PLP_RXFRMERRCTR		0x224	/* Rx Framing Error */
++#define BCMA_CORE_PCI_PLP_RXERRTHRESHREG	0x228	/* Rx Error threshold */
++#define BCMA_CORE_PCI_PLP_TESTCTRLREG		0x22C	/* Test Control reg */
++#define BCMA_CORE_PCI_PLP_SERDESCTRLOVRDREG	0x230	/* SERDES Control Override */
++#define BCMA_CORE_PCI_PLP_TIMINGOVRDREG		0x234	/* Timing param override */
++#define BCMA_CORE_PCI_PLP_RXTXSMDIAGREG		0x238	/* RXTX State Machine Diag */
++#define BCMA_CORE_PCI_PLP_LTSSMDIAGREG		0x23C	/* LTSSM State Machine Diag */
++
++/* PCIE protocol DLLP diagnostic registers */
++#define BCMA_CORE_PCI_DLLP_LCREG		0x100	/* Link Control */
++#define BCMA_CORE_PCI_DLLP_LSREG		0x104	/* Link Status */
++#define BCMA_CORE_PCI_DLLP_LAREG		0x108	/* Link Attention */
++#define  BCMA_CORE_PCI_DLLP_LSREG_LINKUP	(1 << 16)
++#define BCMA_CORE_PCI_DLLP_LAMASKREG		0x10C	/* Link Attention Mask */
++#define BCMA_CORE_PCI_DLLP_NEXTTXSEQNUMREG	0x110	/* Next Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_ACKEDTXSEQNUMREG	0x114	/* Acked Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_PURGEDTXSEQNUMREG	0x118	/* Purged Tx Seq Num */
++#define BCMA_CORE_PCI_DLLP_RXSEQNUMREG		0x11C	/* Rx Sequence Number */
++#define BCMA_CORE_PCI_DLLP_LRREG		0x120	/* Link Replay */
++#define BCMA_CORE_PCI_DLLP_LACKTOREG		0x124	/* Link Ack Timeout */
++#define BCMA_CORE_PCI_DLLP_PMTHRESHREG		0x128	/* Power Management Threshold */
++#define  BCMA_CORE_PCI_ASPMTIMER_EXTEND		0x01000000 /* > rev7: enable extend ASPM timer */
++#define BCMA_CORE_PCI_DLLP_RTRYWPREG		0x12C	/* Retry buffer write ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYRPREG		0x130	/* Retry buffer Read ptr */
++#define BCMA_CORE_PCI_DLLP_RTRYPPREG		0x134	/* Retry buffer Purged ptr */
++#define BCMA_CORE_PCI_DLLP_RTRRWREG		0x138	/* Retry buffer Read/Write */
++#define BCMA_CORE_PCI_DLLP_ECTHRESHREG		0x13C	/* Error Count Threshold */
++#define BCMA_CORE_PCI_DLLP_TLPERRCTRREG		0x140	/* TLP Error Counter */
++#define BCMA_CORE_PCI_DLLP_ERRCTRREG		0x144	/* Error Counter */
++#define BCMA_CORE_PCI_DLLP_NAKRXCTRREG		0x148	/* NAK Received Counter */
++#define BCMA_CORE_PCI_DLLP_TESTREG		0x14C	/* Test */
++#define BCMA_CORE_PCI_DLLP_PKTBIST		0x150	/* Packet BIST */
++#define BCMA_CORE_PCI_DLLP_PCIE11		0x154	/* DLLP PCIE 1.1 reg */
++
++/* SERDES RX registers */
++#define BCMA_CORE_PCI_SERDES_RX_CTRL		1	/* Rx cntrl */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_FORCE	0x80	/* rxpolarity_force */
++#define  BCMA_CORE_PCI_SERDES_RX_CTRL_POLARITY	0x40	/* rxpolarity_value */
++#define BCMA_CORE_PCI_SERDES_RX_TIMER1		2	/* Rx Timer1 */
++#define BCMA_CORE_PCI_SERDES_RX_CDR		6	/* CDR */
++#define BCMA_CORE_PCI_SERDES_RX_CDRBW		7	/* CDR BW */
++
++/* SERDES PLL registers */
++#define BCMA_CORE_PCI_SERDES_PLL_CTRL		1	/* PLL control reg */
++#define BCMA_CORE_PCI_PLL_CTRL_FREQDET_EN	0x4000	/* bit 14 is FREQDET on */
++
+ /* PCIcore specific boardflags */
+ #define BCMA_CORE_PCI_BFL_NOPCI			0x00000400 /* Board leaves PCI floating */
+ 
++/* PCIE Config space accessing MACROS */
++#define BCMA_CORE_PCI_CFG_BUS_SHIFT		24	/* Bus shift */
++#define BCMA_CORE_PCI_CFG_SLOT_SHIFT		19	/* Slot/Device shift */
++#define BCMA_CORE_PCI_CFG_FUN_SHIFT		16	/* Function shift */
++#define BCMA_CORE_PCI_CFG_OFF_SHIFT		0	/* Register shift */
++
++#define BCMA_CORE_PCI_CFG_BUS_MASK		0xff	/* Bus mask */
++#define BCMA_CORE_PCI_CFG_SLOT_MASK		0x1f	/* Slot/Device mask */
++#define BCMA_CORE_PCI_CFG_FUN_MASK		7	/* Function mask */
++#define BCMA_CORE_PCI_CFG_OFF_MASK		0xfff	/* Register mask */
++
++/* PCIE Root Capability Register bits (Host mode only) */
++#define BCMA_CORE_PCI_RC_CRS_VISIBILITY		0x0001
++
++struct bcma_drv_pci;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++struct bcma_drv_pci_host {
++	struct bcma_drv_pci *pdev;
++
++	u32 host_cfg_addr;
++	spinlock_t cfgspace_lock;
++
++	struct pci_controller pci_controller;
++	struct pci_ops pci_ops;
++	struct resource mem_resource;
++	struct resource io_resource;
++};
++#endif
++
+ struct bcma_drv_pci {
+ 	struct bcma_device *core;
+ 	u8 setup_done:1;
++	u8 hostmode:1;
++
++#ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
++	struct bcma_drv_pci_host *host_controller;
++#endif
+ };
+ 
+ /* Register access */
++#define pcicore_read16(pc, offset)		bcma_read16((pc)->core, offset)
+ #define pcicore_read32(pc, offset)		bcma_read32((pc)->core, offset)
++#define pcicore_write16(pc, offset, val)	bcma_write16((pc)->core, offset, val)
+ #define pcicore_write32(pc, offset, val)	bcma_write32((pc)->core, offset, val)
+ 
+-extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
++extern void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc);
+ extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
+ 				 struct bcma_device *core, bool enable);
++extern void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend);
++
++extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
++extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
+ 
+ #endif /* LINUX_BCMA_DRIVER_PCI_H_ */
+--- a/include/linux/bcma/bcma_regs.h
++++ b/include/linux/bcma/bcma_regs.h
+@@ -11,11 +11,13 @@
+ #define  BCMA_CLKCTLST_HAVEHTREQ	0x00000010 /* HT available request */
+ #define  BCMA_CLKCTLST_HWCROFF		0x00000020 /* Force HW clock request off */
+ #define  BCMA_CLKCTLST_EXTRESREQ	0x00000700 /* Mask of external resource requests */
++#define  BCMA_CLKCTLST_EXTRESREQ_SHIFT	8
+ #define  BCMA_CLKCTLST_HAVEALP		0x00010000 /* ALP available */
+ #define  BCMA_CLKCTLST_HAVEHT		0x00020000 /* HT available */
+ #define  BCMA_CLKCTLST_BP_ON_ALP	0x00040000 /* RO: running on ALP clock */
+ #define  BCMA_CLKCTLST_BP_ON_HT		0x00080000 /* RO: running on HT clock */
+ #define  BCMA_CLKCTLST_EXTRESST		0x07000000 /* Mask of external resource status */
++#define  BCMA_CLKCTLST_EXTRESST_SHIFT	24
+ /* Is there any BCM4328 on BCMA bus? */
+ #define  BCMA_CLKCTLST_4328A0_HAVEHT	0x00010000 /* 4328a0 has reversed bits */
+ #define  BCMA_CLKCTLST_4328A0_HAVEALP	0x00020000 /* 4328a0 has reversed bits */
+@@ -56,4 +58,36 @@
+ #define  BCMA_PCI_GPIO_XTAL		0x40	/* PCI config space GPIO 14 for Xtal powerup */
+ #define  BCMA_PCI_GPIO_PLL		0x80	/* PCI config space GPIO 15 for PLL powerdown */
+ 
++/* SiliconBackplane Address Map.
++ * All regions may not exist on all chips.
++ */
++#define BCMA_SOC_SDRAM_BASE		0x00000000U	/* Physical SDRAM */
++#define BCMA_SOC_PCI_MEM		0x08000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI_MEM_SZ		(64 * 1024 * 1024)
++#define BCMA_SOC_PCI_CFG		0x0c000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_SDRAM_SWAPPED		0x10000000U	/* Byteswapped Physical SDRAM */
++#define BCMA_SOC_SDRAM_R2		0x80000000U	/* Region 2 for sdram (512 MB) */
++
++
++#define BCMA_SOC_PCI_DMA		0x40000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA2		0x80000000U	/* Client Mode sb2pcitranslation2 (1 GB) */
++#define BCMA_SOC_PCI_DMA_SZ		0x40000000U	/* Client Mode sb2pcitranslation2 size in bytes */
++#define BCMA_SOC_PCIE_DMA_L32		0x00000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), low 32 bits
++							 */
++#define BCMA_SOC_PCIE_DMA_H32		0x80000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_PCI1_MEM		0x40000000U	/* Host Mode sb2pcitranslation0 (64 MB) */
++#define BCMA_SOC_PCI1_CFG		0x44000000U	/* Host Mode sb2pcitranslation1 (64 MB) */
++#define BCMA_SOC_PCIE1_DMA_H32		0xc0000000U	/* PCIE Client Mode sb2pcitranslation2
++							 * (2 ZettaBytes), high 32 bits
++							 */
++
++#define BCMA_SOC_FLASH1			0x1fc00000	/* MIPS Flash Region 1 */
++#define BCMA_SOC_FLASH1_SZ		0x00400000	/* MIPS Size of Flash Region 1 */
++#define BCMA_SOC_FLASH2			0x1c000000	/* Flash Region 2 (region 1 shadowed here) */
++#define BCMA_SOC_FLASH2_SZ		0x02000000	/* Size of Flash Region 2 */
++
+ #endif /* LINUX_BCMA_REGS_H_ */
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -4618,7 +4618,7 @@ static int b43_wireless_core_init(struct
+ 	switch (dev->dev->bus_type) {
+ #ifdef CONFIG_B43_BCMA
+ 	case B43_BUS_BCMA:
+-		bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci,
++		bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci[0],
+ 				      dev->dev->bdev, true);
+ 		break;
+ #endif
+--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
+@@ -533,7 +533,7 @@ ai_buscore_setup(struct si_info *sii, st
+ 
+ 	/* fixup necessary chip/core configurations */
+ 	if (!sii->pch) {
+-		sii->pch = pcicore_init(&sii->pub, sii->icbus->drv_pci.core);
++		sii->pch = pcicore_init(&sii->pub, sii->icbus->drv_pci[0].core);
+ 		if (sii->pch == NULL)
+ 			return false;
+ 	}
diff --git a/target/linux/generic/patches-3.3/040-Controlled-Delay-AQM.patch b/target/linux/generic/patches-3.3/040-Controlled-Delay-AQM.patch
new file mode 100644
index 0000000..85f563b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/040-Controlled-Delay-AQM.patch
@@ -0,0 +1,757 @@
+From a93fd80d261f1dc2788442dba8dd5701363d3d6e Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 10 May 2012 07:51:25 +0000
+Subject: [PATCH] codel: Controlled Delay AQM
+
+commit 76e3cc126bb223013a6b9a0e2a51238d1ef2e409 upstream.
+
+An implementation of CoDel AQM, from Kathleen Nichols and Van Jacobson.
+
+http://queue.acm.org/detail.cfm?id=2209336
+
+This AQM main input is no longer queue size in bytes or packets, but the
+delay packets stay in (FIFO) queue.
+
+As we don't have infinite memory, we still can drop packets in enqueue()
+in case of massive load, but mean of CoDel is to drop packets in
+dequeue(), using a control law based on two simple parameters :
+
+target : target sojourn time (default 5ms)
+interval : width of moving time window (default 100ms)
+
+Based on initial work from Dave Taht.
+
+Refactored to help future codel inclusion as a plugin for other linux
+qdisc (FQ_CODEL, ...), like RED.
+
+include/net/codel.h contains codel algorithm as close as possible than
+Kathleen reference.
+
+net/sched/sch_codel.c contains the linux qdisc specific glue.
+
+Separate structures permit a memory efficient implementation of fq_codel
+(to be sent as a separate work) : Each flow has its own struct
+codel_vars.
+
+timestamps are taken at enqueue() time with 1024 ns precision, allowing
+a range of 2199 seconds in queue, and 100Gb links support. iproute2 uses
+usec as base unit.
+
+Selected packets are dropped, unless ECN is enabled and packets can get
+ECN mark instead.
+
+Tested from 2Mb to 10Gb speeds with no particular problems, on ixgbe and
+tg3 drivers (BQL enabled).
+
+Usage: tc qdisc ... codel [ limit PACKETS ] [ target TIME ]
+                          [ interval TIME ] [ ecn ]
+
+qdisc codel 10: parent 1:1 limit 2000p target 3.0ms interval 60.0ms ecn
+ Sent 13347099587 bytes 8815805 pkt (dropped 0, overlimits 0 requeues 0)
+ rate 202365Kbit 16708pps backlog 113550b 75p requeues 0
+  count 116 lastcount 98 ldelay 4.3ms dropping drop_next 816us
+  maxpacket 1514 ecn_mark 84399 drop_overlimit 0
+
+CoDel must be seen as a base module, and should be used keeping in mind
+there is still a FIFO queue. So a typical setup will probably need a
+hierarchy of several qdiscs and packet classifiers to be able to meet
+whatever constraints a user might have.
+
+One possible example would be to use fq_codel, which combines Fair
+Queueing and CoDel, in replacement of sfq / sfq_red.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Dave Taht <dave.taht@bufferbloat.net>
+Cc: Kathleen Nichols <nichols@pollere.com>
+Cc: Van Jacobson <van@pollere.net>
+Cc: Tom Herbert <therbert@google.com>
+Cc: Matt Mathis <mattmathis@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/pkt_sched.h |   26 ++++
+ include/net/codel.h       |  332 +++++++++++++++++++++++++++++++++++++++++++++
+ net/sched/Kconfig         |   11 ++
+ net/sched/Makefile        |    1 +
+ net/sched/sch_codel.c     |  275 +++++++++++++++++++++++++++++++++++++
+ 5 files changed, 645 insertions(+)
+ create mode 100644 include/net/codel.h
+ create mode 100644 net/sched/sch_codel.c
+
+--- a/include/linux/pkt_sched.h
++++ b/include/linux/pkt_sched.h
+@@ -633,4 +633,30 @@ struct tc_qfq_stats {
+ 	__u32 lmax;
+ };
+ 
++/* CODEL */
++
++enum {
++	TCA_CODEL_UNSPEC,
++	TCA_CODEL_TARGET,
++	TCA_CODEL_LIMIT,
++	TCA_CODEL_INTERVAL,
++	TCA_CODEL_ECN,
++	__TCA_CODEL_MAX
++};
++
++#define TCA_CODEL_MAX	(__TCA_CODEL_MAX - 1)
++
++struct tc_codel_xstats {
++	__u32	maxpacket; /* largest packet we've seen so far */
++	__u32	count;	   /* how many drops we've done since the last time we
++			    * entered dropping state
++			    */
++	__u32	lastcount; /* count at entry to dropping state */
++	__u32	ldelay;    /* in-queue delay seen by most recently dequeued packet */
++	__s32	drop_next; /* time to drop next packet */
++	__u32	drop_overlimit; /* number of time max qdisc packet limit was hit */
++	__u32	ecn_mark;  /* number of packets we ECN marked instead of dropped */
++	__u32	dropping;  /* are we in dropping state ? */
++};
++
+ #endif
+--- /dev/null
++++ b/include/net/codel.h
+@@ -0,0 +1,332 @@
++#ifndef __NET_SCHED_CODEL_H
++#define __NET_SCHED_CODEL_H
++
++/*
++ * Codel - The Controlled-Delay Active Queue Management algorithm
++ *
++ *  Copyright (C) 2011-2012 Kathleen Nichols <nichols@pollere.com>
++ *  Copyright (C) 2011-2012 Van Jacobson <van@pollere.net>
++ *  Copyright (C) 2012 Michael D. Taht <dave.taht@bufferbloat.net>
++ *  Copyright (C) 2012 Eric Dumazet <edumazet@google.com>
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the authors may not be used to endorse or promote products
++ *    derived from this software without specific prior written permission.
++ *
++ * Alternatively, provided that this notice is retained in full, this
++ * software may be distributed under the terms of the GNU General
++ * Public License ("GPL") version 2, in which case the provisions of the
++ * GPL apply INSTEAD OF those given above.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ *
++ */
++
++#include <linux/types.h>
++#include <linux/ktime.h>
++#include <linux/skbuff.h>
++#include <net/pkt_sched.h>
++#include <net/inet_ecn.h>
++
++/* Controlling Queue Delay (CoDel) algorithm
++ * =========================================
++ * Source : Kathleen Nichols and Van Jacobson
++ * http://queue.acm.org/detail.cfm?id=2209336
++ *
++ * Implemented on linux by Dave Taht and Eric Dumazet
++ */
++
++
++/* CoDel uses a 1024 nsec clock, encoded in u32
++ * This gives a range of 2199 seconds, because of signed compares
++ */
++typedef u32 codel_time_t;
++typedef s32 codel_tdiff_t;
++#define CODEL_SHIFT 10
++#define MS2TIME(a) ((a * NSEC_PER_MSEC) >> CODEL_SHIFT)
++
++static inline codel_time_t codel_get_time(void)
++{
++	u64 ns = ktime_to_ns(ktime_get());
++
++	return ns >> CODEL_SHIFT;
++}
++
++#define codel_time_after(a, b)		((s32)(a) - (s32)(b) > 0)
++#define codel_time_after_eq(a, b)	((s32)(a) - (s32)(b) >= 0)
++#define codel_time_before(a, b)		((s32)(a) - (s32)(b) < 0)
++#define codel_time_before_eq(a, b)	((s32)(a) - (s32)(b) <= 0)
++
++/* Qdiscs using codel plugin must use codel_skb_cb in their own cb[] */
++struct codel_skb_cb {
++	codel_time_t enqueue_time;
++};
++
++static struct codel_skb_cb *get_codel_cb(const struct sk_buff *skb)
++{
++	qdisc_cb_private_validate(skb, sizeof(struct codel_skb_cb));
++	return (struct codel_skb_cb *)qdisc_skb_cb(skb)->data;
++}
++
++static codel_time_t codel_get_enqueue_time(const struct sk_buff *skb)
++{
++	return get_codel_cb(skb)->enqueue_time;
++}
++
++static void codel_set_enqueue_time(struct sk_buff *skb)
++{
++	get_codel_cb(skb)->enqueue_time = codel_get_time();
++}
++
++static inline u32 codel_time_to_us(codel_time_t val)
++{
++	u64 valns = ((u64)val << CODEL_SHIFT);
++
++	do_div(valns, NSEC_PER_USEC);
++	return (u32)valns;
++}
++
++/**
++ * struct codel_params - contains codel parameters
++ * @target:	target queue size (in time units)
++ * @interval:	width of moving time window
++ * @ecn:	is Explicit Congestion Notification enabled
++ */
++struct codel_params {
++	codel_time_t	target;
++	codel_time_t	interval;
++	bool		ecn;
++};
++
++/**
++ * struct codel_vars - contains codel variables
++ * @count:		how many drops we've done since the last time we
++ *			entered dropping state
++ * @lastcount:		count at entry to dropping state
++ * @dropping:		set to true if in dropping state
++ * @first_above_time:	when we went (or will go) continuously above target
++ *			for interval
++ * @drop_next:		time to drop next packet, or when we dropped last
++ * @ldelay:		sojourn time of last dequeued packet
++ */
++struct codel_vars {
++	u32		count;
++	u32		lastcount;
++	bool		dropping;
++	codel_time_t	first_above_time;
++	codel_time_t	drop_next;
++	codel_time_t	ldelay;
++};
++
++/**
++ * struct codel_stats - contains codel shared variables and stats
++ * @maxpacket:	largest packet we've seen so far
++ * @drop_count:	temp count of dropped packets in dequeue()
++ * ecn_mark:	number of packets we ECN marked instead of dropping
++ */
++struct codel_stats {
++	u32		maxpacket;
++	u32		drop_count;
++	u32		ecn_mark;
++};
++
++static void codel_params_init(struct codel_params *params)
++{
++	params->interval = MS2TIME(100);
++	params->target = MS2TIME(5);
++	params->ecn = false;
++}
++
++static void codel_vars_init(struct codel_vars *vars)
++{
++	vars->drop_next = 0;
++	vars->first_above_time = 0;
++	vars->dropping = false; /* exit dropping state */
++	vars->count = 0;
++	vars->lastcount = 0;
++}
++
++static void codel_stats_init(struct codel_stats *stats)
++{
++	stats->maxpacket = 256;
++}
++
++/* return interval/sqrt(x) with good precision
++ * relies on int_sqrt(unsigned long x) kernel implementation
++ */
++static u32 codel_inv_sqrt(u32 _interval, u32 _x)
++{
++	u64 interval = _interval;
++	unsigned long x = _x;
++
++	/* Scale operands for max precision */
++
++#if BITS_PER_LONG == 64
++	x <<= 32; /* On 64bit arches, we can prescale x by 32bits */
++	interval <<= 16;
++#endif
++
++	while (x < (1UL << (BITS_PER_LONG - 2))) {
++		x <<= 2;
++		interval <<= 1;
++	}
++	do_div(interval, int_sqrt(x));
++	return (u32)interval;
++}
++
++static codel_time_t codel_control_law(codel_time_t t,
++				      codel_time_t interval,
++				      u32 count)
++{
++	return t + codel_inv_sqrt(interval, count);
++}
++
++
++static bool codel_should_drop(struct sk_buff *skb,
++			      unsigned int *backlog,
++			      struct codel_vars *vars,
++			      struct codel_params *params,
++			      struct codel_stats *stats,
++			      codel_time_t now)
++{
++	bool ok_to_drop;
++
++	if (!skb) {
++		vars->first_above_time = 0;
++		return false;
++	}
++
++	vars->ldelay = now - codel_get_enqueue_time(skb);
++	*backlog -= qdisc_pkt_len(skb);
++
++	if (unlikely(qdisc_pkt_len(skb) > stats->maxpacket))
++		stats->maxpacket = qdisc_pkt_len(skb);
++
++	if (codel_time_before(vars->ldelay, params->target) ||
++	    *backlog <= stats->maxpacket) {
++		/* went below - stay below for at least interval */
++		vars->first_above_time = 0;
++		return false;
++	}
++	ok_to_drop = false;
++	if (vars->first_above_time == 0) {
++		/* just went above from below. If we stay above
++		 * for at least interval we'll say it's ok to drop
++		 */
++		vars->first_above_time = now + params->interval;
++	} else if (codel_time_after(now, vars->first_above_time)) {
++		ok_to_drop = true;
++	}
++	return ok_to_drop;
++}
++
++typedef struct sk_buff * (*codel_skb_dequeue_t)(struct codel_vars *vars,
++						struct Qdisc *sch);
++
++static struct sk_buff *codel_dequeue(struct Qdisc *sch,
++				     struct codel_params *params,
++				     struct codel_vars *vars,
++				     struct codel_stats *stats,
++				     codel_skb_dequeue_t dequeue_func,
++				     u32 *backlog)
++{
++	struct sk_buff *skb = dequeue_func(vars, sch);
++	codel_time_t now;
++	bool drop;
++
++	if (!skb) {
++		vars->dropping = false;
++		return skb;
++	}
++	now = codel_get_time();
++	drop = codel_should_drop(skb, backlog, vars, params, stats, now);
++	if (vars->dropping) {
++		if (!drop) {
++			/* sojourn time below target - leave dropping state */
++			vars->dropping = false;
++		} else if (codel_time_after_eq(now, vars->drop_next)) {
++			/* It's time for the next drop. Drop the current
++			 * packet and dequeue the next. The dequeue might
++			 * take us out of dropping state.
++			 * If not, schedule the next drop.
++			 * A large backlog might result in drop rates so high
++			 * that the next drop should happen now,
++			 * hence the while loop.
++			 */
++			while (vars->dropping &&
++			       codel_time_after_eq(now, vars->drop_next)) {
++				if (++vars->count == 0) /* avoid zero divides */
++					vars->count = ~0U;
++				if (params->ecn && INET_ECN_set_ce(skb)) {
++					stats->ecn_mark++;
++					vars->drop_next =
++						codel_control_law(vars->drop_next,
++								  params->interval,
++								  vars->count);
++					goto end;
++				}
++				qdisc_drop(skb, sch);
++				stats->drop_count++;
++				skb = dequeue_func(vars, sch);
++				if (!codel_should_drop(skb, backlog,
++						       vars, params, stats, now)) {
++					/* leave dropping state */
++					vars->dropping = false;
++				} else {
++					/* and schedule the next drop */
++					vars->drop_next =
++						codel_control_law(vars->drop_next,
++								  params->interval,
++								  vars->count);
++				}
++			}
++		}
++	} else if (drop) {
++		if (params->ecn && INET_ECN_set_ce(skb)) {
++			stats->ecn_mark++;
++		} else {
++			qdisc_drop(skb, sch);
++			stats->drop_count++;
++
++			skb = dequeue_func(vars, sch);
++			drop = codel_should_drop(skb, backlog, vars, params,
++						 stats, now);
++		}
++		vars->dropping = true;
++		/* if min went above target close to when we last went below it
++		 * assume that the drop rate that controlled the queue on the
++		 * last cycle is a good starting point to control it now.
++		 */
++		if (codel_time_before(now - vars->drop_next,
++				      16 * params->interval)) {
++			vars->count = (vars->count - vars->lastcount) | 1;
++		} else {
++			vars->count = 1;
++		}
++		vars->lastcount = vars->count;
++		vars->drop_next = codel_control_law(now, params->interval,
++						    vars->count);
++	}
++end:
++	return skb;
++}
++#endif
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -250,6 +250,17 @@ config NET_SCH_QFQ
+ 
+ 	  If unsure, say N.
+ 
++config NET_SCH_CODEL
++	tristate "Controlled Delay AQM (CODEL)"
++	help
++	  Say Y here if you want to use the Controlled Delay (CODEL)
++	  packet scheduling algorithm.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called sch_codel.
++
++	  If unsure, say N.
++
+ config NET_SCH_INGRESS
+ 	tristate "Ingress Qdisc"
+ 	depends on NET_CLS_ACT
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -36,6 +36,7 @@ obj-$(CONFIG_NET_SCH_DRR)	+= sch_drr.o
+ obj-$(CONFIG_NET_SCH_MQPRIO)	+= sch_mqprio.o
+ obj-$(CONFIG_NET_SCH_CHOKE)	+= sch_choke.o
+ obj-$(CONFIG_NET_SCH_QFQ)	+= sch_qfq.o
++obj-$(CONFIG_NET_SCH_CODEL)	+= sch_codel.o
+ 
+ obj-$(CONFIG_NET_CLS_U32)	+= cls_u32.o
+ obj-$(CONFIG_NET_CLS_ROUTE4)	+= cls_route.o
+--- /dev/null
++++ b/net/sched/sch_codel.c
+@@ -0,0 +1,275 @@
++/*
++ * Codel - The Controlled-Delay Active Queue Management algorithm
++ *
++ *  Copyright (C) 2011-2012 Kathleen Nichols <nichols@pollere.com>
++ *  Copyright (C) 2011-2012 Van Jacobson <van@pollere.net>
++ *
++ *  Implemented on linux by :
++ *  Copyright (C) 2012 Michael D. Taht <dave.taht@bufferbloat.net>
++ *  Copyright (C) 2012 Eric Dumazet <edumazet@google.com>
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions, and the following disclaimer,
++ *    without modification.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 3. The names of the authors may not be used to endorse or promote products
++ *    derived from this software without specific prior written permission.
++ *
++ * Alternatively, provided that this notice is retained in full, this
++ * software may be distributed under the terms of the GNU General
++ * Public License ("GPL") version 2, in which case the provisions of the
++ * GPL apply INSTEAD OF those given above.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
++ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
++ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
++ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
++ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
++ * DAMAGE.
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/skbuff.h>
++#include <net/pkt_sched.h>
++#include <net/codel.h>
++
++
++#define DEFAULT_CODEL_LIMIT 1000
++
++struct codel_sched_data {
++	struct codel_params	params;
++	struct codel_vars	vars;
++	struct codel_stats	stats;
++	u32			drop_overlimit;
++};
++
++/* This is the specific function called from codel_dequeue()
++ * to dequeue a packet from queue. Note: backlog is handled in
++ * codel, we dont need to reduce it here.
++ */
++static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch)
++{
++	struct sk_buff *skb = __skb_dequeue(&sch->q);
++
++	prefetch(&skb->end); /* we'll need skb_shinfo() */
++	return skb;
++}
++
++static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++	struct sk_buff *skb;
++
++	skb = codel_dequeue(sch, &q->params, &q->vars, &q->stats,
++			    dequeue, &sch->qstats.backlog);
++	/* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
++	 * or HTB crashes. Defer it for next round.
++	 */
++	if (q->stats.drop_count && sch->q.qlen) {
++		qdisc_tree_decrease_qlen(sch, q->stats.drop_count);
++		q->stats.drop_count = 0;
++	}
++	if (skb)
++		qdisc_bstats_update(sch, skb);
++	return skb;
++}
++
++static int codel_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
++{
++	struct codel_sched_data *q;
++
++	if (likely(qdisc_qlen(sch) < sch->limit)) {
++		codel_set_enqueue_time(skb);
++		return qdisc_enqueue_tail(skb, sch);
++	}
++	q = qdisc_priv(sch);
++	q->drop_overlimit++;
++	return qdisc_drop(skb, sch);
++}
++
++static const struct nla_policy codel_policy[TCA_CODEL_MAX + 1] = {
++	[TCA_CODEL_TARGET]	= { .type = NLA_U32 },
++	[TCA_CODEL_LIMIT]	= { .type = NLA_U32 },
++	[TCA_CODEL_INTERVAL]	= { .type = NLA_U32 },
++	[TCA_CODEL_ECN]		= { .type = NLA_U32 },
++};
++
++static int codel_change(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++	struct nlattr *tb[TCA_CODEL_MAX + 1];
++	unsigned int qlen;
++	int err;
++
++	if (!opt)
++		return -EINVAL;
++
++	err = nla_parse_nested(tb, TCA_CODEL_MAX, opt, codel_policy);
++	if (err < 0)
++		return err;
++
++	sch_tree_lock(sch);
++
++	if (tb[TCA_CODEL_TARGET]) {
++		u32 target = nla_get_u32(tb[TCA_CODEL_TARGET]);
++
++		q->params.target = ((u64)target * NSEC_PER_USEC) >> CODEL_SHIFT;
++	}
++
++	if (tb[TCA_CODEL_INTERVAL]) {
++		u32 interval = nla_get_u32(tb[TCA_CODEL_INTERVAL]);
++
++		q->params.interval = ((u64)interval * NSEC_PER_USEC) >> CODEL_SHIFT;
++	}
++
++	if (tb[TCA_CODEL_LIMIT])
++		sch->limit = nla_get_u32(tb[TCA_CODEL_LIMIT]);
++
++	if (tb[TCA_CODEL_ECN])
++		q->params.ecn = !!nla_get_u32(tb[TCA_CODEL_ECN]);
++
++	qlen = sch->q.qlen;
++	while (sch->q.qlen > sch->limit) {
++		struct sk_buff *skb = __skb_dequeue(&sch->q);
++
++		sch->qstats.backlog -= qdisc_pkt_len(skb);
++		qdisc_drop(skb, sch);
++	}
++	qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);
++
++	sch_tree_unlock(sch);
++	return 0;
++}
++
++static int codel_init(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++
++	sch->limit = DEFAULT_CODEL_LIMIT;
++
++	codel_params_init(&q->params);
++	codel_vars_init(&q->vars);
++	codel_stats_init(&q->stats);
++
++	if (opt) {
++		int err = codel_change(sch, opt);
++
++		if (err)
++			return err;
++	}
++
++	if (sch->limit >= 1)
++		sch->flags |= TCQ_F_CAN_BYPASS;
++	else
++		sch->flags &= ~TCQ_F_CAN_BYPASS;
++
++	return 0;
++}
++
++static int codel_dump(struct Qdisc *sch, struct sk_buff *skb)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++	struct nlattr *opts;
++
++	opts = nla_nest_start(skb, TCA_OPTIONS);
++	if (opts == NULL)
++		goto nla_put_failure;
++
++	if (nla_put_u32(skb, TCA_CODEL_TARGET,
++			codel_time_to_us(q->params.target)) ||
++	    nla_put_u32(skb, TCA_CODEL_LIMIT,
++			sch->limit) ||
++	    nla_put_u32(skb, TCA_CODEL_INTERVAL,
++			codel_time_to_us(q->params.interval)) ||
++	    nla_put_u32(skb, TCA_CODEL_ECN,
++			q->params.ecn))
++		goto nla_put_failure;
++
++	return nla_nest_end(skb, opts);
++
++nla_put_failure:
++	nla_nest_cancel(skb, opts);
++	return -1;
++}
++
++static int codel_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
++{
++	const struct codel_sched_data *q = qdisc_priv(sch);
++	struct tc_codel_xstats st = {
++		.maxpacket	= q->stats.maxpacket,
++		.count		= q->vars.count,
++		.lastcount	= q->vars.lastcount,
++		.drop_overlimit = q->drop_overlimit,
++		.ldelay		= codel_time_to_us(q->vars.ldelay),
++		.dropping	= q->vars.dropping,
++		.ecn_mark	= q->stats.ecn_mark,
++	};
++
++	if (q->vars.dropping) {
++		codel_tdiff_t delta = q->vars.drop_next - codel_get_time();
++
++		if (delta >= 0)
++			st.drop_next = codel_time_to_us(delta);
++		else
++			st.drop_next = -codel_time_to_us(-delta);
++	}
++
++	return gnet_stats_copy_app(d, &st, sizeof(st));
++}
++
++static void codel_reset(struct Qdisc *sch)
++{
++	struct codel_sched_data *q = qdisc_priv(sch);
++
++	qdisc_reset_queue(sch);
++	codel_vars_init(&q->vars);
++}
++
++static struct Qdisc_ops codel_qdisc_ops __read_mostly = {
++	.id		=	"codel",
++	.priv_size	=	sizeof(struct codel_sched_data),
++
++	.enqueue	=	codel_qdisc_enqueue,
++	.dequeue	=	codel_qdisc_dequeue,
++	.peek		=	qdisc_peek_dequeued,
++	.init		=	codel_init,
++	.reset		=	codel_reset,
++	.change 	=	codel_change,
++	.dump		=	codel_dump,
++	.dump_stats	=	codel_dump_stats,
++	.owner		=	THIS_MODULE,
++};
++
++static int __init codel_module_init(void)
++{
++	return register_qdisc(&codel_qdisc_ops);
++}
++
++static void __exit codel_module_exit(void)
++{
++	unregister_qdisc(&codel_qdisc_ops);
++}
++
++module_init(codel_module_init)
++module_exit(codel_module_exit)
++
++MODULE_DESCRIPTION("Controlled Delay queue discipline");
++MODULE_AUTHOR("Dave Taht");
++MODULE_AUTHOR("Eric Dumazet");
++MODULE_LICENSE("Dual BSD/GPL");
diff --git a/target/linux/generic/patches-3.3/041-codel-use-Newton-method-instead-of-sqrt-and-divides.patch b/target/linux/generic/patches-3.3/041-codel-use-Newton-method-instead-of-sqrt-and-divides.patch
new file mode 100644
index 0000000..f91b42e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/041-codel-use-Newton-method-instead-of-sqrt-and-divides.patch
@@ -0,0 +1,185 @@
+From 4a8056dfeef49b306ad6af24a5563d7d6867aae0 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 12 May 2012 03:32:13 +0000
+Subject: [PATCH] codel: use Newton method instead of sqrt() and divides
+
+commit 536edd67109df5e0cdb2c4ee759e9bade7976367 upstream.
+
+As Van pointed out, interval/sqrt(count) can be implemented using
+multiplies only.
+
+http://en.wikipedia.org/wiki/Methods_of_computing_square_roots#Iterative_methods_for_reciprocal_square_roots
+
+This patch implements the Newton method and reciprocal divide.
+
+Total cost is 15 cycles instead of 120 on my Corei5 machine (64bit
+kernel).
+
+There is a small 'error' for count values < 5, but we don't really care.
+
+I reuse a hole in struct codel_vars :
+ - pack the dropping boolean into one bit
+ - use 31bit to store the reciprocal value of sqrt(count).
+
+Suggested-by: Van Jacobson <van@pollere.net>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Dave Taht <dave.taht@bufferbloat.net>
+Cc: Kathleen Nichols <nichols@pollere.com>
+Cc: Tom Herbert <therbert@google.com>
+Cc: Matt Mathis <mattmathis@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: Nandita Dukkipati <nanditad@google.com>
+Cc: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/codel.h |   68 ++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 37 insertions(+), 31 deletions(-)
+
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -46,6 +46,7 @@
+ #include <linux/skbuff.h>
+ #include <net/pkt_sched.h>
+ #include <net/inet_ecn.h>
++#include <linux/reciprocal_div.h>
+ 
+ /* Controlling Queue Delay (CoDel) algorithm
+  * =========================================
+@@ -123,6 +124,7 @@ struct codel_params {
+  *			entered dropping state
+  * @lastcount:		count at entry to dropping state
+  * @dropping:		set to true if in dropping state
++ * @rec_inv_sqrt:	reciprocal value of sqrt(count) >> 1
+  * @first_above_time:	when we went (or will go) continuously above target
+  *			for interval
+  * @drop_next:		time to drop next packet, or when we dropped last
+@@ -131,7 +133,8 @@ struct codel_params {
+ struct codel_vars {
+ 	u32		count;
+ 	u32		lastcount;
+-	bool		dropping;
++	bool		dropping:1;
++	u32		rec_inv_sqrt:31;
+ 	codel_time_t	first_above_time;
+ 	codel_time_t	drop_next;
+ 	codel_time_t	ldelay;
+@@ -158,11 +161,7 @@ static void codel_params_init(struct cod
+ 
+ static void codel_vars_init(struct codel_vars *vars)
+ {
+-	vars->drop_next = 0;
+-	vars->first_above_time = 0;
+-	vars->dropping = false; /* exit dropping state */
+-	vars->count = 0;
+-	vars->lastcount = 0;
++	memset(vars, 0, sizeof(*vars));
+ }
+ 
+ static void codel_stats_init(struct codel_stats *stats)
+@@ -170,38 +169,37 @@ static void codel_stats_init(struct code
+ 	stats->maxpacket = 256;
+ }
+ 
+-/* return interval/sqrt(x) with good precision
+- * relies on int_sqrt(unsigned long x) kernel implementation
++/*
++ * http://en.wikipedia.org/wiki/Methods_of_computing_square_roots#Iterative_methods_for_reciprocal_square_roots
++ * new_invsqrt = (invsqrt / 2) * (3 - count * invsqrt^2)
++ *
++ * Here, invsqrt is a fixed point number (< 1.0), 31bit mantissa)
+  */
+-static u32 codel_inv_sqrt(u32 _interval, u32 _x)
++static void codel_Newton_step(struct codel_vars *vars)
+ {
+-	u64 interval = _interval;
+-	unsigned long x = _x;
+-
+-	/* Scale operands for max precision */
++	u32 invsqrt = vars->rec_inv_sqrt;
++	u32 invsqrt2 = ((u64)invsqrt * invsqrt) >> 31;
++	u64 val = (3LL << 31) - ((u64)vars->count * invsqrt2);
+ 
+-#if BITS_PER_LONG == 64
+-	x <<= 32; /* On 64bit arches, we can prescale x by 32bits */
+-	interval <<= 16;
+-#endif
++	val = (val * invsqrt) >> 32;
+ 
+-	while (x < (1UL << (BITS_PER_LONG - 2))) {
+-		x <<= 2;
+-		interval <<= 1;
+-	}
+-	do_div(interval, int_sqrt(x));
+-	return (u32)interval;
++	vars->rec_inv_sqrt = val;
+ }
+ 
++/*
++ * CoDel control_law is t + interval/sqrt(count)
++ * We maintain in rec_inv_sqrt the reciprocal value of sqrt(count) to avoid
++ * both sqrt() and divide operation.
++ */
+ static codel_time_t codel_control_law(codel_time_t t,
+ 				      codel_time_t interval,
+-				      u32 count)
++				      u32 rec_inv_sqrt)
+ {
+-	return t + codel_inv_sqrt(interval, count);
++	return t + reciprocal_divide(interval, rec_inv_sqrt << 1);
+ }
+ 
+ 
+-static bool codel_should_drop(struct sk_buff *skb,
++static bool codel_should_drop(const struct sk_buff *skb,
+ 			      unsigned int *backlog,
+ 			      struct codel_vars *vars,
+ 			      struct codel_params *params,
+@@ -274,14 +272,16 @@ static struct sk_buff *codel_dequeue(str
+ 			 */
+ 			while (vars->dropping &&
+ 			       codel_time_after_eq(now, vars->drop_next)) {
+-				if (++vars->count == 0) /* avoid zero divides */
+-					vars->count = ~0U;
++				vars->count++; /* dont care of possible wrap
++						* since there is no more divide
++						*/
++				codel_Newton_step(vars);
+ 				if (params->ecn && INET_ECN_set_ce(skb)) {
+ 					stats->ecn_mark++;
+ 					vars->drop_next =
+ 						codel_control_law(vars->drop_next,
+ 								  params->interval,
+-								  vars->count);
++								  vars->rec_inv_sqrt);
+ 					goto end;
+ 				}
+ 				qdisc_drop(skb, sch);
+@@ -296,7 +296,7 @@ static struct sk_buff *codel_dequeue(str
+ 					vars->drop_next =
+ 						codel_control_law(vars->drop_next,
+ 								  params->interval,
+-								  vars->count);
++								  vars->rec_inv_sqrt);
+ 				}
+ 			}
+ 		}
+@@ -319,12 +319,18 @@ static struct sk_buff *codel_dequeue(str
+ 		if (codel_time_before(now - vars->drop_next,
+ 				      16 * params->interval)) {
+ 			vars->count = (vars->count - vars->lastcount) | 1;
++			/* we dont care if rec_inv_sqrt approximation
++			 * is not very precise :
++			 * Next Newton steps will correct it quadratically.
++			 */
++			codel_Newton_step(vars);
+ 		} else {
+ 			vars->count = 1;
++			vars->rec_inv_sqrt = 0x7fffffff;
+ 		}
+ 		vars->lastcount = vars->count;
+ 		vars->drop_next = codel_control_law(now, params->interval,
+-						    vars->count);
++						    vars->rec_inv_sqrt);
+ 	}
+ end:
+ 	return skb;
diff --git a/target/linux/generic/patches-3.3/042-fq_codel-Fair-Queue-Codel-AQM.patch b/target/linux/generic/patches-3.3/042-fq_codel-Fair-Queue-Codel-AQM.patch
new file mode 100644
index 0000000..26bbbcb
--- /dev/null
+++ b/target/linux/generic/patches-3.3/042-fq_codel-Fair-Queue-Codel-AQM.patch
@@ -0,0 +1,839 @@
+From f8cf19c19528a468cc0b9846c0328a94cccdc605 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 11 May 2012 09:30:50 +0000
+Subject: [PATCH] fq_codel: Fair Queue Codel AQM
+
+commit 4b549a2ef4bef9965d97cbd992ba67930cd3e0fe upstream.
+
+Fair Queue Codel packet scheduler
+
+Principles :
+
+- Packets are classified (internal classifier or external) on flows.
+- This is a Stochastic model (as we use a hash, several flows might
+                              be hashed on same slot)
+- Each flow has a CoDel managed queue.
+- Flows are linked onto two (Round Robin) lists,
+  so that new flows have priority on old ones.
+
+- For a given flow, packets are not reordered (CoDel uses a FIFO)
+- head drops only.
+- ECN capability is on by default.
+- Very low memory footprint (64 bytes per flow)
+
+tc qdisc ... fq_codel [ limit PACKETS ] [ flows number ]
+                      [ target TIME ] [ interval TIME ] [ noecn ]
+                      [ quantum BYTES ]
+
+defaults : 1024 flows, 10240 packets limit, quantum : device MTU
+           target : 5ms (CoDel default)
+           interval : 100ms (CoDel default)
+
+Impressive results on load :
+
+class htb 1:1 root leaf 10: prio 0 quantum 1514 rate 200000Kbit ceil 200000Kbit burst 1475b/8 mpu 0b overhead 0b cburst 1475b/8 mpu 0b overhead 0b level 0
+ Sent 43304920109 bytes 33063109 pkt (dropped 0, overlimits 0 requeues 0)
+ rate 201691Kbit 28595pps backlog 0b 312p requeues 0
+ lended: 33063109 borrowed: 0 giants: 0
+ tokens: -912 ctokens: -912
+
+class fq_codel 10:1735 parent 10:
+ (dropped 1292, overlimits 0 requeues 0)
+ backlog 15140b 10p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+class fq_codel 10:4524 parent 10:
+ (dropped 1291, overlimits 0 requeues 0)
+ backlog 16654b 11p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+class fq_codel 10:4e74 parent 10:
+ (dropped 1290, overlimits 0 requeues 0)
+ backlog 6056b 4p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 6.4ms dropping drop_next 92.0ms
+class fq_codel 10:628a parent 10:
+ (dropped 1289, overlimits 0 requeues 0)
+ backlog 7570b 5p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 5.4ms dropping drop_next 90.9ms
+class fq_codel 10:a4b3 parent 10:
+ (dropped 302, overlimits 0 requeues 0)
+ backlog 16654b 11p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+class fq_codel 10:c3c2 parent 10:
+ (dropped 1284, overlimits 0 requeues 0)
+ backlog 13626b 9p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 5.9ms
+class fq_codel 10:d331 parent 10:
+ (dropped 299, overlimits 0 requeues 0)
+ backlog 15140b 10p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.0ms
+class fq_codel 10:d526 parent 10:
+ (dropped 12160, overlimits 0 requeues 0)
+ backlog 35870b 211p requeues 0
+  deficit 1508 count 12160 lastcount 1 ldelay 15.3ms dropping drop_next 247us
+class fq_codel 10:e2c6 parent 10:
+ (dropped 1288, overlimits 0 requeues 0)
+ backlog 15140b 10p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+class fq_codel 10:eab5 parent 10:
+ (dropped 1285, overlimits 0 requeues 0)
+ backlog 16654b 11p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 5.9ms
+class fq_codel 10:f220 parent 10:
+ (dropped 1289, overlimits 0 requeues 0)
+ backlog 15140b 10p requeues 0
+  deficit 1514 count 1 lastcount 1 ldelay 7.1ms
+
+qdisc htb 1: root refcnt 6 r2q 10 default 1 direct_packets_stat 0 ver 3.17
+ Sent 43331086547 bytes 33092812 pkt (dropped 0, overlimits 66063544 requeues 71)
+ rate 201697Kbit 28602pps backlog 0b 260p requeues 71
+qdisc fq_codel 10: parent 1:1 limit 10240p flows 65536 target 5.0ms interval 100.0ms ecn
+ Sent 43331086547 bytes 33092812 pkt (dropped 949359, overlimits 0 requeues 0)
+ rate 201697Kbit 28602pps backlog 189352b 260p requeues 0
+  maxpacket 1514 drop_overlimit 0 new_flow_count 5582 ecn_mark 125593
+  new_flows_len 0 old_flows_len 11
+
+PING 172.30.42.18 (172.30.42.18) 56(84) bytes of data.
+64 bytes from 172.30.42.18: icmp_req=1 ttl=64 time=0.227 ms
+64 bytes from 172.30.42.18: icmp_req=2 ttl=64 time=0.165 ms
+64 bytes from 172.30.42.18: icmp_req=3 ttl=64 time=0.166 ms
+64 bytes from 172.30.42.18: icmp_req=4 ttl=64 time=0.151 ms
+64 bytes from 172.30.42.18: icmp_req=5 ttl=64 time=0.164 ms
+64 bytes from 172.30.42.18: icmp_req=6 ttl=64 time=0.172 ms
+64 bytes from 172.30.42.18: icmp_req=7 ttl=64 time=0.175 ms
+64 bytes from 172.30.42.18: icmp_req=8 ttl=64 time=0.183 ms
+64 bytes from 172.30.42.18: icmp_req=9 ttl=64 time=0.158 ms
+64 bytes from 172.30.42.18: icmp_req=10 ttl=64 time=0.200 ms
+
+10 packets transmitted, 10 received, 0% packet loss, time 8999ms
+rtt min/avg/max/mdev = 0.151/0.176/0.227/0.022 ms
+
+Much better than SFQ because of priority given to new flows, and fast
+path dirtying less cache lines.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/linux/pkt_sched.h |   54 ++++
+ net/sched/Kconfig         |   11 +
+ net/sched/Makefile        |    1 +
+ net/sched/sch_fq_codel.c  |  624 +++++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 690 insertions(+)
+ create mode 100644 net/sched/sch_fq_codel.c
+
+--- a/include/linux/pkt_sched.h
++++ b/include/linux/pkt_sched.h
+@@ -659,4 +659,58 @@ struct tc_codel_xstats {
+ 	__u32	dropping;  /* are we in dropping state ? */
+ };
+ 
++/* FQ_CODEL */
++
++enum {
++	TCA_FQ_CODEL_UNSPEC,
++	TCA_FQ_CODEL_TARGET,
++	TCA_FQ_CODEL_LIMIT,
++	TCA_FQ_CODEL_INTERVAL,
++	TCA_FQ_CODEL_ECN,
++	TCA_FQ_CODEL_FLOWS,
++	TCA_FQ_CODEL_QUANTUM,
++	__TCA_FQ_CODEL_MAX
++};
++
++#define TCA_FQ_CODEL_MAX	(__TCA_FQ_CODEL_MAX - 1)
++
++enum {
++	TCA_FQ_CODEL_XSTATS_QDISC,
++	TCA_FQ_CODEL_XSTATS_CLASS,
++};
++
++struct tc_fq_codel_qd_stats {
++	__u32	maxpacket;	/* largest packet we've seen so far */
++	__u32	drop_overlimit; /* number of time max qdisc
++				 * packet limit was hit
++				 */
++	__u32	ecn_mark;	/* number of packets we ECN marked
++				 * instead of being dropped
++				 */
++	__u32	new_flow_count; /* number of time packets
++				 * created a 'new flow'
++				 */
++	__u32	new_flows_len;	/* count of flows in new list */
++	__u32	old_flows_len;	/* count of flows in old list */
++};
++
++struct tc_fq_codel_cl_stats {
++	__s32	deficit;
++	__u32	ldelay;		/* in-queue delay seen by most recently
++				 * dequeued packet
++				 */
++	__u32	count;
++	__u32	lastcount;
++	__u32	dropping;
++	__s32	drop_next;
++};
++
++struct tc_fq_codel_xstats {
++	__u32	type;
++	union {
++		struct tc_fq_codel_qd_stats qdisc_stats;
++		struct tc_fq_codel_cl_stats class_stats;
++	};
++};
++
+ #endif
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -261,6 +261,17 @@ config NET_SCH_CODEL
+ 
+ 	  If unsure, say N.
+ 
++config NET_SCH_FQ_CODEL
++	tristate "Fair Queue Controlled Delay AQM (FQ_CODEL)"
++	help
++	  Say Y here if you want to use the FQ Controlled Delay (FQ_CODEL)
++	  packet scheduling algorithm.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called sch_fq_codel.
++
++	  If unsure, say N.
++
+ config NET_SCH_INGRESS
+ 	tristate "Ingress Qdisc"
+ 	depends on NET_CLS_ACT
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -37,6 +37,7 @@ obj-$(CONFIG_NET_SCH_MQPRIO)	+= sch_mqpr
+ obj-$(CONFIG_NET_SCH_CHOKE)	+= sch_choke.o
+ obj-$(CONFIG_NET_SCH_QFQ)	+= sch_qfq.o
+ obj-$(CONFIG_NET_SCH_CODEL)	+= sch_codel.o
++obj-$(CONFIG_NET_SCH_FQ_CODEL)	+= sch_fq_codel.o
+ 
+ obj-$(CONFIG_NET_CLS_U32)	+= cls_u32.o
+ obj-$(CONFIG_NET_CLS_ROUTE4)	+= cls_route.o
+--- /dev/null
++++ b/net/sched/sch_fq_codel.c
+@@ -0,0 +1,624 @@
++/*
++ * Fair Queue CoDel discipline
++ *
++ *	This program is free software; you can redistribute it and/or
++ *	modify it under the terms of the GNU General Public License
++ *	as published by the Free Software Foundation; either version
++ *	2 of the License, or (at your option) any later version.
++ *
++ *  Copyright (C) 2012 Eric Dumazet <edumazet@google.com>
++ */
++
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/jiffies.h>
++#include <linux/string.h>
++#include <linux/in.h>
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/skbuff.h>
++#include <linux/jhash.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <net/netlink.h>
++#include <net/pkt_sched.h>
++#include <net/flow_keys.h>
++#include <net/codel.h>
++
++/*	Fair Queue CoDel.
++ *
++ * Principles :
++ * Packets are classified (internal classifier or external) on flows.
++ * This is a Stochastic model (as we use a hash, several flows
++ *			       might be hashed on same slot)
++ * Each flow has a CoDel managed queue.
++ * Flows are linked onto two (Round Robin) lists,
++ * so that new flows have priority on old ones.
++ *
++ * For a given flow, packets are not reordered (CoDel uses a FIFO)
++ * head drops only.
++ * ECN capability is on by default.
++ * Low memory footprint (64 bytes per flow)
++ */
++
++struct fq_codel_flow {
++	struct sk_buff	  *head;
++	struct sk_buff	  *tail;
++	struct list_head  flowchain;
++	int		  deficit;
++	u32		  dropped; /* number of drops (or ECN marks) on this flow */
++	struct codel_vars cvars;
++}; /* please try to keep this structure <= 64 bytes */
++
++struct fq_codel_sched_data {
++	struct tcf_proto *filter_list;	/* optional external classifier */
++	struct fq_codel_flow *flows;	/* Flows table [flows_cnt] */
++	u32		*backlogs;	/* backlog table [flows_cnt] */
++	u32		flows_cnt;	/* number of flows */
++	u32		perturbation;	/* hash perturbation */
++	u32		quantum;	/* psched_mtu(qdisc_dev(sch)); */
++	struct codel_params cparams;
++	struct codel_stats cstats;
++	u32		drop_overlimit;
++	u32		new_flow_count;
++
++	struct list_head new_flows;	/* list of new flows */
++	struct list_head old_flows;	/* list of old flows */
++};
++
++static unsigned int fq_codel_hash(const struct fq_codel_sched_data *q,
++				  const struct sk_buff *skb)
++{
++	struct flow_keys keys;
++	unsigned int hash;
++
++	skb_flow_dissect(skb, &keys);
++	hash = jhash_3words((__force u32)keys.dst,
++			    (__force u32)keys.src ^ keys.ip_proto,
++			    (__force u32)keys.ports, q->perturbation);
++	return ((u64)hash * q->flows_cnt) >> 32;
++}
++
++static unsigned int fq_codel_classify(struct sk_buff *skb, struct Qdisc *sch,
++				      int *qerr)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct tcf_result res;
++	int result;
++
++	if (TC_H_MAJ(skb->priority) == sch->handle &&
++	    TC_H_MIN(skb->priority) > 0 &&
++	    TC_H_MIN(skb->priority) <= q->flows_cnt)
++		return TC_H_MIN(skb->priority);
++
++	if (!q->filter_list)
++		return fq_codel_hash(q, skb) + 1;
++
++	*qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
++	result = tc_classify(skb, q->filter_list, &res);
++	if (result >= 0) {
++#ifdef CONFIG_NET_CLS_ACT
++		switch (result) {
++		case TC_ACT_STOLEN:
++		case TC_ACT_QUEUED:
++			*qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
++		case TC_ACT_SHOT:
++			return 0;
++		}
++#endif
++		if (TC_H_MIN(res.classid) <= q->flows_cnt)
++			return TC_H_MIN(res.classid);
++	}
++	return 0;
++}
++
++/* helper functions : might be changed when/if skb use a standard list_head */
++
++/* remove one skb from head of slot queue */
++static inline struct sk_buff *dequeue_head(struct fq_codel_flow *flow)
++{
++	struct sk_buff *skb = flow->head;
++
++	flow->head = skb->next;
++	skb->next = NULL;
++	return skb;
++}
++
++/* add skb to flow queue (tail add) */
++static inline void flow_queue_add(struct fq_codel_flow *flow,
++				  struct sk_buff *skb)
++{
++	if (flow->head == NULL)
++		flow->head = skb;
++	else
++		flow->tail->next = skb;
++	flow->tail = skb;
++	skb->next = NULL;
++}
++
++static unsigned int fq_codel_drop(struct Qdisc *sch)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct sk_buff *skb;
++	unsigned int maxbacklog = 0, idx = 0, i, len;
++	struct fq_codel_flow *flow;
++
++	/* Queue is full! Find the fat flow and drop packet from it.
++	 * This might sound expensive, but with 1024 flows, we scan
++	 * 4KB of memory, and we dont need to handle a complex tree
++	 * in fast path (packet queue/enqueue) with many cache misses.
++	 */
++	for (i = 0; i < q->flows_cnt; i++) {
++		if (q->backlogs[i] > maxbacklog) {
++			maxbacklog = q->backlogs[i];
++			idx = i;
++		}
++	}
++	flow = &q->flows[idx];
++	skb = dequeue_head(flow);
++	len = qdisc_pkt_len(skb);
++	q->backlogs[idx] -= len;
++	kfree_skb(skb);
++	sch->q.qlen--;
++	sch->qstats.drops++;
++	sch->qstats.backlog -= len;
++	flow->dropped++;
++	return idx;
++}
++
++static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	unsigned int idx;
++	struct fq_codel_flow *flow;
++	int uninitialized_var(ret);
++
++	idx = fq_codel_classify(skb, sch, &ret);
++	if (idx == 0) {
++		if (ret & __NET_XMIT_BYPASS)
++			sch->qstats.drops++;
++		kfree_skb(skb);
++		return ret;
++	}
++	idx--;
++
++	codel_set_enqueue_time(skb);
++	flow = &q->flows[idx];
++	flow_queue_add(flow, skb);
++	q->backlogs[idx] += qdisc_pkt_len(skb);
++	sch->qstats.backlog += qdisc_pkt_len(skb);
++
++	if (list_empty(&flow->flowchain)) {
++		list_add_tail(&flow->flowchain, &q->new_flows);
++		codel_vars_init(&flow->cvars);
++		q->new_flow_count++;
++		flow->deficit = q->quantum;
++		flow->dropped = 0;
++	}
++	if (++sch->q.qlen < sch->limit)
++		return NET_XMIT_SUCCESS;
++
++	q->drop_overlimit++;
++	/* Return Congestion Notification only if we dropped a packet
++	 * from this flow.
++	 */
++	if (fq_codel_drop(sch) == idx)
++		return NET_XMIT_CN;
++
++	/* As we dropped a packet, better let upper stack know this */
++	qdisc_tree_decrease_qlen(sch, 1);
++	return NET_XMIT_SUCCESS;
++}
++
++/* This is the specific function called from codel_dequeue()
++ * to dequeue a packet from queue. Note: backlog is handled in
++ * codel, we dont need to reduce it here.
++ */
++static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch)
++{
++	struct fq_codel_flow *flow;
++	struct sk_buff *skb = NULL;
++
++	flow = container_of(vars, struct fq_codel_flow, cvars);
++	if (flow->head) {
++		skb = dequeue_head(flow);
++		sch->qstats.backlog -= qdisc_pkt_len(skb);
++		sch->q.qlen--;
++	}
++	return skb;
++}
++
++static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct sk_buff *skb;
++	struct fq_codel_flow *flow;
++	struct list_head *head;
++	u32 prev_drop_count, prev_ecn_mark;
++
++begin:
++	head = &q->new_flows;
++	if (list_empty(head)) {
++		head = &q->old_flows;
++		if (list_empty(head))
++			return NULL;
++	}
++	flow = list_first_entry(head, struct fq_codel_flow, flowchain);
++
++	if (flow->deficit <= 0) {
++		flow->deficit += q->quantum;
++		list_move_tail(&flow->flowchain, &q->old_flows);
++		goto begin;
++	}
++
++	prev_drop_count = q->cstats.drop_count;
++	prev_ecn_mark = q->cstats.ecn_mark;
++
++	skb = codel_dequeue(sch, &q->cparams, &flow->cvars, &q->cstats,
++			    dequeue, &q->backlogs[flow - q->flows]);
++
++	flow->dropped += q->cstats.drop_count - prev_drop_count;
++	flow->dropped += q->cstats.ecn_mark - prev_ecn_mark;
++
++	if (!skb) {
++		/* force a pass through old_flows to prevent starvation */
++		if ((head == &q->new_flows) && !list_empty(&q->old_flows))
++			list_move_tail(&flow->flowchain, &q->old_flows);
++		else
++			list_del_init(&flow->flowchain);
++		goto begin;
++	}
++	qdisc_bstats_update(sch, skb);
++	flow->deficit -= qdisc_pkt_len(skb);
++	/* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
++	 * or HTB crashes. Defer it for next round.
++	 */
++	if (q->cstats.drop_count && sch->q.qlen) {
++		qdisc_tree_decrease_qlen(sch, q->cstats.drop_count);
++		q->cstats.drop_count = 0;
++	}
++	return skb;
++}
++
++static void fq_codel_reset(struct Qdisc *sch)
++{
++	struct sk_buff *skb;
++
++	while ((skb = fq_codel_dequeue(sch)) != NULL)
++		kfree_skb(skb);
++}
++
++static const struct nla_policy fq_codel_policy[TCA_FQ_CODEL_MAX + 1] = {
++	[TCA_FQ_CODEL_TARGET]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_LIMIT]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_INTERVAL]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_ECN]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_FLOWS]	= { .type = NLA_U32 },
++	[TCA_FQ_CODEL_QUANTUM]	= { .type = NLA_U32 },
++};
++
++static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct nlattr *tb[TCA_FQ_CODEL_MAX + 1];
++	int err;
++
++	if (!opt)
++		return -EINVAL;
++
++	err = nla_parse_nested(tb, TCA_FQ_CODEL_MAX, opt, fq_codel_policy);
++	if (err < 0)
++		return err;
++	if (tb[TCA_FQ_CODEL_FLOWS]) {
++		if (q->flows)
++			return -EINVAL;
++		q->flows_cnt = nla_get_u32(tb[TCA_FQ_CODEL_FLOWS]);
++		if (!q->flows_cnt ||
++		    q->flows_cnt > 65536)
++			return -EINVAL;
++	}
++	sch_tree_lock(sch);
++
++	if (tb[TCA_FQ_CODEL_TARGET]) {
++		u64 target = nla_get_u32(tb[TCA_FQ_CODEL_TARGET]);
++
++		q->cparams.target = (target * NSEC_PER_USEC) >> CODEL_SHIFT;
++	}
++
++	if (tb[TCA_FQ_CODEL_INTERVAL]) {
++		u64 interval = nla_get_u32(tb[TCA_FQ_CODEL_INTERVAL]);
++
++		q->cparams.interval = (interval * NSEC_PER_USEC) >> CODEL_SHIFT;
++	}
++
++	if (tb[TCA_FQ_CODEL_LIMIT])
++		sch->limit = nla_get_u32(tb[TCA_FQ_CODEL_LIMIT]);
++
++	if (tb[TCA_FQ_CODEL_ECN])
++		q->cparams.ecn = !!nla_get_u32(tb[TCA_FQ_CODEL_ECN]);
++
++	if (tb[TCA_FQ_CODEL_QUANTUM])
++		q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
++
++	while (sch->q.qlen > sch->limit) {
++		struct sk_buff *skb = fq_codel_dequeue(sch);
++
++		kfree_skb(skb);
++		q->cstats.drop_count++;
++	}
++	qdisc_tree_decrease_qlen(sch, q->cstats.drop_count);
++	q->cstats.drop_count = 0;
++
++	sch_tree_unlock(sch);
++	return 0;
++}
++
++static void *fq_codel_zalloc(size_t sz)
++{
++	void *ptr = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN);
++
++	if (!ptr)
++		ptr = vzalloc(sz);
++	return ptr;
++}
++
++static void fq_codel_free(void *addr)
++{
++	if (addr) {
++		if (is_vmalloc_addr(addr))
++			vfree(addr);
++		else
++			kfree(addr);
++	}
++}
++
++static void fq_codel_destroy(struct Qdisc *sch)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++
++	tcf_destroy_chain(&q->filter_list);
++	fq_codel_free(q->backlogs);
++	fq_codel_free(q->flows);
++}
++
++static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	int i;
++
++	sch->limit = 10*1024;
++	q->flows_cnt = 1024;
++	q->quantum = psched_mtu(qdisc_dev(sch));
++	q->perturbation = net_random();
++	INIT_LIST_HEAD(&q->new_flows);
++	INIT_LIST_HEAD(&q->old_flows);
++	codel_params_init(&q->cparams);
++	codel_stats_init(&q->cstats);
++	q->cparams.ecn = true;
++
++	if (opt) {
++		int err = fq_codel_change(sch, opt);
++		if (err)
++			return err;
++	}
++
++	if (!q->flows) {
++		q->flows = fq_codel_zalloc(q->flows_cnt *
++					   sizeof(struct fq_codel_flow));
++		if (!q->flows)
++			return -ENOMEM;
++		q->backlogs = fq_codel_zalloc(q->flows_cnt * sizeof(u32));
++		if (!q->backlogs) {
++			fq_codel_free(q->flows);
++			return -ENOMEM;
++		}
++		for (i = 0; i < q->flows_cnt; i++) {
++			struct fq_codel_flow *flow = q->flows + i;
++
++			INIT_LIST_HEAD(&flow->flowchain);
++		}
++	}
++	if (sch->limit >= 1)
++		sch->flags |= TCQ_F_CAN_BYPASS;
++	else
++		sch->flags &= ~TCQ_F_CAN_BYPASS;
++	return 0;
++}
++
++static int fq_codel_dump(struct Qdisc *sch, struct sk_buff *skb)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct nlattr *opts;
++
++	opts = nla_nest_start(skb, TCA_OPTIONS);
++	if (opts == NULL)
++		goto nla_put_failure;
++
++	if (nla_put_u32(skb, TCA_FQ_CODEL_TARGET,
++			codel_time_to_us(q->cparams.target)) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_LIMIT,
++			sch->limit) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_INTERVAL,
++			codel_time_to_us(q->cparams.interval)) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_ECN,
++			q->cparams.ecn) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_QUANTUM,
++			q->quantum) ||
++	    nla_put_u32(skb, TCA_FQ_CODEL_FLOWS,
++			q->flows_cnt))
++		goto nla_put_failure;
++
++	nla_nest_end(skb, opts);
++	return skb->len;
++
++nla_put_failure:
++	return -1;
++}
++
++static int fq_codel_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	struct tc_fq_codel_xstats st = {
++		.type				= TCA_FQ_CODEL_XSTATS_QDISC,
++		.qdisc_stats.maxpacket		= q->cstats.maxpacket,
++		.qdisc_stats.drop_overlimit	= q->drop_overlimit,
++		.qdisc_stats.ecn_mark		= q->cstats.ecn_mark,
++		.qdisc_stats.new_flow_count	= q->new_flow_count,
++	};
++	struct list_head *pos;
++
++	list_for_each(pos, &q->new_flows)
++		st.qdisc_stats.new_flows_len++;
++
++	list_for_each(pos, &q->old_flows)
++		st.qdisc_stats.old_flows_len++;
++
++	return gnet_stats_copy_app(d, &st, sizeof(st));
++}
++
++static struct Qdisc *fq_codel_leaf(struct Qdisc *sch, unsigned long arg)
++{
++	return NULL;
++}
++
++static unsigned long fq_codel_get(struct Qdisc *sch, u32 classid)
++{
++	return 0;
++}
++
++static unsigned long fq_codel_bind(struct Qdisc *sch, unsigned long parent,
++			      u32 classid)
++{
++	/* we cannot bypass queue discipline anymore */
++	sch->flags &= ~TCQ_F_CAN_BYPASS;
++	return 0;
++}
++
++static void fq_codel_put(struct Qdisc *q, unsigned long cl)
++{
++}
++
++static struct tcf_proto **fq_codel_find_tcf(struct Qdisc *sch, unsigned long cl)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++
++	if (cl)
++		return NULL;
++	return &q->filter_list;
++}
++
++static int fq_codel_dump_class(struct Qdisc *sch, unsigned long cl,
++			  struct sk_buff *skb, struct tcmsg *tcm)
++{
++	tcm->tcm_handle |= TC_H_MIN(cl);
++	return 0;
++}
++
++static int fq_codel_dump_class_stats(struct Qdisc *sch, unsigned long cl,
++				     struct gnet_dump *d)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	u32 idx = cl - 1;
++	struct gnet_stats_queue qs = { 0 };
++	struct tc_fq_codel_xstats xstats;
++
++	if (idx < q->flows_cnt) {
++		const struct fq_codel_flow *flow = &q->flows[idx];
++		const struct sk_buff *skb = flow->head;
++
++		memset(&xstats, 0, sizeof(xstats));
++		xstats.type = TCA_FQ_CODEL_XSTATS_CLASS;
++		xstats.class_stats.deficit = flow->deficit;
++		xstats.class_stats.ldelay =
++			codel_time_to_us(flow->cvars.ldelay);
++		xstats.class_stats.count = flow->cvars.count;
++		xstats.class_stats.lastcount = flow->cvars.lastcount;
++		xstats.class_stats.dropping = flow->cvars.dropping;
++		if (flow->cvars.dropping) {
++			codel_tdiff_t delta = flow->cvars.drop_next -
++					      codel_get_time();
++
++			xstats.class_stats.drop_next = (delta >= 0) ?
++				codel_time_to_us(delta) :
++				-codel_time_to_us(-delta);
++		}
++		while (skb) {
++			qs.qlen++;
++			skb = skb->next;
++		}
++		qs.backlog = q->backlogs[idx];
++		qs.drops = flow->dropped;
++	}
++	if (gnet_stats_copy_queue(d, &qs) < 0)
++		return -1;
++	if (idx < q->flows_cnt)
++		return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
++	return 0;
++}
++
++static void fq_codel_walk(struct Qdisc *sch, struct qdisc_walker *arg)
++{
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
++	unsigned int i;
++
++	if (arg->stop)
++		return;
++
++	for (i = 0; i < q->flows_cnt; i++) {
++		if (list_empty(&q->flows[i].flowchain) ||
++		    arg->count < arg->skip) {
++			arg->count++;
++			continue;
++		}
++		if (arg->fn(sch, i + 1, arg) < 0) {
++			arg->stop = 1;
++			break;
++		}
++		arg->count++;
++	}
++}
++
++static const struct Qdisc_class_ops fq_codel_class_ops = {
++	.leaf		=	fq_codel_leaf,
++	.get		=	fq_codel_get,
++	.put		=	fq_codel_put,
++	.tcf_chain	=	fq_codel_find_tcf,
++	.bind_tcf	=	fq_codel_bind,
++	.unbind_tcf	=	fq_codel_put,
++	.dump		=	fq_codel_dump_class,
++	.dump_stats	=	fq_codel_dump_class_stats,
++	.walk		=	fq_codel_walk,
++};
++
++static struct Qdisc_ops fq_codel_qdisc_ops __read_mostly = {
++	.cl_ops		=	&fq_codel_class_ops,
++	.id		=	"fq_codel",
++	.priv_size	=	sizeof(struct fq_codel_sched_data),
++	.enqueue	=	fq_codel_enqueue,
++	.dequeue	=	fq_codel_dequeue,
++	.peek		=	qdisc_peek_dequeued,
++	.drop		=	fq_codel_drop,
++	.init		=	fq_codel_init,
++	.reset		=	fq_codel_reset,
++	.destroy	=	fq_codel_destroy,
++	.change		=	fq_codel_change,
++	.dump		=	fq_codel_dump,
++	.dump_stats =	fq_codel_dump_stats,
++	.owner		=	THIS_MODULE,
++};
++
++static int __init fq_codel_module_init(void)
++{
++	return register_qdisc(&fq_codel_qdisc_ops);
++}
++
++static void __exit fq_codel_module_exit(void)
++{
++	unregister_qdisc(&fq_codel_qdisc_ops);
++}
++
++module_init(fq_codel_module_init)
++module_exit(fq_codel_module_exit)
++MODULE_AUTHOR("Eric Dumazet");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/patches-3.3/043-net-codel-Add-missing-include-linux-prefetch.h.patch b/target/linux/generic/patches-3.3/043-net-codel-Add-missing-include-linux-prefetch.h.patch
new file mode 100644
index 0000000..3510ee0
--- /dev/null
+++ b/target/linux/generic/patches-3.3/043-net-codel-Add-missing-include-linux-prefetch.h.patch
@@ -0,0 +1,33 @@
+From 18c12e496ead3306de00a82d0bc73d71b34d7c24 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Mon, 14 May 2012 09:47:05 +0000
+Subject: [PATCH] net/codel: Add missing #include <linux/prefetch.h>
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit ce5b4b977127ee20c3f9c3fd3637cd3796f649f5 upstream.
+
+m68k allmodconfig:
+
+net/sched/sch_codel.c: In function ‘dequeue’:
+net/sched/sch_codel.c:70: error: implicit declaration of function ‘prefetch’
+make[1]: *** [net/sched/sch_codel.o] Error 1
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/sched/sch_codel.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -46,6 +46,7 @@
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/skbuff.h>
++#include <linux/prefetch.h>
+ #include <net/pkt_sched.h>
+ #include <net/codel.h>
+ 
diff --git a/target/linux/generic/patches-3.3/044-net-codel-fix-build-errors.patch b/target/linux/generic/patches-3.3/044-net-codel-fix-build-errors.patch
new file mode 100644
index 0000000..219285d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/044-net-codel-fix-build-errors.patch
@@ -0,0 +1,51 @@
+From b49ab5f6bb7e609190065cb9a605de809e50ab60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Mon, 14 May 2012 11:57:06 +0000
+Subject: [PATCH] net: codel: fix build errors
+
+commit 669d67bf777def468970f2dcba1537edf3b2d329 upstream.
+
+Fix the following build error:
+
+net/sched/sch_fq_codel.c: In function 'fq_codel_dump_stats':
+net/sched/sch_fq_codel.c:464:3: error: unknown field 'qdisc_stats' specified in initializer
+net/sched/sch_fq_codel.c:464:3: warning: missing braces around initializer
+net/sched/sch_fq_codel.c:464:3: warning: (near initialization for 'st.<anonymous>')
+net/sched/sch_fq_codel.c:465:3: error: unknown field 'qdisc_stats' specified in initializer
+net/sched/sch_fq_codel.c:465:3: warning: excess elements in struct initializer
+net/sched/sch_fq_codel.c:465:3: warning: (near initialization for 'st')
+net/sched/sch_fq_codel.c:466:3: error: unknown field 'qdisc_stats' specified in initializer
+net/sched/sch_fq_codel.c:466:3: warning: excess elements in struct initializer
+net/sched/sch_fq_codel.c:466:3: warning: (near initialization for 'st')
+net/sched/sch_fq_codel.c:467:3: error: unknown field 'qdisc_stats' specified in initializer
+net/sched/sch_fq_codel.c:467:3: warning: excess elements in struct initializer
+net/sched/sch_fq_codel.c:467:3: warning: (near initialization for 'st')
+make[1]: *** [net/sched/sch_fq_codel.o] Error 1
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/sched/sch_fq_codel.c |    9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -461,13 +461,14 @@ static int fq_codel_dump_stats(struct Qd
+ 	struct fq_codel_sched_data *q = qdisc_priv(sch);
+ 	struct tc_fq_codel_xstats st = {
+ 		.type				= TCA_FQ_CODEL_XSTATS_QDISC,
+-		.qdisc_stats.maxpacket		= q->cstats.maxpacket,
+-		.qdisc_stats.drop_overlimit	= q->drop_overlimit,
+-		.qdisc_stats.ecn_mark		= q->cstats.ecn_mark,
+-		.qdisc_stats.new_flow_count	= q->new_flow_count,
+ 	};
+ 	struct list_head *pos;
+ 
++	st.qdisc_stats.maxpacket = q->cstats.maxpacket;
++	st.qdisc_stats.drop_overlimit = q->drop_overlimit;
++	st.qdisc_stats.ecn_mark = q->cstats.ecn_mark;
++	st.qdisc_stats.new_flow_count = q->new_flow_count;
++
+ 	list_for_each(pos, &q->new_flows)
+ 		st.qdisc_stats.new_flows_len++;
+ 
diff --git a/target/linux/generic/patches-3.3/045-codel-use-u16-field-instead-of-31bits-for-rec_inv_sq.patch b/target/linux/generic/patches-3.3/045-codel-use-u16-field-instead-of-31bits-for-rec_inv_sq.patch
new file mode 100644
index 0000000..933a3dc
--- /dev/null
+++ b/target/linux/generic/patches-3.3/045-codel-use-u16-field-instead-of-31bits-for-rec_inv_sq.patch
@@ -0,0 +1,86 @@
+From 03333931c17d9c62ba4063d4e4fec1578c0729a7 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sat, 12 May 2012 21:23:23 +0000
+Subject: [PATCH] codel: use u16 field instead of 31bits for rec_inv_sqrt
+
+commit 6ff272c9ad65eda219cd975b9da2dbc31cc812ee upstream.
+
+David pointed out gcc might generate poor code with 31bit fields.
+
+Using u16 is more than enough and permits a better code output.
+
+Also make the code intent more readable using constants, fixed point arithmetic
+not being trivial for everybody.
+
+Suggested-by: David Miller <davem@davemloft.net>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/codel.h |   25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -133,13 +133,17 @@ struct codel_params {
+ struct codel_vars {
+ 	u32		count;
+ 	u32		lastcount;
+-	bool		dropping:1;
+-	u32		rec_inv_sqrt:31;
++	bool		dropping;
++	u16		rec_inv_sqrt;
+ 	codel_time_t	first_above_time;
+ 	codel_time_t	drop_next;
+ 	codel_time_t	ldelay;
+ };
+ 
++#define REC_INV_SQRT_BITS (8 * sizeof(u16)) /* or sizeof_in_bits(rec_inv_sqrt) */
++/* needed shift to get a Q0.32 number from rec_inv_sqrt */
++#define REC_INV_SQRT_SHIFT (32 - REC_INV_SQRT_BITS)
++
+ /**
+  * struct codel_stats - contains codel shared variables and stats
+  * @maxpacket:	largest packet we've seen so far
+@@ -173,17 +177,18 @@ static void codel_stats_init(struct code
+  * http://en.wikipedia.org/wiki/Methods_of_computing_square_roots#Iterative_methods_for_reciprocal_square_roots
+  * new_invsqrt = (invsqrt / 2) * (3 - count * invsqrt^2)
+  *
+- * Here, invsqrt is a fixed point number (< 1.0), 31bit mantissa)
++ * Here, invsqrt is a fixed point number (< 1.0), 32bit mantissa, aka Q0.32
+  */
+ static void codel_Newton_step(struct codel_vars *vars)
+ {
+-	u32 invsqrt = vars->rec_inv_sqrt;
+-	u32 invsqrt2 = ((u64)invsqrt * invsqrt) >> 31;
+-	u64 val = (3LL << 31) - ((u64)vars->count * invsqrt2);
++	u32 invsqrt = ((u32)vars->rec_inv_sqrt) << REC_INV_SQRT_SHIFT;
++	u32 invsqrt2 = ((u64)invsqrt * invsqrt) >> 32;
++	u64 val = (3LL << 32) - ((u64)vars->count * invsqrt2);
+ 
+-	val = (val * invsqrt) >> 32;
++	val >>= 2; /* avoid overflow in following multiply */
++	val = (val * invsqrt) >> (32 - 2 + 1);
+ 
+-	vars->rec_inv_sqrt = val;
++	vars->rec_inv_sqrt = val >> REC_INV_SQRT_SHIFT;
+ }
+ 
+ /*
+@@ -195,7 +200,7 @@ static codel_time_t codel_control_law(co
+ 				      codel_time_t interval,
+ 				      u32 rec_inv_sqrt)
+ {
+-	return t + reciprocal_divide(interval, rec_inv_sqrt << 1);
++	return t + reciprocal_divide(interval, rec_inv_sqrt << REC_INV_SQRT_SHIFT);
+ }
+ 
+ 
+@@ -326,7 +331,7 @@ static struct sk_buff *codel_dequeue(str
+ 			codel_Newton_step(vars);
+ 		} else {
+ 			vars->count = 1;
+-			vars->rec_inv_sqrt = 0x7fffffff;
++			vars->rec_inv_sqrt = ~0U >> REC_INV_SQRT_SHIFT;
+ 		}
+ 		vars->lastcount = vars->count;
+ 		vars->drop_next = codel_control_law(now, params->interval,
diff --git a/target/linux/generic/patches-3.3/046-fq_codel-qdisc-backlog.patch b/target/linux/generic/patches-3.3/046-fq_codel-qdisc-backlog.patch
new file mode 100644
index 0000000..f9bcbbd
--- /dev/null
+++ b/target/linux/generic/patches-3.3/046-fq_codel-qdisc-backlog.patch
@@ -0,0 +1,132 @@
+From 7bd90773f89001ea4960ed47676b550137f3facb Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 16 May 2012 04:39:09 +0000
+Subject: [PATCH] fq_codel: should use qdisc backlog as threshold
+
+commit 865ec5523dadbedefbc5710a68969f686a28d928 upstream.
+
+codel_should_drop() logic allows a packet being not dropped if queue
+size is under max packet size.
+
+In fq_codel, we have two possible backlogs : The qdisc global one, and
+the flow local one.
+
+The meaningful one for codel_should_drop() should be the global backlog,
+not the per flow one, so that thin flows can have a non zero drop/mark
+probability.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Dave Taht <dave.taht@bufferbloat.net>
+Cc: Kathleen Nichols <nichols@pollere.com>
+Cc: Van Jacobson <van@pollere.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/codel.h      |   15 +++++++--------
+ net/sched/sch_codel.c    |    4 ++--
+ net/sched/sch_fq_codel.c |    5 +++--
+ 3 files changed, 12 insertions(+), 12 deletions(-)
+
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -205,7 +205,7 @@ static codel_time_t codel_control_law(co
+ 
+ 
+ static bool codel_should_drop(const struct sk_buff *skb,
+-			      unsigned int *backlog,
++			      struct Qdisc *sch,
+ 			      struct codel_vars *vars,
+ 			      struct codel_params *params,
+ 			      struct codel_stats *stats,
+@@ -219,13 +219,13 @@ static bool codel_should_drop(const stru
+ 	}
+ 
+ 	vars->ldelay = now - codel_get_enqueue_time(skb);
+-	*backlog -= qdisc_pkt_len(skb);
++	sch->qstats.backlog -= qdisc_pkt_len(skb);
+ 
+ 	if (unlikely(qdisc_pkt_len(skb) > stats->maxpacket))
+ 		stats->maxpacket = qdisc_pkt_len(skb);
+ 
+ 	if (codel_time_before(vars->ldelay, params->target) ||
+-	    *backlog <= stats->maxpacket) {
++	    sch->qstats.backlog <= stats->maxpacket) {
+ 		/* went below - stay below for at least interval */
+ 		vars->first_above_time = 0;
+ 		return false;
+@@ -249,8 +249,7 @@ static struct sk_buff *codel_dequeue(str
+ 				     struct codel_params *params,
+ 				     struct codel_vars *vars,
+ 				     struct codel_stats *stats,
+-				     codel_skb_dequeue_t dequeue_func,
+-				     u32 *backlog)
++				     codel_skb_dequeue_t dequeue_func)
+ {
+ 	struct sk_buff *skb = dequeue_func(vars, sch);
+ 	codel_time_t now;
+@@ -261,7 +260,7 @@ static struct sk_buff *codel_dequeue(str
+ 		return skb;
+ 	}
+ 	now = codel_get_time();
+-	drop = codel_should_drop(skb, backlog, vars, params, stats, now);
++	drop = codel_should_drop(skb, sch, vars, params, stats, now);
+ 	if (vars->dropping) {
+ 		if (!drop) {
+ 			/* sojourn time below target - leave dropping state */
+@@ -292,7 +291,7 @@ static struct sk_buff *codel_dequeue(str
+ 				qdisc_drop(skb, sch);
+ 				stats->drop_count++;
+ 				skb = dequeue_func(vars, sch);
+-				if (!codel_should_drop(skb, backlog,
++				if (!codel_should_drop(skb, sch,
+ 						       vars, params, stats, now)) {
+ 					/* leave dropping state */
+ 					vars->dropping = false;
+@@ -313,7 +312,7 @@ static struct sk_buff *codel_dequeue(str
+ 			stats->drop_count++;
+ 
+ 			skb = dequeue_func(vars, sch);
+-			drop = codel_should_drop(skb, backlog, vars, params,
++			drop = codel_should_drop(skb, sch, vars, params,
+ 						 stats, now);
+ 		}
+ 		vars->dropping = true;
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -77,8 +77,8 @@ static struct sk_buff *codel_qdisc_deque
+ 	struct codel_sched_data *q = qdisc_priv(sch);
+ 	struct sk_buff *skb;
+ 
+-	skb = codel_dequeue(sch, &q->params, &q->vars, &q->stats,
+-			    dequeue, &sch->qstats.backlog);
++	skb = codel_dequeue(sch, &q->params, &q->vars, &q->stats, dequeue);
++
+ 	/* We cant call qdisc_tree_decrease_qlen() if our qlen is 0,
+ 	 * or HTB crashes. Defer it for next round.
+ 	 */
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -217,13 +217,14 @@ static int fq_codel_enqueue(struct sk_bu
+  */
+ static struct sk_buff *dequeue(struct codel_vars *vars, struct Qdisc *sch)
+ {
++	struct fq_codel_sched_data *q = qdisc_priv(sch);
+ 	struct fq_codel_flow *flow;
+ 	struct sk_buff *skb = NULL;
+ 
+ 	flow = container_of(vars, struct fq_codel_flow, cvars);
+ 	if (flow->head) {
+ 		skb = dequeue_head(flow);
+-		sch->qstats.backlog -= qdisc_pkt_len(skb);
++		q->backlogs[flow - q->flows] -= qdisc_pkt_len(skb);
+ 		sch->q.qlen--;
+ 	}
+ 	return skb;
+@@ -256,7 +257,7 @@ begin:
+ 	prev_ecn_mark = q->cstats.ecn_mark;
+ 
+ 	skb = codel_dequeue(sch, &q->cparams, &flow->cvars, &q->cstats,
+-			    dequeue, &q->backlogs[flow - q->flows]);
++			    dequeue);
+ 
+ 	flow->dropped += q->cstats.drop_count - prev_drop_count;
+ 	flow->dropped += q->cstats.ecn_mark - prev_ecn_mark;
diff --git a/target/linux/generic/patches-3.3/047-spi_message_queue.patch b/target/linux/generic/patches-3.3/047-spi_message_queue.patch
new file mode 100644
index 0000000..9aff0be
--- /dev/null
+++ b/target/linux/generic/patches-3.3/047-spi_message_queue.patch
@@ -0,0 +1,603 @@
+commit ffbbdd21329f3e15eeca6df2d4bc11c04d9d91c0
+Author: Linus Walleij <linus.walleij@linaro.org>
+Date:   Wed Feb 22 10:05:38 2012 +0100
+
+    spi: create a message queueing infrastructure
+    
+    This rips the message queue in the PL022 driver out and pushes
+    it into (optional) common infrastructure. Drivers that want to
+    use the message pumping thread will need to define the new
+    per-messags transfer methods and leave the deprecated transfer()
+    method as NULL.
+    
+    Most of the design is described in the documentation changes that
+    are included in this patch.
+    
+    Since there is a queue that need to be stopped when the system
+    is suspending/resuming, two new calls are implemented for the
+    device drivers to call in their suspend()/resume() functions:
+    spi_master_suspend() and spi_master_resume().
+    
+    ChangeLog v1->v2:
+    - Remove Kconfig entry and do not make the queue support optional
+      at all, instead be more agressive and have it as part of the
+      compulsory infrastructure.
+    - If the .transfer() method is implemented, delete print a small
+      deprecation notice and do not start the transfer pump.
+    - Fix a bitrotted comment.
+    ChangeLog v2->v3:
+    - Fix up a problematic sequence courtesy of Chris Blair.
+    - Stop rather than destroy the queue on suspend() courtesy of
+      Chris Blair.
+    
+    Signed-off-by: Chris Blair <chris.blair@stericsson.com>
+    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+    Tested-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+    Reviewed-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+    Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+
+[Florian: dropped the changes on drivers/spi/spi-pl022.c, removed
+the dev_info() about unqueued drivers still using the master function]
+
+--- a/Documentation/spi/spi-summary
++++ b/Documentation/spi/spi-summary
+@@ -1,7 +1,7 @@
+ Overview of Linux kernel SPI support
+ ====================================
+ 
+-21-May-2007
++02-Feb-2012
+ 
+ What is SPI?
+ ------------
+@@ -483,9 +483,9 @@ also initialize its own internal state.
+ and those methods.)
+ 
+ After you initialize the spi_master, then use spi_register_master() to
+-publish it to the rest of the system.  At that time, device nodes for
+-the controller and any predeclared spi devices will be made available,
+-and the driver model core will take care of binding them to drivers.
++publish it to the rest of the system. At that time, device nodes for the
++controller and any predeclared spi devices will be made available, and
++the driver model core will take care of binding them to drivers.
+ 
+ If you need to remove your SPI controller driver, spi_unregister_master()
+ will reverse the effect of spi_register_master().
+@@ -521,21 +521,53 @@ SPI MASTER METHODS
+ 		** When you code setup(), ASSUME that the controller
+ 		** is actively processing transfers for another device.
+ 
+-    master->transfer(struct spi_device *spi, struct spi_message *message)
+-    	This must not sleep.  Its responsibility is arrange that the
+-	transfer happens and its complete() callback is issued.  The two
+-	will normally happen later, after other transfers complete, and
+-	if the controller is idle it will need to be kickstarted.
+-
+     master->cleanup(struct spi_device *spi)
+ 	Your controller driver may use spi_device.controller_state to hold
+ 	state it dynamically associates with that device.  If you do that,
+ 	be sure to provide the cleanup() method to free that state.
+ 
++    master->prepare_transfer_hardware(struct spi_master *master)
++	This will be called by the queue mechanism to signal to the driver
++	that a message is coming in soon, so the subsystem requests the
++	driver to prepare the transfer hardware by issuing this call.
++	This may sleep.
++
++    master->unprepare_transfer_hardware(struct spi_master *master)
++	This will be called by the queue mechanism to signal to the driver
++	that there are no more messages pending in the queue and it may
++	relax the hardware (e.g. by power management calls). This may sleep.
++
++    master->transfer_one_message(struct spi_master *master,
++				 struct spi_message *mesg)
++	The subsystem calls the driver to transfer a single message while
++	queuing transfers that arrive in the meantime. When the driver is
++	finished with this message, it must call
++	spi_finalize_current_message() so the subsystem can issue the next
++	transfer. This may sleep.
++
++    DEPRECATED METHODS
++
++    master->transfer(struct spi_device *spi, struct spi_message *message)
++	This must not sleep. Its responsibility is arrange that the
++	transfer happens and its complete() callback is issued. The two
++	will normally happen later, after other transfers complete, and
++	if the controller is idle it will need to be kickstarted. This
++	method is not used on queued controllers and must be NULL if
++	transfer_one_message() and (un)prepare_transfer_hardware() are
++	implemented.
++
+ 
+ SPI MESSAGE QUEUE
+ 
+-The bulk of the driver will be managing the I/O queue fed by transfer().
++If you are happy with the standard queueing mechanism provided by the
++SPI subsystem, just implement the queued methods specified above. Using
++the message queue has the upside of centralizing a lot of code and
++providing pure process-context execution of methods. The message queue
++can also be elevated to realtime priority on high-priority SPI traffic.
++
++Unless the queueing mechanism in the SPI subsystem is selected, the bulk
++of the driver will be managing the I/O queue fed by the now deprecated
++function transfer().
+ 
+ That queue could be purely conceptual.  For example, a driver used only
+ for low-frequency sensor access might be fine using synchronous PIO.
+@@ -561,4 +593,6 @@ Stephen Street
+ Mark Underwood
+ Andrew Victor
+ Vitaly Wool
+-
++Grant Likely
++Mark Brown
++Linus Walleij
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -30,6 +30,9 @@
+ #include <linux/of_spi.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/export.h>
++#include <linux/sched.h>
++#include <linux/delay.h>
++#include <linux/kthread.h>
+ 
+ static void spidev_release(struct device *dev)
+ {
+@@ -507,6 +510,293 @@ spi_register_board_info(struct spi_board
+ 
+ /*-------------------------------------------------------------------------*/
+ 
++/**
++ * spi_pump_messages - kthread work function which processes spi message queue
++ * @work: pointer to kthread work struct contained in the master struct
++ *
++ * This function checks if there is any spi message in the queue that
++ * needs processing and if so call out to the driver to initialize hardware
++ * and transfer each message.
++ *
++ */
++static void spi_pump_messages(struct kthread_work *work)
++{
++	struct spi_master *master =
++		container_of(work, struct spi_master, pump_messages);
++	unsigned long flags;
++	bool was_busy = false;
++	int ret;
++
++	/* Lock queue and check for queue work */
++	spin_lock_irqsave(&master->queue_lock, flags);
++	if (list_empty(&master->queue) || !master->running) {
++		if (master->busy) {
++			ret = master->unprepare_transfer_hardware(master);
++			if (ret) {
++				dev_err(&master->dev,
++					"failed to unprepare transfer hardware\n");
++				return;
++			}
++		}
++		master->busy = false;
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		return;
++	}
++
++	/* Make sure we are not already running a message */
++	if (master->cur_msg) {
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		return;
++	}
++	/* Extract head of queue */
++	master->cur_msg =
++	    list_entry(master->queue.next, struct spi_message, queue);
++
++	list_del_init(&master->cur_msg->queue);
++	if (master->busy)
++		was_busy = true;
++	else
++		master->busy = true;
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	if (!was_busy) {
++		ret = master->prepare_transfer_hardware(master);
++		if (ret) {
++			dev_err(&master->dev,
++				"failed to prepare transfer hardware\n");
++			return;
++		}
++	}
++
++	ret = master->transfer_one_message(master, master->cur_msg);
++	if (ret) {
++		dev_err(&master->dev,
++			"failed to transfer one message from queue\n");
++		return;
++	}
++}
++
++static int spi_init_queue(struct spi_master *master)
++{
++	struct sched_param param = { .sched_priority = MAX_RT_PRIO - 1 };
++
++	INIT_LIST_HEAD(&master->queue);
++	spin_lock_init(&master->queue_lock);
++
++	master->running = false;
++	master->busy = false;
++
++	init_kthread_worker(&master->kworker);
++	master->kworker_task = kthread_run(kthread_worker_fn,
++					   &master->kworker,
++					   dev_name(&master->dev));
++	if (IS_ERR(master->kworker_task)) {
++		dev_err(&master->dev, "failed to create message pump task\n");
++		return -ENOMEM;
++	}
++	init_kthread_work(&master->pump_messages, spi_pump_messages);
++
++	/*
++	 * Master config will indicate if this controller should run the
++	 * message pump with high (realtime) priority to reduce the transfer
++	 * latency on the bus by minimising the delay between a transfer
++	 * request and the scheduling of the message pump thread. Without this
++	 * setting the message pump thread will remain at default priority.
++	 */
++	if (master->rt) {
++		dev_info(&master->dev,
++			"will run message pump with realtime priority\n");
++		sched_setscheduler(master->kworker_task, SCHED_FIFO, &param);
++	}
++
++	return 0;
++}
++
++/**
++ * spi_get_next_queued_message() - called by driver to check for queued
++ * messages
++ * @master: the master to check for queued messages
++ *
++ * If there are more messages in the queue, the next message is returned from
++ * this call.
++ */
++struct spi_message *spi_get_next_queued_message(struct spi_master *master)
++{
++	struct spi_message *next;
++	unsigned long flags;
++
++	/* get a pointer to the next message, if any */
++	spin_lock_irqsave(&master->queue_lock, flags);
++	if (list_empty(&master->queue))
++		next = NULL;
++	else
++		next = list_entry(master->queue.next,
++				  struct spi_message, queue);
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	return next;
++}
++EXPORT_SYMBOL_GPL(spi_get_next_queued_message);
++
++/**
++ * spi_finalize_current_message() - the current message is complete
++ * @master: the master to return the message to
++ *
++ * Called by the driver to notify the core that the message in the front of the
++ * queue is complete and can be removed from the queue.
++ */
++void spi_finalize_current_message(struct spi_master *master)
++{
++	struct spi_message *mesg;
++	unsigned long flags;
++
++	spin_lock_irqsave(&master->queue_lock, flags);
++	mesg = master->cur_msg;
++	master->cur_msg = NULL;
++
++	queue_kthread_work(&master->kworker, &master->pump_messages);
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	mesg->state = NULL;
++	if (mesg->complete)
++		mesg->complete(mesg->context);
++}
++EXPORT_SYMBOL_GPL(spi_finalize_current_message);
++
++static int spi_start_queue(struct spi_master *master)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&master->queue_lock, flags);
++
++	if (master->running || master->busy) {
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		return -EBUSY;
++	}
++
++	master->running = true;
++	master->cur_msg = NULL;
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	queue_kthread_work(&master->kworker, &master->pump_messages);
++
++	return 0;
++}
++
++static int spi_stop_queue(struct spi_master *master)
++{
++	unsigned long flags;
++	unsigned limit = 500;
++	int ret = 0;
++
++	spin_lock_irqsave(&master->queue_lock, flags);
++
++	/*
++	 * This is a bit lame, but is optimized for the common execution path.
++	 * A wait_queue on the master->busy could be used, but then the common
++	 * execution path (pump_messages) would be required to call wake_up or
++	 * friends on every SPI message. Do this instead.
++	 */
++	while ((!list_empty(&master->queue) || master->busy) && limit--) {
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		msleep(10);
++		spin_lock_irqsave(&master->queue_lock, flags);
++	}
++
++	if (!list_empty(&master->queue) || master->busy)
++		ret = -EBUSY;
++	else
++		master->running = false;
++
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++
++	if (ret) {
++		dev_warn(&master->dev,
++			 "could not stop message queue\n");
++		return ret;
++	}
++	return ret;
++}
++
++static int spi_destroy_queue(struct spi_master *master)
++{
++	int ret;
++
++	ret = spi_stop_queue(master);
++
++	/*
++	 * flush_kthread_worker will block until all work is done.
++	 * If the reason that stop_queue timed out is that the work will never
++	 * finish, then it does no good to call flush/stop thread, so
++	 * return anyway.
++	 */
++	if (ret) {
++		dev_err(&master->dev, "problem destroying queue\n");
++		return ret;
++	}
++
++	flush_kthread_worker(&master->kworker);
++	kthread_stop(master->kworker_task);
++
++	return 0;
++}
++
++/**
++ * spi_queued_transfer - transfer function for queued transfers
++ * @spi: spi device which is requesting transfer
++ * @msg: spi message which is to handled is queued to driver queue
++ */
++static int spi_queued_transfer(struct spi_device *spi, struct spi_message *msg)
++{
++	struct spi_master *master = spi->master;
++	unsigned long flags;
++
++	spin_lock_irqsave(&master->queue_lock, flags);
++
++	if (!master->running) {
++		spin_unlock_irqrestore(&master->queue_lock, flags);
++		return -ESHUTDOWN;
++	}
++	msg->actual_length = 0;
++	msg->status = -EINPROGRESS;
++
++	list_add_tail(&msg->queue, &master->queue);
++	if (master->running && !master->busy)
++		queue_kthread_work(&master->kworker, &master->pump_messages);
++
++	spin_unlock_irqrestore(&master->queue_lock, flags);
++	return 0;
++}
++
++static int spi_master_initialize_queue(struct spi_master *master)
++{
++	int ret;
++
++	master->queued = true;
++	master->transfer = spi_queued_transfer;
++
++	/* Initialize and start queue */
++	ret = spi_init_queue(master);
++	if (ret) {
++		dev_err(&master->dev, "problem initializing queue\n");
++		goto err_init_queue;
++	}
++	ret = spi_start_queue(master);
++	if (ret) {
++		dev_err(&master->dev, "problem starting queue\n");
++		goto err_start_queue;
++	}
++
++	return 0;
++
++err_start_queue:
++err_init_queue:
++	spi_destroy_queue(master);
++	return ret;
++}
++
++/*-------------------------------------------------------------------------*/
++
+ static void spi_master_release(struct device *dev)
+ {
+ 	struct spi_master *master;
+@@ -522,6 +812,7 @@ static struct class spi_master_class = {
+ };
+ 
+ 
++
+ /**
+  * spi_alloc_master - allocate SPI master controller
+  * @dev: the controller, possibly using the platform_bus
+@@ -621,6 +912,15 @@ int spi_register_master(struct spi_maste
+ 	dev_dbg(dev, "registered master %s%s\n", dev_name(&master->dev),
+ 			dynamic ? " (dynamic)" : "");
+ 
++	/* If we're using a queued driver, start the queue */
++	if (!master->transfer) {
++		status = spi_master_initialize_queue(master);
++		if (status) {
++			device_unregister(&master->dev);
++			goto done;
++		}
++	}
++
+ 	mutex_lock(&board_lock);
+ 	list_add_tail(&master->list, &spi_master_list);
+ 	list_for_each_entry(bi, &board_list, list)
+@@ -636,7 +936,6 @@ done:
+ }
+ EXPORT_SYMBOL_GPL(spi_register_master);
+ 
+-
+ static int __unregister(struct device *dev, void *null)
+ {
+ 	spi_unregister_device(to_spi_device(dev));
+@@ -657,6 +956,11 @@ void spi_unregister_master(struct spi_ma
+ {
+ 	int dummy;
+ 
++	if (master->queued) {
++		if (spi_destroy_queue(master))
++			dev_err(&master->dev, "queue remove failed\n");
++	}
++
+ 	mutex_lock(&board_lock);
+ 	list_del(&master->list);
+ 	mutex_unlock(&board_lock);
+@@ -666,6 +970,37 @@ void spi_unregister_master(struct spi_ma
+ }
+ EXPORT_SYMBOL_GPL(spi_unregister_master);
+ 
++int spi_master_suspend(struct spi_master *master)
++{
++	int ret;
++
++	/* Basically no-ops for non-queued masters */
++	if (!master->queued)
++		return 0;
++
++	ret = spi_stop_queue(master);
++	if (ret)
++		dev_err(&master->dev, "queue stop failed\n");
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(spi_master_suspend);
++
++int spi_master_resume(struct spi_master *master)
++{
++	int ret;
++
++	if (!master->queued)
++		return 0;
++
++	ret = spi_start_queue(master);
++	if (ret)
++		dev_err(&master->dev, "queue restart failed\n");
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(spi_master_resume);
++
+ static int __spi_master_match(struct device *dev, void *data)
+ {
+ 	struct spi_master *m;
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -22,6 +22,7 @@
+ #include <linux/device.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/slab.h>
++#include <linux/kthread.h>
+ 
+ /*
+  * INTERFACES between SPI master-side drivers and SPI infrastructure.
+@@ -235,6 +236,27 @@ static inline void spi_unregister_driver
+  *	the device whose settings are being modified.
+  * @transfer: adds a message to the controller's transfer queue.
+  * @cleanup: frees controller-specific state
++ * @queued: whether this master is providing an internal message queue
++ * @kworker: thread struct for message pump
++ * @kworker_task: pointer to task for message pump kworker thread
++ * @pump_messages: work struct for scheduling work to the message pump
++ * @queue_lock: spinlock to syncronise access to message queue
++ * @queue: message queue
++ * @cur_msg: the currently in-flight message
++ * @busy: message pump is busy
++ * @running: message pump is running
++ * @rt: whether this queue is set to run as a realtime task
++ * @prepare_transfer_hardware: a message will soon arrive from the queue
++ *	so the subsystem requests the driver to prepare the transfer hardware
++ *	by issuing this call
++ * @transfer_one_message: the subsystem calls the driver to transfer a single
++ *	message while queuing transfers that arrive in the meantime. When the
++ *	driver is finished with this message, it must call
++ *	spi_finalize_current_message() so the subsystem can issue the next
++ *	transfer
++ * @prepare_transfer_hardware: there are currently no more messages on the
++ *	queue so the subsystem notifies the driver that it may relax the
++ *	hardware by issuing this call
+  *
+  * Each SPI master controller can communicate with one or more @spi_device
+  * children.  These make a small bus, sharing MOSI, MISO and SCK signals
+@@ -318,6 +340,28 @@ struct spi_master {
+ 
+ 	/* called on release() to free memory provided by spi_master */
+ 	void			(*cleanup)(struct spi_device *spi);
++
++	/*
++	 * These hooks are for drivers that want to use the generic
++	 * master transfer queueing mechanism. If these are used, the
++	 * transfer() function above must NOT be specified by the driver.
++	 * Over time we expect SPI drivers to be phased over to this API.
++	 */
++	bool				queued;
++	struct kthread_worker		kworker;
++	struct task_struct		*kworker_task;
++	struct kthread_work		pump_messages;
++	spinlock_t			queue_lock;
++	struct list_head		queue;
++	struct spi_message		*cur_msg;
++	bool				busy;
++	bool				running;
++	bool				rt;
++
++	int (*prepare_transfer_hardware)(struct spi_master *master);
++	int (*transfer_one_message)(struct spi_master *master,
++				    struct spi_message *mesg);
++	int (*unprepare_transfer_hardware)(struct spi_master *master);
+ };
+ 
+ static inline void *spi_master_get_devdata(struct spi_master *master)
+@@ -343,6 +387,13 @@ static inline void spi_master_put(struct
+ 		put_device(&master->dev);
+ }
+ 
++/* PM calls that need to be issued by the driver */
++extern int spi_master_suspend(struct spi_master *master);
++extern int spi_master_resume(struct spi_master *master);
++
++/* Calls the driver make to interact with the message queue */
++extern struct spi_message *spi_get_next_queued_message(struct spi_master *master);
++extern void spi_finalize_current_message(struct spi_master *master);
+ 
+ /* the spi driver core manages memory for the spi_master classdev */
+ extern struct spi_master *
diff --git a/target/linux/generic/patches-3.3/048-spi-Dont-call-prepare-unprepare-transfer-if-not-popu.patch b/target/linux/generic/patches-3.3/048-spi-Dont-call-prepare-unprepare-transfer-if-not-popu.patch
new file mode 100644
index 0000000..deef32e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/048-spi-Dont-call-prepare-unprepare-transfer-if-not-popu.patch
@@ -0,0 +1,39 @@
+From 7dfd2bd70228d1f8d468d58cb3d12ecd618479ed Mon Sep 17 00:00:00 2001
+From: Shubhrajyoti D <shubhrajyoti@ti.com>
+Date: Thu, 10 May 2012 19:20:41 +0530
+Subject: [PATCH] spi: Dont call prepare/unprepare transfer if not populated
+
+Currently the prepare/unprepare transfer are called unconditionally.
+The assumption is that every driver using the spi core queue infrastructure
+has to populate the prepare and unprepare functions. This encourages
+drivers to populate empty functions to prevent crashing.
+This patch prevents the call to prepare/unprepare if not populated.
+
+Signed-off-by: Shubhrajyoti D <shubhrajyoti@ti.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+[grant.likely: fix whitespace defect]
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+---
+ drivers/spi/spi.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -530,7 +530,7 @@ static void spi_pump_messages(struct kth
+ 	/* Lock queue and check for queue work */
+ 	spin_lock_irqsave(&master->queue_lock, flags);
+ 	if (list_empty(&master->queue) || !master->running) {
+-		if (master->busy) {
++		if (master->busy && master->unprepare_transfer_hardware) {
+ 			ret = master->unprepare_transfer_hardware(master);
+ 			if (ret) {
+ 				dev_err(&master->dev,
+@@ -559,7 +559,7 @@ static void spi_pump_messages(struct kth
+ 		master->busy = true;
+ 	spin_unlock_irqrestore(&master->queue_lock, flags);
+ 
+-	if (!was_busy) {
++	if (!was_busy && master->prepare_transfer_hardware) {
+ 		ret = master->prepare_transfer_hardware(master);
+ 		if (ret) {
+ 			dev_err(&master->dev,
diff --git a/target/linux/generic/patches-3.3/049-codel-refine-one-condition-to-avoid-a-nul-rec_inv_sqrt.patch b/target/linux/generic/patches-3.3/049-codel-refine-one-condition-to-avoid-a-nul-rec_inv_sqrt.patch
new file mode 100644
index 0000000..bfb6ae2
--- /dev/null
+++ b/target/linux/generic/patches-3.3/049-codel-refine-one-condition-to-avoid-a-nul-rec_inv_sqrt.patch
@@ -0,0 +1,52 @@
+From b8fc328668a74e1314a19266755a54abd875e5a6 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sun, 29 Jul 2012 20:52:21 +0000
+Subject: [PATCH] codel: refine one condition to avoid a nul rec_inv_sqrt
+
+commit 2359a47671fc4fb0fe5e9945f76c2cb10792c0f8 upstream.
+
+One condition before codel_Newton_step() was not good if
+we never left the dropping state for a flow. As a result
+rec_inv_sqrt was 0, instead of the ~0 initial value.
+
+codel control law was then set to a very aggressive mode, dropping
+many packets before reaching 'target' and recovering from this problem.
+
+To keep codel_vars_init() as efficient as possible, refine
+the condition to make sure rec_inv_sqrt initial value is correct
+
+Many thanks to Anton Mich for discovering the issue and suggesting
+a fix.
+
+Reported-by: Anton Mich <lp2s1h@gmail.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/codel.h |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -305,6 +305,8 @@ static struct sk_buff *codel_dequeue(str
+ 			}
+ 		}
+ 	} else if (drop) {
++		u32 delta;
++
+ 		if (params->ecn && INET_ECN_set_ce(skb)) {
+ 			stats->ecn_mark++;
+ 		} else {
+@@ -320,9 +322,11 @@ static struct sk_buff *codel_dequeue(str
+ 		 * assume that the drop rate that controlled the queue on the
+ 		 * last cycle is a good starting point to control it now.
+ 		 */
+-		if (codel_time_before(now - vars->drop_next,
++		delta = vars->count - vars->lastcount;
++		if (delta > 1 &&
++		    codel_time_before(now - vars->drop_next,
+ 				      16 * params->interval)) {
+-			vars->count = (vars->count - vars->lastcount) | 1;
++			vars->count = delta;
+ 			/* we dont care if rec_inv_sqrt approximation
+ 			 * is not very precise :
+ 			 * Next Newton steps will correct it quadratically.
diff --git a/target/linux/generic/patches-3.3/050-rng_git_backport.patch b/target/linux/generic/patches-3.3/050-rng_git_backport.patch
new file mode 100644
index 0000000..825eb73
--- /dev/null
+++ b/target/linux/generic/patches-3.3/050-rng_git_backport.patch
@@ -0,0 +1,783 @@
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -125,21 +125,26 @@
+  * The current exported interfaces for gathering environmental noise
+  * from the devices are:
+  *
++ *	void add_device_randomness(const void *buf, unsigned int size);
+  * 	void add_input_randomness(unsigned int type, unsigned int code,
+  *                                unsigned int value);
+- * 	void add_interrupt_randomness(int irq);
++ *	void add_interrupt_randomness(int irq, int irq_flags);
+  * 	void add_disk_randomness(struct gendisk *disk);
+  *
+  * add_input_randomness() uses the input layer interrupt timing, as well as
+  * the event type information from the hardware.
+  *
+- * add_interrupt_randomness() uses the inter-interrupt timing as random
+- * inputs to the entropy pool.  Note that not all interrupts are good
+- * sources of randomness!  For example, the timer interrupts is not a
+- * good choice, because the periodicity of the interrupts is too
+- * regular, and hence predictable to an attacker.  Network Interface
+- * Controller interrupts are a better measure, since the timing of the
+- * NIC interrupts are more unpredictable.
++ * add_interrupt_randomness() uses the interrupt timing as random
++ * inputs to the entropy pool. Using the cycle counters and the irq source
++ * as inputs, it feeds the randomness roughly once a second.
++ *
++ * add_device_randomness() is for adding data to the random pool that
++ * is likely to differ between two devices (or possibly even per boot).
++ * This would be things like MAC addresses or serial numbers, or the
++ * read-out of the RTC. This does *not* add any actual entropy to the
++ * pool, but it initializes the pool to different values for devices
++ * that might otherwise be identical and have very little entropy
++ * available to them (particularly common in the embedded world).
+  *
+  * add_disk_randomness() uses what amounts to the seek time of block
+  * layer request events, on a per-disk_devt basis, as input to the
+@@ -248,6 +253,7 @@
+ #include <linux/percpu.h>
+ #include <linux/cryptohash.h>
+ #include <linux/fips.h>
++#include <linux/ptrace.h>
+ 
+ #ifdef CONFIG_GENERIC_HARDIRQS
+ # include <linux/irq.h>
+@@ -256,8 +262,12 @@
+ #include <asm/processor.h>
+ #include <asm/uaccess.h>
+ #include <asm/irq.h>
++#include <asm/irq_regs.h>
+ #include <asm/io.h>
+ 
++#define CREATE_TRACE_POINTS
++#include <trace/events/random.h>
++
+ /*
+  * Configuration information
+  */
+@@ -420,8 +430,10 @@ struct entropy_store {
+ 	/* read-write data: */
+ 	spinlock_t lock;
+ 	unsigned add_ptr;
++	unsigned input_rotate;
+ 	int entropy_count;
+-	int input_rotate;
++	int entropy_total;
++	unsigned int initialized:1;
+ 	__u8 last_data[EXTRACT_SIZE];
+ };
+ 
+@@ -454,6 +466,10 @@ static struct entropy_store nonblocking_
+ 	.pool = nonblocking_pool_data
+ };
+ 
++static __u32 const twist_table[8] = {
++	0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
++	0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
++
+ /*
+  * This function adds bytes into the entropy "pool".  It does not
+  * update the entropy estimate.  The caller should call
+@@ -464,29 +480,24 @@ static struct entropy_store nonblocking_
+  * it's cheap to do so and helps slightly in the expected case where
+  * the entropy is concentrated in the low-order bits.
+  */
+-static void mix_pool_bytes_extract(struct entropy_store *r, const void *in,
+-				   int nbytes, __u8 out[64])
++static void _mix_pool_bytes(struct entropy_store *r, const void *in,
++			    int nbytes, __u8 out[64])
+ {
+-	static __u32 const twist_table[8] = {
+-		0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
+-		0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
+ 	unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
+ 	int input_rotate;
+ 	int wordmask = r->poolinfo->poolwords - 1;
+ 	const char *bytes = in;
+ 	__u32 w;
+-	unsigned long flags;
+ 
+-	/* Taps are constant, so we can load them without holding r->lock.  */
+ 	tap1 = r->poolinfo->tap1;
+ 	tap2 = r->poolinfo->tap2;
+ 	tap3 = r->poolinfo->tap3;
+ 	tap4 = r->poolinfo->tap4;
+ 	tap5 = r->poolinfo->tap5;
+ 
+-	spin_lock_irqsave(&r->lock, flags);
+-	input_rotate = r->input_rotate;
+-	i = r->add_ptr;
++	smp_rmb();
++	input_rotate = ACCESS_ONCE(r->input_rotate);
++	i = ACCESS_ONCE(r->add_ptr);
+ 
+ 	/* mix one byte at a time to simplify size handling and churn faster */
+ 	while (nbytes--) {
+@@ -513,19 +524,61 @@ static void mix_pool_bytes_extract(struc
+ 		input_rotate += i ? 7 : 14;
+ 	}
+ 
+-	r->input_rotate = input_rotate;
+-	r->add_ptr = i;
++	ACCESS_ONCE(r->input_rotate) = input_rotate;
++	ACCESS_ONCE(r->add_ptr) = i;
++	smp_wmb();
+ 
+ 	if (out)
+ 		for (j = 0; j < 16; j++)
+ 			((__u32 *)out)[j] = r->pool[(i - j) & wordmask];
++}
++
++static void __mix_pool_bytes(struct entropy_store *r, const void *in,
++			     int nbytes, __u8 out[64])
++{
++	trace_mix_pool_bytes_nolock(r->name, nbytes, _RET_IP_);
++	_mix_pool_bytes(r, in, nbytes, out);
++}
+ 
++static void mix_pool_bytes(struct entropy_store *r, const void *in,
++			   int nbytes, __u8 out[64])
++{
++	unsigned long flags;
++
++	trace_mix_pool_bytes(r->name, nbytes, _RET_IP_);
++	spin_lock_irqsave(&r->lock, flags);
++	_mix_pool_bytes(r, in, nbytes, out);
+ 	spin_unlock_irqrestore(&r->lock, flags);
+ }
+ 
+-static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
++struct fast_pool {
++	__u32		pool[4];
++	unsigned long	last;
++	unsigned short	count;
++	unsigned char	rotate;
++	unsigned char	last_timer_intr;
++};
++
++/*
++ * This is a fast mixing routine used by the interrupt randomness
++ * collector.  It's hardcoded for an 128 bit pool and assumes that any
++ * locks that might be needed are taken by the caller.
++ */
++static void fast_mix(struct fast_pool *f, const void *in, int nbytes)
+ {
+-       mix_pool_bytes_extract(r, in, bytes, NULL);
++	const char	*bytes = in;
++	__u32		w;
++	unsigned	i = f->count;
++	unsigned	input_rotate = f->rotate;
++
++	while (nbytes--) {
++		w = rol32(*bytes++, input_rotate & 31) ^ f->pool[i & 3] ^
++			f->pool[(i + 1) & 3];
++		f->pool[i & 3] = (w >> 3) ^ twist_table[w & 7];
++		input_rotate += (i++ & 3) ? 7 : 14;
++	}
++	f->count = i;
++	f->rotate = input_rotate;
+ }
+ 
+ /*
+@@ -533,30 +586,38 @@ static void mix_pool_bytes(struct entrop
+  */
+ static void credit_entropy_bits(struct entropy_store *r, int nbits)
+ {
+-	unsigned long flags;
+-	int entropy_count;
++	int entropy_count, orig;
+ 
+ 	if (!nbits)
+ 		return;
+ 
+-	spin_lock_irqsave(&r->lock, flags);
+-
+ 	DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
+-	entropy_count = r->entropy_count;
++retry:
++	entropy_count = orig = ACCESS_ONCE(r->entropy_count);
+ 	entropy_count += nbits;
++
+ 	if (entropy_count < 0) {
+ 		DEBUG_ENT("negative entropy/overflow\n");
+ 		entropy_count = 0;
+ 	} else if (entropy_count > r->poolinfo->POOLBITS)
+ 		entropy_count = r->poolinfo->POOLBITS;
+-	r->entropy_count = entropy_count;
++	if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
++		goto retry;
++
++	if (!r->initialized && nbits > 0) {
++		r->entropy_total += nbits;
++		if (r->entropy_total > 128)
++			r->initialized = 1;
++	}
++
++	trace_credit_entropy_bits(r->name, nbits, entropy_count,
++				  r->entropy_total, _RET_IP_);
+ 
+ 	/* should we wake readers? */
+ 	if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
+ 		wake_up_interruptible(&random_read_wait);
+ 		kill_fasync(&fasync, SIGIO, POLL_IN);
+ 	}
+-	spin_unlock_irqrestore(&r->lock, flags);
+ }
+ 
+ /*********************************************************************
+@@ -609,6 +670,25 @@ static void set_timer_rand_state(unsigne
+ }
+ #endif
+ 
++/*
++ * Add device- or boot-specific data to the input and nonblocking
++ * pools to help initialize them to unique values.
++ *
++ * None of this adds any entropy, it is meant to avoid the
++ * problem of the nonblocking pool having similar initial state
++ * across largely identical devices.
++ */
++void add_device_randomness(const void *buf, unsigned int size)
++{
++	unsigned long time = get_cycles() ^ jiffies;
++
++	mix_pool_bytes(&input_pool, buf, size, NULL);
++	mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
++	mix_pool_bytes(&nonblocking_pool, buf, size, NULL);
++	mix_pool_bytes(&nonblocking_pool, &time, sizeof(time), NULL);
++}
++EXPORT_SYMBOL(add_device_randomness);
++
+ static struct timer_rand_state input_timer_state;
+ 
+ /*
+@@ -637,13 +717,9 @@ static void add_timer_randomness(struct
+ 		goto out;
+ 
+ 	sample.jiffies = jiffies;
+-
+-	/* Use arch random value, fall back to cycles */
+-	if (!arch_get_random_int(&sample.cycles))
+-		sample.cycles = get_cycles();
+-
++	sample.cycles = get_cycles();
+ 	sample.num = num;
+-	mix_pool_bytes(&input_pool, &sample, sizeof(sample));
++	mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
+ 
+ 	/*
+ 	 * Calculate number of bits of randomness we probably added.
+@@ -700,17 +776,48 @@ void add_input_randomness(unsigned int t
+ }
+ EXPORT_SYMBOL_GPL(add_input_randomness);
+ 
+-void add_interrupt_randomness(int irq)
++static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
++
++void add_interrupt_randomness(int irq, int irq_flags)
+ {
+-	struct timer_rand_state *state;
++	struct entropy_store	*r;
++	struct fast_pool	*fast_pool = &__get_cpu_var(irq_randomness);
++	struct pt_regs		*regs = get_irq_regs();
++	unsigned long		now = jiffies;
++	__u32			input[4], cycles = get_cycles();
++
++	input[0] = cycles ^ jiffies;
++	input[1] = irq;
++	if (regs) {
++		__u64 ip = instruction_pointer(regs);
++		input[2] = ip;
++		input[3] = ip >> 32;
++	}
+ 
+-	state = get_timer_rand_state(irq);
++	fast_mix(fast_pool, input, sizeof(input));
+ 
+-	if (state == NULL)
++	if ((fast_pool->count & 1023) &&
++	    !time_after(now, fast_pool->last + HZ))
+ 		return;
+ 
+-	DEBUG_ENT("irq event %d\n", irq);
+-	add_timer_randomness(state, 0x100 + irq);
++	fast_pool->last = now;
++
++	r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
++	__mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool), NULL);
++	/*
++	 * If we don't have a valid cycle counter, and we see
++	 * back-to-back timer interrupts, then skip giving credit for
++	 * any entropy.
++	 */
++	if (cycles == 0) {
++		if (irq_flags & __IRQF_TIMER) {
++			if (fast_pool->last_timer_intr)
++				return;
++			fast_pool->last_timer_intr = 1;
++		} else
++			fast_pool->last_timer_intr = 0;
++	}
++	credit_entropy_bits(r, 1);
+ }
+ 
+ #ifdef CONFIG_BLOCK
+@@ -742,7 +849,11 @@ static ssize_t extract_entropy(struct en
+  */
+ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
+ {
+-	__u32 tmp[OUTPUT_POOL_WORDS];
++	union {
++		__u32	tmp[OUTPUT_POOL_WORDS];
++		long	hwrand[4];
++	} u;
++	int	i;
+ 
+ 	if (r->pull && r->entropy_count < nbytes * 8 &&
+ 	    r->entropy_count < r->poolinfo->POOLBITS) {
+@@ -753,17 +864,22 @@ static void xfer_secondary_pool(struct e
+ 		/* pull at least as many as BYTES as wakeup BITS */
+ 		bytes = max_t(int, bytes, random_read_wakeup_thresh / 8);
+ 		/* but never more than the buffer size */
+-		bytes = min_t(int, bytes, sizeof(tmp));
++		bytes = min_t(int, bytes, sizeof(u.tmp));
+ 
+ 		DEBUG_ENT("going to reseed %s with %d bits "
+ 			  "(%d of %d requested)\n",
+ 			  r->name, bytes * 8, nbytes * 8, r->entropy_count);
+ 
+-		bytes = extract_entropy(r->pull, tmp, bytes,
++		bytes = extract_entropy(r->pull, u.tmp, bytes,
+ 					random_read_wakeup_thresh / 8, rsvd);
+-		mix_pool_bytes(r, tmp, bytes);
++		mix_pool_bytes(r, u.tmp, bytes, NULL);
+ 		credit_entropy_bits(r, bytes*8);
+ 	}
++	for (i = 0; i < 4; i++)
++		if (arch_get_random_long(&u.hwrand[i]))
++			break;
++	if (i)
++		mix_pool_bytes(r, &u.hwrand, i * sizeof(u.hwrand[0]), 0);
+ }
+ 
+ /*
+@@ -822,9 +938,11 @@ static void extract_buf(struct entropy_s
+ 	int i;
+ 	__u32 hash[5], workspace[SHA_WORKSPACE_WORDS];
+ 	__u8 extract[64];
++	unsigned long flags;
+ 
+ 	/* Generate a hash across the pool, 16 words (512 bits) at a time */
+ 	sha_init(hash);
++	spin_lock_irqsave(&r->lock, flags);
+ 	for (i = 0; i < r->poolinfo->poolwords; i += 16)
+ 		sha_transform(hash, (__u8 *)(r->pool + i), workspace);
+ 
+@@ -837,7 +955,8 @@ static void extract_buf(struct entropy_s
+ 	 * brute-forcing the feedback as hard as brute-forcing the
+ 	 * hash.
+ 	 */
+-	mix_pool_bytes_extract(r, hash, sizeof(hash), extract);
++	__mix_pool_bytes(r, hash, sizeof(hash), extract);
++	spin_unlock_irqrestore(&r->lock, flags);
+ 
+ 	/*
+ 	 * To avoid duplicates, we atomically extract a portion of the
+@@ -860,12 +979,12 @@ static void extract_buf(struct entropy_s
+ }
+ 
+ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+-			       size_t nbytes, int min, int reserved)
++				 size_t nbytes, int min, int reserved)
+ {
+ 	ssize_t ret = 0, i;
+ 	__u8 tmp[EXTRACT_SIZE];
+-	unsigned long flags;
+ 
++	trace_extract_entropy(r->name, nbytes, r->entropy_count, _RET_IP_);
+ 	xfer_secondary_pool(r, nbytes);
+ 	nbytes = account(r, nbytes, min, reserved);
+ 
+@@ -873,6 +992,8 @@ static ssize_t extract_entropy(struct en
+ 		extract_buf(r, tmp);
+ 
+ 		if (fips_enabled) {
++			unsigned long flags;
++
+ 			spin_lock_irqsave(&r->lock, flags);
+ 			if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
+ 				panic("Hardware RNG duplicated output!\n");
+@@ -898,6 +1019,7 @@ static ssize_t extract_entropy_user(stru
+ 	ssize_t ret = 0, i;
+ 	__u8 tmp[EXTRACT_SIZE];
+ 
++	trace_extract_entropy_user(r->name, nbytes, r->entropy_count, _RET_IP_);
+ 	xfer_secondary_pool(r, nbytes);
+ 	nbytes = account(r, nbytes, 0, 0);
+ 
+@@ -931,17 +1053,35 @@ static ssize_t extract_entropy_user(stru
+ 
+ /*
+  * This function is the exported kernel interface.  It returns some
+- * number of good random numbers, suitable for seeding TCP sequence
+- * numbers, etc.
++ * number of good random numbers, suitable for key generation, seeding
++ * TCP sequence numbers, etc.  It does not use the hw random number
++ * generator, if available; use get_random_bytes_arch() for that.
+  */
+ void get_random_bytes(void *buf, int nbytes)
+ {
++	extract_entropy(&nonblocking_pool, buf, nbytes, 0, 0);
++}
++EXPORT_SYMBOL(get_random_bytes);
++
++/*
++ * This function will use the architecture-specific hardware random
++ * number generator if it is available.  The arch-specific hw RNG will
++ * almost certainly be faster than what we can do in software, but it
++ * is impossible to verify that it is implemented securely (as
++ * opposed, to, say, the AES encryption of a sequence number using a
++ * key known by the NSA).  So it's useful if we need the speed, but
++ * only if we're willing to trust the hardware manufacturer not to
++ * have put in a back door.
++ */
++void get_random_bytes_arch(void *buf, int nbytes)
++{
+ 	char *p = buf;
+ 
++	trace_get_random_bytes(nbytes, _RET_IP_);
+ 	while (nbytes) {
+ 		unsigned long v;
+ 		int chunk = min(nbytes, (int)sizeof(unsigned long));
+-		
++
+ 		if (!arch_get_random_long(&v))
+ 			break;
+ 		
+@@ -950,9 +1090,11 @@ void get_random_bytes(void *buf, int nby
+ 		nbytes -= chunk;
+ 	}
+ 
+-	extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
++	if (nbytes)
++		extract_entropy(&nonblocking_pool, p, nbytes, 0, 0);
+ }
+-EXPORT_SYMBOL(get_random_bytes);
++EXPORT_SYMBOL(get_random_bytes_arch);
++
+ 
+ /*
+  * init_std_data - initialize pool with system data
+@@ -966,21 +1108,18 @@ EXPORT_SYMBOL(get_random_bytes);
+ static void init_std_data(struct entropy_store *r)
+ {
+ 	int i;
+-	ktime_t now;
+-	unsigned long flags;
++	ktime_t now = ktime_get_real();
++	unsigned long rv;
+ 
+-	spin_lock_irqsave(&r->lock, flags);
+ 	r->entropy_count = 0;
+-	spin_unlock_irqrestore(&r->lock, flags);
+-
+-	now = ktime_get_real();
+-	mix_pool_bytes(r, &now, sizeof(now));
+-	for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof flags) {
+-		if (!arch_get_random_long(&flags))
++	r->entropy_total = 0;
++	mix_pool_bytes(r, &now, sizeof(now), NULL);
++	for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
++		if (!arch_get_random_long(&rv))
+ 			break;
+-		mix_pool_bytes(r, &flags, sizeof(flags));
++		mix_pool_bytes(r, &rv, sizeof(rv), NULL);
+ 	}
+-	mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
++	mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
+ }
+ 
+ static int rand_initialize(void)
+@@ -1117,7 +1256,7 @@ write_pool(struct entropy_store *r, cons
+ 		count -= bytes;
+ 		p += bytes;
+ 
+-		mix_pool_bytes(r, buf, bytes);
++		mix_pool_bytes(r, buf, bytes, NULL);
+ 		cond_resched();
+ 	}
+ 
+@@ -1274,6 +1413,7 @@ static int proc_do_uuid(ctl_table *table
+ }
+ 
+ static int sysctl_poolsize = INPUT_POOL_WORDS * 32;
++extern ctl_table random_table[];
+ ctl_table random_table[] = {
+ 	{
+ 		.procname	= "poolsize",
+@@ -1339,7 +1479,7 @@ late_initcall(random_int_secret_init);
+  * value is not cryptographically secure but for several uses the cost of
+  * depleting entropy is too high
+  */
+-DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
++static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
+ unsigned int get_random_int(void)
+ {
+ 	__u32 *hash;
+--- a/drivers/mfd/ab3100-core.c
++++ b/drivers/mfd/ab3100-core.c
+@@ -409,8 +409,6 @@ static irqreturn_t ab3100_irq_handler(in
+ 	u32 fatevent;
+ 	int err;
+ 
+-	add_interrupt_randomness(irq);
+-
+ 	err = ab3100_get_register_page_interruptible(ab3100, AB3100_EVENTA1,
+ 				       event_regs, 3);
+ 	if (err)
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -24,6 +24,7 @@
+ #include <linux/kthread.h>
+ #include <linux/mutex.h>
+ #include <linux/freezer.h>
++#include <linux/random.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/byteorder.h>
+@@ -1896,6 +1897,14 @@ int usb_new_device(struct usb_device *ud
+ 	/* Tell the world! */
+ 	announce_device(udev);
+ 
++	if (udev->serial)
++		add_device_randomness(udev->serial, strlen(udev->serial));
++	if (udev->product)
++		add_device_randomness(udev->product, strlen(udev->product));
++	if (udev->manufacturer)
++		add_device_randomness(udev->manufacturer,
++				      strlen(udev->manufacturer));
++
+ 	device_enable_async_suspend(&udev->dev);
+ 	/* Register the device.  The device driver is responsible
+ 	 * for configuring the device and invoking the add-device
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -50,11 +50,13 @@ struct rnd_state {
+ 
+ extern void rand_initialize_irq(int irq);
+ 
++extern void add_device_randomness(const void *, unsigned int);
+ extern void add_input_randomness(unsigned int type, unsigned int code,
+ 				 unsigned int value);
+-extern void add_interrupt_randomness(int irq);
++extern void add_interrupt_randomness(int irq, int irq_flags);
+ 
+ extern void get_random_bytes(void *buf, int nbytes);
++extern void get_random_bytes_arch(void *buf, int nbytes);
+ void generate_random_uuid(unsigned char uuid_out[16]);
+ 
+ #ifndef MODULE
+--- /dev/null
++++ b/include/trace/events/random.h
+@@ -0,0 +1,134 @@
++#undef TRACE_SYSTEM
++#define TRACE_SYSTEM random
++
++#if !defined(_TRACE_RANDOM_H) || defined(TRACE_HEADER_MULTI_READ)
++#define _TRACE_RANDOM_H
++
++#include <linux/writeback.h>
++#include <linux/tracepoint.h>
++
++DECLARE_EVENT_CLASS(random__mix_pool_bytes,
++	TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
++
++	TP_ARGS(pool_name, bytes, IP),
++
++	TP_STRUCT__entry(
++		__field( const char *,	pool_name		)
++		__field(	  int,	bytes			)
++		__field(unsigned long,	IP			)
++	),
++
++	TP_fast_assign(
++		__entry->pool_name	= pool_name;
++		__entry->bytes		= bytes;
++		__entry->IP		= IP;
++	),
++
++	TP_printk("%s pool: bytes %d caller %pF",
++		  __entry->pool_name, __entry->bytes, (void *)__entry->IP)
++);
++
++DEFINE_EVENT(random__mix_pool_bytes, mix_pool_bytes,
++	TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
++
++	TP_ARGS(pool_name, bytes, IP)
++);
++
++DEFINE_EVENT(random__mix_pool_bytes, mix_pool_bytes_nolock,
++	TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
++
++	TP_ARGS(pool_name, bytes, IP)
++);
++
++TRACE_EVENT(credit_entropy_bits,
++	TP_PROTO(const char *pool_name, int bits, int entropy_count,
++		 int entropy_total, unsigned long IP),
++
++	TP_ARGS(pool_name, bits, entropy_count, entropy_total, IP),
++
++	TP_STRUCT__entry(
++		__field( const char *,	pool_name		)
++		__field(	  int,	bits			)
++		__field(	  int,	entropy_count		)
++		__field(	  int,	entropy_total		)
++		__field(unsigned long,	IP			)
++	),
++
++	TP_fast_assign(
++		__entry->pool_name	= pool_name;
++		__entry->bits		= bits;
++		__entry->entropy_count	= entropy_count;
++		__entry->entropy_total	= entropy_total;
++		__entry->IP		= IP;
++	),
++
++	TP_printk("%s pool: bits %d entropy_count %d entropy_total %d "
++		  "caller %pF", __entry->pool_name, __entry->bits,
++		  __entry->entropy_count, __entry->entropy_total,
++		  (void *)__entry->IP)
++);
++
++TRACE_EVENT(get_random_bytes,
++	TP_PROTO(int nbytes, unsigned long IP),
++
++	TP_ARGS(nbytes, IP),
++
++	TP_STRUCT__entry(
++		__field(	  int,	nbytes			)
++		__field(unsigned long,	IP			)
++	),
++
++	TP_fast_assign(
++		__entry->nbytes		= nbytes;
++		__entry->IP		= IP;
++	),
++
++	TP_printk("nbytes %d caller %pF", __entry->nbytes, (void *)__entry->IP)
++);
++
++DECLARE_EVENT_CLASS(random__extract_entropy,
++	TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
++		 unsigned long IP),
++
++	TP_ARGS(pool_name, nbytes, entropy_count, IP),
++
++	TP_STRUCT__entry(
++		__field( const char *,	pool_name		)
++		__field(	  int,	nbytes			)
++		__field(	  int,	entropy_count		)
++		__field(unsigned long,	IP			)
++	),
++
++	TP_fast_assign(
++		__entry->pool_name	= pool_name;
++		__entry->nbytes		= nbytes;
++		__entry->entropy_count	= entropy_count;
++		__entry->IP		= IP;
++	),
++
++	TP_printk("%s pool: nbytes %d entropy_count %d caller %pF",
++		  __entry->pool_name, __entry->nbytes, __entry->entropy_count,
++		  (void *)__entry->IP)
++);
++
++
++DEFINE_EVENT(random__extract_entropy, extract_entropy,
++	TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
++		 unsigned long IP),
++
++	TP_ARGS(pool_name, nbytes, entropy_count, IP)
++);
++
++DEFINE_EVENT(random__extract_entropy, extract_entropy_user,
++	TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
++		 unsigned long IP),
++
++	TP_ARGS(pool_name, nbytes, entropy_count, IP)
++);
++
++
++
++#endif /* _TRACE_RANDOM_H */
++
++/* This part must be outside protection */
++#include <trace/define_trace.h>
+--- a/kernel/irq/handle.c
++++ b/kernel/irq/handle.c
+@@ -117,7 +117,7 @@ irqreturn_t
+ handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action)
+ {
+ 	irqreturn_t retval = IRQ_NONE;
+-	unsigned int random = 0, irq = desc->irq_data.irq;
++	unsigned int flags = 0, irq = desc->irq_data.irq;
+ 
+ 	do {
+ 		irqreturn_t res;
+@@ -145,7 +145,7 @@ handle_irq_event_percpu(struct irq_desc
+ 
+ 			/* Fall through to add to randomness */
+ 		case IRQ_HANDLED:
+-			random |= action->flags;
++			flags |= action->flags;
+ 			break;
+ 
+ 		default:
+@@ -156,8 +156,7 @@ handle_irq_event_percpu(struct irq_desc
+ 		action = action->next;
+ 	} while (action);
+ 
+-	if (random & IRQF_SAMPLE_RANDOM)
+-		add_interrupt_randomness(irq);
++	add_interrupt_randomness(irq, flags);
+ 
+ 	if (!noirqdebug)
+ 		note_interrupt(irq, desc, retval);
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1176,6 +1176,7 @@ static int __dev_open(struct net_device
+ 		net_dmaengine_get();
+ 		dev_set_rx_mode(dev);
+ 		dev_activate(dev);
++		add_device_randomness(dev->dev_addr, dev->addr_len);
+ 	}
+ 
+ 	return ret;
+@@ -4823,6 +4824,7 @@ int dev_set_mac_address(struct net_devic
+ 	err = ops->ndo_set_mac_address(dev, sa);
+ 	if (!err)
+ 		call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
++	add_device_randomness(dev->dev_addr, dev->addr_len);
+ 	return err;
+ }
+ EXPORT_SYMBOL(dev_set_mac_address);
+@@ -5602,6 +5604,7 @@ int register_netdevice(struct net_device
+ 	dev_init_scheduler(dev);
+ 	dev_hold(dev);
+ 	list_netdevice(dev);
++	add_device_randomness(dev->dev_addr, dev->addr_len);
+ 
+ 	/* Notify protocols, that a new device appeared. */
+ 	ret = call_netdevice_notifiers(NETDEV_REGISTER, dev);
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1371,6 +1371,7 @@ static int do_setlink(struct net_device
+ 			goto errout;
+ 		send_addr_notify = 1;
+ 		modified = 1;
++		add_device_randomness(dev->dev_addr, dev->addr_len);
+ 	}
+ 
+ 	if (tb[IFLA_MTU]) {
diff --git a/target/linux/generic/patches-3.3/051-rng_git_backport-remove_irqf_sample_random.patch b/target/linux/generic/patches-3.3/051-rng_git_backport-remove_irqf_sample_random.patch
new file mode 100644
index 0000000..93706ed
--- /dev/null
+++ b/target/linux/generic/patches-3.3/051-rng_git_backport-remove_irqf_sample_random.patch
@@ -0,0 +1,543 @@
+--- a/arch/arm/mach-omap1/board-palmz71.c
++++ b/arch/arm/mach-omap1/board-palmz71.c
+@@ -291,8 +291,7 @@ palmz71_gpio_setup(int early)
+ 		}
+ 		gpio_direction_input(PALMZ71_USBDETECT_GPIO);
+ 		if (request_irq(gpio_to_irq(PALMZ71_USBDETECT_GPIO),
+-				palmz71_powercable, IRQF_SAMPLE_RANDOM,
+-				"palmz71-cable", 0))
++				palmz71_powercable, 0, "palmz71-cable", 0))
+ 			printk(KERN_ERR
+ 					"IRQ request for power cable failed!\n");
+ 		palmz71_powercable(gpio_to_irq(PALMZ71_USBDETECT_GPIO), 0);
+--- a/arch/arm/mach-pxa/lubbock.c
++++ b/arch/arm/mach-pxa/lubbock.c
+@@ -455,7 +455,7 @@ static int lubbock_mci_init(struct devic
+ 	init_timer(&mmc_timer);
+ 	mmc_timer.data = (unsigned long) data;
+ 	return request_irq(LUBBOCK_SD_IRQ, lubbock_detect_int,
+-			IRQF_SAMPLE_RANDOM, "lubbock-sd-detect", data);
++			   0, "lubbock-sd-detect", data);
+ }
+ 
+ static int lubbock_mci_get_ro(struct device *dev)
+--- a/arch/arm/mach-pxa/magician.c
++++ b/arch/arm/mach-pxa/magician.c
+@@ -617,9 +617,8 @@ static struct platform_device bq24022 =
+ static int magician_mci_init(struct device *dev,
+ 				irq_handler_t detect_irq, void *data)
+ {
+-	return request_irq(IRQ_MAGICIAN_SD, detect_irq,
+-				IRQF_DISABLED | IRQF_SAMPLE_RANDOM,
+-				"mmc card detect", data);
++	return request_irq(IRQ_MAGICIAN_SD, detect_irq, IRQF_DISABLED,
++			   "mmc card detect", data);
+ }
+ 
+ static void magician_mci_exit(struct device *dev, void *data)
+--- a/arch/arm/mach-pxa/trizeps4.c
++++ b/arch/arm/mach-pxa/trizeps4.c
+@@ -332,8 +332,8 @@ static int trizeps4_mci_init(struct devi
+ 	int err;
+ 
+ 	err = request_irq(TRIZEPS4_MMC_IRQ, mci_detect_int,
+-		IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_SAMPLE_RANDOM,
+-		"MMC card detect", data);
++			  IRQF_DISABLED | IRQF_TRIGGER_RISING,
++			  "MMC card detect", data);
+ 	if (err) {
+ 		printk(KERN_ERR "trizeps4_mci_init: MMC/SD: can't request"
+ 						"MMC card detect IRQ\n");
+--- a/arch/ia64/kernel/irq_ia64.c
++++ b/arch/ia64/kernel/irq_ia64.c
+@@ -23,7 +23,6 @@
+ #include <linux/ioport.h>
+ #include <linux/kernel_stat.h>
+ #include <linux/ptrace.h>
+-#include <linux/random.h>	/* for rand_initialize_irq() */
+ #include <linux/signal.h>
+ #include <linux/smp.h>
+ #include <linux/threads.h>
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1250,14 +1250,12 @@ int ldc_bind(struct ldc_channel *lp, con
+ 	snprintf(lp->rx_irq_name, LDC_IRQ_NAME_MAX, "%s RX", name);
+ 	snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
+ 
+-	err = request_irq(lp->cfg.rx_irq, ldc_rx,
+-			  IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
++	err = request_irq(lp->cfg.rx_irq, ldc_rx, IRQF_DISABLED,
+ 			  lp->rx_irq_name, lp);
+ 	if (err)
+ 		return err;
+ 
+-	err = request_irq(lp->cfg.tx_irq, ldc_tx,
+-			  IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
++	err = request_irq(lp->cfg.tx_irq, ldc_tx, IRQF_DISABLED,
+ 			  lp->tx_irq_name, lp);
+ 	if (err) {
+ 		free_irq(lp->cfg.rx_irq, lp);
+--- a/arch/um/drivers/line.c
++++ b/arch/um/drivers/line.c
+@@ -371,7 +371,7 @@ static irqreturn_t line_write_interrupt(
+ int line_setup_irq(int fd, int input, int output, struct line *line, void *data)
+ {
+ 	const struct line_driver *driver = line->driver;
+-	int err = 0, flags = IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM;
++	int err = 0, flags = IRQF_DISABLED | IRQF_SHARED;
+ 
+ 	if (input)
+ 		err = um_request_irq(driver->read_irq, fd, IRQ_READ,
+@@ -807,7 +807,7 @@ void register_winch_irq(int fd, int tty_
+ 				   .stack	= stack });
+ 
+ 	if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
+-			   IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
++			   IRQF_DISABLED | IRQF_SHARED,
+ 			   "winch", winch) < 0) {
+ 		printk(KERN_ERR "register_winch_irq - failed to register "
+ 		       "IRQ\n");
+--- a/arch/um/drivers/mconsole_kern.c
++++ b/arch/um/drivers/mconsole_kern.c
+@@ -773,7 +773,7 @@ static int __init mconsole_init(void)
+ 	register_reboot_notifier(&reboot_notifier);
+ 
+ 	err = um_request_irq(MCONSOLE_IRQ, sock, IRQ_READ, mconsole_interrupt,
+-			     IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
++			     IRQF_DISABLED | IRQF_SHARED,
+ 			     "mconsole", (void *)sock);
+ 	if (err) {
+ 		printk(KERN_ERR "Failed to get IRQ for management console\n");
+--- a/arch/um/drivers/port_kern.c
++++ b/arch/um/drivers/port_kern.c
+@@ -100,7 +100,7 @@ static int port_accept(struct port_list
+ 		  .port 	= port });
+ 
+ 	if (um_request_irq(TELNETD_IRQ, socket[0], IRQ_READ, pipe_interrupt,
+-			  IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
++			  IRQF_DISABLED | IRQF_SHARED,
+ 			  "telnetd", conn)) {
+ 		printk(KERN_ERR "port_accept : failed to get IRQ for "
+ 		       "telnetd\n");
+@@ -184,7 +184,7 @@ void *port_data(int port_num)
+ 	}
+ 
+ 	if (um_request_irq(ACCEPT_IRQ, fd, IRQ_READ, port_interrupt,
+-			  IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
++			  IRQF_DISABLED | IRQF_SHARED,
+ 			  "port", port)) {
+ 		printk(KERN_ERR "Failed to get IRQ for port %d\n", port_num);
+ 		goto out_close;
+--- a/arch/um/drivers/random.c
++++ b/arch/um/drivers/random.c
+@@ -131,8 +131,7 @@ static int __init rng_init (void)
+ 	random_fd = err;
+ 
+ 	err = um_request_irq(RANDOM_IRQ, random_fd, IRQ_READ, random_interrupt,
+-			     IRQF_DISABLED | IRQF_SAMPLE_RANDOM, "random",
+-			     NULL);
++			     IRQF_DISABLED, "random", NULL);
+ 	if (err)
+ 		goto err_out_cleanup_hw;
+ 
+--- a/arch/um/drivers/xterm_kern.c
++++ b/arch/um/drivers/xterm_kern.c
+@@ -50,8 +50,7 @@ int xterm_fd(int socket, int *pid_out)
+ 	init_completion(&data->ready);
+ 
+ 	err = um_request_irq(XTERM_IRQ, socket, IRQ_READ, xterm_interrupt,
+-			     IRQF_DISABLED | IRQF_SHARED | IRQF_SAMPLE_RANDOM,
+-			     "xterm", data);
++			     IRQF_DISABLED | IRQF_SHARED, "xterm", data);
+ 	if (err) {
+ 		printk(KERN_ERR "xterm_fd : failed to get IRQ for xterm, "
+ 		       "err = %d\n",  err);
+--- a/arch/um/kernel/sigio.c
++++ b/arch/um/kernel/sigio.c
+@@ -25,8 +25,7 @@ int write_sigio_irq(int fd)
+ 	int err;
+ 
+ 	err = um_request_irq(SIGIO_WRITE_IRQ, fd, IRQ_READ, sigio_interrupt,
+-			     IRQF_DISABLED|IRQF_SAMPLE_RANDOM, "write sigio",
+-			     NULL);
++			     IRQF_DISABLED, "write sigio", NULL);
+ 	if (err) {
+ 		printk(KERN_ERR "write_sigio_irq : um_request_irq failed, "
+ 		       "err = %d\n", err);
+--- a/Documentation/feature-removal-schedule.txt
++++ b/Documentation/feature-removal-schedule.txt
+@@ -71,20 +71,6 @@ Who:	Luis R. Rodriguez <lrodriguez@ather
+ 
+ ---------------------------
+ 
+-What:	IRQF_SAMPLE_RANDOM
+-Check:	IRQF_SAMPLE_RANDOM
+-When:	July 2009
+-
+-Why:	Many of IRQF_SAMPLE_RANDOM users are technically bogus as entropy
+-	sources in the kernel's current entropy model. To resolve this, every
+-	input point to the kernel's entropy pool needs to better document the
+-	type of entropy source it actually is. This will be replaced with
+-	additional add_*_randomness functions in drivers/char/random.c
+-
+-Who:	Robin Getz <rgetz@blackfin.uclinux.org> & Matt Mackall <mpm@selenic.com>
+-
+----------------------------
+-
+ What:	The ieee80211_regdom module parameter
+ When:	March 2010 / desktop catchup
+ 
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -852,9 +852,8 @@ static int setup_blkring(struct xenbus_d
+ 	if (err)
+ 		goto fail;
+ 
+-	err = bind_evtchn_to_irqhandler(info->evtchn,
+-					blkif_interrupt,
+-					IRQF_SAMPLE_RANDOM, "blkif", info);
++	err = bind_evtchn_to_irqhandler(info->evtchn, blkif_interrupt, 0,
++					"blkif", info);
+ 	if (err <= 0) {
+ 		xenbus_dev_fatal(dev, err,
+ 				 "bind_evtchn_to_irqhandler failed");
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -633,43 +633,6 @@ struct timer_rand_state {
+ 	unsigned dont_count_entropy:1;
+ };
+ 
+-#ifndef CONFIG_GENERIC_HARDIRQS
+-
+-static struct timer_rand_state *irq_timer_state[NR_IRQS];
+-
+-static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
+-{
+-	return irq_timer_state[irq];
+-}
+-
+-static void set_timer_rand_state(unsigned int irq,
+-				 struct timer_rand_state *state)
+-{
+-	irq_timer_state[irq] = state;
+-}
+-
+-#else
+-
+-static struct timer_rand_state *get_timer_rand_state(unsigned int irq)
+-{
+-	struct irq_desc *desc;
+-
+-	desc = irq_to_desc(irq);
+-
+-	return desc->timer_rand_state;
+-}
+-
+-static void set_timer_rand_state(unsigned int irq,
+-				 struct timer_rand_state *state)
+-{
+-	struct irq_desc *desc;
+-
+-	desc = irq_to_desc(irq);
+-
+-	desc->timer_rand_state = state;
+-}
+-#endif
+-
+ /*
+  * Add device- or boot-specific data to the input and nonblocking
+  * pools to help initialize them to unique values.
+@@ -1131,24 +1094,6 @@ static int rand_initialize(void)
+ }
+ module_init(rand_initialize);
+ 
+-void rand_initialize_irq(int irq)
+-{
+-	struct timer_rand_state *state;
+-
+-	state = get_timer_rand_state(irq);
+-
+-	if (state)
+-		return;
+-
+-	/*
+-	 * If kzalloc returns null, we just won't use that entropy
+-	 * source.
+-	 */
+-	state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
+-	if (state)
+-		set_timer_rand_state(irq, state);
+-}
+-
+ #ifdef CONFIG_BLOCK
+ void rand_initialize_disk(struct gendisk *disk)
+ {
+--- a/drivers/crypto/n2_core.c
++++ b/drivers/crypto/n2_core.c
+@@ -1607,8 +1607,7 @@ static int spu_map_ino(struct platform_d
+ 
+ 	sprintf(p->irq_name, "%s-%d", irq_name, index);
+ 
+-	return request_irq(p->irq, handler, IRQF_SAMPLE_RANDOM,
+-			   p->irq_name, p);
++	return request_irq(p->irq, handler, 0, p->irq_name, p);
+ }
+ 
+ static struct kmem_cache *queue_cache[2];
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -545,8 +545,7 @@ static int vmbus_bus_init(int irq)
+ 	if (ret)
+ 		goto err_cleanup;
+ 
+-	ret = request_irq(irq, vmbus_isr, IRQF_SAMPLE_RANDOM,
+-			driver_name, hv_acpi_dev);
++	ret = request_irq(irq, vmbus_isr, 0, driver_name, hv_acpi_dev);
+ 
+ 	if (ret != 0) {
+ 		pr_err("Unable to request IRQ %d\n",
+--- a/drivers/i2c/busses/i2c-pmcmsp.c
++++ b/drivers/i2c/busses/i2c-pmcmsp.c
+@@ -306,8 +306,7 @@ static int __devinit pmcmsptwi_probe(str
+ 	pmcmsptwi_data.irq = platform_get_irq(pldev, 0);
+ 	if (pmcmsptwi_data.irq) {
+ 		rc = request_irq(pmcmsptwi_data.irq, &pmcmsptwi_interrupt,
+-			IRQF_SHARED | IRQF_SAMPLE_RANDOM,
+-			pldev->name, &pmcmsptwi_data);
++				 IRQF_SHARED, pldev->name, &pmcmsptwi_data);
+ 		if (rc == 0) {
+ 			/*
+ 			 * Enable 'DONE' interrupt only.
+--- a/drivers/input/serio/hp_sdc.c
++++ b/drivers/input/serio/hp_sdc.c
+@@ -879,7 +879,7 @@ static int __init hp_sdc_init(void)
+ #endif
+ 
+ 	errstr = "IRQ not available for";
+-	if (request_irq(hp_sdc.irq, &hp_sdc_isr, IRQF_SHARED|IRQF_SAMPLE_RANDOM,
++	if (request_irq(hp_sdc.irq, &hp_sdc_isr, IRQF_SHARED,
+ 			"HP SDC", &hp_sdc))
+ 		goto err1;
+ 
+--- a/drivers/mfd/ab3100-core.c
++++ b/drivers/mfd/ab3100-core.c
+@@ -937,9 +937,6 @@ static int __devinit ab3100_probe(struct
+ 
+ 	err = request_threaded_irq(client->irq, NULL, ab3100_irq_handler,
+ 				IRQF_ONESHOT, "ab3100-core", ab3100);
+-	/* This real unpredictable IRQ is of course sampled for entropy */
+-	rand_initialize_irq(client->irq);
+-
+ 	if (err)
+ 		goto exit_no_irq;
+ 
+--- a/drivers/mfd/tps65010.c
++++ b/drivers/mfd/tps65010.c
+@@ -563,8 +563,7 @@ static int tps65010_probe(struct i2c_cli
+ 	 */
+ 	if (client->irq > 0) {
+ 		status = request_irq(client->irq, tps65010_irq,
+-			IRQF_SAMPLE_RANDOM | IRQF_TRIGGER_FALLING,
+-			DRIVER_NAME, tps);
++			IRQF_TRIGGER_FALLING, DRIVER_NAME, tps);
+ 		if (status < 0) {
+ 			dev_dbg(&client->dev, "can't get IRQ %d, err %d\n",
+ 					client->irq, status);
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -9415,7 +9415,7 @@ static int tg3_test_interrupt(struct tg3
+ 	}
+ 
+ 	err = request_irq(tnapi->irq_vec, tg3_test_isr,
+-			  IRQF_SHARED | IRQF_SAMPLE_RANDOM, dev->name, tnapi);
++			  IRQF_SHARED, dev->name, tnapi);
+ 	if (err)
+ 		return err;
+ 
+--- a/drivers/power/pda_power.c
++++ b/drivers/power/pda_power.c
+@@ -24,11 +24,7 @@
+ 
+ static inline unsigned int get_irq_flags(struct resource *res)
+ {
+-	unsigned int flags = IRQF_SAMPLE_RANDOM | IRQF_SHARED;
+-
+-	flags |= res->flags & IRQF_TRIGGER_MASK;
+-
+-	return flags;
++	return IRQF_SHARED | (res->flags & IRQF_TRIGGER_MASK);
+ }
+ 
+ static struct device *dev;
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -216,8 +216,7 @@ static int ulite_startup(struct uart_por
+ {
+ 	int ret;
+ 
+-	ret = request_irq(port->irq, ulite_isr,
+-			  IRQF_SHARED | IRQF_SAMPLE_RANDOM, "uartlite", port);
++	ret = request_irq(port->irq, ulite_isr, IRQF_SHARED, "uartlite", port);
+ 	if (ret)
+ 		return ret;
+ 
+--- a/drivers/usb/gadget/goku_udc.c
++++ b/drivers/usb/gadget/goku_udc.c
+@@ -1839,7 +1839,7 @@ static int goku_probe(struct pci_dev *pd
+ 	/* init to known state, then setup irqs */
+ 	udc_reset(dev);
+ 	udc_reinit (dev);
+-	if (request_irq(pdev->irq, goku_irq, IRQF_SHARED/*|IRQF_SAMPLE_RANDOM*/,
++	if (request_irq(pdev->irq, goku_irq, IRQF_SHARED,
+ 			driver_name, dev) != 0) {
+ 		DBG(dev, "request interrupt %d failed\n", pdev->irq);
+ 		retval = -EBUSY;
+--- a/drivers/usb/gadget/omap_udc.c
++++ b/drivers/usb/gadget/omap_udc.c
+@@ -2943,7 +2943,7 @@ known:
+ 
+ 	/* USB general purpose IRQ:  ep0, state changes, dma, etc */
+ 	status = request_irq(pdev->resource[1].start, omap_udc_irq,
+-			IRQF_SAMPLE_RANDOM, driver_name, udc);
++			     0, driver_name, udc);
+ 	if (status != 0) {
+ 		ERR("can't get irq %d, err %d\n",
+ 			(int) pdev->resource[1].start, status);
+@@ -2952,7 +2952,7 @@ known:
+ 
+ 	/* USB "non-iso" IRQ (PIO for all but ep0) */
+ 	status = request_irq(pdev->resource[2].start, omap_udc_pio_irq,
+-			IRQF_SAMPLE_RANDOM, "omap_udc pio", udc);
++			     0, "omap_udc pio", udc);
+ 	if (status != 0) {
+ 		ERR("can't get irq %d, err %d\n",
+ 			(int) pdev->resource[2].start, status);
+--- a/drivers/usb/gadget/pxa25x_udc.c
++++ b/drivers/usb/gadget/pxa25x_udc.c
+@@ -2202,19 +2202,15 @@ static int __init pxa25x_udc_probe(struc
+ 
+ #ifdef CONFIG_ARCH_LUBBOCK
+ 	if (machine_is_lubbock()) {
+-		retval = request_irq(LUBBOCK_USB_DISC_IRQ,
+-				lubbock_vbus_irq,
+-				IRQF_SAMPLE_RANDOM,
+-				driver_name, dev);
++		retval = request_irq(LUBBOCK_USB_DISC_IRQ, lubbock_vbus_irq,
++				     0, driver_name, dev);
+ 		if (retval != 0) {
+ 			pr_err("%s: can't get irq %i, err %d\n",
+ 				driver_name, LUBBOCK_USB_DISC_IRQ, retval);
+ 			goto err_irq_lub;
+ 		}
+-		retval = request_irq(LUBBOCK_USB_IRQ,
+-				lubbock_vbus_irq,
+-				IRQF_SAMPLE_RANDOM,
+-				driver_name, dev);
++		retval = request_irq(LUBBOCK_USB_IRQ, lubbock_vbus_irq,
++				     0, driver_name, dev);
+ 		if (retval != 0) {
+ 			pr_err("%s: can't get irq %i, err %d\n",
+ 				driver_name, LUBBOCK_USB_IRQ, retval);
+--- a/drivers/usb/otg/gpio_vbus.c
++++ b/drivers/usb/otg/gpio_vbus.c
+@@ -51,8 +51,7 @@ struct gpio_vbus_data {
+  * edges might be workable.
+  */
+ #define VBUS_IRQ_FLAGS \
+-	( IRQF_SAMPLE_RANDOM | IRQF_SHARED \
+-	| IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING )
++	( IRQF_SHARED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING )
+ 
+ 
+ /* interface to regulator framework */
+@@ -253,7 +252,7 @@ static int __init gpio_vbus_probe(struct
+ 	if (res) {
+ 		irq = res->start;
+ 		res->flags &= IRQF_TRIGGER_MASK;
+-		res->flags |= IRQF_SAMPLE_RANDOM | IRQF_SHARED;
++		res->flags |= IRQF_SHARED;
+ 	} else
+ 		irq = gpio_to_irq(gpio);
+ 
+--- a/drivers/usb/otg/isp1301_omap.c
++++ b/drivers/usb/otg/isp1301_omap.c
+@@ -1567,7 +1567,6 @@ isp1301_probe(struct i2c_client *i2c, co
+ 		isp->irq_type = IRQF_TRIGGER_FALLING;
+ 	}
+ 
+-	isp->irq_type |= IRQF_SAMPLE_RANDOM;
+ 	status = request_irq(i2c->irq, isp1301_irq,
+ 			isp->irq_type, DRIVER_NAME, isp);
+ 	if (status < 0) {
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -44,7 +44,6 @@
+  *
+  * IRQF_DISABLED - keep irqs disabled when calling the action handler.
+  *                 DEPRECATED. This flag is a NOOP and scheduled to be removed
+- * IRQF_SAMPLE_RANDOM - irq is used to feed the random generator
+  * IRQF_SHARED - allow sharing the irq among several devices
+  * IRQF_PROBE_SHARED - set by callers when they expect sharing mismatches to occur
+  * IRQF_TIMER - Flag to mark this interrupt as timer interrupt
+@@ -63,7 +62,6 @@
+  *                resume time.
+  */
+ #define IRQF_DISABLED		0x00000020
+-#define IRQF_SAMPLE_RANDOM	0x00000040
+ #define IRQF_SHARED		0x00000080
+ #define IRQF_PROBE_SHARED	0x00000100
+ #define __IRQF_TIMER		0x00000200
+--- a/include/linux/irqdesc.h
++++ b/include/linux/irqdesc.h
+@@ -39,7 +39,6 @@ struct module;
+  */
+ struct irq_desc {
+ 	struct irq_data		irq_data;
+-	struct timer_rand_state *timer_rand_state;
+ 	unsigned int __percpu	*kstat_irqs;
+ 	irq_flow_handler_t	handle_irq;
+ #ifdef CONFIG_IRQ_PREFLOW_FASTEOI
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -48,8 +48,6 @@ struct rnd_state {
+ 
+ #ifdef __KERNEL__
+ 
+-extern void rand_initialize_irq(int irq);
+-
+ extern void add_device_randomness(const void *, unsigned int);
+ extern void add_input_randomness(unsigned int type, unsigned int code,
+ 				 unsigned int value);
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -891,22 +891,6 @@ __setup_irq(unsigned int irq, struct irq
+ 		return -ENOSYS;
+ 	if (!try_module_get(desc->owner))
+ 		return -ENODEV;
+-	/*
+-	 * Some drivers like serial.c use request_irq() heavily,
+-	 * so we have to be careful not to interfere with a
+-	 * running system.
+-	 */
+-	if (new->flags & IRQF_SAMPLE_RANDOM) {
+-		/*
+-		 * This function might sleep, we want to call it first,
+-		 * outside of the atomic block.
+-		 * Yes, this might clear the entropy pool if the wrong
+-		 * driver is attempted to be loaded, without actually
+-		 * installing a new handler, but is this really a problem,
+-		 * only the sysadmin is able to do this.
+-		 */
+-		rand_initialize_irq(irq);
+-	}
+ 
+ 	/*
+ 	 * Check whether the interrupt nests into another interrupt
+@@ -1342,7 +1326,6 @@ EXPORT_SYMBOL(free_irq);
+  *	Flags:
+  *
+  *	IRQF_SHARED		Interrupt is shared
+- *	IRQF_SAMPLE_RANDOM	The interrupt can be used for entropy
+  *	IRQF_TRIGGER_*		Specify active edge(s) or level
+  *
+  */
diff --git a/target/linux/generic/patches-3.3/060-hso_devices.patch b/target/linux/generic/patches-3.3/060-hso_devices.patch
new file mode 100644
index 0000000..9b15c75
--- /dev/null
+++ b/target/linux/generic/patches-3.3/060-hso_devices.patch
@@ -0,0 +1,36 @@
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -476,8 +476,10 @@ static const struct usb_device_id hso_id
+ 	{USB_DEVICE(0x0af0, 0x8400)},
+ 	{USB_DEVICE(0x0af0, 0x8600)},
+ 	{USB_DEVICE(0x0af0, 0x8800)},
+-	{USB_DEVICE(0x0af0, 0x8900)},
+-	{USB_DEVICE(0x0af0, 0x9000)},
++	{USB_DEVICE(0x0af0, 0x8900)},  /* GTM 67xx */
++	{USB_DEVICE(0x0af0, 0x9000)},  /* GTM 66xx */
++	{USB_DEVICE(0x0af0, 0x9200)},  /* GTM 67xxWFS */
++	{USB_DEVICE(0x0af0, 0x9300)},  /* GTM 66xxWFS */
+ 	{USB_DEVICE(0x0af0, 0xd035)},
+ 	{USB_DEVICE(0x0af0, 0xd055)},
+ 	{USB_DEVICE(0x0af0, 0xd155)},
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1231,6 +1231,18 @@ UNUSUAL_DEV( 0x0af0, 0x8304, 0x0000, 0x0
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		0 ),
+ 
++UNUSUAL_DEV( 0x0af0, 0x9200, 0x0000, 0x0000,
++		"Option",
++		"Globetrotter 67xxWFS SD-Card",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		0 ),
++
++UNUSUAL_DEV( 0x0af0, 0x9300, 0x0000, 0x0000,
++		"Option",
++		"Globetrotter 66xxWFS SD-Card",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		0 ),
++
+ UNUSUAL_DEV( 0x0af0, 0xc100, 0x0000, 0x0000,
+ 		"Option",
+ 		"GI 070x SD-Card",
diff --git a/target/linux/generic/patches-3.3/060-tcp-ecn-dont-delay-ACKS-after-CE.patch b/target/linux/generic/patches-3.3/060-tcp-ecn-dont-delay-ACKS-after-CE.patch
new file mode 100644
index 0000000..6f1cd12
--- /dev/null
+++ b/target/linux/generic/patches-3.3/060-tcp-ecn-dont-delay-ACKS-after-CE.patch
@@ -0,0 +1,61 @@
+From patchwork Mon Aug  6 21:04:43 2012
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [net-next] tcp: ecn: dont delay ACKS after CE
+Date: Mon, 06 Aug 2012 11:04:43 -0000
+From: Eric Dumazet <eric.dumazet@gmail.com>
+X-Patchwork-Id: 175453
+Message-Id: <1344287083.26674.83.camel@edumazet-glaptop>
+To: David Miller <davem@davemloft.net>
+Cc: netdev <netdev@vger.kernel.org>,
+	Neal Cardwell <ncardwell@google.com>
+
+From: Eric Dumazet <edumazet@google.com>
+
+While playing with CoDel and ECN marking, I discovered a
+non optimal behavior of receiver of CE (Congestion Encountered)
+segments.
+
+In pathological cases, sender has reduced its cwnd to low values,
+and receiver delays its ACK (by 40 ms).
+
+While RFC 3168 6.1.3 (The TCP Receiver) doesn't explicitly recommend
+to send immediate ACKS, we believe its better to not delay ACKS, because
+a CE segment should give same signal than a dropped segment, and its
+quite important to reduce RTT to give ECE/CWR signals as fast as
+possible.
+
+Note we already call tcp_enter_quickack_mode() from TCP_ECN_check_ce()
+if we receive a retransmit, for the same reason.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+
+---
+net/ipv4/tcp_input.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+
+
+--
+To unsubscribe from this list: send the line "unsubscribe netdev" in
+the body of a message to majordomo@vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -231,7 +231,11 @@ static inline void TCP_ECN_check_ce(stru
+ 			tcp_enter_quickack_mode((struct sock *)tp);
+ 		break;
+ 	case INET_ECN_CE:
+-		tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
++		if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
++			/* Better not delay acks, sender can have a very low cwnd */
++			tcp_enter_quickack_mode((struct sock *)tp);
++			tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
++		}
+ 		/* fallinto */
+ 	default:
+ 		tp->ecn_flags |= TCP_ECN_SEEN;
diff --git a/target/linux/generic/patches-3.3/061-fq_codel-dont-reinit-flow-state.patch b/target/linux/generic/patches-3.3/061-fq_codel-dont-reinit-flow-state.patch
new file mode 100644
index 0000000..6699e98
--- /dev/null
+++ b/target/linux/generic/patches-3.3/061-fq_codel-dont-reinit-flow-state.patch
@@ -0,0 +1,36 @@
+From b379135c40163ae79ba7a54e6928b53983e74ee8 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sat, 1 Sep 2012 03:19:57 +0000
+Subject: [PATCH 307/558] fq_codel: dont reinit flow state
+
+When fq_codel builds a new flow, it should not reset codel state.
+
+Codel algo needs to get previous values (lastcount, drop_next) to get
+proper behavior.
+
+Signed-off-by: Dave Taht <dave.taht@gmail.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Dave Taht <dave.taht@bufferbloat.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/sched/sch_fq_codel.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -191,7 +191,6 @@ static int fq_codel_enqueue(struct sk_bu
+ 
+ 	if (list_empty(&flow->flowchain)) {
+ 		list_add_tail(&flow->flowchain, &q->new_flows);
+-		codel_vars_init(&flow->cvars);
+ 		q->new_flow_count++;
+ 		flow->deficit = q->quantum;
+ 		flow->dropped = 0;
+@@ -418,6 +417,7 @@ static int fq_codel_init(struct Qdisc *s
+ 			struct fq_codel_flow *flow = q->flows + i;
+ 
+ 			INIT_LIST_HEAD(&flow->flowchain);
++			codel_vars_init(&flow->cvars);
+ 		}
+ 	}
+ 	if (sch->limit >= 1)
diff --git a/target/linux/generic/patches-3.3/065-8139cp-fixes.patch b/target/linux/generic/patches-3.3/065-8139cp-fixes.patch
new file mode 100644
index 0000000..77c903c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/065-8139cp-fixes.patch
@@ -0,0 +1,187 @@
+commit 01ffc0a7f1c1801a2354719dedbc32aff45b987d
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Sat Nov 24 12:11:21 2012 +0000
+
+    8139cp: re-enable interrupts after tx timeout
+    
+    Recovery doesn't work too well if we leave interrupts disabled...
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Francois Romieu <romieu@fr.zoreil.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 871f0d4c153e1258d4becf306eca6761bf38b629
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Thu Nov 22 03:16:58 2012 +0000
+
+    8139cp: enable bql
+    
+    This adds support for byte queue limits on RTL8139C+
+    
+    Tested on real hardware.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-By: Dave Täht <dave.taht@bufferbloat.net>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit a9dbe40fc10cea2efe6e1ff9e03c62dd7579c5ba
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Wed Nov 21 10:27:19 2012 +0000
+
+    8139cp: set ring address after enabling C+ mode
+    
+    This fixes (for me) a regression introduced by commit b01af457 ("8139cp:
+    set ring address before enabling receiver"). That commit configured the
+    descriptor ring addresses earlier in the initialisation sequence, in
+    order to avoid the possibility of triggering stray DMA before the
+    correct address had been set up.
+    
+    Unfortunately, it seems that the hardware will scribble garbage into the
+    TxRingAddr registers when we enable "plus mode" Tx in the CpCmd
+    register. Observed on a Traverse Geos router board.
+    
+    To deal with this, while not reintroducing the problem which led to the
+    original commit, we augment cp_start_hw() to write to the CpCmd register
+    *first*, then set the descriptor ring addresses, and then finally to
+    enable Rx and Tx in the original 8139 Cmd register. The datasheet
+    actually indicates that we should enable Tx/Rx in the Cmd register
+    *before* configuring the descriptor addresses, but that would appear to
+    re-introduce the problem that the offending commit b01af457 was trying
+    to solve. And this variant appears to work fine on real hardware.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Cc: stable@kernel.org [3.5+]
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 071e3ef4a94a021b16a2912f3885c86f4ff36b49
+Author: David S. Miller <davem@davemloft.net>
+Date:   Sun Nov 25 15:52:09 2012 -0500
+
+    Revert "8139cp: revert "set ring address before enabling receiver""
+    
+    This reverts commit b26623dab7eeb1e9f5898c7a49458789dd492f20.
+    
+    This reverts the revert, in net-next we'll try another scheme
+    to fix this bug using patches from David Woodhouse.
+    
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -645,6 +645,7 @@ static void cp_tx (struct cp_private *cp
+ {
+ 	unsigned tx_head = cp->tx_head;
+ 	unsigned tx_tail = cp->tx_tail;
++	unsigned bytes_compl = 0, pkts_compl = 0;
+ 
+ 	while (tx_tail != tx_head) {
+ 		struct cp_desc *txd = cp->tx_ring + tx_tail;
+@@ -663,6 +664,9 @@ static void cp_tx (struct cp_private *cp
+ 				 le32_to_cpu(txd->opts1) & 0xffff,
+ 				 PCI_DMA_TODEVICE);
+ 
++		bytes_compl += skb->len;
++		pkts_compl++;
++
+ 		if (status & LastFrag) {
+ 			if (status & (TxError | TxFIFOUnder)) {
+ 				netif_dbg(cp, tx_err, cp->dev,
+@@ -694,6 +698,7 @@ static void cp_tx (struct cp_private *cp
+ 
+ 	cp->tx_tail = tx_tail;
+ 
++	netdev_completed_queue(cp->dev, pkts_compl, bytes_compl);
+ 	if (TX_BUFFS_AVAIL(cp) > (MAX_SKB_FRAGS + 1))
+ 		netif_wake_queue(cp->dev);
+ }
+@@ -840,6 +845,8 @@ static netdev_tx_t cp_start_xmit (struct
+ 		wmb();
+ 	}
+ 	cp->tx_head = entry;
++
++	netdev_sent_queue(dev, skb->len);
+ 	netif_dbg(cp, tx_queued, cp->dev, "tx queued, slot %d, skblen %d\n",
+ 		  entry, skb->len);
+ 	if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
+@@ -934,6 +941,8 @@ static void cp_stop_hw (struct cp_privat
+ 
+ 	cp->rx_tail = 0;
+ 	cp->tx_head = cp->tx_tail = 0;
++
++	netdev_reset_queue(cp->dev);
+ }
+ 
+ static void cp_reset_hw (struct cp_private *cp)
+@@ -954,8 +963,38 @@ static void cp_reset_hw (struct cp_priva
+ 
+ static inline void cp_start_hw (struct cp_private *cp)
+ {
++	dma_addr_t ring_dma;
++
+ 	cpw16(CpCmd, cp->cpcmd);
++
++	/*
++	 * These (at least TxRingAddr) need to be configured after the
++	 * corresponding bits in CpCmd are enabled. Datasheet v1.6 §6.33
++	 * (C+ Command Register) recommends that these and more be configured
++	 * *after* the [RT]xEnable bits in CpCmd are set. And on some hardware
++	 * it's been observed that the TxRingAddr is actually reset to garbage
++	 * when C+ mode Tx is enabled in CpCmd.
++	 */
++	cpw32_f(HiTxRingAddr, 0);
++	cpw32_f(HiTxRingAddr + 4, 0);
++
++	ring_dma = cp->ring_dma;
++	cpw32_f(RxRingAddr, ring_dma & 0xffffffff);
++	cpw32_f(RxRingAddr + 4, (ring_dma >> 16) >> 16);
++
++	ring_dma += sizeof(struct cp_desc) * CP_RX_RING_SIZE;
++	cpw32_f(TxRingAddr, ring_dma & 0xffffffff);
++	cpw32_f(TxRingAddr + 4, (ring_dma >> 16) >> 16);
++
++	/*
++	 * Strictly speaking, the datasheet says this should be enabled
++	 * *before* setting the descriptor addresses. But what, then, would
++	 * prevent it from doing DMA to random unconfigured addresses?
++	 * This variant appears to work fine.
++	 */
+ 	cpw8(Cmd, RxOn | TxOn);
++
++	netdev_reset_queue(cp->dev);
+ }
+ 
+ static void cp_enable_irq(struct cp_private *cp)
+@@ -966,7 +1005,6 @@ static void cp_enable_irq(struct cp_priv
+ static void cp_init_hw (struct cp_private *cp)
+ {
+ 	struct net_device *dev = cp->dev;
+-	dma_addr_t ring_dma;
+ 
+ 	cp_reset_hw(cp);
+ 
+@@ -989,17 +1027,6 @@ static void cp_init_hw (struct cp_privat
+ 
+ 	cpw8(Config5, cpr8(Config5) & PMEStatus);
+ 
+-	cpw32_f(HiTxRingAddr, 0);
+-	cpw32_f(HiTxRingAddr + 4, 0);
+-
+-	ring_dma = cp->ring_dma;
+-	cpw32_f(RxRingAddr, ring_dma & 0xffffffff);
+-	cpw32_f(RxRingAddr + 4, (ring_dma >> 16) >> 16);
+-
+-	ring_dma += sizeof(struct cp_desc) * CP_RX_RING_SIZE;
+-	cpw32_f(TxRingAddr, ring_dma & 0xffffffff);
+-	cpw32_f(TxRingAddr + 4, (ring_dma >> 16) >> 16);
+-
+ 	cpw16(MultiIntr, 0);
+ 
+ 	cpw8_f(Cfg9346, Cfg9346_Lock);
+@@ -1188,6 +1215,7 @@ static void cp_tx_timeout(struct net_dev
+ 	cp_clean_rings(cp);
+ 	rc = cp_init_rings(cp);
+ 	cp_start_hw(cp);
++	cp_enable_irq(cp);
+ 
+ 	netif_wake_queue(dev);
+ 
diff --git a/target/linux/generic/patches-3.3/070-gpio-add-flags-to-export-GPIOs-when-requesting.patch b/target/linux/generic/patches-3.3/070-gpio-add-flags-to-export-GPIOs-when-requesting.patch
new file mode 100644
index 0000000..fb4387e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/070-gpio-add-flags-to-export-GPIOs-when-requesting.patch
@@ -0,0 +1,68 @@
+From fc3a1f04f5040255cbc086c419e4237f29f89f88 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Tue, 13 Dec 2011 18:34:01 +0100
+Subject: [PATCH] gpio: add flags to export GPIOs when requesting
+
+commit fc3a1f04f5040255cbc086c419e4237f29f89f88 upstream.
+
+Introduce new flags to automatically export GPIOs when using the convenience
+functions gpio_request_one() or gpio_request_array(). This eases support for
+custom boards where lots of GPIOs need to be exported for customer
+applications.
+
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+---
+ Documentation/gpio.txt |    3 +++
+ drivers/gpio/gpiolib.c |   12 +++++++++++-
+ include/linux/gpio.h   |    5 +++++
+ 3 files changed, 19 insertions(+), 1 deletion(-)
+
+--- a/Documentation/gpio.txt
++++ b/Documentation/gpio.txt
+@@ -303,6 +303,9 @@ where 'flags' is currently defined to sp
+ 	* GPIOF_INIT_LOW	- as output, set initial level to LOW
+ 	* GPIOF_INIT_HIGH	- as output, set initial level to HIGH
+ 
++	* GPIOF_EXPORT_DIR_FIXED	- export gpio to sysfs, keep direction
++	* GPIOF_EXPORT_DIR_CHANGEABLE	- also export, allow changing direction
++
+ since GPIOF_INIT_* are only valid when configured as output, so group valid
+ combinations as:
+ 
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1289,8 +1289,18 @@ int gpio_request_one(unsigned gpio, unsi
+ 				(flags & GPIOF_INIT_HIGH) ? 1 : 0);
+ 
+ 	if (err)
+-		gpio_free(gpio);
++		goto free_gpio;
+ 
++	if (flags & GPIOF_EXPORT) {
++		err = gpio_export(gpio, flags & GPIOF_EXPORT_CHANGEABLE);
++		if (err)
++			goto free_gpio;
++	}
++
++	return 0;
++
++ free_gpio:
++	gpio_free(gpio);
+ 	return err;
+ }
+ EXPORT_SYMBOL_GPL(gpio_request_one);
+--- a/include/linux/gpio.h
++++ b/include/linux/gpio.h
+@@ -14,6 +14,11 @@
+ #define GPIOF_OUT_INIT_LOW	(GPIOF_DIR_OUT | GPIOF_INIT_LOW)
+ #define GPIOF_OUT_INIT_HIGH	(GPIOF_DIR_OUT | GPIOF_INIT_HIGH)
+ 
++#define GPIOF_EXPORT		(1 << 2)
++#define GPIOF_EXPORT_CHANGEABLE	(1 << 3)
++#define GPIOF_EXPORT_DIR_FIXED	(GPIOF_EXPORT)
++#define GPIOF_EXPORT_DIR_CHANGEABLE (GPIOF_EXPORT | GPIOF_EXPORT_CHANGEABLE)
++
+ /**
+  * struct gpio - a structure describing a GPIO with configuration
+  * @gpio:	the GPIO number
diff --git a/target/linux/generic/patches-3.3/080-prot-release-cb.patch b/target/linux/generic/patches-3.3/080-prot-release-cb.patch
new file mode 100644
index 0000000..56cda6b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/080-prot-release-cb.patch
@@ -0,0 +1,27 @@
+This was added in commit 46d3ceabd8d98ed0ad10f20c595ca784e34786c5 (tcp: 
+TCP Small Queues) but we need it for pppoatm too.
+
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -810,6 +810,8 @@ struct proto {
+ 	int			(*backlog_rcv) (struct sock *sk, 
+ 						struct sk_buff *skb);
+ 
++	void		(*release_cb)(struct sock *sk);
++
+ 	/* Keeping track of sk's, looking them up, and port selection methods. */
+ 	void			(*hash)(struct sock *sk);
+ 	void			(*unhash)(struct sock *sk);
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2138,6 +2138,10 @@ void release_sock(struct sock *sk)
+ 	spin_lock_bh(&sk->sk_lock.slock);
+ 	if (sk->sk_backlog.tail)
+ 		__release_sock(sk);
++
++	if (sk->sk_prot->release_cb)
++		sk->sk_prot->release_cb(sk);
++
+ 	sk->sk_lock.owned = 0;
+ 	if (waitqueue_active(&sk->sk_lock.wq))
+ 		wake_up(&sk->sk_lock.wq);
diff --git a/target/linux/generic/patches-3.3/081-USB-OHCI-Add-a-generic-platform-device-driver.patch b/target/linux/generic/patches-3.3/081-USB-OHCI-Add-a-generic-platform-device-driver.patch
new file mode 100644
index 0000000..8ea102f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/081-USB-OHCI-Add-a-generic-platform-device-driver.patch
@@ -0,0 +1,271 @@
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -393,6 +393,16 @@ config USB_CNS3XXX_OHCI
+ 	  Enable support for the CNS3XXX SOC's on-chip OHCI controller.
+ 	  It is needed for low-speed USB 1.0 device support.
+ 
++config USB_OHCI_HCD_PLATFORM
++	bool "Generic OHCI driver for a platform device"
++	depends on USB_OHCI_HCD && EXPERIMENTAL
++	default n
++	---help---
++	  Adds an OHCI host driver for a generic platform device, which
++	  provieds a memory space and an irq.
++
++	  If unsure, say N.
++
+ config USB_OHCI_BIG_ENDIAN_DESC
+ 	bool
+ 	depends on USB_OHCI_HCD
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -1121,6 +1121,11 @@ MODULE_LICENSE ("GPL");
+ #define PLATFORM_DRIVER		ohci_xls_driver
+ #endif
+ 
++#ifdef CONFIG_USB_OHCI_HCD_PLATFORM
++#include "ohci-platform.c"
++#define PLATFORM_DRIVER		ohci_platform_driver
++#endif
++
+ #if	!defined(PCI_DRIVER) &&		\
+ 	!defined(PLATFORM_DRIVER) &&	\
+ 	!defined(OMAP1_PLATFORM_DRIVER) &&	\
+--- /dev/null
++++ b/drivers/usb/host/ohci-platform.c
+@@ -0,0 +1,194 @@
++/*
++ * Generic platform ohci driver
++ *
++ * Copyright 2007 Michael Buesch <m@bues.ch>
++ * Copyright 2011-2012 Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * Derived from the OCHI-SSB driver
++ * Derived from the OHCI-PCI driver
++ * Copyright 1999 Roman Weissgaerber
++ * Copyright 2000-2002 David Brownell
++ * Copyright 1999 Linus Torvalds
++ * Copyright 1999 Gregory P. Smith
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++#include <linux/platform_device.h>
++#include <linux/usb/ohci_pdriver.h>
++
++static int ohci_platform_reset(struct usb_hcd *hcd)
++{
++	struct platform_device *pdev = to_platform_device(hcd->self.controller);
++	struct usb_ohci_pdata *pdata = pdev->dev.platform_data;
++	struct ohci_hcd *ohci = hcd_to_ohci(hcd);
++	int err;
++
++	if (pdata->big_endian_desc)
++		ohci->flags |= OHCI_QUIRK_BE_DESC;
++	if (pdata->big_endian_mmio)
++		ohci->flags |= OHCI_QUIRK_BE_MMIO;
++	if (pdata->no_big_frame_no)
++		ohci->flags |= OHCI_QUIRK_FRAME_NO;
++
++	ohci_hcd_init(ohci);
++	err = ohci_init(ohci);
++
++	return err;
++}
++
++static int ohci_platform_start(struct usb_hcd *hcd)
++{
++	struct ohci_hcd *ohci = hcd_to_ohci(hcd);
++	int err;
++
++	err = ohci_run(ohci);
++	if (err < 0) {
++		ohci_err(ohci, "can't start\n");
++		ohci_stop(hcd);
++	}
++
++	return err;
++}
++
++static const struct hc_driver ohci_platform_hc_driver = {
++	.description		= hcd_name,
++	.product_desc		= "Generic Platform OHCI Controller",
++	.hcd_priv_size		= sizeof(struct ohci_hcd),
++
++	.irq			= ohci_irq,
++	.flags			= HCD_MEMORY | HCD_USB11,
++
++	.reset			= ohci_platform_reset,
++	.start			= ohci_platform_start,
++	.stop			= ohci_stop,
++	.shutdown		= ohci_shutdown,
++
++	.urb_enqueue		= ohci_urb_enqueue,
++	.urb_dequeue		= ohci_urb_dequeue,
++	.endpoint_disable	= ohci_endpoint_disable,
++
++	.get_frame_number	= ohci_get_frame,
++
++	.hub_status_data	= ohci_hub_status_data,
++	.hub_control		= ohci_hub_control,
++#ifdef	CONFIG_PM
++	.bus_suspend		= ohci_bus_suspend,
++	.bus_resume		= ohci_bus_resume,
++#endif
++
++	.start_port_reset	= ohci_start_port_reset,
++};
++
++static int __devinit ohci_platform_probe(struct platform_device *dev)
++{
++	struct usb_hcd *hcd;
++	struct resource *res_mem;
++	int irq;
++	int err = -ENOMEM;
++
++	BUG_ON(!dev->dev.platform_data);
++
++	if (usb_disabled())
++		return -ENODEV;
++
++	irq = platform_get_irq(dev, 0);
++	if (irq < 0) {
++		pr_err("no irq provieded");
++		return irq;
++	}
++
++	res_mem = platform_get_resource(dev, IORESOURCE_MEM, 0);
++	if (!res_mem) {
++		pr_err("no memory recourse provieded");
++		return -ENXIO;
++	}
++
++	hcd = usb_create_hcd(&ohci_platform_hc_driver, &dev->dev,
++			dev_name(&dev->dev));
++	if (!hcd)
++		return -ENOMEM;
++
++	hcd->rsrc_start = res_mem->start;
++	hcd->rsrc_len = resource_size(res_mem);
++
++	if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
++		pr_err("controller already in use");
++		err = -EBUSY;
++		goto err_put_hcd;
++	}
++
++	hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
++	if (!hcd->regs)
++		goto err_release_region;
++	err = usb_add_hcd(hcd, irq, IRQF_SHARED);
++	if (err)
++		goto err_iounmap;
++
++	platform_set_drvdata(dev, hcd);
++
++	return err;
++
++err_iounmap:
++	iounmap(hcd->regs);
++err_release_region:
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
++err_put_hcd:
++	usb_put_hcd(hcd);
++	return err;
++}
++
++static int __devexit ohci_platform_remove(struct platform_device *dev)
++{
++	struct usb_hcd *hcd = platform_get_drvdata(dev);
++
++	usb_remove_hcd(hcd);
++	iounmap(hcd->regs);
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
++	usb_put_hcd(hcd);
++	platform_set_drvdata(dev, NULL);
++
++	return 0;
++}
++
++#ifdef CONFIG_PM
++
++static int ohci_platform_suspend(struct device *dev)
++{
++	return 0;
++}
++
++static int ohci_platform_resume(struct device *dev)
++{
++	struct usb_hcd *hcd = dev_get_drvdata(dev);
++
++	ohci_finish_controller_resume(hcd);
++	return 0;
++}
++
++#else /* !CONFIG_PM */
++#define ohci_platform_suspend	NULL
++#define ohci_platform_resume	NULL
++#endif /* CONFIG_PM */
++
++static const struct platform_device_id ohci_platform_table[] = {
++	{ "ohci-platform", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(platform, ohci_platform_table);
++
++static const struct dev_pm_ops ohci_platform_pm_ops = {
++	.suspend	= ohci_platform_suspend,
++	.resume		= ohci_platform_resume,
++};
++
++static struct platform_driver ohci_platform_driver = {
++	.id_table	= ohci_platform_table,
++	.probe		= ohci_platform_probe,
++	.remove		= __devexit_p(ohci_platform_remove),
++	.shutdown	= usb_hcd_platform_shutdown,
++	.driver		= {
++		.owner	= THIS_MODULE,
++		.name	= "ohci-platform",
++		.pm	= &ohci_platform_pm_ops,
++	}
++};
+--- /dev/null
++++ b/include/linux/usb/ohci_pdriver.h
+@@ -0,0 +1,38 @@
++/*
++ * Copyright (C) 2012 Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
++ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
++ * for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software Foundation,
++ * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ */
++
++#ifndef __USB_CORE_OHCI_PDRIVER_H
++#define __USB_CORE_OHCI_PDRIVER_H
++
++/**
++ * struct usb_ohci_pdata - platform_data for generic ohci driver
++ *
++ * @big_endian_desc:	BE descriptors
++ * @big_endian_mmio:	BE registers
++ * @no_big_frame_no:	no big endian frame_no shift
++ *
++ * These are general configuration options for the OHCI controller. All of
++ * these options are activating more or less workarounds for some hardware.
++ */
++struct usb_ohci_pdata {
++	unsigned	big_endian_desc:1;
++	unsigned	big_endian_mmio:1;
++	unsigned	no_big_frame_no:1;
++};
++
++#endif /* __USB_CORE_OHCI_PDRIVER_H */
diff --git a/target/linux/generic/patches-3.3/082-USB-EHCI-Add-a-generic-platform-device-driver.patch b/target/linux/generic/patches-3.3/082-USB-EHCI-Add-a-generic-platform-device-driver.patch
new file mode 100644
index 0000000..62eb87a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/082-USB-EHCI-Add-a-generic-platform-device-driver.patch
@@ -0,0 +1,283 @@
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -403,6 +403,16 @@ config USB_OHCI_HCD_PLATFORM
+ 
+ 	  If unsure, say N.
+ 
++config USB_EHCI_HCD_PLATFORM
++	bool "Generic EHCI driver for a platform device"
++	depends on USB_EHCI_HCD && EXPERIMENTAL
++	default n
++	---help---
++	  Adds an EHCI host driver for a generic platform device, which
++	  provieds a memory space and an irq.
++
++	  If unsure, say N.
++
+ config USB_OHCI_BIG_ENDIAN_DESC
+ 	bool
+ 	depends on USB_OHCI_HCD
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -1381,6 +1381,11 @@ MODULE_LICENSE ("GPL");
+ #define        PLATFORM_DRIVER         ehci_mv_driver
+ #endif
+ 
++#ifdef CONFIG_USB_EHCI_HCD_PLATFORM
++#include "ehci-platform.c"
++#define PLATFORM_DRIVER		ehci_platform_driver
++#endif
++
+ #if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER) && \
+     !defined(PS3_SYSTEM_BUS_DRIVER) && !defined(OF_PLATFORM_DRIVER) && \
+     !defined(XILINX_OF_PLATFORM_DRIVER)
+--- /dev/null
++++ b/drivers/usb/host/ehci-platform.c
+@@ -0,0 +1,198 @@
++/*
++ * Generic platform ehci driver
++ *
++ * Copyright 2007 Steven Brown <sbrown@cortland.com>
++ * Copyright 2010-2012 Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * Derived from the ohci-ssb driver
++ * Copyright 2007 Michael Buesch <m@bues.ch>
++ *
++ * Derived from the EHCI-PCI driver
++ * Copyright (c) 2000-2004 by David Brownell
++ *
++ * Derived from the ohci-pci driver
++ * Copyright 1999 Roman Weissgaerber
++ * Copyright 2000-2002 David Brownell
++ * Copyright 1999 Linus Torvalds
++ * Copyright 1999 Gregory P. Smith
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++#include <linux/platform_device.h>
++#include <linux/usb/ehci_pdriver.h>
++
++static int ehci_platform_reset(struct usb_hcd *hcd)
++{
++	struct platform_device *pdev = to_platform_device(hcd->self.controller);
++	struct usb_ehci_pdata *pdata = pdev->dev.platform_data;
++	struct ehci_hcd *ehci = hcd_to_ehci(hcd);
++	int retval;
++
++	hcd->has_tt = pdata->has_tt;
++	ehci->has_synopsys_hc_bug = pdata->has_synopsys_hc_bug;
++	ehci->big_endian_desc = pdata->big_endian_desc;
++	ehci->big_endian_mmio = pdata->big_endian_mmio;
++
++	ehci->caps = hcd->regs + pdata->caps_offset;
++	retval = ehci_setup(hcd);
++	if (retval)
++		return retval;
++
++	if (pdata->port_power_on)
++		ehci_port_power(ehci, 1);
++	if (pdata->port_power_off)
++		ehci_port_power(ehci, 0);
++
++	return 0;
++}
++
++static const struct hc_driver ehci_platform_hc_driver = {
++	.description		= hcd_name,
++	.product_desc		= "Generic Platform EHCI Controller",
++	.hcd_priv_size		= sizeof(struct ehci_hcd),
++
++	.irq			= ehci_irq,
++	.flags			= HCD_MEMORY | HCD_USB2,
++
++	.reset			= ehci_platform_reset,
++	.start			= ehci_run,
++	.stop			= ehci_stop,
++	.shutdown		= ehci_shutdown,
++
++	.urb_enqueue		= ehci_urb_enqueue,
++	.urb_dequeue		= ehci_urb_dequeue,
++	.endpoint_disable	= ehci_endpoint_disable,
++	.endpoint_reset		= ehci_endpoint_reset,
++
++	.get_frame_number	= ehci_get_frame,
++
++	.hub_status_data	= ehci_hub_status_data,
++	.hub_control		= ehci_hub_control,
++#if defined(CONFIG_PM)
++	.bus_suspend		= ehci_bus_suspend,
++	.bus_resume		= ehci_bus_resume,
++#endif
++	.relinquish_port	= ehci_relinquish_port,
++	.port_handed_over	= ehci_port_handed_over,
++
++	.update_device		= ehci_update_device,
++
++	.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
++};
++
++static int __devinit ehci_platform_probe(struct platform_device *dev)
++{
++	struct usb_hcd *hcd;
++	struct resource *res_mem;
++	int irq;
++	int err = -ENOMEM;
++
++	BUG_ON(!dev->dev.platform_data);
++
++	if (usb_disabled())
++		return -ENODEV;
++
++	irq = platform_get_irq(dev, 0);
++	if (irq < 0) {
++		pr_err("no irq provieded");
++		return irq;
++	}
++	res_mem = platform_get_resource(dev, IORESOURCE_MEM, 0);
++	if (!res_mem) {
++		pr_err("no memory recourse provieded");
++		return -ENXIO;
++	}
++
++	hcd = usb_create_hcd(&ehci_platform_hc_driver, &dev->dev,
++			     dev_name(&dev->dev));
++	if (!hcd)
++		return -ENOMEM;
++
++	hcd->rsrc_start = res_mem->start;
++	hcd->rsrc_len = resource_size(res_mem);
++
++	if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
++		pr_err("controller already in use");
++		err = -EBUSY;
++		goto err_put_hcd;
++	}
++
++	hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
++	if (!hcd->regs)
++		goto err_release_region;
++	err = usb_add_hcd(hcd, irq, IRQF_SHARED);
++	if (err)
++		goto err_iounmap;
++
++	platform_set_drvdata(dev, hcd);
++
++	return err;
++
++err_iounmap:
++	iounmap(hcd->regs);
++err_release_region:
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
++err_put_hcd:
++	usb_put_hcd(hcd);
++	return err;
++}
++
++static int __devexit ehci_platform_remove(struct platform_device *dev)
++{
++	struct usb_hcd *hcd = platform_get_drvdata(dev);
++
++	usb_remove_hcd(hcd);
++	iounmap(hcd->regs);
++	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
++	usb_put_hcd(hcd);
++	platform_set_drvdata(dev, NULL);
++
++	return 0;
++}
++
++#ifdef CONFIG_PM
++
++static int ehci_platform_suspend(struct device *dev)
++{
++	struct usb_hcd *hcd = dev_get_drvdata(dev);
++	bool wakeup = device_may_wakeup(dev);
++
++	ehci_prepare_ports_for_controller_suspend(hcd_to_ehci(hcd), wakeup);
++	return 0;
++}
++
++static int ehci_platform_resume(struct device *dev)
++{
++	struct usb_hcd *hcd = dev_get_drvdata(dev);
++
++	ehci_prepare_ports_for_controller_resume(hcd_to_ehci(hcd));
++	return 0;
++}
++
++#else /* !CONFIG_PM */
++#define ehci_platform_suspend	NULL
++#define ehci_platform_resume	NULL
++#endif /* CONFIG_PM */
++
++static const struct platform_device_id ehci_platform_table[] = {
++	{ "ehci-platform", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(platform, ehci_platform_table);
++
++static const struct dev_pm_ops ehci_platform_pm_ops = {
++	.suspend	= ehci_platform_suspend,
++	.resume		= ehci_platform_resume,
++};
++
++static struct platform_driver ehci_platform_driver = {
++	.id_table	= ehci_platform_table,
++	.probe		= ehci_platform_probe,
++	.remove		= __devexit_p(ehci_platform_remove),
++	.shutdown	= usb_hcd_platform_shutdown,
++	.driver		= {
++		.owner	= THIS_MODULE,
++		.name	= "ehci-platform",
++		.pm	= &ehci_platform_pm_ops,
++	}
++};
+--- /dev/null
++++ b/include/linux/usb/ehci_pdriver.h
+@@ -0,0 +1,46 @@
++/*
++ * Copyright (C) 2012 Hauke Mehrtens <hauke@hauke-m.de>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
++ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
++ * for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software Foundation,
++ * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ */
++
++#ifndef __USB_CORE_EHCI_PDRIVER_H
++#define __USB_CORE_EHCI_PDRIVER_H
++
++/**
++ * struct usb_ehci_pdata - platform_data for generic ehci driver
++ *
++ * @caps_offset:	offset of the EHCI Capability Registers to the start of
++ *			the io memory region provided to the driver.
++ * @has_tt:		set to 1 if TT is integrated in root hub.
++ * @port_power_on:	set to 1 if the controller needs a power up after
++ *			initialization.
++ * @port_power_off:	set to 1 if the controller needs to be powered down
++ *			after initialization.
++ *
++ * These are general configuration options for the EHCI controller. All of
++ * these options are activating more or less workarounds for some hardware.
++ */
++struct usb_ehci_pdata {
++	int		caps_offset;
++	unsigned	has_tt:1;
++	unsigned	has_synopsys_hc_bug:1;
++	unsigned	big_endian_desc:1;
++	unsigned	big_endian_mmio:1;
++	unsigned	port_power_on:1;
++	unsigned	port_power_off:1;
++};
++
++#endif /* __USB_CORE_EHCI_PDRIVER_H */
diff --git a/target/linux/generic/patches-3.3/083-USB-EHCI-platform-remove-update.patch b/target/linux/generic/patches-3.3/083-USB-EHCI-platform-remove-update.patch
new file mode 100644
index 0000000..e9a5b70
--- /dev/null
+++ b/target/linux/generic/patches-3.3/083-USB-EHCI-platform-remove-update.patch
@@ -0,0 +1,11 @@
+--- a/drivers/usb/host/ehci-platform.c
++++ b/drivers/usb/host/ehci-platform.c
+@@ -75,8 +75,6 @@ static const struct hc_driver ehci_platf
+ 	.relinquish_port	= ehci_relinquish_port,
+ 	.port_handed_over	= ehci_port_handed_over,
+ 
+-	.update_device		= ehci_update_device,
+-
+ 	.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+ 
diff --git a/target/linux/generic/patches-3.3/084-x86_fix_perf_uclibc_build.patch b/target/linux/generic/patches-3.3/084-x86_fix_perf_uclibc_build.patch
new file mode 100644
index 0000000..95163a4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/084-x86_fix_perf_uclibc_build.patch
@@ -0,0 +1,27 @@
+From 031d8ad2c3cee85c515e551fc8c0054bdedb7b8b Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Thu, 13 Dec 2012 18:02:11 +0100
+Subject: [PATCH] x86: fix perf build with uclibc toolchains
+
+libio.h is not provided by uClibc, in order to be able to test the
+definition of __UCLIBC__ we need to include stdlib.h, which also
+includes stddef.h, providing the definition of 'NULL'
+
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+---
+ tools/perf/arch/x86/util/dwarf-regs.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/tools/perf/arch/x86/util/dwarf-regs.c
++++ b/tools/perf/arch/x86/util/dwarf-regs.c
+@@ -20,7 +20,10 @@
+  *
+  */
+ 
++#include <stdlib.h>
++#ifndef __UCLIBC__
+ #include <libio.h>
++#endif
+ #include <dwarf-regs.h>
+ 
+ /*
diff --git a/target/linux/generic/patches-3.3/100-overlayfs_v12.patch b/target/linux/generic/patches-3.3/100-overlayfs_v12.patch
new file mode 100644
index 0000000..14e6558
--- /dev/null
+++ b/target/linux/generic/patches-3.3/100-overlayfs_v12.patch
@@ -0,0 +1,3232 @@
+--- a/Documentation/filesystems/Locking
++++ b/Documentation/filesystems/Locking
+@@ -62,6 +62,7 @@ ata *);
+ 	int (*removexattr) (struct dentry *, const char *);
+ 	void (*truncate_range)(struct inode *, loff_t, loff_t);
+ 	int (*fiemap)(struct inode *, struct fiemap_extent_info *, u64 start, u64 len);
++	struct file *(*open)(struct dentry *,struct file *,const struct cred *);
+ 
+ locking rules:
+ 	all may block
+@@ -89,6 +90,7 @@ listxattr:	no
+ removexattr:	yes
+ truncate_range:	yes
+ fiemap:		no
++open:		no
+ 	Additionally, ->rmdir(), ->unlink() and ->rename() have ->i_mutex on
+ victim.
+ 	cross-directory ->rename() has (per-superblock) ->s_vfs_rename_sem.
+--- /dev/null
++++ b/Documentation/filesystems/overlayfs.txt
+@@ -0,0 +1,199 @@
++Written by: Neil Brown <neilb@suse.de>
++
++Overlay Filesystem
++==================
++
++This document describes a prototype for a new approach to providing
++overlay-filesystem functionality in Linux (sometimes referred to as
++union-filesystems).  An overlay-filesystem tries to present a
++filesystem which is the result over overlaying one filesystem on top
++of the other.
++
++The result will inevitably fail to look exactly like a normal
++filesystem for various technical reasons.  The expectation is that
++many use cases will be able to ignore these differences.
++
++This approach is 'hybrid' because the objects that appear in the
++filesystem do not all appear to belong to that filesystem.  In many
++cases an object accessed in the union will be indistinguishable
++from accessing the corresponding object from the original filesystem.
++This is most obvious from the 'st_dev' field returned by stat(2).
++
++While directories will report an st_dev from the overlay-filesystem,
++all non-directory objects will report an st_dev from the lower or
++upper filesystem that is providing the object.  Similarly st_ino will
++only be unique when combined with st_dev, and both of these can change
++over the lifetime of a non-directory object.  Many applications and
++tools ignore these values and will not be affected.
++
++Upper and Lower
++---------------
++
++An overlay filesystem combines two filesystems - an 'upper' filesystem
++and a 'lower' filesystem.  When a name exists in both filesystems, the
++object in the 'upper' filesystem is visible while the object in the
++'lower' filesystem is either hidden or, in the case of directories,
++merged with the 'upper' object.
++
++It would be more correct to refer to an upper and lower 'directory
++tree' rather than 'filesystem' as it is quite possible for both
++directory trees to be in the same filesystem and there is no
++requirement that the root of a filesystem be given for either upper or
++lower.
++
++The lower filesystem can be any filesystem supported by Linux and does
++not need to be writable.  The lower filesystem can even be another
++overlayfs.  The upper filesystem will normally be writable and if it
++is it must support the creation of trusted.* extended attributes, and
++must provide valid d_type in readdir responses, at least for symbolic
++links - so NFS is not suitable.
++
++A read-only overlay of two read-only filesystems may use any
++filesystem type.
++
++Directories
++-----------
++
++Overlaying mainly involved directories.  If a given name appears in both
++upper and lower filesystems and refers to a non-directory in either,
++then the lower object is hidden - the name refers only to the upper
++object.
++
++Where both upper and lower objects are directories, a merged directory
++is formed.
++
++At mount time, the two directories given as mount options are combined
++into a merged directory:
++
++  mount -t overlayfs overlayfs -olowerdir=/lower,upperdir=/upper /overlay
++
++Then whenever a lookup is requested in such a merged directory, the
++lookup is performed in each actual directory and the combined result
++is cached in the dentry belonging to the overlay filesystem.  If both
++actual lookups find directories, both are stored and a merged
++directory is created, otherwise only one is stored: the upper if it
++exists, else the lower.
++
++Only the lists of names from directories are merged.  Other content
++such as metadata and extended attributes are reported for the upper
++directory only.  These attributes of the lower directory are hidden.
++
++whiteouts and opaque directories
++--------------------------------
++
++In order to support rm and rmdir without changing the lower
++filesystem, an overlay filesystem needs to record in the upper filesystem
++that files have been removed.  This is done using whiteouts and opaque
++directories (non-directories are always opaque).
++
++The overlay filesystem uses extended attributes with a
++"trusted.overlay."  prefix to record these details.
++
++A whiteout is created as a symbolic link with target
++"(overlay-whiteout)" and with xattr "trusted.overlay.whiteout" set to "y".
++When a whiteout is found in the upper level of a merged directory, any
++matching name in the lower level is ignored, and the whiteout itself
++is also hidden.
++
++A directory is made opaque by setting the xattr "trusted.overlay.opaque"
++to "y".  Where the upper filesystem contains an opaque directory, any
++directory in the lower filesystem with the same name is ignored.
++
++readdir
++-------
++
++When a 'readdir' request is made on a merged directory, the upper and
++lower directories are each read and the name lists merged in the
++obvious way (upper is read first, then lower - entries that already
++exist are not re-added).  This merged name list is cached in the
++'struct file' and so remains as long as the file is kept open.  If the
++directory is opened and read by two processes at the same time, they
++will each have separate caches.  A seekdir to the start of the
++directory (offset 0) followed by a readdir will cause the cache to be
++discarded and rebuilt.
++
++This means that changes to the merged directory do not appear while a
++directory is being read.  This is unlikely to be noticed by many
++programs.
++
++seek offsets are assigned sequentially when the directories are read.
++Thus if
++  - read part of a directory
++  - remember an offset, and close the directory
++  - re-open the directory some time later
++  - seek to the remembered offset
++
++there may be little correlation between the old and new locations in
++the list of filenames, particularly if anything has changed in the
++directory.
++
++Readdir on directories that are not merged is simply handled by the
++underlying directory (upper or lower).
++
++
++Non-directories
++---------------
++
++Objects that are not directories (files, symlinks, device-special
++files etc.) are presented either from the upper or lower filesystem as
++appropriate.  When a file in the lower filesystem is accessed in a way
++the requires write-access, such as opening for write access, changing
++some metadata etc., the file is first copied from the lower filesystem
++to the upper filesystem (copy_up).  Note that creating a hard-link
++also requires copy_up, though of course creation of a symlink does
++not.
++
++The copy_up may turn out to be unnecessary, for example if the file is
++opened for read-write but the data is not modified.
++
++The copy_up process first makes sure that the containing directory
++exists in the upper filesystem - creating it and any parents as
++necessary.  It then creates the object with the same metadata (owner,
++mode, mtime, symlink-target etc.) and then if the object is a file, the
++data is copied from the lower to the upper filesystem.  Finally any
++extended attributes are copied up.
++
++Once the copy_up is complete, the overlay filesystem simply
++provides direct access to the newly created file in the upper
++filesystem - future operations on the file are barely noticed by the
++overlay filesystem (though an operation on the name of the file such as
++rename or unlink will of course be noticed and handled).
++
++
++Non-standard behavior
++---------------------
++
++The copy_up operation essentially creates a new, identical file and
++moves it over to the old name.  The new file may be on a different
++filesystem, so both st_dev and st_ino of the file may change.
++
++Any open files referring to this inode will access the old data and
++metadata.  Similarly any file locks obtained before copy_up will not
++apply to the copied up file.
++
++On a file is opened with O_RDONLY fchmod(2), fchown(2), futimesat(2)
++and fsetxattr(2) will fail with EROFS.
++
++If a file with multiple hard links is copied up, then this will
++"break" the link.  Changes will not be propagated to other names
++referring to the same inode.
++
++Symlinks in /proc/PID/ and /proc/PID/fd which point to a non-directory
++object in overlayfs will not contain vaid absolute paths, only
++relative paths leading up to the filesystem's root.  This will be
++fixed in the future.
++
++Some operations are not atomic, for example a crash during copy_up or
++rename will leave the filesystem in an inconsitent state.  This will
++be addressed in the future.
++
++Changes to underlying filesystems
++---------------------------------
++
++Offline changes, when the overlay is not mounted, are allowed to either
++the upper or the lower trees.
++
++Changes to the underlying filesystems while part of a mounted overlay
++filesystem are not allowed.  If the underlying filesystem is changed,
++the behavior of the overlay is undefined, though it will not result in
++a crash or deadlock.
+--- a/Documentation/filesystems/vfs.txt
++++ b/Documentation/filesystems/vfs.txt
+@@ -364,6 +364,8 @@ struct inode_operations {
+ 	ssize_t (*listxattr) (struct dentry *, char *, size_t);
+ 	int (*removexattr) (struct dentry *, const char *);
+ 	void (*truncate_range)(struct inode *, loff_t, loff_t);
++	struct file *(*open) (struct dentry *, struct file *,
++			      const struct cred *);
+ };
+ 
+ Again, all methods are called without any locks being held, unless
+@@ -475,6 +477,12 @@ otherwise noted.
+   truncate_range: a method provided by the underlying filesystem to truncate a
+   	range of blocks , i.e. punch a hole somewhere in a file.
+ 
++  open: this is an alternative to f_op->open(), the difference is that this
++	method may return any open file, not necessarily originating from the
++	same filesystem as the one i_op->open() was called on.  It may be useful
++	for stacking filesystems which want to allow native I/O directly on
++	underlying files.
++
+ 
+ The Address Space Object
+ ========================
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4955,6 +4955,13 @@ F:	drivers/scsi/osd/
+ F:	include/scsi/osd_*
+ F:	fs/exofs/
+ 
++OVERLAYFS FILESYSTEM
++M:	Miklos Szeredi <miklos@szeredi.hu>
++L:	linux-fsdevel@vger.kernel.org
++S:	Supported
++F:	fs/overlayfs/*
++F:	Documentation/filesystems/overlayfs.txt
++
+ P54 WIRELESS DRIVER
+ M:	Christian Lamparter <chunkeey@googlemail.com>
+ L:	linux-wireless@vger.kernel.org
+--- a/fs/Kconfig
++++ b/fs/Kconfig
+@@ -63,6 +63,7 @@ source "fs/quota/Kconfig"
+ 
+ source "fs/autofs4/Kconfig"
+ source "fs/fuse/Kconfig"
++source "fs/overlayfs/Kconfig"
+ 
+ config CUSE
+ 	tristate "Character device in Userspace support"
+--- a/fs/Makefile
++++ b/fs/Makefile
+@@ -105,6 +105,7 @@ obj-$(CONFIG_QNX4FS_FS)		+= qnx4/
+ obj-$(CONFIG_AUTOFS4_FS)	+= autofs4/
+ obj-$(CONFIG_ADFS_FS)		+= adfs/
+ obj-$(CONFIG_FUSE_FS)		+= fuse/
++obj-$(CONFIG_OVERLAYFS_FS)	+= overlayfs/
+ obj-$(CONFIG_UDF_FS)		+= udf/
+ obj-$(CONFIG_SUN_OPENPROMFS)	+= openpromfs/
+ obj-$(CONFIG_OMFS_FS)		+= omfs/
+--- a/fs/ecryptfs/main.c
++++ b/fs/ecryptfs/main.c
+@@ -544,6 +544,13 @@ static struct dentry *ecryptfs_mount(str
+ 	s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
+ 	s->s_blocksize = path.dentry->d_sb->s_blocksize;
+ 	s->s_magic = ECRYPTFS_SUPER_MAGIC;
++	s->s_stack_depth = path.dentry->d_sb->s_stack_depth + 1;
++
++	rc = -EINVAL;
++	if (s->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
++		printk(KERN_ERR "eCryptfs: maximum fs stacking depth exceeded\n");
++		goto out_free;
++	}
+ 
+ 	inode = ecryptfs_get_inode(path.dentry->d_inode, s);
+ 	rc = PTR_ERR(inode);
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1325,6 +1325,24 @@ void drop_collected_mounts(struct vfsmou
+ 	release_mounts(&umount_list);
+ }
+ 
++struct vfsmount *clone_private_mount(struct path *path)
++{
++	struct mount *old_mnt = real_mount(path->mnt);
++	struct mount *new_mnt;
++
++	if (IS_MNT_UNBINDABLE(old_mnt))
++		return ERR_PTR(-EINVAL);
++
++	down_read(&namespace_sem);
++	new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
++	up_read(&namespace_sem);
++	if (!new_mnt)
++		return ERR_PTR(-ENOMEM);
++
++	return &new_mnt->mnt;
++}
++EXPORT_SYMBOL_GPL(clone_private_mount);
++
+ int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
+ 		   struct vfsmount *root)
+ {
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -644,24 +644,24 @@ static inline int __get_file_write_acces
+ 	return error;
+ }
+ 
+-static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
+-					struct file *f,
+-					int (*open)(struct inode *, struct file *),
+-					const struct cred *cred)
++static struct file *__dentry_open(struct path *path, struct file *f,
++				  int (*open)(struct inode *, struct file *),
++				  const struct cred *cred)
+ {
+ 	static const struct file_operations empty_fops = {};
+ 	struct inode *inode;
+ 	int error;
+ 
++	path_get(path);
+ 	f->f_mode = OPEN_FMODE(f->f_flags) | FMODE_LSEEK |
+ 				FMODE_PREAD | FMODE_PWRITE;
+ 
+ 	if (unlikely(f->f_flags & O_PATH))
+ 		f->f_mode = FMODE_PATH;
+ 
+-	inode = dentry->d_inode;
++	inode = path->dentry->d_inode;
+ 	if (f->f_mode & FMODE_WRITE) {
+-		error = __get_file_write_access(inode, mnt);
++		error = __get_file_write_access(inode, path->mnt);
+ 		if (error)
+ 			goto cleanup_file;
+ 		if (!special_file(inode->i_mode))
+@@ -669,8 +669,7 @@ static struct file *__dentry_open(struct
+ 	}
+ 
+ 	f->f_mapping = inode->i_mapping;
+-	f->f_path.dentry = dentry;
+-	f->f_path.mnt = mnt;
++	f->f_path = *path;
+ 	f->f_pos = 0;
+ 	file_sb_list_add(f, inode->i_sb);
+ 
+@@ -727,7 +726,7 @@ cleanup_all:
+ 			 * here, so just reset the state.
+ 			 */
+ 			file_reset_write(f);
+-			mnt_drop_write(mnt);
++			mnt_drop_write(path->mnt);
+ 		}
+ 	}
+ 	file_sb_list_del(f);
+@@ -735,8 +734,7 @@ cleanup_all:
+ 	f->f_path.mnt = NULL;
+ cleanup_file:
+ 	put_filp(f);
+-	dput(dentry);
+-	mntput(mnt);
++	path_put(path);
+ 	return ERR_PTR(error);
+ }
+ 
+@@ -762,14 +760,14 @@ cleanup_file:
+ struct file *lookup_instantiate_filp(struct nameidata *nd, struct dentry *dentry,
+ 		int (*open)(struct inode *, struct file *))
+ {
++	struct path path = { .dentry = dentry, .mnt = nd->path.mnt };
+ 	const struct cred *cred = current_cred();
+ 
+ 	if (IS_ERR(nd->intent.open.file))
+ 		goto out;
+ 	if (IS_ERR(dentry))
+ 		goto out_err;
+-	nd->intent.open.file = __dentry_open(dget(dentry), mntget(nd->path.mnt),
+-					     nd->intent.open.file,
++	nd->intent.open.file = __dentry_open(&path, nd->intent.open.file,
+ 					     open, cred);
+ out:
+ 	return nd->intent.open.file;
+@@ -797,11 +795,9 @@ struct file *nameidata_to_filp(struct na
+ 	nd->intent.open.file = NULL;
+ 
+ 	/* Has the filesystem initialised the file for us? */
+-	if (filp->f_path.dentry == NULL) {
+-		path_get(&nd->path);
+-		filp = __dentry_open(nd->path.dentry, nd->path.mnt, filp,
+-				     NULL, cred);
+-	}
++	if (filp->f_path.dentry == NULL)
++		filp = vfs_open(&nd->path, filp, cred);
++
+ 	return filp;
+ }
+ 
+@@ -812,27 +808,48 @@ struct file *nameidata_to_filp(struct na
+ struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags,
+ 			 const struct cred *cred)
+ {
+-	int error;
+ 	struct file *f;
++	struct file *ret;
++	struct path path = { .dentry = dentry, .mnt = mnt };
+ 
+ 	validate_creds(cred);
+ 
+ 	/* We must always pass in a valid mount pointer. */
+ 	BUG_ON(!mnt);
+ 
+-	error = -ENFILE;
++	ret = ERR_PTR(-ENFILE);
+ 	f = get_empty_filp();
+-	if (f == NULL) {
+-		dput(dentry);
+-		mntput(mnt);
+-		return ERR_PTR(error);
++	if (f != NULL) {
++		f->f_flags = flags;
++		ret = vfs_open(&path, f, cred);
+ 	}
++	path_put(&path);
+ 
+-	f->f_flags = flags;
+-	return __dentry_open(dentry, mnt, f, NULL, cred);
++	return ret;
+ }
+ EXPORT_SYMBOL(dentry_open);
+ 
++/**
++ * vfs_open - open the file at the given path
++ * @path: path to open
++ * @filp: newly allocated file with f_flag initialized
++ * @cred: credentials to use
++ *
++ * Open the file.  If successful, the returned file will have acquired
++ * an additional reference for path.
++ */
++struct file *vfs_open(struct path *path, struct file *filp,
++		      const struct cred *cred)
++{
++	struct inode *inode = path->dentry->d_inode;
++
++	if (inode->i_op->open)
++		return inode->i_op->open(path->dentry, filp, cred);
++	else
++		return __dentry_open(path, filp, NULL, cred);
++}
++EXPORT_SYMBOL(vfs_open);
++
+ static void __put_unused_fd(struct files_struct *files, unsigned int fd)
+ {
+ 	struct fdtable *fdt = files_fdtable(files);
+--- /dev/null
++++ b/fs/overlayfs/Kconfig
+@@ -0,0 +1,4 @@
++config OVERLAYFS_FS
++	tristate "Overlay filesystem support"
++	help
++	  Add support for overlay filesystem.
+--- /dev/null
++++ b/fs/overlayfs/Makefile
+@@ -0,0 +1,7 @@
++#
++# Makefile for the overlay filesystem.
++#
++
++obj-$(CONFIG_OVERLAYFS_FS) += overlayfs.o
++
++overlayfs-objs := super.o inode.o dir.o readdir.o copy_up.o
+--- /dev/null
++++ b/fs/overlayfs/copy_up.c
+@@ -0,0 +1,384 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/slab.h>
++#include <linux/file.h>
++#include <linux/splice.h>
++#include <linux/xattr.h>
++#include <linux/security.h>
++#include <linux/uaccess.h>
++#include "overlayfs.h"
++
++#define OVL_COPY_UP_CHUNK_SIZE (1 << 20)
++
++static int ovl_copy_up_xattr(struct dentry *old, struct dentry *new)
++{
++	ssize_t list_size, size;
++	char *buf, *name, *value;
++	int error;
++
++	if (!old->d_inode->i_op->getxattr ||
++	    !new->d_inode->i_op->getxattr)
++		return 0;
++
++	list_size = vfs_listxattr(old, NULL, 0);
++	if (list_size <= 0) {
++		if (list_size == -EOPNOTSUPP)
++			return 0;
++		return list_size;
++	}
++
++	buf = kzalloc(list_size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++
++	error = -ENOMEM;
++	value = kmalloc(XATTR_SIZE_MAX, GFP_KERNEL);
++	if (!value)
++		goto out;
++
++	list_size = vfs_listxattr(old, buf, list_size);
++	if (list_size <= 0) {
++		error = list_size;
++		goto out_free_value;
++	}
++
++	for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
++		size = vfs_getxattr(old, name, value, XATTR_SIZE_MAX);
++		if (size <= 0) {
++			error = size;
++			goto out_free_value;
++		}
++		error = vfs_setxattr(new, name, value, size, 0);
++		if (error)
++			goto out_free_value;
++	}
++
++out_free_value:
++	kfree(value);
++out:
++	kfree(buf);
++	return error;
++}
++
++static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len)
++{
++	struct file *old_file;
++	struct file *new_file;
++	int error = 0;
++
++	if (len == 0)
++		return 0;
++
++	old_file = ovl_path_open(old, O_RDONLY);
++	if (IS_ERR(old_file))
++		return PTR_ERR(old_file);
++
++	new_file = ovl_path_open(new, O_WRONLY);
++	if (IS_ERR(new_file)) {
++		error = PTR_ERR(new_file);
++		goto out_fput;
++	}
++
++	/* FIXME: copy up sparse files efficiently */
++	while (len) {
++		loff_t offset = new_file->f_pos;
++		size_t this_len = OVL_COPY_UP_CHUNK_SIZE;
++		long bytes;
++
++		if (len < this_len)
++			this_len = len;
++
++		if (signal_pending_state(TASK_KILLABLE, current)) {
++			error = -EINTR;
++			break;
++		}
++
++		bytes = do_splice_direct(old_file, &offset, new_file, this_len,
++				 SPLICE_F_MOVE);
++		if (bytes <= 0) {
++			error = bytes;
++			break;
++		}
++
++		len -= bytes;
++	}
++
++	fput(new_file);
++out_fput:
++	fput(old_file);
++	return error;
++}
++
++static char *ovl_read_symlink(struct dentry *realdentry)
++{
++	int res;
++	char *buf;
++	struct inode *inode = realdentry->d_inode;
++	mm_segment_t old_fs;
++
++	res = -EINVAL;
++	if (!inode->i_op->readlink)
++		goto err;
++
++	res = -ENOMEM;
++	buf = (char *) __get_free_page(GFP_KERNEL);
++	if (!buf)
++		goto err;
++
++	old_fs = get_fs();
++	set_fs(get_ds());
++	/* The cast to a user pointer is valid due to the set_fs() */
++	res = inode->i_op->readlink(realdentry,
++				    (char __user *)buf, PAGE_SIZE - 1);
++	set_fs(old_fs);
++	if (res < 0) {
++		free_page((unsigned long) buf);
++		goto err;
++	}
++	buf[res] = '\0';
++
++	return buf;
++
++err:
++	return ERR_PTR(res);
++}
++
++static int ovl_set_timestamps(struct dentry *upperdentry, struct kstat *stat)
++{
++	struct iattr attr = {
++		.ia_valid =
++		     ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET,
++		.ia_atime = stat->atime,
++		.ia_mtime = stat->mtime,
++	};
++
++	return notify_change(upperdentry, &attr);
++}
++
++static int ovl_set_mode(struct dentry *upperdentry, umode_t mode)
++{
++	struct iattr attr = {
++		.ia_valid = ATTR_MODE,
++		.ia_mode = mode,
++	};
++
++	return notify_change(upperdentry, &attr);
++}
++
++static int ovl_copy_up_locked(struct dentry *upperdir, struct dentry *dentry,
++			      struct path *lowerpath, struct kstat *stat,
++			      const char *link)
++{
++	int err;
++	struct path newpath;
++	umode_t mode = stat->mode;
++
++	/* Can't properly set mode on creation because of the umask */
++	stat->mode &= S_IFMT;
++
++	ovl_path_upper(dentry, &newpath);
++	WARN_ON(newpath.dentry);
++	newpath.dentry = ovl_upper_create(upperdir, dentry, stat, link);
++	if (IS_ERR(newpath.dentry))
++		return PTR_ERR(newpath.dentry);
++
++	if (S_ISREG(stat->mode)) {
++		err = ovl_copy_up_data(lowerpath, &newpath, stat->size);
++		if (err)
++			goto err_remove;
++	}
++
++	err = ovl_copy_up_xattr(lowerpath->dentry, newpath.dentry);
++	if (err)
++		goto err_remove;
++
++	mutex_lock(&newpath.dentry->d_inode->i_mutex);
++	if (!S_ISLNK(stat->mode))
++		err = ovl_set_mode(newpath.dentry, mode);
++	if (!err)
++		err = ovl_set_timestamps(newpath.dentry, stat);
++	mutex_unlock(&newpath.dentry->d_inode->i_mutex);
++	if (err)
++		goto err_remove;
++
++	ovl_dentry_update(dentry, newpath.dentry);
++
++	/*
++	 * Easiest way to get rid of the lower dentry reference is to
++	 * drop this dentry.  This is neither needed nor possible for
++	 * directories.
++	 */
++	if (!S_ISDIR(stat->mode))
++		d_drop(dentry);
++
++	return 0;
++
++err_remove:
++	if (S_ISDIR(stat->mode))
++		vfs_rmdir(upperdir->d_inode, newpath.dentry);
++	else
++		vfs_unlink(upperdir->d_inode, newpath.dentry);
++
++	dput(newpath.dentry);
++
++	return err;
++}
++
++/*
++ * Copy up a single dentry
++ *
++ * Directory renames only allowed on "pure upper" (already created on
++ * upper filesystem, never copied up).  Directories which are on lower or
++ * are merged may not be renamed.  For these -EXDEV is returned and
++ * userspace has to deal with it.  This means, when copying up a
++ * directory we can rely on it and ancestors being stable.
++ *
++ * Non-directory renames start with copy up of source if necessary.  The
++ * actual rename will only proceed once the copy up was successful.  Copy
++ * up uses upper parent i_mutex for exclusion.  Since rename can change
++ * d_parent it is possible that the copy up will lock the old parent.  At
++ * that point the file will have already been copied up anyway.
++ */
++static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
++			   struct path *lowerpath, struct kstat *stat)
++{
++	int err;
++	struct kstat pstat;
++	struct path parentpath;
++	struct dentry *upperdir;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++	char *link = NULL;
++
++	ovl_path_upper(parent, &parentpath);
++	upperdir = parentpath.dentry;
++
++	err = vfs_getattr(parentpath.mnt, parentpath.dentry, &pstat);
++	if (err)
++		return err;
++
++	if (S_ISLNK(stat->mode)) {
++		link = ovl_read_symlink(lowerpath->dentry);
++		if (IS_ERR(link))
++			return PTR_ERR(link);
++	}
++
++	err = -ENOMEM;
++	override_cred = prepare_creds();
++	if (!override_cred)
++		goto out_free_link;
++
++	override_cred->fsuid = stat->uid;
++	override_cred->fsgid = stat->gid;
++	/*
++	 * CAP_SYS_ADMIN for copying up extended attributes
++	 * CAP_DAC_OVERRIDE for create
++	 * CAP_FOWNER for chmod, timestamp update
++	 * CAP_FSETID for chmod
++	 * CAP_MKNOD for mknod
++	 */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
++	cap_raise(override_cred->cap_effective, CAP_FOWNER);
++	cap_raise(override_cred->cap_effective, CAP_FSETID);
++	cap_raise(override_cred->cap_effective, CAP_MKNOD);
++	old_cred = override_creds(override_cred);
++
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++	if (ovl_path_type(dentry) != OVL_PATH_LOWER) {
++		err = 0;
++	} else {
++		err = ovl_copy_up_locked(upperdir, dentry, lowerpath,
++					 stat, link);
++		if (!err) {
++			/* Restore timestamps on parent (best effort) */
++			ovl_set_timestamps(upperdir, &pstat);
++		}
++	}
++
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++out_free_link:
++	if (link)
++		free_page((unsigned long) link);
++
++	return err;
++}
++
++int ovl_copy_up(struct dentry *dentry)
++{
++	int err;
++
++	err = 0;
++	while (!err) {
++		struct dentry *next;
++		struct dentry *parent;
++		struct path lowerpath;
++		struct kstat stat;
++		enum ovl_path_type type = ovl_path_type(dentry);
++
++		if (type != OVL_PATH_LOWER)
++			break;
++
++		next = dget(dentry);
++		/* find the topmost dentry not yet copied up */
++		for (;;) {
++			parent = dget_parent(next);
++
++			type = ovl_path_type(parent);
++			if (type != OVL_PATH_LOWER)
++				break;
++
++			dput(next);
++			next = parent;
++		}
++
++		ovl_path_lower(next, &lowerpath);
++		err = vfs_getattr(lowerpath.mnt, lowerpath.dentry, &stat);
++		if (!err)
++			err = ovl_copy_up_one(parent, next, &lowerpath, &stat);
++
++		dput(parent);
++		dput(next);
++	}
++
++	return err;
++}
++
++/* Optimize by not copying up the file first and truncating later */
++int ovl_copy_up_truncate(struct dentry *dentry, loff_t size)
++{
++	int err;
++	struct kstat stat;
++	struct path lowerpath;
++	struct dentry *parent = dget_parent(dentry);
++
++	err = ovl_copy_up(parent);
++	if (err)
++		goto out_dput_parent;
++
++	ovl_path_lower(dentry, &lowerpath);
++	err = vfs_getattr(lowerpath.mnt, lowerpath.dentry, &stat);
++	if (err)
++		goto out_dput_parent;
++
++	if (size < stat.size)
++		stat.size = size;
++
++	err = ovl_copy_up_one(parent, dentry, &lowerpath, &stat);
++
++out_dput_parent:
++	dput(parent);
++	return err;
++}
+--- /dev/null
++++ b/fs/overlayfs/dir.c
+@@ -0,0 +1,596 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/namei.h>
++#include <linux/xattr.h>
++#include <linux/security.h>
++#include "overlayfs.h"
++
++static const char *ovl_whiteout_symlink = "(overlay-whiteout)";
++
++static int ovl_whiteout(struct dentry *upperdir, struct dentry *dentry)
++{
++	int err;
++	struct dentry *newdentry;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++
++	/* FIXME: recheck lower dentry to see if whiteout is really needed */
++
++	err = -ENOMEM;
++	override_cred = prepare_creds();
++	if (!override_cred)
++		goto out;
++
++	/*
++	 * CAP_SYS_ADMIN for setxattr
++	 * CAP_DAC_OVERRIDE for symlink creation
++	 * CAP_FOWNER for unlink in sticky directory
++	 */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
++	cap_raise(override_cred->cap_effective, CAP_FOWNER);
++	override_cred->fsuid = 0;
++	override_cred->fsgid = 0;
++	old_cred = override_creds(override_cred);
++
++	newdentry = lookup_one_len(dentry->d_name.name, upperdir,
++				   dentry->d_name.len);
++	err = PTR_ERR(newdentry);
++	if (IS_ERR(newdentry))
++		goto out_put_cred;
++
++	/* Just been removed within the same locked region */
++	WARN_ON(newdentry->d_inode);
++
++	err = vfs_symlink(upperdir->d_inode, newdentry, ovl_whiteout_symlink);
++	if (err)
++		goto out_dput;
++
++	ovl_dentry_version_inc(dentry->d_parent);
++
++	err = vfs_setxattr(newdentry, ovl_whiteout_xattr, "y", 1, 0);
++	if (err)
++		vfs_unlink(upperdir->d_inode, newdentry);
++
++out_dput:
++	dput(newdentry);
++out_put_cred:
++	revert_creds(old_cred);
++	put_cred(override_cred);
++out:
++	if (err) {
++		/*
++		 * There's no way to recover from failure to whiteout.
++		 * What should we do?  Log a big fat error and... ?
++		 */
++		printk(KERN_ERR "overlayfs: ERROR - failed to whiteout '%s'\n",
++		       dentry->d_name.name);
++	}
++
++	return err;
++}
++
++static struct dentry *ovl_lookup_create(struct dentry *upperdir,
++					struct dentry *template)
++{
++	int err;
++	struct dentry *newdentry;
++	struct qstr *name = &template->d_name;
++
++	newdentry = lookup_one_len(name->name, upperdir, name->len);
++	if (IS_ERR(newdentry))
++		return newdentry;
++
++	if (newdentry->d_inode) {
++		const struct cred *old_cred;
++		struct cred *override_cred;
++
++		/* No need to check whiteout if lower parent is non-existent */
++		err = -EEXIST;
++		if (!ovl_dentry_lower(template->d_parent))
++			goto out_dput;
++
++		if (!S_ISLNK(newdentry->d_inode->i_mode))
++			goto out_dput;
++
++		err = -ENOMEM;
++		override_cred = prepare_creds();
++		if (!override_cred)
++			goto out_dput;
++
++		/*
++		 * CAP_SYS_ADMIN for getxattr
++		 * CAP_FOWNER for unlink in sticky directory
++		 */
++		cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++		cap_raise(override_cred->cap_effective, CAP_FOWNER);
++		old_cred = override_creds(override_cred);
++
++		err = -EEXIST;
++		if (ovl_is_whiteout(newdentry))
++			err = vfs_unlink(upperdir->d_inode, newdentry);
++
++		revert_creds(old_cred);
++		put_cred(override_cred);
++		if (err)
++			goto out_dput;
++
++		dput(newdentry);
++		newdentry = lookup_one_len(name->name, upperdir, name->len);
++		if (IS_ERR(newdentry)) {
++			ovl_whiteout(upperdir, template);
++			return newdentry;
++		}
++
++		/*
++		 * Whiteout just been successfully removed, parent
++		 * i_mutex is still held, there's no way the lookup
++		 * could return positive.
++		 */
++		WARN_ON(newdentry->d_inode);
++	}
++
++	return newdentry;
++
++out_dput:
++	dput(newdentry);
++	return ERR_PTR(err);
++}
++
++struct dentry *ovl_upper_create(struct dentry *upperdir, struct dentry *dentry,
++				struct kstat *stat, const char *link)
++{
++	int err;
++	struct dentry *newdentry;
++	struct inode *dir = upperdir->d_inode;
++
++	newdentry = ovl_lookup_create(upperdir, dentry);
++	if (IS_ERR(newdentry))
++		goto out;
++
++	switch (stat->mode & S_IFMT) {
++	case S_IFREG:
++		err = vfs_create(dir, newdentry, stat->mode, NULL);
++		break;
++
++	case S_IFDIR:
++		err = vfs_mkdir(dir, newdentry, stat->mode);
++		break;
++
++	case S_IFCHR:
++	case S_IFBLK:
++	case S_IFIFO:
++	case S_IFSOCK:
++		err = vfs_mknod(dir, newdentry, stat->mode, stat->rdev);
++		break;
++
++	case S_IFLNK:
++		err = vfs_symlink(dir, newdentry, link);
++		break;
++
++	default:
++		err = -EPERM;
++	}
++	if (err) {
++		if (ovl_dentry_is_opaque(dentry))
++			ovl_whiteout(upperdir, dentry);
++		dput(newdentry);
++		newdentry = ERR_PTR(err);
++	} else if (WARN_ON(!newdentry->d_inode)) {
++		/*
++		 * Not quite sure if non-instantiated dentry is legal or not.
++		 * VFS doesn't seem to care so check and warn here.
++		 */
++		dput(newdentry);
++		newdentry = ERR_PTR(-ENOENT);
++	}
++
++out:
++	return newdentry;
++
++}
++
++static int ovl_set_opaque(struct dentry *upperdentry)
++{
++	int err;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++
++	override_cred = prepare_creds();
++	if (!override_cred)
++		return -ENOMEM;
++
++	/* CAP_SYS_ADMIN for setxattr of "trusted" namespace */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	old_cred = override_creds(override_cred);
++	err = vfs_setxattr(upperdentry, ovl_opaque_xattr, "y", 1, 0);
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++	return err;
++}
++
++static int ovl_remove_opaque(struct dentry *upperdentry)
++{
++	int err;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++
++	override_cred = prepare_creds();
++	if (!override_cred)
++		return -ENOMEM;
++
++	/* CAP_SYS_ADMIN for removexattr of "trusted" namespace */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	old_cred = override_creds(override_cred);
++	err = vfs_removexattr(upperdentry, ovl_opaque_xattr);
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++	return err;
++}
++
++static int ovl_dir_getattr(struct vfsmount *mnt, struct dentry *dentry,
++			 struct kstat *stat)
++{
++	int err;
++	enum ovl_path_type type;
++	struct path realpath;
++
++	type = ovl_path_real(dentry, &realpath);
++	err = vfs_getattr(realpath.mnt, realpath.dentry, stat);
++	if (err)
++		return err;
++
++	stat->dev = dentry->d_sb->s_dev;
++	stat->ino = dentry->d_inode->i_ino;
++
++	/*
++	 * It's probably not worth it to count subdirs to get the
++	 * correct link count.  nlink=1 seems to pacify 'find' and
++	 * other utilities.
++	 */
++	if (type == OVL_PATH_MERGE)
++		stat->nlink = 1;
++
++	return 0;
++}
++
++static int ovl_create_object(struct dentry *dentry, int mode, dev_t rdev,
++			     const char *link)
++{
++	int err;
++	struct dentry *newdentry;
++	struct dentry *upperdir;
++	struct inode *inode;
++	struct kstat stat = {
++		.mode = mode,
++		.rdev = rdev,
++	};
++
++	err = -ENOMEM;
++	inode = ovl_new_inode(dentry->d_sb, mode, dentry->d_fsdata);
++	if (!inode)
++		goto out;
++
++	err = ovl_copy_up(dentry->d_parent);
++	if (err)
++		goto out_iput;
++
++	upperdir = ovl_dentry_upper(dentry->d_parent);
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++
++	newdentry = ovl_upper_create(upperdir, dentry, &stat, link);
++	err = PTR_ERR(newdentry);
++	if (IS_ERR(newdentry))
++		goto out_unlock;
++
++	ovl_dentry_version_inc(dentry->d_parent);
++	if (ovl_dentry_is_opaque(dentry) && S_ISDIR(mode)) {
++		err = ovl_set_opaque(newdentry);
++		if (err) {
++			vfs_rmdir(upperdir->d_inode, newdentry);
++			ovl_whiteout(upperdir, dentry);
++			goto out_dput;
++		}
++	}
++	ovl_dentry_update(dentry, newdentry);
++	d_instantiate(dentry, inode);
++	inode = NULL;
++	newdentry = NULL;
++	err = 0;
++
++out_dput:
++	dput(newdentry);
++out_unlock:
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++out_iput:
++	iput(inode);
++out:
++	return err;
++}
++
++static int ovl_create(struct inode *dir, struct dentry *dentry, umode_t mode,
++			struct nameidata *nd)
++{
++	return ovl_create_object(dentry, (mode & 07777) | S_IFREG, 0, NULL);
++}
++
++static int ovl_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
++{
++	return ovl_create_object(dentry, (mode & 07777) | S_IFDIR, 0, NULL);
++}
++
++static int ovl_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
++		     dev_t rdev)
++{
++	return ovl_create_object(dentry, mode, rdev, NULL);
++}
++
++static int ovl_symlink(struct inode *dir, struct dentry *dentry,
++			 const char *link)
++{
++	return ovl_create_object(dentry, S_IFLNK, 0, link);
++}
++
++static int ovl_do_remove(struct dentry *dentry, bool is_dir)
++{
++	int err;
++	enum ovl_path_type type;
++	struct path realpath;
++	struct dentry *upperdir;
++
++	err = ovl_copy_up(dentry->d_parent);
++	if (err)
++		return err;
++
++	upperdir = ovl_dentry_upper(dentry->d_parent);
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++	type = ovl_path_real(dentry, &realpath);
++	if (type != OVL_PATH_LOWER) {
++		err = -ESTALE;
++		if (realpath.dentry->d_parent != upperdir)
++			goto out_d_drop;
++
++		/* FIXME: create whiteout up front and rename to target */
++
++		if (is_dir)
++			err = vfs_rmdir(upperdir->d_inode, realpath.dentry);
++		else
++			err = vfs_unlink(upperdir->d_inode, realpath.dentry);
++		if (err)
++			goto out_d_drop;
++
++		ovl_dentry_version_inc(dentry->d_parent);
++	}
++
++	if (type != OVL_PATH_UPPER || ovl_dentry_is_opaque(dentry))
++		err = ovl_whiteout(upperdir, dentry);
++
++	/*
++	 * Keeping this dentry hashed would mean having to release
++	 * upperpath/lowerpath, which could only be done if we are the
++	 * sole user of this dentry.  Too tricky...  Just unhash for
++	 * now.
++	 */
++out_d_drop:
++	d_drop(dentry);
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++
++	return err;
++}
++
++static int ovl_unlink(struct inode *dir, struct dentry *dentry)
++{
++	return ovl_do_remove(dentry, false);
++}
++
++
++static int ovl_rmdir(struct inode *dir, struct dentry *dentry)
++{
++	int err;
++	enum ovl_path_type type;
++
++	type = ovl_path_type(dentry);
++	if (type != OVL_PATH_UPPER) {
++		err = ovl_check_empty_and_clear(dentry, type);
++		if (err)
++			return err;
++	}
++
++	return ovl_do_remove(dentry, true);
++}
++
++static int ovl_link(struct dentry *old, struct inode *newdir,
++		    struct dentry *new)
++{
++	int err;
++	struct dentry *olddentry;
++	struct dentry *newdentry;
++	struct dentry *upperdir;
++
++	err = ovl_copy_up(old);
++	if (err)
++		goto out;
++
++	err = ovl_copy_up(new->d_parent);
++	if (err)
++		goto out;
++
++	upperdir = ovl_dentry_upper(new->d_parent);
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++	newdentry = ovl_lookup_create(upperdir, new);
++	err = PTR_ERR(newdentry);
++	if (IS_ERR(newdentry))
++		goto out_unlock;
++
++	olddentry = ovl_dentry_upper(old);
++	err = vfs_link(olddentry, upperdir->d_inode, newdentry);
++	if (!err) {
++		if (WARN_ON(!newdentry->d_inode)) {
++			dput(newdentry);
++			err = -ENOENT;
++			goto out_unlock;
++		}
++
++		ovl_dentry_version_inc(new->d_parent);
++		ovl_dentry_update(new, newdentry);
++
++		ihold(old->d_inode);
++		d_instantiate(new, old->d_inode);
++	} else {
++		if (ovl_dentry_is_opaque(new))
++			ovl_whiteout(upperdir, new);
++		dput(newdentry);
++	}
++out_unlock:
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++out:
++	return err;
++
++}
++
++static int ovl_rename(struct inode *olddir, struct dentry *old,
++			struct inode *newdir, struct dentry *new)
++{
++	int err;
++	enum ovl_path_type old_type;
++	enum ovl_path_type new_type;
++	struct dentry *old_upperdir;
++	struct dentry *new_upperdir;
++	struct dentry *olddentry;
++	struct dentry *newdentry;
++	struct dentry *trap;
++	bool old_opaque;
++	bool new_opaque;
++	bool new_create = false;
++	bool is_dir = S_ISDIR(old->d_inode->i_mode);
++
++	/* Don't copy up directory trees */
++	old_type = ovl_path_type(old);
++	if (old_type != OVL_PATH_UPPER && is_dir)
++		return -EXDEV;
++
++	if (new->d_inode) {
++		new_type = ovl_path_type(new);
++
++		if (new_type == OVL_PATH_LOWER && old_type == OVL_PATH_LOWER) {
++			if (ovl_dentry_lower(old)->d_inode ==
++			    ovl_dentry_lower(new)->d_inode)
++				return 0;
++		}
++		if (new_type != OVL_PATH_LOWER && old_type != OVL_PATH_LOWER) {
++			if (ovl_dentry_upper(old)->d_inode ==
++			    ovl_dentry_upper(new)->d_inode)
++				return 0;
++		}
++
++		if (new_type != OVL_PATH_UPPER &&
++		    S_ISDIR(new->d_inode->i_mode)) {
++			err = ovl_check_empty_and_clear(new, new_type);
++			if (err)
++				return err;
++		}
++	} else {
++		new_type = OVL_PATH_UPPER;
++	}
++
++	err = ovl_copy_up(old);
++	if (err)
++		return err;
++
++	err = ovl_copy_up(new->d_parent);
++	if (err)
++		return err;
++
++	old_upperdir = ovl_dentry_upper(old->d_parent);
++	new_upperdir = ovl_dentry_upper(new->d_parent);
++
++	trap = lock_rename(new_upperdir, old_upperdir);
++
++	olddentry = ovl_dentry_upper(old);
++	newdentry = ovl_dentry_upper(new);
++	if (newdentry) {
++		dget(newdentry);
++	} else {
++		new_create = true;
++		newdentry = ovl_lookup_create(new_upperdir, new);
++		err = PTR_ERR(newdentry);
++		if (IS_ERR(newdentry))
++			goto out_unlock;
++	}
++
++	err = -ESTALE;
++	if (olddentry->d_parent != old_upperdir)
++		goto out_dput;
++	if (newdentry->d_parent != new_upperdir)
++		goto out_dput;
++	if (olddentry == trap)
++		goto out_dput;
++	if (newdentry == trap)
++		goto out_dput;
++
++	old_opaque = ovl_dentry_is_opaque(old);
++	new_opaque = ovl_dentry_is_opaque(new) || new_type != OVL_PATH_UPPER;
++
++	if (is_dir && !old_opaque && new_opaque) {
++		err = ovl_set_opaque(olddentry);
++		if (err)
++			goto out_dput;
++	}
++
++	err = vfs_rename(old_upperdir->d_inode, olddentry,
++			 new_upperdir->d_inode, newdentry);
++
++	if (err) {
++		if (new_create && ovl_dentry_is_opaque(new))
++			ovl_whiteout(new_upperdir, new);
++		if (is_dir && !old_opaque && new_opaque)
++			ovl_remove_opaque(olddentry);
++		goto out_dput;
++	}
++
++	if (old_type != OVL_PATH_UPPER || old_opaque)
++		err = ovl_whiteout(old_upperdir, old);
++	if (is_dir && old_opaque && !new_opaque)
++		ovl_remove_opaque(olddentry);
++
++	if (old_opaque != new_opaque)
++		ovl_dentry_set_opaque(old, new_opaque);
++
++	ovl_dentry_version_inc(old->d_parent);
++	ovl_dentry_version_inc(new->d_parent);
++
++out_dput:
++	dput(newdentry);
++out_unlock:
++	unlock_rename(new_upperdir, old_upperdir);
++	return err;
++}
++
++const struct inode_operations ovl_dir_inode_operations = {
++	.lookup		= ovl_lookup,
++	.mkdir		= ovl_mkdir,
++	.symlink	= ovl_symlink,
++	.unlink		= ovl_unlink,
++	.rmdir		= ovl_rmdir,
++	.rename		= ovl_rename,
++	.link		= ovl_link,
++	.setattr	= ovl_setattr,
++	.create		= ovl_create,
++	.mknod		= ovl_mknod,
++	.permission	= ovl_permission,
++	.getattr	= ovl_dir_getattr,
++	.setxattr	= ovl_setxattr,
++	.getxattr	= ovl_getxattr,
++	.listxattr	= ovl_listxattr,
++	.removexattr	= ovl_removexattr,
++};
+--- /dev/null
++++ b/fs/overlayfs/inode.c
+@@ -0,0 +1,384 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/slab.h>
++#include <linux/xattr.h>
++#include "overlayfs.h"
++
++int ovl_setattr(struct dentry *dentry, struct iattr *attr)
++{
++	struct dentry *upperdentry;
++	int err;
++
++	if ((attr->ia_valid & ATTR_SIZE) && !ovl_dentry_upper(dentry))
++		err = ovl_copy_up_truncate(dentry, attr->ia_size);
++	else
++		err = ovl_copy_up(dentry);
++	if (err)
++		return err;
++
++	upperdentry = ovl_dentry_upper(dentry);
++
++	if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
++		attr->ia_valid &= ~ATTR_MODE;
++
++	mutex_lock(&upperdentry->d_inode->i_mutex);
++	err = notify_change(upperdentry, attr);
++	mutex_unlock(&upperdentry->d_inode->i_mutex);
++
++	return err;
++}
++
++static int ovl_getattr(struct vfsmount *mnt, struct dentry *dentry,
++			 struct kstat *stat)
++{
++	struct path realpath;
++
++	ovl_path_real(dentry, &realpath);
++	return vfs_getattr(realpath.mnt, realpath.dentry, stat);
++}
++
++int ovl_permission(struct inode *inode, int mask)
++{
++	struct ovl_entry *oe;
++	struct dentry *alias = NULL;
++	struct inode *realinode;
++	struct dentry *realdentry;
++	bool is_upper;
++	int err;
++
++	if (S_ISDIR(inode->i_mode)) {
++		oe = inode->i_private;
++	} else if (mask & MAY_NOT_BLOCK) {
++		return -ECHILD;
++	} else {
++		/*
++		 * For non-directories find an alias and get the info
++		 * from there.
++		 */
++		spin_lock(&inode->i_lock);
++		if (WARN_ON(list_empty(&inode->i_dentry))) {
++			spin_unlock(&inode->i_lock);
++			return -ENOENT;
++		}
++		alias = list_entry(inode->i_dentry.next,
++				   struct dentry, d_alias);
++		dget(alias);
++		spin_unlock(&inode->i_lock);
++		oe = alias->d_fsdata;
++	}
++
++	realdentry = ovl_entry_real(oe, &is_upper);
++
++	/* Careful in RCU walk mode */
++	realinode = ACCESS_ONCE(realdentry->d_inode);
++	if (!realinode) {
++		WARN_ON(!(mask & MAY_NOT_BLOCK));
++		err = -ENOENT;
++		goto out_dput;
++	}
++
++	if (mask & MAY_WRITE) {
++		umode_t mode = realinode->i_mode;
++
++		/*
++		 * Writes will always be redirected to upper layer, so
++		 * ignore lower layer being read-only.
++		 *
++		 * If the overlay itself is read-only then proceed
++		 * with the permission check, don't return EROFS.
++		 * This will only happen if this is the lower layer of
++		 * another overlayfs.
++		 *
++		 * If upper fs becomes read-only after the overlay was
++		 * constructed return EROFS to prevent modification of
++		 * upper layer.
++		 */
++		err = -EROFS;
++		if (is_upper && !IS_RDONLY(inode) && IS_RDONLY(realinode) &&
++		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
++			goto out_dput;
++
++		/*
++		 * Nobody gets write access to an immutable file.
++		 */
++		err = -EACCES;
++		if (IS_IMMUTABLE(realinode))
++			goto out_dput;
++	}
++
++	if (realinode->i_op->permission)
++		err = realinode->i_op->permission(realinode, mask);
++	else
++		err = generic_permission(realinode, mask);
++out_dput:
++	dput(alias);
++	return err;
++}
++
++
++struct ovl_link_data {
++	struct dentry *realdentry;
++	void *cookie;
++};
++
++static void *ovl_follow_link(struct dentry *dentry, struct nameidata *nd)
++{
++	void *ret;
++	struct dentry *realdentry;
++	struct inode *realinode;
++
++	realdentry = ovl_dentry_real(dentry);
++	realinode = realdentry->d_inode;
++
++	if (WARN_ON(!realinode->i_op->follow_link))
++		return ERR_PTR(-EPERM);
++
++	ret = realinode->i_op->follow_link(realdentry, nd);
++	if (IS_ERR(ret))
++		return ret;
++
++	if (realinode->i_op->put_link) {
++		struct ovl_link_data *data;
++
++		data = kmalloc(sizeof(struct ovl_link_data), GFP_KERNEL);
++		if (!data) {
++			realinode->i_op->put_link(realdentry, nd, ret);
++			return ERR_PTR(-ENOMEM);
++		}
++		data->realdentry = realdentry;
++		data->cookie = ret;
++
++		return data;
++	} else {
++		return NULL;
++	}
++}
++
++static void ovl_put_link(struct dentry *dentry, struct nameidata *nd, void *c)
++{
++	struct inode *realinode;
++	struct ovl_link_data *data = c;
++
++	if (!data)
++		return;
++
++	realinode = data->realdentry->d_inode;
++	realinode->i_op->put_link(data->realdentry, nd, data->cookie);
++	kfree(data);
++}
++
++static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
++{
++	struct path realpath;
++	struct inode *realinode;
++
++	ovl_path_real(dentry, &realpath);
++	realinode = realpath.dentry->d_inode;
++
++	if (!realinode->i_op->readlink)
++		return -EINVAL;
++
++	touch_atime(realpath.mnt, realpath.dentry);
++
++	return realinode->i_op->readlink(realpath.dentry, buf, bufsiz);
++}
++
++
++static bool ovl_is_private_xattr(const char *name)
++{
++	return strncmp(name, "trusted.overlay.", 14) == 0;
++}
++
++int ovl_setxattr(struct dentry *dentry, const char *name,
++		 const void *value, size_t size, int flags)
++{
++	int err;
++	struct dentry *upperdentry;
++
++	if (ovl_is_private_xattr(name))
++		return -EPERM;
++
++	err = ovl_copy_up(dentry);
++	if (err)
++		return err;
++
++	upperdentry = ovl_dentry_upper(dentry);
++	return  vfs_setxattr(upperdentry, name, value, size, flags);
++}
++
++ssize_t ovl_getxattr(struct dentry *dentry, const char *name,
++		     void *value, size_t size)
++{
++	if (ovl_path_type(dentry->d_parent) == OVL_PATH_MERGE &&
++	    ovl_is_private_xattr(name))
++		return -ENODATA;
++
++	return vfs_getxattr(ovl_dentry_real(dentry), name, value, size);
++}
++
++ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
++{
++	ssize_t res;
++	int off;
++
++	res = vfs_listxattr(ovl_dentry_real(dentry), list, size);
++	if (res <= 0 || size == 0)
++		return res;
++
++	if (ovl_path_type(dentry->d_parent) != OVL_PATH_MERGE)
++		return res;
++
++	/* filter out private xattrs */
++	for (off = 0; off < res;) {
++		char *s = list + off;
++		size_t slen = strlen(s) + 1;
++
++		BUG_ON(off + slen > res);
++
++		if (ovl_is_private_xattr(s)) {
++			res -= slen;
++			memmove(s, s + slen, res - off);
++		} else {
++			off += slen;
++		}
++	}
++
++	return res;
++}
++
++int ovl_removexattr(struct dentry *dentry, const char *name)
++{
++	int err;
++	struct path realpath;
++	enum ovl_path_type type;
++
++	if (ovl_path_type(dentry->d_parent) == OVL_PATH_MERGE &&
++	    ovl_is_private_xattr(name))
++		return -ENODATA;
++
++	type = ovl_path_real(dentry, &realpath);
++	if (type == OVL_PATH_LOWER) {
++		err = vfs_getxattr(realpath.dentry, name, NULL, 0);
++		if (err < 0)
++			return err;
++
++		err = ovl_copy_up(dentry);
++		if (err)
++			return err;
++
++		ovl_path_upper(dentry, &realpath);
++	}
++
++	return vfs_removexattr(realpath.dentry, name);
++}
++
++static bool ovl_open_need_copy_up(int flags, enum ovl_path_type type,
++				  struct dentry *realdentry)
++{
++	if (type != OVL_PATH_LOWER)
++		return false;
++
++	if (special_file(realdentry->d_inode->i_mode))
++		return false;
++
++	if (!(OPEN_FMODE(flags) & FMODE_WRITE) && !(flags & O_TRUNC))
++		return false;
++
++	return true;
++}
++
++static struct file *ovl_open(struct dentry *dentry, struct file *file,
++			     const struct cred *cred)
++{
++	int err;
++	struct path realpath;
++	enum ovl_path_type type;
++
++	type = ovl_path_real(dentry, &realpath);
++	if (ovl_open_need_copy_up(file->f_flags, type, realpath.dentry)) {
++		if (file->f_flags & O_TRUNC)
++			err = ovl_copy_up_truncate(dentry, 0);
++		else
++			err = ovl_copy_up(dentry);
++		if (err)
++			return ERR_PTR(err);
++
++		ovl_path_upper(dentry, &realpath);
++	}
++
++	return vfs_open(&realpath, file, cred);
++}
++
++static const struct inode_operations ovl_file_inode_operations = {
++	.setattr	= ovl_setattr,
++	.permission	= ovl_permission,
++	.getattr	= ovl_getattr,
++	.setxattr	= ovl_setxattr,
++	.getxattr	= ovl_getxattr,
++	.listxattr	= ovl_listxattr,
++	.removexattr	= ovl_removexattr,
++	.open		= ovl_open,
++};
++
++static const struct inode_operations ovl_symlink_inode_operations = {
++	.setattr	= ovl_setattr,
++	.follow_link	= ovl_follow_link,
++	.put_link	= ovl_put_link,
++	.readlink	= ovl_readlink,
++	.getattr	= ovl_getattr,
++	.setxattr	= ovl_setxattr,
++	.getxattr	= ovl_getxattr,
++	.listxattr	= ovl_listxattr,
++	.removexattr	= ovl_removexattr,
++};
++
++struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
++			    struct ovl_entry *oe)
++{
++	struct inode *inode;
++
++	inode = new_inode(sb);
++	if (!inode)
++		return NULL;
++
++	mode &= S_IFMT;
++
++	inode->i_ino = get_next_ino();
++	inode->i_mode = mode;
++	inode->i_flags |= S_NOATIME | S_NOCMTIME;
++
++	switch (mode) {
++	case S_IFDIR:
++		inode->i_private = oe;
++		inode->i_op = &ovl_dir_inode_operations;
++		inode->i_fop = &ovl_dir_operations;
++		break;
++
++	case S_IFLNK:
++		inode->i_op = &ovl_symlink_inode_operations;
++		break;
++
++	case S_IFREG:
++	case S_IFSOCK:
++	case S_IFBLK:
++	case S_IFCHR:
++	case S_IFIFO:
++		inode->i_op = &ovl_file_inode_operations;
++		break;
++
++	default:
++		WARN(1, "illegal file type: %i\n", mode);
++		inode = NULL;
++	}
++
++	return inode;
++
++}
+--- /dev/null
++++ b/fs/overlayfs/overlayfs.h
+@@ -0,0 +1,64 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++struct ovl_entry;
++
++enum ovl_path_type {
++	OVL_PATH_UPPER,
++	OVL_PATH_MERGE,
++	OVL_PATH_LOWER,
++};
++
++extern const char *ovl_opaque_xattr;
++extern const char *ovl_whiteout_xattr;
++extern const struct dentry_operations ovl_dentry_operations;
++
++enum ovl_path_type ovl_path_type(struct dentry *dentry);
++u64 ovl_dentry_version_get(struct dentry *dentry);
++void ovl_dentry_version_inc(struct dentry *dentry);
++void ovl_path_upper(struct dentry *dentry, struct path *path);
++void ovl_path_lower(struct dentry *dentry, struct path *path);
++enum ovl_path_type ovl_path_real(struct dentry *dentry, struct path *path);
++struct dentry *ovl_dentry_upper(struct dentry *dentry);
++struct dentry *ovl_dentry_lower(struct dentry *dentry);
++struct dentry *ovl_dentry_real(struct dentry *dentry);
++struct dentry *ovl_entry_real(struct ovl_entry *oe, bool *is_upper);
++bool ovl_dentry_is_opaque(struct dentry *dentry);
++void ovl_dentry_set_opaque(struct dentry *dentry, bool opaque);
++bool ovl_is_whiteout(struct dentry *dentry);
++void ovl_dentry_update(struct dentry *dentry, struct dentry *upperdentry);
++struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
++			  struct nameidata *nd);
++struct file *ovl_path_open(struct path *path, int flags);
++
++struct dentry *ovl_upper_create(struct dentry *upperdir, struct dentry *dentry,
++				struct kstat *stat, const char *link);
++
++/* readdir.c */
++extern const struct file_operations ovl_dir_operations;
++int ovl_check_empty_and_clear(struct dentry *dentry, enum ovl_path_type type);
++
++/* inode.c */
++int ovl_setattr(struct dentry *dentry, struct iattr *attr);
++int ovl_permission(struct inode *inode, int mask);
++int ovl_setxattr(struct dentry *dentry, const char *name,
++		 const void *value, size_t size, int flags);
++ssize_t ovl_getxattr(struct dentry *dentry, const char *name,
++		     void *value, size_t size);
++ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
++int ovl_removexattr(struct dentry *dentry, const char *name);
++
++struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
++			    struct ovl_entry *oe);
++/* dir.c */
++extern const struct inode_operations ovl_dir_inode_operations;
++
++/* copy_up.c */
++int ovl_copy_up(struct dentry *dentry);
++int ovl_copy_up_truncate(struct dentry *dentry, loff_t size);
+--- /dev/null
++++ b/fs/overlayfs/readdir.c
+@@ -0,0 +1,565 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/slab.h>
++#include <linux/namei.h>
++#include <linux/file.h>
++#include <linux/xattr.h>
++#include <linux/rbtree.h>
++#include <linux/security.h>
++#include "overlayfs.h"
++
++struct ovl_cache_entry {
++	const char *name;
++	unsigned int len;
++	unsigned int type;
++	u64 ino;
++	bool is_whiteout;
++	struct list_head l_node;
++	struct rb_node node;
++};
++
++struct ovl_readdir_data {
++	struct rb_root *root;
++	struct list_head *list;
++	struct list_head *middle;
++	struct dentry *dir;
++	int count;
++	int err;
++};
++
++struct ovl_dir_file {
++	bool is_real;
++	bool is_cached;
++	struct list_head cursor;
++	u64 cache_version;
++	struct list_head cache;
++	struct file *realfile;
++};
++
++static struct ovl_cache_entry *ovl_cache_entry_from_node(struct rb_node *n)
++{
++	return container_of(n, struct ovl_cache_entry, node);
++}
++
++static struct ovl_cache_entry *ovl_cache_entry_find(struct rb_root *root,
++						    const char *name, int len)
++{
++	struct rb_node *node = root->rb_node;
++	int cmp;
++
++	while (node) {
++		struct ovl_cache_entry *p = ovl_cache_entry_from_node(node);
++
++		cmp = strncmp(name, p->name, len);
++		if (cmp > 0)
++			node = p->node.rb_right;
++		else if (cmp < 0 || len < p->len)
++			node = p->node.rb_left;
++		else
++			return p;
++	}
++
++	return NULL;
++}
++
++static struct ovl_cache_entry *ovl_cache_entry_new(const char *name, int len,
++						   u64 ino, unsigned int d_type)
++{
++	struct ovl_cache_entry *p;
++
++	p = kmalloc(sizeof(*p) + len + 1, GFP_KERNEL);
++	if (p) {
++		char *name_copy = (char *) (p + 1);
++		memcpy(name_copy, name, len);
++		name_copy[len] = '\0';
++		p->name = name_copy;
++		p->len = len;
++		p->type = d_type;
++		p->ino = ino;
++		p->is_whiteout = false;
++	}
++
++	return p;
++}
++
++static int ovl_cache_entry_add_rb(struct ovl_readdir_data *rdd,
++				  const char *name, int len, u64 ino,
++				  unsigned int d_type)
++{
++	struct rb_node **newp = &rdd->root->rb_node;
++	struct rb_node *parent = NULL;
++	struct ovl_cache_entry *p;
++
++	while (*newp) {
++		int cmp;
++		struct ovl_cache_entry *tmp;
++
++		parent = *newp;
++		tmp = ovl_cache_entry_from_node(*newp);
++		cmp = strncmp(name, tmp->name, len);
++		if (cmp > 0)
++			newp = &tmp->node.rb_right;
++		else if (cmp < 0 || len < tmp->len)
++			newp = &tmp->node.rb_left;
++		else
++			return 0;
++	}
++
++	p = ovl_cache_entry_new(name, len, ino, d_type);
++	if (p == NULL)
++		return -ENOMEM;
++
++	list_add_tail(&p->l_node, rdd->list);
++	rb_link_node(&p->node, parent, newp);
++	rb_insert_color(&p->node, rdd->root);
++
++	return 0;
++}
++
++static int ovl_fill_lower(void *buf, const char *name, int namelen,
++			    loff_t offset, u64 ino, unsigned int d_type)
++{
++	struct ovl_readdir_data *rdd = buf;
++	struct ovl_cache_entry *p;
++
++	rdd->count++;
++	p = ovl_cache_entry_find(rdd->root, name, namelen);
++	if (p) {
++		list_move_tail(&p->l_node, rdd->middle);
++	} else {
++		p = ovl_cache_entry_new(name, namelen, ino, d_type);
++		if (p == NULL)
++			rdd->err = -ENOMEM;
++		else
++			list_add_tail(&p->l_node, rdd->middle);
++	}
++
++	return rdd->err;
++}
++
++static void ovl_cache_free(struct list_head *list)
++{
++	struct ovl_cache_entry *p;
++	struct ovl_cache_entry *n;
++
++	list_for_each_entry_safe(p, n, list, l_node)
++		kfree(p);
++
++	INIT_LIST_HEAD(list);
++}
++
++static int ovl_fill_upper(void *buf, const char *name, int namelen,
++			  loff_t offset, u64 ino, unsigned int d_type)
++{
++	struct ovl_readdir_data *rdd = buf;
++
++	rdd->count++;
++	return ovl_cache_entry_add_rb(rdd, name, namelen, ino, d_type);
++}
++
++static inline int ovl_dir_read(struct path *realpath,
++			       struct ovl_readdir_data *rdd, filldir_t filler)
++{
++	struct file *realfile;
++	int err;
++
++	realfile = ovl_path_open(realpath, O_RDONLY | O_DIRECTORY);
++	if (IS_ERR(realfile))
++		return PTR_ERR(realfile);
++
++	do {
++		rdd->count = 0;
++		rdd->err = 0;
++		err = vfs_readdir(realfile, filler, rdd);
++		if (err >= 0)
++			err = rdd->err;
++	} while (!err && rdd->count);
++	fput(realfile);
++
++	return 0;
++}
++
++static void ovl_dir_reset(struct file *file)
++{
++	struct ovl_dir_file *od = file->private_data;
++	enum ovl_path_type type = ovl_path_type(file->f_path.dentry);
++
++	if (ovl_dentry_version_get(file->f_path.dentry) != od->cache_version) {
++		list_del_init(&od->cursor);
++		ovl_cache_free(&od->cache);
++		od->is_cached = false;
++	}
++	WARN_ON(!od->is_real && type != OVL_PATH_MERGE);
++	if (od->is_real && type == OVL_PATH_MERGE) {
++		fput(od->realfile);
++		od->realfile = NULL;
++		od->is_real = false;
++	}
++}
++
++static int ovl_dir_mark_whiteouts(struct ovl_readdir_data *rdd)
++{
++	struct ovl_cache_entry *p;
++	struct dentry *dentry;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++
++	override_cred = prepare_creds();
++	if (!override_cred) {
++		ovl_cache_free(rdd->list);
++		return -ENOMEM;
++	}
++
++	/*
++	 * CAP_SYS_ADMIN for getxattr
++	 * CAP_DAC_OVERRIDE for lookup
++	 */
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
++	old_cred = override_creds(override_cred);
++
++	mutex_lock(&rdd->dir->d_inode->i_mutex);
++	list_for_each_entry(p, rdd->list, l_node) {
++		if (p->type != DT_LNK)
++			continue;
++
++		dentry = lookup_one_len(p->name, rdd->dir, p->len);
++		if (IS_ERR(dentry))
++			continue;
++
++		p->is_whiteout = ovl_is_whiteout(dentry);
++		dput(dentry);
++	}
++	mutex_unlock(&rdd->dir->d_inode->i_mutex);
++
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++	return 0;
++}
++
++static inline int ovl_dir_read_merged(struct path *upperpath,
++				      struct path *lowerpath,
++				      struct ovl_readdir_data *rdd)
++{
++	int err;
++	struct rb_root root = RB_ROOT;
++	struct list_head middle;
++
++	rdd->root = &root;
++	if (upperpath->dentry) {
++		rdd->dir = upperpath->dentry;
++		err = ovl_dir_read(upperpath, rdd, ovl_fill_upper);
++		if (err)
++			goto out;
++
++		err = ovl_dir_mark_whiteouts(rdd);
++		if (err)
++			goto out;
++	}
++	/*
++	 * Insert lowerpath entries before upperpath ones, this allows
++	 * offsets to be reasonably constant
++	 */
++	list_add(&middle, rdd->list);
++	rdd->middle = &middle;
++	err = ovl_dir_read(lowerpath, rdd, ovl_fill_lower);
++	list_del(&middle);
++out:
++	rdd->root = NULL;
++
++	return err;
++}
++
++static void ovl_seek_cursor(struct ovl_dir_file *od, loff_t pos)
++{
++	struct list_head *l;
++	loff_t off;
++
++	l = od->cache.next;
++	for (off = 0; off < pos; off++) {
++		if (l == &od->cache)
++			break;
++		l = l->next;
++	}
++	list_move_tail(&od->cursor, l);
++}
++
++static int ovl_readdir(struct file *file, void *buf, filldir_t filler)
++{
++	struct ovl_dir_file *od = file->private_data;
++	int res;
++
++	if (!file->f_pos)
++		ovl_dir_reset(file);
++
++	if (od->is_real) {
++		res = vfs_readdir(od->realfile, filler, buf);
++		file->f_pos = od->realfile->f_pos;
++
++		return res;
++	}
++
++	if (!od->is_cached) {
++		struct path lowerpath;
++		struct path upperpath;
++		struct ovl_readdir_data rdd = { .list = &od->cache };
++
++		ovl_path_lower(file->f_path.dentry, &lowerpath);
++		ovl_path_upper(file->f_path.dentry, &upperpath);
++
++		res = ovl_dir_read_merged(&upperpath, &lowerpath, &rdd);
++		if (res) {
++			ovl_cache_free(rdd.list);
++			return res;
++		}
++
++		od->cache_version = ovl_dentry_version_get(file->f_path.dentry);
++		od->is_cached = true;
++
++		ovl_seek_cursor(od, file->f_pos);
++	}
++
++	while (od->cursor.next != &od->cache) {
++		int over;
++		loff_t off;
++		struct ovl_cache_entry *p;
++
++		p = list_entry(od->cursor.next, struct ovl_cache_entry, l_node);
++		off = file->f_pos;
++		if (!p->is_whiteout) {
++			over = filler(buf, p->name, p->len, off, p->ino,
++				      p->type);
++			if (over)
++				break;
++		}
++		file->f_pos++;
++		list_move(&od->cursor, &p->l_node);
++	}
++
++	return 0;
++}
++
++static loff_t ovl_dir_llseek(struct file *file, loff_t offset, int origin)
++{
++	loff_t res;
++	struct ovl_dir_file *od = file->private_data;
++
++	mutex_lock(&file->f_dentry->d_inode->i_mutex);
++	if (!file->f_pos)
++		ovl_dir_reset(file);
++
++	if (od->is_real) {
++		res = vfs_llseek(od->realfile, offset, origin);
++		file->f_pos = od->realfile->f_pos;
++	} else {
++		res = -EINVAL;
++
++		switch (origin) {
++		case SEEK_CUR:
++			offset += file->f_pos;
++			break;
++		case SEEK_SET:
++			break;
++		default:
++			goto out_unlock;
++		}
++		if (offset < 0)
++			goto out_unlock;
++
++		if (offset != file->f_pos) {
++			file->f_pos = offset;
++			if (od->is_cached)
++				ovl_seek_cursor(od, offset);
++		}
++		res = offset;
++	}
++out_unlock:
++	mutex_unlock(&file->f_dentry->d_inode->i_mutex);
++
++	return res;
++}
++
++static int ovl_dir_fsync(struct file *file, loff_t start, loff_t end,
++			 int datasync)
++{
++	struct ovl_dir_file *od = file->private_data;
++
++	/* May need to reopen directory if it got copied up */
++	if (!od->realfile) {
++		struct path upperpath;
++
++		ovl_path_upper(file->f_path.dentry, &upperpath);
++		od->realfile = ovl_path_open(&upperpath, O_RDONLY);
++		if (IS_ERR(od->realfile))
++			return PTR_ERR(od->realfile);
++	}
++
++	return vfs_fsync_range(od->realfile, start, end, datasync);
++}
++
++static int ovl_dir_release(struct inode *inode, struct file *file)
++{
++	struct ovl_dir_file *od = file->private_data;
++
++	list_del(&od->cursor);
++	ovl_cache_free(&od->cache);
++	if (od->realfile)
++		fput(od->realfile);
++	kfree(od);
++
++	return 0;
++}
++
++static int ovl_dir_open(struct inode *inode, struct file *file)
++{
++	struct path realpath;
++	struct file *realfile;
++	struct ovl_dir_file *od;
++	enum ovl_path_type type;
++
++	od = kzalloc(sizeof(struct ovl_dir_file), GFP_KERNEL);
++	if (!od)
++		return -ENOMEM;
++
++	type = ovl_path_real(file->f_path.dentry, &realpath);
++	realfile = ovl_path_open(&realpath, file->f_flags);
++	if (IS_ERR(realfile)) {
++		kfree(od);
++		return PTR_ERR(realfile);
++	}
++	INIT_LIST_HEAD(&od->cache);
++	INIT_LIST_HEAD(&od->cursor);
++	od->is_cached = false;
++	od->realfile = realfile;
++	od->is_real = (type != OVL_PATH_MERGE);
++	file->private_data = od;
++
++	return 0;
++}
++
++const struct file_operations ovl_dir_operations = {
++	.read		= generic_read_dir,
++	.open		= ovl_dir_open,
++	.readdir	= ovl_readdir,
++	.llseek		= ovl_dir_llseek,
++	.fsync		= ovl_dir_fsync,
++	.release	= ovl_dir_release,
++};
++
++static int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list)
++{
++	int err;
++	struct path lowerpath;
++	struct path upperpath;
++	struct ovl_cache_entry *p;
++	struct ovl_readdir_data rdd = { .list = list };
++
++	ovl_path_upper(dentry, &upperpath);
++	ovl_path_lower(dentry, &lowerpath);
++
++	err = ovl_dir_read_merged(&upperpath, &lowerpath, &rdd);
++	if (err)
++		return err;
++
++	err = 0;
++
++	list_for_each_entry(p, list, l_node) {
++		if (p->is_whiteout)
++			continue;
++
++		if (p->name[0] == '.') {
++			if (p->len == 1)
++				continue;
++			if (p->len == 2 && p->name[1] == '.')
++				continue;
++		}
++		err = -ENOTEMPTY;
++		break;
++	}
++
++	return err;
++}
++
++static int ovl_remove_whiteouts(struct dentry *dir, struct list_head *list)
++{
++	struct path upperpath;
++	struct dentry *upperdir;
++	struct ovl_cache_entry *p;
++	const struct cred *old_cred;
++	struct cred *override_cred;
++	int err;
++
++	ovl_path_upper(dir, &upperpath);
++	upperdir = upperpath.dentry;
++
++	override_cred = prepare_creds();
++	if (!override_cred)
++		return -ENOMEM;
++
++	/*
++	 * CAP_DAC_OVERRIDE for lookup and unlink
++	 * CAP_SYS_ADMIN for setxattr of "trusted" namespace
++	 * CAP_FOWNER for unlink in sticky directory
++	 */
++	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
++	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++	cap_raise(override_cred->cap_effective, CAP_FOWNER);
++	old_cred = override_creds(override_cred);
++
++	err = vfs_setxattr(upperdir, ovl_opaque_xattr, "y", 1, 0);
++	if (err)
++		goto out_revert_creds;
++
++	mutex_lock_nested(&upperdir->d_inode->i_mutex, I_MUTEX_PARENT);
++	list_for_each_entry(p, list, l_node) {
++		struct dentry *dentry;
++		int ret;
++
++		if (!p->is_whiteout)
++			continue;
++
++		dentry = lookup_one_len(p->name, upperdir, p->len);
++		if (IS_ERR(dentry)) {
++			printk(KERN_WARNING
++			    "overlayfs: failed to lookup whiteout %.*s: %li\n",
++			    p->len, p->name, PTR_ERR(dentry));
++			continue;
++		}
++		ret = vfs_unlink(upperdir->d_inode, dentry);
++		dput(dentry);
++		if (ret)
++			printk(KERN_WARNING
++			    "overlayfs: failed to unlink whiteout %.*s: %i\n",
++			    p->len, p->name, ret);
++	}
++	mutex_unlock(&upperdir->d_inode->i_mutex);
++
++out_revert_creds:
++	revert_creds(old_cred);
++	put_cred(override_cred);
++
++	return err;
++}
++
++int ovl_check_empty_and_clear(struct dentry *dentry, enum ovl_path_type type)
++{
++	int err;
++	LIST_HEAD(list);
++
++	err = ovl_check_empty_dir(dentry, &list);
++	if (!err && type == OVL_PATH_MERGE)
++		err = ovl_remove_whiteouts(dentry, &list);
++
++	ovl_cache_free(&list);
++
++	return err;
++}
+--- /dev/null
++++ b/fs/overlayfs/super.c
+@@ -0,0 +1,664 @@
++/*
++ *
++ * Copyright (C) 2011 Novell Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++
++#include <linux/fs.h>
++#include <linux/namei.h>
++#include <linux/xattr.h>
++#include <linux/security.h>
++#include <linux/mount.h>
++#include <linux/slab.h>
++#include <linux/parser.h>
++#include <linux/module.h>
++#include <linux/seq_file.h>
++#include "overlayfs.h"
++
++MODULE_AUTHOR("Miklos Szeredi <miklos@szeredi.hu>");
++MODULE_DESCRIPTION("Overlay filesystem");
++MODULE_LICENSE("GPL");
++
++struct ovl_config {
++	char *lowerdir;
++	char *upperdir;
++};
++
++/* private information held for overlayfs's superblock */
++struct ovl_fs {
++	struct vfsmount *upper_mnt;
++	struct vfsmount *lower_mnt;
++	/* pathnames of lower and upper dirs, for show_options */
++	struct ovl_config config;
++};
++
++/* private information held for every overlayfs dentry */
++struct ovl_entry {
++	/*
++	 * Keep "double reference" on upper dentries, so that
++	 * d_delete() doesn't think it's OK to reset d_inode to NULL.
++	 */
++	struct dentry *__upperdentry;
++	struct dentry *lowerdentry;
++	union {
++		struct {
++			u64 version;
++			bool opaque;
++		};
++		struct rcu_head rcu;
++	};
++};
++
++const char *ovl_whiteout_xattr = "trusted.overlay.whiteout";
++const char *ovl_opaque_xattr = "trusted.overlay.opaque";
++
++
++enum ovl_path_type ovl_path_type(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	if (oe->__upperdentry) {
++		if (oe->lowerdentry && S_ISDIR(dentry->d_inode->i_mode))
++			return OVL_PATH_MERGE;
++		else
++			return OVL_PATH_UPPER;
++	} else {
++		return OVL_PATH_LOWER;
++	}
++}
++
++static struct dentry *ovl_upperdentry_dereference(struct ovl_entry *oe)
++{
++	struct dentry *upperdentry = ACCESS_ONCE(oe->__upperdentry);
++	smp_read_barrier_depends();
++	return upperdentry;
++}
++
++void ovl_path_upper(struct dentry *dentry, struct path *path)
++{
++	struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	path->mnt = ofs->upper_mnt;
++	path->dentry = ovl_upperdentry_dereference(oe);
++}
++
++void ovl_path_lower(struct dentry *dentry, struct path *path)
++{
++	struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	path->mnt = ofs->lower_mnt;
++	path->dentry = oe->lowerdentry;
++}
++
++enum ovl_path_type ovl_path_real(struct dentry *dentry, struct path *path)
++{
++
++	enum ovl_path_type type = ovl_path_type(dentry);
++
++	if (type == OVL_PATH_LOWER)
++		ovl_path_lower(dentry, path);
++	else
++		ovl_path_upper(dentry, path);
++
++	return type;
++}
++
++struct dentry *ovl_dentry_upper(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	return ovl_upperdentry_dereference(oe);
++}
++
++struct dentry *ovl_dentry_lower(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	return oe->lowerdentry;
++}
++
++struct dentry *ovl_dentry_real(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++	struct dentry *realdentry;
++
++	realdentry = ovl_upperdentry_dereference(oe);
++	if (!realdentry)
++		realdentry = oe->lowerdentry;
++
++	return realdentry;
++}
++
++struct dentry *ovl_entry_real(struct ovl_entry *oe, bool *is_upper)
++{
++	struct dentry *realdentry;
++
++	realdentry = ovl_upperdentry_dereference(oe);
++	if (realdentry) {
++		*is_upper = true;
++	} else {
++		realdentry = oe->lowerdentry;
++		*is_upper = false;
++	}
++	return realdentry;
++}
++
++bool ovl_dentry_is_opaque(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++	return oe->opaque;
++}
++
++void ovl_dentry_set_opaque(struct dentry *dentry, bool opaque)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++	oe->opaque = opaque;
++}
++
++void ovl_dentry_update(struct dentry *dentry, struct dentry *upperdentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	WARN_ON(!mutex_is_locked(&upperdentry->d_parent->d_inode->i_mutex));
++	WARN_ON(oe->__upperdentry);
++	BUG_ON(!upperdentry->d_inode);
++	smp_wmb();
++	oe->__upperdentry = dget(upperdentry);
++}
++
++void ovl_dentry_version_inc(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	WARN_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
++	oe->version++;
++}
++
++u64 ovl_dentry_version_get(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	WARN_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
++	return oe->version;
++}
++
++bool ovl_is_whiteout(struct dentry *dentry)
++{
++	int res;
++	char val;
++
++	if (!dentry)
++		return false;
++	if (!dentry->d_inode)
++		return false;
++	if (!S_ISLNK(dentry->d_inode->i_mode))
++		return false;
++
++	res = vfs_getxattr(dentry, ovl_whiteout_xattr, &val, 1);
++	if (res == 1 && val == 'y')
++		return true;
++
++	return false;
++}
++
++static bool ovl_is_opaquedir(struct dentry *dentry)
++{
++	int res;
++	char val;
++
++	if (!S_ISDIR(dentry->d_inode->i_mode))
++		return false;
++
++	res = vfs_getxattr(dentry, ovl_opaque_xattr, &val, 1);
++	if (res == 1 && val == 'y')
++		return true;
++
++	return false;
++}
++
++static void ovl_entry_free(struct rcu_head *head)
++{
++	struct ovl_entry *oe = container_of(head, struct ovl_entry, rcu);
++	kfree(oe);
++}
++
++static void ovl_dentry_release(struct dentry *dentry)
++{
++	struct ovl_entry *oe = dentry->d_fsdata;
++
++	if (oe) {
++		dput(oe->__upperdentry);
++		dput(oe->__upperdentry);
++		dput(oe->lowerdentry);
++		call_rcu(&oe->rcu, ovl_entry_free);
++	}
++}
++
++const struct dentry_operations ovl_dentry_operations = {
++	.d_release = ovl_dentry_release,
++};
++
++static struct ovl_entry *ovl_alloc_entry(void)
++{
++	return kzalloc(sizeof(struct ovl_entry), GFP_KERNEL);
++}
++
++static inline struct dentry *ovl_lookup_real(struct dentry *dir,
++					     struct qstr *name)
++{
++	struct dentry *dentry;
++
++	mutex_lock(&dir->d_inode->i_mutex);
++	dentry = lookup_one_len(name->name, dir, name->len);
++	mutex_unlock(&dir->d_inode->i_mutex);
++
++	if (IS_ERR(dentry)) {
++		if (PTR_ERR(dentry) == -ENOENT)
++			dentry = NULL;
++	} else if (!dentry->d_inode) {
++		dput(dentry);
++		dentry = NULL;
++	}
++	return dentry;
++}
++
++static int ovl_do_lookup(struct dentry *dentry)
++{
++	struct ovl_entry *oe;
++	struct dentry *upperdir;
++	struct dentry *lowerdir;
++	struct dentry *upperdentry = NULL;
++	struct dentry *lowerdentry = NULL;
++	struct inode *inode = NULL;
++	int err;
++
++	err = -ENOMEM;
++	oe = ovl_alloc_entry();
++	if (!oe)
++		goto out;
++
++	upperdir = ovl_dentry_upper(dentry->d_parent);
++	lowerdir = ovl_dentry_lower(dentry->d_parent);
++
++	if (upperdir) {
++		upperdentry = ovl_lookup_real(upperdir, &dentry->d_name);
++		err = PTR_ERR(upperdentry);
++		if (IS_ERR(upperdentry))
++			goto out_put_dir;
++
++		if (lowerdir && upperdentry &&
++		    (S_ISLNK(upperdentry->d_inode->i_mode) ||
++		     S_ISDIR(upperdentry->d_inode->i_mode))) {
++			const struct cred *old_cred;
++			struct cred *override_cred;
++
++			err = -ENOMEM;
++			override_cred = prepare_creds();
++			if (!override_cred)
++				goto out_dput_upper;
++
++			/* CAP_SYS_ADMIN needed for getxattr */
++			cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
++			old_cred = override_creds(override_cred);
++
++			if (ovl_is_opaquedir(upperdentry)) {
++				oe->opaque = true;
++			} else if (ovl_is_whiteout(upperdentry)) {
++				dput(upperdentry);
++				upperdentry = NULL;
++				oe->opaque = true;
++			}
++			revert_creds(old_cred);
++			put_cred(override_cred);
++		}
++	}
++	if (lowerdir && !oe->opaque) {
++		lowerdentry = ovl_lookup_real(lowerdir, &dentry->d_name);
++		err = PTR_ERR(lowerdentry);
++		if (IS_ERR(lowerdentry))
++			goto out_dput_upper;
++	}
++
++	if (lowerdentry && upperdentry &&
++	    (!S_ISDIR(upperdentry->d_inode->i_mode) ||
++	     !S_ISDIR(lowerdentry->d_inode->i_mode))) {
++		dput(lowerdentry);
++		lowerdentry = NULL;
++		oe->opaque = true;
++	}
++
++	if (lowerdentry || upperdentry) {
++		struct dentry *realdentry;
++
++		realdentry = upperdentry ? upperdentry : lowerdentry;
++		err = -ENOMEM;
++		inode = ovl_new_inode(dentry->d_sb, realdentry->d_inode->i_mode,
++				      oe);
++		if (!inode)
++			goto out_dput;
++	}
++
++	if (upperdentry)
++		oe->__upperdentry = dget(upperdentry);
++
++	if (lowerdentry)
++		oe->lowerdentry = lowerdentry;
++
++	dentry->d_fsdata = oe;
++	dentry->d_op = &ovl_dentry_operations;
++	d_add(dentry, inode);
++
++	return 0;
++
++out_dput:
++	dput(lowerdentry);
++out_dput_upper:
++	dput(upperdentry);
++out_put_dir:
++	kfree(oe);
++out:
++	return err;
++}
++
++struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
++			  struct nameidata *nd)
++{
++	int err = ovl_do_lookup(dentry);
++
++	if (err)
++		return ERR_PTR(err);
++
++	return NULL;
++}
++
++struct file *ovl_path_open(struct path *path, int flags)
++{
++	path_get(path);
++	return dentry_open(path->dentry, path->mnt, flags, current_cred());
++}
++
++static void ovl_put_super(struct super_block *sb)
++{
++	struct ovl_fs *ufs = sb->s_fs_info;
++
++	if (!(sb->s_flags & MS_RDONLY))
++		mnt_drop_write(ufs->upper_mnt);
++
++	mntput(ufs->upper_mnt);
++	mntput(ufs->lower_mnt);
++
++	kfree(ufs->config.lowerdir);
++	kfree(ufs->config.upperdir);
++	kfree(ufs);
++}
++
++static int ovl_remount_fs(struct super_block *sb, int *flagsp, char *data)
++{
++	int flags = *flagsp;
++	struct ovl_fs *ufs = sb->s_fs_info;
++
++	/* When remounting rw or ro, we need to adjust the write access to the
++	 * upper fs.
++	 */
++	if (((flags ^ sb->s_flags) & MS_RDONLY) == 0)
++		/* No change to readonly status */
++		return 0;
++
++	if (flags & MS_RDONLY) {
++		mnt_drop_write(ufs->upper_mnt);
++		return 0;
++	} else
++		return mnt_want_write(ufs->upper_mnt);
++}
++
++/**
++ * ovl_statfs
++ * @sb: The overlayfs super block
++ * @buf: The struct kstatfs to fill in with stats
++ *
++ * Get the filesystem statistics.  As writes always target the upper layer
++ * filesystem pass the statfs to the same filesystem.
++ */
++static int ovl_statfs(struct dentry *dentry, struct kstatfs *buf)
++{
++	struct dentry *root_dentry = dentry->d_sb->s_root;
++	struct path path;
++	ovl_path_upper(root_dentry, &path);
++
++	if (!path.dentry->d_sb->s_op->statfs)
++		return -ENOSYS;
++	return path.dentry->d_sb->s_op->statfs(path.dentry, buf);
++}
++
++/**
++ * ovl_show_options
++ *
++ * Prints the mount options for a given superblock.
++ * Returns zero; does not fail.
++ */
++static int ovl_show_options(struct seq_file *m, struct dentry *dentry)
++{
++	struct super_block *sb = dentry->d_sb;
++	struct ovl_fs *ufs = sb->s_fs_info;
++
++	seq_printf(m, ",lowerdir=%s", ufs->config.lowerdir);
++	seq_printf(m, ",upperdir=%s", ufs->config.upperdir);
++	return 0;
++}
++
++static const struct super_operations ovl_super_operations = {
++	.put_super	= ovl_put_super,
++	.remount_fs	= ovl_remount_fs,
++	.statfs		= ovl_statfs,
++	.show_options	= ovl_show_options,
++};
++
++enum {
++	Opt_lowerdir,
++	Opt_upperdir,
++	Opt_err,
++};
++
++static const match_table_t ovl_tokens = {
++	{Opt_lowerdir,			"lowerdir=%s"},
++	{Opt_upperdir,			"upperdir=%s"},
++	{Opt_err,			NULL}
++};
++
++static int ovl_parse_opt(char *opt, struct ovl_config *config)
++{
++	char *p;
++
++	config->upperdir = NULL;
++	config->lowerdir = NULL;
++
++	while ((p = strsep(&opt, ",")) != NULL) {
++		int token;
++		substring_t args[MAX_OPT_ARGS];
++
++		if (!*p)
++			continue;
++
++		token = match_token(p, ovl_tokens, args);
++		switch (token) {
++		case Opt_upperdir:
++			kfree(config->upperdir);
++			config->upperdir = match_strdup(&args[0]);
++			if (!config->upperdir)
++				return -ENOMEM;
++			break;
++
++		case Opt_lowerdir:
++			kfree(config->lowerdir);
++			config->lowerdir = match_strdup(&args[0]);
++			if (!config->lowerdir)
++				return -ENOMEM;
++			break;
++
++		default:
++			return -EINVAL;
++		}
++	}
++	return 0;
++}
++
++static int ovl_fill_super(struct super_block *sb, void *data, int silent)
++{
++	struct path lowerpath;
++	struct path upperpath;
++	struct inode *root_inode;
++	struct dentry *root_dentry;
++	struct ovl_entry *oe;
++	struct ovl_fs *ufs;
++	int err;
++
++	err = -ENOMEM;
++	ufs = kmalloc(sizeof(struct ovl_fs), GFP_KERNEL);
++	if (!ufs)
++		goto out;
++
++	err = ovl_parse_opt((char *) data, &ufs->config);
++	if (err)
++		goto out_free_ufs;
++
++	err = -EINVAL;
++	if (!ufs->config.upperdir || !ufs->config.lowerdir) {
++		printk(KERN_ERR "overlayfs: missing upperdir or lowerdir\n");
++		goto out_free_config;
++	}
++
++	oe = ovl_alloc_entry();
++	if (oe == NULL)
++		goto out_free_config;
++
++	root_inode = ovl_new_inode(sb, S_IFDIR, oe);
++	if (!root_inode)
++		goto out_free_oe;
++
++	err = kern_path(ufs->config.upperdir, LOOKUP_FOLLOW, &upperpath);
++	if (err)
++		goto out_put_root;
++
++	err = kern_path(ufs->config.lowerdir, LOOKUP_FOLLOW, &lowerpath);
++	if (err)
++		goto out_put_upperpath;
++
++	err = -ENOTDIR;
++	if (!S_ISDIR(upperpath.dentry->d_inode->i_mode) ||
++	    !S_ISDIR(lowerpath.dentry->d_inode->i_mode))
++		goto out_put_lowerpath;
++
++	sb->s_stack_depth = max(upperpath.mnt->mnt_sb->s_stack_depth,
++				lowerpath.mnt->mnt_sb->s_stack_depth) + 1;
++
++	err = -EINVAL;
++	if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
++		printk(KERN_ERR "overlayfs: maximum fs stacking depth exceeded\n");
++		goto out_put_lowerpath;
++	}
++
++
++	ufs->upper_mnt = clone_private_mount(&upperpath);
++	err = PTR_ERR(ufs->upper_mnt);
++	if (IS_ERR(ufs->upper_mnt)) {
++		printk(KERN_ERR "overlayfs: failed to clone upperpath\n");
++		goto out_put_lowerpath;
++	}
++
++	ufs->lower_mnt = clone_private_mount(&lowerpath);
++	err = PTR_ERR(ufs->lower_mnt);
++	if (IS_ERR(ufs->lower_mnt)) {
++		printk(KERN_ERR "overlayfs: failed to clone lowerpath\n");
++		goto out_put_upper_mnt;
++	}
++
++	/*
++	 * Make lower_mnt R/O.  That way fchmod/fchown on lower file
++	 * will fail instead of modifying lower fs.
++	 */
++	ufs->lower_mnt->mnt_flags |= MNT_READONLY;
++
++	/* If the upper fs is r/o, we mark overlayfs r/o too */
++	if (ufs->upper_mnt->mnt_sb->s_flags & MS_RDONLY)
++		sb->s_flags |= MS_RDONLY;
++
++	if (!(sb->s_flags & MS_RDONLY)) {
++		err = mnt_want_write(ufs->upper_mnt);
++		if (err)
++			goto out_put_lower_mnt;
++	}
++
++	err = -ENOMEM;
++	root_dentry = d_alloc_root(root_inode);
++	if (!root_dentry)
++		goto out_drop_write;
++
++	mntput(upperpath.mnt);
++	mntput(lowerpath.mnt);
++
++	oe->__upperdentry = dget(upperpath.dentry);
++	oe->lowerdentry = lowerpath.dentry;
++
++	root_dentry->d_fsdata = oe;
++	root_dentry->d_op = &ovl_dentry_operations;
++
++	sb->s_op = &ovl_super_operations;
++	sb->s_root = root_dentry;
++	sb->s_fs_info = ufs;
++
++	return 0;
++
++out_drop_write:
++	if (!(sb->s_flags & MS_RDONLY))
++		mnt_drop_write(ufs->upper_mnt);
++out_put_lower_mnt:
++	mntput(ufs->lower_mnt);
++out_put_upper_mnt:
++	mntput(ufs->upper_mnt);
++out_put_lowerpath:
++	path_put(&lowerpath);
++out_put_upperpath:
++	path_put(&upperpath);
++out_put_root:
++	iput(root_inode);
++out_free_oe:
++	kfree(oe);
++out_free_config:
++	kfree(ufs->config.lowerdir);
++	kfree(ufs->config.upperdir);
++out_free_ufs:
++	kfree(ufs);
++out:
++	return err;
++}
++
++static struct dentry *ovl_mount(struct file_system_type *fs_type, int flags,
++				const char *dev_name, void *raw_data)
++{
++	return mount_nodev(fs_type, flags, raw_data, ovl_fill_super);
++}
++
++static struct file_system_type ovl_fs_type = {
++	.owner		= THIS_MODULE,
++	.name		= "overlayfs",
++	.mount		= ovl_mount,
++	.kill_sb	= kill_anon_super,
++};
++
++static int __init ovl_init(void)
++{
++	return register_filesystem(&ovl_fs_type);
++}
++
++static void __exit ovl_exit(void)
++{
++	unregister_filesystem(&ovl_fs_type);
++}
++
++module_init(ovl_init);
++module_exit(ovl_exit);
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1302,6 +1302,7 @@ long do_splice_direct(struct file *in, l
+ 
+ 	return ret;
+ }
++EXPORT_SYMBOL(do_splice_direct);
+ 
+ static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
+ 			       struct pipe_inode_info *opipe,
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -484,6 +484,12 @@ struct iattr {
+  */
+ #include <linux/quota.h>
+ 
++/*
++ * Maximum number of layers of fs stack.  Needs to be limited to
++ * prevent kernel stack overflow
++ */
++#define FILESYSTEM_MAX_STACK_DEPTH 2
++
+ /** 
+  * enum positive_aop_returns - aop return codes with specific semantics
+  *
+@@ -1501,6 +1507,11 @@ struct super_block {
+ 
+ 	/* Being remounted read-only */
+ 	int s_readonly_remount;
++
++	/*
++	 * Indicates how deep in a filesystem stack this SB is
++	 */
++	int s_stack_depth;
+ };
+ 
+ /* superblock cache pruning functions */
+@@ -1658,6 +1669,8 @@ struct inode_operations {
+ 	void (*truncate_range)(struct inode *, loff_t, loff_t);
+ 	int (*fiemap)(struct inode *, struct fiemap_extent_info *, u64 start,
+ 		      u64 len);
++	struct file *(*open) (struct dentry *, struct file *,
++			      const struct cred *);
+ } ____cacheline_aligned;
+ 
+ struct seq_file;
+@@ -2028,6 +2041,7 @@ extern long do_sys_open(int dfd, const c
+ extern struct file *filp_open(const char *, int, umode_t);
+ extern struct file *file_open_root(struct dentry *, struct vfsmount *,
+ 				   const char *, int);
++extern struct file *vfs_open(struct path *, struct file *, const struct cred *);
+ extern struct file * dentry_open(struct dentry *, struct vfsmount *, int,
+ 				 const struct cred *);
+ extern int filp_close(struct file *, fl_owner_t id);
+--- a/include/linux/mount.h
++++ b/include/linux/mount.h
+@@ -66,6 +66,9 @@ extern void mnt_pin(struct vfsmount *mnt
+ extern void mnt_unpin(struct vfsmount *mnt);
+ extern int __mnt_is_readonly(struct vfsmount *mnt);
+ 
++struct path;
++extern struct vfsmount *clone_private_mount(struct path *path);
++
+ struct file_system_type;
+ extern struct vfsmount *vfs_kern_mount(struct file_system_type *type,
+ 				      int flags, const char *name,
diff --git a/target/linux/generic/patches-3.3/102-ehci_hcd_ignore_oc.patch b/target/linux/generic/patches-3.3/102-ehci_hcd_ignore_oc.patch
new file mode 100644
index 0000000..400d2ed
--- /dev/null
+++ b/target/linux/generic/patches-3.3/102-ehci_hcd_ignore_oc.patch
@@ -0,0 +1,41 @@
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -795,7 +795,7 @@ static int ehci_run (struct usb_hcd *hcd
+ 		"USB %x.%x started, EHCI %x.%02x%s\n",
+ 		((ehci->sbrn & 0xf0)>>4), (ehci->sbrn & 0x0f),
+ 		temp >> 8, temp & 0xff,
+-		ignore_oc ? ", overcurrent ignored" : "");
++		(ignore_oc || ehci->ignore_oc) ? ", overcurrent ignored" : "");
+ 
+ 	ehci_writel(ehci, INTR_MASK,
+ 		    &ehci->regs->intr_enable); /* Turn On Interrupts */
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -578,7 +578,7 @@ ehci_hub_status_data (struct usb_hcd *hc
+ 	 * always set, seem to clear PORT_OCC and PORT_CSC when writing to
+ 	 * PORT_POWER; that's surprising, but maybe within-spec.
+ 	 */
+-	if (!ignore_oc)
++	if (!ignore_oc && !ehci->ignore_oc)
+ 		mask = PORT_CSC | PORT_PEC | PORT_OCC;
+ 	else
+ 		mask = PORT_CSC | PORT_PEC;
+@@ -803,7 +803,7 @@ static int ehci_hub_control (
+ 		if (temp & PORT_PEC)
+ 			status |= USB_PORT_STAT_C_ENABLE << 16;
+ 
+-		if ((temp & PORT_OCC) && !ignore_oc){
++		if ((temp & PORT_OCC) && (!ignore_oc && !ehci->ignore_oc)){
+ 			status |= USB_PORT_STAT_C_OVERCURRENT << 16;
+ 
+ 			/*
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -147,6 +147,7 @@ struct ehci_hcd {			/* one per controlle
+ 	unsigned		use_dummy_qh:1;	/* AMD Frame List table quirk*/
+ 	unsigned		has_synopsys_hc_bug:1; /* Synopsys HC */
+ 	unsigned		frame_index_bug:1; /* MosChip (AKA NetMos) */
++	unsigned		ignore_oc:1;
+ 
+ 	/* required for usb32 quirk */
+ 	#define OHCI_CTRL_HCFS          (3 << 6)
diff --git a/target/linux/generic/patches-3.3/110-fix_mtd_include.patch b/target/linux/generic/patches-3.3/110-fix_mtd_include.patch
new file mode 100644
index 0000000..c63dbc0
--- /dev/null
+++ b/target/linux/generic/patches-3.3/110-fix_mtd_include.patch
@@ -0,0 +1,10 @@
+--- a/include/linux/mtd/physmap.h
++++ b/include/linux/mtd/physmap.h
+@@ -17,6 +17,7 @@
+ 
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/platform_device.h>
+ 
+ struct map_info;
+ struct platform_device;
diff --git a/target/linux/generic/patches-3.3/130-pppoatm-queue-depth.patch b/target/linux/generic/patches-3.3/130-pppoatm-queue-depth.patch
new file mode 100644
index 0000000..247a312
--- /dev/null
+++ b/target/linux/generic/patches-3.3/130-pppoatm-queue-depth.patch
@@ -0,0 +1,188 @@
+From 9d02daf754238adac48fa075ee79e7edd3d79ed3 Mon Sep 17 00:00:00 2001
+From: David Woodhouse <dwmw2@infradead.org>
+Date: Sun, 8 Apr 2012 09:55:43 +0000
+Subject: [PATCH] pppoatm: Fix excessive queue bloat
+
+We discovered that PPPoATM has an excessively deep transmit queue. A
+queue the size of the default socket send buffer (wmem_default) is
+maintained between the PPP generic core and the ATM device.
+
+Fix it to queue a maximum of *two* packets. The one the ATM device is
+currently working on, and one more for the ATM driver to process
+immediately in its TX done interrupt handler. The PPP core is designed
+to feed packets to the channel with minimal latency, so that really
+ought to be enough to keep the ATM device busy.
+
+While we're at it, fix the fact that we were triggering the wakeup
+tasklet on *every* pppoatm_pop() call. The comment saying "this is
+inefficient, but doing it right is too hard" turns out to be overly
+pessimistic... I think :)
+
+On machines like the Traverse Geos, with a slow Geode CPU and two
+high-speed ADSL2+ interfaces, there were reports of extremely high CPU
+usage which could partly be attributed to the extra wakeups.
+
+(The wakeup handling could actually be made a whole lot easier if we
+ stop checking sk->sk_sndbuf altogether. Given that we now only queue
+ *two* packets ever, one wonders what the point is. As it is, you could
+ already deadlock the thing by setting the sk_sndbuf to a value lower
+ than the MTU of the device, and it'd just block for ever.)
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/atm/pppoatm.c |   95 +++++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 files changed, 85 insertions(+), 10 deletions(-)
+
+--- a/net/atm/pppoatm.c
++++ b/net/atm/pppoatm.c
+@@ -62,12 +62,25 @@ struct pppoatm_vcc {
+ 	void (*old_pop)(struct atm_vcc *, struct sk_buff *);
+ 					/* keep old push/pop for detaching */
+ 	enum pppoatm_encaps encaps;
++	atomic_t inflight;
++	unsigned long blocked;
+ 	int flags;			/* SC_COMP_PROT - compress protocol */
+ 	struct ppp_channel chan;	/* interface to generic ppp layer */
+ 	struct tasklet_struct wakeup_tasklet;
+ };
+ 
+ /*
++ * We want to allow two packets in the queue. The one that's currently in
++ * flight, and *one* queued up ready for the ATM device to send immediately
++ * from its TX done IRQ. We want to be able to use atomic_inc_not_zero(), so
++ * inflight == -2 represents an empty queue, -1 one packet, and zero means
++ * there are two packets in the queue.
++ */
++#define NONE_INFLIGHT -2
++
++#define BLOCKED 0
++
++/*
+  * Header used for LLC Encapsulated PPP (4 bytes) followed by the LCP protocol
+  * ID (0xC021) used in autodetection
+  */
+@@ -102,16 +115,30 @@ static void pppoatm_wakeup_sender(unsign
+ static void pppoatm_pop(struct atm_vcc *atmvcc, struct sk_buff *skb)
+ {
+ 	struct pppoatm_vcc *pvcc = atmvcc_to_pvcc(atmvcc);
++
+ 	pvcc->old_pop(atmvcc, skb);
++	atomic_dec(&pvcc->inflight);
++
+ 	/*
+-	 * We don't really always want to do this since it's
+-	 * really inefficient - it would be much better if we could
+-	 * test if we had actually throttled the generic layer.
+-	 * Unfortunately then there would be a nasty SMP race where
+-	 * we could clear that flag just as we refuse another packet.
+-	 * For now we do the safe thing.
++	 * We always used to run the wakeup tasklet unconditionally here, for
++	 * fear of race conditions where we clear the BLOCKED flag just as we
++	 * refuse another packet in pppoatm_send(). This was quite inefficient.
++	 *
++	 * In fact it's OK. The PPP core will only ever call pppoatm_send()
++	 * while holding the channel->downl lock. And ppp_output_wakeup() as
++	 * called by the tasklet will *also* grab that lock. So even if another
++	 * CPU is in pppoatm_send() right now, the tasklet isn't going to race
++	 * with it. The wakeup *will* happen after the other CPU is safely out
++	 * of pppoatm_send() again.
++	 *
++	 * So if the CPU in pppoatm_send() has already set the BLOCKED bit and
++	 * it about to return, that's fine. We trigger a wakeup which will
++	 * happen later. And if the CPU in pppoatm_send() *hasn't* set the
++	 * BLOCKED bit yet, that's fine too because of the double check in
++	 * pppoatm_may_send() which is commented there.
+ 	 */
+-	tasklet_schedule(&pvcc->wakeup_tasklet);
++	if (test_and_clear_bit(BLOCKED, &pvcc->blocked))
++		tasklet_schedule(&pvcc->wakeup_tasklet);
+ }
+ 
+ /*
+@@ -184,6 +211,51 @@ error:
+ 	ppp_input_error(&pvcc->chan, 0);
+ }
+ 
++static inline int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
++{
++	/*
++	 * It's not clear that we need to bother with using atm_may_send()
++	 * to check we don't exceed sk->sk_sndbuf. If userspace sets a
++	 * value of sk_sndbuf which is lower than the MTU, we're going to
++	 * block for ever. But the code always did that before we introduced
++	 * the packet count limit, so...
++	 */
++	if (atm_may_send(pvcc->atmvcc, size) &&
++	    atomic_inc_not_zero_hint(&pvcc->inflight, NONE_INFLIGHT))
++		return 1;
++
++	/*
++	 * We use test_and_set_bit() rather than set_bit() here because
++	 * we need to ensure there's a memory barrier after it. The bit
++	 * *must* be set before we do the atomic_inc() on pvcc->inflight.
++	 * There's no smp_mb__after_set_bit(), so it's this or abuse
++	 * smp_mb__after_clear_bit().
++	 */
++	test_and_set_bit(BLOCKED, &pvcc->blocked);
++
++	/*
++	 * We may have raced with pppoatm_pop(). If it ran for the
++	 * last packet in the queue, *just* before we set the BLOCKED
++	 * bit, then it might never run again and the channel could
++	 * remain permanently blocked. Cope with that race by checking
++	 * *again*. If it did run in that window, we'll have space on
++	 * the queue now and can return success. It's harmless to leave
++	 * the BLOCKED flag set, since it's only used as a trigger to
++	 * run the wakeup tasklet. Another wakeup will never hurt.
++	 * If pppoatm_pop() is running but hasn't got as far as making
++	 * space on the queue yet, then it hasn't checked the BLOCKED
++	 * flag yet either, so we're safe in that case too. It'll issue
++	 * an "immediate" wakeup... where "immediate" actually involves
++	 * taking the PPP channel's ->downl lock, which is held by the
++	 * code path that calls pppoatm_send(), and is thus going to
++	 * wait for us to finish.
++	 */
++	if (atm_may_send(pvcc->atmvcc, size) &&
++	    atomic_inc_not_zero(&pvcc->inflight))
++		return 1;
++
++	return 0;
++}
+ /*
+  * Called by the ppp_generic.c to send a packet - returns true if packet
+  * was accepted.  If we return false, then it's our job to call
+@@ -207,7 +279,7 @@ static int pppoatm_send(struct ppp_chann
+ 			struct sk_buff *n;
+ 			n = skb_realloc_headroom(skb, LLC_LEN);
+ 			if (n != NULL &&
+-			    !atm_may_send(pvcc->atmvcc, n->truesize)) {
++			    !pppoatm_may_send(pvcc, n->truesize)) {
+ 				kfree_skb(n);
+ 				goto nospace;
+ 			}
+@@ -215,12 +287,12 @@ static int pppoatm_send(struct ppp_chann
+ 			skb = n;
+ 			if (skb == NULL)
+ 				return DROP_PACKET;
+-		} else if (!atm_may_send(pvcc->atmvcc, skb->truesize))
++		} else if (!pppoatm_may_send(pvcc, skb->truesize))
+ 			goto nospace;
+ 		memcpy(skb_push(skb, LLC_LEN), pppllc, LLC_LEN);
+ 		break;
+ 	case e_vc:
+-		if (!atm_may_send(pvcc->atmvcc, skb->truesize))
++		if (!pppoatm_may_send(pvcc, skb->truesize))
+ 			goto nospace;
+ 		break;
+ 	case e_autodetect:
+@@ -285,6 +357,9 @@ static int pppoatm_assign_vcc(struct atm
+ 	if (pvcc == NULL)
+ 		return -ENOMEM;
+ 	pvcc->atmvcc = atmvcc;
++
++	/* Maximum is zero, so that we can use atomic_inc_not_zero() */
++	atomic_set(&pvcc->inflight, NONE_INFLIGHT);
+ 	pvcc->old_push = atmvcc->push;
+ 	pvcc->old_pop = atmvcc->pop;
+ 	pvcc->encaps = (enum pppoatm_encaps) be.encaps;
diff --git a/target/linux/generic/patches-3.3/131-atm-fixes.patch b/target/linux/generic/patches-3.3/131-atm-fixes.patch
new file mode 100644
index 0000000..4d3bd4f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/131-atm-fixes.patch
@@ -0,0 +1,900 @@
+commit d7d3d8f1ee4435e32bc6c93187798b7e2e3170a9
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Thu Nov 29 23:28:30 2012 +0000
+
+    solos-pci: remove list_vccs() debugging function
+    
+    No idea why we've gone so long dumping a list of VCCs with vci==0 on
+    every ->open() call...
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit c93967bfd3a3dffa759a3f28370167bf3cdbc3d0
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Thu Nov 29 23:27:20 2012 +0000
+
+    solos-pci: use GFP_KERNEL where possible, not GFP_ATOMIC
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit ad6999e17ae4f7b99f6d28f425ae970acb115347
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Thu Nov 29 23:15:30 2012 +0000
+
+    solos-pci: clean up pclose() function
+    
+     - Flush pending TX skbs from the queue rather than waiting for them all to
+       complete (suggested by Krzysztof Mazur <krzysiek@podlesie.net>).
+     - Clear ATM_VF_ADDR only when the PKT_PCLOSE packet has been submitted.
+     - Don't clear ATM_VF_READY at all — vcc_destroy_socket() does that for us.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 2547e97f29d6d69d567947d5ef90b6b4fbcaf565
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Nov 28 10:15:05 2012 +0000
+
+    pppoatm: optimise PPP channel wakeups after sock_owned_by_user()
+    
+    We don't need to schedule the wakeup tasklet on *every* unlock; only if we
+    actually blocked the channel in the first place.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit 990b0884a2e9668c08e9daa4d70a54d65329cb6f
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Wed Nov 28 09:08:04 2012 +0100
+
+    br2684: allow assign only on a connected socket
+    
+    The br2684 does not check if used vcc is in connected state,
+    causing potential Oops in pppoatm_send() when vcc->send() is called
+    on not fully connected socket.
+    
+    Now br2684 can be assigned only on connected sockets; otherwise
+    -EINVAL error is returned.
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit f49b6da01f0abebb17f6241473d53018d923f6b0
+Author: Nathan Williams <nathan@traverse.com.au>
+Date:   Tue Nov 27 17:34:09 2012 +1100
+
+    solos-pci: Fix leak of skb received for unknown vcc
+    
+    ... and ensure that the next skb is set up for RX in the DMA case.
+    
+    Signed-off-by: Nathan Williams <nathan@traverse.com.au>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit a61d37ff4a555886c4ebe31d2c6d893afb6f4d3c
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Nov 28 00:46:45 2012 +0000
+
+    br2684: fix module_put() race
+    
+    The br2684 code used module_put() during unassignment from vcc with
+    hope that we have BKL. This assumption is no longer true.
+    
+    Now owner field in atmvcc is used to move this module_put()
+    to vcc_destroy_socket().
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit c52f40629884ddc62c7af445fd5d620fdb466fb2
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Nov 28 00:05:52 2012 +0000
+
+    pppoatm: fix missing wakeup in pppoatm_send()
+    
+    Now that we can return zero from pppoatm_send() for reasons *other* than
+    the queue being full, that means we can't depend on a subsequent call to
+    pppoatm_pop() waking the queue, and we might leave it stalled
+    indefinitely.
+    
+    Use the ->release_cb() callback to wake the queue after the sock is
+    unlocked.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit 35826e7372fe39b7db7930eda0267c82d68d1a4c
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Tue Nov 27 23:28:36 2012 +0000
+
+    br2684: don't send frames on not-ready vcc
+    
+    Avoid submitting packets to a vcc which is being closed. Things go badly
+    wrong when the ->pop method gets later called after everything's been
+    torn down.
+    
+    Use the ATM socket lock for synchronisation with vcc_destroy_socket(),
+    which clears the ATM_VF_READY bit under the same lock. Otherwise, we
+    could end up submitting a packet to the device driver even after its
+    ->ops->close method has been called. And it could call the vcc's ->pop
+    method after the protocol has been shut down. Which leads to a panic.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit 7f940dde65de4a707f3dd723bb6ce9de90ca1eab
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Nov 28 00:03:11 2012 +0000
+
+    atm: add release_cb() callback to vcc
+    
+    The immediate use case for this is that it will allow us to ensure that a
+    pppoatm queue is woken after it has to drop a packet due to the sock being
+    locked.
+    
+    Note that 'release_cb' is called when the socket is *unlocked*. This is
+    not to be confused with vcc_release() — which probably ought to be called
+    vcc_close().
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Krzysztof Mazur <krzysiek@podlesie.net>
+
+commit def1b2f9083f84d0a77730e537c76429914d17c1
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Tue Nov 27 23:49:24 2012 +0000
+
+    solos-pci: wait for pending TX to complete when releasing vcc
+    
+    We should no longer be calling the old pop routine for the vcc, after
+    vcc_release() has completed. Make sure we wait for any pending TX skbs
+    to complete, by waiting for our own PKT_PCLOSE control skb to be sent.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 397ff16dce53888ec693b3718640be2560204751
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:17:02 2012 +0100
+
+    pppoatm: do not inline pppoatm_may_send()
+    
+    The pppoatm_may_send() is quite heavy and it's called three times
+    in pppoatm_send() and inlining costs more than 200 bytes of code
+    (more than 10% of total pppoatm driver code size).
+    
+    add/remove: 1/0 grow/shrink: 0/1 up/down: 132/-367 (-235)
+    function                                     old     new   delta
+    pppoatm_may_send                               -     132    +132
+    pppoatm_send                                 900     533    -367
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 071d93931a75dc1f82f0baa9959613af81c5a032
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Sat Nov 10 23:33:19 2012 +0100
+
+    pppoatm: drop frames to not-ready vcc
+    
+    The vcc_destroy_socket() closes vcc before the protocol is detached
+    from vcc by calling vcc->push() with NULL skb. This leaves some time
+    window, where the protocol may call vcc->send() on closed vcc
+    and crash.
+    
+    Now pppoatm_send(), like vcc_sendmsg(), checks for vcc flags that
+    indicate that vcc is not ready. If the vcc is not ready we just
+    drop frame. Queueing frames is much more complicated because we
+    don't have callbacks that inform us about vcc flags changes.
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 3ac108006fd7f20cb8fc8ea2287f1497bcda00a1
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:17:00 2012 +0100
+
+    pppoatm: take ATM socket lock in pppoatm_send()
+    
+    The pppoatm_send() does not take any lock that will prevent concurrent
+    vcc_sendmsg(). This causes two problems:
+    
+    	- there is no locking between checking the send queue size
+    	  with atm_may_send() and incrementing sk_wmem_alloc,
+    	  and the real queue size can be a little higher than sk_sndbuf
+    
+    	- the vcc->sendmsg() can be called concurrently. I'm not sure
+    	  if it's allowed. Some drivers (eni, nicstar, ...) seem
+    	  to assume it will never happen.
+    
+    Now pppoatm_send() takes ATM socket lock, the same that is used
+    in vcc_sendmsg() and other ATM socket functions. The pppoatm_send()
+    is called with BH disabled, so bh_lock_sock() is used instead
+    of lock_sock().
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Cc: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit e41faed9cde1acce657f75a0b19a1787e9850d3f
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:16:59 2012 +0100
+
+    pppoatm: fix module_put() race
+    
+    The pppoatm used module_put() during unassignment from vcc with
+    hope that we have BKL. This assumption is no longer true.
+    
+    Now owner field in atmvcc is used to move this module_put()
+    to vcc_destroy_socket().
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 3b1a914595f3f9beb9e38ff3ddc7bdafa092ba22
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:16:58 2012 +0100
+
+    pppoatm: allow assign only on a connected socket
+    
+    The pppoatm does not check if used vcc is in connected state,
+    causing an Oops in pppoatm_send() when vcc->send() is called
+    on not fully connected socket.
+    
+    Now pppoatm can be assigned only on connected sockets; otherwise
+    -EINVAL error is returned.
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Cc: Chas Williams - CONTRACTOR <chas@cmf.nrl.navy.mil>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+
+commit ec809bd817dfa1905283468e4c813684ed4efe78
+Author: Krzysztof Mazur <krzysiek@podlesie.net>
+Date:   Tue Nov 6 23:16:57 2012 +0100
+
+    atm: add owner of push() callback to atmvcc
+    
+    The atm is using atmvcc->push(vcc, NULL) callback to notify protocol
+    that vcc will be closed and protocol must detach from it. This callback
+    is usually used by protocol to decrement module usage count by module_put(),
+    but it leaves small window then module is still used after module_put().
+    
+    Now the owner of push() callback is kept in atmvcc and
+    module_put(atmvcc->owner) is called after the protocol is detached from vcc.
+    
+    Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Acked-by: Chas Williams <chas@cmf.nrl.navy.mil>
+
+commit ae088d663beebb3cad0e7abaac67ee61a7c578d5
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Sun Nov 25 12:06:52 2012 +0000
+
+    atm: br2684: Fix excessive queue bloat
+    
+    There's really no excuse for an additional wmem_default of buffering
+    between the netdev queue and the ATM device. Two packets (one in-flight,
+    and one ready to send) ought to be fine. It's not as if it should take
+    long to get another from the netdev queue when we need it.
+    
+    If necessary we can make the queue space configurable later, but I don't
+    think it's likely to be necessary.
+    
+    cf. commit 9d02daf754238adac48fa075ee79e7edd3d79ed3 (pppoatm: Fix
+    excessive queue bloat) which did something very similar for PPPoATM.
+    
+    Note that there is a tremendously unlikely race condition which may
+    result in qspace temporarily going negative. If a CPU running the
+    br2684_pop() function goes off into the weeds for a long period of time
+    after incrementing qspace to 1, but before calling netdev_wake_queue()...
+    and another CPU ends up calling br2684_start_xmit() and *stopping* the
+    queue again before the first CPU comes back, the netdev queue could
+    end up being woken when qspace has already reached zero.
+    
+    An alternative approach to coping with this race would be to check in
+    br2684_start_xmit() for qspace==0 and return NETDEV_TX_BUSY, but just
+    using '> 0' and '< 1' for comparison instead of '== 0' and '!= 0' is
+    simpler. It just warranted a mention of *why* we do it that way...
+    
+    Move the call to atmvcc->send() to happen *after* the accounting and
+    potentially stopping the netdev queue, in br2684_xmit_vcc(). This matters
+    if the ->send() call suffers an immediate failure, because it'll call
+    br2684_pop() with the offending skb before returning. We want that to
+    happen *after* we've done the initial accounting for the packet in
+    question. Also make it return an appropriate success/failure indication
+    while we're at it.
+    
+    Tested by running 'ping -l 1000 bottomless.aaisp.net.uk' from within my
+    network, with only a single PPPoE-over-BR2684 link running. And after
+    setting txqueuelen on the nas0 interface to something low (5, in fact).
+    Before the patch, we'd see about 15 packets being queued and a resulting
+    latency of ~56ms being reached. After the patch, we see only about 8,
+    which is fairly much what we expect. And a max latency of ~36ms. On this
+    OpenWRT box, wmem_default is 163840.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Reviewed-by: Krzysztof Mazur <krzysiek@podlesie.net>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+--- a/drivers/atm/solos-pci.c
++++ b/drivers/atm/solos-pci.c
+@@ -92,6 +92,7 @@ struct pkt_hdr {
+ };
+ 
+ struct solos_skb_cb {
++	struct completion c;
+ 	struct atm_vcc *vcc;
+ 	uint32_t dma_addr;
+ };
+@@ -164,7 +165,6 @@ static void fpga_queue(struct solos_card
+ static uint32_t fpga_tx(struct solos_card *);
+ static irqreturn_t solos_irq(int irq, void *dev_id);
+ static struct atm_vcc* find_vcc(struct atm_dev *dev, short vpi, int vci);
+-static int list_vccs(int vci);
+ static int atm_init(struct solos_card *, struct device *);
+ static void atm_remove(struct solos_card *);
+ static int send_command(struct solos_card *card, int dev, const char *buf, size_t size);
+@@ -710,7 +710,8 @@ void solos_bh(unsigned long card_arg)
+ 						dev_warn(&card->dev->dev, "Received packet for unknown VPI.VCI %d.%d on port %d\n",
+ 							 le16_to_cpu(header->vpi), le16_to_cpu(header->vci),
+ 							 port);
+-					continue;
++					dev_kfree_skb_any(skb);
++					break;
+ 				}
+ 				atm_charge(vcc, skb->truesize);
+ 				vcc->push(vcc, skb);
+@@ -790,44 +791,6 @@ static struct atm_vcc *find_vcc(struct a
+ 	return vcc;
+ }
+ 
+-static int list_vccs(int vci)
+-{
+-	struct hlist_head *head;
+-	struct atm_vcc *vcc;
+-	struct hlist_node *node;
+-	struct sock *s;
+-	int num_found = 0;
+-	int i;
+-
+-	read_lock(&vcc_sklist_lock);
+-	if (vci != 0){
+-		head = &vcc_hash[vci & (VCC_HTABLE_SIZE -1)];
+-		sk_for_each(s, node, head) {
+-			num_found ++;
+-			vcc = atm_sk(s);
+-			printk(KERN_DEBUG "Device: %d Vpi: %d Vci: %d\n",
+-			       vcc->dev->number,
+-			       vcc->vpi,
+-			       vcc->vci);
+-		}
+-	} else {
+-		for(i = 0; i < VCC_HTABLE_SIZE; i++){
+-			head = &vcc_hash[i];
+-			sk_for_each(s, node, head) {
+-				num_found ++;
+-				vcc = atm_sk(s);
+-				printk(KERN_DEBUG "Device: %d Vpi: %d Vci: %d\n",
+-				       vcc->dev->number,
+-				       vcc->vpi,
+-				       vcc->vci);
+-			}
+-		}
+-	}
+-	read_unlock(&vcc_sklist_lock);
+-	return num_found;
+-}
+-
+-
+ static int popen(struct atm_vcc *vcc)
+ {
+ 	struct solos_card *card = vcc->dev->dev_data;
+@@ -840,7 +803,7 @@ static int popen(struct atm_vcc *vcc)
+ 		return -EINVAL;
+ 	}
+ 
+-	skb = alloc_skb(sizeof(*header), GFP_ATOMIC);
++	skb = alloc_skb(sizeof(*header), GFP_KERNEL);
+ 	if (!skb) {
+ 		if (net_ratelimit())
+ 			dev_warn(&card->dev->dev, "Failed to allocate sk_buff in popen()\n");
+@@ -857,8 +820,6 @@ static int popen(struct atm_vcc *vcc)
+ 
+ 	set_bit(ATM_VF_ADDR, &vcc->flags);
+ 	set_bit(ATM_VF_READY, &vcc->flags);
+-	list_vccs(0);
+-
+ 
+ 	return 0;
+ }
+@@ -866,10 +827,21 @@ static int popen(struct atm_vcc *vcc)
+ static void pclose(struct atm_vcc *vcc)
+ {
+ 	struct solos_card *card = vcc->dev->dev_data;
+-	struct sk_buff *skb;
++	unsigned char port = SOLOS_CHAN(vcc->dev);
++	struct sk_buff *skb, *tmpskb;
+ 	struct pkt_hdr *header;
+ 
+-	skb = alloc_skb(sizeof(*header), GFP_ATOMIC);
++	/* Remove any yet-to-be-transmitted packets from the pending queue */
++	spin_lock(&card->tx_queue_lock);
++	skb_queue_walk_safe(&card->tx_queue[port], skb, tmpskb) {
++		if (SKB_CB(skb)->vcc == vcc) {
++			skb_unlink(skb, &card->tx_queue[port]);
++			solos_pop(vcc, skb);
++		}
++	}
++	spin_unlock(&card->tx_queue_lock);
++
++	skb = alloc_skb(sizeof(*header), GFP_KERNEL);
+ 	if (!skb) {
+ 		dev_warn(&card->dev->dev, "Failed to allocate sk_buff in pclose()\n");
+ 		return;
+@@ -881,15 +853,21 @@ static void pclose(struct atm_vcc *vcc)
+ 	header->vci = cpu_to_le16(vcc->vci);
+ 	header->type = cpu_to_le16(PKT_PCLOSE);
+ 
+-	fpga_queue(card, SOLOS_CHAN(vcc->dev), skb, NULL);
++	init_completion(&SKB_CB(skb)->c);
+ 
+-	clear_bit(ATM_VF_ADDR, &vcc->flags);
+-	clear_bit(ATM_VF_READY, &vcc->flags);
++	fpga_queue(card, port, skb, NULL);
++
++	if (!wait_for_completion_timeout(&SKB_CB(skb)->c, 5 * HZ))
++		dev_warn(&card->dev->dev, "Timeout waiting for VCC close on port %d\n",
++			 port);
+ 
+ 	/* Hold up vcc_destroy_socket() (our caller) until solos_bh() in the
+ 	   tasklet has finished processing any incoming packets (and, more to
+ 	   the point, using the vcc pointer). */
+ 	tasklet_unlock_wait(&card->tlet);
++
++	clear_bit(ATM_VF_ADDR, &vcc->flags);
++
+ 	return;
+ }
+ 
+@@ -1010,9 +988,12 @@ static uint32_t fpga_tx(struct solos_car
+ 			if (vcc) {
+ 				atomic_inc(&vcc->stats->tx);
+ 				solos_pop(vcc, oldskb);
+-			} else
++			} else {
++				struct pkt_hdr *header = (void *)oldskb->data;
++				if (le16_to_cpu(header->type) == PKT_PCLOSE)
++					complete(&SKB_CB(oldskb)->c);
+ 				dev_kfree_skb_irq(oldskb);
+-
++			}
+ 		}
+ 	}
+ 	/* For non-DMA TX, write the 'TX start' bit for all four ports simultaneously */
+@@ -1246,7 +1227,7 @@ static int atm_init(struct solos_card *c
+ 		card->atmdev[i]->phy_data = (void *)(unsigned long)i;
+ 		atm_dev_signal_change(card->atmdev[i], ATM_PHY_SIG_FOUND);
+ 
+-		skb = alloc_skb(sizeof(*header), GFP_ATOMIC);
++		skb = alloc_skb(sizeof(*header), GFP_KERNEL);
+ 		if (!skb) {
+ 			dev_warn(&card->dev->dev, "Failed to allocate sk_buff in atm_init()\n");
+ 			continue;
+@@ -1343,6 +1324,8 @@ static struct pci_driver fpga_driver = {
+ 
+ static int __init solos_pci_init(void)
+ {
++	BUILD_BUG_ON(sizeof(struct solos_skb_cb) > sizeof(((struct sk_buff *)0)->cb));
++
+ 	printk(KERN_INFO "Solos PCI Driver Version %s\n", VERSION);
+ 	return pci_register_driver(&fpga_driver);
+ }
+--- a/include/linux/atmdev.h
++++ b/include/linux/atmdev.h
+@@ -307,6 +307,7 @@ struct atm_vcc {
+ 	struct atm_dev	*dev;		/* device back pointer */
+ 	struct atm_qos	qos;		/* QOS */
+ 	struct atm_sap	sap;		/* SAP */
++	void (*release_cb)(struct atm_vcc *vcc); /* release_sock callback */
+ 	void (*push)(struct atm_vcc *vcc,struct sk_buff *skb);
+ 	void (*pop)(struct atm_vcc *vcc,struct sk_buff *skb); /* optional */
+ 	int (*push_oam)(struct atm_vcc *vcc,void *cell);
+@@ -314,6 +315,7 @@ struct atm_vcc {
+ 	void		*dev_data;	/* per-device data */
+ 	void		*proto_data;	/* per-protocol data */
+ 	struct k_atm_aal_stats *stats;	/* pointer to AAL stats group */
++	struct module *owner;		/* owner of ->push function */
+ 	/* SVC part --- may move later ------------------------------------- */
+ 	short		itf;		/* interface number */
+ 	struct sockaddr_atmsvc local;
+--- a/net/atm/br2684.c
++++ b/net/atm/br2684.c
+@@ -68,12 +68,15 @@ struct br2684_vcc {
+ 	/* keep old push, pop functions for chaining */
+ 	void (*old_push)(struct atm_vcc *vcc, struct sk_buff *skb);
+ 	void (*old_pop)(struct atm_vcc *vcc, struct sk_buff *skb);
++	void (*old_release_cb)(struct atm_vcc *vcc);
++	struct module *old_owner;
+ 	enum br2684_encaps encaps;
+ 	struct list_head brvccs;
+ #ifdef CONFIG_ATM_BR2684_IPFILTER
+ 	struct br2684_filter filter;
+ #endif /* CONFIG_ATM_BR2684_IPFILTER */
+ 	unsigned copies_needed, copies_failed;
++	atomic_t qspace;
+ };
+ 
+ struct br2684_dev {
+@@ -181,18 +184,15 @@ static struct notifier_block atm_dev_not
+ static void br2684_pop(struct atm_vcc *vcc, struct sk_buff *skb)
+ {
+ 	struct br2684_vcc *brvcc = BR2684_VCC(vcc);
+-	struct net_device *net_dev = skb->dev;
+ 
+-	pr_debug("(vcc %p ; net_dev %p )\n", vcc, net_dev);
++	pr_debug("(vcc %p ; net_dev %p )\n", vcc, brvcc->device);
+ 	brvcc->old_pop(vcc, skb);
+ 
+-	if (!net_dev)
+-		return;
+-
+-	if (atm_may_send(vcc, 0))
+-		netif_wake_queue(net_dev);
+-
++	/* If the queue space just went up from zero, wake */
++	if (atomic_inc_return(&brvcc->qspace) == 1)
++		netif_wake_queue(brvcc->device);
+ }
++
+ /*
+  * Send a packet out a particular vcc.  Not to useful right now, but paves
+  * the way for multiple vcc's per itf.  Returns true if we can send,
+@@ -256,16 +256,30 @@ static int br2684_xmit_vcc(struct sk_buf
+ 	ATM_SKB(skb)->atm_options = atmvcc->atm_options;
+ 	dev->stats.tx_packets++;
+ 	dev->stats.tx_bytes += skb->len;
+-	atmvcc->send(atmvcc, skb);
+ 
+-	if (!atm_may_send(atmvcc, 0)) {
++	if (atomic_dec_return(&brvcc->qspace) < 1) {
++		/* No more please! */
+ 		netif_stop_queue(brvcc->device);
+-		/*check for race with br2684_pop*/
+-		if (atm_may_send(atmvcc, 0))
+-			netif_start_queue(brvcc->device);
++		/* We might have raced with br2684_pop() */
++		if (unlikely(atomic_read(&brvcc->qspace) > 0))
++			netif_wake_queue(brvcc->device);
+ 	}
+ 
+-	return 1;
++	/* If this fails immediately, the skb will be freed and br2684_pop()
++	   will wake the queue if appropriate. Just return an error so that
++	   the stats are updated correctly */
++	return !atmvcc->send(atmvcc, skb);
++}
++
++static void br2684_release_cb(struct atm_vcc *atmvcc)
++{
++	struct br2684_vcc *brvcc = BR2684_VCC(atmvcc);
++
++	if (atomic_read(&brvcc->qspace) > 0)
++		netif_wake_queue(brvcc->device);
++
++	if (brvcc->old_release_cb)
++		brvcc->old_release_cb(atmvcc);
+ }
+ 
+ static inline struct br2684_vcc *pick_outgoing_vcc(const struct sk_buff *skb,
+@@ -279,6 +293,8 @@ static netdev_tx_t br2684_start_xmit(str
+ {
+ 	struct br2684_dev *brdev = BRPRIV(dev);
+ 	struct br2684_vcc *brvcc;
++	struct atm_vcc *atmvcc;
++	netdev_tx_t ret = NETDEV_TX_OK;
+ 
+ 	pr_debug("skb_dst(skb)=%p\n", skb_dst(skb));
+ 	read_lock(&devs_lock);
+@@ -289,9 +305,26 @@ static netdev_tx_t br2684_start_xmit(str
+ 		dev->stats.tx_carrier_errors++;
+ 		/* netif_stop_queue(dev); */
+ 		dev_kfree_skb(skb);
+-		read_unlock(&devs_lock);
+-		return NETDEV_TX_OK;
++		goto out_devs;
+ 	}
++	atmvcc = brvcc->atmvcc;
++
++	bh_lock_sock(sk_atm(atmvcc));
++
++	if (test_bit(ATM_VF_RELEASED, &atmvcc->flags) ||
++	    test_bit(ATM_VF_CLOSE, &atmvcc->flags) ||
++	    !test_bit(ATM_VF_READY, &atmvcc->flags)) {
++		dev->stats.tx_dropped++;
++		dev_kfree_skb(skb);
++		goto out;
++	}
++
++	if (sock_owned_by_user(sk_atm(atmvcc))) {
++		netif_stop_queue(brvcc->device);
++		ret = NETDEV_TX_BUSY;
++		goto out;
++	}
++
+ 	if (!br2684_xmit_vcc(skb, dev, brvcc)) {
+ 		/*
+ 		 * We should probably use netif_*_queue() here, but that
+@@ -303,8 +336,11 @@ static netdev_tx_t br2684_start_xmit(str
+ 		dev->stats.tx_errors++;
+ 		dev->stats.tx_fifo_errors++;
+ 	}
++ out:
++	bh_unlock_sock(sk_atm(atmvcc));
++ out_devs:
+ 	read_unlock(&devs_lock);
+-	return NETDEV_TX_OK;
++	return ret;
+ }
+ 
+ /*
+@@ -377,9 +413,10 @@ static void br2684_close_vcc(struct br26
+ 	list_del(&brvcc->brvccs);
+ 	write_unlock_irq(&devs_lock);
+ 	brvcc->atmvcc->user_back = NULL;	/* what about vcc->recvq ??? */
++	brvcc->atmvcc->release_cb = brvcc->old_release_cb;
+ 	brvcc->old_push(brvcc->atmvcc, NULL);	/* pass on the bad news */
++	module_put(brvcc->old_owner);
+ 	kfree(brvcc);
+-	module_put(THIS_MODULE);
+ }
+ 
+ /* when AAL5 PDU comes in: */
+@@ -504,6 +541,13 @@ static int br2684_regvcc(struct atm_vcc
+ 	brvcc = kzalloc(sizeof(struct br2684_vcc), GFP_KERNEL);
+ 	if (!brvcc)
+ 		return -ENOMEM;
++	/*
++	 * Allow two packets in the ATM queue. One actually being sent, and one
++	 * for the ATM 'TX done' handler to send. It shouldn't take long to get
++	 * the next one from the netdev queue, when we need it. More than that
++	 * would be bufferbloat.
++	 */
++	atomic_set(&brvcc->qspace, 2);
+ 	write_lock_irq(&devs_lock);
+ 	net_dev = br2684_find_dev(&be.ifspec);
+ 	if (net_dev == NULL) {
+@@ -546,9 +590,13 @@ static int br2684_regvcc(struct atm_vcc
+ 	brvcc->encaps = (enum br2684_encaps)be.encaps;
+ 	brvcc->old_push = atmvcc->push;
+ 	brvcc->old_pop = atmvcc->pop;
++	brvcc->old_release_cb = atmvcc->release_cb;
++	brvcc->old_owner = atmvcc->owner;
+ 	barrier();
+ 	atmvcc->push = br2684_push;
+ 	atmvcc->pop = br2684_pop;
++	atmvcc->release_cb = br2684_release_cb;
++	atmvcc->owner = THIS_MODULE;
+ 
+ 	/* initialize netdev carrier state */
+ 	if (atmvcc->dev->signal == ATM_PHY_SIG_LOST)
+@@ -687,10 +735,13 @@ static int br2684_ioctl(struct socket *s
+ 			return -ENOIOCTLCMD;
+ 		if (!capable(CAP_NET_ADMIN))
+ 			return -EPERM;
+-		if (cmd == ATM_SETBACKEND)
++		if (cmd == ATM_SETBACKEND) {
++			if (sock->state != SS_CONNECTED)
++				return -EINVAL;
+ 			return br2684_regvcc(atmvcc, argp);
+-		else
++		} else {
+ 			return br2684_create(argp);
++		}
+ #ifdef CONFIG_ATM_BR2684_IPFILTER
+ 	case BR2684_SETFILT:
+ 		if (atmvcc->push != br2684_push)
+--- a/net/atm/common.c
++++ b/net/atm/common.c
+@@ -126,10 +126,19 @@ static void vcc_write_space(struct sock
+ 	rcu_read_unlock();
+ }
+ 
++static void vcc_release_cb(struct sock *sk)
++{
++	struct atm_vcc *vcc = atm_sk(sk);
++
++	if (vcc->release_cb)
++		vcc->release_cb(vcc);
++}
++
+ static struct proto vcc_proto = {
+ 	.name	  = "VCC",
+ 	.owner	  = THIS_MODULE,
+ 	.obj_size = sizeof(struct atm_vcc),
++	.release_cb = vcc_release_cb,
+ };
+ 
+ int vcc_create(struct net *net, struct socket *sock, int protocol, int family)
+@@ -156,7 +165,9 @@ int vcc_create(struct net *net, struct s
+ 	atomic_set(&sk->sk_rmem_alloc, 0);
+ 	vcc->push = NULL;
+ 	vcc->pop = NULL;
++	vcc->owner = NULL;
+ 	vcc->push_oam = NULL;
++	vcc->release_cb = NULL;
+ 	vcc->vpi = vcc->vci = 0; /* no VCI/VPI yet */
+ 	vcc->atm_options = vcc->aal_options = 0;
+ 	sk->sk_destruct = vcc_sock_destruct;
+@@ -175,6 +186,7 @@ static void vcc_destroy_socket(struct so
+ 			vcc->dev->ops->close(vcc);
+ 		if (vcc->push)
+ 			vcc->push(vcc, NULL); /* atmarpd has no push */
++		module_put(vcc->owner);
+ 
+ 		while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+ 			atm_return(vcc, skb->truesize);
+--- a/net/atm/pppoatm.c
++++ b/net/atm/pppoatm.c
+@@ -60,6 +60,8 @@ struct pppoatm_vcc {
+ 	struct atm_vcc	*atmvcc;	/* VCC descriptor */
+ 	void (*old_push)(struct atm_vcc *, struct sk_buff *);
+ 	void (*old_pop)(struct atm_vcc *, struct sk_buff *);
++	void (*old_release_cb)(struct atm_vcc *);
++	struct module *old_owner;
+ 					/* keep old push/pop for detaching */
+ 	enum pppoatm_encaps encaps;
+ 	atomic_t inflight;
+@@ -107,6 +109,24 @@ static void pppoatm_wakeup_sender(unsign
+ 	ppp_output_wakeup((struct ppp_channel *) arg);
+ }
+ 
++static void pppoatm_release_cb(struct atm_vcc *atmvcc)
++{
++	struct pppoatm_vcc *pvcc = atmvcc_to_pvcc(atmvcc);
++
++	/*
++	 * As in pppoatm_pop(), it's safe to clear the BLOCKED bit here because
++	 * the wakeup *can't* race with pppoatm_send(). They both hold the PPP
++	 * channel's ->downl lock. And the potential race with *setting* it,
++	 * which leads to the double-check dance in pppoatm_may_send(), doesn't
++	 * exist here. In the sock_owned_by_user() case in pppoatm_send(), we
++	 * set the BLOCKED bit while the socket is still locked. We know that
++	 * ->release_cb() can't be called until that's done.
++	 */
++	if (test_and_clear_bit(BLOCKED, &pvcc->blocked))
++		tasklet_schedule(&pvcc->wakeup_tasklet);
++	if (pvcc->old_release_cb)
++		pvcc->old_release_cb(atmvcc);
++}
+ /*
+  * This gets called every time the ATM card has finished sending our
+  * skb.  The ->old_pop will take care up normal atm flow control,
+@@ -151,12 +171,11 @@ static void pppoatm_unassign_vcc(struct
+ 	pvcc = atmvcc_to_pvcc(atmvcc);
+ 	atmvcc->push = pvcc->old_push;
+ 	atmvcc->pop = pvcc->old_pop;
++	atmvcc->release_cb = pvcc->old_release_cb;
+ 	tasklet_kill(&pvcc->wakeup_tasklet);
+ 	ppp_unregister_channel(&pvcc->chan);
+ 	atmvcc->user_back = NULL;
+ 	kfree(pvcc);
+-	/* Gee, I hope we have the big kernel lock here... */
+-	module_put(THIS_MODULE);
+ }
+ 
+ /* Called when an AAL5 PDU comes in */
+@@ -165,9 +184,13 @@ static void pppoatm_push(struct atm_vcc
+ 	struct pppoatm_vcc *pvcc = atmvcc_to_pvcc(atmvcc);
+ 	pr_debug("\n");
+ 	if (skb == NULL) {			/* VCC was closed */
++		struct module *module;
++
+ 		pr_debug("removing ATMPPP VCC %p\n", pvcc);
++		module = pvcc->old_owner;
+ 		pppoatm_unassign_vcc(atmvcc);
+ 		atmvcc->push(atmvcc, NULL);	/* Pass along bad news */
++		module_put(module);
+ 		return;
+ 	}
+ 	atm_return(atmvcc, skb->truesize);
+@@ -211,7 +234,7 @@ error:
+ 	ppp_input_error(&pvcc->chan, 0);
+ }
+ 
+-static inline int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
++static int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
+ {
+ 	/*
+ 	 * It's not clear that we need to bother with using atm_may_send()
+@@ -269,10 +292,33 @@ static inline int pppoatm_may_send(struc
+ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
+ {
+ 	struct pppoatm_vcc *pvcc = chan_to_pvcc(chan);
++	struct atm_vcc *vcc;
++	int ret;
++
+ 	ATM_SKB(skb)->vcc = pvcc->atmvcc;
+ 	pr_debug("(skb=0x%p, vcc=0x%p)\n", skb, pvcc->atmvcc);
+ 	if (skb->data[0] == '\0' && (pvcc->flags & SC_COMP_PROT))
+ 		(void) skb_pull(skb, 1);
++
++	vcc = ATM_SKB(skb)->vcc;
++	bh_lock_sock(sk_atm(vcc));
++	if (sock_owned_by_user(sk_atm(vcc))) {
++		/*
++		 * Needs to happen (and be flushed, hence test_and_) before we unlock
++		 * the socket. It needs to be seen by the time our ->release_cb gets
++		 * called.
++		 */
++		test_and_set_bit(BLOCKED, &pvcc->blocked);
++		goto nospace;
++	}
++	if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
++	    test_bit(ATM_VF_CLOSE, &vcc->flags) ||
++	    !test_bit(ATM_VF_READY, &vcc->flags)) {
++		bh_unlock_sock(sk_atm(vcc));
++		kfree_skb(skb);
++		return DROP_PACKET;
++	}
++
+ 	switch (pvcc->encaps) {		/* LLC encapsulation needed */
+ 	case e_llc:
+ 		if (skb_headroom(skb) < LLC_LEN) {
+@@ -285,8 +331,10 @@ static int pppoatm_send(struct ppp_chann
+ 			}
+ 			kfree_skb(skb);
+ 			skb = n;
+-			if (skb == NULL)
++			if (skb == NULL) {
++				bh_unlock_sock(sk_atm(vcc));
+ 				return DROP_PACKET;
++			}
+ 		} else if (!pppoatm_may_send(pvcc, skb->truesize))
+ 			goto nospace;
+ 		memcpy(skb_push(skb, LLC_LEN), pppllc, LLC_LEN);
+@@ -296,6 +344,7 @@ static int pppoatm_send(struct ppp_chann
+ 			goto nospace;
+ 		break;
+ 	case e_autodetect:
++		bh_unlock_sock(sk_atm(vcc));
+ 		pr_debug("Trying to send without setting encaps!\n");
+ 		kfree_skb(skb);
+ 		return 1;
+@@ -305,9 +354,12 @@ static int pppoatm_send(struct ppp_chann
+ 	ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options;
+ 	pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n",
+ 		 skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev);
+-	return ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
++	ret = ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
+ 	    ? DROP_PACKET : 1;
++	bh_unlock_sock(sk_atm(vcc));
++	return ret;
+ nospace:
++	bh_unlock_sock(sk_atm(vcc));
+ 	/*
+ 	 * We don't have space to send this SKB now, but we might have
+ 	 * already applied SC_COMP_PROT compression, so may need to undo
+@@ -362,6 +414,8 @@ static int pppoatm_assign_vcc(struct atm
+ 	atomic_set(&pvcc->inflight, NONE_INFLIGHT);
+ 	pvcc->old_push = atmvcc->push;
+ 	pvcc->old_pop = atmvcc->pop;
++	pvcc->old_owner = atmvcc->owner;
++	pvcc->old_release_cb = atmvcc->release_cb;
+ 	pvcc->encaps = (enum pppoatm_encaps) be.encaps;
+ 	pvcc->chan.private = pvcc;
+ 	pvcc->chan.ops = &pppoatm_ops;
+@@ -377,7 +431,9 @@ static int pppoatm_assign_vcc(struct atm
+ 	atmvcc->user_back = pvcc;
+ 	atmvcc->push = pppoatm_push;
+ 	atmvcc->pop = pppoatm_pop;
++	atmvcc->release_cb = pppoatm_release_cb;
+ 	__module_get(THIS_MODULE);
++	atmvcc->owner = THIS_MODULE;
+ 
+ 	/* re-process everything received between connection setup and
+ 	   backend setup */
+@@ -406,6 +462,8 @@ static int pppoatm_ioctl(struct socket *
+ 			return -ENOIOCTLCMD;
+ 		if (!capable(CAP_NET_ADMIN))
+ 			return -EPERM;
++		if (sock->state != SS_CONNECTED)
++			return -EINVAL;
+ 		return pppoatm_assign_vcc(atmvcc, argp);
+ 		}
+ 	case PPPIOCGCHAN:
diff --git a/target/linux/generic/patches-3.3/132-solos-dma.patch b/target/linux/generic/patches-3.3/132-solos-dma.patch
new file mode 100644
index 0000000..beba891
--- /dev/null
+++ b/target/linux/generic/patches-3.3/132-solos-dma.patch
@@ -0,0 +1,442 @@
+commit b4bd8ad9bb311e8536f726f7a633620ccd358cde
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Thu May 24 04:58:27 2012 +0000
+
+    solos-pci: Fix DMA support
+    
+    DMA support has finally made its way to the top of the TODO list, having
+    realised that a Geode using MMIO can't keep up with two ADSL2+ lines
+    each running at 21Mb/s.
+    
+    This patch fixes a couple of bugs in the DMA support in the driver, so
+    once the corresponding FPGA update is complete and tested everything
+    should work properly.
+    
+    We weren't storing the currently-transmitting skb, so we were never
+    unmapping it and never freeing/popping it when the TX was done.
+    And the addition of pci_set_master() is fairly self-explanatory.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Cc: stable@kernel.org
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 152a2a8b5e1d4cbe91a7c66f1028db15164a3766
+Author: David Woodhouse <David.Woodhouse@intel.com>
+Date:   Wed Dec 19 11:01:21 2012 +0000
+
+    solos-pci: ensure all TX packets are aligned to 4 bytes
+    
+    The FPGA can't handled unaligned DMA (yet). So copy into an aligned buffer,
+    if skb->data isn't suitably aligned.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 13af816469db3449c072afbae6c4c1bd9ccecccb
+Author: Nathan Williams <nathan@traverse.com.au>
+Date:   Wed Dec 19 11:01:20 2012 +0000
+
+    solos-pci: add firmware upgrade support for new models
+    
+    Signed-off-by: Nathan Williams <nathan@traverse.com.au>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit 7fbdadb5e951e4f0c0fc991ff5f50295568786e6
+Author: Nathan Williams <nathan@traverse.com.au>
+Date:   Wed Dec 19 11:01:19 2012 +0000
+
+    solos-pci: remove superfluous debug output
+    
+    Signed-off-by: Nathan Williams <nathan@traverse.com.au>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit f9baad02e7411d9f38d5ebe1a1cdcde4ceec100d
+Author: Nathan Williams <nathan@traverse.com.au>
+Date:   Wed Dec 19 11:01:18 2012 +0000
+
+    solos-pci: add GPIO support for newer versions on Geos board
+    
+    dwmw2: Tidy up a little, simpler matching on which GPIO is being accessed,
+           only register on newer boards, register under PCI device instead of
+           duplicating them under each ATM device.
+    
+    Signed-off-by: Nathan Williams <nathan@traverse.com.au>
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+commit cae49ede00ec3d0cda290b03fee55b72b49efc11
+Author: David Woodhouse <dwmw2@infradead.org>
+Date:   Tue Dec 11 14:57:14 2012 +0000
+
+    solos-pci: fix double-free of TX skb in DMA mode
+    
+    We weren't clearing card->tx_skb[port] when processing the TX done interrupt.
+    If there wasn't another skb ready to transmit immediately, this led to a
+    double-free because we'd free it *again* next time we did have a packet to
+    send.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+    Cc: stable@kernel.org
+    Signed-off-by: David S. Miller <davem@davemloft.net>
+
+==
+There is a typo here so we do a double lock instead of an unlock.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+---
+Only needed in linux-next.  Introduced in f9baad02e7411d9 [14/17]
+solos-pci: add GPIO support for newer versions on Geos board
+
+
+--- a/drivers/atm/solos-pci.c
++++ b/drivers/atm/solos-pci.c
+@@ -42,7 +42,8 @@
+ #include <linux/swab.h>
+ #include <linux/slab.h>
+ 
+-#define VERSION "0.07"
++#define VERSION "1.04"
++#define DRIVER_VERSION 0x01
+ #define PTAG "solos-pci"
+ 
+ #define CONFIG_RAM_SIZE	128
+@@ -56,16 +57,21 @@
+ #define FLASH_BUSY	0x60
+ #define FPGA_MODE	0x5C
+ #define FLASH_MODE	0x58
++#define GPIO_STATUS	0x54
++#define DRIVER_VER	0x50
+ #define TX_DMA_ADDR(port)	(0x40 + (4 * (port)))
+ #define RX_DMA_ADDR(port)	(0x30 + (4 * (port)))
+ 
+ #define DATA_RAM_SIZE	32768
+ #define BUF_SIZE	2048
+ #define OLD_BUF_SIZE	4096 /* For FPGA versions <= 2*/
+-#define FPGA_PAGE	528 /* FPGA flash page size*/
+-#define SOLOS_PAGE	512 /* Solos flash page size*/
+-#define FPGA_BLOCK	(FPGA_PAGE * 8) /* FPGA flash block size*/
+-#define SOLOS_BLOCK	(SOLOS_PAGE * 8) /* Solos flash block size*/
++/* Old boards use ATMEL AD45DB161D flash */
++#define ATMEL_FPGA_PAGE	528 /* FPGA flash page size*/
++#define ATMEL_SOLOS_PAGE	512 /* Solos flash page size*/
++#define ATMEL_FPGA_BLOCK	(ATMEL_FPGA_PAGE * 8) /* FPGA block size*/
++#define ATMEL_SOLOS_BLOCK	(ATMEL_SOLOS_PAGE * 8) /* Solos block size*/
++/* Current boards use M25P/M25PE SPI flash */
++#define SPI_FLASH_BLOCK	(256 * 64)
+ 
+ #define RX_BUF(card, nr) ((card->buffers) + (nr)*(card->buffer_size)*2)
+ #define TX_BUF(card, nr) ((card->buffers) + (nr)*(card->buffer_size)*2 + (card->buffer_size))
+@@ -123,11 +129,14 @@ struct solos_card {
+ 	struct sk_buff_head cli_queue[4];
+ 	struct sk_buff *tx_skb[4];
+ 	struct sk_buff *rx_skb[4];
++	unsigned char *dma_bounce;
+ 	wait_queue_head_t param_wq;
+ 	wait_queue_head_t fw_wq;
+ 	int using_dma;
++	int dma_alignment;
+ 	int fpga_version;
+ 	int buffer_size;
++	int atmel_flash;
+ };
+ 
+ 
+@@ -452,7 +461,6 @@ static ssize_t console_show(struct devic
+ 
+ 	len = skb->len;
+ 	memcpy(buf, skb->data, len);
+-	dev_dbg(&card->dev->dev, "len: %d\n", len);
+ 
+ 	kfree_skb(skb);
+ 	return len;
+@@ -499,6 +507,78 @@ static ssize_t console_store(struct devi
+ 	return err?:count;
+ }
+ 
++struct geos_gpio_attr {
++	struct device_attribute attr;
++	int offset;
++};
++
++#define SOLOS_GPIO_ATTR(_name, _mode, _show, _store, _offset)	\
++	struct geos_gpio_attr gpio_attr_##_name = {		\
++		.attr = __ATTR(_name, _mode, _show, _store),	\
++		.offset = _offset }
++
++static ssize_t geos_gpio_store(struct device *dev, struct device_attribute *attr,
++			       const char *buf, size_t count)
++{
++	struct pci_dev *pdev = container_of(dev, struct pci_dev, dev);
++	struct geos_gpio_attr *gattr = container_of(attr, struct geos_gpio_attr, attr);
++	struct solos_card *card = pci_get_drvdata(pdev);
++	uint32_t data32;
++
++	if (count != 1 && (count != 2 || buf[1] != '\n'))
++		return -EINVAL;
++
++	spin_lock_irq(&card->param_queue_lock);
++	data32 = ioread32(card->config_regs + GPIO_STATUS);
++	if (buf[0] == '1') {
++		data32 |= 1 << gattr->offset;
++		iowrite32(data32, card->config_regs + GPIO_STATUS);
++	} else if (buf[0] == '0') {
++		data32 &= ~(1 << gattr->offset);
++		iowrite32(data32, card->config_regs + GPIO_STATUS);
++	} else {
++		count = -EINVAL;
++	}
++	spin_unlock_irq(&card->param_queue_lock);
++	return count;
++}
++
++static ssize_t geos_gpio_show(struct device *dev, struct device_attribute *attr,
++			      char *buf)
++{
++	struct pci_dev *pdev = container_of(dev, struct pci_dev, dev);
++	struct geos_gpio_attr *gattr = container_of(attr, struct geos_gpio_attr, attr);
++	struct solos_card *card = pci_get_drvdata(pdev);
++	uint32_t data32;
++
++	data32 = ioread32(card->config_regs + GPIO_STATUS);
++	data32 = (data32 >> gattr->offset) & 1;
++
++	return sprintf(buf, "%d\n", data32);
++}
++
++static ssize_t hardware_show(struct device *dev, struct device_attribute *attr,
++			     char *buf)
++{
++	struct pci_dev *pdev = container_of(dev, struct pci_dev, dev);
++	struct geos_gpio_attr *gattr = container_of(attr, struct geos_gpio_attr, attr);
++	struct solos_card *card = pci_get_drvdata(pdev);
++	uint32_t data32;
++
++	data32 = ioread32(card->config_regs + GPIO_STATUS);
++	switch (gattr->offset) {
++	case 0:
++		/* HardwareVersion */
++		data32 = data32 & 0x1F;
++		break;
++	case 1:
++		/* HardwareVariant */
++		data32 = (data32 >> 5) & 0x0F;
++		break;
++	}
++	return sprintf(buf, "%d\n", data32);
++}
++
+ static DEVICE_ATTR(console, 0644, console_show, console_store);
+ 
+ 
+@@ -507,6 +587,14 @@ static DEVICE_ATTR(console, 0644, consol
+ 
+ #include "solos-attrlist.c"
+ 
++static SOLOS_GPIO_ATTR(GPIO1, 0644, geos_gpio_show, geos_gpio_store, 9);
++static SOLOS_GPIO_ATTR(GPIO2, 0644, geos_gpio_show, geos_gpio_store, 10);
++static SOLOS_GPIO_ATTR(GPIO3, 0644, geos_gpio_show, geos_gpio_store, 11);
++static SOLOS_GPIO_ATTR(GPIO4, 0644, geos_gpio_show, geos_gpio_store, 12);
++static SOLOS_GPIO_ATTR(GPIO5, 0644, geos_gpio_show, geos_gpio_store, 13);
++static SOLOS_GPIO_ATTR(PushButton, 0444, geos_gpio_show, NULL, 14);
++static SOLOS_GPIO_ATTR(HardwareVersion, 0444, hardware_show, NULL, 0);
++static SOLOS_GPIO_ATTR(HardwareVariant, 0444, hardware_show, NULL, 1);
+ #undef SOLOS_ATTR_RO
+ #undef SOLOS_ATTR_RW
+ 
+@@ -523,6 +611,23 @@ static struct attribute_group solos_attr
+ 	.name = "parameters",
+ };
+ 
++static struct attribute *gpio_attrs[] = {
++	&gpio_attr_GPIO1.attr.attr,
++	&gpio_attr_GPIO2.attr.attr,
++	&gpio_attr_GPIO3.attr.attr,
++	&gpio_attr_GPIO4.attr.attr,
++	&gpio_attr_GPIO5.attr.attr,
++	&gpio_attr_PushButton.attr.attr,
++	&gpio_attr_HardwareVersion.attr.attr,
++	&gpio_attr_HardwareVariant.attr.attr,
++	NULL
++};
++
++static struct attribute_group gpio_attr_group = {
++	.attrs = gpio_attrs,
++	.name = "gpio",
++};
++
+ static int flash_upgrade(struct solos_card *card, int chip)
+ {
+ 	const struct firmware *fw;
+@@ -534,16 +639,25 @@ static int flash_upgrade(struct solos_ca
+ 	switch (chip) {
+ 	case 0:
+ 		fw_name = "solos-FPGA.bin";
+-		blocksize = FPGA_BLOCK;
++		if (card->atmel_flash)
++			blocksize = ATMEL_FPGA_BLOCK;
++		else
++			blocksize = SPI_FLASH_BLOCK;
+ 		break;
+ 	case 1:
+ 		fw_name = "solos-Firmware.bin";
+-		blocksize = SOLOS_BLOCK;
++		if (card->atmel_flash)
++			blocksize = ATMEL_SOLOS_BLOCK;
++		else
++			blocksize = SPI_FLASH_BLOCK;
+ 		break;
+ 	case 2:
+ 		if (card->fpga_version > LEGACY_BUFFERS){
+ 			fw_name = "solos-db-FPGA.bin";
+-			blocksize = FPGA_BLOCK;
++			if (card->atmel_flash)
++				blocksize = ATMEL_FPGA_BLOCK;
++			else
++				blocksize = SPI_FLASH_BLOCK;
+ 		} else {
+ 			dev_info(&card->dev->dev, "FPGA version doesn't support"
+ 					" daughter board upgrades\n");
+@@ -553,7 +667,10 @@ static int flash_upgrade(struct solos_ca
+ 	case 3:
+ 		if (card->fpga_version > LEGACY_BUFFERS){
+ 			fw_name = "solos-Firmware.bin";
+-			blocksize = SOLOS_BLOCK;
++			if (card->atmel_flash)
++				blocksize = ATMEL_SOLOS_BLOCK;
++			else
++				blocksize = SPI_FLASH_BLOCK;
+ 		} else {
+ 			dev_info(&card->dev->dev, "FPGA version doesn't support"
+ 					" daughter board upgrades\n");
+@@ -569,6 +686,9 @@ static int flash_upgrade(struct solos_ca
+ 
+ 	dev_info(&card->dev->dev, "Flash upgrade starting\n");
+ 
++	/* New FPGAs require driver version before permitting flash upgrades */
++	iowrite32(DRIVER_VERSION, card->config_regs + DRIVER_VER);
++
+ 	numblocks = fw->size / blocksize;
+ 	dev_info(&card->dev->dev, "Firmware size: %zd\n", fw->size);
+ 	dev_info(&card->dev->dev, "Number of blocks: %d\n", numblocks);
+@@ -598,9 +718,13 @@ static int flash_upgrade(struct solos_ca
+ 		/* dev_info(&card->dev->dev, "Set FPGA Flash mode to Block Write\n"); */
+ 		iowrite32(((chip * 2) + 1), card->config_regs + FLASH_MODE);
+ 
+-		/* Copy block to buffer, swapping each 16 bits */
++		/* Copy block to buffer, swapping each 16 bits for Atmel flash */
+ 		for(i = 0; i < blocksize; i += 4) {
+-			uint32_t word = swahb32p((uint32_t *)(fw->data + offset + i));
++			uint32_t word;
++			if (card->atmel_flash)
++				word = swahb32p((uint32_t *)(fw->data + offset + i));
++			else
++				word = *(uint32_t *)(fw->data + offset + i);
+ 			if(card->fpga_version > LEGACY_BUFFERS)
+ 				iowrite32(word, FLASH_BUF + i);
+ 			else
+@@ -945,10 +1069,11 @@ static uint32_t fpga_tx(struct solos_car
+ 	for (port = 0; tx_pending; tx_pending >>= 1, port++) {
+ 		if (tx_pending & 1) {
+ 			struct sk_buff *oldskb = card->tx_skb[port];
+-			if (oldskb)
++			if (oldskb) {
+ 				pci_unmap_single(card->dev, SKB_CB(oldskb)->dma_addr,
+ 						 oldskb->len, PCI_DMA_TODEVICE);
+-
++				card->tx_skb[port] = NULL;
++			}
+ 			spin_lock(&card->tx_queue_lock);
+ 			skb = skb_dequeue(&card->tx_queue[port]);
+ 			if (!skb)
+@@ -960,8 +1085,14 @@ static uint32_t fpga_tx(struct solos_car
+ 				tx_started |= 1 << port;
+ 				oldskb = skb; /* We're done with this skb already */
+ 			} else if (skb && card->using_dma) {
+-				SKB_CB(skb)->dma_addr = pci_map_single(card->dev, skb->data,
++				unsigned char *data = skb->data;
++				if ((unsigned long)data & card->dma_alignment) {
++					data = card->dma_bounce + (BUF_SIZE * port);
++					memcpy(data, skb->data, skb->len);
++				}
++				SKB_CB(skb)->dma_addr = pci_map_single(card->dev, data,
+ 								       skb->len, PCI_DMA_TODEVICE);
++				card->tx_skb[port] = skb;
+ 				iowrite32(SKB_CB(skb)->dma_addr,
+ 					  card->config_regs + TX_DMA_ADDR(port));
+ 			}
+@@ -1133,17 +1264,33 @@ static int fpga_probe(struct pci_dev *de
+ 		db_fpga_upgrade = db_firmware_upgrade = 0;
+ 	}
+ 
+-	if (card->fpga_version >= DMA_SUPPORTED){
++	/* Stopped using Atmel flash after 0.03-38 */
++	if (fpga_ver < 39)
++		card->atmel_flash = 1;
++	else
++		card->atmel_flash = 0;
++
++	data32 = ioread32(card->config_regs + PORTS);
++	card->nr_ports = (data32 & 0x000000FF);
++
++	if (card->fpga_version >= DMA_SUPPORTED) {
++		pci_set_master(dev);
+ 		card->using_dma = 1;
++		if (1) { /* All known FPGA versions so far */
++			card->dma_alignment = 3;
++			card->dma_bounce = kmalloc(card->nr_ports * BUF_SIZE, GFP_KERNEL);
++			if (!card->dma_bounce) {
++				dev_warn(&card->dev->dev, "Failed to allocate DMA bounce buffers\n");
++				/* Fallback to MMIO doesn't work */
++				goto out_unmap_both;
++			}
++		}
+ 	} else {
+ 		card->using_dma = 0;
+ 		/* Set RX empty flag for all ports */
+ 		iowrite32(0xF0, card->config_regs + FLAGS_ADDR);
+ 	}
+ 
+-	data32 = ioread32(card->config_regs + PORTS);
+-	card->nr_ports = (data32 & 0x000000FF);
+-
+ 	pci_set_drvdata(dev, card);
+ 
+ 	tasklet_init(&card->tlet, solos_bh, (unsigned long)card);
+@@ -1178,6 +1325,10 @@ static int fpga_probe(struct pci_dev *de
+ 	if (err)
+ 		goto out_free_irq;
+ 
++	if (card->fpga_version >= DMA_SUPPORTED &&
++	    sysfs_create_group(&card->dev->dev.kobj, &gpio_attr_group))
++		dev_err(&card->dev->dev, "Could not register parameter group for GPIOs\n");
++
+ 	return 0;
+ 
+  out_free_irq:
+@@ -1186,6 +1337,7 @@ static int fpga_probe(struct pci_dev *de
+ 	tasklet_kill(&card->tlet);
+ 	
+  out_unmap_both:
++	kfree(card->dma_bounce);
+ 	pci_set_drvdata(dev, NULL);
+ 	pci_iounmap(dev, card->buffers);
+  out_unmap_config:
+@@ -1288,11 +1440,16 @@ static void fpga_remove(struct pci_dev *
+ 	iowrite32(1, card->config_regs + FPGA_MODE);
+ 	(void)ioread32(card->config_regs + FPGA_MODE); 
+ 
++	if (card->fpga_version >= DMA_SUPPORTED)
++		sysfs_remove_group(&card->dev->dev.kobj, &gpio_attr_group);
++
+ 	atm_remove(card);
+ 
+ 	free_irq(dev->irq, card);
+ 	tasklet_kill(&card->tlet);
+ 
++	kfree(card->dma_bounce);
++
+ 	/* Release device from reset */
+ 	iowrite32(0, card->config_regs + FPGA_MODE);
+ 	(void)ioread32(card->config_regs + FPGA_MODE); 
diff --git a/target/linux/generic/patches-3.3/140-ixp4xx_hss_module_h_include.patch b/target/linux/generic/patches-3.3/140-ixp4xx_hss_module_h_include.patch
new file mode 100644
index 0000000..94acf37
--- /dev/null
+++ b/target/linux/generic/patches-3.3/140-ixp4xx_hss_module_h_include.patch
@@ -0,0 +1,39 @@
+From 32e857cd1fbb006f56a99a2eab998173b1576533 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <florian@openwrt.org>
+Date: Mon, 10 Sep 2012 10:18:57 +0200
+Subject: [PATCH net] ixp4xx_hss: fix build failure after logging conversion
+
+Commit c75bb2c6f0cf455c23e60f14d780e841dd47f801 (ixp4xx_hss: Update to
+current logging forms) converted the ixp4xx_hss module to use the current
+logging macros, but forgot to include linux/module.h, leading to the
+following build failures:
+
+  CC [M]  drivers/net/wan/ixp4xx_hss.o
+ drivers/net/wan/ixp4xx_hss.c:1412:20: error: expected ';', ',' or ')'
+ before string constant
+ drivers/net/wan/ixp4xx_hss.c:1413:25: error: expected ';', ',' or ')'
+ before string constant
+ drivers/net/wan/ixp4xx_hss.c:1414:21: error: expected ';', ',' or ')'
+ before string constant
+ drivers/net/wan/ixp4xx_hss.c:1415:19: error: expected ';', ',' or ')'
+ before string constant
+ make[8]: *** [drivers/net/wan/ixp4xx_hss.o] Error 1
+
+CC: stable@vger.kernel.org
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+---
+[stable: 3.1+]
+
+ drivers/net/wan/ixp4xx_hss.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wan/ixp4xx_hss.c
++++ b/drivers/net/wan/ixp4xx_hss.c
+@@ -10,6 +10,7 @@
+ 
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+ 
++#include <linux/module.h>
+ #include <linux/bitops.h>
+ #include <linux/cdev.h>
+ #include <linux/dma-mapping.h>
diff --git a/target/linux/generic/patches-3.3/200-fix_localversion.patch b/target/linux/generic/patches-3.3/200-fix_localversion.patch
new file mode 100644
index 0000000..0d1bae8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/200-fix_localversion.patch
@@ -0,0 +1,11 @@
+--- a/scripts/setlocalversion
++++ b/scripts/setlocalversion
+@@ -168,7 +168,7 @@ else
+ 	# annotated or signed tagged state (as git describe only
+ 	# looks at signed or annotated tags - git tag -a/-s) and
+ 	# LOCALVERSION= is not specified
+-	if test "${LOCALVERSION+set}" != "set"; then
++	if test "${CONFIG_LOCALVERSION+set}" != "set"; then
+ 		scm=$(scm_version --short)
+ 		res="$res${scm:++}"
+ 	fi
diff --git a/target/linux/generic/patches-3.3/201-extra_optimization.patch b/target/linux/generic/patches-3.3/201-extra_optimization.patch
new file mode 100644
index 0000000..6fe8b09
--- /dev/null
+++ b/target/linux/generic/patches-3.3/201-extra_optimization.patch
@@ -0,0 +1,24 @@
+--- a/Makefile
++++ b/Makefile
+@@ -559,9 +559,9 @@ endif # $(dot-config)
+ all: vmlinux
+ 
+ ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+-KBUILD_CFLAGS	+= -Os
++KBUILD_CFLAGS	+= -Os -fno-caller-saves
+ else
+-KBUILD_CFLAGS	+= -O2
++KBUILD_CFLAGS	+= -O2 -fno-reorder-blocks -fno-tree-ch -fno-caller-saves
+ endif
+ 
+ include $(srctree)/arch/$(SRCARCH)/Makefile
+@@ -620,6 +620,9 @@ endif
+ NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)
+ CHECKFLAGS     += $(NOSTDINC_FLAGS)
+ 
++# improve gcc optimization
++CFLAGS += $(call cc-option,-funit-at-a-time,)
++
+ # warn about C99 declaration after statement
+ KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
+ 
diff --git a/target/linux/generic/patches-3.3/202-reduce_module_size.patch b/target/linux/generic/patches-3.3/202-reduce_module_size.patch
new file mode 100644
index 0000000..bca1e35
--- /dev/null
+++ b/target/linux/generic/patches-3.3/202-reduce_module_size.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -374,7 +374,7 @@ KBUILD_CFLAGS_KERNEL :=
+ KBUILD_AFLAGS   := -D__ASSEMBLY__
+ KBUILD_AFLAGS_MODULE  := -DMODULE
+ KBUILD_CFLAGS_MODULE  := -DMODULE
+-KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds
++KBUILD_LDFLAGS_MODULE = -T $(srctree)/scripts/module-common.lds $(if $(CONFIG_PROFILING),,-s)
+ 
+ # Read KERNELRELEASE from include/config/kernel.release (if it exists)
+ KERNELRELEASE = $(shell cat include/config/kernel.release 2> /dev/null)
diff --git a/target/linux/generic/patches-3.3/210-darwin_scripts_include.patch b/target/linux/generic/patches-3.3/210-darwin_scripts_include.patch
new file mode 100644
index 0000000..ccaf142
--- /dev/null
+++ b/target/linux/generic/patches-3.3/210-darwin_scripts_include.patch
@@ -0,0 +1,3088 @@
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -22,6 +22,35 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <ctype.h>
++#ifdef __APPLE__
++/* Darwin has no memmem implementation, this one is ripped of the uClibc-0.9.28 source */
++void *memmem (const void *haystack, size_t haystack_len,
++                          const void *needle,  size_t needle_len)
++{
++  const char *begin;
++  const char *const last_possible
++    = (const char *) haystack + haystack_len - needle_len;
++
++  if (needle_len == 0)
++    /* The first occurrence of the empty string is deemed to occur at
++       the beginning of the string.  */
++    return (void *) haystack;
++
++  /* Sanity check, otherwise the loop might search through the whole
++     memory.  */
++  if (__builtin_expect (haystack_len < needle_len, 0))
++    return NULL;
++
++  for (begin = (const char *) haystack; begin <= last_possible; ++begin)
++    if (begin[0] == ((const char *) needle)[0] &&
++        !memcmp ((const void *) &begin[1],
++                 (const void *) ((const char *) needle + 1),
++                 needle_len - 1))
++      return (void *) begin;
++
++  return NULL;
++}
++#endif
+ 
+ #ifndef ARRAY_SIZE
+ #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof(arr[0]))
+--- a/scripts/kconfig/Makefile
++++ b/scripts/kconfig/Makefile
+@@ -123,6 +123,9 @@ check-lxdialog  := $(srctree)/$(src)/lxd
+ # we really need to do so. (Do not call gcc as part of make mrproper)
+ HOST_EXTRACFLAGS += $(shell $(CONFIG_SHELL) $(check-lxdialog) -ccflags) \
+                     -DLOCALE
++ifeq ($(shell uname -s),Darwin)
++HOST_LOADLIBES  += -lncurses
++endif
+ 
+ # ===========================================================================
+ # Shared Makefile for the various kconfig executables:
+--- a/scripts/mod/mk_elfconfig.c
++++ b/scripts/mod/mk_elfconfig.c
+@@ -1,7 +1,11 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#ifndef __APPLE__
+ #include <elf.h>
++#else
++#include "elf.h"
++#endif
+ 
+ int
+ main(int argc, char **argv)
+--- a/scripts/mod/modpost.h
++++ b/scripts/mod/modpost.h
+@@ -7,7 +7,11 @@
+ #include <sys/mman.h>
+ #include <fcntl.h>
+ #include <unistd.h>
++#if !(defined(__APPLE__) || defined(__CYGWIN__))
+ #include <elf.h>
++#else
++#include "elf.h"
++#endif
+ 
+ #include "elfconfig.h"
+ 
+--- /dev/null
++++ b/scripts/mod/elf.h
+@@ -0,0 +1,3007 @@
++/* This file defines standard ELF types, structures, and macros.
++   Copyright (C) 1995-2012 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <http://www.gnu.org/licenses/>.  */
++
++#ifndef _ELF_H
++#define	_ELF_H 1
++
++/* Standard ELF types.  */
++
++#include <stdint.h>
++
++/* Type for a 16-bit quantity.  */
++typedef uint16_t Elf32_Half;
++typedef uint16_t Elf64_Half;
++
++/* Types for signed and unsigned 32-bit quantities.  */
++typedef uint32_t Elf32_Word;
++typedef	int32_t  Elf32_Sword;
++typedef uint32_t Elf64_Word;
++typedef	int32_t  Elf64_Sword;
++
++/* Types for signed and unsigned 64-bit quantities.  */
++typedef uint64_t Elf32_Xword;
++typedef	int64_t  Elf32_Sxword;
++typedef uint64_t Elf64_Xword;
++typedef	int64_t  Elf64_Sxword;
++
++/* Type of addresses.  */
++typedef uint32_t Elf32_Addr;
++typedef uint64_t Elf64_Addr;
++
++/* Type of file offsets.  */
++typedef uint32_t Elf32_Off;
++typedef uint64_t Elf64_Off;
++
++/* Type for section indices, which are 16-bit quantities.  */
++typedef uint16_t Elf32_Section;
++typedef uint16_t Elf64_Section;
++
++/* Type for version symbol information.  */
++typedef Elf32_Half Elf32_Versym;
++typedef Elf64_Half Elf64_Versym;
++
++
++/* The ELF file header.  This appears at the start of every ELF file.  */
++
++#define EI_NIDENT (16)
++
++typedef struct
++{
++  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
++  Elf32_Half	e_type;			/* Object file type */
++  Elf32_Half	e_machine;		/* Architecture */
++  Elf32_Word	e_version;		/* Object file version */
++  Elf32_Addr	e_entry;		/* Entry point virtual address */
++  Elf32_Off	e_phoff;		/* Program header table file offset */
++  Elf32_Off	e_shoff;		/* Section header table file offset */
++  Elf32_Word	e_flags;		/* Processor-specific flags */
++  Elf32_Half	e_ehsize;		/* ELF header size in bytes */
++  Elf32_Half	e_phentsize;		/* Program header table entry size */
++  Elf32_Half	e_phnum;		/* Program header table entry count */
++  Elf32_Half	e_shentsize;		/* Section header table entry size */
++  Elf32_Half	e_shnum;		/* Section header table entry count */
++  Elf32_Half	e_shstrndx;		/* Section header string table index */
++} Elf32_Ehdr;
++
++typedef struct
++{
++  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
++  Elf64_Half	e_type;			/* Object file type */
++  Elf64_Half	e_machine;		/* Architecture */
++  Elf64_Word	e_version;		/* Object file version */
++  Elf64_Addr	e_entry;		/* Entry point virtual address */
++  Elf64_Off	e_phoff;		/* Program header table file offset */
++  Elf64_Off	e_shoff;		/* Section header table file offset */
++  Elf64_Word	e_flags;		/* Processor-specific flags */
++  Elf64_Half	e_ehsize;		/* ELF header size in bytes */
++  Elf64_Half	e_phentsize;		/* Program header table entry size */
++  Elf64_Half	e_phnum;		/* Program header table entry count */
++  Elf64_Half	e_shentsize;		/* Section header table entry size */
++  Elf64_Half	e_shnum;		/* Section header table entry count */
++  Elf64_Half	e_shstrndx;		/* Section header string table index */
++} Elf64_Ehdr;
++
++/* Fields in the e_ident array.  The EI_* macros are indices into the
++   array.  The macros under each EI_* macro are the values the byte
++   may have.  */
++
++#define EI_MAG0		0		/* File identification byte 0 index */
++#define ELFMAG0		0x7f		/* Magic number byte 0 */
++
++#define EI_MAG1		1		/* File identification byte 1 index */
++#define ELFMAG1		'E'		/* Magic number byte 1 */
++
++#define EI_MAG2		2		/* File identification byte 2 index */
++#define ELFMAG2		'L'		/* Magic number byte 2 */
++
++#define EI_MAG3		3		/* File identification byte 3 index */
++#define ELFMAG3		'F'		/* Magic number byte 3 */
++
++/* Conglomeration of the identification bytes, for easy testing as a word.  */
++#define	ELFMAG		"\177ELF"
++#define	SELFMAG		4
++
++#define EI_CLASS	4		/* File class byte index */
++#define ELFCLASSNONE	0		/* Invalid class */
++#define ELFCLASS32	1		/* 32-bit objects */
++#define ELFCLASS64	2		/* 64-bit objects */
++#define ELFCLASSNUM	3
++
++#define EI_DATA		5		/* Data encoding byte index */
++#define ELFDATANONE	0		/* Invalid data encoding */
++#define ELFDATA2LSB	1		/* 2's complement, little endian */
++#define ELFDATA2MSB	2		/* 2's complement, big endian */
++#define ELFDATANUM	3
++
++#define EI_VERSION	6		/* File version byte index */
++					/* Value must be EV_CURRENT */
++
++#define EI_OSABI	7		/* OS ABI identification */
++#define ELFOSABI_NONE		0	/* UNIX System V ABI */
++#define ELFOSABI_SYSV		0	/* Alias.  */
++#define ELFOSABI_HPUX		1	/* HP-UX */
++#define ELFOSABI_NETBSD		2	/* NetBSD.  */
++#define ELFOSABI_GNU		3	/* Object uses GNU ELF extensions.  */
++#define ELFOSABI_LINUX		ELFOSABI_GNU /* Compatibility alias.  */
++#define ELFOSABI_SOLARIS	6	/* Sun Solaris.  */
++#define ELFOSABI_AIX		7	/* IBM AIX.  */
++#define ELFOSABI_IRIX		8	/* SGI Irix.  */
++#define ELFOSABI_FREEBSD	9	/* FreeBSD.  */
++#define ELFOSABI_TRU64		10	/* Compaq TRU64 UNIX.  */
++#define ELFOSABI_MODESTO	11	/* Novell Modesto.  */
++#define ELFOSABI_OPENBSD	12	/* OpenBSD.  */
++#define ELFOSABI_ARM_AEABI	64	/* ARM EABI */
++#define ELFOSABI_ARM		97	/* ARM */
++#define ELFOSABI_STANDALONE	255	/* Standalone (embedded) application */
++
++#define EI_ABIVERSION	8		/* ABI version */
++
++#define EI_PAD		9		/* Byte index of padding bytes */
++
++/* Legal values for e_type (object file type).  */
++
++#define ET_NONE		0		/* No file type */
++#define ET_REL		1		/* Relocatable file */
++#define ET_EXEC		2		/* Executable file */
++#define ET_DYN		3		/* Shared object file */
++#define ET_CORE		4		/* Core file */
++#define	ET_NUM		5		/* Number of defined types */
++#define ET_LOOS		0xfe00		/* OS-specific range start */
++#define ET_HIOS		0xfeff		/* OS-specific range end */
++#define ET_LOPROC	0xff00		/* Processor-specific range start */
++#define ET_HIPROC	0xffff		/* Processor-specific range end */
++
++/* Legal values for e_machine (architecture).  */
++
++#define EM_NONE		 0		/* No machine */
++#define EM_M32		 1		/* AT&T WE 32100 */
++#define EM_SPARC	 2		/* SUN SPARC */
++#define EM_386		 3		/* Intel 80386 */
++#define EM_68K		 4		/* Motorola m68k family */
++#define EM_88K		 5		/* Motorola m88k family */
++#define EM_860		 7		/* Intel 80860 */
++#define EM_MIPS		 8		/* MIPS R3000 big-endian */
++#define EM_S370		 9		/* IBM System/370 */
++#define EM_MIPS_RS3_LE	10		/* MIPS R3000 little-endian */
++
++#define EM_PARISC	15		/* HPPA */
++#define EM_VPP500	17		/* Fujitsu VPP500 */
++#define EM_SPARC32PLUS	18		/* Sun's "v8plus" */
++#define EM_960		19		/* Intel 80960 */
++#define EM_PPC		20		/* PowerPC */
++#define EM_PPC64	21		/* PowerPC 64-bit */
++#define EM_S390		22		/* IBM S390 */
++
++#define EM_V800		36		/* NEC V800 series */
++#define EM_FR20		37		/* Fujitsu FR20 */
++#define EM_RH32		38		/* TRW RH-32 */
++#define EM_RCE		39		/* Motorola RCE */
++#define EM_ARM		40		/* ARM */
++#define EM_FAKE_ALPHA	41		/* Digital Alpha */
++#define EM_SH		42		/* Hitachi SH */
++#define EM_SPARCV9	43		/* SPARC v9 64-bit */
++#define EM_TRICORE	44		/* Siemens Tricore */
++#define EM_ARC		45		/* Argonaut RISC Core */
++#define EM_H8_300	46		/* Hitachi H8/300 */
++#define EM_H8_300H	47		/* Hitachi H8/300H */
++#define EM_H8S		48		/* Hitachi H8S */
++#define EM_H8_500	49		/* Hitachi H8/500 */
++#define EM_IA_64	50		/* Intel Merced */
++#define EM_MIPS_X	51		/* Stanford MIPS-X */
++#define EM_COLDFIRE	52		/* Motorola Coldfire */
++#define EM_68HC12	53		/* Motorola M68HC12 */
++#define EM_MMA		54		/* Fujitsu MMA Multimedia Accelerator*/
++#define EM_PCP		55		/* Siemens PCP */
++#define EM_NCPU		56		/* Sony nCPU embeeded RISC */
++#define EM_NDR1		57		/* Denso NDR1 microprocessor */
++#define EM_STARCORE	58		/* Motorola Start*Core processor */
++#define EM_ME16		59		/* Toyota ME16 processor */
++#define EM_ST100	60		/* STMicroelectronic ST100 processor */
++#define EM_TINYJ	61		/* Advanced Logic Corp. Tinyj emb.fam*/
++#define EM_X86_64	62		/* AMD x86-64 architecture */
++#define EM_PDSP		63		/* Sony DSP Processor */
++
++#define EM_FX66		66		/* Siemens FX66 microcontroller */
++#define EM_ST9PLUS	67		/* STMicroelectronics ST9+ 8/16 mc */
++#define EM_ST7		68		/* STmicroelectronics ST7 8 bit mc */
++#define EM_68HC16	69		/* Motorola MC68HC16 microcontroller */
++#define EM_68HC11	70		/* Motorola MC68HC11 microcontroller */
++#define EM_68HC08	71		/* Motorola MC68HC08 microcontroller */
++#define EM_68HC05	72		/* Motorola MC68HC05 microcontroller */
++#define EM_SVX		73		/* Silicon Graphics SVx */
++#define EM_ST19		74		/* STMicroelectronics ST19 8 bit mc */
++#define EM_VAX		75		/* Digital VAX */
++#define EM_CRIS		76		/* Axis Communications 32-bit embedded processor */
++#define EM_JAVELIN	77		/* Infineon Technologies 32-bit embedded processor */
++#define EM_FIREPATH	78		/* Element 14 64-bit DSP Processor */
++#define EM_ZSP		79		/* LSI Logic 16-bit DSP Processor */
++#define EM_MMIX		80		/* Donald Knuth's educational 64-bit processor */
++#define EM_HUANY	81		/* Harvard University machine-independent object files */
++#define EM_PRISM	82		/* SiTera Prism */
++#define EM_AVR		83		/* Atmel AVR 8-bit microcontroller */
++#define EM_FR30		84		/* Fujitsu FR30 */
++#define EM_D10V		85		/* Mitsubishi D10V */
++#define EM_D30V		86		/* Mitsubishi D30V */
++#define EM_V850		87		/* NEC v850 */
++#define EM_M32R		88		/* Mitsubishi M32R */
++#define EM_MN10300	89		/* Matsushita MN10300 */
++#define EM_MN10200	90		/* Matsushita MN10200 */
++#define EM_PJ		91		/* picoJava */
++#define EM_OPENRISC	92		/* OpenRISC 32-bit embedded processor */
++#define EM_ARC_A5	93		/* ARC Cores Tangent-A5 */
++#define EM_XTENSA	94		/* Tensilica Xtensa Architecture */
++#define EM_TILEPRO	188		/* Tilera TILEPro */
++#define EM_TILEGX	191		/* Tilera TILE-Gx */
++#define EM_NUM		192
++
++/* If it is necessary to assign new unofficial EM_* values, please
++   pick large random numbers (0x8523, 0xa7f2, etc.) to minimize the
++   chances of collision with official or non-GNU unofficial values.  */
++
++#define EM_ALPHA	0x9026
++
++/* Legal values for e_version (version).  */
++
++#define EV_NONE		0		/* Invalid ELF version */
++#define EV_CURRENT	1		/* Current version */
++#define EV_NUM		2
++
++/* Section header.  */
++
++typedef struct
++{
++  Elf32_Word	sh_name;		/* Section name (string tbl index) */
++  Elf32_Word	sh_type;		/* Section type */
++  Elf32_Word	sh_flags;		/* Section flags */
++  Elf32_Addr	sh_addr;		/* Section virtual addr at execution */
++  Elf32_Off	sh_offset;		/* Section file offset */
++  Elf32_Word	sh_size;		/* Section size in bytes */
++  Elf32_Word	sh_link;		/* Link to another section */
++  Elf32_Word	sh_info;		/* Additional section information */
++  Elf32_Word	sh_addralign;		/* Section alignment */
++  Elf32_Word	sh_entsize;		/* Entry size if section holds table */
++} Elf32_Shdr;
++
++typedef struct
++{
++  Elf64_Word	sh_name;		/* Section name (string tbl index) */
++  Elf64_Word	sh_type;		/* Section type */
++  Elf64_Xword	sh_flags;		/* Section flags */
++  Elf64_Addr	sh_addr;		/* Section virtual addr at execution */
++  Elf64_Off	sh_offset;		/* Section file offset */
++  Elf64_Xword	sh_size;		/* Section size in bytes */
++  Elf64_Word	sh_link;		/* Link to another section */
++  Elf64_Word	sh_info;		/* Additional section information */
++  Elf64_Xword	sh_addralign;		/* Section alignment */
++  Elf64_Xword	sh_entsize;		/* Entry size if section holds table */
++} Elf64_Shdr;
++
++/* Special section indices.  */
++
++#define SHN_UNDEF	0		/* Undefined section */
++#define SHN_LORESERVE	0xff00		/* Start of reserved indices */
++#define SHN_LOPROC	0xff00		/* Start of processor-specific */
++#define SHN_BEFORE	0xff00		/* Order section before all others
++					   (Solaris).  */
++#define SHN_AFTER	0xff01		/* Order section after all others
++					   (Solaris).  */
++#define SHN_HIPROC	0xff1f		/* End of processor-specific */
++#define SHN_LOOS	0xff20		/* Start of OS-specific */
++#define SHN_HIOS	0xff3f		/* End of OS-specific */
++#define SHN_ABS		0xfff1		/* Associated symbol is absolute */
++#define SHN_COMMON	0xfff2		/* Associated symbol is common */
++#define SHN_XINDEX	0xffff		/* Index is in extra table.  */
++#define SHN_HIRESERVE	0xffff		/* End of reserved indices */
++
++/* Legal values for sh_type (section type).  */
++
++#define SHT_NULL	  0		/* Section header table entry unused */
++#define SHT_PROGBITS	  1		/* Program data */
++#define SHT_SYMTAB	  2		/* Symbol table */
++#define SHT_STRTAB	  3		/* String table */
++#define SHT_RELA	  4		/* Relocation entries with addends */
++#define SHT_HASH	  5		/* Symbol hash table */
++#define SHT_DYNAMIC	  6		/* Dynamic linking information */
++#define SHT_NOTE	  7		/* Notes */
++#define SHT_NOBITS	  8		/* Program space with no data (bss) */
++#define SHT_REL		  9		/* Relocation entries, no addends */
++#define SHT_SHLIB	  10		/* Reserved */
++#define SHT_DYNSYM	  11		/* Dynamic linker symbol table */
++#define SHT_INIT_ARRAY	  14		/* Array of constructors */
++#define SHT_FINI_ARRAY	  15		/* Array of destructors */
++#define SHT_PREINIT_ARRAY 16		/* Array of pre-constructors */
++#define SHT_GROUP	  17		/* Section group */
++#define SHT_SYMTAB_SHNDX  18		/* Extended section indeces */
++#define	SHT_NUM		  19		/* Number of defined types.  */
++#define SHT_LOOS	  0x60000000	/* Start OS-specific.  */
++#define SHT_GNU_ATTRIBUTES 0x6ffffff5	/* Object attributes.  */
++#define SHT_GNU_HASH	  0x6ffffff6	/* GNU-style hash table.  */
++#define SHT_GNU_LIBLIST	  0x6ffffff7	/* Prelink library list */
++#define SHT_CHECKSUM	  0x6ffffff8	/* Checksum for DSO content.  */
++#define SHT_LOSUNW	  0x6ffffffa	/* Sun-specific low bound.  */
++#define SHT_SUNW_move	  0x6ffffffa
++#define SHT_SUNW_COMDAT   0x6ffffffb
++#define SHT_SUNW_syminfo  0x6ffffffc
++#define SHT_GNU_verdef	  0x6ffffffd	/* Version definition section.  */
++#define SHT_GNU_verneed	  0x6ffffffe	/* Version needs section.  */
++#define SHT_GNU_versym	  0x6fffffff	/* Version symbol table.  */
++#define SHT_HISUNW	  0x6fffffff	/* Sun-specific high bound.  */
++#define SHT_HIOS	  0x6fffffff	/* End OS-specific type */
++#define SHT_LOPROC	  0x70000000	/* Start of processor-specific */
++#define SHT_HIPROC	  0x7fffffff	/* End of processor-specific */
++#define SHT_LOUSER	  0x80000000	/* Start of application-specific */
++#define SHT_HIUSER	  0x8fffffff	/* End of application-specific */
++
++/* Legal values for sh_flags (section flags).  */
++
++#define SHF_WRITE	     (1 << 0)	/* Writable */
++#define SHF_ALLOC	     (1 << 1)	/* Occupies memory during execution */
++#define SHF_EXECINSTR	     (1 << 2)	/* Executable */
++#define SHF_MERGE	     (1 << 4)	/* Might be merged */
++#define SHF_STRINGS	     (1 << 5)	/* Contains nul-terminated strings */
++#define SHF_INFO_LINK	     (1 << 6)	/* `sh_info' contains SHT index */
++#define SHF_LINK_ORDER	     (1 << 7)	/* Preserve order after combining */
++#define SHF_OS_NONCONFORMING (1 << 8)	/* Non-standard OS specific handling
++					   required */
++#define SHF_GROUP	     (1 << 9)	/* Section is member of a group.  */
++#define SHF_TLS		     (1 << 10)	/* Section hold thread-local data.  */
++#define SHF_MASKOS	     0x0ff00000	/* OS-specific.  */
++#define SHF_MASKPROC	     0xf0000000	/* Processor-specific */
++#define SHF_ORDERED	     (1 << 30)	/* Special ordering requirement
++					   (Solaris).  */
++#define SHF_EXCLUDE	     (1 << 31)	/* Section is excluded unless
++					   referenced or allocated (Solaris).*/
++
++/* Section group handling.  */
++#define GRP_COMDAT	0x1		/* Mark group as COMDAT.  */
++
++/* Symbol table entry.  */
++
++typedef struct
++{
++  Elf32_Word	st_name;		/* Symbol name (string tbl index) */
++  Elf32_Addr	st_value;		/* Symbol value */
++  Elf32_Word	st_size;		/* Symbol size */
++  unsigned char	st_info;		/* Symbol type and binding */
++  unsigned char	st_other;		/* Symbol visibility */
++  Elf32_Section	st_shndx;		/* Section index */
++} Elf32_Sym;
++
++typedef struct
++{
++  Elf64_Word	st_name;		/* Symbol name (string tbl index) */
++  unsigned char	st_info;		/* Symbol type and binding */
++  unsigned char st_other;		/* Symbol visibility */
++  Elf64_Section	st_shndx;		/* Section index */
++  Elf64_Addr	st_value;		/* Symbol value */
++  Elf64_Xword	st_size;		/* Symbol size */
++} Elf64_Sym;
++
++/* The syminfo section if available contains additional information about
++   every dynamic symbol.  */
++
++typedef struct
++{
++  Elf32_Half si_boundto;		/* Direct bindings, symbol bound to */
++  Elf32_Half si_flags;			/* Per symbol flags */
++} Elf32_Syminfo;
++
++typedef struct
++{
++  Elf64_Half si_boundto;		/* Direct bindings, symbol bound to */
++  Elf64_Half si_flags;			/* Per symbol flags */
++} Elf64_Syminfo;
++
++/* Possible values for si_boundto.  */
++#define SYMINFO_BT_SELF		0xffff	/* Symbol bound to self */
++#define SYMINFO_BT_PARENT	0xfffe	/* Symbol bound to parent */
++#define SYMINFO_BT_LOWRESERVE	0xff00	/* Beginning of reserved entries */
++
++/* Possible bitmasks for si_flags.  */
++#define SYMINFO_FLG_DIRECT	0x0001	/* Direct bound symbol */
++#define SYMINFO_FLG_PASSTHRU	0x0002	/* Pass-thru symbol for translator */
++#define SYMINFO_FLG_COPY	0x0004	/* Symbol is a copy-reloc */
++#define SYMINFO_FLG_LAZYLOAD	0x0008	/* Symbol bound to object to be lazy
++					   loaded */
++/* Syminfo version values.  */
++#define SYMINFO_NONE		0
++#define SYMINFO_CURRENT		1
++#define SYMINFO_NUM		2
++
++
++/* How to extract and insert information held in the st_info field.  */
++
++#define ELF32_ST_BIND(val)		(((unsigned char) (val)) >> 4)
++#define ELF32_ST_TYPE(val)		((val) & 0xf)
++#define ELF32_ST_INFO(bind, type)	(((bind) << 4) + ((type) & 0xf))
++
++/* Both Elf32_Sym and Elf64_Sym use the same one-byte st_info field.  */
++#define ELF64_ST_BIND(val)		ELF32_ST_BIND (val)
++#define ELF64_ST_TYPE(val)		ELF32_ST_TYPE (val)
++#define ELF64_ST_INFO(bind, type)	ELF32_ST_INFO ((bind), (type))
++
++/* Legal values for ST_BIND subfield of st_info (symbol binding).  */
++
++#define STB_LOCAL	0		/* Local symbol */
++#define STB_GLOBAL	1		/* Global symbol */
++#define STB_WEAK	2		/* Weak symbol */
++#define	STB_NUM		3		/* Number of defined types.  */
++#define STB_LOOS	10		/* Start of OS-specific */
++#define STB_GNU_UNIQUE	10		/* Unique symbol.  */
++#define STB_HIOS	12		/* End of OS-specific */
++#define STB_LOPROC	13		/* Start of processor-specific */
++#define STB_HIPROC	15		/* End of processor-specific */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_NOTYPE	0		/* Symbol type is unspecified */
++#define STT_OBJECT	1		/* Symbol is a data object */
++#define STT_FUNC	2		/* Symbol is a code object */
++#define STT_SECTION	3		/* Symbol associated with a section */
++#define STT_FILE	4		/* Symbol's name is file name */
++#define STT_COMMON	5		/* Symbol is a common data object */
++#define STT_TLS		6		/* Symbol is thread-local data object*/
++#define	STT_NUM		7		/* Number of defined types.  */
++#define STT_LOOS	10		/* Start of OS-specific */
++#define STT_GNU_IFUNC	10		/* Symbol is indirect code object */
++#define STT_HIOS	12		/* End of OS-specific */
++#define STT_LOPROC	13		/* Start of processor-specific */
++#define STT_HIPROC	15		/* End of processor-specific */
++
++
++/* Symbol table indices are found in the hash buckets and chain table
++   of a symbol hash table section.  This special index value indicates
++   the end of a chain, meaning no further symbols are found in that bucket.  */
++
++#define STN_UNDEF	0		/* End of a chain.  */
++
++
++/* How to extract and insert information held in the st_other field.  */
++
++#define ELF32_ST_VISIBILITY(o)	((o) & 0x03)
++
++/* For ELF64 the definitions are the same.  */
++#define ELF64_ST_VISIBILITY(o)	ELF32_ST_VISIBILITY (o)
++
++/* Symbol visibility specification encoded in the st_other field.  */
++#define STV_DEFAULT	0		/* Default symbol visibility rules */
++#define STV_INTERNAL	1		/* Processor specific hidden class */
++#define STV_HIDDEN	2		/* Sym unavailable in other modules */
++#define STV_PROTECTED	3		/* Not preemptible, not exported */
++
++
++/* Relocation table entry without addend (in section of type SHT_REL).  */
++
++typedef struct
++{
++  Elf32_Addr	r_offset;		/* Address */
++  Elf32_Word	r_info;			/* Relocation type and symbol index */
++} Elf32_Rel;
++
++/* I have seen two different definitions of the Elf64_Rel and
++   Elf64_Rela structures, so we'll leave them out until Novell (or
++   whoever) gets their act together.  */
++/* The following, at least, is used on Sparc v9, MIPS, and Alpha.  */
++
++typedef struct
++{
++  Elf64_Addr	r_offset;		/* Address */
++  Elf64_Xword	r_info;			/* Relocation type and symbol index */
++} Elf64_Rel;
++
++/* Relocation table entry with addend (in section of type SHT_RELA).  */
++
++typedef struct
++{
++  Elf32_Addr	r_offset;		/* Address */
++  Elf32_Word	r_info;			/* Relocation type and symbol index */
++  Elf32_Sword	r_addend;		/* Addend */
++} Elf32_Rela;
++
++typedef struct
++{
++  Elf64_Addr	r_offset;		/* Address */
++  Elf64_Xword	r_info;			/* Relocation type and symbol index */
++  Elf64_Sxword	r_addend;		/* Addend */
++} Elf64_Rela;
++
++/* How to extract and insert information held in the r_info field.  */
++
++#define ELF32_R_SYM(val)		((val) >> 8)
++#define ELF32_R_TYPE(val)		((val) & 0xff)
++#define ELF32_R_INFO(sym, type)		(((sym) << 8) + ((type) & 0xff))
++
++#define ELF64_R_SYM(i)			((i) >> 32)
++#define ELF64_R_TYPE(i)			((i) & 0xffffffff)
++#define ELF64_R_INFO(sym,type)		((((Elf64_Xword) (sym)) << 32) + (type))
++
++/* Program segment header.  */
++
++typedef struct
++{
++  Elf32_Word	p_type;			/* Segment type */
++  Elf32_Off	p_offset;		/* Segment file offset */
++  Elf32_Addr	p_vaddr;		/* Segment virtual address */
++  Elf32_Addr	p_paddr;		/* Segment physical address */
++  Elf32_Word	p_filesz;		/* Segment size in file */
++  Elf32_Word	p_memsz;		/* Segment size in memory */
++  Elf32_Word	p_flags;		/* Segment flags */
++  Elf32_Word	p_align;		/* Segment alignment */
++} Elf32_Phdr;
++
++typedef struct
++{
++  Elf64_Word	p_type;			/* Segment type */
++  Elf64_Word	p_flags;		/* Segment flags */
++  Elf64_Off	p_offset;		/* Segment file offset */
++  Elf64_Addr	p_vaddr;		/* Segment virtual address */
++  Elf64_Addr	p_paddr;		/* Segment physical address */
++  Elf64_Xword	p_filesz;		/* Segment size in file */
++  Elf64_Xword	p_memsz;		/* Segment size in memory */
++  Elf64_Xword	p_align;		/* Segment alignment */
++} Elf64_Phdr;
++
++/* Special value for e_phnum.  This indicates that the real number of
++   program headers is too large to fit into e_phnum.  Instead the real
++   value is in the field sh_info of section 0.  */
++
++#define PN_XNUM		0xffff
++
++/* Legal values for p_type (segment type).  */
++
++#define	PT_NULL		0		/* Program header table entry unused */
++#define PT_LOAD		1		/* Loadable program segment */
++#define PT_DYNAMIC	2		/* Dynamic linking information */
++#define PT_INTERP	3		/* Program interpreter */
++#define PT_NOTE		4		/* Auxiliary information */
++#define PT_SHLIB	5		/* Reserved */
++#define PT_PHDR		6		/* Entry for header table itself */
++#define PT_TLS		7		/* Thread-local storage segment */
++#define	PT_NUM		8		/* Number of defined types */
++#define PT_LOOS		0x60000000	/* Start of OS-specific */
++#define PT_GNU_EH_FRAME	0x6474e550	/* GCC .eh_frame_hdr segment */
++#define PT_GNU_STACK	0x6474e551	/* Indicates stack executability */
++#define PT_GNU_RELRO	0x6474e552	/* Read-only after relocation */
++#define PT_LOSUNW	0x6ffffffa
++#define PT_SUNWBSS	0x6ffffffa	/* Sun Specific segment */
++#define PT_SUNWSTACK	0x6ffffffb	/* Stack segment */
++#define PT_HISUNW	0x6fffffff
++#define PT_HIOS		0x6fffffff	/* End of OS-specific */
++#define PT_LOPROC	0x70000000	/* Start of processor-specific */
++#define PT_HIPROC	0x7fffffff	/* End of processor-specific */
++
++/* Legal values for p_flags (segment flags).  */
++
++#define PF_X		(1 << 0)	/* Segment is executable */
++#define PF_W		(1 << 1)	/* Segment is writable */
++#define PF_R		(1 << 2)	/* Segment is readable */
++#define PF_MASKOS	0x0ff00000	/* OS-specific */
++#define PF_MASKPROC	0xf0000000	/* Processor-specific */
++
++/* Legal values for note segment descriptor types for core files. */
++
++#define NT_PRSTATUS	1		/* Contains copy of prstatus struct */
++#define NT_FPREGSET	2		/* Contains copy of fpregset struct */
++#define NT_PRPSINFO	3		/* Contains copy of prpsinfo struct */
++#define NT_PRXREG	4		/* Contains copy of prxregset struct */
++#define NT_TASKSTRUCT	4		/* Contains copy of task structure */
++#define NT_PLATFORM	5		/* String from sysinfo(SI_PLATFORM) */
++#define NT_AUXV		6		/* Contains copy of auxv array */
++#define NT_GWINDOWS	7		/* Contains copy of gwindows struct */
++#define NT_ASRS		8		/* Contains copy of asrset struct */
++#define NT_PSTATUS	10		/* Contains copy of pstatus struct */
++#define NT_PSINFO	13		/* Contains copy of psinfo struct */
++#define NT_PRCRED	14		/* Contains copy of prcred struct */
++#define NT_UTSNAME	15		/* Contains copy of utsname struct */
++#define NT_LWPSTATUS	16		/* Contains copy of lwpstatus struct */
++#define NT_LWPSINFO	17		/* Contains copy of lwpinfo struct */
++#define NT_PRFPXREG	20		/* Contains copy of fprxregset struct */
++#define NT_PRXFPREG	0x46e62b7f	/* Contains copy of user_fxsr_struct */
++#define NT_PPC_VMX	0x100		/* PowerPC Altivec/VMX registers */
++#define NT_PPC_SPE	0x101		/* PowerPC SPE/EVR registers */
++#define NT_PPC_VSX	0x102		/* PowerPC VSX registers */
++#define NT_386_TLS	0x200		/* i386 TLS slots (struct user_desc) */
++#define NT_386_IOPERM	0x201		/* x86 io permission bitmap (1=deny) */
++#define NT_X86_XSTATE	0x202		/* x86 extended state using xsave */
++
++/* Legal values for the note segment descriptor types for object files.  */
++
++#define NT_VERSION	1		/* Contains a version string.  */
++
++
++/* Dynamic section entry.  */
++
++typedef struct
++{
++  Elf32_Sword	d_tag;			/* Dynamic entry type */
++  union
++    {
++      Elf32_Word d_val;			/* Integer value */
++      Elf32_Addr d_ptr;			/* Address value */
++    } d_un;
++} Elf32_Dyn;
++
++typedef struct
++{
++  Elf64_Sxword	d_tag;			/* Dynamic entry type */
++  union
++    {
++      Elf64_Xword d_val;		/* Integer value */
++      Elf64_Addr d_ptr;			/* Address value */
++    } d_un;
++} Elf64_Dyn;
++
++/* Legal values for d_tag (dynamic entry type).  */
++
++#define DT_NULL		0		/* Marks end of dynamic section */
++#define DT_NEEDED	1		/* Name of needed library */
++#define DT_PLTRELSZ	2		/* Size in bytes of PLT relocs */
++#define DT_PLTGOT	3		/* Processor defined value */
++#define DT_HASH		4		/* Address of symbol hash table */
++#define DT_STRTAB	5		/* Address of string table */
++#define DT_SYMTAB	6		/* Address of symbol table */
++#define DT_RELA		7		/* Address of Rela relocs */
++#define DT_RELASZ	8		/* Total size of Rela relocs */
++#define DT_RELAENT	9		/* Size of one Rela reloc */
++#define DT_STRSZ	10		/* Size of string table */
++#define DT_SYMENT	11		/* Size of one symbol table entry */
++#define DT_INIT		12		/* Address of init function */
++#define DT_FINI		13		/* Address of termination function */
++#define DT_SONAME	14		/* Name of shared object */
++#define DT_RPATH	15		/* Library search path (deprecated) */
++#define DT_SYMBOLIC	16		/* Start symbol search here */
++#define DT_REL		17		/* Address of Rel relocs */
++#define DT_RELSZ	18		/* Total size of Rel relocs */
++#define DT_RELENT	19		/* Size of one Rel reloc */
++#define DT_PLTREL	20		/* Type of reloc in PLT */
++#define DT_DEBUG	21		/* For debugging; unspecified */
++#define DT_TEXTREL	22		/* Reloc might modify .text */
++#define DT_JMPREL	23		/* Address of PLT relocs */
++#define	DT_BIND_NOW	24		/* Process relocations of object */
++#define	DT_INIT_ARRAY	25		/* Array with addresses of init fct */
++#define	DT_FINI_ARRAY	26		/* Array with addresses of fini fct */
++#define	DT_INIT_ARRAYSZ	27		/* Size in bytes of DT_INIT_ARRAY */
++#define	DT_FINI_ARRAYSZ	28		/* Size in bytes of DT_FINI_ARRAY */
++#define DT_RUNPATH	29		/* Library search path */
++#define DT_FLAGS	30		/* Flags for the object being loaded */
++#define DT_ENCODING	32		/* Start of encoded range */
++#define DT_PREINIT_ARRAY 32		/* Array with addresses of preinit fct*/
++#define DT_PREINIT_ARRAYSZ 33		/* size in bytes of DT_PREINIT_ARRAY */
++#define	DT_NUM		34		/* Number used */
++#define DT_LOOS		0x6000000d	/* Start of OS-specific */
++#define DT_HIOS		0x6ffff000	/* End of OS-specific */
++#define DT_LOPROC	0x70000000	/* Start of processor-specific */
++#define DT_HIPROC	0x7fffffff	/* End of processor-specific */
++#define	DT_PROCNUM	DT_MIPS_NUM	/* Most used by any processor */
++
++/* DT_* entries which fall between DT_VALRNGHI & DT_VALRNGLO use the
++   Dyn.d_un.d_val field of the Elf*_Dyn structure.  This follows Sun's
++   approach.  */
++#define DT_VALRNGLO	0x6ffffd00
++#define DT_GNU_PRELINKED 0x6ffffdf5	/* Prelinking timestamp */
++#define DT_GNU_CONFLICTSZ 0x6ffffdf6	/* Size of conflict section */
++#define DT_GNU_LIBLISTSZ 0x6ffffdf7	/* Size of library list */
++#define DT_CHECKSUM	0x6ffffdf8
++#define DT_PLTPADSZ	0x6ffffdf9
++#define DT_MOVEENT	0x6ffffdfa
++#define DT_MOVESZ	0x6ffffdfb
++#define DT_FEATURE_1	0x6ffffdfc	/* Feature selection (DTF_*).  */
++#define DT_POSFLAG_1	0x6ffffdfd	/* Flags for DT_* entries, effecting
++					   the following DT_* entry.  */
++#define DT_SYMINSZ	0x6ffffdfe	/* Size of syminfo table (in bytes) */
++#define DT_SYMINENT	0x6ffffdff	/* Entry size of syminfo */
++#define DT_VALRNGHI	0x6ffffdff
++#define DT_VALTAGIDX(tag)	(DT_VALRNGHI - (tag))	/* Reverse order! */
++#define DT_VALNUM 12
++
++/* DT_* entries which fall between DT_ADDRRNGHI & DT_ADDRRNGLO use the
++   Dyn.d_un.d_ptr field of the Elf*_Dyn structure.
++
++   If any adjustment is made to the ELF object after it has been
++   built these entries will need to be adjusted.  */
++#define DT_ADDRRNGLO	0x6ffffe00
++#define DT_GNU_HASH	0x6ffffef5	/* GNU-style hash table.  */
++#define DT_TLSDESC_PLT	0x6ffffef6
++#define DT_TLSDESC_GOT	0x6ffffef7
++#define DT_GNU_CONFLICT	0x6ffffef8	/* Start of conflict section */
++#define DT_GNU_LIBLIST	0x6ffffef9	/* Library list */
++#define DT_CONFIG	0x6ffffefa	/* Configuration information.  */
++#define DT_DEPAUDIT	0x6ffffefb	/* Dependency auditing.  */
++#define DT_AUDIT	0x6ffffefc	/* Object auditing.  */
++#define	DT_PLTPAD	0x6ffffefd	/* PLT padding.  */
++#define	DT_MOVETAB	0x6ffffefe	/* Move table.  */
++#define DT_SYMINFO	0x6ffffeff	/* Syminfo table.  */
++#define DT_ADDRRNGHI	0x6ffffeff
++#define DT_ADDRTAGIDX(tag)	(DT_ADDRRNGHI - (tag))	/* Reverse order! */
++#define DT_ADDRNUM 11
++
++/* The versioning entry types.  The next are defined as part of the
++   GNU extension.  */
++#define DT_VERSYM	0x6ffffff0
++
++#define DT_RELACOUNT	0x6ffffff9
++#define DT_RELCOUNT	0x6ffffffa
++
++/* These were chosen by Sun.  */
++#define DT_FLAGS_1	0x6ffffffb	/* State flags, see DF_1_* below.  */
++#define	DT_VERDEF	0x6ffffffc	/* Address of version definition
++					   table */
++#define	DT_VERDEFNUM	0x6ffffffd	/* Number of version definitions */
++#define	DT_VERNEED	0x6ffffffe	/* Address of table with needed
++					   versions */
++#define	DT_VERNEEDNUM	0x6fffffff	/* Number of needed versions */
++#define DT_VERSIONTAGIDX(tag)	(DT_VERNEEDNUM - (tag))	/* Reverse order! */
++#define DT_VERSIONTAGNUM 16
++
++/* Sun added these machine-independent extensions in the "processor-specific"
++   range.  Be compatible.  */
++#define DT_AUXILIARY    0x7ffffffd      /* Shared object to load before self */
++#define DT_FILTER       0x7fffffff      /* Shared object to get values from */
++#define DT_EXTRATAGIDX(tag)	((Elf32_Word)-((Elf32_Sword) (tag) <<1>>1)-1)
++#define DT_EXTRANUM	3
++
++/* Values of `d_un.d_val' in the DT_FLAGS entry.  */
++#define DF_ORIGIN	0x00000001	/* Object may use DF_ORIGIN */
++#define DF_SYMBOLIC	0x00000002	/* Symbol resolutions starts here */
++#define DF_TEXTREL	0x00000004	/* Object contains text relocations */
++#define DF_BIND_NOW	0x00000008	/* No lazy binding for this object */
++#define DF_STATIC_TLS	0x00000010	/* Module uses the static TLS model */
++
++/* State flags selectable in the `d_un.d_val' element of the DT_FLAGS_1
++   entry in the dynamic section.  */
++#define DF_1_NOW	0x00000001	/* Set RTLD_NOW for this object.  */
++#define DF_1_GLOBAL	0x00000002	/* Set RTLD_GLOBAL for this object.  */
++#define DF_1_GROUP	0x00000004	/* Set RTLD_GROUP for this object.  */
++#define DF_1_NODELETE	0x00000008	/* Set RTLD_NODELETE for this object.*/
++#define DF_1_LOADFLTR	0x00000010	/* Trigger filtee loading at runtime.*/
++#define DF_1_INITFIRST	0x00000020	/* Set RTLD_INITFIRST for this object*/
++#define DF_1_NOOPEN	0x00000040	/* Set RTLD_NOOPEN for this object.  */
++#define DF_1_ORIGIN	0x00000080	/* $ORIGIN must be handled.  */
++#define DF_1_DIRECT	0x00000100	/* Direct binding enabled.  */
++#define DF_1_TRANS	0x00000200
++#define DF_1_INTERPOSE	0x00000400	/* Object is used to interpose.  */
++#define DF_1_NODEFLIB	0x00000800	/* Ignore default lib search path.  */
++#define DF_1_NODUMP	0x00001000	/* Object can't be dldump'ed.  */
++#define DF_1_CONFALT	0x00002000	/* Configuration alternative created.*/
++#define DF_1_ENDFILTEE	0x00004000	/* Filtee terminates filters search. */
++#define	DF_1_DISPRELDNE	0x00008000	/* Disp reloc applied at build time. */
++#define	DF_1_DISPRELPND	0x00010000	/* Disp reloc applied at run-time.  */
++
++/* Flags for the feature selection in DT_FEATURE_1.  */
++#define DTF_1_PARINIT	0x00000001
++#define DTF_1_CONFEXP	0x00000002
++
++/* Flags in the DT_POSFLAG_1 entry effecting only the next DT_* entry.  */
++#define DF_P1_LAZYLOAD	0x00000001	/* Lazyload following object.  */
++#define DF_P1_GROUPPERM	0x00000002	/* Symbols from next object are not
++					   generally available.  */
++
++/* Version definition sections.  */
++
++typedef struct
++{
++  Elf32_Half	vd_version;		/* Version revision */
++  Elf32_Half	vd_flags;		/* Version information */
++  Elf32_Half	vd_ndx;			/* Version Index */
++  Elf32_Half	vd_cnt;			/* Number of associated aux entries */
++  Elf32_Word	vd_hash;		/* Version name hash value */
++  Elf32_Word	vd_aux;			/* Offset in bytes to verdaux array */
++  Elf32_Word	vd_next;		/* Offset in bytes to next verdef
++					   entry */
++} Elf32_Verdef;
++
++typedef struct
++{
++  Elf64_Half	vd_version;		/* Version revision */
++  Elf64_Half	vd_flags;		/* Version information */
++  Elf64_Half	vd_ndx;			/* Version Index */
++  Elf64_Half	vd_cnt;			/* Number of associated aux entries */
++  Elf64_Word	vd_hash;		/* Version name hash value */
++  Elf64_Word	vd_aux;			/* Offset in bytes to verdaux array */
++  Elf64_Word	vd_next;		/* Offset in bytes to next verdef
++					   entry */
++} Elf64_Verdef;
++
++
++/* Legal values for vd_version (version revision).  */
++#define VER_DEF_NONE	0		/* No version */
++#define VER_DEF_CURRENT	1		/* Current version */
++#define VER_DEF_NUM	2		/* Given version number */
++
++/* Legal values for vd_flags (version information flags).  */
++#define VER_FLG_BASE	0x1		/* Version definition of file itself */
++#define VER_FLG_WEAK	0x2		/* Weak version identifier */
++
++/* Versym symbol index values.  */
++#define	VER_NDX_LOCAL		0	/* Symbol is local.  */
++#define	VER_NDX_GLOBAL		1	/* Symbol is global.  */
++#define	VER_NDX_LORESERVE	0xff00	/* Beginning of reserved entries.  */
++#define	VER_NDX_ELIMINATE	0xff01	/* Symbol is to be eliminated.  */
++
++/* Auxialiary version information.  */
++
++typedef struct
++{
++  Elf32_Word	vda_name;		/* Version or dependency names */
++  Elf32_Word	vda_next;		/* Offset in bytes to next verdaux
++					   entry */
++} Elf32_Verdaux;
++
++typedef struct
++{
++  Elf64_Word	vda_name;		/* Version or dependency names */
++  Elf64_Word	vda_next;		/* Offset in bytes to next verdaux
++					   entry */
++} Elf64_Verdaux;
++
++
++/* Version dependency section.  */
++
++typedef struct
++{
++  Elf32_Half	vn_version;		/* Version of structure */
++  Elf32_Half	vn_cnt;			/* Number of associated aux entries */
++  Elf32_Word	vn_file;		/* Offset of filename for this
++					   dependency */
++  Elf32_Word	vn_aux;			/* Offset in bytes to vernaux array */
++  Elf32_Word	vn_next;		/* Offset in bytes to next verneed
++					   entry */
++} Elf32_Verneed;
++
++typedef struct
++{
++  Elf64_Half	vn_version;		/* Version of structure */
++  Elf64_Half	vn_cnt;			/* Number of associated aux entries */
++  Elf64_Word	vn_file;		/* Offset of filename for this
++					   dependency */
++  Elf64_Word	vn_aux;			/* Offset in bytes to vernaux array */
++  Elf64_Word	vn_next;		/* Offset in bytes to next verneed
++					   entry */
++} Elf64_Verneed;
++
++
++/* Legal values for vn_version (version revision).  */
++#define VER_NEED_NONE	 0		/* No version */
++#define VER_NEED_CURRENT 1		/* Current version */
++#define VER_NEED_NUM	 2		/* Given version number */
++
++/* Auxiliary needed version information.  */
++
++typedef struct
++{
++  Elf32_Word	vna_hash;		/* Hash value of dependency name */
++  Elf32_Half	vna_flags;		/* Dependency specific information */
++  Elf32_Half	vna_other;		/* Unused */
++  Elf32_Word	vna_name;		/* Dependency name string offset */
++  Elf32_Word	vna_next;		/* Offset in bytes to next vernaux
++					   entry */
++} Elf32_Vernaux;
++
++typedef struct
++{
++  Elf64_Word	vna_hash;		/* Hash value of dependency name */
++  Elf64_Half	vna_flags;		/* Dependency specific information */
++  Elf64_Half	vna_other;		/* Unused */
++  Elf64_Word	vna_name;		/* Dependency name string offset */
++  Elf64_Word	vna_next;		/* Offset in bytes to next vernaux
++					   entry */
++} Elf64_Vernaux;
++
++
++/* Legal values for vna_flags.  */
++#define VER_FLG_WEAK	0x2		/* Weak version identifier */
++
++
++/* Auxiliary vector.  */
++
++/* This vector is normally only used by the program interpreter.  The
++   usual definition in an ABI supplement uses the name auxv_t.  The
++   vector is not usually defined in a standard <elf.h> file, but it
++   can't hurt.  We rename it to avoid conflicts.  The sizes of these
++   types are an arrangement between the exec server and the program
++   interpreter, so we don't fully specify them here.  */
++
++typedef struct
++{
++  uint32_t a_type;		/* Entry type */
++  union
++    {
++      uint32_t a_val;		/* Integer value */
++      /* We use to have pointer elements added here.  We cannot do that,
++	 though, since it does not work when using 32-bit definitions
++	 on 64-bit platforms and vice versa.  */
++    } a_un;
++} Elf32_auxv_t;
++
++typedef struct
++{
++  uint64_t a_type;		/* Entry type */
++  union
++    {
++      uint64_t a_val;		/* Integer value */
++      /* We use to have pointer elements added here.  We cannot do that,
++	 though, since it does not work when using 32-bit definitions
++	 on 64-bit platforms and vice versa.  */
++    } a_un;
++} Elf64_auxv_t;
++
++/* Legal values for a_type (entry type).  */
++
++#define AT_NULL		0		/* End of vector */
++#define AT_IGNORE	1		/* Entry should be ignored */
++#define AT_EXECFD	2		/* File descriptor of program */
++#define AT_PHDR		3		/* Program headers for program */
++#define AT_PHENT	4		/* Size of program header entry */
++#define AT_PHNUM	5		/* Number of program headers */
++#define AT_PAGESZ	6		/* System page size */
++#define AT_BASE		7		/* Base address of interpreter */
++#define AT_FLAGS	8		/* Flags */
++#define AT_ENTRY	9		/* Entry point of program */
++#define AT_NOTELF	10		/* Program is not ELF */
++#define AT_UID		11		/* Real uid */
++#define AT_EUID		12		/* Effective uid */
++#define AT_GID		13		/* Real gid */
++#define AT_EGID		14		/* Effective gid */
++#define AT_CLKTCK	17		/* Frequency of times() */
++
++/* Some more special a_type values describing the hardware.  */
++#define AT_PLATFORM	15		/* String identifying platform.  */
++#define AT_HWCAP	16		/* Machine dependent hints about
++					   processor capabilities.  */
++
++/* This entry gives some information about the FPU initialization
++   performed by the kernel.  */
++#define AT_FPUCW	18		/* Used FPU control word.  */
++
++/* Cache block sizes.  */
++#define AT_DCACHEBSIZE	19		/* Data cache block size.  */
++#define AT_ICACHEBSIZE	20		/* Instruction cache block size.  */
++#define AT_UCACHEBSIZE	21		/* Unified cache block size.  */
++
++/* A special ignored value for PPC, used by the kernel to control the
++   interpretation of the AUXV. Must be > 16.  */
++#define AT_IGNOREPPC	22		/* Entry should be ignored.  */
++
++#define	AT_SECURE	23		/* Boolean, was exec setuid-like?  */
++
++#define AT_BASE_PLATFORM 24		/* String identifying real platforms.*/
++
++#define AT_RANDOM	25		/* Address of 16 random bytes.  */
++
++#define AT_EXECFN	31		/* Filename of executable.  */
++
++/* Pointer to the global system page used for system calls and other
++   nice things.  */
++#define AT_SYSINFO	32
++#define AT_SYSINFO_EHDR	33
++
++/* Shapes of the caches.  Bits 0-3 contains associativity; bits 4-7 contains
++   log2 of line size; mask those to get cache size.  */
++#define AT_L1I_CACHESHAPE	34
++#define AT_L1D_CACHESHAPE	35
++#define AT_L2_CACHESHAPE	36
++#define AT_L3_CACHESHAPE	37
++
++/* Note section contents.  Each entry in the note section begins with
++   a header of a fixed form.  */
++
++typedef struct
++{
++  Elf32_Word n_namesz;			/* Length of the note's name.  */
++  Elf32_Word n_descsz;			/* Length of the note's descriptor.  */
++  Elf32_Word n_type;			/* Type of the note.  */
++} Elf32_Nhdr;
++
++typedef struct
++{
++  Elf64_Word n_namesz;			/* Length of the note's name.  */
++  Elf64_Word n_descsz;			/* Length of the note's descriptor.  */
++  Elf64_Word n_type;			/* Type of the note.  */
++} Elf64_Nhdr;
++
++/* Known names of notes.  */
++
++/* Solaris entries in the note section have this name.  */
++#define ELF_NOTE_SOLARIS	"SUNW Solaris"
++
++/* Note entries for GNU systems have this name.  */
++#define ELF_NOTE_GNU		"GNU"
++
++
++/* Defined types of notes for Solaris.  */
++
++/* Value of descriptor (one word) is desired pagesize for the binary.  */
++#define ELF_NOTE_PAGESIZE_HINT	1
++
++
++/* Defined note types for GNU systems.  */
++
++/* ABI information.  The descriptor consists of words:
++   word 0: OS descriptor
++   word 1: major version of the ABI
++   word 2: minor version of the ABI
++   word 3: subminor version of the ABI
++*/
++#define NT_GNU_ABI_TAG	1
++#define ELF_NOTE_ABI	NT_GNU_ABI_TAG /* Old name.  */
++
++/* Known OSes.  These values can appear in word 0 of an
++   NT_GNU_ABI_TAG note section entry.  */
++#define ELF_NOTE_OS_LINUX	0
++#define ELF_NOTE_OS_GNU		1
++#define ELF_NOTE_OS_SOLARIS2	2
++#define ELF_NOTE_OS_FREEBSD	3
++
++/* Synthetic hwcap information.  The descriptor begins with two words:
++   word 0: number of entries
++   word 1: bitmask of enabled entries
++   Then follow variable-length entries, one byte followed by a
++   '\0'-terminated hwcap name string.  The byte gives the bit
++   number to test if enabled, (1U << bit) & bitmask.  */
++#define NT_GNU_HWCAP	2
++
++/* Build ID bits as generated by ld --build-id.
++   The descriptor consists of any nonzero number of bytes.  */
++#define NT_GNU_BUILD_ID	3
++
++/* Version note generated by GNU gold containing a version string.  */
++#define NT_GNU_GOLD_VERSION	4
++
++
++/* Move records.  */
++typedef struct
++{
++  Elf32_Xword m_value;		/* Symbol value.  */
++  Elf32_Word m_info;		/* Size and index.  */
++  Elf32_Word m_poffset;		/* Symbol offset.  */
++  Elf32_Half m_repeat;		/* Repeat count.  */
++  Elf32_Half m_stride;		/* Stride info.  */
++} Elf32_Move;
++
++typedef struct
++{
++  Elf64_Xword m_value;		/* Symbol value.  */
++  Elf64_Xword m_info;		/* Size and index.  */
++  Elf64_Xword m_poffset;	/* Symbol offset.  */
++  Elf64_Half m_repeat;		/* Repeat count.  */
++  Elf64_Half m_stride;		/* Stride info.  */
++} Elf64_Move;
++
++/* Macro to construct move records.  */
++#define ELF32_M_SYM(info)	((info) >> 8)
++#define ELF32_M_SIZE(info)	((unsigned char) (info))
++#define ELF32_M_INFO(sym, size)	(((sym) << 8) + (unsigned char) (size))
++
++#define ELF64_M_SYM(info)	ELF32_M_SYM (info)
++#define ELF64_M_SIZE(info)	ELF32_M_SIZE (info)
++#define ELF64_M_INFO(sym, size)	ELF32_M_INFO (sym, size)
++
++
++/* Motorola 68k specific definitions.  */
++
++/* Values for Elf32_Ehdr.e_flags.  */
++#define EF_CPU32	0x00810000
++
++/* m68k relocs.  */
++
++#define R_68K_NONE	0		/* No reloc */
++#define R_68K_32	1		/* Direct 32 bit  */
++#define R_68K_16	2		/* Direct 16 bit  */
++#define R_68K_8		3		/* Direct 8 bit  */
++#define R_68K_PC32	4		/* PC relative 32 bit */
++#define R_68K_PC16	5		/* PC relative 16 bit */
++#define R_68K_PC8	6		/* PC relative 8 bit */
++#define R_68K_GOT32	7		/* 32 bit PC relative GOT entry */
++#define R_68K_GOT16	8		/* 16 bit PC relative GOT entry */
++#define R_68K_GOT8	9		/* 8 bit PC relative GOT entry */
++#define R_68K_GOT32O	10		/* 32 bit GOT offset */
++#define R_68K_GOT16O	11		/* 16 bit GOT offset */
++#define R_68K_GOT8O	12		/* 8 bit GOT offset */
++#define R_68K_PLT32	13		/* 32 bit PC relative PLT address */
++#define R_68K_PLT16	14		/* 16 bit PC relative PLT address */
++#define R_68K_PLT8	15		/* 8 bit PC relative PLT address */
++#define R_68K_PLT32O	16		/* 32 bit PLT offset */
++#define R_68K_PLT16O	17		/* 16 bit PLT offset */
++#define R_68K_PLT8O	18		/* 8 bit PLT offset */
++#define R_68K_COPY	19		/* Copy symbol at runtime */
++#define R_68K_GLOB_DAT	20		/* Create GOT entry */
++#define R_68K_JMP_SLOT	21		/* Create PLT entry */
++#define R_68K_RELATIVE	22		/* Adjust by program base */
++#define R_68K_TLS_GD32      25          /* 32 bit GOT offset for GD */
++#define R_68K_TLS_GD16      26          /* 16 bit GOT offset for GD */
++#define R_68K_TLS_GD8       27          /* 8 bit GOT offset for GD */
++#define R_68K_TLS_LDM32     28          /* 32 bit GOT offset for LDM */
++#define R_68K_TLS_LDM16     29          /* 16 bit GOT offset for LDM */
++#define R_68K_TLS_LDM8      30          /* 8 bit GOT offset for LDM */
++#define R_68K_TLS_LDO32     31          /* 32 bit module-relative offset */
++#define R_68K_TLS_LDO16     32          /* 16 bit module-relative offset */
++#define R_68K_TLS_LDO8      33          /* 8 bit module-relative offset */
++#define R_68K_TLS_IE32      34          /* 32 bit GOT offset for IE */
++#define R_68K_TLS_IE16      35          /* 16 bit GOT offset for IE */
++#define R_68K_TLS_IE8       36          /* 8 bit GOT offset for IE */
++#define R_68K_TLS_LE32      37          /* 32 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_LE16      38          /* 16 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_LE8       39          /* 8 bit offset relative to
++					   static TLS block */
++#define R_68K_TLS_DTPMOD32  40          /* 32 bit module number */
++#define R_68K_TLS_DTPREL32  41          /* 32 bit module-relative offset */
++#define R_68K_TLS_TPREL32   42          /* 32 bit TP-relative offset */
++/* Keep this the last entry.  */
++#define R_68K_NUM	43
++
++/* Intel 80386 specific definitions.  */
++
++/* i386 relocs.  */
++
++#define R_386_NONE	   0		/* No reloc */
++#define R_386_32	   1		/* Direct 32 bit  */
++#define R_386_PC32	   2		/* PC relative 32 bit */
++#define R_386_GOT32	   3		/* 32 bit GOT entry */
++#define R_386_PLT32	   4		/* 32 bit PLT address */
++#define R_386_COPY	   5		/* Copy symbol at runtime */
++#define R_386_GLOB_DAT	   6		/* Create GOT entry */
++#define R_386_JMP_SLOT	   7		/* Create PLT entry */
++#define R_386_RELATIVE	   8		/* Adjust by program base */
++#define R_386_GOTOFF	   9		/* 32 bit offset to GOT */
++#define R_386_GOTPC	   10		/* 32 bit PC relative offset to GOT */
++#define R_386_32PLT	   11
++#define R_386_TLS_TPOFF	   14		/* Offset in static TLS block */
++#define R_386_TLS_IE	   15		/* Address of GOT entry for static TLS
++					   block offset */
++#define R_386_TLS_GOTIE	   16		/* GOT entry for static TLS block
++					   offset */
++#define R_386_TLS_LE	   17		/* Offset relative to static TLS
++					   block */
++#define R_386_TLS_GD	   18		/* Direct 32 bit for GNU version of
++					   general dynamic thread local data */
++#define R_386_TLS_LDM	   19		/* Direct 32 bit for GNU version of
++					   local dynamic thread local data
++					   in LE code */
++#define R_386_16	   20
++#define R_386_PC16	   21
++#define R_386_8		   22
++#define R_386_PC8	   23
++#define R_386_TLS_GD_32	   24		/* Direct 32 bit for general dynamic
++					   thread local data */
++#define R_386_TLS_GD_PUSH  25		/* Tag for pushl in GD TLS code */
++#define R_386_TLS_GD_CALL  26		/* Relocation for call to
++					   __tls_get_addr() */
++#define R_386_TLS_GD_POP   27		/* Tag for popl in GD TLS code */
++#define R_386_TLS_LDM_32   28		/* Direct 32 bit for local dynamic
++					   thread local data in LE code */
++#define R_386_TLS_LDM_PUSH 29		/* Tag for pushl in LDM TLS code */
++#define R_386_TLS_LDM_CALL 30		/* Relocation for call to
++					   __tls_get_addr() in LDM code */
++#define R_386_TLS_LDM_POP  31		/* Tag for popl in LDM TLS code */
++#define R_386_TLS_LDO_32   32		/* Offset relative to TLS block */
++#define R_386_TLS_IE_32	   33		/* GOT entry for negated static TLS
++					   block offset */
++#define R_386_TLS_LE_32	   34		/* Negated offset relative to static
++					   TLS block */
++#define R_386_TLS_DTPMOD32 35		/* ID of module containing symbol */
++#define R_386_TLS_DTPOFF32 36		/* Offset in TLS block */
++#define R_386_TLS_TPOFF32  37		/* Negated offset in static TLS block */
++/* 38? */
++#define R_386_TLS_GOTDESC  39		/* GOT offset for TLS descriptor.  */
++#define R_386_TLS_DESC_CALL 40		/* Marker of call through TLS
++					   descriptor for
++					   relaxation.  */
++#define R_386_TLS_DESC     41		/* TLS descriptor containing
++					   pointer to code and to
++					   argument, returning the TLS
++					   offset for the symbol.  */
++#define R_386_IRELATIVE	   42		/* Adjust indirectly by program base */
++/* Keep this the last entry.  */
++#define R_386_NUM	   43
++
++/* SUN SPARC specific definitions.  */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_SPARC_REGISTER	13	/* Global register reserved to app. */
++
++/* Values for Elf64_Ehdr.e_flags.  */
++
++#define EF_SPARCV9_MM		3
++#define EF_SPARCV9_TSO		0
++#define EF_SPARCV9_PSO		1
++#define EF_SPARCV9_RMO		2
++#define EF_SPARC_LEDATA		0x800000 /* little endian data */
++#define EF_SPARC_EXT_MASK	0xFFFF00
++#define EF_SPARC_32PLUS		0x000100 /* generic V8+ features */
++#define EF_SPARC_SUN_US1	0x000200 /* Sun UltraSPARC1 extensions */
++#define EF_SPARC_HAL_R1		0x000400 /* HAL R1 extensions */
++#define EF_SPARC_SUN_US3	0x000800 /* Sun UltraSPARCIII extensions */
++
++/* SPARC relocs.  */
++
++#define R_SPARC_NONE		0	/* No reloc */
++#define R_SPARC_8		1	/* Direct 8 bit */
++#define R_SPARC_16		2	/* Direct 16 bit */
++#define R_SPARC_32		3	/* Direct 32 bit */
++#define R_SPARC_DISP8		4	/* PC relative 8 bit */
++#define R_SPARC_DISP16		5	/* PC relative 16 bit */
++#define R_SPARC_DISP32		6	/* PC relative 32 bit */
++#define R_SPARC_WDISP30		7	/* PC relative 30 bit shifted */
++#define R_SPARC_WDISP22		8	/* PC relative 22 bit shifted */
++#define R_SPARC_HI22		9	/* High 22 bit */
++#define R_SPARC_22		10	/* Direct 22 bit */
++#define R_SPARC_13		11	/* Direct 13 bit */
++#define R_SPARC_LO10		12	/* Truncated 10 bit */
++#define R_SPARC_GOT10		13	/* Truncated 10 bit GOT entry */
++#define R_SPARC_GOT13		14	/* 13 bit GOT entry */
++#define R_SPARC_GOT22		15	/* 22 bit GOT entry shifted */
++#define R_SPARC_PC10		16	/* PC relative 10 bit truncated */
++#define R_SPARC_PC22		17	/* PC relative 22 bit shifted */
++#define R_SPARC_WPLT30		18	/* 30 bit PC relative PLT address */
++#define R_SPARC_COPY		19	/* Copy symbol at runtime */
++#define R_SPARC_GLOB_DAT	20	/* Create GOT entry */
++#define R_SPARC_JMP_SLOT	21	/* Create PLT entry */
++#define R_SPARC_RELATIVE	22	/* Adjust by program base */
++#define R_SPARC_UA32		23	/* Direct 32 bit unaligned */
++
++/* Additional Sparc64 relocs.  */
++
++#define R_SPARC_PLT32		24	/* Direct 32 bit ref to PLT entry */
++#define R_SPARC_HIPLT22		25	/* High 22 bit PLT entry */
++#define R_SPARC_LOPLT10		26	/* Truncated 10 bit PLT entry */
++#define R_SPARC_PCPLT32		27	/* PC rel 32 bit ref to PLT entry */
++#define R_SPARC_PCPLT22		28	/* PC rel high 22 bit PLT entry */
++#define R_SPARC_PCPLT10		29	/* PC rel trunc 10 bit PLT entry */
++#define R_SPARC_10		30	/* Direct 10 bit */
++#define R_SPARC_11		31	/* Direct 11 bit */
++#define R_SPARC_64		32	/* Direct 64 bit */
++#define R_SPARC_OLO10		33	/* 10bit with secondary 13bit addend */
++#define R_SPARC_HH22		34	/* Top 22 bits of direct 64 bit */
++#define R_SPARC_HM10		35	/* High middle 10 bits of ... */
++#define R_SPARC_LM22		36	/* Low middle 22 bits of ... */
++#define R_SPARC_PC_HH22		37	/* Top 22 bits of pc rel 64 bit */
++#define R_SPARC_PC_HM10		38	/* High middle 10 bit of ... */
++#define R_SPARC_PC_LM22		39	/* Low miggle 22 bits of ... */
++#define R_SPARC_WDISP16		40	/* PC relative 16 bit shifted */
++#define R_SPARC_WDISP19		41	/* PC relative 19 bit shifted */
++#define R_SPARC_GLOB_JMP	42	/* was part of v9 ABI but was removed */
++#define R_SPARC_7		43	/* Direct 7 bit */
++#define R_SPARC_5		44	/* Direct 5 bit */
++#define R_SPARC_6		45	/* Direct 6 bit */
++#define R_SPARC_DISP64		46	/* PC relative 64 bit */
++#define R_SPARC_PLT64		47	/* Direct 64 bit ref to PLT entry */
++#define R_SPARC_HIX22		48	/* High 22 bit complemented */
++#define R_SPARC_LOX10		49	/* Truncated 11 bit complemented */
++#define R_SPARC_H44		50	/* Direct high 12 of 44 bit */
++#define R_SPARC_M44		51	/* Direct mid 22 of 44 bit */
++#define R_SPARC_L44		52	/* Direct low 10 of 44 bit */
++#define R_SPARC_REGISTER	53	/* Global register usage */
++#define R_SPARC_UA64		54	/* Direct 64 bit unaligned */
++#define R_SPARC_UA16		55	/* Direct 16 bit unaligned */
++#define R_SPARC_TLS_GD_HI22	56
++#define R_SPARC_TLS_GD_LO10	57
++#define R_SPARC_TLS_GD_ADD	58
++#define R_SPARC_TLS_GD_CALL	59
++#define R_SPARC_TLS_LDM_HI22	60
++#define R_SPARC_TLS_LDM_LO10	61
++#define R_SPARC_TLS_LDM_ADD	62
++#define R_SPARC_TLS_LDM_CALL	63
++#define R_SPARC_TLS_LDO_HIX22	64
++#define R_SPARC_TLS_LDO_LOX10	65
++#define R_SPARC_TLS_LDO_ADD	66
++#define R_SPARC_TLS_IE_HI22	67
++#define R_SPARC_TLS_IE_LO10	68
++#define R_SPARC_TLS_IE_LD	69
++#define R_SPARC_TLS_IE_LDX	70
++#define R_SPARC_TLS_IE_ADD	71
++#define R_SPARC_TLS_LE_HIX22	72
++#define R_SPARC_TLS_LE_LOX10	73
++#define R_SPARC_TLS_DTPMOD32	74
++#define R_SPARC_TLS_DTPMOD64	75
++#define R_SPARC_TLS_DTPOFF32	76
++#define R_SPARC_TLS_DTPOFF64	77
++#define R_SPARC_TLS_TPOFF32	78
++#define R_SPARC_TLS_TPOFF64	79
++#define R_SPARC_GOTDATA_HIX22	80
++#define R_SPARC_GOTDATA_LOX10	81
++#define R_SPARC_GOTDATA_OP_HIX22	82
++#define R_SPARC_GOTDATA_OP_LOX10	83
++#define R_SPARC_GOTDATA_OP	84
++#define R_SPARC_H34		85
++#define R_SPARC_SIZE32		86
++#define R_SPARC_SIZE64		87
++#define R_SPARC_WDISP10		88
++#define R_SPARC_JMP_IREL	248
++#define R_SPARC_IRELATIVE	249
++#define R_SPARC_GNU_VTINHERIT	250
++#define R_SPARC_GNU_VTENTRY	251
++#define R_SPARC_REV32		252
++/* Keep this the last entry.  */
++#define R_SPARC_NUM		253
++
++/* For Sparc64, legal values for d_tag of Elf64_Dyn.  */
++
++#define DT_SPARC_REGISTER 0x70000001
++#define DT_SPARC_NUM	2
++
++/* MIPS R3000 specific definitions.  */
++
++/* Legal values for e_flags field of Elf32_Ehdr.  */
++
++#define EF_MIPS_NOREORDER   1		/* A .noreorder directive was used */
++#define EF_MIPS_PIC	    2		/* Contains PIC code */
++#define EF_MIPS_CPIC	    4		/* Uses PIC calling sequence */
++#define EF_MIPS_XGOT	    8
++#define EF_MIPS_64BIT_WHIRL 16
++#define EF_MIPS_ABI2	    32
++#define EF_MIPS_ABI_ON32    64
++#define EF_MIPS_ARCH	    0xf0000000	/* MIPS architecture level */
++
++/* Legal values for MIPS architecture level.  */
++
++#define EF_MIPS_ARCH_1	    0x00000000	/* -mips1 code.  */
++#define EF_MIPS_ARCH_2	    0x10000000	/* -mips2 code.  */
++#define EF_MIPS_ARCH_3	    0x20000000	/* -mips3 code.  */
++#define EF_MIPS_ARCH_4	    0x30000000	/* -mips4 code.  */
++#define EF_MIPS_ARCH_5	    0x40000000	/* -mips5 code.  */
++#define EF_MIPS_ARCH_32	    0x60000000	/* MIPS32 code.  */
++#define EF_MIPS_ARCH_64	    0x70000000	/* MIPS64 code.  */
++
++/* The following are non-official names and should not be used.  */
++
++#define E_MIPS_ARCH_1	  0x00000000	/* -mips1 code.  */
++#define E_MIPS_ARCH_2	  0x10000000	/* -mips2 code.  */
++#define E_MIPS_ARCH_3	  0x20000000	/* -mips3 code.  */
++#define E_MIPS_ARCH_4	  0x30000000	/* -mips4 code.  */
++#define E_MIPS_ARCH_5	  0x40000000	/* -mips5 code.  */
++#define E_MIPS_ARCH_32	  0x60000000	/* MIPS32 code.  */
++#define E_MIPS_ARCH_64	  0x70000000	/* MIPS64 code.  */
++
++/* Special section indices.  */
++
++#define SHN_MIPS_ACOMMON    0xff00	/* Allocated common symbols */
++#define SHN_MIPS_TEXT	    0xff01	/* Allocated test symbols.  */
++#define SHN_MIPS_DATA	    0xff02	/* Allocated data symbols.  */
++#define SHN_MIPS_SCOMMON    0xff03	/* Small common symbols */
++#define SHN_MIPS_SUNDEFINED 0xff04	/* Small undefined symbols */
++
++/* Legal values for sh_type field of Elf32_Shdr.  */
++
++#define SHT_MIPS_LIBLIST       0x70000000 /* Shared objects used in link */
++#define SHT_MIPS_MSYM	       0x70000001
++#define SHT_MIPS_CONFLICT      0x70000002 /* Conflicting symbols */
++#define SHT_MIPS_GPTAB	       0x70000003 /* Global data area sizes */
++#define SHT_MIPS_UCODE	       0x70000004 /* Reserved for SGI/MIPS compilers */
++#define SHT_MIPS_DEBUG	       0x70000005 /* MIPS ECOFF debugging information*/
++#define SHT_MIPS_REGINFO       0x70000006 /* Register usage information */
++#define SHT_MIPS_PACKAGE       0x70000007
++#define SHT_MIPS_PACKSYM       0x70000008
++#define SHT_MIPS_RELD	       0x70000009
++#define SHT_MIPS_IFACE         0x7000000b
++#define SHT_MIPS_CONTENT       0x7000000c
++#define SHT_MIPS_OPTIONS       0x7000000d /* Miscellaneous options.  */
++#define SHT_MIPS_SHDR	       0x70000010
++#define SHT_MIPS_FDESC	       0x70000011
++#define SHT_MIPS_EXTSYM	       0x70000012
++#define SHT_MIPS_DENSE	       0x70000013
++#define SHT_MIPS_PDESC	       0x70000014
++#define SHT_MIPS_LOCSYM	       0x70000015
++#define SHT_MIPS_AUXSYM	       0x70000016
++#define SHT_MIPS_OPTSYM	       0x70000017
++#define SHT_MIPS_LOCSTR	       0x70000018
++#define SHT_MIPS_LINE	       0x70000019
++#define SHT_MIPS_RFDESC	       0x7000001a
++#define SHT_MIPS_DELTASYM      0x7000001b
++#define SHT_MIPS_DELTAINST     0x7000001c
++#define SHT_MIPS_DELTACLASS    0x7000001d
++#define SHT_MIPS_DWARF         0x7000001e /* DWARF debugging information.  */
++#define SHT_MIPS_DELTADECL     0x7000001f
++#define SHT_MIPS_SYMBOL_LIB    0x70000020
++#define SHT_MIPS_EVENTS	       0x70000021 /* Event section.  */
++#define SHT_MIPS_TRANSLATE     0x70000022
++#define SHT_MIPS_PIXIE	       0x70000023
++#define SHT_MIPS_XLATE	       0x70000024
++#define SHT_MIPS_XLATE_DEBUG   0x70000025
++#define SHT_MIPS_WHIRL	       0x70000026
++#define SHT_MIPS_EH_REGION     0x70000027
++#define SHT_MIPS_XLATE_OLD     0x70000028
++#define SHT_MIPS_PDR_EXCEPTION 0x70000029
++
++/* Legal values for sh_flags field of Elf32_Shdr.  */
++
++#define SHF_MIPS_GPREL	 0x10000000	/* Must be part of global data area */
++#define SHF_MIPS_MERGE	 0x20000000
++#define SHF_MIPS_ADDR	 0x40000000
++#define SHF_MIPS_STRINGS 0x80000000
++#define SHF_MIPS_NOSTRIP 0x08000000
++#define SHF_MIPS_LOCAL	 0x04000000
++#define SHF_MIPS_NAMES	 0x02000000
++#define SHF_MIPS_NODUPE	 0x01000000
++
++
++/* Symbol tables.  */
++
++/* MIPS specific values for `st_other'.  */
++#define STO_MIPS_DEFAULT		0x0
++#define STO_MIPS_INTERNAL		0x1
++#define STO_MIPS_HIDDEN			0x2
++#define STO_MIPS_PROTECTED		0x3
++#define STO_MIPS_PLT			0x8
++#define STO_MIPS_SC_ALIGN_UNUSED	0xff
++
++/* MIPS specific values for `st_info'.  */
++#define STB_MIPS_SPLIT_COMMON		13
++
++/* Entries found in sections of type SHT_MIPS_GPTAB.  */
++
++typedef union
++{
++  struct
++    {
++      Elf32_Word gt_current_g_value;	/* -G value used for compilation */
++      Elf32_Word gt_unused;		/* Not used */
++    } gt_header;			/* First entry in section */
++  struct
++    {
++      Elf32_Word gt_g_value;		/* If this value were used for -G */
++      Elf32_Word gt_bytes;		/* This many bytes would be used */
++    } gt_entry;				/* Subsequent entries in section */
++} Elf32_gptab;
++
++/* Entry found in sections of type SHT_MIPS_REGINFO.  */
++
++typedef struct
++{
++  Elf32_Word	ri_gprmask;		/* General registers used */
++  Elf32_Word	ri_cprmask[4];		/* Coprocessor registers used */
++  Elf32_Sword	ri_gp_value;		/* $gp register value */
++} Elf32_RegInfo;
++
++/* Entries found in sections of type SHT_MIPS_OPTIONS.  */
++
++typedef struct
++{
++  unsigned char kind;		/* Determines interpretation of the
++				   variable part of descriptor.  */
++  unsigned char size;		/* Size of descriptor, including header.  */
++  Elf32_Section section;	/* Section header index of section affected,
++				   0 for global options.  */
++  Elf32_Word info;		/* Kind-specific information.  */
++} Elf_Options;
++
++/* Values for `kind' field in Elf_Options.  */
++
++#define ODK_NULL	0	/* Undefined.  */
++#define ODK_REGINFO	1	/* Register usage information.  */
++#define ODK_EXCEPTIONS	2	/* Exception processing options.  */
++#define ODK_PAD		3	/* Section padding options.  */
++#define ODK_HWPATCH	4	/* Hardware workarounds performed */
++#define ODK_FILL	5	/* record the fill value used by the linker. */
++#define ODK_TAGS	6	/* reserve space for desktop tools to write. */
++#define ODK_HWAND	7	/* HW workarounds.  'AND' bits when merging. */
++#define ODK_HWOR	8	/* HW workarounds.  'OR' bits when merging.  */
++
++/* Values for `info' in Elf_Options for ODK_EXCEPTIONS entries.  */
++
++#define OEX_FPU_MIN	0x1f	/* FPE's which MUST be enabled.  */
++#define OEX_FPU_MAX	0x1f00	/* FPE's which MAY be enabled.  */
++#define OEX_PAGE0	0x10000	/* page zero must be mapped.  */
++#define OEX_SMM		0x20000	/* Force sequential memory mode?  */
++#define OEX_FPDBUG	0x40000	/* Force floating point debug mode?  */
++#define OEX_PRECISEFP	OEX_FPDBUG
++#define OEX_DISMISS	0x80000	/* Dismiss invalid address faults?  */
++
++#define OEX_FPU_INVAL	0x10
++#define OEX_FPU_DIV0	0x08
++#define OEX_FPU_OFLO	0x04
++#define OEX_FPU_UFLO	0x02
++#define OEX_FPU_INEX	0x01
++
++/* Masks for `info' in Elf_Options for an ODK_HWPATCH entry.  */
++
++#define OHW_R4KEOP	0x1	/* R4000 end-of-page patch.  */
++#define OHW_R8KPFETCH	0x2	/* may need R8000 prefetch patch.  */
++#define OHW_R5KEOP	0x4	/* R5000 end-of-page patch.  */
++#define OHW_R5KCVTL	0x8	/* R5000 cvt.[ds].l bug.  clean=1.  */
++
++#define OPAD_PREFIX	0x1
++#define OPAD_POSTFIX	0x2
++#define OPAD_SYMBOL	0x4
++
++/* Entry found in `.options' section.  */
++
++typedef struct
++{
++  Elf32_Word hwp_flags1;	/* Extra flags.  */
++  Elf32_Word hwp_flags2;	/* Extra flags.  */
++} Elf_Options_Hw;
++
++/* Masks for `info' in ElfOptions for ODK_HWAND and ODK_HWOR entries.  */
++
++#define OHWA0_R4KEOP_CHECKED	0x00000001
++#define OHWA1_R4KEOP_CLEAN	0x00000002
++
++/* MIPS relocs.  */
++
++#define R_MIPS_NONE		0	/* No reloc */
++#define R_MIPS_16		1	/* Direct 16 bit */
++#define R_MIPS_32		2	/* Direct 32 bit */
++#define R_MIPS_REL32		3	/* PC relative 32 bit */
++#define R_MIPS_26		4	/* Direct 26 bit shifted */
++#define R_MIPS_HI16		5	/* High 16 bit */
++#define R_MIPS_LO16		6	/* Low 16 bit */
++#define R_MIPS_GPREL16		7	/* GP relative 16 bit */
++#define R_MIPS_LITERAL		8	/* 16 bit literal entry */
++#define R_MIPS_GOT16		9	/* 16 bit GOT entry */
++#define R_MIPS_PC16		10	/* PC relative 16 bit */
++#define R_MIPS_CALL16		11	/* 16 bit GOT entry for function */
++#define R_MIPS_GPREL32		12	/* GP relative 32 bit */
++
++#define R_MIPS_SHIFT5		16
++#define R_MIPS_SHIFT6		17
++#define R_MIPS_64		18
++#define R_MIPS_GOT_DISP		19
++#define R_MIPS_GOT_PAGE		20
++#define R_MIPS_GOT_OFST		21
++#define R_MIPS_GOT_HI16		22
++#define R_MIPS_GOT_LO16		23
++#define R_MIPS_SUB		24
++#define R_MIPS_INSERT_A		25
++#define R_MIPS_INSERT_B		26
++#define R_MIPS_DELETE		27
++#define R_MIPS_HIGHER		28
++#define R_MIPS_HIGHEST		29
++#define R_MIPS_CALL_HI16	30
++#define R_MIPS_CALL_LO16	31
++#define R_MIPS_SCN_DISP		32
++#define R_MIPS_REL16		33
++#define R_MIPS_ADD_IMMEDIATE	34
++#define R_MIPS_PJUMP		35
++#define R_MIPS_RELGOT		36
++#define R_MIPS_JALR		37
++#define R_MIPS_TLS_DTPMOD32	38	/* Module number 32 bit */
++#define R_MIPS_TLS_DTPREL32	39	/* Module-relative offset 32 bit */
++#define R_MIPS_TLS_DTPMOD64	40	/* Module number 64 bit */
++#define R_MIPS_TLS_DTPREL64	41	/* Module-relative offset 64 bit */
++#define R_MIPS_TLS_GD		42	/* 16 bit GOT offset for GD */
++#define R_MIPS_TLS_LDM		43	/* 16 bit GOT offset for LDM */
++#define R_MIPS_TLS_DTPREL_HI16	44	/* Module-relative offset, high 16 bits */
++#define R_MIPS_TLS_DTPREL_LO16	45	/* Module-relative offset, low 16 bits */
++#define R_MIPS_TLS_GOTTPREL	46	/* 16 bit GOT offset for IE */
++#define R_MIPS_TLS_TPREL32	47	/* TP-relative offset, 32 bit */
++#define R_MIPS_TLS_TPREL64	48	/* TP-relative offset, 64 bit */
++#define R_MIPS_TLS_TPREL_HI16	49	/* TP-relative offset, high 16 bits */
++#define R_MIPS_TLS_TPREL_LO16	50	/* TP-relative offset, low 16 bits */
++#define R_MIPS_GLOB_DAT		51
++#define R_MIPS_COPY		126
++#define R_MIPS_JUMP_SLOT        127
++/* Keep this the last entry.  */
++#define R_MIPS_NUM		128
++
++/* Legal values for p_type field of Elf32_Phdr.  */
++
++#define PT_MIPS_REGINFO	0x70000000	/* Register usage information */
++#define PT_MIPS_RTPROC  0x70000001	/* Runtime procedure table. */
++#define PT_MIPS_OPTIONS 0x70000002
++
++/* Special program header types.  */
++
++#define PF_MIPS_LOCAL	0x10000000
++
++/* Legal values for d_tag field of Elf32_Dyn.  */
++
++#define DT_MIPS_RLD_VERSION  0x70000001	/* Runtime linker interface version */
++#define DT_MIPS_TIME_STAMP   0x70000002	/* Timestamp */
++#define DT_MIPS_ICHECKSUM    0x70000003	/* Checksum */
++#define DT_MIPS_IVERSION     0x70000004	/* Version string (string tbl index) */
++#define DT_MIPS_FLAGS	     0x70000005	/* Flags */
++#define DT_MIPS_BASE_ADDRESS 0x70000006	/* Base address */
++#define DT_MIPS_MSYM	     0x70000007
++#define DT_MIPS_CONFLICT     0x70000008	/* Address of CONFLICT section */
++#define DT_MIPS_LIBLIST	     0x70000009	/* Address of LIBLIST section */
++#define DT_MIPS_LOCAL_GOTNO  0x7000000a	/* Number of local GOT entries */
++#define DT_MIPS_CONFLICTNO   0x7000000b	/* Number of CONFLICT entries */
++#define DT_MIPS_LIBLISTNO    0x70000010	/* Number of LIBLIST entries */
++#define DT_MIPS_SYMTABNO     0x70000011	/* Number of DYNSYM entries */
++#define DT_MIPS_UNREFEXTNO   0x70000012	/* First external DYNSYM */
++#define DT_MIPS_GOTSYM	     0x70000013	/* First GOT entry in DYNSYM */
++#define DT_MIPS_HIPAGENO     0x70000014	/* Number of GOT page table entries */
++#define DT_MIPS_RLD_MAP	     0x70000016	/* Address of run time loader map.  */
++#define DT_MIPS_DELTA_CLASS  0x70000017	/* Delta C++ class definition.  */
++#define DT_MIPS_DELTA_CLASS_NO    0x70000018 /* Number of entries in
++						DT_MIPS_DELTA_CLASS.  */
++#define DT_MIPS_DELTA_INSTANCE    0x70000019 /* Delta C++ class instances.  */
++#define DT_MIPS_DELTA_INSTANCE_NO 0x7000001a /* Number of entries in
++						DT_MIPS_DELTA_INSTANCE.  */
++#define DT_MIPS_DELTA_RELOC  0x7000001b /* Delta relocations.  */
++#define DT_MIPS_DELTA_RELOC_NO 0x7000001c /* Number of entries in
++					     DT_MIPS_DELTA_RELOC.  */
++#define DT_MIPS_DELTA_SYM    0x7000001d /* Delta symbols that Delta
++					   relocations refer to.  */
++#define DT_MIPS_DELTA_SYM_NO 0x7000001e /* Number of entries in
++					   DT_MIPS_DELTA_SYM.  */
++#define DT_MIPS_DELTA_CLASSSYM 0x70000020 /* Delta symbols that hold the
++					     class declaration.  */
++#define DT_MIPS_DELTA_CLASSSYM_NO 0x70000021 /* Number of entries in
++						DT_MIPS_DELTA_CLASSSYM.  */
++#define DT_MIPS_CXX_FLAGS    0x70000022 /* Flags indicating for C++ flavor.  */
++#define DT_MIPS_PIXIE_INIT   0x70000023
++#define DT_MIPS_SYMBOL_LIB   0x70000024
++#define DT_MIPS_LOCALPAGE_GOTIDX 0x70000025
++#define DT_MIPS_LOCAL_GOTIDX 0x70000026
++#define DT_MIPS_HIDDEN_GOTIDX 0x70000027
++#define DT_MIPS_PROTECTED_GOTIDX 0x70000028
++#define DT_MIPS_OPTIONS	     0x70000029 /* Address of .options.  */
++#define DT_MIPS_INTERFACE    0x7000002a /* Address of .interface.  */
++#define DT_MIPS_DYNSTR_ALIGN 0x7000002b
++#define DT_MIPS_INTERFACE_SIZE 0x7000002c /* Size of the .interface section. */
++#define DT_MIPS_RLD_TEXT_RESOLVE_ADDR 0x7000002d /* Address of rld_text_rsolve
++						    function stored in GOT.  */
++#define DT_MIPS_PERF_SUFFIX  0x7000002e /* Default suffix of dso to be added
++					   by rld on dlopen() calls.  */
++#define DT_MIPS_COMPACT_SIZE 0x7000002f /* (O32)Size of compact rel section. */
++#define DT_MIPS_GP_VALUE     0x70000030 /* GP value for aux GOTs.  */
++#define DT_MIPS_AUX_DYNAMIC  0x70000031 /* Address of aux .dynamic.  */
++/* The address of .got.plt in an executable using the new non-PIC ABI.  */
++#define DT_MIPS_PLTGOT	     0x70000032
++/* The base of the PLT in an executable using the new non-PIC ABI if that
++   PLT is writable.  For a non-writable PLT, this is omitted or has a zero
++   value.  */
++#define DT_MIPS_RWPLT        0x70000034
++#define DT_MIPS_NUM	     0x35
++
++/* Legal values for DT_MIPS_FLAGS Elf32_Dyn entry.  */
++
++#define RHF_NONE		   0		/* No flags */
++#define RHF_QUICKSTART		   (1 << 0)	/* Use quickstart */
++#define RHF_NOTPOT		   (1 << 1)	/* Hash size not power of 2 */
++#define RHF_NO_LIBRARY_REPLACEMENT (1 << 2)	/* Ignore LD_LIBRARY_PATH */
++#define RHF_NO_MOVE		   (1 << 3)
++#define RHF_SGI_ONLY		   (1 << 4)
++#define RHF_GUARANTEE_INIT	   (1 << 5)
++#define RHF_DELTA_C_PLUS_PLUS	   (1 << 6)
++#define RHF_GUARANTEE_START_INIT   (1 << 7)
++#define RHF_PIXIE		   (1 << 8)
++#define RHF_DEFAULT_DELAY_LOAD	   (1 << 9)
++#define RHF_REQUICKSTART	   (1 << 10)
++#define RHF_REQUICKSTARTED	   (1 << 11)
++#define RHF_CORD		   (1 << 12)
++#define RHF_NO_UNRES_UNDEF	   (1 << 13)
++#define RHF_RLD_ORDER_SAFE	   (1 << 14)
++
++/* Entries found in sections of type SHT_MIPS_LIBLIST.  */
++
++typedef struct
++{
++  Elf32_Word l_name;		/* Name (string table index) */
++  Elf32_Word l_time_stamp;	/* Timestamp */
++  Elf32_Word l_checksum;	/* Checksum */
++  Elf32_Word l_version;		/* Interface version */
++  Elf32_Word l_flags;		/* Flags */
++} Elf32_Lib;
++
++typedef struct
++{
++  Elf64_Word l_name;		/* Name (string table index) */
++  Elf64_Word l_time_stamp;	/* Timestamp */
++  Elf64_Word l_checksum;	/* Checksum */
++  Elf64_Word l_version;		/* Interface version */
++  Elf64_Word l_flags;		/* Flags */
++} Elf64_Lib;
++
++
++/* Legal values for l_flags.  */
++
++#define LL_NONE		  0
++#define LL_EXACT_MATCH	  (1 << 0)	/* Require exact match */
++#define LL_IGNORE_INT_VER (1 << 1)	/* Ignore interface version */
++#define LL_REQUIRE_MINOR  (1 << 2)
++#define LL_EXPORTS	  (1 << 3)
++#define LL_DELAY_LOAD	  (1 << 4)
++#define LL_DELTA	  (1 << 5)
++
++/* Entries found in sections of type SHT_MIPS_CONFLICT.  */
++
++typedef Elf32_Addr Elf32_Conflict;
++
++
++/* HPPA specific definitions.  */
++
++/* Legal values for e_flags field of Elf32_Ehdr.  */
++
++#define EF_PARISC_TRAPNIL	0x00010000 /* Trap nil pointer dereference.  */
++#define EF_PARISC_EXT		0x00020000 /* Program uses arch. extensions. */
++#define EF_PARISC_LSB		0x00040000 /* Program expects little endian. */
++#define EF_PARISC_WIDE		0x00080000 /* Program expects wide mode.  */
++#define EF_PARISC_NO_KABP	0x00100000 /* No kernel assisted branch
++					      prediction.  */
++#define EF_PARISC_LAZYSWAP	0x00400000 /* Allow lazy swapping.  */
++#define EF_PARISC_ARCH		0x0000ffff /* Architecture version.  */
++
++/* Defined values for `e_flags & EF_PARISC_ARCH' are:  */
++
++#define EFA_PARISC_1_0		    0x020b /* PA-RISC 1.0 big-endian.  */
++#define EFA_PARISC_1_1		    0x0210 /* PA-RISC 1.1 big-endian.  */
++#define EFA_PARISC_2_0		    0x0214 /* PA-RISC 2.0 big-endian.  */
++
++/* Additional section indeces.  */
++
++#define SHN_PARISC_ANSI_COMMON	0xff00	   /* Section for tenatively declared
++					      symbols in ANSI C.  */
++#define SHN_PARISC_HUGE_COMMON	0xff01	   /* Common blocks in huge model.  */
++
++/* Legal values for sh_type field of Elf32_Shdr.  */
++
++#define SHT_PARISC_EXT		0x70000000 /* Contains product specific ext. */
++#define SHT_PARISC_UNWIND	0x70000001 /* Unwind information.  */
++#define SHT_PARISC_DOC		0x70000002 /* Debug info for optimized code. */
++
++/* Legal values for sh_flags field of Elf32_Shdr.  */
++
++#define SHF_PARISC_SHORT	0x20000000 /* Section with short addressing. */
++#define SHF_PARISC_HUGE		0x40000000 /* Section far from gp.  */
++#define SHF_PARISC_SBP		0x80000000 /* Static branch prediction code. */
++
++/* Legal values for ST_TYPE subfield of st_info (symbol type).  */
++
++#define STT_PARISC_MILLICODE	13	/* Millicode function entry point.  */
++
++#define STT_HP_OPAQUE		(STT_LOOS + 0x1)
++#define STT_HP_STUB		(STT_LOOS + 0x2)
++
++/* HPPA relocs.  */
++
++#define R_PARISC_NONE		0	/* No reloc.  */
++#define R_PARISC_DIR32		1	/* Direct 32-bit reference.  */
++#define R_PARISC_DIR21L		2	/* Left 21 bits of eff. address.  */
++#define R_PARISC_DIR17R		3	/* Right 17 bits of eff. address.  */
++#define R_PARISC_DIR17F		4	/* 17 bits of eff. address.  */
++#define R_PARISC_DIR14R		6	/* Right 14 bits of eff. address.  */
++#define R_PARISC_PCREL32	9	/* 32-bit rel. address.  */
++#define R_PARISC_PCREL21L	10	/* Left 21 bits of rel. address.  */
++#define R_PARISC_PCREL17R	11	/* Right 17 bits of rel. address.  */
++#define R_PARISC_PCREL17F	12	/* 17 bits of rel. address.  */
++#define R_PARISC_PCREL14R	14	/* Right 14 bits of rel. address.  */
++#define R_PARISC_DPREL21L	18	/* Left 21 bits of rel. address.  */
++#define R_PARISC_DPREL14R	22	/* Right 14 bits of rel. address.  */
++#define R_PARISC_GPREL21L	26	/* GP-relative, left 21 bits.  */
++#define R_PARISC_GPREL14R	30	/* GP-relative, right 14 bits.  */
++#define R_PARISC_LTOFF21L	34	/* LT-relative, left 21 bits.  */
++#define R_PARISC_LTOFF14R	38	/* LT-relative, right 14 bits.  */
++#define R_PARISC_SECREL32	41	/* 32 bits section rel. address.  */
++#define R_PARISC_SEGBASE	48	/* No relocation, set segment base.  */
++#define R_PARISC_SEGREL32	49	/* 32 bits segment rel. address.  */
++#define R_PARISC_PLTOFF21L	50	/* PLT rel. address, left 21 bits.  */
++#define R_PARISC_PLTOFF14R	54	/* PLT rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF_FPTR32	57	/* 32 bits LT-rel. function pointer. */
++#define R_PARISC_LTOFF_FPTR21L	58	/* LT-rel. fct ptr, left 21 bits. */
++#define R_PARISC_LTOFF_FPTR14R	62	/* LT-rel. fct ptr, right 14 bits. */
++#define R_PARISC_FPTR64		64	/* 64 bits function address.  */
++#define R_PARISC_PLABEL32	65	/* 32 bits function address.  */
++#define R_PARISC_PLABEL21L	66	/* Left 21 bits of fdesc address.  */
++#define R_PARISC_PLABEL14R	70	/* Right 14 bits of fdesc address.  */
++#define R_PARISC_PCREL64	72	/* 64 bits PC-rel. address.  */
++#define R_PARISC_PCREL22F	74	/* 22 bits PC-rel. address.  */
++#define R_PARISC_PCREL14WR	75	/* PC-rel. address, right 14 bits.  */
++#define R_PARISC_PCREL14DR	76	/* PC rel. address, right 14 bits.  */
++#define R_PARISC_PCREL16F	77	/* 16 bits PC-rel. address.  */
++#define R_PARISC_PCREL16WF	78	/* 16 bits PC-rel. address.  */
++#define R_PARISC_PCREL16DF	79	/* 16 bits PC-rel. address.  */
++#define R_PARISC_DIR64		80	/* 64 bits of eff. address.  */
++#define R_PARISC_DIR14WR	83	/* 14 bits of eff. address.  */
++#define R_PARISC_DIR14DR	84	/* 14 bits of eff. address.  */
++#define R_PARISC_DIR16F		85	/* 16 bits of eff. address.  */
++#define R_PARISC_DIR16WF	86	/* 16 bits of eff. address.  */
++#define R_PARISC_DIR16DF	87	/* 16 bits of eff. address.  */
++#define R_PARISC_GPREL64	88	/* 64 bits of GP-rel. address.  */
++#define R_PARISC_GPREL14WR	91	/* GP-rel. address, right 14 bits.  */
++#define R_PARISC_GPREL14DR	92	/* GP-rel. address, right 14 bits.  */
++#define R_PARISC_GPREL16F	93	/* 16 bits GP-rel. address.  */
++#define R_PARISC_GPREL16WF	94	/* 16 bits GP-rel. address.  */
++#define R_PARISC_GPREL16DF	95	/* 16 bits GP-rel. address.  */
++#define R_PARISC_LTOFF64	96	/* 64 bits LT-rel. address.  */
++#define R_PARISC_LTOFF14WR	99	/* LT-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF14DR	100	/* LT-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF16F	101	/* 16 bits LT-rel. address.  */
++#define R_PARISC_LTOFF16WF	102	/* 16 bits LT-rel. address.  */
++#define R_PARISC_LTOFF16DF	103	/* 16 bits LT-rel. address.  */
++#define R_PARISC_SECREL64	104	/* 64 bits section rel. address.  */
++#define R_PARISC_SEGREL64	112	/* 64 bits segment rel. address.  */
++#define R_PARISC_PLTOFF14WR	115	/* PLT-rel. address, right 14 bits.  */
++#define R_PARISC_PLTOFF14DR	116	/* PLT-rel. address, right 14 bits.  */
++#define R_PARISC_PLTOFF16F	117	/* 16 bits LT-rel. address.  */
++#define R_PARISC_PLTOFF16WF	118	/* 16 bits PLT-rel. address.  */
++#define R_PARISC_PLTOFF16DF	119	/* 16 bits PLT-rel. address.  */
++#define R_PARISC_LTOFF_FPTR64	120	/* 64 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR14WR	123	/* LT-rel. fct. ptr., right 14 bits. */
++#define R_PARISC_LTOFF_FPTR14DR	124	/* LT-rel. fct. ptr., right 14 bits. */
++#define R_PARISC_LTOFF_FPTR16F	125	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR16WF	126	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LTOFF_FPTR16DF	127	/* 16 bits LT-rel. function ptr.  */
++#define R_PARISC_LORESERVE	128
++#define R_PARISC_COPY		128	/* Copy relocation.  */
++#define R_PARISC_IPLT		129	/* Dynamic reloc, imported PLT */
++#define R_PARISC_EPLT		130	/* Dynamic reloc, exported PLT */
++#define R_PARISC_TPREL32	153	/* 32 bits TP-rel. address.  */
++#define R_PARISC_TPREL21L	154	/* TP-rel. address, left 21 bits.  */
++#define R_PARISC_TPREL14R	158	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_LTOFF_TP21L	162	/* LT-TP-rel. address, left 21 bits. */
++#define R_PARISC_LTOFF_TP14R	166	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP14F	167	/* 14 bits LT-TP-rel. address.  */
++#define R_PARISC_TPREL64	216	/* 64 bits TP-rel. address.  */
++#define R_PARISC_TPREL14WR	219	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_TPREL14DR	220	/* TP-rel. address, right 14 bits.  */
++#define R_PARISC_TPREL16F	221	/* 16 bits TP-rel. address.  */
++#define R_PARISC_TPREL16WF	222	/* 16 bits TP-rel. address.  */
++#define R_PARISC_TPREL16DF	223	/* 16 bits TP-rel. address.  */
++#define R_PARISC_LTOFF_TP64	224	/* 64 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP14WR	227	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP14DR	228	/* LT-TP-rel. address, right 14 bits.*/
++#define R_PARISC_LTOFF_TP16F	229	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP16WF	230	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_LTOFF_TP16DF	231	/* 16 bits LT-TP-rel. address.  */
++#define R_PARISC_GNU_VTENTRY	232
++#define R_PARISC_GNU_VTINHERIT	233
++#define R_PARISC_TLS_GD21L	234	/* GD 21-bit left.  */
++#define R_PARISC_TLS_GD14R	235	/* GD 14-bit right.  */
++#define R_PARISC_TLS_GDCALL	236	/* GD call to __t_g_a.  */
++#define R_PARISC_TLS_LDM21L	237	/* LD module 21-bit left.  */
++#define R_PARISC_TLS_LDM14R	238	/* LD module 14-bit right.  */
++#define R_PARISC_TLS_LDMCALL	239	/* LD module call to __t_g_a.  */
++#define R_PARISC_TLS_LDO21L	240	/* LD offset 21-bit left.  */
++#define R_PARISC_TLS_LDO14R	241	/* LD offset 14-bit right.  */
++#define R_PARISC_TLS_DTPMOD32	242	/* DTP module 32-bit.  */
++#define R_PARISC_TLS_DTPMOD64	243	/* DTP module 64-bit.  */
++#define R_PARISC_TLS_DTPOFF32	244	/* DTP offset 32-bit.  */
++#define R_PARISC_TLS_DTPOFF64	245	/* DTP offset 32-bit.  */
++#define R_PARISC_TLS_LE21L	R_PARISC_TPREL21L
++#define R_PARISC_TLS_LE14R	R_PARISC_TPREL14R
++#define R_PARISC_TLS_IE21L	R_PARISC_LTOFF_TP21L
++#define R_PARISC_TLS_IE14R	R_PARISC_LTOFF_TP14R
++#define R_PARISC_TLS_TPREL32	R_PARISC_TPREL32
++#define R_PARISC_TLS_TPREL64	R_PARISC_TPREL64
++#define R_PARISC_HIRESERVE	255
++
++/* Legal values for p_type field of Elf32_Phdr/Elf64_Phdr.  */
++
++#define PT_HP_TLS		(PT_LOOS + 0x0)
++#define PT_HP_CORE_NONE		(PT_LOOS + 0x1)
++#define PT_HP_CORE_VERSION	(PT_LOOS + 0x2)
++#define PT_HP_CORE_KERNEL	(PT_LOOS + 0x3)
++#define PT_HP_CORE_COMM		(PT_LOOS + 0x4)
++#define PT_HP_CORE_PROC		(PT_LOOS + 0x5)
++#define PT_HP_CORE_LOADABLE	(PT_LOOS + 0x6)
++#define PT_HP_CORE_STACK	(PT_LOOS + 0x7)
++#define PT_HP_CORE_SHM		(PT_LOOS + 0x8)
++#define PT_HP_CORE_MMF		(PT_LOOS + 0x9)
++#define PT_HP_PARALLEL		(PT_LOOS + 0x10)
++#define PT_HP_FASTBIND		(PT_LOOS + 0x11)
++#define PT_HP_OPT_ANNOT		(PT_LOOS + 0x12)
++#define PT_HP_HSL_ANNOT		(PT_LOOS + 0x13)
++#define PT_HP_STACK		(PT_LOOS + 0x14)
++
++#define PT_PARISC_ARCHEXT	0x70000000
++#define PT_PARISC_UNWIND	0x70000001
++
++/* Legal values for p_flags field of Elf32_Phdr/Elf64_Phdr.  */
++
++#define PF_PARISC_SBP		0x08000000
++
++#define PF_HP_PAGE_SIZE		0x00100000
++#define PF_HP_FAR_SHARED	0x00200000
++#define PF_HP_NEAR_SHARED	0x00400000
++#define PF_HP_CODE		0x01000000
++#define PF_HP_MODIFY		0x02000000
++#define PF_HP_LAZYSWAP		0x04000000
++#define PF_HP_SBP		0x08000000
++
++
++/* Alpha specific definitions.  */
++
++/* Legal values for e_flags field of Elf64_Ehdr.  */
++
++#define EF_ALPHA_32BIT		1	/* All addresses must be < 2GB.  */
++#define EF_ALPHA_CANRELAX	2	/* Relocations for relaxing exist.  */
++
++/* Legal values for sh_type field of Elf64_Shdr.  */
++
++/* These two are primerily concerned with ECOFF debugging info.  */
++#define SHT_ALPHA_DEBUG		0x70000001
++#define SHT_ALPHA_REGINFO	0x70000002
++
++/* Legal values for sh_flags field of Elf64_Shdr.  */
++
++#define SHF_ALPHA_GPREL		0x10000000
++
++/* Legal values for st_other field of Elf64_Sym.  */
++#define STO_ALPHA_NOPV		0x80	/* No PV required.  */
++#define STO_ALPHA_STD_GPLOAD	0x88	/* PV only used for initial ldgp.  */
++
++/* Alpha relocs.  */
++
++#define R_ALPHA_NONE		0	/* No reloc */
++#define R_ALPHA_REFLONG		1	/* Direct 32 bit */
++#define R_ALPHA_REFQUAD		2	/* Direct 64 bit */
++#define R_ALPHA_GPREL32		3	/* GP relative 32 bit */
++#define R_ALPHA_LITERAL		4	/* GP relative 16 bit w/optimization */
++#define R_ALPHA_LITUSE		5	/* Optimization hint for LITERAL */
++#define R_ALPHA_GPDISP		6	/* Add displacement to GP */
++#define R_ALPHA_BRADDR		7	/* PC+4 relative 23 bit shifted */
++#define R_ALPHA_HINT		8	/* PC+4 relative 16 bit shifted */
++#define R_ALPHA_SREL16		9	/* PC relative 16 bit */
++#define R_ALPHA_SREL32		10	/* PC relative 32 bit */
++#define R_ALPHA_SREL64		11	/* PC relative 64 bit */
++#define R_ALPHA_GPRELHIGH	17	/* GP relative 32 bit, high 16 bits */
++#define R_ALPHA_GPRELLOW	18	/* GP relative 32 bit, low 16 bits */
++#define R_ALPHA_GPREL16		19	/* GP relative 16 bit */
++#define R_ALPHA_COPY		24	/* Copy symbol at runtime */
++#define R_ALPHA_GLOB_DAT	25	/* Create GOT entry */
++#define R_ALPHA_JMP_SLOT	26	/* Create PLT entry */
++#define R_ALPHA_RELATIVE	27	/* Adjust by program base */
++#define R_ALPHA_TLS_GD_HI	28
++#define R_ALPHA_TLSGD		29
++#define R_ALPHA_TLS_LDM		30
++#define R_ALPHA_DTPMOD64	31
++#define R_ALPHA_GOTDTPREL	32
++#define R_ALPHA_DTPREL64	33
++#define R_ALPHA_DTPRELHI	34
++#define R_ALPHA_DTPRELLO	35
++#define R_ALPHA_DTPREL16	36
++#define R_ALPHA_GOTTPREL	37
++#define R_ALPHA_TPREL64		38
++#define R_ALPHA_TPRELHI		39
++#define R_ALPHA_TPRELLO		40
++#define R_ALPHA_TPREL16		41
++/* Keep this the last entry.  */
++#define R_ALPHA_NUM		46
++
++/* Magic values of the LITUSE relocation addend.  */
++#define LITUSE_ALPHA_ADDR	0
++#define LITUSE_ALPHA_BASE	1
++#define LITUSE_ALPHA_BYTOFF	2
++#define LITUSE_ALPHA_JSR	3
++#define LITUSE_ALPHA_TLS_GD	4
++#define LITUSE_ALPHA_TLS_LDM	5
++
++/* Legal values for d_tag of Elf64_Dyn.  */
++#define DT_ALPHA_PLTRO		(DT_LOPROC + 0)
++#define DT_ALPHA_NUM		1
++
++/* PowerPC specific declarations */
++
++/* Values for Elf32/64_Ehdr.e_flags.  */
++#define EF_PPC_EMB		0x80000000	/* PowerPC embedded flag */
++
++/* Cygnus local bits below */
++#define EF_PPC_RELOCATABLE	0x00010000	/* PowerPC -mrelocatable flag*/
++#define EF_PPC_RELOCATABLE_LIB	0x00008000	/* PowerPC -mrelocatable-lib
++						   flag */
++
++/* PowerPC relocations defined by the ABIs */
++#define R_PPC_NONE		0
++#define R_PPC_ADDR32		1	/* 32bit absolute address */
++#define R_PPC_ADDR24		2	/* 26bit address, 2 bits ignored.  */
++#define R_PPC_ADDR16		3	/* 16bit absolute address */
++#define R_PPC_ADDR16_LO		4	/* lower 16bit of absolute address */
++#define R_PPC_ADDR16_HI		5	/* high 16bit of absolute address */
++#define R_PPC_ADDR16_HA		6	/* adjusted high 16bit */
++#define R_PPC_ADDR14		7	/* 16bit address, 2 bits ignored */
++#define R_PPC_ADDR14_BRTAKEN	8
++#define R_PPC_ADDR14_BRNTAKEN	9
++#define R_PPC_REL24		10	/* PC relative 26 bit */
++#define R_PPC_REL14		11	/* PC relative 16 bit */
++#define R_PPC_REL14_BRTAKEN	12
++#define R_PPC_REL14_BRNTAKEN	13
++#define R_PPC_GOT16		14
++#define R_PPC_GOT16_LO		15
++#define R_PPC_GOT16_HI		16
++#define R_PPC_GOT16_HA		17
++#define R_PPC_PLTREL24		18
++#define R_PPC_COPY		19
++#define R_PPC_GLOB_DAT		20
++#define R_PPC_JMP_SLOT		21
++#define R_PPC_RELATIVE		22
++#define R_PPC_LOCAL24PC		23
++#define R_PPC_UADDR32		24
++#define R_PPC_UADDR16		25
++#define R_PPC_REL32		26
++#define R_PPC_PLT32		27
++#define R_PPC_PLTREL32		28
++#define R_PPC_PLT16_LO		29
++#define R_PPC_PLT16_HI		30
++#define R_PPC_PLT16_HA		31
++#define R_PPC_SDAREL16		32
++#define R_PPC_SECTOFF		33
++#define R_PPC_SECTOFF_LO	34
++#define R_PPC_SECTOFF_HI	35
++#define R_PPC_SECTOFF_HA	36
++
++/* PowerPC relocations defined for the TLS access ABI.  */
++#define R_PPC_TLS		67 /* none	(sym+add)@tls */
++#define R_PPC_DTPMOD32		68 /* word32	(sym+add)@dtpmod */
++#define R_PPC_TPREL16		69 /* half16*	(sym+add)@tprel */
++#define R_PPC_TPREL16_LO	70 /* half16	(sym+add)@tprel@l */
++#define R_PPC_TPREL16_HI	71 /* half16	(sym+add)@tprel@h */
++#define R_PPC_TPREL16_HA	72 /* half16	(sym+add)@tprel@ha */
++#define R_PPC_TPREL32		73 /* word32	(sym+add)@tprel */
++#define R_PPC_DTPREL16		74 /* half16*	(sym+add)@dtprel */
++#define R_PPC_DTPREL16_LO	75 /* half16	(sym+add)@dtprel@l */
++#define R_PPC_DTPREL16_HI	76 /* half16	(sym+add)@dtprel@h */
++#define R_PPC_DTPREL16_HA	77 /* half16	(sym+add)@dtprel@ha */
++#define R_PPC_DTPREL32		78 /* word32	(sym+add)@dtprel */
++#define R_PPC_GOT_TLSGD16	79 /* half16*	(sym+add)@got@tlsgd */
++#define R_PPC_GOT_TLSGD16_LO	80 /* half16	(sym+add)@got@tlsgd@l */
++#define R_PPC_GOT_TLSGD16_HI	81 /* half16	(sym+add)@got@tlsgd@h */
++#define R_PPC_GOT_TLSGD16_HA	82 /* half16	(sym+add)@got@tlsgd@ha */
++#define R_PPC_GOT_TLSLD16	83 /* half16*	(sym+add)@got@tlsld */
++#define R_PPC_GOT_TLSLD16_LO	84 /* half16	(sym+add)@got@tlsld@l */
++#define R_PPC_GOT_TLSLD16_HI	85 /* half16	(sym+add)@got@tlsld@h */
++#define R_PPC_GOT_TLSLD16_HA	86 /* half16	(sym+add)@got@tlsld@ha */
++#define R_PPC_GOT_TPREL16	87 /* half16*	(sym+add)@got@tprel */
++#define R_PPC_GOT_TPREL16_LO	88 /* half16	(sym+add)@got@tprel@l */
++#define R_PPC_GOT_TPREL16_HI	89 /* half16	(sym+add)@got@tprel@h */
++#define R_PPC_GOT_TPREL16_HA	90 /* half16	(sym+add)@got@tprel@ha */
++#define R_PPC_GOT_DTPREL16	91 /* half16*	(sym+add)@got@dtprel */
++#define R_PPC_GOT_DTPREL16_LO	92 /* half16*	(sym+add)@got@dtprel@l */
++#define R_PPC_GOT_DTPREL16_HI	93 /* half16*	(sym+add)@got@dtprel@h */
++#define R_PPC_GOT_DTPREL16_HA	94 /* half16*	(sym+add)@got@dtprel@ha */
++
++/* The remaining relocs are from the Embedded ELF ABI, and are not
++   in the SVR4 ELF ABI.  */
++#define R_PPC_EMB_NADDR32	101
++#define R_PPC_EMB_NADDR16	102
++#define R_PPC_EMB_NADDR16_LO	103
++#define R_PPC_EMB_NADDR16_HI	104
++#define R_PPC_EMB_NADDR16_HA	105
++#define R_PPC_EMB_SDAI16	106
++#define R_PPC_EMB_SDA2I16	107
++#define R_PPC_EMB_SDA2REL	108
++#define R_PPC_EMB_SDA21		109	/* 16 bit offset in SDA */
++#define R_PPC_EMB_MRKREF	110
++#define R_PPC_EMB_RELSEC16	111
++#define R_PPC_EMB_RELST_LO	112
++#define R_PPC_EMB_RELST_HI	113
++#define R_PPC_EMB_RELST_HA	114
++#define R_PPC_EMB_BIT_FLD	115
++#define R_PPC_EMB_RELSDA	116	/* 16 bit relative offset in SDA */
++
++/* Diab tool relocations.  */
++#define R_PPC_DIAB_SDA21_LO	180	/* like EMB_SDA21, but lower 16 bit */
++#define R_PPC_DIAB_SDA21_HI	181	/* like EMB_SDA21, but high 16 bit */
++#define R_PPC_DIAB_SDA21_HA	182	/* like EMB_SDA21, adjusted high 16 */
++#define R_PPC_DIAB_RELSDA_LO	183	/* like EMB_RELSDA, but lower 16 bit */
++#define R_PPC_DIAB_RELSDA_HI	184	/* like EMB_RELSDA, but high 16 bit */
++#define R_PPC_DIAB_RELSDA_HA	185	/* like EMB_RELSDA, adjusted high 16 */
++
++/* GNU extension to support local ifunc.  */
++#define R_PPC_IRELATIVE		248
++
++/* GNU relocs used in PIC code sequences.  */
++#define R_PPC_REL16		249	/* half16   (sym+add-.) */
++#define R_PPC_REL16_LO		250	/* half16   (sym+add-.)@l */
++#define R_PPC_REL16_HI		251	/* half16   (sym+add-.)@h */
++#define R_PPC_REL16_HA		252	/* half16   (sym+add-.)@ha */
++
++/* This is a phony reloc to handle any old fashioned TOC16 references
++   that may still be in object files.  */
++#define R_PPC_TOC16		255
++
++/* PowerPC specific values for the Dyn d_tag field.  */
++#define DT_PPC_GOT		(DT_LOPROC + 0)
++#define DT_PPC_NUM		1
++
++/* PowerPC64 relocations defined by the ABIs */
++#define R_PPC64_NONE		R_PPC_NONE
++#define R_PPC64_ADDR32		R_PPC_ADDR32 /* 32bit absolute address */
++#define R_PPC64_ADDR24		R_PPC_ADDR24 /* 26bit address, word aligned */
++#define R_PPC64_ADDR16		R_PPC_ADDR16 /* 16bit absolute address */
++#define R_PPC64_ADDR16_LO	R_PPC_ADDR16_LO	/* lower 16bits of address */
++#define R_PPC64_ADDR16_HI	R_PPC_ADDR16_HI	/* high 16bits of address. */
++#define R_PPC64_ADDR16_HA	R_PPC_ADDR16_HA /* adjusted high 16bits.  */
++#define R_PPC64_ADDR14		R_PPC_ADDR14 /* 16bit address, word aligned */
++#define R_PPC64_ADDR14_BRTAKEN	R_PPC_ADDR14_BRTAKEN
++#define R_PPC64_ADDR14_BRNTAKEN	R_PPC_ADDR14_BRNTAKEN
++#define R_PPC64_REL24		R_PPC_REL24 /* PC-rel. 26 bit, word aligned */
++#define R_PPC64_REL14		R_PPC_REL14 /* PC relative 16 bit */
++#define R_PPC64_REL14_BRTAKEN	R_PPC_REL14_BRTAKEN
++#define R_PPC64_REL14_BRNTAKEN	R_PPC_REL14_BRNTAKEN
++#define R_PPC64_GOT16		R_PPC_GOT16
++#define R_PPC64_GOT16_LO	R_PPC_GOT16_LO
++#define R_PPC64_GOT16_HI	R_PPC_GOT16_HI
++#define R_PPC64_GOT16_HA	R_PPC_GOT16_HA
++
++#define R_PPC64_COPY		R_PPC_COPY
++#define R_PPC64_GLOB_DAT	R_PPC_GLOB_DAT
++#define R_PPC64_JMP_SLOT	R_PPC_JMP_SLOT
++#define R_PPC64_RELATIVE	R_PPC_RELATIVE
++
++#define R_PPC64_UADDR32		R_PPC_UADDR32
++#define R_PPC64_UADDR16		R_PPC_UADDR16
++#define R_PPC64_REL32		R_PPC_REL32
++#define R_PPC64_PLT32		R_PPC_PLT32
++#define R_PPC64_PLTREL32	R_PPC_PLTREL32
++#define R_PPC64_PLT16_LO	R_PPC_PLT16_LO
++#define R_PPC64_PLT16_HI	R_PPC_PLT16_HI
++#define R_PPC64_PLT16_HA	R_PPC_PLT16_HA
++
++#define R_PPC64_SECTOFF		R_PPC_SECTOFF
++#define R_PPC64_SECTOFF_LO	R_PPC_SECTOFF_LO
++#define R_PPC64_SECTOFF_HI	R_PPC_SECTOFF_HI
++#define R_PPC64_SECTOFF_HA	R_PPC_SECTOFF_HA
++#define R_PPC64_ADDR30		37 /* word30 (S + A - P) >> 2 */
++#define R_PPC64_ADDR64		38 /* doubleword64 S + A */
++#define R_PPC64_ADDR16_HIGHER	39 /* half16 #higher(S + A) */
++#define R_PPC64_ADDR16_HIGHERA	40 /* half16 #highera(S + A) */
++#define R_PPC64_ADDR16_HIGHEST	41 /* half16 #highest(S + A) */
++#define R_PPC64_ADDR16_HIGHESTA	42 /* half16 #highesta(S + A) */
++#define R_PPC64_UADDR64		43 /* doubleword64 S + A */
++#define R_PPC64_REL64		44 /* doubleword64 S + A - P */
++#define R_PPC64_PLT64		45 /* doubleword64 L + A */
++#define R_PPC64_PLTREL64	46 /* doubleword64 L + A - P */
++#define R_PPC64_TOC16		47 /* half16* S + A - .TOC */
++#define R_PPC64_TOC16_LO	48 /* half16 #lo(S + A - .TOC.) */
++#define R_PPC64_TOC16_HI	49 /* half16 #hi(S + A - .TOC.) */
++#define R_PPC64_TOC16_HA	50 /* half16 #ha(S + A - .TOC.) */
++#define R_PPC64_TOC		51 /* doubleword64 .TOC */
++#define R_PPC64_PLTGOT16	52 /* half16* M + A */
++#define R_PPC64_PLTGOT16_LO	53 /* half16 #lo(M + A) */
++#define R_PPC64_PLTGOT16_HI	54 /* half16 #hi(M + A) */
++#define R_PPC64_PLTGOT16_HA	55 /* half16 #ha(M + A) */
++
++#define R_PPC64_ADDR16_DS	56 /* half16ds* (S + A) >> 2 */
++#define R_PPC64_ADDR16_LO_DS	57 /* half16ds  #lo(S + A) >> 2 */
++#define R_PPC64_GOT16_DS	58 /* half16ds* (G + A) >> 2 */
++#define R_PPC64_GOT16_LO_DS	59 /* half16ds  #lo(G + A) >> 2 */
++#define R_PPC64_PLT16_LO_DS	60 /* half16ds  #lo(L + A) >> 2 */
++#define R_PPC64_SECTOFF_DS	61 /* half16ds* (R + A) >> 2 */
++#define R_PPC64_SECTOFF_LO_DS	62 /* half16ds  #lo(R + A) >> 2 */
++#define R_PPC64_TOC16_DS	63 /* half16ds* (S + A - .TOC.) >> 2 */
++#define R_PPC64_TOC16_LO_DS	64 /* half16ds  #lo(S + A - .TOC.) >> 2 */
++#define R_PPC64_PLTGOT16_DS	65 /* half16ds* (M + A) >> 2 */
++#define R_PPC64_PLTGOT16_LO_DS	66 /* half16ds  #lo(M + A) >> 2 */
++
++/* PowerPC64 relocations defined for the TLS access ABI.  */
++#define R_PPC64_TLS		67 /* none	(sym+add)@tls */
++#define R_PPC64_DTPMOD64	68 /* doubleword64 (sym+add)@dtpmod */
++#define R_PPC64_TPREL16		69 /* half16*	(sym+add)@tprel */
++#define R_PPC64_TPREL16_LO	70 /* half16	(sym+add)@tprel@l */
++#define R_PPC64_TPREL16_HI	71 /* half16	(sym+add)@tprel@h */
++#define R_PPC64_TPREL16_HA	72 /* half16	(sym+add)@tprel@ha */
++#define R_PPC64_TPREL64		73 /* doubleword64 (sym+add)@tprel */
++#define R_PPC64_DTPREL16	74 /* half16*	(sym+add)@dtprel */
++#define R_PPC64_DTPREL16_LO	75 /* half16	(sym+add)@dtprel@l */
++#define R_PPC64_DTPREL16_HI	76 /* half16	(sym+add)@dtprel@h */
++#define R_PPC64_DTPREL16_HA	77 /* half16	(sym+add)@dtprel@ha */
++#define R_PPC64_DTPREL64	78 /* doubleword64 (sym+add)@dtprel */
++#define R_PPC64_GOT_TLSGD16	79 /* half16*	(sym+add)@got@tlsgd */
++#define R_PPC64_GOT_TLSGD16_LO	80 /* half16	(sym+add)@got@tlsgd@l */
++#define R_PPC64_GOT_TLSGD16_HI	81 /* half16	(sym+add)@got@tlsgd@h */
++#define R_PPC64_GOT_TLSGD16_HA	82 /* half16	(sym+add)@got@tlsgd@ha */
++#define R_PPC64_GOT_TLSLD16	83 /* half16*	(sym+add)@got@tlsld */
++#define R_PPC64_GOT_TLSLD16_LO	84 /* half16	(sym+add)@got@tlsld@l */
++#define R_PPC64_GOT_TLSLD16_HI	85 /* half16	(sym+add)@got@tlsld@h */
++#define R_PPC64_GOT_TLSLD16_HA	86 /* half16	(sym+add)@got@tlsld@ha */
++#define R_PPC64_GOT_TPREL16_DS	87 /* half16ds*	(sym+add)@got@tprel */
++#define R_PPC64_GOT_TPREL16_LO_DS 88 /* half16ds (sym+add)@got@tprel@l */
++#define R_PPC64_GOT_TPREL16_HI	89 /* half16	(sym+add)@got@tprel@h */
++#define R_PPC64_GOT_TPREL16_HA	90 /* half16	(sym+add)@got@tprel@ha */
++#define R_PPC64_GOT_DTPREL16_DS	91 /* half16ds*	(sym+add)@got@dtprel */
++#define R_PPC64_GOT_DTPREL16_LO_DS 92 /* half16ds (sym+add)@got@dtprel@l */
++#define R_PPC64_GOT_DTPREL16_HI	93 /* half16	(sym+add)@got@dtprel@h */
++#define R_PPC64_GOT_DTPREL16_HA	94 /* half16	(sym+add)@got@dtprel@ha */
++#define R_PPC64_TPREL16_DS	95 /* half16ds*	(sym+add)@tprel */
++#define R_PPC64_TPREL16_LO_DS	96 /* half16ds	(sym+add)@tprel@l */
++#define R_PPC64_TPREL16_HIGHER	97 /* half16	(sym+add)@tprel@higher */
++#define R_PPC64_TPREL16_HIGHERA	98 /* half16	(sym+add)@tprel@highera */
++#define R_PPC64_TPREL16_HIGHEST	99 /* half16	(sym+add)@tprel@highest */
++#define R_PPC64_TPREL16_HIGHESTA 100 /* half16	(sym+add)@tprel@highesta */
++#define R_PPC64_DTPREL16_DS	101 /* half16ds* (sym+add)@dtprel */
++#define R_PPC64_DTPREL16_LO_DS	102 /* half16ds	(sym+add)@dtprel@l */
++#define R_PPC64_DTPREL16_HIGHER	103 /* half16	(sym+add)@dtprel@higher */
++#define R_PPC64_DTPREL16_HIGHERA 104 /* half16	(sym+add)@dtprel@highera */
++#define R_PPC64_DTPREL16_HIGHEST 105 /* half16	(sym+add)@dtprel@highest */
++#define R_PPC64_DTPREL16_HIGHESTA 106 /* half16	(sym+add)@dtprel@highesta */
++
++/* GNU extension to support local ifunc.  */
++#define R_PPC64_JMP_IREL	247
++#define R_PPC64_IRELATIVE	248
++#define R_PPC64_REL16		249	/* half16   (sym+add-.) */
++#define R_PPC64_REL16_LO	250	/* half16   (sym+add-.)@l */
++#define R_PPC64_REL16_HI	251	/* half16   (sym+add-.)@h */
++#define R_PPC64_REL16_HA	252	/* half16   (sym+add-.)@ha */
++
++/* PowerPC64 specific values for the Dyn d_tag field.  */
++#define DT_PPC64_GLINK  (DT_LOPROC + 0)
++#define DT_PPC64_OPD	(DT_LOPROC + 1)
++#define DT_PPC64_OPDSZ	(DT_LOPROC + 2)
++#define DT_PPC64_NUM    3
++
++
++/* ARM specific declarations */
++
++/* Processor specific flags for the ELF header e_flags field.  */
++#define EF_ARM_RELEXEC		0x01
++#define EF_ARM_HASENTRY		0x02
++#define EF_ARM_INTERWORK	0x04
++#define EF_ARM_APCS_26		0x08
++#define EF_ARM_APCS_FLOAT	0x10
++#define EF_ARM_PIC		0x20
++#define EF_ARM_ALIGN8		0x40 /* 8-bit structure alignment is in use */
++#define EF_ARM_NEW_ABI		0x80
++#define EF_ARM_OLD_ABI		0x100
++#define EF_ARM_SOFT_FLOAT	0x200
++#define EF_ARM_VFP_FLOAT	0x400
++#define EF_ARM_MAVERICK_FLOAT	0x800
++
++
++/* Other constants defined in the ARM ELF spec. version B-01.  */
++/* NB. These conflict with values defined above.  */
++#define EF_ARM_SYMSARESORTED	0x04
++#define EF_ARM_DYNSYMSUSESEGIDX	0x08
++#define EF_ARM_MAPSYMSFIRST	0x10
++#define EF_ARM_EABIMASK		0XFF000000
++
++/* Constants defined in AAELF.  */
++#define EF_ARM_BE8	    0x00800000
++#define EF_ARM_LE8	    0x00400000
++
++#define EF_ARM_EABI_VERSION(flags)	((flags) & EF_ARM_EABIMASK)
++#define EF_ARM_EABI_UNKNOWN	0x00000000
++#define EF_ARM_EABI_VER1	0x01000000
++#define EF_ARM_EABI_VER2	0x02000000
++#define EF_ARM_EABI_VER3	0x03000000
++#define EF_ARM_EABI_VER4	0x04000000
++#define EF_ARM_EABI_VER5	0x05000000
++
++/* Additional symbol types for Thumb.  */
++#define STT_ARM_TFUNC		STT_LOPROC /* A Thumb function.  */
++#define STT_ARM_16BIT		STT_HIPROC /* A Thumb label.  */
++
++/* ARM-specific values for sh_flags */
++#define SHF_ARM_ENTRYSECT	0x10000000 /* Section contains an entry point */
++#define SHF_ARM_COMDEF		0x80000000 /* Section may be multiply defined
++					      in the input to a link step.  */
++
++/* ARM-specific program header flags */
++#define PF_ARM_SB		0x10000000 /* Segment contains the location
++					      addressed by the static base. */
++#define PF_ARM_PI		0x20000000 /* Position-independent segment.  */
++#define PF_ARM_ABS		0x40000000 /* Absolute segment.  */
++
++/* Processor specific values for the Phdr p_type field.  */
++#define PT_ARM_EXIDX		(PT_LOPROC + 1)	/* ARM unwind segment.  */
++
++/* Processor specific values for the Shdr sh_type field.  */
++#define SHT_ARM_EXIDX		(SHT_LOPROC + 1) /* ARM unwind section.  */
++#define SHT_ARM_PREEMPTMAP	(SHT_LOPROC + 2) /* Preemption details.  */
++#define SHT_ARM_ATTRIBUTES	(SHT_LOPROC + 3) /* ARM attributes section.  */
++
++
++/* ARM relocs.  */
++
++#define R_ARM_NONE		0	/* No reloc */
++#define R_ARM_PC24		1	/* PC relative 26 bit branch */
++#define R_ARM_ABS32		2	/* Direct 32 bit  */
++#define R_ARM_REL32		3	/* PC relative 32 bit */
++#define R_ARM_PC13		4
++#define R_ARM_ABS16		5	/* Direct 16 bit */
++#define R_ARM_ABS12		6	/* Direct 12 bit */
++#define R_ARM_THM_ABS5		7
++#define R_ARM_ABS8		8	/* Direct 8 bit */
++#define R_ARM_SBREL32		9
++#define R_ARM_THM_PC22		10
++#define R_ARM_THM_PC8		11
++#define R_ARM_AMP_VCALL9	12
++#define R_ARM_SWI24		13	/* Obsolete static relocation.  */
++#define R_ARM_TLS_DESC		13      /* Dynamic relocation.  */
++#define R_ARM_THM_SWI8		14
++#define R_ARM_XPC25		15
++#define R_ARM_THM_XPC22		16
++#define R_ARM_TLS_DTPMOD32	17	/* ID of module containing symbol */
++#define R_ARM_TLS_DTPOFF32	18	/* Offset in TLS block */
++#define R_ARM_TLS_TPOFF32	19	/* Offset in static TLS block */
++#define R_ARM_COPY		20	/* Copy symbol at runtime */
++#define R_ARM_GLOB_DAT		21	/* Create GOT entry */
++#define R_ARM_JUMP_SLOT		22	/* Create PLT entry */
++#define R_ARM_RELATIVE		23	/* Adjust by program base */
++#define R_ARM_GOTOFF		24	/* 32 bit offset to GOT */
++#define R_ARM_GOTPC		25	/* 32 bit PC relative offset to GOT */
++#define R_ARM_GOT32		26	/* 32 bit GOT entry */
++#define R_ARM_PLT32		27	/* 32 bit PLT address */
++#define R_ARM_ALU_PCREL_7_0	32
++#define R_ARM_ALU_PCREL_15_8	33
++#define R_ARM_ALU_PCREL_23_15	34
++#define R_ARM_LDR_SBREL_11_0	35
++#define R_ARM_ALU_SBREL_19_12	36
++#define R_ARM_ALU_SBREL_27_20	37
++#define R_ARM_TLS_GOTDESC	90
++#define R_ARM_TLS_CALL		91
++#define R_ARM_TLS_DESCSEQ	92
++#define R_ARM_THM_TLS_CALL	93
++#define R_ARM_GNU_VTENTRY	100
++#define R_ARM_GNU_VTINHERIT	101
++#define R_ARM_THM_PC11		102	/* thumb unconditional branch */
++#define R_ARM_THM_PC9		103	/* thumb conditional branch */
++#define R_ARM_TLS_GD32		104	/* PC-rel 32 bit for global dynamic
++					   thread local data */
++#define R_ARM_TLS_LDM32		105	/* PC-rel 32 bit for local dynamic
++					   thread local data */
++#define R_ARM_TLS_LDO32		106	/* 32 bit offset relative to TLS
++					   block */
++#define R_ARM_TLS_IE32		107	/* PC-rel 32 bit for GOT entry of
++					   static TLS block offset */
++#define R_ARM_TLS_LE32		108	/* 32 bit offset relative to static
++					   TLS block */
++#define	R_ARM_THM_TLS_DESCSEQ	129
++#define R_ARM_IRELATIVE		160
++#define R_ARM_RXPC25		249
++#define R_ARM_RSBREL32		250
++#define R_ARM_THM_RPC22		251
++#define R_ARM_RREL32		252
++#define R_ARM_RABS22		253
++#define R_ARM_RPC24		254
++#define R_ARM_RBASE		255
++/* Keep this the last entry.  */
++#define R_ARM_NUM		256
++
++/* IA-64 specific declarations.  */
++
++/* Processor specific flags for the Ehdr e_flags field.  */
++#define EF_IA_64_MASKOS		0x0000000f	/* os-specific flags */
++#define EF_IA_64_ABI64		0x00000010	/* 64-bit ABI */
++#define EF_IA_64_ARCH		0xff000000	/* arch. version mask */
++
++/* Processor specific values for the Phdr p_type field.  */
++#define PT_IA_64_ARCHEXT	(PT_LOPROC + 0)	/* arch extension bits */
++#define PT_IA_64_UNWIND		(PT_LOPROC + 1)	/* ia64 unwind bits */
++#define PT_IA_64_HP_OPT_ANOT	(PT_LOOS + 0x12)
++#define PT_IA_64_HP_HSL_ANOT	(PT_LOOS + 0x13)
++#define PT_IA_64_HP_STACK	(PT_LOOS + 0x14)
++
++/* Processor specific flags for the Phdr p_flags field.  */
++#define PF_IA_64_NORECOV	0x80000000	/* spec insns w/o recovery */
++
++/* Processor specific values for the Shdr sh_type field.  */
++#define SHT_IA_64_EXT		(SHT_LOPROC + 0) /* extension bits */
++#define SHT_IA_64_UNWIND	(SHT_LOPROC + 1) /* unwind bits */
++
++/* Processor specific flags for the Shdr sh_flags field.  */
++#define SHF_IA_64_SHORT		0x10000000	/* section near gp */
++#define SHF_IA_64_NORECOV	0x20000000	/* spec insns w/o recovery */
++
++/* Processor specific values for the Dyn d_tag field.  */
++#define DT_IA_64_PLT_RESERVE	(DT_LOPROC + 0)
++#define DT_IA_64_NUM		1
++
++/* IA-64 relocations.  */
++#define R_IA64_NONE		0x00	/* none */
++#define R_IA64_IMM14		0x21	/* symbol + addend, add imm14 */
++#define R_IA64_IMM22		0x22	/* symbol + addend, add imm22 */
++#define R_IA64_IMM64		0x23	/* symbol + addend, mov imm64 */
++#define R_IA64_DIR32MSB		0x24	/* symbol + addend, data4 MSB */
++#define R_IA64_DIR32LSB		0x25	/* symbol + addend, data4 LSB */
++#define R_IA64_DIR64MSB		0x26	/* symbol + addend, data8 MSB */
++#define R_IA64_DIR64LSB		0x27	/* symbol + addend, data8 LSB */
++#define R_IA64_GPREL22		0x2a	/* @gprel(sym + add), add imm22 */
++#define R_IA64_GPREL64I		0x2b	/* @gprel(sym + add), mov imm64 */
++#define R_IA64_GPREL32MSB	0x2c	/* @gprel(sym + add), data4 MSB */
++#define R_IA64_GPREL32LSB	0x2d	/* @gprel(sym + add), data4 LSB */
++#define R_IA64_GPREL64MSB	0x2e	/* @gprel(sym + add), data8 MSB */
++#define R_IA64_GPREL64LSB	0x2f	/* @gprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF22		0x32	/* @ltoff(sym + add), add imm22 */
++#define R_IA64_LTOFF64I		0x33	/* @ltoff(sym + add), mov imm64 */
++#define R_IA64_PLTOFF22		0x3a	/* @pltoff(sym + add), add imm22 */
++#define R_IA64_PLTOFF64I	0x3b	/* @pltoff(sym + add), mov imm64 */
++#define R_IA64_PLTOFF64MSB	0x3e	/* @pltoff(sym + add), data8 MSB */
++#define R_IA64_PLTOFF64LSB	0x3f	/* @pltoff(sym + add), data8 LSB */
++#define R_IA64_FPTR64I		0x43	/* @fptr(sym + add), mov imm64 */
++#define R_IA64_FPTR32MSB	0x44	/* @fptr(sym + add), data4 MSB */
++#define R_IA64_FPTR32LSB	0x45	/* @fptr(sym + add), data4 LSB */
++#define R_IA64_FPTR64MSB	0x46	/* @fptr(sym + add), data8 MSB */
++#define R_IA64_FPTR64LSB	0x47	/* @fptr(sym + add), data8 LSB */
++#define R_IA64_PCREL60B		0x48	/* @pcrel(sym + add), brl */
++#define R_IA64_PCREL21B		0x49	/* @pcrel(sym + add), ptb, call */
++#define R_IA64_PCREL21M		0x4a	/* @pcrel(sym + add), chk.s */
++#define R_IA64_PCREL21F		0x4b	/* @pcrel(sym + add), fchkf */
++#define R_IA64_PCREL32MSB	0x4c	/* @pcrel(sym + add), data4 MSB */
++#define R_IA64_PCREL32LSB	0x4d	/* @pcrel(sym + add), data4 LSB */
++#define R_IA64_PCREL64MSB	0x4e	/* @pcrel(sym + add), data8 MSB */
++#define R_IA64_PCREL64LSB	0x4f	/* @pcrel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_FPTR22	0x52	/* @ltoff(@fptr(s+a)), imm22 */
++#define R_IA64_LTOFF_FPTR64I	0x53	/* @ltoff(@fptr(s+a)), imm64 */
++#define R_IA64_LTOFF_FPTR32MSB	0x54	/* @ltoff(@fptr(s+a)), data4 MSB */
++#define R_IA64_LTOFF_FPTR32LSB	0x55	/* @ltoff(@fptr(s+a)), data4 LSB */
++#define R_IA64_LTOFF_FPTR64MSB	0x56	/* @ltoff(@fptr(s+a)), data8 MSB */
++#define R_IA64_LTOFF_FPTR64LSB	0x57	/* @ltoff(@fptr(s+a)), data8 LSB */
++#define R_IA64_SEGREL32MSB	0x5c	/* @segrel(sym + add), data4 MSB */
++#define R_IA64_SEGREL32LSB	0x5d	/* @segrel(sym + add), data4 LSB */
++#define R_IA64_SEGREL64MSB	0x5e	/* @segrel(sym + add), data8 MSB */
++#define R_IA64_SEGREL64LSB	0x5f	/* @segrel(sym + add), data8 LSB */
++#define R_IA64_SECREL32MSB	0x64	/* @secrel(sym + add), data4 MSB */
++#define R_IA64_SECREL32LSB	0x65	/* @secrel(sym + add), data4 LSB */
++#define R_IA64_SECREL64MSB	0x66	/* @secrel(sym + add), data8 MSB */
++#define R_IA64_SECREL64LSB	0x67	/* @secrel(sym + add), data8 LSB */
++#define R_IA64_REL32MSB		0x6c	/* data 4 + REL */
++#define R_IA64_REL32LSB		0x6d	/* data 4 + REL */
++#define R_IA64_REL64MSB		0x6e	/* data 8 + REL */
++#define R_IA64_REL64LSB		0x6f	/* data 8 + REL */
++#define R_IA64_LTV32MSB		0x74	/* symbol + addend, data4 MSB */
++#define R_IA64_LTV32LSB		0x75	/* symbol + addend, data4 LSB */
++#define R_IA64_LTV64MSB		0x76	/* symbol + addend, data8 MSB */
++#define R_IA64_LTV64LSB		0x77	/* symbol + addend, data8 LSB */
++#define R_IA64_PCREL21BI	0x79	/* @pcrel(sym + add), 21bit inst */
++#define R_IA64_PCREL22		0x7a	/* @pcrel(sym + add), 22bit inst */
++#define R_IA64_PCREL64I		0x7b	/* @pcrel(sym + add), 64bit inst */
++#define R_IA64_IPLTMSB		0x80	/* dynamic reloc, imported PLT, MSB */
++#define R_IA64_IPLTLSB		0x81	/* dynamic reloc, imported PLT, LSB */
++#define R_IA64_COPY		0x84	/* copy relocation */
++#define R_IA64_SUB		0x85	/* Addend and symbol difference */
++#define R_IA64_LTOFF22X		0x86	/* LTOFF22, relaxable.  */
++#define R_IA64_LDXMOV		0x87	/* Use of LTOFF22X.  */
++#define R_IA64_TPREL14		0x91	/* @tprel(sym + add), imm14 */
++#define R_IA64_TPREL22		0x92	/* @tprel(sym + add), imm22 */
++#define R_IA64_TPREL64I		0x93	/* @tprel(sym + add), imm64 */
++#define R_IA64_TPREL64MSB	0x96	/* @tprel(sym + add), data8 MSB */
++#define R_IA64_TPREL64LSB	0x97	/* @tprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_TPREL22	0x9a	/* @ltoff(@tprel(s+a)), imm2 */
++#define R_IA64_DTPMOD64MSB	0xa6	/* @dtpmod(sym + add), data8 MSB */
++#define R_IA64_DTPMOD64LSB	0xa7	/* @dtpmod(sym + add), data8 LSB */
++#define R_IA64_LTOFF_DTPMOD22	0xaa	/* @ltoff(@dtpmod(sym + add)), imm22 */
++#define R_IA64_DTPREL14		0xb1	/* @dtprel(sym + add), imm14 */
++#define R_IA64_DTPREL22		0xb2	/* @dtprel(sym + add), imm22 */
++#define R_IA64_DTPREL64I	0xb3	/* @dtprel(sym + add), imm64 */
++#define R_IA64_DTPREL32MSB	0xb4	/* @dtprel(sym + add), data4 MSB */
++#define R_IA64_DTPREL32LSB	0xb5	/* @dtprel(sym + add), data4 LSB */
++#define R_IA64_DTPREL64MSB	0xb6	/* @dtprel(sym + add), data8 MSB */
++#define R_IA64_DTPREL64LSB	0xb7	/* @dtprel(sym + add), data8 LSB */
++#define R_IA64_LTOFF_DTPREL22	0xba	/* @ltoff(@dtprel(s+a)), imm22 */
++
++/* SH specific declarations */
++
++/* Processor specific flags for the ELF header e_flags field.  */
++#define EF_SH_MACH_MASK		0x1f
++#define EF_SH_UNKNOWN		0x0
++#define EF_SH1			0x1
++#define EF_SH2			0x2
++#define EF_SH3			0x3
++#define EF_SH_DSP		0x4
++#define EF_SH3_DSP		0x5
++#define EF_SH4AL_DSP		0x6
++#define EF_SH3E			0x8
++#define EF_SH4			0x9
++#define EF_SH2E			0xb
++#define EF_SH4A			0xc
++#define EF_SH2A			0xd
++#define EF_SH4_NOFPU		0x10
++#define EF_SH4A_NOFPU		0x11
++#define EF_SH4_NOMMU_NOFPU	0x12
++#define EF_SH2A_NOFPU		0x13
++#define EF_SH3_NOMMU		0x14
++#define EF_SH2A_SH4_NOFPU	0x15
++#define EF_SH2A_SH3_NOFPU	0x16
++#define EF_SH2A_SH4		0x17
++#define EF_SH2A_SH3E		0x18
++
++/* SH relocs.  */
++#define	R_SH_NONE		0
++#define	R_SH_DIR32		1
++#define	R_SH_REL32		2
++#define	R_SH_DIR8WPN		3
++#define	R_SH_IND12W		4
++#define	R_SH_DIR8WPL		5
++#define	R_SH_DIR8WPZ		6
++#define	R_SH_DIR8BP		7
++#define	R_SH_DIR8W		8
++#define	R_SH_DIR8L		9
++#define	R_SH_SWITCH16		25
++#define	R_SH_SWITCH32		26
++#define	R_SH_USES		27
++#define	R_SH_COUNT		28
++#define	R_SH_ALIGN		29
++#define	R_SH_CODE		30
++#define	R_SH_DATA		31
++#define	R_SH_LABEL		32
++#define	R_SH_SWITCH8		33
++#define	R_SH_GNU_VTINHERIT	34
++#define	R_SH_GNU_VTENTRY	35
++#define	R_SH_TLS_GD_32		144
++#define	R_SH_TLS_LD_32		145
++#define	R_SH_TLS_LDO_32		146
++#define	R_SH_TLS_IE_32		147
++#define	R_SH_TLS_LE_32		148
++#define	R_SH_TLS_DTPMOD32	149
++#define	R_SH_TLS_DTPOFF32	150
++#define	R_SH_TLS_TPOFF32	151
++#define	R_SH_GOT32		160
++#define	R_SH_PLT32		161
++#define	R_SH_COPY		162
++#define	R_SH_GLOB_DAT		163
++#define	R_SH_JMP_SLOT		164
++#define	R_SH_RELATIVE		165
++#define	R_SH_GOTOFF		166
++#define	R_SH_GOTPC		167
++/* Keep this the last entry.  */
++#define	R_SH_NUM		256
++
++/* S/390 specific definitions.  */
++
++/* Valid values for the e_flags field.  */
++
++#define EF_S390_HIGH_GPRS    0x00000001  /* High GPRs kernel facility needed.  */
++
++/* Additional s390 relocs */
++
++#define R_390_NONE		0	/* No reloc.  */
++#define R_390_8			1	/* Direct 8 bit.  */
++#define R_390_12		2	/* Direct 12 bit.  */
++#define R_390_16		3	/* Direct 16 bit.  */
++#define R_390_32		4	/* Direct 32 bit.  */
++#define R_390_PC32		5	/* PC relative 32 bit.	*/
++#define R_390_GOT12		6	/* 12 bit GOT offset.  */
++#define R_390_GOT32		7	/* 32 bit GOT offset.  */
++#define R_390_PLT32		8	/* 32 bit PC relative PLT address.  */
++#define R_390_COPY		9	/* Copy symbol at runtime.  */
++#define R_390_GLOB_DAT		10	/* Create GOT entry.  */
++#define R_390_JMP_SLOT		11	/* Create PLT entry.  */
++#define R_390_RELATIVE		12	/* Adjust by program base.  */
++#define R_390_GOTOFF32		13	/* 32 bit offset to GOT.	 */
++#define R_390_GOTPC		14	/* 32 bit PC relative offset to GOT.  */
++#define R_390_GOT16		15	/* 16 bit GOT offset.  */
++#define R_390_PC16		16	/* PC relative 16 bit.	*/
++#define R_390_PC16DBL		17	/* PC relative 16 bit shifted by 1.  */
++#define R_390_PLT16DBL		18	/* 16 bit PC rel. PLT shifted by 1.  */
++#define R_390_PC32DBL		19	/* PC relative 32 bit shifted by 1.  */
++#define R_390_PLT32DBL		20	/* 32 bit PC rel. PLT shifted by 1.  */
++#define R_390_GOTPCDBL		21	/* 32 bit PC rel. GOT shifted by 1.  */
++#define R_390_64		22	/* Direct 64 bit.  */
++#define R_390_PC64		23	/* PC relative 64 bit.	*/
++#define R_390_GOT64		24	/* 64 bit GOT offset.  */
++#define R_390_PLT64		25	/* 64 bit PC relative PLT address.  */
++#define R_390_GOTENT		26	/* 32 bit PC rel. to GOT entry >> 1. */
++#define R_390_GOTOFF16		27	/* 16 bit offset to GOT. */
++#define R_390_GOTOFF64		28	/* 64 bit offset to GOT. */
++#define R_390_GOTPLT12		29	/* 12 bit offset to jump slot.	*/
++#define R_390_GOTPLT16		30	/* 16 bit offset to jump slot.	*/
++#define R_390_GOTPLT32		31	/* 32 bit offset to jump slot.	*/
++#define R_390_GOTPLT64		32	/* 64 bit offset to jump slot.	*/
++#define R_390_GOTPLTENT		33	/* 32 bit rel. offset to jump slot.  */
++#define R_390_PLTOFF16		34	/* 16 bit offset from GOT to PLT. */
++#define R_390_PLTOFF32		35	/* 32 bit offset from GOT to PLT. */
++#define R_390_PLTOFF64		36	/* 16 bit offset from GOT to PLT. */
++#define R_390_TLS_LOAD		37	/* Tag for load insn in TLS code.  */
++#define R_390_TLS_GDCALL	38	/* Tag for function call in general
++					   dynamic TLS code. */
++#define R_390_TLS_LDCALL	39	/* Tag for function call in local
++					   dynamic TLS code. */
++#define R_390_TLS_GD32		40	/* Direct 32 bit for general dynamic
++					   thread local data.  */
++#define R_390_TLS_GD64		41	/* Direct 64 bit for general dynamic
++					  thread local data.  */
++#define R_390_TLS_GOTIE12	42	/* 12 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_TLS_GOTIE32	43	/* 32 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_TLS_GOTIE64	44	/* 64 bit GOT offset for static TLS
++					   block offset. */
++#define R_390_TLS_LDM32		45	/* Direct 32 bit for local dynamic
++					   thread local data in LE code.  */
++#define R_390_TLS_LDM64		46	/* Direct 64 bit for local dynamic
++					   thread local data in LE code.  */
++#define R_390_TLS_IE32		47	/* 32 bit address of GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_IE64		48	/* 64 bit address of GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_IEENT		49	/* 32 bit rel. offset to GOT entry for
++					   negated static TLS block offset.  */
++#define R_390_TLS_LE32		50	/* 32 bit negated offset relative to
++					   static TLS block.  */
++#define R_390_TLS_LE64		51	/* 64 bit negated offset relative to
++					   static TLS block.  */
++#define R_390_TLS_LDO32		52	/* 32 bit offset relative to TLS
++					   block.  */
++#define R_390_TLS_LDO64		53	/* 64 bit offset relative to TLS
++					   block.  */
++#define R_390_TLS_DTPMOD	54	/* ID of module containing symbol.  */
++#define R_390_TLS_DTPOFF	55	/* Offset in TLS block.	 */
++#define R_390_TLS_TPOFF		56	/* Negated offset in static TLS
++					   block.  */
++#define R_390_20		57	/* Direct 20 bit.  */
++#define R_390_GOT20		58	/* 20 bit GOT offset.  */
++#define R_390_GOTPLT20		59	/* 20 bit offset to jump slot.  */
++#define R_390_TLS_GOTIE20	60	/* 20 bit GOT offset for static TLS
++					   block offset.  */
++#define R_390_IRELATIVE         61      /* STT_GNU_IFUNC relocation.  */
++/* Keep this the last entry.  */
++#define R_390_NUM		62
++
++
++/* CRIS relocations.  */
++#define R_CRIS_NONE		0
++#define R_CRIS_8		1
++#define R_CRIS_16		2
++#define R_CRIS_32		3
++#define R_CRIS_8_PCREL		4
++#define R_CRIS_16_PCREL		5
++#define R_CRIS_32_PCREL		6
++#define R_CRIS_GNU_VTINHERIT	7
++#define R_CRIS_GNU_VTENTRY	8
++#define R_CRIS_COPY		9
++#define R_CRIS_GLOB_DAT		10
++#define R_CRIS_JUMP_SLOT	11
++#define R_CRIS_RELATIVE		12
++#define R_CRIS_16_GOT		13
++#define R_CRIS_32_GOT		14
++#define R_CRIS_16_GOTPLT	15
++#define R_CRIS_32_GOTPLT	16
++#define R_CRIS_32_GOTREL	17
++#define R_CRIS_32_PLT_GOTREL	18
++#define R_CRIS_32_PLT_PCREL	19
++
++#define R_CRIS_NUM		20
++
++
++/* AMD x86-64 relocations.  */
++#define R_X86_64_NONE		0	/* No reloc */
++#define R_X86_64_64		1	/* Direct 64 bit  */
++#define R_X86_64_PC32		2	/* PC relative 32 bit signed */
++#define R_X86_64_GOT32		3	/* 32 bit GOT entry */
++#define R_X86_64_PLT32		4	/* 32 bit PLT address */
++#define R_X86_64_COPY		5	/* Copy symbol at runtime */
++#define R_X86_64_GLOB_DAT	6	/* Create GOT entry */
++#define R_X86_64_JUMP_SLOT	7	/* Create PLT entry */
++#define R_X86_64_RELATIVE	8	/* Adjust by program base */
++#define R_X86_64_GOTPCREL	9	/* 32 bit signed PC relative
++					   offset to GOT */
++#define R_X86_64_32		10	/* Direct 32 bit zero extended */
++#define R_X86_64_32S		11	/* Direct 32 bit sign extended */
++#define R_X86_64_16		12	/* Direct 16 bit zero extended */
++#define R_X86_64_PC16		13	/* 16 bit sign extended pc relative */
++#define R_X86_64_8		14	/* Direct 8 bit sign extended  */
++#define R_X86_64_PC8		15	/* 8 bit sign extended pc relative */
++#define R_X86_64_DTPMOD64	16	/* ID of module containing symbol */
++#define R_X86_64_DTPOFF64	17	/* Offset in module's TLS block */
++#define R_X86_64_TPOFF64	18	/* Offset in initial TLS block */
++#define R_X86_64_TLSGD		19	/* 32 bit signed PC relative offset
++					   to two GOT entries for GD symbol */
++#define R_X86_64_TLSLD		20	/* 32 bit signed PC relative offset
++					   to two GOT entries for LD symbol */
++#define R_X86_64_DTPOFF32	21	/* Offset in TLS block */
++#define R_X86_64_GOTTPOFF	22	/* 32 bit signed PC relative offset
++					   to GOT entry for IE symbol */
++#define R_X86_64_TPOFF32	23	/* Offset in initial TLS block */
++#define R_X86_64_PC64		24	/* PC relative 64 bit */
++#define R_X86_64_GOTOFF64	25	/* 64 bit offset to GOT */
++#define R_X86_64_GOTPC32	26	/* 32 bit signed pc relative
++					   offset to GOT */
++#define R_X86_64_GOT64		27	/* 64-bit GOT entry offset */
++#define R_X86_64_GOTPCREL64	28	/* 64-bit PC relative offset
++					   to GOT entry */
++#define R_X86_64_GOTPC64	29	/* 64-bit PC relative offset to GOT */
++#define R_X86_64_GOTPLT64	30 	/* like GOT64, says PLT entry needed */
++#define R_X86_64_PLTOFF64	31	/* 64-bit GOT relative offset
++					   to PLT entry */
++#define R_X86_64_SIZE32		32	/* Size of symbol plus 32-bit addend */
++#define R_X86_64_SIZE64		33	/* Size of symbol plus 64-bit addend */
++#define R_X86_64_GOTPC32_TLSDESC 34	/* GOT offset for TLS descriptor.  */
++#define R_X86_64_TLSDESC_CALL   35	/* Marker for call through TLS
++					   descriptor.  */
++#define R_X86_64_TLSDESC        36	/* TLS descriptor.  */
++#define R_X86_64_IRELATIVE	37	/* Adjust indirectly by program base */
++#define R_X86_64_RELATIVE64	38	/* 64-bit adjust by program base */
++
++#define R_X86_64_NUM		39
++
++
++/* AM33 relocations.  */
++#define R_MN10300_NONE		0	/* No reloc.  */
++#define R_MN10300_32		1	/* Direct 32 bit.  */
++#define R_MN10300_16		2	/* Direct 16 bit.  */
++#define R_MN10300_8		3	/* Direct 8 bit.  */
++#define R_MN10300_PCREL32	4	/* PC-relative 32-bit.  */
++#define R_MN10300_PCREL16	5	/* PC-relative 16-bit signed.  */
++#define R_MN10300_PCREL8	6	/* PC-relative 8-bit signed.  */
++#define R_MN10300_GNU_VTINHERIT	7	/* Ancient C++ vtable garbage... */
++#define R_MN10300_GNU_VTENTRY	8	/* ... collection annotation.  */
++#define R_MN10300_24		9	/* Direct 24 bit.  */
++#define R_MN10300_GOTPC32	10	/* 32-bit PCrel offset to GOT.  */
++#define R_MN10300_GOTPC16	11	/* 16-bit PCrel offset to GOT.  */
++#define R_MN10300_GOTOFF32	12	/* 32-bit offset from GOT.  */
++#define R_MN10300_GOTOFF24	13	/* 24-bit offset from GOT.  */
++#define R_MN10300_GOTOFF16	14	/* 16-bit offset from GOT.  */
++#define R_MN10300_PLT32		15	/* 32-bit PCrel to PLT entry.  */
++#define R_MN10300_PLT16		16	/* 16-bit PCrel to PLT entry.  */
++#define R_MN10300_GOT32		17	/* 32-bit offset to GOT entry.  */
++#define R_MN10300_GOT24		18	/* 24-bit offset to GOT entry.  */
++#define R_MN10300_GOT16		19	/* 16-bit offset to GOT entry.  */
++#define R_MN10300_COPY		20	/* Copy symbol at runtime.  */
++#define R_MN10300_GLOB_DAT	21	/* Create GOT entry.  */
++#define R_MN10300_JMP_SLOT	22	/* Create PLT entry.  */
++#define R_MN10300_RELATIVE	23	/* Adjust by program base.  */
++
++#define R_MN10300_NUM		24
++
++
++/* M32R relocs.  */
++#define R_M32R_NONE		0	/* No reloc. */
++#define R_M32R_16		1	/* Direct 16 bit. */
++#define R_M32R_32		2	/* Direct 32 bit. */
++#define R_M32R_24		3	/* Direct 24 bit. */
++#define R_M32R_10_PCREL		4	/* PC relative 10 bit shifted. */
++#define R_M32R_18_PCREL		5	/* PC relative 18 bit shifted. */
++#define R_M32R_26_PCREL		6	/* PC relative 26 bit shifted. */
++#define R_M32R_HI16_ULO		7	/* High 16 bit with unsigned low. */
++#define R_M32R_HI16_SLO		8	/* High 16 bit with signed low. */
++#define R_M32R_LO16		9	/* Low 16 bit. */
++#define R_M32R_SDA16		10	/* 16 bit offset in SDA. */
++#define R_M32R_GNU_VTINHERIT	11
++#define R_M32R_GNU_VTENTRY	12
++/* M32R relocs use SHT_RELA.  */
++#define R_M32R_16_RELA		33	/* Direct 16 bit. */
++#define R_M32R_32_RELA		34	/* Direct 32 bit. */
++#define R_M32R_24_RELA		35	/* Direct 24 bit. */
++#define R_M32R_10_PCREL_RELA	36	/* PC relative 10 bit shifted. */
++#define R_M32R_18_PCREL_RELA	37	/* PC relative 18 bit shifted. */
++#define R_M32R_26_PCREL_RELA	38	/* PC relative 26 bit shifted. */
++#define R_M32R_HI16_ULO_RELA	39	/* High 16 bit with unsigned low */
++#define R_M32R_HI16_SLO_RELA	40	/* High 16 bit with signed low */
++#define R_M32R_LO16_RELA	41	/* Low 16 bit */
++#define R_M32R_SDA16_RELA	42	/* 16 bit offset in SDA */
++#define R_M32R_RELA_GNU_VTINHERIT	43
++#define R_M32R_RELA_GNU_VTENTRY	44
++#define R_M32R_REL32		45	/* PC relative 32 bit.  */
++
++#define R_M32R_GOT24		48	/* 24 bit GOT entry */
++#define R_M32R_26_PLTREL	49	/* 26 bit PC relative to PLT shifted */
++#define R_M32R_COPY		50	/* Copy symbol at runtime */
++#define R_M32R_GLOB_DAT		51	/* Create GOT entry */
++#define R_M32R_JMP_SLOT		52	/* Create PLT entry */
++#define R_M32R_RELATIVE		53	/* Adjust by program base */
++#define R_M32R_GOTOFF		54	/* 24 bit offset to GOT */
++#define R_M32R_GOTPC24		55	/* 24 bit PC relative offset to GOT */
++#define R_M32R_GOT16_HI_ULO	56	/* High 16 bit GOT entry with unsigned
++					   low */
++#define R_M32R_GOT16_HI_SLO	57	/* High 16 bit GOT entry with signed
++					   low */
++#define R_M32R_GOT16_LO		58	/* Low 16 bit GOT entry */
++#define R_M32R_GOTPC_HI_ULO	59	/* High 16 bit PC relative offset to
++					   GOT with unsigned low */
++#define R_M32R_GOTPC_HI_SLO	60	/* High 16 bit PC relative offset to
++					   GOT with signed low */
++#define R_M32R_GOTPC_LO		61	/* Low 16 bit PC relative offset to
++					   GOT */
++#define R_M32R_GOTOFF_HI_ULO	62	/* High 16 bit offset to GOT
++					   with unsigned low */
++#define R_M32R_GOTOFF_HI_SLO	63	/* High 16 bit offset to GOT
++					   with signed low */
++#define R_M32R_GOTOFF_LO	64	/* Low 16 bit offset to GOT */
++#define R_M32R_NUM		256	/* Keep this the last entry. */
++
++
++/* TILEPro relocations.  */
++#define R_TILEPRO_NONE		0	/* No reloc */
++#define R_TILEPRO_32		1	/* Direct 32 bit */
++#define R_TILEPRO_16		2	/* Direct 16 bit */
++#define R_TILEPRO_8		3	/* Direct 8 bit */
++#define R_TILEPRO_32_PCREL	4	/* PC relative 32 bit */
++#define R_TILEPRO_16_PCREL	5	/* PC relative 16 bit */
++#define R_TILEPRO_8_PCREL	6	/* PC relative 8 bit */
++#define R_TILEPRO_LO16		7	/* Low 16 bit */
++#define R_TILEPRO_HI16		8	/* High 16 bit */
++#define R_TILEPRO_HA16		9	/* High 16 bit, adjusted */
++#define R_TILEPRO_COPY		10	/* Copy relocation */
++#define R_TILEPRO_GLOB_DAT	11	/* Create GOT entry */
++#define R_TILEPRO_JMP_SLOT	12	/* Create PLT entry */
++#define R_TILEPRO_RELATIVE	13	/* Adjust by program base */
++#define R_TILEPRO_BROFF_X1	14	/* X1 pipe branch offset */
++#define R_TILEPRO_JOFFLONG_X1	15	/* X1 pipe jump offset */
++#define R_TILEPRO_JOFFLONG_X1_PLT 16	/* X1 pipe jump offset to PLT */
++#define R_TILEPRO_IMM8_X0	17	/* X0 pipe 8-bit */
++#define R_TILEPRO_IMM8_Y0	18	/* Y0 pipe 8-bit */
++#define R_TILEPRO_IMM8_X1	19	/* X1 pipe 8-bit */
++#define R_TILEPRO_IMM8_Y1	20	/* Y1 pipe 8-bit */
++#define R_TILEPRO_MT_IMM15_X1	21	/* X1 pipe mtspr */
++#define R_TILEPRO_MF_IMM15_X1	22	/* X1 pipe mfspr */
++#define R_TILEPRO_IMM16_X0	23	/* X0 pipe 16-bit */
++#define R_TILEPRO_IMM16_X1	24	/* X1 pipe 16-bit */
++#define R_TILEPRO_IMM16_X0_LO	25	/* X0 pipe low 16-bit */
++#define R_TILEPRO_IMM16_X1_LO	26	/* X1 pipe low 16-bit */
++#define R_TILEPRO_IMM16_X0_HI	27	/* X0 pipe high 16-bit */
++#define R_TILEPRO_IMM16_X1_HI	28	/* X1 pipe high 16-bit */
++#define R_TILEPRO_IMM16_X0_HA	29	/* X0 pipe high 16-bit, adjusted */
++#define R_TILEPRO_IMM16_X1_HA	30	/* X1 pipe high 16-bit, adjusted */
++#define R_TILEPRO_IMM16_X0_PCREL 31	/* X0 pipe PC relative 16 bit */
++#define R_TILEPRO_IMM16_X1_PCREL 32	/* X1 pipe PC relative 16 bit */
++#define R_TILEPRO_IMM16_X0_LO_PCREL 33	/* X0 pipe PC relative low 16 bit */
++#define R_TILEPRO_IMM16_X1_LO_PCREL 34	/* X1 pipe PC relative low 16 bit */
++#define R_TILEPRO_IMM16_X0_HI_PCREL 35	/* X0 pipe PC relative high 16 bit */
++#define R_TILEPRO_IMM16_X1_HI_PCREL 36	/* X1 pipe PC relative high 16 bit */
++#define R_TILEPRO_IMM16_X0_HA_PCREL 37	/* X0 pipe PC relative ha() 16 bit */
++#define R_TILEPRO_IMM16_X1_HA_PCREL 38	/* X1 pipe PC relative ha() 16 bit */
++#define R_TILEPRO_IMM16_X0_GOT	39	/* X0 pipe 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT	40	/* X1 pipe 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_LO 41	/* X0 pipe low 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_LO 42	/* X1 pipe low 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_HI 43	/* X0 pipe high 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_HI 44	/* X1 pipe high 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X0_GOT_HA 45	/* X0 pipe ha() 16-bit GOT offset */
++#define R_TILEPRO_IMM16_X1_GOT_HA 46	/* X1 pipe ha() 16-bit GOT offset */
++#define R_TILEPRO_MMSTART_X0	47	/* X0 pipe mm "start" */
++#define R_TILEPRO_MMEND_X0	48	/* X0 pipe mm "end" */
++#define R_TILEPRO_MMSTART_X1	49	/* X1 pipe mm "start" */
++#define R_TILEPRO_MMEND_X1	50	/* X1 pipe mm "end" */
++#define R_TILEPRO_SHAMT_X0	51	/* X0 pipe shift amount */
++#define R_TILEPRO_SHAMT_X1	52	/* X1 pipe shift amount */
++#define R_TILEPRO_SHAMT_Y0	53	/* Y0 pipe shift amount */
++#define R_TILEPRO_SHAMT_Y1	54	/* Y1 pipe shift amount */
++#define R_TILEPRO_DEST_IMM8_X1	55	/* X1 pipe destination 8-bit */
++/* Relocs 56-59 are currently not defined.  */
++#define R_TILEPRO_TLS_GD_CALL	60	/* "jal" for TLS GD */
++#define R_TILEPRO_IMM8_X0_TLS_GD_ADD 61	/* X0 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_X1_TLS_GD_ADD 62	/* X1 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_Y0_TLS_GD_ADD 63	/* Y0 pipe "addi" for TLS GD */
++#define R_TILEPRO_IMM8_Y1_TLS_GD_ADD 64	/* Y1 pipe "addi" for TLS GD */
++#define R_TILEPRO_TLS_IE_LOAD	65	/* "lw_tls" for TLS IE */
++#define R_TILEPRO_IMM16_X0_TLS_GD 66	/* X0 pipe 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD 67	/* X1 pipe 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_LO 68	/* X0 pipe low 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_LO 69	/* X1 pipe low 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_HI 70	/* X0 pipe high 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_HI 71	/* X1 pipe high 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_GD_HA 72	/* X0 pipe ha() 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X1_TLS_GD_HA 73	/* X1 pipe ha() 16-bit TLS GD offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE 74	/* X0 pipe 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE 75	/* X1 pipe 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_LO 76	/* X0 pipe low 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_LO 77	/* X1 pipe low 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_HI 78	/* X0 pipe high 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_HI 79	/* X1 pipe high 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X0_TLS_IE_HA 80	/* X0 pipe ha() 16-bit TLS IE offset */
++#define R_TILEPRO_IMM16_X1_TLS_IE_HA 81	/* X1 pipe ha() 16-bit TLS IE offset */
++#define R_TILEPRO_TLS_DTPMOD32	82	/* ID of module containing symbol */
++#define R_TILEPRO_TLS_DTPOFF32	83	/* Offset in TLS block */
++#define R_TILEPRO_TLS_TPOFF32	84	/* Offset in static TLS block */
++#define R_TILEPRO_IMM16_X0_TLS_LE 85	/* X0 pipe 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE 86	/* X1 pipe 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_LO 87	/* X0 pipe low 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_LO 88	/* X1 pipe low 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_HI 89	/* X0 pipe high 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_HI 90	/* X1 pipe high 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X0_TLS_LE_HA 91	/* X0 pipe ha() 16-bit TLS LE offset */
++#define R_TILEPRO_IMM16_X1_TLS_LE_HA 92	/* X1 pipe ha() 16-bit TLS LE offset */
++
++#define R_TILEPRO_GNU_VTINHERIT	128	/* GNU C++ vtable hierarchy */
++#define R_TILEPRO_GNU_VTENTRY	129	/* GNU C++ vtable member usage */
++
++#define R_TILEPRO_NUM		130
++
++
++/* TILE-Gx relocations.  */
++#define R_TILEGX_NONE		0	/* No reloc */
++#define R_TILEGX_64		1	/* Direct 64 bit */
++#define R_TILEGX_32		2	/* Direct 32 bit */
++#define R_TILEGX_16		3	/* Direct 16 bit */
++#define R_TILEGX_8		4	/* Direct 8 bit */
++#define R_TILEGX_64_PCREL	5	/* PC relative 64 bit */
++#define R_TILEGX_32_PCREL	6	/* PC relative 32 bit */
++#define R_TILEGX_16_PCREL	7	/* PC relative 16 bit */
++#define R_TILEGX_8_PCREL	8	/* PC relative 8 bit */
++#define R_TILEGX_HW0		9	/* hword 0 16-bit */
++#define R_TILEGX_HW1		10	/* hword 1 16-bit */
++#define R_TILEGX_HW2		11	/* hword 2 16-bit */
++#define R_TILEGX_HW3		12	/* hword 3 16-bit */
++#define R_TILEGX_HW0_LAST	13	/* last hword 0 16-bit */
++#define R_TILEGX_HW1_LAST	14	/* last hword 1 16-bit */
++#define R_TILEGX_HW2_LAST	15	/* last hword 2 16-bit */
++#define R_TILEGX_COPY		16	/* Copy relocation */
++#define R_TILEGX_GLOB_DAT	17	/* Create GOT entry */
++#define R_TILEGX_JMP_SLOT	18	/* Create PLT entry */
++#define R_TILEGX_RELATIVE	19	/* Adjust by program base */
++#define R_TILEGX_BROFF_X1	20	/* X1 pipe branch offset */
++#define R_TILEGX_JUMPOFF_X1	21	/* X1 pipe jump offset */
++#define R_TILEGX_JUMPOFF_X1_PLT	22	/* X1 pipe jump offset to PLT */
++#define R_TILEGX_IMM8_X0	23	/* X0 pipe 8-bit */
++#define R_TILEGX_IMM8_Y0	24	/* Y0 pipe 8-bit */
++#define R_TILEGX_IMM8_X1	25	/* X1 pipe 8-bit */
++#define R_TILEGX_IMM8_Y1	26	/* Y1 pipe 8-bit */
++#define R_TILEGX_DEST_IMM8_X1	27	/* X1 pipe destination 8-bit */
++#define R_TILEGX_MT_IMM14_X1	28	/* X1 pipe mtspr */
++#define R_TILEGX_MF_IMM14_X1	29	/* X1 pipe mfspr */
++#define R_TILEGX_MMSTART_X0	30	/* X0 pipe mm "start" */
++#define R_TILEGX_MMEND_X0	31	/* X0 pipe mm "end" */
++#define R_TILEGX_SHAMT_X0	32	/* X0 pipe shift amount */
++#define R_TILEGX_SHAMT_X1	33	/* X1 pipe shift amount */
++#define R_TILEGX_SHAMT_Y0	34	/* Y0 pipe shift amount */
++#define R_TILEGX_SHAMT_Y1	35	/* Y1 pipe shift amount */
++#define R_TILEGX_IMM16_X0_HW0	36	/* X0 pipe hword 0 */
++#define R_TILEGX_IMM16_X1_HW0	37	/* X1 pipe hword 0 */
++#define R_TILEGX_IMM16_X0_HW1	38	/* X0 pipe hword 1 */
++#define R_TILEGX_IMM16_X1_HW1	39	/* X1 pipe hword 1 */
++#define R_TILEGX_IMM16_X0_HW2	40	/* X0 pipe hword 2 */
++#define R_TILEGX_IMM16_X1_HW2	41	/* X1 pipe hword 2 */
++#define R_TILEGX_IMM16_X0_HW3	42	/* X0 pipe hword 3 */
++#define R_TILEGX_IMM16_X1_HW3	43	/* X1 pipe hword 3 */
++#define R_TILEGX_IMM16_X0_HW0_LAST 44	/* X0 pipe last hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_LAST 45	/* X1 pipe last hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_LAST 46	/* X0 pipe last hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_LAST 47	/* X1 pipe last hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_LAST 48	/* X0 pipe last hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_LAST 49	/* X1 pipe last hword 2 */
++#define R_TILEGX_IMM16_X0_HW0_PCREL 50	/* X0 pipe PC relative hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_PCREL 51	/* X1 pipe PC relative hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_PCREL 52	/* X0 pipe PC relative hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_PCREL 53	/* X1 pipe PC relative hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_PCREL 54	/* X0 pipe PC relative hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_PCREL 55	/* X1 pipe PC relative hword 2 */
++#define R_TILEGX_IMM16_X0_HW3_PCREL 56	/* X0 pipe PC relative hword 3 */
++#define R_TILEGX_IMM16_X1_HW3_PCREL 57	/* X1 pipe PC relative hword 3 */
++#define R_TILEGX_IMM16_X0_HW0_LAST_PCREL 58 /* X0 pipe PC-rel last hword 0 */
++#define R_TILEGX_IMM16_X1_HW0_LAST_PCREL 59 /* X1 pipe PC-rel last hword 0 */
++#define R_TILEGX_IMM16_X0_HW1_LAST_PCREL 60 /* X0 pipe PC-rel last hword 1 */
++#define R_TILEGX_IMM16_X1_HW1_LAST_PCREL 61 /* X1 pipe PC-rel last hword 1 */
++#define R_TILEGX_IMM16_X0_HW2_LAST_PCREL 62 /* X0 pipe PC-rel last hword 2 */
++#define R_TILEGX_IMM16_X1_HW2_LAST_PCREL 63 /* X1 pipe PC-rel last hword 2 */
++#define R_TILEGX_IMM16_X0_HW0_GOT 64	/* X0 pipe hword 0 GOT offset */
++#define R_TILEGX_IMM16_X1_HW0_GOT 65	/* X1 pipe hword 0 GOT offset */
++/* Relocs 66-71 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_LAST_GOT 72 /* X0 pipe last hword 0 GOT offset */
++#define R_TILEGX_IMM16_X1_HW0_LAST_GOT 73 /* X1 pipe last hword 0 GOT offset */
++#define R_TILEGX_IMM16_X0_HW1_LAST_GOT 74 /* X0 pipe last hword 1 GOT offset */
++#define R_TILEGX_IMM16_X1_HW1_LAST_GOT 75 /* X1 pipe last hword 1 GOT offset */
++/* Relocs 76-77 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_TLS_GD 78	/* X0 pipe hword 0 TLS GD offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_GD 79	/* X1 pipe hword 0 TLS GD offset */
++#define R_TILEGX_IMM16_X0_HW0_TLS_LE 80	/* X0 pipe hword 0 TLS LE offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_LE 81	/* X1 pipe hword 0 TLS LE offset */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_LE 82 /* X0 pipe last hword 0 LE off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_LE 83 /* X1 pipe last hword 0 LE off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_LE 84 /* X0 pipe last hword 1 LE off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_LE 85 /* X1 pipe last hword 1 LE off */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_GD 86 /* X0 pipe last hword 0 GD off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_GD 87 /* X1 pipe last hword 0 GD off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_GD 88 /* X0 pipe last hword 1 GD off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_GD 89 /* X1 pipe last hword 1 GD off */
++/* Relocs 90-91 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_TLS_IE 92	/* X0 pipe hword 0 TLS IE offset */
++#define R_TILEGX_IMM16_X1_HW0_TLS_IE 93	/* X1 pipe hword 0 TLS IE offset */
++/* Relocs 94-99 are currently not defined.  */
++#define R_TILEGX_IMM16_X0_HW0_LAST_TLS_IE 100 /* X0 pipe last hword 0 IE off */
++#define R_TILEGX_IMM16_X1_HW0_LAST_TLS_IE 101 /* X1 pipe last hword 0 IE off */
++#define R_TILEGX_IMM16_X0_HW1_LAST_TLS_IE 102 /* X0 pipe last hword 1 IE off */
++#define R_TILEGX_IMM16_X1_HW1_LAST_TLS_IE 103 /* X1 pipe last hword 1 IE off */
++/* Relocs 104-105 are currently not defined.  */
++#define R_TILEGX_TLS_DTPMOD64	106	/* 64-bit ID of symbol's module */
++#define R_TILEGX_TLS_DTPOFF64	107	/* 64-bit offset in TLS block */
++#define R_TILEGX_TLS_TPOFF64	108	/* 64-bit offset in static TLS block */
++#define R_TILEGX_TLS_DTPMOD32	109	/* 32-bit ID of symbol's module */
++#define R_TILEGX_TLS_DTPOFF32	110	/* 32-bit offset in TLS block */
++#define R_TILEGX_TLS_TPOFF32	111	/* 32-bit offset in static TLS block */
++#define R_TILEGX_TLS_GD_CALL	112	/* "jal" for TLS GD */
++#define R_TILEGX_IMM8_X0_TLS_GD_ADD 113	/* X0 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_X1_TLS_GD_ADD 114	/* X1 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_Y0_TLS_GD_ADD 115	/* Y0 pipe "addi" for TLS GD */
++#define R_TILEGX_IMM8_Y1_TLS_GD_ADD 116	/* Y1 pipe "addi" for TLS GD */
++#define R_TILEGX_TLS_IE_LOAD	117	/* "ld_tls" for TLS IE */
++#define R_TILEGX_IMM8_X0_TLS_ADD 118	/* X0 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_X1_TLS_ADD 119	/* X1 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_Y0_TLS_ADD 120	/* Y0 pipe "addi" for TLS GD/IE */
++#define R_TILEGX_IMM8_Y1_TLS_ADD 121	/* Y1 pipe "addi" for TLS GD/IE */
++
++#define R_TILEGX_GNU_VTINHERIT	128	/* GNU C++ vtable hierarchy */
++#define R_TILEGX_GNU_VTENTRY	129	/* GNU C++ vtable member usage */
++
++#define R_TILEGX_NUM		130
++
++#endif	/* elf.h */
diff --git a/target/linux/generic/patches-3.3/211-stddef_include.patch b/target/linux/generic/patches-3.3/211-stddef_include.patch
new file mode 100644
index 0000000..7fe248d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/211-stddef_include.patch
@@ -0,0 +1,17 @@
+--- a/include/linux/stddef.h
++++ b/include/linux/stddef.h
+@@ -16,6 +16,7 @@ enum {
+ 	false	= 0,
+ 	true	= 1
+ };
++#endif /* __KERNEL__ */
+ 
+ #undef offsetof
+ #ifdef __compiler_offsetof
+@@ -23,6 +24,5 @@ enum {
+ #else
+ #define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+ #endif
+-#endif /* __KERNEL__ */
+ 
+ #endif
diff --git a/target/linux/generic/patches-3.3/212-x86_reloc_portability.patch b/target/linux/generic/patches-3.3/212-x86_reloc_portability.patch
new file mode 100644
index 0000000..d0c8106
--- /dev/null
+++ b/target/linux/generic/patches-3.3/212-x86_reloc_portability.patch
@@ -0,0 +1,22 @@
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -10,7 +10,18 @@
+ #define USE_BSD
+ #include <endian.h>
+ #include <regex.h>
+-#include <tools/le_byteshift.h>
++
++static inline void __put_unaligned_le16(uint16_t val, uint8_t *p)
++{
++	*p++ = val;
++	*p++ = val >> 8;
++}
++
++static inline void put_unaligned_le32(uint32_t val, uint8_t *p)
++{
++	__put_unaligned_le16(val >> 16, p + 2);
++	__put_unaligned_le16(val, p);
++}
+ 
+ static void die(char *fmt, ...);
+ 
diff --git a/target/linux/generic/patches-3.3/220-module_exports.patch b/target/linux/generic/patches-3.3/220-module_exports.patch
new file mode 100644
index 0000000..5b87c1a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/220-module_exports.patch
@@ -0,0 +1,91 @@
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -52,6 +52,18 @@
+ #define LOAD_OFFSET 0
+ #endif
+ 
++#ifndef SYMTAB_KEEP_STR
++#define SYMTAB_KEEP *(SORT(___ksymtab+*))
++#define SYMTAB_KEEP_GPL *(SORT(___ksymtab_gpl+*))
++#define SYMTAB_KEEP_STR *(__ksymtab_strings+*)
++#endif
++
++#ifndef SYMTAB_DISCARD
++#define SYMTAB_DISCARD
++#define SYMTAB_DISCARD_GPL
++#define SYMTAB_DISCARD_STR
++#endif
++
+ #ifndef SYMBOL_PREFIX
+ #define VMLINUX_SYMBOL(sym) sym
+ #else
+@@ -275,14 +287,14 @@
+ 	/* Kernel symbol table: Normal symbols */			\
+ 	__ksymtab         : AT(ADDR(__ksymtab) - LOAD_OFFSET) {		\
+ 		VMLINUX_SYMBOL(__start___ksymtab) = .;			\
+-		*(SORT(___ksymtab+*))					\
++		SYMTAB_KEEP						\
+ 		VMLINUX_SYMBOL(__stop___ksymtab) = .;			\
+ 	}								\
+ 									\
+ 	/* Kernel symbol table: GPL-only symbols */			\
+ 	__ksymtab_gpl     : AT(ADDR(__ksymtab_gpl) - LOAD_OFFSET) {	\
+ 		VMLINUX_SYMBOL(__start___ksymtab_gpl) = .;		\
+-		*(SORT(___ksymtab_gpl+*))				\
++		SYMTAB_KEEP_GPL						\
+ 		VMLINUX_SYMBOL(__stop___ksymtab_gpl) = .;		\
+ 	}								\
+ 									\
+@@ -344,7 +356,7 @@
+ 									\
+ 	/* Kernel symbol table: strings */				\
+         __ksymtab_strings : AT(ADDR(__ksymtab_strings) - LOAD_OFFSET) {	\
+-		*(__ksymtab_strings)					\
++		SYMTAB_KEEP_STR						\
+ 	}								\
+ 									\
+ 	/* __*init sections */						\
+@@ -676,6 +688,9 @@
+ 	EXIT_TEXT							\
+ 	EXIT_DATA							\
+ 	EXIT_CALL							\
++	SYMTAB_DISCARD							\
++	SYMTAB_DISCARD_GPL						\
++	SYMTAB_DISCARD_STR						\
+ 	*(.discard)							\
+ 	*(.discard.*)							\
+ 	}
+--- a/include/linux/export.h
++++ b/include/linux/export.h
+@@ -45,12 +45,19 @@ extern struct module __this_module;
+ #define __CRC_SYMBOL(sym, sec)
+ #endif
+ 
++#ifdef MODULE
++#define __EXPORT_SUFFIX(sym)
++#else
++#define __EXPORT_SUFFIX(sym) "+" #sym
++#endif
++
+ /* For every exported symbol, place a struct in the __ksymtab section */
+ #define __EXPORT_SYMBOL(sym, sec)				\
+ 	extern typeof(sym) sym;					\
+ 	__CRC_SYMBOL(sym, sec)					\
+ 	static const char __kstrtab_##sym[]			\
+-	__attribute__((section("__ksymtab_strings"), aligned(1))) \
++	__attribute__((section("__ksymtab_strings"		\
++	  __EXPORT_SUFFIX(sym)), aligned(1)))			\
+ 	= MODULE_SYMBOL_PREFIX #sym;				\
+ 	static const struct kernel_symbol __ksymtab_##sym	\
+ 	__used							\
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -346,7 +346,7 @@ targets += $(extra-y) $(MAKECMDGOALS) $(
+ # Linker scripts preprocessor (.lds.S -> .lds)
+ # ---------------------------------------------------------------------------
+ quiet_cmd_cpp_lds_S = LDS     $@
+-      cmd_cpp_lds_S = $(CPP) $(cpp_flags) -P -C -U$(ARCH) \
++      cmd_cpp_lds_S = $(CPP) $(EXTRA_LDSFLAGS) $(cpp_flags) -P -C -U$(ARCH) \
+ 	                     -D__ASSEMBLY__ -DLINKER_SCRIPT -o $@ $<
+ 
+ $(obj)/%.lds: $(src)/%.lds.S FORCE
diff --git a/target/linux/generic/patches-3.3/230-openwrt_lzma_options.patch b/target/linux/generic/patches-3.3/230-openwrt_lzma_options.patch
new file mode 100644
index 0000000..f17f40a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/230-openwrt_lzma_options.patch
@@ -0,0 +1,54 @@
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -296,7 +296,7 @@ cmd_bzip2 = (cat $(filter-out FORCE,$^)
+ 
+ quiet_cmd_lzma = LZMA    $@
+ cmd_lzma = (cat $(filter-out FORCE,$^) | \
+-	lzma -9 && $(call size_append, $(filter-out FORCE,$^))) > $@ || \
++	lzma e -d20 -lc1 -lp2 -pb2 -eos -si -so && $(call size_append, $(filter-out FORCE,$^))) > $@ || \
+ 	(rm -f $@ ; false)
+ 
+ quiet_cmd_lzo = LZO     $@
+--- a/scripts/gen_initramfs_list.sh
++++ b/scripts/gen_initramfs_list.sh
+@@ -226,7 +226,7 @@ cpio_list=
+ output="/dev/stdout"
+ output_file=""
+ is_cpio_compressed=
+-compr="gzip -n -9 -f"
++compr="gzip -n -9 -f -"
+ 
+ arg="$1"
+ case "$arg" in
+@@ -240,9 +240,9 @@ case "$arg" in
+ 		output_file="$1"
+ 		cpio_list="$(mktemp ${TMPDIR:-/tmp}/cpiolist.XXXXXX)"
+ 		output=${cpio_list}
+-		echo "$output_file" | grep -q "\.gz$" && compr="gzip -n -9 -f"
+-		echo "$output_file" | grep -q "\.bz2$" && compr="bzip2 -9 -f"
+-		echo "$output_file" | grep -q "\.lzma$" && compr="lzma -9 -f"
++		echo "$output_file" | grep -q "\.gz$" && compr="gzip -n -9 -f -"
++		echo "$output_file" | grep -q "\.bz2$" && compr="bzip2 -9 -f -"
++		echo "$output_file" | grep -q "\.lzma$" && compr="lzma e -d20 -lc1 -lp2 -pb2 -eos -si -so"
+ 		echo "$output_file" | grep -q "\.xz$" && \
+ 				compr="xz --check=crc32 --lzma2=dict=1MiB"
+ 		echo "$output_file" | grep -q "\.lzo$" && compr="lzop -9 -f"
+@@ -303,7 +303,7 @@ if [ ! -z ${output_file} ]; then
+ 	if [ "${is_cpio_compressed}" = "compressed" ]; then
+ 		cat ${cpio_tfile} > ${output_file}
+ 	else
+-		(cat ${cpio_tfile} | ${compr}  - > ${output_file}) \
++		(cat ${cpio_tfile} | ${compr} > ${output_file}) \
+ 		|| (rm -f ${output_file} ; false)
+ 	fi
+ 	[ -z ${cpio_file} ] && rm ${cpio_tfile}
+--- a/lib/decompress.c
++++ b/lib/decompress.c
+@@ -40,6 +40,7 @@ static const struct compress_format {
+ 	{ {037, 0236}, "gzip", gunzip },
+ 	{ {0x42, 0x5a}, "bzip2", bunzip2 },
+ 	{ {0x5d, 0x00}, "lzma", unlzma },
++	{ {0x6d, 0x00}, "lzma-openwrt", unlzma },
+ 	{ {0xfd, 0x37}, "xz", unxz },
+ 	{ {0x89, 0x4c}, "lzo", unlzo },
+ 	{ {0, 0}, NULL, NULL }
diff --git a/target/linux/generic/patches-3.3/250-netfilter_depends.patch b/target/linux/generic/patches-3.3/250-netfilter_depends.patch
new file mode 100644
index 0000000..cbe3892
--- /dev/null
+++ b/target/linux/generic/patches-3.3/250-netfilter_depends.patch
@@ -0,0 +1,18 @@
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -181,7 +181,6 @@ config NF_CONNTRACK_FTP
+ 
+ config NF_CONNTRACK_H323
+ 	tristate "H.323 protocol support"
+-	depends on (IPV6 || IPV6=n)
+ 	depends on NETFILTER_ADVANCED
+ 	help
+ 	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
+@@ -627,7 +626,6 @@ config NETFILTER_XT_TARGET_SECMARK
+ 
+ config NETFILTER_XT_TARGET_TCPMSS
+ 	tristate '"TCPMSS" target support'
+-	depends on (IPV6 || IPV6=n)
+ 	default m if NETFILTER_ADVANCED=n
+ 	---help---
+ 	  This option adds a `TCPMSS' target, which allows you to alter the
diff --git a/target/linux/generic/patches-3.3/251-sound_kconfig.patch b/target/linux/generic/patches-3.3/251-sound_kconfig.patch
new file mode 100644
index 0000000..f374009
--- /dev/null
+++ b/target/linux/generic/patches-3.3/251-sound_kconfig.patch
@@ -0,0 +1,11 @@
+--- a/sound/core/Kconfig
++++ b/sound/core/Kconfig
+@@ -7,7 +7,7 @@ config SND_PCM
+ 	select SND_TIMER
+ 
+ config SND_HWDEP
+-	tristate
++	tristate "Sound hardware support"
+ 
+ config SND_RAWMIDI
+ 	tristate
diff --git a/target/linux/generic/patches-3.3/252-mv_cesa_depends.patch b/target/linux/generic/patches-3.3/252-mv_cesa_depends.patch
new file mode 100644
index 0000000..5370145
--- /dev/null
+++ b/target/linux/generic/patches-3.3/252-mv_cesa_depends.patch
@@ -0,0 +1,10 @@
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -172,6 +172,7 @@ config CRYPTO_DEV_MV_CESA
+ 	depends on PLAT_ORION
+ 	select CRYPTO_ALGAPI
+ 	select CRYPTO_AES
++	select CRYPTO_HASH2
+ 	select CRYPTO_BLKCIPHER2
+ 	select CRYPTO_HASH
+ 	help
diff --git a/target/linux/generic/patches-3.3/253-ssb_b43_default_on.patch b/target/linux/generic/patches-3.3/253-ssb_b43_default_on.patch
new file mode 100644
index 0000000..29d2a41
--- /dev/null
+++ b/target/linux/generic/patches-3.3/253-ssb_b43_default_on.patch
@@ -0,0 +1,29 @@
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -29,6 +29,7 @@ config SSB_SPROM
+ config SSB_BLOCKIO
+ 	bool
+ 	depends on SSB
++	default y
+ 
+ config SSB_PCIHOST_POSSIBLE
+ 	bool
+@@ -49,7 +50,7 @@ config SSB_PCIHOST
+ config SSB_B43_PCI_BRIDGE
+ 	bool
+ 	depends on SSB_PCIHOST
+-	default n
++	default y
+ 
+ config SSB_PCMCIAHOST_POSSIBLE
+ 	bool
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -17,6 +17,7 @@ config BCMA
+ config BCMA_BLOCKIO
+ 	bool
+ 	depends on BCMA
++	default y
+ 
+ config BCMA_HOST_PCI_POSSIBLE
+ 	bool
diff --git a/target/linux/generic/patches-3.3/254-textsearch_kconfig_hacks.patch b/target/linux/generic/patches-3.3/254-textsearch_kconfig_hacks.patch
new file mode 100644
index 0000000..1659fda
--- /dev/null
+++ b/target/linux/generic/patches-3.3/254-textsearch_kconfig_hacks.patch
@@ -0,0 +1,23 @@
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -207,16 +207,16 @@ config BCH_CONST_T
+ # Textsearch support is select'ed if needed
+ #
+ config TEXTSEARCH
+-	boolean
++	boolean	"Textsearch support"
+ 
+ config TEXTSEARCH_KMP
+-	tristate
++	tristate "Textsearch KMP"
+ 
+ config TEXTSEARCH_BM
+-	tristate
++	tristate "Textsearch BM"
+ 
+ config TEXTSEARCH_FSM
+-	tristate
++	tristate "Textsearch FSM"
+ 
+ config BTREE
+ 	boolean
diff --git a/target/linux/generic/patches-3.3/255-lib80211_kconfig_hacks.patch b/target/linux/generic/patches-3.3/255-lib80211_kconfig_hacks.patch
new file mode 100644
index 0000000..8dde331
--- /dev/null
+++ b/target/linux/generic/patches-3.3/255-lib80211_kconfig_hacks.patch
@@ -0,0 +1,19 @@
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -143,13 +143,13 @@ config LIB80211
+ 	  you want this built into your kernel.
+ 
+ config LIB80211_CRYPT_WEP
+-	tristate
++	tristate "LIB80211_CRYPT_WEP"
+ 
+ config LIB80211_CRYPT_CCMP
+-	tristate
++	tristate "LIB80211_CRYPT_CCMP"
+ 
+ config LIB80211_CRYPT_TKIP
+-	tristate
++	tristate "LIB80211_CRYPT_TKIP"
+ 
+ config LIB80211_DEBUG
+ 	bool "lib80211 debugging messages"
diff --git a/target/linux/generic/patches-3.3/256-crypto_add_kconfig_prompts.patch b/target/linux/generic/patches-3.3/256-crypto_add_kconfig_prompts.patch
new file mode 100644
index 0000000..8462c71
--- /dev/null
+++ b/target/linux/generic/patches-3.3/256-crypto_add_kconfig_prompts.patch
@@ -0,0 +1,47 @@
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -31,7 +31,7 @@ config CRYPTO_FIPS
+ 	  this is.
+ 
+ config CRYPTO_ALGAPI
+-	tristate
++	tristate "ALGAPI"
+ 	select CRYPTO_ALGAPI2
+ 	help
+ 	  This option provides the API for cryptographic algorithms.
+@@ -40,7 +40,7 @@ config CRYPTO_ALGAPI2
+ 	tristate
+ 
+ config CRYPTO_AEAD
+-	tristate
++	tristate "AEAD"
+ 	select CRYPTO_AEAD2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -49,7 +49,7 @@ config CRYPTO_AEAD2
+ 	select CRYPTO_ALGAPI2
+ 
+ config CRYPTO_BLKCIPHER
+-	tristate
++	tristate "BLKCIPHER"
+ 	select CRYPTO_BLKCIPHER2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -60,7 +60,7 @@ config CRYPTO_BLKCIPHER2
+ 	select CRYPTO_WORKQUEUE
+ 
+ config CRYPTO_HASH
+-	tristate
++	tristate "HASH"
+ 	select CRYPTO_HASH2
+ 	select CRYPTO_ALGAPI
+ 
+@@ -69,7 +69,7 @@ config CRYPTO_HASH2
+ 	select CRYPTO_ALGAPI2
+ 
+ config CRYPTO_RNG
+-	tristate
++	tristate "RNG"
+ 	select CRYPTO_RNG2
+ 	select CRYPTO_ALGAPI
+ 
diff --git a/target/linux/generic/patches-3.3/257-wireless_ext_kconfig_hack.patch b/target/linux/generic/patches-3.3/257-wireless_ext_kconfig_hack.patch
new file mode 100644
index 0000000..daac589
--- /dev/null
+++ b/target/linux/generic/patches-3.3/257-wireless_ext_kconfig_hack.patch
@@ -0,0 +1,22 @@
+--- a/net/wireless/Kconfig
++++ b/net/wireless/Kconfig
+@@ -1,5 +1,5 @@
+ config WIRELESS_EXT
+-	bool
++	bool "Wireless extensions"
+ 
+ config WEXT_CORE
+ 	def_bool y
+@@ -11,10 +11,10 @@ config WEXT_PROC
+ 	depends on WEXT_CORE
+ 
+ config WEXT_SPY
+-	bool
++	bool "WEXT_SPY"
+ 
+ config WEXT_PRIV
+-	bool
++	bool "WEXT_PRIV"
+ 
+ config CFG80211
+ 	tristate "cfg80211 - wireless configuration API"
diff --git a/target/linux/generic/patches-3.3/258-netfilter_netlink_kconfig_hack.patch b/target/linux/generic/patches-3.3/258-netfilter_netlink_kconfig_hack.patch
new file mode 100644
index 0000000..9d827c2
--- /dev/null
+++ b/target/linux/generic/patches-3.3/258-netfilter_netlink_kconfig_hack.patch
@@ -0,0 +1,11 @@
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -2,7 +2,7 @@ menu "Core Netfilter Configuration"
+ 	depends on NET && INET && NETFILTER
+ 
+ config NETFILTER_NETLINK
+-	tristate
++	tristate "Netfilter NFNETLINK interface"
+ 
+ config NETFILTER_NETLINK_ACCT
+ tristate "Netfilter NFACCT over NFNETLINK interface"
diff --git a/target/linux/generic/patches-3.3/260-move_bcm963xx_tag.patch b/target/linux/generic/patches-3.3/260-move_bcm963xx_tag.patch
new file mode 100644
index 0000000..b281326
--- /dev/null
+++ b/target/linux/generic/patches-3.3/260-move_bcm963xx_tag.patch
@@ -0,0 +1,219 @@
+--- a/arch/mips/include/asm/mach-bcm63xx/bcm963xx_tag.h
++++ /dev/null
+@@ -1,96 +0,0 @@
+-#ifndef __BCM963XX_TAG_H
+-#define __BCM963XX_TAG_H
+-
+-#define TAGVER_LEN		4	/* Length of Tag Version */
+-#define TAGLAYOUT_LEN		4	/* Length of FlashLayoutVer */
+-#define SIG1_LEN		20	/* Company Signature 1 Length */
+-#define SIG2_LEN		14	/* Company Signature 2 Length */
+-#define BOARDID_LEN		16	/* Length of BoardId */
+-#define ENDIANFLAG_LEN		2	/* Endian Flag Length */
+-#define CHIPID_LEN		6	/* Chip Id Length */
+-#define IMAGE_LEN		10	/* Length of Length Field */
+-#define ADDRESS_LEN		12	/* Length of Address field */
+-#define DUALFLAG_LEN		2	/* Dual Image flag Length */
+-#define INACTIVEFLAG_LEN	2	/* Inactie Flag Length */
+-#define RSASIG_LEN		20	/* Length of RSA Signature in tag */
+-#define TAGINFO1_LEN		30	/* Length of vendor information field1 in tag */
+-#define FLASHLAYOUTVER_LEN	4	/* Length of Flash Layout Version String tag */
+-#define TAGINFO2_LEN		16	/* Length of vendor information field2 in tag */
+-#define ALTTAGINFO_LEN		54	/* Alternate length for vendor information; Pirelli */
+-
+-#define NUM_PIRELLI		2
+-#define IMAGETAG_CRC_START	0xFFFFFFFF
+-
+-#define PIRELLI_BOARDS { \
+-	"AGPF-S0", \
+-	"DWV-S0", \
+-}
+-
+-/*
+- * The broadcom firmware assumes the rootfs starts the image,
+- * therefore uses the rootfs start (flash_image_address)
+- * to determine where to flash the image.  Since we have the kernel first
+- * we have to give it the kernel address, but the crc uses the length
+- * associated with this address (root_length), which is added to the kernel
+- * length (kernel_length) to determine the length of image to flash and thus
+- * needs to be rootfs + deadcode (jffs2 EOF marker)
+-*/
+-
+-struct bcm_tag {
+-	/* 0-3: Version of the image tag */
+-	char tag_version[TAGVER_LEN];
+-	/* 4-23: Company Line 1 */
+-	char sig_1[SIG1_LEN];
+-	/*  24-37: Company Line 2 */
+-	char sig_2[SIG2_LEN];
+-	/* 38-43: Chip this image is for */
+-	char chip_id[CHIPID_LEN];
+-	/* 44-59: Board name */
+-	char board_id[BOARDID_LEN];
+-	/* 60-61: Map endianness -- 1 BE 0 LE */
+-	char big_endian[ENDIANFLAG_LEN];
+-	/* 62-71: Total length of image */
+-	char total_length[IMAGE_LEN];
+-	/* 72-83: Address in memory of CFE */
+-	char cfe__address[ADDRESS_LEN];
+-	/* 84-93: Size of CFE */
+-	char cfe_length[IMAGE_LEN];
+-	/* 94-105: Address in memory of image start
+-	 * (kernel for OpenWRT, rootfs for stock firmware)
+-	 */
+-	char flash_image_start[ADDRESS_LEN];
+-	/* 106-115: Size of rootfs */
+-	char root_length[IMAGE_LEN];
+-	/* 116-127: Address in memory of kernel */
+-	char kernel_address[ADDRESS_LEN];
+-	/* 128-137: Size of kernel */
+-	char kernel_length[IMAGE_LEN];
+-	/* 138-139: Unused at the moment */
+-	char dual_image[DUALFLAG_LEN];
+-	/* 140-141: Unused at the moment */
+-	char inactive_flag[INACTIVEFLAG_LEN];
+-	/* 142-161: RSA Signature (not used; some vendors may use this) */
+-	char rsa_signature[RSASIG_LEN];
+-	/* 162-191: Compilation and related information (not used in OpenWrt) */
+-	char information1[TAGINFO1_LEN];
+-	/* 192-195: Version flash layout */
+-	char flash_layout_ver[FLASHLAYOUTVER_LEN];
+-	/* 196-199: kernel+rootfs CRC32 */
+-	__u32 fskernel_crc;
+-	/* 200-215: Unused except on Alice Gate where is is information */
+-	char information2[TAGINFO2_LEN];
+-	/* 216-219: CRC32 of image less imagetag (kernel for Alice Gate) */
+-	__u32 image_crc;
+-	/* 220-223: CRC32 of rootfs partition */
+-	__u32 rootfs_crc;
+-	/* 224-227: CRC32 of kernel partition */
+-	__u32 kernel_crc;
+-	/* 228-235: Unused at present */
+-	char reserved1[8];
+-	/* 236-239: CRC32 of header excluding last 20 bytes */
+-	__u32 header_crc;
+-	/* 240-255: Unused at present */
+-	char reserved2[16];
+-};
+-
+-#endif /* __BCM63XX_TAG_H */
+--- a/drivers/mtd/bcm63xxpart.c
++++ b/drivers/mtd/bcm63xxpart.c
+@@ -32,7 +32,7 @@
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
+ 
+-#include <asm/mach-bcm63xx/bcm963xx_tag.h>
++#include <linux/bcm963xx_tag.h>
+ #include <asm/mach-bcm63xx/board_bcm963xx.h>
+ 
+ #define BCM63XX_EXTENDED_SIZE	0xBFC00000	/* Extended flash address */
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -77,6 +77,7 @@ header-y += blk_types.h
+ header-y += blkpg.h
+ header-y += blktrace_api.h
+ header-y += bpqether.h
++header-y += bcm963xx_tag.h
+ header-y += bsg.h
+ header-y += can.h
+ header-y += capability.h
+--- /dev/null
++++ b/include/linux/bcm963xx_tag.h
+@@ -0,0 +1,96 @@
++#ifndef __BCM963XX_TAG_H
++#define __BCM963XX_TAG_H
++
++#define TAGVER_LEN		4	/* Length of Tag Version */
++#define TAGLAYOUT_LEN		4	/* Length of FlashLayoutVer */
++#define SIG1_LEN		20	/* Company Signature 1 Length */
++#define SIG2_LEN		14	/* Company Signature 2 Length */
++#define BOARDID_LEN		16	/* Length of BoardId */
++#define ENDIANFLAG_LEN		2	/* Endian Flag Length */
++#define CHIPID_LEN		6	/* Chip Id Length */
++#define IMAGE_LEN		10	/* Length of Length Field */
++#define ADDRESS_LEN		12	/* Length of Address field */
++#define DUALFLAG_LEN		2	/* Dual Image flag Length */
++#define INACTIVEFLAG_LEN	2	/* Inactie Flag Length */
++#define RSASIG_LEN		20	/* Length of RSA Signature in tag */
++#define TAGINFO1_LEN		30	/* Length of vendor information field1 in tag */
++#define FLASHLAYOUTVER_LEN	4	/* Length of Flash Layout Version String tag */
++#define TAGINFO2_LEN		16	/* Length of vendor information field2 in tag */
++#define ALTTAGINFO_LEN		54	/* Alternate length for vendor information; Pirelli */
++
++#define NUM_PIRELLI		2
++#define IMAGETAG_CRC_START	0xFFFFFFFF
++
++#define PIRELLI_BOARDS { \
++	"AGPF-S0", \
++	"DWV-S0", \
++}
++
++/*
++ * The broadcom firmware assumes the rootfs starts the image,
++ * therefore uses the rootfs start (flash_image_address)
++ * to determine where to flash the image.  Since we have the kernel first
++ * we have to give it the kernel address, but the crc uses the length
++ * associated with this address (root_length), which is added to the kernel
++ * length (kernel_length) to determine the length of image to flash and thus
++ * needs to be rootfs + deadcode (jffs2 EOF marker)
++*/
++
++struct bcm_tag {
++	/* 0-3: Version of the image tag */
++	char tag_version[TAGVER_LEN];
++	/* 4-23: Company Line 1 */
++	char sig_1[SIG1_LEN];
++	/*  24-37: Company Line 2 */
++	char sig_2[SIG2_LEN];
++	/* 38-43: Chip this image is for */
++	char chip_id[CHIPID_LEN];
++	/* 44-59: Board name */
++	char board_id[BOARDID_LEN];
++	/* 60-61: Map endianness -- 1 BE 0 LE */
++	char big_endian[ENDIANFLAG_LEN];
++	/* 62-71: Total length of image */
++	char total_length[IMAGE_LEN];
++	/* 72-83: Address in memory of CFE */
++	char cfe__address[ADDRESS_LEN];
++	/* 84-93: Size of CFE */
++	char cfe_length[IMAGE_LEN];
++	/* 94-105: Address in memory of image start
++	 * (kernel for OpenWRT, rootfs for stock firmware)
++	 */
++	char flash_image_start[ADDRESS_LEN];
++	/* 106-115: Size of rootfs */
++	char root_length[IMAGE_LEN];
++	/* 116-127: Address in memory of kernel */
++	char kernel_address[ADDRESS_LEN];
++	/* 128-137: Size of kernel */
++	char kernel_length[IMAGE_LEN];
++	/* 138-139: Unused at the moment */
++	char dual_image[DUALFLAG_LEN];
++	/* 140-141: Unused at the moment */
++	char inactive_flag[INACTIVEFLAG_LEN];
++	/* 142-161: RSA Signature (not used; some vendors may use this) */
++	char rsa_signature[RSASIG_LEN];
++	/* 162-191: Compilation and related information (not used in OpenWrt) */
++	char information1[TAGINFO1_LEN];
++	/* 192-195: Version flash layout */
++	char flash_layout_ver[FLASHLAYOUTVER_LEN];
++	/* 196-199: kernel+rootfs CRC32 */
++	__u32 fskernel_crc;
++	/* 200-215: Unused except on Alice Gate where is is information */
++	char information2[TAGINFO2_LEN];
++	/* 216-219: CRC32 of image less imagetag (kernel for Alice Gate) */
++	__u32 image_crc;
++	/* 220-223: CRC32 of rootfs partition */
++	__u32 rootfs_crc;
++	/* 224-227: CRC32 of kernel partition */
++	__u32 kernel_crc;
++	/* 228-235: Unused at present */
++	char reserved1[8];
++	/* 236-239: CRC32 of header excluding last 20 bytes */
++	__u32 header_crc;
++	/* 240-255: Unused at present */
++	char reserved2[16];
++};
++
++#endif /* __BCM63XX_TAG_H */
diff --git a/target/linux/generic/patches-3.3/270-regmap_dynamic.patch b/target/linux/generic/patches-3.3/270-regmap_dynamic.patch
new file mode 100644
index 0000000..d6c32b4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/270-regmap_dynamic.patch
@@ -0,0 +1,38 @@
+--- a/drivers/base/regmap/Kconfig
++++ b/drivers/base/regmap/Kconfig
+@@ -3,16 +3,17 @@
+ # subsystems should select the appropriate symbols.
+ 
+ config REGMAP
+-	default y if (REGMAP_I2C || REGMAP_SPI)
+ 	select LZO_COMPRESS
+ 	select LZO_DECOMPRESS
+-	bool
++	tristate "Regmap"
+ 
+ config REGMAP_I2C
+-	tristate
++	select REGMAP
++	tristate "Regmap I2C"
+ 
+ config REGMAP_SPI
+-	tristate
++	select REGMAP
++	tristate "Regmap SPI"
+ 
+ config REGMAP_IRQ
+ 	bool
+--- a/drivers/base/regmap/Makefile
++++ b/drivers/base/regmap/Makefile
+@@ -1,6 +1,8 @@
+-obj-$(CONFIG_REGMAP) += regmap.o regcache.o
+-obj-$(CONFIG_REGMAP) += regcache-rbtree.o regcache-lzo.o
+-obj-$(CONFIG_DEBUG_FS) += regmap-debugfs.o
++regmap-core-objs = regmap.o regcache.o regcache-rbtree.o regcache-lzo.o
++ifdef CONFIG_DEBUG_FS
++regmap-core-objs += regmap-debugfs.o
++endif
++obj-$(CONFIG_REGMAP) += regmap-core.o
+ obj-$(CONFIG_REGMAP_I2C) += regmap-i2c.o
+ obj-$(CONFIG_REGMAP_SPI) += regmap-spi.o
+ obj-$(CONFIG_REGMAP_IRQ) += regmap-irq.o
diff --git a/target/linux/generic/patches-3.3/300-mips_expose_boot_raw.patch b/target/linux/generic/patches-3.3/300-mips_expose_boot_raw.patch
new file mode 100644
index 0000000..b114ef4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/300-mips_expose_boot_raw.patch
@@ -0,0 +1,39 @@
+From: Mark Miller <mark@mirell.org>
+
+This exposes the CONFIG_BOOT_RAW symbol in Kconfig. This is needed on
+certain Broadcom chipsets running CFE in order to load the kernel.
+
+Signed-off-by: Mark Miller <mark@mirell.org>
+Acked-by: Rob Landley <rob@landley.net>
+---
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -877,9 +877,6 @@ config ARC
+ config ARCH_MAY_HAVE_PC_FDC
+ 	bool
+ 
+-config BOOT_RAW
+-	bool
+-
+ config CEVT_BCM1480
+ 	bool
+ 
+@@ -2330,6 +2327,18 @@ config USE_OF
+ 	help
+ 	  Include support for flattened device tree machine descriptions.
+ 
++config BOOT_RAW
++	bool "Enable the kernel to be executed from the load address"
++	default n
++	help
++	 Allow the kernel to be executed from the load address for
++	 bootloaders which cannot read the ELF format. This places
++	 a jump to start_kernel at the load address.
++
++	 If unsure, say N.
++
++
++
+ endmenu
+ 
+ config LOCKDEP_SUPPORT
diff --git a/target/linux/generic/patches-3.3/301-mips_image_cmdline_hack.patch b/target/linux/generic/patches-3.3/301-mips_image_cmdline_hack.patch
new file mode 100644
index 0000000..9193c68
--- /dev/null
+++ b/target/linux/generic/patches-3.3/301-mips_image_cmdline_hack.patch
@@ -0,0 +1,28 @@
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -976,6 +976,10 @@ config SYNC_R4K
+ config MIPS_MACHINE
+ 	def_bool n
+ 
++config IMAGE_CMDLINE_HACK
++	bool "OpenWrt specific image command line hack"
++	default n
++
+ config NO_IOPORT
+ 	def_bool n
+ 
+--- a/arch/mips/kernel/head.S
++++ b/arch/mips/kernel/head.S
+@@ -141,6 +141,12 @@ FEXPORT(__kernel_entry)
+ 	j	kernel_entry
+ #endif
+ 
++#ifdef CONFIG_IMAGE_CMDLINE_HACK
++	.ascii	"CMDLINE:"
++EXPORT(__image_cmdline)
++	.fill	0x400
++#endif /* CONFIG_IMAGE_CMDLINE_HACK */
++
+ 	__REF
+ 
+ NESTED(kernel_entry, 16, sp)			# kernel entry point
diff --git a/target/linux/generic/patches-3.3/302-mips_use_generic_thread_info_allocator.patch b/target/linux/generic/patches-3.3/302-mips_use_generic_thread_info_allocator.patch
new file mode 100644
index 0000000..1bcc74b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/302-mips_use_generic_thread_info_allocator.patch
@@ -0,0 +1,18 @@
+--- a/arch/mips/include/asm/thread_info.h
++++ b/arch/mips/include/asm/thread_info.h
+@@ -85,6 +85,7 @@ register struct thread_info *__current_t
+ 
+ #define STACK_WARN	(THREAD_SIZE / 8)
+ 
++#if 0
+ #define __HAVE_ARCH_THREAD_INFO_ALLOCATOR
+ 
+ #ifdef CONFIG_DEBUG_STACK_USAGE
+@@ -96,6 +97,7 @@ register struct thread_info *__current_t
+ #endif
+ 
+ #define free_thread_info(info) kfree(info)
++#endif
+ 
+ #endif /* !__ASSEMBLY__ */
+ 
diff --git a/target/linux/generic/patches-3.3/303-mips_fix_kexec.patch b/target/linux/generic/patches-3.3/303-mips_fix_kexec.patch
new file mode 100644
index 0000000..e6928dd
--- /dev/null
+++ b/target/linux/generic/patches-3.3/303-mips_fix_kexec.patch
@@ -0,0 +1,11 @@
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -52,7 +52,7 @@ machine_kexec(struct kimage *image)
+ 	reboot_code_buffer =
+ 	  (unsigned long)page_address(image->control_code_page);
+ 
+-	kexec_start_address = image->start;
++	kexec_start_address = (unsigned long) phys_to_virt(image->start);
+ 	kexec_indirection_page =
+ 		(unsigned long) phys_to_virt(image->head & PAGE_MASK);
+ 
diff --git a/target/linux/generic/patches-3.3/304-mips_disable_fpu.patch b/target/linux/generic/patches-3.3/304-mips_disable_fpu.patch
new file mode 100644
index 0000000..e747fea
--- /dev/null
+++ b/target/linux/generic/patches-3.3/304-mips_disable_fpu.patch
@@ -0,0 +1,160 @@
+MIPS: allow disabling the kernel FPU emulator
+
+This patch allows turning off the in-kernel Algorithmics
+FPU emulator support, which allows one to save a couple of
+precious blocks on an embedded system.
+
+Signed-off-by: Florian Fainelli <florian@openwrt.org>
+--
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -961,6 +961,17 @@ config I8259
+ config MIPS_BONITO64
+ 	bool
+ 
++config MIPS_FPU_EMU
++	bool "Enable FPU emulation"
++	default y
++	help
++	   This option allows building a kernel with or without the Algorithmics
++	   FPU emulator enabled. Turning off this option results in a kernel which
++	   does not catch floating operations exceptions. Make sure that your toolchain
++	   is configured to enable software floating point emulation in that case.
++		
++	   If unsure say Y here.
++
+ config MIPS_MSC
+ 	bool
+ 
+--- a/arch/mips/math-emu/Makefile
++++ b/arch/mips/math-emu/Makefile
+@@ -2,11 +2,13 @@
+ # Makefile for the Linux/MIPS kernel FPU emulation.
+ #
+ 
+-obj-y	:= cp1emu.o ieee754m.o ieee754d.o ieee754dp.o ieee754sp.o ieee754.o \
++obj-y	:=	kernel_linkage.o dsemul.o cp1emu.o
++
++obj-$(CONFIG_MIPS_FPU_EMU)	+= ieee754m.o ieee754d.o ieee754dp.o ieee754sp.o ieee754.o \
+ 	   ieee754xcpt.o dp_frexp.o dp_modf.o dp_div.o dp_mul.o dp_sub.o \
+ 	   dp_add.o dp_fsp.o dp_cmp.o dp_logb.o dp_scalb.o dp_simple.o \
+ 	   dp_tint.o dp_fint.o dp_tlong.o dp_flong.o sp_frexp.o sp_modf.o \
+ 	   sp_div.o sp_mul.o sp_sub.o sp_add.o sp_fdp.o sp_cmp.o sp_logb.o \
+ 	   sp_scalb.o sp_simple.o sp_tint.o sp_fint.o sp_tlong.o sp_flong.o \
+-	   dp_sqrt.o sp_sqrt.o kernel_linkage.o dsemul.o
++	   dp_sqrt.o sp_sqrt.o
+ 
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -58,7 +58,11 @@
+ #define __mips 4
+ 
+ /* Function which emulates a floating point instruction. */
++#ifdef CONFIG_DEBUG_FS
++DEFINE_PER_CPU(struct mips_fpu_emulator_stats, fpuemustats);
++#endif
+ 
++#ifdef CONFIG_MIPS_FPU_EMU
+ static int fpu_emu(struct pt_regs *, struct mips_fpu_struct *,
+ 	mips_instruction);
+ 
+@@ -69,10 +73,6 @@ static int fpux_emu(struct pt_regs *,
+ 
+ /* Further private data for which no space exists in mips_fpu_struct */
+ 
+-#ifdef CONFIG_DEBUG_FS
+-DEFINE_PER_CPU(struct mips_fpu_emulator_stats, fpuemustats);
+-#endif
+-
+ /* Control registers */
+ 
+ #define FPCREG_RID	0	/* $0  = revision id */
+@@ -1360,7 +1360,6 @@ int fpu_emulator_cop1Handler(struct pt_r
+ 
+ 	return sig;
+ }
+-
+ #ifdef CONFIG_DEBUG_FS
+ 
+ static int fpuemu_stat_get(void *data, u64 *val)
+@@ -1409,4 +1408,11 @@ static int __init debugfs_fpuemu(void)
+ 	return 0;
+ }
+ __initcall(debugfs_fpuemu);
+-#endif
++#endif /* CONFIG_DEBUGFS */
++#else
++int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
++        int has_fpu)
++{
++	return 0;
++}
++#endif /* CONFIG_MIPS_FPU_EMU */
+--- a/arch/mips/math-emu/dsemul.c
++++ b/arch/mips/math-emu/dsemul.c
+@@ -109,6 +109,7 @@ int mips_dsemul(struct pt_regs *regs, mi
+ 	return SIGILL;		/* force out of emulation loop */
+ }
+ 
++#ifdef CONFIG_MIPS_FPU_EMU
+ int do_dsemulret(struct pt_regs *xcp)
+ {
+ 	struct emuframe __user *fr;
+@@ -165,3 +166,9 @@ int do_dsemulret(struct pt_regs *xcp)
+ 
+ 	return 1;
+ }
++#else
++int do_dsemulret(struct pt_regs *xcp)
++{
++	return 0;
++}
++#endif /* CONFIG_MIPS_FPU_EMU */
+--- a/arch/mips/math-emu/kernel_linkage.c
++++ b/arch/mips/math-emu/kernel_linkage.c
+@@ -29,6 +29,7 @@
+ 
+ #define SIGNALLING_NAN 0x7ff800007ff80000LL
+ 
++#ifdef CONFIG_MIPS_FPU_EMU
+ void fpu_emulator_init_fpu(void)
+ {
+ 	static int first = 1;
+@@ -112,4 +113,36 @@ int fpu_emulator_restore_context32(struc
+ 
+ 	return err;
+ }
+-#endif
++#endif	/* CONFIG_64BIT */
++#else
++
++void fpu_emulator_init_fpu(void)
++{
++	printk(KERN_INFO "FPU emulator disabled, make sure your toolchain"
++		"was compiled with software floating point support (soft-float)\n");
++	return;
++}
++
++int fpu_emulator_save_context(struct sigcontext __user *sc)
++{
++	return 0;
++}
++
++int fpu_emulator_restore_context(struct sigcontext __user *sc)
++{
++	return 0;
++}
++
++int fpu_emulator_save_context32(struct sigcontext32 __user *sc)
++{
++	return 0;
++}
++
++int fpu_emulator_restore_context32(struct sigcontext32 __user *sc)
++{
++	return 0;
++}
++
++#ifdef CONFIG_64BIT
++#endif	/* CONFIG_64BIT */
++#endif /* CONFIG_MIPS_FPU_EMU */
diff --git a/target/linux/generic/patches-3.3/305-mips_module_reloc.patch b/target/linux/generic/patches-3.3/305-mips_module_reloc.patch
new file mode 100644
index 0000000..b4b142c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/305-mips_module_reloc.patch
@@ -0,0 +1,371 @@
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -90,8 +90,8 @@ all-$(CONFIG_SYS_SUPPORTS_ZBOOT)+= vmlin
+ cflags-y			+= -G 0 -mno-abicalls -fno-pic -pipe
+ cflags-y			+= -msoft-float
+ LDFLAGS_vmlinux			+= -G 0 -static -n -nostdlib
+-KBUILD_AFLAGS_MODULE		+= -mlong-calls
+-KBUILD_CFLAGS_MODULE		+= -mlong-calls
++KBUILD_AFLAGS_MODULE		+= -mno-long-calls
++KBUILD_CFLAGS_MODULE		+= -mno-long-calls
+ 
+ cflags-y += -ffreestanding
+ 
+--- a/arch/mips/include/asm/module.h
++++ b/arch/mips/include/asm/module.h
+@@ -9,6 +9,11 @@ struct mod_arch_specific {
+ 	struct list_head dbe_list;
+ 	const struct exception_table_entry *dbe_start;
+ 	const struct exception_table_entry *dbe_end;
++
++	void *phys_plt_tbl;
++	void *virt_plt_tbl;
++	unsigned int phys_plt_offset;
++	unsigned int virt_plt_offset;
+ };
+ 
+ typedef uint8_t Elf64_Byte;		/* Type for a 8-bit quantity.  */
+--- a/arch/mips/kernel/module.c
++++ b/arch/mips/kernel/module.c
+@@ -44,14 +44,219 @@ static struct mips_hi16 *mips_hi16_list;
+ static LIST_HEAD(dbe_list);
+ static DEFINE_SPINLOCK(dbe_lock);
+ 
+-#ifdef MODULE_START
++/*
++ * Get the potential max trampolines size required of the init and
++ * non-init sections. Only used if we cannot find enough contiguous
++ * physically mapped memory to put the module into.
++ */
++static unsigned int
++get_plt_size(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
++             const char *secstrings, unsigned int symindex, bool is_init)
++{
++	unsigned long ret = 0;
++	unsigned int i, j;
++	Elf_Sym *syms;
++
++	/* Everything marked ALLOC (this includes the exported symbols) */
++	for (i = 1; i < hdr->e_shnum; ++i) {
++		unsigned int info = sechdrs[i].sh_info;
++
++		if (sechdrs[i].sh_type != SHT_REL
++		    && sechdrs[i].sh_type != SHT_RELA)
++			continue;
++
++		/* Not a valid relocation section? */
++		if (info >= hdr->e_shnum)
++			continue;
++
++		/* Don't bother with non-allocated sections */
++		if (!(sechdrs[info].sh_flags & SHF_ALLOC))
++			continue;
++
++		/* If it's called *.init*, and we're not init, we're
++                   not interested */
++		if ((strstr(secstrings + sechdrs[i].sh_name, ".init") != 0)
++		    != is_init)
++			continue;
++
++		syms = (Elf_Sym *) sechdrs[symindex].sh_addr;
++		if (sechdrs[i].sh_type == SHT_REL) {
++			Elf_Mips_Rel *rel = (void *) sechdrs[i].sh_addr;
++			unsigned int size = sechdrs[i].sh_size / sizeof(*rel);
++
++			for (j = 0; j < size; ++j) {
++				Elf_Sym *sym;
++
++				if (ELF_MIPS_R_TYPE(rel[j]) != R_MIPS_26)
++					continue;
++
++				sym = syms + ELF_MIPS_R_SYM(rel[j]);
++				if (!is_init && sym->st_shndx != SHN_UNDEF)
++					continue;
++
++				ret += 4 * sizeof(int);
++			}
++		} else {
++			Elf_Mips_Rela *rela = (void *) sechdrs[i].sh_addr;
++			unsigned int size = sechdrs[i].sh_size / sizeof(*rela);
++
++			for (j = 0; j < size; ++j) {
++				Elf_Sym *sym;
++
++				if (ELF_MIPS_R_TYPE(rela[j]) != R_MIPS_26)
++					continue;
++
++				sym = syms + ELF_MIPS_R_SYM(rela[j]);
++				if (!is_init && sym->st_shndx != SHN_UNDEF)
++					continue;
++
++				ret += 4 * sizeof(int);
++			}
++		}
++	}
++
++	return ret;
++}
++
++#ifndef MODULE_START
++static void *alloc_phys(unsigned long size)
++{
++	unsigned order;
++	struct page *page;
++	struct page *p;
++
++	size = PAGE_ALIGN(size);
++	order = get_order(size);
++
++	page = alloc_pages(GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN |
++			__GFP_THISNODE, order);
++	if (!page)
++		return NULL;
++
++	split_page(page, order);
++
++	for (p = page + (size >> PAGE_SHIFT); p < page + (1 << order); ++p)
++		__free_page(p);
++
++	return page_address(page);
++}
++#endif
++
++static void free_phys(void *ptr, unsigned long size)
++{
++	struct page *page;
++	struct page *end;
++
++	page = virt_to_page(ptr);
++	end = page + (PAGE_ALIGN(size) >> PAGE_SHIFT);
++
++	for (; page < end; ++page)
++		__free_page(page);
++}
++
++
+ void *module_alloc(unsigned long size)
+ {
++#ifdef MODULE_START
+ 	return __vmalloc_node_range(size, 1, MODULE_START, MODULE_END,
+ 				GFP_KERNEL, PAGE_KERNEL, -1,
+ 				__builtin_return_address(0));
++#else
++	void *ptr;
++
++	if (size == 0)
++		return NULL;
++
++	ptr = alloc_phys(size);
++
++	/* If we failed to allocate physically contiguous memory,
++	 * fall back to regular vmalloc. The module loader code will
++	 * create jump tables to handle long jumps */
++	if (!ptr)
++		return vmalloc(size);
++
++	return ptr;
++#endif
+ }
++
++static inline bool is_phys_addr(void *ptr)
++{
++#ifdef CONFIG_64BIT
++	return (KSEGX((unsigned long)ptr) == CKSEG0);
++#else
++	return (KSEGX(ptr) == KSEG0);
+ #endif
++}
++
++/* Free memory returned from module_alloc */
++void module_free(struct module *mod, void *module_region)
++{
++	if (is_phys_addr(module_region)) {
++		if (mod->module_init == module_region)
++			free_phys(module_region, mod->init_size);
++		else if (mod->module_core == module_region)
++			free_phys(module_region, mod->core_size);
++		else
++			BUG();
++	} else {
++		vfree(module_region);
++	}
++}
++
++static void *__module_alloc(int size, bool phys)
++{
++	void *ptr;
++
++	if (phys)
++		ptr = kmalloc(size, GFP_KERNEL);
++	else
++		ptr = vmalloc(size);
++	return ptr;
++}
++
++static void __module_free(void *ptr)
++{
++	if (is_phys_addr(ptr))
++		kfree(ptr);
++	else
++		vfree(ptr);
++}
++
++int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
++			      char *secstrings, struct module *mod)
++{
++	unsigned int symindex = 0;
++	unsigned int core_size, init_size;
++	int i;
++
++	for (i = 1; i < hdr->e_shnum; i++)
++		if (sechdrs[i].sh_type == SHT_SYMTAB)
++			symindex = i;
++
++	core_size = get_plt_size(hdr, sechdrs, secstrings, symindex, false);
++	init_size = get_plt_size(hdr, sechdrs, secstrings, symindex, true);
++
++	mod->arch.phys_plt_offset = 0;
++	mod->arch.virt_plt_offset = 0;
++	mod->arch.phys_plt_tbl = NULL;
++	mod->arch.virt_plt_tbl = NULL;
++
++	if ((core_size + init_size) == 0)
++		return 0;
++
++	mod->arch.phys_plt_tbl = __module_alloc(core_size + init_size, 1);
++	if (!mod->arch.phys_plt_tbl)
++		return -ENOMEM;
++
++	mod->arch.virt_plt_tbl = __module_alloc(core_size + init_size, 0);
++	if (!mod->arch.virt_plt_tbl) {
++		__module_free(mod->arch.phys_plt_tbl);
++		mod->arch.phys_plt_tbl = NULL;
++		return -ENOMEM;
++	}
++
++	return 0;
++}
+ 
+ static int apply_r_mips_none(struct module *me, u32 *location, Elf_Addr v)
+ {
+@@ -72,28 +277,36 @@ static int apply_r_mips_32_rela(struct m
+ 	return 0;
+ }
+ 
+-static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
++static Elf_Addr add_plt_entry_to(unsigned *plt_offset,
++				 void *start, Elf_Addr v)
+ {
+-	if (v % 4) {
+-		pr_err("module %s: dangerous R_MIPS_26 REL relocation\n",
+-		       me->name);
+-		return -ENOEXEC;
+-	}
++	unsigned *tramp = start + *plt_offset;
++	*plt_offset += 4 * sizeof(int);
+ 
+-	if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
+-		printk(KERN_ERR
+-		       "module %s: relocation overflow\n",
+-		       me->name);
+-		return -ENOEXEC;
+-	}
++	/* adjust carry for addiu */
++	if (v & 0x00008000)
++		v += 0x10000;
+ 
+-	*location = (*location & ~0x03ffffff) |
+-	            ((*location + (v >> 2)) & 0x03ffffff);
++	tramp[0] = 0x3c190000 | (v >> 16);      /* lui t9, hi16 */
++	tramp[1] = 0x27390000 | (v & 0xffff);   /* addiu t9, t9, lo16 */
++	tramp[2] = 0x03200008;                  /* jr t9 */
++	tramp[3] = 0x00000000;                  /* nop */
+ 
+-	return 0;
++	return (Elf_Addr) tramp;
+ }
+ 
+-static int apply_r_mips_26_rela(struct module *me, u32 *location, Elf_Addr v)
++static Elf_Addr add_plt_entry(struct module *me, void *location, Elf_Addr v)
++{
++	if (is_phys_addr(location))
++		return add_plt_entry_to(&me->arch.phys_plt_offset,
++				me->arch.phys_plt_tbl, v);
++	else
++		return add_plt_entry_to(&me->arch.virt_plt_offset,
++				me->arch.virt_plt_tbl, v);
++
++}
++
++static int set_r_mips_26(struct module *me, u32 *location, u32 ofs, Elf_Addr v)
+ {
+ 	if (v % 4) {
+ 		pr_err("module %s: dangerous R_MIPS_26 RELArelocation\n",
+@@ -102,17 +315,31 @@ static int apply_r_mips_26_rela(struct m
+ 	}
+ 
+ 	if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
+-		printk(KERN_ERR
++	    v = add_plt_entry(me, location, v + (ofs << 2));
++		if (!v) {
++			printk(KERN_ERR
+ 		       "module %s: relocation overflow\n",
+ 		       me->name);
+-		return -ENOEXEC;
++			return -ENOEXEC;
++		}
++		ofs = 0;
+ 	}
+ 
+-	*location = (*location & ~0x03ffffff) | ((v >> 2) & 0x03ffffff);
++	*location = (*location & ~0x03ffffff) | ((ofs + (v >> 2)) & 0x03ffffff);
+ 
+ 	return 0;
+ }
+ 
++static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
++{
++	return set_r_mips_26(me, location, *location & 0x03ffffff, v);
++}
++
++static int apply_r_mips_26_rela(struct module *me, u32 *location, Elf_Addr v)
++{
++	return set_r_mips_26(me, location, 0, v);
++}
++
+ static int apply_r_mips_hi16_rel(struct module *me, u32 *location, Elf_Addr v)
+ {
+ 	struct mips_hi16 *n;
+@@ -380,11 +607,32 @@ int module_finalize(const Elf_Ehdr *hdr,
+ 		list_add(&me->arch.dbe_list, &dbe_list);
+ 		spin_unlock_irq(&dbe_lock);
+ 	}
++
++	/* Get rid of the fixup trampoline if we're running the module
++	 * from physically mapped address space */
++	if (me->arch.phys_plt_offset == 0) {
++		__module_free(me->arch.phys_plt_tbl);
++		me->arch.phys_plt_tbl = NULL;
++	}
++	if (me->arch.virt_plt_offset == 0) {
++		__module_free(me->arch.virt_plt_tbl);
++		me->arch.virt_plt_tbl = NULL;
++	}
++
+ 	return 0;
+ }
+ 
+ void module_arch_cleanup(struct module *mod)
+ {
++	if (mod->arch.phys_plt_tbl) {
++		__module_free(mod->arch.phys_plt_tbl);
++		mod->arch.phys_plt_tbl = NULL;
++	}
++	if (mod->arch.virt_plt_tbl) {
++		__module_free(mod->arch.virt_plt_tbl);
++		mod->arch.virt_plt_tbl = NULL;
++	}
++
+ 	spin_lock_irq(&dbe_lock);
+ 	list_del(&mod->arch.dbe_list);
+ 	spin_unlock_irq(&dbe_lock);
diff --git a/target/linux/generic/patches-3.3/306-mips_mem_functions_performance.patch b/target/linux/generic/patches-3.3/306-mips_mem_functions_performance.patch
new file mode 100644
index 0000000..e432471
--- /dev/null
+++ b/target/linux/generic/patches-3.3/306-mips_mem_functions_performance.patch
@@ -0,0 +1,83 @@
+--- a/arch/mips/include/asm/string.h
++++ b/arch/mips/include/asm/string.h
+@@ -133,11 +133,44 @@ strncmp(__const__ char *__cs, __const__
+ 
+ #define __HAVE_ARCH_MEMSET
+ extern void *memset(void *__s, int __c, size_t __count);
++#define memset(__s, __c, len)					\
++({								\
++	size_t __len = (len);					\
++	void *__ret;						\
++	if (__builtin_constant_p(len) && __len >= 64)		\
++		__ret = memset((__s), (__c), __len);		\
++	else							\
++		__ret = __builtin_memset((__s), (__c), __len);	\
++	__ret;							\
++})
+ 
+ #define __HAVE_ARCH_MEMCPY
+ extern void *memcpy(void *__to, __const__ void *__from, size_t __n);
++#define memcpy(dst, src, len)					\
++({								\
++	size_t __len = (len);					\
++	void *__ret;						\
++	if (__builtin_constant_p(len) && __len >= 64)		\
++		__ret = memcpy((dst), (src), __len);		\
++	else							\
++		__ret = __builtin_memcpy((dst), (src), __len);	\
++	__ret;							\
++})
+ 
+ #define __HAVE_ARCH_MEMMOVE
+ extern void *memmove(void *__dest, __const__ void *__src, size_t __n);
++#define memmove(dst, src, len)					\
++({								\
++	size_t __len = (len);					\
++	void *__ret;						\
++	if (__builtin_constant_p(len) && __len >= 64)		\
++		__ret = memmove((dst), (src), __len);		\
++	else							\
++		__ret = __builtin_memmove((dst), (src), __len);	\
++	__ret;							\
++})
++
++#define __HAVE_ARCH_MEMCMP
++#define memcmp(src1, src2, len) __builtin_memcmp((src1), (src2), (len))
+ 
+ #endif /* _ASM_STRING_H */
+--- a/arch/mips/lib/Makefile
++++ b/arch/mips/lib/Makefile
+@@ -3,7 +3,7 @@
+ #
+ 
+ lib-y	+= csum_partial.o delay.o memcpy.o memcpy-inatomic.o memset.o \
+-	   strlen_user.o strncpy_user.o strnlen_user.o uncached.o
++	   strlen_user.o strncpy_user.o strnlen_user.o uncached.o memcmp.o
+ 
+ obj-y			+= iomap.o
+ obj-$(CONFIG_PCI)	+= iomap-pci.o
+--- /dev/null
++++ b/arch/mips/lib/memcmp.c
+@@ -0,0 +1,22 @@
++/*
++ *  copied from linux/lib/string.c
++ *
++ *  Copyright (C) 1991, 1992  Linus Torvalds
++ */
++
++#include <linux/module.h>
++#include <linux/string.h>
++
++#undef memcmp
++int memcmp(const void *cs, const void *ct, size_t count)
++{
++	const unsigned char *su1, *su2;
++	int res = 0;
++
++	for (su1 = cs, su2 = ct; 0 < count; ++su1, ++su2, count--)
++		if ((res = *su1 - *su2) != 0)
++			break;
++	return res;
++}
++EXPORT_SYMBOL(memcmp);
++
diff --git a/target/linux/generic/patches-3.3/307-mips_oprofile_fix.patch b/target/linux/generic/patches-3.3/307-mips_oprofile_fix.patch
new file mode 100644
index 0000000..f83c96b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/307-mips_oprofile_fix.patch
@@ -0,0 +1,35 @@
+--- a/arch/mips/oprofile/op_model_mipsxx.c
++++ b/arch/mips/oprofile/op_model_mipsxx.c
+@@ -298,6 +298,11 @@ static void reset_counters(void *arg)
+ 	}
+ }
+ 
++static irqreturn_t mipsxx_perfcount_int(int irq, void *dev_id)
++{
++	return mipsxx_perfcount_handler();
++}
++
+ static int __init mipsxx_init(void)
+ {
+ 	int counters;
+@@ -374,6 +379,10 @@ static int __init mipsxx_init(void)
+ 	save_perf_irq = perf_irq;
+ 	perf_irq = mipsxx_perfcount_handler;
+ 
++	if (cp0_perfcount_irq >= 0)
++		return request_irq(cp0_perfcount_irq, mipsxx_perfcount_int,
++			IRQF_SHARED, "Perfcounter", save_perf_irq);
++
+ 	return 0;
+ }
+ 
+@@ -381,6 +390,9 @@ static void mipsxx_exit(void)
+ {
+ 	int counters = op_model_mipsxx_ops.num_counters;
+ 
++	if (cp0_perfcount_irq >= 0)
++		free_irq(cp0_perfcount_irq, save_perf_irq);
++
+ 	counters = counters_per_cpu_to_total(counters);
+ 	on_each_cpu(reset_counters, (void *)(long)counters, 1);
+ 
diff --git a/target/linux/generic/patches-3.3/308-mips-show-correct-cpu-name-for-24KEc.patch b/target/linux/generic/patches-3.3/308-mips-show-correct-cpu-name-for-24KEc.patch
new file mode 100644
index 0000000..ac6304a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/308-mips-show-correct-cpu-name-for-24KEc.patch
@@ -0,0 +1,17 @@
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -816,10 +816,13 @@ static inline void cpu_probe_mips(struct
+ 		__cpu_name[cpu] = "MIPS 20Kc";
+ 		break;
+ 	case PRID_IMP_24K:
+-	case PRID_IMP_24KE:
+ 		c->cputype = CPU_24K;
+ 		__cpu_name[cpu] = "MIPS 24Kc";
+ 		break;
++	case PRID_IMP_24KE:
++		c->cputype = CPU_24K;
++		__cpu_name[cpu] = "MIPS 24KEc";
++		break;
+ 	case PRID_IMP_25KF:
+ 		c->cputype = CPU_25KF;
+ 		__cpu_name[cpu] = "MIPS 25Kc";
diff --git a/target/linux/generic/patches-3.3/309-mips_fuse_workaround.patch b/target/linux/generic/patches-3.3/309-mips_fuse_workaround.patch
new file mode 100644
index 0000000..78ab64f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/309-mips_fuse_workaround.patch
@@ -0,0 +1,32 @@
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -39,6 +39,7 @@ void (*__flush_kernel_vmap_range)(unsign
+ void (*__invalidate_kernel_vmap_range)(unsigned long vaddr, int size);
+ 
+ EXPORT_SYMBOL_GPL(__flush_kernel_vmap_range);
++EXPORT_SYMBOL(__flush_cache_all);
+ 
+ /* MIPS specific cache operations */
+ void (*flush_cache_sigtramp)(unsigned long addr);
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -19,6 +19,9 @@
+ #include <linux/pipe_fs_i.h>
+ #include <linux/swap.h>
+ #include <linux/splice.h>
++#ifdef CONFIG_MIPS
++#include <asm/cacheflush.h>
++#endif
+ 
+ MODULE_ALIAS_MISCDEV(FUSE_MINOR);
+ MODULE_ALIAS("devname:fuse");
+@@ -655,6 +658,9 @@ static int fuse_copy_fill(struct fuse_co
+ static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
+ {
+ 	unsigned ncpy = min(*size, cs->len);
++#ifdef CONFIG_MIPS
++	__flush_cache_all();
++#endif
+ 	if (val) {
+ 		if (cs->write)
+ 			memcpy(cs->buf, *val, ncpy);
diff --git a/target/linux/generic/patches-3.3/310-arm_module_unresolved_weak_sym.patch b/target/linux/generic/patches-3.3/310-arm_module_unresolved_weak_sym.patch
new file mode 100644
index 0000000..d1eba55
--- /dev/null
+++ b/target/linux/generic/patches-3.3/310-arm_module_unresolved_weak_sym.patch
@@ -0,0 +1,13 @@
+--- a/arch/arm/kernel/module.c
++++ b/arch/arm/kernel/module.c
+@@ -81,6 +81,10 @@ apply_relocate(Elf32_Shdr *sechdrs, cons
+ 			return -ENOEXEC;
+ 		}
+ 
++		if ((IS_ERR_VALUE(sym->st_value) || !sym->st_value) &&
++		    ELF_ST_BIND(sym->st_info) == STB_WEAK)
++			continue;
++
+ 		loc = dstsec->sh_addr + rel->r_offset;
+ 
+ 		switch (ELF32_R_TYPE(rel->r_info)) {
diff --git a/target/linux/generic/patches-3.3/320-ppc4xx_optimization.patch b/target/linux/generic/patches-3.3/320-ppc4xx_optimization.patch
new file mode 100644
index 0000000..3f67f1b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/320-ppc4xx_optimization.patch
@@ -0,0 +1,31 @@
+Upstream doesn't optimize the kernel and bootwrappers for ppc44x because
+they still want to support gcc 3.3 -- well, we don't.
+
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -130,7 +130,8 @@ ifeq ($(CONFIG_FUNCTION_TRACER),y)
+ KBUILD_CFLAGS		+= -mno-sched-epilog
+ endif
+ 
+-cpu-as-$(CONFIG_4xx)		+= -Wa,-m405
++cpu-as-$(CONFIG_40x)		+= -Wa,-m405
++cpu-as-$(CONFIG_44x)		+= -Wa,-m440
+ cpu-as-$(CONFIG_ALTIVEC)	+= -Wa,-maltivec
+ cpu-as-$(CONFIG_E500)		+= -Wa,-me500
+ cpu-as-$(CONFIG_E200)		+= -Wa,-me200
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -38,10 +38,10 @@ BOOTCFLAGS	+= -I$(obj) -I$(srctree)/$(ob
+ DTC_FLAGS	?= -p 1024
+ 
+ $(obj)/4xx.o: BOOTCFLAGS += -mcpu=405
+-$(obj)/ebony.o: BOOTCFLAGS += -mcpu=405
++$(obj)/ebony.o: BOOTCFLAGS += -mcpu=440
+ $(obj)/cuboot-hotfoot.o: BOOTCFLAGS += -mcpu=405
+-$(obj)/cuboot-taishan.o: BOOTCFLAGS += -mcpu=405
+-$(obj)/cuboot-katmai.o: BOOTCFLAGS += -mcpu=405
++$(obj)/cuboot-taishan.o: BOOTCFLAGS += -mcpu=440
++$(obj)/cuboot-katmai.o: BOOTCFLAGS += -mcpu=440
+ $(obj)/cuboot-acadia.o: BOOTCFLAGS += -mcpu=405
+ $(obj)/treeboot-walnut.o: BOOTCFLAGS += -mcpu=405
+ $(obj)/treeboot-iss4xx.o: BOOTCFLAGS += -mcpu=405
diff --git a/target/linux/generic/patches-3.3/321-powerpc_crtsavres_prereq.patch b/target/linux/generic/patches-3.3/321-powerpc_crtsavres_prereq.patch
new file mode 100644
index 0000000..941aa90
--- /dev/null
+++ b/target/linux/generic/patches-3.3/321-powerpc_crtsavres_prereq.patch
@@ -0,0 +1,10 @@
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -94,7 +94,6 @@ else
+ endif
+ endif
+ 
+-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
+ 
+ ifeq ($(CONFIG_TUNE_CELL),y)
+ 	KBUILD_CFLAGS += $(call cc-option,-mtune=cell)
diff --git a/target/linux/generic/patches-3.3/322-ppc4xx-crypto-compile-fix.patch b/target/linux/generic/patches-3.3/322-ppc4xx-crypto-compile-fix.patch
new file mode 100644
index 0000000..226e411
--- /dev/null
+++ b/target/linux/generic/patches-3.3/322-ppc4xx-crypto-compile-fix.patch
@@ -0,0 +1,10 @@
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -19,6 +19,7 @@
+  */
+ 
+ #include <linux/kernel.h>
++#include <linux/module.h>
+ #include <linux/interrupt.h>
+ #include <linux/spinlock_types.h>
+ #include <linux/random.h>
diff --git a/target/linux/generic/patches-3.3/330-mips-add-crash-and-kdump-support.patch b/target/linux/generic/patches-3.3/330-mips-add-crash-and-kdump-support.patch
new file mode 100644
index 0000000..7a79c41
--- /dev/null
+++ b/target/linux/generic/patches-3.3/330-mips-add-crash-and-kdump-support.patch
@@ -0,0 +1,616 @@
+From eee16330c9de9adf7880cce9f1d32e13f89706bb Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Tue, 11 Jan 2011 13:16:47 +0000
+Subject: MIPS: Add crash and kdump support
+
+From: http://patchwork.linux-mips.org/patch/1025/
+
+Hello folks,
+
+Please find here MIPS crash and kdump patches.
+This is patch set of 3 patches:
+1. generic MIPS changes (kernel);
+2. MIPS Cavium Octeon board kexec/kdump code (kernel);
+3. Kexec user space MIPS changes.
+
+Patches were tested on the latest linux-mips@ git kernel and the latest
+kexec-tools git on Cavium Octeon 50xx board.
+
+I also made the same code working on RMI XLR/XLS boards for both
+mips32 and mips64 kernels.
+
+Best regards,
+Maxim Uvarov.
+
+------
+[ Zhangjin: Several trivial building failure has been fixed.
+
+Note: the 2nd patch can not be cleanly applied, but may be a good
+reference for the other board development:
+
+	+ MIPS Cavium Octeon board kexec,kdump support
+	http://patchwork.linux-mips.org/patch/1026/
+
+And the 3rd patch has already been merged into the mainline kexec-tools:
+
+	+ some kexec MIPS improvements
+	http://patchwork.linux-mips.org/patch/1027/
+
+kexec-tools is available here:
+
+	+ http://horms.net/projects/kexec/
+	git://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git
+]
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+(limited to 'arch/mips/kernel')
+
+--- a/arch/mips/kernel/Makefile
++++ b/arch/mips/kernel/Makefile
+@@ -97,7 +97,8 @@ obj-$(CONFIG_I8253)		+= i8253.o
+ 
+ obj-$(CONFIG_GPIO_TXX9)		+= gpio_txx9.o
+ 
+-obj-$(CONFIG_KEXEC)		+= machine_kexec.o relocate_kernel.o
++obj-$(CONFIG_KEXEC)		+= machine_kexec.o relocate_kernel.o crash.o
++obj-$(CONFIG_CRASH_DUMP)	+= crash_dump.o
+ obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
+ obj-$(CONFIG_SPINLOCK_TEST)	+= spinlock_test.o
+ obj-$(CONFIG_MIPS_MACHINE)	+= mips_machine.o
+--- /dev/null
++++ b/arch/mips/kernel/crash.c
+@@ -0,0 +1,75 @@
++#include <linux/kernel.h>
++#include <linux/smp.h>
++#include <linux/reboot.h>
++#include <linux/kexec.h>
++#include <linux/bootmem.h>
++#include <linux/crash_dump.h>
++#include <linux/delay.h>
++#include <linux/init.h>
++#include <linux/irq.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++
++#ifdef CONFIG_CRASH_DUMP
++unsigned long long elfcorehdr_addr = ELFCORE_ADDR_MAX;
++#endif
++
++/* This keeps a track of which one is crashing cpu. */
++int crashing_cpu = -1;
++static cpumask_t cpus_in_crash = CPU_MASK_NONE;
++
++#ifdef CONFIG_SMP
++void crash_shutdown_secondary(void *ignore)
++{
++	struct pt_regs *regs;
++	int cpu = smp_processor_id();
++
++	regs = task_pt_regs(current);
++
++	if (!cpu_online(cpu))
++		return;
++
++	local_irq_disable();
++	if (!cpu_isset(cpu, cpus_in_crash))
++		crash_save_cpu(regs, cpu);
++	cpu_set(cpu, cpus_in_crash);
++
++	while (!atomic_read(&kexec_ready_to_reboot))
++		cpu_relax();
++	relocated_kexec_smp_wait(NULL);
++	/* NOTREACHED */
++}
++
++static void crash_kexec_prepare_cpus(void)
++{
++	unsigned int msecs;
++
++	unsigned int ncpus = num_online_cpus() - 1;/* Excluding the panic cpu */
++
++	dump_send_ipi(crash_shutdown_secondary);
++	smp_wmb();
++
++	/*
++	 * The crash CPU sends an IPI and wait for other CPUs to
++	 * respond. Delay of at least 10 seconds.
++	 */
++	printk(KERN_EMERG "Sending IPI to other cpus...\n");
++	msecs = 10000;
++	while ((cpus_weight(cpus_in_crash) < ncpus) && (--msecs > 0)) {
++		cpu_relax();
++		mdelay(1);
++	}
++}
++
++#else
++static void crash_kexec_prepare_cpus(void) {}
++#endif
++
++void default_machine_crash_shutdown(struct pt_regs *regs)
++{
++	local_irq_disable();
++	crashing_cpu = smp_processor_id();
++	crash_save_cpu(regs, crashing_cpu);
++	crash_kexec_prepare_cpus();
++	cpu_set(crashing_cpu, cpus_in_crash);
++}
+--- /dev/null
++++ b/arch/mips/kernel/crash_dump.c
+@@ -0,0 +1,86 @@
++#include <linux/highmem.h>
++#include <linux/bootmem.h>
++#include <linux/crash_dump.h>
++#include <asm/uaccess.h>
++
++#ifdef CONFIG_PROC_VMCORE
++static int __init parse_elfcorehdr(char *p)
++{
++	if (p)
++		elfcorehdr_addr = memparse(p, &p);
++	return 1;
++}
++__setup("elfcorehdr=", parse_elfcorehdr);
++#endif
++
++static int __init parse_savemaxmem(char *p)
++{
++	if (p)
++		saved_max_pfn = (memparse(p, &p) >> PAGE_SHIFT) - 1;
++
++	return 1;
++}
++__setup("savemaxmem=", parse_savemaxmem);
++
++
++static void *kdump_buf_page;
++
++/**
++ * copy_oldmem_page - copy one page from "oldmem"
++ * @pfn: page frame number to be copied
++ * @buf: target memory address for the copy; this can be in kernel address
++ *	space or user address space (see @userbuf)
++ * @csize: number of bytes to copy
++ * @offset: offset in bytes into the page (based on pfn) to begin the copy
++ * @userbuf: if set, @buf is in user address space, use copy_to_user(),
++ *	otherwise @buf is in kernel address space, use memcpy().
++ *
++ * Copy a page from "oldmem". For this page, there is no pte mapped
++ * in the current kernel.
++ *
++ * Calling copy_to_user() in atomic context is not desirable. Hence first
++ * copying the data to a pre-allocated kernel page and then copying to user
++ * space in non-atomic context.
++ */
++ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
++		size_t csize, unsigned long offset, int userbuf)
++{
++	void  *vaddr;
++
++	if (!csize)
++		return 0;
++
++	vaddr = kmap_atomic_pfn(pfn, KM_PTE0);
++
++	if (!userbuf) {
++		memcpy(buf, (vaddr + offset), csize);
++		kunmap_atomic(vaddr, KM_PTE0);
++	} else {
++		if (!kdump_buf_page) {
++			printk(KERN_WARNING "Kdump: Kdump buffer page not"
++				" allocated\n");
++			return -EFAULT;
++		}
++		copy_page(kdump_buf_page, vaddr);
++		kunmap_atomic(vaddr, KM_PTE0);
++		if (copy_to_user(buf, (kdump_buf_page + offset), csize))
++			return -EFAULT;
++	}
++
++	return csize;
++}
++
++static int __init kdump_buf_page_init(void)
++{
++	int ret = 0;
++
++	kdump_buf_page = kmalloc(PAGE_SIZE, GFP_KERNEL);
++	if (!kdump_buf_page) {
++		printk(KERN_WARNING "Kdump: Failed to allocate kdump buffer"
++			 " page\n");
++		ret = -ENOMEM;
++	}
++
++	return ret;
++}
++arch_initcall(kdump_buf_page_init);
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -19,9 +19,19 @@ extern const size_t relocate_new_kernel_
+ extern unsigned long kexec_start_address;
+ extern unsigned long kexec_indirection_page;
+ 
++int (*_machine_kexec_prepare)(struct kimage *) = NULL;
++void (*_machine_kexec_shutdown)(void) = NULL;
++void (*_machine_crash_shutdown)(struct pt_regs *regs) = NULL;
++#ifdef CONFIG_SMP
++void (*relocated_kexec_smp_wait) (void *);
++atomic_t kexec_ready_to_reboot = ATOMIC_INIT(0);
++#endif
++
+ int
+ machine_kexec_prepare(struct kimage *kimage)
+ {
++	if (_machine_kexec_prepare)
++		return _machine_kexec_prepare(kimage);
+ 	return 0;
+ }
+ 
+@@ -33,11 +43,17 @@ machine_kexec_cleanup(struct kimage *kim
+ void
+ machine_shutdown(void)
+ {
++	if (_machine_kexec_shutdown)
++		_machine_kexec_shutdown();
+ }
+ 
+ void
+ machine_crash_shutdown(struct pt_regs *regs)
+ {
++	if (_machine_crash_shutdown)
++		_machine_crash_shutdown(regs);
++	else
++		default_machine_crash_shutdown(regs);
+ }
+ 
+ typedef void (*noretfun_t)(void) __attribute__((noreturn));
+@@ -52,7 +68,9 @@ machine_kexec(struct kimage *image)
+ 	reboot_code_buffer =
+ 	  (unsigned long)page_address(image->control_code_page);
+ 
+-	kexec_start_address = (unsigned long) phys_to_virt(image->start);
++	kexec_start_address =
++	  (unsigned long) phys_to_virt(image->start);
++
+ 	kexec_indirection_page =
+ 		(unsigned long) phys_to_virt(image->head & PAGE_MASK);
+ 
+@@ -63,7 +81,7 @@ machine_kexec(struct kimage *image)
+ 	 * The generic kexec code builds a page list with physical
+ 	 * addresses. they are directly accessible through KSEG0 (or
+ 	 * CKSEG0 or XPHYS if on 64bit system), hence the
+-	 * pys_to_virt() call.
++	 * phys_to_virt() call.
+ 	 */
+ 	for (ptr = &image->head; (entry = *ptr) && !(entry &IND_DONE);
+ 	     ptr = (entry & IND_INDIRECTION) ?
+@@ -81,5 +99,13 @@ machine_kexec(struct kimage *image)
+ 	printk("Will call new kernel at %08lx\n", image->start);
+ 	printk("Bye ...\n");
+ 	__flush_cache_all();
++#ifdef CONFIG_SMP
++	/* All secondary cpus now may jump to kexec_wait cycle */
++	relocated_kexec_smp_wait = reboot_code_buffer +
++		(void *)(kexec_smp_wait - relocate_new_kernel);
++	smp_wmb();
++	atomic_set(&kexec_ready_to_reboot, 1);
++#endif
+ 	((noretfun_t) reboot_code_buffer)();
+ }
++
+--- a/arch/mips/kernel/relocate_kernel.S
++++ b/arch/mips/kernel/relocate_kernel.S
+@@ -15,6 +15,11 @@
+ #include <asm/addrspace.h>
+ 
+ LEAF(relocate_new_kernel)
++	PTR_L a0,	arg0
++	PTR_L a1,	arg1
++	PTR_L a2,	arg2
++	PTR_L a3,	arg3
++
+ 	PTR_L		s0, kexec_indirection_page
+ 	PTR_L		s1, kexec_start_address
+ 
+@@ -26,7 +31,6 @@ process_entry:
+ 	and		s3, s2, 0x1
+ 	beq		s3, zero, 1f
+ 	and		s4, s2, ~0x1	/* store destination addr in s4 */
+-	move		a0, s4
+ 	b		process_entry
+ 
+ 1:
+@@ -60,23 +64,100 @@ copy_word:
+ 	b		process_entry
+ 
+ done:
++#ifdef CONFIG_SMP
++	/* kexec_flag reset is signal to other CPUs what kernel
++ 	   was moved to it's location. Note - we need relocated address
++ 	   of kexec_flag.  */
++
++ 	bal		1f
++ 1: 	move		t1,ra;
++ 	PTR_LA		t2,1b
++ 	PTR_LA		t0,kexec_flag
++ 	PTR_SUB		t0,t0,t2;
++ 	PTR_ADD		t0,t1,t0;
++ 	LONG_S		zero,(t0)
++#endif
++
++	sync
+ 	/* jump to kexec_start_address */
+ 	j		s1
+ 	END(relocate_new_kernel)
+ 
+-kexec_start_address:
+-	EXPORT(kexec_start_address)
++#ifdef CONFIG_SMP
++/*
++ * Other CPUs should wait until code is relocated and
++ * then start at entry (?) point.
++ */
++LEAF(kexec_smp_wait)
++	PTR_L		a0, s_arg0
++	PTR_L		a1, s_arg1
++	PTR_L		a2, s_arg2
++	PTR_L		a3, s_arg3
++	PTR_L		s1, kexec_start_address
++
++	/* Non-relocated address works for args and kexec_start_address ( old
++	 * kernel is not overwritten). But we need relocated address of
++	 * kexec_flag.
++	 */
++
++	bal		1f
++1:	move		t1,ra;
++	PTR_LA		t2,1b
++	PTR_LA		t0,kexec_flag
++	PTR_SUB		t0,t0,t2;
++	PTR_ADD		t0,t1,t0;
++
++1:	LONG_L		s0, (t0)
++	bne		s0, zero,1b
++
++	sync
++	j		s1
++	END(kexec_smp_wait)
++#endif
++
++#ifdef __mips64
++       /* all PTR's must be aligned to 8 byte in 64-bit mode */
++       .align  3
++#endif
++
++/* All parameters to new kernel are passed in registers a0-a3.
++ * kexec_args[0..3] are uses to prepare register values.
++ */
++
++EXPORT(kexec_args)
++arg0:	PTR		0x0
++arg1:	PTR		0x0
++arg2:	PTR		0x0
++arg3:	PTR		0x0
++	.size	kexec_args,PTRSIZE*4
++
++#ifdef CONFIG_SMP
++/*
++ * Secondary CPUs may have different kernel parameters in
++ * their registers a0-a3. secondary_kexec_args[0..3] are used
++ * to prepare register values.
++ */
++EXPORT(secondary_kexec_args)
++s_arg0:	PTR		0x0
++s_arg1:	PTR		0x0
++s_arg2:	PTR		0x0
++s_arg3:	PTR		0x0
++	.size	secondary_kexec_args,PTRSIZE*4
++kexec_flag:
++	LONG		0x1
++
++#endif
++
++EXPORT(kexec_start_address)
+ 	PTR		0x0
+ 	.size		kexec_start_address, PTRSIZE
+ 
+-kexec_indirection_page:
+-	EXPORT(kexec_indirection_page)
++EXPORT(kexec_indirection_page)
+ 	PTR		0
+ 	.size		kexec_indirection_page, PTRSIZE
+ 
+ relocate_new_kernel_end:
+ 
+-relocate_new_kernel_size:
+-	EXPORT(relocate_new_kernel_size)
++EXPORT(relocate_new_kernel_size)
+ 	PTR		relocate_new_kernel_end - relocate_new_kernel
+ 	.size		relocate_new_kernel_size, PTRSIZE
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -22,6 +22,7 @@
+ #include <linux/console.h>
+ #include <linux/pfn.h>
+ #include <linux/debugfs.h>
++#include <linux/kexec.h>
+ 
+ #include <asm/addrspace.h>
+ #include <asm/bootinfo.h>
+@@ -523,12 +524,62 @@ static void __init arch_mem_init(char **
+ 	}
+ 
+ 	bootmem_init();
++#ifdef CONFIG_KEXEC
++	if (crashk_res.start != crashk_res.end)
++		reserve_bootmem(crashk_res.start,
++			crashk_res.end - crashk_res.start + 1,
++			BOOTMEM_DEFAULT);
++#endif
+ 	device_tree_init();
+ 	sparse_init();
+ 	plat_swiotlb_setup();
+ 	paging_init();
+ }
+ 
++#ifdef CONFIG_KEXEC
++static inline unsigned long long get_total_mem(void)
++{
++	unsigned long long total;
++	total = max_pfn - min_low_pfn;
++	return total << PAGE_SHIFT;
++}
++
++static void __init mips_parse_crashkernel(void)
++{
++	unsigned long long total_mem;
++	unsigned long long crash_size, crash_base;
++	int ret;
++
++	total_mem = get_total_mem();
++	ret = parse_crashkernel(boot_command_line, total_mem,
++			&crash_size, &crash_base);
++	if (ret != 0 || crash_size <= 0)
++		return;
++
++	crashk_res.start = crash_base;
++	crashk_res.end   = crash_base + crash_size - 1;
++}
++static void __init request_crashkernel(struct resource *res)
++{
++	int ret;
++
++	ret = request_resource(res, &crashk_res);
++	if (!ret)
++		printk(KERN_INFO "Reserving %ldMB of memory at %ldMB "
++			"for crashkernel\n",
++			(unsigned long)((crashk_res.end -
++				crashk_res.start + 1) >> 20),
++			(unsigned long)(crashk_res.start  >> 20));
++}
++#else
++static void __init mips_parse_crashkernel(void)
++{
++}
++static void __init request_crashkernel(struct resource *res)
++{
++}
++#endif
++
+ static void __init resource_init(void)
+ {
+ 	int i;
+@@ -544,6 +595,8 @@ static void __init resource_init(void)
+ 	/*
+ 	 * Request address space for all standard RAM.
+ 	 */
++	mips_parse_crashkernel();
++
+ 	for (i = 0; i < boot_mem_map.nr_map; i++) {
+ 		struct resource *res;
+ 		unsigned long start, end;
+@@ -580,6 +633,7 @@ static void __init resource_init(void)
+ 		 */
+ 		request_resource(res, &code_resource);
+ 		request_resource(res, &data_resource);
++		request_crashkernel(res);
+ 	}
+ }
+ 
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -433,3 +433,21 @@ void flush_tlb_one(unsigned long vaddr)
+ 
+ EXPORT_SYMBOL(flush_tlb_page);
+ EXPORT_SYMBOL(flush_tlb_one);
++
++#if defined(CONFIG_KEXEC)
++void (*dump_ipi_function_ptr)(void *) = NULL;
++void dump_send_ipi(void (*dump_ipi_callback)(void *))
++{
++	int i;
++	int cpu = smp_processor_id();
++
++	dump_ipi_function_ptr = dump_ipi_callback;
++	smp_mb();
++	for_each_online_cpu(i)
++		if (i != cpu)
++			core_send_ipi(i, SMP_DUMP);
++
++}
++EXPORT_SYMBOL(dump_send_ipi);
++#endif
++
+--- a/arch/mips/include/asm/kexec.h
++++ b/arch/mips/include/asm/kexec.h
+@@ -9,22 +9,45 @@
+ #ifndef _MIPS_KEXEC
+ # define _MIPS_KEXEC
+ 
++#include <asm/stacktrace.h>
++
++extern unsigned long long elfcorehdr_addr;
++
+ /* Maximum physical address we can use pages from */
+ #define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000)
+ /* Maximum address we can reach in physical address mode */
+ #define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000)
+  /* Maximum address we can use for the control code buffer */
+ #define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000)
+-
+-#define KEXEC_CONTROL_PAGE_SIZE 4096
++/* Reserve 3*4096 bytes for board-specific info */
++#define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096)
+ 
+ /* The native architecture */
+ #define KEXEC_ARCH KEXEC_ARCH_MIPS
++#define MAX_NOTE_BYTES 1024
+ 
+ static inline void crash_setup_regs(struct pt_regs *newregs,
+-				    struct pt_regs *oldregs)
++					struct pt_regs *oldregs)
+ {
+-	/* Dummy implementation for now */
++	if (oldregs)
++		memcpy(newregs, oldregs, sizeof(*newregs));
++	else
++		prepare_frametrace(newregs);
+ }
+ 
++#ifdef CONFIG_KEXEC
++struct kimage;
++extern unsigned long kexec_args[4];
++extern int (*_machine_kexec_prepare)(struct kimage *);
++extern void (*_machine_kexec_shutdown)(void);
++extern void (*_machine_crash_shutdown)(struct pt_regs *regs);
++extern void default_machine_crash_shutdown(struct pt_regs *regs);
++#ifdef CONFIG_SMP
++extern const unsigned char kexec_smp_wait[];
++extern unsigned long secondary_kexec_args[4];
++extern void (*relocated_kexec_smp_wait) (void *);
++extern atomic_t kexec_ready_to_reboot;
++#endif
++#endif
++
+ #endif /* !_MIPS_KEXEC */
+--- a/arch/mips/include/asm/smp.h
++++ b/arch/mips/include/asm/smp.h
+@@ -40,6 +40,8 @@ extern int __cpu_logical_map[NR_CPUS];
+ #define SMP_CALL_FUNCTION	0x2
+ /* Octeon - Tell another core to flush its icache */
+ #define SMP_ICACHE_FLUSH	0x4
++/* Used by kexec crashdump to save all cpu's state */
++#define SMP_DUMP		0x8
+ 
+ extern volatile cpumask_t cpu_callin_map;
+ 
+@@ -91,4 +93,9 @@ static inline void arch_send_call_functi
+ 	mp_ops->send_ipi_mask(mask, SMP_CALL_FUNCTION);
+ }
+ 
++extern void core_send_ipi(int cpu, unsigned int action);
++#if defined(CONFIG_KEXEC)
++extern void (*dump_ipi_function_ptr)(void *);
++void dump_send_ipi(void (*dump_ipi_callback)(void *));
++#endif
+ #endif /* __ASM_SMP_H */
diff --git a/target/linux/generic/patches-3.3/331-mips-kexec-enhanche-the-support.patch b/target/linux/generic/patches-3.3/331-mips-kexec-enhanche-the-support.patch
new file mode 100644
index 0000000..21bbeed
--- /dev/null
+++ b/target/linux/generic/patches-3.3/331-mips-kexec-enhanche-the-support.patch
@@ -0,0 +1,157 @@
+From 03cd81fbca6b91317ec1a7b3b3c09fb8d08f83a6 Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Tue, 11 Jan 2011 18:42:08 +0000
+Subject: MIPS: Kexec: Enhance the support
+
+Changes:
+  o Print more information in machine_kexec() for debugging
+    E.g. with this information, the kexec_start_address has been found
+    it was wrong with 64bit kernel / o32 kexec-tools. Which must be
+    fixed later.
+  o Link relocate_kernel.S to a section for future extension
+    This allows more functions can be added for the kexec relocation
+    part even written in C. to add code into that section, you just need
+    to mark your function or data with __kexec or
+    __attribute__((__section__(".__kexec.relocate")))
+
+TODO:
+
+1. Make 64bit kernel / o32|n32|64 kexec-tools works
+
+Fix the user-space kexec-tools, seems the tool only work for 32bit
+machine. So, we need to add 64bit support for it. The address of the
+entry point(kexec_start_address) is wrong and make the "kexec -e" fail.
+the real entry point must be read from the new kernel image by the
+user-space kexec-tools, otherwise, it will not work.  The above 64bit
+support tested is 64bit kernel with o32 user-space kexec-tools. The root
+cause may be the different definition of virt_to_phys() and
+phys_to_virt() in the kexec-tools and kernel space for 64bit system /
+o32 kernel.
+
+Ref: http://www.linux-mips.org/archives/linux-mips/2009-08/msg00149.html
+
+2. Pass the arguments from kexec-tools to the new kernel image
+
+Please refer to: "MIPS: Loongson: Kexec: Pass parameters to new kernel"
+
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+--- a/arch/mips/include/asm/kexec.h
++++ b/arch/mips/include/asm/kexec.h
+@@ -36,6 +36,16 @@ static inline void crash_setup_regs(stru
+ }
+ 
+ #ifdef CONFIG_KEXEC
++
++#define __kexec __attribute__((__section__(".__kexec.relocate")))
++
++/* The linker tells us where the relocate_new_kernel part is. */
++extern const unsigned char __start___kexec_relocate;
++extern const unsigned char __end___kexec_relocate;
++
++extern unsigned long kexec_start_address;
++extern unsigned long kexec_indirection_page;
++
+ struct kimage;
+ extern unsigned long kexec_args[4];
+ extern int (*_machine_kexec_prepare)(struct kimage *);
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -14,10 +14,6 @@
+ #include <asm/page.h>
+ 
+ extern const unsigned char relocate_new_kernel[];
+-extern const size_t relocate_new_kernel_size;
+-
+-extern unsigned long kexec_start_address;
+-extern unsigned long kexec_indirection_page;
+ 
+ int (*_machine_kexec_prepare)(struct kimage *) = NULL;
+ void (*_machine_kexec_shutdown)(void) = NULL;
+@@ -61,21 +57,34 @@ typedef void (*noretfun_t)(void) __attri
+ void
+ machine_kexec(struct kimage *image)
+ {
++	unsigned long kexec_relocate_size;
+ 	unsigned long reboot_code_buffer;
+ 	unsigned long entry;
+ 	unsigned long *ptr;
+ 
++	kexec_relocate_size = (unsigned long)(&__end___kexec_relocate) -
++		(unsigned long)(&__start___kexec_relocate);
++	pr_info("kexec_relocate_size = %lu\n", kexec_relocate_size);
++
+ 	reboot_code_buffer =
+ 	  (unsigned long)page_address(image->control_code_page);
++	pr_info("reboot_code_buffer = %p\n", (void *)reboot_code_buffer);
+ 
+ 	kexec_start_address =
+ 	  (unsigned long) phys_to_virt(image->start);
++	pr_info("kexec_start_address(entry point of new kernel) = %p\n",
++			(void *)kexec_start_address);
+ 
+ 	kexec_indirection_page =
+ 		(unsigned long) phys_to_virt(image->head & PAGE_MASK);
++	pr_info("kexec_indirection_page = %p\n",
++			(void *)kexec_indirection_page);
+ 
+-	memcpy((void*)reboot_code_buffer, relocate_new_kernel,
+-	       relocate_new_kernel_size);
++	memcpy((void *)reboot_code_buffer, &__start___kexec_relocate,
++	       kexec_relocate_size);
++
++	pr_info("Copy kexec_relocate section from %p to reboot_code_buffer: %p\n",
++			&__start___kexec_relocate, (void *)reboot_code_buffer);
+ 
+ 	/*
+ 	 * The generic kexec code builds a page list with physical
+@@ -96,8 +105,8 @@ machine_kexec(struct kimage *image)
+ 	 */
+ 	local_irq_disable();
+ 
+-	printk("Will call new kernel at %08lx\n", image->start);
+-	printk("Bye ...\n");
++	pr_info("Will call new kernel at %p\n", (void *)kexec_start_address);
++	pr_info("Bye ...\n");
+ 	__flush_cache_all();
+ #ifdef CONFIG_SMP
+ 	/* All secondary cpus now may jump to kexec_wait cycle */
+@@ -108,4 +117,3 @@ machine_kexec(struct kimage *image)
+ #endif
+ 	((noretfun_t) reboot_code_buffer)();
+ }
+-
+--- a/arch/mips/kernel/relocate_kernel.S
++++ b/arch/mips/kernel/relocate_kernel.S
+@@ -14,6 +14,8 @@
+ #include <asm/stackframe.h>
+ #include <asm/addrspace.h>
+ 
++	.section	.kexec.relocate, "ax"
++
+ LEAF(relocate_new_kernel)
+ 	PTR_L a0,	arg0
+ 	PTR_L a1,	arg1
+@@ -155,9 +157,3 @@ EXPORT(kexec_start_address)
+ EXPORT(kexec_indirection_page)
+ 	PTR		0
+ 	.size		kexec_indirection_page, PTRSIZE
+-
+-relocate_new_kernel_end:
+-
+-EXPORT(relocate_new_kernel_size)
+-	PTR		relocate_new_kernel_end - relocate_new_kernel
+-	.size		relocate_new_kernel_size, PTRSIZE
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -50,6 +50,10 @@ SECTIONS
+ 		*(.text.*)
+ 		*(.fixup)
+ 		*(.gnu.warning)
++		__start___kexec_relocate = .;
++		KEEP(*(.kexec.relocate))
++		KEEP(*(.__kexec.relocate))
++		__end___kexec_relocate = .;
+ 	} :text = 0
+ 	_etext = .;	/* End of text section */
+ 
diff --git a/target/linux/generic/patches-3.3/332-mips-kexec-init-the-arguments-for-the-new-kernel-image.patch b/target/linux/generic/patches-3.3/332-mips-kexec-init-the-arguments-for-the-new-kernel-image.patch
new file mode 100644
index 0000000..07d0af9
--- /dev/null
+++ b/target/linux/generic/patches-3.3/332-mips-kexec-init-the-arguments-for-the-new-kernel-image.patch
@@ -0,0 +1,52 @@
+From 49d07a29653b1f2c6ae273b3d8fe93d981f43004 Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Wed, 12 Jan 2011 20:59:32 +0000
+Subject: MIPS: Kexec: Init the arguments for the new kernel image
+
+Whenever the kexec-tools pass the command lines to the new kernel image,
+init the arguments as the ones for the 1st kernel image. This fixed the
+booting failure of Kexec on YeeLoong.
+
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -10,6 +10,7 @@
+ #include <linux/mm.h>
+ #include <linux/delay.h>
+ 
++#include <asm/bootinfo.h>
+ #include <asm/cacheflush.h>
+ #include <asm/page.h>
+ 
+@@ -23,9 +24,30 @@ void (*relocated_kexec_smp_wait) (void *
+ atomic_t kexec_ready_to_reboot = ATOMIC_INIT(0);
+ #endif
+ 
++static void machine_kexec_init_args(void)
++{
++	kexec_args[0] = fw_arg0;
++	kexec_args[1] = fw_arg1;
++	kexec_args[2] = fw_arg2;
++	kexec_args[3] = fw_arg3;
++
++	pr_info("kexec_args[0] (argc): %lu\n", kexec_args[0]);
++	pr_info("kexec_args[1] (argv): %p\n", (void *)kexec_args[1]);
++	pr_info("kexec_args[2] (env ): %p\n", (void *)kexec_args[2]);
++	pr_info("kexec_args[3] (desc): %p\n", (void *)kexec_args[3]);
++}
++
+ int
+ machine_kexec_prepare(struct kimage *kimage)
+ {
++	/*
++	 * Whenever arguments passed from kexec-tools, Init the arguments as
++	 * the original ones to avoid booting failure.
++	 *
++	 * This can be overrided by _machine_kexec_prepare().
++	 */
++	machine_kexec_init_args();
++
+ 	if (_machine_kexec_prepare)
+ 		return _machine_kexec_prepare(kimage);
+ 	return 0;
diff --git a/target/linux/generic/patches-3.3/333-mips-kexec-get-kernel-parameters-from-kexec-tools.patch b/target/linux/generic/patches-3.3/333-mips-kexec-get-kernel-parameters-from-kexec-tools.patch
new file mode 100644
index 0000000..44380da
--- /dev/null
+++ b/target/linux/generic/patches-3.3/333-mips-kexec-get-kernel-parameters-from-kexec-tools.patch
@@ -0,0 +1,88 @@
+From 240c76841b26f1b09aaced33414ee1d08b6454cf Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Sat, 15 Jan 2011 12:46:03 +0000
+Subject: MIPS: Get kernel parameters from kexec-tools
+
+Before, we simply use the command lines from the original bootloader,
+but it is not convenient. Now, we accept the kernel parameters from the
+--command-line or --append option of the kexec-tools.  But If not
+--command-line or --apend option indicated, will fall back to use the
+ones from the original bootloader.
+
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -13,6 +13,7 @@
+ #include <asm/bootinfo.h>
+ #include <asm/cacheflush.h>
+ #include <asm/page.h>
++#include <asm/uaccess.h>
+ 
+ extern const unsigned char relocate_new_kernel[];
+ 
+@@ -37,6 +38,56 @@ static void machine_kexec_init_args(void
+ 	pr_info("kexec_args[3] (desc): %p\n", (void *)kexec_args[3]);
+ }
+ 
++#define ARGV_MAX_ARGS (COMMAND_LINE_SIZE / 15)
++
++int machine_kexec_pass_args(struct kimage *image)
++{
++	int i, argc = 0;
++	char *bootloader = "kexec";
++	int *kexec_argv = (int *)kexec_args[1];
++
++	for (i = 0; i < image->nr_segments; i++) {
++		if (!strncmp(bootloader, (char *)image->segment[i].buf,
++				strlen(bootloader))) {
++			/*
++			 * convert command line string to array
++			 * of parameters (as bootloader does).
++			 */
++			/*
++			 * Note: we do treat the 1st string "kexec" as an
++			 * argument ;-) so, argc here is 1.
++			 */
++			char *str = (char *)image->segment[i].buf;
++			char *ptr = strchr(str, ' ');
++			char *kbuf = (char *)kexec_argv[0];
++			/* Whenever --command-line or --append used, "kexec" is copied */
++			argc = 1;
++			/* Parse the offset */
++			while (ptr && (ARGV_MAX_ARGS > argc)) {
++				*ptr = '\0';
++				if (ptr[1] != ' ' && ptr[1] != '\0') {
++					int offt = (int)(ptr - str + 1);
++					kexec_argv[argc] = (int)kbuf + offt;
++					argc++;
++				}
++				ptr = strchr(ptr + 1, ' ');
++			}
++			if (argc > 1) {
++				/* Copy to kernel space */
++				copy_from_user(kbuf, (char *)image->segment[i].buf, image->segment[i].bufsz);
++				fw_arg0 = kexec_args[0] = argc;
++			}
++			break;
++		}
++	}
++
++	pr_info("argc = %lu\n", kexec_args[0]);
++	for (i = 0; i < kexec_args[0]; i++)
++		pr_info("argv[%d] = %p, %s\n", i, (char *)kexec_argv[i], (char *)kexec_argv[i]);
++
++	return 0;
++}
++
+ int
+ machine_kexec_prepare(struct kimage *kimage)
+ {
+@@ -47,6 +98,7 @@ machine_kexec_prepare(struct kimage *kim
+ 	 * This can be overrided by _machine_kexec_prepare().
+ 	 */
+ 	machine_kexec_init_args();
++	machine_kexec_pass_args(kimage);
+ 
+ 	if (_machine_kexec_prepare)
+ 		return _machine_kexec_prepare(kimage);
diff --git a/target/linux/generic/patches-3.3/334-mips-fix-compiling-failure-of-relocate_kernel.patch b/target/linux/generic/patches-3.3/334-mips-fix-compiling-failure-of-relocate_kernel.patch
new file mode 100644
index 0000000..46a7395
--- /dev/null
+++ b/target/linux/generic/patches-3.3/334-mips-fix-compiling-failure-of-relocate_kernel.patch
@@ -0,0 +1,83 @@
+From 4aded085fa0057a9a1e1dcec631f950307360c1f Mon Sep 17 00:00:00 2001
+From: Wu Zhangjin <wuzhangjin@gmail.com>
+Date: Tue, 11 Jan 2011 13:46:19 +0000
+Subject: MIPS: Fix compiling failure of relocate_kernel.S
+
+The following errors is fixed with the help of <asm/asm_nosec.h>. for
+this file need to put different symbols in the same section, the
+original LEAF, NESTED and EXPORT (without explicit section indication)
+must be used, <asm/asm_nosec.h> does it.
+
+arch/mips/kernel/relocate_kernel.S: Assembler messages:
+arch/mips/kernel/relocate_kernel.S:162: Error: operation combines symbols in different segments
+
+Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
+---
+(limited to 'arch/mips/kernel')
+
+--- a/arch/mips/kernel/relocate_kernel.S
++++ b/arch/mips/kernel/relocate_kernel.S
+@@ -7,6 +7,7 @@
+  */
+ 
+ #include <asm/asm.h>
++#include <asm/asm_nosec.h>
+ #include <asm/asmmacro.h>
+ #include <asm/regdef.h>
+ #include <asm/page.h>
+--- /dev/null
++++ b/arch/mips/include/asm/asm_nosec.h
+@@ -0,0 +1,53 @@
++/*
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License.  See the file "COPYING" in the main directory of this archive
++ * for more details.
++ *
++ * Copyright (C) 1995, 1996, 1997, 1999, 2001 by Ralf Baechle
++ * Copyright (C) 1999 by Silicon Graphics, Inc.
++ * Copyright (C) 2001 MIPS Technologies, Inc.
++ * Copyright (C) 2002  Maciej W. Rozycki
++ * Copyright (C) 2010  Wu Zhangjin <wuzhangjin@gmail.com>
++ *
++ * Derive from <asm/asm.h>
++ *
++ * Override the macros without -ffunction-sections and -fdata-sections support.
++ * If several functions or data must be put in the same section, please include
++ * this header file after the <asm/asm.h> to override the generic definition.
++ */
++
++#ifndef __ASM_ASM_NOSEC_H
++#define __ASM_ASM_NOSEC_H
++
++#undef LEAF
++#undef NESTED
++#undef EXPORT
++
++/*
++ * LEAF - declare leaf routine
++ */
++#define	LEAF(symbol)                                    \
++		.globl	symbol;                         \
++		.align	2;                              \
++		.type	symbol, @function;              \
++		.ent	symbol, 0;                      \
++symbol:		.frame	sp, 0, ra
++
++/*
++ * NESTED - declare nested routine entry point
++ */
++#define	NESTED(symbol, framesize, rpc)                  \
++		.globl	symbol;                         \
++		.align	2;                              \
++		.type	symbol, @function;              \
++		.ent	symbol, 0;                       \
++symbol:		.frame	sp, framesize, rpc
++
++/*
++ * EXPORT - export definition of symbol
++ */
++#define EXPORT(symbol)					\
++		.globl	symbol;                         \
++symbol:
++
++#endif /* __ASM_ASM_NOSEC_H */
diff --git a/target/linux/generic/patches-3.3/335-mips-kexec-cleanup-kexec-tools-parameter-handling.patch b/target/linux/generic/patches-3.3/335-mips-kexec-cleanup-kexec-tools-parameter-handling.patch
new file mode 100644
index 0000000..e0a1103
--- /dev/null
+++ b/target/linux/generic/patches-3.3/335-mips-kexec-cleanup-kexec-tools-parameter-handling.patch
@@ -0,0 +1,186 @@
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -25,67 +25,104 @@ void (*relocated_kexec_smp_wait) (void *
+ atomic_t kexec_ready_to_reboot = ATOMIC_INIT(0);
+ #endif
+ 
+-static void machine_kexec_init_args(void)
++#define KEXEC_MIPS_ARGV_BUF_SIZE	COMMAND_LINE_SIZE
++#define KEXEC_MIPS_ARGV_MAX_ARGS	(COMMAND_LINE_SIZE / 15)
++
++char kexec_argv_buf[KEXEC_MIPS_ARGV_BUF_SIZE] __kexec;
++char *kexec_argv[KEXEC_MIPS_ARGV_MAX_ARGS] __kexec;
++
++static void
++machine_kexec_print_args(void)
+ {
+-	kexec_args[0] = fw_arg0;
+-	kexec_args[1] = fw_arg1;
+-	kexec_args[2] = fw_arg2;
+-	kexec_args[3] = fw_arg3;
++	int i;
+ 
+ 	pr_info("kexec_args[0] (argc): %lu\n", kexec_args[0]);
+ 	pr_info("kexec_args[1] (argv): %p\n", (void *)kexec_args[1]);
+ 	pr_info("kexec_args[2] (env ): %p\n", (void *)kexec_args[2]);
+ 	pr_info("kexec_args[3] (desc): %p\n", (void *)kexec_args[3]);
+-}
+ 
+-#define ARGV_MAX_ARGS (COMMAND_LINE_SIZE / 15)
++	for (i = 0; i < kexec_args[0]; i++)
++		pr_info("kexec_argv[%d] = %p, %s\n", i,
++			(char *)kexec_argv[i], (char *)kexec_argv[i]);
++}
+ 
+-int machine_kexec_pass_args(struct kimage *image)
++static void
++machine_kexec_init_argv(struct kimage *image)
+ {
+-	int i, argc = 0;
+-	char *bootloader = "kexec";
+-	int *kexec_argv = (int *)kexec_args[1];
++	void __user *buf = NULL;
++	size_t bufsz;
++	size_t size;
++	int i;
+ 
++	bufsz = 0;
+ 	for (i = 0; i < image->nr_segments; i++) {
+-		if (!strncmp(bootloader, (char *)image->segment[i].buf,
+-				strlen(bootloader))) {
+-			/*
+-			 * convert command line string to array
+-			 * of parameters (as bootloader does).
+-			 */
+-			/*
+-			 * Note: we do treat the 1st string "kexec" as an
+-			 * argument ;-) so, argc here is 1.
+-			 */
+-			char *str = (char *)image->segment[i].buf;
+-			char *ptr = strchr(str, ' ');
+-			char *kbuf = (char *)kexec_argv[0];
+-			/* Whenever --command-line or --append used, "kexec" is copied */
+-			argc = 1;
+-			/* Parse the offset */
+-			while (ptr && (ARGV_MAX_ARGS > argc)) {
+-				*ptr = '\0';
+-				if (ptr[1] != ' ' && ptr[1] != '\0') {
+-					int offt = (int)(ptr - str + 1);
+-					kexec_argv[argc] = (int)kbuf + offt;
+-					argc++;
+-				}
+-				ptr = strchr(ptr + 1, ' ');
+-			}
+-			if (argc > 1) {
+-				/* Copy to kernel space */
+-				copy_from_user(kbuf, (char *)image->segment[i].buf, image->segment[i].bufsz);
+-				fw_arg0 = kexec_args[0] = argc;
+-			}
+-			break;
++		struct kexec_segment *seg;
++
++		seg = &image->segment[i];
++		if (seg->bufsz < 6)
++			continue;
++
++		if (strncmp((char *) seg->buf, "kexec", 5))
++			continue;
++
++		/* don't copy "kexec" */
++		buf = seg->buf + 5;
++		bufsz = seg->bufsz - 5;
++		break;
++	}
++
++	if (!buf)
++		return;
++
++	size = KEXEC_MIPS_ARGV_BUF_SIZE - 1;
++	size = min(size, bufsz);
++	if (size < bufsz)
++		pr_warn("kexec command line truncated to %zd bytes\n", size);
++
++	/* Copy to kernel space */
++	copy_from_user(kexec_argv_buf, buf, size);
++}
++
++static void
++machine_kexec_parse_argv(struct kimage *image)
++{
++	char *reboot_code_buffer;
++	int reloc_delta;
++	char *ptr;
++	int argc;
++	int i;
++
++	ptr = kexec_argv_buf;
++	argc = 0;
++
++	/*
++	 * convert command line string to array of parameters
++	 * (as bootloader does).
++	 */
++	while (ptr && *ptr && (KEXEC_MIPS_ARGV_MAX_ARGS > argc)) {
++		if (*ptr == ' ') {
++			*ptr++ = '\0';
++			continue;
+ 		}
++
++		kexec_argv[argc++] = ptr;
++		ptr = strchr(ptr, ' ');
+ 	}
+ 
+-	pr_info("argc = %lu\n", kexec_args[0]);
+-	for (i = 0; i < kexec_args[0]; i++)
+-		pr_info("argv[%d] = %p, %s\n", i, (char *)kexec_argv[i], (char *)kexec_argv[i]);
++	if (!argc)
++		return;
+ 
+-	return 0;
++	kexec_args[0] = argc;
++	kexec_args[1] = (unsigned long)kexec_argv;
++	kexec_args[2] = 0;
++	kexec_args[3] = 0;
++
++	reboot_code_buffer = page_address(image->control_code_page);
++	reloc_delta = reboot_code_buffer - (char *) &__start___kexec_relocate;
++
++	kexec_args[1] += reloc_delta;
++	for (i = 0; i < argc; i++)
++		kexec_argv[i] += reloc_delta;
+ }
+ 
+ int
+@@ -97,8 +134,14 @@ machine_kexec_prepare(struct kimage *kim
+ 	 *
+ 	 * This can be overrided by _machine_kexec_prepare().
+ 	 */
+-	machine_kexec_init_args();
+-	machine_kexec_pass_args(kimage);
++
++	kexec_args[0] = fw_arg0;
++	kexec_args[1] = fw_arg1;
++	kexec_args[2] = fw_arg2;
++	kexec_args[3] = fw_arg3;
++
++	machine_kexec_init_argv(kimage);
++	machine_kexec_parse_argv(kimage);
+ 
+ 	if (_machine_kexec_prepare)
+ 		return _machine_kexec_prepare(kimage);
+@@ -154,11 +197,13 @@ machine_kexec(struct kimage *image)
+ 	pr_info("kexec_indirection_page = %p\n",
+ 			(void *)kexec_indirection_page);
+ 
++	pr_info("Copy kexec_relocate section from %p to reboot_code_buffer: %p\n",
++			&__start___kexec_relocate, (void *)reboot_code_buffer);
++
+ 	memcpy((void *)reboot_code_buffer, &__start___kexec_relocate,
+ 	       kexec_relocate_size);
+ 
+-	pr_info("Copy kexec_relocate section from %p to reboot_code_buffer: %p\n",
+-			&__start___kexec_relocate, (void *)reboot_code_buffer);
++	machine_kexec_print_args();
+ 
+ 	/*
+ 	 * The generic kexec code builds a page list with physical
diff --git a/target/linux/generic/patches-3.3/340-module_alloc_size_check.patch b/target/linux/generic/patches-3.3/340-module_alloc_size_check.patch
new file mode 100644
index 0000000..549df5a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/340-module_alloc_size_check.patch
@@ -0,0 +1,20 @@
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2322,12 +2322,15 @@ static void dynamic_debug_remove(struct
+ 
+ void * __weak module_alloc(unsigned long size)
+ {
+-	return size == 0 ? NULL : vmalloc_exec(size);
++	return vmalloc_exec(size);
+ }
+ 
+ static void *module_alloc_update_bounds(unsigned long size)
+ {
+-	void *ret = module_alloc(size);
++	void *ret = NULL;
++
++	if (size)
++		ret = module_alloc(size);
+ 
+ 	if (ret) {
+ 		mutex_lock(&module_mutex);
diff --git a/target/linux/generic/patches-3.3/400-rootfs_split.patch b/target/linux/generic/patches-3.3/400-rootfs_split.patch
new file mode 100644
index 0000000..349185a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/400-rootfs_split.patch
@@ -0,0 +1,327 @@
+--- a/drivers/mtd/Kconfig
++++ b/drivers/mtd/Kconfig
+@@ -23,6 +23,14 @@ config MTD_TESTS
+ 	  WARNING: some of the tests will ERASE entire MTD device which they
+ 	  test. Do not use these tests unless you really know what you do.
+ 
++config MTD_ROOTFS_ROOT_DEV
++	bool "Automatically set 'rootfs' partition to be root filesystem"
++	default y
++
++config MTD_ROOTFS_SPLIT
++	bool "Automatically split 'rootfs' partition for squashfs"
++	default y
++
+ config MTD_REDBOOT_PARTS
+ 	tristate "RedBoot partition table parsing"
+ 	---help---
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -29,6 +29,8 @@
+ #include <linux/kmod.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/root_dev.h>
++#include <linux/magic.h>
+ #include <linux/err.h>
+ 
+ #include "mtdcore.h"
+@@ -50,7 +52,7 @@ struct mtd_part {
+  * the pointer to that structure with this macro.
+  */
+ #define PART(x)  ((struct mtd_part *)(x))
+-
++#define IS_PART(mtd) (mtd->read == part_read)
+ 
+ /*
+  * MTD methods which simply translate the effective address and pass through
+@@ -643,6 +645,155 @@ int mtd_del_partition(struct mtd_info *m
+ }
+ EXPORT_SYMBOL_GPL(mtd_del_partition);
+ 
++#ifdef CONFIG_MTD_ROOTFS_SPLIT
++#define ROOTFS_SPLIT_NAME "rootfs_data"
++#define ROOTFS_REMOVED_NAME "<removed>"
++
++struct squashfs_super_block {
++	__le32 s_magic;
++	__le32 pad0[9];
++	__le64 bytes_used;
++};
++
++
++static int split_squashfs(struct mtd_info *master, int offset, int *split_offset)
++{
++	struct squashfs_super_block sb;
++	int len, ret;
++
++	ret = master->read(master, offset, sizeof(sb), &len, (void *) &sb);
++	if (ret || (len != sizeof(sb))) {
++		printk(KERN_ALERT "split_squashfs: error occured while reading "
++			"from \"%s\"\n", master->name);
++		return -EINVAL;
++	}
++
++	if (SQUASHFS_MAGIC != le32_to_cpu(sb.s_magic) ) {
++		printk(KERN_ALERT "split_squashfs: no squashfs found in \"%s\"\n",
++			master->name);
++		*split_offset = 0;
++		return 0;
++	}
++
++	if (le64_to_cpu((sb.bytes_used)) <= 0) {
++		printk(KERN_ALERT "split_squashfs: squashfs is empty in \"%s\"\n",
++			master->name);
++		*split_offset = 0;
++		return 0;
++	}
++
++	len = (u32) le64_to_cpu(sb.bytes_used);
++	len += (offset & 0x000fffff);
++	len +=  (master->erasesize - 1);
++	len &= ~(master->erasesize - 1);
++	len -= (offset & 0x000fffff);
++	*split_offset = offset + len;
++
++	return 0;
++}
++
++static int split_rootfs_data(struct mtd_info *master, struct mtd_info *rpart, const struct mtd_partition *part)
++{
++	struct mtd_partition *dpart;
++	struct mtd_part *slave = NULL;
++	struct mtd_part *spart;
++	int ret, split_offset = 0;
++
++	spart = PART(rpart);
++	ret = split_squashfs(master, spart->offset, &split_offset);
++	if (ret)
++		return ret;
++
++	if (split_offset <= 0)
++		return 0;
++
++	dpart = kmalloc(sizeof(*part)+sizeof(ROOTFS_SPLIT_NAME)+1, GFP_KERNEL);
++	if (dpart == NULL) {
++		printk(KERN_INFO "split_squashfs: no memory for partition \"%s\"\n",
++			ROOTFS_SPLIT_NAME);
++		return -ENOMEM;
++	}
++
++	memcpy(dpart, part, sizeof(*part));
++	dpart->name = (unsigned char *)&dpart[1];
++	strcpy(dpart->name, ROOTFS_SPLIT_NAME);
++
++	dpart->size = rpart->size - (split_offset - spart->offset);
++	dpart->offset = split_offset;
++
++	if (dpart == NULL)
++		return 1;
++
++	printk(KERN_INFO "mtd: partition \"%s\" created automatically, ofs=%llX, len=%llX \n",
++		ROOTFS_SPLIT_NAME, dpart->offset, dpart->size);
++
++	slave = allocate_partition(master, dpart, 0, split_offset);
++	if (IS_ERR(slave))
++		return PTR_ERR(slave);
++	mutex_lock(&mtd_partitions_mutex);
++	list_add(&slave->list, &mtd_partitions);
++	mutex_unlock(&mtd_partitions_mutex);
++
++	add_mtd_device(&slave->mtd);
++
++	rpart->split = &slave->mtd;
++
++	return 0;
++}
++
++static int refresh_rootfs_split(struct mtd_info *mtd)
++{
++	struct mtd_partition tpart;
++	struct mtd_part *part;
++	char *name;
++	//int index = 0;
++	int offset, size;
++	int ret;
++
++	part = PART(mtd);
++
++	/* check for the new squashfs offset first */
++	ret = split_squashfs(part->master, part->offset, &offset);
++	if (ret)
++		return ret;
++
++	if ((offset > 0) && !mtd->split) {
++		printk(KERN_INFO "%s: creating new split partition for \"%s\"\n", __func__, mtd->name);
++		/* if we don't have a rootfs split partition, create a new one */
++		tpart.name = (char *) mtd->name;
++		tpart.size = mtd->size;
++		tpart.offset = part->offset;
++
++		return split_rootfs_data(part->master, &part->mtd, &tpart);
++	} else if ((offset > 0) && mtd->split) {
++		/* update the offsets of the existing partition */
++		size = mtd->size + part->offset - offset;
++
++		part = PART(mtd->split);
++		part->offset = offset;
++		part->mtd.size = size;
++		printk(KERN_INFO "%s: %s partition \"" ROOTFS_SPLIT_NAME "\", offset: 0x%06x (0x%06x)\n",
++			__func__, (!strcmp(part->mtd.name, ROOTFS_SPLIT_NAME) ? "updating" : "creating"),
++			(u32) part->offset, (u32) part->mtd.size);
++		name = kmalloc(sizeof(ROOTFS_SPLIT_NAME) + 1, GFP_KERNEL);
++		strcpy(name, ROOTFS_SPLIT_NAME);
++		part->mtd.name = name;
++	} else if ((offset <= 0) && mtd->split) {
++		printk(KERN_INFO "%s: removing partition \"%s\"\n", __func__, mtd->split->name);
++
++		/* mark existing partition as removed */
++		part = PART(mtd->split);
++		name = kmalloc(sizeof(ROOTFS_SPLIT_NAME) + 1, GFP_KERNEL);
++		strcpy(name, ROOTFS_REMOVED_NAME);
++		part->mtd.name = name;
++		part->offset = 0;
++		part->mtd.size = 0;
++	}
++
++	return 0;
++}
++#endif /* CONFIG_MTD_ROOTFS_SPLIT */
++
+ /*
+  * This function, given a master MTD object and a partition table, creates
+  * and registers slave MTD objects which are bound to the master according to
+@@ -659,6 +810,9 @@ int add_mtd_partitions(struct mtd_info *
+ 	struct mtd_part *slave;
+ 	uint64_t cur_offset = 0;
+ 	int i;
++#ifdef CONFIG_MTD_ROOTFS_SPLIT
++	int ret;
++#endif
+ 
+ 	printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name);
+ 
+@@ -673,12 +827,53 @@ int add_mtd_partitions(struct mtd_info *
+ 
+ 		add_mtd_device(&slave->mtd);
+ 
++		if (!strcmp(parts[i].name, "rootfs")) {
++#ifdef CONFIG_MTD_ROOTFS_ROOT_DEV
++			if (ROOT_DEV == 0) {
++				printk(KERN_NOTICE "mtd: partition \"rootfs\" "
++					"set to be root filesystem\n");
++				ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, slave->mtd.index);
++			}
++#endif
++#ifdef CONFIG_MTD_ROOTFS_SPLIT
++			ret = split_rootfs_data(master, &slave->mtd, &parts[i]);
++			/* if (ret == 0)
++			 * 	j++; */
++#endif
++		}
++
+ 		cur_offset = slave->offset + slave->mtd.size;
+ 	}
+ 
+ 	return 0;
+ }
+ 
++int mtd_device_refresh(struct mtd_info *mtd)
++{
++	int ret = 0;
++
++	if (IS_PART(mtd)) {
++		struct mtd_part *part;
++		struct mtd_info *master;
++
++		part = PART(mtd);
++		master = part->master;
++		if (master->refresh_device)
++			ret = master->refresh_device(master);
++	}
++
++	if (!ret && mtd->refresh_device)
++		ret = mtd->refresh_device(mtd);
++
++#ifdef CONFIG_MTD_ROOTFS_SPLIT
++	if (!ret && IS_PART(mtd) && !strcmp(mtd->name, "rootfs"))
++		refresh_rootfs_split(mtd);
++#endif
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(mtd_device_refresh);
++
+ static DEFINE_SPINLOCK(part_parser_lock);
+ static LIST_HEAD(part_parsers);
+ 
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -1005,6 +1005,12 @@ static int mtdchar_ioctl(struct file *fi
+ 		break;
+ 	}
+ 
++	case MTDREFRESH:
++	{
++		ret = mtd_device_refresh(mtd);
++		break;
++	}
++
+ 	default:
+ 		ret = -ENOTTY;
+ 	}
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -114,6 +114,7 @@ struct nand_ecclayout {
+ 
+ struct module;	/* only needed for owner field in mtd_info */
+ 
++struct mtd_info;
+ struct mtd_info {
+ 	u_char type;
+ 	uint32_t flags;
+@@ -214,6 +215,9 @@ struct mtd_info {
+ 	int (*block_markbad) (struct mtd_info *mtd, loff_t ofs);
+ 	int (*suspend) (struct mtd_info *mtd);
+ 	void (*resume) (struct mtd_info *mtd);
++	int (*refresh_device)(struct mtd_info *mtd);
++	struct mtd_info *split;
++
+ 	/*
+ 	 * If the driver is something smart, like UBI, it may need to maintain
+ 	 * its own reference counting. The below functions are only for driver.
+@@ -502,6 +506,7 @@ extern int mtd_device_parse_register(str
+ 			      int defnr_parts);
+ #define mtd_device_register(master, parts, nr_parts)	\
+ 	mtd_device_parse_register(master, NULL, NULL, parts, nr_parts)
++extern int mtd_device_refresh(struct mtd_info *master);
+ extern int mtd_device_unregister(struct mtd_info *master);
+ extern struct mtd_info *get_mtd_device(struct mtd_info *mtd, int num);
+ extern int __get_mtd_device(struct mtd_info *mtd);
+--- a/include/linux/mtd/partitions.h
++++ b/include/linux/mtd/partitions.h
+@@ -36,12 +36,14 @@
+  * erasesize aligned (e.g. use MTDPART_OFS_NEXTBLK).
+  */
+ 
++struct mtd_partition;
+ struct mtd_partition {
+ 	char *name;			/* identifier string */
+ 	uint64_t size;			/* partition size */
+ 	uint64_t offset;		/* offset within the master MTD space */
+ 	uint32_t mask_flags;		/* master MTD flags to mask out for this partition */
+ 	struct nand_ecclayout *ecclayout;	/* out of band layout for this partition (NAND only) */
++	int (*refresh_partition)(struct mtd_info *);
+ };
+ 
+ #define MTDPART_OFS_RETAIN	(-3)
+--- a/include/mtd/mtd-abi.h
++++ b/include/mtd/mtd-abi.h
+@@ -202,6 +202,7 @@ struct otp_info {
+  * without OOB, e.g., NOR flash.
+  */
+ #define MEMWRITE		_IOWR('M', 24, struct mtd_write_req)
++#define MTDREFRESH		_IO('M', 50)
+ 
+ /*
+  * Obsolete legacy interface. Keep it in order not to break userspace
diff --git a/target/linux/generic/patches-3.3/401-partial_eraseblock_write.patch b/target/linux/generic/patches-3.3/401-partial_eraseblock_write.patch
new file mode 100644
index 0000000..3b22cfc
--- /dev/null
+++ b/target/linux/generic/patches-3.3/401-partial_eraseblock_write.patch
@@ -0,0 +1,145 @@
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -35,6 +35,8 @@
+ 
+ #include "mtdcore.h"
+ 
++#define MTD_ERASE_PARTIAL	0x8000 /* partition only covers parts of an erase block */
++
+ /* Our partition linked list */
+ static LIST_HEAD(mtd_partitions);
+ static DEFINE_MUTEX(mtd_partitions_mutex);
+@@ -252,13 +254,60 @@ static int part_erase(struct mtd_info *m
+ 		return -EROFS;
+ 	if (instr->addr >= mtd->size)
+ 		return -EINVAL;
++
++	instr->partial_start = false;
++	if (mtd->flags & MTD_ERASE_PARTIAL) {
++		size_t readlen = 0;
++		u64 mtd_ofs;
++
++		instr->erase_buf = kmalloc(part->master->erasesize, GFP_ATOMIC);
++		if (!instr->erase_buf)
++			return -ENOMEM;
++
++		mtd_ofs = part->offset + instr->addr;
++		instr->erase_buf_ofs = do_div(mtd_ofs, part->master->erasesize);
++
++		if (instr->erase_buf_ofs > 0) {
++			instr->addr -= instr->erase_buf_ofs;
++			ret = mtd_read(part->master,
++				instr->addr + part->offset,
++				part->master->erasesize,
++				&readlen, instr->erase_buf);
++
++			instr->partial_start = true;
++		} else {
++			mtd_ofs = part->offset + part->mtd.size;
++			instr->erase_buf_ofs = part->master->erasesize -
++				do_div(mtd_ofs, part->master->erasesize);
++
++			if (instr->erase_buf_ofs > 0) {
++				instr->len += instr->erase_buf_ofs;
++				ret = mtd_read(part->master,
++					part->offset + instr->addr +
++					instr->len - part->master->erasesize,
++					part->master->erasesize, &readlen,
++					instr->erase_buf);
++			} else {
++				ret = 0;
++			}
++		}
++		if (ret < 0) {
++			kfree(instr->erase_buf);
++			return ret;
++		}
++
++	}
++
+ 	instr->addr += part->offset;
+ 	ret = mtd_erase(part->master, instr);
+ 	if (ret) {
+ 		if (instr->fail_addr != MTD_FAIL_ADDR_UNKNOWN)
+ 			instr->fail_addr -= part->offset;
+ 		instr->addr -= part->offset;
++		if (mtd->flags & MTD_ERASE_PARTIAL)
++			kfree(instr->erase_buf);
+ 	}
++
+ 	return ret;
+ }
+ 
+@@ -266,7 +315,25 @@ void mtd_erase_callback(struct erase_inf
+ {
+ 	if (instr->mtd->erase == part_erase) {
+ 		struct mtd_part *part = PART(instr->mtd);
++		size_t wrlen = 0;
+ 
++		if (instr->mtd->flags & MTD_ERASE_PARTIAL) {
++			if (instr->partial_start) {
++				part->master->write(part->master,
++					instr->addr, instr->erase_buf_ofs,
++					&wrlen, instr->erase_buf);
++				instr->addr += instr->erase_buf_ofs;
++			} else {
++				instr->len -= instr->erase_buf_ofs;
++				part->master->write(part->master,
++					instr->addr + instr->len,
++					instr->erase_buf_ofs, &wrlen,
++					instr->erase_buf +
++					part->master->erasesize -
++					instr->erase_buf_ofs);
++			}
++			kfree(instr->erase_buf);
++		}
+ 		if (instr->fail_addr != MTD_FAIL_ADDR_UNKNOWN)
+ 			instr->fail_addr -= part->offset;
+ 		instr->addr -= part->offset;
+@@ -537,18 +604,24 @@ static struct mtd_part *allocate_partiti
+ 	if ((slave->mtd.flags & MTD_WRITEABLE) &&
+ 	    mtd_mod_by_eb(slave->offset, &slave->mtd)) {
+ 		/* Doesn't start on a boundary of major erase size */
+-		/* FIXME: Let it be writable if it is on a boundary of
+-		 * _minor_ erase size though */
+-		slave->mtd.flags &= ~MTD_WRITEABLE;
+-		printk(KERN_WARNING"mtd: partition \"%s\" doesn't start on an erase block boundary -- force read-only\n",
+-			part->name);
++		slave->mtd.flags |= MTD_ERASE_PARTIAL;
++		if (((u32) slave->mtd.size) > master->erasesize)
++			slave->mtd.flags &= ~MTD_WRITEABLE;
++		else
++			slave->mtd.erasesize = slave->mtd.size;
+ 	}
+ 	if ((slave->mtd.flags & MTD_WRITEABLE) &&
+-	    mtd_mod_by_eb(slave->mtd.size, &slave->mtd)) {
+-		slave->mtd.flags &= ~MTD_WRITEABLE;
+-		printk(KERN_WARNING"mtd: partition \"%s\" doesn't end on an erase block -- force read-only\n",
+-			part->name);
++	    mtd_mod_by_eb(slave->offset + slave->mtd.size, &slave->mtd)) {
++		slave->mtd.flags |= MTD_ERASE_PARTIAL;
++
++		if ((u32) slave->mtd.size > master->erasesize)
++			slave->mtd.flags &= ~MTD_WRITEABLE;
++		else
++			slave->mtd.erasesize = slave->mtd.size;
+ 	}
++	if ((slave->mtd.flags & (MTD_ERASE_PARTIAL|MTD_WRITEABLE)) == MTD_ERASE_PARTIAL)
++		printk(KERN_WARNING"mtd: partition \"%s\" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only\n",
++				part->name);
+ 
+ 	slave->mtd.ecclayout = master->ecclayout;
+ 	if (master->block_isbad) {
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -58,6 +58,10 @@ struct erase_info {
+ 	u_long priv;
+ 	u_char state;
+ 	struct erase_info *next;
++
++	u8 *erase_buf;
++	u32 erase_buf_ofs;
++	bool partial_start;
+ };
+ 
+ struct mtd_erase_region_info {
diff --git a/target/linux/generic/patches-3.3/410-mtd_info_move_forward_decl.patch b/target/linux/generic/patches-3.3/410-mtd_info_move_forward_decl.patch
new file mode 100644
index 0000000..251f522
--- /dev/null
+++ b/target/linux/generic/patches-3.3/410-mtd_info_move_forward_decl.patch
@@ -0,0 +1,18 @@
+--- a/include/linux/mtd/partitions.h
++++ b/include/linux/mtd/partitions.h
+@@ -35,6 +35,7 @@
+  * Note: writeable partitions require their size and offset be
+  * erasesize aligned (e.g. use MTDPART_OFS_NEXTBLK).
+  */
++struct mtd_info;
+ 
+ struct mtd_partition;
+ struct mtd_partition {
+@@ -52,7 +53,6 @@ struct mtd_partition {
+ #define MTDPART_SIZ_FULL	(0)
+ 
+ 
+-struct mtd_info;
+ struct device_node;
+ 
+ /**
diff --git a/target/linux/generic/patches-3.3/420-redboot_space.patch b/target/linux/generic/patches-3.3/420-redboot_space.patch
new file mode 100644
index 0000000..fb6700b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/420-redboot_space.patch
@@ -0,0 +1,30 @@
+--- a/drivers/mtd/redboot.c
++++ b/drivers/mtd/redboot.c
+@@ -267,14 +267,21 @@ static int parse_redboot_partitions(stru
+ #endif
+ 		names += strlen(names)+1;
+ 
+-#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
+ 		if(fl->next && fl->img->flash_base + fl->img->size + master->erasesize <= fl->next->img->flash_base) {
+-			i++;
+-			parts[i].offset = parts[i-1].size + parts[i-1].offset;
+-			parts[i].size = fl->next->img->flash_base - parts[i].offset;
+-			parts[i].name = nullname;
+-		}
++			if (!strcmp(parts[i].name, "rootfs")) {
++				parts[i].size = fl->next->img->flash_base;
++				parts[i].size &= ~(master->erasesize - 1);
++				parts[i].size -= parts[i].offset;
++#ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED
++				nrparts--;
++			} else {
++				i++;
++				parts[i].offset = parts[i-1].size + parts[i-1].offset;
++				parts[i].size = fl->next->img->flash_base - parts[i].offset;
++				parts[i].name = nullname;
+ #endif
++			}
++		}
+ 		tmp_fl = fl;
+ 		fl = fl->next;
+ 		kfree(tmp_fl);
diff --git a/target/linux/generic/patches-3.3/430-mtd_myloader_partition_parser.patch b/target/linux/generic/patches-3.3/430-mtd_myloader_partition_parser.patch
new file mode 100644
index 0000000..d60126d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/430-mtd_myloader_partition_parser.patch
@@ -0,0 +1,35 @@
+--- a/drivers/mtd/Kconfig
++++ b/drivers/mtd/Kconfig
+@@ -156,6 +156,22 @@ config MTD_BCM63XX_PARTS
+ 	  This provides partions parsing for BCM63xx devices with CFE
+ 	  bootloaders.
+ 
++config MTD_MYLOADER_PARTS
++	tristate "MyLoader partition parsing"
++	depends on ADM5120 || ATHEROS_AR231X || ATHEROS_AR71XX || ATH79
++	---help---
++	  MyLoader is a bootloader which allows the user to define partitions
++	  in flash devices, by putting a table in the second erase block
++	  on the device, similar to a partition table. This table gives the 
++	  offsets and lengths of the user defined partitions.
++
++	  If you need code which can detect and parse these tables, and
++	  register MTD 'partitions' corresponding to each image detected,
++	  enable this option.
++
++	  You will still need the parsing functions to be called by the driver
++	  for your particular device. It won't happen automatically.
++
+ comment "User Modules And Translation Layers"
+ 
+ config MTD_CHAR
+--- a/drivers/mtd/Makefile
++++ b/drivers/mtd/Makefile
+@@ -12,6 +12,7 @@ obj-$(CONFIG_MTD_CMDLINE_PARTS) += cmdli
+ obj-$(CONFIG_MTD_AFS_PARTS)	+= afs.o
+ obj-$(CONFIG_MTD_AR7_PARTS)	+= ar7part.o
+ obj-$(CONFIG_MTD_BCM63XX_PARTS)	+= bcm63xxpart.o
++obj-$(CONFIG_MTD_MYLOADER_PARTS) += myloader.o
+ 
+ # 'Users' - code which presents functionality to userspace.
+ obj-$(CONFIG_MTD_CHAR)		+= mtdchar.o
diff --git a/target/linux/generic/patches-3.3/440-block2mtd_init.patch b/target/linux/generic/patches-3.3/440-block2mtd_init.patch
new file mode 100644
index 0000000..00208c8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/440-block2mtd_init.patch
@@ -0,0 +1,116 @@
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -14,6 +14,7 @@
+ #include <linux/list.h>
+ #include <linux/init.h>
+ #include <linux/mtd/mtd.h>
++#include <linux/mtd/partitions.h>
+ #include <linux/mutex.h>
+ #include <linux/mount.h>
+ #include <linux/slab.h>
+@@ -231,11 +232,12 @@ static void block2mtd_free_device(struct
+ 
+ 
+ /* FIXME: ensure that mtd->size % erase_size == 0 */
+-static struct block2mtd_dev *add_device(char *devname, int erase_size)
++static struct block2mtd_dev *add_device(char *devname, int erase_size, const char *mtdname)
+ {
+ 	const fmode_t mode = FMODE_READ | FMODE_WRITE | FMODE_EXCL;
+ 	struct block_device *bdev;
+ 	struct block2mtd_dev *dev;
++	struct mtd_partition *part;
+ 	char *name;
+ 
+ 	if (!devname)
+@@ -274,13 +276,16 @@ static struct block2mtd_dev *add_device(
+ 
+ 	/* Setup the MTD structure */
+ 	/* make the name contain the block device in */
+-	name = kasprintf(GFP_KERNEL, "block2mtd: %s", devname);
++	if (!mtdname)
++		mtdname = devname;
++	name = kmalloc(strlen(mtdname) + 1, GFP_KERNEL);
+ 	if (!name)
+ 		goto devinit_err;
+ 
++	strcpy(name, mtdname);
+ 	dev->mtd.name = name;
+ 
+-	dev->mtd.size = dev->blkdev->bd_inode->i_size & PAGE_MASK;
++	dev->mtd.size = dev->blkdev->bd_inode->i_size & PAGE_MASK & ~(erase_size - 1);
+ 	dev->mtd.erasesize = erase_size;
+ 	dev->mtd.writesize = 1;
+ 	dev->mtd.writebufsize = PAGE_SIZE;
+@@ -294,14 +299,17 @@ static struct block2mtd_dev *add_device(
+ 	dev->mtd.priv = dev;
+ 	dev->mtd.owner = THIS_MODULE;
+ 
+-	if (mtd_device_register(&dev->mtd, NULL, 0)) {
++	part = kzalloc(sizeof(struct mtd_partition), GFP_KERNEL);
++	part->name = name;
++	part->offset = 0;
++	part->size = dev->mtd.size;
++	if (mtd_device_register(&dev->mtd, part, 1)) {
+ 		/* Device didn't get added, so free the entry */
+ 		goto devinit_err;
+ 	}
+ 	list_add(&dev->list, &blkmtd_device_list);
+ 	INFO("mtd%d: [%s] erase_size = %dKiB [%d]", dev->mtd.index,
+-			dev->mtd.name + strlen("block2mtd: "),
+-			dev->mtd.erasesize >> 10, dev->mtd.erasesize);
++			mtdname, dev->mtd.erasesize >> 10, dev->mtd.erasesize);
+ 	return dev;
+ 
+ devinit_err:
+@@ -374,9 +382,9 @@ static char block2mtd_paramline[80 + 12]
+ 
+ static int block2mtd_setup2(const char *val)
+ {
+-	char buf[80 + 12]; /* 80 for device, 12 for erase size */
++	char buf[80 + 12 + 80]; /* 80 for device, 12 for erase size, 80 for name */
+ 	char *str = buf;
+-	char *token[2];
++	char *token[3];
+ 	char *name;
+ 	size_t erase_size = PAGE_SIZE;
+ 	int i, ret;
+@@ -387,7 +395,7 @@ static int block2mtd_setup2(const char *
+ 	strcpy(str, val);
+ 	kill_final_newline(str);
+ 
+-	for (i = 0; i < 2; i++)
++	for (i = 0; i < 3; i++)
+ 		token[i] = strsep(&str, ",");
+ 
+ 	if (str)
+@@ -406,8 +414,10 @@ static int block2mtd_setup2(const char *
+ 			parse_err("illegal erase size");
+ 		}
+ 	}
++	if (token[2] && (strlen(token[2]) + 1 > 80))
++		parse_err("mtd device name too long");
+ 
+-	add_device(name, erase_size);
++	add_device(name, erase_size, token[2]);
+ 
+ 	return 0;
+ }
+@@ -441,7 +451,7 @@ static int block2mtd_setup(const char *v
+ 
+ 
+ module_param_call(block2mtd, block2mtd_setup, NULL, NULL, 0200);
+-MODULE_PARM_DESC(block2mtd, "Device to use. \"block2mtd=<dev>[,<erasesize>]\"");
++MODULE_PARM_DESC(block2mtd, "Device to use. \"block2mtd=<dev>[,<erasesize>[,<name>]]\"");
+ 
+ static int __init block2mtd_init(void)
+ {
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -546,6 +546,7 @@ int invalidate_partitions(struct gendisk
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL(rescan_partitions);
+ 
+ unsigned char *read_dev_sector(struct block_device *bdev, sector_t n, Sector *p)
+ {
diff --git a/target/linux/generic/patches-3.3/441-block2mtd_refresh.patch b/target/linux/generic/patches-3.3/441-block2mtd_refresh.patch
new file mode 100644
index 0000000..979b43b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/441-block2mtd_refresh.patch
@@ -0,0 +1,291 @@
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -29,6 +29,8 @@ struct block2mtd_dev {
+ 	struct block_device *blkdev;
+ 	struct mtd_info mtd;
+ 	struct mutex write_mutex;
++	rwlock_t bdev_mutex;
++	char devname[0];
+ };
+ 
+ 
+@@ -81,6 +83,12 @@ static int block2mtd_erase(struct mtd_in
+ 	size_t len = instr->len;
+ 	int err;
+ 
++	read_lock(&dev->bdev_mutex);
++	if (!dev->blkdev) {
++		err = -EINVAL;
++		goto done;
++	}
++
+ 	instr->state = MTD_ERASING;
+ 	mutex_lock(&dev->write_mutex);
+ 	err = _block2mtd_erase(dev, from, len);
+@@ -92,6 +100,10 @@ static int block2mtd_erase(struct mtd_in
+ 		instr->state = MTD_ERASE_DONE;
+ 
+ 	mtd_erase_callback(instr);
++
++done:
++	read_unlock(&dev->bdev_mutex);
++
+ 	return err;
+ }
+ 
+@@ -103,10 +115,14 @@ static int block2mtd_read(struct mtd_inf
+ 	struct page *page;
+ 	int index = from >> PAGE_SHIFT;
+ 	int offset = from & (PAGE_SIZE-1);
+-	int cpylen;
++	int cpylen, err = 0;
++
++	read_lock(&dev->bdev_mutex);
++	if (!dev->blkdev || (from > mtd->size)) {
++		err = -EINVAL;
++		goto done;
++	}
+ 
+-	if (from > mtd->size)
+-		return -EINVAL;
+ 	if (from + len > mtd->size)
+ 		len = mtd->size - from;
+ 
+@@ -121,10 +137,14 @@ static int block2mtd_read(struct mtd_inf
+ 		len = len - cpylen;
+ 
+ 		page = page_read(dev->blkdev->bd_inode->i_mapping, index);
+-		if (!page)
+-			return -ENOMEM;
+-		if (IS_ERR(page))
+-			return PTR_ERR(page);
++		if (!page) {
++			err = -ENOMEM;
++			goto done;
++		}
++		if (IS_ERR(page)) {
++			err = PTR_ERR(page);
++			goto done;
++		}
+ 
+ 		memcpy(buf, page_address(page) + offset, cpylen);
+ 		page_cache_release(page);
+@@ -135,7 +155,10 @@ static int block2mtd_read(struct mtd_inf
+ 		offset = 0;
+ 		index++;
+ 	}
+-	return 0;
++
++done:
++	read_unlock(&dev->bdev_mutex);
++	return err;
+ }
+ 
+ 
+@@ -187,12 +210,22 @@ static int block2mtd_write(struct mtd_in
+ 		size_t *retlen, const u_char *buf)
+ {
+ 	struct block2mtd_dev *dev = mtd->priv;
+-	int err;
++	int err = 0;
++
++	read_lock(&dev->bdev_mutex);
++	if (!dev->blkdev) {
++		err = -EINVAL;
++		goto done;
++	}
+ 
+ 	if (!len)
+-		return 0;
+-	if (to >= mtd->size)
+-		return -ENOSPC;
++		goto done;
++
++	if (to >= mtd->size) {
++		err = -ENOSPC;
++		goto done;
++	}
++
+ 	if (to + len > mtd->size)
+ 		len = mtd->size - to;
+ 
+@@ -201,6 +234,9 @@ static int block2mtd_write(struct mtd_in
+ 	mutex_unlock(&dev->write_mutex);
+ 	if (err > 0)
+ 		err = 0;
++
++done:
++	read_unlock(&dev->bdev_mutex);
+ 	return err;
+ }
+ 
+@@ -209,33 +245,110 @@ static int block2mtd_write(struct mtd_in
+ static void block2mtd_sync(struct mtd_info *mtd)
+ {
+ 	struct block2mtd_dev *dev = mtd->priv;
++	read_lock(&dev->bdev_mutex);
++	if (dev->blkdev)
+ 	sync_blockdev(dev->blkdev);
++	read_unlock(&dev->bdev_mutex);
++
+ 	return;
+ }
+ 
+ 
++static int _open_bdev(struct block2mtd_dev *dev)
++{
++	const fmode_t mode = FMODE_READ | FMODE_WRITE | FMODE_EXCL;
++	struct block_device *bdev;
++
++	/* Get a handle on the device */
++	bdev = blkdev_get_by_path(dev->devname, mode, dev);
++#ifndef MODULE
++	if (IS_ERR(bdev)) {
++		dev_t devt;
++
++		/* We might not have rootfs mounted at this point. Try
++		   to resolve the device name by other means. */
++
++		devt = name_to_dev_t(dev->devname);
++		if (devt)
++			bdev = blkdev_get_by_dev(devt, mode, dev);
++	}
++#endif
++
++	if (IS_ERR(bdev)) {
++		ERROR("error: cannot open device %s", dev->devname);
++		return 1;
++	}
++	dev->blkdev = bdev;
++
++	if (MAJOR(bdev->bd_dev) == MTD_BLOCK_MAJOR) {
++		ERROR("attempting to use an MTD device as a block device");
++		return 1;
++	}
++
++	return 0;
++}
++
++static void _close_bdev(struct block2mtd_dev *dev)
++{
++	struct block_device *bdev;
++
++	if (!dev->blkdev)
++		return;
++
++	bdev = dev->blkdev;
++	invalidate_mapping_pages(dev->blkdev->bd_inode->i_mapping, 0, -1);
++	blkdev_put(dev->blkdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
++	dev->blkdev = NULL;
++}
++
+ static void block2mtd_free_device(struct block2mtd_dev *dev)
+ {
+ 	if (!dev)
+ 		return;
+ 
+ 	kfree(dev->mtd.name);
+-
+-	if (dev->blkdev) {
+-		invalidate_mapping_pages(dev->blkdev->bd_inode->i_mapping,
+-					0, -1);
+-		blkdev_put(dev->blkdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+-	}
+-
++	_close_bdev(dev);
+ 	kfree(dev);
+ }
+ 
+ 
+-/* FIXME: ensure that mtd->size % erase_size == 0 */
+-static struct block2mtd_dev *add_device(char *devname, int erase_size, const char *mtdname)
++static int block2mtd_refresh(struct mtd_info *mtd)
+ {
+-	const fmode_t mode = FMODE_READ | FMODE_WRITE | FMODE_EXCL;
++	struct block2mtd_dev *dev = mtd->priv;
+ 	struct block_device *bdev;
++	dev_t devt;
++	int err = 0;
++
++	/* no other mtd function can run at this point */
++	write_lock(&dev->bdev_mutex);
++
++	/* get the device number for the whole disk */
++	devt = MKDEV(MAJOR(dev->blkdev->bd_dev), 0);
++
++	/* close the old block device */
++	_close_bdev(dev);
++
++	/* open the whole disk, issue a partition rescan, then */
++	bdev = blkdev_get_by_dev(devt, FMODE_WRITE | FMODE_READ, mtd);
++	if (!bdev || !bdev->bd_disk)
++		err = -EINVAL;
++#ifndef CONFIG_MTD_BLOCK2MTD_MODULE
++	else
++		err = rescan_partitions(bdev->bd_disk, bdev);
++#endif
++	if (bdev)
++		blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
++
++	/* try to open the partition block device again */
++	_open_bdev(dev);
++	write_unlock(&dev->bdev_mutex);
++
++	return err;
++}
++
++/* FIXME: ensure that mtd->size % erase_size == 0 */
++static struct block2mtd_dev *add_device(char *devname, int erase_size, char *mtdname)
++{
+ 	struct block2mtd_dev *dev;
+ 	struct mtd_partition *part;
+ 	char *name;
+@@ -243,36 +356,17 @@ static struct block2mtd_dev *add_device(
+ 	if (!devname)
+ 		return NULL;
+ 
+-	dev = kzalloc(sizeof(struct block2mtd_dev), GFP_KERNEL);
++	dev = kzalloc(sizeof(struct block2mtd_dev) + strlen(devname) + 1, GFP_KERNEL);
+ 	if (!dev)
+ 		return NULL;
+ 
+-	/* Get a handle on the device */
+-	bdev = blkdev_get_by_path(devname, mode, dev);
+-#ifndef MODULE
+-	if (IS_ERR(bdev)) {
+-
+-		/* We might not have rootfs mounted at this point. Try
+-		   to resolve the device name by other means. */
++	strcpy(dev->devname, devname);
+ 
+-		dev_t devt = name_to_dev_t(devname);
+-		if (devt)
+-			bdev = blkdev_get_by_dev(devt, mode, dev);
+-	}
+-#endif
+-
+-	if (IS_ERR(bdev)) {
+-		ERROR("error: cannot open device %s", devname);
++	if (_open_bdev(dev))
+ 		goto devinit_err;
+-	}
+-	dev->blkdev = bdev;
+-
+-	if (MAJOR(bdev->bd_dev) == MTD_BLOCK_MAJOR) {
+-		ERROR("attempting to use an MTD device as a block device");
+-		goto devinit_err;
+-	}
+ 
+ 	mutex_init(&dev->write_mutex);
++	rwlock_init(&dev->bdev_mutex);
+ 
+ 	/* Setup the MTD structure */
+ 	/* make the name contain the block device in */
+@@ -298,6 +392,7 @@ static struct block2mtd_dev *add_device(
+ 	dev->mtd.read = block2mtd_read;
+ 	dev->mtd.priv = dev;
+ 	dev->mtd.owner = THIS_MODULE;
++	dev->mtd.refresh_device = block2mtd_refresh;
+ 
+ 	part = kzalloc(sizeof(struct mtd_partition), GFP_KERNEL);
+ 	part->name = name;
diff --git a/target/linux/generic/patches-3.3/442-block2mtd_probe.patch b/target/linux/generic/patches-3.3/442-block2mtd_probe.patch
new file mode 100644
index 0000000..c427e9f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/442-block2mtd_probe.patch
@@ -0,0 +1,10 @@
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -268,6 +268,7 @@ static int _open_bdev(struct block2mtd_d
+ 		/* We might not have rootfs mounted at this point. Try
+ 		   to resolve the device name by other means. */
+ 
++		wait_for_device_probe();
+ 		devt = name_to_dev_t(dev->devname);
+ 		if (devt)
+ 			bdev = blkdev_get_by_dev(devt, mode, dev);
diff --git a/target/linux/generic/patches-3.3/443-block2mtd-avoid-recursive-call-of-mtd_writev.patch b/target/linux/generic/patches-3.3/443-block2mtd-avoid-recursive-call-of-mtd_writev.patch
new file mode 100644
index 0000000..0ce9368
--- /dev/null
+++ b/target/linux/generic/patches-3.3/443-block2mtd-avoid-recursive-call-of-mtd_writev.patch
@@ -0,0 +1,10 @@
+--- a/drivers/mtd/devices/block2mtd.c
++++ b/drivers/mtd/devices/block2mtd.c
+@@ -388,7 +388,6 @@ static struct block2mtd_dev *add_device(
+ 	dev->mtd.flags = MTD_CAP_RAM;
+ 	dev->mtd.erase = block2mtd_erase;
+ 	dev->mtd.write = block2mtd_write;
+-	dev->mtd.writev = mtd_writev;
+ 	dev->mtd.sync = block2mtd_sync;
+ 	dev->mtd.read = block2mtd_read;
+ 	dev->mtd.priv = dev;
diff --git a/target/linux/generic/patches-3.3/450-mtd_plat_nand_chip_fixup.patch b/target/linux/generic/patches-3.3/450-mtd_plat_nand_chip_fixup.patch
new file mode 100644
index 0000000..fd2b9b5
--- /dev/null
+++ b/target/linux/generic/patches-3.3/450-mtd_plat_nand_chip_fixup.patch
@@ -0,0 +1,37 @@
+---
+ drivers/mtd/nand/plat_nand.c |   13 ++++++++++++-
+ include/linux/mtd/nand.h     |    1 +
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -622,6 +622,7 @@ struct platform_nand_chip {
+ 	unsigned int options;
+ 	unsigned int bbt_options;
+ 	const char **part_probe_types;
++	int (*chip_fixup)(struct mtd_info *mtd);
+ };
+ 
+ /* Keep gcc happy */
+--- a/drivers/mtd/nand/plat_nand.c
++++ b/drivers/mtd/nand/plat_nand.c
+@@ -93,7 +93,18 @@ static int __devinit plat_nand_probe(str
+ 	}
+ 
+ 	/* Scan to find existence of the device */
+-	if (nand_scan(&data->mtd, pdata->chip.nr_chips)) {
++	if (nand_scan_ident(&data->mtd, pdata->chip.nr_chips, NULL)) {
++		err = -ENXIO;
++		goto out;
++	}
++
++	if (pdata->chip.chip_fixup) {
++		err = pdata->chip.chip_fixup(&data->mtd);
++		if (err)
++			goto out;
++	}
++
++	if (nand_scan_tail(&data->mtd)) {
+ 		err = -ENXIO;
+ 		goto out;
+ 	}
diff --git a/target/linux/generic/patches-3.3/451-mtd_fix_nand_correct_data_return_code.patch b/target/linux/generic/patches-3.3/451-mtd_fix_nand_correct_data_return_code.patch
new file mode 100644
index 0000000..2f72d85
--- /dev/null
+++ b/target/linux/generic/patches-3.3/451-mtd_fix_nand_correct_data_return_code.patch
@@ -0,0 +1,12 @@
+--- a/drivers/mtd/nand/nand_ecc.c
++++ b/drivers/mtd/nand/nand_ecc.c
+@@ -507,8 +507,7 @@ int __nand_correct_data(unsigned char *b
+ 	if ((bitsperbyte[b0] + bitsperbyte[b1] + bitsperbyte[b2]) == 1)
+ 		return 1;	/* error in ECC data; no action needed */
+ 
+-	printk(KERN_ERR "uncorrectable error : ");
+-	return -1;
++	return -EBADMSG;
+ }
+ EXPORT_SYMBOL(__nand_correct_data);
+ 
diff --git a/target/linux/generic/patches-3.3/460-cfi_cmdset_0002_no_erase_suspend.patch b/target/linux/generic/patches-3.3/460-cfi_cmdset_0002_no_erase_suspend.patch
new file mode 100644
index 0000000..0c4b9be
--- /dev/null
+++ b/target/linux/generic/patches-3.3/460-cfi_cmdset_0002_no_erase_suspend.patch
@@ -0,0 +1,11 @@
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -682,7 +682,7 @@ static int get_chip(struct map_info *map
+ 		return 0;
+ 
+ 	case FL_ERASING:
+-		if (!cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
++		if (1 /* no suspend */ || !cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
+ 		    !(mode == FL_READY || mode == FL_POINT ||
+ 		    (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
+ 			goto sleep;
diff --git a/target/linux/generic/patches-3.3/470-mtd_m25p80_add_pm25lv_flash_support.patch b/target/linux/generic/patches-3.3/470-mtd_m25p80_add_pm25lv_flash_support.patch
new file mode 100644
index 0000000..ff27d04
--- /dev/null
+++ b/target/linux/generic/patches-3.3/470-mtd_m25p80_add_pm25lv_flash_support.patch
@@ -0,0 +1,39 @@
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -45,6 +45,7 @@
+ #define	OPCODE_BE_4K		0x20	/* Erase 4KiB block */
+ #define	OPCODE_BE_32K		0x52	/* Erase 32KiB block */
+ #define	OPCODE_CHIP_ERASE	0xc7	/* Erase whole flash chip */
++#define	OPCODE_BE_4K_PMC	0xd7	/* Erase 4KiB block on PMC chips*/
+ #define	OPCODE_SE		0xd8	/* Sector erase (usually 64KiB) */
+ #define	OPCODE_RDID		0x9f	/* Read JEDEC ID */
+ 
+@@ -625,6 +626,7 @@ struct flash_info {
+ 	u16		flags;
+ #define	SECT_4K		0x01		/* OPCODE_BE_4K works uniformly */
+ #define	M25P_NO_ERASE	0x02		/* No erase command needed */
++#define	SECT_4K_PMC	0x04		/* OPCODE_BE_4K_PMC works uniformly */
+ };
+ 
+ #define INFO(_jedec_id, _ext_id, _sector_size, _n_sectors, _flags)	\
+@@ -686,6 +688,10 @@ static const struct spi_device_id m25p_i
+ 	{ "mx25l25635e", INFO(0xc22019, 0, 64 * 1024, 512, 0) },
+ 	{ "mx25l25655e", INFO(0xc22619, 0, 64 * 1024, 512, 0) },
+ 
++	/* PMC -- pm25x "blocks" are 32K, sectors are 4K */
++	{ "pm25lv512", INFO(0, 0, 32 * 1024, 2, SECT_4K_PMC) },
++	{ "pm25lv010", INFO(0, 0, 32 * 1024, 4, SECT_4K_PMC) },
++
+ 	/* Spansion -- single (large) sector size only, at least
+ 	 * for the chips listed here (without boot sectors).
+ 	 */
+@@ -921,6 +927,9 @@ static int __devinit m25p_probe(struct s
+ 	if (info->flags & SECT_4K) {
+ 		flash->erase_opcode = OPCODE_BE_4K;
+ 		flash->mtd.erasesize = 4096;
++	} else if (info->flags & SECT_4K_PMC) {
++		flash->erase_opcode = OPCODE_BE_4K_PMC;
++		flash->mtd.erasesize = 4096;
+ 	} else {
+ 		flash->erase_opcode = OPCODE_SE;
+ 		flash->mtd.erasesize = info->sector_size;
diff --git a/target/linux/generic/patches-3.3/473-mtd_m25p80_add_w25q128.patch b/target/linux/generic/patches-3.3/473-mtd_m25p80_add_w25q128.patch
new file mode 100644
index 0000000..b00c9fa
--- /dev/null
+++ b/target/linux/generic/patches-3.3/473-mtd_m25p80_add_w25q128.patch
@@ -0,0 +1,10 @@
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -765,6 +765,7 @@ static const struct spi_device_id m25p_i
+ 	{ "w25q32", INFO(0xef4016, 0, 64 * 1024,  64, SECT_4K) },
+ 	{ "w25x64", INFO(0xef3017, 0, 64 * 1024, 128, SECT_4K) },
+ 	{ "w25q64", INFO(0xef4017, 0, 64 * 1024, 128, SECT_4K) },
++	{ "w25q128", INFO(0xef4018, 0, 64 * 1024, 256, SECT_4K) },
+ 
+ 	/* Catalyst / On Semiconductor -- non-JEDEC */
+ 	{ "cat25c11", CAT25_INFO(  16, 8, 16, 1) },
diff --git a/target/linux/generic/patches-3.3/475-mtd_cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch b/target/linux/generic/patches-3.3/475-mtd_cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
new file mode 100644
index 0000000..3b43535
--- /dev/null
+++ b/target/linux/generic/patches-3.3/475-mtd_cfi_cmdset_0002-add-buffer-write-cmd-timeout.patch
@@ -0,0 +1,18 @@
+From: George Kashperko <george@znau.edu.ua>
+
+Issue map read after Write Buffer Load command to ensure chip is ready
+to receive data.
+Signed-off-by: George Kashperko <george@znau.edu.ua>
+---
+ drivers/mtd/chips/cfi_cmdset_0002.c |    1 +
+ 1 file changed, 1 insertion(+)
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -1409,6 +1409,7 @@ static int __xipram do_write_buffer(stru
+ 
+ 	/* Write Buffer Load */
+ 	map_write(map, CMD(0x25), cmd_adr);
++	(void) map_read(map, cmd_adr);
+ 
+ 	chip->state = FL_WRITING_TO_BUFFER;
+ 
diff --git a/target/linux/generic/patches-3.3/476-mtd-m25p80-allow-to-disable-small-sector-erase.patch b/target/linux/generic/patches-3.3/476-mtd-m25p80-allow-to-disable-small-sector-erase.patch
new file mode 100644
index 0000000..231d454
--- /dev/null
+++ b/target/linux/generic/patches-3.3/476-mtd-m25p80-allow-to-disable-small-sector-erase.patch
@@ -0,0 +1,41 @@
+--- a/drivers/mtd/devices/Kconfig
++++ b/drivers/mtd/devices/Kconfig
+@@ -102,6 +102,14 @@ config M25PXX_USE_FAST_READ
+ 	help
+ 	  This option enables FAST_READ access supported by ST M25Pxx.
+ 
++config M25PXX_PREFER_SMALL_SECTOR_ERASE
++	bool "Prefer small sector erase"
++	depends on MTD_M25P80
++	default y
++	help
++	  This option enables use of the small erase sectors if that is
++	  supported by the flash chip.
++
+ config MTD_SST25L
+ 	tristate "Support SST25L (non JEDEC) SPI Flash chips"
+ 	depends on SPI_MASTER
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -84,6 +84,12 @@
+ 
+ #define JEDEC_MFR(_jedec_id)	((_jedec_id) >> 16)
+ 
++#ifdef CONFIG_M25PXX_PREFER_SMALL_SECTOR_ERASE
++#define PREFER_SMALL_SECTOR_ERASE 1
++#else
++#define PREFER_SMALL_SECTOR_ERASE 0
++#endif
++
+ /****************************************************************************/
+ 
+ struct m25p {
+@@ -925,7 +931,7 @@ static int __devinit m25p_probe(struct s
+ 		flash->mtd.write = m25p80_write;
+ 
+ 	/* prefer "small sector" erase if possible */
+-	if (info->flags & SECT_4K) {
++	if (PREFER_SMALL_SECTOR_ERASE && (info->flags & SECT_4K)) {
+ 		flash->erase_opcode = OPCODE_BE_4K;
+ 		flash->mtd.erasesize = 4096;
+ 	} else if (info->flags & SECT_4K_PMC) {
diff --git a/target/linux/generic/patches-3.3/477-mtd-m25p80-add-support-for-the-EON-EN25Q64-chip.patch b/target/linux/generic/patches-3.3/477-mtd-m25p80-add-support-for-the-EON-EN25Q64-chip.patch
new file mode 100644
index 0000000..439cbde
--- /dev/null
+++ b/target/linux/generic/patches-3.3/477-mtd-m25p80-add-support-for-the-EON-EN25Q64-chip.patch
@@ -0,0 +1,10 @@
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -677,6 +677,7 @@ static const struct spi_device_id m25p_i
+ 	{ "en25p32", INFO(0x1c2016, 0, 64 * 1024,  64, 0) },
+ 	{ "en25q32b", INFO(0x1c3016, 0, 64 * 1024,  64, 0) },
+ 	{ "en25p64", INFO(0x1c2017, 0, 64 * 1024, 128, 0) },
++	{ "en25q64", INFO(0x1c3017, 0, 64 * 1024, 128, SECT_4K) },
+ 
+ 	/* Intel/Numonyx -- xxxs33b */
+ 	{ "160s33b",  INFO(0x898911, 0, 64 * 1024,  32, 0) },
diff --git a/target/linux/generic/patches-3.3/478-mtd-partial_eraseblock_unlock.patch b/target/linux/generic/patches-3.3/478-mtd-partial_eraseblock_unlock.patch
new file mode 100644
index 0000000..de4481a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/478-mtd-partial_eraseblock_unlock.patch
@@ -0,0 +1,18 @@
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -356,7 +356,14 @@ static int part_unlock(struct mtd_info *
+ 	struct mtd_part *part = PART(mtd);
+ 	if ((len + ofs) > mtd->size)
+ 		return -EINVAL;
+-	return mtd_unlock(part->master, ofs + part->offset, len);
++
++	ofs += part->offset;
++	if (mtd->flags & MTD_ERASE_PARTIAL) {
++		/* round up len to next erasesize and round down offset to prev block */
++		len = (mtd_div_by_eb(len, part->master) + 1) * part->master->erasesize;
++		ofs &= ~(part->master->erasesize - 1);
++	}
++	return mtd_unlock(part->master, ofs, len);
+ }
+ 
+ static int part_is_locked(struct mtd_info *mtd, loff_t ofs, uint64_t len)
diff --git a/target/linux/generic/patches-3.3/500-yaffs-Kbuild-integration.patch b/target/linux/generic/patches-3.3/500-yaffs-Kbuild-integration.patch
new file mode 100644
index 0000000..7776dcf
--- /dev/null
+++ b/target/linux/generic/patches-3.3/500-yaffs-Kbuild-integration.patch
@@ -0,0 +1,18 @@
+--- a/fs/Kconfig
++++ b/fs/Kconfig
+@@ -35,6 +35,7 @@ source "fs/gfs2/Kconfig"
+ source "fs/ocfs2/Kconfig"
+ source "fs/btrfs/Kconfig"
+ source "fs/nilfs2/Kconfig"
++source "fs/yaffs2/Kconfig"
+ 
+ endif # BLOCK
+ 
+--- a/fs/Makefile
++++ b/fs/Makefile
+@@ -125,3 +125,5 @@ obj-$(CONFIG_GFS2_FS)           += gfs2/
+ obj-y				+= exofs/ # Multiple modules
+ obj-$(CONFIG_CEPH_FS)		+= ceph/
+ obj-$(CONFIG_PSTORE)		+= pstore/
++obj-$(CONFIG_YAFFS_FS)		+= yaffs2/
++
diff --git a/target/linux/generic/patches-3.3/501-yaffs-Fix-directory-unlinking-in-yaffs1-mode.patch b/target/linux/generic/patches-3.3/501-yaffs-Fix-directory-unlinking-in-yaffs1-mode.patch
new file mode 100644
index 0000000..d2bad01
--- /dev/null
+++ b/target/linux/generic/patches-3.3/501-yaffs-Fix-directory-unlinking-in-yaffs1-mode.patch
@@ -0,0 +1,31 @@
+From 2505e8b0a13d3d5c5bbeaaae4eb889864f44c9df Mon Sep 17 00:00:00 2001
+From: Charles Manning <cdhmanning@gmail.com>
+Date: Thu, 3 Feb 2011 05:55:30 +1300
+Subject: [PATCH] yaffs: Fix directory unlinking in yaffs1 mode
+
+commit 964b3425a71890e6701c830e38b04d8557c04f49 upstream.
+
+Treat both yaffs2 and yaffs1 paths the same.
+
+Signed-off-by: Charles Manning <cdhmanning@gmail.com>
+---
+ yaffs_guts.c |    8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/fs/yaffs2/yaffs_guts.c
++++ b/fs/yaffs2/yaffs_guts.c
+@@ -1708,13 +1708,7 @@ static int yaffs_change_obj_name(yaffs_o
+ 		YBUG();
+ 	}
+ 
+-	/* TODO: Do we need this different handling for YAFFS2 and YAFFS1?? */
+-	if (obj->my_dev->param.is_yaffs2)
+-		unlinkOp = (new_dir == obj->my_dev->unlinked_dir);
+-	else
+-		unlinkOp = (new_dir == obj->my_dev->unlinked_dir
+-			    && obj->variant_type == YAFFS_OBJECT_TYPE_FILE);
+-
++	unlinkOp = (new_dir == obj->my_dev->unlinked_dir);
+ 	deleteOp = (new_dir == obj->my_dev->del_dir);
+ 
+ 	existingTarget = yaffs_find_by_name(new_dir, new_name);
diff --git a/target/linux/generic/patches-3.3/502-yaffs-Switch-from-semaphores-to-mutexes.patch b/target/linux/generic/patches-3.3/502-yaffs-Switch-from-semaphores-to-mutexes.patch
new file mode 100644
index 0000000..8d1872e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/502-yaffs-Switch-from-semaphores-to-mutexes.patch
@@ -0,0 +1,138 @@
+From c0c289363e84c53b5872f7c0c5069045096dca07 Mon Sep 17 00:00:00 2001
+From: Charles Manning <cdhmanning@gmail.com>
+Date: Wed, 3 Nov 2010 16:01:12 +1300
+Subject: [PATCH] yaffs: Switch from semaphores to mutexes
+
+commit 73c54aa8c1de3f61a4c211cd47431293a6092f18 upstream.
+
+Mutex is faster and init_MUTEX has been deprecated, so we'll just switch
+to mutexes.
+
+Signed-off-by: Charles Manning <cdhmanning@gmail.com>
+---
+ yaffs_linux.h     |    2 +-
+ yaffs_vfs.c       |   24 ++++++++++++------------
+ yaffs_vfs_multi.c |   26 +++++++++++++-------------
+ 3 files changed, 26 insertions(+), 26 deletions(-)
+
+--- a/fs/yaffs2/yaffs_linux.h
++++ b/fs/yaffs2/yaffs_linux.h
+@@ -25,7 +25,7 @@ struct yaffs_LinuxContext {
+ 	struct super_block * superBlock;
+ 	struct task_struct *bgThread; /* Background thread for this device */
+ 	int bgRunning;
+-        struct semaphore grossLock;     /* Gross locking semaphore */
++	struct mutex grossLock;	/* Gross locking mutex*/
+ 	__u8 *spareBuffer;      /* For mtdif2 use. Don't know the size of the buffer
+ 				 * at compile time so we have to allocate it.
+ 				 */
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -515,14 +515,14 @@ static unsigned yaffs_gc_control_callbac
+ static void yaffs_gross_lock(yaffs_dev_t *dev)
+ {
+ 	T(YAFFS_TRACE_LOCK, (TSTR("yaffs locking %p\n"), current));
+-	down(&(yaffs_dev_to_lc(dev)->grossLock));
++	mutex_lock(&(yaffs_dev_to_lc(dev)->grossLock));
+ 	T(YAFFS_TRACE_LOCK, (TSTR("yaffs locked %p\n"), current));
+ }
+ 
+ static void yaffs_gross_unlock(yaffs_dev_t *dev)
+ {
+ 	T(YAFFS_TRACE_LOCK, (TSTR("yaffs unlocking %p\n"), current));
+-	up(&(yaffs_dev_to_lc(dev)->grossLock));
++	mutex_unlock(&(yaffs_dev_to_lc(dev)->grossLock));
+ }
+ 
+ #ifdef YAFFS_COMPILE_EXPORTFS
+@@ -2542,7 +2542,7 @@ static void yaffs_read_inode(struct inod
+ #endif
+ 
+ static YLIST_HEAD(yaffs_context_list);
+-struct semaphore yaffs_context_lock;
++struct mutex yaffs_context_lock;
+ 
+ static void yaffs_put_super(struct super_block *sb)
+ {
+@@ -2568,9 +2568,9 @@ static void yaffs_put_super(struct super
+ 
+ 	yaffs_gross_unlock(dev);
+ 
+-	down(&yaffs_context_lock);
++	mutex_lock(&yaffs_context_lock);
+ 	ylist_del_init(&(yaffs_dev_to_lc(dev)->contextList));
+-	up(&yaffs_context_lock);
++	mutex_unlock(&yaffs_context_lock);
+ 
+ 	if (yaffs_dev_to_lc(dev)->spareBuffer) {
+ 		YFREE(yaffs_dev_to_lc(dev)->spareBuffer);
+@@ -3016,7 +3016,7 @@ static struct super_block *yaffs_interna
+ 	param->skip_checkpt_rd = options.skip_checkpoint_read;
+ 	param->skip_checkpt_wr = options.skip_checkpoint_write;
+ 
+-	down(&yaffs_context_lock);
++	mutex_lock(&yaffs_context_lock);
+ 	/* Get a mount id */
+ 	found = 0;
+ 	for(mount_id=0; ! found; mount_id++){
+@@ -3030,13 +3030,13 @@ static struct super_block *yaffs_interna
+ 	context->mount_id = mount_id;
+ 
+ 	ylist_add_tail(&(yaffs_dev_to_lc(dev)->contextList), &yaffs_context_list);
+-	up(&yaffs_context_lock);
++	mutex_unlock(&yaffs_context_lock);
+ 
+         /* Directory search handling...*/
+         YINIT_LIST_HEAD(&(yaffs_dev_to_lc(dev)->searchContexts));
+         param->remove_obj_fn = yaffs_remove_obj_callback;
+ 
+-	init_MUTEX(&(yaffs_dev_to_lc(dev)->grossLock));
++	mutex_init(&(yaffs_dev_to_lc(dev)->grossLock));
+ 
+ 	yaffs_gross_lock(dev);
+ 
+@@ -3268,7 +3268,7 @@ static int yaffs_proc_read(char *page,
+ 	else {
+ 		step-=2;
+ 		
+-		down(&yaffs_context_lock);
++		mutex_lock(&yaffs_context_lock);
+ 
+ 		/* Locate and print the Nth entry.  Order N-squared but N is small. */
+ 		ylist_for_each(item, &yaffs_context_list) {
+@@ -3287,7 +3287,7 @@ static int yaffs_proc_read(char *page,
+ 			
+ 			break;
+ 		}
+-		up(&yaffs_context_lock);
++		mutex_unlock(&yaffs_context_lock);
+ 	}
+ 
+ 	return buf - page < count ? buf - page : count;
+@@ -3301,7 +3301,7 @@ static int yaffs_stats_proc_read(char *p
+ 	char *buf = page;
+ 	int n = 0;
+ 
+-	down(&yaffs_context_lock);
++	mutex_lock(&yaffs_context_lock);
+ 
+ 	/* Locate and print the Nth entry.  Order N-squared but N is small. */
+ 	ylist_for_each(item, &yaffs_context_list) {
+@@ -3317,7 +3317,7 @@ static int yaffs_stats_proc_read(char *p
+ 				dev->bg_gcs, dev->oldest_dirty_gc_count,
+ 				dev->n_obj, dev->n_tnodes);
+ 	}
+-	up(&yaffs_context_lock);
++	mutex_unlock(&yaffs_context_lock);
+ 
+ 
+ 	return buf - page < count ? buf - page : count;
+@@ -3494,7 +3494,7 @@ static int __init init_yaffs_fs(void)
+ 
+ 
+ 
+-	init_MUTEX(&yaffs_context_lock);
++	mutex_init(&yaffs_context_lock);
+ 
+ 	/* Install the proc_fs entries */
+ 	my_proc_entry = create_proc_entry("yaffs",
diff --git a/target/linux/generic/patches-3.3/503-yaffs-Replace-yaffs_dir_llseek-with-Linux-generic-ll.patch b/target/linux/generic/patches-3.3/503-yaffs-Replace-yaffs_dir_llseek-with-Linux-generic-ll.patch
new file mode 100644
index 0000000..d283e85
--- /dev/null
+++ b/target/linux/generic/patches-3.3/503-yaffs-Replace-yaffs_dir_llseek-with-Linux-generic-ll.patch
@@ -0,0 +1,72 @@
+From cd6657c4bde20886b0805ea9f2cbac7ec25ac2e5 Mon Sep 17 00:00:00 2001
+From: Charles Manning <cdhmanning@gmail.com>
+Date: Tue, 30 Nov 2010 16:01:28 +1300
+Subject: [PATCH 1/2] yaffs: Replace yaffs_dir_llseek with Linux generic
+ llseek
+
+commit ed8188fb7659cfb65b5adbe154d143190ade0324 upstream.
+
+There was not much point in having the yaffs version as it is
+functionally equivalent to the kernel one.
+
+This also gets rid of using BKL in yaffs2.
+
+Signed-off-by: Charles Manning <cdhmanning@gmail.com>
+---
+ yaffs_vfs.c       |   30 +-----------------------------
+ yaffs_vfs_multi.c |   30 +-----------------------------
+ 2 files changed, 2 insertions(+), 58 deletions(-)
+
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -342,8 +342,6 @@ static int yaffs_follow_link(struct dent
+ 
+ static void yaffs_touch_super(yaffs_dev_t *dev);
+ 
+-static loff_t yaffs_dir_llseek(struct file *file, loff_t offset, int origin);
+-
+ static int yaffs_vfs_setattr(struct inode *, struct iattr *);
+ 
+ 
+@@ -460,7 +458,7 @@ static const struct file_operations yaff
+ 	.read = generic_read_dir,
+ 	.readdir = yaffs_readdir,
+ 	.fsync = yaffs_sync_object,
+-	.llseek = yaffs_dir_llseek,
++	.llseek = generic_file_llseek,
+ };
+ 
+ static const struct super_operations yaffs_super_ops = {
+@@ -1534,32 +1532,6 @@ static void yaffs_release_space(struct f
+ }
+ 
+ 
+-static loff_t yaffs_dir_llseek(struct file *file, loff_t offset, int origin)
+-{
+-	long long retval;
+-
+-	lock_kernel();
+-
+-	switch (origin){
+-	case 2:
+-		offset += i_size_read(file->f_path.dentry->d_inode);
+-		break;
+-	case 1:
+-		offset += file->f_pos;
+-	}
+-	retval = -EINVAL;
+-
+-	if (offset >= 0){
+-		if (offset != file->f_pos)
+-			file->f_pos = offset;
+-
+-		retval = offset;
+-	}
+-	unlock_kernel();
+-	return retval;
+-}
+-
+-
+ static int yaffs_readdir(struct file *f, void *dirent, filldir_t filldir)
+ {
+ 	yaffs_obj_t *obj;
diff --git a/target/linux/generic/patches-3.3/504-yaffs-Mods-for-Linux-3.0-and-fix-a-typo.patch b/target/linux/generic/patches-3.3/504-yaffs-Mods-for-Linux-3.0-and-fix-a-typo.patch
new file mode 100644
index 0000000..1b814e9
--- /dev/null
+++ b/target/linux/generic/patches-3.3/504-yaffs-Mods-for-Linux-3.0-and-fix-a-typo.patch
@@ -0,0 +1,110 @@
+From e1537a700c2e750c5eacc5ad93f30821f1e94424 Mon Sep 17 00:00:00 2001
+From: Charles Manning <cdhmanning@gmail.com>
+Date: Mon, 15 Aug 2011 11:40:30 +1200
+Subject: [PATCH 2/2] Mods for Linux 3.0 and fix a typo
+
+commit a7b5dcf904ba6f7890e4b77ce1f56388b855d0f6 upstream.
+
+Roll in NCB's patch and some other changes for Linux 3.0.
+Also fix a dumb type retired_writes->retried_writes
+
+Signed-off-by: Charles Manning <cdhmanning@gmail.com>
+---
+ patch-ker.sh      |    2 +-
+ yaffs_vfs_glue.c |   42 ++++++++++++++++++++++++++++++++++--------
+ 2 files changed, 35 insertions(+), 9 deletions(-)
+
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -72,7 +72,9 @@
+ #include <linux/init.h>
+ #include <linux/fs.h>
+ #include <linux/proc_fs.h>
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 39))
+ #include <linux/smp_lock.h>
++#endif
+ #include <linux/pagemap.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/interrupt.h>
+@@ -236,7 +238,9 @@ static int yaffs_file_flush(struct file
+ static int yaffs_file_flush(struct file *file);
+ #endif
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 34))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++static int yaffs_sync_object(struct file *file, loff_t start, loff_t end, int datasync);
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 34))
+ static int yaffs_sync_object(struct file *file, int datasync);
+ #else
+ static int yaffs_sync_object(struct file *file, struct dentry *dentry,
+@@ -1864,7 +1868,9 @@ static int yaffs_symlink(struct inode *d
+ 	return -ENOMEM;
+ }
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 34))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++static int yaffs_sync_object(struct file *file, loff_t start, loff_t end, int datasync)
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 34))
+ static int yaffs_sync_object(struct file *file, int datasync)
+ #else
+ static int yaffs_sync_object(struct file *file, struct dentry *dentry,
+@@ -3067,7 +3073,13 @@ static int yaffs_internal_read_super_mtd
+ 	return yaffs_internal_read_super(1, sb, data, silent) ? 0 : -EINVAL;
+ }
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++static struct dentry *yaffs_mount(struct file_system_type *fs_type, int flags,
++        const char *dev_name, void *data)
++{
++    return mount_bdev(fs_type, flags, dev_name, data, yaffs_internal_read_super_mtd);
++}
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
+ static int yaffs_read_super(struct file_system_type *fs,
+ 			    int flags, const char *dev_name,
+ 			    void *data, struct vfsmount *mnt)
+@@ -3090,8 +3102,12 @@ static struct super_block *yaffs_read_su
+ static struct file_system_type yaffs_fs_type = {
+ 	.owner = THIS_MODULE,
+ 	.name = "yaffs",
+-	.get_sb = yaffs_read_super,
+-	.kill_sb = kill_block_super,
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++        .mount = yaffs_mount,
++#else
++        .get_sb = yaffs_read_super,
++#endif
++     	.kill_sb = kill_block_super,
+ 	.fs_flags = FS_REQUIRES_DEV,
+ };
+ #else
+@@ -3115,7 +3131,13 @@ static int yaffs2_internal_read_super_mt
+ 	return yaffs_internal_read_super(2, sb, data, silent) ? 0 : -EINVAL;
+ }
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++static struct dentry *yaffs2_mount(struct file_system_type *fs_type, int flags,
++        const char *dev_name, void *data)
++{
++        return mount_bdev(fs_type, flags, dev_name, data, yaffs2_internal_read_super_mtd);
++}
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
+ static int yaffs2_read_super(struct file_system_type *fs,
+ 			int flags, const char *dev_name, void *data,
+ 			struct vfsmount *mnt)
+@@ -3137,8 +3159,12 @@ static struct super_block *yaffs2_read_s
+ static struct file_system_type yaffs2_fs_type = {
+ 	.owner = THIS_MODULE,
+ 	.name = "yaffs2",
+-	.get_sb = yaffs2_read_super,
+-	.kill_sb = kill_block_super,
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
++        .mount = yaffs2_mount,
++#else
++        .get_sb = yaffs2_read_super,
++#endif
++     	.kill_sb = kill_block_super,
+ 	.fs_flags = FS_REQUIRES_DEV,
+ };
+ #else
diff --git a/target/linux/generic/patches-3.3/505-yaffs-3.2-use-MTD_OPS_AUTO_OOB.patch b/target/linux/generic/patches-3.3/505-yaffs-3.2-use-MTD_OPS_AUTO_OOB.patch
new file mode 100644
index 0000000..463f4a2
--- /dev/null
+++ b/target/linux/generic/patches-3.3/505-yaffs-3.2-use-MTD_OPS_AUTO_OOB.patch
@@ -0,0 +1,54 @@
+--- a/fs/yaffs2/yaffs_mtdif1.c
++++ b/fs/yaffs2/yaffs_mtdif1.c
+@@ -127,7 +127,7 @@ int nandmtd1_WriteChunkWithTagsToNAND(ya
+ #endif
+ 
+ 	memset(&ops, 0, sizeof(ops));
+-	ops.mode = MTD_OOB_AUTO;
++	ops.mode = MTD_OPS_AUTO_OOB;
+ 	ops.len = (data) ? chunkBytes : 0;
+ 	ops.ooblen = YTAG1_SIZE;
+ 	ops.datbuf = (__u8 *)data;
+@@ -179,7 +179,7 @@ int nandmtd1_ReadChunkWithTagsFromNAND(y
+ 	int deleted;
+ 
+ 	memset(&ops, 0, sizeof(ops));
+-	ops.mode = MTD_OOB_AUTO;
++	ops.mode = MTD_OPS_AUTO_OOB;
+ 	ops.len = (data) ? chunkBytes : 0;
+ 	ops.ooblen = YTAG1_SIZE;
+ 	ops.datbuf = data;
+--- a/fs/yaffs2/yaffs_mtdif2.c
++++ b/fs/yaffs2/yaffs_mtdif2.c
+@@ -71,7 +71,7 @@ int nandmtd2_WriteChunkWithTagsToNAND(ya
+ 		yaffs_PackTags2(&pt, tags, !dev->param.no_tags_ecc);
+ 
+ #if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
+-	ops.mode = MTD_OOB_AUTO;
++	ops.mode = MTD_OPS_AUTO_OOB;
+ 	ops.ooblen = (dev->param.inband_tags) ? 0 : packed_tags_size;
+ 	ops.len = dev->param.total_bytes_per_chunk;
+ 	ops.ooboffs = 0;
+@@ -136,7 +136,7 @@ int nandmtd2_ReadChunkWithTagsFromNAND(y
+ 		retval = mtd->read(mtd, addr, dev->param.total_bytes_per_chunk,
+ 				&dummy, data);
+ 	else if (tags) {
+-		ops.mode = MTD_OOB_AUTO;
++		ops.mode = MTD_OPS_AUTO_OOB;
+ 		ops.ooblen = packed_tags_size;
+ 		ops.len = data ? dev->data_bytes_per_chunk : packed_tags_size;
+ 		ops.ooboffs = 0;
+--- a/fs/yaffs2/yaffs_mtdif.h
++++ b/fs/yaffs2/yaffs_mtdif.h
+@@ -24,4 +24,11 @@ extern struct nand_oobinfo yaffs_noeccin
+ #endif
+ int nandmtd_EraseBlockInNAND(yaffs_dev_t *dev, int blockNumber);
+ int nandmtd_InitialiseNAND(yaffs_dev_t *dev);
++
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
++#include <mtd/mtd-abi.h>
++#else
++#define MTD_OPS_AUTO_OOB 	MTD_OOB_AUTO
++#endif
++
+ #endif
diff --git a/target/linux/generic/patches-3.3/506-yaffs-3.2-dont-use-i_nlink-directly.patch b/target/linux/generic/patches-3.3/506-yaffs-3.2-dont-use-i_nlink-directly.patch
new file mode 100644
index 0000000..91e8281
--- /dev/null
+++ b/target/linux/generic/patches-3.3/506-yaffs-3.2-dont-use-i_nlink-directly.patch
@@ -0,0 +1,78 @@
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -220,6 +220,29 @@ static struct inode *yaffs_iget(struct s
+ #define yaffs_SuperToDevice(sb)	((yaffs_dev_t *)sb->u.generic_sbp)
+ #endif
+ 
++#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0))
++static inline void yaffs_set_nlink(struct inode *inode, unsigned int nlink)
++{
++	set_nlink(inode, nlink);
++}
++
++static inline void yaffs_dec_link_count(struct inode *inode)
++{
++	inode_dec_link_count(inode);
++}
++#else
++static inline void yaffs_set_nlink(struct inode *inode, unsigned int nlink)
++{
++	inode->i_nlink = nlink;
++}
++
++static inline void yaffs_dec_link_count(struct inode *inode)
++{
++	inode->i_nlink--;
++	mark_inode_dirty(inode)
++}
++#endif
++
+ 
+ #define update_dir_time(dir) do {\
+ 			(dir)->i_ctime = (dir)->i_mtime = CURRENT_TIME; \
+@@ -1362,7 +1385,7 @@ static void yaffs_fill_inode_from_obj(st
+ 		inode->i_size = yaffs_get_obj_length(obj);
+ 		inode->i_blocks = (inode->i_size + 511) >> 9;
+ 
+-		inode->i_nlink = yaffs_get_obj_link_count(obj);
++		yaffs_set_nlink(inode, yaffs_get_obj_link_count(obj));
+ 
+ 		T(YAFFS_TRACE_OS,
+ 			(TSTR("yaffs_fill_inode mode %x uid %d gid %d size %d count %d\n"),
+@@ -1784,10 +1807,9 @@ static int yaffs_unlink(struct inode *di
+ 	retVal = yaffs_unlinker(obj, dentry->d_name.name);
+ 
+ 	if (retVal == YAFFS_OK) {
+-		dentry->d_inode->i_nlink--;
++		yaffs_dec_link_count(dentry->d_inode);
+ 		dir->i_version++;
+ 		yaffs_gross_unlock(dev);
+-		mark_inode_dirty(dentry->d_inode);
+ 		update_dir_time(dir);
+ 		return 0;
+ 	}
+@@ -1818,7 +1840,8 @@ static int yaffs_link(struct dentry *old
+ 			obj);
+ 
+ 	if (link) {
+-		old_dentry->d_inode->i_nlink = yaffs_get_obj_link_count(obj);
++		yaffs_set_nlink(old_dentry->d_inode,
++				yaffs_get_obj_link_count(obj));
+ 		d_instantiate(dentry, old_dentry->d_inode);
+ 		atomic_inc(&old_dentry->d_inode->i_count);
+ 		T(YAFFS_TRACE_OS,
+@@ -1937,11 +1960,9 @@ static int yaffs_rename(struct inode *ol
+ 	yaffs_gross_unlock(dev);
+ 
+ 	if (retVal == YAFFS_OK) {
+-		if (target) {
+-			new_dentry->d_inode->i_nlink--;
+-			mark_inode_dirty(new_dentry->d_inode);
+-		}
+-		
++		if (target)
++			yaffs_dec_link_count(new_dentry->d_inode);
++
+ 		update_dir_time(old_dir);
+ 		if(old_dir != new_dir)
+ 			update_dir_time(new_dir);
diff --git a/target/linux/generic/patches-3.3/507-yaffs-3.3_fix.patch b/target/linux/generic/patches-3.3/507-yaffs-3.3_fix.patch
new file mode 100644
index 0000000..d823fc4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/507-yaffs-3.3_fix.patch
@@ -0,0 +1,71 @@
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -273,8 +273,13 @@ static int yaffs_sync_object(struct file
+ static int yaffs_readdir(struct file *f, void *dirent, filldir_t filldir);
+ 
+ #if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
++			struct nameidata *n);
++#else
+ static int yaffs_create(struct inode *dir, struct dentry *dentry, int mode,
+ 			struct nameidata *n);
++#endif
+ static struct dentry *yaffs_lookup(struct inode *dir, struct dentry *dentry,
+ 					struct nameidata *n);
+ #else
+@@ -286,9 +291,17 @@ static int yaffs_link(struct dentry *old
+ static int yaffs_unlink(struct inode *dir, struct dentry *dentry);
+ static int yaffs_symlink(struct inode *dir, struct dentry *dentry,
+ 			const char *symname);
++
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
++#else
+ static int yaffs_mkdir(struct inode *dir, struct dentry *dentry, int mode);
++#endif
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
++			dev_t dev);
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
+ static int yaffs_mknod(struct inode *dir, struct dentry *dentry, int mode,
+ 			dev_t dev);
+ #else
+@@ -1679,7 +1692,10 @@ out:
+ #define YCRED(x) (x->cred)
+ #endif
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode,
++			dev_t rdev)
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
+ static int yaffs_mknod(struct inode *dir, struct dentry *dentry, int mode,
+ 			dev_t rdev)
+ #else
+@@ -1769,7 +1785,11 @@ static int yaffs_mknod(struct inode *dir
+ 	return error;
+ }
+ 
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
++#else
+ static int yaffs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
++#endif
+ {
+ 	int retVal;
+ 	T(YAFFS_TRACE_OS, (TSTR("yaffs_mkdir\n")));
+@@ -1777,7 +1797,10 @@ static int yaffs_mkdir(struct inode *dir
+ 	return retVal;
+ }
+ 
+-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0))
++static int yaffs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
++			struct nameidata *n)
++#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 0))
+ static int yaffs_create(struct inode *dir, struct dentry *dentry, int mode,
+ 			struct nameidata *n)
+ #else
diff --git a/target/linux/generic/patches-3.3/508-yaffs-3.3-use-mtd_-helpers.patch b/target/linux/generic/patches-3.3/508-yaffs-3.3-use-mtd_-helpers.patch
new file mode 100644
index 0000000..65d45a0
--- /dev/null
+++ b/target/linux/generic/patches-3.3/508-yaffs-3.3-use-mtd_-helpers.patch
@@ -0,0 +1,160 @@
+--- a/fs/yaffs2/yaffs_mtdif1.c
++++ b/fs/yaffs2/yaffs_mtdif1.c
+@@ -133,7 +133,7 @@ int nandmtd1_WriteChunkWithTagsToNAND(ya
+ 	ops.datbuf = (__u8 *)data;
+ 	ops.oobbuf = (__u8 *)&pt1;
+ 
+-	retval = mtd->write_oob(mtd, addr, &ops);
++	retval = mtd_write_oob(mtd, addr, &ops);
+ 	if (retval) {
+ 		T(YAFFS_TRACE_MTD,
+ 			(TSTR("write_oob failed, chunk %d, mtd error %d"TENDSTR),
+@@ -194,7 +194,7 @@ int nandmtd1_ReadChunkWithTagsFromNAND(y
+ 	/* Read page and oob using MTD.
+ 	 * Check status and determine ECC result.
+ 	 */
+-	retval = mtd->read_oob(mtd, addr, &ops);
++	retval = mtd_read_oob(mtd, addr, &ops);
+ 	if (retval) {
+ 		T(YAFFS_TRACE_MTD,
+ 			(TSTR("read_oob failed, chunk %d, mtd error %d"TENDSTR),
+@@ -218,7 +218,7 @@ int nandmtd1_ReadChunkWithTagsFromNAND(y
+ 		/* fall into... */
+ 	default:
+ 		rettags(etags, YAFFS_ECC_RESULT_UNFIXED, 0);
+-		etags->block_bad = (mtd->block_isbad)(mtd, addr);
++		etags->block_bad = mtd_block_isbad(mtd, addr);
+ 		return YAFFS_FAIL;
+ 	}
+ 
+@@ -286,7 +286,7 @@ int nandmtd1_MarkNANDBlockBad(struct yaf
+ 
+ 	T(YAFFS_TRACE_BAD_BLOCKS,(TSTR("marking block %d bad"TENDSTR), block_no));
+ 
+-	retval = mtd->block_markbad(mtd, (loff_t)blocksize * block_no);
++	retval = mtd_block_markbad(mtd, (loff_t)blocksize * block_no);
+ 	return (retval) ? YAFFS_FAIL : YAFFS_OK;
+ }
+ 
+@@ -336,7 +336,7 @@ int nandmtd1_QueryNANDBlock(struct yaffs
+ 		return YAFFS_FAIL;
+ 
+ 	retval = nandmtd1_ReadChunkWithTagsFromNAND(dev, chunkNo, NULL, &etags);
+-	etags.block_bad = (mtd->block_isbad)(mtd, addr);
++	etags.block_bad = mtd_block_isbad(mtd, addr);
+ 	if (etags.block_bad) {
+ 		T(YAFFS_TRACE_BAD_BLOCKS,
+ 			(TSTR("block %d is marked bad"TENDSTR), block_no));
+--- a/fs/yaffs2/yaffs_vfs_glue.c
++++ b/fs/yaffs2/yaffs_vfs_glue.c
+@@ -2607,8 +2607,8 @@ static void yaffs_MTDPutSuper(struct sup
+ {
+ 	struct mtd_info *mtd = yaffs_dev_to_mtd(yaffs_SuperToDevice(sb));
+ 
+-	if (mtd->sync)
+-		mtd->sync(mtd);
++	if (mtd)
++		mtd_sync(mtd);
+ 
+ 	put_mtd_device(mtd);
+ }
+--- a/fs/yaffs2/yaffs_mtdif2.c
++++ b/fs/yaffs2/yaffs_mtdif2.c
+@@ -77,7 +77,7 @@ int nandmtd2_WriteChunkWithTagsToNAND(ya
+ 	ops.ooboffs = 0;
+ 	ops.datbuf = (__u8 *)data;
+ 	ops.oobbuf = (dev->param.inband_tags) ? NULL : packed_tags_ptr;
+-	retval = mtd->write_oob(mtd, addr, &ops);
++	retval = mtd_write_oob(mtd, addr, &ops);
+ 
+ #else
+ 	if (!dev->param.inband_tags) {
+@@ -133,7 +133,7 @@ int nandmtd2_ReadChunkWithTagsFromNAND(y
+ 
+ #if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 17))
+ 	if (dev->param.inband_tags || (data && !tags))
+-		retval = mtd->read(mtd, addr, dev->param.total_bytes_per_chunk,
++		retval = mtd_read(mtd, addr, dev->param.total_bytes_per_chunk,
+ 				&dummy, data);
+ 	else if (tags) {
+ 		ops.mode = MTD_OPS_AUTO_OOB;
+@@ -142,7 +142,7 @@ int nandmtd2_ReadChunkWithTagsFromNAND(y
+ 		ops.ooboffs = 0;
+ 		ops.datbuf = data;
+ 		ops.oobbuf = yaffs_dev_to_lc(dev)->spareBuffer;
+-		retval = mtd->read_oob(mtd, addr, &ops);
++		retval = mtd_read_oob(mtd, addr, &ops);
+ 	}
+ #else
+ 	if (!dev->param.inband_tags && data && tags) {
+@@ -201,7 +201,7 @@ int nandmtd2_MarkNANDBlockBad(struct yaf
+ 	  (TSTR("nandmtd2_MarkNANDBlockBad %d" TENDSTR), block_no));
+ 
+ 	retval =
+-	    mtd->block_markbad(mtd,
++	    mtd_block_markbad(mtd,
+ 			       block_no * dev->param.chunks_per_block *
+ 			       dev->param.total_bytes_per_chunk);
+ 
+@@ -221,7 +221,7 @@ int nandmtd2_QueryNANDBlock(struct yaffs
+ 	T(YAFFS_TRACE_MTD,
+ 	  (TSTR("nandmtd2_QueryNANDBlock %d" TENDSTR), block_no));
+ 	retval =
+-	    mtd->block_isbad(mtd,
++	    mtd_block_isbad(mtd,
+ 			     block_no * dev->param.chunks_per_block *
+ 			     dev->param.total_bytes_per_chunk);
+ 
+--- a/fs/yaffs2/yaffs_mtdif.h
++++ b/fs/yaffs2/yaffs_mtdif.h
+@@ -31,4 +31,39 @@ int nandmtd_InitialiseNAND(yaffs_dev_t *
+ #define MTD_OPS_AUTO_OOB 	MTD_OOB_AUTO
+ #endif
+ 
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 3, 0))
++static inline int mtd_erase(struct mdt_info *mtd, struct erase_info *ei)
++{
++	return mtd->erase(mtd, ei);
++}
++
++static inline int mtd_block_markbad(struct mtd_info *mtd, loff_t ofs)
++{
++	return mtd->block_mark_bad(mtd, ofs);
++}
++
++static inline int mtd_block_isbad(struct mtd_info *mtd, loff_t ofs)
++{
++	return mtd->block_is_bad(mtd, ofs);
++}
++
++static inline int mtd_read_oob(struct mtd_info *mtd, loff_t from,
++			       struct mtd_oob_ops *ops)
++{
++	return mtd->read_oob(mtd, from, ops);
++}
++
++static inline int mtd_write_oob(struct mtd_info *mtd, loff_t to,
++				struct mtd_oob_ops *ops)
++{
++	return mtd->write_oob(mtd, to, ops);
++}
++
++static inline void mtd_sync(struct mtd_info *mtd)
++{
++	if (mtd->sync)
++		mtd->sync(mtd);
++}
++#endif
++
+ #endif
+--- a/fs/yaffs2/yaffs_mtdif.c
++++ b/fs/yaffs2/yaffs_mtdif.c
+@@ -41,7 +41,7 @@ int nandmtd_EraseBlockInNAND(yaffs_dev_t
+ 	ei.callback = NULL;
+ 	ei.priv = (u_long) dev;
+ 
+-	retval = mtd->erase(mtd, &ei);
++	retval = mtd_erase(mtd, &ei);
+ 
+ 	if (retval == 0)
+ 		return YAFFS_OK;
diff --git a/target/linux/generic/patches-3.3/520-squashfs_update_xz_comp_opts.patch b/target/linux/generic/patches-3.3/520-squashfs_update_xz_comp_opts.patch
new file mode 100644
index 0000000..523b89f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/520-squashfs_update_xz_comp_opts.patch
@@ -0,0 +1,25 @@
+From f31b7c0efa255dd17a5f584022a319387f09b0d8 Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jonas.gorski@gmail.com>
+Date: Tue, 12 Apr 2011 19:55:41 +0200
+Subject: [PATCH] squashfs: update xz compressor options struct.
+
+Update the xz compressor options struct to match the squashfs userspace
+one.
+---
+ fs/squashfs/xz_wrapper.c |    4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+--- a/fs/squashfs/xz_wrapper.c
++++ b/fs/squashfs/xz_wrapper.c
+@@ -39,8 +39,10 @@ struct squashfs_xz {
+ };
+ 
+ struct comp_opts {
+-	__le32 dictionary_size;
+ 	__le32 flags;
++	__le16 bit_opts;
++	__le16 fb;
++	__le32 dictionary_size;
+ };
+ 
+ static void *squashfs_xz_init(struct squashfs_sb_info *msblk, void *buff,
diff --git a/target/linux/generic/patches-3.3/530-jffs2_make_lzma_available.patch b/target/linux/generic/patches-3.3/530-jffs2_make_lzma_available.patch
new file mode 100644
index 0000000..fa79ba3
--- /dev/null
+++ b/target/linux/generic/patches-3.3/530-jffs2_make_lzma_available.patch
@@ -0,0 +1,5142 @@
+--- a/fs/jffs2/Kconfig
++++ b/fs/jffs2/Kconfig
+@@ -139,6 +139,15 @@ config JFFS2_LZO
+ 	  This feature was added in July, 2007. Say 'N' if you need
+ 	  compatibility with older bootloaders or kernels.
+ 
++config JFFS2_LZMA
++	bool "JFFS2 LZMA compression support" if JFFS2_COMPRESSION_OPTIONS
++	select LZMA_COMPRESS
++	select LZMA_DECOMPRESS
++	depends on JFFS2_FS
++	default n
++	help
++	  JFFS2 wrapper to the LZMA C SDK
++
+ config JFFS2_RTIME
+ 	bool "JFFS2 RTIME compression support" if JFFS2_COMPRESSION_OPTIONS
+ 	depends on JFFS2_FS
+--- a/fs/jffs2/Makefile
++++ b/fs/jffs2/Makefile
+@@ -18,4 +18,7 @@ jffs2-$(CONFIG_JFFS2_RUBIN)	+= compr_rub
+ jffs2-$(CONFIG_JFFS2_RTIME)	+= compr_rtime.o
+ jffs2-$(CONFIG_JFFS2_ZLIB)	+= compr_zlib.o
+ jffs2-$(CONFIG_JFFS2_LZO)	+= compr_lzo.o
++jffs2-$(CONFIG_JFFS2_LZMA)      += compr_lzma.o
+ jffs2-$(CONFIG_JFFS2_SUMMARY)   += summary.o
++
++CFLAGS_compr_lzma.o += -Iinclude/linux -Ilib/lzma
+--- a/fs/jffs2/compr.c
++++ b/fs/jffs2/compr.c
+@@ -374,6 +374,9 @@ int __init jffs2_compressors_init(void)
+ #ifdef CONFIG_JFFS2_LZO
+ 	jffs2_lzo_init();
+ #endif
++#ifdef CONFIG_JFFS2_LZMA
++        jffs2_lzma_init();
++#endif
+ /* Setting default compression mode */
+ #ifdef CONFIG_JFFS2_CMODE_NONE
+ 	jffs2_compression_mode = JFFS2_COMPR_MODE_NONE;
+@@ -397,6 +400,9 @@ int __init jffs2_compressors_init(void)
+ int jffs2_compressors_exit(void)
+ {
+ /* Unregistering compressors */
++#ifdef CONFIG_JFFS2_LZMA
++        jffs2_lzma_exit();
++#endif
+ #ifdef CONFIG_JFFS2_LZO
+ 	jffs2_lzo_exit();
+ #endif
+--- a/fs/jffs2/compr.h
++++ b/fs/jffs2/compr.h
+@@ -29,9 +29,9 @@
+ #define JFFS2_DYNRUBIN_PRIORITY  20
+ #define JFFS2_LZARI_PRIORITY     30
+ #define JFFS2_RTIME_PRIORITY     50
+-#define JFFS2_ZLIB_PRIORITY      60
+-#define JFFS2_LZO_PRIORITY       80
+-
++#define JFFS2_LZMA_PRIORITY      70
++#define JFFS2_ZLIB_PRIORITY      80
++#define JFFS2_LZO_PRIORITY       90
+ 
+ #define JFFS2_RUBINMIPS_DISABLED /* RUBINs will be used only */
+ #define JFFS2_DYNRUBIN_DISABLED  /*	   for decompression */
+@@ -101,5 +101,9 @@ void jffs2_zlib_exit(void);
+ int jffs2_lzo_init(void);
+ void jffs2_lzo_exit(void);
+ #endif
++#ifdef CONFIG_JFFS2_LZMA
++int jffs2_lzma_init(void);
++void jffs2_lzma_exit(void);
++#endif
+ 
+ #endif /* __JFFS2_COMPR_H__ */
+--- /dev/null
++++ b/fs/jffs2/compr_lzma.c
+@@ -0,0 +1,128 @@
++/*
++ * JFFS2 -- Journalling Flash File System, Version 2.
++ *
++ * For licensing information, see the file 'LICENCE' in this directory.
++ *
++ * JFFS2 wrapper to the LZMA C SDK
++ *
++ */
++
++#include <linux/lzma.h>
++#include "compr.h"
++
++#ifdef __KERNEL__
++	static DEFINE_MUTEX(deflate_mutex);
++#endif
++
++CLzmaEncHandle *p;
++Byte propsEncoded[LZMA_PROPS_SIZE];
++SizeT propsSize = sizeof(propsEncoded);
++
++STATIC void lzma_free_workspace(void)
++{
++	LzmaEnc_Destroy(p, &lzma_alloc, &lzma_alloc);
++}
++
++STATIC int INIT lzma_alloc_workspace(CLzmaEncProps *props)
++{
++	if ((p = (CLzmaEncHandle *)LzmaEnc_Create(&lzma_alloc)) == NULL)
++	{
++		PRINT_ERROR("Failed to allocate lzma deflate workspace\n");
++		return -ENOMEM;
++	}
++
++	if (LzmaEnc_SetProps(p, props) != SZ_OK)
++	{
++		lzma_free_workspace();
++		return -1;
++	}
++	
++	if (LzmaEnc_WriteProperties(p, propsEncoded, &propsSize) != SZ_OK)
++	{
++		lzma_free_workspace();
++		return -1;
++	}
++
++        return 0;
++}
++
++STATIC int jffs2_lzma_compress(unsigned char *data_in, unsigned char *cpage_out,
++			      uint32_t *sourcelen, uint32_t *dstlen)
++{
++	SizeT compress_size = (SizeT)(*dstlen);
++	int ret;
++
++	#ifdef __KERNEL__
++		mutex_lock(&deflate_mutex);
++	#endif
++
++	ret = LzmaEnc_MemEncode(p, cpage_out, &compress_size, data_in, *sourcelen,
++		0, NULL, &lzma_alloc, &lzma_alloc);
++
++	#ifdef __KERNEL__
++		mutex_unlock(&deflate_mutex);
++	#endif
++
++	if (ret != SZ_OK)
++		return -1;
++
++	*dstlen = (uint32_t)compress_size;
++
++	return 0;
++}
++
++STATIC int jffs2_lzma_decompress(unsigned char *data_in, unsigned char *cpage_out,
++				 uint32_t srclen, uint32_t destlen)
++{
++	int ret;
++	SizeT dl = (SizeT)destlen;
++	SizeT sl = (SizeT)srclen;
++	ELzmaStatus status;
++	
++	ret = LzmaDecode(cpage_out, &dl, data_in, &sl, propsEncoded,
++		propsSize, LZMA_FINISH_ANY, &status, &lzma_alloc);
++
++	if (ret != SZ_OK || status == LZMA_STATUS_NOT_FINISHED || dl != (SizeT)destlen)
++		return -1;
++
++	return 0;
++}
++
++static struct jffs2_compressor jffs2_lzma_comp = {
++	.priority = JFFS2_LZMA_PRIORITY,
++	.name = "lzma",
++	.compr = JFFS2_COMPR_LZMA,
++	.compress = &jffs2_lzma_compress,
++	.decompress = &jffs2_lzma_decompress,
++	.disabled = 0,
++};
++
++int INIT jffs2_lzma_init(void)
++{
++        int ret;
++	CLzmaEncProps props;
++	LzmaEncProps_Init(&props);
++
++        props.dictSize = LZMA_BEST_DICT(0x2000);
++        props.level = LZMA_BEST_LEVEL;
++        props.lc = LZMA_BEST_LC;
++        props.lp = LZMA_BEST_LP;
++        props.pb = LZMA_BEST_PB;
++        props.fb = LZMA_BEST_FB;
++
++	ret = lzma_alloc_workspace(&props);
++        if (ret < 0)
++                return ret;
++
++	ret = jffs2_register_compressor(&jffs2_lzma_comp);
++	if (ret)
++		lzma_free_workspace();
++	
++        return ret;
++}
++
++void jffs2_lzma_exit(void)
++{
++	jffs2_unregister_compressor(&jffs2_lzma_comp);
++	lzma_free_workspace();
++}
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -371,14 +371,41 @@ static int __init init_jffs2_fs(void)
+ 	BUILD_BUG_ON(sizeof(struct jffs2_raw_inode) != 68);
+ 	BUILD_BUG_ON(sizeof(struct jffs2_raw_summary) != 32);
+ 
+-	printk(KERN_INFO "JFFS2 version 2.2."
++	printk(KERN_INFO "JFFS2 version 2.2"
+ #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
+ 	       " (NAND)"
+ #endif
+ #ifdef CONFIG_JFFS2_SUMMARY
+-	       " (SUMMARY) "
++	       " (SUMMARY)"
+ #endif
+-	       " © 2001-2006 Red Hat, Inc.\n");
++#ifdef CONFIG_JFFS2_ZLIB
++	       " (ZLIB)"
++#endif
++#ifdef CONFIG_JFFS2_LZO
++	       " (LZO)"
++#endif
++#ifdef CONFIG_JFFS2_LZMA
++	       " (LZMA)"
++#endif
++#ifdef CONFIG_JFFS2_RTIME
++	       " (RTIME)"
++#endif
++#ifdef CONFIG_JFFS2_RUBIN
++	       " (RUBIN)"
++#endif
++#ifdef  CONFIG_JFFS2_CMODE_NONE
++	       " (CMODE_NONE)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_PRIORITY
++	       " (CMODE_PRIORITY)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_SIZE
++	       " (CMODE_SIZE)"
++#endif
++#ifdef CONFIG_JFFS2_CMODE_FAVOURLZO
++	       " (CMODE_FAVOURLZO)"
++#endif
++	       " (c) 2001-2006 Red Hat, Inc.\n");
+ 
+ 	jffs2_inode_cachep = kmem_cache_create("jffs2_i",
+ 					     sizeof(struct jffs2_inode_info),
+--- a/include/linux/jffs2.h
++++ b/include/linux/jffs2.h
+@@ -46,6 +46,7 @@
+ #define JFFS2_COMPR_DYNRUBIN	0x05
+ #define JFFS2_COMPR_ZLIB	0x06
+ #define JFFS2_COMPR_LZO		0x07
++#define JFFS2_COMPR_LZMA	0x08
+ /* Compatibility flags. */
+ #define JFFS2_COMPAT_MASK 0xc000      /* What do to if an unknown nodetype is found */
+ #define JFFS2_NODE_ACCURATE 0x2000
+--- /dev/null
++++ b/include/linux/lzma.h
+@@ -0,0 +1,62 @@
++#ifndef __LZMA_H__
++#define __LZMA_H__
++
++#ifdef __KERNEL__
++	#include <linux/kernel.h>
++	#include <linux/sched.h>
++	#include <linux/slab.h>
++	#include <linux/vmalloc.h>
++	#include <linux/init.h>
++	#define LZMA_MALLOC vmalloc
++	#define LZMA_FREE vfree
++	#define PRINT_ERROR(msg) printk(KERN_WARNING #msg)
++	#define INIT __init
++	#define STATIC static
++#else
++	#include <stdint.h>
++	#include <stdlib.h>
++	#include <stdio.h>
++	#include <unistd.h>
++	#include <string.h>
++	#include <asm/types.h>
++	#include <errno.h>
++	#include <linux/jffs2.h>
++	#ifndef PAGE_SIZE
++		extern int page_size;
++		#define PAGE_SIZE page_size
++	#endif
++	#define LZMA_MALLOC malloc
++	#define LZMA_FREE free
++	#define PRINT_ERROR(msg) fprintf(stderr, msg)
++	#define INIT
++	#define STATIC
++#endif
++
++#include "lzma/LzmaDec.h"
++#include "lzma/LzmaEnc.h"
++
++#define LZMA_BEST_LEVEL (9)
++#define LZMA_BEST_LC    (0)
++#define LZMA_BEST_LP    (0)
++#define LZMA_BEST_PB    (0)
++#define LZMA_BEST_FB  (273)
++
++#define LZMA_BEST_DICT(n) (((int)((n) / 2)) * 2)
++
++static void *p_lzma_malloc(void *p, size_t size)
++{
++        if (size == 0)
++                return NULL;
++
++        return LZMA_MALLOC(size);
++}
++
++static void p_lzma_free(void *p, void *address)
++{
++        if (address != NULL)
++                LZMA_FREE(address);
++}
++
++static ISzAlloc lzma_alloc = {p_lzma_malloc, p_lzma_free};
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzFind.h
+@@ -0,0 +1,115 @@
++/* LzFind.h -- Match finder for LZ algorithms
++2009-04-22 : Igor Pavlov : Public domain */
++
++#ifndef __LZ_FIND_H
++#define __LZ_FIND_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++typedef UInt32 CLzRef;
++
++typedef struct _CMatchFinder
++{
++  Byte *buffer;
++  UInt32 pos;
++  UInt32 posLimit;
++  UInt32 streamPos;
++  UInt32 lenLimit;
++
++  UInt32 cyclicBufferPos;
++  UInt32 cyclicBufferSize; /* it must be = (historySize + 1) */
++
++  UInt32 matchMaxLen;
++  CLzRef *hash;
++  CLzRef *son;
++  UInt32 hashMask;
++  UInt32 cutValue;
++
++  Byte *bufferBase;
++  ISeqInStream *stream;
++  int streamEndWasReached;
++
++  UInt32 blockSize;
++  UInt32 keepSizeBefore;
++  UInt32 keepSizeAfter;
++
++  UInt32 numHashBytes;
++  int directInput;
++  size_t directInputRem;
++  int btMode;
++  int bigHash;
++  UInt32 historySize;
++  UInt32 fixedHashSize;
++  UInt32 hashSizeSum;
++  UInt32 numSons;
++  SRes result;
++  UInt32 crc[256];
++} CMatchFinder;
++
++#define Inline_MatchFinder_GetPointerToCurrentPos(p) ((p)->buffer)
++#define Inline_MatchFinder_GetIndexByte(p, index) ((p)->buffer[(Int32)(index)])
++
++#define Inline_MatchFinder_GetNumAvailableBytes(p) ((p)->streamPos - (p)->pos)
++
++int MatchFinder_NeedMove(CMatchFinder *p);
++Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p);
++void MatchFinder_MoveBlock(CMatchFinder *p);
++void MatchFinder_ReadIfRequired(CMatchFinder *p);
++
++void MatchFinder_Construct(CMatchFinder *p);
++
++/* Conditions:
++     historySize <= 3 GB
++     keepAddBufferBefore + matchMaxLen + keepAddBufferAfter < 511MB
++*/
++int MatchFinder_Create(CMatchFinder *p, UInt32 historySize,
++    UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
++    ISzAlloc *alloc);
++void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc);
++void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems);
++void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue);
++
++UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *buffer, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 _cutValue,
++    UInt32 *distances, UInt32 maxLen);
++
++/*
++Conditions:
++  Mf_GetNumAvailableBytes_Func must be called before each Mf_GetMatchLen_Func.
++  Mf_GetPointerToCurrentPos_Func's result must be used only before any other function
++*/
++
++typedef void (*Mf_Init_Func)(void *object);
++typedef Byte (*Mf_GetIndexByte_Func)(void *object, Int32 index);
++typedef UInt32 (*Mf_GetNumAvailableBytes_Func)(void *object);
++typedef const Byte * (*Mf_GetPointerToCurrentPos_Func)(void *object);
++typedef UInt32 (*Mf_GetMatches_Func)(void *object, UInt32 *distances);
++typedef void (*Mf_Skip_Func)(void *object, UInt32);
++
++typedef struct _IMatchFinder
++{
++  Mf_Init_Func Init;
++  Mf_GetIndexByte_Func GetIndexByte;
++  Mf_GetNumAvailableBytes_Func GetNumAvailableBytes;
++  Mf_GetPointerToCurrentPos_Func GetPointerToCurrentPos;
++  Mf_GetMatches_Func GetMatches;
++  Mf_Skip_Func Skip;
++} IMatchFinder;
++
++void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable);
++
++void MatchFinder_Init(CMatchFinder *p);
++UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
++UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
++void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
++void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzHash.h
+@@ -0,0 +1,54 @@
++/* LzHash.h -- HASH functions for LZ algorithms
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZ_HASH_H
++#define __LZ_HASH_H
++
++#define kHash2Size (1 << 10)
++#define kHash3Size (1 << 16)
++#define kHash4Size (1 << 20)
++
++#define kFix3HashSize (kHash2Size)
++#define kFix4HashSize (kHash2Size + kHash3Size)
++#define kFix5HashSize (kHash2Size + kHash3Size + kHash4Size)
++
++#define HASH2_CALC hashValue = cur[0] | ((UInt32)cur[1] << 8);
++
++#define HASH3_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hashValue = (temp ^ ((UInt32)cur[2] << 8)) & p->hashMask; }
++
++#define HASH4_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hashValue = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)) & p->hashMask; }
++
++#define HASH5_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hash4Value = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)); \
++  hashValue = (hash4Value ^ (p->crc[cur[4]] << 3)) & p->hashMask; \
++  hash4Value &= (kHash4Size - 1); }
++
++/* #define HASH_ZIP_CALC hashValue = ((cur[0] | ((UInt32)cur[1] << 8)) ^ p->crc[cur[2]]) & 0xFFFF; */
++#define HASH_ZIP_CALC hashValue = ((cur[2] | ((UInt32)cur[0] << 8)) ^ p->crc[cur[1]]) & 0xFFFF;
++
++
++#define MT_HASH2_CALC \
++  hash2Value = (p->crc[cur[0]] ^ cur[1]) & (kHash2Size - 1);
++
++#define MT_HASH3_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); }
++
++#define MT_HASH4_CALC { \
++  UInt32 temp = p->crc[cur[0]] ^ cur[1]; \
++  hash2Value = temp & (kHash2Size - 1); \
++  hash3Value = (temp ^ ((UInt32)cur[2] << 8)) & (kHash3Size - 1); \
++  hash4Value = (temp ^ ((UInt32)cur[2] << 8) ^ (p->crc[cur[3]] << 5)) & (kHash4Size - 1); }
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzmaDec.h
+@@ -0,0 +1,231 @@
++/* LzmaDec.h -- LZMA Decoder
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZMA_DEC_H
++#define __LZMA_DEC_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++/* #define _LZMA_PROB32 */
++/* _LZMA_PROB32 can increase the speed on some CPUs,
++   but memory usage for CLzmaDec::probs will be doubled in that case */
++
++#ifdef _LZMA_PROB32
++#define CLzmaProb UInt32
++#else
++#define CLzmaProb UInt16
++#endif
++
++
++/* ---------- LZMA Properties ---------- */
++
++#define LZMA_PROPS_SIZE 5
++
++typedef struct _CLzmaProps
++{
++  unsigned lc, lp, pb;
++  UInt32 dicSize;
++} CLzmaProps;
++
++/* LzmaProps_Decode - decodes properties
++Returns:
++  SZ_OK
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++*/
++
++SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size);
++
++
++/* ---------- LZMA Decoder state ---------- */
++
++/* LZMA_REQUIRED_INPUT_MAX = number of required input bytes for worst case.
++   Num bits = log2((2^11 / 31) ^ 22) + 26 < 134 + 26 = 160; */
++
++#define LZMA_REQUIRED_INPUT_MAX 20
++
++typedef struct
++{
++  CLzmaProps prop;
++  CLzmaProb *probs;
++  Byte *dic;
++  const Byte *buf;
++  UInt32 range, code;
++  SizeT dicPos;
++  SizeT dicBufSize;
++  UInt32 processedPos;
++  UInt32 checkDicSize;
++  unsigned state;
++  UInt32 reps[4];
++  unsigned remainLen;
++  int needFlush;
++  int needInitState;
++  UInt32 numProbs;
++  unsigned tempBufSize;
++  Byte tempBuf[LZMA_REQUIRED_INPUT_MAX];
++} CLzmaDec;
++
++#define LzmaDec_Construct(p) { (p)->dic = 0; (p)->probs = 0; }
++
++void LzmaDec_Init(CLzmaDec *p);
++
++/* There are two types of LZMA streams:
++     0) Stream with end mark. That end mark adds about 6 bytes to compressed size.
++     1) Stream without end mark. You must know exact uncompressed size to decompress such stream. */
++
++typedef enum
++{
++  LZMA_FINISH_ANY,   /* finish at any point */
++  LZMA_FINISH_END    /* block must be finished at the end */
++} ELzmaFinishMode;
++
++/* ELzmaFinishMode has meaning only if the decoding reaches output limit !!!
++
++   You must use LZMA_FINISH_END, when you know that current output buffer
++   covers last bytes of block. In other cases you must use LZMA_FINISH_ANY.
++
++   If LZMA decoder sees end marker before reaching output limit, it returns SZ_OK,
++   and output value of destLen will be less than output buffer size limit.
++   You can check status result also.
++
++   You can use multiple checks to test data integrity after full decompression:
++     1) Check Result and "status" variable.
++     2) Check that output(destLen) = uncompressedSize, if you know real uncompressedSize.
++     3) Check that output(srcLen) = compressedSize, if you know real compressedSize.
++        You must use correct finish mode in that case. */
++
++typedef enum
++{
++  LZMA_STATUS_NOT_SPECIFIED,               /* use main error code instead */
++  LZMA_STATUS_FINISHED_WITH_MARK,          /* stream was finished with end mark. */
++  LZMA_STATUS_NOT_FINISHED,                /* stream was not finished */
++  LZMA_STATUS_NEEDS_MORE_INPUT,            /* you must provide more input bytes */
++  LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK  /* there is probability that stream was finished without end mark */
++} ELzmaStatus;
++
++/* ELzmaStatus is used only as output value for function call */
++
++
++/* ---------- Interfaces ---------- */
++
++/* There are 3 levels of interfaces:
++     1) Dictionary Interface
++     2) Buffer Interface
++     3) One Call Interface
++   You can select any of these interfaces, but don't mix functions from different
++   groups for same object. */
++
++
++/* There are two variants to allocate state for Dictionary Interface:
++     1) LzmaDec_Allocate / LzmaDec_Free
++     2) LzmaDec_AllocateProbs / LzmaDec_FreeProbs
++   You can use variant 2, if you set dictionary buffer manually.
++   For Buffer Interface you must always use variant 1.
++
++LzmaDec_Allocate* can return:
++  SZ_OK
++  SZ_ERROR_MEM         - Memory allocation error
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++*/
++   
++SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc);
++void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc);
++
++SRes LzmaDec_Allocate(CLzmaDec *state, const Byte *prop, unsigned propsSize, ISzAlloc *alloc);
++void LzmaDec_Free(CLzmaDec *state, ISzAlloc *alloc);
++
++/* ---------- Dictionary Interface ---------- */
++
++/* You can use it, if you want to eliminate the overhead for data copying from
++   dictionary to some other external buffer.
++   You must work with CLzmaDec variables directly in this interface.
++
++   STEPS:
++     LzmaDec_Constr()
++     LzmaDec_Allocate()
++     for (each new stream)
++     {
++       LzmaDec_Init()
++       while (it needs more decompression)
++       {
++         LzmaDec_DecodeToDic()
++         use data from CLzmaDec::dic and update CLzmaDec::dicPos
++       }
++     }
++     LzmaDec_Free()
++*/
++
++/* LzmaDec_DecodeToDic
++   
++   The decoding to internal dictionary buffer (CLzmaDec::dic).
++   You must manually update CLzmaDec::dicPos, if it reaches CLzmaDec::dicBufSize !!!
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (dicLimit).
++  LZMA_FINISH_ANY - Decode just dicLimit bytes.
++  LZMA_FINISH_END - Stream must be finished after dicLimit.
++
++Returns:
++  SZ_OK
++    status:
++      LZMA_STATUS_FINISHED_WITH_MARK
++      LZMA_STATUS_NOT_FINISHED
++      LZMA_STATUS_NEEDS_MORE_INPUT
++      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
++  SZ_ERROR_DATA - Data error
++*/
++
++SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit,
++    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
++
++
++/* ---------- Buffer Interface ---------- */
++
++/* It's zlib-like interface.
++   See LzmaDec_DecodeToDic description for information about STEPS and return results,
++   but you must use LzmaDec_DecodeToBuf instead of LzmaDec_DecodeToDic and you don't need
++   to work with CLzmaDec variables manually.
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (*destLen).
++  LZMA_FINISH_ANY - Decode just destLen bytes.
++  LZMA_FINISH_END - Stream must be finished after (*destLen).
++*/
++
++SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen,
++    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
++
++
++/* ---------- One Call Interface ---------- */
++
++/* LzmaDecode
++
++finishMode:
++  It has meaning only if the decoding reaches output limit (*destLen).
++  LZMA_FINISH_ANY - Decode just destLen bytes.
++  LZMA_FINISH_END - Stream must be finished after (*destLen).
++
++Returns:
++  SZ_OK
++    status:
++      LZMA_STATUS_FINISHED_WITH_MARK
++      LZMA_STATUS_NOT_FINISHED
++      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
++  SZ_ERROR_DATA - Data error
++  SZ_ERROR_MEM  - Memory allocation error
++  SZ_ERROR_UNSUPPORTED - Unsupported properties
++  SZ_ERROR_INPUT_EOF - It needs more bytes in input buffer (src).
++*/
++
++SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
++    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
++    ELzmaStatus *status, ISzAlloc *alloc);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/LzmaEnc.h
+@@ -0,0 +1,80 @@
++/*  LzmaEnc.h -- LZMA Encoder
++2009-02-07 : Igor Pavlov : Public domain */
++
++#ifndef __LZMA_ENC_H
++#define __LZMA_ENC_H
++
++#include "Types.h"
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#define LZMA_PROPS_SIZE 5
++
++typedef struct _CLzmaEncProps
++{
++  int level;       /*  0 <= level <= 9 */
++  UInt32 dictSize; /* (1 << 12) <= dictSize <= (1 << 27) for 32-bit version
++                      (1 << 12) <= dictSize <= (1 << 30) for 64-bit version
++                       default = (1 << 24) */
++  int lc;          /* 0 <= lc <= 8, default = 3 */
++  int lp;          /* 0 <= lp <= 4, default = 0 */
++  int pb;          /* 0 <= pb <= 4, default = 2 */
++  int algo;        /* 0 - fast, 1 - normal, default = 1 */
++  int fb;          /* 5 <= fb <= 273, default = 32 */
++  int btMode;      /* 0 - hashChain Mode, 1 - binTree mode - normal, default = 1 */
++  int numHashBytes; /* 2, 3 or 4, default = 4 */
++  UInt32 mc;        /* 1 <= mc <= (1 << 30), default = 32 */
++  unsigned writeEndMark;  /* 0 - do not write EOPM, 1 - write EOPM, default = 0 */
++  int numThreads;  /* 1 or 2, default = 2 */
++} CLzmaEncProps;
++
++void LzmaEncProps_Init(CLzmaEncProps *p);
++void LzmaEncProps_Normalize(CLzmaEncProps *p);
++UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2);
++
++
++/* ---------- CLzmaEncHandle Interface ---------- */
++
++/* LzmaEnc_* functions can return the following exit codes:
++Returns:
++  SZ_OK           - OK
++  SZ_ERROR_MEM    - Memory allocation error
++  SZ_ERROR_PARAM  - Incorrect paramater in props
++  SZ_ERROR_WRITE  - Write callback error.
++  SZ_ERROR_PROGRESS - some break from progress callback
++  SZ_ERROR_THREAD - errors in multithreading functions (only for Mt version)
++*/
++
++typedef void * CLzmaEncHandle;
++
++CLzmaEncHandle LzmaEnc_Create(ISzAlloc *alloc);
++void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig);
++SRes LzmaEnc_SetProps(CLzmaEncHandle p, const CLzmaEncProps *props);
++SRes LzmaEnc_WriteProperties(CLzmaEncHandle p, Byte *properties, SizeT *size);
++SRes LzmaEnc_Encode(CLzmaEncHandle p, ISeqOutStream *outStream, ISeqInStream *inStream,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++SRes LzmaEnc_MemEncode(CLzmaEncHandle p, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++
++/* ---------- One Call Interface ---------- */
++
++/* LzmaEncode
++Return code:
++  SZ_OK               - OK
++  SZ_ERROR_MEM        - Memory allocation error
++  SZ_ERROR_PARAM      - Incorrect paramater
++  SZ_ERROR_OUTPUT_EOF - output buffer overflow
++  SZ_ERROR_THREAD     - errors in multithreading functions (only for Mt version)
++*/
++
++SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/lzma/Types.h
+@@ -0,0 +1,226 @@
++/* Types.h -- Basic types
++2009-11-23 : Igor Pavlov : Public domain */
++
++#ifndef __7Z_TYPES_H
++#define __7Z_TYPES_H
++
++#include <stddef.h>
++
++#ifdef _WIN32
++#include <windows.h>
++#endif
++
++#ifndef EXTERN_C_BEGIN
++#ifdef __cplusplus
++#define EXTERN_C_BEGIN extern "C" {
++#define EXTERN_C_END }
++#else
++#define EXTERN_C_BEGIN
++#define EXTERN_C_END
++#endif
++#endif
++
++EXTERN_C_BEGIN
++
++#define SZ_OK 0
++
++#define SZ_ERROR_DATA 1
++#define SZ_ERROR_MEM 2
++#define SZ_ERROR_CRC 3
++#define SZ_ERROR_UNSUPPORTED 4
++#define SZ_ERROR_PARAM 5
++#define SZ_ERROR_INPUT_EOF 6
++#define SZ_ERROR_OUTPUT_EOF 7
++#define SZ_ERROR_READ 8
++#define SZ_ERROR_WRITE 9
++#define SZ_ERROR_PROGRESS 10
++#define SZ_ERROR_FAIL 11
++#define SZ_ERROR_THREAD 12
++
++#define SZ_ERROR_ARCHIVE 16
++#define SZ_ERROR_NO_ARCHIVE 17
++
++typedef int SRes;
++
++#ifdef _WIN32
++typedef DWORD WRes;
++#else
++typedef int WRes;
++#endif
++
++#ifndef RINOK
++#define RINOK(x) { int __result__ = (x); if (__result__ != 0) return __result__; }
++#endif
++
++typedef unsigned char Byte;
++typedef short Int16;
++typedef unsigned short UInt16;
++
++#ifdef _LZMA_UINT32_IS_ULONG
++typedef long Int32;
++typedef unsigned long UInt32;
++#else
++typedef int Int32;
++typedef unsigned int UInt32;
++#endif
++
++#ifdef _SZ_NO_INT_64
++
++/* define _SZ_NO_INT_64, if your compiler doesn't support 64-bit integers.
++   NOTES: Some code will work incorrectly in that case! */
++
++typedef long Int64;
++typedef unsigned long UInt64;
++
++#else
++
++#if defined(_MSC_VER) || defined(__BORLANDC__)
++typedef __int64 Int64;
++typedef unsigned __int64 UInt64;
++#else
++typedef long long int Int64;
++typedef unsigned long long int UInt64;
++#endif
++
++#endif
++
++#ifdef _LZMA_NO_SYSTEM_SIZE_T
++typedef UInt32 SizeT;
++#else
++typedef size_t SizeT;
++#endif
++
++typedef int Bool;
++#define True 1
++#define False 0
++
++
++#ifdef _WIN32
++#define MY_STD_CALL __stdcall
++#else
++#define MY_STD_CALL
++#endif
++
++#ifdef _MSC_VER
++
++#if _MSC_VER >= 1300
++#define MY_NO_INLINE __declspec(noinline)
++#else
++#define MY_NO_INLINE
++#endif
++
++#define MY_CDECL __cdecl
++#define MY_FAST_CALL __fastcall
++
++#else
++
++#define MY_CDECL
++#define MY_FAST_CALL
++
++#endif
++
++
++/* The following interfaces use first parameter as pointer to structure */
++
++typedef struct
++{
++  SRes (*Read)(void *p, void *buf, size_t *size);
++    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
++       (output(*size) < input(*size)) is allowed */
++} ISeqInStream;
++
++/* it can return SZ_ERROR_INPUT_EOF */
++SRes SeqInStream_Read(ISeqInStream *stream, void *buf, size_t size);
++SRes SeqInStream_Read2(ISeqInStream *stream, void *buf, size_t size, SRes errorType);
++SRes SeqInStream_ReadByte(ISeqInStream *stream, Byte *buf);
++
++typedef struct
++{
++  size_t (*Write)(void *p, const void *buf, size_t size);
++    /* Returns: result - the number of actually written bytes.
++       (result < size) means error */
++} ISeqOutStream;
++
++typedef enum
++{
++  SZ_SEEK_SET = 0,
++  SZ_SEEK_CUR = 1,
++  SZ_SEEK_END = 2
++} ESzSeek;
++
++typedef struct
++{
++  SRes (*Read)(void *p, void *buf, size_t *size);  /* same as ISeqInStream::Read */
++  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
++} ISeekInStream;
++
++typedef struct
++{
++  SRes (*Look)(void *p, void **buf, size_t *size);
++    /* if (input(*size) != 0 && output(*size) == 0) means end_of_stream.
++       (output(*size) > input(*size)) is not allowed
++       (output(*size) < input(*size)) is allowed */
++  SRes (*Skip)(void *p, size_t offset);
++    /* offset must be <= output(*size) of Look */
++
++  SRes (*Read)(void *p, void *buf, size_t *size);
++    /* reads directly (without buffer). It's same as ISeqInStream::Read */
++  SRes (*Seek)(void *p, Int64 *pos, ESzSeek origin);
++} ILookInStream;
++
++SRes LookInStream_LookRead(ILookInStream *stream, void *buf, size_t *size);
++SRes LookInStream_SeekTo(ILookInStream *stream, UInt64 offset);
++
++/* reads via ILookInStream::Read */
++SRes LookInStream_Read2(ILookInStream *stream, void *buf, size_t size, SRes errorType);
++SRes LookInStream_Read(ILookInStream *stream, void *buf, size_t size);
++
++#define LookToRead_BUF_SIZE (1 << 14)
++
++typedef struct
++{
++  ILookInStream s;
++  ISeekInStream *realStream;
++  size_t pos;
++  size_t size;
++  Byte buf[LookToRead_BUF_SIZE];
++} CLookToRead;
++
++void LookToRead_CreateVTable(CLookToRead *p, int lookahead);
++void LookToRead_Init(CLookToRead *p);
++
++typedef struct
++{
++  ISeqInStream s;
++  ILookInStream *realStream;
++} CSecToLook;
++
++void SecToLook_CreateVTable(CSecToLook *p);
++
++typedef struct
++{
++  ISeqInStream s;
++  ILookInStream *realStream;
++} CSecToRead;
++
++void SecToRead_CreateVTable(CSecToRead *p);
++
++typedef struct
++{
++  SRes (*Progress)(void *p, UInt64 inSize, UInt64 outSize);
++    /* Returns: result. (result != SZ_OK) means break.
++       Value (UInt64)(Int64)-1 for size means unknown value. */
++} ICompressProgress;
++
++typedef struct
++{
++  void *(*Alloc)(void *p, size_t size);
++  void (*Free)(void *p, void *address); /* address can be 0 */
++} ISzAlloc;
++
++#define IAlloc_Alloc(p, size) (p)->Alloc((p), size)
++#define IAlloc_Free(p, a) (p)->Free((p), a)
++
++EXTERN_C_END
++
++#endif
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -118,6 +118,12 @@ config LZO_DECOMPRESS
+ 
+ source "lib/xz/Kconfig"
+ 
++config LZMA_COMPRESS
++    tristate
++
++config LZMA_DECOMPRESS
++    tristate
++
+ #
+ # These all provide a common interface (hence the apparent duplication with
+ # ZLIB_INFLATE; DECOMPRESS_GZIP is just a wrapper.)
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -2,6 +2,16 @@
+ # Makefile for some libs needed in the kernel.
+ #
+ 
++ifdef CONFIG_JFFS2_ZLIB
++	CONFIG_ZLIB_INFLATE:=y
++	CONFIG_ZLIB_DEFLATE:=y
++endif
++
++ifdef CONFIG_JFFS2_LZMA
++	CONFIG_LZMA_DECOMPRESS:=y
++	CONFIG_LZMA_COMPRESS:=y
++endif
++
+ ifdef CONFIG_FUNCTION_TRACER
+ ORIG_CFLAGS := $(KBUILD_CFLAGS)
+ KBUILD_CFLAGS = $(subst -pg,,$(ORIG_CFLAGS))
+@@ -73,6 +83,8 @@ obj-$(CONFIG_LZO_COMPRESS) += lzo/
+ obj-$(CONFIG_LZO_DECOMPRESS) += lzo/
+ obj-$(CONFIG_XZ_DEC) += xz/
+ obj-$(CONFIG_RAID6_PQ) += raid6/
++obj-$(CONFIG_LZMA_COMPRESS) += lzma/
++obj-$(CONFIG_LZMA_DECOMPRESS) += lzma/
+ 
+ lib-$(CONFIG_DECOMPRESS_GZIP) += decompress_inflate.o
+ lib-$(CONFIG_DECOMPRESS_BZIP2) += decompress_bunzip2.o
+--- /dev/null
++++ b/lib/lzma/LzFind.c
+@@ -0,0 +1,761 @@
++/* LzFind.c -- Match finder for LZ algorithms
++2009-04-22 : Igor Pavlov : Public domain */
++
++#include <string.h>
++
++#include "LzFind.h"
++#include "LzHash.h"
++
++#define kEmptyHashValue 0
++#define kMaxValForNormalize ((UInt32)0xFFFFFFFF)
++#define kNormalizeStepMin (1 << 10) /* it must be power of 2 */
++#define kNormalizeMask (~(kNormalizeStepMin - 1))
++#define kMaxHistorySize ((UInt32)3 << 30)
++
++#define kStartMaxLen 3
++
++static void LzInWindow_Free(CMatchFinder *p, ISzAlloc *alloc)
++{
++  if (!p->directInput)
++  {
++    alloc->Free(alloc, p->bufferBase);
++    p->bufferBase = 0;
++  }
++}
++
++/* keepSizeBefore + keepSizeAfter + keepSizeReserv must be < 4G) */
++
++static int LzInWindow_Create(CMatchFinder *p, UInt32 keepSizeReserv, ISzAlloc *alloc)
++{
++  UInt32 blockSize = p->keepSizeBefore + p->keepSizeAfter + keepSizeReserv;
++  if (p->directInput)
++  {
++    p->blockSize = blockSize;
++    return 1;
++  }
++  if (p->bufferBase == 0 || p->blockSize != blockSize)
++  {
++    LzInWindow_Free(p, alloc);
++    p->blockSize = blockSize;
++    p->bufferBase = (Byte *)alloc->Alloc(alloc, (size_t)blockSize);
++  }
++  return (p->bufferBase != 0);
++}
++
++Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
++Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
++
++UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
++
++void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
++{
++  p->posLimit -= subValue;
++  p->pos -= subValue;
++  p->streamPos -= subValue;
++}
++
++static void MatchFinder_ReadBlock(CMatchFinder *p)
++{
++  if (p->streamEndWasReached || p->result != SZ_OK)
++    return;
++  if (p->directInput)
++  {
++    UInt32 curSize = 0xFFFFFFFF - p->streamPos;
++    if (curSize > p->directInputRem)
++      curSize = (UInt32)p->directInputRem;
++    p->directInputRem -= curSize;
++    p->streamPos += curSize;
++    if (p->directInputRem == 0)
++      p->streamEndWasReached = 1;
++    return;
++  }
++  for (;;)
++  {
++    Byte *dest = p->buffer + (p->streamPos - p->pos);
++    size_t size = (p->bufferBase + p->blockSize - dest);
++    if (size == 0)
++      return;
++    p->result = p->stream->Read(p->stream, dest, &size);
++    if (p->result != SZ_OK)
++      return;
++    if (size == 0)
++    {
++      p->streamEndWasReached = 1;
++      return;
++    }
++    p->streamPos += (UInt32)size;
++    if (p->streamPos - p->pos > p->keepSizeAfter)
++      return;
++  }
++}
++
++void MatchFinder_MoveBlock(CMatchFinder *p)
++{
++  memmove(p->bufferBase,
++    p->buffer - p->keepSizeBefore,
++    (size_t)(p->streamPos - p->pos + p->keepSizeBefore));
++  p->buffer = p->bufferBase + p->keepSizeBefore;
++}
++
++int MatchFinder_NeedMove(CMatchFinder *p)
++{
++  if (p->directInput)
++    return 0;
++  /* if (p->streamEndWasReached) return 0; */
++  return ((size_t)(p->bufferBase + p->blockSize - p->buffer) <= p->keepSizeAfter);
++}
++
++void MatchFinder_ReadIfRequired(CMatchFinder *p)
++{
++  if (p->streamEndWasReached)
++    return;
++  if (p->keepSizeAfter >= p->streamPos - p->pos)
++    MatchFinder_ReadBlock(p);
++}
++
++static void MatchFinder_CheckAndMoveAndRead(CMatchFinder *p)
++{
++  if (MatchFinder_NeedMove(p))
++    MatchFinder_MoveBlock(p);
++  MatchFinder_ReadBlock(p);
++}
++
++static void MatchFinder_SetDefaultSettings(CMatchFinder *p)
++{
++  p->cutValue = 32;
++  p->btMode = 1;
++  p->numHashBytes = 4;
++  p->bigHash = 0;
++}
++
++#define kCrcPoly 0xEDB88320
++
++void MatchFinder_Construct(CMatchFinder *p)
++{
++  UInt32 i;
++  p->bufferBase = 0;
++  p->directInput = 0;
++  p->hash = 0;
++  MatchFinder_SetDefaultSettings(p);
++
++  for (i = 0; i < 256; i++)
++  {
++    UInt32 r = i;
++    int j;
++    for (j = 0; j < 8; j++)
++      r = (r >> 1) ^ (kCrcPoly & ~((r & 1) - 1));
++    p->crc[i] = r;
++  }
++}
++
++static void MatchFinder_FreeThisClassMemory(CMatchFinder *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->hash);
++  p->hash = 0;
++}
++
++void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc)
++{
++  MatchFinder_FreeThisClassMemory(p, alloc);
++  LzInWindow_Free(p, alloc);
++}
++
++static CLzRef* AllocRefs(UInt32 num, ISzAlloc *alloc)
++{
++  size_t sizeInBytes = (size_t)num * sizeof(CLzRef);
++  if (sizeInBytes / sizeof(CLzRef) != num)
++    return 0;
++  return (CLzRef *)alloc->Alloc(alloc, sizeInBytes);
++}
++
++int MatchFinder_Create(CMatchFinder *p, UInt32 historySize,
++    UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
++    ISzAlloc *alloc)
++{
++  UInt32 sizeReserv;
++  if (historySize > kMaxHistorySize)
++  {
++    MatchFinder_Free(p, alloc);
++    return 0;
++  }
++  sizeReserv = historySize >> 1;
++  if (historySize > ((UInt32)2 << 30))
++    sizeReserv = historySize >> 2;
++  sizeReserv += (keepAddBufferBefore + matchMaxLen + keepAddBufferAfter) / 2 + (1 << 19);
++
++  p->keepSizeBefore = historySize + keepAddBufferBefore + 1;
++  p->keepSizeAfter = matchMaxLen + keepAddBufferAfter;
++  /* we need one additional byte, since we use MoveBlock after pos++ and before dictionary using */
++  if (LzInWindow_Create(p, sizeReserv, alloc))
++  {
++    UInt32 newCyclicBufferSize = historySize + 1;
++    UInt32 hs;
++    p->matchMaxLen = matchMaxLen;
++    {
++      p->fixedHashSize = 0;
++      if (p->numHashBytes == 2)
++        hs = (1 << 16) - 1;
++      else
++      {
++        hs = historySize - 1;
++        hs |= (hs >> 1);
++        hs |= (hs >> 2);
++        hs |= (hs >> 4);
++        hs |= (hs >> 8);
++        hs >>= 1;
++        hs |= 0xFFFF; /* don't change it! It's required for Deflate */
++        if (hs > (1 << 24))
++        {
++          if (p->numHashBytes == 3)
++            hs = (1 << 24) - 1;
++          else
++            hs >>= 1;
++        }
++      }
++      p->hashMask = hs;
++      hs++;
++      if (p->numHashBytes > 2) p->fixedHashSize += kHash2Size;
++      if (p->numHashBytes > 3) p->fixedHashSize += kHash3Size;
++      if (p->numHashBytes > 4) p->fixedHashSize += kHash4Size;
++      hs += p->fixedHashSize;
++    }
++
++    {
++      UInt32 prevSize = p->hashSizeSum + p->numSons;
++      UInt32 newSize;
++      p->historySize = historySize;
++      p->hashSizeSum = hs;
++      p->cyclicBufferSize = newCyclicBufferSize;
++      p->numSons = (p->btMode ? newCyclicBufferSize * 2 : newCyclicBufferSize);
++      newSize = p->hashSizeSum + p->numSons;
++      if (p->hash != 0 && prevSize == newSize)
++        return 1;
++      MatchFinder_FreeThisClassMemory(p, alloc);
++      p->hash = AllocRefs(newSize, alloc);
++      if (p->hash != 0)
++      {
++        p->son = p->hash + p->hashSizeSum;
++        return 1;
++      }
++    }
++  }
++  MatchFinder_Free(p, alloc);
++  return 0;
++}
++
++static void MatchFinder_SetLimits(CMatchFinder *p)
++{
++  UInt32 limit = kMaxValForNormalize - p->pos;
++  UInt32 limit2 = p->cyclicBufferSize - p->cyclicBufferPos;
++  if (limit2 < limit)
++    limit = limit2;
++  limit2 = p->streamPos - p->pos;
++  if (limit2 <= p->keepSizeAfter)
++  {
++    if (limit2 > 0)
++      limit2 = 1;
++  }
++  else
++    limit2 -= p->keepSizeAfter;
++  if (limit2 < limit)
++    limit = limit2;
++  {
++    UInt32 lenLimit = p->streamPos - p->pos;
++    if (lenLimit > p->matchMaxLen)
++      lenLimit = p->matchMaxLen;
++    p->lenLimit = lenLimit;
++  }
++  p->posLimit = p->pos + limit;
++}
++
++void MatchFinder_Init(CMatchFinder *p)
++{
++  UInt32 i;
++  for (i = 0; i < p->hashSizeSum; i++)
++    p->hash[i] = kEmptyHashValue;
++  p->cyclicBufferPos = 0;
++  p->buffer = p->bufferBase;
++  p->pos = p->streamPos = p->cyclicBufferSize;
++  p->result = SZ_OK;
++  p->streamEndWasReached = 0;
++  MatchFinder_ReadBlock(p);
++  MatchFinder_SetLimits(p);
++}
++
++static UInt32 MatchFinder_GetSubValue(CMatchFinder *p)
++{
++  return (p->pos - p->historySize - 1) & kNormalizeMask;
++}
++
++void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
++{
++  UInt32 i;
++  for (i = 0; i < numItems; i++)
++  {
++    UInt32 value = items[i];
++    if (value <= subValue)
++      value = kEmptyHashValue;
++    else
++      value -= subValue;
++    items[i] = value;
++  }
++}
++
++static void MatchFinder_Normalize(CMatchFinder *p)
++{
++  UInt32 subValue = MatchFinder_GetSubValue(p);
++  MatchFinder_Normalize3(subValue, p->hash, p->hashSizeSum + p->numSons);
++  MatchFinder_ReduceOffsets(p, subValue);
++}
++
++static void MatchFinder_CheckLimits(CMatchFinder *p)
++{
++  if (p->pos == kMaxValForNormalize)
++    MatchFinder_Normalize(p);
++  if (!p->streamEndWasReached && p->keepSizeAfter == p->streamPos - p->pos)
++    MatchFinder_CheckAndMoveAndRead(p);
++  if (p->cyclicBufferPos == p->cyclicBufferSize)
++    p->cyclicBufferPos = 0;
++  MatchFinder_SetLimits(p);
++}
++
++static UInt32 * Hc_GetMatchesSpec(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
++    UInt32 *distances, UInt32 maxLen)
++{
++  son[_cyclicBufferPos] = curMatch;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++      return distances;
++    {
++      const Byte *pb = cur - delta;
++      curMatch = son[_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)];
++      if (pb[maxLen] == cur[maxLen] && *pb == *cur)
++      {
++        UInt32 len = 0;
++        while (++len != lenLimit)
++          if (pb[len] != cur[len])
++            break;
++        if (maxLen < len)
++        {
++          *distances++ = maxLen = len;
++          *distances++ = delta - 1;
++          if (len == lenLimit)
++            return distances;
++        }
++      }
++    }
++  }
++}
++
++UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
++    UInt32 *distances, UInt32 maxLen)
++{
++  CLzRef *ptr0 = son + (_cyclicBufferPos << 1) + 1;
++  CLzRef *ptr1 = son + (_cyclicBufferPos << 1);
++  UInt32 len0 = 0, len1 = 0;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++    {
++      *ptr0 = *ptr1 = kEmptyHashValue;
++      return distances;
++    }
++    {
++      CLzRef *pair = son + ((_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)) << 1);
++      const Byte *pb = cur - delta;
++      UInt32 len = (len0 < len1 ? len0 : len1);
++      if (pb[len] == cur[len])
++      {
++        if (++len != lenLimit && pb[len] == cur[len])
++          while (++len != lenLimit)
++            if (pb[len] != cur[len])
++              break;
++        if (maxLen < len)
++        {
++          *distances++ = maxLen = len;
++          *distances++ = delta - 1;
++          if (len == lenLimit)
++          {
++            *ptr1 = pair[0];
++            *ptr0 = pair[1];
++            return distances;
++          }
++        }
++      }
++      if (pb[len] < cur[len])
++      {
++        *ptr1 = curMatch;
++        ptr1 = pair + 1;
++        curMatch = *ptr1;
++        len1 = len;
++      }
++      else
++      {
++        *ptr0 = curMatch;
++        ptr0 = pair;
++        curMatch = *ptr0;
++        len0 = len;
++      }
++    }
++  }
++}
++
++static void SkipMatchesSpec(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue)
++{
++  CLzRef *ptr0 = son + (_cyclicBufferPos << 1) + 1;
++  CLzRef *ptr1 = son + (_cyclicBufferPos << 1);
++  UInt32 len0 = 0, len1 = 0;
++  for (;;)
++  {
++    UInt32 delta = pos - curMatch;
++    if (cutValue-- == 0 || delta >= _cyclicBufferSize)
++    {
++      *ptr0 = *ptr1 = kEmptyHashValue;
++      return;
++    }
++    {
++      CLzRef *pair = son + ((_cyclicBufferPos - delta + ((delta > _cyclicBufferPos) ? _cyclicBufferSize : 0)) << 1);
++      const Byte *pb = cur - delta;
++      UInt32 len = (len0 < len1 ? len0 : len1);
++      if (pb[len] == cur[len])
++      {
++        while (++len != lenLimit)
++          if (pb[len] != cur[len])
++            break;
++        {
++          if (len == lenLimit)
++          {
++            *ptr1 = pair[0];
++            *ptr0 = pair[1];
++            return;
++          }
++        }
++      }
++      if (pb[len] < cur[len])
++      {
++        *ptr1 = curMatch;
++        ptr1 = pair + 1;
++        curMatch = *ptr1;
++        len1 = len;
++      }
++      else
++      {
++        *ptr0 = curMatch;
++        ptr0 = pair;
++        curMatch = *ptr0;
++        len0 = len;
++      }
++    }
++  }
++}
++
++#define MOVE_POS \
++  ++p->cyclicBufferPos; \
++  p->buffer++; \
++  if (++p->pos == p->posLimit) MatchFinder_CheckLimits(p);
++
++#define MOVE_POS_RET MOVE_POS return offset;
++
++static void MatchFinder_MovePos(CMatchFinder *p) { MOVE_POS; }
++
++#define GET_MATCHES_HEADER2(minLen, ret_op) \
++  UInt32 lenLimit; UInt32 hashValue; const Byte *cur; UInt32 curMatch; \
++  lenLimit = p->lenLimit; { if (lenLimit < minLen) { MatchFinder_MovePos(p); ret_op; }} \
++  cur = p->buffer;
++
++#define GET_MATCHES_HEADER(minLen) GET_MATCHES_HEADER2(minLen, return 0)
++#define SKIP_HEADER(minLen)        GET_MATCHES_HEADER2(minLen, continue)
++
++#define MF_PARAMS(p) p->pos, p->buffer, p->son, p->cyclicBufferPos, p->cyclicBufferSize, p->cutValue
++
++#define GET_MATCHES_FOOTER(offset, maxLen) \
++  offset = (UInt32)(GetMatchesSpec1(lenLimit, curMatch, MF_PARAMS(p), \
++  distances + offset, maxLen) - distances); MOVE_POS_RET;
++
++#define SKIP_FOOTER \
++  SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p)); MOVE_POS;
++
++static UInt32 Bt2_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(2)
++  HASH2_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = 0;
++  GET_MATCHES_FOOTER(offset, 1)
++}
++
++UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(3)
++  HASH_ZIP_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = 0;
++  GET_MATCHES_FOOTER(offset, 2)
++}
++
++static UInt32 Bt3_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, delta2, maxLen, offset;
++  GET_MATCHES_HEADER(3)
++
++  HASH3_CALC;
++
++  delta2 = p->pos - p->hash[hash2Value];
++  curMatch = p->hash[kFix3HashSize + hashValue];
++  
++  p->hash[hash2Value] =
++  p->hash[kFix3HashSize + hashValue] = p->pos;
++
++
++  maxLen = 2;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[0] = maxLen;
++    distances[1] = delta2 - 1;
++    offset = 2;
++    if (maxLen == lenLimit)
++    {
++      SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p));
++      MOVE_POS_RET;
++    }
++  }
++  GET_MATCHES_FOOTER(offset, maxLen)
++}
++
++static UInt32 Bt4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, hash3Value, delta2, delta3, maxLen, offset;
++  GET_MATCHES_HEADER(4)
++
++  HASH4_CALC;
++
++  delta2 = p->pos - p->hash[                hash2Value];
++  delta3 = p->pos - p->hash[kFix3HashSize + hash3Value];
++  curMatch = p->hash[kFix4HashSize + hashValue];
++  
++  p->hash[                hash2Value] =
++  p->hash[kFix3HashSize + hash3Value] =
++  p->hash[kFix4HashSize + hashValue] = p->pos;
++
++  maxLen = 1;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    distances[0] = maxLen = 2;
++    distances[1] = delta2 - 1;
++    offset = 2;
++  }
++  if (delta2 != delta3 && delta3 < p->cyclicBufferSize && *(cur - delta3) == *cur)
++  {
++    maxLen = 3;
++    distances[offset + 1] = delta3 - 1;
++    offset += 2;
++    delta2 = delta3;
++  }
++  if (offset != 0)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[offset - 2] = maxLen;
++    if (maxLen == lenLimit)
++    {
++      SkipMatchesSpec(lenLimit, curMatch, MF_PARAMS(p));
++      MOVE_POS_RET;
++    }
++  }
++  if (maxLen < 3)
++    maxLen = 3;
++  GET_MATCHES_FOOTER(offset, maxLen)
++}
++
++static UInt32 Hc4_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 hash2Value, hash3Value, delta2, delta3, maxLen, offset;
++  GET_MATCHES_HEADER(4)
++
++  HASH4_CALC;
++
++  delta2 = p->pos - p->hash[                hash2Value];
++  delta3 = p->pos - p->hash[kFix3HashSize + hash3Value];
++  curMatch = p->hash[kFix4HashSize + hashValue];
++
++  p->hash[                hash2Value] =
++  p->hash[kFix3HashSize + hash3Value] =
++  p->hash[kFix4HashSize + hashValue] = p->pos;
++
++  maxLen = 1;
++  offset = 0;
++  if (delta2 < p->cyclicBufferSize && *(cur - delta2) == *cur)
++  {
++    distances[0] = maxLen = 2;
++    distances[1] = delta2 - 1;
++    offset = 2;
++  }
++  if (delta2 != delta3 && delta3 < p->cyclicBufferSize && *(cur - delta3) == *cur)
++  {
++    maxLen = 3;
++    distances[offset + 1] = delta3 - 1;
++    offset += 2;
++    delta2 = delta3;
++  }
++  if (offset != 0)
++  {
++    for (; maxLen != lenLimit; maxLen++)
++      if (cur[(ptrdiff_t)maxLen - delta2] != cur[maxLen])
++        break;
++    distances[offset - 2] = maxLen;
++    if (maxLen == lenLimit)
++    {
++      p->son[p->cyclicBufferPos] = curMatch;
++      MOVE_POS_RET;
++    }
++  }
++  if (maxLen < 3)
++    maxLen = 3;
++  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
++    distances + offset, maxLen) - (distances));
++  MOVE_POS_RET
++}
++
++UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++{
++  UInt32 offset;
++  GET_MATCHES_HEADER(3)
++  HASH_ZIP_CALC;
++  curMatch = p->hash[hashValue];
++  p->hash[hashValue] = p->pos;
++  offset = (UInt32)(Hc_GetMatchesSpec(lenLimit, curMatch, MF_PARAMS(p),
++    distances, 2) - (distances));
++  MOVE_POS_RET
++}
++
++static void Bt2_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(2)
++    HASH2_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(3)
++    HASH_ZIP_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Bt3_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value;
++    SKIP_HEADER(3)
++    HASH3_CALC;
++    curMatch = p->hash[kFix3HashSize + hashValue];
++    p->hash[hash2Value] =
++    p->hash[kFix3HashSize + hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Bt4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value, hash3Value;
++    SKIP_HEADER(4)
++    HASH4_CALC;
++    curMatch = p->hash[kFix4HashSize + hashValue];
++    p->hash[                hash2Value] =
++    p->hash[kFix3HashSize + hash3Value] = p->pos;
++    p->hash[kFix4HashSize + hashValue] = p->pos;
++    SKIP_FOOTER
++  }
++  while (--num != 0);
++}
++
++static void Hc4_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    UInt32 hash2Value, hash3Value;
++    SKIP_HEADER(4)
++    HASH4_CALC;
++    curMatch = p->hash[kFix4HashSize + hashValue];
++    p->hash[                hash2Value] =
++    p->hash[kFix3HashSize + hash3Value] =
++    p->hash[kFix4HashSize + hashValue] = p->pos;
++    p->son[p->cyclicBufferPos] = curMatch;
++    MOVE_POS
++  }
++  while (--num != 0);
++}
++
++void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++{
++  do
++  {
++    SKIP_HEADER(3)
++    HASH_ZIP_CALC;
++    curMatch = p->hash[hashValue];
++    p->hash[hashValue] = p->pos;
++    p->son[p->cyclicBufferPos] = curMatch;
++    MOVE_POS
++  }
++  while (--num != 0);
++}
++
++void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable)
++{
++  vTable->Init = (Mf_Init_Func)MatchFinder_Init;
++  vTable->GetIndexByte = (Mf_GetIndexByte_Func)MatchFinder_GetIndexByte;
++  vTable->GetNumAvailableBytes = (Mf_GetNumAvailableBytes_Func)MatchFinder_GetNumAvailableBytes;
++  vTable->GetPointerToCurrentPos = (Mf_GetPointerToCurrentPos_Func)MatchFinder_GetPointerToCurrentPos;
++  if (!p->btMode)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Hc4_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Hc4_MatchFinder_Skip;
++  }
++  else if (p->numHashBytes == 2)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt2_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt2_MatchFinder_Skip;
++  }
++  else if (p->numHashBytes == 3)
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt3_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt3_MatchFinder_Skip;
++  }
++  else
++  {
++    vTable->GetMatches = (Mf_GetMatches_Func)Bt4_MatchFinder_GetMatches;
++    vTable->Skip = (Mf_Skip_Func)Bt4_MatchFinder_Skip;
++  }
++}
+--- /dev/null
++++ b/lib/lzma/LzmaDec.c
+@@ -0,0 +1,999 @@
++/* LzmaDec.c -- LZMA Decoder
++2009-09-20 : Igor Pavlov : Public domain */
++
++#include "LzmaDec.h"
++
++#include <string.h>
++
++#define kNumTopBits 24
++#define kTopValue ((UInt32)1 << kNumTopBits)
++
++#define kNumBitModelTotalBits 11
++#define kBitModelTotal (1 << kNumBitModelTotalBits)
++#define kNumMoveBits 5
++
++#define RC_INIT_SIZE 5
++
++#define NORMALIZE if (range < kTopValue) { range <<= 8; code = (code << 8) | (*buf++); }
++
++#define IF_BIT_0(p) ttt = *(p); NORMALIZE; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
++#define UPDATE_0(p) range = bound; *(p) = (CLzmaProb)(ttt + ((kBitModelTotal - ttt) >> kNumMoveBits));
++#define UPDATE_1(p) range -= bound; code -= bound; *(p) = (CLzmaProb)(ttt - (ttt >> kNumMoveBits));
++#define GET_BIT2(p, i, A0, A1) IF_BIT_0(p) \
++  { UPDATE_0(p); i = (i + i); A0; } else \
++  { UPDATE_1(p); i = (i + i) + 1; A1; }
++#define GET_BIT(p, i) GET_BIT2(p, i, ; , ;)
++
++#define TREE_GET_BIT(probs, i) { GET_BIT((probs + i), i); }
++#define TREE_DECODE(probs, limit, i) \
++  { i = 1; do { TREE_GET_BIT(probs, i); } while (i < limit); i -= limit; }
++
++/* #define _LZMA_SIZE_OPT */
++
++#ifdef _LZMA_SIZE_OPT
++#define TREE_6_DECODE(probs, i) TREE_DECODE(probs, (1 << 6), i)
++#else
++#define TREE_6_DECODE(probs, i) \
++  { i = 1; \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  TREE_GET_BIT(probs, i); \
++  i -= 0x40; }
++#endif
++
++#define NORMALIZE_CHECK if (range < kTopValue) { if (buf >= bufLimit) return DUMMY_ERROR; range <<= 8; code = (code << 8) | (*buf++); }
++
++#define IF_BIT_0_CHECK(p) ttt = *(p); NORMALIZE_CHECK; bound = (range >> kNumBitModelTotalBits) * ttt; if (code < bound)
++#define UPDATE_0_CHECK range = bound;
++#define UPDATE_1_CHECK range -= bound; code -= bound;
++#define GET_BIT2_CHECK(p, i, A0, A1) IF_BIT_0_CHECK(p) \
++  { UPDATE_0_CHECK; i = (i + i); A0; } else \
++  { UPDATE_1_CHECK; i = (i + i) + 1; A1; }
++#define GET_BIT_CHECK(p, i) GET_BIT2_CHECK(p, i, ; , ;)
++#define TREE_DECODE_CHECK(probs, limit, i) \
++  { i = 1; do { GET_BIT_CHECK(probs + i, i) } while (i < limit); i -= limit; }
++
++
++#define kNumPosBitsMax 4
++#define kNumPosStatesMax (1 << kNumPosBitsMax)
++
++#define kLenNumLowBits 3
++#define kLenNumLowSymbols (1 << kLenNumLowBits)
++#define kLenNumMidBits 3
++#define kLenNumMidSymbols (1 << kLenNumMidBits)
++#define kLenNumHighBits 8
++#define kLenNumHighSymbols (1 << kLenNumHighBits)
++
++#define LenChoice 0
++#define LenChoice2 (LenChoice + 1)
++#define LenLow (LenChoice2 + 1)
++#define LenMid (LenLow + (kNumPosStatesMax << kLenNumLowBits))
++#define LenHigh (LenMid + (kNumPosStatesMax << kLenNumMidBits))
++#define kNumLenProbs (LenHigh + kLenNumHighSymbols)
++
++
++#define kNumStates 12
++#define kNumLitStates 7
++
++#define kStartPosModelIndex 4
++#define kEndPosModelIndex 14
++#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
++
++#define kNumPosSlotBits 6
++#define kNumLenToPosStates 4
++
++#define kNumAlignBits 4
++#define kAlignTableSize (1 << kNumAlignBits)
++
++#define kMatchMinLen 2
++#define kMatchSpecLenStart (kMatchMinLen + kLenNumLowSymbols + kLenNumMidSymbols + kLenNumHighSymbols)
++
++#define IsMatch 0
++#define IsRep (IsMatch + (kNumStates << kNumPosBitsMax))
++#define IsRepG0 (IsRep + kNumStates)
++#define IsRepG1 (IsRepG0 + kNumStates)
++#define IsRepG2 (IsRepG1 + kNumStates)
++#define IsRep0Long (IsRepG2 + kNumStates)
++#define PosSlot (IsRep0Long + (kNumStates << kNumPosBitsMax))
++#define SpecPos (PosSlot + (kNumLenToPosStates << kNumPosSlotBits))
++#define Align (SpecPos + kNumFullDistances - kEndPosModelIndex)
++#define LenCoder (Align + kAlignTableSize)
++#define RepLenCoder (LenCoder + kNumLenProbs)
++#define Literal (RepLenCoder + kNumLenProbs)
++
++#define LZMA_BASE_SIZE 1846
++#define LZMA_LIT_SIZE 768
++
++#define LzmaProps_GetNumProbs(p) ((UInt32)LZMA_BASE_SIZE + (LZMA_LIT_SIZE << ((p)->lc + (p)->lp)))
++
++#if Literal != LZMA_BASE_SIZE
++StopCompilingDueBUG
++#endif
++
++#define LZMA_DIC_MIN (1 << 12)
++
++/* First LZMA-symbol is always decoded.
++And it decodes new LZMA-symbols while (buf < bufLimit), but "buf" is without last normalization
++Out:
++  Result:
++    SZ_OK - OK
++    SZ_ERROR_DATA - Error
++  p->remainLen:
++    < kMatchSpecLenStart : normal remain
++    = kMatchSpecLenStart : finished
++    = kMatchSpecLenStart + 1 : Flush marker
++    = kMatchSpecLenStart + 2 : State Init Marker
++*/
++
++static int MY_FAST_CALL LzmaDec_DecodeReal(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
++{
++  CLzmaProb *probs = p->probs;
++
++  unsigned state = p->state;
++  UInt32 rep0 = p->reps[0], rep1 = p->reps[1], rep2 = p->reps[2], rep3 = p->reps[3];
++  unsigned pbMask = ((unsigned)1 << (p->prop.pb)) - 1;
++  unsigned lpMask = ((unsigned)1 << (p->prop.lp)) - 1;
++  unsigned lc = p->prop.lc;
++
++  Byte *dic = p->dic;
++  SizeT dicBufSize = p->dicBufSize;
++  SizeT dicPos = p->dicPos;
++  
++  UInt32 processedPos = p->processedPos;
++  UInt32 checkDicSize = p->checkDicSize;
++  unsigned len = 0;
++
++  const Byte *buf = p->buf;
++  UInt32 range = p->range;
++  UInt32 code = p->code;
++
++  do
++  {
++    CLzmaProb *prob;
++    UInt32 bound;
++    unsigned ttt;
++    unsigned posState = processedPos & pbMask;
++
++    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
++    IF_BIT_0(prob)
++    {
++      unsigned symbol;
++      UPDATE_0(prob);
++      prob = probs + Literal;
++      if (checkDicSize != 0 || processedPos != 0)
++        prob += (LZMA_LIT_SIZE * (((processedPos & lpMask) << lc) +
++        (dic[(dicPos == 0 ? dicBufSize : dicPos) - 1] >> (8 - lc))));
++
++      if (state < kNumLitStates)
++      {
++        state -= (state < 4) ? state : 3;
++        symbol = 1;
++        do { GET_BIT(prob + symbol, symbol) } while (symbol < 0x100);
++      }
++      else
++      {
++        unsigned matchByte = p->dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++        unsigned offs = 0x100;
++        state -= (state < 10) ? 3 : 6;
++        symbol = 1;
++        do
++        {
++          unsigned bit;
++          CLzmaProb *probLit;
++          matchByte <<= 1;
++          bit = (matchByte & offs);
++          probLit = prob + offs + bit + symbol;
++          GET_BIT2(probLit, symbol, offs &= ~bit, offs &= bit)
++        }
++        while (symbol < 0x100);
++      }
++      dic[dicPos++] = (Byte)symbol;
++      processedPos++;
++      continue;
++    }
++    else
++    {
++      UPDATE_1(prob);
++      prob = probs + IsRep + state;
++      IF_BIT_0(prob)
++      {
++        UPDATE_0(prob);
++        state += kNumStates;
++        prob = probs + LenCoder;
++      }
++      else
++      {
++        UPDATE_1(prob);
++        if (checkDicSize == 0 && processedPos == 0)
++          return SZ_ERROR_DATA;
++        prob = probs + IsRepG0 + state;
++        IF_BIT_0(prob)
++        {
++          UPDATE_0(prob);
++          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
++          IF_BIT_0(prob)
++          {
++            UPDATE_0(prob);
++            dic[dicPos] = dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++            dicPos++;
++            processedPos++;
++            state = state < kNumLitStates ? 9 : 11;
++            continue;
++          }
++          UPDATE_1(prob);
++        }
++        else
++        {
++          UInt32 distance;
++          UPDATE_1(prob);
++          prob = probs + IsRepG1 + state;
++          IF_BIT_0(prob)
++          {
++            UPDATE_0(prob);
++            distance = rep1;
++          }
++          else
++          {
++            UPDATE_1(prob);
++            prob = probs + IsRepG2 + state;
++            IF_BIT_0(prob)
++            {
++              UPDATE_0(prob);
++              distance = rep2;
++            }
++            else
++            {
++              UPDATE_1(prob);
++              distance = rep3;
++              rep3 = rep2;
++            }
++            rep2 = rep1;
++          }
++          rep1 = rep0;
++          rep0 = distance;
++        }
++        state = state < kNumLitStates ? 8 : 11;
++        prob = probs + RepLenCoder;
++      }
++      {
++        unsigned limit, offset;
++        CLzmaProb *probLen = prob + LenChoice;
++        IF_BIT_0(probLen)
++        {
++          UPDATE_0(probLen);
++          probLen = prob + LenLow + (posState << kLenNumLowBits);
++          offset = 0;
++          limit = (1 << kLenNumLowBits);
++        }
++        else
++        {
++          UPDATE_1(probLen);
++          probLen = prob + LenChoice2;
++          IF_BIT_0(probLen)
++          {
++            UPDATE_0(probLen);
++            probLen = prob + LenMid + (posState << kLenNumMidBits);
++            offset = kLenNumLowSymbols;
++            limit = (1 << kLenNumMidBits);
++          }
++          else
++          {
++            UPDATE_1(probLen);
++            probLen = prob + LenHigh;
++            offset = kLenNumLowSymbols + kLenNumMidSymbols;
++            limit = (1 << kLenNumHighBits);
++          }
++        }
++        TREE_DECODE(probLen, limit, len);
++        len += offset;
++      }
++
++      if (state >= kNumStates)
++      {
++        UInt32 distance;
++        prob = probs + PosSlot +
++            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) << kNumPosSlotBits);
++        TREE_6_DECODE(prob, distance);
++        if (distance >= kStartPosModelIndex)
++        {
++          unsigned posSlot = (unsigned)distance;
++          int numDirectBits = (int)(((distance >> 1) - 1));
++          distance = (2 | (distance & 1));
++          if (posSlot < kEndPosModelIndex)
++          {
++            distance <<= numDirectBits;
++            prob = probs + SpecPos + distance - posSlot - 1;
++            {
++              UInt32 mask = 1;
++              unsigned i = 1;
++              do
++              {
++                GET_BIT2(prob + i, i, ; , distance |= mask);
++                mask <<= 1;
++              }
++              while (--numDirectBits != 0);
++            }
++          }
++          else
++          {
++            numDirectBits -= kNumAlignBits;
++            do
++            {
++              NORMALIZE
++              range >>= 1;
++              
++              {
++                UInt32 t;
++                code -= range;
++                t = (0 - ((UInt32)code >> 31)); /* (UInt32)((Int32)code >> 31) */
++                distance = (distance << 1) + (t + 1);
++                code += range & t;
++              }
++              /*
++              distance <<= 1;
++              if (code >= range)
++              {
++                code -= range;
++                distance |= 1;
++              }
++              */
++            }
++            while (--numDirectBits != 0);
++            prob = probs + Align;
++            distance <<= kNumAlignBits;
++            {
++              unsigned i = 1;
++              GET_BIT2(prob + i, i, ; , distance |= 1);
++              GET_BIT2(prob + i, i, ; , distance |= 2);
++              GET_BIT2(prob + i, i, ; , distance |= 4);
++              GET_BIT2(prob + i, i, ; , distance |= 8);
++            }
++            if (distance == (UInt32)0xFFFFFFFF)
++            {
++              len += kMatchSpecLenStart;
++              state -= kNumStates;
++              break;
++            }
++          }
++        }
++        rep3 = rep2;
++        rep2 = rep1;
++        rep1 = rep0;
++        rep0 = distance + 1;
++        if (checkDicSize == 0)
++        {
++          if (distance >= processedPos)
++            return SZ_ERROR_DATA;
++        }
++        else if (distance >= checkDicSize)
++          return SZ_ERROR_DATA;
++        state = (state < kNumStates + kNumLitStates) ? kNumLitStates : kNumLitStates + 3;
++      }
++
++      len += kMatchMinLen;
++
++      if (limit == dicPos)
++        return SZ_ERROR_DATA;
++      {
++        SizeT rem = limit - dicPos;
++        unsigned curLen = ((rem < len) ? (unsigned)rem : len);
++        SizeT pos = (dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0);
++
++        processedPos += curLen;
++
++        len -= curLen;
++        if (pos + curLen <= dicBufSize)
++        {
++          Byte *dest = dic + dicPos;
++          ptrdiff_t src = (ptrdiff_t)pos - (ptrdiff_t)dicPos;
++          const Byte *lim = dest + curLen;
++          dicPos += curLen;
++          do
++            *(dest) = (Byte)*(dest + src);
++          while (++dest != lim);
++        }
++        else
++        {
++          do
++          {
++            dic[dicPos++] = dic[pos];
++            if (++pos == dicBufSize)
++              pos = 0;
++          }
++          while (--curLen != 0);
++        }
++      }
++    }
++  }
++  while (dicPos < limit && buf < bufLimit);
++  NORMALIZE;
++  p->buf = buf;
++  p->range = range;
++  p->code = code;
++  p->remainLen = len;
++  p->dicPos = dicPos;
++  p->processedPos = processedPos;
++  p->reps[0] = rep0;
++  p->reps[1] = rep1;
++  p->reps[2] = rep2;
++  p->reps[3] = rep3;
++  p->state = state;
++
++  return SZ_OK;
++}
++
++static void MY_FAST_CALL LzmaDec_WriteRem(CLzmaDec *p, SizeT limit)
++{
++  if (p->remainLen != 0 && p->remainLen < kMatchSpecLenStart)
++  {
++    Byte *dic = p->dic;
++    SizeT dicPos = p->dicPos;
++    SizeT dicBufSize = p->dicBufSize;
++    unsigned len = p->remainLen;
++    UInt32 rep0 = p->reps[0];
++    if (limit - dicPos < len)
++      len = (unsigned)(limit - dicPos);
++
++    if (p->checkDicSize == 0 && p->prop.dicSize - p->processedPos <= len)
++      p->checkDicSize = p->prop.dicSize;
++
++    p->processedPos += len;
++    p->remainLen -= len;
++    while (len-- != 0)
++    {
++      dic[dicPos] = dic[(dicPos - rep0) + ((dicPos < rep0) ? dicBufSize : 0)];
++      dicPos++;
++    }
++    p->dicPos = dicPos;
++  }
++}
++
++static int MY_FAST_CALL LzmaDec_DecodeReal2(CLzmaDec *p, SizeT limit, const Byte *bufLimit)
++{
++  do
++  {
++    SizeT limit2 = limit;
++    if (p->checkDicSize == 0)
++    {
++      UInt32 rem = p->prop.dicSize - p->processedPos;
++      if (limit - p->dicPos > rem)
++        limit2 = p->dicPos + rem;
++    }
++    RINOK(LzmaDec_DecodeReal(p, limit2, bufLimit));
++    if (p->processedPos >= p->prop.dicSize)
++      p->checkDicSize = p->prop.dicSize;
++    LzmaDec_WriteRem(p, limit);
++  }
++  while (p->dicPos < limit && p->buf < bufLimit && p->remainLen < kMatchSpecLenStart);
++
++  if (p->remainLen > kMatchSpecLenStart)
++  {
++    p->remainLen = kMatchSpecLenStart;
++  }
++  return 0;
++}
++
++typedef enum
++{
++  DUMMY_ERROR, /* unexpected end of input stream */
++  DUMMY_LIT,
++  DUMMY_MATCH,
++  DUMMY_REP
++} ELzmaDummy;
++
++static ELzmaDummy LzmaDec_TryDummy(const CLzmaDec *p, const Byte *buf, SizeT inSize)
++{
++  UInt32 range = p->range;
++  UInt32 code = p->code;
++  const Byte *bufLimit = buf + inSize;
++  CLzmaProb *probs = p->probs;
++  unsigned state = p->state;
++  ELzmaDummy res;
++
++  {
++    CLzmaProb *prob;
++    UInt32 bound;
++    unsigned ttt;
++    unsigned posState = (p->processedPos) & ((1 << p->prop.pb) - 1);
++
++    prob = probs + IsMatch + (state << kNumPosBitsMax) + posState;
++    IF_BIT_0_CHECK(prob)
++    {
++      UPDATE_0_CHECK
++
++      /* if (bufLimit - buf >= 7) return DUMMY_LIT; */
++
++      prob = probs + Literal;
++      if (p->checkDicSize != 0 || p->processedPos != 0)
++        prob += (LZMA_LIT_SIZE *
++          ((((p->processedPos) & ((1 << (p->prop.lp)) - 1)) << p->prop.lc) +
++          (p->dic[(p->dicPos == 0 ? p->dicBufSize : p->dicPos) - 1] >> (8 - p->prop.lc))));
++
++      if (state < kNumLitStates)
++      {
++        unsigned symbol = 1;
++        do { GET_BIT_CHECK(prob + symbol, symbol) } while (symbol < 0x100);
++      }
++      else
++      {
++        unsigned matchByte = p->dic[p->dicPos - p->reps[0] +
++            ((p->dicPos < p->reps[0]) ? p->dicBufSize : 0)];
++        unsigned offs = 0x100;
++        unsigned symbol = 1;
++        do
++        {
++          unsigned bit;
++          CLzmaProb *probLit;
++          matchByte <<= 1;
++          bit = (matchByte & offs);
++          probLit = prob + offs + bit + symbol;
++          GET_BIT2_CHECK(probLit, symbol, offs &= ~bit, offs &= bit)
++        }
++        while (symbol < 0x100);
++      }
++      res = DUMMY_LIT;
++    }
++    else
++    {
++      unsigned len;
++      UPDATE_1_CHECK;
++
++      prob = probs + IsRep + state;
++      IF_BIT_0_CHECK(prob)
++      {
++        UPDATE_0_CHECK;
++        state = 0;
++        prob = probs + LenCoder;
++        res = DUMMY_MATCH;
++      }
++      else
++      {
++        UPDATE_1_CHECK;
++        res = DUMMY_REP;
++        prob = probs + IsRepG0 + state;
++        IF_BIT_0_CHECK(prob)
++        {
++          UPDATE_0_CHECK;
++          prob = probs + IsRep0Long + (state << kNumPosBitsMax) + posState;
++          IF_BIT_0_CHECK(prob)
++          {
++            UPDATE_0_CHECK;
++            NORMALIZE_CHECK;
++            return DUMMY_REP;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++          }
++        }
++        else
++        {
++          UPDATE_1_CHECK;
++          prob = probs + IsRepG1 + state;
++          IF_BIT_0_CHECK(prob)
++          {
++            UPDATE_0_CHECK;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++            prob = probs + IsRepG2 + state;
++            IF_BIT_0_CHECK(prob)
++            {
++              UPDATE_0_CHECK;
++            }
++            else
++            {
++              UPDATE_1_CHECK;
++            }
++          }
++        }
++        state = kNumStates;
++        prob = probs + RepLenCoder;
++      }
++      {
++        unsigned limit, offset;
++        CLzmaProb *probLen = prob + LenChoice;
++        IF_BIT_0_CHECK(probLen)
++        {
++          UPDATE_0_CHECK;
++          probLen = prob + LenLow + (posState << kLenNumLowBits);
++          offset = 0;
++          limit = 1 << kLenNumLowBits;
++        }
++        else
++        {
++          UPDATE_1_CHECK;
++          probLen = prob + LenChoice2;
++          IF_BIT_0_CHECK(probLen)
++          {
++            UPDATE_0_CHECK;
++            probLen = prob + LenMid + (posState << kLenNumMidBits);
++            offset = kLenNumLowSymbols;
++            limit = 1 << kLenNumMidBits;
++          }
++          else
++          {
++            UPDATE_1_CHECK;
++            probLen = prob + LenHigh;
++            offset = kLenNumLowSymbols + kLenNumMidSymbols;
++            limit = 1 << kLenNumHighBits;
++          }
++        }
++        TREE_DECODE_CHECK(probLen, limit, len);
++        len += offset;
++      }
++
++      if (state < 4)
++      {
++        unsigned posSlot;
++        prob = probs + PosSlot +
++            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) <<
++            kNumPosSlotBits);
++        TREE_DECODE_CHECK(prob, 1 << kNumPosSlotBits, posSlot);
++        if (posSlot >= kStartPosModelIndex)
++        {
++          int numDirectBits = ((posSlot >> 1) - 1);
++
++          /* if (bufLimit - buf >= 8) return DUMMY_MATCH; */
++
++          if (posSlot < kEndPosModelIndex)
++          {
++            prob = probs + SpecPos + ((2 | (posSlot & 1)) << numDirectBits) - posSlot - 1;
++          }
++          else
++          {
++            numDirectBits -= kNumAlignBits;
++            do
++            {
++              NORMALIZE_CHECK
++              range >>= 1;
++              code -= range & (((code - range) >> 31) - 1);
++              /* if (code >= range) code -= range; */
++            }
++            while (--numDirectBits != 0);
++            prob = probs + Align;
++            numDirectBits = kNumAlignBits;
++          }
++          {
++            unsigned i = 1;
++            do
++            {
++              GET_BIT_CHECK(prob + i, i);
++            }
++            while (--numDirectBits != 0);
++          }
++        }
++      }
++    }
++  }
++  NORMALIZE_CHECK;
++  return res;
++}
++
++
++static void LzmaDec_InitRc(CLzmaDec *p, const Byte *data)
++{
++  p->code = ((UInt32)data[1] << 24) | ((UInt32)data[2] << 16) | ((UInt32)data[3] << 8) | ((UInt32)data[4]);
++  p->range = 0xFFFFFFFF;
++  p->needFlush = 0;
++}
++
++void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
++{
++  p->needFlush = 1;
++  p->remainLen = 0;
++  p->tempBufSize = 0;
++
++  if (initDic)
++  {
++    p->processedPos = 0;
++    p->checkDicSize = 0;
++    p->needInitState = 1;
++  }
++  if (initState)
++    p->needInitState = 1;
++}
++
++void LzmaDec_Init(CLzmaDec *p)
++{
++  p->dicPos = 0;
++  LzmaDec_InitDicAndState(p, True, True);
++}
++
++static void LzmaDec_InitStateReal(CLzmaDec *p)
++{
++  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (p->prop.lc + p->prop.lp));
++  UInt32 i;
++  CLzmaProb *probs = p->probs;
++  for (i = 0; i < numProbs; i++)
++    probs[i] = kBitModelTotal >> 1;
++  p->reps[0] = p->reps[1] = p->reps[2] = p->reps[3] = 1;
++  p->state = 0;
++  p->needInitState = 0;
++}
++
++SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
++    ELzmaFinishMode finishMode, ELzmaStatus *status)
++{
++  SizeT inSize = *srcLen;
++  (*srcLen) = 0;
++  LzmaDec_WriteRem(p, dicLimit);
++  
++  *status = LZMA_STATUS_NOT_SPECIFIED;
++
++  while (p->remainLen != kMatchSpecLenStart)
++  {
++      int checkEndMarkNow;
++
++      if (p->needFlush != 0)
++      {
++        for (; inSize > 0 && p->tempBufSize < RC_INIT_SIZE; (*srcLen)++, inSize--)
++          p->tempBuf[p->tempBufSize++] = *src++;
++        if (p->tempBufSize < RC_INIT_SIZE)
++        {
++          *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++          return SZ_OK;
++        }
++        if (p->tempBuf[0] != 0)
++          return SZ_ERROR_DATA;
++
++        LzmaDec_InitRc(p, p->tempBuf);
++        p->tempBufSize = 0;
++      }
++
++      checkEndMarkNow = 0;
++      if (p->dicPos >= dicLimit)
++      {
++        if (p->remainLen == 0 && p->code == 0)
++        {
++          *status = LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK;
++          return SZ_OK;
++        }
++        if (finishMode == LZMA_FINISH_ANY)
++        {
++          *status = LZMA_STATUS_NOT_FINISHED;
++          return SZ_OK;
++        }
++        if (p->remainLen != 0)
++        {
++          *status = LZMA_STATUS_NOT_FINISHED;
++          return SZ_ERROR_DATA;
++        }
++        checkEndMarkNow = 1;
++      }
++
++      if (p->needInitState)
++        LzmaDec_InitStateReal(p);
++  
++      if (p->tempBufSize == 0)
++      {
++        SizeT processed;
++        const Byte *bufLimit;
++        if (inSize < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
++        {
++          int dummyRes = LzmaDec_TryDummy(p, src, inSize);
++          if (dummyRes == DUMMY_ERROR)
++          {
++            memcpy(p->tempBuf, src, inSize);
++            p->tempBufSize = (unsigned)inSize;
++            (*srcLen) += inSize;
++            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++            return SZ_OK;
++          }
++          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
++          {
++            *status = LZMA_STATUS_NOT_FINISHED;
++            return SZ_ERROR_DATA;
++          }
++          bufLimit = src;
++        }
++        else
++          bufLimit = src + inSize - LZMA_REQUIRED_INPUT_MAX;
++        p->buf = src;
++        if (LzmaDec_DecodeReal2(p, dicLimit, bufLimit) != 0)
++          return SZ_ERROR_DATA;
++        processed = (SizeT)(p->buf - src);
++        (*srcLen) += processed;
++        src += processed;
++        inSize -= processed;
++      }
++      else
++      {
++        unsigned rem = p->tempBufSize, lookAhead = 0;
++        while (rem < LZMA_REQUIRED_INPUT_MAX && lookAhead < inSize)
++          p->tempBuf[rem++] = src[lookAhead++];
++        p->tempBufSize = rem;
++        if (rem < LZMA_REQUIRED_INPUT_MAX || checkEndMarkNow)
++        {
++          int dummyRes = LzmaDec_TryDummy(p, p->tempBuf, rem);
++          if (dummyRes == DUMMY_ERROR)
++          {
++            (*srcLen) += lookAhead;
++            *status = LZMA_STATUS_NEEDS_MORE_INPUT;
++            return SZ_OK;
++          }
++          if (checkEndMarkNow && dummyRes != DUMMY_MATCH)
++          {
++            *status = LZMA_STATUS_NOT_FINISHED;
++            return SZ_ERROR_DATA;
++          }
++        }
++        p->buf = p->tempBuf;
++        if (LzmaDec_DecodeReal2(p, dicLimit, p->buf) != 0)
++          return SZ_ERROR_DATA;
++        lookAhead -= (rem - (unsigned)(p->buf - p->tempBuf));
++        (*srcLen) += lookAhead;
++        src += lookAhead;
++        inSize -= lookAhead;
++        p->tempBufSize = 0;
++      }
++  }
++  if (p->code == 0)
++    *status = LZMA_STATUS_FINISHED_WITH_MARK;
++  return (p->code == 0) ? SZ_OK : SZ_ERROR_DATA;
++}
++
++SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
++{
++  SizeT outSize = *destLen;
++  SizeT inSize = *srcLen;
++  *srcLen = *destLen = 0;
++  for (;;)
++  {
++    SizeT inSizeCur = inSize, outSizeCur, dicPos;
++    ELzmaFinishMode curFinishMode;
++    SRes res;
++    if (p->dicPos == p->dicBufSize)
++      p->dicPos = 0;
++    dicPos = p->dicPos;
++    if (outSize > p->dicBufSize - dicPos)
++    {
++      outSizeCur = p->dicBufSize;
++      curFinishMode = LZMA_FINISH_ANY;
++    }
++    else
++    {
++      outSizeCur = dicPos + outSize;
++      curFinishMode = finishMode;
++    }
++
++    res = LzmaDec_DecodeToDic(p, outSizeCur, src, &inSizeCur, curFinishMode, status);
++    src += inSizeCur;
++    inSize -= inSizeCur;
++    *srcLen += inSizeCur;
++    outSizeCur = p->dicPos - dicPos;
++    memcpy(dest, p->dic + dicPos, outSizeCur);
++    dest += outSizeCur;
++    outSize -= outSizeCur;
++    *destLen += outSizeCur;
++    if (res != 0)
++      return res;
++    if (outSizeCur == 0 || outSize == 0)
++      return SZ_OK;
++  }
++}
++
++void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->probs);
++  p->probs = 0;
++}
++
++static void LzmaDec_FreeDict(CLzmaDec *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->dic);
++  p->dic = 0;
++}
++
++void LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
++{
++  LzmaDec_FreeProbs(p, alloc);
++  LzmaDec_FreeDict(p, alloc);
++}
++
++SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
++{
++  UInt32 dicSize;
++  Byte d;
++  
++  if (size < LZMA_PROPS_SIZE)
++    return SZ_ERROR_UNSUPPORTED;
++  else
++    dicSize = data[1] | ((UInt32)data[2] << 8) | ((UInt32)data[3] << 16) | ((UInt32)data[4] << 24);
++ 
++  if (dicSize < LZMA_DIC_MIN)
++    dicSize = LZMA_DIC_MIN;
++  p->dicSize = dicSize;
++
++  d = data[0];
++  if (d >= (9 * 5 * 5))
++    return SZ_ERROR_UNSUPPORTED;
++
++  p->lc = d % 9;
++  d /= 9;
++  p->pb = d / 5;
++  p->lp = d % 5;
++
++  return SZ_OK;
++}
++
++static SRes LzmaDec_AllocateProbs2(CLzmaDec *p, const CLzmaProps *propNew, ISzAlloc *alloc)
++{
++  UInt32 numProbs = LzmaProps_GetNumProbs(propNew);
++  if (p->probs == 0 || numProbs != p->numProbs)
++  {
++    LzmaDec_FreeProbs(p, alloc);
++    p->probs = (CLzmaProb *)alloc->Alloc(alloc, numProbs * sizeof(CLzmaProb));
++    p->numProbs = numProbs;
++    if (p->probs == 0)
++      return SZ_ERROR_MEM;
++  }
++  return SZ_OK;
++}
++
++SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++{
++  CLzmaProps propNew;
++  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
++  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
++  p->prop = propNew;
++  return SZ_OK;
++}
++
++SRes LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++{
++  CLzmaProps propNew;
++  SizeT dicBufSize;
++  RINOK(LzmaProps_Decode(&propNew, props, propsSize));
++  RINOK(LzmaDec_AllocateProbs2(p, &propNew, alloc));
++  dicBufSize = propNew.dicSize;
++  if (p->dic == 0 || dicBufSize != p->dicBufSize)
++  {
++    LzmaDec_FreeDict(p, alloc);
++    p->dic = (Byte *)alloc->Alloc(alloc, dicBufSize);
++    if (p->dic == 0)
++    {
++      LzmaDec_FreeProbs(p, alloc);
++      return SZ_ERROR_MEM;
++    }
++  }
++  p->dicBufSize = dicBufSize;
++  p->prop = propNew;
++  return SZ_OK;
++}
++
++SRes LzmaDecode(Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen,
++    const Byte *propData, unsigned propSize, ELzmaFinishMode finishMode,
++    ELzmaStatus *status, ISzAlloc *alloc)
++{
++  CLzmaDec p;
++  SRes res;
++  SizeT inSize = *srcLen;
++  SizeT outSize = *destLen;
++  *srcLen = *destLen = 0;
++  if (inSize < RC_INIT_SIZE)
++    return SZ_ERROR_INPUT_EOF;
++
++  LzmaDec_Construct(&p);
++  res = LzmaDec_AllocateProbs(&p, propData, propSize, alloc);
++  if (res != 0)
++    return res;
++  p.dic = dest;
++  p.dicBufSize = outSize;
++
++  LzmaDec_Init(&p);
++  
++  *srcLen = inSize;
++  res = LzmaDec_DecodeToDic(&p, outSize, src, srcLen, finishMode, status);
++
++  if (res == SZ_OK && *status == LZMA_STATUS_NEEDS_MORE_INPUT)
++    res = SZ_ERROR_INPUT_EOF;
++
++  (*destLen) = p.dicPos;
++  LzmaDec_FreeProbs(&p, alloc);
++  return res;
++}
+--- /dev/null
++++ b/lib/lzma/LzmaEnc.c
+@@ -0,0 +1,2271 @@
++/* LzmaEnc.c -- LZMA Encoder
++2009-11-24 : Igor Pavlov : Public domain */
++
++#include <string.h>
++
++/* #define SHOW_STAT */
++/* #define SHOW_STAT2 */
++
++#if defined(SHOW_STAT) || defined(SHOW_STAT2)
++#include <stdio.h>
++#endif
++
++#include "LzmaEnc.h"
++
++/* disable MT */
++#define _7ZIP_ST
++
++#include "LzFind.h"
++#ifndef _7ZIP_ST
++#include "LzFindMt.h"
++#endif
++
++#ifdef SHOW_STAT
++static int ttt = 0;
++#endif
++
++#define kBlockSizeMax ((1 << LZMA_NUM_BLOCK_SIZE_BITS) - 1)
++
++#define kBlockSize (9 << 10)
++#define kUnpackBlockSize (1 << 18)
++#define kMatchArraySize (1 << 21)
++#define kMatchRecordMaxSize ((LZMA_MATCH_LEN_MAX * 2 + 3) * LZMA_MATCH_LEN_MAX)
++
++#define kNumMaxDirectBits (31)
++
++#define kNumTopBits 24
++#define kTopValue ((UInt32)1 << kNumTopBits)
++
++#define kNumBitModelTotalBits 11
++#define kBitModelTotal (1 << kNumBitModelTotalBits)
++#define kNumMoveBits 5
++#define kProbInitValue (kBitModelTotal >> 1)
++
++#define kNumMoveReducingBits 4
++#define kNumBitPriceShiftBits 4
++#define kBitPrice (1 << kNumBitPriceShiftBits)
++
++void LzmaEncProps_Init(CLzmaEncProps *p)
++{
++  p->level = 5;
++  p->dictSize = p->mc = 0;
++  p->lc = p->lp = p->pb = p->algo = p->fb = p->btMode = p->numHashBytes = p->numThreads = -1;
++  p->writeEndMark = 0;
++}
++
++void LzmaEncProps_Normalize(CLzmaEncProps *p)
++{
++  int level = p->level;
++  if (level < 0) level = 5;
++  p->level = level;
++  if (p->dictSize == 0) p->dictSize = (level <= 5 ? (1 << (level * 2 + 14)) : (level == 6 ? (1 << 25) : (1 << 26)));
++  if (p->lc < 0) p->lc = 3;
++  if (p->lp < 0) p->lp = 0;
++  if (p->pb < 0) p->pb = 2;
++  if (p->algo < 0) p->algo = (level < 5 ? 0 : 1);
++  if (p->fb < 0) p->fb = (level < 7 ? 32 : 64);
++  if (p->btMode < 0) p->btMode = (p->algo == 0 ? 0 : 1);
++  if (p->numHashBytes < 0) p->numHashBytes = 4;
++  if (p->mc == 0)  p->mc = (16 + (p->fb >> 1)) >> (p->btMode ? 0 : 1);
++  if (p->numThreads < 0)
++    p->numThreads =
++      #ifndef _7ZIP_ST
++      ((p->btMode && p->algo) ? 2 : 1);
++      #else
++      1;
++      #endif
++}
++
++UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
++{
++  CLzmaEncProps props = *props2;
++  LzmaEncProps_Normalize(&props);
++  return props.dictSize;
++}
++
++/* #define LZMA_LOG_BSR */
++/* Define it for Intel's CPU */
++
++
++#ifdef LZMA_LOG_BSR
++
++#define kDicLogSizeMaxCompress 30
++
++#define BSR2_RET(pos, res) { unsigned long i; _BitScanReverse(&i, (pos)); res = (i + i) + ((pos >> (i - 1)) & 1); }
++
++UInt32 GetPosSlot1(UInt32 pos)
++{
++  UInt32 res;
++  BSR2_RET(pos, res);
++  return res;
++}
++#define GetPosSlot2(pos, res) { BSR2_RET(pos, res); }
++#define GetPosSlot(pos, res) { if (pos < 2) res = pos; else BSR2_RET(pos, res); }
++
++#else
++
++#define kNumLogBits (9 + (int)sizeof(size_t) / 2)
++#define kDicLogSizeMaxCompress ((kNumLogBits - 1) * 2 + 7)
++
++void LzmaEnc_FastPosInit(Byte *g_FastPos)
++{
++  int c = 2, slotFast;
++  g_FastPos[0] = 0;
++  g_FastPos[1] = 1;
++  
++  for (slotFast = 2; slotFast < kNumLogBits * 2; slotFast++)
++  {
++    UInt32 k = (1 << ((slotFast >> 1) - 1));
++    UInt32 j;
++    for (j = 0; j < k; j++, c++)
++      g_FastPos[c] = (Byte)slotFast;
++  }
++}
++
++#define BSR2_RET(pos, res) { UInt32 i = 6 + ((kNumLogBits - 1) & \
++  (0 - (((((UInt32)1 << (kNumLogBits + 6)) - 1) - pos) >> 31))); \
++  res = p->g_FastPos[pos >> i] + (i * 2); }
++/*
++#define BSR2_RET(pos, res) { res = (pos < (1 << (kNumLogBits + 6))) ? \
++  p->g_FastPos[pos >> 6] + 12 : \
++  p->g_FastPos[pos >> (6 + kNumLogBits - 1)] + (6 + (kNumLogBits - 1)) * 2; }
++*/
++
++#define GetPosSlot1(pos) p->g_FastPos[pos]
++#define GetPosSlot2(pos, res) { BSR2_RET(pos, res); }
++#define GetPosSlot(pos, res) { if (pos < kNumFullDistances) res = p->g_FastPos[pos]; else BSR2_RET(pos, res); }
++
++#endif
++
++
++#define LZMA_NUM_REPS 4
++
++typedef unsigned CState;
++
++typedef struct
++{
++  UInt32 price;
++
++  CState state;
++  int prev1IsChar;
++  int prev2;
++
++  UInt32 posPrev2;
++  UInt32 backPrev2;
++
++  UInt32 posPrev;
++  UInt32 backPrev;
++  UInt32 backs[LZMA_NUM_REPS];
++} COptimal;
++
++#define kNumOpts (1 << 12)
++
++#define kNumLenToPosStates 4
++#define kNumPosSlotBits 6
++#define kDicLogSizeMin 0
++#define kDicLogSizeMax 32
++#define kDistTableSizeMax (kDicLogSizeMax * 2)
++
++
++#define kNumAlignBits 4
++#define kAlignTableSize (1 << kNumAlignBits)
++#define kAlignMask (kAlignTableSize - 1)
++
++#define kStartPosModelIndex 4
++#define kEndPosModelIndex 14
++#define kNumPosModels (kEndPosModelIndex - kStartPosModelIndex)
++
++#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
++
++#ifdef _LZMA_PROB32
++#define CLzmaProb UInt32
++#else
++#define CLzmaProb UInt16
++#endif
++
++#define LZMA_PB_MAX 4
++#define LZMA_LC_MAX 8
++#define LZMA_LP_MAX 4
++
++#define LZMA_NUM_PB_STATES_MAX (1 << LZMA_PB_MAX)
++
++
++#define kLenNumLowBits 3
++#define kLenNumLowSymbols (1 << kLenNumLowBits)
++#define kLenNumMidBits 3
++#define kLenNumMidSymbols (1 << kLenNumMidBits)
++#define kLenNumHighBits 8
++#define kLenNumHighSymbols (1 << kLenNumHighBits)
++
++#define kLenNumSymbolsTotal (kLenNumLowSymbols + kLenNumMidSymbols + kLenNumHighSymbols)
++
++#define LZMA_MATCH_LEN_MIN 2
++#define LZMA_MATCH_LEN_MAX (LZMA_MATCH_LEN_MIN + kLenNumSymbolsTotal - 1)
++
++#define kNumStates 12
++
++typedef struct
++{
++  CLzmaProb choice;
++  CLzmaProb choice2;
++  CLzmaProb low[LZMA_NUM_PB_STATES_MAX << kLenNumLowBits];
++  CLzmaProb mid[LZMA_NUM_PB_STATES_MAX << kLenNumMidBits];
++  CLzmaProb high[kLenNumHighSymbols];
++} CLenEnc;
++
++typedef struct
++{
++  CLenEnc p;
++  UInt32 prices[LZMA_NUM_PB_STATES_MAX][kLenNumSymbolsTotal];
++  UInt32 tableSize;
++  UInt32 counters[LZMA_NUM_PB_STATES_MAX];
++} CLenPriceEnc;
++
++typedef struct
++{
++  UInt32 range;
++  Byte cache;
++  UInt64 low;
++  UInt64 cacheSize;
++  Byte *buf;
++  Byte *bufLim;
++  Byte *bufBase;
++  ISeqOutStream *outStream;
++  UInt64 processed;
++  SRes res;
++} CRangeEnc;
++
++typedef struct
++{
++  CLzmaProb *litProbs;
++
++  CLzmaProb isMatch[kNumStates][LZMA_NUM_PB_STATES_MAX];
++  CLzmaProb isRep[kNumStates];
++  CLzmaProb isRepG0[kNumStates];
++  CLzmaProb isRepG1[kNumStates];
++  CLzmaProb isRepG2[kNumStates];
++  CLzmaProb isRep0Long[kNumStates][LZMA_NUM_PB_STATES_MAX];
++
++  CLzmaProb posSlotEncoder[kNumLenToPosStates][1 << kNumPosSlotBits];
++  CLzmaProb posEncoders[kNumFullDistances - kEndPosModelIndex];
++  CLzmaProb posAlignEncoder[1 << kNumAlignBits];
++  
++  CLenPriceEnc lenEnc;
++  CLenPriceEnc repLenEnc;
++
++  UInt32 reps[LZMA_NUM_REPS];
++  UInt32 state;
++} CSaveState;
++
++typedef struct
++{
++  IMatchFinder matchFinder;
++  void *matchFinderObj;
++
++  #ifndef _7ZIP_ST
++  Bool mtMode;
++  CMatchFinderMt matchFinderMt;
++  #endif
++
++  CMatchFinder matchFinderBase;
++
++  #ifndef _7ZIP_ST
++  Byte pad[128];
++  #endif
++  
++  UInt32 optimumEndIndex;
++  UInt32 optimumCurrentIndex;
++
++  UInt32 longestMatchLength;
++  UInt32 numPairs;
++  UInt32 numAvail;
++  COptimal opt[kNumOpts];
++  
++  #ifndef LZMA_LOG_BSR
++  Byte g_FastPos[1 << kNumLogBits];
++  #endif
++
++  UInt32 ProbPrices[kBitModelTotal >> kNumMoveReducingBits];
++  UInt32 matches[LZMA_MATCH_LEN_MAX * 2 + 2 + 1];
++  UInt32 numFastBytes;
++  UInt32 additionalOffset;
++  UInt32 reps[LZMA_NUM_REPS];
++  UInt32 state;
++
++  UInt32 posSlotPrices[kNumLenToPosStates][kDistTableSizeMax];
++  UInt32 distancesPrices[kNumLenToPosStates][kNumFullDistances];
++  UInt32 alignPrices[kAlignTableSize];
++  UInt32 alignPriceCount;
++
++  UInt32 distTableSize;
++
++  unsigned lc, lp, pb;
++  unsigned lpMask, pbMask;
++
++  CLzmaProb *litProbs;
++
++  CLzmaProb isMatch[kNumStates][LZMA_NUM_PB_STATES_MAX];
++  CLzmaProb isRep[kNumStates];
++  CLzmaProb isRepG0[kNumStates];
++  CLzmaProb isRepG1[kNumStates];
++  CLzmaProb isRepG2[kNumStates];
++  CLzmaProb isRep0Long[kNumStates][LZMA_NUM_PB_STATES_MAX];
++
++  CLzmaProb posSlotEncoder[kNumLenToPosStates][1 << kNumPosSlotBits];
++  CLzmaProb posEncoders[kNumFullDistances - kEndPosModelIndex];
++  CLzmaProb posAlignEncoder[1 << kNumAlignBits];
++  
++  CLenPriceEnc lenEnc;
++  CLenPriceEnc repLenEnc;
++
++  unsigned lclp;
++
++  Bool fastMode;
++  
++  CRangeEnc rc;
++
++  Bool writeEndMark;
++  UInt64 nowPos64;
++  UInt32 matchPriceCount;
++  Bool finished;
++  Bool multiThread;
++
++  SRes result;
++  UInt32 dictSize;
++  UInt32 matchFinderCycles;
++
++  int needInit;
++
++  CSaveState saveState;
++} CLzmaEnc;
++
++void LzmaEnc_SaveState(CLzmaEncHandle pp)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  CSaveState *dest = &p->saveState;
++  int i;
++  dest->lenEnc = p->lenEnc;
++  dest->repLenEnc = p->repLenEnc;
++  dest->state = p->state;
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
++    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
++  }
++  for (i = 0; i < kNumLenToPosStates; i++)
++    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
++  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
++  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
++  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
++  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
++  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
++  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
++  memcpy(dest->reps, p->reps, sizeof(p->reps));
++  memcpy(dest->litProbs, p->litProbs, (0x300 << p->lclp) * sizeof(CLzmaProb));
++}
++
++void LzmaEnc_RestoreState(CLzmaEncHandle pp)
++{
++  CLzmaEnc *dest = (CLzmaEnc *)pp;
++  const CSaveState *p = &dest->saveState;
++  int i;
++  dest->lenEnc = p->lenEnc;
++  dest->repLenEnc = p->repLenEnc;
++  dest->state = p->state;
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    memcpy(dest->isMatch[i], p->isMatch[i], sizeof(p->isMatch[i]));
++    memcpy(dest->isRep0Long[i], p->isRep0Long[i], sizeof(p->isRep0Long[i]));
++  }
++  for (i = 0; i < kNumLenToPosStates; i++)
++    memcpy(dest->posSlotEncoder[i], p->posSlotEncoder[i], sizeof(p->posSlotEncoder[i]));
++  memcpy(dest->isRep, p->isRep, sizeof(p->isRep));
++  memcpy(dest->isRepG0, p->isRepG0, sizeof(p->isRepG0));
++  memcpy(dest->isRepG1, p->isRepG1, sizeof(p->isRepG1));
++  memcpy(dest->isRepG2, p->isRepG2, sizeof(p->isRepG2));
++  memcpy(dest->posEncoders, p->posEncoders, sizeof(p->posEncoders));
++  memcpy(dest->posAlignEncoder, p->posAlignEncoder, sizeof(p->posAlignEncoder));
++  memcpy(dest->reps, p->reps, sizeof(p->reps));
++  memcpy(dest->litProbs, p->litProbs, (0x300 << dest->lclp) * sizeof(CLzmaProb));
++}
++
++SRes LzmaEnc_SetProps(CLzmaEncHandle pp, const CLzmaEncProps *props2)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  CLzmaEncProps props = *props2;
++  LzmaEncProps_Normalize(&props);
++
++  if (props.lc > LZMA_LC_MAX || props.lp > LZMA_LP_MAX || props.pb > LZMA_PB_MAX ||
++      props.dictSize > (1 << kDicLogSizeMaxCompress) || props.dictSize > (1 << 30))
++    return SZ_ERROR_PARAM;
++  p->dictSize = props.dictSize;
++  p->matchFinderCycles = props.mc;
++  {
++    unsigned fb = props.fb;
++    if (fb < 5)
++      fb = 5;
++    if (fb > LZMA_MATCH_LEN_MAX)
++      fb = LZMA_MATCH_LEN_MAX;
++    p->numFastBytes = fb;
++  }
++  p->lc = props.lc;
++  p->lp = props.lp;
++  p->pb = props.pb;
++  p->fastMode = (props.algo == 0);
++  p->matchFinderBase.btMode = props.btMode;
++  {
++    UInt32 numHashBytes = 4;
++    if (props.btMode)
++    {
++      if (props.numHashBytes < 2)
++        numHashBytes = 2;
++      else if (props.numHashBytes < 4)
++        numHashBytes = props.numHashBytes;
++    }
++    p->matchFinderBase.numHashBytes = numHashBytes;
++  }
++
++  p->matchFinderBase.cutValue = props.mc;
++
++  p->writeEndMark = props.writeEndMark;
++
++  #ifndef _7ZIP_ST
++  /*
++  if (newMultiThread != _multiThread)
++  {
++    ReleaseMatchFinder();
++    _multiThread = newMultiThread;
++  }
++  */
++  p->multiThread = (props.numThreads > 1);
++  #endif
++
++  return SZ_OK;
++}
++
++static const int kLiteralNextStates[kNumStates] = {0, 0, 0, 0, 1, 2, 3, 4,  5,  6,   4, 5};
++static const int kMatchNextStates[kNumStates]   = {7, 7, 7, 7, 7, 7, 7, 10, 10, 10, 10, 10};
++static const int kRepNextStates[kNumStates]     = {8, 8, 8, 8, 8, 8, 8, 11, 11, 11, 11, 11};
++static const int kShortRepNextStates[kNumStates]= {9, 9, 9, 9, 9, 9, 9, 11, 11, 11, 11, 11};
++
++#define IsCharState(s) ((s) < 7)
++
++#define GetLenToPosState(len) (((len) < kNumLenToPosStates + 1) ? (len) - 2 : kNumLenToPosStates - 1)
++
++#define kInfinityPrice (1 << 30)
++
++static void RangeEnc_Construct(CRangeEnc *p)
++{
++  p->outStream = 0;
++  p->bufBase = 0;
++}
++
++#define RangeEnc_GetProcessed(p) ((p)->processed + ((p)->buf - (p)->bufBase) + (p)->cacheSize)
++
++#define RC_BUF_SIZE (1 << 16)
++static int RangeEnc_Alloc(CRangeEnc *p, ISzAlloc *alloc)
++{
++  if (p->bufBase == 0)
++  {
++    p->bufBase = (Byte *)alloc->Alloc(alloc, RC_BUF_SIZE);
++    if (p->bufBase == 0)
++      return 0;
++    p->bufLim = p->bufBase + RC_BUF_SIZE;
++  }
++  return 1;
++}
++
++static void RangeEnc_Free(CRangeEnc *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->bufBase);
++  p->bufBase = 0;
++}
++
++static void RangeEnc_Init(CRangeEnc *p)
++{
++  /* Stream.Init(); */
++  p->low = 0;
++  p->range = 0xFFFFFFFF;
++  p->cacheSize = 1;
++  p->cache = 0;
++
++  p->buf = p->bufBase;
++
++  p->processed = 0;
++  p->res = SZ_OK;
++}
++
++static void RangeEnc_FlushStream(CRangeEnc *p)
++{
++  size_t num;
++  if (p->res != SZ_OK)
++    return;
++  num = p->buf - p->bufBase;
++  if (num != p->outStream->Write(p->outStream, p->bufBase, num))
++    p->res = SZ_ERROR_WRITE;
++  p->processed += num;
++  p->buf = p->bufBase;
++}
++
++static void MY_FAST_CALL RangeEnc_ShiftLow(CRangeEnc *p)
++{
++  if ((UInt32)p->low < (UInt32)0xFF000000 || (int)(p->low >> 32) != 0)
++  {
++    Byte temp = p->cache;
++    do
++    {
++      Byte *buf = p->buf;
++      *buf++ = (Byte)(temp + (Byte)(p->low >> 32));
++      p->buf = buf;
++      if (buf == p->bufLim)
++        RangeEnc_FlushStream(p);
++      temp = 0xFF;
++    }
++    while (--p->cacheSize != 0);
++    p->cache = (Byte)((UInt32)p->low >> 24);
++  }
++  p->cacheSize++;
++  p->low = (UInt32)p->low << 8;
++}
++
++static void RangeEnc_FlushData(CRangeEnc *p)
++{
++  int i;
++  for (i = 0; i < 5; i++)
++    RangeEnc_ShiftLow(p);
++}
++
++static void RangeEnc_EncodeDirectBits(CRangeEnc *p, UInt32 value, int numBits)
++{
++  do
++  {
++    p->range >>= 1;
++    p->low += p->range & (0 - ((value >> --numBits) & 1));
++    if (p->range < kTopValue)
++    {
++      p->range <<= 8;
++      RangeEnc_ShiftLow(p);
++    }
++  }
++  while (numBits != 0);
++}
++
++static void RangeEnc_EncodeBit(CRangeEnc *p, CLzmaProb *prob, UInt32 symbol)
++{
++  UInt32 ttt = *prob;
++  UInt32 newBound = (p->range >> kNumBitModelTotalBits) * ttt;
++  if (symbol == 0)
++  {
++    p->range = newBound;
++    ttt += (kBitModelTotal - ttt) >> kNumMoveBits;
++  }
++  else
++  {
++    p->low += newBound;
++    p->range -= newBound;
++    ttt -= ttt >> kNumMoveBits;
++  }
++  *prob = (CLzmaProb)ttt;
++  if (p->range < kTopValue)
++  {
++    p->range <<= 8;
++    RangeEnc_ShiftLow(p);
++  }
++}
++
++static void LitEnc_Encode(CRangeEnc *p, CLzmaProb *probs, UInt32 symbol)
++{
++  symbol |= 0x100;
++  do
++  {
++    RangeEnc_EncodeBit(p, probs + (symbol >> 8), (symbol >> 7) & 1);
++    symbol <<= 1;
++  }
++  while (symbol < 0x10000);
++}
++
++static void LitEnc_EncodeMatched(CRangeEnc *p, CLzmaProb *probs, UInt32 symbol, UInt32 matchByte)
++{
++  UInt32 offs = 0x100;
++  symbol |= 0x100;
++  do
++  {
++    matchByte <<= 1;
++    RangeEnc_EncodeBit(p, probs + (offs + (matchByte & offs) + (symbol >> 8)), (symbol >> 7) & 1);
++    symbol <<= 1;
++    offs &= ~(matchByte ^ symbol);
++  }
++  while (symbol < 0x10000);
++}
++
++void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
++{
++  UInt32 i;
++  for (i = (1 << kNumMoveReducingBits) / 2; i < kBitModelTotal; i += (1 << kNumMoveReducingBits))
++  {
++    const int kCyclesBits = kNumBitPriceShiftBits;
++    UInt32 w = i;
++    UInt32 bitCount = 0;
++    int j;
++    for (j = 0; j < kCyclesBits; j++)
++    {
++      w = w * w;
++      bitCount <<= 1;
++      while (w >= ((UInt32)1 << 16))
++      {
++        w >>= 1;
++        bitCount++;
++      }
++    }
++    ProbPrices[i >> kNumMoveReducingBits] = ((kNumBitModelTotalBits << kCyclesBits) - 15 - bitCount);
++  }
++}
++
++
++#define GET_PRICE(prob, symbol) \
++  p->ProbPrices[((prob) ^ (((-(int)(symbol))) & (kBitModelTotal - 1))) >> kNumMoveReducingBits];
++
++#define GET_PRICEa(prob, symbol) \
++  ProbPrices[((prob) ^ ((-((int)(symbol))) & (kBitModelTotal - 1))) >> kNumMoveReducingBits];
++
++#define GET_PRICE_0(prob) p->ProbPrices[(prob) >> kNumMoveReducingBits]
++#define GET_PRICE_1(prob) p->ProbPrices[((prob) ^ (kBitModelTotal - 1)) >> kNumMoveReducingBits]
++
++#define GET_PRICE_0a(prob) ProbPrices[(prob) >> kNumMoveReducingBits]
++#define GET_PRICE_1a(prob) ProbPrices[((prob) ^ (kBitModelTotal - 1)) >> kNumMoveReducingBits]
++
++static UInt32 LitEnc_GetPrice(const CLzmaProb *probs, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  symbol |= 0x100;
++  do
++  {
++    price += GET_PRICEa(probs[symbol >> 8], (symbol >> 7) & 1);
++    symbol <<= 1;
++  }
++  while (symbol < 0x10000);
++  return price;
++}
++
++static UInt32 LitEnc_GetPriceMatched(const CLzmaProb *probs, UInt32 symbol, UInt32 matchByte, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  UInt32 offs = 0x100;
++  symbol |= 0x100;
++  do
++  {
++    matchByte <<= 1;
++    price += GET_PRICEa(probs[offs + (matchByte & offs) + (symbol >> 8)], (symbol >> 7) & 1);
++    symbol <<= 1;
++    offs &= ~(matchByte ^ symbol);
++  }
++  while (symbol < 0x10000);
++  return price;
++}
++
++
++static void RcTree_Encode(CRangeEnc *rc, CLzmaProb *probs, int numBitLevels, UInt32 symbol)
++{
++  UInt32 m = 1;
++  int i;
++  for (i = numBitLevels; i != 0;)
++  {
++    UInt32 bit;
++    i--;
++    bit = (symbol >> i) & 1;
++    RangeEnc_EncodeBit(rc, probs + m, bit);
++    m = (m << 1) | bit;
++  }
++}
++
++static void RcTree_ReverseEncode(CRangeEnc *rc, CLzmaProb *probs, int numBitLevels, UInt32 symbol)
++{
++  UInt32 m = 1;
++  int i;
++  for (i = 0; i < numBitLevels; i++)
++  {
++    UInt32 bit = symbol & 1;
++    RangeEnc_EncodeBit(rc, probs + m, bit);
++    m = (m << 1) | bit;
++    symbol >>= 1;
++  }
++}
++
++static UInt32 RcTree_GetPrice(const CLzmaProb *probs, int numBitLevels, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  symbol |= (1 << numBitLevels);
++  while (symbol != 1)
++  {
++    price += GET_PRICEa(probs[symbol >> 1], symbol & 1);
++    symbol >>= 1;
++  }
++  return price;
++}
++
++static UInt32 RcTree_ReverseGetPrice(const CLzmaProb *probs, int numBitLevels, UInt32 symbol, UInt32 *ProbPrices)
++{
++  UInt32 price = 0;
++  UInt32 m = 1;
++  int i;
++  for (i = numBitLevels; i != 0; i--)
++  {
++    UInt32 bit = symbol & 1;
++    symbol >>= 1;
++    price += GET_PRICEa(probs[m], bit);
++    m = (m << 1) | bit;
++  }
++  return price;
++}
++
++
++static void LenEnc_Init(CLenEnc *p)
++{
++  unsigned i;
++  p->choice = p->choice2 = kProbInitValue;
++  for (i = 0; i < (LZMA_NUM_PB_STATES_MAX << kLenNumLowBits); i++)
++    p->low[i] = kProbInitValue;
++  for (i = 0; i < (LZMA_NUM_PB_STATES_MAX << kLenNumMidBits); i++)
++    p->mid[i] = kProbInitValue;
++  for (i = 0; i < kLenNumHighSymbols; i++)
++    p->high[i] = kProbInitValue;
++}
++
++static void LenEnc_Encode(CLenEnc *p, CRangeEnc *rc, UInt32 symbol, UInt32 posState)
++{
++  if (symbol < kLenNumLowSymbols)
++  {
++    RangeEnc_EncodeBit(rc, &p->choice, 0);
++    RcTree_Encode(rc, p->low + (posState << kLenNumLowBits), kLenNumLowBits, symbol);
++  }
++  else
++  {
++    RangeEnc_EncodeBit(rc, &p->choice, 1);
++    if (symbol < kLenNumLowSymbols + kLenNumMidSymbols)
++    {
++      RangeEnc_EncodeBit(rc, &p->choice2, 0);
++      RcTree_Encode(rc, p->mid + (posState << kLenNumMidBits), kLenNumMidBits, symbol - kLenNumLowSymbols);
++    }
++    else
++    {
++      RangeEnc_EncodeBit(rc, &p->choice2, 1);
++      RcTree_Encode(rc, p->high, kLenNumHighBits, symbol - kLenNumLowSymbols - kLenNumMidSymbols);
++    }
++  }
++}
++
++static void LenEnc_SetPrices(CLenEnc *p, UInt32 posState, UInt32 numSymbols, UInt32 *prices, UInt32 *ProbPrices)
++{
++  UInt32 a0 = GET_PRICE_0a(p->choice);
++  UInt32 a1 = GET_PRICE_1a(p->choice);
++  UInt32 b0 = a1 + GET_PRICE_0a(p->choice2);
++  UInt32 b1 = a1 + GET_PRICE_1a(p->choice2);
++  UInt32 i = 0;
++  for (i = 0; i < kLenNumLowSymbols; i++)
++  {
++    if (i >= numSymbols)
++      return;
++    prices[i] = a0 + RcTree_GetPrice(p->low + (posState << kLenNumLowBits), kLenNumLowBits, i, ProbPrices);
++  }
++  for (; i < kLenNumLowSymbols + kLenNumMidSymbols; i++)
++  {
++    if (i >= numSymbols)
++      return;
++    prices[i] = b0 + RcTree_GetPrice(p->mid + (posState << kLenNumMidBits), kLenNumMidBits, i - kLenNumLowSymbols, ProbPrices);
++  }
++  for (; i < numSymbols; i++)
++    prices[i] = b1 + RcTree_GetPrice(p->high, kLenNumHighBits, i - kLenNumLowSymbols - kLenNumMidSymbols, ProbPrices);
++}
++
++static void MY_FAST_CALL LenPriceEnc_UpdateTable(CLenPriceEnc *p, UInt32 posState, UInt32 *ProbPrices)
++{
++  LenEnc_SetPrices(&p->p, posState, p->tableSize, p->prices[posState], ProbPrices);
++  p->counters[posState] = p->tableSize;
++}
++
++static void LenPriceEnc_UpdateTables(CLenPriceEnc *p, UInt32 numPosStates, UInt32 *ProbPrices)
++{
++  UInt32 posState;
++  for (posState = 0; posState < numPosStates; posState++)
++    LenPriceEnc_UpdateTable(p, posState, ProbPrices);
++}
++
++static void LenEnc_Encode2(CLenPriceEnc *p, CRangeEnc *rc, UInt32 symbol, UInt32 posState, Bool updatePrice, UInt32 *ProbPrices)
++{
++  LenEnc_Encode(&p->p, rc, symbol, posState);
++  if (updatePrice)
++    if (--p->counters[posState] == 0)
++      LenPriceEnc_UpdateTable(p, posState, ProbPrices);
++}
++
++
++
++
++static void MovePos(CLzmaEnc *p, UInt32 num)
++{
++  #ifdef SHOW_STAT
++  ttt += num;
++  printf("\n MovePos %d", num);
++  #endif
++  if (num != 0)
++  {
++    p->additionalOffset += num;
++    p->matchFinder.Skip(p->matchFinderObj, num);
++  }
++}
++
++static UInt32 ReadMatchDistances(CLzmaEnc *p, UInt32 *numDistancePairsRes)
++{
++  UInt32 lenRes = 0, numPairs;
++  p->numAvail = p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
++  numPairs = p->matchFinder.GetMatches(p->matchFinderObj, p->matches);
++  #ifdef SHOW_STAT
++  printf("\n i = %d numPairs = %d    ", ttt, numPairs / 2);
++  ttt++;
++  {
++    UInt32 i;
++    for (i = 0; i < numPairs; i += 2)
++      printf("%2d %6d   | ", p->matches[i], p->matches[i + 1]);
++  }
++  #endif
++  if (numPairs > 0)
++  {
++    lenRes = p->matches[numPairs - 2];
++    if (lenRes == p->numFastBytes)
++    {
++      const Byte *pby = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++      UInt32 distance = p->matches[numPairs - 1] + 1;
++      UInt32 numAvail = p->numAvail;
++      if (numAvail > LZMA_MATCH_LEN_MAX)
++        numAvail = LZMA_MATCH_LEN_MAX;
++      {
++        const Byte *pby2 = pby - distance;
++        for (; lenRes < numAvail && pby[lenRes] == pby2[lenRes]; lenRes++);
++      }
++    }
++  }
++  p->additionalOffset++;
++  *numDistancePairsRes = numPairs;
++  return lenRes;
++}
++
++
++#define MakeAsChar(p) (p)->backPrev = (UInt32)(-1); (p)->prev1IsChar = False;
++#define MakeAsShortRep(p) (p)->backPrev = 0; (p)->prev1IsChar = False;
++#define IsShortRep(p) ((p)->backPrev == 0)
++
++static UInt32 GetRepLen1Price(CLzmaEnc *p, UInt32 state, UInt32 posState)
++{
++  return
++    GET_PRICE_0(p->isRepG0[state]) +
++    GET_PRICE_0(p->isRep0Long[state][posState]);
++}
++
++static UInt32 GetPureRepPrice(CLzmaEnc *p, UInt32 repIndex, UInt32 state, UInt32 posState)
++{
++  UInt32 price;
++  if (repIndex == 0)
++  {
++    price = GET_PRICE_0(p->isRepG0[state]);
++    price += GET_PRICE_1(p->isRep0Long[state][posState]);
++  }
++  else
++  {
++    price = GET_PRICE_1(p->isRepG0[state]);
++    if (repIndex == 1)
++      price += GET_PRICE_0(p->isRepG1[state]);
++    else
++    {
++      price += GET_PRICE_1(p->isRepG1[state]);
++      price += GET_PRICE(p->isRepG2[state], repIndex - 2);
++    }
++  }
++  return price;
++}
++
++static UInt32 GetRepPrice(CLzmaEnc *p, UInt32 repIndex, UInt32 len, UInt32 state, UInt32 posState)
++{
++  return p->repLenEnc.prices[posState][len - LZMA_MATCH_LEN_MIN] +
++    GetPureRepPrice(p, repIndex, state, posState);
++}
++
++static UInt32 Backward(CLzmaEnc *p, UInt32 *backRes, UInt32 cur)
++{
++  UInt32 posMem = p->opt[cur].posPrev;
++  UInt32 backMem = p->opt[cur].backPrev;
++  p->optimumEndIndex = cur;
++  do
++  {
++    if (p->opt[cur].prev1IsChar)
++    {
++      MakeAsChar(&p->opt[posMem])
++      p->opt[posMem].posPrev = posMem - 1;
++      if (p->opt[cur].prev2)
++      {
++        p->opt[posMem - 1].prev1IsChar = False;
++        p->opt[posMem - 1].posPrev = p->opt[cur].posPrev2;
++        p->opt[posMem - 1].backPrev = p->opt[cur].backPrev2;
++      }
++    }
++    {
++      UInt32 posPrev = posMem;
++      UInt32 backCur = backMem;
++      
++      backMem = p->opt[posPrev].backPrev;
++      posMem = p->opt[posPrev].posPrev;
++      
++      p->opt[posPrev].backPrev = backCur;
++      p->opt[posPrev].posPrev = cur;
++      cur = posPrev;
++    }
++  }
++  while (cur != 0);
++  *backRes = p->opt[0].backPrev;
++  p->optimumCurrentIndex  = p->opt[0].posPrev;
++  return p->optimumCurrentIndex;
++}
++
++#define LIT_PROBS(pos, prevByte) (p->litProbs + ((((pos) & p->lpMask) << p->lc) + ((prevByte) >> (8 - p->lc))) * 0x300)
++
++static UInt32 GetOptimum(CLzmaEnc *p, UInt32 position, UInt32 *backRes)
++{
++  UInt32 numAvail, mainLen, numPairs, repMaxIndex, i, posState, lenEnd, len, cur;
++  UInt32 matchPrice, repMatchPrice, normalMatchPrice;
++  UInt32 reps[LZMA_NUM_REPS], repLens[LZMA_NUM_REPS];
++  UInt32 *matches;
++  const Byte *data;
++  Byte curByte, matchByte;
++  if (p->optimumEndIndex != p->optimumCurrentIndex)
++  {
++    const COptimal *opt = &p->opt[p->optimumCurrentIndex];
++    UInt32 lenRes = opt->posPrev - p->optimumCurrentIndex;
++    *backRes = opt->backPrev;
++    p->optimumCurrentIndex = opt->posPrev;
++    return lenRes;
++  }
++  p->optimumCurrentIndex = p->optimumEndIndex = 0;
++  
++  if (p->additionalOffset == 0)
++    mainLen = ReadMatchDistances(p, &numPairs);
++  else
++  {
++    mainLen = p->longestMatchLength;
++    numPairs = p->numPairs;
++  }
++
++  numAvail = p->numAvail;
++  if (numAvail < 2)
++  {
++    *backRes = (UInt32)(-1);
++    return 1;
++  }
++  if (numAvail > LZMA_MATCH_LEN_MAX)
++    numAvail = LZMA_MATCH_LEN_MAX;
++
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++  repMaxIndex = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 lenTest;
++    const Byte *data2;
++    reps[i] = p->reps[i];
++    data2 = data - (reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++    {
++      repLens[i] = 0;
++      continue;
++    }
++    for (lenTest = 2; lenTest < numAvail && data[lenTest] == data2[lenTest]; lenTest++);
++    repLens[i] = lenTest;
++    if (lenTest > repLens[repMaxIndex])
++      repMaxIndex = i;
++  }
++  if (repLens[repMaxIndex] >= p->numFastBytes)
++  {
++    UInt32 lenRes;
++    *backRes = repMaxIndex;
++    lenRes = repLens[repMaxIndex];
++    MovePos(p, lenRes - 1);
++    return lenRes;
++  }
++
++  matches = p->matches;
++  if (mainLen >= p->numFastBytes)
++  {
++    *backRes = matches[numPairs - 1] + LZMA_NUM_REPS;
++    MovePos(p, mainLen - 1);
++    return mainLen;
++  }
++  curByte = *data;
++  matchByte = *(data - (reps[0] + 1));
++
++  if (mainLen < 2 && curByte != matchByte && repLens[repMaxIndex] < 2)
++  {
++    *backRes = (UInt32)-1;
++    return 1;
++  }
++
++  p->opt[0].state = (CState)p->state;
++
++  posState = (position & p->pbMask);
++
++  {
++    const CLzmaProb *probs = LIT_PROBS(position, *(data - 1));
++    p->opt[1].price = GET_PRICE_0(p->isMatch[p->state][posState]) +
++        (!IsCharState(p->state) ?
++          LitEnc_GetPriceMatched(probs, curByte, matchByte, p->ProbPrices) :
++          LitEnc_GetPrice(probs, curByte, p->ProbPrices));
++  }
++
++  MakeAsChar(&p->opt[1]);
++
++  matchPrice = GET_PRICE_1(p->isMatch[p->state][posState]);
++  repMatchPrice = matchPrice + GET_PRICE_1(p->isRep[p->state]);
++
++  if (matchByte == curByte)
++  {
++    UInt32 shortRepPrice = repMatchPrice + GetRepLen1Price(p, p->state, posState);
++    if (shortRepPrice < p->opt[1].price)
++    {
++      p->opt[1].price = shortRepPrice;
++      MakeAsShortRep(&p->opt[1]);
++    }
++  }
++  lenEnd = ((mainLen >= repLens[repMaxIndex]) ? mainLen : repLens[repMaxIndex]);
++
++  if (lenEnd < 2)
++  {
++    *backRes = p->opt[1].backPrev;
++    return 1;
++  }
++
++  p->opt[1].posPrev = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++    p->opt[0].backs[i] = reps[i];
++
++  len = lenEnd;
++  do
++    p->opt[len--].price = kInfinityPrice;
++  while (len >= 2);
++
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 repLen = repLens[i];
++    UInt32 price;
++    if (repLen < 2)
++      continue;
++    price = repMatchPrice + GetPureRepPrice(p, i, p->state, posState);
++    do
++    {
++      UInt32 curAndLenPrice = price + p->repLenEnc.prices[posState][repLen - 2];
++      COptimal *opt = &p->opt[repLen];
++      if (curAndLenPrice < opt->price)
++      {
++        opt->price = curAndLenPrice;
++        opt->posPrev = 0;
++        opt->backPrev = i;
++        opt->prev1IsChar = False;
++      }
++    }
++    while (--repLen >= 2);
++  }
++
++  normalMatchPrice = matchPrice + GET_PRICE_0(p->isRep[p->state]);
++
++  len = ((repLens[0] >= 2) ? repLens[0] + 1 : 2);
++  if (len <= mainLen)
++  {
++    UInt32 offs = 0;
++    while (len > matches[offs])
++      offs += 2;
++    for (; ; len++)
++    {
++      COptimal *opt;
++      UInt32 distance = matches[offs + 1];
++
++      UInt32 curAndLenPrice = normalMatchPrice + p->lenEnc.prices[posState][len - LZMA_MATCH_LEN_MIN];
++      UInt32 lenToPosState = GetLenToPosState(len);
++      if (distance < kNumFullDistances)
++        curAndLenPrice += p->distancesPrices[lenToPosState][distance];
++      else
++      {
++        UInt32 slot;
++        GetPosSlot2(distance, slot);
++        curAndLenPrice += p->alignPrices[distance & kAlignMask] + p->posSlotPrices[lenToPosState][slot];
++      }
++      opt = &p->opt[len];
++      if (curAndLenPrice < opt->price)
++      {
++        opt->price = curAndLenPrice;
++        opt->posPrev = 0;
++        opt->backPrev = distance + LZMA_NUM_REPS;
++        opt->prev1IsChar = False;
++      }
++      if (len == matches[offs])
++      {
++        offs += 2;
++        if (offs == numPairs)
++          break;
++      }
++    }
++  }
++
++  cur = 0;
++
++    #ifdef SHOW_STAT2
++    if (position >= 0)
++    {
++      unsigned i;
++      printf("\n pos = %4X", position);
++      for (i = cur; i <= lenEnd; i++)
++      printf("\nprice[%4X] = %d", position - cur + i, p->opt[i].price);
++    }
++    #endif
++
++  for (;;)
++  {
++    UInt32 numAvailFull, newLen, numPairs, posPrev, state, posState, startLen;
++    UInt32 curPrice, curAnd1Price, matchPrice, repMatchPrice;
++    Bool nextIsChar;
++    Byte curByte, matchByte;
++    const Byte *data;
++    COptimal *curOpt;
++    COptimal *nextOpt;
++
++    cur++;
++    if (cur == lenEnd)
++      return Backward(p, backRes, cur);
++
++    newLen = ReadMatchDistances(p, &numPairs);
++    if (newLen >= p->numFastBytes)
++    {
++      p->numPairs = numPairs;
++      p->longestMatchLength = newLen;
++      return Backward(p, backRes, cur);
++    }
++    position++;
++    curOpt = &p->opt[cur];
++    posPrev = curOpt->posPrev;
++    if (curOpt->prev1IsChar)
++    {
++      posPrev--;
++      if (curOpt->prev2)
++      {
++        state = p->opt[curOpt->posPrev2].state;
++        if (curOpt->backPrev2 < LZMA_NUM_REPS)
++          state = kRepNextStates[state];
++        else
++          state = kMatchNextStates[state];
++      }
++      else
++        state = p->opt[posPrev].state;
++      state = kLiteralNextStates[state];
++    }
++    else
++      state = p->opt[posPrev].state;
++    if (posPrev == cur - 1)
++    {
++      if (IsShortRep(curOpt))
++        state = kShortRepNextStates[state];
++      else
++        state = kLiteralNextStates[state];
++    }
++    else
++    {
++      UInt32 pos;
++      const COptimal *prevOpt;
++      if (curOpt->prev1IsChar && curOpt->prev2)
++      {
++        posPrev = curOpt->posPrev2;
++        pos = curOpt->backPrev2;
++        state = kRepNextStates[state];
++      }
++      else
++      {
++        pos = curOpt->backPrev;
++        if (pos < LZMA_NUM_REPS)
++          state = kRepNextStates[state];
++        else
++          state = kMatchNextStates[state];
++      }
++      prevOpt = &p->opt[posPrev];
++      if (pos < LZMA_NUM_REPS)
++      {
++        UInt32 i;
++        reps[0] = prevOpt->backs[pos];
++        for (i = 1; i <= pos; i++)
++          reps[i] = prevOpt->backs[i - 1];
++        for (; i < LZMA_NUM_REPS; i++)
++          reps[i] = prevOpt->backs[i];
++      }
++      else
++      {
++        UInt32 i;
++        reps[0] = (pos - LZMA_NUM_REPS);
++        for (i = 1; i < LZMA_NUM_REPS; i++)
++          reps[i] = prevOpt->backs[i - 1];
++      }
++    }
++    curOpt->state = (CState)state;
++
++    curOpt->backs[0] = reps[0];
++    curOpt->backs[1] = reps[1];
++    curOpt->backs[2] = reps[2];
++    curOpt->backs[3] = reps[3];
++
++    curPrice = curOpt->price;
++    nextIsChar = False;
++    data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++    curByte = *data;
++    matchByte = *(data - (reps[0] + 1));
++
++    posState = (position & p->pbMask);
++
++    curAnd1Price = curPrice + GET_PRICE_0(p->isMatch[state][posState]);
++    {
++      const CLzmaProb *probs = LIT_PROBS(position, *(data - 1));
++      curAnd1Price +=
++        (!IsCharState(state) ?
++          LitEnc_GetPriceMatched(probs, curByte, matchByte, p->ProbPrices) :
++          LitEnc_GetPrice(probs, curByte, p->ProbPrices));
++    }
++
++    nextOpt = &p->opt[cur + 1];
++
++    if (curAnd1Price < nextOpt->price)
++    {
++      nextOpt->price = curAnd1Price;
++      nextOpt->posPrev = cur;
++      MakeAsChar(nextOpt);
++      nextIsChar = True;
++    }
++
++    matchPrice = curPrice + GET_PRICE_1(p->isMatch[state][posState]);
++    repMatchPrice = matchPrice + GET_PRICE_1(p->isRep[state]);
++    
++    if (matchByte == curByte && !(nextOpt->posPrev < cur && nextOpt->backPrev == 0))
++    {
++      UInt32 shortRepPrice = repMatchPrice + GetRepLen1Price(p, state, posState);
++      if (shortRepPrice <= nextOpt->price)
++      {
++        nextOpt->price = shortRepPrice;
++        nextOpt->posPrev = cur;
++        MakeAsShortRep(nextOpt);
++        nextIsChar = True;
++      }
++    }
++    numAvailFull = p->numAvail;
++    {
++      UInt32 temp = kNumOpts - 1 - cur;
++      if (temp < numAvailFull)
++        numAvailFull = temp;
++    }
++
++    if (numAvailFull < 2)
++      continue;
++    numAvail = (numAvailFull <= p->numFastBytes ? numAvailFull : p->numFastBytes);
++
++    if (!nextIsChar && matchByte != curByte) /* speed optimization */
++    {
++      /* try Literal + rep0 */
++      UInt32 temp;
++      UInt32 lenTest2;
++      const Byte *data2 = data - (reps[0] + 1);
++      UInt32 limit = p->numFastBytes + 1;
++      if (limit > numAvailFull)
++        limit = numAvailFull;
++
++      for (temp = 1; temp < limit && data[temp] == data2[temp]; temp++);
++      lenTest2 = temp - 1;
++      if (lenTest2 >= 2)
++      {
++        UInt32 state2 = kLiteralNextStates[state];
++        UInt32 posStateNext = (position + 1) & p->pbMask;
++        UInt32 nextRepMatchPrice = curAnd1Price +
++            GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++            GET_PRICE_1(p->isRep[state2]);
++        /* for (; lenTest2 >= 2; lenTest2--) */
++        {
++          UInt32 curAndLenPrice;
++          COptimal *opt;
++          UInt32 offset = cur + 1 + lenTest2;
++          while (lenEnd < offset)
++            p->opt[++lenEnd].price = kInfinityPrice;
++          curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++          opt = &p->opt[offset];
++          if (curAndLenPrice < opt->price)
++          {
++            opt->price = curAndLenPrice;
++            opt->posPrev = cur + 1;
++            opt->backPrev = 0;
++            opt->prev1IsChar = True;
++            opt->prev2 = False;
++          }
++        }
++      }
++    }
++    
++    startLen = 2; /* speed optimization */
++    {
++    UInt32 repIndex;
++    for (repIndex = 0; repIndex < LZMA_NUM_REPS; repIndex++)
++    {
++      UInt32 lenTest;
++      UInt32 lenTestTemp;
++      UInt32 price;
++      const Byte *data2 = data - (reps[repIndex] + 1);
++      if (data[0] != data2[0] || data[1] != data2[1])
++        continue;
++      for (lenTest = 2; lenTest < numAvail && data[lenTest] == data2[lenTest]; lenTest++);
++      while (lenEnd < cur + lenTest)
++        p->opt[++lenEnd].price = kInfinityPrice;
++      lenTestTemp = lenTest;
++      price = repMatchPrice + GetPureRepPrice(p, repIndex, state, posState);
++      do
++      {
++        UInt32 curAndLenPrice = price + p->repLenEnc.prices[posState][lenTest - 2];
++        COptimal *opt = &p->opt[cur + lenTest];
++        if (curAndLenPrice < opt->price)
++        {
++          opt->price = curAndLenPrice;
++          opt->posPrev = cur;
++          opt->backPrev = repIndex;
++          opt->prev1IsChar = False;
++        }
++      }
++      while (--lenTest >= 2);
++      lenTest = lenTestTemp;
++      
++      if (repIndex == 0)
++        startLen = lenTest + 1;
++        
++      /* if (_maxMode) */
++        {
++          UInt32 lenTest2 = lenTest + 1;
++          UInt32 limit = lenTest2 + p->numFastBytes;
++          UInt32 nextRepMatchPrice;
++          if (limit > numAvailFull)
++            limit = numAvailFull;
++          for (; lenTest2 < limit && data[lenTest2] == data2[lenTest2]; lenTest2++);
++          lenTest2 -= lenTest + 1;
++          if (lenTest2 >= 2)
++          {
++            UInt32 state2 = kRepNextStates[state];
++            UInt32 posStateNext = (position + lenTest) & p->pbMask;
++            UInt32 curAndLenCharPrice =
++                price + p->repLenEnc.prices[posState][lenTest - 2] +
++                GET_PRICE_0(p->isMatch[state2][posStateNext]) +
++                LitEnc_GetPriceMatched(LIT_PROBS(position + lenTest, data[lenTest - 1]),
++                    data[lenTest], data2[lenTest], p->ProbPrices);
++            state2 = kLiteralNextStates[state2];
++            posStateNext = (position + lenTest + 1) & p->pbMask;
++            nextRepMatchPrice = curAndLenCharPrice +
++                GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++                GET_PRICE_1(p->isRep[state2]);
++            
++            /* for (; lenTest2 >= 2; lenTest2--) */
++            {
++              UInt32 curAndLenPrice;
++              COptimal *opt;
++              UInt32 offset = cur + lenTest + 1 + lenTest2;
++              while (lenEnd < offset)
++                p->opt[++lenEnd].price = kInfinityPrice;
++              curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++              opt = &p->opt[offset];
++              if (curAndLenPrice < opt->price)
++              {
++                opt->price = curAndLenPrice;
++                opt->posPrev = cur + lenTest + 1;
++                opt->backPrev = 0;
++                opt->prev1IsChar = True;
++                opt->prev2 = True;
++                opt->posPrev2 = cur;
++                opt->backPrev2 = repIndex;
++              }
++            }
++          }
++        }
++    }
++    }
++    /* for (UInt32 lenTest = 2; lenTest <= newLen; lenTest++) */
++    if (newLen > numAvail)
++    {
++      newLen = numAvail;
++      for (numPairs = 0; newLen > matches[numPairs]; numPairs += 2);
++      matches[numPairs] = newLen;
++      numPairs += 2;
++    }
++    if (newLen >= startLen)
++    {
++      UInt32 normalMatchPrice = matchPrice + GET_PRICE_0(p->isRep[state]);
++      UInt32 offs, curBack, posSlot;
++      UInt32 lenTest;
++      while (lenEnd < cur + newLen)
++        p->opt[++lenEnd].price = kInfinityPrice;
++
++      offs = 0;
++      while (startLen > matches[offs])
++        offs += 2;
++      curBack = matches[offs + 1];
++      GetPosSlot2(curBack, posSlot);
++      for (lenTest = /*2*/ startLen; ; lenTest++)
++      {
++        UInt32 curAndLenPrice = normalMatchPrice + p->lenEnc.prices[posState][lenTest - LZMA_MATCH_LEN_MIN];
++        UInt32 lenToPosState = GetLenToPosState(lenTest);
++        COptimal *opt;
++        if (curBack < kNumFullDistances)
++          curAndLenPrice += p->distancesPrices[lenToPosState][curBack];
++        else
++          curAndLenPrice += p->posSlotPrices[lenToPosState][posSlot] + p->alignPrices[curBack & kAlignMask];
++        
++        opt = &p->opt[cur + lenTest];
++        if (curAndLenPrice < opt->price)
++        {
++          opt->price = curAndLenPrice;
++          opt->posPrev = cur;
++          opt->backPrev = curBack + LZMA_NUM_REPS;
++          opt->prev1IsChar = False;
++        }
++
++        if (/*_maxMode && */lenTest == matches[offs])
++        {
++          /* Try Match + Literal + Rep0 */
++          const Byte *data2 = data - (curBack + 1);
++          UInt32 lenTest2 = lenTest + 1;
++          UInt32 limit = lenTest2 + p->numFastBytes;
++          UInt32 nextRepMatchPrice;
++          if (limit > numAvailFull)
++            limit = numAvailFull;
++          for (; lenTest2 < limit && data[lenTest2] == data2[lenTest2]; lenTest2++);
++          lenTest2 -= lenTest + 1;
++          if (lenTest2 >= 2)
++          {
++            UInt32 state2 = kMatchNextStates[state];
++            UInt32 posStateNext = (position + lenTest) & p->pbMask;
++            UInt32 curAndLenCharPrice = curAndLenPrice +
++                GET_PRICE_0(p->isMatch[state2][posStateNext]) +
++                LitEnc_GetPriceMatched(LIT_PROBS(position + lenTest, data[lenTest - 1]),
++                    data[lenTest], data2[lenTest], p->ProbPrices);
++            state2 = kLiteralNextStates[state2];
++            posStateNext = (posStateNext + 1) & p->pbMask;
++            nextRepMatchPrice = curAndLenCharPrice +
++                GET_PRICE_1(p->isMatch[state2][posStateNext]) +
++                GET_PRICE_1(p->isRep[state2]);
++            
++            /* for (; lenTest2 >= 2; lenTest2--) */
++            {
++              UInt32 offset = cur + lenTest + 1 + lenTest2;
++              UInt32 curAndLenPrice;
++              COptimal *opt;
++              while (lenEnd < offset)
++                p->opt[++lenEnd].price = kInfinityPrice;
++              curAndLenPrice = nextRepMatchPrice + GetRepPrice(p, 0, lenTest2, state2, posStateNext);
++              opt = &p->opt[offset];
++              if (curAndLenPrice < opt->price)
++              {
++                opt->price = curAndLenPrice;
++                opt->posPrev = cur + lenTest + 1;
++                opt->backPrev = 0;
++                opt->prev1IsChar = True;
++                opt->prev2 = True;
++                opt->posPrev2 = cur;
++                opt->backPrev2 = curBack + LZMA_NUM_REPS;
++              }
++            }
++          }
++          offs += 2;
++          if (offs == numPairs)
++            break;
++          curBack = matches[offs + 1];
++          if (curBack >= kNumFullDistances)
++            GetPosSlot2(curBack, posSlot);
++        }
++      }
++    }
++  }
++}
++
++#define ChangePair(smallDist, bigDist) (((bigDist) >> 7) > (smallDist))
++
++static UInt32 GetOptimumFast(CLzmaEnc *p, UInt32 *backRes)
++{
++  UInt32 numAvail, mainLen, mainDist, numPairs, repIndex, repLen, i;
++  const Byte *data;
++  const UInt32 *matches;
++
++  if (p->additionalOffset == 0)
++    mainLen = ReadMatchDistances(p, &numPairs);
++  else
++  {
++    mainLen = p->longestMatchLength;
++    numPairs = p->numPairs;
++  }
++
++  numAvail = p->numAvail;
++  *backRes = (UInt32)-1;
++  if (numAvail < 2)
++    return 1;
++  if (numAvail > LZMA_MATCH_LEN_MAX)
++    numAvail = LZMA_MATCH_LEN_MAX;
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++
++  repLen = repIndex = 0;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 len;
++    const Byte *data2 = data - (p->reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++      continue;
++    for (len = 2; len < numAvail && data[len] == data2[len]; len++);
++    if (len >= p->numFastBytes)
++    {
++      *backRes = i;
++      MovePos(p, len - 1);
++      return len;
++    }
++    if (len > repLen)
++    {
++      repIndex = i;
++      repLen = len;
++    }
++  }
++
++  matches = p->matches;
++  if (mainLen >= p->numFastBytes)
++  {
++    *backRes = matches[numPairs - 1] + LZMA_NUM_REPS;
++    MovePos(p, mainLen - 1);
++    return mainLen;
++  }
++
++  mainDist = 0; /* for GCC */
++  if (mainLen >= 2)
++  {
++    mainDist = matches[numPairs - 1];
++    while (numPairs > 2 && mainLen == matches[numPairs - 4] + 1)
++    {
++      if (!ChangePair(matches[numPairs - 3], mainDist))
++        break;
++      numPairs -= 2;
++      mainLen = matches[numPairs - 2];
++      mainDist = matches[numPairs - 1];
++    }
++    if (mainLen == 2 && mainDist >= 0x80)
++      mainLen = 1;
++  }
++
++  if (repLen >= 2 && (
++        (repLen + 1 >= mainLen) ||
++        (repLen + 2 >= mainLen && mainDist >= (1 << 9)) ||
++        (repLen + 3 >= mainLen && mainDist >= (1 << 15))))
++  {
++    *backRes = repIndex;
++    MovePos(p, repLen - 1);
++    return repLen;
++  }
++  
++  if (mainLen < 2 || numAvail <= 2)
++    return 1;
++
++  p->longestMatchLength = ReadMatchDistances(p, &p->numPairs);
++  if (p->longestMatchLength >= 2)
++  {
++    UInt32 newDistance = matches[p->numPairs - 1];
++    if ((p->longestMatchLength >= mainLen && newDistance < mainDist) ||
++        (p->longestMatchLength == mainLen + 1 && !ChangePair(mainDist, newDistance)) ||
++        (p->longestMatchLength > mainLen + 1) ||
++        (p->longestMatchLength + 1 >= mainLen && mainLen >= 3 && ChangePair(newDistance, mainDist)))
++      return 1;
++  }
++  
++  data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - 1;
++  for (i = 0; i < LZMA_NUM_REPS; i++)
++  {
++    UInt32 len, limit;
++    const Byte *data2 = data - (p->reps[i] + 1);
++    if (data[0] != data2[0] || data[1] != data2[1])
++      continue;
++    limit = mainLen - 1;
++    for (len = 2; len < limit && data[len] == data2[len]; len++);
++    if (len >= limit)
++      return 1;
++  }
++  *backRes = mainDist + LZMA_NUM_REPS;
++  MovePos(p, mainLen - 2);
++  return mainLen;
++}
++
++static void WriteEndMarker(CLzmaEnc *p, UInt32 posState)
++{
++  UInt32 len;
++  RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 1);
++  RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
++  p->state = kMatchNextStates[p->state];
++  len = LZMA_MATCH_LEN_MIN;
++  LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++  RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, (1 << kNumPosSlotBits) - 1);
++  RangeEnc_EncodeDirectBits(&p->rc, (((UInt32)1 << 30) - 1) >> kNumAlignBits, 30 - kNumAlignBits);
++  RcTree_ReverseEncode(&p->rc, p->posAlignEncoder, kNumAlignBits, kAlignMask);
++}
++
++static SRes CheckErrors(CLzmaEnc *p)
++{
++  if (p->result != SZ_OK)
++    return p->result;
++  if (p->rc.res != SZ_OK)
++    p->result = SZ_ERROR_WRITE;
++  if (p->matchFinderBase.result != SZ_OK)
++    p->result = SZ_ERROR_READ;
++  if (p->result != SZ_OK)
++    p->finished = True;
++  return p->result;
++}
++
++static SRes Flush(CLzmaEnc *p, UInt32 nowPos)
++{
++  /* ReleaseMFStream(); */
++  p->finished = True;
++  if (p->writeEndMark)
++    WriteEndMarker(p, nowPos & p->pbMask);
++  RangeEnc_FlushData(&p->rc);
++  RangeEnc_FlushStream(&p->rc);
++  return CheckErrors(p);
++}
++
++static void FillAlignPrices(CLzmaEnc *p)
++{
++  UInt32 i;
++  for (i = 0; i < kAlignTableSize; i++)
++    p->alignPrices[i] = RcTree_ReverseGetPrice(p->posAlignEncoder, kNumAlignBits, i, p->ProbPrices);
++  p->alignPriceCount = 0;
++}
++
++static void FillDistancesPrices(CLzmaEnc *p)
++{
++  UInt32 tempPrices[kNumFullDistances];
++  UInt32 i, lenToPosState;
++  for (i = kStartPosModelIndex; i < kNumFullDistances; i++)
++  {
++    UInt32 posSlot = GetPosSlot1(i);
++    UInt32 footerBits = ((posSlot >> 1) - 1);
++    UInt32 base = ((2 | (posSlot & 1)) << footerBits);
++    tempPrices[i] = RcTree_ReverseGetPrice(p->posEncoders + base - posSlot - 1, footerBits, i - base, p->ProbPrices);
++  }
++
++  for (lenToPosState = 0; lenToPosState < kNumLenToPosStates; lenToPosState++)
++  {
++    UInt32 posSlot;
++    const CLzmaProb *encoder = p->posSlotEncoder[lenToPosState];
++    UInt32 *posSlotPrices = p->posSlotPrices[lenToPosState];
++    for (posSlot = 0; posSlot < p->distTableSize; posSlot++)
++      posSlotPrices[posSlot] = RcTree_GetPrice(encoder, kNumPosSlotBits, posSlot, p->ProbPrices);
++    for (posSlot = kEndPosModelIndex; posSlot < p->distTableSize; posSlot++)
++      posSlotPrices[posSlot] += ((((posSlot >> 1) - 1) - kNumAlignBits) << kNumBitPriceShiftBits);
++
++    {
++      UInt32 *distancesPrices = p->distancesPrices[lenToPosState];
++      UInt32 i;
++      for (i = 0; i < kStartPosModelIndex; i++)
++        distancesPrices[i] = posSlotPrices[i];
++      for (; i < kNumFullDistances; i++)
++        distancesPrices[i] = posSlotPrices[GetPosSlot1(i)] + tempPrices[i];
++    }
++  }
++  p->matchPriceCount = 0;
++}
++
++void LzmaEnc_Construct(CLzmaEnc *p)
++{
++  RangeEnc_Construct(&p->rc);
++  MatchFinder_Construct(&p->matchFinderBase);
++  #ifndef _7ZIP_ST
++  MatchFinderMt_Construct(&p->matchFinderMt);
++  p->matchFinderMt.MatchFinder = &p->matchFinderBase;
++  #endif
++
++  {
++    CLzmaEncProps props;
++    LzmaEncProps_Init(&props);
++    LzmaEnc_SetProps(p, &props);
++  }
++
++  #ifndef LZMA_LOG_BSR
++  LzmaEnc_FastPosInit(p->g_FastPos);
++  #endif
++
++  LzmaEnc_InitPriceTables(p->ProbPrices);
++  p->litProbs = 0;
++  p->saveState.litProbs = 0;
++}
++
++CLzmaEncHandle LzmaEnc_Create(ISzAlloc *alloc)
++{
++  void *p;
++  p = alloc->Alloc(alloc, sizeof(CLzmaEnc));
++  if (p != 0)
++    LzmaEnc_Construct((CLzmaEnc *)p);
++  return p;
++}
++
++void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
++{
++  alloc->Free(alloc, p->litProbs);
++  alloc->Free(alloc, p->saveState.litProbs);
++  p->litProbs = 0;
++  p->saveState.litProbs = 0;
++}
++
++void LzmaEnc_Destruct(CLzmaEnc *p, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  #ifndef _7ZIP_ST
++  MatchFinderMt_Destruct(&p->matchFinderMt, allocBig);
++  #endif
++  MatchFinder_Free(&p->matchFinderBase, allocBig);
++  LzmaEnc_FreeLits(p, alloc);
++  RangeEnc_Free(&p->rc, alloc);
++}
++
++void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  LzmaEnc_Destruct((CLzmaEnc *)p, alloc, allocBig);
++  alloc->Free(alloc, p);
++}
++
++static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize, UInt32 maxUnpackSize)
++{
++  UInt32 nowPos32, startPos32;
++  if (p->needInit)
++  {
++    p->matchFinder.Init(p->matchFinderObj);
++    p->needInit = 0;
++  }
++
++  if (p->finished)
++    return p->result;
++  RINOK(CheckErrors(p));
++
++  nowPos32 = (UInt32)p->nowPos64;
++  startPos32 = nowPos32;
++
++  if (p->nowPos64 == 0)
++  {
++    UInt32 numPairs;
++    Byte curByte;
++    if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) == 0)
++      return Flush(p, nowPos32);
++    ReadMatchDistances(p, &numPairs);
++    RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][0], 0);
++    p->state = kLiteralNextStates[p->state];
++    curByte = p->matchFinder.GetIndexByte(p->matchFinderObj, 0 - p->additionalOffset);
++    LitEnc_Encode(&p->rc, p->litProbs, curByte);
++    p->additionalOffset--;
++    nowPos32++;
++  }
++
++  if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) != 0)
++  for (;;)
++  {
++    UInt32 pos, len, posState;
++
++    if (p->fastMode)
++      len = GetOptimumFast(p, &pos);
++    else
++      len = GetOptimum(p, nowPos32, &pos);
++
++    #ifdef SHOW_STAT2
++    printf("\n pos = %4X,   len = %d   pos = %d", nowPos32, len, pos);
++    #endif
++
++    posState = nowPos32 & p->pbMask;
++    if (len == 1 && pos == (UInt32)-1)
++    {
++      Byte curByte;
++      CLzmaProb *probs;
++      const Byte *data;
++
++      RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 0);
++      data = p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
++      curByte = *data;
++      probs = LIT_PROBS(nowPos32, *(data - 1));
++      if (IsCharState(p->state))
++        LitEnc_Encode(&p->rc, probs, curByte);
++      else
++        LitEnc_EncodeMatched(&p->rc, probs, curByte, *(data - p->reps[0] - 1));
++      p->state = kLiteralNextStates[p->state];
++    }
++    else
++    {
++      RangeEnc_EncodeBit(&p->rc, &p->isMatch[p->state][posState], 1);
++      if (pos < LZMA_NUM_REPS)
++      {
++        RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 1);
++        if (pos == 0)
++        {
++          RangeEnc_EncodeBit(&p->rc, &p->isRepG0[p->state], 0);
++          RangeEnc_EncodeBit(&p->rc, &p->isRep0Long[p->state][posState], ((len == 1) ? 0 : 1));
++        }
++        else
++        {
++          UInt32 distance = p->reps[pos];
++          RangeEnc_EncodeBit(&p->rc, &p->isRepG0[p->state], 1);
++          if (pos == 1)
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG1[p->state], 0);
++          else
++          {
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG1[p->state], 1);
++            RangeEnc_EncodeBit(&p->rc, &p->isRepG2[p->state], pos - 2);
++            if (pos == 3)
++              p->reps[3] = p->reps[2];
++            p->reps[2] = p->reps[1];
++          }
++          p->reps[1] = p->reps[0];
++          p->reps[0] = distance;
++        }
++        if (len == 1)
++          p->state = kShortRepNextStates[p->state];
++        else
++        {
++          LenEnc_Encode2(&p->repLenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++          p->state = kRepNextStates[p->state];
++        }
++      }
++      else
++      {
++        UInt32 posSlot;
++        RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
++        p->state = kMatchNextStates[p->state];
++        LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
++        pos -= LZMA_NUM_REPS;
++        GetPosSlot(pos, posSlot);
++        RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, posSlot);
++        
++        if (posSlot >= kStartPosModelIndex)
++        {
++          UInt32 footerBits = ((posSlot >> 1) - 1);
++          UInt32 base = ((2 | (posSlot & 1)) << footerBits);
++          UInt32 posReduced = pos - base;
++
++          if (posSlot < kEndPosModelIndex)
++            RcTree_ReverseEncode(&p->rc, p->posEncoders + base - posSlot - 1, footerBits, posReduced);
++          else
++          {
++            RangeEnc_EncodeDirectBits(&p->rc, posReduced >> kNumAlignBits, footerBits - kNumAlignBits);
++            RcTree_ReverseEncode(&p->rc, p->posAlignEncoder, kNumAlignBits, posReduced & kAlignMask);
++            p->alignPriceCount++;
++          }
++        }
++        p->reps[3] = p->reps[2];
++        p->reps[2] = p->reps[1];
++        p->reps[1] = p->reps[0];
++        p->reps[0] = pos;
++        p->matchPriceCount++;
++      }
++    }
++    p->additionalOffset -= len;
++    nowPos32 += len;
++    if (p->additionalOffset == 0)
++    {
++      UInt32 processed;
++      if (!p->fastMode)
++      {
++        if (p->matchPriceCount >= (1 << 7))
++          FillDistancesPrices(p);
++        if (p->alignPriceCount >= kAlignTableSize)
++          FillAlignPrices(p);
++      }
++      if (p->matchFinder.GetNumAvailableBytes(p->matchFinderObj) == 0)
++        break;
++      processed = nowPos32 - startPos32;
++      if (useLimits)
++      {
++        if (processed + kNumOpts + 300 >= maxUnpackSize ||
++            RangeEnc_GetProcessed(&p->rc) + kNumOpts * 2 >= maxPackSize)
++          break;
++      }
++      else if (processed >= (1 << 15))
++      {
++        p->nowPos64 += nowPos32 - startPos32;
++        return CheckErrors(p);
++      }
++    }
++  }
++  p->nowPos64 += nowPos32 - startPos32;
++  return Flush(p, nowPos32);
++}
++
++#define kBigHashDicLimit ((UInt32)1 << 24)
++
++static SRes LzmaEnc_Alloc(CLzmaEnc *p, UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  UInt32 beforeSize = kNumOpts;
++  Bool btMode;
++  if (!RangeEnc_Alloc(&p->rc, alloc))
++    return SZ_ERROR_MEM;
++  btMode = (p->matchFinderBase.btMode != 0);
++  #ifndef _7ZIP_ST
++  p->mtMode = (p->multiThread && !p->fastMode && btMode);
++  #endif
++
++  {
++    unsigned lclp = p->lc + p->lp;
++    if (p->litProbs == 0 || p->saveState.litProbs == 0 || p->lclp != lclp)
++    {
++      LzmaEnc_FreeLits(p, alloc);
++      p->litProbs = (CLzmaProb *)alloc->Alloc(alloc, (0x300 << lclp) * sizeof(CLzmaProb));
++      p->saveState.litProbs = (CLzmaProb *)alloc->Alloc(alloc, (0x300 << lclp) * sizeof(CLzmaProb));
++      if (p->litProbs == 0 || p->saveState.litProbs == 0)
++      {
++        LzmaEnc_FreeLits(p, alloc);
++        return SZ_ERROR_MEM;
++      }
++      p->lclp = lclp;
++    }
++  }
++
++  p->matchFinderBase.bigHash = (p->dictSize > kBigHashDicLimit);
++
++  if (beforeSize + p->dictSize < keepWindowSize)
++    beforeSize = keepWindowSize - p->dictSize;
++
++  #ifndef _7ZIP_ST
++  if (p->mtMode)
++  {
++    RINOK(MatchFinderMt_Create(&p->matchFinderMt, p->dictSize, beforeSize, p->numFastBytes, LZMA_MATCH_LEN_MAX, allocBig));
++    p->matchFinderObj = &p->matchFinderMt;
++    MatchFinderMt_CreateVTable(&p->matchFinderMt, &p->matchFinder);
++  }
++  else
++  #endif
++  {
++    if (!MatchFinder_Create(&p->matchFinderBase, p->dictSize, beforeSize, p->numFastBytes, LZMA_MATCH_LEN_MAX, allocBig))
++      return SZ_ERROR_MEM;
++    p->matchFinderObj = &p->matchFinderBase;
++    MatchFinder_CreateVTable(&p->matchFinderBase, &p->matchFinder);
++  }
++  return SZ_OK;
++}
++
++void LzmaEnc_Init(CLzmaEnc *p)
++{
++  UInt32 i;
++  p->state = 0;
++  for (i = 0 ; i < LZMA_NUM_REPS; i++)
++    p->reps[i] = 0;
++
++  RangeEnc_Init(&p->rc);
++
++
++  for (i = 0; i < kNumStates; i++)
++  {
++    UInt32 j;
++    for (j = 0; j < LZMA_NUM_PB_STATES_MAX; j++)
++    {
++      p->isMatch[i][j] = kProbInitValue;
++      p->isRep0Long[i][j] = kProbInitValue;
++    }
++    p->isRep[i] = kProbInitValue;
++    p->isRepG0[i] = kProbInitValue;
++    p->isRepG1[i] = kProbInitValue;
++    p->isRepG2[i] = kProbInitValue;
++  }
++
++  {
++    UInt32 num = 0x300 << (p->lp + p->lc);
++    for (i = 0; i < num; i++)
++      p->litProbs[i] = kProbInitValue;
++  }
++
++  {
++    for (i = 0; i < kNumLenToPosStates; i++)
++    {
++      CLzmaProb *probs = p->posSlotEncoder[i];
++      UInt32 j;
++      for (j = 0; j < (1 << kNumPosSlotBits); j++)
++        probs[j] = kProbInitValue;
++    }
++  }
++  {
++    for (i = 0; i < kNumFullDistances - kEndPosModelIndex; i++)
++      p->posEncoders[i] = kProbInitValue;
++  }
++
++  LenEnc_Init(&p->lenEnc.p);
++  LenEnc_Init(&p->repLenEnc.p);
++
++  for (i = 0; i < (1 << kNumAlignBits); i++)
++    p->posAlignEncoder[i] = kProbInitValue;
++
++  p->optimumEndIndex = 0;
++  p->optimumCurrentIndex = 0;
++  p->additionalOffset = 0;
++
++  p->pbMask = (1 << p->pb) - 1;
++  p->lpMask = (1 << p->lp) - 1;
++}
++
++void LzmaEnc_InitPrices(CLzmaEnc *p)
++{
++  if (!p->fastMode)
++  {
++    FillDistancesPrices(p);
++    FillAlignPrices(p);
++  }
++
++  p->lenEnc.tableSize =
++  p->repLenEnc.tableSize =
++      p->numFastBytes + 1 - LZMA_MATCH_LEN_MIN;
++  LenPriceEnc_UpdateTables(&p->lenEnc, 1 << p->pb, p->ProbPrices);
++  LenPriceEnc_UpdateTables(&p->repLenEnc, 1 << p->pb, p->ProbPrices);
++}
++
++static SRes LzmaEnc_AllocAndInit(CLzmaEnc *p, UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  UInt32 i;
++  for (i = 0; i < (UInt32)kDicLogSizeMaxCompress; i++)
++    if (p->dictSize <= ((UInt32)1 << i))
++      break;
++  p->distTableSize = i * 2;
++
++  p->finished = False;
++  p->result = SZ_OK;
++  RINOK(LzmaEnc_Alloc(p, keepWindowSize, alloc, allocBig));
++  LzmaEnc_Init(p);
++  LzmaEnc_InitPrices(p);
++  p->nowPos64 = 0;
++  return SZ_OK;
++}
++
++static SRes LzmaEnc_Prepare(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  p->matchFinderBase.stream = inStream;
++  p->needInit = 1;
++  p->rc.outStream = outStream;
++  return LzmaEnc_AllocAndInit(p, 0, alloc, allocBig);
++}
++
++SRes LzmaEnc_PrepareForLzma2(CLzmaEncHandle pp,
++    ISeqInStream *inStream, UInt32 keepWindowSize,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  p->matchFinderBase.stream = inStream;
++  p->needInit = 1;
++  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
++}
++
++static void LzmaEnc_SetInputBuf(CLzmaEnc *p, const Byte *src, SizeT srcLen)
++{
++  p->matchFinderBase.directInput = 1;
++  p->matchFinderBase.bufferBase = (Byte *)src;
++  p->matchFinderBase.directInputRem = srcLen;
++}
++
++SRes LzmaEnc_MemPrepare(CLzmaEncHandle pp, const Byte *src, SizeT srcLen,
++    UInt32 keepWindowSize, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  LzmaEnc_SetInputBuf(p, src, srcLen);
++  p->needInit = 1;
++
++  return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
++}
++
++void LzmaEnc_Finish(CLzmaEncHandle pp)
++{
++  #ifndef _7ZIP_ST
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  if (p->mtMode)
++    MatchFinderMt_ReleaseStream(&p->matchFinderMt);
++  #else
++  pp = pp;
++  #endif
++}
++
++typedef struct
++{
++  ISeqOutStream funcTable;
++  Byte *data;
++  SizeT rem;
++  Bool overflow;
++} CSeqOutStreamBuf;
++
++static size_t MyWrite(void *pp, const void *data, size_t size)
++{
++  CSeqOutStreamBuf *p = (CSeqOutStreamBuf *)pp;
++  if (p->rem < size)
++  {
++    size = p->rem;
++    p->overflow = True;
++  }
++  memcpy(p->data, data, size);
++  p->rem -= size;
++  p->data += size;
++  return size;
++}
++
++
++UInt32 LzmaEnc_GetNumAvailableBytes(CLzmaEncHandle pp)
++{
++  const CLzmaEnc *p = (CLzmaEnc *)pp;
++  return p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
++}
++
++const Byte *LzmaEnc_GetCurBuf(CLzmaEncHandle pp)
++{
++  const CLzmaEnc *p = (CLzmaEnc *)pp;
++  return p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
++}
++
++SRes LzmaEnc_CodeOneMemBlock(CLzmaEncHandle pp, Bool reInit,
++    Byte *dest, size_t *destLen, UInt32 desiredPackSize, UInt32 *unpackSize)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  UInt64 nowPos64;
++  SRes res;
++  CSeqOutStreamBuf outStream;
++
++  outStream.funcTable.Write = MyWrite;
++  outStream.data = dest;
++  outStream.rem = *destLen;
++  outStream.overflow = False;
++
++  p->writeEndMark = False;
++  p->finished = False;
++  p->result = SZ_OK;
++
++  if (reInit)
++    LzmaEnc_Init(p);
++  LzmaEnc_InitPrices(p);
++  nowPos64 = p->nowPos64;
++  RangeEnc_Init(&p->rc);
++  p->rc.outStream = &outStream.funcTable;
++
++  res = LzmaEnc_CodeOneBlock(p, True, desiredPackSize, *unpackSize);
++  
++  *unpackSize = (UInt32)(p->nowPos64 - nowPos64);
++  *destLen -= outStream.rem;
++  if (outStream.overflow)
++    return SZ_ERROR_OUTPUT_EOF;
++
++  return res;
++}
++
++static SRes LzmaEnc_Encode2(CLzmaEnc *p, ICompressProgress *progress)
++{
++  SRes res = SZ_OK;
++
++  #ifndef _7ZIP_ST
++  Byte allocaDummy[0x300];
++  int i = 0;
++  for (i = 0; i < 16; i++)
++    allocaDummy[i] = (Byte)i;
++  #endif
++
++  for (;;)
++  {
++    res = LzmaEnc_CodeOneBlock(p, False, 0, 0);
++    if (res != SZ_OK || p->finished != 0)
++      break;
++    if (progress != 0)
++    {
++      res = progress->Progress(progress, p->nowPos64, RangeEnc_GetProcessed(&p->rc));
++      if (res != SZ_OK)
++      {
++        res = SZ_ERROR_PROGRESS;
++        break;
++      }
++    }
++  }
++  LzmaEnc_Finish(p);
++  return res;
++}
++
++SRes LzmaEnc_Encode(CLzmaEncHandle pp, ISeqOutStream *outStream, ISeqInStream *inStream, ICompressProgress *progress,
++    ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  RINOK(LzmaEnc_Prepare(pp, outStream, inStream, alloc, allocBig));
++  return LzmaEnc_Encode2((CLzmaEnc *)pp, progress);
++}
++
++SRes LzmaEnc_WriteProperties(CLzmaEncHandle pp, Byte *props, SizeT *size)
++{
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++  int i;
++  UInt32 dictSize = p->dictSize;
++  if (*size < LZMA_PROPS_SIZE)
++    return SZ_ERROR_PARAM;
++  *size = LZMA_PROPS_SIZE;
++  props[0] = (Byte)((p->pb * 5 + p->lp) * 9 + p->lc);
++
++  for (i = 11; i <= 30; i++)
++  {
++    if (dictSize <= ((UInt32)2 << i))
++    {
++      dictSize = (2 << i);
++      break;
++    }
++    if (dictSize <= ((UInt32)3 << i))
++    {
++      dictSize = (3 << i);
++      break;
++    }
++  }
++
++  for (i = 0; i < 4; i++)
++    props[1 + i] = (Byte)(dictSize >> (8 * i));
++  return SZ_OK;
++}
++
++SRes LzmaEnc_MemEncode(CLzmaEncHandle pp, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  SRes res;
++  CLzmaEnc *p = (CLzmaEnc *)pp;
++
++  CSeqOutStreamBuf outStream;
++
++  LzmaEnc_SetInputBuf(p, src, srcLen);
++
++  outStream.funcTable.Write = MyWrite;
++  outStream.data = dest;
++  outStream.rem = *destLen;
++  outStream.overflow = False;
++
++  p->writeEndMark = writeEndMark;
++
++  p->rc.outStream = &outStream.funcTable;
++  res = LzmaEnc_MemPrepare(pp, src, srcLen, 0, alloc, allocBig);
++  if (res == SZ_OK)
++    res = LzmaEnc_Encode2(p, progress);
++
++  *destLen -= outStream.rem;
++  if (outStream.overflow)
++    return SZ_ERROR_OUTPUT_EOF;
++  return res;
++}
++
++SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
++    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
++{
++  CLzmaEnc *p = (CLzmaEnc *)LzmaEnc_Create(alloc);
++  SRes res;
++  if (p == 0)
++    return SZ_ERROR_MEM;
++
++  res = LzmaEnc_SetProps(p, props);
++  if (res == SZ_OK)
++  {
++    res = LzmaEnc_WriteProperties(p, propsEncoded, propsSize);
++    if (res == SZ_OK)
++      res = LzmaEnc_MemEncode(p, dest, destLen, src, srcLen,
++          writeEndMark, progress, alloc, allocBig);
++  }
++
++  LzmaEnc_Destroy(p, alloc, allocBig);
++  return res;
++}
+--- /dev/null
++++ b/lib/lzma/Makefile
+@@ -0,0 +1,7 @@
++lzma_compress-objs := LzFind.o LzmaEnc.o
++lzma_decompress-objs := LzmaDec.o
++
++obj-$(CONFIG_LZMA_COMPRESS) += lzma_compress.o
++obj-$(CONFIG_LZMA_DECOMPRESS) += lzma_decompress.o
++
++EXTRA_CFLAGS += -Iinclude/linux -Iinclude/linux/lzma -include types.h
diff --git a/target/linux/generic/patches-3.3/531-debloat_lzma.patch b/target/linux/generic/patches-3.3/531-debloat_lzma.patch
new file mode 100644
index 0000000..1e41661
--- /dev/null
+++ b/target/linux/generic/patches-3.3/531-debloat_lzma.patch
@@ -0,0 +1,485 @@
+--- a/include/linux/lzma/LzmaDec.h
++++ b/include/linux/lzma/LzmaDec.h
+@@ -31,14 +31,6 @@ typedef struct _CLzmaProps
+   UInt32 dicSize;
+ } CLzmaProps;
+ 
+-/* LzmaProps_Decode - decodes properties
+-Returns:
+-  SZ_OK
+-  SZ_ERROR_UNSUPPORTED - Unsupported properties
+-*/
+-
+-SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size);
+-
+ 
+ /* ---------- LZMA Decoder state ---------- */
+ 
+@@ -70,8 +62,6 @@ typedef struct
+ 
+ #define LzmaDec_Construct(p) { (p)->dic = 0; (p)->probs = 0; }
+ 
+-void LzmaDec_Init(CLzmaDec *p);
+-
+ /* There are two types of LZMA streams:
+      0) Stream with end mark. That end mark adds about 6 bytes to compressed size.
+      1) Stream without end mark. You must know exact uncompressed size to decompress such stream. */
+@@ -108,97 +98,6 @@ typedef enum
+ 
+ /* ELzmaStatus is used only as output value for function call */
+ 
+-
+-/* ---------- Interfaces ---------- */
+-
+-/* There are 3 levels of interfaces:
+-     1) Dictionary Interface
+-     2) Buffer Interface
+-     3) One Call Interface
+-   You can select any of these interfaces, but don't mix functions from different
+-   groups for same object. */
+-
+-
+-/* There are two variants to allocate state for Dictionary Interface:
+-     1) LzmaDec_Allocate / LzmaDec_Free
+-     2) LzmaDec_AllocateProbs / LzmaDec_FreeProbs
+-   You can use variant 2, if you set dictionary buffer manually.
+-   For Buffer Interface you must always use variant 1.
+-
+-LzmaDec_Allocate* can return:
+-  SZ_OK
+-  SZ_ERROR_MEM         - Memory allocation error
+-  SZ_ERROR_UNSUPPORTED - Unsupported properties
+-*/
+-   
+-SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc);
+-void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc);
+-
+-SRes LzmaDec_Allocate(CLzmaDec *state, const Byte *prop, unsigned propsSize, ISzAlloc *alloc);
+-void LzmaDec_Free(CLzmaDec *state, ISzAlloc *alloc);
+-
+-/* ---------- Dictionary Interface ---------- */
+-
+-/* You can use it, if you want to eliminate the overhead for data copying from
+-   dictionary to some other external buffer.
+-   You must work with CLzmaDec variables directly in this interface.
+-
+-   STEPS:
+-     LzmaDec_Constr()
+-     LzmaDec_Allocate()
+-     for (each new stream)
+-     {
+-       LzmaDec_Init()
+-       while (it needs more decompression)
+-       {
+-         LzmaDec_DecodeToDic()
+-         use data from CLzmaDec::dic and update CLzmaDec::dicPos
+-       }
+-     }
+-     LzmaDec_Free()
+-*/
+-
+-/* LzmaDec_DecodeToDic
+-   
+-   The decoding to internal dictionary buffer (CLzmaDec::dic).
+-   You must manually update CLzmaDec::dicPos, if it reaches CLzmaDec::dicBufSize !!!
+-
+-finishMode:
+-  It has meaning only if the decoding reaches output limit (dicLimit).
+-  LZMA_FINISH_ANY - Decode just dicLimit bytes.
+-  LZMA_FINISH_END - Stream must be finished after dicLimit.
+-
+-Returns:
+-  SZ_OK
+-    status:
+-      LZMA_STATUS_FINISHED_WITH_MARK
+-      LZMA_STATUS_NOT_FINISHED
+-      LZMA_STATUS_NEEDS_MORE_INPUT
+-      LZMA_STATUS_MAYBE_FINISHED_WITHOUT_MARK
+-  SZ_ERROR_DATA - Data error
+-*/
+-
+-SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit,
+-    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
+-
+-
+-/* ---------- Buffer Interface ---------- */
+-
+-/* It's zlib-like interface.
+-   See LzmaDec_DecodeToDic description for information about STEPS and return results,
+-   but you must use LzmaDec_DecodeToBuf instead of LzmaDec_DecodeToDic and you don't need
+-   to work with CLzmaDec variables manually.
+-
+-finishMode:
+-  It has meaning only if the decoding reaches output limit (*destLen).
+-  LZMA_FINISH_ANY - Decode just destLen bytes.
+-  LZMA_FINISH_END - Stream must be finished after (*destLen).
+-*/
+-
+-SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen,
+-    const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status);
+-
+-
+ /* ---------- One Call Interface ---------- */
+ 
+ /* LzmaDecode
+--- a/lib/lzma/LzmaDec.c
++++ b/lib/lzma/LzmaDec.c
+@@ -682,7 +682,7 @@ static void LzmaDec_InitRc(CLzmaDec *p,
+   p->needFlush = 0;
+ }
+ 
+-void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
++static void LzmaDec_InitDicAndState(CLzmaDec *p, Bool initDic, Bool initState)
+ {
+   p->needFlush = 1;
+   p->remainLen = 0;
+@@ -698,7 +698,7 @@ void LzmaDec_InitDicAndState(CLzmaDec *p
+     p->needInitState = 1;
+ }
+ 
+-void LzmaDec_Init(CLzmaDec *p)
++static void LzmaDec_Init(CLzmaDec *p)
+ {
+   p->dicPos = 0;
+   LzmaDec_InitDicAndState(p, True, True);
+@@ -716,7 +716,7 @@ static void LzmaDec_InitStateReal(CLzmaD
+   p->needInitState = 0;
+ }
+ 
+-SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
++static SRes LzmaDec_DecodeToDic(CLzmaDec *p, SizeT dicLimit, const Byte *src, SizeT *srcLen,
+     ELzmaFinishMode finishMode, ELzmaStatus *status)
+ {
+   SizeT inSize = *srcLen;
+@@ -837,7 +837,7 @@ SRes LzmaDec_DecodeToDic(CLzmaDec *p, Si
+   return (p->code == 0) ? SZ_OK : SZ_ERROR_DATA;
+ }
+ 
+-SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
++static __maybe_unused SRes LzmaDec_DecodeToBuf(CLzmaDec *p, Byte *dest, SizeT *destLen, const Byte *src, SizeT *srcLen, ELzmaFinishMode finishMode, ELzmaStatus *status)
+ {
+   SizeT outSize = *destLen;
+   SizeT inSize = *srcLen;
+@@ -877,7 +877,7 @@ SRes LzmaDec_DecodeToBuf(CLzmaDec *p, By
+   }
+ }
+ 
+-void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
++static void LzmaDec_FreeProbs(CLzmaDec *p, ISzAlloc *alloc)
+ {
+   alloc->Free(alloc, p->probs);
+   p->probs = 0;
+@@ -889,13 +889,13 @@ static void LzmaDec_FreeDict(CLzmaDec *p
+   p->dic = 0;
+ }
+ 
+-void LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
++static void __maybe_unused LzmaDec_Free(CLzmaDec *p, ISzAlloc *alloc)
+ {
+   LzmaDec_FreeProbs(p, alloc);
+   LzmaDec_FreeDict(p, alloc);
+ }
+ 
+-SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
++static SRes LzmaProps_Decode(CLzmaProps *p, const Byte *data, unsigned size)
+ {
+   UInt32 dicSize;
+   Byte d;
+@@ -935,7 +935,7 @@ static SRes LzmaDec_AllocateProbs2(CLzma
+   return SZ_OK;
+ }
+ 
+-SRes LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++static SRes __maybe_unused LzmaDec_AllocateProbs(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
+ {
+   CLzmaProps propNew;
+   RINOK(LzmaProps_Decode(&propNew, props, propsSize));
+@@ -944,7 +944,7 @@ SRes LzmaDec_AllocateProbs(CLzmaDec *p,
+   return SZ_OK;
+ }
+ 
+-SRes LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
++static SRes __maybe_unused LzmaDec_Allocate(CLzmaDec *p, const Byte *props, unsigned propsSize, ISzAlloc *alloc)
+ {
+   CLzmaProps propNew;
+   SizeT dicBufSize;
+--- a/include/linux/lzma/LzmaEnc.h
++++ b/include/linux/lzma/LzmaEnc.h
+@@ -31,9 +31,6 @@ typedef struct _CLzmaEncProps
+ } CLzmaEncProps;
+ 
+ void LzmaEncProps_Init(CLzmaEncProps *p);
+-void LzmaEncProps_Normalize(CLzmaEncProps *p);
+-UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2);
+-
+ 
+ /* ---------- CLzmaEncHandle Interface ---------- */
+ 
+@@ -53,26 +50,9 @@ CLzmaEncHandle LzmaEnc_Create(ISzAlloc *
+ void LzmaEnc_Destroy(CLzmaEncHandle p, ISzAlloc *alloc, ISzAlloc *allocBig);
+ SRes LzmaEnc_SetProps(CLzmaEncHandle p, const CLzmaEncProps *props);
+ SRes LzmaEnc_WriteProperties(CLzmaEncHandle p, Byte *properties, SizeT *size);
+-SRes LzmaEnc_Encode(CLzmaEncHandle p, ISeqOutStream *outStream, ISeqInStream *inStream,
+-    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
+ SRes LzmaEnc_MemEncode(CLzmaEncHandle p, Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
+     int writeEndMark, ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
+ 
+-/* ---------- One Call Interface ---------- */
+-
+-/* LzmaEncode
+-Return code:
+-  SZ_OK               - OK
+-  SZ_ERROR_MEM        - Memory allocation error
+-  SZ_ERROR_PARAM      - Incorrect paramater
+-  SZ_ERROR_OUTPUT_EOF - output buffer overflow
+-  SZ_ERROR_THREAD     - errors in multithreading functions (only for Mt version)
+-*/
+-
+-SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
+-    const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
+-    ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig);
+-
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/lib/lzma/LzmaEnc.c
++++ b/lib/lzma/LzmaEnc.c
+@@ -53,7 +53,7 @@ void LzmaEncProps_Init(CLzmaEncProps *p)
+   p->writeEndMark = 0;
+ }
+ 
+-void LzmaEncProps_Normalize(CLzmaEncProps *p)
++static void LzmaEncProps_Normalize(CLzmaEncProps *p)
+ {
+   int level = p->level;
+   if (level < 0) level = 5;
+@@ -76,7 +76,7 @@ void LzmaEncProps_Normalize(CLzmaEncProp
+       #endif
+ }
+ 
+-UInt32 LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
++static UInt32 __maybe_unused LzmaEncProps_GetDictSize(const CLzmaEncProps *props2)
+ {
+   CLzmaEncProps props = *props2;
+   LzmaEncProps_Normalize(&props);
+@@ -93,7 +93,7 @@ UInt32 LzmaEncProps_GetDictSize(const CL
+ 
+ #define BSR2_RET(pos, res) { unsigned long i; _BitScanReverse(&i, (pos)); res = (i + i) + ((pos >> (i - 1)) & 1); }
+ 
+-UInt32 GetPosSlot1(UInt32 pos)
++static UInt32 GetPosSlot1(UInt32 pos)
+ {
+   UInt32 res;
+   BSR2_RET(pos, res);
+@@ -107,7 +107,7 @@ UInt32 GetPosSlot1(UInt32 pos)
+ #define kNumLogBits (9 + (int)sizeof(size_t) / 2)
+ #define kDicLogSizeMaxCompress ((kNumLogBits - 1) * 2 + 7)
+ 
+-void LzmaEnc_FastPosInit(Byte *g_FastPos)
++static void LzmaEnc_FastPosInit(Byte *g_FastPos)
+ {
+   int c = 2, slotFast;
+   g_FastPos[0] = 0;
+@@ -339,7 +339,7 @@ typedef struct
+   CSaveState saveState;
+ } CLzmaEnc;
+ 
+-void LzmaEnc_SaveState(CLzmaEncHandle pp)
++static void __maybe_unused LzmaEnc_SaveState(CLzmaEncHandle pp)
+ {
+   CLzmaEnc *p = (CLzmaEnc *)pp;
+   CSaveState *dest = &p->saveState;
+@@ -365,7 +365,7 @@ void LzmaEnc_SaveState(CLzmaEncHandle pp
+   memcpy(dest->litProbs, p->litProbs, (0x300 << p->lclp) * sizeof(CLzmaProb));
+ }
+ 
+-void LzmaEnc_RestoreState(CLzmaEncHandle pp)
++static void __maybe_unused LzmaEnc_RestoreState(CLzmaEncHandle pp)
+ {
+   CLzmaEnc *dest = (CLzmaEnc *)pp;
+   const CSaveState *p = &dest->saveState;
+@@ -600,7 +600,7 @@ static void LitEnc_EncodeMatched(CRangeE
+   while (symbol < 0x10000);
+ }
+ 
+-void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
++static void LzmaEnc_InitPriceTables(UInt32 *ProbPrices)
+ {
+   UInt32 i;
+   for (i = (1 << kNumMoveReducingBits) / 2; i < kBitModelTotal; i += (1 << kNumMoveReducingBits))
+@@ -1676,7 +1676,7 @@ static void FillDistancesPrices(CLzmaEnc
+   p->matchPriceCount = 0;
+ }
+ 
+-void LzmaEnc_Construct(CLzmaEnc *p)
++static void LzmaEnc_Construct(CLzmaEnc *p)
+ {
+   RangeEnc_Construct(&p->rc);
+   MatchFinder_Construct(&p->matchFinderBase);
+@@ -1709,7 +1709,7 @@ CLzmaEncHandle LzmaEnc_Create(ISzAlloc *
+   return p;
+ }
+ 
+-void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
++static void LzmaEnc_FreeLits(CLzmaEnc *p, ISzAlloc *alloc)
+ {
+   alloc->Free(alloc, p->litProbs);
+   alloc->Free(alloc, p->saveState.litProbs);
+@@ -2074,7 +2074,7 @@ SRes LzmaEnc_MemPrepare(CLzmaEncHandle p
+   return LzmaEnc_AllocAndInit(p, keepWindowSize, alloc, allocBig);
+ }
+ 
+-void LzmaEnc_Finish(CLzmaEncHandle pp)
++static void LzmaEnc_Finish(CLzmaEncHandle pp)
+ {
+   #ifndef _7ZIP_ST
+   CLzmaEnc *p = (CLzmaEnc *)pp;
+@@ -2108,7 +2108,7 @@ static size_t MyWrite(void *pp, const vo
+ }
+ 
+ 
+-UInt32 LzmaEnc_GetNumAvailableBytes(CLzmaEncHandle pp)
++static UInt32 __maybe_unused LzmaEnc_GetNumAvailableBytes(CLzmaEncHandle pp)
+ {
+   const CLzmaEnc *p = (CLzmaEnc *)pp;
+   return p->matchFinder.GetNumAvailableBytes(p->matchFinderObj);
+@@ -2120,7 +2120,7 @@ const Byte *LzmaEnc_GetCurBuf(CLzmaEncHa
+   return p->matchFinder.GetPointerToCurrentPos(p->matchFinderObj) - p->additionalOffset;
+ }
+ 
+-SRes LzmaEnc_CodeOneMemBlock(CLzmaEncHandle pp, Bool reInit,
++static SRes __maybe_unused LzmaEnc_CodeOneMemBlock(CLzmaEncHandle pp, Bool reInit,
+     Byte *dest, size_t *destLen, UInt32 desiredPackSize, UInt32 *unpackSize)
+ {
+   CLzmaEnc *p = (CLzmaEnc *)pp;
+@@ -2248,7 +2248,7 @@ SRes LzmaEnc_MemEncode(CLzmaEncHandle pp
+   return res;
+ }
+ 
+-SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
++static __maybe_unused SRes LzmaEncode(Byte *dest, SizeT *destLen, const Byte *src, SizeT srcLen,
+     const CLzmaEncProps *props, Byte *propsEncoded, SizeT *propsSize, int writeEndMark,
+     ICompressProgress *progress, ISzAlloc *alloc, ISzAlloc *allocBig)
+ {
+--- a/include/linux/lzma/LzFind.h
++++ b/include/linux/lzma/LzFind.h
+@@ -55,11 +55,6 @@ typedef struct _CMatchFinder
+ 
+ #define Inline_MatchFinder_GetNumAvailableBytes(p) ((p)->streamPos - (p)->pos)
+ 
+-int MatchFinder_NeedMove(CMatchFinder *p);
+-Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p);
+-void MatchFinder_MoveBlock(CMatchFinder *p);
+-void MatchFinder_ReadIfRequired(CMatchFinder *p);
+-
+ void MatchFinder_Construct(CMatchFinder *p);
+ 
+ /* Conditions:
+@@ -70,12 +65,6 @@ int MatchFinder_Create(CMatchFinder *p,
+     UInt32 keepAddBufferBefore, UInt32 matchMaxLen, UInt32 keepAddBufferAfter,
+     ISzAlloc *alloc);
+ void MatchFinder_Free(CMatchFinder *p, ISzAlloc *alloc);
+-void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems);
+-void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue);
+-
+-UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *buffer, CLzRef *son,
+-    UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 _cutValue,
+-    UInt32 *distances, UInt32 maxLen);
+ 
+ /*
+ Conditions:
+@@ -102,12 +91,6 @@ typedef struct _IMatchFinder
+ 
+ void MatchFinder_CreateVTable(CMatchFinder *p, IMatchFinder *vTable);
+ 
+-void MatchFinder_Init(CMatchFinder *p);
+-UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
+-UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances);
+-void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
+-void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num);
+-
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/lib/lzma/LzFind.c
++++ b/lib/lzma/LzFind.c
+@@ -42,12 +42,12 @@ static int LzInWindow_Create(CMatchFinde
+   return (p->bufferBase != 0);
+ }
+ 
+-Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
+-Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
++static Byte *MatchFinder_GetPointerToCurrentPos(CMatchFinder *p) { return p->buffer; }
++static Byte MatchFinder_GetIndexByte(CMatchFinder *p, Int32 index) { return p->buffer[index]; }
+ 
+-UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
++static UInt32 MatchFinder_GetNumAvailableBytes(CMatchFinder *p) { return p->streamPos - p->pos; }
+ 
+-void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
++static void MatchFinder_ReduceOffsets(CMatchFinder *p, UInt32 subValue)
+ {
+   p->posLimit -= subValue;
+   p->pos -= subValue;
+@@ -268,7 +268,7 @@ static void MatchFinder_SetLimits(CMatch
+   p->posLimit = p->pos + limit;
+ }
+ 
+-void MatchFinder_Init(CMatchFinder *p)
++static void MatchFinder_Init(CMatchFinder *p)
+ {
+   UInt32 i;
+   for (i = 0; i < p->hashSizeSum; i++)
+@@ -287,7 +287,7 @@ static UInt32 MatchFinder_GetSubValue(CM
+   return (p->pos - p->historySize - 1) & kNormalizeMask;
+ }
+ 
+-void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
++static void MatchFinder_Normalize3(UInt32 subValue, CLzRef *items, UInt32 numItems)
+ {
+   UInt32 i;
+   for (i = 0; i < numItems; i++)
+@@ -350,7 +350,7 @@ static UInt32 * Hc_GetMatchesSpec(UInt32
+   }
+ }
+ 
+-UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
++static UInt32 * GetMatchesSpec1(UInt32 lenLimit, UInt32 curMatch, UInt32 pos, const Byte *cur, CLzRef *son,
+     UInt32 _cyclicBufferPos, UInt32 _cyclicBufferSize, UInt32 cutValue,
+     UInt32 *distances, UInt32 maxLen)
+ {
+@@ -492,7 +492,7 @@ static UInt32 Bt2_MatchFinder_GetMatches
+   GET_MATCHES_FOOTER(offset, 1)
+ }
+ 
+-UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++static __maybe_unused UInt32 Bt3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
+ {
+   UInt32 offset;
+   GET_MATCHES_HEADER(3)
+@@ -632,7 +632,7 @@ static UInt32 Hc4_MatchFinder_GetMatches
+   MOVE_POS_RET
+ }
+ 
+-UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
++static __maybe_unused UInt32 Hc3Zip_MatchFinder_GetMatches(CMatchFinder *p, UInt32 *distances)
+ {
+   UInt32 offset;
+   GET_MATCHES_HEADER(3)
+@@ -657,7 +657,7 @@ static void Bt2_MatchFinder_Skip(CMatchF
+   while (--num != 0);
+ }
+ 
+-void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++static __maybe_unused void Bt3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
+ {
+   do
+   {
+@@ -718,7 +718,7 @@ static void Hc4_MatchFinder_Skip(CMatchF
+   while (--num != 0);
+ }
+ 
+-void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
++static __maybe_unused void Hc3Zip_MatchFinder_Skip(CMatchFinder *p, UInt32 num)
+ {
+   do
+   {
diff --git a/target/linux/generic/patches-3.3/532-jffs2_eofdetect.patch b/target/linux/generic/patches-3.3/532-jffs2_eofdetect.patch
new file mode 100644
index 0000000..1fac6d1
--- /dev/null
+++ b/target/linux/generic/patches-3.3/532-jffs2_eofdetect.patch
@@ -0,0 +1,132 @@
+--- a/fs/jffs2/build.c
++++ b/fs/jffs2/build.c
+@@ -112,6 +112,17 @@ static int jffs2_build_filesystem(struct
+ 	dbg_fsbuild("scanned flash completely\n");
+ 	jffs2_dbg_dump_block_lists_nolock(c);
+ 
++	if (c->flags & (1 << 7)) {
++		printk("%s(): unlocking the mtd device... ", __func__);
++		if (c->mtd->unlock)
++			c->mtd->unlock(c->mtd, 0, c->mtd->size);
++		printk("done.\n");
++
++		printk("%s(): erasing all blocks after the end marker... ", __func__);
++		jffs2_erase_pending_blocks(c, -1);
++		printk("done.\n");
++	}
++
+ 	dbg_fsbuild("pass 1 starting\n");
+ 	c->flags |= JFFS2_SB_FLAG_BUILDING;
+ 	/* Now scan the directory tree, increasing nlink according to every dirent found. */
+--- a/fs/jffs2/scan.c
++++ b/fs/jffs2/scan.c
+@@ -72,7 +72,7 @@ static int file_dirty(struct jffs2_sb_in
+ 		return ret;
+ 	if ((ret = jffs2_scan_dirty_space(c, jeb, jeb->free_size)))
+ 		return ret;
+-	/* Turned wasted size into dirty, since we apparently 
++	/* Turned wasted size into dirty, since we apparently
+ 	   think it's recoverable now. */
+ 	jeb->dirty_size += jeb->wasted_size;
+ 	c->dirty_size += jeb->wasted_size;
+@@ -147,8 +147,11 @@ int jffs2_scan_medium(struct jffs2_sb_in
+ 		/* reset summary info for next eraseblock scan */
+ 		jffs2_sum_reset_collected(s);
+ 
+-		ret = jffs2_scan_eraseblock(c, jeb, buf_size?flashbuf:(flashbuf+jeb->offset),
+-						buf_size, s);
++		if (c->flags & (1 << 7))
++			ret = BLK_STATE_ALLFF;
++		else
++			ret = jffs2_scan_eraseblock(c, jeb, buf_size?flashbuf:(flashbuf+jeb->offset),
++							buf_size, s);
+ 
+ 		if (ret < 0)
+ 			goto out;
+@@ -403,7 +406,7 @@ static int jffs2_scan_xref_node(struct j
+ 	if (!ref)
+ 		return -ENOMEM;
+ 
+-	/* BEFORE jffs2_build_xattr_subsystem() called, 
++	/* BEFORE jffs2_build_xattr_subsystem() called,
+ 	 * and AFTER xattr_ref is marked as a dead xref,
+ 	 * ref->xid is used to store 32bit xid, xd is not used
+ 	 * ref->ino is used to store 32bit inode-number, ic is not used
+@@ -476,7 +479,7 @@ static int jffs2_scan_eraseblock (struct
+ 		struct jffs2_sum_marker *sm;
+ 		void *sumptr = NULL;
+ 		uint32_t sumlen;
+-	      
++
+ 		if (!buf_size) {
+ 			/* XIP case. Just look, point at the summary if it's there */
+ 			sm = (void *)buf + c->sector_size - sizeof(*sm);
+@@ -492,9 +495,9 @@ static int jffs2_scan_eraseblock (struct
+ 				buf_len = sizeof(*sm);
+ 
+ 			/* Read as much as we want into the _end_ of the preallocated buffer */
+-			err = jffs2_fill_scan_buf(c, buf + buf_size - buf_len, 
++			err = jffs2_fill_scan_buf(c, buf + buf_size - buf_len,
+ 						  jeb->offset + c->sector_size - buf_len,
+-						  buf_len);				
++						  buf_len);
+ 			if (err)
+ 				return err;
+ 
+@@ -513,9 +516,9 @@ static int jffs2_scan_eraseblock (struct
+ 				}
+ 				if (buf_len < sumlen) {
+ 					/* Need to read more so that the entire summary node is present */
+-					err = jffs2_fill_scan_buf(c, sumptr, 
++					err = jffs2_fill_scan_buf(c, sumptr,
+ 								  jeb->offset + c->sector_size - sumlen,
+-								  sumlen - buf_len);				
++								  sumlen - buf_len);
+ 					if (err)
+ 						return err;
+ 				}
+@@ -528,7 +531,7 @@ static int jffs2_scan_eraseblock (struct
+ 
+ 			if (buf_size && sumlen > buf_size)
+ 				kfree(sumptr);
+-			/* If it returns with a real error, bail. 
++			/* If it returns with a real error, bail.
+ 			   If it returns positive, that's a block classification
+ 			   (i.e. BLK_STATE_xxx) so return that too.
+ 			   If it returns zero, fall through to full scan. */
+@@ -549,6 +552,17 @@ static int jffs2_scan_eraseblock (struct
+ 			return err;
+ 	}
+ 
++	if ((buf[0] == 0xde) &&
++		(buf[1] == 0xad) &&
++		(buf[2] == 0xc0) &&
++		(buf[3] == 0xde)) {
++		/* end of filesystem. erase everything after this point */
++		printk("%s(): End of filesystem marker found at 0x%x\n", __func__, jeb->offset);
++		c->flags |= (1 << 7);
++
++		return BLK_STATE_ALLFF;
++	}
++
+ 	/* We temporarily use 'ofs' as a pointer into the buffer/jeb */
+ 	ofs = 0;
+ 	max_ofs = EMPTY_SCAN_SIZE(c->sector_size);
+@@ -674,7 +688,7 @@ scan_more:
+ 				scan_end = buf_len;
+ 				goto more_empty;
+ 			}
+-			
++
+ 			/* See how much more there is to read in this eraseblock... */
+ 			buf_len = min_t(uint32_t, buf_size, jeb->offset + c->sector_size - ofs);
+ 			if (!buf_len) {
+@@ -910,7 +924,7 @@ scan_more:
+ 
+ 	D1(printk(KERN_DEBUG "Block at 0x%08x: free 0x%08x, dirty 0x%08x, unchecked 0x%08x, used 0x%08x, wasted 0x%08x\n",
+ 		  jeb->offset,jeb->free_size, jeb->dirty_size, jeb->unchecked_size, jeb->used_size, jeb->wasted_size));
+-	
++
+ 	/* mark_node_obsolete can add to wasted !! */
+ 	if (jeb->wasted_size) {
+ 		jeb->dirty_size += jeb->wasted_size;
diff --git a/target/linux/generic/patches-3.3/540-crypto-xz-decompression-support.patch b/target/linux/generic/patches-3.3/540-crypto-xz-decompression-support.patch
new file mode 100644
index 0000000..3b37007
--- /dev/null
+++ b/target/linux/generic/patches-3.3/540-crypto-xz-decompression-support.patch
@@ -0,0 +1,146 @@
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -924,6 +924,13 @@ config CRYPTO_LZO
+ 	help
+ 	  This is the LZO algorithm.
+ 
++config CRYPTO_XZ
++	tristate "XZ compression algorithm"
++	select CRYPTO_ALGAPI
++	select XZ_DEC
++	help
++	  This is the XZ algorithm. Only decompression is supported for now.
++
+ comment "Random Number Generation"
+ 
+ config CRYPTO_ANSI_CPRNG
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -82,6 +82,7 @@ obj-$(CONFIG_CRYPTO_MICHAEL_MIC) += mich
+ obj-$(CONFIG_CRYPTO_CRC32C) += crc32c.o
+ obj-$(CONFIG_CRYPTO_AUTHENC) += authenc.o authencesn.o
+ obj-$(CONFIG_CRYPTO_LZO) += lzo.o
++obj-$(CONFIG_CRYPTO_XZ) += xz.o
+ obj-$(CONFIG_CRYPTO_RNG2) += rng.o
+ obj-$(CONFIG_CRYPTO_RNG2) += krng.o
+ obj-$(CONFIG_CRYPTO_ANSI_CPRNG) += ansi_cprng.o
+--- /dev/null
++++ b/crypto/xz.c
+@@ -0,0 +1,117 @@
++/*
++ * Cryptographic API.
++ *
++ * XZ decompression support.
++ *
++ * Copyright (c) 2012 Gabor Juhos <juhosg@openwrt.org>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ *
++ */
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/crypto.h>
++#include <linux/xz.h>
++#include <linux/interrupt.h>
++#include <linux/mm.h>
++#include <linux/net.h>
++
++struct xz_comp_ctx {
++	struct xz_dec	*decomp_state;
++	struct xz_buf	decomp_buf;
++};
++
++static int crypto_xz_decomp_init(struct xz_comp_ctx *ctx)
++{
++	ctx->decomp_state = xz_dec_init(XZ_SINGLE, 0);
++	if (!ctx->decomp_state)
++		return -ENOMEM;
++
++	return 0;
++}
++
++static void crypto_xz_decomp_exit(struct xz_comp_ctx *ctx)
++{
++	xz_dec_end(ctx->decomp_state);
++}
++
++static int crypto_xz_init(struct crypto_tfm *tfm)
++{
++	struct xz_comp_ctx *ctx = crypto_tfm_ctx(tfm);
++
++	return crypto_xz_decomp_init(ctx);
++}
++
++static void crypto_xz_exit(struct crypto_tfm *tfm)
++{
++	struct xz_comp_ctx *ctx = crypto_tfm_ctx(tfm);
++
++	crypto_xz_decomp_exit(ctx);
++}
++
++static int crypto_xz_compress(struct crypto_tfm *tfm, const u8 *src,
++			      unsigned int slen, u8 *dst, unsigned int *dlen)
++{
++	return -EOPNOTSUPP;
++}
++
++static int crypto_xz_decompress(struct crypto_tfm *tfm, const u8 *src,
++				unsigned int slen, u8 *dst, unsigned int *dlen)
++{
++	struct xz_comp_ctx *dctx = crypto_tfm_ctx(tfm);
++	struct xz_buf *xz_buf = &dctx->decomp_buf;
++	int ret;
++
++	memset(xz_buf, '\0', sizeof(struct xz_buf));
++
++	xz_buf->in = (u8 *) src;
++	xz_buf->in_pos = 0;
++	xz_buf->in_size = slen;
++	xz_buf->out = (u8 *) dst;
++	xz_buf->out_pos = 0;
++	xz_buf->out_size = *dlen;
++
++	ret = xz_dec_run(dctx->decomp_state, xz_buf);
++	if (ret != XZ_STREAM_END) {
++		ret = -EINVAL;
++		goto out;
++	}
++
++	*dlen = xz_buf->out_pos;
++	ret = 0;
++
++out:
++	return ret;
++}
++
++static struct crypto_alg crypto_xz_alg = {
++	.cra_name		= "xz",
++	.cra_flags		= CRYPTO_ALG_TYPE_COMPRESS,
++	.cra_ctxsize		= sizeof(struct xz_comp_ctx),
++	.cra_module		= THIS_MODULE,
++	.cra_list		= LIST_HEAD_INIT(crypto_xz_alg.cra_list),
++	.cra_init		= crypto_xz_init,
++	.cra_exit		= crypto_xz_exit,
++	.cra_u			= { .compress = {
++	.coa_compress 		= crypto_xz_compress,
++	.coa_decompress  	= crypto_xz_decompress } }
++};
++
++static int __init crypto_xz_mod_init(void)
++{
++	return crypto_register_alg(&crypto_xz_alg);
++}
++
++static void __exit crypto_xz_mod_exit(void)
++{
++	crypto_unregister_alg(&crypto_xz_alg);
++}
++
++module_init(crypto_xz_mod_init);
++module_exit(crypto_xz_mod_exit);
++
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("Crypto XZ decompression support");
++MODULE_AUTHOR("Gabor Juhos <juhosg@openwrt.org>");
diff --git a/target/linux/generic/patches-3.3/541-ubifs-xz-decompression-support.patch b/target/linux/generic/patches-3.3/541-ubifs-xz-decompression-support.patch
new file mode 100644
index 0000000..3442d90
--- /dev/null
+++ b/target/linux/generic/patches-3.3/541-ubifs-xz-decompression-support.patch
@@ -0,0 +1,94 @@
+--- a/fs/ubifs/Kconfig
++++ b/fs/ubifs/Kconfig
+@@ -5,8 +5,10 @@ config UBIFS_FS
+ 	select CRYPTO if UBIFS_FS_ADVANCED_COMPR
+ 	select CRYPTO if UBIFS_FS_LZO
+ 	select CRYPTO if UBIFS_FS_ZLIB
++	select CRYPTO if UBIFS_FS_XZ
+ 	select CRYPTO_LZO if UBIFS_FS_LZO
+ 	select CRYPTO_DEFLATE if UBIFS_FS_ZLIB
++	select CRYPTO_XZ if UBIFS_FS_XZ
+ 	depends on MTD_UBI
+ 	help
+ 	  UBIFS is a file system for flash devices which works on top of UBI.
+@@ -42,6 +44,14 @@ config UBIFS_FS_ZLIB
+ 	help
+ 	  Zlib compresses better than LZO but it is slower. Say 'Y' if unsure.
+ 
++config UBIFS_FS_XZ
++	bool "XZ decompression support" if UBIFS_FS_ADVANCED_COMPR
++	depends on UBIFS_FS
++	default y
++	help
++	  XZ compresses better the ZLIB but it is slower. 
++	  Say 'Y' if unsure.
++
+ # Debugging-related stuff
+ config UBIFS_FS_DEBUG
+ 	bool "Enable debugging support"
+--- a/fs/ubifs/compress.c
++++ b/fs/ubifs/compress.c
+@@ -71,6 +71,24 @@ static struct ubifs_compressor zlib_comp
+ };
+ #endif
+ 
++#ifdef CONFIG_UBIFS_FS_XZ
++static DEFINE_MUTEX(xz_enc_mutex);
++static DEFINE_MUTEX(xz_dec_mutex);
++
++static struct ubifs_compressor xz_compr = {
++	.compr_type = UBIFS_COMPR_XZ,
++	.comp_mutex = &xz_enc_mutex,
++	.decomp_mutex = &xz_dec_mutex,
++	.name = "xz",
++	.capi_name = "xz",
++};
++#else
++static struct ubifs_compressor xz_compr = {
++	.compr_type = UBIFS_COMPR_XZ,
++	.name = "xz",
++};
++#endif
++
+ /* All UBIFS compressors */
+ struct ubifs_compressor *ubifs_compressors[UBIFS_COMPR_TYPES_CNT];
+ 
+@@ -233,9 +251,15 @@ int __init ubifs_compressors_init(void)
+ 	if (err)
+ 		goto out_lzo;
+ 
++	err = compr_init(&xz_compr);
++	if (err)
++		goto out_zlib;
++
+ 	ubifs_compressors[UBIFS_COMPR_NONE] = &none_compr;
+ 	return 0;
+ 
++out_zlib:
++	compr_exit(&zlib_compr);
+ out_lzo:
+ 	compr_exit(&lzo_compr);
+ 	return err;
+@@ -248,4 +272,5 @@ void ubifs_compressors_exit(void)
+ {
+ 	compr_exit(&lzo_compr);
+ 	compr_exit(&zlib_compr);
++	compr_exit(&xz_compr);
+ }
+--- a/fs/ubifs/ubifs-media.h
++++ b/fs/ubifs/ubifs-media.h
+@@ -332,12 +332,14 @@ enum {
+  * UBIFS_COMPR_NONE: no compression
+  * UBIFS_COMPR_LZO: LZO compression
+  * UBIFS_COMPR_ZLIB: ZLIB compression
++ * UBIFS_COMPR_XZ: XZ compression
+  * UBIFS_COMPR_TYPES_CNT: count of supported compression types
+  */
+ enum {
+ 	UBIFS_COMPR_NONE,
+ 	UBIFS_COMPR_LZO,
+ 	UBIFS_COMPR_ZLIB,
++	UBIFS_COMPR_XZ,
+ 	UBIFS_COMPR_TYPES_CNT,
+ };
+ 
diff --git a/target/linux/generic/patches-3.3/550-ubifs-symlink-xattr-support.patch b/target/linux/generic/patches-3.3/550-ubifs-symlink-xattr-support.patch
new file mode 100644
index 0000000..b0d818e
--- /dev/null
+++ b/target/linux/generic/patches-3.3/550-ubifs-symlink-xattr-support.patch
@@ -0,0 +1,67 @@
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -1575,6 +1575,12 @@ const struct inode_operations ubifs_syml
+ 	.follow_link = ubifs_follow_link,
+ 	.setattr     = ubifs_setattr,
+ 	.getattr     = ubifs_getattr,
++#ifdef CONFIG_UBIFS_FS_XATTR
++	.setxattr    = ubifs_setxattr,
++	.getxattr    = ubifs_getxattr,
++	.listxattr   = ubifs_listxattr,
++	.removexattr = ubifs_removexattr,
++#endif
+ };
+ 
+ const struct file_operations ubifs_file_operations = {
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -553,7 +553,8 @@ int ubifs_jnl_update(struct ubifs_info *
+ 
+ 	dbg_jnl("ino %lu, dent '%.*s', data len %d in dir ino %lu",
+ 		inode->i_ino, nm->len, nm->name, ui->data_len, dir->i_ino);
+-	ubifs_assert(dir_ui->data_len == 0);
++	if (!xent)
++		ubifs_assert(dir_ui->data_len == 0);
+ 	ubifs_assert(mutex_is_locked(&dir_ui->ui_mutex));
+ 
+ 	dlen = UBIFS_DENT_NODE_SZ + nm->len + 1;
+@@ -573,6 +574,13 @@ int ubifs_jnl_update(struct ubifs_info *
+ 	aligned_dlen = ALIGN(dlen, 8);
+ 	aligned_ilen = ALIGN(ilen, 8);
+ 	len = aligned_dlen + aligned_ilen + UBIFS_INO_NODE_SZ;
++	if (xent) {
++		/*
++		 * Make sure to account for dir_ui->data_len in
++		 * length calculation in case there is extended attribute.
++		 */
++		len += dir_ui->data_len;
++	}
+ 	dent = kmalloc(len, GFP_NOFS);
+ 	if (!dent)
+ 		return -ENOMEM;
+@@ -649,7 +657,8 @@ int ubifs_jnl_update(struct ubifs_info *
+ 
+ 	ino_key_init(c, &ino_key, dir->i_ino);
+ 	ino_offs += aligned_ilen;
+-	err = ubifs_tnc_add(c, &ino_key, lnum, ino_offs, UBIFS_INO_NODE_SZ);
++	err = ubifs_tnc_add(c, &ino_key, lnum, ino_offs,
++			    UBIFS_INO_NODE_SZ + dir_ui->data_len);
+ 	if (err)
+ 		goto out_ro;
+ 
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -209,12 +209,12 @@ static int change_xattr(struct ubifs_inf
+ 		goto out_free;
+ 	}
+ 	inode->i_size = ui->ui_size = size;
+-	ui->data_len = size;
+ 
+ 	mutex_lock(&host_ui->ui_mutex);
+ 	host->i_ctime = ubifs_current_time(host);
+ 	host_ui->xattr_size -= CALC_XATTR_BYTES(ui->data_len);
+ 	host_ui->xattr_size += CALC_XATTR_BYTES(size);
++	ui->data_len = size;
+ 
+ 	/*
+ 	 * It is important to write the host inode after the xattr inode
diff --git a/target/linux/generic/patches-3.3/600-netfilter_layer7_2.22.patch b/target/linux/generic/patches-3.3/600-netfilter_layer7_2.22.patch
new file mode 100644
index 0000000..f305559
--- /dev/null
+++ b/target/linux/generic/patches-3.3/600-netfilter_layer7_2.22.patch
@@ -0,0 +1,2142 @@
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -1053,6 +1053,27 @@ config NETFILTER_XT_MATCH_STATE
+ 
+ 	  To compile it as a module, choose M here.  If unsure, say N.
+ 
++config NETFILTER_XT_MATCH_LAYER7
++	tristate '"layer7" match support'
++	depends on NETFILTER_XTABLES
++	depends on EXPERIMENTAL && (IP_NF_CONNTRACK || NF_CONNTRACK)
++       depends on NETFILTER_ADVANCED
++	help
++	  Say Y if you want to be able to classify connections (and their
++	  packets) based on regular expression matching of their application
++	  layer data.   This is one way to classify applications such as
++	  peer-to-peer filesharing systems that do not always use the same
++	  port.
++
++	  To compile it as a module, choose M here.  If unsure, say N.
++
++config NETFILTER_XT_MATCH_LAYER7_DEBUG
++        bool 'Layer 7 debugging output'
++        depends on NETFILTER_XT_MATCH_LAYER7
++        help
++          Say Y to get lots of debugging output.
++
++
+ config NETFILTER_XT_MATCH_STATISTIC
+ 	tristate '"statistic" match support'
+ 	depends on NETFILTER_ADVANCED
+--- a/net/netfilter/Makefile
++++ b/net/netfilter/Makefile
+@@ -105,6 +105,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_RECENT)
+ obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_SOCKET) += xt_socket.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o
++obj-$(CONFIG_NETFILTER_XT_MATCH_LAYER7) += xt_layer7.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) += xt_tcpmss.o
+--- /dev/null
++++ b/net/netfilter/xt_layer7.c
+@@ -0,0 +1,666 @@
++/*
++  Kernel module to match application layer (OSI layer 7) data in connections.
++
++  http://l7-filter.sf.net
++
++  (C) 2003-2009 Matthew Strait and Ethan Sommer.
++
++  This program is free software; you can redistribute it and/or
++  modify it under the terms of the GNU General Public License
++  as published by the Free Software Foundation; either version
++  2 of the License, or (at your option) any later version.
++  http://www.gnu.org/licenses/gpl.txt
++
++  Based on ipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>,
++  xt_helper.c (C) 2002 Harald Welte and cls_layer7.c (C) 2003 Matthew Strait,
++  Ethan Sommer, Justin Levandoski.
++*/
++
++#include <linux/spinlock.h>
++#include <linux/version.h>
++#include <net/ip.h>
++#include <net/tcp.h>
++#include <linux/module.h>
++#include <linux/skbuff.h>
++#include <linux/netfilter.h>
++#include <net/netfilter/nf_conntrack.h>
++#include <net/netfilter/nf_conntrack_core.h>
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
++#include <net/netfilter/nf_conntrack_extend.h>
++#include <net/netfilter/nf_conntrack_acct.h>
++#endif
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_layer7.h>
++#include <linux/ctype.h>
++#include <linux/proc_fs.h>
++
++#include "regexp/regexp.c"
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Matthew Strait <quadong@users.sf.net>, Ethan Sommer <sommere@users.sf.net>");
++MODULE_DESCRIPTION("iptables application layer match module");
++MODULE_ALIAS("ipt_layer7");
++MODULE_VERSION("2.21");
++
++static int maxdatalen = 2048; // this is the default
++module_param(maxdatalen, int, 0444);
++MODULE_PARM_DESC(maxdatalen, "maximum bytes of data looked at by l7-filter");
++#ifdef CONFIG_NETFILTER_XT_MATCH_LAYER7_DEBUG
++	#define DPRINTK(format,args...) printk(format,##args)
++#else
++	#define DPRINTK(format,args...)
++#endif
++
++/* Number of packets whose data we look at.
++This can be modified through /proc/net/layer7_numpackets */
++static int num_packets = 10;
++
++static struct pattern_cache {
++	char * regex_string;
++	regexp * pattern;
++	struct pattern_cache * next;
++} * first_pattern_cache = NULL;
++
++DEFINE_SPINLOCK(l7_lock);
++
++static int total_acct_packets(struct nf_conn *ct)
++{
++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 26)
++	BUG_ON(ct == NULL);
++	return (ct->counters[IP_CT_DIR_ORIGINAL].packets + ct->counters[IP_CT_DIR_REPLY].packets);
++#else
++	struct nf_conn_counter *acct;
++
++	BUG_ON(ct == NULL);
++	acct = nf_conn_acct_find(ct);
++	if (!acct)
++		return 0;
++	return (atomic64_read(&acct[IP_CT_DIR_ORIGINAL].packets) + atomic64_read(&acct[IP_CT_DIR_REPLY].packets));
++#endif
++}
++
++#ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG
++/* Converts an unfriendly string into a friendly one by
++replacing unprintables with periods and all whitespace with " ". */
++static char * friendly_print(unsigned char * s)
++{
++	char * f = kmalloc(strlen(s) + 1, GFP_ATOMIC);
++	int i;
++
++	if(!f) {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory in "
++					"friendly_print, bailing.\n");
++		return NULL;
++	}
++
++	for(i = 0; i < strlen(s); i++){
++		if(isprint(s[i]) && s[i] < 128)	f[i] = s[i];
++		else if(isspace(s[i]))		f[i] = ' ';
++		else 				f[i] = '.';
++	}
++	f[i] = '\0';
++	return f;
++}
++
++static char dec2hex(int i)
++{
++	switch (i) {
++		case 0 ... 9:
++			return (i + '0');
++			break;
++		case 10 ... 15:
++			return (i - 10 + 'a');
++			break;
++		default:
++			if (net_ratelimit())
++				printk("layer7: Problem in dec2hex\n");
++			return '\0';
++	}
++}
++
++static char * hex_print(unsigned char * s)
++{
++	char * g = kmalloc(strlen(s)*3 + 1, GFP_ATOMIC);
++	int i;
++
++	if(!g) {
++	       if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory in hex_print, "
++					"bailing.\n");
++	       return NULL;
++	}
++
++	for(i = 0; i < strlen(s); i++) {
++		g[i*3    ] = dec2hex(s[i]/16);
++		g[i*3 + 1] = dec2hex(s[i]%16);
++		g[i*3 + 2] = ' ';
++	}
++	g[i*3] = '\0';
++
++	return g;
++}
++#endif // DEBUG
++
++/* Use instead of regcomp.  As we expect to be seeing the same regexps over and
++over again, it make sense to cache the results. */
++static regexp * compile_and_cache(const char * regex_string, 
++                                  const char * protocol)
++{
++	struct pattern_cache * node               = first_pattern_cache;
++	struct pattern_cache * last_pattern_cache = first_pattern_cache;
++	struct pattern_cache * tmp;
++	unsigned int len;
++
++	while (node != NULL) {
++		if (!strcmp(node->regex_string, regex_string))
++		return node->pattern;
++
++		last_pattern_cache = node;/* points at the last non-NULL node */
++		node = node->next;
++	}
++
++	/* If we reach the end of the list, then we have not yet cached
++	   the pattern for this regex. Let's do that now.
++	   Be paranoid about running out of memory to avoid list corruption. */
++	tmp = kmalloc(sizeof(struct pattern_cache), GFP_ATOMIC);
++
++	if(!tmp) {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory in "
++					"compile_and_cache, bailing.\n");
++		return NULL;
++	}
++
++	tmp->regex_string  = kmalloc(strlen(regex_string) + 1, GFP_ATOMIC);
++	tmp->pattern       = kmalloc(sizeof(struct regexp),    GFP_ATOMIC);
++	tmp->next = NULL;
++
++	if(!tmp->regex_string || !tmp->pattern) {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory in "
++					"compile_and_cache, bailing.\n");
++		kfree(tmp->regex_string);
++		kfree(tmp->pattern);
++		kfree(tmp);
++		return NULL;
++	}
++
++	/* Ok.  The new node is all ready now. */
++	node = tmp;
++
++	if(first_pattern_cache == NULL) /* list is empty */
++		first_pattern_cache = node; /* make node the beginning */
++	else
++		last_pattern_cache->next = node; /* attach node to the end */
++
++	/* copy the string and compile the regex */
++	len = strlen(regex_string);
++	DPRINTK("About to compile this: \"%s\"\n", regex_string);
++	node->pattern = regcomp((char *)regex_string, &len);
++	if ( !node->pattern ) {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: Error compiling regexp "
++					"\"%s\" (%s)\n", 
++					regex_string, protocol);
++		/* pattern is now cached as NULL, so we won't try again. */
++	}
++
++	strcpy(node->regex_string, regex_string);
++	return node->pattern;
++}
++
++static int can_handle(const struct sk_buff *skb)
++{
++	if(!ip_hdr(skb)) /* not IP */
++		return 0;
++	if(ip_hdr(skb)->protocol != IPPROTO_TCP &&
++	   ip_hdr(skb)->protocol != IPPROTO_UDP &&
++	   ip_hdr(skb)->protocol != IPPROTO_ICMP)
++		return 0;
++	return 1;
++}
++
++/* Returns offset the into the skb->data that the application data starts */
++static int app_data_offset(const struct sk_buff *skb)
++{
++	/* In case we are ported somewhere (ebtables?) where ip_hdr(skb)
++	isn't set, this can be gotten from 4*(skb->data[0] & 0x0f) as well. */
++	int ip_hl = 4*ip_hdr(skb)->ihl;
++
++	if( ip_hdr(skb)->protocol == IPPROTO_TCP ) {
++		/* 12 == offset into TCP header for the header length field.
++		Can't get this with skb->h.th->doff because the tcphdr
++		struct doesn't get set when routing (this is confirmed to be
++		true in Netfilter as well as QoS.) */
++		int tcp_hl = 4*(skb->data[ip_hl + 12] >> 4);
++
++		return ip_hl + tcp_hl;
++	} else if( ip_hdr(skb)->protocol == IPPROTO_UDP  ) {
++		return ip_hl + 8; /* UDP header is always 8 bytes */
++	} else if( ip_hdr(skb)->protocol == IPPROTO_ICMP ) {
++		return ip_hl + 8; /* ICMP header is 8 bytes */
++	} else {
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: tried to handle unknown "
++					"protocol!\n");
++		return ip_hl + 8; /* something reasonable */
++	}
++}
++
++/* handles whether there's a match when we aren't appending data anymore */
++static int match_no_append(struct nf_conn * conntrack, 
++                           struct nf_conn * master_conntrack, 
++                           enum ip_conntrack_info ctinfo,
++                           enum ip_conntrack_info master_ctinfo,
++                           const struct xt_layer7_info * info)
++{
++	/* If we're in here, throw the app data away */
++	if(master_conntrack->layer7.app_data != NULL) {
++
++	#ifdef CONFIG_IP_NF_MATCH_LAYER7_DEBUG
++		if(!master_conntrack->layer7.app_proto) {
++			char * f = 
++			  friendly_print(master_conntrack->layer7.app_data);
++			char * g = 
++			  hex_print(master_conntrack->layer7.app_data);
++			DPRINTK("\nl7-filter gave up after %d bytes "
++				"(%d packets):\n%s\n",
++				strlen(f), total_acct_packets(master_conntrack), f);
++			kfree(f);
++			DPRINTK("In hex: %s\n", g);
++			kfree(g);
++		}
++	#endif
++
++		kfree(master_conntrack->layer7.app_data);
++		master_conntrack->layer7.app_data = NULL; /* don't free again */
++	}
++
++	if(master_conntrack->layer7.app_proto){
++		/* Here child connections set their .app_proto (for /proc) */
++		if(!conntrack->layer7.app_proto) {
++			conntrack->layer7.app_proto = 
++			  kmalloc(strlen(master_conntrack->layer7.app_proto)+1, 
++			    GFP_ATOMIC);
++			if(!conntrack->layer7.app_proto){
++				if (net_ratelimit())
++					printk(KERN_ERR "layer7: out of memory "
++							"in match_no_append, "
++							"bailing.\n");
++				return 1;
++			}
++			strcpy(conntrack->layer7.app_proto, 
++				master_conntrack->layer7.app_proto);
++		}
++
++		return (!strcmp(master_conntrack->layer7.app_proto, 
++				info->protocol));
++	}
++	else {
++		/* If not classified, set to "unknown" to distinguish from
++		connections that are still being tested. */
++		master_conntrack->layer7.app_proto = 
++			kmalloc(strlen("unknown")+1, GFP_ATOMIC);
++		if(!master_conntrack->layer7.app_proto){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: out of memory in "
++						"match_no_append, bailing.\n");
++			return 1;
++		}
++		strcpy(master_conntrack->layer7.app_proto, "unknown");
++		return 0;
++	}
++}
++
++/* add the new app data to the conntrack.  Return number of bytes added. */
++static int add_data(struct nf_conn * master_conntrack,
++                    char * app_data, int appdatalen)
++{
++	int length = 0, i;
++	int oldlength = master_conntrack->layer7.app_data_len;
++
++	/* This is a fix for a race condition by Deti Fliegl. However, I'm not 
++	   clear on whether the race condition exists or whether this really 
++	   fixes it.  I might just be being dense... Anyway, if it's not really 
++	   a fix, all it does is waste a very small amount of time. */
++	if(!master_conntrack->layer7.app_data) return 0;
++
++	/* Strip nulls. Make everything lower case (our regex lib doesn't
++	do case insensitivity).  Add it to the end of the current data. */
++	for(i = 0; i < maxdatalen-oldlength-1 &&
++		   i < appdatalen; i++) {
++		if(app_data[i] != '\0') {
++			/* the kernel version of tolower mungs 'upper ascii' */
++			master_conntrack->layer7.app_data[length+oldlength] =
++				isascii(app_data[i])? 
++					tolower(app_data[i]) : app_data[i];
++			length++;
++		}
++	}
++
++	master_conntrack->layer7.app_data[length+oldlength] = '\0';
++	master_conntrack->layer7.app_data_len = length + oldlength;
++
++	return length;
++}
++
++/* taken from drivers/video/modedb.c */
++static int my_atoi(const char *s)
++{
++	int val = 0;
++
++	for (;; s++) {
++		switch (*s) {
++			case '0'...'9':
++			val = 10*val+(*s-'0');
++			break;
++		default:
++			return val;
++		}
++	}
++}
++
++/* write out num_packets to userland. */
++static int layer7_read_proc(char* page, char ** start, off_t off, int count,
++                            int* eof, void * data)
++{
++	if(num_packets > 99 && net_ratelimit())
++		printk(KERN_ERR "layer7: NOT REACHED. num_packets too big\n");
++
++	page[0] = num_packets/10 + '0';
++	page[1] = num_packets%10 + '0';
++	page[2] = '\n';
++	page[3] = '\0';
++
++	*eof=1;
++
++	return 3;
++}
++
++/* Read in num_packets from userland */
++static int layer7_write_proc(struct file* file, const char* buffer,
++                             unsigned long count, void *data)
++{
++	char * foo = kmalloc(count, GFP_ATOMIC);
++
++	if(!foo){
++		if (net_ratelimit())
++			printk(KERN_ERR "layer7: out of memory, bailing. "
++					"num_packets unchanged.\n");
++		return count;
++	}
++
++	if(copy_from_user(foo, buffer, count)) {
++		return -EFAULT;
++	}
++
++
++	num_packets = my_atoi(foo);
++	kfree (foo);
++
++	/* This has an arbitrary limit to make the math easier. I'm lazy.
++	But anyway, 99 is a LOT! If you want more, you're doing it wrong! */
++	if(num_packets > 99) {
++		printk(KERN_WARNING "layer7: num_packets can't be > 99.\n");
++		num_packets = 99;
++	} else if(num_packets < 1) {
++		printk(KERN_WARNING "layer7: num_packets can't be < 1.\n");
++		num_packets = 1;
++	}
++
++	return count;
++}
++
++static bool
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++match(const struct sk_buff *skbin, const struct xt_match_param *par)
++#else
++match(const struct sk_buff *skbin,
++      const struct net_device *in,
++      const struct net_device *out,
++      const struct xt_match *match,
++      const void *matchinfo,
++      int offset,
++      unsigned int protoff,
++      bool *hotdrop)
++#endif
++{
++	/* sidestep const without getting a compiler warning... */
++	struct sk_buff * skb = (struct sk_buff *)skbin; 
++
++	const struct xt_layer7_info * info = 
++	#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++		par->matchinfo;
++	#else
++		matchinfo;
++	#endif
++
++	enum ip_conntrack_info master_ctinfo, ctinfo;
++	struct nf_conn *master_conntrack, *conntrack;
++	unsigned char * app_data;
++	unsigned int pattern_result, appdatalen;
++	regexp * comppattern;
++
++	/* Be paranoid/incompetent - lock the entire match function. */
++	spin_lock_bh(&l7_lock);
++
++	if(!can_handle(skb)){
++		DPRINTK("layer7: This is some protocol I can't handle.\n");
++		spin_unlock_bh(&l7_lock);
++		return info->invert;
++	}
++
++	/* Treat parent & all its children together as one connection, except
++	for the purpose of setting conntrack->layer7.app_proto in the actual
++	connection. This makes /proc/net/ip_conntrack more satisfying. */
++	if(!(conntrack = nf_ct_get(skb, &ctinfo)) ||
++	   !(master_conntrack=nf_ct_get(skb,&master_ctinfo))){
++		DPRINTK("layer7: couldn't get conntrack.\n");
++		spin_unlock_bh(&l7_lock);
++		return info->invert;
++	}
++
++	/* Try to get a master conntrack (and its master etc) for FTP, etc. */
++	while (master_ct(master_conntrack) != NULL)
++		master_conntrack = master_ct(master_conntrack);
++
++	/* if we've classified it or seen too many packets */
++	if(total_acct_packets(master_conntrack) > num_packets ||
++	   master_conntrack->layer7.app_proto) {
++
++		pattern_result = match_no_append(conntrack, master_conntrack, 
++						 ctinfo, master_ctinfo, info);
++
++		/* skb->cb[0] == seen. Don't do things twice if there are 
++		multiple l7 rules. I'm not sure that using cb for this purpose 
++		is correct, even though it says "put your private variables 
++		there". But it doesn't look like it is being used for anything
++		else in the skbs that make it here. */
++		skb->cb[0] = 1; /* marking it seen here's probably irrelevant */
++
++		spin_unlock_bh(&l7_lock);
++		return (pattern_result ^ info->invert);
++	}
++
++	if(skb_is_nonlinear(skb)){
++		if(skb_linearize(skb) != 0){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: failed to linearize "
++						"packet, bailing.\n");
++			spin_unlock_bh(&l7_lock);
++			return info->invert;
++		}
++	}
++
++	/* now that the skb is linearized, it's safe to set these. */
++	app_data = skb->data + app_data_offset(skb);
++	appdatalen = skb_tail_pointer(skb) - app_data;
++
++	/* the return value gets checked later, when we're ready to use it */
++	comppattern = compile_and_cache(info->pattern, info->protocol);
++
++	/* On the first packet of a connection, allocate space for app data */
++	if(total_acct_packets(master_conntrack) == 1 && !skb->cb[0] && 
++	   !master_conntrack->layer7.app_data){
++		master_conntrack->layer7.app_data = 
++			kmalloc(maxdatalen, GFP_ATOMIC);
++		if(!master_conntrack->layer7.app_data){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: out of memory in "
++						"match, bailing.\n");
++			spin_unlock_bh(&l7_lock);
++			return info->invert;
++		}
++
++		master_conntrack->layer7.app_data[0] = '\0';
++	}
++
++	/* Can be here, but unallocated, if numpackets is increased near
++	the beginning of a connection */
++	if(master_conntrack->layer7.app_data == NULL){
++		spin_unlock_bh(&l7_lock);
++		return info->invert; /* unmatched */
++	}
++
++	if(!skb->cb[0]){
++		int newbytes;
++		newbytes = add_data(master_conntrack, app_data, appdatalen);
++
++		if(newbytes == 0) { /* didn't add any data */
++			skb->cb[0] = 1;
++			/* Didn't match before, not going to match now */
++			spin_unlock_bh(&l7_lock);
++			return info->invert;
++		}
++	}
++
++	/* If looking for "unknown", then never match.  "Unknown" means that
++	we've given up; we're still trying with these packets. */
++	if(!strcmp(info->protocol, "unknown")) {
++		pattern_result = 0;
++	/* If looking for "unset", then always match. "Unset" means that we
++	haven't yet classified the connection. */
++	} else if(!strcmp(info->protocol, "unset")) {
++		pattern_result = 2;
++		DPRINTK("layer7: matched unset: not yet classified "
++			"(%d/%d packets)\n",
++                        total_acct_packets(master_conntrack), num_packets);
++	/* If the regexp failed to compile, don't bother running it */
++	} else if(comppattern && 
++		  regexec(comppattern, master_conntrack->layer7.app_data)){
++		DPRINTK("layer7: matched %s\n", info->protocol);
++		pattern_result = 1;
++	} else pattern_result = 0;
++
++	if(pattern_result == 1) {
++		master_conntrack->layer7.app_proto = 
++			kmalloc(strlen(info->protocol)+1, GFP_ATOMIC);
++		if(!master_conntrack->layer7.app_proto){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: out of memory in "
++						"match, bailing.\n");
++			spin_unlock_bh(&l7_lock);
++			return (pattern_result ^ info->invert);
++		}
++		strcpy(master_conntrack->layer7.app_proto, info->protocol);
++	} else if(pattern_result > 1) { /* cleanup from "unset" */
++		pattern_result = 1;
++	}
++
++	/* mark the packet seen */
++	skb->cb[0] = 1;
++
++	spin_unlock_bh(&l7_lock);
++	return (pattern_result ^ info->invert);
++}
++
++// load nf_conntrack_ipv4
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++static bool check(const struct xt_mtchk_param *par)
++{
++        if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
++                printk(KERN_WARNING "can't load conntrack support for "
++                                    "proto=%d\n", par->match->family);
++#else
++static bool check(const char *tablename, const void *inf,
++		 const struct xt_match *match, void *matchinfo,
++		 unsigned int hook_mask)
++{
++        if (nf_ct_l3proto_try_module_get(match->family) < 0) {
++                printk(KERN_WARNING "can't load conntrack support for "
++                                    "proto=%d\n", match->family);
++#endif
++                return 0;
++        }
++	return 1;
++}
++
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++	static void destroy(const struct xt_mtdtor_param *par)
++	{
++		nf_ct_l3proto_module_put(par->match->family);
++	}
++#else
++	static void destroy(const struct xt_match *match, void *matchinfo)
++	{
++		nf_ct_l3proto_module_put(match->family);
++	}
++#endif
++
++static struct xt_match xt_layer7_match[] __read_mostly = {
++{
++	.name		= "layer7",
++	.family		= AF_INET,
++	.checkentry	= check,
++	.match		= match,
++	.destroy	= destroy,
++	.matchsize	= sizeof(struct xt_layer7_info),
++	.me		= THIS_MODULE
++}
++};
++
++static void layer7_cleanup_proc(void)
++{
++	remove_proc_entry("layer7_numpackets", init_net.proc_net);
++}
++
++/* register the proc file */
++static void layer7_init_proc(void)
++{
++	struct proc_dir_entry* entry;
++	entry = create_proc_entry("layer7_numpackets", 0644, init_net.proc_net);
++	entry->read_proc = layer7_read_proc;
++	entry->write_proc = layer7_write_proc;
++}
++
++static int __init xt_layer7_init(void)
++{
++	need_conntrack();
++
++	layer7_init_proc();
++	if(maxdatalen < 1) {
++		printk(KERN_WARNING "layer7: maxdatalen can't be < 1, "
++			"using 1\n");
++		maxdatalen = 1;
++	}
++	/* This is not a hard limit.  It's just here to prevent people from
++	bringing their slow machines to a grinding halt. */
++	else if(maxdatalen > 65536) {
++		printk(KERN_WARNING "layer7: maxdatalen can't be > 65536, "
++			"using 65536\n");
++		maxdatalen = 65536;
++	}
++	return xt_register_matches(xt_layer7_match,
++				   ARRAY_SIZE(xt_layer7_match));
++}
++
++static void __exit xt_layer7_fini(void)
++{
++	layer7_cleanup_proc();
++	xt_unregister_matches(xt_layer7_match, ARRAY_SIZE(xt_layer7_match));
++}
++
++module_init(xt_layer7_init);
++module_exit(xt_layer7_fini);
+--- /dev/null
++++ b/net/netfilter/regexp/regexp.c
+@@ -0,0 +1,1197 @@
++/*
++ * regcomp and regexec -- regsub and regerror are elsewhere
++ * @(#)regexp.c	1.3 of 18 April 87
++ *
++ *	Copyright (c) 1986 by University of Toronto.
++ *	Written by Henry Spencer.  Not derived from licensed software.
++ *
++ *	Permission is granted to anyone to use this software for any
++ *	purpose on any computer system, and to redistribute it freely,
++ *	subject to the following restrictions:
++ *
++ *	1. The author is not responsible for the consequences of use of
++ *		this software, no matter how awful, even if they arise
++ *		from defects in it.
++ *
++ *	2. The origin of this software must not be misrepresented, either
++ *		by explicit claim or by omission.
++ *
++ *	3. Altered versions must be plainly marked as such, and must not
++ *		be misrepresented as being the original software.
++ *
++ * Beware that some of this code is subtly aware of the way operator
++ * precedence is structured in regular expressions.  Serious changes in
++ * regular-expression syntax might require a total rethink.
++ *
++ * This code was modified by Ethan Sommer to work within the kernel
++ * (it now uses kmalloc etc..)
++ *
++ * Modified slightly by Matthew Strait to use more modern C.
++ */
++
++#include "regexp.h"
++#include "regmagic.h"
++
++/* added by ethan and matt.  Lets it work in both kernel and user space.
++(So iptables can use it, for instance.)  Yea, it goes both ways... */
++#if __KERNEL__
++  #define malloc(foo) kmalloc(foo,GFP_ATOMIC)
++#else
++  #define printk(format,args...) printf(format,##args)
++#endif
++
++void regerror(char * s)
++{
++        printk("<3>Regexp: %s\n", s);
++        /* NOTREACHED */
++}
++
++/*
++ * The "internal use only" fields in regexp.h are present to pass info from
++ * compile to execute that permits the execute phase to run lots faster on
++ * simple cases.  They are:
++ *
++ * regstart	char that must begin a match; '\0' if none obvious
++ * reganch	is the match anchored (at beginning-of-line only)?
++ * regmust	string (pointer into program) that match must include, or NULL
++ * regmlen	length of regmust string
++ *
++ * Regstart and reganch permit very fast decisions on suitable starting points
++ * for a match, cutting down the work a lot.  Regmust permits fast rejection
++ * of lines that cannot possibly match.  The regmust tests are costly enough
++ * that regcomp() supplies a regmust only if the r.e. contains something
++ * potentially expensive (at present, the only such thing detected is * or +
++ * at the start of the r.e., which can involve a lot of backup).  Regmlen is
++ * supplied because the test in regexec() needs it and regcomp() is computing
++ * it anyway.
++ */
++
++/*
++ * Structure for regexp "program".  This is essentially a linear encoding
++ * of a nondeterministic finite-state machine (aka syntax charts or
++ * "railroad normal form" in parsing technology).  Each node is an opcode
++ * plus a "next" pointer, possibly plus an operand.  "Next" pointers of
++ * all nodes except BRANCH implement concatenation; a "next" pointer with
++ * a BRANCH on both ends of it is connecting two alternatives.  (Here we
++ * have one of the subtle syntax dependencies:  an individual BRANCH (as
++ * opposed to a collection of them) is never concatenated with anything
++ * because of operator precedence.)  The operand of some types of node is
++ * a literal string; for others, it is a node leading into a sub-FSM.  In
++ * particular, the operand of a BRANCH node is the first node of the branch.
++ * (NB this is *not* a tree structure:  the tail of the branch connects
++ * to the thing following the set of BRANCHes.)  The opcodes are:
++ */
++
++/* definition	number	opnd?	meaning */
++#define	END	0	/* no	End of program. */
++#define	BOL	1	/* no	Match "" at beginning of line. */
++#define	EOL	2	/* no	Match "" at end of line. */
++#define	ANY	3	/* no	Match any one character. */
++#define	ANYOF	4	/* str	Match any character in this string. */
++#define	ANYBUT	5	/* str	Match any character not in this string. */
++#define	BRANCH	6	/* node	Match this alternative, or the next... */
++#define	BACK	7	/* no	Match "", "next" ptr points backward. */
++#define	EXACTLY	8	/* str	Match this string. */
++#define	NOTHING	9	/* no	Match empty string. */
++#define	STAR	10	/* node	Match this (simple) thing 0 or more times. */
++#define	PLUS	11	/* node	Match this (simple) thing 1 or more times. */
++#define	OPEN	20	/* no	Mark this point in input as start of #n. */
++			/*	OPEN+1 is number 1, etc. */
++#define	CLOSE	30	/* no	Analogous to OPEN. */
++
++/*
++ * Opcode notes:
++ *
++ * BRANCH	The set of branches constituting a single choice are hooked
++ *		together with their "next" pointers, since precedence prevents
++ *		anything being concatenated to any individual branch.  The
++ *		"next" pointer of the last BRANCH in a choice points to the
++ *		thing following the whole choice.  This is also where the
++ *		final "next" pointer of each individual branch points; each
++ *		branch starts with the operand node of a BRANCH node.
++ *
++ * BACK		Normal "next" pointers all implicitly point forward; BACK
++ *		exists to make loop structures possible.
++ *
++ * STAR,PLUS	'?', and complex '*' and '+', are implemented as circular
++ *		BRANCH structures using BACK.  Simple cases (one character
++ *		per match) are implemented with STAR and PLUS for speed
++ *		and to minimize recursive plunges.
++ *
++ * OPEN,CLOSE	...are numbered at compile time.
++ */
++
++/*
++ * A node is one char of opcode followed by two chars of "next" pointer.
++ * "Next" pointers are stored as two 8-bit pieces, high order first.  The
++ * value is a positive offset from the opcode of the node containing it.
++ * An operand, if any, simply follows the node.  (Note that much of the
++ * code generation knows about this implicit relationship.)
++ *
++ * Using two bytes for the "next" pointer is vast overkill for most things,
++ * but allows patterns to get big without disasters.
++ */
++#define	OP(p)	(*(p))
++#define	NEXT(p)	(((*((p)+1)&0377)<<8) + (*((p)+2)&0377))
++#define	OPERAND(p)	((p) + 3)
++
++/*
++ * See regmagic.h for one further detail of program structure.
++ */
++
++
++/*
++ * Utility definitions.
++ */
++#ifndef CHARBITS
++#define	UCHARAT(p)	((int)*(unsigned char *)(p))
++#else
++#define	UCHARAT(p)	((int)*(p)&CHARBITS)
++#endif
++
++#define	FAIL(m)	{ regerror(m); return(NULL); }
++#define	ISMULT(c)	((c) == '*' || (c) == '+' || (c) == '?')
++#define	META	"^$.[()|?+*\\"
++
++/*
++ * Flags to be passed up and down.
++ */
++#define	HASWIDTH	01	/* Known never to match null string. */
++#define	SIMPLE		02	/* Simple enough to be STAR/PLUS operand. */
++#define	SPSTART		04	/* Starts with * or +. */
++#define	WORST		0	/* Worst case. */
++
++/*
++ * Global work variables for regcomp().
++ */
++struct match_globals {
++char *reginput;		/* String-input pointer. */
++char *regbol;		/* Beginning of input, for ^ check. */
++char **regstartp;	/* Pointer to startp array. */
++char **regendp;		/* Ditto for endp. */
++char *regparse;		/* Input-scan pointer. */
++int regnpar;		/* () count. */
++char regdummy;
++char *regcode;		/* Code-emit pointer; &regdummy = don't. */
++long regsize;		/* Code size. */
++};
++
++/*
++ * Forward declarations for regcomp()'s friends.
++ */
++#ifndef STATIC
++#define	STATIC	static
++#endif
++STATIC char *reg(struct match_globals *g, int paren,int *flagp);
++STATIC char *regbranch(struct match_globals *g, int *flagp);
++STATIC char *regpiece(struct match_globals *g, int *flagp);
++STATIC char *regatom(struct match_globals *g, int *flagp);
++STATIC char *regnode(struct match_globals *g, char op);
++STATIC char *regnext(struct match_globals *g, char *p);
++STATIC void regc(struct match_globals *g, char b);
++STATIC void reginsert(struct match_globals *g, char op, char *opnd);
++STATIC void regtail(struct match_globals *g, char *p, char *val);
++STATIC void regoptail(struct match_globals *g, char *p, char *val);
++
++
++__kernel_size_t my_strcspn(const char *s1,const char *s2)
++{
++        char *scan1;
++        char *scan2;
++        int count;
++
++        count = 0;
++        for (scan1 = (char *)s1; *scan1 != '\0'; scan1++) {
++                for (scan2 = (char *)s2; *scan2 != '\0';)       /* ++ moved down. */
++                        if (*scan1 == *scan2++)
++                                return(count);
++                count++;
++        }
++        return(count);
++}
++
++/*
++ - regcomp - compile a regular expression into internal code
++ *
++ * We can't allocate space until we know how big the compiled form will be,
++ * but we can't compile it (and thus know how big it is) until we've got a
++ * place to put the code.  So we cheat:  we compile it twice, once with code
++ * generation turned off and size counting turned on, and once "for real".
++ * This also means that we don't allocate space until we are sure that the
++ * thing really will compile successfully, and we never have to move the
++ * code and thus invalidate pointers into it.  (Note that it has to be in
++ * one piece because free() must be able to free it all.)
++ *
++ * Beware that the optimization-preparation code in here knows about some
++ * of the structure of the compiled regexp.
++ */
++regexp *
++regcomp(char *exp,int *patternsize)
++{
++	register regexp *r;
++	register char *scan;
++	register char *longest;
++	register int len;
++	int flags;
++	struct match_globals g;
++	
++	/* commented out by ethan
++	   extern char *malloc();
++	*/
++
++	if (exp == NULL)
++		FAIL("NULL argument");
++
++	/* First pass: determine size, legality. */
++	g.regparse = exp;
++	g.regnpar = 1;
++	g.regsize = 0L;
++	g.regcode = &g.regdummy;
++	regc(&g, MAGIC);
++	if (reg(&g, 0, &flags) == NULL)
++		return(NULL);
++
++	/* Small enough for pointer-storage convention? */
++	if (g.regsize >= 32767L)		/* Probably could be 65535L. */
++		FAIL("regexp too big");
++
++	/* Allocate space. */
++	*patternsize=sizeof(regexp) + (unsigned)g.regsize;
++	r = (regexp *)malloc(sizeof(regexp) + (unsigned)g.regsize);
++	if (r == NULL)
++		FAIL("out of space");
++
++	/* Second pass: emit code. */
++	g.regparse = exp;
++	g.regnpar = 1;
++	g.regcode = r->program;
++	regc(&g, MAGIC);
++	if (reg(&g, 0, &flags) == NULL)
++		return(NULL);
++
++	/* Dig out information for optimizations. */
++	r->regstart = '\0';	/* Worst-case defaults. */
++	r->reganch = 0;
++	r->regmust = NULL;
++	r->regmlen = 0;
++	scan = r->program+1;			/* First BRANCH. */
++	if (OP(regnext(&g, scan)) == END) {		/* Only one top-level choice. */
++		scan = OPERAND(scan);
++
++		/* Starting-point info. */
++		if (OP(scan) == EXACTLY)
++			r->regstart = *OPERAND(scan);
++		else if (OP(scan) == BOL)
++			r->reganch++;
++
++		/*
++		 * If there's something expensive in the r.e., find the
++		 * longest literal string that must appear and make it the
++		 * regmust.  Resolve ties in favor of later strings, since
++		 * the regstart check works with the beginning of the r.e.
++		 * and avoiding duplication strengthens checking.  Not a
++		 * strong reason, but sufficient in the absence of others.
++		 */
++		if (flags&SPSTART) {
++			longest = NULL;
++			len = 0;
++			for (; scan != NULL; scan = regnext(&g, scan))
++				if (OP(scan) == EXACTLY && strlen(OPERAND(scan)) >= len) {
++					longest = OPERAND(scan);
++					len = strlen(OPERAND(scan));
++				}
++			r->regmust = longest;
++			r->regmlen = len;
++		}
++	}
++
++	return(r);
++}
++
++/*
++ - reg - regular expression, i.e. main body or parenthesized thing
++ *
++ * Caller must absorb opening parenthesis.
++ *
++ * Combining parenthesis handling with the base level of regular expression
++ * is a trifle forced, but the need to tie the tails of the branches to what
++ * follows makes it hard to avoid.
++ */
++static char *
++reg(struct match_globals *g, int paren, int *flagp /* Parenthesized? */ )
++{
++	register char *ret;
++	register char *br;
++	register char *ender;
++	register int parno = 0; /* 0 makes gcc happy */
++	int flags;
++
++	*flagp = HASWIDTH;	/* Tentatively. */
++
++	/* Make an OPEN node, if parenthesized. */
++	if (paren) {
++		if (g->regnpar >= NSUBEXP)
++			FAIL("too many ()");
++		parno = g->regnpar;
++		g->regnpar++;
++		ret = regnode(g, OPEN+parno);
++	} else
++		ret = NULL;
++
++	/* Pick up the branches, linking them together. */
++	br = regbranch(g, &flags);
++	if (br == NULL)
++		return(NULL);
++	if (ret != NULL)
++		regtail(g, ret, br);	/* OPEN -> first. */
++	else
++		ret = br;
++	if (!(flags&HASWIDTH))
++		*flagp &= ~HASWIDTH;
++	*flagp |= flags&SPSTART;
++	while (*g->regparse == '|') {
++		g->regparse++;
++		br = regbranch(g, &flags);
++		if (br == NULL)
++			return(NULL);
++		regtail(g, ret, br);	/* BRANCH -> BRANCH. */
++		if (!(flags&HASWIDTH))
++			*flagp &= ~HASWIDTH;
++		*flagp |= flags&SPSTART;
++	}
++
++	/* Make a closing node, and hook it on the end. */
++	ender = regnode(g, (paren) ? CLOSE+parno : END);	
++	regtail(g, ret, ender);
++
++	/* Hook the tails of the branches to the closing node. */
++	for (br = ret; br != NULL; br = regnext(g, br))
++		regoptail(g, br, ender);
++
++	/* Check for proper termination. */
++	if (paren && *g->regparse++ != ')') {
++		FAIL("unmatched ()");
++	} else if (!paren && *g->regparse != '\0') {
++		if (*g->regparse == ')') {
++			FAIL("unmatched ()");
++		} else
++			FAIL("junk on end");	/* "Can't happen". */
++		/* NOTREACHED */
++	}
++
++	return(ret);
++}
++
++/*
++ - regbranch - one alternative of an | operator
++ *
++ * Implements the concatenation operator.
++ */
++static char *
++regbranch(struct match_globals *g, int *flagp)
++{
++	register char *ret;
++	register char *chain;
++	register char *latest;
++	int flags;
++
++	*flagp = WORST;		/* Tentatively. */
++
++	ret = regnode(g, BRANCH);
++	chain = NULL;
++	while (*g->regparse != '\0' && *g->regparse != '|' && *g->regparse != ')') {
++		latest = regpiece(g, &flags);
++		if (latest == NULL)
++			return(NULL);
++		*flagp |= flags&HASWIDTH;
++		if (chain == NULL)	/* First piece. */
++			*flagp |= flags&SPSTART;
++		else
++			regtail(g, chain, latest);
++		chain = latest;
++	}
++	if (chain == NULL)	/* Loop ran zero times. */
++		(void) regnode(g, NOTHING);
++
++	return(ret);
++}
++
++/*
++ - regpiece - something followed by possible [*+?]
++ *
++ * Note that the branching code sequences used for ? and the general cases
++ * of * and + are somewhat optimized:  they use the same NOTHING node as
++ * both the endmarker for their branch list and the body of the last branch.
++ * It might seem that this node could be dispensed with entirely, but the
++ * endmarker role is not redundant.
++ */
++static char *
++regpiece(struct match_globals *g, int *flagp)
++{
++	register char *ret;
++	register char op;
++	register char *next;
++	int flags;
++
++	ret = regatom(g, &flags);
++	if (ret == NULL)
++		return(NULL);
++
++	op = *g->regparse;
++	if (!ISMULT(op)) {
++		*flagp = flags;
++		return(ret);
++	}
++
++	if (!(flags&HASWIDTH) && op != '?')
++		FAIL("*+ operand could be empty");
++	*flagp = (op != '+') ? (WORST|SPSTART) : (WORST|HASWIDTH);
++
++	if (op == '*' && (flags&SIMPLE))
++		reginsert(g, STAR, ret);
++	else if (op == '*') {
++		/* Emit x* as (x&|), where & means "self". */
++		reginsert(g, BRANCH, ret);			/* Either x */
++		regoptail(g, ret, regnode(g, BACK));		/* and loop */
++		regoptail(g, ret, ret);			/* back */
++		regtail(g, ret, regnode(g, BRANCH));		/* or */
++		regtail(g, ret, regnode(g, NOTHING));		/* null. */
++	} else if (op == '+' && (flags&SIMPLE))
++		reginsert(g, PLUS, ret);
++	else if (op == '+') {
++		/* Emit x+ as x(&|), where & means "self". */
++		next = regnode(g, BRANCH);			/* Either */
++		regtail(g, ret, next);
++		regtail(g, regnode(g, BACK), ret);		/* loop back */
++		regtail(g, next, regnode(g, BRANCH));		/* or */
++		regtail(g, ret, regnode(g, NOTHING));		/* null. */
++	} else if (op == '?') {
++		/* Emit x? as (x|) */
++		reginsert(g, BRANCH, ret);			/* Either x */
++		regtail(g, ret, regnode(g, BRANCH));		/* or */
++		next = regnode(g, NOTHING);		/* null. */
++		regtail(g, ret, next);
++		regoptail(g, ret, next);
++	}
++	g->regparse++;
++	if (ISMULT(*g->regparse))
++		FAIL("nested *?+");
++
++	return(ret);
++}
++
++/*
++ - regatom - the lowest level
++ *
++ * Optimization:  gobbles an entire sequence of ordinary characters so that
++ * it can turn them into a single node, which is smaller to store and
++ * faster to run.  Backslashed characters are exceptions, each becoming a
++ * separate node; the code is simpler that way and it's not worth fixing.
++ */
++static char *
++regatom(struct match_globals *g, int *flagp)
++{
++	register char *ret;
++	int flags;
++
++	*flagp = WORST;		/* Tentatively. */
++
++	switch (*g->regparse++) {
++	case '^':
++		ret = regnode(g, BOL);
++		break;
++	case '$':
++		ret = regnode(g, EOL);
++		break;
++	case '.':
++		ret = regnode(g, ANY);
++		*flagp |= HASWIDTH|SIMPLE;
++		break;
++	case '[': {
++			register int class;
++			register int classend;
++
++			if (*g->regparse == '^') {	/* Complement of range. */
++				ret = regnode(g, ANYBUT);
++				g->regparse++;
++			} else
++				ret = regnode(g, ANYOF);
++			if (*g->regparse == ']' || *g->regparse == '-')
++				regc(g, *g->regparse++);
++			while (*g->regparse != '\0' && *g->regparse != ']') {
++				if (*g->regparse == '-') {
++					g->regparse++;
++					if (*g->regparse == ']' || *g->regparse == '\0')
++						regc(g, '-');
++					else {
++						class = UCHARAT(g->regparse-2)+1;
++						classend = UCHARAT(g->regparse);
++						if (class > classend+1)
++							FAIL("invalid [] range");
++						for (; class <= classend; class++)
++							regc(g, class);
++						g->regparse++;
++					}
++				} else
++					regc(g, *g->regparse++);
++			}
++			regc(g, '\0');
++			if (*g->regparse != ']')
++				FAIL("unmatched []");
++			g->regparse++;
++			*flagp |= HASWIDTH|SIMPLE;
++		}
++		break;
++	case '(':
++		ret = reg(g, 1, &flags);
++		if (ret == NULL)
++			return(NULL);
++		*flagp |= flags&(HASWIDTH|SPSTART);
++		break;
++	case '\0':
++	case '|':
++	case ')':
++		FAIL("internal urp");	/* Supposed to be caught earlier. */
++		break;
++	case '?':
++	case '+':
++	case '*':
++		FAIL("?+* follows nothing");
++		break;
++	case '\\':
++		if (*g->regparse == '\0')
++			FAIL("trailing \\");
++		ret = regnode(g, EXACTLY);
++		regc(g, *g->regparse++);
++		regc(g, '\0');
++		*flagp |= HASWIDTH|SIMPLE;
++		break;
++	default: {
++			register int len;
++			register char ender;
++
++			g->regparse--;
++			len = my_strcspn((const char *)g->regparse, (const char *)META);
++			if (len <= 0)
++				FAIL("internal disaster");
++			ender = *(g->regparse+len);
++			if (len > 1 && ISMULT(ender))
++				len--;		/* Back off clear of ?+* operand. */
++			*flagp |= HASWIDTH;
++			if (len == 1)
++				*flagp |= SIMPLE;
++			ret = regnode(g, EXACTLY);
++			while (len > 0) {
++				regc(g, *g->regparse++);
++				len--;
++			}
++			regc(g, '\0');
++		}
++		break;
++	}
++
++	return(ret);
++}
++
++/*
++ - regnode - emit a node
++ */
++static char *			/* Location. */
++regnode(struct match_globals *g, char op)
++{
++	register char *ret;
++	register char *ptr;
++
++	ret = g->regcode;
++	if (ret == &g->regdummy) {
++		g->regsize += 3;
++		return(ret);
++	}
++
++	ptr = ret;
++	*ptr++ = op;
++	*ptr++ = '\0';		/* Null "next" pointer. */
++	*ptr++ = '\0';
++	g->regcode = ptr;
++
++	return(ret);
++}
++
++/*
++ - regc - emit (if appropriate) a byte of code
++ */
++static void
++regc(struct match_globals *g, char b)
++{
++	if (g->regcode != &g->regdummy)
++		*g->regcode++ = b;
++	else
++		g->regsize++;
++}
++
++/*
++ - reginsert - insert an operator in front of already-emitted operand
++ *
++ * Means relocating the operand.
++ */
++static void
++reginsert(struct match_globals *g, char op, char* opnd)
++{
++	register char *src;
++	register char *dst;
++	register char *place;
++
++	if (g->regcode == &g->regdummy) {
++		g->regsize += 3;
++		return;
++	}
++
++	src = g->regcode;
++	g->regcode += 3;
++	dst = g->regcode;
++	while (src > opnd)
++		*--dst = *--src;
++
++	place = opnd;		/* Op node, where operand used to be. */
++	*place++ = op;
++	*place++ = '\0';
++	*place++ = '\0';
++}
++
++/*
++ - regtail - set the next-pointer at the end of a node chain
++ */
++static void
++regtail(struct match_globals *g, char *p, char *val)
++{
++	register char *scan;
++	register char *temp;
++	register int offset;
++
++	if (p == &g->regdummy)
++		return;
++
++	/* Find last node. */
++	scan = p;
++	for (;;) {
++		temp = regnext(g, scan);
++		if (temp == NULL)
++			break;
++		scan = temp;
++	}
++
++	if (OP(scan) == BACK)
++		offset = scan - val;
++	else
++		offset = val - scan;
++	*(scan+1) = (offset>>8)&0377;
++	*(scan+2) = offset&0377;
++}
++
++/*
++ - regoptail - regtail on operand of first argument; nop if operandless
++ */
++static void
++regoptail(struct match_globals *g, char *p, char *val)
++{
++	/* "Operandless" and "op != BRANCH" are synonymous in practice. */
++	if (p == NULL || p == &g->regdummy || OP(p) != BRANCH)
++		return;
++	regtail(g, OPERAND(p), val);
++}
++
++/*
++ * regexec and friends
++ */
++
++
++/*
++ * Forwards.
++ */
++STATIC int regtry(struct match_globals *g, regexp *prog, char *string);
++STATIC int regmatch(struct match_globals *g, char *prog);
++STATIC int regrepeat(struct match_globals *g, char *p);
++
++#ifdef DEBUG
++int regnarrate = 0;
++void regdump();
++STATIC char *regprop(char *op);
++#endif
++
++/*
++ - regexec - match a regexp against a string
++ */
++int
++regexec(regexp *prog, char *string)
++{
++	register char *s;
++	struct match_globals g;
++
++	/* Be paranoid... */
++	if (prog == NULL || string == NULL) {
++		printk("<3>Regexp: NULL parameter\n");
++		return(0);
++	}
++
++	/* Check validity of program. */
++	if (UCHARAT(prog->program) != MAGIC) {
++		printk("<3>Regexp: corrupted program\n");
++		return(0);
++	}
++
++	/* If there is a "must appear" string, look for it. */
++	if (prog->regmust != NULL) {
++		s = string;
++		while ((s = strchr(s, prog->regmust[0])) != NULL) {
++			if (strncmp(s, prog->regmust, prog->regmlen) == 0)
++				break;	/* Found it. */
++			s++;
++		}
++		if (s == NULL)	/* Not present. */
++			return(0);
++	}
++
++	/* Mark beginning of line for ^ . */
++	g.regbol = string;
++
++	/* Simplest case:  anchored match need be tried only once. */
++	if (prog->reganch)
++		return(regtry(&g, prog, string));
++
++	/* Messy cases:  unanchored match. */
++	s = string;
++	if (prog->regstart != '\0')
++		/* We know what char it must start with. */
++		while ((s = strchr(s, prog->regstart)) != NULL) {
++			if (regtry(&g, prog, s))
++				return(1);
++			s++;
++		}
++	else
++		/* We don't -- general case. */
++		do {
++			if (regtry(&g, prog, s))
++				return(1);
++		} while (*s++ != '\0');
++
++	/* Failure. */
++	return(0);
++}
++
++/*
++ - regtry - try match at specific point
++ */
++static int			/* 0 failure, 1 success */
++regtry(struct match_globals *g, regexp *prog, char *string)
++{
++	register int i;
++	register char **sp;
++	register char **ep;
++
++	g->reginput = string;
++	g->regstartp = prog->startp;
++	g->regendp = prog->endp;
++
++	sp = prog->startp;
++	ep = prog->endp;
++	for (i = NSUBEXP; i > 0; i--) {
++		*sp++ = NULL;
++		*ep++ = NULL;
++	}
++	if (regmatch(g, prog->program + 1)) {
++		prog->startp[0] = string;
++		prog->endp[0] = g->reginput;
++		return(1);
++	} else
++		return(0);
++}
++
++/*
++ - regmatch - main matching routine
++ *
++ * Conceptually the strategy is simple:  check to see whether the current
++ * node matches, call self recursively to see whether the rest matches,
++ * and then act accordingly.  In practice we make some effort to avoid
++ * recursion, in particular by going through "ordinary" nodes (that don't
++ * need to know whether the rest of the match failed) by a loop instead of
++ * by recursion.
++ */
++static int			/* 0 failure, 1 success */
++regmatch(struct match_globals *g, char *prog)
++{
++	register char *scan = prog; /* Current node. */
++	char *next;		    /* Next node. */
++
++#ifdef DEBUG
++	if (scan != NULL && regnarrate)
++		fprintf(stderr, "%s(\n", regprop(scan));
++#endif
++	while (scan != NULL) {
++#ifdef DEBUG
++		if (regnarrate)
++			fprintf(stderr, "%s...\n", regprop(scan));
++#endif
++		next = regnext(g, scan);
++
++		switch (OP(scan)) {
++		case BOL:
++			if (g->reginput != g->regbol)
++				return(0);
++			break;
++		case EOL:
++			if (*g->reginput != '\0')
++				return(0);
++			break;
++		case ANY:
++			if (*g->reginput == '\0')
++				return(0);
++			g->reginput++;
++			break;
++		case EXACTLY: {
++				register int len;
++				register char *opnd;
++
++				opnd = OPERAND(scan);
++				/* Inline the first character, for speed. */
++				if (*opnd != *g->reginput)
++					return(0);
++				len = strlen(opnd);
++				if (len > 1 && strncmp(opnd, g->reginput, len) != 0)
++					return(0);
++				g->reginput += len;
++			}
++			break;
++		case ANYOF:
++			if (*g->reginput == '\0' || strchr(OPERAND(scan), *g->reginput) == NULL)
++				return(0);
++			g->reginput++;
++			break;
++		case ANYBUT:
++			if (*g->reginput == '\0' || strchr(OPERAND(scan), *g->reginput) != NULL)
++				return(0);
++			g->reginput++;
++			break;
++		case NOTHING:
++		case BACK:
++			break;
++		case OPEN+1:
++		case OPEN+2:
++		case OPEN+3:
++		case OPEN+4:
++		case OPEN+5:
++		case OPEN+6:
++		case OPEN+7:
++		case OPEN+8:
++		case OPEN+9: {
++				register int no;
++				register char *save;
++
++				no = OP(scan) - OPEN;
++				save = g->reginput;
++
++				if (regmatch(g, next)) {
++					/*
++					 * Don't set startp if some later
++					 * invocation of the same parentheses
++					 * already has.
++					 */
++					if (g->regstartp[no] == NULL)
++						g->regstartp[no] = save;
++					return(1);
++				} else
++					return(0);
++			}
++			break;
++		case CLOSE+1:
++		case CLOSE+2:
++		case CLOSE+3:
++		case CLOSE+4:
++		case CLOSE+5:
++		case CLOSE+6:
++		case CLOSE+7:
++		case CLOSE+8:
++		case CLOSE+9:
++			{
++				register int no;
++				register char *save;
++
++				no = OP(scan) - CLOSE;
++				save = g->reginput;
++
++				if (regmatch(g, next)) {
++					/*
++					 * Don't set endp if some later
++					 * invocation of the same parentheses
++					 * already has.
++					 */
++					if (g->regendp[no] == NULL)
++						g->regendp[no] = save;
++					return(1);
++				} else
++					return(0);
++			}
++			break;
++		case BRANCH: {
++				register char *save;
++
++				if (OP(next) != BRANCH)		/* No choice. */
++					next = OPERAND(scan);	/* Avoid recursion. */
++				else {
++					do {
++						save = g->reginput;
++						if (regmatch(g, OPERAND(scan)))
++							return(1);
++						g->reginput = save;
++						scan = regnext(g, scan);
++					} while (scan != NULL && OP(scan) == BRANCH);
++					return(0);
++					/* NOTREACHED */
++				}
++			}
++			break;
++		case STAR:
++		case PLUS: {
++				register char nextch;
++				register int no;
++				register char *save;
++				register int min;
++
++				/*
++				 * Lookahead to avoid useless match attempts
++				 * when we know what character comes next.
++				 */
++				nextch = '\0';
++				if (OP(next) == EXACTLY)
++					nextch = *OPERAND(next);
++				min = (OP(scan) == STAR) ? 0 : 1;
++				save = g->reginput;
++				no = regrepeat(g, OPERAND(scan));
++				while (no >= min) {
++					/* If it could work, try it. */
++					if (nextch == '\0' || *g->reginput == nextch)
++						if (regmatch(g, next))
++							return(1);
++					/* Couldn't or didn't -- back up. */
++					no--;
++					g->reginput = save + no;
++				}
++				return(0);
++			}
++			break;
++		case END:
++			return(1);	/* Success! */
++			break;
++		default:
++			printk("<3>Regexp: memory corruption\n");
++			return(0);
++			break;
++		}
++
++		scan = next;
++	}
++
++	/*
++	 * We get here only if there's trouble -- normally "case END" is
++	 * the terminating point.
++	 */
++	printk("<3>Regexp: corrupted pointers\n");
++	return(0);
++}
++
++/*
++ - regrepeat - repeatedly match something simple, report how many
++ */
++static int
++regrepeat(struct match_globals *g, char *p)
++{
++	register int count = 0;
++	register char *scan;
++	register char *opnd;
++
++	scan = g->reginput;
++	opnd = OPERAND(p);
++	switch (OP(p)) {
++	case ANY:
++		count = strlen(scan);
++		scan += count;
++		break;
++	case EXACTLY:
++		while (*opnd == *scan) {
++			count++;
++			scan++;
++		}
++		break;
++	case ANYOF:
++		while (*scan != '\0' && strchr(opnd, *scan) != NULL) {
++			count++;
++			scan++;
++		}
++		break;
++	case ANYBUT:
++		while (*scan != '\0' && strchr(opnd, *scan) == NULL) {
++			count++;
++			scan++;
++		}
++		break;
++	default:		/* Oh dear.  Called inappropriately. */
++		printk("<3>Regexp: internal foulup\n");
++		count = 0;	/* Best compromise. */
++		break;
++	}
++	g->reginput = scan;
++
++	return(count);
++}
++
++/*
++ - regnext - dig the "next" pointer out of a node
++ */
++static char*
++regnext(struct match_globals *g, char *p)
++{
++	register int offset;
++
++	if (p == &g->regdummy)
++		return(NULL);
++
++	offset = NEXT(p);
++	if (offset == 0)
++		return(NULL);
++
++	if (OP(p) == BACK)
++		return(p-offset);
++	else
++		return(p+offset);
++}
++
++#ifdef DEBUG
++
++STATIC char *regprop();
++
++/*
++ - regdump - dump a regexp onto stdout in vaguely comprehensible form
++ */
++void
++regdump(regexp *r)
++{
++	register char *s;
++	register char op = EXACTLY;	/* Arbitrary non-END op. */
++	register char *next;
++	/* extern char *strchr(); */
++
++
++	s = r->program + 1;
++	while (op != END) {	/* While that wasn't END last time... */
++		op = OP(s);
++		printf("%2d%s", s-r->program, regprop(s));	/* Where, what. */
++		next = regnext(s);
++		if (next == NULL)		/* Next ptr. */
++			printf("(0)");
++		else
++			printf("(%d)", (s-r->program)+(next-s));
++		s += 3;
++		if (op == ANYOF || op == ANYBUT || op == EXACTLY) {
++			/* Literal string, where present. */
++			while (*s != '\0') {
++				putchar(*s);
++				s++;
++			}
++			s++;
++		}
++		putchar('\n');
++	}
++
++	/* Header fields of interest. */
++	if (r->regstart != '\0')
++		printf("start `%c' ", r->regstart);
++	if (r->reganch)
++		printf("anchored ");
++	if (r->regmust != NULL)
++		printf("must have \"%s\"", r->regmust);
++	printf("\n");
++}
++
++/*
++ - regprop - printable representation of opcode
++ */
++static char *
++regprop(char *op)
++{
++#define BUFLEN 50
++	register char *p;
++	static char buf[BUFLEN];
++
++	strcpy(buf, ":");
++
++	switch (OP(op)) {
++	case BOL:
++		p = "BOL";
++		break;
++	case EOL:
++		p = "EOL";
++		break;
++	case ANY:
++		p = "ANY";
++		break;
++	case ANYOF:
++		p = "ANYOF";
++		break;
++	case ANYBUT:
++		p = "ANYBUT";
++		break;
++	case BRANCH:
++		p = "BRANCH";
++		break;
++	case EXACTLY:
++		p = "EXACTLY";
++		break;
++	case NOTHING:
++		p = "NOTHING";
++		break;
++	case BACK:
++		p = "BACK";
++		break;
++	case END:
++		p = "END";
++		break;
++	case OPEN+1:
++	case OPEN+2:
++	case OPEN+3:
++	case OPEN+4:
++	case OPEN+5:
++	case OPEN+6:
++	case OPEN+7:
++	case OPEN+8:
++	case OPEN+9:
++		snprintf(buf+strlen(buf),BUFLEN-strlen(buf), "OPEN%d", OP(op)-OPEN);
++		p = NULL;
++		break;
++	case CLOSE+1:
++	case CLOSE+2:
++	case CLOSE+3:
++	case CLOSE+4:
++	case CLOSE+5:
++	case CLOSE+6:
++	case CLOSE+7:
++	case CLOSE+8:
++	case CLOSE+9:
++		snprintf(buf+strlen(buf),BUFLEN-strlen(buf), "CLOSE%d", OP(op)-CLOSE);
++		p = NULL;
++		break;
++	case STAR:
++		p = "STAR";
++		break;
++	case PLUS:
++		p = "PLUS";
++		break;
++	default:
++		printk("<3>Regexp: corrupted opcode\n");
++		break;
++	}
++	if (p != NULL)
++		strncat(buf, p, BUFLEN-strlen(buf));
++	return(buf);
++}
++#endif
++
++
+--- /dev/null
++++ b/net/netfilter/regexp/regexp.h
+@@ -0,0 +1,41 @@
++/*
++ * Definitions etc. for regexp(3) routines.
++ *
++ * Caveat:  this is V8 regexp(3) [actually, a reimplementation thereof],
++ * not the System V one.
++ */
++
++#ifndef REGEXP_H
++#define REGEXP_H
++
++
++/*
++http://www.opensource.apple.com/darwinsource/10.3/expect-1/expect/expect.h ,
++which contains a version of this library, says:
++
++ *
++ * NSUBEXP must be at least 10, and no greater than 117 or the parser
++ * will not work properly.
++ *
++
++However, it looks rather like this library is limited to 10.  If you think
++otherwise, let us know.
++*/
++
++#define NSUBEXP  10
++typedef struct regexp {
++	char *startp[NSUBEXP];
++	char *endp[NSUBEXP];
++	char regstart;		/* Internal use only. */
++	char reganch;		/* Internal use only. */
++	char *regmust;		/* Internal use only. */
++	int regmlen;		/* Internal use only. */
++	char program[1];	/* Unwarranted chumminess with compiler. */
++} regexp;
++
++regexp * regcomp(char *exp, int *patternsize);
++int regexec(regexp *prog, char *string);
++void regsub(regexp *prog, char *source, char *dest);
++void regerror(char *s);
++
++#endif
+--- /dev/null
++++ b/net/netfilter/regexp/regmagic.h
+@@ -0,0 +1,5 @@
++/*
++ * The first byte of the regexp internal "program" is actually this magic
++ * number; the start node begins in the second byte.
++ */
++#define	MAGIC	0234
+--- /dev/null
++++ b/net/netfilter/regexp/regsub.c
+@@ -0,0 +1,95 @@
++/*
++ * regsub
++ * @(#)regsub.c	1.3 of 2 April 86
++ *
++ *	Copyright (c) 1986 by University of Toronto.
++ *	Written by Henry Spencer.  Not derived from licensed software.
++ *
++ *	Permission is granted to anyone to use this software for any
++ *	purpose on any computer system, and to redistribute it freely,
++ *	subject to the following restrictions:
++ *
++ *	1. The author is not responsible for the consequences of use of
++ *		this software, no matter how awful, even if they arise
++ *		from defects in it.
++ *
++ *	2. The origin of this software must not be misrepresented, either
++ *		by explicit claim or by omission.
++ *
++ *	3. Altered versions must be plainly marked as such, and must not
++ *		be misrepresented as being the original software.
++ *
++ *
++ * This code was modified by Ethan Sommer to work within the kernel
++ * (it now uses kmalloc etc..)
++ *
++ */
++#include "regexp.h"
++#include "regmagic.h"
++#include <linux/string.h>
++
++
++#ifndef CHARBITS
++#define	UCHARAT(p)	((int)*(unsigned char *)(p))
++#else
++#define	UCHARAT(p)	((int)*(p)&CHARBITS)
++#endif
++
++#if 0
++//void regerror(char * s)
++//{
++//        printk("regexp(3): %s", s);
++//        /* NOTREACHED */
++//}
++#endif
++
++/*
++ - regsub - perform substitutions after a regexp match
++ */
++void
++regsub(regexp * prog, char * source, char * dest)
++{
++	register char *src;
++	register char *dst;
++	register char c;
++	register int no;
++	register int len;
++	
++	/* Not necessary and gcc doesn't like it -MLS */
++	/*extern char *strncpy();*/
++
++	if (prog == NULL || source == NULL || dest == NULL) {
++		regerror("NULL parm to regsub");
++		return;
++	}
++	if (UCHARAT(prog->program) != MAGIC) {
++		regerror("damaged regexp fed to regsub");
++		return;
++	}
++
++	src = source;
++	dst = dest;
++	while ((c = *src++) != '\0') {
++		if (c == '&')
++			no = 0;
++		else if (c == '\\' && '0' <= *src && *src <= '9')
++			no = *src++ - '0';
++		else
++			no = -1;
++
++		if (no < 0) {	/* Ordinary character. */
++			if (c == '\\' && (*src == '\\' || *src == '&'))
++				c = *src++;
++			*dst++ = c;
++		} else if (prog->startp[no] != NULL && prog->endp[no] != NULL) {
++			len = prog->endp[no] - prog->startp[no];
++			(void) strncpy(dst, prog->startp[no], len);
++			dst += len;
++			if (len != 0 && *(dst-1) == '\0') {	/* strncpy hit NUL. */
++				regerror("damaged match string");
++				return;
++			}
++		}
++	}
++	*dst++ = '\0';
++}
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -214,6 +214,14 @@ destroy_conntrack(struct nf_conntrack *n
+ 	 * too. */
+ 	nf_ct_remove_expectations(ct);
+ 
++	#if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE)
++	if(ct->layer7.app_proto)
++		kfree(ct->layer7.app_proto);
++	if(ct->layer7.app_data)
++	kfree(ct->layer7.app_data);
++	#endif
++
++
+ 	/* We overload first tuple to link into unconfirmed list. */
+ 	if (!nf_ct_is_confirmed(ct)) {
+ 		BUG_ON(hlist_nulls_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode));
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -239,6 +239,12 @@ static int ct_seq_show(struct seq_file *
+ 	if (ct_show_delta_time(s, ct))
+ 		goto release;
+ 
++#if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE)
++	if(ct->layer7.app_proto &&
++           seq_printf(s, "l7proto=%s ", ct->layer7.app_proto))
++		return -ENOSPC;
++#endif
++
+ 	if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
+ 		goto release;
+ 
+--- a/include/net/netfilter/nf_conntrack.h
++++ b/include/net/netfilter/nf_conntrack.h
+@@ -134,6 +134,22 @@ struct nf_conn {
+ 	struct net *ct_net;
+ #endif
+ 
++#if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || \
++    defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE)
++	struct {
++		/*
++		 * e.g. "http". NULL before decision. "unknown" after decision
++		 * if no match.
++		 */
++		char *app_proto;
++		/*
++		 * application layer data so far. NULL after match decision.
++		 */
++		char *app_data;
++		unsigned int app_data_len;
++	} layer7;
++#endif
++
+ 	/* Storage reserved for other modules, must be the last member */
+ 	union nf_conntrack_proto proto;
+ };
+--- /dev/null
++++ b/include/linux/netfilter/xt_layer7.h
+@@ -0,0 +1,13 @@
++#ifndef _XT_LAYER7_H
++#define _XT_LAYER7_H
++
++#define MAX_PATTERN_LEN 8192
++#define MAX_PROTOCOL_LEN 256
++
++struct xt_layer7_info {
++    char protocol[MAX_PROTOCOL_LEN];
++    char pattern[MAX_PATTERN_LEN];
++    u_int8_t invert;
++};
++
++#endif /* _XT_LAYER7_H */
+--- a/include/linux/netfilter/Kbuild
++++ b/include/linux/netfilter/Kbuild
+@@ -49,6 +49,7 @@ header-y += xt_hashlimit.h
+ header-y += xt_helper.h
+ header-y += xt_iprange.h
+ header-y += xt_ipvs.h
++header-y += xt_layer7.h
+ header-y += xt_length.h
+ header-y += xt_limit.h
+ header-y += xt_mac.h
diff --git a/target/linux/generic/patches-3.3/601-netfilter_layer7_pktmatch.patch b/target/linux/generic/patches-3.3/601-netfilter_layer7_pktmatch.patch
new file mode 100644
index 0000000..f65e301
--- /dev/null
+++ b/target/linux/generic/patches-3.3/601-netfilter_layer7_pktmatch.patch
@@ -0,0 +1,108 @@
+--- a/include/linux/netfilter/xt_layer7.h
++++ b/include/linux/netfilter/xt_layer7.h
+@@ -8,6 +8,7 @@ struct xt_layer7_info {
+     char protocol[MAX_PROTOCOL_LEN];
+     char pattern[MAX_PATTERN_LEN];
+     u_int8_t invert;
++    u_int8_t pkt;
+ };
+ 
+ #endif /* _XT_LAYER7_H */
+--- a/net/netfilter/xt_layer7.c
++++ b/net/netfilter/xt_layer7.c
+@@ -314,33 +314,35 @@ static int match_no_append(struct nf_con
+ }
+ 
+ /* add the new app data to the conntrack.  Return number of bytes added. */
+-static int add_data(struct nf_conn * master_conntrack,
+-                    char * app_data, int appdatalen)
++static int add_datastr(char *target, int offset, char *app_data, int len)
+ {
+ 	int length = 0, i;
+-	int oldlength = master_conntrack->layer7.app_data_len;
+-
+-	/* This is a fix for a race condition by Deti Fliegl. However, I'm not 
+-	   clear on whether the race condition exists or whether this really 
+-	   fixes it.  I might just be being dense... Anyway, if it's not really 
+-	   a fix, all it does is waste a very small amount of time. */
+-	if(!master_conntrack->layer7.app_data) return 0;
++	if (!target) return 0;
+ 
+ 	/* Strip nulls. Make everything lower case (our regex lib doesn't
+ 	do case insensitivity).  Add it to the end of the current data. */
+-	for(i = 0; i < maxdatalen-oldlength-1 &&
+-		   i < appdatalen; i++) {
++ 	for(i = 0; i < maxdatalen-offset-1 && i < len; i++) {
+ 		if(app_data[i] != '\0') {
+ 			/* the kernel version of tolower mungs 'upper ascii' */
+-			master_conntrack->layer7.app_data[length+oldlength] =
++			target[length+offset] =
+ 				isascii(app_data[i])? 
+ 					tolower(app_data[i]) : app_data[i];
+ 			length++;
+ 		}
+ 	}
++	target[length+offset] = '\0';
++
++	return length;
++}
++
++/* add the new app data to the conntrack.  Return number of bytes added. */
++static int add_data(struct nf_conn * master_conntrack,
++                    char * app_data, int appdatalen)
++{
++	int length;
+ 
+-	master_conntrack->layer7.app_data[length+oldlength] = '\0';
+-	master_conntrack->layer7.app_data_len = length + oldlength;
++	length = add_datastr(master_conntrack->layer7.app_data, master_conntrack->layer7.app_data_len, app_data, appdatalen);
++	master_conntrack->layer7.app_data_len += length;
+ 
+ 	return length;
+ }
+@@ -438,7 +440,7 @@ match(const struct sk_buff *skbin,
+ 
+ 	enum ip_conntrack_info master_ctinfo, ctinfo;
+ 	struct nf_conn *master_conntrack, *conntrack;
+-	unsigned char * app_data;
++	unsigned char *app_data, *tmp_data;
+ 	unsigned int pattern_result, appdatalen;
+ 	regexp * comppattern;
+ 
+@@ -466,8 +468,8 @@ match(const struct sk_buff *skbin,
+ 		master_conntrack = master_ct(master_conntrack);
+ 
+ 	/* if we've classified it or seen too many packets */
+-	if(total_acct_packets(master_conntrack) > num_packets ||
+-	   master_conntrack->layer7.app_proto) {
++	if(!info->pkt && (total_acct_packets(master_conntrack) > num_packets ||
++	   master_conntrack->layer7.app_proto)) {
+ 
+ 		pattern_result = match_no_append(conntrack, master_conntrack, 
+ 						 ctinfo, master_ctinfo, info);
+@@ -500,6 +502,25 @@ match(const struct sk_buff *skbin,
+ 	/* the return value gets checked later, when we're ready to use it */
+ 	comppattern = compile_and_cache(info->pattern, info->protocol);
+ 
++	if (info->pkt) {
++		tmp_data = kmalloc(maxdatalen, GFP_ATOMIC);
++		if(!tmp_data){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
++			return info->invert;
++		}
++
++		tmp_data[0] = '\0';
++		add_datastr(tmp_data, 0, app_data, appdatalen);
++		pattern_result = ((comppattern && regexec(comppattern, tmp_data)) ? 1 : 0);
++
++		kfree(tmp_data);
++		tmp_data = NULL;
++		spin_unlock_bh(&l7_lock);
++
++		return (pattern_result ^ info->invert);
++	}
++
+ 	/* On the first packet of a connection, allocate space for app data */
+ 	if(total_acct_packets(master_conntrack) == 1 && !skb->cb[0] && 
+ 	   !master_conntrack->layer7.app_data){
diff --git a/target/linux/generic/patches-3.3/602-netfilter_layer7_match.patch b/target/linux/generic/patches-3.3/602-netfilter_layer7_match.patch
new file mode 100644
index 0000000..b2e48c8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/602-netfilter_layer7_match.patch
@@ -0,0 +1,51 @@
+--- a/net/netfilter/xt_layer7.c
++++ b/net/netfilter/xt_layer7.c
+@@ -415,7 +415,9 @@ static int layer7_write_proc(struct file
+ }
+ 
+ static bool
+-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
++match(const struct sk_buff *skbin, struct xt_action_param *par)
++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
+ match(const struct sk_buff *skbin, const struct xt_match_param *par)
+ #else
+ match(const struct sk_buff *skbin,
+@@ -597,14 +599,19 @@ match(const struct sk_buff *skbin,
+ }
+ 
+ // load nf_conntrack_ipv4
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
++static int
++#else
++static bool
++#endif
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)
+-static bool check(const struct xt_mtchk_param *par)
++check(const struct xt_mtchk_param *par)
+ {
+         if (nf_ct_l3proto_try_module_get(par->match->family) < 0) {
+                 printk(KERN_WARNING "can't load conntrack support for "
+                                     "proto=%d\n", par->match->family);
+ #else
+-static bool check(const char *tablename, const void *inf,
++check(const char *tablename, const void *inf,
+ 		 const struct xt_match *match, void *matchinfo,
+ 		 unsigned int hook_mask)
+ {
+@@ -612,9 +619,15 @@ static bool check(const char *tablename,
+                 printk(KERN_WARNING "can't load conntrack support for "
+                                     "proto=%d\n", match->family);
+ #endif
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
++		return -EINVAL;
++	}
++	return 0;
++#else
+                 return 0;
+         }
+ 	return 1;
++#endif
+ }
+ 
+ 
diff --git a/target/linux/generic/patches-3.3/603-netfilter_layer7_2.6.36_fix.patch b/target/linux/generic/patches-3.3/603-netfilter_layer7_2.6.36_fix.patch
new file mode 100644
index 0000000..92a7200
--- /dev/null
+++ b/target/linux/generic/patches-3.3/603-netfilter_layer7_2.6.36_fix.patch
@@ -0,0 +1,61 @@
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -857,6 +857,27 @@ config NETFILTER_XT_MATCH_IPVS
+ 
+ 	  If unsure, say N.
+ 
++config NETFILTER_XT_MATCH_LAYER7
++	tristate '"layer7" match support'
++	depends on EXPERIMENTAL
++	depends on NETFILTER_XTABLES
++	depends on NETFILTER_ADVANCED
++	depends on NF_CONNTRACK
++	help
++	  Say Y if you want to be able to classify connections (and their
++	  packets) based on regular expression matching of their application
++	  layer data.   This is one way to classify applications such as
++	  peer-to-peer filesharing systems that do not always use the same
++	  port.
++
++	  To compile it as a module, choose M here.  If unsure, say N.
++
++config NETFILTER_XT_MATCH_LAYER7_DEBUG
++	bool 'Layer 7 debugging output'
++	depends on NETFILTER_XT_MATCH_LAYER7
++	help
++	  Say Y to get lots of debugging output.
++
+ config NETFILTER_XT_MATCH_LENGTH
+ 	tristate '"length" match support'
+ 	depends on NETFILTER_ADVANCED
+@@ -1053,26 +1074,11 @@ config NETFILTER_XT_MATCH_STATE
+ 
+ 	  To compile it as a module, choose M here.  If unsure, say N.
+ 
+-config NETFILTER_XT_MATCH_LAYER7
+-	tristate '"layer7" match support'
+-	depends on NETFILTER_XTABLES
+-	depends on EXPERIMENTAL && (IP_NF_CONNTRACK || NF_CONNTRACK)
+-       depends on NETFILTER_ADVANCED
+-	help
+-	  Say Y if you want to be able to classify connections (and their
+-	  packets) based on regular expression matching of their application
+-	  layer data.   This is one way to classify applications such as
+-	  peer-to-peer filesharing systems that do not always use the same
+-	  port.
+-
+-	  To compile it as a module, choose M here.  If unsure, say N.
+-
+ config NETFILTER_XT_MATCH_LAYER7_DEBUG
+-        bool 'Layer 7 debugging output'
+-        depends on NETFILTER_XT_MATCH_LAYER7
+-        help
+-          Say Y to get lots of debugging output.
+-
++	bool 'Layer 7 debugging output'
++	depends on NETFILTER_XT_MATCH_LAYER7
++	help
++	  Say Y to get lots of debugging output.
+ 
+ config NETFILTER_XT_MATCH_STATISTIC
+ 	tristate '"statistic" match support'
diff --git a/target/linux/generic/patches-3.3/604-netfilter_conntrack_flush.patch b/target/linux/generic/patches-3.3/604-netfilter_conntrack_flush.patch
new file mode 100644
index 0000000..cbcd29a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/604-netfilter_conntrack_flush.patch
@@ -0,0 +1,46 @@
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -267,10 +267,34 @@ static int ct_open(struct inode *inode, 
+ 			sizeof(struct ct_iter_state));
+ }
+ 
++static int kill_all(struct nf_conn *i, void *data)
++{
++    return 1;
++}
++
++static ssize_t ct_file_write(struct file *file, const char __user *buf,
++			     size_t count, loff_t *ppos)
++{
++	struct seq_file *seq = file->private_data;
++	struct net *net = seq_file_net(seq);
++
++	if (count) {
++		char c;
++
++		if (get_user(c, buf))
++			return -EFAULT;
++
++		if (c == 'f')
++			nf_ct_iterate_cleanup(net, kill_all, NULL);
++	}
++	return count;
++}
++
+ static const struct file_operations ct_file_ops = {
+ 	.owner   = THIS_MODULE,
+ 	.open    = ct_open,
+ 	.read    = seq_read,
++	.write	 = ct_file_write,
+ 	.llseek  = seq_lseek,
+ 	.release = seq_release_net,
+ };
+@@ -372,7 +396,7 @@ static int nf_conntrack_standalone_init_
+ {
+ 	struct proc_dir_entry *pde;
+ 
+-	pde = proc_net_fops_create(net, "nf_conntrack", 0440, &ct_file_ops);
++	pde = proc_net_fops_create(net, "nf_conntrack", 0660, &ct_file_ops);
+ 	if (!pde)
+ 		goto out_nf_conntrack;
+ 
diff --git a/target/linux/generic/patches-3.3/610-netfilter_match_bypass_default_checks.patch b/target/linux/generic/patches-3.3/610-netfilter_match_bypass_default_checks.patch
new file mode 100644
index 0000000..51c9e09
--- /dev/null
+++ b/target/linux/generic/patches-3.3/610-netfilter_match_bypass_default_checks.patch
@@ -0,0 +1,93 @@
+--- a/include/linux/netfilter_ipv4/ip_tables.h
++++ b/include/linux/netfilter_ipv4/ip_tables.h
+@@ -93,6 +93,7 @@ struct ipt_ip {
+ #define IPT_F_FRAG		0x01	/* Set if rule is a fragment rule */
+ #define IPT_F_GOTO		0x02	/* Set if jump is a goto */
+ #define IPT_F_MASK		0x03	/* All possible flag bits mask. */
++#define IPT_F_NO_DEF_MATCH	0x80	/* Internal: no default match rules present */
+ 
+ /* Values for "inv" field in struct ipt_ip. */
+ #define IPT_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -81,6 +81,9 @@ ip_packet_match(const struct iphdr *ip,
+ 
+ #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
+ 
++	if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
++		return true;
++
+ 	if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
+ 		  IPT_INV_SRCIP) ||
+ 	    FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+@@ -134,6 +137,29 @@ ip_packet_match(const struct iphdr *ip,
+ 	return true;
+ }
+ 
++static void
++ip_checkdefault(struct ipt_ip *ip)
++{
++	static const char iface_mask[IFNAMSIZ] = {};
++
++	if (ip->invflags || ip->flags & IPT_F_FRAG)
++		return;
++
++	if (memcmp(ip->iniface_mask, iface_mask, IFNAMSIZ) != 0)
++		return;
++
++	if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
++		return;
++
++	if (ip->smsk.s_addr || ip->dmsk.s_addr)
++		return;
++
++	if (ip->proto)
++		return;
++
++	ip->flags |= IPT_F_NO_DEF_MATCH;
++}
++
+ static bool
+ ip_checkentry(const struct ipt_ip *ip)
+ {
+@@ -561,7 +587,7 @@ static void cleanup_match(struct xt_entr
+ }
+ 
+ static int
+-check_entry(const struct ipt_entry *e, const char *name)
++check_entry(struct ipt_entry *e, const char *name)
+ {
+ 	const struct xt_entry_target *t;
+ 
+@@ -570,6 +596,8 @@ check_entry(const struct ipt_entry *e, c
+ 		return -EINVAL;
+ 	}
+ 
++	ip_checkdefault(&e->ip);
++
+ 	if (e->target_offset + sizeof(struct xt_entry_target) >
+ 	    e->next_offset)
+ 		return -EINVAL;
+@@ -931,6 +959,7 @@ copy_entries_to_user(unsigned int total_
+ 	const struct xt_table_info *private = table->private;
+ 	int ret = 0;
+ 	const void *loc_cpu_entry;
++	u8 flags;
+ 
+ 	counters = alloc_counters(table);
+ 	if (IS_ERR(counters))
+@@ -961,6 +990,14 @@ copy_entries_to_user(unsigned int total_
+ 			ret = -EFAULT;
+ 			goto free_counters;
+ 		}
++
++		flags = e->ip.flags & IPT_F_MASK;
++		if (copy_to_user(userptr + off
++				 + offsetof(struct ipt_entry, ip.flags),
++				 &flags, sizeof(flags)) != 0) {
++			ret = -EFAULT;
++			goto free_counters;
++		}
+ 
+ 		for (i = sizeof(struct ipt_entry);
+ 		     i < e->target_offset;
diff --git a/target/linux/generic/patches-3.3/611-netfilter_match_bypass_default_table.patch b/target/linux/generic/patches-3.3/611-netfilter_match_bypass_default_table.patch
new file mode 100644
index 0000000..3cf0e5a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/611-netfilter_match_bypass_default_table.patch
@@ -0,0 +1,81 @@
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -310,6 +310,33 @@ struct ipt_entry *ipt_next_entry(const s
+ 	return (void *)entry + entry->next_offset;
+ }
+ 
++static bool
++ipt_handle_default_rule(struct ipt_entry *e, unsigned int *verdict)
++{
++	struct xt_entry_target *t;
++	struct xt_standard_target *st;
++
++	if (e->target_offset != sizeof(struct ipt_entry))
++		return false;
++
++	if (!(e->ip.flags & IPT_F_NO_DEF_MATCH))
++		return false;
++
++	t = ipt_get_target(e);
++	if (t->u.kernel.target->target)
++		return false;
++
++	st = (struct xt_standard_target *) t;
++	if (st->verdict == XT_RETURN)
++		return false;
++
++	if (st->verdict >= 0)
++		return false;
++
++	*verdict = (unsigned)(-st->verdict) - 1;
++	return true;
++}
++
+ /* Returns one of the generic firewall policies, like NF_ACCEPT. */
+ unsigned int
+ ipt_do_table(struct sk_buff *skb,
+@@ -334,6 +361,25 @@ ipt_do_table(struct sk_buff *skb,
+ 	ip = ip_hdr(skb);
+ 	indev = in ? in->name : nulldevname;
+ 	outdev = out ? out->name : nulldevname;
++
++	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
++	local_bh_disable();
++	addend = xt_write_recseq_begin();
++	private = table->private;
++	cpu        = smp_processor_id();
++	table_base = private->entries[cpu];
++	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
++	stackptr   = per_cpu_ptr(private->stackptr, cpu);
++	origptr    = *stackptr;
++
++	e = get_entry(table_base, private->hook_entry[hook]);
++	if (ipt_handle_default_rule(e, &verdict)) {
++		ADD_COUNTER(e->counters, skb->len, 1);
++		xt_write_recseq_end(addend);
++		local_bh_enable();
++		return verdict;
++	}
++
+ 	/* We handle fragments by dealing with the first fragment as
+ 	 * if it was a normal packet.  All other fragments are treated
+ 	 * normally, except that they will NEVER match rules that ask
+@@ -348,18 +394,6 @@ ipt_do_table(struct sk_buff *skb,
+ 	acpar.family  = NFPROTO_IPV4;
+ 	acpar.hooknum = hook;
+ 
+-	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
+-	local_bh_disable();
+-	addend = xt_write_recseq_begin();
+-	private = table->private;
+-	cpu        = smp_processor_id();
+-	table_base = private->entries[cpu];
+-	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
+-	stackptr   = per_cpu_ptr(private->stackptr, cpu);
+-	origptr    = *stackptr;
+-
+-	e = get_entry(table_base, private->hook_entry[hook]);
+-
+ 	pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n",
+ 		 table->name, hook, origptr,
+ 		 get_entry(table_base, private->underflow[hook]));
diff --git a/target/linux/generic/patches-3.3/612-netfilter_match_reduce_memory_access.patch b/target/linux/generic/patches-3.3/612-netfilter_match_reduce_memory_access.patch
new file mode 100644
index 0000000..f506165
--- /dev/null
+++ b/target/linux/generic/patches-3.3/612-netfilter_match_reduce_memory_access.patch
@@ -0,0 +1,16 @@
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -84,9 +84,11 @@ ip_packet_match(const struct iphdr *ip,
+ 	if (ipinfo->flags & IPT_F_NO_DEF_MATCH)
+ 		return true;
+ 
+-	if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
++	if (FWINV(ipinfo->smsk.s_addr &&
++		  (ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
+ 		  IPT_INV_SRCIP) ||
+-	    FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
++	    FWINV(ipinfo->dmsk.s_addr &&
++		  (ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+ 		  IPT_INV_DSTIP)) {
+ 		dprintf("Source or dest mismatch.\n");
+ 
diff --git a/target/linux/generic/patches-3.3/613-netfilter_optional_tcp_window_check.patch b/target/linux/generic/patches-3.3/613-netfilter_optional_tcp_window_check.patch
new file mode 100644
index 0000000..1c259d4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/613-netfilter_optional_tcp_window_check.patch
@@ -0,0 +1,36 @@
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -29,6 +29,9 @@
+ #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
+ #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+ 
++/* Do not check the TCP window for incoming packets  */
++static int nf_ct_tcp_no_window_check __read_mostly = 1;
++
+ /* "Be conservative in what you do,
+     be liberal in what you accept from others."
+     If it's non-zero, we mark only out of window RST segments as INVALID. */
+@@ -524,6 +527,9 @@ static bool tcp_in_window(const struct n
+ 	s16 receiver_offset;
+ 	bool res;
+ 
++	if (nf_ct_tcp_no_window_check)
++		return true;
++
+ 	/*
+ 	 * Get the required data from the packet.
+ 	 */
+@@ -1321,6 +1327,13 @@ static struct ctl_table tcp_sysctl_table
+ 		.proc_handler	= proc_dointvec,
+ 	},
+ 	{
++		.procname       = "nf_conntrack_tcp_no_window_check",
++		.data           = &nf_ct_tcp_no_window_check,
++		.maxlen         = sizeof(unsigned int),
++		.mode           = 0644,
++		.proc_handler   = proc_dointvec,
++	},
++	{
+ 		.procname       = "nf_conntrack_tcp_be_liberal",
+ 		.data           = &nf_ct_tcp_be_liberal,
+ 		.maxlen         = sizeof(unsigned int),
diff --git a/target/linux/generic/patches-3.3/620-sched_esfq.patch b/target/linux/generic/patches-3.3/620-sched_esfq.patch
new file mode 100644
index 0000000..1fdf09d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/620-sched_esfq.patch
@@ -0,0 +1,791 @@
+--- a/include/linux/pkt_sched.h
++++ b/include/linux/pkt_sched.h
+@@ -193,6 +193,33 @@ struct tc_sfq_xstats {
+ 	__s32		allot;
+ };
+ 
++/* ESFQ section */
++
++enum
++{
++        /* traditional */
++	TCA_SFQ_HASH_CLASSIC,
++	TCA_SFQ_HASH_DST,
++	TCA_SFQ_HASH_SRC,
++	TCA_SFQ_HASH_FWMARK,
++	/* conntrack */
++	TCA_SFQ_HASH_CTORIGDST,
++	TCA_SFQ_HASH_CTORIGSRC,
++	TCA_SFQ_HASH_CTREPLDST,
++	TCA_SFQ_HASH_CTREPLSRC,
++	TCA_SFQ_HASH_CTNATCHG,
++};
++
++struct tc_esfq_qopt
++{
++	unsigned	quantum;	/* Bytes per round allocated to flow */
++	int		perturb_period;	/* Period of hash perturbation */
++	__u32		limit;		/* Maximal packets in queue */
++	unsigned	divisor;	/* Hash divisor  */
++	unsigned	flows;		/* Maximal number of flows  */
++	unsigned	hash_kind;	/* Hash function to use for flow identification */
++};
++
+ /* RED section */
+ 
+ enum {
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -148,6 +148,37 @@ config NET_SCH_SFQ
+ 	  To compile this code as a module, choose M here: the
+ 	  module will be called sch_sfq.
+ 
++config NET_SCH_ESFQ
++	tristate "Enhanced Stochastic Fairness Queueing (ESFQ)"
++	---help---
++	  Say Y here if you want to use the Enhanced Stochastic Fairness
++	  Queueing (ESFQ) packet scheduling algorithm for some of your network
++	  devices or as a leaf discipline for a classful qdisc such as HTB or
++	  CBQ (see the top of <file:net/sched/sch_esfq.c> for details and
++	  references to the SFQ algorithm).
++
++	  This is an enchanced SFQ version which allows you to control some
++	  hardcoded values in the SFQ scheduler.
++
++	  ESFQ also adds control of the hash function used to identify packet
++	  flows. The original SFQ discipline hashes by connection; ESFQ add
++	  several other hashing methods, such as by src IP or by dst IP, which
++	  can be more fair to users in some networking situations.
++
++	  To compile this code as a module, choose M here: the
++	  module will be called sch_esfq.
++
++config NET_SCH_ESFQ_NFCT
++	bool "Connection Tracking Hash Types"
++	depends on NET_SCH_ESFQ && NF_CONNTRACK
++	---help---
++	  Say Y here to enable support for hashing based on netfilter connection
++	  tracking information. This is useful for a router that is also using
++	  NAT to connect privately-addressed hosts to the Internet. If you want
++	  to provide fair distribution of upstream bandwidth, ESFQ must use
++	  connection tracking information, since all outgoing packets will share
++	  the same source address.
++
+ config NET_SCH_TEQL
+ 	tristate "True Link Equalizer (TEQL)"
+ 	---help---
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -26,6 +26,7 @@ obj-$(CONFIG_NET_SCH_INGRESS)	+= sch_ing
+ obj-$(CONFIG_NET_SCH_DSMARK)	+= sch_dsmark.o
+ obj-$(CONFIG_NET_SCH_SFB)	+= sch_sfb.o
+ obj-$(CONFIG_NET_SCH_SFQ)	+= sch_sfq.o
++obj-$(CONFIG_NET_SCH_ESFQ)	+= sch_esfq.o
+ obj-$(CONFIG_NET_SCH_TBF)	+= sch_tbf.o
+ obj-$(CONFIG_NET_SCH_TEQL)	+= sch_teql.o
+ obj-$(CONFIG_NET_SCH_PRIO)	+= sch_prio.o
+--- /dev/null
++++ b/net/sched/sch_esfq.c
+@@ -0,0 +1,702 @@
++/*
++ * net/sched/sch_esfq.c	Extended Stochastic Fairness Queueing discipline.
++ *
++ *		This program is free software; you can redistribute it and/or
++ *		modify it under the terms of the GNU General Public License
++ *		as published by the Free Software Foundation; either version
++ *		2 of the License, or (at your option) any later version.
++ *
++ * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
++ *
++ * Changes:	Alexander Atanasov, <alex@ssi.bg>
++ *		Added dynamic depth,limit,divisor,hash_kind options.
++ *		Added dst and src hashes.
++ *
++ * 		Alexander Clouter, <alex@digriz.org.uk>
++ *		Ported ESFQ to Linux 2.6.
++ *
++ * 		Corey Hickey, <bugfood-c@fatooh.org>
++ *		Maintenance of the Linux 2.6 port.
++ *		Added fwmark hash (thanks to Robert Kurjata).
++ *		Added usage of jhash.
++ *		Added conntrack support.
++ *		Added ctnatchg hash (thanks to Ben Pfountz).
++ */
++
++#include <linux/module.h>
++#include <asm/uaccess.h>
++#include <asm/system.h>
++#include <linux/bitops.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/jiffies.h>
++#include <linux/string.h>
++#include <linux/mm.h>
++#include <linux/socket.h>
++#include <linux/sockios.h>
++#include <linux/in.h>
++#include <linux/errno.h>
++#include <linux/interrupt.h>
++#include <linux/if_ether.h>
++#include <linux/inet.h>
++#include <linux/netdevice.h>
++#include <linux/etherdevice.h>
++#include <linux/notifier.h>
++#include <linux/init.h>
++#include <net/ip.h>
++#include <net/netlink.h>
++#include <linux/ipv6.h>
++#include <net/route.h>
++#include <linux/skbuff.h>
++#include <net/sock.h>
++#include <net/pkt_sched.h>
++#include <linux/jhash.h>
++#ifdef CONFIG_NET_SCH_ESFQ_NFCT
++#include <net/netfilter/nf_conntrack.h>
++#endif
++
++/*	Stochastic Fairness Queuing algorithm.
++	For more comments look at sch_sfq.c.
++	The difference is that you can change limit, depth,
++	hash table size and choose alternate hash types.
++
++	classic:	same as in sch_sfq.c
++	dst:		destination IP address
++	src:		source IP address
++	fwmark:		netfilter mark value
++	ctorigdst:	original destination IP address
++	ctorigsrc:	original source IP address
++	ctrepldst:	reply destination IP address
++	ctreplsrc:	reply source IP
++
++*/
++
++#define ESFQ_HEAD 0
++#define ESFQ_TAIL 1
++
++/* This type should contain at least SFQ_DEPTH*2 values */
++typedef unsigned int esfq_index;
++
++struct esfq_head
++{
++	esfq_index	next;
++	esfq_index	prev;
++};
++
++struct esfq_sched_data
++{
++/* Parameters */
++	int		perturb_period;
++	unsigned	quantum;	/* Allotment per round: MUST BE >= MTU */
++	int		limit;
++	unsigned	depth;
++	unsigned	hash_divisor;
++	unsigned	hash_kind;
++/* Variables */
++	struct timer_list perturb_timer;
++	int		perturbation;
++	esfq_index	tail;		/* Index of current slot in round */
++	esfq_index	max_depth;	/* Maximal depth */
++
++	esfq_index	*ht;			/* Hash table */
++	esfq_index	*next;			/* Active slots link */
++	short		*allot;			/* Current allotment per slot */
++	unsigned short	*hash;			/* Hash value indexed by slots */
++	struct sk_buff_head	*qs;		/* Slot queue */
++	struct esfq_head	*dep;		/* Linked list of slots, indexed by depth */
++};
++
++/* This contains the info we will hash. */
++struct esfq_packet_info
++{
++	u32	proto;		/* protocol or port */
++	u32	src;		/* source from packet header */
++	u32	dst;		/* destination from packet header */
++	u32	ctorigsrc;	/* original source from conntrack */
++	u32	ctorigdst;	/* original destination from conntrack */
++	u32	ctreplsrc;	/* reply source from conntrack */
++	u32	ctrepldst;	/* reply destination from conntrack */
++	u32	mark;		/* netfilter mark (fwmark) */
++};
++
++static __inline__ unsigned esfq_jhash_1word(struct esfq_sched_data *q,u32 a)
++{
++	return jhash_1word(a, q->perturbation) & (q->hash_divisor-1);
++}
++
++static __inline__ unsigned esfq_jhash_2words(struct esfq_sched_data *q, u32 a, u32 b)
++{
++	return jhash_2words(a, b, q->perturbation) & (q->hash_divisor-1);
++}
++
++static __inline__ unsigned esfq_jhash_3words(struct esfq_sched_data *q, u32 a, u32 b, u32 c)
++{
++	return jhash_3words(a, b, c, q->perturbation) & (q->hash_divisor-1);
++}
++
++static unsigned esfq_hash(struct esfq_sched_data *q, struct sk_buff *skb)
++{
++	struct esfq_packet_info info;
++#ifdef CONFIG_NET_SCH_ESFQ_NFCT
++	enum ip_conntrack_info ctinfo;
++	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
++#endif
++
++	switch (skb->protocol) {
++	case __constant_htons(ETH_P_IP):
++	{
++		struct iphdr *iph = ip_hdr(skb);
++		info.dst = iph->daddr;
++		info.src = iph->saddr;
++		if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
++		    (iph->protocol == IPPROTO_TCP ||
++		     iph->protocol == IPPROTO_UDP ||
++		     iph->protocol == IPPROTO_SCTP ||
++		     iph->protocol == IPPROTO_DCCP ||
++		     iph->protocol == IPPROTO_ESP))
++			info.proto = *(((u32*)iph) + iph->ihl);
++		else
++			info.proto = iph->protocol;
++		break;
++	}
++	case __constant_htons(ETH_P_IPV6):
++	{
++		struct ipv6hdr *iph = ipv6_hdr(skb);
++		/* Hash ipv6 addresses into a u32. This isn't ideal,
++		 * but the code is simple. */
++		info.dst = jhash2(iph->daddr.s6_addr32, 4, q->perturbation);
++		info.src = jhash2(iph->saddr.s6_addr32, 4, q->perturbation);
++		if (iph->nexthdr == IPPROTO_TCP ||
++		    iph->nexthdr == IPPROTO_UDP ||
++		    iph->nexthdr == IPPROTO_SCTP ||
++		    iph->nexthdr == IPPROTO_DCCP ||
++		    iph->nexthdr == IPPROTO_ESP)
++			info.proto = *(u32*)&iph[1];
++		else
++			info.proto = iph->nexthdr;
++		break;
++	}
++	default:
++		info.dst   = (u32)(unsigned long)skb_dst(skb);
++		info.src   = (u32)(unsigned long)skb->sk;
++		info.proto = skb->protocol;
++	}
++
++	info.mark = skb->mark;
++
++#ifdef CONFIG_NET_SCH_ESFQ_NFCT
++	/* defaults if there is no conntrack info */
++	info.ctorigsrc = info.src;
++	info.ctorigdst = info.dst;
++	info.ctreplsrc = info.dst;
++	info.ctrepldst = info.src;
++	/* collect conntrack info */
++	if (ct && ct != &nf_conntrack_untracked) {
++		if (skb->protocol == __constant_htons(ETH_P_IP)) {
++			info.ctorigsrc = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip;
++			info.ctorigdst = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.ip;
++			info.ctreplsrc = ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip;
++			info.ctrepldst = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip;
++		}
++		else if (skb->protocol == __constant_htons(ETH_P_IPV6)) {
++			/* Again, hash ipv6 addresses into a single u32. */
++			info.ctorigsrc = jhash2(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip6, 4, q->perturbation);
++			info.ctorigdst = jhash2(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.ip6, 4, q->perturbation);
++			info.ctreplsrc = jhash2(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip6, 4, q->perturbation);
++			info.ctrepldst = jhash2(ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip6, 4, q->perturbation);
++		}
++
++	}
++#endif
++
++	switch(q->hash_kind) {
++	case TCA_SFQ_HASH_CLASSIC:
++		return esfq_jhash_3words(q, info.dst, info.src, info.proto);
++	case TCA_SFQ_HASH_DST:
++		return esfq_jhash_1word(q, info.dst);
++	case TCA_SFQ_HASH_SRC:
++		return esfq_jhash_1word(q, info.src);
++	case TCA_SFQ_HASH_FWMARK:
++		return esfq_jhash_1word(q, info.mark);
++#ifdef CONFIG_NET_SCH_ESFQ_NFCT
++	case TCA_SFQ_HASH_CTORIGDST:
++		return esfq_jhash_1word(q, info.ctorigdst);
++	case TCA_SFQ_HASH_CTORIGSRC:
++		return esfq_jhash_1word(q, info.ctorigsrc);
++	case TCA_SFQ_HASH_CTREPLDST:
++		return esfq_jhash_1word(q, info.ctrepldst);
++	case TCA_SFQ_HASH_CTREPLSRC:
++		return esfq_jhash_1word(q, info.ctreplsrc);
++	case TCA_SFQ_HASH_CTNATCHG:
++	{
++		if (info.ctorigdst == info.ctreplsrc)
++			return esfq_jhash_1word(q, info.ctorigsrc);
++		return esfq_jhash_1word(q, info.ctreplsrc);
++	}
++#endif
++	default:
++		if (net_ratelimit())
++			printk(KERN_WARNING "ESFQ: Unknown hash method. Falling back to classic.\n");
++	}
++	return esfq_jhash_3words(q, info.dst, info.src, info.proto);
++}
++
++static inline void esfq_link(struct esfq_sched_data *q, esfq_index x)
++{
++	esfq_index p, n;
++	int d = q->qs[x].qlen + q->depth;
++
++	p = d;
++	n = q->dep[d].next;
++	q->dep[x].next = n;
++	q->dep[x].prev = p;
++	q->dep[p].next = q->dep[n].prev = x;
++}
++
++static inline void esfq_dec(struct esfq_sched_data *q, esfq_index x)
++{
++	esfq_index p, n;
++
++	n = q->dep[x].next;
++	p = q->dep[x].prev;
++	q->dep[p].next = n;
++	q->dep[n].prev = p;
++
++	if (n == p && q->max_depth == q->qs[x].qlen + 1)
++		q->max_depth--;
++
++	esfq_link(q, x);
++}
++
++static inline void esfq_inc(struct esfq_sched_data *q, esfq_index x)
++{
++	esfq_index p, n;
++	int d;
++
++	n = q->dep[x].next;
++	p = q->dep[x].prev;
++	q->dep[p].next = n;
++	q->dep[n].prev = p;
++	d = q->qs[x].qlen;
++	if (q->max_depth < d)
++		q->max_depth = d;
++
++	esfq_link(q, x);
++}
++
++static unsigned int esfq_drop(struct Qdisc *sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	esfq_index d = q->max_depth;
++	struct sk_buff *skb;
++	unsigned int len;
++
++	/* Queue is full! Find the longest slot and
++	   drop a packet from it */
++
++	if (d > 1) {
++		esfq_index x = q->dep[d+q->depth].next;
++		skb = q->qs[x].prev;
++		len = skb->len;
++		__skb_unlink(skb, &q->qs[x]);
++		kfree_skb(skb);
++		esfq_dec(q, x);
++		sch->q.qlen--;
++		sch->qstats.drops++;
++		sch->qstats.backlog -= len;
++		return len;
++	}
++
++	if (d == 1) {
++		/* It is difficult to believe, but ALL THE SLOTS HAVE LENGTH 1. */
++		d = q->next[q->tail];
++		q->next[q->tail] = q->next[d];
++		q->allot[q->next[d]] += q->quantum;
++		skb = q->qs[d].prev;
++		len = skb->len;
++		__skb_unlink(skb, &q->qs[d]);
++		kfree_skb(skb);
++		esfq_dec(q, d);
++		sch->q.qlen--;
++		q->ht[q->hash[d]] = q->depth;
++		sch->qstats.drops++;
++		sch->qstats.backlog -= len;
++		return len;
++	}
++
++	return 0;
++}
++
++static void esfq_q_enqueue(struct sk_buff *skb, struct esfq_sched_data *q, unsigned int end)
++{
++	unsigned hash = esfq_hash(q, skb);
++	unsigned depth = q->depth;
++	esfq_index x;
++
++	x = q->ht[hash];
++	if (x == depth) {
++		q->ht[hash] = x = q->dep[depth].next;
++		q->hash[x] = hash;
++	}
++
++	if (end == ESFQ_TAIL)
++		__skb_queue_tail(&q->qs[x], skb);
++	else
++		__skb_queue_head(&q->qs[x], skb);
++
++	esfq_inc(q, x);
++	if (q->qs[x].qlen == 1) {		/* The flow is new */
++		if (q->tail == depth) {	/* It is the first flow */
++			q->tail = x;
++			q->next[x] = x;
++			q->allot[x] = q->quantum;
++		} else {
++			q->next[x] = q->next[q->tail];
++			q->next[q->tail] = x;
++			q->tail = x;
++		}
++	}
++}
++
++static int esfq_enqueue(struct sk_buff *skb, struct Qdisc* sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	esfq_q_enqueue(skb, q, ESFQ_TAIL);
++	sch->qstats.backlog += skb->len;
++	if (++sch->q.qlen < q->limit-1) {
++		sch->bstats.bytes += skb->len;
++		sch->bstats.packets++;
++		return 0;
++	}
++
++	sch->qstats.drops++;
++	esfq_drop(sch);
++	return NET_XMIT_CN;
++}
++
++static struct sk_buff *esfq_peek(struct Qdisc* sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	esfq_index a;
++
++	/* No active slots */
++	if (q->tail == q->depth)
++		return NULL;
++
++	a = q->next[q->tail];
++	return skb_peek(&q->qs[a]);
++}
++
++static struct sk_buff *esfq_q_dequeue(struct esfq_sched_data *q)
++{
++	struct sk_buff *skb;
++	unsigned depth = q->depth;
++	esfq_index a, old_a;
++
++	/* No active slots */
++	if (q->tail == depth)
++		return NULL;
++
++	a = old_a = q->next[q->tail];
++
++	/* Grab packet */
++	skb = __skb_dequeue(&q->qs[a]);
++	esfq_dec(q, a);
++
++	/* Is the slot empty? */
++	if (q->qs[a].qlen == 0) {
++		q->ht[q->hash[a]] = depth;
++		a = q->next[a];
++		if (a == old_a) {
++			q->tail = depth;
++			return skb;
++		}
++		q->next[q->tail] = a;
++		q->allot[a] += q->quantum;
++	} else if ((q->allot[a] -= skb->len) <= 0) {
++		q->tail = a;
++		a = q->next[a];
++		q->allot[a] += q->quantum;
++	}
++
++	return skb;
++}
++
++static struct sk_buff *esfq_dequeue(struct Qdisc* sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	struct sk_buff *skb;
++
++	skb = esfq_q_dequeue(q);
++	if (skb == NULL)
++		return NULL;
++	sch->q.qlen--;
++	sch->qstats.backlog -= skb->len;
++	return skb;
++}
++
++static void esfq_q_destroy(struct esfq_sched_data *q)
++{
++	del_timer(&q->perturb_timer);
++	if(q->ht)
++		kfree(q->ht);
++	if(q->dep)
++		kfree(q->dep);
++	if(q->next)
++		kfree(q->next);
++	if(q->allot)
++		kfree(q->allot);
++	if(q->hash)
++		kfree(q->hash);
++	if(q->qs)
++		kfree(q->qs);
++}
++
++static void esfq_destroy(struct Qdisc *sch)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	esfq_q_destroy(q);
++}
++
++
++static void esfq_reset(struct Qdisc* sch)
++{
++	struct sk_buff *skb;
++
++	while ((skb = esfq_dequeue(sch)) != NULL)
++		kfree_skb(skb);
++}
++
++static void esfq_perturbation(unsigned long arg)
++{
++	struct Qdisc *sch = (struct Qdisc*)arg;
++	struct esfq_sched_data *q = qdisc_priv(sch);
++
++	q->perturbation = net_random()&0x1F;
++
++	if (q->perturb_period) {
++		q->perturb_timer.expires = jiffies + q->perturb_period;
++		add_timer(&q->perturb_timer);
++	}
++}
++
++static unsigned int esfq_check_hash(unsigned int kind)
++{
++	switch (kind) {
++	case TCA_SFQ_HASH_CTORIGDST:
++	case TCA_SFQ_HASH_CTORIGSRC:
++	case TCA_SFQ_HASH_CTREPLDST:
++	case TCA_SFQ_HASH_CTREPLSRC:
++	case TCA_SFQ_HASH_CTNATCHG:
++#ifndef CONFIG_NET_SCH_ESFQ_NFCT
++	{
++		if (net_ratelimit())
++			printk(KERN_WARNING "ESFQ: Conntrack hash types disabled in kernel config. Falling back to classic.\n");
++		return TCA_SFQ_HASH_CLASSIC;
++	}
++#endif
++	case TCA_SFQ_HASH_CLASSIC:
++	case TCA_SFQ_HASH_DST:
++	case TCA_SFQ_HASH_SRC:
++	case TCA_SFQ_HASH_FWMARK:
++		return kind;
++	default:
++	{
++		if (net_ratelimit())
++			printk(KERN_WARNING "ESFQ: Unknown hash type. Falling back to classic.\n");
++		return TCA_SFQ_HASH_CLASSIC;
++	}
++	}
++}
++
++static int esfq_q_init(struct esfq_sched_data *q, struct nlattr *opt)
++{
++	struct tc_esfq_qopt *ctl = nla_data(opt);
++	esfq_index p = ~0U/2;
++	int i;
++
++	if (opt && opt->nla_len < nla_attr_size(sizeof(*ctl)))
++		return -EINVAL;
++
++	q->perturbation = 0;
++	q->hash_kind = TCA_SFQ_HASH_CLASSIC;
++	q->max_depth = 0;
++	if (opt == NULL) {
++		q->perturb_period = 0;
++		q->hash_divisor = 1024;
++		q->tail = q->limit = q->depth = 128;
++
++	} else {
++		struct tc_esfq_qopt *ctl = nla_data(opt);
++		if (ctl->quantum)
++			q->quantum = ctl->quantum;
++		q->perturb_period = ctl->perturb_period*HZ;
++		q->hash_divisor = ctl->divisor ? : 1024;
++		q->tail = q->limit = q->depth = ctl->flows ? : 128;
++
++		if ( q->depth > p - 1 )
++			return -EINVAL;
++
++		if (ctl->limit)
++			q->limit = min_t(u32, ctl->limit, q->depth);
++
++		if (ctl->hash_kind) {
++			q->hash_kind = esfq_check_hash(ctl->hash_kind);
++		}
++	}
++
++	q->ht = kmalloc(q->hash_divisor*sizeof(esfq_index), GFP_KERNEL);
++	if (!q->ht)
++		goto err_case;
++	q->dep = kmalloc((1+q->depth*2)*sizeof(struct esfq_head), GFP_KERNEL);
++	if (!q->dep)
++		goto err_case;
++	q->next = kmalloc(q->depth*sizeof(esfq_index), GFP_KERNEL);
++	if (!q->next)
++		goto err_case;
++	q->allot = kmalloc(q->depth*sizeof(short), GFP_KERNEL);
++	if (!q->allot)
++		goto err_case;
++	q->hash = kmalloc(q->depth*sizeof(unsigned short), GFP_KERNEL);
++	if (!q->hash)
++		goto err_case;
++	q->qs = kmalloc(q->depth*sizeof(struct sk_buff_head), GFP_KERNEL);
++	if (!q->qs)
++		goto err_case;
++
++	for (i=0; i< q->hash_divisor; i++)
++		q->ht[i] = q->depth;
++	for (i=0; i<q->depth; i++) {
++		skb_queue_head_init(&q->qs[i]);
++		q->dep[i+q->depth].next = i+q->depth;
++		q->dep[i+q->depth].prev = i+q->depth;
++	}
++
++	for (i=0; i<q->depth; i++)
++		esfq_link(q, i);
++	return 0;
++err_case:
++	esfq_q_destroy(q);
++	return -ENOBUFS;
++}
++
++static int esfq_init(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	int err;
++
++	q->quantum = psched_mtu(qdisc_dev(sch)); /* default */
++	if ((err = esfq_q_init(q, opt)))
++		return err;
++
++	init_timer(&q->perturb_timer);
++	q->perturb_timer.data = (unsigned long)sch;
++	q->perturb_timer.function = esfq_perturbation;
++	if (q->perturb_period) {
++		q->perturb_timer.expires = jiffies + q->perturb_period;
++		add_timer(&q->perturb_timer);
++	}
++
++	return 0;
++}
++
++static int esfq_change(struct Qdisc *sch, struct nlattr *opt)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	struct esfq_sched_data new;
++	struct sk_buff *skb;
++	int err;
++
++	/* set up new queue */
++	memset(&new, 0, sizeof(struct esfq_sched_data));
++	new.quantum = psched_mtu(qdisc_dev(sch)); /* default */
++	if ((err = esfq_q_init(&new, opt)))
++		return err;
++
++	/* copy all packets from the old queue to the new queue */
++	sch_tree_lock(sch);
++	while ((skb = esfq_q_dequeue(q)) != NULL)
++		esfq_q_enqueue(skb, &new, ESFQ_TAIL);
++
++	/* clean up the old queue */
++	esfq_q_destroy(q);
++
++	/* copy elements of the new queue into the old queue */
++	q->perturb_period = new.perturb_period;
++	q->quantum        = new.quantum;
++	q->limit          = new.limit;
++	q->depth          = new.depth;
++	q->hash_divisor   = new.hash_divisor;
++	q->hash_kind      = new.hash_kind;
++	q->tail           = new.tail;
++	q->max_depth      = new.max_depth;
++	q->ht    = new.ht;
++	q->dep   = new.dep;
++	q->next  = new.next;
++	q->allot = new.allot;
++	q->hash  = new.hash;
++	q->qs    = new.qs;
++
++	/* finish up */
++	if (q->perturb_period) {
++		q->perturb_timer.expires = jiffies + q->perturb_period;
++		add_timer(&q->perturb_timer);
++	} else {
++		q->perturbation = 0;
++	}
++	sch_tree_unlock(sch);
++	return 0;
++}
++
++static int esfq_dump(struct Qdisc *sch, struct sk_buff *skb)
++{
++	struct esfq_sched_data *q = qdisc_priv(sch);
++	unsigned char *b = skb_tail_pointer(skb);
++	struct tc_esfq_qopt opt;
++
++	opt.quantum = q->quantum;
++	opt.perturb_period = q->perturb_period/HZ;
++
++	opt.limit = q->limit;
++	opt.divisor = q->hash_divisor;
++	opt.flows = q->depth;
++	opt.hash_kind = q->hash_kind;
++
++	NLA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
++
++	return skb->len;
++
++nla_put_failure:
++	nlmsg_trim(skb, b);
++	return -1;
++}
++
++static struct Qdisc_ops esfq_qdisc_ops =
++{
++	.next		=	NULL,
++	.cl_ops		=	NULL,
++	.id		=	"esfq",
++	.priv_size	=	sizeof(struct esfq_sched_data),
++	.enqueue	=	esfq_enqueue,
++	.dequeue	=	esfq_dequeue,
++	.peek		=	esfq_peek,
++	.drop		=	esfq_drop,
++	.init		=	esfq_init,
++	.reset		=	esfq_reset,
++	.destroy	=	esfq_destroy,
++	.change		=	esfq_change,
++	.dump		=	esfq_dump,
++	.owner		=	THIS_MODULE,
++};
++
++static int __init esfq_module_init(void)
++{
++	return register_qdisc(&esfq_qdisc_ops);
++}
++static void __exit esfq_module_exit(void)
++{
++	unregister_qdisc(&esfq_qdisc_ops);
++}
++module_init(esfq_module_init)
++module_exit(esfq_module_exit)
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/patches-3.3/621-sched_act_connmark.patch b/target/linux/generic/patches-3.3/621-sched_act_connmark.patch
new file mode 100644
index 0000000..b6adce1
--- /dev/null
+++ b/target/linux/generic/patches-3.3/621-sched_act_connmark.patch
@@ -0,0 +1,172 @@
+--- /dev/null
++++ b/net/sched/act_connmark.c
+@@ -0,0 +1,137 @@
++/*
++ * Copyright (c) 2011 Felix Fietkau <nbd@openwrt.org>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
++ * Place - Suite 330, Boston, MA 02111-1307 USA.
++ */
++
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/skbuff.h>
++#include <linux/rtnetlink.h>
++#include <linux/pkt_cls.h>
++#include <linux/ip.h>
++#include <linux/ipv6.h>
++#include <net/netlink.h>
++#include <net/pkt_sched.h>
++#include <net/act_api.h>
++
++#include <net/netfilter/nf_conntrack.h>
++#include <net/netfilter/nf_conntrack_core.h>
++
++#define TCA_ACT_CONNMARK	20
++
++#define CONNMARK_TAB_MASK     3
++static struct tcf_common *tcf_connmark_ht[CONNMARK_TAB_MASK + 1];
++static u32 connmark_idx_gen;
++static DEFINE_RWLOCK(connmark_lock);
++
++static struct tcf_hashinfo connmark_hash_info = {
++	.htab	=	tcf_connmark_ht,
++	.hmask	=	CONNMARK_TAB_MASK,
++	.lock	=	&connmark_lock,
++};
++
++static int tcf_connmark(struct sk_buff *skb, const struct tc_action *a,
++		       struct tcf_result *res)
++{
++	struct nf_conn *c;
++	enum ip_conntrack_info ctinfo;
++	int proto;
++	int r;
++
++	if (skb->protocol == htons(ETH_P_IP)) {
++		if (skb->len < sizeof(struct iphdr))
++			goto out;
++		proto = PF_INET;
++	} else if (skb->protocol == htons(ETH_P_IPV6)) {
++		if (skb->len < sizeof(struct ipv6hdr))
++			goto out;
++		proto = PF_INET6;
++	} else
++		goto out;
++
++	r = nf_conntrack_in(dev_net(skb->dev), proto, NF_INET_PRE_ROUTING, skb);
++	if (r != NF_ACCEPT)
++		goto out;
++
++	c = nf_ct_get(skb, &ctinfo);
++	if (!c)
++		goto out;
++
++	skb->mark = c->mark;
++	nf_conntrack_put(skb->nfct);
++	skb->nfct = NULL;
++
++out:
++	return TC_ACT_PIPE;
++}
++
++static int tcf_connmark_init(struct nlattr *nla, struct nlattr *est,
++			 struct tc_action *a, int ovr, int bind)
++{
++	struct tcf_common *pc;
++
++	pc = tcf_hash_create(0, est, a, sizeof(*pc), bind,
++			     &connmark_idx_gen, &connmark_hash_info);
++	if (IS_ERR(pc))
++	    return PTR_ERR(pc);
++
++	tcf_hash_insert(pc, &connmark_hash_info);
++
++	return ACT_P_CREATED;
++}
++
++static inline int tcf_connmark_cleanup(struct tc_action *a, int bind)
++{
++	if (a->priv)
++		return tcf_hash_release(a->priv, bind, &connmark_hash_info);
++	return 0;
++}
++
++static inline int tcf_connmark_dump(struct sk_buff *skb, struct tc_action *a,
++				int bind, int ref)
++{
++	return skb->len;
++}
++
++static struct tc_action_ops act_connmark_ops = {
++	.kind		=	"connmark",
++	.hinfo		=	&connmark_hash_info,
++	.type		=	TCA_ACT_CONNMARK,
++	.capab		=	TCA_CAP_NONE,
++	.owner		=	THIS_MODULE,
++	.act		=	tcf_connmark,
++	.dump		=	tcf_connmark_dump,
++	.cleanup	=	tcf_connmark_cleanup,
++	.init		=	tcf_connmark_init,
++	.walk		=	tcf_generic_walker,
++};
++
++MODULE_AUTHOR("Felix Fietkau <nbd@openwrt.org>");
++MODULE_DESCRIPTION("Connection tracking mark restoring");
++MODULE_LICENSE("GPL");
++
++static int __init connmark_init_module(void)
++{
++	return tcf_register_action(&act_connmark_ops);
++}
++
++static void __exit connmark_cleanup_module(void)
++{
++	tcf_unregister_action(&act_connmark_ops);
++}
++
++module_init(connmark_init_module);
++module_exit(connmark_cleanup_module);
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -624,6 +624,19 @@ config NET_ACT_CSUM
+ 	  To compile this code as a module, choose M here: the
+ 	  module will be called act_csum.
+ 
++config NET_ACT_CONNMARK
++        tristate "Connection Tracking Marking"
++        depends on NET_CLS_ACT
++        depends on NF_CONNTRACK
++	 depends on NF_CONNTRACK_MARK
++        ---help---
++	  Say Y here to restore the connmark from a scheduler action
++
++	  If unsure, say N.
++
++	  To compile this code as a module, choose M here: the
++	  module will be called act_connmark.
++
+ config NET_CLS_IND
+ 	bool "Incoming device classification"
+ 	depends on NET_CLS_U32 || NET_CLS_FW
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -16,6 +16,7 @@ obj-$(CONFIG_NET_ACT_PEDIT)	+= act_pedit
+ obj-$(CONFIG_NET_ACT_SIMP)	+= act_simple.o
+ obj-$(CONFIG_NET_ACT_SKBEDIT)	+= act_skbedit.o
+ obj-$(CONFIG_NET_ACT_CSUM)	+= act_csum.o
++obj-$(CONFIG_NET_ACT_CONNMARK)	+= act_connmark.o
+ obj-$(CONFIG_NET_SCH_FIFO)	+= sch_fifo.o
+ obj-$(CONFIG_NET_SCH_CBQ)	+= sch_cbq.o
+ obj-$(CONFIG_NET_SCH_HTB)	+= sch_htb.o
diff --git a/target/linux/generic/patches-3.3/630-packet_socket_type.patch b/target/linux/generic/patches-3.3/630-packet_socket_type.patch
new file mode 100644
index 0000000..231b745
--- /dev/null
+++ b/target/linux/generic/patches-3.3/630-packet_socket_type.patch
@@ -0,0 +1,132 @@
+This patch allows the user to specify desired packet types (outgoing,
+broadcast, unicast, etc.) on packet sockets via setsockopt.
+This can reduce the load in situations where only a limited number
+of packet types are necessary
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+
+--- a/include/linux/if_packet.h
++++ b/include/linux/if_packet.h
+@@ -29,6 +29,8 @@ struct sockaddr_ll {
+ /* These ones are invisible by user level */
+ #define PACKET_LOOPBACK		5		/* MC/BRD frame looped back */
+ #define PACKET_FASTROUTE	6		/* Fastrouted frame	*/
++#define PACKET_MASK_ANY		0xffffffff	/* mask for packet type bits */
++
+ 
+ /* Packet socket options */
+ 
+@@ -50,6 +52,7 @@ struct sockaddr_ll {
+ #define PACKET_TX_TIMESTAMP		16
+ #define PACKET_TIMESTAMP		17
+ #define PACKET_FANOUT			18
++#define PACKET_RECV_TYPE		19
+ 
+ #define PACKET_FANOUT_HASH		0
+ #define PACKET_FANOUT_LB		1
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -296,6 +296,7 @@ struct packet_sock {
+ 	unsigned int		tp_loss:1;
+ 	unsigned int		tp_tstamp;
+ 	struct packet_type	prot_hook ____cacheline_aligned_in_smp;
++	unsigned int		pkt_type;
+ };
+ 
+ #define PACKET_FANOUT_MAX	256
+@@ -1383,6 +1384,7 @@ static int packet_rcv_spkt(struct sk_buf
+ {
+ 	struct sock *sk;
+ 	struct sockaddr_pkt *spkt;
++	struct packet_sock *po;
+ 
+ 	/*
+ 	 *	When we registered the protocol we saved the socket in the data
+@@ -1390,6 +1392,7 @@ static int packet_rcv_spkt(struct sk_buf
+ 	 */
+ 
+ 	sk = pt->af_packet_priv;
++	po = pkt_sk(sk);
+ 
+ 	/*
+ 	 *	Yank back the headers [hope the device set this
+@@ -1402,7 +1405,7 @@ static int packet_rcv_spkt(struct sk_buf
+ 	 *	so that this procedure is noop.
+ 	 */
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
+ 		goto out;
+ 
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+@@ -1596,12 +1599,12 @@ static int packet_rcv(struct sk_buff *sk
+ 	int skb_len = skb->len;
+ 	unsigned int snaplen, res;
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
+-		goto drop;
+-
+ 	sk = pt->af_packet_priv;
+ 	po = pkt_sk(sk);
+ 
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
++		goto drop;
++
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+ 		goto drop;
+ 
+@@ -1720,12 +1723,12 @@ static int tpacket_rcv(struct sk_buff *s
+ 	struct timespec ts;
+ 	struct skb_shared_hwtstamps *shhwtstamps = skb_hwtstamps(skb);
+ 
+-	if (skb->pkt_type == PACKET_LOOPBACK)
+-		goto drop;
+-
+ 	sk = pt->af_packet_priv;
+ 	po = pkt_sk(sk);
+ 
++	if (!(po->pkt_type & (1 << skb->pkt_type)))
++		goto drop;
++
+ 	if (!net_eq(dev_net(dev), sock_net(sk)))
+ 		goto drop;
+ 
+@@ -2595,6 +2598,7 @@ static int packet_create(struct net *net
+ 	spin_lock_init(&po->bind_lock);
+ 	mutex_init(&po->pg_vec_lock);
+ 	po->prot_hook.func = packet_rcv;
++	po->pkt_type = PACKET_MASK_ANY & ~(1 << PACKET_LOOPBACK);
+ 
+ 	if (sock->type == SOCK_PACKET)
+ 		po->prot_hook.func = packet_rcv_spkt;
+@@ -3192,6 +3196,16 @@ packet_setsockopt(struct socket *sock, i
+ 
+ 		return fanout_add(sk, val & 0xffff, val >> 16);
+ 	}
++        case PACKET_RECV_TYPE:
++        {
++                unsigned int val;
++                if (optlen != sizeof(val))
++                        return -EINVAL;
++                if (copy_from_user(&val, optval, sizeof(val)))
++                        return -EFAULT;
++                po->pkt_type = val & ~PACKET_LOOPBACK;
++                return 0;
++        }
+ 	default:
+ 		return -ENOPROTOOPT;
+ 	}
+@@ -3262,6 +3276,13 @@ static int packet_getsockopt(struct sock
+ 
+ 		data = &val;
+ 		break;
++	case PACKET_RECV_TYPE:
++		if (len > sizeof(unsigned int))
++			len = sizeof(unsigned int);
++		val = po->pkt_type;
++
++		data = &val;
++		break;
+ 	case PACKET_VERSION:
+ 		if (len > sizeof(int))
+ 			len = sizeof(int);
diff --git a/target/linux/generic/patches-3.3/640-bridge_no_eap_forward.patch b/target/linux/generic/patches-3.3/640-bridge_no_eap_forward.patch
new file mode 100644
index 0000000..bbdb3bf
--- /dev/null
+++ b/target/linux/generic/patches-3.3/640-bridge_no_eap_forward.patch
@@ -0,0 +1,15 @@
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -78,7 +78,11 @@ int br_handle_frame_finish(struct sk_buf
+ 
+ 	dst = NULL;
+ 
+-	if (is_broadcast_ether_addr(dest))
++	if (skb->protocol == htons(ETH_P_PAE)) {
++		skb2 = skb;
++		/* Do not forward 802.1x/EAP frames */
++		skb = NULL;
++	} else if (is_broadcast_ether_addr(dest))
+ 		skb2 = skb;
+ 	else if (is_multicast_ether_addr(dest)) {
+ 		mdst = br_mdb_get(br, skb);
diff --git a/target/linux/generic/patches-3.3/641-bridge_always_accept_eap.patch b/target/linux/generic/patches-3.3/641-bridge_always_accept_eap.patch
new file mode 100644
index 0000000..e04199b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/641-bridge_always_accept_eap.patch
@@ -0,0 +1,11 @@
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -65,7 +65,7 @@ int br_handle_frame_finish(struct sk_buf
+ 	    br_multicast_rcv(br, p, skb))
+ 		goto drop;
+ 
+-	if (p->state == BR_STATE_LEARNING)
++	if ((p->state == BR_STATE_LEARNING) && skb->protocol != htons(ETH_P_PAE))
+ 		goto drop;
+ 
+ 	BR_INPUT_SKB_CB(skb)->brdev = br->dev;
diff --git a/target/linux/generic/patches-3.3/642-bridge_port_isolate.patch b/target/linux/generic/patches-3.3/642-bridge_port_isolate.patch
new file mode 100644
index 0000000..68434bf
--- /dev/null
+++ b/target/linux/generic/patches-3.3/642-bridge_port_isolate.patch
@@ -0,0 +1,103 @@
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -135,6 +135,7 @@ struct net_bridge_port
+ 
+ 	unsigned long 			flags;
+ #define BR_HAIRPIN_MODE		0x00000001
++#define BR_ISOLATE_MODE		0x00000002
+ 
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+ 	u32				multicast_startup_queries_sent;
+--- a/net/bridge/br_sysfs_if.c
++++ b/net/bridge/br_sysfs_if.c
+@@ -149,6 +149,22 @@ static int store_hairpin_mode(struct net
+ static BRPORT_ATTR(hairpin_mode, S_IRUGO | S_IWUSR,
+ 		   show_hairpin_mode, store_hairpin_mode);
+ 
++static ssize_t show_isolate_mode(struct net_bridge_port *p, char *buf)
++{
++	int isolate_mode = (p->flags & BR_ISOLATE_MODE) ? 1 : 0;
++	return sprintf(buf, "%d\n", isolate_mode);
++}
++static ssize_t store_isolate_mode(struct net_bridge_port *p, unsigned long v)
++{
++	if (v)
++		p->flags |= BR_ISOLATE_MODE;
++	else
++		p->flags &= ~BR_ISOLATE_MODE;
++	return 0;
++}
++static BRPORT_ATTR(isolate_mode, S_IRUGO | S_IWUSR,
++		   show_isolate_mode, store_isolate_mode);
++
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+ static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
+ {
+@@ -181,6 +197,7 @@ static struct brport_attribute *brport_a
+ 	&brport_attr_hold_timer,
+ 	&brport_attr_flush,
+ 	&brport_attr_hairpin_mode,
++	&brport_attr_isolate_mode,
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+ 	&brport_attr_multicast_router,
+ #endif
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -98,7 +98,8 @@ int br_handle_frame_finish(struct sk_buf
+ 			skb2 = skb;
+ 
+ 		br->dev->stats.multicast++;
+-	} else if ((dst = __br_fdb_get(br, dest)) && dst->is_local) {
++	} else if ((p->flags & BR_ISOLATE_MODE) ||
++		   ((dst = __br_fdb_get(br, dest)) && dst->is_local)) {
+ 		skb2 = skb;
+ 		/* Do not forward the packet since it's local. */
+ 		skb = NULL;
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -109,7 +109,7 @@ void br_deliver(const struct net_bridge_
+ /* called with rcu_read_lock */
+ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, struct sk_buff *skb0)
+ {
+-	if (should_deliver(to, skb)) {
++	if (should_deliver(to, skb) && !(to->flags & BR_ISOLATE_MODE)) {
+ 		if (skb0)
+ 			deliver_clone(to, skb, __br_forward);
+ 		else
+@@ -164,7 +164,8 @@ out:
+ static void br_flood(struct net_bridge *br, struct sk_buff *skb,
+ 		     struct sk_buff *skb0,
+ 		     void (*__packet_hook)(const struct net_bridge_port *p,
+-					   struct sk_buff *skb))
++					   struct sk_buff *skb),
++		     bool forward)
+ {
+ 	struct net_bridge_port *p;
+ 	struct net_bridge_port *prev;
+@@ -172,6 +173,9 @@ static void br_flood(struct net_bridge *
+ 	prev = NULL;
+ 
+ 	list_for_each_entry_rcu(p, &br->port_list, list) {
++		if (forward && (p->flags & BR_ISOLATE_MODE))
++			continue;
++
+ 		prev = maybe_deliver(prev, p, skb, __packet_hook);
+ 		if (IS_ERR(prev))
+ 			goto out;
+@@ -195,14 +199,14 @@ out:
+ /* called with rcu_read_lock */
+ void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb)
+ {
+-	br_flood(br, skb, NULL, __br_deliver);
++	br_flood(br, skb, NULL, __br_deliver, false);
+ }
+ 
+ /* called under bridge lock */
+ void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
+ 		      struct sk_buff *skb2)
+ {
+-	br_flood(br, skb, skb2, __br_forward);
++	br_flood(br, skb, skb2, __br_forward, true);
+ }
+ 
+ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
diff --git a/target/linux/generic/patches-3.3/643-bridge_remove_ipv6_dependency.patch b/target/linux/generic/patches-3.3/643-bridge_remove_ipv6_dependency.patch
new file mode 100644
index 0000000..301b6be
--- /dev/null
+++ b/target/linux/generic/patches-3.3/643-bridge_remove_ipv6_dependency.patch
@@ -0,0 +1,107 @@
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -91,6 +91,12 @@ extern void			addrconf_join_solict(struc
+ extern void			addrconf_leave_solict(struct inet6_dev *idev,
+ 					const struct in6_addr *addr);
+ 
++extern int			(*ipv6_dev_get_saddr_hook)(struct net *net,
++						struct net_device *dev,
++						const struct in6_addr *daddr,
++						unsigned int srcprefs,
++						struct in6_addr *saddr);
++
+ static inline unsigned long addrconf_timeout_fixup(u32 timeout,
+ 						    unsigned unit)
+ {
+--- a/net/bridge/Kconfig
++++ b/net/bridge/Kconfig
+@@ -6,7 +6,6 @@ config BRIDGE
+ 	tristate "802.1d Ethernet Bridging"
+ 	select LLC
+ 	select STP
+-	depends on IPV6 || IPV6=n
+ 	---help---
+ 	  If you say Y here, then your Linux box will be able to act as an
+ 	  Ethernet bridge, which means that the different Ethernet segments it
+--- a/net/ipv6/Makefile
++++ b/net/ipv6/Makefile
+@@ -40,3 +40,4 @@ obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.
+ obj-y += addrconf_core.o exthdrs_core.o
+ 
+ obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_hashtables.o
++obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_stubs.o
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1103,7 +1103,7 @@ out:
+ 	return ret;
+ }
+ 
+-int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
++static int __ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
+ 		       const struct in6_addr *daddr, unsigned int prefs,
+ 		       struct in6_addr *saddr)
+ {
+@@ -1228,7 +1228,6 @@ try_nextdev:
+ 	in6_ifa_put(hiscore->ifa);
+ 	return 0;
+ }
+-EXPORT_SYMBOL(ipv6_dev_get_saddr);
+ 
+ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
+ 		    unsigned char banned_flags)
+@@ -4840,6 +4839,9 @@ int __init addrconf_init(void)
+ 
+ 	ipv6_addr_label_rtnl_register();
+ 
++	BUG_ON(ipv6_dev_get_saddr_hook != NULL);
++	rcu_assign_pointer(ipv6_dev_get_saddr_hook, __ipv6_dev_get_saddr);
++
+ 	return 0;
+ errout:
+ 	rtnl_af_unregister(&inet6_ops);
+@@ -4858,6 +4860,9 @@ void addrconf_cleanup(void)
+ 	struct net_device *dev;
+ 	int i;
+ 
++	rcu_assign_pointer(ipv6_dev_get_saddr_hook, NULL);
++	synchronize_rcu();
++
+ 	unregister_netdevice_notifier(&ipv6_dev_notf);
+ 	unregister_pernet_subsys(&addrconf_ops);
+ 	ipv6_addr_label_cleanup();
+--- /dev/null
++++ b/net/ipv6/inet6_stubs.c
+@@ -0,0 +1,33 @@
++/*
++ *      This program is free software; you can redistribute it and/or
++ *      modify it under the terms of the GNU General Public License
++ *      as published by the Free Software Foundation; either version
++ *      2 of the License, or (at your option) any later version.
++ */
++#include <linux/export.h>
++#include <net/ipv6.h>
++
++int (*ipv6_dev_get_saddr_hook)(struct net *net, struct net_device *dev,
++			const struct in6_addr *daddr, unsigned int srcprefs,
++			struct in6_addr *saddr);
++
++EXPORT_SYMBOL(ipv6_dev_get_saddr_hook);
++
++int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
++			const struct in6_addr *daddr, unsigned int prefs,
++			struct in6_addr *saddr)
++{
++	int ret = -EADDRNOTAVAIL;
++	typeof(ipv6_dev_get_saddr_hook) dev_get_saddr;
++
++	rcu_read_lock();
++	dev_get_saddr = rcu_dereference(ipv6_dev_get_saddr_hook);
++
++	if (dev_get_saddr)
++		ret = dev_get_saddr(net, dst_dev, daddr, prefs, saddr);
++
++	rcu_read_unlock();
++	return ret;
++}
++EXPORT_SYMBOL(ipv6_dev_get_saddr);
++
diff --git a/target/linux/generic/patches-3.3/644-bridge_optimize_netfilter_hooks.patch b/target/linux/generic/patches-3.3/644-bridge_optimize_netfilter_hooks.patch
new file mode 100644
index 0000000..dafe420
--- /dev/null
+++ b/target/linux/generic/patches-3.3/644-bridge_optimize_netfilter_hooks.patch
@@ -0,0 +1,146 @@
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -55,7 +55,7 @@ int br_dev_queue_push_xmit(struct sk_buf
+ 
+ int br_forward_finish(struct sk_buff *skb)
+ {
+-	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
++	return BR_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
+ 		       br_dev_queue_push_xmit);
+ 
+ }
+@@ -74,7 +74,7 @@ static void __br_deliver(const struct ne
+ 		return;
+ 	}
+ 
+-	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
++	BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+ 		br_forward_finish);
+ }
+ 
+@@ -91,7 +91,7 @@ static void __br_forward(const struct ne
+ 	skb->dev = to->dev;
+ 	skb_forward_csum(skb);
+ 
+-	NF_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
++	BR_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
+ 		br_forward_finish);
+ }
+ 
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -40,7 +40,7 @@ static int br_pass_frame_up(struct sk_bu
+ 	indev = skb->dev;
+ 	skb->dev = brdev;
+ 
+-	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, indev, NULL,
++	return BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, indev, NULL,
+ 		       netif_receive_skb);
+ }
+ 
+@@ -199,7 +199,7 @@ rx_handler_result_t br_handle_frame(stru
+ 		}
+ 
+ 		/* Deliver packet to local host only */
+-		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
++		if (BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
+ 			    NULL, br_handle_local_finish)) {
+ 			return RX_HANDLER_CONSUMED; /* consumed by filter */
+ 		} else {
+@@ -224,7 +224,7 @@ forward:
+ 		if (!compare_ether_addr(p->br->dev->dev_addr, dest))
+ 			skb->pkt_type = PACKET_HOST;
+ 
+-		NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
++		BR_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
+ 			br_handle_frame_finish);
+ 		break;
+ 	default:
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -753,7 +753,7 @@ static void __br_multicast_send_query(st
+ 	if (port) {
+ 		__skb_push(skb, sizeof(struct ethhdr));
+ 		skb->dev = port->dev;
+-		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
++		BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+ 			dev_queue_xmit);
+ 	} else
+ 		netif_rx(skb);
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -71,6 +71,15 @@ static int brnf_filter_pppoe_tagged __re
+ #define IS_ARP(skb) \
+ 	(!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
+ 
++int brnf_call_ebtables __read_mostly = 0;
++EXPORT_SYMBOL_GPL(brnf_call_ebtables);
++
++bool br_netfilter_run_hooks(void)
++{
++	return brnf_call_iptables | brnf_call_ip6tables | brnf_call_arptables |
++	       brnf_call_ebtables;
++}
++
+ static inline __be16 vlan_proto(const struct sk_buff *skb)
+ {
+ 	if (vlan_tx_tag_present(skb))
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -486,15 +486,29 @@ static inline bool br_multicast_is_route
+ 
+ /* br_netfilter.c */
+ #ifdef CONFIG_BRIDGE_NETFILTER
++extern int brnf_call_ebtables;
+ extern int br_netfilter_init(void);
+ extern void br_netfilter_fini(void);
+ extern void br_netfilter_rtable_init(struct net_bridge *);
++extern bool br_netfilter_run_hooks(void);
+ #else
+ #define br_netfilter_init()	(0)
+ #define br_netfilter_fini()	do { } while(0)
+ #define br_netfilter_rtable_init(x)
++#define br_netfilter_run_hooks()	false
+ #endif
+ 
++static inline int
++BR_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb,
++	struct net_device *in, struct net_device *out,
++	int (*okfn)(struct sk_buff *))
++{
++	if (!br_netfilter_run_hooks())
++		return okfn(skb);
++
++	return NF_HOOK(pf, hook, skb, in, out, okfn);
++}
++
+ /* br_stp.c */
+ extern void br_log_state(const struct net_bridge_port *p);
+ extern struct net_bridge_port *br_get_port(struct net_bridge *br,
+--- a/net/bridge/br_stp_bpdu.c
++++ b/net/bridge/br_stp_bpdu.c
+@@ -52,7 +52,7 @@ static void br_send_bpdu(struct net_brid
+ 
+ 	skb_reset_mac_header(skb);
+ 
+-	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
++	BR_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+ 		dev_queue_xmit);
+ }
+ 
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2403,11 +2403,13 @@ static int __init ebtables_init(void)
+ 	}
+ 
+ 	printk(KERN_INFO "Ebtables v2.0 registered\n");
++	brnf_call_ebtables = 1;
+ 	return 0;
+ }
+ 
+ static void __exit ebtables_fini(void)
+ {
++	brnf_call_ebtables = 0;
+ 	nf_unregister_sockopt(&ebt_sockopts);
+ 	xt_unregister_target(&ebt_standard_target);
+ 	printk(KERN_INFO "Ebtables v2.0 unregistered\n");
diff --git a/target/linux/generic/patches-3.3/650-pppoe_header_pad.patch b/target/linux/generic/patches-3.3/650-pppoe_header_pad.patch
new file mode 100644
index 0000000..5862dc1
--- /dev/null
+++ b/target/linux/generic/patches-3.3/650-pppoe_header_pad.patch
@@ -0,0 +1,20 @@
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -856,7 +856,7 @@ static int pppoe_sendmsg(struct kiocb *i
+ 		goto end;
+ 
+ 
+-	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32,
++	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32 + NET_SKB_PAD,
+ 			   0, GFP_KERNEL);
+ 	if (!skb) {
+ 		error = -ENOMEM;
+@@ -864,7 +864,7 @@ static int pppoe_sendmsg(struct kiocb *i
+ 	}
+ 
+ 	/* Reserve space for headers. */
+-	skb_reserve(skb, dev->hard_header_len);
++	skb_reserve(skb, dev->hard_header_len + NET_SKB_PAD);
+ 	skb_reset_network_header(skb);
+ 
+ 	skb->dev = dev;
diff --git a/target/linux/generic/patches-3.3/651-wireless_mesh_header.patch b/target/linux/generic/patches-3.3/651-wireless_mesh_header.patch
new file mode 100644
index 0000000..5c83d19
--- /dev/null
+++ b/target/linux/generic/patches-3.3/651-wireless_mesh_header.patch
@@ -0,0 +1,11 @@
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -145,7 +145,7 @@ static inline bool dev_xmit_complete(int
+  */
+ 
+ #if defined(CONFIG_WLAN) || IS_ENABLED(CONFIG_AX25)
+-# if defined(CONFIG_MAC80211_MESH)
++# if 1 || defined(CONFIG_MAC80211_MESH)
+ #  define LL_MAX_HEADER 128
+ # else
+ #  define LL_MAX_HEADER 96
diff --git a/target/linux/generic/patches-3.3/652-atm_header_changes.patch b/target/linux/generic/patches-3.3/652-atm_header_changes.patch
new file mode 100644
index 0000000..238d6f8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/652-atm_header_changes.patch
@@ -0,0 +1,12 @@
+--- a/include/linux/atm.h
++++ b/include/linux/atm.h
+@@ -139,6 +139,9 @@ struct atm_trafprm {
+ 	int		min_pcr;	/* minimum PCR in cells per second */
+ 	int		max_cdv;	/* maximum CDV in microseconds */
+ 	int		max_sdu;	/* maximum SDU in bytes */
++	int		scr;		/* sustained rate in cells per second */
++	int		mbs;		/* maximum burst size (MBS) in cells */
++	int		cdv;		/* Cell delay varition */
+         /* extra params for ABR */
+         unsigned int 	icr;         	/* Initial Cell Rate (24-bit) */
+         unsigned int	tbe;		/* Transient Buffer Exposure (24-bit) */ 
diff --git a/target/linux/generic/patches-3.3/653-disable_netlink_trim.patch b/target/linux/generic/patches-3.3/653-disable_netlink_trim.patch
new file mode 100644
index 0000000..ffa6502
--- /dev/null
+++ b/target/linux/generic/patches-3.3/653-disable_netlink_trim.patch
@@ -0,0 +1,28 @@
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -854,25 +854,7 @@ void netlink_detachskb(struct sock *sk,
+ 
+ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
+ {
+-	int delta;
+-
+ 	skb_orphan(skb);
+-
+-	delta = skb->end - skb->tail;
+-	if (delta * 2 < skb->truesize)
+-		return skb;
+-
+-	if (skb_shared(skb)) {
+-		struct sk_buff *nskb = skb_clone(skb, allocation);
+-		if (!nskb)
+-			return skb;
+-		kfree_skb(skb);
+-		skb = nskb;
+-	}
+-
+-	if (!pskb_expand_head(skb, 0, -delta, allocation))
+-		skb->truesize -= delta;
+-
+ 	return skb;
+ }
+ 
diff --git a/target/linux/generic/patches-3.3/654-avoid_skb_cow_realloc.patch b/target/linux/generic/patches-3.3/654-avoid_skb_cow_realloc.patch
new file mode 100644
index 0000000..5b25371
--- /dev/null
+++ b/target/linux/generic/patches-3.3/654-avoid_skb_cow_realloc.patch
@@ -0,0 +1,21 @@
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1850,12 +1850,15 @@ static inline int skb_clone_writable(con
+ static inline int __skb_cow(struct sk_buff *skb, unsigned int headroom,
+ 			    int cloned)
+ {
++	unsigned int alloc_headroom = headroom;
+ 	int delta = 0;
+ 
+ 	if (headroom < NET_SKB_PAD)
+-		headroom = NET_SKB_PAD;
+-	if (headroom > skb_headroom(skb))
+-		delta = headroom - skb_headroom(skb);
++		alloc_headroom = NET_SKB_PAD;
++	if (headroom > skb_headroom(skb) ||
++	    (cloned && alloc_headroom > skb_headroom(skb))) {
++		delta = alloc_headroom - skb_headroom(skb);
++	}
+ 
+ 	if (delta || cloned)
+ 		return pskb_expand_head(skb, ALIGN(delta, NET_SKB_PAD), 0,
diff --git a/target/linux/generic/patches-3.3/655-increase_skb_pad.patch b/target/linux/generic/patches-3.3/655-increase_skb_pad.patch
new file mode 100644
index 0000000..5d14daa
--- /dev/null
+++ b/target/linux/generic/patches-3.3/655-increase_skb_pad.patch
@@ -0,0 +1,11 @@
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1558,7 +1558,7 @@ static inline int pskb_network_may_pull(
+  * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
+  */
+ #ifndef NET_SKB_PAD
+-#define NET_SKB_PAD	max(32, L1_CACHE_BYTES)
++#define NET_SKB_PAD	max(48, L1_CACHE_BYTES)
+ #endif
+ 
+ extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
diff --git a/target/linux/generic/patches-3.3/700-swconfig.patch b/target/linux/generic/patches-3.3/700-swconfig.patch
new file mode 100644
index 0000000..a200943
--- /dev/null
+++ b/target/linux/generic/patches-3.3/700-swconfig.patch
@@ -0,0 +1,39 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -13,6 +13,16 @@ menuconfig PHYLIB
+ 
+ if PHYLIB
+ 
++config SWCONFIG
++	tristate "Switch configuration API"
++	---help---
++	  Switch configuration API using netlink. This allows
++	  you to configure the VLAN features of certain switches.
++
++config SWCONFIG_LEDS
++	bool "Switch LED trigger support"
++	depends on (SWCONFIG && LEDS_TRIGGERS)
++
+ comment "MII PHY device drivers"
+ 
+ config MARVELL_PHY
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -3,6 +3,7 @@
+ libphy-objs			:= phy.o phy_device.o mdio_bus.o
+ 
+ obj-$(CONFIG_PHYLIB)		+= libphy.o
++obj-$(CONFIG_SWCONFIG)		+= swconfig.o
+ obj-$(CONFIG_MARVELL_PHY)	+= marvell.o
+ obj-$(CONFIG_DAVICOM_PHY)	+= davicom.o
+ obj-$(CONFIG_CICADA_PHY)	+= cicada.o
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -354,6 +354,7 @@ header-y += stddef.h
+ header-y += string.h
+ header-y += suspend_ioctls.h
+ header-y += swab.h
++header-y += switch.h
+ header-y += synclink.h
+ header-y += sysctl.h
+ header-y += taskstats.h
diff --git a/target/linux/generic/patches-3.3/701-phy_extension.patch b/target/linux/generic/patches-3.3/701-phy_extension.patch
new file mode 100644
index 0000000..201c857
--- /dev/null
+++ b/target/linux/generic/patches-3.3/701-phy_extension.patch
@@ -0,0 +1,72 @@
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -299,6 +299,50 @@ int phy_ethtool_gset(struct phy_device *
+ }
+ EXPORT_SYMBOL(phy_ethtool_gset);
+ 
++int phy_ethtool_ioctl(struct phy_device *phydev, void *useraddr)
++{
++	u32 cmd;
++	int tmp;
++	struct ethtool_cmd ecmd = { ETHTOOL_GSET };
++	struct ethtool_value edata = { ETHTOOL_GLINK };
++
++	if (get_user(cmd, (u32 *) useraddr))
++		return -EFAULT;
++
++	switch (cmd) {
++	case ETHTOOL_GSET:
++		phy_ethtool_gset(phydev, &ecmd);
++		if (copy_to_user(useraddr, &ecmd, sizeof(ecmd)))
++			return -EFAULT;
++		return 0;
++
++	case ETHTOOL_SSET:
++		if (copy_from_user(&ecmd, useraddr, sizeof(ecmd)))
++			return -EFAULT;
++		return phy_ethtool_sset(phydev, &ecmd);
++
++	case ETHTOOL_NWAY_RST:
++		/* if autoneg is off, it's an error */
++		tmp = phy_read(phydev, MII_BMCR);
++		if (tmp & BMCR_ANENABLE) {
++			tmp |= (BMCR_ANRESTART);
++			phy_write(phydev, MII_BMCR, tmp);
++			return 0;
++		}
++		return -EINVAL;
++
++	case ETHTOOL_GLINK:
++		edata.data = (phy_read(phydev,
++				MII_BMSR) & BMSR_LSTATUS) ? 1 : 0;
++		if (copy_to_user(useraddr, &edata, sizeof(edata)))
++			return -EFAULT;
++		return 0;
++	}
++
++	return -EOPNOTSUPP;
++}
++EXPORT_SYMBOL(phy_ethtool_ioctl);
++
+ /**
+  * phy_mii_ioctl - generic PHY MII ioctl interface
+  * @phydev: the phy_device struct
+@@ -474,7 +518,7 @@ static void phy_force_reduction(struct p
+ 	int idx;
+ 
+ 	idx = phy_find_setting(phydev->speed, phydev->duplex);
+-	
++
+ 	idx++;
+ 
+ 	idx = phy_find_valid(idx, phydev->supported);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -515,6 +515,7 @@ void phy_start_machine(struct phy_device
+ void phy_stop_machine(struct phy_device *phydev);
+ int phy_ethtool_sset(struct phy_device *phydev, struct ethtool_cmd *cmd);
+ int phy_ethtool_gset(struct phy_device *phydev, struct ethtool_cmd *cmd);
++int phy_ethtool_ioctl(struct phy_device *phydev, void *useraddr);
+ int phy_mii_ioctl(struct phy_device *phydev,
+ 		struct ifreq *ifr, int cmd);
+ int phy_start_interrupts(struct phy_device *phydev);
diff --git a/target/linux/generic/patches-3.3/702-phy_add_aneg_done_function.patch b/target/linux/generic/patches-3.3/702-phy_add_aneg_done_function.patch
new file mode 100644
index 0000000..0649afb
--- /dev/null
+++ b/target/linux/generic/patches-3.3/702-phy_add_aneg_done_function.patch
@@ -0,0 +1,45 @@
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -393,9 +393,18 @@ struct phy_driver {
+ 	 */
+ 	int (*config_aneg)(struct phy_device *phydev);
+ 
++	/* Determine if autonegotiation is done */
++	int (*aneg_done)(struct phy_device *phydev);
++
+ 	/* Determines the negotiated speed and duplex */
+ 	int (*read_status)(struct phy_device *phydev);
+ 
++	/* 
++	 * Update the value in phydev->link to reflect the 
++	 * current link value
++	 */
++	int (*update_link)(struct phy_device *phydev);
++
+ 	/* Clears any pending interrupts */
+ 	int (*ack_interrupt)(struct phy_device *phydev);
+ 
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -705,6 +705,9 @@ int genphy_update_link(struct phy_device
+ {
+ 	int status;
+ 
++	if (phydev->drv->update_link)
++		return phydev->drv->update_link(phydev);
++
+ 	/* Do a fake read */
+ 	status = phy_read(phydev, MII_BMSR);
+ 
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -106,6 +106,9 @@ static inline int phy_aneg_done(struct p
+ {
+ 	int retval;
+ 
++	if (phydev->drv->aneg_done)
++		return phydev->drv->aneg_done(phydev);
++
+ 	retval = phy_read(phydev, MII_BMSR);
+ 
+ 	return (retval < 0) ? retval : (retval & BMSR_ANEGCOMPLETE);
diff --git a/target/linux/generic/patches-3.3/703-phy-add-detach-callback-to-struct-phy_driver.patch b/target/linux/generic/patches-3.3/703-phy-add-detach-callback-to-struct-phy_driver.patch
new file mode 100644
index 0000000..8af9a19
--- /dev/null
+++ b/target/linux/generic/patches-3.3/703-phy-add-detach-callback-to-struct-phy_driver.patch
@@ -0,0 +1,27 @@
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -522,6 +522,9 @@ EXPORT_SYMBOL(phy_attach);
+  */
+ void phy_detach(struct phy_device *phydev)
+ {
++	if (phydev->drv && phydev->drv->detach)
++		phydev->drv->detach(phydev);
++
+ 	phydev->attached_dev->phydev = NULL;
+ 	phydev->attached_dev = NULL;
+ 
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -417,6 +417,12 @@ struct phy_driver {
+ 	 */
+ 	int (*did_interrupt)(struct phy_device *phydev);
+ 
++	/*
++	 * Called before an ethernet device is detached
++	 * from the PHY.
++	 */
++	void (*detach)(struct phy_device *phydev);
++
+ 	/* Clears up any memory if needed */
+ 	void (*remove)(struct phy_device *phydev);
+ 
diff --git a/target/linux/generic/patches-3.3/710-phy-add-mdio_register_board_info.patch b/target/linux/generic/patches-3.3/710-phy-add-mdio_register_board_info.patch
new file mode 100644
index 0000000..5e40394
--- /dev/null
+++ b/target/linux/generic/patches-3.3/710-phy-add-mdio_register_board_info.patch
@@ -0,0 +1,191 @@
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -36,6 +36,8 @@
+ #include <asm/irq.h>
+ #include <asm/uaccess.h>
+ 
++#include "mdio-boardinfo.h"
++
+ /**
+  * mdiobus_alloc_size - allocate a mii_bus structure
+  * @size: extra amount of memory to allocate for private storage.
+@@ -192,15 +194,33 @@ void mdiobus_free(struct mii_bus *bus)
+ }
+ EXPORT_SYMBOL(mdiobus_free);
+ 
++static void mdiobus_setup_phydev_from_boardinfo(struct mii_bus *bus,
++						struct phy_device *phydev,
++						struct mdio_board_info *bi)
++{
++	if (strcmp(bus->id, bi->bus_id) ||
++	    bi->phy_addr != phydev->addr)
++		return;
++
++	phydev->dev.platform_data = (void *) bi->platform_data;
++}
++
+ struct phy_device *mdiobus_scan(struct mii_bus *bus, int addr)
+ {
+ 	struct phy_device *phydev;
++	struct mdio_board_entry *be;
+ 	int err;
+ 
+ 	phydev = get_phy_device(bus, addr);
+ 	if (IS_ERR(phydev) || phydev == NULL)
+ 		return phydev;
+ 
++	mutex_lock(&__mdio_board_lock);
++	list_for_each_entry(be, &__mdio_board_list, list)
++		mdiobus_setup_phydev_from_boardinfo(bus, phydev,
++						    &be->board_info);
++	mutex_unlock(&__mdio_board_lock);
++
+ 	err = phy_device_register(phydev);
+ 	if (err) {
+ 		phy_device_free(phydev);
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -549,4 +549,22 @@ int __init mdio_bus_init(void);
+ void mdio_bus_exit(void);
+ 
+ extern struct bus_type mdio_bus_type;
++
++struct mdio_board_info {
++	const char	*bus_id;
++	int		phy_addr;
++
++	const void	*platform_data;
++};
++
++#ifdef CONFIG_MDIO_BOARDINFO
++int mdiobus_register_board_info(const struct mdio_board_info *info, unsigned n);
++#else
++static inline int
++mdiobus_register_board_info(const struct mdio_board_info *info, unsigned n)
++{
++	return 0;
++}
++#endif
++
+ #endif /* __PHY_H */
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -13,6 +13,10 @@ menuconfig PHYLIB
+ 
+ if PHYLIB
+ 
++config MDIO_BOARDINFO
++	bool
++	default y
++
+ config SWCONFIG
+ 	tristate "Switch configuration API"
+ 	---help---
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -2,6 +2,8 @@
+ 
+ libphy-objs			:= phy.o phy_device.o mdio_bus.o
+ 
++obj-$(CONFIG_MDIO_BOARDINFO)	+= mdio-boardinfo.o
++
+ obj-$(CONFIG_PHYLIB)		+= libphy.o
+ obj-$(CONFIG_SWCONFIG)		+= swconfig.o
+ obj-$(CONFIG_MARVELL_PHY)	+= marvell.o
+--- /dev/null
++++ b/drivers/net/phy/mdio-boardinfo.c
+@@ -0,0 +1,58 @@
++/*
++ * mdio-boardinfo.c - collect pre-declarations of PHY devices
++ *
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/phy.h>
++#include <linux/slab.h>
++#include <linux/export.h>
++#include <linux/mutex.h>
++#include <linux/phy.h>
++
++#include "mdio-boardinfo.h"
++
++/*
++ * These symbols are exported ONLY FOR the mdio_bus component.
++ * No other users will be supported.
++ */
++
++LIST_HEAD(__mdio_board_list);
++EXPORT_SYMBOL_GPL(__mdio_board_list);
++
++DEFINE_MUTEX(__mdio_board_lock);
++EXPORT_SYMBOL_GPL(__mdio_board_lock);
++
++/**
++ * mdio_register_board_info - register PHY devices for a given board
++ * @info: array of chip descriptors
++ * @n: how many descriptors are provided
++ * Context: can sleep
++ *
++ * The board info passed can safely be __initdata ... but be careful of
++ * any embedded pointers (platform_data, etc), they're copied as-is.
++ */
++int __init
++mdiobus_register_board_info(struct mdio_board_info const *info, unsigned n)
++{
++	struct mdio_board_entry *be;
++	int i;
++
++	be = kzalloc(n * sizeof(*be), GFP_KERNEL);
++	if (!be)
++		return -ENOMEM;
++
++	for (i = 0; i < n; i++, be++, info++) {
++		memcpy(&be->board_info, info, sizeof(*info));
++		mutex_lock(&__mdio_board_lock);
++		list_add_tail(&be->list, &__mdio_board_list);
++		mutex_unlock(&__mdio_board_lock);
++	}
++
++	return 0;
++}
+--- /dev/null
++++ b/drivers/net/phy/mdio-boardinfo.h
+@@ -0,0 +1,22 @@
++/*
++ * mdio-boardinfo.h - boardinfo interface internal to the mdio_bus component
++ *
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ *
++ */
++
++#include <linux/mutex.h>
++
++struct mdio_board_entry {
++	struct list_head	list;
++	struct mdio_board_info	board_info;
++};
++
++/* __mdio_board_lock protects __mdio_board_list
++ * only mdio_bus components are allowed to use these symbols.
++ */
++extern struct mutex __mdio_board_lock;
++extern struct list_head __mdio_board_list;
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -15,7 +15,7 @@ obj-$(CONFIG_MII) += mii.o
+ obj-$(CONFIG_MDIO) += mdio.o
+ obj-$(CONFIG_NET) += Space.o loopback.o
+ obj-$(CONFIG_NETCONSOLE) += netconsole.o
+-obj-$(CONFIG_PHYLIB) += phy/
++obj-y += phy/
+ obj-$(CONFIG_RIONET) += rionet.o
+ obj-$(CONFIG_NET_TEAM) += team/
+ obj-$(CONFIG_TUN) += tun.o
diff --git a/target/linux/generic/patches-3.3/720-phy_adm6996.patch b/target/linux/generic/patches-3.3/720-phy_adm6996.patch
new file mode 100644
index 0000000..c99824a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/720-phy_adm6996.patch
@@ -0,0 +1,26 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -106,6 +106,13 @@ config MICREL_PHY
+ 	---help---
+ 	  Supports the KSZ9021, VSC8201, KS8001 PHYs.
+ 
++config ADM6996_PHY
++	tristate "Driver for ADM6996 switches"
++	select SWCONFIG
++	---help---
++	  Currently supports the ADM6996FC and ADM6996M switches.
++	  Support for FC is very limited.
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -16,6 +16,7 @@ obj-$(CONFIG_VITESSE_PHY)	+= vitesse.o
+ obj-$(CONFIG_BROADCOM_PHY)	+= broadcom.o
+ obj-$(CONFIG_BCM63XX_PHY)	+= bcm63xx.o
+ obj-$(CONFIG_ICPLUS_PHY)	+= icplus.o
++obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
diff --git a/target/linux/generic/patches-3.3/721-phy_packets.patch b/target/linux/generic/patches-3.3/721-phy_packets.patch
new file mode 100644
index 0000000..575fbae
--- /dev/null
+++ b/target/linux/generic/patches-3.3/721-phy_packets.patch
@@ -0,0 +1,175 @@
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1078,6 +1078,11 @@ struct net_device {
+ 	const struct net_device_ops *netdev_ops;
+ 	const struct ethtool_ops *ethtool_ops;
+ 
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	void (*eth_mangle_rx)(struct net_device *dev, struct sk_buff *skb);
++	struct sk_buff *(*eth_mangle_tx)(struct net_device *dev, struct sk_buff *skb);
++#endif
++
+ 	/* Hardware header description */
+ 	const struct header_ops *header_ops;
+ 
+@@ -1134,6 +1139,9 @@ struct net_device {
+ 	void			*ax25_ptr;	/* AX.25 specific data */
+ 	struct wireless_dev	*ieee80211_ptr;	/* IEEE 802.11 specific data,
+ 						   assign before registering */
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	void			*phy_ptr; /* PHY device specific data */
++#endif
+ 
+ /*
+  * Cache lines mostly used on receive path (including eth_type_trans())
+--- a/include/linux/if.h
++++ b/include/linux/if.h
+@@ -80,6 +80,7 @@
+ 					 * skbs on transmit */
+ #define IFF_UNICAST_FLT	0x20000		/* Supports unicast filtering	*/
+ #define IFF_TEAM_PORT	0x40000		/* device used as team port */
++#define IFF_NO_IP_ALIGN	0x80000		/* do not ip-align allocated rx pkts */
+ 
+ #define IF_GET_IFACE	0x0001		/* for querying only */
+ #define IF_GET_PROTO	0x0002
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1661,6 +1661,10 @@ extern struct sk_buff *dev_alloc_skb(uns
+ extern struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
+ 		unsigned int length, gfp_t gfp_mask);
+ 
++extern struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
++		unsigned int length, gfp_t gfp);
++
++
+ /**
+  *	netdev_alloc_skb - allocate an skbuff for rx on a specific device
+  *	@dev: network device to receive on
+@@ -1680,16 +1684,6 @@ static inline struct sk_buff *netdev_all
+ 	return __netdev_alloc_skb(dev, length, GFP_ATOMIC);
+ }
+ 
+-static inline struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
+-		unsigned int length, gfp_t gfp)
+-{
+-	struct sk_buff *skb = __netdev_alloc_skb(dev, length + NET_IP_ALIGN, gfp);
+-
+-	if (NET_IP_ALIGN && skb)
+-		skb_reserve(skb, NET_IP_ALIGN);
+-	return skb;
+-}
+-
+ static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
+ 		unsigned int length)
+ {
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -23,6 +23,12 @@ menuconfig NET
+ 
+ if NET
+ 
++config ETHERNET_PACKET_MANGLE
++	bool
++	help
++	  This option can be selected by phy drivers that need to mangle
++	  packets going in or out of an ethernet device.
++
+ config WANT_COMPAT_NETLINK_MESSAGES
+ 	bool
+ 	help
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2267,9 +2267,19 @@ int dev_hard_start_xmit(struct sk_buff *
+ 			}
+ 		}
+ 
+-		skb_len = skb->len;
+-		rc = ops->ndo_start_xmit(skb, dev);
+-		trace_net_dev_xmit(skb, rc, dev, skb_len);
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++		if (!dev->eth_mangle_tx ||
++		    (skb = dev->eth_mangle_tx(dev, skb)) != NULL)
++#else
++		if (1)
++#endif
++		{
++			skb_len = skb->len;
++			rc = ops->ndo_start_xmit(skb, dev);
++			trace_net_dev_xmit(skb, rc, dev, skb_len);
++		} else {
++			rc = NETDEV_TX_OK;
++		}
+ 		if (rc == NETDEV_TX_OK)
+ 			txq_trans_update(txq);
+ 		return rc;
+@@ -2289,9 +2299,19 @@ gso:
+ 		if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
+ 			skb_dst_drop(nskb);
+ 
+-		skb_len = nskb->len;
+-		rc = ops->ndo_start_xmit(nskb, dev);
+-		trace_net_dev_xmit(nskb, rc, dev, skb_len);
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++		if (!dev->eth_mangle_tx ||
++		    (nskb = dev->eth_mangle_tx(dev, nskb)) != NULL)
++#else
++		if (1)
++#endif
++		{
++			skb_len = nskb->len;
++			rc = ops->ndo_start_xmit(nskb, dev);
++			trace_net_dev_xmit(nskb, rc, dev, skb_len);
++		} else {
++			rc = NETDEV_TX_OK;
++		}
+ 		if (unlikely(rc != NETDEV_TX_OK)) {
+ 			if (rc & ~NETDEV_TX_MASK)
+ 				goto out_kfree_gso_skb;
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -58,6 +58,7 @@
+ #include <linux/scatterlist.h>
+ #include <linux/errqueue.h>
+ #include <linux/prefetch.h>
++#include <linux/if.h>
+ 
+ #include <net/protocol.h>
+ #include <net/dst.h>
+@@ -320,6 +321,22 @@ struct sk_buff *__netdev_alloc_skb(struc
+ }
+ EXPORT_SYMBOL(__netdev_alloc_skb);
+ 
++struct sk_buff *__netdev_alloc_skb_ip_align(struct net_device *dev,
++		unsigned int length, gfp_t gfp)
++{
++	struct sk_buff *skb = __netdev_alloc_skb(dev, length + NET_IP_ALIGN, gfp);
++
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	if (dev->priv_flags & IFF_NO_IP_ALIGN)
++		return skb;
++#endif
++
++	if (NET_IP_ALIGN && skb)
++		skb_reserve(skb, NET_IP_ALIGN);
++	return skb;
++}
++EXPORT_SYMBOL(__netdev_alloc_skb_ip_align);
++
+ void skb_add_rx_frag(struct sk_buff *skb, int i, struct page *page, int off,
+ 		int size)
+ {
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -160,6 +160,12 @@ __be16 eth_type_trans(struct sk_buff *sk
+ 	struct ethhdr *eth;
+ 
+ 	skb->dev = dev;
++
++#ifdef CONFIG_ETHERNET_PACKET_MANGLE
++	if (dev->eth_mangle_rx)
++		dev->eth_mangle_rx(dev, skb);
++#endif
++
+ 	skb_reset_mac_header(skb);
+ 	skb_pull_inline(skb, ETH_HLEN);
+ 	eth = eth_hdr(skb);
diff --git a/target/linux/generic/patches-3.3/722-phy_mvswitch.patch b/target/linux/generic/patches-3.3/722-phy_mvswitch.patch
new file mode 100644
index 0000000..8a45611
--- /dev/null
+++ b/target/linux/generic/patches-3.3/722-phy_mvswitch.patch
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -113,6 +113,10 @@ config ADM6996_PHY
+ 	  Currently supports the ADM6996FC and ADM6996M switches.
+ 	  Support for FC is very limited.
+ 
++config MVSWITCH_PHY
++	tristate "Driver for Marvell 88E6060 switches"
++	select ETHERNET_PACKET_MANGLE
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -17,6 +17,7 @@ obj-$(CONFIG_BROADCOM_PHY)	+= broadcom.o
+ obj-$(CONFIG_BCM63XX_PHY)	+= bcm63xx.o
+ obj-$(CONFIG_ICPLUS_PHY)	+= icplus.o
+ obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
++obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
diff --git a/target/linux/generic/patches-3.3/723-phy_ip175c.patch b/target/linux/generic/patches-3.3/723-phy_ip175c.patch
new file mode 100644
index 0000000..8eff10c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/723-phy_ip175c.patch
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -117,6 +117,10 @@ config MVSWITCH_PHY
+ 	tristate "Driver for Marvell 88E6060 switches"
+ 	select ETHERNET_PACKET_MANGLE
+ 
++config IP17XX_PHY
++	tristate "Driver for IC+ IP17xx switches"
++	select SWCONFIG
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -18,6 +18,7 @@ obj-$(CONFIG_BCM63XX_PHY)	+= bcm63xx.o
+ obj-$(CONFIG_ICPLUS_PHY)	+= icplus.o
+ obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
+ obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
++obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
diff --git a/target/linux/generic/patches-3.3/724-phy_ar8216.patch b/target/linux/generic/patches-3.3/724-phy_ar8216.patch
new file mode 100644
index 0000000..eed6e2b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/724-phy_ar8216.patch
@@ -0,0 +1,24 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -121,6 +121,11 @@ config IP17XX_PHY
+ 	tristate "Driver for IC+ IP17xx switches"
+ 	select SWCONFIG
+ 
++config AR8216_PHY
++	tristate "Driver for Atheros AR8216 switches"
++	select ETHERNET_PACKET_MANGLE
++	select SWCONFIG
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -20,6 +20,7 @@ obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
+ obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
+ obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
++obj-$(CONFIG_AR8216_PHY)	+= ar8216.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
diff --git a/target/linux/generic/patches-3.3/725-phy_rtl8306.patch b/target/linux/generic/patches-3.3/725-phy_rtl8306.patch
new file mode 100644
index 0000000..db0ee65
--- /dev/null
+++ b/target/linux/generic/patches-3.3/725-phy_rtl8306.patch
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -126,6 +126,10 @@ config AR8216_PHY
+ 	select ETHERNET_PACKET_MANGLE
+ 	select SWCONFIG
+ 
++config RTL8306_PHY
++	tristate "Driver for Realtek RTL8306S switches"
++	select SWCONFIG
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -21,6 +21,7 @@ obj-$(CONFIG_MVSWITCH_PHY)	+= mvswitch.o
+ obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_AR8216_PHY)	+= ar8216.o
++obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
diff --git a/target/linux/generic/patches-3.3/726-phy_rtl8366.patch b/target/linux/generic/patches-3.3/726-phy_rtl8366.patch
new file mode 100644
index 0000000..d258e4b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/726-phy_rtl8366.patch
@@ -0,0 +1,45 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -168,6 +168,30 @@ config MDIO_OCTEON
+ 
+ 	  If in doubt, say Y.
+ 
++config RTL8366_SMI
++	tristate "Driver for the RTL8366 SMI interface"
++	depends on GENERIC_GPIO
++	---help---
++	  This module implements the SMI interface protocol which is used
++	  by some RTL8366 ethernet switch devices via the generic GPIO API.
++
++if RTL8366_SMI
++
++config RTL8366_SMI_DEBUG_FS
++	bool "RTL8366 SMI interface debugfs support"
++        depends on DEBUG_FS
++        default n
++
++config RTL8366S_PHY
++	tristate "Driver for the Realtek RTL8366S switch"
++	select SWCONFIG
++
++config RTL8366RB_PHY
++	tristate "Driver for the Realtek RTL8366RB switch"
++	select SWCONFIG
++
++endif # RTL8366_SMI
++
+ endif # PHYLIB
+ 
+ config MICREL_KS8995MA
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -22,6 +22,9 @@ obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_AR8216_PHY)	+= ar8216.o
+ obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
++obj-$(CONFIG_RTL8366_SMI)	+= rtl8366_smi.o
++obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
++obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
diff --git a/target/linux/generic/patches-3.3/727-phy-rtl8367.patch b/target/linux/generic/patches-3.3/727-phy-rtl8367.patch
new file mode 100644
index 0000000..a24f497
--- /dev/null
+++ b/target/linux/generic/patches-3.3/727-phy-rtl8367.patch
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -190,6 +190,10 @@ config RTL8366RB_PHY
+ 	tristate "Driver for the Realtek RTL8366RB switch"
+ 	select SWCONFIG
+ 
++config RTL8367_PHY
++	tristate "Driver for the Realtek RTL8367R/M switches"
++	select SWCONFIG
++
+ endif # RTL8366_SMI
+ 
+ endif # PHYLIB
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -25,6 +25,7 @@ obj-$(CONFIG_RTL8306_PHY)	+= rtl8306.o
+ obj-$(CONFIG_RTL8366_SMI)	+= rtl8366_smi.o
+ obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
+ obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
++obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
diff --git a/target/linux/generic/patches-3.3/728-phy-micrel.patch b/target/linux/generic/patches-3.3/728-phy-micrel.patch
new file mode 100644
index 0000000..c41d030
--- /dev/null
+++ b/target/linux/generic/patches-3.3/728-phy-micrel.patch
@@ -0,0 +1,24 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -130,6 +130,11 @@ config RTL8306_PHY
+ 	tristate "Driver for Realtek RTL8306S switches"
+ 	select SWCONFIG
+ 
++config MICREL_PHY
++	tristate "Drivers for Micrel/Kendin PHYs"
++	---help---
++	  Currently has a driver for the KSZ8041
++
+ config FIXED_PHY
+ 	bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
+ 	depends on PHYLIB=y
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -27,6 +27,7 @@ obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
+ obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
+ obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
++obj-$(CONFIG_MICREL_PHY)	+= micrel.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
+ obj-$(CONFIG_MDIO_GPIO)		+= mdio-gpio.o
diff --git a/target/linux/generic/patches-3.3/729-phy-rtl8367b.patch b/target/linux/generic/patches-3.3/729-phy-rtl8367b.patch
new file mode 100644
index 0000000..82a7386
--- /dev/null
+++ b/target/linux/generic/patches-3.3/729-phy-rtl8367b.patch
@@ -0,0 +1,23 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -199,6 +199,10 @@ config RTL8367_PHY
+ 	tristate "Driver for the Realtek RTL8367R/M switches"
+ 	select SWCONFIG
+ 
++config RTL8367B_PHY
++	tristate "Driver fot the Realtek RTL8367R-VB switch"
++	select SWCONFIG
++
+ endif # RTL8366_SMI
+ 
+ endif # PHYLIB
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -26,6 +26,7 @@ obj-$(CONFIG_RTL8366_SMI)	+= rtl8366_smi
+ obj-$(CONFIG_RTL8366S_PHY)	+= rtl8366s.o
+ obj-$(CONFIG_RTL8366RB_PHY)	+= rtl8366rb.o
+ obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
++obj-$(CONFIG_RTL8367B_PHY)	+= rtl8367b.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_MICREL_PHY)	+= micrel.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
diff --git a/target/linux/generic/patches-3.3/729-phy-tantos.patch b/target/linux/generic/patches-3.3/729-phy-tantos.patch
new file mode 100644
index 0000000..99a4e71
--- /dev/null
+++ b/target/linux/generic/patches-3.3/729-phy-tantos.patch
@@ -0,0 +1,21 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -210,3 +210,8 @@ endif # PHYLIB
+ config MICREL_KS8995MA
+ 	tristate "Micrel KS8995MA 5-ports 10/100 managed Ethernet switch"
+ 	depends on SPI
++
++config PSB6970_PHY
++	tristate "Lantiq XWAY Tantos (PSB6970) Ethernet switch"
++	select SWCONFIG
++	select ETHERNET_PACKET_MANGLE
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -29,6 +29,7 @@ obj-$(CONFIG_RTL8367_PHY)	+= rtl8367.o
+ obj-$(CONFIG_RTL8367B_PHY)	+= rtl8367b.o
+ obj-$(CONFIG_LSI_ET1011C_PHY)	+= et1011c.o
+ obj-$(CONFIG_MICREL_PHY)	+= micrel.o
++obj-$(CONFIG_PSB6970_PHY)	+= psb6970.o
+ obj-$(CONFIG_FIXED_PHY)		+= fixed.o
+ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
+ obj-$(CONFIG_MDIO_GPIO)		+= mdio-gpio.o
diff --git a/target/linux/generic/patches-3.3/750-hostap_txpower.patch b/target/linux/generic/patches-3.3/750-hostap_txpower.patch
new file mode 100644
index 0000000..8e2ec9a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/750-hostap_txpower.patch
@@ -0,0 +1,154 @@
+--- a/drivers/net/wireless/hostap/hostap_ap.c
++++ b/drivers/net/wireless/hostap/hostap_ap.c
+@@ -2340,13 +2340,13 @@ int prism2_ap_get_sta_qual(local_info_t
+ 		addr[count].sa_family = ARPHRD_ETHER;
+ 		memcpy(addr[count].sa_data, sta->addr, ETH_ALEN);
+ 		if (sta->last_rx_silence == 0)
+-			qual[count].qual = sta->last_rx_signal < 27 ?
+-				0 : (sta->last_rx_signal - 27) * 92 / 127;
++                        qual[count].qual = (sta->last_rx_signal - 156) == 0 ?
++                                0 : (sta->last_rx_signal - 156) * 92 / 64;
+ 		else
+-			qual[count].qual = sta->last_rx_signal -
+-				sta->last_rx_silence - 35;
+-		qual[count].level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
+-		qual[count].noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
++                        qual[count].qual = (sta->last_rx_signal -
++                                sta->last_rx_silence) * 92 / 64;
++                qual[count].level = sta->last_rx_signal;
++                qual[count].noise = sta->last_rx_silence;
+ 		qual[count].updated = sta->last_rx_updated;
+ 
+ 		sta->last_rx_updated = IW_QUAL_DBM;
+@@ -2412,13 +2412,13 @@ int prism2_ap_translate_scan(struct net_
+ 		memset(&iwe, 0, sizeof(iwe));
+ 		iwe.cmd = IWEVQUAL;
+ 		if (sta->last_rx_silence == 0)
+-			iwe.u.qual.qual = sta->last_rx_signal < 27 ?
+-				0 : (sta->last_rx_signal - 27) * 92 / 127;
++	                iwe.u.qual.qual = (sta->last_rx_signal -156) == 0 ?
++	                        0 : (sta->last_rx_signal - 156) * 92 / 64;
+ 		else
+-			iwe.u.qual.qual = sta->last_rx_signal -
+-				sta->last_rx_silence - 35;
+-		iwe.u.qual.level = HFA384X_LEVEL_TO_dBm(sta->last_rx_signal);
+-		iwe.u.qual.noise = HFA384X_LEVEL_TO_dBm(sta->last_rx_silence);
++                        iwe.u.qual.qual = (sta->last_rx_signal -
++                                sta->last_rx_silence) * 92 / 64;
++                iwe.u.qual.level = sta->last_rx_signal;
++                iwe.u.qual.noise = sta->last_rx_silence;
+ 		iwe.u.qual.updated = sta->last_rx_updated;
+ 		iwe.len = IW_EV_QUAL_LEN;
+ 		current_ev = iwe_stream_add_event(info, current_ev, end_buf,
+--- a/drivers/net/wireless/hostap/hostap_config.h
++++ b/drivers/net/wireless/hostap/hostap_config.h
+@@ -45,4 +45,9 @@
+  */
+ /* #define PRISM2_NO_STATION_MODES */
+ 
++/* Enable TX power Setting functions
++ * (min att = -128 , max att =  127)
++ */
++#define RAW_TXPOWER_SETTING
++
+ #endif /* HOSTAP_CONFIG_H */
+--- a/drivers/net/wireless/hostap/hostap.h
++++ b/drivers/net/wireless/hostap/hostap.h
+@@ -90,6 +90,7 @@ extern const struct iw_handler_def hosta
+ extern const struct ethtool_ops prism2_ethtool_ops;
+ 
+ int hostap_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
++int hostap_restore_power(struct net_device *dev);
+ 
+ 
+ #endif /* HOSTAP_H */
+--- a/drivers/net/wireless/hostap/hostap_hw.c
++++ b/drivers/net/wireless/hostap/hostap_hw.c
+@@ -932,6 +932,7 @@ static int hfa384x_set_rid(struct net_de
+ 			prism2_hw_reset(dev);
+ 	}
+ 
++	hostap_restore_power(dev);
+ 	return res;
+ }
+ 
+--- a/drivers/net/wireless/hostap/hostap_info.c
++++ b/drivers/net/wireless/hostap/hostap_info.c
+@@ -434,6 +434,11 @@ static void handle_info_queue_linkstatus
+ 	}
+ 
+ 	/* Get BSSID if we have a valid AP address */
++
++	if ( val == HFA384X_LINKSTATUS_CONNECTED ||
++	     val == HFA384X_LINKSTATUS_DISCONNECTED )
++			hostap_restore_power(local->dev);
++
+ 	if (connected) {
+ 		netif_carrier_on(local->dev);
+ 		netif_carrier_on(local->ddev);
+--- a/drivers/net/wireless/hostap/hostap_ioctl.c
++++ b/drivers/net/wireless/hostap/hostap_ioctl.c
+@@ -1478,23 +1478,20 @@ static int prism2_txpower_hfa386x_to_dBm
+ 		val = 255;
+ 
+ 	tmp = val;
+-	tmp >>= 2;
+ 
+-	return -12 - tmp;
++	return tmp;
+ }
+ 
+ static u16 prism2_txpower_dBm_to_hfa386x(int val)
+ {
+ 	signed char tmp;
+ 
+-	if (val > 20)
+-		return 128;
+-	else if (val < -43)
++	if (val > 127)
+ 		return 127;
++	else if (val < -128)
++		return 128;
+ 
+ 	tmp = val;
+-	tmp = -12 - tmp;
+-	tmp <<= 2;
+ 
+ 	return (unsigned char) tmp;
+ }
+@@ -4057,3 +4054,35 @@ int hostap_ioctl(struct net_device *dev,
+ 
+ 	return ret;
+ }
++
++/* BUG FIX: Restore power setting value when lost due to F/W bug */
++
++int hostap_restore_power(struct net_device *dev)
++{
++        struct hostap_interface *iface = netdev_priv(dev);
++       local_info_t *local = iface->local;
++
++       u16 val;
++       int ret = 0;
++
++       if (local->txpower_type == PRISM2_TXPOWER_OFF) {
++                       val = 0xff; /* use all standby and sleep modes */
++                       ret = local->func->cmd(dev, HFA384X_CMDCODE_WRITEMIF,
++                                              HFA386X_CR_A_D_TEST_MODES2,
++                                              &val, NULL);
++       }
++
++#ifdef RAW_TXPOWER_SETTING
++       if (local->txpower_type == PRISM2_TXPOWER_FIXED) {
++               val = HFA384X_TEST_CFG_BIT_ALC;
++               local->func->cmd(dev, HFA384X_CMDCODE_TEST |
++                                (HFA384X_TEST_CFG_BITS << 8), 0, &val, NULL);
++               val = prism2_txpower_dBm_to_hfa386x(local->txpower);
++               ret = (local->func->cmd(dev, HFA384X_CMDCODE_WRITEMIF,
++                            HFA386X_CR_MANUAL_TX_POWER, &val, NULL));
++       }
++#endif /* RAW_TXPOWER_SETTING */
++       return (ret ? -EOPNOTSUPP : 0);
++}
++
++EXPORT_SYMBOL(hostap_restore_power);
diff --git a/target/linux/generic/patches-3.3/800-usb-ohci-multiple-platform-driver-fix.patch b/target/linux/generic/patches-3.3/800-usb-ohci-multiple-platform-driver-fix.patch
new file mode 100644
index 0000000..a2a213b
--- /dev/null
+++ b/target/linux/generic/patches-3.3/800-usb-ohci-multiple-platform-driver-fix.patch
@@ -0,0 +1,51 @@
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -1123,7 +1123,7 @@ MODULE_LICENSE ("GPL");
+ 
+ #ifdef CONFIG_USB_OHCI_HCD_PLATFORM
+ #include "ohci-platform.c"
+-#define PLATFORM_DRIVER		ohci_platform_driver
++#define OHCI_PLATFORM_DRIVER		ohci_platform_driver
+ #endif
+ 
+ #if	!defined(PCI_DRIVER) &&		\
+@@ -1135,7 +1135,8 @@ MODULE_LICENSE ("GPL");
+ 	!defined(PS3_SYSTEM_BUS_DRIVER) && \
+ 	!defined(SM501_OHCI_DRIVER) && \
+ 	!defined(TMIO_OHCI_DRIVER) && \
+-	!defined(SSB_OHCI_DRIVER)
++	!defined(SSB_OHCI_DRIVER) && \
++	!defined(OHCI_PLATFORM_DRIVER)
+ #error "missing bus glue for ohci-hcd"
+ #endif
+ 
+@@ -1219,9 +1220,19 @@ static int __init ohci_hcd_mod_init(void
+ 		goto error_tmio;
+ #endif
+ 
++#ifdef OHCI_PLATFORM_DRIVER
++	retval = platform_driver_register(&OHCI_PLATFORM_DRIVER);
++	if (retval < 0)
++		goto error_ohci;
++#endif
++
+ 	return retval;
+ 
+ 	/* Error path */
++#ifdef OHCI_PLATFORM_DRIVER
++	platform_driver_unregister(&OHCI_PLATFORM_DRIVER);
++ error_ohci:
++#endif
+ #ifdef TMIO_OHCI_DRIVER
+ 	platform_driver_unregister(&TMIO_OHCI_DRIVER);
+  error_tmio:
+@@ -1275,6 +1286,9 @@ module_init(ohci_hcd_mod_init);
+ 
+ static void __exit ohci_hcd_mod_exit(void)
+ {
++#ifdef OHCI_PLATFORM_DRIVER
++	platform_driver_unregister(&OHCI_PLATFORM_DRIVER);
++#endif
+ #ifdef TMIO_OHCI_DRIVER
+ 	platform_driver_unregister(&TMIO_OHCI_DRIVER);
+ #endif
diff --git a/target/linux/generic/patches-3.3/801-usb-ehci-multiple-platform-driver-fix.patch b/target/linux/generic/patches-3.3/801-usb-ehci-multiple-platform-driver-fix.patch
new file mode 100644
index 0000000..9bf5097
--- /dev/null
+++ b/target/linux/generic/patches-3.3/801-usb-ehci-multiple-platform-driver-fix.patch
@@ -0,0 +1,47 @@
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -1383,12 +1383,12 @@ MODULE_LICENSE ("GPL");
+ 
+ #ifdef CONFIG_USB_EHCI_HCD_PLATFORM
+ #include "ehci-platform.c"
+-#define PLATFORM_DRIVER		ehci_platform_driver
++#define EHCI_PLATFORM_DRIVER	ehci_platform_driver
+ #endif
+ 
+ #if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER) && \
+     !defined(PS3_SYSTEM_BUS_DRIVER) && !defined(OF_PLATFORM_DRIVER) && \
+-    !defined(XILINX_OF_PLATFORM_DRIVER)
++    !defined(XILINX_OF_PLATFORM_DRIVER) && !defined(EHCI_PLATFORM_DRIVER)
+ #error "missing bus glue for ehci-hcd"
+ #endif
+ 
+@@ -1448,8 +1448,19 @@ static int __init ehci_hcd_init(void)
+ 	if (retval < 0)
+ 		goto clean4;
+ #endif
++
++#ifdef EHCI_PLATFORM_DRIVER
++	retval = platform_driver_register(&EHCI_PLATFORM_DRIVER);
++	if (retval < 0)
++		goto clean5;
++#endif
++
+ 	return retval;
+ 
++#ifdef EHCI_PLATFORM_DRIVER
++	platform_driver_unregister(&EHCI_PLATFORM_DRIVER);
++clean5:
++#endif
+ #ifdef XILINX_OF_PLATFORM_DRIVER
+ 	/* platform_driver_unregister(&XILINX_OF_PLATFORM_DRIVER); */
+ clean4:
+@@ -1482,6 +1493,9 @@ module_init(ehci_hcd_init);
+ 
+ static void __exit ehci_hcd_cleanup(void)
+ {
++#ifdef EHCI_PLATFORM_DRIVER
++	platform_driver_unregister(&EHCI_PLATFORM_DRIVER);
++#endif
+ #ifdef XILINX_OF_PLATFORM_DRIVER
+ 	platform_driver_unregister(&XILINX_OF_PLATFORM_DRIVER);
+ #endif
diff --git a/target/linux/generic/patches-3.3/810-pci_disable_common_quirks.patch b/target/linux/generic/patches-3.3/810-pci_disable_common_quirks.patch
new file mode 100644
index 0000000..4802157
--- /dev/null
+++ b/target/linux/generic/patches-3.3/810-pci_disable_common_quirks.patch
@@ -0,0 +1,43 @@
+--- a/drivers/pci/Kconfig
++++ b/drivers/pci/Kconfig
+@@ -51,6 +51,12 @@ config XEN_PCIDEV_FRONTEND
+           The PCI device frontend driver allows the kernel to import arbitrary
+           PCI devices from a PCI backend to support PCI driver domains.
+ 
++config PCI_DISABLE_COMMON_QUIRKS
++	bool "PCI disable common quirks"
++	depends on PCI
++	help
++	  If you don't know what to do here, say N.
++
+ config HT_IRQ
+ 	bool "Interrupts on hypertransport devices"
+ 	default y
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -105,6 +105,7 @@ static void __devinit quirk_mmio_always_
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, quirk_mmio_always_on);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
+ /* The Mellanox Tavor device gives false positive parity errors
+  * Mark this device with a broken_parity_status, to allow
+  * PCI scanning code to "skip" this now blacklisted device.
+@@ -1990,7 +1991,9 @@ static void __devinit fixup_rev1_53c810(
+ 	}
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NCR, PCI_DEVICE_ID_NCR_53C810, fixup_rev1_53c810);
++#endif /* !CONFIG_PCI_DISABLE_COMMON_QUIRKS */
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
+ /* Enable 1k I/O space granularity on the Intel P64H2 */
+ static void __devinit quirk_p64h2_1k_io(struct pci_dev *dev)
+ {
+@@ -2666,6 +2669,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AT
+ 			quirk_msi_intx_disable_bug);
+ 
+ #endif /* CONFIG_PCI_MSI */
++#endif /* !CONFIG_PCI_DISABLE_COMMON_QUIRKS */
+ 
+ /* Allow manual resource allocation for PCI hotplug bridges
+  * via pci=hpmemsize=nnM and pci=hpiosize=nnM parameters. For
diff --git a/target/linux/generic/patches-3.3/811-pci_disable_usb_common_quirks.patch b/target/linux/generic/patches-3.3/811-pci_disable_usb_common_quirks.patch
new file mode 100644
index 0000000..7bf8eaf
--- /dev/null
+++ b/target/linux/generic/patches-3.3/811-pci_disable_usb_common_quirks.patch
@@ -0,0 +1,38 @@
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -432,6 +432,8 @@ reset_needed:
+ }
+ EXPORT_SYMBOL_GPL(uhci_check_and_reset_hc);
+ 
++#ifndef CONFIG_PCI_DISABLE_COMMON_QUIRKS
++
+ static inline int io_type_enabled(struct pci_dev *pdev, unsigned int mask)
+ {
+ 	u16 cmd;
+@@ -928,3 +930,5 @@ static void __devinit quirk_usb_early_ha
+ 	pci_disable_device(pdev);
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, quirk_usb_early_handoff);
++
++#endif
+--- a/drivers/usb/host/pci-quirks.h
++++ b/drivers/usb/host/pci-quirks.h
+@@ -8,9 +8,17 @@ int usb_amd_find_chipset_info(void);
+ void usb_amd_dev_put(void);
+ void usb_amd_quirk_pll_disable(void);
+ void usb_amd_quirk_pll_enable(void);
++#if !defined(CONFIG_PCI_DISABLE_COMMON_QUIRKS)
+ bool usb_is_intel_switchable_xhci(struct pci_dev *pdev);
+ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev);
+ #else
++static inline bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
++{
++	return false;
++}
++static inline void usb_enable_xhci_ports(struct pci_dev *xhci_pdev) {}
++#endif
++#else
+ static inline void usb_amd_quirk_pll_disable(void) {}
+ static inline void usb_amd_quirk_pll_enable(void) {}
+ static inline void usb_amd_dev_put(void) {}
diff --git a/target/linux/generic/patches-3.3/820-usb_add_usb_find_device_by_name.patch b/target/linux/generic/patches-3.3/820-usb_add_usb_find_device_by_name.patch
new file mode 100644
index 0000000..ee50ff9
--- /dev/null
+++ b/target/linux/generic/patches-3.3/820-usb_add_usb_find_device_by_name.patch
@@ -0,0 +1,84 @@
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -652,6 +652,71 @@ int __usb_get_extra_descriptor(char *buf
+ }
+ EXPORT_SYMBOL_GPL(__usb_get_extra_descriptor);
+ 
++static struct usb_device *match_device_name(struct usb_device *dev,
++					    const char *name)
++{
++	struct usb_device *ret_dev = NULL;
++	int child;
++
++	dev_dbg(&dev->dev, "check for name %s ...\n", name);
++
++	/* see if this device matches */
++	if (strcmp(dev_name(&dev->dev), name) == 0 ) {
++		dev_dbg(&dev->dev, "matched this device!\n");
++		ret_dev = usb_get_dev(dev);
++		goto exit;
++	}
++
++	/* look through all of the children of this device */
++	for (child = 0; child < dev->maxchild; ++child) {
++		if (dev->children[child]) {
++			usb_lock_device(dev->children[child]);
++			ret_dev = match_device_name(dev->children[child], name);
++			usb_unlock_device(dev->children[child]);
++			if (ret_dev)
++				goto exit;
++		}
++	}
++exit:
++	return ret_dev;
++}
++
++/**
++ * usb_find_device_by_name - find a specific usb device in the system
++ * @name: the name of the device to find
++ *
++ * Returns a pointer to a struct usb_device if such a specified usb
++ * device is present in the system currently.  The usage count of the
++ * device will be incremented if a device is found.  Make sure to call
++ * usb_put_dev() when the caller is finished with the device.
++ *
++ * If a device with the specified bus id is not found, NULL is returned.
++ */
++struct usb_device *usb_find_device_by_name(const char *name)
++{
++	struct list_head *buslist;
++	struct usb_bus *bus;
++	struct usb_device *dev = NULL;
++
++	mutex_lock(&usb_bus_list_lock);
++	for (buslist = usb_bus_list.next;
++	     buslist != &usb_bus_list;
++	     buslist = buslist->next) {
++		bus = container_of(buslist, struct usb_bus, bus_list);
++		if (!bus->root_hub)
++			continue;
++		usb_lock_device(bus->root_hub);
++		dev = match_device_name(bus->root_hub, name);
++		usb_unlock_device(bus->root_hub);
++		if (dev)
++			goto exit;
++	}
++exit:
++	mutex_unlock(&usb_bus_list_lock);
++	return dev;
++}
++EXPORT_SYMBOL_GPL(usb_find_device_by_name);
++
+ /**
+  * usb_alloc_coherent - allocate dma-consistent buffer for URB_NO_xxx_DMA_MAP
+  * @dev: device the buffer will be used with
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -531,6 +531,7 @@ extern int usb_lock_device_for_reset(str
+ extern int usb_reset_device(struct usb_device *dev);
+ extern void usb_queue_reset_device(struct usb_interface *dev);
+ 
++extern struct usb_device *usb_find_device_by_name(const char *name);
+ 
+ /* USB autosuspend and autoresume */
+ #ifdef CONFIG_USB_SUSPEND
diff --git a/target/linux/generic/patches-3.3/830-ledtrig_morse.patch b/target/linux/generic/patches-3.3/830-ledtrig_morse.patch
new file mode 100644
index 0000000..3283807
--- /dev/null
+++ b/target/linux/generic/patches-3.3/830-ledtrig_morse.patch
@@ -0,0 +1,28 @@
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -480,4 +480,8 @@ config LEDS_TRIGGER_DEFAULT_ON
+ comment "iptables trigger is under Netfilter config (LED target)"
+ 	depends on LEDS_TRIGGERS
+ 
++config LEDS_TRIGGER_MORSE
++	tristate "LED Morse Trigger"
++	depends on LEDS_TRIGGERS
++
+ endif # NEW_LEDS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -57,3 +57,4 @@ obj-$(CONFIG_LEDS_TRIGGER_HEARTBEAT)	+=
+ obj-$(CONFIG_LEDS_TRIGGER_BACKLIGHT)	+= ledtrig-backlight.o
+ obj-$(CONFIG_LEDS_TRIGGER_GPIO)		+= ledtrig-gpio.o
+ obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
++obj-$(CONFIG_LEDS_TRIGGER_MORSE)	+= ledtrig-morse.o
+--- a/drivers/leds/ledtrig-morse.c
++++ b/drivers/leds/ledtrig-morse.c
+@@ -26,7 +26,6 @@
+ #include <linux/list.h>
+ #include <linux/spinlock.h>
+ #include <linux/device.h>
+-#include <linux/sysdev.h>
+ #include <linux/timer.h>
+ #include <linux/ctype.h>
+ #include <linux/leds.h>
diff --git a/target/linux/generic/patches-3.3/831-ledtrig_netdev.patch b/target/linux/generic/patches-3.3/831-ledtrig_netdev.patch
new file mode 100644
index 0000000..7f94b1c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/831-ledtrig_netdev.patch
@@ -0,0 +1,51 @@
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -484,4 +484,11 @@ config LEDS_TRIGGER_MORSE
+ 	tristate "LED Morse Trigger"
+ 	depends on LEDS_TRIGGERS
+ 
++config LEDS_TRIGGER_NETDEV
++	tristate "LED Netdev Trigger"
++	depends on NET && LEDS_TRIGGERS
++	help
++	  This allows LEDs to be controlled by network device activity.
++	  If unsure, say Y.
++
+ endif # NEW_LEDS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -58,3 +58,4 @@ obj-$(CONFIG_LEDS_TRIGGER_BACKLIGHT)	+=
+ obj-$(CONFIG_LEDS_TRIGGER_GPIO)		+= ledtrig-gpio.o
+ obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
+ obj-$(CONFIG_LEDS_TRIGGER_MORSE)	+= ledtrig-morse.o
++obj-$(CONFIG_LEDS_TRIGGER_NETDEV)	+= ledtrig-netdev.o
+--- a/drivers/leds/ledtrig-netdev.c
++++ b/drivers/leds/ledtrig-netdev.c
+@@ -22,7 +22,6 @@
+ #include <linux/list.h>
+ #include <linux/spinlock.h>
+ #include <linux/device.h>
+-#include <linux/sysdev.h>
+ #include <linux/netdevice.h>
+ #include <linux/timer.h>
+ #include <linux/ctype.h>
+@@ -307,8 +306,9 @@ done:
+ static void netdev_trig_timer(unsigned long arg)
+ {
+ 	struct led_netdev_data *trigger_data = (struct led_netdev_data *)arg;
+-	const struct net_device_stats *dev_stats;
++	struct rtnl_link_stats64 *dev_stats;
+ 	unsigned new_activity;
++	struct rtnl_link_stats64 temp;
+ 
+ 	write_lock(&trigger_data->lock);
+ 
+@@ -318,7 +318,7 @@ static void netdev_trig_timer(unsigned l
+ 		goto no_restart;
+ 	}
+ 
+-	dev_stats = dev_get_stats(trigger_data->net_dev);
++	dev_stats = dev_get_stats(trigger_data->net_dev, &temp);
+ 	new_activity =
+ 		((trigger_data->mode & MODE_TX) ? dev_stats->tx_packets : 0) +
+ 		((trigger_data->mode & MODE_RX) ? dev_stats->rx_packets : 0);
diff --git a/target/linux/generic/patches-3.3/832-ledtrig_usbdev.patch b/target/linux/generic/patches-3.3/832-ledtrig_usbdev.patch
new file mode 100644
index 0000000..8933497
--- /dev/null
+++ b/target/linux/generic/patches-3.3/832-ledtrig_usbdev.patch
@@ -0,0 +1,31 @@
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -491,4 +491,11 @@ config LEDS_TRIGGER_NETDEV
+ 	  This allows LEDs to be controlled by network device activity.
+ 	  If unsure, say Y.
+ 
++config LEDS_TRIGGER_USBDEV
++	tristate "LED USB device Trigger"
++	depends on USB && LEDS_TRIGGERS
++	help
++	  This allows LEDs to be controlled by the presence/activity of
++	  an USB device. If unsure, say N.
++
+ endif # NEW_LEDS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -59,3 +59,4 @@ obj-$(CONFIG_LEDS_TRIGGER_GPIO)		+= ledt
+ obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
+ obj-$(CONFIG_LEDS_TRIGGER_MORSE)	+= ledtrig-morse.o
+ obj-$(CONFIG_LEDS_TRIGGER_NETDEV)	+= ledtrig-netdev.o
++obj-$(CONFIG_LEDS_TRIGGER_USBDEV)	+= ledtrig-usbdev.o
+--- a/drivers/leds/ledtrig-usbdev.c
++++ b/drivers/leds/ledtrig-usbdev.c
+@@ -24,7 +24,6 @@
+ #include <linux/list.h>
+ #include <linux/spinlock.h>
+ #include <linux/device.h>
+-#include <linux/sysdev.h>
+ #include <linux/timer.h>
+ #include <linux/ctype.h>
+ #include <linux/slab.h>
diff --git a/target/linux/generic/patches-3.3/840-rtc7301.patch b/target/linux/generic/patches-3.3/840-rtc7301.patch
new file mode 100644
index 0000000..35dd3b8
--- /dev/null
+++ b/target/linux/generic/patches-3.3/840-rtc7301.patch
@@ -0,0 +1,250 @@
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -719,6 +719,15 @@ config RTC_DRV_NUC900
+ 	  If you say yes here you get support for the RTC subsystem of the
+ 	  NUC910/NUC920 used in embedded systems.
+ 
++config RTC_DRV_RTC7301
++	tristate "Epson RTC-7301 SF/DG"
++	help
++	  If you say Y here you will get support for the
++	  Epson RTC-7301 SF/DG RTC chips.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called rtc-7301.
++
+ comment "on-CPU RTC drivers"
+ 
+ config RTC_DRV_DAVINCI
+--- a/drivers/rtc/Makefile
++++ b/drivers/rtc/Makefile
+@@ -86,6 +86,7 @@ obj-$(CONFIG_RTC_DRV_RP5C01)	+= rtc-rp5c
+ obj-$(CONFIG_RTC_DRV_RS5C313)	+= rtc-rs5c313.o
+ obj-$(CONFIG_RTC_DRV_RS5C348)	+= rtc-rs5c348.o
+ obj-$(CONFIG_RTC_DRV_RS5C372)	+= rtc-rs5c372.o
++obj-$(CONFIG_RTC_DRV_RTC7301)	+= rtc-rtc7301.o
+ obj-$(CONFIG_RTC_DRV_RV3029C2)	+= rtc-rv3029c2.o
+ obj-$(CONFIG_RTC_DRV_RX8025)	+= rtc-rx8025.o
+ obj-$(CONFIG_RTC_DRV_RX8581)	+= rtc-rx8581.o
+--- /dev/null
++++ b/drivers/rtc/rtc-rtc7301.c
+@@ -0,0 +1,219 @@
++/*
++ * Driver for Epson RTC-7301SF/DG
++ *
++ * Copyright (C) 2009 Jose Vasconcellos
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/module.h>
++#include <linux/rtc.h>
++#include <linux/platform_device.h>
++#include <linux/io.h>
++#include <linux/delay.h>
++#include <linux/bcd.h>
++
++#define RTC_NAME "rtc7301"
++#define RTC_VERSION "0.1"
++
++/* Epson RTC-7301 register addresses */
++#define RTC7301_SEC		0x00
++#define RTC7301_SEC10		0x01
++#define RTC7301_MIN		0x02
++#define RTC7301_MIN10		0x03
++#define RTC7301_HOUR		0x04
++#define RTC7301_HOUR10		0x05
++#define RTC7301_WEEKDAY		0x06
++#define RTC7301_DAY		0x07
++#define RTC7301_DAY10		0x08
++#define RTC7301_MON		0x09
++#define RTC7301_MON10		0x0A
++#define RTC7301_YEAR		0x0B
++#define RTC7301_YEAR10		0x0C
++#define RTC7301_YEAR100		0x0D
++#define RTC7301_YEAR1000	0x0E
++#define RTC7301_CTRLREG		0x0F
++
++static uint8_t __iomem *rtc7301_base;
++
++#define read_reg(offset) (readb(rtc7301_base + offset) & 0xf)
++#define write_reg(offset, data) writeb(data, rtc7301_base + (offset))
++
++#define rtc7301_isbusy() (read_reg(RTC7301_CTRLREG) & 1)
++
++static void rtc7301_init_settings(void)
++{
++	int i;
++
++	write_reg(RTC7301_CTRLREG, 2);
++	write_reg(RTC7301_YEAR1000, 2);
++	udelay(122);
++
++	/* bank 1 */
++	write_reg(RTC7301_CTRLREG, 6);
++	for (i=0; i<15; i++)
++		write_reg(i, 0);
++
++	/* bank 2 */
++	write_reg(RTC7301_CTRLREG, 14);
++	for (i=0; i<15; i++)
++		write_reg(i, 0);
++	write_reg(RTC7301_CTRLREG, 0);
++}
++
++static int rtc7301_get_datetime(struct device *dev, struct rtc_time *dt)
++{
++	int cnt;
++	uint8_t buf[16];
++
++	cnt = 0;
++	while (rtc7301_isbusy()) {
++		udelay(244);
++		if (cnt++ > 100) {
++			dev_err(dev, "%s: timeout error %x\n", __func__, rtc7301_base[RTC7301_CTRLREG]);
++			return -EIO;
++		}
++	}
++
++	for (cnt=0; cnt<16; cnt++)
++		buf[cnt] = read_reg(cnt);
++
++	if (buf[RTC7301_SEC10] & 8) {
++		dev_err(dev, "%s: RTC not set\n", __func__);
++		return -EINVAL;
++	}
++
++	memset(dt, 0, sizeof(*dt));
++
++	dt->tm_sec =  buf[RTC7301_SEC] + buf[RTC7301_SEC10]*10;
++	dt->tm_min =  buf[RTC7301_MIN] + buf[RTC7301_MIN10]*10;
++	dt->tm_hour = buf[RTC7301_HOUR] + buf[RTC7301_HOUR10]*10;
++
++	dt->tm_mday = buf[RTC7301_DAY] + buf[RTC7301_DAY10]*10;
++	dt->tm_mon =  buf[RTC7301_MON] + buf[RTC7301_MON10]*10 - 1;
++	dt->tm_year = buf[RTC7301_YEAR] + buf[RTC7301_YEAR10]*10 +
++		      buf[RTC7301_YEAR100]*100 +
++		      ((buf[RTC7301_YEAR1000] & 3)*1000) - 1900;
++
++	/* the rtc device may contain illegal values on power up
++	 * according to the data sheet. make sure they are valid.
++	 */
++
++	return rtc_valid_tm(dt);
++}
++
++static int rtc7301_set_datetime(struct device *dev, struct rtc_time *dt)
++{
++	int data;
++
++	data = dt->tm_year + 1900;
++	if (data >= 2100 || data < 1900)
++		return -EINVAL;
++
++	write_reg(RTC7301_CTRLREG, 2);
++       	udelay(122);
++
++	data = bin2bcd(dt->tm_sec);
++	write_reg(RTC7301_SEC, data);
++	write_reg(RTC7301_SEC10, (data >> 4));
++
++	data = bin2bcd(dt->tm_min);
++	write_reg(RTC7301_MIN, data );
++	write_reg(RTC7301_MIN10, (data >> 4));
++
++	data = bin2bcd(dt->tm_hour);
++	write_reg(RTC7301_HOUR, data);
++	write_reg(RTC7301_HOUR10, (data >> 4));
++
++	data = bin2bcd(dt->tm_mday);
++	write_reg(RTC7301_DAY, data);
++	write_reg(RTC7301_DAY10, (data>> 4));
++
++	data = bin2bcd(dt->tm_mon + 1);
++	write_reg(RTC7301_MON, data);
++	write_reg(RTC7301_MON10, (data >> 4));
++
++	data = bin2bcd(dt->tm_year % 100);
++	write_reg(RTC7301_YEAR, data);
++	write_reg(RTC7301_YEAR10, (data >> 4));
++	data = bin2bcd((1900 + dt->tm_year) / 100);
++	write_reg(RTC7301_YEAR100, data);
++
++	data = bin2bcd(dt->tm_wday);
++	write_reg(RTC7301_WEEKDAY, data);
++
++	write_reg(RTC7301_CTRLREG, 0);
++
++	return 0;
++}
++
++static const struct rtc_class_ops rtc7301_rtc_ops = {
++	.read_time	= rtc7301_get_datetime,
++	.set_time	= rtc7301_set_datetime,
++};
++
++static int __devinit rtc7301_probe(struct platform_device *pdev)
++{
++	struct rtc_device *rtc;
++	struct resource *res;
++
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	if (!res)
++		return -ENOENT;
++
++	rtc7301_base = ioremap_nocache(res->start, 0x1000 /*res->end - res->start + 1*/);
++	if (!rtc7301_base)
++		return -EINVAL;
++
++	rtc = rtc_device_register(RTC_NAME, &pdev->dev,
++				&rtc7301_rtc_ops, THIS_MODULE);
++	if (IS_ERR(rtc)) {
++		iounmap(rtc7301_base);
++		return PTR_ERR(rtc);
++	}
++
++	platform_set_drvdata(pdev, rtc);
++
++	rtc7301_init_settings();
++	return 0;
++}
++
++static int __devexit rtc7301_remove(struct platform_device *pdev)
++{
++	struct rtc_device *rtc = platform_get_drvdata(pdev);
++
++	if (rtc)
++		rtc_device_unregister(rtc);
++	if (rtc7301_base)
++		iounmap(rtc7301_base);
++	return 0;
++}
++
++static struct platform_driver rtc7301_driver = {
++	.driver = {
++		.name	= RTC_NAME,
++		.owner	= THIS_MODULE,
++	},
++	.probe	= rtc7301_probe,
++	.remove = __devexit_p(rtc7301_remove),
++};
++
++static __init int rtc7301_init(void)
++{
++	return platform_driver_register(&rtc7301_driver);
++}
++module_init(rtc7301_init);
++
++static __exit void rtc7301_exit(void)
++{
++	platform_driver_unregister(&rtc7301_driver);
++}
++module_exit(rtc7301_exit);
++
++MODULE_DESCRIPTION("Epson 7301 RTC driver");
++MODULE_AUTHOR("Jose Vasconcellos <jvasco@verizon.net>");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:" RTC_NAME);
++MODULE_VERSION(RTC_VERSION);
diff --git a/target/linux/generic/patches-3.3/841-rtc_pt7c4338.patch b/target/linux/generic/patches-3.3/841-rtc_pt7c4338.patch
new file mode 100644
index 0000000..2c9e603
--- /dev/null
+++ b/target/linux/generic/patches-3.3/841-rtc_pt7c4338.patch
@@ -0,0 +1,247 @@
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -379,6 +379,15 @@ config RTC_DRV_RV3029C2
+ 	  This driver can also be built as a module. If so, the module
+ 	  will be called rtc-rv3029c2.
+ 
++config RTC_DRV_PT7C4338
++	tristate "Pericom Technology Inc. PT7C4338 RTC"
++	help
++	  If you say yes here you get support for the Pericom Technology
++	  Inc. PT7C4338 RTC chip.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called rtc-pt7c4338.
++
+ endif # I2C
+ 
+ comment "SPI RTC drivers"
+--- a/drivers/rtc/Makefile
++++ b/drivers/rtc/Makefile
+@@ -79,6 +79,7 @@ obj-$(CONFIG_RTC_DRV_PL030)	+= rtc-pl030
+ obj-$(CONFIG_RTC_DRV_PL031)	+= rtc-pl031.o
+ obj-$(CONFIG_RTC_DRV_PM8XXX)	+= rtc-pm8xxx.o
+ obj-$(CONFIG_RTC_DRV_PS3)	+= rtc-ps3.o
++obj-$(CONFIG_RTC_DRV_PT7C4338)	+= rtc-pt7c4338.o
+ obj-$(CONFIG_RTC_DRV_PUV3)	+= rtc-puv3.o
+ obj-$(CONFIG_RTC_DRV_PXA)	+= rtc-pxa.o
+ obj-$(CONFIG_RTC_DRV_R9701)	+= rtc-r9701.o
+--- /dev/null
++++ b/drivers/rtc/rtc-pt7c4338.c
+@@ -0,0 +1,216 @@
++/*
++ * Copyright 2010 Freescale Semiconductor, Inc.
++ *
++ * Author:	Priyanka Jain <Priyanka.Jain@freescale.com>
++ *
++ * See file CREDITS for list of people who contributed to this
++ * project.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of
++ * the License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
++ * MA 02111-1307 USA
++ */
++
++/*
++ * This file provides Date & Time support (no alarms) for PT7C4338 chip.
++ *
++ * This file is based on drivers/rtc/rtc-ds1307.c
++ *
++ * PT7C4338 chip is manufactured by Pericom Technology Inc.
++ * It is a serial real-time clock which provides
++ * 1)Low-power clock/calendar.
++ * 2)Programmable square-wave output.
++ * It has 56 bytes of nonvolatile RAM.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/i2c.h>
++#include <linux/rtc.h>
++#include <linux/bcd.h>
++
++/* RTC register addresses */
++#define PT7C4338_REG_SECONDS          0x00
++#define PT7C4338_REG_MINUTES          0x01
++#define PT7C4338_REG_HOURS            0x02
++#define PT7C4338_REG_AMPM             0x02
++#define PT7C4338_REG_DAY              0x03
++#define PT7C4338_REG_DATE             0x04
++#define PT7C4338_REG_MONTH            0x05
++#define PT7C4338_REG_YEAR             0x06
++#define PT7C4338_REG_CTRL_STAT        0x07
++
++/* RTC second register address bit */
++#define PT7C4338_SEC_BIT_CH           0x80	/*Clock Halt (in Register 0)*/
++
++/* RTC control and status register bits */
++#define PT7C4338_CTRL_STAT_BIT_RS0    0x1	/*Rate select 0*/
++#define PT7C4338_CTRL_STAT_BIT_RS1    0x2	/*Rate select 1*/
++#define PT7C4338_CTRL_STAT_BIT_SQWE   0x10	/*Square Wave Enable*/
++#define PT7C4338_CTRL_STAT_BIT_OSF    0x20	/*Oscillator Stop Flag*/
++#define PT7C4338_CTRL_STAT_BIT_OUT    0x80	/*Output Level Control*/
++
++static const struct i2c_device_id pt7c4338_id[] = {
++	{ "pt7c4338", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, pt7c4338_id);
++
++struct pt7c4338{
++	struct i2c_client *client;
++	struct rtc_device *rtc;
++};
++
++static int pt7c4338_read_time(struct device *dev, struct rtc_time *time)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	int ret;
++	u8 buf[7];
++	u8 year, month, day, hour, minute, second;
++	u8 week, twelve_hr, am_pm;
++
++	ret = i2c_smbus_read_i2c_block_data(client,
++			PT7C4338_REG_SECONDS, 7, buf);
++	if (ret < 0)
++		return ret;
++	if (ret < 7)
++		return -EIO;
++
++	second = buf[0];
++	minute = buf[1];
++	hour = buf[2];
++	week = buf[3];
++	day = buf[4];
++	month = buf[5];
++	year = buf[6];
++
++	/* Extract additional information for AM/PM */
++	twelve_hr = hour & 0x40;
++	am_pm = hour & 0x20;
++
++	/* Write to rtc_time structure */
++	time->tm_sec = bcd2bin(second & 0x7f);
++	time->tm_min = bcd2bin(minute & 0x7f);
++	if (twelve_hr) {
++		/* Convert to 24 hr */
++		if (am_pm)
++			time->tm_hour = bcd2bin(hour & 0x10) + 12;
++		else
++			time->tm_hour = bcd2bin(hour & 0xBF);
++	} else {
++		time->tm_hour = bcd2bin(hour);
++	}
++
++	time->tm_wday = bcd2bin(week & 0x07) - 1;
++	time->tm_mday = bcd2bin(day & 0x3f);
++	time->tm_mon = bcd2bin(month & 0x1F) - 1;
++	/* assume 20YY not 19YY */
++	time->tm_year = bcd2bin(year) + 100;
++
++	return 0;
++}
++
++static int pt7c4338_set_time(struct device *dev, struct rtc_time *time)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	u8 buf[7];
++
++	/* Extract time from rtc_time and load into pt7c4338*/
++	buf[0] = bin2bcd(time->tm_sec);
++	buf[1] = bin2bcd(time->tm_min);
++	buf[2] = bin2bcd(time->tm_hour);
++	buf[3] = bin2bcd(time->tm_wday + 1); /* Day of the week */
++	buf[4] = bin2bcd(time->tm_mday); /* Date */
++	buf[5] = bin2bcd(time->tm_mon + 1);
++
++	/* assume 20YY not 19YY */
++	if (time->tm_year >= 100)
++		buf[6] = bin2bcd(time->tm_year - 100);
++	else
++		buf[6] = bin2bcd(time->tm_year);
++
++	return i2c_smbus_write_i2c_block_data(client,
++					PT7C4338_REG_SECONDS, 7, buf);
++}
++
++static const struct rtc_class_ops pt7c4338_rtc_ops = {
++	.read_time = pt7c4338_read_time,
++	.set_time = pt7c4338_set_time,
++};
++
++static int pt7c4338_probe(struct i2c_client *client,
++		const struct i2c_device_id *id)
++{
++	struct pt7c4338 *pt7c4338;
++	struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
++	int ret;
++
++	pt7c4338 = kzalloc(sizeof(struct pt7c4338), GFP_KERNEL);
++	if (!pt7c4338)
++		return -ENOMEM;
++
++	pt7c4338->client = client;
++	i2c_set_clientdata(client, pt7c4338);
++	pt7c4338->rtc = rtc_device_register(client->name, &client->dev,
++					&pt7c4338_rtc_ops, THIS_MODULE);
++	if (IS_ERR(pt7c4338->rtc)) {
++		ret = PTR_ERR(pt7c4338->rtc);
++		dev_err(&client->dev, "unable to register the class device\n");
++		goto out_free;
++	}
++
++	return 0;
++out_free:
++	i2c_set_clientdata(client, NULL);
++	kfree(pt7c4338);
++	return ret;
++}
++
++static int __devexit pt7c4338_remove(struct i2c_client *client)
++{
++	struct pt7c4338 *pt7c4338 = i2c_get_clientdata(client);
++
++	rtc_device_unregister(pt7c4338->rtc);
++	i2c_set_clientdata(client, NULL);
++	kfree(pt7c4338);
++	return 0;
++}
++
++static struct i2c_driver pt7c4338_driver = {
++	.driver = {
++		.name = "rtc-pt7c4338",
++		.owner = THIS_MODULE,
++	},
++	.probe = pt7c4338_probe,
++	.remove = __devexit_p(pt7c4338_remove),
++	.id_table = pt7c4338_id,
++};
++
++static int __init pt7c4338_init(void)
++{
++	return i2c_add_driver(&pt7c4338_driver);
++}
++
++static void __exit pt7c4338_exit(void)
++{
++	i2c_del_driver(&pt7c4338_driver);
++}
++
++module_init(pt7c4338_init);
++module_exit(pt7c4338_exit);
++
++MODULE_AUTHOR("Priyanka Jain <Priyanka.Jain@freescale.com>");
++MODULE_DESCRIPTION("pericom Technology Inc. PT7C4338 RTC Driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/patches-3.3/850-glamo_headers.patch b/target/linux/generic/patches-3.3/850-glamo_headers.patch
new file mode 100644
index 0000000..d6d49fd
--- /dev/null
+++ b/target/linux/generic/patches-3.3/850-glamo_headers.patch
@@ -0,0 +1,21 @@
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -127,6 +127,7 @@
+ #define FB_ACCEL_TRIDENT_BLADE3D 52	/* Trident Blade3D		*/
+ #define FB_ACCEL_TRIDENT_BLADEXP 53	/* Trident BladeXP		*/
+ #define FB_ACCEL_CIRRUS_ALPINE   53	/* Cirrus Logic 543x/544x/5480	*/
++#define FB_ACCEL_GLAMO		50	/* SMedia Glamo                 */
+ #define FB_ACCEL_NEOMAGIC_NM2070 90	/* NeoMagic NM2070              */
+ #define FB_ACCEL_NEOMAGIC_NM2090 91	/* NeoMagic NM2090              */
+ #define FB_ACCEL_NEOMAGIC_NM2093 92	/* NeoMagic NM2093              */
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -145,6 +145,8 @@ header-y += generic_serial.h
+ header-y += genetlink.h
+ header-y += gfs2_ondisk.h
+ header-y += gigaset_dev.h
++header-y += glamofb.h
++header-y += glamo-engine.h
+ header-y += hdlc.h
+ header-y += hdlcdrv.h
+ header-y += hdreg.h
diff --git a/target/linux/generic/patches-3.3/861-04_spi_gpio_implement_spi_delay.patch b/target/linux/generic/patches-3.3/861-04_spi_gpio_implement_spi_delay.patch
new file mode 100644
index 0000000..7828869
--- /dev/null
+++ b/target/linux/generic/patches-3.3/861-04_spi_gpio_implement_spi_delay.patch
@@ -0,0 +1,58 @@
+Implement the SPI-GPIO delay function for busses that need speed limitation.
+
+--mb
+
+
+
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -22,6 +22,7 @@
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
+ #include <linux/gpio.h>
++#include <linux/delay.h>
+ 
+ #include <linux/spi/spi.h>
+ #include <linux/spi/spi_bitbang.h>
+@@ -70,6 +71,7 @@ struct spi_gpio {
+  *		#define	SPI_MOSI_GPIO	120
+  *		#define	SPI_SCK_GPIO	121
+  *		#define	SPI_N_CHIPSEL	4
++ *		#undef NEED_SPIDELAY
+  *		#include "spi-gpio.c"
+  */
+ 
+@@ -77,6 +79,7 @@ struct spi_gpio {
+ #define DRIVER_NAME	"spi_gpio"
+ 
+ #define GENERIC_BITBANG	/* vs tight inlines */
++#define NEED_SPIDELAY	1
+ 
+ /* all functions referencing these symbols must define pdata */
+ #define SPI_MISO_GPIO	((pdata)->miso)
+@@ -121,12 +124,20 @@ static inline int getmiso(const struct s
+ #undef pdata
+ 
+ /*
+- * NOTE:  this clocks "as fast as we can".  It "should" be a function of the
+- * requested device clock.  Software overhead means we usually have trouble
+- * reaching even one Mbit/sec (except when we can inline bitops), so for now
+- * we'll just assume we never need additional per-bit slowdowns.
++ * NOTE:  to clock "as fast as we can", set spi_device.max_speed_hz
++ * and spi_transfer.speed_hz to 0.
++ * Otherwise this is a function of the requested device clock.
++ * Software overhead means we usually have trouble
++ * reaching even one Mbit/sec (except when we can inline bitops). So on small
++ * embedded devices with fast SPI slaves you usually don't need a delay.
+  */
+-#define spidelay(nsecs)	do {} while (0)
++static inline void spidelay(unsigned nsecs)
++{
++#ifdef NEED_SPIDELAY
++	if (unlikely(nsecs))
++		ndelay(nsecs);
++#endif /* NEED_SPIDELAY */
++}
+ 
+ #include "spi-bitbang-txrx.h"
+ 
diff --git a/target/linux/generic/patches-3.3/862-gpio_spi_driver.patch b/target/linux/generic/patches-3.3/862-gpio_spi_driver.patch
new file mode 100644
index 0000000..6cbea32
--- /dev/null
+++ b/target/linux/generic/patches-3.3/862-gpio_spi_driver.patch
@@ -0,0 +1,373 @@
+THIS CODE IS DEPRECATED.
+
+Please use the new mainline SPI-GPIO driver, as of 2.6.29.
+
+--mb
+
+
+
+---
+ drivers/spi/Kconfig              |    9 +
+ drivers/spi/Makefile             |    1 
+ drivers/spi/spi_gpio_old.c       |  251 +++++++++++++++++++++++++++++++++++++++
+ include/linux/spi/spi_gpio_old.h |   73 +++++++++++
+ 4 files changed, 334 insertions(+)
+
+--- /dev/null
++++ b/include/linux/spi/spi_gpio_old.h
+@@ -0,0 +1,73 @@
++/*
++ * spi_gpio interface to platform code
++ *
++ * Copyright (c) 2008 Piotr Skamruk
++ * Copyright (c) 2008 Michael Buesch
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++#ifndef _LINUX_SPI_SPI_GPIO
++#define _LINUX_SPI_SPI_GPIO
++
++#include <linux/types.h>
++#include <linux/spi/spi.h>
++
++
++/**
++ * struct spi_gpio_platform_data - Data definitions for a SPI-GPIO device.
++ *
++ * This structure holds information about a GPIO-based SPI device.
++ *
++ * @pin_clk: The GPIO pin number of the CLOCK pin.
++ *
++ * @pin_miso: The GPIO pin number of the MISO pin.
++ *
++ * @pin_mosi: The GPIO pin number of the MOSI pin.
++ *
++ * @pin_cs: The GPIO pin number of the CHIPSELECT pin.
++ *
++ * @cs_activelow: If true, the chip is selected when the CS line is low.
++ *
++ * @no_spi_delay: If true, no delay is done in the lowlevel bitbanging.
++ *                Note that doing no delay is not standards compliant,
++ *                but it might be needed to speed up transfers on some
++ *                slow embedded machines.
++ *
++ * @boardinfo_setup: This callback is called after the
++ *                   SPI master device was registered, but before the
++ *                   device is registered.
++ * @boardinfo_setup_data: Data argument passed to boardinfo_setup().
++ */
++struct spi_gpio_platform_data {
++	unsigned int pin_clk;
++	unsigned int pin_miso;
++	unsigned int pin_mosi;
++	unsigned int pin_cs;
++	bool cs_activelow;
++	bool no_spi_delay;
++	int (*boardinfo_setup)(struct spi_board_info *bi,
++			       struct spi_master *master,
++			       void *data);
++	void *boardinfo_setup_data;
++};
++
++/**
++ * SPI_GPIO_PLATDEV_NAME - The platform device name string.
++ *
++ * The name string that has to be used for platform_device_alloc
++ * when allocating a spi-gpio device.
++ */
++#define SPI_GPIO_PLATDEV_NAME	"spi-gpio"
++
++/**
++ * spi_gpio_next_id - Get another platform device ID number.
++ *
++ * This returns the next platform device ID number that has to be used
++ * for platform_device_alloc. The ID is opaque and should not be used for
++ * anything else.
++ */
++int spi_gpio_next_id(void);
++
++#endif /* _LINUX_SPI_SPI_GPIO */
+--- /dev/null
++++ b/drivers/spi/spi_gpio_old.c
+@@ -0,0 +1,251 @@
++/*
++ * Bitbanging SPI bus driver using GPIO API
++ *
++ * Copyright (c) 2008 Piotr Skamruk
++ * Copyright (c) 2008 Michael Buesch
++ *
++ * based on spi_s3c2410_gpio.c
++ *   Copyright (c) 2006 Ben Dooks
++ *   Copyright (c) 2006 Simtec Electronics
++ * and on i2c-gpio.c
++ *   Copyright (C) 2007 Atmel Corporation
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/spinlock.h>
++#include <linux/workqueue.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/spi/spi.h>
++#include <linux/spi/spi_bitbang.h>
++#include <linux/spi/spi_gpio_old.h>
++#include <linux/gpio.h>
++#include <asm/atomic.h>
++
++
++struct spi_gpio {
++	struct spi_bitbang bitbang;
++	struct spi_gpio_platform_data *info;
++	struct platform_device *pdev;
++	struct spi_board_info bi;
++};
++
++
++static inline struct spi_gpio *spidev_to_sg(struct spi_device *dev)
++{
++	return dev->controller_data;
++}
++
++static inline void setsck(struct spi_device *dev, int val)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++	gpio_set_value(sp->info->pin_clk, val ? 1 : 0);
++}
++
++static inline void setmosi(struct spi_device *dev, int val)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++	gpio_set_value(sp->info->pin_mosi, val ? 1 : 0);
++}
++
++static inline u32 getmiso(struct spi_device *dev)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++	return gpio_get_value(sp->info->pin_miso) ? 1 : 0;
++}
++
++static inline void do_spidelay(struct spi_device *dev, unsigned nsecs)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++
++	if (!sp->info->no_spi_delay)
++		ndelay(nsecs);
++}
++
++#define spidelay(nsecs) do {					\
++	/* Steal the spi_device pointer from our caller.	\
++	 * The bitbang-API should probably get fixed here... */	\
++	do_spidelay(spi, nsecs);				\
++  } while (0)
++
++#define EXPAND_BITBANG_TXRX
++#include "spi-bitbang-txrx.h"
++
++static u32 spi_gpio_txrx_mode0(struct spi_device *spi,
++			       unsigned nsecs, u32 word, u8 bits)
++{
++	return bitbang_txrx_be_cpha0(spi, nsecs, 0, 0, word, bits);
++}
++
++static u32 spi_gpio_txrx_mode1(struct spi_device *spi,
++			       unsigned nsecs, u32 word, u8 bits)
++{
++	return bitbang_txrx_be_cpha1(spi, nsecs, 0, 0, word, bits);
++}
++
++static u32 spi_gpio_txrx_mode2(struct spi_device *spi,
++			       unsigned nsecs, u32 word, u8 bits)
++{
++	return bitbang_txrx_be_cpha0(spi, nsecs, 1, 0, word, bits);
++}
++
++static u32 spi_gpio_txrx_mode3(struct spi_device *spi,
++			       unsigned nsecs, u32 word, u8 bits)
++{
++	return bitbang_txrx_be_cpha1(spi, nsecs, 1, 0, word, bits);
++}
++
++static void spi_gpio_chipselect(struct spi_device *dev, int on)
++{
++	struct spi_gpio *sp = spidev_to_sg(dev);
++
++	if (sp->info->cs_activelow)
++		on = !on;
++	gpio_set_value(sp->info->pin_cs, on ? 1 : 0);
++}
++
++static int spi_gpio_probe(struct platform_device *pdev)
++{
++	struct spi_master *master;
++	struct spi_gpio_platform_data *pdata;
++	struct spi_gpio *sp;
++	struct spi_device *spidev;
++	int err;
++
++	pdata = pdev->dev.platform_data;
++	if (!pdata)
++		return -ENXIO;
++
++	err = -ENOMEM;
++	master = spi_alloc_master(&pdev->dev, sizeof(struct spi_gpio));
++	if (!master)
++		goto err_alloc_master;
++
++	sp = spi_master_get_devdata(master);
++	platform_set_drvdata(pdev, sp);
++	sp->info = pdata;
++
++	err = gpio_request(pdata->pin_clk, "spi_clock");
++	if (err)
++		goto err_request_clk;
++	err = gpio_request(pdata->pin_mosi, "spi_mosi");
++	if (err)
++		goto err_request_mosi;
++	err = gpio_request(pdata->pin_miso, "spi_miso");
++	if (err)
++		goto err_request_miso;
++	err = gpio_request(pdata->pin_cs, "spi_cs");
++	if (err)
++		goto err_request_cs;
++
++	sp->bitbang.master = spi_master_get(master);
++	sp->bitbang.master->bus_num = -1;
++	sp->bitbang.master->num_chipselect = 1;
++	sp->bitbang.chipselect = spi_gpio_chipselect;
++	sp->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_mode0;
++	sp->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_mode1;
++	sp->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_mode2;
++	sp->bitbang.txrx_word[SPI_MODE_3] = spi_gpio_txrx_mode3;
++
++	gpio_direction_output(pdata->pin_clk, 0);
++	gpio_direction_output(pdata->pin_mosi, 0);
++	gpio_direction_output(pdata->pin_cs,
++			      pdata->cs_activelow ? 1 : 0);
++	gpio_direction_input(pdata->pin_miso);
++
++	err = spi_bitbang_start(&sp->bitbang);
++	if (err)
++		goto err_no_bitbang;
++	err = pdata->boardinfo_setup(&sp->bi, master,
++				     pdata->boardinfo_setup_data);
++	if (err)
++		goto err_bi_setup;
++	sp->bi.controller_data = sp;
++	spidev = spi_new_device(master, &sp->bi);
++	if (!spidev)
++		goto err_new_dev;
++
++	return 0;
++
++err_new_dev:
++err_bi_setup:
++	spi_bitbang_stop(&sp->bitbang);
++err_no_bitbang:
++	spi_master_put(sp->bitbang.master);
++	gpio_free(pdata->pin_cs);
++err_request_cs:
++	gpio_free(pdata->pin_miso);
++err_request_miso:
++	gpio_free(pdata->pin_mosi);
++err_request_mosi:
++	gpio_free(pdata->pin_clk);
++err_request_clk:
++	kfree(master);
++
++err_alloc_master:
++	return err;
++}
++
++static int __devexit spi_gpio_remove(struct platform_device *pdev)
++{
++	struct spi_gpio *sp;
++	struct spi_gpio_platform_data *pdata;
++
++	pdata = pdev->dev.platform_data;
++	sp = platform_get_drvdata(pdev);
++
++	gpio_free(pdata->pin_clk);
++	gpio_free(pdata->pin_mosi);
++	gpio_free(pdata->pin_miso);
++	gpio_free(pdata->pin_cs);
++	spi_bitbang_stop(&sp->bitbang);
++	spi_master_put(sp->bitbang.master);
++
++	return 0;
++}
++
++static struct platform_driver spi_gpio_driver = {
++	.driver		= {
++		.name	= SPI_GPIO_PLATDEV_NAME,
++		.owner	= THIS_MODULE,
++	},
++	.probe		= spi_gpio_probe,
++	.remove		= __devexit_p(spi_gpio_remove),
++};
++
++int spi_gpio_next_id(void)
++{
++	static atomic_t counter = ATOMIC_INIT(-1);
++
++	return atomic_inc_return(&counter);
++}
++EXPORT_SYMBOL(spi_gpio_next_id);
++
++static int __init spi_gpio_init(void)
++{
++	int err;
++
++	err = platform_driver_register(&spi_gpio_driver);
++	if (err)
++		printk(KERN_ERR "spi-gpio: register failed: %d\n", err);
++
++	return err;
++}
++module_init(spi_gpio_init);
++
++static void __exit spi_gpio_exit(void)
++{
++	platform_driver_unregister(&spi_gpio_driver);
++}
++module_exit(spi_gpio_exit);
++
++MODULE_AUTHOR("Piot Skamruk <piotr.skamruk at gmail.com>");
++MODULE_AUTHOR("Michael Buesch");
++MODULE_DESCRIPTION("Platform independent GPIO bitbanging SPI driver");
++MODULE_LICENSE("GPL v2");
+--- a/drivers/spi/Kconfig
++++ b/drivers/spi/Kconfig
+@@ -154,6 +154,15 @@ config SPI_GPIO
+ 	  GPIO operations, you should be able to leverage that for better
+ 	  speed with a custom version of this driver; see the source code.
+ 
++config SPI_GPIO_OLD
++	tristate "Old GPIO API based bitbanging SPI controller (DEPRECATED)"
++	depends on SPI_MASTER && GENERIC_GPIO
++	select SPI_BITBANG
++	help
++	  This code is deprecated. Please use the new mainline SPI-GPIO driver.
++
++	  If unsure, say N.
++
+ config SPI_IMX
+ 	tristate "Freescale i.MX SPI controllers"
+ 	depends on ARCH_MXC
+--- a/drivers/spi/Makefile
++++ b/drivers/spi/Makefile
+@@ -29,6 +29,7 @@ obj-$(CONFIG_SPI_FSL_LIB)		+= spi-fsl-li
+ obj-$(CONFIG_SPI_FSL_ESPI)		+= spi-fsl-espi.o
+ obj-$(CONFIG_SPI_FSL_SPI)		+= spi-fsl-spi.o
+ obj-$(CONFIG_SPI_GPIO)			+= spi-gpio.o
++obj-$(CONFIG_SPI_GPIO_OLD)		+= spi_gpio_old.o
+ obj-$(CONFIG_SPI_IMX)			+= spi-imx.o
+ obj-$(CONFIG_SPI_LM70_LLP)		+= spi-lm70llp.o
+ obj-$(CONFIG_SPI_MPC512x_PSC)		+= spi-mpc512x-psc.o
diff --git a/target/linux/generic/patches-3.3/863-gpiommc.patch b/target/linux/generic/patches-3.3/863-gpiommc.patch
new file mode 100644
index 0000000..3260671
--- /dev/null
+++ b/target/linux/generic/patches-3.3/863-gpiommc.patch
@@ -0,0 +1,844 @@
+--- /dev/null
++++ b/drivers/mmc/host/gpiommc.c
+@@ -0,0 +1,609 @@
++/*
++ * Driver an MMC/SD card on a bitbanging GPIO SPI bus.
++ * This module hooks up the mmc_spi and spi_gpio modules and also
++ * provides a configfs interface.
++ *
++ * Copyright 2008 Michael Buesch <mb@bu3sch.de>
++ *
++ * Licensed under the GNU/GPL. See COPYING for details.
++ */
++
++#include <linux/module.h>
++#include <linux/mmc/gpiommc.h>
++#include <linux/platform_device.h>
++#include <linux/list.h>
++#include <linux/mutex.h>
++#include <linux/spi/spi_gpio_old.h>
++#include <linux/configfs.h>
++#include <linux/gpio.h>
++#include <asm/atomic.h>
++
++
++#define PFX				"gpio-mmc: "
++
++
++struct gpiommc_device {
++	struct platform_device *pdev;
++	struct platform_device *spi_pdev;
++	struct spi_board_info boardinfo;
++};
++
++
++MODULE_DESCRIPTION("GPIO based MMC driver");
++MODULE_AUTHOR("Michael Buesch");
++MODULE_LICENSE("GPL");
++
++
++static int gpiommc_boardinfo_setup(struct spi_board_info *bi,
++				   struct spi_master *master,
++				   void *data)
++{
++	struct gpiommc_device *d = data;
++	struct gpiommc_platform_data *pdata = d->pdev->dev.platform_data;
++
++	/* Bind the SPI master to the MMC-SPI host driver. */
++	strlcpy(bi->modalias, "mmc_spi", sizeof(bi->modalias));
++
++	bi->max_speed_hz = pdata->max_bus_speed;
++	bi->bus_num = master->bus_num;
++	bi->mode = pdata->mode;
++
++	return 0;
++}
++
++static int gpiommc_probe(struct platform_device *pdev)
++{
++	struct gpiommc_platform_data *mmc_pdata = pdev->dev.platform_data;
++	struct spi_gpio_platform_data spi_pdata;
++	struct gpiommc_device *d;
++	int err;
++
++	err = -ENXIO;
++	if (!mmc_pdata)
++		goto error;
++
++#ifdef CONFIG_MMC_SPI_MODULE
++	err = request_module("mmc_spi");
++	if (err) {
++		printk(KERN_WARNING PFX
++		       "Failed to request mmc_spi module.\n");
++	}
++#endif /* CONFIG_MMC_SPI_MODULE */
++
++	/* Allocate the GPIO-MMC device */
++	err = -ENOMEM;
++	d = kzalloc(sizeof(*d), GFP_KERNEL);
++	if (!d)
++		goto error;
++	d->pdev = pdev;
++
++	/* Create the SPI-GPIO device */
++	d->spi_pdev = platform_device_alloc(SPI_GPIO_PLATDEV_NAME,
++					    spi_gpio_next_id());
++	if (!d->spi_pdev)
++		goto err_free_d;
++
++	memset(&spi_pdata, 0, sizeof(spi_pdata));
++	spi_pdata.pin_clk = mmc_pdata->pins.gpio_clk;
++	spi_pdata.pin_miso = mmc_pdata->pins.gpio_do;
++	spi_pdata.pin_mosi = mmc_pdata->pins.gpio_di;
++	spi_pdata.pin_cs = mmc_pdata->pins.gpio_cs;
++	spi_pdata.cs_activelow = mmc_pdata->pins.cs_activelow;
++	spi_pdata.no_spi_delay = mmc_pdata->no_spi_delay;
++	spi_pdata.boardinfo_setup = gpiommc_boardinfo_setup;
++	spi_pdata.boardinfo_setup_data = d;
++
++	err = platform_device_add_data(d->spi_pdev, &spi_pdata,
++				       sizeof(spi_pdata));
++	if (err)
++		goto err_free_pdev;
++	err = platform_device_add(d->spi_pdev);
++	if (err)
++		goto err_free_pdata;
++	platform_set_drvdata(pdev, d);
++
++	printk(KERN_INFO PFX "MMC-Card \"%s\" "
++	       "attached to GPIO pins di=%u, do=%u, clk=%u, cs=%u\n",
++	       mmc_pdata->name, mmc_pdata->pins.gpio_di,
++	       mmc_pdata->pins.gpio_do,
++	       mmc_pdata->pins.gpio_clk,
++	       mmc_pdata->pins.gpio_cs);
++
++	return 0;
++
++err_free_pdata:
++	kfree(d->spi_pdev->dev.platform_data);
++	d->spi_pdev->dev.platform_data = NULL;
++err_free_pdev:
++	platform_device_put(d->spi_pdev);
++err_free_d:
++	kfree(d);
++error:
++	return err;
++}
++
++static int gpiommc_remove(struct platform_device *pdev)
++{
++	struct gpiommc_device *d = platform_get_drvdata(pdev);
++	struct gpiommc_platform_data *pdata = d->pdev->dev.platform_data;
++
++	platform_device_unregister(d->spi_pdev);
++	printk(KERN_INFO PFX "GPIO based MMC-Card \"%s\" removed\n",
++	       pdata->name);
++	platform_device_put(d->spi_pdev);
++
++	return 0;
++}
++
++#ifdef CONFIG_GPIOMMC_CONFIGFS
++
++/* A device that was created through configfs */
++struct gpiommc_configfs_device {
++	struct config_item item;
++	/* The platform device, after registration. */
++	struct platform_device *pdev;
++	/* The configuration */
++	struct gpiommc_platform_data pdata;
++};
++
++#define GPIO_INVALID	-1
++
++static inline bool gpiommc_is_registered(struct gpiommc_configfs_device *dev)
++{
++	return (dev->pdev != NULL);
++}
++
++static inline struct gpiommc_configfs_device *ci_to_gpiommc(struct config_item *item)
++{
++	return item ? container_of(item, struct gpiommc_configfs_device, item) : NULL;
++}
++
++static struct configfs_attribute gpiommc_attr_DI = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_data_in",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_DO = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_data_out",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_CLK = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_clock",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_CS = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_chipselect",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_CS_activelow = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "gpio_chipselect_activelow",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_spimode = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "spi_mode",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_spidelay = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "spi_delay",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_max_bus_speed = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "max_bus_speed",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute gpiommc_attr_register = {
++	.ca_owner = THIS_MODULE,
++	.ca_name = "register",
++	.ca_mode = S_IRUGO | S_IWUSR,
++};
++
++static struct configfs_attribute *gpiommc_config_attrs[] = {
++	&gpiommc_attr_DI,
++	&gpiommc_attr_DO,
++	&gpiommc_attr_CLK,
++	&gpiommc_attr_CS,
++	&gpiommc_attr_CS_activelow,
++	&gpiommc_attr_spimode,
++	&gpiommc_attr_spidelay,
++	&gpiommc_attr_max_bus_speed,
++	&gpiommc_attr_register,
++	NULL,
++};
++
++static ssize_t gpiommc_config_attr_show(struct config_item *item,
++					struct configfs_attribute *attr,
++					char *page)
++{
++	struct gpiommc_configfs_device *dev = ci_to_gpiommc(item);
++	ssize_t count = 0;
++	unsigned int gpio;
++	int err = 0;
++
++	if (attr == &gpiommc_attr_DI) {
++		gpio = dev->pdata.pins.gpio_di;
++		if (gpio == GPIO_INVALID)
++			count = snprintf(page, PAGE_SIZE, "not configured\n");
++		else
++			count = snprintf(page, PAGE_SIZE, "%u\n", gpio);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_DO) {
++		gpio = dev->pdata.pins.gpio_do;
++		if (gpio == GPIO_INVALID)
++			count = snprintf(page, PAGE_SIZE, "not configured\n");
++		else
++			count = snprintf(page, PAGE_SIZE, "%u\n", gpio);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CLK) {
++		gpio = dev->pdata.pins.gpio_clk;
++		if (gpio == GPIO_INVALID)
++			count = snprintf(page, PAGE_SIZE, "not configured\n");
++		else
++			count = snprintf(page, PAGE_SIZE, "%u\n", gpio);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CS) {
++		gpio = dev->pdata.pins.gpio_cs;
++		if (gpio == GPIO_INVALID)
++			count = snprintf(page, PAGE_SIZE, "not configured\n");
++		else
++			count = snprintf(page, PAGE_SIZE, "%u\n", gpio);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CS_activelow) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 dev->pdata.pins.cs_activelow);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_spimode) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 dev->pdata.mode);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_spidelay) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 !dev->pdata.no_spi_delay);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_max_bus_speed) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 dev->pdata.max_bus_speed);
++		goto out;
++	}
++	if (attr == &gpiommc_attr_register) {
++		count = snprintf(page, PAGE_SIZE, "%u\n",
++				 gpiommc_is_registered(dev));
++		goto out;
++	}
++	WARN_ON(1);
++	err = -ENOSYS;
++out:
++	return err ? err : count;
++}
++
++static int gpiommc_do_register(struct gpiommc_configfs_device *dev,
++			       const char *name)
++{
++	int err;
++
++	if (gpiommc_is_registered(dev))
++		return 0;
++
++	if (!gpio_is_valid(dev->pdata.pins.gpio_di) ||
++	    !gpio_is_valid(dev->pdata.pins.gpio_do) ||
++	    !gpio_is_valid(dev->pdata.pins.gpio_clk) ||
++	    !gpio_is_valid(dev->pdata.pins.gpio_cs)) {
++		printk(KERN_ERR PFX
++		       "configfs: Invalid GPIO pin number(s)\n");
++		return -EINVAL;
++	}
++
++	strlcpy(dev->pdata.name, name,
++		sizeof(dev->pdata.name));
++
++	dev->pdev = platform_device_alloc(GPIOMMC_PLATDEV_NAME,
++					  gpiommc_next_id());
++	if (!dev->pdev)
++		return -ENOMEM;
++	err = platform_device_add_data(dev->pdev, &dev->pdata,
++				       sizeof(dev->pdata));
++	if (err) {
++		platform_device_put(dev->pdev);
++		return err;
++	}
++	err = platform_device_add(dev->pdev);
++	if (err) {
++		platform_device_put(dev->pdev);
++		return err;
++	}
++
++	return 0;
++}
++
++static void gpiommc_do_unregister(struct gpiommc_configfs_device *dev)
++{
++	if (!gpiommc_is_registered(dev))
++		return;
++
++	platform_device_unregister(dev->pdev);
++	dev->pdev = NULL;
++}
++
++static ssize_t gpiommc_config_attr_store(struct config_item *item,
++					 struct configfs_attribute *attr,
++					 const char *page, size_t count)
++{
++	struct gpiommc_configfs_device *dev = ci_to_gpiommc(item);
++	int err = -EINVAL;
++	unsigned long data;
++
++	if (attr == &gpiommc_attr_register) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (data == 1)
++			err = gpiommc_do_register(dev, item->ci_name);
++		if (data == 0) {
++			gpiommc_do_unregister(dev);
++			err = 0;
++		}
++		goto out;
++	}
++
++	if (gpiommc_is_registered(dev)) {
++		/* The rest of the config parameters can only be set
++		 * as long as the device is not registered, yet. */
++		err = -EBUSY;
++		goto out;
++	}
++
++	if (attr == &gpiommc_attr_DI) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (!gpio_is_valid(data))
++			goto out;
++		dev->pdata.pins.gpio_di = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_DO) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (!gpio_is_valid(data))
++			goto out;
++		dev->pdata.pins.gpio_do = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CLK) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (!gpio_is_valid(data))
++			goto out;
++		dev->pdata.pins.gpio_clk = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CS) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (!gpio_is_valid(data))
++			goto out;
++		dev->pdata.pins.gpio_cs = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_CS_activelow) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (data != 0 && data != 1)
++			goto out;
++		dev->pdata.pins.cs_activelow = data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_spimode) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		switch (data) {
++		case 0:
++			dev->pdata.mode = SPI_MODE_0;
++			break;
++		case 1:
++			dev->pdata.mode = SPI_MODE_1;
++			break;
++		case 2:
++			dev->pdata.mode = SPI_MODE_2;
++			break;
++		case 3:
++			dev->pdata.mode = SPI_MODE_3;
++			break;
++		default:
++			goto out;
++		}
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_spidelay) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (data != 0 && data != 1)
++			goto out;
++		dev->pdata.no_spi_delay = !data;
++		err = 0;
++		goto out;
++	}
++	if (attr == &gpiommc_attr_max_bus_speed) {
++		err = strict_strtoul(page, 10, &data);
++		if (err)
++			goto out;
++		err = -EINVAL;
++		if (data > UINT_MAX)
++			goto out;
++		dev->pdata.max_bus_speed = data;
++		err = 0;
++		goto out;
++	}
++	WARN_ON(1);
++	err = -ENOSYS;
++out:
++	return err ? err : count;
++}
++
++static void gpiommc_config_item_release(struct config_item *item)
++{
++	struct gpiommc_configfs_device *dev = ci_to_gpiommc(item);
++
++	kfree(dev);
++}
++
++static struct configfs_item_operations gpiommc_config_item_ops = {
++	.release		= gpiommc_config_item_release,
++	.show_attribute		= gpiommc_config_attr_show,
++	.store_attribute	= gpiommc_config_attr_store,
++};
++
++static struct config_item_type gpiommc_dev_ci_type = {
++	.ct_item_ops	= &gpiommc_config_item_ops,
++	.ct_attrs	= gpiommc_config_attrs,
++	.ct_owner	= THIS_MODULE,
++};
++
++static struct config_item *gpiommc_make_item(struct config_group *group,
++					     const char *name)
++{
++	struct gpiommc_configfs_device *dev;
++
++	if (strlen(name) > GPIOMMC_MAX_NAMELEN) {
++		printk(KERN_ERR PFX "configfs: device name too long\n");
++		return NULL;
++	}
++
++	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
++	if (!dev)
++		return NULL;
++
++	config_item_init_type_name(&dev->item, name,
++				   &gpiommc_dev_ci_type);
++
++	/* Assign default configuration */
++	dev->pdata.pins.gpio_di = GPIO_INVALID;
++	dev->pdata.pins.gpio_do = GPIO_INVALID;
++	dev->pdata.pins.gpio_clk = GPIO_INVALID;
++	dev->pdata.pins.gpio_cs = GPIO_INVALID;
++	dev->pdata.pins.cs_activelow = 1;
++	dev->pdata.mode = SPI_MODE_0;
++	dev->pdata.no_spi_delay = 0;
++	dev->pdata.max_bus_speed = 5000000; /* 5 MHz */
++
++	return &(dev->item);
++}
++
++static void gpiommc_drop_item(struct config_group *group,
++			      struct config_item *item)
++{
++	struct gpiommc_configfs_device *dev = ci_to_gpiommc(item);
++
++	gpiommc_do_unregister(dev);
++	kfree(dev);
++}
++
++static struct configfs_group_operations gpiommc_ct_group_ops = {
++	.make_item	= gpiommc_make_item,
++	.drop_item	= gpiommc_drop_item,
++};
++
++static struct config_item_type gpiommc_ci_type = {
++	.ct_group_ops	= &gpiommc_ct_group_ops,
++	.ct_owner	= THIS_MODULE,
++};
++
++static struct configfs_subsystem gpiommc_subsys = {
++	.su_group = {
++		.cg_item = {
++			.ci_namebuf = GPIOMMC_PLATDEV_NAME,
++			.ci_type = &gpiommc_ci_type,
++		},
++	},
++	.su_mutex = __MUTEX_INITIALIZER(gpiommc_subsys.su_mutex),
++};
++
++#endif /* CONFIG_GPIOMMC_CONFIGFS */
++
++static struct platform_driver gpiommc_plat_driver = {
++	.probe	= gpiommc_probe,
++	.remove	= gpiommc_remove,
++	.driver	= {
++		.name	= GPIOMMC_PLATDEV_NAME,
++		.owner	= THIS_MODULE,
++	},
++};
++
++int gpiommc_next_id(void)
++{
++	static atomic_t counter = ATOMIC_INIT(-1);
++
++	return atomic_inc_return(&counter);
++}
++EXPORT_SYMBOL(gpiommc_next_id);
++
++static int __init gpiommc_modinit(void)
++{
++	int err;
++
++	err = platform_driver_register(&gpiommc_plat_driver);
++	if (err)
++		return err;
++
++#ifdef CONFIG_GPIOMMC_CONFIGFS
++	config_group_init(&gpiommc_subsys.su_group);
++	err = configfs_register_subsystem(&gpiommc_subsys);
++	if (err) {
++		platform_driver_unregister(&gpiommc_plat_driver);
++		return err;
++	}
++#endif /* CONFIG_GPIOMMC_CONFIGFS */
++
++	return 0;
++}
++module_init(gpiommc_modinit);
++
++static void __exit gpiommc_modexit(void)
++{
++#ifdef CONFIG_GPIOMMC_CONFIGFS
++	configfs_unregister_subsystem(&gpiommc_subsys);
++#endif
++	platform_driver_unregister(&gpiommc_plat_driver);
++}
++module_exit(gpiommc_modexit);
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -474,6 +474,31 @@ config MMC_SDHI
+ 	  This provides support for the SDHI SD/SDIO controller found in
+ 	  SuperH and ARM SH-Mobile SoCs
+ 
++config GPIOMMC
++	tristate "MMC/SD over GPIO-based SPI"
++	depends on MMC && MMC_SPI && SPI_GPIO_OLD
++	help
++	  This driver hooks up the mmc_spi and spi_gpio modules so that
++	  MMC/SD cards can be used on a GPIO based bus by bitbanging
++	  the SPI protocol in software.
++
++	  This driver provides a configfs interface to dynamically create
++	  and destroy GPIO-based MMC/SD card devices. It also provides
++	  a platform device interface API.
++	  See Documentation/gpiommc.txt for details.
++
++	  The module will be called gpiommc.
++
++	  If unsure, say N.
++
++config GPIOMMC_CONFIGFS
++	bool
++	depends on GPIOMMC && CONFIGFS_FS
++	default y
++	help
++	  This option automatically enables configfs support for gpiommc
++	  if configfs is available.
++
+ config MMC_CB710
+ 	tristate "ENE CB710 MMC/SD Interface support"
+ 	depends on PCI
+--- a/drivers/mmc/host/Makefile
++++ b/drivers/mmc/host/Makefile
+@@ -37,6 +37,7 @@ tmio_mmc_core-$(subst m,y,$(CONFIG_MMC_S
+ obj-$(CONFIG_MMC_SDHI)		+= sh_mobile_sdhi.o
+ obj-$(CONFIG_MMC_CB710)		+= cb710-mmc.o
+ obj-$(CONFIG_MMC_VIA_SDMMC)	+= via-sdmmc.o
++obj-$(CONFIG_GPIOMMC)		+= gpiommc.o
+ obj-$(CONFIG_SDH_BFIN)		+= bfin_sdh.o
+ obj-$(CONFIG_MMC_DW)		+= dw_mmc.o
+ obj-$(CONFIG_MMC_SH_MMCIF)	+= sh_mmcif.o
+--- /dev/null
++++ b/include/linux/mmc/gpiommc.h
+@@ -0,0 +1,71 @@
++/*
++ * Device driver for MMC/SD cards driven over a GPIO bus.
++ *
++ * Copyright (c) 2008 Michael Buesch
++ *
++ * Licensed under the GNU/GPL version 2.
++ */
++#ifndef LINUX_GPIOMMC_H_
++#define LINUX_GPIOMMC_H_
++
++#include <linux/types.h>
++
++
++#define GPIOMMC_MAX_NAMELEN		15
++#define GPIOMMC_MAX_NAMELEN_STR		__stringify(GPIOMMC_MAX_NAMELEN)
++
++/**
++ * struct gpiommc_pins - Hardware pin assignments
++ *
++ * @gpio_di: The GPIO number of the DATA IN pin
++ * @gpio_do: The GPIO number of the DATA OUT pin
++ * @gpio_clk: The GPIO number of the CLOCK pin
++ * @gpio_cs: The GPIO number of the CHIPSELECT pin
++ * @cs_activelow: If true, the chip is considered selected if @gpio_cs is low.
++ */
++struct gpiommc_pins {
++	unsigned int gpio_di;
++	unsigned int gpio_do;
++	unsigned int gpio_clk;
++	unsigned int gpio_cs;
++	bool cs_activelow;
++};
++
++/**
++ * struct gpiommc_platform_data - Platform data for a MMC-over-SPI-GPIO device.
++ *
++ * @name: The unique name string of the device.
++ * @pins: The hardware pin assignments.
++ * @mode: The hardware mode. This is either SPI_MODE_0,
++ *        SPI_MODE_1, SPI_MODE_2 or SPI_MODE_3. See the SPI documentation.
++ * @no_spi_delay: Do not use delays in the lowlevel SPI bitbanging code.
++ *                This is not standards compliant, but may be required for some
++ *                embedded machines to gain reasonable speed.
++ * @max_bus_speed: The maximum speed of the SPI bus, in Hertz.
++ */
++struct gpiommc_platform_data {
++	char name[GPIOMMC_MAX_NAMELEN + 1];
++	struct gpiommc_pins pins;
++	u8 mode;
++	bool no_spi_delay;
++	unsigned int max_bus_speed;
++};
++
++/**
++ * GPIOMMC_PLATDEV_NAME - The platform device name string.
++ *
++ * The name string that has to be used for platform_device_alloc
++ * when allocating a gpiommc device.
++ */
++#define GPIOMMC_PLATDEV_NAME	"gpiommc"
++
++/**
++ * gpiommc_next_id - Get another platform device ID number.
++ *
++ * This returns the next platform device ID number that has to be used
++ * for platform_device_alloc. The ID is opaque and should not be used for
++ * anything else.
++ */
++int gpiommc_next_id(void);
++
++#endif /* LINUX_GPIOMMC_H_ */
+--- /dev/null
++++ b/Documentation/gpiommc.txt
+@@ -0,0 +1,97 @@
++GPIOMMC - Driver for an MMC/SD card on a bitbanging GPIO SPI bus
++================================================================
++
++The gpiommc module hooks up the mmc_spi and spi_gpio modules for running an
++MMC or SD card on GPIO pins.
++
++Two interfaces for registering a new MMC/SD card device are provided:
++A static platform-device based mechanism and a dynamic configfs based interface.
++
++
++Registering devices via platform-device
++=======================================
++
++The platform-device interface is used for registering MMC/SD devices that are
++part of the hardware platform. This is most useful only for embedded machines
++with MMC/SD devices statically connected to the platform GPIO bus.
++
++The data structures are declared in <linux/mmc/gpiommc.h>.
++
++To register a new device, define an instance of struct gpiommc_platform_data.
++This structure holds any information about how the device is hooked up to the
++GPIO pins and what hardware modes the device supports. See the docbook-style
++documentation in the header file for more information on the struct fields.
++
++Then allocate a new instance of a platform device by doing:
++
++	pdev = platform_device_alloc(GPIOMMC_PLATDEV_NAME, gpiommc_next_id());
++
++This will allocate the platform device data structures and hook it up to the
++gpiommc driver.
++Then add the gpiommc_platform_data to the platform device.
++
++	err = platform_device_add_data(pdev, pdata, sizeof(struct gpiommc_platform_data));
++
++You may free the local instance of struct gpiommc_platform_data now. (So the
++struct may be allocated on the stack, too).
++Now simply register the platform device.
++
++	err = platform_device_add(pdev);
++
++Done. The gpiommc probe routine will be invoked now and you should see a kernel
++log message for the added device.
++
++
++Registering devices via configfs
++================================
++
++MMC/SD cards connected via GPIO often are a pretty dynamic thing, as for example
++selfmade hacks for soldering an MMC/SD card to standard GPIO pins on embedded
++hardware are a common situation.
++So we provide a dynamic interface to conveniently handle adding and removing
++devices from userspace, without the need to recompile the kernel.
++
++The "gpiommc" subdirectory at the configfs mountpoint is used for handling
++the dynamic configuration.
++
++To create a new device, it must first be allocated with mkdir.
++The following command will allocate a device named "my_mmc":
++	mkdir /config/gpiommc/my_mmc
++
++There are several configuration files available in the new
++/config/gpiommc/my_mmc/ directory:
++
++gpio_data_in			= The SPI data-IN GPIO pin number.
++gpio_data_out			= The SPI data-OUT GPIO pin number.
++gpio_clock			= The SPI Clock GPIO pin number.
++gpio_chipselect			= The SPI Chipselect GPIO pin number.
++gpio_chipselect_activelow	= Boolean. If 0, Chipselect is active-HIGH.
++				  If 1, Chipselect is active-LOW.
++spi_mode			= The SPI data mode. Can be 0-3.
++spi_delay			= Enable all delays in the lowlevel bitbanging.
++max_bus_speed			= The maximum SPI bus speed. In Hertz.
++
++register			= Not a configuration parameter.
++				  Used to register the configured card
++				  with the kernel.
++
++The device must first get configured and then registered by writing "1" to
++the "register" file.
++The configuration parameters "gpio_data_in", "gpio_data_out", "gpio_clock"
++and "gpio_chipselect" are essential and _must_ be configured before writing
++"1" to the "register" file. The registration will fail, otherwise.
++
++The default values for the other parameters are:
++gpio_chipselect_activelow	= 1		(CS active-LOW)
++spi_mode			= 0		(SPI_MODE_0)
++spi_delay			= 1		(enabled)
++max_bus_speed			= 5000000	(5 Mhz)
++
++Configuration values can not be changed after registration. To unregister
++the device, write a "0" to the "register" file. The configuration can be
++changed again after unregistering.
++
++To completely remove the device, simply rmdir the directory
++(/config/gpiommc/my_mmc in this example).
++There's no need to first unregister the device before removing it. That will
++be done automatically.
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -3045,6 +3045,11 @@ L:	linuxppc-dev@lists.ozlabs.org
+ S:	Odd Fixes
+ F:	drivers/tty/hvc/
+ 
++GPIOMMC DRIVER
++P:	Michael Buesch
++M:	mb@bu3sch.de
++S:	Maintained
++
+ HARDWARE MONITORING
+ M:	Jean Delvare <khali@linux-fr.org>
+ M:	Guenter Roeck <guenter.roeck@ericsson.com>
diff --git a/target/linux/generic/patches-3.3/864-gpiommc_configfs_locking.patch b/target/linux/generic/patches-3.3/864-gpiommc_configfs_locking.patch
new file mode 100644
index 0000000..d4201eb
--- /dev/null
+++ b/target/linux/generic/patches-3.3/864-gpiommc_configfs_locking.patch
@@ -0,0 +1,58 @@
+The gpiommc configfs context structure needs locking, as configfs
+does not lock access between files.
+
+--- a/drivers/mmc/host/gpiommc.c
++++ b/drivers/mmc/host/gpiommc.c
+@@ -144,6 +144,8 @@ struct gpiommc_configfs_device {
+ 	struct platform_device *pdev;
+ 	/* The configuration */
+ 	struct gpiommc_platform_data pdata;
++	/* Mutex to protect this structure */
++	struct mutex mutex;
+ };
+ 
+ #define GPIO_INVALID	-1
+@@ -234,6 +236,8 @@ static ssize_t gpiommc_config_attr_show(
+ 	unsigned int gpio;
+ 	int err = 0;
+ 
++	mutex_lock(&dev->mutex);
++
+ 	if (attr == &gpiommc_attr_DI) {
+ 		gpio = dev->pdata.pins.gpio_di;
+ 		if (gpio == GPIO_INVALID)
+@@ -294,6 +298,8 @@ static ssize_t gpiommc_config_attr_show(
+ 	WARN_ON(1);
+ 	err = -ENOSYS;
+ out:
++	mutex_unlock(&dev->mutex);
++
+ 	return err ? err : count;
+ }
+ 
+@@ -353,6 +359,8 @@ static ssize_t gpiommc_config_attr_store
+ 	int err = -EINVAL;
+ 	unsigned long data;
+ 
++	mutex_lock(&dev->mutex);
++
+ 	if (attr == &gpiommc_attr_register) {
+ 		err = strict_strtoul(page, 10, &data);
+ 		if (err)
+@@ -478,6 +486,8 @@ static ssize_t gpiommc_config_attr_store
+ 	WARN_ON(1);
+ 	err = -ENOSYS;
+ out:
++	mutex_unlock(&dev->mutex);
++
+ 	return err ? err : count;
+ }
+ 
+@@ -514,6 +524,7 @@ static struct config_item *gpiommc_make_
+ 	if (!dev)
+ 		return NULL;
+ 
++	mutex_init(&dev->mutex);
+ 	config_item_init_type_name(&dev->item, name,
+ 				   &gpiommc_dev_ci_type);
+ 
diff --git a/target/linux/generic/patches-3.3/865-gpiopwm.patch b/target/linux/generic/patches-3.3/865-gpiopwm.patch
new file mode 100644
index 0000000..015f14a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/865-gpiopwm.patch
@@ -0,0 +1,21 @@
+--- a/drivers/Kconfig
++++ b/drivers/Kconfig
+@@ -60,6 +60,8 @@ source "drivers/pinctrl/Kconfig"
+ 
+ source "drivers/gpio/Kconfig"
+ 
++source "drivers/pwm/Kconfig"
++
+ source "drivers/w1/Kconfig"
+ 
+ source "drivers/power/Kconfig"
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -8,6 +8,7 @@
+ # GPIO must come after pinctrl as gpios may need to mux pins etc
+ obj-y				+= pinctrl/
+ obj-y				+= gpio/
++obj-$(CONFIG_GENERIC_PWM)	+= pwm/
+ obj-$(CONFIG_PCI)		+= pci/
+ obj-$(CONFIG_PARISC)		+= parisc/
+ obj-$(CONFIG_RAPIDIO)		+= rapidio/
diff --git a/target/linux/generic/patches-3.3/870-hifn795x_byteswap.patch b/target/linux/generic/patches-3.3/870-hifn795x_byteswap.patch
new file mode 100644
index 0000000..3a37c95
--- /dev/null
+++ b/target/linux/generic/patches-3.3/870-hifn795x_byteswap.patch
@@ -0,0 +1,17 @@
+--- a/drivers/crypto/hifn_795x.c
++++ b/drivers/crypto/hifn_795x.c
+@@ -682,12 +682,12 @@ static inline u32 hifn_read_1(struct hif
+ 
+ static inline void hifn_write_0(struct hifn_device *dev, u32 reg, u32 val)
+ {
+-	writel((__force u32)cpu_to_le32(val), dev->bar[0] + reg);
++	writel(val, dev->bar[0] + reg);
+ }
+ 
+ static inline void hifn_write_1(struct hifn_device *dev, u32 reg, u32 val)
+ {
+-	writel((__force u32)cpu_to_le32(val), dev->bar[1] + reg);
++	writel(val, dev->bar[1] + reg);
+ }
+ 
+ static void hifn_wait_puc(struct hifn_device *dev)
diff --git a/target/linux/generic/patches-3.3/880-gateworks_system_controller.patch b/target/linux/generic/patches-3.3/880-gateworks_system_controller.patch
new file mode 100644
index 0000000..981610d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/880-gateworks_system_controller.patch
@@ -0,0 +1,339 @@
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -423,6 +423,15 @@ config SENSORS_GL520SM
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called gl520sm.
+ 
++config SENSORS_GSC
++	tristate "Gateworks System Controller"
++	depends on I2C && (ARCH_DAVINCI || ARCH_CNS3XXX || ARCH_IXP4XX)
++	help
++	  If you say yes here you get support for the Gateworks System Controller.
++
++	  This driver can also be built as a module. If so, the module
++	  will be called gsc.
++
+ config SENSORS_GPIO_FAN
+ 	tristate "GPIO fan"
+ 	depends on GENERIC_GPIO
+--- a/drivers/hwmon/Makefile
++++ b/drivers/hwmon/Makefile
+@@ -125,6 +125,7 @@ obj-$(CONFIG_SENSORS_W83L785TS)	+= w83l7
+ obj-$(CONFIG_SENSORS_W83L786NG)	+= w83l786ng.o
+ obj-$(CONFIG_SENSORS_WM831X)	+= wm831x-hwmon.o
+ obj-$(CONFIG_SENSORS_WM8350)	+= wm8350-hwmon.o
++obj-$(CONFIG_SENSORS_GSC)	+= gsc.o
+ 
+ obj-$(CONFIG_PMBUS)		+= pmbus/
+ 
+--- /dev/null
++++ b/drivers/hwmon/gsc.c
+@@ -0,0 +1,308 @@
++/*
++ * A hwmon driver for the Gateworks System Controller 
++ * Copyright (C) 2009 Gateworks Corporation
++ *
++ * Author: Chris Lang <clang@gateworks.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License,
++ * as published by the Free Software Foundation - version 2.
++ */
++
++#include <linux/module.h>
++#include <linux/i2c.h>
++#include <linux/hwmon.h>
++#include <linux/hwmon-sysfs.h>
++#include <linux/err.h>
++#include <linux/slab.h>
++
++#define DRV_VERSION "0.2"
++
++enum chips { gsp };
++
++/* AD7418 registers */
++#define GSP_REG_TEMP_IN		0x00
++#define GSP_REG_VIN		0x02
++#define GSP_REG_3P3		0x05
++#define GSP_REG_BAT		0x08
++#define GSP_REG_5P0		0x0b
++#define GSP_REG_CORE		0x0e
++#define GSP_REG_CPU1		0x11
++#define GSP_REG_CPU2		0x14
++#define GSP_REG_DRAM		0x17
++#define GSP_REG_EXT_BAT		0x1a
++#define GSP_REG_IO1		0x1d
++#define GSP_REG_IO2 		0x20
++#define GSP_REG_PCIE		0x23
++#define GSP_REG_CURRENT		0x26
++#define GSP_FAN_0		0x2C
++#define GSP_FAN_1		0x2E
++#define GSP_FAN_2		0x30
++#define GSP_FAN_3		0x32
++#define GSP_FAN_4		0x34
++#define GSP_FAN_5		0x36
++
++struct gsp_sensor_info {
++	const char* name;
++	int reg;
++};
++
++static const struct gsp_sensor_info gsp_sensors[] = {
++	{"temp", GSP_REG_TEMP_IN},
++	{"vin", GSP_REG_VIN},
++	{"3p3", GSP_REG_3P3},
++	{"bat", GSP_REG_BAT},
++	{"5p0", GSP_REG_5P0},
++	{"core", GSP_REG_CORE},
++	{"cpu1", GSP_REG_CPU1},
++	{"cpu2", GSP_REG_CPU2},
++	{"dram", GSP_REG_DRAM},
++	{"ext_bat", GSP_REG_EXT_BAT},
++	{"io1", GSP_REG_IO1},
++	{"io2", GSP_REG_IO2},
++	{"pci2", GSP_REG_PCIE},
++	{"current", GSP_REG_CURRENT},
++	{"fan_point0", GSP_FAN_0},
++	{"fan_point1", GSP_FAN_1},
++	{"fan_point2", GSP_FAN_2},
++	{"fan_point3", GSP_FAN_3},
++	{"fan_point4", GSP_FAN_4},
++	{"fan_point5", GSP_FAN_5},
++};
++
++struct gsp_data {
++	struct device		*hwmon_dev;
++	struct attribute_group	attrs;
++	enum chips		type;
++};
++
++static int gsp_probe(struct i2c_client *client,
++			const struct i2c_device_id *id);
++static int gsp_remove(struct i2c_client *client);
++
++static const struct i2c_device_id gsp_id[] = {
++	{ "gsp", 0 },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, gsp_id);
++
++static struct i2c_driver gsp_driver = {
++	.driver = {
++		.name	= "gsp",
++	},
++	.probe		= gsp_probe,
++	.remove		= gsp_remove,
++	.id_table	= gsp_id,
++};
++
++/* All registers are word-sized, except for the configuration registers.
++ * AD7418 uses a high-byte first convention. Do NOT use those functions to
++ * access the configuration registers CONF and CONF2, as they are byte-sized.
++ */
++static inline int gsp_read(struct i2c_client *client, u8 reg)
++{
++	unsigned int adc = 0;
++	if (reg == GSP_REG_TEMP_IN || reg > GSP_REG_CURRENT)
++	{
++		adc |= i2c_smbus_read_byte_data(client, reg);
++		adc |= i2c_smbus_read_byte_data(client, reg + 1) << 8;
++		return adc;
++	}
++	else
++	{
++		adc |= i2c_smbus_read_byte_data(client, reg);
++		adc |= i2c_smbus_read_byte_data(client, reg + 1) << 8;
++		adc |= i2c_smbus_read_byte_data(client, reg + 2) << 16;
++		return adc;
++	}
++}
++
++static inline int gsp_write(struct i2c_client *client, u8 reg, u16 value)
++{
++	i2c_smbus_write_byte_data(client, reg, value & 0xff);
++	i2c_smbus_write_byte_data(client, reg + 1, ((value >> 8) & 0xff));
++	return 1;
++}
++
++static ssize_t show_adc(struct device *dev, struct device_attribute *devattr,
++			char *buf)
++{
++	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
++	struct i2c_client *client = to_i2c_client(dev);
++	return sprintf(buf, "%d\n", gsp_read(client, gsp_sensors[attr->index].reg));
++}
++
++static ssize_t show_label(struct device *dev,
++			struct device_attribute *devattr, char *buf)
++{
++	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
++
++	return sprintf(buf, "%s\n", gsp_sensors[attr->index].name);
++}
++
++static ssize_t store_fan(struct device *dev,
++			struct device_attribute *devattr, const char *buf, size_t count)
++{
++	u16 val;
++	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
++	struct i2c_client *client = to_i2c_client(dev);
++	val = simple_strtoul(buf, NULL, 10);
++	gsp_write(client, gsp_sensors[attr->index].reg, val);
++	return count;
++}
++
++static SENSOR_DEVICE_ATTR(temp0_input, S_IRUGO, show_adc, NULL, 0);
++static SENSOR_DEVICE_ATTR(temp0_label, S_IRUGO, show_label, NULL, 0);
++
++static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_adc, NULL, 1);
++static SENSOR_DEVICE_ATTR(in0_label, S_IRUGO, show_label, NULL, 1);
++static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_adc, NULL, 2);
++static SENSOR_DEVICE_ATTR(in1_label, S_IRUGO, show_label, NULL, 2);
++static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_adc, NULL, 3);
++static SENSOR_DEVICE_ATTR(in2_label, S_IRUGO, show_label, NULL, 3);
++static SENSOR_DEVICE_ATTR(in3_input, S_IRUGO, show_adc, NULL, 4);
++static SENSOR_DEVICE_ATTR(in3_label, S_IRUGO, show_label, NULL, 4);
++static SENSOR_DEVICE_ATTR(in4_input, S_IRUGO, show_adc, NULL, 5);
++static SENSOR_DEVICE_ATTR(in4_label, S_IRUGO, show_label, NULL, 5);
++static SENSOR_DEVICE_ATTR(in5_input, S_IRUGO, show_adc, NULL, 6);
++static SENSOR_DEVICE_ATTR(in5_label, S_IRUGO, show_label, NULL, 6);
++static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_adc, NULL, 7);
++static SENSOR_DEVICE_ATTR(in6_label, S_IRUGO, show_label, NULL, 7);
++static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_adc, NULL, 8);
++static SENSOR_DEVICE_ATTR(in7_label, S_IRUGO, show_label, NULL, 8);
++static SENSOR_DEVICE_ATTR(in8_input, S_IRUGO, show_adc, NULL, 9);
++static SENSOR_DEVICE_ATTR(in8_label, S_IRUGO, show_label, NULL, 9);
++static SENSOR_DEVICE_ATTR(in9_input, S_IRUGO, show_adc, NULL, 10);
++static SENSOR_DEVICE_ATTR(in9_label, S_IRUGO, show_label, NULL, 10);
++static SENSOR_DEVICE_ATTR(in10_input, S_IRUGO, show_adc, NULL, 11);
++static SENSOR_DEVICE_ATTR(in10_label, S_IRUGO, show_label, NULL, 11);
++static SENSOR_DEVICE_ATTR(in11_input, S_IRUGO, show_adc, NULL, 12);
++static SENSOR_DEVICE_ATTR(in11_label, S_IRUGO, show_label, NULL, 12);
++static SENSOR_DEVICE_ATTR(in12_input, S_IRUGO, show_adc, NULL, 13);
++static SENSOR_DEVICE_ATTR(in12_label, S_IRUGO, show_label, NULL, 13);
++
++static SENSOR_DEVICE_ATTR(fan0_point0, S_IRUGO | S_IWUSR, show_adc, store_fan, 14);
++static SENSOR_DEVICE_ATTR(fan0_point1, S_IRUGO | S_IWUSR, show_adc, store_fan, 15);
++static SENSOR_DEVICE_ATTR(fan0_point2, S_IRUGO | S_IWUSR, show_adc, store_fan, 16);
++static SENSOR_DEVICE_ATTR(fan0_point3, S_IRUGO | S_IWUSR, show_adc, store_fan, 17);
++static SENSOR_DEVICE_ATTR(fan0_point4, S_IRUGO | S_IWUSR, show_adc, store_fan, 18);
++static SENSOR_DEVICE_ATTR(fan0_point5, S_IRUGO | S_IWUSR, show_adc, store_fan, 19);
++
++static struct attribute *gsp_attributes[] = {
++	&sensor_dev_attr_temp0_input.dev_attr.attr,
++	&sensor_dev_attr_in0_input.dev_attr.attr,
++	&sensor_dev_attr_in1_input.dev_attr.attr,
++	&sensor_dev_attr_in2_input.dev_attr.attr,
++	&sensor_dev_attr_in3_input.dev_attr.attr,
++	&sensor_dev_attr_in4_input.dev_attr.attr,
++	&sensor_dev_attr_in5_input.dev_attr.attr,
++	&sensor_dev_attr_in6_input.dev_attr.attr,
++	&sensor_dev_attr_in7_input.dev_attr.attr,
++	&sensor_dev_attr_in8_input.dev_attr.attr,
++	&sensor_dev_attr_in9_input.dev_attr.attr,
++	&sensor_dev_attr_in10_input.dev_attr.attr,
++	&sensor_dev_attr_in11_input.dev_attr.attr,
++	&sensor_dev_attr_in12_input.dev_attr.attr,
++
++	&sensor_dev_attr_temp0_label.dev_attr.attr,
++	&sensor_dev_attr_in0_label.dev_attr.attr,
++	&sensor_dev_attr_in1_label.dev_attr.attr,
++	&sensor_dev_attr_in2_label.dev_attr.attr,
++	&sensor_dev_attr_in3_label.dev_attr.attr,
++	&sensor_dev_attr_in4_label.dev_attr.attr,
++	&sensor_dev_attr_in5_label.dev_attr.attr,
++	&sensor_dev_attr_in6_label.dev_attr.attr,
++	&sensor_dev_attr_in7_label.dev_attr.attr,
++	&sensor_dev_attr_in8_label.dev_attr.attr,
++	&sensor_dev_attr_in9_label.dev_attr.attr,
++	&sensor_dev_attr_in10_label.dev_attr.attr,
++	&sensor_dev_attr_in11_label.dev_attr.attr,
++	&sensor_dev_attr_in12_label.dev_attr.attr,
++
++	&sensor_dev_attr_fan0_point0.dev_attr.attr,
++	&sensor_dev_attr_fan0_point1.dev_attr.attr,
++	&sensor_dev_attr_fan0_point2.dev_attr.attr,
++	&sensor_dev_attr_fan0_point3.dev_attr.attr,
++	&sensor_dev_attr_fan0_point4.dev_attr.attr,
++	&sensor_dev_attr_fan0_point5.dev_attr.attr,
++	NULL
++};
++
++
++static int gsp_probe(struct i2c_client *client,
++			 const struct i2c_device_id *id)
++{
++	struct i2c_adapter *adapter = client->adapter;
++	struct gsp_data *data;
++	int err;
++
++	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA |
++					I2C_FUNC_SMBUS_WORD_DATA)) {
++		err = -EOPNOTSUPP;
++		goto exit;
++	}
++
++	if (!(data = kzalloc(sizeof(struct gsp_data), GFP_KERNEL))) {
++		err = -ENOMEM;
++		goto exit;
++	}
++
++	i2c_set_clientdata(client, data);
++
++	data->type = id->driver_data;
++
++	switch (data->type) {
++	case 0:
++		data->attrs.attrs = gsp_attributes;
++		break;
++	}
++
++	dev_info(&client->dev, "%s chip found\n", client->name);
++
++	/* Register sysfs hooks */
++	if ((err = sysfs_create_group(&client->dev.kobj, &data->attrs)))
++		goto exit_free;
++
++	data->hwmon_dev = hwmon_device_register(&client->dev);
++	if (IS_ERR(data->hwmon_dev)) {
++		err = PTR_ERR(data->hwmon_dev);
++		goto exit_remove;
++	}
++
++	return 0;
++
++exit_remove:
++	sysfs_remove_group(&client->dev.kobj, &data->attrs);
++exit_free:
++	kfree(data);
++exit:
++	return err;
++}
++
++static int gsp_remove(struct i2c_client *client)
++{
++	struct gsp_data *data = i2c_get_clientdata(client);
++	hwmon_device_unregister(data->hwmon_dev);
++	sysfs_remove_group(&client->dev.kobj, &data->attrs);
++	kfree(data);
++	return 0;
++}
++
++static int __init gsp_init(void)
++{
++	return i2c_add_driver(&gsp_driver);
++}
++
++static void __exit gsp_exit(void)
++{
++	i2c_del_driver(&gsp_driver);
++}
++
++module_init(gsp_init);
++module_exit(gsp_exit);
++
++MODULE_AUTHOR("Chris Lang <clang@gateworks.com>");
++MODULE_DESCRIPTION("GSC HWMON driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION(DRV_VERSION);
++
diff --git a/target/linux/generic/patches-3.3/900-slab_maxsize.patch b/target/linux/generic/patches-3.3/900-slab_maxsize.patch
new file mode 100644
index 0000000..1c95694
--- /dev/null
+++ b/target/linux/generic/patches-3.3/900-slab_maxsize.patch
@@ -0,0 +1,13 @@
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -127,8 +127,8 @@ unsigned int kmem_cache_size(struct kmem
+  * to do various tricks to work around compiler limitations in order to
+  * ensure proper constant folding.
+  */
+-#define KMALLOC_SHIFT_HIGH	((MAX_ORDER + PAGE_SHIFT - 1) <= 25 ? \
+-				(MAX_ORDER + PAGE_SHIFT - 1) : 25)
++#define KMALLOC_SHIFT_HIGH	((MAX_ORDER + PAGE_SHIFT - 1) <= 17 ? \
++				(MAX_ORDER + PAGE_SHIFT - 1) : 17)
+ 
+ #define KMALLOC_MAX_SIZE	(1UL << KMALLOC_SHIFT_HIGH)
+ #define KMALLOC_MAX_ORDER	(KMALLOC_SHIFT_HIGH - PAGE_SHIFT)
diff --git a/target/linux/generic/patches-3.3/910-kobject_uevent.patch b/target/linux/generic/patches-3.3/910-kobject_uevent.patch
new file mode 100644
index 0000000..aa9a40f
--- /dev/null
+++ b/target/linux/generic/patches-3.3/910-kobject_uevent.patch
@@ -0,0 +1,21 @@
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -50,6 +50,18 @@ static const char *kobject_actions[] = {
+ 	[KOBJ_OFFLINE] =	"offline",
+ };
+ 
++u64 uevent_next_seqnum(void)
++{
++	u64 seq;
++
++	mutex_lock(&uevent_sock_mutex);
++	seq = ++uevent_seqnum;
++	mutex_unlock(&uevent_sock_mutex);
++
++	return seq;
++}
++EXPORT_SYMBOL_GPL(uevent_next_seqnum);
++
+ /**
+  * kobject_action_type - translate action string to numeric type
+  *
diff --git a/target/linux/generic/patches-3.3/911-kobject_add_broadcast_uevent.patch b/target/linux/generic/patches-3.3/911-kobject_add_broadcast_uevent.patch
new file mode 100644
index 0000000..104df13
--- /dev/null
+++ b/target/linux/generic/patches-3.3/911-kobject_add_broadcast_uevent.patch
@@ -0,0 +1,85 @@
+--- a/include/linux/kobject.h
++++ b/include/linux/kobject.h
+@@ -31,6 +31,8 @@
+ #define UEVENT_NUM_ENVP			32	/* number of env pointers */
+ #define UEVENT_BUFFER_SIZE		2048	/* buffer for the variables */
+ 
++struct sk_buff;
++
+ /* path to the userspace helper executed on an event */
+ extern char uevent_helper[];
+ 
+@@ -213,6 +215,10 @@ int add_uevent_var(struct kobj_uevent_en
+ 
+ int kobject_action_type(const char *buf, size_t count,
+ 			enum kobject_action *type);
++
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation);
++
+ #else
+ static inline int kobject_uevent(struct kobject *kobj,
+ 				 enum kobject_action action)
+@@ -229,6 +235,16 @@ int add_uevent_var(struct kobj_uevent_en
+ static inline int kobject_action_type(const char *buf, size_t count,
+ 				      enum kobject_action *type)
+ { return -EINVAL; }
++
++void kfree_skb(struct sk_buff *);
++
++static inline int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++				   gfp_t allocation)
++{
++	kfree_skb(skb);
++	return 0;
++}
++
+ #endif
+ 
+ #endif /* _KOBJECT_H_ */
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -381,6 +381,43 @@ int add_uevent_var(struct kobj_uevent_en
+ EXPORT_SYMBOL_GPL(add_uevent_var);
+ 
+ #if defined(CONFIG_NET)
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation)
++{
++	struct uevent_sock *ue_sk;
++	int err = 0;
++
++	/* send netlink message */
++	mutex_lock(&uevent_sock_mutex);
++	list_for_each_entry(ue_sk, &uevent_sock_list, list) {
++		struct sock *uevent_sock = ue_sk->sk;
++		struct sk_buff *skb2;
++
++		skb2 = skb_clone(skb, allocation);
++		if (!skb2)
++			break;
++
++		err = netlink_broadcast(uevent_sock, skb2, pid, group,
++					allocation);
++		if (err)
++			break;
++	}
++	mutex_unlock(&uevent_sock_mutex);
++
++	kfree_skb(skb);
++	return err;
++}
++#else
++int broadcast_uevent(struct sk_buff *skb, __u32 pid, __u32 group,
++		     gfp_t allocation)
++{
++	kfree_skb(skb);
++	return 0;
++}
++#endif
++EXPORT_SYMBOL_GPL(broadcast_uevent);
++
++#if defined(CONFIG_NET)
+ static int uevent_net_init(struct net *net)
+ {
+ 	struct uevent_sock *ue_sk;
diff --git a/target/linux/generic/patches-3.3/920-unable_to_open_console.patch b/target/linux/generic/patches-3.3/920-unable_to_open_console.patch
new file mode 100644
index 0000000..11f67dc
--- /dev/null
+++ b/target/linux/generic/patches-3.3/920-unable_to_open_console.patch
@@ -0,0 +1,11 @@
+--- a/init/main.c
++++ b/init/main.c
+@@ -816,7 +816,7 @@ static int __init kernel_init(void * unu
+ 
+ 	/* Open the /dev/console on the rootfs, this should never fail */
+ 	if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
+-		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
++		printk(KERN_WARNING "Please be patient, while OpenWrt loads ...\n");
+ 
+ 	(void) sys_dup(0);
+ 	(void) sys_dup(0);
diff --git a/target/linux/generic/patches-3.3/921-use_preinit_as_init.patch b/target/linux/generic/patches-3.3/921-use_preinit_as_init.patch
new file mode 100644
index 0000000..a71251d
--- /dev/null
+++ b/target/linux/generic/patches-3.3/921-use_preinit_as_init.patch
@@ -0,0 +1,14 @@
+--- a/init/main.c
++++ b/init/main.c
+@@ -774,10 +774,7 @@ static noinline int init_post(void)
+ 		printk(KERN_WARNING "Failed to execute %s.  Attempting "
+ 					"defaults...\n", execute_command);
+ 	}
+-	run_init_process("/sbin/init");
+-	run_init_process("/etc/init");
+-	run_init_process("/bin/init");
+-	run_init_process("/bin/sh");
++	run_init_process("/etc/preinit");
+ 
+ 	panic("No init found.  Try passing init= option to kernel. "
+ 	      "See Linux Documentation/init.txt for guidance.");
diff --git a/target/linux/generic/patches-3.3/930-crashlog.patch b/target/linux/generic/patches-3.3/930-crashlog.patch
new file mode 100644
index 0000000..f6a52f3
--- /dev/null
+++ b/target/linux/generic/patches-3.3/930-crashlog.patch
@@ -0,0 +1,285 @@
+--- /dev/null
++++ b/include/linux/crashlog.h
+@@ -0,0 +1,17 @@
++#ifndef __CRASHLOG_H
++#define __CRASHLOG_H
++
++#ifdef CONFIG_CRASHLOG
++void crashlog_init_bootmem(struct bootmem_data *bdata);
++void crashlog_init_memblock(phys_addr_t addr, phys_addr_t size);
++#else
++static inline void crashlog_init_bootmem(struct bootmem_data *bdata)
++{
++}
++
++static inline void crashlog_init_memblock(phys_addr_t addr, phys_addr_t size)
++{
++}
++#endif
++
++#endif
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -926,6 +926,10 @@ config RELAY
+ 
+ 	  If unsure, say N.
+ 
++config CRASHLOG
++	bool "Crash logging"
++	depends on (!NO_BOOTMEM || HAVE_MEMBLOCK) && !(ARM || SPARC || PPC)
++
+ config BLK_DEV_INITRD
+ 	bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
+ 	depends on BROKEN || !FRV
+--- a/kernel/Makefile
++++ b/kernel/Makefile
+@@ -107,6 +107,7 @@ obj-$(CONFIG_USER_RETURN_NOTIFIER) += us
+ obj-$(CONFIG_PADATA) += padata.o
+ obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
+ obj-$(CONFIG_JUMP_LABEL) += jump_label.o
++obj-$(CONFIG_CRASHLOG) += crashlog.o
+ 
+ $(obj)/configs.o: $(obj)/config_data.h
+ 
+--- /dev/null
++++ b/kernel/crashlog.c
+@@ -0,0 +1,190 @@
++/*
++ * Crash information logger
++ * Copyright (C) 2010 Felix Fietkau <nbd@openwrt.org>
++ *
++ * Based on ramoops.c
++ *   Copyright (C) 2010 Marco Stornelli <marco.stornelli@gmail.com>
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * version 2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful, but
++ * WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
++ * 02110-1301 USA
++ *
++ */
++
++#include <linux/module.h>
++#include <linux/bootmem.h>
++#include <linux/memblock.h>
++#include <linux/debugfs.h>
++#include <linux/crashlog.h>
++#include <linux/kmsg_dump.h>
++#include <linux/module.h>
++#include <linux/pfn.h>
++#include <asm/io.h>
++
++#define CRASHLOG_PAGES	4
++#define CRASHLOG_SIZE	(CRASHLOG_PAGES * PAGE_SIZE)
++#define CRASHLOG_MAGIC	0xa1eedead
++
++/*
++ * Start the log at 1M before the end of RAM, as some boot loaders like
++ * to use the end of the RAM for stack usage and other things
++ * If this fails, fall back to using the last part.
++ */
++#define CRASHLOG_OFFSET	(1024 * 1024)
++
++struct crashlog_data {
++	u32 magic;
++	u32 len;
++	u8 data[];
++};
++
++static struct debugfs_blob_wrapper crashlog_blob;
++static unsigned long crashlog_addr = 0;
++static struct crashlog_data *crashlog_buf;
++static struct kmsg_dumper dump;
++static bool first = true;
++
++extern struct list_head *crashlog_modules;
++
++#ifndef CONFIG_NO_BOOTMEM
++void __init crashlog_init_bootmem(bootmem_data_t *bdata)
++{
++	unsigned long addr;
++
++	if (crashlog_addr)
++		return;
++
++	addr = PFN_PHYS(bdata->node_low_pfn) - CRASHLOG_OFFSET;
++	if (reserve_bootmem(addr, CRASHLOG_SIZE, BOOTMEM_EXCLUSIVE) < 0) {
++		printk("Crashlog failed to allocate RAM at address 0x%lx\n", addr);
++		bdata->node_low_pfn -= CRASHLOG_PAGES;
++		addr = PFN_PHYS(bdata->node_low_pfn);
++	}
++	crashlog_addr = addr;
++}
++#endif
++
++#ifdef CONFIG_HAVE_MEMBLOCK
++void __meminit crashlog_init_memblock(phys_addr_t addr, phys_addr_t size)
++{
++	if (crashlog_addr)
++		return;
++
++	addr += size - CRASHLOG_OFFSET;
++	if (memblock_reserve(addr, CRASHLOG_SIZE)) {
++		printk("Crashlog failed to allocate RAM at address 0x%lx\n", (unsigned long) addr);
++		return;
++	}
++
++	crashlog_addr = addr;
++}
++#endif
++
++static void __init crashlog_copy(void)
++{
++	if (crashlog_buf->magic != CRASHLOG_MAGIC)
++		return;
++
++	if (!crashlog_buf->len || crashlog_buf->len >
++	    CRASHLOG_SIZE - sizeof(*crashlog_buf))
++		return;
++
++	crashlog_blob.size = crashlog_buf->len;
++	crashlog_blob.data = kmemdup(crashlog_buf->data,
++		crashlog_buf->len, GFP_KERNEL);
++
++	debugfs_create_blob("crashlog", 0700, NULL, &crashlog_blob);
++}
++
++static int get_maxlen(void)
++{
++	return CRASHLOG_SIZE - sizeof(*crashlog_buf) - crashlog_buf->len;
++}
++
++static void crashlog_printf(const char *fmt, ...)
++{
++	va_list args;
++	int len = get_maxlen();
++
++	if (!len)
++		return;
++
++	va_start(args, fmt);
++	crashlog_buf->len += vsnprintf(
++		&crashlog_buf->data[crashlog_buf->len],
++		len, fmt, args);
++	va_end(args);
++}
++
++static void crashlog_do_dump(struct kmsg_dumper *dumper,
++		enum kmsg_dump_reason reason, const char *s1, unsigned long l1,
++		const char *s2, unsigned long l2)
++{
++	unsigned long s1_start, s2_start;
++	unsigned long l1_cpy, l2_cpy;
++	struct timeval tv;
++	struct module *m;
++	char *buf;
++	int len;
++
++	if (!first)
++		crashlog_printf("\n===================================\n");
++
++	do_gettimeofday(&tv);
++	crashlog_printf("Time: %lu.%lu\n",
++		(long)tv.tv_sec, (long)tv.tv_usec);
++
++	if (first) {
++		crashlog_printf("Modules:");
++		list_for_each_entry(m, crashlog_modules, list) {
++			crashlog_printf("\t%s@%p+%x", m->name,
++			m->module_core, m->core_size,
++			m->module_init, m->init_size);
++		}
++		crashlog_printf("\n");
++		first = false;
++	}
++
++	buf = (char *)&crashlog_buf->data[crashlog_buf->len];
++	len = get_maxlen();
++
++	l2_cpy = min(l2, (unsigned long)len);
++	l1_cpy = min(l1, (unsigned long)len - l2_cpy);
++
++	s2_start = l2 - l2_cpy;
++	s1_start = l1 - l1_cpy;
++
++	memcpy(buf, s1 + s1_start, l1_cpy);
++	memcpy(buf + l1_cpy, s2 + s2_start, l2_cpy);
++	crashlog_buf->len += l1_cpy + l2_cpy;
++}
++
++
++int __init crashlog_init_fs(void)
++{
++	if (!crashlog_addr)
++		return -ENOMEM;
++
++	crashlog_buf = ioremap(crashlog_addr, CRASHLOG_SIZE);
++
++	crashlog_copy();
++
++	crashlog_buf->magic = CRASHLOG_MAGIC;
++	crashlog_buf->len = 0;
++
++	dump.dump = crashlog_do_dump;
++	kmsg_dump_register(&dump);
++
++	return 0;
++}
++module_init(crashlog_init_fs);
+--- a/mm/bootmem.c
++++ b/mm/bootmem.c
+@@ -15,6 +15,7 @@
+ #include <linux/export.h>
+ #include <linux/kmemleak.h>
+ #include <linux/range.h>
++#include <linux/crashlog.h>
+ #include <linux/memblock.h>
+ 
+ #include <asm/bug.h>
+@@ -177,6 +178,7 @@ static unsigned long __init free_all_boo
+ 	if (!bdata->node_bootmem_map)
+ 		return 0;
+ 
++	crashlog_init_bootmem(bdata);
+ 	start = bdata->node_min_pfn;
+ 	end = bdata->node_low_pfn;
+ 
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -101,6 +101,9 @@ static LIST_HEAD(modules);
+ #ifdef CONFIG_KGDB_KDB
+ struct list_head *kdb_modules = &modules; /* kdb needs the list of modules */
+ #endif /* CONFIG_KGDB_KDB */
++#ifdef CONFIG_CRASHLOG
++struct list_head *crashlog_modules = &modules;
++#endif
+ 
+ 
+ /* Block module loading/unloading? */
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -19,6 +19,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/seq_file.h>
+ #include <linux/memblock.h>
++#include <linux/crashlog.h>
+ 
+ static struct memblock_region memblock_memory_init_regions[INIT_MEMBLOCK_REGIONS] __initdata_memblock;
+ static struct memblock_region memblock_reserved_init_regions[INIT_MEMBLOCK_REGIONS] __initdata_memblock;
+@@ -305,6 +306,8 @@ static void __init_memblock memblock_ins
+ 	memblock_set_region_node(rgn, nid);
+ 	type->cnt++;
+ 	type->total_size += size;
++	if (type == &memblock.memory && idx == 0)
++		crashlog_init_memblock(base, size);
+ }
+ 
+ /**
diff --git a/target/linux/generic/patches-3.3/940-ocf_kbuild_integration.patch b/target/linux/generic/patches-3.3/940-ocf_kbuild_integration.patch
new file mode 100644
index 0000000..b5cce90
--- /dev/null
+++ b/target/linux/generic/patches-3.3/940-ocf_kbuild_integration.patch
@@ -0,0 +1,20 @@
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -968,3 +968,6 @@ config CRYPTO_USER_API_SKCIPHER
+ source "drivers/crypto/Kconfig"
+ 
+ endif	# if CRYPTO
++
++source "crypto/ocf/Kconfig"
++
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -92,6 +92,8 @@ obj-$(CONFIG_CRYPTO_USER_API) += af_alg.
+ obj-$(CONFIG_CRYPTO_USER_API_HASH) += algif_hash.o
+ obj-$(CONFIG_CRYPTO_USER_API_SKCIPHER) += algif_skcipher.o
+ 
++obj-$(CONFIG_OCF_OCF) += ocf/
++
+ #
+ # generic algorithms and the async_tx api
+ #
diff --git a/target/linux/generic/patches-3.3/941-ocf_20120127.patch b/target/linux/generic/patches-3.3/941-ocf_20120127.patch
new file mode 100644
index 0000000..794627a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/941-ocf_20120127.patch
@@ -0,0 +1,164 @@
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -131,6 +131,9 @@
+  *	void add_interrupt_randomness(int irq, int irq_flags);
+  * 	void add_disk_randomness(struct gendisk *disk);
+  *
++ *      void random_input_words(__u32 *buf, size_t wordcount, int ent_count)
++ *      int random_input_wait(void);
++ *
+  * add_input_randomness() uses the input layer interrupt timing, as well as
+  * the event type information from the hardware.
+  *
+@@ -152,6 +155,13 @@
+  * seek times do not make for good sources of entropy, as their seek
+  * times are usually fairly consistent.
+  *
++ * random_input_words() just provides a raw block of entropy to the input
++ * pool, such as from a hardware entropy generator.
++ *
++ * random_input_wait() suspends the caller until such time as the
++ * entropy pool falls below the write threshold, and returns a count of how
++ * much entropy (in bits) is needed to sustain the pool.
++ *
+  * All of these routines try to estimate how many bits of randomness a
+  * particular randomness source.  They do this by keeping track of the
+  * first and second order deltas of the event timings.
+@@ -796,6 +806,63 @@ void add_disk_randomness(struct gendisk
+ }
+ #endif
+ 
++/*
++ * random_input_words - add bulk entropy to pool
++ *
++ * @buf: buffer to add
++ * @wordcount: number of __u32 words to add
++ * @ent_count: total amount of entropy (in bits) to credit
++ *
++ * this provides bulk input of entropy to the input pool
++ *
++ */
++void random_input_words(__u32 *buf, size_t wordcount, int ent_count)
++{
++	mix_pool_bytes(&input_pool, buf, wordcount*4, NULL);
++
++	credit_entropy_bits(&input_pool, ent_count);
++
++	DEBUG_ENT("crediting %d bits => %d\n",
++		  ent_count, input_pool.entropy_count);
++	/*
++	 * Wake up waiting processes if we have enough
++	 * entropy.
++	 */
++	if (input_pool.entropy_count >= random_read_wakeup_thresh)
++		wake_up_interruptible(&random_read_wait);
++}
++EXPORT_SYMBOL(random_input_words);
++
++/*
++ * random_input_wait - wait until random needs entropy
++ *
++ * this function sleeps until the /dev/random subsystem actually
++ * needs more entropy, and then return the amount of entropy
++ * that it would be nice to have added to the system.
++ */
++int random_input_wait(void)
++{
++	int count;
++
++	wait_event_interruptible(random_write_wait, 
++			 input_pool.entropy_count < random_write_wakeup_thresh);
++
++	count = random_write_wakeup_thresh - input_pool.entropy_count;
++
++        /* likely we got woken up due to a signal */
++	if (count <= 0) count = random_read_wakeup_thresh; 
++
++	DEBUG_ENT("requesting %d bits from input_wait()er %d<%d\n",
++		  count,
++		  input_pool.entropy_count, random_write_wakeup_thresh);
++
++	return count;
++}
++EXPORT_SYMBOL(random_input_wait);
++
++
++#define EXTRACT_SIZE 10
++
+ /*********************************************************************
+  *
+  * Entropy extraction routines
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -142,6 +142,7 @@ SYSCALL_DEFINE1(dup, unsigned int, filde
+ 	}
+ 	return ret;
+ }
++EXPORT_SYMBOL(sys_dup);
+ 
+ #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
+ 
+--- a/include/linux/miscdevice.h
++++ b/include/linux/miscdevice.h
+@@ -19,6 +19,7 @@
+ #define APOLLO_MOUSE_MINOR	7
+ #define PC110PAD_MINOR		9
+ /*#define ADB_MOUSE_MINOR	10	FIXME OBSOLETE */
++#define CRYPTODEV_MINOR		70	/* /dev/crypto */
+ #define WATCHDOG_MINOR		130	/* Watchdog timer     */
+ #define TEMP_MINOR		131	/* Temperature Sensor */
+ #define RTC_MINOR		135
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -34,6 +34,30 @@
+ /* Clear the entropy pool and associated counters.  (Superuser only.) */
+ #define RNDCLEARPOOL	_IO( 'R', 0x06 )
+ 
++#ifdef CONFIG_FIPS_RNG
++
++/* Size of seed value - equal to AES blocksize */
++#define AES_BLOCK_SIZE_BYTES	16
++#define SEED_SIZE_BYTES			AES_BLOCK_SIZE_BYTES
++/* Size of AES key */
++#define KEY_SIZE_BYTES		16
++
++/* ioctl() structure used by FIPS 140-2 Tests */
++struct rand_fips_test {
++	unsigned char key[KEY_SIZE_BYTES];			/* Input */
++	unsigned char datetime[SEED_SIZE_BYTES];	/* Input */
++	unsigned char seed[SEED_SIZE_BYTES];		/* Input */
++	unsigned char result[SEED_SIZE_BYTES];		/* Output */
++};
++
++/* FIPS 140-2 RNG Variable Seed Test. (Superuser only.) */
++#define RNDFIPSVST	_IOWR('R', 0x10, struct rand_fips_test)
++
++/* FIPS 140-2 RNG Monte Carlo Test. (Superuser only.) */
++#define RNDFIPSMCT	_IOWR('R', 0x11, struct rand_fips_test)
++
++#endif /* #ifdef CONFIG_FIPS_RNG */
++
+ struct rand_pool_info {
+ 	int	entropy_count;
+ 	int	buf_size;
+@@ -53,6 +77,10 @@ extern void add_input_randomness(unsigne
+ 				 unsigned int value);
+ extern void add_interrupt_randomness(int irq, int irq_flags);
+ 
++extern void random_input_words(__u32 *buf, size_t wordcount, int ent_count);
++extern int random_input_wait(void);
++#define HAS_RANDOM_INPUT_WAIT 1
++
+ extern void get_random_bytes(void *buf, int nbytes);
+ extern void get_random_bytes_arch(void *buf, int nbytes);
+ void generate_random_uuid(unsigned char uuid_out[16]);
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -430,6 +430,7 @@ struct task_struct *find_task_by_vpid(pi
+ {
+ 	return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
+ }
++EXPORT_SYMBOL(find_task_by_vpid);
+ 
+ struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
+ {
diff --git a/target/linux/generic/patches-3.3/950-vm_exports.patch b/target/linux/generic/patches-3.3/950-vm_exports.patch
new file mode 100644
index 0000000..1cd970c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/950-vm_exports.patch
@@ -0,0 +1,117 @@
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2490,6 +2490,16 @@ EXPORT_SYMBOL_GPL(shmem_truncate_range);
+ 
+ /* common code */
+ 
++void shmem_set_file(struct vm_area_struct *vma, struct file *file)
++{
++	if (vma->vm_file)
++		fput(vma->vm_file);
++	vma->vm_file = file;
++	vma->vm_ops = &shmem_vm_ops;
++	vma->vm_flags |= VM_CAN_NONLINEAR;
++}
++EXPORT_SYMBOL_GPL(shmem_set_file);
++
+ /**
+  * shmem_file_setup - get an unlinked file living in tmpfs
+  * @name: name for dentry (to be seen in /proc/<pid>/maps
+@@ -2567,11 +2577,8 @@ int shmem_zero_setup(struct vm_area_stru
+ 	if (IS_ERR(file))
+ 		return PTR_ERR(file);
+ 
+-	if (vma->vm_file)
+-		fput(vma->vm_file);
+-	vma->vm_file = file;
+-	vma->vm_ops = &shmem_vm_ops;
+-	vma->vm_flags |= VM_CAN_NONLINEAR;
++	shmem_set_file(vma, file);
++
+ 	return 0;
+ }
+ 
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -268,6 +268,7 @@ int expand_files(struct files_struct *fi
+ 	/* All good, so we try */
+ 	return expand_fdtable(files, nr);
+ }
++EXPORT_SYMBOL_GPL(expand_files);
+ 
+ static int count_open_files(struct fdtable *fdt)
+ {
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -500,6 +500,7 @@ struct files_struct *get_files_struct(st
+ 
+ 	return files;
+ }
++EXPORT_SYMBOL_GPL(get_files_struct);
+ 
+ void put_files_struct(struct files_struct *files)
+ {
+@@ -521,6 +522,7 @@ void put_files_struct(struct files_struc
+ 		rcu_read_unlock();
+ 	}
+ }
++EXPORT_SYMBOL_GPL(put_files_struct);
+ 
+ void reset_files_struct(struct files_struct *files)
+ {
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3854,6 +3854,7 @@ int can_nice(const struct task_struct *p
+ 	return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
+ 		capable(CAP_SYS_NICE));
+ }
++EXPORT_SYMBOL_GPL(can_nice);
+ 
+ #ifdef __ARCH_WANT_SYS_NICE
+ 
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1412,6 +1412,7 @@ unsigned long zap_page_range(struct vm_a
+ 	tlb_finish_mmu(&tlb, address, end);
+ 	return end;
+ }
++EXPORT_SYMBOL_GPL(zap_page_range);
+ 
+ /**
+  * zap_vma_ptes - remove ptes mapping the vma
+@@ -3087,6 +3088,7 @@ static inline int check_stack_guard_page
+ 	}
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(vmtruncate_range);
+ 
+ /*
+  * We enter with non-exclusive mmap_sem (to exclude vma changes,
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1257,6 +1257,7 @@ void unmap_kernel_range(unsigned long ad
+ 	vunmap_page_range(addr, end);
+ 	flush_tlb_kernel_range(addr, end);
+ }
++EXPORT_SYMBOL_GPL(unmap_kernel_range);
+ 
+ int map_vm_area(struct vm_struct *area, pgprot_t prot, struct page ***pages)
+ {
+@@ -1394,6 +1395,7 @@ struct vm_struct *get_vm_area(unsigned l
+ 	return __get_vm_area_node(size, 1, flags, VMALLOC_START, VMALLOC_END,
+ 				-1, GFP_KERNEL, __builtin_return_address(0));
+ }
++EXPORT_SYMBOL_GPL(get_vm_area);
+ 
+ struct vm_struct *get_vm_area_caller(unsigned long size, unsigned long flags,
+ 				void *caller)
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -872,6 +872,7 @@ extern bool skip_free_areas_node(unsigne
+ 
+ int shmem_lock(struct file *file, int lock, struct user_struct *user);
+ struct file *shmem_file_setup(const char *name, loff_t size, unsigned long flags);
++void shmem_set_file(struct vm_area_struct *vma, struct file *file);
+ int shmem_zero_setup(struct vm_area_struct *);
+ 
+ extern int can_do_mlock(void);
diff --git a/target/linux/generic/patches-3.3/960-decompress_unlzo_fix.patch b/target/linux/generic/patches-3.3/960-decompress_unlzo_fix.patch
new file mode 100644
index 0000000..ee7c118
--- /dev/null
+++ b/target/linux/generic/patches-3.3/960-decompress_unlzo_fix.patch
@@ -0,0 +1,23 @@
+--- /dev/null
++++ b/include/linux/decompress/unlzo_mm.h
+@@ -0,0 +1,10 @@
++#ifndef UNLZO_MM_H
++#define UNLZO_MM_H
++
++#ifdef STATIC
++#define INIT
++#else
++#define INIT __init
++#endif
++
++#endif
+--- a/lib/decompress_unlzo.c
++++ b/lib/decompress_unlzo.c
+@@ -38,6 +38,7 @@
+ 
+ #include <linux/types.h>
+ #include <linux/lzo.h>
++#include <linux/decompress/unlzo_mm.h>
+ #include <linux/decompress/mm.h>
+ 
+ #include <linux/compiler.h>
diff --git a/target/linux/generic/patches-3.3/970-remove-unsane-filenames-from-deps_initramfs-list.patch b/target/linux/generic/patches-3.3/970-remove-unsane-filenames-from-deps_initramfs-list.patch
new file mode 100644
index 0000000..65c6ef7
--- /dev/null
+++ b/target/linux/generic/patches-3.3/970-remove-unsane-filenames-from-deps_initramfs-list.patch
@@ -0,0 +1,28 @@
+--- a/usr/Makefile
++++ b/usr/Makefile
+@@ -50,20 +50,22 @@ ifneq ($(wildcard $(obj)/.initramfs_data
+ 	include $(obj)/.initramfs_data.cpio.d
+ endif
+ 
++deps_initramfs_sane := $(foreach v,$(deps_initramfs),$(if $(findstring :,$(v)),,$(v)))
++
+ quiet_cmd_initfs = GEN     $@
+       cmd_initfs = $(initramfs) -o $@ $(ramfs-args) $(ramfs-input)
+ 
+ targets := initramfs_data.cpio.gz initramfs_data.cpio.bz2 initramfs_data.cpio.lzma initramfs_data.cpio.xz initramfs_data.cpio.lzo initramfs_data.cpio
+ # do not try to update files included in initramfs
+-$(deps_initramfs): ;
++$(deps_initramfs_sane): ;
+ 
+-$(deps_initramfs): klibcdirs
++$(deps_initramfs_sane): klibcdirs
+ # We rebuild initramfs_data.cpio if:
+ # 1) Any included file is newer then initramfs_data.cpio
+ # 2) There are changes in which files are included (added or deleted)
+ # 3) If gen_init_cpio are newer than initramfs_data.cpio
+ # 4) arguments to gen_initramfs.sh changes
+-$(obj)/initramfs_data.cpio$(suffix_y): $(obj)/gen_init_cpio $(deps_initramfs) klibcdirs
++$(obj)/initramfs_data.cpio$(suffix_y): $(obj)/gen_init_cpio $(deps_initramfs_sane) klibcdirs
+ 	$(Q)$(initramfs) -l $(ramfs-input) > $(obj)/.initramfs_data.cpio.d
+ 	$(call if_changed,initfs)
+ 
diff --git a/target/linux/generic/patches-3.3/980-arm_openwrt_machtypes.patch b/target/linux/generic/patches-3.3/980-arm_openwrt_machtypes.patch
new file mode 100644
index 0000000..8204318
--- /dev/null
+++ b/target/linux/generic/patches-3.3/980-arm_openwrt_machtypes.patch
@@ -0,0 +1,34 @@
+--- a/arch/arm/tools/mach-types
++++ b/arch/arm/tools/mach-types
+@@ -1169,3 +1169,31 @@ elite_ulk		MACH_ELITE_ULK		ELITE_ULK		38
+ pov2			MACH_POV2		POV2			3889
+ ipod_touch_2g		MACH_IPOD_TOUCH_2G	IPOD_TOUCH_2G		3890
+ da850_pqab		MACH_DA850_PQAB		DA850_PQAB		3891
++#
++# Additional mach-types supported by OpenWrt
++#
++wg302v1			MACH_WG302V1		WG302V1			889
++pronghorn		MACH_PRONGHORN		PRONGHORN		928
++pronghorn_metro		MACH_PRONGHORNMETRO	PRONGHORNMETRO		1040
++sidewinder		MACH_SIDEWINDER		SIDEWINDER		1041
++wrt300nv2		MACH_WRT300NV2		WRT300NV2		1077
++compex42x		MACH_COMPEXWP18		COMPEXWP18		1273
++goldfish		MACH_GOLDFISH		GOLDFISH		1441
++cambria			MACH_CAMBRIA		CAMBRIA			1468
++dt2			MACH_DT2		DT2			1514
++ap1000			MACH_AP1000		AP1000			1543
++tw2662			MACH_TW2662		TW2662			1658
++tw5334			MACH_TW5334		TW5334			1664
++usr8200			MACH_USR8200		USR8200			1762
++mi424wr			MACH_MI424WR		MI424WR			1778
++gw2388			MACH_GW2388		GW2388			2635
++iconnect		MACH_ICONNECT		ICONNECT		2870
++nsb3ast			MACH_NSB3AST		NSB3AST			2917
++goflexnet		MACH_GOFLEXNET		GOFLEXNET		3089
++nas6210			MACH_NAS6210		NAS6210			3104
++ns_k330			MACH_NS_K330		NS_K330			3108
++bcm2708			MACH_BCM2708		BCM2708			3138
++wn802t			MACH_WN802T		WN802T			3306
++nsa310			MACH_NSA310		NSA310			4022
++wnr3500			MACH_WNR3500		WNR3500			4407
++ap42x			MACH_AP42X		AP42X			4418
diff --git a/target/linux/generic/patches-3.3/992-mpcore_wdt_fix_watchdog_counter_loading.patch b/target/linux/generic/patches-3.3/992-mpcore_wdt_fix_watchdog_counter_loading.patch
new file mode 100644
index 0000000..fb16e2a
--- /dev/null
+++ b/target/linux/generic/patches-3.3/992-mpcore_wdt_fix_watchdog_counter_loading.patch
@@ -0,0 +1,64 @@
+Although the commit "98af057092f8f0dabe63c5df08adc2bbfbddb1d2
+ ARM: 6126/1: ARM mpcore_wdt: fix build failure and other fixes"
+resolved long standing mpcore_wdt driver build problems, it
+introduced an error in the relationship between the MPcore watchdog
+timer clock rate and mpcore_margin, "MPcore timer margin in seconds",
+such that watchdog timeouts are now arbitrary rather than the number
+of seconds specified by mpcore_margin.
+
+This change restores mpcore_wdt_keepalive() to its equivalent
+implementation prior to commit 98af057 such that watchdog timeouts now
+occur as specified by mpcore_margin.
+
+The variable 'mpcore_timer_rate' which caused that build failure was
+replaced by 'twd_timer_rate'. Adding exported function to obtain
+'twd_timer_rate' value in mpcore_wdt driver.
+
+MPCORE_WATCHDOG needed to build 'mpcore_wdt' already depends on
+HAVE_ARM_TWD needed to build 'smp_twd', so from the point of view of
+'mpcore_wdt' driver the exported function will always exist.
+
+Signed-off-by: Valentine Barshak <vbarshak@mvista.com>
+Signed-off-by: Vitaly Kuzmichev <vkuzmichev@mvista.com>
+---
+
+ arch/arm/include/asm/smp_twd.h |    1 +
+ arch/arm/kernel/smp_twd.c      |    7 +++++++
+ drivers/watchdog/mpcore_wdt.c  |    4 +---
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/include/asm/smp_twd.h
++++ b/arch/arm/include/asm/smp_twd.h
+@@ -24,5 +24,6 @@ extern void __iomem *twd_base;
+ 
+ void twd_timer_setup(struct clock_event_device *);
+ void twd_timer_stop(struct clock_event_device *);
++unsigned long twd_timer_get_rate(void);
+ 
+ #endif
+--- a/arch/arm/kernel/smp_twd.c
++++ b/arch/arm/kernel/smp_twd.c
+@@ -268,3 +268,10 @@ void __cpuinit twd_timer_setup(struct cl
+ 					0xf, 0xffffffff);
+ 	enable_percpu_irq(clk->irq, 0);
+ }
++
++/* Needed by mpcore_wdt */
++unsigned long twd_timer_get_rate(void)
++{
++	return twd_timer_rate;
++}
++EXPORT_SYMBOL_GPL(twd_timer_get_rate);
+--- a/drivers/watchdog/mpcore_wdt.c
++++ b/drivers/watchdog/mpcore_wdt.c
+@@ -99,9 +99,7 @@ static void mpcore_wdt_keepalive(struct
+ 
+ 	spin_lock(&wdt_lock);
+ 	/* Assume prescale is set to 256 */
+-	count =  __raw_readl(wdt->base + TWD_WDOG_COUNTER);
+-	count = (0xFFFFFFFFU - count) * (HZ / 5);
+-	count = (count / 256) * mpcore_margin;
++	count = (twd_timer_get_rate() / 256) * mpcore_margin;
+ 
+ 	/* Reload the counter */
+ 	writel(count + wdt->perturb, wdt->base + TWD_WDOG_LOAD);
diff --git a/target/linux/generic/patches-3.3/993-mpcore_wdt_fix_wdioc_setoptions_handling.patch b/target/linux/generic/patches-3.3/993-mpcore_wdt_fix_wdioc_setoptions_handling.patch
new file mode 100644
index 0000000..fa261ce
--- /dev/null
+++ b/target/linux/generic/patches-3.3/993-mpcore_wdt_fix_wdioc_setoptions_handling.patch
@@ -0,0 +1,29 @@
+According to the include/linux/watchdog.h WDIOC_SETOPTIONS is
+classified as 'read from device' ioctl call:
+  #define WDIOC_SETOPTIONS        _IOR(WATCHDOG_IOCTL_BASE, 4, int)
+
+However, the driver 'mpcore_wdt' performs 'copy_from_user' only if
+_IOC_WRITE is set, thus the local variable 'uarg' which is used in
+WDIOC_SETOPTIONS handling remains uninitialized.
+
+The proper way to fix this is to bind WDIOC_SETOPTIONS to _IOW,
+but this will break compatibility.
+So adding additional condition for performing 'copy_from_user'.
+
+Signed-off-by: Vitaly Kuzmichev <vkuzmichev@mvista.com>
+---
+ drivers/watchdog/mpcore_wdt.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+--- a/drivers/watchdog/mpcore_wdt.c
++++ b/drivers/watchdog/mpcore_wdt.c
+@@ -233,7 +233,8 @@ static long mpcore_wdt_ioctl(struct file
+ 	if (_IOC_DIR(cmd) && _IOC_SIZE(cmd) > sizeof(uarg))
+ 		return -ENOTTY;
+ 
+-	if (_IOC_DIR(cmd) & _IOC_WRITE) {
++	if ((_IOC_DIR(cmd) & _IOC_WRITE)
++			|| cmd == WDIOC_SETOPTIONS) {
+ 		ret = copy_from_user(&uarg, (void __user *)arg, _IOC_SIZE(cmd));
+ 		if (ret)
+ 			return -EFAULT;
diff --git a/target/linux/generic/patches-3.3/994-mpcore_wdt_fix_timer_mode_setup.patch b/target/linux/generic/patches-3.3/994-mpcore_wdt_fix_timer_mode_setup.patch
new file mode 100644
index 0000000..0090923
--- /dev/null
+++ b/target/linux/generic/patches-3.3/994-mpcore_wdt_fix_timer_mode_setup.patch
@@ -0,0 +1,57 @@
+Allow watchdog to set its iterrupt as pending when it is configured
+for timer mode (in other words, allow emitting interrupt).
+Also add macros for all Watchdog Control Register flags.
+
+Signed-off-by: Vitaly Kuzmichev <vkuzmichev@mvista.com>
+---
+ arch/arm/include/asm/smp_twd.h |    6 ++++++
+ drivers/watchdog/mpcore_wdt.c  |   15 +++++++++++----
+ 2 files changed, 17 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/include/asm/smp_twd.h
++++ b/arch/arm/include/asm/smp_twd.h
+@@ -18,6 +18,12 @@
+ #define TWD_TIMER_CONTROL_PERIODIC	(1 << 1)
+ #define TWD_TIMER_CONTROL_IT_ENABLE	(1 << 2)
+ 
++#define TWD_WDOG_CONTROL_ENABLE		(1 << 0)
++#define TWD_WDOG_CONTROL_PERIODIC	(1 << 1)
++#define TWD_WDOG_CONTROL_IT_ENABLE	(1 << 2)
++#define TWD_WDOG_CONTROL_TIMER_MODE	(0 << 3)
++#define TWD_WDOG_CONTROL_WATCHDOG_MODE	(1 << 3)
++
+ struct clock_event_device;
+ 
+ extern void __iomem *twd_base;
+--- a/drivers/watchdog/mpcore_wdt.c
++++ b/drivers/watchdog/mpcore_wdt.c
+@@ -118,18 +118,25 @@ static void mpcore_wdt_stop(struct mpcor
+ 
+ static void mpcore_wdt_start(struct mpcore_wdt *wdt)
+ {
++	u32 mode;
++
+ 	dev_printk(KERN_INFO, wdt->dev, "enabling watchdog.\n");
+ 
+ 	/* This loads the count register but does NOT start the count yet */
+ 	mpcore_wdt_keepalive(wdt);
+ 
++	/* Setup watchdog - prescale=256, enable=1 */
++	mode = (255 << 8) | TWD_WDOG_CONTROL_ENABLE;
++
+ 	if (mpcore_noboot) {
+-		/* Enable watchdog - prescale=256, watchdog mode=0, enable=1 */
+-		writel(0x0000FF01, wdt->base + TWD_WDOG_CONTROL);
++		/* timer mode, send interrupt */
++		mode |=	TWD_WDOG_CONTROL_TIMER_MODE |
++				TWD_WDOG_CONTROL_IT_ENABLE;
+ 	} else {
+-		/* Enable watchdog - prescale=256, watchdog mode=1, enable=1 */
+-		writel(0x0000FF09, wdt->base + TWD_WDOG_CONTROL);
++		/* watchdog mode */
++		mode |=	TWD_WDOG_CONTROL_WATCHDOG_MODE;
+ 	}
++	writel(mode, wdt->base + TWD_WDOG_CONTROL);
+ }
+ 
+ static int mpcore_wdt_set_heartbeat(int t)
diff --git a/target/linux/generic/patches-3.3/a01-swconfig_leds-define-leds_set_brightness.patch b/target/linux/generic/patches-3.3/a01-swconfig_leds-define-leds_set_brightness.patch
new file mode 100644
index 0000000..e9362e4
--- /dev/null
+++ b/target/linux/generic/patches-3.3/a01-swconfig_leds-define-leds_set_brightness.patch
@@ -0,0 +1,11 @@
+--- a/drivers/net/phy/swconfig_leds.c
++++ b/drivers/net/phy/swconfig_leds.c
+@@ -20,6 +20,8 @@
+ #define SWCONFIG_LED_TIMER_INTERVAL	(HZ / 10)
+ #define SWCONFIG_LED_NUM_PORTS		32
+ 
++#define led_set_brightness(_led, _switch)	led_brightness_set((_led), (_switch))
++
+ struct switch_led_trigger {
+ 	struct led_trigger trig;
+ 	struct switch_dev *swdev;
diff --git a/target/linux/generic/patches-3.3/a02-swconfig-revert-portid-snd_portid-usage.patch b/target/linux/generic/patches-3.3/a02-swconfig-revert-portid-snd_portid-usage.patch
new file mode 100644
index 0000000..e465f90
--- /dev/null
+++ b/target/linux/generic/patches-3.3/a02-swconfig-revert-portid-snd_portid-usage.patch
@@ -0,0 +1,30 @@
+reverted:
+--- a/drivers/net/phy/swconfig.c
++++ b/drivers/net/phy/swconfig.c
+@@ -376,7 +376,7 @@ swconfig_dump_attr(struct swconfig_callb
+ 	int id = cb->args[0];
+ 	void *hdr;
+ 
+-	hdr = genlmsg_put(msg, info->snd_portid, info->snd_seq, &switch_fam,
++	hdr = genlmsg_put(msg, info->snd_pid, info->snd_seq, &switch_fam,
+ 			NLM_F_MULTI, SWITCH_CMD_NEW_ATTR);
+ 	if (IS_ERR(hdr))
+ 		return -1;
+@@ -798,7 +798,7 @@ swconfig_get_attr(struct sk_buff *skb, s
+ 	if (!msg)
+ 		goto error;
+ 
+-	hdr = genlmsg_put(msg, info->snd_portid, info->snd_seq, &switch_fam,
++	hdr = genlmsg_put(msg, info->snd_pid, info->snd_seq, &switch_fam,
+ 			0, cmd);
+ 	if (IS_ERR(hdr))
+ 		goto nla_put_failure;
+@@ -883,7 +883,7 @@ static int swconfig_dump_switches(struct
+ 	list_for_each_entry(dev, &swdevs, dev_list) {
+ 		if (++idx <= start)
+ 			continue;
+-		if (swconfig_send_switch(skb, NETLINK_CB(cb->skb).portid,
++		if (swconfig_send_switch(skb, NETLINK_CB(cb->skb).pid,
+ 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
+ 				dev) < 0)
+ 			break;
diff --git a/target/linux/generic/patches-3.3/a03-swconfig-revert-UAPI-disintegration.patch b/target/linux/generic/patches-3.3/a03-swconfig-revert-UAPI-disintegration.patch
new file mode 100644
index 0000000..569fd0c
--- /dev/null
+++ b/target/linux/generic/patches-3.3/a03-swconfig-revert-UAPI-disintegration.patch
@@ -0,0 +1,100 @@
+--- a/include/linux/switch.h
++++ b/include/linux/switch.h
+@@ -13,11 +13,86 @@
+  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  * GNU General Public License for more details.
+  */
+-#ifndef _LINUX_SWITCH_H
+-#define _LINUX_SWITCH_H
+ 
++#ifndef __LINUX_SWITCH_H
++#define __LINUX_SWITCH_H
++
++#include <linux/types.h>
++#include <linux/netdevice.h>
++#include <linux/netlink.h>
++#include <linux/genetlink.h>
++#ifndef __KERNEL__
++#include <netlink/netlink.h>
++#include <netlink/genl/genl.h>
++#include <netlink/genl/ctrl.h>
++#else
+ #include <net/genetlink.h>
+-#include <uapi/linux/switch.h>
++#endif
++
++/* main attributes */
++enum {
++	SWITCH_ATTR_UNSPEC,
++	/* global */
++	SWITCH_ATTR_TYPE,
++	/* device */
++	SWITCH_ATTR_ID,
++	SWITCH_ATTR_DEV_NAME,
++	SWITCH_ATTR_ALIAS,
++	SWITCH_ATTR_NAME,
++	SWITCH_ATTR_VLANS,
++	SWITCH_ATTR_PORTS,
++	SWITCH_ATTR_CPU_PORT,
++	/* attributes */
++	SWITCH_ATTR_OP_ID,
++	SWITCH_ATTR_OP_TYPE,
++	SWITCH_ATTR_OP_NAME,
++	SWITCH_ATTR_OP_PORT,
++	SWITCH_ATTR_OP_VLAN,
++	SWITCH_ATTR_OP_VALUE_INT,
++	SWITCH_ATTR_OP_VALUE_STR,
++	SWITCH_ATTR_OP_VALUE_PORTS,
++	SWITCH_ATTR_OP_DESCRIPTION,
++	/* port lists */
++	SWITCH_ATTR_PORT,
++	SWITCH_ATTR_MAX
++};
++
++/* commands */
++enum {
++	SWITCH_CMD_UNSPEC,
++	SWITCH_CMD_GET_SWITCH,
++	SWITCH_CMD_NEW_ATTR,
++	SWITCH_CMD_LIST_GLOBAL,
++	SWITCH_CMD_GET_GLOBAL,
++	SWITCH_CMD_SET_GLOBAL,
++	SWITCH_CMD_LIST_PORT,
++	SWITCH_CMD_GET_PORT,
++	SWITCH_CMD_SET_PORT,
++	SWITCH_CMD_LIST_VLAN,
++	SWITCH_CMD_GET_VLAN,
++	SWITCH_CMD_SET_VLAN
++};
++
++/* data types */
++enum switch_val_type {
++	SWITCH_TYPE_UNSPEC,
++	SWITCH_TYPE_INT,
++	SWITCH_TYPE_STRING,
++	SWITCH_TYPE_PORTS,
++	SWITCH_TYPE_NOVAL,
++};
++
++/* port nested attributes */
++enum {
++	SWITCH_PORT_UNSPEC,
++	SWITCH_PORT_ID,
++	SWITCH_PORT_FLAG_TAGGED,
++	SWITCH_PORT_ATTR_MAX
++};
++
++#define SWITCH_ATTR_DEFAULTS_OFFSET	0x1000
++
++#ifdef __KERNEL__
+ 
+ struct switch_dev;
+ struct switch_op;
+@@ -157,4 +232,6 @@ struct switch_attr {
+ 	int max;
+ };
+ 
+-#endif /* _LINUX_SWITCH_H */
++#endif
++
++#endif